* [PATCH 6.13 001/443] irqchip/lan966x-oic: Make CONFIG_LAN966X_OIC depend on CONFIG_MCHP_LAN966X_PCI
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 002/443] btrfs: fix lockdep splat while merging a relocation root Greg Kroah-Hartman
` (452 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Thomas Gleixner,
Herve Codina, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit e06c9e3682f58fbeb632b7b866bb4fe66a4a4b42 ]
The Microchip LAN966x outband interrupt controller is only present on
Microchip LAN966x SoCs, and only used in PCI endpoint mode. Hence add a
dependency on MCHP_LAN966X_PCI, to prevent asking the user about this
driver when configuring a kernel without Microchip LAN966x PCIe support.
Fixes: 3e3a7b35332924c8 ("irqchip: Add support for LAN966x OIC")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Herve Codina <herve.codina@bootlin.com>
Link: https://lore.kernel.org/all/28e8a605e72ee45e27f0d06b2b71366159a9c782.1737383314.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index 9bee02db16439..990674713b863 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -169,6 +169,7 @@ config IXP4XX_IRQ
config LAN966X_OIC
tristate "Microchip LAN966x OIC Support"
+ depends on MCHP_LAN966X_PCI || COMPILE_TEST
select GENERIC_IRQ_CHIP
select IRQ_DOMAIN
help
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 002/443] btrfs: fix lockdep splat while merging a relocation root
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 001/443] irqchip/lan966x-oic: Make CONFIG_LAN966X_OIC depend on CONFIG_MCHP_LAN966X_PCI Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 003/443] btrfs: fix assertion failure when splitting ordered extent after transaction abort Greg Kroah-Hartman
` (451 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+63913e558c084f7f8fdc,
Filipe Manana, David Sterba, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit a216542027b892e6651c1b4e076012140d04afaf ]
When COWing a relocation tree path, at relocation.c:replace_path(), we
can trigger a lockdep splat while we are in the btrfs_search_slot() call
against the relocation root. This happens in that callchain at
ctree.c:read_block_for_search() when we happen to find a child extent
buffer already loaded through the fs tree with a lockdep class set to
the fs tree. So when we attempt to lock that extent buffer through a
relocation tree we have to reset the lockdep class to the class for a
relocation tree, since a relocation tree has extent buffers that used
to belong to a fs tree and may currently be already loaded (we swap
extent buffers between the two trees at the end of replace_path()).
However we are missing calls to btrfs_maybe_reset_lockdep_class() to reset
the lockdep class at ctree.c:read_block_for_search() before we read lock
an extent buffer, just like we did for btrfs_search_slot() in commit
b40130b23ca4 ("btrfs: fix lockdep splat with reloc root extent buffers").
So add the missing btrfs_maybe_reset_lockdep_class() calls before the
attempts to read lock an extent buffer at ctree.c:read_block_for_search().
The lockdep splat was reported by syzbot and it looks like this:
======================================================
WARNING: possible circular locking dependency detected
6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 Not tainted
------------------------------------------------------
syz.0.0/5335 is trying to acquire lock:
ffff8880545dbc38 (btrfs-tree-01){++++}-{4:4}, at: btrfs_tree_read_lock_nested+0x2f/0x250 fs/btrfs/locking.c:146
but task is already holding lock:
ffff8880545dba58 (btrfs-treloc-02/1){+.+.}-{4:4}, at: btrfs_tree_lock_nested+0x2f/0x250 fs/btrfs/locking.c:189
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (btrfs-treloc-02/1){+.+.}-{4:4}:
reacquire_held_locks+0x3eb/0x690 kernel/locking/lockdep.c:5374
__lock_release kernel/locking/lockdep.c:5563 [inline]
lock_release+0x396/0xa30 kernel/locking/lockdep.c:5870
up_write+0x79/0x590 kernel/locking/rwsem.c:1629
btrfs_force_cow_block+0x14b3/0x1fd0 fs/btrfs/ctree.c:660
btrfs_cow_block+0x371/0x830 fs/btrfs/ctree.c:755
btrfs_search_slot+0xc01/0x3180 fs/btrfs/ctree.c:2153
replace_path+0x1243/0x2740 fs/btrfs/relocation.c:1224
merge_reloc_root+0xc46/0x1ad0 fs/btrfs/relocation.c:1692
merge_reloc_roots+0x3b3/0x980 fs/btrfs/relocation.c:1942
relocate_block_group+0xb0a/0xd40 fs/btrfs/relocation.c:3754
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4087
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3494
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4278
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4655
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #1 (btrfs-tree-01/1){+.+.}-{4:4}:
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
down_write_nested+0xa2/0x220 kernel/locking/rwsem.c:1693
btrfs_tree_lock_nested+0x2f/0x250 fs/btrfs/locking.c:189
btrfs_init_new_buffer fs/btrfs/extent-tree.c:5052 [inline]
btrfs_alloc_tree_block+0x41c/0x1440 fs/btrfs/extent-tree.c:5132
btrfs_force_cow_block+0x526/0x1fd0 fs/btrfs/ctree.c:573
btrfs_cow_block+0x371/0x830 fs/btrfs/ctree.c:755
btrfs_search_slot+0xc01/0x3180 fs/btrfs/ctree.c:2153
btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4351
btrfs_insert_empty_item fs/btrfs/ctree.h:688 [inline]
btrfs_insert_inode_ref+0x2bb/0xf80 fs/btrfs/inode-item.c:330
btrfs_rename_exchange fs/btrfs/inode.c:7990 [inline]
btrfs_rename2+0xcb7/0x2b90 fs/btrfs/inode.c:8374
vfs_rename+0xbdb/0xf00 fs/namei.c:5067
do_renameat2+0xd94/0x13f0 fs/namei.c:5224
__do_sys_renameat2 fs/namei.c:5258 [inline]
__se_sys_renameat2 fs/namei.c:5255 [inline]
__x64_sys_renameat2+0xce/0xe0 fs/namei.c:5255
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
-> #0 (btrfs-tree-01){++++}-{4:4}:
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
down_read_nested+0xb5/0xa50 kernel/locking/rwsem.c:1649
btrfs_tree_read_lock_nested+0x2f/0x250 fs/btrfs/locking.c:146
btrfs_tree_read_lock fs/btrfs/locking.h:188 [inline]
read_block_for_search+0x718/0xbb0 fs/btrfs/ctree.c:1610
btrfs_search_slot+0x1274/0x3180 fs/btrfs/ctree.c:2237
replace_path+0x1243/0x2740 fs/btrfs/relocation.c:1224
merge_reloc_root+0xc46/0x1ad0 fs/btrfs/relocation.c:1692
merge_reloc_roots+0x3b3/0x980 fs/btrfs/relocation.c:1942
relocate_block_group+0xb0a/0xd40 fs/btrfs/relocation.c:3754
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4087
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3494
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4278
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4655
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
other info that might help us debug this:
Chain exists of:
btrfs-tree-01 --> btrfs-tree-01/1 --> btrfs-treloc-02/1
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(btrfs-treloc-02/1);
lock(btrfs-tree-01/1);
lock(btrfs-treloc-02/1);
rlock(btrfs-tree-01);
*** DEADLOCK ***
8 locks held by syz.0.0/5335:
#0: ffff88801e3ae420 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write_file+0x5e/0x200 fs/namespace.c:559
#1: ffff888052c760d0 (&fs_info->reclaim_bgs_lock){+.+.}-{4:4}, at: __btrfs_balance+0x4c2/0x26b0 fs/btrfs/volumes.c:4183
#2: ffff888052c74850 (&fs_info->cleaner_mutex){+.+.}-{4:4}, at: btrfs_relocate_block_group+0x775/0xd90 fs/btrfs/relocation.c:4086
#3: ffff88801e3ae610 (sb_internal#2){.+.+}-{0:0}, at: merge_reloc_root+0xf11/0x1ad0 fs/btrfs/relocation.c:1659
#4: ffff888052c76470 (btrfs_trans_num_writers){++++}-{0:0}, at: join_transaction+0x405/0xda0 fs/btrfs/transaction.c:288
#5: ffff888052c76498 (btrfs_trans_num_extwriters){++++}-{0:0}, at: join_transaction+0x405/0xda0 fs/btrfs/transaction.c:288
#6: ffff8880545db878 (btrfs-tree-01/1){+.+.}-{4:4}, at: btrfs_tree_lock_nested+0x2f/0x250 fs/btrfs/locking.c:189
#7: ffff8880545dba58 (btrfs-treloc-02/1){+.+.}-{4:4}, at: btrfs_tree_lock_nested+0x2f/0x250 fs/btrfs/locking.c:189
stack backtrace:
CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
check_prev_add kernel/locking/lockdep.c:3161 [inline]
check_prevs_add kernel/locking/lockdep.c:3280 [inline]
validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
__lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
down_read_nested+0xb5/0xa50 kernel/locking/rwsem.c:1649
btrfs_tree_read_lock_nested+0x2f/0x250 fs/btrfs/locking.c:146
btrfs_tree_read_lock fs/btrfs/locking.h:188 [inline]
read_block_for_search+0x718/0xbb0 fs/btrfs/ctree.c:1610
btrfs_search_slot+0x1274/0x3180 fs/btrfs/ctree.c:2237
replace_path+0x1243/0x2740 fs/btrfs/relocation.c:1224
merge_reloc_root+0xc46/0x1ad0 fs/btrfs/relocation.c:1692
merge_reloc_roots+0x3b3/0x980 fs/btrfs/relocation.c:1942
relocate_block_group+0xb0a/0xd40 fs/btrfs/relocation.c:3754
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4087
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3494
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4278
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4655
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1ac6985d29
Code: ff ff c3 (...)
RSP: 002b:00007f1ac63fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1ac6b76160 RCX: 00007f1ac6985d29
RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000007
RBP: 00007f1ac6a01b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f1ac6b76160 R15: 00007fffda145a88
</TASK>
Reported-by: syzbot+63913e558c084f7f8fdc@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/677b3014.050a0220.3b53b0.0064.GAE@google.com/
Fixes: 99785998ed1c ("btrfs: reduce lock contention when eb cache miss for btree search")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ctree.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 185985a337b30..5d2613b16cd24 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1563,6 +1563,7 @@ read_block_for_search(struct btrfs_root *root, struct btrfs_path *p,
if (!p->skip_locking) {
btrfs_unlock_up_safe(p, parent_level + 1);
+ btrfs_maybe_reset_lockdep_class(root, tmp);
tmp_locked = true;
btrfs_tree_read_lock(tmp);
btrfs_release_path(p);
@@ -1606,6 +1607,7 @@ read_block_for_search(struct btrfs_root *root, struct btrfs_path *p,
if (!p->skip_locking) {
ASSERT(ret == -EAGAIN);
+ btrfs_maybe_reset_lockdep_class(root, tmp);
tmp_locked = true;
btrfs_tree_read_lock(tmp);
btrfs_release_path(p);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 003/443] btrfs: fix assertion failure when splitting ordered extent after transaction abort
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 001/443] irqchip/lan966x-oic: Make CONFIG_LAN966X_OIC depend on CONFIG_MCHP_LAN966X_PCI Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 002/443] btrfs: fix lockdep splat while merging a relocation root Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 004/443] btrfs: do not output error message if a qgroup has been already cleaned up Greg Kroah-Hartman
` (450 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f60d8337a5c8e8d92a77,
Qu Wenruo, Filipe Manana, David Sterba, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 0d85f5c2dd91df6b5da454406756f463ba923b69 ]
If while we are doing a direct IO write a transaction abort happens, we
mark all existing ordered extents with the BTRFS_ORDERED_IOERR flag (done
at btrfs_destroy_ordered_extents()), and then after that if we enter
btrfs_split_ordered_extent() and the ordered extent has bytes left
(meaning we have a bio that doesn't cover the whole ordered extent, see
details at btrfs_extract_ordered_extent()), we will fail on the following
assertion at btrfs_split_ordered_extent():
ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS));
because the BTRFS_ORDERED_IOERR flag is set and the definition of
BTRFS_ORDERED_TYPE_FLAGS is just the union of all flags that identify the
type of write (regular, nocow, prealloc, compressed, direct IO, encoded).
Fix this by returning an error from btrfs_extract_ordered_extent() if we
find the BTRFS_ORDERED_IOERR flag in the ordered extent. The error will
be the error that resulted in the transaction abort or -EIO if no
transaction abort happened.
This was recently reported by syzbot with the following trace:
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
fail_dump lib/fault-inject.c:53 [inline]
should_fail_ex+0x3b0/0x4e0 lib/fault-inject.c:154
should_failslab+0xac/0x100 mm/failslab.c:46
slab_pre_alloc_hook mm/slub.c:4072 [inline]
slab_alloc_node mm/slub.c:4148 [inline]
__do_kmalloc_node mm/slub.c:4297 [inline]
__kmalloc_noprof+0xdd/0x4c0 mm/slub.c:4310
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
btrfs_chunk_alloc_add_chunk_item+0x244/0x1100 fs/btrfs/volumes.c:5742
reserve_chunk_space+0x1ca/0x2c0 fs/btrfs/block-group.c:4292
check_system_chunk fs/btrfs/block-group.c:4319 [inline]
do_chunk_alloc fs/btrfs/block-group.c:3891 [inline]
btrfs_chunk_alloc+0x77b/0xf80 fs/btrfs/block-group.c:4187
find_free_extent_update_loop fs/btrfs/extent-tree.c:4166 [inline]
find_free_extent+0x42d1/0x5810 fs/btrfs/extent-tree.c:4579
btrfs_reserve_extent+0x422/0x810 fs/btrfs/extent-tree.c:4672
btrfs_new_extent_direct fs/btrfs/direct-io.c:186 [inline]
btrfs_get_blocks_direct_write+0x706/0xfa0 fs/btrfs/direct-io.c:321
btrfs_dio_iomap_begin+0xbb7/0x1180 fs/btrfs/direct-io.c:525
iomap_iter+0x697/0xf60 fs/iomap/iter.c:90
__iomap_dio_rw+0xeb9/0x25b0 fs/iomap/direct-io.c:702
btrfs_dio_write fs/btrfs/direct-io.c:775 [inline]
btrfs_direct_write+0x610/0xa30 fs/btrfs/direct-io.c:880
btrfs_do_write_iter+0x2a0/0x760 fs/btrfs/file.c:1397
do_iter_readv_writev+0x600/0x880
vfs_writev+0x376/0xba0 fs/read_write.c:1050
do_pwritev fs/read_write.c:1146 [inline]
__do_sys_pwritev2 fs/read_write.c:1204 [inline]
__se_sys_pwritev2+0x196/0x2b0 fs/read_write.c:1195
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1281f85d29
RSP: 002b:00007f12819fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
RAX: ffffffffffffffda RBX: 00007f1282176080 RCX: 00007f1281f85d29
RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000005
RBP: 00007f12819fe090 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000002
R13: 0000000000000000 R14: 00007f1282176080 R15: 00007ffcb9e23328
</TASK>
BTRFS error (device loop0 state A): Transaction aborted (error -12)
BTRFS: error (device loop0 state A) in btrfs_chunk_alloc_add_chunk_item:5745: errno=-12 Out of memory
BTRFS info (device loop0 state EA): forced readonly
assertion failed: !(flags & ~BTRFS_ORDERED_TYPE_FLAGS), in fs/btrfs/ordered-data.c:1234
------------[ cut here ]------------
kernel BUG at fs/btrfs/ordered-data.c:1234!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted 6.13.0-rc5-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:btrfs_split_ordered_extent+0xd8d/0xe20 fs/btrfs/ordered-data.c:1234
RSP: 0018:ffffc9000d1df2b8 EFLAGS: 00010246
RAX: 0000000000000057 RBX: 000000000006a000 RCX: 9ce21886c4195300
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000091 R08: ffffffff817f0a3c R09: 1ffff92001a3bdf4
R10: dffffc0000000000 R11: fffff52001a3bdf5 R12: 1ffff1100a45f401
R13: ffff8880522fa018 R14: dffffc0000000000 R15: 000000000006a000
FS: 00007f12819fe6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557750bd7da8 CR3: 00000000400ea000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
btrfs_extract_ordered_extent fs/btrfs/direct-io.c:702 [inline]
btrfs_dio_submit_io+0x4be/0x6d0 fs/btrfs/direct-io.c:737
iomap_dio_submit_bio fs/iomap/direct-io.c:85 [inline]
iomap_dio_bio_iter+0x1022/0x1740 fs/iomap/direct-io.c:447
__iomap_dio_rw+0x13b7/0x25b0 fs/iomap/direct-io.c:703
btrfs_dio_write fs/btrfs/direct-io.c:775 [inline]
btrfs_direct_write+0x610/0xa30 fs/btrfs/direct-io.c:880
btrfs_do_write_iter+0x2a0/0x760 fs/btrfs/file.c:1397
do_iter_readv_writev+0x600/0x880
vfs_writev+0x376/0xba0 fs/read_write.c:1050
do_pwritev fs/read_write.c:1146 [inline]
__do_sys_pwritev2 fs/read_write.c:1204 [inline]
__se_sys_pwritev2+0x196/0x2b0 fs/read_write.c:1195
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1281f85d29
RSP: 002b:00007f12819fe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
RAX: ffffffffffffffda RBX: 00007f1282176080 RCX: 00007f1281f85d29
RDX: 0000000000000001 RSI: 0000000020000240 RDI: 0000000000000005
RBP: 00007f12819fe090 R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000002
R13: 0000000000000000 R14: 00007f1282176080 R15: 00007ffcb9e23328
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:btrfs_split_ordered_extent+0xd8d/0xe20 fs/btrfs/ordered-data.c:1234
RSP: 0018:ffffc9000d1df2b8 EFLAGS: 00010246
RAX: 0000000000000057 RBX: 000000000006a000 RCX: 9ce21886c4195300
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000091 R08: ffffffff817f0a3c R09: 1ffff92001a3bdf4
R10: dffffc0000000000 R11: fffff52001a3bdf5 R12: 1ffff1100a45f401
R13: ffff8880522fa018 R14: dffffc0000000000 R15: 000000000006a000
FS: 00007f12819fe6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557750bd7da8 CR3: 00000000400ea000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
In this case the transaction abort was due to (an injected) memory
allocation failure when attempting to allocate a new chunk.
Reported-by: syzbot+f60d8337a5c8e8d92a77@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/6777f2dd.050a0220.178762.0045.GAE@google.com/
Fixes: 52b1fdca23ac ("btrfs: handle completed ordered extents in btrfs_split_ordered_extent")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ordered-data.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 30eceaf829a7e..4aca7475fd82c 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -1229,6 +1229,18 @@ struct btrfs_ordered_extent *btrfs_split_ordered_extent(
*/
if (WARN_ON_ONCE(len >= ordered->num_bytes))
return ERR_PTR(-EINVAL);
+ /*
+ * If our ordered extent had an error there's no point in continuing.
+ * The error may have come from a transaction abort done either by this
+ * task or some other concurrent task, and the transaction abort path
+ * iterates over all existing ordered extents and sets the flag
+ * BTRFS_ORDERED_IOERR on them.
+ */
+ if (unlikely(flags & (1U << BTRFS_ORDERED_IOERR))) {
+ const int fs_error = BTRFS_FS_ERROR(fs_info);
+
+ return fs_error ? ERR_PTR(fs_error) : ERR_PTR(-EIO);
+ }
/* We cannot split partially completed ordered extents. */
if (ordered->bytes_left) {
ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS));
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 004/443] btrfs: do not output error message if a qgroup has been already cleaned up
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 003/443] btrfs: fix assertion failure when splitting ordered extent after transaction abort Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 005/443] btrfs: fix use-after-free when attempting to join an aborted transaction Greg Kroah-Hartman
` (449 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Shand, Filipe Manana, Qu Wenruo,
David Sterba, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit c9c863793395cf0a66c2778a29d72c48c02fbb66 ]
[BUG]
There is a bug report that btrfs outputs the following error message:
BTRFS info (device nvme0n1p2): qgroup scan completed (inconsistency flag cleared)
BTRFS warning (device nvme0n1p2): failed to cleanup qgroup 0/1179: -2
[CAUSE]
The error itself is pretty harmless, and the end user should ignore it.
When a subvolume is fully dropped, btrfs will call
btrfs_qgroup_cleanup_dropped_subvolume() to delete the qgroup.
However if a qgroup rescan happened before a subvolume fully dropped,
qgroup for that subvolume will not be re-created, as rescan will only
create new qgroup if there is a BTRFS_ROOT_REF_KEY found.
But before we drop a subvolume, the subvolume is unlinked thus there is no
BTRFS_ROOT_REF_KEY.
In that case, btrfs_remove_qgroup() will fail with -ENOENT and trigger
the above error message.
[FIX]
Just ignore -ENOENT error from btrfs_remove_qgroup() inside
btrfs_qgroup_cleanup_dropped_subvolume().
Reported-by: John Shand <jshand2013@gmail.com>
Link: https://bugzilla.suse.com/show_bug.cgi?id=1236056
Fixes: 839d6ea4f86d ("btrfs: automatically remove the subvolume qgroup")
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/qgroup.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 993b5e803699e..5ab51781d0e4f 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1915,8 +1915,11 @@ int btrfs_qgroup_cleanup_dropped_subvolume(struct btrfs_fs_info *fs_info, u64 su
/*
* It's squota and the subvolume still has numbers needed for future
* accounting, in this case we can not delete it. Just skip it.
+ *
+ * Or the qgroup is already removed by a qgroup rescan. For both cases we're
+ * safe to ignore them.
*/
- if (ret == -EBUSY)
+ if (ret == -EBUSY || ret == -ENOENT)
ret = 0;
return ret;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 005/443] btrfs: fix use-after-free when attempting to join an aborted transaction
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 004/443] btrfs: do not output error message if a qgroup has been already cleaned up Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 006/443] arm64/mm: Ensure adequate HUGE_MAX_HSTATE Greg Kroah-Hartman
` (448 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+45212e9d87a98c3f5b42,
Dmitry Vyukov, Johannes Thumshirn, Qu Wenruo, Filipe Manana,
David Sterba, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit e2f0943cf37305dbdeaf9846e3c941451bcdef63 ]
When we are trying to join the current transaction and if it's aborted,
we read its 'aborted' field after unlocking fs_info->trans_lock and
without holding any extra reference count on it. This means that a
concurrent task that is aborting the transaction may free the transaction
before we read its 'aborted' field, leading to a use-after-free.
Fix this by reading the 'aborted' field while holding fs_info->trans_lock
since any freeing task must first acquire that lock and set
fs_info->running_transaction to NULL before freeing the transaction.
This was reported by syzbot and Dmitry with the following stack traces
from KASAN:
==================================================================
BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278
Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128
CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound btrfs_async_reclaim_data_space
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602
join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278
start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697
flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803
btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 5315:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329
kmalloc_noprof include/linux/slab.h:901 [inline]
join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308
start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697
btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572
lookup_open fs/namei.c:3649 [inline]
open_last_lookups fs/namei.c:3748 [inline]
path_openat+0x1c03/0x3590 fs/namei.c:3984
do_filp_open+0x27f/0x4e0 fs/namei.c:4014
do_sys_openat2+0x13e/0x1d0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_creat fs/open.c:1495 [inline]
__se_sys_creat fs/open.c:1489 [inline]
__x64_sys_creat+0x123/0x170 fs/open.c:1489
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5336:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4613 [inline]
kfree+0x196/0x430 mm/slub.c:4761
cleanup_transaction fs/btrfs/transaction.c:2063 [inline]
btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598
insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757
btrfs_balance+0x992/0x10c0 fs/btrfs/volumes.c:4633
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888011839000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 36 bytes inside of
freed 2048-byte region [ffff888011839000, ffff888011839800)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11838
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002
raw: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000
head: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002
head: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000
head: 00fff00000000003 ffffea0000460e01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 57, tgid 57 (kworker/0:2), ts 67248182943, free_ts 67229742023
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
prep_new_page mm/page_alloc.c:1566 [inline]
get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269
alloc_slab_page+0x6a/0x110 mm/slub.c:2423
allocate_slab+0x5a/0x2b0 mm/slub.c:2589
new_slab mm/slub.c:2642 [inline]
___slab_alloc+0xc27/0x14a0 mm/slub.c:3830
__slab_alloc+0x58/0xa0 mm/slub.c:3920
__slab_alloc_node mm/slub.c:3995 [inline]
slab_alloc_node mm/slub.c:4156 [inline]
__do_kmalloc_node mm/slub.c:4297 [inline]
__kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317
kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609
__alloc_skb+0x1f3/0x440 net/core/skbuff.c:678
alloc_skb include/linux/skbuff.h:1323 [inline]
alloc_skb_with_frags+0xc3/0x820 net/core/skbuff.c:6612
sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2884
sock_alloc_send_skb include/net/sock.h:1803 [inline]
mld_newpack+0x1c3/0xaf0 net/ipv6/mcast.c:1747
add_grhead net/ipv6/mcast.c:1850 [inline]
add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1988
mld_send_cr net/ipv6/mcast.c:2114 [inline]
mld_ifc_work+0x691/0xd90 net/ipv6/mcast.c:2651
page last free pid 5300 tgid 5300 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2659
__slab_free+0x2c2/0x380 mm/slub.c:4524
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4119 [inline]
slab_alloc_node mm/slub.c:4168 [inline]
__do_kmalloc_node mm/slub.c:4297 [inline]
__kmalloc_noprof+0x236/0x4c0 mm/slub.c:4310
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
fib_create_info+0xc14/0x25b0 net/ipv4/fib_semantics.c:1435
fib_table_insert+0x1f6/0x1f20 net/ipv4/fib_trie.c:1231
fib_magic+0x3d8/0x620 net/ipv4/fib_frontend.c:1112
fib_add_ifaddr+0x40c/0x5e0 net/ipv4/fib_frontend.c:1156
fib_netdev_event+0x375/0x490 net/ipv4/fib_frontend.c:1494
notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
__dev_notify_flags+0x207/0x400
dev_change_flags+0xf0/0x1a0 net/core/dev.c:9045
do_setlink+0xc90/0x4210 net/core/rtnetlink.c:3109
rtnl_changelink net/core/rtnetlink.c:3723 [inline]
__rtnl_newlink net/core/rtnetlink.c:3875 [inline]
rtnl_newlink+0x1bb6/0x2210 net/core/rtnetlink.c:4012
Memory state around the buggy address:
ffff888011838f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888011838f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888011839000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888011839080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888011839100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Reported-by: syzbot+45212e9d87a98c3f5b42@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/678e7da5.050a0220.303755.007c.GAE@google.com/
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Link: https://lore.kernel.org/linux-btrfs/CACT4Y+ZFBdo7pT8L2AzM=vegZwjp-wNkVJZQf0Ta3vZqtExaSw@mail.gmail.com/
Fixes: 871383be592b ("btrfs: add missing unlocks to transaction abort paths")
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/transaction.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index dc0b837efd5df..914a22cc950b5 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -274,8 +274,10 @@ static noinline int join_transaction(struct btrfs_fs_info *fs_info,
cur_trans = fs_info->running_transaction;
if (cur_trans) {
if (TRANS_ABORTED(cur_trans)) {
+ const int abort_error = cur_trans->aborted;
+
spin_unlock(&fs_info->trans_lock);
- return cur_trans->aborted;
+ return abort_error;
}
if (btrfs_blocked_trans_types[cur_trans->state] & type) {
spin_unlock(&fs_info->trans_lock);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 006/443] arm64/mm: Ensure adequate HUGE_MAX_HSTATE
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 005/443] btrfs: fix use-after-free when attempting to join an aborted transaction Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 007/443] exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case Greg Kroah-Hartman
` (447 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Catalin Marinas, Will Deacon,
Ard Biesheuvel, Ryan Roberts, Mark Rutland, linux-arm-kernel,
linux-kernel, Anshuman Khandual, Gavin Shan, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anshuman Khandual <anshuman.khandual@arm.com>
[ Upstream commit 1e5823c8e86de83a43d59a522b4de29066d3b306 ]
This asserts that HUGE_MAX_HSTATE is sufficient enough preventing potential
hugetlb_max_hstate runtime overflow in hugetlb_add_hstate() thus triggering
a BUG_ON() there after.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Link: https://lore.kernel.org/r/20241202064407.53807-1-anshuman.khandual@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/hugetlbpage.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 3215adf48a1b6..98a2a0e64e255 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -519,6 +519,18 @@ pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
static int __init hugetlbpage_init(void)
{
+ /*
+ * HugeTLB pages are supported on maximum four page table
+ * levels (PUD, CONT PMD, PMD, CONT PTE) for a given base
+ * page size, corresponding to hugetlb_add_hstate() calls
+ * here.
+ *
+ * HUGE_MAX_HSTATE should at least match maximum supported
+ * HugeTLB page sizes on the platform. Any new addition to
+ * supported HugeTLB page sizes will also require changing
+ * HUGE_MAX_HSTATE as well.
+ */
+ BUILD_BUG_ON(HUGE_MAX_HSTATE < 4);
if (pud_sect_supported())
hugetlb_add_hstate(PUD_SHIFT - PAGE_SHIFT);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 007/443] exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 006/443] arm64/mm: Ensure adequate HUGE_MAX_HSTATE Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 008/443] s390/stackleak: Use exrl instead of ex in __stackleak_poison() Greg Kroah-Hartman
` (446 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zbigniew Jędrzejewski-Szmek,
Tycho Andersen, Al Viro, Linus Torvalds, Aleksa Sarai, Kees Cook,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <kees@kernel.org>
[ Upstream commit 543841d1806029889c2f69f040e88b247aba8e22 ]
Zbigniew mentioned at Linux Plumber's that systemd is interested in
switching to execveat() for service execution, but can't, because the
contents of /proc/pid/comm are the file descriptor which was used,
instead of the path to the binary[1]. This makes the output of tools like
top and ps useless, especially in a world where most fds are opened
CLOEXEC so the number is truly meaningless.
When the filename passed in is empty (e.g. with AT_EMPTY_PATH), use the
dentry's filename for "comm" instead of using the useless numeral from
the synthetic fdpath construction. This way the actual exec machinery
is unchanged, but cosmetically the comm looks reasonable to admins
investigating things.
Instead of adding TASK_COMM_LEN more bytes to bprm, use one of the unused
flag bits to indicate that we need to set "comm" from the dentry.
Suggested-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Suggested-by: Tycho Andersen <tandersen@netflix.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://github.com/uapi-group/kernel-features#set-comm-field-before-exec [1]
Reviewed-by: Aleksa Sarai <cyphar@cyphar.com>
Tested-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exec.c | 29 ++++++++++++++++++++++++++---
include/linux/binfmts.h | 4 +++-
2 files changed, 29 insertions(+), 4 deletions(-)
diff --git a/fs/exec.c b/fs/exec.c
index 98cb7ba9983c7..b1f6b47ad20e1 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1341,7 +1341,28 @@ int begin_new_exec(struct linux_binprm * bprm)
set_dumpable(current->mm, SUID_DUMP_USER);
perf_event_exec();
- __set_task_comm(me, kbasename(bprm->filename), true);
+
+ /*
+ * If the original filename was empty, alloc_bprm() made up a path
+ * that will probably not be useful to admins running ps or similar.
+ * Let's fix it up to be something reasonable.
+ */
+ if (bprm->comm_from_dentry) {
+ /*
+ * Hold RCU lock to keep the name from being freed behind our back.
+ * Use acquire semantics to make sure the terminating NUL from
+ * __d_alloc() is seen.
+ *
+ * Note, we're deliberately sloppy here. We don't need to care about
+ * detecting a concurrent rename and just want a terminated name.
+ */
+ rcu_read_lock();
+ __set_task_comm(me, smp_load_acquire(&bprm->file->f_path.dentry->d_name.name),
+ true);
+ rcu_read_unlock();
+ } else {
+ __set_task_comm(me, kbasename(bprm->filename), true);
+ }
/* An exec changes our domain. We are no longer part of the thread
group */
@@ -1517,11 +1538,13 @@ static struct linux_binprm *alloc_bprm(int fd, struct filename *filename, int fl
if (fd == AT_FDCWD || filename->name[0] == '/') {
bprm->filename = filename->name;
} else {
- if (filename->name[0] == '\0')
+ if (filename->name[0] == '\0') {
bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d", fd);
- else
+ bprm->comm_from_dentry = 1;
+ } else {
bprm->fdpath = kasprintf(GFP_KERNEL, "/dev/fd/%d/%s",
fd, filename->name);
+ }
if (!bprm->fdpath)
goto out_free;
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index e6c00e860951a..3305c849abd66 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -42,7 +42,9 @@ struct linux_binprm {
* Set when errors can no longer be returned to the
* original userspace.
*/
- point_of_no_return:1;
+ point_of_no_return:1,
+ /* Set when "comm" must come from the dentry. */
+ comm_from_dentry:1;
struct file *executable; /* Executable to pass to the interpreter */
struct file *interpreter;
struct file *file;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 008/443] s390/stackleak: Use exrl instead of ex in __stackleak_poison()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 007/443] exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 009/443] btrfs: fix data race when accessing the inodes disk_i_size at btrfs_drop_extents() Greg Kroah-Hartman
` (445 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sven Schnelle, Heiko Carstens,
Alexander Gordeev, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Schnelle <svens@linux.ibm.com>
[ Upstream commit a88c26bb8e04ee5f2678225c0130a5fbc08eef85 ]
exrl is present in all machines currently supported, therefore prefer
it over ex. This saves one instruction and doesn't need an additional
register to hold the address of the target instruction.
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/include/asm/processor.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 8761fd01a9f09..4f8d5592c2981 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -163,8 +163,7 @@ static __always_inline void __stackleak_poison(unsigned long erase_low,
" la %[addr],256(%[addr])\n"
" brctg %[tmp],0b\n"
"1: stg %[poison],0(%[addr])\n"
- " larl %[tmp],3f\n"
- " ex %[count],0(%[tmp])\n"
+ " exrl %[count],3f\n"
" j 4f\n"
"2: stg %[poison],0(%[addr])\n"
" j 4f\n"
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 009/443] btrfs: fix data race when accessing the inodes disk_i_size at btrfs_drop_extents()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 008/443] s390/stackleak: Use exrl instead of ex in __stackleak_poison() Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 010/443] btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling Greg Kroah-Hartman
` (444 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, Hao-ran Zheng,
David Sterba, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-ran Zheng <zhenghaoran154@gmail.com>
[ Upstream commit 5324c4e10e9c2ce307a037e904c0d9671d7137d9 ]
A data race occurs when the function `insert_ordered_extent_file_extent()`
and the function `btrfs_inode_safe_disk_i_size_write()` are executed
concurrently. The function `insert_ordered_extent_file_extent()` is not
locked when reading inode->disk_i_size, causing
`btrfs_inode_safe_disk_i_size_write()` to cause data competition when
writing inode->disk_i_size, thus affecting the value of `modify_tree`.
The specific call stack that appears during testing is as follows:
============DATA_RACE============
btrfs_drop_extents+0x89a/0xa060 [btrfs]
insert_reserved_file_extent+0xb54/0x2960 [btrfs]
insert_ordered_extent_file_extent+0xff5/0x1760 [btrfs]
btrfs_finish_one_ordered+0x1b85/0x36a0 [btrfs]
btrfs_finish_ordered_io+0x37/0x60 [btrfs]
finish_ordered_fn+0x3e/0x50 [btrfs]
btrfs_work_helper+0x9c9/0x27a0 [btrfs]
process_scheduled_works+0x716/0xf10
worker_thread+0xb6a/0x1190
kthread+0x292/0x330
ret_from_fork+0x4d/0x80
ret_from_fork_asm+0x1a/0x30
============OTHER_INFO============
btrfs_inode_safe_disk_i_size_write+0x4ec/0x600 [btrfs]
btrfs_finish_one_ordered+0x24c7/0x36a0 [btrfs]
btrfs_finish_ordered_io+0x37/0x60 [btrfs]
finish_ordered_fn+0x3e/0x50 [btrfs]
btrfs_work_helper+0x9c9/0x27a0 [btrfs]
process_scheduled_works+0x716/0xf10
worker_thread+0xb6a/0x1190
kthread+0x292/0x330
ret_from_fork+0x4d/0x80
ret_from_fork_asm+0x1a/0x30
=================================
The main purpose of the check of the inode's disk_i_size is to avoid
taking write locks on a btree path when we have a write at or beyond
EOF, since in these cases we don't expect to find extent items in the
root to drop. However if we end up taking write locks due to a data
race on disk_i_size, everything is still correct, we only add extra
lock contention on the tree in case there's concurrency from other tasks.
If the race causes us to not take write locks when we actually need them,
then everything is functionally correct as well, since if we find out we
have extent items to drop and we took read locks (modify_tree set to 0),
we release the path and retry again with write locks.
Since this data race does not affect the correctness of the function,
it is a harmless data race, use data_race() to check inode->disk_i_size.
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Hao-ran Zheng <zhenghaoran154@gmail.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 14e27473c5bce..4d7c7a296d2d1 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -224,7 +224,7 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans,
if (args->drop_cache)
btrfs_drop_extent_map_range(inode, args->start, args->end - 1, false);
- if (args->start >= inode->disk_i_size && !args->replace_extent)
+ if (data_race(args->start >= inode->disk_i_size) && !args->replace_extent)
modify_tree = 0;
update_refs = (btrfs_root_id(root) != BTRFS_TREE_LOG_OBJECTID);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 010/443] btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 009/443] btrfs: fix data race when accessing the inodes disk_i_size at btrfs_drop_extents() Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 011/443] btrfs: dont use btrfs_set_item_key_safe on RAID stripe-extents Greg Kroah-Hartman
` (443 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Burkov, Josef Bacik,
David Sterba, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 6a4730b325aaa48f7a5d5ba97aff0a955e2d9cec ]
This BUG_ON is meant to catch backref cache problems, but these can
arise from either bugs in the backref cache or corruption in the extent
tree. Fix it to be a proper error.
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/relocation.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index db8b42f674b7c..ab2de2d1b2bee 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -4405,8 +4405,18 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
WARN_ON(!first_cow && level == 0);
node = rc->backref_cache.path[level];
- BUG_ON(node->bytenr != buf->start &&
- node->new_bytenr != buf->start);
+
+ /*
+ * If node->bytenr != buf->start and node->new_bytenr !=
+ * buf->start then we've got the wrong backref node for what we
+ * expected to see here and the cache is incorrect.
+ */
+ if (unlikely(node->bytenr != buf->start && node->new_bytenr != buf->start)) {
+ btrfs_err(fs_info,
+"bytenr %llu was found but our backref cache was expecting %llu or %llu",
+ buf->start, node->bytenr, node->new_bytenr);
+ return -EUCLEAN;
+ }
btrfs_backref_drop_node_buffer(node);
atomic_inc(&cow->refs);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 011/443] btrfs: dont use btrfs_set_item_key_safe on RAID stripe-extents
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 010/443] btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 012/443] sched: Dont try to catch up excess steal time Greg Kroah-Hartman
` (442 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, David Sterba,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
[ Upstream commit dc14ba10781bd2629835696b7cc1febf914768e9 ]
Don't use btrfs_set_item_key_safe() to modify the keys in the RAID
stripe-tree, as this can lead to corruption of the tree, which is caught
by the checks in btrfs_set_item_key_safe():
BTRFS info (device nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12
BTRFS info (device nvme1n1): refs 2 lock_owner 1030 current 1030
[ snip ]
item 105 key (354549760 230 20480) itemoff 14587 itemsize 16
stride 0 devid 5 physical 67502080
item 106 key (354631680 230 4096) itemoff 14571 itemsize 16
stride 0 devid 1 physical 88559616
item 107 key (354631680 230 32768) itemoff 14555 itemsize 16
stride 0 devid 1 physical 88555520
item 108 key (354717696 230 28672) itemoff 14539 itemsize 16
stride 0 devid 2 physical 67604480
[ snip ]
BTRFS critical (device nvme1n1): slot 106 key (354631680 230 32768) new key (354635776 230 4096)
------------[ cut here ]------------
kernel BUG at fs/btrfs/ctree.c:2602!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 1 UID: 0 PID: 1055 Comm: fsstress Not tainted 6.13.0-rc1+ #1464
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
RIP: 0010:btrfs_set_item_key_safe+0xf7/0x270
Code: <snip>
RSP: 0018:ffffc90001337ab0 EFLAGS: 00010287
RAX: 0000000000000000 RBX: ffff8881115fd000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff
RBP: ffff888110ed6f50 R08: 00000000ffffefff R09: ffffffff8244c500
R10: 00000000ffffefff R11: 00000000ffffffff R12: ffff888100586000
R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f23b58
FS: 00007f7d75c72740(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa811652c60 CR3: 0000000111398001 CR4: 0000000000370eb0
Call Trace:
<TASK>
? __die_body.cold+0x14/0x1a
? die+0x2e/0x50
? do_trap+0xca/0x110
? do_error_trap+0x65/0x80
? btrfs_set_item_key_safe+0xf7/0x270
? exc_invalid_op+0x50/0x70
? btrfs_set_item_key_safe+0xf7/0x270
? asm_exc_invalid_op+0x1a/0x20
? btrfs_set_item_key_safe+0xf7/0x270
btrfs_partially_delete_raid_extent+0xc4/0xe0
btrfs_delete_raid_extent+0x227/0x240
__btrfs_free_extent.isra.0+0x57f/0x9c0
? exc_coproc_segment_overrun+0x40/0x40
__btrfs_run_delayed_refs+0x2fa/0xe80
btrfs_run_delayed_refs+0x81/0xe0
btrfs_commit_transaction+0x2dd/0xbe0
? preempt_count_add+0x52/0xb0
btrfs_sync_file+0x375/0x4c0
do_fsync+0x39/0x70
__x64_sys_fsync+0x13/0x20
do_syscall_64+0x54/0x110
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f7d7550ef90
Code: <snip>
RSP: 002b:00007ffd70237248 EFLAGS: 00000202 ORIG_RAX: 000000000000004a
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f7d7550ef90
RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004
RBP: 000000000000001b R08: 0000000000000078 R09: 00007ffd7023725c
R10: 00007f7d75400390 R11: 0000000000000202 R12: 028f5c28f5c28f5c
R13: 8f5c28f5c28f5c29 R14: 000000000040b520 R15: 00007f7d75c726c8
</TASK>
While the root cause of the tree order corruption isn't clear, using
btrfs_duplicate_item() to copy the item and then adjusting both the key
and the per-device physical addresses is a safe way to counter this
problem.
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/raid-stripe-tree.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/fs/btrfs/raid-stripe-tree.c b/fs/btrfs/raid-stripe-tree.c
index 9ffc79f250fbb..10781c015ee8d 100644
--- a/fs/btrfs/raid-stripe-tree.c
+++ b/fs/btrfs/raid-stripe-tree.c
@@ -13,12 +13,13 @@
#include "volumes.h"
#include "print-tree.h"
-static void btrfs_partially_delete_raid_extent(struct btrfs_trans_handle *trans,
+static int btrfs_partially_delete_raid_extent(struct btrfs_trans_handle *trans,
struct btrfs_path *path,
const struct btrfs_key *oldkey,
u64 newlen, u64 frontpad)
{
- struct btrfs_stripe_extent *extent;
+ struct btrfs_root *stripe_root = trans->fs_info->stripe_root;
+ struct btrfs_stripe_extent *extent, *newitem;
struct extent_buffer *leaf;
int slot;
size_t item_size;
@@ -27,23 +28,38 @@ static void btrfs_partially_delete_raid_extent(struct btrfs_trans_handle *trans,
.type = BTRFS_RAID_STRIPE_KEY,
.offset = newlen,
};
+ int ret;
ASSERT(oldkey->type == BTRFS_RAID_STRIPE_KEY);
leaf = path->nodes[0];
slot = path->slots[0];
item_size = btrfs_item_size(leaf, slot);
+
+ newitem = kzalloc(item_size, GFP_NOFS);
+ if (!newitem)
+ return -ENOMEM;
+
extent = btrfs_item_ptr(leaf, slot, struct btrfs_stripe_extent);
for (int i = 0; i < btrfs_num_raid_stripes(item_size); i++) {
struct btrfs_raid_stride *stride = &extent->strides[i];
u64 phys;
- phys = btrfs_raid_stride_physical(leaf, stride);
- btrfs_set_raid_stride_physical(leaf, stride, phys + frontpad);
+ phys = btrfs_raid_stride_physical(leaf, stride) + frontpad;
+ btrfs_set_stack_raid_stride_physical(&newitem->strides[i], phys);
}
- btrfs_set_item_key_safe(trans, path, &newkey);
+ ret = btrfs_del_item(trans, stripe_root, path);
+ if (ret)
+ goto out;
+
+ btrfs_release_path(path);
+ ret = btrfs_insert_item(trans, stripe_root, &newkey, newitem, item_size);
+
+out:
+ kfree(newitem);
+ return ret;
}
int btrfs_delete_raid_extent(struct btrfs_trans_handle *trans, u64 start, u64 length)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 012/443] sched: Dont try to catch up excess steal time.
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 011/443] btrfs: dont use btrfs_set_item_key_safe on RAID stripe-extents Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 013/443] sched/deadline: Correctly account for allocated bandwidth during hotplug Greg Kroah-Hartman
` (441 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suleiman Souhlal,
Peter Zijlstra (Intel), Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suleiman Souhlal <suleiman@google.com>
[ Upstream commit 108ad0999085df2366dd9ef437573955cb3f5586 ]
When steal time exceeds the measured delta when updating clock_task, we
currently try to catch up the excess in future updates.
However, this results in inaccurate run times for the future things using
clock_task, in some situations, as they end up getting additional steal
time that did not actually happen.
This is because there is a window between reading the elapsed time in
update_rq_clock() and sampling the steal time in update_rq_clock_task().
If the VCPU gets preempted between those two points, any additional
steal time is accounted to the outgoing task even though the calculated
delta did not actually contain any of that "stolen" time.
When this race happens, we can end up with steal time that exceeds the
calculated delta, and the previous code would try to catch up that excess
steal time in future clock updates, which is given to the next,
incoming task, even though it did not actually have any time stolen.
This behavior is particularly bad when steal time can be very long,
which we've seen when trying to extend steal time to contain the duration
that the host was suspended [0]. When this happens, clock_task stays
frozen, during which the running task stays running for the whole
duration, since its run time doesn't increase.
However the race can happen even under normal operation.
Ideally we would read the elapsed cpu time and the steal time atomically,
to prevent this race from happening in the first place, but doing so
is non-trivial.
Since the time between those two points isn't otherwise accounted anywhere,
neither to the outgoing task nor the incoming task (because the "end of
outgoing task" and "start of incoming task" timestamps are the same),
I would argue that the right thing to do is to simply drop any excess steal
time, in order to prevent these issues.
[0] https://lore.kernel.org/kvm/20240820043543.837914-1-suleiman@google.com/
Signed-off-by: Suleiman Souhlal <suleiman@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20241118043745.1857272-1-suleiman@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index e0fd8069c60e6..ffceb5ff4c5c3 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -766,13 +766,15 @@ static void update_rq_clock_task(struct rq *rq, s64 delta)
#endif
#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
if (static_key_false((¶virt_steal_rq_enabled))) {
- steal = paravirt_steal_clock(cpu_of(rq));
+ u64 prev_steal;
+
+ steal = prev_steal = paravirt_steal_clock(cpu_of(rq));
steal -= rq->prev_steal_time_rq;
if (unlikely(steal > delta))
steal = delta;
- rq->prev_steal_time_rq += steal;
+ rq->prev_steal_time_rq = prev_steal;
delta -= steal;
}
#endif
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 013/443] sched/deadline: Correctly account for allocated bandwidth during hotplug
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 012/443] sched: Dont try to catch up excess steal time Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:22 ` [PATCH 6.13 014/443] sched/deadline: Check bandwidth overflow earlier for hotplug Greg Kroah-Hartman
` (440 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juri Lelli, Peter Zijlstra (Intel),
Phil Auld, Waiman Long, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juri Lelli <juri.lelli@redhat.com>
[ Upstream commit d4742f6ed7ea6df56e381f82ba4532245fa1e561 ]
For hotplug operations, DEADLINE needs to check that there is still enough
bandwidth left after removing the CPU that is going offline. We however
fail to do so currently.
Restore the correct behavior by restructuring dl_bw_manage() a bit, so
that overflow conditions (not enough bandwidth left) are properly
checked. Also account for dl_server bandwidth, i.e. discount such
bandwidth in the calculation since NORMAL tasks will be anyway moved
away from the CPU as a result of the hotplug operation.
Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Phil Auld <pauld@redhat.com>
Tested-by: Waiman Long <longman@redhat.com>
Link: https://lore.kernel.org/r/20241114142810.794657-3-juri.lelli@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/core.c | 2 +-
kernel/sched/deadline.c | 48 +++++++++++++++++++++++++++++++++--------
kernel/sched/sched.h | 2 +-
3 files changed, 41 insertions(+), 11 deletions(-)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index ffceb5ff4c5c3..141bbe97d7e5f 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -8185,7 +8185,7 @@ static void cpuset_cpu_active(void)
static int cpuset_cpu_inactive(unsigned int cpu)
{
if (!cpuhp_tasks_frozen) {
- int ret = dl_bw_check_overflow(cpu);
+ int ret = dl_bw_deactivate(cpu);
if (ret)
return ret;
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index d94f2ed6d1f46..b078014273d9e 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -3453,29 +3453,31 @@ int dl_cpuset_cpumask_can_shrink(const struct cpumask *cur,
}
enum dl_bw_request {
- dl_bw_req_check_overflow = 0,
+ dl_bw_req_deactivate = 0,
dl_bw_req_alloc,
dl_bw_req_free
};
static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw)
{
- unsigned long flags;
+ unsigned long flags, cap;
struct dl_bw *dl_b;
bool overflow = 0;
+ u64 fair_server_bw = 0;
rcu_read_lock_sched();
dl_b = dl_bw_of(cpu);
raw_spin_lock_irqsave(&dl_b->lock, flags);
- if (req == dl_bw_req_free) {
+ cap = dl_bw_capacity(cpu);
+ switch (req) {
+ case dl_bw_req_free:
__dl_sub(dl_b, dl_bw, dl_bw_cpus(cpu));
- } else {
- unsigned long cap = dl_bw_capacity(cpu);
-
+ break;
+ case dl_bw_req_alloc:
overflow = __dl_overflow(dl_b, cap, 0, dl_bw);
- if (req == dl_bw_req_alloc && !overflow) {
+ if (!overflow) {
/*
* We reserve space in the destination
* root_domain, as we can't fail after this point.
@@ -3484,6 +3486,34 @@ static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw)
*/
__dl_add(dl_b, dl_bw, dl_bw_cpus(cpu));
}
+ break;
+ case dl_bw_req_deactivate:
+ /*
+ * cpu is going offline and NORMAL tasks will be moved away
+ * from it. We can thus discount dl_server bandwidth
+ * contribution as it won't need to be servicing tasks after
+ * the cpu is off.
+ */
+ if (cpu_rq(cpu)->fair_server.dl_server)
+ fair_server_bw = cpu_rq(cpu)->fair_server.dl_bw;
+
+ /*
+ * Not much to check if no DEADLINE bandwidth is present.
+ * dl_servers we can discount, as tasks will be moved out the
+ * offlined CPUs anyway.
+ */
+ if (dl_b->total_bw - fair_server_bw > 0) {
+ /*
+ * Leaving at least one CPU for DEADLINE tasks seems a
+ * wise thing to do.
+ */
+ if (dl_bw_cpus(cpu))
+ overflow = __dl_overflow(dl_b, cap, fair_server_bw, 0);
+ else
+ overflow = 1;
+ }
+
+ break;
}
raw_spin_unlock_irqrestore(&dl_b->lock, flags);
@@ -3492,9 +3522,9 @@ static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw)
return overflow ? -EBUSY : 0;
}
-int dl_bw_check_overflow(int cpu)
+int dl_bw_deactivate(int cpu)
{
- return dl_bw_manage(dl_bw_req_check_overflow, cpu, 0);
+ return dl_bw_manage(dl_bw_req_deactivate, cpu, 0);
}
int dl_bw_alloc(int cpu, u64 dl_bw)
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index c5d67a43fe524..96d9bbba94acc 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -362,7 +362,7 @@ extern void __getparam_dl(struct task_struct *p, struct sched_attr *attr);
extern bool __checkparam_dl(const struct sched_attr *attr);
extern bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr);
extern int dl_cpuset_cpumask_can_shrink(const struct cpumask *cur, const struct cpumask *trial);
-extern int dl_bw_check_overflow(int cpu);
+extern int dl_bw_deactivate(int cpu);
extern s64 dl_scaled_delta_exec(struct rq *rq, struct sched_dl_entity *dl_se, s64 delta_exec);
/*
* SCHED_DEADLINE supports servers (nested scheduling) with the following
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 014/443] sched/deadline: Check bandwidth overflow earlier for hotplug
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 013/443] sched/deadline: Correctly account for allocated bandwidth during hotplug Greg Kroah-Hartman
@ 2025-02-13 14:22 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 015/443] x86: Convert unreachable() to BUG() Greg Kroah-Hartman
` (439 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juri Lelli, Peter Zijlstra (Intel),
Phil Auld, Waiman Long, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juri Lelli <juri.lelli@redhat.com>
[ Upstream commit 53916d5fd3c0b658de3463439dd2b7ce765072cb ]
Currently we check for bandwidth overflow potentially due to hotplug
operations at the end of sched_cpu_deactivate(), after the cpu going
offline has already been removed from scheduling, active_mask, etc.
This can create issues for DEADLINE tasks, as there is a substantial
race window between the start of sched_cpu_deactivate() and the moment
we possibly decide to roll-back the operation if dl_bw_deactivate()
returns failure in cpuset_cpu_inactive(). An example is a throttled
task that sees its replenishment timer firing while the cpu it was
previously running on is considered offline, but before
dl_bw_deactivate() had a chance to say no and roll-back happened.
Fix this by directly calling dl_bw_deactivate() first thing in
sched_cpu_deactivate() and do the required calculation in the former
function considering the cpu passed as an argument as offline already.
By doing so we also simplify sched_cpu_deactivate(), as there is no need
anymore for any kind of roll-back if we fail early.
Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Phil Auld <pauld@redhat.com>
Tested-by: Waiman Long <longman@redhat.com>
Link: https://lore.kernel.org/r/Zzc1DfPhbvqDDIJR@jlelli-thinkpadt14gen4.remote.csb
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/core.c | 22 +++++++---------------
kernel/sched/deadline.c | 12 ++++++++++--
2 files changed, 17 insertions(+), 17 deletions(-)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 141bbe97d7e5f..a4fc6d357e08a 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -8182,19 +8182,14 @@ static void cpuset_cpu_active(void)
cpuset_update_active_cpus();
}
-static int cpuset_cpu_inactive(unsigned int cpu)
+static void cpuset_cpu_inactive(unsigned int cpu)
{
if (!cpuhp_tasks_frozen) {
- int ret = dl_bw_deactivate(cpu);
-
- if (ret)
- return ret;
cpuset_update_active_cpus();
} else {
num_cpus_frozen++;
partition_sched_domains(1, NULL, NULL);
}
- return 0;
}
static inline void sched_smt_present_inc(int cpu)
@@ -8256,6 +8251,11 @@ int sched_cpu_deactivate(unsigned int cpu)
struct rq *rq = cpu_rq(cpu);
int ret;
+ ret = dl_bw_deactivate(cpu);
+
+ if (ret)
+ return ret;
+
/*
* Remove CPU from nohz.idle_cpus_mask to prevent participating in
* load balancing when not active
@@ -8301,15 +8301,7 @@ int sched_cpu_deactivate(unsigned int cpu)
return 0;
sched_update_numa(cpu, false);
- ret = cpuset_cpu_inactive(cpu);
- if (ret) {
- sched_smt_present_inc(cpu);
- sched_set_rq_online(rq, cpu);
- balance_push_set(cpu, false);
- set_cpu_active(cpu, true);
- sched_update_numa(cpu, true);
- return ret;
- }
+ cpuset_cpu_inactive(cpu);
sched_domains_numa_masks_clear(cpu);
return 0;
}
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index b078014273d9e..b6781ddea7650 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -3488,6 +3488,13 @@ static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw)
}
break;
case dl_bw_req_deactivate:
+ /*
+ * cpu is not off yet, but we need to do the math by
+ * considering it off already (i.e., what would happen if we
+ * turn cpu off?).
+ */
+ cap -= arch_scale_cpu_capacity(cpu);
+
/*
* cpu is going offline and NORMAL tasks will be moved away
* from it. We can thus discount dl_server bandwidth
@@ -3505,9 +3512,10 @@ static int dl_bw_manage(enum dl_bw_request req, int cpu, u64 dl_bw)
if (dl_b->total_bw - fair_server_bw > 0) {
/*
* Leaving at least one CPU for DEADLINE tasks seems a
- * wise thing to do.
+ * wise thing to do. As said above, cpu is not offline
+ * yet, so account for that.
*/
- if (dl_bw_cpus(cpu))
+ if (dl_bw_cpus(cpu) - 1)
overflow = __dl_overflow(dl_b, cap, fair_server_bw, 0);
else
overflow = 1;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 015/443] x86: Convert unreachable() to BUG()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2025-02-13 14:22 ` [PATCH 6.13 014/443] sched/deadline: Check bandwidth overflow earlier for hotplug Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 016/443] locking/ww_mutex/test: Use swap() macro Greg Kroah-Hartman
` (438 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel),
Josh Poimboeuf, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit 2190966fbc14ca2cd4ea76eefeb96a47d8e390df ]
Avoid unreachable() as it can (and will in the absence of UBSAN)
generate fallthrough code. Use BUG() so we get a UD2 trap (with
unreachable annotation).
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/r/20241128094312.028316261@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/process.c | 2 +-
arch/x86/kernel/reboot.c | 2 +-
arch/x86/kvm/svm/sev.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index f63f8fd00a91f..15507e739c255 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -838,7 +838,7 @@ void __noreturn stop_this_cpu(void *dummy)
#ifdef CONFIG_SMP
if (smp_ops.stop_this_cpu) {
smp_ops.stop_this_cpu();
- unreachable();
+ BUG();
}
#endif
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 615922838c510..dc1dd3f3e67fc 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -883,7 +883,7 @@ static int crash_nmi_callback(unsigned int val, struct pt_regs *regs)
if (smp_ops.stop_this_cpu) {
smp_ops.stop_this_cpu();
- unreachable();
+ BUG();
}
/* Assume hlt works */
diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 943bd074a5d37..fe6cc763fd518 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -3820,7 +3820,7 @@ static int snp_begin_psc(struct vcpu_svm *svm, struct psc_buffer *psc)
goto next_range;
}
- unreachable();
+ BUG();
}
static int __sev_snp_update_protected_guest_state(struct kvm_vcpu *vcpu)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 016/443] locking/ww_mutex/test: Use swap() macro
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 015/443] x86: Convert unreachable() to BUG() Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 017/443] lockdep: Fix upper limit for LOCKDEP_*_BITS configs Greg Kroah-Hartman
` (437 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abaci Robot, Jiapeng Chong,
Waiman Long, Thorsten Blum, Boqun Feng, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@toblux.com>
[ Upstream commit 0d3547df6934b8f9600630322799a2a76b4567d8 ]
Fixes the following Coccinelle/coccicheck warning reported by
swap.cocci:
WARNING opportunity for swap()
Compile-tested only.
[Boqun: Add the report tags from Jiapeng and Abaci Robot [1].]
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Reported-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=11531
Link: https://lore.kernel.org/r/20241025081455.55089-1-jiapeng.chong@linux.alibaba.com [1]
Acked-by: Waiman Long <longman@redhat.com>
Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com>
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Link: https://lore.kernel.org/r/20240731135850.81018-2-thorsten.blum@toblux.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/test-ww_mutex.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c
index 5d58b2c0ef98b..bcb1b9fea5880 100644
--- a/kernel/locking/test-ww_mutex.c
+++ b/kernel/locking/test-ww_mutex.c
@@ -404,7 +404,7 @@ static inline u32 prandom_u32_below(u32 ceil)
static int *get_random_order(int count)
{
int *order;
- int n, r, tmp;
+ int n, r;
order = kmalloc_array(count, sizeof(*order), GFP_KERNEL);
if (!order)
@@ -415,11 +415,8 @@ static int *get_random_order(int count)
for (n = count - 1; n > 1; n--) {
r = prandom_u32_below(n + 1);
- if (r != n) {
- tmp = order[n];
- order[n] = order[r];
- order[r] = tmp;
- }
+ if (r != n)
+ swap(order[n], order[r]);
}
return order;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 017/443] lockdep: Fix upper limit for LOCKDEP_*_BITS configs
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 016/443] locking/ww_mutex/test: Use swap() macro Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 018/443] x86/amd_nb: Restrict init function to AMD-based systems Greg Kroah-Hartman
` (436 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, J. R. Okajima, Peter Zijlstra,
Boqun Feng, Ingo Molnar, Waiman Long, Will Deacon, Carlos Llamas,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
[ Upstream commit e638072e61726cae363d48812815197a2a0e097f ]
Lockdep has a set of configs used to determine the size of the static
arrays that it uses. However, the upper limit that was initially setup
for these configs is too high (30 bit shift). This equates to several
GiB of static memory for individual symbols. Using such high values
leads to linker errors:
$ make defconfig
$ ./scripts/config -e PROVE_LOCKING --set-val LOCKDEP_BITS 30
$ make olddefconfig all
[...]
ld: kernel image bigger than KERNEL_IMAGE_SIZE
ld: section .bss VMA wraps around address space
Adjust the upper limits to the maximum values that avoid these issues.
The need for anything more, likely points to a problem elsewhere. Note
that LOCKDEP_CHAINS_BITS was intentionally left out as its upper limit
had a different symptom and has already been fixed [1].
Reported-by: J. R. Okajima <hooanon05g@gmail.com>
Closes: https://lore.kernel.org/all/30795.1620913191@jrobl/ [1]
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Waiman Long <longman@redhat.com>
Cc: Will Deacon <will@kernel.org>
Acked-by: Waiman Long <longman@redhat.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Link: https://lore.kernel.org/r/20241024183631.643450-2-cmllamas@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/Kconfig.debug | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index f3d7237058793..bc725add84f46 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1504,7 +1504,7 @@ config LOCKDEP_SMALL
config LOCKDEP_BITS
int "Bitsize for MAX_LOCKDEP_ENTRIES"
depends on LOCKDEP && !LOCKDEP_SMALL
- range 10 30
+ range 10 24
default 15
help
Try increasing this value if you hit "BUG: MAX_LOCKDEP_ENTRIES too low!" message.
@@ -1520,7 +1520,7 @@ config LOCKDEP_CHAINS_BITS
config LOCKDEP_STACK_TRACE_BITS
int "Bitsize for MAX_STACK_TRACE_ENTRIES"
depends on LOCKDEP && !LOCKDEP_SMALL
- range 10 30
+ range 10 26
default 19
help
Try increasing this value if you hit "BUG: MAX_STACK_TRACE_ENTRIES too low!" message.
@@ -1528,7 +1528,7 @@ config LOCKDEP_STACK_TRACE_BITS
config LOCKDEP_STACK_TRACE_HASH_BITS
int "Bitsize for STACK_TRACE_HASH_SIZE"
depends on LOCKDEP && !LOCKDEP_SMALL
- range 10 30
+ range 10 26
default 14
help
Try increasing this value if you need large STACK_TRACE_HASH_SIZE.
@@ -1536,7 +1536,7 @@ config LOCKDEP_STACK_TRACE_HASH_BITS
config LOCKDEP_CIRCULAR_QUEUE_BITS
int "Bitsize for elements in circular_queue struct"
depends on LOCKDEP
- range 10 30
+ range 10 26
default 12
help
Try increasing this value if you hit "lockdep bfs error:-1" warning due to __cq_enqueue() failure.
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 018/443] x86/amd_nb: Restrict init function to AMD-based systems
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 017/443] lockdep: Fix upper limit for LOCKDEP_*_BITS configs Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 019/443] drm/virtio: New fence for every plane update Greg Kroah-Hartman
` (435 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yazen Ghannam, Borislav Petkov (AMD),
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yazen Ghannam <yazen.ghannam@amd.com>
[ Upstream commit bee9e840609cc67d0a7d82f22a2130fb7a0a766d ]
The code implicitly operates on AMD-based systems by matching on PCI
IDs. However, the use of these IDs is going away.
Add an explicit CPU vendor check instead of relying on PCI IDs.
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20241206161210.163701-3-yazen.ghannam@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/amd_nb.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
index 9fe9972d2071b..37b8244899d89 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -582,6 +582,10 @@ static __init void fix_erratum_688(void)
static __init int init_amd_nbs(void)
{
+ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD &&
+ boot_cpu_data.x86_vendor != X86_VENDOR_HYGON)
+ return 0;
+
amd_cache_northbridges();
amd_cache_gart();
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 019/443] drm/virtio: New fence for every plane update
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 018/443] x86/amd_nb: Restrict init function to AMD-based systems Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 020/443] drm: Add panel backlight quirks Greg Kroah-Hartman
` (434 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dongwon Kim, Dmitry Osipenko,
Vivek Kasireddy, Rob Clark, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongwon Kim <dongwon.kim@intel.com>
[ Upstream commit d3c55b8ab6fe5fa2e7ab02efd36d09c39ee5022f ]
Having a fence linked to a virtio_gpu_framebuffer in the plane update
sequence would cause conflict when several planes referencing the same
framebuffer (e.g. Xorg screen covering multi-displays configured for an
extended mode) and those planes are updated concurrently. So it is needed
to allocate a fence for every plane state instead of the framebuffer.
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
[dmitry.osipenko@collabora.com: rebase, fix up, edit commit message]
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241020230803.247419-2-dmitry.osipenko@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/virtio/virtgpu_drv.h | 7 ++++
drivers/gpu/drm/virtio/virtgpu_plane.c | 58 +++++++++++++++++---------
2 files changed, 46 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 64c236169db88..5dc8eeaf7123c 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -194,6 +194,13 @@ struct virtio_gpu_framebuffer {
#define to_virtio_gpu_framebuffer(x) \
container_of(x, struct virtio_gpu_framebuffer, base)
+struct virtio_gpu_plane_state {
+ struct drm_plane_state base;
+ struct virtio_gpu_fence *fence;
+};
+#define to_virtio_gpu_plane_state(x) \
+ container_of(x, struct virtio_gpu_plane_state, base)
+
struct virtio_gpu_queue {
struct virtqueue *vq;
spinlock_t qlock;
diff --git a/drivers/gpu/drm/virtio/virtgpu_plane.c b/drivers/gpu/drm/virtio/virtgpu_plane.c
index a72a2dbda031c..7acd38b962c62 100644
--- a/drivers/gpu/drm/virtio/virtgpu_plane.c
+++ b/drivers/gpu/drm/virtio/virtgpu_plane.c
@@ -66,11 +66,28 @@ uint32_t virtio_gpu_translate_format(uint32_t drm_fourcc)
return format;
}
+static struct
+drm_plane_state *virtio_gpu_plane_duplicate_state(struct drm_plane *plane)
+{
+ struct virtio_gpu_plane_state *new;
+
+ if (WARN_ON(!plane->state))
+ return NULL;
+
+ new = kzalloc(sizeof(*new), GFP_KERNEL);
+ if (!new)
+ return NULL;
+
+ __drm_atomic_helper_plane_duplicate_state(plane, &new->base);
+
+ return &new->base;
+}
+
static const struct drm_plane_funcs virtio_gpu_plane_funcs = {
.update_plane = drm_atomic_helper_update_plane,
.disable_plane = drm_atomic_helper_disable_plane,
.reset = drm_atomic_helper_plane_reset,
- .atomic_duplicate_state = drm_atomic_helper_plane_duplicate_state,
+ .atomic_duplicate_state = virtio_gpu_plane_duplicate_state,
.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
};
@@ -138,11 +155,13 @@ static void virtio_gpu_resource_flush(struct drm_plane *plane,
struct drm_device *dev = plane->dev;
struct virtio_gpu_device *vgdev = dev->dev_private;
struct virtio_gpu_framebuffer *vgfb;
+ struct virtio_gpu_plane_state *vgplane_st;
struct virtio_gpu_object *bo;
vgfb = to_virtio_gpu_framebuffer(plane->state->fb);
+ vgplane_st = to_virtio_gpu_plane_state(plane->state);
bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]);
- if (vgfb->fence) {
+ if (vgplane_st->fence) {
struct virtio_gpu_object_array *objs;
objs = virtio_gpu_array_alloc(1);
@@ -151,13 +170,11 @@ static void virtio_gpu_resource_flush(struct drm_plane *plane,
virtio_gpu_array_add_obj(objs, vgfb->base.obj[0]);
virtio_gpu_array_lock_resv(objs);
virtio_gpu_cmd_resource_flush(vgdev, bo->hw_res_handle, x, y,
- width, height, objs, vgfb->fence);
+ width, height, objs,
+ vgplane_st->fence);
virtio_gpu_notify(vgdev);
-
- dma_fence_wait_timeout(&vgfb->fence->f, true,
+ dma_fence_wait_timeout(&vgplane_st->fence->f, true,
msecs_to_jiffies(50));
- dma_fence_put(&vgfb->fence->f);
- vgfb->fence = NULL;
} else {
virtio_gpu_cmd_resource_flush(vgdev, bo->hw_res_handle, x, y,
width, height, NULL, NULL);
@@ -247,20 +264,23 @@ static int virtio_gpu_plane_prepare_fb(struct drm_plane *plane,
struct drm_device *dev = plane->dev;
struct virtio_gpu_device *vgdev = dev->dev_private;
struct virtio_gpu_framebuffer *vgfb;
+ struct virtio_gpu_plane_state *vgplane_st;
struct virtio_gpu_object *bo;
if (!new_state->fb)
return 0;
vgfb = to_virtio_gpu_framebuffer(new_state->fb);
+ vgplane_st = to_virtio_gpu_plane_state(new_state);
bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]);
if (!bo || (plane->type == DRM_PLANE_TYPE_PRIMARY && !bo->guest_blob))
return 0;
- if (bo->dumb && (plane->state->fb != new_state->fb)) {
- vgfb->fence = virtio_gpu_fence_alloc(vgdev, vgdev->fence_drv.context,
+ if (bo->dumb) {
+ vgplane_st->fence = virtio_gpu_fence_alloc(vgdev,
+ vgdev->fence_drv.context,
0);
- if (!vgfb->fence)
+ if (!vgplane_st->fence)
return -ENOMEM;
}
@@ -270,15 +290,15 @@ static int virtio_gpu_plane_prepare_fb(struct drm_plane *plane,
static void virtio_gpu_plane_cleanup_fb(struct drm_plane *plane,
struct drm_plane_state *state)
{
- struct virtio_gpu_framebuffer *vgfb;
+ struct virtio_gpu_plane_state *vgplane_st;
if (!state->fb)
return;
- vgfb = to_virtio_gpu_framebuffer(state->fb);
- if (vgfb->fence) {
- dma_fence_put(&vgfb->fence->f);
- vgfb->fence = NULL;
+ vgplane_st = to_virtio_gpu_plane_state(state);
+ if (vgplane_st->fence) {
+ dma_fence_put(&vgplane_st->fence->f);
+ vgplane_st->fence = NULL;
}
}
@@ -291,6 +311,7 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane,
struct virtio_gpu_device *vgdev = dev->dev_private;
struct virtio_gpu_output *output = NULL;
struct virtio_gpu_framebuffer *vgfb;
+ struct virtio_gpu_plane_state *vgplane_st;
struct virtio_gpu_object *bo = NULL;
uint32_t handle;
@@ -303,6 +324,7 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane,
if (plane->state->fb) {
vgfb = to_virtio_gpu_framebuffer(plane->state->fb);
+ vgplane_st = to_virtio_gpu_plane_state(plane->state);
bo = gem_to_virtio_gpu_obj(vgfb->base.obj[0]);
handle = bo->hw_res_handle;
} else {
@@ -322,11 +344,9 @@ static void virtio_gpu_cursor_plane_update(struct drm_plane *plane,
(vgdev, 0,
plane->state->crtc_w,
plane->state->crtc_h,
- 0, 0, objs, vgfb->fence);
+ 0, 0, objs, vgplane_st->fence);
virtio_gpu_notify(vgdev);
- dma_fence_wait(&vgfb->fence->f, true);
- dma_fence_put(&vgfb->fence->f);
- vgfb->fence = NULL;
+ dma_fence_wait(&vgplane_st->fence->f, true);
}
if (plane->state->fb != old_state->fb) {
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 020/443] drm: Add panel backlight quirks
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 019/443] drm/virtio: New fence for every plane update Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 021/443] drm/amd/display: Add support for minimum backlight quirk Greg Kroah-Hartman
` (433 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Dustin L. Howett, Mario Limonciello, Harry Wentland, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <linux@weissschuh.net>
[ Upstream commit 22e5c7ae12145af13785e3ff138395d5b1a22116 ]
Panels using a PWM-controlled backlight source do not have a standard
way to communicate their valid PWM ranges.
On x86 the ranges are read from ACPI through driver-specific tables.
The built-in ranges are not necessarily correct, or may grow stale if an
older device can be retrofitted with newer panels.
Add a quirk infrastructure with which the minimum valid backlight value
can be maintained as part of the kernel.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Tested-by: Dustin L. Howett <dustin@howett.net>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241111-amdgpu-min-backlight-quirk-v7-1-f662851fda69@weissschuh.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/gpu/drm-kms-helpers.rst | 3 +
drivers/gpu/drm/Kconfig | 4 ++
drivers/gpu/drm/Makefile | 1 +
drivers/gpu/drm/drm_panel_backlight_quirks.c | 70 ++++++++++++++++++++
include/drm/drm_utils.h | 4 ++
5 files changed, 82 insertions(+)
create mode 100644 drivers/gpu/drm/drm_panel_backlight_quirks.c
diff --git a/Documentation/gpu/drm-kms-helpers.rst b/Documentation/gpu/drm-kms-helpers.rst
index 8cf2f041af470..b4ee25af1702b 100644
--- a/Documentation/gpu/drm-kms-helpers.rst
+++ b/Documentation/gpu/drm-kms-helpers.rst
@@ -221,6 +221,9 @@ Panel Helper Reference
.. kernel-doc:: drivers/gpu/drm/drm_panel_orientation_quirks.c
:export:
+.. kernel-doc:: drivers/gpu/drm/drm_panel_backlight_quirks.c
+ :export:
+
Panel Self Refresh Helper Reference
===================================
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 772fc7625639d..b55be8889e2ca 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -530,6 +530,10 @@ config DRM_HYPERV
config DRM_EXPORT_FOR_TESTS
bool
+# Separate option as not all DRM drivers use it
+config DRM_PANEL_BACKLIGHT_QUIRKS
+ tristate
+
config DRM_LIB_RANDOM
bool
default n
diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
index 463afad1b5ca6..06b73068d2483 100644
--- a/drivers/gpu/drm/Makefile
+++ b/drivers/gpu/drm/Makefile
@@ -95,6 +95,7 @@ drm-$(CONFIG_DRM_PANIC_SCREEN_QR_CODE) += drm_panic_qr.o
obj-$(CONFIG_DRM) += drm.o
obj-$(CONFIG_DRM_PANEL_ORIENTATION_QUIRKS) += drm_panel_orientation_quirks.o
+obj-$(CONFIG_DRM_PANEL_BACKLIGHT_QUIRKS) += drm_panel_backlight_quirks.o
#
# Memory-management helpers
diff --git a/drivers/gpu/drm/drm_panel_backlight_quirks.c b/drivers/gpu/drm/drm_panel_backlight_quirks.c
new file mode 100644
index 0000000000000..6b8bbed77c7f1
--- /dev/null
+++ b/drivers/gpu/drm/drm_panel_backlight_quirks.c
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/array_size.h>
+#include <linux/dmi.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <drm/drm_edid.h>
+#include <drm/drm_utils.h>
+
+struct drm_panel_min_backlight_quirk {
+ struct {
+ enum dmi_field field;
+ const char * const value;
+ } dmi_match;
+ struct drm_edid_ident ident;
+ u8 min_brightness;
+};
+
+static const struct drm_panel_min_backlight_quirk drm_panel_min_backlight_quirks[] = {
+};
+
+static bool drm_panel_min_backlight_quirk_matches(const struct drm_panel_min_backlight_quirk *quirk,
+ const struct drm_edid *edid)
+{
+ if (!dmi_match(quirk->dmi_match.field, quirk->dmi_match.value))
+ return false;
+
+ if (!drm_edid_match(edid, &quirk->ident))
+ return false;
+
+ return true;
+}
+
+/**
+ * drm_get_panel_min_brightness_quirk - Get minimum supported brightness level for a panel.
+ * @edid: EDID of the panel to check
+ *
+ * This function checks for platform specific (e.g. DMI based) quirks
+ * providing info on the minimum backlight brightness for systems where this
+ * cannot be probed correctly from the hard-/firm-ware.
+ *
+ * Returns:
+ * A negative error value or
+ * an override value in the range [0, 255] representing 0-100% to be scaled to
+ * the drivers target range.
+ */
+int drm_get_panel_min_brightness_quirk(const struct drm_edid *edid)
+{
+ const struct drm_panel_min_backlight_quirk *quirk;
+ size_t i;
+
+ if (!IS_ENABLED(CONFIG_DMI))
+ return -ENODATA;
+
+ if (!edid)
+ return -EINVAL;
+
+ for (i = 0; i < ARRAY_SIZE(drm_panel_min_backlight_quirks); i++) {
+ quirk = &drm_panel_min_backlight_quirks[i];
+
+ if (drm_panel_min_backlight_quirk_matches(quirk, edid))
+ return quirk->min_brightness;
+ }
+
+ return -ENODATA;
+}
+EXPORT_SYMBOL(drm_get_panel_min_brightness_quirk);
+
+MODULE_DESCRIPTION("Quirks for panel backlight overrides");
+MODULE_LICENSE("GPL");
diff --git a/include/drm/drm_utils.h b/include/drm/drm_utils.h
index 70775748d243b..15fa9b6865f44 100644
--- a/include/drm/drm_utils.h
+++ b/include/drm/drm_utils.h
@@ -12,8 +12,12 @@
#include <linux/types.h>
+struct drm_edid;
+
int drm_get_panel_orientation_quirk(int width, int height);
+int drm_get_panel_min_brightness_quirk(const struct drm_edid *edid);
+
signed long drm_timeout_abs_to_jiffies(int64_t timeout_nsec);
#endif
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 021/443] drm/amd/display: Add support for minimum backlight quirk
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 020/443] drm: Add panel backlight quirks Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 022/443] drm: panel-backlight-quirks: Add Framework 13 matte panel Greg Kroah-Hartman
` (432 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Dustin L. Howett, Mario Limonciello, Harry Wentland, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <linux@weissschuh.net>
[ Upstream commit c2753b2471c65955de18cbc58530641447e5bfe9 ]
Not all platforms provide the full range of PWM backlight capabilities
supported by the hardware through ATIF.
Use the generic drm panel minimum backlight quirk infrastructure to
override the capabilities where necessary.
Testing the backlight quirk together with the "panel_power_savings"
sysfs file has not shown any negative impact.
One quirk seems to be that 0% at panel_power_savings=0 seems to be
slightly darker than at panel_power_savings=4.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Tested-by: Dustin L. Howett <dustin@howett.net>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241111-amdgpu-min-backlight-quirk-v7-2-f662851fda69@weissschuh.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/Kconfig | 1 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++++
2 files changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/Kconfig b/drivers/gpu/drm/amd/amdgpu/Kconfig
index 41fa3377d9cf5..1a11cab741aca 100644
--- a/drivers/gpu/drm/amd/amdgpu/Kconfig
+++ b/drivers/gpu/drm/amd/amdgpu/Kconfig
@@ -26,6 +26,7 @@ config DRM_AMDGPU
select DRM_BUDDY
select DRM_SUBALLOC_HELPER
select DRM_EXEC
+ select DRM_PANEL_BACKLIGHT_QUIRKS
# amdgpu depends on ACPI_VIDEO when ACPI is enabled, for select to work
# ACPI_VIDEO's dependencies must also be selected.
select INPUT if ACPI
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 53694baca9663..92e1d59921f49 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -93,6 +93,7 @@
#include <drm/drm_fourcc.h>
#include <drm/drm_edid.h>
#include <drm/drm_eld.h>
+#include <drm/drm_utils.h>
#include <drm/drm_vblank.h>
#include <drm/drm_audio_component.h>
#include <drm/drm_gem_atomic_helper.h>
@@ -3457,6 +3458,7 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector)
struct drm_connector *conn_base;
struct amdgpu_device *adev;
struct drm_luminance_range_info *luminance_range;
+ int min_input_signal_override;
if (aconnector->bl_idx == -1 ||
aconnector->dc_link->connector_signal != SIGNAL_TYPE_EDP)
@@ -3493,6 +3495,10 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector)
caps->aux_min_input_signal = 0;
caps->aux_max_input_signal = 512;
}
+
+ min_input_signal_override = drm_get_panel_min_brightness_quirk(aconnector->drm_edid);
+ if (min_input_signal_override >= 0)
+ caps->min_input_signal = min_input_signal_override;
}
void amdgpu_dm_update_connector_after_detect(
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 022/443] drm: panel-backlight-quirks: Add Framework 13 matte panel
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 021/443] drm/amd/display: Add support for minimum backlight quirk Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 023/443] drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels Greg Kroah-Hartman
` (431 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Dustin L. Howett, Mario Limonciello, Harry Wentland, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <linux@weissschuh.net>
[ Upstream commit 916ecc0db336768d80e14ef28a8c64a775274f95 ]
The value of "min_input_signal" returned from ATIF on a Framework AMD 13
is "12". This leads to a fairly bright minimum display backlight.
Add a quirk to override that the minimum backlight PWM to "0" which
leads to a much lower minimum brightness, which is still visible.
Tested on a Framework AMD 13 BIOS 3.05 with the matte panel.
Link: https://community.frame.work/t/25711/9
Link: https://community.frame.work/t/47036
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Tested-by: Dustin L. Howett <dustin@howett.net>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241111-amdgpu-min-backlight-quirk-v7-3-f662851fda69@weissschuh.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel_backlight_quirks.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_backlight_quirks.c b/drivers/gpu/drm/drm_panel_backlight_quirks.c
index 6b8bbed77c7f1..f2aefff618ddb 100644
--- a/drivers/gpu/drm/drm_panel_backlight_quirks.c
+++ b/drivers/gpu/drm/drm_panel_backlight_quirks.c
@@ -17,6 +17,14 @@ struct drm_panel_min_backlight_quirk {
};
static const struct drm_panel_min_backlight_quirk drm_panel_min_backlight_quirks[] = {
+ /* 13 inch matte panel */
+ {
+ .dmi_match.field = DMI_BOARD_VENDOR,
+ .dmi_match.value = "Framework",
+ .ident.panel_id = drm_edid_encode_panel_id('B', 'O', 'E', 0x0bca),
+ .ident.name = "NE135FBM-N41",
+ .min_brightness = 0,
+ },
};
static bool drm_panel_min_backlight_quirk_matches(const struct drm_panel_min_backlight_quirk *quirk,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 023/443] drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 022/443] drm: panel-backlight-quirks: Add Framework 13 matte panel Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 024/443] nvkm/gsp: correctly advance the read pointer of GSP message queue Greg Kroah-Hartman
` (430 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dustin L. Howett,
Thomas Weißschuh, Mario Limonciello, Harry Wentland,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dustin L. Howett <dustin@howett.net>
[ Upstream commit d80b5c5b9be6b2e1cdeaaeaa8259523b63cae292 ]
I have tested these panels on the Framework Laptop 13 AMD with firmware
revision 3.05 (latest at time of submission).
Signed-off-by: Dustin L. Howett <dustin@howett.net>
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241111-amdgpu-min-backlight-quirk-v7-4-f662851fda69@weissschuh.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel_backlight_quirks.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_backlight_quirks.c b/drivers/gpu/drm/drm_panel_backlight_quirks.c
index f2aefff618ddb..c477d98ade2b4 100644
--- a/drivers/gpu/drm/drm_panel_backlight_quirks.c
+++ b/drivers/gpu/drm/drm_panel_backlight_quirks.c
@@ -25,6 +25,22 @@ static const struct drm_panel_min_backlight_quirk drm_panel_min_backlight_quirks
.ident.name = "NE135FBM-N41",
.min_brightness = 0,
},
+ /* 13 inch glossy panel */
+ {
+ .dmi_match.field = DMI_BOARD_VENDOR,
+ .dmi_match.value = "Framework",
+ .ident.panel_id = drm_edid_encode_panel_id('B', 'O', 'E', 0x095f),
+ .ident.name = "NE135FBM-N41",
+ .min_brightness = 0,
+ },
+ /* 13 inch 2.8k panel */
+ {
+ .dmi_match.field = DMI_BOARD_VENDOR,
+ .dmi_match.value = "Framework",
+ .ident.panel_id = drm_edid_encode_panel_id('B', 'O', 'E', 0x0cb4),
+ .ident.name = "NE135A1M-NY1",
+ .min_brightness = 0,
+ },
};
static bool drm_panel_min_backlight_quirk_matches(const struct drm_panel_min_backlight_quirk *quirk,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 024/443] nvkm/gsp: correctly advance the read pointer of GSP message queue
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 023/443] drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 025/443] nvkm: correctly calculate the available space of the GSP cmdq buffer Greg Kroah-Hartman
` (429 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhi Wang, Danilo Krummrich,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhi Wang <zhiw@nvidia.com>
[ Upstream commit 8d9beb4aebc02c4bd09e1d39c9c5f1c68c786dbc ]
A GSP event message consists three parts: message header, RPC header,
message body. GSP calculates the number of pages to write from the
total size of a GSP message. This behavior can be observed from the
movement of the write pointer.
However, nvkm takes only the size of RPC header and message body as
the message size when advancing the read pointer. When handling a
two-page GSP message in the non rollback case, It wrongly takes the
message body of the previous message as the message header of the next
message. As the "message length" tends to be zero, in the calculation of
size needs to be copied (0 - size of (message header)), the size needs to
be copied will be "0xffffffxx". It also triggers a kernel panic due to a
NULL pointer error.
[ 547.614102] msg: 00000f90: ff ff ff ff ff ff ff ff 40 d7 18 fb 8b 00 00 00 ........@.......
[ 547.622533] msg: 00000fa0: 00 00 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
[ 547.630965] msg: 00000fb0: ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff ................
[ 547.639397] msg: 00000fc0: ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................
[ 547.647832] nvkm 0000:c1:00.0: gsp: peek msg rpc fn:0 len:0x0/0xffffffffffffffe0
[ 547.655225] nvkm 0000:c1:00.0: gsp: get msg rpc fn:0 len:0x0/0xffffffffffffffe0
[ 547.662532] BUG: kernel NULL pointer dereference, address: 0000000000000020
[ 547.669485] #PF: supervisor read access in kernel mode
[ 547.674624] #PF: error_code(0x0000) - not-present page
[ 547.679755] PGD 0 P4D 0
[ 547.682294] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 547.686643] CPU: 22 PID: 322 Comm: kworker/22:1 Tainted: G E 6.9.0-rc6+ #1
[ 547.694893] Hardware name: ASRockRack 1U1G-MILAN/N/ROMED8-NL, BIOS L3.12E 09/06/2022
[ 547.702626] Workqueue: events r535_gsp_msgq_work [nvkm]
[ 547.707921] RIP: 0010:r535_gsp_msg_recv+0x87/0x230 [nvkm]
[ 547.713375] Code: 00 8b 70 08 48 89 e1 31 d2 4c 89 f7 e8 12 f5 ff ff 48 89 c5 48 85 c0 0f 84 cf 00 00 00 48 81 fd 00 f0 ff ff 0f 87 c4 00 00 00 <8b> 55 10 41 8b 46 30 85 d2 0f 85 f6 00 00 00 83 f8 04 76 10 ba 05
[ 547.732119] RSP: 0018:ffffabe440f87e10 EFLAGS: 00010203
[ 547.737335] RAX: 0000000000000010 RBX: 0000000000000008 RCX: 000000000000003f
[ 547.744461] RDX: 0000000000000000 RSI: ffffabe4480a8030 RDI: 0000000000000010
[ 547.751585] RBP: 0000000000000010 R08: 0000000000000000 R09: ffffabe440f87bb0
[ 547.758707] R10: ffffabe440f87dc8 R11: 0000000000000010 R12: 0000000000000000
[ 547.765834] R13: 0000000000000000 R14: ffff9351df1e5000 R15: 0000000000000000
[ 547.772958] FS: 0000000000000000(0000) GS:ffff93708eb00000(0000) knlGS:0000000000000000
[ 547.781035] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 547.786771] CR2: 0000000000000020 CR3: 00000003cc220002 CR4: 0000000000770ef0
[ 547.793896] PKRU: 55555554
[ 547.796600] Call Trace:
[ 547.799046] <TASK>
[ 547.801152] ? __die+0x20/0x70
[ 547.804211] ? page_fault_oops+0x75/0x170
[ 547.808221] ? print_hex_dump+0x100/0x160
[ 547.812226] ? exc_page_fault+0x64/0x150
[ 547.816152] ? asm_exc_page_fault+0x22/0x30
[ 547.820341] ? r535_gsp_msg_recv+0x87/0x230 [nvkm]
[ 547.825184] r535_gsp_msgq_work+0x42/0x50 [nvkm]
[ 547.829845] process_one_work+0x196/0x3d0
[ 547.833861] worker_thread+0x2fc/0x410
[ 547.837613] ? __pfx_worker_thread+0x10/0x10
[ 547.841885] kthread+0xdf/0x110
[ 547.845031] ? __pfx_kthread+0x10/0x10
[ 547.848775] ret_from_fork+0x30/0x50
[ 547.852354] ? __pfx_kthread+0x10/0x10
[ 547.856097] ret_from_fork_asm+0x1a/0x30
[ 547.860019] </TASK>
[ 547.862208] Modules linked in: nvkm(E) gsp_log(E) snd_seq_dummy(E) snd_hrtimer(E) snd_seq(E) snd_timer(E) snd_seq_device(E) snd(E) soundcore(E) rfkill(E) qrtr(E) vfat(E) fat(E) ipmi_ssif(E) amd_atl(E) intel_rapl_msr(E) intel_rapl_common(E) amd64_edac(E) mlx5_ib(E) edac_mce_amd(E) kvm_amd(E) ib_uverbs(E) kvm(E) ib_core(E) acpi_ipmi(E) ipmi_si(E) ipmi_devintf(E) mxm_wmi(E) joydev(E) rapl(E) ptdma(E) i2c_piix4(E) acpi_cpufreq(E) wmi_bmof(E) pcspkr(E) k10temp(E) ipmi_msghandler(E) xfs(E) libcrc32c(E) ast(E) i2c_algo_bit(E) drm_shmem_helper(E) crct10dif_pclmul(E) drm_kms_helper(E) ahci(E) crc32_pclmul(E) nvme_tcp(E) libahci(E) nvme(E) crc32c_intel(E) nvme_fabrics(E) cdc_ether(E) nvme_core(E) usbnet(E) mlx5_core(E) ghash_clmulni_intel(E) drm(E) libata(E) ccp(E) mii(E) t10_pi(E) mlxfw(E) sp5100_tco(E) psample(E) pci_hyperv_intf(E) wmi(E) dm_multipath(E) sunrpc(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) be2iscsi(E) bnx2i(E) cnic(E) uio(E) cxgb4i(E) cxgb4(E) tls(E) libcxgbi(E) libcxgb(E) qla4xxx(E)
[ 547.862283] iscsi_boot_sysfs(E) iscsi_tcp(E) libiscsi_tcp(E) libiscsi(E) scsi_transport_iscsi(E) fuse(E) [last unloaded: gsp_log(E)]
[ 547.962691] CR2: 0000000000000020
[ 547.966003] ---[ end trace 0000000000000000 ]---
[ 549.012012] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 1370499158 wd_nsec: 1370498904
[ 549.043676] pstore: backend (erst) writing error (-28)
[ 549.050924] RIP: 0010:r535_gsp_msg_recv+0x87/0x230 [nvkm]
[ 549.056389] Code: 00 8b 70 08 48 89 e1 31 d2 4c 89 f7 e8 12 f5 ff ff 48 89 c5 48 85 c0 0f 84 cf 00 00 00 48 81 fd 00 f0 ff ff 0f 87 c4 00 00 00 <8b> 55 10 41 8b 46 30 85 d2 0f 85 f6 00 00 00 83 f8 04 76 10 ba 05
[ 549.075138] RSP: 0018:ffffabe440f87e10 EFLAGS: 00010203
[ 549.080361] RAX: 0000000000000010 RBX: 0000000000000008 RCX: 000000000000003f
[ 549.087484] RDX: 0000000000000000 RSI: ffffabe4480a8030 RDI: 0000000000000010
[ 549.094609] RBP: 0000000000000010 R08: 0000000000000000 R09: ffffabe440f87bb0
[ 549.101733] R10: ffffabe440f87dc8 R11: 0000000000000010 R12: 0000000000000000
[ 549.108857] R13: 0000000000000000 R14: ffff9351df1e5000 R15: 0000000000000000
[ 549.115982] FS: 0000000000000000(0000) GS:ffff93708eb00000(0000) knlGS:0000000000000000
[ 549.124061] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 549.129807] CR2: 0000000000000020 CR3: 00000003cc220002 CR4: 0000000000770ef0
[ 549.136940] PKRU: 55555554
[ 549.139653] Kernel panic - not syncing: Fatal exception
[ 549.145054] Kernel Offset: 0x18c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 549.165074] ---[ end Kernel panic - not syncing: Fatal exception ]---
Also, nvkm wrongly advances the read pointer when handling a two-page GSP
message in the rollback case. In the rollback case, the GSP message will
be copied in two rounds. When handling a two-page GSP message, nvkm first
copies amount of (GSP_PAGE_SIZE - header) data into the buffer, then
advances the read pointer by the result of DIV_ROUND_UP(size,
GSP_PAGE_SIZE). Thus, the read pointer is advanced by 1.
Next, nvkm copies the amount of (total size - (GSP_PAGE_SIZE -
header)) data into the buffer. The left amount of the data will be always
larger than one page since the message header is not taken into account
in the first copy. Thus, the read pointer is advanced by DIV_ROUND_UP(
size(larger than one page), GSP_PAGE_SIZE) = 2.
In the end, the read pointer is wrongly advanced by 3 when handling a
two-page GSP message in the rollback case.
Fix the problems by taking the total size of the message into account
when advancing the read pointer and calculate the read pointer in the end
of the all copies for the rollback case.
BTW: the two-page GSP message can be observed in the msgq when vGPU is
enabled.
Signed-off-by: Zhi Wang <zhiw@nvidia.com>
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241017071922.2518724-2-zhiw@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
index d586aea308984..bd4b5d6a7bd36 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
@@ -121,6 +121,8 @@ r535_gsp_msgq_wait(struct nvkm_gsp *gsp, u32 repc, u32 *prepc, int *ptime)
return mqe->data;
}
+ size = ALIGN(repc + GSP_MSG_HDR_SIZE, GSP_PAGE_SIZE);
+
msg = kvmalloc(repc, GFP_KERNEL);
if (!msg)
return ERR_PTR(-ENOMEM);
@@ -129,19 +131,15 @@ r535_gsp_msgq_wait(struct nvkm_gsp *gsp, u32 repc, u32 *prepc, int *ptime)
len = min_t(u32, repc, len);
memcpy(msg, mqe->data, len);
- rptr += DIV_ROUND_UP(len, GSP_PAGE_SIZE);
- if (rptr == gsp->msgq.cnt)
- rptr = 0;
-
repc -= len;
if (repc) {
mqe = (void *)((u8 *)gsp->shm.msgq.ptr + 0x1000 + 0 * 0x1000);
memcpy(msg + len, mqe, repc);
-
- rptr += DIV_ROUND_UP(repc, GSP_PAGE_SIZE);
}
+ rptr = (rptr + DIV_ROUND_UP(size, GSP_PAGE_SIZE)) % gsp->msgq.cnt;
+
mb();
(*gsp->msgq.rptr) = rptr;
return msg;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 025/443] nvkm: correctly calculate the available space of the GSP cmdq buffer
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 024/443] nvkm/gsp: correctly advance the read pointer of GSP message queue Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 026/443] drm/tests: hdmi: handle empty modes in find_preferred_mode() Greg Kroah-Hartman
` (428 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhi Wang, Danilo Krummrich,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhi Wang <zhiw@nvidia.com>
[ Upstream commit 01ed662bdd6fce4f59c1804b334610d710d79fa0 ]
r535_gsp_cmdq_push() waits for the available page in the GSP cmdq
buffer when handling a large RPC request. When it sees at least one
available page in the cmdq, it quits the waiting with the amount of
free buffer pages in the queue.
Unfortunately, it always takes the [write pointer, buf_size) as
available buffer pages before rolling back and wrongly calculates the
size of the data should be copied. Thus, it can overwrite the RPC
request that GSP is currently reading, which causes GSP hang due
to corrupted RPC request:
[ 549.209389] ------------[ cut here ]------------
[ 549.214010] WARNING: CPU: 8 PID: 6314 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:116 r535_gsp_msgq_wait+0xd0/0x190 [nvkm]
[ 549.225678] Modules linked in: nvkm(E+) gsp_log(E) snd_seq_dummy(E) snd_hrtimer(E) snd_seq(E) snd_timer(E) snd_seq_device(E) snd(E) soundcore(E) rfkill(E) qrtr(E) vfat(E) fat(E) ipmi_ssif(E) amd_atl(E) intel_rapl_msr(E) intel_rapl_common(E) mlx5_ib(E) amd64_edac(E) edac_mce_amd(E) kvm_amd(E) ib_uverbs(E) kvm(E) ib_core(E) acpi_ipmi(E) ipmi_si(E) mxm_wmi(E) ipmi_devintf(E) rapl(E) i2c_piix4(E) wmi_bmof(E) joydev(E) ptdma(E) acpi_cpufreq(E) k10temp(E) pcspkr(E) ipmi_msghandler(E) xfs(E) libcrc32c(E) ast(E) i2c_algo_bit(E) crct10dif_pclmul(E) drm_shmem_helper(E) nvme_tcp(E) crc32_pclmul(E) ahci(E) drm_kms_helper(E) libahci(E) nvme_fabrics(E) crc32c_intel(E) nvme(E) cdc_ether(E) mlx5_core(E) nvme_core(E) usbnet(E) drm(E) libata(E) ccp(E) ghash_clmulni_intel(E) mii(E) t10_pi(E) mlxfw(E) sp5100_tco(E) psample(E) pci_hyperv_intf(E) wmi(E) dm_multipath(E) sunrpc(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E) be2iscsi(E) bnx2i(E) cnic(E) uio(E) cxgb4i(E) cxgb4(E) tls(E) libcxgbi(E) libcxgb(E) qla4xxx(E)
[ 549.225752] iscsi_boot_sysfs(E) iscsi_tcp(E) libiscsi_tcp(E) libiscsi(E) scsi_transport_iscsi(E) fuse(E) [last unloaded: gsp_log(E)]
[ 549.326293] CPU: 8 PID: 6314 Comm: insmod Tainted: G E 6.9.0-rc6+ #1
[ 549.334039] Hardware name: ASRockRack 1U1G-MILAN/N/ROMED8-NL, BIOS L3.12E 09/06/2022
[ 549.341781] RIP: 0010:r535_gsp_msgq_wait+0xd0/0x190 [nvkm]
[ 549.347343] Code: 08 00 00 89 da c1 e2 0c 48 8d ac 11 00 10 00 00 48 8b 0c 24 48 85 c9 74 1f c1 e0 0c 4c 8d 6d 30 83 e8 30 89 01 e9 68 ff ff ff <0f> 0b 49 c7 c5 92 ff ff ff e9 5a ff ff ff ba ff ff ff ff be c0 0c
[ 549.366090] RSP: 0018:ffffacbccaaeb7d0 EFLAGS: 00010246
[ 549.371315] RAX: 0000000000000000 RBX: 0000000000000012 RCX: 0000000000923e28
[ 549.378451] RDX: 0000000000000000 RSI: 0000000055555554 RDI: ffffacbccaaeb730
[ 549.385590] RBP: 0000000000000001 R08: ffff8bd14d235f70 R09: ffff8bd14d235f70
[ 549.392721] R10: 0000000000000002 R11: ffff8bd14d233864 R12: 0000000000000020
[ 549.399854] R13: ffffacbccaaeb818 R14: 0000000000000020 R15: ffff8bb298c67000
[ 549.406988] FS: 00007f5179244740(0000) GS:ffff8bd14d200000(0000) knlGS:0000000000000000
[ 549.415076] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 549.420829] CR2: 00007fa844000010 CR3: 00000001567dc005 CR4: 0000000000770ef0
[ 549.427963] PKRU: 55555554
[ 549.430672] Call Trace:
[ 549.433126] <TASK>
[ 549.435233] ? __warn+0x7f/0x130
[ 549.438473] ? r535_gsp_msgq_wait+0xd0/0x190 [nvkm]
[ 549.443426] ? report_bug+0x18a/0x1a0
[ 549.447098] ? handle_bug+0x3c/0x70
[ 549.450589] ? exc_invalid_op+0x14/0x70
[ 549.454430] ? asm_exc_invalid_op+0x16/0x20
[ 549.458619] ? r535_gsp_msgq_wait+0xd0/0x190 [nvkm]
[ 549.463565] r535_gsp_msg_recv+0x46/0x230 [nvkm]
[ 549.468257] r535_gsp_rpc_push+0x106/0x160 [nvkm]
[ 549.473033] r535_gsp_rpc_rm_ctrl_push+0x40/0x130 [nvkm]
[ 549.478422] nvidia_grid_init_vgpu_types+0xbc/0xe0 [nvkm]
[ 549.483899] nvidia_grid_init+0xb1/0xd0 [nvkm]
[ 549.488420] ? srso_alias_return_thunk+0x5/0xfbef5
[ 549.493213] nvkm_device_pci_probe+0x305/0x420 [nvkm]
[ 549.498338] local_pci_probe+0x46/0xa0
[ 549.502096] pci_call_probe+0x56/0x170
[ 549.505851] pci_device_probe+0x79/0xf0
[ 549.509690] ? driver_sysfs_add+0x59/0xc0
[ 549.513702] really_probe+0xd9/0x380
[ 549.517282] __driver_probe_device+0x78/0x150
[ 549.521640] driver_probe_device+0x1e/0x90
[ 549.525746] __driver_attach+0xd2/0x1c0
[ 549.529594] ? __pfx___driver_attach+0x10/0x10
[ 549.534045] bus_for_each_dev+0x78/0xd0
[ 549.537893] bus_add_driver+0x112/0x210
[ 549.541750] driver_register+0x5c/0x120
[ 549.545596] ? __pfx_nvkm_init+0x10/0x10 [nvkm]
[ 549.550224] do_one_initcall+0x44/0x300
[ 549.554063] ? do_init_module+0x23/0x240
[ 549.557989] do_init_module+0x64/0x240
Calculate the available buffer page before rolling back based on
the result from the waiting.
Signed-off-by: Zhi Wang <zhiw@nvidia.com>
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241017071922.2518724-3-zhiw@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
index bd4b5d6a7bd36..9c83bab0a5309 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c
@@ -161,7 +161,7 @@ r535_gsp_cmdq_push(struct nvkm_gsp *gsp, void *argv)
u64 *end;
u64 csum = 0;
int free, time = 1000000;
- u32 wptr, size;
+ u32 wptr, size, step;
u32 off = 0;
argc = ALIGN(GSP_MSG_HDR_SIZE + argc, GSP_PAGE_SIZE);
@@ -195,7 +195,9 @@ r535_gsp_cmdq_push(struct nvkm_gsp *gsp, void *argv)
}
cqe = (void *)((u8 *)gsp->shm.cmdq.ptr + 0x1000 + wptr * 0x1000);
- size = min_t(u32, argc, (gsp->cmdq.cnt - wptr) * GSP_PAGE_SIZE);
+ step = min_t(u32, free, (gsp->cmdq.cnt - wptr));
+ size = min_t(u32, argc, step * GSP_PAGE_SIZE);
+
memcpy(cqe, (u8 *)cmd + off, size);
wptr += DIV_ROUND_UP(size, 0x1000);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 026/443] drm/tests: hdmi: handle empty modes in find_preferred_mode()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 025/443] nvkm: correctly calculate the available space of the GSP cmdq buffer Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 027/443] drm/tests: hdmi: return meaningful value from set_connector_edid() Greg Kroah-Hartman
` (427 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Baryshkov,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit d3314efd6ebf335a3682b1d6b1b81cdab3d8254a ]
If the connector->modes list is empty, then list_first_entry() returns a
bogus entry. Change that to use list_first_entry_or_null().
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241130-hdmi-mode-valid-v5-1-742644ec3b1f@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
index 294773342e710..1e77689af6549 100644
--- a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
+++ b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
@@ -46,7 +46,7 @@ static struct drm_display_mode *find_preferred_mode(struct drm_connector *connec
struct drm_display_mode *mode, *preferred;
mutex_lock(&drm->mode_config.mutex);
- preferred = list_first_entry(&connector->modes, struct drm_display_mode, head);
+ preferred = list_first_entry_or_null(&connector->modes, struct drm_display_mode, head);
list_for_each_entry(mode, &connector->modes, head)
if (mode->type & DRM_MODE_TYPE_PREFERRED)
preferred = mode;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 027/443] drm/tests: hdmi: return meaningful value from set_connector_edid()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 026/443] drm/tests: hdmi: handle empty modes in find_preferred_mode() Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 028/443] drm/amd/display: Populate chroma prefetch parameters, DET buffer fix Greg Kroah-Hartman
` (426 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Baryshkov,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit a8403be6eea91e4f5d8ad5dbc463dd08339eaece ]
The set_connector_edid() function returns a bogus 0, performing the
check on the connector->funcs->fill_modes() result internally. Make the
function pass the fill_modes()'s return value to the caller and move
corresponding checks to the caller site.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241130-hdmi-mode-valid-v5-3-742644ec3b1f@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/tests/drm_hdmi_state_helper_test.c | 31 +++++++++----------
1 file changed, 15 insertions(+), 16 deletions(-)
diff --git a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
index 1e77689af6549..4ba869e0e794c 100644
--- a/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
+++ b/drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c
@@ -105,9 +105,8 @@ static int set_connector_edid(struct kunit *test, struct drm_connector *connecto
mutex_lock(&drm->mode_config.mutex);
ret = connector->funcs->fill_modes(connector, 4096, 4096);
mutex_unlock(&drm->mode_config.mutex);
- KUNIT_ASSERT_GT(test, ret, 0);
- return 0;
+ return ret;
}
static const struct drm_connector_hdmi_funcs dummy_connector_hdmi_funcs = {
@@ -223,7 +222,7 @@ drm_atomic_helper_connector_hdmi_init(struct kunit *test,
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
return priv;
}
@@ -728,7 +727,7 @@ static void drm_test_check_output_bpc_crtc_mode_changed(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
ctx = drm_kunit_helper_acquire_ctx_alloc(test);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
@@ -802,7 +801,7 @@ static void drm_test_check_output_bpc_crtc_mode_not_changed(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
ctx = drm_kunit_helper_acquire_ctx_alloc(test);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
@@ -873,7 +872,7 @@ static void drm_test_check_output_bpc_dvi(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_dvi_1080p,
ARRAY_SIZE(test_edid_dvi_1080p));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
info = &conn->display_info;
KUNIT_ASSERT_FALSE(test, info->is_hdmi);
@@ -920,7 +919,7 @@ static void drm_test_check_tmds_char_rate_rgb_8bpc(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
ctx = drm_kunit_helper_acquire_ctx_alloc(test);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
@@ -967,7 +966,7 @@ static void drm_test_check_tmds_char_rate_rgb_10bpc(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
ctx = drm_kunit_helper_acquire_ctx_alloc(test);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
@@ -1014,7 +1013,7 @@ static void drm_test_check_tmds_char_rate_rgb_12bpc(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
ctx = drm_kunit_helper_acquire_ctx_alloc(test);
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ctx);
@@ -1121,7 +1120,7 @@ static void drm_test_check_max_tmds_rate_bpc_fallback(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
info = &conn->display_info;
KUNIT_ASSERT_TRUE(test, info->is_hdmi);
@@ -1190,7 +1189,7 @@ static void drm_test_check_max_tmds_rate_format_fallback(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
info = &conn->display_info;
KUNIT_ASSERT_TRUE(test, info->is_hdmi);
@@ -1254,7 +1253,7 @@ static void drm_test_check_output_bpc_format_vic_1(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
info = &conn->display_info;
KUNIT_ASSERT_TRUE(test, info->is_hdmi);
@@ -1314,7 +1313,7 @@ static void drm_test_check_output_bpc_format_driver_rgb_only(struct kunit *test)
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
info = &conn->display_info;
KUNIT_ASSERT_TRUE(test, info->is_hdmi);
@@ -1381,7 +1380,7 @@ static void drm_test_check_output_bpc_format_display_rgb_only(struct kunit *test
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_max_200mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_200mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
info = &conn->display_info;
KUNIT_ASSERT_TRUE(test, info->is_hdmi);
@@ -1447,7 +1446,7 @@ static void drm_test_check_output_bpc_format_driver_8bpc_only(struct kunit *test
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_yuv_dc_max_340mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
info = &conn->display_info;
KUNIT_ASSERT_TRUE(test, info->is_hdmi);
@@ -1507,7 +1506,7 @@ static void drm_test_check_output_bpc_format_display_8bpc_only(struct kunit *tes
ret = set_connector_edid(test, conn,
test_edid_hdmi_1080p_rgb_max_340mhz,
ARRAY_SIZE(test_edid_hdmi_1080p_rgb_max_340mhz));
- KUNIT_ASSERT_EQ(test, ret, 0);
+ KUNIT_ASSERT_GT(test, ret, 0);
info = &conn->display_info;
KUNIT_ASSERT_TRUE(test, info->is_hdmi);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 028/443] drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 027/443] drm/tests: hdmi: return meaningful value from set_connector_edid() Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 029/443] drm/amd/display: Overwriting dualDPP UBF values before usage Greg Kroah-Hartman
` (425 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Charlene Liu, Ausef Yousof,
Fangzhi Zuo, Daniel Wheeler, Alex Deucher, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ausef Yousof <Ausef.Yousof@amd.com>
[ Upstream commit 70fec46519fca859aa209f5f02e7e0a0123aca4a ]
[WHY]
Soft hang/lag observed during 10bit playback + moving cursor, corruption
observed in other tickets for same reason, also failing MPO.
1. Currently, we are always running
calculate_lowest_supported_state_for_temp_read which is only
necessary on dGPU
2. Fast validate path does not apply DET buffer allocation policy
3. Prefetch UrgBFactor chroma parameter not populated in prefetch
calculation
[HOW]
1. Add a check to see if we are on APU, if so, skip the code
2. Add det buffer alloc policy checks to fast validate path
3. Populate UrgentBurstChroma param in call to calculate
UrgBChroma prefetch values
-revision commits: small formatting/brackets/null check addition + remove test change + dGPU code
Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Signed-off-by: Ausef Yousof <Ausef.Yousof@amd.com>
Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/dml2/display_mode_core.c | 5 ++-
.../drm/amd/display/dc/dml2/dml2_wrapper.c | 35 +++++++++++++------
2 files changed, 29 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
index 8dabb1ac0b684..be87dc0f07799 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
@@ -6434,7 +6434,7 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib)
/* Output */
&mode_lib->ms.UrgentBurstFactorCursorPre[k],
&mode_lib->ms.UrgentBurstFactorLumaPre[k],
- &mode_lib->ms.UrgentBurstFactorChroma[k],
+ &mode_lib->ms.UrgentBurstFactorChromaPre[k],
&mode_lib->ms.NotUrgentLatencyHidingPre[k]);
mode_lib->ms.cursor_bw_pre[k] = mode_lib->ms.cache_display_cfg.plane.NumberOfCursors[k] * mode_lib->ms.cache_display_cfg.plane.CursorWidth[k] *
@@ -9190,6 +9190,8 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc
&locals->FractionOfUrgentBandwidth,
&s->dummy_boolean[0]); // dml_bool_t *PrefetchBandwidthSupport
+
+
if (s->VRatioPrefetchMoreThanMax != false || s->DestinationLineTimesForPrefetchLessThan2 != false) {
dml_print("DML::%s: VRatioPrefetchMoreThanMax = %u\n", __func__, s->VRatioPrefetchMoreThanMax);
dml_print("DML::%s: DestinationLineTimesForPrefetchLessThan2 = %u\n", __func__, s->DestinationLineTimesForPrefetchLessThan2);
@@ -9204,6 +9206,7 @@ void dml_core_mode_programming(struct display_mode_lib_st *mode_lib, const struc
}
}
+
if (locals->PrefetchModeSupported == true && mode_lib->ms.support.ImmediateFlipSupport == true) {
locals->BandwidthAvailableForImmediateFlip = CalculateBandwidthAvailableForImmediateFlip(
mode_lib->ms.num_active_planes,
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
index 9190c1328d5b2..340791d40ecbf 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c
@@ -531,14 +531,21 @@ static bool optimize_pstate_with_svp_and_drr(struct dml2_context *dml2, struct d
static bool call_dml_mode_support_and_programming(struct dc_state *context)
{
unsigned int result = 0;
- unsigned int min_state;
+ unsigned int min_state = 0;
int min_state_for_g6_temp_read = 0;
+
+
+ if (!context)
+ return false;
+
struct dml2_context *dml2 = context->bw_ctx.dml2;
struct dml2_wrapper_scratch *s = &dml2->v20.scratch;
- min_state_for_g6_temp_read = calculate_lowest_supported_state_for_temp_read(dml2, context);
+ if (!context->streams[0]->sink->link->dc->caps.is_apu) {
+ min_state_for_g6_temp_read = calculate_lowest_supported_state_for_temp_read(dml2, context);
- ASSERT(min_state_for_g6_temp_read >= 0);
+ ASSERT(min_state_for_g6_temp_read >= 0);
+ }
if (!dml2->config.use_native_pstate_optimization) {
result = optimize_pstate_with_svp_and_drr(dml2, context);
@@ -549,14 +556,20 @@ static bool call_dml_mode_support_and_programming(struct dc_state *context)
/* Upon trying to sett certain frequencies in FRL, min_state_for_g6_temp_read is reported as -1. This leads to an invalid value of min_state causing crashes later on.
* Use the default logic for min_state only when min_state_for_g6_temp_read is a valid value. In other cases, use the value calculated by the DML directly.
*/
- if (min_state_for_g6_temp_read >= 0)
- min_state = min_state_for_g6_temp_read > s->mode_support_params.out_lowest_state_idx ? min_state_for_g6_temp_read : s->mode_support_params.out_lowest_state_idx;
- else
- min_state = s->mode_support_params.out_lowest_state_idx;
-
- if (result)
- result = dml_mode_programming(&dml2->v20.dml_core_ctx, min_state, &s->cur_display_config, true);
+ if (!context->streams[0]->sink->link->dc->caps.is_apu) {
+ if (min_state_for_g6_temp_read >= 0)
+ min_state = min_state_for_g6_temp_read > s->mode_support_params.out_lowest_state_idx ? min_state_for_g6_temp_read : s->mode_support_params.out_lowest_state_idx;
+ else
+ min_state = s->mode_support_params.out_lowest_state_idx;
+ }
+ if (result) {
+ if (!context->streams[0]->sink->link->dc->caps.is_apu) {
+ result = dml_mode_programming(&dml2->v20.dml_core_ctx, min_state, &s->cur_display_config, true);
+ } else {
+ result = dml_mode_programming(&dml2->v20.dml_core_ctx, s->mode_support_params.out_lowest_state_idx, &s->cur_display_config, true);
+ }
+ }
return result;
}
@@ -685,6 +698,8 @@ static bool dml2_validate_only(struct dc_state *context)
build_unoptimized_policy_settings(dml2->v20.dml_core_ctx.project, &dml2->v20.dml_core_ctx.policy);
map_dc_state_into_dml_display_cfg(dml2, context, &dml2->v20.scratch.cur_display_config);
+ if (!dml2->config.skip_hw_state_mapping)
+ dml2_apply_det_buffer_allocation_policy(dml2, &dml2->v20.scratch.cur_display_config);
result = pack_and_call_dml_mode_support_ex(dml2,
&dml2->v20.scratch.cur_display_config,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 029/443] drm/amd/display: Overwriting dualDPP UBF values before usage
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 028/443] drm/amd/display: Populate chroma prefetch parameters, DET buffer fix Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 030/443] printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX Greg Kroah-Hartman
` (424 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicholas Kazlauskas, Ausef Yousof,
Aurabindo Pillai, Daniel Wheeler, Alex Deucher, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ausef Yousof <Ausef.Yousof@amd.com>
[ Upstream commit 24909d9ec7c3afa8da2f3c9afa312e7a4a61f250 ]
[WHY]
Right now in dml2 mode validation we are calculating UBF parameters for
prefetch calculation for single and dual DPP scenarios. Data structure
to store such values are just 1D arrays, the single DPP values are
overwritten by the dualDPP values, and we end up using dualDPP for
prefetch calculations twice (once in place of singleDPP support check
and again for dual).
This naturally leads to many problems, one of which validating a mode in
"singleDPP" (when we used dual DPP parameters) and sending the singleDPP
parameters to mode programming, if we cannot support then we observe the
corruption as described in the ticket.
[HOW]
UBF values need to have 2d arrays to store values specific to single and
dual DPP states to avoid single DPP values being overwritten. Other
parameters are recorded on a per state basis such as prefetch UBF values
but they are in the same loop used for calculation and at that point its
fine to overwrite them, its not the case for plain UBF values.
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Ausef Yousof <Ausef.Yousof@amd.com>
Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../amd/display/dc/dml2/display_mode_core.c | 30 +++++++++----------
.../dc/dml2/display_mode_core_structs.h | 6 ++--
2 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
index be87dc0f07799..6822b07951204 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
@@ -6301,9 +6301,9 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib)
mode_lib->ms.meta_row_bandwidth_this_state,
mode_lib->ms.dpte_row_bandwidth_this_state,
mode_lib->ms.NoOfDPPThisState,
- mode_lib->ms.UrgentBurstFactorLuma,
- mode_lib->ms.UrgentBurstFactorChroma,
- mode_lib->ms.UrgentBurstFactorCursor);
+ mode_lib->ms.UrgentBurstFactorLuma[j],
+ mode_lib->ms.UrgentBurstFactorChroma[j],
+ mode_lib->ms.UrgentBurstFactorCursor[j]);
s->VMDataOnlyReturnBWPerState = dml_get_return_bw_mbps_vm_only(
&mode_lib->ms.soc,
@@ -6458,9 +6458,9 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib)
mode_lib->ms.cursor_bw_pre,
mode_lib->ms.prefetch_vmrow_bw,
mode_lib->ms.NoOfDPPThisState,
- mode_lib->ms.UrgentBurstFactorLuma,
- mode_lib->ms.UrgentBurstFactorChroma,
- mode_lib->ms.UrgentBurstFactorCursor,
+ mode_lib->ms.UrgentBurstFactorLuma[j],
+ mode_lib->ms.UrgentBurstFactorChroma[j],
+ mode_lib->ms.UrgentBurstFactorCursor[j],
mode_lib->ms.UrgentBurstFactorLumaPre,
mode_lib->ms.UrgentBurstFactorChromaPre,
mode_lib->ms.UrgentBurstFactorCursorPre,
@@ -6517,9 +6517,9 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib)
mode_lib->ms.cursor_bw,
mode_lib->ms.cursor_bw_pre,
mode_lib->ms.NoOfDPPThisState,
- mode_lib->ms.UrgentBurstFactorLuma,
- mode_lib->ms.UrgentBurstFactorChroma,
- mode_lib->ms.UrgentBurstFactorCursor,
+ mode_lib->ms.UrgentBurstFactorLuma[j],
+ mode_lib->ms.UrgentBurstFactorChroma[j],
+ mode_lib->ms.UrgentBurstFactorCursor[j],
mode_lib->ms.UrgentBurstFactorLumaPre,
mode_lib->ms.UrgentBurstFactorChromaPre,
mode_lib->ms.UrgentBurstFactorCursorPre);
@@ -6586,9 +6586,9 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib)
mode_lib->ms.cursor_bw_pre,
mode_lib->ms.prefetch_vmrow_bw,
mode_lib->ms.NoOfDPP[j], // VBA_ERROR DPPPerSurface is not assigned at this point, should use NoOfDpp here
- mode_lib->ms.UrgentBurstFactorLuma,
- mode_lib->ms.UrgentBurstFactorChroma,
- mode_lib->ms.UrgentBurstFactorCursor,
+ mode_lib->ms.UrgentBurstFactorLuma[j],
+ mode_lib->ms.UrgentBurstFactorChroma[j],
+ mode_lib->ms.UrgentBurstFactorCursor[j],
mode_lib->ms.UrgentBurstFactorLumaPre,
mode_lib->ms.UrgentBurstFactorChromaPre,
mode_lib->ms.UrgentBurstFactorCursorPre,
@@ -7809,9 +7809,9 @@ dml_bool_t dml_core_mode_support(struct display_mode_lib_st *mode_lib)
mode_lib->ms.DETBufferSizeYThisState[k],
mode_lib->ms.DETBufferSizeCThisState[k],
/* Output */
- &mode_lib->ms.UrgentBurstFactorCursor[k],
- &mode_lib->ms.UrgentBurstFactorLuma[k],
- &mode_lib->ms.UrgentBurstFactorChroma[k],
+ &mode_lib->ms.UrgentBurstFactorCursor[j][k],
+ &mode_lib->ms.UrgentBurstFactorLuma[j][k],
+ &mode_lib->ms.UrgentBurstFactorChroma[j][k],
&mode_lib->ms.NotUrgentLatencyHiding[k]);
}
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h
index f951936bb579e..504c427b3b319 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h
+++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core_structs.h
@@ -884,11 +884,11 @@ struct mode_support_st {
dml_uint_t meta_row_height[__DML_NUM_PLANES__];
dml_uint_t meta_row_height_chroma[__DML_NUM_PLANES__];
dml_float_t UrgLatency;
- dml_float_t UrgentBurstFactorCursor[__DML_NUM_PLANES__];
+ dml_float_t UrgentBurstFactorCursor[2][__DML_NUM_PLANES__];
dml_float_t UrgentBurstFactorCursorPre[__DML_NUM_PLANES__];
- dml_float_t UrgentBurstFactorLuma[__DML_NUM_PLANES__];
+ dml_float_t UrgentBurstFactorLuma[2][__DML_NUM_PLANES__];
dml_float_t UrgentBurstFactorLumaPre[__DML_NUM_PLANES__];
- dml_float_t UrgentBurstFactorChroma[__DML_NUM_PLANES__];
+ dml_float_t UrgentBurstFactorChroma[2][__DML_NUM_PLANES__];
dml_float_t UrgentBurstFactorChromaPre[__DML_NUM_PLANES__];
dml_float_t MaximumSwathWidthInLineBufferLuma;
dml_float_t MaximumSwathWidthInLineBufferChroma;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 030/443] printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 029/443] drm/amd/display: Overwriting dualDPP UBF values before usage Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 031/443] drm/msm/dpu: filter out too wide modes if no 3dmux is present Greg Kroah-Hartman
` (423 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kuan-Wei Chiu, Petr Mladek,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <visitorckw@gmail.com>
[ Upstream commit 3d6f83df8ff2d5de84b50377e4f0d45e25311c7a ]
Shifting 1 << 31 on a 32-bit int causes signed integer overflow, which
leads to undefined behavior. To prevent this, cast 1 to u32 before
performing the shift, ensuring well-defined behavior.
This change explicitly avoids any potential overflow by ensuring that
the shift occurs on an unsigned 32-bit integer.
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Acked-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20240928113608.1438087-1-visitorckw@gmail.com
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/printk/printk.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index f446a06b4da8c..07668433644b8 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -523,7 +523,7 @@ static struct latched_seq clear_seq = {
/* record buffer */
#define LOG_ALIGN __alignof__(unsigned long)
#define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT)
-#define LOG_BUF_LEN_MAX (u32)(1 << 31)
+#define LOG_BUF_LEN_MAX ((u32)1 << 31)
static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
static char *log_buf = __log_buf;
static u32 log_buf_len = __LOG_BUF_LEN;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 031/443] drm/msm/dpu: filter out too wide modes if no 3dmux is present
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 030/443] printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 032/443] drm/connector: add mutex to protect ELD from concurrent access Greg Kroah-Hartman
` (422 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abhinav Kumar, Dmitry Baryshkov,
Sasha Levin, Xiangxu Yin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
[ Upstream commit dbc7bb1a93f41c533fe31ddc97bdf777d7a61faa ]
On chipsets such as QCS615, there is no 3dmux present. In such
a case, a layer exceeding the max_mixer_width cannot be split,
hence cannot be supported.
Filter out the modes which exceed the max_mixer_width when there
is no 3dmux present. Also, add a check in the dpu_crtc_atomic_check()
to return failure for such modes.
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Xiangxu Yin <quic_xiangxuy@quicinc.com> # QCS615
Patchwork: https://patchwork.freedesktop.org/patch/627974/
Link: https://lore.kernel.org/r/20241209-no_3dmux-v3-1-48aaa555b0d3@quicinc.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
index 9f6ffd344693e..ad3462476a143 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
@@ -732,6 +732,13 @@ static int _dpu_crtc_check_and_setup_lm_bounds(struct drm_crtc *crtc,
struct dpu_kms *dpu_kms = _dpu_crtc_get_kms(crtc);
int i;
+ /* if we cannot merge 2 LMs (no 3d mux) better to fail earlier
+ * before even checking the width after the split
+ */
+ if (!dpu_kms->catalog->caps->has_3d_merge &&
+ adj_mode->hdisplay > dpu_kms->catalog->caps->max_mixer_width)
+ return -E2BIG;
+
for (i = 0; i < cstate->num_mixers; i++) {
struct drm_rect *r = &cstate->lm_bounds[i];
r->x1 = crtc_split_width * i;
@@ -1251,6 +1258,12 @@ static enum drm_mode_status dpu_crtc_mode_valid(struct drm_crtc *crtc,
{
struct dpu_kms *dpu_kms = _dpu_crtc_get_kms(crtc);
+ /* if there is no 3d_mux block we cannot merge LMs so we cannot
+ * split the large layer into 2 LMs, filter out such modes
+ */
+ if (!dpu_kms->catalog->caps->has_3d_merge &&
+ mode->hdisplay > dpu_kms->catalog->caps->max_mixer_width)
+ return MODE_BAD_HVALUE;
/*
* max crtc width is equal to the max mixer width * 2 and max height is 4K
*/
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 032/443] drm/connector: add mutex to protect ELD from concurrent access
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 031/443] drm/msm/dpu: filter out too wide modes if no 3dmux is present Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 033/443] drm/bridge: anx7625: use eld_mutex to protect access to connector->eld Greg Kroah-Hartman
` (421 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Baryshkov,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit df7c8e3dde37a9d81c0613285b43600f3cc70f34 ]
The connector->eld is accessed by the .get_eld() callback. This access
can collide with the drm_edid_to_eld() updating the data at the same
time. Add drm_connector.eld_mutex to protect the data from concurrenct
access. Individual drivers are not updated (to reduce possible issues
while applying the patch), maintainers are to find a best suitable way
to lock that mutex while accessing the ELD data.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-1-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_connector.c | 1 +
drivers/gpu/drm/drm_edid.c | 6 ++++++
include/drm/drm_connector.h | 5 ++++-
3 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index ca7f43c8d6f1b..0e6021235a930 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -277,6 +277,7 @@ static int __drm_connector_init(struct drm_device *dev,
INIT_LIST_HEAD(&connector->probed_modes);
INIT_LIST_HEAD(&connector->modes);
mutex_init(&connector->mutex);
+ mutex_init(&connector->eld_mutex);
mutex_init(&connector->edid_override_mutex);
mutex_init(&connector->hdmi.infoframes.lock);
connector->edid_blob_ptr = NULL;
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 855beafb76ffb..13bc4c290b17d 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -5605,7 +5605,9 @@ EXPORT_SYMBOL(drm_edid_get_monitor_name);
static void clear_eld(struct drm_connector *connector)
{
+ mutex_lock(&connector->eld_mutex);
memset(connector->eld, 0, sizeof(connector->eld));
+ mutex_unlock(&connector->eld_mutex);
connector->latency_present[0] = false;
connector->latency_present[1] = false;
@@ -5657,6 +5659,8 @@ static void drm_edid_to_eld(struct drm_connector *connector,
if (!drm_edid)
return;
+ mutex_lock(&connector->eld_mutex);
+
mnl = get_monitor_name(drm_edid, &eld[DRM_ELD_MONITOR_NAME_STRING]);
drm_dbg_kms(connector->dev, "[CONNECTOR:%d:%s] ELD monitor %s\n",
connector->base.id, connector->name,
@@ -5717,6 +5721,8 @@ static void drm_edid_to_eld(struct drm_connector *connector,
drm_dbg_kms(connector->dev, "[CONNECTOR:%d:%s] ELD size %d, SAD count %d\n",
connector->base.id, connector->name,
drm_eld_size(eld), total_sad_count);
+
+ mutex_unlock(&connector->eld_mutex);
}
static int _drm_edid_to_sad(const struct drm_edid *drm_edid,
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index e3fa43291f449..1e2b25e204cb5 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -2001,8 +2001,11 @@ struct drm_connector {
struct drm_encoder *encoder;
#define MAX_ELD_BYTES 128
- /** @eld: EDID-like data, if present */
+ /** @eld: EDID-like data, if present, protected by @eld_mutex */
uint8_t eld[MAX_ELD_BYTES];
+ /** @eld_mutex: protection for concurrenct access to @eld */
+ struct mutex eld_mutex;
+
/** @latency_present: AV delay info from ELD, if found */
bool latency_present[2];
/**
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 033/443] drm/bridge: anx7625: use eld_mutex to protect access to connector->eld
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 032/443] drm/connector: add mutex to protect ELD from concurrent access Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 034/443] drm/bridge: ite-it66121: " Greg Kroah-Hartman
` (420 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Baryshkov,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit e72bf423a60afd744d13e40ab2194044a3af5217 ]
Reading access to connector->eld can happen at the same time the
drm_edid_to_eld() updates the data. Take the newly added eld_mutex in
order to protect connector->eld from concurrent access.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-2-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/analogix/anx7625.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
index a2675b121fe44..c036bbc92ba96 100644
--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
@@ -2002,8 +2002,10 @@ static int anx7625_audio_get_eld(struct device *dev, void *data,
memset(buf, 0, len);
} else {
dev_dbg(dev, "audio copy eld\n");
+ mutex_lock(&ctx->connector->eld_mutex);
memcpy(buf, ctx->connector->eld,
min(sizeof(ctx->connector->eld), len));
+ mutex_unlock(&ctx->connector->eld_mutex);
}
return 0;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 034/443] drm/bridge: ite-it66121: use eld_mutex to protect access to connector->eld
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 033/443] drm/bridge: anx7625: use eld_mutex to protect access to connector->eld Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 035/443] drm/amd/display: " Greg Kroah-Hartman
` (419 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Baryshkov,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 39ead6e02ea7d19b421e9d42299d4293fed3064e ]
Reading access to connector->eld can happen at the same time the
drm_edid_to_eld() updates the data. Take the newly added eld_mutex in
order to protect connector->eld from concurrent access.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-3-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ite-it66121.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/bridge/ite-it66121.c b/drivers/gpu/drm/bridge/ite-it66121.c
index 35ae3f0e8f51f..940083e5d2ddb 100644
--- a/drivers/gpu/drm/bridge/ite-it66121.c
+++ b/drivers/gpu/drm/bridge/ite-it66121.c
@@ -1450,8 +1450,10 @@ static int it66121_audio_get_eld(struct device *dev, void *data,
dev_dbg(dev, "No connector present, passing empty EDID data");
memset(buf, 0, len);
} else {
+ mutex_lock(&ctx->connector->eld_mutex);
memcpy(buf, ctx->connector->eld,
min(sizeof(ctx->connector->eld), len));
+ mutex_unlock(&ctx->connector->eld_mutex);
}
mutex_unlock(&ctx->lock);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 035/443] drm/amd/display: use eld_mutex to protect access to connector->eld
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 034/443] drm/bridge: ite-it66121: " Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 036/443] drm/exynos: hdmi: " Greg Kroah-Hartman
` (418 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Harry Wentland,
Dmitry Baryshkov, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 819bee01eea06282d7bda17d46caf29cae4f6d84 ]
Reading access to connector->eld can happen at the same time the
drm_edid_to_eld() updates the data. Take the newly added eld_mutex in
order to protect connector->eld from concurrent access.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-4-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 92e1d59921f49..cff07681e0f4c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1037,8 +1037,10 @@ static int amdgpu_dm_audio_component_get_eld(struct device *kdev, int port,
continue;
*enabled = true;
+ mutex_lock(&connector->eld_mutex);
ret = drm_eld_size(connector->eld);
memcpy(buf, connector->eld, min(max_bytes, ret));
+ mutex_unlock(&connector->eld_mutex);
break;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 036/443] drm/exynos: hdmi: use eld_mutex to protect access to connector->eld
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 035/443] drm/amd/display: " Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 037/443] drm/msm/dp: " Greg Kroah-Hartman
` (417 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Baryshkov,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 5e8436d334ed7f6785416447c50b42077c6503e0 ]
Reading access to connector->eld can happen at the same time the
drm_edid_to_eld() updates the data. Take the newly added eld_mutex in
order to protect connector->eld from concurrent access.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-5-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 466a9e514aa1c..7a57d4a23e410 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -1648,7 +1648,9 @@ static int hdmi_audio_get_eld(struct device *dev, void *data, uint8_t *buf,
struct hdmi_context *hdata = dev_get_drvdata(dev);
struct drm_connector *connector = &hdata->connector;
+ mutex_lock(&connector->eld_mutex);
memcpy(buf, connector->eld, min(sizeof(connector->eld), len));
+ mutex_unlock(&connector->eld_mutex);
return 0;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 037/443] drm/msm/dp: use eld_mutex to protect access to connector->eld
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 036/443] drm/exynos: hdmi: " Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 038/443] drm/radeon: " Greg Kroah-Hartman
` (416 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Abhinav Kumar,
Dmitry Baryshkov, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 9aad030dc64f6994dc5de7bb81ceca55dbc555c3 ]
Reading access to connector->eld can happen at the same time the
drm_edid_to_eld() updates the data. Take the newly added eld_mutex in
order to protect connector->eld from concurrent access.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Acked-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-7-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dp/dp_audio.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/msm/dp/dp_audio.c b/drivers/gpu/drm/msm/dp/dp_audio.c
index 5cbb11986460d..c179ed0e9e2bd 100644
--- a/drivers/gpu/drm/msm/dp/dp_audio.c
+++ b/drivers/gpu/drm/msm/dp/dp_audio.c
@@ -414,8 +414,10 @@ static int msm_dp_audio_get_eld(struct device *dev,
return -ENODEV;
}
+ mutex_lock(&msm_dp_display->connector->eld_mutex);
memcpy(buf, msm_dp_display->connector->eld,
min(sizeof(msm_dp_display->connector->eld), len));
+ mutex_unlock(&msm_dp_display->connector->eld_mutex);
return 0;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 038/443] drm/radeon: use eld_mutex to protect access to connector->eld
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 037/443] drm/msm/dp: " Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 039/443] drm/sti: hdmi: " Greg Kroah-Hartman
` (415 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Baryshkov,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit b54c14f82428c8a602392d4cae1958a71a578132 ]
Reading access to connector->eld can happen at the same time the
drm_edid_to_eld() updates the data. Take the newly added eld_mutex in
order to protect connector->eld from concurrent access.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-8-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_audio.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
index 5b69cc8011b42..8d64ba18572ec 100644
--- a/drivers/gpu/drm/radeon/radeon_audio.c
+++ b/drivers/gpu/drm/radeon/radeon_audio.c
@@ -775,8 +775,10 @@ static int radeon_audio_component_get_eld(struct device *kdev, int port,
if (!dig->pin || dig->pin->id != port)
continue;
*enabled = true;
+ mutex_lock(&connector->eld_mutex);
ret = drm_eld_size(connector->eld);
memcpy(buf, connector->eld, min(max_bytes, ret));
+ mutex_unlock(&connector->eld_mutex);
break;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 039/443] drm/sti: hdmi: use eld_mutex to protect access to connector->eld
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 038/443] drm/radeon: " Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 040/443] drm/vc4: " Greg Kroah-Hartman
` (414 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Raphael Gallais-Pou,
Dmitry Baryshkov, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit e99c0b517bcd53cf61f998a3c4291333401cb391 ]
Reading access to connector->eld can happen at the same time the
drm_edid_to_eld() updates the data. Take the newly added eld_mutex in
order to protect connector->eld from concurrent access.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Acked-by: Raphael Gallais-Pou <rgallaispou@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-9-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/sti/sti_hdmi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
index 21b46a6465f08..f8bbae6393ef8 100644
--- a/drivers/gpu/drm/sti/sti_hdmi.c
+++ b/drivers/gpu/drm/sti/sti_hdmi.c
@@ -1225,7 +1225,9 @@ static int hdmi_audio_get_eld(struct device *dev, void *data, uint8_t *buf, size
struct drm_connector *connector = hdmi->drm_connector;
DRM_DEBUG_DRIVER("\n");
+ mutex_lock(&connector->eld_mutex);
memcpy(buf, connector->eld, min(sizeof(connector->eld), len));
+ mutex_unlock(&connector->eld_mutex);
return 0;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 040/443] drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 039/443] drm/sti: hdmi: " Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 041/443] drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor Greg Kroah-Hartman
` (413 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Baryshkov,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 81a9a93b169a273ccc4a9a1ee56f17e9981d3f98 ]
Reading access to connector->eld can happen at the same time the
drm_edid_to_eld() updates the data. Take the newly added eld_mutex in
order to protect connector->eld from concurrent access.
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241206-drm-connector-eld-mutex-v2-10-c9bce1ee8bea@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index e3818c48c9b8c..e86123009c905 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -2193,9 +2193,9 @@ static int vc4_hdmi_audio_get_eld(struct device *dev, void *data,
struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
struct drm_connector *connector = &vc4_hdmi->connector;
- mutex_lock(&vc4_hdmi->mutex);
+ mutex_lock(&connector->eld_mutex);
memcpy(buf, connector->eld, min(sizeof(connector->eld), len));
- mutex_unlock(&vc4_hdmi->mutex);
+ mutex_unlock(&connector->eld_mutex);
return 0;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 041/443] drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 040/443] drm/vc4: " Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 042/443] drm/amdgpu: Dont enable sdma 4.4.5 CTXEMPTY interrupt Greg Kroah-Hartman
` (412 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Wheeler, Wayne Lin,
Fangzhi Zuo, Rodrigo Siqueira, Alex Deucher, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <Jerry.Zuo@amd.com>
[ Upstream commit e56ad45e991128bf4db160b75a1d9f647a341d8f ]
Source --> DP2.1 MST hub --> DP1.4/2.1 monitor
When change from DP1.4 to DP2.1 from monitor manual, modes higher than
4k120 are all cutoff by mode validation. Switch back to DP1.4 gets all
the modes up to 4k240 available to be enabled by dsc passthrough.
[why]
Compared to DP1.4 link from hub to monitor, DP2.1 link has larger
full_pbn value that causes overflow in the process of doing conversion
from pbn to kbps.
[how]
Change the data type accordingly to fit into the data limit during
conversion calculation.
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Reviewed-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
Signed-off-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
index 1080075ccb17c..e096fb5621229 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
@@ -1695,16 +1695,16 @@ int pre_validate_dsc(struct drm_atomic_state *state,
return ret;
}
-static unsigned int kbps_from_pbn(unsigned int pbn)
+static uint32_t kbps_from_pbn(unsigned int pbn)
{
- unsigned int kbps = pbn;
+ uint64_t kbps = (uint64_t)pbn;
kbps *= (1000000 / PEAK_FACTOR_X1000);
kbps *= 8;
kbps *= 54;
kbps /= 64;
- return kbps;
+ return (uint32_t)kbps;
}
static bool is_dsc_common_config_possible(struct dc_stream_state *stream,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 042/443] drm/amdgpu: Dont enable sdma 4.4.5 CTXEMPTY interrupt
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 041/443] drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 043/443] drm/amdkfd: Queue interrupt work to different CPU Greg Kroah-Hartman
` (411 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philip Yang, Felix Kuehling,
Alex Deucher, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <Philip.Yang@amd.com>
[ Upstream commit b4b7271e5ca95b581f2fcc4ae852c4079215e92d ]
The sdma context empty interrupt is dropped in amdgpu_irq_dispatch
as unregistered interrupt src_id 243, this interrupt accounts to 1/3 of
total interrupts and causes IH primary ring overflow when running
stressful benchmark application. Disable this interrupt has no side
effect found.
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c
index a38553f38fdc8..ed68d7971a93a 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c
@@ -953,10 +953,12 @@ static int sdma_v4_4_2_inst_start(struct amdgpu_device *adev,
/* set utc l1 enable flag always to 1 */
temp = RREG32_SDMA(i, regSDMA_CNTL);
temp = REG_SET_FIELD(temp, SDMA_CNTL, UTC_L1_ENABLE, 1);
- /* enable context empty interrupt during initialization */
- temp = REG_SET_FIELD(temp, SDMA_CNTL, CTXEMPTY_INT_ENABLE, 1);
- WREG32_SDMA(i, regSDMA_CNTL, temp);
+ if (amdgpu_ip_version(adev, SDMA0_HWIP, 0) < IP_VERSION(4, 4, 5)) {
+ /* enable context empty interrupt during initialization */
+ temp = REG_SET_FIELD(temp, SDMA_CNTL, CTXEMPTY_INT_ENABLE, 1);
+ WREG32_SDMA(i, regSDMA_CNTL, temp);
+ }
if (!amdgpu_sriov_vf(adev)) {
if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) {
/* unhalt engine */
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 043/443] drm/amdkfd: Queue interrupt work to different CPU
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 042/443] drm/amdgpu: Dont enable sdma 4.4.5 CTXEMPTY interrupt Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 044/443] drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT Greg Kroah-Hartman
` (410 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philip Yang, Felix Kuehling,
Alex Deucher, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <Philip.Yang@amd.com>
[ Upstream commit 34db5a32617d102e8042151bb87590e43c97132e ]
For CPX mode, each KFD node has interrupt worker to process ih_fifo to
send events to user space. Currently all interrupt workers of same adev
queue to same CPU, all workers execution are actually serialized and
this cause KFD ih_fifo overflow when CPU usage is high.
Use per-GPU unbounded highpri queue with number of workers equals to
number of partitions, let queue_work select the next CPU round robin
among the local CPUs of same NUMA.
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_device.c | 25 ++++++++--------------
drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 25 ++++++++--------------
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 ++-
3 files changed, 20 insertions(+), 33 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 9b51dd75fefc7..35caa71f317dc 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -638,6 +638,14 @@ static void kfd_cleanup_nodes(struct kfd_dev *kfd, unsigned int num_nodes)
struct kfd_node *knode;
unsigned int i;
+ /*
+ * flush_work ensures that there are no outstanding
+ * work-queue items that will access interrupt_ring. New work items
+ * can't be created because we stopped interrupt handling above.
+ */
+ flush_workqueue(kfd->ih_wq);
+ destroy_workqueue(kfd->ih_wq);
+
for (i = 0; i < num_nodes; i++) {
knode = kfd->nodes[i];
device_queue_manager_uninit(knode->dqm);
@@ -1059,21 +1067,6 @@ static int kfd_resume(struct kfd_node *node)
return err;
}
-static inline void kfd_queue_work(struct workqueue_struct *wq,
- struct work_struct *work)
-{
- int cpu, new_cpu;
-
- cpu = new_cpu = smp_processor_id();
- do {
- new_cpu = cpumask_next(new_cpu, cpu_online_mask) % nr_cpu_ids;
- if (cpu_to_node(new_cpu) == numa_node_id())
- break;
- } while (cpu != new_cpu);
-
- queue_work_on(new_cpu, wq, work);
-}
-
/* This is called directly from KGD at ISR. */
void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
{
@@ -1099,7 +1092,7 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
patched_ihre, &is_patched)
&& enqueue_ih_ring_entry(node,
is_patched ? patched_ihre : ih_ring_entry)) {
- kfd_queue_work(node->ih_wq, &node->interrupt_work);
+ queue_work(node->kfd->ih_wq, &node->interrupt_work);
spin_unlock_irqrestore(&node->interrupt_lock, flags);
return;
}
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
index 9b6b6e8825934..15b4b70cf1997 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c
@@ -62,11 +62,14 @@ int kfd_interrupt_init(struct kfd_node *node)
return r;
}
- node->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI, 1);
- if (unlikely(!node->ih_wq)) {
- kfifo_free(&node->ih_fifo);
- dev_err(node->adev->dev, "Failed to allocate KFD IH workqueue\n");
- return -ENOMEM;
+ if (!node->kfd->ih_wq) {
+ node->kfd->ih_wq = alloc_workqueue("KFD IH", WQ_HIGHPRI | WQ_UNBOUND,
+ node->kfd->num_nodes);
+ if (unlikely(!node->kfd->ih_wq)) {
+ kfifo_free(&node->ih_fifo);
+ dev_err(node->adev->dev, "Failed to allocate KFD IH workqueue\n");
+ return -ENOMEM;
+ }
}
spin_lock_init(&node->interrupt_lock);
@@ -96,16 +99,6 @@ void kfd_interrupt_exit(struct kfd_node *node)
spin_lock_irqsave(&node->interrupt_lock, flags);
node->interrupts_active = false;
spin_unlock_irqrestore(&node->interrupt_lock, flags);
-
- /*
- * flush_work ensures that there are no outstanding
- * work-queue items that will access interrupt_ring. New work items
- * can't be created because we stopped interrupt handling above.
- */
- flush_workqueue(node->ih_wq);
-
- destroy_workqueue(node->ih_wq);
-
kfifo_free(&node->ih_fifo);
}
@@ -162,7 +155,7 @@ static void interrupt_wq(struct work_struct *work)
/* If we spent more than a second processing signals,
* reschedule the worker to avoid soft-lockup warnings
*/
- queue_work(dev->ih_wq, &dev->interrupt_work);
+ queue_work(dev->kfd->ih_wq, &dev->interrupt_work);
break;
}
}
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index 9e5ca0b93b2a2..74881a5ca59ad 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -273,7 +273,6 @@ struct kfd_node {
/* Interrupts */
struct kfifo ih_fifo;
- struct workqueue_struct *ih_wq;
struct work_struct interrupt_work;
spinlock_t interrupt_lock;
@@ -366,6 +365,8 @@ struct kfd_dev {
struct kfd_node *nodes[MAX_KFD_NODES];
unsigned int num_nodes;
+ struct workqueue_struct *ih_wq;
+
/* Kernel doorbells for KFD device */
struct amdgpu_bo *doorbells;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 044/443] drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 043/443] drm/amdkfd: Queue interrupt work to different CPU Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 045/443] drm/bridge: it6505: fix HDCP Bstatus check Greg Kroah-Hartman
` (409 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Hermes Wu,
AngeloGioacchino Del Regno, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Wu <hermes.wu@ite.com.tw>
[ Upstream commit 85597bc0d70c287ba41f17d14d3d857a38a3d727 ]
A HDCP source device shall support max downstream to 127 devices.
Change definition MAX_HDCP_DOWN_STREAM_COUNT to 127
KSVs shall save for DRM blocked devices check.
This results in struct it6505 growth by ~0.5 KiB.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Hermes Wu <hermes.wu@ite.com.tw>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-4-e0fdd4844703@ite.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index cf891e7677c0e..d55d7dad9545f 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -296,7 +296,7 @@
#define MAX_LANE_COUNT 4
#define MAX_LINK_RATE HBR
#define AUTO_TRAIN_RETRY 3
-#define MAX_HDCP_DOWN_STREAM_COUNT 10
+#define MAX_HDCP_DOWN_STREAM_COUNT 127
#define MAX_CR_LEVEL 0x03
#define MAX_EQ_LEVEL 0x03
#define AUX_WAIT_TIMEOUT_MS 15
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 045/443] drm/bridge: it6505: fix HDCP Bstatus check
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 044/443] drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 046/443] drm/bridge: it6505: fix HDCP encryption when R0 ready Greg Kroah-Hartman
` (408 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Hermes Wu,
AngeloGioacchino Del Regno, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Wu <hermes.wu@ite.com.tw>
[ Upstream commit 0fd2ff47d8c207fa3173661de04bb9e8201c0ad2 ]
When HDCP is activated,
a DisplayPort source receiving CP_IRQ from the sink
shall check Bstatus from DPCD and process the corresponding value
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Hermes Wu <hermes.wu@ite.com.tw>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-5-e0fdd4844703@ite.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index d55d7dad9545f..0f7d50da56835 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -2312,14 +2312,20 @@ static int it6505_process_hpd_irq(struct it6505 *it6505)
DRM_DEV_DEBUG_DRIVER(dev, "dp_irq_vector = 0x%02x", dp_irq_vector);
if (dp_irq_vector & DP_CP_IRQ) {
- it6505_set_bits(it6505, REG_HDCP_TRIGGER, HDCP_TRIGGER_CPIRQ,
- HDCP_TRIGGER_CPIRQ);
-
bstatus = it6505_dpcd_read(it6505, DP_AUX_HDCP_BSTATUS);
if (bstatus < 0)
return bstatus;
DRM_DEV_DEBUG_DRIVER(dev, "Bstatus = 0x%02x", bstatus);
+
+ /*Check BSTATUS when recive CP_IRQ */
+ if (bstatus & DP_BSTATUS_R0_PRIME_READY &&
+ it6505->hdcp_status == HDCP_AUTH_GOING)
+ it6505_set_bits(it6505, REG_HDCP_TRIGGER, HDCP_TRIGGER_CPIRQ,
+ HDCP_TRIGGER_CPIRQ);
+ else if (bstatus & (DP_BSTATUS_REAUTH_REQ | DP_BSTATUS_LINK_FAILURE) &&
+ it6505->hdcp_status == HDCP_AUTH_DONE)
+ it6505_start_hdcp(it6505);
}
ret = drm_dp_dpcd_read_link_status(&it6505->aux, link_status);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 046/443] drm/bridge: it6505: fix HDCP encryption when R0 ready
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 045/443] drm/bridge: it6505: fix HDCP Bstatus check Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 047/443] drm/bridge: it6505: fix HDCP CTS compare V matching Greg Kroah-Hartman
` (407 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hermes Wu,
AngeloGioacchino Del Regno, Dmitry Baryshkov, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Wu <hermes.wu@ite.com.tw>
[ Upstream commit 8c01b0bae2f9e58f2fee0e811cb90d8331986554 ]
When starting HDCP authentication, HDCP encryption should be enabled
when R0'is checked.
Change encryption enables time at R0' ready.
The hardware HDCP engine trigger is changed and the repeater KSV fails
will restart HDCP.
Signed-off-by: Hermes Wu <hermes.wu@ite.com.tw>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-6-e0fdd4844703@ite.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 0f7d50da56835..15873e7f07626 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -2081,15 +2081,12 @@ static void it6505_hdcp_wait_ksv_list(struct work_struct *work)
ksv_list_check = it6505_hdcp_part2_ksvlist_check(it6505);
DRM_DEV_DEBUG_DRIVER(dev, "ksv list ready, ksv list check %s",
ksv_list_check ? "pass" : "fail");
- if (ksv_list_check) {
- it6505_set_bits(it6505, REG_HDCP_TRIGGER,
- HDCP_TRIGGER_KSV_DONE, HDCP_TRIGGER_KSV_DONE);
+
+ if (ksv_list_check)
return;
- }
+
timeout:
- it6505_set_bits(it6505, REG_HDCP_TRIGGER,
- HDCP_TRIGGER_KSV_DONE | HDCP_TRIGGER_KSV_FAIL,
- HDCP_TRIGGER_KSV_DONE | HDCP_TRIGGER_KSV_FAIL);
+ it6505_start_hdcp(it6505);
}
static void it6505_hdcp_work(struct work_struct *work)
@@ -2462,7 +2459,11 @@ static void it6505_irq_hdcp_ksv_check(struct it6505 *it6505)
{
struct device *dev = it6505->dev;
- DRM_DEV_DEBUG_DRIVER(dev, "HDCP event Interrupt");
+ DRM_DEV_DEBUG_DRIVER(dev, "HDCP repeater R0 event Interrupt");
+ /* 1B01 HDCP encription should start when R0 is ready*/
+ it6505_set_bits(it6505, REG_HDCP_TRIGGER,
+ HDCP_TRIGGER_KSV_DONE, HDCP_TRIGGER_KSV_DONE);
+
schedule_work(&it6505->hdcp_wait_ksv_list);
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 047/443] drm/bridge: it6505: fix HDCP CTS compare V matching
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 046/443] drm/bridge: it6505: fix HDCP encryption when R0 ready Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 048/443] drm/bridge: it6505: fix HDCP CTS KSV list wait timer Greg Kroah-Hartman
` (406 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hermes Wu,
AngeloGioacchino Del Regno, Dmitry Baryshkov, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Wu <hermes.wu@ite.com.tw>
[ Upstream commit 0989c02c7a5c887c70afeae80c64d0291624e1a7 ]
When HDCP negotiation with a repeater device.
Checking SHA V' matching must retry 3 times before restarting HDCP.
Signed-off-by: Hermes Wu <hermes.wu@ite.com.tw>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-8-e0fdd4844703@ite.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 32 +++++++++++++++++------------
1 file changed, 19 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 15873e7f07626..029755ee21e23 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -2023,7 +2023,7 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505)
{
struct device *dev = it6505->dev;
u8 av[5][4], bv[5][4];
- int i, err;
+ int i, err, retry;
i = it6505_setup_sha1_input(it6505, it6505->sha1_input);
if (i <= 0) {
@@ -2032,22 +2032,28 @@ static bool it6505_hdcp_part2_ksvlist_check(struct it6505 *it6505)
}
it6505_sha1_digest(it6505, it6505->sha1_input, i, (u8 *)av);
+ /*1B-05 V' must retry 3 times */
+ for (retry = 0; retry < 3; retry++) {
+ err = it6505_get_dpcd(it6505, DP_AUX_HDCP_V_PRIME(0), (u8 *)bv,
+ sizeof(bv));
- err = it6505_get_dpcd(it6505, DP_AUX_HDCP_V_PRIME(0), (u8 *)bv,
- sizeof(bv));
+ if (err < 0) {
+ dev_err(dev, "Read V' value Fail %d", retry);
+ continue;
+ }
- if (err < 0) {
- dev_err(dev, "Read V' value Fail");
- return false;
- }
+ for (i = 0; i < 5; i++) {
+ if (bv[i][3] != av[i][0] || bv[i][2] != av[i][1] ||
+ av[i][1] != av[i][2] || bv[i][0] != av[i][3])
+ break;
- for (i = 0; i < 5; i++)
- if (bv[i][3] != av[i][0] || bv[i][2] != av[i][1] ||
- bv[i][1] != av[i][2] || bv[i][0] != av[i][3])
- return false;
+ DRM_DEV_DEBUG_DRIVER(dev, "V' all match!! %d, %d", retry, i);
+ return true;
+ }
+ }
- DRM_DEV_DEBUG_DRIVER(dev, "V' all match!!");
- return true;
+ DRM_DEV_DEBUG_DRIVER(dev, "V' NOT match!! %d", retry);
+ return false;
}
static void it6505_hdcp_wait_ksv_list(struct work_struct *work)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 048/443] drm/bridge: it6505: fix HDCP CTS KSV list wait timer
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 047/443] drm/bridge: it6505: fix HDCP CTS compare V matching Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 049/443] safesetid: check size of policy writes Greg Kroah-Hartman
` (405 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hermes Wu,
AngeloGioacchino Del Regno, Dmitry Baryshkov, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hermes Wu <hermes.wu@ite.com.tw>
[ Upstream commit 9f9eef9ec1a2b57d95a86fe81df758e8253a7766 ]
HDCP must disabled encryption and restart authentication after
waiting KSV for 5s.
The original method uses a counter in a waitting loop that may
wait much longer than it is supposed to.
Use time_after() for KSV wait timeout.
Signed-off-by: Hermes Wu <hermes.wu@ite.com.tw>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-9-e0fdd4844703@ite.corp-partner.google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
index 029755ee21e23..faee8e2e82a05 100644
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -2061,12 +2061,13 @@ static void it6505_hdcp_wait_ksv_list(struct work_struct *work)
struct it6505 *it6505 = container_of(work, struct it6505,
hdcp_wait_ksv_list);
struct device *dev = it6505->dev;
- unsigned int timeout = 5000;
- u8 bstatus = 0;
+ u8 bstatus;
bool ksv_list_check;
+ /* 1B-04 wait ksv list for 5s */
+ unsigned long timeout = jiffies +
+ msecs_to_jiffies(5000) + 1;
- timeout /= 20;
- while (timeout > 0) {
+ for (;;) {
if (!it6505_get_sink_hpd_status(it6505))
return;
@@ -2075,13 +2076,12 @@ static void it6505_hdcp_wait_ksv_list(struct work_struct *work)
if (bstatus & DP_BSTATUS_READY)
break;
- msleep(20);
- timeout--;
- }
+ if (time_after(jiffies, timeout)) {
+ DRM_DEV_DEBUG_DRIVER(dev, "KSV list wait timeout");
+ goto timeout;
+ }
- if (timeout == 0) {
- DRM_DEV_DEBUG_DRIVER(dev, "timeout and ksv list wait failed");
- goto timeout;
+ msleep(20);
}
ksv_list_check = it6505_hdcp_part2_ksvlist_check(it6505);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 049/443] safesetid: check size of policy writes
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 048/443] drm/bridge: it6505: fix HDCP CTS KSV list wait timer Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 050/443] drm/amd/display: Increase sanitizer frame larger than limit when compile testing with clang Greg Kroah-Hartman
` (404 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+4eb7a741b3216020043a,
Leo Stone, Paul Moore, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Stone <leocstone@gmail.com>
[ Upstream commit f09ff307c7299392f1c88f763299e24bc99811c7 ]
syzbot attempts to write a buffer with a large size to a sysfs entry
with writes handled by handle_policy_update(), triggering a warning
in kmalloc.
Check the size specified for write buffers before allocating.
Reported-by: syzbot+4eb7a741b3216020043a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4eb7a741b3216020043a
Signed-off-by: Leo Stone <leocstone@gmail.com>
[PM: subject tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/safesetid/securityfs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/security/safesetid/securityfs.c b/security/safesetid/securityfs.c
index 25310468bcddf..8e1ffd70b18ab 100644
--- a/security/safesetid/securityfs.c
+++ b/security/safesetid/securityfs.c
@@ -143,6 +143,9 @@ static ssize_t handle_policy_update(struct file *file,
char *buf, *p, *end;
int err;
+ if (len >= KMALLOC_MAX_SIZE)
+ return -EINVAL;
+
pol = kmalloc(sizeof(struct setid_ruleset), GFP_KERNEL);
if (!pol)
return -ENOMEM;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 050/443] drm/amd/display: Increase sanitizer frame larger than limit when compile testing with clang
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 049/443] safesetid: check size of policy writes Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 051/443] drm/amd/display: Limit Scaling Ratio on DCN3.01 Greg Kroah-Hartman
` (403 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Nathan Chancellor,
Alex Deucher, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
[ Upstream commit e4479aecf6581af81bc0908575447878d2a07e01 ]
Commit 24909d9ec7c3 ("drm/amd/display: Overwriting dualDPP UBF values
before usage") added a new warning in dml2/display_mode_core.c when
building allmodconfig with clang:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/display_mode_core.c:6268:13: error: stack frame size (3128) exceeds limit (3072) in 'dml_prefetch_check' [-Werror,-Wframe-larger-than]
6268 | static void dml_prefetch_check(struct display_mode_lib_st *mode_lib)
| ^
Commit be4e3509314a ("drm/amd/display: DML21 Reintegration For Various
Fixes") introduced one in dml2_core/dml2_core_dcn4_calcs.c with the same
configuration:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:7236:13: error: stack frame size (3256) exceeds limit (3072) in 'dml_core_mode_support' [-Werror,-Wframe-larger-than]
7236 | static bool dml_core_mode_support(struct dml2_core_calcs_mode_support_ex *in_out_params)
| ^
In the case of the first warning, the stack usage was already at the
limit at the parent change, so the offending change was rather
innocuous. In the case of the second warning, there was a rather
dramatic increase in stack usage compared to the parent:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:7032:13: error: stack frame size (2696) exceeds limit (2048) in 'dml_core_mode_support' [-Werror,-Wframe-larger-than]
7032 | static bool dml_core_mode_support(struct dml2_core_calcs_mode_support_ex *in_out_params)
| ^
This is an unfortunate interaction between an issue with stack slot
reuse in LLVM that gets exacerbated by sanitization (which gets enabled
with all{mod,yes}config) and function calls using a much higher number
of parameters than is typical in the kernel, necessitating passing most
of these values on the stack.
While it is possible that there should be source code changes to address
these warnings, this code is difficult to modify for various reasons, as
has been noted in other changes that have occurred for similar reasons,
such as commit 6740ec97bcdb ("drm/amd/display: Increase frame warning
limit with KASAN or KCSAN in dml2").
Increase the frame larger than limit when compile testing with clang and
the sanitizers enabled to avoid this breakage in all{mod,yes}config, as
they are commonly used and valuable testing targets. While it is not the
best to hide this issue, it is not really relevant when compile testing,
as the sanitizers are commonly stressful on optimizations and they are
only truly useful at runtime, which COMPILE_TEST states will not occur
with the current build.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202412121748.chuX4sap-lkp@intel.com/
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dml2/Makefile | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dml2/Makefile b/drivers/gpu/drm/amd/display/dc/dml2/Makefile
index c4378e620cbf9..986a69c5bd4bc 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dml2/Makefile
@@ -29,7 +29,11 @@ dml2_rcflags := $(CC_FLAGS_NO_FPU)
ifneq ($(CONFIG_FRAME_WARN),0)
ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
+ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy)
+frame_warn_flag := -Wframe-larger-than=4096
+else
frame_warn_flag := -Wframe-larger-than=3072
+endif
else
frame_warn_flag := -Wframe-larger-than=2048
endif
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 051/443] drm/amd/display: Limit Scaling Ratio on DCN3.01
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 050/443] drm/amd/display: Increase sanitizer frame larger than limit when compile testing with clang Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 052/443] ring-buffer: Make reading page consistent with the code logic Greg Kroah-Hartman
` (402 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicholas Kazlauskas, Gabe Teeger,
Tom Chung, Daniel Wheeler, Alex Deucher, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabe Teeger <Gabe.Teeger@amd.com>
[ Upstream commit abc0ad6d08440761b199988c329ad7ac83f41c9b ]
[why]
Underflow and flickering was occuring due to high scaling ratios
when resizing videos.
[how]
Limit the scaling ratios by increasing the max scaling factor
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Gabe Teeger <Gabe.Teeger@amd.com>
Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/amd/display/dc/resource/dcn301/dcn301_resource.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
index a9816affd312d..0cc8a27be5935 100644
--- a/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c
@@ -671,9 +671,9 @@ static const struct dc_plane_cap plane_cap = {
/* 6:1 downscaling ratio: 1000/6 = 166.666 */
.max_downscale_factor = {
- .argb8888 = 167,
- .nv12 = 167,
- .fp16 = 167
+ .argb8888 = 358,
+ .nv12 = 358,
+ .fp16 = 358
},
64,
64
@@ -693,7 +693,7 @@ static const struct dc_debug_options debug_defaults_drv = {
.disable_dcc = DCC_ENABLE,
.vsr_support = true,
.performance_trace = false,
- .max_downscale_src_width = 7680,/*upto 8K*/
+ .max_downscale_src_width = 4096,/*upto true 4k*/
.scl_reset_length10 = true,
.sanity_checks = false,
.underflow_assert_delay_us = 0xFFFFFFFF,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 052/443] ring-buffer: Make reading page consistent with the code logic
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 051/443] drm/amd/display: Limit Scaling Ratio on DCN3.01 Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 053/443] wifi: ath12k: Fix for out-of bound access error Greg Kroah-Hartman
` (401 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeongjun Park,
Steven Rostedt (Google), Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <aha310510@gmail.com>
[ Upstream commit 6e31b759b076eebb4184117234f0c4eb9e4bc460 ]
In the loop of __rb_map_vma(), the 's' variable is calculated from the
same logic that nr_pages is and they both come from nr_subbufs. But the
relationship is not obvious and there's a WARN_ON_ONCE() around the 's'
variable to make sure it never becomes equal to nr_subbufs within the
loop. If that happens, then the code is buggy and needs to be fixed.
The 'page' variable is calculated from cpu_buffer->subbuf_ids[s] which is
an array of 'nr_subbufs' entries. If the code becomes buggy and 's'
becomes equal to or greater than 'nr_subbufs' then this will be an out of
bounds hit before the WARN_ON() is triggered and the code exiting safely.
Make the 'page' initialization consistent with the code logic and assign
it after the out of bounds check.
Link: https://lore.kernel.org/20250110162612.13983-1-aha310510@gmail.com
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
[ sdr: rewrote change log ]
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 60210fb5b2110..6804ab126802b 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7059,7 +7059,7 @@ static int __rb_map_vma(struct ring_buffer_per_cpu *cpu_buffer,
}
while (p < nr_pages) {
- struct page *page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]);
+ struct page *page;
int off = 0;
if (WARN_ON_ONCE(s >= nr_subbufs)) {
@@ -7067,6 +7067,8 @@ static int __rb_map_vma(struct ring_buffer_per_cpu *cpu_buffer,
goto out;
}
+ page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]);
+
for (; off < (1 << (subbuf_order)); off++, page++) {
if (p >= nr_pages)
break;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 053/443] wifi: ath12k: Fix for out-of bound access error
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 052/443] ring-buffer: Make reading page consistent with the code logic Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 054/443] wifi: ath12k: ath12k_mac_op_set_key(): fix uninitialized symbol ret Greg Kroah-Hartman
` (400 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karol Przybylski, Kalle Valo,
Jeff Johnson, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karol Przybylski <karprzy7@gmail.com>
[ Upstream commit eb8c0534713865d190856f10bfc97cf0b88475b1 ]
Selfgen stats are placed in a buffer using print_array_to_buf_index() function.
Array length parameter passed to the function is too big, resulting in possible
out-of bound memory error.
Decreasing buffer size by one fixes faulty upper bound of passed array.
Discovered in coverity scan, CID 1600742 and CID 1600758
Signed-off-by: Karol Przybylski <karprzy7@gmail.com>
Acked-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20241105101132.374372-1-karprzy7@gmail.com
Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c b/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c
index c9980c0193d1d..43ea87e981f42 100644
--- a/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c
+++ b/drivers/net/wireless/ath/ath12k/debugfs_htt_stats.c
@@ -1562,7 +1562,8 @@ ath12k_htt_print_tx_selfgen_ac_stats_tlv(const void *tag_buf, u16 tag_len,
le32_to_cpu(htt_stats_buf->ac_mu_mimo_ndp));
len += print_array_to_buf_index(buf, len, "ac_mu_mimo_brpollX_tried = ", 1,
htt_stats_buf->ac_mu_mimo_brpoll,
- ATH12K_HTT_TX_NUM_AC_MUMIMO_USER_STATS, "\n\n");
+ ATH12K_HTT_TX_NUM_AC_MUMIMO_USER_STATS - 1,
+ "\n\n");
stats_req->buf_len = len;
}
@@ -1590,7 +1591,7 @@ ath12k_htt_print_tx_selfgen_ax_stats_tlv(const void *tag_buf, u16 tag_len,
le32_to_cpu(htt_stats_buf->ax_mu_mimo_ndp));
len += print_array_to_buf_index(buf, len, "ax_mu_mimo_brpollX_tried = ", 1,
htt_stats_buf->ax_mu_mimo_brpoll,
- ATH12K_HTT_TX_NUM_AX_MUMIMO_USER_STATS, "\n");
+ ATH12K_HTT_TX_NUM_AX_MUMIMO_USER_STATS - 1, "\n");
len += scnprintf(buf + len, buf_len - len, "ax_basic_trigger = %u\n",
le32_to_cpu(htt_stats_buf->ax_basic_trigger));
len += scnprintf(buf + len, buf_len - len, "ax_ulmumimo_total_trigger = %u\n",
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 054/443] wifi: ath12k: ath12k_mac_op_set_key(): fix uninitialized symbol ret
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 053/443] wifi: ath12k: Fix for out-of bound access error Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 055/443] wifi: rtw89: add crystal_cap check to avoid setting as overflow value Greg Kroah-Hartman
` (399 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Kalle Valo, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalle Valo <quic_kvalo@quicinc.com>
[ Upstream commit ad969bc9ee73fa9eda6223be2a7c0c6caf937d71 ]
Dan reported that in some cases the ret variable could be uninitialized. Fix
that by removing the out label entirely and returning zero explicitly on
succesful cases.
Also remove the unnecessary else branches to follow more the style used in
ath12k and now it's easier to see the error handling.
No functional changes.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/7e7afd00-ad84-4744-8d94-416bab7e7dd9@stanley.mountain/
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://patch.msgid.link/20241126171139.2350704-10-kvalo@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath12k/mac.c | 57 +++++++++++++++------------
1 file changed, 32 insertions(+), 25 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index ef2736fb5f53f..e8639ad8761a2 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -4378,6 +4378,7 @@ static int ath12k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
if (sta) {
ahsta = ath12k_sta_to_ahsta(sta);
+
/* For an ML STA Pairwise key is same for all associated link Stations,
* hence do set key for all link STAs which are active.
*/
@@ -4400,41 +4401,47 @@ static int ath12k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
if (ret)
break;
}
- } else {
- arsta = &ahsta->deflink;
- arvif = arsta->arvif;
- if (WARN_ON(!arvif)) {
- ret = -EINVAL;
- goto out;
- }
- ret = ath12k_mac_set_key(arvif->ar, cmd, arvif, arsta, key);
- }
- } else {
- if (key->link_id >= 0 && key->link_id < IEEE80211_MLD_MAX_NUM_LINKS) {
- link_id = key->link_id;
- arvif = wiphy_dereference(hw->wiphy, ahvif->link[link_id]);
- } else {
- link_id = 0;
- arvif = &ahvif->deflink;
+ return 0;
}
- if (!arvif || !arvif->is_created) {
- cache = ath12k_ahvif_get_link_cache(ahvif, link_id);
- if (!cache)
- return -ENOSPC;
+ arsta = &ahsta->deflink;
+ arvif = arsta->arvif;
+ if (WARN_ON(!arvif))
+ return -EINVAL;
- ret = ath12k_mac_update_key_cache(cache, cmd, sta, key);
+ ret = ath12k_mac_set_key(arvif->ar, cmd, arvif, arsta, key);
+ if (ret)
+ return ret;
+ return 0;
+ }
+
+ if (key->link_id >= 0 && key->link_id < IEEE80211_MLD_MAX_NUM_LINKS) {
+ link_id = key->link_id;
+ arvif = wiphy_dereference(hw->wiphy, ahvif->link[link_id]);
+ } else {
+ link_id = 0;
+ arvif = &ahvif->deflink;
+ }
+
+ if (!arvif || !arvif->is_created) {
+ cache = ath12k_ahvif_get_link_cache(ahvif, link_id);
+ if (!cache)
+ return -ENOSPC;
+
+ ret = ath12k_mac_update_key_cache(cache, cmd, sta, key);
+ if (ret)
return ret;
- }
- ret = ath12k_mac_set_key(arvif->ar, cmd, arvif, NULL, key);
+ return 0;
}
-out:
+ ret = ath12k_mac_set_key(arvif->ar, cmd, arvif, NULL, key);
+ if (ret)
+ return ret;
- return ret;
+ return 0;
}
static int
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 055/443] wifi: rtw89: add crystal_cap check to avoid setting as overflow value
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 054/443] wifi: ath12k: ath12k_mac_op_set_key(): fix uninitialized symbol ret Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 056/443] tun: fix group permission check Greg Kroah-Hartman
` (398 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chih-Kang Chang, Ping-Ke Shih,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chih-Kang Chang <gary.chang@realtek.com>
[ Upstream commit 7b98caea39676561f22db58752551161bb36462b ]
In the original flow, the crystal_cap might be calculated as a negative
value and set as an overflow value. Therefore, we added a check to limit
the calculated crystal_cap value. Additionally, we shrank the crystal_cap
adjustment according to specific CFO.
Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241128055433.11851-7-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/phy.c | 11 ++++++-----
drivers/net/wireless/realtek/rtw89/phy.h | 2 +-
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
index f24aca663cf00..b9171f6ccae07 100644
--- a/drivers/net/wireless/realtek/rtw89/phy.c
+++ b/drivers/net/wireless/realtek/rtw89/phy.c
@@ -4058,7 +4058,6 @@ static void rtw89_phy_cfo_set_crystal_cap(struct rtw89_dev *rtwdev,
if (!force && cfo->crystal_cap == crystal_cap)
return;
- crystal_cap = clamp_t(u8, crystal_cap, 0, 127);
if (chip->chip_id == RTL8852A || chip->chip_id == RTL8851B) {
rtw89_phy_cfo_set_xcap_reg(rtwdev, true, crystal_cap);
rtw89_phy_cfo_set_xcap_reg(rtwdev, false, crystal_cap);
@@ -4181,7 +4180,7 @@ static void rtw89_phy_cfo_crystal_cap_adjust(struct rtw89_dev *rtwdev,
s32 curr_cfo)
{
struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
- s8 crystal_cap = cfo->crystal_cap;
+ int crystal_cap = cfo->crystal_cap;
s32 cfo_abs = abs(curr_cfo);
int sign;
@@ -4202,15 +4201,17 @@ static void rtw89_phy_cfo_crystal_cap_adjust(struct rtw89_dev *rtwdev,
}
sign = curr_cfo > 0 ? 1 : -1;
if (cfo_abs > CFO_TRK_STOP_TH_4)
- crystal_cap += 7 * sign;
+ crystal_cap += 3 * sign;
else if (cfo_abs > CFO_TRK_STOP_TH_3)
- crystal_cap += 5 * sign;
- else if (cfo_abs > CFO_TRK_STOP_TH_2)
crystal_cap += 3 * sign;
+ else if (cfo_abs > CFO_TRK_STOP_TH_2)
+ crystal_cap += 1 * sign;
else if (cfo_abs > CFO_TRK_STOP_TH_1)
crystal_cap += 1 * sign;
else
return;
+
+ crystal_cap = clamp(crystal_cap, 0, 127);
rtw89_phy_cfo_set_crystal_cap(rtwdev, (u8)crystal_cap, false);
rtw89_debug(rtwdev, RTW89_DBG_CFO,
"X_cap{Curr,Default}={0x%x,0x%x}\n",
diff --git a/drivers/net/wireless/realtek/rtw89/phy.h b/drivers/net/wireless/realtek/rtw89/phy.h
index c683f4d7d29b0..bc6912b3a2fba 100644
--- a/drivers/net/wireless/realtek/rtw89/phy.h
+++ b/drivers/net/wireless/realtek/rtw89/phy.h
@@ -57,7 +57,7 @@
#define CFO_TRK_STOP_TH_4 (30 << 2)
#define CFO_TRK_STOP_TH_3 (20 << 2)
#define CFO_TRK_STOP_TH_2 (10 << 2)
-#define CFO_TRK_STOP_TH_1 (00 << 2)
+#define CFO_TRK_STOP_TH_1 (03 << 2)
#define CFO_TRK_STOP_TH (2 << 2)
#define CFO_SW_COMP_FINE_TUNE (2 << 2)
#define CFO_PERIOD_CNT 15
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 056/443] tun: fix group permission check
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 055/443] wifi: rtw89: add crystal_cap check to avoid setting as overflow value Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 057/443] mmc: core: Respect quirk_max_rate for non-UHS SDIO card Greg Kroah-Hartman
` (397 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stas Sergeev, Willem de Bruijn,
Jason Wang, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stas Sergeev <stsp2@yandex.ru>
[ Upstream commit 3ca459eaba1bf96a8c7878de84fa8872259a01e3 ]
Currently tun checks the group permission even if the user have matched.
Besides going against the usual permission semantic, this has a
very interesting implication: if the tun group is not among the
supplementary groups of the tun user, then effectively no one can
access the tun device. CAP_SYS_ADMIN still can, but its the same as
not setting the tun ownership.
This patch relaxes the group checking so that either the user match
or the group match is enough. This avoids the situation when no one
can access the device even though the ownership is properly set.
Also I simplified the logic by removing the redundant inversions:
tun_not_capable() --> !tun_capable()
Signed-off-by: Stas Sergeev <stsp2@yandex.ru>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://patch.msgid.link/20241205073614.294773-1-stsp2@yandex.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/tun.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 148c7bc66c0af..28624cca91f8d 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -574,14 +574,18 @@ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
return ret;
}
-static inline bool tun_not_capable(struct tun_struct *tun)
+static inline bool tun_capable(struct tun_struct *tun)
{
const struct cred *cred = current_cred();
struct net *net = dev_net(tun->dev);
- return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
- (gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
- !ns_capable(net->user_ns, CAP_NET_ADMIN);
+ if (ns_capable(net->user_ns, CAP_NET_ADMIN))
+ return 1;
+ if (uid_valid(tun->owner) && uid_eq(cred->euid, tun->owner))
+ return 1;
+ if (gid_valid(tun->group) && in_egroup_p(tun->group))
+ return 1;
+ return 0;
}
static void tun_set_real_num_queues(struct tun_struct *tun)
@@ -2778,7 +2782,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
!!(tun->flags & IFF_MULTI_QUEUE))
return -EINVAL;
- if (tun_not_capable(tun))
+ if (!tun_capable(tun))
return -EPERM;
err = security_tun_dev_open(tun->security);
if (err < 0)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 057/443] mmc: core: Respect quirk_max_rate for non-UHS SDIO card
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 056/443] tun: fix group permission check Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 058/443] mmc: sdhci-esdhc-imx: enable SDHCI_QUIRK_NO_LED quirk for S32G Greg Kroah-Hartman
` (396 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shawn Lin, Ulf Hansson, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
[ Upstream commit a2a44f8da29352f76c99c6904ee652911b8dc7dd ]
The card-quirk was added to limit the clock-rate for a card with UHS-mode
support, although let's respect the quirk for non-UHS mode too, to make the
behaviour consistent.
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Message-ID: <1732268242-72799-1-git-send-email-shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/core/sdio.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 9566837c9848e..4b19b8a16b096 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -458,6 +458,8 @@ static unsigned mmc_sdio_get_max_clock(struct mmc_card *card)
if (mmc_card_sd_combo(card))
max_dtr = min(max_dtr, mmc_sd_get_max_clock(card));
+ max_dtr = min_not_zero(max_dtr, card->quirk_max_rate);
+
return max_dtr;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 058/443] mmc: sdhci-esdhc-imx: enable SDHCI_QUIRK_NO_LED quirk for S32G
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 057/443] mmc: core: Respect quirk_max_rate for non-UHS SDIO card Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 059/443] wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() Greg Kroah-Hartman
` (395 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ciprian Marian Costea, Frank Li,
Adrian Hunter, Haibo Chen, Ulf Hansson, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com>
[ Upstream commit 0202dfbdc5dea70e213205aa42ab49a1a08aad3a ]
Enable SDHCI_QUIRK_NO_LED quirk for S32G2/S32G3 variants as the controller
does not have a LED signal line.
Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>
Message-ID: <20241125083357.1041949-1-ciprianmarian.costea@oss.nxp.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/sdhci-esdhc-imx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d55d045ef2363..e23177ea9d916 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -304,6 +304,7 @@ static struct esdhc_soc_data usdhc_s32g2_data = {
| ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200
| ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES
| ESDHC_FLAG_SKIP_ERR004536 | ESDHC_FLAG_SKIP_CD_WAKE,
+ .quirks = SDHCI_QUIRK_NO_LED,
};
static struct esdhc_soc_data usdhc_imx7ulp_data = {
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 059/443] wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 058/443] mmc: sdhci-esdhc-imx: enable SDHCI_QUIRK_NO_LED quirk for S32G Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 060/443] tomoyo: dont emit warning in tomoyo_write_control() Greg Kroah-Hartman
` (394 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov, Arend van Spriel,
Kalle Valo, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 3f4a0948c3524ae50f166dbc6572a3296b014e62 ]
In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN()
instead of possible out-of-bounds 'tbl_iqcal_gainparams_nphy' access.
Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20241210070441.836362-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
index d69879e1bd870..d362c4337616b 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
@@ -23423,6 +23423,9 @@ wlc_phy_iqcal_gainparams_nphy(struct brcms_phy *pi, u16 core_no,
break;
}
+ if (WARN_ON(k == NPHY_IQCAL_NUMGAINS))
+ return;
+
params->txgm = tbl_iqcal_gainparams_nphy[band_idx][k][1];
params->pga = tbl_iqcal_gainparams_nphy[band_idx][k][2];
params->pad = tbl_iqcal_gainparams_nphy[band_idx][k][3];
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 060/443] tomoyo: dont emit warning in tomoyo_write_control()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 059/443] wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 061/443] mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id Greg Kroah-Hartman
` (393 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7536f77535e5210a5c76,
Leo Stone, Tetsuo Handa, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit 3df7546fc03b8f004eee0b9e3256369f7d096685 ]
syzbot is reporting too large allocation warning at tomoyo_write_control(),
for one can write a very very long line without new line character. To fix
this warning, I use __GFP_NOWARN rather than checking for KMALLOC_MAX_SIZE,
for practically a valid line should be always shorter than 32KB where the
"too small to fail" memory-allocation rule applies.
One might try to write a valid line that is longer than 32KB, but such
request will likely fail with -ENOMEM. Therefore, I feel that separately
returning -EINVAL when a line is longer than KMALLOC_MAX_SIZE is redundant.
There is no need to distinguish over-32KB and over-KMALLOC_MAX_SIZE.
Reported-by: syzbot+7536f77535e5210a5c76@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7536f77535e5210a5c76
Reported-by: Leo Stone <leocstone@gmail.com>
Closes: https://lkml.kernel.org/r/20241216021459.178759-2-leocstone@gmail.com
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/tomoyo/common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index 5c7b059a332aa..972664962e8f6 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -2665,7 +2665,7 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
if (head->w.avail >= head->writebuf_size - 1) {
const int len = head->writebuf_size * 2;
- char *cp = kzalloc(len, GFP_NOFS);
+ char *cp = kzalloc(len, GFP_NOFS | __GFP_NOWARN);
if (!cp) {
error = -ENOMEM;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 061/443] mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 060/443] tomoyo: dont emit warning in tomoyo_write_control() Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 062/443] wifi: rtw88: add __packed attribute to efuse layout struct Greg Kroah-Hartman
` (392 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Andy Shevchenko,
Lee Jones, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 1e89d21f8189d286f80b900e1b7cf57cb1f3037e ]
On N4100 / N4120 Gemini Lake SoCs the ISA bridge PCI device-id is 31e8
rather the 3197 found on e.g. the N4000 / N4020.
While at fix the existing GLK PCI-id table entry breaking the table
being sorted by device-id.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://lore.kernel.org/r/20241114193808.110132-1-hdegoede@redhat.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/lpc_ich.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/lpc_ich.c b/drivers/mfd/lpc_ich.c
index f14901660147f..4b7d0cb9340f1 100644
--- a/drivers/mfd/lpc_ich.c
+++ b/drivers/mfd/lpc_ich.c
@@ -834,8 +834,9 @@ static const struct pci_device_id lpc_ich_ids[] = {
{ PCI_VDEVICE(INTEL, 0x2917), LPC_ICH9ME},
{ PCI_VDEVICE(INTEL, 0x2918), LPC_ICH9},
{ PCI_VDEVICE(INTEL, 0x2919), LPC_ICH9M},
- { PCI_VDEVICE(INTEL, 0x3197), LPC_GLK},
{ PCI_VDEVICE(INTEL, 0x2b9c), LPC_COUGARMOUNTAIN},
+ { PCI_VDEVICE(INTEL, 0x3197), LPC_GLK},
+ { PCI_VDEVICE(INTEL, 0x31e8), LPC_GLK},
{ PCI_VDEVICE(INTEL, 0x3a14), LPC_ICH10DO},
{ PCI_VDEVICE(INTEL, 0x3a16), LPC_ICH10R},
{ PCI_VDEVICE(INTEL, 0x3a18), LPC_ICH10},
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 062/443] wifi: rtw88: add __packed attribute to efuse layout struct
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 061/443] mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 063/443] clk: qcom: Make GCC_8150 depend on QCOM_GDSC Greg Kroah-Hartman
` (391 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Ping-Ke Shih,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit 0daa521a1c8c29ffbefe6530f0d276e74e2749d0 ]
The layout struct of efuse should not do address alignment by compiler.
Otherwise it leads unexpected layout and size for certain arch suc as arm.
In x86-64, the results are identical before and after this patch.
Also adjust bit-field to prevent over adjacent byte to avoid warning:
rtw88/rtw8822b.h:66:1: note: offset of packed bit-field `res2` has changed in GCC 4.4
66 | } __packed;
| ^
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202412120131.qk0x6OhE-lkp@intel.com/
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241212054203.135046-1-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/main.h | 4 ++--
drivers/net/wireless/realtek/rtw88/rtw8723x.h | 8 ++++----
drivers/net/wireless/realtek/rtw88/rtw8821c.h | 9 +++++----
drivers/net/wireless/realtek/rtw88/rtw8822b.h | 9 +++++----
drivers/net/wireless/realtek/rtw88/rtw8822c.h | 9 +++++----
5 files changed, 21 insertions(+), 18 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h
index cd09fb6f7b8b3..65c7acea41aff 100644
--- a/drivers/net/wireless/realtek/rtw88/main.h
+++ b/drivers/net/wireless/realtek/rtw88/main.h
@@ -510,12 +510,12 @@ struct rtw_5g_txpwr_idx {
struct rtw_5g_vht_ns_pwr_idx_diff vht_2s_diff;
struct rtw_5g_vht_ns_pwr_idx_diff vht_3s_diff;
struct rtw_5g_vht_ns_pwr_idx_diff vht_4s_diff;
-};
+} __packed;
struct rtw_txpwr_idx {
struct rtw_2g_txpwr_idx pwr_idx_2g;
struct rtw_5g_txpwr_idx pwr_idx_5g;
-};
+} __packed;
struct rtw_channel_params {
u8 center_chan;
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8723x.h b/drivers/net/wireless/realtek/rtw88/rtw8723x.h
index e93bfce994bf8..a99af527c92cf 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8723x.h
+++ b/drivers/net/wireless/realtek/rtw88/rtw8723x.h
@@ -47,7 +47,7 @@ struct rtw8723xe_efuse {
u8 device_id[2];
u8 sub_vendor_id[2];
u8 sub_device_id[2];
-};
+} __packed;
struct rtw8723xu_efuse {
u8 res4[48]; /* 0xd0 */
@@ -56,12 +56,12 @@ struct rtw8723xu_efuse {
u8 usb_option; /* 0x104 */
u8 res5[2]; /* 0x105 */
u8 mac_addr[ETH_ALEN]; /* 0x107 */
-};
+} __packed;
struct rtw8723xs_efuse {
u8 res4[0x4a]; /* 0xd0 */
u8 mac_addr[ETH_ALEN]; /* 0x11a */
-};
+} __packed;
struct rtw8723x_efuse {
__le16 rtl_id;
@@ -96,7 +96,7 @@ struct rtw8723x_efuse {
struct rtw8723xu_efuse u;
struct rtw8723xs_efuse s;
};
-};
+} __packed;
#define RTW8723X_IQK_ADDA_REG_NUM 16
#define RTW8723X_IQK_MAC8_REG_NUM 3
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821c.h b/drivers/net/wireless/realtek/rtw88/rtw8821c.h
index 7a33ebd612eda..954e93c8020d8 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.h
+++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.h
@@ -27,7 +27,7 @@ struct rtw8821cu_efuse {
u8 res11[0xcf];
u8 package_type; /* 0x1fb */
u8 res12[0x4];
-};
+} __packed;
struct rtw8821ce_efuse {
u8 mac_addr[ETH_ALEN]; /* 0xd0 */
@@ -47,7 +47,8 @@ struct rtw8821ce_efuse {
u8 ltr_en:1;
u8 res1:2;
u8 obff:2;
- u8 res2:3;
+ u8 res2_1:1;
+ u8 res2_2:2;
u8 obff_cap:2;
u8 res3:4;
u8 res4[3];
@@ -63,7 +64,7 @@ struct rtw8821ce_efuse {
u8 res6:1;
u8 port_t_power_on_value:5;
u8 res7;
-};
+} __packed;
struct rtw8821cs_efuse {
u8 res4[0x4a]; /* 0xd0 */
@@ -101,7 +102,7 @@ struct rtw8821c_efuse {
struct rtw8821cu_efuse u;
struct rtw8821cs_efuse s;
};
-};
+} __packed;
static inline void
_rtw_write32s_mask(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 data)
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.h b/drivers/net/wireless/realtek/rtw88/rtw8822b.h
index 0514958fb57c3..9fca9ba67c90f 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.h
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.h
@@ -27,7 +27,7 @@ struct rtw8822bu_efuse {
u8 res11[0xcf];
u8 package_type; /* 0x1fb */
u8 res12[0x4];
-};
+} __packed;
struct rtw8822be_efuse {
u8 mac_addr[ETH_ALEN]; /* 0xd0 */
@@ -47,7 +47,8 @@ struct rtw8822be_efuse {
u8 ltr_en:1;
u8 res1:2;
u8 obff:2;
- u8 res2:3;
+ u8 res2_1:1;
+ u8 res2_2:2;
u8 obff_cap:2;
u8 res3:4;
u8 res4[3];
@@ -63,7 +64,7 @@ struct rtw8822be_efuse {
u8 res6:1;
u8 port_t_power_on_value:5;
u8 res7;
-};
+} __packed;
struct rtw8822bs_efuse {
u8 res4[0x4a]; /* 0xd0 */
@@ -103,7 +104,7 @@ struct rtw8822b_efuse {
struct rtw8822bu_efuse u;
struct rtw8822bs_efuse s;
};
-};
+} __packed;
static inline void
_rtw_write32s_mask(struct rtw_dev *rtwdev, u32 addr, u32 mask, u32 data)
diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.h b/drivers/net/wireless/realtek/rtw88/rtw8822c.h
index e2b383d633cd2..fc62b67a15f21 100644
--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.h
+++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.h
@@ -14,7 +14,7 @@ struct rtw8822cu_efuse {
u8 res1[3];
u8 mac_addr[ETH_ALEN]; /* 0x157 */
u8 res2[0x3d];
-};
+} __packed;
struct rtw8822cs_efuse {
u8 res0[0x4a]; /* 0x120 */
@@ -39,7 +39,8 @@ struct rtw8822ce_efuse {
u8 ltr_en:1;
u8 res1:2;
u8 obff:2;
- u8 res2:3;
+ u8 res2_1:1;
+ u8 res2_2:2;
u8 obff_cap:2;
u8 res3:4;
u8 class_code[3];
@@ -55,7 +56,7 @@ struct rtw8822ce_efuse {
u8 res6:1;
u8 port_t_power_on_value:5;
u8 res7;
-};
+} __packed;
struct rtw8822c_efuse {
__le16 rtl_id;
@@ -102,7 +103,7 @@ struct rtw8822c_efuse {
struct rtw8822cu_efuse u;
struct rtw8822cs_efuse s;
};
-};
+} __packed;
enum rtw8822c_dpk_agc_phase {
RTW_DPK_GAIN_CHECK,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 063/443] clk: qcom: Make GCC_8150 depend on QCOM_GDSC
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 062/443] wifi: rtw88: add __packed attribute to efuse layout struct Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 064/443] net/mlx5: HWS, change error flow on matcher disconnect Greg Kroah-Hartman
` (390 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[ Upstream commit 1474149c4209943b37a2c01b82f07ba39465e5fe ]
Like all other non-ancient Qualcomm clock drivers, QCOM_GDSC is
required, as the GCC driver defines and instantiates a bunch of GDSCs.
Add the missing dependency.
Reported-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Closes: https://lore.kernel.org/linux-arm-msm/ab85f2ae-6c97-4fbb-a15b-31cc9e1f77fc@linaro.org/
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Link: https://lore.kernel.org/r/20241026-topic-8150gcc_kconfig-v1-1-3772013d8804@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/Kconfig b/drivers/clk/qcom/Kconfig
index ef89d686cbc4e..c27ea46283fd9 100644
--- a/drivers/clk/qcom/Kconfig
+++ b/drivers/clk/qcom/Kconfig
@@ -1079,6 +1079,7 @@ config SM_GCC_7150
config SM_GCC_8150
tristate "SM8150 Global Clock Controller"
depends on ARM64 || COMPILE_TEST
+ select QCOM_GDSC
help
Support for the global clock controller on SM8150 devices.
Say Y if you want to use peripheral devices such as UART,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 064/443] net/mlx5: HWS, change error flow on matcher disconnect
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 063/443] clk: qcom: Make GCC_8150 depend on QCOM_GDSC Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 065/443] net/mlx5: HWS, num_of_rules counter on matcher should be atomic Greg Kroah-Hartman
` (389 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yevgeny Kliteynik, Itamar Gozlan,
Mark Bloch, Tariq Toukan, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yevgeny Kliteynik <kliteyn@nvidia.com>
[ Upstream commit 1ce840c7a659aa53a31ef49f0271b4fd0dc10296 ]
Currently, when firmware failure occurs during matcher disconnect flow,
the error flow of the function reconnects the matcher back and returns
an error, which continues running the calling function and eventually
frees the matcher that is being disconnected.
This leads to a case where we have a freed matcher on the matchers list,
which in turn leads to use-after-free and eventual crash.
This patch fixes that by not trying to reconnect the matcher back when
some FW command fails during disconnect.
Note that we're dealing here with FW error. We can't overcome this
problem. This might lead to bad steering state (e.g. wrong connection
between matchers), and will also lead to resource leakage, as it is
the case with any other error handling during resource destruction.
However, the goal here is to allow the driver to continue and not crash
the machine with use-after-free error.
Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Signed-off-by: Itamar Gozlan <igozlan@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20250102181415.1477316-7-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/steering/hws/matcher.c | 24 +++++++------------
1 file changed, 8 insertions(+), 16 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c
index 1bb3a6f8c3cda..e94f96c0c781f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c
@@ -165,14 +165,14 @@ static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher)
next->match_ste.rtc_0_id,
next->match_ste.rtc_1_id);
if (ret) {
- mlx5hws_err(tbl->ctx, "Failed to disconnect matcher\n");
- goto matcher_reconnect;
+ mlx5hws_err(tbl->ctx, "Fatal error, failed to disconnect matcher\n");
+ return ret;
}
} else {
ret = mlx5hws_table_connect_to_miss_table(tbl, tbl->default_miss.miss_tbl);
if (ret) {
- mlx5hws_err(tbl->ctx, "Failed to disconnect last matcher\n");
- goto matcher_reconnect;
+ mlx5hws_err(tbl->ctx, "Fatal error, failed to disconnect last matcher\n");
+ return ret;
}
}
@@ -180,27 +180,19 @@ static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher)
if (prev_ft_id == tbl->ft_id) {
ret = mlx5hws_table_update_connected_miss_tables(tbl);
if (ret) {
- mlx5hws_err(tbl->ctx, "Fatal error, failed to update connected miss table\n");
- goto matcher_reconnect;
+ mlx5hws_err(tbl->ctx,
+ "Fatal error, failed to update connected miss table\n");
+ return ret;
}
}
ret = mlx5hws_table_ft_set_default_next_ft(tbl, prev_ft_id);
if (ret) {
mlx5hws_err(tbl->ctx, "Fatal error, failed to restore matcher ft default miss\n");
- goto matcher_reconnect;
+ return ret;
}
return 0;
-
-matcher_reconnect:
- if (list_empty(&tbl->matchers_list) || !prev)
- list_add(&matcher->list_node, &tbl->matchers_list);
- else
- /* insert after prev matcher */
- list_add(&matcher->list_node, &prev->list_node);
-
- return ret;
}
static void hws_matcher_set_rtc_attr_sz(struct mlx5hws_matcher *matcher,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 065/443] net/mlx5: HWS, num_of_rules counter on matcher should be atomic
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 064/443] net/mlx5: HWS, change error flow on matcher disconnect Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 066/443] HID: multitouch: Add quirk for Hantick 5288 touchpad Greg Kroah-Hartman
` (388 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yevgeny Kliteynik, Erez Shitrit,
Mark Bloch, Tariq Toukan, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yevgeny Kliteynik <kliteyn@nvidia.com>
[ Upstream commit 61fb92701b8ac9174857c417cfa988adc24e32c2 ]
Rule counter in matcher's struct is used in two places:
1. As heuristics to decide when the number of rules have crossed a
certain percentage threshold and the matcher should be resized.
We don't mind here if the number will be off by 1-2 due to concurrency.
2. When destroying matcher, the counter value is checked and the
user is warned if it is not 0. Here we lock all the queues, so the
counter will be correct.
We don't need to always have *exact* number, but we do need this
number to not be corrupted, which is what is happening when the
counter isn't atomic, due to update by different threads.
Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Erez Shitrit <erezsh@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20250102181415.1477316-10-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/steering/hws/bwc.c | 17 +++++++++++------
.../mellanox/mlx5/core/steering/hws/bwc.h | 2 +-
2 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
index baacf662c0ab8..ae2849cf4dd49 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c
@@ -152,6 +152,8 @@ mlx5hws_bwc_matcher_create(struct mlx5hws_table *table,
if (!bwc_matcher)
return NULL;
+ atomic_set(&bwc_matcher->num_of_rules, 0);
+
/* Check if the required match params can be all matched
* in single STE, otherwise complex matcher is needed.
*/
@@ -199,10 +201,12 @@ int mlx5hws_bwc_matcher_destroy_simple(struct mlx5hws_bwc_matcher *bwc_matcher)
int mlx5hws_bwc_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher)
{
- if (bwc_matcher->num_of_rules)
+ u32 num_of_rules = atomic_read(&bwc_matcher->num_of_rules);
+
+ if (num_of_rules)
mlx5hws_err(bwc_matcher->matcher->tbl->ctx,
"BWC matcher destroy: matcher still has %d rules\n",
- bwc_matcher->num_of_rules);
+ num_of_rules);
mlx5hws_bwc_matcher_destroy_simple(bwc_matcher);
@@ -309,7 +313,7 @@ static void hws_bwc_rule_list_add(struct mlx5hws_bwc_rule *bwc_rule, u16 idx)
{
struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher;
- bwc_matcher->num_of_rules++;
+ atomic_inc(&bwc_matcher->num_of_rules);
bwc_rule->bwc_queue_idx = idx;
list_add(&bwc_rule->list_node, &bwc_matcher->rules[idx]);
}
@@ -318,7 +322,7 @@ static void hws_bwc_rule_list_remove(struct mlx5hws_bwc_rule *bwc_rule)
{
struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher;
- bwc_matcher->num_of_rules--;
+ atomic_dec(&bwc_matcher->num_of_rules);
list_del_init(&bwc_rule->list_node);
}
@@ -704,7 +708,8 @@ hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher)
* Need to check again if we really need rehash.
* If the reason for rehash was size, but not any more - skip rehash.
*/
- if (!hws_bwc_matcher_rehash_size_needed(bwc_matcher, bwc_matcher->num_of_rules))
+ if (!hws_bwc_matcher_rehash_size_needed(bwc_matcher,
+ atomic_read(&bwc_matcher->num_of_rules)))
return 0;
/* Now we're done all the checking - do the rehash:
@@ -797,7 +802,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule,
}
/* check if number of rules require rehash */
- num_of_rules = bwc_matcher->num_of_rules;
+ num_of_rules = atomic_read(&bwc_matcher->num_of_rules);
if (unlikely(hws_bwc_matcher_rehash_size_needed(bwc_matcher, num_of_rules))) {
mutex_unlock(queue_lock);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h
index 0b745968e21e1..655fa7a22d84f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h
@@ -19,7 +19,7 @@ struct mlx5hws_bwc_matcher {
u8 num_of_at;
u16 priority;
u8 size_log;
- u32 num_of_rules; /* atomically accessed */
+ atomic_t num_of_rules;
struct list_head *rules;
};
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 066/443] HID: multitouch: Add quirk for Hantick 5288 touchpad
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 065/443] net/mlx5: HWS, num_of_rules counter on matcher should be atomic Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 067/443] HID: Wacom: Add PCI Wacom device support Greg Kroah-Hartman
` (387 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Enze Xie, Youwan Wang, Jiri Kosina,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youwan Wang <youwan@nfschina.com>
[ Upstream commit b5e65ae557da9fd17b08482ee44ee108ba636182 ]
This device sometimes doesn't send touch release signals when moving
from >=2 fingers to <2 fingers. Using MT_QUIRK_NOT_SEEN_MEANS_UP instead
of MT_QUIRK_ALWAYS_VALID makes sure that no touches become stuck.
Signed-off-by: Enze Xie <enze@nfschina.com>
Signed-off-by: Youwan Wang <youwan@nfschina.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 42c0bd9d2f31e..82900857bfd87 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -2314,6 +2314,11 @@ static const struct hid_device_id mt_devices[] = {
HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, USB_VENDOR_ID_SIS_TOUCH,
HID_ANY_ID) },
+ /* Hantick */
+ { .driver_data = MT_CLS_NSMU,
+ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+ I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288) },
+
/* Generic MT device */
{ HID_DEVICE(HID_BUS_ANY, HID_GROUP_MULTITOUCH, HID_ANY_ID, HID_ANY_ID) },
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 067/443] HID: Wacom: Add PCI Wacom device support
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 066/443] HID: multitouch: Add quirk for Hantick 5288 touchpad Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 068/443] net/mlx5: use do_aux_work for PHC overflow checks Greg Kroah-Hartman
` (386 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Even Xu, Tatsunosuke Tobita,
Ping Cheng, Jiri Kosina, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Even Xu <even.xu@intel.com>
[ Upstream commit c4c123504a65583e3689b3de04a61dc5272e453a ]
Add PCI device ID of wacom device into driver support list.
Signed-off-by: Even Xu <even.xu@intel.com>
Tested-by: Tatsunosuke Tobita <tatsunosuke.tobita@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/wacom_wac.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 5501a560fb07f..b60bfafc6a8fb 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -4946,6 +4946,10 @@ static const struct wacom_features wacom_features_0x94 =
HID_DEVICE(BUS_I2C, HID_GROUP_WACOM, USB_VENDOR_ID_WACOM, prod),\
.driver_data = (kernel_ulong_t)&wacom_features_##prod
+#define PCI_DEVICE_WACOM(prod) \
+ HID_DEVICE(BUS_PCI, HID_GROUP_WACOM, USB_VENDOR_ID_WACOM, prod),\
+ .driver_data = (kernel_ulong_t)&wacom_features_##prod
+
#define USB_DEVICE_LENOVO(prod) \
HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, prod), \
.driver_data = (kernel_ulong_t)&wacom_features_##prod
@@ -5115,6 +5119,7 @@ const struct hid_device_id wacom_ids[] = {
{ USB_DEVICE_WACOM(HID_ANY_ID) },
{ I2C_DEVICE_WACOM(HID_ANY_ID) },
+ { PCI_DEVICE_WACOM(HID_ANY_ID) },
{ BT_DEVICE_WACOM(HID_ANY_ID) },
{ }
};
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 068/443] net/mlx5: use do_aux_work for PHC overflow checks
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 067/443] HID: Wacom: Add PCI Wacom device support Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 069/443] Revert "mfd: axp20x: Allow multiple regulators" Greg Kroah-Hartman
` (385 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Vadim Fedorenko,
Tariq Toukan, Paolo Abeni, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Fedorenko <vadfed@meta.com>
[ Upstream commit e61e6c415ba9ff2b32bb6780ce1b17d1d76238f1 ]
The overflow_work is using system wq to do overflow checks and updates
for PHC device timecounter, which might be overhelmed by other tasks.
But there is dedicated kthread in PTP subsystem designed for such
things. This patch changes the work queue to proper align with PTP
subsystem and to avoid overloading system work queue.
The adjfine() function acts the same way as overflow check worker,
we can postpone ptp aux worker till the next overflow period after
adjfine() was called.
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Signed-off-by: Vadim Fedorenko <vadfed@meta.com>
Acked-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20250107104812.380225-1-vadfed@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlx5/core/lib/clock.c | 24 ++++++++++---------
include/linux/mlx5/driver.h | 1 -
2 files changed, 13 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 4822d01123b45..d61a1a9297c90 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -322,17 +322,16 @@ static void mlx5_pps_out(struct work_struct *work)
}
}
-static void mlx5_timestamp_overflow(struct work_struct *work)
+static long mlx5_timestamp_overflow(struct ptp_clock_info *ptp_info)
{
- struct delayed_work *dwork = to_delayed_work(work);
struct mlx5_core_dev *mdev;
struct mlx5_timer *timer;
struct mlx5_clock *clock;
unsigned long flags;
- timer = container_of(dwork, struct mlx5_timer, overflow_work);
- clock = container_of(timer, struct mlx5_clock, timer);
+ clock = container_of(ptp_info, struct mlx5_clock, ptp_info);
mdev = container_of(clock, struct mlx5_core_dev, clock);
+ timer = &clock->timer;
if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
goto out;
@@ -343,7 +342,7 @@ static void mlx5_timestamp_overflow(struct work_struct *work)
write_sequnlock_irqrestore(&clock->lock, flags);
out:
- schedule_delayed_work(&timer->overflow_work, timer->overflow_period);
+ return timer->overflow_period;
}
static int mlx5_ptp_settime_real_time(struct mlx5_core_dev *mdev,
@@ -517,6 +516,7 @@ static int mlx5_ptp_adjfine(struct ptp_clock_info *ptp, long scaled_ppm)
timer->cycles.mult = mult;
mlx5_update_clock_info_page(mdev);
write_sequnlock_irqrestore(&clock->lock, flags);
+ ptp_schedule_worker(clock->ptp, timer->overflow_period);
return 0;
}
@@ -852,6 +852,7 @@ static const struct ptp_clock_info mlx5_ptp_clock_info = {
.settime64 = mlx5_ptp_settime,
.enable = NULL,
.verify = NULL,
+ .do_aux_work = mlx5_timestamp_overflow,
};
static int mlx5_query_mtpps_pin_mode(struct mlx5_core_dev *mdev, u8 pin,
@@ -1052,12 +1053,11 @@ static void mlx5_init_overflow_period(struct mlx5_clock *clock)
do_div(ns, NSEC_PER_SEC / HZ);
timer->overflow_period = ns;
- INIT_DELAYED_WORK(&timer->overflow_work, mlx5_timestamp_overflow);
- if (timer->overflow_period)
- schedule_delayed_work(&timer->overflow_work, 0);
- else
+ if (!timer->overflow_period) {
+ timer->overflow_period = HZ;
mlx5_core_warn(mdev,
- "invalid overflow period, overflow_work is not scheduled\n");
+ "invalid overflow period, overflow_work is scheduled once per second\n");
+ }
if (clock_info)
clock_info->overflow_period = timer->overflow_period;
@@ -1172,6 +1172,9 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev)
MLX5_NB_INIT(&clock->pps_nb, mlx5_pps_event, PPS_EVENT);
mlx5_eq_notifier_register(mdev, &clock->pps_nb);
+
+ if (clock->ptp)
+ ptp_schedule_worker(clock->ptp, 0);
}
void mlx5_cleanup_clock(struct mlx5_core_dev *mdev)
@@ -1188,7 +1191,6 @@ void mlx5_cleanup_clock(struct mlx5_core_dev *mdev)
}
cancel_work_sync(&clock->pps_info.out_work);
- cancel_delayed_work_sync(&clock->timer.overflow_work);
if (mdev->clock_info) {
free_page((unsigned long)mdev->clock_info);
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index ea48eb879a0f5..fed666c5bd163 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -691,7 +691,6 @@ struct mlx5_timer {
struct timecounter tc;
u32 nominal_c_mult;
unsigned long overflow_period;
- struct delayed_work overflow_work;
};
struct mlx5_clock {
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 069/443] Revert "mfd: axp20x: Allow multiple regulators"
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 068/443] net/mlx5: use do_aux_work for PHC overflow checks Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 070/443] wifi: brcmfmac: Check the return value of of_property_read_string_index() Greg Kroah-Hartman
` (384 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Morgan, Vasily Khoruzhick,
Andre Przywara, Chen-Yu Tsai, Lee Jones, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <andre.przywara@arm.com>
[ Upstream commit b246bd32a34c1b0d80670e60e4e4102be6366191 ]
As Chris and Vasily reported, the attempt to support multiple AXP PMICs
in one system [1] breaks some of the battery and charging functionality
on devices with AXP PMICs. The reason is that the drivers now fail to get
the correct IIO channel for the ADC component, as the current code seems
to rely on the zero-based enumeration of the regulator devices.
A fix is possible, but not trivial, as it requires some rework in the AXP
MFD driver, which cannot be fully reviewed or tested in time for the
6.13 release.
So revert this patch for now, to avoid regressions on battery powered
devices. This patch was really only necessary for devices with two
PMICs, support for which is not mainline yet anyway, so we don't lose
any functionality.
This reverts commit e37ec32188701efa01455b9be42a392adab06ce4.
[1] https://lore.kernel.org/linux-sunxi/20241007001408.27249-4-andre.przywara@arm.com/
Reported-by: Chris Morgan <macroalpha82@gmail.com>
Closes: https://lore.kernel.org/linux-sunxi/675489c1.050a0220.8d73f.6e90@mx.google.com/
Reported-by: Vasily Khoruzhick <anarsoul@gmail.com>
Closes: https://lore.kernel.org/linux-sunxi/CA+E=qVf8_9gn0y=mcdKXvj2PFoHT2eF+JN=CmtTNdRGaSnpgKg@mail.gmail.com/
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20250108164359.2609078-1-andre.przywara@arm.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/axp20x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
index 251465a656d09..bce85a58944ac 100644
--- a/drivers/mfd/axp20x.c
+++ b/drivers/mfd/axp20x.c
@@ -1445,7 +1445,7 @@ int axp20x_device_probe(struct axp20x_dev *axp20x)
}
}
- ret = mfd_add_devices(axp20x->dev, PLATFORM_DEVID_AUTO, axp20x->cells,
+ ret = mfd_add_devices(axp20x->dev, PLATFORM_DEVID_NONE, axp20x->cells,
axp20x->nr_cells, NULL, 0, NULL);
if (ret) {
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 070/443] wifi: brcmfmac: Check the return value of of_property_read_string_index()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 069/443] Revert "mfd: axp20x: Allow multiple regulators" Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 071/443] wifi: iwlwifi: pcie: Add support for new device ids Greg Kroah-Hartman
` (383 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Dösinger,
Arend van Spriel, Kalle Valo, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Dösinger <stefan@codeweavers.com>
[ Upstream commit 082d9e263af8de68f0c34f67b251818205160f6e ]
Somewhen between 6.10 and 6.11 the driver started to crash on my
MacBookPro14,3. The property doesn't exist and 'tmp' remains
uninitialized, so we pass a random pointer to devm_kstrdup().
The crash I am getting looks like this:
BUG: unable to handle page fault for address: 00007f033c669379
PF: supervisor read access in kernel mode
PF: error_code(0x0001) - permissions violation
PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025
Oops: Oops: 0001 [#1] SMP PTI
CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1
Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024
RIP: 0010:strlen+0x4/0x30
Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc
RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202
RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001
RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379
RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a
R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8
R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30
FS: 00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
? __die+0x23/0x70
? page_fault_oops+0x149/0x4c0
? raw_spin_rq_lock_nested+0xe/0x20
? sched_balance_newidle+0x22b/0x3c0
? update_load_avg+0x78/0x770
? exc_page_fault+0x6f/0x150
? asm_exc_page_fault+0x26/0x30
? __pfx_pci_conf1_write+0x10/0x10
? strlen+0x4/0x30
devm_kstrdup+0x25/0x70
brcmf_of_probe+0x273/0x350 [brcmfmac]
Signed-off-by: Stefan Dösinger <stefan@codeweavers.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20250106170958.3595-1-stefan@codeweavers.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
index c1f18e2fe540d..1681ad00f82ec 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/of.c
@@ -99,13 +99,13 @@ int brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
/* Set board-type to the first string of the machine compatible prop */
root = of_find_node_by_path("/");
if (root && err) {
- char *board_type;
+ char *board_type = NULL;
const char *tmp;
- of_property_read_string_index(root, "compatible", 0, &tmp);
-
/* get rid of '/' in the compatible string to be able to find the FW */
- board_type = devm_kstrdup(dev, tmp, GFP_KERNEL);
+ if (!of_property_read_string_index(root, "compatible", 0, &tmp))
+ board_type = devm_kstrdup(dev, tmp, GFP_KERNEL);
+
if (!board_type) {
of_node_put(root);
return 0;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 071/443] wifi: iwlwifi: pcie: Add support for new device ids
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 070/443] wifi: brcmfmac: Check the return value of of_property_read_string_index() Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 072/443] wifi: iwlwifi: avoid memory leak Greg Kroah-Hartman
` (382 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Somashekhar(Som), Johannes Berg,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Somashekhar(Som) <somashekhar.puttagangaiah@intel.com>
[ Upstream commit 9b45ba3976945e8d53f2dd40541a66c690f12286 ]
Add support for new device-ids 0x2730 and 0x272F.
Signed-off-by: Somashekhar(Som) <somashekhar.puttagangaiah@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Link: https://patch.msgid.link/20241226174257.6a0db60436e7.I50a66544dde6c88acd9abe4b31badab96ef04cfc@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/Makefile | 2 +-
drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 167 ++++++++++++++++++
.../net/wireless/intel/iwlwifi/iwl-config.h | 10 ++
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 16 ++
4 files changed, 194 insertions(+), 1 deletion(-)
create mode 100644 drivers/net/wireless/intel/iwlwifi/cfg/dr.c
diff --git a/drivers/net/wireless/intel/iwlwifi/Makefile b/drivers/net/wireless/intel/iwlwifi/Makefile
index 64c1233142451..a3052684b341f 100644
--- a/drivers/net/wireless/intel/iwlwifi/Makefile
+++ b/drivers/net/wireless/intel/iwlwifi/Makefile
@@ -11,7 +11,7 @@ iwlwifi-objs += pcie/ctxt-info.o pcie/ctxt-info-gen3.o
iwlwifi-objs += pcie/trans-gen2.o pcie/tx-gen2.o
iwlwifi-$(CONFIG_IWLDVM) += cfg/1000.o cfg/2000.o cfg/5000.o cfg/6000.o
iwlwifi-$(CONFIG_IWLMVM) += cfg/7000.o cfg/8000.o cfg/9000.o cfg/22000.o
-iwlwifi-$(CONFIG_IWLMVM) += cfg/ax210.o cfg/bz.o cfg/sc.o
+iwlwifi-$(CONFIG_IWLMVM) += cfg/ax210.o cfg/bz.o cfg/sc.o cfg/dr.o
iwlwifi-objs += iwl-dbg-tlv.o
iwlwifi-objs += iwl-trans.o
diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/dr.c b/drivers/net/wireless/intel/iwlwifi/cfg/dr.c
new file mode 100644
index 0000000000000..ab7c0f8d54f42
--- /dev/null
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/dr.c
@@ -0,0 +1,167 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+/*
+ * Copyright (C) 2024 Intel Corporation
+ */
+#include <linux/module.h>
+#include <linux/stringify.h>
+#include "iwl-config.h"
+#include "iwl-prph.h"
+#include "fw/api/txq.h"
+
+/* Highest firmware API version supported */
+#define IWL_DR_UCODE_API_MAX 96
+
+/* Lowest firmware API version supported */
+#define IWL_DR_UCODE_API_MIN 96
+
+/* NVM versions */
+#define IWL_DR_NVM_VERSION 0x0a1d
+
+/* Memory offsets and lengths */
+#define IWL_DR_DCCM_OFFSET 0x800000 /* LMAC1 */
+#define IWL_DR_DCCM_LEN 0x10000 /* LMAC1 */
+#define IWL_DR_DCCM2_OFFSET 0x880000
+#define IWL_DR_DCCM2_LEN 0x8000
+#define IWL_DR_SMEM_OFFSET 0x400000
+#define IWL_DR_SMEM_LEN 0xD0000
+
+#define IWL_DR_A_PE_A_FW_PRE "iwlwifi-dr-a0-pe-a0"
+#define IWL_BR_A_PET_A_FW_PRE "iwlwifi-br-a0-petc-a0"
+#define IWL_BR_A_PE_A_FW_PRE "iwlwifi-br-a0-pe-a0"
+
+#define IWL_DR_A_PE_A_FW_MODULE_FIRMWARE(api) \
+ IWL_DR_A_PE_A_FW_PRE "-" __stringify(api) ".ucode"
+#define IWL_BR_A_PET_A_FW_MODULE_FIRMWARE(api) \
+ IWL_BR_A_PET_A_FW_PRE "-" __stringify(api) ".ucode"
+#define IWL_BR_A_PE_A_FW_MODULE_FIRMWARE(api) \
+ IWL_BR_A_PE_A_FW_PRE "-" __stringify(api) ".ucode"
+
+static const struct iwl_base_params iwl_dr_base_params = {
+ .eeprom_size = OTP_LOW_IMAGE_SIZE_32K,
+ .num_of_queues = 512,
+ .max_tfd_queue_size = 65536,
+ .shadow_ram_support = true,
+ .led_compensation = 57,
+ .wd_timeout = IWL_LONG_WD_TIMEOUT,
+ .max_event_log_size = 512,
+ .shadow_reg_enable = true,
+ .pcie_l1_allowed = true,
+};
+
+#define IWL_DEVICE_DR_COMMON \
+ .ucode_api_max = IWL_DR_UCODE_API_MAX, \
+ .ucode_api_min = IWL_DR_UCODE_API_MIN, \
+ .led_mode = IWL_LED_RF_STATE, \
+ .nvm_hw_section_num = 10, \
+ .non_shared_ant = ANT_B, \
+ .dccm_offset = IWL_DR_DCCM_OFFSET, \
+ .dccm_len = IWL_DR_DCCM_LEN, \
+ .dccm2_offset = IWL_DR_DCCM2_OFFSET, \
+ .dccm2_len = IWL_DR_DCCM2_LEN, \
+ .smem_offset = IWL_DR_SMEM_OFFSET, \
+ .smem_len = IWL_DR_SMEM_LEN, \
+ .apmg_not_supported = true, \
+ .trans.mq_rx_supported = true, \
+ .vht_mu_mimo_supported = true, \
+ .mac_addr_from_csr = 0x30, \
+ .nvm_ver = IWL_DR_NVM_VERSION, \
+ .trans.rf_id = true, \
+ .trans.gen2 = true, \
+ .nvm_type = IWL_NVM_EXT, \
+ .dbgc_supported = true, \
+ .min_umac_error_event_table = 0xD0000, \
+ .d3_debug_data_base_addr = 0x401000, \
+ .d3_debug_data_length = 60 * 1024, \
+ .mon_smem_regs = { \
+ .write_ptr = { \
+ .addr = LDBG_M2S_BUF_WPTR, \
+ .mask = LDBG_M2S_BUF_WPTR_VAL_MSK, \
+ }, \
+ .cycle_cnt = { \
+ .addr = LDBG_M2S_BUF_WRAP_CNT, \
+ .mask = LDBG_M2S_BUF_WRAP_CNT_VAL_MSK, \
+ }, \
+ }, \
+ .trans.umac_prph_offset = 0x300000, \
+ .trans.device_family = IWL_DEVICE_FAMILY_DR, \
+ .trans.base_params = &iwl_dr_base_params, \
+ .min_txq_size = 128, \
+ .gp2_reg_addr = 0xd02c68, \
+ .min_ba_txq_size = IWL_DEFAULT_QUEUE_SIZE_EHT, \
+ .mon_dram_regs = { \
+ .write_ptr = { \
+ .addr = DBGC_CUR_DBGBUF_STATUS, \
+ .mask = DBGC_CUR_DBGBUF_STATUS_OFFSET_MSK, \
+ }, \
+ .cycle_cnt = { \
+ .addr = DBGC_DBGBUF_WRAP_AROUND, \
+ .mask = 0xffffffff, \
+ }, \
+ .cur_frag = { \
+ .addr = DBGC_CUR_DBGBUF_STATUS, \
+ .mask = DBGC_CUR_DBGBUF_STATUS_IDX_MSK, \
+ }, \
+ }, \
+ .mon_dbgi_regs = { \
+ .write_ptr = { \
+ .addr = DBGI_SRAM_FIFO_POINTERS, \
+ .mask = DBGI_SRAM_FIFO_POINTERS_WR_PTR_MSK, \
+ }, \
+ }
+
+#define IWL_DEVICE_DR \
+ IWL_DEVICE_DR_COMMON, \
+ .uhb_supported = true, \
+ .features = IWL_TX_CSUM_NETIF_FLAGS | NETIF_F_RXCSUM, \
+ .num_rbds = IWL_NUM_RBDS_DR_EHT, \
+ .ht_params = &iwl_22000_ht_params
+
+/*
+ * This size was picked according to 8 MSDUs inside 512 A-MSDUs in an
+ * A-MPDU, with additional overhead to account for processing time.
+ */
+#define IWL_NUM_RBDS_DR_EHT (512 * 16)
+
+const struct iwl_cfg_trans_params iwl_dr_trans_cfg = {
+ .device_family = IWL_DEVICE_FAMILY_DR,
+ .base_params = &iwl_dr_base_params,
+ .mq_rx_supported = true,
+ .rf_id = true,
+ .gen2 = true,
+ .integrated = true,
+ .umac_prph_offset = 0x300000,
+ .xtal_latency = 12000,
+ .low_latency_xtal = true,
+ .ltr_delay = IWL_CFG_TRANS_LTR_DELAY_2500US,
+};
+
+const char iwl_dr_name[] = "Intel(R) TBD Dr device";
+
+const struct iwl_cfg iwl_cfg_dr = {
+ .fw_name_mac = "dr",
+ IWL_DEVICE_DR,
+};
+
+const struct iwl_cfg_trans_params iwl_br_trans_cfg = {
+ .device_family = IWL_DEVICE_FAMILY_DR,
+ .base_params = &iwl_dr_base_params,
+ .mq_rx_supported = true,
+ .rf_id = true,
+ .gen2 = true,
+ .integrated = true,
+ .umac_prph_offset = 0x300000,
+ .xtal_latency = 12000,
+ .low_latency_xtal = true,
+ .ltr_delay = IWL_CFG_TRANS_LTR_DELAY_2500US,
+};
+
+const char iwl_br_name[] = "Intel(R) TBD Br device";
+
+const struct iwl_cfg iwl_cfg_br = {
+ .fw_name_mac = "br",
+ IWL_DEVICE_DR,
+};
+
+MODULE_FIRMWARE(IWL_DR_A_PE_A_FW_MODULE_FIRMWARE(IWL_DR_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_BR_A_PET_A_FW_MODULE_FIRMWARE(IWL_DR_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_BR_A_PE_A_FW_MODULE_FIRMWARE(IWL_DR_UCODE_API_MAX));
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index 17721bb47e251..89744dbedb4a5 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -38,6 +38,7 @@ enum iwl_device_family {
IWL_DEVICE_FAMILY_AX210,
IWL_DEVICE_FAMILY_BZ,
IWL_DEVICE_FAMILY_SC,
+ IWL_DEVICE_FAMILY_DR,
};
/*
@@ -424,6 +425,8 @@ struct iwl_cfg {
#define IWL_CFG_MAC_TYPE_SC2 0x49
#define IWL_CFG_MAC_TYPE_SC2F 0x4A
#define IWL_CFG_MAC_TYPE_BZ_W 0x4B
+#define IWL_CFG_MAC_TYPE_BR 0x4C
+#define IWL_CFG_MAC_TYPE_DR 0x4D
#define IWL_CFG_RF_TYPE_TH 0x105
#define IWL_CFG_RF_TYPE_TH1 0x108
@@ -434,6 +437,7 @@ struct iwl_cfg {
#define IWL_CFG_RF_TYPE_GF 0x10D
#define IWL_CFG_RF_TYPE_FM 0x112
#define IWL_CFG_RF_TYPE_WH 0x113
+#define IWL_CFG_RF_TYPE_PE 0x114
#define IWL_CFG_RF_ID_TH 0x1
#define IWL_CFG_RF_ID_TH1 0x1
@@ -506,6 +510,8 @@ extern const struct iwl_cfg_trans_params iwl_ma_trans_cfg;
extern const struct iwl_cfg_trans_params iwl_bz_trans_cfg;
extern const struct iwl_cfg_trans_params iwl_gl_trans_cfg;
extern const struct iwl_cfg_trans_params iwl_sc_trans_cfg;
+extern const struct iwl_cfg_trans_params iwl_dr_trans_cfg;
+extern const struct iwl_cfg_trans_params iwl_br_trans_cfg;
extern const char iwl9162_name[];
extern const char iwl9260_name[];
extern const char iwl9260_1_name[];
@@ -551,6 +557,8 @@ extern const char iwl_mtp_name[];
extern const char iwl_sc_name[];
extern const char iwl_sc2_name[];
extern const char iwl_sc2f_name[];
+extern const char iwl_dr_name[];
+extern const char iwl_br_name[];
#if IS_ENABLED(CONFIG_IWLDVM)
extern const struct iwl_cfg iwl5300_agn_cfg;
extern const struct iwl_cfg iwl5100_agn_cfg;
@@ -658,6 +666,8 @@ extern const struct iwl_cfg iwl_cfg_gl;
extern const struct iwl_cfg iwl_cfg_sc;
extern const struct iwl_cfg iwl_cfg_sc2;
extern const struct iwl_cfg iwl_cfg_sc2f;
+extern const struct iwl_cfg iwl_cfg_dr;
+extern const struct iwl_cfg iwl_cfg_br;
#endif /* CONFIG_IWLMVM */
#endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 8fb2aa2822421..9dd0e0a51ce5c 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -540,6 +540,9 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct pci_device_id iwl_hw_card_ids[] = {
{IWL_PCI_DEVICE(0xE340, PCI_ANY_ID, iwl_sc_trans_cfg)},
{IWL_PCI_DEVICE(0xD340, PCI_ANY_ID, iwl_sc_trans_cfg)},
{IWL_PCI_DEVICE(0x6E70, PCI_ANY_ID, iwl_sc_trans_cfg)},
+
+/* Dr devices */
+ {IWL_PCI_DEVICE(0x272F, PCI_ANY_ID, iwl_dr_trans_cfg)},
#endif /* CONFIG_IWLMVM */
{0}
@@ -1182,6 +1185,19 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = {
IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
iwl_cfg_sc2f, iwl_sc2f_name),
+/* Dr */
+ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
+ IWL_CFG_MAC_TYPE_DR, IWL_CFG_ANY,
+ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
+ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
+ iwl_cfg_dr, iwl_dr_name),
+
+/* Br */
+ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
+ IWL_CFG_MAC_TYPE_BR, IWL_CFG_ANY,
+ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
+ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_ANY,
+ iwl_cfg_br, iwl_br_name),
#endif /* CONFIG_IWLMVM */
};
EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_dev_info_table);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 072/443] wifi: iwlwifi: avoid memory leak
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 071/443] wifi: iwlwifi: pcie: Add support for new device ids Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 073/443] i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz Greg Kroah-Hartman
` (381 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miri Korenblit, Johannes Berg,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
[ Upstream commit 80e96206a3ef348fbd658d98f2f43149c36df8bc ]
A caller of iwl_acpi_get_dsm_object must free the returned object.
iwl_acpi_get_dsm_integer returns immediately without freeing
it if the expected size is more than 8 bytes. Fix that.
Note that with the current code this will never happen, since the caller
of iwl_acpi_get_dsm_integer already checks that the expected size if
either 1 or 4 bytes, so it can't exceed 8 bytes.
While at it, print the DSM value instead of the return value, as this
was the intention in the first place.
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241228223206.bf61eaab99f8.Ibdc5df02f885208c222456d42c889c43b7e3b2f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index 0bc32291815e1..a26c5573d2091 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -108,7 +108,7 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
size_t expected_size)
{
union acpi_object *obj;
- int ret = 0;
+ int ret;
obj = iwl_acpi_get_dsm_object(dev, rev, func, NULL, guid);
if (IS_ERR(obj)) {
@@ -123,8 +123,10 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
} else if (obj->type == ACPI_TYPE_BUFFER) {
__le64 le_value = 0;
- if (WARN_ON_ONCE(expected_size > sizeof(le_value)))
- return -EINVAL;
+ if (WARN_ON_ONCE(expected_size > sizeof(le_value))) {
+ ret = -EINVAL;
+ goto out;
+ }
/* if the buffer size doesn't match the expected size */
if (obj->buffer.length != expected_size)
@@ -145,8 +147,9 @@ static int iwl_acpi_get_dsm_integer(struct device *dev, int rev, int func,
}
IWL_DEBUG_DEV_RADIO(dev,
- "ACPI: DSM method evaluated: func=%d, ret=%d\n",
- func, ret);
+ "ACPI: DSM method evaluated: func=%d, value=%lld\n",
+ func, *value);
+ ret = 0;
out:
ACPI_FREE(obj);
return ret;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 073/443] i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 072/443] wifi: iwlwifi: avoid memory leak Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:23 ` [PATCH 6.13 074/443] APEI: GHES: Have GHES honor the panic= setting Greg Kroah-Hartman
` (380 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randolph Ha, Mika Westerberg,
Wolfram Sang, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randolph Ha <rha051117@gmail.com>
[ Upstream commit bfd74cd1fbc026f04446e67d6915c7e199c2bffd ]
When a 400KHz freq is used on this model of ELAN touchpad in Linux,
excessive smoothing (similar to when the touchpad's firmware detects
a noisy signal) is sometimes applied. As some devices' (e.g, Lenovo
V15 G4) ACPI tables specify a 400KHz frequency for this device and
some I2C busses (e.g, Designware I2C) default to a 400KHz freq,
force the speed to 100KHz as a workaround.
For future investigation: This problem may be related to the default
HCNT/LCNT values given by some busses' drivers, because they are not
specified in the aforementioned devices' ACPI tables, and because
the device works without issues on Windows at what is expected to be
a 400KHz frequency. The root cause of the issue is not known.
Signed-off-by: Randolph Ha <rha051117@gmail.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/i2c-core-acpi.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 14ae0cfc325ef..d2499f302b508 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -355,6 +355,25 @@ static const struct acpi_device_id i2c_acpi_force_400khz_device_ids[] = {
{}
};
+static const struct acpi_device_id i2c_acpi_force_100khz_device_ids[] = {
+ /*
+ * When a 400KHz freq is used on this model of ELAN touchpad in Linux,
+ * excessive smoothing (similar to when the touchpad's firmware detects
+ * a noisy signal) is sometimes applied. As some devices' (e.g, Lenovo
+ * V15 G4) ACPI tables specify a 400KHz frequency for this device and
+ * some I2C busses (e.g, Designware I2C) default to a 400KHz freq,
+ * force the speed to 100KHz as a workaround.
+ *
+ * For future investigation: This problem may be related to the default
+ * HCNT/LCNT values given by some busses' drivers, because they are not
+ * specified in the aforementioned devices' ACPI tables, and because
+ * the device works without issues on Windows at what is expected to be
+ * a 400KHz frequency. The root cause of the issue is not known.
+ */
+ { "ELAN06FA", 0 },
+ {}
+};
+
static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level,
void *data, void **return_value)
{
@@ -373,6 +392,9 @@ static acpi_status i2c_acpi_lookup_speed(acpi_handle handle, u32 level,
if (acpi_match_device_ids(adev, i2c_acpi_force_400khz_device_ids) == 0)
lookup->force_speed = I2C_MAX_FAST_MODE_FREQ;
+ if (acpi_match_device_ids(adev, i2c_acpi_force_100khz_device_ids) == 0)
+ lookup->force_speed = I2C_MAX_STANDARD_MODE_FREQ;
+
return AE_OK;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 074/443] APEI: GHES: Have GHES honor the panic= setting
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 073/443] i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz Greg Kroah-Hartman
@ 2025-02-13 14:23 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 075/443] Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x Greg Kroah-Hartman
` (379 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Feng Tang, Borislav Petkov (AMD),
Ira Weiny, Rafael J. Wysocki, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <bp@alien8.de>
[ Upstream commit 5c0e00a391dd0099fe95991bb2f962848d851916 ]
The GHES driver overrides the panic= setting by force-rebooting the
system after a fatal hw error has been reported. The intent being that
such an error would be reported earlier.
However, this is not optimal when a hard-to-debug issue requires long
time to reproduce and when that happens, the box will get rebooted after
30 seconds and thus destroy the whole hw context of when the error
happened.
So rip out the default GHES panic timeout and honor the global one.
In the panic disabled (panic=0) case, the error will still be logged to
dmesg for later inspection and if panic after a hw error is really
required, then that can be controlled the usual way - use panic= on the
cmdline or set it in the kernel .config's CONFIG_PANIC_TIMEOUT.
Reported-by: Feng Tang <feng.tang@linux.alibaba.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Feng Tang <feng.tang@linux.alibaba.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Link: https://patch.msgid.link/20250113125224.GFZ4UMiNtWIJvgpveU@fat_crate.local
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/ghes.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 07789f0b59bcd..b727724946556 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -173,8 +173,6 @@ static struct gen_pool *ghes_estatus_pool;
static struct ghes_estatus_cache __rcu *ghes_estatus_caches[GHES_ESTATUS_CACHES_SIZE];
static atomic_t ghes_estatus_cache_alloced;
-static int ghes_panic_timeout __read_mostly = 30;
-
static void __iomem *ghes_map(u64 pfn, enum fixed_addresses fixmap_idx)
{
phys_addr_t paddr;
@@ -983,14 +981,16 @@ static void __ghes_panic(struct ghes *ghes,
struct acpi_hest_generic_status *estatus,
u64 buf_paddr, enum fixed_addresses fixmap_idx)
{
+ const char *msg = GHES_PFX "Fatal hardware error";
+
__ghes_print_estatus(KERN_EMERG, ghes->generic, estatus);
ghes_clear_estatus(ghes, estatus, buf_paddr, fixmap_idx);
- /* reboot to log the error! */
if (!panic_timeout)
- panic_timeout = ghes_panic_timeout;
- panic("Fatal hardware error!");
+ pr_emerg("%s but panic disabled\n", msg);
+
+ panic(msg);
}
static int ghes_proc(struct ghes *ghes)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 075/443] Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2025-02-13 14:23 ` [PATCH 6.13 074/443] APEI: GHES: Have GHES honor the panic= setting Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 076/443] Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922 Greg Kroah-Hartman
` (378 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Dietzer, Luiz Augusto von Dentz,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Dietzer <git@doridian.net>
[ Upstream commit a6587d7ed2cd8341f8a92112ac772f2c44f09824 ]
Adds a new entry with VID 0x2c7c and PID 0x0130 to the btusb quirks table as it uses a Qualcomm WCN785x chipset
The device information from /sys/kernel/debug/usb/devices is provided below:
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=05 Dev#= 7 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0130 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
I: If#= 1 Alt= 7 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 65 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 65 Ivl=1ms
Signed-off-by: Mark Dietzer <git@doridian.net>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f69df515d668b..41132d02fd7d9 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -377,6 +377,8 @@ static const struct usb_device_id quirks_table[] = {
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x13d3, 0x3623), .driver_info = BTUSB_QCA_WCN6855 |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x2c7c, 0x0130), .driver_info = BTUSB_QCA_WCN6855 |
+ BTUSB_WIDEBAND_SPEECH },
/* Broadcom BCM2035 */
{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 076/443] Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 075/443] Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 077/443] Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925 Greg Kroah-Hartman
` (377 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Halaney,
Luiz Augusto von Dentz, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Halaney <ajhalaney@gmail.com>
[ Upstream commit 45e7d389bf2e52dfc893779c611dd5cff461b590 ]
A new machine has a Archer AX3000 / TX55e in it,
and out the box reported issues resetting hci0. It looks like
this is a MT7922 from the lspci output, so treat it as a MediaTek
device and use the proper callbacks. With that in place an xbox
controller can be used without issue as seen below:
[ 7.047388] Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20241106163512
[ 9.583883] Bluetooth: hci0: Device setup in 2582842 usecs
[ 9.583895] Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
[ 9.644780] Bluetooth: hci0: AOSP extensions version v1.00
[ 9.644784] Bluetooth: hci0: AOSP quality report is supported
[ 876.379876] input: Xbox Wireless Controller as /devices/virtual/misc/uhid/0005:045E:0B13.0006/input/input27
[ 876.380215] hid-generic 0005:045E:0B13.0006: input,hidraw3: BLUETOOTH HID v5.15 Gamepad [Xbox Wireless Controller] on c0:bf:be:27:de:f7
[ 876.429368] input: Xbox Wireless Controller as /devices/virtual/misc/uhid/0005:045E:0B13.0006/input/input28
[ 876.429423] microsoft 0005:045E:0B13.0006: input,hidraw3: BLUETOOTH HID v5.15 Gamepad [Xbox Wireless Controller] on c0:bf:be:27:de:f7
lspci output:
root@livingroom:/home/ajhalaney/git# lspci
...
05:00.0 Network controller: MEDIATEK Corp. MT7922 802.11ax PCI Express Wireless Network Adapter
and USB device:
root@livingroom:/home/ajhalaney/git# cat /sys/kernel/debug/usb/devices
...
T: Bus=01 Lev=01 Prnt=01 Port=10 Cnt=03 Dev#= 4 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3610 Rev= 1.00
S: Manufacturer=MediaTek Inc.
S: Product=Wireless_Device
S: SerialNumber=000000000
C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
Signed-off-by: Andrew Halaney <ajhalaney@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 41132d02fd7d9..744c34a5e4774 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -612,6 +612,8 @@ static const struct usb_device_id quirks_table[] = {
/* MediaTek MT7922 Bluetooth devices */
{ USB_DEVICE(0x13d3, 0x3585), .driver_info = BTUSB_MEDIATEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3610), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
/* MediaTek MT7922A Bluetooth devices */
{ USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK |
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 077/443] Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 076/443] Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922 Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 078/443] Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync Greg Kroah-Hartman
` (376 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, En-Wei Wu, Luiz Augusto von Dentz,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: En-Wei Wu <en-wei.wu@canonical.com>
[ Upstream commit f63f401130e5c5cd0dd2f18c9df967ab75cd4732 ]
Add VID 13d3 & PID 3628 for MediaTek MT7925 USB Bluetooth chip.
The information in /sys/kernel/debug/usb/devices about the Bluetooth
device is listed as the below.
T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#= 4 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=13d3 ProdID=3628 Rev= 1.00
S: Manufacturer=MediaTek Inc.
S: Product=Wireless_Device
S: SerialNumber=000000000
C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us
E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us
I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
Signed-off-by: En-Wei Wu <en-wei.wu@canonical.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 744c34a5e4774..72e85673b7095 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -678,6 +678,8 @@ static const struct usb_device_id quirks_table[] = {
BTUSB_WIDEBAND_SPEECH },
{ USB_DEVICE(0x13d3, 0x3608), .driver_info = BTUSB_MEDIATEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x13d3, 0x3628), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH },
/* Additional Realtek 8723AE Bluetooth devices */
{ USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 078/443] Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 077/443] Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925 Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 079/443] net: wwan: iosm: Fix hibernation by re-binding the driver around it Greg Kroah-Hartman
` (375 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+479aff51bb361ef5aa18,
Mazin Al Haddad, Luiz Augusto von Dentz, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mazin Al Haddad <mazin@getstate.dev>
[ Upstream commit 26fbd3494a7dd26269cb0817c289267dbcfdec06 ]
This fixes the following crash:
==================================================================
BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543
Read of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961
CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x169/0x550 mm/kasan/report.c:489
kasan_report+0x143/0x180 mm/kasan/report.c:602
mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543
hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Allocated by task 16026:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314
kmalloc_noprof include/linux/slab.h:901 [inline]
kzalloc_noprof include/linux/slab.h:1037 [inline]
mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568
hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:711 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:726
sock_write_iter+0x2d7/0x3f0 net/socket.c:1147
new_sync_write fs/read_write.c:586 [inline]
vfs_write+0xaeb/0xd30 fs/read_write.c:679
ksys_write+0x18f/0x2b0 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 16022:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2338 [inline]
slab_free mm/slub.c:4598 [inline]
kfree+0x196/0x420 mm/slub.c:4746
mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
__mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550
hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208
hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
sock_do_ioctl+0x158/0x460 net/socket.c:1209
sock_ioctl+0x626/0x8e0 net/socket.c:1328
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: syzbot+479aff51bb361ef5aa18@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=479aff51bb361ef5aa18
Tested-by: syzbot+479aff51bb361ef5aa18@syzkaller.appspotmail.com
Signed-off-by: Mazin Al Haddad <mazin@getstate.dev>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index de47ad999d7b6..71dda10f6a24f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5519,10 +5519,16 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
{
struct mgmt_rp_remove_adv_monitor rp;
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
+ struct mgmt_cp_remove_adv_monitor *cp;
+
+ if (status == -ECANCELED ||
+ cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev))
+ return;
hci_dev_lock(hdev);
+ cp = cmd->param;
+
rp.monitor_handle = cp->monitor_handle;
if (!status)
@@ -5540,6 +5546,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
+
+ if (cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev))
+ return -ECANCELED;
+
struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
u16 handle = __le16_to_cpu(cp->monitor_handle);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 079/443] net: wwan: iosm: Fix hibernation by re-binding the driver around it
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 078/443] Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 080/443] HID: hid-asus: Disable OOBE mode on the ProArt P16 Greg Kroah-Hartman
` (374 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Ryazanov, Maciej S. Szmigiero,
Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
[ Upstream commit 0b6f6593aa8c3a05f155c12fd0e7ad33a5149c31 ]
Currently, the driver is seriously broken with respect to the
hibernation (S4): after image restore the device is back into
IPC_MEM_EXEC_STAGE_BOOT (which AFAIK means bootloader stage) and needs
full re-launch of the rest of its firmware, but the driver restore
handler treats the device as merely sleeping and just sends it a
wake-up command.
This wake-up command times out but device nodes (/dev/wwan*) remain
accessible.
However attempting to use them causes the bootloader to crash and
enter IPC_MEM_EXEC_STAGE_CD_READY stage (which apparently means "a crash
dump is ready").
It seems that the device cannot be re-initialized from this crashed
stage without toggling some reset pin (on my test platform that's
apparently what the device _RST ACPI method does).
While it would theoretically be possible to rewrite the driver to tear
down the whole MUX / IPC layers on hibernation (so the bootloader does
not crash from improper access) and then re-launch the device on
restore this would require significant refactoring of the driver
(believe me, I've tried), since there are quite a few assumptions
hard-coded in the driver about the device never being partially
de-initialized (like channels other than devlink cannot be closed,
for example).
Probably this would also need some programming guide for this hardware.
Considering that the driver seems orphaned [1] and other people are
hitting this issue too [2] fix it by simply unbinding the PCI driver
before hibernation and re-binding it after restore, much like
USB_QUIRK_RESET_RESUME does for USB devices that exhibit a similar
problem.
Tested on XMM7360 in HP EliteBook 855 G7 both with s2idle (which uses
the existing suspend / resume handlers) and S4 (which uses the new code).
[1]: https://lore.kernel.org/all/c248f0b4-2114-4c61-905f-466a786bdebb@leemhuis.info/
[2]:
https://github.com/xmm7360/xmm7360-pci/issues/211#issuecomment-1804139413
Reviewed-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Link: https://patch.msgid.link/e60287ebdb0ab54c4075071b72568a40a75d0205.1736372610.git.mail@maciej.szmigiero.name
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wwan/iosm/iosm_ipc_pcie.c | 56 ++++++++++++++++++++++++++-
1 file changed, 55 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wwan/iosm/iosm_ipc_pcie.c b/drivers/net/wwan/iosm/iosm_ipc_pcie.c
index 04517bd3325a2..a066977af0be5 100644
--- a/drivers/net/wwan/iosm/iosm_ipc_pcie.c
+++ b/drivers/net/wwan/iosm/iosm_ipc_pcie.c
@@ -6,6 +6,7 @@
#include <linux/acpi.h>
#include <linux/bitfield.h>
#include <linux/module.h>
+#include <linux/suspend.h>
#include <net/rtnetlink.h>
#include "iosm_ipc_imem.h"
@@ -18,6 +19,7 @@ MODULE_LICENSE("GPL v2");
/* WWAN GUID */
static guid_t wwan_acpi_guid = GUID_INIT(0xbad01b75, 0x22a8, 0x4f48, 0x87, 0x92,
0xbd, 0xde, 0x94, 0x67, 0x74, 0x7d);
+static bool pci_registered;
static void ipc_pcie_resources_release(struct iosm_pcie *ipc_pcie)
{
@@ -448,7 +450,6 @@ static struct pci_driver iosm_ipc_driver = {
},
.id_table = iosm_ipc_ids,
};
-module_pci_driver(iosm_ipc_driver);
int ipc_pcie_addr_map(struct iosm_pcie *ipc_pcie, unsigned char *data,
size_t size, dma_addr_t *mapping, int direction)
@@ -530,3 +531,56 @@ void ipc_pcie_kfree_skb(struct iosm_pcie *ipc_pcie, struct sk_buff *skb)
IPC_CB(skb)->mapping = 0;
dev_kfree_skb(skb);
}
+
+static int pm_notify(struct notifier_block *nb, unsigned long mode, void *_unused)
+{
+ if (mode == PM_HIBERNATION_PREPARE || mode == PM_RESTORE_PREPARE) {
+ if (pci_registered) {
+ pci_unregister_driver(&iosm_ipc_driver);
+ pci_registered = false;
+ }
+ } else if (mode == PM_POST_HIBERNATION || mode == PM_POST_RESTORE) {
+ if (!pci_registered) {
+ int ret;
+
+ ret = pci_register_driver(&iosm_ipc_driver);
+ if (ret) {
+ pr_err(KBUILD_MODNAME ": unable to re-register PCI driver: %d\n",
+ ret);
+ } else {
+ pci_registered = true;
+ }
+ }
+ }
+
+ return 0;
+}
+
+static struct notifier_block pm_notifier = {
+ .notifier_call = pm_notify,
+};
+
+static int __init iosm_ipc_driver_init(void)
+{
+ int ret;
+
+ ret = pci_register_driver(&iosm_ipc_driver);
+ if (ret)
+ return ret;
+
+ pci_registered = true;
+
+ register_pm_notifier(&pm_notifier);
+
+ return 0;
+}
+module_init(iosm_ipc_driver_init);
+
+static void __exit iosm_ipc_driver_exit(void)
+{
+ unregister_pm_notifier(&pm_notifier);
+
+ if (pci_registered)
+ pci_unregister_driver(&iosm_ipc_driver);
+}
+module_exit(iosm_ipc_driver_exit);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 080/443] HID: hid-asus: Disable OOBE mode on the ProArt P16
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 079/443] net: wwan: iosm: Fix hibernation by re-binding the driver around it Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 081/443] mmc: sdhci-msm: Correctly set the load for the regulator Greg Kroah-Hartman
` (373 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luke D. Jones, Connor Belli,
Jan Schmidt, Jiri Kosina, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke D. Jones <luke@ljones.dev>
[ Upstream commit 53078a736fbc60e5d3a1e14f4cd4214003815026 ]
The new ASUS ProArt 16" laptop series come with their keyboards stuck in
an Out-Of-Box-Experience mode. While in this mode most functions will
not work such as LED control or Fn key combos. The correct init sequence
is now done to disable this OOBE.
This patch addresses only the ProArt series so far and it is unknown if
there may be others, in which case a new quirk may be required.
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Co-developed-by: Connor Belli <connorbelli2003@gmail.com>
Signed-off-by: Connor Belli <connorbelli2003@gmail.com>
Tested-by: Jan Schmidt <jan@centricular.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-asus.c | 26 ++++++++++++++++++++++
include/linux/platform_data/x86/asus-wmi.h | 5 +++++
2 files changed, 31 insertions(+)
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
index 506c6f377e7d6..46e3e42f9eb5f 100644
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -432,6 +432,26 @@ static int asus_kbd_get_functions(struct hid_device *hdev,
return ret;
}
+static int asus_kbd_disable_oobe(struct hid_device *hdev)
+{
+ const u8 init[][6] = {
+ { FEATURE_KBD_REPORT_ID, 0x05, 0x20, 0x31, 0x00, 0x08 },
+ { FEATURE_KBD_REPORT_ID, 0xBA, 0xC5, 0xC4 },
+ { FEATURE_KBD_REPORT_ID, 0xD0, 0x8F, 0x01 },
+ { FEATURE_KBD_REPORT_ID, 0xD0, 0x85, 0xFF }
+ };
+ int ret;
+
+ for (size_t i = 0; i < ARRAY_SIZE(init); i++) {
+ ret = asus_kbd_set_report(hdev, init[i], sizeof(init[i]));
+ if (ret < 0)
+ return ret;
+ }
+
+ hid_info(hdev, "Disabled OOBE for keyboard\n");
+ return 0;
+}
+
static void asus_schedule_work(struct asus_kbd_leds *led)
{
unsigned long flags;
@@ -534,6 +554,12 @@ static int asus_kbd_register_leds(struct hid_device *hdev)
ret = asus_kbd_init(hdev, FEATURE_KBD_LED_REPORT_ID2);
if (ret < 0)
return ret;
+
+ if (dmi_match(DMI_PRODUCT_FAMILY, "ProArt P16")) {
+ ret = asus_kbd_disable_oobe(hdev);
+ if (ret < 0)
+ return ret;
+ }
} else {
/* Initialize keyboard */
ret = asus_kbd_init(hdev, FEATURE_KBD_REPORT_ID);
diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h
index 365e119bebaa2..783e2a336861b 100644
--- a/include/linux/platform_data/x86/asus-wmi.h
+++ b/include/linux/platform_data/x86/asus-wmi.h
@@ -184,6 +184,11 @@ static const struct dmi_system_id asus_use_hid_led_dmi_ids[] = {
DMI_MATCH(DMI_PRODUCT_FAMILY, "ROG Flow"),
},
},
+ {
+ .matches = {
+ DMI_MATCH(DMI_PRODUCT_FAMILY, "ProArt P16"),
+ },
+ },
{
.matches = {
DMI_MATCH(DMI_BOARD_NAME, "GA403U"),
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 081/443] mmc: sdhci-msm: Correctly set the load for the regulator
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 080/443] HID: hid-asus: Disable OOBE mode on the ProArt P16 Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 082/443] octeon_ep: update tx/rx stats locally for persistence Greg Kroah-Hartman
` (372 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanjie Yang, Dmitry Baryshkov,
Ulf Hansson, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjie Yang <quic_yuanjiey@quicinc.com>
[ Upstream commit 20a0c37e44063997391430c4ae09973e9cbc3911 ]
Qualcomm regulator supports two power supply modes: HPM and LPM.
Currently, the sdhci-msm.c driver does not set the load to adjust
the current for eMMC and SD. If the regulator dont't set correct
load in LPM state, it will lead to the inability to properly
initialize eMMC and SD.
Set the correct regulator current for eMMC and SD to ensure that the
device can work normally even when the regulator is in LPM.
Signed-off-by: Yuanjie Yang <quic_yuanjiey@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20250114083514.258379-1-quic_yuanjiey@quicinc.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/sdhci-msm.c | 53 ++++++++++++++++++++++++++++++++++--
1 file changed, 51 insertions(+), 2 deletions(-)
diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
index 319f0ebbe652d..1fcaaf683d68c 100644
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -134,9 +134,18 @@
/* Timeout value to avoid infinite waiting for pwr_irq */
#define MSM_PWR_IRQ_TIMEOUT_MS 5000
+/* Max load for eMMC Vdd supply */
+#define MMC_VMMC_MAX_LOAD_UA 570000
+
/* Max load for eMMC Vdd-io supply */
#define MMC_VQMMC_MAX_LOAD_UA 325000
+/* Max load for SD Vdd supply */
+#define SD_VMMC_MAX_LOAD_UA 800000
+
+/* Max load for SD Vdd-io supply */
+#define SD_VQMMC_MAX_LOAD_UA 22000
+
#define msm_host_readl(msm_host, host, offset) \
msm_host->var_ops->msm_readl_relaxed(host, offset)
@@ -1403,11 +1412,48 @@ static int sdhci_msm_set_pincfg(struct sdhci_msm_host *msm_host, bool level)
return ret;
}
-static int sdhci_msm_set_vmmc(struct mmc_host *mmc)
+static void msm_config_vmmc_regulator(struct mmc_host *mmc, bool hpm)
+{
+ int load;
+
+ if (!hpm)
+ load = 0;
+ else if (!mmc->card)
+ load = max(MMC_VMMC_MAX_LOAD_UA, SD_VMMC_MAX_LOAD_UA);
+ else if (mmc_card_mmc(mmc->card))
+ load = MMC_VMMC_MAX_LOAD_UA;
+ else if (mmc_card_sd(mmc->card))
+ load = SD_VMMC_MAX_LOAD_UA;
+ else
+ return;
+
+ regulator_set_load(mmc->supply.vmmc, load);
+}
+
+static void msm_config_vqmmc_regulator(struct mmc_host *mmc, bool hpm)
+{
+ int load;
+
+ if (!hpm)
+ load = 0;
+ else if (!mmc->card)
+ load = max(MMC_VQMMC_MAX_LOAD_UA, SD_VQMMC_MAX_LOAD_UA);
+ else if (mmc_card_sd(mmc->card))
+ load = SD_VQMMC_MAX_LOAD_UA;
+ else
+ return;
+
+ regulator_set_load(mmc->supply.vqmmc, load);
+}
+
+static int sdhci_msm_set_vmmc(struct sdhci_msm_host *msm_host,
+ struct mmc_host *mmc, bool hpm)
{
if (IS_ERR(mmc->supply.vmmc))
return 0;
+ msm_config_vmmc_regulator(mmc, hpm);
+
return mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, mmc->ios.vdd);
}
@@ -1420,6 +1466,8 @@ static int msm_toggle_vqmmc(struct sdhci_msm_host *msm_host,
if (msm_host->vqmmc_enabled == level)
return 0;
+ msm_config_vqmmc_regulator(mmc, level);
+
if (level) {
/* Set the IO voltage regulator to default voltage level */
if (msm_host->caps_0 & CORE_3_0V_SUPPORT)
@@ -1642,7 +1690,8 @@ static void sdhci_msm_handle_pwr_irq(struct sdhci_host *host, int irq)
}
if (pwr_state) {
- ret = sdhci_msm_set_vmmc(mmc);
+ ret = sdhci_msm_set_vmmc(msm_host, mmc,
+ pwr_state & REQ_BUS_ON);
if (!ret)
ret = sdhci_msm_set_vqmmc(msm_host, mmc,
pwr_state & REQ_BUS_ON);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 082/443] octeon_ep: update tx/rx stats locally for persistence
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 081/443] mmc: sdhci-msm: Correctly set the load for the regulator Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 083/443] octeon_ep_vf: " Greg Kroah-Hartman
` (371 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinas Rasheed, Jakub Kicinski,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shinas Rasheed <srasheed@marvell.com>
[ Upstream commit 10fad79846e49f67ad1a0a05910837125c6ca9ad ]
Update tx/rx stats locally, so that ndo_get_stats64()
can use that and not rely on per queue resources to obtain statistics.
The latter used to cause race conditions when the device stopped.
Signed-off-by: Shinas Rasheed <srasheed@marvell.com>
Link: https://patch.msgid.link/20250117094653.2588578-3-srasheed@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../marvell/octeon_ep/octep_ethtool.c | 41 ++++++++-----------
.../ethernet/marvell/octeon_ep/octep_main.c | 19 ++++-----
.../ethernet/marvell/octeon_ep/octep_main.h | 6 +++
.../net/ethernet/marvell/octeon_ep/octep_rx.c | 11 ++---
.../net/ethernet/marvell/octeon_ep/octep_rx.h | 4 +-
.../net/ethernet/marvell/octeon_ep/octep_tx.c | 7 ++--
.../net/ethernet/marvell/octeon_ep/octep_tx.h | 4 +-
7 files changed, 45 insertions(+), 47 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_ethtool.c b/drivers/net/ethernet/marvell/octeon_ep/octep_ethtool.c
index 4f4d581891188..a88c006ea65b7 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_ethtool.c
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_ethtool.c
@@ -150,17 +150,14 @@ octep_get_ethtool_stats(struct net_device *netdev,
iface_rx_stats,
iface_tx_stats);
- for (q = 0; q < oct->num_oqs; q++) {
- struct octep_iq *iq = oct->iq[q];
- struct octep_oq *oq = oct->oq[q];
-
- tx_packets += iq->stats.instr_completed;
- tx_bytes += iq->stats.bytes_sent;
- tx_busy_errors += iq->stats.tx_busy;
-
- rx_packets += oq->stats.packets;
- rx_bytes += oq->stats.bytes;
- rx_alloc_errors += oq->stats.alloc_failures;
+ for (q = 0; q < OCTEP_MAX_QUEUES; q++) {
+ tx_packets += oct->stats_iq[q].instr_completed;
+ tx_bytes += oct->stats_iq[q].bytes_sent;
+ tx_busy_errors += oct->stats_iq[q].tx_busy;
+
+ rx_packets += oct->stats_oq[q].packets;
+ rx_bytes += oct->stats_oq[q].bytes;
+ rx_alloc_errors += oct->stats_oq[q].alloc_failures;
}
i = 0;
data[i++] = rx_packets;
@@ -198,22 +195,18 @@ octep_get_ethtool_stats(struct net_device *netdev,
data[i++] = iface_rx_stats->err_pkts;
/* Per Tx Queue stats */
- for (q = 0; q < oct->num_iqs; q++) {
- struct octep_iq *iq = oct->iq[q];
-
- data[i++] = iq->stats.instr_posted;
- data[i++] = iq->stats.instr_completed;
- data[i++] = iq->stats.bytes_sent;
- data[i++] = iq->stats.tx_busy;
+ for (q = 0; q < OCTEP_MAX_QUEUES; q++) {
+ data[i++] = oct->stats_iq[q].instr_posted;
+ data[i++] = oct->stats_iq[q].instr_completed;
+ data[i++] = oct->stats_iq[q].bytes_sent;
+ data[i++] = oct->stats_iq[q].tx_busy;
}
/* Per Rx Queue stats */
- for (q = 0; q < oct->num_oqs; q++) {
- struct octep_oq *oq = oct->oq[q];
-
- data[i++] = oq->stats.packets;
- data[i++] = oq->stats.bytes;
- data[i++] = oq->stats.alloc_failures;
+ for (q = 0; q < OCTEP_MAX_QUEUES; q++) {
+ data[i++] = oct->stats_oq[q].packets;
+ data[i++] = oct->stats_oq[q].bytes;
+ data[i++] = oct->stats_oq[q].alloc_failures;
}
}
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
index 730aa5632ccee..a89f80bac39b8 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c
@@ -822,7 +822,7 @@ static inline int octep_iq_full_check(struct octep_iq *iq)
if (unlikely(IQ_INSTR_SPACE(iq) >
OCTEP_WAKE_QUEUE_THRESHOLD)) {
netif_start_subqueue(iq->netdev, iq->q_no);
- iq->stats.restart_cnt++;
+ iq->stats->restart_cnt++;
return 0;
}
@@ -960,7 +960,7 @@ static netdev_tx_t octep_start_xmit(struct sk_buff *skb,
wmb();
/* Ring Doorbell to notify the NIC of new packets */
writel(iq->fill_cnt, iq->doorbell_reg);
- iq->stats.instr_posted += iq->fill_cnt;
+ iq->stats->instr_posted += iq->fill_cnt;
iq->fill_cnt = 0;
return NETDEV_TX_OK;
@@ -991,22 +991,19 @@ static netdev_tx_t octep_start_xmit(struct sk_buff *skb,
static void octep_get_stats64(struct net_device *netdev,
struct rtnl_link_stats64 *stats)
{
- u64 tx_packets, tx_bytes, rx_packets, rx_bytes;
struct octep_device *oct = netdev_priv(netdev);
+ u64 tx_packets, tx_bytes, rx_packets, rx_bytes;
int q;
tx_packets = 0;
tx_bytes = 0;
rx_packets = 0;
rx_bytes = 0;
- for (q = 0; q < oct->num_oqs; q++) {
- struct octep_iq *iq = oct->iq[q];
- struct octep_oq *oq = oct->oq[q];
-
- tx_packets += iq->stats.instr_completed;
- tx_bytes += iq->stats.bytes_sent;
- rx_packets += oq->stats.packets;
- rx_bytes += oq->stats.bytes;
+ for (q = 0; q < OCTEP_MAX_QUEUES; q++) {
+ tx_packets += oct->stats_iq[q].instr_completed;
+ tx_bytes += oct->stats_iq[q].bytes_sent;
+ rx_packets += oct->stats_oq[q].packets;
+ rx_bytes += oct->stats_oq[q].bytes;
}
stats->tx_packets = tx_packets;
stats->tx_bytes = tx_bytes;
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.h b/drivers/net/ethernet/marvell/octeon_ep/octep_main.h
index fee59e0e0138f..936b786f42816 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.h
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.h
@@ -257,11 +257,17 @@ struct octep_device {
/* Pointers to Octeon Tx queues */
struct octep_iq *iq[OCTEP_MAX_IQ];
+ /* Per iq stats */
+ struct octep_iq_stats stats_iq[OCTEP_MAX_IQ];
+
/* Rx queues (OQ: Output Queue) */
u16 num_oqs;
/* Pointers to Octeon Rx queues */
struct octep_oq *oq[OCTEP_MAX_OQ];
+ /* Per oq stats */
+ struct octep_oq_stats stats_oq[OCTEP_MAX_OQ];
+
/* Hardware port number of the PCIe interface */
u16 pcie_port;
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
index 8af75cb37c3ee..82b6b19e76b47 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.c
@@ -87,7 +87,7 @@ static int octep_oq_refill(struct octep_device *oct, struct octep_oq *oq)
page = dev_alloc_page();
if (unlikely(!page)) {
dev_err(oq->dev, "refill: rx buffer alloc failed\n");
- oq->stats.alloc_failures++;
+ oq->stats->alloc_failures++;
break;
}
@@ -98,7 +98,7 @@ static int octep_oq_refill(struct octep_device *oct, struct octep_oq *oq)
"OQ-%d buffer refill: DMA mapping error!\n",
oq->q_no);
put_page(page);
- oq->stats.alloc_failures++;
+ oq->stats->alloc_failures++;
break;
}
oq->buff_info[refill_idx].page = page;
@@ -134,6 +134,7 @@ static int octep_setup_oq(struct octep_device *oct, int q_no)
oq->netdev = oct->netdev;
oq->dev = &oct->pdev->dev;
oq->q_no = q_no;
+ oq->stats = &oct->stats_oq[q_no];
oq->max_count = CFG_GET_OQ_NUM_DESC(oct->conf);
oq->ring_size_mask = oq->max_count - 1;
oq->buffer_size = CFG_GET_OQ_BUF_SIZE(oct->conf);
@@ -443,7 +444,7 @@ static int __octep_oq_process_rx(struct octep_device *oct,
if (!skb) {
octep_oq_drop_rx(oq, buff_info,
&read_idx, &desc_used);
- oq->stats.alloc_failures++;
+ oq->stats->alloc_failures++;
continue;
}
skb_reserve(skb, data_offset);
@@ -494,8 +495,8 @@ static int __octep_oq_process_rx(struct octep_device *oct,
oq->host_read_idx = read_idx;
oq->refill_count += desc_used;
- oq->stats.packets += pkt;
- oq->stats.bytes += rx_bytes;
+ oq->stats->packets += pkt;
+ oq->stats->bytes += rx_bytes;
return pkt;
}
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.h b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.h
index 3b08e2d560dc3..b4696c93d0e6a 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_rx.h
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_rx.h
@@ -186,8 +186,8 @@ struct octep_oq {
*/
u8 __iomem *pkts_sent_reg;
- /* Statistics for this OQ. */
- struct octep_oq_stats stats;
+ /* Pointer to statistics for this OQ. */
+ struct octep_oq_stats *stats;
/* Packets pending to be processed */
u32 pkts_pending;
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_tx.c b/drivers/net/ethernet/marvell/octeon_ep/octep_tx.c
index 06851b78aa28c..08ee90013fef3 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_tx.c
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_tx.c
@@ -81,9 +81,9 @@ int octep_iq_process_completions(struct octep_iq *iq, u16 budget)
}
iq->pkts_processed += compl_pkts;
- iq->stats.instr_completed += compl_pkts;
- iq->stats.bytes_sent += compl_bytes;
- iq->stats.sgentry_sent += compl_sg;
+ iq->stats->instr_completed += compl_pkts;
+ iq->stats->bytes_sent += compl_bytes;
+ iq->stats->sgentry_sent += compl_sg;
iq->flush_index = fi;
netdev_tx_completed_queue(iq->netdev_q, compl_pkts, compl_bytes);
@@ -187,6 +187,7 @@ static int octep_setup_iq(struct octep_device *oct, int q_no)
iq->netdev = oct->netdev;
iq->dev = &oct->pdev->dev;
iq->q_no = q_no;
+ iq->stats = &oct->stats_iq[q_no];
iq->max_count = CFG_GET_IQ_NUM_DESC(oct->conf);
iq->ring_size_mask = iq->max_count - 1;
iq->fill_threshold = CFG_GET_IQ_DB_MIN(oct->conf);
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_tx.h b/drivers/net/ethernet/marvell/octeon_ep/octep_tx.h
index 875a2c34091ff..58fb39dda977c 100644
--- a/drivers/net/ethernet/marvell/octeon_ep/octep_tx.h
+++ b/drivers/net/ethernet/marvell/octeon_ep/octep_tx.h
@@ -170,8 +170,8 @@ struct octep_iq {
*/
u16 flush_index;
- /* Statistics for this input queue. */
- struct octep_iq_stats stats;
+ /* Pointer to statistics for this input queue. */
+ struct octep_iq_stats *stats;
/* Pointer to the Virtual Base addr of the input ring. */
struct octep_tx_desc_hw *desc_ring;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 083/443] octeon_ep_vf: update tx/rx stats locally for persistence
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 082/443] octeon_ep: update tx/rx stats locally for persistence Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 084/443] tipc: re-order conditions in tipc_crypto_key_rcv() Greg Kroah-Hartman
` (370 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinas Rasheed, Jakub Kicinski,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shinas Rasheed <srasheed@marvell.com>
[ Upstream commit f84039939512e6d88b0f2f353695530f123be789 ]
Update tx/rx stats locally, so that ndo_get_stats64()
can use that and not rely on per queue resources to obtain statistics.
The latter used to cause race conditions when the device stopped.
Signed-off-by: Shinas Rasheed <srasheed@marvell.com>
Link: https://patch.msgid.link/20250117094653.2588578-5-srasheed@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../marvell/octeon_ep_vf/octep_vf_ethtool.c | 29 +++++++------------
.../marvell/octeon_ep_vf/octep_vf_main.c | 17 +++++------
.../marvell/octeon_ep_vf/octep_vf_main.h | 6 ++++
.../marvell/octeon_ep_vf/octep_vf_rx.c | 9 +++---
.../marvell/octeon_ep_vf/octep_vf_rx.h | 2 +-
.../marvell/octeon_ep_vf/octep_vf_tx.c | 7 +++--
.../marvell/octeon_ep_vf/octep_vf_tx.h | 2 +-
7 files changed, 35 insertions(+), 37 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_ethtool.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_ethtool.c
index 7b21439a315f2..d60441928ba96 100644
--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_ethtool.c
+++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_ethtool.c
@@ -114,12 +114,9 @@ static void octep_vf_get_ethtool_stats(struct net_device *netdev,
iface_tx_stats = &oct->iface_tx_stats;
iface_rx_stats = &oct->iface_rx_stats;
- for (q = 0; q < oct->num_oqs; q++) {
- struct octep_vf_iq *iq = oct->iq[q];
- struct octep_vf_oq *oq = oct->oq[q];
-
- tx_busy_errors += iq->stats.tx_busy;
- rx_alloc_errors += oq->stats.alloc_failures;
+ for (q = 0; q < OCTEP_VF_MAX_QUEUES; q++) {
+ tx_busy_errors += oct->stats_iq[q].tx_busy;
+ rx_alloc_errors += oct->stats_oq[q].alloc_failures;
}
i = 0;
data[i++] = rx_alloc_errors;
@@ -134,22 +131,18 @@ static void octep_vf_get_ethtool_stats(struct net_device *netdev,
data[i++] = iface_rx_stats->dropped_octets_fifo_full;
/* Per Tx Queue stats */
- for (q = 0; q < oct->num_iqs; q++) {
- struct octep_vf_iq *iq = oct->iq[q];
-
- data[i++] = iq->stats.instr_posted;
- data[i++] = iq->stats.instr_completed;
- data[i++] = iq->stats.bytes_sent;
- data[i++] = iq->stats.tx_busy;
+ for (q = 0; q < OCTEP_VF_MAX_QUEUES; q++) {
+ data[i++] = oct->stats_iq[q].instr_posted;
+ data[i++] = oct->stats_iq[q].instr_completed;
+ data[i++] = oct->stats_iq[q].bytes_sent;
+ data[i++] = oct->stats_iq[q].tx_busy;
}
/* Per Rx Queue stats */
for (q = 0; q < oct->num_oqs; q++) {
- struct octep_vf_oq *oq = oct->oq[q];
-
- data[i++] = oq->stats.packets;
- data[i++] = oq->stats.bytes;
- data[i++] = oq->stats.alloc_failures;
+ data[i++] = oct->stats_oq[q].packets;
+ data[i++] = oct->stats_oq[q].bytes;
+ data[i++] = oct->stats_oq[q].alloc_failures;
}
}
diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c
index 4c699514fd57a..18c922dd5fc64 100644
--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c
+++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c
@@ -574,7 +574,7 @@ static int octep_vf_iq_full_check(struct octep_vf_iq *iq)
* caused queues to get re-enabled after
* being stopped
*/
- iq->stats.restart_cnt++;
+ iq->stats->restart_cnt++;
fallthrough;
case 1: /* Queue left enabled, since IQ is not yet full*/
return 0;
@@ -731,7 +731,7 @@ static netdev_tx_t octep_vf_start_xmit(struct sk_buff *skb,
/* Flush the hw descriptors before writing to doorbell */
smp_wmb();
writel(iq->fill_cnt, iq->doorbell_reg);
- iq->stats.instr_posted += iq->fill_cnt;
+ iq->stats->instr_posted += iq->fill_cnt;
iq->fill_cnt = 0;
return NETDEV_TX_OK;
}
@@ -786,14 +786,11 @@ static void octep_vf_get_stats64(struct net_device *netdev,
tx_bytes = 0;
rx_packets = 0;
rx_bytes = 0;
- for (q = 0; q < oct->num_oqs; q++) {
- struct octep_vf_iq *iq = oct->iq[q];
- struct octep_vf_oq *oq = oct->oq[q];
-
- tx_packets += iq->stats.instr_completed;
- tx_bytes += iq->stats.bytes_sent;
- rx_packets += oq->stats.packets;
- rx_bytes += oq->stats.bytes;
+ for (q = 0; q < OCTEP_VF_MAX_QUEUES; q++) {
+ tx_packets += oct->stats_iq[q].instr_completed;
+ tx_bytes += oct->stats_iq[q].bytes_sent;
+ rx_packets += oct->stats_oq[q].packets;
+ rx_bytes += oct->stats_oq[q].bytes;
}
stats->tx_packets = tx_packets;
stats->tx_bytes = tx_bytes;
diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.h b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.h
index 5769f62545cd4..1a352f41f823c 100644
--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.h
+++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.h
@@ -246,11 +246,17 @@ struct octep_vf_device {
/* Pointers to Octeon Tx queues */
struct octep_vf_iq *iq[OCTEP_VF_MAX_IQ];
+ /* Per iq stats */
+ struct octep_vf_iq_stats stats_iq[OCTEP_VF_MAX_IQ];
+
/* Rx queues (OQ: Output Queue) */
u16 num_oqs;
/* Pointers to Octeon Rx queues */
struct octep_vf_oq *oq[OCTEP_VF_MAX_OQ];
+ /* Per oq stats */
+ struct octep_vf_oq_stats stats_oq[OCTEP_VF_MAX_OQ];
+
/* Hardware port number of the PCIe interface */
u16 pcie_port;
diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c
index 82821bc28634b..d70c8be3cfc40 100644
--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c
+++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.c
@@ -87,7 +87,7 @@ static int octep_vf_oq_refill(struct octep_vf_device *oct, struct octep_vf_oq *o
page = dev_alloc_page();
if (unlikely(!page)) {
dev_err(oq->dev, "refill: rx buffer alloc failed\n");
- oq->stats.alloc_failures++;
+ oq->stats->alloc_failures++;
break;
}
@@ -98,7 +98,7 @@ static int octep_vf_oq_refill(struct octep_vf_device *oct, struct octep_vf_oq *o
"OQ-%d buffer refill: DMA mapping error!\n",
oq->q_no);
put_page(page);
- oq->stats.alloc_failures++;
+ oq->stats->alloc_failures++;
break;
}
oq->buff_info[refill_idx].page = page;
@@ -134,6 +134,7 @@ static int octep_vf_setup_oq(struct octep_vf_device *oct, int q_no)
oq->netdev = oct->netdev;
oq->dev = &oct->pdev->dev;
oq->q_no = q_no;
+ oq->stats = &oct->stats_oq[q_no];
oq->max_count = CFG_GET_OQ_NUM_DESC(oct->conf);
oq->ring_size_mask = oq->max_count - 1;
oq->buffer_size = CFG_GET_OQ_BUF_SIZE(oct->conf);
@@ -458,8 +459,8 @@ static int __octep_vf_oq_process_rx(struct octep_vf_device *oct,
oq->host_read_idx = read_idx;
oq->refill_count += desc_used;
- oq->stats.packets += pkt;
- oq->stats.bytes += rx_bytes;
+ oq->stats->packets += pkt;
+ oq->stats->bytes += rx_bytes;
return pkt;
}
diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.h b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.h
index fe46838b5200f..9e296b7d7e349 100644
--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.h
+++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_rx.h
@@ -187,7 +187,7 @@ struct octep_vf_oq {
u8 __iomem *pkts_sent_reg;
/* Statistics for this OQ. */
- struct octep_vf_oq_stats stats;
+ struct octep_vf_oq_stats *stats;
/* Packets pending to be processed */
u32 pkts_pending;
diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.c
index 47a5c054fdb63..8180e5ce3d7ef 100644
--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.c
+++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.c
@@ -82,9 +82,9 @@ int octep_vf_iq_process_completions(struct octep_vf_iq *iq, u16 budget)
}
iq->pkts_processed += compl_pkts;
- iq->stats.instr_completed += compl_pkts;
- iq->stats.bytes_sent += compl_bytes;
- iq->stats.sgentry_sent += compl_sg;
+ iq->stats->instr_completed += compl_pkts;
+ iq->stats->bytes_sent += compl_bytes;
+ iq->stats->sgentry_sent += compl_sg;
iq->flush_index = fi;
netif_subqueue_completed_wake(iq->netdev, iq->q_no, compl_pkts,
@@ -186,6 +186,7 @@ static int octep_vf_setup_iq(struct octep_vf_device *oct, int q_no)
iq->netdev = oct->netdev;
iq->dev = &oct->pdev->dev;
iq->q_no = q_no;
+ iq->stats = &oct->stats_iq[q_no];
iq->max_count = CFG_GET_IQ_NUM_DESC(oct->conf);
iq->ring_size_mask = iq->max_count - 1;
iq->fill_threshold = CFG_GET_IQ_DB_MIN(oct->conf);
diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.h b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.h
index f338b975103c3..1cede90e3a5fa 100644
--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.h
+++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_tx.h
@@ -129,7 +129,7 @@ struct octep_vf_iq {
u16 flush_index;
/* Statistics for this input queue. */
- struct octep_vf_iq_stats stats;
+ struct octep_vf_iq_stats *stats;
/* Pointer to the Virtual Base addr of the input ring. */
struct octep_vf_tx_desc_hw *desc_ring;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 084/443] tipc: re-order conditions in tipc_crypto_key_rcv()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 083/443] octeon_ep_vf: " Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 085/443] selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack() Greg Kroah-Hartman
` (369 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Simon Horman,
David S. Miller, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 5fe71fda89745fc3cd95f70d06e9162b595c3702 ]
On a 32bit system the "keylen + sizeof(struct tipc_aead_key)" math could
have an integer wrapping issue. It doesn't matter because the "keylen"
is checked on the next line, but just to make life easier for static
analysis tools, let's re-order these conditions and avoid the integer
overflow.
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/crypto.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
index 43c3f1c971b8f..c524421ec6525 100644
--- a/net/tipc/crypto.c
+++ b/net/tipc/crypto.c
@@ -2293,8 +2293,8 @@ static bool tipc_crypto_key_rcv(struct tipc_crypto *rx, struct tipc_msg *hdr)
keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME)));
/* Verify the supplied size values */
- if (unlikely(size != keylen + sizeof(struct tipc_aead_key) ||
- keylen > TIPC_AEAD_KEY_SIZE_MAX)) {
+ if (unlikely(keylen > TIPC_AEAD_KEY_SIZE_MAX ||
+ size != keylen + sizeof(struct tipc_aead_key))) {
pr_debug("%s: invalid MSG_CRYPTO key size\n", rx->name);
goto exit;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 085/443] selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 084/443] tipc: re-order conditions in tipc_crypto_key_rcv() Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 086/443] net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path Greg Kroah-Hartman
` (368 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liu Ye, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Ye <liuye@kylinos.cn>
[ Upstream commit 3a0b7fa095212b51ed63892540c4f249991a2d74 ]
Address Null pointer dereference / undefined behavior in rtattr_pack
(note that size is 0 in the bad case).
Flagged by cppcheck as:
tools/testing/selftests/net/ipsec.c:230:25: warning: Possible null pointer
dereference: payload [nullPointer]
memcpy(RTA_DATA(attr), payload, size);
^
tools/testing/selftests/net/ipsec.c:1618:54: note: Calling function 'rtattr_pack',
4th argument 'NULL' value is 0
if (rtattr_pack(&req.nh, sizeof(req), XFRMA_IF_ID, NULL, 0)) {
^
tools/testing/selftests/net/ipsec.c:230:25: note: Null pointer dereference
memcpy(RTA_DATA(attr), payload, size);
^
Signed-off-by: Liu Ye <liuye@kylinos.cn>
Link: https://patch.msgid.link/20250116013037.29470-1-liuye@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/ipsec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/ipsec.c b/tools/testing/selftests/net/ipsec.c
index be4a30a0d02ae..9b44a091802cb 100644
--- a/tools/testing/selftests/net/ipsec.c
+++ b/tools/testing/selftests/net/ipsec.c
@@ -227,7 +227,8 @@ static int rtattr_pack(struct nlmsghdr *nh, size_t req_sz,
attr->rta_len = RTA_LENGTH(size);
attr->rta_type = rta_type;
- memcpy(RTA_DATA(attr), payload, size);
+ if (payload)
+ memcpy(RTA_DATA(attr), payload, size);
return 0;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 086/443] net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 085/443] selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack() Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 087/443] ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params Greg Kroah-Hartman
` (367 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Vadapalli, Roger Quadros,
Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <rogerq@kernel.org>
[ Upstream commit 681eb2beb3efe21e630bcc4881595e3b42dd7948 ]
We are missing netif_napi_del() and am65_cpsw_nuss_free_tx/rx_chns()
in error path when am65_cpsw_nuss_init_tx/rx_chns() is used anywhere
other than at probe(). i.e. am65_cpsw_nuss_update_tx_rx_chns and
am65_cpsw_nuss_resume()
As reported, in am65_cpsw_nuss_update_tx_rx_chns(),
if am65_cpsw_nuss_init_tx_chns() partially fails then
devm_add_action(dev, am65_cpsw_nuss_free_tx_chns,..) is added
but the cleanup via am65_cpsw_nuss_free_tx_chns() will not run.
Same issue exists for am65_cpsw_nuss_init_tx/rx_chns() failures
in am65_cpsw_nuss_resume() as well.
This would otherwise require more instances of devm_add/remove_action
and is clearly more of a distraction than any benefit.
So, drop devm_add/remove_action for am65_cpsw_nuss_free_tx/rx_chns()
and call am65_cpsw_nuss_free_tx/rx_chns() and netif_napi_del()
where required.
Reported-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Closes: https://lore.kernel.org/all/m4rhkzcr7dlylxr54udyt6lal5s2q4krrvmyay6gzgzhcu4q2c@r34snfumzqxy/
Signed-off-by: Roger Quadros <rogerq@kernel.org>
Link: https://patch.msgid.link/20250117-am65-cpsw-streamline-v2-1-91a29c97e569@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 67 ++++++++++++++++--------
1 file changed, 44 insertions(+), 23 deletions(-)
diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
index e1de45fb18aee..2be2889d0646b 100644
--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
@@ -2242,8 +2242,6 @@ static void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common)
struct device *dev = common->dev;
int i;
- devm_remove_action(dev, am65_cpsw_nuss_free_tx_chns, common);
-
common->tx_ch_rate_msk = 0;
for (i = 0; i < common->tx_ch_num; i++) {
struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i];
@@ -2265,8 +2263,6 @@ static int am65_cpsw_nuss_ndev_add_tx_napi(struct am65_cpsw_common *common)
for (i = 0; i < common->tx_ch_num; i++) {
struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i];
- netif_napi_add_tx(common->dma_ndev, &tx_chn->napi_tx,
- am65_cpsw_nuss_tx_poll);
hrtimer_init(&tx_chn->tx_hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_PINNED);
tx_chn->tx_hrtimer.function = &am65_cpsw_nuss_tx_timer_callback;
@@ -2279,9 +2275,21 @@ static int am65_cpsw_nuss_ndev_add_tx_napi(struct am65_cpsw_common *common)
tx_chn->id, tx_chn->irq, ret);
goto err;
}
+
+ netif_napi_add_tx(common->dma_ndev, &tx_chn->napi_tx,
+ am65_cpsw_nuss_tx_poll);
}
+ return 0;
+
err:
+ for (--i ; i >= 0 ; i--) {
+ struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i];
+
+ netif_napi_del(&tx_chn->napi_tx);
+ devm_free_irq(dev, tx_chn->irq, tx_chn);
+ }
+
return ret;
}
@@ -2362,12 +2370,10 @@ static int am65_cpsw_nuss_init_tx_chns(struct am65_cpsw_common *common)
goto err;
}
+ return 0;
+
err:
- i = devm_add_action(dev, am65_cpsw_nuss_free_tx_chns, common);
- if (i) {
- dev_err(dev, "Failed to add free_tx_chns action %d\n", i);
- return i;
- }
+ am65_cpsw_nuss_free_tx_chns(common);
return ret;
}
@@ -2395,7 +2401,6 @@ static void am65_cpsw_nuss_remove_rx_chns(struct am65_cpsw_common *common)
rx_chn = &common->rx_chns;
flows = rx_chn->flows;
- devm_remove_action(dev, am65_cpsw_nuss_free_rx_chns, common);
for (i = 0; i < common->rx_ch_num_flows; i++) {
if (!(flows[i].irq < 0))
@@ -2494,7 +2499,7 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common)
i, &rx_flow_cfg);
if (ret) {
dev_err(dev, "Failed to init rx flow%d %d\n", i, ret);
- goto err;
+ goto err_flow;
}
if (!i)
fdqring_id =
@@ -2506,14 +2511,12 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common)
dev_err(dev, "Failed to get rx dma irq %d\n",
flow->irq);
ret = flow->irq;
- goto err;
+ goto err_flow;
}
snprintf(flow->name,
sizeof(flow->name), "%s-rx%d",
dev_name(dev), i);
- netif_napi_add(common->dma_ndev, &flow->napi_rx,
- am65_cpsw_nuss_rx_poll);
hrtimer_init(&flow->rx_hrtimer, CLOCK_MONOTONIC,
HRTIMER_MODE_REL_PINNED);
flow->rx_hrtimer.function = &am65_cpsw_nuss_rx_timer_callback;
@@ -2526,20 +2529,28 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common)
dev_err(dev, "failure requesting rx %d irq %u, %d\n",
i, flow->irq, ret);
flow->irq = -EINVAL;
- goto err;
+ goto err_flow;
}
+
+ netif_napi_add(common->dma_ndev, &flow->napi_rx,
+ am65_cpsw_nuss_rx_poll);
}
/* setup classifier to route priorities to flows */
cpsw_ale_classifier_setup_default(common->ale, common->rx_ch_num_flows);
-err:
- i = devm_add_action(dev, am65_cpsw_nuss_free_rx_chns, common);
- if (i) {
- dev_err(dev, "Failed to add free_rx_chns action %d\n", i);
- return i;
+ return 0;
+
+err_flow:
+ for (--i; i >= 0 ; i--) {
+ flow = &rx_chn->flows[i];
+ netif_napi_del(&flow->napi_rx);
+ devm_free_irq(dev, flow->irq, flow);
}
+err:
+ am65_cpsw_nuss_free_rx_chns(common);
+
return ret;
}
@@ -3349,7 +3360,7 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common)
return ret;
ret = am65_cpsw_nuss_init_rx_chns(common);
if (ret)
- return ret;
+ goto err_remove_tx;
/* The DMA Channels are not guaranteed to be in a clean state.
* Reset and disable them to ensure that they are back to the
@@ -3370,7 +3381,7 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common)
ret = am65_cpsw_nuss_register_devlink(common);
if (ret)
- return ret;
+ goto err_remove_rx;
for (i = 0; i < common->port_num; i++) {
port = &common->ports[i];
@@ -3401,6 +3412,10 @@ static int am65_cpsw_nuss_register_ndevs(struct am65_cpsw_common *common)
err_cleanup_ndev:
am65_cpsw_nuss_cleanup_ndev(common);
am65_cpsw_unregister_devlink(common);
+err_remove_rx:
+ am65_cpsw_nuss_remove_rx_chns(common);
+err_remove_tx:
+ am65_cpsw_nuss_remove_tx_chns(common);
return ret;
}
@@ -3420,6 +3435,8 @@ int am65_cpsw_nuss_update_tx_rx_chns(struct am65_cpsw_common *common,
return ret;
ret = am65_cpsw_nuss_init_rx_chns(common);
+ if (ret)
+ am65_cpsw_nuss_remove_tx_chns(common);
return ret;
}
@@ -3678,6 +3695,8 @@ static void am65_cpsw_nuss_remove(struct platform_device *pdev)
*/
am65_cpsw_nuss_cleanup_ndev(common);
am65_cpsw_unregister_devlink(common);
+ am65_cpsw_nuss_remove_rx_chns(common);
+ am65_cpsw_nuss_remove_tx_chns(common);
am65_cpsw_nuss_phylink_cleanup(common);
am65_cpts_release(common->cpts);
am65_cpsw_disable_serdes_phy(common);
@@ -3739,8 +3758,10 @@ static int am65_cpsw_nuss_resume(struct device *dev)
if (ret)
return ret;
ret = am65_cpsw_nuss_init_rx_chns(common);
- if (ret)
+ if (ret) {
+ am65_cpsw_nuss_remove_tx_chns(common);
return ret;
+ }
/* If RX IRQ was disabled before suspend, keep it disabled */
for (i = 0; i < common->rx_ch_num_flows; i++) {
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 087/443] ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 086/443] net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 088/443] bpf: Improve verifier log for resource leak on exit Greg Kroah-Hartman
` (366 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bard Liao, Ranjani Sridharan,
Péter Ujfalusi, Liam Girdwood, Mark Brown, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <yung-chuan.liao@linux.intel.com>
[ Upstream commit 569922b82ca660f8b24e705f6cf674e6b1f99cc7 ]
Each cpu DAI should associate with a widget. However, the topology might
not create the right number of DAI widgets for aggregated amps. And it
will cause NULL pointer deference.
Check that the DAI widget associated with the CPU DAI is valid to prevent
NULL pointer deference due to missing DAI widgets in topologies with
aggregated amps.
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Link: https://patch.msgid.link/20241203104853.56956-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/intel/hda-dai.c | 12 ++++++++++++
sound/soc/sof/intel/hda.c | 5 +++++
2 files changed, 17 insertions(+)
diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
index 0db2a3e554fb2..da12aabc1bb85 100644
--- a/sound/soc/sof/intel/hda-dai.c
+++ b/sound/soc/sof/intel/hda-dai.c
@@ -503,6 +503,12 @@ int sdw_hda_dai_hw_params(struct snd_pcm_substream *substream,
int ret;
int i;
+ if (!w) {
+ dev_err(cpu_dai->dev, "%s widget not found, check amp link num in the topology\n",
+ cpu_dai->name);
+ return -EINVAL;
+ }
+
ops = hda_dai_get_ops(substream, cpu_dai);
if (!ops) {
dev_err(cpu_dai->dev, "DAI widget ops not set\n");
@@ -582,6 +588,12 @@ int sdw_hda_dai_hw_params(struct snd_pcm_substream *substream,
*/
for_each_rtd_cpu_dais(rtd, i, dai) {
w = snd_soc_dai_get_widget(dai, substream->stream);
+ if (!w) {
+ dev_err(cpu_dai->dev,
+ "%s widget not found, check amp link num in the topology\n",
+ dai->name);
+ return -EINVAL;
+ }
ipc4_copier = widget_to_copier(w);
memcpy(&ipc4_copier->dma_config_tlv[cpu_dai_id], dma_config_tlv,
sizeof(*dma_config_tlv));
diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
index f991785f727e9..be689f6e10c81 100644
--- a/sound/soc/sof/intel/hda.c
+++ b/sound/soc/sof/intel/hda.c
@@ -63,6 +63,11 @@ static int sdw_params_stream(struct device *dev,
struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(d, params_data->substream->stream);
struct snd_sof_dai_config_data data = { 0 };
+ if (!w) {
+ dev_err(dev, "%s widget not found, check amp link num in the topology\n",
+ d->name);
+ return -EINVAL;
+ }
data.dai_index = (params_data->link_id << 8) | d->id;
data.dai_data = params_data->alh_stream_id;
data.dai_node_id = data.dai_data;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 088/443] bpf: Improve verifier log for resource leak on exit
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 087/443] ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately Greg Kroah-Hartman
` (365 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eduard Zingerman,
Kumar Kartikeya Dwivedi, Alexei Starovoitov, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
[ Upstream commit cbd8730aea8d79cda6b0f3c18b406dfdef0c1b80 ]
The verifier log when leaking resources on BPF_EXIT may be a bit
confusing, as it's a problem only when finally existing from the main
prog, not from any of the subprogs. Hence, update the verifier error
string and the corresponding selftests matching on it.
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241204030400.208005-6-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 2 +-
.../testing/selftests/bpf/progs/exceptions_fail.c | 4 ++--
tools/testing/selftests/bpf/progs/preempt_lock.c | 14 +++++++-------
.../selftests/bpf/progs/verifier_spin_lock.c | 2 +-
4 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 77f56674aaa99..4f02345b764fd 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -18803,7 +18803,7 @@ static int do_check(struct bpf_verifier_env *env)
* match caller reference state when it exits.
*/
err = check_resource_leak(env, exception_exit, !env->cur_state->curframe,
- "BPF_EXIT instruction");
+ "BPF_EXIT instruction in main prog");
if (err)
return err;
diff --git a/tools/testing/selftests/bpf/progs/exceptions_fail.c b/tools/testing/selftests/bpf/progs/exceptions_fail.c
index fe0f3fa5aab68..8a0fdff899271 100644
--- a/tools/testing/selftests/bpf/progs/exceptions_fail.c
+++ b/tools/testing/selftests/bpf/progs/exceptions_fail.c
@@ -131,7 +131,7 @@ int reject_subprog_with_lock(void *ctx)
}
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_rcu_read_lock-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region")
int reject_with_rcu_read_lock(void *ctx)
{
bpf_rcu_read_lock();
@@ -147,7 +147,7 @@ __noinline static int throwing_subprog(struct __sk_buff *ctx)
}
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_rcu_read_lock-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_rcu_read_lock-ed region")
int reject_subprog_with_rcu_read_lock(void *ctx)
{
bpf_rcu_read_lock();
diff --git a/tools/testing/selftests/bpf/progs/preempt_lock.c b/tools/testing/selftests/bpf/progs/preempt_lock.c
index 885377e836077..5269571cf7b57 100644
--- a/tools/testing/selftests/bpf/progs/preempt_lock.c
+++ b/tools/testing/selftests/bpf/progs/preempt_lock.c
@@ -6,7 +6,7 @@
#include "bpf_experimental.h"
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region")
int preempt_lock_missing_1(struct __sk_buff *ctx)
{
bpf_preempt_disable();
@@ -14,7 +14,7 @@ int preempt_lock_missing_1(struct __sk_buff *ctx)
}
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region")
int preempt_lock_missing_2(struct __sk_buff *ctx)
{
bpf_preempt_disable();
@@ -23,7 +23,7 @@ int preempt_lock_missing_2(struct __sk_buff *ctx)
}
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region")
int preempt_lock_missing_3(struct __sk_buff *ctx)
{
bpf_preempt_disable();
@@ -33,7 +33,7 @@ int preempt_lock_missing_3(struct __sk_buff *ctx)
}
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region")
int preempt_lock_missing_3_minus_2(struct __sk_buff *ctx)
{
bpf_preempt_disable();
@@ -55,7 +55,7 @@ static __noinline void preempt_enable(void)
}
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region")
int preempt_lock_missing_1_subprog(struct __sk_buff *ctx)
{
preempt_disable();
@@ -63,7 +63,7 @@ int preempt_lock_missing_1_subprog(struct __sk_buff *ctx)
}
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region")
int preempt_lock_missing_2_subprog(struct __sk_buff *ctx)
{
preempt_disable();
@@ -72,7 +72,7 @@ int preempt_lock_missing_2_subprog(struct __sk_buff *ctx)
}
SEC("?tc")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_preempt_disable-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_preempt_disable-ed region")
int preempt_lock_missing_2_minus_1_subprog(struct __sk_buff *ctx)
{
preempt_disable();
diff --git a/tools/testing/selftests/bpf/progs/verifier_spin_lock.c b/tools/testing/selftests/bpf/progs/verifier_spin_lock.c
index 3f679de73229f..25599eac9a702 100644
--- a/tools/testing/selftests/bpf/progs/verifier_spin_lock.c
+++ b/tools/testing/selftests/bpf/progs/verifier_spin_lock.c
@@ -187,7 +187,7 @@ l0_%=: r6 = r0; \
SEC("cgroup/skb")
__description("spin_lock: test6 missing unlock")
-__failure __msg("BPF_EXIT instruction cannot be used inside bpf_spin_lock-ed region")
+__failure __msg("BPF_EXIT instruction in main prog cannot be used inside bpf_spin_lock-ed region")
__failure_unpriv __msg_unpriv("")
__naked void spin_lock_test6_missing_unlock(void)
{
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 088/443] bpf: Improve verifier log for resource leak on exit Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-03-11 15:45 ` [EXTERNAL] " David Woodhouse
2025-02-13 14:24 ` [PATCH 6.13 090/443] ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7 Greg Kroah-Hartman
` (364 subsequent siblings)
453 siblings, 1 reply; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Woodhouse, Ingo Molnar,
Baoquan He, Vivek Goyal, Dave Young, Eric Biederman,
Ard Biesheuvel, H. Peter Anvin, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
[ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]
Now that the following fix:
d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")
stops kernel_ident_mapping_init() from scribbling over the end of a
4KiB PGD by assuming the following 4KiB will be a userspace PGD,
there's no good reason for the kexec PGD to be part of a single
8KiB allocation with the control_code_page.
( It's not clear that that was the reason for x86_64 kexec doing it that
way in the first place either; there were no comments to that effect and
it seems to have been the case even before PTI came along. It looks like
it was just a happy accident which prevented memory corruption on kexec. )
Either way, it definitely isn't needed now. Just allocate the PGD
separately on x86_64, like i386 already does.
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Link: https://lore.kernel.org/r/20241205153343.3275139-6-dwmw2@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/kexec.h | 18 +++++++++---
arch/x86/kernel/machine_kexec_64.c | 45 ++++++++++++++++--------------
2 files changed, 38 insertions(+), 25 deletions(-)
diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
index ae5482a2f0ca0..ccb8ff37fa9d4 100644
--- a/arch/x86/include/asm/kexec.h
+++ b/arch/x86/include/asm/kexec.h
@@ -16,6 +16,7 @@
# define PAGES_NR 4
#endif
+# define KEXEC_CONTROL_PAGE_SIZE 4096
# define KEXEC_CONTROL_CODE_MAX_SIZE 2048
#ifndef __ASSEMBLY__
@@ -43,7 +44,6 @@ struct kimage;
/* Maximum address we can use for the control code buffer */
# define KEXEC_CONTROL_MEMORY_LIMIT TASK_SIZE
-# define KEXEC_CONTROL_PAGE_SIZE 4096
/* The native architecture */
# define KEXEC_ARCH KEXEC_ARCH_386
@@ -58,9 +58,6 @@ struct kimage;
/* Maximum address we can use for the control pages */
# define KEXEC_CONTROL_MEMORY_LIMIT (MAXMEM-1)
-/* Allocate one page for the pdp and the second for the code */
-# define KEXEC_CONTROL_PAGE_SIZE (4096UL + 4096UL)
-
/* The native architecture */
# define KEXEC_ARCH KEXEC_ARCH_X86_64
#endif
@@ -145,6 +142,19 @@ struct kimage_arch {
};
#else
struct kimage_arch {
+ /*
+ * This is a kimage control page, as it must not overlap with either
+ * source or destination address ranges.
+ */
+ pgd_t *pgd;
+ /*
+ * The virtual mapping of the control code page itself is used only
+ * during the transition, while the current kernel's pages are all
+ * in place. Thus the intermediate page table pages used to map it
+ * are not control pages, but instead just normal pages obtained
+ * with get_zeroed_page(). And have to be tracked (below) so that
+ * they can be freed.
+ */
p4d_t *p4d;
pud_t *pud;
pmd_t *pmd;
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index 9c9ac606893e9..7223c38a8708f 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -146,7 +146,8 @@ static void free_transition_pgtable(struct kimage *image)
image->arch.pte = NULL;
}
-static int init_transition_pgtable(struct kimage *image, pgd_t *pgd)
+static int init_transition_pgtable(struct kimage *image, pgd_t *pgd,
+ unsigned long control_page)
{
pgprot_t prot = PAGE_KERNEL_EXEC_NOENC;
unsigned long vaddr, paddr;
@@ -157,7 +158,7 @@ static int init_transition_pgtable(struct kimage *image, pgd_t *pgd)
pte_t *pte;
vaddr = (unsigned long)relocate_kernel;
- paddr = __pa(page_address(image->control_code_page)+PAGE_SIZE);
+ paddr = control_page;
pgd += pgd_index(vaddr);
if (!pgd_present(*pgd)) {
p4d = (p4d_t *)get_zeroed_page(GFP_KERNEL);
@@ -216,7 +217,7 @@ static void *alloc_pgt_page(void *data)
return p;
}
-static int init_pgtable(struct kimage *image, unsigned long start_pgtable)
+static int init_pgtable(struct kimage *image, unsigned long control_page)
{
struct x86_mapping_info info = {
.alloc_pgt_page = alloc_pgt_page,
@@ -225,12 +226,12 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable)
.kernpg_flag = _KERNPG_TABLE_NOENC,
};
unsigned long mstart, mend;
- pgd_t *level4p;
int result;
int i;
- level4p = (pgd_t *)__va(start_pgtable);
- clear_page(level4p);
+ image->arch.pgd = alloc_pgt_page(image);
+ if (!image->arch.pgd)
+ return -ENOMEM;
if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) {
info.page_flag |= _PAGE_ENC;
@@ -244,8 +245,8 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable)
mstart = pfn_mapped[i].start << PAGE_SHIFT;
mend = pfn_mapped[i].end << PAGE_SHIFT;
- result = kernel_ident_mapping_init(&info,
- level4p, mstart, mend);
+ result = kernel_ident_mapping_init(&info, image->arch.pgd,
+ mstart, mend);
if (result)
return result;
}
@@ -260,8 +261,8 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable)
mstart = image->segment[i].mem;
mend = mstart + image->segment[i].memsz;
- result = kernel_ident_mapping_init(&info,
- level4p, mstart, mend);
+ result = kernel_ident_mapping_init(&info, image->arch.pgd,
+ mstart, mend);
if (result)
return result;
@@ -271,15 +272,19 @@ static int init_pgtable(struct kimage *image, unsigned long start_pgtable)
* Prepare EFI systab and ACPI tables for kexec kernel since they are
* not covered by pfn_mapped.
*/
- result = map_efi_systab(&info, level4p);
+ result = map_efi_systab(&info, image->arch.pgd);
if (result)
return result;
- result = map_acpi_tables(&info, level4p);
+ result = map_acpi_tables(&info, image->arch.pgd);
if (result)
return result;
- return init_transition_pgtable(image, level4p);
+ /*
+ * This must be last because the intermediate page table pages it
+ * allocates will not be control pages and may overlap the image.
+ */
+ return init_transition_pgtable(image, image->arch.pgd, control_page);
}
static void load_segments(void)
@@ -296,14 +301,14 @@ static void load_segments(void)
int machine_kexec_prepare(struct kimage *image)
{
- unsigned long start_pgtable;
+ unsigned long control_page;
int result;
/* Calculate the offsets */
- start_pgtable = page_to_pfn(image->control_code_page) << PAGE_SHIFT;
+ control_page = page_to_pfn(image->control_code_page) << PAGE_SHIFT;
/* Setup the identity mapped 64bit page table */
- result = init_pgtable(image, start_pgtable);
+ result = init_pgtable(image, control_page);
if (result)
return result;
@@ -357,13 +362,12 @@ void machine_kexec(struct kimage *image)
#endif
}
- control_page = page_address(image->control_code_page) + PAGE_SIZE;
+ control_page = page_address(image->control_code_page);
__memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
page_list[PA_CONTROL_PAGE] = virt_to_phys(control_page);
page_list[VA_CONTROL_PAGE] = (unsigned long)control_page;
- page_list[PA_TABLE_PAGE] =
- (unsigned long)__pa(page_address(image->control_code_page));
+ page_list[PA_TABLE_PAGE] = (unsigned long)__pa(image->arch.pgd);
if (image->type == KEXEC_TYPE_DEFAULT)
page_list[PA_SWAP_PAGE] = (page_to_pfn(image->swap_page)
@@ -573,8 +577,7 @@ static void kexec_mark_crashkres(bool protect)
/* Don't touch the control code page used in crash_kexec().*/
control = PFN_PHYS(page_to_pfn(kexec_crash_image->control_code_page));
- /* Control code page is located in the 2nd page. */
- kexec_mark_range(crashk_res.start, control + PAGE_SIZE - 1, protect);
+ kexec_mark_range(crashk_res.start, control - 1, protect);
control += KEXEC_CONTROL_PAGE_SIZE;
kexec_mark_range(control, crashk_res.end, protect);
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* Re: [EXTERNAL] [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately
2025-02-13 14:24 ` [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately Greg Kroah-Hartman
@ 2025-03-11 15:45 ` David Woodhouse
2025-03-12 7:47 ` Greg Kroah-Hartman
0 siblings, 1 reply; 474+ messages in thread
From: David Woodhouse @ 2025-03-11 15:45 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Ingo Molnar, Baoquan He, Vivek Goyal, Dave Young,
Eric Biederman, Ard Biesheuvel, H. Peter Anvin, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 1396 bytes --]
On Thu, 2025-02-13 at 15:24 +0100, Greg Kroah-Hartman wrote:
> 6.13-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: David Woodhouse <dwmw@amazon.co.uk>
>
> [ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]
>
> Now that the following fix:
>
> d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")
>
> stops kernel_ident_mapping_init() from scribbling over the end of a
> 4KiB PGD by assuming the following 4KiB will be a userspace PGD,
> there's no good reason for the kexec PGD to be part of a single
> 8KiB allocation with the control_code_page.
>
> ( It's not clear that that was the reason for x86_64 kexec doing it that
> way in the first place either; there were no comments to that effect and
> it seems to have been the case even before PTI came along. It looks like
> it was just a happy accident which prevented memory corruption on kexec. )
>
> Either way, it definitely isn't needed now. Just allocate the PGD
> separately on x86_64, like i386 already does.
No objection (which is just as well given how late I am in replying)
but I'm just not sure *why*. This doesn't fix a real bug; it's just a
cleanup.
Does this mean I should have written my original commit message better,
to make it clearer that this *isn't* a bugfix?
[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5069 bytes --]
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [EXTERNAL] [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately
2025-03-11 15:45 ` [EXTERNAL] " David Woodhouse
@ 2025-03-12 7:47 ` Greg Kroah-Hartman
2025-03-12 7:54 ` Ard Biesheuvel
0 siblings, 1 reply; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-03-12 7:47 UTC (permalink / raw)
To: David Woodhouse
Cc: stable, patches, Ingo Molnar, Baoquan He, Vivek Goyal, Dave Young,
Eric Biederman, Ard Biesheuvel, H. Peter Anvin, Sasha Levin
On Tue, Mar 11, 2025 at 04:45:26PM +0100, David Woodhouse wrote:
> On Thu, 2025-02-13 at 15:24 +0100, Greg Kroah-Hartman wrote:
> > 6.13-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: David Woodhouse <dwmw@amazon.co.uk>
> >
> > [ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]
> >
> > Now that the following fix:
> >
> > d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")
> >
> > stops kernel_ident_mapping_init() from scribbling over the end of a
> > 4KiB PGD by assuming the following 4KiB will be a userspace PGD,
> > there's no good reason for the kexec PGD to be part of a single
> > 8KiB allocation with the control_code_page.
> >
> > ( It's not clear that that was the reason for x86_64 kexec doing it that
> > way in the first place either; there were no comments to that effect and
> > it seems to have been the case even before PTI came along. It looks like
> > it was just a happy accident which prevented memory corruption on kexec. )
> >
> > Either way, it definitely isn't needed now. Just allocate the PGD
> > separately on x86_64, like i386 already does.
>
> No objection (which is just as well given how late I am in replying)
> but I'm just not sure *why*. This doesn't fix a real bug; it's just a
> cleanup.
>
> Does this mean I should have written my original commit message better,
> to make it clearer that this *isn't* a bugfix?
Yes, that's why it was picked up.
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [EXTERNAL] [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately
2025-03-12 7:47 ` Greg Kroah-Hartman
@ 2025-03-12 7:54 ` Ard Biesheuvel
2025-03-12 8:16 ` Greg Kroah-Hartman
0 siblings, 1 reply; 474+ messages in thread
From: Ard Biesheuvel @ 2025-03-12 7:54 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: David Woodhouse, stable, patches, Ingo Molnar, Baoquan He,
Vivek Goyal, Dave Young, Eric Biederman, H. Peter Anvin,
Sasha Levin
On Wed, 12 Mar 2025 at 08:47, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Tue, Mar 11, 2025 at 04:45:26PM +0100, David Woodhouse wrote:
> > On Thu, 2025-02-13 at 15:24 +0100, Greg Kroah-Hartman wrote:
> > > 6.13-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: David Woodhouse <dwmw@amazon.co.uk>
> > >
> > > [ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]
> > >
> > > Now that the following fix:
> > >
> > > d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")
> > >
> > > stops kernel_ident_mapping_init() from scribbling over the end of a
> > > 4KiB PGD by assuming the following 4KiB will be a userspace PGD,
> > > there's no good reason for the kexec PGD to be part of a single
> > > 8KiB allocation with the control_code_page.
> > >
> > > ( It's not clear that that was the reason for x86_64 kexec doing it that
> > > way in the first place either; there were no comments to that effect and
> > > it seems to have been the case even before PTI came along. It looks like
> > > it was just a happy accident which prevented memory corruption on kexec. )
> > >
> > > Either way, it definitely isn't needed now. Just allocate the PGD
> > > separately on x86_64, like i386 already does.
> >
> > No objection (which is just as well given how late I am in replying)
> > but I'm just not sure *why*. This doesn't fix a real bug; it's just a
> > cleanup.
> >
> > Does this mean I should have written my original commit message better,
> > to make it clearer that this *isn't* a bugfix?
>
> Yes, that's why it was picked up.
>
The patch has no fixes: tag and no cc:stable. The burden shouldn't be
on the patch author to sprinkle enough of the right keywords over the
commit log to convince the bot that this is not a suitable stable
candidate, just because it happens to apply without conflicts.
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [EXTERNAL] [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately
2025-03-12 7:54 ` Ard Biesheuvel
@ 2025-03-12 8:16 ` Greg Kroah-Hartman
2025-03-12 8:31 ` Ard Biesheuvel
2025-03-12 8:37 ` David Woodhouse
0 siblings, 2 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-03-12 8:16 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: David Woodhouse, stable, patches, Ingo Molnar, Baoquan He,
Vivek Goyal, Dave Young, Eric Biederman, H. Peter Anvin,
Sasha Levin
On Wed, Mar 12, 2025 at 08:54:52AM +0100, Ard Biesheuvel wrote:
> On Wed, 12 Mar 2025 at 08:47, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Tue, Mar 11, 2025 at 04:45:26PM +0100, David Woodhouse wrote:
> > > On Thu, 2025-02-13 at 15:24 +0100, Greg Kroah-Hartman wrote:
> > > > 6.13-stable review patch. If anyone has any objections, please let me know.
> > > >
> > > > ------------------
> > > >
> > > > From: David Woodhouse <dwmw@amazon.co.uk>
> > > >
> > > > [ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]
> > > >
> > > > Now that the following fix:
> > > >
> > > > d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")
> > > >
> > > > stops kernel_ident_mapping_init() from scribbling over the end of a
> > > > 4KiB PGD by assuming the following 4KiB will be a userspace PGD,
> > > > there's no good reason for the kexec PGD to be part of a single
> > > > 8KiB allocation with the control_code_page.
> > > >
> > > > ( It's not clear that that was the reason for x86_64 kexec doing it that
> > > > way in the first place either; there were no comments to that effect and
> > > > it seems to have been the case even before PTI came along. It looks like
> > > > it was just a happy accident which prevented memory corruption on kexec. )
> > > >
> > > > Either way, it definitely isn't needed now. Just allocate the PGD
> > > > separately on x86_64, like i386 already does.
> > >
> > > No objection (which is just as well given how late I am in replying)
> > > but I'm just not sure *why*. This doesn't fix a real bug; it's just a
> > > cleanup.
> > >
> > > Does this mean I should have written my original commit message better,
> > > to make it clearer that this *isn't* a bugfix?
> >
> > Yes, that's why it was picked up.
> >
>
> The patch has no fixes: tag and no cc:stable. The burden shouldn't be
> on the patch author to sprinkle enough of the right keywords over the
> commit log to convince the bot that this is not a suitable stable
> candidate, just because it happens to apply without conflicts.
The burden is not there to do that, this came in from the AUTOSEL stuff.
It was sent to everyone on Jan 26:
https://lore.kernel.org/r/20250126150720.961959-3-sashal@kernel.org
so there was 1 1/2 weeks chance to say something before Sasha committed
it to the stable queue. Then it was sent out again here in the -rc
releases for review, for anyone to object to.
So there was 3 different times someone could have said "no, this isn't
ok for stable inclusion" before it was merged. And even if that's not
enough, I'll be glad to revert it if it wasn't ok to be merged at any
time afterward.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [EXTERNAL] [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately
2025-03-12 8:16 ` Greg Kroah-Hartman
@ 2025-03-12 8:31 ` Ard Biesheuvel
2025-03-12 8:55 ` Greg Kroah-Hartman
2025-03-12 8:37 ` David Woodhouse
1 sibling, 1 reply; 474+ messages in thread
From: Ard Biesheuvel @ 2025-03-12 8:31 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: David Woodhouse, stable, patches, Ingo Molnar, Baoquan He,
Vivek Goyal, Dave Young, Eric Biederman, H. Peter Anvin,
Sasha Levin
On Wed, 12 Mar 2025 at 09:16, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Wed, Mar 12, 2025 at 08:54:52AM +0100, Ard Biesheuvel wrote:
> > On Wed, 12 Mar 2025 at 08:47, Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Tue, Mar 11, 2025 at 04:45:26PM +0100, David Woodhouse wrote:
> > > > On Thu, 2025-02-13 at 15:24 +0100, Greg Kroah-Hartman wrote:
> > > > > 6.13-stable review patch. If anyone has any objections, please let me know.
> > > > >
> > > > > ------------------
> > > > >
> > > > > From: David Woodhouse <dwmw@amazon.co.uk>
> > > > >
> > > > > [ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]
> > > > >
> > > > > Now that the following fix:
> > > > >
> > > > > d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")
> > > > >
> > > > > stops kernel_ident_mapping_init() from scribbling over the end of a
> > > > > 4KiB PGD by assuming the following 4KiB will be a userspace PGD,
> > > > > there's no good reason for the kexec PGD to be part of a single
> > > > > 8KiB allocation with the control_code_page.
> > > > >
> > > > > ( It's not clear that that was the reason for x86_64 kexec doing it that
> > > > > way in the first place either; there were no comments to that effect and
> > > > > it seems to have been the case even before PTI came along. It looks like
> > > > > it was just a happy accident which prevented memory corruption on kexec. )
> > > > >
> > > > > Either way, it definitely isn't needed now. Just allocate the PGD
> > > > > separately on x86_64, like i386 already does.
> > > >
> > > > No objection (which is just as well given how late I am in replying)
> > > > but I'm just not sure *why*. This doesn't fix a real bug; it's just a
> > > > cleanup.
> > > >
> > > > Does this mean I should have written my original commit message better,
> > > > to make it clearer that this *isn't* a bugfix?
> > >
> > > Yes, that's why it was picked up.
> > >
> >
> > The patch has no fixes: tag and no cc:stable. The burden shouldn't be
> > on the patch author to sprinkle enough of the right keywords over the
> > commit log to convince the bot that this is not a suitable stable
> > candidate, just because it happens to apply without conflicts.
>
> The burden is not there to do that, this came in from the AUTOSEL stuff.
Yeah, that is what I figured. Can we *please* stop doing stupid stuff
like that for arch code, especially arch/x86, which is well looked
after? (In my personal opinion, we should not be using AUTOSEL at all,
but that seems to be a lost battle)
Especially for this patch in particular, which touches the kexec code,
which is easy to break and difficult to fix. Whether the patch applies
without breaking the build is entirely irrelevant (and even that seems
a high bar for stable trees these days). Nobody should be touching any
of that code without actually testing whether or not kexec still
works.
> It was sent to everyone on Jan 26:
> https://lore.kernel.org/r/20250126150720.961959-3-sashal@kernel.org
> so there was 1 1/2 weeks chance to say something before Sasha committed
> it to the stable queue. Then it was sent out again here in the -rc
> releases for review, for anyone to object to.
>
There should not be a need for people to object to something that no
actual person ever suggested in the first place.
The only responsible way to use AUTOSEL is to make it opt-in rather
than opt-out. And I object to the idea that it is ok for someone like
Sasha to run a bot that generates lots of emails to lots of people,
and put the burden on everyone else to spend actual time and mental
effort to go over all those patches and decide whether or not they
might the stable candidates, especially without any due diligence
whatsoever regarding whether the resulting kernel still boots and runs
correctly on a system that actually exercises the updated code.
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [EXTERNAL] [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately
2025-03-12 8:31 ` Ard Biesheuvel
@ 2025-03-12 8:55 ` Greg Kroah-Hartman
0 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-03-12 8:55 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: David Woodhouse, stable, patches, Ingo Molnar, Baoquan He,
Vivek Goyal, Dave Young, Eric Biederman, H. Peter Anvin,
Sasha Levin
On Wed, Mar 12, 2025 at 09:31:47AM +0100, Ard Biesheuvel wrote:
> On Wed, 12 Mar 2025 at 09:16, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Wed, Mar 12, 2025 at 08:54:52AM +0100, Ard Biesheuvel wrote:
> > > On Wed, 12 Mar 2025 at 08:47, Greg Kroah-Hartman
> > > <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > On Tue, Mar 11, 2025 at 04:45:26PM +0100, David Woodhouse wrote:
> > > > > On Thu, 2025-02-13 at 15:24 +0100, Greg Kroah-Hartman wrote:
> > > > > > 6.13-stable review patch. If anyone has any objections, please let me know.
> > > > > >
> > > > > > ------------------
> > > > > >
> > > > > > From: David Woodhouse <dwmw@amazon.co.uk>
> > > > > >
> > > > > > [ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]
> > > > > >
> > > > > > Now that the following fix:
> > > > > >
> > > > > > d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")
> > > > > >
> > > > > > stops kernel_ident_mapping_init() from scribbling over the end of a
> > > > > > 4KiB PGD by assuming the following 4KiB will be a userspace PGD,
> > > > > > there's no good reason for the kexec PGD to be part of a single
> > > > > > 8KiB allocation with the control_code_page.
> > > > > >
> > > > > > ( It's not clear that that was the reason for x86_64 kexec doing it that
> > > > > > way in the first place either; there were no comments to that effect and
> > > > > > it seems to have been the case even before PTI came along. It looks like
> > > > > > it was just a happy accident which prevented memory corruption on kexec. )
> > > > > >
> > > > > > Either way, it definitely isn't needed now. Just allocate the PGD
> > > > > > separately on x86_64, like i386 already does.
> > > > >
> > > > > No objection (which is just as well given how late I am in replying)
> > > > > but I'm just not sure *why*. This doesn't fix a real bug; it's just a
> > > > > cleanup.
> > > > >
> > > > > Does this mean I should have written my original commit message better,
> > > > > to make it clearer that this *isn't* a bugfix?
> > > >
> > > > Yes, that's why it was picked up.
> > > >
> > >
> > > The patch has no fixes: tag and no cc:stable. The burden shouldn't be
> > > on the patch author to sprinkle enough of the right keywords over the
> > > commit log to convince the bot that this is not a suitable stable
> > > candidate, just because it happens to apply without conflicts.
> >
> > The burden is not there to do that, this came in from the AUTOSEL stuff.
>
> Yeah, that is what I figured. Can we *please* stop doing stupid stuff
> like that for arch code, especially arch/x86, which is well looked
> after? (In my personal opinion, we should not be using AUTOSEL at all,
> but that seems to be a lost battle)
>
> Especially for this patch in particular, which touches the kexec code,
> which is easy to break and difficult to fix. Whether the patch applies
> without breaking the build is entirely irrelevant (and even that seems
> a high bar for stable trees these days). Nobody should be touching any
> of that code without actually testing whether or not kexec still
> works.
Maintainers can ask for their portions of the kernel to be not included
in the AUTOSEL work, and many have, please see:
https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/ignore_list
for the current list of things that are excluded.
> > It was sent to everyone on Jan 26:
> > https://lore.kernel.org/r/20250126150720.961959-3-sashal@kernel.org
> > so there was 1 1/2 weeks chance to say something before Sasha committed
> > it to the stable queue. Then it was sent out again here in the -rc
> > releases for review, for anyone to object to.
> >
>
> There should not be a need for people to object to something that no
> actual person ever suggested in the first place.
>
> The only responsible way to use AUTOSEL is to make it opt-in rather
> than opt-out. And I object to the idea that it is ok for someone like
> Sasha to run a bot that generates lots of emails to lots of people,
> and put the burden on everyone else to spend actual time and mental
> effort to go over all those patches and decide whether or not they
> might the stable candidates, especially without any due diligence
> whatsoever regarding whether the resulting kernel still boots and runs
> correctly on a system that actually exercises the updated code.
That does not work at all. The whole reason AUTOSEL is used is because
maintainers and developers are NOT tagging things that are bugfixes. We
have whole subsystems that just don't do anything, and this is the only
way we can get fixes for that area included in stable kernels.
Again, we allow any subsystem to opt-out entirely from this if they so
desire, AND we allow many chances for a patch to be dropped, AND we
later allow anything to be reverted. Heck, we have maintainers who just
don't want to deal with stable kernels at all, and that's fine, I'm not
going to impose that burden on them if they do not want to. But in that
case, we will do spelunking through the tree to find stuff that affects
users.
If you look at the history of AUTOSEL, I think the number of real bugs
has shown that overall, it works really well. Sure it will mess up at
times, we're all human, and all we can do then is to be sure to react
and fix the issue.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 474+ messages in thread
* Re: [EXTERNAL] [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately
2025-03-12 8:16 ` Greg Kroah-Hartman
2025-03-12 8:31 ` Ard Biesheuvel
@ 2025-03-12 8:37 ` David Woodhouse
1 sibling, 0 replies; 474+ messages in thread
From: David Woodhouse @ 2025-03-12 8:37 UTC (permalink / raw)
To: Greg Kroah-Hartman, Ard Biesheuvel
Cc: stable, patches, Ingo Molnar, Baoquan He, Vivek Goyal, Dave Young,
Eric Biederman, H. Peter Anvin, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 3290 bytes --]
On Wed, 2025-03-12 at 09:16 +0100, Greg Kroah-Hartman wrote:
> On Wed, Mar 12, 2025 at 08:54:52AM +0100, Ard Biesheuvel wrote:
> > On Wed, 12 Mar 2025 at 08:47, Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Tue, Mar 11, 2025 at 04:45:26PM +0100, David Woodhouse wrote:
> > > > On Thu, 2025-02-13 at 15:24 +0100, Greg Kroah-Hartman wrote:
> > > > > 6.13-stable review patch. If anyone has any objections, please let me know.
> > > > >
> > > > > ------------------
> > > > >
> > > > > From: David Woodhouse <dwmw@amazon.co.uk>
> > > > >
> > > > > [ Upstream commit 4b5bc2ec9a239bce261ffeafdd63571134102323 ]
> > > > >
> > > > > Now that the following fix:
> > > > >
> > > > > d0ceea662d45 ("x86/mm: Add _PAGE_NOPTISHADOW bit to avoid updating userspace page tables")
> > > > >
> > > > > stops kernel_ident_mapping_init() from scribbling over the end of a
> > > > > 4KiB PGD by assuming the following 4KiB will be a userspace PGD,
> > > > > there's no good reason for the kexec PGD to be part of a single
> > > > > 8KiB allocation with the control_code_page.
> > > > >
> > > > > ( It's not clear that that was the reason for x86_64 kexec doing it that
> > > > > way in the first place either; there were no comments to that effect and
> > > > > it seems to have been the case even before PTI came along. It looks like
> > > > > it was just a happy accident which prevented memory corruption on kexec. )
> > > > >
> > > > > Either way, it definitely isn't needed now. Just allocate the PGD
> > > > > separately on x86_64, like i386 already does.
> > > >
> > > > No objection (which is just as well given how late I am in replying)
> > > > but I'm just not sure *why*. This doesn't fix a real bug; it's just a
> > > > cleanup.
> > > >
> > > > Does this mean I should have written my original commit message better,
> > > > to make it clearer that this *isn't* a bugfix?
> > >
> > > Yes, that's why it was picked up.
> > >
> >
> > The patch has no fixes: tag and no cc:stable. The burden shouldn't be
> > on the patch author to sprinkle enough of the right keywords over the
> > commit log to convince the bot that this is not a suitable stable
> > candidate, just because it happens to apply without conflicts.
>
> The burden is not there to do that, this came in from the AUTOSEL stuff.
> It was sent to everyone on Jan 26:
> https://lore.kernel.org/r/20250126150720.961959-3-sashal@kernel.org
> so there was 1 1/2 weeks chance to say something before Sasha committed
> it to the stable queue. Then it was sent out again here in the -rc
> releases for review, for anyone to object to.
>
> So there was 3 different times someone could have said "no, this isn't
> ok for stable inclusion" before it was merged. And even if that's not
> enough, I'll be glad to revert it if it wasn't ok to be merged at any
> time afterward.
FWIW I don't think there's any need to revert it; it's fine. Just not
entirely necessary. I did see it in January but I was travelling so I
didn't get past briefly wondering *why* it was being picked up; I
thought perhaps one of the x86 maintainers had actually chosen to do
so.
If I'd *objected*, I'd have found the time to do so then.
[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5069 bytes --]
^ permalink raw reply [flat|nested] 474+ messages in thread
* [PATCH 6.13 090/443] ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 089/443] x86/kexec: Allocate PGD for x86_64 transition page tables separately Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 091/443] iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible Greg Kroah-Hartman
` (363 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Trimmer, Liam Girdwood,
Bard Liao, Mark Brown, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Trimmer <simont@opensource.cirrus.com>
[ Upstream commit 7662f0e5d55728a009229112ec820e963ed0e21c ]
In addition to changing the DMI match to examine the product name rather
than the SKU, this adds the quirk to inform the machine driver to not
bind in the cs42l43 microphone DAI link.
Signed-off-by: Simon Trimmer <simont@opensource.cirrus.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20241206075903.195730-5-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_sdw.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
index 5554ad4e7c787..65e55c46fb064 100644
--- a/sound/soc/intel/boards/sof_sdw.c
+++ b/sound/soc/intel/boards/sof_sdw.c
@@ -641,9 +641,10 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
.callback = sof_sdw_quirk_cb,
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
- DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "380E")
+ DMI_MATCH(DMI_PRODUCT_NAME, "83HM")
},
- .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS),
+ .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS |
+ SOC_SDW_CODEC_MIC),
},
{
.callback = sof_sdw_quirk_cb,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 091/443] iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 090/443] ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7 Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 092/443] iommu/arm-smmu-v3: Clean up more on probe failure Greg Kroah-Hartman
` (362 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Acayan, Dmitry Baryshkov,
Will Deacon, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Acayan <mailingradian@gmail.com>
[ Upstream commit 42314738906380cbd3b6e9caf3ad34e1b2d66035 ]
Add the compatible for the separate IOMMU on SDM670 for the Adreno GPU.
This IOMMU has the compatible strings:
"qcom,sdm670-smmu-v2", "qcom,adreno-smmu", "qcom,smmu-v2"
While the SMMU 500 doesn't need an entry for this specific SoC, the
SMMU v2 compatible should have its own entry, as the fallback entry in
arm-smmu.c handles "qcom,smmu-v2" without per-process page table support
unless there is an entry here. This entry can't be the
"qcom,adreno-smmu" compatible because dedicated GPU IOMMUs can also be
SMMU 500 with different handling.
Signed-off-by: Richard Acayan <mailingradian@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20241114004713.42404-6-mailingradian@gmail.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
index 6372f3e25c4bc..601fb878d0ef2 100644
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -567,6 +567,7 @@ static const struct of_device_id __maybe_unused qcom_smmu_impl_of_match[] = {
{ .compatible = "qcom,sc8180x-smmu-500", .data = &qcom_smmu_500_impl0_data },
{ .compatible = "qcom,sc8280xp-smmu-500", .data = &qcom_smmu_500_impl0_data },
{ .compatible = "qcom,sdm630-smmu-v2", .data = &qcom_smmu_v2_data },
+ { .compatible = "qcom,sdm670-smmu-v2", .data = &qcom_smmu_v2_data },
{ .compatible = "qcom,sdm845-smmu-v2", .data = &qcom_smmu_v2_data },
{ .compatible = "qcom,sdm845-smmu-500", .data = &sdm845_smmu_500_data },
{ .compatible = "qcom,sm6115-smmu-500", .data = &qcom_smmu_500_impl0_data},
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 092/443] iommu/arm-smmu-v3: Clean up more on probe failure
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 091/443] iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 093/443] platform/x86: int3472: Check for adev == NULL Greg Kroah-Hartman
` (361 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Robin Murphy, Will Deacon,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
[ Upstream commit fcbd621567420b3a2f21f49bbc056de8b273c625 ]
kmemleak noticed that the iopf queue allocated deep down within
arm_smmu_init_structures() can be leaked by a subsequent error return
from arm_smmu_device_probe(). Furthermore, after arm_smmu_device_reset()
we will also leave the SMMU enabled with an empty Stream Table, silently
blocking all DMA. This proves rather annoying for debugging said probe
failure, so let's handle it a bit better by putting the SMMU back into
(more or less) the same state as if it hadn't probed at all.
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/5137901958471cf67f2fad5c2229f8a8f1ae901a.1733406914.git.robin.murphy@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 6d15405f0ea3e..42a89d499cda8 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4670,7 +4670,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev)
/* Initialise in-memory data structures */
ret = arm_smmu_init_structures(smmu);
if (ret)
- return ret;
+ goto err_free_iopf;
/* Record our private device structure */
platform_set_drvdata(pdev, smmu);
@@ -4681,22 +4681,29 @@ static int arm_smmu_device_probe(struct platform_device *pdev)
/* Reset the device */
ret = arm_smmu_device_reset(smmu);
if (ret)
- return ret;
+ goto err_disable;
/* And we're up. Go go go! */
ret = iommu_device_sysfs_add(&smmu->iommu, dev, NULL,
"smmu3.%pa", &ioaddr);
if (ret)
- return ret;
+ goto err_disable;
ret = iommu_device_register(&smmu->iommu, &arm_smmu_ops, dev);
if (ret) {
dev_err(dev, "Failed to register iommu\n");
- iommu_device_sysfs_remove(&smmu->iommu);
- return ret;
+ goto err_free_sysfs;
}
return 0;
+
+err_free_sysfs:
+ iommu_device_sysfs_remove(&smmu->iommu);
+err_disable:
+ arm_smmu_device_disable(smmu);
+err_free_iopf:
+ iopf_queue_free(smmu->evtq.iopf);
+ return ret;
}
static void arm_smmu_device_remove(struct platform_device *pdev)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 093/443] platform/x86: int3472: Check for adev == NULL
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 092/443] iommu/arm-smmu-v3: Clean up more on probe failure Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 094/443] platform/x86: acer-wmi: Add support for Acer PH14-51 Greg Kroah-Hartman
` (360 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Ilpo Järvinen,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit cd2fd6eab480dfc247b737cf7a3d6b009c4d0f1c ]
Not all devices have an ACPI companion fwnode, so adev might be NULL. This
can e.g. (theoretically) happen when a user manually binds one of
the int3472 drivers to another i2c/platform device through sysfs.
Add a check for adev not being set and return -ENODEV in that case to
avoid a possible NULL pointer deref in skl_int3472_get_acpi_buffer().
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20241209220522.25288-1-hdegoede@redhat.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/int3472/discrete.c | 3 +++
drivers/platform/x86/intel/int3472/tps68470.c | 3 +++
2 files changed, 6 insertions(+)
diff --git a/drivers/platform/x86/intel/int3472/discrete.c b/drivers/platform/x86/intel/int3472/discrete.c
index d881b2cfcdfcf..09fff213b0911 100644
--- a/drivers/platform/x86/intel/int3472/discrete.c
+++ b/drivers/platform/x86/intel/int3472/discrete.c
@@ -336,6 +336,9 @@ static int skl_int3472_discrete_probe(struct platform_device *pdev)
struct int3472_cldb cldb;
int ret;
+ if (!adev)
+ return -ENODEV;
+
ret = skl_int3472_fill_cldb(adev, &cldb);
if (ret) {
dev_err(&pdev->dev, "Couldn't fill CLDB structure\n");
diff --git a/drivers/platform/x86/intel/int3472/tps68470.c b/drivers/platform/x86/intel/int3472/tps68470.c
index 1e107fd49f828..81ac4c6919630 100644
--- a/drivers/platform/x86/intel/int3472/tps68470.c
+++ b/drivers/platform/x86/intel/int3472/tps68470.c
@@ -152,6 +152,9 @@ static int skl_int3472_tps68470_probe(struct i2c_client *client)
int ret;
int i;
+ if (!adev)
+ return -ENODEV;
+
n_consumers = skl_int3472_fill_clk_pdata(&client->dev, &clk_pdata);
if (n_consumers < 0)
return n_consumers;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 094/443] platform/x86: acer-wmi: Add support for Acer PH14-51
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 093/443] platform/x86: int3472: Check for adev == NULL Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 095/443] ASoC: soc-pcm: dont use soc_pcm_ret() on .prepare callback Greg Kroah-Hartman
` (359 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rayan Margham, Armin Wolf,
Kurt Borja, Ilpo Järvinen, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 9741f9aa13f6dc3ff24e1d006b2ced5f460e6b6f ]
Add the Acer Predator PT14-51 to acer_quirks to provide support
for the turbo button and predator_v4 hwmon interface.
Reported-by: Rayan Margham <rayanmargham4@gmail.com>
Closes: https://lore.kernel.org/platform-driver-x86/CACzB==6tUsCnr5musVMz-EymjTUCJfNtKzhMFYqMRU_h=kydXA@mail.gmail.com
Tested-by: Rayan Margham <rayanmargham4@gmail.com>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Reviewed-by: Kurt Borja <kuurtb@gmail.com>
Link: https://lore.kernel.org/r/20241210001657.3362-2-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/acer-wmi.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index d09baa3d3d902..5cff538ee67fa 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -393,6 +393,13 @@ static struct quirk_entry quirk_acer_predator_ph315_53 = {
.gpu_fans = 1,
};
+static struct quirk_entry quirk_acer_predator_pt14_51 = {
+ .turbo = 1,
+ .cpu_fans = 1,
+ .gpu_fans = 1,
+ .predator_v4 = 1,
+};
+
static struct quirk_entry quirk_acer_predator_v4 = {
.predator_v4 = 1,
};
@@ -600,6 +607,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = {
},
.driver_data = &quirk_acer_predator_v4,
},
+ {
+ .callback = dmi_matched,
+ .ident = "Acer Predator PT14-51",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Predator PT14-51"),
+ },
+ .driver_data = &quirk_acer_predator_pt14_51,
+ },
{
.callback = set_force_caps,
.ident = "Acer Aspire Switch 10E SW3-016",
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 095/443] ASoC: soc-pcm: dont use soc_pcm_ret() on .prepare callback
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 094/443] platform/x86: acer-wmi: Add support for Acer PH14-51 Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 096/443] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE Greg Kroah-Hartman
` (358 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Kuninori Morimoto,
Mark Brown, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
[ Upstream commit 301c26a018acb94dd537a4418cefa0f654500c6f ]
commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port"
log severity") ignores -EINVAL error message on common soc_pcm_ret().
It is used from many functions, ignoring -EINVAL is over-kill.
The reason why -EINVAL was ignored was it really should only be used
upon invalid parameters coming from userspace and in that case we don't
want to log an error since we do not want to give userspace a way to do
a denial-of-service attack on the syslog / diskspace.
So don't use soc_pcm_ret() on .prepare callback is better idea.
Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++----
1 file changed, 28 insertions(+), 4 deletions(-)
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 1150455619aa4..88b3ad5a25520 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd,
switch (ret) {
case -EPROBE_DEFER:
case -ENOTSUPP:
- case -EINVAL:
break;
default:
dev_err(rtd->dev,
@@ -986,7 +985,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd,
}
out:
- return soc_pcm_ret(rtd, ret);
+ /*
+ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity
+ *
+ * We don't want to log an error since we do not want to give userspace a way to do a
+ * denial-of-service attack on the syslog / diskspace.
+ */
+ return ret;
}
/* PCM prepare ops for non-DPCM streams */
@@ -998,6 +1003,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream)
snd_soc_dpcm_mutex_lock(rtd);
ret = __soc_pcm_prepare(rtd, substream);
snd_soc_dpcm_mutex_unlock(rtd);
+
+ /*
+ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity
+ *
+ * We don't want to log an error since we do not want to give userspace a way to do a
+ * denial-of-service attack on the syslog / diskspace.
+ */
return ret;
}
@@ -2539,7 +2551,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream)
be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE;
}
- return soc_pcm_ret(fe, ret);
+ /*
+ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity
+ *
+ * We don't want to log an error since we do not want to give userspace a way to do a
+ * denial-of-service attack on the syslog / diskspace.
+ */
+ return ret;
}
static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream)
@@ -2579,7 +2597,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream)
dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO);
snd_soc_dpcm_mutex_unlock(fe);
- return soc_pcm_ret(fe, ret);
+ /*
+ * Don't use soc_pcm_ret() on .prepare callback to lower error log severity
+ *
+ * We don't want to log an error since we do not want to give userspace a way to do a
+ * denial-of-service attack on the syslog / diskspace.
+ */
+ return ret;
}
static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 096/443] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 095/443] ASoC: soc-pcm: dont use soc_pcm_ret() on .prepare callback Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 097/443] platform/x86: acer-wmi: Add support for Acer Predator PH16-72 Greg Kroah-Hartman
` (357 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kees Bakker, Lu Baolu, Joerg Roedel,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Bakker <kees@ijzerbout.nl>
[ Upstream commit 60f030f7418d3f1d94f2fb207fe3080e1844630b ]
There is a WARN_ON_ONCE to catch an unlikely situation when
domain_remove_dev_pasid can't find the `pasid`. In case it nevertheless
happens we must avoid using a NULL pointer.
Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
Link: https://lore.kernel.org/r/20241218201048.E544818E57E@bout3.ijzerbout.nl
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/iommu.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 79e0da9eb626c..8f75c11a3ec48 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -4090,13 +4090,14 @@ void domain_remove_dev_pasid(struct iommu_domain *domain,
break;
}
}
- WARN_ON_ONCE(!dev_pasid);
spin_unlock_irqrestore(&dmar_domain->lock, flags);
cache_tag_unassign_domain(dmar_domain, dev, pasid);
domain_detach_iommu(dmar_domain, iommu);
- intel_iommu_debugfs_remove_dev_pasid(dev_pasid);
- kfree(dev_pasid);
+ if (!WARN_ON_ONCE(!dev_pasid)) {
+ intel_iommu_debugfs_remove_dev_pasid(dev_pasid);
+ kfree(dev_pasid);
+ }
}
static void intel_iommu_remove_dev_pasid(struct device *dev, ioasid_t pasid,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 097/443] platform/x86: acer-wmi: Add support for Acer Predator PH16-72
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 096/443] iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 098/443] ASoC: amd: Add ACPI dependency to fix build error Greg Kroah-Hartman
` (356 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Johnsten, Armin Wolf,
Ilpo Järvinen, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit c85b516b44d21e9cf751c4f73a6c235ed170d887 ]
Add the Acer Predator PT16-72 to acer_quirks to provide support
for the turbo button and predator_v4 interfaces.
Tested-by: Eric Johnsten <ejohnsten@gmail.com>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20250107175652.3171-1-W_Armin@gmx.de
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/acer-wmi.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 5cff538ee67fa..3c211eee95f42 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -393,6 +393,13 @@ static struct quirk_entry quirk_acer_predator_ph315_53 = {
.gpu_fans = 1,
};
+static struct quirk_entry quirk_acer_predator_ph16_72 = {
+ .turbo = 1,
+ .cpu_fans = 1,
+ .gpu_fans = 1,
+ .predator_v4 = 1,
+};
+
static struct quirk_entry quirk_acer_predator_pt14_51 = {
.turbo = 1,
.cpu_fans = 1,
@@ -598,6 +605,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = {
},
.driver_data = &quirk_acer_predator_v4,
},
+ {
+ .callback = dmi_matched,
+ .ident = "Acer Predator PH16-72",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Predator PH16-72"),
+ },
+ .driver_data = &quirk_acer_predator_ph16_72,
+ },
{
.callback = dmi_matched,
.ident = "Acer Predator PH18-71",
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 098/443] ASoC: amd: Add ACPI dependency to fix build error
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 097/443] platform/x86: acer-wmi: Add support for Acer Predator PH16-72 Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 099/443] Input: allocate keycode for phone linking Greg Kroah-Hartman
` (355 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Yu-Chun Lin,
Mark Brown, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu-Chun Lin <eleanor15x@gmail.com>
[ Upstream commit 7e24ec93aecd12e33d31e38e5af4625553bbc727 ]
As reported by the kernel test robot, the following error occurs:
sound/soc/amd/yc/acp6x-mach.c: In function 'acp6x_probe':
>> sound/soc/amd/yc/acp6x-mach.c:573:15: error: implicit declaration of function 'acpi_evaluate_integer'; did you mean 'acpi_evaluate_object'? [-Werror=implicit-function-declaration]
573 | ret = acpi_evaluate_integer(handle, "_WOV", NULL, &dmic_status);
| ^~~~~~~~~~~~~~~~~~~~~
| acpi_evaluate_object
cc1: some warnings being treated as errors
The function 'acpi_evaluate_integer' and its prototype in 'acpi_bus.h'
are only available when 'CONFIG_ACPI' is enabled. Add a 'depends on ACPI'
directive in Kconfig to ensure proper compilation.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202501090345.pBIDRTym-lkp@intel.com/
Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com>
Link: https://patch.msgid.link/20250109171547.362412-1-eleanor15x@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/amd/Kconfig b/sound/soc/amd/Kconfig
index c7590d4989bba..8035211782791 100644
--- a/sound/soc/amd/Kconfig
+++ b/sound/soc/amd/Kconfig
@@ -105,7 +105,7 @@ config SND_SOC_AMD_ACP6x
config SND_SOC_AMD_YC_MACH
tristate "AMD YC support for DMIC"
select SND_SOC_DMIC
- depends on SND_SOC_AMD_ACP6x
+ depends on SND_SOC_AMD_ACP6x && ACPI
help
This option enables machine driver for Yellow Carp platform
using dmic. ACP IP has PDM Decoder block with DMA controller.
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 099/443] Input: allocate keycode for phone linking
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 098/443] ASoC: amd: Add ACPI dependency to fix build error Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 100/443] platform/x86: acer-wmi: add support for Acer Nitro AN515-58 Greg Kroah-Hartman
` (354 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Illia Ostapyshyn, Dmitry Torokhov,
Ilpo Järvinen, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Illia Ostapyshyn <illia@yshyn.com>
[ Upstream commit 1bebc7869c99d466f819dd2cffaef0edf7d7a035 ]
The F11 key on the new Lenovo Thinkpad T14 Gen 5, T16 Gen 3, and P14s
Gen 5 laptops includes a symbol showing a smartphone and a laptop
chained together. According to the user manual, it starts the Microsoft
Phone Link software used to connect to Android/iOS devices and relay
messages/calls or sync data.
As there are no suitable keycodes for this action, introduce a new one.
Signed-off-by: Illia Ostapyshyn <illia@yshyn.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://lore.kernel.org/r/20241114173930.44983-2-illia@yshyn.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/input-event-codes.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index a4206723f5033..5a199f3d4a26a 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -519,6 +519,7 @@
#define KEY_NOTIFICATION_CENTER 0x1bc /* Show/hide the notification center */
#define KEY_PICKUP_PHONE 0x1bd /* Answer incoming call */
#define KEY_HANGUP_PHONE 0x1be /* Decline incoming call */
+#define KEY_LINK_PHONE 0x1bf /* AL Phone Syncing */
#define KEY_DEL_EOL 0x1c0
#define KEY_DEL_EOS 0x1c1
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 100/443] platform/x86: acer-wmi: add support for Acer Nitro AN515-58
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 099/443] Input: allocate keycode for phone linking Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 101/443] platform/x86: acer-wmi: Ignore AC events Greg Kroah-Hartman
` (353 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hridesh MG, Kurt Borja,
Ilpo Järvinen, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hridesh MG <hridesh699@gmail.com>
[ Upstream commit 549fcf58cf5837d401d0de906093169b05365609 ]
Add predator_v4 quirk for the Acer Nitro AN515-58 to enable fan speed
monitoring and platform_profile handling.
Signed-off-by: Hridesh MG <hridesh699@gmail.com>
Reviewed-by: Kurt Borja <kuurtb@gmail.com>
Link: https://lore.kernel.org/r/20250113-platform_profile-v4-5-23be0dff19f1@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/acer-wmi.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 3c211eee95f42..1b966b75cb979 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -578,6 +578,15 @@ static const struct dmi_system_id acer_quirks[] __initconst = {
},
.driver_data = &quirk_acer_travelmate_2490,
},
+ {
+ .callback = dmi_matched,
+ .ident = "Acer Nitro AN515-58",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Nitro AN515-58"),
+ },
+ .driver_data = &quirk_acer_predator_v4,
+ },
{
.callback = dmi_matched,
.ident = "Acer Predator PH315-53",
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 101/443] platform/x86: acer-wmi: Ignore AC events
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 100/443] platform/x86: acer-wmi: add support for Acer Nitro AN515-58 Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 102/443] tty: xilinx_uartps: split sysrq handling Greg Kroah-Hartman
` (352 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Farhan Anwar, Rayan Margham,
Ilpo Järvinen, Armin Wolf, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit f6bfa25c6665f8721421ea94fe506cc22f1d4b43 ]
On the Acer Swift SFG14-41, the events 8 - 1 and 8 - 0 are printed on
AC connect/disconnect. Ignore those events to avoid spamming the
kernel log with error messages.
Reported-by: Farhan Anwar <farhan.anwar8@gmail.com>
Closes: https://lore.kernel.org/platform-driver-x86/2ffb529d-e7c8-4026-a3b8-120c8e7afec8@gmail.com
Tested-by: Rayan Margham <rayanmargham4@gmail.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20250119201723.11102-2-W_Armin@gmx.de
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/acer-wmi.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 1b966b75cb979..ac4f8ab45bdc0 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -95,6 +95,7 @@ enum acer_wmi_event_ids {
WMID_HOTKEY_EVENT = 0x1,
WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
WMID_GAMING_TURBO_KEY_EVENT = 0x7,
+ WMID_AC_EVENT = 0x8,
};
enum acer_wmi_predator_v4_sys_info_command {
@@ -2321,6 +2322,9 @@ static void acer_wmi_notify(union acpi_object *obj, void *context)
if (return_value.key_num == 0x5 && has_cap(ACER_CAP_PLATFORM_PROFILE))
acer_thermal_profile_change();
break;
+ case WMID_AC_EVENT:
+ /* We ignore AC events here */
+ break;
default:
pr_warn("Unknown function number - %d - %d\n",
return_value.function, return_value.key_num);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 102/443] tty: xilinx_uartps: split sysrq handling
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 101/443] platform/x86: acer-wmi: Ignore AC events Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 103/443] tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN Greg Kroah-Hartman
` (351 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Anderson, John Ogness
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <sean.anderson@linux.dev>
commit b06f388994500297bb91be60ffaf6825ecfd2afe upstream.
lockdep detects the following circular locking dependency:
CPU 0 CPU 1
========================== ============================
cdns_uart_isr() printk()
uart_port_lock(port) console_lock()
cdns_uart_console_write()
if (!port->sysrq)
uart_port_lock(port)
uart_handle_break()
port->sysrq = ...
uart_handle_sysrq_char()
printk()
console_lock()
The fixed commit attempts to avoid this situation by only taking the
port lock in cdns_uart_console_write if port->sysrq unset. However, if
(as shown above) cdns_uart_console_write runs before port->sysrq is set,
then it will try to take the port lock anyway. This may result in a
deadlock.
Fix this by splitting sysrq handling into two parts. We use the prepare
helper under the port lock and defer handling until we release the lock.
Fixes: 74ea66d4ca06 ("tty: xuartps: Improve sysrq handling")
Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
Cc: stable@vger.kernel.org # c980248179d: serial: xilinx_uartps: Use port lock wrappers
Acked-by: John Ogness <john.ogness@linutronix.de>
Link: https://lore.kernel.org/r/20250110213822.2107462-1-sean.anderson@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/xilinx_uartps.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -287,7 +287,7 @@ static void cdns_uart_handle_rx(void *de
continue;
}
- if (uart_handle_sysrq_char(port, data))
+ if (uart_prepare_sysrq_char(port, data))
continue;
if (is_rxbs_support) {
@@ -495,7 +495,7 @@ static irqreturn_t cdns_uart_isr(int irq
!(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS))
cdns_uart_handle_rx(dev_id, isrstatus);
- uart_port_unlock(port);
+ uart_unlock_and_check_sysrq(port);
return IRQ_HANDLED;
}
@@ -1380,9 +1380,7 @@ static void cdns_uart_console_write(stru
unsigned int imr, ctrl;
int locked = 1;
- if (port->sysrq)
- locked = 0;
- else if (oops_in_progress)
+ if (oops_in_progress)
locked = uart_port_trylock_irqsave(port, &flags);
else
uart_port_lock_irqsave(port, &flags);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 103/443] tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 102/443] tty: xilinx_uartps: split sysrq handling Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 104/443] platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL Greg Kroah-Hartman
` (350 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Günther Noack,
Kees Cook
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Günther Noack <gnoack@google.com>
commit 2f83e38a095f8bf7c6029883d894668b03b9bd93 upstream.
With this, processes without CAP_SYS_ADMIN are able to use TIOCLINUX with
subcode TIOCL_SETSEL, in the selection modes TIOCL_SETPOINTER,
TIOCL_SELCLEAR and TIOCL_SELMOUSEREPORT.
TIOCL_SETSEL was previously changed to require CAP_SYS_ADMIN, as this IOCTL
let callers change the selection buffer and could be used to simulate
keypresses. These three TIOCL_SETSEL selection modes, however, are safe to
use, as they do not modify the selection buffer.
This fixes a mouse support regression that affected Emacs (invisible mouse
cursor).
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/ee3ec63269b43b34e1c90dd8c9743bf8@finder.org
Fixes: 8d1b43f6a6df ("tty: Restrict access to TIOCLINUX' copy-and-paste subcommands")
Signed-off-by: Günther Noack <gnoack@google.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/r/20250110142122.1013222-1-gnoack@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/vt/selection.c | 14 ++++++++++++++
drivers/tty/vt/vt.c | 2 --
2 files changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -192,6 +192,20 @@ int set_selection_user(const struct tioc
if (copy_from_user(&v, sel, sizeof(*sel)))
return -EFAULT;
+ /*
+ * TIOCL_SELCLEAR, TIOCL_SELPOINTER and TIOCL_SELMOUSEREPORT are OK to
+ * use without CAP_SYS_ADMIN as they do not modify the selection.
+ */
+ switch (v.sel_mode) {
+ case TIOCL_SELCLEAR:
+ case TIOCL_SELPOINTER:
+ case TIOCL_SELMOUSEREPORT:
+ break;
+ default:
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+ }
+
return set_selection_kernel(&v, tty);
}
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -3345,8 +3345,6 @@ int tioclinux(struct tty_struct *tty, un
switch (type) {
case TIOCL_SETSEL:
- if (!capable(CAP_SYS_ADMIN))
- return -EPERM;
return set_selection_user(param, tty);
case TIOCL_PASTESEL:
if (!capable(CAP_SYS_ADMIN))
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 104/443] platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 103/443] tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 105/443] sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue Greg Kroah-Hartman
` (349 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Hans de Goede,
Andy Shevchenko
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit 478b00a623d6c8ae23a1be7bcc96cb5497045cef upstream.
dell_uart_bl_pdev_probe() calls get_serdev_controller() with the
serial_ctrl_uid parameter set to NULL.
In case of errors this NULL parameter then gets passed to pr_err()
as argument matching a "%s" conversion specification. This leads to
compiler warnings when building with "make W=1".
Check serial_ctrl_uid before passing it to pr_err() to avoid these.
Fixes: dc5afd720f84 ("platform/x86: Add new get_serdev_controller() helper")
Cc: stable@vger.kernel.org
Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://lore.kernel.org/r/20241204204227.95757-4-hdegoede@redhat.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/serdev_helpers.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/platform/x86/serdev_helpers.h
+++ b/drivers/platform/x86/serdev_helpers.h
@@ -35,7 +35,7 @@ get_serdev_controller(const char *serial
ctrl_adev = acpi_dev_get_first_match_dev(serial_ctrl_hid, serial_ctrl_uid, -1);
if (!ctrl_adev) {
pr_err("error could not get %s/%s serial-ctrl adev\n",
- serial_ctrl_hid, serial_ctrl_uid);
+ serial_ctrl_hid, serial_ctrl_uid ?: "*");
return ERR_PTR(-ENODEV);
}
@@ -43,7 +43,7 @@ get_serdev_controller(const char *serial
ctrl_dev = get_device(acpi_get_first_physical_node(ctrl_adev));
if (!ctrl_dev) {
pr_err("error could not get %s/%s serial-ctrl physical node\n",
- serial_ctrl_hid, serial_ctrl_uid);
+ serial_ctrl_hid, serial_ctrl_uid ?: "*");
ctrl_dev = ERR_PTR(-ENODEV);
goto put_ctrl_adev;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 105/443] sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 104/443] platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 106/443] nvme: handle connectivity loss in nvme_set_queue_count Greg Kroah-Hartman
` (348 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, K Prateek Nayak,
Peter Zijlstra (Intel), Gautham R. Shenoy, Swapnil Sapkal,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: K Prateek Nayak <kprateek.nayak@amd.com>
[ Upstream commit 3429dd57f0deb1a602c2624a1dd7c4c11b6c4734 ]
set_delayed() adjusts cfs_rq->h_nr_runnable for the hierarchy when an
entity is delayed irrespective of whether the entity corresponds to a
task or a cfs_rq.
Consider the following scenario:
root
/ \
A B (*) delayed since B is no longer eligible on root
| |
Task0 Task1 <--- dequeue_task_fair() - task blocks
When Task1 blocks (dequeue_entity() for task's se returns true),
dequeue_entities() will continue adjusting cfs_rq->h_nr_* for the
hierarchy of Task1. However, when the sched_entity corresponding to
cfs_rq B is delayed, set_delayed() will adjust the h_nr_runnable for the
hierarchy too leading to both dequeue_entity() and set_delayed()
decrementing h_nr_runnable for the dequeue of the same task.
A SCHED_WARN_ON() to inspect h_nr_runnable post its update in
dequeue_entities() like below:
cfs_rq->h_nr_runnable -= h_nr_runnable;
SCHED_WARN_ON(((int) cfs_rq->h_nr_runnable) < 0);
is consistently tripped when running wakeup intensive workloads like
hackbench in a cgroup.
This error is self correcting since cfs_rq are per-cpu and cannot
migrate. The entitiy is either picked for full dequeue or is requeued
when a task wakes up below it. Both those paths call clear_delayed()
which again increments h_nr_runnable of the hierarchy without
considering if the entity corresponds to a task or not.
h_nr_runnable will eventually reflect the correct value however in the
interim, the incorrect values can still influence PELT calculation which
uses se->runnable_weight or cfs_rq->h_nr_runnable.
Since only delayed tasks take the early return path in
dequeue_entities() and enqueue_task_fair(), adjust the
h_nr_runnable in {set,clear}_delayed() only when a task is delayed as
this path skips the h_nr_* update loops and returns early.
For entities corresponding to cfs_rq, the h_nr_* update loop in the
caller will do the right thing.
Fixes: 76f2f783294d ("sched/eevdf: More PELT vs DELAYED_DEQUEUE")
Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
Tested-by: Swapnil Sapkal <swapnil.sapkal@amd.com>
Link: https://lkml.kernel.org/r/20250117105852.23908-1-kprateek.nayak@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 8800679b508d9..7d0a05660e5ef 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5372,6 +5372,15 @@ static __always_inline void return_cfs_rq_runtime(struct cfs_rq *cfs_rq);
static void set_delayed(struct sched_entity *se)
{
se->sched_delayed = 1;
+
+ /*
+ * Delayed se of cfs_rq have no tasks queued on them.
+ * Do not adjust h_nr_runnable since dequeue_entities()
+ * will account it for blocked tasks.
+ */
+ if (!entity_is_task(se))
+ return;
+
for_each_sched_entity(se) {
struct cfs_rq *cfs_rq = cfs_rq_of(se);
@@ -5384,6 +5393,16 @@ static void set_delayed(struct sched_entity *se)
static void clear_delayed(struct sched_entity *se)
{
se->sched_delayed = 0;
+
+ /*
+ * Delayed se of cfs_rq have no tasks queued on them.
+ * Do not adjust h_nr_runnable since a dequeue has
+ * already accounted for it or an enqueue of a task
+ * below it will account for it in enqueue_task_fair().
+ */
+ if (!entity_is_task(se))
+ return;
+
for_each_sched_entity(se) {
struct cfs_rq *cfs_rq = cfs_rq_of(se);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 106/443] nvme: handle connectivity loss in nvme_set_queue_count
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 105/443] sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 107/443] nvmet: fix a memory leak in controller identify Greg Kroah-Hartman
` (347 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Hannes Reinecke,
Sagi Grimberg, Daniel Wagner, Keith Busch, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <wagi@kernel.org>
[ Upstream commit 294b2b7516fd06a8dd82e4a6118f318ec521e706 ]
When the set feature attempts fails with any NVME status code set in
nvme_set_queue_count, the function still report success. Though the
numbers of queues set to 0. This is done to support controllers in
degraded state (the admin queue is still up and running but no IO
queues).
Though there is an exception. When nvme_set_features reports an host
path error, nvme_set_queue_count should propagate this error as the
connectivity is lost, which means also the admin queue is not working
anymore.
Fixes: 9a0be7abb62f ("nvme: refactor set_queue_count")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Daniel Wagner <wagi@kernel.org>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 12e7ae1f99e20..46e04b30f6425 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1695,7 +1695,13 @@ int nvme_set_queue_count(struct nvme_ctrl *ctrl, int *count)
status = nvme_set_features(ctrl, NVME_FEAT_NUM_QUEUES, q_count, NULL, 0,
&result);
- if (status < 0)
+
+ /*
+ * It's either a kernel error or the host observed a connection
+ * lost. In either case it's not possible communicate with the
+ * controller and thus enter the error code path.
+ */
+ if (status < 0 || status == NVME_SC_HOST_PATH_ERROR)
return status;
/*
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 107/443] nvmet: fix a memory leak in controller identify
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 106/443] nvme: handle connectivity loss in nvme_set_queue_count Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 108/443] firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry Greg Kroah-Hartman
` (346 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Nilay Shroff,
Keith Busch, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit 58f5c8d5ca07a2f9fa93fb073f5b1646ec482ff2 ]
Simply free an allocated buffer once we copied its content
to the request sgl.
kmemleak complaint:
unreferenced object 0xffff8cd40c388000 (size 4096):
comm "kworker/2:2H", pid 14739, jiffies 4401313113
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 0):
[<ffffffff9e01087a>] kmemleak_alloc+0x4a/0x90
[<ffffffff9d30324a>] __kmalloc_cache_noprof+0x35a/0x420
[<ffffffffc180b0e2>] nvmet_execute_identify+0x912/0x9f0 [nvmet]
[<ffffffffc181a72c>] nvmet_tcp_try_recv_pdu+0x84c/0xc90 [nvmet_tcp]
[<ffffffffc181ac02>] nvmet_tcp_io_work+0x82/0x8b0 [nvmet_tcp]
[<ffffffff9cfa7158>] process_one_work+0x178/0x3e0
[<ffffffff9cfa8e9c>] worker_thread+0x2ec/0x420
[<ffffffff9cfb2140>] kthread+0xf0/0x120
[<ffffffff9cee36a4>] ret_from_fork+0x44/0x70
[<ffffffff9ce7fdda>] ret_from_fork_asm+0x1a/0x30
Fixes: 84909f7decbd ("nvmet: use kzalloc instead of ZERO_PAGE in nvme_execute_identify_ns_nvm()")
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/admin-cmd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index fa89b0549c36c..7b70635373fd8 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -915,6 +915,7 @@ static void nvme_execute_identify_ns_nvm(struct nvmet_req *req)
goto out;
}
status = nvmet_copy_to_sgl(req, 0, id, sizeof(*id));
+ kfree(id);
out:
nvmet_req_complete(req, status);
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 108/443] firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 107/443] nvmet: fix a memory leak in controller identify Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 109/443] gpu: drm_dp_cec: fix broken CEC adapter properties check Greg Kroah-Hartman
` (345 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prasad Pandit, Konrad Rzeszutek Wilk,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prasad Pandit <pjp@fedoraproject.org>
[ Upstream commit e1e17a1715982201034024863efbf238bee2bdf9 ]
Fix ISCSI_IBFT Kconfig entry, replace tab with a space character.
Fixes: 138fe4e0697 ("Firmware: add iSCSI iBFT Support")
Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 71d8b26c4103b..9f35f69e0f9e2 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -106,7 +106,7 @@ config ISCSI_IBFT
select ISCSI_BOOT_SYSFS
select ISCSI_IBFT_FIND if X86
depends on ACPI && SCSI && SCSI_LOWLEVEL
- default n
+ default n
help
This option enables support for detection and exposing of iSCSI
Boot Firmware Table (iBFT) via sysfs to userspace. If you wish to
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 109/443] gpu: drm_dp_cec: fix broken CEC adapter properties check
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 108/443] firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 110/443] ice: put Rx buffers after being done with current frame Greg Kroah-Hartman
` (344 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Farblos,
Dmitry Baryshkov, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil@xs4all.nl>
[ Upstream commit 6daaae5ff7f3b23a2dacc9c387ff3d4f95b67cad ]
If the hotplug detect of a display is low for longer than one second
(configurable through drm_dp_cec_unregister_delay), then the CEC adapter
is unregistered since we assume the display was disconnected. If the
HPD went low for less than one second, then we check if the properties
of the CEC adapter have changed, since that indicates that we actually
switch to new hardware and we have to unregister the old CEC device and
register a new one.
Unfortunately, the test for changed properties was written poorly, and
after a new CEC capability was added to the CEC core code the test always
returned true (i.e. the properties had changed).
As a result the CEC device was unregistered and re-registered for every
HPD toggle. If the CEC remote controller integration was also enabled
(CONFIG_MEDIA_CEC_RC was set), then the corresponding input device was
also unregistered and re-registered. As a result the input device in
/sys would keep incrementing its number, e.g.:
/sys/devices/pci0000:00/0000:00:08.1/0000:e7:00.0/rc/rc0/input20
Since short HPD toggles are common, the number could over time get into
the thousands.
While not a serious issue (i.e. nothing crashes), it is not intended
to work that way.
This patch changes the test so that it only checks for the single CEC
capability that can actually change, and it ignores any other
capabilities, so this is now safe as well if new caps are added in
the future.
With the changed test the bit under #ifndef CONFIG_MEDIA_CEC_RC can be
dropped as well, so that's a nice cleanup.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Reported-by: Farblos <farblos@vodafonemail.de>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Fixes: 2c6d1fffa1d9 ("drm: add support for DisplayPort CEC-Tunneling-over-AUX")
Tested-by: Farblos <farblos@vodafonemail.de>
Link: https://patchwork.freedesktop.org/patch/msgid/361bb03d-1691-4e23-84da-0861ead5dbdc@xs4all.nl
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/display/drm_dp_cec.c | 14 +++-----------
1 file changed, 3 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/display/drm_dp_cec.c b/drivers/gpu/drm/display/drm_dp_cec.c
index 007ceb281d00d..56a4965e518cc 100644
--- a/drivers/gpu/drm/display/drm_dp_cec.c
+++ b/drivers/gpu/drm/display/drm_dp_cec.c
@@ -311,16 +311,6 @@ void drm_dp_cec_attach(struct drm_dp_aux *aux, u16 source_physical_address)
if (!aux->transfer)
return;
-#ifndef CONFIG_MEDIA_CEC_RC
- /*
- * CEC_CAP_RC is part of CEC_CAP_DEFAULTS, but it is stripped by
- * cec_allocate_adapter() if CONFIG_MEDIA_CEC_RC is undefined.
- *
- * Do this here as well to ensure the tests against cec_caps are
- * correct.
- */
- cec_caps &= ~CEC_CAP_RC;
-#endif
cancel_delayed_work_sync(&aux->cec.unregister_work);
mutex_lock(&aux->cec.lock);
@@ -337,7 +327,9 @@ void drm_dp_cec_attach(struct drm_dp_aux *aux, u16 source_physical_address)
num_las = CEC_MAX_LOG_ADDRS;
if (aux->cec.adap) {
- if (aux->cec.adap->capabilities == cec_caps &&
+ /* Check if the adapter properties have changed */
+ if ((aux->cec.adap->capabilities & CEC_CAP_MONITOR_ALL) ==
+ (cec_caps & CEC_CAP_MONITOR_ALL) &&
aux->cec.adap->available_log_addrs == num_las) {
/* Unchanged, so just set the phys addr */
cec_s_phys_addr(aux->cec.adap, source_physical_address, false);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 110/443] ice: put Rx buffers after being done with current frame
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 109/443] gpu: drm_dp_cec: fix broken CEC adapter properties check Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 111/443] ice: gather page_count()s of each frag right before XDP prog call Greg Kroah-Hartman
` (343 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Simon Horman,
Jacob Keller, Maciej Fijalkowski, Tony Nguyen, Sasha Levin, Xu Du,
Chandan Kumar Rout
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
[ Upstream commit 743bbd93cf29f653fae0e1416a31f03231689911 ]
Introduce a new helper ice_put_rx_mbuf() that will go through gathered
frags from current frame and will call ice_put_rx_buf() on them. Current
logic that was supposed to simplify and optimize the driver where we go
through a batch of all buffers processed in current NAPI instance turned
out to be broken for jumbo frames and very heavy load that was coming
from both multi-thread iperf and nginx/wrk pair between server and
client. The delay introduced by approach that we are dropping is simply
too big and we need to take the decision regarding page
recycling/releasing as quick as we can.
While at it, address an error path of ice_add_xdp_frag() - we were
missing buffer putting from day 1 there.
As a nice side effect we get rid of annoying and repetitive three-liner:
xdp->data = NULL;
rx_ring->first_desc = ntc;
rx_ring->nr_frags = 0;
by embedding it within introduced routine.
Fixes: 1dc1a7e7f410 ("ice: Centrallize Rx buffer recycling")
Reported-and-tested-by: Xu Du <xudu@redhat.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Co-developed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_txrx.c | 79 ++++++++++++++---------
1 file changed, 50 insertions(+), 29 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index 5d2d7736fd5f1..e173d9c989883 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -1103,6 +1103,49 @@ ice_put_rx_buf(struct ice_rx_ring *rx_ring, struct ice_rx_buf *rx_buf)
rx_buf->page = NULL;
}
+/**
+ * ice_put_rx_mbuf - ice_put_rx_buf() caller, for all frame frags
+ * @rx_ring: Rx ring with all the auxiliary data
+ * @xdp: XDP buffer carrying linear + frags part
+ * @xdp_xmit: XDP_TX/XDP_REDIRECT verdict storage
+ * @ntc: a current next_to_clean value to be stored at rx_ring
+ *
+ * Walk through gathered fragments and satisfy internal page
+ * recycle mechanism; we take here an action related to verdict
+ * returned by XDP program;
+ */
+static void ice_put_rx_mbuf(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp,
+ u32 *xdp_xmit, u32 ntc)
+{
+ u32 nr_frags = rx_ring->nr_frags + 1;
+ u32 idx = rx_ring->first_desc;
+ u32 cnt = rx_ring->count;
+ struct ice_rx_buf *buf;
+ int i;
+
+ for (i = 0; i < nr_frags; i++) {
+ buf = &rx_ring->rx_buf[idx];
+
+ if (buf->act & (ICE_XDP_TX | ICE_XDP_REDIR)) {
+ ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
+ *xdp_xmit |= buf->act;
+ } else if (buf->act & ICE_XDP_CONSUMED) {
+ buf->pagecnt_bias++;
+ } else if (buf->act == ICE_XDP_PASS) {
+ ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
+ }
+
+ ice_put_rx_buf(rx_ring, buf);
+
+ if (++idx == cnt)
+ idx = 0;
+ }
+
+ xdp->data = NULL;
+ rx_ring->first_desc = ntc;
+ rx_ring->nr_frags = 0;
+}
+
/**
* ice_clean_rx_irq - Clean completed descriptors from Rx ring - bounce buf
* @rx_ring: Rx descriptor ring to transact packets on
@@ -1120,7 +1163,6 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
unsigned int total_rx_bytes = 0, total_rx_pkts = 0;
unsigned int offset = rx_ring->rx_offset;
struct xdp_buff *xdp = &rx_ring->xdp;
- u32 cached_ntc = rx_ring->first_desc;
struct ice_tx_ring *xdp_ring = NULL;
struct bpf_prog *xdp_prog = NULL;
u32 ntc = rx_ring->next_to_clean;
@@ -1128,7 +1170,6 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
u32 xdp_xmit = 0;
u32 cached_ntu;
bool failure;
- u32 first;
xdp_prog = READ_ONCE(rx_ring->xdp_prog);
if (xdp_prog) {
@@ -1190,6 +1231,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
xdp_prepare_buff(xdp, hard_start, offset, size, !!offset);
xdp_buff_clear_frags_flag(xdp);
} else if (ice_add_xdp_frag(rx_ring, xdp, rx_buf, size)) {
+ ice_put_rx_mbuf(rx_ring, xdp, NULL, ntc);
break;
}
if (++ntc == cnt)
@@ -1205,9 +1247,8 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
total_rx_bytes += xdp_get_buff_len(xdp);
total_rx_pkts++;
- xdp->data = NULL;
- rx_ring->first_desc = ntc;
- rx_ring->nr_frags = 0;
+ ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc);
+
continue;
construct_skb:
if (likely(ice_ring_uses_build_skb(rx_ring)))
@@ -1221,14 +1262,11 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
if (unlikely(xdp_buff_has_frags(xdp)))
ice_set_rx_bufs_act(xdp, rx_ring,
ICE_XDP_CONSUMED);
- xdp->data = NULL;
- rx_ring->first_desc = ntc;
- rx_ring->nr_frags = 0;
- break;
}
- xdp->data = NULL;
- rx_ring->first_desc = ntc;
- rx_ring->nr_frags = 0;
+ ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc);
+
+ if (!skb)
+ break;
stat_err_bits = BIT(ICE_RX_FLEX_DESC_STATUS0_RXE_S);
if (unlikely(ice_test_staterr(rx_desc->wb.status_error0,
@@ -1257,23 +1295,6 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
total_rx_pkts++;
}
- first = rx_ring->first_desc;
- while (cached_ntc != first) {
- struct ice_rx_buf *buf = &rx_ring->rx_buf[cached_ntc];
-
- if (buf->act & (ICE_XDP_TX | ICE_XDP_REDIR)) {
- ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
- xdp_xmit |= buf->act;
- } else if (buf->act & ICE_XDP_CONSUMED) {
- buf->pagecnt_bias++;
- } else if (buf->act == ICE_XDP_PASS) {
- ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
- }
-
- ice_put_rx_buf(rx_ring, buf);
- if (++cached_ntc >= cnt)
- cached_ntc = 0;
- }
rx_ring->next_to_clean = ntc;
/* return up to cleaned_count buffers to hardware */
failure = ice_alloc_rx_bufs(rx_ring, ICE_RX_DESC_UNUSED(rx_ring));
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 111/443] ice: gather page_count()s of each frag right before XDP prog call
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 110/443] ice: put Rx buffers after being done with current frame Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 112/443] ice: stop storing XDP verdict within ice_rx_buf Greg Kroah-Hartman
` (342 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Simon Horman,
Jacob Keller, Maciej Fijalkowski, Tony Nguyen, Sasha Levin, Xu Du,
Chandan Kumar Rout
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
[ Upstream commit 11c4aa074d547d825b19cd8d9f288254d89d805c ]
If we store the pgcnt on few fragments while being in the middle of
gathering the whole frame and we stumbled upon DD bit not being set, we
terminate the NAPI Rx processing loop and come back later on. Then on
next NAPI execution we work on previously stored pgcnt.
Imagine that second half of page was used actively by networking stack
and by the time we came back, stack is not busy with this page anymore
and decremented the refcnt. The page reuse algorithm in this case should
be good to reuse the page but given the old refcnt it will not do so and
attempt to release the page via page_frag_cache_drain() with
pagecnt_bias used as an arg. This in turn will result in negative refcnt
on struct page, which was initially observed by Xu Du.
Therefore, move the page count storage from ice_get_rx_buf() to a place
where we are sure that whole frame has been collected, but before
calling XDP program as it internally can also change the page count of
fragments belonging to xdp_buff.
Fixes: ac0753391195 ("ice: Store page count inside ice_rx_buf")
Reported-and-tested-by: Xu Du <xudu@redhat.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Co-developed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_txrx.c | 27 ++++++++++++++++++++++-
1 file changed, 26 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index e173d9c989883..cf46bcf143b4b 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -924,7 +924,6 @@ ice_get_rx_buf(struct ice_rx_ring *rx_ring, const unsigned int size,
struct ice_rx_buf *rx_buf;
rx_buf = &rx_ring->rx_buf[ntc];
- rx_buf->pgcnt = page_count(rx_buf->page);
prefetchw(rx_buf->page);
if (!size)
@@ -940,6 +939,31 @@ ice_get_rx_buf(struct ice_rx_ring *rx_ring, const unsigned int size,
return rx_buf;
}
+/**
+ * ice_get_pgcnts - grab page_count() for gathered fragments
+ * @rx_ring: Rx descriptor ring to store the page counts on
+ *
+ * This function is intended to be called right before running XDP
+ * program so that the page recycling mechanism will be able to take
+ * a correct decision regarding underlying pages; this is done in such
+ * way as XDP program can change the refcount of page
+ */
+static void ice_get_pgcnts(struct ice_rx_ring *rx_ring)
+{
+ u32 nr_frags = rx_ring->nr_frags + 1;
+ u32 idx = rx_ring->first_desc;
+ struct ice_rx_buf *rx_buf;
+ u32 cnt = rx_ring->count;
+
+ for (int i = 0; i < nr_frags; i++) {
+ rx_buf = &rx_ring->rx_buf[idx];
+ rx_buf->pgcnt = page_count(rx_buf->page);
+
+ if (++idx == cnt)
+ idx = 0;
+ }
+}
+
/**
* ice_build_skb - Build skb around an existing buffer
* @rx_ring: Rx descriptor ring to transact packets on
@@ -1241,6 +1265,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
if (ice_is_non_eop(rx_ring, rx_desc))
continue;
+ ice_get_pgcnts(rx_ring);
ice_run_xdp(rx_ring, xdp, xdp_prog, xdp_ring, rx_buf, rx_desc);
if (rx_buf->act == ICE_XDP_PASS)
goto construct_skb;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 112/443] ice: stop storing XDP verdict within ice_rx_buf
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 111/443] ice: gather page_count()s of each frag right before XDP prog call Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 113/443] nvme: make nvme_tls_attrs_group static Greg Kroah-Hartman
` (341 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Simon Horman,
Maciej Fijalkowski, Tony Nguyen, Sasha Levin, Chandan Kumar Rout
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
[ Upstream commit 468a1952df78f65c5991b7ac885c8b5b7dd87bab ]
Idea behind having ice_rx_buf::act was to simplify and speed up the Rx
data path by walking through buffers that were representing cleaned HW
Rx descriptors. Since it caused us a major headache recently and we
rolled back to old approach that 'puts' Rx buffers right after running
XDP prog/creating skb, this is useless now and should be removed.
Get rid of ice_rx_buf::act and related logic. We still need to take care
of a corner case where XDP program releases a particular fragment.
Make ice_run_xdp() to return its result and use it within
ice_put_rx_mbuf().
Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side")
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_txrx.c | 62 +++++++++++--------
drivers/net/ethernet/intel/ice/ice_txrx.h | 1 -
drivers/net/ethernet/intel/ice/ice_txrx_lib.h | 43 -------------
3 files changed, 36 insertions(+), 70 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index cf46bcf143b4b..9c9ea4c1b93b7 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -527,15 +527,14 @@ int ice_setup_rx_ring(struct ice_rx_ring *rx_ring)
* @xdp: xdp_buff used as input to the XDP program
* @xdp_prog: XDP program to run
* @xdp_ring: ring to be used for XDP_TX action
- * @rx_buf: Rx buffer to store the XDP action
* @eop_desc: Last descriptor in packet to read metadata from
*
* Returns any of ICE_XDP_{PASS, CONSUMED, TX, REDIR}
*/
-static void
+static u32
ice_run_xdp(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp,
struct bpf_prog *xdp_prog, struct ice_tx_ring *xdp_ring,
- struct ice_rx_buf *rx_buf, union ice_32b_rx_flex_desc *eop_desc)
+ union ice_32b_rx_flex_desc *eop_desc)
{
unsigned int ret = ICE_XDP_PASS;
u32 act;
@@ -574,7 +573,7 @@ ice_run_xdp(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp,
ret = ICE_XDP_CONSUMED;
}
exit:
- ice_set_rx_bufs_act(xdp, rx_ring, ret);
+ return ret;
}
/**
@@ -860,10 +859,8 @@ ice_add_xdp_frag(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp,
xdp_buff_set_frags_flag(xdp);
}
- if (unlikely(sinfo->nr_frags == MAX_SKB_FRAGS)) {
- ice_set_rx_bufs_act(xdp, rx_ring, ICE_XDP_CONSUMED);
+ if (unlikely(sinfo->nr_frags == MAX_SKB_FRAGS))
return -ENOMEM;
- }
__skb_fill_page_desc_noacc(sinfo, sinfo->nr_frags++, rx_buf->page,
rx_buf->page_offset, size);
@@ -1075,12 +1072,12 @@ ice_construct_skb(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp)
rx_buf->page_offset + headlen, size,
xdp->frame_sz);
} else {
- /* buffer is unused, change the act that should be taken later
- * on; data was copied onto skb's linear part so there's no
+ /* buffer is unused, restore biased page count in Rx buffer;
+ * data was copied onto skb's linear part so there's no
* need for adjusting page offset and we can reuse this buffer
* as-is
*/
- rx_buf->act = ICE_SKB_CONSUMED;
+ rx_buf->pagecnt_bias++;
}
if (unlikely(xdp_buff_has_frags(xdp))) {
@@ -1133,29 +1130,34 @@ ice_put_rx_buf(struct ice_rx_ring *rx_ring, struct ice_rx_buf *rx_buf)
* @xdp: XDP buffer carrying linear + frags part
* @xdp_xmit: XDP_TX/XDP_REDIRECT verdict storage
* @ntc: a current next_to_clean value to be stored at rx_ring
+ * @verdict: return code from XDP program execution
*
* Walk through gathered fragments and satisfy internal page
* recycle mechanism; we take here an action related to verdict
* returned by XDP program;
*/
static void ice_put_rx_mbuf(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp,
- u32 *xdp_xmit, u32 ntc)
+ u32 *xdp_xmit, u32 ntc, u32 verdict)
{
u32 nr_frags = rx_ring->nr_frags + 1;
u32 idx = rx_ring->first_desc;
u32 cnt = rx_ring->count;
+ u32 post_xdp_frags = 1;
struct ice_rx_buf *buf;
int i;
- for (i = 0; i < nr_frags; i++) {
+ if (unlikely(xdp_buff_has_frags(xdp)))
+ post_xdp_frags += xdp_get_shared_info_from_buff(xdp)->nr_frags;
+
+ for (i = 0; i < post_xdp_frags; i++) {
buf = &rx_ring->rx_buf[idx];
- if (buf->act & (ICE_XDP_TX | ICE_XDP_REDIR)) {
+ if (verdict & (ICE_XDP_TX | ICE_XDP_REDIR)) {
ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
- *xdp_xmit |= buf->act;
- } else if (buf->act & ICE_XDP_CONSUMED) {
+ *xdp_xmit |= verdict;
+ } else if (verdict & ICE_XDP_CONSUMED) {
buf->pagecnt_bias++;
- } else if (buf->act == ICE_XDP_PASS) {
+ } else if (verdict == ICE_XDP_PASS) {
ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz);
}
@@ -1164,6 +1166,17 @@ static void ice_put_rx_mbuf(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp,
if (++idx == cnt)
idx = 0;
}
+ /* handle buffers that represented frags released by XDP prog;
+ * for these we keep pagecnt_bias as-is; refcount from struct page
+ * has been decremented within XDP prog and we do not have to increase
+ * the biased refcnt
+ */
+ for (; i < nr_frags; i++) {
+ buf = &rx_ring->rx_buf[idx];
+ ice_put_rx_buf(rx_ring, buf);
+ if (++idx == cnt)
+ idx = 0;
+ }
xdp->data = NULL;
rx_ring->first_desc = ntc;
@@ -1190,9 +1203,9 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
struct ice_tx_ring *xdp_ring = NULL;
struct bpf_prog *xdp_prog = NULL;
u32 ntc = rx_ring->next_to_clean;
+ u32 cached_ntu, xdp_verdict;
u32 cnt = rx_ring->count;
u32 xdp_xmit = 0;
- u32 cached_ntu;
bool failure;
xdp_prog = READ_ONCE(rx_ring->xdp_prog);
@@ -1255,7 +1268,7 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
xdp_prepare_buff(xdp, hard_start, offset, size, !!offset);
xdp_buff_clear_frags_flag(xdp);
} else if (ice_add_xdp_frag(rx_ring, xdp, rx_buf, size)) {
- ice_put_rx_mbuf(rx_ring, xdp, NULL, ntc);
+ ice_put_rx_mbuf(rx_ring, xdp, NULL, ntc, ICE_XDP_CONSUMED);
break;
}
if (++ntc == cnt)
@@ -1266,13 +1279,13 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
continue;
ice_get_pgcnts(rx_ring);
- ice_run_xdp(rx_ring, xdp, xdp_prog, xdp_ring, rx_buf, rx_desc);
- if (rx_buf->act == ICE_XDP_PASS)
+ xdp_verdict = ice_run_xdp(rx_ring, xdp, xdp_prog, xdp_ring, rx_desc);
+ if (xdp_verdict == ICE_XDP_PASS)
goto construct_skb;
total_rx_bytes += xdp_get_buff_len(xdp);
total_rx_pkts++;
- ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc);
+ ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict);
continue;
construct_skb:
@@ -1283,12 +1296,9 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
/* exit if we failed to retrieve a buffer */
if (!skb) {
rx_ring->ring_stats->rx_stats.alloc_page_failed++;
- rx_buf->act = ICE_XDP_CONSUMED;
- if (unlikely(xdp_buff_has_frags(xdp)))
- ice_set_rx_bufs_act(xdp, rx_ring,
- ICE_XDP_CONSUMED);
+ xdp_verdict = ICE_XDP_CONSUMED;
}
- ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc);
+ ice_put_rx_mbuf(rx_ring, xdp, &xdp_xmit, ntc, xdp_verdict);
if (!skb)
break;
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h
index cb347c852ba9e..806bce701df34 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.h
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h
@@ -201,7 +201,6 @@ struct ice_rx_buf {
struct page *page;
unsigned int page_offset;
unsigned int pgcnt;
- unsigned int act;
unsigned int pagecnt_bias;
};
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx_lib.h b/drivers/net/ethernet/intel/ice/ice_txrx_lib.h
index 79f960c6680d1..6cf32b4041275 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx_lib.h
+++ b/drivers/net/ethernet/intel/ice/ice_txrx_lib.h
@@ -5,49 +5,6 @@
#define _ICE_TXRX_LIB_H_
#include "ice.h"
-/**
- * ice_set_rx_bufs_act - propagate Rx buffer action to frags
- * @xdp: XDP buffer representing frame (linear and frags part)
- * @rx_ring: Rx ring struct
- * act: action to store onto Rx buffers related to XDP buffer parts
- *
- * Set action that should be taken before putting Rx buffer from first frag
- * to the last.
- */
-static inline void
-ice_set_rx_bufs_act(struct xdp_buff *xdp, const struct ice_rx_ring *rx_ring,
- const unsigned int act)
-{
- u32 sinfo_frags = xdp_get_shared_info_from_buff(xdp)->nr_frags;
- u32 nr_frags = rx_ring->nr_frags + 1;
- u32 idx = rx_ring->first_desc;
- u32 cnt = rx_ring->count;
- struct ice_rx_buf *buf;
-
- for (int i = 0; i < nr_frags; i++) {
- buf = &rx_ring->rx_buf[idx];
- buf->act = act;
-
- if (++idx == cnt)
- idx = 0;
- }
-
- /* adjust pagecnt_bias on frags freed by XDP prog */
- if (sinfo_frags < rx_ring->nr_frags && act == ICE_XDP_CONSUMED) {
- u32 delta = rx_ring->nr_frags - sinfo_frags;
-
- while (delta) {
- if (idx == 0)
- idx = cnt - 1;
- else
- idx--;
- buf = &rx_ring->rx_buf[idx];
- buf->pagecnt_bias--;
- delta--;
- }
- }
-}
-
/**
* ice_test_staterr - tests bits in Rx descriptor status and error fields
* @status_err_n: Rx descriptor status_error0 or status_error1 bits
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 113/443] nvme: make nvme_tls_attrs_group static
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 112/443] ice: stop storing XDP verdict within ice_rx_buf Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 114/443] nvme-fc: use ctrl state getter Greg Kroah-Hartman
` (340 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Sagi Grimberg,
Keith Busch, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
[ Upstream commit 2d1a2dab95cdc6f2e0c6af3c0514b0bea94af482 ]
To suppress the compiler "warning: symbol 'nvme_tls_attrs_group' was not
declared. Should it be static?"
Fixes: 1e48b34c9bc79a ("nvme: split off TLS sysfs attributes into a separate group")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index b68a9e5f1ea39..3a41b9ab0f13c 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -792,7 +792,7 @@ static umode_t nvme_tls_attrs_are_visible(struct kobject *kobj,
return a->mode;
}
-const struct attribute_group nvme_tls_attrs_group = {
+static const struct attribute_group nvme_tls_attrs_group = {
.attrs = nvme_tls_attrs,
.is_visible = nvme_tls_attrs_are_visible,
};
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 114/443] nvme-fc: use ctrl state getter
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 113/443] nvme: make nvme_tls_attrs_group static Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 115/443] net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN Greg Kroah-Hartman
` (339 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Wagner, Christoph Hellwig,
Sagi Grimberg, Keith Busch, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <wagi@kernel.org>
[ Upstream commit c8ed6cb5d37bc09c7e25e49a670e9fd1a3bd1dfa ]
Do not access the state variable directly, instead use proper
synchronization so not stale data is read.
Fixes: e6e7f7ac03e4 ("nvme: ensure reset state check ordering")
Signed-off-by: Daniel Wagner <wagi@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/fc.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index b81af7919e94c..682234da2fabe 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2080,7 +2080,8 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
nvme_fc_complete_rq(rq);
check_error:
- if (terminate_assoc && ctrl->ctrl.state != NVME_CTRL_RESETTING)
+ if (terminate_assoc &&
+ nvme_ctrl_state(&ctrl->ctrl) != NVME_CTRL_RESETTING)
queue_work(nvme_reset_wq, &ctrl->ioerr_work);
}
@@ -2534,6 +2535,8 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues)
static void
nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
{
+ enum nvme_ctrl_state state = nvme_ctrl_state(&ctrl->ctrl);
+
/*
* if an error (io timeout, etc) while (re)connecting, the remote
* port requested terminating of the association (disconnect_ls)
@@ -2541,7 +2544,7 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
* the controller. Abort any ios on the association and let the
* create_association error path resolve things.
*/
- if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
+ if (state == NVME_CTRL_CONNECTING) {
__nvme_fc_abort_outstanding_ios(ctrl, true);
set_bit(ASSOC_FAILED, &ctrl->flags);
dev_warn(ctrl->ctrl.device,
@@ -2551,7 +2554,7 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
}
/* Otherwise, only proceed if in LIVE state - e.g. on first error */
- if (ctrl->ctrl.state != NVME_CTRL_LIVE)
+ if (state != NVME_CTRL_LIVE)
return;
dev_warn(ctrl->ctrl.device,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 115/443] net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 114/443] nvme-fc: use ctrl state getter Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 116/443] ice: Add check for devm_kzalloc() Greg Kroah-Hartman
` (338 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli, Jakub Kicinski,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <florian.fainelli@broadcom.com>
[ Upstream commit 46ded709232344b5750a852747a8881763c721ab ]
Some Wake-on-LAN modes such as WAKE_FILTER may only be supported by the MAC,
while others might be only supported by the PHY. Make sure that the .get_wol()
returns the union of both rather than only that of the PHY if the PHY supports
Wake-on-LAN.
When disabling Wake-on-LAN, make sure that this is done at both the PHY
and MAC level, rather than doing an early return from the PHY driver.
Fixes: 7e400ff35cbe ("net: bcmgenet: Add support for PHY-based Wake-on-LAN")
Fixes: 9ee09edc05f2 ("net: bcmgenet: Properly overlay PHY and MAC Wake-on-LAN capabilities")
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20250129231342.35013-1-florian.fainelli@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/broadcom/genet/bcmgenet_wol.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
index 0715ea5bf13ed..3b082114f2e53 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c
@@ -41,9 +41,12 @@ void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
{
struct bcmgenet_priv *priv = netdev_priv(dev);
struct device *kdev = &priv->pdev->dev;
+ u32 phy_wolopts = 0;
- if (dev->phydev)
+ if (dev->phydev) {
phy_ethtool_get_wol(dev->phydev, wol);
+ phy_wolopts = wol->wolopts;
+ }
/* MAC is not wake-up capable, return what the PHY does */
if (!device_can_wakeup(kdev))
@@ -51,9 +54,14 @@ void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
/* Overlay MAC capabilities with that of the PHY queried before */
wol->supported |= WAKE_MAGIC | WAKE_MAGICSECURE | WAKE_FILTER;
- wol->wolopts = priv->wolopts;
- memset(wol->sopass, 0, sizeof(wol->sopass));
+ wol->wolopts |= priv->wolopts;
+ /* Return the PHY configured magic password */
+ if (phy_wolopts & WAKE_MAGICSECURE)
+ return;
+
+ /* Otherwise the MAC one */
+ memset(wol->sopass, 0, sizeof(wol->sopass));
if (wol->wolopts & WAKE_MAGICSECURE)
memcpy(wol->sopass, priv->sopass, sizeof(priv->sopass));
}
@@ -70,7 +78,7 @@ int bcmgenet_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
/* Try Wake-on-LAN from the PHY first */
if (dev->phydev) {
ret = phy_ethtool_set_wol(dev->phydev, wol);
- if (ret != -EOPNOTSUPP)
+ if (ret != -EOPNOTSUPP && wol->wolopts)
return ret;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 116/443] ice: Add check for devm_kzalloc()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 115/443] net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 117/443] vmxnet3: Fix tx queue race condition with XDP Greg Kroah-Hartman
` (337 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Michal Swiatkowski,
Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
[ Upstream commit a8aa6a6ddce9b5585f2b74f27f3feea1427fb4e7 ]
Add check for the return value of devm_kzalloc() to guarantee the success
of allocation.
Fixes: 42c2eb6b1f43 ("ice: Implement devlink-rate API")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Link: https://patch.msgid.link/20250131013832.24805-1-jiashengjiangcool@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/devlink/devlink.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/intel/ice/devlink/devlink.c b/drivers/net/ethernet/intel/ice/devlink/devlink.c
index 415445cefdb2a..b1efd287b3309 100644
--- a/drivers/net/ethernet/intel/ice/devlink/devlink.c
+++ b/drivers/net/ethernet/intel/ice/devlink/devlink.c
@@ -977,6 +977,9 @@ static int ice_devlink_rate_node_new(struct devlink_rate *rate_node, void **priv
/* preallocate memory for ice_sched_node */
node = devm_kzalloc(ice_hw_to_dev(pi->hw), sizeof(*node), GFP_KERNEL);
+ if (!node)
+ return -ENOMEM;
+
*priv = node;
return 0;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 117/443] vmxnet3: Fix tx queue race condition with XDP
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 116/443] ice: Add check for devm_kzalloc() Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 118/443] tg3: Disable tg3 PCIe AER on system reboot Greg Kroah-Hartman
` (336 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sankararaman Jayaraman, Ronak Doshi,
Simon Horman, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sankararaman Jayaraman <sankararaman.jayaraman@broadcom.com>
[ Upstream commit 3f1baa91a1fdf3de9dbad4bd615b35fab347874b ]
If XDP traffic runs on a CPU which is greater than or equal to
the number of the Tx queues of the NIC, then vmxnet3_xdp_get_tq()
always picks up queue 0 for transmission as it uses reciprocal scale
instead of simple modulo operation.
vmxnet3_xdp_xmit() and vmxnet3_xdp_xmit_frame() use the above
returned queue without any locking which can lead to race conditions
when multiple XDP xmits run in parallel on different CPU's.
This patch uses a simple module scheme when the current CPU equals or
exceeds the number of Tx queues on the NIC. It also adds locking in
vmxnet3_xdp_xmit() and vmxnet3_xdp_xmit_frame() functions.
Fixes: 54f00cce1178 ("vmxnet3: Add XDP support.")
Signed-off-by: Sankararaman Jayaraman <sankararaman.jayaraman@broadcom.com>
Signed-off-by: Ronak Doshi <ronak.doshi@broadcom.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250131042340.156547-1-sankararaman.jayaraman@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vmxnet3/vmxnet3_xdp.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/net/vmxnet3/vmxnet3_xdp.c b/drivers/net/vmxnet3/vmxnet3_xdp.c
index 1341374a4588a..616ecc38d1726 100644
--- a/drivers/net/vmxnet3/vmxnet3_xdp.c
+++ b/drivers/net/vmxnet3/vmxnet3_xdp.c
@@ -28,7 +28,7 @@ vmxnet3_xdp_get_tq(struct vmxnet3_adapter *adapter)
if (likely(cpu < tq_number))
tq = &adapter->tx_queue[cpu];
else
- tq = &adapter->tx_queue[reciprocal_scale(cpu, tq_number)];
+ tq = &adapter->tx_queue[cpu % tq_number];
return tq;
}
@@ -124,6 +124,7 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter,
u32 buf_size;
u32 dw2;
+ spin_lock_irq(&tq->tx_lock);
dw2 = (tq->tx_ring.gen ^ 0x1) << VMXNET3_TXD_GEN_SHIFT;
dw2 |= xdpf->len;
ctx.sop_txd = tq->tx_ring.base + tq->tx_ring.next2fill;
@@ -134,6 +135,7 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter,
if (vmxnet3_cmd_ring_desc_avail(&tq->tx_ring) == 0) {
tq->stats.tx_ring_full++;
+ spin_unlock_irq(&tq->tx_lock);
return -ENOSPC;
}
@@ -142,8 +144,10 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter,
tbi->dma_addr = dma_map_single(&adapter->pdev->dev,
xdpf->data, buf_size,
DMA_TO_DEVICE);
- if (dma_mapping_error(&adapter->pdev->dev, tbi->dma_addr))
+ if (dma_mapping_error(&adapter->pdev->dev, tbi->dma_addr)) {
+ spin_unlock_irq(&tq->tx_lock);
return -EFAULT;
+ }
tbi->map_type |= VMXNET3_MAP_SINGLE;
} else { /* XDP buffer from page pool */
page = virt_to_page(xdpf->data);
@@ -182,6 +186,7 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter,
dma_wmb();
gdesc->dword[2] = cpu_to_le32(le32_to_cpu(gdesc->dword[2]) ^
VMXNET3_TXD_GEN);
+ spin_unlock_irq(&tq->tx_lock);
/* No need to handle the case when tx_num_deferred doesn't reach
* threshold. Backend driver at hypervisor side will poll and reset
@@ -225,6 +230,7 @@ vmxnet3_xdp_xmit(struct net_device *dev,
{
struct vmxnet3_adapter *adapter = netdev_priv(dev);
struct vmxnet3_tx_queue *tq;
+ struct netdev_queue *nq;
int i;
if (unlikely(test_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state)))
@@ -236,6 +242,9 @@ vmxnet3_xdp_xmit(struct net_device *dev,
if (tq->stopped)
return -ENETDOWN;
+ nq = netdev_get_tx_queue(adapter->netdev, tq->qid);
+
+ __netif_tx_lock(nq, smp_processor_id());
for (i = 0; i < n; i++) {
if (vmxnet3_xdp_xmit_frame(adapter, frames[i], tq, true)) {
tq->stats.xdp_xmit_err++;
@@ -243,6 +252,7 @@ vmxnet3_xdp_xmit(struct net_device *dev,
}
}
tq->stats.xdp_xmit += i;
+ __netif_tx_unlock(nq);
return i;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 118/443] tg3: Disable tg3 PCIe AER on system reboot
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 117/443] vmxnet3: Fix tx queue race condition with XDP Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 119/443] udp: gso: do not drop small packets when PMTU reduces Greg Kroah-Hartman
` (335 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lenny Szubowicz, Pavan Chebbi,
Simon Horman, David S. Miller, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lenny Szubowicz <lszubowi@redhat.com>
[ Upstream commit e0efe83ed325277bb70f9435d4d9fc70bebdcca8 ]
Disable PCIe AER on the tg3 device on system reboot on a limited
list of Dell PowerEdge systems. This prevents a fatal PCIe AER event
on the tg3 device during the ACPI _PTS (prepare to sleep) method for
S5 on those systems. The _PTS is invoked by acpi_enter_sleep_state_prep()
as part of the kernel's reboot sequence as a result of commit
38f34dba806a ("PM: ACPI: reboot: Reinstate S5 for reboot").
There was an earlier fix for this problem by commit 2ca1c94ce0b6
("tg3: Disable tg3 device on system reboot to avoid triggering AER").
But it was discovered that this earlier fix caused a reboot hang
when some Dell PowerEdge servers were booted via ipxe. To address
this reboot hang, the earlier fix was essentially reverted by commit
9fc3bc764334 ("tg3: power down device only on SYSTEM_POWER_OFF").
This re-exposed the tg3 PCIe AER on reboot problem.
This fix is not an ideal solution because the root cause of the AER
is in system firmware. Instead, it's a targeted work-around in the
tg3 driver.
Note also that the PCIe AER must be disabled on the tg3 device even
if the system is configured to use "firmware first" error handling.
V3:
- Fix sparse warning on improper comparison of pdev->current_state
- Adhere to netdev comment style
Fixes: 9fc3bc764334 ("tg3: power down device only on SYSTEM_POWER_OFF")
Signed-off-by: Lenny Szubowicz <lszubowi@redhat.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/tg3.c | 58 +++++++++++++++++++++++++++++
1 file changed, 58 insertions(+)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 9cc8db10a8d60..5ba22fe0995f9 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -55,6 +55,7 @@
#include <linux/hwmon.h>
#include <linux/hwmon-sysfs.h>
#include <linux/crc32poly.h>
+#include <linux/dmi.h>
#include <net/checksum.h>
#include <net/gso.h>
@@ -18192,6 +18193,50 @@ static int tg3_resume(struct device *device)
static SIMPLE_DEV_PM_OPS(tg3_pm_ops, tg3_suspend, tg3_resume);
+/* Systems where ACPI _PTS (Prepare To Sleep) S5 will result in a fatal
+ * PCIe AER event on the tg3 device if the tg3 device is not, or cannot
+ * be, powered down.
+ */
+static const struct dmi_system_id tg3_restart_aer_quirk_table[] = {
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R440"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R540"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R640"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R650"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R740"),
+ },
+ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge R750"),
+ },
+ },
+ {}
+};
+
static void tg3_shutdown(struct pci_dev *pdev)
{
struct net_device *dev = pci_get_drvdata(pdev);
@@ -18208,6 +18253,19 @@ static void tg3_shutdown(struct pci_dev *pdev)
if (system_state == SYSTEM_POWER_OFF)
tg3_power_down(tp);
+ else if (system_state == SYSTEM_RESTART &&
+ dmi_first_match(tg3_restart_aer_quirk_table) &&
+ pdev->current_state != PCI_D3cold &&
+ pdev->current_state != PCI_UNKNOWN) {
+ /* Disable PCIe AER on the tg3 to avoid a fatal
+ * error during this system restart.
+ */
+ pcie_capability_clear_word(pdev, PCI_EXP_DEVCTL,
+ PCI_EXP_DEVCTL_CERE |
+ PCI_EXP_DEVCTL_NFERE |
+ PCI_EXP_DEVCTL_FERE |
+ PCI_EXP_DEVCTL_URRE);
+ }
rtnl_unlock();
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 119/443] udp: gso: do not drop small packets when PMTU reduces
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 118/443] tg3: Disable tg3 PCIe AER on system reboot Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 120/443] drm/i915/hdcp: Fix Repeater authentication during topology change Greg Kroah-Hartman
` (334 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yan Zhai, Willem de Bruijn,
Willem de Bruijn, David S. Miller, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan Zhai <yan@cloudflare.com>
[ Upstream commit 235174b2bed88501fda689c113c55737f99332d8 ]
Commit 4094871db1d6 ("udp: only do GSO if # of segs > 1") avoided GSO
for small packets. But the kernel currently dismisses GSO requests only
after checking MTU/PMTU on gso_size. This means any packets, regardless
of their payload sizes, could be dropped when PMTU becomes smaller than
requested gso_size. We encountered this issue in production and it
caused a reliability problem that new QUIC connection cannot be
established before PMTU cache expired, while non GSO sockets still
worked fine at the same time.
Ideally, do not check any GSO related constraints when payload size is
smaller than requested gso_size, and return EMSGSIZE instead of EINVAL
on MTU/PMTU check failure to be more specific on the error cause.
Fixes: 4094871db1d6 ("udp: only do GSO if # of segs > 1")
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/udp.c | 4 ++--
net/ipv6/udp.c | 4 ++--
tools/testing/selftests/net/udpgso.c | 26 ++++++++++++++++++++++++++
3 files changed, 30 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index c472c9a57cf68..a9bb9ce5438ea 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1141,9 +1141,9 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
const int hlen = skb_network_header_len(skb) +
sizeof(struct udphdr);
- if (hlen + cork->gso_size > cork->fragsize) {
+ if (hlen + min(datalen, cork->gso_size) > cork->fragsize) {
kfree_skb(skb);
- return -EINVAL;
+ return -EMSGSIZE;
}
if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) {
kfree_skb(skb);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index b974116152dd3..3a3c7639d1d61 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1389,9 +1389,9 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
const int hlen = skb_network_header_len(skb) +
sizeof(struct udphdr);
- if (hlen + cork->gso_size > cork->fragsize) {
+ if (hlen + min(datalen, cork->gso_size) > cork->fragsize) {
kfree_skb(skb);
- return -EINVAL;
+ return -EMSGSIZE;
}
if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) {
kfree_skb(skb);
diff --git a/tools/testing/selftests/net/udpgso.c b/tools/testing/selftests/net/udpgso.c
index 3f2fca02fec53..36ff28af4b190 100644
--- a/tools/testing/selftests/net/udpgso.c
+++ b/tools/testing/selftests/net/udpgso.c
@@ -102,6 +102,19 @@ struct testcase testcases_v4[] = {
.gso_len = CONST_MSS_V4,
.r_num_mss = 1,
},
+ {
+ /* datalen <= MSS < gso_len: will fall back to no GSO */
+ .tlen = CONST_MSS_V4,
+ .gso_len = CONST_MSS_V4 + 1,
+ .r_num_mss = 0,
+ .r_len_last = CONST_MSS_V4,
+ },
+ {
+ /* MSS < datalen < gso_len: fail */
+ .tlen = CONST_MSS_V4 + 1,
+ .gso_len = CONST_MSS_V4 + 2,
+ .tfail = true,
+ },
{
/* send a single MSS + 1B */
.tlen = CONST_MSS_V4 + 1,
@@ -205,6 +218,19 @@ struct testcase testcases_v6[] = {
.gso_len = CONST_MSS_V6,
.r_num_mss = 1,
},
+ {
+ /* datalen <= MSS < gso_len: will fall back to no GSO */
+ .tlen = CONST_MSS_V6,
+ .gso_len = CONST_MSS_V6 + 1,
+ .r_num_mss = 0,
+ .r_len_last = CONST_MSS_V6,
+ },
+ {
+ /* MSS < datalen < gso_len: fail */
+ .tlen = CONST_MSS_V6 + 1,
+ .gso_len = CONST_MSS_V6 + 2,
+ .tfail = true
+ },
{
/* send a single MSS + 1B */
.tlen = CONST_MSS_V6 + 1,
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 120/443] drm/i915/hdcp: Fix Repeater authentication during topology change
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 119/443] udp: gso: do not drop small packets when PMTU reduces Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 121/443] drm/i915/dp: fix the Adaptive sync Operation mode for SDP Greg Kroah-Hartman
` (333 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suraj Kandpal, Ankit Nautiyal,
Rodrigo Vivi, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Kandpal <suraj.kandpal@intel.com>
[ Upstream commit 448060463198924c0a485e7e1622fa8a9c03cf3e ]
When topology changes, before beginning a new HDCP authentication by
sending AKE_init message we need to first authenticate only the
repeater. Only after repeater authentication failure, it makes sense
to start a new HDCP authentication. Even though it made sense to not
enable HDCP directly from check_link and schedule it for later, repeater
authentication needs to be done immediately.
--v2
-Fix comment grammatical errors [Ankit]
Fixes: 47ef55a8b784 ("drm/i915/hdcp: Don't enable HDCP2.2 directly from check_link")
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241217083723.2883317-1-suraj.kandpal@intel.com
(cherry picked from commit 605a33e765890e4f1345315afc25268d4ae0fb7c)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_hdcp.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c
index 8fee26d791f4f..3bf42871a4f08 100644
--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
+++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
@@ -2180,6 +2180,19 @@ static int intel_hdcp2_check_link(struct intel_connector *connector)
drm_dbg_kms(display->drm,
"HDCP2.2 Downstream topology change\n");
+
+ ret = hdcp2_authenticate_repeater_topology(connector);
+ if (!ret) {
+ intel_hdcp_update_value(connector,
+ DRM_MODE_CONTENT_PROTECTION_ENABLED,
+ true);
+ goto out;
+ }
+
+ drm_dbg_kms(display->drm,
+ "[CONNECTOR:%d:%s] Repeater topology auth failed.(%d)\n",
+ connector->base.base.id, connector->base.name,
+ ret);
} else {
drm_dbg_kms(display->drm,
"[CONNECTOR:%d:%s] HDCP2.2 link failed, retrying auth\n",
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 121/443] drm/i915/dp: fix the Adaptive sync Operation mode for SDP
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 120/443] drm/i915/hdcp: Fix Repeater authentication during topology change Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 122/443] drm/xe/oa: Preserve oa_ctrl unused bits Greg Kroah-Hartman
` (332 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mitul Golani, Ankit Nautiyal,
Jani Nikula, Rodrigo Vivi, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
[ Upstream commit 4466302262b38f5e6c65325035b4036a42efc934 ]
Currently we support Adaptive sync operation mode with dynamic frame
rate, but instead the operation mode with fixed rate is set.
This was initially set correctly in the earlier version of changes but
later got changed, while defining a macro for the same.
Fixes: a5bd5991cb8a ("drm/i915/display: Compute AS SDP parameters")
Cc: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com>
Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Reviewed-by: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com>
Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250130051609.1796524-4-mitulkumar.ajitkumar.golani@intel.com
(cherry picked from commit c5806862543ff6c2ad242409fcdf0667eac26dae)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_dp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
index ff5ba7b3035f3..dfc600ff0b4e7 100644
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -2778,7 +2778,6 @@ static void intel_dp_compute_as_sdp(struct intel_dp *intel_dp,
crtc_state->infoframes.enable |= intel_hdmi_infoframe_enable(DP_SDP_ADAPTIVE_SYNC);
- /* Currently only DP_AS_SDP_AVT_FIXED_VTOTAL mode supported */
as_sdp->sdp_type = DP_SDP_ADAPTIVE_SYNC;
as_sdp->length = 0x9;
as_sdp->duration_incr_ms = 0;
@@ -2789,7 +2788,7 @@ static void intel_dp_compute_as_sdp(struct intel_dp *intel_dp,
as_sdp->target_rr = drm_mode_vrefresh(adjusted_mode);
as_sdp->target_rr_divider = true;
} else {
- as_sdp->mode = DP_AS_SDP_AVT_FIXED_VTOTAL;
+ as_sdp->mode = DP_AS_SDP_AVT_DYNAMIC_VTOTAL;
as_sdp->vtotal = adjusted_mode->vtotal;
as_sdp->target_rr = 0;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 122/443] drm/xe/oa: Preserve oa_ctrl unused bits
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 121/443] drm/i915/dp: fix the Adaptive sync Operation mode for SDP Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 123/443] drm/xe/pf: Fix migration initialization Greg Kroah-Hartman
` (331 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ashutosh Dixit,
Umesh Nerlige Ramappa, Rodrigo Vivi, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashutosh Dixit <ashutosh.dixit@intel.com>
[ Upstream commit 588c20079e17dae9e1f49ba42981a05de1c9136e ]
UMD's have interest in setting unused bits of the oa_ctrl register "out of
band" for certain experiments. To facilitate this, don't clobber previous
oa_ctrl unused bits, i.e. rmw the values rather than simply write them.
Fixes: e936f885f1e9 ("drm/xe/oa/uapi: Expose OA stream fd")
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250117032155.3048063-1-ashutosh.dixit@intel.com
(cherry picked from commit cfa9d40db8c30d894171010fe765d96e9bc6a47e)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/regs/xe_oa_regs.h | 6 ++++++
drivers/gpu/drm/xe/xe_oa.c | 12 ++++++++++--
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/xe/regs/xe_oa_regs.h b/drivers/gpu/drm/xe/regs/xe_oa_regs.h
index a9b0091cb7ee1..6d31573ed1765 100644
--- a/drivers/gpu/drm/xe/regs/xe_oa_regs.h
+++ b/drivers/gpu/drm/xe/regs/xe_oa_regs.h
@@ -59,6 +59,10 @@
/* Common to all OA units */
#define OA_OACONTROL_REPORT_BC_MASK REG_GENMASK(9, 9)
#define OA_OACONTROL_COUNTER_SIZE_MASK REG_GENMASK(8, 8)
+#define OAG_OACONTROL_USED_BITS \
+ (OAG_OACONTROL_OA_PES_DISAG_EN | OAG_OACONTROL_OA_CCS_SELECT_MASK | \
+ OAG_OACONTROL_OA_COUNTER_SEL_MASK | OAG_OACONTROL_OA_COUNTER_ENABLE | \
+ OA_OACONTROL_REPORT_BC_MASK | OA_OACONTROL_COUNTER_SIZE_MASK)
#define OAG_OA_DEBUG XE_REG(0xdaf8, XE_REG_OPTION_MASKED)
#define OAG_OA_DEBUG_DISABLE_MMIO_TRG REG_BIT(14)
@@ -85,6 +89,8 @@
#define OAM_CONTEXT_CONTROL_OFFSET (0x1bc)
#define OAM_CONTROL_OFFSET (0x194)
#define OAM_CONTROL_COUNTER_SEL_MASK REG_GENMASK(3, 1)
+#define OAM_OACONTROL_USED_BITS \
+ (OAM_CONTROL_COUNTER_SEL_MASK | OAG_OACONTROL_OA_COUNTER_ENABLE)
#define OAM_DEBUG_OFFSET (0x198)
#define OAM_STATUS_OFFSET (0x19c)
#define OAM_MMIO_TRG_OFFSET (0x1d0)
diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
index 678fa40e4cea7..d8af82dcdce4b 100644
--- a/drivers/gpu/drm/xe/xe_oa.c
+++ b/drivers/gpu/drm/xe/xe_oa.c
@@ -445,6 +445,12 @@ static u32 __oa_ccs_select(struct xe_oa_stream *stream)
return val;
}
+static u32 __oactrl_used_bits(struct xe_oa_stream *stream)
+{
+ return stream->hwe->oa_unit->type == DRM_XE_OA_UNIT_TYPE_OAG ?
+ OAG_OACONTROL_USED_BITS : OAM_OACONTROL_USED_BITS;
+}
+
static void xe_oa_enable(struct xe_oa_stream *stream)
{
const struct xe_oa_format *format = stream->oa_buffer.format;
@@ -465,14 +471,14 @@ static void xe_oa_enable(struct xe_oa_stream *stream)
stream->hwe->oa_unit->type == DRM_XE_OA_UNIT_TYPE_OAG)
val |= OAG_OACONTROL_OA_PES_DISAG_EN;
- xe_mmio_write32(&stream->gt->mmio, regs->oa_ctrl, val);
+ xe_mmio_rmw32(&stream->gt->mmio, regs->oa_ctrl, __oactrl_used_bits(stream), val);
}
static void xe_oa_disable(struct xe_oa_stream *stream)
{
struct xe_mmio *mmio = &stream->gt->mmio;
- xe_mmio_write32(mmio, __oa_regs(stream)->oa_ctrl, 0);
+ xe_mmio_rmw32(mmio, __oa_regs(stream)->oa_ctrl, __oactrl_used_bits(stream), 0);
if (xe_mmio_wait32(mmio, __oa_regs(stream)->oa_ctrl,
OAG_OACONTROL_OA_COUNTER_ENABLE, 0, 50000, NULL, false))
drm_err(&stream->oa->xe->drm,
@@ -2569,6 +2575,8 @@ static void __xe_oa_init_oa_units(struct xe_gt *gt)
u->type = DRM_XE_OA_UNIT_TYPE_OAM;
}
+ xe_mmio_write32(>->mmio, u->regs.oa_ctrl, 0);
+
/* Ensure MMIO trigger remains disabled till there is a stream */
xe_mmio_write32(>->mmio, u->regs.oa_debug,
oag_configure_mmio_trigger(NULL, false));
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 123/443] drm/xe/pf: Fix migration initialization
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 122/443] drm/xe/oa: Preserve oa_ctrl unused bits Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 124/443] ethtool: rss: fix hiding unsupported fields in dumps Greg Kroah-Hartman
` (330 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Wajdeczko,
Michał Winiarski, Rodrigo Vivi, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Wajdeczko <michal.wajdeczko@intel.com>
[ Upstream commit 9f706fd8024208b0686bb8ec68589d758f765672 ]
The migration support only needs to be initialized once, but it
was incorrectly called from the xe_gt_sriov_pf_init_hw(), which
is part of the reset flow and may be called multiple times.
Fixes: d86e3737c7ab ("drm/xe/pf: Add functions to save and restore VF GuC state")
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Michał Winiarski <michal.winiarski@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250120232443.544-1-michal.wajdeczko@intel.com
(cherry picked from commit 9ebb5846e1a3b1705f8a7cbc528888a1aa0b163e)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_gt.c | 4 +++-
drivers/gpu/drm/xe/xe_gt_sriov_pf.c | 14 +++++++++++++-
drivers/gpu/drm/xe/xe_gt_sriov_pf.h | 6 ++++++
3 files changed, 22 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_gt.c b/drivers/gpu/drm/xe/xe_gt.c
index 94d468d01253d..77d818beb26d3 100644
--- a/drivers/gpu/drm/xe/xe_gt.c
+++ b/drivers/gpu/drm/xe/xe_gt.c
@@ -532,8 +532,10 @@ static int all_fw_domain_init(struct xe_gt *gt)
if (IS_SRIOV_PF(gt_to_xe(gt)) && !xe_gt_is_media_type(gt))
xe_lmtt_init_hw(>_to_tile(gt)->sriov.pf.lmtt);
- if (IS_SRIOV_PF(gt_to_xe(gt)))
+ if (IS_SRIOV_PF(gt_to_xe(gt))) {
+ xe_gt_sriov_pf_init(gt);
xe_gt_sriov_pf_init_hw(gt);
+ }
xe_force_wake_put(gt_to_fw(gt), fw_ref);
diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_pf.c b/drivers/gpu/drm/xe/xe_gt_sriov_pf.c
index e71fc3d2bda22..6f906c8e8108b 100644
--- a/drivers/gpu/drm/xe/xe_gt_sriov_pf.c
+++ b/drivers/gpu/drm/xe/xe_gt_sriov_pf.c
@@ -68,6 +68,19 @@ int xe_gt_sriov_pf_init_early(struct xe_gt *gt)
return 0;
}
+/**
+ * xe_gt_sriov_pf_init - Prepare SR-IOV PF data structures on PF.
+ * @gt: the &xe_gt to initialize
+ *
+ * Late one-time initialization of the PF data.
+ *
+ * Return: 0 on success or a negative error code on failure.
+ */
+int xe_gt_sriov_pf_init(struct xe_gt *gt)
+{
+ return xe_gt_sriov_pf_migration_init(gt);
+}
+
static bool pf_needs_enable_ggtt_guest_update(struct xe_device *xe)
{
return GRAPHICS_VERx100(xe) == 1200;
@@ -90,7 +103,6 @@ void xe_gt_sriov_pf_init_hw(struct xe_gt *gt)
pf_enable_ggtt_guest_update(gt);
xe_gt_sriov_pf_service_update(gt);
- xe_gt_sriov_pf_migration_init(gt);
}
static u32 pf_get_vf_regs_stride(struct xe_device *xe)
diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_pf.h b/drivers/gpu/drm/xe/xe_gt_sriov_pf.h
index 96fab779a906f..f474509411c0c 100644
--- a/drivers/gpu/drm/xe/xe_gt_sriov_pf.h
+++ b/drivers/gpu/drm/xe/xe_gt_sriov_pf.h
@@ -10,6 +10,7 @@ struct xe_gt;
#ifdef CONFIG_PCI_IOV
int xe_gt_sriov_pf_init_early(struct xe_gt *gt);
+int xe_gt_sriov_pf_init(struct xe_gt *gt);
void xe_gt_sriov_pf_init_hw(struct xe_gt *gt);
void xe_gt_sriov_pf_sanitize_hw(struct xe_gt *gt, unsigned int vfid);
void xe_gt_sriov_pf_restart(struct xe_gt *gt);
@@ -19,6 +20,11 @@ static inline int xe_gt_sriov_pf_init_early(struct xe_gt *gt)
return 0;
}
+static inline int xe_gt_sriov_pf_init(struct xe_gt *gt)
+{
+ return 0;
+}
+
static inline void xe_gt_sriov_pf_init_hw(struct xe_gt *gt)
{
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 124/443] ethtool: rss: fix hiding unsupported fields in dumps
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 123/443] drm/xe/pf: Fix migration initialization Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 125/443] ethtool: ntuple: fix rss + ring_cookie check Greg Kroah-Hartman
` (329 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Joe Damato,
Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 244f8aa46fa9e2f4ea5fe0e04988b395d5e30fc7 ]
Commit ec6e57beaf8b ("ethtool: rss: don't report key if device
doesn't support it") intended to stop reporting key fields for
additional rss contexts if device has a global hashing key.
Later we added dump support and the filtering wasn't properly
added there. So we end up reporting the key fields in dumps
but not in dos:
# ./pyynl/cli.py --spec netlink/specs/ethtool.yaml --do rss-get \
--json '{"header": {"dev-index":2}, "context": 1 }'
{
"header": { ... },
"context": 1,
"indir": [0, 1, 2, 3, ...]]
}
# ./pyynl/cli.py --spec netlink/specs/ethtool.yaml --dump rss-get
[
... snip context 0 ...
{ "header": { ... },
"context": 1,
"indir": [0, 1, 2, 3, ...],
-> "input_xfrm": 255,
-> "hfunc": 1,
-> "hkey": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
}
]
Hide these fields correctly.
The drivers/net/hw/rss_ctx.py selftest catches this when run on
a device with single key, already:
# Check| At /root/./ksft-net-drv/drivers/net/hw/rss_ctx.py, line 381, in test_rss_context_dump:
# Check| ksft_ne(set(data.get('hkey', [1])), {0}, "key is all zero")
# Check failed {0} == {0} key is all zero
not ok 8 rss_ctx.test_rss_context_dump
Fixes: f6122900f4e2 ("ethtool: rss: support dumping RSS contexts")
Reviewed-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Joe Damato <jdamato@fastly.com>
Link: https://patch.msgid.link/20250201013040.725123-2-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--git a/net/ethtool/rss.c b/net/ethtool/rss.c
index 7cb106b590aba..58df9ad02ce8a 100644
--- a/net/ethtool/rss.c
+++ b/net/ethtool/rss.c
@@ -107,6 +107,8 @@ rss_prepare_ctx(const struct rss_req_info *request, struct net_device *dev,
u32 total_size, indir_bytes;
u8 *rss_config;
+ data->no_key_fields = !dev->ethtool_ops->rxfh_per_ctx_key;
+
ctx = xa_load(&dev->ethtool->rss_ctx, request->rss_context);
if (!ctx)
return -ENOENT;
@@ -153,7 +155,6 @@ rss_prepare_data(const struct ethnl_req_info *req_base,
if (!ops->cap_rss_ctx_supported && !ops->create_rxfh_context)
return -EOPNOTSUPP;
- data->no_key_fields = !ops->rxfh_per_ctx_key;
return rss_prepare_ctx(request, dev, data, info);
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 125/443] ethtool: ntuple: fix rss + ring_cookie check
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 124/443] ethtool: rss: fix hiding unsupported fields in dumps Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 126/443] selftests: drv-net: rss_ctx: add missing cleanup in queue reconfigure Greg Kroah-Hartman
` (328 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Joe Damato,
Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 2b91cc1214b165c25ac9b0885db89a0d3224028a ]
The info.flow_type is for RXFH commands, ntuple flow_type is inside
the flow spec. The check currently does nothing, as info.flow_type
is 0 (or even uninitialized by user space) for ETHTOOL_SRXCLSRLINS.
Fixes: 9e43ad7a1ede ("net: ethtool: only allow set_rxnfc with rss + ring_cookie if driver opts in")
Reviewed-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Joe Damato <jdamato@fastly.com>
Link: https://patch.msgid.link/20250201013040.725123-3-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ethtool/ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index 34bee42e12470..7609ce2b2c5e2 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -993,7 +993,7 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
return rc;
/* Nonzero ring with RSS only makes sense if NIC adds them together */
- if (cmd == ETHTOOL_SRXCLSRLINS && info.flow_type & FLOW_RSS &&
+ if (cmd == ETHTOOL_SRXCLSRLINS && info.fs.flow_type & FLOW_RSS &&
!ops->cap_rss_rxnfc_adds &&
ethtool_get_flow_spec_ring(info.fs.ring_cookie))
return -EINVAL;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 126/443] selftests: drv-net: rss_ctx: add missing cleanup in queue reconfigure
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 125/443] ethtool: ntuple: fix rss + ring_cookie check Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 127/443] rxrpc: Fix the rxrpc_connection attend queue handling Greg Kroah-Hartman
` (327 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Joe Damato, Jakub Kicinski,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit de379dfd9ada2995699052f4a1ecebe5d8f8d70f ]
Commit under Fixes adds ntuple rules but never deletes them.
Fixes: 29a4bc1fe961 ("selftest: extend test_rss_context_queue_reconfigure for action addition")
Reviewed-by: Joe Damato <jdamato@fastly.com>
Link: https://patch.msgid.link/20250201013040.725123-4-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 2 ++
1 file changed, 2 insertions(+)
--git a/tools/testing/selftests/drivers/net/hw/rss_ctx.py b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
index ca8a7edff3dda..27e24e20749ff 100755
--- a/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+++ b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
@@ -252,6 +252,7 @@ def test_rss_queue_reconfigure(cfg, main_ctx=True):
try:
# this targets queue 4, which doesn't exist
ntuple2 = ethtool_create(cfg, "-N", flow)
+ defer(ethtool, f"-N {cfg.ifname} delete {ntuple2}")
except CmdExitFailure:
pass
else:
@@ -260,6 +261,7 @@ def test_rss_queue_reconfigure(cfg, main_ctx=True):
ethtool(f"-X {cfg.ifname} {ctx_ref} weight 1 0 1 0")
# ntuple rule therefore targets queues 1 and 3
ntuple2 = ethtool_create(cfg, "-N", flow)
+ defer(ethtool, f"-N {cfg.ifname} delete {ntuple2}")
# should replace existing filter
ksft_eq(ntuple, ntuple2)
_send_traffic_check(cfg, port, ctx_ref, { 'target': (1, 3),
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 127/443] rxrpc: Fix the rxrpc_connection attend queue handling
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 126/443] selftests: drv-net: rss_ctx: add missing cleanup in queue reconfigure Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 128/443] gpio: pca953x: Improve interrupt support Greg Kroah-Hartman
` (326 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Jakub Kicinski, David S. Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, linux-afs, netdev, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 4241a702e0d0c2ca9364cfac08dbf134264962de ]
The rxrpc_connection attend queue is never used because conn::attend_link
is never initialised and so is always NULL'd out and thus always appears to
be busy. This requires the following fix:
(1) Fix this the attend queue problem by initialising conn::attend_link.
And, consequently, two further fixes for things masked by the above bug:
(2) Fix rxrpc_input_conn_event() to handle being invoked with a NULL
sk_buff pointer - something that can now happen with the above change.
(3) Fix the RXRPC_SKB_MARK_SERVICE_CONN_SECURED message to carry a pointer
to the connection and a ref on it.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: "David S. Miller" <davem@davemloft.net>
cc: Eric Dumazet <edumazet@google.com>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
Fixes: f2cce89a074e ("rxrpc: Implement a mechanism to send an event notification to a connection")
Link: https://patch.msgid.link/20250203110307.7265-3-dhowells@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/trace/events/rxrpc.h | 1 +
net/rxrpc/conn_event.c | 17 ++++++++++-------
net/rxrpc/conn_object.c | 1 +
3 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 27c23873c8811..ee4030f2e99da 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -218,6 +218,7 @@
EM(rxrpc_conn_get_conn_input, "GET inp-conn") \
EM(rxrpc_conn_get_idle, "GET idle ") \
EM(rxrpc_conn_get_poke_abort, "GET pk-abort") \
+ EM(rxrpc_conn_get_poke_secured, "GET secured ") \
EM(rxrpc_conn_get_poke_timer, "GET poke ") \
EM(rxrpc_conn_get_service_conn, "GET svc-conn") \
EM(rxrpc_conn_new_client, "NEW client ") \
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index 2a1396cd892f3..ca5e694ab858b 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -266,6 +266,7 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
* we've already received the packet, put it on the
* front of the queue.
*/
+ sp->conn = rxrpc_get_connection(conn, rxrpc_conn_get_poke_secured);
skb->mark = RXRPC_SKB_MARK_SERVICE_CONN_SECURED;
rxrpc_get_skb(skb, rxrpc_skb_get_conn_secured);
skb_queue_head(&conn->local->rx_queue, skb);
@@ -431,14 +432,16 @@ void rxrpc_input_conn_event(struct rxrpc_connection *conn, struct sk_buff *skb)
if (test_and_clear_bit(RXRPC_CONN_EV_ABORT_CALLS, &conn->events))
rxrpc_abort_calls(conn);
- switch (skb->mark) {
- case RXRPC_SKB_MARK_SERVICE_CONN_SECURED:
- if (conn->state != RXRPC_CONN_SERVICE)
- break;
+ if (skb) {
+ switch (skb->mark) {
+ case RXRPC_SKB_MARK_SERVICE_CONN_SECURED:
+ if (conn->state != RXRPC_CONN_SERVICE)
+ break;
- for (loop = 0; loop < RXRPC_MAXCALLS; loop++)
- rxrpc_call_is_secure(conn->channels[loop].call);
- break;
+ for (loop = 0; loop < RXRPC_MAXCALLS; loop++)
+ rxrpc_call_is_secure(conn->channels[loop].call);
+ break;
+ }
}
/* Process delayed ACKs whose time has come. */
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 694c4df7a1a31..88b4aab5a0913 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -67,6 +67,7 @@ struct rxrpc_connection *rxrpc_alloc_connection(struct rxrpc_net *rxnet,
INIT_WORK(&conn->destructor, rxrpc_clean_up_connection);
INIT_LIST_HEAD(&conn->proc_link);
INIT_LIST_HEAD(&conn->link);
+ INIT_LIST_HEAD(&conn->attend_link);
mutex_init(&conn->security_lock);
mutex_init(&conn->tx_data_alloc_lock);
skb_queue_head_init(&conn->rx_queue);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 128/443] gpio: pca953x: Improve interrupt support
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 127/443] rxrpc: Fix the rxrpc_connection attend queue handling Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 129/443] net: atlantic: fix warning during hot unplug Greg Kroah-Hartman
` (325 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Tomlinson, Andy Shevchenko,
Bartosz Golaszewski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
[ Upstream commit d6179f6c6204f9932aed3a7a2100b4a295dfed9d ]
The GPIO drivers with latch interrupt support (typically types starting
with PCAL) have interrupt status registers to determine which particular
inputs have caused an interrupt. Unfortunately there is no atomic
operation to read these registers and clear the interrupt. Clearing the
interrupt is done by reading the input registers.
The code was reading the interrupt status registers, and then reading
the input registers. If an input changed between these two events it was
lost.
The solution in this patch is to revert to the non-latch version of
code, i.e. remembering the previous input status, and looking for the
changes. This system results in no more I2C transfers, so is no slower.
The latch property of the device still means interrupts will still be
noticed if the input changes back to its initial state.
Fixes: 44896beae605 ("gpio: pca953x: add PCAL9535 interrupt support for Galileo Gen2")
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240606033102.2271916-1-mark.tomlinson@alliedtelesis.co.nz
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-pca953x.c | 19 -------------------
1 file changed, 19 deletions(-)
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index be4c9981ebc40..d63c1030e6ac0 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -841,25 +841,6 @@ static bool pca953x_irq_pending(struct pca953x_chip *chip, unsigned long *pendin
DECLARE_BITMAP(trigger, MAX_LINE);
int ret;
- if (chip->driver_data & PCA_PCAL) {
- /* Read the current interrupt status from the device */
- ret = pca953x_read_regs(chip, PCAL953X_INT_STAT, trigger);
- if (ret)
- return false;
-
- /* Check latched inputs and clear interrupt status */
- ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
- if (ret)
- return false;
-
- /* Apply filter for rising/falling edge selection */
- bitmap_replace(new_stat, chip->irq_trig_fall, chip->irq_trig_raise, cur_stat, gc->ngpio);
-
- bitmap_and(pending, new_stat, trigger, gc->ngpio);
-
- return !bitmap_empty(pending, gc->ngpio);
- }
-
ret = pca953x_read_regs(chip, chip->regs->input, cur_stat);
if (ret)
return false;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 129/443] net: atlantic: fix warning during hot unplug
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 128/443] gpio: pca953x: Improve interrupt support Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 130/443] net: rose: lock the socket in rose_bind() Greg Kroah-Hartman
` (324 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Moroni, Igor Russkikh,
Simon Horman, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Moroni <mail@jakemoroni.com>
[ Upstream commit 028676bb189ed6d1b550a0fc570a9d695b6acfd3 ]
Firmware deinitialization performs MMIO accesses which are not
necessary if the device has already been removed. In some cases,
these accesses happen via readx_poll_timeout_atomic which ends up
timing out, resulting in a warning at hw_atl2_utils_fw.c:112:
[ 104.595913] Call Trace:
[ 104.595915] <TASK>
[ 104.595918] ? show_regs+0x6c/0x80
[ 104.595923] ? __warn+0x8d/0x150
[ 104.595925] ? aq_a2_fw_deinit+0xcf/0xe0 [atlantic]
[ 104.595934] ? report_bug+0x182/0x1b0
[ 104.595938] ? handle_bug+0x6e/0xb0
[ 104.595940] ? exc_invalid_op+0x18/0x80
[ 104.595942] ? asm_exc_invalid_op+0x1b/0x20
[ 104.595944] ? aq_a2_fw_deinit+0xcf/0xe0 [atlantic]
[ 104.595952] ? aq_a2_fw_deinit+0xcf/0xe0 [atlantic]
[ 104.595959] aq_nic_deinit.part.0+0xbd/0xf0 [atlantic]
[ 104.595964] aq_nic_deinit+0x17/0x30 [atlantic]
[ 104.595970] aq_ndev_close+0x2b/0x40 [atlantic]
[ 104.595975] __dev_close_many+0xad/0x160
[ 104.595978] dev_close_many+0x99/0x170
[ 104.595979] unregister_netdevice_many_notify+0x18b/0xb20
[ 104.595981] ? __call_rcu_common+0xcd/0x700
[ 104.595984] unregister_netdevice_queue+0xc6/0x110
[ 104.595986] unregister_netdev+0x1c/0x30
[ 104.595988] aq_pci_remove+0xb1/0xc0 [atlantic]
Fix this by skipping firmware deinitialization altogether if the
PCI device is no longer present.
Tested with an AQC113 attached via Thunderbolt by performing
repeated unplug cycles while traffic was running via iperf.
Fixes: 97bde5c4f909 ("net: ethernet: aquantia: Support for NIC-specific code")
Signed-off-by: Jacob Moroni <mail@jakemoroni.com>
Reviewed-by: Igor Russkikh <irusskikh@marvell.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250203143604.24930-3-mail@jakemoroni.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index fe0e3e2a81171..71e50fc65c147 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -1441,7 +1441,9 @@ void aq_nic_deinit(struct aq_nic_s *self, bool link_down)
aq_ptp_ring_free(self);
aq_ptp_free(self);
- if (likely(self->aq_fw_ops->deinit) && link_down) {
+ /* May be invoked during hot unplug. */
+ if (pci_device_is_present(self->pdev) &&
+ likely(self->aq_fw_ops->deinit) && link_down) {
mutex_lock(&self->fwreq_mutex);
self->aq_fw_ops->deinit(self->aq_hw);
mutex_unlock(&self->fwreq_mutex);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 130/443] net: rose: lock the socket in rose_bind()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 129/443] net: atlantic: fix warning during hot unplug Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 131/443] gpio: sim: lock hog configfs items if present Greg Kroah-Hartman
` (323 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7ff41b5215f0c534534e,
Eric Dumazet, Paolo Abeni, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit a1300691aed9ee852b0a9192e29e2bdc2411a7e6 ]
syzbot reported a soft lockup in rose_loopback_timer(),
with a repro calling bind() from multiple threads.
rose_bind() must lock the socket to avoid this issue.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+7ff41b5215f0c534534e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/67a0f78d.050a0220.d7c5a.00a0.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://patch.msgid.link/20250203170838.3521361-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rose/af_rose.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 72c65d938a150..a4a668b88a8f2 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -701,11 +701,9 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
struct net_device *dev;
ax25_address *source;
ax25_uid_assoc *user;
+ int err = -EINVAL;
int n;
- if (!sock_flag(sk, SOCK_ZAPPED))
- return -EINVAL;
-
if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose))
return -EINVAL;
@@ -718,8 +716,15 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
return -EINVAL;
- if ((dev = rose_dev_get(&addr->srose_addr)) == NULL)
- return -EADDRNOTAVAIL;
+ lock_sock(sk);
+
+ if (!sock_flag(sk, SOCK_ZAPPED))
+ goto out_release;
+
+ err = -EADDRNOTAVAIL;
+ dev = rose_dev_get(&addr->srose_addr);
+ if (!dev)
+ goto out_release;
source = &addr->srose_call;
@@ -730,7 +735,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
} else {
if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
dev_put(dev);
- return -EACCES;
+ err = -EACCES;
+ goto out_release;
}
rose->source_call = *source;
}
@@ -753,8 +759,10 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
rose_insert_socket(sk);
sock_reset_flag(sk, SOCK_ZAPPED);
-
- return 0;
+ err = 0;
+out_release:
+ release_sock(sk);
+ return err;
}
static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 131/443] gpio: sim: lock hog configfs items if present
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 130/443] net: rose: lock the socket in rose_bind() Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 132/443] gpio: GPIO_GRGPIO should depend on OF Greg Kroah-Hartman
` (322 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Koichiro Den, Bartosz Golaszewski,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
[ Upstream commit 015b7dae084fa95465ff89f6cbf15fe49906a370 ]
Depending on the user config, the leaf entry may be the hog directory,
not line. Check it and lock the correct item.
Fixes: 8bd76b3d3f3a ("gpio: sim: lock up configfs that an instantiated device depends on")
Tested-by: Koichiro Den <koichiro.den@canonical.com>
Link: https://lore.kernel.org/r/20250203110123.87701-1-brgl@bgdev.pl
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-sim.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/gpio/gpio-sim.c b/drivers/gpio/gpio-sim.c
index 686ae3d11ba36..940165235db64 100644
--- a/drivers/gpio/gpio-sim.c
+++ b/drivers/gpio/gpio-sim.c
@@ -1033,20 +1033,23 @@ gpio_sim_device_lockup_configfs(struct gpio_sim_device *dev, bool lock)
struct configfs_subsystem *subsys = dev->group.cg_subsys;
struct gpio_sim_bank *bank;
struct gpio_sim_line *line;
+ struct config_item *item;
/*
- * The device only needs to depend on leaf line entries. This is
+ * The device only needs to depend on leaf entries. This is
* sufficient to lock up all the configfs entries that the
* instantiated, alive device depends on.
*/
list_for_each_entry(bank, &dev->bank_list, siblings) {
list_for_each_entry(line, &bank->line_list, siblings) {
+ item = line->hog ? &line->hog->item
+ : &line->group.cg_item;
+
if (lock)
- WARN_ON(configfs_depend_item_unlocked(
- subsys, &line->group.cg_item));
+ WARN_ON(configfs_depend_item_unlocked(subsys,
+ item));
else
- configfs_undepend_item_unlocked(
- &line->group.cg_item);
+ configfs_undepend_item_unlocked(item);
}
}
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 132/443] gpio: GPIO_GRGPIO should depend on OF
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 131/443] gpio: sim: lock hog configfs items if present Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 133/443] x86/xen: fix xen_hypercall_hvm() to not clobber %rbx Greg Kroah-Hartman
` (321 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Andreas Larsson,
Bartosz Golaszewski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 5393f40a640b8c4f716bf87e7b0d4328bf1f22b2 ]
While the Aeroflex Gaisler GRGPIO driver has no build-time dependency on
gpiolib-of, it supports only DT-based configuration, and is used only on
DT systems. Hence add a dependency on OF, to prevent asking the user
about this driver when configuring a kernel without DT support.
Fixes: bc40668def384256 ("gpio: grgpio: drop Kconfig dependency on OF_GPIO")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/db6da3d11bf850d89f199e5c740d8f133e38078d.1738760539.git.geert+renesas@glider.be
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 93ee3aa092f81..1a66ca075aded 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -338,6 +338,7 @@ config GPIO_GRANITERAPIDS
config GPIO_GRGPIO
tristate "Aeroflex Gaisler GRGPIO support"
+ depends on OF || COMPILE_TEST
select GPIO_GENERIC
select IRQ_DOMAIN
help
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 133/443] x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 132/443] gpio: GPIO_GRGPIO should depend on OF Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:24 ` [PATCH 6.13 134/443] x86/xen: add FRAME_END to xen_hypercall_hvm() Greg Kroah-Hartman
` (320 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juergen Gross, Jan Beulich,
Andrew Cooper, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
[ Upstream commit 98a5cfd2320966f40fe049a9855f8787f0126825 ]
xen_hypercall_hvm(), which is used when running as a Xen PVH guest at
most only once during early boot, is clobbering %rbx. Depending on
whether the caller relies on %rbx to be preserved across the call or
not, this clobbering might result in an early crash of the system.
This can be avoided by using an already saved register instead of %rbx.
Fixes: b4845bb63838 ("x86/xen: add central hypercall functions")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/xen/xen-head.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
index 9252652afe596..72f28d66e0e52 100644
--- a/arch/x86/xen/xen-head.S
+++ b/arch/x86/xen/xen-head.S
@@ -117,8 +117,8 @@ SYM_FUNC_START(xen_hypercall_hvm)
pop %ebx
pop %eax
#else
- lea xen_hypercall_amd(%rip), %rbx
- cmp %rax, %rbx
+ lea xen_hypercall_amd(%rip), %rcx
+ cmp %rax, %rcx
#ifdef CONFIG_FRAME_POINTER
pop %rax /* Dummy pop. */
#endif
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 134/443] x86/xen: add FRAME_END to xen_hypercall_hvm()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 133/443] x86/xen: fix xen_hypercall_hvm() to not clobber %rbx Greg Kroah-Hartman
@ 2025-02-13 14:24 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 135/443] ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read() Greg Kroah-Hartman
` (319 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Juergen Gross,
Jan Beulich, Andrew Cooper, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
[ Upstream commit 0bd797b801bd8ee06c822844e20d73aaea0878dd ]
xen_hypercall_hvm() is missing a FRAME_END at the end, add it.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202502030848.HTNTTuo9-lkp@intel.com/
Fixes: b4845bb63838 ("x86/xen: add central hypercall functions")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/xen/xen-head.S | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
index 72f28d66e0e52..4e481b0eefc96 100644
--- a/arch/x86/xen/xen-head.S
+++ b/arch/x86/xen/xen-head.S
@@ -132,6 +132,7 @@ SYM_FUNC_START(xen_hypercall_hvm)
pop %rcx
pop %rax
#endif
+ FRAME_END
/* Use correct hypercall function. */
jz xen_hypercall_amd
jmp xen_hypercall_intel
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 135/443] ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2025-02-13 14:24 ` [PATCH 6.13 134/443] x86/xen: add FRAME_END to xen_hypercall_hvm() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 136/443] pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Greg Kroah-Hartman
` (318 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Rafael J. Wysocki,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit ab930483eca9f3e816c35824b5868599af0c61d7 ]
While analysing code for software and OF node for the corner case when
caller asks to read zero items in the supposed to be an array of values
I found that ACPI behaves differently to what OF does, i.e.
1. It returns -EINVAL when caller asks to read zero items from integer
array, while OF returns 0, if no other errors happened.
2. It returns -EINVAL when caller asks to read zero items from string
array, while OF returns -ENODATA, if no other errors happened.
Amend ACPI implementation to follow what OF does.
Fixes: b31384fa5de3 ("Driver core: Unified device properties interface for platform firmware")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20250203194629.3731895-1-andriy.shevchenko@linux.intel.com
[ rjw: Added empty line after a conditional ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/property.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 80a52a4e66dd1..e9186339f6e6b 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1187,8 +1187,6 @@ static int acpi_data_prop_read(const struct acpi_device_data *data,
}
break;
}
- if (nval == 0)
- return -EINVAL;
if (obj->type == ACPI_TYPE_BUFFER) {
if (proptype != DEV_PROP_U8)
@@ -1212,9 +1210,11 @@ static int acpi_data_prop_read(const struct acpi_device_data *data,
ret = acpi_copy_property_array_uint(items, (u64 *)val, nval);
break;
case DEV_PROP_STRING:
- ret = acpi_copy_property_array_string(
- items, (char **)val,
- min_t(u32, nval, obj->package.count));
+ nval = min_t(u32, nval, obj->package.count);
+ if (nval == 0)
+ return -ENODATA;
+
+ ret = acpi_copy_property_array_string(items, (char **)val, nval);
break;
default:
ret = -EINVAL;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 136/443] pfifo_tail_enqueue: Drop new packet when sch->limit == 0
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 135/443] ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 137/443] netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() Greg Kroah-Hartman
` (317 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quang Le, Cong Wang, Jakub Kicinski,
Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quang Le <quanglex97@gmail.com>
[ Upstream commit 647cef20e649c576dff271e018d5d15d998b629d ]
Expected behaviour:
In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a
packet in scheduler's queue and decrease scheduler's qlen by one.
Then, pfifo_tail_enqueue() enqueue new packet and increase
scheduler's qlen by one. Finally, pfifo_tail_enqueue() return
`NET_XMIT_CN` status code.
Weird behaviour:
In case we set `sch->limit == 0` and trigger pfifo_tail_enqueue() on a
scheduler that has no packet, the 'drop a packet' step will do nothing.
This means the scheduler's qlen still has value equal 0.
Then, we continue to enqueue new packet and increase scheduler's qlen by
one. In summary, we can leverage pfifo_tail_enqueue() to increase qlen by
one and return `NET_XMIT_CN` status code.
The problem is:
Let's say we have two qdiscs: Qdisc_A and Qdisc_B.
- Qdisc_A's type must have '->graft()' function to create parent/child relationship.
Let's say Qdisc_A's type is `hfsc`. Enqueue packet to this qdisc will trigger `hfsc_enqueue`.
- Qdisc_B's type is pfifo_head_drop. Enqueue packet to this qdisc will trigger `pfifo_tail_enqueue`.
- Qdisc_B is configured to have `sch->limit == 0`.
- Qdisc_A is configured to route the enqueued's packet to Qdisc_B.
Enqueue packet through Qdisc_A will lead to:
- hfsc_enqueue(Qdisc_A) -> pfifo_tail_enqueue(Qdisc_B)
- Qdisc_B->q.qlen += 1
- pfifo_tail_enqueue() return `NET_XMIT_CN`
- hfsc_enqueue() check for `NET_XMIT_SUCCESS` and see `NET_XMIT_CN` => hfsc_enqueue() don't increase qlen of Qdisc_A.
The whole process lead to a situation where Qdisc_A->q.qlen == 0 and Qdisc_B->q.qlen == 1.
Replace 'hfsc' with other type (for example: 'drr') still lead to the same problem.
This violate the design where parent's qlen should equal to the sum of its childrens'qlen.
Bug impact: This issue can be used for user->kernel privilege escalation when it is reachable.
Fixes: 57dbb2d83d10 ("sched: add head drop fifo queue")
Reported-by: Quang Le <quanglex97@gmail.com>
Signed-off-by: Quang Le <quanglex97@gmail.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Link: https://patch.msgid.link/20250204005841.223511-2-xiyou.wangcong@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_fifo.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index b50b2c2cc09bc..e6bfd39ff3396 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -40,6 +40,9 @@ static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch,
{
unsigned int prev_backlog;
+ if (unlikely(READ_ONCE(sch->limit) == 0))
+ return qdisc_drop(skb, sch, to_free);
+
if (likely(sch->q.qlen < READ_ONCE(sch->limit)))
return qdisc_enqueue_tail(skb, sch);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 137/443] netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 136/443] pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 138/443] tun: revert fix group permission check Greg Kroah-Hartman
` (316 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Ottens, Mingi Cho, Cong Wang,
Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <cong.wang@bytedance.com>
[ Upstream commit 638ba5089324796c2ee49af10427459c2de35f71 ]
qdisc_tree_reduce_backlog() notifies parent qdisc only if child
qdisc becomes empty, therefore we need to reduce the backlog of the
child qdisc before calling it. Otherwise it would miss the opportunity
to call cops->qlen_notify(), in the case of DRR, it resulted in UAF
since DRR uses ->qlen_notify() to maintain its active list.
Fixes: f8d4bc455047 ("net/sched: netem: account for backlog updates from child qdisc")
Cc: Martin Ottens <martin.ottens@fau.de>
Reported-by: Mingi Cho <mincho@theori.io>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Link: https://patch.msgid.link/20250204005841.223511-4-xiyou.wangcong@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_netem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 71ec9986ed37f..fdd79d3ccd8ce 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -749,9 +749,9 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch)
if (err != NET_XMIT_SUCCESS) {
if (net_xmit_drop_count(err))
qdisc_qstats_drop(sch);
- qdisc_tree_reduce_backlog(sch, 1, pkt_len);
sch->qstats.backlog -= pkt_len;
sch->q.qlen--;
+ qdisc_tree_reduce_backlog(sch, 1, pkt_len);
}
goto tfifo_dequeue;
}
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 138/443] tun: revert fix group permission check
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 137/443] netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 139/443] net: sched: Fix truncation of offloaded action statistics Greg Kroah-Hartman
` (315 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Willem de Bruijn, Ondrej Mosnacek,
Stas Sergeev, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
[ Upstream commit a70c7b3cbc0688016810bb2e0b9b8a0d6a530045 ]
This reverts commit 3ca459eaba1bf96a8c7878de84fa8872259a01e3.
The blamed commit caused a regression when neither tun->owner nor
tun->group is set. This is intended to be allowed, but now requires
CAP_NET_ADMIN.
Discussion in the referenced thread pointed out that the original
issue that prompted this patch can be resolved in userspace.
The relaxed access control may also make a device accessible when it
previously wasn't, while existing users may depend on it to not be.
This is a clean pure git revert, except for fixing the indentation on
the gid_valid line that checkpatch correctly flagged.
Fixes: 3ca459eaba1b ("tun: fix group permission check")
Link: https://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/
Signed-off-by: Willem de Bruijn <willemb@google.com>
Cc: Ondrej Mosnacek <omosnace@redhat.com>
Cc: Stas Sergeev <stsp2@yandex.ru>
Link: https://patch.msgid.link/20250204161015.739430-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/tun.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 28624cca91f8d..acf96f2624887 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -574,18 +574,14 @@ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
return ret;
}
-static inline bool tun_capable(struct tun_struct *tun)
+static inline bool tun_not_capable(struct tun_struct *tun)
{
const struct cred *cred = current_cred();
struct net *net = dev_net(tun->dev);
- if (ns_capable(net->user_ns, CAP_NET_ADMIN))
- return 1;
- if (uid_valid(tun->owner) && uid_eq(cred->euid, tun->owner))
- return 1;
- if (gid_valid(tun->group) && in_egroup_p(tun->group))
- return 1;
- return 0;
+ return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
+ (gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
+ !ns_capable(net->user_ns, CAP_NET_ADMIN);
}
static void tun_set_real_num_queues(struct tun_struct *tun)
@@ -2782,7 +2778,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
!!(tun->flags & IFF_MULTI_QUEUE))
return -EINVAL;
- if (!tun_capable(tun))
+ if (tun_not_capable(tun))
return -EPERM;
err = security_tun_dev_open(tun->security);
if (err < 0)
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 139/443] net: sched: Fix truncation of offloaded action statistics
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 138/443] tun: revert fix group permission check Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 140/443] rxrpc: Fix call state set to not include the SERVER_SECURING state Greg Kroah-Hartman
` (314 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Botha, Ido Schimmel,
Petr Machata, Simon Horman, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 811b8f534fd85e17077bd2ac0413bcd16cc8fb9b ]
In case of tc offload, when user space queries the kernel for tc action
statistics, tc will query the offloaded statistics from device drivers.
Among other statistics, drivers are expected to pass the number of
packets that hit the action since the last query as a 64-bit number.
Unfortunately, tc treats the number of packets as a 32-bit number,
leading to truncation and incorrect statistics when the number of
packets since the last query exceeds 0xffffffff:
$ tc -s filter show dev swp2 ingress
filter protocol all pref 1 flower chain 0
filter protocol all pref 1 flower chain 0 handle 0x1
skip_sw
in_hw in_hw_count 1
action order 1: mirred (Egress Redirect to device swp1) stolen
index 1 ref 1 bind 1 installed 58 sec used 0 sec
Action statistics:
Sent 1133877034176 bytes 536959475 pkt (dropped 0, overlimits 0 requeues 0)
[...]
According to the above, 2111-byte packets were redirected which is
impossible as only 64-byte packets were transmitted and the MTU was
1500.
Fix by treating packets as a 64-bit number:
$ tc -s filter show dev swp2 ingress
filter protocol all pref 1 flower chain 0
filter protocol all pref 1 flower chain 0 handle 0x1
skip_sw
in_hw in_hw_count 1
action order 1: mirred (Egress Redirect to device swp1) stolen
index 1 ref 1 bind 1 installed 61 sec used 0 sec
Action statistics:
Sent 1370624380864 bytes 21416005951 pkt (dropped 0, overlimits 0 requeues 0)
[...]
Which shows that only 64-byte packets were redirected (1370624380864 /
21416005951 = 64).
Fixes: 380407023526 ("net/sched: Enable netdev drivers to update statistics of offloaded actions")
Reported-by: Joe Botha <joe@atomic.ac>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250204123839.1151804-1-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sch_generic.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 1e6324f0d4efd..24e48af7e8f74 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -851,7 +851,7 @@ static inline int qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch,
}
static inline void _bstats_update(struct gnet_stats_basic_sync *bstats,
- __u64 bytes, __u32 packets)
+ __u64 bytes, __u64 packets)
{
u64_stats_update_begin(&bstats->syncp);
u64_stats_add(&bstats->bytes, bytes);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 140/443] rxrpc: Fix call state set to not include the SERVER_SECURING state
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 139/443] net: sched: Fix truncation of offloaded action statistics Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 141/443] PCI/TPH: Restore TPH Requester Enable correctly Greg Kroah-Hartman
` (313 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
Simon Horman, linux-afs, Jakub Kicinski, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 41b996ce83bf944de5569d6263c8dbd5513e7ed0 ]
The RXRPC_CALL_SERVER_SECURING state doesn't really belong with the other
states in the call's state set as the other states govern the call's Rx/Tx
phase transition and govern when packets can and can't be received or
transmitted. The "Securing" state doesn't actually govern the reception of
packets and would need to be split depending on whether or not we've
received the last packet yet (to mirror RECV_REQUEST/ACK_REQUEST).
The "Securing" state is more about whether or not we can start forwarding
packets to the application as recvmsg will need to decode them and the
decoding can't take place until the challenge/response exchange has
completed.
Fix this by removing the RXRPC_CALL_SERVER_SECURING state from the state
set and, instead, using a flag, RXRPC_CALL_CONN_CHALLENGING, to track
whether or not we can queue the call for reception by recvmsg() or notify
the kernel app that data is ready. In the event that we've already
received all the packets, the connection event handler will poke the app
layer in the appropriate manner.
Also there's a race whereby the app layer sees the last packet before rxrpc
has managed to end the rx phase and change the state to one amenable to
allowing a reply. Fix this by queuing the packet after calling
rxrpc_end_rx_phase().
Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
Link: https://patch.msgid.link/20250204230558.712536-2-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rxrpc/ar-internal.h | 2 +-
net/rxrpc/call_object.c | 6 ++----
net/rxrpc/conn_event.c | 4 +---
net/rxrpc/input.c | 2 +-
net/rxrpc/sendmsg.c | 2 +-
5 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index d0fd37bdcfe9c..6b036c0564c7a 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -567,6 +567,7 @@ enum rxrpc_call_flag {
RXRPC_CALL_EXCLUSIVE, /* The call uses a once-only connection */
RXRPC_CALL_RX_IS_IDLE, /* recvmsg() is idle - send an ACK */
RXRPC_CALL_RECVMSG_READ_ALL, /* recvmsg() read all of the received data */
+ RXRPC_CALL_CONN_CHALLENGING, /* The connection is being challenged */
};
/*
@@ -587,7 +588,6 @@ enum rxrpc_call_state {
RXRPC_CALL_CLIENT_AWAIT_REPLY, /* - client awaiting reply */
RXRPC_CALL_CLIENT_RECV_REPLY, /* - client receiving reply phase */
RXRPC_CALL_SERVER_PREALLOC, /* - service preallocation */
- RXRPC_CALL_SERVER_SECURING, /* - server securing request connection */
RXRPC_CALL_SERVER_RECV_REQUEST, /* - server receiving request */
RXRPC_CALL_SERVER_ACK_REQUEST, /* - server pending ACK of request */
RXRPC_CALL_SERVER_SEND_REPLY, /* - server sending reply */
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index f9e983a12c149..e379a2a9375ae 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -22,7 +22,6 @@ const char *const rxrpc_call_states[NR__RXRPC_CALL_STATES] = {
[RXRPC_CALL_CLIENT_AWAIT_REPLY] = "ClAwtRpl",
[RXRPC_CALL_CLIENT_RECV_REPLY] = "ClRcvRpl",
[RXRPC_CALL_SERVER_PREALLOC] = "SvPrealc",
- [RXRPC_CALL_SERVER_SECURING] = "SvSecure",
[RXRPC_CALL_SERVER_RECV_REQUEST] = "SvRcvReq",
[RXRPC_CALL_SERVER_ACK_REQUEST] = "SvAckReq",
[RXRPC_CALL_SERVER_SEND_REPLY] = "SvSndRpl",
@@ -453,17 +452,16 @@ void rxrpc_incoming_call(struct rxrpc_sock *rx,
call->cong_tstamp = skb->tstamp;
__set_bit(RXRPC_CALL_EXPOSED, &call->flags);
- rxrpc_set_call_state(call, RXRPC_CALL_SERVER_SECURING);
+ rxrpc_set_call_state(call, RXRPC_CALL_SERVER_RECV_REQUEST);
spin_lock(&conn->state_lock);
switch (conn->state) {
case RXRPC_CONN_SERVICE_UNSECURED:
case RXRPC_CONN_SERVICE_CHALLENGING:
- rxrpc_set_call_state(call, RXRPC_CALL_SERVER_SECURING);
+ __set_bit(RXRPC_CALL_CONN_CHALLENGING, &call->flags);
break;
case RXRPC_CONN_SERVICE:
- rxrpc_set_call_state(call, RXRPC_CALL_SERVER_RECV_REQUEST);
break;
case RXRPC_CONN_ABORTED:
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index ca5e694ab858b..c4eb7986efddf 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -222,10 +222,8 @@ static void rxrpc_abort_calls(struct rxrpc_connection *conn)
*/
static void rxrpc_call_is_secure(struct rxrpc_call *call)
{
- if (call && __rxrpc_call_state(call) == RXRPC_CALL_SERVER_SECURING) {
- rxrpc_set_call_state(call, RXRPC_CALL_SERVER_RECV_REQUEST);
+ if (call && __test_and_clear_bit(RXRPC_CALL_CONN_CHALLENGING, &call->flags))
rxrpc_notify_socket(call);
- }
}
/*
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 16d49a861dbb5..6a075a7c190db 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -573,7 +573,7 @@ static bool rxrpc_input_split_jumbo(struct rxrpc_call *call, struct sk_buff *skb
rxrpc_propose_delay_ACK(call, sp->hdr.serial,
rxrpc_propose_ack_input_data);
}
- if (notify) {
+ if (notify && !test_bit(RXRPC_CALL_CONN_CHALLENGING, &call->flags)) {
trace_rxrpc_notify_socket(call->debug_id, sp->hdr.serial);
rxrpc_notify_socket(call);
}
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 6abb8eec1b2b1..708a1484dadac 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -655,7 +655,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
} else {
switch (rxrpc_call_state(call)) {
case RXRPC_CALL_CLIENT_AWAIT_CONN:
- case RXRPC_CALL_SERVER_SECURING:
+ case RXRPC_CALL_SERVER_RECV_REQUEST:
if (p.command == RXRPC_CMD_SEND_ABORT)
break;
fallthrough;
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 141/443] PCI/TPH: Restore TPH Requester Enable correctly
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 140/443] rxrpc: Fix call state set to not include the SERVER_SECURING state Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 142/443] cpufreq: fix using cpufreq-dt as module Greg Kroah-Hartman
` (312 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Murphy, Bjorn Helgaas,
Wei Huang, Sasha Levin
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
[ Upstream commit 6f64b83d9fe9729000a0616830cb1606945465d8 ]
When we reenable TPH after changing a Steering Tag value, we need the
actual TPH Requester Enable value, not the ST Mode (which only happens to
work out by chance for non-extended TPH in interrupt vector mode).
Link: https://lore.kernel.org/r/13118098116d7bce07aa20b8c52e28c7d1847246.1738759933.git.robin.murphy@arm.com
Fixes: d2e8a34876ce ("PCI/TPH: Add Steering Tag support")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Wei Huang <wei.huang2@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/tph.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c
index 1e604fbbda657..07de59ca2ebfa 100644
--- a/drivers/pci/tph.c
+++ b/drivers/pci/tph.c
@@ -360,7 +360,7 @@ int pcie_tph_set_st_entry(struct pci_dev *pdev, unsigned int index, u16 tag)
return err;
}
- set_ctrl_reg_req_en(pdev, pdev->tph_mode);
+ set_ctrl_reg_req_en(pdev, pdev->tph_req_type);
pci_dbg(pdev, "set steering tag: %s table, index=%d, tag=%#04x\n",
(loc == PCI_TPH_LOC_MSIX) ? "MSI-X" : "ST", index, tag);
--
2.39.5
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 142/443] cpufreq: fix using cpufreq-dt as module
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 141/443] PCI/TPH: Restore TPH Requester Enable correctly Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 143/443] cpufreq: s3c64xx: Fix compilation warning Greg Kroah-Hartman
` (311 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Kemnade, Radu Rendec,
Javier Martinez Canillas, Viresh Kumar
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <andreas@kemnade.info>
commit f1f010c9d9c62c865d9f54e94075800ba764b4d9 upstream.
This driver can be built as a module since commit 3b062a086984 ("cpufreq:
dt-platdev: Support building as module"), but unfortunately this caused
a regression because the cputfreq-dt-platdev.ko module does not autoload.
Usually, this is solved by just using the MODULE_DEVICE_TABLE() macro to
export all the device IDs as module aliases. But this driver is special
due how matches with devices and decides what platform supports.
There are two of_device_id lists, an allow list that are for CPU devices
that always match and a deny list that's for devices that must not match.
The driver registers a cpufreq-dt platform device for all the CPU device
nodes that either are in the allow list or contain an operating-points-v2
property and are not in the deny list.
Enforce builtin compile of cpufreq-dt-platdev to make autoload work.
Fixes: 3b062a086984 ("cpufreq: dt-platdev: Support building as module")
Link: https://lore.kernel.org/all/20241104201424.2a42efdd@akair/
Link: https://lore.kernel.org/all/20241119111918.1732531-1-javierm@redhat.com/
Cc: stable@vger.kernel.org
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Reported-by: Radu Rendec <rrendec@redhat.com>
Reported-by: Javier Martinez Canillas <javierm@redhat.com>
[ Viresh: Picked commit log from Javier, updated tags ]
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/Kconfig | 2 +-
drivers/cpufreq/cpufreq-dt-platdev.c | 2 --
2 files changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -232,7 +232,7 @@ config CPUFREQ_VIRT
If in doubt, say N.
config CPUFREQ_DT_PLATDEV
- tristate "Generic DT based cpufreq platdev driver"
+ bool "Generic DT based cpufreq platdev driver"
depends on OF
help
This adds a generic DT based cpufreq platdev driver for frequency
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -235,5 +235,3 @@ create_pdev:
sizeof(struct cpufreq_dt_platform_data)));
}
core_initcall(cpufreq_dt_platdev_init);
-MODULE_DESCRIPTION("Generic DT based cpufreq platdev driver");
-MODULE_LICENSE("GPL");
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 143/443] cpufreq: s3c64xx: Fix compilation warning
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 142/443] cpufreq: fix using cpufreq-dt as module Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 144/443] leds: lp8860: Write full EEPROM, not only half of it Greg Kroah-Hartman
` (310 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Viresh Kumar,
Rafael J. Wysocki
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <viresh.kumar@linaro.org>
commit 43855ac61483cb914f060851535ea753c094b3e0 upstream.
The driver generates following warning when regulator support isn't
enabled in the kernel. Fix it.
drivers/cpufreq/s3c64xx-cpufreq.c: In function 's3c64xx_cpufreq_set_target':
>> drivers/cpufreq/s3c64xx-cpufreq.c:55:22: warning: variable 'old_freq' set but not used [-Wunused-but-set-variable]
55 | unsigned int old_freq, new_freq;
| ^~~~~~~~
>> drivers/cpufreq/s3c64xx-cpufreq.c:54:30: warning: variable 'dvfs' set but not used [-Wunused-but-set-variable]
54 | struct s3c64xx_dvfs *dvfs;
| ^~~~
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202501191803.CtfT7b2o-lkp@intel.com/
Cc: 5.4+ <stable@vger.kernel.org> # v5.4+
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Link: https://patch.msgid.link/236b227e929e5adc04d1e9e7af6845a46c8e9432.1737525916.git.viresh.kumar@linaro.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/s3c64xx-cpufreq.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/cpufreq/s3c64xx-cpufreq.c
+++ b/drivers/cpufreq/s3c64xx-cpufreq.c
@@ -24,6 +24,7 @@ struct s3c64xx_dvfs {
unsigned int vddarm_max;
};
+#ifdef CONFIG_REGULATOR
static struct s3c64xx_dvfs s3c64xx_dvfs_table[] = {
[0] = { 1000000, 1150000 },
[1] = { 1050000, 1150000 },
@@ -31,6 +32,7 @@ static struct s3c64xx_dvfs s3c64xx_dvfs_
[3] = { 1200000, 1350000 },
[4] = { 1300000, 1350000 },
};
+#endif
static struct cpufreq_frequency_table s3c64xx_freq_table[] = {
{ 0, 0, 66000 },
@@ -51,15 +53,16 @@ static struct cpufreq_frequency_table s3
static int s3c64xx_cpufreq_set_target(struct cpufreq_policy *policy,
unsigned int index)
{
- struct s3c64xx_dvfs *dvfs;
- unsigned int old_freq, new_freq;
+ unsigned int new_freq = s3c64xx_freq_table[index].frequency;
int ret;
+#ifdef CONFIG_REGULATOR
+ struct s3c64xx_dvfs *dvfs;
+ unsigned int old_freq;
+
old_freq = clk_get_rate(policy->clk) / 1000;
- new_freq = s3c64xx_freq_table[index].frequency;
dvfs = &s3c64xx_dvfs_table[s3c64xx_freq_table[index].driver_data];
-#ifdef CONFIG_REGULATOR
if (vddarm && new_freq > old_freq) {
ret = regulator_set_voltage(vddarm,
dvfs->vddarm_min,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 144/443] leds: lp8860: Write full EEPROM, not only half of it
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 143/443] cpufreq: s3c64xx: Fix compilation warning Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 145/443] ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx Greg Kroah-Hartman
` (309 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Sverdlin, Lee Jones
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
commit 0d2e820a86793595e2a776855d04701109e46663 upstream.
I struggle to explain dividing an ARRAY_SIZE() by the size of an element
once again. As the latter equals to 2, only the half of EEPROM was ever
written. Drop the unexplainable division and write full ARRAY_SIZE().
Cc: stable@vger.kernel.org
Fixes: 7a8685accb95 ("leds: lp8860: Introduce TI lp8860 4 channel LED driver")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Link: https://lore.kernel.org/r/20241114101402.2562878-1-alexander.sverdlin@siemens.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/leds-lp8860.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/leds/leds-lp8860.c
+++ b/drivers/leds/leds-lp8860.c
@@ -265,7 +265,7 @@ static int lp8860_init(struct lp8860_led
goto out;
}
- reg_count = ARRAY_SIZE(lp8860_eeprom_disp_regs) / sizeof(lp8860_eeprom_disp_regs[0]);
+ reg_count = ARRAY_SIZE(lp8860_eeprom_disp_regs);
for (i = 0; i < reg_count; i++) {
ret = regmap_write(led->eeprom_regmap,
lp8860_eeprom_disp_regs[i].reg,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 145/443] ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 144/443] leds: lp8860: Write full EEPROM, not only half of it Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 146/443] cifs: Remove intermediate object of failed create SFU call Greg Kroah-Hartman
` (308 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sebastian Wiese-Wagner, Takashi Iwai
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Wiese-Wagner <seb@fastmail.to>
commit 711aad3c43a9853657e00225466d204e46ae528b upstream.
This HP Laptop uses ALC236 codec with COEF 0x07 controlling the mute
LED. Enable existing quirk for this device.
Signed-off-by: Sebastian Wiese-Wagner <seb@fastmail.to>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20250120181240.13106-1-seb@fastmail.to
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10389,6 +10389,7 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x103c, 0x8870, "HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
SND_PCI_QUIRK(0x103c, 0x8873, "HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
SND_PCI_QUIRK(0x103c, 0x887a, "HP Laptop 15s-eq2xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x887c, "HP Laptop 14s-fq1xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
SND_PCI_QUIRK(0x103c, 0x888a, "HP ENVY x360 Convertible 15-eu0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS),
SND_PCI_QUIRK(0x103c, 0x888d, "HP ZBook Power 15.6 inch G8 Mobile Workstation PC", ALC236_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8895, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 146/443] cifs: Remove intermediate object of failed create SFU call
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 145/443] ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 147/443] drm/modeset: Handle tiled displays in pan_display_atomic Greg Kroah-Hartman
` (307 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pali Rohár, Steve French
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pali Rohár <pali@kernel.org>
commit 25f6184e24b3991eae977a29ecf27d537cc930b2 upstream.
Check if the server honored ATTR_SYSTEM flag by CREATE_OPTION_SPECIAL
option. If not then server does not support ATTR_SYSTEM and newly
created file is not SFU compatible, which means that the call failed.
If CREATE was successful but either setting ATTR_SYSTEM failed or
writing type/data information failed then remove the intermediate
object created by CREATE. Otherwise intermediate empty object stay
on the server.
This ensures that if the creating of SFU files with system attribute is
unsupported by the server then no empty file stay on the server as a result
of unsupported operation.
This is for example case with Samba server and Linux tmpfs storage without
enabled xattr support (where Samba stores ATTR_SYSTEM bit).
Cc: stable@vger.kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2ops.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5077,6 +5077,7 @@ int __cifs_sfu_make_node(unsigned int xi
{
struct TCP_Server_Info *server = tcon->ses->server;
struct cifs_open_parms oparms;
+ struct cifs_open_info_data idata;
struct cifs_io_parms io_parms = {};
struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
struct cifs_fid fid;
@@ -5146,10 +5147,20 @@ int __cifs_sfu_make_node(unsigned int xi
CREATE_OPTION_SPECIAL, ACL_NO_MODE);
oparms.fid = &fid;
- rc = server->ops->open(xid, &oparms, &oplock, NULL);
+ rc = server->ops->open(xid, &oparms, &oplock, &idata);
if (rc)
goto out;
+ /*
+ * Check if the server honored ATTR_SYSTEM flag by CREATE_OPTION_SPECIAL
+ * option. If not then server does not support ATTR_SYSTEM and newly
+ * created file is not SFU compatible, which means that the call failed.
+ */
+ if (!(le32_to_cpu(idata.fi.Attributes) & ATTR_SYSTEM)) {
+ rc = -EOPNOTSUPP;
+ goto out_close;
+ }
+
if (type_len + data_len > 0) {
io_parms.pid = current->tgid;
io_parms.tcon = tcon;
@@ -5164,8 +5175,18 @@ int __cifs_sfu_make_node(unsigned int xi
iov, ARRAY_SIZE(iov)-1);
}
+out_close:
server->ops->close(xid, tcon, &fid);
+ /*
+ * If CREATE was successful but either setting ATTR_SYSTEM failed or
+ * writing type/data information failed then remove the intermediate
+ * object created by CREATE. Otherwise intermediate empty object stay
+ * on the server.
+ */
+ if (rc)
+ server->ops->unlink(xid, tcon, full_path, cifs_sb, NULL);
+
out:
kfree(symname_utf16);
return rc;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 147/443] drm/modeset: Handle tiled displays in pan_display_atomic.
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 146/443] cifs: Remove intermediate object of failed create SFU call Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 148/443] drm/client: Handle tiled displays better Greg Kroah-Hartman
` (306 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Maarten Lankhorst
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <dev@lankhorst.se>
commit f4a9dd57e549a17a7dac1c1defec26abd7e5c2d4 upstream.
Tiled displays have a different x/y offset to begin with. Instead of
attempting to remember this, just apply a delta instead.
This fixes the first tile being duplicated on other tiles when vt
switching.
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20250116142825.3933-1-dev@lankhorst.se
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_fb_helper.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1354,14 +1354,14 @@ int drm_fb_helper_set_par(struct fb_info
}
EXPORT_SYMBOL(drm_fb_helper_set_par);
-static void pan_set(struct drm_fb_helper *fb_helper, int x, int y)
+static void pan_set(struct drm_fb_helper *fb_helper, int dx, int dy)
{
struct drm_mode_set *mode_set;
mutex_lock(&fb_helper->client.modeset_mutex);
drm_client_for_each_modeset(mode_set, &fb_helper->client) {
- mode_set->x = x;
- mode_set->y = y;
+ mode_set->x += dx;
+ mode_set->y += dy;
}
mutex_unlock(&fb_helper->client.modeset_mutex);
}
@@ -1370,16 +1370,18 @@ static int pan_display_atomic(struct fb_
struct fb_info *info)
{
struct drm_fb_helper *fb_helper = info->par;
- int ret;
+ int ret, dx, dy;
- pan_set(fb_helper, var->xoffset, var->yoffset);
+ dx = var->xoffset - info->var.xoffset;
+ dy = var->yoffset - info->var.yoffset;
+ pan_set(fb_helper, dx, dy);
ret = drm_client_modeset_commit_locked(&fb_helper->client);
if (!ret) {
info->var.xoffset = var->xoffset;
info->var.yoffset = var->yoffset;
} else
- pan_set(fb_helper, info->var.xoffset, info->var.yoffset);
+ pan_set(fb_helper, -dx, -dy);
return ret;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 148/443] drm/client: Handle tiled displays better
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 147/443] drm/modeset: Handle tiled displays in pan_display_atomic Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 149/443] smb: client: fix order of arguments of tracepoints Greg Kroah-Hartman
` (305 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Maarten Lankhorst
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <dev@lankhorst.se>
commit 10026f536843eb8c9148ef6ffb4c6deeebc26838 upstream.
When testing on my tiled display, initially the tiled display is
detected correctly:
[90376.523692] xe 0000:67:00.0: [drm:drm_client_firmware_config.isra.0 [drm]] fallback: Not all outputs enabled
[90376.523713] xe 0000:67:00.0: [drm:drm_client_firmware_config.isra.0 [drm]] Enabled: 0, detected: 2
...
[90376.523967] xe 0000:67:00.0: [drm:drm_client_modeset_probe [drm]] [CRTC:82:pipe A] desired mode 1920x2160 set (1920,0)
[90376.524020] xe 0000:67:00.0: [drm:drm_client_modeset_probe [drm]] [CRTC:134:pipe B] desired mode 1920x2160 set (0,0)
But then, when modes have been set:
[90379.729525] xe 0000:67:00.0: [drm:drm_client_firmware_config.isra.0 [drm]] [CONNECTOR:287:DP-4] on [CRTC:82:pipe A]: 1920x2160
[90379.729640] xe 0000:67:00.0: [drm:drm_client_firmware_config.isra.0 [drm]] [CONNECTOR:289:DP-5] on [CRTC:134:pipe B]: 1920x2160
...
[90379.730036] xe 0000:67:00.0: [drm:drm_client_modeset_probe [drm]] [CRTC:82:pipe A] desired mode 1920x2160 set (0,0)
[90379.730124] xe 0000:67:00.0: [drm:drm_client_modeset_probe [drm]] [CRTC:134:pipe B] desired mode 1920x2160 set (0,0)
Call drm_client_get_tile_offsets() in drm_client_firmware_config() as
well, to ensure that the offset is set correctly.
This has to be done as a separate pass, as the tile order may not be
equal to the drm connector order.
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20250116142825.3933-2-dev@lankhorst.se
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_client_modeset.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/gpu/drm/drm_client_modeset.c
+++ b/drivers/gpu/drm/drm_client_modeset.c
@@ -743,6 +743,15 @@ retry:
if ((conn_configured & mask) != mask && conn_configured != conn_seq)
goto retry;
+ for (i = 0; i < count; i++) {
+ struct drm_connector *connector = connectors[i];
+
+ if (connector->has_tile)
+ drm_client_get_tile_offsets(dev, connectors, connector_count,
+ modes, offsets, i,
+ connector->tile_h_loc, connector->tile_v_loc);
+ }
+
/*
* If the BIOS didn't enable everything it could, fall back to have the
* same user experiencing of lighting up as much as possible like the
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 149/443] smb: client: fix order of arguments of tracepoints
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 148/443] drm/client: Handle tiled displays better Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 150/443] smb: client: change lease epoch type from unsigned int to __u16 Greg Kroah-Hartman
` (304 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruben Devos, Steve French
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruben Devos <devosruben6@gmail.com>
commit 11f8b80ab9f99291dc88d09855b9f8f43b772335 upstream.
The tracepoints based on smb3_inf_compound_*_class have tcon id and
session id swapped around. This results in incorrect output in
`trace-cmd report`.
Fix the order of arguments to resolve this issue. The trace-cmd output
below shows the before and after of the smb3_delete_enter and
smb3_delete_done events as an example. The smb3_cmd_* events show the
correct session and tcon id for reference.
Also fix tracepoint set -> get in the SMB2_OP_GET_REPARSE case.
BEFORE:
rm-2211 [001] ..... 1839.550888: smb3_delete_enter: xid=281 sid=0x5 tid=0x3d path=\hello2.txt
rm-2211 [001] ..... 1839.550894: smb3_cmd_enter: sid=0x1ac000000003d tid=0x5 cmd=5 mid=61
rm-2211 [001] ..... 1839.550896: smb3_cmd_enter: sid=0x1ac000000003d tid=0x5 cmd=6 mid=62
rm-2211 [001] ..... 1839.552091: smb3_cmd_done: sid=0x1ac000000003d tid=0x5 cmd=5 mid=61
rm-2211 [001] ..... 1839.552093: smb3_cmd_done: sid=0x1ac000000003d tid=0x5 cmd=6 mid=62
rm-2211 [001] ..... 1839.552103: smb3_delete_done: xid=281 sid=0x5 tid=0x3d
AFTER:
rm-2501 [001] ..... 3237.656110: smb3_delete_enter: xid=88 sid=0x1ac0000000041 tid=0x5 path=\hello2.txt
rm-2501 [001] ..... 3237.656122: smb3_cmd_enter: sid=0x1ac0000000041 tid=0x5 cmd=5 mid=84
rm-2501 [001] ..... 3237.656123: smb3_cmd_enter: sid=0x1ac0000000041 tid=0x5 cmd=6 mid=85
rm-2501 [001] ..... 3237.657909: smb3_cmd_done: sid=0x1ac0000000041 tid=0x5 cmd=5 mid=84
rm-2501 [001] ..... 3237.657909: smb3_cmd_done: sid=0x1ac0000000041 tid=0x5 cmd=6 mid=85
rm-2501 [001] ..... 3237.657922: smb3_delete_done: xid=88 sid=0x1ac0000000041 tid=0x5
Cc: stable@vger.kernel.org
Signed-off-by: Ruben Devos <devosruben6@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/dir.c | 6 +-
fs/smb/client/smb2inode.c | 108 +++++++++++++++++++++++-----------------------
2 files changed, 57 insertions(+), 57 deletions(-)
--- a/fs/smb/client/dir.c
+++ b/fs/smb/client/dir.c
@@ -627,7 +627,7 @@ int cifs_mknod(struct mnt_idmap *idmap,
goto mknod_out;
}
- trace_smb3_mknod_enter(xid, tcon->ses->Suid, tcon->tid, full_path);
+ trace_smb3_mknod_enter(xid, tcon->tid, tcon->ses->Suid, full_path);
rc = tcon->ses->server->ops->make_node(xid, inode, direntry, tcon,
full_path, mode,
@@ -635,9 +635,9 @@ int cifs_mknod(struct mnt_idmap *idmap,
mknod_out:
if (rc)
- trace_smb3_mknod_err(xid, tcon->ses->Suid, tcon->tid, rc);
+ trace_smb3_mknod_err(xid, tcon->tid, tcon->ses->Suid, rc);
else
- trace_smb3_mknod_done(xid, tcon->ses->Suid, tcon->tid);
+ trace_smb3_mknod_done(xid, tcon->tid, tcon->ses->Suid);
free_dentry_path(page);
free_xid(xid);
--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
@@ -298,8 +298,8 @@ replay_again:
goto finished;
}
num_rqst++;
- trace_smb3_query_info_compound_enter(xid, ses->Suid,
- tcon->tid, full_path);
+ trace_smb3_query_info_compound_enter(xid, tcon->tid,
+ ses->Suid, full_path);
break;
case SMB2_OP_POSIX_QUERY_INFO:
rqst[num_rqst].rq_iov = &vars->qi_iov;
@@ -334,18 +334,18 @@ replay_again:
goto finished;
}
num_rqst++;
- trace_smb3_posix_query_info_compound_enter(xid, ses->Suid,
- tcon->tid, full_path);
+ trace_smb3_posix_query_info_compound_enter(xid, tcon->tid,
+ ses->Suid, full_path);
break;
case SMB2_OP_DELETE:
- trace_smb3_delete_enter(xid, ses->Suid, tcon->tid, full_path);
+ trace_smb3_delete_enter(xid, tcon->tid, ses->Suid, full_path);
break;
case SMB2_OP_MKDIR:
/*
* Directories are created through parameters in the
* SMB2_open() call.
*/
- trace_smb3_mkdir_enter(xid, ses->Suid, tcon->tid, full_path);
+ trace_smb3_mkdir_enter(xid, tcon->tid, ses->Suid, full_path);
break;
case SMB2_OP_RMDIR:
rqst[num_rqst].rq_iov = &vars->si_iov[0];
@@ -363,7 +363,7 @@ replay_again:
goto finished;
smb2_set_next_command(tcon, &rqst[num_rqst]);
smb2_set_related(&rqst[num_rqst++]);
- trace_smb3_rmdir_enter(xid, ses->Suid, tcon->tid, full_path);
+ trace_smb3_rmdir_enter(xid, tcon->tid, ses->Suid, full_path);
break;
case SMB2_OP_SET_EOF:
rqst[num_rqst].rq_iov = &vars->si_iov[0];
@@ -398,7 +398,7 @@ replay_again:
goto finished;
}
num_rqst++;
- trace_smb3_set_eof_enter(xid, ses->Suid, tcon->tid, full_path);
+ trace_smb3_set_eof_enter(xid, tcon->tid, ses->Suid, full_path);
break;
case SMB2_OP_SET_INFO:
rqst[num_rqst].rq_iov = &vars->si_iov[0];
@@ -429,8 +429,8 @@ replay_again:
goto finished;
}
num_rqst++;
- trace_smb3_set_info_compound_enter(xid, ses->Suid,
- tcon->tid, full_path);
+ trace_smb3_set_info_compound_enter(xid, tcon->tid,
+ ses->Suid, full_path);
break;
case SMB2_OP_RENAME:
rqst[num_rqst].rq_iov = &vars->si_iov[0];
@@ -469,7 +469,7 @@ replay_again:
goto finished;
}
num_rqst++;
- trace_smb3_rename_enter(xid, ses->Suid, tcon->tid, full_path);
+ trace_smb3_rename_enter(xid, tcon->tid, ses->Suid, full_path);
break;
case SMB2_OP_HARDLINK:
rqst[num_rqst].rq_iov = &vars->si_iov[0];
@@ -496,7 +496,7 @@ replay_again:
goto finished;
smb2_set_next_command(tcon, &rqst[num_rqst]);
smb2_set_related(&rqst[num_rqst++]);
- trace_smb3_hardlink_enter(xid, ses->Suid, tcon->tid, full_path);
+ trace_smb3_hardlink_enter(xid, tcon->tid, ses->Suid, full_path);
break;
case SMB2_OP_SET_REPARSE:
rqst[num_rqst].rq_iov = vars->io_iov;
@@ -523,8 +523,8 @@ replay_again:
goto finished;
}
num_rqst++;
- trace_smb3_set_reparse_compound_enter(xid, ses->Suid,
- tcon->tid, full_path);
+ trace_smb3_set_reparse_compound_enter(xid, tcon->tid,
+ ses->Suid, full_path);
break;
case SMB2_OP_GET_REPARSE:
rqst[num_rqst].rq_iov = vars->io_iov;
@@ -549,8 +549,8 @@ replay_again:
goto finished;
}
num_rqst++;
- trace_smb3_get_reparse_compound_enter(xid, ses->Suid,
- tcon->tid, full_path);
+ trace_smb3_get_reparse_compound_enter(xid, tcon->tid,
+ ses->Suid, full_path);
break;
case SMB2_OP_QUERY_WSL_EA:
rqst[num_rqst].rq_iov = &vars->ea_iov;
@@ -663,11 +663,11 @@ finished:
}
SMB2_query_info_free(&rqst[num_rqst++]);
if (rc)
- trace_smb3_query_info_compound_err(xid, ses->Suid,
- tcon->tid, rc);
+ trace_smb3_query_info_compound_err(xid, tcon->tid,
+ ses->Suid, rc);
else
- trace_smb3_query_info_compound_done(xid, ses->Suid,
- tcon->tid);
+ trace_smb3_query_info_compound_done(xid, tcon->tid,
+ ses->Suid);
break;
case SMB2_OP_POSIX_QUERY_INFO:
idata = in_iov[i].iov_base;
@@ -690,15 +690,15 @@ finished:
SMB2_query_info_free(&rqst[num_rqst++]);
if (rc)
- trace_smb3_posix_query_info_compound_err(xid, ses->Suid,
- tcon->tid, rc);
+ trace_smb3_posix_query_info_compound_err(xid, tcon->tid,
+ ses->Suid, rc);
else
- trace_smb3_posix_query_info_compound_done(xid, ses->Suid,
- tcon->tid);
+ trace_smb3_posix_query_info_compound_done(xid, tcon->tid,
+ ses->Suid);
break;
case SMB2_OP_DELETE:
if (rc)
- trace_smb3_delete_err(xid, ses->Suid, tcon->tid, rc);
+ trace_smb3_delete_err(xid, tcon->tid, ses->Suid, rc);
else {
/*
* If dentry (hence, inode) is NULL, lease break is going to
@@ -706,59 +706,59 @@ finished:
*/
if (inode)
cifs_mark_open_handles_for_deleted_file(inode, full_path);
- trace_smb3_delete_done(xid, ses->Suid, tcon->tid);
+ trace_smb3_delete_done(xid, tcon->tid, ses->Suid);
}
break;
case SMB2_OP_MKDIR:
if (rc)
- trace_smb3_mkdir_err(xid, ses->Suid, tcon->tid, rc);
+ trace_smb3_mkdir_err(xid, tcon->tid, ses->Suid, rc);
else
- trace_smb3_mkdir_done(xid, ses->Suid, tcon->tid);
+ trace_smb3_mkdir_done(xid, tcon->tid, ses->Suid);
break;
case SMB2_OP_HARDLINK:
if (rc)
- trace_smb3_hardlink_err(xid, ses->Suid, tcon->tid, rc);
+ trace_smb3_hardlink_err(xid, tcon->tid, ses->Suid, rc);
else
- trace_smb3_hardlink_done(xid, ses->Suid, tcon->tid);
+ trace_smb3_hardlink_done(xid, tcon->tid, ses->Suid);
SMB2_set_info_free(&rqst[num_rqst++]);
break;
case SMB2_OP_RENAME:
if (rc)
- trace_smb3_rename_err(xid, ses->Suid, tcon->tid, rc);
+ trace_smb3_rename_err(xid, tcon->tid, ses->Suid, rc);
else
- trace_smb3_rename_done(xid, ses->Suid, tcon->tid);
+ trace_smb3_rename_done(xid, tcon->tid, ses->Suid);
SMB2_set_info_free(&rqst[num_rqst++]);
break;
case SMB2_OP_RMDIR:
if (rc)
- trace_smb3_rmdir_err(xid, ses->Suid, tcon->tid, rc);
+ trace_smb3_rmdir_err(xid, tcon->tid, ses->Suid, rc);
else
- trace_smb3_rmdir_done(xid, ses->Suid, tcon->tid);
+ trace_smb3_rmdir_done(xid, tcon->tid, ses->Suid);
SMB2_set_info_free(&rqst[num_rqst++]);
break;
case SMB2_OP_SET_EOF:
if (rc)
- trace_smb3_set_eof_err(xid, ses->Suid, tcon->tid, rc);
+ trace_smb3_set_eof_err(xid, tcon->tid, ses->Suid, rc);
else
- trace_smb3_set_eof_done(xid, ses->Suid, tcon->tid);
+ trace_smb3_set_eof_done(xid, tcon->tid, ses->Suid);
SMB2_set_info_free(&rqst[num_rqst++]);
break;
case SMB2_OP_SET_INFO:
if (rc)
- trace_smb3_set_info_compound_err(xid, ses->Suid,
- tcon->tid, rc);
+ trace_smb3_set_info_compound_err(xid, tcon->tid,
+ ses->Suid, rc);
else
- trace_smb3_set_info_compound_done(xid, ses->Suid,
- tcon->tid);
+ trace_smb3_set_info_compound_done(xid, tcon->tid,
+ ses->Suid);
SMB2_set_info_free(&rqst[num_rqst++]);
break;
case SMB2_OP_SET_REPARSE:
if (rc) {
- trace_smb3_set_reparse_compound_err(xid, ses->Suid,
- tcon->tid, rc);
+ trace_smb3_set_reparse_compound_err(xid, tcon->tid,
+ ses->Suid, rc);
} else {
- trace_smb3_set_reparse_compound_done(xid, ses->Suid,
- tcon->tid);
+ trace_smb3_set_reparse_compound_done(xid, tcon->tid,
+ ses->Suid);
}
SMB2_ioctl_free(&rqst[num_rqst++]);
break;
@@ -771,18 +771,18 @@ finished:
rbuf = reparse_buf_ptr(iov);
if (IS_ERR(rbuf)) {
rc = PTR_ERR(rbuf);
- trace_smb3_set_reparse_compound_err(xid, ses->Suid,
- tcon->tid, rc);
+ trace_smb3_get_reparse_compound_err(xid, tcon->tid,
+ ses->Suid, rc);
} else {
idata->reparse.tag = le32_to_cpu(rbuf->ReparseTag);
- trace_smb3_set_reparse_compound_done(xid, ses->Suid,
- tcon->tid);
+ trace_smb3_get_reparse_compound_done(xid, tcon->tid,
+ ses->Suid);
}
memset(iov, 0, sizeof(*iov));
resp_buftype[i + 1] = CIFS_NO_BUFFER;
} else {
- trace_smb3_set_reparse_compound_err(xid, ses->Suid,
- tcon->tid, rc);
+ trace_smb3_get_reparse_compound_err(xid, tcon->tid,
+ ses->Suid, rc);
}
SMB2_ioctl_free(&rqst[num_rqst++]);
break;
@@ -799,11 +799,11 @@ finished:
}
}
if (!rc) {
- trace_smb3_query_wsl_ea_compound_done(xid, ses->Suid,
- tcon->tid);
+ trace_smb3_query_wsl_ea_compound_done(xid, tcon->tid,
+ ses->Suid);
} else {
- trace_smb3_query_wsl_ea_compound_err(xid, ses->Suid,
- tcon->tid, rc);
+ trace_smb3_query_wsl_ea_compound_err(xid, tcon->tid,
+ ses->Suid, rc);
}
SMB2_query_info_free(&rqst[num_rqst++]);
break;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 150/443] smb: client: change lease epoch type from unsigned int to __u16
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 149/443] smb: client: fix order of arguments of tracepoints Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 151/443] md: reintroduce md-linear Greg Kroah-Hartman
` (303 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Meetakshi Setiya, Shyam Prasad N,
Steve French
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meetakshi Setiya <msetiya@microsoft.com>
commit 57e4a9bd61c308f607bc3e55e8fa02257b06b552 upstream.
MS-SMB2 section 2.2.13.2.10 specifies that 'epoch' should be a 16-bit
unsigned integer used to track lease state changes. Change the data
type of all instances of 'epoch' from unsigned int to __u16. This
simplifies the epoch change comparisons and makes the code more
compliant with the protocol spec.
Cc: stable@vger.kernel.org
Signed-off-by: Meetakshi Setiya <msetiya@microsoft.com>
Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsglob.h | 14 +++++++-------
fs/smb/client/smb1ops.c | 2 +-
fs/smb/client/smb2ops.c | 18 +++++++++---------
fs/smb/client/smb2pdu.c | 2 +-
fs/smb/client/smb2proto.h | 2 +-
5 files changed, 19 insertions(+), 19 deletions(-)
--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
@@ -326,7 +326,7 @@ struct smb_version_operations {
int (*handle_cancelled_mid)(struct mid_q_entry *, struct TCP_Server_Info *);
void (*downgrade_oplock)(struct TCP_Server_Info *server,
struct cifsInodeInfo *cinode, __u32 oplock,
- unsigned int epoch, bool *purge_cache);
+ __u16 epoch, bool *purge_cache);
/* process transaction2 response */
bool (*check_trans2)(struct mid_q_entry *, struct TCP_Server_Info *,
char *, int);
@@ -521,12 +521,12 @@ struct smb_version_operations {
/* if we can do cache read operations */
bool (*is_read_op)(__u32);
/* set oplock level for the inode */
- void (*set_oplock_level)(struct cifsInodeInfo *, __u32, unsigned int,
- bool *);
+ void (*set_oplock_level)(struct cifsInodeInfo *cinode, __u32 oplock, __u16 epoch,
+ bool *purge_cache);
/* create lease context buffer for CREATE request */
char * (*create_lease_buf)(u8 *lease_key, u8 oplock);
/* parse lease context buffer and return oplock/epoch info */
- __u8 (*parse_lease_buf)(void *buf, unsigned int *epoch, char *lkey);
+ __u8 (*parse_lease_buf)(void *buf, __u16 *epoch, char *lkey);
ssize_t (*copychunk_range)(const unsigned int,
struct cifsFileInfo *src_file,
struct cifsFileInfo *target_file,
@@ -1422,7 +1422,7 @@ struct cifs_fid {
__u8 create_guid[16];
__u32 access;
struct cifs_pending_open *pending_open;
- unsigned int epoch;
+ __u16 epoch;
#ifdef CONFIG_CIFS_DEBUG2
__u64 mid;
#endif /* CIFS_DEBUG2 */
@@ -1455,7 +1455,7 @@ struct cifsFileInfo {
bool oplock_break_cancelled:1;
bool status_file_deleted:1; /* file has been deleted */
bool offload:1; /* offload final part of _put to a wq */
- unsigned int oplock_epoch; /* epoch from the lease break */
+ __u16 oplock_epoch; /* epoch from the lease break */
__u32 oplock_level; /* oplock/lease level from the lease break */
int count;
spinlock_t file_info_lock; /* protects four flag/count fields above */
@@ -1552,7 +1552,7 @@ struct cifsInodeInfo {
spinlock_t open_file_lock; /* protects openFileList */
__u32 cifsAttrs; /* e.g. DOS archive bit, sparse, compressed, system */
unsigned int oplock; /* oplock/lease level we have */
- unsigned int epoch; /* used to track lease state changes */
+ __u16 epoch; /* used to track lease state changes */
#define CIFS_INODE_PENDING_OPLOCK_BREAK (0) /* oplock break in progress */
#define CIFS_INODE_PENDING_WRITERS (1) /* Writes in progress */
#define CIFS_INODE_FLAG_UNUSED (2) /* Unused flag */
--- a/fs/smb/client/smb1ops.c
+++ b/fs/smb/client/smb1ops.c
@@ -377,7 +377,7 @@ coalesce_t2(char *second_buf, struct smb
static void
cifs_downgrade_oplock(struct TCP_Server_Info *server,
struct cifsInodeInfo *cinode, __u32 oplock,
- unsigned int epoch, bool *purge_cache)
+ __u16 epoch, bool *purge_cache)
{
cifs_set_oplock_level(cinode, oplock);
}
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -3904,22 +3904,22 @@ static long smb3_fallocate(struct file *
static void
smb2_downgrade_oplock(struct TCP_Server_Info *server,
struct cifsInodeInfo *cinode, __u32 oplock,
- unsigned int epoch, bool *purge_cache)
+ __u16 epoch, bool *purge_cache)
{
server->ops->set_oplock_level(cinode, oplock, 0, NULL);
}
static void
smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- unsigned int epoch, bool *purge_cache);
+ __u16 epoch, bool *purge_cache);
static void
smb3_downgrade_oplock(struct TCP_Server_Info *server,
struct cifsInodeInfo *cinode, __u32 oplock,
- unsigned int epoch, bool *purge_cache)
+ __u16 epoch, bool *purge_cache)
{
unsigned int old_state = cinode->oplock;
- unsigned int old_epoch = cinode->epoch;
+ __u16 old_epoch = cinode->epoch;
unsigned int new_state;
if (epoch > old_epoch) {
@@ -3939,7 +3939,7 @@ smb3_downgrade_oplock(struct TCP_Server_
static void
smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- unsigned int epoch, bool *purge_cache)
+ __u16 epoch, bool *purge_cache)
{
oplock &= 0xFF;
cinode->lease_granted = false;
@@ -3963,7 +3963,7 @@ smb2_set_oplock_level(struct cifsInodeIn
static void
smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- unsigned int epoch, bool *purge_cache)
+ __u16 epoch, bool *purge_cache)
{
char message[5] = {0};
unsigned int new_oplock = 0;
@@ -4000,7 +4000,7 @@ smb21_set_oplock_level(struct cifsInodeI
static void
smb3_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
- unsigned int epoch, bool *purge_cache)
+ __u16 epoch, bool *purge_cache)
{
unsigned int old_oplock = cinode->oplock;
@@ -4114,7 +4114,7 @@ smb3_create_lease_buf(u8 *lease_key, u8
}
static __u8
-smb2_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key)
+smb2_parse_lease_buf(void *buf, __u16 *epoch, char *lease_key)
{
struct create_lease *lc = (struct create_lease *)buf;
@@ -4125,7 +4125,7 @@ smb2_parse_lease_buf(void *buf, unsigned
}
static __u8
-smb3_parse_lease_buf(void *buf, unsigned int *epoch, char *lease_key)
+smb3_parse_lease_buf(void *buf, __u16 *epoch, char *lease_key)
{
struct create_lease_v2 *lc = (struct create_lease_v2 *)buf;
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -2329,7 +2329,7 @@ parse_posix_ctxt(struct create_context *
int smb2_parse_contexts(struct TCP_Server_Info *server,
struct kvec *rsp_iov,
- unsigned int *epoch,
+ __u16 *epoch,
char *lease_key, __u8 *oplock,
struct smb2_file_all_info *buf,
struct create_posix_rsp *posix)
--- a/fs/smb/client/smb2proto.h
+++ b/fs/smb/client/smb2proto.h
@@ -282,7 +282,7 @@ extern enum securityEnum smb2_select_sec
enum securityEnum);
int smb2_parse_contexts(struct TCP_Server_Info *server,
struct kvec *rsp_iov,
- unsigned int *epoch,
+ __u16 *epoch,
char *lease_key, __u8 *oplock,
struct smb2_file_all_info *buf,
struct create_posix_rsp *posix);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 151/443] md: reintroduce md-linear
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 150/443] smb: client: change lease epoch type from unsigned int to __u16 Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 152/443] s390/futex: Fix FUTEX_OP_ANDN implementation Greg Kroah-Hartman
` (302 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Coly Li, Mike Snitzer,
Song Liu
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
commit 127186cfb184eaccdfe948e6da66940cfa03efc5 upstream.
THe md-linear is removed by commit 849d18e27be9 ("md: Remove deprecated
CONFIG_MD_LINEAR") because it has been marked as deprecated for a long
time.
However, md-linear is used widely for underlying disks with different size,
sadly we didn't know this until now, and it's true useful to create
partitions and assemble multiple raid and then append one to the other.
People have to use dm-linear in this case now, however, they will prefer
to minimize the number of involved modules.
Fixes: 849d18e27be9 ("md: Remove deprecated CONFIG_MD_LINEAR")
Cc: stable@vger.kernel.org
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Acked-by: Coly Li <colyli@kernel.org>
Acked-by: Mike Snitzer <snitzer@kernel.org>
Link: https://lore.kernel.org/r/20250102112841.1227111-1-yukuai1@huaweicloud.com
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/Kconfig | 13 +
drivers/md/Makefile | 2
drivers/md/md-autodetect.c | 8
drivers/md/md-linear.c | 354 +++++++++++++++++++++++++++++++++++++++++
drivers/md/md.c | 2
include/uapi/linux/raid/md_p.h | 2
include/uapi/linux/raid/md_u.h | 2
7 files changed, 379 insertions(+), 4 deletions(-)
create mode 100644 drivers/md/md-linear.c
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -61,6 +61,19 @@ config MD_BITMAP_FILE
various kernel APIs and can only work with files on a file system not
actually sitting on the MD device.
+config MD_LINEAR
+ tristate "Linear (append) mode"
+ depends on BLK_DEV_MD
+ help
+ If you say Y here, then your multiple devices driver will be able to
+ use the so-called linear mode, i.e. it will combine the hard disk
+ partitions by simply appending one to the other.
+
+ To compile this as a module, choose M here: the module
+ will be called linear.
+
+ If unsure, say Y.
+
config MD_RAID0
tristate "RAID-0 (striping) mode"
depends on BLK_DEV_MD
--- a/drivers/md/Makefile
+++ b/drivers/md/Makefile
@@ -29,12 +29,14 @@ dm-zoned-y += dm-zoned-target.o dm-zoned
md-mod-y += md.o md-bitmap.o
raid456-y += raid5.o raid5-cache.o raid5-ppl.o
+linear-y += md-linear.o
# Note: link order is important. All raid personalities
# and must come before md.o, as they each initialise
# themselves, and md.o may use the personalities when it
# auto-initialised.
+obj-$(CONFIG_MD_LINEAR) += linear.o
obj-$(CONFIG_MD_RAID0) += raid0.o
obj-$(CONFIG_MD_RAID1) += raid1.o
obj-$(CONFIG_MD_RAID10) += raid10.o
--- a/drivers/md/md-autodetect.c
+++ b/drivers/md/md-autodetect.c
@@ -49,6 +49,7 @@ static int md_setup_ents __initdata;
* instead of just one. -- KTK
* 18May2000: Added support for persistent-superblock arrays:
* md=n,0,factor,fault,device-list uses RAID0 for device n
+ * md=n,-1,factor,fault,device-list uses LINEAR for device n
* md=n,device-list reads a RAID superblock from the devices
* elements in device-list are read by name_to_kdev_t so can be
* a hex number or something like /dev/hda1 /dev/sdb
@@ -87,7 +88,7 @@ static int __init md_setup(char *str)
md_setup_ents++;
switch (get_option(&str, &level)) { /* RAID level */
case 2: /* could be 0 or -1.. */
- if (level == 0) {
+ if (level == 0 || level == LEVEL_LINEAR) {
if (get_option(&str, &factor) != 2 || /* Chunk Size */
get_option(&str, &fault) != 2) {
printk(KERN_WARNING "md: Too few arguments supplied to md=.\n");
@@ -95,7 +96,10 @@ static int __init md_setup(char *str)
}
md_setup_args[ent].level = level;
md_setup_args[ent].chunk = 1 << (factor+12);
- pername = "raid0";
+ if (level == LEVEL_LINEAR)
+ pername = "linear";
+ else
+ pername = "raid0";
break;
}
fallthrough;
--- /dev/null
+++ b/drivers/md/md-linear.c
@@ -0,0 +1,354 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * linear.c : Multiple Devices driver for Linux Copyright (C) 1994-96 Marc
+ * ZYNGIER <zyngier@ufr-info-p7.ibp.fr> or <maz@gloups.fdn.fr>
+ */
+
+#include <linux/blkdev.h>
+#include <linux/raid/md_u.h>
+#include <linux/seq_file.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <trace/events/block.h>
+#include "md.h"
+
+struct dev_info {
+ struct md_rdev *rdev;
+ sector_t end_sector;
+};
+
+struct linear_conf {
+ struct rcu_head rcu;
+ sector_t array_sectors;
+ /* a copy of mddev->raid_disks */
+ int raid_disks;
+ struct dev_info disks[] __counted_by(raid_disks);
+};
+
+/*
+ * find which device holds a particular offset
+ */
+static inline struct dev_info *which_dev(struct mddev *mddev, sector_t sector)
+{
+ int lo, mid, hi;
+ struct linear_conf *conf;
+
+ lo = 0;
+ hi = mddev->raid_disks - 1;
+ conf = mddev->private;
+
+ /*
+ * Binary Search
+ */
+
+ while (hi > lo) {
+
+ mid = (hi + lo) / 2;
+ if (sector < conf->disks[mid].end_sector)
+ hi = mid;
+ else
+ lo = mid + 1;
+ }
+
+ return conf->disks + lo;
+}
+
+static sector_t linear_size(struct mddev *mddev, sector_t sectors, int raid_disks)
+{
+ struct linear_conf *conf;
+ sector_t array_sectors;
+
+ conf = mddev->private;
+ WARN_ONCE(sectors || raid_disks,
+ "%s does not support generic reshape\n", __func__);
+ array_sectors = conf->array_sectors;
+
+ return array_sectors;
+}
+
+static int linear_set_limits(struct mddev *mddev)
+{
+ struct queue_limits lim;
+ int err;
+
+ md_init_stacking_limits(&lim);
+ lim.max_hw_sectors = mddev->chunk_sectors;
+ lim.max_write_zeroes_sectors = mddev->chunk_sectors;
+ lim.io_min = mddev->chunk_sectors << 9;
+ err = mddev_stack_rdev_limits(mddev, &lim, MDDEV_STACK_INTEGRITY);
+ if (err) {
+ queue_limits_cancel_update(mddev->gendisk->queue);
+ return err;
+ }
+
+ return queue_limits_set(mddev->gendisk->queue, &lim);
+}
+
+static struct linear_conf *linear_conf(struct mddev *mddev, int raid_disks)
+{
+ struct linear_conf *conf;
+ struct md_rdev *rdev;
+ int ret = -EINVAL;
+ int cnt;
+ int i;
+
+ conf = kzalloc(struct_size(conf, disks, raid_disks), GFP_KERNEL);
+ if (!conf)
+ return ERR_PTR(-ENOMEM);
+
+ /*
+ * conf->raid_disks is copy of mddev->raid_disks. The reason to
+ * keep a copy of mddev->raid_disks in struct linear_conf is,
+ * mddev->raid_disks may not be consistent with pointers number of
+ * conf->disks[] when it is updated in linear_add() and used to
+ * iterate old conf->disks[] earray in linear_congested().
+ * Here conf->raid_disks is always consitent with number of
+ * pointers in conf->disks[] array, and mddev->private is updated
+ * with rcu_assign_pointer() in linear_addr(), such race can be
+ * avoided.
+ */
+ conf->raid_disks = raid_disks;
+
+ cnt = 0;
+ conf->array_sectors = 0;
+
+ rdev_for_each(rdev, mddev) {
+ int j = rdev->raid_disk;
+ struct dev_info *disk = conf->disks + j;
+ sector_t sectors;
+
+ if (j < 0 || j >= raid_disks || disk->rdev) {
+ pr_warn("md/linear:%s: disk numbering problem. Aborting!\n",
+ mdname(mddev));
+ goto out;
+ }
+
+ disk->rdev = rdev;
+ if (mddev->chunk_sectors) {
+ sectors = rdev->sectors;
+ sector_div(sectors, mddev->chunk_sectors);
+ rdev->sectors = sectors * mddev->chunk_sectors;
+ }
+
+ conf->array_sectors += rdev->sectors;
+ cnt++;
+ }
+ if (cnt != raid_disks) {
+ pr_warn("md/linear:%s: not enough drives present. Aborting!\n",
+ mdname(mddev));
+ goto out;
+ }
+
+ /*
+ * Here we calculate the device offsets.
+ */
+ conf->disks[0].end_sector = conf->disks[0].rdev->sectors;
+
+ for (i = 1; i < raid_disks; i++)
+ conf->disks[i].end_sector =
+ conf->disks[i-1].end_sector +
+ conf->disks[i].rdev->sectors;
+
+ if (!mddev_is_dm(mddev)) {
+ ret = linear_set_limits(mddev);
+ if (ret)
+ goto out;
+ }
+
+ return conf;
+
+out:
+ kfree(conf);
+ return ERR_PTR(ret);
+}
+
+static int linear_run(struct mddev *mddev)
+{
+ struct linear_conf *conf;
+ int ret;
+
+ if (md_check_no_bitmap(mddev))
+ return -EINVAL;
+
+ conf = linear_conf(mddev, mddev->raid_disks);
+ if (IS_ERR(conf))
+ return PTR_ERR(conf);
+
+ mddev->private = conf;
+ md_set_array_sectors(mddev, linear_size(mddev, 0, 0));
+
+ ret = md_integrity_register(mddev);
+ if (ret) {
+ kfree(conf);
+ mddev->private = NULL;
+ }
+ return ret;
+}
+
+static int linear_add(struct mddev *mddev, struct md_rdev *rdev)
+{
+ /* Adding a drive to a linear array allows the array to grow.
+ * It is permitted if the new drive has a matching superblock
+ * already on it, with raid_disk equal to raid_disks.
+ * It is achieved by creating a new linear_private_data structure
+ * and swapping it in in-place of the current one.
+ * The current one is never freed until the array is stopped.
+ * This avoids races.
+ */
+ struct linear_conf *newconf, *oldconf;
+
+ if (rdev->saved_raid_disk != mddev->raid_disks)
+ return -EINVAL;
+
+ rdev->raid_disk = rdev->saved_raid_disk;
+ rdev->saved_raid_disk = -1;
+
+ newconf = linear_conf(mddev, mddev->raid_disks + 1);
+ if (!newconf)
+ return -ENOMEM;
+
+ /* newconf->raid_disks already keeps a copy of * the increased
+ * value of mddev->raid_disks, WARN_ONCE() is just used to make
+ * sure of this. It is possible that oldconf is still referenced
+ * in linear_congested(), therefore kfree_rcu() is used to free
+ * oldconf until no one uses it anymore.
+ */
+ oldconf = rcu_dereference_protected(mddev->private,
+ lockdep_is_held(&mddev->reconfig_mutex));
+ mddev->raid_disks++;
+ WARN_ONCE(mddev->raid_disks != newconf->raid_disks,
+ "copied raid_disks doesn't match mddev->raid_disks");
+ rcu_assign_pointer(mddev->private, newconf);
+ md_set_array_sectors(mddev, linear_size(mddev, 0, 0));
+ set_capacity_and_notify(mddev->gendisk, mddev->array_sectors);
+ kfree_rcu(oldconf, rcu);
+ return 0;
+}
+
+static void linear_free(struct mddev *mddev, void *priv)
+{
+ struct linear_conf *conf = priv;
+
+ kfree(conf);
+}
+
+static bool linear_make_request(struct mddev *mddev, struct bio *bio)
+{
+ struct dev_info *tmp_dev;
+ sector_t start_sector, end_sector, data_offset;
+ sector_t bio_sector = bio->bi_iter.bi_sector;
+
+ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
+ && md_flush_request(mddev, bio))
+ return true;
+
+ tmp_dev = which_dev(mddev, bio_sector);
+ start_sector = tmp_dev->end_sector - tmp_dev->rdev->sectors;
+ end_sector = tmp_dev->end_sector;
+ data_offset = tmp_dev->rdev->data_offset;
+
+ if (unlikely(bio_sector >= end_sector ||
+ bio_sector < start_sector))
+ goto out_of_bounds;
+
+ if (unlikely(is_rdev_broken(tmp_dev->rdev))) {
+ md_error(mddev, tmp_dev->rdev);
+ bio_io_error(bio);
+ return true;
+ }
+
+ if (unlikely(bio_end_sector(bio) > end_sector)) {
+ /* This bio crosses a device boundary, so we have to split it */
+ struct bio *split = bio_split(bio, end_sector - bio_sector,
+ GFP_NOIO, &mddev->bio_set);
+
+ if (IS_ERR(split)) {
+ bio->bi_status = errno_to_blk_status(PTR_ERR(split));
+ bio_endio(bio);
+ return true;
+ }
+
+ bio_chain(split, bio);
+ submit_bio_noacct(bio);
+ bio = split;
+ }
+
+ md_account_bio(mddev, &bio);
+ bio_set_dev(bio, tmp_dev->rdev->bdev);
+ bio->bi_iter.bi_sector = bio->bi_iter.bi_sector -
+ start_sector + data_offset;
+
+ if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
+ !bdev_max_discard_sectors(bio->bi_bdev))) {
+ /* Just ignore it */
+ bio_endio(bio);
+ } else {
+ if (mddev->gendisk)
+ trace_block_bio_remap(bio, disk_devt(mddev->gendisk),
+ bio_sector);
+ mddev_check_write_zeroes(mddev, bio);
+ submit_bio_noacct(bio);
+ }
+ return true;
+
+out_of_bounds:
+ pr_err("md/linear:%s: make_request: Sector %llu out of bounds on dev %pg: %llu sectors, offset %llu\n",
+ mdname(mddev),
+ (unsigned long long)bio->bi_iter.bi_sector,
+ tmp_dev->rdev->bdev,
+ (unsigned long long)tmp_dev->rdev->sectors,
+ (unsigned long long)start_sector);
+ bio_io_error(bio);
+ return true;
+}
+
+static void linear_status(struct seq_file *seq, struct mddev *mddev)
+{
+ seq_printf(seq, " %dk rounding", mddev->chunk_sectors / 2);
+}
+
+static void linear_error(struct mddev *mddev, struct md_rdev *rdev)
+{
+ if (!test_and_set_bit(MD_BROKEN, &mddev->flags)) {
+ char *md_name = mdname(mddev);
+
+ pr_crit("md/linear%s: Disk failure on %pg detected, failing array.\n",
+ md_name, rdev->bdev);
+ }
+}
+
+static void linear_quiesce(struct mddev *mddev, int state)
+{
+}
+
+static struct md_personality linear_personality = {
+ .name = "linear",
+ .level = LEVEL_LINEAR,
+ .owner = THIS_MODULE,
+ .make_request = linear_make_request,
+ .run = linear_run,
+ .free = linear_free,
+ .status = linear_status,
+ .hot_add_disk = linear_add,
+ .size = linear_size,
+ .quiesce = linear_quiesce,
+ .error_handler = linear_error,
+};
+
+static int __init linear_init(void)
+{
+ return register_md_personality(&linear_personality);
+}
+
+static void linear_exit(void)
+{
+ unregister_md_personality(&linear_personality);
+}
+
+module_init(linear_init);
+module_exit(linear_exit);
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Linear device concatenation personality for MD (deprecated)");
+MODULE_ALIAS("md-personality-1"); /* LINEAR - deprecated*/
+MODULE_ALIAS("md-linear");
+MODULE_ALIAS("md-level--1");
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8124,7 +8124,7 @@ void md_error(struct mddev *mddev, struc
return;
mddev->pers->error_handler(mddev, rdev);
- if (mddev->pers->level == 0)
+ if (mddev->pers->level == 0 || mddev->pers->level == LEVEL_LINEAR)
return;
if (mddev->degraded && !test_bit(MD_BROKEN, &mddev->flags))
--- a/include/uapi/linux/raid/md_p.h
+++ b/include/uapi/linux/raid/md_p.h
@@ -233,7 +233,7 @@ struct mdp_superblock_1 {
char set_name[32]; /* set and interpreted by user-space */
__le64 ctime; /* lo 40 bits are seconds, top 24 are microseconds or 0*/
- __le32 level; /* 0,1,4,5 */
+ __le32 level; /* 0,1,4,5, -1 (linear) */
__le32 layout; /* only for raid5 and raid10 currently */
__le64 size; /* used size of component devices, in 512byte sectors */
--- a/include/uapi/linux/raid/md_u.h
+++ b/include/uapi/linux/raid/md_u.h
@@ -103,6 +103,8 @@ typedef struct mdu_array_info_s {
} mdu_array_info_t;
+#define LEVEL_LINEAR (-1)
+
/* we need a value for 'no level specified' and 0
* means 'raid0', so we need something else. This is
* for internal use only
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 152/443] s390/futex: Fix FUTEX_OP_ANDN implementation
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 151/443] md: reintroduce md-linear Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 153/443] arm64: Filter out SVE hwcaps when FEAT_SVE isnt implemented Greg Kroah-Hartman
` (301 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Alexander Gordeev
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit 26701574cee6777f867f89b4a5c667817e1ee0dd upstream.
The futex operation FUTEX_OP_ANDN is supposed to implement
*(int *)UADDR2 &= ~OPARG;
The s390 implementation just implements an AND instead of ANDN.
Add the missing bitwise not operation to oparg to fix this.
This is broken since nearly 19 years, so it looks like user space is
not making use of this operation.
Fixes: 3363fbdd6fb4 ("[PATCH] s390: futex atomic operations")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/futex.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/s390/include/asm/futex.h
+++ b/arch/s390/include/asm/futex.h
@@ -44,7 +44,7 @@ static inline int arch_futex_atomic_op_i
break;
case FUTEX_OP_ANDN:
__futex_atomic_op("lr %2,%1\nnr %2,%5\n",
- ret, oldval, newval, uaddr, oparg);
+ ret, oldval, newval, uaddr, ~oparg);
break;
case FUTEX_OP_XOR:
__futex_atomic_op("lr %2,%1\nxr %2,%5\n",
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 153/443] arm64: Filter out SVE hwcaps when FEAT_SVE isnt implemented
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 152/443] s390/futex: Fix FUTEX_OP_ANDN implementation Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 154/443] m68k: vga: Fix I/O defines Greg Kroah-Hartman
` (300 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Catalin Marinas, Marc Zyngier,
Mark Brown, Will Deacon, Mark Rutland
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit 064737920bdbca86df91b96aed256e88018fef3a upstream.
The hwcaps code that exposes SVE features to userspace only
considers ID_AA64ZFR0_EL1, while this is only valid when
ID_AA64PFR0_EL1.SVE advertises that SVE is actually supported.
The expectations are that when ID_AA64PFR0_EL1.SVE is 0, the
ID_AA64ZFR0_EL1 register is also 0. So far, so good.
Things become a bit more interesting if the HW implements SME.
In this case, a few ID_AA64ZFR0_EL1 fields indicate *SME*
features. And these fields overlap with their SVE interpretations.
But the architecture says that the SME and SVE feature sets must
match, so we're still hunky-dory.
This goes wrong if the HW implements SME, but not SVE. In this
case, we end-up advertising some SVE features to userspace, even
if the HW has none. That's because we never consider whether SVE
is actually implemented. Oh well.
Fix it by restricting all SVE capabilities to ID_AA64PFR0_EL1.SVE
being non-zero. The HWCAPS documentation is amended to reflect the
actually checks performed by the kernel.
Fixes: 06a916feca2b ("arm64: Expose SVE2 features for userspace")
Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: stable@vger.kernel.org
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20250107-arm64-2024-dpisa-v5-1-7578da51fc3d@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/arch/arm64/elf_hwcaps.rst | 39 ++++++++++++++++++++-----------
arch/arm64/kernel/cpufeature.c | 40 +++++++++++++++++++++-----------
2 files changed, 53 insertions(+), 26 deletions(-)
--- a/Documentation/arch/arm64/elf_hwcaps.rst
+++ b/Documentation/arch/arm64/elf_hwcaps.rst
@@ -178,22 +178,28 @@ HWCAP2_DCPODP
Functionality implied by ID_AA64ISAR1_EL1.DPB == 0b0010.
HWCAP2_SVE2
- Functionality implied by ID_AA64ZFR0_EL1.SVEver == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.SVEver == 0b0001.
HWCAP2_SVEAES
- Functionality implied by ID_AA64ZFR0_EL1.AES == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.AES == 0b0001.
HWCAP2_SVEPMULL
- Functionality implied by ID_AA64ZFR0_EL1.AES == 0b0010.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.AES == 0b0010.
HWCAP2_SVEBITPERM
- Functionality implied by ID_AA64ZFR0_EL1.BitPerm == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.BitPerm == 0b0001.
HWCAP2_SVESHA3
- Functionality implied by ID_AA64ZFR0_EL1.SHA3 == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.SHA3 == 0b0001.
HWCAP2_SVESM4
- Functionality implied by ID_AA64ZFR0_EL1.SM4 == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.SM4 == 0b0001.
HWCAP2_FLAGM2
Functionality implied by ID_AA64ISAR0_EL1.TS == 0b0010.
@@ -202,16 +208,20 @@ HWCAP2_FRINT
Functionality implied by ID_AA64ISAR1_EL1.FRINTTS == 0b0001.
HWCAP2_SVEI8MM
- Functionality implied by ID_AA64ZFR0_EL1.I8MM == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.I8MM == 0b0001.
HWCAP2_SVEF32MM
- Functionality implied by ID_AA64ZFR0_EL1.F32MM == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.F32MM == 0b0001.
HWCAP2_SVEF64MM
- Functionality implied by ID_AA64ZFR0_EL1.F64MM == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.F64MM == 0b0001.
HWCAP2_SVEBF16
- Functionality implied by ID_AA64ZFR0_EL1.BF16 == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.BF16 == 0b0001.
HWCAP2_I8MM
Functionality implied by ID_AA64ISAR1_EL1.I8MM == 0b0001.
@@ -277,7 +287,8 @@ HWCAP2_EBF16
Functionality implied by ID_AA64ISAR1_EL1.BF16 == 0b0010.
HWCAP2_SVE_EBF16
- Functionality implied by ID_AA64ZFR0_EL1.BF16 == 0b0010.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.BF16 == 0b0010.
HWCAP2_CSSC
Functionality implied by ID_AA64ISAR2_EL1.CSSC == 0b0001.
@@ -286,7 +297,8 @@ HWCAP2_RPRFM
Functionality implied by ID_AA64ISAR2_EL1.RPRFM == 0b0001.
HWCAP2_SVE2P1
- Functionality implied by ID_AA64ZFR0_EL1.SVEver == 0b0010.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.SVEver == 0b0010.
HWCAP2_SME2
Functionality implied by ID_AA64SMFR0_EL1.SMEver == 0b0001.
@@ -313,7 +325,8 @@ HWCAP2_HBC
Functionality implied by ID_AA64ISAR2_EL1.BC == 0b0001.
HWCAP2_SVE_B16B16
- Functionality implied by ID_AA64ZFR0_EL1.B16B16 == 0b0001.
+ Functionality implied by ID_AA64PFR0_EL1.SVE == 0b0001 and
+ ID_AA64ZFR0_EL1.B16B16 == 0b0001.
HWCAP2_LRCPC3
Functionality implied by ID_AA64ISAR1_EL1.LRCPC == 0b0011.
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -3022,6 +3022,13 @@ static const struct arm64_cpu_capabiliti
.matches = match, \
}
+#define HWCAP_CAP_MATCH_ID(match, reg, field, min_value, cap_type, cap) \
+ { \
+ __HWCAP_CAP(#cap, cap_type, cap) \
+ HWCAP_CPUID_MATCH(reg, field, min_value) \
+ .matches = match, \
+ }
+
#ifdef CONFIG_ARM64_PTR_AUTH
static const struct arm64_cpu_capabilities ptr_auth_hwcap_addr_matches[] = {
{
@@ -3050,6 +3057,13 @@ static const struct arm64_cpu_capabiliti
};
#endif
+#ifdef CONFIG_ARM64_SVE
+static bool has_sve_feature(const struct arm64_cpu_capabilities *cap, int scope)
+{
+ return system_supports_sve() && has_user_cpuid_feature(cap, scope);
+}
+#endif
+
static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
HWCAP_CAP(ID_AA64ISAR0_EL1, AES, PMULL, CAP_HWCAP, KERNEL_HWCAP_PMULL),
HWCAP_CAP(ID_AA64ISAR0_EL1, AES, AES, CAP_HWCAP, KERNEL_HWCAP_AES),
@@ -3092,19 +3106,19 @@ static const struct arm64_cpu_capabiliti
HWCAP_CAP(ID_AA64MMFR2_EL1, AT, IMP, CAP_HWCAP, KERNEL_HWCAP_USCAT),
#ifdef CONFIG_ARM64_SVE
HWCAP_CAP(ID_AA64PFR0_EL1, SVE, IMP, CAP_HWCAP, KERNEL_HWCAP_SVE),
- HWCAP_CAP(ID_AA64ZFR0_EL1, SVEver, SVE2p1, CAP_HWCAP, KERNEL_HWCAP_SVE2P1),
- HWCAP_CAP(ID_AA64ZFR0_EL1, SVEver, SVE2, CAP_HWCAP, KERNEL_HWCAP_SVE2),
- HWCAP_CAP(ID_AA64ZFR0_EL1, AES, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEAES),
- HWCAP_CAP(ID_AA64ZFR0_EL1, AES, PMULL128, CAP_HWCAP, KERNEL_HWCAP_SVEPMULL),
- HWCAP_CAP(ID_AA64ZFR0_EL1, BitPerm, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEBITPERM),
- HWCAP_CAP(ID_AA64ZFR0_EL1, B16B16, IMP, CAP_HWCAP, KERNEL_HWCAP_SVE_B16B16),
- HWCAP_CAP(ID_AA64ZFR0_EL1, BF16, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEBF16),
- HWCAP_CAP(ID_AA64ZFR0_EL1, BF16, EBF16, CAP_HWCAP, KERNEL_HWCAP_SVE_EBF16),
- HWCAP_CAP(ID_AA64ZFR0_EL1, SHA3, IMP, CAP_HWCAP, KERNEL_HWCAP_SVESHA3),
- HWCAP_CAP(ID_AA64ZFR0_EL1, SM4, IMP, CAP_HWCAP, KERNEL_HWCAP_SVESM4),
- HWCAP_CAP(ID_AA64ZFR0_EL1, I8MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEI8MM),
- HWCAP_CAP(ID_AA64ZFR0_EL1, F32MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEF32MM),
- HWCAP_CAP(ID_AA64ZFR0_EL1, F64MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEF64MM),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, SVEver, SVE2p1, CAP_HWCAP, KERNEL_HWCAP_SVE2P1),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, SVEver, SVE2, CAP_HWCAP, KERNEL_HWCAP_SVE2),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, AES, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEAES),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, AES, PMULL128, CAP_HWCAP, KERNEL_HWCAP_SVEPMULL),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, BitPerm, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEBITPERM),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, B16B16, IMP, CAP_HWCAP, KERNEL_HWCAP_SVE_B16B16),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, BF16, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEBF16),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, BF16, EBF16, CAP_HWCAP, KERNEL_HWCAP_SVE_EBF16),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, SHA3, IMP, CAP_HWCAP, KERNEL_HWCAP_SVESHA3),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, SM4, IMP, CAP_HWCAP, KERNEL_HWCAP_SVESM4),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, I8MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEI8MM),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, F32MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEF32MM),
+ HWCAP_CAP_MATCH_ID(has_sve_feature, ID_AA64ZFR0_EL1, F64MM, IMP, CAP_HWCAP, KERNEL_HWCAP_SVEF64MM),
#endif
#ifdef CONFIG_ARM64_GCS
HWCAP_CAP(ID_AA64PFR1_EL1, GCS, IMP, CAP_HWCAP, KERNEL_HWCAP_GCS),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 154/443] m68k: vga: Fix I/O defines
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 153/443] arm64: Filter out SVE hwcaps when FEAT_SVE isnt implemented Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 155/443] fs/proc: do_task_stat: Fix ESP not readable during coredump Greg Kroah-Hartman
` (299 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, kernel test robot,
Geert Uytterhoeven, linux-fbdev, dri-devel, Helge Deller
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 53036937a101b5faeaf98e7438555fa854a1a844 upstream.
Including m68k's <asm/raw_io.h> in vga.h on nommu platforms results
in conflicting defines with io_no.h for various I/O macros from the
__raw_read and __raw_write families. An example error is
In file included from arch/m68k/include/asm/vga.h:12,
from include/video/vga.h:22,
from include/linux/vgaarb.h:34,
from drivers/video/aperture.c:12:
>> arch/m68k/include/asm/raw_io.h:39: warning: "__raw_readb" redefined
39 | #define __raw_readb in_8
|
In file included from arch/m68k/include/asm/io.h:6,
from include/linux/io.h:13,
from include/linux/irq.h:20,
from include/asm-generic/hardirq.h:17,
from ./arch/m68k/include/generated/asm/hardirq.h:1,
from include/linux/hardirq.h:11,
from include/linux/interrupt.h:11,
from include/linux/trace_recursion.h:5,
from include/linux/ftrace.h:10,
from include/linux/kprobes.h:28,
from include/linux/kgdb.h:19,
from include/linux/fb.h:6,
from drivers/video/aperture.c:5:
arch/m68k/include/asm/io_no.h:16: note: this is the location of the previous definition
16 | #define __raw_readb(addr) \
|
Include <asm/io.h>, which avoids raw_io.h on nommu platforms.
Also change the defined values of some of the read/write symbols in
vga.h to __raw_read/__raw_write as the raw_in/raw_out symbols are not
generally available.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202501071629.DNEswlm8-lkp@intel.com/
Fixes: 5c3f968712ce ("m68k/video: Create <asm/vga.h>")
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-fbdev@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v3.5+
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/20250107095912.130530-1-tzimmermann@suse.de
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/m68k/include/asm/vga.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/m68k/include/asm/vga.h
+++ b/arch/m68k/include/asm/vga.h
@@ -9,7 +9,7 @@
*/
#ifndef CONFIG_PCI
-#include <asm/raw_io.h>
+#include <asm/io.h>
#include <asm/kmap.h>
/*
@@ -29,9 +29,9 @@
#define inw_p(port) 0
#define outb_p(port, val) do { } while (0)
#define outw(port, val) do { } while (0)
-#define readb raw_inb
-#define writeb raw_outb
-#define writew raw_outw
+#define readb __raw_readb
+#define writeb __raw_writeb
+#define writew __raw_writew
#endif /* CONFIG_PCI */
#endif /* _ASM_M68K_VGA_H */
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 155/443] fs/proc: do_task_stat: Fix ESP not readable during coredump
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 154/443] m68k: vga: Fix I/O defines Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 156/443] block: mark GFP_NOIO around sysfs ->store() Greg Kroah-Hartman
` (298 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric W. Biederman, Oleg Nesterov,
Kees Cook, Nam Cao, Christian Brauner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <namcao@linutronix.de>
commit ab251dacfbae28772c897f068a4184f478189ff2 upstream.
The field "eip" (instruction pointer) and "esp" (stack pointer) of a task
can be read from /proc/PID/stat. These fields can be interesting for
coredump.
However, these fields were disabled by commit 0a1eb2d474ed ("fs/proc: Stop
reporting eip and esp in /proc/PID/stat"), because it is generally unsafe
to do so. But it is safe for a coredumping process, and therefore
exceptions were made:
- for a coredumping thread by commit fd7d56270b52 ("fs/proc: Report
eip/esp in /prod/PID/stat for coredumping").
- for all other threads in a coredumping process by commit cb8f381f1613
("fs/proc/array.c: allow reporting eip/esp for all coredumping
threads").
The above two commits check the PF_DUMPCORE flag to determine a coredump thread
and the PF_EXITING flag for the other threads.
Unfortunately, commit 92307383082d ("coredump: Don't perform any cleanups
before dumping core") moved coredump to happen earlier and before PF_EXITING is
set. Thus, checking PF_EXITING is no longer the correct way to determine
threads in a coredumping process.
Instead of PF_EXITING, use PF_POSTCOREDUMP to determine the other threads.
Checking of PF_EXITING was added for coredumping, so it probably can now be
removed. But it doesn't hurt to keep.
Fixes: 92307383082d ("coredump: Don't perform any cleanups before dumping core")
Cc: stable@vger.kernel.org
Cc: Eric W. Biederman <ebiederm@xmission.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Kees Cook <kees@kernel.org>
Signed-off-by: Nam Cao <namcao@linutronix.de>
Link: https://lore.kernel.org/r/d89af63d478d6c64cc46a01420b46fd6eb147d6f.1735805772.git.namcao@linutronix.de
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/array.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -500,7 +500,7 @@ static int do_task_stat(struct seq_file
* a program is not able to use ptrace(2) in that case. It is
* safe because the task has stopped executing permanently.
*/
- if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE))) {
+ if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE|PF_POSTCOREDUMP))) {
if (try_get_task_stack(task)) {
eip = KSTK_EIP(task);
esp = KSTK_ESP(task);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 156/443] block: mark GFP_NOIO around sysfs ->store()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 155/443] fs/proc: do_task_stat: Fix ESP not readable during coredump Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 157/443] binfmt_flat: Fix integer overflow bug on 32 bit systems Greg Kroah-Hartman
` (297 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Hellström, Ming Lei,
Christoph Hellwig, John Garry, Jens Axboe
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <tom.leiming@gmail.com>
commit 7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c upstream.
sysfs ->store is called with queue freezed, meantime we have several
->store() callbacks(update_nr_requests, wbt, scheduler) to allocate
memory with GFP_KERNEL which may run into direct reclaim code path,
then potential deadlock can be caused.
Fix the issue by marking NOIO around sysfs ->store()
Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Link: https://lore.kernel.org/r/20250113015833.698458-1-ming.lei@redhat.com
Link: https://lore.kernel.org/linux-block/Z4RkemI9f6N5zoEF@fedora/T/#mc774c65eeca5c024d29695f9ac6152b87763f305
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-sysfs.c | 3 +++
1 file changed, 3 insertions(+)
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -681,6 +681,7 @@ queue_attr_store(struct kobject *kobj, s
struct queue_sysfs_entry *entry = to_queue(attr);
struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj);
struct request_queue *q = disk->queue;
+ unsigned int noio_flag;
ssize_t res;
if (!entry->store_limit && !entry->store)
@@ -711,7 +712,9 @@ queue_attr_store(struct kobject *kobj, s
mutex_lock(&q->sysfs_lock);
blk_mq_freeze_queue(q);
+ noio_flag = memalloc_noio_save();
res = entry->store(disk, page, length);
+ memalloc_noio_restore(noio_flag);
blk_mq_unfreeze_queue(q);
mutex_unlock(&q->sysfs_lock);
return res;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 157/443] binfmt_flat: Fix integer overflow bug on 32 bit systems
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 156/443] block: mark GFP_NOIO around sysfs ->store() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 158/443] perf: imx9_perf: Introduce AXI filter version to refactor the driver and better extension Greg Kroah-Hartman
` (296 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Nicolas Pitre,
Kees Cook
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit 55cf2f4b945f6a6416cc2524ba740b83cc9af25a upstream.
Most of these sizes and counts are capped at 256MB so the math doesn't
result in an integer overflow. The "relocs" count needs to be checked
as well. Otherwise on 32bit systems the calculation of "full_data"
could be wrong.
full_data = data_len + relocs * sizeof(unsigned long);
Fixes: c995ee28d29d ("binfmt_flat: prevent kernel dammage from corrupted executable headers")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Nicolas Pitre <npitre@baylibre.com>
Link: https://lore.kernel.org/r/5be17f6c-5338-43be-91ef-650153b975cb@stanley.mountain
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/binfmt_flat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -478,7 +478,7 @@ static int load_flat_file(struct linux_b
* 28 bits (256 MB) is way more than reasonable in this case.
* If some top bits are set we have probable binary corruption.
*/
- if ((text_len | data_len | bss_len | stack_len | full_data) >> 28) {
+ if ((text_len | data_len | bss_len | stack_len | relocs | full_data) >> 28) {
pr_err("bad header\n");
ret = -ENOEXEC;
goto err;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 158/443] perf: imx9_perf: Introduce AXI filter version to refactor the driver and better extension
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 157/443] binfmt_flat: Fix integer overflow bug on 32 bit systems Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 159/443] accel/ivpu: Fix Qemu crash when running in passthrough Greg Kroah-Hartman
` (295 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Xu Yang, Will Deacon
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit f3edf03a4c59e59e52c0c1fd958f64a76a038302 upstream.
The imx93 is the first supported DDR PMU that supports read transaction,
write transaction and read beats events which corresponding respecitively
to counter 2, 3 and 4.
However, transaction-based AXI match has low accuracy when get total bits
compared to beats-based. And imx93 doesn't assign AXI_ID to each master.
So axi filter is not used widely on imx93. This could be regards as AXI
filter version 1.
To improve the AXI filter capability, imx95 supports 1 read beats and 3
write beats event which corresponding respecitively to counter 2-5. imx95
also detailed AXI_ID allocation so that most of the master could be count
individually. This could be regards as AXI filter version 2.
This will introduce AXI filter version to refactor the driver and support
better extension, such as coming imx943. This is also a potential fix on
imx91 when configure axi filter.
Fixes: 44798fe136dc ("perf: imx_perf: add support for i.MX91 platform")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://lore.kernel.org/r/20241212065708.1353513-1-xu.yang_2@nxp.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/perf/fsl_imx9_ddr_perf.c | 33 +++++++++++++++++++++++++--------
1 file changed, 25 insertions(+), 8 deletions(-)
--- a/drivers/perf/fsl_imx9_ddr_perf.c
+++ b/drivers/perf/fsl_imx9_ddr_perf.c
@@ -63,8 +63,21 @@
static DEFINE_IDA(ddr_ida);
+/*
+ * V1 support 1 read transaction, 1 write transaction and 1 read beats
+ * event which corresponding respecitively to counter 2, 3 and 4.
+ */
+#define DDR_PERF_AXI_FILTER_V1 0x1
+
+/*
+ * V2 support 1 read beats and 3 write beats events which corresponding
+ * respecitively to counter 2-5.
+ */
+#define DDR_PERF_AXI_FILTER_V2 0x2
+
struct imx_ddr_devtype_data {
const char *identifier; /* system PMU identifier for userspace */
+ unsigned int filter_ver; /* AXI filter version */
};
struct ddr_pmu {
@@ -83,24 +96,27 @@ struct ddr_pmu {
static const struct imx_ddr_devtype_data imx91_devtype_data = {
.identifier = "imx91",
+ .filter_ver = DDR_PERF_AXI_FILTER_V1
};
static const struct imx_ddr_devtype_data imx93_devtype_data = {
.identifier = "imx93",
+ .filter_ver = DDR_PERF_AXI_FILTER_V1
};
static const struct imx_ddr_devtype_data imx95_devtype_data = {
.identifier = "imx95",
+ .filter_ver = DDR_PERF_AXI_FILTER_V2
};
-static inline bool is_imx93(struct ddr_pmu *pmu)
+static inline bool axi_filter_v1(struct ddr_pmu *pmu)
{
- return pmu->devtype_data == &imx93_devtype_data;
+ return pmu->devtype_data->filter_ver == DDR_PERF_AXI_FILTER_V1;
}
-static inline bool is_imx95(struct ddr_pmu *pmu)
+static inline bool axi_filter_v2(struct ddr_pmu *pmu)
{
- return pmu->devtype_data == &imx95_devtype_data;
+ return pmu->devtype_data->filter_ver == DDR_PERF_AXI_FILTER_V2;
}
static const struct of_device_id imx_ddr_pmu_dt_ids[] = {
@@ -155,7 +171,7 @@ static const struct attribute_group ddr_
struct imx9_pmu_events_attr {
struct device_attribute attr;
u64 id;
- const void *devtype_data;
+ const struct imx_ddr_devtype_data *devtype_data;
};
static ssize_t ddr_pmu_event_show(struct device *dev,
@@ -307,7 +323,8 @@ ddr_perf_events_attrs_is_visible(struct
if (!eattr->devtype_data)
return attr->mode;
- if (eattr->devtype_data != ddr_pmu->devtype_data)
+ if (eattr->devtype_data != ddr_pmu->devtype_data &&
+ eattr->devtype_data->filter_ver != ddr_pmu->devtype_data->filter_ver)
return 0;
return attr->mode;
@@ -624,11 +641,11 @@ static int ddr_perf_event_add(struct per
hwc->idx = counter;
hwc->state |= PERF_HES_STOPPED;
- if (is_imx93(pmu))
+ if (axi_filter_v1(pmu))
/* read trans, write trans, read beat */
imx93_ddr_perf_monitor_config(pmu, event_id, counter, cfg1, cfg2);
- if (is_imx95(pmu))
+ if (axi_filter_v2(pmu))
/* write beat, read beat2, read beat1, read beat */
imx95_ddr_perf_monitor_config(pmu, event_id, counter, cfg1, cfg2);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 159/443] accel/ivpu: Fix Qemu crash when running in passthrough
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 158/443] perf: imx9_perf: Introduce AXI filter version to refactor the driver and better extension Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 160/443] arm64/kvm: Configure HYP TCR.PS/DS based on host stage1 Greg Kroah-Hartman
` (294 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Karol Wachowski, Jacek Lawrynowicz
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
commit 901dd2617c9c3554b2449c8844b6338009112fcf upstream.
Restore PCI state after putting the NPU in D0.
Restoring state before powering up the device caused a Qemu crash
if NPU was running in passthrough mode and recovery was performed.
Fixes: 3534eacbf101 ("accel/ivpu: Fix PCI D0 state entry in resume")
Cc: stable@vger.kernel.org # v6.8+
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241106105549.2757115-1-jacek.lawrynowicz@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/ivpu/ivpu_pm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/accel/ivpu/ivpu_pm.c
+++ b/drivers/accel/ivpu/ivpu_pm.c
@@ -78,8 +78,8 @@ static int ivpu_resume(struct ivpu_devic
int ret;
retry:
- pci_restore_state(to_pci_dev(vdev->drm.dev));
pci_set_power_state(to_pci_dev(vdev->drm.dev), PCI_D0);
+ pci_restore_state(to_pci_dev(vdev->drm.dev));
ret = ivpu_hw_power_up(vdev);
if (ret) {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 160/443] arm64/kvm: Configure HYP TCR.PS/DS based on host stage1
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 159/443] accel/ivpu: Fix Qemu crash when running in passthrough Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 161/443] arm64/mm: Override PARange for !LPA2 and use it consistently Greg Kroah-Hartman
` (293 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Marc Zyngier,
Will Deacon
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
commit f0da16992aef7e246b2f3bba1492e3a52c38ca0e upstream.
When the host stage1 is configured for LPA2, the value currently being
programmed into TCR_EL2.T0SZ may be invalid unless LPA2 is configured
at HYP as well. This means kvm_lpa2_is_enabled() is not the right
condition to test when setting TCR_EL2.DS, as it will return false if
LPA2 is only available for stage 1 but not for stage 2.
Similary, programming TCR_EL2.PS based on a limited IPA range due to
lack of stage2 LPA2 support could potentially result in problems.
So use lpa2_is_enabled() instead, and set the PS field according to the
host's IPS, which is capped at 48 bits if LPA2 support is absent or
disabled. Whether or not we can make meaningful use of such a
configuration is a different question.
Cc: stable@vger.kernel.org
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20241212081841.2168124-11-ardb+git@google.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/arm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1990,8 +1990,7 @@ static int kvm_init_vector_slots(void)
static void __init cpu_prepare_hyp_mode(int cpu, u32 hyp_va_bits)
{
struct kvm_nvhe_init_params *params = per_cpu_ptr_nvhe_sym(kvm_init_params, cpu);
- u64 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);
- unsigned long tcr;
+ unsigned long tcr, ips;
/*
* Calculate the raw per-cpu offset without a translation from the
@@ -2005,6 +2004,7 @@ static void __init cpu_prepare_hyp_mode(
params->mair_el2 = read_sysreg(mair_el1);
tcr = read_sysreg(tcr_el1);
+ ips = FIELD_GET(TCR_IPS_MASK, tcr);
if (cpus_have_final_cap(ARM64_KVM_HVHE)) {
tcr |= TCR_EPD1_MASK;
} else {
@@ -2014,8 +2014,8 @@ static void __init cpu_prepare_hyp_mode(
tcr &= ~TCR_T0SZ_MASK;
tcr |= TCR_T0SZ(hyp_va_bits);
tcr &= ~TCR_EL2_PS_MASK;
- tcr |= FIELD_PREP(TCR_EL2_PS_MASK, kvm_get_parange(mmfr0));
- if (kvm_lpa2_is_enabled())
+ tcr |= FIELD_PREP(TCR_EL2_PS_MASK, ips);
+ if (lpa2_is_enabled())
tcr |= TCR_EL2_DS;
params->tcr_el2 = tcr;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 161/443] arm64/mm: Override PARange for !LPA2 and use it consistently
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 160/443] arm64/kvm: Configure HYP TCR.PS/DS based on host stage1 Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 162/443] arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu() Greg Kroah-Hartman
` (292 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Marc Zyngier,
Will Deacon
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
commit 62cffa496aac0c2c4eeca00d080058affd7a0172 upstream.
When FEAT_LPA{,2} are not implemented, the ID_AA64MMFR0_EL1.PARange and
TCR.IPS values corresponding with 52-bit physical addressing are
reserved.
Setting the TCR.IPS field to 0b110 (52-bit physical addressing) has side
effects, such as how the TTBRn_ELx.BADDR fields are interpreted, and so
it is important that disabling FEAT_LPA2 (by overriding the
ID_AA64MMFR0.TGran fields) also presents a PARange field consistent with
that.
So limit the field to 48 bits unless LPA2 is enabled, and update
existing references to use the override consistently.
Fixes: 352b0395b505 ("arm64: Enable 52-bit virtual addressing for 4k and 16k granule configs")
Cc: stable@vger.kernel.org
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20241212081841.2168124-10-ardb+git@google.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/assembler.h | 5 +++++
arch/arm64/kernel/cpufeature.c | 2 +-
arch/arm64/kernel/pi/idreg-override.c | 9 +++++++++
arch/arm64/kernel/pi/map_kernel.c | 6 ++++++
arch/arm64/mm/init.c | 7 ++++++-
5 files changed, 27 insertions(+), 2 deletions(-)
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -343,6 +343,11 @@ alternative_cb_end
// Narrow PARange to fit the PS field in TCR_ELx
ubfx \tmp0, \tmp0, #ID_AA64MMFR0_EL1_PARANGE_SHIFT, #3
mov \tmp1, #ID_AA64MMFR0_EL1_PARANGE_MAX
+#ifdef CONFIG_ARM64_LPA2
+alternative_if_not ARM64_HAS_VA52
+ mov \tmp1, #ID_AA64MMFR0_EL1_PARANGE_48
+alternative_else_nop_endif
+#endif
cmp \tmp0, \tmp1
csel \tmp0, \tmp1, \tmp0, hi
bfi \tcr, \tmp0, \pos, #3
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -3492,7 +3492,7 @@ static void verify_hyp_capabilities(void
return;
safe_mmfr1 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1);
- mmfr0 = read_cpuid(ID_AA64MMFR0_EL1);
+ mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);
mmfr1 = read_cpuid(ID_AA64MMFR1_EL1);
/* Verify VMID bits */
--- a/arch/arm64/kernel/pi/idreg-override.c
+++ b/arch/arm64/kernel/pi/idreg-override.c
@@ -83,6 +83,15 @@ static bool __init mmfr2_varange_filter(
id_aa64mmfr0_override.val |=
(ID_AA64MMFR0_EL1_TGRAN_LPA2 - 1) << ID_AA64MMFR0_EL1_TGRAN_SHIFT;
id_aa64mmfr0_override.mask |= 0xfU << ID_AA64MMFR0_EL1_TGRAN_SHIFT;
+
+ /*
+ * Override PARange to 48 bits - the override will just be
+ * ignored if the actual PARange is smaller, but this is
+ * unlikely to be the case for LPA2 capable silicon.
+ */
+ id_aa64mmfr0_override.val |=
+ ID_AA64MMFR0_EL1_PARANGE_48 << ID_AA64MMFR0_EL1_PARANGE_SHIFT;
+ id_aa64mmfr0_override.mask |= 0xfU << ID_AA64MMFR0_EL1_PARANGE_SHIFT;
}
#endif
return true;
--- a/arch/arm64/kernel/pi/map_kernel.c
+++ b/arch/arm64/kernel/pi/map_kernel.c
@@ -136,6 +136,12 @@ static void noinline __section(".idmap.t
{
u64 sctlr = read_sysreg(sctlr_el1);
u64 tcr = read_sysreg(tcr_el1) | TCR_DS;
+ u64 mmfr0 = read_sysreg(id_aa64mmfr0_el1);
+ u64 parange = cpuid_feature_extract_unsigned_field(mmfr0,
+ ID_AA64MMFR0_EL1_PARANGE_SHIFT);
+
+ tcr &= ~TCR_IPS_MASK;
+ tcr |= parange << TCR_IPS_SHIFT;
asm(" msr sctlr_el1, %0 ;"
" isb ;"
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -279,7 +279,12 @@ void __init arm64_memblock_init(void)
if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) {
extern u16 memstart_offset_seed;
- u64 mmfr0 = read_cpuid(ID_AA64MMFR0_EL1);
+
+ /*
+ * Use the sanitised version of id_aa64mmfr0_el1 so that linear
+ * map randomization can be enabled by shrinking the IPA space.
+ */
+ u64 mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);
int parange = cpuid_feature_extract_unsigned_field(
mmfr0, ID_AA64MMFR0_EL1_PARANGE_SHIFT);
s64 range = linear_region_size -
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 162/443] arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 161/443] arm64/mm: Override PARange for !LPA2 and use it consistently Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 163/443] arm64/mm: Reduce PA space to 48 bits when LPA2 is not enabled Greg Kroah-Hartman
` (291 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Brown, Will Deacon
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@kernel.org>
commit d3c7c48d004f6c8d892f39b5d69884fd0fe98c81 upstream.
In commit 892f7237b3ff ("arm64: Delay initialisation of
cpuinfo_arm64::reg_{zcr,smcr}") we moved access to ZCR, SMCR and SMIDR
later in the boot process in order to ensure that we don't attempt to
interact with them if SVE or SME is disabled on the command line.
Unfortunately when initialising the boot CPU in init_cpu_features() we work
on a copy of the struct cpuinfo_arm64 for the boot CPU used only during
boot, not the percpu copy used by the sysfs code. The expectation of the
feature identification code was that the ID registers would be read in
__cpuinfo_store_cpu() and the values not modified by init_cpu_features().
The main reason for the original change was to avoid early accesses to
ZCR on practical systems that were seen shipping with SVE reported in ID
registers but traps enabled at EL3 and handled as fatal errors, SME was
rolled in due to the similarity with SVE. Since then we have removed the
early accesses to ZCR and SMCR in commits:
abef0695f9665c3d ("arm64/sve: Remove ZCR pseudo register from cpufeature code")
391208485c3ad50f ("arm64/sve: Remove SMCR pseudo register from cpufeature code")
so only the SMIDR_EL1 part of the change remains. Since SMIDR_EL1 is
only trapped via FEAT_IDST and not the SME trap it is less likely to be
affected by similar issues, and the factors that lead to issues with SVE
are less likely to apply to SME.
Since we have not yet seen practical SME systems that need to use a
command line override (and are only just beginning to see SME systems at
all) and the ID register read is much more likely to be safe let's just
store SMIDR_EL1 along with all the other ID register reads in
__cpuinfo_store_cpu().
This issue wasn't apparent when testing on emulated platforms that do not
report values in SMIDR_EL1.
Fixes: 892f7237b3ff ("arm64: Delay initialisation of cpuinfo_arm64::reg_{zcr,smcr}")
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20241217-arm64-fix-boot-cpu-smidr-v3-1-7be278a85623@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/cpufeature.c | 13 -------------
arch/arm64/kernel/cpuinfo.c | 10 ++++++++++
2 files changed, 10 insertions(+), 13 deletions(-)
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1167,12 +1167,6 @@ void __init init_cpu_features(struct cpu
id_aa64pfr1_sme(read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1))) {
unsigned long cpacr = cpacr_save_enable_kernel_sme();
- /*
- * We mask out SMPS since even if the hardware
- * supports priorities the kernel does not at present
- * and we block access to them.
- */
- info->reg_smidr = read_cpuid(SMIDR_EL1) & ~SMIDR_EL1_SMPS;
vec_init_vq_map(ARM64_VEC_SME);
cpacr_restore(cpacr);
@@ -1423,13 +1417,6 @@ void update_cpu_features(int cpu,
id_aa64pfr1_sme(read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1))) {
unsigned long cpacr = cpacr_save_enable_kernel_sme();
- /*
- * We mask out SMPS since even if the hardware
- * supports priorities the kernel does not at present
- * and we block access to them.
- */
- info->reg_smidr = read_cpuid(SMIDR_EL1) & ~SMIDR_EL1_SMPS;
-
/* Probe vector lengths */
if (!system_capabilities_finalized())
vec_update_vq_map(ARM64_VEC_SME);
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -482,6 +482,16 @@ static void __cpuinfo_store_cpu(struct c
if (id_aa64pfr0_mpam(info->reg_id_aa64pfr0))
info->reg_mpamidr = read_cpuid(MPAMIDR_EL1);
+ if (IS_ENABLED(CONFIG_ARM64_SME) &&
+ id_aa64pfr1_sme(info->reg_id_aa64pfr1)) {
+ /*
+ * We mask out SMPS since even if the hardware
+ * supports priorities the kernel does not at present
+ * and we block access to them.
+ */
+ info->reg_smidr = read_cpuid(SMIDR_EL1) & ~SMIDR_EL1_SMPS;
+ }
+
cpuinfo_detect_icache_policy(info);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 163/443] arm64/mm: Reduce PA space to 48 bits when LPA2 is not enabled
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 162/443] arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 164/443] KVM: arm64: timer: Always evaluate the need for a soft timer Greg Kroah-Hartman
` (290 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anshuman Khandual, Ard Biesheuvel,
Marc Zyngier, Will Deacon
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
commit bf74bb73cd87c64bd5afc1fd4b749029997b6170 upstream.
Currently, LPA2 kernel support implies support for up to 52 bits of
physical addressing, and this is reflected in global definitions such as
PHYS_MASK_SHIFT and MAX_PHYSMEM_BITS.
This is potentially problematic, given that LPA2 hardware support is
modeled as a CPU feature which can be overridden, and with LPA2 hardware
support turned off, attempting to map physical regions with address bits
[51:48] set (which may exist on LPA2 capable systems booting with
arm64.nolva) will result in corrupted mappings with a truncated output
address and bogus shareability attributes.
This means that the accepted physical address range in the mapping
routines should be at most 48 bits wide when LPA2 support is configured
but not enabled at runtime.
Fixes: 352b0395b505 ("arm64: Enable 52-bit virtual addressing for 4k and 16k granule configs")
Cc: stable@vger.kernel.org
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20241212081841.2168124-9-ardb+git@google.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/pgtable-hwdef.h | 6 ------
arch/arm64/include/asm/pgtable-prot.h | 7 +++++++
arch/arm64/include/asm/sparsemem.h | 5 ++++-
3 files changed, 11 insertions(+), 7 deletions(-)
--- a/arch/arm64/include/asm/pgtable-hwdef.h
+++ b/arch/arm64/include/asm/pgtable-hwdef.h
@@ -222,12 +222,6 @@
*/
#define S1_TABLE_AP (_AT(pmdval_t, 3) << 61)
-/*
- * Highest possible physical address supported.
- */
-#define PHYS_MASK_SHIFT (CONFIG_ARM64_PA_BITS)
-#define PHYS_MASK ((UL(1) << PHYS_MASK_SHIFT) - 1)
-
#define TTBR_CNP_BIT (UL(1) << 0)
/*
--- a/arch/arm64/include/asm/pgtable-prot.h
+++ b/arch/arm64/include/asm/pgtable-prot.h
@@ -81,6 +81,7 @@ extern unsigned long prot_ns_shared;
#define lpa2_is_enabled() false
#define PTE_MAYBE_SHARED PTE_SHARED
#define PMD_MAYBE_SHARED PMD_SECT_S
+#define PHYS_MASK_SHIFT (CONFIG_ARM64_PA_BITS)
#else
static inline bool __pure lpa2_is_enabled(void)
{
@@ -89,9 +90,15 @@ static inline bool __pure lpa2_is_enable
#define PTE_MAYBE_SHARED (lpa2_is_enabled() ? 0 : PTE_SHARED)
#define PMD_MAYBE_SHARED (lpa2_is_enabled() ? 0 : PMD_SECT_S)
+#define PHYS_MASK_SHIFT (lpa2_is_enabled() ? CONFIG_ARM64_PA_BITS : 48)
#endif
/*
+ * Highest possible physical address supported.
+ */
+#define PHYS_MASK ((UL(1) << PHYS_MASK_SHIFT) - 1)
+
+/*
* If we have userspace only BTI we don't want to mark kernel pages
* guarded even if the system does support BTI.
*/
--- a/arch/arm64/include/asm/sparsemem.h
+++ b/arch/arm64/include/asm/sparsemem.h
@@ -5,7 +5,10 @@
#ifndef __ASM_SPARSEMEM_H
#define __ASM_SPARSEMEM_H
-#define MAX_PHYSMEM_BITS CONFIG_ARM64_PA_BITS
+#include <asm/pgtable-prot.h>
+
+#define MAX_PHYSMEM_BITS PHYS_MASK_SHIFT
+#define MAX_POSSIBLE_PHYSMEM_BITS (52)
/*
* Section size must be at least 512MB for 64K base
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 164/443] KVM: arm64: timer: Always evaluate the need for a soft timer
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 163/443] arm64/mm: Reduce PA space to 48 bits when LPA2 is not enabled Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 165/443] drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event() Greg Kroah-Hartman
` (289 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmytro Terletskyi, Oliver Upton,
Marc Zyngier
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit b450dcce93bc2cf6d2bfaf5a0de88a94ebad8f89 upstream.
When updating the interrupt state for an emulated timer, we return
early and skip the setup of a soft timer that runs in parallel
with the guest.
While this is OK if we have set the interrupt pending, it is pretty
wrong if the guest moved CVAL into the future. In that case,
no timer is armed and the guest can wait for a very long time
(it will take a full put/load cycle for the situation to resolve).
This is specially visible with EDK2 running at EL2, but still
using the EL1 virtual timer, which in that case is fully emulated.
Any key-press takes ages to be captured, as there is no UART
interrupt and EDK2 relies on polling from a timer...
The fix is simply to drop the early return. If the timer interrupt
is pending, we will still return early, and otherwise arm the soft
timer.
Fixes: 4d74ecfa6458b ("KVM: arm64: Don't arm a hrtimer for an already pending timer")
Cc: stable@vger.kernel.org
Tested-by: Dmytro Terletskyi <dmytro_terletskyi@epam.com>
Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20250204110050.150560-2-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/arch_timer.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/arch/arm64/kvm/arch_timer.c
+++ b/arch/arm64/kvm/arch_timer.c
@@ -466,10 +466,8 @@ static void timer_emulate(struct arch_ti
trace_kvm_timer_emulate(ctx, should_fire);
- if (should_fire != ctx->irq.level) {
+ if (should_fire != ctx->irq.level)
kvm_timer_update_irq(ctx->vcpu, should_fire, ctx);
- return;
- }
/*
* If the timer can fire now, we don't need to have a soft timer
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 165/443] drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 164/443] KVM: arm64: timer: Always evaluate the need for a soft timer Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 166/443] arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma Greg Kroah-Hartman
` (288 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Chris Zhong,
Guenter Roeck, Sandy Huang, Heiko Stübner, Andy Yan,
dri-devel, linux-arm-kernel, linux-rockchip
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 666e1960464140cc4bc9203c203097e70b54c95a upstream.
The code for detecting and updating the connector status in
cdn_dp_pd_event_work() has a number of problems.
- It does not aquire the locks to call the detect helper and update
the connector status. These are struct drm_mode_config.connection_mutex
and struct drm_mode_config.mutex.
- It does not use drm_helper_probe_detect(), which helps with the
details of locking and detection.
- It uses the connector's status field to determine a change to
the connector status. The epoch_counter field is the correct one. The
field signals a change even if the connector status' value did not
change.
Replace the code with a call to drm_connector_helper_hpd_irq_event(),
which fixes all these problems.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 81632df69772 ("drm/rockchip: cdn-dp: do not use drm_helper_hpd_irq_event")
Cc: Chris Zhong <zyw@rock-chips.com>
Cc: Guenter Roeck <groeck@chromium.org>
Cc: Sandy Huang <hjc@rock-chips.com>
Cc: "Heiko Stübner" <heiko@sntech.de>
Cc: Andy Yan <andy.yan@rock-chips.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-rockchip@lists.infradead.org
Cc: <stable@vger.kernel.org> # v4.11+
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20241105133848.480407-1-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/rockchip/cdn-dp-core.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
@@ -947,9 +947,6 @@ static void cdn_dp_pd_event_work(struct
{
struct cdn_dp_device *dp = container_of(work, struct cdn_dp_device,
event_work);
- struct drm_connector *connector = &dp->connector;
- enum drm_connector_status old_status;
-
int ret;
mutex_lock(&dp->lock);
@@ -1009,11 +1006,7 @@ static void cdn_dp_pd_event_work(struct
out:
mutex_unlock(&dp->lock);
-
- old_status = connector->status;
- connector->status = connector->funcs->detect(connector, false);
- if (old_status != connector->status)
- drm_kms_helper_hotplug_event(dp->drm_dev);
+ drm_connector_helper_hpd_irq_event(&dp->connector);
}
static int cdn_dp_pd_event(struct notifier_block *nb,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 166/443] arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 165/443] drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 167/443] remoteproc: omap: Handle ARM dma_iommu_mapping Greg Kroah-Hartman
` (287 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quentin Schulz, Jakob Unterwurzacher,
Heiko Stuebner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakob Unterwurzacher <jakobunt@gmail.com>
commit 9d241b06802c6c2176ae7aa4f9f17f8a577ed337 upstream.
During mass manufacturing, we noticed the mmc_rx_crc_error counter,
as reported by "ethtool -S eth0 | grep mmc_rx_crc_error", to increase
above zero during nuttcp speedtests. Most of the time, this did not
affect the achieved speed, but it prompted this investigation.
Cycling through the rx_delay range on six boards (see table below) of
various ages shows that there is a large good region from 0x12 to 0x35
where we see zero crc errors on all tested boards.
The old rx_delay value (0x10) seems to have always been on the edge for
the KSZ9031RNX that is usually placed on Puma.
Choose "rx_delay = 0x23" to put us smack in the middle of the good
region. This works fine as well with the KSZ9131RNX PHY that was used
for a small number of boards during the COVID chip shortages.
Board S/N PHY rx_delay good region
--------- --- --------------------
Puma TT0069903 KSZ9031RNX 0x11 0x35
Puma TT0157733 KSZ9031RNX 0x11 0x35
Puma TT0681551 KSZ9031RNX 0x12 0x37
Puma TT0681156 KSZ9031RNX 0x10 0x38
Puma 17496030079 KSZ9031RNX 0x10 0x37 (Puma v1.2 from 2017)
Puma TT0681720 KSZ9131RNX 0x02 0x39 (alternative PHY used in very few boards)
Intersection of good regions = 0x12 0x35
Middle of good region = 0x23
Fixes: 2c66fc34e945 ("arm64: dts: rockchip: add RK3399-Q7 (Puma) SoM")
Cc: stable@vger.kernel.org
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Tested-by: Quentin Schulz <quentin.schulz@cherry.de> # Puma v2.1 and v2.3 with KSZ9031
Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
Link: https://lore.kernel.org/r/20241213-puma_rx_delay-v4-1-8e8e11cc6ed7@cherry.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
@@ -182,7 +182,7 @@
snps,reset-active-low;
snps,reset-delays-us = <0 10000 50000>;
tx_delay = <0x10>;
- rx_delay = <0x10>;
+ rx_delay = <0x23>;
status = "okay";
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 167/443] remoteproc: omap: Handle ARM dma_iommu_mapping
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 166/443] arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 168/443] KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID Greg Kroah-Hartman
` (286 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Murphy, Beleswar Padhi,
Mathieu Poirier
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
commit 1dc7c8ed7cb378dd3974387692dfa833aee718d4 upstream.
It's no longer practical for the OMAP IOMMU driver to trick
arm_setup_iommu_dma_ops() into ignoring its presence, so let's use the
same tactic as other IOMMU API users on 32-bit ARM and explicitly kick
the arch code's dma_iommu_mapping out of the way to avoid problems.
Fixes: 4720287c7bf7 ("iommu: Remove struct iommu_ops *iommu from arch_setup_dma_ops()")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Tested-by: Beleswar Padhi <b-padhi@ti.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/6186e311cb6f64a787f87fd41e49a73f409b789c.1730136799.git.robin.murphy@arm.com
[Fixed changelog title]
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/remoteproc/omap_remoteproc.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/drivers/remoteproc/omap_remoteproc.c
+++ b/drivers/remoteproc/omap_remoteproc.c
@@ -37,6 +37,10 @@
#include <linux/platform_data/dmtimer-omap.h>
+#ifdef CONFIG_ARM_DMA_USE_IOMMU
+#include <asm/dma-iommu.h>
+#endif
+
#include "omap_remoteproc.h"
#include "remoteproc_internal.h"
@@ -1323,6 +1327,19 @@ static int omap_rproc_probe(struct platf
/* All existing OMAP IPU and DSP processors have an MMU */
rproc->has_iommu = true;
+#ifdef CONFIG_ARM_DMA_USE_IOMMU
+ /*
+ * Throw away the ARM DMA mapping that we'll never use, so it doesn't
+ * interfere with the core rproc->domain and we get the right DMA ops.
+ */
+ if (pdev->dev.archdata.mapping) {
+ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(&pdev->dev);
+
+ arm_iommu_detach_device(&pdev->dev);
+ arm_iommu_release_mapping(mapping);
+ }
+#endif
+
ret = omap_rproc_of_get_internal_memories(pdev, rproc);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 168/443] KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 167/443] remoteproc: omap: Handle ARM dma_iommu_mapping Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 169/443] KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Greg Kroah-Hartman
` (285 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Markku Ahvenjärvi,
Janne Karhunen, Chao Gao, Sean Christopherson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Gao <chao.gao@intel.com>
commit 04bc93cf49d16d01753b95ddb5d4f230b809a991 upstream.
If KVM emulates an EOI for L1's virtual APIC while L2 is active, defer
updating GUEST_INTERUPT_STATUS.SVI, i.e. the VMCS's cache of the highest
in-service IRQ, until L1 is active, as vmcs01, not vmcs02, needs to track
vISR. The missed SVI update for vmcs01 can result in L1 interrupts being
incorrectly blocked, e.g. if there is a pending interrupt with lower
priority than the interrupt that was EOI'd.
This bug only affects use cases where L1's vAPIC is effectively passed
through to L2, e.g. in a pKVM scenario where L2 is L1's depriveleged host,
as KVM will only emulate an EOI for L1's vAPIC if Virtual Interrupt
Delivery (VID) is disabled in vmc12, and L1 isn't intercepting L2 accesses
to its (virtual) APIC page (or if x2APIC is enabled, the EOI MSR).
WARN() if KVM updates L1's ISR while L2 is active with VID enabled, as an
EOI from L2 is supposed to affect L2's vAPIC, but still defer the update,
to try to keep L1 alive. Specifically, KVM forwards all APICv-related
VM-Exits to L1 via nested_vmx_l1_wants_exit():
case EXIT_REASON_APIC_ACCESS:
case EXIT_REASON_APIC_WRITE:
case EXIT_REASON_EOI_INDUCED:
/*
* The controls for "virtualize APIC accesses," "APIC-
* register virtualization," and "virtual-interrupt
* delivery" only come from vmcs12.
*/
return true;
Fixes: c7c9c56ca26f ("x86, apicv: add virtual interrupt delivery support")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/kvm/20230312180048.1778187-1-jason.cj.chen@intel.com
Reported-by: Markku Ahvenjärvi <mankku@gmail.com>
Closes: https://lore.kernel.org/all/20240920080012.74405-1-mankku@gmail.com
Cc: Janne Karhunen <janne.karhunen@gmail.com>
Signed-off-by: Chao Gao <chao.gao@intel.com>
[sean: drop request, handle in VMX, write changelog]
Tested-by: Chao Gao <chao.gao@intel.com>
Link: https://lore.kernel.org/r/20241128000010.4051275-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/lapic.c | 11 +++++++++++
arch/x86/kvm/lapic.h | 1 +
arch/x86/kvm/vmx/nested.c | 5 +++++
arch/x86/kvm/vmx/vmx.c | 21 +++++++++++++++++++++
arch/x86/kvm/vmx/vmx.h | 1 +
5 files changed, 39 insertions(+)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -816,6 +816,17 @@ static inline void apic_clear_isr(int ve
}
}
+void kvm_apic_update_hwapic_isr(struct kvm_vcpu *vcpu)
+{
+ struct kvm_lapic *apic = vcpu->arch.apic;
+
+ if (WARN_ON_ONCE(!lapic_in_kernel(vcpu)) || !apic->apicv_active)
+ return;
+
+ kvm_x86_call(hwapic_isr_update)(vcpu, apic_find_highest_isr(apic));
+}
+EXPORT_SYMBOL_GPL(kvm_apic_update_hwapic_isr);
+
int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu)
{
/* This may race with setting of irr in __apic_accept_irq() and
--- a/arch/x86/kvm/lapic.h
+++ b/arch/x86/kvm/lapic.h
@@ -118,6 +118,7 @@ void kvm_apic_send_ipi(struct kvm_lapic
int kvm_apic_set_base(struct kvm_vcpu *vcpu, u64 value, bool host_initiated);
int kvm_apic_get_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s);
int kvm_apic_set_state(struct kvm_vcpu *vcpu, struct kvm_lapic_state *s);
+void kvm_apic_update_hwapic_isr(struct kvm_vcpu *vcpu);
int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu);
u64 kvm_get_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu);
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5050,6 +5050,11 @@ void nested_vmx_vmexit(struct kvm_vcpu *
kvm_make_request(KVM_REQ_APICV_UPDATE, vcpu);
}
+ if (vmx->nested.update_vmcs01_hwapic_isr) {
+ vmx->nested.update_vmcs01_hwapic_isr = false;
+ kvm_apic_update_hwapic_isr(vcpu);
+ }
+
if ((vm_exit_reason != -1) &&
(enable_shadow_vmcs || nested_vmx_is_evmptr12_valid(vmx)))
vmx->nested.need_vmcs12_to_shadow_sync = true;
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6867,6 +6867,27 @@ void vmx_hwapic_isr_update(struct kvm_vc
u16 status;
u8 old;
+ /*
+ * If L2 is active, defer the SVI update until vmcs01 is loaded, as SVI
+ * is only relevant for if and only if Virtual Interrupt Delivery is
+ * enabled in vmcs12, and if VID is enabled then L2 EOIs affect L2's
+ * vAPIC, not L1's vAPIC. KVM must update vmcs01 on the next nested
+ * VM-Exit, otherwise L1 with run with a stale SVI.
+ */
+ if (is_guest_mode(vcpu)) {
+ /*
+ * KVM is supposed to forward intercepted L2 EOIs to L1 if VID
+ * is enabled in vmcs12; as above, the EOIs affect L2's vAPIC.
+ * Note, userspace can stuff state while L2 is active; assert
+ * that VID is disabled if and only if the vCPU is in KVM_RUN
+ * to avoid false positives if userspace is setting APIC state.
+ */
+ WARN_ON_ONCE(vcpu->wants_to_run &&
+ nested_cpu_has_vid(get_vmcs12(vcpu)));
+ to_vmx(vcpu)->nested.update_vmcs01_hwapic_isr = true;
+ return;
+ }
+
if (max_isr == -1)
max_isr = 0;
--- a/arch/x86/kvm/vmx/vmx.h
+++ b/arch/x86/kvm/vmx/vmx.h
@@ -176,6 +176,7 @@ struct nested_vmx {
bool reload_vmcs01_apic_access_page;
bool update_vmcs01_cpu_dirty_logging;
bool update_vmcs01_apicv_status;
+ bool update_vmcs01_hwapic_isr;
/*
* Enlightened VMCS has been enabled. It does not mean that L1 has to
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 169/443] KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 168/443] KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 170/443] kvm: defer huge page recovery vhost task to later Greg Kroah-Hartman
` (284 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Will Deacon, Michal Luczaj,
Pankaj Gupta, Sean Christopherson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 1e7381f3617d14b3c11da80ff5f8a93ab14cfc46 upstream.
Explicitly verify the target vCPU is fully online _prior_ to clamping the
index in kvm_get_vcpu(). If the index is "bad", the nospec clamping will
generate '0', i.e. KVM will return vCPU0 instead of NULL.
In practice, the bug is unlikely to cause problems, as it will only come
into play if userspace or the guest is buggy or misbehaving, e.g. KVM may
send interrupts to vCPU0 instead of dropping them on the floor.
However, returning vCPU0 when it shouldn't exist per online_vcpus is
problematic now that KVM uses an xarray for the vCPUs array, as KVM needs
to insert into the xarray before publishing the vCPU to userspace (see
commit c5b077549136 ("KVM: Convert the kvm->vcpus array to a xarray")),
i.e. before vCPU creation is guaranteed to succeed.
As a result, incorrectly providing access to vCPU0 will trigger a
use-after-free if vCPU0 is dereferenced and kvm_vm_ioctl_create_vcpu()
bails out of vCPU creation due to an error and frees vCPU0. Commit
afb2acb2e3a3 ("KVM: Fix vcpu_array[0] races") papered over that issue, but
in doing so introduced an unsolvable teardown conundrum. Preventing
accesses to vCPU0 before it's fully online will allow reverting commit
afb2acb2e3a3, without re-introducing the vcpu_array[0] UAF race.
Fixes: 1d487e9bf8ba ("KVM: fix spectrev1 gadgets")
Cc: stable@vger.kernel.org
Cc: Will Deacon <will@kernel.org>
Cc: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
Acked-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20241009150455.1057573-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/kvm_host.h | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -963,6 +963,15 @@ static inline struct kvm_io_bus *kvm_get
static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i)
{
int num_vcpus = atomic_read(&kvm->online_vcpus);
+
+ /*
+ * Explicitly verify the target vCPU is online, as the anti-speculation
+ * logic only limits the CPU's ability to speculate, e.g. given a "bad"
+ * index, clamping the index to 0 would return vCPU0, not NULL.
+ */
+ if (i >= num_vcpus)
+ return NULL;
+
i = array_index_nospec(i, num_vcpus);
/* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu. */
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 170/443] kvm: defer huge page recovery vhost task to later
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 169/443] KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 171/443] KVM: s390: vsie: fix some corner-cases when grabbing vsie pages Greg Kroah-Hartman
` (283 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Paolo Bonzini,
Alyssa Ross, Keith Busch
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
commit 931656b9e2ff7029aee0b36e17780621948a6ac1 upstream.
Some libraries want to ensure they are single threaded before forking,
so making the kernel's kvm huge page recovery process a vhost task of
the user process breaks those. The minijail library used by crosvm is
one such affected application.
Defer the task to after the first VM_RUN call, which occurs after the
parent process has forked all its jailed processes. This needs to happen
only once for the kvm instance, so introduce some general-purpose
infrastructure for that, too. It's similar in concept to pthread_once;
except it is actually usable, because the callback takes a parameter.
Cc: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Alyssa Ross <hi@alyssa.is>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Message-ID: <20250123153543.2769928-1-kbusch@meta.com>
[Move call_once API to include/linux. - Paolo]
Cc: stable@vger.kernel.org
Fixes: d96c77bd4eeb ("KVM: x86: switch hugepage recovery thread to vhost_task")
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/kvm_host.h | 2 +
arch/x86/kvm/mmu/mmu.c | 18 +++++++++++-----
arch/x86/kvm/x86.c | 7 +++++-
include/linux/call_once.h | 45 ++++++++++++++++++++++++++++++++++++++++
4 files changed, 66 insertions(+), 6 deletions(-)
create mode 100644 include/linux/call_once.h
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -27,6 +27,7 @@
#include <linux/hyperv.h>
#include <linux/kfifo.h>
#include <linux/sched/vhost_task.h>
+#include <linux/call_once.h>
#include <asm/apic.h>
#include <asm/pvclock-abi.h>
@@ -1445,6 +1446,7 @@ struct kvm_arch {
struct kvm_x86_pmu_event_filter __rcu *pmu_event_filter;
struct vhost_task *nx_huge_page_recovery_thread;
u64 nx_huge_page_last;
+ struct once nx_once;
#ifdef CONFIG_X86_64
/* The number of TDP MMU pages across all roots. */
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -7411,20 +7411,28 @@ static bool kvm_nx_huge_page_recovery_wo
return true;
}
-int kvm_mmu_post_init_vm(struct kvm *kvm)
+static void kvm_mmu_start_lpage_recovery(struct once *once)
{
- if (nx_hugepage_mitigation_hard_disabled)
- return 0;
+ struct kvm_arch *ka = container_of(once, struct kvm_arch, nx_once);
+ struct kvm *kvm = container_of(ka, struct kvm, arch);
kvm->arch.nx_huge_page_last = get_jiffies_64();
kvm->arch.nx_huge_page_recovery_thread = vhost_task_create(
kvm_nx_huge_page_recovery_worker, kvm_nx_huge_page_recovery_worker_kill,
kvm, "kvm-nx-lpage-recovery");
+ if (kvm->arch.nx_huge_page_recovery_thread)
+ vhost_task_start(kvm->arch.nx_huge_page_recovery_thread);
+}
+
+int kvm_mmu_post_init_vm(struct kvm *kvm)
+{
+ if (nx_hugepage_mitigation_hard_disabled)
+ return 0;
+
+ call_once(&kvm->arch.nx_once, kvm_mmu_start_lpage_recovery);
if (!kvm->arch.nx_huge_page_recovery_thread)
return -ENOMEM;
-
- vhost_task_start(kvm->arch.nx_huge_page_recovery_thread);
return 0;
}
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -11463,6 +11463,10 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
struct kvm_run *kvm_run = vcpu->run;
int r;
+ r = kvm_mmu_post_init_vm(vcpu->kvm);
+ if (r)
+ return r;
+
vcpu_load(vcpu);
kvm_sigset_activate(vcpu);
kvm_run->flags = 0;
@@ -12742,7 +12746,8 @@ out:
int kvm_arch_post_init_vm(struct kvm *kvm)
{
- return kvm_mmu_post_init_vm(kvm);
+ once_init(&kvm->arch.nx_once);
+ return 0;
}
static void kvm_unload_vcpu_mmu(struct kvm_vcpu *vcpu)
--- /dev/null
+++ b/include/linux/call_once.h
@@ -0,0 +1,45 @@
+#ifndef _LINUX_CALL_ONCE_H
+#define _LINUX_CALL_ONCE_H
+
+#include <linux/types.h>
+#include <linux/mutex.h>
+
+#define ONCE_NOT_STARTED 0
+#define ONCE_RUNNING 1
+#define ONCE_COMPLETED 2
+
+struct once {
+ atomic_t state;
+ struct mutex lock;
+};
+
+static inline void __once_init(struct once *once, const char *name,
+ struct lock_class_key *key)
+{
+ atomic_set(&once->state, ONCE_NOT_STARTED);
+ __mutex_init(&once->lock, name, key);
+}
+
+#define once_init(once) \
+do { \
+ static struct lock_class_key __key; \
+ __once_init((once), #once, &__key); \
+} while (0)
+
+static inline void call_once(struct once *once, void (*cb)(struct once *))
+{
+ /* Pairs with atomic_set_release() below. */
+ if (atomic_read_acquire(&once->state) == ONCE_COMPLETED)
+ return;
+
+ guard(mutex)(&once->lock);
+ WARN_ON(atomic_read(&once->state) == ONCE_RUNNING);
+ if (atomic_read(&once->state) != ONCE_NOT_STARTED)
+ return;
+
+ atomic_set(&once->state, ONCE_RUNNING);
+ cb(once);
+ atomic_set_release(&once->state, ONCE_COMPLETED);
+}
+
+#endif /* _LINUX_CALL_ONCE_H */
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 171/443] KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 170/443] kvm: defer huge page recovery vhost task to later Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 172/443] ksmbd: fix integer overflows on 32 bit systems Greg Kroah-Hartman
` (282 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Hildenbrand, Claudio Imbrenda,
Christoph Schlameuss
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <david@redhat.com>
commit 5f230f41fdd9e799f43a699348dc572bca7159aa upstream.
We try to reuse the same vsie page when re-executing the vsie with a
given SCB address. The result is that we use the same shadow SCB --
residing in the vsie page -- and can avoid flushing the TLB when
re-running the vsie on a CPU.
So, when we allocate a fresh vsie page, or when we reuse a vsie page for
a different SCB address -- reusing the shadow SCB in different context --
we set ihcpu=0xffff to trigger the flush.
However, after we looked up the SCB address in the radix tree, but before
we grabbed the vsie page by raising the refcount to 2, someone could reuse
the vsie page for a different SCB address, adjusting page->index and the
radix tree. In that case, we would be reusing the vsie page with a
wrong page->index.
Another corner case is that we might set the SCB address for a vsie
page, but fail the insertion into the radix tree. Whoever would reuse
that page would remove the corresponding radix tree entry -- which might
now be a valid entry pointing at another page, resulting in the wrong
vsie page getting removed from the radix tree.
Let's handle such races better, by validating that the SCB address of a
vsie page didn't change after we grabbed it (not reuse for a different
SCB; the alternative would be performing another tree lookup), and by
setting the SCB address to invalid until the insertion in the tree
succeeded (SCB addresses are aligned to 512, so ULONG_MAX is invalid).
These scenarios are rare, the effects a bit unclear, and these issues were
only found by code inspection. Let's CC stable to be safe.
Fixes: a3508fbe9dc6 ("KVM: s390: vsie: initial support for nested virtualization")
Cc: stable@vger.kernel.org
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Tested-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Message-ID: <20250107154344.1003072-2-david@redhat.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kvm/vsie.c | 25 +++++++++++++++++++------
1 file changed, 19 insertions(+), 6 deletions(-)
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -1362,8 +1362,14 @@ static struct vsie_page *get_vsie_page(s
page = radix_tree_lookup(&kvm->arch.vsie.addr_to_page, addr >> 9);
rcu_read_unlock();
if (page) {
- if (page_ref_inc_return(page) == 2)
- return page_to_virt(page);
+ if (page_ref_inc_return(page) == 2) {
+ if (page->index == addr)
+ return page_to_virt(page);
+ /*
+ * We raced with someone reusing + putting this vsie
+ * page before we grabbed it.
+ */
+ }
page_ref_dec(page);
}
@@ -1393,15 +1399,20 @@ static struct vsie_page *get_vsie_page(s
kvm->arch.vsie.next++;
kvm->arch.vsie.next %= nr_vcpus;
}
- radix_tree_delete(&kvm->arch.vsie.addr_to_page, page->index >> 9);
+ if (page->index != ULONG_MAX)
+ radix_tree_delete(&kvm->arch.vsie.addr_to_page,
+ page->index >> 9);
}
- page->index = addr;
- /* double use of the same address */
+ /* Mark it as invalid until it resides in the tree. */
+ page->index = ULONG_MAX;
+
+ /* Double use of the same address or allocation failure. */
if (radix_tree_insert(&kvm->arch.vsie.addr_to_page, addr >> 9, page)) {
page_ref_dec(page);
mutex_unlock(&kvm->arch.vsie.mutex);
return NULL;
}
+ page->index = addr;
mutex_unlock(&kvm->arch.vsie.mutex);
vsie_page = page_to_virt(page);
@@ -1496,7 +1507,9 @@ void kvm_s390_vsie_destroy(struct kvm *k
vsie_page = page_to_virt(page);
release_gmap_shadow(vsie_page);
/* free the radix tree entry */
- radix_tree_delete(&kvm->arch.vsie.addr_to_page, page->index >> 9);
+ if (page->index != ULONG_MAX)
+ radix_tree_delete(&kvm->arch.vsie.addr_to_page,
+ page->index >> 9);
__free_page(page);
}
kvm->arch.vsie.page_count = 0;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 172/443] ksmbd: fix integer overflows on 32 bit systems
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 171/443] KVM: s390: vsie: fix some corner-cases when grabbing vsie pages Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 173/443] drm/amd/display: Optimize cursor position updates Greg Kroah-Hartman
` (281 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Namjae Jeon,
Steve French
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit aab98e2dbd648510f8f51b83fbf4721206ccae45 upstream.
On 32bit systems the addition operations in ipc_msg_alloc() can
potentially overflow leading to memory corruption.
Add bounds checking using KSMBD_IPC_MAX_PAYLOAD to avoid overflow.
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/server/transport_ipc.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
@@ -626,6 +626,9 @@ ksmbd_ipc_spnego_authen_request(const ch
struct ksmbd_spnego_authen_request *req;
struct ksmbd_spnego_authen_response *resp;
+ if (blob_len > KSMBD_IPC_MAX_PAYLOAD)
+ return NULL;
+
msg = ipc_msg_alloc(sizeof(struct ksmbd_spnego_authen_request) +
blob_len + 1);
if (!msg)
@@ -805,6 +808,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_writ
struct ksmbd_rpc_command *req;
struct ksmbd_rpc_command *resp;
+ if (payload_sz > KSMBD_IPC_MAX_PAYLOAD)
+ return NULL;
+
msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1);
if (!msg)
return NULL;
@@ -853,6 +859,9 @@ struct ksmbd_rpc_command *ksmbd_rpc_ioct
struct ksmbd_rpc_command *req;
struct ksmbd_rpc_command *resp;
+ if (payload_sz > KSMBD_IPC_MAX_PAYLOAD)
+ return NULL;
+
msg = ipc_msg_alloc(sizeof(struct ksmbd_rpc_command) + payload_sz + 1);
if (!msg)
return NULL;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 173/443] drm/amd/display: Optimize cursor position updates
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 172/443] ksmbd: fix integer overflows on 32 bit systems Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 174/443] drm/amd/pm: Mark MM activity as unsupported Greg Kroah-Hartman
` (280 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Alex Deucher,
Sung Lee, Aric Cyr, Wayne Lin, Daniel Wheeler
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aric Cyr <Aric.Cyr@amd.com>
commit 024771f3fb75dc817e9429d5763f1a6eb84b6f21 upstream.
[why]
Updating the cursor enablement register can be a slow operation and accumulates
when high polling rate cursors cause frequent updates asynchronously to the
cursor position.
[how]
Since the cursor enable bit is cached there is no need to update the
enablement register if there is no change to it. This removes the
read-modify-write from the cursor position programming path in HUBP and
DPP, leaving only the register writes.
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Reviewed-by: Sung Lee <sung.lee@amd.com>
Signed-off-by: Aric Cyr <Aric.Cyr@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.c | 7 ++++---
drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_cm.c | 6 ++++--
drivers/gpu/drm/amd/display/dc/hubp/dcn20/dcn20_hubp.c | 8 +++++---
drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 10 ++++++----
4 files changed, 19 insertions(+), 12 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.c
+++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.c
@@ -483,10 +483,11 @@ void dpp1_set_cursor_position(
if (src_y_offset + cursor_height <= 0)
cur_en = 0; /* not visible beyond top edge*/
- REG_UPDATE(CURSOR0_CONTROL,
- CUR0_ENABLE, cur_en);
+ if (dpp_base->pos.cur0_ctl.bits.cur0_enable != cur_en) {
+ REG_UPDATE(CURSOR0_CONTROL, CUR0_ENABLE, cur_en);
- dpp_base->pos.cur0_ctl.bits.cur0_enable = cur_en;
+ dpp_base->pos.cur0_ctl.bits.cur0_enable = cur_en;
+ }
}
void dpp1_cnv_set_optional_cursor_attributes(
--- a/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dpp/dcn401/dcn401_dpp_cm.c
@@ -154,9 +154,11 @@ void dpp401_set_cursor_position(
struct dcn401_dpp *dpp = TO_DCN401_DPP(dpp_base);
uint32_t cur_en = pos->enable ? 1 : 0;
- REG_UPDATE(CURSOR0_CONTROL, CUR0_ENABLE, cur_en);
+ if (dpp_base->pos.cur0_ctl.bits.cur0_enable != cur_en) {
+ REG_UPDATE(CURSOR0_CONTROL, CUR0_ENABLE, cur_en);
- dpp_base->pos.cur0_ctl.bits.cur0_enable = cur_en;
+ dpp_base->pos.cur0_ctl.bits.cur0_enable = cur_en;
+ }
}
void dpp401_set_optional_cursor_attributes(
--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn20/dcn20_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn20/dcn20_hubp.c
@@ -1044,11 +1044,13 @@ void hubp2_cursor_set_position(
if (src_y_offset + cursor_height <= 0)
cur_en = 0; /* not visible beyond top edge*/
- if (cur_en && REG_READ(CURSOR_SURFACE_ADDRESS) == 0)
- hubp->funcs->set_cursor_attributes(hubp, &hubp->curs_attr);
+ if (hubp->pos.cur_ctl.bits.cur_enable != cur_en) {
+ if (cur_en && REG_READ(CURSOR_SURFACE_ADDRESS) == 0)
+ hubp->funcs->set_cursor_attributes(hubp, &hubp->curs_attr);
- REG_UPDATE(CURSOR_CONTROL,
+ REG_UPDATE(CURSOR_CONTROL,
CURSOR_ENABLE, cur_en);
+ }
REG_SET_2(CURSOR_POSITION, 0,
CURSOR_X_POSITION, pos->x,
--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
@@ -718,11 +718,13 @@ void hubp401_cursor_set_position(
dc_fixpt_from_int(dst_x_offset),
param->h_scale_ratio));
- if (cur_en && REG_READ(CURSOR_SURFACE_ADDRESS) == 0)
- hubp->funcs->set_cursor_attributes(hubp, &hubp->curs_attr);
+ if (hubp->pos.cur_ctl.bits.cur_enable != cur_en) {
+ if (cur_en && REG_READ(CURSOR_SURFACE_ADDRESS) == 0)
+ hubp->funcs->set_cursor_attributes(hubp, &hubp->curs_attr);
- REG_UPDATE(CURSOR_CONTROL,
- CURSOR_ENABLE, cur_en);
+ REG_UPDATE(CURSOR_CONTROL,
+ CURSOR_ENABLE, cur_en);
+ }
REG_SET_2(CURSOR_POSITION, 0,
CURSOR_X_POSITION, x_pos,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 174/443] drm/amd/pm: Mark MM activity as unsupported
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 173/443] drm/amd/display: Optimize cursor position updates Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 175/443] drm/amd/amdgpu: change the config of cgcg on gfx12 Greg Kroah-Hartman
` (279 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Hawking Zhang,
Alex Deucher
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
commit 819bf6662b93a5a8b0c396d2c7e7fab6264c9808 upstream.
Aldebaran doesn't support querying MM activity percentage. Keep the
field as 0xFFs to mark it as unsupported.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
@@ -1732,7 +1732,6 @@ static ssize_t aldebaran_get_gpu_metrics
gpu_metrics->average_gfx_activity = metrics.AverageGfxActivity;
gpu_metrics->average_umc_activity = metrics.AverageUclkActivity;
- gpu_metrics->average_mm_activity = 0;
/* Valid power data is available only from primary die */
if (aldebaran_is_primary(smu)) {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 175/443] drm/amd/amdgpu: change the config of cgcg on gfx12
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 174/443] drm/amd/pm: Mark MM activity as unsupported Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 176/443] drm/amdkfd: only flush the validate MES contex Greg Kroah-Hartman
` (278 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kenneth Feng, Yang Wang,
Alex Deucher
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <kenneth.feng@amd.com>
commit 5cda56bd86c455341087dca29c65dc7c87f84340 upstream.
change the config of cgcg on gfx12
Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.12.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 11 -----------
1 file changed, 11 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
@@ -3999,17 +3999,6 @@ static void gfx_v12_0_update_coarse_grai
if (def != data)
WREG32_SOC15(GC, 0, regRLC_CGCG_CGLS_CTRL_3D, data);
-
- data = RREG32_SOC15(GC, 0, regSDMA0_RLC_CGCG_CTRL);
- data &= ~SDMA0_RLC_CGCG_CTRL__CGCG_INT_ENABLE_MASK;
- WREG32_SOC15(GC, 0, regSDMA0_RLC_CGCG_CTRL, data);
-
- /* Some ASICs only have one SDMA instance, not need to configure SDMA1 */
- if (adev->sdma.num_instances > 1) {
- data = RREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL);
- data &= ~SDMA1_RLC_CGCG_CTRL__CGCG_INT_ENABLE_MASK;
- WREG32_SOC15(GC, 0, regSDMA1_RLC_CGCG_CTRL, data);
- }
}
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 176/443] drm/amdkfd: only flush the validate MES contex
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 175/443] drm/amd/amdgpu: change the config of cgcg on gfx12 Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 177/443] drm/amdkfd: Block per-queue reset when halt_if_hws_hang=1 Greg Kroah-Hartman
` (277 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prike Liang, Jonathan Kim,
Alex Deucher
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <Prike.Liang@amd.com>
commit 9078a5bfa21e78ae68b6d7c365d1b92f26720c55 upstream.
The following page fault was observed duringthe KFD process release.
In this particular error case, the HIP test (./MemcpyPerformance -h)
does not require the queue. As a result, the process_context_addr was
not assigned when the KFD process was released, ultimately leading to
this page fault during the execution of the function
kfd_process_dequeue_from_all_devices().
[345962.294891] amdgpu 0000:03:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:153 vmid:0 pasid:0)
[345962.295333] amdgpu 0000:03:00.0: amdgpu: in page starting at address 0x0000000000000000 from client 10
[345962.295775] amdgpu 0000:03:00.0: amdgpu: GCVM_L2_PROTECTION_FAULT_STATUS:0x00000B33
[345962.296097] amdgpu 0000:03:00.0: amdgpu: Faulty UTCL2 client ID: CPC (0x5)
[345962.296394] amdgpu 0000:03:00.0: amdgpu: MORE_FAULTS: 0x1
[345962.296633] amdgpu 0000:03:00.0: amdgpu: WALKER_ERROR: 0x1
[345962.296876] amdgpu 0000:03:00.0: amdgpu: PERMISSION_FAULTS: 0x3
[345962.297135] amdgpu 0000:03:00.0: amdgpu: MAPPING_ERROR: 0x1
[345962.297377] amdgpu 0000:03:00.0: amdgpu: RW: 0x0
[345962.297682] amdgpu 0000:03:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:169 vmid:0 pasid:0)
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Jonathan Kim <jonathan.kim@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -86,9 +86,12 @@ void kfd_process_dequeue_from_device(str
if (pdd->already_dequeued)
return;
-
+ /* The MES context flush needs to filter out the case which the
+ * KFD process is created without setting up the MES context and
+ * queue for creating a compute queue.
+ */
dev->dqm->ops.process_termination(dev->dqm, &pdd->qpd);
- if (dev->kfd->shared_resources.enable_mes &&
+ if (dev->kfd->shared_resources.enable_mes && !!pdd->proc_ctx_gpu_addr &&
down_read_trylock(&dev->adev->reset_domain->sem)) {
amdgpu_mes_flush_shader_debugger(dev->adev,
pdd->proc_ctx_gpu_addr);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 177/443] drm/amdkfd: Block per-queue reset when halt_if_hws_hang=1
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 176/443] drm/amdkfd: only flush the validate MES contex Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 178/443] Revert "drm/amd/display: Use HW lock mgr for PSR1" Greg Kroah-Hartman
` (276 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jay Cornwall, Jonathan Kim,
Alex Deucher
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Cornwall <jay.cornwall@amd.com>
commit f214b7beb00621b983e67ce97477afc3ab4b38f4 upstream.
The purpose of halt_if_hws_hang is to preserve GPU state for driver
debugging when queue preemption fails. Issuing per-queue reset may
kill wavefronts which caused the preemption failure.
Signed-off-by: Jay Cornwall <jay.cornwall@amd.com>
Reviewed-by: Jonathan Kim <Jonathan.Kim@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.12.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -2325,9 +2325,9 @@ static int unmap_queues_cpsch(struct dev
*/
mqd_mgr = dqm->mqd_mgrs[KFD_MQD_TYPE_HIQ];
if (mqd_mgr->check_preemption_failed(mqd_mgr, dqm->packet_mgr.priv_queue->queue->mqd)) {
+ while (halt_if_hws_hang)
+ schedule();
if (reset_queues_on_hws_hang(dqm)) {
- while (halt_if_hws_hang)
- schedule();
dqm->is_hws_hang = true;
kfd_hws_hang(dqm);
retval = -ETIME;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 178/443] Revert "drm/amd/display: Use HW lock mgr for PSR1"
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 177/443] drm/amdkfd: Block per-queue reset when halt_if_hws_hang=1 Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 179/443] drm/i915/guc: Debug print LRC state entries only if the context is pinned Greg Kroah-Hartman
` (275 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wayne Lin, Tom Chung, Alex Deucher
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Chung <chiahsuan.chung@amd.com>
commit f245b400a223a71d6d5f4c72a2cb9b573a7fc2b6 upstream.
This reverts commit
a2b5a9956269 ("drm/amd/display: Use HW lock mgr for PSR1")
Because it may cause system hang while connect with two edp panel.
Acked-by: Wayne Lin <wayne.lin@amd.com>
Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c
@@ -63,8 +63,7 @@ void dmub_hw_lock_mgr_inbox0_cmd(struct
bool should_use_dmub_lock(struct dc_link *link)
{
- if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1 ||
- link->psr_settings.psr_version == DC_PSR_VERSION_1)
+ if (link->psr_settings.psr_version == DC_PSR_VERSION_SU_1)
return true;
if (link->replay_settings.replay_feature_enabled)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 179/443] drm/i915/guc: Debug print LRC state entries only if the context is pinned
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 178/443] Revert "drm/amd/display: Use HW lock mgr for PSR1" Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 180/443] drm/i915: Fix page cleanup on DMA remap failure Greg Kroah-Hartman
` (274 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniele Ceraolo Spurio,
John Harrison, Matthew Brost, Rodrigo Vivi
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
commit 57965269896313e1629a518d3971ad55f599b792 upstream.
After the context is unpinned the backing memory can also be unpinned,
so any accesses via the lrc_reg_state pointer can end up in unmapped
memory. To avoid that, make sure to only access that memory if the
context is pinned when printing its info.
v2: fix newline alignment
Fixes: 28ff6520a34d ("drm/i915/guc: Update GuC debugfs to support new GuC")
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: John Harrison <John.C.Harrison@Intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: <stable@vger.kernel.org> # v5.15+
Reviewed-by: John Harrison <John.C.Harrison@Intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250115001334.3875347-1-daniele.ceraolospurio@intel.com
(cherry picked from commit 5bea40687c5cf2a33bf04e9110eb2e2b80222ef5)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
@@ -5511,12 +5511,20 @@ static inline void guc_log_context(struc
{
drm_printf(p, "GuC lrc descriptor %u:\n", ce->guc_id.id);
drm_printf(p, "\tHW Context Desc: 0x%08x\n", ce->lrc.lrca);
- drm_printf(p, "\t\tLRC Head: Internal %u, Memory %u\n",
- ce->ring->head,
- ce->lrc_reg_state[CTX_RING_HEAD]);
- drm_printf(p, "\t\tLRC Tail: Internal %u, Memory %u\n",
- ce->ring->tail,
- ce->lrc_reg_state[CTX_RING_TAIL]);
+ if (intel_context_pin_if_active(ce)) {
+ drm_printf(p, "\t\tLRC Head: Internal %u, Memory %u\n",
+ ce->ring->head,
+ ce->lrc_reg_state[CTX_RING_HEAD]);
+ drm_printf(p, "\t\tLRC Tail: Internal %u, Memory %u\n",
+ ce->ring->tail,
+ ce->lrc_reg_state[CTX_RING_TAIL]);
+ intel_context_unpin(ce);
+ } else {
+ drm_printf(p, "\t\tLRC Head: Internal %u, Memory not pinned\n",
+ ce->ring->head);
+ drm_printf(p, "\t\tLRC Tail: Internal %u, Memory not pinned\n",
+ ce->ring->tail);
+ }
drm_printf(p, "\t\tContext Pin Count: %u\n",
atomic_read(&ce->pin_count));
drm_printf(p, "\t\tGuC ID Ref Count: %u\n",
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 180/443] drm/i915: Fix page cleanup on DMA remap failure
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 179/443] drm/i915/guc: Debug print LRC state entries only if the context is pinned Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 181/443] drm/ast: astdp: Fix timeout for enabling video signal Greg Kroah-Hartman
` (273 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjala, Vidya Srinivas,
Brian Geffon, Tomasz Figa, Jonathan Cavitt, Rodrigo Vivi
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Geffon <bgeffon@google.com>
commit fa6182c8b13ebfdc70ebdc09161a70dd8131f3b1 upstream.
When converting to folios the cleanup path of shmem_get_pages() was
missed. When a DMA remap fails and the max segment size is greater than
PAGE_SIZE it will attempt to retry the remap with a PAGE_SIZEd segment
size. The cleanup code isn't properly using the folio apis and as a
result isn't handling compound pages correctly.
v2 -> v3:
(Ville) Just use shmem_sg_free_table() as-is in the failure path of
shmem_get_pages(). shmem_sg_free_table() will clear mapping unevictable
but it will be reset when it retries in shmem_sg_alloc_table().
v1 -> v2:
(Ville) Fixed locations where we were not clearing mapping unevictable.
Cc: stable@vger.kernel.org
Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
Cc: Vidya Srinivas <vidya.srinivas@intel.com>
Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13487
Link: https://lore.kernel.org/lkml/20250116135636.410164-1-bgeffon@google.com/
Fixes: 0b62af28f249 ("i915: convert shmem_sg_free_table() to use a folio_batch")
Signed-off-by: Brian Geffon <bgeffon@google.com>
Suggested-by: Tomasz Figa <tfiga@google.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250127204332.336665-1-bgeffon@google.com
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Tested-by: Vidya Srinivas <vidya.srinivas@intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
(cherry picked from commit 9e304a18630875352636ad52a3d2af47c3bde824)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
@@ -209,8 +209,6 @@ static int shmem_get_pages(struct drm_i9
struct address_space *mapping = obj->base.filp->f_mapping;
unsigned int max_segment = i915_sg_segment_size(i915->drm.dev);
struct sg_table *st;
- struct sgt_iter sgt_iter;
- struct page *page;
int ret;
/*
@@ -239,9 +237,7 @@ rebuild_st:
* for PAGE_SIZE chunks instead may be helpful.
*/
if (max_segment > PAGE_SIZE) {
- for_each_sgt_page(page, sgt_iter, st)
- put_page(page);
- sg_free_table(st);
+ shmem_sg_free_table(st, mapping, false, false);
kfree(st);
max_segment = PAGE_SIZE;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 181/443] drm/ast: astdp: Fix timeout for enabling video signal
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 180/443] drm/i915: Fix page cleanup on DMA remap failure Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 182/443] drm/komeda: Add check for komeda_get_layer_fourcc_list() Greg Kroah-Hartman
` (272 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Jocelyn Falempe,
Dave Airlie, dri-devel
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit fd39c41bcd82d5ebaaebadb944eab5598c668a90 upstream.
The ASTDP transmitter sometimes takes up to 1 second for enabling the
video signal, while the timeout is only 200 msec. This results in a
kernel error message. Increase the timeout to 1 second. An example
of the error message is shown below.
[ 697.084433] ------------[ cut here ]------------
[ 697.091115] ast 0000:02:00.0: [drm] drm_WARN_ON(!__ast_dp_wait_enable(ast, enabled))
[ 697.091233] WARNING: CPU: 1 PID: 160 at drivers/gpu/drm/ast/ast_dp.c:232 ast_dp_set_enable+0x123/0x140 [ast]
[...]
[ 697.272469] RIP: 0010:ast_dp_set_enable+0x123/0x140 [ast]
[...]
[ 697.415283] Call Trace:
[ 697.420727] <TASK>
[ 697.425908] ? show_trace_log_lvl+0x196/0x2c0
[ 697.433304] ? show_trace_log_lvl+0x196/0x2c0
[ 697.440693] ? drm_atomic_helper_commit_modeset_enables+0x30a/0x470
[ 697.450115] ? ast_dp_set_enable+0x123/0x140 [ast]
[ 697.458059] ? __warn.cold+0xaf/0xca
[ 697.464713] ? ast_dp_set_enable+0x123/0x140 [ast]
[ 697.472633] ? report_bug+0x134/0x1d0
[ 697.479544] ? handle_bug+0x58/0x90
[ 697.486127] ? exc_invalid_op+0x13/0x40
[ 697.492975] ? asm_exc_invalid_op+0x16/0x20
[ 697.500224] ? preempt_count_sub+0x14/0xc0
[ 697.507473] ? ast_dp_set_enable+0x123/0x140 [ast]
[ 697.515377] ? ast_dp_set_enable+0x123/0x140 [ast]
[ 697.523227] drm_atomic_helper_commit_modeset_enables+0x30a/0x470
[ 697.532388] drm_atomic_helper_commit_tail+0x58/0x90
[ 697.540400] ast_mode_config_helper_atomic_commit_tail+0x30/0x40 [ast]
[ 697.550009] commit_tail+0xfe/0x1d0
[ 697.556547] drm_atomic_helper_commit+0x198/0x1c0
This is a cosmetical problem. Enabling the video signal still works
even with the error message. The problem has always been present, but
only recent versions of the ast driver warn about missing the timeout.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 4e29cc7c5c67 ("drm/ast: astdp: Replace ast_dp_set_on_off()")
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v6.13+
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250127134423.84266-1-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ast/ast_dp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/ast/ast_dp.c
+++ b/drivers/gpu/drm/ast/ast_dp.c
@@ -195,7 +195,7 @@ static bool __ast_dp_wait_enable(struct
if (enabled)
vgacrdf_test |= AST_IO_VGACRDF_DP_VIDEO_ENABLE;
- for (i = 0; i < 200; ++i) {
+ for (i = 0; i < 1000; ++i) {
if (i)
mdelay(1);
vgacrdf = ast_get_index_reg_mask(ast, AST_IO_VGACRI, 0xdf,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 182/443] drm/komeda: Add check for komeda_get_layer_fourcc_list()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 181/443] drm/ast: astdp: Fix timeout for enabling video signal Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 183/443] drm/xe/devcoredump: Move exec queue snapshot to Contexts section Greg Kroah-Hartman
` (271 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Liviu Dudau
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 79fc672a092d93a7eac24fe20a571d4efd8fa5a4 upstream.
Add check for the return value of komeda_get_layer_fourcc_list()
to catch the potential exception.
Fixes: 5d51f6c0da1b ("drm/komeda: Add writeback support")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Acked-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://lore.kernel.org/r/20241219090256.146424-1-haoxiang_li2024@163.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
@@ -160,6 +160,10 @@ static int komeda_wb_connector_add(struc
formats = komeda_get_layer_fourcc_list(&mdev->fmt_tbl,
kwb_conn->wb_layer->layer_type,
&n_formats);
+ if (!formats) {
+ kfree(kwb_conn);
+ return -ENOMEM;
+ }
err = drm_writeback_connector_init(&kms->base, wb_conn,
&komeda_wb_connector_funcs,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 183/443] drm/xe/devcoredump: Move exec queue snapshot to Contexts section
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 182/443] drm/komeda: Add check for komeda_get_layer_fourcc_list() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 184/443] drm/i915/dp: Iterate DSC BPP from high to low on all platforms Greg Kroah-Hartman
` (270 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Harrison, Julia Filipchuk,
José Roberto de Souza, Lucas De Marchi, Rodrigo Vivi
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <lucas.demarchi@intel.com>
commit 042c48b73699c47d84b6ace73036e5a31a0d4cfc upstream.
Having the exec queue snapshot inside a "GuC CT" section was always
wrong. Commit c28fd6c358db ("drm/xe/devcoredump: Improve section
headings and add tile info") tried to fix that bug, but with that also
broke the mesa tool that parses the devcoredump, hence it was reverted
in commit a53da2fb25a3 ("drm/xe: Revert some changes that break a mesa
debug tool").
With the mesa tool also fixed, this can propagate as a fix on both
kernel and userspace side to avoid unnecessary headache for a debug
feature.
Cc: John Harrison <John.C.Harrison@Intel.com>
Cc: Julia Filipchuk <julia.filipchuk@intel.com>
Cc: José Roberto de Souza <jose.souza@intel.com>
Cc: stable@vger.kernel.org
Fixes: a53da2fb25a3 ("drm/xe: Revert some changes that break a mesa debug tool")
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250123051112.1938193-2-lucas.demarchi@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
(cherry picked from commit a37934ea75d331fafa7fe80b6180642ba5193422)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_devcoredump.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/gpu/drm/xe/xe_devcoredump.c
+++ b/drivers/gpu/drm/xe/xe_devcoredump.c
@@ -109,11 +109,7 @@ static ssize_t __xe_devcoredump_read(cha
drm_puts(&p, "\n**** GuC CT ****\n");
xe_guc_ct_snapshot_print(ss->guc.ct, &p);
- /*
- * Don't add a new section header here because the mesa debug decoder
- * tool expects the context information to be in the 'GuC CT' section.
- */
- /* drm_puts(&p, "\n**** Contexts ****\n"); */
+ drm_puts(&p, "\n**** Contexts ****\n");
xe_guc_exec_queue_snapshot_print(ss->ge, &p);
drm_puts(&p, "\n**** Job ****\n");
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 184/443] drm/i915/dp: Iterate DSC BPP from high to low on all platforms
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 183/443] drm/xe/devcoredump: Move exec queue snapshot to Contexts section Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 185/443] drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes Greg Kroah-Hartman
` (269 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ankit Nautiyal, Imre Deak,
Jani Nikula, Rodrigo Vivi
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
commit 230b19bc2bcc5897d0e20b4ce7e9790a469a2db0 upstream.
Commit 1c56e9a39833 ("drm/i915/dp: Get optimal link config to have best
compressed bpp") tries to find the best compressed bpp for the
link. However, it iterates from max to min bpp on display 13+, and from
min to max on other platforms. This presumably leads to minimum
compressed bpp always being chosen on display 11-12.
Iterate from high to low on all platforms to actually use the best
possible compressed bpp.
Fixes: 1c56e9a39833 ("drm/i915/dp: Get optimal link config to have best compressed bpp")
Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Cc: Imre Deak <imre.deak@intel.com>
Cc: <stable@vger.kernel.org> # v6.7+
Reviewed-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/3bba67923cbcd13a59d26ef5fa4bb042b13c8a9b.1738327620.git.jani.nikula@intel.com
(cherry picked from commit 56b0337d429356c3b9ecc36a03023c8cc856b196)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_dp.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -2049,11 +2049,10 @@ icl_dsc_compute_link_config(struct intel
/* Compressed BPP should be less than the Input DSC bpp */
dsc_max_bpp = min(dsc_max_bpp, pipe_bpp - 1);
- for (i = 0; i < ARRAY_SIZE(valid_dsc_bpp); i++) {
- if (valid_dsc_bpp[i] < dsc_min_bpp)
+ for (i = ARRAY_SIZE(valid_dsc_bpp) - 1; i >= 0; i--) {
+ if (valid_dsc_bpp[i] < dsc_min_bpp ||
+ valid_dsc_bpp[i] > dsc_max_bpp)
continue;
- if (valid_dsc_bpp[i] > dsc_max_bpp)
- break;
ret = dsc_compute_link_config(intel_dp,
pipe_config,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 185/443] drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 184/443] drm/i915/dp: Iterate DSC BPP from high to low on all platforms Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 186/443] drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan Greg Kroah-Hartman
` (268 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä,
Juha-Pekka Heikkila, Rodrigo Vivi
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
commit c7b49506b3ba7a62335e6f666a43f67d5cd9fd1e upstream.
I'm seeing underruns with these 64bpp YUV formats on TGL.
The weird details:
- only happens on pipe B/C/D SDR planes, pipe A SDR planes
seem fine, as do all HDR planes
- somehow CDCLK related, higher CDCLK allows for bigger plane
with these formats without underruns. With 300MHz CDCLK I
can only go up to 1200 pixels wide or so, with 650MHz even
a 3840 pixel wide plane was OK
- ICL and ADL so far appear unaffected
So not really sure what's the deal with this, but bspec does
state "64-bit formats supported only on the HDR planes" so
let's just drop these formats from the SDR planes. We already
disallow 64bpp RGB formats.
Cc: stable@vger.kernel.org
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241218173650.19782-2-ville.syrjala@linux.intel.com
Reviewed-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com>
(cherry picked from commit 35e1aacfe536d6e8d8d440cd7155366da2541ad4)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/skl_universal_plane.c | 4 ----
1 file changed, 4 deletions(-)
--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c
+++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c
@@ -106,8 +106,6 @@ static const u32 icl_sdr_y_plane_formats
DRM_FORMAT_Y216,
DRM_FORMAT_XYUV8888,
DRM_FORMAT_XVYU2101010,
- DRM_FORMAT_XVYU12_16161616,
- DRM_FORMAT_XVYU16161616,
};
static const u32 icl_sdr_uv_plane_formats[] = {
@@ -134,8 +132,6 @@ static const u32 icl_sdr_uv_plane_format
DRM_FORMAT_Y216,
DRM_FORMAT_XYUV8888,
DRM_FORMAT_XVYU2101010,
- DRM_FORMAT_XVYU12_16161616,
- DRM_FORMAT_XVYU16161616,
};
static const u32 icl_hdr_plane_formats[] = {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 186/443] drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 185/443] drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 187/443] drm/amd/display: Fix seamless boot sequence Greg Kroah-Hartman
` (267 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Olšák, Alex Deucher
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Olšák <marek.olsak@amd.com>
commit 2255b40cacc2e5ef1b127770fc1808c60de4a2fc upstream.
Vulkan can't support DCC and Z/S compression on GFX12 without
WRITE_COMPRESS_DISABLE in this commit or a completely different DCC
interface.
AMDGPU_TILING_GFX12_SCANOUT is added because it's already used by userspace.
Cc: stable@vger.kernel.org # 6.12.x
Signed-off-by: Marek Olšák <marek.olsak@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 8 ++++++--
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 2 ++
drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 5 +++--
include/uapi/drm/amdgpu_drm.h | 9 ++++++++-
5 files changed, 21 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -119,9 +119,10 @@
* - 3.57.0 - Compute tunneling on GFX10+
* - 3.58.0 - Add GFX12 DCC support
* - 3.59.0 - Cleared VRAM
+ * - 3.60.0 - Add AMDGPU_TILING_GFX12_DCC_WRITE_COMPRESS_DISABLE (Vulkan requirement)
*/
#define KMS_DRIVER_MAJOR 3
-#define KMS_DRIVER_MINOR 59
+#define KMS_DRIVER_MINOR 60
#define KMS_DRIVER_PATCHLEVEL 0
/*
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -309,7 +309,7 @@ int amdgpu_ttm_copy_mem_to_mem(struct am
mutex_lock(&adev->mman.gtt_window_lock);
while (src_mm.remaining) {
uint64_t from, to, cur_size, tiling_flags;
- uint32_t num_type, data_format, max_com;
+ uint32_t num_type, data_format, max_com, write_compress_disable;
struct dma_fence *next;
/* Never copy more than 256MiB at once to avoid a timeout */
@@ -340,9 +340,13 @@ int amdgpu_ttm_copy_mem_to_mem(struct am
max_com = AMDGPU_TILING_GET(tiling_flags, GFX12_DCC_MAX_COMPRESSED_BLOCK);
num_type = AMDGPU_TILING_GET(tiling_flags, GFX12_DCC_NUMBER_TYPE);
data_format = AMDGPU_TILING_GET(tiling_flags, GFX12_DCC_DATA_FORMAT);
+ write_compress_disable =
+ AMDGPU_TILING_GET(tiling_flags, GFX12_DCC_WRITE_COMPRESS_DISABLE);
copy_flags |= (AMDGPU_COPY_FLAGS_SET(MAX_COMPRESSED, max_com) |
AMDGPU_COPY_FLAGS_SET(NUMBER_TYPE, num_type) |
- AMDGPU_COPY_FLAGS_SET(DATA_FORMAT, data_format));
+ AMDGPU_COPY_FLAGS_SET(DATA_FORMAT, data_format) |
+ AMDGPU_COPY_FLAGS_SET(WRITE_COMPRESS_DISABLE,
+ write_compress_disable));
}
r = amdgpu_copy_buffer(ring, from, to, cur_size, resv,
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h
@@ -119,6 +119,8 @@ struct amdgpu_copy_mem {
#define AMDGPU_COPY_FLAGS_NUMBER_TYPE_MASK 0x07
#define AMDGPU_COPY_FLAGS_DATA_FORMAT_SHIFT 8
#define AMDGPU_COPY_FLAGS_DATA_FORMAT_MASK 0x3f
+#define AMDGPU_COPY_FLAGS_WRITE_COMPRESS_DISABLE_SHIFT 14
+#define AMDGPU_COPY_FLAGS_WRITE_COMPRESS_DISABLE_MASK 0x1
#define AMDGPU_COPY_FLAGS_SET(field, value) \
(((__u32)(value) & AMDGPU_COPY_FLAGS_##field##_MASK) << AMDGPU_COPY_FLAGS_##field##_SHIFT)
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c
@@ -1684,11 +1684,12 @@ static void sdma_v7_0_emit_copy_buffer(s
uint32_t byte_count,
uint32_t copy_flags)
{
- uint32_t num_type, data_format, max_com;
+ uint32_t num_type, data_format, max_com, write_cm;
max_com = AMDGPU_COPY_FLAGS_GET(copy_flags, MAX_COMPRESSED);
data_format = AMDGPU_COPY_FLAGS_GET(copy_flags, DATA_FORMAT);
num_type = AMDGPU_COPY_FLAGS_GET(copy_flags, NUMBER_TYPE);
+ write_cm = AMDGPU_COPY_FLAGS_GET(copy_flags, WRITE_COMPRESS_DISABLE) ? 2 : 1;
ib->ptr[ib->length_dw++] = SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_COPY) |
SDMA_PKT_COPY_LINEAR_HEADER_SUB_OP(SDMA_SUBOP_COPY_LINEAR) |
@@ -1705,7 +1706,7 @@ static void sdma_v7_0_emit_copy_buffer(s
if ((copy_flags & (AMDGPU_COPY_FLAGS_READ_DECOMPRESSED | AMDGPU_COPY_FLAGS_WRITE_COMPRESSED)))
ib->ptr[ib->length_dw++] = SDMA_DCC_DATA_FORMAT(data_format) | SDMA_DCC_NUM_TYPE(num_type) |
((copy_flags & AMDGPU_COPY_FLAGS_READ_DECOMPRESSED) ? SDMA_DCC_READ_CM(2) : 0) |
- ((copy_flags & AMDGPU_COPY_FLAGS_WRITE_COMPRESSED) ? SDMA_DCC_WRITE_CM(1) : 0) |
+ ((copy_flags & AMDGPU_COPY_FLAGS_WRITE_COMPRESSED) ? SDMA_DCC_WRITE_CM(write_cm) : 0) |
SDMA_DCC_MAX_COM(max_com) | SDMA_DCC_MAX_UCOM(1);
else
ib->ptr[ib->length_dw++] = 0;
--- a/include/uapi/drm/amdgpu_drm.h
+++ b/include/uapi/drm/amdgpu_drm.h
@@ -411,13 +411,20 @@ struct drm_amdgpu_gem_userptr {
/* GFX12 and later: */
#define AMDGPU_TILING_GFX12_SWIZZLE_MODE_SHIFT 0
#define AMDGPU_TILING_GFX12_SWIZZLE_MODE_MASK 0x7
-/* These are DCC recompression setting for memory management: */
+/* These are DCC recompression settings for memory management: */
#define AMDGPU_TILING_GFX12_DCC_MAX_COMPRESSED_BLOCK_SHIFT 3
#define AMDGPU_TILING_GFX12_DCC_MAX_COMPRESSED_BLOCK_MASK 0x3 /* 0:64B, 1:128B, 2:256B */
#define AMDGPU_TILING_GFX12_DCC_NUMBER_TYPE_SHIFT 5
#define AMDGPU_TILING_GFX12_DCC_NUMBER_TYPE_MASK 0x7 /* CB_COLOR0_INFO.NUMBER_TYPE */
#define AMDGPU_TILING_GFX12_DCC_DATA_FORMAT_SHIFT 8
#define AMDGPU_TILING_GFX12_DCC_DATA_FORMAT_MASK 0x3f /* [0:4]:CB_COLOR0_INFO.FORMAT, [5]:MM */
+/* When clearing the buffer or moving it from VRAM to GTT, don't compress and set DCC metadata
+ * to uncompressed. Set when parts of an allocation bypass DCC and read raw data. */
+#define AMDGPU_TILING_GFX12_DCC_WRITE_COMPRESS_DISABLE_SHIFT 14
+#define AMDGPU_TILING_GFX12_DCC_WRITE_COMPRESS_DISABLE_MASK 0x1
+/* bit gap */
+#define AMDGPU_TILING_GFX12_SCANOUT_SHIFT 63
+#define AMDGPU_TILING_GFX12_SCANOUT_MASK 0x1
/* Set/Get helpers for tiling flags. */
#define AMDGPU_TILING_SET(field, value) \
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 187/443] drm/amd/display: Fix seamless boot sequence
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 186/443] drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 188/443] drm/xe: Fix and re-enable xe_print_blob_ascii85() Greg Kroah-Hartman
` (266 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Alex Deucher,
Nicholas Kazlauskas, Lo-an Chen, Paul Hsieh, Alex Hung,
Daniel Wheeler
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lo-an Chen <lo-an.chen@amd.com>
commit e01f07cb92513ca4b9b219ab9caa34d607bc1e2d upstream.
[WHY]
When the system powers up eDP with external monitors in seamless boot
sequence, stutter get enabled before TTU and HUBP registers being
programmed, which resulting in underflow.
[HOW]
Enable TTU in hubp_init.
Change the sequence that do not perpare_bandwidth and optimize_bandwidth
while having seamless boot streams.
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Lo-an Chen <lo-an.chen@amd.com>
Signed-off-by: Paul Hsieh <paul.hsieh@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
drivers/gpu/drm/amd/display/dc/hubbub/dcn30/dcn30_hubbub.c | 3 ++-
drivers/gpu/drm/amd/display/dc/hubbub/dcn31/dcn31_hubbub.c | 3 ++-
drivers/gpu/drm/amd/display/dc/hubbub/dcn32/dcn32_hubbub.c | 3 ++-
drivers/gpu/drm/amd/display/dc/hubbub/dcn35/dcn35_hubbub.c | 3 ++-
drivers/gpu/drm/amd/display/dc/hubp/dcn30/dcn30_hubp.c | 2 ++
drivers/gpu/drm/amd/display/dc/hubp/dcn32/dcn32_hubp.c | 2 ++
drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 ++-
8 files changed, 15 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -2063,7 +2063,7 @@ static enum dc_status dc_commit_state_no
dc_enable_stereo(dc, context, dc_streams, context->stream_count);
- if (context->stream_count > get_seamless_boot_stream_count(context) ||
+ if (get_seamless_boot_stream_count(context) == 0 ||
context->stream_count == 0) {
/* Must wait for no flips to be pending before doing optimize bw */
hwss_wait_for_no_pipes_pending(dc, context);
--- a/drivers/gpu/drm/amd/display/dc/hubbub/dcn30/dcn30_hubbub.c
+++ b/drivers/gpu/drm/amd/display/dc/hubbub/dcn30/dcn30_hubbub.c
@@ -129,7 +129,8 @@ bool hubbub3_program_watermarks(
REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,
DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);
- hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
+ if (safe_to_lower || hubbub->ctx->dc->debug.disable_stutter)
+ hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
return wm_pending;
}
--- a/drivers/gpu/drm/amd/display/dc/hubbub/dcn31/dcn31_hubbub.c
+++ b/drivers/gpu/drm/amd/display/dc/hubbub/dcn31/dcn31_hubbub.c
@@ -750,7 +750,8 @@ static bool hubbub31_program_watermarks(
REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,
DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);*/
- hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
+ if (safe_to_lower || hubbub->ctx->dc->debug.disable_stutter)
+ hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
return wm_pending;
}
--- a/drivers/gpu/drm/amd/display/dc/hubbub/dcn32/dcn32_hubbub.c
+++ b/drivers/gpu/drm/amd/display/dc/hubbub/dcn32/dcn32_hubbub.c
@@ -786,7 +786,8 @@ static bool hubbub32_program_watermarks(
REG_UPDATE(DCHUBBUB_ARB_DF_REQ_OUTSTAND,
DCHUBBUB_ARB_MIN_REQ_OUTSTAND, 0x1FF);*/
- hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
+ if (safe_to_lower || hubbub->ctx->dc->debug.disable_stutter)
+ hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
hubbub32_force_usr_retraining_allow(hubbub, hubbub->ctx->dc->debug.force_usr_allow);
--- a/drivers/gpu/drm/amd/display/dc/hubbub/dcn35/dcn35_hubbub.c
+++ b/drivers/gpu/drm/amd/display/dc/hubbub/dcn35/dcn35_hubbub.c
@@ -326,7 +326,8 @@ static bool hubbub35_program_watermarks(
DCHUBBUB_ARB_MIN_REQ_OUTSTAND_COMMIT_THRESHOLD, 0xA);/*hw delta*/
REG_UPDATE(DCHUBBUB_ARB_HOSTVM_CNTL, DCHUBBUB_ARB_MAX_QOS_COMMIT_THRESHOLD, 0xF);
- hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
+ if (safe_to_lower || hubbub->ctx->dc->debug.disable_stutter)
+ hubbub1_allow_self_refresh_control(hubbub, !hubbub->ctx->dc->debug.disable_stutter);
hubbub32_force_usr_retraining_allow(hubbub, hubbub->ctx->dc->debug.force_usr_allow);
--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn30/dcn30_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn30/dcn30_hubp.c
@@ -484,6 +484,8 @@ void hubp3_init(struct hubp *hubp)
//hubp[i].HUBPREQ_DEBUG.HUBPREQ_DEBUG[26] = 1;
REG_WRITE(HUBPREQ_DEBUG, 1 << 26);
+ REG_UPDATE(DCHUBP_CNTL, HUBP_TTU_DISABLE, 0);
+
hubp_reset(hubp);
}
--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn32/dcn32_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn32/dcn32_hubp.c
@@ -168,6 +168,8 @@ void hubp32_init(struct hubp *hubp)
{
struct dcn20_hubp *hubp2 = TO_DCN20_HUBP(hubp);
REG_WRITE(HUBPREQ_DEBUG_DB, 1 << 8);
+
+ REG_UPDATE(DCHUBP_CNTL, HUBP_TTU_DISABLE, 0);
}
static struct hubp_funcs dcn32_hubp_funcs = {
.hubp_enable_tripleBuffer = hubp2_enable_triplebuffer,
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
@@ -236,7 +236,8 @@ void dcn35_init_hw(struct dc *dc)
}
hws->funcs.init_pipes(dc, dc->current_state);
- if (dc->res_pool->hubbub->funcs->allow_self_refresh_control)
+ if (dc->res_pool->hubbub->funcs->allow_self_refresh_control &&
+ !dc->res_pool->hubbub->ctx->dc->debug.disable_stutter)
dc->res_pool->hubbub->funcs->allow_self_refresh_control(dc->res_pool->hubbub,
!dc->res_pool->hubbub->ctx->dc->debug.disable_stutter);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 188/443] drm/xe: Fix and re-enable xe_print_blob_ascii85()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 187/443] drm/amd/display: Fix seamless boot sequence Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 189/443] Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc Greg Kroah-Hartman
` (265 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, José Roberto de Souza,
John Harrison, Julia Filipchuk, Lucas De Marchi, Rodrigo Vivi
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <lucas.demarchi@intel.com>
commit a9ab6591b45258b79af1cb66112fd9f83c8855da upstream.
Commit 70fb86a85dc9 ("drm/xe: Revert some changes that break a mesa
debug tool") partially reverted some changes to workaround breakage
caused to mesa tools. However, in doing so it also broke fetching the
GuC log via debugfs since xe_print_blob_ascii85() simply bails out.
The fix is to avoid the extra newlines: the devcoredump interface is
line-oriented and adding random newlines in the middle breaks it. If a
tool is able to parse it by looking at the data and checking for chars
that are out of the ascii85 space, it can still do so. A format change
that breaks the line-oriented output on devcoredump however needs better
coordination with existing tools.
v2: Add suffix description comment
v3: Reword explanation of xe_print_blob_ascii85() calling drm_puts()
in a loop
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Cc: John Harrison <John.C.Harrison@Intel.com>
Cc: Julia Filipchuk <julia.filipchuk@intel.com>
Cc: José Roberto de Souza <jose.souza@intel.com>
Cc: stable@vger.kernel.org
Fixes: 70fb86a85dc9 ("drm/xe: Revert some changes that break a mesa debug tool")
Fixes: ec1455ce7e35 ("drm/xe/devcoredump: Add ASCII85 dump helper function")
Link: https://patchwork.freedesktop.org/patch/msgid/20250123202307.95103-2-jose.souza@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
(cherry picked from commit 2c95bbf5002776117a69caed3b31c10bf7341bec)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_devcoredump.c | 34 +++++++++++++---------------------
drivers/gpu/drm/xe/xe_devcoredump.h | 2 +-
drivers/gpu/drm/xe/xe_guc_ct.c | 3 ++-
drivers/gpu/drm/xe/xe_guc_log.c | 4 +++-
4 files changed, 19 insertions(+), 24 deletions(-)
--- a/drivers/gpu/drm/xe/xe_devcoredump.c
+++ b/drivers/gpu/drm/xe/xe_devcoredump.c
@@ -338,42 +338,34 @@ int xe_devcoredump_init(struct xe_device
/**
* xe_print_blob_ascii85 - print a BLOB to some useful location in ASCII85
*
- * The output is split to multiple lines because some print targets, e.g. dmesg
- * cannot handle arbitrarily long lines. Note also that printing to dmesg in
- * piece-meal fashion is not possible, each separate call to drm_puts() has a
- * line-feed automatically added! Therefore, the entire output line must be
- * constructed in a local buffer first, then printed in one atomic output call.
+ * The output is split into multiple calls to drm_puts() because some print
+ * targets, e.g. dmesg, cannot handle arbitrarily long lines. These targets may
+ * add newlines, as is the case with dmesg: each drm_puts() call creates a
+ * separate line.
*
* There is also a scheduler yield call to prevent the 'task has been stuck for
* 120s' kernel hang check feature from firing when printing to a slow target
* such as dmesg over a serial port.
*
- * TODO: Add compression prior to the ASCII85 encoding to shrink huge buffers down.
- *
* @p: the printer object to output to
* @prefix: optional prefix to add to output string
+ * @suffix: optional suffix to add at the end. 0 disables it and is
+ * not added to the output, which is useful when using multiple calls
+ * to dump data to @p
* @blob: the Binary Large OBject to dump out
* @offset: offset in bytes to skip from the front of the BLOB, must be a multiple of sizeof(u32)
* @size: the size in bytes of the BLOB, must be a multiple of sizeof(u32)
*/
-void xe_print_blob_ascii85(struct drm_printer *p, const char *prefix,
+void xe_print_blob_ascii85(struct drm_printer *p, const char *prefix, char suffix,
const void *blob, size_t offset, size_t size)
{
const u32 *blob32 = (const u32 *)blob;
char buff[ASCII85_BUFSZ], *line_buff;
size_t line_pos = 0;
- /*
- * Splitting blobs across multiple lines is not compatible with the mesa
- * debug decoder tool. Note that even dropping the explicit '\n' below
- * doesn't help because the GuC log is so big some underlying implementation
- * still splits the lines at 512K characters. So just bail completely for
- * the moment.
- */
- return;
-
#define DMESG_MAX_LINE_LEN 800
-#define MIN_SPACE (ASCII85_BUFSZ + 2) /* 85 + "\n\0" */
+ /* Always leave space for the suffix char and the \0 */
+#define MIN_SPACE (ASCII85_BUFSZ + 2) /* 85 + "<suffix>\0" */
if (size & 3)
drm_printf(p, "Size not word aligned: %zu", size);
@@ -405,7 +397,6 @@ void xe_print_blob_ascii85(struct drm_pr
line_pos += strlen(line_buff + line_pos);
if ((line_pos + MIN_SPACE) >= DMESG_MAX_LINE_LEN) {
- line_buff[line_pos++] = '\n';
line_buff[line_pos++] = 0;
drm_puts(p, line_buff);
@@ -417,10 +408,11 @@ void xe_print_blob_ascii85(struct drm_pr
}
}
+ if (suffix)
+ line_buff[line_pos++] = suffix;
+
if (line_pos) {
- line_buff[line_pos++] = '\n';
line_buff[line_pos++] = 0;
-
drm_puts(p, line_buff);
}
--- a/drivers/gpu/drm/xe/xe_devcoredump.h
+++ b/drivers/gpu/drm/xe/xe_devcoredump.h
@@ -26,7 +26,7 @@ static inline int xe_devcoredump_init(st
}
#endif
-void xe_print_blob_ascii85(struct drm_printer *p, const char *prefix,
+void xe_print_blob_ascii85(struct drm_printer *p, const char *prefix, char suffix,
const void *blob, size_t offset, size_t size);
#endif
--- a/drivers/gpu/drm/xe/xe_guc_ct.c
+++ b/drivers/gpu/drm/xe/xe_guc_ct.c
@@ -1700,7 +1700,8 @@ void xe_guc_ct_snapshot_print(struct xe_
snapshot->g2h_outstanding);
if (snapshot->ctb)
- xe_print_blob_ascii85(p, "CTB data", snapshot->ctb, 0, snapshot->ctb_size);
+ xe_print_blob_ascii85(p, "CTB data", '\n',
+ snapshot->ctb, 0, snapshot->ctb_size);
} else {
drm_puts(p, "CT disabled\n");
}
--- a/drivers/gpu/drm/xe/xe_guc_log.c
+++ b/drivers/gpu/drm/xe/xe_guc_log.c
@@ -211,8 +211,10 @@ void xe_guc_log_snapshot_print(struct xe
remain = snapshot->size;
for (i = 0; i < snapshot->num_chunks; i++) {
size_t size = min(GUC_LOG_CHUNK_SIZE, remain);
+ const char *prefix = i ? NULL : "Log data";
+ char suffix = i == snapshot->num_chunks - 1 ? '\n' : 0;
- xe_print_blob_ascii85(p, i ? NULL : "Log data", snapshot->copy[i], 0, size);
+ xe_print_blob_ascii85(p, prefix, suffix, snapshot->copy[i], 0, size);
remain -= size;
}
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 189/443] Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 188/443] drm/xe: Fix and re-enable xe_print_blob_ascii85() Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 190/443] Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection Greg Kroah-Hartman
` (264 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Kuniyuki Iwashima,
Luiz Augusto von Dentz
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
commit 5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1 upstream.
A NULL sock pointer is passed into l2cap_sock_alloc() when it is called
from l2cap_sock_new_connection_cb() and the error handling paths should
also be aware of it.
Seemingly a more elegant solution would be to swap bt_sock_alloc() and
l2cap_chan_create() calls since they are not interdependent to that moment
but then l2cap_chan_create() adds the soon to be deallocated and still
dummy-initialized channel to the global list accessible by many L2CAP
paths. The channel would be removed from the list in short period of time
but be a bit more straight-forward here and just check for NULL instead of
changing the order of function calls.
Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.
Fixes: 7c4f78cdb8e7 ("Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_sock.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1888,7 +1888,8 @@ static struct sock *l2cap_sock_alloc(str
chan = l2cap_chan_create();
if (!chan) {
sk_free(sk);
- sock->sk = NULL;
+ if (sock)
+ sock->sk = NULL;
return NULL;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 190/443] Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 189/443] Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 191/443] KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y Greg Kroah-Hartman
` (263 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin,
Luiz Augusto von Dentz
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
commit 5c61419e02033eaf01733d66e2fcd4044808f482 upstream.
One of the possible ways to enable the input MTU auto-selection for L2CAP
connections is supposed to be through passing a special "0" value for it
as a socket option. Commit [1] added one of those into avdtp. However, it
simply wouldn't work because the kernel still treats the specified value
as invalid and denies the setting attempt. Recorded BlueZ logs include the
following:
bluetoothd[496]: profiles/audio/avdtp.c:l2cap_connect() setsockopt(L2CAP_OPTIONS): Invalid argument (22)
[1]: https://github.com/bluez/bluez/commit/ae5be371a9f53fed33d2b34748a95a5498fd4b77
Found by Linux Verification Center (linuxtesting.org).
Fixes: 4b6e228e297b ("Bluetooth: Auto tune if input MTU is set to 0")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_sock.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -710,12 +710,12 @@ static bool l2cap_valid_mtu(struct l2cap
{
switch (chan->scid) {
case L2CAP_CID_ATT:
- if (mtu < L2CAP_LE_MIN_MTU)
+ if (mtu && mtu < L2CAP_LE_MIN_MTU)
return false;
break;
default:
- if (mtu < L2CAP_DEFAULT_MIN_MTU)
+ if (mtu && mtu < L2CAP_DEFAULT_MIN_MTU)
return false;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 191/443] KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 190/443] Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 192/443] Input: synaptics - fix crash when enabling pass-through port Greg Kroah-Hartman
` (262 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Gstir, Jarkko Sakkinen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Gstir <david@sigma-star.at>
commit e8d9fab39d1f87b52932646b2f1e7877aa3fc0f4 upstream.
With vmalloc stack addresses enabled (CONFIG_VMAP_STACK=y) DCP trusted
keys can crash during en- and decryption of the blob encryption key via
the DCP crypto driver. This is caused by improperly using sg_init_one()
with vmalloc'd stack buffers (plain_key_blob).
Fix this by always using kmalloc() for buffers we give to the DCP crypto
driver.
Cc: stable@vger.kernel.org # v6.10+
Fixes: 0e28bf61a5f9 ("KEYS: trusted: dcp: fix leak of blob encryption key")
Signed-off-by: David Gstir <david@sigma-star.at>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/keys/trusted-keys/trusted_dcp.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
--- a/security/keys/trusted-keys/trusted_dcp.c
+++ b/security/keys/trusted-keys/trusted_dcp.c
@@ -201,12 +201,16 @@ static int trusted_dcp_seal(struct trust
{
struct dcp_blob_fmt *b = (struct dcp_blob_fmt *)p->blob;
int blen, ret;
- u8 plain_blob_key[AES_KEYSIZE_128];
+ u8 *plain_blob_key;
blen = calc_blob_len(p->key_len);
if (blen > MAX_BLOB_SIZE)
return -E2BIG;
+ plain_blob_key = kmalloc(AES_KEYSIZE_128, GFP_KERNEL);
+ if (!plain_blob_key)
+ return -ENOMEM;
+
b->fmt_version = DCP_BLOB_VERSION;
get_random_bytes(b->nonce, AES_KEYSIZE_128);
get_random_bytes(plain_blob_key, AES_KEYSIZE_128);
@@ -229,7 +233,8 @@ static int trusted_dcp_seal(struct trust
ret = 0;
out:
- memzero_explicit(plain_blob_key, sizeof(plain_blob_key));
+ memzero_explicit(plain_blob_key, AES_KEYSIZE_128);
+ kfree(plain_blob_key);
return ret;
}
@@ -238,7 +243,7 @@ static int trusted_dcp_unseal(struct tru
{
struct dcp_blob_fmt *b = (struct dcp_blob_fmt *)p->blob;
int blen, ret;
- u8 plain_blob_key[AES_KEYSIZE_128];
+ u8 *plain_blob_key = NULL;
if (b->fmt_version != DCP_BLOB_VERSION) {
pr_err("DCP blob has bad version: %i, expected %i\n",
@@ -256,6 +261,12 @@ static int trusted_dcp_unseal(struct tru
goto out;
}
+ plain_blob_key = kmalloc(AES_KEYSIZE_128, GFP_KERNEL);
+ if (!plain_blob_key) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
ret = decrypt_blob_key(b->blob_key, plain_blob_key);
if (ret) {
pr_err("Unable to decrypt blob key: %i\n", ret);
@@ -271,7 +282,10 @@ static int trusted_dcp_unseal(struct tru
ret = 0;
out:
- memzero_explicit(plain_blob_key, sizeof(plain_blob_key));
+ if (plain_blob_key) {
+ memzero_explicit(plain_blob_key, AES_KEYSIZE_128);
+ kfree(plain_blob_key);
+ }
return ret;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 192/443] Input: synaptics - fix crash when enabling pass-through port
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 191/443] KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 193/443] clk: sunxi-ng: a100: enable MMC clock reparenting Greg Kroah-Hartman
` (261 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Dmitry Torokhov
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 08bd5b7c9a2401faabdaa1472d45c7de0755fd7e upstream.
When enabling a pass-through port an interrupt might come before psmouse
driver binds to the pass-through port. However synaptics sub-driver
tries to access psmouse instance presumably associated with the
pass-through port to figure out if only 1 byte of response or entire
protocol packet needs to be forwarded to the pass-through port and may
crash if psmouse instance has not been attached to the port yet.
Fix the crash by introducing open() and close() methods for the port and
check if the port is open before trying to access psmouse instance.
Because psmouse calls serio_open() only after attaching psmouse instance
to serio port instance this prevents the potential crash.
Reported-by: Takashi Iwai <tiwai@suse.de>
Fixes: 100e16959c3c ("Input: libps2 - attach ps2dev instances as serio port's drvdata")
Link: https://bugzilla.suse.com/show_bug.cgi?id=1219522
Cc: stable@vger.kernel.org
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/Z4qSHORvPn7EU2j1@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/synaptics.c | 56 ++++++++++++++++++++++++++++++----------
drivers/input/mouse/synaptics.h | 1
2 files changed, 43 insertions(+), 14 deletions(-)
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -665,23 +665,50 @@ static void synaptics_pt_stop(struct ser
priv->pt_port = NULL;
}
+static int synaptics_pt_open(struct serio *serio)
+{
+ struct psmouse *parent = psmouse_from_serio(serio->parent);
+ struct synaptics_data *priv = parent->private;
+
+ guard(serio_pause_rx)(parent->ps2dev.serio);
+ priv->pt_port_open = true;
+
+ return 0;
+}
+
+static void synaptics_pt_close(struct serio *serio)
+{
+ struct psmouse *parent = psmouse_from_serio(serio->parent);
+ struct synaptics_data *priv = parent->private;
+
+ guard(serio_pause_rx)(parent->ps2dev.serio);
+ priv->pt_port_open = false;
+}
+
static int synaptics_is_pt_packet(u8 *buf)
{
return (buf[0] & 0xFC) == 0x84 && (buf[3] & 0xCC) == 0xC4;
}
-static void synaptics_pass_pt_packet(struct serio *ptport, u8 *packet)
+static void synaptics_pass_pt_packet(struct synaptics_data *priv, u8 *packet)
{
- struct psmouse *child = psmouse_from_serio(ptport);
+ struct serio *ptport;
- if (child && child->state == PSMOUSE_ACTIVATED) {
- serio_interrupt(ptport, packet[1], 0);
- serio_interrupt(ptport, packet[4], 0);
- serio_interrupt(ptport, packet[5], 0);
- if (child->pktsize == 4)
- serio_interrupt(ptport, packet[2], 0);
- } else {
- serio_interrupt(ptport, packet[1], 0);
+ ptport = priv->pt_port;
+ if (!ptport)
+ return;
+
+ serio_interrupt(ptport, packet[1], 0);
+
+ if (priv->pt_port_open) {
+ struct psmouse *child = psmouse_from_serio(ptport);
+
+ if (child->state == PSMOUSE_ACTIVATED) {
+ serio_interrupt(ptport, packet[4], 0);
+ serio_interrupt(ptport, packet[5], 0);
+ if (child->pktsize == 4)
+ serio_interrupt(ptport, packet[2], 0);
+ }
}
}
@@ -720,6 +747,8 @@ static void synaptics_pt_create(struct p
serio->write = synaptics_pt_write;
serio->start = synaptics_pt_start;
serio->stop = synaptics_pt_stop;
+ serio->open = synaptics_pt_open;
+ serio->close = synaptics_pt_close;
serio->parent = psmouse->ps2dev.serio;
psmouse->pt_activate = synaptics_pt_activate;
@@ -1216,11 +1245,10 @@ static psmouse_ret_t synaptics_process_b
if (SYN_CAP_PASS_THROUGH(priv->info.capabilities) &&
synaptics_is_pt_packet(psmouse->packet)) {
- if (priv->pt_port)
- synaptics_pass_pt_packet(priv->pt_port,
- psmouse->packet);
- } else
+ synaptics_pass_pt_packet(priv, psmouse->packet);
+ } else {
synaptics_process_packet(psmouse);
+ }
return PSMOUSE_FULL_PACKET;
}
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -188,6 +188,7 @@ struct synaptics_data {
bool disable_gesture; /* disable gestures */
struct serio *pt_port; /* Pass-through serio port */
+ bool pt_port_open;
/*
* Last received Advanced Gesture Mode (AGM) packet. An AGM packet
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 193/443] clk: sunxi-ng: a100: enable MMC clock reparenting
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 192/443] Input: synaptics - fix crash when enabling pass-through port Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:25 ` [PATCH 6.13 194/443] clk: mmp2: call pm_genpd_init() only after genpd.name is set Greg Kroah-Hartman
` (260 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cody Eksal, Andre Przywara,
Chen-Yu Tsai
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cody Eksal <masterr3c0rd@epochal.quest>
commit 16414720045de30945b8d14b7907e0cbf81a4b49 upstream.
While testing the MMC nodes proposed in [1], it was noted that mmc0/1
would fail to initialize, with "mmc: fatal err update clk timeout" in
the kernel logs. A closer look at the clock definitions showed that the MMC
MPs had the "CLK_SET_RATE_NO_REPARENT" flag set. No reason was given for
adding this flag in the first place, and its original purpose is unknown,
but it doesn't seem to make sense and results in severe limitations to MMC
speeds. Thus, remove this flag from the 3 MMC MPs.
[1] https://msgid.link/20241024170540.2721307-10-masterr3c0rd@epochal.quest
Fixes: fb038ce4db55 ("clk: sunxi-ng: add support for the Allwinner A100 CCU")
Cc: stable@vger.kernel.org
Signed-off-by: Cody Eksal <masterr3c0rd@epochal.quest>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Link: https://patch.msgid.link/20241109003739.3440904-1-masterr3c0rd@epochal.quest
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/sunxi-ng/ccu-sun50i-a100.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/clk/sunxi-ng/ccu-sun50i-a100.c
+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a100.c
@@ -436,7 +436,7 @@ static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDI
24, 2, /* mux */
BIT(31), /* gate */
2, /* post-div */
- CLK_SET_RATE_NO_REPARENT);
+ 0);
static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDIV(mmc1_clk, "mmc1", mmc_parents, 0x834,
0, 4, /* M */
@@ -444,7 +444,7 @@ static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDI
24, 2, /* mux */
BIT(31), /* gate */
2, /* post-div */
- CLK_SET_RATE_NO_REPARENT);
+ 0);
static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDIV(mmc2_clk, "mmc2", mmc_parents, 0x838,
0, 4, /* M */
@@ -452,7 +452,7 @@ static SUNXI_CCU_MP_WITH_MUX_GATE_POSTDI
24, 2, /* mux */
BIT(31), /* gate */
2, /* post-div */
- CLK_SET_RATE_NO_REPARENT);
+ 0);
static SUNXI_CCU_GATE(bus_mmc0_clk, "bus-mmc0", "ahb3", 0x84c, BIT(0), 0);
static SUNXI_CCU_GATE(bus_mmc1_clk, "bus-mmc1", "ahb3", 0x84c, BIT(1), 0);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 194/443] clk: mmp2: call pm_genpd_init() only after genpd.name is set
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 193/443] clk: sunxi-ng: a100: enable MMC clock reparenting Greg Kroah-Hartman
@ 2025-02-13 14:25 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 195/443] media: i2c: ds90ub960: Fix UB9702 refclk register access Greg Kroah-Hartman
` (259 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lubomir Rintel, Stephen Boyd
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <lkundrak@v3.sk>
commit e24b15d4704dcb73920c3d18a6157abd18df08c1 upstream.
Setting the genpd's struct device's name with dev_set_name() is
happening within pm_genpd_init(). If it remains NULL, things can blow up
later, such as when crafting the devfs hierarchy for the power domain:
Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read
...
Call trace:
strlen from start_creating+0x90/0x138
start_creating from debugfs_create_dir+0x20/0x178
debugfs_create_dir from genpd_debug_add.part.0+0x4c/0x144
genpd_debug_add.part.0 from genpd_debug_init+0x74/0x90
genpd_debug_init from do_one_initcall+0x5c/0x244
do_one_initcall from kernel_init_freeable+0x19c/0x1f4
kernel_init_freeable from kernel_init+0x1c/0x12c
kernel_init from ret_from_fork+0x14/0x28
Bisecting tracks this crash back to commit 899f44531fe6 ("pmdomain: core:
Add GENPD_FLAG_DEV_NAME_FW flag"), which exchanges use of genpd->name
with dev_name(&genpd->dev) in genpd_debug_add.part().
Fixes: 899f44531fe6 ("pmdomain: core: Add GENPD_FLAG_DEV_NAME_FW flag")
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Cc: stable@vger.kernel.org # v6.12+
Link: https://lore.kernel.org/r/20241231190336.423172-1-lkundrak@v3.sk
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/mmp/pwr-island.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/mmp/pwr-island.c
+++ b/drivers/clk/mmp/pwr-island.c
@@ -106,10 +106,10 @@ struct generic_pm_domain *mmp_pm_domain_
pm_domain->flags = flags;
pm_domain->lock = lock;
- pm_genpd_init(&pm_domain->genpd, NULL, true);
pm_domain->genpd.name = name;
pm_domain->genpd.power_on = mmp_pm_domain_power_on;
pm_domain->genpd.power_off = mmp_pm_domain_power_off;
+ pm_genpd_init(&pm_domain->genpd, NULL, true);
return &pm_domain->genpd;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 195/443] media: i2c: ds90ub960: Fix UB9702 refclk register access
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2025-02-13 14:25 ` [PATCH 6.13 194/443] clk: mmp2: call pm_genpd_init() only after genpd.name is set Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 196/443] clk: clk-loongson2: Fix the number count of clk provider Greg Kroah-Hartman
` (258 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jai Luthra, Tomi Valkeinen,
Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
commit ba3bdb93947c90f098061de1fb2458e2ca040093 upstream.
UB9702 has the refclk freq register at a different offset than UB960,
but the code uses the UB960's offset for both chips. Fix this.
The refclk freq is only used for a debug print, so there's no functional
change here.
Cc: stable@vger.kernel.org
Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver")
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ds90ub960.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/media/i2c/ds90ub960.c
+++ b/drivers/media/i2c/ds90ub960.c
@@ -351,6 +351,8 @@
#define UB960_SR_I2C_RX_ID(n) (0xf8 + (n)) /* < UB960_FPD_RX_NPORTS */
+#define UB9702_SR_REFCLK_FREQ 0x3d
+
/* Indirect register blocks */
#define UB960_IND_TARGET_PAT_GEN 0x00
#define UB960_IND_TARGET_RX_ANA(n) (0x01 + (n))
@@ -3834,7 +3836,10 @@ static int ub960_enable_core_hw(struct u
if (ret)
goto err_pd_gpio;
- ret = ub960_read(priv, UB960_XR_REFCLK_FREQ, &refclk_freq);
+ if (priv->hw_data->is_ub9702)
+ ret = ub960_read(priv, UB9702_SR_REFCLK_FREQ, &refclk_freq);
+ else
+ ret = ub960_read(priv, UB960_XR_REFCLK_FREQ, &refclk_freq);
if (ret)
goto err_pd_gpio;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 196/443] clk: clk-loongson2: Fix the number count of clk provider
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 195/443] media: i2c: ds90ub960: Fix UB9702 refclk register access Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 197/443] clk: qcom: clk-alpha-pll: fix alpha mode configuration Greg Kroah-Hartman
` (257 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gustavo A. R. Silva, Binbin Zhou,
Stephen Boyd
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Binbin Zhou <zhoubinbin@loongson.cn>
commit 5fb33b6797633ce60908d13dc06c54a101621845 upstream.
Since commit 02fb4f008433 ("clk: clk-loongson2: Fix potential buffer
overflow in flexible-array member access"), the clk provider register is
failed.
The count of `clks_num` is shown below:
for (p = data; p->name; p++)
clks_num++;
In fact, `clks_num` represents the number of SoC clocks and should be
expressed as the maximum value of the clock binding id in use (p->id + 1).
Now we fix it to avoid the following error when trying to register a clk
provider:
[ 13.409595] of_clk_hw_onecell_get: invalid index 17
Cc: stable@vger.kernel.org
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Fixes: 02fb4f008433 ("clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access")
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Link: https://lore.kernel.org/r/82e43d89a9a6791129cf8ea14f4eeb666cd87be4.1736856470.git.zhoubinbin@loongson.cn
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/clk-loongson2.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/clk/clk-loongson2.c
+++ b/drivers/clk/clk-loongson2.c
@@ -294,7 +294,7 @@ static int loongson2_clk_probe(struct pl
return -EINVAL;
for (p = data; p->name; p++)
- clks_num++;
+ clks_num = max(clks_num, p->id + 1);
clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num),
GFP_KERNEL);
@@ -309,6 +309,9 @@ static int loongson2_clk_probe(struct pl
clp->clk_data.num = clks_num;
clp->dev = dev;
+ /* Avoid returning NULL for unused id */
+ memset_p((void **)clp->clk_data.hws, ERR_PTR(-ENOENT), clks_num);
+
for (i = 0; i < clks_num; i++) {
p = &data[i];
switch (p->type) {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 197/443] clk: qcom: clk-alpha-pll: fix alpha mode configuration
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 196/443] clk: clk-loongson2: Fix the number count of clk provider Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 198/443] clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable() Greg Kroah-Hartman
` (256 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Dmitry Baryshkov,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <j4g8y7@gmail.com>
commit 33f1722eb86e45320a3dd7b3d42f6593a1d595c2 upstream.
Commit c45ae598fc16 ("clk: qcom: support for alpha mode configuration")
added support for configuring alpha mode, but it seems that the feature
was never working in practice.
The value of the alpha_{en,mode}_mask members of the configuration gets
added to the value parameter passed to the regmap_update_bits() function,
however the same values are not getting applied to the bitmask. As the
result, the respective bits in the USER_CTL register are never modifed
which leads to improper configuration of several PLLs.
The following table shows the PLL configurations where the 'alpha_en_mask'
member is set and which are passed as a parameter for the
clk_alpha_pll_configure() function. In the table the 'expected rate' column
shows the rate the PLL should run at with the given configuration, and
the 'real rate' column shows the rate the PLL runs at actually. The real
rates has been verified on hardwareOn IPQ* platforms, on other platforms,
those are computed values only.
file pll expected rate real rate
dispcc-qcm2290.c disp_cc_pll0 768.0 MHz 768.0 MHz
dispcc-sm6115.c disp_cc_pll0 768.0 MHz 768.0 MHz
gcc-ipq5018.c ubi32_pll 1000.0 MHz != 984.0 MHz
gcc-ipq6018.c nss_crypto_pll 1200.0 MHz 1200.0 MHz
gcc-ipq6018.c ubi32_pll 1497.6 MHz != 1488.0 MHz
gcc-ipq8074.c nss_crypto_pll 1200.0 MHz != 1190.4 MHz
gcc-qcm2290.c gpll11 532.0 MHz != 518.4 MHz
gcc-qcm2290.c gpll8 533.2 MHz != 518.4 MHz
gcc-qcs404.c gpll3 921.6 MHz 921.6 MHz
gcc-sm6115.c gpll11 600.0 MHz != 595.2 MHz
gcc-sm6115.c gpll8 800.0 MHz != 787.2 MHz
gpucc-sdm660.c gpu_cc_pll0 800.0 MHz != 787.2 MHz
gpucc-sdm660.c gpu_cc_pll1 740.0 MHz != 729.6 MHz
gpucc-sm6115.c gpu_cc_pll0 1200.0 MHz != 1190.4 MHz
gpucc-sm6115.c gpu_cc_pll1 640.0 MHz != 633.6 MHz
gpucc-sm6125.c gpu_pll0 1020.0 MHz != 1017.6 MHz
gpucc-sm6125.c gpu_pll1 930.0 MHz != 921.6 MHz
mmcc-sdm660.c mmpll8 930.0 MHz != 921.6 MHz
mmcc-sdm660.c mmpll5 825.0 MHz != 806.4 MHz
As it can be seen from the above, there are several PLLs which are
configured incorrectly.
Change the code to apply both 'alpha_en_mask' and 'alpha_mode_mask'
values to the bitmask in order to configure the alpha mode correctly.
Applying the 'alpha_en_mask' fixes the initial rate of the PLLs showed
in the table above. Since the 'alpha_mode_mask' is not used by any driver
currently, that part of the change causes no functional changes.
Cc: stable@vger.kernel.org
Fixes: c45ae598fc16 ("clk: qcom: support for alpha mode configuration")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://lore.kernel.org/r/20241021-fix-alpha-mode-config-v1-1-f32c254e02bc@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/clk-alpha-pll.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/clk/qcom/clk-alpha-pll.c
+++ b/drivers/clk/qcom/clk-alpha-pll.c
@@ -432,6 +432,8 @@ void clk_alpha_pll_configure(struct clk_
mask |= config->pre_div_mask;
mask |= config->post_div_mask;
mask |= config->vco_mask;
+ mask |= config->alpha_en_mask;
+ mask |= config->alpha_mode_mask;
regmap_update_bits(regmap, PLL_USER_CTL(pll), mask, val);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 198/443] clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 197/443] clk: qcom: clk-alpha-pll: fix alpha mode configuration Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 199/443] clk: qcom: gcc-sm8650: " Greg Kroah-Hartman
` (255 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong,
Manivannan Sadhasivam, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
commit 967e011013eda287dbec9e8bd3a19ebe730b8a08 upstream.
With PWRSTS_OFF_ON, PCIe GDSCs are turned off during gdsc_disable(). This
can happen during scenarios such as system suspend and breaks the resume
of PCIe controllers from suspend.
So use PWRSTS_RET_ON to indicate the GDSC driver to not turn off the GDSCs
during gdsc_disable() and allow the hardware to transition the GDSCs to
retention when the parent domain enters low power state during system
suspend.
Cc: stable@vger.kernel.org # 6.2
Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550")
Reported-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on QRD8550
Link: https://lore.kernel.org/r/20241219170011.70140-1-manivannan.sadhasivam@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-sm8550.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/clk/qcom/gcc-sm8550.c
+++ b/drivers/clk/qcom/gcc-sm8550.c
@@ -3003,7 +3003,7 @@ static struct gdsc pcie_0_gdsc = {
.pd = {
.name = "pcie_0_gdsc",
},
- .pwrsts = PWRSTS_OFF_ON,
+ .pwrsts = PWRSTS_RET_ON,
.flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3014,7 +3014,7 @@ static struct gdsc pcie_0_phy_gdsc = {
.pd = {
.name = "pcie_0_phy_gdsc",
},
- .pwrsts = PWRSTS_OFF_ON,
+ .pwrsts = PWRSTS_RET_ON,
.flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3025,7 +3025,7 @@ static struct gdsc pcie_1_gdsc = {
.pd = {
.name = "pcie_1_gdsc",
},
- .pwrsts = PWRSTS_OFF_ON,
+ .pwrsts = PWRSTS_RET_ON,
.flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
@@ -3036,7 +3036,7 @@ static struct gdsc pcie_1_phy_gdsc = {
.pd = {
.name = "pcie_1_phy_gdsc",
},
- .pwrsts = PWRSTS_OFF_ON,
+ .pwrsts = PWRSTS_RET_ON,
.flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 199/443] clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during gdsc_disable()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 198/443] clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable() Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 200/443] clk: qcom: gcc-sm6350: Add missing parent_map for two clocks Greg Kroah-Hartman
` (254 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong,
Manivannan Sadhasivam, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
commit a57465766a91c6e173876f9cbb424340e214313f upstream.
With PWRSTS_OFF_ON, PCIe GDSCs are turned off during gdsc_disable(). This
can happen during scenarios such as system suspend and breaks the resume
of PCIe controllers from suspend.
So use PWRSTS_RET_ON to indicate the GDSC driver to not turn off the GDSCs
during gdsc_disable() and allow the hardware to transition the GDSCs to
retention when the parent domain enters low power state during system
suspend.
Cc: stable@vger.kernel.org # 6.8
Fixes: c58225b7e3d7 ("clk: qcom: add the SM8650 Global Clock Controller driver, part 1")
Reported-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on QRD8650
Link: https://lore.kernel.org/r/20241219170011.70140-2-manivannan.sadhasivam@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-sm8650.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/clk/qcom/gcc-sm8650.c
+++ b/drivers/clk/qcom/gcc-sm8650.c
@@ -3437,7 +3437,7 @@ static struct gdsc pcie_0_gdsc = {
.pd = {
.name = "pcie_0_gdsc",
},
- .pwrsts = PWRSTS_OFF_ON,
+ .pwrsts = PWRSTS_RET_ON,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE | VOTABLE,
};
@@ -3448,7 +3448,7 @@ static struct gdsc pcie_0_phy_gdsc = {
.pd = {
.name = "pcie_0_phy_gdsc",
},
- .pwrsts = PWRSTS_OFF_ON,
+ .pwrsts = PWRSTS_RET_ON,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE | VOTABLE,
};
@@ -3459,7 +3459,7 @@ static struct gdsc pcie_1_gdsc = {
.pd = {
.name = "pcie_1_gdsc",
},
- .pwrsts = PWRSTS_OFF_ON,
+ .pwrsts = PWRSTS_RET_ON,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE | VOTABLE,
};
@@ -3470,7 +3470,7 @@ static struct gdsc pcie_1_phy_gdsc = {
.pd = {
.name = "pcie_1_phy_gdsc",
},
- .pwrsts = PWRSTS_OFF_ON,
+ .pwrsts = PWRSTS_RET_ON,
.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE | VOTABLE,
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 200/443] clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 199/443] clk: qcom: gcc-sm8650: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 201/443] clk: qcom: dispcc-sm6350: Add missing parent_map for a clock Greg Kroah-Hartman
` (253 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
commit 96fe1a7ee477d701cfc98ab9d3c730c35d966861 upstream.
If a clk_rcg2 has a parent, it should also have parent_map defined,
otherwise we'll get a NULL pointer dereference when calling clk_set_rate
like the following:
[ 3.388105] Call trace:
[ 3.390664] qcom_find_src_index+0x3c/0x70 (P)
[ 3.395301] qcom_find_src_index+0x1c/0x70 (L)
[ 3.399934] _freq_tbl_determine_rate+0x48/0x100
[ 3.404753] clk_rcg2_determine_rate+0x1c/0x28
[ 3.409387] clk_core_determine_round_nolock+0x58/0xe4
[ 3.421414] clk_core_round_rate_nolock+0x48/0xfc
[ 3.432974] clk_core_round_rate_nolock+0xd0/0xfc
[ 3.444483] clk_core_set_rate_nolock+0x8c/0x300
[ 3.455886] clk_set_rate+0x38/0x14c
Add the parent_map property for two clocks where it's missing and also
un-inline the parent_data as well to keep the matching parent_map and
parent_data together.
Fixes: 131abae905df ("clk: qcom: Add SM6350 GCC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241220-sm6350-parent_map-v1-1-64f3d04cb2eb@fairphone.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-sm6350.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
--- a/drivers/clk/qcom/gcc-sm6350.c
+++ b/drivers/clk/qcom/gcc-sm6350.c
@@ -182,6 +182,14 @@ static const struct clk_parent_data gcc_
{ .hw = &gpll0_out_odd.clkr.hw },
};
+static const struct parent_map gcc_parent_map_3[] = {
+ { P_BI_TCXO, 0 },
+};
+
+static const struct clk_parent_data gcc_parent_data_3[] = {
+ { .fw_name = "bi_tcxo" },
+};
+
static const struct parent_map gcc_parent_map_4[] = {
{ P_BI_TCXO, 0 },
{ P_GPLL0_OUT_MAIN, 1 },
@@ -701,13 +709,12 @@ static struct clk_rcg2 gcc_ufs_phy_phy_a
.cmd_rcgr = 0x3a0b0,
.mnd_width = 0,
.hid_width = 5,
+ .parent_map = gcc_parent_map_3,
.freq_tbl = ftbl_gcc_ufs_phy_phy_aux_clk_src,
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_phy_aux_clk_src",
- .parent_data = &(const struct clk_parent_data){
- .fw_name = "bi_tcxo",
- },
- .num_parents = 1,
+ .parent_data = gcc_parent_data_3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_3),
.ops = &clk_rcg2_ops,
},
};
@@ -764,13 +771,12 @@ static struct clk_rcg2 gcc_usb30_prim_mo
.cmd_rcgr = 0x1a034,
.mnd_width = 0,
.hid_width = 5,
+ .parent_map = gcc_parent_map_3,
.freq_tbl = ftbl_gcc_usb30_prim_mock_utmi_clk_src,
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb30_prim_mock_utmi_clk_src",
- .parent_data = &(const struct clk_parent_data){
- .fw_name = "bi_tcxo",
- },
- .num_parents = 1,
+ .parent_data = gcc_parent_data_3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_3),
.ops = &clk_rcg2_ops,
},
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 201/443] clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 200/443] clk: qcom: gcc-sm6350: Add missing parent_map for two clocks Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 202/443] clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg Greg Kroah-Hartman
` (252 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
commit d4cdb196f182d2fbe336c968228be00d8c3fed05 upstream.
If a clk_rcg2 has a parent, it should also have parent_map defined,
otherwise we'll get a NULL pointer dereference when calling clk_set_rate
like the following:
[ 3.388105] Call trace:
[ 3.390664] qcom_find_src_index+0x3c/0x70 (P)
[ 3.395301] qcom_find_src_index+0x1c/0x70 (L)
[ 3.399934] _freq_tbl_determine_rate+0x48/0x100
[ 3.404753] clk_rcg2_determine_rate+0x1c/0x28
[ 3.409387] clk_core_determine_round_nolock+0x58/0xe4
[ 3.421414] clk_core_round_rate_nolock+0x48/0xfc
[ 3.432974] clk_core_round_rate_nolock+0xd0/0xfc
[ 3.444483] clk_core_set_rate_nolock+0x8c/0x300
[ 3.455886] clk_set_rate+0x38/0x14c
Add the parent_map property for the clock where it's missing and also
un-inline the parent_data as well to keep the matching parent_map and
parent_data together.
Fixes: 837519775f1d ("clk: qcom: Add display clock controller driver for SM6350")
Cc: stable@vger.kernel.org
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241220-sm6350-parent_map-v1-2-64f3d04cb2eb@fairphone.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/dispcc-sm6350.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/clk/qcom/dispcc-sm6350.c
+++ b/drivers/clk/qcom/dispcc-sm6350.c
@@ -187,13 +187,12 @@ static struct clk_rcg2 disp_cc_mdss_dp_a
.cmd_rcgr = 0x1144,
.mnd_width = 0,
.hid_width = 5,
+ .parent_map = disp_cc_parent_map_6,
.freq_tbl = ftbl_disp_cc_mdss_dp_aux_clk_src,
.clkr.hw.init = &(struct clk_init_data){
.name = "disp_cc_mdss_dp_aux_clk_src",
- .parent_data = &(const struct clk_parent_data){
- .fw_name = "bi_tcxo",
- },
- .num_parents = 1,
+ .parent_data = disp_cc_parent_data_6,
+ .num_parents = ARRAY_SIZE(disp_cc_parent_data_6),
.ops = &clk_rcg2_ops,
},
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 202/443] clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 201/443] clk: qcom: dispcc-sm6350: Add missing parent_map for a clock Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 203/443] clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate Greg Kroah-Hartman
` (251 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Satya Priya Kakitapalli,
Konrad Dybcio, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
commit 88d9dca36aac9659446be1e569d8fbe3462b5741 upstream.
Fix cmd_rcgr offset for blsp1_uart6_apps_clk_src on mdm9607 platform.
Fixes: 48b7253264ea ("clk: qcom: Add MDM9607 GCC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241220095048.248425-1-quic_skakitap@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-mdm9607.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/qcom/gcc-mdm9607.c
+++ b/drivers/clk/qcom/gcc-mdm9607.c
@@ -535,7 +535,7 @@ static struct clk_rcg2 blsp1_uart5_apps_
};
static struct clk_rcg2 blsp1_uart6_apps_clk_src = {
- .cmd_rcgr = 0x6044,
+ .cmd_rcgr = 0x7044,
.mnd_width = 16,
.hid_width = 5,
.parent_map = gcc_xo_gpll0_map,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 203/443] clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 202/443] clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 204/443] clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe Greg Kroah-Hartman
` (250 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Anastasia Belova, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anastasia Belova <abelova@astralinux.ru>
commit 89aa5925d201b90a48416784831916ca203658f9 upstream.
aggr_state and unit fields are u32. The result of their
multiplication may not fit in this type.
Add explicit casting to prevent overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 04053f4d23a4 ("clk: qcom: clk-rpmh: Add IPA clock support")
Cc: stable@vger.kernel.org # 5.4+
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Link: https://lore.kernel.org/r/20241203084231.6001-1-abelova@astralinux.ru
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/clk-rpmh.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/qcom/clk-rpmh.c
+++ b/drivers/clk/qcom/clk-rpmh.c
@@ -329,7 +329,7 @@ static unsigned long clk_rpmh_bcm_recalc
{
struct clk_rpmh *c = to_clk_rpmh(hw);
- return c->aggr_state * c->unit;
+ return (unsigned long)c->aggr_state * c->unit;
}
static const struct clk_ops clk_rpmh_bcm_ops = {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 204/443] clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 203/443] clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 205/443] clk: mediatek: mt2701-aud: " Greg Kroah-Hartman
` (249 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Golle,
AngeloGioacchino Del Regno, Stephen Boyd
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <daniel@makrotopia.org>
commit 7c8746126a4e256fcf1af9174ee7d92cc3f3bc31 upstream.
Commit 973d1607d936 ("clk: mediatek: mt2701: use mtk_clk_simple_probe to
simplify driver") broke DT bindings as the highest index was reduced by
1 because the id count starts from 1 and not from 0.
Fix this, like for other drivers which had the same issue, by adding a
dummy clk at index 0.
Fixes: 973d1607d936 ("clk: mediatek: mt2701: use mtk_clk_simple_probe to simplify driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://lore.kernel.org/r/b126a5577f3667ef19b1b5feea5e70174084fb03.1734300668.git.daniel@makrotopia.org
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/mediatek/clk-mt2701-vdec.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/clk/mediatek/clk-mt2701-vdec.c
+++ b/drivers/clk/mediatek/clk-mt2701-vdec.c
@@ -31,6 +31,7 @@ static const struct mtk_gate_regs vdec1_
GATE_MTK(_id, _name, _parent, &vdec1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
static const struct mtk_gate vdec_clks[] = {
+ GATE_DUMMY(CLK_DUMMY, "vdec_dummy"),
GATE_VDEC0(CLK_VDEC_CKGEN, "vdec_cken", "vdec_sel", 0),
GATE_VDEC1(CLK_VDEC_LARB, "vdec_larb_cken", "mm_sel", 0),
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 205/443] clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 204/443] clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 206/443] clk: mediatek: mt2701-bdp: add missing dummy clk Greg Kroah-Hartman
` (248 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Golle,
AngeloGioacchino Del Regno, Stephen Boyd
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <daniel@makrotopia.org>
commit 5fba40be5fbad563914e3ce9d5129a6baaea1ff5 upstream.
Some of the audio subsystem clocks defined in clk-mt2701.h aren't
actually used by the driver. This broke conversion to
mtk_clk_simple_probe which expects that the highest possible clk id is
defined by the ARRAY_SIZE.
Add additional dummy clocks to fill the gaps and remain compatible with
the existing DT bindings.
Fixes: 0f69a423c458 ("clk: mediatek: Switch to mtk_clk_simple_probe() where possible")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://lore.kernel.org/r/a07584d803af57b9ce4b5df5e122c09bf5a56ac9.1734300668.git.daniel@makrotopia.org
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/mediatek/clk-mt2701-aud.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/clk/mediatek/clk-mt2701-aud.c
+++ b/drivers/clk/mediatek/clk-mt2701-aud.c
@@ -55,10 +55,16 @@ static const struct mtk_gate audio_clks[
GATE_DUMMY(CLK_DUMMY, "aud_dummy"),
/* AUDIO0 */
GATE_AUDIO0(CLK_AUD_AFE, "audio_afe", "aud_intbus_sel", 2),
+ GATE_DUMMY(CLK_AUD_LRCK_DETECT, "audio_lrck_detect_dummy"),
+ GATE_DUMMY(CLK_AUD_I2S, "audio_i2c_dummy"),
+ GATE_DUMMY(CLK_AUD_APLL_TUNER, "audio_apll_tuner_dummy"),
GATE_AUDIO0(CLK_AUD_HDMI, "audio_hdmi", "audpll_sel", 20),
GATE_AUDIO0(CLK_AUD_SPDF, "audio_spdf", "audpll_sel", 21),
GATE_AUDIO0(CLK_AUD_SPDF2, "audio_spdf2", "audpll_sel", 22),
GATE_AUDIO0(CLK_AUD_APLL, "audio_apll", "audpll_sel", 23),
+ GATE_DUMMY(CLK_AUD_TML, "audio_tml_dummy"),
+ GATE_DUMMY(CLK_AUD_AHB_IDLE_EXT, "audio_ahb_idle_ext_dummy"),
+ GATE_DUMMY(CLK_AUD_AHB_IDLE_INT, "audio_ahb_idle_int_dummy"),
/* AUDIO1 */
GATE_AUDIO1(CLK_AUD_I2SIN1, "audio_i2sin1", "aud_mux1_sel", 0),
GATE_AUDIO1(CLK_AUD_I2SIN2, "audio_i2sin2", "aud_mux1_sel", 1),
@@ -76,10 +82,12 @@ static const struct mtk_gate audio_clks[
GATE_AUDIO1(CLK_AUD_ASRCI2, "audio_asrci2", "asm_h_sel", 13),
GATE_AUDIO1(CLK_AUD_ASRCO1, "audio_asrco1", "asm_h_sel", 14),
GATE_AUDIO1(CLK_AUD_ASRCO2, "audio_asrco2", "asm_h_sel", 15),
+ GATE_DUMMY(CLK_AUD_HDMIRX, "audio_hdmirx_dummy"),
GATE_AUDIO1(CLK_AUD_INTDIR, "audio_intdir", "intdir_sel", 20),
GATE_AUDIO1(CLK_AUD_A1SYS, "audio_a1sys", "aud_mux1_sel", 21),
GATE_AUDIO1(CLK_AUD_A2SYS, "audio_a2sys", "aud_mux2_sel", 22),
GATE_AUDIO1(CLK_AUD_AFE_CONN, "audio_afe_conn", "aud_mux1_sel", 23),
+ GATE_DUMMY(CLK_AUD_AFE_PCMIF, "audio_afe_pcmif_dummy"),
GATE_AUDIO1(CLK_AUD_AFE_MRGIF, "audio_afe_mrgif", "aud_mux1_sel", 25),
/* AUDIO2 */
GATE_AUDIO2(CLK_AUD_MMIF_UL1, "audio_ul1", "aud_mux1_sel", 0),
@@ -100,6 +108,8 @@ static const struct mtk_gate audio_clks[
GATE_AUDIO2(CLK_AUD_MMIF_AWB2, "audio_awb2", "aud_mux1_sel", 15),
GATE_AUDIO2(CLK_AUD_MMIF_DAI, "audio_dai", "aud_mux1_sel", 16),
/* AUDIO3 */
+ GATE_DUMMY(CLK_AUD_DMIC1, "audio_dmic1_dummy"),
+ GATE_DUMMY(CLK_AUD_DMIC2, "audio_dmic2_dummy"),
GATE_AUDIO3(CLK_AUD_ASRCI3, "audio_asrci3", "asm_h_sel", 2),
GATE_AUDIO3(CLK_AUD_ASRCI4, "audio_asrci4", "asm_h_sel", 3),
GATE_AUDIO3(CLK_AUD_ASRCI5, "audio_asrci5", "asm_h_sel", 4),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 206/443] clk: mediatek: mt2701-bdp: add missing dummy clk
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 205/443] clk: mediatek: mt2701-aud: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 207/443] clk: mediatek: mt2701-img: " Greg Kroah-Hartman
` (247 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Golle,
AngeloGioacchino Del Regno, Stephen Boyd
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <daniel@makrotopia.org>
commit fd291adc5e9a4ee6cd91e57f148f3b427f80647b upstream.
Add dummy clk for index 0 which was missed during the conversion to
mtk_clk_simple_probe().
Fixes: 973d1607d936 ("clk: mediatek: mt2701: use mtk_clk_simple_probe to simplify driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://lore.kernel.org/r/b8526c882a50f2b158df0eccb4a165956fd8fa13.1734300668.git.daniel@makrotopia.org
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/mediatek/clk-mt2701-bdp.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/clk/mediatek/clk-mt2701-bdp.c
+++ b/drivers/clk/mediatek/clk-mt2701-bdp.c
@@ -31,6 +31,7 @@ static const struct mtk_gate_regs bdp1_c
GATE_MTK(_id, _name, _parent, &bdp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr_inv)
static const struct mtk_gate bdp_clks[] = {
+ GATE_DUMMY(CLK_DUMMY, "bdp_dummy"),
GATE_BDP0(CLK_BDP_BRG_BA, "brg_baclk", "mm_sel", 0),
GATE_BDP0(CLK_BDP_BRG_DRAM, "brg_dram", "mm_sel", 1),
GATE_BDP0(CLK_BDP_LARB_DRAM, "larb_dram", "mm_sel", 2),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 207/443] clk: mediatek: mt2701-img: add missing dummy clk
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 206/443] clk: mediatek: mt2701-bdp: add missing dummy clk Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 208/443] clk: mediatek: mt2701-mm: " Greg Kroah-Hartman
` (246 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Golle,
AngeloGioacchino Del Regno, Stephen Boyd
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <daniel@makrotopia.org>
commit 366640868ccb4a7991aebe8442b01340fab218e2 upstream.
Add dummy clk for index 0 which was missed during the conversion to
mtk_clk_simple_probe().
Fixes: 973d1607d936 ("clk: mediatek: mt2701: use mtk_clk_simple_probe to simplify driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://lore.kernel.org/r/d677486a5c563fe5c47aa995841adc2aaa183b8a.1734300668.git.daniel@makrotopia.org
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/mediatek/clk-mt2701-img.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/clk/mediatek/clk-mt2701-img.c
+++ b/drivers/clk/mediatek/clk-mt2701-img.c
@@ -22,6 +22,7 @@ static const struct mtk_gate_regs img_cg
GATE_MTK(_id, _name, _parent, &img_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
static const struct mtk_gate img_clks[] = {
+ GATE_DUMMY(CLK_DUMMY, "img_dummy"),
GATE_IMG(CLK_IMG_SMI_COMM, "img_smi_comm", "mm_sel", 0),
GATE_IMG(CLK_IMG_RESZ, "img_resz", "mm_sel", 1),
GATE_IMG(CLK_IMG_JPGDEC_SMI, "img_jpgdec_smi", "mm_sel", 5),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 208/443] clk: mediatek: mt2701-mm: add missing dummy clk
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 207/443] clk: mediatek: mt2701-img: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 209/443] seccomp: passthrough uretprobe systemcall without filtering Greg Kroah-Hartman
` (245 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Golle,
AngeloGioacchino Del Regno, Stephen Boyd
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <daniel@makrotopia.org>
commit 67aea188f23a5dde51c31a720ccf66aed0ce4187 upstream.
Add dummy clk which was missed during the conversion to
mtk_clk_pdev_probe() and is required for the existing DT bindings to
keep working.
Fixes: 65c10c50c9c7 ("clk: mediatek: Migrate to mtk_clk_pdev_probe() for multimedia clocks")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://lore.kernel.org/r/9de23440fcba1ffef9e77d58c9f505105e57a250.1734300668.git.daniel@makrotopia.org
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/mediatek/clk-mt2701-mm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/clk/mediatek/clk-mt2701-mm.c
+++ b/drivers/clk/mediatek/clk-mt2701-mm.c
@@ -31,6 +31,7 @@ static const struct mtk_gate_regs disp1_
GATE_MTK(_id, _name, _parent, &disp1_cg_regs, _shift, &mtk_clk_gate_ops_setclr)
static const struct mtk_gate mm_clks[] = {
+ GATE_DUMMY(CLK_DUMMY, "mm_dummy"),
GATE_DISP0(CLK_MM_SMI_COMMON, "mm_smi_comm", "mm_sel", 0),
GATE_DISP0(CLK_MM_SMI_LARB0, "mm_smi_larb0", "mm_sel", 1),
GATE_DISP0(CLK_MM_CMDQ, "mm_cmdq", "mm_sel", 2),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 209/443] seccomp: passthrough uretprobe systemcall without filtering
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 208/443] clk: mediatek: mt2701-mm: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 210/443] blk-cgroup: Fix class @block_classs subsystem refcount leakage Greg Kroah-Hartman
` (244 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael Buchbinder, Eyal Birger,
Kees Cook
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Birger <eyal.birger@gmail.com>
commit cf6cb56ef24410fb5308f9655087f1eddf4452e6 upstream.
When attaching uretprobes to processes running inside docker, the attached
process is segfaulted when encountering the retprobe.
The reason is that now that uretprobe is a system call the default seccomp
filters in docker block it as they only allow a specific set of known
syscalls. This is true for other userspace applications which use seccomp
to control their syscall surface.
Since uretprobe is a "kernel implementation detail" system call which is
not used by userspace application code directly, it is impractical and
there's very little point in forcing all userspace applications to
explicitly allow it in order to avoid crashing tracked processes.
Pass this systemcall through seccomp without depending on configuration.
Note: uretprobe is currently only x86_64 and isn't expected to ever be
supported in i386.
Fixes: ff474a78cef5 ("uprobe: Add uretprobe syscall to speed up return probe")
Reported-by: Rafael Buchbinder <rafi@rbk.io>
Closes: https://lore.kernel.org/lkml/CAHsH6Gs3Eh8DFU0wq58c_LF8A4_+o6z456J7BidmcVY2AqOnHQ@mail.gmail.com/
Link: https://lore.kernel.org/lkml/20250121182939.33d05470@gandalf.local.home/T/#me2676c378eff2d6a33f3054fed4a5f3afa64e65b
Link: https://lore.kernel.org/lkml/20250128145806.1849977-1-eyal.birger@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
Link: https://lore.kernel.org/r/20250202162921.335813-2-eyal.birger@gmail.com
[kees: minimized changes for easier backporting, tweaked commit log]
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/seccomp.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -749,6 +749,15 @@ static bool seccomp_is_const_allow(struc
if (WARN_ON_ONCE(!fprog))
return false;
+ /* Our single exception to filtering. */
+#ifdef __NR_uretprobe
+#ifdef SECCOMP_ARCH_COMPAT
+ if (sd->arch == SECCOMP_ARCH_NATIVE)
+#endif
+ if (sd->nr == __NR_uretprobe)
+ return true;
+#endif
+
for (pc = 0; pc < fprog->len; pc++) {
struct sock_filter *insn = &fprog->filter[pc];
u16 code = insn->code;
@@ -1023,6 +1032,9 @@ static inline void seccomp_log(unsigned
*/
static const int mode1_syscalls[] = {
__NR_seccomp_read, __NR_seccomp_write, __NR_seccomp_exit, __NR_seccomp_sigreturn,
+#ifdef __NR_uretprobe
+ __NR_uretprobe,
+#endif
-1, /* negative terminated */
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 210/443] blk-cgroup: Fix class @block_classs subsystem refcount leakage
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 209/443] seccomp: passthrough uretprobe systemcall without filtering Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 211/443] efi: libstub: Use -std=gnu11 to fix build with GCC 15 Greg Kroah-Hartman
` (243 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michal Koutný, Tejun Heo,
Zijun Hu
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <quic_zijuhu@quicinc.com>
commit d1248436cbef1f924c04255367ff4845ccd9025e upstream.
blkcg_fill_root_iostats() iterates over @block_class's devices by
class_dev_iter_(init|next)(), but does not end iterating with
class_dev_iter_exit(), so causes the class's subsystem refcount leakage.
Fix by ending the iterating with class_dev_iter_exit().
Fixes: ef45fe470e1e ("blk-cgroup: show global disk stats in root cgroup io.stat")
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20250105-class_fix-v6-2-3a2f1768d4d4@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-cgroup.c | 1 +
1 file changed, 1 insertion(+)
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1138,6 +1138,7 @@ static void blkcg_fill_root_iostats(void
blkg_iostat_set(&blkg->iostat.cur, &tmp);
u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags);
}
+ class_dev_iter_exit(&iter);
}
static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 211/443] efi: libstub: Use -std=gnu11 to fix build with GCC 15
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 210/443] blk-cgroup: Fix class @block_classs subsystem refcount leakage Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 212/443] x86/efi: skip memattr table on kexec boot Greg Kroah-Hartman
` (242 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kostadin Shishmanov, Jakub Jelinek,
Nathan Chancellor, Ard Biesheuvel
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit 8ba14d9f490aef9fd535c04e9e62e1169eb7a055 upstream.
GCC 15 changed the default C standard version to C23, which should not
have impacted the kernel because it requests the gnu11 standard via
'-std=' in the main Makefile. However, the EFI libstub Makefile uses its
own set of KBUILD_CFLAGS for x86 without a '-std=' value (i.e., using
the default), resulting in errors from the kernel's definitions of bool,
true, and false in stddef.h, which are reserved keywords under C23.
./include/linux/stddef.h:11:9: error: expected identifier before ‘false’
11 | false = 0,
./include/linux/types.h:35:33: error: two or more data types in declaration specifiers
35 | typedef _Bool bool;
Set '-std=gnu11' in the x86 cflags to resolve the error and consistently
use the same C standard version for the entire kernel. All other
architectures reuse KBUILD_CFLAGS from the rest of the kernel, so this
issue is not visible for them.
Cc: stable@vger.kernel.org
Reported-by: Kostadin Shishmanov <kostadinshishmanov@protonmail.com>
Closes: https://lore.kernel.org/4OAhbllK7x4QJGpZjkYjtBYNLd_2whHx9oFiuZcGwtVR4hIzvduultkgfAIRZI3vQpZylu7Gl929HaYFRGeMEalWCpeMzCIIhLxxRhq4U-Y=@protonmail.com/
Reported-by: Jakub Jelinek <jakub@redhat.com>
Closes: https://lore.kernel.org/Z4467umXR2PZ0M1H@tucnak/
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efi/libstub/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -11,7 +11,7 @@ cflags-y := $(KBUILD_CFLAGS)
cflags-$(CONFIG_X86_32) := -march=i386
cflags-$(CONFIG_X86_64) := -mcmodel=small
-cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ \
+cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu11 \
-fPIC -fno-strict-aliasing -mno-red-zone \
-mno-mmx -mno-sse -fshort-wchar \
-Wno-pointer-sign \
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 212/443] x86/efi: skip memattr table on kexec boot
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 211/443] efi: libstub: Use -std=gnu11 to fix build with GCC 15 Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 213/443] perf bench: Fix undefined behavior in cmpworker() Greg Kroah-Hartman
` (241 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Ard Biesheuvel,
Dave Young, Usama Arif
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Young <dyoung@redhat.com>
commit 64b45dd46e154ee7641d7e0457f3fa266e57179f upstream.
efi_memattr_init() added a sanity check to avoid firmware caused corruption.
The check is based on efi memmap entry numbers, but kexec only takes the
runtime related memmap entries thus this caused many false warnings, see
below thread for details:
https://lore.kernel.org/all/20250108215957.3437660-2-usamaarif642@gmail.com/
Ard suggests to skip the efi memattr table in kexec, this makes sense because
those memattr fixups are not critical.
Fixes: 8fbe4c49c0cc ("efi/memattr: Ignore table if the size is clearly bogus")
Cc: <stable@vger.kernel.org> # v6.13+
Reported-by: Breno Leitao <leitao@debian.org>
Reported-and-tested-by: Usama Arif <usamaarif642@gmail.com>
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Dave Young <dyoung@redhat.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/platform/efi/quirks.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 846bf49f2508..553f330198f2 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -561,6 +561,11 @@ int __init efi_reuse_config(u64 tables, int nr_tables)
if (!efi_guidcmp(guid, SMBIOS_TABLE_GUID))
((efi_config_table_64_t *)p)->table = data->smbios;
+
+ /* Do not bother to play with mem attr table across kexec */
+ if (!efi_guidcmp(guid, EFI_MEMORY_ATTRIBUTES_TABLE_GUID))
+ ((efi_config_table_64_t *)p)->table = EFI_INVALID_TABLE_ADDR;
+
p += sz;
}
early_memunmap(tablep, nr_tables * sz);
--
2.48.1
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 213/443] perf bench: Fix undefined behavior in cmpworker()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 212/443] x86/efi: skip memattr table on kexec boot Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 214/443] scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions Greg Kroah-Hartman
` (240 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuan-Wei Chiu, James Clark,
Namhyung Kim
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <visitorckw@gmail.com>
commit 62892e77b8a64b9dc0e1da75980aa145347b6820 upstream.
The comparison function cmpworker() violates the C standard's
requirements for qsort() comparison functions, which mandate symmetry
and transitivity:
Symmetry: If x < y, then y > x.
Transitivity: If x < y and y < z, then x < z.
In its current implementation, cmpworker() incorrectly returns 0 when
w1->tid < w2->tid, which breaks both symmetry and transitivity. This
violation causes undefined behavior, potentially leading to issues such
as memory corruption in glibc [1].
Fix the issue by returning -1 when w1->tid < w2->tid, ensuring
compliance with the C standard and preventing undefined behavior.
Link: https://www.qualys.com/2024/01/30/qsort.txt [1]
Fixes: 121dd9ea0116 ("perf bench: Add epoll parallel epoll_wait benchmark")
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Link: https://lore.kernel.org/r/20250116110842.4087530-1-visitorckw@gmail.com
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/bench/epoll-wait.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/tools/perf/bench/epoll-wait.c
+++ b/tools/perf/bench/epoll-wait.c
@@ -420,7 +420,12 @@ static int cmpworker(const void *p1, con
struct worker *w1 = (struct worker *) p1;
struct worker *w2 = (struct worker *) p2;
- return w1->tid > w2->tid;
+
+ if (w1->tid > w2->tid)
+ return 1;
+ if (w1->tid < w2->tid)
+ return -1;
+ return 0;
}
int bench_epoll_wait(int argc, const char **argv)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 214/443] scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 213/443] perf bench: Fix undefined behavior in cmpworker() Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 215/443] of: Correct child specifier used as input of the 2nd nexus node Greg Kroah-Hartman
` (239 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bao D. Nguyen, Avri Altman,
Peter Wang, Martin K. Petersen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bao D. Nguyen <quic_nguyenb@quicinc.com>
commit 1b3e2d4ec0c5848776cc56d2624998aa5b2f0d27 upstream.
According to the UFS Device Specification, the dExtendedUFSFeaturesSupport
defines the support for TOO_HIGH_TEMPERATURE as bit[4] and the
TOO_LOW_TEMPERATURE as bit[5]. Correct the code to match with
the UFS device specification definition.
Cc: stable@vger.kernel.org
Fixes: e88e2d32200a ("scsi: ufs: core: Probe for temperature notification support")
Signed-off-by: Bao D. Nguyen <quic_nguyenb@quicinc.com>
Link: https://lore.kernel.org/r/69992b3e3e3434a5c7643be5a64de48be892ca46.1736793068.git.quic_nguyenb@quicinc.com
Reviewed-by: Avri Altman <Avri.Altman@wdc.com>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/ufs/ufs.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/include/ufs/ufs.h
+++ b/include/ufs/ufs.h
@@ -386,8 +386,8 @@ enum {
/* Possible values for dExtendedUFSFeaturesSupport */
enum {
- UFS_DEV_LOW_TEMP_NOTIF = BIT(4),
- UFS_DEV_HIGH_TEMP_NOTIF = BIT(5),
+ UFS_DEV_HIGH_TEMP_NOTIF = BIT(4),
+ UFS_DEV_LOW_TEMP_NOTIF = BIT(5),
UFS_DEV_EXT_TEMP_NOTIF = BIT(6),
UFS_DEV_HPB_SUPPORT = BIT(7),
UFS_DEV_WRITE_BOOSTER_SUP = BIT(8),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 215/443] of: Correct child specifier used as input of the 2nd nexus node
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 214/443] scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 216/443] of: address: Fix empty resource handling in __of_address_resource_bounds() Greg Kroah-Hartman
` (238 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zijun Hu, Rob Herring (Arm)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <quic_zijuhu@quicinc.com>
commit e4c00c9b1f70cd11792ff5b825899a6ee0234a62 upstream.
API of_parse_phandle_with_args_map() will use wrong input for nexus node
Nexus_2 as shown below:
Node_1 Nexus_1 Nexus_2
&Nexus_1,arg_1 -> arg_1,&Nexus_2,arg_2' -> &Nexus_2,arg_2 -> arg_2,...
map-pass-thru=<...>
Nexus_1's output arg_2 should be used as input of Nexus_2, but the API
wrongly uses arg_2' instead which != arg_2 due to Nexus_1's map-pass-thru.
Fix by always making @match_array point to @initial_match_array into
which to store nexus output.
Fixes: bd6f2fd5a1d5 ("of: Support parsing phandle argument lists through a nexus node")
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-1-db8a72415b8c@quicinc.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1546,7 +1546,6 @@ int of_parse_phandle_with_args_map(const
* specifier into the out_args structure, keeping the
* bits specified in <list>-map-pass-thru.
*/
- match_array = map - new_size;
for (i = 0; i < new_size; i++) {
__be32 val = *(map - new_size + i);
@@ -1555,6 +1554,7 @@ int of_parse_phandle_with_args_map(const
val |= cpu_to_be32(out_args->args[i]) & pass[i];
}
+ initial_match_array[i] = val;
out_args->args[i] = be32_to_cpu(val);
}
out_args->args_count = list_size = new_size;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 216/443] of: address: Fix empty resource handling in __of_address_resource_bounds()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 215/443] of: Correct child specifier used as input of the 2nd nexus node Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 217/443] of: Fix of_find_node_opts_by_path() handling of alias+path+options Greg Kroah-Hartman
` (237 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Basharath Hussain Khaja,
Thomas Weißschuh, Rob Herring (Arm)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
commit 15e2f65f2ecfeb8e39315522e2b5cfdc5651fc10 upstream.
"resource->end" needs to always be equal to "resource->start + size - 1".
The previous version of the function did not perform the "- 1" in case
of an empty resource.
Also make sure to allow an empty resource at address 0.
Reported-by: Basharath Hussain Khaja <basharath@couthit.com>
Closes: https://lore.kernel.org/lkml/20250108140414.13530-1-basharath@couthit.com/
Fixes: 1a52a094c2f0 ("of: address: Unify resource bounds overflow checking")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://lore.kernel.org/r/20250120-of-address-overflow-v1-1-dd68dbf47bce@linutronix.de
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/address.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -200,17 +200,15 @@ static u64 of_bus_pci_map(__be32 *addr,
static int __of_address_resource_bounds(struct resource *r, u64 start, u64 size)
{
- u64 end = start;
-
if (overflows_type(start, r->start))
return -EOVERFLOW;
- if (size && check_add_overflow(end, size - 1, &end))
- return -EOVERFLOW;
- if (overflows_type(end, r->end))
- return -EOVERFLOW;
r->start = start;
- r->end = end;
+
+ if (!size)
+ r->end = wrapping_sub(typeof(r->end), r->start, 1);
+ else if (size && check_add_overflow(r->start, size - 1, &r->end))
+ return -EOVERFLOW;
return 0;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 217/443] of: Fix of_find_node_opts_by_path() handling of alias+path+options
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 216/443] of: address: Fix empty resource handling in __of_address_resource_bounds() Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 218/443] of: reserved-memory: Fix using wrong number of cells to get property alignment Greg Kroah-Hartman
` (236 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zijun Hu, Rob Herring (Arm)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <quic_zijuhu@quicinc.com>
commit b9e58c934c56aa35b0fb436d9afd86ef326bae0e upstream.
of_find_node_opts_by_path() fails to find OF device node when its
@path parameter have pattern below:
"alias-name/node-name-1/.../node-name-N:options".
The reason is that alias name length calculated by the API is wrong, as
explained by example below:
"testcase-alias/phandle-tests/consumer-a:testaliasoption".
^ ^ ^
0 14 39
The right length of alias 'testcase-alias' is 14, but the result worked
out by the API is 39 which is obvious wrong.
Fix by using index of either '/' or ':' as the length who comes earlier.
Fixes: 75c28c09af99 ("of: add optional options parameter to of_find_node_by_path()")
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20241216-of_core_fix-v2-1-e69b8f60da63@quicinc.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/base.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -894,10 +894,10 @@ struct device_node *of_find_node_opts_by
/* The path could begin with an alias */
if (*path != '/') {
int len;
- const char *p = separator;
+ const char *p = strchrnul(path, '/');
- if (!p)
- p = strchrnul(path, '/');
+ if (separator && separator < p)
+ p = separator;
len = p - path;
/* of_aliases must not be NULL */
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 218/443] of: reserved-memory: Fix using wrong number of cells to get property alignment
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 217/443] of: Fix of_find_node_opts_by_path() handling of alias+path+options Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 219/443] of: reserved-memory: Warn for missing static reserved memory regions Greg Kroah-Hartman
` (235 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zijun Hu, Rob Herring (Arm)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <quic_zijuhu@quicinc.com>
commit 267b21d0bef8e67dbe6c591c9991444e58237ec9 upstream.
According to DT spec, size of property 'alignment' is based on parent
node’s #size-cells property.
But __reserved_mem_alloc_size() wrongly uses @dt_root_addr_cells to get
the property obviously.
Fix by using @dt_root_size_cells instead of @dt_root_addr_cells.
Fixes: 3f0c82066448 ("drivers: of: add initialization code for dynamic reserved memory")
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-9-db8a72415b8c@quicinc.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/of_reserved_mem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -410,12 +410,12 @@ static int __init __reserved_mem_alloc_s
prop = of_get_flat_dt_prop(node, "alignment", &len);
if (prop) {
- if (len != dt_root_addr_cells * sizeof(__be32)) {
+ if (len != dt_root_size_cells * sizeof(__be32)) {
pr_err("invalid alignment property in '%s' node.\n",
uname);
return -EINVAL;
}
- align = dt_mem_next_cell(dt_root_addr_cells, &prop);
+ align = dt_mem_next_cell(dt_root_size_cells, &prop);
}
nomap = of_get_flat_dt_prop(node, "no-map", NULL) != NULL;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 219/443] of: reserved-memory: Warn for missing static reserved memory regions
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 218/443] of: reserved-memory: Fix using wrong number of cells to get property alignment Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 220/443] Input: bbnsm_pwrkey - add remove hook Greg Kroah-Hartman
` (234 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijun Hu, Krzysztof Kozlowski,
Rob Herring (Arm)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <quic_zijuhu@quicinc.com>
commit 81dfedd5234b42df11a473eefe7328ea4a0416ad upstream.
For child node of /reserved-memory, its property 'reg' may contain
multiple regions, but fdt_scan_reserved_mem_reg_nodes() only takes
into account the first region, and miss remaining regions.
But there are no simple approach to fix it, so give user warning
message when miss remaining regions.
Fixes: 8a6e02d0c00e ("of: reserved_mem: Restructure how the reserved memory regions are processed")
Cc: stable@vger.kernel.org
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20250114-of_core_fix-v5-2-b8bafd00a86f@quicinc.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/of_reserved_mem.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -263,6 +263,11 @@ void __init fdt_scan_reserved_mem_reg_no
uname);
continue;
}
+
+ if (len > t_len)
+ pr_warn("%s() ignores %d regions in node '%s'\n",
+ __func__, len / t_len - 1, uname);
+
base = dt_mem_next_cell(dt_root_addr_cells, &prop);
size = dt_mem_next_cell(dt_root_size_cells, &prop);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 220/443] Input: bbnsm_pwrkey - add remove hook
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 219/443] of: reserved-memory: Warn for missing static reserved memory regions Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 221/443] HID: hid-sensor-hub: dont use stale platform-data on remove Greg Kroah-Hartman
` (233 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peng Fan, Dmitry Torokhov
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
commit 55b75306c3edf369285ce22ba1ced45e335094c2 upstream.
Without remove hook to clear wake irq, there will be kernel dump when
doing module test.
"bbnsm_pwrkey 44440000.bbnsm:pwrkey: wake irq already initialized"
Add remove hook to clear wake irq and set wakeup to false.
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Fixes: 40e40fdfec3f ("Input: bbnsm_pwrkey - add bbnsm power key support")
Link: https://lore.kernel.org/r/20241212030322.3110017-1-peng.fan@oss.nxp.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/nxp-bbnsm-pwrkey.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/input/misc/nxp-bbnsm-pwrkey.c
+++ b/drivers/input/misc/nxp-bbnsm-pwrkey.c
@@ -187,6 +187,12 @@ static int bbnsm_pwrkey_probe(struct pla
return 0;
}
+static void bbnsm_pwrkey_remove(struct platform_device *pdev)
+{
+ dev_pm_clear_wake_irq(&pdev->dev);
+ device_init_wakeup(&pdev->dev, false);
+}
+
static int __maybe_unused bbnsm_pwrkey_suspend(struct device *dev)
{
struct platform_device *pdev = to_platform_device(dev);
@@ -223,6 +229,8 @@ static struct platform_driver bbnsm_pwrk
.of_match_table = bbnsm_pwrkey_ids,
},
.probe = bbnsm_pwrkey_probe,
+ .remove = bbnsm_pwrkey_remove,
+
};
module_platform_driver(bbnsm_pwrkey_driver);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 221/443] HID: hid-sensor-hub: dont use stale platform-data on remove
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 220/443] Input: bbnsm_pwrkey - add remove hook Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 222/443] ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg() Greg Kroah-Hartman
` (232 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Stuebner, Benjamin Tissoires,
Srinivas Pandruvada, Jiri Kosina, Lee Jones
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <heiko@sntech.de>
commit 8a5b38c3fd709e8acd2bfdedf66c25e6af759576 upstream.
The hid-sensor-hub creates the individual device structs and transfers them
to the created mfd platform-devices via the platform_data in the mfd_cell.
Before e651a1da442a ("HID: hid-sensor-hub: Allow parallel synchronous reads")
the sensor-hub was managing access centrally, with one "completion" in the
hub's data structure, which needed to be finished on removal at the latest.
The mentioned commit then moved this central management to each hid sensor
device, resulting on a completion in each struct hid_sensor_hub_device.
The remove procedure was adapted to go through all sensor devices and
finish any pending "completion".
What this didn't take into account was, platform_device_add_data() that is
used by mfd_add{_hotplug}_devices() does a kmemdup on the submitted
platform-data. So the data the platform-device gets is a copy of the
original data, meaning that the device worked on a different completion
than what sensor_hub_remove() currently wants to access.
To fix that, use device_for_each_child() to go through each child-device
similar to how mfd_remove_devices() unregisters the devices later and
with that get the live platform_data to finalize the correct completion.
Fixes: e651a1da442a ("HID: hid-sensor-hub: Allow parallel synchronous reads")
Cc: stable@vger.kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Acked-by: Benjamin Tissoires <bentiss@kernel.org>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Link: https://lore.kernel.org/r/20241107114712.538976-2-heiko@sntech.de
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sensor-hub.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -730,23 +730,30 @@ err_stop_hw:
return ret;
}
+static int sensor_hub_finalize_pending_fn(struct device *dev, void *data)
+{
+ struct hid_sensor_hub_device *hsdev = dev->platform_data;
+
+ if (hsdev->pending.status)
+ complete(&hsdev->pending.ready);
+
+ return 0;
+}
+
static void sensor_hub_remove(struct hid_device *hdev)
{
struct sensor_hub_data *data = hid_get_drvdata(hdev);
unsigned long flags;
- int i;
hid_dbg(hdev, " hardware removed\n");
hid_hw_close(hdev);
hid_hw_stop(hdev);
+
spin_lock_irqsave(&data->lock, flags);
- for (i = 0; i < data->hid_sensor_client_cnt; ++i) {
- struct hid_sensor_hub_device *hsdev =
- data->hid_sensor_hub_client_devs[i].platform_data;
- if (hsdev->pending.status)
- complete(&hsdev->pending.ready);
- }
+ device_for_each_child(&hdev->dev, NULL,
+ sensor_hub_finalize_pending_fn);
spin_unlock_irqrestore(&data->lock, flags);
+
mfd_remove_devices(&hdev->dev);
mutex_destroy(&data->mutex);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 222/443] ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 221/443] HID: hid-sensor-hub: dont use stale platform-data on remove Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 223/443] atomic64: Use arch_spin_locks instead of raw_spin_locks Greg Kroah-Hartman
` (231 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Mathieu Desnoyers,
Andrew Morton, Peter Zijlstra, Thomas Gleixner, Linus Torvalds,
Andreas Larsson, Ludwig Rydberg, Masami Hiramatsu (Google),
Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit cd2375a3567fd3d93aa6c68e0027a5756213bda0 upstream.
Some architectures can not safely do atomic64 operations in NMI context.
Since the ring buffer relies on atomic64 operations to do its time
keeping, if an event is requested in NMI context, reject it for these
architectures.
Cc: stable@vger.kernel.org
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/20250120235721.407068250@goodmis.org
Fixes: c84897c0ff592 ("ring-buffer: Remove 32bit timestamp logic")
Closes: https://lore.kernel.org/all/86fb4f86-a0e4-45a2-a2df-3154acc4f086@gaisler.com/
Reported-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4398,8 +4398,13 @@ rb_reserve_next_event(struct trace_buffe
int nr_loops = 0;
int add_ts_default;
- /* ring buffer does cmpxchg, make sure it is safe in NMI context */
- if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) &&
+ /*
+ * ring buffer does cmpxchg as well as atomic64 operations
+ * (which some archs use locking for atomic64), make sure this
+ * is safe in NMI context
+ */
+ if ((!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) ||
+ IS_ENABLED(CONFIG_GENERIC_ATOMIC64)) &&
(unlikely(in_nmi()))) {
return NULL;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 223/443] atomic64: Use arch_spin_locks instead of raw_spin_locks
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 222/443] ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg() Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 224/443] wifi: rtlwifi: rtl8821ae: Fix media status report Greg Kroah-Hartman
` (230 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Mathieu Desnoyers,
Andrew Morton, Peter Zijlstra, Thomas Gleixner, Linus Torvalds,
Andreas Larsson, Ludwig Rydberg, Masami Hiramatsu (Google),
Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit 6c8ad3ab45ad0e94bfb7a9c71f2fa9c6cacea4b2 upstream.
raw_spin_locks can be traced by lockdep or tracing itself. Atomic64
operations can be used in the tracing infrastructure. When an architecture
does not have true atomic64 operations it can use the generic version that
disables interrupts and uses spin_locks.
The tracing ring buffer code uses atomic64 operations for the time
keeping. But because some architectures use the default operations, the
locking inside the atomic operations can cause an infinite recursion.
As atomic64 implementation is architecture specific, it should not be
using raw_spin_locks() but instead arch_spin_locks as that is the purpose
of arch_spin_locks. To be used in architecture specific implementations of
generic infrastructure like atomic64 operations.
Note, by switching from raw_spin_locks to arch_spin_locks, the locks taken
to emulate the atomic64 operations will not have lockdep, mmio, or any
kind of checks done on them. They will not even disable preemption,
although the code will disable interrupts preventing the tasks that hold
the locks from being preempted. As the locks held are done so for very
short periods of time, and the logic is only done to emulate atomic64, not
having them be instrumented should not be an issue.
Cc: stable@vger.kernel.org
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/20250122144311.64392baf@gandalf.local.home
Fixes: c84897c0ff592 ("ring-buffer: Remove 32bit timestamp logic")
Closes: https://lore.kernel.org/all/86fb4f86-a0e4-45a2-a2df-3154acc4f086@gaisler.com/
Reported-by: Ludwig Rydberg <ludwig.rydberg@gaisler.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/atomic64.c | 78 +++++++++++++++++++++++++++++++++++----------------------
1 file changed, 48 insertions(+), 30 deletions(-)
--- a/lib/atomic64.c
+++ b/lib/atomic64.c
@@ -25,15 +25,15 @@
* Ensure each lock is in a separate cacheline.
*/
static union {
- raw_spinlock_t lock;
+ arch_spinlock_t lock;
char pad[L1_CACHE_BYTES];
} atomic64_lock[NR_LOCKS] __cacheline_aligned_in_smp = {
[0 ... (NR_LOCKS - 1)] = {
- .lock = __RAW_SPIN_LOCK_UNLOCKED(atomic64_lock.lock),
+ .lock = __ARCH_SPIN_LOCK_UNLOCKED,
},
};
-static inline raw_spinlock_t *lock_addr(const atomic64_t *v)
+static inline arch_spinlock_t *lock_addr(const atomic64_t *v)
{
unsigned long addr = (unsigned long) v;
@@ -45,12 +45,14 @@ static inline raw_spinlock_t *lock_addr(
s64 generic_atomic64_read(const atomic64_t *v)
{
unsigned long flags;
- raw_spinlock_t *lock = lock_addr(v);
+ arch_spinlock_t *lock = lock_addr(v);
s64 val;
- raw_spin_lock_irqsave(lock, flags);
+ local_irq_save(flags);
+ arch_spin_lock(lock);
val = v->counter;
- raw_spin_unlock_irqrestore(lock, flags);
+ arch_spin_unlock(lock);
+ local_irq_restore(flags);
return val;
}
EXPORT_SYMBOL(generic_atomic64_read);
@@ -58,11 +60,13 @@ EXPORT_SYMBOL(generic_atomic64_read);
void generic_atomic64_set(atomic64_t *v, s64 i)
{
unsigned long flags;
- raw_spinlock_t *lock = lock_addr(v);
+ arch_spinlock_t *lock = lock_addr(v);
- raw_spin_lock_irqsave(lock, flags);
+ local_irq_save(flags);
+ arch_spin_lock(lock);
v->counter = i;
- raw_spin_unlock_irqrestore(lock, flags);
+ arch_spin_unlock(lock);
+ local_irq_restore(flags);
}
EXPORT_SYMBOL(generic_atomic64_set);
@@ -70,11 +74,13 @@ EXPORT_SYMBOL(generic_atomic64_set);
void generic_atomic64_##op(s64 a, atomic64_t *v) \
{ \
unsigned long flags; \
- raw_spinlock_t *lock = lock_addr(v); \
+ arch_spinlock_t *lock = lock_addr(v); \
\
- raw_spin_lock_irqsave(lock, flags); \
+ local_irq_save(flags); \
+ arch_spin_lock(lock); \
v->counter c_op a; \
- raw_spin_unlock_irqrestore(lock, flags); \
+ arch_spin_unlock(lock); \
+ local_irq_restore(flags); \
} \
EXPORT_SYMBOL(generic_atomic64_##op);
@@ -82,12 +88,14 @@ EXPORT_SYMBOL(generic_atomic64_##op);
s64 generic_atomic64_##op##_return(s64 a, atomic64_t *v) \
{ \
unsigned long flags; \
- raw_spinlock_t *lock = lock_addr(v); \
+ arch_spinlock_t *lock = lock_addr(v); \
s64 val; \
\
- raw_spin_lock_irqsave(lock, flags); \
+ local_irq_save(flags); \
+ arch_spin_lock(lock); \
val = (v->counter c_op a); \
- raw_spin_unlock_irqrestore(lock, flags); \
+ arch_spin_unlock(lock); \
+ local_irq_restore(flags); \
return val; \
} \
EXPORT_SYMBOL(generic_atomic64_##op##_return);
@@ -96,13 +104,15 @@ EXPORT_SYMBOL(generic_atomic64_##op##_re
s64 generic_atomic64_fetch_##op(s64 a, atomic64_t *v) \
{ \
unsigned long flags; \
- raw_spinlock_t *lock = lock_addr(v); \
+ arch_spinlock_t *lock = lock_addr(v); \
s64 val; \
\
- raw_spin_lock_irqsave(lock, flags); \
+ local_irq_save(flags); \
+ arch_spin_lock(lock); \
val = v->counter; \
v->counter c_op a; \
- raw_spin_unlock_irqrestore(lock, flags); \
+ arch_spin_unlock(lock); \
+ local_irq_restore(flags); \
return val; \
} \
EXPORT_SYMBOL(generic_atomic64_fetch_##op);
@@ -131,14 +141,16 @@ ATOMIC64_OPS(xor, ^=)
s64 generic_atomic64_dec_if_positive(atomic64_t *v)
{
unsigned long flags;
- raw_spinlock_t *lock = lock_addr(v);
+ arch_spinlock_t *lock = lock_addr(v);
s64 val;
- raw_spin_lock_irqsave(lock, flags);
+ local_irq_save(flags);
+ arch_spin_lock(lock);
val = v->counter - 1;
if (val >= 0)
v->counter = val;
- raw_spin_unlock_irqrestore(lock, flags);
+ arch_spin_unlock(lock);
+ local_irq_restore(flags);
return val;
}
EXPORT_SYMBOL(generic_atomic64_dec_if_positive);
@@ -146,14 +158,16 @@ EXPORT_SYMBOL(generic_atomic64_dec_if_po
s64 generic_atomic64_cmpxchg(atomic64_t *v, s64 o, s64 n)
{
unsigned long flags;
- raw_spinlock_t *lock = lock_addr(v);
+ arch_spinlock_t *lock = lock_addr(v);
s64 val;
- raw_spin_lock_irqsave(lock, flags);
+ local_irq_save(flags);
+ arch_spin_lock(lock);
val = v->counter;
if (val == o)
v->counter = n;
- raw_spin_unlock_irqrestore(lock, flags);
+ arch_spin_unlock(lock);
+ local_irq_restore(flags);
return val;
}
EXPORT_SYMBOL(generic_atomic64_cmpxchg);
@@ -161,13 +175,15 @@ EXPORT_SYMBOL(generic_atomic64_cmpxchg);
s64 generic_atomic64_xchg(atomic64_t *v, s64 new)
{
unsigned long flags;
- raw_spinlock_t *lock = lock_addr(v);
+ arch_spinlock_t *lock = lock_addr(v);
s64 val;
- raw_spin_lock_irqsave(lock, flags);
+ local_irq_save(flags);
+ arch_spin_lock(lock);
val = v->counter;
v->counter = new;
- raw_spin_unlock_irqrestore(lock, flags);
+ arch_spin_unlock(lock);
+ local_irq_restore(flags);
return val;
}
EXPORT_SYMBOL(generic_atomic64_xchg);
@@ -175,14 +191,16 @@ EXPORT_SYMBOL(generic_atomic64_xchg);
s64 generic_atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u)
{
unsigned long flags;
- raw_spinlock_t *lock = lock_addr(v);
+ arch_spinlock_t *lock = lock_addr(v);
s64 val;
- raw_spin_lock_irqsave(lock, flags);
+ local_irq_save(flags);
+ arch_spin_lock(lock);
val = v->counter;
if (val != u)
v->counter += a;
- raw_spin_unlock_irqrestore(lock, flags);
+ arch_spin_unlock(lock);
+ local_irq_restore(flags);
return val;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 224/443] wifi: rtlwifi: rtl8821ae: Fix media status report
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 223/443] atomic64: Use arch_spin_locks instead of raw_spin_locks Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 225/443] wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() Greg Kroah-Hartman
` (229 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bitterblue Smith, Ping-Ke Shih
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
commit 66ef0289ac99e155d206ddaa0fdfad09ae3cd007 upstream.
RTL8821AE is stuck transmitting at the lowest rate allowed by the rate
mask. This is because the firmware doesn't know the device is connected
to a network.
Fix the macros SET_H2CCMD_MSRRPT_PARM_OPMODE and
SET_H2CCMD_MSRRPT_PARM_MACID_IND to work on the first byte of __cmd,
not the second. Now the firmware is correctly notified when the device
is connected to a network and it activates the rate control.
Before (MCS3):
[ 5] 0.00-1.00 sec 12.5 MBytes 105 Mbits/sec 0 339 KBytes
[ 5] 1.00-2.00 sec 10.6 MBytes 89.1 Mbits/sec 0 339 KBytes
[ 5] 2.00-3.00 sec 10.6 MBytes 89.1 Mbits/sec 0 386 KBytes
[ 5] 3.00-4.00 sec 10.6 MBytes 89.1 Mbits/sec 0 386 KBytes
[ 5] 4.00-5.00 sec 10.2 MBytes 86.0 Mbits/sec 0 427 KBytes
After (MCS9):
[ 5] 0.00-1.00 sec 33.9 MBytes 284 Mbits/sec 0 771 KBytes
[ 5] 1.00-2.00 sec 31.6 MBytes 265 Mbits/sec 0 865 KBytes
[ 5] 2.00-3.00 sec 29.9 MBytes 251 Mbits/sec 0 963 KBytes
[ 5] 3.00-4.00 sec 28.2 MBytes 237 Mbits/sec 0 963 KBytes
[ 5] 4.00-5.00 sec 26.8 MBytes 224 Mbits/sec 0 963 KBytes
Fixes: 39f40710d0b5 ("rtlwifi: rtl88821ae: Remove usage of private bit manipulation macros")
Cc: stable@vger.kernel.org
Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/754785b3-8a78-4554-b80d-de5f603b410b@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/fw.h
@@ -197,9 +197,9 @@ enum rtl8821a_h2c_cmd {
/* _MEDIA_STATUS_RPT_PARM_CMD1 */
#define SET_H2CCMD_MSRRPT_PARM_OPMODE(__cmd, __value) \
- u8p_replace_bits(__cmd + 1, __value, BIT(0))
+ u8p_replace_bits(__cmd, __value, BIT(0))
#define SET_H2CCMD_MSRRPT_PARM_MACID_IND(__cmd, __value) \
- u8p_replace_bits(__cmd + 1, __value, BIT(1))
+ u8p_replace_bits(__cmd, __value, BIT(1))
/* AP_OFFLOAD */
#define SET_H2CCMD_AP_OFFLOAD_ON(__cmd, __value) \
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 225/443] wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 224/443] wifi: rtlwifi: rtl8821ae: Fix media status report Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 226/443] wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH Greg Kroah-Hartman
` (228 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marcel Hamer, Arend van Spriel,
Kalle Valo
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcel Hamer <marcel.hamer@windriver.com>
commit 68abd0c4ebf24cd499841a488b97a6873d5efabb upstream.
On removal of the device or unloading of the kernel module a potential NULL
pointer dereference occurs.
The following sequence deletes the interface:
brcmf_detach()
brcmf_remove_interface()
brcmf_del_if()
Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to
BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.
After brcmf_remove_interface() call the brcmf_proto_detach() function is
called providing the following sequence:
brcmf_detach()
brcmf_proto_detach()
brcmf_proto_msgbuf_detach()
brcmf_flowring_detach()
brcmf_msgbuf_delete_flowring()
brcmf_msgbuf_remove_flowring()
brcmf_flowring_delete()
brcmf_get_ifp()
brcmf_txfinalize()
Since brcmf_get_ip() can and actually will return NULL in this case the
call to brcmf_txfinalize() will result in a NULL pointer dereference inside
brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors.
This will only happen if a flowring still has an skb.
Although the NULL pointer dereference has only been seen when trying to
update the tx statistic, all other uses of the ifp pointer have been
guarded as well with an early return if ifp is NULL.
Cc: stable@vger.kernel.org
Signed-off-by: Marcel Hamer <marcel.hamer@windriver.com>
Link: https://lore.kernel.org/all/b519e746-ddfd-421f-d897-7620d229e4b2@gmail.com/
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20250116132240.731039-1-marcel.hamer@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -540,6 +540,11 @@ void brcmf_txfinalize(struct brcmf_if *i
struct ethhdr *eh;
u16 type;
+ if (!ifp) {
+ brcmu_pkt_buf_free_skb(txp);
+ return;
+ }
+
eh = (struct ethhdr *)(txp->data);
type = ntohs(eh->h_proto);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 226/443] wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 225/443] wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 227/443] wifi: rtw88: sdio: Fix disconnection after beacon loss Greg Kroah-Hartman
` (227 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shang Chieh Tseng, Nick Morrow,
Felix Fietkau
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Morrow <usbwifi2024@gmail.com>
commit 47d9a8ba1d7f31c674b6936b3c34ee934aa9b420 upstream.
Add VID/PID 35bc/0107 for recently released TP-Link TXE50UH USB WiFi adapter.
Tested-by: Shang Chieh Tseng <shangchieh.tseng@tsengsy.com>
Signed-off-by: Nick Morrow <usbwifi2024@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/e797f105-9ca8-41e9-96de-7d25dec09943@gmail.com
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/usb.c
@@ -21,6 +21,9 @@ static const struct usb_device_id mt7921
/* Netgear, Inc. [A8000,AXE3000] */
{ USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9060, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM },
+ /* TP-Link TXE50UH */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0107, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)MT7921_FIRMWARE_WM },
{ },
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 227/443] wifi: rtw88: sdio: Fix disconnection after beacon loss
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 226/443] wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 228/443] wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916 Greg Kroah-Hartman
` (226 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fiona Klute, Ping-Ke Shih,
Vasily Khoruzhick
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fiona Klute <fiona.klute@gmx.de>
commit fb2fcfbe5eef9ae26b0425978435ae1308951e51 upstream.
This is the equivalent of commit 28818b4d871b ("wifi: rtw88: usb: Fix
disconnection after beacon loss") for SDIO chips.
Tested on Pinephone (RTL8723CS), random disconnections became rare,
instead of a frequent nuisance.
Cc: stable@vger.kernel.org
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Vasily Khoruzhick <anarsoul@gmail.com> # Tested on Pinebook
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250106135434.35936-1-fiona.klute@gmx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtw88/sdio.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/wireless/realtek/rtw88/sdio.c
+++ b/drivers/net/wireless/realtek/rtw88/sdio.c
@@ -1192,6 +1192,8 @@ static void rtw_sdio_indicate_tx_status(
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
struct ieee80211_hw *hw = rtwdev->hw;
+ skb_pull(skb, rtwdev->chip->tx_pkt_desc_sz);
+
/* enqueue to wait for tx report */
if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
rtw_tx_report_enqueue(rtwdev, skb, tx_data->sn);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 228/443] wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 227/443] wifi: rtw88: sdio: Fix disconnection after beacon loss Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 229/443] wifi: rtw88: 8703b: Fix RX/TX issues Greg Kroah-Hartman
` (225 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shayne Chen, Felix Fietkau
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shayne Chen <shayne.chen@mediatek.com>
commit 57af267d2b8f5d88485c6372761386d79c5e6a1a upstream.
Due to a limitation in available memory, the MT7916 firmware can only
handle either 5 GHz or 6 GHz at a time. It does not support runtime
switching without a full restart.
On older firmware, this accidentally worked to some degree due to missing
checks, but couldn't be supported properly, because it left the 6 GHz
channels uncalibrated.
Newer firmware refuses to start on either band if the passed EEPROM
data indicates support for both.
Deal with this limitation by using a module parameter to specify the
preferred band in case both are supported.
Fixes: b4d093e321bd ("mt76: mt7915: add 6 GHz support")
Cc: stable@vger.kernel.org
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Link: https://patch.msgid.link/20241010083816.51880-1-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 21 +++++++++++++++++++--
drivers/net/wireless/mediatek/mt76/mt7915/init.c | 4 ++--
2 files changed, 21 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
@@ -2,9 +2,14 @@
/* Copyright (C) 2020 MediaTek Inc. */
#include <linux/firmware.h>
+#include <linux/moduleparam.h>
#include "mt7915.h"
#include "eeprom.h"
+static bool enable_6ghz;
+module_param(enable_6ghz, bool, 0644);
+MODULE_PARM_DESC(enable_6ghz, "Enable 6 GHz instead of 5 GHz on hardware that supports both");
+
static int mt7915_eeprom_load_precal(struct mt7915_dev *dev)
{
struct mt76_dev *mdev = &dev->mt76;
@@ -170,8 +175,20 @@ static void mt7915_eeprom_parse_band_con
phy->mt76->cap.has_6ghz = true;
return;
case MT_EE_V2_BAND_SEL_5GHZ_6GHZ:
- phy->mt76->cap.has_5ghz = true;
- phy->mt76->cap.has_6ghz = true;
+ if (enable_6ghz) {
+ phy->mt76->cap.has_6ghz = true;
+ u8p_replace_bits(&eeprom[MT_EE_WIFI_CONF + band],
+ MT_EE_V2_BAND_SEL_6GHZ,
+ MT_EE_WIFI_CONF0_BAND_SEL);
+ } else {
+ phy->mt76->cap.has_5ghz = true;
+ u8p_replace_bits(&eeprom[MT_EE_WIFI_CONF + band],
+ MT_EE_V2_BAND_SEL_5GHZ,
+ MT_EE_WIFI_CONF0_BAND_SEL);
+ }
+ /* force to buffer mode */
+ dev->flash_mode = true;
+
return;
default:
phy->mt76->cap.has_2ghz = true;
--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
@@ -1239,14 +1239,14 @@ int mt7915_register_device(struct mt7915
if (ret)
goto unreg_dev;
- ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
-
if (phy2) {
ret = mt7915_register_ext_phy(dev, phy2);
if (ret)
goto unreg_thermal;
}
+ ieee80211_queue_work(mt76_hw(dev), &dev->init_work);
+
dev->recovery.hw_init_done = true;
ret = mt7915_init_debugfs(&dev->phy);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 229/443] wifi: rtw88: 8703b: Fix RX/TX issues
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 228/443] wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916 Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 230/443] usb: gadget: f_tcm: Translate error to sense Greg Kroah-Hartman
` (224 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasily Khoruzhick, Ping-Ke Shih,
Fiona Klute, Andrey Skvortsov
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Khoruzhick <anarsoul@gmail.com>
commit a806a8160a0fcaff368bb510c8a52eff37faf727 upstream.
Fix 3 typos in 8703b driver. 2 typos in calibration routines are not
fatal and do not seem to have any impact, just fix them to match vendor
driver.
However the last one in rtw8703b_set_channel_bb() clears too many bits
in REG_OFDM0_TX_PSD_NOISE, causing TX and RX issues (neither rate goes
above MCS0-MCS1). Vendor driver clears only 2 most significant bits.
With the last typo fixed, the driver is able to reach MCS7 on Pinebook
Cc: stable@vger.kernel.org
Fixes: 9bb762b3a957 ("wifi: rtw88: Add definitions for 8703b chip")
Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250103075107.1337533-1-anarsoul@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtw88/rtw8703b.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
@@ -903,7 +903,7 @@ static void rtw8703b_set_channel_bb(stru
rtw_write32_mask(rtwdev, REG_FPGA0_RFMOD, BIT_MASK_RFMOD, 0x0);
rtw_write32_mask(rtwdev, REG_FPGA1_RFMOD, BIT_MASK_RFMOD, 0x0);
rtw_write32_mask(rtwdev, REG_OFDM0_TX_PSD_NOISE,
- GENMASK(31, 20), 0x0);
+ GENMASK(31, 30), 0x0);
rtw_write32(rtwdev, REG_BBRX_DFIR, 0x4A880000);
rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x19F60000);
break;
@@ -1198,9 +1198,9 @@ static u8 rtw8703b_iqk_rx_path(struct rt
rtw_write32(rtwdev, REG_RXIQK_TONE_A_11N, 0x38008c1c);
rtw_write32(rtwdev, REG_TX_IQK_TONE_B, 0x38008c1c);
rtw_write32(rtwdev, REG_RX_IQK_TONE_B, 0x38008c1c);
- rtw_write32(rtwdev, REG_TXIQK_PI_A_11N, 0x8216000f);
+ rtw_write32(rtwdev, REG_TXIQK_PI_A_11N, 0x8214030f);
rtw_write32(rtwdev, REG_RXIQK_PI_A_11N, 0x28110000);
- rtw_write32(rtwdev, REG_TXIQK_PI_B, 0x28110000);
+ rtw_write32(rtwdev, REG_TXIQK_PI_B, 0x82110000);
rtw_write32(rtwdev, REG_RXIQK_PI_B, 0x28110000);
/* LOK setting */
@@ -1372,7 +1372,7 @@ void rtw8703b_iqk_fill_a_matrix(struct r
return;
tmp_rx_iqi |= FIELD_PREP(BIT_MASK_RXIQ_S1_X, result[IQK_S1_RX_X]);
- tmp_rx_iqi |= FIELD_PREP(BIT_MASK_RXIQ_S1_Y1, result[IQK_S1_RX_X]);
+ tmp_rx_iqi |= FIELD_PREP(BIT_MASK_RXIQ_S1_Y1, result[IQK_S1_RX_Y]);
rtw_write32(rtwdev, REG_A_RXIQI, tmp_rx_iqi);
rtw_write32_mask(rtwdev, REG_RXIQK_MATRIX_LSB_11N, BIT_MASK_RXIQ_S1_Y2,
BIT_SET_RXIQ_S1_Y2(result[IQK_S1_RX_Y]));
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 230/443] usb: gadget: f_tcm: Translate error to sense
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 229/443] wifi: rtw88: 8703b: Fix RX/TX issues Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 231/443] usb: gadget: f_tcm: Decrement command ref count on cleanup Greg Kroah-Hartman
` (223 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thinh Nguyen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 98fa00fd3ae43b857b4976984a135483d89d9281 upstream.
When respond with check_condition error status, clear from_transport
input so the target layer can translate the sense reason reported by
f_tcm.
Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/b2a5577efe7abd0af0051229622cf7d3be5cdcd0.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_tcm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1065,7 +1065,7 @@ static void usbg_cmd_work(struct work_st
out:
transport_send_check_condition_and_sense(se_cmd,
- TCM_UNSUPPORTED_SCSI_OPCODE, 1);
+ TCM_UNSUPPORTED_SCSI_OPCODE, 0);
}
static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu,
@@ -1193,7 +1193,7 @@ static void bot_cmd_work(struct work_str
out:
transport_send_check_condition_and_sense(se_cmd,
- TCM_UNSUPPORTED_SCSI_OPCODE, 1);
+ TCM_UNSUPPORTED_SCSI_OPCODE, 0);
}
static int bot_submit_command(struct f_uas *fu,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 231/443] usb: gadget: f_tcm: Decrement command ref count on cleanup
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 230/443] usb: gadget: f_tcm: Translate error to sense Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 232/443] usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint Greg Kroah-Hartman
` (222 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thinh Nguyen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 3b2a52e88ab0c9469eaadd4d4c8f57d072477820 upstream.
We submitted the command with TARGET_SCF_ACK_KREF, which requires
acknowledgment of command completion. If the command fails, make sure to
decrement the ref count.
Fixes: cff834c16d23 ("usb-gadget/tcm: Convert to TARGET_SCF_ACK_KREF I/O krefs")
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/3c667b4d9c8b0b580346a69ff53616b6a74cfea2.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_tcm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -973,6 +973,7 @@ static void usbg_data_write_cmpl(struct
return;
cleanup:
+ target_put_sess_cmd(se_cmd);
transport_generic_free_cmd(&cmd->se_cmd, 0);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 232/443] usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 231/443] usb: gadget: f_tcm: Decrement command ref count on cleanup Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 233/443] usb: gadget: f_tcm: Dont prepare BOT write request twice Greg Kroah-Hartman
` (221 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thinh Nguyen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 25224c1f07d31c261d04dfbc705a7a0f314a825d upstream.
Match usb endpoint using fullspeed endpoint descriptor to make sure the
wMaxPacketSize for fullspeed descriptors is automatically configured.
Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/e4507bc824aed6e7c7f5a718392ab6a7c1480a7f.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_tcm.c | 30 +++++++++++++-----------------
1 file changed, 13 insertions(+), 17 deletions(-)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1970,43 +1970,39 @@ static int tcm_bind(struct usb_configura
bot_intf_desc.bInterfaceNumber = iface;
uasp_intf_desc.bInterfaceNumber = iface;
fu->iface = iface;
- ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bi_desc,
- &uasp_bi_ep_comp_desc);
+ ep = usb_ep_autoconfig(gadget, &uasp_fs_bi_desc);
if (!ep)
goto ep_fail;
fu->ep_in = ep;
- ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_bo_desc,
- &uasp_bo_ep_comp_desc);
+ ep = usb_ep_autoconfig(gadget, &uasp_fs_bo_desc);
if (!ep)
goto ep_fail;
fu->ep_out = ep;
- ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_status_desc,
- &uasp_status_in_ep_comp_desc);
+ ep = usb_ep_autoconfig(gadget, &uasp_fs_status_desc);
if (!ep)
goto ep_fail;
fu->ep_status = ep;
- ep = usb_ep_autoconfig_ss(gadget, &uasp_ss_cmd_desc,
- &uasp_cmd_comp_desc);
+ ep = usb_ep_autoconfig(gadget, &uasp_fs_cmd_desc);
if (!ep)
goto ep_fail;
fu->ep_cmd = ep;
/* Assume endpoint addresses are the same for both speeds */
- uasp_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
- uasp_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
+ uasp_bi_desc.bEndpointAddress = uasp_fs_bi_desc.bEndpointAddress;
+ uasp_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress;
uasp_status_desc.bEndpointAddress =
- uasp_ss_status_desc.bEndpointAddress;
- uasp_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
+ uasp_fs_status_desc.bEndpointAddress;
+ uasp_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress;
- uasp_fs_bi_desc.bEndpointAddress = uasp_ss_bi_desc.bEndpointAddress;
- uasp_fs_bo_desc.bEndpointAddress = uasp_ss_bo_desc.bEndpointAddress;
- uasp_fs_status_desc.bEndpointAddress =
- uasp_ss_status_desc.bEndpointAddress;
- uasp_fs_cmd_desc.bEndpointAddress = uasp_ss_cmd_desc.bEndpointAddress;
+ uasp_ss_bi_desc.bEndpointAddress = uasp_fs_bi_desc.bEndpointAddress;
+ uasp_ss_bo_desc.bEndpointAddress = uasp_fs_bo_desc.bEndpointAddress;
+ uasp_ss_status_desc.bEndpointAddress =
+ uasp_fs_status_desc.bEndpointAddress;
+ uasp_ss_cmd_desc.bEndpointAddress = uasp_fs_cmd_desc.bEndpointAddress;
ret = usb_assign_descriptors(f, uasp_fs_function_desc,
uasp_hs_function_desc, uasp_ss_function_desc,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 233/443] usb: gadget: f_tcm: Dont prepare BOT write request twice
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 232/443] usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 234/443] usbnet: ipheth: fix possible overflow in DPE length check Greg Kroah-Hartman
` (220 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thinh Nguyen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 94d9bf671ae314cacc2d7bf96bd233b4abc7cede upstream.
The duplicate kmalloc here is causing memory leak. The request
preparation in bot_send_write_request is also done in
usbg_prepare_w_request. Remove the duplicate work.
Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/f4f26c3d586cde0d46f8c3bcb4e8ae32311b650d.1733876548.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_tcm.c | 17 -----------------
1 file changed, 17 deletions(-)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -245,7 +245,6 @@ static int bot_send_write_request(struct
{
struct f_uas *fu = cmd->fu;
struct se_cmd *se_cmd = &cmd->se_cmd;
- struct usb_gadget *gadget = fuas_to_gadget(fu);
int ret;
init_completion(&cmd->write_complete);
@@ -256,22 +255,6 @@ static int bot_send_write_request(struct
return -EINVAL;
}
- if (!gadget->sg_supported) {
- cmd->data_buf = kmalloc(se_cmd->data_length, GFP_KERNEL);
- if (!cmd->data_buf)
- return -ENOMEM;
-
- fu->bot_req_out->buf = cmd->data_buf;
- } else {
- fu->bot_req_out->buf = NULL;
- fu->bot_req_out->num_sgs = se_cmd->t_data_nents;
- fu->bot_req_out->sg = se_cmd->t_data_sg;
- }
-
- fu->bot_req_out->complete = usbg_data_write_cmpl;
- fu->bot_req_out->length = se_cmd->data_length;
- fu->bot_req_out->context = cmd;
-
ret = usbg_prepare_w_request(cmd, fu->bot_req_out);
if (ret)
goto cleanup;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 234/443] usbnet: ipheth: fix possible overflow in DPE length check
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 233/443] usb: gadget: f_tcm: Dont prepare BOT write request twice Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 235/443] usbnet: ipheth: use static NDP16 location in URB Greg Kroah-Hartman
` (219 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Foster Snowhill, Jakub Kicinski,
Paolo Abeni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <forst@pen.gy>
commit c219427ed296f94bb4b91d08626776dc7719ee27 upstream.
Originally, it was possible for the DPE length check to overflow if
wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB
read.
Move the wDatagramIndex term to the other side of the inequality.
An existing condition ensures that wDatagramIndex < urb->actual_length.
Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support")
Cc: stable@vger.kernel.org
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -243,8 +243,8 @@ static int ipheth_rcvbulk_callback_ncm(s
while (le16_to_cpu(dpe->wDatagramIndex) != 0 &&
le16_to_cpu(dpe->wDatagramLength) != 0) {
if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length ||
- le16_to_cpu(dpe->wDatagramIndex) +
- le16_to_cpu(dpe->wDatagramLength) > urb->actual_length) {
+ le16_to_cpu(dpe->wDatagramLength) > urb->actual_length -
+ le16_to_cpu(dpe->wDatagramIndex)) {
dev->net->stats.rx_length_errors++;
return retval;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 235/443] usbnet: ipheth: use static NDP16 location in URB
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 234/443] usbnet: ipheth: fix possible overflow in DPE length check Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 236/443] usbnet: ipheth: check that DPE points past NCM header Greg Kroah-Hartman
` (218 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Foster Snowhill, Jakub Kicinski,
Paolo Abeni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <forst@pen.gy>
commit 86586dcb75cb8fd062a518aca8ee667938b91efb upstream.
Original code allowed for the start of NDP16 to be anywhere within the
URB based on the `wNdpIndex` value in NTH16. Only the start position of
NDP16 was checked, so it was possible for even the fixed-length part
of NDP16 to extend past the end of URB, leading to an out-of-bounds
read.
On iOS devices, the NDP16 header always directly follows NTH16. Rely on
and check for this specific format.
This, along with NCM-specific minimal URB length check that already
exists, will ensure that the fixed-length part of NDP16 plus a set
amount of DPEs fit within the URB.
Note that this commit alone does not fully address the OoB read.
The limit on the amount of DPEs needs to be enforced separately.
Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support")
Cc: stable@vger.kernel.org
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -226,15 +226,14 @@ static int ipheth_rcvbulk_callback_ncm(s
ncmh = urb->transfer_buffer;
if (ncmh->dwSignature != cpu_to_le32(USB_CDC_NCM_NTH16_SIGN) ||
- le16_to_cpu(ncmh->wNdpIndex) >= urb->actual_length) {
+ /* On iOS, NDP16 directly follows NTH16 */
+ ncmh->wNdpIndex != cpu_to_le16(sizeof(struct usb_cdc_ncm_nth16))) {
dev->net->stats.rx_errors++;
return retval;
}
- ncm0 = urb->transfer_buffer + le16_to_cpu(ncmh->wNdpIndex);
- if (ncm0->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN) ||
- le16_to_cpu(ncmh->wHeaderLength) + le16_to_cpu(ncm0->wLength) >=
- urb->actual_length) {
+ ncm0 = urb->transfer_buffer + sizeof(struct usb_cdc_ncm_nth16);
+ if (ncm0->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN)) {
dev->net->stats.rx_errors++;
return retval;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 236/443] usbnet: ipheth: check that DPE points past NCM header
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 235/443] usbnet: ipheth: use static NDP16 location in URB Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 237/443] usbnet: ipheth: refactor NCM datagram loop Greg Kroah-Hartman
` (217 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Foster Snowhill, Jakub Kicinski,
Paolo Abeni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <forst@pen.gy>
commit 429fa68b58cefb9aa9de27e4089637298b46b757 upstream.
By definition, a DPE points at the start of a network frame/datagram.
Thus it makes no sense for it to point at anything that's part of the
NCM header. It is not a security issue, but merely an indication of
a malformed DPE.
Enforce that all DPEs point at the data portion of the URB, past the
NCM header.
Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support")
Cc: stable@vger.kernel.org
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -241,7 +241,8 @@ static int ipheth_rcvbulk_callback_ncm(s
dpe = ncm0->dpe16;
while (le16_to_cpu(dpe->wDatagramIndex) != 0 &&
le16_to_cpu(dpe->wDatagramLength) != 0) {
- if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length ||
+ if (le16_to_cpu(dpe->wDatagramIndex) < IPHETH_NCM_HEADER_SIZE ||
+ le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length ||
le16_to_cpu(dpe->wDatagramLength) > urb->actual_length -
le16_to_cpu(dpe->wDatagramIndex)) {
dev->net->stats.rx_length_errors++;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 237/443] usbnet: ipheth: refactor NCM datagram loop
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 236/443] usbnet: ipheth: check that DPE points past NCM header Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 238/443] usbnet: ipheth: break up NCM header size computation Greg Kroah-Hartman
` (216 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Foster Snowhill, Jakub Kicinski,
Paolo Abeni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <forst@pen.gy>
commit 2a9a196429e98fcc64078366c2679bc40aba5466 upstream.
Introduce an rx_error label to reduce repetitions in the header
signature checks.
Store wDatagramIndex and wDatagramLength after endianness conversion to
avoid repeated le16_to_cpu() calls.
Rewrite the loop to return on a null trailing DPE, which is required
by the CDC NCM spec. In case it is missing, fall through to rx_error.
This change does not fix any particular issue. Its purpose is to
simplify a subsequent commit that fixes a potential OoB read by limiting
the maximum amount of processed DPEs.
Cc: stable@vger.kernel.org # 6.5.x
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 42 +++++++++++++++++++++++-------------------
1 file changed, 23 insertions(+), 19 deletions(-)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -213,9 +213,9 @@ static int ipheth_rcvbulk_callback_ncm(s
struct usb_cdc_ncm_ndp16 *ncm0;
struct usb_cdc_ncm_dpe16 *dpe;
struct ipheth_device *dev;
+ u16 dg_idx, dg_len;
int retval = -EINVAL;
char *buf;
- int len;
dev = urb->context;
@@ -227,39 +227,43 @@ static int ipheth_rcvbulk_callback_ncm(s
ncmh = urb->transfer_buffer;
if (ncmh->dwSignature != cpu_to_le32(USB_CDC_NCM_NTH16_SIGN) ||
/* On iOS, NDP16 directly follows NTH16 */
- ncmh->wNdpIndex != cpu_to_le16(sizeof(struct usb_cdc_ncm_nth16))) {
- dev->net->stats.rx_errors++;
- return retval;
- }
+ ncmh->wNdpIndex != cpu_to_le16(sizeof(struct usb_cdc_ncm_nth16)))
+ goto rx_error;
ncm0 = urb->transfer_buffer + sizeof(struct usb_cdc_ncm_nth16);
- if (ncm0->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN)) {
- dev->net->stats.rx_errors++;
- return retval;
- }
+ if (ncm0->dwSignature != cpu_to_le32(USB_CDC_NCM_NDP16_NOCRC_SIGN))
+ goto rx_error;
dpe = ncm0->dpe16;
- while (le16_to_cpu(dpe->wDatagramIndex) != 0 &&
- le16_to_cpu(dpe->wDatagramLength) != 0) {
- if (le16_to_cpu(dpe->wDatagramIndex) < IPHETH_NCM_HEADER_SIZE ||
- le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length ||
- le16_to_cpu(dpe->wDatagramLength) > urb->actual_length -
- le16_to_cpu(dpe->wDatagramIndex)) {
+ while (true) {
+ dg_idx = le16_to_cpu(dpe->wDatagramIndex);
+ dg_len = le16_to_cpu(dpe->wDatagramLength);
+
+ /* Null DPE must be present after last datagram pointer entry
+ * (3.3.1 USB CDC NCM spec v1.0)
+ */
+ if (dg_idx == 0 && dg_len == 0)
+ return 0;
+
+ if (dg_idx < IPHETH_NCM_HEADER_SIZE ||
+ dg_idx >= urb->actual_length ||
+ dg_len > urb->actual_length - dg_idx) {
dev->net->stats.rx_length_errors++;
return retval;
}
- buf = urb->transfer_buffer + le16_to_cpu(dpe->wDatagramIndex);
- len = le16_to_cpu(dpe->wDatagramLength);
+ buf = urb->transfer_buffer + dg_idx;
- retval = ipheth_consume_skb(buf, len, dev);
+ retval = ipheth_consume_skb(buf, dg_len, dev);
if (retval != 0)
return retval;
dpe++;
}
- return 0;
+rx_error:
+ dev->net->stats.rx_errors++;
+ return retval;
}
static void ipheth_rcvbulk_callback(struct urb *urb)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 238/443] usbnet: ipheth: break up NCM header size computation
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 237/443] usbnet: ipheth: refactor NCM datagram loop Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 239/443] usbnet: ipheth: fix DPE OoB read Greg Kroah-Hartman
` (215 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Foster Snowhill, Jakub Kicinski,
Paolo Abeni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <forst@pen.gy>
commit efcbc678a14be268040ffc1fa33c98faf2d55141 upstream.
Originally, the total NCM header size was computed as the sum of two
vaguely labelled constants. While accurate, it wasn't particularly clear
where they were coming from.
Use sizes of existing NCM structs where available. Define the total
NDP16 size based on the maximum amount of DPEs that can fit into the
iOS-specific fixed-size header.
This change does not fix any particular issue. Rather, it introduces
intermediate constants that will simplify subsequent commits.
It should also make it clearer for the reader where the constant values
come from.
Cc: stable@vger.kernel.org # 6.5.x
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -61,7 +61,18 @@
#define IPHETH_USBINTF_PROTO 1
#define IPHETH_IP_ALIGN 2 /* padding at front of URB */
-#define IPHETH_NCM_HEADER_SIZE (12 + 96) /* NCMH + NCM0 */
+/* On iOS devices, NCM headers in RX have a fixed size regardless of DPE count:
+ * - NTH16 (NCMH): 12 bytes, as per CDC NCM 1.0 spec
+ * - NDP16 (NCM0): 96 bytes, of which
+ * - NDP16 fixed header: 8 bytes
+ * - maximum of 22 DPEs (21 datagrams + trailer), 4 bytes each
+ */
+#define IPHETH_NDP16_MAX_DPE 22
+#define IPHETH_NDP16_HEADER_SIZE (sizeof(struct usb_cdc_ncm_ndp16) + \
+ IPHETH_NDP16_MAX_DPE * \
+ sizeof(struct usb_cdc_ncm_dpe16))
+#define IPHETH_NCM_HEADER_SIZE (sizeof(struct usb_cdc_ncm_nth16) + \
+ IPHETH_NDP16_HEADER_SIZE)
#define IPHETH_TX_BUF_SIZE ETH_FRAME_LEN
#define IPHETH_RX_BUF_SIZE_LEGACY (IPHETH_IP_ALIGN + ETH_FRAME_LEN)
#define IPHETH_RX_BUF_SIZE_NCM 65536
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 239/443] usbnet: ipheth: fix DPE OoB read
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 238/443] usbnet: ipheth: break up NCM header size computation Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 240/443] usbnet: ipheth: document scope of NCM implementation Greg Kroah-Hartman
` (214 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Foster Snowhill, Jakub Kicinski,
Paolo Abeni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <forst@pen.gy>
commit ee591f2b281721171896117f9946fced31441418 upstream.
Fix an out-of-bounds DPE read, limit the number of processed DPEs to
the amount that fits into the fixed-size NDP16 header.
Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support")
Cc: stable@vger.kernel.org
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -246,7 +246,7 @@ static int ipheth_rcvbulk_callback_ncm(s
goto rx_error;
dpe = ncm0->dpe16;
- while (true) {
+ for (int dpe_i = 0; dpe_i < IPHETH_NDP16_MAX_DPE; ++dpe_i, ++dpe) {
dg_idx = le16_to_cpu(dpe->wDatagramIndex);
dg_len = le16_to_cpu(dpe->wDatagramLength);
@@ -268,8 +268,6 @@ static int ipheth_rcvbulk_callback_ncm(s
retval = ipheth_consume_skb(buf, dg_len, dev);
if (retval != 0)
return retval;
-
- dpe++;
}
rx_error:
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 240/443] usbnet: ipheth: document scope of NCM implementation
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 239/443] usbnet: ipheth: fix DPE OoB read Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 241/443] arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies Greg Kroah-Hartman
` (213 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Foster Snowhill, Jakub Kicinski,
Paolo Abeni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <forst@pen.gy>
commit be154b598fa54136e2be17d6dd13c8a8bc0078ce upstream.
Clarify that the "NCM" implementation in `ipheth` is very limited, as
iOS devices aren't compatible with the CDC NCM specification in regular
tethering mode.
For a standards-compliant implementation, one shall turn to
the `cdc_ncm` module.
Cc: stable@vger.kernel.org # 6.5.x
Signed-off-by: Foster Snowhill <forst@pen.gy>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -218,6 +218,14 @@ static int ipheth_rcvbulk_callback_legac
return ipheth_consume_skb(buf, len, dev);
}
+/* In "NCM mode", the iOS device encapsulates RX (phone->computer) traffic
+ * in NCM Transfer Blocks (similarly to CDC NCM). However, unlike reverse
+ * tethering (handled by the `cdc_ncm` driver), regular tethering is not
+ * compliant with the CDC NCM spec, as the device is missing the necessary
+ * descriptors, and TX (computer->phone) traffic is not encapsulated
+ * at all. Thus `ipheth` implements a very limited subset of the spec with
+ * the sole purpose of parsing RX URBs.
+ */
static int ipheth_rcvbulk_callback_ncm(struct urb *urb)
{
struct usb_cdc_ncm_nth16 *ncmh;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 241/443] arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 240/443] usbnet: ipheth: document scope of NCM implementation Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 242/443] arm64: dts: qcom: x1e80100-dell-xps13-9345: " Greg Kroah-Hartman
` (212 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Maud Spierings,
Johan Hovold, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit bf5e9aa844ca74e9c202d8de2ce7390d24ec38a4 upstream.
On the X1E80100 CRD, &vreg_l3e_1p2 only powers &usb_mp_qmpphy0/1
(i.e. USBSS_3 and USBSS_4). The QMP PHYs for USB_0, USB_1 and USB_2
are actually powered by &vreg_l2j_1p2.
Since x1e80100-asus-vivobook-s15 mostly just mirrors the power supplies
from the x1e80100-crd device tree, assume that the fix also applies here.
Cc: stable@vger.kernel.org
Fixes: d0e2f8f62dff ("arm64: dts: qcom: Add device tree for ASUS Vivobook S 15")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Tested-by: Maud Spierings <maud_spierings@hotmail.com>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241210-x1e80100-usb-qmp-supply-fix-v1-3-0adda5d30bbd@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100-asus-vivobook-s15.dts
+++ b/arch/arm64/boot/dts/qcom/x1e80100-asus-vivobook-s15.dts
@@ -591,7 +591,7 @@
};
&usb_1_ss0_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l1j_0p8>;
status = "okay";
@@ -623,7 +623,7 @@
};
&usb_1_ss1_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 242/443] arm64: dts: qcom: x1e80100-dell-xps13-9345: Fix USB QMP PHY supplies
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 241/443] arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 243/443] arm64: dts: qcom: x1e80100-qcp: " Greg Kroah-Hartman
` (211 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold,
Aleksandrs Vinarskis, Johan Hovold, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit 26a1b22aaf0c6f5128f8d0242caf3d983d5a2836 upstream.
On the X1E80100 CRD, &vreg_l3e_1p2 only powers &usb_mp_qmpphy0/1
(i.e. USBSS_3 and USBSS_4). The QMP PHYs for USB_0, USB_1 and USB_2
are actually powered by &vreg_l2j_1p2.
Since x1e80100-dell-xps13-9345 mostly just mirrors the power supplies from
the x1e80100-crd device tree, assume that the fix also applies here.
Cc: stable@vger.kernel.org
Fixes: f5b788d0e8cd ("arm64: dts: qcom: Add support for X1-based Dell XPS 13 9345")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Tested-by: Aleksandrs Vinarskis <alex.vinarskis@gmail.com>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241210-x1e80100-usb-qmp-supply-fix-v1-5-0adda5d30bbd@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100-dell-xps13-9345.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100-dell-xps13-9345.dts
+++ b/arch/arm64/boot/dts/qcom/x1e80100-dell-xps13-9345.dts
@@ -820,7 +820,7 @@
};
&usb_1_ss0_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l1j_0p9>;
status = "okay";
@@ -852,7 +852,7 @@
};
&usb_1_ss1_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 243/443] arm64: dts: qcom: x1e80100-qcp: Fix USB QMP PHY supplies
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 242/443] arm64: dts: qcom: x1e80100-dell-xps13-9345: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 244/443] arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: " Greg Kroah-Hartman
` (210 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Johan Hovold,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit 4861ba7cf5a49969dee258dda2bf8d4e819135d1 upstream.
On the X1E80100 QCP, &vreg_l3e_1p2 only powers &usb_mp_qmpphy0/1
(i.e. USBSS_3 and USBSS_4). The QMP PHYs for USB_0, USB_1 and USB_2
are actually powered by &vreg_l2j_1p2.
Cc: stable@vger.kernel.org
Fixes: 20676f7819d7 ("arm64: dts: qcom: x1e80100-qcp: Fix USB PHYs regulators")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241210-x1e80100-usb-qmp-supply-fix-v1-8-0adda5d30bbd@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
+++ b/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
@@ -896,7 +896,7 @@
};
&usb_1_ss0_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l1j_0p8>;
status = "okay";
@@ -928,7 +928,7 @@
};
&usb_1_ss1_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
@@ -960,7 +960,7 @@
};
&usb_1_ss2_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 244/443] arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Fix USB QMP PHY supplies
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 243/443] arm64: dts: qcom: x1e80100-qcp: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 245/443] arm64: dts: qcom: x1e80100-crd: " Greg Kroah-Hartman
` (209 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Johan Hovold,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit 6efc01b75f819a2988aa9392f93a4d6501871525 upstream.
On the X1E80100 CRD, &vreg_l3e_1p2 only powers &usb_mp_qmpphy0/1
(i.e. USBSS_3 and USBSS_4). The QMP PHYs for USB_0, USB_1 and USB_2
are actually powered by &vreg_l2j_1p2.
Since x1e78100-lenovo-thinkpad-t14s mostly just mirrors the power supplies
from the x1e80100-crd device tree, assume that the fix also applies here.
Cc: stable@vger.kernel.org
Fixes: 7d1cbe2f4985 ("arm64: dts: qcom: Add X1E78100 ThinkPad T14s Gen 6")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241210-x1e80100-usb-qmp-supply-fix-v1-2-0adda5d30bbd@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e78100-lenovo-thinkpad-t14s.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e78100-lenovo-thinkpad-t14s.dts
+++ b/arch/arm64/boot/dts/qcom/x1e78100-lenovo-thinkpad-t14s.dts
@@ -763,7 +763,7 @@
};
&usb_1_ss0_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l1j_0p8>;
status = "okay";
@@ -795,7 +795,7 @@
};
&usb_1_ss1_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 245/443] arm64: dts: qcom: x1e80100-crd: Fix USB QMP PHY supplies
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 244/443] arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 246/443] arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: " Greg Kroah-Hartman
` (208 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Johan Hovold,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit 789209dd08124da448bfa7524b21049a04d98f83 upstream.
On the X1E80100 CRD, &vreg_l3e_1p2 only powers &usb_mp_qmpphy0/1
(i.e. USBSS_3 and USBSS_4). The QMP PHYs for USB_0, USB_1 and USB_2
are actually powered by &vreg_l2j_1p2.
Cc: stable@vger.kernel.org
Fixes: ae5cee8e7349 ("arm64: dts: qcom: x1e80100-crd: Fix USB PHYs regulators")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241210-x1e80100-usb-qmp-supply-fix-v1-4-0adda5d30bbd@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100-crd.dts
+++ b/arch/arm64/boot/dts/qcom/x1e80100-crd.dts
@@ -1187,7 +1187,7 @@
};
&usb_1_ss0_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l1j_0p8>;
status = "okay";
@@ -1219,7 +1219,7 @@
};
&usb_1_ss1_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
@@ -1251,7 +1251,7 @@
};
&usb_1_ss2_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 246/443] arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix USB QMP PHY supplies
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 245/443] arm64: dts: qcom: x1e80100-crd: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 247/443] arm64: dts: qcom: x1e80100-microsoft-romulus: " Greg Kroah-Hartman
` (207 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Johan Hovold,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit 6ba8e1b8242d27dd83ed4ce58a104c709e72f45f upstream.
On the X1E80100 CRD, &vreg_l3e_1p2 only powers &usb_mp_qmpphy0/1
(i.e. USBSS_3 and USBSS_4). The QMP PHYs for USB_0, USB_1 and USB_2
are actually powered by &vreg_l2j_1p2.
Since x1e80100-lenovo-yoga-slim7x mostly just mirrors the power supplies
from the x1e80100-crd device tree, assume that the fix also applies here.
Cc: stable@vger.kernel.org
Fixes: 45247fe17db2 ("arm64: dts: qcom: x1e80100: add Lenovo Thinkpad Yoga slim 7x devicetree")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241210-x1e80100-usb-qmp-supply-fix-v1-6-0adda5d30bbd@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts
+++ b/arch/arm64/boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts
@@ -908,7 +908,7 @@
};
&usb_1_ss0_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l1j_0p8>;
status = "okay";
@@ -940,7 +940,7 @@
};
&usb_1_ss1_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
@@ -972,7 +972,7 @@
};
&usb_1_ss2_qmpphy {
- vdda-phy-supply = <&vreg_l3e_1p2>;
+ vdda-phy-supply = <&vreg_l2j_1p2>;
vdda-pll-supply = <&vreg_l2d_0p9>;
status = "okay";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 247/443] arm64: dts: qcom: x1e80100-microsoft-romulus: Fix USB QMP PHY supplies
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 246/443] arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 248/443] arm64: dts: qcom: x1e80100: Fix usb_2 controller interrupts Greg Kroah-Hartman
` (206 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Johan Hovold,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit c0562f51b177d49829a378b5aeda73f78c60d0fc upstream.
On the X1E80100 CRD, &vreg_l3e_1p2 only powers &usb_mp_qmpphy0/1
(i.e. USBSS_3 and USBSS_4). The QMP PHYs for USB_0, USB_1 and USB_2
are actually powered by &vreg_l2j_1p2.
Since x1e80100-microsoft-romulus mostly just mirrors the power supplies
from the x1e80100-crd device tree, assume that the fix also applies here.
Cc: stable@vger.kernel.org
Fixes: 09d77be56093 ("arm64: dts: qcom: Add support for X1-based Surface Laptop 7 devices")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241210-x1e80100-usb-qmp-supply-fix-v1-7-0adda5d30bbd@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus.dtsi
@@ -823,7 +823,7 @@
};
&usb_1_ss0_qmpphy {
- vdda-phy-supply = <&vreg_l3e>;
+ vdda-phy-supply = <&vreg_l2j>;
vdda-pll-supply = <&vreg_l1j>;
status = "okay";
@@ -855,7 +855,7 @@
};
&usb_1_ss1_qmpphy {
- vdda-phy-supply = <&vreg_l3e>;
+ vdda-phy-supply = <&vreg_l2j>;
vdda-pll-supply = <&vreg_l2d>;
status = "okay";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 248/443] arm64: dts: qcom: x1e80100: Fix usb_2 controller interrupts
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 247/443] arm64: dts: qcom: x1e80100-microsoft-romulus: " Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 249/443] ASoC: renesas: rz-ssi: Terminate all the DMA transactions Greg Kroah-Hartman
` (205 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Vesa, Johan Hovold,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Vesa <abel.vesa@linaro.org>
commit 680421056216efe727ff4ed48f481691d5873b9e upstream.
Back when the CRD support was brought up, the usb_2 controller didn't
have anything connected to it in order to test it properly, so it was
never enabled.
On the Lenovo ThinkPad T14s, the usb_2 controller has the fingerprint
controller connected to it. So enabling it, proved that the interrupts
lines were wrong from the start.
Fix both the pwr_event and the DWC ctrl_irq lines, according to
documentation.
Fixes: 4af46b7bd66f ("arm64: dts: qcom: x1e80100: Add USB nodes")
Cc: stable@vger.kernel.org # 6.9
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20250107-x1e80100-fix-usb2-controller-irqs-v1-1-4689aa9852a7@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
@@ -4118,7 +4118,7 @@
<&gcc GCC_USB20_MASTER_CLK>;
assigned-clock-rates = <19200000>, <200000000>;
- interrupts-extended = <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+ interrupts-extended = <&intc GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
<&pdc 50 IRQ_TYPE_EDGE_BOTH>,
<&pdc 49 IRQ_TYPE_EDGE_BOTH>;
interrupt-names = "pwr_event",
@@ -4144,7 +4144,7 @@
usb_2_dwc3: usb@a200000 {
compatible = "snps,dwc3";
reg = <0 0x0a200000 0 0xcd00>;
- interrupts = <GIC_SPI 241 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>;
iommus = <&apps_smmu 0x14e0 0x0>;
phys = <&usb_2_hsphy>;
phy-names = "usb2-phy";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 249/443] ASoC: renesas: rz-ssi: Terminate all the DMA transactions
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 248/443] arm64: dts: qcom: x1e80100: Fix usb_2 controller interrupts Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 250/443] ASoC: renesas: rz-ssi: Add a check for negative sample_space Greg Kroah-Hartman
` (204 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Biju Das, Claudiu Beznea,
Geert Uytterhoeven, Mark Brown
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 541011dc2d7c4c82523706f726f422a5e23cc86f upstream.
The stop trigger invokes rz_ssi_stop() and rz_ssi_stream_quit().
- The purpose of rz_ssi_stop() is to disable TX/RX, terminate DMA
transactions, and set the controller to idle.
- The purpose of rz_ssi_stream_quit() is to reset the substream-specific
software data by setting strm->running and strm->substream appropriately.
The function rz_ssi_is_stream_running() checks if both strm->substream and
strm->running are valid and returns true if so. Its implementation is as
follows:
static inline bool rz_ssi_is_stream_running(struct rz_ssi_stream *strm)
{
return strm->substream && strm->running;
}
When the controller is configured in full-duplex mode (with both playback
and capture active), the rz_ssi_stop() function does not modify the
controller settings when called for the first substream in the full-duplex
setup. Instead, it simply sets strm->running = 0 and returns if the
companion substream is still running. The following code illustrates this:
static int rz_ssi_stop(struct rz_ssi_priv *ssi, struct rz_ssi_stream *strm)
{
strm->running = 0;
if (rz_ssi_is_stream_running(&ssi->playback) ||
rz_ssi_is_stream_running(&ssi->capture))
return 0;
// ...
}
The controller settings, along with the DMA termination (for the last
stopped substream), are only applied when the last substream in the
full-duplex setup is stopped.
While applying the controller settings only when the last substream stops
is not problematic, terminating the DMA operations for only one substream
causes failures when starting and stopping full-duplex operations multiple
times in a loop.
To address this issue, call dmaengine_terminate_async() for both substreams
involved in the full-duplex setup when the last substream in the setup is
stopped.
Fixes: 4f8cd05a4305 ("ASoC: sh: rz-ssi: Add full duplex support")
Cc: stable@vger.kernel.org
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20241210170953.2936724-5-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/renesas/rz-ssi.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/sound/soc/renesas/rz-ssi.c
+++ b/sound/soc/renesas/rz-ssi.c
@@ -414,8 +414,12 @@ static int rz_ssi_stop(struct rz_ssi_pri
rz_ssi_reg_mask_setl(ssi, SSICR, SSICR_TEN | SSICR_REN, 0);
/* Cancel all remaining DMA transactions */
- if (rz_ssi_is_dma_enabled(ssi))
- dmaengine_terminate_async(strm->dma_ch);
+ if (rz_ssi_is_dma_enabled(ssi)) {
+ if (ssi->playback.dma_ch)
+ dmaengine_terminate_async(ssi->playback.dma_ch);
+ if (ssi->capture.dma_ch)
+ dmaengine_terminate_async(ssi->capture.dma_ch);
+ }
rz_ssi_set_idle(ssi);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 250/443] ASoC: renesas: rz-ssi: Add a check for negative sample_space
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 249/443] ASoC: renesas: rz-ssi: Terminate all the DMA transactions Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 251/443] ASoC: acp: Support microphone from Lenovo Go S Greg Kroah-Hartman
` (203 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Geert Uytterhoeven,
Mark Brown
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit 82a0a3e6f8c02b3236b55e784a083fa4ee07c321 upstream.
My static checker rule complains about this code. The concern is that
if "sample_space" is negative then the "sample_space >= runtime->channels"
condition will not work as intended because it will be type promoted to a
high unsigned int value.
strm->fifo_sample_size is SSI_FIFO_DEPTH (32). The SSIFSR_TDC_MASK is
0x3f. Without any further context it does seem like a reasonable warning
and it can't hurt to add a check for negatives.
Cc: stable@vger.kernel.org
Fixes: 03e786bd4341 ("ASoC: sh: Add RZ/G2L SSIF-2 driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/e07c3dc5-d885-4b04-a742-71f42243f4fd@stanley.mountain
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/renesas/rz-ssi.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/soc/renesas/rz-ssi.c
+++ b/sound/soc/renesas/rz-ssi.c
@@ -526,6 +526,8 @@ static int rz_ssi_pio_send(struct rz_ssi
sample_space = strm->fifo_sample_size;
ssifsr = rz_ssi_reg_readl(ssi, SSIFSR);
sample_space -= (ssifsr >> SSIFSR_TDC_SHIFT) & SSIFSR_TDC_MASK;
+ if (sample_space < 0)
+ return -EINVAL;
/* Only add full frames at a time */
while (frames_left && (sample_space >= runtime->channels)) {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 251/443] ASoC: acp: Support microphone from Lenovo Go S
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 250/443] ASoC: renesas: rz-ssi: Add a check for negative sample_space Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 252/443] soc: qcom: socinfo: Avoid out of bounds read of serial number Greg Kroah-Hartman
` (202 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, nijs1, pgriffais, mpearson-lenovo,
Mario Limonciello, Mark Brown
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit b9a8ea185f3f8024619b2e74b74375493c87df8c upstream.
On Lenovo Go S there is a DMIC connected to the ACP but the firmware
has no `AcpDmicConnected` ACPI _DSD.
Add a DMI entry for all possible Lenovo Go S SKUs to enable DMIC.
Cc: nijs1@lenovo.com
Cc: pgriffais@valvesoftware.com
Cc: mpearson-lenovo@squebb.ca
Cc: stable@vger.kernel.org
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://patch.msgid.link/20250123024915.2457115-1-superm1@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/amd/yc/acp6x-mach.c | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
--- a/sound/soc/amd/yc/acp6x-mach.c
+++ b/sound/soc/amd/yc/acp6x-mach.c
@@ -307,6 +307,34 @@ static const struct dmi_system_id yc_acp
{
.driver_data = &acp6x_card,
.matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "83L3"),
+ }
+ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "83N6"),
+ }
+ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "83Q2"),
+ }
+ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "83Q3"),
+ }
+ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
DMI_MATCH(DMI_PRODUCT_NAME, "UM5302TA"),
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 252/443] soc: qcom: socinfo: Avoid out of bounds read of serial number
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 251/443] ASoC: acp: Support microphone from Lenovo Go S Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 253/443] serial: sh-sci: Drop __initdata macro for port_cfg Greg Kroah-Hartman
` (201 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephan Gerhold, Dmitry Baryshkov,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit 22cf4fae6660b6e1a583a41cbf84e3046ca9ccd0 upstream.
On MSM8916 devices, the serial number exposed in sysfs is constant and does
not change across individual devices. It's always:
db410c:/sys/devices/soc0$ cat serial_number
2644893864
The firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not
have support for the serial_num field in the socinfo struct. There is an
existing check to avoid exposing the serial number in that case, but it's
not correct: When checking the item_size returned by SMEM, we need to make
sure the *end* of the serial_num is within bounds, instead of comparing
with the *start* offset. The serial_number currently exposed on MSM8916
devices is just an out of bounds read of whatever comes after the socinfo
struct in SMEM.
Fix this by changing offsetof() to offsetofend(), so that the size of the
field is also taken into account.
Cc: stable@vger.kernel.org
Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20241230-qcom-socinfo-serialno-oob-v1-1-9b7a890da3da@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/socinfo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/soc/qcom/socinfo.c
+++ b/drivers/soc/qcom/socinfo.c
@@ -796,7 +796,7 @@ static int qcom_socinfo_probe(struct pla
if (!qs->attr.soc_id || !qs->attr.revision)
return -ENOMEM;
- if (offsetof(struct socinfo, serial_num) <= item_size) {
+ if (offsetofend(struct socinfo, serial_num) <= item_size) {
qs->attr.serial_number = devm_kasprintf(&pdev->dev, GFP_KERNEL,
"%u",
le32_to_cpu(info->serial_num));
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 253/443] serial: sh-sci: Drop __initdata macro for port_cfg
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 252/443] soc: qcom: socinfo: Avoid out of bounds read of serial number Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:26 ` [PATCH 6.13 254/443] serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use Greg Kroah-Hartman
` (200 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Claudiu Beznea
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit eaeee4225dba30bef4d424bdf134a07b7f423e8b upstream.
The port_cfg object is used by serial_console_write(), which serves as
the write function for the earlycon device. Marking port_cfg as __initdata
causes it to be freed after kernel initialization, resulting in earlycon
becoming unavailable thereafter. Remove the __initdata macro from port_cfg
to resolve this issue.
Fixes: 0b0cced19ab1 ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support")
Cc: stable@vger.kernel.org
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Fixes: 0b0cced19ab15c9e ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support")
Link: https://lore.kernel.org/r/20250116182249.3828577-2-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sh-sci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -3562,7 +3562,7 @@ sh_early_platform_init_buffer("earlyprin
early_serial_buf, ARRAY_SIZE(early_serial_buf));
#endif
#ifdef CONFIG_SERIAL_SH_SCI_EARLYCON
-static struct plat_sci_port port_cfg __initdata;
+static struct plat_sci_port port_cfg;
static int __init early_console_setup(struct earlycon_device *device,
int type)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 254/443] serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 253/443] serial: sh-sci: Drop __initdata macro for port_cfg Greg Kroah-Hartman
@ 2025-02-13 14:26 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 255/443] MIPS: Loongson64: remove ROM Size unit in boardinfo Greg Kroah-Hartman
` (199 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Claudiu Beznea
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
commit 9f7dea875cc7f9c1a56a5c688290634a59cd1420 upstream.
In the sh-sci driver, sci_ports[0] is used by earlycon. If the earlycon is
still active when sci_probe() is called and the new serial port is supposed
to map to sci_ports[0], return -EBUSY to prevent breaking the earlycon.
This situation should occurs in debug scenarios, and users should be
aware of the potential conflict.
Fixes: 0b0cced19ab1 ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support")
Cc: stable@vger.kernel.org
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://lore.kernel.org/r/20250116182249.3828577-4-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sh-sci.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -165,6 +165,7 @@ struct sci_port {
static struct sci_port sci_ports[SCI_NPORTS];
static unsigned long sci_ports_in_use;
static struct uart_driver sci_uart_driver;
+static bool sci_uart_earlycon;
static inline struct sci_port *
to_sci_port(struct uart_port *uart)
@@ -3450,6 +3451,7 @@ static int sci_probe_single(struct platf
static int sci_probe(struct platform_device *dev)
{
struct plat_sci_port *p;
+ struct resource *res;
struct sci_port *sp;
unsigned int dev_id;
int ret;
@@ -3479,6 +3481,26 @@ static int sci_probe(struct platform_dev
}
sp = &sci_ports[dev_id];
+
+ /*
+ * In case:
+ * - the probed port alias is zero (as the one used by earlycon), and
+ * - the earlycon is still active (e.g., "earlycon keep_bootcon" in
+ * bootargs)
+ *
+ * defer the probe of this serial. This is a debug scenario and the user
+ * must be aware of it.
+ *
+ * Except when the probed port is the same as the earlycon port.
+ */
+
+ res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ if (!res)
+ return -ENODEV;
+
+ if (sci_uart_earlycon && sp == &sci_ports[0] && sp->port.mapbase != res->start)
+ return dev_err_probe(&dev->dev, -EBUSY, "sci_port[0] is used by earlycon!\n");
+
platform_set_drvdata(dev, sp);
ret = sci_probe_single(dev, dev_id, p, sp);
@@ -3575,6 +3597,7 @@ static int __init early_console_setup(st
port_cfg.type = type;
sci_ports[0].cfg = &port_cfg;
sci_ports[0].params = sci_probe_regmap(&port_cfg);
+ sci_uart_earlycon = true;
port_cfg.scscr = sci_serial_in(&sci_ports[0].port, SCSCR);
sci_serial_out(&sci_ports[0].port, SCSCR,
SCSCR_RE | SCSCR_TE | port_cfg.scscr);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 255/443] MIPS: Loongson64: remove ROM Size unit in boardinfo
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2025-02-13 14:26 ` [PATCH 6.13 254/443] serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 256/443] LoongArch: Extend the maximum number of watchpoints Greg Kroah-Hartman
` (198 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mingcong Bai, Icenowy Zheng,
Kexy Biscuit, Jiaxun Yang, Thomas Bogendoerfer
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kexy Biscuit <kexybiscuit@aosc.io>
commit bd2212d658d7659b9d83c7e2f3a06789d4db1e90 upstream.
Per Appendix A.7 in Q/LS 0013-2014 (龙芯CPU开发系统固件与内核接口规范 V2.2,
lit. Loongson DevSys Firmware Kernel Interface Specification V2.2),
interface_info.size is size of this interface, not size of the LEFI BIOS
ROM.
In any case, the BIOS ROM Size just cannot be several kilobytes (KB) on
Loongson64 LEFI platforms.
Reported-by: Mingcong Bai <jeffbai@aosc.io>
Suggested-by: Icenowy Zheng <uwu@icenowy.me>
Fixes: 6c1bfbd9df8c ("MIPS: Loongson64: Add /sys/firmware/lefi/boardinfo")
Cc: stable@vger.kernel.org
Signed-off-by: Kexy Biscuit <kexybiscuit@aosc.io>
Acked-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/loongson64/boardinfo.c | 2 --
1 file changed, 2 deletions(-)
--- a/arch/mips/loongson64/boardinfo.c
+++ b/arch/mips/loongson64/boardinfo.c
@@ -21,13 +21,11 @@ static ssize_t boardinfo_show(struct kob
"BIOS Info\n"
"Vendor\t\t\t: %s\n"
"Version\t\t\t: %s\n"
- "ROM Size\t\t: %d KB\n"
"Release Date\t\t: %s\n",
strsep(&tmp_board_manufacturer, "-"),
eboard->name,
strsep(&tmp_bios_vendor, "-"),
einter->description,
- einter->size,
especial->special_name);
}
static struct kobj_attribute boardinfo_attr = __ATTR(boardinfo, 0444,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 256/443] LoongArch: Extend the maximum number of watchpoints
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 255/443] MIPS: Loongson64: remove ROM Size unit in boardinfo Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 257/443] powerpc/pseries/eeh: Fix get PE state translation Greg Kroah-Hartman
` (197 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, WANG Xuerui, Xi Ruoyao, Tiezhu Yang,
Huacai Chen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
commit 531936dee53e471a3ec668de3c94ca357f54b7e8 upstream.
The maximum number of load/store watchpoints and fetch instruction
watchpoints is 14 each according to LoongArch Reference Manual, so
extend the maximum number of watchpoints from 8 to 14 for ptrace.
By the way, just simply change 8 to 14 for the definition in struct
user_watch_state at the beginning, but it may corrupt uapi, then add
a new struct user_watch_state_v2 directly.
As far as I can tell, the only users for this struct in the userspace
are GDB and LLDB, there are no any problems of software compatibility
between the application and kernel according to the analysis.
The compatibility problem has been considered while developing and
testing. When the applications in the userspace get watchpoint state,
the length will be specified which is no bigger than the sizeof struct
user_watch_state or user_watch_state_v2, the actual length is assigned
as the minimal value of the application and kernel in the generic code
of ptrace:
kernel/ptrace.c: ptrace_regset():
kiov->iov_len = min(kiov->iov_len,
(__kernel_size_t) (regset->n * regset->size));
if (req == PTRACE_GETREGSET)
return copy_regset_to_user(task, view, regset_no, 0,
kiov->iov_len, kiov->iov_base);
else
return copy_regset_from_user(task, view, regset_no, 0,
kiov->iov_len, kiov->iov_base);
For example, there are four kind of combinations, all of them work well.
(1) "older kernel + older gdb", the actual length is 8+(8+8+4+4)*8=200;
(2) "newer kernel + newer gdb", the actual length is 8+(8+8+4+4)*14=344;
(3) "older kernel + newer gdb", the actual length is 8+(8+8+4+4)*8=200;
(4) "newer kernel + older gdb", the actual length is 8+(8+8+4+4)*8=200.
Link: https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#control-and-status-registers-related-to-watchpoints
Cc: stable@vger.kernel.org
Fixes: 1a69f7a161a7 ("LoongArch: ptrace: Expose hardware breakpoints to debuggers")
Reviewed-by: WANG Xuerui <git@xen0n.name>
Reviewed-by: Xi Ruoyao <xry111@xry111.site>
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/include/uapi/asm/ptrace.h | 10 ++++++++++
arch/loongarch/kernel/ptrace.c | 6 +++---
2 files changed, 13 insertions(+), 3 deletions(-)
--- a/arch/loongarch/include/uapi/asm/ptrace.h
+++ b/arch/loongarch/include/uapi/asm/ptrace.h
@@ -72,6 +72,16 @@ struct user_watch_state {
} dbg_regs[8];
};
+struct user_watch_state_v2 {
+ uint64_t dbg_info;
+ struct {
+ uint64_t addr;
+ uint64_t mask;
+ uint32_t ctrl;
+ uint32_t pad;
+ } dbg_regs[14];
+};
+
#define PTRACE_SYSEMU 0x1f
#define PTRACE_SYSEMU_SINGLESTEP 0x20
--- a/arch/loongarch/kernel/ptrace.c
+++ b/arch/loongarch/kernel/ptrace.c
@@ -720,7 +720,7 @@ static int hw_break_set(struct task_stru
unsigned int note_type = regset->core_note_type;
/* Resource info */
- offset = offsetof(struct user_watch_state, dbg_regs);
+ offset = offsetof(struct user_watch_state_v2, dbg_regs);
user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 0, offset);
/* (address, mask, ctrl) registers */
@@ -920,7 +920,7 @@ static const struct user_regset loongarc
#ifdef CONFIG_HAVE_HW_BREAKPOINT
[REGSET_HW_BREAK] = {
.core_note_type = NT_LOONGARCH_HW_BREAK,
- .n = sizeof(struct user_watch_state) / sizeof(u32),
+ .n = sizeof(struct user_watch_state_v2) / sizeof(u32),
.size = sizeof(u32),
.align = sizeof(u32),
.regset_get = hw_break_get,
@@ -928,7 +928,7 @@ static const struct user_regset loongarc
},
[REGSET_HW_WATCH] = {
.core_note_type = NT_LOONGARCH_HW_WATCH,
- .n = sizeof(struct user_watch_state) / sizeof(u32),
+ .n = sizeof(struct user_watch_state_v2) / sizeof(u32),
.size = sizeof(u32),
.align = sizeof(u32),
.regset_get = hw_break_get,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 257/443] powerpc/pseries/eeh: Fix get PE state translation
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 256/443] LoongArch: Extend the maximum number of watchpoints Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 258/443] dm-crypt: dont update io->sector after kcryptd_crypt_write_io_submit() Greg Kroah-Hartman
` (196 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM),
Narayana Murty N, Madhavan Srinivasan
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Narayana Murty N <nnmlinux@linux.ibm.com>
commit 11b93559000c686ad7e5ab0547e76f21cc143844 upstream.
The PE Reset State "0" returned by RTAS calls
"ibm_read_slot_reset_[state|state2]" indicates that the reset is
deactivated and the PE is in a state where MMIO and DMA are allowed.
However, the current implementation of "pseries_eeh_get_state()" does
not reflect this, causing drivers to incorrectly assume that MMIO and
DMA operations cannot be resumed.
The userspace drivers as a part of EEH recovery using VFIO ioctls fail
to detect when the recovery process is complete. The VFIO_EEH_PE_GET_STATE
ioctl does not report the expected EEH_PE_STATE_NORMAL state, preventing
userspace drivers from functioning properly on pseries systems.
The patch addresses this issue by updating 'pseries_eeh_get_state()'
to include "EEH_STATE_MMIO_ENABLED" and "EEH_STATE_DMA_ENABLED" in
the result mask for PE Reset State "0". This ensures correct state
reporting to the callers, aligning the behavior with the PAPR specification
and fixing the bug in EEH recovery for VFIO user workflows.
Fixes: 00ba05a12b3c ("powerpc/pseries: Cleanup on pseries_eeh_get_state()")
Cc: stable@vger.kernel.org
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Narayana Murty N <nnmlinux@linux.ibm.com>
Link: https://lore.kernel.org/stable/20241212075044.10563-1-nnmlinux%40linux.ibm.com
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250116103954.17324-1-nnmlinux@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/eeh_pseries.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
@@ -580,8 +580,10 @@ static int pseries_eeh_get_state(struct
switch(rets[0]) {
case 0:
- result = EEH_STATE_MMIO_ACTIVE |
- EEH_STATE_DMA_ACTIVE;
+ result = EEH_STATE_MMIO_ACTIVE |
+ EEH_STATE_DMA_ACTIVE |
+ EEH_STATE_MMIO_ENABLED |
+ EEH_STATE_DMA_ENABLED;
break;
case 1:
result = EEH_STATE_RESET_ACTIVE |
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 258/443] dm-crypt: dont update io->sector after kcryptd_crypt_write_io_submit()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 257/443] powerpc/pseries/eeh: Fix get PE state translation Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 259/443] dm-crypt: track tag_offset in convert_context Greg Kroah-Hartman
` (195 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hou Tao, Mikulas Patocka
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <houtao1@huawei.com>
commit 9fdbbdbbc92b1474a87b89f8b964892a63734492 upstream.
The updates of io->sector are the leftovers when dm-crypt allocated
pages for partial write request. However, since commit cf2f1abfbd0db
("dm crypt: don't allocate pages for a partial request"), there is no
partial request anymore.
After the introduction of write request rb-tree, the updates of
io->sectors may interfere the insertion procedure, because ->sectors of
these write requests which have already been added in the rb-tree may be
changed during the insertion of new write request.
Fix it by removing these buggy updates of io->sectors. Considering these
updates only effect the write request rb-tree, the commit which
introduces the write request rb-tree is used as the fix tag.
Fixes: b3c5fd305249 ("dm crypt: sort writes")
Cc: stable@vger.kernel.org
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-crypt.c | 14 +++-----------
1 file changed, 3 insertions(+), 11 deletions(-)
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2092,7 +2092,6 @@ static void kcryptd_crypt_write_continue
struct crypt_config *cc = io->cc;
struct convert_context *ctx = &io->ctx;
int crypt_finished;
- sector_t sector = io->sector;
blk_status_t r;
wait_for_completion(&ctx->restart);
@@ -2109,10 +2108,8 @@ static void kcryptd_crypt_write_continue
}
/* Encryption was already finished, submit io now */
- if (crypt_finished) {
+ if (crypt_finished)
kcryptd_crypt_write_io_submit(io, 0);
- io->sector = sector;
- }
crypt_dec_pending(io);
}
@@ -2123,14 +2120,13 @@ static void kcryptd_crypt_write_convert(
struct convert_context *ctx = &io->ctx;
struct bio *clone;
int crypt_finished;
- sector_t sector = io->sector;
blk_status_t r;
/*
* Prevent io from disappearing until this function completes.
*/
crypt_inc_pending(io);
- crypt_convert_init(cc, ctx, NULL, io->base_bio, sector);
+ crypt_convert_init(cc, ctx, NULL, io->base_bio, io->sector);
clone = crypt_alloc_buffer(io, io->base_bio->bi_iter.bi_size);
if (unlikely(!clone)) {
@@ -2147,8 +2143,6 @@ static void kcryptd_crypt_write_convert(
io->ctx.iter_in = clone->bi_iter;
}
- sector += bio_sectors(clone);
-
crypt_inc_pending(io);
r = crypt_convert(cc, ctx,
test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags), true);
@@ -2172,10 +2166,8 @@ static void kcryptd_crypt_write_convert(
}
/* Encryption was already finished, submit io now */
- if (crypt_finished) {
+ if (crypt_finished)
kcryptd_crypt_write_io_submit(io, 0);
- io->sector = sector;
- }
dec:
crypt_dec_pending(io);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 259/443] dm-crypt: track tag_offset in convert_context
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 258/443] dm-crypt: dont update io->sector after kcryptd_crypt_write_io_submit() Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 260/443] mips/math-emu: fix emulation of the prefx instruction Greg Kroah-Hartman
` (194 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hou Tao, Mikulas Patocka
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <houtao1@huawei.com>
commit 8b8f8037765757861f899ed3a2bfb34525b5c065 upstream.
dm-crypt uses tag_offset to index the integrity metadata for each crypt
sector. When the initial crypt_convert() returns BLK_STS_DEV_RESOURCE,
dm-crypt will try to continue the crypt/decrypt procedure in a kworker.
However, it resets tag_offset as zero instead of using the tag_offset
related with current sector. It may return unexpected data when using
random IV or return unexpected integrity related error.
Fix the problem by tracking tag_offset in per-IO convert_context.
Therefore, when the crypt/decrypt procedure continues in a kworker, it
could use the next tag_offset saved in convert_context.
Fixes: 8abec36d1274 ("dm crypt: do not wait for backlogged crypto request completion in softirq")
Cc: stable@vger.kernel.org
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-crypt.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -59,6 +59,7 @@ struct convert_context {
struct bio *bio_out;
struct bvec_iter iter_out;
atomic_t cc_pending;
+ unsigned int tag_offset;
u64 cc_sector;
union {
struct skcipher_request *req;
@@ -1256,6 +1257,7 @@ static void crypt_convert_init(struct cr
if (bio_out)
ctx->iter_out = bio_out->bi_iter;
ctx->cc_sector = sector + cc->iv_offset;
+ ctx->tag_offset = 0;
init_completion(&ctx->restart);
}
@@ -1588,7 +1590,6 @@ static void crypt_free_req(struct crypt_
static blk_status_t crypt_convert(struct crypt_config *cc,
struct convert_context *ctx, bool atomic, bool reset_pending)
{
- unsigned int tag_offset = 0;
unsigned int sector_step = cc->sector_size >> SECTOR_SHIFT;
int r;
@@ -1611,9 +1612,9 @@ static blk_status_t crypt_convert(struct
atomic_inc(&ctx->cc_pending);
if (crypt_integrity_aead(cc))
- r = crypt_convert_block_aead(cc, ctx, ctx->r.req_aead, tag_offset);
+ r = crypt_convert_block_aead(cc, ctx, ctx->r.req_aead, ctx->tag_offset);
else
- r = crypt_convert_block_skcipher(cc, ctx, ctx->r.req, tag_offset);
+ r = crypt_convert_block_skcipher(cc, ctx, ctx->r.req, ctx->tag_offset);
switch (r) {
/*
@@ -1633,8 +1634,8 @@ static blk_status_t crypt_convert(struct
* exit and continue processing in a workqueue
*/
ctx->r.req = NULL;
+ ctx->tag_offset++;
ctx->cc_sector += sector_step;
- tag_offset++;
return BLK_STS_DEV_RESOURCE;
}
} else {
@@ -1648,8 +1649,8 @@ static blk_status_t crypt_convert(struct
*/
case -EINPROGRESS:
ctx->r.req = NULL;
+ ctx->tag_offset++;
ctx->cc_sector += sector_step;
- tag_offset++;
continue;
/*
* The request was already processed (synchronously).
@@ -1657,7 +1658,7 @@ static blk_status_t crypt_convert(struct
case 0:
atomic_dec(&ctx->cc_pending);
ctx->cc_sector += sector_step;
- tag_offset++;
+ ctx->tag_offset++;
if (!atomic)
cond_resched();
continue;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 260/443] mips/math-emu: fix emulation of the prefx instruction
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 259/443] dm-crypt: track tag_offset in convert_context Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 261/443] MIPS: pci-legacy: Override pci_address_to_pio Greg Kroah-Hartman
` (193 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mateusz Jończyk, Dengcheng Zhu,
Thomas Bogendoerfer, Ming Wang, Tiezhu Yang
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Jończyk <mat.jonczyk@o2.pl>
commit 42a39e4aa59a10aa4afdc14194f3ee63d2db94e1 upstream.
Currently, installation of Debian 12.8 for mipsel fails on machines
without an FPU [1]. This is caused by the fact that zstd (which is used
for initramfs compression) executes the prefx instruction, which is not
emulated properly by the kernel.
The prefx (Prefetch Indexed) instruction fetches data from memory into
the cache without any side effects. Though functionally unrelated, it
requires an FPU [2].
Bytecode format of this instruction ends on "001111" binary:
(prefx instruction format) & 0x0000003f = 0x0000000f
The code in fpux_emu() runs like so:
#define MIPSInst(x) x
#define MIPSInst_FMA_FFMT(x) (MIPSInst(x) & 0x00000007)
#define MIPSInst_FUNC(x) (MIPSInst(x) & 0x0000003f)
enum cop1x_func { ..., pfetch_op = 0x0f, ... };
...
switch (MIPSInst_FMA_FFMT(ir)) {
...
case 0x3:
if (MIPSInst_FUNC(ir) != pfetch_op)
return SIGILL;
/* ignore prefx operation */
break;
default:
return SIGILL;
}
That snippet above contains a logic error and the
if (MIPSInst_FUNC(ir) != pfetch_op)
comparison always fires.
When MIPSInst_FUNC(ir) is equal to pfetch_op, ir must end on 001111
binary. In this case, MIPSInst_FMA_FFMT(ir) must be equal to 0x7, which
does not match that case label.
This causes emulation failure for the prefx instruction. Fix it.
This has been broken by
commit 919af8b96c89 ("MIPS: Make definitions of MIPSInst_FMA_{FUNC,FMTM} consistent with MIPS64 manual")
which modified the MIPSInst_FMA_FFMT macro without updating the users.
Signed-off-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
Cc: stable@vger.kernel.org # after 3 weeks
Cc: Dengcheng Zhu <dzhu@wavecomp.com>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Ming Wang <wangming01@loongson.cn>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Fixes: 919af8b96c89 ("MIPS: Make definitions of MIPSInst_FMA_{FUNC,FMTM} consistent with MIPS64 manual")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1091858
[2] MIPS Architecture For Programmers Volume II-A: The MIPS32 Instruction Set
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
---
arch/mips/math-emu/cp1emu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -1660,7 +1660,7 @@ static int fpux_emu(struct pt_regs *xcp,
break;
}
- case 0x3:
+ case 0x7:
if (MIPSInst_FUNC(ir) != pfetch_op)
return SIGILL;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 261/443] MIPS: pci-legacy: Override pci_address_to_pio
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 260/443] mips/math-emu: fix emulation of the prefx instruction Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 262/443] Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT" Greg Kroah-Hartman
` (192 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mateusz Jończyk, Jiaxun Yang,
Thomas Bogendoerfer
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <jiaxun.yang@flygoat.com>
commit df1b8d6e89db0edd572a1e375f5d3dd5575b9a9b upstream.
pci-legacy systems are not using logic_pio to managed PIO
allocations, thus the generic pci_address_to_pio won't work
when PCI_IOBASE is defined.
Override the function to use architecture implementation to
fix the problem.
Cc: stable@vger.kernel.org
Fixes: 4bfb53e7d317 ("mips: add <asm-generic/io.h> including")
Reported-by: Mateusz Jończyk <mat.jonczyk@o2.pl>
Closes: https://lore.kernel.org/r/99f75c66-4c2d-45dc-a808-b5ba440c7551@app.fastmail.com/
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/pci/pci-legacy.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/mips/pci/pci-legacy.c
+++ b/arch/mips/pci/pci-legacy.c
@@ -29,6 +29,14 @@ static LIST_HEAD(controllers);
static int pci_initialized;
+unsigned long pci_address_to_pio(phys_addr_t address)
+{
+ if (address > IO_SPACE_LIMIT)
+ return (unsigned long)-1;
+
+ return (unsigned long) address;
+}
+
/*
* We need to avoid collisions with `mirrored' VGA ports
* and other strange ISA hardware, so we always want the
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 262/443] Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT"
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 261/443] MIPS: pci-legacy: Override pci_address_to_pio Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 263/443] block: dont revert iter for -EIOCBQUEUED Greg Kroah-Hartman
` (191 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiaxun Yang, Icenowy Zheng,
Xi Ruoyao, Thomas Bogendoerfer
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Ruoyao <xry111@xry111.site>
commit 078b831638e1aa06dd7ffa9f244c8ac6b2995561 upstream.
This reverts commit 426fa8e4fe7bb914b5977cbce453a9926bf5b2e6.
The commit has caused two issues on Loongson 3A4000:
1. The timestamp in dmesg become erratic, like:
[3.736957] amdgpu 0000:04:00.0: ... ...
[3.748895] [drm] Initialized amdgpu ... ...
[18446744073.381141] amdgpu 0000:04:00:0: ... ...
[1.613326] igb 0000:03:00.0 enp3s0: ... ...
2. More seriously, some workloads (for example, the test
stdlib/test-cxa_atexit2 in the Glibc test suite) triggers an RCU
stall and hang the system with a high probably (4 hangs out of 5
tests).
Revert this commit to use jiffie on Loongson MIPS systems and fix these
issues for now. The root cause may need more investigation.
Cc: stable@vger.kernel.org # 6.11+
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Cc: Icenowy Zheng <icenowy@aosc.io>
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/Kconfig | 1 -
1 file changed, 1 deletion(-)
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1084,7 +1084,6 @@ config CSRC_IOASIC
config CSRC_R4K
select CLOCKSOURCE_WATCHDOG if CPU_FREQ
- select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT
bool
config CSRC_SB1250
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 263/443] block: dont revert iter for -EIOCBQUEUED
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 262/443] Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT" Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 264/443] Revert "media: uvcvideo: Require entities to have a non-zero unique ID" Greg Kroah-Hartman
` (190 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
commit b13ee668e8280ca5b07f8ce2846b9957a8a10853 upstream.
blkdev_read_iter() has a few odd checks, like gating the position and
count adjustment on whether or not the result is bigger-than-or-equal to
zero (where bigger than makes more sense), and not checking the return
value of blkdev_direct_IO() before doing an iov_iter_revert(). The
latter can lead to attempting to revert with a negative value, which
when passed to iov_iter_revert() as an unsigned value will lead to
throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT.
Be sane and don't revert for -EIOCBQUEUED, like what is done in other
spots.
Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/fops.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/block/fops.c
+++ b/block/fops.c
@@ -758,11 +758,12 @@ static ssize_t blkdev_read_iter(struct k
file_accessed(iocb->ki_filp);
ret = blkdev_direct_IO(iocb, to);
- if (ret >= 0) {
+ if (ret > 0) {
iocb->ki_pos += ret;
count -= ret;
}
- iov_iter_revert(to, count - iov_iter_count(to));
+ if (ret != -EIOCBQUEUED)
+ iov_iter_revert(to, count - iov_iter_count(to));
if (ret < 0 || !count)
goto reexpand;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 264/443] Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 263/443] block: dont revert iter for -EIOCBQUEUED Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 265/443] firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available() Greg Kroah-Hartman
` (189 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomasz Sikora,
Thadeu Lima de Souza Cascardo, Laurent Pinchart, Hans de Goede,
Ricardo Ribalda, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
commit 8004d635f27bbccaa5c083c50d4d5302a6ffa00e upstream.
This reverts commit 3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195.
Tomasz has reported that his device, Generalplus Technology Inc. 808 Camera,
with ID 1b3f:2002, stopped being detected:
$ ls -l /dev/video*
zsh: no matches found: /dev/video*
[ 7.230599] usb 3-2: Found multiple Units with ID 5
This particular device is non-compliant, having both the Output Terminal
and Processing Unit with ID 5. uvc_scan_fallback, though, is able to build
a chain. However, when media elements are added and uvc_mc_create_links
call uvc_entity_by_id, it will get the incorrect entity,
media_create_pad_link will WARN, and it will fail to register the entities.
In order to reinstate support for such devices in a timely fashion,
reverting the fix for these warnings is appropriate. A proper fix that
considers the existence of such non-compliant devices will be submitted in
a later development cycle.
Reported-by: Tomasz Sikora <sikora.tomus@gmail.com>
Fixes: 3dd075fe8ebb ("media: uvcvideo: Require entities to have a non-zero unique ID")
Cc: stable@vger.kernel.org
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://lore.kernel.org/r/20250114200045.1401644-1-cascardo@igalia.com
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_driver.c | 70 ++++++++++++++-----------------------
1 file changed, 27 insertions(+), 43 deletions(-)
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -775,27 +775,14 @@ static const u8 uvc_media_transport_inpu
UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
-static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type,
- u16 id, unsigned int num_pads,
- unsigned int extra_size)
+static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
+ unsigned int num_pads, unsigned int extra_size)
{
struct uvc_entity *entity;
unsigned int num_inputs;
unsigned int size;
unsigned int i;
- /* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */
- if (id == 0) {
- dev_err(&dev->udev->dev, "Found Unit with invalid ID 0.\n");
- return ERR_PTR(-EINVAL);
- }
-
- /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */
- if (uvc_entity_by_id(dev, id)) {
- dev_err(&dev->udev->dev, "Found multiple Units with ID %u\n", id);
- return ERR_PTR(-EINVAL);
- }
-
extra_size = roundup(extra_size, sizeof(*entity->pads));
if (num_pads)
num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
@@ -805,7 +792,7 @@ static struct uvc_entity *uvc_alloc_new_
+ num_inputs;
entity = kzalloc(size, GFP_KERNEL);
if (entity == NULL)
- return ERR_PTR(-ENOMEM);
+ return NULL;
entity->id = id;
entity->type = type;
@@ -917,10 +904,10 @@ static int uvc_parse_vendor_control(stru
break;
}
- unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT,
- buffer[3], p + 1, 2 * n);
- if (IS_ERR(unit))
- return PTR_ERR(unit);
+ unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3],
+ p + 1, 2*n);
+ if (unit == NULL)
+ return -ENOMEM;
memcpy(unit->guid, &buffer[4], 16);
unit->extension.bNumControls = buffer[20];
@@ -1029,10 +1016,10 @@ static int uvc_parse_standard_control(st
return -EINVAL;
}
- term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT,
- buffer[3], 1, n + p);
- if (IS_ERR(term))
- return PTR_ERR(term);
+ term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3],
+ 1, n + p);
+ if (term == NULL)
+ return -ENOMEM;
if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) {
term->camera.bControlSize = n;
@@ -1088,10 +1075,10 @@ static int uvc_parse_standard_control(st
return 0;
}
- term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
- buffer[3], 1, 0);
- if (IS_ERR(term))
- return PTR_ERR(term);
+ term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3],
+ 1, 0);
+ if (term == NULL)
+ return -ENOMEM;
memcpy(term->baSourceID, &buffer[7], 1);
@@ -1110,10 +1097,9 @@ static int uvc_parse_standard_control(st
return -EINVAL;
}
- unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
- p + 1, 0);
- if (IS_ERR(unit))
- return PTR_ERR(unit);
+ unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0);
+ if (unit == NULL)
+ return -ENOMEM;
memcpy(unit->baSourceID, &buffer[5], p);
@@ -1133,9 +1119,9 @@ static int uvc_parse_standard_control(st
return -EINVAL;
}
- unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n);
- if (IS_ERR(unit))
- return PTR_ERR(unit);
+ unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n);
+ if (unit == NULL)
+ return -ENOMEM;
memcpy(unit->baSourceID, &buffer[4], 1);
unit->processing.wMaxMultiplier =
@@ -1162,10 +1148,9 @@ static int uvc_parse_standard_control(st
return -EINVAL;
}
- unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
- p + 1, n);
- if (IS_ERR(unit))
- return PTR_ERR(unit);
+ unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n);
+ if (unit == NULL)
+ return -ENOMEM;
memcpy(unit->guid, &buffer[4], 16);
unit->extension.bNumControls = buffer[20];
@@ -1305,10 +1290,9 @@ static int uvc_gpio_parse(struct uvc_dev
return dev_err_probe(&dev->udev->dev, irq,
"No IRQ for privacy GPIO\n");
- unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT,
- UVC_EXT_GPIO_UNIT_ID, 0, 1);
- if (IS_ERR(unit))
- return PTR_ERR(unit);
+ unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
+ if (!unit)
+ return -ENOMEM;
unit->gpio.gpio_privacy = gpio_privacy;
unit->gpio.irq = irq;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 265/443] firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 264/443] Revert "media: uvcvideo: Require entities to have a non-zero unique ID" Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 266/443] firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool() Greg Kroah-Hartman
` (188 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 0a744cceebd0480cb39587b3b1339d66a9d14063 upstream.
Commit 2e4955167ec5 ("firmware: qcom: scm: Fix __scm and waitq
completion variable initialization") introduced a write barrier in probe
function to store global '__scm' variable. It also claimed that it
added a read barrier, because as we all known barriers are paired (see
memory-barriers.txt: "Note that write barriers should normally be paired
with read or address-dependency barriers"), however it did not really
add it.
The offending commit used READ_ONCE() to access '__scm' global which is
not a barrier.
The barrier is needed so the store to '__scm' will be properly visible.
This is most likely not fatal in current driver design, because missing
read barrier would mean qcom_scm_is_available() callers will access old
value, NULL. Driver does not support unbinding and does not correctly
handle probe failures, thus there is no risk of stale or old pointer in
'__scm' variable.
However for code correctness, readability and to be sure that we did not
mess up something in this tricky topic of SMP barriers, add a read
barrier for accessing '__scm'. Change also comment from useless/obvious
what does barrier do, to what is expected: which other parts of the code
are involved here.
Fixes: 2e4955167ec5 ("firmware: qcom: scm: Fix __scm and waitq completion variable initialization")
Cc: stable@vger.kernel.org
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241209-qcom-scm-missing-barriers-and-all-sort-of-srap-v2-1-9061013c8d92@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/qcom/qcom_scm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -1867,7 +1867,8 @@ static int qcom_scm_qseecom_init(struct
*/
bool qcom_scm_is_available(void)
{
- return !!READ_ONCE(__scm);
+ /* Paired with smp_store_release() in qcom_scm_probe */
+ return !!smp_load_acquire(&__scm);
}
EXPORT_SYMBOL_GPL(qcom_scm_is_available);
@@ -2024,7 +2025,7 @@ static int qcom_scm_probe(struct platfor
if (ret)
return ret;
- /* Let all above stores be available after this */
+ /* Paired with smp_load_acquire() in qcom_scm_is_available(). */
smp_store_release(&__scm, scm);
irq = platform_get_irq_optional(pdev, 0);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 266/443] firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 265/443] firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available() Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 267/443] ALSA: hda/realtek: Enable headset mic on Positivo C6400 Greg Kroah-Hartman
` (187 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit b628510397b5cafa1f5d3e848a28affd1c635302 upstream.
Commit 2e4955167ec5 ("firmware: qcom: scm: Fix __scm and waitq
completion variable initialization") introduced a write barrier in probe
function to store global '__scm' variable. We all known barriers are
paired (see memory-barriers.txt: "Note that write barriers should
normally be paired with read or address-dependency barriers"), therefore
accessing it from concurrent contexts requires read barrier. Previous
commit added such barrier in qcom_scm_is_available(), so let's use that
directly.
Lack of this read barrier can result in fetching stale '__scm' variable
value, NULL, and dereferencing it.
Note that barrier in qcom_scm_is_available() satisfies here the control
dependency.
Fixes: ca61d6836e6f ("firmware: qcom: scm: fix a NULL-pointer dereference")
Fixes: 449d0d84bcd8 ("firmware: qcom: scm: smc: switch to using the SCM allocator")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241209-qcom-scm-missing-barriers-and-all-sort-of-srap-v2-2-9061013c8d92@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/qcom/qcom_scm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -217,7 +217,10 @@ static DEFINE_SPINLOCK(scm_query_lock);
struct qcom_tzmem_pool *qcom_scm_get_tzmem_pool(void)
{
- return __scm ? __scm->mempool : NULL;
+ if (!qcom_scm_is_available())
+ return NULL;
+
+ return __scm->mempool;
}
static enum qcom_scm_convention __get_convention(void)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 267/443] ALSA: hda/realtek: Enable headset mic on Positivo C6400
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 266/443] firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool() Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 268/443] ALSA: hda/realtek: Fix quirk matching for Legion Pro 7 Greg Kroah-Hartman
` (186 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Edson Juliano Drosdeck, Takashi Iwai
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
commit 1aec3ed2e3e1512aba15e7e790196a44efd5f0a7 upstream.
Positivo C6400 is equipped with ALC269VB, and it needs
ALC269VB_FIXUP_ASUS_ZENBOOK quirk to make its headset mic work.
Also must to limits the microphone boost.
Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20250114170619.11510-1-edson.drosdeck@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10965,6 +10965,7 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
SND_PCI_QUIRK(0x17aa, 0x9e56, "Lenovo ZhaoYang CF4620Z", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1849, 0x0269, "Positivo Master C6400", ALC269VB_FIXUP_ASUS_ZENBOOK),
SND_PCI_QUIRK(0x1849, 0x1233, "ASRock NUC Box 1100", ALC233_FIXUP_NO_AUDIO_JACK),
SND_PCI_QUIRK(0x1849, 0xa233, "Positivo Master C6300", ALC269_FIXUP_HEADSET_MIC),
SND_PCI_QUIRK(0x1854, 0x0440, "LG CQ6", ALC256_FIXUP_HEADPHONE_AMP_VOL),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 268/443] ALSA: hda/realtek: Fix quirk matching for Legion Pro 7
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 267/443] ALSA: hda/realtek: Enable headset mic on Positivo C6400 Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 269/443] ALSA: hda: Fix headset detection failure due to unstable sort Greg Kroah-Hartman
` (185 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Samantha Glocker
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 0f3a822ae2254a1e7ce3a130a1efd94e2cab73ee upstream.
The recent cleanup of the quirk table entries with the codec ID
matching caused a regression on some Lenovo Legion 7 models with PCI
SSID 17aa:386f: it assumed wrongly as if the codec SSID on the machine
were also 17aa:386f, but in this case, it was 17aa:38a8. This made
the binding with a wrong sub-codec, instead of TAS2781, the Cirrus
codec was bound.
For addressing the regression, correct the quirk entry to the right
value 17aa:38a8.
Note that this makes the entry appearing in an unsorted position.
This exception is needed because the entry must match before the PCI
SSID 17aa:386f.
Also there is another entry for 17aa:38a8, but the latter is for PCI
SSID matching while the new entry is for the codec SSID matching.
Fixes: 504f052aa343 ("ALSA: hda/realtek: Use codec SSID matching for Lenovo devices")
Reported-and-tested-by: Samantha Glocker <iam@anislandsomewhere.com>
Closes: https://lore.kernel.org/CAGPQRHYd48U__UKYj2jJnT4+dnNNoWRBi+wj6zPRn=JpNMBUrg@mail.gmail.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20250125120519.16420-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10890,7 +10890,7 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x17aa, 0x3869, "Lenovo Yoga7 14IAL7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN),
HDA_CODEC_QUIRK(0x17aa, 0x386e, "Legion Y9000X 2022 IAH7", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x17aa, 0x386e, "Yoga Pro 7 14ARP8", ALC285_FIXUP_SPEAKER2_TO_DAC1),
- HDA_CODEC_QUIRK(0x17aa, 0x386f, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C),
+ HDA_CODEC_QUIRK(0x17aa, 0x38a8, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C), /* this must match before PCI SSID 17aa:386f below */
SND_PCI_QUIRK(0x17aa, 0x386f, "Legion Pro 7i 16IAX7", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x17aa, 0x3870, "Lenovo Yoga 7 14ARB7", ALC287_FIXUP_YOGA7_14ARB7_I2C),
SND_PCI_QUIRK(0x17aa, 0x3877, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 269/443] ALSA: hda: Fix headset detection failure due to unstable sort
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 268/443] ALSA: hda/realtek: Fix quirk matching for Legion Pro 7 Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 270/443] ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 Greg Kroah-Hartman
` (184 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Austrum, Kuan-Wei Chiu, Takashi Iwai
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <visitorckw@gmail.com>
commit 3b4309546b48fc167aa615a2d881a09c0a97971f upstream.
The auto_parser assumed sort() was stable, but the kernel's sort() uses
heapsort, which has never been stable. After commit 0e02ca29a563
("lib/sort: optimize heapsort with double-pop variation"), the order of
equal elements changed, causing the headset to fail to work.
Fix the issue by recording the original order of elements before
sorting and using it as a tiebreaker for equal elements in the
comparison function.
Fixes: b9030a005d58 ("ALSA: hda - Use standard sort function in hda_auto_parser.c")
Reported-by: Austrum <austrum.lab@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219158
Tested-by: Austrum <austrum.lab@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Link: https://patch.msgid.link/20250128165415.643223-1-visitorckw@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_auto_parser.c | 8 +++++++-
sound/pci/hda/hda_auto_parser.h | 1 +
2 files changed, 8 insertions(+), 1 deletion(-)
--- a/sound/pci/hda/hda_auto_parser.c
+++ b/sound/pci/hda/hda_auto_parser.c
@@ -80,7 +80,11 @@ static int compare_input_type(const void
/* In case one has boost and the other one has not,
pick the one with boost first. */
- return (int)(b->has_boost_on_pin - a->has_boost_on_pin);
+ if (a->has_boost_on_pin != b->has_boost_on_pin)
+ return (int)(b->has_boost_on_pin - a->has_boost_on_pin);
+
+ /* Keep the original order */
+ return a->order - b->order;
}
/* Reorder the surround channels
@@ -400,6 +404,8 @@ int snd_hda_parse_pin_defcfg(struct hda_
reorder_outputs(cfg->speaker_outs, cfg->speaker_pins);
/* sort inputs in the order of AUTO_PIN_* type */
+ for (i = 0; i < cfg->num_inputs; i++)
+ cfg->inputs[i].order = i;
sort(cfg->inputs, cfg->num_inputs, sizeof(cfg->inputs[0]),
compare_input_type, NULL);
--- a/sound/pci/hda/hda_auto_parser.h
+++ b/sound/pci/hda/hda_auto_parser.h
@@ -37,6 +37,7 @@ struct auto_pin_cfg_item {
unsigned int is_headset_mic:1;
unsigned int is_headphone_mic:1; /* Mic-only in headphone jack */
unsigned int has_boost_on_pin:1;
+ int order;
};
struct auto_pin_cfg;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 270/443] ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 269/443] ALSA: hda: Fix headset detection failure due to unstable sort Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 271/443] arm64: tegra: Fix Tegra234 PCIe interrupt-map Greg Kroah-Hartman
` (183 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 8c2fa44132e8cd1b05c77a705adb8d1f5a5daf3f upstream.
It was reported that the headphone output on Dell Venue 11 Pro 7130
becomes mono after PM resume. The cause seems to be the BIOS setting
up the codec COEF 0x0d bit 0x40 wrongly by some reason, and restoring
the original value 0x2800 fixes the problem.
This patch adds the quirk entry to perform the COEF restore.
Cc: <stable@vger.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=219697
Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1235686
Link: https://patch.msgid.link/20250130123301.8996-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7485,6 +7485,16 @@ static void alc287_fixup_lenovo_thinkpad
spec->gen.pcm_playback_hook = alc287_alc1318_playback_pcm_hook;
}
+/*
+ * Clear COEF 0x0d (PCBEEP passthrough) bit 0x40 where BIOS sets it wrongly
+ * at PM resume
+ */
+static void alc283_fixup_dell_hp_resume(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+{
+ if (action == HDA_FIXUP_ACT_INIT)
+ alc_write_coef_idx(codec, 0xd, 0x2800);
+}
enum {
ALC269_FIXUP_GPIO2,
@@ -7785,6 +7795,7 @@ enum {
ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE,
ALC233_FIXUP_MEDION_MTL_SPK,
ALC294_FIXUP_BASS_SPEAKER_15,
+ ALC283_FIXUP_DELL_HP_RESUME,
};
/* A special fixup for Lenovo C940 and Yoga Duet 7;
@@ -10117,6 +10128,10 @@ static const struct hda_fixup alc269_fix
.type = HDA_FIXUP_FUNC,
.v.func = alc294_fixup_bass_speaker_15,
},
+ [ALC283_FIXUP_DELL_HP_RESUME] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc283_fixup_dell_hp_resume,
+ },
};
static const struct hda_quirk alc269_fixup_tbl[] = {
@@ -10177,6 +10192,7 @@ static const struct hda_quirk alc269_fix
SND_PCI_QUIRK(0x1028, 0x05f4, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x05f5, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1028, 0x05f6, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0604, "Dell Venue 11 Pro 7130", ALC283_FIXUP_DELL_HP_RESUME),
SND_PCI_QUIRK(0x1028, 0x0615, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK),
SND_PCI_QUIRK(0x1028, 0x0616, "Dell Vostro 5470", ALC290_FIXUP_SUBWOOFER_HSJACK),
SND_PCI_QUIRK(0x1028, 0x062c, "Dell Latitude E5550", ALC292_FIXUP_DELL_E7X),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 271/443] arm64: tegra: Fix Tegra234 PCIe interrupt-map
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 270/443] ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130 Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 272/443] s390/pci: Fix SR-IOV for PFs initially in standby Greg Kroah-Hartman
` (182 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Brad Griffis, Thierry Reding
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brad Griffis <bgriffis@nvidia.com>
commit b615fbd70fce8582d92b3bdbbf3c9b80cadcfb55 upstream.
For interrupt-map entries, the DTS specification requires
that #address-cells is defined for both the child node and the
interrupt parent. For the PCIe interrupt-map entries, the parent
node ("gic") has not specified #address-cells. The existing layout
of the PCIe interrupt-map entries indicates that it assumes
that #address-cells is zero for this node.
Explicitly set #address-cells to zero for "gic" so that it complies
with the device tree specification.
NVIDIA EDK2 works around this issue by assuming #address-cells
is zero in this scenario, but that workaround is being removed and so
this update is needed or else NVIDIA EDK2 cannot successfully parse the
device tree and the board cannot boot.
Fixes: ec142c44b026 ("arm64: tegra: Add P2U and PCIe controller nodes to Tegra234 DT")
Signed-off-by: Brad Griffis <bgriffis@nvidia.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20241213235602.452303-1-bgriffis@nvidia.com
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
@@ -4018,6 +4018,8 @@
#redistributor-regions = <1>;
#interrupt-cells = <3>;
interrupt-controller;
+
+ #address-cells = <0>;
};
smmu_iso: iommu@10000000 {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 272/443] s390/pci: Fix SR-IOV for PFs initially in standby
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 271/443] arm64: tegra: Fix Tegra234 PCIe interrupt-map Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 273/443] PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 Greg Kroah-Hartman
` (181 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gerd Bayer, Niklas Schnelle,
Alexander Gordeev
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <schnelle@linux.ibm.com>
commit dc287e4c9149ab54a5003b4d4da007818b5fda3d upstream.
Since commit 25f39d3dcb48 ("s390/pci: Ignore RID for isolated VFs") PFs
which are not initially configured but in standby are considered
isolated. That is they create only a single function PCI domain. Due to
the PCI domains being created on discovery, this means that even if they
are configured later on, sibling PFs and their child VFs will not be
added to their PCI domain breaking SR-IOV expectations.
The reason the referenced commit ignored standby PFs for the creation of
multi-function PCI subhierarchies, was to work around a PCI domain
renumbering scenario on reboot. The renumbering would occur after
removing a previously in standby PF, whose domain number is used for its
configured sibling PFs and their child VFs, but which itself remained in
standby. When this is followed by a reboot, the sibling PF is used
instead to determine the PCI domain number of it and its child VFs.
In principle it is not possible to know which standby PFs will be
configured later and which may be removed. The PCI domain and root bus
are pre-requisites for hotplug slots so the decision of which functions
belong to which domain can not be postponed. With the renumbering
occurring only in rare circumstances and being generally benign, accept
it as an oddity and fix SR-IOV for initially standby PFs simply by
allowing them to create PCI domains.
Cc: stable@vger.kernel.org
Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com>
Fixes: 25f39d3dcb48 ("s390/pci: Ignore RID for isolated VFs")
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/pci/pci_bus.c | 1 -
1 file changed, 1 deletion(-)
--- a/arch/s390/pci/pci_bus.c
+++ b/arch/s390/pci/pci_bus.c
@@ -171,7 +171,6 @@ void zpci_bus_scan_busses(void)
static bool zpci_bus_is_multifunction_root(struct zpci_dev *zdev)
{
return !s390_pci_no_rid && zdev->rid_available &&
- zpci_is_device_configured(zdev) &&
!zdev->vfn;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 273/443] PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 272/443] s390/pci: Fix SR-IOV for PFs initially in standby Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 274/443] PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() Greg Kroah-Hartman
` (180 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Georg Gottleuber,
Werner Sembach, Krzysztof Wilczyński
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Sembach <wse@tuxedocomputers.com>
commit b1049f2d68693c80a576c4578d96774a68df2bad upstream.
commit 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend") sets the
policy that all PCIe ports are allowed to use D3. When the system is
suspended if the port is not power manageable by the platform and won't be
used for wakeup via a PME this sets up the policy for these ports to go
into D3hot.
This policy generally makes sense from an OSPM perspective but it leads to
problems with wakeup from suspend on the TUXEDO Sirius 16 Gen 1 with a
specific old BIOS. This manifests as a system hang.
On the affected Device + BIOS combination, add a quirk for the root port of
the problematic controller to ensure that these root ports are not put into
D3hot at suspend.
This patch is based on
https://lore.kernel.org/linux-pci/20230708214457.1229-2-mario.limonciello@amd.com
but with the added condition both in the documentation and in the code to
apply only to the TUXEDO Sirius 16 Gen 1 with a specific old BIOS and only
the affected root ports.
Fixes: 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend")
Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://lore.kernel.org/r/20250114222436.1075456-1-wse@tuxedocomputers.com
Co-developed-by: Georg Gottleuber <ggo@tuxedocomputers.com>
Signed-off-by: Georg Gottleuber <ggo@tuxedocomputers.com>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Cc: <stable@vger.kernel.org> # 6.1+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/pci/fixup.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -1010,4 +1010,34 @@ DECLARE_PCI_FIXUP_SUSPEND(PCI_VENDOR_ID_
DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1668, amd_rp_pme_resume);
DECLARE_PCI_FIXUP_SUSPEND(PCI_VENDOR_ID_AMD, 0x1669, amd_rp_pme_suspend);
DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1669, amd_rp_pme_resume);
+
+/*
+ * Putting PCIe root ports on Ryzen SoCs with USB4 controllers into D3hot
+ * may cause problems when the system attempts wake up from s2idle.
+ *
+ * On the TUXEDO Sirius 16 Gen 1 with a specific old BIOS this manifests as
+ * a system hang.
+ */
+static const struct dmi_system_id quirk_tuxeo_rp_d3_dmi_table[] = {
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "APX958"),
+ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "V1.00A00_20240108"),
+ },
+ },
+ {}
+};
+
+static void quirk_tuxeo_rp_d3(struct pci_dev *pdev)
+{
+ struct pci_dev *root_pdev;
+
+ if (dmi_check_system(quirk_tuxeo_rp_d3_dmi_table)) {
+ root_pdev = pcie_find_root_port(pdev);
+ if (root_pdev)
+ root_pdev->dev_flags |= PCI_DEV_FLAGS_NO_D3;
+ }
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1502, quirk_tuxeo_rp_d3);
#endif /* CONFIG_SUSPEND */
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 274/443] PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 273/443] PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 275/443] PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar() Greg Kroah-Hartman
` (179 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zijun Hu, Bjorn Helgaas, Frank Li
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <quic_zijuhu@quicinc.com>
commit 3b9f942eb21c92041905e3943a8d5177c9a9d89d upstream.
When removing a virtual Endpoint, pci_epf_remove_vepf() failed to clear
epf_vf->epf_pf, which caused a subsequent pci_epf_add_vepf() to incorrectly
return -EBUSY:
pci_epf_add_vepf(epf_pf, epf_vf) // add
pci_epf_remove_vepf(epf_pf, epf_vf) // remove
pci_epf_add_vepf(epf_pf, epf_vf) // add again, -EBUSY error
Fix by clearing epf_vf->epf_pf in pci_epf_remove_vepf().
Link: https://lore.kernel.org/r/20241210-pci-epc-core_fix-v3-3-4d86dd573e4b@quicinc.com
Fixes: 1cf362e907f3 ("PCI: endpoint: Add support to add virtual function in endpoint core")
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/endpoint/pci-epf-core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/endpoint/pci-epf-core.c
+++ b/drivers/pci/endpoint/pci-epf-core.c
@@ -202,6 +202,7 @@ void pci_epf_remove_vepf(struct pci_epf
mutex_lock(&epf_pf->lock);
clear_bit(epf_vf->vfunc_no, &epf_pf->vfunction_num_map);
+ epf_vf->epf_pf = NULL;
list_del(&epf_vf->list);
mutex_unlock(&epf_pf->lock);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 275/443] PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 274/443] PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf() Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 276/443] PCI: dwc: ep: Prevent changing BAR size/flags " Greg Kroah-Hartman
` (178 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel,
Krzysztof Wilczyński, Manivannan Sadhasivam
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
commit 33a6938e0c3373f2d11f92d098f337668cd64fdd upstream.
The "DesignWare Cores PCI Express Controller Register Descriptions,
Version 4.60a", section "1.21.70 IATU_LWR_TARGET_ADDR_OFF_INBOUND_i",
fields LWR_TARGET_RW and LWR_TARGET_HW both state that:
"Field size depends on log2(BAR_MASK+1) in BAR match mode."
I.e. only the upper bits are writable, and the number of writable bits is
dependent on the configured BAR_MASK.
If we do not write the BAR_MASK before writing the iATU registers, we are
relying the reset value of the BAR_MASK being larger than the requested
BAR size (which is supplied in the struct pci_epf_bar which is passed to
pci_epc_set_bar()). The reset value of the BAR_MASK is SoC dependent.
Thus, if the struct pci_epf_bar requests a BAR size that is larger than the
reset value of the BAR_MASK, the iATU will try to write to read-only bits,
which will cause the iATU to end up redirecting to a physical address that
is different from the address that was intended.
Thus, we should always write the iATU registers after writing the BAR_MASK.
Fixes: f8aed6ec624f ("PCI: dwc: designware: Add EP mode support")
Link: https://lore.kernel.org/r/20241213143301.4158431-9-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pcie-designware-ep.c | 28 ++++++++++++------------
1 file changed, 15 insertions(+), 13 deletions(-)
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -222,19 +222,10 @@ static int dw_pcie_ep_set_bar(struct pci
if ((flags & PCI_BASE_ADDRESS_MEM_TYPE_64) && (bar & 1))
return -EINVAL;
- reg = PCI_BASE_ADDRESS_0 + (4 * bar);
-
- if (!(flags & PCI_BASE_ADDRESS_SPACE))
- type = PCIE_ATU_TYPE_MEM;
- else
- type = PCIE_ATU_TYPE_IO;
-
- ret = dw_pcie_ep_inbound_atu(ep, func_no, type, epf_bar->phys_addr, bar);
- if (ret)
- return ret;
-
if (ep->epf_bar[bar])
- return 0;
+ goto config_atu;
+
+ reg = PCI_BASE_ADDRESS_0 + (4 * bar);
dw_pcie_dbi_ro_wr_en(pci);
@@ -246,9 +237,20 @@ static int dw_pcie_ep_set_bar(struct pci
dw_pcie_ep_writel_dbi(ep, func_no, reg + 4, 0);
}
- ep->epf_bar[bar] = epf_bar;
dw_pcie_dbi_ro_wr_dis(pci);
+config_atu:
+ if (!(flags & PCI_BASE_ADDRESS_SPACE))
+ type = PCIE_ATU_TYPE_MEM;
+ else
+ type = PCIE_ATU_TYPE_IO;
+
+ ret = dw_pcie_ep_inbound_atu(ep, func_no, type, epf_bar->phys_addr, bar);
+ if (ret)
+ return ret;
+
+ ep->epf_bar[bar] = epf_bar;
+
return 0;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 276/443] PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 275/443] PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar() Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 277/443] nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk Greg Kroah-Hartman
` (177 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel,
Krzysztof Wilczyński, Manivannan Sadhasivam
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
commit 3708acbd5f169ebafe1faa519cb28adc56295546 upstream.
In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update
inbound map address") set_bar() was modified to support dynamically
changing the backing physical address of a BAR that was already configured.
This means that set_bar() can be called twice, without ever calling
clear_bar() (as calling clear_bar() would clear the BAR's PCI address
assigned by the host).
This can only be done if the new BAR size/flags does not differ from the
existing BAR configuration. Add these missing checks.
If we allow set_bar() to set e.g. a new BAR size that differs from the
existing BAR size, the new address translation range will be smaller than
the BAR size already determined by the host, which would mean that a read
past the new BAR size would pass the iATU untranslated, which could allow
the host to read memory not belonging to the new struct pci_epf_bar.
While at it, add comments which clarifies the support for dynamically
changing the physical address of a BAR. (Which was also missing.)
Fixes: 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address")
Link: https://lore.kernel.org/r/20241213143301.4158431-10-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pcie-designware-ep.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -222,8 +222,28 @@ static int dw_pcie_ep_set_bar(struct pci
if ((flags & PCI_BASE_ADDRESS_MEM_TYPE_64) && (bar & 1))
return -EINVAL;
- if (ep->epf_bar[bar])
+ /*
+ * Certain EPF drivers dynamically change the physical address of a BAR
+ * (i.e. they call set_bar() twice, without ever calling clear_bar(), as
+ * calling clear_bar() would clear the BAR's PCI address assigned by the
+ * host).
+ */
+ if (ep->epf_bar[bar]) {
+ /*
+ * We can only dynamically change a BAR if the new BAR size and
+ * BAR flags do not differ from the existing configuration.
+ */
+ if (ep->epf_bar[bar]->barno != bar ||
+ ep->epf_bar[bar]->size != size ||
+ ep->epf_bar[bar]->flags != flags)
+ return -EINVAL;
+
+ /*
+ * When dynamically changing a BAR, skip writing the BAR reg, as
+ * that would clear the BAR's PCI address assigned by the host.
+ */
goto config_atu;
+ }
reg = PCI_BASE_ADDRESS_0 + (4 * bar);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 277/443] nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 276/443] PCI: dwc: ep: Prevent changing BAR size/flags " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 278/443] nvme-pci: Add TUXEDO IBP Gen9 " Greg Kroah-Hartman
` (176 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georg Gottleuber, Werner Sembach,
Christoph Hellwig, Keith Busch
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georg Gottleuber <ggo@tuxedocomputers.com>
commit dbf2bb1a1319b7c7d8828905378a6696cca6b0f2 upstream.
On the TUXEDO InfinityFlex, a Samsung 990 Evo NVMe leads to a high power
consumption in s2idle sleep (4 watts).
This patch applies 'Force No Simple Suspend' quirk to achieve a sleep with
a lower power consumption, typically around 1.4 watts.
Signed-off-by: Georg Gottleuber <ggo@tuxedocomputers.com>
Cc: stable@vger.kernel.org
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3148,7 +3148,8 @@ static unsigned long check_vendor_combin
* because of high power consumption (> 2 Watt) in s2idle
* sleep. Only some boards with Intel CPU are affected.
*/
- if (dmi_match(DMI_BOARD_NAME, "GMxPXxx") ||
+ if (dmi_match(DMI_BOARD_NAME, "DN50Z-140HC-YD") ||
+ dmi_match(DMI_BOARD_NAME, "GMxPXxx") ||
dmi_match(DMI_BOARD_NAME, "PH4PG31") ||
dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1") ||
dmi_match(DMI_BOARD_NAME, "PH6PG01_PH6PG71"))
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 278/443] nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 277/443] nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 279/443] KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking Greg Kroah-Hartman
` (175 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georg Gottleuber, Werner Sembach,
Christoph Hellwig, Keith Busch
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georg Gottleuber <ggo@tuxedocomputers.com>
commit 11cb3529d18514f7d28ad2190533192aedefd761 upstream.
On the TUXEDO InfinityBook Pro Gen9 Intel, a Samsung 990 Evo NVMe leads to
a high power consumption in s2idle sleep (4 watts).
This patch applies 'Force No Simple Suspend' quirk to achieve a sleep with
a lower power consumption, typically around 1.2 watts.
Signed-off-by: Georg Gottleuber <ggo@tuxedocomputers.com>
Cc: stable@vger.kernel.org
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/pci.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3150,6 +3150,7 @@ static unsigned long check_vendor_combin
*/
if (dmi_match(DMI_BOARD_NAME, "DN50Z-140HC-YD") ||
dmi_match(DMI_BOARD_NAME, "GMxPXxx") ||
+ dmi_match(DMI_BOARD_NAME, "GXxMRXx") ||
dmi_match(DMI_BOARD_NAME, "PH4PG31") ||
dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1") ||
dmi_match(DMI_BOARD_NAME, "PH6PG01_PH6PG71"))
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 279/443] KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 278/443] nvme-pci: Add TUXEDO IBP Gen9 " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 280/443] scsi: st: Dont set pos_unknown just after device recognition Greg Kroah-Hartman
` (174 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keith Busch, Sean Christopherson,
Paolo Bonzini
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 43fb96ae78551d7bfa4ecca956b258f085d67c40 upstream.
When waking a VM's NX huge page recovery thread, ensure the thread is
actually alive before trying to wake it. Now that the thread is spawned
on-demand during KVM_RUN, a VM without a recovery thread is reachable via
the related module params.
BUG: kernel NULL pointer dereference, address: 0000000000000040
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:vhost_task_wake+0x5/0x10
Call Trace:
<TASK>
set_nx_huge_pages+0xcc/0x1e0 [kvm]
param_attr_store+0x8a/0xd0
module_attr_store+0x1a/0x30
kernfs_fop_write_iter+0x12f/0x1e0
vfs_write+0x233/0x3e0
ksys_write+0x60/0xd0
do_syscall_64+0x5b/0x160
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f3b52710104
</TASK>
Modules linked in: kvm_intel kvm
CR2: 0000000000000040
Fixes: 931656b9e2ff ("kvm: defer huge page recovery vhost task to later")
Cc: stable@vger.kernel.org
Cc: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20250124234623.3609069-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/mmu.c | 33 ++++++++++++++++++++++++++-------
1 file changed, 26 insertions(+), 7 deletions(-)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -7090,6 +7090,19 @@ static void mmu_destroy_caches(void)
kmem_cache_destroy(mmu_page_header_cache);
}
+static void kvm_wake_nx_recovery_thread(struct kvm *kvm)
+{
+ /*
+ * The NX recovery thread is spawned on-demand at the first KVM_RUN and
+ * may not be valid even though the VM is globally visible. Do nothing,
+ * as such a VM can't have any possible NX huge pages.
+ */
+ struct vhost_task *nx_thread = READ_ONCE(kvm->arch.nx_huge_page_recovery_thread);
+
+ if (nx_thread)
+ vhost_task_wake(nx_thread);
+}
+
static int get_nx_huge_pages(char *buffer, const struct kernel_param *kp)
{
if (nx_hugepage_mitigation_hard_disabled)
@@ -7150,7 +7163,7 @@ static int set_nx_huge_pages(const char
kvm_mmu_zap_all_fast(kvm);
mutex_unlock(&kvm->slots_lock);
- vhost_task_wake(kvm->arch.nx_huge_page_recovery_thread);
+ kvm_wake_nx_recovery_thread(kvm);
}
mutex_unlock(&kvm_lock);
}
@@ -7279,7 +7292,7 @@ static int set_nx_huge_pages_recovery_pa
mutex_lock(&kvm_lock);
list_for_each_entry(kvm, &vm_list, vm_list)
- vhost_task_wake(kvm->arch.nx_huge_page_recovery_thread);
+ kvm_wake_nx_recovery_thread(kvm);
mutex_unlock(&kvm_lock);
}
@@ -7415,14 +7428,20 @@ static void kvm_mmu_start_lpage_recovery
{
struct kvm_arch *ka = container_of(once, struct kvm_arch, nx_once);
struct kvm *kvm = container_of(ka, struct kvm, arch);
+ struct vhost_task *nx_thread;
kvm->arch.nx_huge_page_last = get_jiffies_64();
- kvm->arch.nx_huge_page_recovery_thread = vhost_task_create(
- kvm_nx_huge_page_recovery_worker, kvm_nx_huge_page_recovery_worker_kill,
- kvm, "kvm-nx-lpage-recovery");
+ nx_thread = vhost_task_create(kvm_nx_huge_page_recovery_worker,
+ kvm_nx_huge_page_recovery_worker_kill,
+ kvm, "kvm-nx-lpage-recovery");
+
+ if (!nx_thread)
+ return;
+
+ vhost_task_start(nx_thread);
- if (kvm->arch.nx_huge_page_recovery_thread)
- vhost_task_start(kvm->arch.nx_huge_page_recovery_thread);
+ /* Make the task visible only once it is fully started. */
+ WRITE_ONCE(kvm->arch.nx_huge_page_recovery_thread, nx_thread);
}
int kvm_mmu_post_init_vm(struct kvm *kvm)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 280/443] scsi: st: Dont set pos_unknown just after device recognition
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 279/443] KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 281/443] scsi: qla2xxx: Move FCE Trace buffer allocation to user control Greg Kroah-Hartman
` (173 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kai Mäkisara,
Martin K. Petersen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Mäkisara <Kai.Makisara@kolumbus.fi>
commit 98b37881b7492ae9048ad48260cc8a6ee9eb39fd upstream.
Commit 9604eea5bd3a ("scsi: st: Add third party poweron reset handling") in
v6.6 added new code to handle the Power On/Reset Unit Attention (POR UA)
sense data. This was in addition to the existing method. When this Unit
Attention is received, the driver blocks attempts to read, write and some
other operations because the reset may have rewinded the tape. Because of
the added code, also the initial POR UA resulted in blocking operations,
including those that are used to set the driver options after the device is
recognized. Also, reading and writing are refused, whereas they succeeded
before this commit.
Add code to not set pos_unknown to block operations if the POR UA is
received from the first test_ready() call after the st device has been
created. This restores the behavior before v6.6.
Signed-off-by: Kai Mäkisara <Kai.Makisara@kolumbus.fi>
Link: https://lore.kernel.org/r/20241216113755.30415-1-Kai.Makisara@kolumbus.fi
Fixes: 9604eea5bd3a ("scsi: st: Add third party poweron reset handling")
CC: stable@vger.kernel.org
Closes: https://lore.kernel.org/linux-scsi/2201CF73-4795-4D3B-9A79-6EE5215CF58D@kolumbus.fi/
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/st.c | 6 ++++++
drivers/scsi/st.h | 1 +
2 files changed, 7 insertions(+)
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -1030,6 +1030,11 @@ static int test_ready(struct scsi_tape *
retval = new_session ? CHKRES_NEW_SESSION : CHKRES_READY;
break;
}
+ if (STp->first_tur) {
+ /* Don't set pos_unknown right after device recognition */
+ STp->pos_unknown = 0;
+ STp->first_tur = 0;
+ }
if (SRpnt != NULL)
st_release_request(SRpnt);
@@ -4328,6 +4333,7 @@ static int st_probe(struct device *dev)
blk_queue_rq_timeout(tpnt->device->request_queue, ST_TIMEOUT);
tpnt->long_timeout = ST_LONG_TIMEOUT;
tpnt->try_dio = try_direct_io;
+ tpnt->first_tur = 1;
for (i = 0; i < ST_NBR_MODES; i++) {
STm = &(tpnt->modes[i]);
--- a/drivers/scsi/st.h
+++ b/drivers/scsi/st.h
@@ -170,6 +170,7 @@ struct scsi_tape {
unsigned char rew_at_close; /* rewind necessary at close */
unsigned char inited;
unsigned char cleaning_req; /* cleaning requested? */
+ unsigned char first_tur; /* first TEST UNIT READY */
int block_size;
int min_block;
int max_block;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 281/443] scsi: qla2xxx: Move FCE Trace buffer allocation to user control
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 280/443] scsi: st: Dont set pos_unknown just after device recognition Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 282/443] scsi: ufs: qcom: Fix crypto key eviction Greg Kroah-Hartman
` (172 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <qutran@marvell.com>
commit 841df27d619ee1f5ca6473e15227b39d6136562d upstream.
Currently FCE Tracing is enabled to log additional ELS events. Instead,
user will enable or disable this feature through debugfs.
Modify existing DFS knob to allow user to enable or disable this
feature.
echo [1 | 0] > /sys/kernel/debug/qla2xxx/qla2xxx_??/fce
cat /sys/kernel/debug/qla2xxx/qla2xxx_??/fce
Cc: stable@vger.kernel.org
Fixes: df613b96077c ("[SCSI] qla2xxx: Add Fibre Channel Event (FCE) tracing support.")
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20241115130313.46826-4-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_def.h | 2
drivers/scsi/qla2xxx/qla_dfs.c | 124 ++++++++++++++++++++++++++++++++--------
drivers/scsi/qla2xxx/qla_gbl.h | 3
drivers/scsi/qla2xxx/qla_init.c | 28 ++++++---
4 files changed, 126 insertions(+), 31 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -4098,6 +4098,8 @@ struct qla_hw_data {
uint32_t npiv_supported :1;
uint32_t pci_channel_io_perm_failure :1;
uint32_t fce_enabled :1;
+ uint32_t user_enabled_fce :1;
+ uint32_t fce_dump_buf_alloced :1;
uint32_t fac_supported :1;
uint32_t chip_reset_done :1;
--- a/drivers/scsi/qla2xxx/qla_dfs.c
+++ b/drivers/scsi/qla2xxx/qla_dfs.c
@@ -409,27 +409,32 @@ qla2x00_dfs_fce_show(struct seq_file *s,
mutex_lock(&ha->fce_mutex);
- seq_puts(s, "FCE Trace Buffer\n");
- seq_printf(s, "In Pointer = %llx\n\n", (unsigned long long)ha->fce_wr);
- seq_printf(s, "Base = %llx\n\n", (unsigned long long) ha->fce_dma);
- seq_puts(s, "FCE Enable Registers\n");
- seq_printf(s, "%08x %08x %08x %08x %08x %08x\n",
- ha->fce_mb[0], ha->fce_mb[2], ha->fce_mb[3], ha->fce_mb[4],
- ha->fce_mb[5], ha->fce_mb[6]);
-
- fce = (uint32_t *) ha->fce;
- fce_start = (unsigned long long) ha->fce_dma;
- for (cnt = 0; cnt < fce_calc_size(ha->fce_bufs) / 4; cnt++) {
- if (cnt % 8 == 0)
- seq_printf(s, "\n%llx: ",
- (unsigned long long)((cnt * 4) + fce_start));
- else
- seq_putc(s, ' ');
- seq_printf(s, "%08x", *fce++);
+ if (ha->flags.user_enabled_fce) {
+ seq_puts(s, "FCE Trace Buffer\n");
+ seq_printf(s, "In Pointer = %llx\n\n", (unsigned long long)ha->fce_wr);
+ seq_printf(s, "Base = %llx\n\n", (unsigned long long)ha->fce_dma);
+ seq_puts(s, "FCE Enable Registers\n");
+ seq_printf(s, "%08x %08x %08x %08x %08x %08x\n",
+ ha->fce_mb[0], ha->fce_mb[2], ha->fce_mb[3], ha->fce_mb[4],
+ ha->fce_mb[5], ha->fce_mb[6]);
+
+ fce = (uint32_t *)ha->fce;
+ fce_start = (unsigned long long)ha->fce_dma;
+ for (cnt = 0; cnt < fce_calc_size(ha->fce_bufs) / 4; cnt++) {
+ if (cnt % 8 == 0)
+ seq_printf(s, "\n%llx: ",
+ (unsigned long long)((cnt * 4) + fce_start));
+ else
+ seq_putc(s, ' ');
+ seq_printf(s, "%08x", *fce++);
+ }
+
+ seq_puts(s, "\nEnd\n");
+ } else {
+ seq_puts(s, "FCE Trace is currently not enabled\n");
+ seq_puts(s, "\techo [ 1 | 0 ] > fce\n");
}
- seq_puts(s, "\nEnd\n");
-
mutex_unlock(&ha->fce_mutex);
return 0;
@@ -467,7 +472,7 @@ qla2x00_dfs_fce_release(struct inode *in
struct qla_hw_data *ha = vha->hw;
int rval;
- if (ha->flags.fce_enabled)
+ if (ha->flags.fce_enabled || !ha->fce)
goto out;
mutex_lock(&ha->fce_mutex);
@@ -488,11 +493,88 @@ out:
return single_release(inode, file);
}
+static ssize_t
+qla2x00_dfs_fce_write(struct file *file, const char __user *buffer,
+ size_t count, loff_t *pos)
+{
+ struct seq_file *s = file->private_data;
+ struct scsi_qla_host *vha = s->private;
+ struct qla_hw_data *ha = vha->hw;
+ char *buf;
+ int rc = 0;
+ unsigned long enable;
+
+ if (!IS_QLA25XX(ha) && !IS_QLA81XX(ha) && !IS_QLA83XX(ha) &&
+ !IS_QLA27XX(ha) && !IS_QLA28XX(ha)) {
+ ql_dbg(ql_dbg_user, vha, 0xd034,
+ "this adapter does not support FCE.");
+ return -EINVAL;
+ }
+
+ buf = memdup_user_nul(buffer, count);
+ if (IS_ERR(buf)) {
+ ql_dbg(ql_dbg_user, vha, 0xd037,
+ "fail to copy user buffer.");
+ return PTR_ERR(buf);
+ }
+
+ enable = kstrtoul(buf, 0, 0);
+ rc = count;
+
+ mutex_lock(&ha->fce_mutex);
+
+ if (enable) {
+ if (ha->flags.user_enabled_fce) {
+ mutex_unlock(&ha->fce_mutex);
+ goto out_free;
+ }
+ ha->flags.user_enabled_fce = 1;
+ if (!ha->fce) {
+ rc = qla2x00_alloc_fce_trace(vha);
+ if (rc) {
+ ha->flags.user_enabled_fce = 0;
+ mutex_unlock(&ha->fce_mutex);
+ goto out_free;
+ }
+
+ /* adjust fw dump buffer to take into account of this feature */
+ if (!ha->flags.fce_dump_buf_alloced)
+ qla2x00_alloc_fw_dump(vha);
+ }
+
+ if (!ha->flags.fce_enabled)
+ qla_enable_fce_trace(vha);
+
+ ql_dbg(ql_dbg_user, vha, 0xd045, "User enabled FCE .\n");
+ } else {
+ if (!ha->flags.user_enabled_fce) {
+ mutex_unlock(&ha->fce_mutex);
+ goto out_free;
+ }
+ ha->flags.user_enabled_fce = 0;
+ if (ha->flags.fce_enabled) {
+ qla2x00_disable_fce_trace(vha, NULL, NULL);
+ ha->flags.fce_enabled = 0;
+ }
+
+ qla2x00_free_fce_trace(ha);
+ /* no need to re-adjust fw dump buffer */
+
+ ql_dbg(ql_dbg_user, vha, 0xd04f, "User disabled FCE .\n");
+ }
+
+ mutex_unlock(&ha->fce_mutex);
+out_free:
+ kfree(buf);
+ return rc;
+}
+
static const struct file_operations dfs_fce_ops = {
.open = qla2x00_dfs_fce_open,
.read = seq_read,
.llseek = seq_lseek,
.release = qla2x00_dfs_fce_release,
+ .write = qla2x00_dfs_fce_write,
};
static int
@@ -626,8 +708,6 @@ qla2x00_dfs_setup(scsi_qla_host_t *vha)
if (!IS_QLA25XX(ha) && !IS_QLA81XX(ha) && !IS_QLA83XX(ha) &&
!IS_QLA27XX(ha) && !IS_QLA28XX(ha))
goto out;
- if (!ha->fce)
- goto out;
if (qla2x00_dfs_root)
goto create_dir;
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -11,6 +11,9 @@
/*
* Global Function Prototypes in qla_init.c source file.
*/
+int qla2x00_alloc_fce_trace(scsi_qla_host_t *);
+void qla2x00_free_fce_trace(struct qla_hw_data *ha);
+void qla_enable_fce_trace(scsi_qla_host_t *);
extern int qla2x00_initialize_adapter(scsi_qla_host_t *);
extern int qla24xx_post_prli_work(struct scsi_qla_host *vha, fc_port_t *fcport);
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2681,7 +2681,7 @@ exit:
return rval;
}
-static void qla_enable_fce_trace(scsi_qla_host_t *vha)
+void qla_enable_fce_trace(scsi_qla_host_t *vha)
{
int rval;
struct qla_hw_data *ha = vha->hw;
@@ -3717,25 +3717,24 @@ qla24xx_chip_diag(scsi_qla_host_t *vha)
return rval;
}
-static void
-qla2x00_alloc_fce_trace(scsi_qla_host_t *vha)
+int qla2x00_alloc_fce_trace(scsi_qla_host_t *vha)
{
dma_addr_t tc_dma;
void *tc;
struct qla_hw_data *ha = vha->hw;
if (!IS_FWI2_CAPABLE(ha))
- return;
+ return -EINVAL;
if (!IS_QLA25XX(ha) && !IS_QLA81XX(ha) && !IS_QLA83XX(ha) &&
!IS_QLA27XX(ha) && !IS_QLA28XX(ha))
- return;
+ return -EINVAL;
if (ha->fce) {
ql_dbg(ql_dbg_init, vha, 0x00bd,
"%s: FCE Mem is already allocated.\n",
__func__);
- return;
+ return -EIO;
}
/* Allocate memory for Fibre Channel Event Buffer. */
@@ -3745,7 +3744,7 @@ qla2x00_alloc_fce_trace(scsi_qla_host_t
ql_log(ql_log_warn, vha, 0x00be,
"Unable to allocate (%d KB) for FCE.\n",
FCE_SIZE / 1024);
- return;
+ return -ENOMEM;
}
ql_dbg(ql_dbg_init, vha, 0x00c0,
@@ -3754,6 +3753,16 @@ qla2x00_alloc_fce_trace(scsi_qla_host_t
ha->fce_dma = tc_dma;
ha->fce = tc;
ha->fce_bufs = FCE_NUM_BUFFERS;
+ return 0;
+}
+
+void qla2x00_free_fce_trace(struct qla_hw_data *ha)
+{
+ if (!ha->fce)
+ return;
+ dma_free_coherent(&ha->pdev->dev, FCE_SIZE, ha->fce, ha->fce_dma);
+ ha->fce = NULL;
+ ha->fce_dma = 0;
}
static void
@@ -3844,9 +3853,10 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *v
if (ha->tgt.atio_ring)
mq_size += ha->tgt.atio_q_length * sizeof(request_t);
- qla2x00_alloc_fce_trace(vha);
- if (ha->fce)
+ if (ha->fce) {
fce_size = sizeof(struct qla2xxx_fce_chain) + FCE_SIZE;
+ ha->flags.fce_dump_buf_alloced = 1;
+ }
qla2x00_alloc_eft_trace(vha);
if (ha->eft)
eft_size = EFT_SIZE;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 282/443] scsi: ufs: qcom: Fix crypto key eviction
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 281/443] scsi: qla2xxx: Move FCE Trace buffer allocation to user control Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 283/443] scsi: ufs: core: Fix use-after free in init error and remove paths Greg Kroah-Hartman
` (171 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abel Vesa, Eric Biggers,
Martin K. Petersen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 7a0905caf5665be41094a6ceb5e9d2524de4627a upstream.
Commit 56541c7c4468 ("scsi: ufs: ufs-qcom: Switch to the new ICE API")
introduced an incorrect check of the algorithm ID into the key eviction
path, and thus qcom_ice_evict_key() is no longer ever called. Fix it.
Fixes: 56541c7c4468 ("scsi: ufs: ufs-qcom: Switch to the new ICE API")
Cc: stable@vger.kernel.org
Cc: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20241210030839.1118805-1-ebiggers@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ufs/host/ufs-qcom.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
--- a/drivers/ufs/host/ufs-qcom.c
+++ b/drivers/ufs/host/ufs-qcom.c
@@ -155,8 +155,9 @@ static int ufs_qcom_ice_program_key(stru
{
struct ufs_qcom_host *host = ufshcd_get_variant(hba);
union ufs_crypto_cap_entry cap;
- bool config_enable =
- cfg->config_enable & UFS_CRYPTO_CONFIGURATION_ENABLE;
+
+ if (!(cfg->config_enable & UFS_CRYPTO_CONFIGURATION_ENABLE))
+ return qcom_ice_evict_key(host->ice, slot);
/* Only AES-256-XTS has been tested so far. */
cap = hba->crypto_cap_array[cfg->crypto_cap_idx];
@@ -164,14 +165,11 @@ static int ufs_qcom_ice_program_key(stru
cap.key_size != UFS_CRYPTO_KEY_SIZE_256)
return -EOPNOTSUPP;
- if (config_enable)
- return qcom_ice_program_key(host->ice,
- QCOM_ICE_CRYPTO_ALG_AES_XTS,
- QCOM_ICE_CRYPTO_KEY_SIZE_256,
- cfg->crypto_key,
- cfg->data_unit_size, slot);
- else
- return qcom_ice_evict_key(host->ice, slot);
+ return qcom_ice_program_key(host->ice,
+ QCOM_ICE_CRYPTO_ALG_AES_XTS,
+ QCOM_ICE_CRYPTO_KEY_SIZE_256,
+ cfg->crypto_key,
+ cfg->data_unit_size, slot);
}
#else
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 283/443] scsi: ufs: core: Fix use-after free in init error and remove paths
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 282/443] scsi: ufs: qcom: Fix crypto key eviction Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 284/443] scsi: storvsc: Set correct data length for sending SCSI command without payload Greg Kroah-Hartman
` (170 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, André Draszik, Bean Huo,
Manivannan Sadhasivam, Eric Biggers, Martin K. Petersen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: André Draszik <andre.draszik@linaro.org>
commit f8fb2403ddebb5eea0033d90d9daae4c88749ada upstream.
devm_blk_crypto_profile_init() registers a cleanup handler to run when
the associated (platform-) device is being released. For UFS, the
crypto private data and pointers are stored as part of the ufs_hba's
data structure 'struct ufs_hba::crypto_profile'. This structure is
allocated as part of the underlying ufshcd and therefore Scsi_host
allocation.
During driver release or during error handling in ufshcd_pltfrm_init(),
this structure is released as part of ufshcd_dealloc_host() before the
(platform-) device associated with the crypto call above is released.
Once this device is released, the crypto cleanup code will run, using
the just-released 'struct ufs_hba::crypto_profile'. This causes a
use-after-free situation:
Call trace:
kfree+0x60/0x2d8 (P)
kvfree+0x44/0x60
blk_crypto_profile_destroy_callback+0x28/0x70
devm_action_release+0x1c/0x30
release_nodes+0x6c/0x108
devres_release_all+0x98/0x100
device_unbind_cleanup+0x20/0x70
really_probe+0x218/0x2d0
In other words, the initialisation code flow is:
platform-device probe
ufshcd_pltfrm_init()
ufshcd_alloc_host()
scsi_host_alloc()
allocation of struct ufs_hba
creation of scsi-host devices
devm_blk_crypto_profile_init()
devm registration of cleanup handler using platform-device
and during error handling of ufshcd_pltfrm_init() or during driver
removal:
ufshcd_dealloc_host()
scsi_host_put()
put_device(scsi-host)
release of struct ufs_hba
put_device(platform-device)
crypto cleanup handler
To fix this use-after free, change ufshcd_alloc_host() to register a
devres action to automatically cleanup the underlying SCSI device on
ufshcd destruction, without requiring explicit calls to
ufshcd_dealloc_host(). This way:
* the crypto profile and all other ufs_hba-owned resources are
destroyed before SCSI (as they've been registered after)
* a memleak is plugged in tc-dwc-g210-pci.c remove() as a
side-effect
* EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as
it's not needed anymore
* no future drivers using ufshcd_alloc_host() could ever forget
adding the cleanup
Fixes: cb77cb5abe1f ("blk-crypto: rename blk_keyslot_manager to blk_crypto_profile")
Fixes: d76d9d7d1009 ("scsi: ufs: use devm_blk_ksm_init()")
Cc: stable@vger.kernel.org
Signed-off-by: André Draszik <andre.draszik@linaro.org>
Link: https://lore.kernel.org/r/20250124-ufshcd-fix-v4-1-c5d0144aae59@linaro.org
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Acked-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ufs/core/ufshcd.c | 31 +++++++++++++++++++++----------
drivers/ufs/host/ufshcd-pci.c | 2 --
drivers/ufs/host/ufshcd-pltfrm.c | 28 +++++++++-------------------
include/ufs/ufshcd.h | 1 -
4 files changed, 30 insertions(+), 32 deletions(-)
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -10293,16 +10293,6 @@ EXPORT_SYMBOL_GPL(ufshcd_system_thaw);
#endif /* CONFIG_PM_SLEEP */
/**
- * ufshcd_dealloc_host - deallocate Host Bus Adapter (HBA)
- * @hba: pointer to Host Bus Adapter (HBA)
- */
-void ufshcd_dealloc_host(struct ufs_hba *hba)
-{
- scsi_host_put(hba->host);
-}
-EXPORT_SYMBOL_GPL(ufshcd_dealloc_host);
-
-/**
* ufshcd_set_dma_mask - Set dma mask based on the controller
* addressing capability
* @hba: per adapter instance
@@ -10321,11 +10311,25 @@ static int ufshcd_set_dma_mask(struct uf
}
/**
+ * ufshcd_devres_release - devres cleanup handler, invoked during release of
+ * hba->dev
+ * @host: pointer to SCSI host
+ */
+static void ufshcd_devres_release(void *host)
+{
+ scsi_host_put(host);
+}
+
+/**
* ufshcd_alloc_host - allocate Host Bus Adapter (HBA)
* @dev: pointer to device handle
* @hba_handle: driver private handle
*
* Return: 0 on success, non-zero value on failure.
+ *
+ * NOTE: There is no corresponding ufshcd_dealloc_host() because this function
+ * keeps track of its allocations using devres and deallocates everything on
+ * device removal automatically.
*/
int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
{
@@ -10347,6 +10351,13 @@ int ufshcd_alloc_host(struct device *dev
err = -ENOMEM;
goto out_error;
}
+
+ err = devm_add_action_or_reset(dev, ufshcd_devres_release,
+ host);
+ if (err)
+ return dev_err_probe(dev, err,
+ "failed to add ufshcd dealloc action\n");
+
host->nr_maps = HCTX_TYPE_POLL + 1;
hba = shost_priv(host);
hba->host = host;
--- a/drivers/ufs/host/ufshcd-pci.c
+++ b/drivers/ufs/host/ufshcd-pci.c
@@ -562,7 +562,6 @@ static void ufshcd_pci_remove(struct pci
pm_runtime_forbid(&pdev->dev);
pm_runtime_get_noresume(&pdev->dev);
ufshcd_remove(hba);
- ufshcd_dealloc_host(hba);
}
/**
@@ -605,7 +604,6 @@ ufshcd_pci_probe(struct pci_dev *pdev, c
err = ufshcd_init(hba, mmio_base, pdev->irq);
if (err) {
dev_err(&pdev->dev, "Initialization failed\n");
- ufshcd_dealloc_host(hba);
return err;
}
--- a/drivers/ufs/host/ufshcd-pltfrm.c
+++ b/drivers/ufs/host/ufshcd-pltfrm.c
@@ -465,21 +465,17 @@ int ufshcd_pltfrm_init(struct platform_d
struct device *dev = &pdev->dev;
mmio_base = devm_platform_ioremap_resource(pdev, 0);
- if (IS_ERR(mmio_base)) {
- err = PTR_ERR(mmio_base);
- goto out;
- }
+ if (IS_ERR(mmio_base))
+ return PTR_ERR(mmio_base);
irq = platform_get_irq(pdev, 0);
- if (irq < 0) {
- err = irq;
- goto out;
- }
+ if (irq < 0)
+ return irq;
err = ufshcd_alloc_host(dev, &hba);
if (err) {
dev_err(dev, "Allocation failed\n");
- goto out;
+ return err;
}
hba->vops = vops;
@@ -488,13 +484,13 @@ int ufshcd_pltfrm_init(struct platform_d
if (err) {
dev_err(dev, "%s: clock parse failed %d\n",
__func__, err);
- goto dealloc_host;
+ return err;
}
err = ufshcd_parse_regulator_info(hba);
if (err) {
dev_err(dev, "%s: regulator init failed %d\n",
__func__, err);
- goto dealloc_host;
+ return err;
}
ufshcd_init_lanes_per_dir(hba);
@@ -502,25 +498,20 @@ int ufshcd_pltfrm_init(struct platform_d
err = ufshcd_parse_operating_points(hba);
if (err) {
dev_err(dev, "%s: OPP parse failed %d\n", __func__, err);
- goto dealloc_host;
+ return err;
}
err = ufshcd_init(hba, mmio_base, irq);
if (err) {
dev_err_probe(dev, err, "Initialization failed with error %d\n",
err);
- goto dealloc_host;
+ return err;
}
pm_runtime_set_active(dev);
pm_runtime_enable(dev);
return 0;
-
-dealloc_host:
- ufshcd_dealloc_host(hba);
-out:
- return err;
}
EXPORT_SYMBOL_GPL(ufshcd_pltfrm_init);
@@ -534,7 +525,6 @@ void ufshcd_pltfrm_remove(struct platfor
pm_runtime_get_sync(&pdev->dev);
ufshcd_remove(hba);
- ufshcd_dealloc_host(hba);
pm_runtime_disable(&pdev->dev);
pm_runtime_put_noidle(&pdev->dev);
}
--- a/include/ufs/ufshcd.h
+++ b/include/ufs/ufshcd.h
@@ -1297,7 +1297,6 @@ static inline void ufshcd_rmwl(struct uf
void ufshcd_enable_irq(struct ufs_hba *hba);
void ufshcd_disable_irq(struct ufs_hba *hba);
int ufshcd_alloc_host(struct device *, struct ufs_hba **);
-void ufshcd_dealloc_host(struct ufs_hba *);
int ufshcd_hba_enable(struct ufs_hba *hba);
int ufshcd_init(struct ufs_hba *, void __iomem *, unsigned int);
int ufshcd_link_recovery(struct ufs_hba *hba);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 284/443] scsi: storvsc: Set correct data length for sending SCSI command without payload
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 283/443] scsi: ufs: core: Fix use-after free in init error and remove paths Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 285/443] scsi: core: Do not retry I/Os during depopulation Greg Kroah-Hartman
` (169 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Roman Kisel, Michael Kelley,
Long Li, Martin K. Petersen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <longli@microsoft.com>
commit 87c4b5e8a6b65189abd9ea5010ab308941f964a4 upstream.
In StorVSC, payload->range.len is used to indicate if this SCSI command
carries payload. This data is allocated as part of the private driver data
by the upper layer and may get passed to lower driver uninitialized.
For example, the SCSI error handling mid layer may send TEST_UNIT_READY or
REQUEST_SENSE while reusing the buffer from a failed command. The private
data section may have stale data from the previous command.
If the SCSI command doesn't carry payload, the driver may use this value as
is for communicating with host, resulting in possible corruption.
Fix this by always initializing this value.
Fixes: be0cf6ca301c ("scsi: storvsc: Set the tablesize based on the information given by the host")
Cc: stable@kernel.org
Tested-by: Roman Kisel <romank@linux.microsoft.com>
Reviewed-by: Roman Kisel <romank@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Long Li <longli@microsoft.com>
Link: https://lore.kernel.org/r/1737601642-7759-1-git-send-email-longli@linuxonhyperv.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1800,6 +1800,7 @@ static int storvsc_queuecommand(struct S
length = scsi_bufflen(scmnd);
payload = (struct vmbus_packet_mpb_array *)&cmd_request->mpb;
+ payload->range.len = 0;
payload_sz = 0;
if (scsi_sg_count(scmnd)) {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 285/443] scsi: core: Do not retry I/Os during depopulation
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 284/443] scsi: storvsc: Set correct data length for sending SCSI command without payload Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 286/443] kbuild: Move -Wenum-enum-conversion to W=2 Greg Kroah-Hartman
` (168 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Igor Pylypiv, Martin K. Petersen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Pylypiv <ipylypiv@google.com>
commit 9ff7c383b8ac0c482a1da7989f703406d78445c6 upstream.
Fail I/Os instead of retry to prevent user space processes from being
blocked on the I/O completion for several minutes.
Retrying I/Os during "depopulation in progress" or "depopulation restore in
progress" results in a continuous retry loop until the depopulation
completes or until the I/O retry loop is aborted due to a timeout by the
scsi_cmd_runtime_exceeced().
Depopulation is slow and can take 24+ hours to complete on 20+ TB HDDs.
Most I/Os in the depopulation retry loop end up taking several minutes
before returning the failure to user space.
Cc: stable@vger.kernel.org # 4.18.x: 2bbeb8d scsi: core: Handle depopulation and restoration in progress
Cc: stable@vger.kernel.org # 4.18.x
Fixes: e37c7d9a0341 ("scsi: core: sanitize++ in progress")
Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
Link: https://lore.kernel.org/r/20250131184408.859579-1-ipylypiv@google.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_lib.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -868,13 +868,18 @@ static void scsi_io_completion_action(st
case 0x1a: /* start stop unit in progress */
case 0x1b: /* sanitize in progress */
case 0x1d: /* configuration in progress */
- case 0x24: /* depopulation in progress */
- case 0x25: /* depopulation restore in progress */
action = ACTION_DELAYED_RETRY;
break;
case 0x0a: /* ALUA state transition */
action = ACTION_DELAYED_REPREP;
break;
+ /*
+ * Depopulation might take many hours,
+ * thus it is not worthwhile to retry.
+ */
+ case 0x24: /* depopulation in progress */
+ case 0x25: /* depopulation restore in progress */
+ fallthrough;
default:
action = ACTION_FAIL;
break;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 286/443] kbuild: Move -Wenum-enum-conversion to W=2
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 285/443] scsi: core: Do not retry I/Os during depopulation Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 287/443] pidfs: check for valid ioctl commands Greg Kroah-Hartman
` (167 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Arnd Bergmann,
Linus Torvalds
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit 8f6629c004b193d23612641c3607e785819e97ab upstream.
-Wenum-enum-conversion was strengthened in clang-19 to warn for C, which
caused the kernel to move it to W=1 in commit 75b5ab134bb5 ("kbuild:
Move -Wenum-{compare-conditional,enum-conversion} into W=1") because
there were numerous instances that would break builds with -Werror.
Unfortunately, this is not a full solution, as more and more developers,
subsystems, and distributors are building with W=1 as well, so they
continue to see the numerous instances of this warning.
Since the move to W=1, there have not been many new instances that have
appeared through various build reports and the ones that have appeared
seem to be following similar existing patterns, suggesting that most
instances of this warning will not be real issues. The only alternatives
for silencing this warning are adding casts (which is generally seen as
an ugly practice) or refactoring the enums to macro defines or a unified
enum (which may be undesirable because of type safety in other parts of
the code).
Move the warning to W=2, where warnings that occur frequently but may be
relevant should reside.
Cc: stable@vger.kernel.org
Fixes: 75b5ab134bb5 ("kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1")
Link: https://lore.kernel.org/ZwRA9SOcOjjLJcpi@google.com/
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
| 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/scripts/Makefile.extrawarn
+++ b/scripts/Makefile.extrawarn
@@ -130,7 +130,6 @@ KBUILD_CFLAGS += $(call cc-disable-warni
KBUILD_CFLAGS += -Wno-tautological-constant-out-of-range-compare
KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access)
KBUILD_CFLAGS += -Wno-enum-compare-conditional
-KBUILD_CFLAGS += -Wno-enum-enum-conversion
endif
endif
@@ -154,6 +153,10 @@ KBUILD_CFLAGS += -Wno-missing-field-init
KBUILD_CFLAGS += -Wno-type-limits
KBUILD_CFLAGS += -Wno-shift-negative-value
+ifdef CONFIG_CC_IS_CLANG
+KBUILD_CFLAGS += -Wno-enum-enum-conversion
+endif
+
ifdef CONFIG_CC_IS_GCC
KBUILD_CFLAGS += -Wno-maybe-uninitialized
endif
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 287/443] pidfs: check for valid ioctl commands
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 286/443] kbuild: Move -Wenum-enum-conversion to W=2 Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 288/443] pidfs: improve ioctl handling Greg Kroah-Hartman
` (166 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Brauner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
commit 8ce3528188207a2e1896cc3173fba6d99a59013a upstream.
Prior to doing any work, check whether the provided ioctl command is
supported by pidfs.
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pidfs.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -190,6 +190,27 @@ static long pidfd_info(struct task_struc
return 0;
}
+static bool pidfs_ioctl_valid(unsigned int cmd)
+{
+ switch (cmd) {
+ case FS_IOC_GETVERSION:
+ case PIDFD_GET_CGROUP_NAMESPACE:
+ case PIDFD_GET_INFO:
+ case PIDFD_GET_IPC_NAMESPACE:
+ case PIDFD_GET_MNT_NAMESPACE:
+ case PIDFD_GET_NET_NAMESPACE:
+ case PIDFD_GET_PID_FOR_CHILDREN_NAMESPACE:
+ case PIDFD_GET_TIME_NAMESPACE:
+ case PIDFD_GET_TIME_FOR_CHILDREN_NAMESPACE:
+ case PIDFD_GET_UTS_NAMESPACE:
+ case PIDFD_GET_USER_NAMESPACE:
+ case PIDFD_GET_PID_NAMESPACE:
+ return true;
+ }
+
+ return false;
+}
+
static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
struct task_struct *task __free(put_task) = NULL;
@@ -198,6 +219,9 @@ static long pidfd_ioctl(struct file *fil
struct ns_common *ns_common = NULL;
struct pid_namespace *pid_ns;
+ if (!pidfs_ioctl_valid(cmd))
+ return -ENOIOCTLCMD;
+
task = get_pid_task(pid, PIDTYPE_PID);
if (!task)
return -ESRCH;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 288/443] pidfs: improve ioctl handling
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 287/443] pidfs: check for valid ioctl commands Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 289/443] rust: init: use explicit ABI to clean warning in future compilers Greg Kroah-Hartman
` (165 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Boccassi, Jann Horn,
Christian Brauner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
commit 091ee63e36e8289f9067f659a48d497911e49d6f upstream.
Pidfs supports extensible and non-extensible ioctls. The extensible
ioctls need to check for the ioctl number itself not just the ioctl
command otherwise both backward- and forward compatibility are broken.
The pidfs ioctl handler also needs to look at the type of the ioctl
command to guard against cases where "[...] a daemon receives some
random file descriptor from a (potentially less privileged) client and
expects the FD to be of some specific type, it might call ioctl() on
this FD with some type-specific command and expect the call to fail if
the FD is of the wrong type; but due to the missing type check, the
kernel instead performs some action that userspace didn't expect."
(cf. [1]]
Link: https://lore.kernel.org/r/20250204-work-pidfs-ioctl-v1-1-04987d239575@kernel.org
Link: https://lore.kernel.org/r/CAG48ez2K9A5GwtgqO31u9ZL292we8ZwAA=TJwwEv7wRuJ3j4Lw@mail.gmail.com [1]
Fixes: 8ce352818820 ("pidfs: check for valid ioctl commands")
Acked-by: Luca Boccassi <luca.boccassi@gmail.com>
Reported-by: Jann Horn <jannh@google.com>
Cc: stable@vger.kernel.org # v6.13; please backport with 8ce352818820 ("pidfs: check for valid ioctl commands")
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pidfs.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -195,7 +195,6 @@ static bool pidfs_ioctl_valid(unsigned i
switch (cmd) {
case FS_IOC_GETVERSION:
case PIDFD_GET_CGROUP_NAMESPACE:
- case PIDFD_GET_INFO:
case PIDFD_GET_IPC_NAMESPACE:
case PIDFD_GET_MNT_NAMESPACE:
case PIDFD_GET_NET_NAMESPACE:
@@ -208,6 +207,17 @@ static bool pidfs_ioctl_valid(unsigned i
return true;
}
+ /* Extensible ioctls require some more careful checks. */
+ switch (_IOC_NR(cmd)) {
+ case _IOC_NR(PIDFD_GET_INFO):
+ /*
+ * Try to prevent performing a pidfd ioctl when someone
+ * erronously mistook the file descriptor for a pidfd.
+ * This is not perfect but will catch most cases.
+ */
+ return (_IOC_TYPE(cmd) == _IOC_TYPE(PIDFD_GET_INFO));
+ }
+
return false;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 289/443] rust: init: use explicit ABI to clean warning in future compilers
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 288/443] pidfs: improve ioctl handling Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 290/443] x86: rust: set rustc-abi=x86-softfloat on rustc>=1.86.0 Greg Kroah-Hartman
` (164 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gary Guo, Alice Ryhl, Fiona Behrens,
Miguel Ojeda
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miguel Ojeda <ojeda@kernel.org>
commit c21bdb3d8a850afdfa4afe77eea39ae9533629b0 upstream.
Starting with Rust 1.86.0 (currently in nightly, to be released on
2025-04-03), the `missing_abi` lint is warn-by-default [1]:
error: extern declarations without an explicit ABI are deprecated
--> rust/doctests_kernel_generated.rs:3158:1
|
3158 | extern {
| ^^^^^^ help: explicitly specify the C ABI: `extern "C"`
|
= note: `-D missing-abi` implied by `-D warnings`
= help: to override `-D warnings` add `#[allow(missing_abi)]`
Thus clean it up.
Cc: <stable@vger.kernel.org> # Needed in 6.12.y and 6.13.y only (Rust is pinned in older LTSs).
Fixes: 7f8977a7fe6d ("rust: init: add `{pin_}chain` functions to `{Pin}Init<T, E>`")
Link: https://github.com/rust-lang/rust/pull/132397 [1]
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Fiona Behrens <me@kloenk.dev>
Link: https://lore.kernel.org/r/20250121200934.222075-1-ojeda@kernel.org
[ Added 6.13.y to Cc: stable tag. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
rust/kernel/init.rs | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/rust/kernel/init.rs
+++ b/rust/kernel/init.rs
@@ -854,7 +854,7 @@ pub unsafe trait PinInit<T: ?Sized, E =
/// use kernel::{types::Opaque, init::pin_init_from_closure};
/// #[repr(C)]
/// struct RawFoo([u8; 16]);
- /// extern {
+ /// extern "C" {
/// fn init_foo(_: *mut RawFoo);
/// }
///
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 290/443] x86: rust: set rustc-abi=x86-softfloat on rustc>=1.86.0
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 289/443] rust: init: use explicit ABI to clean warning in future compilers Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 291/443] x86/acpi: Fix LAPIC/x2APIC parsing order Greg Kroah-Hartman
` (163 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Miguel Ojeda,
Dave Hansen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <aliceryhl@google.com>
commit 6273a058383e05465083b535ed9469f2c8a48321 upstream.
When using Rust on the x86 architecture, we are currently using the
unstable target.json feature to specify the compilation target. Rustc is
going to change how softfloat is specified in the target.json file on
x86, thus update generate_rust_target.rs to specify softfloat using the
new option.
Note that if you enable this parameter with a compiler that does not
recognize it, then that triggers a warning but it does not break the
build.
[ For future reference, this solves the following error:
RUSTC L rust/core.o
error: Error loading target specification: target feature
`soft-float` is incompatible with the ABI but gets enabled in
target spec. Run `rustc --print target-list` for a list of
built-in targets
- Miguel ]
Cc: <stable@vger.kernel.org> # Needed in 6.12.y and 6.13.y only (Rust is pinned in older LTSs).
Link: https://github.com/rust-lang/rust/pull/136146
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com> # for x86
Link: https://lore.kernel.org/r/20250203-rustc-1-86-x86-softfloat-v1-1-220a72a5003e@google.com
[ Added 6.13.y too to Cc: stable tag and added reasoning to avoid
over-backporting. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/generate_rust_target.rs | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/scripts/generate_rust_target.rs
+++ b/scripts/generate_rust_target.rs
@@ -165,6 +165,18 @@ impl KernelConfig {
let option = "CONFIG_".to_owned() + option;
self.0.contains_key(&option)
}
+
+ /// Is the rustc version at least `major.minor.patch`?
+ fn rustc_version_atleast(&self, major: u32, minor: u32, patch: u32) -> bool {
+ let check_version = 100000 * major + 100 * minor + patch;
+ let actual_version = self
+ .0
+ .get("CONFIG_RUSTC_VERSION")
+ .unwrap()
+ .parse::<u32>()
+ .unwrap();
+ check_version <= actual_version
+ }
}
fn main() {
@@ -182,6 +194,9 @@ fn main() {
}
} else if cfg.has("X86_64") {
ts.push("arch", "x86_64");
+ if cfg.rustc_version_atleast(1, 86, 0) {
+ ts.push("rustc-abi", "x86-softfloat");
+ }
ts.push(
"data-layout",
"e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128",
@@ -215,6 +230,9 @@ fn main() {
panic!("32-bit x86 only works under UML");
}
ts.push("arch", "x86");
+ if cfg.rustc_version_atleast(1, 86, 0) {
+ ts.push("rustc-abi", "x86-softfloat");
+ }
ts.push(
"data-layout",
"e-m:e-p:32:32-p270:32:32-p271:32:32-p272:64:64-i128:128-f64:32:64-f80:32-n8:16:32-S128",
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 291/443] x86/acpi: Fix LAPIC/x2APIC parsing order
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 290/443] x86: rust: set rustc-abi=x86-softfloat on rustc>=1.86.0 Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 292/443] x86/boot: Use -std=gnu11 to fix build with GCC 15 Greg Kroah-Hartman
` (162 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jim Mattson, Zhang Rui,
Thomas Gleixner, Rafael J. Wysocki
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <rui.zhang@intel.com>
commit 0141978ae75bd48bac13fca6de131a5071c32011 upstream.
On some systems, the same CPU (with the same APIC ID) is assigned a
different logical CPU id after commit ec9aedb2aa1a ("x86/acpi: Ignore
invalid x2APIC entries").
This means that Linux enumerates the CPUs in a different order, which
violates ACPI specification[1] that states:
"OSPM should initialize processors in the order that they appear in
the MADT"
The problematic commit parses all LAPIC entries before any x2APIC
entries, aiming to ignore x2APIC entries with APIC ID < 255 when valid
LAPIC entries exist. However, it disrupts the CPU enumeration order on
systems where x2APIC entries precede LAPIC entries in the MADT.
Fix this problem by:
1) Parsing LAPIC entries first without registering them in the
topology to evaluate whether valid LAPIC entries exist.
2) Restoring the MADT in order parser which invokes either the LAPIC
or the X2APIC parser function depending on the entry type.
The X2APIC parser still ignores entries < 0xff in case that #1 found
valid LAPIC entries independent of their position in the MADT table.
Link: https://uefi.org/specs/ACPI/6.5/05_ACPI_Software_Programming_Model.html#madt-processor-local-apic-sapic-structure-entry-order
Cc: All applicable <stable@vger.kernel.org>
Reported-by: Jim Mattson <jmattson@google.com>
Closes: https://lore.kernel.org/all/20241010213136.668672-1-jmattson@google.com/
Fixes: ec9aedb2aa1a ("x86/acpi: Ignore invalid x2APIC entries")
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Reviewed-by: Jim Mattson <jmattson@google.com>
Tested-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20250117081420.4046737-1-rui.zhang@intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/acpi/boot.c | 50 +++++++++++++++++++++++++++++++++++++++-----
1 file changed, 45 insertions(+), 5 deletions(-)
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -227,6 +227,28 @@ acpi_parse_x2apic(union acpi_subtable_he
}
static int __init
+acpi_check_lapic(union acpi_subtable_headers *header, const unsigned long end)
+{
+ struct acpi_madt_local_apic *processor = NULL;
+
+ processor = (struct acpi_madt_local_apic *)header;
+
+ if (BAD_MADT_ENTRY(processor, end))
+ return -EINVAL;
+
+ /* Ignore invalid ID */
+ if (processor->id == 0xff)
+ return 0;
+
+ /* Ignore processors that can not be onlined */
+ if (!acpi_is_processor_usable(processor->lapic_flags))
+ return 0;
+
+ has_lapic_cpus = true;
+ return 0;
+}
+
+static int __init
acpi_parse_lapic(union acpi_subtable_headers * header, const unsigned long end)
{
struct acpi_madt_local_apic *processor = NULL;
@@ -257,7 +279,6 @@ acpi_parse_lapic(union acpi_subtable_hea
processor->processor_id, /* ACPI ID */
processor->lapic_flags & ACPI_MADT_ENABLED);
- has_lapic_cpus = true;
return 0;
}
@@ -1029,6 +1050,8 @@ static int __init early_acpi_parse_madt_
static int __init acpi_parse_madt_lapic_entries(void)
{
int count, x2count = 0;
+ struct acpi_subtable_proc madt_proc[2];
+ int ret;
if (!boot_cpu_has(X86_FEATURE_APIC))
return -ENODEV;
@@ -1037,10 +1060,27 @@ static int __init acpi_parse_madt_lapic_
acpi_parse_sapic, MAX_LOCAL_APIC);
if (!count) {
- count = acpi_table_parse_madt(ACPI_MADT_TYPE_LOCAL_APIC,
- acpi_parse_lapic, MAX_LOCAL_APIC);
- x2count = acpi_table_parse_madt(ACPI_MADT_TYPE_LOCAL_X2APIC,
- acpi_parse_x2apic, MAX_LOCAL_APIC);
+ /* Check if there are valid LAPIC entries */
+ acpi_table_parse_madt(ACPI_MADT_TYPE_LOCAL_APIC, acpi_check_lapic, MAX_LOCAL_APIC);
+
+ /*
+ * Enumerate the APIC IDs in the order that they appear in the
+ * MADT, no matter LAPIC entry or x2APIC entry is used.
+ */
+ memset(madt_proc, 0, sizeof(madt_proc));
+ madt_proc[0].id = ACPI_MADT_TYPE_LOCAL_APIC;
+ madt_proc[0].handler = acpi_parse_lapic;
+ madt_proc[1].id = ACPI_MADT_TYPE_LOCAL_X2APIC;
+ madt_proc[1].handler = acpi_parse_x2apic;
+ ret = acpi_table_parse_entries_array(ACPI_SIG_MADT,
+ sizeof(struct acpi_table_madt),
+ madt_proc, ARRAY_SIZE(madt_proc), MAX_LOCAL_APIC);
+ if (ret < 0) {
+ pr_err("Error parsing LAPIC/X2APIC entries\n");
+ return ret;
+ }
+ count = madt_proc[0].count;
+ x2count = madt_proc[1].count;
}
if (!count && !x2count) {
pr_err("No LAPIC entries present\n");
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 292/443] x86/boot: Use -std=gnu11 to fix build with GCC 15
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 291/443] x86/acpi: Fix LAPIC/x2APIC parsing order Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 293/443] ubi: Add a check for ubi_num Greg Kroah-Hartman
` (161 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kostadin Shishmanov, Jakub Jelinek,
Nathan Chancellor, Dave Hansen, Ard Biesheuvel
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit ee2ab467bddfb2d7f68d996dbab94d7b88f8eaf7 upstream.
GCC 15 changed the default C standard version to C23, which should not
have impacted the kernel because it requests the gnu11 standard via
'-std=' in the main Makefile. However, the x86 compressed boot Makefile
uses its own set of KBUILD_CFLAGS without a '-std=' value (i.e., using
the default), resulting in errors from the kernel's definitions of bool,
true, and false in stddef.h, which are reserved keywords under C23.
./include/linux/stddef.h:11:9: error: expected identifier before ‘false’
11 | false = 0,
./include/linux/types.h:35:33: error: two or more data types in declaration specifiers
35 | typedef _Bool bool;
Set '-std=gnu11' in the x86 compressed boot Makefile to resolve the
error and consistently use the same C standard version for the entire
kernel.
Closes: https://lore.kernel.org/4OAhbllK7x4QJGpZjkYjtBYNLd_2whHx9oFiuZcGwtVR4hIzvduultkgfAIRZI3vQpZylu7Gl929HaYFRGeMEalWCpeMzCIIhLxxRhq4U-Y=@protonmail.com/
Closes: https://lore.kernel.org/Z4467umXR2PZ0M1H@tucnak/
Reported-by: Kostadin Shishmanov <kostadinshishmanov@protonmail.com>
Reported-by: Jakub Jelinek <jakub@redhat.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Cc:stable@vger.kernel.org
Link: https://lore.kernel.org/all/20250121-x86-use-std-consistently-gcc-15-v1-1-8ab0acf645cb%40kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/compressed/Makefile | 1 +
1 file changed, 1 insertion(+)
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -25,6 +25,7 @@ targets := vmlinux vmlinux.bin vmlinux.b
# avoid errors with '-march=i386', and future flags may depend on the target to
# be valid.
KBUILD_CFLAGS := -m$(BITS) -O2 $(CLANG_FLAGS)
+KBUILD_CFLAGS += -std=gnu11
KBUILD_CFLAGS += -fno-strict-aliasing -fPIE
KBUILD_CFLAGS += -Wundef
KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 293/443] ubi: Add a check for ubi_num
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 292/443] x86/boot: Use -std=gnu11 to fix build with GCC 15 Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 294/443] ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus Greg Kroah-Hartman
` (160 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Denis Arefev, Zhihao Cheng,
Richard Weinberger
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <arefev@swemel.ru>
commit 97bbf9e312c3fbaf0baa56120238825d2eb23b8a upstream.
Added a check for ubi_num for negative numbers
If the variable ubi_num takes negative values then we get:
qemu-system-arm ... -append "ubi.mtd=0,0,0,-22222345" ...
[ 0.745065] ubi_attach_mtd_dev from ubi_init+0x178/0x218
[ 0.745230] ubi_init from do_one_initcall+0x70/0x1ac
[ 0.745344] do_one_initcall from kernel_init_freeable+0x198/0x224
[ 0.745474] kernel_init_freeable from kernel_init+0x18/0x134
[ 0.745600] kernel_init from ret_from_fork+0x14/0x28
[ 0.745727] Exception stack(0x90015fb0 to 0x90015ff8)
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 83ff59a06663 ("UBI: support ubi_num on mtd.ubi command line")
Cc: stable@vger.kernel.org
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/ubi/build.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -1537,7 +1537,7 @@ static int ubi_mtd_param_parse(const cha
if (token) {
int err = kstrtoint(token, 10, &p->ubi_num);
- if (err) {
+ if (err || p->ubi_num < UBI_DEV_NUM_AUTO) {
pr_err("UBI error: bad value for ubi_num parameter: %s\n",
token);
return -EINVAL;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 294/443] ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 293/443] ubi: Add a check for ubi_num Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 295/443] ARM: dts: ti/omap: gta04: fix pm issues caused by spi module Greg Kroah-Hartman
` (159 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Romain Naour, Kevin Hilman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Naour <romain.naour@skf.com>
commit c1472ec1dc4419d0bae663c1a1e6cb98dc7881ad upstream.
A bus_dma_limit was added for l3 bus by commit cfb5d65f2595
("ARM: dts: dra7: Add bus_dma_limit for L3 bus") to fix an issue
observed only with SATA on DRA7-EVM with 4GB RAM and CONFIG_ARM_LPAE
enabled.
Since kernel 5.13, the SATA issue can be reproduced again following
the SATA node move from L3 bus to L4_cfg in commit 8af15365a368
("ARM: dts: Configure interconnect target module for dra7 sata").
Fix it by adding an empty dma-ranges property to l4_cfg and
segment@100000 nodes (parent device tree node of SATA controller) to
inherit the 2GB dma ranges limit from l3 bus node.
Note: A similar fix was applied for PCIe controller by commit
90d4d3f4ea45 ("ARM: dts: dra7: Fix bus_dma_limit for PCIe").
Fixes: 8af15365a368 ("ARM: dts: Configure interconnect target module for dra7 sata").
Link: https://lore.kernel.org/linux-omap/c583e1bb-f56b-4489-8012-ce742e85f233@smile.fr/
Cc: stable@vger.kernel.org # 5.13
Signed-off-by: Romain Naour <romain.naour@skf.com>
Link: https://lore.kernel.org/r/20241115102537.1330300-1-romain.naour@smile.fr
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/ti/omap/dra7-l4.dtsi | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi
+++ b/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi
@@ -12,6 +12,7 @@
ranges = <0x00000000 0x4a000000 0x100000>, /* segment 0 */
<0x00100000 0x4a100000 0x100000>, /* segment 1 */
<0x00200000 0x4a200000 0x100000>; /* segment 2 */
+ dma-ranges;
segment@0 { /* 0x4a000000 */
compatible = "simple-pm-bus";
@@ -557,6 +558,7 @@
<0x0007e000 0x0017e000 0x001000>, /* ap 124 */
<0x00059000 0x00159000 0x001000>, /* ap 125 */
<0x0005a000 0x0015a000 0x001000>; /* ap 126 */
+ dma-ranges;
target-module@2000 { /* 0x4a102000, ap 27 3c.0 */
compatible = "ti,sysc";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 295/443] ARM: dts: ti/omap: gta04: fix pm issues caused by spi module
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 294/443] ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 296/443] arm64: dts: mediatek: mt8183: Disable DPI display output by default Greg Kroah-Hartman
` (158 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Kemnade, Roger Quadros,
Kevin Hilman
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <andreas@kemnade.info>
commit 0cfbd7805fe13406500e6a6f2aa08f198d5db4bd upstream.
Despite CM_IDLEST1_CORE and CM_FCLKEN1_CORE behaving normal,
disabling SPI leads to messages like when suspending:
Powerdomain (core_pwrdm) didn't enter target state 0
and according to /sys/kernel/debug/pm_debug/count off state is not
entered. That was not connected to SPI during the discussion
of disabling SPI. See:
https://lore.kernel.org/linux-omap/20230122100852.32ae082c@aktux/
The reason is that SPI is per default in slave mode. Linux driver
will turn it to master per default. It slave mode, the powerdomain seems to
be kept active if active chip select input is sensed.
Fix that by explicitly disabling the SPI3 pins which used to be muxed by
the bootloader since they are available on an optionally fitted header
which would require dtb overlays anyways.
Fixes: a622310f7f01 ("ARM: dts: gta04: fix excess dma channel usage")
CC: stable@vger.kernel.org
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Reviewed-by: Roger Quadros <rogerq@kernel.org>
Link: https://lore.kernel.org/r/20241204174152.2360431-1-andreas@kemnade.info
Signed-off-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi
@@ -446,6 +446,7 @@
pinctrl-names = "default";
pinctrl-0 = <
&hsusb2_2_pins
+ &mcspi3hog_pins
>;
hsusb2_2_pins: hsusb2-2-pins {
@@ -459,6 +460,15 @@
>;
};
+ mcspi3hog_pins: mcspi3hog-pins {
+ pinctrl-single,pins = <
+ OMAP3630_CORE2_IOPAD(0x25dc, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d0 */
+ OMAP3630_CORE2_IOPAD(0x25de, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d1 */
+ OMAP3630_CORE2_IOPAD(0x25e0, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d2 */
+ OMAP3630_CORE2_IOPAD(0x25e2, PIN_OUTPUT_PULLDOWN | MUX_MODE4) /* etk_d3 */
+ >;
+ };
+
spi_gpio_pins: spi-gpio-pinmux-pins {
pinctrl-single,pins = <
OMAP3630_CORE2_IOPAD(0x25d8, PIN_OUTPUT | MUX_MODE4) /* clk */
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 296/443] arm64: dts: mediatek: mt8183: Disable DPI display output by default
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 295/443] ARM: dts: ti/omap: gta04: fix pm issues caused by spi module Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 297/443] arm64: dts: mediatek: mt8183: Disable DSI " Greg Kroah-Hartman
` (157 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai, Fei Shao,
AngeloGioacchino Del Regno
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
commit 93a680af46436780fd64f4e856a4cfa8b393be6e upstream.
This reverts commit 377548f05bd0905db52a1d50e5b328b9b4eb049d.
Most SoC dtsi files have the display output interfaces disabled by
default, and only enabled on boards that utilize them. The MT8183
has it backwards: the display outputs are left enabled by default,
and only disabled at the board level.
Reverse the situation for the DPI output so that it follows the
normal scheme. For ease of backporting the DSI output is handled
in a separate patch.
Fixes: 009d855a26fd ("arm64: dts: mt8183: add dpi node to mt8183")
Fixes: 377548f05bd0 ("arm64: dts: mediatek: mt8183-kukui: Disable DPI display interface")
Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Fei Shao <fshao@chromium.org>
Link: https://lore.kernel.org/r/20241025075630.3917458-1-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 5 -----
arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 +
2 files changed, 1 insertion(+), 5 deletions(-)
--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
@@ -269,11 +269,6 @@
};
};
-&dpi0 {
- /* TODO Re-enable after DP to Type-C port muxing can be described */
- status = "disabled";
-};
-
&gic {
mediatek,broken-save-restore-fw;
};
--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
@@ -1846,6 +1846,7 @@
<&mmsys CLK_MM_DPI_MM>,
<&apmixedsys CLK_APMIXED_TVDPLL>;
clock-names = "pixel", "engine", "pll";
+ status = "disabled";
port {
dpi_out: endpoint { };
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 297/443] arm64: dts: mediatek: mt8183: Disable DSI display output by default
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 296/443] arm64: dts: mediatek: mt8183: Disable DPI display output by default Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 298/443] arm64: dts: qcom: sdx75: Fix MPSS memory length Greg Kroah-Hartman
` (156 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai, Fei Shao,
AngeloGioacchino Del Regno
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
commit 26f6e91fa29a58fdc76b47f94f8f6027944a490c upstream.
Most SoC dtsi files have the display output interfaces disabled by
default, and only enabled on boards that utilize them. The MT8183
has it backwards: the display outputs are left enabled by default,
and only disabled at the board level.
Reverse the situation for the DSI output so that it follows the
normal scheme. For ease of backporting the DPI output is handled
in a separate patch.
Fixes: 88ec840270e6 ("arm64: dts: mt8183: Add dsi node")
Fixes: 19b6403f1e2a ("arm64: dts: mt8183: add mt8183 pumpkin board")
Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Fei Shao <fshao@chromium.org>
Link: https://lore.kernel.org/r/20241025075630.3917458-2-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 4 ----
arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 +
2 files changed, 1 insertion(+), 4 deletions(-)
--- a/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts
@@ -522,10 +522,6 @@
status = "okay";
};
-&dsi0 {
- status = "disabled";
-};
-
&dpi0 {
pinctrl-names = "default", "sleep";
pinctrl-0 = <&dpi_func_pins>;
--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
@@ -1835,6 +1835,7 @@
resets = <&mmsys MT8183_MMSYS_SW0_RST_B_DISP_DSI0>;
phys = <&mipi_tx0>;
phy-names = "dphy";
+ status = "disabled";
};
dpi0: dpi@14015000 {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 298/443] arm64: dts: qcom: sdx75: Fix MPSS memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 297/443] arm64: dts: mediatek: mt8183: Disable DSI " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 299/443] arm64: dts: qcom: x1e80100: Fix ADSP memory base and length Greg Kroah-Hartman
` (155 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 9a27f0e1869e992e4107e2af8ec348e1a3b9d4d5 upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x4040 was
copied from older DTS, but it grew since then.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Cc: stable@vger.kernel.org
Fixes: 41c72f36b286 ("arm64: dts: qcom: sdx75: Add remoteproc node")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-20-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sdx75.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sdx75.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdx75.dtsi
@@ -893,7 +893,7 @@
remoteproc_mpss: remoteproc@4080000 {
compatible = "qcom,sdx75-mpss-pas";
- reg = <0 0x04080000 0 0x4040>;
+ reg = <0 0x04080000 0 0x10000>;
interrupts-extended = <&intc GIC_SPI 250 IRQ_TYPE_EDGE_RISING>,
<&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 299/443] arm64: dts: qcom: x1e80100: Fix ADSP memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 298/443] arm64: dts: qcom: sdx75: Fix MPSS memory length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 300/443] arm64: dts: qcom: x1e80100: Fix CDSP memory length Greg Kroah-Hartman
` (154 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Johan Hovold, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 7a003077366946a5ed1adab6d177efb2ab59e815 upstream.
The address space in ADSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0680_0000 with length of 0x10000.
0x3000_0000, value used so far, is the main region of CDSP and was
simply copied from other/older DTS.
Correct the base address and length, which also moves the node to
different place to keep things sorted by unit address. The diff looks
big, but only the unit address and "reg" property were changed. This
should have no functional impact on Linux users, because PAS loader does
not use this address space at all.
Fixes: 5f2a9cd4b104 ("arm64: dts: qcom: x1e80100: Add ADSP/CDSP remoteproc nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-13-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100.dtsi | 274 ++++++++++++++++-----------------
1 file changed, 137 insertions(+), 137 deletions(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
@@ -3518,6 +3518,143 @@
#interconnect-cells = <2>;
};
+ remoteproc_adsp: remoteproc@6800000 {
+ compatible = "qcom,x1e80100-adsp-pas";
+ reg = <0x0 0x06800000 0x0 0x10000>;
+
+ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "wdog",
+ "fatal",
+ "ready",
+ "handover",
+ "stop-ack";
+
+ clocks = <&rpmhcc RPMH_CXO_CLK>;
+ clock-names = "xo";
+
+ power-domains = <&rpmhpd RPMHPD_LCX>,
+ <&rpmhpd RPMHPD_LMX>;
+ power-domain-names = "lcx",
+ "lmx";
+
+ interconnects = <&lpass_lpicx_noc MASTER_LPASS_PROC QCOM_ICC_TAG_ALWAYS
+ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+
+ memory-region = <&adspslpi_mem>,
+ <&q6_adsp_dtb_mem>;
+
+ qcom,qmp = <&aoss_qmp>;
+
+ qcom,smem-states = <&smp2p_adsp_out 0>;
+ qcom,smem-state-names = "stop";
+
+ status = "disabled";
+
+ glink-edge {
+ interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP
+ IRQ_TYPE_EDGE_RISING>;
+ mboxes = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+ label = "lpass";
+ qcom,remote-pid = <2>;
+
+ fastrpc {
+ compatible = "qcom,fastrpc";
+ qcom,glink-channels = "fastrpcglink-apps-dsp";
+ label = "adsp";
+ qcom,non-secure-domain;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ compute-cb@3 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <3>;
+ iommus = <&apps_smmu 0x1003 0x80>,
+ <&apps_smmu 0x1063 0x0>;
+ dma-coherent;
+ };
+
+ compute-cb@4 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <4>;
+ iommus = <&apps_smmu 0x1004 0x80>,
+ <&apps_smmu 0x1064 0x0>;
+ dma-coherent;
+ };
+
+ compute-cb@5 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <5>;
+ iommus = <&apps_smmu 0x1005 0x80>,
+ <&apps_smmu 0x1065 0x0>;
+ dma-coherent;
+ };
+
+ compute-cb@6 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <6>;
+ iommus = <&apps_smmu 0x1006 0x80>,
+ <&apps_smmu 0x1066 0x0>;
+ dma-coherent;
+ };
+
+ compute-cb@7 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <7>;
+ iommus = <&apps_smmu 0x1007 0x80>,
+ <&apps_smmu 0x1067 0x0>;
+ dma-coherent;
+ };
+ };
+
+ gpr {
+ compatible = "qcom,gpr";
+ qcom,glink-channels = "adsp_apps";
+ qcom,domain = <GPR_DOMAIN_ID_ADSP>;
+ qcom,intents = <512 20>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ q6apm: service@1 {
+ compatible = "qcom,q6apm";
+ reg = <GPR_APM_MODULE_IID>;
+ #sound-dai-cells = <0>;
+ qcom,protection-domain = "avs/audio",
+ "msm/adsp/audio_pd";
+
+ q6apmbedai: bedais {
+ compatible = "qcom,q6apm-lpass-dais";
+ #sound-dai-cells = <1>;
+ };
+
+ q6apmdai: dais {
+ compatible = "qcom,q6apm-dais";
+ iommus = <&apps_smmu 0x1001 0x80>,
+ <&apps_smmu 0x1061 0x0>;
+ };
+ };
+
+ q6prm: service@2 {
+ compatible = "qcom,q6prm";
+ reg = <GPR_PRM_MODULE_IID>;
+ qcom,protection-domain = "avs/audio",
+ "msm/adsp/audio_pd";
+
+ q6prmcc: clock-controller {
+ compatible = "qcom,q6prm-lpass-clocks";
+ #clock-cells = <2>;
+ };
+ };
+ };
+ };
+ };
+
lpass_wsa2macro: codec@6aa0000 {
compatible = "qcom,x1e80100-lpass-wsa-macro", "qcom,sm8550-lpass-wsa-macro";
reg = <0 0x06aa0000 0 0x1000>;
@@ -6111,143 +6248,6 @@
interrupts = <GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>;
};
- remoteproc_adsp: remoteproc@30000000 {
- compatible = "qcom,x1e80100-adsp-pas";
- reg = <0 0x30000000 0 0x100>;
-
- interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
- interrupt-names = "wdog",
- "fatal",
- "ready",
- "handover",
- "stop-ack";
-
- clocks = <&rpmhcc RPMH_CXO_CLK>;
- clock-names = "xo";
-
- power-domains = <&rpmhpd RPMHPD_LCX>,
- <&rpmhpd RPMHPD_LMX>;
- power-domain-names = "lcx",
- "lmx";
-
- interconnects = <&lpass_lpicx_noc MASTER_LPASS_PROC QCOM_ICC_TAG_ALWAYS
- &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
-
- memory-region = <&adspslpi_mem>,
- <&q6_adsp_dtb_mem>;
-
- qcom,qmp = <&aoss_qmp>;
-
- qcom,smem-states = <&smp2p_adsp_out 0>;
- qcom,smem-state-names = "stop";
-
- status = "disabled";
-
- glink-edge {
- interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP
- IRQ_TYPE_EDGE_RISING>;
- mboxes = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP>;
-
- label = "lpass";
- qcom,remote-pid = <2>;
-
- fastrpc {
- compatible = "qcom,fastrpc";
- qcom,glink-channels = "fastrpcglink-apps-dsp";
- label = "adsp";
- qcom,non-secure-domain;
- #address-cells = <1>;
- #size-cells = <0>;
-
- compute-cb@3 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <3>;
- iommus = <&apps_smmu 0x1003 0x80>,
- <&apps_smmu 0x1063 0x0>;
- dma-coherent;
- };
-
- compute-cb@4 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <4>;
- iommus = <&apps_smmu 0x1004 0x80>,
- <&apps_smmu 0x1064 0x0>;
- dma-coherent;
- };
-
- compute-cb@5 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <5>;
- iommus = <&apps_smmu 0x1005 0x80>,
- <&apps_smmu 0x1065 0x0>;
- dma-coherent;
- };
-
- compute-cb@6 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <6>;
- iommus = <&apps_smmu 0x1006 0x80>,
- <&apps_smmu 0x1066 0x0>;
- dma-coherent;
- };
-
- compute-cb@7 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <7>;
- iommus = <&apps_smmu 0x1007 0x80>,
- <&apps_smmu 0x1067 0x0>;
- dma-coherent;
- };
- };
-
- gpr {
- compatible = "qcom,gpr";
- qcom,glink-channels = "adsp_apps";
- qcom,domain = <GPR_DOMAIN_ID_ADSP>;
- qcom,intents = <512 20>;
- #address-cells = <1>;
- #size-cells = <0>;
-
- q6apm: service@1 {
- compatible = "qcom,q6apm";
- reg = <GPR_APM_MODULE_IID>;
- #sound-dai-cells = <0>;
- qcom,protection-domain = "avs/audio",
- "msm/adsp/audio_pd";
-
- q6apmbedai: bedais {
- compatible = "qcom,q6apm-lpass-dais";
- #sound-dai-cells = <1>;
- };
-
- q6apmdai: dais {
- compatible = "qcom,q6apm-dais";
- iommus = <&apps_smmu 0x1001 0x80>,
- <&apps_smmu 0x1061 0x0>;
- };
- };
-
- q6prm: service@2 {
- compatible = "qcom,q6prm";
- reg = <GPR_PRM_MODULE_IID>;
- qcom,protection-domain = "avs/audio",
- "msm/adsp/audio_pd";
-
- q6prmcc: clock-controller {
- compatible = "qcom,q6prm-lpass-clocks";
- #clock-cells = <2>;
- };
- };
- };
- };
- };
-
remoteproc_cdsp: remoteproc@32300000 {
compatible = "qcom,x1e80100-cdsp-pas";
reg = <0 0x32300000 0 0x1400000>;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 300/443] arm64: dts: qcom: x1e80100: Fix CDSP memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 299/443] arm64: dts: qcom: x1e80100: Fix ADSP memory base and length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 301/443] arm64: dts: qcom: sm6115: Fix MPSS " Greg Kroah-Hartman
` (153 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Johan Hovold, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 3de1bf12c6bfb9a92f0803941ecae39b08470446 upstream.
The address space in CDSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x1400000 was
copied from older DTS, but it does not look accurate at all.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: 5f2a9cd4b104 ("arm64: dts: qcom: x1e80100: Add ADSP/CDSP remoteproc nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-14-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/x1e80100.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
@@ -6250,7 +6250,7 @@
remoteproc_cdsp: remoteproc@32300000 {
compatible = "qcom,x1e80100-cdsp-pas";
- reg = <0 0x32300000 0 0x1400000>;
+ reg = <0x0 0x32300000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
<&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 301/443] arm64: dts: qcom: sm6115: Fix MPSS memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 300/443] arm64: dts: qcom: x1e80100: Fix CDSP memory length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 302/443] arm64: dts: qcom: sm6115: Fix CDSP " Greg Kroah-Hartman
` (152 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 472d65e7cb591c8379dd6f40561f96be73a46f0f upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x100 was
copied from older DTS, but it grew since then.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Cc: stable@vger.kernel.org
Fixes: 96ce9227fdbc ("arm64: dts: qcom: sm6115: Add remoteproc nodes")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-21-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
@@ -2027,7 +2027,7 @@
remoteproc_mpss: remoteproc@6080000 {
compatible = "qcom,sm6115-mpss-pas";
- reg = <0x0 0x06080000 0x0 0x100>;
+ reg = <0x0 0x06080000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 307 IRQ_TYPE_EDGE_RISING>,
<&modem_smp2p_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 302/443] arm64: dts: qcom: sm6115: Fix CDSP memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 301/443] arm64: dts: qcom: sm6115: Fix MPSS " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 303/443] arm64: dts: qcom: sm6115: Fix ADSP memory base and length Greg Kroah-Hartman
` (151 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 846f49c3f01680f4af3043bf5b7abc9cf71bb42d upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x4040. Value of 0x100000 covers
entire Touring/CDSP memory block seems to big here.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Cc: stable@vger.kernel.org
Fixes: 96ce9227fdbc ("arm64: dts: qcom: sm6115: Add remoteproc nodes")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-22-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
@@ -2744,7 +2744,7 @@
remoteproc_cdsp: remoteproc@b300000 {
compatible = "qcom,sm6115-cdsp-pas";
- reg = <0x0 0x0b300000 0x0 0x100000>;
+ reg = <0x0 0x0b300000 0x0 0x4040>;
interrupts-extended = <&intc GIC_SPI 265 IRQ_TYPE_EDGE_RISING>,
<&cdsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 303/443] arm64: dts: qcom: sm6115: Fix ADSP memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 302/443] arm64: dts: qcom: sm6115: Fix CDSP " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 304/443] arm64: dts: qcom: sm6350: Fix ADSP memory length Greg Kroah-Hartman
` (150 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 47d178caac3ec13f5f472afda25fcfdfaa00d0da upstream.
The address space in ADSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0a40_0000 with length of 0x4040.
0x0ab0_0000, value used so far, is the SSC_QUPV3 block, so entierly
unrelated.
Correct the base address and length, which should have no functional
impact on Linux users, because PAS loader does not use this address
space at all.
Cc: stable@vger.kernel.org
Fixes: 96ce9227fdbc ("arm64: dts: qcom: sm6115: Add remoteproc nodes")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-23-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6115.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
@@ -2670,9 +2670,9 @@
};
};
- remoteproc_adsp: remoteproc@ab00000 {
+ remoteproc_adsp: remoteproc@a400000 {
compatible = "qcom,sm6115-adsp-pas";
- reg = <0x0 0x0ab00000 0x0 0x100>;
+ reg = <0x0 0x0a400000 0x0 0x4040>;
interrupts-extended = <&intc GIC_SPI 282 IRQ_TYPE_EDGE_RISING>,
<&adsp_smp2p_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 304/443] arm64: dts: qcom: sm6350: Fix ADSP memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 303/443] arm64: dts: qcom: sm6115: Fix ADSP memory base and length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 305/443] arm64: dts: qcom: sm6350: Fix MPSS " Greg Kroah-Hartman
` (149 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Konrad Dybcio,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit b0805a864459a29831577d2a47165afebe338faf upstream.
The address space in ADSP (Peripheral Authentication Service) remoteproc
node should point to the QDSP PUB address space (QDSP6...SS_PUB) which
has a length of 0x10000.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: efc33c969f23 ("arm64: dts: qcom: sm6350: Add ADSP nodes")
Cc: stable@vger.kernel.org
Tested-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-15-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
@@ -1283,7 +1283,7 @@
adsp: remoteproc@3000000 {
compatible = "qcom,sm6350-adsp-pas";
- reg = <0 0x03000000 0 0x100>;
+ reg = <0x0 0x03000000 0x0 0x10000>;
interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
<&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 305/443] arm64: dts: qcom: sm6350: Fix MPSS memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 304/443] arm64: dts: qcom: sm6350: Fix ADSP memory length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 306/443] arm64: dts: qcom: sm6350: Fix uart1 interconnect path Greg Kroah-Hartman
` (148 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Konrad Dybcio,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit cd8d83de9cc9ecfb1f9a12bc838041c4eb4d10bd upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x4040 was
copied from older DTS, but it grew since then.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: 489be59b635b ("arm64: dts: qcom: sm6350: Add MPSS nodes")
Cc: stable@vger.kernel.org
Tested-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-16-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
@@ -1503,7 +1503,7 @@
mpss: remoteproc@4080000 {
compatible = "qcom,sm6350-mpss-pas";
- reg = <0x0 0x04080000 0x0 0x4040>;
+ reg = <0x0 0x04080000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_EDGE_RISING>,
<&modem_smp2p_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 306/443] arm64: dts: qcom: sm6350: Fix uart1 interconnect path
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 305/443] arm64: dts: qcom: sm6350: Fix MPSS " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 307/443] arm64: dts: qcom: sm6375: Fix ADSP memory length Greg Kroah-Hartman
` (147 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
commit be2f81eaa2c8e81d3de5b73dca5e133f63384cb3 upstream.
The path MASTER_QUP_0 to SLAVE_EBI_CH0 would be qup-memory path and not
qup-config. Since the qup-memory path is not part of the qcom,geni-uart
bindings, just replace that path with the correct path for qup-config.
Fixes: b179f35b887b ("arm64: dts: qcom: sm6350: add uart1 node")
Cc: stable@vger.kernel.org
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241220-sm6350-uart1-icc-v1-1-f4f10fd91adf@fairphone.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
@@ -936,7 +936,7 @@
power-domains = <&rpmhpd SM6350_CX>;
operating-points-v2 = <&qup_opp_table>;
interconnects = <&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>,
- <&aggre1_noc MASTER_QUP_0 0 &clk_virt SLAVE_EBI_CH0 0>;
+ <&gem_noc MASTER_AMPSS_M0 0 &config_noc SLAVE_QUP_0 0>;
interconnect-names = "qup-core", "qup-config";
status = "disabled";
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 307/443] arm64: dts: qcom: sm6375: Fix ADSP memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 306/443] arm64: dts: qcom: sm6350: Fix uart1 interconnect path Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 308/443] arm64: dts: qcom: sm6375: Fix CDSP memory base and length Greg Kroah-Hartman
` (146 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit bf4dda83da27b7efc49326ebb82cbd8b3e637c38 upstream.
The address space in ADSP (Peripheral Authentication Service) remoteproc
node should point to the QDSP PUB address space (QDSP6...SS_PUB) which
has a length of 0x10000.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: fe6fd26aeddf ("arm64: dts: qcom: sm6375: Add ADSP&CDSP")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-17-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6375.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm6375.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi
@@ -1559,7 +1559,7 @@
remoteproc_adsp: remoteproc@a400000 {
compatible = "qcom,sm6375-adsp-pas";
- reg = <0 0x0a400000 0 0x100>;
+ reg = <0 0x0a400000 0 0x10000>;
interrupts-extended = <&intc GIC_SPI 282 IRQ_TYPE_EDGE_RISING>,
<&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 308/443] arm64: dts: qcom: sm6375: Fix CDSP memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 307/443] arm64: dts: qcom: sm6375: Fix ADSP memory length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 309/443] arm64: dts: qcom: sm6375: Fix MPSS " Greg Kroah-Hartman
` (145 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit c9f7f341e896836c99709421a23bae5f53039aab upstream.
The address space in CDSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0b30_0000 with length of 0x10000.
0x0b00_0000, value used so far, is the main region of CDSP.
Correct the base address and length, which should have no functional
impact on Linux users, because PAS loader does not use this address
space at all.
Fixes: fe6fd26aeddf ("arm64: dts: qcom: sm6375: Add ADSP&CDSP")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-18-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6375.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm6375.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi
@@ -1595,9 +1595,9 @@
};
};
- remoteproc_cdsp: remoteproc@b000000 {
+ remoteproc_cdsp: remoteproc@b300000 {
compatible = "qcom,sm6375-cdsp-pas";
- reg = <0x0 0x0b000000 0x0 0x100000>;
+ reg = <0x0 0x0b300000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 265 IRQ_TYPE_EDGE_RISING>,
<&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 309/443] arm64: dts: qcom: sm6375: Fix MPSS memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 308/443] arm64: dts: qcom: sm6375: Fix CDSP memory base and length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 310/443] arm64: dts: qcom: sm8350: Fix ADSP " Greg Kroah-Hartman
` (144 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 918e71ba0c08c3d609ad69067854b0f675c4a253 upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0608_0000 with length of 0x10000.
0x0600_0000, value used so far, is the main region of Modem.
Correct the base address and length, which should have no functional
impact on Linux users, because PAS loader does not use this address
space at all.
Fixes: 31cc61104f68 ("arm64: dts: qcom: sm6375: Add modem nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-19-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm6375.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm6375.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi
@@ -1516,9 +1516,9 @@
#power-domain-cells = <1>;
};
- remoteproc_mss: remoteproc@6000000 {
+ remoteproc_mss: remoteproc@6080000 {
compatible = "qcom,sm6375-mpss-pas";
- reg = <0 0x06000000 0 0x4040>;
+ reg = <0x0 0x06080000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 307 IRQ_TYPE_EDGE_RISING>,
<&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 310/443] arm64: dts: qcom: sm8350: Fix ADSP memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 309/443] arm64: dts: qcom: sm6375: Fix MPSS " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 311/443] arm64: dts: qcom: sm8350: Fix CDSP " Greg Kroah-Hartman
` (143 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit f9ba85566ddd5a3db8fa291aaecd70c4e55a3732 upstream.
The address space in ADSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0300_0000 with length of 0x10000. 0x1730_0000,
value used so far, was copied from downstream DTS, is in the middle of
unused space and downstream DTS describes the PIL loader, which is a bit
different interface.
Assume existing value (thus downstream DTS) is not really describing the
intended ADSP PAS region.
Correct the base address and length, which also moves the node to
different place to keep things sorted by unit address. The diff looks
big, but only the unit address and "reg" property were changed. This
should have no functional impact on Linux users, because PAS loader does
not use this address space at all.
Fixes: 177fcf0aeda2 ("arm64: dts: qcom: sm8350: Add remoteprocs")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-1-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8350.dtsi | 272 +++++++++++++++++------------------
1 file changed, 136 insertions(+), 136 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -1876,6 +1876,142 @@
reg = <0x0 0x1fc0000 0x0 0x30000>;
};
+ adsp: remoteproc@3000000 {
+ compatible = "qcom,sm8350-adsp-pas";
+ reg = <0x0 0x03000000 0x0 0x10000>;
+
+ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "wdog", "fatal", "ready",
+ "handover", "stop-ack";
+
+ clocks = <&rpmhcc RPMH_CXO_CLK>;
+ clock-names = "xo";
+
+ power-domains = <&rpmhpd RPMHPD_LCX>,
+ <&rpmhpd RPMHPD_LMX>;
+ power-domain-names = "lcx", "lmx";
+
+ memory-region = <&pil_adsp_mem>;
+
+ qcom,qmp = <&aoss_qmp>;
+
+ qcom,smem-states = <&smp2p_adsp_out 0>;
+ qcom,smem-state-names = "stop";
+
+ status = "disabled";
+
+ glink-edge {
+ interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP
+ IRQ_TYPE_EDGE_RISING>;
+ mboxes = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+ label = "lpass";
+ qcom,remote-pid = <2>;
+
+ apr {
+ compatible = "qcom,apr-v2";
+ qcom,glink-channels = "apr_audio_svc";
+ qcom,domain = <APR_DOMAIN_ADSP>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ service@3 {
+ reg = <APR_SVC_ADSP_CORE>;
+ compatible = "qcom,q6core";
+ qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd";
+ };
+
+ q6afe: service@4 {
+ compatible = "qcom,q6afe";
+ reg = <APR_SVC_AFE>;
+ qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd";
+
+ q6afedai: dais {
+ compatible = "qcom,q6afe-dais";
+ #address-cells = <1>;
+ #size-cells = <0>;
+ #sound-dai-cells = <1>;
+ };
+
+ q6afecc: clock-controller {
+ compatible = "qcom,q6afe-clocks";
+ #clock-cells = <2>;
+ };
+ };
+
+ q6asm: service@7 {
+ compatible = "qcom,q6asm";
+ reg = <APR_SVC_ASM>;
+ qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd";
+
+ q6asmdai: dais {
+ compatible = "qcom,q6asm-dais";
+ #address-cells = <1>;
+ #size-cells = <0>;
+ #sound-dai-cells = <1>;
+ iommus = <&apps_smmu 0x1801 0x0>;
+
+ dai@0 {
+ reg = <0>;
+ };
+
+ dai@1 {
+ reg = <1>;
+ };
+
+ dai@2 {
+ reg = <2>;
+ };
+ };
+ };
+
+ q6adm: service@8 {
+ compatible = "qcom,q6adm";
+ reg = <APR_SVC_ADM>;
+ qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd";
+
+ q6routing: routing {
+ compatible = "qcom,q6adm-routing";
+ #sound-dai-cells = <0>;
+ };
+ };
+ };
+
+ fastrpc {
+ compatible = "qcom,fastrpc";
+ qcom,glink-channels = "fastrpcglink-apps-dsp";
+ label = "adsp";
+ qcom,non-secure-domain;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ compute-cb@3 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <3>;
+ iommus = <&apps_smmu 0x1803 0x0>;
+ };
+
+ compute-cb@4 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <4>;
+ iommus = <&apps_smmu 0x1804 0x0>;
+ };
+
+ compute-cb@5 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <5>;
+ iommus = <&apps_smmu 0x1805 0x0>;
+ };
+ };
+ };
+ };
+
lpass_tlmm: pinctrl@33c0000 {
compatible = "qcom,sm8350-lpass-lpi-pinctrl";
reg = <0 0x033c0000 0 0x20000>,
@@ -3285,142 +3421,6 @@
dma-coherent;
};
- adsp: remoteproc@17300000 {
- compatible = "qcom,sm8350-adsp-pas";
- reg = <0 0x17300000 0 0x100>;
-
- interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
- interrupt-names = "wdog", "fatal", "ready",
- "handover", "stop-ack";
-
- clocks = <&rpmhcc RPMH_CXO_CLK>;
- clock-names = "xo";
-
- power-domains = <&rpmhpd RPMHPD_LCX>,
- <&rpmhpd RPMHPD_LMX>;
- power-domain-names = "lcx", "lmx";
-
- memory-region = <&pil_adsp_mem>;
-
- qcom,qmp = <&aoss_qmp>;
-
- qcom,smem-states = <&smp2p_adsp_out 0>;
- qcom,smem-state-names = "stop";
-
- status = "disabled";
-
- glink-edge {
- interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP
- IRQ_TYPE_EDGE_RISING>;
- mboxes = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP>;
-
- label = "lpass";
- qcom,remote-pid = <2>;
-
- apr {
- compatible = "qcom,apr-v2";
- qcom,glink-channels = "apr_audio_svc";
- qcom,domain = <APR_DOMAIN_ADSP>;
- #address-cells = <1>;
- #size-cells = <0>;
-
- service@3 {
- reg = <APR_SVC_ADSP_CORE>;
- compatible = "qcom,q6core";
- qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd";
- };
-
- q6afe: service@4 {
- compatible = "qcom,q6afe";
- reg = <APR_SVC_AFE>;
- qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd";
-
- q6afedai: dais {
- compatible = "qcom,q6afe-dais";
- #address-cells = <1>;
- #size-cells = <0>;
- #sound-dai-cells = <1>;
- };
-
- q6afecc: clock-controller {
- compatible = "qcom,q6afe-clocks";
- #clock-cells = <2>;
- };
- };
-
- q6asm: service@7 {
- compatible = "qcom,q6asm";
- reg = <APR_SVC_ASM>;
- qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd";
-
- q6asmdai: dais {
- compatible = "qcom,q6asm-dais";
- #address-cells = <1>;
- #size-cells = <0>;
- #sound-dai-cells = <1>;
- iommus = <&apps_smmu 0x1801 0x0>;
-
- dai@0 {
- reg = <0>;
- };
-
- dai@1 {
- reg = <1>;
- };
-
- dai@2 {
- reg = <2>;
- };
- };
- };
-
- q6adm: service@8 {
- compatible = "qcom,q6adm";
- reg = <APR_SVC_ADM>;
- qcom,protection-domain = "avs/audio", "msm/adsp/audio_pd";
-
- q6routing: routing {
- compatible = "qcom,q6adm-routing";
- #sound-dai-cells = <0>;
- };
- };
- };
-
- fastrpc {
- compatible = "qcom,fastrpc";
- qcom,glink-channels = "fastrpcglink-apps-dsp";
- label = "adsp";
- qcom,non-secure-domain;
- #address-cells = <1>;
- #size-cells = <0>;
-
- compute-cb@3 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <3>;
- iommus = <&apps_smmu 0x1803 0x0>;
- };
-
- compute-cb@4 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <4>;
- iommus = <&apps_smmu 0x1804 0x0>;
- };
-
- compute-cb@5 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <5>;
- iommus = <&apps_smmu 0x1805 0x0>;
- };
- };
- };
- };
-
intc: interrupt-controller@17a00000 {
compatible = "arm,gic-v3";
#interrupt-cells = <3>;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 311/443] arm64: dts: qcom: sm8350: Fix CDSP memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 310/443] arm64: dts: qcom: sm8350: Fix ADSP " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 312/443] arm64: dts: qcom: sm8350: Fix MPSS memory length Greg Kroah-Hartman
` (142 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit f4afd8ba453b6e82245b9068868c72c831aec84e upstream.
The address space in CDSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0a30_0000 with length of 0x10000. 0x9890_0000,
value used so far, was copied from downstream DTS, is in the middle of
RAM/DDR space and downstream DTS describes the PIL loader, which is a
bit different interface. Datasheet says that one of the main CDSP
address spaces is 0x0980_0000, which is oddly similar to 0x9890_0000,
but quite different.
Assume existing value (thus downstream DTS) is not really describing the
intended CDSP PAS region.
Correct the base address and length, which also moves the node to
different place to keep things sorted by unit address. The diff looks
big, but only the unit address and "reg" property were changed. This
should have no functional impact on Linux users, because PAS loader does
not use this address space at all.
Fixes: 177fcf0aeda2 ("arm64: dts: qcom: sm8350: Add remoteprocs")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-2-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8350.dtsi | 218 +++++++++++++++++------------------
1 file changed, 109 insertions(+), 109 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -2496,6 +2496,115 @@
qcom,bcm-voters = <&apps_bcm_voter>;
};
+ cdsp: remoteproc@a300000 {
+ compatible = "qcom,sm8350-cdsp-pas";
+ reg = <0x0 0x0a300000 0x0 0x10000>;
+
+ interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_cdsp_in 3 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "wdog", "fatal", "ready",
+ "handover", "stop-ack";
+
+ clocks = <&rpmhcc RPMH_CXO_CLK>;
+ clock-names = "xo";
+
+ power-domains = <&rpmhpd RPMHPD_CX>,
+ <&rpmhpd RPMHPD_MXC>;
+ power-domain-names = "cx", "mxc";
+
+ interconnects = <&compute_noc MASTER_CDSP_PROC 0 &mc_virt SLAVE_EBI1 0>;
+
+ memory-region = <&pil_cdsp_mem>;
+
+ qcom,qmp = <&aoss_qmp>;
+
+ qcom,smem-states = <&smp2p_cdsp_out 0>;
+ qcom,smem-state-names = "stop";
+
+ status = "disabled";
+
+ glink-edge {
+ interrupts-extended = <&ipcc IPCC_CLIENT_CDSP
+ IPCC_MPROC_SIGNAL_GLINK_QMP
+ IRQ_TYPE_EDGE_RISING>;
+ mboxes = <&ipcc IPCC_CLIENT_CDSP
+ IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+ label = "cdsp";
+ qcom,remote-pid = <5>;
+
+ fastrpc {
+ compatible = "qcom,fastrpc";
+ qcom,glink-channels = "fastrpcglink-apps-dsp";
+ label = "cdsp";
+ qcom,non-secure-domain;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ compute-cb@1 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <1>;
+ iommus = <&apps_smmu 0x2161 0x0400>,
+ <&apps_smmu 0x1181 0x0420>;
+ };
+
+ compute-cb@2 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <2>;
+ iommus = <&apps_smmu 0x2162 0x0400>,
+ <&apps_smmu 0x1182 0x0420>;
+ };
+
+ compute-cb@3 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <3>;
+ iommus = <&apps_smmu 0x2163 0x0400>,
+ <&apps_smmu 0x1183 0x0420>;
+ };
+
+ compute-cb@4 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <4>;
+ iommus = <&apps_smmu 0x2164 0x0400>,
+ <&apps_smmu 0x1184 0x0420>;
+ };
+
+ compute-cb@5 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <5>;
+ iommus = <&apps_smmu 0x2165 0x0400>,
+ <&apps_smmu 0x1185 0x0420>;
+ };
+
+ compute-cb@6 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <6>;
+ iommus = <&apps_smmu 0x2166 0x0400>,
+ <&apps_smmu 0x1186 0x0420>;
+ };
+
+ compute-cb@7 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <7>;
+ iommus = <&apps_smmu 0x2167 0x0400>,
+ <&apps_smmu 0x1187 0x0420>;
+ };
+
+ compute-cb@8 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <8>;
+ iommus = <&apps_smmu 0x2168 0x0400>,
+ <&apps_smmu 0x1188 0x0420>;
+ };
+
+ /* note: secure cb9 in downstream */
+ };
+ };
+ };
+
usb_1: usb@a6f8800 {
compatible = "qcom,sm8350-dwc3", "qcom,dwc3";
reg = <0 0x0a6f8800 0 0x400>;
@@ -3589,115 +3698,6 @@
#freq-domain-cells = <1>;
#clock-cells = <1>;
};
-
- cdsp: remoteproc@98900000 {
- compatible = "qcom,sm8350-cdsp-pas";
- reg = <0 0x98900000 0 0x1400000>;
-
- interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_cdsp_in 1 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_cdsp_in 2 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_cdsp_in 3 IRQ_TYPE_EDGE_RISING>;
- interrupt-names = "wdog", "fatal", "ready",
- "handover", "stop-ack";
-
- clocks = <&rpmhcc RPMH_CXO_CLK>;
- clock-names = "xo";
-
- power-domains = <&rpmhpd RPMHPD_CX>,
- <&rpmhpd RPMHPD_MXC>;
- power-domain-names = "cx", "mxc";
-
- interconnects = <&compute_noc MASTER_CDSP_PROC 0 &mc_virt SLAVE_EBI1 0>;
-
- memory-region = <&pil_cdsp_mem>;
-
- qcom,qmp = <&aoss_qmp>;
-
- qcom,smem-states = <&smp2p_cdsp_out 0>;
- qcom,smem-state-names = "stop";
-
- status = "disabled";
-
- glink-edge {
- interrupts-extended = <&ipcc IPCC_CLIENT_CDSP
- IPCC_MPROC_SIGNAL_GLINK_QMP
- IRQ_TYPE_EDGE_RISING>;
- mboxes = <&ipcc IPCC_CLIENT_CDSP
- IPCC_MPROC_SIGNAL_GLINK_QMP>;
-
- label = "cdsp";
- qcom,remote-pid = <5>;
-
- fastrpc {
- compatible = "qcom,fastrpc";
- qcom,glink-channels = "fastrpcglink-apps-dsp";
- label = "cdsp";
- qcom,non-secure-domain;
- #address-cells = <1>;
- #size-cells = <0>;
-
- compute-cb@1 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <1>;
- iommus = <&apps_smmu 0x2161 0x0400>,
- <&apps_smmu 0x1181 0x0420>;
- };
-
- compute-cb@2 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <2>;
- iommus = <&apps_smmu 0x2162 0x0400>,
- <&apps_smmu 0x1182 0x0420>;
- };
-
- compute-cb@3 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <3>;
- iommus = <&apps_smmu 0x2163 0x0400>,
- <&apps_smmu 0x1183 0x0420>;
- };
-
- compute-cb@4 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <4>;
- iommus = <&apps_smmu 0x2164 0x0400>,
- <&apps_smmu 0x1184 0x0420>;
- };
-
- compute-cb@5 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <5>;
- iommus = <&apps_smmu 0x2165 0x0400>,
- <&apps_smmu 0x1185 0x0420>;
- };
-
- compute-cb@6 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <6>;
- iommus = <&apps_smmu 0x2166 0x0400>,
- <&apps_smmu 0x1186 0x0420>;
- };
-
- compute-cb@7 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <7>;
- iommus = <&apps_smmu 0x2167 0x0400>,
- <&apps_smmu 0x1187 0x0420>;
- };
-
- compute-cb@8 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <8>;
- iommus = <&apps_smmu 0x2168 0x0400>,
- <&apps_smmu 0x1188 0x0420>;
- };
-
- /* note: secure cb9 in downstream */
- };
- };
- };
};
thermal_zones: thermal-zones {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 312/443] arm64: dts: qcom: sm8350: Fix MPSS memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 311/443] arm64: dts: qcom: sm8350: Fix CDSP " Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 313/443] arm64: dts: qcom: sm8450: Fix ADSP memory base and length Greg Kroah-Hartman
` (141 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit da1937dec9cd986e685b6a429b528a4cbc7b1603 upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x4040 was
copied from older DTS, but it grew since then.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: 177fcf0aeda2 ("arm64: dts: qcom: sm8350: Add remoteprocs")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-3-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -2214,7 +2214,7 @@
mpss: remoteproc@4080000 {
compatible = "qcom,sm8350-mpss-pas";
- reg = <0x0 0x04080000 0x0 0x4040>;
+ reg = <0x0 0x04080000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_EDGE_RISING>,
<&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 313/443] arm64: dts: qcom: sm8450: Fix ADSP memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 312/443] arm64: dts: qcom: sm8350: Fix MPSS memory length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:27 ` [PATCH 6.13 314/443] arm64: dts: qcom: sm8450: Fix CDSP memory length Greg Kroah-Hartman
` (140 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Krzysztof Kozlowski,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 13c96bee5d5e5b61a9d8d000c9bb37bb9a2a0551 upstream.
The address space in ADSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0300_0000 with length of 0x10000, which also matches
downstream DTS. 0x3000_0000, value used so far, was in datasheet is the
region of CDSP.
Correct the base address and length, which also moves the node to
different place to keep things sorted by unit address. The diff looks
big, but only the unit address and "reg" property were changed. This
should have no functional impact on Linux users, because PAS loader does
not use this address space at all.
Fixes: 1172729576fb ("arm64: dts: qcom: sm8450: Add remoteproc enablers and instances")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-4-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8450.dtsi | 212 +++++++++++++++++------------------
1 file changed, 106 insertions(+), 106 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
@@ -2496,6 +2496,112 @@
};
};
+ remoteproc_adsp: remoteproc@3000000 {
+ compatible = "qcom,sm8450-adsp-pas";
+ reg = <0x0 0x03000000 0x0 0x10000>;
+
+ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "wdog", "fatal", "ready",
+ "handover", "stop-ack";
+
+ clocks = <&rpmhcc RPMH_CXO_CLK>;
+ clock-names = "xo";
+
+ power-domains = <&rpmhpd RPMHPD_LCX>,
+ <&rpmhpd RPMHPD_LMX>;
+ power-domain-names = "lcx", "lmx";
+
+ memory-region = <&adsp_mem>;
+
+ qcom,qmp = <&aoss_qmp>;
+
+ qcom,smem-states = <&smp2p_adsp_out 0>;
+ qcom,smem-state-names = "stop";
+
+ status = "disabled";
+
+ remoteproc_adsp_glink: glink-edge {
+ interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP
+ IRQ_TYPE_EDGE_RISING>;
+ mboxes = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+ label = "lpass";
+ qcom,remote-pid = <2>;
+
+ gpr {
+ compatible = "qcom,gpr";
+ qcom,glink-channels = "adsp_apps";
+ qcom,domain = <GPR_DOMAIN_ID_ADSP>;
+ qcom,intents = <512 20>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ q6apm: service@1 {
+ compatible = "qcom,q6apm";
+ reg = <GPR_APM_MODULE_IID>;
+ #sound-dai-cells = <0>;
+ qcom,protection-domain = "avs/audio",
+ "msm/adsp/audio_pd";
+
+ q6apmdai: dais {
+ compatible = "qcom,q6apm-dais";
+ iommus = <&apps_smmu 0x1801 0x0>;
+ };
+
+ q6apmbedai: bedais {
+ compatible = "qcom,q6apm-lpass-dais";
+ #sound-dai-cells = <1>;
+ };
+ };
+
+ q6prm: service@2 {
+ compatible = "qcom,q6prm";
+ reg = <GPR_PRM_MODULE_IID>;
+ qcom,protection-domain = "avs/audio",
+ "msm/adsp/audio_pd";
+
+ q6prmcc: clock-controller {
+ compatible = "qcom,q6prm-lpass-clocks";
+ #clock-cells = <2>;
+ };
+ };
+ };
+
+ fastrpc {
+ compatible = "qcom,fastrpc";
+ qcom,glink-channels = "fastrpcglink-apps-dsp";
+ label = "adsp";
+ qcom,non-secure-domain;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ compute-cb@3 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <3>;
+ iommus = <&apps_smmu 0x1803 0x0>;
+ };
+
+ compute-cb@4 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <4>;
+ iommus = <&apps_smmu 0x1804 0x0>;
+ };
+
+ compute-cb@5 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <5>;
+ iommus = <&apps_smmu 0x1805 0x0>;
+ };
+ };
+ };
+ };
+
wsa2macro: codec@31e0000 {
compatible = "qcom,sm8450-lpass-wsa-macro";
reg = <0 0x031e0000 0 0x1000>;
@@ -2692,112 +2798,6 @@
status = "disabled";
};
- remoteproc_adsp: remoteproc@30000000 {
- compatible = "qcom,sm8450-adsp-pas";
- reg = <0 0x30000000 0 0x100>;
-
- interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
- interrupt-names = "wdog", "fatal", "ready",
- "handover", "stop-ack";
-
- clocks = <&rpmhcc RPMH_CXO_CLK>;
- clock-names = "xo";
-
- power-domains = <&rpmhpd RPMHPD_LCX>,
- <&rpmhpd RPMHPD_LMX>;
- power-domain-names = "lcx", "lmx";
-
- memory-region = <&adsp_mem>;
-
- qcom,qmp = <&aoss_qmp>;
-
- qcom,smem-states = <&smp2p_adsp_out 0>;
- qcom,smem-state-names = "stop";
-
- status = "disabled";
-
- remoteproc_adsp_glink: glink-edge {
- interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP
- IRQ_TYPE_EDGE_RISING>;
- mboxes = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP>;
-
- label = "lpass";
- qcom,remote-pid = <2>;
-
- gpr {
- compatible = "qcom,gpr";
- qcom,glink-channels = "adsp_apps";
- qcom,domain = <GPR_DOMAIN_ID_ADSP>;
- qcom,intents = <512 20>;
- #address-cells = <1>;
- #size-cells = <0>;
-
- q6apm: service@1 {
- compatible = "qcom,q6apm";
- reg = <GPR_APM_MODULE_IID>;
- #sound-dai-cells = <0>;
- qcom,protection-domain = "avs/audio",
- "msm/adsp/audio_pd";
-
- q6apmdai: dais {
- compatible = "qcom,q6apm-dais";
- iommus = <&apps_smmu 0x1801 0x0>;
- };
-
- q6apmbedai: bedais {
- compatible = "qcom,q6apm-lpass-dais";
- #sound-dai-cells = <1>;
- };
- };
-
- q6prm: service@2 {
- compatible = "qcom,q6prm";
- reg = <GPR_PRM_MODULE_IID>;
- qcom,protection-domain = "avs/audio",
- "msm/adsp/audio_pd";
-
- q6prmcc: clock-controller {
- compatible = "qcom,q6prm-lpass-clocks";
- #clock-cells = <2>;
- };
- };
- };
-
- fastrpc {
- compatible = "qcom,fastrpc";
- qcom,glink-channels = "fastrpcglink-apps-dsp";
- label = "adsp";
- qcom,non-secure-domain;
- #address-cells = <1>;
- #size-cells = <0>;
-
- compute-cb@3 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <3>;
- iommus = <&apps_smmu 0x1803 0x0>;
- };
-
- compute-cb@4 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <4>;
- iommus = <&apps_smmu 0x1804 0x0>;
- };
-
- compute-cb@5 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <5>;
- iommus = <&apps_smmu 0x1805 0x0>;
- };
- };
- };
- };
-
remoteproc_cdsp: remoteproc@32300000 {
compatible = "qcom,sm8450-cdsp-pas";
reg = <0 0x32300000 0 0x1400000>;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 314/443] arm64: dts: qcom: sm8450: Fix CDSP memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 313/443] arm64: dts: qcom: sm8450: Fix ADSP memory base and length Greg Kroah-Hartman
@ 2025-02-13 14:27 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 315/443] arm64: dts: qcom: sm8450: Fix MPSS " Greg Kroah-Hartman
` (139 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Krzysztof Kozlowski,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 3751fe2cba2a9fba2204ef62102bc4bb027cec7b upstream.
The address space in CDSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x1400000 was
copied from older DTS, but it does not look accurate at all.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: 1172729576fb ("arm64: dts: qcom: sm8450: Add remoteproc enablers and instances")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-5-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
@@ -2800,7 +2800,7 @@
remoteproc_cdsp: remoteproc@32300000 {
compatible = "qcom,sm8450-cdsp-pas";
- reg = <0 0x32300000 0 0x1400000>;
+ reg = <0 0x32300000 0 0x10000>;
interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
<&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 315/443] arm64: dts: qcom: sm8450: Fix MPSS memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2025-02-13 14:27 ` [PATCH 6.13 314/443] arm64: dts: qcom: sm8450: Fix CDSP memory length Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 316/443] arm64: dts: qcom: sm8550: Fix ADSP memory base and length Greg Kroah-Hartman
` (138 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Krzysztof Kozlowski,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit fa6442e87ab7c4a58c0b5fc64aab1aacc8034712 upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x4040 was
copied from older DTS, but it grew since then.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: 1172729576fb ("arm64: dts: qcom: sm8450: Add remoteproc enablers and instances")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-6-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
@@ -2907,7 +2907,7 @@
remoteproc_mpss: remoteproc@4080000 {
compatible = "qcom,sm8450-mpss-pas";
- reg = <0x0 0x04080000 0x0 0x4040>;
+ reg = <0x0 0x04080000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_EDGE_RISING>,
<&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 316/443] arm64: dts: qcom: sm8550: Fix ADSP memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 315/443] arm64: dts: qcom: sm8450: Fix MPSS " Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 317/443] arm64: dts: qcom: sm8550: Fix CDSP memory length Greg Kroah-Hartman
` (137 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Konrad Dybcio,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit a6a8f54bc2af555738322783ba1e990c2ae7f443 upstream.
The address space in ADSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0680_0000 with length of 0x10000.
0x3000_0000, value used so far, is the main region of CDSP. Downstream
DTS uses 0x0300_0000, which is oddly similar to 0x3000_0000, yet quite
different and points to unused area.
Correct the base address and length, which also moves the node to
different place to keep things sorted by unit address. The diff looks
big, but only the unit address and "reg" property were changed. This
should have no functional impact on Linux users, because PAS loader does
not use this address space at all.
Fixes: d0c061e366ed ("arm64: dts: qcom: sm8550: add adsp, cdsp & mdss nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-7-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8550.dtsi | 262 +++++++++++++++++------------------
1 file changed, 131 insertions(+), 131 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
@@ -2354,6 +2354,137 @@
};
};
+ remoteproc_adsp: remoteproc@6800000 {
+ compatible = "qcom,sm8550-adsp-pas";
+ reg = <0x0 0x06800000 0x0 0x10000>;
+
+ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "wdog", "fatal", "ready",
+ "handover", "stop-ack";
+
+ clocks = <&rpmhcc RPMH_CXO_CLK>;
+ clock-names = "xo";
+
+ power-domains = <&rpmhpd RPMHPD_LCX>,
+ <&rpmhpd RPMHPD_LMX>;
+ power-domain-names = "lcx", "lmx";
+
+ interconnects = <&lpass_lpicx_noc MASTER_LPASS_PROC 0 &mc_virt SLAVE_EBI1 0>;
+
+ memory-region = <&adspslpi_mem>, <&q6_adsp_dtb_mem>;
+
+ qcom,qmp = <&aoss_qmp>;
+
+ qcom,smem-states = <&smp2p_adsp_out 0>;
+ qcom,smem-state-names = "stop";
+
+ status = "disabled";
+
+ remoteproc_adsp_glink: glink-edge {
+ interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP
+ IRQ_TYPE_EDGE_RISING>;
+ mboxes = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+ label = "lpass";
+ qcom,remote-pid = <2>;
+
+ fastrpc {
+ compatible = "qcom,fastrpc";
+ qcom,glink-channels = "fastrpcglink-apps-dsp";
+ label = "adsp";
+ qcom,non-secure-domain;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ compute-cb@3 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <3>;
+ iommus = <&apps_smmu 0x1003 0x80>,
+ <&apps_smmu 0x1063 0x0>;
+ dma-coherent;
+ };
+
+ compute-cb@4 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <4>;
+ iommus = <&apps_smmu 0x1004 0x80>,
+ <&apps_smmu 0x1064 0x0>;
+ dma-coherent;
+ };
+
+ compute-cb@5 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <5>;
+ iommus = <&apps_smmu 0x1005 0x80>,
+ <&apps_smmu 0x1065 0x0>;
+ dma-coherent;
+ };
+
+ compute-cb@6 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <6>;
+ iommus = <&apps_smmu 0x1006 0x80>,
+ <&apps_smmu 0x1066 0x0>;
+ dma-coherent;
+ };
+
+ compute-cb@7 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <7>;
+ iommus = <&apps_smmu 0x1007 0x80>,
+ <&apps_smmu 0x1067 0x0>;
+ dma-coherent;
+ };
+ };
+
+ gpr {
+ compatible = "qcom,gpr";
+ qcom,glink-channels = "adsp_apps";
+ qcom,domain = <GPR_DOMAIN_ID_ADSP>;
+ qcom,intents = <512 20>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ q6apm: service@1 {
+ compatible = "qcom,q6apm";
+ reg = <GPR_APM_MODULE_IID>;
+ #sound-dai-cells = <0>;
+ qcom,protection-domain = "avs/audio",
+ "msm/adsp/audio_pd";
+
+ q6apmdai: dais {
+ compatible = "qcom,q6apm-dais";
+ iommus = <&apps_smmu 0x1001 0x80>,
+ <&apps_smmu 0x1061 0x0>;
+ };
+
+ q6apmbedai: bedais {
+ compatible = "qcom,q6apm-lpass-dais";
+ #sound-dai-cells = <1>;
+ };
+ };
+
+ q6prm: service@2 {
+ compatible = "qcom,q6prm";
+ reg = <GPR_PRM_MODULE_IID>;
+ qcom,protection-domain = "avs/audio",
+ "msm/adsp/audio_pd";
+
+ q6prmcc: clock-controller {
+ compatible = "qcom,q6prm-lpass-clocks";
+ #clock-cells = <2>;
+ };
+ };
+ };
+ };
+ };
+
lpass_wsa2macro: codec@6aa0000 {
compatible = "qcom,sm8550-lpass-wsa-macro";
reg = <0 0x06aa0000 0 0x1000>;
@@ -4576,137 +4707,6 @@
interrupts = <GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>;
};
- remoteproc_adsp: remoteproc@30000000 {
- compatible = "qcom,sm8550-adsp-pas";
- reg = <0x0 0x30000000 0x0 0x100>;
-
- interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
- interrupt-names = "wdog", "fatal", "ready",
- "handover", "stop-ack";
-
- clocks = <&rpmhcc RPMH_CXO_CLK>;
- clock-names = "xo";
-
- power-domains = <&rpmhpd RPMHPD_LCX>,
- <&rpmhpd RPMHPD_LMX>;
- power-domain-names = "lcx", "lmx";
-
- interconnects = <&lpass_lpicx_noc MASTER_LPASS_PROC 0 &mc_virt SLAVE_EBI1 0>;
-
- memory-region = <&adspslpi_mem>, <&q6_adsp_dtb_mem>;
-
- qcom,qmp = <&aoss_qmp>;
-
- qcom,smem-states = <&smp2p_adsp_out 0>;
- qcom,smem-state-names = "stop";
-
- status = "disabled";
-
- remoteproc_adsp_glink: glink-edge {
- interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP
- IRQ_TYPE_EDGE_RISING>;
- mboxes = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP>;
-
- label = "lpass";
- qcom,remote-pid = <2>;
-
- fastrpc {
- compatible = "qcom,fastrpc";
- qcom,glink-channels = "fastrpcglink-apps-dsp";
- label = "adsp";
- qcom,non-secure-domain;
- #address-cells = <1>;
- #size-cells = <0>;
-
- compute-cb@3 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <3>;
- iommus = <&apps_smmu 0x1003 0x80>,
- <&apps_smmu 0x1063 0x0>;
- dma-coherent;
- };
-
- compute-cb@4 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <4>;
- iommus = <&apps_smmu 0x1004 0x80>,
- <&apps_smmu 0x1064 0x0>;
- dma-coherent;
- };
-
- compute-cb@5 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <5>;
- iommus = <&apps_smmu 0x1005 0x80>,
- <&apps_smmu 0x1065 0x0>;
- dma-coherent;
- };
-
- compute-cb@6 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <6>;
- iommus = <&apps_smmu 0x1006 0x80>,
- <&apps_smmu 0x1066 0x0>;
- dma-coherent;
- };
-
- compute-cb@7 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <7>;
- iommus = <&apps_smmu 0x1007 0x80>,
- <&apps_smmu 0x1067 0x0>;
- dma-coherent;
- };
- };
-
- gpr {
- compatible = "qcom,gpr";
- qcom,glink-channels = "adsp_apps";
- qcom,domain = <GPR_DOMAIN_ID_ADSP>;
- qcom,intents = <512 20>;
- #address-cells = <1>;
- #size-cells = <0>;
-
- q6apm: service@1 {
- compatible = "qcom,q6apm";
- reg = <GPR_APM_MODULE_IID>;
- #sound-dai-cells = <0>;
- qcom,protection-domain = "avs/audio",
- "msm/adsp/audio_pd";
-
- q6apmdai: dais {
- compatible = "qcom,q6apm-dais";
- iommus = <&apps_smmu 0x1001 0x80>,
- <&apps_smmu 0x1061 0x0>;
- };
-
- q6apmbedai: bedais {
- compatible = "qcom,q6apm-lpass-dais";
- #sound-dai-cells = <1>;
- };
- };
-
- q6prm: service@2 {
- compatible = "qcom,q6prm";
- reg = <GPR_PRM_MODULE_IID>;
- qcom,protection-domain = "avs/audio",
- "msm/adsp/audio_pd";
-
- q6prmcc: clock-controller {
- compatible = "qcom,q6prm-lpass-clocks";
- #clock-cells = <2>;
- };
- };
- };
- };
- };
-
nsp_noc: interconnect@320c0000 {
compatible = "qcom,sm8550-nsp-noc";
reg = <0 0x320c0000 0 0xe080>;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 317/443] arm64: dts: qcom: sm8550: Fix CDSP memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 316/443] arm64: dts: qcom: sm8550: Fix ADSP memory base and length Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 318/443] arm64: dts: qcom: sm8550: Fix MPSS " Greg Kroah-Hartman
` (136 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Konrad Dybcio,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 6b2570e1e43e4acd0fcb98c6489736fe1c67b222 upstream.
The address space in CDSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x1400000 was
copied from older DTS, but it does not look accurate at all.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: d0c061e366ed ("arm64: dts: qcom: sm8550: add adsp, cdsp & mdss nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-8-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
@@ -4716,7 +4716,7 @@
remoteproc_cdsp: remoteproc@32300000 {
compatible = "qcom,sm8550-cdsp-pas";
- reg = <0x0 0x32300000 0x0 0x1400000>;
+ reg = <0x0 0x32300000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
<&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 318/443] arm64: dts: qcom: sm8550: Fix MPSS memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 317/443] arm64: dts: qcom: sm8550: Fix CDSP memory length Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 319/443] arm64: dts: qcom: sm8650: Fix ADSP memory base and length Greg Kroah-Hartman
` (135 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Konrad Dybcio,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 8ef227e93a513d431f9345f23cd4d2d65607b985 upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x4040 was
copied from older DTS, but it grew since then.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: d0c061e366ed ("arm64: dts: qcom: sm8550: add adsp, cdsp & mdss nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-9-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
@@ -2314,7 +2314,7 @@
remoteproc_mpss: remoteproc@4080000 {
compatible = "qcom,sm8550-mpss-pas";
- reg = <0x0 0x04080000 0x0 0x4040>;
+ reg = <0x0 0x04080000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_EDGE_RISING>,
<&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 319/443] arm64: dts: qcom: sm8650: Fix ADSP memory base and length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 318/443] arm64: dts: qcom: sm8550: Fix MPSS " Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 320/443] arm64: dts: qcom: sm8650: Fix CDSP memory length Greg Kroah-Hartman
` (134 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Konrad Dybcio,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit b6ddc5c37323f7875c2533cc4949be58d15e430a upstream.
The address space in ADSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB): 0x0680_0000 with length of 0x10000.
0x3000_0000, value used so far, is the main region of CDSP. Downstream
DTS uses 0x0300_0000, which is oddly similar to 0x3000_0000, yet quite
different and points to unused area.
Correct the base address and length, which also moves the node to
different place to keep things sorted by unit address. The diff looks
big, but only the unit address and "reg" property were changed. This
should have no functional impact on Linux users, because PAS loader does
not use this address space at all.
Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-10-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8650.dtsi | 296 +++++++++++++++++------------------
1 file changed, 148 insertions(+), 148 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
@@ -2904,6 +2904,154 @@
};
};
+ remoteproc_adsp: remoteproc@6800000 {
+ compatible = "qcom,sm8650-adsp-pas";
+ reg = <0x0 0x06800000 0x0 0x10000>;
+
+ interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
+ <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "wdog",
+ "fatal",
+ "ready",
+ "handover",
+ "stop-ack";
+
+ clocks = <&rpmhcc RPMH_CXO_CLK>;
+ clock-names = "xo";
+
+ interconnects = <&lpass_lpicx_noc MASTER_LPASS_PROC QCOM_ICC_TAG_ALWAYS
+ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+
+ power-domains = <&rpmhpd RPMHPD_LCX>,
+ <&rpmhpd RPMHPD_LMX>;
+ power-domain-names = "lcx",
+ "lmx";
+
+ memory-region = <&adspslpi_mem>, <&q6_adsp_dtb_mem>;
+
+ qcom,qmp = <&aoss_qmp>;
+
+ qcom,smem-states = <&smp2p_adsp_out 0>;
+ qcom,smem-state-names = "stop";
+
+ status = "disabled";
+
+ remoteproc_adsp_glink: glink-edge {
+ interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP
+ IRQ_TYPE_EDGE_RISING>;
+
+ mboxes = <&ipcc IPCC_CLIENT_LPASS
+ IPCC_MPROC_SIGNAL_GLINK_QMP>;
+
+ qcom,remote-pid = <2>;
+
+ label = "lpass";
+
+ fastrpc {
+ compatible = "qcom,fastrpc";
+
+ qcom,glink-channels = "fastrpcglink-apps-dsp";
+
+ label = "adsp";
+
+ qcom,non-secure-domain;
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ compute-cb@3 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <3>;
+
+ iommus = <&apps_smmu 0x1003 0x80>,
+ <&apps_smmu 0x1043 0x20>;
+ dma-coherent;
+ };
+
+ compute-cb@4 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <4>;
+
+ iommus = <&apps_smmu 0x1004 0x80>,
+ <&apps_smmu 0x1044 0x20>;
+ dma-coherent;
+ };
+
+ compute-cb@5 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <5>;
+
+ iommus = <&apps_smmu 0x1005 0x80>,
+ <&apps_smmu 0x1045 0x20>;
+ dma-coherent;
+ };
+
+ compute-cb@6 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <6>;
+
+ iommus = <&apps_smmu 0x1006 0x80>,
+ <&apps_smmu 0x1046 0x20>;
+ dma-coherent;
+ };
+
+ compute-cb@7 {
+ compatible = "qcom,fastrpc-compute-cb";
+ reg = <7>;
+
+ iommus = <&apps_smmu 0x1007 0x40>,
+ <&apps_smmu 0x1067 0x0>,
+ <&apps_smmu 0x1087 0x0>;
+ dma-coherent;
+ };
+ };
+
+ gpr {
+ compatible = "qcom,gpr";
+ qcom,glink-channels = "adsp_apps";
+ qcom,domain = <GPR_DOMAIN_ID_ADSP>;
+ qcom,intents = <512 20>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ q6apm: service@1 {
+ compatible = "qcom,q6apm";
+ reg = <GPR_APM_MODULE_IID>;
+ #sound-dai-cells = <0>;
+ qcom,protection-domain = "avs/audio",
+ "msm/adsp/audio_pd";
+
+ q6apmbedai: bedais {
+ compatible = "qcom,q6apm-lpass-dais";
+ #sound-dai-cells = <1>;
+ };
+
+ q6apmdai: dais {
+ compatible = "qcom,q6apm-dais";
+ iommus = <&apps_smmu 0x1001 0x80>,
+ <&apps_smmu 0x1061 0x0>;
+ };
+ };
+
+ q6prm: service@2 {
+ compatible = "qcom,q6prm";
+ reg = <GPR_PRM_MODULE_IID>;
+ qcom,protection-domain = "avs/audio",
+ "msm/adsp/audio_pd";
+
+ q6prmcc: clock-controller {
+ compatible = "qcom,q6prm-lpass-clocks";
+ #clock-cells = <2>;
+ };
+ };
+ };
+ };
+ };
+
lpass_wsa2macro: codec@6aa0000 {
compatible = "qcom,sm8650-lpass-wsa-macro", "qcom,sm8550-lpass-wsa-macro";
reg = <0 0x06aa0000 0 0x1000>;
@@ -5322,154 +5470,6 @@
interrupts = <GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>;
};
- remoteproc_adsp: remoteproc@30000000 {
- compatible = "qcom,sm8650-adsp-pas";
- reg = <0 0x30000000 0 0x100>;
-
- interrupts-extended = <&pdc 6 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 1 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 2 IRQ_TYPE_EDGE_RISING>,
- <&smp2p_adsp_in 3 IRQ_TYPE_EDGE_RISING>;
- interrupt-names = "wdog",
- "fatal",
- "ready",
- "handover",
- "stop-ack";
-
- clocks = <&rpmhcc RPMH_CXO_CLK>;
- clock-names = "xo";
-
- interconnects = <&lpass_lpicx_noc MASTER_LPASS_PROC QCOM_ICC_TAG_ALWAYS
- &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
-
- power-domains = <&rpmhpd RPMHPD_LCX>,
- <&rpmhpd RPMHPD_LMX>;
- power-domain-names = "lcx",
- "lmx";
-
- memory-region = <&adspslpi_mem>, <&q6_adsp_dtb_mem>;
-
- qcom,qmp = <&aoss_qmp>;
-
- qcom,smem-states = <&smp2p_adsp_out 0>;
- qcom,smem-state-names = "stop";
-
- status = "disabled";
-
- remoteproc_adsp_glink: glink-edge {
- interrupts-extended = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP
- IRQ_TYPE_EDGE_RISING>;
-
- mboxes = <&ipcc IPCC_CLIENT_LPASS
- IPCC_MPROC_SIGNAL_GLINK_QMP>;
-
- qcom,remote-pid = <2>;
-
- label = "lpass";
-
- fastrpc {
- compatible = "qcom,fastrpc";
-
- qcom,glink-channels = "fastrpcglink-apps-dsp";
-
- label = "adsp";
-
- qcom,non-secure-domain;
-
- #address-cells = <1>;
- #size-cells = <0>;
-
- compute-cb@3 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <3>;
-
- iommus = <&apps_smmu 0x1003 0x80>,
- <&apps_smmu 0x1043 0x20>;
- dma-coherent;
- };
-
- compute-cb@4 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <4>;
-
- iommus = <&apps_smmu 0x1004 0x80>,
- <&apps_smmu 0x1044 0x20>;
- dma-coherent;
- };
-
- compute-cb@5 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <5>;
-
- iommus = <&apps_smmu 0x1005 0x80>,
- <&apps_smmu 0x1045 0x20>;
- dma-coherent;
- };
-
- compute-cb@6 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <6>;
-
- iommus = <&apps_smmu 0x1006 0x80>,
- <&apps_smmu 0x1046 0x20>;
- dma-coherent;
- };
-
- compute-cb@7 {
- compatible = "qcom,fastrpc-compute-cb";
- reg = <7>;
-
- iommus = <&apps_smmu 0x1007 0x40>,
- <&apps_smmu 0x1067 0x0>,
- <&apps_smmu 0x1087 0x0>;
- dma-coherent;
- };
- };
-
- gpr {
- compatible = "qcom,gpr";
- qcom,glink-channels = "adsp_apps";
- qcom,domain = <GPR_DOMAIN_ID_ADSP>;
- qcom,intents = <512 20>;
- #address-cells = <1>;
- #size-cells = <0>;
-
- q6apm: service@1 {
- compatible = "qcom,q6apm";
- reg = <GPR_APM_MODULE_IID>;
- #sound-dai-cells = <0>;
- qcom,protection-domain = "avs/audio",
- "msm/adsp/audio_pd";
-
- q6apmbedai: bedais {
- compatible = "qcom,q6apm-lpass-dais";
- #sound-dai-cells = <1>;
- };
-
- q6apmdai: dais {
- compatible = "qcom,q6apm-dais";
- iommus = <&apps_smmu 0x1001 0x80>,
- <&apps_smmu 0x1061 0x0>;
- };
- };
-
- q6prm: service@2 {
- compatible = "qcom,q6prm";
- reg = <GPR_PRM_MODULE_IID>;
- qcom,protection-domain = "avs/audio",
- "msm/adsp/audio_pd";
-
- q6prmcc: clock-controller {
- compatible = "qcom,q6prm-lpass-clocks";
- #clock-cells = <2>;
- };
- };
- };
- };
- };
-
nsp_noc: interconnect@320c0000 {
compatible = "qcom,sm8650-nsp-noc";
reg = <0 0x320c0000 0 0xf080>;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 320/443] arm64: dts: qcom: sm8650: Fix CDSP memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 319/443] arm64: dts: qcom: sm8650: Fix ADSP memory base and length Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 321/443] arm64: dts: qcom: sm8650: Fix MPSS " Greg Kroah-Hartman
` (133 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Konrad Dybcio,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit aca0053f051625a224c2e802a0e88755770819e4 upstream.
The address space in CDSP PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x1400000 was
copied from older DTS, but it does not look accurate at all.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-11-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
@@ -5481,7 +5481,7 @@
remoteproc_cdsp: remoteproc@32300000 {
compatible = "qcom,sm8650-cdsp-pas";
- reg = <0 0x32300000 0 0x1400000>;
+ reg = <0x0 0x32300000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_EDGE_RISING>,
<&smp2p_cdsp_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 321/443] arm64: dts: qcom: sm8650: Fix MPSS memory length
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 320/443] arm64: dts: qcom: sm8650: Fix CDSP memory length Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 322/443] arm64: dts: qcom: sm8550: correct MDSS interconnects Greg Kroah-Hartman
` (132 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Konrad Dybcio,
Krzysztof Kozlowski, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit d4fa87daf3dd39d6bd4b69613e22bfb43c737831 upstream.
The address space in MPSS/Modem PAS (Peripheral Authentication Service)
remoteproc node should point to the QDSP PUB address space
(QDSP6...SS_PUB) which has a length of 0x10000. Value of 0x4040 was
copied from older DTS, but it grew since then.
This should have no functional impact on Linux users, because PAS loader
does not use this address space at all.
Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20241213-dts-qcom-cdsp-mpss-base-address-v3-12-2e0036fccd8d@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
@@ -2853,7 +2853,7 @@
remoteproc_mpss: remoteproc@4080000 {
compatible = "qcom,sm8650-mpss-pas";
- reg = <0 0x04080000 0 0x4040>;
+ reg = <0x0 0x04080000 0x0 0x10000>;
interrupts-extended = <&intc GIC_SPI 264 IRQ_TYPE_EDGE_RISING>,
<&smp2p_modem_in 0 IRQ_TYPE_EDGE_RISING>,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 322/443] arm64: dts: qcom: sm8550: correct MDSS interconnects
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 321/443] arm64: dts: qcom: sm8650: Fix MPSS " Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 323/443] arm64: dts: qcom: sm8650: " Greg Kroah-Hartman
` (131 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Dmitry Baryshkov,
Konrad Dybcio, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
commit b8591df49cde459e3b84cdc0517d7bf92053d244 upstream.
SM8550 lists two interconnects for the display subsystem, mdp0-mem
(between MDP and LLCC) and mdp1-mem (between LLCC and EBI, memory).
The second interconnect is a misuse. mdpN-mem paths should be used for
several outboud MDP interconnects rather than the path between LLCC and
memory. This kind of misuse can result in bandwidth underflows, possibly
degrading picture quality as the required memory bandwidth is divided
between all mdpN-mem paths (and LLCC-EBI should not be a part of such
division).
Drop the second path and use direct MDP-EBI path for mdp0-mem until we
support separate MDP-LLCC and LLCC-EBI paths.
Fixes: d7da51db5b81 ("arm64: dts: qcom: sm8550: add display hardware devices")
Cc: stable@kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20241026-fix-sm8x50-mdp-icc-v2-1-fd8ddf755acc@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8550.dtsi | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
@@ -3003,9 +3003,8 @@
power-domains = <&dispcc MDSS_GDSC>;
- interconnects = <&mmss_noc MASTER_MDP 0 &gem_noc SLAVE_LLCC 0>,
- <&mc_virt MASTER_LLCC 0 &mc_virt SLAVE_EBI1 0>;
- interconnect-names = "mdp0-mem", "mdp1-mem";
+ interconnects = <&mmss_noc MASTER_MDP 0 &mc_virt SLAVE_EBI1 0>;
+ interconnect-names = "mdp0-mem";
iommus = <&apps_smmu 0x1c00 0x2>;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 323/443] arm64: dts: qcom: sm8650: correct MDSS interconnects
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 322/443] arm64: dts: qcom: sm8550: correct MDSS interconnects Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 324/443] crypto: qce - fix priority to be less than ARMv8 CE Greg Kroah-Hartman
` (130 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Dmitry Baryshkov,
Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
commit 9fa33cbca3d2842f1f47ed4e5f6574e611dae32b upstream.
SM8650 lists two interconnects for the display subsystem, mdp0-mem
(between MDP and LLCC) and mdp1-mem (between LLCC and EBI, memory).
The second interconnect is a misuse. mdpN-mem paths should be used for
several outboud MDP interconnects rather than the path between LLCC and
memory. This kind of misuse can result in bandwidth underflows, possibly
degrading picture quality as the required memory bandwidth is divided
between all mdpN-mem paths (and LLCC-EBI should not be a part of such
division).
Drop the second path and use direct MDP-EBI path for mdp0-mem until we
support separate MDP-LLCC and LLCC-EBI paths.
Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes")
Cc: stable@kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20241026-fix-sm8x50-mdp-icc-v2-2-fd8ddf755acc@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sm8650.dtsi | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
@@ -3603,11 +3603,8 @@
resets = <&dispcc DISP_CC_MDSS_CORE_BCR>;
interconnects = <&mmss_noc MASTER_MDP QCOM_ICC_TAG_ALWAYS
- &gem_noc SLAVE_LLCC QCOM_ICC_TAG_ALWAYS>,
- <&mc_virt MASTER_LLCC QCOM_ICC_TAG_ALWAYS
&mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
- interconnect-names = "mdp0-mem",
- "mdp1-mem";
+ interconnect-names = "mdp0-mem";
power-domains = <&dispcc MDSS_GDSC>;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 324/443] crypto: qce - fix priority to be less than ARMv8 CE
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 323/443] arm64: dts: qcom: sm8650: " Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 325/443] arm64: tegra: Fix typo in Tegra234 dce-fabric compatible Greg Kroah-Hartman
` (129 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Neil Armstrong,
Thara Gopinath, Eric Biggers, Bartosz Golaszewski, Ard Biesheuvel,
Herbert Xu
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 49b9258b05b97c6464e1964b6a2fddb3ddb65d17 upstream.
As QCE is an order of magnitude slower than the ARMv8 Crypto Extensions
on the CPU, and is also less well tested, give it a lower priority.
Previously the QCE SHA algorithms had higher priority than the ARMv8 CE
equivalents, and the ciphers such as AES-XTS had the same priority which
meant the QCE versions were chosen if they happened to be loaded later.
Fixes: ec8f5d8f6f76 ("crypto: qce - Qualcomm crypto engine driver")
Cc: stable@vger.kernel.org
Cc: Bartosz Golaszewski <brgl@bgdev.pl>
Cc: Neil Armstrong <neil.armstrong@linaro.org>
Cc: Thara Gopinath <thara.gopinath@gmail.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qce/aead.c | 2 +-
drivers/crypto/qce/sha.c | 2 +-
drivers/crypto/qce/skcipher.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -786,7 +786,7 @@ static int qce_aead_register_one(const s
alg->init = qce_aead_init;
alg->exit = qce_aead_exit;
- alg->base.cra_priority = 300;
+ alg->base.cra_priority = 275;
alg->base.cra_flags = CRYPTO_ALG_ASYNC |
CRYPTO_ALG_ALLOCATES_MEMORY |
CRYPTO_ALG_KERN_DRIVER_ONLY |
--- a/drivers/crypto/qce/sha.c
+++ b/drivers/crypto/qce/sha.c
@@ -482,7 +482,7 @@ static int qce_ahash_register_one(const
base = &alg->halg.base;
base->cra_blocksize = def->blocksize;
- base->cra_priority = 300;
+ base->cra_priority = 175;
base->cra_flags = CRYPTO_ALG_ASYNC | CRYPTO_ALG_KERN_DRIVER_ONLY;
base->cra_ctxsize = sizeof(struct qce_sha_ctx);
base->cra_alignmask = 0;
--- a/drivers/crypto/qce/skcipher.c
+++ b/drivers/crypto/qce/skcipher.c
@@ -461,7 +461,7 @@ static int qce_skcipher_register_one(con
alg->encrypt = qce_skcipher_encrypt;
alg->decrypt = qce_skcipher_decrypt;
- alg->base.cra_priority = 300;
+ alg->base.cra_priority = 275;
alg->base.cra_flags = CRYPTO_ALG_ASYNC |
CRYPTO_ALG_ALLOCATES_MEMORY |
CRYPTO_ALG_KERN_DRIVER_ONLY;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 325/443] arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 324/443] crypto: qce - fix priority to be less than ARMv8 CE Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 326/443] arm64: tegra: Disable Tegra234 sce-fabric node Greg Kroah-Hartman
` (128 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumit Gupta, Ivy Huang, Brad Griffis,
Jon Hunter, Thierry Reding
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <sumitg@nvidia.com>
commit 604120fd9e9df50ee0e803d3c6e77a1f45d2c58e upstream.
The compatible string for the Tegra DCE fabric is currently defined as
'nvidia,tegra234-sce-fabric' but this is incorrect because this is the
compatible string for SCE fabric. Update the compatible for the DCE
fabric to correct the compatible string.
This compatible needs to be correct in order for the interconnect
to catch things such as improper data accesses.
Cc: stable@vger.kernel.org
Fixes: 302e154000ec ("arm64: tegra: Add node for CBB 2.0 on Tegra234")
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Signed-off-by: Ivy Huang <yijuh@nvidia.com>
Reviewed-by: Brad Griffis <bgriffis@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20241218000737.1789569-2-yijuh@nvidia.com
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
@@ -3995,7 +3995,7 @@
};
dce-fabric@de00000 {
- compatible = "nvidia,tegra234-sce-fabric";
+ compatible = "nvidia,tegra234-dce-fabric";
reg = <0x0 0xde00000 0x0 0x40000>;
interrupts = <GIC_SPI 381 IRQ_TYPE_LEVEL_HIGH>;
status = "okay";
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 326/443] arm64: tegra: Disable Tegra234 sce-fabric node
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 325/443] arm64: tegra: Fix typo in Tegra234 dce-fabric compatible Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 327/443] parisc: Temporarily disable jump label support Greg Kroah-Hartman
` (127 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumit Gupta, Ivy Huang, Brad Griffis,
Jon Hunter, Thierry Reding
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumit Gupta <sumitg@nvidia.com>
commit a5e6fc0a10fe280989f1367a3b4f8047c7d00ea6 upstream.
Access to safety cluster engine (SCE) fabric registers was blocked
by firewall after the introduction of Functional Safety Island in
Tegra234. After that, any access by software to SCE registers is
correctly resulting in the internal bus error. However, when CPUs
try accessing the SCE-fabric registers to print error info,
another firewall error occurs as the fabric registers are also
firewall protected. This results in a second error to be printed.
Disable the SCE fabric node to avoid printing the misleading error.
The first error info will be printed by the interrupt from the
fabric causing the actual access.
Cc: stable@vger.kernel.org
Fixes: 302e154000ec ("arm64: tegra: Add node for CBB 2.0 on Tegra234")
Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
Signed-off-by: Ivy Huang <yijuh@nvidia.com>
Reviewed-by: Brad Griffis <bgriffis@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20241218000737.1789569-3-yijuh@nvidia.com
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/nvidia/tegra234.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi
@@ -3815,7 +3815,7 @@
compatible = "nvidia,tegra234-sce-fabric";
reg = <0x0 0xb600000 0x0 0x40000>;
interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
- status = "okay";
+ status = "disabled";
};
rce-fabric@be00000 {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 327/443] parisc: Temporarily disable jump label support
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 326/443] arm64: tegra: Disable Tegra234 sce-fabric node Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 328/443] pwm: microchip-core: fix incorrect comparison with max period Greg Kroah-Hartman
` (126 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller, Guenter Roeck
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@kernel.org>
commit 3599bae489d86fbabe039f9a2ab5472ffb04f7f1 upstream.
The 32-bit Debian kernel 6.12 fails to boot and crashes like this:
init (pid 65): Protection id trap (code 7)
CPU: 0 UID: 0 PID: 65 Comm: init Not tainted 6.12.9 #2
Hardware name: 9000/778/B160L
YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
PSW: 00000000000001000000000000001111 Not tainted
r00-03 0004000f 110d39d0 109a6558 12974400
r04-07 12a810e0 12a810e0 00000000 12a81144
r08-11 12a81174 00000007 00000000 00000002
r12-15 f8c55c08 0000006c 00000001 f8c55c08
r16-19 00000002 f8c58620 002da3a8 0000004e
r20-23 00001a46 0000000f 10754f84 00000000
r24-27 00000000 00000003 12ae6980 1127b9d0
r28-31 00000000 00000000 12974440 109a6558
sr00-03 00000000 00000000 00000000 00000010
sr04-07 00000000 00000000 00000000 00000000
IASQ: 00000000 00000000 IAOQ: 110d39d0 110d39d4
IIR: baadf00d ISR: 00000000 IOR: 110d39d0
CPU: 0 CR30: 128740c0 CR31: 00000000
ORIG_R28: 000003f3
IAOQ[0]: 0x110d39d0
IAOQ[1]: 0x110d39d4
RP(r2): security_sk_free+0x70/0x1a4
Backtrace:
[<10d8c844>] __sk_destruct+0x2bc/0x378
[<10d8e33c>] sk_destruct+0x68/0x8c
[<10d8e3dc>] __sk_free+0x7c/0x148
[<10d8e560>] sk_free+0xb8/0xf0
[<10f6420c>] unix_release_sock+0x3ac/0x50c
[<10f643b8>] unix_release+0x4c/0x7c
[<10d832f8>] __sock_release+0x5c/0xf8
[<10d833b4>] sock_close+0x20/0x44
[<107ba52c>] __fput+0xf8/0x468
[<107baa08>] __fput_sync+0xb4/0xd4
[<107b471c>] sys_close+0x44/0x94
[<10405334>] syscall_exit+0x0/0x10
Bisecting points to this commit which triggers the issue:
commit 417c5643cd67a55f424b203b492082035d0236c3
Author: KP Singh <kpsingh@kernel.org>
Date: Fri Aug 16 17:43:07 2024 +0200
lsm: replace indirect LSM hook calls with static calls
After more analysis it seems that we don't fully implement the static calls
and jump tables yet. Additionally the functions which mark kernel memory
read-only or read-write-executable needs to be further enhanced to be able to
fully support static calls.
Enabling CONFIG_SECURITY_YAMA=y was one possibility to trigger the issue,
although YAMA isn't the reason for the fault.
As a temporary solution disable JUMP_LABEL functionality to
avoid the crashes.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Cc: <stable@vger.kernel.org> # v6.12+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/Kconfig | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -60,8 +60,8 @@ config PARISC
select HAVE_ARCH_MMAP_RND_BITS
select HAVE_ARCH_AUDITSYSCALL
select HAVE_ARCH_HASH
- select HAVE_ARCH_JUMP_LABEL
- select HAVE_ARCH_JUMP_LABEL_RELATIVE
+ # select HAVE_ARCH_JUMP_LABEL
+ # select HAVE_ARCH_JUMP_LABEL_RELATIVE
select HAVE_ARCH_KFENCE
select HAVE_ARCH_SECCOMP_FILTER
select HAVE_ARCH_TRACEHOOK
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 328/443] pwm: microchip-core: fix incorrect comparison with max period
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 327/443] parisc: Temporarily disable jump label support Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 329/443] xfs: dont call remap_verify_area with sb write protection held Greg Kroah-Hartman
` (125 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Conor Dooley, Uwe Kleine-König
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Conor Dooley <conor.dooley@microchip.com>
commit 752b6e3af374460a2de18f0c10bfa06bf844dbe8 upstream.
In mchp_core_pwm_apply_locked(), if hw_period_steps is equal to its max,
an error is reported and .apply fails. The max value is actually a
permitted value however, and so this check can fail where multiple
channels are enabled.
For example, the first channel to be configured requests a period that
sets hw_period_steps to the maximum value, and when a second channel
is enabled the driver reads hw_period_steps back from the hardware and
finds it to be the maximum possible value, triggering the warning on a
permitted value. The value to be avoided is 255 (PERIOD_STEPS_MAX + 1),
as that will produce undesired behaviour, so test for greater than,
rather than equal to.
Fixes: 2bf7ecf7b4ff ("pwm: add microchip soft ip corePWM driver")
Cc: stable@vger.kernel.org
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20250122-pastor-fancied-0b993da2d2d2@spud
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pwm/pwm-microchip-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pwm/pwm-microchip-core.c
+++ b/drivers/pwm/pwm-microchip-core.c
@@ -327,7 +327,7 @@ static int mchp_core_pwm_apply_locked(st
* mchp_core_pwm_calc_period().
* The period is locked and we cannot change this, so we abort.
*/
- if (hw_period_steps == MCHPCOREPWM_PERIOD_STEPS_MAX)
+ if (hw_period_steps > MCHPCOREPWM_PERIOD_STEPS_MAX)
return -EINVAL;
prescale = hw_prescale;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 329/443] xfs: dont call remap_verify_area with sb write protection held
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 328/443] pwm: microchip-core: fix incorrect comparison with max period Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 330/443] xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end Greg Kroah-Hartman
` (124 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Darrick J. Wong,
Carlos Maiolino
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit f5f0ed89f13e3e5246404a322ee85169a226bfb5 upstream.
The XFS_IOC_EXCHANGE_RANGE ioctl with the XFS_EXCHANGE_RANGE_TO_EOF flag
operates on a range bounded by the end of the file. This means the
actual amount of blocks exchanged is derived from the inode size, which
is only stable with the IOLOCK (i_rwsem) held. Do that, it currently
calls remap_verify_area from inside the sb write protection which nests
outside the IOLOCK. But this makes fsnotify_file_area_perm which is
called from remap_verify_area unhappy when the kernel is built with
lockdep and the recently added CONFIG_FANOTIFY_ACCESS_PERMISSIONS
option.
Fix this by always calling remap_verify_area before taking the write
protection, and passing a 0 size to remap_verify_area similar to
the FICLONE/FICLONERANGE ioctls when they are asked to clone until
the file end.
(Note: the size argument gets passed to fsnotify_file_area_perm, but
then isn't actually used there).
Fixes: 9a64d9b3109d ("xfs: introduce new file range exchange ioctl")
Cc: <stable@vger.kernel.org> # v6.10
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_exchrange.c | 71 ++++++++++++++++++-------------------------------
1 file changed, 27 insertions(+), 44 deletions(-)
--- a/fs/xfs/xfs_exchrange.c
+++ b/fs/xfs/xfs_exchrange.c
@@ -326,22 +326,6 @@ out_trans_cancel:
* successfully but before locks are dropped.
*/
-/* Verify that we have security clearance to perform this operation. */
-static int
-xfs_exchange_range_verify_area(
- struct xfs_exchrange *fxr)
-{
- int ret;
-
- ret = remap_verify_area(fxr->file1, fxr->file1_offset, fxr->length,
- true);
- if (ret)
- return ret;
-
- return remap_verify_area(fxr->file2, fxr->file2_offset, fxr->length,
- true);
-}
-
/*
* Performs necessary checks before doing a range exchange, having stabilized
* mutable inode attributes via i_rwsem.
@@ -352,11 +336,13 @@ xfs_exchange_range_checks(
unsigned int alloc_unit)
{
struct inode *inode1 = file_inode(fxr->file1);
+ loff_t size1 = i_size_read(inode1);
struct inode *inode2 = file_inode(fxr->file2);
+ loff_t size2 = i_size_read(inode2);
uint64_t allocmask = alloc_unit - 1;
int64_t test_len;
uint64_t blen;
- loff_t size1, size2, tmp;
+ loff_t tmp;
int error;
/* Don't touch certain kinds of inodes */
@@ -365,24 +351,25 @@ xfs_exchange_range_checks(
if (IS_SWAPFILE(inode1) || IS_SWAPFILE(inode2))
return -ETXTBSY;
- size1 = i_size_read(inode1);
- size2 = i_size_read(inode2);
-
/* Ranges cannot start after EOF. */
if (fxr->file1_offset > size1 || fxr->file2_offset > size2)
return -EINVAL;
- /*
- * If the caller said to exchange to EOF, we set the length of the
- * request large enough to cover everything to the end of both files.
- */
if (fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF) {
+ /*
+ * If the caller said to exchange to EOF, we set the length of
+ * the request large enough to cover everything to the end of
+ * both files.
+ */
fxr->length = max_t(int64_t, size1 - fxr->file1_offset,
size2 - fxr->file2_offset);
-
- error = xfs_exchange_range_verify_area(fxr);
- if (error)
- return error;
+ } else {
+ /*
+ * Otherwise we require both ranges to end within EOF.
+ */
+ if (fxr->file1_offset + fxr->length > size1 ||
+ fxr->file2_offset + fxr->length > size2)
+ return -EINVAL;
}
/*
@@ -399,15 +386,6 @@ xfs_exchange_range_checks(
return -EINVAL;
/*
- * We require both ranges to end within EOF, unless we're exchanging
- * to EOF.
- */
- if (!(fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF) &&
- (fxr->file1_offset + fxr->length > size1 ||
- fxr->file2_offset + fxr->length > size2))
- return -EINVAL;
-
- /*
* Make sure we don't hit any file size limits. If we hit any size
* limits such that test_length was adjusted, we abort the whole
* operation.
@@ -744,6 +722,7 @@ xfs_exchange_range(
{
struct inode *inode1 = file_inode(fxr->file1);
struct inode *inode2 = file_inode(fxr->file2);
+ loff_t check_len = fxr->length;
int ret;
BUILD_BUG_ON(XFS_EXCHANGE_RANGE_ALL_FLAGS &
@@ -776,14 +755,18 @@ xfs_exchange_range(
return -EBADF;
/*
- * If we're not exchanging to EOF, we can check the areas before
- * stabilizing both files' i_size.
+ * If we're exchanging to EOF we can't calculate the length until taking
+ * the iolock. Pass a 0 length to remap_verify_area similar to the
+ * FICLONE and FICLONERANGE ioctls that support cloning to EOF as well.
*/
- if (!(fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF)) {
- ret = xfs_exchange_range_verify_area(fxr);
- if (ret)
- return ret;
- }
+ if (fxr->flags & XFS_EXCHANGE_RANGE_TO_EOF)
+ check_len = 0;
+ ret = remap_verify_area(fxr->file1, fxr->file1_offset, check_len, true);
+ if (ret)
+ return ret;
+ ret = remap_verify_area(fxr->file2, fxr->file2_offset, check_len, true);
+ if (ret)
+ return ret;
/* Update cmtime if the fd/inode don't forbid it. */
if (!(fxr->file1->f_mode & FMODE_NOCMTIME) && !IS_NOCMTIME(inode1))
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 330/443] xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 329/443] xfs: dont call remap_verify_area with sb write protection held Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 331/443] xfs: Add error handling for xfs_reflink_cancel_cow_range Greg Kroah-Hartman
` (123 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Wentao Liang,
Carlos Maiolino
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit fb95897b8c60653805aa09daec575ca30983f768 upstream.
In xfs_dax_write_iomap_end(), directly return the result of
xfs_reflink_cancel_cow_range() when !written, ensuring proper
error propagation and improving code robustness.
Fixes: ea6c49b784f0 ("xfs: support CoW in fsdax mode")
Cc: stable@vger.kernel.org # v6.0
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_iomap.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -976,10 +976,8 @@ xfs_dax_write_iomap_end(
if (!xfs_is_cow_inode(ip))
return 0;
- if (!written) {
- xfs_reflink_cancel_cow_range(ip, pos, length, true);
- return 0;
- }
+ if (!written)
+ return xfs_reflink_cancel_cow_range(ip, pos, length, true);
return xfs_reflink_end_cow(ip, pos, written);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 331/443] xfs: Add error handling for xfs_reflink_cancel_cow_range
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 330/443] xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 332/443] accel/ivpu: Fix error handling in ivpu_boot() Greg Kroah-Hartman
` (122 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Wentao Liang,
Carlos Maiolino
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 26b63bee2f6e711c5a169997fd126fddcfb90848 upstream.
In xfs_inactive(), xfs_reflink_cancel_cow_range() is called
without error handling, risking unnoticed failures and
inconsistent behavior compared to other parts of the code.
Fix this issue by adding an error handling for the
xfs_reflink_cancel_cow_range(), improving code robustness.
Fixes: 6231848c3aa5 ("xfs: check for cow blocks before trying to clear them")
Cc: stable@vger.kernel.org # v4.17
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_inode.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1404,8 +1404,11 @@ xfs_inactive(
goto out;
/* Try to clean out the cow blocks if there are any. */
- if (xfs_inode_has_cow_data(ip))
- xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, true);
+ if (xfs_inode_has_cow_data(ip)) {
+ error = xfs_reflink_cancel_cow_range(ip, 0, NULLFILEOFF, true);
+ if (error)
+ goto out;
+ }
if (VFS_I(ip)->i_nlink != 0) {
/*
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 332/443] accel/ivpu: Fix error handling in ivpu_boot()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 331/443] xfs: Add error handling for xfs_reflink_cancel_cow_range Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 333/443] accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails Greg Kroah-Hartman
` (121 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Karol Wachowski, Jeffrey Hugo,
Jacek Lawrynowicz
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
commit f3be8a9b1afffbcc70f8e41063b151b1038d7813 upstream.
Ensure IRQs and IPC are properly disabled if HW sched or DCT
initialization fails.
Fixes: cc3c72c7e610 ("accel/ivpu: Refactor failure diagnostics during boot")
Cc: stable@vger.kernel.org # v6.13+
Reviewed-by: Karol Wachowski <karol.wachowski@intel.com>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250129124009.1039982-2-jacek.lawrynowicz@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/ivpu/ivpu_drv.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
index ca2bf47ce248..0c4a82271c26 100644
--- a/drivers/accel/ivpu/ivpu_drv.c
+++ b/drivers/accel/ivpu/ivpu_drv.c
@@ -397,15 +397,19 @@ int ivpu_boot(struct ivpu_device *vdev)
if (ivpu_fw_is_cold_boot(vdev)) {
ret = ivpu_pm_dct_init(vdev);
if (ret)
- goto err_diagnose_failure;
+ goto err_disable_ipc;
ret = ivpu_hw_sched_init(vdev);
if (ret)
- goto err_diagnose_failure;
+ goto err_disable_ipc;
}
return 0;
+err_disable_ipc:
+ ivpu_ipc_disable(vdev);
+ ivpu_hw_irq_disable(vdev);
+ disable_irq(vdev->irq);
err_diagnose_failure:
ivpu_hw_diagnose_failure(vdev);
ivpu_mmu_evtq_dump(vdev);
--
2.48.1
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 333/443] accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 332/443] accel/ivpu: Fix error handling in ivpu_boot() Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 334/443] accel/ivpu: Fix error handling in recovery/reset Greg Kroah-Hartman
` (120 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Falkowski, Jeffrey Hugo,
Jacek Lawrynowicz
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
commit f2bc2afe34c107a02ce829a4039e85514feafe55 upstream.
pm_runtime_resume_and_get() sets dev->power.runtime_error that causes
all subsequent pm_runtime_get_sync() calls to fail.
Clear the runtime_error using pm_runtime_set_suspended(), so the driver
doesn't have to be reloaded to recover when the NPU fails to boot during
runtime resume.
Fixes: 7d4b4c74432d ("accel/ivpu: Remove suspend_reschedule_counter")
Cc: stable@vger.kernel.org # v6.11+
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250129124009.1039982-3-jacek.lawrynowicz@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/ivpu/ivpu_pm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/accel/ivpu/ivpu_pm.c
+++ b/drivers/accel/ivpu/ivpu_pm.c
@@ -309,7 +309,10 @@ int ivpu_rpm_get(struct ivpu_device *vde
int ret;
ret = pm_runtime_resume_and_get(vdev->drm.dev);
- drm_WARN_ON(&vdev->drm, ret < 0);
+ if (ret < 0) {
+ ivpu_err(vdev, "Failed to resume NPU: %d\n", ret);
+ pm_runtime_set_suspended(vdev->drm.dev);
+ }
return ret;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 334/443] accel/ivpu: Fix error handling in recovery/reset
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 333/443] accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 335/443] ACPI: PRM: Remove unnecessary strict handler address checks Greg Kroah-Hartman
` (119 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Falkowski, Jeffrey Hugo,
Jacek Lawrynowicz
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
commit 41a2d8286c905614f29007f1bc8e652d54654b82 upstream.
Disable runtime PM for the duration of reset/recovery so it is possible
to set the correct runtime PM state depending on the outcome of the
`ivpu_resume()`. Don’t suspend or reset the HW if the NPU is suspended
when the reset/recovery is requested. Also, move common reset/recovery
code to separate functions for better code readability.
Fixes: 27d19268cf39 ("accel/ivpu: Improve recovery and reset support")
Cc: stable@vger.kernel.org # v6.8+
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250129124009.1039982-4-jacek.lawrynowicz@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/accel/ivpu/ivpu_pm.c | 79 +++++++++++++++++++++++--------------------
1 file changed, 43 insertions(+), 36 deletions(-)
--- a/drivers/accel/ivpu/ivpu_pm.c
+++ b/drivers/accel/ivpu/ivpu_pm.c
@@ -115,41 +115,57 @@ err_power_down:
return ret;
}
-static void ivpu_pm_recovery_work(struct work_struct *work)
+static void ivpu_pm_reset_begin(struct ivpu_device *vdev)
{
- struct ivpu_pm_info *pm = container_of(work, struct ivpu_pm_info, recovery_work);
- struct ivpu_device *vdev = pm->vdev;
- char *evt[2] = {"IVPU_PM_EVENT=IVPU_RECOVER", NULL};
- int ret;
-
- ivpu_err(vdev, "Recovering the NPU (reset #%d)\n", atomic_read(&vdev->pm->reset_counter));
-
- ret = pm_runtime_resume_and_get(vdev->drm.dev);
- if (ret)
- ivpu_err(vdev, "Failed to resume NPU: %d\n", ret);
-
- ivpu_jsm_state_dump(vdev);
- ivpu_dev_coredump(vdev);
+ pm_runtime_disable(vdev->drm.dev);
atomic_inc(&vdev->pm->reset_counter);
atomic_set(&vdev->pm->reset_pending, 1);
down_write(&vdev->pm->reset_lock);
+}
+
+static void ivpu_pm_reset_complete(struct ivpu_device *vdev)
+{
+ int ret;
- ivpu_suspend(vdev);
ivpu_pm_prepare_cold_boot(vdev);
ivpu_jobs_abort_all(vdev);
ivpu_ms_cleanup_all(vdev);
ret = ivpu_resume(vdev);
- if (ret)
+ if (ret) {
ivpu_err(vdev, "Failed to resume NPU: %d\n", ret);
+ pm_runtime_set_suspended(vdev->drm.dev);
+ } else {
+ pm_runtime_set_active(vdev->drm.dev);
+ }
up_write(&vdev->pm->reset_lock);
atomic_set(&vdev->pm->reset_pending, 0);
- kobject_uevent_env(&vdev->drm.dev->kobj, KOBJ_CHANGE, evt);
pm_runtime_mark_last_busy(vdev->drm.dev);
- pm_runtime_put_autosuspend(vdev->drm.dev);
+ pm_runtime_enable(vdev->drm.dev);
+}
+
+static void ivpu_pm_recovery_work(struct work_struct *work)
+{
+ struct ivpu_pm_info *pm = container_of(work, struct ivpu_pm_info, recovery_work);
+ struct ivpu_device *vdev = pm->vdev;
+ char *evt[2] = {"IVPU_PM_EVENT=IVPU_RECOVER", NULL};
+
+ ivpu_err(vdev, "Recovering the NPU (reset #%d)\n", atomic_read(&vdev->pm->reset_counter));
+
+ ivpu_pm_reset_begin(vdev);
+
+ if (!pm_runtime_status_suspended(vdev->drm.dev)) {
+ ivpu_jsm_state_dump(vdev);
+ ivpu_dev_coredump(vdev);
+ ivpu_suspend(vdev);
+ }
+
+ ivpu_pm_reset_complete(vdev);
+
+ kobject_uevent_env(&vdev->drm.dev->kobj, KOBJ_CHANGE, evt);
}
void ivpu_pm_trigger_recovery(struct ivpu_device *vdev, const char *reason)
@@ -328,16 +344,13 @@ void ivpu_pm_reset_prepare_cb(struct pci
struct ivpu_device *vdev = pci_get_drvdata(pdev);
ivpu_dbg(vdev, PM, "Pre-reset..\n");
- atomic_inc(&vdev->pm->reset_counter);
- atomic_set(&vdev->pm->reset_pending, 1);
- pm_runtime_get_sync(vdev->drm.dev);
- down_write(&vdev->pm->reset_lock);
- ivpu_prepare_for_reset(vdev);
- ivpu_hw_reset(vdev);
- ivpu_pm_prepare_cold_boot(vdev);
- ivpu_jobs_abort_all(vdev);
- ivpu_ms_cleanup_all(vdev);
+ ivpu_pm_reset_begin(vdev);
+
+ if (!pm_runtime_status_suspended(vdev->drm.dev)) {
+ ivpu_prepare_for_reset(vdev);
+ ivpu_hw_reset(vdev);
+ }
ivpu_dbg(vdev, PM, "Pre-reset done.\n");
}
@@ -345,18 +358,12 @@ void ivpu_pm_reset_prepare_cb(struct pci
void ivpu_pm_reset_done_cb(struct pci_dev *pdev)
{
struct ivpu_device *vdev = pci_get_drvdata(pdev);
- int ret;
ivpu_dbg(vdev, PM, "Post-reset..\n");
- ret = ivpu_resume(vdev);
- if (ret)
- ivpu_err(vdev, "Failed to set RESUME state: %d\n", ret);
- up_write(&vdev->pm->reset_lock);
- atomic_set(&vdev->pm->reset_pending, 0);
- ivpu_dbg(vdev, PM, "Post-reset done.\n");
- pm_runtime_mark_last_busy(vdev->drm.dev);
- pm_runtime_put_autosuspend(vdev->drm.dev);
+ ivpu_pm_reset_complete(vdev);
+
+ ivpu_dbg(vdev, PM, "Post-reset done.\n");
}
void ivpu_pm_init(struct ivpu_device *vdev)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 335/443] ACPI: PRM: Remove unnecessary strict handler address checks
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 334/443] accel/ivpu: Fix error handling in recovery/reset Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 336/443] tpm: Change to kvalloc() in eventlog/acpi.c Greg Kroah-Hartman
` (118 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aubrey Li, Koba Ko, Ard Biesheuvel,
Rafael J. Wysocki, Shi Liu
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aubrey Li <aubrey.li@linux.intel.com>
commit 7f5704b6a143b8eca640cba820968e798d065e91 upstream.
Commit 088984c8d54c ("ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM
handler and context") added unnecessary strict handler address checks,
causing the PRM module to fail in translating memory error addresses.
Both static data buffer address and ACPI parameter buffer address may
be NULL if they are not needed, as described in section 4.1.2 PRM Handler
Information Structure of Platform Runtime Mechanism specification [1].
Here are two examples from real hardware:
----PRMT.dsl----
- staic data address is not used
[10Ch 0268 2] Revision : 0000
[10Eh 0270 2] Length : 002C
[110h 0272 16] Handler GUID : F6A58D47-E04F-4F5A-86B8-2A50D4AA109B
[120h 0288 8] Handler address : 0000000065CE51F4
[128h 0296 8] Satic Data Address : 0000000000000000
[130h 0304 8] ACPI Parameter Address : 000000006522A718
- ACPI parameter address is not used
[1B0h 0432 2] Revision : 0000
[1B2h 0434 2] Length : 002C
[1B4h 0436 16] Handler GUID : 657E8AE6-A8FC-4877-BB28-42E7DE1899A5
[1C4h 0452 8] Handler address : 0000000065C567C8
[1CCh 0460 8] Satic Data Address : 000000006113FB98
[1D4h 0468 8] ACPI Parameter Address : 0000000000000000
Fixes: 088984c8d54c ("ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context")
Reported-and-tested-by: Shi Liu <aurelianliu@tencent.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Aubrey Li <aubrey.li@linux.intel.com>
Link: https://uefi.org/sites/default/files/resources/Platform%20Runtime%20Mechanism%20-%20with%20legal%20notice.pdf # [1]
Reviewed-by: Koba Ko <kobak@nvidia.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20250126022250.3014210-1-aubrey.li@linux.intel.com
[ rjw: Minor changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/prmt.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/acpi/prmt.c
+++ b/drivers/acpi/prmt.c
@@ -287,9 +287,7 @@ static acpi_status acpi_platformrt_space
if (!handler || !module)
goto invalid_guid;
- if (!handler->handler_addr ||
- !handler->static_data_buffer_addr ||
- !handler->acpi_param_buffer_addr) {
+ if (!handler->handler_addr) {
buffer->prm_status = PRM_HANDLER_ERROR;
return AE_OK;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 336/443] tpm: Change to kvalloc() in eventlog/acpi.c
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 335/443] ACPI: PRM: Remove unnecessary strict handler address checks Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 337/443] rv: Reset per-task monitors also for idle tasks Greg Kroah-Hartman
` (117 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Andy Liang,
Stefan Berger, Takashi Iwai, Jarkko Sakkinen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <jarkko@kernel.org>
commit a3a860bc0fd6c07332e4911cf9a238d20de90173 upstream.
The following failure was reported on HPE ProLiant D320:
[ 10.693310][ T1] tpm_tis STM0925:00: 2.0 TPM (device-id 0x3, rev-id 0)
[ 10.848132][ T1] ------------[ cut here ]------------
[ 10.853559][ T1] WARNING: CPU: 59 PID: 1 at mm/page_alloc.c:4727 __alloc_pages_noprof+0x2ca/0x330
[ 10.862827][ T1] Modules linked in:
[ 10.866671][ T1] CPU: 59 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-lp155.2.g52785e2-default #1 openSUSE Tumbleweed (unreleased) 588cd98293a7c9eba9013378d807364c088c9375
[ 10.882741][ T1] Hardware name: HPE ProLiant DL320 Gen12/ProLiant DL320 Gen12, BIOS 1.20 10/28/2024
[ 10.892170][ T1] RIP: 0010:__alloc_pages_noprof+0x2ca/0x330
[ 10.898103][ T1] Code: 24 08 e9 4a fe ff ff e8 34 36 fa ff e9 88 fe ff ff 83 fe 0a 0f 86 b3 fd ff ff 80 3d 01 e7 ce 01 00 75 09 c6 05 f8 e6 ce 01 01 <0f> 0b 45 31 ff e9 e5 fe ff ff f7 c2 00 00 08 00 75 42 89 d9 80 e1
[ 10.917750][ T1] RSP: 0000:ffffb7cf40077980 EFLAGS: 00010246
[ 10.923777][ T1] RAX: 0000000000000000 RBX: 0000000000040cc0 RCX: 0000000000000000
[ 10.931727][ T1] RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000040cc0
The above transcript shows that ACPI pointed a 16 MiB buffer for the log
events because RSI maps to the 'order' parameter of __alloc_pages_noprof().
Address the bug by moving from devm_kmalloc() to devm_add_action() and
kvmalloc() and devm_add_action().
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Cc: stable@vger.kernel.org # v2.6.16+
Fixes: 55a82ab3181b ("[PATCH] tpm: add bios measurement log")
Reported-by: Andy Liang <andy.liang@hpe.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219495
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Andy Liang <andy.liang@hpe.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/eventlog/acpi.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/drivers/char/tpm/eventlog/acpi.c
+++ b/drivers/char/tpm/eventlog/acpi.c
@@ -63,6 +63,11 @@ static bool tpm_is_tpm2_log(void *bios_e
return n == 0;
}
+static void tpm_bios_log_free(void *data)
+{
+ kvfree(data);
+}
+
/* read binary bios log */
int tpm_read_log_acpi(struct tpm_chip *chip)
{
@@ -136,7 +141,7 @@ int tpm_read_log_acpi(struct tpm_chip *c
}
/* malloc EventLog space */
- log->bios_event_log = devm_kmalloc(&chip->dev, len, GFP_KERNEL);
+ log->bios_event_log = kvmalloc(len, GFP_KERNEL);
if (!log->bios_event_log)
return -ENOMEM;
@@ -161,10 +166,16 @@ int tpm_read_log_acpi(struct tpm_chip *c
goto err;
}
+ ret = devm_add_action(&chip->dev, tpm_bios_log_free, log->bios_event_log);
+ if (ret) {
+ log->bios_event_log = NULL;
+ goto err;
+ }
+
return format;
err:
- devm_kfree(&chip->dev, log->bios_event_log);
+ tpm_bios_log_free(log->bios_event_log);
log->bios_event_log = NULL;
return ret;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 337/443] rv: Reset per-task monitors also for idle tasks
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 336/443] tpm: Change to kvalloc() in eventlog/acpi.c Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 338/443] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Greg Kroah-Hartman
` (116 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juri Lelli, Thomas Gleixner,
Peter Zijlstra, John Kacur, Gabriele Monaco,
Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriele Monaco <gmonaco@redhat.com>
commit 8259cb14a70680553d5e82d65d1302fe589e9b39 upstream.
RV per-task monitors are implemented through a monitor structure
available for each task_struct. This structure is reset every time the
monitor is (re-)started, to avoid inconsistencies if the monitor was
activated previously.
To do so, we reset the monitor on all threads using the macro
for_each_process_thread. However, this macro excludes the idle tasks on
each CPU. Idle tasks could be considered tasks on their own right and it
should be up to the model whether to ignore them or not.
Reset monitors also on the idle tasks for each present CPU whenever we
reset all per-task monitors.
Cc: stable@vger.kernel.org
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: John Kacur <jkacur@redhat.com>
Link: https://lore.kernel.org/20250115151547.605750-2-gmonaco@redhat.com
Fixes: 792575348ff7 ("rv/include: Add deterministic automata monitor definition via C macros")
Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/rv/da_monitor.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/include/rv/da_monitor.h
+++ b/include/rv/da_monitor.h
@@ -14,6 +14,7 @@
#include <rv/automata.h>
#include <linux/rv.h>
#include <linux/bug.h>
+#include <linux/sched.h>
#ifdef CONFIG_RV_REACTORS
@@ -324,10 +325,13 @@ static inline struct da_monitor *da_get_
static void da_monitor_reset_all_##name(void) \
{ \
struct task_struct *g, *p; \
+ int cpu; \
\
read_lock(&tasklist_lock); \
for_each_process_thread(g, p) \
da_monitor_reset_##name(da_get_monitor_##name(p)); \
+ for_each_present_cpu(cpu) \
+ da_monitor_reset_##name(da_get_monitor_##name(idle_task(cpu))); \
read_unlock(&tasklist_lock); \
} \
\
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 338/443] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 337/443] rv: Reset per-task monitors also for idle tasks Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 339/443] jiffies: Cast to unsigned long in secs_to_jiffies() conversion Greg Kroah-Hartman
` (115 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlad Poenaru, Usama Arif,
Frederic Weisbecker, Paul E. McKenney, Thomas Gleixner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <frederic@kernel.org>
commit 53dac345395c0d2493cbc2f4c85fe38aef5b63f5 upstream.
hrtimers are migrated away from the dying CPU to any online target at
the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers
handling tasks involved in the CPU hotplug forward progress.
However wakeups can still be performed by the outgoing CPU after
CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being
armed. Depending on several considerations (crystal ball power management
based election, earliest timer already enqueued, timer migration enabled or
not), the target may eventually be the current CPU even if offline. If that
happens, the timer is eventually ignored.
The most notable example is RCU which had to deal with each and every of
those wake-ups by deferring them to an online CPU, along with related
workarounds:
_ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying)
_ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU)
_ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq)
The problem isn't confined to RCU though as the stop machine kthread
(which runs CPUHP_AP_HRTIMERS_DYING) reports its completion at the end
of its work through cpu_stop_signal_done() and performs a wake up that
eventually arms the deadline server timer:
WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0
CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted
Stopper: multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0
RIP: 0010:hrtimer_start_range_ns+0x289/0x2d0
Call Trace:
<TASK>
start_dl_timer
enqueue_dl_entity
dl_server_start
enqueue_task_fair
enqueue_task
ttwu_do_activate
try_to_wake_up
complete
cpu_stopper_thread
Instead of providing yet another bandaid to work around the situation, fix
it in the hrtimers infrastructure instead: always migrate away a timer to
an online target whenever it is enqueued from an offline CPU.
This will also allow to revert all the above RCU disgraceful hacks.
Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier")
Reported-by: Vlad Poenaru <vlad.wing@gmail.com>
Reported-by: Usama Arif <usamaarif642@gmail.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Tested-by: Paul E. McKenney <paulmck@kernel.org>
Link: https://lore.kernel.org/all/20250117232433.24027-1-frederic@kernel.org
Closes: 20241213203739.1519801-1-usamaarif642@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/hrtimer_defs.h | 1
kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++++---------
2 files changed, 83 insertions(+), 21 deletions(-)
--- a/include/linux/hrtimer_defs.h
+++ b/include/linux/hrtimer_defs.h
@@ -125,6 +125,7 @@ struct hrtimer_cpu_base {
ktime_t softirq_expires_next;
struct hrtimer *softirq_next_timer;
struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES];
+ call_single_data_t csd;
} ____cacheline_aligned;
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -58,6 +58,8 @@
#define HRTIMER_ACTIVE_SOFT (HRTIMER_ACTIVE_HARD << MASK_SHIFT)
#define HRTIMER_ACTIVE_ALL (HRTIMER_ACTIVE_SOFT | HRTIMER_ACTIVE_HARD)
+static void retrigger_next_event(void *arg);
+
/*
* The timer bases:
*
@@ -111,7 +113,8 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base,
.clockid = CLOCK_TAI,
.get_time = &ktime_get_clocktai,
},
- }
+ },
+ .csd = CSD_INIT(retrigger_next_event, NULL)
};
static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
@@ -124,6 +127,14 @@ static const int hrtimer_clock_to_base_t
[CLOCK_TAI] = HRTIMER_BASE_TAI,
};
+static inline bool hrtimer_base_is_online(struct hrtimer_cpu_base *base)
+{
+ if (!IS_ENABLED(CONFIG_HOTPLUG_CPU))
+ return true;
+ else
+ return likely(base->online);
+}
+
/*
* Functions and macros which are different for UP/SMP systems are kept in a
* single place
@@ -183,27 +194,54 @@ struct hrtimer_clock_base *lock_hrtimer_
}
/*
- * We do not migrate the timer when it is expiring before the next
- * event on the target cpu. When high resolution is enabled, we cannot
- * reprogram the target cpu hardware and we would cause it to fire
- * late. To keep it simple, we handle the high resolution enabled and
- * disabled case similar.
+ * Check if the elected target is suitable considering its next
+ * event and the hotplug state of the current CPU.
+ *
+ * If the elected target is remote and its next event is after the timer
+ * to queue, then a remote reprogram is necessary. However there is no
+ * guarantee the IPI handling the operation would arrive in time to meet
+ * the high resolution deadline. In this case the local CPU becomes a
+ * preferred target, unless it is offline.
+ *
+ * High and low resolution modes are handled the same way for simplicity.
*
* Called with cpu_base->lock of target cpu held.
*/
-static int
-hrtimer_check_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base)
+static bool hrtimer_suitable_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base,
+ struct hrtimer_cpu_base *new_cpu_base,
+ struct hrtimer_cpu_base *this_cpu_base)
{
ktime_t expires;
+ /*
+ * The local CPU clockevent can be reprogrammed. Also get_target_base()
+ * guarantees it is online.
+ */
+ if (new_cpu_base == this_cpu_base)
+ return true;
+
+ /*
+ * The offline local CPU can't be the default target if the
+ * next remote target event is after this timer. Keep the
+ * elected new base. An IPI will we issued to reprogram
+ * it as a last resort.
+ */
+ if (!hrtimer_base_is_online(this_cpu_base))
+ return true;
+
expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset);
- return expires < new_base->cpu_base->expires_next;
+
+ return expires >= new_base->cpu_base->expires_next;
}
-static inline
-struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base,
- int pinned)
+static inline struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, int pinned)
{
+ if (!hrtimer_base_is_online(base)) {
+ int cpu = cpumask_any_and(cpu_online_mask, housekeeping_cpumask(HK_TYPE_TIMER));
+
+ return &per_cpu(hrtimer_bases, cpu);
+ }
+
#if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ_COMMON)
if (static_branch_likely(&timers_migration_enabled) && !pinned)
return &per_cpu(hrtimer_bases, get_nohz_timer_target());
@@ -254,8 +292,8 @@ again:
raw_spin_unlock(&base->cpu_base->lock);
raw_spin_lock(&new_base->cpu_base->lock);
- if (new_cpu_base != this_cpu_base &&
- hrtimer_check_target(timer, new_base)) {
+ if (!hrtimer_suitable_target(timer, new_base, new_cpu_base,
+ this_cpu_base)) {
raw_spin_unlock(&new_base->cpu_base->lock);
raw_spin_lock(&base->cpu_base->lock);
new_cpu_base = this_cpu_base;
@@ -264,8 +302,7 @@ again:
}
WRITE_ONCE(timer->base, new_base);
} else {
- if (new_cpu_base != this_cpu_base &&
- hrtimer_check_target(timer, new_base)) {
+ if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, this_cpu_base)) {
new_cpu_base = this_cpu_base;
goto again;
}
@@ -716,8 +753,6 @@ static inline int hrtimer_is_hres_enable
return hrtimer_hres_enabled;
}
-static void retrigger_next_event(void *arg);
-
/*
* Switch to high resolution mode
*/
@@ -1206,6 +1241,7 @@ static int __hrtimer_start_range_ns(stru
u64 delta_ns, const enum hrtimer_mode mode,
struct hrtimer_clock_base *base)
{
+ struct hrtimer_cpu_base *this_cpu_base = this_cpu_ptr(&hrtimer_bases);
struct hrtimer_clock_base *new_base;
bool force_local, first;
@@ -1217,10 +1253,16 @@ static int __hrtimer_start_range_ns(stru
* and enforce reprogramming after it is queued no matter whether
* it is the new first expiring timer again or not.
*/
- force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
+ force_local = base->cpu_base == this_cpu_base;
force_local &= base->cpu_base->next_timer == timer;
/*
+ * Don't force local queuing if this enqueue happens on a unplugged
+ * CPU after hrtimer_cpu_dying() has been invoked.
+ */
+ force_local &= this_cpu_base->online;
+
+ /*
* Remove an active timer from the queue. In case it is not queued
* on the current CPU, make sure that remove_hrtimer() updates the
* remote data correctly.
@@ -1249,8 +1291,27 @@ static int __hrtimer_start_range_ns(stru
}
first = enqueue_hrtimer(timer, new_base, mode);
- if (!force_local)
- return first;
+ if (!force_local) {
+ /*
+ * If the current CPU base is online, then the timer is
+ * never queued on a remote CPU if it would be the first
+ * expiring timer there.
+ */
+ if (hrtimer_base_is_online(this_cpu_base))
+ return first;
+
+ /*
+ * Timer was enqueued remote because the current base is
+ * already offline. If the timer is the first to expire,
+ * kick the remote CPU to reprogram the clock event.
+ */
+ if (first) {
+ struct hrtimer_cpu_base *new_cpu_base = new_base->cpu_base;
+
+ smp_call_function_single_async(new_cpu_base->cpu, &new_cpu_base->csd);
+ }
+ return 0;
+ }
/*
* Timer was forced to stay on the current CPU to avoid
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 339/443] jiffies: Cast to unsigned long in secs_to_jiffies() conversion
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 338/443] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 340/443] iommufd: Fix struct iommu_hwpt_pgfault init and padding Greg Kroah-Hartman
` (114 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Easwar Hariharan,
Thomas Gleixner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Easwar Hariharan <eahariha@linux.microsoft.com>
commit bb2784d9ab49587ba4fbff37a319fff2924db289 upstream.
While converting users of msecs_to_jiffies(), lkp reported that some range
checks would always be true because of the mismatch between the implied int
value of secs_to_jiffies() vs the unsigned long return value of the
msecs_to_jiffies() calls it was replacing.
Fix this by casting the secs_to_jiffies() input value to unsigned long.
Fixes: b35108a51cf7ba ("jiffies: Define secs_to_jiffies()")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Easwar Hariharan <eahariha@linux.microsoft.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20250130192701.99626-1-eahariha@linux.microsoft.com
Closes: https://lore.kernel.org/oe-kbuild-all/202501301334.NB6NszQR-lkp@intel.com/
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/jiffies.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index ed945f42e064..0ea8c9887429 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -537,7 +537,7 @@ static __always_inline unsigned long msecs_to_jiffies(const unsigned int m)
*
* Return: jiffies value
*/
-#define secs_to_jiffies(_secs) ((_secs) * HZ)
+#define secs_to_jiffies(_secs) (unsigned long)((_secs) * HZ)
extern unsigned long __usecs_to_jiffies(const unsigned int u);
#if !(USEC_PER_SEC % HZ)
--
2.48.1
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 340/443] iommufd: Fix struct iommu_hwpt_pgfault init and padding
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 339/443] jiffies: Cast to unsigned long in secs_to_jiffies() conversion Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 341/443] kfence: skip __GFP_THISNODE allocations on NUMA systems Greg Kroah-Hartman
` (113 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Nicolin Chen,
Kevin Tian
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
commit e721f619e3ec9bae08bf419c3944cf1e6966c821 upstream.
The iommu_hwpt_pgfault is used to report IO page fault data to userspace,
but iommufd_fault_fops_read was never zeroing its padding. This leaks the
content of the kernel stack memory to userspace.
Also, the iommufd uAPI requires explicit padding and use of __aligned_u64
to ensure ABI compatibility's with 32 bit.
pahole result, before:
struct iommu_hwpt_pgfault {
__u32 flags; /* 0 4 */
__u32 dev_id; /* 4 4 */
__u32 pasid; /* 8 4 */
__u32 grpid; /* 12 4 */
__u32 perm; /* 16 4 */
/* XXX 4 bytes hole, try to pack */
__u64 addr; /* 24 8 */
__u32 length; /* 32 4 */
__u32 cookie; /* 36 4 */
/* size: 40, cachelines: 1, members: 8 */
/* sum members: 36, holes: 1, sum holes: 4 */
/* last cacheline: 40 bytes */
};
pahole result, after:
struct iommu_hwpt_pgfault {
__u32 flags; /* 0 4 */
__u32 dev_id; /* 4 4 */
__u32 pasid; /* 8 4 */
__u32 grpid; /* 12 4 */
__u32 perm; /* 16 4 */
__u32 __reserved; /* 20 4 */
__u64 addr __attribute__((__aligned__(8))); /* 24 8 */
__u32 length; /* 32 4 */
__u32 cookie; /* 36 4 */
/* size: 40, cachelines: 1, members: 9 */
/* forced alignments: 1 */
/* last cacheline: 40 bytes */
} __attribute__((__aligned__(8)));
Fixes: c714f15860fc ("iommufd: Add fault and response message definitions")
Link: https://patch.msgid.link/r/20250120195051.2450-1-nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommufd/fault.c | 2 +-
include/uapi/linux/iommufd.h | 4 +++-
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/iommu/iommufd/fault.c
+++ b/drivers/iommu/iommufd/fault.c
@@ -247,7 +247,7 @@ static ssize_t iommufd_fault_fops_read(s
{
size_t fault_size = sizeof(struct iommu_hwpt_pgfault);
struct iommufd_fault *fault = filep->private_data;
- struct iommu_hwpt_pgfault data;
+ struct iommu_hwpt_pgfault data = {};
struct iommufd_device *idev;
struct iopf_group *group;
struct iopf_fault *iopf;
--- a/include/uapi/linux/iommufd.h
+++ b/include/uapi/linux/iommufd.h
@@ -868,6 +868,7 @@ enum iommu_hwpt_pgfault_perm {
* @pasid: Process Address Space ID
* @grpid: Page Request Group Index
* @perm: Combination of enum iommu_hwpt_pgfault_perm
+ * @__reserved: Must be 0.
* @addr: Fault address
* @length: a hint of how much data the requestor is expecting to fetch. For
* example, if the PRI initiator knows it is going to do a 10MB
@@ -883,7 +884,8 @@ struct iommu_hwpt_pgfault {
__u32 pasid;
__u32 grpid;
__u32 perm;
- __u64 addr;
+ __u32 __reserved;
+ __aligned_u64 addr;
__u32 length;
__u32 cookie;
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 341/443] kfence: skip __GFP_THISNODE allocations on NUMA systems
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 340/443] iommufd: Fix struct iommu_hwpt_pgfault init and padding Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 342/443] media: ccs: Clean up parsed CCS static data on parse failure Greg Kroah-Hartman
` (112 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Elver, Vlastimil Babka,
Christoph Lameter, Alexander Potapenko, Dmitriy Vyukov,
Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <elver@google.com>
commit e64f81946adf68cd75e2207dd9a51668348a4af8 upstream.
On NUMA systems, __GFP_THISNODE indicates that an allocation _must_ be on
a particular node, and failure to allocate on the desired node will result
in a failed allocation.
Skip __GFP_THISNODE allocations if we are running on a NUMA system, since
KFENCE can't guarantee which node its pool pages are allocated on.
Link: https://lkml.kernel.org/r/20250124120145.410066-1-elver@google.com
Fixes: 236e9f153852 ("kfence: skip all GFP_ZONEMASK allocations")
Signed-off-by: Marco Elver <elver@google.com>
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Chistoph Lameter <cl@linux.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kfence/core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/kfence/core.c
+++ b/mm/kfence/core.c
@@ -21,6 +21,7 @@
#include <linux/log2.h>
#include <linux/memblock.h>
#include <linux/moduleparam.h>
+#include <linux/nodemask.h>
#include <linux/notifier.h>
#include <linux/panic_notifier.h>
#include <linux/random.h>
@@ -1084,6 +1085,7 @@ void *__kfence_alloc(struct kmem_cache *
* properties (e.g. reside in DMAable memory).
*/
if ((flags & GFP_ZONEMASK) ||
+ ((flags & __GFP_THISNODE) && num_online_nodes() > 1) ||
(s->flags & (SLAB_CACHE_DMA | SLAB_CACHE_DMA32))) {
atomic_long_inc(&counters[KFENCE_COUNTER_SKIP_INCOMPAT]);
return NULL;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 342/443] media: ccs: Clean up parsed CCS static data on parse failure
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 341/443] kfence: skip __GFP_THISNODE allocations on NUMA systems Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 343/443] mm/hugetlb: fix avoid_reserve to allow taking folio from subpool Greg Kroah-Hartman
` (111 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Mehdi Djait,
Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
commit da73efa8e675a2b58f1c7ae61201acfe57714bf7 upstream.
ccs_data_parse() releases the allocated in-memory data structure when the
parser fails, but it does not clean up parsed metadata that is there to
help access the actual data. Do that, in order to return the data
structure in a sane state.
Fixes: a6b396f410b1 ("media: ccs: Add CCS static data parser library")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ccs/ccs-data.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/media/i2c/ccs/ccs-data.c
+++ b/drivers/media/i2c/ccs/ccs-data.c
@@ -10,6 +10,7 @@
#include <linux/limits.h>
#include <linux/mm.h>
#include <linux/slab.h>
+#include <linux/string.h>
#include "ccs-data-defs.h"
@@ -948,15 +949,15 @@ int ccs_data_parse(struct ccs_data_conta
rval = __ccs_data_parse(&bin, ccsdata, data, len, dev, verbose);
if (rval)
- return rval;
+ goto out_cleanup;
rval = bin_backing_alloc(&bin);
if (rval)
- return rval;
+ goto out_cleanup;
rval = __ccs_data_parse(&bin, ccsdata, data, len, dev, false);
if (rval)
- goto out_free;
+ goto out_cleanup;
if (verbose && ccsdata->version)
print_ccs_data_version(dev, ccsdata->version);
@@ -965,15 +966,16 @@ int ccs_data_parse(struct ccs_data_conta
rval = -EPROTO;
dev_dbg(dev, "parsing mismatch; base %p; now %p; end %p\n",
bin.base, bin.now, bin.end);
- goto out_free;
+ goto out_cleanup;
}
ccsdata->backing = bin.base;
return 0;
-out_free:
+out_cleanup:
kvfree(bin.base);
+ memset(ccsdata, 0, sizeof(*ccsdata));
return rval;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 343/443] mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 342/443] media: ccs: Clean up parsed CCS static data on parse failure Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 344/443] iio: chemical: bme680: Fix uninitialized variable in __bme680_read_raw() Greg Kroah-Hartman
` (110 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Xu, Ackerley Tng,
Oscar Salvador, Breno Leitao, Muchun Song, Naoya Horiguchi,
Rik van Riel, Roman Gushchin, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Xu <peterx@redhat.com>
commit 58db7c5fbe7daa42098d4965133a864f98ba90ba upstream.
Patch series "mm/hugetlb: Refactor hugetlb allocation resv accounting",
v2.
This is a follow up on Ackerley's series here as replacement:
https://lore.kernel.org/r/cover.1728684491.git.ackerleytng@google.com
The goal of this series is to cleanup hugetlb resv accounting, especially
during folio allocation, to decouple a few things:
- Hugetlb folios v.s. Hugetlbfs: IOW, the hope is in the future hugetlb
folios can be allocated completely without hugetlbfs.
- Decouple VMA v.s. hugetlb folio allocations: allocating a hugetlb folio
should not always require a hugetlbfs VMA. For example, either it got
allocated from the inode level (see hugetlbfs_fallocate() where it used
a pesudo VMA for allocation), or it can be allocated by other kernel
subsystems.
It paves way for other users to allocate hugetlb folios out of either
system reservations, or subpools (instead of hugetlbfs, as a file system).
For longer term, this prepares hugetlb as a separate concept versus
hugetlbfs, so that hugetlb folios can be allocated by not only hugetlbfs
and other things.
Tests I've done:
- I had a reproducer in patch 1 for the bug I found, this will start to
work after patch 1 or the whole set applied.
- Hugetlb regression tests (on x86_64 2MBs), includes:
- All vmtests on hugetlbfs
- libhugetlbfs test suite (which may fail some tests, but no new failures
will be introduced by this series, so all such failures happen before
this series so shouldn't be relevant).
This patch (of 7):
Since commit 04f2cbe35699 ("hugetlb: guarantee that COW faults for a
process that called mmap(MAP_PRIVATE) on hugetlbfs will succeed"),
avoid_reserve was introduced for a special case of CoW on hugetlb private
mappings, and only if the owner VMA is trying to allocate yet another
hugetlb folio that is not reserved within the private vma reserved map.
Later on, in commit d85f69b0b533 ("mm/hugetlb: alloc_huge_page handle
areas hole punched by fallocate"), alloc_huge_page() enforced to not
consume any global reservation as long as avoid_reserve=true. This
operation doesn't look correct, because even if it will enforce the
allocation to not use global reservation at all, it will still try to take
one reservation from the spool (if the subpool existed). Then since the
spool reserved pages take from global reservation, it'll also take one
reservation globally.
Logically it can cause global reservation to go wrong.
I wrote a reproducer below, trigger this special path, and every run of
such program will cause global reservation count to increment by one, until
it hits the number of free pages:
#define _GNU_SOURCE /* See feature_test_macros(7) */
#include <stdio.h>
#include <fcntl.h>
#include <errno.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/mman.h>
#define MSIZE (2UL << 20)
int main(int argc, char *argv[])
{
const char *path;
int *buf;
int fd, ret;
pid_t child;
if (argc < 2) {
printf("usage: %s <hugetlb_file>\n", argv[0]);
return -1;
}
path = argv[1];
fd = open(path, O_RDWR | O_CREAT, 0666);
if (fd < 0) {
perror("open failed");
return -1;
}
ret = fallocate(fd, 0, 0, MSIZE);
if (ret != 0) {
perror("fallocate");
return -1;
}
buf = mmap(NULL, MSIZE, PROT_READ|PROT_WRITE,
MAP_PRIVATE, fd, 0);
if (buf == MAP_FAILED) {
perror("mmap() failed");
return -1;
}
/* Allocate a page */
*buf = 1;
child = fork();
if (child == 0) {
/* child doesn't need to do anything */
exit(0);
}
/* Trigger CoW from owner */
*buf = 2;
munmap(buf, MSIZE);
close(fd);
unlink(path);
return 0;
}
It can only reproduce with a sub-mount when there're reserved pages on the
spool, like:
# sysctl vm.nr_hugepages=128
# mkdir ./hugetlb-pool
# mount -t hugetlbfs -o min_size=8M,pagesize=2M none ./hugetlb-pool
Then run the reproducer on the mountpoint:
# ./reproducer ./hugetlb-pool/test
Fix it by taking the reservation from spool if available. In general,
avoid_reserve is IMHO more about "avoid vma resv map", not spool's.
I copied stable, however I have no intention for backporting if it's not a
clean cherry-pick, because private hugetlb mapping, and then fork() on top
is too rare to hit.
Link: https://lkml.kernel.org/r/20250107204002.2683356-1-peterx@redhat.com
Link: https://lkml.kernel.org/r/20250107204002.2683356-2-peterx@redhat.com
Fixes: d85f69b0b533 ("mm/hugetlb: alloc_huge_page handle areas hole punched by fallocate")
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Ackerley Tng <ackerleytng@google.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Cc: Breno Leitao <leitao@debian.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 22 +++-------------------
1 file changed, 3 insertions(+), 19 deletions(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1394,8 +1394,7 @@ static unsigned long available_huge_page
static struct folio *dequeue_hugetlb_folio_vma(struct hstate *h,
struct vm_area_struct *vma,
- unsigned long address, int avoid_reserve,
- long chg)
+ unsigned long address, long chg)
{
struct folio *folio = NULL;
struct mempolicy *mpol;
@@ -1411,10 +1410,6 @@ static struct folio *dequeue_hugetlb_fol
if (!vma_has_reserves(vma, chg) && !available_huge_pages(h))
goto err;
- /* If reserves cannot be used, ensure enough pages are in the pool */
- if (avoid_reserve && !available_huge_pages(h))
- goto err;
-
gfp_mask = htlb_alloc_mask(h);
nid = huge_node(vma, address, gfp_mask, &mpol, &nodemask);
@@ -1430,7 +1425,7 @@ static struct folio *dequeue_hugetlb_fol
folio = dequeue_hugetlb_folio_nodemask(h, gfp_mask,
nid, nodemask);
- if (folio && !avoid_reserve && vma_has_reserves(vma, chg)) {
+ if (folio && vma_has_reserves(vma, chg)) {
folio_set_hugetlb_restore_reserve(folio);
h->resv_huge_pages--;
}
@@ -3007,17 +3002,6 @@ struct folio *alloc_hugetlb_folio(struct
gbl_chg = hugepage_subpool_get_pages(spool, 1);
if (gbl_chg < 0)
goto out_end_reservation;
-
- /*
- * Even though there was no reservation in the region/reserve
- * map, there could be reservations associated with the
- * subpool that can be used. This would be indicated if the
- * return value of hugepage_subpool_get_pages() is zero.
- * However, if avoid_reserve is specified we still avoid even
- * the subpool reservations.
- */
- if (avoid_reserve)
- gbl_chg = 1;
}
/* If this allocation is not consuming a reservation, charge it now.
@@ -3040,7 +3024,7 @@ struct folio *alloc_hugetlb_folio(struct
* from the global free pool (global change). gbl_chg == 0 indicates
* a reservation exists for the allocation.
*/
- folio = dequeue_hugetlb_folio_vma(h, vma, addr, avoid_reserve, gbl_chg);
+ folio = dequeue_hugetlb_folio_vma(h, vma, addr, gbl_chg);
if (!folio) {
spin_unlock_irq(&hugetlb_lock);
folio = alloc_buddy_hugetlb_folio_with_mpol(h, vma, addr);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 344/443] iio: chemical: bme680: Fix uninitialized variable in __bme680_read_raw()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 343/443] mm/hugetlb: fix avoid_reserve to allow taking folio from subpool Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 345/443] iio: dac: ad3552r-common: fix ad3541/2r ranges Greg Kroah-Hartman
` (109 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Vasileios Amoiridis,
Jonathan Cameron
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit 20eb1fae4145bc45717aa8a6d05fcd6a64ed856a upstream.
The bme680_read_temp() function takes a pointer to s16 but we're passing
an int pointer to it. This will not work on big endian systems and it
also means that the other 16 bits are uninitialized.
Pass an s16 type variable.
Fixes: f51171ce2236 ("iio: chemical: bme680: Add SCALE and RAW channels")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Vasileios Amoiridis <vassilisamir@gmail.com>
Link: https://patch.msgid.link/4addb68c-853a-49fc-8d40-739e78db5fa1@stanley.mountain
Cc: <stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/chemical/bme680_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/chemical/bme680_core.c b/drivers/iio/chemical/bme680_core.c
index d12270409c8a..a2949daf9467 100644
--- a/drivers/iio/chemical/bme680_core.c
+++ b/drivers/iio/chemical/bme680_core.c
@@ -874,11 +874,11 @@ static int bme680_read_raw(struct iio_dev *indio_dev,
case IIO_CHAN_INFO_RAW:
switch (chan->type) {
case IIO_TEMP:
- ret = bme680_read_temp(data, (s16 *)&chan_val);
+ ret = bme680_read_temp(data, &temp_chan_val);
if (ret)
return ret;
- *val = chan_val;
+ *val = temp_chan_val;
return IIO_VAL_INT;
case IIO_PRESSURE:
ret = bme680_read_press(data, &chan_val);
--
2.48.1
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 345/443] iio: dac: ad3552r-common: fix ad3541/2r ranges
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 344/443] iio: chemical: bme680: Fix uninitialized variable in __bme680_read_raw() Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 346/443] iio: dac: ad3552r-hs: clear reset status flag Greg Kroah-Hartman
` (108 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Angelo Dureghello, David Lechner,
Stable, Jonathan Cameron
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Angelo Dureghello <adureghello@baylibre.com>
commit 1e758b613212b6964518a67939535910b5aee831 upstream.
Fix ad3541/2r voltage ranges to be as per ad3542r datasheet,
rev. C, table 38 (page 57).
The wrong ad354xr ranges was generating erroneous Vpp output.
In more details:
- fix wrong number of ranges, they are 5 ranges, not 6,
- remove non-existent 0-3V range,
- adjust order, since ad3552r_find_range() get a wrong index,
producing a wrong Vpp as output.
Retested all the ranges on real hardware, EVALAD3542RFMCZ:
adi,output-range-microvolt (fdt):
<(000000) (2500000)>; ok (Rfbx1, switch 10)
<(000000) (5000000)>; ok (Rfbx1, switch 10)
<(000000) (10000000)>; ok (Rfbx1, switch 10)
<(-5000000) (5000000)>; ok (Rfbx2, switch +/- 5)
<(-2500000) (7500000)>; ok (Rfbx2, switch -2.5/7.5)
Fixes: 8f2b54824b28 ("drivers:iio:dac: Add AD3552R driver support")
Signed-off-by: Angelo Dureghello <adureghello@baylibre.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250108-wip-bl-ad3552r-axi-v0-iio-testing-carlos-v2-1-2dac02f04638@baylibre.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/ad3552r-common.c | 5 ++---
drivers/iio/dac/ad3552r.h | 8 +++-----
2 files changed, 5 insertions(+), 8 deletions(-)
--- a/drivers/iio/dac/ad3552r-common.c
+++ b/drivers/iio/dac/ad3552r-common.c
@@ -22,11 +22,10 @@ EXPORT_SYMBOL_NS_GPL(ad3552r_ch_ranges,
const s32 ad3542r_ch_ranges[AD3542R_MAX_RANGES][2] = {
[AD3542R_CH_OUTPUT_RANGE_0__2P5V] = { 0, 2500 },
- [AD3542R_CH_OUTPUT_RANGE_0__3V] = { 0, 3000 },
[AD3542R_CH_OUTPUT_RANGE_0__5V] = { 0, 5000 },
[AD3542R_CH_OUTPUT_RANGE_0__10V] = { 0, 10000 },
- [AD3542R_CH_OUTPUT_RANGE_NEG_2P5__7P5V] = { -2500, 7500 },
- [AD3542R_CH_OUTPUT_RANGE_NEG_5__5V] = { -5000, 5000 }
+ [AD3542R_CH_OUTPUT_RANGE_NEG_5__5V] = { -5000, 5000 },
+ [AD3542R_CH_OUTPUT_RANGE_NEG_2P5__7P5V] = { -2500, 7500 }
};
EXPORT_SYMBOL_NS_GPL(ad3542r_ch_ranges, "IIO_AD3552R");
--- a/drivers/iio/dac/ad3552r.h
+++ b/drivers/iio/dac/ad3552r.h
@@ -131,7 +131,7 @@
#define AD3552R_CH1_ACTIVE BIT(1)
#define AD3552R_MAX_RANGES 5
-#define AD3542R_MAX_RANGES 6
+#define AD3542R_MAX_RANGES 5
#define AD3552R_QUAD_SPI 2
extern const s32 ad3552r_ch_ranges[AD3552R_MAX_RANGES][2];
@@ -189,16 +189,14 @@ enum ad3552r_ch_vref_select {
enum ad3542r_ch_output_range {
/* Range from 0 V to 2.5 V. Requires Rfb1x connection */
AD3542R_CH_OUTPUT_RANGE_0__2P5V,
- /* Range from 0 V to 3 V. Requires Rfb1x connection */
- AD3542R_CH_OUTPUT_RANGE_0__3V,
/* Range from 0 V to 5 V. Requires Rfb1x connection */
AD3542R_CH_OUTPUT_RANGE_0__5V,
/* Range from 0 V to 10 V. Requires Rfb2x connection */
AD3542R_CH_OUTPUT_RANGE_0__10V,
- /* Range from -2.5 V to 7.5 V. Requires Rfb2x connection */
- AD3542R_CH_OUTPUT_RANGE_NEG_2P5__7P5V,
/* Range from -5 V to 5 V. Requires Rfb2x connection */
AD3542R_CH_OUTPUT_RANGE_NEG_5__5V,
+ /* Range from -2.5 V to 7.5 V. Requires Rfb2x connection */
+ AD3542R_CH_OUTPUT_RANGE_NEG_2P5__7P5V,
};
enum ad3552r_ch_output_range {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 346/443] iio: dac: ad3552r-hs: clear reset status flag
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 345/443] iio: dac: ad3552r-common: fix ad3541/2r ranges Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 347/443] iio: light: as73211: fix channel handling in only-color triggered buffer Greg Kroah-Hartman
` (107 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Angelo Dureghello, David Lechner,
Stable, Jonathan Cameron
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Angelo Dureghello <adureghello@baylibre.com>
commit 012b8276f08a67b9f2e2fd0f35363ae4a75e5267 upstream.
Clear reset status flag, to keep error status register
clean after reset (ad3552r manual, rev B table 38).
Reset error flag was left to 1, so debugging registers, the
"Error Status Register" was dirty (0x01). It is important
to clear this bit, so if there is any reset event over normal
working mode, it is possible to detect it.
Fixes: 0b4d9fe58be8 ("iio: dac: ad3552r: add high-speed platform driver")
Signed-off-by: Angelo Dureghello <adureghello@baylibre.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250108-wip-bl-ad3552r-axi-v0-iio-testing-carlos-v2-2-2dac02f04638@baylibre.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/ad3552r-hs.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/iio/dac/ad3552r-hs.c
+++ b/drivers/iio/dac/ad3552r-hs.c
@@ -329,6 +329,12 @@ static int ad3552r_hs_setup(struct ad355
dev_info(st->dev, "Chip ID error. Expected 0x%x, Read 0x%x\n",
AD3552R_ID, id);
+ /* Clear reset error flag, see ad3552r manual, rev B table 38. */
+ ret = st->data->bus_reg_write(st->back, AD3552R_REG_ADDR_ERR_STATUS,
+ AD3552R_MASK_RESET_STATUS, 1);
+ if (ret)
+ return ret;
+
ret = st->data->bus_reg_write(st->back,
AD3552R_REG_ADDR_SH_REFERENCE_CONFIG,
0, 1);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 347/443] iio: light: as73211: fix channel handling in only-color triggered buffer
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 346/443] iio: dac: ad3552r-hs: clear reset status flag Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 348/443] iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding Greg Kroah-Hartman
` (106 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Eggers, Javier Carrasco,
Jonathan Cameron
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit ab09c6cfe01b317f515bcd944668697241a54b9d upstream.
The channel index is off by one unit if AS73211_SCAN_MASK_ALL is not
set (optimized path for color channel readings), and it must be shifted
instead of leaving an empty channel for the temperature when it is off.
Once the channel index is fixed, the uninitialized channel must be set
to zero to avoid pushing uninitialized data.
Add available_scan_masks for all channels and only-color channels to let
the IIO core demux and repack the enabled channels.
Cc: stable@vger.kernel.org
Fixes: 403e5586b52e ("iio: light: as73211: New driver")
Tested-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://patch.msgid.link/20241214-iio_memset_scan_holes-v4-1-260b395b8ed5@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/as73211.c | 24 ++++++++++++++++++++----
1 file changed, 20 insertions(+), 4 deletions(-)
--- a/drivers/iio/light/as73211.c
+++ b/drivers/iio/light/as73211.c
@@ -177,6 +177,12 @@ struct as73211_data {
BIT(AS73211_SCAN_INDEX_TEMP) | \
AS73211_SCAN_MASK_COLOR)
+static const unsigned long as73211_scan_masks[] = {
+ AS73211_SCAN_MASK_COLOR,
+ AS73211_SCAN_MASK_ALL,
+ 0
+};
+
static const struct iio_chan_spec as73211_channels[] = {
{
.type = IIO_TEMP,
@@ -672,9 +678,12 @@ static irqreturn_t as73211_trigger_handl
/* AS73211 starts reading at address 2 */
ret = i2c_master_recv(data->client,
- (char *)&scan.chan[1], 3 * sizeof(scan.chan[1]));
+ (char *)&scan.chan[0], 3 * sizeof(scan.chan[0]));
if (ret < 0)
goto done;
+
+ /* Avoid pushing uninitialized data */
+ scan.chan[3] = 0;
}
if (data_result) {
@@ -682,9 +691,15 @@ static irqreturn_t as73211_trigger_handl
* Saturate all channels (in case of overflows). Temperature channel
* is not affected by overflows.
*/
- scan.chan[1] = cpu_to_le16(U16_MAX);
- scan.chan[2] = cpu_to_le16(U16_MAX);
- scan.chan[3] = cpu_to_le16(U16_MAX);
+ if (*indio_dev->active_scan_mask == AS73211_SCAN_MASK_ALL) {
+ scan.chan[1] = cpu_to_le16(U16_MAX);
+ scan.chan[2] = cpu_to_le16(U16_MAX);
+ scan.chan[3] = cpu_to_le16(U16_MAX);
+ } else {
+ scan.chan[0] = cpu_to_le16(U16_MAX);
+ scan.chan[1] = cpu_to_le16(U16_MAX);
+ scan.chan[2] = cpu_to_le16(U16_MAX);
+ }
}
iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns(indio_dev));
@@ -758,6 +773,7 @@ static int as73211_probe(struct i2c_clie
indio_dev->channels = data->spec_dev->channels;
indio_dev->num_channels = data->spec_dev->num_channels;
indio_dev->modes = INDIO_DIRECT_MODE;
+ indio_dev->available_scan_masks = as73211_scan_masks;
ret = i2c_smbus_read_byte_data(data->client, AS73211_REG_OSR);
if (ret < 0)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 348/443] iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 347/443] iio: light: as73211: fix channel handling in only-color triggered buffer Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 349/443] iommufd/fault: Destroy response and mutex in iommufd_fault_destroy() Greg Kroah-Hartman
` (105 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Kalinowski, Nicolin Chen,
Will Deacon
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
commit e94dc6ddda8dd3770879a132d577accd2cce25f9 upstream.
The hardware limitation "max=19" actually comes from SMMU Command Queue.
So, it'd be more natural for tegra241-cmdqv driver to read it out rather
than hardcoding it itself.
This is not an issue yet for a kernel on a baremetal system, but a guest
kernel setting the queue base/size in form of IPA/gPA might result in a
noncontiguous queue in the physical address space, if underlying physical
pages backing up the guest RAM aren't contiguous entirely: e.g. 2MB-page
backed guest RAM cannot guarantee a contiguous queue if it is 8MB (capped
to VCMDQ_LOG2SIZE_MAX=19). This might lead to command errors when HW does
linear-read from a noncontiguous queue memory.
Adding this extra IDR1.CMDQS cap (in the guest kernel) allows VMM to set
SMMU's IDR1.CMDQS=17 for the case mentioned above, so a guest-level queue
will be capped to maximum 2MB, ensuring a contiguous queue memory.
Fixes: a3799717b881 ("iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift")
Reported-by: Ian Kalinowski <ikalinowski@nvidia.com>
Cc: stable@vger.kernel.org
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Link: https://lore.kernel.org/r/20241219051421.1850267-1-nicolinc@nvidia.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index c8ec74f089f3..dc7af970e9d0 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -79,7 +79,6 @@
#define TEGRA241_VCMDQ_PAGE1(q) (TEGRA241_VCMDQ_PAGE1_BASE + 0x80*(q))
#define VCMDQ_ADDR GENMASK(47, 5)
#define VCMDQ_LOG2SIZE GENMASK(4, 0)
-#define VCMDQ_LOG2SIZE_MAX 19
#define TEGRA241_VCMDQ_BASE 0x00000
#define TEGRA241_VCMDQ_CONS_INDX_BASE 0x00008
@@ -505,12 +504,15 @@ static int tegra241_vcmdq_alloc_smmu_cmdq(struct tegra241_vcmdq *vcmdq)
struct arm_smmu_cmdq *cmdq = &vcmdq->cmdq;
struct arm_smmu_queue *q = &cmdq->q;
char name[16];
+ u32 regval;
int ret;
snprintf(name, 16, "vcmdq%u", vcmdq->idx);
- /* Queue size, capped to ensure natural alignment */
- q->llq.max_n_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT, VCMDQ_LOG2SIZE_MAX);
+ /* Cap queue size to SMMU's IDR1.CMDQS and ensure natural alignment */
+ regval = readl_relaxed(smmu->base + ARM_SMMU_IDR1);
+ q->llq.max_n_shift =
+ min_t(u32, CMDQ_MAX_SZ_SHIFT, FIELD_GET(IDR1_CMDQS, regval));
/* Use the common helper to init the VCMDQ, and then... */
ret = arm_smmu_init_one_queue(smmu, q, vcmdq->page0,
--
2.48.1
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 349/443] iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 348/443] iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 350/443] iommufd/fault: Use a separate spinlock to protect fault->deliver list Greg Kroah-Hartman
` (104 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Kevin Tian,
Lu Baolu, Nicolin Chen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
commit 3f4818ec139030f425476bf8a10b616bab53a7b5 upstream.
Both were missing in the initial patch.
Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Link: https://patch.msgid.link/r/bc8bb13e215af27e62ee51bdba3648dd4ed2dce3.1736923732.git.nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommufd/fault.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/iommu/iommufd/fault.c
+++ b/drivers/iommu/iommufd/fault.c
@@ -213,6 +213,7 @@ void iommufd_fault_destroy(struct iommuf
{
struct iommufd_fault *fault = container_of(obj, struct iommufd_fault, obj);
struct iopf_group *group, *next;
+ unsigned long index;
/*
* The iommufd object's reference count is zero at this point.
@@ -225,6 +226,13 @@ void iommufd_fault_destroy(struct iommuf
iopf_group_response(group, IOMMU_PAGE_RESP_INVALID);
iopf_free_group(group);
}
+ xa_for_each(&fault->response, index, group) {
+ xa_erase(&fault->response, index);
+ iopf_group_response(group, IOMMU_PAGE_RESP_INVALID);
+ iopf_free_group(group);
+ }
+ xa_destroy(&fault->response);
+ mutex_destroy(&fault->mutex);
}
static void iommufd_compose_fault_message(struct iommu_fault *fault,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 350/443] iommufd/fault: Use a separate spinlock to protect fault->deliver list
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 349/443] iommufd/fault: Destroy response and mutex in iommufd_fault_destroy() Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 351/443] soc: samsung: exynos-pmu: Fix uninitialized ret in tensor_set_bits_atomic() Greg Kroah-Hartman
` (103 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Kevin Tian,
Lu Baolu, Nicolin Chen
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolin Chen <nicolinc@nvidia.com>
commit 3d49020a327cd7d069059317c11df24e407ccfa3 upstream.
The fault->mutex serializes the fault read()/write() fops and the
iommufd_fault_auto_response_faults(), mainly for fault->response. Also, it
was conveniently used to fence the fault->deliver in poll() fop and
iommufd_fault_iopf_handler().
However, copy_from/to_user() may sleep if pagefaults are enabled. Thus,
they could take a long time to wait for user pages to swap in, blocking
iommufd_fault_iopf_handler() and its caller that is typically a shared IRQ
handler of an IOMMU driver, resulting in a potential global DOS.
Instead of reusing the mutex to protect the fault->deliver list, add a
separate spinlock, nested under the mutex, to do the job.
iommufd_fault_iopf_handler() would no longer be blocked by
copy_from/to_user().
Add a free_list in iommufd_auto_response_faults(), so the spinlock can
simply fence a fast list_for_each_entry_safe routine.
Provide two deliver list helpers for iommufd_fault_fops_read() to use:
- Fetch the first iopf_group out of the fault->deliver list
- Restore an iopf_group back to the head of the fault->deliver list
Lastly, move the mutex closer to the response in the fault structure,
and update its kdoc accordingly.
Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Link: https://patch.msgid.link/r/20250117192901.79491-1-nicolinc@nvidia.com
Cc: stable@vger.kernel.org
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommufd/fault.c | 34 ++++++++++++++++++++------------
drivers/iommu/iommufd/iommufd_private.h | 29 +++++++++++++++++++++++++--
2 files changed, 49 insertions(+), 14 deletions(-)
--- a/drivers/iommu/iommufd/fault.c
+++ b/drivers/iommu/iommufd/fault.c
@@ -103,15 +103,23 @@ static void iommufd_auto_response_faults
{
struct iommufd_fault *fault = hwpt->fault;
struct iopf_group *group, *next;
+ struct list_head free_list;
unsigned long index;
if (!fault)
return;
+ INIT_LIST_HEAD(&free_list);
mutex_lock(&fault->mutex);
+ spin_lock(&fault->lock);
list_for_each_entry_safe(group, next, &fault->deliver, node) {
if (group->attach_handle != &handle->handle)
continue;
+ list_move(&group->node, &free_list);
+ }
+ spin_unlock(&fault->lock);
+
+ list_for_each_entry_safe(group, next, &free_list, node) {
list_del(&group->node);
iopf_group_response(group, IOMMU_PAGE_RESP_INVALID);
iopf_free_group(group);
@@ -266,17 +274,19 @@ static ssize_t iommufd_fault_fops_read(s
return -ESPIPE;
mutex_lock(&fault->mutex);
- while (!list_empty(&fault->deliver) && count > done) {
- group = list_first_entry(&fault->deliver,
- struct iopf_group, node);
-
- if (group->fault_count * fault_size > count - done)
+ while ((group = iommufd_fault_deliver_fetch(fault))) {
+ if (done >= count ||
+ group->fault_count * fault_size > count - done) {
+ iommufd_fault_deliver_restore(fault, group);
break;
+ }
rc = xa_alloc(&fault->response, &group->cookie, group,
xa_limit_32b, GFP_KERNEL);
- if (rc)
+ if (rc) {
+ iommufd_fault_deliver_restore(fault, group);
break;
+ }
idev = to_iommufd_handle(group->attach_handle)->idev;
list_for_each_entry(iopf, &group->faults, list) {
@@ -285,13 +295,12 @@ static ssize_t iommufd_fault_fops_read(s
group->cookie);
if (copy_to_user(buf + done, &data, fault_size)) {
xa_erase(&fault->response, group->cookie);
+ iommufd_fault_deliver_restore(fault, group);
rc = -EFAULT;
break;
}
done += fault_size;
}
-
- list_del(&group->node);
}
mutex_unlock(&fault->mutex);
@@ -349,10 +358,10 @@ static __poll_t iommufd_fault_fops_poll(
__poll_t pollflags = EPOLLOUT;
poll_wait(filep, &fault->wait_queue, wait);
- mutex_lock(&fault->mutex);
+ spin_lock(&fault->lock);
if (!list_empty(&fault->deliver))
pollflags |= EPOLLIN | EPOLLRDNORM;
- mutex_unlock(&fault->mutex);
+ spin_unlock(&fault->lock);
return pollflags;
}
@@ -394,6 +403,7 @@ int iommufd_fault_alloc(struct iommufd_u
INIT_LIST_HEAD(&fault->deliver);
xa_init_flags(&fault->response, XA_FLAGS_ALLOC1);
mutex_init(&fault->mutex);
+ spin_lock_init(&fault->lock);
init_waitqueue_head(&fault->wait_queue);
filep = anon_inode_getfile("[iommufd-pgfault]", &iommufd_fault_fops,
@@ -442,9 +452,9 @@ int iommufd_fault_iopf_handler(struct io
hwpt = group->attach_handle->domain->fault_data;
fault = hwpt->fault;
- mutex_lock(&fault->mutex);
+ spin_lock(&fault->lock);
list_add_tail(&group->node, &fault->deliver);
- mutex_unlock(&fault->mutex);
+ spin_unlock(&fault->lock);
wake_up_interruptible(&fault->wait_queue);
--- a/drivers/iommu/iommufd/iommufd_private.h
+++ b/drivers/iommu/iommufd/iommufd_private.h
@@ -443,14 +443,39 @@ struct iommufd_fault {
struct iommufd_ctx *ictx;
struct file *filep;
- /* The lists of outstanding faults protected by below mutex. */
- struct mutex mutex;
+ spinlock_t lock; /* protects the deliver list */
struct list_head deliver;
+ struct mutex mutex; /* serializes response flows */
struct xarray response;
struct wait_queue_head wait_queue;
};
+/* Fetch the first node out of the fault->deliver list */
+static inline struct iopf_group *
+iommufd_fault_deliver_fetch(struct iommufd_fault *fault)
+{
+ struct list_head *list = &fault->deliver;
+ struct iopf_group *group = NULL;
+
+ spin_lock(&fault->lock);
+ if (!list_empty(list)) {
+ group = list_first_entry(list, struct iopf_group, node);
+ list_del(&group->node);
+ }
+ spin_unlock(&fault->lock);
+ return group;
+}
+
+/* Restore a node back to the head of the fault->deliver list */
+static inline void iommufd_fault_deliver_restore(struct iommufd_fault *fault,
+ struct iopf_group *group)
+{
+ spin_lock(&fault->lock);
+ list_add(&group->node, &fault->deliver);
+ spin_unlock(&fault->lock);
+}
+
struct iommufd_attach_handle {
struct iommu_attach_handle handle;
struct iommufd_device *idev;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 351/443] soc: samsung: exynos-pmu: Fix uninitialized ret in tensor_set_bits_atomic()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 350/443] iommufd/fault: Use a separate spinlock to protect fault->deliver list Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 352/443] soc: mediatek: mtk-devapc: Fix leaking IO map on error paths Greg Kroah-Hartman
` (102 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit eca836dfd8386b32f1aae60f8e323218ac6a0b75 upstream.
If tensor_set_bits_atomic() is called with a mask of 0 the function will
just iterate over its bit, not perform any updates and return stack
value of 'ret'.
Also reported by smatch:
drivers/soc/samsung/exynos-pmu.c:129 tensor_set_bits_atomic() error: uninitialized symbol 'ret'.
Fixes: 0b7c6075022c ("soc: samsung: exynos-pmu: Add regmap support for SoCs that protect PMU regs")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250104135605.109209-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/samsung/exynos-pmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -126,7 +126,7 @@ static int tensor_set_bits_atomic(void *
if (ret)
return ret;
}
- return ret;
+ return 0;
}
static bool tensor_is_atomic(unsigned int reg)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 352/443] soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 351/443] soc: samsung: exynos-pmu: Fix uninitialized ret in tensor_set_bits_atomic() Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 353/443] soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove Greg Kroah-Hartman
` (101 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
AngeloGioacchino Del Regno
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit c0eb059a4575ed57f265d9883a5203799c19982c upstream.
Error paths of mtk_devapc_probe() should unmap the memory. Reported by
Smatch:
drivers/soc/mediatek/mtk-devapc.c:292 mtk_devapc_probe() warn: 'ctx->infra_base' from of_iomap() not released on lines: 277,281,286.
Fixes: 0890beb22618 ("soc: mediatek: add mt6779 devapc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20250104142012.115974-1-krzysztof.kozlowski@linaro.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/mediatek/mtk-devapc.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/drivers/soc/mediatek/mtk-devapc.c
+++ b/drivers/soc/mediatek/mtk-devapc.c
@@ -273,23 +273,31 @@ static int mtk_devapc_probe(struct platf
return -EINVAL;
devapc_irq = irq_of_parse_and_map(node, 0);
- if (!devapc_irq)
- return -EINVAL;
+ if (!devapc_irq) {
+ ret = -EINVAL;
+ goto err;
+ }
ctx->infra_clk = devm_clk_get_enabled(&pdev->dev, "devapc-infra-clock");
- if (IS_ERR(ctx->infra_clk))
- return -EINVAL;
+ if (IS_ERR(ctx->infra_clk)) {
+ ret = -EINVAL;
+ goto err;
+ }
ret = devm_request_irq(&pdev->dev, devapc_irq, devapc_violation_irq,
IRQF_TRIGGER_NONE, "devapc", ctx);
if (ret)
- return ret;
+ goto err;
platform_set_drvdata(pdev, ctx);
start_devapc(ctx);
return 0;
+
+err:
+ iounmap(ctx->infra_base);
+ return ret;
}
static void mtk_devapc_remove(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 353/443] soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 352/443] soc: mediatek: mtk-devapc: Fix leaking IO map on error paths Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 354/443] soc: qcom: llcc: Enable LLCC_WRCACHE at boot on X1 Greg Kroah-Hartman
` (100 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
AngeloGioacchino Del Regno
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit c9c0036c1990da8d2dd33563e327e05a775fcf10 upstream.
Driver removal should fully clean up - unmap the memory.
Fixes: 0890beb22618 ("soc: mediatek: add mt6779 devapc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20250104142012.115974-2-krzysztof.kozlowski@linaro.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/mediatek/mtk-devapc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/soc/mediatek/mtk-devapc.c
+++ b/drivers/soc/mediatek/mtk-devapc.c
@@ -305,6 +305,7 @@ static void mtk_devapc_remove(struct pla
struct mtk_devapc_context *ctx = platform_get_drvdata(pdev);
stop_devapc(ctx);
+ iounmap(ctx->infra_base);
}
static struct platform_driver mtk_devapc_driver = {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 354/443] soc: qcom: llcc: Enable LLCC_WRCACHE at boot on X1
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 353/443] soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 355/443] soc: qcom: smem_state: fix missing of_node_put in error path Greg Kroah-Hartman
` (99 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rajendra Nayak, Konrad Dybcio,
Johan Hovold, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
commit 35d8bc131de0f0f280f0db42499512d79f05f456 upstream.
The Last Level Cache is split into many slices, each one of which can
be toggled on or off.
Only certain slices are recommended to be turned on unconditionally,
in order to reach optimal performance/latency/power levels.
Enable WRCACHE on X1 at boot, in accordance with internal
recommendations.
No significant performance difference is expected.
Fixes: b3cf69a43502 ("soc: qcom: llcc: Add configuration data for X1E80100")
Cc: stable@vger.kernel.org
Reviewed-by: Rajendra Nayak <quic_rjendra@quicinc.com>
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20241219-topic-llcc_x1e_wrcache-v3-1-b9848d9c3d63@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/llcc-qcom.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/soc/qcom/llcc-qcom.c
+++ b/drivers/soc/qcom/llcc-qcom.c
@@ -3004,6 +3004,7 @@ static const struct llcc_slice_config x1
.fixed_size = true,
.bonus_ways = 0xfff,
.cache_mode = 0,
+ .activate_on_init = true,
}, {
.usecase_id = LLCC_CAMEXP0,
.slice_id = 4,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 355/443] soc: qcom: smem_state: fix missing of_node_put in error path
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 354/443] soc: qcom: llcc: Enable LLCC_WRCACHE at boot on X1 Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 356/443] media: mmp: Bring back registration of the device Greg Kroah-Hartman
` (98 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Dmitry Baryshkov, Bjorn Andersson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 70096b4990848229d0784c5e51dc3c7c072f1111 upstream.
If of_parse_phandle_with_args() succeeds, the OF node reference should
be dropped, regardless of number of phandle arguments.
Cc: stable@vger.kernel.org
Fixes: 9460ae2ff308 ("soc: qcom: Introduce common SMEM state machine code")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20240822164853.231087-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/smem_state.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/soc/qcom/smem_state.c
+++ b/drivers/soc/qcom/smem_state.c
@@ -112,7 +112,8 @@ struct qcom_smem_state *qcom_smem_state_
if (args.args_count != 1) {
dev_err(dev, "invalid #qcom,smem-state-cells\n");
- return ERR_PTR(-EINVAL);
+ state = ERR_PTR(-EINVAL);
+ goto put;
}
state = of_node_to_state(args.np);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 356/443] media: mmp: Bring back registration of the device
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 355/443] soc: qcom: smem_state: fix missing of_node_put in error path Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 357/443] media: Documentation: tx-rx: Fix formatting Greg Kroah-Hartman
` (97 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lubomir Rintel, Hans Verkuil
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <lkundrak@v3.sk>
commit fbb5298bf1a7b71723cd2bb193642429ceb0fb84 upstream.
In commit 4af65141e38e ("media: marvell: cafe: Register V4L2 device
earlier"), a call to v4l2_device_register() was moved away from
mccic_register() into its caller, marvell/cafe's cafe_pci_probe().
This is not the only caller though -- there's also marvell/mmp.
Add v4l2_device_register() into mmpcam_probe() to unbreak the MMP camera
driver, in a fashion analogous to what's been done to the Cafe driver.
Same for the teardown path.
Fixes: 4af65141e38e ("media: marvell: cafe: Register V4L2 device earlier")
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Cc: stable@vger.kernel.org # v6.6+
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/marvell/mmp-driver.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
--- a/drivers/media/platform/marvell/mmp-driver.c
+++ b/drivers/media/platform/marvell/mmp-driver.c
@@ -232,12 +232,22 @@ static int mmpcam_probe(struct platform_
mcam_init_clk(mcam);
/*
+ * Register with V4L.
+ */
+
+ ret = v4l2_device_register(mcam->dev, &mcam->v4l2_dev);
+ if (ret)
+ return ret;
+
+ /*
* Create a match of the sensor against its OF node.
*/
ep = fwnode_graph_get_next_endpoint(of_fwnode_handle(pdev->dev.of_node),
NULL);
- if (!ep)
- return -ENODEV;
+ if (!ep) {
+ ret = -ENODEV;
+ goto out_v4l2_device_unregister;
+ }
v4l2_async_nf_init(&mcam->notifier, &mcam->v4l2_dev);
@@ -246,7 +256,7 @@ static int mmpcam_probe(struct platform_
fwnode_handle_put(ep);
if (IS_ERR(asd)) {
ret = PTR_ERR(asd);
- goto out;
+ goto out_v4l2_device_unregister;
}
/*
@@ -254,7 +264,7 @@ static int mmpcam_probe(struct platform_
*/
ret = mccic_register(mcam);
if (ret)
- goto out;
+ goto out_v4l2_device_unregister;
/*
* Add OF clock provider.
@@ -283,6 +293,8 @@ static int mmpcam_probe(struct platform_
return 0;
out:
mccic_shutdown(mcam);
+out_v4l2_device_unregister:
+ v4l2_device_unregister(&mcam->v4l2_dev);
return ret;
}
@@ -293,6 +305,7 @@ static void mmpcam_remove(struct platfor
struct mcam_camera *mcam = &cam->mcam;
mccic_shutdown(mcam);
+ v4l2_device_unregister(&mcam->v4l2_dev);
pm_runtime_force_suspend(mcam->dev);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 357/443] media: Documentation: tx-rx: Fix formatting
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 356/443] media: mmp: Bring back registration of the device Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 358/443] media: mc: fix endpoint iteration Greg Kroah-Hartman
` (96 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
commit b76fb1f2c5a39e8e1b785e94a08448847fe4c626 upstream.
Fix formatting under "``.enable_streams()`` and ``.disable_streams()``
callbacks" in tx-rx.rst.
Fixes: 30fe661eb9d3 ("media: Documentation: Deprecate s_stream video op, update docs")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/driver-api/media/tx-rx.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/driver-api/media/tx-rx.rst b/Documentation/driver-api/media/tx-rx.rst
index dd09484df1d3..b936065dd640 100644
--- a/Documentation/driver-api/media/tx-rx.rst
+++ b/Documentation/driver-api/media/tx-rx.rst
@@ -50,7 +50,7 @@ The :ref:`V4L2_CID_LINK_FREQ <v4l2-cid-link-freq>` control is used to tell the
receiver the frequency of the bus (i.e. it is not the same as the symbol rate).
``.enable_streams()`` and ``.disable_streams()`` callbacks
-^^^^^^^^^^^^^^^^^^^^^^^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The struct v4l2_subdev_pad_ops->enable_streams() and struct
v4l2_subdev_pad_ops->disable_streams() callbacks are used by the receiver driver
--
2.48.1
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 358/443] media: mc: fix endpoint iteration
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 357/443] media: Documentation: tx-rx: Fix formatting Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 359/443] media: nuvoton: Fix an error check in npcm_video_ece_init() Greg Kroah-Hartman
` (95 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cosmin Tanislav, Laurent Pinchart,
Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <demonsingur@gmail.com>
commit fb2bd86270cd0ad004f4c614ba4f8c63a5720e25 upstream.
When creating links from a subdev to a sink, the current logic tries to
iterate over the endpoints of dev's fwnode.
This might not be correct when the subdev uses a different fwnode
compared to the dev's fwnode.
If, when registering, the subdev's fwnode is not set, the code inside
v4l2_async_register_subdev will set it to the dev's fwnode.
To fix this, just use the subdev's fwnode.
Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com>
Fixes: 0d3c81e82da9 ("media: v4l2-mc: add v4l2_create_fwnode_links helpers")
Cc: stable@vger.kernel.org
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-mc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/v4l2-core/v4l2-mc.c
+++ b/drivers/media/v4l2-core/v4l2-mc.c
@@ -329,7 +329,7 @@ int v4l2_create_fwnode_links_to_pad(stru
if (!(sink->flags & MEDIA_PAD_FL_SINK))
return -EINVAL;
- fwnode_graph_for_each_endpoint(dev_fwnode(src_sd->dev), endpoint) {
+ fwnode_graph_for_each_endpoint(src_sd->fwnode, endpoint) {
struct fwnode_handle *remote_ep;
int src_idx, sink_idx, ret;
struct media_pad *src;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 359/443] media: nuvoton: Fix an error check in npcm_video_ece_init()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 358/443] media: mc: fix endpoint iteration Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 360/443] media: imx296: Add standby delay during probe Greg Kroah-Hartman
` (94 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhen Lei, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <thunder.leizhen@huawei.com>
commit c4b7779abc6633677e6edb79e2809f4f61fde157 upstream.
When function of_find_device_by_node() fails, it returns NULL instead of
an error code. So the corresponding error check logic should be modified
to check whether the return value is NULL and set the error code to be
returned as -ENODEV.
Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine")
Cc: stable@vger.kernel.org
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20241015014053.669-1-thunder.leizhen@huawei.com
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/nuvoton/npcm-video.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/platform/nuvoton/npcm-video.c
+++ b/drivers/media/platform/nuvoton/npcm-video.c
@@ -1665,9 +1665,9 @@ static int npcm_video_ece_init(struct np
dev_info(dev, "Support HEXTILE pixel format\n");
ece_pdev = of_find_device_by_node(ece_node);
- if (IS_ERR(ece_pdev)) {
+ if (!ece_pdev) {
dev_err(dev, "Failed to find ECE device\n");
- return PTR_ERR(ece_pdev);
+ return -ENODEV;
}
of_node_put(ece_node);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 360/443] media: imx296: Add standby delay during probe
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 359/443] media: nuvoton: Fix an error check in npcm_video_ece_init() Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 361/443] media: intel/ipu6: remove cpu latency qos request on error Greg Kroah-Hartman
` (93 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandru Ardelean, Naushir Patuck,
Kieran Bingham, Laurent Pinchart, Sakari Ailus,
Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naushir Patuck <naush@raspberrypi.com>
commit 57d10bcac67707caaa542e09dee86e13ea85defc upstream.
Add a 2-5ms delay when coming out of standby and before reading the
sensor info register durning probe, as instructed by the datasheet. This
standby delay is already present when the sensor starts streaming.
During a cold-boot, reading the IMX296_SENSOR_INFO register would often
return a value of 0x0000, if this delay is not present before.
Fixes: cb33db2b6ccf ("media: i2c: IMX296 camera sensor driver")
Cc: stable@vger.kernel.org
Tested-by: Alexandru Ardelean <aardelean@baylibre.com>
Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/imx296.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/i2c/imx296.c
+++ b/drivers/media/i2c/imx296.c
@@ -954,6 +954,8 @@ static int imx296_identify_model(struct
return ret;
}
+ usleep_range(2000, 5000);
+
ret = imx296_read(sensor, IMX296_SENSOR_INFO);
if (ret < 0) {
dev_err(sensor->dev, "failed to read sensor information (%d)\n",
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 361/443] media: intel/ipu6: remove cpu latency qos request on error
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 360/443] media: imx296: Add standby delay during probe Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 362/443] media: ov5640: fix get_light_freq on auto Greg Kroah-Hartman
` (92 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Genes Lists, Stanislaw Gruszka,
Hans de Goede, Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
commit facb541ff0805314e0b56e508f7d3cbd07af513c upstream.
Fix cpu latency qos list corruption like below. It happens when
we do not remove cpu latency request on error path and free
corresponding memory.
[ 30.634378] l7 kernel: list_add corruption. prev->next should be next (ffffffff9645e960), but was 0000000100100001. (prev=ffff8e9e877e20a8).
[ 30.634388] l7 kernel: WARNING: CPU: 2 PID: 2008 at lib/list_debug.c:32 __list_add_valid_or_report+0x83/0xa0
<snip>
[ 30.634640] l7 kernel: Call Trace:
[ 30.634650] l7 kernel: <TASK>
[ 30.634659] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0
[ 30.634669] l7 kernel: ? __warn.cold+0x93/0xf6
[ 30.634678] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0
[ 30.634690] l7 kernel: ? report_bug+0xff/0x140
[ 30.634702] l7 kernel: ? handle_bug+0x58/0x90
[ 30.634712] l7 kernel: ? exc_invalid_op+0x17/0x70
[ 30.634723] l7 kernel: ? asm_exc_invalid_op+0x1a/0x20
[ 30.634733] l7 kernel: ? __list_add_valid_or_report+0x83/0xa0
[ 30.634742] l7 kernel: plist_add+0xdd/0x140
[ 30.634754] l7 kernel: pm_qos_update_target+0xa0/0x1f0
[ 30.634764] l7 kernel: cpu_latency_qos_update_request+0x61/0xc0
[ 30.634773] l7 kernel: intel_dp_aux_xfer+0x4c7/0x6e0 [i915 1f824655ed04687c2b0d23dbce759fa785f6d033]
Reported-by: Genes Lists <lists@sapience.com>
Closes: https://lore.kernel.org/linux-media/c0e94be466b367f1a3cfdc3cb7b1a4f47e5953ae.camel@sapience.com/
Fixes: f50c4ca0a820 ("media: intel/ipu6: add the main input system driver")
Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/pci/intel/ipu6/ipu6-isys.c
+++ b/drivers/media/pci/intel/ipu6/ipu6-isys.c
@@ -1133,6 +1133,7 @@ static int isys_probe(struct auxiliary_d
free_fw_msg_bufs:
free_fw_msg_bufs(isys);
out_remove_pkg_dir_shared_buffer:
+ cpu_latency_qos_remove_request(&isys->pm_qos);
if (!isp->secure_mode)
ipu6_cpd_free_pkg_dir(adev);
remove_shared_buffer:
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 362/443] media: ov5640: fix get_light_freq on auto
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 361/443] media: intel/ipu6: remove cpu latency qos request on error Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 363/443] media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value Greg Kroah-Hartman
` (91 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sam Bobrowicz, Michal Simek,
Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Bobrowicz <sam@elite-embedded.com>
commit 001d3753538d26ddcbef011f5643cfff58a7f672 upstream.
Light frequency was not properly returned when in auto
mode and the detected frequency was 60Hz.
Fixes: 19a81c1426c1 ("[media] add Omnivision OV5640 sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sam Bobrowicz <sam@elite-embedded.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov5640.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/i2c/ov5640.c
+++ b/drivers/media/i2c/ov5640.c
@@ -1982,6 +1982,7 @@ static int ov5640_get_light_freq(struct
light_freq = 50;
} else {
/* 60Hz */
+ light_freq = 60;
}
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 363/443] media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 362/443] media: ov5640: fix get_light_freq on auto Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 364/443] media: venus: destroy hfi session after m2m_ctx release Greg Kroah-Hartman
` (90 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alain Volmat, Hans Verkuil
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alain Volmat <alain.volmat@foss.st.com>
commit b36077ba289b827b4e76e25e8d8e0cc90fa09186 upstream.
Correct the call to dma_set_mask_and_coherent which should be set
to DMA_BIT_MASK(32).
Fixes: 28e0f3772296 ("media: stm32-dcmipp: STM32 DCMIPP camera interface driver")
Cc: stable@vger.kernel.org
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c
+++ b/drivers/media/platform/st/stm32/stm32-dcmipp/dcmipp-bytecap.c
@@ -887,7 +887,7 @@ struct dcmipp_ent_device *dcmipp_bytecap
q->dev = dev;
/* DCMIPP requires 16 bytes aligned buffers */
- ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32) & ~0x0f);
+ ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
if (ret) {
dev_err(dev, "Failed to set DMA mask\n");
goto err_mutex_destroy;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 364/443] media: venus: destroy hfi session after m2m_ctx release
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 363/443] media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 365/443] media: ccs: Fix CCS static data parsing for large block sizes Greg Kroah-Hartman
` (89 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Hebert, Sergey Senozhatsky,
Stanimir Varbanov, Hans Verkuil
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <senozhatsky@chromium.org>
commit df4ff47448fe0d392b29868e8398e3b0e587514d upstream.
This partially reverts commit that made hfi_session_destroy()
the first step of vdec/venc close(). The reason being is a
regression report when, supposedly, encode/decoder is closed
with still active streaming (no ->stop_streaming() call before
close()) and pending pkts, so isr_thread cannot find instance
and fails to process those pending pkts. This was the idea
behind the original patch - make it impossible to use instance
under destruction, because this is racy, but apparently there
are uses cases that depend on that unsafe pattern. Return to
the old (unsafe) behaviour for the time being (until a better
fix is found).
Fixes: 45b1a1b348ec ("media: venus: sync with threaded IRQ during inst destruction")
Cc: stable@vger.kernel.org
Reported-by: Nathan Hebert <nhebert@google.com>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/venus/core.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 2d27c5167246..807487a1f536 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -506,18 +506,14 @@ static __maybe_unused int venus_runtime_suspend(struct device *dev)
void venus_close_common(struct venus_inst *inst)
{
/*
- * First, remove the inst from the ->instances list, so that
- * to_instance() will return NULL.
- */
- hfi_session_destroy(inst);
- /*
- * Second, make sure we don't have IRQ/IRQ-thread currently running
+ * Make sure we don't have IRQ/IRQ-thread currently running
* or pending execution, which would race with the inst destruction.
*/
synchronize_irq(inst->core->irq);
v4l2_m2m_ctx_release(inst->m2m_ctx);
v4l2_m2m_release(inst->m2m_dev);
+ hfi_session_destroy(inst);
v4l2_fh_del(&inst->fh);
v4l2_fh_exit(&inst->fh);
v4l2_ctrl_handler_free(&inst->ctrl_handler);
--
2.48.1
^ permalink raw reply related [flat|nested] 474+ messages in thread* [PATCH 6.13 365/443] media: ccs: Fix CCS static data parsing for large block sizes
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 364/443] media: venus: destroy hfi session after m2m_ctx release Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 366/443] media: ccs: Fix cleanup order in ccs_probe() Greg Kroah-Hartman
` (88 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
commit 82b696750f0b60e7513082a10ad42786854f59f8 upstream.
The length field of the CCS static data blocks was mishandled, leading to
wrong interpretation of the length header for blocks that are 16 kiB in
size. Such large blocks are very, very rare and so this wasn't found
earlier.
As the length is used as part of input validation, the issue has no
security implications.
Fixes: a6b396f410b1 ("media: ccs: Add CCS static data parser library")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ccs/ccs-data.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/i2c/ccs/ccs-data.c
+++ b/drivers/media/i2c/ccs/ccs-data.c
@@ -98,7 +98,7 @@ ccs_data_parse_length_specifier(const st
plen = ((size_t)
(__len3->length[0] &
((1 << CCS_DATA_LENGTH_SPECIFIER_SIZE_SHIFT) - 1))
- << 16) + (__len3->length[0] << 8) + __len3->length[1];
+ << 16) + (__len3->length[1] << 8) + __len3->length[2];
break;
}
default:
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 366/443] media: ccs: Fix cleanup order in ccs_probe()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 365/443] media: ccs: Fix CCS static data parsing for large block sizes Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 367/443] media: i2c: ds90ub9x3: Fix extra fwnode_handle_put() Greg Kroah-Hartman
` (87 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mehdi Djait, Sakari Ailus,
Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mehdi Djait <mehdi.djait@linux.intel.com>
commit 6fdbff0f54786e94f0f630ff200ec1d666b1633e upstream.
ccs_limits is allocated in ccs_read_all_limits() after the allocation of
mdata.backing. Ensure that resources are freed in the reverse order of
their allocation by moving out_free_ccs_limits up.
Fixes: a11d3d6891f0 ("media: ccs: Read CCS static data from firmware binaries")
Cc: stable@vger.kernel.org
Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ccs/ccs-core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/media/i2c/ccs/ccs-core.c
+++ b/drivers/media/i2c/ccs/ccs-core.c
@@ -3566,15 +3566,15 @@ out_disable_runtime_pm:
out_cleanup:
ccs_cleanup(sensor);
+out_free_ccs_limits:
+ kfree(sensor->ccs_limits);
+
out_release_mdata:
kvfree(sensor->mdata.backing);
out_release_sdata:
kvfree(sensor->sdata.backing);
-out_free_ccs_limits:
- kfree(sensor->ccs_limits);
-
out_power_off:
ccs_power_off(&client->dev);
mutex_destroy(&sensor->mutex);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 367/443] media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 366/443] media: ccs: Fix cleanup order in ccs_probe() Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 368/443] media: i2c: ds90ub960: Fix use of non-existing registers on UB9702 Greg Kroah-Hartman
` (86 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jai Luthra, Tomi Valkeinen,
Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
commit 60b45ece41c5632a3a3274115a401cb244180646 upstream.
The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as
part of their remove process, and if the driver is removed multiple
times, eventually leads to put "overflow", possibly causing memory
corruption or crash.
The fwnode_handle_put() is a leftover from commit 905f88ccebb1 ("media:
i2c: ds90ub9x3: Fix sub-device matching"), which changed the code
related to the sd.fwnode, but missed removing these fwnode_handle_put()
calls.
Cc: stable@vger.kernel.org
Fixes: 905f88ccebb1 ("media: i2c: ds90ub9x3: Fix sub-device matching")
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ds90ub913.c | 1 -
drivers/media/i2c/ds90ub953.c | 1 -
2 files changed, 2 deletions(-)
--- a/drivers/media/i2c/ds90ub913.c
+++ b/drivers/media/i2c/ds90ub913.c
@@ -793,7 +793,6 @@ static void ub913_subdev_uninit(struct u
v4l2_async_unregister_subdev(&priv->sd);
ub913_v4l2_nf_unregister(priv);
v4l2_subdev_cleanup(&priv->sd);
- fwnode_handle_put(priv->sd.fwnode);
media_entity_cleanup(&priv->sd.entity);
}
--- a/drivers/media/i2c/ds90ub953.c
+++ b/drivers/media/i2c/ds90ub953.c
@@ -1288,7 +1288,6 @@ static void ub953_subdev_uninit(struct u
v4l2_async_unregister_subdev(&priv->sd);
ub953_v4l2_notifier_unregister(priv);
v4l2_subdev_cleanup(&priv->sd);
- fwnode_handle_put(priv->sd.fwnode);
media_entity_cleanup(&priv->sd.entity);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 368/443] media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 367/443] media: i2c: ds90ub9x3: Fix extra fwnode_handle_put() Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 369/443] media: i2c: ds90ub960: Fix UB9702 VC map Greg Kroah-Hartman
` (85 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jai Luthra, Tomi Valkeinen,
Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
commit 698cf6df87ffa83f259703e7443c15a4c5ceae86 upstream.
UB9702 doesn't have the registers for SP and EQ. Adjust the code in
ub960_rxport_wait_locks() to not use those registers for UB9702. As
these values are only used for a debug print here, there's no functional
change.
Cc: stable@vger.kernel.org
Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver")
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ds90ub960.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
--- a/drivers/media/i2c/ds90ub960.c
+++ b/drivers/media/i2c/ds90ub960.c
@@ -1576,16 +1576,24 @@ static int ub960_rxport_wait_locks(struc
ub960_rxport_read16(priv, nport, UB960_RR_RX_FREQ_HIGH, &v);
- ret = ub960_rxport_get_strobe_pos(priv, nport, &strobe_pos);
- if (ret)
- return ret;
+ if (priv->hw_data->is_ub9702) {
+ dev_dbg(dev, "\trx%u: locked, freq %llu Hz\n",
+ nport, (v * 1000000ULL) >> 8);
+ } else {
+ ret = ub960_rxport_get_strobe_pos(priv, nport,
+ &strobe_pos);
+ if (ret)
+ return ret;
- ret = ub960_rxport_get_eq_level(priv, nport, &eq_level);
- if (ret)
- return ret;
+ ret = ub960_rxport_get_eq_level(priv, nport, &eq_level);
+ if (ret)
+ return ret;
- dev_dbg(dev, "\trx%u: locked, SP: %d, EQ: %u, freq %llu Hz\n",
- nport, strobe_pos, eq_level, (v * 1000000ULL) >> 8);
+ dev_dbg(dev,
+ "\trx%u: locked, SP: %d, EQ: %u, freq %llu Hz\n",
+ nport, strobe_pos, eq_level,
+ (v * 1000000ULL) >> 8);
+ }
}
return 0;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 369/443] media: i2c: ds90ub960: Fix UB9702 VC map
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 368/443] media: i2c: ds90ub960: Fix use of non-existing registers on UB9702 Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 370/443] media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702 Greg Kroah-Hartman
` (84 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jai Luthra, Tomi Valkeinen,
Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
commit 5dbbd0609b83f6eb72c005e2e5979d0cd25243c8 upstream.
The driver uses a static CSI-2 virtual channel mapping where all virtual
channels from an RX port are mapped to a virtual channel number matching
the RX port number.
The UB960 and UB9702 have different registers for the purpose, and the
UB9702 version is not correct. Each of the VC_ID_MAP registers do not
contain a single mapping, as the driver currently thinks, but two.
This can cause received VCs other than 0 to be mapped in a wrong way.
Fix this by writing both mappings to each register.
Cc: stable@vger.kernel.org
Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver")
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ds90ub960.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/i2c/ds90ub960.c
+++ b/drivers/media/i2c/ds90ub960.c
@@ -2532,7 +2532,7 @@ static int ub960_configure_ports_for_str
for (i = 0; i < 8; i++)
ub960_rxport_write(priv, nport,
UB960_RR_VC_ID_MAP(i),
- nport);
+ (nport << 4) | nport);
}
break;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 370/443] media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 369/443] media: i2c: ds90ub960: Fix UB9702 VC map Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 371/443] media: uvcvideo: Fix crash during unbind if gpio unit is in use Greg Kroah-Hartman
` (83 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jai Luthra, Tomi Valkeinen,
Sakari Ailus, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
commit 42d0ec194aa12e9b97f09a94fe565ba2e5f631a2 upstream.
UB9702 does not have SP and EQ registers, but the driver uses them in
log_status(). Fix this by separating the SP and EQ related log_status()
work into a separate function (for clarity) and calling that function
only for UB960.
Cc: stable@vger.kernel.org
Fixes: afe267f2d368 ("media: i2c: add DS90UB960 driver")
Reviewed-by: Jai Luthra <jai.luthra@ideasonboard.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ds90ub960.c | 90 +++++++++++++++++++++++-------------------
1 file changed, 50 insertions(+), 40 deletions(-)
--- a/drivers/media/i2c/ds90ub960.c
+++ b/drivers/media/i2c/ds90ub960.c
@@ -2949,6 +2949,54 @@ static const struct v4l2_subdev_pad_ops
.set_fmt = ub960_set_fmt,
};
+static void ub960_log_status_ub960_sp_eq(struct ub960_data *priv,
+ unsigned int nport)
+{
+ struct device *dev = &priv->client->dev;
+ u8 eq_level;
+ s8 strobe_pos;
+ u8 v = 0;
+
+ /* Strobe */
+
+ ub960_read(priv, UB960_XR_AEQ_CTL1, &v);
+
+ dev_info(dev, "\t%s strobe\n",
+ (v & UB960_XR_AEQ_CTL1_AEQ_SFILTER_EN) ? "Adaptive" :
+ "Manual");
+
+ if (v & UB960_XR_AEQ_CTL1_AEQ_SFILTER_EN) {
+ ub960_read(priv, UB960_XR_SFILTER_CFG, &v);
+
+ dev_info(dev, "\tStrobe range [%d, %d]\n",
+ ((v >> UB960_XR_SFILTER_CFG_SFILTER_MIN_SHIFT) & 0xf) - 7,
+ ((v >> UB960_XR_SFILTER_CFG_SFILTER_MAX_SHIFT) & 0xf) - 7);
+ }
+
+ ub960_rxport_get_strobe_pos(priv, nport, &strobe_pos);
+
+ dev_info(dev, "\tStrobe pos %d\n", strobe_pos);
+
+ /* EQ */
+
+ ub960_rxport_read(priv, nport, UB960_RR_AEQ_BYPASS, &v);
+
+ dev_info(dev, "\t%s EQ\n",
+ (v & UB960_RR_AEQ_BYPASS_ENABLE) ? "Manual" :
+ "Adaptive");
+
+ if (!(v & UB960_RR_AEQ_BYPASS_ENABLE)) {
+ ub960_rxport_read(priv, nport, UB960_RR_AEQ_MIN_MAX, &v);
+
+ dev_info(dev, "\tEQ range [%u, %u]\n",
+ (v >> UB960_RR_AEQ_MIN_MAX_AEQ_FLOOR_SHIFT) & 0xf,
+ (v >> UB960_RR_AEQ_MIN_MAX_AEQ_MAX_SHIFT) & 0xf);
+ }
+
+ if (ub960_rxport_get_eq_level(priv, nport, &eq_level) == 0)
+ dev_info(dev, "\tEQ level %u\n", eq_level);
+}
+
static int ub960_log_status(struct v4l2_subdev *sd)
{
struct ub960_data *priv = sd_to_ub960(sd);
@@ -2996,8 +3044,6 @@ static int ub960_log_status(struct v4l2_
for (nport = 0; nport < priv->hw_data->num_rxports; nport++) {
struct ub960_rxport *rxport = priv->rxports[nport];
- u8 eq_level;
- s8 strobe_pos;
unsigned int i;
dev_info(dev, "RX %u\n", nport);
@@ -3033,44 +3079,8 @@ static int ub960_log_status(struct v4l2_
ub960_rxport_read(priv, nport, UB960_RR_CSI_ERR_COUNTER, &v);
dev_info(dev, "\tcsi_err_counter %u\n", v);
- /* Strobe */
-
- ub960_read(priv, UB960_XR_AEQ_CTL1, &v);
-
- dev_info(dev, "\t%s strobe\n",
- (v & UB960_XR_AEQ_CTL1_AEQ_SFILTER_EN) ? "Adaptive" :
- "Manual");
-
- if (v & UB960_XR_AEQ_CTL1_AEQ_SFILTER_EN) {
- ub960_read(priv, UB960_XR_SFILTER_CFG, &v);
-
- dev_info(dev, "\tStrobe range [%d, %d]\n",
- ((v >> UB960_XR_SFILTER_CFG_SFILTER_MIN_SHIFT) & 0xf) - 7,
- ((v >> UB960_XR_SFILTER_CFG_SFILTER_MAX_SHIFT) & 0xf) - 7);
- }
-
- ub960_rxport_get_strobe_pos(priv, nport, &strobe_pos);
-
- dev_info(dev, "\tStrobe pos %d\n", strobe_pos);
-
- /* EQ */
-
- ub960_rxport_read(priv, nport, UB960_RR_AEQ_BYPASS, &v);
-
- dev_info(dev, "\t%s EQ\n",
- (v & UB960_RR_AEQ_BYPASS_ENABLE) ? "Manual" :
- "Adaptive");
-
- if (!(v & UB960_RR_AEQ_BYPASS_ENABLE)) {
- ub960_rxport_read(priv, nport, UB960_RR_AEQ_MIN_MAX, &v);
-
- dev_info(dev, "\tEQ range [%u, %u]\n",
- (v >> UB960_RR_AEQ_MIN_MAX_AEQ_FLOOR_SHIFT) & 0xf,
- (v >> UB960_RR_AEQ_MIN_MAX_AEQ_MAX_SHIFT) & 0xf);
- }
-
- if (ub960_rxport_get_eq_level(priv, nport, &eq_level) == 0)
- dev_info(dev, "\tEQ level %u\n", eq_level);
+ if (!priv->hw_data->is_ub9702)
+ ub960_log_status_ub960_sp_eq(priv, nport);
/* GPIOs */
for (i = 0; i < UB960_NUM_BC_GPIOS; i++) {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 371/443] media: uvcvideo: Fix crash during unbind if gpio unit is in use
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 370/443] media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702 Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 372/443] media: uvcvideo: Fix event flags in uvc_ctrl_send_events Greg Kroah-Hartman
` (82 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5 upstream.
We used the wrong device for the device managed functions. We used the
usb device, when we should be using the interface device.
If we unbind the driver from the usb interface, the cleanup functions
are never called. In our case, the IRQ is never disabled.
If an IRQ is triggered, it will try to access memory sections that are
already free, causing an OOPS.
We cannot use the function devm_request_threaded_irq here. The devm_*
clean functions may be called after the main structure is released by
uvc_delete.
Luckily this bug has small impact, as it is only affected by devices
with gpio units and the user has to unbind the device, a disconnect will
not trigger this error.
Cc: stable@vger.kernel.org
Fixes: 2886477ff987 ("media: uvcvideo: Implement UVC_EXT_GPIO_UNIT")
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20241106-uvc-crashrmmod-v6-1-fbf9781c6e83@chromium.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_driver.c | 28 +++++++++++++++++++++-------
drivers/media/usb/uvc/uvcvideo.h | 1 +
2 files changed, 22 insertions(+), 7 deletions(-)
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -1280,14 +1280,14 @@ static int uvc_gpio_parse(struct uvc_dev
struct gpio_desc *gpio_privacy;
int irq;
- gpio_privacy = devm_gpiod_get_optional(&dev->udev->dev, "privacy",
+ gpio_privacy = devm_gpiod_get_optional(&dev->intf->dev, "privacy",
GPIOD_IN);
if (IS_ERR_OR_NULL(gpio_privacy))
return PTR_ERR_OR_ZERO(gpio_privacy);
irq = gpiod_to_irq(gpio_privacy);
if (irq < 0)
- return dev_err_probe(&dev->udev->dev, irq,
+ return dev_err_probe(&dev->intf->dev, irq,
"No IRQ for privacy GPIO\n");
unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
@@ -1313,15 +1313,27 @@ static int uvc_gpio_parse(struct uvc_dev
static int uvc_gpio_init_irq(struct uvc_device *dev)
{
struct uvc_entity *unit = dev->gpio_unit;
+ int ret;
if (!unit || unit->gpio.irq < 0)
return 0;
- return devm_request_threaded_irq(&dev->udev->dev, unit->gpio.irq, NULL,
- uvc_gpio_irq,
- IRQF_ONESHOT | IRQF_TRIGGER_FALLING |
- IRQF_TRIGGER_RISING,
- "uvc_privacy_gpio", dev);
+ ret = request_threaded_irq(unit->gpio.irq, NULL, uvc_gpio_irq,
+ IRQF_ONESHOT | IRQF_TRIGGER_FALLING |
+ IRQF_TRIGGER_RISING,
+ "uvc_privacy_gpio", dev);
+
+ unit->gpio.initialized = !ret;
+
+ return ret;
+}
+
+static void uvc_gpio_deinit(struct uvc_device *dev)
+{
+ if (!dev->gpio_unit || !dev->gpio_unit->gpio.initialized)
+ return;
+
+ free_irq(dev->gpio_unit->gpio.irq, dev);
}
/* ------------------------------------------------------------------------
@@ -1918,6 +1930,8 @@ static void uvc_unregister_video(struct
{
struct uvc_streaming *stream;
+ uvc_gpio_deinit(dev);
+
list_for_each_entry(stream, &dev->streams, list) {
/* Nothing to do here, continue. */
if (!video_is_registered(&stream->vdev))
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -234,6 +234,7 @@ struct uvc_entity {
u8 *bmControls;
struct gpio_desc *gpio_privacy;
int irq;
+ bool initialized;
} gpio;
};
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 372/443] media: uvcvideo: Fix event flags in uvc_ctrl_send_events
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 371/443] media: uvcvideo: Fix crash during unbind if gpio unit is in use Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 373/443] media: uvcvideo: Support partial control reads Greg Kroah-Hartman
` (81 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Laurent Pinchart,
Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit c31cffd5ae2c3d7ef21d9008977a9d117ce7a64e upstream.
If there is an event that needs the V4L2_EVENT_CTRL_CH_FLAGS flag, all
the following events will have that flag, regardless if they need it or
not.
This is because we keep using the same variable all the time and we do
not reset its original value.
Cc: stable@vger.kernel.org
Fixes: 805e9b4a06bf ("[media] uvcvideo: Send control change events for slave ctrls when the master changes")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20241114-uvc-roi-v15-1-64cfeb56b6f8@chromium.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1673,13 +1673,13 @@ static void uvc_ctrl_send_events(struct
{
struct uvc_control_mapping *mapping;
struct uvc_control *ctrl;
- u32 changes = V4L2_EVENT_CTRL_CH_VALUE;
unsigned int i;
unsigned int j;
for (i = 0; i < xctrls_count; ++i) {
- ctrl = uvc_find_control(handle->chain, xctrls[i].id, &mapping);
+ u32 changes = V4L2_EVENT_CTRL_CH_VALUE;
+ ctrl = uvc_find_control(handle->chain, xctrls[i].id, &mapping);
if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
/* Notification will be sent from an Interrupt event. */
continue;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 373/443] media: uvcvideo: Support partial control reads
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 372/443] media: uvcvideo: Fix event flags in uvc_ctrl_send_events Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:28 ` [PATCH 6.13 374/443] media: uvcvideo: Only save async fh if success Greg Kroah-Hartman
` (80 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit f00ee2ca8da25ebccb8e19956d853c9055e2c8d0 upstream.
Some cameras, like the ELMO MX-P3, do not return all the bytes
requested from a control if it can fit in less bytes.
Eg: Returning 0xab instead of 0x00ab.
usb 3-9: Failed to query (GET_DEF) UVC control 3 on unit 2: 1 (exp. 2).
Extend the returned value from the camera and return it.
Cc: stable@vger.kernel.org
Fixes: a763b9fb58be ("media: uvcvideo: Do not return positive errors in uvc_query_ctrl()")
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://lore.kernel.org/r/20241128-uvc-readless-v5-1-cf16ed282af8@chromium.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_video.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -79,6 +79,27 @@ int uvc_query_ctrl(struct uvc_device *de
if (likely(ret == size))
return 0;
+ /*
+ * Some devices return shorter USB control packets than expected if the
+ * returned value can fit in less bytes. Zero all the bytes that the
+ * device has not written.
+ *
+ * This quirk is applied to all controls, regardless of their data type.
+ * Most controls are little-endian integers, in which case the missing
+ * bytes become 0 MSBs. For other data types, a different heuristic
+ * could be implemented if a device is found needing it.
+ *
+ * We exclude UVC_GET_INFO from the quirk. UVC_GET_LEN does not need
+ * to be excluded because its size is always 1.
+ */
+ if (ret > 0 && query != UVC_GET_INFO) {
+ memset(data + ret, 0, size - ret);
+ dev_warn_once(&dev->udev->dev,
+ "UVC non compliance: %s control %u on unit %u returned %d bytes when we expected %u.\n",
+ uvc_query_name(query), cs, unit, ret, size);
+ return 0;
+ }
+
if (ret != -EPIPE) {
dev_err(&dev->udev->dev,
"Failed to query (%s) UVC control %u on unit %u: %d (exp. %u).\n",
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 374/443] media: uvcvideo: Only save async fh if success
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 373/443] media: uvcvideo: Support partial control reads Greg Kroah-Hartman
@ 2025-02-13 14:28 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 375/443] media: uvcvideo: Remove redundant NULL assignment Greg Kroah-Hartman
` (79 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Laurent Pinchart,
Ricardo Ribalda, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit d9fecd096f67a4469536e040a8a10bbfb665918b upstream.
Now we keep a reference to the active fh for any call to uvc_ctrl_set,
regardless if it is an actual set or if it is a just a try or if the
device refused the operation.
We should only keep the file handle if the device actually accepted
applying the operation.
Cc: stable@vger.kernel.org
Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
Suggested-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-1-26c867231118@chromium.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1811,7 +1811,10 @@ int uvc_ctrl_begin(struct uvc_video_chai
}
static int uvc_ctrl_commit_entity(struct uvc_device *dev,
- struct uvc_entity *entity, int rollback, struct uvc_control **err_ctrl)
+ struct uvc_fh *handle,
+ struct uvc_entity *entity,
+ int rollback,
+ struct uvc_control **err_ctrl)
{
struct uvc_control *ctrl;
unsigned int i;
@@ -1859,6 +1862,10 @@ static int uvc_ctrl_commit_entity(struct
*err_ctrl = ctrl;
return ret;
}
+
+ if (!rollback && handle &&
+ ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
+ ctrl->handle = handle;
}
return 0;
@@ -1895,8 +1902,8 @@ int __uvc_ctrl_commit(struct uvc_fh *han
/* Find the control. */
list_for_each_entry(entity, &chain->entities, chain) {
- ret = uvc_ctrl_commit_entity(chain->dev, entity, rollback,
- &err_ctrl);
+ ret = uvc_ctrl_commit_entity(chain->dev, handle, entity,
+ rollback, &err_ctrl);
if (ret < 0) {
if (ctrls)
ctrls->error_idx =
@@ -2046,9 +2053,6 @@ int uvc_ctrl_set(struct uvc_fh *handle,
mapping->set(mapping, value,
uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT));
- if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
- ctrl->handle = handle;
-
ctrl->dirty = 1;
ctrl->modified = 1;
return 0;
@@ -2377,7 +2381,7 @@ int uvc_ctrl_restore_values(struct uvc_d
ctrl->dirty = 1;
}
- ret = uvc_ctrl_commit_entity(dev, entity, 0, NULL);
+ ret = uvc_ctrl_commit_entity(dev, NULL, entity, 0, NULL);
if (ret < 0)
return ret;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 375/443] media: uvcvideo: Remove redundant NULL assignment
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2025-02-13 14:28 ` [PATCH 6.13 374/443] media: uvcvideo: Only save async fh if success Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 376/443] media: uvcvideo: Remove dangling pointers Greg Kroah-Hartman
` (78 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Hans de Goede,
Ricardo Ribalda, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit 04d3398f66d2d31c4b8caea88f051a4257b7a161 upstream.
ctrl->handle will only be different than NULL for controls that have
mappings. This is because that assignment is only done inside
uvc_ctrl_set() for mapped controls.
Cc: stable@vger.kernel.org
Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-2-26c867231118@chromium.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1640,10 +1640,8 @@ bool uvc_ctrl_status_event_async(struct
struct uvc_device *dev = chain->dev;
struct uvc_ctrl_work *w = &dev->async_ctrl;
- if (list_empty(&ctrl->info.mappings)) {
- ctrl->handle = NULL;
+ if (list_empty(&ctrl->info.mappings))
return false;
- }
w->data = data;
w->urb = urb;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 376/443] media: uvcvideo: Remove dangling pointers
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 375/443] media: uvcvideo: Remove redundant NULL assignment Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 377/443] mm: kmemleak: fix upper boundary check for physical address objects Greg Kroah-Hartman
` (77 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Ricardo Ribalda,
Laurent Pinchart, Mauro Carvalho Chehab
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit 221cd51efe4565501a3dbf04cc011b537dcce7fb upstream.
When an async control is written, we copy a pointer to the file handle
that started the operation. That pointer will be used when the device is
done. Which could be anytime in the future.
If the user closes that file descriptor, its structure will be freed,
and there will be one dangling pointer per pending async control, that
the driver will try to use.
Clean all the dangling pointers during release().
To avoid adding a performance penalty in the most common case (no async
operation), a counter has been introduced with some logic to make sure
that it is properly handled.
Cc: stable@vger.kernel.org
Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-3-26c867231118@chromium.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_ctrl.c | 59 +++++++++++++++++++++++++++++++++++++--
drivers/media/usb/uvc/uvc_v4l2.c | 2 +
drivers/media/usb/uvc/uvcvideo.h | 9 +++++
3 files changed, 67 insertions(+), 3 deletions(-)
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1579,6 +1579,40 @@ static void uvc_ctrl_send_slave_event(st
uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes);
}
+static void uvc_ctrl_set_handle(struct uvc_fh *handle, struct uvc_control *ctrl,
+ struct uvc_fh *new_handle)
+{
+ lockdep_assert_held(&handle->chain->ctrl_mutex);
+
+ if (new_handle) {
+ if (ctrl->handle)
+ dev_warn_ratelimited(&handle->stream->dev->udev->dev,
+ "UVC non compliance: Setting an async control with a pending operation.");
+
+ if (new_handle == ctrl->handle)
+ return;
+
+ if (ctrl->handle) {
+ WARN_ON(!ctrl->handle->pending_async_ctrls);
+ if (ctrl->handle->pending_async_ctrls)
+ ctrl->handle->pending_async_ctrls--;
+ }
+
+ ctrl->handle = new_handle;
+ handle->pending_async_ctrls++;
+ return;
+ }
+
+ /* Cannot clear the handle for a control not owned by us.*/
+ if (WARN_ON(ctrl->handle != handle))
+ return;
+
+ ctrl->handle = NULL;
+ if (WARN_ON(!handle->pending_async_ctrls))
+ return;
+ handle->pending_async_ctrls--;
+}
+
void uvc_ctrl_status_event(struct uvc_video_chain *chain,
struct uvc_control *ctrl, const u8 *data)
{
@@ -1589,7 +1623,8 @@ void uvc_ctrl_status_event(struct uvc_vi
mutex_lock(&chain->ctrl_mutex);
handle = ctrl->handle;
- ctrl->handle = NULL;
+ if (handle)
+ uvc_ctrl_set_handle(handle, ctrl, NULL);
list_for_each_entry(mapping, &ctrl->info.mappings, list) {
s32 value = __uvc_ctrl_get_value(mapping, data);
@@ -1863,7 +1898,7 @@ static int uvc_ctrl_commit_entity(struct
if (!rollback && handle &&
ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS)
- ctrl->handle = handle;
+ uvc_ctrl_set_handle(handle, ctrl, handle);
}
return 0;
@@ -2772,6 +2807,26 @@ int uvc_ctrl_init_device(struct uvc_devi
return 0;
}
+void uvc_ctrl_cleanup_fh(struct uvc_fh *handle)
+{
+ struct uvc_entity *entity;
+
+ guard(mutex)(&handle->chain->ctrl_mutex);
+
+ if (!handle->pending_async_ctrls)
+ return;
+
+ list_for_each_entry(entity, &handle->chain->dev->entities, list) {
+ for (unsigned int i = 0; i < entity->ncontrols; ++i) {
+ if (entity->controls[i].handle != handle)
+ continue;
+ uvc_ctrl_set_handle(handle, &entity->controls[i], NULL);
+ }
+ }
+
+ WARN_ON(handle->pending_async_ctrls);
+}
+
/*
* Cleanup device controls.
*/
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -652,6 +652,8 @@ static int uvc_v4l2_release(struct file
uvc_dbg(stream->dev, CALLS, "%s\n", __func__);
+ uvc_ctrl_cleanup_fh(handle);
+
/* Only free resources if this is a privileged handle. */
if (uvc_has_privileges(handle))
uvc_queue_release(&stream->queue);
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -338,7 +338,11 @@ struct uvc_video_chain {
struct uvc_entity *processing; /* Processing unit */
struct uvc_entity *selector; /* Selector unit */
- struct mutex ctrl_mutex; /* Protects ctrl.info */
+ struct mutex ctrl_mutex; /*
+ * Protects ctrl.info,
+ * ctrl.handle and
+ * uvc_fh.pending_async_ctrls
+ */
struct v4l2_prio_state prio; /* V4L2 priority state */
u32 caps; /* V4L2 chain-wide caps */
@@ -613,6 +617,7 @@ struct uvc_fh {
struct uvc_video_chain *chain;
struct uvc_streaming *stream;
enum uvc_handle_state state;
+ unsigned int pending_async_ctrls;
};
struct uvc_driver {
@@ -798,6 +803,8 @@ int uvc_ctrl_is_accessible(struct uvc_vi
int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
struct uvc_xu_control_query *xqry);
+void uvc_ctrl_cleanup_fh(struct uvc_fh *handle);
+
/* Utility functions */
struct usb_host_endpoint *uvc_find_endpoint(struct usb_host_interface *alts,
u8 epaddr);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 377/443] mm: kmemleak: fix upper boundary check for physical address objects
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 376/443] media: uvcvideo: Remove dangling pointers Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 378/443] mm: gup: fix infinite loop within __get_longterm_locked Greg Kroah-Hartman
` (76 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Catalin Marinas, Jakub Kicinski,
Matthieu Baerts (NGI0), Patrick Wang, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Catalin Marinas <catalin.marinas@arm.com>
commit 488b5b9eca68497b533ced059be5eff19578bbca upstream.
Memblock allocations are registered by kmemleak separately, based on their
physical address. During the scanning stage, it checks whether an object
is within the min_low_pfn and max_low_pfn boundaries and ignores it
otherwise.
With the recent addition of __percpu pointer leak detection (commit
6c99d4eb7c5e ("kmemleak: enable tracking for percpu pointers")), kmemleak
started reporting leaks in setup_zone_pageset() and
setup_per_cpu_pageset(). These were caused by the node_data[0] object
(initialised in alloc_node_data()) ending on the PFN_PHYS(max_low_pfn)
boundary. The non-strict upper boundary check introduced by commit
84c326299191 ("mm: kmemleak: check physical address when scan") causes the
pg_data_t object to be ignored (not scanned) and the __percpu pointers it
contains to be reported as leaks.
Make the max_low_pfn upper boundary check strict when deciding whether to
ignore a physical address object and not scan it.
Link: https://lkml.kernel.org/r/20250127184233.2974311-1-catalin.marinas@arm.com
Fixes: 84c326299191 ("mm: kmemleak: check physical address when scan")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Jakub Kicinski <kuba@kernel.org>
Tested-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Cc: Patrick Wang <patrick.wang.shcn@gmail.com>
Cc: <stable@vger.kernel.org> [6.0.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kmemleak.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -1689,7 +1689,7 @@ static void kmemleak_scan(void)
unsigned long phys = object->pointer;
if (PHYS_PFN(phys) < min_low_pfn ||
- PHYS_PFN(phys + object->size) >= max_low_pfn)
+ PHYS_PFN(phys + object->size) > max_low_pfn)
__paint_it(object, KMEMLEAK_BLACK);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 378/443] mm: gup: fix infinite loop within __get_longterm_locked
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 377/443] mm: kmemleak: fix upper boundary check for physical address objects Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 379/443] mm/vmscan: accumulate nr_demoted for accurate demotion statistics Greg Kroah-Hartman
` (75 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhaoyang Huang, John Hubbard,
David Hildenbrand, Aijun Sun, Alistair Popple, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
commit 1aaf8c122918aa8897605a9aa1e8ed6600d6f930 upstream.
We can run into an infinite loop in __get_longterm_locked() when
collect_longterm_unpinnable_folios() finds only folios that are isolated
from the LRU or were never added to the LRU. This can happen when all
folios to be pinned are never added to the LRU, for example when
vm_ops->fault allocated pages using cma_alloc() and never added them to
the LRU.
Fix it by simply taking a look at the list in the single caller, to see if
anything was added.
[zhaoyang.huang@unisoc.com: move definition of local]
Link: https://lkml.kernel.org/r/20250122012604.3654667-1-zhaoyang.huang@unisoc.com
Link: https://lkml.kernel.org/r/20250121020159.3636477-1-zhaoyang.huang@unisoc.com
Fixes: 67e139b02d99 ("mm/gup.c: refactor check_and_migrate_movable_pages()")
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Suggested-by: David Hildenbrand <david@redhat.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Aijun Sun <aijun.sun@unisoc.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/gup.c | 14 ++++----------
1 file changed, 4 insertions(+), 10 deletions(-)
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2323,13 +2323,13 @@ static void pofs_unpin(struct pages_or_f
/*
* Returns the number of collected folios. Return value is always >= 0.
*/
-static unsigned long collect_longterm_unpinnable_folios(
+static void collect_longterm_unpinnable_folios(
struct list_head *movable_folio_list,
struct pages_or_folios *pofs)
{
- unsigned long i, collected = 0;
struct folio *prev_folio = NULL;
bool drain_allow = true;
+ unsigned long i;
for (i = 0; i < pofs->nr_entries; i++) {
struct folio *folio = pofs_get_folio(pofs, i);
@@ -2341,8 +2341,6 @@ static unsigned long collect_longterm_un
if (folio_is_longterm_pinnable(folio))
continue;
- collected++;
-
if (folio_is_device_coherent(folio))
continue;
@@ -2364,8 +2362,6 @@ static unsigned long collect_longterm_un
NR_ISOLATED_ANON + folio_is_file_lru(folio),
folio_nr_pages(folio));
}
-
- return collected;
}
/*
@@ -2442,11 +2438,9 @@ static long
check_and_migrate_movable_pages_or_folios(struct pages_or_folios *pofs)
{
LIST_HEAD(movable_folio_list);
- unsigned long collected;
- collected = collect_longterm_unpinnable_folios(&movable_folio_list,
- pofs);
- if (!collected)
+ collect_longterm_unpinnable_folios(&movable_folio_list, pofs);
+ if (list_empty(&movable_folio_list))
return 0;
return migrate_longterm_unpinnable_folios(&movable_folio_list, pofs);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 379/443] mm/vmscan: accumulate nr_demoted for accurate demotion statistics
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 378/443] mm: gup: fix infinite loop within __get_longterm_locked Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 380/443] mm/hugetlb: fix hugepage allocation for interleaved memory nodes Greg Kroah-Hartman
` (74 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Zhijian, Kaiyang Zhao, Donet Tom,
Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zhijian <lizhijian@fujitsu.com>
commit a479b078fddb0ad7f9e3c6da22d9cf8f2b5c7799 upstream.
In shrink_folio_list(), demote_folio_list() can be called 2 times.
Currently stat->nr_demoted will only store the last nr_demoted( the later
nr_demoted is always zero, the former nr_demoted will get lost), as a
result number of demoted pages is not accurate.
Accumulate the nr_demoted count across multiple calls to
demote_folio_list(), ensuring accurate reporting of demotion statistics.
[lizhijian@fujitsu.com: introduce local nr_demoted to fix nr_reclaimed double counting]
Link: https://lkml.kernel.org/r/20250111015253.425693-1-lizhijian@fujitsu.com
Link: https://lkml.kernel.org/r/20250110122133.423481-1-lizhijian@fujitsu.com
Fixes: f77f0c751478 ("mm,memcg: provide per-cgroup counters for NUMA balancing operations")
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Acked-by: Kaiyang Zhao <kaiyang2@cs.cmu.edu>
Tested-by: Donet Tom <donettom@linux.ibm.com>
Reviewed-by: Donet Tom <donettom@linux.ibm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmscan.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1053,7 +1053,7 @@ static unsigned int shrink_folio_list(st
struct folio_batch free_folios;
LIST_HEAD(ret_folios);
LIST_HEAD(demote_folios);
- unsigned int nr_reclaimed = 0;
+ unsigned int nr_reclaimed = 0, nr_demoted = 0;
unsigned int pgactivate = 0;
bool do_demote_pass;
struct swap_iocb *plug = NULL;
@@ -1522,8 +1522,9 @@ keep:
/* 'folio_list' is always empty here */
/* Migrate folios selected for demotion */
- stat->nr_demoted = demote_folio_list(&demote_folios, pgdat);
- nr_reclaimed += stat->nr_demoted;
+ nr_demoted = demote_folio_list(&demote_folios, pgdat);
+ nr_reclaimed += nr_demoted;
+ stat->nr_demoted += nr_demoted;
/* Folios that could not be demoted are still in @demote_folios */
if (!list_empty(&demote_folios)) {
/* Folios which weren't demoted go back on @folio_list */
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 380/443] mm/hugetlb: fix hugepage allocation for interleaved memory nodes
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 379/443] mm/vmscan: accumulate nr_demoted for accurate demotion statistics Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 381/443] mm/compaction: fix UBSAN shift-out-of-bounds warning Greg Kroah-Hartman
` (73 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM),
Pavithra Prakash, Muchun Song, Sourabh Jain, Luiz Capitulino,
David Rientjes, Donet Tom, Gang Li, Daniel Jordan, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
commit 76e961157e078bc5d3cd2df08317e00b00a829eb upstream.
gather_bootmem_prealloc() assumes the start nid as 0 and size as
num_node_state(N_MEMORY). That means in case if memory attached numa
nodes are interleaved, then gather_bootmem_prealloc_parallel() will fail
to scan few of these nodes.
Since memory attached numa nodes can be interleaved in any fashion, hence
ensure that the current code checks for all numa node ids
(.size = nr_node_ids). Let's still keep max_threads as N_MEMORY, so that
it can distributes all nr_node_ids among the these many no. threads.
e.g. qemu cmdline
========================
numa_cmd="-numa node,nodeid=1,memdev=mem1,cpus=2-3 -numa node,nodeid=0,cpus=0-1 -numa dist,src=0,dst=1,val=20"
mem_cmd="-object memory-backend-ram,id=mem1,size=16G"
w/o this patch for cmdline (default_hugepagesz=1GB hugepagesz=1GB hugepages=2):
==========================
~ # cat /proc/meminfo |grep -i huge
AnonHugePages: 0 kB
ShmemHugePages: 0 kB
FileHugePages: 0 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 1048576 kB
Hugetlb: 0 kB
with this patch for cmdline (default_hugepagesz=1GB hugepagesz=1GB hugepages=2):
===========================
~ # cat /proc/meminfo |grep -i huge
AnonHugePages: 0 kB
ShmemHugePages: 0 kB
FileHugePages: 0 kB
HugePages_Total: 2
HugePages_Free: 2
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 1048576 kB
Hugetlb: 2097152 kB
Link: https://lkml.kernel.org/r/f8d8dad3a5471d284f54185f65d575a6aaab692b.1736592534.git.ritesh.list@gmail.com
Fixes: b78b27d02930 ("hugetlb: parallelize 1G hugetlb initialization")
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Reported-by: Pavithra Prakash <pavrampu@linux.ibm.com>
Suggested-by: Muchun Song <muchun.song@linux.dev>
Tested-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Reviewed-by: Luiz Capitulino <luizcap@redhat.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Donet Tom <donettom@linux.ibm.com>
Cc: Gang Li <gang.li@linux.dev>
Cc: Daniel Jordan <daniel.m.jordan@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/hugetlb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3273,7 +3273,7 @@ static void __init gather_bootmem_preall
.thread_fn = gather_bootmem_prealloc_parallel,
.fn_arg = NULL,
.start = 0,
- .size = num_node_state(N_MEMORY),
+ .size = nr_node_ids,
.align = 1,
.min_chunk = 1,
.max_threads = num_node_state(N_MEMORY),
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 381/443] mm/compaction: fix UBSAN shift-out-of-bounds warning
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 380/443] mm/hugetlb: fix hugepage allocation for interleaved memory nodes Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 382/443] ata: libata-core: Add ATA_QUIRK_NOLPM for Samsung SSD 870 QVO drives Greg Kroah-Hartman
` (72 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liu Shixin, Kemeng Shi,
David Hildenbrand, Oscar Salvador, Baolin Wang, Matthew Wilcox,
Mel Gorman, Nanyong Sun, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Shixin <liushixin2@huawei.com>
commit d1366e74342e75555af2648a2964deb2d5c92200 upstream.
syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order)
in isolate_freepages_block(). The bogus compound_order can be any value
because it is union with flags. Add back the MAX_PAGE_ORDER check to fix
the warning.
Link: https://lkml.kernel.org/r/20250123021029.2826736-1-liushixin2@huawei.com
Fixes: 3da0272a4c7d ("mm/compaction: correctly return failure with bogus compound_order in strict mode")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Reviewed-by: Kemeng Shi <shikemeng@huaweicloud.com>
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Nanyong Sun <sunnanyong@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/compaction.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -630,7 +630,8 @@ static unsigned long isolate_freepages_b
if (PageCompound(page)) {
const unsigned int order = compound_order(page);
- if (blockpfn + (1UL << order) <= end_pfn) {
+ if ((order <= MAX_PAGE_ORDER) &&
+ (blockpfn + (1UL << order) <= end_pfn)) {
blockpfn += (1UL << order) - 1;
page += (1UL << order) - 1;
nr_scanned += (1UL << order) - 1;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 382/443] ata: libata-core: Add ATA_QUIRK_NOLPM for Samsung SSD 870 QVO drives
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 381/443] mm/compaction: fix UBSAN shift-out-of-bounds warning Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 383/443] ata: libata-sff: Ensure that we cannot write outside the allocated buffer Greg Kroah-Hartman
` (71 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daniel Baumann, Niklas Cassel
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Baumann <daniel@debian.org>
commit cc77e2ce187d26cc66af3577bf896d7410eb25ab upstream.
Disabling link power management on Samsung SSD 870 QVO drives
to make them work again after the switch of the default LPM
policy to low.
Testing so far has shown that regular Samsung SSD 870
(the non QVO variants) do not need it and work fine with
the default LPM policy.
Cc: stable@vger.kernel.org
Fixes: 7627a0edef54 ("ata: ahci: Drop low power policy board type")
Signed-off-by: Daniel Baumann <daniel@debian.org>
Link: https://lore.kernel.org/linux-ide/ac64a484-022c-42a0-95bc-1520333b1536@debian.org/
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-core.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4143,6 +4143,10 @@ static const struct ata_dev_quirks_entry
{ "Samsung SSD 860*", NULL, ATA_QUIRK_NO_NCQ_TRIM |
ATA_QUIRK_ZERO_AFTER_TRIM |
ATA_QUIRK_NO_NCQ_ON_ATI },
+ { "Samsung SSD 870 QVO*", NULL, ATA_QUIRK_NO_NCQ_TRIM |
+ ATA_QUIRK_ZERO_AFTER_TRIM |
+ ATA_QUIRK_NO_NCQ_ON_ATI |
+ ATA_QUIRK_NOLPM },
{ "Samsung SSD 870*", NULL, ATA_QUIRK_NO_NCQ_TRIM |
ATA_QUIRK_ZERO_AFTER_TRIM |
ATA_QUIRK_NO_NCQ_ON_ATI },
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 383/443] ata: libata-sff: Ensure that we cannot write outside the allocated buffer
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 382/443] ata: libata-core: Add ATA_QUIRK_NOLPM for Samsung SSD 870 QVO drives Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 384/443] irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data Greg Kroah-Hartman
` (70 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, reveliofuzzing, Niklas Cassel
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
commit 6e74e53b34b6dec5a50e1404e2680852ec6768d2 upstream.
reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len
set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to
ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to
write outside the allocated buffer, overwriting random memory.
While a ATA device is supposed to abort a ATA_NOP command, there does seem
to be a bug either in libata-sff or QEMU, where either this status is not
set, or the status is cleared before read by ata_sff_hsm_move().
Anyway, that is most likely a separate bug.
Looking at __atapi_pio_bytes(), it already has a safety check to ensure
that __atapi_pio_bytes() cannot write outside the allocated buffer.
Add a similar check to ata_pio_sector(), such that also ata_pio_sector()
cannot write outside the allocated buffer.
Cc: stable@vger.kernel.org
Reported-by: reveliofuzzing <reveliofuzzing@gmail.com>
Closes: https://lore.kernel.org/linux-ide/CA+-ZZ_jTgxh3bS7m+KX07_EWckSnW3N2adX3KV63y4g7M4CZ2A@mail.gmail.com/
Link: https://lore.kernel.org/r/20250127154303.15567-2-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-sff.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -601,7 +601,7 @@ static void ata_pio_sector(struct ata_qu
{
struct ata_port *ap = qc->ap;
struct page *page;
- unsigned int offset;
+ unsigned int offset, count;
if (!qc->cursg) {
qc->curbytes = qc->nbytes;
@@ -617,25 +617,27 @@ static void ata_pio_sector(struct ata_qu
page = nth_page(page, (offset >> PAGE_SHIFT));
offset %= PAGE_SIZE;
- trace_ata_sff_pio_transfer_data(qc, offset, qc->sect_size);
+ /* don't overrun current sg */
+ count = min(qc->cursg->length - qc->cursg_ofs, qc->sect_size);
+
+ trace_ata_sff_pio_transfer_data(qc, offset, count);
/*
* Split the transfer when it splits a page boundary. Note that the
* split still has to be dword aligned like all ATA data transfers.
*/
WARN_ON_ONCE(offset % 4);
- if (offset + qc->sect_size > PAGE_SIZE) {
+ if (offset + count > PAGE_SIZE) {
unsigned int split_len = PAGE_SIZE - offset;
ata_pio_xfer(qc, page, offset, split_len);
- ata_pio_xfer(qc, nth_page(page, 1), 0,
- qc->sect_size - split_len);
+ ata_pio_xfer(qc, nth_page(page, 1), 0, count - split_len);
} else {
- ata_pio_xfer(qc, page, offset, qc->sect_size);
+ ata_pio_xfer(qc, page, offset, count);
}
- qc->curbytes += qc->sect_size;
- qc->cursg_ofs += qc->sect_size;
+ qc->curbytes += count;
+ qc->cursg_ofs += count;
if (qc->cursg_ofs == qc->cursg->length) {
qc->cursg = sg_next(qc->cursg);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 384/443] irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 383/443] ata: libata-sff: Ensure that we cannot write outside the allocated buffer Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 385/443] crypto: qce - fix goto jump in error path Greg Kroah-Hartman
` (69 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stefan Eichenberger, Thomas Gleixner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Eichenberger <eichest@gmail.com>
commit 987f379b54091cc1b1db986bde71cee1081350b3 upstream.
mvebu_icu_translate() incorrectly casts irq_domain::host_data directly to
mvebu_icu_msi_data. However, host_data actually points to a structure of
type msi_domain_info.
This incorrect cast causes issues such as the thermal sensors of the
CP110 platform malfunctioning. Specifically, the translation of the SEI
interrupt to IRQ_TYPE_EDGE_RISING fails, preventing proper interrupt
handling. The following error was observed:
genirq: Setting trigger mode 4 for irq 85 failed (irq_chip_set_type_parent+0x0/0x34)
armada_thermal f2400000.system-controller:thermal-sensor@70: Cannot request threaded IRQ 85
Resolve the issue by first casting host_data to msi_domain_info and then
accessing mvebu_icu_msi_data through msi_domain_info::chip_data.
Fixes: d929e4db22b6 ("irqchip/irq-mvebu-icu: Prepare for real per device MSI")
Signed-off-by: Stefan Eichenberger <eichest@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20250124085140.44792-1-eichest@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-mvebu-icu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/irqchip/irq-mvebu-icu.c
+++ b/drivers/irqchip/irq-mvebu-icu.c
@@ -68,7 +68,8 @@ static int mvebu_icu_translate(struct ir
unsigned long *hwirq, unsigned int *type)
{
unsigned int param_count = static_branch_unlikely(&legacy_bindings) ? 3 : 2;
- struct mvebu_icu_msi_data *msi_data = d->host_data;
+ struct msi_domain_info *info = d->host_data;
+ struct mvebu_icu_msi_data *msi_data = info->chip_data;
struct mvebu_icu *icu = msi_data->icu;
/* Check the count of the parameters in dt */
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 385/443] crypto: qce - fix goto jump in error path
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 384/443] irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 386/443] crypto: qce - unregister previously registered algos " Greg Kroah-Hartman
` (68 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Neil Armstrong,
Herbert Xu
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
commit 5278275c1758a38199b43530adfc50098f4b41c7 upstream.
If qce_check_version() fails, we should jump to err_dma as we already
called qce_dma_request() a couple lines before.
Cc: stable@vger.kernel.org
Fixes: ec8f5d8f6f76 ("crypto: qce - Qualcomm crypto engine driver")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qce/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/qce/core.c
+++ b/drivers/crypto/qce/core.c
@@ -247,7 +247,7 @@ static int qce_crypto_probe(struct platf
ret = qce_check_version(qce);
if (ret)
- goto err_clks;
+ goto err_dma;
spin_lock_init(&qce->lock);
tasklet_init(&qce->done_tasklet, qce_tasklet_req_done,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 386/443] crypto: qce - unregister previously registered algos in error path
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 385/443] crypto: qce - fix goto jump in error path Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 387/443] ceph: fix memory leak in ceph_mds_auth_match() Greg Kroah-Hartman
` (67 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Neil Armstrong,
Herbert Xu
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
commit e80cf84b608725303113d6fe98bb727bf7b7a40d upstream.
If we encounter an error when registering alorithms with the crypto
framework, we just bail out and don't unregister the ones we
successfully registered in prior iterations of the loop.
Add code that goes back over the algos and unregisters them before
returning an error from qce_register_algs().
Cc: stable@vger.kernel.org
Fixes: ec8f5d8f6f76 ("crypto: qce - Qualcomm crypto engine driver")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qce/core.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/crypto/qce/core.c
+++ b/drivers/crypto/qce/core.c
@@ -51,16 +51,19 @@ static void qce_unregister_algs(struct q
static int qce_register_algs(struct qce_device *qce)
{
const struct qce_algo_ops *ops;
- int i, ret = -ENODEV;
+ int i, j, ret = -ENODEV;
for (i = 0; i < ARRAY_SIZE(qce_ops); i++) {
ops = qce_ops[i];
ret = ops->register_algs(qce);
- if (ret)
- break;
+ if (ret) {
+ for (j = i - 1; j >= 0; j--)
+ ops->unregister_algs(qce);
+ return ret;
+ }
}
- return ret;
+ return 0;
}
static int qce_handle_request(struct crypto_async_request *async_req)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 387/443] ceph: fix memory leak in ceph_mds_auth_match()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 386/443] crypto: qce - unregister previously registered algos " Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 388/443] nvmem: qcom-spmi-sdam: Set size in struct nvmem_config Greg Kroah-Hartman
` (66 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antoine Viallon, Viacheslav Dubeyko,
Ilya Dryomov
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoine Viallon <antoine@lesviallon.fr>
commit 3b7d93db450e9d8ead80d75e2a303248f1528c35 upstream.
We now free the temporary target path substring allocation on every
possible branch, instead of omitting the default branch. In some
cases, a memory leak occured, which could rapidly crash the system
(depending on how many file accesses were attempted).
This was detected in production because it caused a continuous memory
growth, eventually triggering kernel OOM and completely hard-locking
the kernel.
Relevant kmemleak stacktrace:
unreferenced object 0xffff888131e69900 (size 128):
comm "git", pid 66104, jiffies 4295435999
hex dump (first 32 bytes):
76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe
72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67 rs/gitea/gitea/g
backtrace (crc 2f3bb450):
[<ffffffffaa68fb49>] __kmalloc_noprof+0x359/0x510
[<ffffffffc32bf1df>] ceph_mds_check_access+0x5bf/0x14e0 [ceph]
[<ffffffffc3235722>] ceph_open+0x312/0xd80 [ceph]
[<ffffffffaa7dd786>] do_dentry_open+0x456/0x1120
[<ffffffffaa7e3729>] vfs_open+0x79/0x360
[<ffffffffaa832875>] path_openat+0x1de5/0x4390
[<ffffffffaa834fcc>] do_filp_open+0x19c/0x3c0
[<ffffffffaa7e44a1>] do_sys_openat2+0x141/0x180
[<ffffffffaa7e4945>] __x64_sys_open+0xe5/0x1a0
[<ffffffffac2cc2f7>] do_syscall_64+0xb7/0x210
[<ffffffffac400130>] entry_SYSCALL_64_after_hwframe+0x77/0x7f
It can be triggered by mouting a subdirectory of a CephFS filesystem,
and then trying to access files on this subdirectory with an auth token
using a path-scoped capability:
$ ceph auth get client.services
[client.services]
key = REDACTED
caps mds = "allow rw fsname=cephfs path=/volumes/"
caps mon = "allow r fsname=cephfs"
caps osd = "allow rw tag cephfs data=cephfs"
$ cat /proc/self/mounts
services@[REDACTED].cephfs=/volumes/containers /ceph/containers ceph rw,noatime,name=services,secret=<hidden>,ms_mode=prefer-crc,mount_timeout=300,acl,mon_addr=[REDACTED]:3300,recover_session=clean 0 0
$ seq 1 1000000 | xargs -P32 --replace={} touch /ceph/containers/file-{} && \
seq 1 1000000 | xargs -P32 --replace={} cat /ceph/containers/file-{}
[ idryomov: combine if statements, rename rc to path_matched and make
it a bool, formatting ]
Cc: stable@vger.kernel.org
Fixes: 596afb0b8933 ("ceph: add ceph_mds_check_access() helper")
Signed-off-by: Antoine Viallon <antoine@lesviallon.fr>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mds_client.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -5690,18 +5690,18 @@ static int ceph_mds_auth_match(struct ce
*
* All the other cases --> mismatch
*/
+ bool path_matched = true;
char *first = strstr(_tpath, auth->match.path);
- if (first != _tpath) {
- if (free_tpath)
- kfree(_tpath);
- return 0;
+ if (first != _tpath ||
+ (tlen > len && _tpath[len] != '/')) {
+ path_matched = false;
}
- if (tlen > len && _tpath[len] != '/') {
- if (free_tpath)
- kfree(_tpath);
+ if (free_tpath)
+ kfree(_tpath);
+
+ if (!path_matched)
return 0;
- }
}
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 388/443] nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 387/443] ceph: fix memory leak in ceph_mds_auth_match() Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 389/443] nvmem: core: improve range check for nvmem_cell_write() Greg Kroah-Hartman
` (65 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Vladimir Zapolskiy,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
commit e88f516ea417c71bb3702603ac6af9e95338cfa6 upstream.
Let the nvmem core know what size the SDAM is, most notably this fixes
the size of /sys/bus/nvmem/devices/spmi_sdam*/nvmem being '0' and makes
user space work with that file.
~ # hexdump -C -s 64 /sys/bus/nvmem/devices/spmi_sdam2/nvmem
00000040 02 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 |................|
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000080
Fixes: 40ce9798794f ("nvmem: add QTI SDAM driver")
Cc: stable@vger.kernel.org
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20241230141901.263976-6-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/qcom-spmi-sdam.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/nvmem/qcom-spmi-sdam.c
+++ b/drivers/nvmem/qcom-spmi-sdam.c
@@ -144,6 +144,7 @@ static int sdam_probe(struct platform_de
sdam->sdam_config.owner = THIS_MODULE;
sdam->sdam_config.add_legacy_fixed_of_cells = true;
sdam->sdam_config.stride = 1;
+ sdam->sdam_config.size = sdam->size;
sdam->sdam_config.word_size = 1;
sdam->sdam_config.reg_read = sdam_read;
sdam->sdam_config.reg_write = sdam_write;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 389/443] nvmem: core: improve range check for nvmem_cell_write()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 388/443] nvmem: qcom-spmi-sdam: Set size in struct nvmem_config Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 390/443] nvmem: imx-ocotp-ele: simplify read beyond device check Greg Kroah-Hartman
` (64 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jennifer Berringer,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jennifer Berringer <jberring@redhat.com>
commit 31507fc2ad36e0071751a710449db19c85d82a7f upstream.
When __nvmem_cell_entry_write() is called for an nvmem cell that does
not need bit shifting, it requires that the len parameter exactly
matches the nvmem cell size. However, when the nvmem cell has a nonzero
bit_offset, it was skipping this check.
Accepting values of len larger than the cell size results in
nvmem_cell_prepare_write_buffer() trying to write past the end of a heap
buffer that it allocates. Add a check to avoid that problem and instead
return -EINVAL when len doesn't match the number of bits expected by the
nvmem cell when bit_offset is nonzero.
This check uses cell->nbits in order to allow providing the smaller size
to cells that are shifted into another byte by bit_offset. For example,
a cell with nbits=8 and nonzero bit_offset would have bytes=2 but should
accept a 1-byte write here, although no current callers depend on this.
Fixes: 69aba7948cbe ("nvmem: Add a simple NVMEM framework for consumers")
Cc: stable@vger.kernel.org
Signed-off-by: Jennifer Berringer <jberring@redhat.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20241230141901.263976-7-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1790,6 +1790,8 @@ static int __nvmem_cell_entry_write(stru
return -EINVAL;
if (cell->bit_offset || cell->nbits) {
+ if (len != BITS_TO_BYTES(cell->nbits) && len != cell->bytes)
+ return -EINVAL;
buf = nvmem_cell_prepare_write_buffer(cell, buf, len);
if (IS_ERR(buf))
return PTR_ERR(buf);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 390/443] nvmem: imx-ocotp-ele: simplify read beyond device check
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 389/443] nvmem: core: improve range check for nvmem_cell_write() Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 391/443] nvmem: imx-ocotp-ele: fix MAC address byte order Greg Kroah-Hartman
` (63 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sascha Hauer, stable, Peng Fan,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <s.hauer@pengutronix.de>
commit 343aa1e289e8e3dba5e3d054c4eb27da7b4e1ecc upstream.
Do the read beyond device check on function entry in bytes instead of
32bit words which is easier to follow.
Fixes: 22e9e6fcfb50 ("nvmem: imx: support i.MX93 OCOTP")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Cc: stable <stable@kernel.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20241230141901.263976-2-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/imx-ocotp-ele.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/nvmem/imx-ocotp-ele.c
+++ b/drivers/nvmem/imx-ocotp-ele.c
@@ -72,13 +72,13 @@ static int imx_ocotp_reg_read(void *cont
void *p;
int i;
+ if (offset + bytes > priv->data->size)
+ bytes = priv->data->size - offset;
+
index = offset;
num_bytes = round_up(bytes, 4);
count = num_bytes >> 2;
- if (count > ((priv->data->size >> 2) - index))
- count = (priv->data->size >> 2) - index;
-
p = kzalloc(num_bytes, GFP_KERNEL);
if (!p)
return -ENOMEM;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 391/443] nvmem: imx-ocotp-ele: fix MAC address byte order
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 390/443] nvmem: imx-ocotp-ele: simplify read beyond device check Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 392/443] nvmem: imx-ocotp-ele: fix reading from non zero offset Greg Kroah-Hartman
` (62 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sascha Hauer, stable, Peng Fan,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <s.hauer@pengutronix.de>
commit 391b06ecb63e6eacd054582cb4eb738dfbf5eb77 upstream.
According to the i.MX93 Fusemap the two MAC addresses are stored in
words 315 to 317 like this:
315 MAC1_ADDR_31_0[31:0]
316 MAC1_ADDR_47_32[47:32]
MAC2_ADDR_15_0[15:0]
317 MAC2_ADDR_47_16[31:0]
This means the MAC addresses are stored in reverse byte order. We have
to swap the bytes before passing them to the upper layers. The storage
format is consistent to the one used on i.MX6 using imx-ocotp driver
which does the same byte swapping as introduced here.
With this patch the MAC address on my i.MX93 TQ board correctly reads as
00:d0:93:6b:27:b8 instead of b8:27:6b:93:d0:00.
Fixes: 22e9e6fcfb50 ("nvmem: imx: support i.MX93 OCOTP")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Cc: stable <stable@kernel.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20241230141901.263976-4-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/imx-ocotp-ele.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/drivers/nvmem/imx-ocotp-ele.c
+++ b/drivers/nvmem/imx-ocotp-ele.c
@@ -109,6 +109,26 @@ static int imx_ocotp_reg_read(void *cont
return 0;
};
+static int imx_ocotp_cell_pp(void *context, const char *id, int index,
+ unsigned int offset, void *data, size_t bytes)
+{
+ u8 *buf = data;
+ int i;
+
+ /* Deal with some post processing of nvmem cell data */
+ if (id && !strcmp(id, "mac-address"))
+ for (i = 0; i < bytes / 2; i++)
+ swap(buf[i], buf[bytes - i - 1]);
+
+ return 0;
+}
+
+static void imx_ocotp_fixup_dt_cell_info(struct nvmem_device *nvmem,
+ struct nvmem_cell_info *cell)
+{
+ cell->read_post_process = imx_ocotp_cell_pp;
+}
+
static int imx_ele_ocotp_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -135,6 +155,8 @@ static int imx_ele_ocotp_probe(struct pl
priv->config.stride = 1;
priv->config.priv = priv;
priv->config.read_only = true;
+ priv->config.add_legacy_fixed_of_cells = true;
+ priv->config.fixup_dt_cell_info = imx_ocotp_fixup_dt_cell_info;
mutex_init(&priv->lock);
nvmem = devm_nvmem_register(dev, &priv->config);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 392/443] nvmem: imx-ocotp-ele: fix reading from non zero offset
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 391/443] nvmem: imx-ocotp-ele: fix MAC address byte order Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 393/443] nvmem: imx-ocotp-ele: set word length to 1 Greg Kroah-Hartman
` (61 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sascha Hauer, stable, Peng Fan,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <s.hauer@pengutronix.de>
commit 3c9e2cb6cecf65f7501004038c5d1ed85fb7db84 upstream.
In imx_ocotp_reg_read() the offset comes in as bytes and not as words.
This means we have to divide offset by 4 to get to the correct word
offset.
Also the incoming offset might not be word aligned. In order to read
from the OCOTP the driver aligns down the previous word boundary and
reads from there. This means we have to skip this alignment offset from
the temporary buffer when copying the data to the output buffer.
Fixes: 22e9e6fcfb50 ("nvmem: imx: support i.MX93 OCOTP")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Cc: stable <stable@kernel.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20241230141901.263976-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/imx-ocotp-ele.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/nvmem/imx-ocotp-ele.c
+++ b/drivers/nvmem/imx-ocotp-ele.c
@@ -71,12 +71,14 @@ static int imx_ocotp_reg_read(void *cont
u32 *buf;
void *p;
int i;
+ u8 skipbytes;
if (offset + bytes > priv->data->size)
bytes = priv->data->size - offset;
- index = offset;
- num_bytes = round_up(bytes, 4);
+ index = offset >> 2;
+ skipbytes = offset - (index << 2);
+ num_bytes = round_up(bytes + skipbytes, 4);
count = num_bytes >> 2;
p = kzalloc(num_bytes, GFP_KERNEL);
@@ -100,7 +102,7 @@ static int imx_ocotp_reg_read(void *cont
*buf++ = readl_relaxed(reg + (i << 2));
}
- memcpy(val, (u8 *)p, bytes);
+ memcpy(val, ((u8 *)p) + skipbytes, bytes);
mutex_unlock(&priv->lock);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 393/443] nvmem: imx-ocotp-ele: set word length to 1
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 392/443] nvmem: imx-ocotp-ele: fix reading from non zero offset Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 394/443] io_uring: fix multishots with selected buffers Greg Kroah-Hartman
` (60 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sascha Hauer, stable, Peng Fan,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sascha Hauer <s.hauer@pengutronix.de>
commit 1b2cb4d0b5b6a9d9fe78470704309ec75f8a1c3a upstream.
The ELE hardware internally has a word length of 4. However, among other
things we store MAC addresses in the ELE OCOTP. With a length of 6 bytes
these are naturally unaligned to the word length. Therefore we must
support unaligned reads in reg_read() and indeed it works properly when
reg_read() is called via nvmem_reg_read(). Setting the word size to 4
has the only visible effect that doing unaligned reads from userspace
via bin_attr_nvmem_read() do not work because they are rejected by that
function.
Given that we have to abstract from word accesses to byte accesses in
the driver, set the word size to 1. This allows bytewise accesses from
userspace to be able to test what the driver has to support anyway.
Fixes: 22e9e6fcfb50 ("nvmem: imx: support i.MX93 OCOTP")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Cc: stable <stable@kernel.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20241230141901.263976-5-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/imx-ocotp-ele.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvmem/imx-ocotp-ele.c
+++ b/drivers/nvmem/imx-ocotp-ele.c
@@ -153,7 +153,7 @@ static int imx_ele_ocotp_probe(struct pl
priv->config.owner = THIS_MODULE;
priv->config.size = priv->data->size;
priv->config.reg_read = priv->data->reg_read;
- priv->config.word_size = 4;
+ priv->config.word_size = 1;
priv->config.stride = 1;
priv->config.priv = priv;
priv->config.read_only = true;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 394/443] io_uring: fix multishots with selected buffers
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 393/443] nvmem: imx-ocotp-ele: set word length to 1 Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 395/443] io_uring/net: dont retry connect operation on EPOLLERR Greg Kroah-Hartman
` (59 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Muhammad Ramdhan,
Bing-Jhong Billy Jheng, Jacob Soo, Pavel Begunkov, Jens Axboe
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <asml.silence@gmail.com>
commit d63b0e8a628e62ca85a0f7915230186bb92f8bb4 upstream.
We do io_kbuf_recycle() when arming a poll but every iteration of a
multishot can grab more buffers, which is why we need to flush the kbuf
ring state before continuing with waiting.
Cc: stable@vger.kernel.org
Fixes: b3fdea6ecb55c ("io_uring: multishot recv")
Reported-by: Muhammad Ramdhan <ramdhan@starlabs.sg>
Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Reported-by: Jacob Soo <jacob.soo@starlabs.sg>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/1bfc9990fe435f1fc6152ca9efeba5eb3e68339c.1738025570.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/poll.c | 2 ++
1 file changed, 2 insertions(+)
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -315,8 +315,10 @@ void io_poll_task_func(struct io_kiocb *
ret = io_poll_check_events(req, ts);
if (ret == IOU_POLL_NO_ACTION) {
+ io_kbuf_recycle(req, 0);
return;
} else if (ret == IOU_POLL_REQUEUE) {
+ io_kbuf_recycle(req, 0);
__io_poll_execute(req, 0);
return;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 395/443] io_uring/net: dont retry connect operation on EPOLLERR
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 394/443] io_uring: fix multishots with selected buffers Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 396/443] vfio/platform: check the bounds of read/write syscalls Greg Kroah-Hartman
` (58 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sergey Galas, Jens Axboe
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
commit 8c8492ca64e79c6e0f433e8c9d2bcbd039ef83d0 upstream.
If a socket is shutdown before the connection completes, POLLERR is set
in the poll mask. However, connect ignores this as it doesn't know, and
attempts the connection again. This may lead to a bogus -ETIMEDOUT
result, where it should have noticed the POLLERR and just returned
-ECONNRESET instead.
Have the poll logic check for whether or not POLLERR is set in the mask,
and if so, mark the request as failed. Then connect can appropriately
fail the request rather than retry it.
Reported-by: Sergey Galas <ssgalas@cloud.ru>
Cc: stable@vger.kernel.org
Link: https://github.com/axboe/liburing/discussions/1335
Fixes: 3fb1bd688172 ("io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/net.c | 5 +++++
io_uring/poll.c | 2 ++
2 files changed, 7 insertions(+)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1709,6 +1709,11 @@ int io_connect(struct io_kiocb *req, uns
int ret;
bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
+ if (unlikely(req->flags & REQ_F_FAIL)) {
+ ret = -ECONNRESET;
+ goto out;
+ }
+
file_flags = force_nonblock ? O_NONBLOCK : 0;
ret = __sys_connect_file(req->file, &io->addr, connect->addr_len,
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -273,6 +273,8 @@ static int io_poll_check_events(struct i
return IOU_POLL_REISSUE;
}
}
+ if (unlikely(req->cqe.res & EPOLLERR))
+ req_set_fail(req);
if (req->apoll_events & EPOLLONESHOT)
return IOU_POLL_DONE;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 396/443] vfio/platform: check the bounds of read/write syscalls
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 395/443] io_uring/net: dont retry connect operation on EPOLLERR Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 397/443] selftests: mptcp: connect: -f: no reconnect Greg Kroah-Hartman
` (57 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mostafa Saleh, Eric Auger,
Alex Williamson
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <alex.williamson@redhat.com>
commit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream.
count and offset are passed from user space and not checked, only
offset is capped to 40 bits, which can be used to read/write out of
bounds of the device.
Fixes: 6e3f26456009 (“vfio/platform: read and write support for the device fd”)
Cc: stable@vger.kernel.org
Reported-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/platform/vfio_platform_common.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/vfio/platform/vfio_platform_common.c
+++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -393,6 +393,11 @@ static ssize_t vfio_platform_read_mmio(s
count = min_t(size_t, count, reg->size - off);
+ if (off >= reg->size)
+ return -EINVAL;
+
+ count = min_t(size_t, count, reg->size - off);
+
if (!reg->ioaddr) {
reg->ioaddr =
ioremap(reg->addr, reg->size);
@@ -474,6 +479,11 @@ static ssize_t vfio_platform_write_mmio(
if (off >= reg->size)
return -EINVAL;
+
+ count = min_t(size_t, count, reg->size - off);
+
+ if (off >= reg->size)
+ return -EINVAL;
count = min_t(size_t, count, reg->size - off);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 397/443] selftests: mptcp: connect: -f: no reconnect
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 396/443] vfio/platform: check the bounds of read/write syscalls Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 398/443] pnfs/flexfiles: retry getting layout segment for reads Greg Kroah-Hartman
` (56 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mat Martineau,
Matthieu Baerts (NGI0), Jakub Kicinski
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
commit 5368a67307b3b2c347dc8965ac55b888be665934 upstream.
The '-f' parameter is there to force the kernel to emit MPTCP FASTCLOSE
by closing the connection with unread bytes in the receive queue.
The xdisconnect() helper was used to stop the connection, but it does
more than that: it will shut it down, then wait before reconnecting to
the same address. This causes the mptcp_join's "fastclose test" to fail
all the time.
This failure is due to a recent change, with commit 218cc166321f
("selftests: mptcp: avoid spurious errors on disconnect"), but that went
unnoticed because the test is currently ignored. The recent modification
only shown an existing issue: xdisconnect() doesn't need to be used
here, only the shutdown() part is needed.
Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases")
Cc: stable@vger.kernel.org
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20250204-net-mptcp-sft-conn-f-v1-1-6b470c72fffa@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_connect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -1302,7 +1302,7 @@ again:
return ret;
if (cfg_truncate > 0) {
- xdisconnect(fd);
+ shutdown(fd, SHUT_WR);
} else if (--cfg_repeat > 0) {
xdisconnect(fd);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 398/443] pnfs/flexfiles: retry getting layout segment for reads
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 397/443] selftests: mptcp: connect: -f: no reconnect Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 399/443] ocfs2: fix incorrect CPU endianness conversion causing mount failure Greg Kroah-Hartman
` (55 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Anna Schumaker
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
commit eb3fabde15bccdf34f1c9b35a83aa4c0dacbb4ca upstream.
If ff_layout_pg_get_read()'s attempt to get a layout segment results
in -EAGAIN have ff_layout_pg_init_read() retry it after sleeping.
If "softerr" mount is used, use 'io_maxretrans' to limit the number of
attempts to get a layout segment.
This fixes a long-standing issue of O_DIRECT reads failing with
-EAGAIN (11) when using flexfiles Client Side Mirroring (CSM).
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -847,6 +847,9 @@ ff_layout_pg_init_read(struct nfs_pageio
struct nfs4_pnfs_ds *ds;
u32 ds_idx;
+ if (NFS_SERVER(pgio->pg_inode)->flags &
+ (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR))
+ pgio->pg_maxretrans = io_maxretrans;
retry:
pnfs_generic_pg_check_layout(pgio, req);
/* Use full layout for now */
@@ -860,6 +863,8 @@ retry:
if (!pgio->pg_lseg)
goto out_nolseg;
}
+ /* Reset wb_nio, since getting layout segment was successful */
+ req->wb_nio = 0;
ds = ff_layout_get_ds_for_read(pgio, &ds_idx);
if (!ds) {
@@ -876,14 +881,24 @@ retry:
pgm->pg_bsize = mirror->mirror_ds->ds_versions[0].rsize;
pgio->pg_mirror_idx = ds_idx;
-
- if (NFS_SERVER(pgio->pg_inode)->flags &
- (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR))
- pgio->pg_maxretrans = io_maxretrans;
return;
out_nolseg:
- if (pgio->pg_error < 0)
- return;
+ if (pgio->pg_error < 0) {
+ if (pgio->pg_error != -EAGAIN)
+ return;
+ /* Retry getting layout segment if lower layer returned -EAGAIN */
+ if (pgio->pg_maxretrans && req->wb_nio++ > pgio->pg_maxretrans) {
+ if (NFS_SERVER(pgio->pg_inode)->flags & NFS_MOUNT_SOFTERR)
+ pgio->pg_error = -ETIMEDOUT;
+ else
+ pgio->pg_error = -EIO;
+ return;
+ }
+ pgio->pg_error = 0;
+ /* Sleep for 1 second before retrying */
+ ssleep(1);
+ goto retry;
+ }
out_mds:
trace_pnfs_mds_fallback_pg_init_read(pgio->pg_inode,
0, NFS4_MAX_UINT64, IOMODE_READ,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 399/443] ocfs2: fix incorrect CPU endianness conversion causing mount failure
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 398/443] pnfs/flexfiles: retry getting layout segment for reads Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 400/443] ocfs2: handle a symlink read error correctly Greg Kroah-Hartman
` (54 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heming Zhao, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heming Zhao <heming.zhao@suse.com>
commit f921da2c34692dfec5f72b5ae347b1bea22bb369 upstream.
Commit 23aab037106d ("ocfs2: fix UBSAN warning in ocfs2_verify_volume()")
introduced a regression bug. The blksz_bits value is already converted to
CPU endian in the previous code; therefore, the code shouldn't use
le32_to_cpu() anymore.
Link: https://lkml.kernel.org/r/20250121112204.12834-1-heming.zhao@suse.com
Fixes: 23aab037106d ("ocfs2: fix UBSAN warning in ocfs2_verify_volume()")
Signed-off-by: Heming Zhao <heming.zhao@suse.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -2340,7 +2340,7 @@ static int ocfs2_verify_volume(struct oc
mlog(ML_ERROR, "found superblock with incorrect block "
"size bits: found %u, should be 9, 10, 11, or 12\n",
blksz_bits);
- } else if ((1 << le32_to_cpu(blksz_bits)) != blksz) {
+ } else if ((1 << blksz_bits) != blksz) {
mlog(ML_ERROR, "found superblock with incorrect block "
"size: found %u, should be %u\n", 1 << blksz_bits, blksz);
} else if (le16_to_cpu(di->id2.i_super.s_major_rev_level) !=
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 400/443] ocfs2: handle a symlink read error correctly
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 399/443] ocfs2: fix incorrect CPU endianness conversion causing mount failure Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 401/443] nilfs2: fix possible int overflows in nilfs_fiemap() Greg Kroah-Hartman
` (53 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Wilcox (Oracle), Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Mark Tinguely, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <willy@infradead.org>
commit 2b4c2094da6d84e69b843dd3317902e977bf64bd upstream.
Patch series "Convert ocfs2 to use folios".
Mark did a conversion of ocfs2 to use folios and sent it to me as a
giant patch for review ;-)
So I've redone it as individual patches, and credited Mark for the patches
where his code is substantially the same. It's not a bad way to do it;
his patch had some bugs and my patches had some bugs. Hopefully all our
bugs were different from each other. And hopefully Mark likes all the
changes I made to his code!
This patch (of 23):
If we can't read the buffer, be sure to unlock the page before returning.
Link: https://lkml.kernel.org/r/20241205171653.3179945-1-willy@infradead.org
Link: https://lkml.kernel.org/r/20241205171653.3179945-2-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Tinguely <mark.tinguely@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/symlink.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/ocfs2/symlink.c
+++ b/fs/ocfs2/symlink.c
@@ -65,7 +65,7 @@ static int ocfs2_fast_symlink_read_folio
if (status < 0) {
mlog_errno(status);
- return status;
+ goto out;
}
fe = (struct ocfs2_dinode *) bh->b_data;
@@ -76,9 +76,10 @@ static int ocfs2_fast_symlink_read_folio
memcpy(kaddr, link, len + 1);
kunmap_atomic(kaddr);
SetPageUptodate(page);
+out:
unlock_page(page);
brelse(bh);
- return 0;
+ return status;
}
const struct address_space_operations ocfs2_fast_symlink_aops = {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 401/443] nilfs2: fix possible int overflows in nilfs_fiemap()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 400/443] ocfs2: handle a symlink read error correctly Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 402/443] nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it Greg Kroah-Hartman
` (52 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Ryusuke Konishi,
Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
commit 6438ef381c183444f7f9d1de18f22661cba1e946 upstream.
Since nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result
by being prepared to go through potentially maxblocks == INT_MAX blocks,
the value in n may experience an overflow caused by left shift of blkbits.
While it is extremely unlikely to occur, play it safe and cast right hand
expression to wider type to mitigate the issue.
Found by Linux Verification Center (linuxtesting.org) with static analysis
tool SVACE.
Link: https://lkml.kernel.org/r/20250124222133.5323-1-konishi.ryusuke@gmail.com
Fixes: 622daaff0a89 ("nilfs2: fiemap support")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/inode.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -1188,7 +1188,7 @@ int nilfs_fiemap(struct inode *inode, st
if (size) {
if (phys && blkphy << blkbits == phys + size) {
/* The current extent goes on */
- size += n << blkbits;
+ size += (u64)n << blkbits;
} else {
/* Terminate the current extent */
ret = fiemap_fill_next_extent(
@@ -1201,14 +1201,14 @@ int nilfs_fiemap(struct inode *inode, st
flags = FIEMAP_EXTENT_MERGED;
logical = blkoff << blkbits;
phys = blkphy << blkbits;
- size = n << blkbits;
+ size = (u64)n << blkbits;
}
} else {
/* Start a new extent */
flags = FIEMAP_EXTENT_MERGED;
logical = blkoff << blkbits;
phys = blkphy << blkbits;
- size = n << blkbits;
+ size = (u64)n << blkbits;
}
blkoff += n;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 402/443] nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 401/443] nilfs2: fix possible int overflows in nilfs_fiemap() Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 403/443] NFSD: Encode COMPOUND operation status on page boundaries Greg Kroah-Hartman
` (51 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Diederik de Haas, Dragan Simic,
Anna Schumaker
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <dsimic@manjaro.org>
commit 90190ba1c3b11687e2c251fda1f5d9893b4bab17 upstream.
Having the NFS_FSCACHE option depend on the NETFS_SUPPORT options makes
selecting NFS_FSCACHE impossible unless another option that additionally
selects NETFS_SUPPORT is already selected.
As a result, for example, being able to reach and select the NFS_FSCACHE
option requires the CEPH_FS or CIFS option to be selected beforehand, which
obviously doesn't make much sense.
Let's correct this by making the NFS_FSCACHE option actually select the
NETFS_SUPPORT option, instead of depending on it.
Fixes: 915cd30cdea8 ("netfs, fscache: Combine fscache with netfs")
Cc: stable@vger.kernel.org
Reported-by: Diederik de Haas <didi.debian@cknow.org>
Signed-off-by: Dragan Simic <dsimic@manjaro.org>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/Kconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -170,7 +170,8 @@ config ROOT_NFS
config NFS_FSCACHE
bool "Provide NFS client caching support"
- depends on NFS_FS=m && NETFS_SUPPORT || NFS_FS=y && NETFS_SUPPORT=y
+ depends on NFS_FS
+ select NETFS_SUPPORT
select FSCACHE
help
Say Y here if you want NFS data to be cached locally on disc through
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 403/443] NFSD: Encode COMPOUND operation status on page boundaries
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 402/443] nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 404/443] mailbox: tegra-hsp: Clear mailbox before using message Greg Kroah-Hartman
` (50 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, J David, Rick Macklem, NeilBrown,
Jeff Layton, Chuck Lever
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit ef3675b45bcb6c17cabbbde620c6cea52ffb21ac upstream.
J. David reports an odd corruption of a READDIR reply sent to a
FreeBSD client.
xdr_reserve_space() has to do a special trick when the @nbytes value
requests more space than there is in the current page of the XDR
buffer.
In that case, xdr_reserve_space() returns a pointer to the start of
the next page, and then the next call to xdr_reserve_space() invokes
__xdr_commit_encode() to copy enough of the data item back into the
previous page to make that data item contiguous across the page
boundary.
But we need to be careful in the case where buffer space is reserved
early for a data item whose value will be inserted into the buffer
later.
One such caller, nfsd4_encode_operation(), reserves 8 bytes in the
encoding buffer for each COMPOUND operation. However, a READDIR
result can sometimes encode file names so that there are only 4
bytes left at the end of the current XDR buffer page (though plenty
of pages are left to handle the remaining encoding tasks).
If a COMPOUND operation follows the READDIR result (say, a GETATTR),
then nfsd4_encode_operation() will reserve 8 bytes for the op number
(9) and the op status (usually NFS4_OK). In this weird case,
xdr_reserve_space() returns a pointer to byte zero of the next buffer
page, as it assumes the data item will be copied back into place (in
the previous page) on the next call to xdr_reserve_space().
nfsd4_encode_operation() writes the op num into the buffer, then
saves the next 4-byte location for the op's status code. The next
xdr_reserve_space() call is part of GETATTR encoding, so the op num
gets copied back into the previous page, but the saved location for
the op status continues to point to the wrong spot in the current
XDR buffer page because __xdr_commit_encode() moved that data item.
After GETATTR encoding is complete, nfsd4_encode_operation() writes
the op status over the first XDR data item in the GETATTR result.
The NFS4_OK status code (0) makes it look like there are zero items
in the GETATTR's attribute bitmask.
The patch description of commit 2825a7f90753 ("nfsd4: allow encoding
across page boundaries") [2014] remarks that NFSD "can't handle a
new operation starting close to the end of a page." This bug appears
to be one reason for that remark.
Reported-by: J David <j.david.lists@gmail.com>
Closes: https://lore.kernel.org/linux-nfs/3998d739-c042-46b4-8166-dbd6c5f0e804@oracle.com/T/#t
Tested-by: Rick Macklem <rmacklem@uoguelph.ca>
Reviewed-by: NeilBrown <neilb@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -5760,15 +5760,14 @@ nfsd4_encode_operation(struct nfsd4_comp
struct nfs4_stateowner *so = resp->cstate.replay_owner;
struct svc_rqst *rqstp = resp->rqstp;
const struct nfsd4_operation *opdesc = op->opdesc;
- int post_err_offset;
+ unsigned int op_status_offset;
nfsd4_enc encoder;
- __be32 *p;
- p = xdr_reserve_space(xdr, 8);
- if (!p)
+ if (xdr_stream_encode_u32(xdr, op->opnum) != XDR_UNIT)
+ goto release;
+ op_status_offset = xdr->buf->len;
+ if (!xdr_reserve_space(xdr, XDR_UNIT))
goto release;
- *p++ = cpu_to_be32(op->opnum);
- post_err_offset = xdr->buf->len;
if (op->opnum == OP_ILLEGAL)
goto status;
@@ -5809,20 +5808,21 @@ nfsd4_encode_operation(struct nfsd4_comp
* bug if we had to do this on a non-idempotent op:
*/
warn_on_nonidempotent_op(op);
- xdr_truncate_encode(xdr, post_err_offset);
+ xdr_truncate_encode(xdr, op_status_offset + XDR_UNIT);
}
if (so) {
- int len = xdr->buf->len - post_err_offset;
+ int len = xdr->buf->len - (op_status_offset + XDR_UNIT);
so->so_replay.rp_status = op->status;
so->so_replay.rp_buflen = len;
- read_bytes_from_xdr_buf(xdr->buf, post_err_offset,
+ read_bytes_from_xdr_buf(xdr->buf, op_status_offset + XDR_UNIT,
so->so_replay.rp_buf, len);
}
status:
op->status = nfsd4_map_status(op->status,
resp->cstate.minorversion);
- *p = op->status;
+ write_bytes_to_xdr_buf(xdr->buf, op_status_offset,
+ &op->status, XDR_UNIT);
release:
if (opdesc && opdesc->op_release)
opdesc->op_release(&op->u);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 404/443] mailbox: tegra-hsp: Clear mailbox before using message
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 403/443] NFSD: Encode COMPOUND operation status on page boundaries Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 405/443] mailbox: zynqmp: Remove invalid __percpu annotation in zynqmp_ipi_probe() Greg Kroah-Hartman
` (49 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pekka Pessi, Kartik Rajput,
Thierry Reding, Jassi Brar
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pekka Pessi <ppessi@nvidia.com>
commit 0b7f8328f988178b55ee11d772a6e1238c04d29d upstream.
The Tegra RCE (Camera) driver expects the mailbox to be empty before
processing the IVC messages. On RT kernel, the threads processing the
IVC messages (which are invoked after `mbox_chan_received_data()` is
called) may be on a different CPU or running with a higher priority
than the HSP interrupt handler thread. This can cause it to act on the
message before the mailbox gets cleared in the HSP interrupt handler
resulting in a loss of IVC notification.
Fix this by clearing the mailbox data register before calling
`mbox_chan_received_data()`.
Fixes: 8f585d14030d ("mailbox: tegra-hsp: Add tegra_hsp_sm_ops")
Fixes: 74c20dd0f892 ("mailbox: tegra-hsp: Add 128-bit shared mailbox support")
Cc: stable@vger.kernel.org
Signed-off-by: Pekka Pessi <ppessi@nvidia.com>
Signed-off-by: Kartik Rajput <kkartik@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mailbox/tegra-hsp.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/mailbox/tegra-hsp.c
+++ b/drivers/mailbox/tegra-hsp.c
@@ -388,7 +388,6 @@ static void tegra_hsp_sm_recv32(struct t
value = tegra_hsp_channel_readl(channel, HSP_SM_SHRD_MBOX);
value &= ~HSP_SM_SHRD_MBOX_FULL;
msg = (void *)(unsigned long)value;
- mbox_chan_received_data(channel->chan, msg);
/*
* Need to clear all bits here since some producers, such as TCU, depend
@@ -398,6 +397,8 @@ static void tegra_hsp_sm_recv32(struct t
* explicitly, so we have to make sure we cover all possible cases.
*/
tegra_hsp_channel_writel(channel, 0x0, HSP_SM_SHRD_MBOX);
+
+ mbox_chan_received_data(channel->chan, msg);
}
static const struct tegra_hsp_sm_ops tegra_hsp_sm_32bit_ops = {
@@ -433,7 +434,6 @@ static void tegra_hsp_sm_recv128(struct
value[3] = tegra_hsp_channel_readl(channel, HSP_SHRD_MBOX_TYPE1_DATA3);
msg = (void *)(unsigned long)value;
- mbox_chan_received_data(channel->chan, msg);
/*
* Clear data registers and tag.
@@ -443,6 +443,8 @@ static void tegra_hsp_sm_recv128(struct
tegra_hsp_channel_writel(channel, 0x0, HSP_SHRD_MBOX_TYPE1_DATA2);
tegra_hsp_channel_writel(channel, 0x0, HSP_SHRD_MBOX_TYPE1_DATA3);
tegra_hsp_channel_writel(channel, 0x0, HSP_SHRD_MBOX_TYPE1_TAG);
+
+ mbox_chan_received_data(channel->chan, msg);
}
static const struct tegra_hsp_sm_ops tegra_hsp_sm_128bit_ops = {
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 405/443] mailbox: zynqmp: Remove invalid __percpu annotation in zynqmp_ipi_probe()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 404/443] mailbox: tegra-hsp: Clear mailbox before using message Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 406/443] NFC: nci: Add bounds checking in nci_hci_create_pipe() Greg Kroah-Hartman
` (48 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uros Bizjak, Michal Simek,
Tanmay Shah, Jassi Brar
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <ubizjak@gmail.com>
commit 170a264d2611a0bfa96b7818730473db5e7546fc upstream.
struct zynqmp_ipi_pdata __percpu *pdata is not a per-cpu variable,
so it should not be annotated with __percpu annotation.
Remove invalid __percpu annotation to fix several
zynqmp-ipi-mailbox.c:920:15: warning: incorrect type in assignment (different address spaces)
zynqmp-ipi-mailbox.c:920:15: expected struct zynqmp_ipi_pdata [noderef] __percpu *pdata
zynqmp-ipi-mailbox.c:920:15: got void *
zynqmp-ipi-mailbox.c:927:56: warning: incorrect type in argument 3 (different address spaces)
zynqmp-ipi-mailbox.c:927:56: expected unsigned int [usertype] *out_value
zynqmp-ipi-mailbox.c:927:56: got unsigned int [noderef] __percpu *
...
and several
drivers/mailbox/zynqmp-ipi-mailbox.c:924:9: warning: dereference of noderef expression
...
sparse warnings.
There were no changes in the resulting object file.
Cc: stable@vger.kernel.org
Fixes: 6ffb1635341b ("mailbox: zynqmp: handle SGI for shared IPI")
Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
Reviewed-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Tanmay Shah <tanmay.shah@amd.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mailbox/zynqmp-ipi-mailbox.c
+++ b/drivers/mailbox/zynqmp-ipi-mailbox.c
@@ -905,7 +905,7 @@ static int zynqmp_ipi_probe(struct platf
{
struct device *dev = &pdev->dev;
struct device_node *nc, *np = pdev->dev.of_node;
- struct zynqmp_ipi_pdata __percpu *pdata;
+ struct zynqmp_ipi_pdata *pdata;
struct of_phandle_args out_irq;
struct zynqmp_ipi_mbox *mbox;
int num_mboxes, ret = -EINVAL;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 406/443] NFC: nci: Add bounds checking in nci_hci_create_pipe()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 405/443] mailbox: zynqmp: Remove invalid __percpu annotation in zynqmp_ipi_probe() Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 407/443] fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT Greg Kroah-Hartman
` (47 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Simon Horman,
Krzysztof Kozlowski, Jakub Kicinski
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit 110b43ef05342d5a11284cc8b21582b698b4ef1c upstream.
The "pipe" variable is a u8 which comes from the network. If it's more
than 127, then it results in memory corruption in the caller,
nci_hci_connect_gate().
Cc: stable@vger.kernel.org
Fixes: a1b0b9415817 ("NFC: nci: Create pipe on specific gate in nci_hci_connect_gate")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/bcf5453b-7204-4297-9c20-4d8c7dacf586@stanley.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/nci/hci.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/nfc/nci/hci.c
+++ b/net/nfc/nci/hci.c
@@ -542,6 +542,8 @@ static u8 nci_hci_create_pipe(struct nci
pr_debug("pipe created=%d\n", pipe);
+ if (pipe >= NCI_HCI_MAX_PIPES)
+ pipe = NCI_HCI_INVALID_PIPE;
return pipe;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 407/443] fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 406/443] NFC: nci: Add bounds checking in nci_hci_create_pipe() Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 408/443] i3c: master: Fix missing ret assignment in set_speed() Greg Kroah-Hartman
` (46 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit c8c9b1d2d5b4377c72a979f5a26e842a869aefc9 upstream.
The code was restructured where the function graph notrace code, that
would not trace a function and all its children is done by setting a
NOTRACE flag when the function that is not to be traced is hit.
There's a TRACE_GRAPH_NOTRACE_BIT which defines the bit in the flags and a
TRACE_GRAPH_NOTRACE which is the mask with that bit set. But the
restructuring used TRACE_GRAPH_NOTRACE_BIT when it should have used
TRACE_GRAPH_NOTRACE.
For example:
# cd /sys/kernel/tracing
# echo set_track_prepare stack_trace_save > set_graph_notrace
# echo function_graph > current_tracer
# cat trace
[..]
0) | __slab_free() {
0) | free_to_partial_list() {
0) | arch_stack_walk() {
0) | __unwind_start() {
0) 0.501 us | get_stack_info();
Where a non filter trace looks like:
# echo > set_graph_notrace
# cat trace
0) | free_to_partial_list() {
0) | set_track_prepare() {
0) | stack_trace_save() {
0) | arch_stack_walk() {
0) | __unwind_start() {
Where the filter should look like:
# cat trace
0) | free_to_partial_list() {
0) | _raw_spin_lock_irqsave() {
0) 0.350 us | preempt_count_add();
0) 0.351 us | do_raw_spin_lock();
0) 2.440 us | }
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20250208001511.535be150@batman.local.home
Fixes: b84214890a9bc ("function_graph: Move graph notrace bit to shadow stack global var")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_functions_graph.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -198,7 +198,7 @@ int trace_graph_entry(struct ftrace_grap
* returning from the function.
*/
if (ftrace_graph_notrace_addr(trace->func)) {
- *task_var |= TRACE_GRAPH_NOTRACE_BIT;
+ *task_var |= TRACE_GRAPH_NOTRACE;
/*
* Need to return 1 to have the return called
* that will clear the NOTRACE bit.
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 408/443] i3c: master: Fix missing ret assignment in set_speed()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 407/443] fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 409/443] irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so Greg Kroah-Hartman
` (45 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Wolfram Sang,
Mukesh Kumar Savaliya, Miquel Raynal, Alexandre Belloni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit b266e0d4dac00eecdfaf50ec3f708fd0c3b39637 upstream.
Fix a probe failure in the i3c master driver that occurs when no i3c
devices are connected to the bus.
The issue arises in `i3c_master_bus_init()` where the `ret` value is not
updated after calling `master->ops->set_speed()`. If no devices are
present, `ret` remains set to `I3C_ERROR_M2`, causing the code to
incorrectly proceed to `err_bus_cleanup`.
Cc: stable@vger.kernel.org
Fixes: aef79e189ba2 ("i3c: master: support to adjust first broadcast address speed")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Acked-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/r/20250108225533.915334-1-Frank.Li@nxp.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1919,7 +1919,7 @@ static int i3c_master_bus_init(struct i3
goto err_bus_cleanup;
if (master->ops->set_speed) {
- master->ops->set_speed(master, I3C_OPEN_DRAIN_NORMAL_SPEED);
+ ret = master->ops->set_speed(master, I3C_OPEN_DRAIN_NORMAL_SPEED);
if (ret)
goto err_bus_cleanup;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 409/443] irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 408/443] i3c: master: Fix missing ret assignment in set_speed() Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 410/443] mtd: onenand: Fix uninitialized retlen in do_otp_read() Greg Kroah-Hartman
` (44 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nick Chan, Thomas Gleixner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Chan <towinchenmi@gmail.com>
commit 698244bbb3bfd32ddf9a0b70a12b1c7d69056497 upstream.
The CPU PMU in Apple SoCs can be configured to fire its interrupt in one of
several ways, and since Apple A11 one of the methods is FIQ, but the check
of the configuration register fails to test explicitely for FIQ mode. It
tests whether the IMODE bitfield is zero or not and the PMCRO_IACT bit is
set. That results in false positives when the IMODE bitfield is not zero,
but does not have the mode PMCR0_IMODE_FIQ.
Only handle the PMC interrupt as a FIQ when the CPU PMU has been configured
to fire FIQs, i.e. the IMODE bitfield value is PMCR0_IMODE_FIQ and
PMCR0_IACT is set.
Fixes: c7708816c944 ("irqchip/apple-aic: Wire PMU interrupts")
Signed-off-by: Nick Chan <towinchenmi@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20250118163554.16733-1-towinchenmi@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-apple-aic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/irqchip/irq-apple-aic.c
+++ b/drivers/irqchip/irq-apple-aic.c
@@ -577,7 +577,8 @@ static void __exception_irq_entry aic_ha
AIC_FIQ_HWIRQ(AIC_TMR_EL02_VIRT));
}
- if (read_sysreg_s(SYS_IMP_APL_PMCR0_EL1) & PMCR0_IACT) {
+ if ((read_sysreg_s(SYS_IMP_APL_PMCR0_EL1) & (PMCR0_IMODE | PMCR0_IACT)) ==
+ (FIELD_PREP(PMCR0_IMODE, PMCR0_IMODE_FIQ) | PMCR0_IACT)) {
int irq;
if (cpumask_test_cpu(smp_processor_id(),
&aic_irqc->fiq_aff[AIC_CPU_PMU_P]->aff))
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 410/443] mtd: onenand: Fix uninitialized retlen in do_otp_read()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 409/443] irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 411/443] misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors Greg Kroah-Hartman
` (43 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ivan Stepchenko, Miquel Raynal
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Stepchenko <sid@itb.spb.ru>
commit 70a71f8151b9879b0950668ce3ad76263261fee0 upstream.
The function do_otp_read() does not set the output parameter *retlen,
which is expected to contain the number of bytes actually read.
As a result, in onenand_otp_walk(), the tmp_retlen variable remains
uninitialized after calling do_otp_walk() and used to change
the values of the buf, len and retlen variables.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 49dc08eeda70 ("[MTD] [OneNAND] fix numerous races")
Cc: stable@vger.kernel.org
Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/onenand/onenand_base.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mtd/nand/onenand/onenand_base.c
+++ b/drivers/mtd/nand/onenand/onenand_base.c
@@ -2923,6 +2923,7 @@ static int do_otp_read(struct mtd_info *
ret = ONENAND_IS_4KB_PAGE(this) ?
onenand_mlc_read_ops_nolock(mtd, from, &ops) :
onenand_read_ops_nolock(mtd, from, &ops);
+ *retlen = ops.retlen;
/* Exit OTP access mode */
this->command(mtd, ONENAND_CMD_RESET, 0, 0);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 411/443] misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 410/443] mtd: onenand: Fix uninitialized retlen in do_otp_read() Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 412/443] misc: fastrpc: Deregister device nodes properly in error scenarios Greg Kroah-Hartman
` (42 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vimal Agrawal, Dirk VanDerMerwe
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vimal Agrawal <vimal.agrawal@sophos.com>
commit 6d04d2b554b14ae6c428a9c60b6c85f1e5c89f68 upstream.
misc_minor_alloc was allocating id using ida for minor only in case of
MISC_DYNAMIC_MINOR but misc_minor_free was always freeing ids
using ida_free causing a mismatch and following warn:
> > WARNING: CPU: 0 PID: 159 at lib/idr.c:525 ida_free+0x3e0/0x41f
> > ida_free called for id=127 which is not allocated.
> > <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
...
> > [<60941eb4>] ida_free+0x3e0/0x41f
> > [<605ac993>] misc_minor_free+0x3e/0xbc
> > [<605acb82>] misc_deregister+0x171/0x1b3
misc_minor_alloc is changed to allocate id from ida for all minors
falling in the range of dynamic/ misc dynamic minors
Fixes: ab760791c0cf ("char: misc: Increase the maximum number of dynamic misc devices to 1048448")
Signed-off-by: Vimal Agrawal <vimal.agrawal@sophos.com>
Reviewed-by: Dirk VanDerMerwe <dirk.vandermerwe@sophos.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20241021133812.23703-1-vimal.agrawal@sophos.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/misc.c | 37 +++++++++++++++++++++++++++++--------
1 file changed, 29 insertions(+), 8 deletions(-)
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -63,16 +63,30 @@ static DEFINE_MUTEX(misc_mtx);
#define DYNAMIC_MINORS 128 /* like dynamic majors */
static DEFINE_IDA(misc_minors_ida);
-static int misc_minor_alloc(void)
+static int misc_minor_alloc(int minor)
{
- int ret;
+ int ret = 0;
- ret = ida_alloc_max(&misc_minors_ida, DYNAMIC_MINORS - 1, GFP_KERNEL);
- if (ret >= 0) {
- ret = DYNAMIC_MINORS - ret - 1;
+ if (minor == MISC_DYNAMIC_MINOR) {
+ /* allocate free id */
+ ret = ida_alloc_max(&misc_minors_ida, DYNAMIC_MINORS - 1, GFP_KERNEL);
+ if (ret >= 0) {
+ ret = DYNAMIC_MINORS - ret - 1;
+ } else {
+ ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1,
+ MINORMASK, GFP_KERNEL);
+ }
} else {
- ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1,
- MINORMASK, GFP_KERNEL);
+ /* specific minor, check if it is in dynamic or misc dynamic range */
+ if (minor < DYNAMIC_MINORS) {
+ minor = DYNAMIC_MINORS - minor - 1;
+ ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL);
+ } else if (minor > MISC_DYNAMIC_MINOR) {
+ ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL);
+ } else {
+ /* case of non-dynamic minors, no need to allocate id */
+ ret = 0;
+ }
}
return ret;
}
@@ -219,7 +233,7 @@ int misc_register(struct miscdevice *mis
mutex_lock(&misc_mtx);
if (is_dynamic) {
- int i = misc_minor_alloc();
+ int i = misc_minor_alloc(misc->minor);
if (i < 0) {
err = -EBUSY;
@@ -228,6 +242,7 @@ int misc_register(struct miscdevice *mis
misc->minor = i;
} else {
struct miscdevice *c;
+ int i;
list_for_each_entry(c, &misc_list, list) {
if (c->minor == misc->minor) {
@@ -235,6 +250,12 @@ int misc_register(struct miscdevice *mis
goto out;
}
}
+
+ i = misc_minor_alloc(misc->minor);
+ if (i < 0) {
+ err = -EBUSY;
+ goto out;
+ }
}
dev = MKDEV(MISC_MAJOR, misc->minor);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 412/443] misc: fastrpc: Deregister device nodes properly in error scenarios
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 411/443] misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 413/443] misc: fastrpc: Fix registered buffer page address Greg Kroah-Hartman
` (41 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Anandu Krishnan E,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anandu Krishnan E <quic_anane@quicinc.com>
commit 637c20002dc8c347001292664055bfbf56544ec6 upstream.
During fastrpc_rpmsg_probe, if secure device node registration
succeeds but non-secure device node registration fails, the secure
device node deregister is not called during error cleanup. Add proper
exit paths to ensure proper cleanup in case of error.
Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support")
Cc: stable@kernel.org
Signed-off-by: Anandu Krishnan E <quic_anane@quicinc.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20250110134239.123603-2-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -2344,7 +2344,7 @@ static int fastrpc_rpmsg_probe(struct rp
err = fastrpc_device_register(rdev, data, false, domains[domain_id]);
if (err)
- goto fdev_error;
+ goto populate_error;
break;
default:
err = -EINVAL;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 413/443] misc: fastrpc: Fix registered buffer page address
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 412/443] misc: fastrpc: Deregister device nodes properly in error scenarios Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 414/443] misc: fastrpc: Fix copy buffer page size Greg Kroah-Hartman
` (40 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ekansh Gupta,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ekansh Gupta <quic_ekangupt@quicinc.com>
commit 6ca4ea1f88a06a04ed7b2c9c6bf9f00833b68214 upstream.
For registered buffers, fastrpc driver sends the buffer information
to remote subsystem. There is a problem with current implementation
where the page address is being sent with an offset leading to
improper buffer address on DSP. This is leads to functional failures
as DSP expects base address in page information and extracts offset
information from remote arguments. Mask the offset and pass the base
page address to DSP.
This issue is observed is a corner case when some buffer which is registered
with fastrpc framework is passed with some offset by user and then the DSP
implementation tried to read the data. As DSP expects base address and takes
care of offsetting with remote arguments, passing an offsetted address will
result in some unexpected data read in DSP.
All generic usecases usually pass the buffer as it is hence is problem is
not usually observed. If someone tries to pass offsetted buffer and then
tries to compare data at HLOS and DSP end, then the ambiguity will be observed.
Fixes: 80f3afd72bd4 ("misc: fastrpc: consider address offset before sending to DSP")
Cc: stable@kernel.org
Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20250110134239.123603-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -992,7 +992,7 @@ static int fastrpc_get_args(u32 kernel,
mmap_read_lock(current->mm);
vma = find_vma(current->mm, ctx->args[i].ptr);
if (vma)
- pages[i].addr += ctx->args[i].ptr -
+ pages[i].addr += (ctx->args[i].ptr & PAGE_MASK) -
vma->vm_start;
mmap_read_unlock(current->mm);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 414/443] misc: fastrpc: Fix copy buffer page size
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 413/443] misc: fastrpc: Fix registered buffer page address Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 415/443] net/ncsi: wait for the last response to Deselect Package before configuring channel Greg Kroah-Hartman
` (39 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ekansh Gupta,
Srinivas Kandagatla
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ekansh Gupta <quic_ekangupt@quicinc.com>
commit e966eae72762ecfdbdb82627e2cda48845b9dd66 upstream.
For non-registered buffer, fastrpc driver copies the buffer and
pass it to the remote subsystem. There is a problem with current
implementation of page size calculation which is not considering
the offset in the calculation. This might lead to passing of
improper and out-of-bounds page size which could result in
memory issue. Calculate page start and page end using the offset
adjusted address instead of absolute address.
Fixes: 02b45b47fbe8 ("misc: fastrpc: fix remote page size calculation")
Cc: stable@kernel.org
Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20250110134239.123603-4-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1019,8 +1019,8 @@ static int fastrpc_get_args(u32 kernel,
(pkt_size - rlen);
pages[i].addr = pages[i].addr & PAGE_MASK;
- pg_start = (args & PAGE_MASK) >> PAGE_SHIFT;
- pg_end = ((args + len - 1) & PAGE_MASK) >> PAGE_SHIFT;
+ pg_start = (rpra[i].buf.pv & PAGE_MASK) >> PAGE_SHIFT;
+ pg_end = ((rpra[i].buf.pv + len - 1) & PAGE_MASK) >> PAGE_SHIFT;
pages[i].size = (pg_end - pg_start + 1) * PAGE_SIZE;
args = args + mlen;
rlen -= mlen;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 415/443] net/ncsi: wait for the last response to Deselect Package before configuring channel
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 414/443] misc: fastrpc: Fix copy buffer page size Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 416/443] net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset Greg Kroah-Hartman
` (38 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Fertser, Jakub Kicinski
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Fertser <fercerpav@gmail.com>
commit 6bb194d036c6e1b329dcdff459338cdd9a54802a upstream.
The NCSI state machine as it's currently implemented assumes that
transition to the next logical state is performed either explicitly by
calling `schedule_work(&ndp->work)` to re-queue itself or implicitly
after processing the predefined (ndp->pending_req_num) number of
replies. Thus to avoid the configuration FSM from advancing prematurely
and getting out of sync with the process it's essential to not skip
waiting for a reply.
This patch makes the code wait for reception of the Deselect Package
response for the last package probed before proceeding to channel
configuration.
Thanks go to Potin Lai and Cosmo Chou for the initial investigation and
testing.
Fixes: 8e13f70be05e ("net/ncsi: Probe single packages to avoid conflict")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Link: https://patch.msgid.link/20250116152900.8656-1-fercerpav@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ncsi/ncsi-manage.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -1385,6 +1385,12 @@ static void ncsi_probe_channel(struct nc
nd->state = ncsi_dev_state_probe_package;
break;
case ncsi_dev_state_probe_package:
+ if (ndp->package_probe_id >= 8) {
+ /* Last package probed, finishing */
+ ndp->flags |= NCSI_DEV_PROBED;
+ break;
+ }
+
ndp->pending_req_num = 1;
nca.type = NCSI_PKT_CMD_SP;
@@ -1501,13 +1507,8 @@ static void ncsi_probe_channel(struct nc
if (ret)
goto error;
- /* Probe next package */
+ /* Probe next package after receiving response */
ndp->package_probe_id++;
- if (ndp->package_probe_id >= 8) {
- /* Probe finished */
- ndp->flags |= NCSI_DEV_PROBED;
- break;
- }
nd->state = ncsi_dev_state_probe_package;
ndp->active_package = NULL;
break;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 416/443] net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 415/443] net/ncsi: wait for the last response to Deselect Package before configuring channel Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 417/443] maple_tree: simplify split calculation Greg Kroah-Hartman
` (37 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Milos Reljin, Andrew Lunn,
Jakub Kicinski
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milos Reljin <milos_reljin@outlook.com>
commit bd1bbab717608757cccbbe08b0d46e6c3ed0ced5 upstream.
In application note (AN13663) for TJA1120, on page 30, there's a figure
with average PHY startup timing values following software reset.
The time it takes for SMI to become operational after software reset
ranges roughly from 500 us to 1500 us.
This commit adds 2000 us delay after MDIO write which triggers software
reset. Without this delay, soft_reset function returns an error and
prevents successful PHY init.
Cc: stable@vger.kernel.org
Fixes: b050f2f15e04 ("phy: nxp-c45: add driver for tja1103")
Signed-off-by: Milos Reljin <milos_reljin@outlook.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/AM8P250MB0124D258E5A71041AF2CC322E1E32@AM8P250MB0124.EURP250.PROD.OUTLOOK.COM
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/nxp-c45-tja11xx.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/phy/nxp-c45-tja11xx.c
+++ b/drivers/net/phy/nxp-c45-tja11xx.c
@@ -1297,6 +1297,8 @@ static int nxp_c45_soft_reset(struct phy
if (ret)
return ret;
+ usleep_range(2000, 2050);
+
return phy_read_mmd_poll_timeout(phydev, MDIO_MMD_VEND1,
VEND1_DEVICE_CONTROL, ret,
!(ret & DEVICE_CONTROL_RESET), 20000,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 417/443] maple_tree: simplify split calculation
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 416/443] net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 418/443] scripts/gdb: fix aarch64 userspace detection in get_current_task Greg Kroah-Hartman
` (36 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Yang, Liam R. Howlett,
Sidhartha Kumar, Lorenzo Stoakes, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <richard.weiyang@gmail.com>
commit 4f6a6bed0bfef4b966f076f33eb4f5547226056a upstream.
Patch series "simplify split calculation", v3.
This patch (of 3):
The current calculation for splitting nodes tries to enforce a minimum
span on the leaf nodes. This code is complex and never worked correctly
to begin with, due to the min value being passed as 0 for all leaves.
The calculation should just split the data as equally as possible
between the new nodes. Note that b_end will be one more than the data,
so the left side is still favoured in the calculation.
The current code may also lead to a deficient node by not leaving enough
data for the right side of the split. This issue is also addressed with
the split calculation change.
[Liam.Howlett@Oracle.com: rephrase the change log]
Link: https://lkml.kernel.org/r/20241113031616.10530-1-richard.weiyang@gmail.com
Link: https://lkml.kernel.org/r/20241113031616.10530-2-richard.weiyang@gmail.com
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Sidhartha Kumar <sidhartha.kumar@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/maple_tree.c | 23 ++++++-----------------
1 file changed, 6 insertions(+), 17 deletions(-)
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -1863,11 +1863,11 @@ static inline int mab_no_null_split(stru
* Return: The first split location. The middle split is set in @mid_split.
*/
static inline int mab_calc_split(struct ma_state *mas,
- struct maple_big_node *bn, unsigned char *mid_split, unsigned long min)
+ struct maple_big_node *bn, unsigned char *mid_split)
{
unsigned char b_end = bn->b_end;
int split = b_end / 2; /* Assume equal split. */
- unsigned char slot_min, slot_count = mt_slots[bn->type];
+ unsigned char slot_count = mt_slots[bn->type];
/*
* To support gap tracking, all NULL entries are kept together and a node cannot
@@ -1900,18 +1900,7 @@ static inline int mab_calc_split(struct
split = b_end / 3;
*mid_split = split * 2;
} else {
- slot_min = mt_min_slots[bn->type];
-
*mid_split = 0;
- /*
- * Avoid having a range less than the slot count unless it
- * causes one node to be deficient.
- * NOTE: mt_min_slots is 1 based, b_end and split are zero.
- */
- while ((split < slot_count - 1) &&
- ((bn->pivot[split] - min) < slot_count - 1) &&
- (b_end - split > slot_min))
- split++;
}
/* Avoid ending a node on a NULL entry */
@@ -2377,7 +2366,7 @@ static inline struct maple_enode
static inline unsigned char mas_mab_to_node(struct ma_state *mas,
struct maple_big_node *b_node, struct maple_enode **left,
struct maple_enode **right, struct maple_enode **middle,
- unsigned char *mid_split, unsigned long min)
+ unsigned char *mid_split)
{
unsigned char split = 0;
unsigned char slot_count = mt_slots[b_node->type];
@@ -2390,7 +2379,7 @@ static inline unsigned char mas_mab_to_n
if (b_node->b_end < slot_count) {
split = b_node->b_end;
} else {
- split = mab_calc_split(mas, b_node, mid_split, min);
+ split = mab_calc_split(mas, b_node, mid_split);
*right = mas_new_ma_node(mas, b_node);
}
@@ -2877,7 +2866,7 @@ static void mas_spanning_rebalance(struc
mast->bn->b_end--;
mast->bn->type = mte_node_type(mast->orig_l->node);
split = mas_mab_to_node(mas, mast->bn, &left, &right, &middle,
- &mid_split, mast->orig_l->min);
+ &mid_split);
mast_set_split_parents(mast, left, middle, right, split,
mid_split);
mast_cp_to_nodes(mast, left, middle, right, split, mid_split);
@@ -3365,7 +3354,7 @@ static void mas_split(struct ma_state *m
if (mas_push_data(mas, height, &mast, false))
break;
- split = mab_calc_split(mas, b_node, &mid_split, prev_l_mas.min);
+ split = mab_calc_split(mas, b_node, &mid_split);
mast_split_data(&mast, mas, split);
/*
* Usually correct, mab_mas_cp in the above call overwrites
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 418/443] scripts/gdb: fix aarch64 userspace detection in get_current_task
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 417/443] maple_tree: simplify split calculation Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 419/443] tracing/osnoise: Fix resetting of tracepoints Greg Kroah-Hartman
` (35 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kiszka, Barry Song,
Kieran Bingham, Andrew Morton
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kiszka <jan.kiszka@siemens.com>
commit 4ebc417ef9cb34010a71270421fe320ec5d88aa2 upstream.
At least recent gdb releases (seen with 14.2) return SP_EL0 as signed long
which lets the right-shift always return 0.
Link: https://lkml.kernel.org/r/dcd2fabc-9131-4b48-8419-6444e2d67454@siemens.com
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Kieran Bingham <kbingham@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/gdb/linux/cpus.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/scripts/gdb/linux/cpus.py
+++ b/scripts/gdb/linux/cpus.py
@@ -167,7 +167,7 @@ def get_current_task(cpu):
var_ptr = gdb.parse_and_eval("&pcpu_hot.current_task")
return per_cpu(var_ptr, cpu).dereference()
elif utils.is_target_arch("aarch64"):
- current_task_addr = gdb.parse_and_eval("$SP_EL0")
+ current_task_addr = gdb.parse_and_eval("(unsigned long)$SP_EL0")
if (current_task_addr >> 63) != 0:
current_task = current_task_addr.cast(task_ptr_type)
return current_task.dereference()
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 419/443] tracing/osnoise: Fix resetting of tracepoints
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 418/443] scripts/gdb: fix aarch64 userspace detection in get_current_task Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 420/443] rtla/osnoise: Distinguish missing workload option Greg Kroah-Hartman
` (34 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mathieu Desnoyers,
Tomas Glozar, Gabriele Monaco, Luis Goncalves, John Kacur,
Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit e3ff4245928f948f3eb2e852aa350b870421c358 upstream.
If a timerlat tracer is started with the osnoise option OSNOISE_WORKLOAD
disabled, but then that option is enabled and timerlat is removed, the
tracepoints that were enabled on timerlat registration do not get
disabled. If the option is disabled again and timelat is started, then it
triggers a warning in the tracepoint code due to registering the
tracepoint again without ever disabling it.
Do not use the same user space defined options to know to disable the
tracepoints when timerlat is removed. Instead, set a global flag when it
is enabled and use that flag to know to disable the events.
~# echo NO_OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options
~# echo timerlat > /sys/kernel/tracing/current_tracer
~# echo OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options
~# echo nop > /sys/kernel/tracing/current_tracer
~# echo NO_OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options
~# echo timerlat > /sys/kernel/tracing/current_tracer
Triggers:
------------[ cut here ]------------
WARNING: CPU: 6 PID: 1337 at kernel/tracepoint.c:294 tracepoint_add_func+0x3b6/0x3f0
Modules linked in:
CPU: 6 UID: 0 PID: 1337 Comm: rtla Not tainted 6.13.0-rc4-test-00018-ga867c441128e-dirty #73
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:tracepoint_add_func+0x3b6/0x3f0
Code: 48 8b 53 28 48 8b 73 20 4c 89 04 24 e8 23 59 11 00 4c 8b 04 24 e9 36 fe ff ff 0f 0b b8 ea ff ff ff 45 84 e4 0f 84 68 fe ff ff <0f> 0b e9 61 fe ff ff 48 8b 7b 18 48 85 ff 0f 84 4f ff ff ff 49 8b
RSP: 0018:ffffb9b003a87ca0 EFLAGS: 00010202
RAX: 00000000ffffffef RBX: ffffffff92f30860 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff9bf59e91ccd0 RDI: ffffffff913b6410
RBP: 000000000000000a R08: 00000000000005c7 R09: 0000000000000002
R10: ffffb9b003a87ce0 R11: 0000000000000002 R12: 0000000000000001
R13: ffffb9b003a87ce0 R14: ffffffffffffffef R15: 0000000000000008
FS: 00007fce81209240(0000) GS:ffff9bf6fdd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e99b728000 CR3: 00000001277c0002 CR4: 0000000000172ef0
Call Trace:
<TASK>
? __warn.cold+0xb7/0x14d
? tracepoint_add_func+0x3b6/0x3f0
? report_bug+0xea/0x170
? handle_bug+0x58/0x90
? exc_invalid_op+0x17/0x70
? asm_exc_invalid_op+0x1a/0x20
? __pfx_trace_sched_migrate_callback+0x10/0x10
? tracepoint_add_func+0x3b6/0x3f0
? __pfx_trace_sched_migrate_callback+0x10/0x10
? __pfx_trace_sched_migrate_callback+0x10/0x10
tracepoint_probe_register+0x78/0xb0
? __pfx_trace_sched_migrate_callback+0x10/0x10
osnoise_workload_start+0x2b5/0x370
timerlat_tracer_init+0x76/0x1b0
tracing_set_tracer+0x244/0x400
tracing_set_trace_write+0xa0/0xe0
vfs_write+0xfc/0x570
? do_sys_openat2+0x9c/0xe0
ksys_write+0x72/0xf0
do_syscall_64+0x79/0x1c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Tomas Glozar <tglozar@redhat.com>
Cc: Gabriele Monaco <gmonaco@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Cc: John Kacur <jkacur@redhat.com>
Link: https://lore.kernel.org/20250123204159.4450c88e@gandalf.local.home
Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_osnoise.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--- a/kernel/trace/trace_osnoise.c
+++ b/kernel/trace/trace_osnoise.c
@@ -1229,6 +1229,8 @@ static void trace_sched_migrate_callback
}
}
+static bool monitor_enabled;
+
static int register_migration_monitor(void)
{
int ret = 0;
@@ -1237,16 +1239,25 @@ static int register_migration_monitor(vo
* Timerlat thread migration check is only required when running timerlat in user-space.
* Thus, enable callback only if timerlat is set with no workload.
*/
- if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options))
+ if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) {
+ if (WARN_ON_ONCE(monitor_enabled))
+ return 0;
+
ret = register_trace_sched_migrate_task(trace_sched_migrate_callback, NULL);
+ if (!ret)
+ monitor_enabled = true;
+ }
return ret;
}
static void unregister_migration_monitor(void)
{
- if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options))
- unregister_trace_sched_migrate_task(trace_sched_migrate_callback, NULL);
+ if (!monitor_enabled)
+ return;
+
+ unregister_trace_sched_migrate_task(trace_sched_migrate_callback, NULL);
+ monitor_enabled = false;
}
#else
static int register_migration_monitor(void)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 420/443] rtla/osnoise: Distinguish missing workload option
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 419/443] tracing/osnoise: Fix resetting of tracepoints Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 421/443] rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads Greg Kroah-Hartman
` (33 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Kacur, Luis Goncalves,
Tomas Glozar, Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
commit 80d3ba1cf51bfbbb3b098434f2b2c95cd7c0ae5c upstream.
osnoise_set_workload returns -1 for both missing OSNOISE_WORKLOAD option
and failure in setting the option.
Return -1 for missing and -2 for failure to distinguish them.
Cc: stable@vger.kernel.org
Cc: John Kacur <jkacur@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Link: https://lore.kernel.org/20250107144823.239782-2-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/tracing/rtla/src/osnoise.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/tracing/rtla/src/osnoise.c
+++ b/tools/tracing/rtla/src/osnoise.c
@@ -867,7 +867,7 @@ int osnoise_set_workload(struct osnoise_
retval = osnoise_options_set_option("OSNOISE_WORKLOAD", onoff);
if (retval < 0)
- return -1;
+ return -2;
context->opt_workload = onoff;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 421/443] rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 420/443] rtla/osnoise: Distinguish missing workload option Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 422/443] rtla/timerlat_top: " Greg Kroah-Hartman
` (32 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Kacur, Luis Goncalves,
Tomas Glozar, Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
commit d8d866171a414ed88bd0d720864095fd75461134 upstream.
When using rtla timerlat with userspace threads (-u or -U), rtla
disables the OSNOISE_WORKLOAD option in
/sys/kernel/tracing/osnoise/options. This option is not re-enabled in a
subsequent run with kernel-space threads, leading to rtla collecting no
results if the previous run exited abnormally:
$ rtla timerlat hist -u
^\Quit (core dumped)
$ rtla timerlat hist -k -d 1s
Index
over:
count:
min:
avg:
max:
ALL: IRQ Thr Usr
count: 0 0 0
min: - - -
avg: - - -
max: - - -
The issue persists until OSNOISE_WORKLOAD is set manually by running:
$ echo OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options
Set OSNOISE_WORKLOAD when running rtla with kernel-space threads if
available to fix the issue.
Cc: stable@vger.kernel.org
Cc: John Kacur <jkacur@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Link: https://lore.kernel.org/20250107144823.239782-3-tglozar@redhat.com
Fixes: ed774f7481fa ("rtla/timerlat_hist: Add timerlat user-space support")
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/tracing/rtla/src/timerlat_hist.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/tools/tracing/rtla/src/timerlat_hist.c
+++ b/tools/tracing/rtla/src/timerlat_hist.c
@@ -1100,12 +1100,15 @@ timerlat_hist_apply_config(struct osnois
}
}
- if (params->user_hist) {
- retval = osnoise_set_workload(tool->context, 0);
- if (retval) {
- err_msg("Failed to set OSNOISE_WORKLOAD option\n");
- goto out_err;
- }
+ /*
+ * Set workload according to type of thread if the kernel supports it.
+ * On kernels without support, user threads will have already failed
+ * on missing timerlat_fd, and kernel threads do not need it.
+ */
+ retval = osnoise_set_workload(tool->context, params->kernel_workload);
+ if (retval < -1) {
+ err_msg("Failed to set OSNOISE_WORKLOAD option\n");
+ goto out_err;
}
return 0;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 422/443] rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 421/443] rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 423/443] rtla: Add trace_instance_stop Greg Kroah-Hartman
` (31 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Kacur, Luis Goncalves,
Tomas Glozar, Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
commit 217f0b1e990e30a1f06f6d531fdb4530f4788d48 upstream.
When using rtla timerlat with userspace threads (-u or -U), rtla
disables the OSNOISE_WORKLOAD option in
/sys/kernel/tracing/osnoise/options. This option is not re-enabled in a
subsequent run with kernel-space threads, leading to rtla collecting no
results if the previous run exited abnormally:
$ rtla timerlat top -u
^\Quit (core dumped)
$ rtla timerlat top -k -d 1s
Timer Latency
0 00:00:01 | IRQ Timer Latency (us) | Thread Timer Latency (us)
CPU COUNT | cur min avg max | cur min avg max
The issue persists until OSNOISE_WORKLOAD is set manually by running:
$ echo OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options
Set OSNOISE_WORKLOAD when running rtla with kernel-space threads if
available to fix the issue.
Cc: stable@vger.kernel.org
Cc: John Kacur <jkacur@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Link: https://lore.kernel.org/20250107144823.239782-4-tglozar@redhat.com
Fixes: cdca4f4e5e8e ("rtla/timerlat_top: Add timerlat user-space support")
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/tracing/rtla/src/timerlat_top.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/tools/tracing/rtla/src/timerlat_top.c
+++ b/tools/tracing/rtla/src/timerlat_top.c
@@ -851,12 +851,15 @@ timerlat_top_apply_config(struct osnoise
}
}
- if (params->user_top) {
- retval = osnoise_set_workload(top->context, 0);
- if (retval) {
- err_msg("Failed to set OSNOISE_WORKLOAD option\n");
- goto out_err;
- }
+ /*
+ * Set workload according to type of thread if the kernel supports it.
+ * On kernels without support, user threads will have already failed
+ * on missing timerlat_fd, and kernel threads do not need it.
+ */
+ retval = osnoise_set_workload(top->context, params->kernel_workload);
+ if (retval < -1) {
+ err_msg("Failed to set OSNOISE_WORKLOAD option\n");
+ goto out_err;
}
if (isatty(STDOUT_FILENO) && !params->quiet)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 423/443] rtla: Add trace_instance_stop
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 422/443] rtla/timerlat_top: " Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 424/443] rtla/timerlat_hist: Stop timerlat tracer on signal Greg Kroah-Hartman
` (30 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Kacur, Luis Goncalves,
Gabriele Monaco, Tomas Glozar, Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
commit e879b5dcf8d044f3865a32d95cc5b213f314c54f upstream.
Support not only turning trace on for the timerlat tracer, but also
turning it off.
This will be used in subsequent patches to stop the timerlat tracer
without also wiping the trace buffer.
Cc: stable@vger.kernel.org
Cc: John Kacur <jkacur@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Cc: Gabriele Monaco <gmonaco@redhat.com>
Link: https://lore.kernel.org/20250116144931.649593-2-tglozar@redhat.com
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/tracing/rtla/src/trace.c | 8 ++++++++
tools/tracing/rtla/src/trace.h | 1 +
2 files changed, 9 insertions(+)
--- a/tools/tracing/rtla/src/trace.c
+++ b/tools/tracing/rtla/src/trace.c
@@ -197,6 +197,14 @@ int trace_instance_start(struct trace_in
}
/*
+ * trace_instance_stop - stop tracing a given rtla instance
+ */
+int trace_instance_stop(struct trace_instance *trace)
+{
+ return tracefs_trace_off(trace->inst);
+}
+
+/*
* trace_events_free - free a list of trace events
*/
static void trace_events_free(struct trace_events *events)
--- a/tools/tracing/rtla/src/trace.h
+++ b/tools/tracing/rtla/src/trace.h
@@ -21,6 +21,7 @@ struct trace_instance {
int trace_instance_init(struct trace_instance *trace, char *tool_name);
int trace_instance_start(struct trace_instance *trace);
+int trace_instance_stop(struct trace_instance *trace);
void trace_instance_destroy(struct trace_instance *trace);
struct trace_seq *get_trace_seq(void);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 424/443] rtla/timerlat_hist: Stop timerlat tracer on signal
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 423/443] rtla: Add trace_instance_stop Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 425/443] rtla/timerlat_top: " Greg Kroah-Hartman
` (29 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Kacur, Luis Goncalves,
Gabriele Monaco, Tomas Glozar, Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
commit c73cab9dbed04d8f65ca69177b4b21ed3e09dfa7 upstream.
Currently, when either SIGINT from the user or SIGALRM from the duration
timer is caught by rtla-timerlat, stop_tracing is set to break out of
the main loop. This is not sufficient for cases where the timerlat
tracer is producing more data than rtla can consume, since in that case,
rtla is looping indefinitely inside tracefs_iterate_raw_events, never
reaches the check of stop_tracing and hangs.
In addition to setting stop_tracing, also stop the timerlat tracer on
received signal (SIGINT or SIGALRM). This will stop new samples so that
the existing samples may be processed and tracefs_iterate_raw_events
eventually exits.
Cc: stable@vger.kernel.org
Cc: John Kacur <jkacur@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Cc: Gabriele Monaco <gmonaco@redhat.com>
Link: https://lore.kernel.org/20250116144931.649593-3-tglozar@redhat.com
Fixes: 1eeb6328e8b3 ("rtla/timerlat: Add timerlat hist mode")
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/tracing/rtla/src/timerlat_hist.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/tools/tracing/rtla/src/timerlat_hist.c
+++ b/tools/tracing/rtla/src/timerlat_hist.c
@@ -1149,9 +1149,12 @@ out_err:
}
static int stop_tracing;
+static struct trace_instance *hist_inst = NULL;
static void stop_hist(int sig)
{
stop_tracing = 1;
+ if (hist_inst)
+ trace_instance_stop(hist_inst);
}
/*
@@ -1198,6 +1201,12 @@ int timerlat_hist_main(int argc, char *a
}
trace = &tool->trace;
+ /*
+ * Save trace instance into global variable so that SIGINT can stop
+ * the timerlat tracer.
+ * Otherwise, rtla could loop indefinitely when overloaded.
+ */
+ hist_inst = trace;
retval = enable_timerlat(trace);
if (retval) {
@@ -1366,7 +1375,7 @@ int timerlat_hist_main(int argc, char *a
return_value = 0;
- if (trace_is_off(&tool->trace, &record->trace)) {
+ if (trace_is_off(&tool->trace, &record->trace) && !stop_tracing) {
printf("rtla timerlat hit stop tracing\n");
if (!params->no_aa)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 425/443] rtla/timerlat_top: Stop timerlat tracer on signal
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 424/443] rtla/timerlat_hist: Stop timerlat tracer on signal Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 426/443] pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails Greg Kroah-Hartman
` (28 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Kacur, Luis Goncalves,
Gabriele Monaco, Tomas Glozar, Steven Rostedt (Google)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <tglozar@redhat.com>
commit a4dfce7559d75430c464294ddee554be2a413c4a upstream.
Currently, when either SIGINT from the user or SIGALRM from the duration
timer is caught by rtla-timerlat, stop_tracing is set to break out of
the main loop. This is not sufficient for cases where the timerlat
tracer is producing more data than rtla can consume, since in that case,
rtla is looping indefinitely inside tracefs_iterate_raw_events, never
reaches the check of stop_tracing and hangs.
In addition to setting stop_tracing, also stop the timerlat tracer on
received signal (SIGINT or SIGALRM). This will stop new samples so that
the existing samples may be processed and tracefs_iterate_raw_events
eventually exits.
Cc: stable@vger.kernel.org
Cc: John Kacur <jkacur@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Cc: Gabriele Monaco <gmonaco@redhat.com>
Link: https://lore.kernel.org/20250116144931.649593-4-tglozar@redhat.com
Fixes: a828cd18bc4a ("rtla: Add timerlat tool and timelart top mode")
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/tracing/rtla/src/timerlat_top.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/tools/tracing/rtla/src/timerlat_top.c
+++ b/tools/tracing/rtla/src/timerlat_top.c
@@ -903,9 +903,12 @@ out_err:
}
static int stop_tracing;
+static struct trace_instance *top_inst = NULL;
static void stop_top(int sig)
{
stop_tracing = 1;
+ if (top_inst)
+ trace_instance_stop(top_inst);
}
/*
@@ -953,6 +956,13 @@ int timerlat_top_main(int argc, char *ar
}
trace = &top->trace;
+ /*
+ * Save trace instance into global variable so that SIGINT can stop
+ * the timerlat tracer.
+ * Otherwise, rtla could loop indefinitely when overloaded.
+ */
+ top_inst = trace;
+
retval = enable_timerlat(trace);
if (retval) {
@@ -1134,7 +1144,7 @@ int timerlat_top_main(int argc, char *ar
return_value = 0;
- if (trace_is_off(&top->trace, &record->trace)) {
+ if (trace_is_off(&top->trace, &record->trace) && !stop_tracing) {
printf("rtla timerlat hit stop tracing\n");
if (!params->no_aa)
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 426/443] pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 425/443] rtla/timerlat_top: " Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 427/443] pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E Greg Kroah-Hartman
` (27 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Javier Carrasco, Krzysztof Kozlowski
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit 459915f55509f4bfd6076daa1428e28490ddee3b upstream.
Commit 50ebd19e3585 ("pinctrl: samsung: drop pin banks references on
error paths") fixed the pin bank references on the error paths of the
probe function, but there is still an error path where this is not done.
If samsung_pinctrl_get_soc_data() does not fail, the child references
will have acquired, and they will need to be released in the error path
of platform_get_irq_optional(), as it is done in the following error
paths within the probe function.
Replace the direct return in the error path with a goto instruction to
the cleanup function.
Cc: stable@vger.kernel.org
Fixes: a382d568f144 ("pinctrl: samsung: Use platform_get_irq_optional() to get the interrupt")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://lore.kernel.org/r/20241106-samsung-pinctrl-put-v1-1-de854e26dd03@gmail.com
[krzysztof: change Fixes SHA to point to commit introducing the return
leading to OF node leak]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -1272,7 +1272,7 @@ static int samsung_pinctrl_probe(struct
ret = platform_get_irq_optional(pdev, 0);
if (ret < 0 && ret != -ENXIO)
- return ret;
+ goto err_put_banks;
if (ret > 0)
drvdata->irq = ret;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 427/443] pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 426/443] pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 428/443] ptp: Ensure info->enable callback is always set Greg Kroah-Hartman
` (26 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hien Huynh, Lad Prabhakar,
Geert Uytterhoeven
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
commit accabfaae0940f9427c782bfee7340ce4c15151c upstream.
The PFC_MASK value for the PFC_mx registers is currently hardcoded to
0x07, which is correct for SoCs in the RZ/G2L family, but insufficient
for RZ/V2H and RZ/G3E, where the mask value should be 0x0f. This
discrepancy causes incorrect PFC register configuration on RZ/V2H and
RZ/G3E SoCs.
On RZ/G2L, the PFC_mx bitfields are also 4 bits wide, with bit 4 marked
as reserved. The reserved bits are documented to read as zero and be
ignored when written. Updating the PFC_MASK definition from 0x07 to
0x0f ensures compatibility with both SoC families while maintaining
correct behavior on RZ/G2L.
Fixes: 9bd95ac86e70 ("pinctrl: renesas: rzg2l: Add support for RZ/V2H SoC")
Cc: stable@vger.kernel.org
Reported-by: Hien Huynh <hien.huynh.px@renesas.com>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250110221045.594596-1-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
@@ -157,7 +157,7 @@
#define PWPR_REGWE_B BIT(5) /* OEN Register Write Enable, known only in RZ/V2H(P) */
#define PM_MASK 0x03
-#define PFC_MASK 0x07
+#define PFC_MASK 0x0f
#define IEN_MASK 0x01
#define IOLH_MASK 0x03
#define SR_MASK 0x01
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 428/443] ptp: Ensure info->enable callback is always set
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 427/443] pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 429/443] RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error Greg Kroah-Hartman
` (25 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Richard Cochran, Michal Swiatkowski, Jakub Kicinski
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <linux@weissschuh.net>
commit fd53aa40e65f518453115b6f56183b0c201db26b upstream.
The ioctl and sysfs handlers unconditionally call the ->enable callback.
Not all drivers implement that callback, leading to NULL dereferences.
Example of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c.
Instead use a dummy callback if no better was specified by the driver.
Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Link: https://patch.msgid.link/20250123-ptp-enable-v1-1-b015834d3a47@weissschuh.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ptp/ptp_clock.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -217,6 +217,11 @@ static int ptp_getcycles64(struct ptp_cl
return info->gettime64(info, ts);
}
+static int ptp_enable(struct ptp_clock_info *ptp, struct ptp_clock_request *request, int on)
+{
+ return -EOPNOTSUPP;
+}
+
static void ptp_aux_kworker(struct kthread_work *work)
{
struct ptp_clock *ptp = container_of(work, struct ptp_clock,
@@ -294,6 +299,9 @@ struct ptp_clock *ptp_clock_register(str
ptp->info->getcrosscycles = ptp->info->getcrosststamp;
}
+ if (!ptp->info->enable)
+ ptp->info->enable = ptp_enable;
+
if (ptp->info->do_aux_work) {
kthread_init_delayed_work(&ptp->aux_work, ptp_aux_kworker);
ptp->kworker = kthread_create_worker(0, "ptp%d", ptp->index);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 429/443] RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 428/443] ptp: Ensure info->enable callback is always set Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 430/443] rtc: zynqmp: Fix optional clock name property Greg Kroah-Hartman
` (24 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yishai Hadas, Artemy Kovalyov,
Leon Romanovsky, Jason Gunthorpe
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yishai Hadas <yishaih@nvidia.com>
commit abb604a1a9c87255c7a6f3b784410a9707baf467 upstream.
This patch addresses a race condition for an ODP MR that can result in a
CQE with an error on the UMR QP.
During the __mlx5_ib_dereg_mr() flow, the following sequence of calls
occurs:
mlx5_revoke_mr()
mlx5r_umr_revoke_mr()
mlx5r_umr_post_send_wait()
At this point, the lkey is freed from the hardware's perspective.
However, concurrently, mlx5_ib_invalidate_range() might be triggered by
another task attempting to invalidate a range for the same freed lkey.
This task will:
- Acquire the umem_odp->umem_mutex lock.
- Call mlx5r_umr_update_xlt() on the UMR QP.
- Since the lkey has already been freed, this can lead to a CQE error,
causing the UMR QP to enter an error state [1].
To resolve this race condition, the umem_odp->umem_mutex lock is now also
acquired as part of the mlx5_revoke_mr() scope. Upon successful revoke,
we set umem_odp->private which points to that MR to NULL, preventing any
further invalidation attempts on its lkey.
[1] From dmesg:
infiniband rocep8s0f0: dump_cqe:277:(pid 0): WC error: 6, Message: memory bind operation error
cqe_dump: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
cqe_dump: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
cqe_dump: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
cqe_dump: 00000030: 00 00 00 00 08 00 78 06 25 00 11 b9 00 0e dd d2
WARNING: CPU: 15 PID: 1506 at drivers/infiniband/hw/mlx5/umr.c:394 mlx5r_umr_post_send_wait+0x15a/0x2b0 [mlx5_ib]
Modules linked in: ip6table_mangle ip6table_natip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_umad ib_ipoib ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core
CPU: 15 UID: 0 PID: 1506 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1626
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:mlx5r_umr_post_send_wait+0x15a/0x2b0 [mlx5_ib]
[..]
Call Trace:
<TASK>
mlx5r_umr_update_xlt+0x23c/0x3e0 [mlx5_ib]
mlx5_ib_invalidate_range+0x2e1/0x330 [mlx5_ib]
__mmu_notifier_invalidate_range_start+0x1e1/0x240
zap_page_range_single+0xf1/0x1a0
madvise_vma_behavior+0x677/0x6e0
do_madvise+0x1a2/0x4b0
__x64_sys_madvise+0x25/0x30
do_syscall_64+0x6b/0x140
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fixes: e6fb246ccafb ("RDMA/mlx5: Consolidate MR destruction to mlx5_ib_dereg_mr()")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/r/68a1e007c25b2b8fe5d625f238cc3b63e5341f77.1737290229.git.leon@kernel.org
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
Reviewed-by: Artemy Kovalyov <artemyko@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/mr.c | 17 +++++++++++++++--
drivers/infiniband/hw/mlx5/odp.c | 2 ++
2 files changed, 17 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -2021,6 +2021,11 @@ static int mlx5_revoke_mr(struct mlx5_ib
{
struct mlx5_ib_dev *dev = to_mdev(mr->ibmr.device);
struct mlx5_cache_ent *ent = mr->mmkey.cache_ent;
+ bool is_odp = is_odp_mr(mr);
+ int ret = 0;
+
+ if (is_odp)
+ mutex_lock(&to_ib_umem_odp(mr->umem)->umem_mutex);
if (mr->mmkey.cacheable && !mlx5r_umr_revoke_mr(mr) && !cache_ent_find_and_store(dev, mr)) {
ent = mr->mmkey.cache_ent;
@@ -2032,7 +2037,7 @@ static int mlx5_revoke_mr(struct mlx5_ib
ent->tmp_cleanup_scheduled = true;
}
spin_unlock_irq(&ent->mkeys_queue.lock);
- return 0;
+ goto out;
}
if (ent) {
@@ -2041,7 +2046,15 @@ static int mlx5_revoke_mr(struct mlx5_ib
mr->mmkey.cache_ent = NULL;
spin_unlock_irq(&ent->mkeys_queue.lock);
}
- return destroy_mkey(dev, mr);
+ ret = destroy_mkey(dev, mr);
+out:
+ if (is_odp) {
+ if (!ret)
+ to_ib_umem_odp(mr->umem)->private = NULL;
+ mutex_unlock(&to_ib_umem_odp(mr->umem)->umem_mutex);
+ }
+
+ return ret;
}
static int __mlx5_ib_dereg_mr(struct ib_mr *ibmr)
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -282,6 +282,8 @@ static bool mlx5_ib_invalidate_range(str
if (!umem_odp->npages)
goto out;
mr = umem_odp->private;
+ if (!mr)
+ goto out;
start = max_t(u64, ib_umem_start(umem_odp), range->start);
end = min_t(u64, ib_umem_end(umem_odp), range->end);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 430/443] rtc: zynqmp: Fix optional clock name property
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 429/443] RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 431/443] statmount: let unset strings be empty Greg Kroah-Hartman
` (23 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Simek, stable,
Peter Korsgaard, Alexandre Belloni
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Simek <michal.simek@amd.com>
commit 2a388ff22d2cbfc5cbd628ef085bdcd3b7dc64f5 upstream.
Clock description in DT binding introduced by commit f69060c14431
("dt-bindings: rtc: zynqmp: Add clock information") is talking about "rtc"
clock name but driver is checking "rtc_clk" name instead.
Because clock is optional property likely in was never handled properly by
the driver.
Fixes: 07dcc6f9c762 ("rtc: zynqmp: Add calibration set and get support")
Signed-off-by: Michal Simek <michal.simek@amd.com>
Cc: stable@kernel.org
Reviewed-by: Peter Korsgaard <peter@korsgaard.com>
Link: https://lore.kernel.org/r/cd5f0c9d01ec1f5a240e37a7e0d85b8dacb3a869.1732723280.git.michal.simek@amd.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-zynqmp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/rtc/rtc-zynqmp.c
+++ b/drivers/rtc/rtc-zynqmp.c
@@ -318,8 +318,8 @@ static int xlnx_rtc_probe(struct platfor
return ret;
}
- /* Getting the rtc_clk info */
- xrtcdev->rtc_clk = devm_clk_get_optional(&pdev->dev, "rtc_clk");
+ /* Getting the rtc info */
+ xrtcdev->rtc_clk = devm_clk_get_optional(&pdev->dev, "rtc");
if (IS_ERR(xrtcdev->rtc_clk)) {
if (PTR_ERR(xrtcdev->rtc_clk) != -EPROBE_DEFER)
dev_warn(&pdev->dev, "Device clock not found.\n");
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 431/443] statmount: let unset strings be empty
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 430/443] rtc: zynqmp: Fix optional clock name property Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 432/443] timers/migration: Fix off-by-one root mis-connection Greg Kroah-Hartman
` (22 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miklos Szeredi, Jeff Layton,
Christian Brauner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit e52e97f09fb66fd868260d05bd6b74a9a3db39ee upstream.
Just like it's normal for unset values to be zero, unset strings should be
empty instead of containing random values.
It seems to be a typical mistake that the mask returned by statmount is not
checked, which can result in various bugs.
With this fix, these bugs are prevented, since it is highly likely that
userspace would just want to turn the missing mask case into an empty
string anyway (most of the recently found cases are of this type).
Link: https://lore.kernel.org/all/CAJfpegsVCPfCn2DpM8iiYSS5DpMsLB8QBUCHecoj6s0Vxf4jzg@mail.gmail.com/
Fixes: 68385d77c05b ("statmount: simplify string option retrieval")
Fixes: 46eae99ef733 ("add statmount(2) syscall")
Cc: stable@vger.kernel.org # v6.8
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Link: https://lore.kernel.org/r/20250130121500.113446-1-mszeredi@redhat.com
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5137,39 +5137,45 @@ static int statmount_string(struct kstat
size_t kbufsize;
struct seq_file *seq = &s->seq;
struct statmount *sm = &s->sm;
- u32 start = seq->count;
+ u32 start, *offp;
+
+ /* Reserve an empty string at the beginning for any unset offsets */
+ if (!seq->count)
+ seq_putc(seq, 0);
+
+ start = seq->count;
switch (flag) {
case STATMOUNT_FS_TYPE:
- sm->fs_type = start;
+ offp = &sm->fs_type;
ret = statmount_fs_type(s, seq);
break;
case STATMOUNT_MNT_ROOT:
- sm->mnt_root = start;
+ offp = &sm->mnt_root;
ret = statmount_mnt_root(s, seq);
break;
case STATMOUNT_MNT_POINT:
- sm->mnt_point = start;
+ offp = &sm->mnt_point;
ret = statmount_mnt_point(s, seq);
break;
case STATMOUNT_MNT_OPTS:
- sm->mnt_opts = start;
+ offp = &sm->mnt_opts;
ret = statmount_mnt_opts(s, seq);
break;
case STATMOUNT_OPT_ARRAY:
- sm->opt_array = start;
+ offp = &sm->opt_array;
ret = statmount_opt_array(s, seq);
break;
case STATMOUNT_OPT_SEC_ARRAY:
- sm->opt_sec_array = start;
+ offp = &sm->opt_sec_array;
ret = statmount_opt_sec_array(s, seq);
break;
case STATMOUNT_FS_SUBTYPE:
- sm->fs_subtype = start;
+ offp = &sm->fs_subtype;
statmount_fs_subtype(s, seq);
break;
case STATMOUNT_SB_SOURCE:
- sm->sb_source = start;
+ offp = &sm->sb_source;
ret = statmount_sb_source(s, seq);
break;
default:
@@ -5197,6 +5203,7 @@ static int statmount_string(struct kstat
seq->buf[seq->count++] = '\0';
sm->mask |= flag;
+ *offp = start;
return 0;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 432/443] timers/migration: Fix off-by-one root mis-connection
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 431/443] statmount: let unset strings be empty Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 433/443] s390/fpu: Add fpc exception handler / remove fixup section again Greg Kroah-Hartman
` (21 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matt Fleming, Frederic Weisbecker,
Thomas Gleixner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <frederic@kernel.org>
commit 868c9037df626b3c245ee26a290a03ae1f9f58d3 upstream.
Before attaching a new root to the old root, the children counter of the
new root is checked to verify that only the upcoming CPU's top group have
been connected to it. However since the recently added commit b729cc1ec21a
("timers/migration: Fix another race between hotplug and idle entry/exit")
this check is not valid anymore because the old root is pre-accounted
as a child to the new root. Therefore after connecting the upcoming
CPU's top group to the new root, the children count to be expected must
be 2 and not 1 anymore.
This omission results in the old root to not be connected to the new
root. Then eventually the system may run with more than one top level,
which defeats the purpose of a single idle migrator.
Also the old root is pre-accounted but not connected upon the new root
creation. But it can be connected to the new root later on. Therefore
the old root may be accounted twice to the new root. The propagation of
such overcommit can end up creating a double final top-level root with a
groupmask incorrectly initialized. Although harmless given that the final
top level roots will never have a parent to walk up to, this oddity
opportunistically reported the core issue:
WARNING: CPU: 8 PID: 0 at kernel/time/timer_migration.c:543 tmigr_requires_handle_remote
CPU: 8 UID: 0 PID: 0 Comm: swapper/8
RIP: 0010:tmigr_requires_handle_remote
Call Trace:
<IRQ>
? tmigr_requires_handle_remote
? hrtimer_run_queues
update_process_times
tick_periodic
tick_handle_periodic
__sysvec_apic_timer_interrupt
sysvec_apic_timer_interrupt
</IRQ>
Fix the problem by taking the old root into account in the children count
of the new root so the connection is not omitted.
Also warn when more than one top level group exists to better detect
similar issues in the future.
Fixes: b729cc1ec21a ("timers/migration: Fix another race between hotplug and idle entry/exit")
Reported-by: Matt Fleming <mfleming@cloudflare.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20250205160220.39467-1-frederic@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/timer_migration.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/kernel/time/timer_migration.c
+++ b/kernel/time/timer_migration.c
@@ -1677,6 +1677,9 @@ static int tmigr_setup_groups(unsigned i
} while (i < tmigr_hierarchy_levels);
+ /* Assert single root */
+ WARN_ON_ONCE(!err && !group->parent && !list_is_singular(&tmigr_level_list[top]));
+
while (i > 0) {
group = stack[--i];
@@ -1718,7 +1721,12 @@ static int tmigr_setup_groups(unsigned i
WARN_ON_ONCE(top == 0);
lvllist = &tmigr_level_list[top];
- if (group->num_children == 1 && list_is_singular(lvllist)) {
+
+ /*
+ * Newly created root level should have accounted the upcoming
+ * CPU's child group and pre-accounted the old root.
+ */
+ if (group->num_children == 2 && list_is_singular(lvllist)) {
/*
* The target CPU must never do the prepare work, except
* on early boot when the boot CPU is the target. Otherwise
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 433/443] s390/fpu: Add fpc exception handler / remove fixup section again
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 432/443] timers/migration: Fix off-by-one root mis-connection Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:29 ` [PATCH 6.13 434/443] MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static Greg Kroah-Hartman
` (20 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Gordeev, Heiko Carstens
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit ae02615b7fcea9ce9a4ec40b3c5b5dafd322b179 upstream.
The fixup section was added again by mistake when test_fp_ctl() was
removed. The reason for the removal of the fixup section is described in
commit 484a8ed8b7d1 ("s390/extable: add dedicated uaccess handler").
Remove it again for the same reason.
Add an exception handler which handles exceptions when the floating point
control register is attempted to be set to invalid values. The exception
handler sets the floating point control register to zero and continues
execution at the specified address.
The new sfpc inline assembly is open-coded to make back porting a bit
easier.
Fixes: 702644249d3e ("s390/fpu: get rid of test_fp_ctl()")
Cc: stable@vger.kernel.org
Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/asm-extable.h | 4 ++++
arch/s390/include/asm/fpu-insn.h | 17 +++++------------
arch/s390/kernel/vmlinux.lds.S | 1 -
arch/s390/mm/extable.c | 9 +++++++++
4 files changed, 18 insertions(+), 13 deletions(-)
--- a/arch/s390/include/asm/asm-extable.h
+++ b/arch/s390/include/asm/asm-extable.h
@@ -14,6 +14,7 @@
#define EX_TYPE_UA_LOAD_REG 5
#define EX_TYPE_UA_LOAD_REGPAIR 6
#define EX_TYPE_ZEROPAD 7
+#define EX_TYPE_FPC 8
#define EX_DATA_REG_ERR_SHIFT 0
#define EX_DATA_REG_ERR GENMASK(3, 0)
@@ -84,4 +85,7 @@
#define EX_TABLE_ZEROPAD(_fault, _target, _regdata, _regaddr) \
__EX_TABLE(__ex_table, _fault, _target, EX_TYPE_ZEROPAD, _regdata, _regaddr, 0)
+#define EX_TABLE_FPC(_fault, _target) \
+ __EX_TABLE(__ex_table, _fault, _target, EX_TYPE_FPC, __stringify(%%r0), __stringify(%%r0), 0)
+
#endif /* __ASM_EXTABLE_H */
--- a/arch/s390/include/asm/fpu-insn.h
+++ b/arch/s390/include/asm/fpu-insn.h
@@ -100,19 +100,12 @@ static __always_inline void fpu_lfpc(uns
*/
static inline void fpu_lfpc_safe(unsigned int *fpc)
{
- u32 tmp;
-
instrument_read(fpc, sizeof(*fpc));
- asm volatile("\n"
- "0: lfpc %[fpc]\n"
- "1: nopr %%r7\n"
- ".pushsection .fixup, \"ax\"\n"
- "2: lghi %[tmp],0\n"
- " sfpc %[tmp]\n"
- " jg 1b\n"
- ".popsection\n"
- EX_TABLE(1b, 2b)
- : [tmp] "=d" (tmp)
+ asm_inline volatile(
+ " lfpc %[fpc]\n"
+ "0: nopr %%r7\n"
+ EX_TABLE_FPC(0b, 0b)
+ :
: [fpc] "Q" (*fpc)
: "memory");
}
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -52,7 +52,6 @@ SECTIONS
SOFTIRQENTRY_TEXT
FTRACE_HOTPATCH_TRAMPOLINES_TEXT
*(.text.*_indirect_*)
- *(.fixup)
*(.gnu.warning)
. = ALIGN(PAGE_SIZE);
_etext = .; /* End of text section */
--- a/arch/s390/mm/extable.c
+++ b/arch/s390/mm/extable.c
@@ -77,6 +77,13 @@ static bool ex_handler_zeropad(const str
return true;
}
+static bool ex_handler_fpc(const struct exception_table_entry *ex, struct pt_regs *regs)
+{
+ asm volatile("sfpc %[val]\n" : : [val] "d" (0));
+ regs->psw.addr = extable_fixup(ex);
+ return true;
+}
+
bool fixup_exception(struct pt_regs *regs)
{
const struct exception_table_entry *ex;
@@ -99,6 +106,8 @@ bool fixup_exception(struct pt_regs *reg
return ex_handler_ua_load_reg(ex, true, regs);
case EX_TYPE_ZEROPAD:
return ex_handler_zeropad(ex, regs);
+ case EX_TYPE_FPC:
+ return ex_handler_fpc(ex, regs);
}
panic("invalid exception table entry");
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 434/443] MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 433/443] s390/fpu: Add fpc exception handler / remove fixup section again Greg Kroah-Hartman
@ 2025-02-13 14:29 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 435/443] spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families Greg Kroah-Hartman
` (19 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:29 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, WangYuli, Masami Hiramatsu (Google),
Philippe Mathieu-Daudé, Thomas Bogendoerfer
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: WangYuli <wangyuli@uniontech.com>
commit ddd068d81445b17ac0bed084dfeb9e58b4df3ddd upstream.
Declare ftrace_get_parent_ra_addr() as static to suppress clang
compiler warning that 'no previous prototype'. This function is
not intended to be called from other parts.
Fix follow error with clang-19:
arch/mips/kernel/ftrace.c:251:15: error: no previous prototype for function 'ftrace_get_parent_ra_addr' [-Werror,-Wmissing-prototypes]
251 | unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
| ^
arch/mips/kernel/ftrace.c:251:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
251 | unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
| ^
| static
1 error generated.
Signed-off-by: WangYuli <wangyuli@uniontech.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/ftrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -248,7 +248,7 @@ int ftrace_disable_ftrace_graph_caller(v
#define S_R_SP (0xafb0 << 16) /* s{d,w} R, offset(sp) */
#define OFFSET_MASK 0xffff /* stack offset range: 0 ~ PT_SIZE */
-unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
+static unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
old_parent_ra, unsigned long parent_ra_addr, unsigned long fp)
{
unsigned long sp, ip, tmp;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 435/443] spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2025-02-13 14:29 ` [PATCH 6.13 434/443] MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 436/443] spi: atmel-qspi: Memory barriers after memory-mapped I/O Greg Kroah-Hartman
` (18 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, =20Bence?=, Mark Brown
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Csókás, Bence <csokas.bence@prolan.hu>
commit c0a0203cf57963792d59b3e4317a1d07b73df42a upstream.
Refactor the code to introduce an ops struct, to prepare for merging
support for later SoCs, such as SAMA7G5. This code was based on the
vendor's kernel (linux4microchip). Cc'ing original contributors.
Signed-off-by: Csókás, Bence <csokas.bence@prolan.hu>
Link: https://patch.msgid.link/20241128174316.3209354-2-csokas.bence@prolan.hu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/atmel-quadspi.c | 111 ++++++++++++++++++++++++++++++--------------
1 file changed, 77 insertions(+), 34 deletions(-)
--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -138,11 +138,15 @@
#define QSPI_WPSR_WPVSRC_MASK GENMASK(15, 8)
#define QSPI_WPSR_WPVSRC(src) (((src) << 8) & QSPI_WPSR_WPVSRC)
+#define ATMEL_QSPI_TIMEOUT 1000 /* ms */
+
struct atmel_qspi_caps {
bool has_qspick;
bool has_ricr;
};
+struct atmel_qspi_ops;
+
struct atmel_qspi {
void __iomem *regs;
void __iomem *mem;
@@ -150,13 +154,22 @@ struct atmel_qspi {
struct clk *qspick;
struct platform_device *pdev;
const struct atmel_qspi_caps *caps;
+ const struct atmel_qspi_ops *ops;
resource_size_t mmap_size;
u32 pending;
+ u32 irq_mask;
u32 mr;
u32 scr;
struct completion cmd_completion;
};
+struct atmel_qspi_ops {
+ int (*set_cfg)(struct atmel_qspi *aq, const struct spi_mem_op *op,
+ u32 *offset);
+ int (*transfer)(struct spi_mem *mem, const struct spi_mem_op *op,
+ u32 offset);
+};
+
struct atmel_qspi_mode {
u8 cmd_buswidth;
u8 addr_buswidth;
@@ -404,10 +417,60 @@ static int atmel_qspi_set_cfg(struct atm
return 0;
}
+static int atmel_qspi_wait_for_completion(struct atmel_qspi *aq, u32 irq_mask)
+{
+ int err = 0;
+ u32 sr;
+
+ /* Poll INSTRuction End status */
+ sr = atmel_qspi_read(aq, QSPI_SR);
+ if ((sr & irq_mask) == irq_mask)
+ return 0;
+
+ /* Wait for INSTRuction End interrupt */
+ reinit_completion(&aq->cmd_completion);
+ aq->pending = sr & irq_mask;
+ aq->irq_mask = irq_mask;
+ atmel_qspi_write(irq_mask, aq, QSPI_IER);
+ if (!wait_for_completion_timeout(&aq->cmd_completion,
+ msecs_to_jiffies(ATMEL_QSPI_TIMEOUT)))
+ err = -ETIMEDOUT;
+ atmel_qspi_write(irq_mask, aq, QSPI_IDR);
+
+ return err;
+}
+
+static int atmel_qspi_transfer(struct spi_mem *mem,
+ const struct spi_mem_op *op, u32 offset)
+{
+ struct atmel_qspi *aq = spi_controller_get_devdata(mem->spi->controller);
+
+ /* Skip to the final steps if there is no data */
+ if (!op->data.nbytes)
+ return atmel_qspi_wait_for_completion(aq,
+ QSPI_SR_CMD_COMPLETED);
+
+ /* Dummy read of QSPI_IFR to synchronize APB and AHB accesses */
+ (void)atmel_qspi_read(aq, QSPI_IFR);
+
+ /* Send/Receive data */
+ if (op->data.dir == SPI_MEM_DATA_IN)
+ memcpy_fromio(op->data.buf.in, aq->mem + offset,
+ op->data.nbytes);
+ else
+ memcpy_toio(aq->mem + offset, op->data.buf.out,
+ op->data.nbytes);
+
+ /* Release the chip-select */
+ atmel_qspi_write(QSPI_CR_LASTXFER, aq, QSPI_CR);
+
+ return atmel_qspi_wait_for_completion(aq, QSPI_SR_CMD_COMPLETED);
+}
+
static int atmel_qspi_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
{
struct atmel_qspi *aq = spi_controller_get_devdata(mem->spi->controller);
- u32 sr, offset;
+ u32 offset;
int err;
/*
@@ -416,46 +479,20 @@ static int atmel_qspi_exec_op(struct spi
* when the flash memories overrun the controller's memory space.
*/
if (op->addr.val + op->data.nbytes > aq->mmap_size)
- return -ENOTSUPP;
+ return -EOPNOTSUPP;
+
+ if (op->addr.nbytes > 4)
+ return -EOPNOTSUPP;
err = pm_runtime_resume_and_get(&aq->pdev->dev);
if (err < 0)
return err;
- err = atmel_qspi_set_cfg(aq, op, &offset);
+ err = aq->ops->set_cfg(aq, op, &offset);
if (err)
goto pm_runtime_put;
- /* Skip to the final steps if there is no data */
- if (op->data.nbytes) {
- /* Dummy read of QSPI_IFR to synchronize APB and AHB accesses */
- (void)atmel_qspi_read(aq, QSPI_IFR);
-
- /* Send/Receive data */
- if (op->data.dir == SPI_MEM_DATA_IN)
- memcpy_fromio(op->data.buf.in, aq->mem + offset,
- op->data.nbytes);
- else
- memcpy_toio(aq->mem + offset, op->data.buf.out,
- op->data.nbytes);
-
- /* Release the chip-select */
- atmel_qspi_write(QSPI_CR_LASTXFER, aq, QSPI_CR);
- }
-
- /* Poll INSTRuction End status */
- sr = atmel_qspi_read(aq, QSPI_SR);
- if ((sr & QSPI_SR_CMD_COMPLETED) == QSPI_SR_CMD_COMPLETED)
- goto pm_runtime_put;
-
- /* Wait for INSTRuction End interrupt */
- reinit_completion(&aq->cmd_completion);
- aq->pending = sr & QSPI_SR_CMD_COMPLETED;
- atmel_qspi_write(QSPI_SR_CMD_COMPLETED, aq, QSPI_IER);
- if (!wait_for_completion_timeout(&aq->cmd_completion,
- msecs_to_jiffies(1000)))
- err = -ETIMEDOUT;
- atmel_qspi_write(QSPI_SR_CMD_COMPLETED, aq, QSPI_IDR);
+ err = aq->ops->transfer(mem, op, offset);
pm_runtime_put:
pm_runtime_mark_last_busy(&aq->pdev->dev);
@@ -599,12 +636,17 @@ static irqreturn_t atmel_qspi_interrupt(
return IRQ_NONE;
aq->pending |= pending;
- if ((aq->pending & QSPI_SR_CMD_COMPLETED) == QSPI_SR_CMD_COMPLETED)
+ if ((aq->pending & aq->irq_mask) == aq->irq_mask)
complete(&aq->cmd_completion);
return IRQ_HANDLED;
}
+static const struct atmel_qspi_ops atmel_qspi_ops = {
+ .set_cfg = atmel_qspi_set_cfg,
+ .transfer = atmel_qspi_transfer,
+};
+
static int atmel_qspi_probe(struct platform_device *pdev)
{
struct spi_controller *ctrl;
@@ -629,6 +671,7 @@ static int atmel_qspi_probe(struct platf
init_completion(&aq->cmd_completion);
aq->pdev = pdev;
+ aq->ops = &atmel_qspi_ops;
/* Map the registers */
aq->regs = devm_platform_ioremap_resource_byname(pdev, "qspi_base");
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 436/443] spi: atmel-qspi: Memory barriers after memory-mapped I/O
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 435/443] spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 437/443] x86/mm: Convert unreachable() to BUG() Greg Kroah-Hartman
` (17 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hari.PrasathGE, Mahesh.Abotula,
Marco.Cardellini, Bence Csókás, Mark Brown
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bence Csókás <csokas.bence@prolan.hu>
commit be92ab2de0ee1a13291c3b47b2d7eb24d80c0a2c upstream.
The QSPI peripheral control and status registers are
accessible via the SoC's APB bus, whereas MMIO transactions'
data travels on the AHB bus.
Microchip documentation and even sample code from Atmel
emphasises the need for a memory barrier before the first
MMIO transaction to the AHB-connected QSPI, and before the
last write to its registers via APB. This is achieved by
the following lines in `atmel_qspi_transfer()`:
/* Dummy read of QSPI_IFR to synchronize APB and AHB accesses */
(void)atmel_qspi_read(aq, QSPI_IFR);
However, the current documentation makes no mention to
synchronization requirements in the other direction, i.e.
after the last data written via AHB, and before the first
register access on APB.
In our case, we were facing an issue where the QSPI peripheral
would cease to send any new CSR (nCS Rise) interrupts,
leading to a timeout in `atmel_qspi_wait_for_completion()`
and ultimately this panic in higher levels:
ubi0 error: ubi_io_write: error -110 while writing 63108 bytes
to PEB 491:128, written 63104 bytes
After months of extensive research of the codebase, fiddling
around the debugger with kgdb, and back-and-forth with
Microchip, we came to the conclusion that the issue is
probably that the peripheral is still busy receiving on AHB
when the LASTXFER bit is written to its Control Register
on APB, therefore this write gets lost, and the peripheral
still thinks there is more data to come in the MMIO transfer.
This was first formulated when we noticed that doubling the
write() of QSPI_CR_LASTXFER seemed to solve the problem.
Ultimately, the solution is to introduce memory barriers
after the AHB-mapped MMIO transfers, to ensure ordering.
Fixes: d5433def3153 ("mtd: spi-nor: atmel-quadspi: Add spi-mem support to atmel-quadspi")
Cc: Hari.PrasathGE@microchip.com
Cc: Mahesh.Abotula@microchip.com
Cc: Marco.Cardellini@microchip.com
Cc: stable@vger.kernel.org # c0a0203cf579: ("spi: atmel-quadspi: Create `atmel_qspi_ops`"...)
Cc: stable@vger.kernel.org # 6.x.y
Signed-off-by: Bence Csókás <csokas.bence@prolan.hu>
Link: https://patch.msgid.link/20241219091258.395187-1-csokas.bence@prolan.hu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/atmel-quadspi.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/spi/atmel-quadspi.c
+++ b/drivers/spi/atmel-quadspi.c
@@ -454,13 +454,20 @@ static int atmel_qspi_transfer(struct sp
(void)atmel_qspi_read(aq, QSPI_IFR);
/* Send/Receive data */
- if (op->data.dir == SPI_MEM_DATA_IN)
+ if (op->data.dir == SPI_MEM_DATA_IN) {
memcpy_fromio(op->data.buf.in, aq->mem + offset,
op->data.nbytes);
- else
+
+ /* Synchronize AHB and APB accesses again */
+ rmb();
+ } else {
memcpy_toio(aq->mem + offset, op->data.buf.out,
op->data.nbytes);
+ /* Synchronize AHB and APB accesses again */
+ wmb();
+ }
+
/* Release the chip-select */
atmel_qspi_write(QSPI_CR_LASTXFER, aq, QSPI_CR);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 437/443] x86/mm: Convert unreachable() to BUG()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 436/443] spi: atmel-qspi: Memory barriers after memory-mapped I/O Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 438/443] md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add() Greg Kroah-Hartman
` (16 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Zijlstra (Intel)
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 41a1e976623eb430f7b5a8619d3810b44e6235ad upstream.
Commit 2190966fbc14 ("x86: Convert unreachable() to BUG()") missed
one.
And after commit 06e24745985c ("objtool: Remove
annotate_{,un}reachable()") the invalid use of unreachable()
(rightfully) triggers warnings:
vmlinux.o: warning: objtool: page_fault_oops() falls through to next function is_prefetch()
Fixes: 2190966fbc14 ("x86: Convert unreachable() to BUG()")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20241216093215.GD12338@noisy.programming.kicks-ass.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/fault.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -678,7 +678,7 @@ page_fault_oops(struct pt_regs *regs, un
ASM_CALL_ARG3,
, [arg1] "r" (regs), [arg2] "r" (address), [arg3] "r" (&info));
- unreachable();
+ BUG();
}
#endif
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 438/443] md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 437/443] x86/mm: Convert unreachable() to BUG() Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 439/443] md: Fix linear_set_limits() Greg Kroah-Hartman
` (15 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Yu Kuai, Song Liu
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit 62c552070a980363d55a6082b432ebd1cade7a6e upstream.
The linear_conf() returns error pointers, it doesn't return NULL. Update
the error checking to match.
Fixes: 127186cfb184 ("md: reintroduce md-linear")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/add654be-759f-4b2d-93ba-a3726dae380c@stanley.mountain
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md-linear.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/md/md-linear.c
+++ b/drivers/md/md-linear.c
@@ -204,8 +204,8 @@ static int linear_add(struct mddev *mdde
rdev->saved_raid_disk = -1;
newconf = linear_conf(mddev, mddev->raid_disks + 1);
- if (!newconf)
- return -ENOMEM;
+ if (IS_ERR(newconf))
+ return PTR_ERR(newconf);
/* newconf->raid_disks already keeps a copy of * the increased
* value of mddev->raid_disks, WARN_ONCE() is just used to make
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 439/443] md: Fix linear_set_limits()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 438/443] md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add() Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 440/443] Revert "drm/amd/display: Fix green screen issue after suspend" Greg Kroah-Hartman
` (14 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Kuai, Coly Li, Mike Snitzer,
Christoph Hellwig, Bart Van Assche, Song Liu
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit a572593ac80e51eb69ecede7e614289fcccdbf8d upstream.
queue_limits_cancel_update() must only be called if
queue_limits_start_update() is called first. Remove the
queue_limits_cancel_update() call from linear_set_limits() because
there is no corresponding queue_limits_start_update() call.
This bug was discovered by annotating all mutex operations with clang
thread-safety attributes and by building the kernel with clang and
-Wthread-safety.
Cc: Yu Kuai <yukuai3@huawei.com>
Cc: Coly Li <colyli@kernel.org>
Cc: Mike Snitzer <snitzer@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Fixes: 127186cfb184 ("md: reintroduce md-linear")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20250129225636.2667932-1-bvanassche@acm.org
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md-linear.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/md/md-linear.c
+++ b/drivers/md/md-linear.c
@@ -76,10 +76,8 @@ static int linear_set_limits(struct mdde
lim.max_write_zeroes_sectors = mddev->chunk_sectors;
lim.io_min = mddev->chunk_sectors << 9;
err = mddev_stack_rdev_limits(mddev, &lim, MDDEV_STACK_INTEGRITY);
- if (err) {
- queue_limits_cancel_update(mddev->gendisk->queue);
+ if (err)
return err;
- }
return queue_limits_set(mddev->gendisk->queue, &lim);
}
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 440/443] Revert "drm/amd/display: Fix green screen issue after suspend"
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 439/443] md: Fix linear_set_limits() Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 441/443] wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit Greg Kroah-Hartman
` (13 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello,
Pierre-Eric Pelloux-Prayer, Daniel Wheeler, Aurabindo Pillai,
Rodrigo Siqueira, Alex Deucher
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
commit 04d6273faed083e619fc39a738ab0372b6a4db20 upstream.
This reverts commit 87b7ebc2e16c14d32a912f18206a4d6cc9abc3e8.
A long time ago, we had an issue with the Raven system when it was
connected to two displays: one with DP and another with HDMI. After the
system woke up from suspension, we saw a solid green screen caused by an
underflow generated by bad DCC metadata. To workaround this issue, the
'commit 87b7ebc2e16c ("drm/amd/display: Fix green screen issue after
suspend")' was introduced to disable the DCC for a few frames after in
the resume phase. However, in hindsight, this solution was probably a
workaround at the kernel level for some issues from another part
(probably other driver components or user space). After applying this
patch and trying to reproduce the green issue in a similar hardware
system but using the latest kernel and userspace, we cannot see the
issue, which makes this workaround obsolete and creates extra
unnecessary complexity to the code; for all of this reason, this commit
reverts the original change.
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++------
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 22 +++++-----------
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.h | 3 --
3 files changed, 13 insertions(+), 24 deletions(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5530,8 +5530,7 @@ fill_dc_plane_info_and_addr(struct amdgp
const u64 tiling_flags,
struct dc_plane_info *plane_info,
struct dc_plane_address *address,
- bool tmz_surface,
- bool force_disable_dcc)
+ bool tmz_surface)
{
const struct drm_framebuffer *fb = plane_state->fb;
const struct amdgpu_framebuffer *afb =
@@ -5630,7 +5629,7 @@ fill_dc_plane_info_and_addr(struct amdgp
&plane_info->tiling_info,
&plane_info->plane_size,
&plane_info->dcc, address,
- tmz_surface, force_disable_dcc);
+ tmz_surface);
if (ret)
return ret;
@@ -5651,7 +5650,6 @@ static int fill_dc_plane_attributes(stru
struct dc_scaling_info scaling_info;
struct dc_plane_info plane_info;
int ret;
- bool force_disable_dcc = false;
ret = amdgpu_dm_plane_fill_dc_scaling_info(adev, plane_state, &scaling_info);
if (ret)
@@ -5662,13 +5660,11 @@ static int fill_dc_plane_attributes(stru
dc_plane_state->clip_rect = scaling_info.clip_rect;
dc_plane_state->scaling_quality = scaling_info.scaling_quality;
- force_disable_dcc = adev->asic_type == CHIP_RAVEN && adev->in_suspend;
ret = fill_dc_plane_info_and_addr(adev, plane_state,
afb->tiling_flags,
&plane_info,
&dc_plane_state->address,
- afb->tmz_surface,
- force_disable_dcc);
+ afb->tmz_surface);
if (ret)
return ret;
@@ -9076,7 +9072,7 @@ static void amdgpu_dm_commit_planes(stru
afb->tiling_flags,
&bundle->plane_infos[planes_count],
&bundle->flip_addrs[planes_count].address,
- afb->tmz_surface, false);
+ afb->tmz_surface);
drm_dbg_state(state->dev, "plane: id=%d dcc_en=%d\n",
new_plane_state->plane->index,
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c
@@ -309,8 +309,7 @@ static int amdgpu_dm_plane_fill_gfx9_pla
const struct plane_size *plane_size,
union dc_tiling_info *tiling_info,
struct dc_plane_dcc_param *dcc,
- struct dc_plane_address *address,
- const bool force_disable_dcc)
+ struct dc_plane_address *address)
{
const uint64_t modifier = afb->base.modifier;
int ret = 0;
@@ -318,7 +317,7 @@ static int amdgpu_dm_plane_fill_gfx9_pla
amdgpu_dm_plane_fill_gfx9_tiling_info_from_modifier(adev, tiling_info, modifier);
tiling_info->gfx9.swizzle = amdgpu_dm_plane_modifier_gfx9_swizzle_mode(modifier);
- if (amdgpu_dm_plane_modifier_has_dcc(modifier) && !force_disable_dcc) {
+ if (amdgpu_dm_plane_modifier_has_dcc(modifier)) {
uint64_t dcc_address = afb->address + afb->base.offsets[1];
bool independent_64b_blks = AMD_FMT_MOD_GET(DCC_INDEPENDENT_64B, modifier);
bool independent_128b_blks = AMD_FMT_MOD_GET(DCC_INDEPENDENT_128B, modifier);
@@ -360,8 +359,7 @@ static int amdgpu_dm_plane_fill_gfx12_pl
const struct plane_size *plane_size,
union dc_tiling_info *tiling_info,
struct dc_plane_dcc_param *dcc,
- struct dc_plane_address *address,
- const bool force_disable_dcc)
+ struct dc_plane_address *address)
{
const uint64_t modifier = afb->base.modifier;
int ret = 0;
@@ -371,7 +369,7 @@ static int amdgpu_dm_plane_fill_gfx12_pl
tiling_info->gfx9.swizzle = amdgpu_dm_plane_modifier_gfx9_swizzle_mode(modifier);
- if (amdgpu_dm_plane_modifier_has_dcc(modifier) && !force_disable_dcc) {
+ if (amdgpu_dm_plane_modifier_has_dcc(modifier)) {
int max_compressed_block = AMD_FMT_MOD_GET(DCC_MAX_COMPRESSED_BLOCK, modifier);
dcc->enable = 1;
@@ -839,8 +837,7 @@ int amdgpu_dm_plane_fill_plane_buffer_at
struct plane_size *plane_size,
struct dc_plane_dcc_param *dcc,
struct dc_plane_address *address,
- bool tmz_surface,
- bool force_disable_dcc)
+ bool tmz_surface)
{
const struct drm_framebuffer *fb = &afb->base;
int ret;
@@ -900,16 +897,14 @@ int amdgpu_dm_plane_fill_plane_buffer_at
ret = amdgpu_dm_plane_fill_gfx12_plane_attributes_from_modifiers(adev, afb, format,
rotation, plane_size,
tiling_info, dcc,
- address,
- force_disable_dcc);
+ address);
if (ret)
return ret;
} else if (adev->family >= AMDGPU_FAMILY_AI) {
ret = amdgpu_dm_plane_fill_gfx9_plane_attributes_from_modifiers(adev, afb, format,
rotation, plane_size,
tiling_info, dcc,
- address,
- force_disable_dcc);
+ address);
if (ret)
return ret;
} else {
@@ -1000,14 +995,13 @@ static int amdgpu_dm_plane_helper_prepar
dm_plane_state_old->dc_state != dm_plane_state_new->dc_state) {
struct dc_plane_state *plane_state =
dm_plane_state_new->dc_state;
- bool force_disable_dcc = !plane_state->dcc.enable;
amdgpu_dm_plane_fill_plane_buffer_attributes(
adev, afb, plane_state->format, plane_state->rotation,
afb->tiling_flags,
&plane_state->tiling_info, &plane_state->plane_size,
&plane_state->dcc, &plane_state->address,
- afb->tmz_surface, force_disable_dcc);
+ afb->tmz_surface);
}
return 0;
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.h
@@ -51,8 +51,7 @@ int amdgpu_dm_plane_fill_plane_buffer_at
struct plane_size *plane_size,
struct dc_plane_dcc_param *dcc,
struct dc_plane_address *address,
- bool tmz_surface,
- bool force_disable_dcc);
+ bool tmz_surface);
int amdgpu_dm_plane_init(struct amdgpu_display_manager *dm,
struct drm_plane *plane,
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 441/443] wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 440/443] Revert "drm/amd/display: Fix green screen issue after suspend" Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 442/443] fs: prepend statmount.mnt_opts string with security_sb_mnt_opts() Greg Kroah-Hartman
` (12 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ping-Ke Shih
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <pkshih@realtek.com>
commit 9c1df813e08832c3836c254bc8a2f83ff22dbc06 upstream.
The PCIE wake bit is to control PCIE wake signal to host. When PCIE is
going down, clear this bit to prevent waking up host unexpectedly.
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241111063835.15454-1-pkshih@realtek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtw89/pci.c | 16 +++++++++++++---
drivers/net/wireless/realtek/rtw89/pci.h | 9 +++++++++
drivers/net/wireless/realtek/rtw89/pci_be.c | 1 +
3 files changed, 23 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/realtek/rtw89/pci.c
+++ b/drivers/net/wireless/realtek/rtw89/pci.c
@@ -2516,7 +2516,7 @@ static int rtw89_pci_dphy_delay(struct r
PCIE_DPHY_DLY_25US, PCIE_PHY_GEN1);
}
-static void rtw89_pci_power_wake(struct rtw89_dev *rtwdev, bool pwr_up)
+static void rtw89_pci_power_wake_ax(struct rtw89_dev *rtwdev, bool pwr_up)
{
if (pwr_up)
rtw89_write32_set(rtwdev, R_AX_HCI_OPT_CTRL, BIT_WAKE_CTRL);
@@ -2825,6 +2825,8 @@ static int rtw89_pci_ops_deinit(struct r
{
const struct rtw89_pci_info *info = rtwdev->pci_info;
+ rtw89_pci_power_wake(rtwdev, false);
+
if (rtwdev->chip->chip_id == RTL8852A) {
/* ltr sw trigger */
rtw89_write32_set(rtwdev, R_AX_LTR_CTRL_0, B_AX_APP_LTR_IDLE);
@@ -2867,7 +2869,7 @@ static int rtw89_pci_ops_mac_pre_init_ax
return ret;
}
- rtw89_pci_power_wake(rtwdev, true);
+ rtw89_pci_power_wake_ax(rtwdev, true);
rtw89_pci_autoload_hang(rtwdev);
rtw89_pci_l12_vmain(rtwdev);
rtw89_pci_gen2_force_ib(rtwdev);
@@ -2912,6 +2914,13 @@ static int rtw89_pci_ops_mac_pre_init_ax
return 0;
}
+static int rtw89_pci_ops_mac_pre_deinit_ax(struct rtw89_dev *rtwdev)
+{
+ rtw89_pci_power_wake_ax(rtwdev, false);
+
+ return 0;
+}
+
int rtw89_pci_ltr_set(struct rtw89_dev *rtwdev, bool en)
{
u32 val;
@@ -4325,7 +4334,7 @@ const struct rtw89_pci_gen_def rtw89_pci
B_AX_RDU_INT},
.mac_pre_init = rtw89_pci_ops_mac_pre_init_ax,
- .mac_pre_deinit = NULL,
+ .mac_pre_deinit = rtw89_pci_ops_mac_pre_deinit_ax,
.mac_post_init = rtw89_pci_ops_mac_post_init_ax,
.clr_idx_all = rtw89_pci_clr_idx_all_ax,
@@ -4343,6 +4352,7 @@ const struct rtw89_pci_gen_def rtw89_pci
.l1ss_set = rtw89_pci_l1ss_set_ax,
.disable_eq = rtw89_pci_disable_eq_ax,
+ .power_wake = rtw89_pci_power_wake_ax,
};
EXPORT_SYMBOL(rtw89_pci_gen_ax);
--- a/drivers/net/wireless/realtek/rtw89/pci.h
+++ b/drivers/net/wireless/realtek/rtw89/pci.h
@@ -1290,6 +1290,7 @@ struct rtw89_pci_gen_def {
void (*l1ss_set)(struct rtw89_dev *rtwdev, bool enable);
void (*disable_eq)(struct rtw89_dev *rtwdev);
+ void (*power_wake)(struct rtw89_dev *rtwdev, bool pwr_up);
};
#define RTW89_PCI_SSID(v, d, ssv, ssd, cust) \
@@ -1805,4 +1806,12 @@ static inline void rtw89_pci_disable_eq(
gen_def->disable_eq(rtwdev);
}
+static inline void rtw89_pci_power_wake(struct rtw89_dev *rtwdev, bool pwr_up)
+{
+ const struct rtw89_pci_info *info = rtwdev->pci_info;
+ const struct rtw89_pci_gen_def *gen_def = info->gen_def;
+
+ gen_def->power_wake(rtwdev, pwr_up);
+}
+
#endif
--- a/drivers/net/wireless/realtek/rtw89/pci_be.c
+++ b/drivers/net/wireless/realtek/rtw89/pci_be.c
@@ -691,5 +691,6 @@ const struct rtw89_pci_gen_def rtw89_pci
.l1ss_set = rtw89_pci_l1ss_set_be,
.disable_eq = rtw89_pci_disable_eq_be,
+ .power_wake = _patch_pcie_power_wake_be,
};
EXPORT_SYMBOL(rtw89_pci_gen_be);
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 442/443] fs: prepend statmount.mnt_opts string with security_sb_mnt_opts()
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 441/443] wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 14:30 ` [PATCH 6.13 443/443] fs: fix adding security options to statmount.mnt_opt Greg Kroah-Hartman
` (11 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Christian Brauner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 056d33137bf9364456ee70aa265ccbb948daee49 upstream.
Currently these mount options aren't accessible via statmount().
The read handler for /proc/#/mountinfo calls security_sb_show_options()
to emit the security options after emitting superblock flag options, but
before calling sb->s_op->show_options.
Have statmount_mnt_opts() call security_sb_show_options() before
calling ->show_options.
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://lore.kernel.org/r/20241115-statmount-v2-2-cd29aeff9cbb@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 5eb987105357 ("fs: fix adding security options to statmount.mnt_opt")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5042,6 +5042,10 @@ static int statmount_mnt_opts(struct kst
if (sb->s_op->show_options) {
size_t start = seq->count;
+ err = security_sb_show_options(seq, sb);
+ if (err)
+ return err;
+
err = sb->s_op->show_options(seq, mnt->mnt_root);
if (err)
return err;
^ permalink raw reply [flat|nested] 474+ messages in thread* [PATCH 6.13 443/443] fs: fix adding security options to statmount.mnt_opt
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 442/443] fs: prepend statmount.mnt_opts string with security_sb_mnt_opts() Greg Kroah-Hartman
@ 2025-02-13 14:30 ` Greg Kroah-Hartman
2025-02-13 19:55 ` [PATCH 6.13 000/443] 6.13.3-rc1 review Pavel Machek
` (10 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-13 14:30 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miklos Szeredi, Christian Brauner
6.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit 5eb987105357cb7cfa7cf3b1e2f66d5c0977e412 upstream.
Prepending security options was made conditional on sb->s_op->show_options,
but security options are independent of sb options.
Fixes: 056d33137bf9 ("fs: prepend statmount.mnt_opts string with security_sb_mnt_opts()")
Fixes: f9af549d1fd3 ("fs: export mount options via statmount()")
Cc: stable@vger.kernel.org # v6.11
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Link: https://lore.kernel.org/r/20250129151253.33241-1-mszeredi@redhat.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 29 ++++++++++++++---------------
1 file changed, 14 insertions(+), 15 deletions(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -5037,30 +5037,29 @@ static int statmount_mnt_opts(struct kst
{
struct vfsmount *mnt = s->mnt;
struct super_block *sb = mnt->mnt_sb;
+ size_t start = seq->count;
int err;
- if (sb->s_op->show_options) {
- size_t start = seq->count;
-
- err = security_sb_show_options(seq, sb);
- if (err)
- return err;
+ err = security_sb_show_options(seq, sb);
+ if (err)
+ return err;
+ if (sb->s_op->show_options) {
err = sb->s_op->show_options(seq, mnt->mnt_root);
if (err)
return err;
+ }
- if (unlikely(seq_has_overflowed(seq)))
- return -EAGAIN;
+ if (unlikely(seq_has_overflowed(seq)))
+ return -EAGAIN;
- if (seq->count == start)
- return 0;
+ if (seq->count == start)
+ return 0;
- /* skip leading comma */
- memmove(seq->buf + start, seq->buf + start + 1,
- seq->count - start - 1);
- seq->count--;
- }
+ /* skip leading comma */
+ memmove(seq->buf + start, seq->buf + start + 1,
+ seq->count - start - 1);
+ seq->count--;
return 0;
}
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2025-02-13 14:30 ` [PATCH 6.13 443/443] fs: fix adding security options to statmount.mnt_opt Greg Kroah-Hartman
@ 2025-02-13 19:55 ` Pavel Machek
2025-02-13 20:04 ` Florian Fainelli
` (9 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Pavel Machek @ 2025-02-13 19:55 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
[-- Attachment #1: Type: text/plain, Size: 897 bytes --]
Hi!
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.13.y
6.12 passes our testing, too; 6.6 will likely be ok after retries.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.12.y
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.6.y
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2025-02-13 19:55 ` [PATCH 6.13 000/443] 6.13.3-rc1 review Pavel Machek
@ 2025-02-13 20:04 ` Florian Fainelli
2025-02-13 20:52 ` Takeshi Ogasawara
` (8 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Florian Fainelli @ 2025-02-13 20:04 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor, hargar, broonie
On 2/13/25 06:22, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 15 Feb 2025 14:23:11 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2025-02-13 20:04 ` Florian Fainelli
@ 2025-02-13 20:52 ` Takeshi Ogasawara
2025-02-13 22:57 ` Justin Forbes
` (7 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Takeshi Ogasawara @ 2025-02-13 20:52 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
Hi Greg
On Fri, Feb 14, 2025 at 12:07 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 15 Feb 2025 14:23:11 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
6.13.3-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.13.3-rc1rv
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 14.2.1 20250207, GNU ld (GNU
Binutils) 2.44) #1 SMP PREEMPT_DYNAMIC Fri Feb 14 05:08:38 JST 2025
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2025-02-13 20:52 ` Takeshi Ogasawara
@ 2025-02-13 22:57 ` Justin Forbes
2025-02-13 23:59 ` Mark Brown
` (6 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Justin Forbes @ 2025-02-13 22:57 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
On Thu, Feb 13, 2025 at 03:22:45PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 15 Feb 2025 14:23:11 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x,
x86_64), and boot tested x86_64. No regressions noted.
Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2025-02-13 22:57 ` Justin Forbes
@ 2025-02-13 23:59 ` Mark Brown
2025-02-14 0:58 ` [PATCH 6.13 000/619] " Hardik Garg
` (5 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Mark Brown @ 2025-02-13 23:59 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar
[-- Attachment #1: Type: text/plain, Size: 345 bytes --]
On Thu, Feb 13, 2025 at 03:22:45PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Tested-by: Mark Brown <broonie@kernel.org>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/619] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2025-02-13 23:59 ` Mark Brown
@ 2025-02-14 0:58 ` Hardik Garg
2025-02-14 3:52 ` [PATCH 6.13 000/443] " Peter Schneider
` (4 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Hardik Garg @ 2025-02-14 0:58 UTC (permalink / raw)
To: gregkh
Cc: akpm, broonie, conor, f.fainelli, hargar, jonathanh, linux-kernel,
linux, lkft-triage, patches, patches, pavel, rwarsow, shuah, srw,
stable, sudipm.mukherjee, torvalds
The kernel, bpf tool, perf tool, and kselftest builds fine for v6.13.3-rc1 on x86 and arm64 Azure VM.
Kernel binary size for x86 build:
text data bss dec hex filename
29934888 17832018 6320128 54087034 3394d7a vmlinux
Kernel binary size for arm64 build:
text data bss dec hex filename
36672710 15080089 1054416 52807215 325c62f vmlinux
Tested-by: Hardik Garg <hargar@linux.microsoft.com>
Thanks,
Hardik
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2025-02-14 0:58 ` [PATCH 6.13 000/619] " Hardik Garg
@ 2025-02-14 3:52 ` Peter Schneider
2025-02-14 6:09 ` Ron Economos
` (3 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Peter Schneider @ 2025-02-14 3:52 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, hargar, broonie
Am 13.02.2025 um 15:22 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg
oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2025-02-14 3:52 ` [PATCH 6.13 000/443] " Peter Schneider
@ 2025-02-14 6:09 ` Ron Economos
2025-02-14 6:42 ` Luna Jernberg
` (2 subsequent siblings)
453 siblings, 0 replies; 474+ messages in thread
From: Ron Economos @ 2025-02-14 6:09 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, hargar, broonie
On 2/13/25 06:22, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 15 Feb 2025 14:23:11 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2025-02-14 6:09 ` Ron Economos
@ 2025-02-14 6:42 ` Luna Jernberg
2025-02-14 10:16 ` Luna Jernberg
2025-02-14 8:32 ` Holger Hoffstätte
2025-02-14 9:45 ` [PATCH 6.13 000/443] 6.13.3-rc1 review Jon Hunter
453 siblings, 1 reply; 474+ messages in thread
From: Luna Jernberg @ 2025-02-14 6:42 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
Tested-by: Luna Jernberg <droidbittin@gmail.com>
AMD Ryzen 5 5600 6-Core Processor:
https://www.inet.se/produkt/5304697/amd-ryzen-5-5600-3-5-ghz-35mb on a
https://www.gigabyte.com/Motherboard/B550-AORUS-ELITE-V2-rev-12
https://www.inet.se/produkt/1903406/gigabyte-b550-aorus-elite-v2
motherboard :)
running Arch Linux with the testing repos enabled:
https://archlinux.org/ https://archboot.com/
https://wiki.archlinux.org/title/Arch_Testing_Team
Den tors 13 feb. 2025 kl 16:12 skrev Greg Kroah-Hartman
<gregkh@linuxfoundation.org>:
>
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 15 Feb 2025 14:23:11 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.13.3-rc1
>
> Miklos Szeredi <mszeredi@redhat.com>
> fs: fix adding security options to statmount.mnt_opt
>
> Jeff Layton <jlayton@kernel.org>
> fs: prepend statmount.mnt_opts string with security_sb_mnt_opts()
>
> Ping-Ke Shih <pkshih@realtek.com>
> wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
>
> Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
> Revert "drm/amd/display: Fix green screen issue after suspend"
>
> Bart Van Assche <bvanassche@acm.org>
> md: Fix linear_set_limits()
>
> Dan Carpenter <dan.carpenter@linaro.org>
> md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add()
>
> Peter Zijlstra <peterz@infradead.org>
> x86/mm: Convert unreachable() to BUG()
>
> Bence Csókás <csokas.bence@prolan.hu>
> spi: atmel-qspi: Memory barriers after memory-mapped I/O
>
> Csókás, Bence <csokas.bence@prolan.hu>
> spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
>
> WangYuli <wangyuli@uniontech.com>
> MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
>
> Heiko Carstens <hca@linux.ibm.com>
> s390/fpu: Add fpc exception handler / remove fixup section again
>
> Frederic Weisbecker <frederic@kernel.org>
> timers/migration: Fix off-by-one root mis-connection
>
> Miklos Szeredi <mszeredi@redhat.com>
> statmount: let unset strings be empty
>
> Michal Simek <michal.simek@amd.com>
> rtc: zynqmp: Fix optional clock name property
>
> Yishai Hadas <yishaih@nvidia.com>
> RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
>
> Thomas Weißschuh <linux@weissschuh.net>
> ptp: Ensure info->enable callback is always set
>
> Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
> pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E
>
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
> pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails
>
> Tomas Glozar <tglozar@redhat.com>
> rtla/timerlat_top: Stop timerlat tracer on signal
>
> Tomas Glozar <tglozar@redhat.com>
> rtla/timerlat_hist: Stop timerlat tracer on signal
>
> Tomas Glozar <tglozar@redhat.com>
> rtla: Add trace_instance_stop
>
> Tomas Glozar <tglozar@redhat.com>
> rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
>
> Tomas Glozar <tglozar@redhat.com>
> rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
>
> Tomas Glozar <tglozar@redhat.com>
> rtla/osnoise: Distinguish missing workload option
>
> Steven Rostedt <rostedt@goodmis.org>
> tracing/osnoise: Fix resetting of tracepoints
>
> Jan Kiszka <jan.kiszka@siemens.com>
> scripts/gdb: fix aarch64 userspace detection in get_current_task
>
> Wei Yang <richard.weiyang@gmail.com>
> maple_tree: simplify split calculation
>
> Milos Reljin <milos_reljin@outlook.com>
> net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
>
> Paul Fertser <fercerpav@gmail.com>
> net/ncsi: wait for the last response to Deselect Package before configuring channel
>
> Ekansh Gupta <quic_ekangupt@quicinc.com>
> misc: fastrpc: Fix copy buffer page size
>
> Ekansh Gupta <quic_ekangupt@quicinc.com>
> misc: fastrpc: Fix registered buffer page address
>
> Anandu Krishnan E <quic_anane@quicinc.com>
> misc: fastrpc: Deregister device nodes properly in error scenarios
>
> Vimal Agrawal <vimal.agrawal@sophos.com>
> misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
>
> Ivan Stepchenko <sid@itb.spb.ru>
> mtd: onenand: Fix uninitialized retlen in do_otp_read()
>
> Nick Chan <towinchenmi@gmail.com>
> irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
>
> Frank Li <Frank.Li@nxp.com>
> i3c: master: Fix missing 'ret' assignment in set_speed()
>
> Steven Rostedt <rostedt@goodmis.org>
> fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT
>
> Dan Carpenter <dan.carpenter@linaro.org>
> NFC: nci: Add bounds checking in nci_hci_create_pipe()
>
> Uros Bizjak <ubizjak@gmail.com>
> mailbox: zynqmp: Remove invalid __percpu annotation in zynqmp_ipi_probe()
>
> Pekka Pessi <ppessi@nvidia.com>
> mailbox: tegra-hsp: Clear mailbox before using message
>
> Chuck Lever <chuck.lever@oracle.com>
> NFSD: Encode COMPOUND operation status on page boundaries
>
> Dragan Simic <dsimic@manjaro.org>
> nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> nilfs2: fix possible int overflows in nilfs_fiemap()
>
> Matthew Wilcox (Oracle) <willy@infradead.org>
> ocfs2: handle a symlink read error correctly
>
> Heming Zhao <heming.zhao@suse.com>
> ocfs2: fix incorrect CPU endianness conversion causing mount failure
>
> Mike Snitzer <snitzer@kernel.org>
> pnfs/flexfiles: retry getting layout segment for reads
>
> Matthieu Baerts (NGI0) <matttbe@kernel.org>
> selftests: mptcp: connect: -f: no reconnect
>
> Alex Williamson <alex.williamson@redhat.com>
> vfio/platform: check the bounds of read/write syscalls
>
> Jens Axboe <axboe@kernel.dk>
> io_uring/net: don't retry connect operation on EPOLLERR
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring: fix multishots with selected buffers
>
> Sascha Hauer <s.hauer@pengutronix.de>
> nvmem: imx-ocotp-ele: set word length to 1
>
> Sascha Hauer <s.hauer@pengutronix.de>
> nvmem: imx-ocotp-ele: fix reading from non zero offset
>
> Sascha Hauer <s.hauer@pengutronix.de>
> nvmem: imx-ocotp-ele: fix MAC address byte order
>
> Sascha Hauer <s.hauer@pengutronix.de>
> nvmem: imx-ocotp-ele: simplify read beyond device check
>
> Jennifer Berringer <jberring@redhat.com>
> nvmem: core: improve range check for nvmem_cell_write()
>
> Luca Weiss <luca.weiss@fairphone.com>
> nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
>
> Antoine Viallon <antoine@lesviallon.fr>
> ceph: fix memory leak in ceph_mds_auth_match()
>
> Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> crypto: qce - unregister previously registered algos in error path
>
> Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> crypto: qce - fix goto jump in error path
>
> Stefan Eichenberger <eichest@gmail.com>
> irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data
>
> Niklas Cassel <cassel@kernel.org>
> ata: libata-sff: Ensure that we cannot write outside the allocated buffer
>
> Daniel Baumann <daniel@debian.org>
> ata: libata-core: Add ATA_QUIRK_NOLPM for Samsung SSD 870 QVO drives
>
> Liu Shixin <liushixin2@huawei.com>
> mm/compaction: fix UBSAN shift-out-of-bounds warning
>
> Ritesh Harjani (IBM) <ritesh.list@gmail.com>
> mm/hugetlb: fix hugepage allocation for interleaved memory nodes
>
> Li Zhijian <lizhijian@fujitsu.com>
> mm/vmscan: accumulate nr_demoted for accurate demotion statistics
>
> Zhaoyang Huang <zhaoyang.huang@unisoc.com>
> mm: gup: fix infinite loop within __get_longterm_locked
>
> Catalin Marinas <catalin.marinas@arm.com>
> mm: kmemleak: fix upper boundary check for physical address objects
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Remove dangling pointers
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Remove redundant NULL assignment
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Only save async fh if success
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Support partial control reads
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Fix event flags in uvc_ctrl_send_events
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Fix crash during unbind if gpio unit is in use
>
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
>
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> media: i2c: ds90ub960: Fix UB9702 VC map
>
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
>
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
>
> Mehdi Djait <mehdi.djait@linux.intel.com>
> media: ccs: Fix cleanup order in ccs_probe()
>
> Sakari Ailus <sakari.ailus@linux.intel.com>
> media: ccs: Fix CCS static data parsing for large block sizes
>
> Sergey Senozhatsky <senozhatsky@chromium.org>
> media: venus: destroy hfi session after m2m_ctx release
>
> Alain Volmat <alain.volmat@foss.st.com>
> media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
>
> Sam Bobrowicz <sam@elite-embedded.com>
> media: ov5640: fix get_light_freq on auto
>
> Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
> media: intel/ipu6: remove cpu latency qos request on error
>
> Naushir Patuck <naush@raspberrypi.com>
> media: imx296: Add standby delay during probe
>
> Zhen Lei <thunder.leizhen@huawei.com>
> media: nuvoton: Fix an error check in npcm_video_ece_init()
>
> Cosmin Tanislav <demonsingur@gmail.com>
> media: mc: fix endpoint iteration
>
> Sakari Ailus <sakari.ailus@linux.intel.com>
> media: Documentation: tx-rx: Fix formatting
>
> Lubomir Rintel <lkundrak@v3.sk>
> media: mmp: Bring back registration of the device
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> soc: qcom: smem_state: fix missing of_node_put in error path
>
> Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> soc: qcom: llcc: Enable LLCC_WRCACHE at boot on X1
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> soc: samsung: exynos-pmu: Fix uninitialized ret in tensor_set_bits_atomic()
>
> Nicolin Chen <nicolinc@nvidia.com>
> iommufd/fault: Use a separate spinlock to protect fault->deliver list
>
> Nicolin Chen <nicolinc@nvidia.com>
> iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()
>
> Nicolin Chen <nicolinc@nvidia.com>
> iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding
>
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
> iio: light: as73211: fix channel handling in only-color triggered buffer
>
> Angelo Dureghello <adureghello@baylibre.com>
> iio: dac: ad3552r-hs: clear reset status flag
>
> Angelo Dureghello <adureghello@baylibre.com>
> iio: dac: ad3552r-common: fix ad3541/2r ranges
>
> Dan Carpenter <dan.carpenter@linaro.org>
> iio: chemical: bme680: Fix uninitialized variable in __bme680_read_raw()
>
> Peter Xu <peterx@redhat.com>
> mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
>
> Sakari Ailus <sakari.ailus@linux.intel.com>
> media: ccs: Clean up parsed CCS static data on parse failure
>
> Marco Elver <elver@google.com>
> kfence: skip __GFP_THISNODE allocations on NUMA systems
>
> Nicolin Chen <nicolinc@nvidia.com>
> iommufd: Fix struct iommu_hwpt_pgfault init and padding
>
> Easwar Hariharan <eahariha@linux.microsoft.com>
> jiffies: Cast to unsigned long in secs_to_jiffies() conversion
>
> Frederic Weisbecker <frederic@kernel.org>
> hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
>
> Gabriele Monaco <gmonaco@redhat.com>
> rv: Reset per-task monitors also for idle tasks
>
> Jarkko Sakkinen <jarkko@kernel.org>
> tpm: Change to kvalloc() in eventlog/acpi.c
>
> Aubrey Li <aubrey.li@linux.intel.com>
> ACPI: PRM: Remove unnecessary strict handler address checks
>
> Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> accel/ivpu: Fix error handling in recovery/reset
>
> Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails
>
> Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> accel/ivpu: Fix error handling in ivpu_boot()
>
> Wentao Liang <vulab@iscas.ac.cn>
> xfs: Add error handling for xfs_reflink_cancel_cow_range
>
> Wentao Liang <vulab@iscas.ac.cn>
> xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end
>
> Christoph Hellwig <hch@lst.de>
> xfs: don't call remap_verify_area with sb write protection held
>
> Conor Dooley <conor.dooley@microchip.com>
> pwm: microchip-core: fix incorrect comparison with max period
>
> Helge Deller <deller@kernel.org>
> parisc: Temporarily disable jump label support
>
> Sumit Gupta <sumitg@nvidia.com>
> arm64: tegra: Disable Tegra234 sce-fabric node
>
> Sumit Gupta <sumitg@nvidia.com>
> arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
>
> Eric Biggers <ebiggers@google.com>
> crypto: qce - fix priority to be less than ARMv8 CE
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> arm64: dts: qcom: sm8650: correct MDSS interconnects
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> arm64: dts: qcom: sm8550: correct MDSS interconnects
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8650: Fix MPSS memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8650: Fix CDSP memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8650: Fix ADSP memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8550: Fix MPSS memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8550: Fix CDSP memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8550: Fix ADSP memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8450: Fix MPSS memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8450: Fix CDSP memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8450: Fix ADSP memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8350: Fix MPSS memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8350: Fix CDSP memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm8350: Fix ADSP memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm6375: Fix MPSS memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm6375: Fix CDSP memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm6375: Fix ADSP memory length
>
> Luca Weiss <luca.weiss@fairphone.com>
> arm64: dts: qcom: sm6350: Fix uart1 interconnect path
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm6350: Fix MPSS memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm6350: Fix ADSP memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm6115: Fix ADSP memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm6115: Fix CDSP memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sm6115: Fix MPSS memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: x1e80100: Fix CDSP memory length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: x1e80100: Fix ADSP memory base and length
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> arm64: dts: qcom: sdx75: Fix MPSS memory length
>
> Chen-Yu Tsai <wenst@chromium.org>
> arm64: dts: mediatek: mt8183: Disable DSI display output by default
>
> Chen-Yu Tsai <wenst@chromium.org>
> arm64: dts: mediatek: mt8183: Disable DPI display output by default
>
> Andreas Kemnade <andreas@kemnade.info>
> ARM: dts: ti/omap: gta04: fix pm issues caused by spi module
>
> Romain Naour <romain.naour@skf.com>
> ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
>
> Denis Arefev <arefev@swemel.ru>
> ubi: Add a check for ubi_num
>
> Nathan Chancellor <nathan@kernel.org>
> x86/boot: Use '-std=gnu11' to fix build with GCC 15
>
> Zhang Rui <rui.zhang@intel.com>
> x86/acpi: Fix LAPIC/x2APIC parsing order
>
> Alice Ryhl <aliceryhl@google.com>
> x86: rust: set rustc-abi=x86-softfloat on rustc>=1.86.0
>
> Miguel Ojeda <ojeda@kernel.org>
> rust: init: use explicit ABI to clean warning in future compilers
>
> Christian Brauner <brauner@kernel.org>
> pidfs: improve ioctl handling
>
> Christian Brauner <brauner@kernel.org>
> pidfs: check for valid ioctl commands
>
> Nathan Chancellor <nathan@kernel.org>
> kbuild: Move -Wenum-enum-conversion to W=2
>
> Igor Pylypiv <ipylypiv@google.com>
> scsi: core: Do not retry I/Os during depopulation
>
> Long Li <longli@microsoft.com>
> scsi: storvsc: Set correct data length for sending SCSI command without payload
>
> André Draszik <andre.draszik@linaro.org>
> scsi: ufs: core: Fix use-after free in init error and remove paths
>
> Eric Biggers <ebiggers@google.com>
> scsi: ufs: qcom: Fix crypto key eviction
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Move FCE Trace buffer allocation to user control
>
> Kai Mäkisara <Kai.Makisara@kolumbus.fi>
> scsi: st: Don't set pos_unknown just after device recognition
>
> Sean Christopherson <seanjc@google.com>
> KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
>
> Georg Gottleuber <ggo@tuxedocomputers.com>
> nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
>
> Georg Gottleuber <ggo@tuxedocomputers.com>
> nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
>
> Niklas Cassel <cassel@kernel.org>
> PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
>
> Niklas Cassel <cassel@kernel.org>
> PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
>
> Zijun Hu <quic_zijuhu@quicinc.com>
> PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
>
> Werner Sembach <wse@tuxedocomputers.com>
> PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
>
> Niklas Schnelle <schnelle@linux.ibm.com>
> s390/pci: Fix SR-IOV for PFs initially in standby
>
> Brad Griffis <bgriffis@nvidia.com>
> arm64: tegra: Fix Tegra234 PCIe interrupt-map
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130
>
> Kuan-Wei Chiu <visitorckw@gmail.com>
> ALSA: hda: Fix headset detection failure due to unstable sort
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: hda/realtek: Fix quirk matching for Legion Pro 7
>
> Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
> ALSA: hda/realtek: Enable headset mic on Positivo C6400
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available()
>
> Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
> Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
>
> Jens Axboe <axboe@kernel.dk>
> block: don't revert iter for -EIOCBQUEUED
>
> Xi Ruoyao <xry111@xry111.site>
> Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT"
>
> Jiaxun Yang <jiaxun.yang@flygoat.com>
> MIPS: pci-legacy: Override pci_address_to_pio
>
> Mateusz Jończyk <mat.jonczyk@o2.pl>
> mips/math-emu: fix emulation of the prefx instruction
>
> Hou Tao <houtao1@huawei.com>
> dm-crypt: track tag_offset in convert_context
>
> Hou Tao <houtao1@huawei.com>
> dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
>
> Narayana Murty N <nnmlinux@linux.ibm.com>
> powerpc/pseries/eeh: Fix get PE state translation
>
> Tiezhu Yang <yangtiezhu@loongson.cn>
> LoongArch: Extend the maximum number of watchpoints
>
> Kexy Biscuit <kexybiscuit@aosc.io>
> MIPS: Loongson64: remove ROM Size unit in boardinfo
>
> Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
>
> Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> serial: sh-sci: Drop __initdata macro for port_cfg
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> soc: qcom: socinfo: Avoid out of bounds read of serial number
>
> Mario Limonciello <mario.limonciello@amd.com>
> ASoC: acp: Support microphone from Lenovo Go S
>
> Dan Carpenter <dan.carpenter@linaro.org>
> ASoC: renesas: rz-ssi: Add a check for negative sample_space
>
> Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> ASoC: renesas: rz-ssi: Terminate all the DMA transactions
>
> Abel Vesa <abel.vesa@linaro.org>
> arm64: dts: qcom: x1e80100: Fix usb_2 controller interrupts
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> arm64: dts: qcom: x1e80100-microsoft-romulus: Fix USB QMP PHY supplies
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix USB QMP PHY supplies
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> arm64: dts: qcom: x1e80100-crd: Fix USB QMP PHY supplies
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Fix USB QMP PHY supplies
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> arm64: dts: qcom: x1e80100-qcp: Fix USB QMP PHY supplies
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> arm64: dts: qcom: x1e80100-dell-xps13-9345: Fix USB QMP PHY supplies
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies
>
> Foster Snowhill <forst@pen.gy>
> usbnet: ipheth: document scope of NCM implementation
>
> Foster Snowhill <forst@pen.gy>
> usbnet: ipheth: fix DPE OoB read
>
> Foster Snowhill <forst@pen.gy>
> usbnet: ipheth: break up NCM header size computation
>
> Foster Snowhill <forst@pen.gy>
> usbnet: ipheth: refactor NCM datagram loop
>
> Foster Snowhill <forst@pen.gy>
> usbnet: ipheth: check that DPE points past NCM header
>
> Foster Snowhill <forst@pen.gy>
> usbnet: ipheth: use static NDP16 location in URB
>
> Foster Snowhill <forst@pen.gy>
> usbnet: ipheth: fix possible overflow in DPE length check
>
> Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> usb: gadget: f_tcm: Don't prepare BOT write request twice
>
> Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
>
> Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> usb: gadget: f_tcm: Decrement command ref count on cleanup
>
> Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> usb: gadget: f_tcm: Translate error to sense
>
> Vasily Khoruzhick <anarsoul@gmail.com>
> wifi: rtw88: 8703b: Fix RX/TX issues
>
> Shayne Chen <shayne.chen@mediatek.com>
> wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
>
> Fiona Klute <fiona.klute@gmx.de>
> wifi: rtw88: sdio: Fix disconnection after beacon loss
>
> Nick Morrow <usbwifi2024@gmail.com>
> wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
>
> Marcel Hamer <marcel.hamer@windriver.com>
> wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
>
> Bitterblue Smith <rtl8821cerfe2@gmail.com>
> wifi: rtlwifi: rtl8821ae: Fix media status report
>
> Steven Rostedt <rostedt@goodmis.org>
> atomic64: Use arch_spin_locks instead of raw_spin_locks
>
> Steven Rostedt <rostedt@goodmis.org>
> ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
>
> Heiko Stuebner <heiko@sntech.de>
> HID: hid-sensor-hub: don't use stale platform-data on remove
>
> Peng Fan <peng.fan@nxp.com>
> Input: bbnsm_pwrkey - add remove hook
>
> Zijun Hu <quic_zijuhu@quicinc.com>
> of: reserved-memory: Warn for missing static reserved memory regions
>
> Zijun Hu <quic_zijuhu@quicinc.com>
> of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
>
> Zijun Hu <quic_zijuhu@quicinc.com>
> of: Fix of_find_node_opts_by_path() handling of alias+path+options
>
> Thomas Weißschuh <thomas.weissschuh@linutronix.de>
> of: address: Fix empty resource handling in __of_address_resource_bounds()
>
> Zijun Hu <quic_zijuhu@quicinc.com>
> of: Correct child specifier used as input of the 2nd nexus node
>
> Bao D. Nguyen <quic_nguyenb@quicinc.com>
> scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
>
> Kuan-Wei Chiu <visitorckw@gmail.com>
> perf bench: Fix undefined behavior in cmpworker()
>
> Dave Young <dyoung@redhat.com>
> x86/efi: skip memattr table on kexec boot
>
> Nathan Chancellor <nathan@kernel.org>
> efi: libstub: Use '-std=gnu11' to fix build with GCC 15
>
> Zijun Hu <quic_zijuhu@quicinc.com>
> blk-cgroup: Fix class @block_class's subsystem refcount leakage
>
> Eyal Birger <eyal.birger@gmail.com>
> seccomp: passthrough uretprobe systemcall without filtering
>
> Daniel Golle <daniel@makrotopia.org>
> clk: mediatek: mt2701-mm: add missing dummy clk
>
> Daniel Golle <daniel@makrotopia.org>
> clk: mediatek: mt2701-img: add missing dummy clk
>
> Daniel Golle <daniel@makrotopia.org>
> clk: mediatek: mt2701-bdp: add missing dummy clk
>
> Daniel Golle <daniel@makrotopia.org>
> clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe
>
> Daniel Golle <daniel@makrotopia.org>
> clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
>
> Anastasia Belova <abelova@astralinux.ru>
> clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
>
> Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
> clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
>
> Luca Weiss <luca.weiss@fairphone.com>
> clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
>
> Luca Weiss <luca.weiss@fairphone.com>
> clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
>
> Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during gdsc_disable()
>
> Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
>
> Gabor Juhos <j4g8y7@gmail.com>
> clk: qcom: clk-alpha-pll: fix alpha mode configuration
>
> Binbin Zhou <zhoubinbin@loongson.cn>
> clk: clk-loongson2: Fix the number count of clk provider
>
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> media: i2c: ds90ub960: Fix UB9702 refclk register access
>
> Lubomir Rintel <lkundrak@v3.sk>
> clk: mmp2: call pm_genpd_init() only after genpd.name is set
>
> Cody Eksal <masterr3c0rd@epochal.quest>
> clk: sunxi-ng: a100: enable MMC clock reparenting
>
> Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Input: synaptics - fix crash when enabling pass-through port
>
> David Gstir <david@sigma-star.at>
> KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
>
> Lucas De Marchi <lucas.demarchi@intel.com>
> drm/xe: Fix and re-enable xe_print_blob_ascii85()
>
> Lo-an Chen <lo-an.chen@amd.com>
> drm/amd/display: Fix seamless boot sequence
>
> Marek Olšák <marek.olsak@amd.com>
> drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan
>
> Ville Syrjälä <ville.syrjala@linux.intel.com>
> drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
>
> Jani Nikula <jani.nikula@intel.com>
> drm/i915/dp: Iterate DSC BPP from high to low on all platforms
>
> Lucas De Marchi <lucas.demarchi@intel.com>
> drm/xe/devcoredump: Move exec queue snapshot to Contexts section
>
> Haoxiang Li <haoxiang_li2024@163.com>
> drm/komeda: Add check for komeda_get_layer_fourcc_list()
>
> Thomas Zimmermann <tzimmermann@suse.de>
> drm/ast: astdp: Fix timeout for enabling video signal
>
> Brian Geffon <bgeffon@google.com>
> drm/i915: Fix page cleanup on DMA remap failure
>
> Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
> drm/i915/guc: Debug print LRC state entries only if the context is pinned
>
> Tom Chung <chiahsuan.chung@amd.com>
> Revert "drm/amd/display: Use HW lock mgr for PSR1"
>
> Jay Cornwall <jay.cornwall@amd.com>
> drm/amdkfd: Block per-queue reset when halt_if_hws_hang=1
>
> Prike Liang <Prike.Liang@amd.com>
> drm/amdkfd: only flush the validate MES contex
>
> Kenneth Feng <kenneth.feng@amd.com>
> drm/amd/amdgpu: change the config of cgcg on gfx12
>
> Lijo Lazar <lijo.lazar@amd.com>
> drm/amd/pm: Mark MM activity as unsupported
>
> Aric Cyr <Aric.Cyr@amd.com>
> drm/amd/display: Optimize cursor position updates
>
> Dan Carpenter <dan.carpenter@linaro.org>
> ksmbd: fix integer overflows on 32 bit systems
>
> David Hildenbrand <david@redhat.com>
> KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
>
> Keith Busch <kbusch@kernel.org>
> kvm: defer huge page recovery vhost task to later
>
> Sean Christopherson <seanjc@google.com>
> KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
>
> Chao Gao <chao.gao@intel.com>
> KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
>
> Robin Murphy <robin.murphy@arm.com>
> remoteproc: omap: Handle ARM dma_iommu_mapping
>
> Jakob Unterwurzacher <jakobunt@gmail.com>
> arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
>
> Thomas Zimmermann <tzimmermann@suse.de>
> drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
>
> Marc Zyngier <maz@kernel.org>
> KVM: arm64: timer: Always evaluate the need for a soft timer
>
> Ard Biesheuvel <ardb@kernel.org>
> arm64/mm: Reduce PA space to 48 bits when LPA2 is not enabled
>
> Mark Brown <broonie@kernel.org>
> arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
>
> Ard Biesheuvel <ardb@kernel.org>
> arm64/mm: Override PARange for !LPA2 and use it consistently
>
> Ard Biesheuvel <ardb@kernel.org>
> arm64/kvm: Configure HYP TCR.PS/DS based on host stage1
>
> Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> accel/ivpu: Fix Qemu crash when running in passthrough
>
> Xu Yang <xu.yang_2@nxp.com>
> perf: imx9_perf: Introduce AXI filter version to refactor the driver and better extension
>
> Dan Carpenter <dan.carpenter@linaro.org>
> binfmt_flat: Fix integer overflow bug on 32 bit systems
>
> Ming Lei <tom.leiming@gmail.com>
> block: mark GFP_NOIO around sysfs ->store()
>
> Nam Cao <namcao@linutronix.de>
> fs/proc: do_task_stat: Fix ESP not readable during coredump
>
> Thomas Zimmermann <tzimmermann@suse.de>
> m68k: vga: Fix I/O defines
>
> Marc Zyngier <maz@kernel.org>
> arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented
>
> Heiko Carstens <hca@linux.ibm.com>
> s390/futex: Fix FUTEX_OP_ANDN implementation
>
> Yu Kuai <yukuai3@huawei.com>
> md: reintroduce md-linear
>
> Meetakshi Setiya <msetiya@microsoft.com>
> smb: client: change lease epoch type from unsigned int to __u16
>
> Ruben Devos <devosruben6@gmail.com>
> smb: client: fix order of arguments of tracepoints
>
> Maarten Lankhorst <dev@lankhorst.se>
> drm/client: Handle tiled displays better
>
> Maarten Lankhorst <dev@lankhorst.se>
> drm/modeset: Handle tiled displays in pan_display_atomic.
>
> Pali Rohár <pali@kernel.org>
> cifs: Remove intermediate object of failed create SFU call
>
> Sebastian Wiese-Wagner <seb@fastmail.to>
> ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
>
> Alexander Sverdlin <alexander.sverdlin@siemens.com>
> leds: lp8860: Write full EEPROM, not only half of it
>
> Viresh Kumar <viresh.kumar@linaro.org>
> cpufreq: s3c64xx: Fix compilation warning
>
> Andreas Kemnade <andreas@kemnade.info>
> cpufreq: fix using cpufreq-dt as module
>
> Robin Murphy <robin.murphy@arm.com>
> PCI/TPH: Restore TPH Requester Enable correctly
>
> David Howells <dhowells@redhat.com>
> rxrpc: Fix call state set to not include the SERVER_SECURING state
>
> Ido Schimmel <idosch@nvidia.com>
> net: sched: Fix truncation of offloaded action statistics
>
> Willem de Bruijn <willemb@google.com>
> tun: revert fix group permission check
>
> Cong Wang <cong.wang@bytedance.com>
> netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
>
> Quang Le <quanglex97@gmail.com>
> pfifo_tail_enqueue: Drop new packet when sch->limit == 0
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
>
> Juergen Gross <jgross@suse.com>
> x86/xen: add FRAME_END to xen_hypercall_hvm()
>
> Juergen Gross <jgross@suse.com>
> x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> gpio: GPIO_GRGPIO should depend on OF
>
> Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> gpio: sim: lock hog configfs items if present
>
> Eric Dumazet <edumazet@google.com>
> net: rose: lock the socket in rose_bind()
>
> Jacob Moroni <mail@jakemoroni.com>
> net: atlantic: fix warning during hot unplug
>
> Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
> gpio: pca953x: Improve interrupt support
>
> David Howells <dhowells@redhat.com>
> rxrpc: Fix the rxrpc_connection attend queue handling
>
> Jakub Kicinski <kuba@kernel.org>
> selftests: drv-net: rss_ctx: add missing cleanup in queue reconfigure
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: ntuple: fix rss + ring_cookie check
>
> Jakub Kicinski <kuba@kernel.org>
> ethtool: rss: fix hiding unsupported fields in dumps
>
> Michal Wajdeczko <michal.wajdeczko@intel.com>
> drm/xe/pf: Fix migration initialization
>
> Ashutosh Dixit <ashutosh.dixit@intel.com>
> drm/xe/oa: Preserve oa_ctrl unused bits
>
> Ankit Nautiyal <ankit.k.nautiyal@intel.com>
> drm/i915/dp: fix the Adaptive sync Operation mode for SDP
>
> Suraj Kandpal <suraj.kandpal@intel.com>
> drm/i915/hdcp: Fix Repeater authentication during topology change
>
> Yan Zhai <yan@cloudflare.com>
> udp: gso: do not drop small packets when PMTU reduces
>
> Lenny Szubowicz <lszubowi@redhat.com>
> tg3: Disable tg3 PCIe AER on system reboot
>
> Sankararaman Jayaraman <sankararaman.jayaraman@broadcom.com>
> vmxnet3: Fix tx queue race condition with XDP
>
> Jiasheng Jiang <jiashengjiangcool@gmail.com>
> ice: Add check for devm_kzalloc()
>
> Florian Fainelli <florian.fainelli@broadcom.com>
> net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
>
> Daniel Wagner <wagi@kernel.org>
> nvme-fc: use ctrl state getter
>
> Keith Busch <kbusch@kernel.org>
> nvme: make nvme_tls_attrs_group static
>
> Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> ice: stop storing XDP verdict within ice_rx_buf
>
> Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> ice: gather page_count()'s of each frag right before XDP prog call
>
> Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> ice: put Rx buffers after being done with current frame
>
> Hans Verkuil <hverkuil@xs4all.nl>
> gpu: drm_dp_cec: fix broken CEC adapter properties check
>
> Prasad Pandit <pjp@fedoraproject.org>
> firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
>
> Sagi Grimberg <sagi@grimberg.me>
> nvmet: fix a memory leak in controller identify
>
> Daniel Wagner <wagi@kernel.org>
> nvme: handle connectivity loss in nvme_set_queue_count
>
> K Prateek Nayak <kprateek.nayak@amd.com>
> sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
>
> Günther Noack <gnoack@google.com>
> tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
>
> Sean Anderson <sean.anderson@linux.dev>
> tty: xilinx_uartps: split sysrq handling
>
> Armin Wolf <W_Armin@gmx.de>
> platform/x86: acer-wmi: Ignore AC events
>
> Hridesh MG <hridesh699@gmail.com>
> platform/x86: acer-wmi: add support for Acer Nitro AN515-58
>
> Illia Ostapyshyn <illia@yshyn.com>
> Input: allocate keycode for phone linking
>
> Yu-Chun Lin <eleanor15x@gmail.com>
> ASoC: amd: Add ACPI dependency to fix build error
>
> Armin Wolf <W_Armin@gmx.de>
> platform/x86: acer-wmi: Add support for Acer Predator PH16-72
>
> Kees Bakker <kees@ijzerbout.nl>
> iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE
>
> Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
> ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
>
> Armin Wolf <W_Armin@gmx.de>
> platform/x86: acer-wmi: Add support for Acer PH14-51
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: int3472: Check for adev == NULL
>
> Robin Murphy <robin.murphy@arm.com>
> iommu/arm-smmu-v3: Clean up more on probe failure
>
> Richard Acayan <mailingradian@gmail.com>
> iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
>
> Simon Trimmer <simont@opensource.cirrus.com>
> ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7
>
> David Woodhouse <dwmw@amazon.co.uk>
> x86/kexec: Allocate PGD for x86_64 transition page tables separately
>
> Kumar Kartikeya Dwivedi <memxor@gmail.com>
> bpf: Improve verifier log for resource leak on exit
>
> Bard Liao <yung-chuan.liao@linux.intel.com>
> ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
>
> Roger Quadros <rogerq@kernel.org>
> net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path
>
> Liu Ye <liuye@kylinos.cn>
> selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
>
> Dan Carpenter <dan.carpenter@linaro.org>
> tipc: re-order conditions in tipc_crypto_key_rcv()
>
> Shinas Rasheed <srasheed@marvell.com>
> octeon_ep_vf: update tx/rx stats locally for persistence
>
> Shinas Rasheed <srasheed@marvell.com>
> octeon_ep: update tx/rx stats locally for persistence
>
> Yuanjie Yang <quic_yuanjiey@quicinc.com>
> mmc: sdhci-msm: Correctly set the load for the regulator
>
> Luke D. Jones <luke@ljones.dev>
> HID: hid-asus: Disable OOBE mode on the ProArt P16
>
> Maciej S. Szmigiero <mail@maciej.szmigiero.name>
> net: wwan: iosm: Fix hibernation by re-binding the driver around it
>
> Mazin Al Haddad <mazin@getstate.dev>
> Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
>
> En-Wei Wu <en-wei.wu@canonical.com>
> Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
>
> Andrew Halaney <ajhalaney@gmail.com>
> Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
>
> Mark Dietzer <git@doridian.net>
> Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x
>
> Borislav Petkov <bp@alien8.de>
> APEI: GHES: Have GHES honor the panic= setting
>
> Randolph Ha <rha051117@gmail.com>
> i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
>
> Miri Korenblit <miriam.rachel.korenblit@intel.com>
> wifi: iwlwifi: avoid memory leak
>
> Somashekhar(Som) <somashekhar.puttagangaiah@intel.com>
> wifi: iwlwifi: pcie: Add support for new device ids
>
> Stefan Dösinger <stefan@codeweavers.com>
> wifi: brcmfmac: Check the return value of of_property_read_string_index()
>
> Andre Przywara <andre.przywara@arm.com>
> Revert "mfd: axp20x: Allow multiple regulators"
>
> Vadim Fedorenko <vadim.fedorenko@linux.dev>
> net/mlx5: use do_aux_work for PHC overflow checks
>
> Even Xu <even.xu@intel.com>
> HID: Wacom: Add PCI Wacom device support
>
> Youwan Wang <youwan@nfschina.com>
> HID: multitouch: Add quirk for Hantick 5288 touchpad
>
> Yevgeny Kliteynik <kliteyn@nvidia.com>
> net/mlx5: HWS, num_of_rules counter on matcher should be atomic
>
> Yevgeny Kliteynik <kliteyn@nvidia.com>
> net/mlx5: HWS, change error flow on matcher disconnect
>
> Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> clk: qcom: Make GCC_8150 depend on QCOM_GDSC
>
> Ping-Ke Shih <pkshih@realtek.com>
> wifi: rtw88: add __packed attribute to efuse layout struct
>
> Hans de Goede <hdegoede@redhat.com>
> mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
>
> Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> tomoyo: don't emit warning in tomoyo_write_control()
>
> Dmitry Antipov <dmantipov@yandex.ru>
> wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
>
> Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com>
> mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
>
> Shawn Lin <shawn.lin@rock-chips.com>
> mmc: core: Respect quirk_max_rate for non-UHS SDIO card
>
> Stas Sergeev <stsp2@yandex.ru>
> tun: fix group permission check
>
> Chih-Kang Chang <gary.chang@realtek.com>
> wifi: rtw89: add crystal_cap check to avoid setting as overflow value
>
> Kalle Valo <quic_kvalo@quicinc.com>
> wifi: ath12k: ath12k_mac_op_set_key(): fix uninitialized symbol 'ret'
>
> Karol Przybylski <karprzy7@gmail.com>
> wifi: ath12k: Fix for out-of bound access error
>
> Jeongjun Park <aha310510@gmail.com>
> ring-buffer: Make reading page consistent with the code logic
>
> Gabe Teeger <Gabe.Teeger@amd.com>
> drm/amd/display: Limit Scaling Ratio on DCN3.01
>
> Nathan Chancellor <nathan@kernel.org>
> drm/amd/display: Increase sanitizer frame larger than limit when compile testing with clang
>
> Leo Stone <leocstone@gmail.com>
> safesetid: check size of policy writes
>
> Hermes Wu <hermes.wu@ite.com.tw>
> drm/bridge: it6505: fix HDCP CTS KSV list wait timer
>
> Hermes Wu <hermes.wu@ite.com.tw>
> drm/bridge: it6505: fix HDCP CTS compare V matching
>
> Hermes Wu <hermes.wu@ite.com.tw>
> drm/bridge: it6505: fix HDCP encryption when R0 ready
>
> Hermes Wu <hermes.wu@ite.com.tw>
> drm/bridge: it6505: fix HDCP Bstatus check
>
> Hermes Wu <hermes.wu@ite.com.tw>
> drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
>
> Philip Yang <Philip.Yang@amd.com>
> drm/amdkfd: Queue interrupt work to different CPU
>
> Philip Yang <Philip.Yang@amd.com>
> drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
>
> Fangzhi Zuo <Jerry.Zuo@amd.com>
> drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/sti: hdmi: use eld_mutex to protect access to connector->eld
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/radeon: use eld_mutex to protect access to connector->eld
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/msm/dp: use eld_mutex to protect access to connector->eld
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/exynos: hdmi: use eld_mutex to protect access to connector->eld
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/amd/display: use eld_mutex to protect access to connector->eld
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/bridge: ite-it66121: use eld_mutex to protect access to connector->eld
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/bridge: anx7625: use eld_mutex to protect access to connector->eld
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/connector: add mutex to protect ELD from concurrent access
>
> Abhinav Kumar <quic_abhinavk@quicinc.com>
> drm/msm/dpu: filter out too wide modes if no 3dmux is present
>
> Kuan-Wei Chiu <visitorckw@gmail.com>
> printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
>
> Ausef Yousof <Ausef.Yousof@amd.com>
> drm/amd/display: Overwriting dualDPP UBF values before usage
>
> Ausef Yousof <Ausef.Yousof@amd.com>
> drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/tests: hdmi: return meaningful value from set_connector_edid()
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> drm/tests: hdmi: handle empty modes in find_preferred_mode()
>
> Zhi Wang <zhiw@nvidia.com>
> nvkm: correctly calculate the available space of the GSP cmdq buffer
>
> Zhi Wang <zhiw@nvidia.com>
> nvkm/gsp: correctly advance the read pointer of GSP message queue
>
> Dustin L. Howett <dustin@howett.net>
> drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
>
> Thomas Weißschuh <linux@weissschuh.net>
> drm: panel-backlight-quirks: Add Framework 13 matte panel
>
> Thomas Weißschuh <linux@weissschuh.net>
> drm/amd/display: Add support for minimum backlight quirk
>
> Thomas Weißschuh <linux@weissschuh.net>
> drm: Add panel backlight quirks
>
> Dongwon Kim <dongwon.kim@intel.com>
> drm/virtio: New fence for every plane update
>
> Yazen Ghannam <yazen.ghannam@amd.com>
> x86/amd_nb: Restrict init function to AMD-based systems
>
> Carlos Llamas <cmllamas@google.com>
> lockdep: Fix upper limit for LOCKDEP_*_BITS configs
>
> Thorsten Blum <thorsten.blum@linux.dev>
> locking/ww_mutex/test: Use swap() macro
>
> Peter Zijlstra <peterz@infradead.org>
> x86: Convert unreachable() to BUG()
>
> Juri Lelli <juri.lelli@redhat.com>
> sched/deadline: Check bandwidth overflow earlier for hotplug
>
> Juri Lelli <juri.lelli@redhat.com>
> sched/deadline: Correctly account for allocated bandwidth during hotplug
>
> Suleiman Souhlal <suleiman@google.com>
> sched: Don't try to catch up excess steal time.
>
> Johannes Thumshirn <johannes.thumshirn@wdc.com>
> btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents
>
> Josef Bacik <josef@toxicpanda.com>
> btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
>
> Hao-ran Zheng <zhenghaoran154@gmail.com>
> btrfs: fix data race when accessing the inode's disk_i_size at btrfs_drop_extents()
>
> Sven Schnelle <svens@linux.ibm.com>
> s390/stackleak: Use exrl instead of ex in __stackleak_poison()
>
> Kees Cook <kees@kernel.org>
> exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
>
> Anshuman Khandual <anshuman.khandual@arm.com>
> arm64/mm: Ensure adequate HUGE_MAX_HSTATE
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix use-after-free when attempting to join an aborted transaction
>
> Qu Wenruo <wqu@suse.com>
> btrfs: do not output error message if a qgroup has been already cleaned up
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix assertion failure when splitting ordered extent after transaction abort
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: fix lockdep splat while merging a relocation root
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> irqchip/lan966x-oic: Make CONFIG_LAN966X_OIC depend on CONFIG_MCHP_LAN966X_PCI
>
>
> -------------
>
> Diffstat:
>
> Documentation/arch/arm64/elf_hwcaps.rst | 39 +-
> Documentation/driver-api/media/tx-rx.rst | 2 +-
> Documentation/gpu/drm-kms-helpers.rst | 3 +
> Makefile | 4 +-
> arch/arm/boot/dts/ti/omap/dra7-l4.dtsi | 2 +
> arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi | 10 +
> arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 5 -
> arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 4 -
> arch/arm64/boot/dts/mediatek/mt8183.dtsi | 2 +
> arch/arm64/boot/dts/nvidia/tegra234.dtsi | 6 +-
> arch/arm64/boot/dts/qcom/sdx75.dtsi | 2 +-
> arch/arm64/boot/dts/qcom/sm6115.dtsi | 8 +-
> arch/arm64/boot/dts/qcom/sm6350.dtsi | 6 +-
> arch/arm64/boot/dts/qcom/sm6375.dtsi | 10 +-
> arch/arm64/boot/dts/qcom/sm8350.dtsi | 492 ++++++++++-----------
> arch/arm64/boot/dts/qcom/sm8450.dtsi | 216 ++++-----
> arch/arm64/boot/dts/qcom/sm8550.dtsi | 271 ++++++------
> arch/arm64/boot/dts/qcom/sm8650.dtsi | 305 +++++++------
> .../dts/qcom/x1e78100-lenovo-thinkpad-t14s.dts | 4 +-
> .../boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 +-
> arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 6 +-
> .../boot/dts/qcom/x1e80100-dell-xps13-9345.dts | 4 +-
> .../boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 6 +-
> .../boot/dts/qcom/x1e80100-microsoft-romulus.dtsi | 4 +-
> arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 6 +-
> arch/arm64/boot/dts/qcom/x1e80100.dtsi | 280 ++++++------
> arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 2 +-
> arch/arm64/include/asm/assembler.h | 5 +
> arch/arm64/include/asm/pgtable-hwdef.h | 6 -
> arch/arm64/include/asm/pgtable-prot.h | 7 +
> arch/arm64/include/asm/sparsemem.h | 5 +-
> arch/arm64/kernel/cpufeature.c | 55 +--
> arch/arm64/kernel/cpuinfo.c | 10 +
> arch/arm64/kernel/pi/idreg-override.c | 9 +
> arch/arm64/kernel/pi/map_kernel.c | 6 +
> arch/arm64/kvm/arch_timer.c | 4 +-
> arch/arm64/kvm/arm.c | 8 +-
> arch/arm64/mm/hugetlbpage.c | 12 +
> arch/arm64/mm/init.c | 7 +-
> arch/loongarch/include/uapi/asm/ptrace.h | 10 +
> arch/loongarch/kernel/ptrace.c | 6 +-
> arch/m68k/include/asm/vga.h | 8 +-
> arch/mips/Kconfig | 1 -
> arch/mips/kernel/ftrace.c | 2 +-
> arch/mips/loongson64/boardinfo.c | 2 -
> arch/mips/math-emu/cp1emu.c | 2 +-
> arch/mips/pci/pci-legacy.c | 8 +
> arch/parisc/Kconfig | 4 +-
> arch/powerpc/platforms/pseries/eeh_pseries.c | 6 +-
> arch/s390/include/asm/asm-extable.h | 4 +
> arch/s390/include/asm/fpu-insn.h | 17 +-
> arch/s390/include/asm/futex.h | 2 +-
> arch/s390/include/asm/processor.h | 3 +-
> arch/s390/kernel/vmlinux.lds.S | 1 -
> arch/s390/kvm/vsie.c | 25 +-
> arch/s390/mm/extable.c | 9 +
> arch/s390/pci/pci_bus.c | 1 -
> arch/x86/boot/compressed/Makefile | 1 +
> arch/x86/include/asm/kexec.h | 18 +-
> arch/x86/include/asm/kvm_host.h | 2 +
> arch/x86/kernel/acpi/boot.c | 50 ++-
> arch/x86/kernel/amd_nb.c | 4 +
> arch/x86/kernel/machine_kexec_64.c | 45 +-
> arch/x86/kernel/process.c | 2 +-
> arch/x86/kernel/reboot.c | 2 +-
> arch/x86/kvm/lapic.c | 11 +
> arch/x86/kvm/lapic.h | 1 +
> arch/x86/kvm/mmu/mmu.c | 45 +-
> arch/x86/kvm/svm/sev.c | 2 +-
> arch/x86/kvm/vmx/nested.c | 5 +
> arch/x86/kvm/vmx/vmx.c | 21 +
> arch/x86/kvm/vmx/vmx.h | 1 +
> arch/x86/kvm/x86.c | 7 +-
> arch/x86/mm/fault.c | 2 +-
> arch/x86/pci/fixup.c | 30 ++
> arch/x86/platform/efi/quirks.c | 5 +
> arch/x86/xen/xen-head.S | 5 +-
> block/blk-cgroup.c | 1 +
> block/blk-sysfs.c | 3 +
> block/fops.c | 5 +-
> drivers/accel/ivpu/ivpu_drv.c | 8 +-
> drivers/accel/ivpu/ivpu_pm.c | 86 ++--
> drivers/acpi/apei/ghes.c | 10 +-
> drivers/acpi/prmt.c | 4 +-
> drivers/acpi/property.c | 10 +-
> drivers/ata/libata-core.c | 4 +
> drivers/ata/libata-sff.c | 18 +-
> drivers/bluetooth/btusb.c | 6 +
> drivers/char/misc.c | 37 +-
> drivers/char/tpm/eventlog/acpi.c | 15 +-
> drivers/clk/clk-loongson2.c | 5 +-
> drivers/clk/mediatek/clk-mt2701-aud.c | 10 +
> drivers/clk/mediatek/clk-mt2701-bdp.c | 1 +
> drivers/clk/mediatek/clk-mt2701-img.c | 1 +
> drivers/clk/mediatek/clk-mt2701-mm.c | 1 +
> drivers/clk/mediatek/clk-mt2701-vdec.c | 1 +
> drivers/clk/mmp/pwr-island.c | 2 +-
> drivers/clk/qcom/Kconfig | 1 +
> drivers/clk/qcom/clk-alpha-pll.c | 2 +
> drivers/clk/qcom/clk-rpmh.c | 2 +-
> drivers/clk/qcom/dispcc-sm6350.c | 7 +-
> drivers/clk/qcom/gcc-mdm9607.c | 2 +-
> drivers/clk/qcom/gcc-sm6350.c | 22 +-
> drivers/clk/qcom/gcc-sm8550.c | 8 +-
> drivers/clk/qcom/gcc-sm8650.c | 8 +-
> drivers/clk/sunxi-ng/ccu-sun50i-a100.c | 6 +-
> drivers/cpufreq/Kconfig | 2 +-
> drivers/cpufreq/cpufreq-dt-platdev.c | 2 -
> drivers/cpufreq/s3c64xx-cpufreq.c | 11 +-
> drivers/crypto/qce/aead.c | 2 +-
> drivers/crypto/qce/core.c | 13 +-
> drivers/crypto/qce/sha.c | 2 +-
> drivers/crypto/qce/skcipher.c | 2 +-
> drivers/firmware/Kconfig | 2 +-
> drivers/firmware/efi/libstub/Makefile | 2 +-
> drivers/firmware/qcom/qcom_scm.c | 10 +-
> drivers/gpio/Kconfig | 1 +
> drivers/gpio/gpio-pca953x.c | 19 -
> drivers/gpio/gpio-sim.c | 13 +-
> drivers/gpu/drm/Kconfig | 4 +
> drivers/gpu/drm/Makefile | 1 +
> drivers/gpu/drm/amd/amdgpu/Kconfig | 1 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 8 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 2 +
> drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 11 -
> drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 8 +-
> drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 5 +-
> drivers/gpu/drm/amd/amdkfd/kfd_device.c | 25 +-
> .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 4 +-
> drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 25 +-
> drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +-
> .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 7 +-
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 20 +-
> .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6 +-
> .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 22 +-
> .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.h | 3 +-
> drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
> .../gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 3 +-
> drivers/gpu/drm/amd/display/dc/dml2/Makefile | 4 +
> .../drm/amd/display/dc/dml2/display_mode_core.c | 35 +-
> .../display/dc/dml2/display_mode_core_structs.h | 6 +-
> drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 35 +-
> .../gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.c | 7 +-
> .../drm/amd/display/dc/dpp/dcn401/dcn401_dpp_cm.c | 6 +-
> .../drm/amd/display/dc/hubbub/dcn30/dcn30_hubbub.c | 3 +-
> .../drm/amd/display/dc/hubbub/dcn31/dcn31_hubbub.c | 3 +-
> .../drm/amd/display/dc/hubbub/dcn32/dcn32_hubbub.c | 3 +-
> .../drm/amd/display/dc/hubbub/dcn35/dcn35_hubbub.c | 3 +-
> .../gpu/drm/amd/display/dc/hubp/dcn20/dcn20_hubp.c | 8 +-
> .../gpu/drm/amd/display/dc/hubp/dcn30/dcn30_hubp.c | 2 +
> .../gpu/drm/amd/display/dc/hubp/dcn32/dcn32_hubp.c | 2 +
> .../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 10 +-
> .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 +-
> .../display/dc/resource/dcn301/dcn301_resource.c | 8 +-
> drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 1 -
> .../drm/arm/display/komeda/komeda_wb_connector.c | 4 +
> drivers/gpu/drm/ast/ast_dp.c | 2 +-
> drivers/gpu/drm/bridge/analogix/anx7625.c | 2 +
> drivers/gpu/drm/bridge/ite-it6505.c | 83 ++--
> drivers/gpu/drm/bridge/ite-it66121.c | 2 +
> drivers/gpu/drm/display/drm_dp_cec.c | 14 +-
> drivers/gpu/drm/drm_client_modeset.c | 9 +
> drivers/gpu/drm/drm_connector.c | 1 +
> drivers/gpu/drm/drm_edid.c | 6 +
> drivers/gpu/drm/drm_fb_helper.c | 14 +-
> drivers/gpu/drm/drm_panel_backlight_quirks.c | 94 ++++
> drivers/gpu/drm/exynos/exynos_hdmi.c | 2 +
> drivers/gpu/drm/i915/display/intel_dp.c | 10 +-
> drivers/gpu/drm/i915/display/intel_hdcp.c | 13 +
> drivers/gpu/drm/i915/display/skl_universal_plane.c | 4 -
> drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 6 +-
> drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 20 +-
> drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 13 +
> drivers/gpu/drm/msm/dp/dp_audio.c | 2 +
> drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 16 +-
> drivers/gpu/drm/radeon/radeon_audio.c | 2 +
> drivers/gpu/drm/rockchip/cdn-dp-core.c | 9 +-
> drivers/gpu/drm/sti/sti_hdmi.c | 2 +
> drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c | 33 +-
> drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +-
> drivers/gpu/drm/virtio/virtgpu_drv.h | 7 +
> drivers/gpu/drm/virtio/virtgpu_plane.c | 58 ++-
> drivers/gpu/drm/xe/regs/xe_oa_regs.h | 6 +
> drivers/gpu/drm/xe/xe_devcoredump.c | 42 +-
> drivers/gpu/drm/xe/xe_devcoredump.h | 2 +-
> drivers/gpu/drm/xe/xe_gt.c | 4 +-
> drivers/gpu/drm/xe/xe_gt_sriov_pf.c | 14 +-
> drivers/gpu/drm/xe/xe_gt_sriov_pf.h | 6 +
> drivers/gpu/drm/xe/xe_guc_ct.c | 3 +-
> drivers/gpu/drm/xe/xe_guc_log.c | 4 +-
> drivers/gpu/drm/xe/xe_oa.c | 12 +-
> drivers/hid/hid-asus.c | 26 ++
> drivers/hid/hid-multitouch.c | 5 +
> drivers/hid/hid-sensor-hub.c | 21 +-
> drivers/hid/wacom_wac.c | 5 +
> drivers/i2c/i2c-core-acpi.c | 22 +
> drivers/i3c/master.c | 2 +-
> drivers/iio/chemical/bme680_core.c | 4 +-
> drivers/iio/dac/ad3552r-common.c | 5 +-
> drivers/iio/dac/ad3552r-hs.c | 6 +
> drivers/iio/dac/ad3552r.h | 8 +-
> drivers/iio/light/as73211.c | 24 +-
> drivers/infiniband/hw/mlx5/mr.c | 17 +-
> drivers/infiniband/hw/mlx5/odp.c | 2 +
> drivers/input/misc/nxp-bbnsm-pwrkey.c | 8 +
> drivers/input/mouse/synaptics.c | 56 ++-
> drivers/input/mouse/synaptics.h | 1 +
> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 17 +-
> drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +-
> drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 +
> drivers/iommu/intel/iommu.c | 7 +-
> drivers/iommu/iommufd/fault.c | 44 +-
> drivers/iommu/iommufd/iommufd_private.h | 29 +-
> drivers/irqchip/Kconfig | 1 +
> drivers/irqchip/irq-apple-aic.c | 3 +-
> drivers/irqchip/irq-mvebu-icu.c | 3 +-
> drivers/leds/leds-lp8860.c | 2 +-
> drivers/mailbox/tegra-hsp.c | 6 +-
> drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +-
> drivers/md/Kconfig | 13 +
> drivers/md/Makefile | 2 +
> drivers/md/dm-crypt.c | 27 +-
> drivers/md/md-autodetect.c | 8 +-
> drivers/md/md-linear.c | 352 +++++++++++++++
> drivers/md/md.c | 2 +-
> drivers/media/i2c/ccs/ccs-core.c | 6 +-
> drivers/media/i2c/ccs/ccs-data.c | 14 +-
> drivers/media/i2c/ds90ub913.c | 1 -
> drivers/media/i2c/ds90ub953.c | 1 -
> drivers/media/i2c/ds90ub960.c | 123 +++---
> drivers/media/i2c/imx296.c | 2 +
> drivers/media/i2c/ov5640.c | 1 +
> drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 +
> drivers/media/platform/marvell/mmp-driver.c | 21 +-
> drivers/media/platform/nuvoton/npcm-video.c | 4 +-
> drivers/media/platform/qcom/venus/core.c | 8 +-
> .../st/stm32/stm32-dcmipp/dcmipp-bytecap.c | 2 +-
> drivers/media/usb/uvc/uvc_ctrl.c | 83 +++-
> drivers/media/usb/uvc/uvc_driver.c | 98 ++--
> drivers/media/usb/uvc/uvc_v4l2.c | 2 +
> drivers/media/usb/uvc/uvc_video.c | 21 +
> drivers/media/usb/uvc/uvcvideo.h | 10 +-
> drivers/media/v4l2-core/v4l2-mc.c | 2 +-
> drivers/mfd/axp20x.c | 2 +-
> drivers/mfd/lpc_ich.c | 3 +-
> drivers/misc/fastrpc.c | 8 +-
> drivers/mmc/core/sdio.c | 2 +
> drivers/mmc/host/sdhci-esdhc-imx.c | 1 +
> drivers/mmc/host/sdhci-msm.c | 53 ++-
> drivers/mtd/nand/onenand/onenand_base.c | 1 +
> drivers/mtd/ubi/build.c | 2 +-
> drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 +-
> drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 16 +-
> drivers/net/ethernet/broadcom/tg3.c | 58 +++
> drivers/net/ethernet/intel/ice/devlink/devlink.c | 3 +
> drivers/net/ethernet/intel/ice/ice_txrx.c | 150 +++++--
> drivers/net/ethernet/intel/ice/ice_txrx.h | 1 -
> drivers/net/ethernet/intel/ice/ice_txrx_lib.h | 43 --
> .../net/ethernet/marvell/octeon_ep/octep_ethtool.c | 39 +-
> .../net/ethernet/marvell/octeon_ep/octep_main.c | 19 +-
> .../net/ethernet/marvell/octeon_ep/octep_main.h | 6 +
> drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 11 +-
> drivers/net/ethernet/marvell/octeon_ep/octep_rx.h | 4 +-
> drivers/net/ethernet/marvell/octeon_ep/octep_tx.c | 7 +-
> drivers/net/ethernet/marvell/octeon_ep/octep_tx.h | 4 +-
> .../marvell/octeon_ep_vf/octep_vf_ethtool.c | 29 +-
> .../ethernet/marvell/octeon_ep_vf/octep_vf_main.c | 17 +-
> .../ethernet/marvell/octeon_ep_vf/octep_vf_main.h | 6 +
> .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 9 +-
> .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.h | 2 +-
> .../ethernet/marvell/octeon_ep_vf/octep_vf_tx.c | 7 +-
> .../ethernet/marvell/octeon_ep_vf/octep_vf_tx.h | 2 +-
> .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 24 +-
> .../ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 17 +-
> .../ethernet/mellanox/mlx5/core/steering/hws/bwc.h | 2 +-
> .../mellanox/mlx5/core/steering/hws/matcher.c | 24 +-
> drivers/net/ethernet/ti/am65-cpsw-nuss.c | 67 ++-
> drivers/net/phy/nxp-c45-tja11xx.c | 2 +
> drivers/net/tun.c | 2 +-
> drivers/net/usb/ipheth.c | 69 ++-
> drivers/net/vmxnet3/vmxnet3_xdp.c | 14 +-
> .../net/wireless/ath/ath12k/debugfs_htt_stats.c | 5 +-
> drivers/net/wireless/ath/ath12k/mac.c | 59 +--
> .../wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +
> .../net/wireless/broadcom/brcm80211/brcmfmac/of.c | 8 +-
> .../broadcom/brcm80211/brcmsmac/phy/phy_n.c | 3 +
> drivers/net/wireless/intel/iwlwifi/Makefile | 2 +-
> drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 167 +++++++
> drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 +-
> drivers/net/wireless/intel/iwlwifi/iwl-config.h | 10 +
> drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 16 +
> drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 21 +-
> drivers/net/wireless/mediatek/mt76/mt7915/init.c | 4 +-
> drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 3 +
> .../net/wireless/realtek/rtlwifi/rtl8821ae/fw.h | 4 +-
> drivers/net/wireless/realtek/rtw88/main.h | 4 +-
> drivers/net/wireless/realtek/rtw88/rtw8703b.c | 8 +-
> drivers/net/wireless/realtek/rtw88/rtw8723x.h | 8 +-
> drivers/net/wireless/realtek/rtw88/rtw8821c.h | 9 +-
> drivers/net/wireless/realtek/rtw88/rtw8822b.h | 9 +-
> drivers/net/wireless/realtek/rtw88/rtw8822c.h | 9 +-
> drivers/net/wireless/realtek/rtw88/sdio.c | 2 +
> drivers/net/wireless/realtek/rtw89/pci.c | 16 +-
> drivers/net/wireless/realtek/rtw89/pci.h | 9 +
> drivers/net/wireless/realtek/rtw89/pci_be.c | 1 +
> drivers/net/wireless/realtek/rtw89/phy.c | 13 +-
> drivers/net/wireless/realtek/rtw89/phy.h | 2 +-
> drivers/net/wwan/iosm/iosm_ipc_pcie.c | 56 ++-
> drivers/nvme/host/core.c | 8 +-
> drivers/nvme/host/fc.c | 9 +-
> drivers/nvme/host/pci.c | 4 +-
> drivers/nvme/host/sysfs.c | 2 +-
> drivers/nvme/target/admin-cmd.c | 1 +
> drivers/nvmem/core.c | 2 +
> drivers/nvmem/imx-ocotp-ele.c | 38 +-
> drivers/nvmem/qcom-spmi-sdam.c | 1 +
> drivers/of/address.c | 12 +-
> drivers/of/base.c | 8 +-
> drivers/of/of_reserved_mem.c | 9 +-
> drivers/pci/controller/dwc/pcie-designware-ep.c | 48 +-
> drivers/pci/endpoint/pci-epf-core.c | 1 +
> drivers/pci/tph.c | 2 +-
> drivers/perf/fsl_imx9_ddr_perf.c | 33 +-
> drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
> drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +-
> drivers/platform/x86/acer-wmi.c | 45 ++
> drivers/platform/x86/intel/int3472/discrete.c | 3 +
> drivers/platform/x86/intel/int3472/tps68470.c | 3 +
> drivers/platform/x86/serdev_helpers.h | 4 +-
> drivers/ptp/ptp_clock.c | 8 +
> drivers/pwm/pwm-microchip-core.c | 2 +-
> drivers/remoteproc/omap_remoteproc.c | 17 +
> drivers/rtc/rtc-zynqmp.c | 4 +-
> drivers/scsi/qla2xxx/qla_def.h | 2 +
> drivers/scsi/qla2xxx/qla_dfs.c | 122 ++++-
> drivers/scsi/qla2xxx/qla_gbl.h | 3 +
> drivers/scsi/qla2xxx/qla_init.c | 28 +-
> drivers/scsi/scsi_lib.c | 9 +-
> drivers/scsi/st.c | 6 +
> drivers/scsi/st.h | 1 +
> drivers/scsi/storvsc_drv.c | 1 +
> drivers/soc/mediatek/mtk-devapc.c | 19 +-
> drivers/soc/qcom/llcc-qcom.c | 1 +
> drivers/soc/qcom/smem_state.c | 3 +-
> drivers/soc/qcom/socinfo.c | 2 +-
> drivers/soc/samsung/exynos-pmu.c | 2 +-
> drivers/spi/atmel-quadspi.c | 118 +++--
> drivers/tty/serial/sh-sci.c | 25 +-
> drivers/tty/serial/xilinx_uartps.c | 8 +-
> drivers/tty/vt/selection.c | 14 +
> drivers/tty/vt/vt.c | 2 -
> drivers/ufs/core/ufshcd.c | 31 +-
> drivers/ufs/host/ufs-qcom.c | 18 +-
> drivers/ufs/host/ufshcd-pci.c | 2 -
> drivers/ufs/host/ufshcd-pltfrm.c | 28 +-
> drivers/usb/gadget/function/f_tcm.c | 52 +--
> drivers/vfio/platform/vfio_platform_common.c | 10 +
> fs/binfmt_flat.c | 2 +-
> fs/btrfs/ctree.c | 2 +
> fs/btrfs/file.c | 2 +-
> fs/btrfs/ordered-data.c | 12 +
> fs/btrfs/qgroup.c | 5 +-
> fs/btrfs/raid-stripe-tree.c | 26 +-
> fs/btrfs/relocation.c | 14 +-
> fs/btrfs/transaction.c | 4 +-
> fs/ceph/mds_client.c | 16 +-
> fs/exec.c | 29 +-
> fs/namespace.c | 54 ++-
> fs/nfs/Kconfig | 3 +-
> fs/nfs/flexfilelayout/flexfilelayout.c | 27 +-
> fs/nfsd/nfs4xdr.c | 20 +-
> fs/nilfs2/inode.c | 6 +-
> fs/ocfs2/super.c | 2 +-
> fs/ocfs2/symlink.c | 5 +-
> fs/pidfs.c | 34 ++
> fs/proc/array.c | 2 +-
> fs/smb/client/cifsglob.h | 14 +-
> fs/smb/client/dir.c | 6 +-
> fs/smb/client/smb1ops.c | 2 +-
> fs/smb/client/smb2inode.c | 108 ++---
> fs/smb/client/smb2ops.c | 41 +-
> fs/smb/client/smb2pdu.c | 2 +-
> fs/smb/client/smb2proto.h | 2 +-
> fs/smb/server/transport_ipc.c | 9 +
> fs/xfs/xfs_exchrange.c | 71 ++-
> fs/xfs/xfs_inode.c | 7 +-
> fs/xfs/xfs_iomap.c | 6 +-
> include/drm/drm_connector.h | 5 +-
> include/drm/drm_utils.h | 4 +
> include/linux/binfmts.h | 4 +-
> include/linux/call_once.h | 45 ++
> include/linux/hrtimer_defs.h | 1 +
> include/linux/jiffies.h | 2 +-
> include/linux/kvm_host.h | 9 +
> include/linux/mlx5/driver.h | 1 -
> include/linux/platform_data/x86/asus-wmi.h | 5 +
> include/net/sch_generic.h | 2 +-
> include/rv/da_monitor.h | 4 +
> include/trace/events/rxrpc.h | 1 +
> include/uapi/drm/amdgpu_drm.h | 9 +-
> include/uapi/linux/input-event-codes.h | 1 +
> include/uapi/linux/iommufd.h | 4 +-
> include/uapi/linux/raid/md_p.h | 2 +-
> include/uapi/linux/raid/md_u.h | 2 +
> include/ufs/ufs.h | 4 +-
> include/ufs/ufshcd.h | 1 -
> io_uring/net.c | 5 +
> io_uring/poll.c | 4 +
> kernel/bpf/verifier.c | 2 +-
> kernel/locking/test-ww_mutex.c | 9 +-
> kernel/printk/printk.c | 2 +-
> kernel/sched/core.c | 28 +-
> kernel/sched/deadline.c | 56 ++-
> kernel/sched/fair.c | 19 +
> kernel/sched/sched.h | 2 +-
> kernel/seccomp.c | 12 +
> kernel/time/hrtimer.c | 103 ++++-
> kernel/time/timer_migration.c | 10 +-
> kernel/trace/ring_buffer.c | 13 +-
> kernel/trace/trace_functions_graph.c | 2 +-
> kernel/trace/trace_osnoise.c | 17 +-
> lib/Kconfig.debug | 8 +-
> lib/atomic64.c | 78 ++--
> lib/maple_tree.c | 23 +-
> mm/compaction.c | 3 +-
> mm/gup.c | 14 +-
> mm/hugetlb.c | 24 +-
> mm/kfence/core.c | 2 +
> mm/kmemleak.c | 2 +-
> mm/vmscan.c | 7 +-
> net/bluetooth/l2cap_sock.c | 7 +-
> net/bluetooth/mgmt.c | 12 +-
> net/ethtool/ioctl.c | 2 +-
> net/ethtool/rss.c | 3 +-
> net/ipv4/udp.c | 4 +-
> net/ipv6/udp.c | 4 +-
> net/ncsi/ncsi-manage.c | 13 +-
> net/nfc/nci/hci.c | 2 +
> net/rose/af_rose.c | 24 +-
> net/rxrpc/ar-internal.h | 2 +-
> net/rxrpc/call_object.c | 6 +-
> net/rxrpc/conn_event.c | 21 +-
> net/rxrpc/conn_object.c | 1 +
> net/rxrpc/input.c | 2 +-
> net/rxrpc/sendmsg.c | 2 +-
> net/sched/sch_fifo.c | 3 +
> net/sched/sch_netem.c | 2 +-
> net/tipc/crypto.c | 4 +-
> rust/kernel/init.rs | 2 +-
> scripts/Makefile.extrawarn | 5 +-
> scripts/gdb/linux/cpus.py | 2 +-
> scripts/generate_rust_target.rs | 18 +
> security/keys/trusted-keys/trusted_dcp.c | 22 +-
> security/safesetid/securityfs.c | 3 +
> security/tomoyo/common.c | 2 +-
> sound/pci/hda/hda_auto_parser.c | 8 +-
> sound/pci/hda/hda_auto_parser.h | 1 +
> sound/pci/hda/patch_realtek.c | 20 +-
> sound/soc/amd/Kconfig | 2 +-
> sound/soc/amd/yc/acp6x-mach.c | 28 ++
> sound/soc/intel/boards/sof_sdw.c | 5 +-
> sound/soc/renesas/rz-ssi.c | 10 +-
> sound/soc/soc-pcm.c | 32 +-
> sound/soc/sof/intel/hda-dai.c | 12 +
> sound/soc/sof/intel/hda.c | 5 +
> tools/perf/bench/epoll-wait.c | 7 +-
> .../testing/selftests/bpf/progs/exceptions_fail.c | 4 +-
> tools/testing/selftests/bpf/progs/preempt_lock.c | 14 +-
> .../selftests/bpf/progs/verifier_spin_lock.c | 2 +-
> tools/testing/selftests/drivers/net/hw/rss_ctx.py | 2 +
> tools/testing/selftests/net/ipsec.c | 3 +-
> tools/testing/selftests/net/mptcp/mptcp_connect.c | 2 +-
> tools/testing/selftests/net/udpgso.c | 26 ++
> tools/tracing/rtla/src/osnoise.c | 2 +-
> tools/tracing/rtla/src/timerlat_hist.c | 26 +-
> tools/tracing/rtla/src/timerlat_top.c | 27 +-
> tools/tracing/rtla/src/trace.c | 8 +
> tools/tracing/rtla/src/trace.h | 1 +
> 479 files changed, 5359 insertions(+), 2651 deletions(-)
>
>
>
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-14 6:42 ` Luna Jernberg
@ 2025-02-14 10:16 ` Luna Jernberg
0 siblings, 0 replies; 474+ messages in thread
From: Luna Jernberg @ 2025-02-14 10:16 UTC (permalink / raw)
To: Greg Kroah-Hartman, Luna Jernberg
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
Also boots on my other Arch Linux Machine a Dell Micro 3050 with a
model name : Intel(R) Core(TM) i5-6500T CPU @ 2.50GHz
Den fre 14 feb. 2025 kl 07:42 skrev Luna Jernberg <droidbittin@gmail.com>:
>
> Tested-by: Luna Jernberg <droidbittin@gmail.com>
>
> AMD Ryzen 5 5600 6-Core Processor:
> https://www.inet.se/produkt/5304697/amd-ryzen-5-5600-3-5-ghz-35mb on a
> https://www.gigabyte.com/Motherboard/B550-AORUS-ELITE-V2-rev-12
> https://www.inet.se/produkt/1903406/gigabyte-b550-aorus-elite-v2
> motherboard :)
>
> running Arch Linux with the testing repos enabled:
> https://archlinux.org/ https://archboot.com/
> https://wiki.archlinux.org/title/Arch_Testing_Team
>
> Den tors 13 feb. 2025 kl 16:12 skrev Greg Kroah-Hartman
> <gregkh@linuxfoundation.org>:
> >
> > This is the start of the stable review cycle for the 6.13.3 release.
> > There are 443 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat, 15 Feb 2025 14:23:11 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.3-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
> > -------------
> > Pseudo-Shortlog of commits:
> >
> > Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Linux 6.13.3-rc1
> >
> > Miklos Szeredi <mszeredi@redhat.com>
> > fs: fix adding security options to statmount.mnt_opt
> >
> > Jeff Layton <jlayton@kernel.org>
> > fs: prepend statmount.mnt_opts string with security_sb_mnt_opts()
> >
> > Ping-Ke Shih <pkshih@realtek.com>
> > wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
> >
> > Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
> > Revert "drm/amd/display: Fix green screen issue after suspend"
> >
> > Bart Van Assche <bvanassche@acm.org>
> > md: Fix linear_set_limits()
> >
> > Dan Carpenter <dan.carpenter@linaro.org>
> > md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add()
> >
> > Peter Zijlstra <peterz@infradead.org>
> > x86/mm: Convert unreachable() to BUG()
> >
> > Bence Csókás <csokas.bence@prolan.hu>
> > spi: atmel-qspi: Memory barriers after memory-mapped I/O
> >
> > Csókás, Bence <csokas.bence@prolan.hu>
> > spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families
> >
> > WangYuli <wangyuli@uniontech.com>
> > MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
> >
> > Heiko Carstens <hca@linux.ibm.com>
> > s390/fpu: Add fpc exception handler / remove fixup section again
> >
> > Frederic Weisbecker <frederic@kernel.org>
> > timers/migration: Fix off-by-one root mis-connection
> >
> > Miklos Szeredi <mszeredi@redhat.com>
> > statmount: let unset strings be empty
> >
> > Michal Simek <michal.simek@amd.com>
> > rtc: zynqmp: Fix optional clock name property
> >
> > Yishai Hadas <yishaih@nvidia.com>
> > RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
> >
> > Thomas Weißschuh <linux@weissschuh.net>
> > ptp: Ensure info->enable callback is always set
> >
> > Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
> > pinctrl: renesas: rzg2l: Fix PFC_MASK for RZ/V2H and RZ/G3E
> >
> > Javier Carrasco <javier.carrasco.cruz@gmail.com>
> > pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails
> >
> > Tomas Glozar <tglozar@redhat.com>
> > rtla/timerlat_top: Stop timerlat tracer on signal
> >
> > Tomas Glozar <tglozar@redhat.com>
> > rtla/timerlat_hist: Stop timerlat tracer on signal
> >
> > Tomas Glozar <tglozar@redhat.com>
> > rtla: Add trace_instance_stop
> >
> > Tomas Glozar <tglozar@redhat.com>
> > rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads
> >
> > Tomas Glozar <tglozar@redhat.com>
> > rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads
> >
> > Tomas Glozar <tglozar@redhat.com>
> > rtla/osnoise: Distinguish missing workload option
> >
> > Steven Rostedt <rostedt@goodmis.org>
> > tracing/osnoise: Fix resetting of tracepoints
> >
> > Jan Kiszka <jan.kiszka@siemens.com>
> > scripts/gdb: fix aarch64 userspace detection in get_current_task
> >
> > Wei Yang <richard.weiyang@gmail.com>
> > maple_tree: simplify split calculation
> >
> > Milos Reljin <milos_reljin@outlook.com>
> > net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset
> >
> > Paul Fertser <fercerpav@gmail.com>
> > net/ncsi: wait for the last response to Deselect Package before configuring channel
> >
> > Ekansh Gupta <quic_ekangupt@quicinc.com>
> > misc: fastrpc: Fix copy buffer page size
> >
> > Ekansh Gupta <quic_ekangupt@quicinc.com>
> > misc: fastrpc: Fix registered buffer page address
> >
> > Anandu Krishnan E <quic_anane@quicinc.com>
> > misc: fastrpc: Deregister device nodes properly in error scenarios
> >
> > Vimal Agrawal <vimal.agrawal@sophos.com>
> > misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors
> >
> > Ivan Stepchenko <sid@itb.spb.ru>
> > mtd: onenand: Fix uninitialized retlen in do_otp_read()
> >
> > Nick Chan <towinchenmi@gmail.com>
> > irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so
> >
> > Frank Li <Frank.Li@nxp.com>
> > i3c: master: Fix missing 'ret' assignment in set_speed()
> >
> > Steven Rostedt <rostedt@goodmis.org>
> > fgraph: Fix set_graph_notrace with setting TRACE_GRAPH_NOTRACE_BIT
> >
> > Dan Carpenter <dan.carpenter@linaro.org>
> > NFC: nci: Add bounds checking in nci_hci_create_pipe()
> >
> > Uros Bizjak <ubizjak@gmail.com>
> > mailbox: zynqmp: Remove invalid __percpu annotation in zynqmp_ipi_probe()
> >
> > Pekka Pessi <ppessi@nvidia.com>
> > mailbox: tegra-hsp: Clear mailbox before using message
> >
> > Chuck Lever <chuck.lever@oracle.com>
> > NFSD: Encode COMPOUND operation status on page boundaries
> >
> > Dragan Simic <dsimic@manjaro.org>
> > nfs: Make NFS_FSCACHE select NETFS_SUPPORT instead of depending on it
> >
> > Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> > nilfs2: fix possible int overflows in nilfs_fiemap()
> >
> > Matthew Wilcox (Oracle) <willy@infradead.org>
> > ocfs2: handle a symlink read error correctly
> >
> > Heming Zhao <heming.zhao@suse.com>
> > ocfs2: fix incorrect CPU endianness conversion causing mount failure
> >
> > Mike Snitzer <snitzer@kernel.org>
> > pnfs/flexfiles: retry getting layout segment for reads
> >
> > Matthieu Baerts (NGI0) <matttbe@kernel.org>
> > selftests: mptcp: connect: -f: no reconnect
> >
> > Alex Williamson <alex.williamson@redhat.com>
> > vfio/platform: check the bounds of read/write syscalls
> >
> > Jens Axboe <axboe@kernel.dk>
> > io_uring/net: don't retry connect operation on EPOLLERR
> >
> > Pavel Begunkov <asml.silence@gmail.com>
> > io_uring: fix multishots with selected buffers
> >
> > Sascha Hauer <s.hauer@pengutronix.de>
> > nvmem: imx-ocotp-ele: set word length to 1
> >
> > Sascha Hauer <s.hauer@pengutronix.de>
> > nvmem: imx-ocotp-ele: fix reading from non zero offset
> >
> > Sascha Hauer <s.hauer@pengutronix.de>
> > nvmem: imx-ocotp-ele: fix MAC address byte order
> >
> > Sascha Hauer <s.hauer@pengutronix.de>
> > nvmem: imx-ocotp-ele: simplify read beyond device check
> >
> > Jennifer Berringer <jberring@redhat.com>
> > nvmem: core: improve range check for nvmem_cell_write()
> >
> > Luca Weiss <luca.weiss@fairphone.com>
> > nvmem: qcom-spmi-sdam: Set size in struct nvmem_config
> >
> > Antoine Viallon <antoine@lesviallon.fr>
> > ceph: fix memory leak in ceph_mds_auth_match()
> >
> > Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > crypto: qce - unregister previously registered algos in error path
> >
> > Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > crypto: qce - fix goto jump in error path
> >
> > Stefan Eichenberger <eichest@gmail.com>
> > irqchip/irq-mvebu-icu: Fix access to msi_data from irq_domain::host_data
> >
> > Niklas Cassel <cassel@kernel.org>
> > ata: libata-sff: Ensure that we cannot write outside the allocated buffer
> >
> > Daniel Baumann <daniel@debian.org>
> > ata: libata-core: Add ATA_QUIRK_NOLPM for Samsung SSD 870 QVO drives
> >
> > Liu Shixin <liushixin2@huawei.com>
> > mm/compaction: fix UBSAN shift-out-of-bounds warning
> >
> > Ritesh Harjani (IBM) <ritesh.list@gmail.com>
> > mm/hugetlb: fix hugepage allocation for interleaved memory nodes
> >
> > Li Zhijian <lizhijian@fujitsu.com>
> > mm/vmscan: accumulate nr_demoted for accurate demotion statistics
> >
> > Zhaoyang Huang <zhaoyang.huang@unisoc.com>
> > mm: gup: fix infinite loop within __get_longterm_locked
> >
> > Catalin Marinas <catalin.marinas@arm.com>
> > mm: kmemleak: fix upper boundary check for physical address objects
> >
> > Ricardo Ribalda <ribalda@chromium.org>
> > media: uvcvideo: Remove dangling pointers
> >
> > Ricardo Ribalda <ribalda@chromium.org>
> > media: uvcvideo: Remove redundant NULL assignment
> >
> > Ricardo Ribalda <ribalda@chromium.org>
> > media: uvcvideo: Only save async fh if success
> >
> > Ricardo Ribalda <ribalda@chromium.org>
> > media: uvcvideo: Support partial control reads
> >
> > Ricardo Ribalda <ribalda@chromium.org>
> > media: uvcvideo: Fix event flags in uvc_ctrl_send_events
> >
> > Ricardo Ribalda <ribalda@chromium.org>
> > media: uvcvideo: Fix crash during unbind if gpio unit is in use
> >
> > Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> > media: i2c: ds90ub960: Fix logging SP & EQ status only for UB9702
> >
> > Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> > media: i2c: ds90ub960: Fix UB9702 VC map
> >
> > Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> > media: i2c: ds90ub960: Fix use of non-existing registers on UB9702
> >
> > Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> > media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
> >
> > Mehdi Djait <mehdi.djait@linux.intel.com>
> > media: ccs: Fix cleanup order in ccs_probe()
> >
> > Sakari Ailus <sakari.ailus@linux.intel.com>
> > media: ccs: Fix CCS static data parsing for large block sizes
> >
> > Sergey Senozhatsky <senozhatsky@chromium.org>
> > media: venus: destroy hfi session after m2m_ctx release
> >
> > Alain Volmat <alain.volmat@foss.st.com>
> > media: stm32: dcmipp: correct dma_set_mask_and_coherent mask value
> >
> > Sam Bobrowicz <sam@elite-embedded.com>
> > media: ov5640: fix get_light_freq on auto
> >
> > Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
> > media: intel/ipu6: remove cpu latency qos request on error
> >
> > Naushir Patuck <naush@raspberrypi.com>
> > media: imx296: Add standby delay during probe
> >
> > Zhen Lei <thunder.leizhen@huawei.com>
> > media: nuvoton: Fix an error check in npcm_video_ece_init()
> >
> > Cosmin Tanislav <demonsingur@gmail.com>
> > media: mc: fix endpoint iteration
> >
> > Sakari Ailus <sakari.ailus@linux.intel.com>
> > media: Documentation: tx-rx: Fix formatting
> >
> > Lubomir Rintel <lkundrak@v3.sk>
> > media: mmp: Bring back registration of the device
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > soc: qcom: smem_state: fix missing of_node_put in error path
> >
> > Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> > soc: qcom: llcc: Enable LLCC_WRCACHE at boot on X1
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > soc: mediatek: mtk-devapc: Fix leaking IO map on driver remove
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > soc: mediatek: mtk-devapc: Fix leaking IO map on error paths
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > soc: samsung: exynos-pmu: Fix uninitialized ret in tensor_set_bits_atomic()
> >
> > Nicolin Chen <nicolinc@nvidia.com>
> > iommufd/fault: Use a separate spinlock to protect fault->deliver list
> >
> > Nicolin Chen <nicolinc@nvidia.com>
> > iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()
> >
> > Nicolin Chen <nicolinc@nvidia.com>
> > iommu/tegra241-cmdqv: Read SMMU IDR1.CMDQS instead of hardcoding
> >
> > Javier Carrasco <javier.carrasco.cruz@gmail.com>
> > iio: light: as73211: fix channel handling in only-color triggered buffer
> >
> > Angelo Dureghello <adureghello@baylibre.com>
> > iio: dac: ad3552r-hs: clear reset status flag
> >
> > Angelo Dureghello <adureghello@baylibre.com>
> > iio: dac: ad3552r-common: fix ad3541/2r ranges
> >
> > Dan Carpenter <dan.carpenter@linaro.org>
> > iio: chemical: bme680: Fix uninitialized variable in __bme680_read_raw()
> >
> > Peter Xu <peterx@redhat.com>
> > mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
> >
> > Sakari Ailus <sakari.ailus@linux.intel.com>
> > media: ccs: Clean up parsed CCS static data on parse failure
> >
> > Marco Elver <elver@google.com>
> > kfence: skip __GFP_THISNODE allocations on NUMA systems
> >
> > Nicolin Chen <nicolinc@nvidia.com>
> > iommufd: Fix struct iommu_hwpt_pgfault init and padding
> >
> > Easwar Hariharan <eahariha@linux.microsoft.com>
> > jiffies: Cast to unsigned long in secs_to_jiffies() conversion
> >
> > Frederic Weisbecker <frederic@kernel.org>
> > hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
> >
> > Gabriele Monaco <gmonaco@redhat.com>
> > rv: Reset per-task monitors also for idle tasks
> >
> > Jarkko Sakkinen <jarkko@kernel.org>
> > tpm: Change to kvalloc() in eventlog/acpi.c
> >
> > Aubrey Li <aubrey.li@linux.intel.com>
> > ACPI: PRM: Remove unnecessary strict handler address checks
> >
> > Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> > accel/ivpu: Fix error handling in recovery/reset
> >
> > Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> > accel/ivpu: Clear runtime_error after pm_runtime_resume_and_get() fails
> >
> > Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> > accel/ivpu: Fix error handling in ivpu_boot()
> >
> > Wentao Liang <vulab@iscas.ac.cn>
> > xfs: Add error handling for xfs_reflink_cancel_cow_range
> >
> > Wentao Liang <vulab@iscas.ac.cn>
> > xfs: Propagate errors from xfs_reflink_cancel_cow_range in xfs_dax_write_iomap_end
> >
> > Christoph Hellwig <hch@lst.de>
> > xfs: don't call remap_verify_area with sb write protection held
> >
> > Conor Dooley <conor.dooley@microchip.com>
> > pwm: microchip-core: fix incorrect comparison with max period
> >
> > Helge Deller <deller@kernel.org>
> > parisc: Temporarily disable jump label support
> >
> > Sumit Gupta <sumitg@nvidia.com>
> > arm64: tegra: Disable Tegra234 sce-fabric node
> >
> > Sumit Gupta <sumitg@nvidia.com>
> > arm64: tegra: Fix typo in Tegra234 dce-fabric compatible
> >
> > Eric Biggers <ebiggers@google.com>
> > crypto: qce - fix priority to be less than ARMv8 CE
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > arm64: dts: qcom: sm8650: correct MDSS interconnects
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > arm64: dts: qcom: sm8550: correct MDSS interconnects
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8650: Fix MPSS memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8650: Fix CDSP memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8650: Fix ADSP memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8550: Fix MPSS memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8550: Fix CDSP memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8550: Fix ADSP memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8450: Fix MPSS memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8450: Fix CDSP memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8450: Fix ADSP memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8350: Fix MPSS memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8350: Fix CDSP memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm8350: Fix ADSP memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm6375: Fix MPSS memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm6375: Fix CDSP memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm6375: Fix ADSP memory length
> >
> > Luca Weiss <luca.weiss@fairphone.com>
> > arm64: dts: qcom: sm6350: Fix uart1 interconnect path
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm6350: Fix MPSS memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm6350: Fix ADSP memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm6115: Fix ADSP memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm6115: Fix CDSP memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sm6115: Fix MPSS memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: x1e80100: Fix CDSP memory length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: x1e80100: Fix ADSP memory base and length
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > arm64: dts: qcom: sdx75: Fix MPSS memory length
> >
> > Chen-Yu Tsai <wenst@chromium.org>
> > arm64: dts: mediatek: mt8183: Disable DSI display output by default
> >
> > Chen-Yu Tsai <wenst@chromium.org>
> > arm64: dts: mediatek: mt8183: Disable DPI display output by default
> >
> > Andreas Kemnade <andreas@kemnade.info>
> > ARM: dts: ti/omap: gta04: fix pm issues caused by spi module
> >
> > Romain Naour <romain.naour@skf.com>
> > ARM: dts: dra7: Add bus_dma_limit for l4 cfg bus
> >
> > Denis Arefev <arefev@swemel.ru>
> > ubi: Add a check for ubi_num
> >
> > Nathan Chancellor <nathan@kernel.org>
> > x86/boot: Use '-std=gnu11' to fix build with GCC 15
> >
> > Zhang Rui <rui.zhang@intel.com>
> > x86/acpi: Fix LAPIC/x2APIC parsing order
> >
> > Alice Ryhl <aliceryhl@google.com>
> > x86: rust: set rustc-abi=x86-softfloat on rustc>=1.86.0
> >
> > Miguel Ojeda <ojeda@kernel.org>
> > rust: init: use explicit ABI to clean warning in future compilers
> >
> > Christian Brauner <brauner@kernel.org>
> > pidfs: improve ioctl handling
> >
> > Christian Brauner <brauner@kernel.org>
> > pidfs: check for valid ioctl commands
> >
> > Nathan Chancellor <nathan@kernel.org>
> > kbuild: Move -Wenum-enum-conversion to W=2
> >
> > Igor Pylypiv <ipylypiv@google.com>
> > scsi: core: Do not retry I/Os during depopulation
> >
> > Long Li <longli@microsoft.com>
> > scsi: storvsc: Set correct data length for sending SCSI command without payload
> >
> > André Draszik <andre.draszik@linaro.org>
> > scsi: ufs: core: Fix use-after free in init error and remove paths
> >
> > Eric Biggers <ebiggers@google.com>
> > scsi: ufs: qcom: Fix crypto key eviction
> >
> > Quinn Tran <qutran@marvell.com>
> > scsi: qla2xxx: Move FCE Trace buffer allocation to user control
> >
> > Kai Mäkisara <Kai.Makisara@kolumbus.fi>
> > scsi: st: Don't set pos_unknown just after device recognition
> >
> > Sean Christopherson <seanjc@google.com>
> > KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking
> >
> > Georg Gottleuber <ggo@tuxedocomputers.com>
> > nvme-pci: Add TUXEDO IBP Gen9 to Samsung sleep quirk
> >
> > Georg Gottleuber <ggo@tuxedocomputers.com>
> > nvme-pci: Add TUXEDO InfinityFlex to Samsung sleep quirk
> >
> > Niklas Cassel <cassel@kernel.org>
> > PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
> >
> > Niklas Cassel <cassel@kernel.org>
> > PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()
> >
> > Zijun Hu <quic_zijuhu@quicinc.com>
> > PCI: endpoint: Finish virtual EP removal in pci_epf_remove_vepf()
> >
> > Werner Sembach <wse@tuxedocomputers.com>
> > PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
> >
> > Niklas Schnelle <schnelle@linux.ibm.com>
> > s390/pci: Fix SR-IOV for PFs initially in standby
> >
> > Brad Griffis <bgriffis@nvidia.com>
> > arm64: tegra: Fix Tegra234 PCIe interrupt-map
> >
> > Takashi Iwai <tiwai@suse.de>
> > ALSA: hda/realtek: Workaround for resume on Dell Venue 11 Pro 7130
> >
> > Kuan-Wei Chiu <visitorckw@gmail.com>
> > ALSA: hda: Fix headset detection failure due to unstable sort
> >
> > Takashi Iwai <tiwai@suse.de>
> > ALSA: hda/realtek: Fix quirk matching for Legion Pro 7
> >
> > Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
> > ALSA: hda/realtek: Enable headset mic on Positivo C6400
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()
> >
> > Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> > firmware: qcom: scm: Fix missing read barrier in qcom_scm_is_available()
> >
> > Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
> > Revert "media: uvcvideo: Require entities to have a non-zero unique ID"
> >
> > Jens Axboe <axboe@kernel.dk>
> > block: don't revert iter for -EIOCBQUEUED
> >
> > Xi Ruoyao <xry111@xry111.site>
> > Revert "MIPS: csrc-r4k: Select HAVE_UNSTABLE_SCHED_CLOCK if SMP && 64BIT"
> >
> > Jiaxun Yang <jiaxun.yang@flygoat.com>
> > MIPS: pci-legacy: Override pci_address_to_pio
> >
> > Mateusz Jończyk <mat.jonczyk@o2.pl>
> > mips/math-emu: fix emulation of the prefx instruction
> >
> > Hou Tao <houtao1@huawei.com>
> > dm-crypt: track tag_offset in convert_context
> >
> > Hou Tao <houtao1@huawei.com>
> > dm-crypt: don't update io->sector after kcryptd_crypt_write_io_submit()
> >
> > Narayana Murty N <nnmlinux@linux.ibm.com>
> > powerpc/pseries/eeh: Fix get PE state translation
> >
> > Tiezhu Yang <yangtiezhu@loongson.cn>
> > LoongArch: Extend the maximum number of watchpoints
> >
> > Kexy Biscuit <kexybiscuit@aosc.io>
> > MIPS: Loongson64: remove ROM Size unit in boardinfo
> >
> > Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> > serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
> >
> > Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> > serial: sh-sci: Drop __initdata macro for port_cfg
> >
> > Stephan Gerhold <stephan.gerhold@linaro.org>
> > soc: qcom: socinfo: Avoid out of bounds read of serial number
> >
> > Mario Limonciello <mario.limonciello@amd.com>
> > ASoC: acp: Support microphone from Lenovo Go S
> >
> > Dan Carpenter <dan.carpenter@linaro.org>
> > ASoC: renesas: rz-ssi: Add a check for negative sample_space
> >
> > Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> > ASoC: renesas: rz-ssi: Terminate all the DMA transactions
> >
> > Abel Vesa <abel.vesa@linaro.org>
> > arm64: dts: qcom: x1e80100: Fix usb_2 controller interrupts
> >
> > Stephan Gerhold <stephan.gerhold@linaro.org>
> > arm64: dts: qcom: x1e80100-microsoft-romulus: Fix USB QMP PHY supplies
> >
> > Stephan Gerhold <stephan.gerhold@linaro.org>
> > arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix USB QMP PHY supplies
> >
> > Stephan Gerhold <stephan.gerhold@linaro.org>
> > arm64: dts: qcom: x1e80100-crd: Fix USB QMP PHY supplies
> >
> > Stephan Gerhold <stephan.gerhold@linaro.org>
> > arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Fix USB QMP PHY supplies
> >
> > Stephan Gerhold <stephan.gerhold@linaro.org>
> > arm64: dts: qcom: x1e80100-qcp: Fix USB QMP PHY supplies
> >
> > Stephan Gerhold <stephan.gerhold@linaro.org>
> > arm64: dts: qcom: x1e80100-dell-xps13-9345: Fix USB QMP PHY supplies
> >
> > Stephan Gerhold <stephan.gerhold@linaro.org>
> > arm64: dts: qcom: x1e80100-asus-vivobook-s15: Fix USB QMP PHY supplies
> >
> > Foster Snowhill <forst@pen.gy>
> > usbnet: ipheth: document scope of NCM implementation
> >
> > Foster Snowhill <forst@pen.gy>
> > usbnet: ipheth: fix DPE OoB read
> >
> > Foster Snowhill <forst@pen.gy>
> > usbnet: ipheth: break up NCM header size computation
> >
> > Foster Snowhill <forst@pen.gy>
> > usbnet: ipheth: refactor NCM datagram loop
> >
> > Foster Snowhill <forst@pen.gy>
> > usbnet: ipheth: check that DPE points past NCM header
> >
> > Foster Snowhill <forst@pen.gy>
> > usbnet: ipheth: use static NDP16 location in URB
> >
> > Foster Snowhill <forst@pen.gy>
> > usbnet: ipheth: fix possible overflow in DPE length check
> >
> > Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> > usb: gadget: f_tcm: Don't prepare BOT write request twice
> >
> > Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> > usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
> >
> > Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> > usb: gadget: f_tcm: Decrement command ref count on cleanup
> >
> > Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> > usb: gadget: f_tcm: Translate error to sense
> >
> > Vasily Khoruzhick <anarsoul@gmail.com>
> > wifi: rtw88: 8703b: Fix RX/TX issues
> >
> > Shayne Chen <shayne.chen@mediatek.com>
> > wifi: mt76: mt7915: add module param to select 5 GHz or 6 GHz on MT7916
> >
> > Fiona Klute <fiona.klute@gmx.de>
> > wifi: rtw88: sdio: Fix disconnection after beacon loss
> >
> > Nick Morrow <usbwifi2024@gmail.com>
> > wifi: mt76: mt7921u: Add VID/PID for TP-Link TXE50UH
> >
> > Marcel Hamer <marcel.hamer@windriver.com>
> > wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
> >
> > Bitterblue Smith <rtl8821cerfe2@gmail.com>
> > wifi: rtlwifi: rtl8821ae: Fix media status report
> >
> > Steven Rostedt <rostedt@goodmis.org>
> > atomic64: Use arch_spin_locks instead of raw_spin_locks
> >
> > Steven Rostedt <rostedt@goodmis.org>
> > ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg()
> >
> > Heiko Stuebner <heiko@sntech.de>
> > HID: hid-sensor-hub: don't use stale platform-data on remove
> >
> > Peng Fan <peng.fan@nxp.com>
> > Input: bbnsm_pwrkey - add remove hook
> >
> > Zijun Hu <quic_zijuhu@quicinc.com>
> > of: reserved-memory: Warn for missing static reserved memory regions
> >
> > Zijun Hu <quic_zijuhu@quicinc.com>
> > of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
> >
> > Zijun Hu <quic_zijuhu@quicinc.com>
> > of: Fix of_find_node_opts_by_path() handling of alias+path+options
> >
> > Thomas Weißschuh <thomas.weissschuh@linutronix.de>
> > of: address: Fix empty resource handling in __of_address_resource_bounds()
> >
> > Zijun Hu <quic_zijuhu@quicinc.com>
> > of: Correct child specifier used as input of the 2nd nexus node
> >
> > Bao D. Nguyen <quic_nguyenb@quicinc.com>
> > scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions
> >
> > Kuan-Wei Chiu <visitorckw@gmail.com>
> > perf bench: Fix undefined behavior in cmpworker()
> >
> > Dave Young <dyoung@redhat.com>
> > x86/efi: skip memattr table on kexec boot
> >
> > Nathan Chancellor <nathan@kernel.org>
> > efi: libstub: Use '-std=gnu11' to fix build with GCC 15
> >
> > Zijun Hu <quic_zijuhu@quicinc.com>
> > blk-cgroup: Fix class @block_class's subsystem refcount leakage
> >
> > Eyal Birger <eyal.birger@gmail.com>
> > seccomp: passthrough uretprobe systemcall without filtering
> >
> > Daniel Golle <daniel@makrotopia.org>
> > clk: mediatek: mt2701-mm: add missing dummy clk
> >
> > Daniel Golle <daniel@makrotopia.org>
> > clk: mediatek: mt2701-img: add missing dummy clk
> >
> > Daniel Golle <daniel@makrotopia.org>
> > clk: mediatek: mt2701-bdp: add missing dummy clk
> >
> > Daniel Golle <daniel@makrotopia.org>
> > clk: mediatek: mt2701-aud: fix conversion to mtk_clk_simple_probe
> >
> > Daniel Golle <daniel@makrotopia.org>
> > clk: mediatek: mt2701-vdec: fix conversion to mtk_clk_simple_probe
> >
> > Anastasia Belova <abelova@astralinux.ru>
> > clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
> >
> > Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
> > clk: qcom: gcc-mdm9607: Fix cmd_rcgr offset for blsp1_uart6 rcg
> >
> > Luca Weiss <luca.weiss@fairphone.com>
> > clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
> >
> > Luca Weiss <luca.weiss@fairphone.com>
> > clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
> >
> > Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> > clk: qcom: gcc-sm8650: Do not turn off PCIe GDSCs during gdsc_disable()
> >
> > Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> > clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
> >
> > Gabor Juhos <j4g8y7@gmail.com>
> > clk: qcom: clk-alpha-pll: fix alpha mode configuration
> >
> > Binbin Zhou <zhoubinbin@loongson.cn>
> > clk: clk-loongson2: Fix the number count of clk provider
> >
> > Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> > media: i2c: ds90ub960: Fix UB9702 refclk register access
> >
> > Lubomir Rintel <lkundrak@v3.sk>
> > clk: mmp2: call pm_genpd_init() only after genpd.name is set
> >
> > Cody Eksal <masterr3c0rd@epochal.quest>
> > clk: sunxi-ng: a100: enable MMC clock reparenting
> >
> > Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > Input: synaptics - fix crash when enabling pass-through port
> >
> > David Gstir <david@sigma-star.at>
> > KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
> >
> > Fedor Pchelkin <pchelkin@ispras.ru>
> > Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection
> >
> > Fedor Pchelkin <pchelkin@ispras.ru>
> > Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
> >
> > Lucas De Marchi <lucas.demarchi@intel.com>
> > drm/xe: Fix and re-enable xe_print_blob_ascii85()
> >
> > Lo-an Chen <lo-an.chen@amd.com>
> > drm/amd/display: Fix seamless boot sequence
> >
> > Marek Olšák <marek.olsak@amd.com>
> > drm/amdgpu: add a BO metadata flag to disable write compression for Vulkan
> >
> > Ville Syrjälä <ville.syrjala@linux.intel.com>
> > drm/i915: Drop 64bpp YUV formats from ICL+ SDR planes
> >
> > Jani Nikula <jani.nikula@intel.com>
> > drm/i915/dp: Iterate DSC BPP from high to low on all platforms
> >
> > Lucas De Marchi <lucas.demarchi@intel.com>
> > drm/xe/devcoredump: Move exec queue snapshot to Contexts section
> >
> > Haoxiang Li <haoxiang_li2024@163.com>
> > drm/komeda: Add check for komeda_get_layer_fourcc_list()
> >
> > Thomas Zimmermann <tzimmermann@suse.de>
> > drm/ast: astdp: Fix timeout for enabling video signal
> >
> > Brian Geffon <bgeffon@google.com>
> > drm/i915: Fix page cleanup on DMA remap failure
> >
> > Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
> > drm/i915/guc: Debug print LRC state entries only if the context is pinned
> >
> > Tom Chung <chiahsuan.chung@amd.com>
> > Revert "drm/amd/display: Use HW lock mgr for PSR1"
> >
> > Jay Cornwall <jay.cornwall@amd.com>
> > drm/amdkfd: Block per-queue reset when halt_if_hws_hang=1
> >
> > Prike Liang <Prike.Liang@amd.com>
> > drm/amdkfd: only flush the validate MES contex
> >
> > Kenneth Feng <kenneth.feng@amd.com>
> > drm/amd/amdgpu: change the config of cgcg on gfx12
> >
> > Lijo Lazar <lijo.lazar@amd.com>
> > drm/amd/pm: Mark MM activity as unsupported
> >
> > Aric Cyr <Aric.Cyr@amd.com>
> > drm/amd/display: Optimize cursor position updates
> >
> > Dan Carpenter <dan.carpenter@linaro.org>
> > ksmbd: fix integer overflows on 32 bit systems
> >
> > David Hildenbrand <david@redhat.com>
> > KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
> >
> > Keith Busch <kbusch@kernel.org>
> > kvm: defer huge page recovery vhost task to later
> >
> > Sean Christopherson <seanjc@google.com>
> > KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
> >
> > Chao Gao <chao.gao@intel.com>
> > KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
> >
> > Robin Murphy <robin.murphy@arm.com>
> > remoteproc: omap: Handle ARM dma_iommu_mapping
> >
> > Jakob Unterwurzacher <jakobunt@gmail.com>
> > arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
> >
> > Thomas Zimmermann <tzimmermann@suse.de>
> > drm/rockchip: cdn-dp: Use drm_connector_helper_hpd_irq_event()
> >
> > Marc Zyngier <maz@kernel.org>
> > KVM: arm64: timer: Always evaluate the need for a soft timer
> >
> > Ard Biesheuvel <ardb@kernel.org>
> > arm64/mm: Reduce PA space to 48 bits when LPA2 is not enabled
> >
> > Mark Brown <broonie@kernel.org>
> > arm64/sme: Move storage of reg_smidr to __cpuinfo_store_cpu()
> >
> > Ard Biesheuvel <ardb@kernel.org>
> > arm64/mm: Override PARange for !LPA2 and use it consistently
> >
> > Ard Biesheuvel <ardb@kernel.org>
> > arm64/kvm: Configure HYP TCR.PS/DS based on host stage1
> >
> > Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> > accel/ivpu: Fix Qemu crash when running in passthrough
> >
> > Xu Yang <xu.yang_2@nxp.com>
> > perf: imx9_perf: Introduce AXI filter version to refactor the driver and better extension
> >
> > Dan Carpenter <dan.carpenter@linaro.org>
> > binfmt_flat: Fix integer overflow bug on 32 bit systems
> >
> > Ming Lei <tom.leiming@gmail.com>
> > block: mark GFP_NOIO around sysfs ->store()
> >
> > Nam Cao <namcao@linutronix.de>
> > fs/proc: do_task_stat: Fix ESP not readable during coredump
> >
> > Thomas Zimmermann <tzimmermann@suse.de>
> > m68k: vga: Fix I/O defines
> >
> > Marc Zyngier <maz@kernel.org>
> > arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented
> >
> > Heiko Carstens <hca@linux.ibm.com>
> > s390/futex: Fix FUTEX_OP_ANDN implementation
> >
> > Yu Kuai <yukuai3@huawei.com>
> > md: reintroduce md-linear
> >
> > Meetakshi Setiya <msetiya@microsoft.com>
> > smb: client: change lease epoch type from unsigned int to __u16
> >
> > Ruben Devos <devosruben6@gmail.com>
> > smb: client: fix order of arguments of tracepoints
> >
> > Maarten Lankhorst <dev@lankhorst.se>
> > drm/client: Handle tiled displays better
> >
> > Maarten Lankhorst <dev@lankhorst.se>
> > drm/modeset: Handle tiled displays in pan_display_atomic.
> >
> > Pali Rohár <pali@kernel.org>
> > cifs: Remove intermediate object of failed create SFU call
> >
> > Sebastian Wiese-Wagner <seb@fastmail.to>
> > ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx
> >
> > Alexander Sverdlin <alexander.sverdlin@siemens.com>
> > leds: lp8860: Write full EEPROM, not only half of it
> >
> > Viresh Kumar <viresh.kumar@linaro.org>
> > cpufreq: s3c64xx: Fix compilation warning
> >
> > Andreas Kemnade <andreas@kemnade.info>
> > cpufreq: fix using cpufreq-dt as module
> >
> > Robin Murphy <robin.murphy@arm.com>
> > PCI/TPH: Restore TPH Requester Enable correctly
> >
> > David Howells <dhowells@redhat.com>
> > rxrpc: Fix call state set to not include the SERVER_SECURING state
> >
> > Ido Schimmel <idosch@nvidia.com>
> > net: sched: Fix truncation of offloaded action statistics
> >
> > Willem de Bruijn <willemb@google.com>
> > tun: revert fix group permission check
> >
> > Cong Wang <cong.wang@bytedance.com>
> > netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
> >
> > Quang Le <quanglex97@gmail.com>
> > pfifo_tail_enqueue: Drop new packet when sch->limit == 0
> >
> > Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> > ACPI: property: Fix return value for nval == 0 in acpi_data_prop_read()
> >
> > Juergen Gross <jgross@suse.com>
> > x86/xen: add FRAME_END to xen_hypercall_hvm()
> >
> > Juergen Gross <jgross@suse.com>
> > x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
> >
> > Geert Uytterhoeven <geert+renesas@glider.be>
> > gpio: GPIO_GRGPIO should depend on OF
> >
> > Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > gpio: sim: lock hog configfs items if present
> >
> > Eric Dumazet <edumazet@google.com>
> > net: rose: lock the socket in rose_bind()
> >
> > Jacob Moroni <mail@jakemoroni.com>
> > net: atlantic: fix warning during hot unplug
> >
> > Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
> > gpio: pca953x: Improve interrupt support
> >
> > David Howells <dhowells@redhat.com>
> > rxrpc: Fix the rxrpc_connection attend queue handling
> >
> > Jakub Kicinski <kuba@kernel.org>
> > selftests: drv-net: rss_ctx: add missing cleanup in queue reconfigure
> >
> > Jakub Kicinski <kuba@kernel.org>
> > ethtool: ntuple: fix rss + ring_cookie check
> >
> > Jakub Kicinski <kuba@kernel.org>
> > ethtool: rss: fix hiding unsupported fields in dumps
> >
> > Michal Wajdeczko <michal.wajdeczko@intel.com>
> > drm/xe/pf: Fix migration initialization
> >
> > Ashutosh Dixit <ashutosh.dixit@intel.com>
> > drm/xe/oa: Preserve oa_ctrl unused bits
> >
> > Ankit Nautiyal <ankit.k.nautiyal@intel.com>
> > drm/i915/dp: fix the Adaptive sync Operation mode for SDP
> >
> > Suraj Kandpal <suraj.kandpal@intel.com>
> > drm/i915/hdcp: Fix Repeater authentication during topology change
> >
> > Yan Zhai <yan@cloudflare.com>
> > udp: gso: do not drop small packets when PMTU reduces
> >
> > Lenny Szubowicz <lszubowi@redhat.com>
> > tg3: Disable tg3 PCIe AER on system reboot
> >
> > Sankararaman Jayaraman <sankararaman.jayaraman@broadcom.com>
> > vmxnet3: Fix tx queue race condition with XDP
> >
> > Jiasheng Jiang <jiashengjiangcool@gmail.com>
> > ice: Add check for devm_kzalloc()
> >
> > Florian Fainelli <florian.fainelli@broadcom.com>
> > net: bcmgenet: Correct overlaying of PHY and MAC Wake-on-LAN
> >
> > Daniel Wagner <wagi@kernel.org>
> > nvme-fc: use ctrl state getter
> >
> > Keith Busch <kbusch@kernel.org>
> > nvme: make nvme_tls_attrs_group static
> >
> > Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> > ice: stop storing XDP verdict within ice_rx_buf
> >
> > Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> > ice: gather page_count()'s of each frag right before XDP prog call
> >
> > Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> > ice: put Rx buffers after being done with current frame
> >
> > Hans Verkuil <hverkuil@xs4all.nl>
> > gpu: drm_dp_cec: fix broken CEC adapter properties check
> >
> > Prasad Pandit <pjp@fedoraproject.org>
> > firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
> >
> > Sagi Grimberg <sagi@grimberg.me>
> > nvmet: fix a memory leak in controller identify
> >
> > Daniel Wagner <wagi@kernel.org>
> > nvme: handle connectivity loss in nvme_set_queue_count
> >
> > K Prateek Nayak <kprateek.nayak@amd.com>
> > sched/fair: Fix inaccurate h_nr_runnable accounting with delayed dequeue
> >
> > Hans de Goede <hdegoede@redhat.com>
> > platform/x86: serdev_helpers: Check for serial_ctrl_uid == NULL
> >
> > Günther Noack <gnoack@google.com>
> > tty: Permit some TIOCL_SETSEL modes without CAP_SYS_ADMIN
> >
> > Sean Anderson <sean.anderson@linux.dev>
> > tty: xilinx_uartps: split sysrq handling
> >
> > Armin Wolf <W_Armin@gmx.de>
> > platform/x86: acer-wmi: Ignore AC events
> >
> > Hridesh MG <hridesh699@gmail.com>
> > platform/x86: acer-wmi: add support for Acer Nitro AN515-58
> >
> > Illia Ostapyshyn <illia@yshyn.com>
> > Input: allocate keycode for phone linking
> >
> > Yu-Chun Lin <eleanor15x@gmail.com>
> > ASoC: amd: Add ACPI dependency to fix build error
> >
> > Armin Wolf <W_Armin@gmx.de>
> > platform/x86: acer-wmi: Add support for Acer Predator PH16-72
> >
> > Kees Bakker <kees@ijzerbout.nl>
> > iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE
> >
> > Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
> > ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
> >
> > Armin Wolf <W_Armin@gmx.de>
> > platform/x86: acer-wmi: Add support for Acer PH14-51
> >
> > Hans de Goede <hdegoede@redhat.com>
> > platform/x86: int3472: Check for adev == NULL
> >
> > Robin Murphy <robin.murphy@arm.com>
> > iommu/arm-smmu-v3: Clean up more on probe failure
> >
> > Richard Acayan <mailingradian@gmail.com>
> > iommu/arm-smmu-qcom: add sdm670 adreno iommu compatible
> >
> > Simon Trimmer <simont@opensource.cirrus.com>
> > ASoC: Intel: sof_sdw: Correct quirk for Lenovo Yoga Slim 7
> >
> > David Woodhouse <dwmw@amazon.co.uk>
> > x86/kexec: Allocate PGD for x86_64 transition page tables separately
> >
> > Kumar Kartikeya Dwivedi <memxor@gmail.com>
> > bpf: Improve verifier log for resource leak on exit
> >
> > Bard Liao <yung-chuan.liao@linux.intel.com>
> > ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
> >
> > Roger Quadros <rogerq@kernel.org>
> > net: ethernet: ti: am65-cpsw: ensure proper channel cleanup in error path
> >
> > Liu Ye <liuye@kylinos.cn>
> > selftests/net/ipsec: Fix Null pointer dereference in rtattr_pack()
> >
> > Dan Carpenter <dan.carpenter@linaro.org>
> > tipc: re-order conditions in tipc_crypto_key_rcv()
> >
> > Shinas Rasheed <srasheed@marvell.com>
> > octeon_ep_vf: update tx/rx stats locally for persistence
> >
> > Shinas Rasheed <srasheed@marvell.com>
> > octeon_ep: update tx/rx stats locally for persistence
> >
> > Yuanjie Yang <quic_yuanjiey@quicinc.com>
> > mmc: sdhci-msm: Correctly set the load for the regulator
> >
> > Luke D. Jones <luke@ljones.dev>
> > HID: hid-asus: Disable OOBE mode on the ProArt P16
> >
> > Maciej S. Szmigiero <mail@maciej.szmigiero.name>
> > net: wwan: iosm: Fix hibernation by re-binding the driver around it
> >
> > Mazin Al Haddad <mazin@getstate.dev>
> > Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
> >
> > En-Wei Wu <en-wei.wu@canonical.com>
> > Bluetooth: btusb: Add new VID/PID 13d3/3628 for MT7925
> >
> > Andrew Halaney <ajhalaney@gmail.com>
> > Bluetooth: btusb: Add new VID/PID 13d3/3610 for MT7922
> >
> > Mark Dietzer <git@doridian.net>
> > Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x
> >
> > Borislav Petkov <bp@alien8.de>
> > APEI: GHES: Have GHES honor the panic= setting
> >
> > Randolph Ha <rha051117@gmail.com>
> > i2c: Force ELAN06FA touchpad I2C bus freq to 100KHz
> >
> > Miri Korenblit <miriam.rachel.korenblit@intel.com>
> > wifi: iwlwifi: avoid memory leak
> >
> > Somashekhar(Som) <somashekhar.puttagangaiah@intel.com>
> > wifi: iwlwifi: pcie: Add support for new device ids
> >
> > Stefan Dösinger <stefan@codeweavers.com>
> > wifi: brcmfmac: Check the return value of of_property_read_string_index()
> >
> > Andre Przywara <andre.przywara@arm.com>
> > Revert "mfd: axp20x: Allow multiple regulators"
> >
> > Vadim Fedorenko <vadim.fedorenko@linux.dev>
> > net/mlx5: use do_aux_work for PHC overflow checks
> >
> > Even Xu <even.xu@intel.com>
> > HID: Wacom: Add PCI Wacom device support
> >
> > Youwan Wang <youwan@nfschina.com>
> > HID: multitouch: Add quirk for Hantick 5288 touchpad
> >
> > Yevgeny Kliteynik <kliteyn@nvidia.com>
> > net/mlx5: HWS, num_of_rules counter on matcher should be atomic
> >
> > Yevgeny Kliteynik <kliteyn@nvidia.com>
> > net/mlx5: HWS, change error flow on matcher disconnect
> >
> > Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> > clk: qcom: Make GCC_8150 depend on QCOM_GDSC
> >
> > Ping-Ke Shih <pkshih@realtek.com>
> > wifi: rtw88: add __packed attribute to efuse layout struct
> >
> > Hans de Goede <hdegoede@redhat.com>
> > mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
> >
> > Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> > tomoyo: don't emit warning in tomoyo_write_control()
> >
> > Dmitry Antipov <dmantipov@yandex.ru>
> > wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
> >
> > Ciprian Marian Costea <ciprianmarian.costea@oss.nxp.com>
> > mmc: sdhci-esdhc-imx: enable 'SDHCI_QUIRK_NO_LED' quirk for S32G
> >
> > Shawn Lin <shawn.lin@rock-chips.com>
> > mmc: core: Respect quirk_max_rate for non-UHS SDIO card
> >
> > Stas Sergeev <stsp2@yandex.ru>
> > tun: fix group permission check
> >
> > Chih-Kang Chang <gary.chang@realtek.com>
> > wifi: rtw89: add crystal_cap check to avoid setting as overflow value
> >
> > Kalle Valo <quic_kvalo@quicinc.com>
> > wifi: ath12k: ath12k_mac_op_set_key(): fix uninitialized symbol 'ret'
> >
> > Karol Przybylski <karprzy7@gmail.com>
> > wifi: ath12k: Fix for out-of bound access error
> >
> > Jeongjun Park <aha310510@gmail.com>
> > ring-buffer: Make reading page consistent with the code logic
> >
> > Gabe Teeger <Gabe.Teeger@amd.com>
> > drm/amd/display: Limit Scaling Ratio on DCN3.01
> >
> > Nathan Chancellor <nathan@kernel.org>
> > drm/amd/display: Increase sanitizer frame larger than limit when compile testing with clang
> >
> > Leo Stone <leocstone@gmail.com>
> > safesetid: check size of policy writes
> >
> > Hermes Wu <hermes.wu@ite.com.tw>
> > drm/bridge: it6505: fix HDCP CTS KSV list wait timer
> >
> > Hermes Wu <hermes.wu@ite.com.tw>
> > drm/bridge: it6505: fix HDCP CTS compare V matching
> >
> > Hermes Wu <hermes.wu@ite.com.tw>
> > drm/bridge: it6505: fix HDCP encryption when R0 ready
> >
> > Hermes Wu <hermes.wu@ite.com.tw>
> > drm/bridge: it6505: fix HDCP Bstatus check
> >
> > Hermes Wu <hermes.wu@ite.com.tw>
> > drm/bridge: it6505: Change definition MAX_HDCP_DOWN_STREAM_COUNT
> >
> > Philip Yang <Philip.Yang@amd.com>
> > drm/amdkfd: Queue interrupt work to different CPU
> >
> > Philip Yang <Philip.Yang@amd.com>
> > drm/amdgpu: Don't enable sdma 4.4.5 CTXEMPTY interrupt
> >
> > Fangzhi Zuo <Jerry.Zuo@amd.com>
> > drm/amd/display: Fix Mode Cutoff in DSC Passthrough to DP2.1 Monitor
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/vc4: hdmi: use eld_mutex to protect access to connector->eld
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/sti: hdmi: use eld_mutex to protect access to connector->eld
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/radeon: use eld_mutex to protect access to connector->eld
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/msm/dp: use eld_mutex to protect access to connector->eld
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/exynos: hdmi: use eld_mutex to protect access to connector->eld
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/amd/display: use eld_mutex to protect access to connector->eld
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/bridge: ite-it66121: use eld_mutex to protect access to connector->eld
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/bridge: anx7625: use eld_mutex to protect access to connector->eld
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/connector: add mutex to protect ELD from concurrent access
> >
> > Abhinav Kumar <quic_abhinavk@quicinc.com>
> > drm/msm/dpu: filter out too wide modes if no 3dmux is present
> >
> > Kuan-Wei Chiu <visitorckw@gmail.com>
> > printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
> >
> > Ausef Yousof <Ausef.Yousof@amd.com>
> > drm/amd/display: Overwriting dualDPP UBF values before usage
> >
> > Ausef Yousof <Ausef.Yousof@amd.com>
> > drm/amd/display: Populate chroma prefetch parameters, DET buffer fix
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/tests: hdmi: return meaningful value from set_connector_edid()
> >
> > Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > drm/tests: hdmi: handle empty modes in find_preferred_mode()
> >
> > Zhi Wang <zhiw@nvidia.com>
> > nvkm: correctly calculate the available space of the GSP cmdq buffer
> >
> > Zhi Wang <zhiw@nvidia.com>
> > nvkm/gsp: correctly advance the read pointer of GSP message queue
> >
> > Dustin L. Howett <dustin@howett.net>
> > drm: panel-backlight-quirks: Add Framework 13 glossy and 2.8k panels
> >
> > Thomas Weißschuh <linux@weissschuh.net>
> > drm: panel-backlight-quirks: Add Framework 13 matte panel
> >
> > Thomas Weißschuh <linux@weissschuh.net>
> > drm/amd/display: Add support for minimum backlight quirk
> >
> > Thomas Weißschuh <linux@weissschuh.net>
> > drm: Add panel backlight quirks
> >
> > Dongwon Kim <dongwon.kim@intel.com>
> > drm/virtio: New fence for every plane update
> >
> > Yazen Ghannam <yazen.ghannam@amd.com>
> > x86/amd_nb: Restrict init function to AMD-based systems
> >
> > Carlos Llamas <cmllamas@google.com>
> > lockdep: Fix upper limit for LOCKDEP_*_BITS configs
> >
> > Thorsten Blum <thorsten.blum@linux.dev>
> > locking/ww_mutex/test: Use swap() macro
> >
> > Peter Zijlstra <peterz@infradead.org>
> > x86: Convert unreachable() to BUG()
> >
> > Juri Lelli <juri.lelli@redhat.com>
> > sched/deadline: Check bandwidth overflow earlier for hotplug
> >
> > Juri Lelli <juri.lelli@redhat.com>
> > sched/deadline: Correctly account for allocated bandwidth during hotplug
> >
> > Suleiman Souhlal <suleiman@google.com>
> > sched: Don't try to catch up excess steal time.
> >
> > Johannes Thumshirn <johannes.thumshirn@wdc.com>
> > btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents
> >
> > Josef Bacik <josef@toxicpanda.com>
> > btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
> >
> > Hao-ran Zheng <zhenghaoran154@gmail.com>
> > btrfs: fix data race when accessing the inode's disk_i_size at btrfs_drop_extents()
> >
> > Sven Schnelle <svens@linux.ibm.com>
> > s390/stackleak: Use exrl instead of ex in __stackleak_poison()
> >
> > Kees Cook <kees@kernel.org>
> > exec: fix up /proc/pid/comm in the execveat(AT_EMPTY_PATH) case
> >
> > Anshuman Khandual <anshuman.khandual@arm.com>
> > arm64/mm: Ensure adequate HUGE_MAX_HSTATE
> >
> > Filipe Manana <fdmanana@suse.com>
> > btrfs: fix use-after-free when attempting to join an aborted transaction
> >
> > Qu Wenruo <wqu@suse.com>
> > btrfs: do not output error message if a qgroup has been already cleaned up
> >
> > Filipe Manana <fdmanana@suse.com>
> > btrfs: fix assertion failure when splitting ordered extent after transaction abort
> >
> > Filipe Manana <fdmanana@suse.com>
> > btrfs: fix lockdep splat while merging a relocation root
> >
> > Geert Uytterhoeven <geert+renesas@glider.be>
> > irqchip/lan966x-oic: Make CONFIG_LAN966X_OIC depend on CONFIG_MCHP_LAN966X_PCI
> >
> >
> > -------------
> >
> > Diffstat:
> >
> > Documentation/arch/arm64/elf_hwcaps.rst | 39 +-
> > Documentation/driver-api/media/tx-rx.rst | 2 +-
> > Documentation/gpu/drm-kms-helpers.rst | 3 +
> > Makefile | 4 +-
> > arch/arm/boot/dts/ti/omap/dra7-l4.dtsi | 2 +
> > arch/arm/boot/dts/ti/omap/omap3-gta04.dtsi | 10 +
> > arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 5 -
> > arch/arm64/boot/dts/mediatek/mt8183-pumpkin.dts | 4 -
> > arch/arm64/boot/dts/mediatek/mt8183.dtsi | 2 +
> > arch/arm64/boot/dts/nvidia/tegra234.dtsi | 6 +-
> > arch/arm64/boot/dts/qcom/sdx75.dtsi | 2 +-
> > arch/arm64/boot/dts/qcom/sm6115.dtsi | 8 +-
> > arch/arm64/boot/dts/qcom/sm6350.dtsi | 6 +-
> > arch/arm64/boot/dts/qcom/sm6375.dtsi | 10 +-
> > arch/arm64/boot/dts/qcom/sm8350.dtsi | 492 ++++++++++-----------
> > arch/arm64/boot/dts/qcom/sm8450.dtsi | 216 ++++-----
> > arch/arm64/boot/dts/qcom/sm8550.dtsi | 271 ++++++------
> > arch/arm64/boot/dts/qcom/sm8650.dtsi | 305 +++++++------
> > .../dts/qcom/x1e78100-lenovo-thinkpad-t14s.dts | 4 +-
> > .../boot/dts/qcom/x1e80100-asus-vivobook-s15.dts | 4 +-
> > arch/arm64/boot/dts/qcom/x1e80100-crd.dts | 6 +-
> > .../boot/dts/qcom/x1e80100-dell-xps13-9345.dts | 4 +-
> > .../boot/dts/qcom/x1e80100-lenovo-yoga-slim7x.dts | 6 +-
> > .../boot/dts/qcom/x1e80100-microsoft-romulus.dtsi | 4 +-
> > arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 6 +-
> > arch/arm64/boot/dts/qcom/x1e80100.dtsi | 280 ++++++------
> > arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 2 +-
> > arch/arm64/include/asm/assembler.h | 5 +
> > arch/arm64/include/asm/pgtable-hwdef.h | 6 -
> > arch/arm64/include/asm/pgtable-prot.h | 7 +
> > arch/arm64/include/asm/sparsemem.h | 5 +-
> > arch/arm64/kernel/cpufeature.c | 55 +--
> > arch/arm64/kernel/cpuinfo.c | 10 +
> > arch/arm64/kernel/pi/idreg-override.c | 9 +
> > arch/arm64/kernel/pi/map_kernel.c | 6 +
> > arch/arm64/kvm/arch_timer.c | 4 +-
> > arch/arm64/kvm/arm.c | 8 +-
> > arch/arm64/mm/hugetlbpage.c | 12 +
> > arch/arm64/mm/init.c | 7 +-
> > arch/loongarch/include/uapi/asm/ptrace.h | 10 +
> > arch/loongarch/kernel/ptrace.c | 6 +-
> > arch/m68k/include/asm/vga.h | 8 +-
> > arch/mips/Kconfig | 1 -
> > arch/mips/kernel/ftrace.c | 2 +-
> > arch/mips/loongson64/boardinfo.c | 2 -
> > arch/mips/math-emu/cp1emu.c | 2 +-
> > arch/mips/pci/pci-legacy.c | 8 +
> > arch/parisc/Kconfig | 4 +-
> > arch/powerpc/platforms/pseries/eeh_pseries.c | 6 +-
> > arch/s390/include/asm/asm-extable.h | 4 +
> > arch/s390/include/asm/fpu-insn.h | 17 +-
> > arch/s390/include/asm/futex.h | 2 +-
> > arch/s390/include/asm/processor.h | 3 +-
> > arch/s390/kernel/vmlinux.lds.S | 1 -
> > arch/s390/kvm/vsie.c | 25 +-
> > arch/s390/mm/extable.c | 9 +
> > arch/s390/pci/pci_bus.c | 1 -
> > arch/x86/boot/compressed/Makefile | 1 +
> > arch/x86/include/asm/kexec.h | 18 +-
> > arch/x86/include/asm/kvm_host.h | 2 +
> > arch/x86/kernel/acpi/boot.c | 50 ++-
> > arch/x86/kernel/amd_nb.c | 4 +
> > arch/x86/kernel/machine_kexec_64.c | 45 +-
> > arch/x86/kernel/process.c | 2 +-
> > arch/x86/kernel/reboot.c | 2 +-
> > arch/x86/kvm/lapic.c | 11 +
> > arch/x86/kvm/lapic.h | 1 +
> > arch/x86/kvm/mmu/mmu.c | 45 +-
> > arch/x86/kvm/svm/sev.c | 2 +-
> > arch/x86/kvm/vmx/nested.c | 5 +
> > arch/x86/kvm/vmx/vmx.c | 21 +
> > arch/x86/kvm/vmx/vmx.h | 1 +
> > arch/x86/kvm/x86.c | 7 +-
> > arch/x86/mm/fault.c | 2 +-
> > arch/x86/pci/fixup.c | 30 ++
> > arch/x86/platform/efi/quirks.c | 5 +
> > arch/x86/xen/xen-head.S | 5 +-
> > block/blk-cgroup.c | 1 +
> > block/blk-sysfs.c | 3 +
> > block/fops.c | 5 +-
> > drivers/accel/ivpu/ivpu_drv.c | 8 +-
> > drivers/accel/ivpu/ivpu_pm.c | 86 ++--
> > drivers/acpi/apei/ghes.c | 10 +-
> > drivers/acpi/prmt.c | 4 +-
> > drivers/acpi/property.c | 10 +-
> > drivers/ata/libata-core.c | 4 +
> > drivers/ata/libata-sff.c | 18 +-
> > drivers/bluetooth/btusb.c | 6 +
> > drivers/char/misc.c | 37 +-
> > drivers/char/tpm/eventlog/acpi.c | 15 +-
> > drivers/clk/clk-loongson2.c | 5 +-
> > drivers/clk/mediatek/clk-mt2701-aud.c | 10 +
> > drivers/clk/mediatek/clk-mt2701-bdp.c | 1 +
> > drivers/clk/mediatek/clk-mt2701-img.c | 1 +
> > drivers/clk/mediatek/clk-mt2701-mm.c | 1 +
> > drivers/clk/mediatek/clk-mt2701-vdec.c | 1 +
> > drivers/clk/mmp/pwr-island.c | 2 +-
> > drivers/clk/qcom/Kconfig | 1 +
> > drivers/clk/qcom/clk-alpha-pll.c | 2 +
> > drivers/clk/qcom/clk-rpmh.c | 2 +-
> > drivers/clk/qcom/dispcc-sm6350.c | 7 +-
> > drivers/clk/qcom/gcc-mdm9607.c | 2 +-
> > drivers/clk/qcom/gcc-sm6350.c | 22 +-
> > drivers/clk/qcom/gcc-sm8550.c | 8 +-
> > drivers/clk/qcom/gcc-sm8650.c | 8 +-
> > drivers/clk/sunxi-ng/ccu-sun50i-a100.c | 6 +-
> > drivers/cpufreq/Kconfig | 2 +-
> > drivers/cpufreq/cpufreq-dt-platdev.c | 2 -
> > drivers/cpufreq/s3c64xx-cpufreq.c | 11 +-
> > drivers/crypto/qce/aead.c | 2 +-
> > drivers/crypto/qce/core.c | 13 +-
> > drivers/crypto/qce/sha.c | 2 +-
> > drivers/crypto/qce/skcipher.c | 2 +-
> > drivers/firmware/Kconfig | 2 +-
> > drivers/firmware/efi/libstub/Makefile | 2 +-
> > drivers/firmware/qcom/qcom_scm.c | 10 +-
> > drivers/gpio/Kconfig | 1 +
> > drivers/gpio/gpio-pca953x.c | 19 -
> > drivers/gpio/gpio-sim.c | 13 +-
> > drivers/gpu/drm/Kconfig | 4 +
> > drivers/gpu/drm/Makefile | 1 +
> > drivers/gpu/drm/amd/amdgpu/Kconfig | 1 +
> > drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 +-
> > drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 8 +-
> > drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h | 2 +
> > drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 11 -
> > drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 8 +-
> > drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c | 5 +-
> > drivers/gpu/drm/amd/amdkfd/kfd_device.c | 25 +-
> > .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 4 +-
> > drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c | 25 +-
> > drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +-
> > .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 7 +-
> > drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 20 +-
> > .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6 +-
> > .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 22 +-
> > .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.h | 3 +-
> > drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
> > .../gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 3 +-
> > drivers/gpu/drm/amd/display/dc/dml2/Makefile | 4 +
> > .../drm/amd/display/dc/dml2/display_mode_core.c | 35 +-
> > .../display/dc/dml2/display_mode_core_structs.h | 6 +-
> > drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c | 35 +-
> > .../gpu/drm/amd/display/dc/dpp/dcn10/dcn10_dpp.c | 7 +-
> > .../drm/amd/display/dc/dpp/dcn401/dcn401_dpp_cm.c | 6 +-
> > .../drm/amd/display/dc/hubbub/dcn30/dcn30_hubbub.c | 3 +-
> > .../drm/amd/display/dc/hubbub/dcn31/dcn31_hubbub.c | 3 +-
> > .../drm/amd/display/dc/hubbub/dcn32/dcn32_hubbub.c | 3 +-
> > .../drm/amd/display/dc/hubbub/dcn35/dcn35_hubbub.c | 3 +-
> > .../gpu/drm/amd/display/dc/hubp/dcn20/dcn20_hubp.c | 8 +-
> > .../gpu/drm/amd/display/dc/hubp/dcn30/dcn30_hubp.c | 2 +
> > .../gpu/drm/amd/display/dc/hubp/dcn32/dcn32_hubp.c | 2 +
> > .../drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c | 10 +-
> > .../drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 3 +-
> > .../display/dc/resource/dcn301/dcn301_resource.c | 8 +-
> > drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 1 -
> > .../drm/arm/display/komeda/komeda_wb_connector.c | 4 +
> > drivers/gpu/drm/ast/ast_dp.c | 2 +-
> > drivers/gpu/drm/bridge/analogix/anx7625.c | 2 +
> > drivers/gpu/drm/bridge/ite-it6505.c | 83 ++--
> > drivers/gpu/drm/bridge/ite-it66121.c | 2 +
> > drivers/gpu/drm/display/drm_dp_cec.c | 14 +-
> > drivers/gpu/drm/drm_client_modeset.c | 9 +
> > drivers/gpu/drm/drm_connector.c | 1 +
> > drivers/gpu/drm/drm_edid.c | 6 +
> > drivers/gpu/drm/drm_fb_helper.c | 14 +-
> > drivers/gpu/drm/drm_panel_backlight_quirks.c | 94 ++++
> > drivers/gpu/drm/exynos/exynos_hdmi.c | 2 +
> > drivers/gpu/drm/i915/display/intel_dp.c | 10 +-
> > drivers/gpu/drm/i915/display/intel_hdcp.c | 13 +
> > drivers/gpu/drm/i915/display/skl_universal_plane.c | 4 -
> > drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 6 +-
> > drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 20 +-
> > drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 13 +
> > drivers/gpu/drm/msm/dp/dp_audio.c | 2 +
> > drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c | 16 +-
> > drivers/gpu/drm/radeon/radeon_audio.c | 2 +
> > drivers/gpu/drm/rockchip/cdn-dp-core.c | 9 +-
> > drivers/gpu/drm/sti/sti_hdmi.c | 2 +
> > drivers/gpu/drm/tests/drm_hdmi_state_helper_test.c | 33 +-
> > drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +-
> > drivers/gpu/drm/virtio/virtgpu_drv.h | 7 +
> > drivers/gpu/drm/virtio/virtgpu_plane.c | 58 ++-
> > drivers/gpu/drm/xe/regs/xe_oa_regs.h | 6 +
> > drivers/gpu/drm/xe/xe_devcoredump.c | 42 +-
> > drivers/gpu/drm/xe/xe_devcoredump.h | 2 +-
> > drivers/gpu/drm/xe/xe_gt.c | 4 +-
> > drivers/gpu/drm/xe/xe_gt_sriov_pf.c | 14 +-
> > drivers/gpu/drm/xe/xe_gt_sriov_pf.h | 6 +
> > drivers/gpu/drm/xe/xe_guc_ct.c | 3 +-
> > drivers/gpu/drm/xe/xe_guc_log.c | 4 +-
> > drivers/gpu/drm/xe/xe_oa.c | 12 +-
> > drivers/hid/hid-asus.c | 26 ++
> > drivers/hid/hid-multitouch.c | 5 +
> > drivers/hid/hid-sensor-hub.c | 21 +-
> > drivers/hid/wacom_wac.c | 5 +
> > drivers/i2c/i2c-core-acpi.c | 22 +
> > drivers/i3c/master.c | 2 +-
> > drivers/iio/chemical/bme680_core.c | 4 +-
> > drivers/iio/dac/ad3552r-common.c | 5 +-
> > drivers/iio/dac/ad3552r-hs.c | 6 +
> > drivers/iio/dac/ad3552r.h | 8 +-
> > drivers/iio/light/as73211.c | 24 +-
> > drivers/infiniband/hw/mlx5/mr.c | 17 +-
> > drivers/infiniband/hw/mlx5/odp.c | 2 +
> > drivers/input/misc/nxp-bbnsm-pwrkey.c | 8 +
> > drivers/input/mouse/synaptics.c | 56 ++-
> > drivers/input/mouse/synaptics.h | 1 +
> > drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 17 +-
> > drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 +-
> > drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 +
> > drivers/iommu/intel/iommu.c | 7 +-
> > drivers/iommu/iommufd/fault.c | 44 +-
> > drivers/iommu/iommufd/iommufd_private.h | 29 +-
> > drivers/irqchip/Kconfig | 1 +
> > drivers/irqchip/irq-apple-aic.c | 3 +-
> > drivers/irqchip/irq-mvebu-icu.c | 3 +-
> > drivers/leds/leds-lp8860.c | 2 +-
> > drivers/mailbox/tegra-hsp.c | 6 +-
> > drivers/mailbox/zynqmp-ipi-mailbox.c | 2 +-
> > drivers/md/Kconfig | 13 +
> > drivers/md/Makefile | 2 +
> > drivers/md/dm-crypt.c | 27 +-
> > drivers/md/md-autodetect.c | 8 +-
> > drivers/md/md-linear.c | 352 +++++++++++++++
> > drivers/md/md.c | 2 +-
> > drivers/media/i2c/ccs/ccs-core.c | 6 +-
> > drivers/media/i2c/ccs/ccs-data.c | 14 +-
> > drivers/media/i2c/ds90ub913.c | 1 -
> > drivers/media/i2c/ds90ub953.c | 1 -
> > drivers/media/i2c/ds90ub960.c | 123 +++---
> > drivers/media/i2c/imx296.c | 2 +
> > drivers/media/i2c/ov5640.c | 1 +
> > drivers/media/pci/intel/ipu6/ipu6-isys.c | 1 +
> > drivers/media/platform/marvell/mmp-driver.c | 21 +-
> > drivers/media/platform/nuvoton/npcm-video.c | 4 +-
> > drivers/media/platform/qcom/venus/core.c | 8 +-
> > .../st/stm32/stm32-dcmipp/dcmipp-bytecap.c | 2 +-
> > drivers/media/usb/uvc/uvc_ctrl.c | 83 +++-
> > drivers/media/usb/uvc/uvc_driver.c | 98 ++--
> > drivers/media/usb/uvc/uvc_v4l2.c | 2 +
> > drivers/media/usb/uvc/uvc_video.c | 21 +
> > drivers/media/usb/uvc/uvcvideo.h | 10 +-
> > drivers/media/v4l2-core/v4l2-mc.c | 2 +-
> > drivers/mfd/axp20x.c | 2 +-
> > drivers/mfd/lpc_ich.c | 3 +-
> > drivers/misc/fastrpc.c | 8 +-
> > drivers/mmc/core/sdio.c | 2 +
> > drivers/mmc/host/sdhci-esdhc-imx.c | 1 +
> > drivers/mmc/host/sdhci-msm.c | 53 ++-
> > drivers/mtd/nand/onenand/onenand_base.c | 1 +
> > drivers/mtd/ubi/build.c | 2 +-
> > drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 +-
> > drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c | 16 +-
> > drivers/net/ethernet/broadcom/tg3.c | 58 +++
> > drivers/net/ethernet/intel/ice/devlink/devlink.c | 3 +
> > drivers/net/ethernet/intel/ice/ice_txrx.c | 150 +++++--
> > drivers/net/ethernet/intel/ice/ice_txrx.h | 1 -
> > drivers/net/ethernet/intel/ice/ice_txrx_lib.h | 43 --
> > .../net/ethernet/marvell/octeon_ep/octep_ethtool.c | 39 +-
> > .../net/ethernet/marvell/octeon_ep/octep_main.c | 19 +-
> > .../net/ethernet/marvell/octeon_ep/octep_main.h | 6 +
> > drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 11 +-
> > drivers/net/ethernet/marvell/octeon_ep/octep_rx.h | 4 +-
> > drivers/net/ethernet/marvell/octeon_ep/octep_tx.c | 7 +-
> > drivers/net/ethernet/marvell/octeon_ep/octep_tx.h | 4 +-
> > .../marvell/octeon_ep_vf/octep_vf_ethtool.c | 29 +-
> > .../ethernet/marvell/octeon_ep_vf/octep_vf_main.c | 17 +-
> > .../ethernet/marvell/octeon_ep_vf/octep_vf_main.h | 6 +
> > .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c | 9 +-
> > .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.h | 2 +-
> > .../ethernet/marvell/octeon_ep_vf/octep_vf_tx.c | 7 +-
> > .../ethernet/marvell/octeon_ep_vf/octep_vf_tx.h | 2 +-
> > .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 24 +-
> > .../ethernet/mellanox/mlx5/core/steering/hws/bwc.c | 17 +-
> > .../ethernet/mellanox/mlx5/core/steering/hws/bwc.h | 2 +-
> > .../mellanox/mlx5/core/steering/hws/matcher.c | 24 +-
> > drivers/net/ethernet/ti/am65-cpsw-nuss.c | 67 ++-
> > drivers/net/phy/nxp-c45-tja11xx.c | 2 +
> > drivers/net/tun.c | 2 +-
> > drivers/net/usb/ipheth.c | 69 ++-
> > drivers/net/vmxnet3/vmxnet3_xdp.c | 14 +-
> > .../net/wireless/ath/ath12k/debugfs_htt_stats.c | 5 +-
> > drivers/net/wireless/ath/ath12k/mac.c | 59 +--
> > .../wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +
> > .../net/wireless/broadcom/brcm80211/brcmfmac/of.c | 8 +-
> > .../broadcom/brcm80211/brcmsmac/phy/phy_n.c | 3 +
> > drivers/net/wireless/intel/iwlwifi/Makefile | 2 +-
> > drivers/net/wireless/intel/iwlwifi/cfg/dr.c | 167 +++++++
> > drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 13 +-
> > drivers/net/wireless/intel/iwlwifi/iwl-config.h | 10 +
> > drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 16 +
> > drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 21 +-
> > drivers/net/wireless/mediatek/mt76/mt7915/init.c | 4 +-
> > drivers/net/wireless/mediatek/mt76/mt7921/usb.c | 3 +
> > .../net/wireless/realtek/rtlwifi/rtl8821ae/fw.h | 4 +-
> > drivers/net/wireless/realtek/rtw88/main.h | 4 +-
> > drivers/net/wireless/realtek/rtw88/rtw8703b.c | 8 +-
> > drivers/net/wireless/realtek/rtw88/rtw8723x.h | 8 +-
> > drivers/net/wireless/realtek/rtw88/rtw8821c.h | 9 +-
> > drivers/net/wireless/realtek/rtw88/rtw8822b.h | 9 +-
> > drivers/net/wireless/realtek/rtw88/rtw8822c.h | 9 +-
> > drivers/net/wireless/realtek/rtw88/sdio.c | 2 +
> > drivers/net/wireless/realtek/rtw89/pci.c | 16 +-
> > drivers/net/wireless/realtek/rtw89/pci.h | 9 +
> > drivers/net/wireless/realtek/rtw89/pci_be.c | 1 +
> > drivers/net/wireless/realtek/rtw89/phy.c | 13 +-
> > drivers/net/wireless/realtek/rtw89/phy.h | 2 +-
> > drivers/net/wwan/iosm/iosm_ipc_pcie.c | 56 ++-
> > drivers/nvme/host/core.c | 8 +-
> > drivers/nvme/host/fc.c | 9 +-
> > drivers/nvme/host/pci.c | 4 +-
> > drivers/nvme/host/sysfs.c | 2 +-
> > drivers/nvme/target/admin-cmd.c | 1 +
> > drivers/nvmem/core.c | 2 +
> > drivers/nvmem/imx-ocotp-ele.c | 38 +-
> > drivers/nvmem/qcom-spmi-sdam.c | 1 +
> > drivers/of/address.c | 12 +-
> > drivers/of/base.c | 8 +-
> > drivers/of/of_reserved_mem.c | 9 +-
> > drivers/pci/controller/dwc/pcie-designware-ep.c | 48 +-
> > drivers/pci/endpoint/pci-epf-core.c | 1 +
> > drivers/pci/tph.c | 2 +-
> > drivers/perf/fsl_imx9_ddr_perf.c | 33 +-
> > drivers/pinctrl/renesas/pinctrl-rzg2l.c | 2 +-
> > drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +-
> > drivers/platform/x86/acer-wmi.c | 45 ++
> > drivers/platform/x86/intel/int3472/discrete.c | 3 +
> > drivers/platform/x86/intel/int3472/tps68470.c | 3 +
> > drivers/platform/x86/serdev_helpers.h | 4 +-
> > drivers/ptp/ptp_clock.c | 8 +
> > drivers/pwm/pwm-microchip-core.c | 2 +-
> > drivers/remoteproc/omap_remoteproc.c | 17 +
> > drivers/rtc/rtc-zynqmp.c | 4 +-
> > drivers/scsi/qla2xxx/qla_def.h | 2 +
> > drivers/scsi/qla2xxx/qla_dfs.c | 122 ++++-
> > drivers/scsi/qla2xxx/qla_gbl.h | 3 +
> > drivers/scsi/qla2xxx/qla_init.c | 28 +-
> > drivers/scsi/scsi_lib.c | 9 +-
> > drivers/scsi/st.c | 6 +
> > drivers/scsi/st.h | 1 +
> > drivers/scsi/storvsc_drv.c | 1 +
> > drivers/soc/mediatek/mtk-devapc.c | 19 +-
> > drivers/soc/qcom/llcc-qcom.c | 1 +
> > drivers/soc/qcom/smem_state.c | 3 +-
> > drivers/soc/qcom/socinfo.c | 2 +-
> > drivers/soc/samsung/exynos-pmu.c | 2 +-
> > drivers/spi/atmel-quadspi.c | 118 +++--
> > drivers/tty/serial/sh-sci.c | 25 +-
> > drivers/tty/serial/xilinx_uartps.c | 8 +-
> > drivers/tty/vt/selection.c | 14 +
> > drivers/tty/vt/vt.c | 2 -
> > drivers/ufs/core/ufshcd.c | 31 +-
> > drivers/ufs/host/ufs-qcom.c | 18 +-
> > drivers/ufs/host/ufshcd-pci.c | 2 -
> > drivers/ufs/host/ufshcd-pltfrm.c | 28 +-
> > drivers/usb/gadget/function/f_tcm.c | 52 +--
> > drivers/vfio/platform/vfio_platform_common.c | 10 +
> > fs/binfmt_flat.c | 2 +-
> > fs/btrfs/ctree.c | 2 +
> > fs/btrfs/file.c | 2 +-
> > fs/btrfs/ordered-data.c | 12 +
> > fs/btrfs/qgroup.c | 5 +-
> > fs/btrfs/raid-stripe-tree.c | 26 +-
> > fs/btrfs/relocation.c | 14 +-
> > fs/btrfs/transaction.c | 4 +-
> > fs/ceph/mds_client.c | 16 +-
> > fs/exec.c | 29 +-
> > fs/namespace.c | 54 ++-
> > fs/nfs/Kconfig | 3 +-
> > fs/nfs/flexfilelayout/flexfilelayout.c | 27 +-
> > fs/nfsd/nfs4xdr.c | 20 +-
> > fs/nilfs2/inode.c | 6 +-
> > fs/ocfs2/super.c | 2 +-
> > fs/ocfs2/symlink.c | 5 +-
> > fs/pidfs.c | 34 ++
> > fs/proc/array.c | 2 +-
> > fs/smb/client/cifsglob.h | 14 +-
> > fs/smb/client/dir.c | 6 +-
> > fs/smb/client/smb1ops.c | 2 +-
> > fs/smb/client/smb2inode.c | 108 ++---
> > fs/smb/client/smb2ops.c | 41 +-
> > fs/smb/client/smb2pdu.c | 2 +-
> > fs/smb/client/smb2proto.h | 2 +-
> > fs/smb/server/transport_ipc.c | 9 +
> > fs/xfs/xfs_exchrange.c | 71 ++-
> > fs/xfs/xfs_inode.c | 7 +-
> > fs/xfs/xfs_iomap.c | 6 +-
> > include/drm/drm_connector.h | 5 +-
> > include/drm/drm_utils.h | 4 +
> > include/linux/binfmts.h | 4 +-
> > include/linux/call_once.h | 45 ++
> > include/linux/hrtimer_defs.h | 1 +
> > include/linux/jiffies.h | 2 +-
> > include/linux/kvm_host.h | 9 +
> > include/linux/mlx5/driver.h | 1 -
> > include/linux/platform_data/x86/asus-wmi.h | 5 +
> > include/net/sch_generic.h | 2 +-
> > include/rv/da_monitor.h | 4 +
> > include/trace/events/rxrpc.h | 1 +
> > include/uapi/drm/amdgpu_drm.h | 9 +-
> > include/uapi/linux/input-event-codes.h | 1 +
> > include/uapi/linux/iommufd.h | 4 +-
> > include/uapi/linux/raid/md_p.h | 2 +-
> > include/uapi/linux/raid/md_u.h | 2 +
> > include/ufs/ufs.h | 4 +-
> > include/ufs/ufshcd.h | 1 -
> > io_uring/net.c | 5 +
> > io_uring/poll.c | 4 +
> > kernel/bpf/verifier.c | 2 +-
> > kernel/locking/test-ww_mutex.c | 9 +-
> > kernel/printk/printk.c | 2 +-
> > kernel/sched/core.c | 28 +-
> > kernel/sched/deadline.c | 56 ++-
> > kernel/sched/fair.c | 19 +
> > kernel/sched/sched.h | 2 +-
> > kernel/seccomp.c | 12 +
> > kernel/time/hrtimer.c | 103 ++++-
> > kernel/time/timer_migration.c | 10 +-
> > kernel/trace/ring_buffer.c | 13 +-
> > kernel/trace/trace_functions_graph.c | 2 +-
> > kernel/trace/trace_osnoise.c | 17 +-
> > lib/Kconfig.debug | 8 +-
> > lib/atomic64.c | 78 ++--
> > lib/maple_tree.c | 23 +-
> > mm/compaction.c | 3 +-
> > mm/gup.c | 14 +-
> > mm/hugetlb.c | 24 +-
> > mm/kfence/core.c | 2 +
> > mm/kmemleak.c | 2 +-
> > mm/vmscan.c | 7 +-
> > net/bluetooth/l2cap_sock.c | 7 +-
> > net/bluetooth/mgmt.c | 12 +-
> > net/ethtool/ioctl.c | 2 +-
> > net/ethtool/rss.c | 3 +-
> > net/ipv4/udp.c | 4 +-
> > net/ipv6/udp.c | 4 +-
> > net/ncsi/ncsi-manage.c | 13 +-
> > net/nfc/nci/hci.c | 2 +
> > net/rose/af_rose.c | 24 +-
> > net/rxrpc/ar-internal.h | 2 +-
> > net/rxrpc/call_object.c | 6 +-
> > net/rxrpc/conn_event.c | 21 +-
> > net/rxrpc/conn_object.c | 1 +
> > net/rxrpc/input.c | 2 +-
> > net/rxrpc/sendmsg.c | 2 +-
> > net/sched/sch_fifo.c | 3 +
> > net/sched/sch_netem.c | 2 +-
> > net/tipc/crypto.c | 4 +-
> > rust/kernel/init.rs | 2 +-
> > scripts/Makefile.extrawarn | 5 +-
> > scripts/gdb/linux/cpus.py | 2 +-
> > scripts/generate_rust_target.rs | 18 +
> > security/keys/trusted-keys/trusted_dcp.c | 22 +-
> > security/safesetid/securityfs.c | 3 +
> > security/tomoyo/common.c | 2 +-
> > sound/pci/hda/hda_auto_parser.c | 8 +-
> > sound/pci/hda/hda_auto_parser.h | 1 +
> > sound/pci/hda/patch_realtek.c | 20 +-
> > sound/soc/amd/Kconfig | 2 +-
> > sound/soc/amd/yc/acp6x-mach.c | 28 ++
> > sound/soc/intel/boards/sof_sdw.c | 5 +-
> > sound/soc/renesas/rz-ssi.c | 10 +-
> > sound/soc/soc-pcm.c | 32 +-
> > sound/soc/sof/intel/hda-dai.c | 12 +
> > sound/soc/sof/intel/hda.c | 5 +
> > tools/perf/bench/epoll-wait.c | 7 +-
> > .../testing/selftests/bpf/progs/exceptions_fail.c | 4 +-
> > tools/testing/selftests/bpf/progs/preempt_lock.c | 14 +-
> > .../selftests/bpf/progs/verifier_spin_lock.c | 2 +-
> > tools/testing/selftests/drivers/net/hw/rss_ctx.py | 2 +
> > tools/testing/selftests/net/ipsec.c | 3 +-
> > tools/testing/selftests/net/mptcp/mptcp_connect.c | 2 +-
> > tools/testing/selftests/net/udpgso.c | 26 ++
> > tools/tracing/rtla/src/osnoise.c | 2 +-
> > tools/tracing/rtla/src/timerlat_hist.c | 26 +-
> > tools/tracing/rtla/src/timerlat_top.c | 27 +-
> > tools/tracing/rtla/src/trace.c | 8 +
> > tools/tracing/rtla/src/trace.h | 1 +
> > 479 files changed, 5359 insertions(+), 2651 deletions(-)
> >
> >
> >
^ permalink raw reply [flat|nested] 474+ messages in thread
* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2025-02-14 6:42 ` Luna Jernberg
@ 2025-02-14 8:32 ` Holger Hoffstätte
2025-02-14 8:42 ` Greg Kroah-Hartman
2025-02-14 9:45 ` [PATCH 6.13 000/443] 6.13.3-rc1 review Jon Hunter
453 siblings, 1 reply; 474+ messages in thread
From: Holger Hoffstätte @ 2025-02-14 8:32 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, hargar, broonie
On 2025-02-13 15:22, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds & runs fine BUT fails to suspend to RAM 99.99% of the time (basically
one success but never again). Display powers down but fans stay on.
Tested on multiple systems, all x64. I first suspected amdgpu because why not :)
but it also fails on a system without amdgpu, so that's not it.
Reverting to 6.13.2 immediately fixes everything.
Common symptom on all machines seems to be
[ +0.000134] Disabling non-boot CPUs ...
[ +0.000072] Error taking CPU15 down: -16
[ +0.000002] Non-boot CPUs are not disabled
"Error taking down CPUX" is always the highest number of CPU, i.e.
15 on my 16-core Zen2 laptop, 3 on my 4-core Sandybridge etc.
I started to revert suspects but no luck so far:
- acpi parsing order
- amdgpu backlight quirks
- timers/hrtimers
Suggestions for other suspects are welcome.
-h
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-14 8:32 ` Holger Hoffstätte
@ 2025-02-14 8:42 ` Greg Kroah-Hartman
2025-02-14 9:06 ` Holger Hoffstätte
2025-02-14 10:12 ` Holger Hoffstätte
0 siblings, 2 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-14 8:42 UTC (permalink / raw)
To: Holger Hoffstätte
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
On Fri, Feb 14, 2025 at 09:32:06AM +0100, Holger Hoffstätte wrote:
> On 2025-02-13 15:22, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 6.13.3 release.
> > There are 443 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
>
> Builds & runs fine BUT fails to suspend to RAM 99.99% of the time (basically
> one success but never again). Display powers down but fans stay on.
>
> Tested on multiple systems, all x64. I first suspected amdgpu because why not :)
> but it also fails on a system without amdgpu, so that's not it.
>
> Reverting to 6.13.2 immediately fixes everything.
>
> Common symptom on all machines seems to be
>
> [ +0.000134] Disabling non-boot CPUs ...
> [ +0.000072] Error taking CPU15 down: -16
> [ +0.000002] Non-boot CPUs are not disabled
>
> "Error taking down CPUX" is always the highest number of CPU, i.e.
> 15 on my 16-core Zen2 laptop, 3 on my 4-core Sandybridge etc.
>
> I started to revert suspects but no luck so far:
> - acpi parsing order
> - amdgpu backlight quirks
> - timers/hrtimers
>
> Suggestions for other suspects are welcome.
Can you run 'git bisect' to try to find the offending change?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 474+ messages in thread
* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-14 8:42 ` Greg Kroah-Hartman
@ 2025-02-14 9:06 ` Holger Hoffstätte
2025-02-14 10:12 ` Holger Hoffstätte
1 sibling, 0 replies; 474+ messages in thread
From: Holger Hoffstätte @ 2025-02-14 9:06 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
On 2025-02-14 09:42, Greg Kroah-Hartman wrote:
> On Fri, Feb 14, 2025 at 09:32:06AM +0100, Holger Hoffstätte wrote:
>> On 2025-02-13 15:22, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 6.13.3 release.
>>> There are 443 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>
>> Builds & runs fine BUT fails to suspend to RAM 99.99% of the time (basically
>> one success but never again). Display powers down but fans stay on.
>>
>> Tested on multiple systems, all x64. I first suspected amdgpu because why not :)
>> but it also fails on a system without amdgpu, so that's not it.
>>
>> Reverting to 6.13.2 immediately fixes everything.
>>
>> Common symptom on all machines seems to be
>>
>> [ +0.000134] Disabling non-boot CPUs ...
>> [ +0.000072] Error taking CPU15 down: -16
>> [ +0.000002] Non-boot CPUs are not disabled
>>
>> "Error taking down CPUX" is always the highest number of CPU, i.e.
>> 15 on my 16-core Zen2 laptop, 3 on my 4-core Sandybridge etc.
>>
>> I started to revert suspects but no luck so far:
>> - acpi parsing order
>> - amdgpu backlight quirks
>> - timers/hrtimers
>>
>> Suggestions for other suspects are welcome.
>
> Can you run 'git bisect' to try to find the offending change?
Can do later today but this is going to take a while - slow HW. :(
-h
^ permalink raw reply [flat|nested] 474+ messages in thread
* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-14 8:42 ` Greg Kroah-Hartman
2025-02-14 9:06 ` Holger Hoffstätte
@ 2025-02-14 10:12 ` Holger Hoffstätte
2025-02-14 13:07 ` Greg Kroah-Hartman
2025-02-14 23:18 ` Suspend failures (was Re: [PATCH 6.13 000/443] 6.13.3-rc1 review) Linus Torvalds
1 sibling, 2 replies; 474+ messages in thread
From: Holger Hoffstätte @ 2025-02-14 10:12 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie,
Juri Lelli
On 2025-02-14 09:42, Greg Kroah-Hartman wrote:
> On Fri, Feb 14, 2025 at 09:32:06AM +0100, Holger Hoffstätte wrote:
>> On 2025-02-13 15:22, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 6.13.3 release.
>>> There are 443 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>
>> Builds & runs fine BUT fails to suspend to RAM 99.99% of the time (basically
>> one success but never again). Display powers down but fans stay on.
>>
>> Tested on multiple systems, all x64. I first suspected amdgpu because why not :)
>> but it also fails on a system without amdgpu, so that's not it.
>>
>> Reverting to 6.13.2 immediately fixes everything.
>>
>> Common symptom on all machines seems to be
>>
>> [ +0.000134] Disabling non-boot CPUs ...
>> [ +0.000072] Error taking CPU15 down: -16
>> [ +0.000002] Non-boot CPUs are not disabled
>>
>> "Error taking down CPUX" is always the highest number of CPU, i.e.
>> 15 on my 16-core Zen2 laptop, 3 on my 4-core Sandybridge etc.
>>
>> I started to revert suspects but no luck so far:
>> - acpi parsing order
>> - amdgpu backlight quirks
>> - timers/hrtimers
>>
>> Suggestions for other suspects are welcome.
>
> Can you run 'git bisect' to try to find the offending change?
(cc: Juri Lelli)
Whoop! Whoop! The sound of da police!
2ce2a62881abcd379b714bf41aa671ad7657bdd2 is the first bad commit
commit 2ce2a62881abcd379b714bf41aa671ad7657bdd2 (HEAD)
Author: Juri Lelli <juri.lelli@redhat.com>
Date: Fri Nov 15 11:48:29 2024 +0000
sched/deadline: Check bandwidth overflow earlier for hotplug
[ Upstream commit 53916d5fd3c0b658de3463439dd2b7ce765072cb ]
With this reverted it reliably suspends again.
cheers
Holger
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-14 10:12 ` Holger Hoffstätte
@ 2025-02-14 13:07 ` Greg Kroah-Hartman
2025-02-14 23:18 ` Suspend failures (was Re: [PATCH 6.13 000/443] 6.13.3-rc1 review) Linus Torvalds
1 sibling, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-14 13:07 UTC (permalink / raw)
To: Holger Hoffstätte
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie,
Juri Lelli
On Fri, Feb 14, 2025 at 11:12:06AM +0100, Holger Hoffstätte wrote:
> On 2025-02-14 09:42, Greg Kroah-Hartman wrote:
> > On Fri, Feb 14, 2025 at 09:32:06AM +0100, Holger Hoffstätte wrote:
> > > On 2025-02-13 15:22, Greg Kroah-Hartman wrote:
> > > > This is the start of the stable review cycle for the 6.13.3 release.
> > > > There are 443 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > >
> > > Builds & runs fine BUT fails to suspend to RAM 99.99% of the time (basically
> > > one success but never again). Display powers down but fans stay on.
> > >
> > > Tested on multiple systems, all x64. I first suspected amdgpu because why not :)
> > > but it also fails on a system without amdgpu, so that's not it.
> > >
> > > Reverting to 6.13.2 immediately fixes everything.
> > >
> > > Common symptom on all machines seems to be
> > >
> > > [ +0.000134] Disabling non-boot CPUs ...
> > > [ +0.000072] Error taking CPU15 down: -16
> > > [ +0.000002] Non-boot CPUs are not disabled
> > >
> > > "Error taking down CPUX" is always the highest number of CPU, i.e.
> > > 15 on my 16-core Zen2 laptop, 3 on my 4-core Sandybridge etc.
> > >
> > > I started to revert suspects but no luck so far:
> > > - acpi parsing order
> > > - amdgpu backlight quirks
> > > - timers/hrtimers
> > >
> > > Suggestions for other suspects are welcome.
> >
> > Can you run 'git bisect' to try to find the offending change?
>
> (cc: Juri Lelli)
>
> Whoop! Whoop! The sound of da police!
>
> 2ce2a62881abcd379b714bf41aa671ad7657bdd2 is the first bad commit
> commit 2ce2a62881abcd379b714bf41aa671ad7657bdd2 (HEAD)
> Author: Juri Lelli <juri.lelli@redhat.com>
> Date: Fri Nov 15 11:48:29 2024 +0000
>
> sched/deadline: Check bandwidth overflow earlier for hotplug
> [ Upstream commit 53916d5fd3c0b658de3463439dd2b7ce765072cb ]
>
> With this reverted it reliably suspends again.
Thanks! I'll go revert that one now and push out new -rc releases soon.
greg k-h
^ permalink raw reply [flat|nested] 474+ messages in thread
* Suspend failures (was Re: [PATCH 6.13 000/443] 6.13.3-rc1 review)
2025-02-14 10:12 ` Holger Hoffstätte
2025-02-14 13:07 ` Greg Kroah-Hartman
@ 2025-02-14 23:18 ` Linus Torvalds
2025-02-15 0:48 ` Suspend failures (was " Holger Hoffstätte
2025-02-15 1:35 ` Suspend failures (was " Waiman Long
1 sibling, 2 replies; 474+ messages in thread
From: Linus Torvalds @ 2025-02-14 23:18 UTC (permalink / raw)
To: Holger Hoffstätte, Peter Zijlstra, Juri Lelli, Phil Auld,
Waiman Long
Cc: Greg Kroah-Hartman, stable
Adding more people: Peter / Phil / Waiman. Juri was already on the list earlier.
On Fri, 14 Feb 2025 at 02:12, Holger Hoffstätte
<holger@applied-asynchrony.com> wrote:
>
> Whoop! Whoop! The sound of da police!
>
> 2ce2a62881abcd379b714bf41aa671ad7657bdd2 is the first bad commit
> commit 2ce2a62881abcd379b714bf41aa671ad7657bdd2 (HEAD)
> Author: Juri Lelli <juri.lelli@redhat.com>
> Date: Fri Nov 15 11:48:29 2024 +0000
>
> sched/deadline: Check bandwidth overflow earlier for hotplug
>
> [ Upstream commit 53916d5fd3c0b658de3463439dd2b7ce765072cb ]
>
> With this reverted it reliably suspends again.
Can you check that it works (or - more likely - doesn't work) in upstream?
That commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow
earlier for hotplug") got merged during the current merge window, so
it would be lovely if you can check whether current -git (or just the
latest 6.14-rc) works for you, or has the same breakage.
Background for new people on the participants list: original report at
https://lore.kernel.org/all/e7096ec2-68db-fc3e-9c48-f20d3e80df72@applied-asynchrony.com/
which says
>> Common symptom on all machines seems to be
>>
>> [ +0.000134] Disabling non-boot CPUs ...
>> [ +0.000072] Error taking CPU15 down: -16
>> [ +0.000002] Non-boot CPUs are not disabled
and this bisection result is from
https://lore.kernel.org/all/9a44f314-c101-4ed1-98ad-547c84df7cdd@applied-asynchrony.com/
and if it breaks in 6.13 -stable, I would expect the same in the
current tree. Unless there's some non-obvious interaction with
something else ?
Linus
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: Suspend failures (was [PATCH 6.13 000/443] 6.13.3-rc1 review)
2025-02-14 23:18 ` Suspend failures (was Re: [PATCH 6.13 000/443] 6.13.3-rc1 review) Linus Torvalds
@ 2025-02-15 0:48 ` Holger Hoffstätte
2025-02-15 7:46 ` Greg Kroah-Hartman
2025-02-15 1:35 ` Suspend failures (was " Waiman Long
1 sibling, 1 reply; 474+ messages in thread
From: Holger Hoffstätte @ 2025-02-15 0:48 UTC (permalink / raw)
To: Linus Torvalds, Peter Zijlstra, Juri Lelli, Phil Auld,
Waiman Long
Cc: Greg Kroah-Hartman, stable
On 2025-02-15 00:18, Linus Torvalds wrote:
> Adding more people: Peter / Phil / Waiman. Juri was already on the list earlier.
>
> On Fri, 14 Feb 2025 at 02:12, Holger Hoffstätte
> <holger@applied-asynchrony.com> wrote:
>>
>> Whoop! Whoop! The sound of da police!
>>
>> 2ce2a62881abcd379b714bf41aa671ad7657bdd2 is the first bad commit
>> commit 2ce2a62881abcd379b714bf41aa671ad7657bdd2 (HEAD)
>> Author: Juri Lelli <juri.lelli@redhat.com>
>> Date: Fri Nov 15 11:48:29 2024 +0000
>>
>> sched/deadline: Check bandwidth overflow earlier for hotplug
>>
>> [ Upstream commit 53916d5fd3c0b658de3463439dd2b7ce765072cb ]
>>
>> With this reverted it reliably suspends again.
>
> Can you check that it works (or - more likely - doesn't work) in upstream?
>
> That commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow
> earlier for hotplug") got merged during the current merge window, so
> it would be lovely if you can check whether current -git (or just the
> latest 6.14-rc) works for you, or has the same breakage.
>
> Background for new people on the participants list: original report at
>
> https://lore.kernel.org/all/e7096ec2-68db-fc3e-9c48-f20d3e80df72@applied-asynchrony.com/
>
> which says
>
>>> Common symptom on all machines seems to be
>>>
>>> [ +0.000134] Disabling non-boot CPUs ...
>>> [ +0.000072] Error taking CPU15 down: -16
>>> [ +0.000002] Non-boot CPUs are not disabled
>
> and this bisection result is from
>
> https://lore.kernel.org/all/9a44f314-c101-4ed1-98ad-547c84df7cdd@applied-asynchrony.com/
>
> and if it breaks in 6.13 -stable, I would expect the same in the
> current tree. Unless there's some non-obvious interaction with
> something else ?
I just booted into current 6.14-git and could suspend/wakeup multiple times without
any problem - no reverting necessary, so that is good.
As for 6.12/6.13 it might be necessary to revert an accompanying commit
as well since it seems to cause test failures with hotplug, as documented here:
https://lore.kernel.org/stable/bcf76664-e77c-44b3-b78f-bcefc7aa3fc1@nvidia.com/
..but I don't know anything about that; I just wanted to find the patch causing
the suspend problem. Other than that 6.13.3-rc2 works fine.
Not sure if that was useful information. :)
cheers
Holger
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: Suspend failures (was [PATCH 6.13 000/443] 6.13.3-rc1 review)
2025-02-15 0:48 ` Suspend failures (was " Holger Hoffstätte
@ 2025-02-15 7:46 ` Greg Kroah-Hartman
0 siblings, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-15 7:46 UTC (permalink / raw)
To: Holger Hoffstätte
Cc: Linus Torvalds, Peter Zijlstra, Juri Lelli, Phil Auld,
Waiman Long, stable
On Sat, Feb 15, 2025 at 01:48:34AM +0100, Holger Hoffstätte wrote:
> On 2025-02-15 00:18, Linus Torvalds wrote:
> > Adding more people: Peter / Phil / Waiman. Juri was already on the list earlier.
> >
> > On Fri, 14 Feb 2025 at 02:12, Holger Hoffstätte
> > <holger@applied-asynchrony.com> wrote:
> > >
> > > Whoop! Whoop! The sound of da police!
> > >
> > > 2ce2a62881abcd379b714bf41aa671ad7657bdd2 is the first bad commit
> > > commit 2ce2a62881abcd379b714bf41aa671ad7657bdd2 (HEAD)
> > > Author: Juri Lelli <juri.lelli@redhat.com>
> > > Date: Fri Nov 15 11:48:29 2024 +0000
> > >
> > > sched/deadline: Check bandwidth overflow earlier for hotplug
> > >
> > > [ Upstream commit 53916d5fd3c0b658de3463439dd2b7ce765072cb ]
> > >
> > > With this reverted it reliably suspends again.
> >
> > Can you check that it works (or - more likely - doesn't work) in upstream?
> >
> > That commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow
> > earlier for hotplug") got merged during the current merge window, so
> > it would be lovely if you can check whether current -git (or just the
> > latest 6.14-rc) works for you, or has the same breakage.
> >
> > Background for new people on the participants list: original report at
> >
> > https://lore.kernel.org/all/e7096ec2-68db-fc3e-9c48-f20d3e80df72@applied-asynchrony.com/
> >
> > which says
> >
> > > > Common symptom on all machines seems to be
> > > >
> > > > [ +0.000134] Disabling non-boot CPUs ...
> > > > [ +0.000072] Error taking CPU15 down: -16
> > > > [ +0.000002] Non-boot CPUs are not disabled
> >
> > and this bisection result is from
> >
> > https://lore.kernel.org/all/9a44f314-c101-4ed1-98ad-547c84df7cdd@applied-asynchrony.com/
> >
> > and if it breaks in 6.13 -stable, I would expect the same in the
> > current tree. Unless there's some non-obvious interaction with
> > something else ?
>
> I just booted into current 6.14-git and could suspend/wakeup multiple times without
> any problem - no reverting necessary, so that is good.
>
> As for 6.12/6.13 it might be necessary to revert an accompanying commit
> as well since it seems to cause test failures with hotplug, as documented here:
>
> https://lore.kernel.org/stable/bcf76664-e77c-44b3-b78f-bcefc7aa3fc1@nvidia.com/
>
> ..but I don't know anything about that; I just wanted to find the patch causing
> the suspend problem. Other than that 6.13.3-rc2 works fine.
>
> Not sure if that was useful information. :)
Yes, thanks, I'll go drop this other patch from the stable queues as
taking only 1 of a 3 patch series generally isn't good :)
greg k-h
^ permalink raw reply [flat|nested] 474+ messages in thread
* Re: Suspend failures (was Re: [PATCH 6.13 000/443] 6.13.3-rc1 review)
2025-02-14 23:18 ` Suspend failures (was Re: [PATCH 6.13 000/443] 6.13.3-rc1 review) Linus Torvalds
2025-02-15 0:48 ` Suspend failures (was " Holger Hoffstätte
@ 2025-02-15 1:35 ` Waiman Long
2025-02-15 19:57 ` Suspend failures (was " Holger Hoffstätte
1 sibling, 1 reply; 474+ messages in thread
From: Waiman Long @ 2025-02-15 1:35 UTC (permalink / raw)
To: Linus Torvalds, Holger Hoffstätte, Peter Zijlstra,
Juri Lelli, Phil Auld
Cc: Greg Kroah-Hartman, stable
On 2/14/25 6:18 PM, Linus Torvalds wrote:
> Adding more people: Peter / Phil / Waiman. Juri was already on the list earlier.
>
> On Fri, 14 Feb 2025 at 02:12, Holger Hoffstätte
> <holger@applied-asynchrony.com> wrote:
>> Whoop! Whoop! The sound of da police!
>>
>> 2ce2a62881abcd379b714bf41aa671ad7657bdd2 is the first bad commit
>> commit 2ce2a62881abcd379b714bf41aa671ad7657bdd2 (HEAD)
>> Author: Juri Lelli <juri.lelli@redhat.com>
>> Date: Fri Nov 15 11:48:29 2024 +0000
>>
>> sched/deadline: Check bandwidth overflow earlier for hotplug
>>
>> [ Upstream commit 53916d5fd3c0b658de3463439dd2b7ce765072cb ]
>>
>> With this reverted it reliably suspends again.
> Can you check that it works (or - more likely - doesn't work) in upstream?
>
> That commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow
> earlier for hotplug") got merged during the current merge window, so
> it would be lovely if you can check whether current -git (or just the
> latest 6.14-rc) works for you, or has the same breakage.
>
> Background for new people on the participants list: original report at
>
> https://lore.kernel.org/all/e7096ec2-68db-fc3e-9c48-f20d3e80df72@applied-asynchrony.com/
>
> which says
>
>>> Common symptom on all machines seems to be
>>>
>>> [ +0.000134] Disabling non-boot CPUs ...
>>> [ +0.000072] Error taking CPU15 down: -16
>>> [ +0.000002] Non-boot CPUs are not disabled
> and this bisection result is from
>
> https://lore.kernel.org/all/9a44f314-c101-4ed1-98ad-547c84df7cdd@applied-asynchrony.com/
>
> and if it breaks in 6.13 -stable, I would expect the same in the
> current tree. Unless there's some non-obvious interaction with
> something else ?
Commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow earlier
for hotplug") is the last patch of the 3 patch series.
1) commit 41d4200b7103 ("sched/deadline: Restore dl_server bandwidth
on non-destructive root domain changes")
2) commit d4742f6ed7ea ("sched/deadline: Correctly account for
allocated bandwidth during hotplug")
3) commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow
earlier for hotplug")
It looks like 6.13.3-rc1 has patches 2 and 3, but not patch 1. It is
possible that patch 3 has a dependency on patch 1. My suggestion is to
either take patch 1 as well or none of them.
Cheers,
Longman
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: Suspend failures (was [PATCH 6.13 000/443] 6.13.3-rc1 review)
2025-02-15 1:35 ` Suspend failures (was " Waiman Long
@ 2025-02-15 19:57 ` Holger Hoffstätte
2025-02-16 7:05 ` Greg Kroah-Hartman
2025-02-17 6:30 ` Juri Lelli
0 siblings, 2 replies; 474+ messages in thread
From: Holger Hoffstätte @ 2025-02-15 19:57 UTC (permalink / raw)
To: Waiman Long, Linus Torvalds, Peter Zijlstra, Juri Lelli,
Phil Auld
Cc: Greg Kroah-Hartman, stable
On 2025-02-15 02:35, Waiman Long wrote:
<snip>
> Commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow
> earlier for hotplug") is the last patch of the 3 patch series.
>
> 1) commit 41d4200b7103 ("sched/deadline: Restore dl_server bandwidth on non-destructive root domain changes")
> 2) commit d4742f6ed7ea ("sched/deadline: Correctly account for allocated bandwidth during hotplug")
> 3) commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow earlier for hotplug")
>
> It looks like 6.13.3-rc1 has patches 2 and 3, but not patch 1. It is
> possible that patch 3 has a dependency on patch 1. My suggestion is
> to either take patch 1 as well or none of them.
Now that we have 6.13.3-rc3 passing all tests I got curious and applied
the whole series again. And voila: suspend works reliably (3 out of 3).
Mystery solved.
So Greg, feel free to add the whole 3-part series in the next round.
cheers
Holger
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: Suspend failures (was [PATCH 6.13 000/443] 6.13.3-rc1 review)
2025-02-15 19:57 ` Suspend failures (was " Holger Hoffstätte
@ 2025-02-16 7:05 ` Greg Kroah-Hartman
2025-02-17 6:30 ` Juri Lelli
1 sibling, 0 replies; 474+ messages in thread
From: Greg Kroah-Hartman @ 2025-02-16 7:05 UTC (permalink / raw)
To: Holger Hoffstätte
Cc: Waiman Long, Linus Torvalds, Peter Zijlstra, Juri Lelli,
Phil Auld, stable
On Sat, Feb 15, 2025 at 08:57:56PM +0100, Holger Hoffstätte wrote:
> On 2025-02-15 02:35, Waiman Long wrote:
> <snip>
>
> > Commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow
> > earlier for hotplug") is the last patch of the 3 patch series.
> >
> > 1) commit 41d4200b7103 ("sched/deadline: Restore dl_server bandwidth on non-destructive root domain changes")
> > 2) commit d4742f6ed7ea ("sched/deadline: Correctly account for allocated bandwidth during hotplug")
> > 3) commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow earlier for hotplug")
> >
> > It looks like 6.13.3-rc1 has patches 2 and 3, but not patch 1. It is
> > possible that patch 3 has a dependency on patch 1. My suggestion is
> > to either take patch 1 as well or none of them.
> Now that we have 6.13.3-rc3 passing all tests I got curious and applied
> the whole series again. And voila: suspend works reliably (3 out of 3).
> Mystery solved.
>
> So Greg, feel free to add the whole 3-part series in the next round.
Thanks for testing, I'll consider it then, after things have calmed down :)
greg k-h
^ permalink raw reply [flat|nested] 474+ messages in thread* Re: Suspend failures (was [PATCH 6.13 000/443] 6.13.3-rc1 review)
2025-02-15 19:57 ` Suspend failures (was " Holger Hoffstätte
2025-02-16 7:05 ` Greg Kroah-Hartman
@ 2025-02-17 6:30 ` Juri Lelli
1 sibling, 0 replies; 474+ messages in thread
From: Juri Lelli @ 2025-02-17 6:30 UTC (permalink / raw)
To: Holger Hoffstätte
Cc: Waiman Long, Linus Torvalds, Peter Zijlstra, Phil Auld,
Greg Kroah-Hartman, stable
Hi,
On 15/02/25 20:57, Holger Hoffstätte wrote:
> On 2025-02-15 02:35, Waiman Long wrote:
> <snip>
>
> > Commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow
> > earlier for hotplug") is the last patch of the 3 patch series.
> >
> > 1) commit 41d4200b7103 ("sched/deadline: Restore dl_server bandwidth on non-destructive root domain changes")
> > 2) commit d4742f6ed7ea ("sched/deadline: Correctly account for allocated bandwidth during hotplug")
> > 3) commit 53916d5fd3c0 ("sched/deadline: Check bandwidth overflow earlier for hotplug")
> >
> > It looks like 6.13.3-rc1 has patches 2 and 3, but not patch 1. It is
> > possible that patch 3 has a dependency on patch 1. My suggestion is
> > to either take patch 1 as well or none of them.
> Now that we have 6.13.3-rc3 passing all tests I got curious and applied
> the whole series again. And voila: suspend works reliably (3 out of 3).
> Mystery solved.
>
> So Greg, feel free to add the whole 3-part series in the next round.
Apologies for looking into this late, but thank you so much, Holger, for
the report and Waiman for catching the missing change!
Best,
Juri
^ permalink raw reply [flat|nested] 474+ messages in thread
* Re: [PATCH 6.13 000/443] 6.13.3-rc1 review
2025-02-13 14:22 [PATCH 6.13 000/443] 6.13.3-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2025-02-14 8:32 ` Holger Hoffstätte
@ 2025-02-14 9:45 ` Jon Hunter
453 siblings, 0 replies; 474+ messages in thread
From: Jon Hunter @ 2025-02-14 9:45 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie,
linux-tegra, stable
On Thu, 13 Feb 2025 15:22:45 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.13.3 release.
> There are 443 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat, 15 Feb 2025 14:23:11 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.13.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.13.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Failures detected for Tegra ...
Test results for stable-v6.13:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
116 tests: 103 pass, 13 fail
Linux version: 6.13.3-rc1-g50782d9796dc
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04
Test failures: tegra124-jetson-tk1: pm-system-suspend.sh
tegra186-p2771-0000: cpu-hotplug
tegra186-p2771-0000: pm-system-suspend.sh
tegra194-p2972-0000: pm-system-suspend.sh
tegra20-ventana: pm-system-suspend.sh
tegra210-p2371-2180: cpu-hotplug
tegra210-p3450-0000: cpu-hotplug
tegra30-cardhu-a04: pm-system-suspend.sh
Jon
^ permalink raw reply [flat|nested] 474+ messages in thread