December 2022 - Linux-stable-mirror

[RFC][PATCH v2 4/7] bpf-lsm: Enforce return value limitations on security modules

by Roberto Sassu

From: Roberto Sassu <roberto.sassu(a)huawei.com> With the patch for the LSM infrastructure to redefine the LSM_HOOK() macro and to introduce the return value flags, it becomes straightforward for eBPF to leverage this information to enforce return values limitations on eBPF programs implementing security hooks. Update the bpf_lsm_hooks BTF ID set, by including the return value flags. Then, introduce bpf_lsm_is_ret_value_allowed(), which determines in which intervals the R0 register (which contains the return value) falls, and checks if the corresponding return value flag is set for those intervals. In addition, for the interval including zero, ensure that the hook is not inode_init_security, otherwise report that zero is not allowed. By LSM conventions, LSMs should return zero only if they set an xattr, which currently eBPF programs cannot do. Finally, expose the new function and add a call to it in the verifier. Cc: stable(a)vger.kernel.org # 5.7.x Fixes: 9d3fdea789c8 ("bpf: lsm: Provide attachment points for BPF LSM programs") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> --- include/linux/bpf_lsm.h | 9 +++++ kernel/bpf/bpf_lsm.c | 78 ++++++++++++++++++++++++++++++++++++++--- kernel/bpf/verifier.c | 7 ++-- 3 files changed, 87 insertions(+), 7 deletions(-) diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h index 2f5757085dfd..0ce5948f3662 100644 --- a/include/linux/bpf_lsm.h +++ b/include/linux/bpf_lsm.h @@ -29,6 +29,8 @@ int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, bool bpf_lsm_is_sleepable_hook(u32 btf_id); bool bpf_lsm_is_trusted(const struct bpf_prog *prog); +bool bpf_lsm_is_ret_value_allowed(struct bpf_verifier_log *vlog, + struct bpf_reg_state *reg, u32 btf_id); static inline struct bpf_storage_blob *bpf_inode( const struct inode *inode) @@ -57,6 +59,13 @@ static inline bool bpf_lsm_is_trusted(const struct bpf_prog *prog) return false; } +static inline bool bpf_lsm_is_ret_value_allowed(struct bpf_verifier_log *vlog, + struct bpf_reg_state *reg, + u32 btf_id) +{ + return false; +} + static inline int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, const struct bpf_prog *prog) { diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c index 98f810f661a6..39ddafc06021 100644 --- a/kernel/bpf/bpf_lsm.c +++ b/kernel/bpf/bpf_lsm.c @@ -31,11 +31,11 @@ noinline RET bpf_lsm_##NAME(__VA_ARGS__) \ #undef LSM_HOOK #define LSM_HOOK(RET, DEFAULT, RET_FLAGS, NAME, ...) \ - BTF_ID(func, bpf_lsm_##NAME) -BTF_SET_START(bpf_lsm_hooks) + BTF_ID_FLAGS(func, bpf_lsm_##NAME, RET_FLAGS) +BTF_SET8_START(bpf_lsm_hooks) #include <linux/lsm_hook_defs.h> #undef LSM_HOOK -BTF_SET_END(bpf_lsm_hooks) +BTF_SET8_END(bpf_lsm_hooks) /* List of LSM hooks that should operate on 'current' cgroup regardless * of function signature. @@ -105,7 +105,7 @@ int bpf_lsm_verify_prog(struct bpf_verifier_log *vlog, return -EINVAL; } - if (!btf_id_set_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) { + if (!btf_id_set8_contains(&bpf_lsm_hooks, prog->aux->attach_btf_id)) { bpf_log(vlog, "attach_btf_id %u points to wrong type name %s\n", prog->aux->attach_btf_id, prog->aux->attach_func_name); return -EINVAL; @@ -367,6 +367,76 @@ bool bpf_lsm_is_trusted(const struct bpf_prog *prog) return !btf_id_set_contains(&untrusted_lsm_hooks, prog->aux->attach_btf_id); } +BTF_SET_START(zero_forbidden_lsm_hooks) +BTF_ID(func, bpf_lsm_inode_init_security) +BTF_SET_END(zero_forbidden_lsm_hooks) + +bool bpf_lsm_is_ret_value_allowed(struct bpf_verifier_log *vlog, + struct bpf_reg_state *reg, u32 btf_id) +{ + u32 *id = btf_id_set8_contains(&bpf_lsm_hooks, btf_id); + s64 smin_value = reg->smin_value; + s64 smax_value = reg->smax_value; + u32 *ret_flags = id + 1; + + /* See no_alu32/test_bpf_cookie.bpf.o for how return -EPERM is compiled: + * + * 11: 18 06 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 r6 = 4294967295 ll + * 13: 67 00 00 00 20 00 00 00 r0 <<= 32 + * 14: 77 00 00 00 20 00 00 00 r0 >>= 32 + * 15: 5d 08 07 00 00 00 00 00 if r8 != r0 goto +7 <LBB11_3> + * + * This causes predicted values to be: + * smin_value = 0xffffffff, smax_value = 0xffffffff, + * s32_min_value = 0xffffffff, s32_max_value = 0xffffffff, + * + * despite it is an ALU64 operation. So, checking reg->alu32 is not + * enough. Then, if after casting the 64 bit values they are equal to + * the 32 bit ones, use the latter ones (the LSM infrastructure takes + * an int). + */ + if ((reg->s32_min_value == (u32)smin_value && + reg->s32_max_value == (u32)smax_value) || reg->alu32) { + smin_value = reg->s32_min_value; + smax_value = reg->s32_max_value; + } + + /* Interval includes < 0 values. */ + if (smin_value < 0) { + if (!(*ret_flags & LSM_RET_NEG)) { + bpf_log(vlog, "Invalid R0, cannot return < 0\n"); + return false; + } + } + + /* Interval includes 0. */ + if (smin_value <= 0 && smax_value >= 0) { + if (!(*ret_flags & LSM_RET_ZERO) || + btf_id_set_contains(&zero_forbidden_lsm_hooks, btf_id)) { + bpf_log(vlog, "Invalid R0, cannot return 0\n"); + return false; + } + } + + /* Interval includes 1. */ + if (smin_value <= 1 && smax_value >= 1) { + if (!(*ret_flags & LSM_RET_ONE)) { + bpf_log(vlog, "Invalid R0, cannot return 1\n"); + return false; + } + } + + /* Interval includes > 1 values. */ + if (smax_value > 1) { + if (!(*ret_flags & LSM_RET_GT_ONE)) { + bpf_log(vlog, "Invalid R0, cannot return > 1\n"); + return false; + } + } + + return true; +} + const struct bpf_prog_ops lsm_prog_ops = { }; diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index edce85c425a2..5d13b7f42238 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -12064,9 +12064,10 @@ static int check_return_code(struct bpf_verifier_env *env) case BPF_PROG_TYPE_LSM: if (env->prog->expected_attach_type != BPF_LSM_CGROUP) { - /* Regular BPF_PROG_TYPE_LSM programs can return - * any value. - */ + if (!bpf_lsm_is_ret_value_allowed(&env->log, reg, + env->prog->aux->attach_btf_id)) + return -EINVAL; + return 0; } if (!env->prog->aux->attach_func_proto->type) { -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH 02/12] dt-bindings: arm: msm: Fix register regions used for LLCC banks

by Manivannan Sadhasivam

Register regions of the LLCC banks are located at separate addresses. Currently, the binding just lists the LLCC0 base address and specifies the size to cover all banks. This is not the correct approach since, there are holes and other registers located in between. So let's specify the base address of each LLCC bank. It should be noted that the bank count differs for each SoC, so that also needs to be taken into account in the binding. Cc: <stable(a)vger.kernel.org> # 4.19 Fixes: 7e5700ae64f6 ("dt-bindings: Documentation for qcom, llcc") Reported-by: Parikshit Pareek <quic_ppareek(a)quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- .../bindings/arm/msm/qcom,llcc.yaml | 125 ++++++++++++++++-- 1 file changed, 114 insertions(+), 11 deletions(-) diff --git a/Documentation/devicetree/bindings/arm/msm/qcom,llcc.yaml b/Documentation/devicetree/bindings/arm/msm/qcom,llcc.yaml index d1df49ffcc1b..7f694baa017c 100644 --- a/Documentation/devicetree/bindings/arm/msm/qcom,llcc.yaml +++ b/Documentation/devicetree/bindings/arm/msm/qcom,llcc.yaml @@ -33,14 +33,12 @@ properties: - qcom,sm8550-llcc reg: - items: - - description: LLCC base register region - - description: LLCC broadcast base register region + minItems: 2 + maxItems: 9 reg-names: - items: - - const: llcc_base - - const: llcc_broadcast_base + minItems: 2 + maxItems: 9 interrupts: maxItems: 1 @@ -50,15 +48,120 @@ required: - reg - reg-names +allOf: + - if: + properties: + compatible: + contains: + enum: + - qcom,sc7180-llcc + - qcom,sm6350-llcc + then: + properties: + reg: + items: + - description: LLCC0 base register region + - description: LLCC broadcast base register region + reg-names: + items: + - const: llcc0_base + - const: llcc_broadcast_base + + - if: + properties: + compatible: + contains: + enum: + - qcom,sc7280-llcc + then: + properties: + reg: + items: + - description: LLCC0 base register region + - description: LLCC1 base register region + - description: LLCC broadcast base register region + reg-names: + items: + - const: llcc0_base + - const: llcc1_base + - const: llcc_broadcast_base + + - if: + properties: + compatible: + contains: + enum: + - qcom,sc8180x-llcc + - qcom,sc8280xp-llcc + then: + properties: + reg: + items: + - description: LLCC0 base register region + - description: LLCC1 base register region + - description: LLCC2 base register region + - description: LLCC3 base register region + - description: LLCC4 base register region + - description: LLCC5 base register region + - description: LLCC6 base register region + - description: LLCC7 base register region + - description: LLCC broadcast base register region + reg-names: + items: + - const: llcc0_base + - const: llcc1_base + - const: llcc2_base + - const: llcc3_base + - const: llcc4_base + - const: llcc5_base + - const: llcc6_base + - const: llcc7_base + - const: llcc_broadcast_base + + - if: + properties: + compatible: + contains: + enum: + - qcom,sdm845-llcc + - qcom,sm8150-llcc + - qcom,sm8250-llcc + - qcom,sm8350-llcc + - qcom,sm8450-llcc + then: + properties: + reg: + items: + - description: LLCC0 base register region + - description: LLCC1 base register region + - description: LLCC2 base register region + - description: LLCC3 base register region + - description: LLCC broadcast base register region + reg-names: + items: + - const: llcc0_base + - const: llcc1_base + - const: llcc2_base + - const: llcc3_base + - const: llcc_broadcast_base + additionalProperties: false examples: - | #include <dt-bindings/interrupt-controller/arm-gic.h> - system-cache-controller@1100000 { - compatible = "qcom,sdm845-llcc"; - reg = <0x1100000 0x200000>, <0x1300000 0x50000> ; - reg-names = "llcc_base", "llcc_broadcast_base"; - interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; + soc { + #address-cells = <2>; + #size-cells = <2>; + + system-cache-controller@1100000 { + compatible = "qcom,sdm845-llcc"; + reg = <0 0x01100000 0 0x50000>, <0 0x01180000 0 0x50000>, + <0 0x01200000 0 0x50000>, <0 0x01280000 0 0x50000>, + <0 0x01300000 0 0x50000>; + reg-names = "llcc0_base", "llcc1_base", "llcc2_base", + "llcc3_base", "llcc_broadcast_base"; + interrupts = <GIC_SPI 582 IRQ_TYPE_LEVEL_HIGH>; + }; }; -- 2.25.1

2 years, 1 month

2
2
0 0

[PATCH 12/12] qcom: llcc/edac: Fix the base address used for accessing LLCC banks

by Manivannan Sadhasivam

The Qualcomm LLCC/EDAC drivers were using a fixed register stride for accessing the (Control and Status Registers) CSRs of each LLCC bank. This stride only works for some SoCs like SDM845 for which driver support was initially added. But the later SoCs use different register stride that vary between the banks with holes in-between. So it is not possible to use a single register stride for accessing the CSRs of each bank. By doing so could result in a crash. For fixing this issue, let's obtain the base address of each LLCC bank from devicetree and get rid of the fixed stride. Cc: <stable(a)vger.kernel.org> # 4.20 Fixes: a3134fb09e0b ("drivers: soc: Add LLCC driver") Fixes: 27450653f1db ("drivers: edac: Add EDAC driver support for QCOM SoCs") Reported-by: Parikshit Pareek <quic_ppareek(a)quicinc.com> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- drivers/edac/qcom_edac.c | 14 +++---- drivers/soc/qcom/llcc-qcom.c | 64 ++++++++++++++++++------------ include/linux/soc/qcom/llcc-qcom.h | 4 +- 3 files changed, 44 insertions(+), 38 deletions(-) diff --git a/drivers/edac/qcom_edac.c b/drivers/edac/qcom_edac.c index 97a27e42dd61..70bd39a91b89 100644 --- a/drivers/edac/qcom_edac.c +++ b/drivers/edac/qcom_edac.c @@ -213,7 +213,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) for (i = 0; i < reg_data.reg_cnt; i++) { synd_reg = reg_data.synd_reg + (i * 4); - ret = regmap_read(drv->regmap, drv->offsets[bank] + synd_reg, + ret = regmap_read(drv->regmap[bank], synd_reg, &synd_val); if (ret) goto clear; @@ -222,8 +222,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) reg_data.name, i, synd_val); } - ret = regmap_read(drv->regmap, - drv->offsets[bank] + reg_data.count_status_reg, + ret = regmap_read(drv->regmap[bank], reg_data.count_status_reg, &err_cnt); if (ret) goto clear; @@ -233,8 +232,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) edac_printk(KERN_CRIT, EDAC_LLCC, "%s: Error count: 0x%4x\n", reg_data.name, err_cnt); - ret = regmap_read(drv->regmap, - drv->offsets[bank] + reg_data.ways_status_reg, + ret = regmap_read(drv->regmap[bank], reg_data.ways_status_reg, &err_ways); if (ret) goto clear; @@ -296,8 +294,7 @@ llcc_ecc_irq_handler(int irq, void *edev_ctl) /* Iterate over the banks and look for Tag RAM or Data RAM errors */ for (i = 0; i < drv->num_banks; i++) { - ret = regmap_read(drv->regmap, - drv->offsets[i] + DRP_INTERRUPT_STATUS, + ret = regmap_read(drv->regmap[i], DRP_INTERRUPT_STATUS, &drp_error); if (!ret && (drp_error & SB_ECC_ERROR)) { @@ -312,8 +309,7 @@ llcc_ecc_irq_handler(int irq, void *edev_ctl) if (!ret) irq_rc = IRQ_HANDLED; - ret = regmap_read(drv->regmap, - drv->offsets[i] + TRP_INTERRUPT_0_STATUS, + ret = regmap_read(drv->regmap[i], TRP_INTERRUPT_0_STATUS, &trp_error); if (!ret && (trp_error & SB_ECC_ERROR)) { diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c index 23ce2f78c4ed..7264ac9993e0 100644 --- a/drivers/soc/qcom/llcc-qcom.c +++ b/drivers/soc/qcom/llcc-qcom.c @@ -62,8 +62,6 @@ #define LLCC_TRP_WRSC_CACHEABLE_EN 0x21f2c #define LLCC_TRP_ALGO_CFG8 0x21f30 -#define BANK_OFFSET_STRIDE 0x80000 - #define LLCC_VERSION_2_0_0_0 0x02000000 #define LLCC_VERSION_2_1_0_0 0x02010000 #define LLCC_VERSION_4_1_0_0 0x04010000 @@ -927,6 +925,7 @@ static int qcom_llcc_probe(struct platform_device *pdev) const struct llcc_slice_config *llcc_cfg; u32 sz; u32 version; + struct regmap *regmap; drv_data = devm_kzalloc(dev, sizeof(*drv_data), GFP_KERNEL); if (!drv_data) { @@ -934,12 +933,46 @@ static int qcom_llcc_probe(struct platform_device *pdev) goto err; } - drv_data->regmap = qcom_llcc_init_mmio(pdev, "llcc_base"); - if (IS_ERR(drv_data->regmap)) { - ret = PTR_ERR(drv_data->regmap); + /* Initialize the first LLCC bank regmap */ + regmap = qcom_llcc_init_mmio(pdev, "llcc0_base"); + if (IS_ERR(regmap)) { + ret = PTR_ERR(regmap); + goto err; + } + + cfg = of_device_get_match_data(&pdev->dev); + + ret = regmap_read(regmap, cfg->reg_offset[LLCC_COMMON_STATUS0], + &num_banks); + if (ret) + goto err; + + num_banks &= LLCC_LB_CNT_MASK; + num_banks >>= LLCC_LB_CNT_SHIFT; + drv_data->num_banks = num_banks; + + drv_data->regmap = devm_kcalloc(dev, num_banks, sizeof(*drv_data->regmap), GFP_KERNEL); + if (!drv_data->regmap) { + ret = -ENOMEM; goto err; } + drv_data->regmap[0] = regmap; + + /* Initialize rest of LLCC bank regmaps */ + for (i = 1; i < num_banks; i++) { + char *base = kasprintf(GFP_KERNEL, "llcc%d_base", i); + + drv_data->regmap[i] = qcom_llcc_init_mmio(pdev, base); + if (IS_ERR(drv_data->regmap[i])) { + ret = PTR_ERR(drv_data->regmap[i]); + kfree(base); + goto err; + } + + kfree(base); + } + drv_data->bcast_regmap = qcom_llcc_init_mmio(pdev, "llcc_broadcast_base"); if (IS_ERR(drv_data->bcast_regmap)) { @@ -947,8 +980,6 @@ static int qcom_llcc_probe(struct platform_device *pdev) goto err; } - cfg = of_device_get_match_data(&pdev->dev); - /* Extract version of the IP */ ret = regmap_read(drv_data->bcast_regmap, cfg->reg_offset[LLCC_COMMON_HW_INFO], &version); @@ -957,15 +988,6 @@ static int qcom_llcc_probe(struct platform_device *pdev) drv_data->version = version; - ret = regmap_read(drv_data->regmap, cfg->reg_offset[LLCC_COMMON_STATUS0], - &num_banks); - if (ret) - goto err; - - num_banks &= LLCC_LB_CNT_MASK; - num_banks >>= LLCC_LB_CNT_SHIFT; - drv_data->num_banks = num_banks; - llcc_cfg = cfg->sct_data; sz = cfg->size; @@ -973,16 +995,6 @@ static int qcom_llcc_probe(struct platform_device *pdev) if (llcc_cfg[i].slice_id > drv_data->max_slices) drv_data->max_slices = llcc_cfg[i].slice_id; - drv_data->offsets = devm_kcalloc(dev, num_banks, sizeof(u32), - GFP_KERNEL); - if (!drv_data->offsets) { - ret = -ENOMEM; - goto err; - } - - for (i = 0; i < num_banks; i++) - drv_data->offsets[i] = i * BANK_OFFSET_STRIDE; - drv_data->bitmap = devm_bitmap_zalloc(dev, drv_data->max_slices, GFP_KERNEL); if (!drv_data->bitmap) { diff --git a/include/linux/soc/qcom/llcc-qcom.h b/include/linux/soc/qcom/llcc-qcom.h index ad1fd718169d..4b8bf585f9ba 100644 --- a/include/linux/soc/qcom/llcc-qcom.h +++ b/include/linux/soc/qcom/llcc-qcom.h @@ -129,12 +129,11 @@ struct llcc_edac_reg_offset { * @max_slices: max slices as read from device tree * @num_banks: Number of llcc banks * @bitmap: Bit map to track the active slice ids - * @offsets: Pointer to the bank offsets array * @ecc_irq: interrupt for llcc cache error detection and reporting * @version: Indicates the LLCC version */ struct llcc_drv_data { - struct regmap *regmap; + struct regmap **regmap; struct regmap *bcast_regmap; const struct llcc_slice_config *cfg; const struct llcc_edac_reg_offset *edac_reg_offset; @@ -143,7 +142,6 @@ struct llcc_drv_data { u32 max_slices; u32 num_banks; unsigned long *bitmap; - u32 *offsets; int ecc_irq; u32 version; }; -- 2.25.1

2 years, 1 month

2
1
0 0

[PATCH 4.14 00/83] 4.14.301-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.14.301 release. There are 83 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 08 Dec 2022 12:40:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.301-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.14.301-rc2 Ben Hutchings <ben(a)decadent.org.uk> Revert "x86/speculation: Change FILL_RETURN_BUFFER to work with objtool" Peter Zijlstra <peterz(a)infradead.org> x86/nospec: Fix i386 RSB stuffing Jann Horn <jannh(a)google.com> ipc/sem: Fix dangling sem_array access in semtimedop race Linus Torvalds <torvalds(a)linux-foundation.org> v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails Linus Torvalds <torvalds(a)linux-foundation.org> proc: proc_skip_spaces() shouldn't think it is working on C strings Linus Torvalds <torvalds(a)linux-foundation.org> proc: avoid integer type confusion in get_proc_long Adrian Hunter <adrian.hunter(a)intel.com> mmc: sdhci: Fix voltage switch delay Masahiro Yamada <yamada.masahiro(a)socionext.com> mmc: sdhci: use FIELD_GET for preset value bit masks Michael Kelley <mikelley(a)microsoft.com> x86/ioremap: Fix page aligned size calculation in __ioremap_caller() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/pm: Add enumeration check before spec MSRs save/restore setup Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/tsx: Add a feature bit for TSX control MSR support Keith Busch <kbusch(a)kernel.org> nvme: restrict management ioctls to admin Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp/udp: Fix memory leak in ipv6_renew_options(). Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() Maxim Korotkov <korotkov.maxim.s(a)gmail.com> pinctrl: single: Fix potential division by zero Mark Brown <broonie(a)kernel.org> ASoC: ops: Fix bounds check for _sx controls Ben Hutchings <ben(a)decadent.org.uk> efi: random: Properly limit the size of the random seed James Morse <james.morse(a)arm.com> arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72 James Morse <james.morse(a)arm.com> arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 ZhangPeng <zhangpeng362(a)huawei.com> nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Tiezhu Yang <yangtiezhu(a)loongson.cn> tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" ChenXiaoSong <chenxiaosong2(a)huawei.com> btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Kan Liang <kan.liang(a)linux.intel.com> perf: Add sample_flags to indicate the PMU-filled sample data Sam James <sam(a)gentoo.org> kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() Phil Auld <pauld(a)redhat.com> hwmon: (coretemp) Check for null before removing sysfs attrs Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed Willem de Bruijn <willemb(a)google.com> packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE YueHaibing <yuehaibing(a)huawei.com> net: hsr: Fix potential use-after-free Jerry Ray <jerry.ray(a)microchip.com> dsa: lan9303: Correct stat name Wang Hai <wanghai38(a)huawei.com> net/9p: Fix a potential socket leak in p9_socket_open Yuan Can <yuancan(a)huawei.com> net: net_netdev: Fix error handling in ntb_netdev_init_module() Yang Yingliang <yangyingliang(a)huawei.com> net: phy: fix null-ptr-deref while probe() failed Duoming Zhou <duoming(a)zju.edu.cn> qlcnic: fix sleep-in-atomic-context bugs caused by msleep Zhang Changzhong <zhangchangzhong(a)huawei.com> can: cc770: cc770_isa_probe(): add missing free_cc770dev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() YueHaibing <yuehaibing(a)huawei.com> net/mlx5: Fix uninitialized variable bug in outlen_write() Yang Yingliang <yangyingliang(a)huawei.com> of: property: decrement node refcount in of_fwnode_get_reference_args() Gaosheng Cui <cuigaosheng1(a)huawei.com> hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (i5500_temp) fix missing pci_disable_device() Paul Gazzillo <paul(a)pgazz.com> iio: light: rpr0521: add missing Kconfig dependencies Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4403: Fix oob read in afe4403_read_raw Christian König <christian.koenig(a)amd.com> drm/amdgpu: always register an MMU notifier for userptr Enrico Sau <enrico.sau(a)gmail.com> net: usb: qmi_wwan: add Telit 0x103a composition Gleb Mazovetskiy <glex.spb(a)gmail.com> tcp: configurable source port perturb table size Kai-Heng Feng <kai.heng.feng(a)canonical.com> platform/x86: hp-wmi: Ignore Smart Experience App event Hans de Goede <hdegoede(a)redhat.com> platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) Xiongfeng Wang <wangxiongfeng2(a)huawei.com> platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() ruanjinjie <ruanjinjie(a)huawei.com> xen/platform-pci: add missing free_irq() in error path Lukas Wunner <lukas(a)wunner.de> serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() Aman Dhoot <amandhoot12(a)gmail.com> Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode Chen Zhongjin <chenzhongjin(a)huawei.com> nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty Masahiro Yamada <yamada.masahiro(a)socionext.com> kconfig: display recursive dependency resolution hint just once Chen Zhongjin <chenzhongjin(a)huawei.com> iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails Alejandro Concepción Rodríguez <asconcepcion(a)acoro.eu> iio: light: apds9960: fix wrong register for gesture gain Jakob Unterwurzacher <jakob.unterwurzacher(a)theobroma-systems.com> arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency Randy Dunlap <rdunlap(a)infradead.org> nios2: add FORCE for vmlinuz.gz Heiko Carstens <hca(a)linux.ibm.com> s390/crashdump: fix TOD programmable field size Yu Liao <liaoyu15(a)huawei.com> net: thunderx: Fix the ACPI memory leak Martin Faltesek <mfaltesek(a)google.com> nfc: st-nci: fix memory leaks in EVT_TRANSACTION Martin Faltesek <mfaltesek(a)google.com> nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION Stefan Haberland <sth(a)linux.ibm.com> s390/dasd: fix no record found for raw_track_access Kuniyuki Iwashima <kuniyu(a)amazon.com> dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). Liu Shixin <liushixin2(a)huawei.com> NFC: nci: fix memory leak in nci_rx_data_packet() Chen Zhongjin <chenzhongjin(a)huawei.com> xfrm: Fix ignored return value in xfrm6_init() Zhang Changzhong <zhangchangzhong(a)huawei.com> net/qla3xxx: fix potential memleak in ql3xxx_send() Peter Kosyh <pkosyh(a)yandex.ru> net/mlx4: Check retval of mlx4_bitmap_init Zheng Yongjun <zhengyongjun3(a)huawei.com> ARM: mxs: fix memory leak in mxs_machine_init() Zhengchao Shao <shaozhengchao(a)huawei.com> 9p/fd: fix issue of list_del corruption in p9_fd_cancel() Wang Hai <wanghai38(a)huawei.com> net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() Lin Ma <linma(a)zju.edu.cn> nfc/nci: fix race with opening and closing Michael Grzeschik <m.grzeschik(a)pengutronix.de> ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl Samuel Holland <samuel(a)sholland.org> bus: sunxi-rsb: Support atomic transfers Dominik Haller <d.haller(a)phytec.de> ARM: dts: am335x-pcm-953: Define fixed regulators in root node Herbert Xu <herbert(a)gondor.apana.org.au> af_key: Fix send_acquire race with pfkey_register Jason A. Donenfeld <Jason(a)zx2c4.com> MIPS: pic32: treat port as signed integer Sean Nyekjaer <sean(a)geanix.com> spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run Nicolas Cavallari <nicolas.cavallari(a)green-communications.fr> wifi: mac80211: Fix ack frame idr leak when mesh has no route Gaosheng Cui <cuigaosheng1(a)huawei.com> audit: fix undefined behavior in bit shift for AUDIT_BIT Jonas Jelonek <jelonek.jonas(a)gmail.com> wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support ------------- Diffstat: Makefile | 4 +- arch/arm/boot/dts/am335x-pcm-953.dtsi | 28 ++++----- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 9 +++ arch/arm/mach-mxs/mach-mxs.c | 4 +- .../arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 2 +- arch/arm64/kernel/cpu_errata.c | 24 ++++++-- arch/mips/include/asm/fw/fw.h | 2 +- arch/mips/pic32/pic32mzda/early_console.c | 13 ++-- arch/mips/pic32/pic32mzda/init.c | 2 +- arch/nios2/boot/Makefile | 2 +- arch/s390/kernel/crash_dump.c | 2 +- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/nospec-branch.h | 26 ++++++-- arch/x86/kernel/cpu/bugs.c | 21 ++++--- arch/x86/kernel/cpu/tsx.c | 33 +++++----- arch/x86/kernel/process.c | 2 +- arch/x86/mm/ioremap.c | 8 ++- arch/x86/power/cpu.c | 23 ++++--- drivers/bus/sunxi-rsb.c | 29 ++++++--- drivers/firmware/efi/efi.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 8 +-- drivers/hwmon/coretemp.c | 9 ++- drivers/hwmon/i5500_temp.c | 2 +- drivers/hwmon/ibmpex.c | 1 + drivers/iio/health/afe4403.c | 5 +- drivers/iio/health/afe4404.c | 12 ++-- drivers/iio/industrialio-sw-trigger.c | 6 +- drivers/iio/light/Kconfig | 2 + drivers/iio/light/apds9960.c | 12 ++-- drivers/input/mouse/synaptics.c | 1 + drivers/iommu/dmar.c | 1 + drivers/mmc/host/sdhci.c | 71 ++++++++++++++++++---- drivers/mmc/host/sdhci.h | 12 ++-- drivers/net/can/cc770/cc770_isa.c | 10 +-- drivers/net/can/sja1000/sja1000_isa.c | 10 +-- drivers/net/dsa/lan9303-core.c | 2 +- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +- drivers/net/ethernet/mellanox/mlx4/qp.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +- .../net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 1 + drivers/net/ethernet/qlogic/qla3xxx.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +- drivers/net/ethernet/renesas/ravb_main.c | 1 + drivers/net/ntb_netdev.c | 9 ++- drivers/net/phy/phy_device.c | 1 + drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/mac80211_hwsim.c | 5 ++ drivers/nfc/st-nci/se.c | 6 +- drivers/nvme/host/core.c | 6 ++ drivers/of/property.c | 4 +- drivers/pinctrl/pinctrl-single.c | 2 +- drivers/platform/x86/acer-wmi.c | 9 +++ drivers/platform/x86/asus-wmi.c | 2 + drivers/platform/x86/hp-wmi.c | 3 + drivers/s390/block/dasd_eckd.c | 6 +- drivers/spi/spi-stm32.c | 2 +- drivers/tty/serial/8250/8250_omap.c | 7 ++- drivers/xen/platform-pci.c | 7 ++- fs/btrfs/qgroup.c | 9 +-- fs/nilfs2/dat.c | 7 +++ fs/nilfs2/sufile.c | 8 +++ include/linux/license.h | 2 + include/linux/perf_event.h | 2 + include/uapi/linux/audit.h | 2 +- ipc/sem.c | 3 +- kernel/events/core.c | 17 ++++-- kernel/sysctl.c | 30 ++++----- mm/frame_vector.c | 31 ++-------- net/9p/trans_fd.c | 6 +- net/bluetooth/l2cap_core.c | 13 ++++ net/dccp/ipv4.c | 2 + net/dccp/ipv6.c | 2 + net/hsr/hsr_forward.c | 5 +- net/ipv4/Kconfig | 10 +++ net/ipv4/inet_hashtables.c | 10 +-- net/ipv4/tcp_ipv4.c | 2 + net/ipv6/ipv6_sockglue.c | 7 +++ net/ipv6/tcp_ipv6.c | 2 + net/ipv6/xfrm6_policy.c | 6 +- net/key/af_key.c | 32 +++++++--- net/mac80211/mesh_pathtbl.c | 2 +- net/nfc/nci/core.c | 2 +- net/nfc/nci/data.c | 4 +- net/packet/af_packet.c | 6 +- scripts/kconfig/symbol.c | 8 ++- sound/soc/soc-ops.c | 2 +- tools/vm/slabinfo-gnuplot.sh | 4 +- 87 files changed, 482 insertions(+), 243 deletions(-)

2 years, 1 month

3
2
0 0

[PATCH 4.9 00/63] 4.9.335-rc2 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.9.335 release. There are 63 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Thu, 08 Dec 2022 12:40:31 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.335-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.9.335-rc2 Linus Torvalds <torvalds(a)linux-foundation.org> v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails Linus Torvalds <torvalds(a)linux-foundation.org> proc: proc_skip_spaces() shouldn't think it is working on C strings Linus Torvalds <torvalds(a)linux-foundation.org> proc: avoid integer type confusion in get_proc_long Michael Kelley <mikelley(a)microsoft.com> x86/ioremap: Fix page aligned size calculation in __ioremap_caller() Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/pm: Add enumeration check before spec MSRs save/restore setup Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> x86/tsx: Add a feature bit for TSX control MSR support Ulrich Hecht <uli+cip(a)fpond.eu> Revert "fbdev: fb_pm2fb: Avoid potential divide by zero error" Kuniyuki Iwashima <kuniyu(a)amazon.com> tcp/udp: Fix memory leak in ipv6_renew_options(). Xiongfeng Wang <wangxiongfeng2(a)huawei.com> iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() Maxim Korotkov <korotkov.maxim.s(a)gmail.com> pinctrl: single: Fix potential division by zero Mark Brown <broonie(a)kernel.org> ASoC: ops: Fix bounds check for _sx controls James Morse <james.morse(a)arm.com> arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72 James Morse <james.morse(a)arm.com> arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors ZhangPeng <zhangpeng362(a)huawei.com> nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() Tiezhu Yang <yangtiezhu(a)loongson.cn> tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" ChenXiaoSong <chenxiaosong2(a)huawei.com> btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() Phil Auld <pauld(a)redhat.com> hwmon: (coretemp) Check for null before removing sysfs attrs Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed Willem de Bruijn <willemb(a)google.com> packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE YueHaibing <yuehaibing(a)huawei.com> net: hsr: Fix potential use-after-free Wang Hai <wanghai38(a)huawei.com> net/9p: Fix a potential socket leak in p9_socket_open Yuan Can <yuancan(a)huawei.com> net: net_netdev: Fix error handling in ntb_netdev_init_module() Yang Yingliang <yangyingliang(a)huawei.com> net: phy: fix null-ptr-deref while probe() failed Duoming Zhou <duoming(a)zju.edu.cn> qlcnic: fix sleep-in-atomic-context bugs caused by msleep Zhang Changzhong <zhangchangzhong(a)huawei.com> can: cc770: cc770_isa_probe(): add missing free_cc770dev() Zhang Changzhong <zhangchangzhong(a)huawei.com> can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() YueHaibing <yuehaibing(a)huawei.com> net/mlx5: Fix uninitialized variable bug in outlen_write() Gaosheng Cui <cuigaosheng1(a)huawei.com> hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Yang Yingliang <yangyingliang(a)huawei.com> hwmon: (i5500_temp) fix missing pci_disable_device() Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw Wei Yongjun <weiyongjun1(a)huawei.com> iio: health: afe4403: Fix oob read in afe4403_read_raw Christian König <christian.koenig(a)amd.com> drm/amdgpu: always register an MMU notifier for userptr Enrico Sau <enrico.sau(a)gmail.com> net: usb: qmi_wwan: add Telit 0x103a composition Gleb Mazovetskiy <glex.spb(a)gmail.com> tcp: configurable source port perturb table size Xiongfeng Wang <wangxiongfeng2(a)huawei.com> platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() ruanjinjie <ruanjinjie(a)huawei.com> xen/platform-pci: add missing free_irq() in error path Lukas Wunner <lukas(a)wunner.de> serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() Chen Zhongjin <chenzhongjin(a)huawei.com> nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty Randy Dunlap <rdunlap(a)infradead.org> nios2: add FORCE for vmlinuz.gz Masahiro Yamada <yamada.masahiro(a)socionext.com> kconfig: display recursive dependency resolution hint just once Chen Zhongjin <chenzhongjin(a)huawei.com> iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails Alejandro Concepción Rodríguez <asconcepcion(a)acoro.eu> iio: light: apds9960: fix wrong register for gesture gain Heiko Carstens <hca(a)linux.ibm.com> s390/crashdump: fix TOD programmable field size Yu Liao <liaoyu15(a)huawei.com> net: thunderx: Fix the ACPI memory leak Martin Faltesek <mfaltesek(a)google.com> nfc: st-nci: fix memory leaks in EVT_TRANSACTION Martin Faltesek <mfaltesek(a)google.com> nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION Liu Shixin <liushixin2(a)huawei.com> NFC: nci: fix memory leak in nci_rx_data_packet() Chen Zhongjin <chenzhongjin(a)huawei.com> xfrm: Fix ignored return value in xfrm6_init() Zhang Changzhong <zhangchangzhong(a)huawei.com> net/qla3xxx: fix potential memleak in ql3xxx_send() Peter Kosyh <pkosyh(a)yandex.ru> net/mlx4: Check retval of mlx4_bitmap_init Zheng Yongjun <zhengyongjun3(a)huawei.com> ARM: mxs: fix memory leak in mxs_machine_init() Zhengchao Shao <shaozhengchao(a)huawei.com> 9p/fd: fix issue of list_del corruption in p9_fd_cancel() Wang Hai <wanghai38(a)huawei.com> net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() Lin Ma <linma(a)zju.edu.cn> nfc/nci: fix race with opening and closing Michael Grzeschik <m.grzeschik(a)pengutronix.de> ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl Samuel Holland <samuel(a)sholland.org> bus: sunxi-rsb: Support atomic transfers Herbert Xu <herbert(a)gondor.apana.org.au> af_key: Fix send_acquire race with pfkey_register Jason A. Donenfeld <Jason(a)zx2c4.com> MIPS: pic32: treat port as signed integer Nicolas Cavallari <nicolas.cavallari(a)green-communications.fr> wifi: mac80211: Fix ack frame idr leak when mesh has no route Gaosheng Cui <cuigaosheng1(a)huawei.com> audit: fix undefined behavior in bit shift for AUDIT_BIT Jonas Jelonek <jelonek.jonas(a)gmail.com> wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support ------------- Diffstat: Makefile | 4 +-- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 9 ++++++ arch/arm/mach-mxs/mach-mxs.c | 4 ++- arch/arm64/kernel/cpu_errata.c | 25 +++++++++++----- arch/mips/include/asm/fw/fw.h | 2 +- arch/mips/pic32/pic32mzda/early_console.c | 13 ++++----- arch/mips/pic32/pic32mzda/init.c | 2 +- arch/nios2/boot/Makefile | 2 +- arch/s390/kernel/crash_dump.c | 2 +- arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/kernel/cpu/tsx.c | 33 +++++++++------------- arch/x86/mm/ioremap.c | 8 +++++- arch/x86/power/cpu.c | 23 +++++++++------ drivers/bus/sunxi-rsb.c | 29 +++++++++++++------ drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 8 ++---- drivers/hwmon/coretemp.c | 9 +++++- drivers/hwmon/i5500_temp.c | 2 +- drivers/hwmon/ibmpex.c | 1 + drivers/iio/health/afe4403.c | 5 ++-- drivers/iio/health/afe4404.c | 12 ++++---- drivers/iio/industrialio-sw-trigger.c | 6 +++- drivers/iio/light/apds9960.c | 12 ++++---- drivers/iommu/dmar.c | 1 + drivers/net/can/cc770/cc770_isa.c | 10 ++++--- drivers/net/can/sja1000/sja1000_isa.c | 10 ++++--- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 ++- drivers/net/ethernet/mellanox/mlx4/qp.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 +-- .../net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 1 + drivers/net/ethernet/qlogic/qla3xxx.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +-- drivers/net/ethernet/renesas/ravb_main.c | 1 + drivers/net/ntb_netdev.c | 9 +++++- drivers/net/phy/phy_device.c | 1 + drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wireless/mac80211_hwsim.c | 5 ++++ drivers/nfc/st-nci/se.c | 6 ++-- drivers/pinctrl/pinctrl-single.c | 2 +- drivers/platform/x86/asus-wmi.c | 2 ++ drivers/tty/serial/8250/8250_omap.c | 7 +++-- drivers/video/fbdev/pm2fb.c | 5 ---- drivers/xen/platform-pci.c | 7 +++-- fs/btrfs/qgroup.c | 9 +----- fs/nilfs2/dat.c | 7 +++++ fs/nilfs2/sufile.c | 8 ++++++ include/uapi/linux/audit.h | 2 +- kernel/sysctl.c | 26 ++++++++--------- mm/frame_vector.c | 31 ++++---------------- net/9p/trans_fd.c | 6 +++- net/bluetooth/l2cap_core.c | 13 +++++++++ net/hsr/hsr_forward.c | 5 ++-- net/ipv4/Kconfig | 10 +++++++ net/ipv4/inet_hashtables.c | 10 +++---- net/ipv6/ipv6_sockglue.c | 7 +++++ net/ipv6/xfrm6_policy.c | 6 +++- net/key/af_key.c | 32 ++++++++++++++------- net/mac80211/mesh_pathtbl.c | 2 +- net/nfc/nci/core.c | 2 +- net/nfc/nci/data.c | 4 ++- net/packet/af_packet.c | 6 ++-- scripts/kconfig/symbol.c | 8 ++++-- sound/soc/soc-ops.c | 2 +- tools/vm/slabinfo-gnuplot.sh | 4 +-- 63 files changed, 312 insertions(+), 184 deletions(-)

2 years, 1 month

5
4
0 0

[PATCH 12/12] llcc/edac: Fix the base address used for accessing LLCC banks

by Manivannan Sadhasivam

The LLCC driver has been using a fixed register offset stride for accessing the CSRs of each LLCC bank. This offset only works for some SoCs like SDM845 for which driver support was initially added. But the later SoCs use different register stride that vary between the banks with holes in-between. So it is not possible to use a single register stride for accessing the CSRs of each bank. Hence, obtain the base address of each LLCC bank from devicetree and get rid of the fixed stride. Cc: <stable(a)vger.kernel.org> # 4.20 Fixes: a3134fb09e0b ("drivers: soc: Add LLCC driver") Fixes: 27450653f1db ("drivers: edac: Add EDAC driver support for QCOM SoCs") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- drivers/edac/qcom_edac.c | 14 +++---- drivers/soc/qcom/llcc-qcom.c | 64 ++++++++++++++++++------------ include/linux/soc/qcom/llcc-qcom.h | 4 +- 3 files changed, 44 insertions(+), 38 deletions(-) diff --git a/drivers/edac/qcom_edac.c b/drivers/edac/qcom_edac.c index 97a27e42dd61..70bd39a91b89 100644 --- a/drivers/edac/qcom_edac.c +++ b/drivers/edac/qcom_edac.c @@ -213,7 +213,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) for (i = 0; i < reg_data.reg_cnt; i++) { synd_reg = reg_data.synd_reg + (i * 4); - ret = regmap_read(drv->regmap, drv->offsets[bank] + synd_reg, + ret = regmap_read(drv->regmap[bank], synd_reg, &synd_val); if (ret) goto clear; @@ -222,8 +222,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) reg_data.name, i, synd_val); } - ret = regmap_read(drv->regmap, - drv->offsets[bank] + reg_data.count_status_reg, + ret = regmap_read(drv->regmap[bank], reg_data.count_status_reg, &err_cnt); if (ret) goto clear; @@ -233,8 +232,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) edac_printk(KERN_CRIT, EDAC_LLCC, "%s: Error count: 0x%4x\n", reg_data.name, err_cnt); - ret = regmap_read(drv->regmap, - drv->offsets[bank] + reg_data.ways_status_reg, + ret = regmap_read(drv->regmap[bank], reg_data.ways_status_reg, &err_ways); if (ret) goto clear; @@ -296,8 +294,7 @@ llcc_ecc_irq_handler(int irq, void *edev_ctl) /* Iterate over the banks and look for Tag RAM or Data RAM errors */ for (i = 0; i < drv->num_banks; i++) { - ret = regmap_read(drv->regmap, - drv->offsets[i] + DRP_INTERRUPT_STATUS, + ret = regmap_read(drv->regmap[i], DRP_INTERRUPT_STATUS, &drp_error); if (!ret && (drp_error & SB_ECC_ERROR)) { @@ -312,8 +309,7 @@ llcc_ecc_irq_handler(int irq, void *edev_ctl) if (!ret) irq_rc = IRQ_HANDLED; - ret = regmap_read(drv->regmap, - drv->offsets[i] + TRP_INTERRUPT_0_STATUS, + ret = regmap_read(drv->regmap[i], TRP_INTERRUPT_0_STATUS, &trp_error); if (!ret && (trp_error & SB_ECC_ERROR)) { diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c index 23ce2f78c4ed..7264ac9993e0 100644 --- a/drivers/soc/qcom/llcc-qcom.c +++ b/drivers/soc/qcom/llcc-qcom.c @@ -62,8 +62,6 @@ #define LLCC_TRP_WRSC_CACHEABLE_EN 0x21f2c #define LLCC_TRP_ALGO_CFG8 0x21f30 -#define BANK_OFFSET_STRIDE 0x80000 - #define LLCC_VERSION_2_0_0_0 0x02000000 #define LLCC_VERSION_2_1_0_0 0x02010000 #define LLCC_VERSION_4_1_0_0 0x04010000 @@ -927,6 +925,7 @@ static int qcom_llcc_probe(struct platform_device *pdev) const struct llcc_slice_config *llcc_cfg; u32 sz; u32 version; + struct regmap *regmap; drv_data = devm_kzalloc(dev, sizeof(*drv_data), GFP_KERNEL); if (!drv_data) { @@ -934,12 +933,46 @@ static int qcom_llcc_probe(struct platform_device *pdev) goto err; } - drv_data->regmap = qcom_llcc_init_mmio(pdev, "llcc_base"); - if (IS_ERR(drv_data->regmap)) { - ret = PTR_ERR(drv_data->regmap); + /* Initialize the first LLCC bank regmap */ + regmap = qcom_llcc_init_mmio(pdev, "llcc0_base"); + if (IS_ERR(regmap)) { + ret = PTR_ERR(regmap); + goto err; + } + + cfg = of_device_get_match_data(&pdev->dev); + + ret = regmap_read(regmap, cfg->reg_offset[LLCC_COMMON_STATUS0], + &num_banks); + if (ret) + goto err; + + num_banks &= LLCC_LB_CNT_MASK; + num_banks >>= LLCC_LB_CNT_SHIFT; + drv_data->num_banks = num_banks; + + drv_data->regmap = devm_kcalloc(dev, num_banks, sizeof(*drv_data->regmap), GFP_KERNEL); + if (!drv_data->regmap) { + ret = -ENOMEM; goto err; } + drv_data->regmap[0] = regmap; + + /* Initialize rest of LLCC bank regmaps */ + for (i = 1; i < num_banks; i++) { + char *base = kasprintf(GFP_KERNEL, "llcc%d_base", i); + + drv_data->regmap[i] = qcom_llcc_init_mmio(pdev, base); + if (IS_ERR(drv_data->regmap[i])) { + ret = PTR_ERR(drv_data->regmap[i]); + kfree(base); + goto err; + } + + kfree(base); + } + drv_data->bcast_regmap = qcom_llcc_init_mmio(pdev, "llcc_broadcast_base"); if (IS_ERR(drv_data->bcast_regmap)) { @@ -947,8 +980,6 @@ static int qcom_llcc_probe(struct platform_device *pdev) goto err; } - cfg = of_device_get_match_data(&pdev->dev); - /* Extract version of the IP */ ret = regmap_read(drv_data->bcast_regmap, cfg->reg_offset[LLCC_COMMON_HW_INFO], &version); @@ -957,15 +988,6 @@ static int qcom_llcc_probe(struct platform_device *pdev) drv_data->version = version; - ret = regmap_read(drv_data->regmap, cfg->reg_offset[LLCC_COMMON_STATUS0], - &num_banks); - if (ret) - goto err; - - num_banks &= LLCC_LB_CNT_MASK; - num_banks >>= LLCC_LB_CNT_SHIFT; - drv_data->num_banks = num_banks; - llcc_cfg = cfg->sct_data; sz = cfg->size; @@ -973,16 +995,6 @@ static int qcom_llcc_probe(struct platform_device *pdev) if (llcc_cfg[i].slice_id > drv_data->max_slices) drv_data->max_slices = llcc_cfg[i].slice_id; - drv_data->offsets = devm_kcalloc(dev, num_banks, sizeof(u32), - GFP_KERNEL); - if (!drv_data->offsets) { - ret = -ENOMEM; - goto err; - } - - for (i = 0; i < num_banks; i++) - drv_data->offsets[i] = i * BANK_OFFSET_STRIDE; - drv_data->bitmap = devm_bitmap_zalloc(dev, drv_data->max_slices, GFP_KERNEL); if (!drv_data->bitmap) { diff --git a/include/linux/soc/qcom/llcc-qcom.h b/include/linux/soc/qcom/llcc-qcom.h index ad1fd718169d..4b8bf585f9ba 100644 --- a/include/linux/soc/qcom/llcc-qcom.h +++ b/include/linux/soc/qcom/llcc-qcom.h @@ -129,12 +129,11 @@ struct llcc_edac_reg_offset { * @max_slices: max slices as read from device tree * @num_banks: Number of llcc banks * @bitmap: Bit map to track the active slice ids - * @offsets: Pointer to the bank offsets array * @ecc_irq: interrupt for llcc cache error detection and reporting * @version: Indicates the LLCC version */ struct llcc_drv_data { - struct regmap *regmap; + struct regmap **regmap; struct regmap *bcast_regmap; const struct llcc_slice_config *cfg; const struct llcc_edac_reg_offset *edac_reg_offset; @@ -143,7 +142,6 @@ struct llcc_drv_data { u32 max_slices; u32 num_banks; unsigned long *bitmap; - u32 *offsets; int ecc_irq; u32 version; }; -- 2.25.1

2 years, 1 month

1
1
0 0

[PATCH 11/12] arm64: dts: qcom: sm6350: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. On SM6350, there is only one LLCC bank available. So let's just pass that as "llcc0_base". Cc: <stable(a)vger.kernel.org> # 5.16 Fixes: ced2f0d75e13 ("arm64: dts: qcom: sm6350: Add LLCC node") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi index 43324bf291c3..c7701f5e4af6 100644 --- a/arch/arm64/boot/dts/qcom/sm6350.dtsi +++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi @@ -1174,7 +1174,7 @@ dc_noc: interconnect@9160000 { system-cache-controller@9200000 { compatible = "qcom,sm6350-llcc"; reg = <0 0x09200000 0 0x50000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg-names = "llcc0_base", "llcc_broadcast_base"; }; gem_noc: interconnect@9680000 { -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH 10/12] arm64: dts: qcom: sm8450: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Cc: <stable(a)vger.kernel.org> # 5.18 Fixes: 1dc3e50eb680 ("arm64: dts: qcom: sm8450: Add LLCC/system-cache-controller node") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sm8450.dtsi | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi index 570475040d95..12549a2912c6 100644 --- a/arch/arm64/boot/dts/qcom/sm8450.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi @@ -3640,8 +3640,11 @@ gem_noc: interconnect@19100000 { system-cache-controller@19200000 { compatible = "qcom,sm8450-llcc"; - reg = <0 0x19200000 0 0x580000>, <0 0x19a00000 0 0x80000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x19200000 0 0x80000>, <0 0x19600000 0 0x80000>, + <0 0x19300000 0 0x80000>, <0 0x19700000 0 0x80000>, + <0 0x19a00000 0 0x80000>; + reg-names = "llcc0_base", "llcc1_base", "llcc2_base", + "llcc3_base", "llcc_broadcast_base"; interrupts = <GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>; }; -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH 09/12] arm64: dts: qcom: sm8350: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Cc: <stable(a)vger.kernel.org> # 5.17 Fixes: 9ac8999e8d6c ("arm64: dts: qcom: sm8350: Add LLCC node") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sm8350.dtsi | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi index 245dce24ec59..836732d16635 100644 --- a/arch/arm64/boot/dts/qcom/sm8350.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi @@ -2513,8 +2513,11 @@ gem_noc: interconnect@9100000 { system-cache-controller@9200000 { compatible = "qcom,sm8350-llcc"; - reg = <0 0x09200000 0 0x1d0000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x58000>, <0 0x09280000 0 0x58000>, + <0 0x09300000 0 0x58000>, <0 0x09380000 0 0x58000>, + <0 0x09600000 0 0x58000>; + reg-names = "llcc0_base", "llcc1_base", "llcc2_base", + "llcc3_base", "llcc_broadcast_base"; }; usb_1: usb@a6f8800 { -- 2.25.1

2 years, 1 month

1
0
0 0

[PATCH 08/12] arm64: dts: qcom: sm8250: Fix the base addresses of LLCC banks

by Manivannan Sadhasivam

The LLCC block has several banks each with a different base address and holes in between. So it is not a correct approach to cover these banks with a single offset/size. Instead, the individual bank's base address needs to be specified in devicetree with the exact size. Cc: <stable(a)vger.kernel.org> # 5.12 Fixes: 0085a33a25cc ("arm64: dts: qcom: sm8250: Add support for LLCC block") Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> --- arch/arm64/boot/dts/qcom/sm8250.dtsi | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi index dab5579946f3..d1b65fb3f3f3 100644 --- a/arch/arm64/boot/dts/qcom/sm8250.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi @@ -3545,8 +3545,11 @@ usb_1_dwc3: usb@a600000 { system-cache-controller@9200000 { compatible = "qcom,sm8250-llcc"; - reg = <0 0x09200000 0 0x1d0000>, <0 0x09600000 0 0x50000>; - reg-names = "llcc_base", "llcc_broadcast_base"; + reg = <0 0x09200000 0 0x50000>, <0 0x09280000 0 0x50000>, + <0 0x09300000 0 0x50000>, <0 0x09380000 0 0x50000>, + <0 0x09600000 0 0x50000>; + reg-names = "llcc0_base", "llcc1_base", "llcc2_base", + "llcc3_base", "llcc_broadcast_base"; }; usb_2: usb@a8f8800 { -- 2.25.1

2 years, 1 month

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2022