The Elan eKTH5015M touch controller on the X13s requires a 300 ms delay
before sending commands after having deasserted reset during power on.
Switch to the Elan specific binding so that the OS can determine the
required power-on sequence and make sure that the controller is always
detected during boot.
Note that the always-on 1.8 V supply (s10b) is not used by the
controller directly and should not be described.
Fixes: 32c231385ed4 ("arm64: dts: qcom: sc8280xp: add Lenovo Thinkpad X13s devicetree")
Cc: stable(a)vger.kernel.org # 6.0
Tested-by: Steev Klimaszewski <steev(a)kali.org>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
---
.../dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
index 569add4ebfab..98c1b75513be 100644
--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
@@ -653,15 +653,16 @@ &i2c4 {
status = "okay";
- /* FIXME: verify */
touchscreen@10 {
- compatible = "hid-over-i2c";
+ compatible = "elan,ekth5015m", "elan,ekth6915";
reg = <0x10>;
- hid-descr-addr = <0x1>;
interrupts-extended = <&tlmm 175 IRQ_TYPE_LEVEL_LOW>;
- vdd-supply = <&vreg_misc_3p3>;
- vddl-supply = <&vreg_s10b>;
+ reset-gpios = <&tlmm 99 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>;
+ no-reset-on-power-off;
+
+ vcc33-supply = <&vreg_misc_3p3>;
+ vccio-supply = <&vreg_misc_3p3>;
pinctrl-names = "default";
pinctrl-0 = <&ts0_default>;
@@ -1507,8 +1508,8 @@ int-n-pins {
reset-n-pins {
pins = "gpio99";
function = "gpio";
- output-high;
- drive-strength = <16>;
+ drive-strength = <2>;
+ bias-disable;
};
};
--
2.43.2
From: Vitor Soares <vitor.soares(a)toradex.com>
When the mcp251xfd_start_xmit() function fails, the driver stops
processing messages, and the interrupt routine does not return,
running indefinitely even after killing the running application.
Error messages:
[ 441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16
[ 441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3).
... and repeat forever.
The issue can be triggered when multiple devices share the same
SPI interface. And there is concurrent access to the bus.
The problem occurs because tx_ring->head increments even if
mcp251xfd_start_xmit() fails. Consequently, the driver skips one
TX package while still expecting a response in
mcp251xfd_handle_tefif_one().
This patch resolves the issue by decreasing tx_ring->head and removing
the skb from the echo stack if mcp251xfd_start_xmit() fails.
Consequently, the package is dropped not been possible to re-transmit.
Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN")
Cc: stable(a)vger.kernel.org
Signed-off-by: Vitor Soares <vitor.soares(a)toradex.com>
---
With this approach, some packages get lost in concurrent SPI bus access
due to can_put_echo_skb() being called before mcp251xfd_tx_obj_write().
The can_put_echo_skb() calls can_create_echo_skb() that consumes the original skb
resulting in a Kernel NULL pointer dereference error if return NETDEV_TX_BUSY on
mcp251xfd_tx_obj_write() failure.
A potential solution would be to change the code to use spi_sync(), which would
wait for SPI bus to be unlocked. Any thoughts about this?
V3->V4:
- Leave can_put_echo_skb() and stop the queue if needed, before mcp251xfd_tx_obj_write().
- Re-sync head and remove echo skb if mcp251xfd_tx_obj_write() fails.
- Revert -> return NETDEV_TX_BUSY if mcp251xfd_tx_obj_write() == -EBUSY.
V2->V3:
- Add tx_dropped stats.
- netdev_sent_queue() only if can_put_echo_skb() succeed.
V1->V2:
- Return NETDEV_TX_BUSY if mcp251xfd_tx_obj_write() == -EBUSY.
- Rework the commit message to address the change above.
- Change can_put_echo_skb() to be called after mcp251xfd_tx_obj_write() succeed.
Otherwise, we get Kernel NULL pointer dereference error.
drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c | 26 ++++++++++++++------
1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c
index 160528d3cc26..9909e23de7b9 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c
@@ -166,11 +166,12 @@ netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb,
struct net_device *ndev)
{
struct mcp251xfd_priv *priv = netdev_priv(ndev);
+ struct net_device_stats *stats = &ndev->stats;
struct mcp251xfd_tx_ring *tx_ring = priv->tx;
struct mcp251xfd_tx_obj *tx_obj;
unsigned int frame_len;
+ int err, echo_err;
u8 tx_head;
- int err;
if (can_dev_dropped_skb(ndev, skb))
return NETDEV_TX_OK;
@@ -188,18 +189,27 @@ netdev_tx_t mcp251xfd_start_xmit(struct sk_buff *skb,
netif_stop_queue(ndev);
frame_len = can_skb_get_frame_len(skb);
- err = can_put_echo_skb(skb, ndev, tx_head, frame_len);
- if (!err)
+ echo_err = can_put_echo_skb(skb, ndev, tx_head, frame_len);
+ if (!echo_err)
netdev_sent_queue(priv->ndev, frame_len);
err = mcp251xfd_tx_obj_write(priv, tx_obj);
- if (err)
- goto out_err;
+ if (err) {
+ tx_ring->head--;
- return NETDEV_TX_OK;
+ if (!echo_err) {
+ can_free_echo_skb(ndev, tx_head, &frame_len);
+ netdev_completed_queue(ndev, 1, frame_len);
+ }
+
+ if (mcp251xfd_get_tx_free(tx_ring))
+ netif_wake_queue(ndev);
- out_err:
- netdev_err(priv->ndev, "ERROR in %s: %d\n", __func__, err);
+ stats->tx_dropped++;
+ if (net_ratelimit())
+ netdev_err(priv->ndev,
+ "ERROR in %s: %d\n", __func__, err);
+ }
return NETDEV_TX_OK;
}
--
2.34.1
From: Wang Yong <wang.yong12(a)zte.com.cn>
During the stress testing of the jffs2 file system,the following
abnormal printouts were found:
[ 2430.649000] Unable to handle kernel paging request at virtual address 0069696969696948
[ 2430.649622] Mem abort info:
[ 2430.649829] ESR = 0x96000004
[ 2430.650115] EC = 0x25: DABT (current EL), IL = 32 bits
[ 2430.650564] SET = 0, FnV = 0
[ 2430.650795] EA = 0, S1PTW = 0
[ 2430.651032] FSC = 0x04: level 0 translation fault
[ 2430.651446] Data abort info:
[ 2430.651683] ISV = 0, ISS = 0x00000004
[ 2430.652001] CM = 0, WnR = 0
[ 2430.652558] [0069696969696948] address between user and kernel address ranges
[ 2430.653265] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[ 2430.654512] CPU: 2 PID: 20919 Comm: cat Not tainted 5.15.25-g512f31242bf6 #33
[ 2430.655008] Hardware name: linux,dummy-virt (DT)
[ 2430.655517] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 2430.656142] pc : kfree+0x78/0x348
[ 2430.656630] lr : jffs2_free_inode+0x24/0x48
[ 2430.657051] sp : ffff800009eebd10
[ 2430.657355] x29: ffff800009eebd10 x28: 0000000000000001 x27: 0000000000000000
[ 2430.658327] x26: ffff000038f09d80 x25: 0080000000000000 x24: ffff800009d38000
[ 2430.658919] x23: 5a5a5a5a5a5a5a5a x22: ffff000038f09d80 x21: ffff8000084f0d14
[ 2430.659434] x20: ffff0000bf9a6ac0 x19: 0169696969696940 x18: 0000000000000000
[ 2430.659969] x17: ffff8000b6506000 x16: ffff800009eec000 x15: 0000000000004000
[ 2430.660637] x14: 0000000000000000 x13: 00000001000820a1 x12: 00000000000d1b19
[ 2430.661345] x11: 0004000800000000 x10: 0000000000000001 x9 : ffff8000084f0d14
[ 2430.662025] x8 : ffff0000bf9a6b40 x7 : ffff0000bf9a6b48 x6 : 0000000003470302
[ 2430.662695] x5 : ffff00002e41dcc0 x4 : ffff0000bf9aa3b0 x3 : 0000000003470342
[ 2430.663486] x2 : 0000000000000000 x1 : ffff8000084f0d14 x0 : fffffc0000000000
[ 2430.664217] Call trace:
[ 2430.664528] kfree+0x78/0x348
[ 2430.664855] jffs2_free_inode+0x24/0x48
[ 2430.665233] i_callback+0x24/0x50
[ 2430.665528] rcu_do_batch+0x1ac/0x448
[ 2430.665892] rcu_core+0x28c/0x3c8
[ 2430.666151] rcu_core_si+0x18/0x28
[ 2430.666473] __do_softirq+0x138/0x3cc
[ 2430.666781] irq_exit+0xf0/0x110
[ 2430.667065] handle_domain_irq+0x6c/0x98
[ 2430.667447] gic_handle_irq+0xac/0xe8
[ 2430.667739] call_on_irq_stack+0x28/0x54
The parameter passed to kfree was 5a5a5a5a, which corresponds to the target field of
the jffs_inode_info structure. It was found that all variables in the jffs_inode_info
structure were 5a5a5a5a, except for the first member sem. It is suspected that these
variables are not initialized because they were set to 5a5a5a5a during memory testing,
which is meant to detect uninitialized memory.The sem variable is initialized in the
function jffs2_i_init_once, while other members are initialized in
the function jffs2_init_inode_info.
The function jffs2_init_inode_info is called after iget_locked,
but in the iget_locked function, the destroy_inode process is triggered,
which releases the inode and consequently, the target member of the inode
is not initialized.In concurrent high pressure scenarios, iget_locked
may enter the destroy_inode branch as described in the code.
Since the destroy_inode functionality of jffs2 only releases the target,
the fix method is to set target to NULL in jffs2_i_init_once.
Signed-off-by: Wang Yong <wang.yong12(a)zte.com.cn>
Reviewed-by: Lu Zhongjun <lu.zhongjun(a)zte.com.cn>
Reviewed-by: Yang Tao <yang.tao172(a)zte.com.cn>
Cc: Xu Xin <xu.xin16(a)zte.com.cn>
Cc: Yang Yang <yang.yang29(a)zte.com.cn>
---
fs/jffs2/super.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 81ca58c..40cc5e6 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -58,6 +58,7 @@ static void jffs2_i_init_once(void *foo)
struct jffs2_inode_info *f = foo;
mutex_init(&f->sem);
+ f->target = NULL;
inode_init_once(&f->vfs_inode);
}
--
2.15.2
6.6.30-rc1 has a large set of fs/smb (cifs.ko and ksmbd.ko) patches
backported but was missing more than 30 fixes so I put together a safe
backport of the remaining, leaving out patches that had dependencies
on things outside of fs/smb
The following changes since commit 488f7008e62890fae8c7a2d3583913c8074f1fc6:
smb3: fix lock ordering potential deadlock in cifs_sync_mid_result
(2024-04-30 12:30:53 -0500)
are available in the Git repository at:
git://git.samba.org/ksmbd.git tags/6.6.30-rc1-full-fs-smb-backport
for you to fetch changes up to 411b6f385ac2427ee9d70fae277a4ed6b9d3983f:
smb: smb2pdu.h: Avoid -Wflex-array-member-not-at-end warnings
(2024-05-01 02:18:25 -0500)
----------------------------------------------------------------
full backport for 6.6.30, includes all 80 (of the relevant) missing
fs/smb changesets
Test results look good (and better than without the patches). Here
are the functional test results (they passed exhaustive set of tests
to various server types):
http://smb311-linux-testing.southcentralus.cloudapp.azure.com/#/builders/3/…http://smb311-linux-testing.southcentralus.cloudapp.azure.com/#/builders/5/…http://smb311-linux-testing.southcentralus.cloudapp.azure.com/#/builders/9/…http://smb311-linux-testing.southcentralus.cloudapp.azure.com/#/builders/10…
Note that 22 patches had dependencies and were not appropriate to
backport and are not included, but here is the list of the additional
80 fs/smb patches included, many of which fix bugs (the others reduce
risk of backport, and help avoid merge conflicts):
411b6f385ac2 (HEAD -> fs-smb-backport-linux-6.6.30-rc1, tag:
6.6.30-rc1-full-fs-smb-backport,
origin/fs-smb-backport-linux-6.6.30-rc1) smb: smb2pdu.h: Avoid
-Wflex-array-member-not-at-end warnings
e97b85914501 ksmbd: add continuous availability share parameter
c52ce70edb58 cifs: Add tracing for the cifs_tcon struct refcounting
6fa6d5ed6a06 smb3: fix broken reconnect when password changing on the
server by allowing password rotation
d8833245b0f3 smb: client: instantiate when creating SFU files
4c8cf606bdb9 smb: client: fix NULL ptr deref in
cifs_mark_open_handles_for_deleted_file()
e0727528f3be smb3: add trace event for mknod
b71e6511fa98 smb311: additional compression flag defined in updated
protocol spec
0725c800685e smb311: correct incorrect offset field in compression header
e25e2f027599 cifs: Move some extern decls from .c files to .h
0d422616d36e ksmbd: fix potencial out-of-bounds when buffer offset is invalid
3967f3e18d66 ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
aec926736509 ksmbd: Fix spelling mistake "connction" -> "connection"
43f609cc80a5 ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close
3f1a838bc984 cifs: remove redundant variable assignment
05415df6229c cifs: fixes for get_inode_info
025b6f60cccc cifs: defer close file handles having RH lease
f1907205b6d3 ksmbd: add support for durable handles v1/v2
38b6f9391d64 ksmbd: mark SMB2_SESSION_EXPIRED to session when
destroying previous session
5ab62e6d22d1 cifs: update internal module version number for cifs.ko
4dcd0fe0c185 smb: common: simplify compression headers
0409ad4bad2b smb: common: fix fields sizes in compression_pattern_payload_v1
25fc3d85adc6 smb: client: negotiate compression algorithms
f3351838c269 smb3: add dynamic trace point for ioctls
7716c6db1c3b smb: client: return reparse type in /proc/mounts
1c3fbd8f92e9 smb: client: set correct d_type for reparse DFS/DFSR and
mount point
555e4ef34991 smb: client: parse uid, gid, mode and dev from WSL reparse points
5232c56b469f smb: client: introduce SMB2_OP_QUERY_WSL_EA
2bcfc0b089f7 smb: client: Fix a NULL vs IS_ERR() check in wsl_set_xattrs()
7ef14e642141 smb: client: add support for WSL reparse points
324c9dc5ab0b smb: client: reduce number of parameters in smb2_compound_op()
8b52dc432b0a smb: client: fix potential broken compound request
8f22fd9f0396 smb: client: move most of reparse point handling code to
common file
0ddb5bfd6f20 smb: client: introduce reparse mount option
370c2c605121 smb: client: retry compound request without reusing lease
6051d1b018ea smb: client: do not defer close open handles to deleted files
6a9d47b768c4 smb: client: reuse file lease key in compound operations
87eec3c54337 smb: client: get rid of smb311_posix_query_path_info()
32fab0e3e9b9 smb: client: parse owner/group when creating reparse points
df9a4c3f5db4 smb3: update allocation size more accurately on write completion
4d7263b3bf67 smb: client: handle path separator of created SMB symlinks
bd15b21c46c1 cifs: update the same create_guid on replay
6feda182ccf0 ksmbd: Add kernel-doc for ksmbd_extract_sharename() function
a12c76c3f311 cifs: set replay flag for retries of write command
e0a86c86ec5f cifs: commands that are retried should have replay flag set
207e9813ad88 smb: client: delete "true", "false" defines
6eb8a67757c6 smb: Fix some kernel-doc comments
3c21bffee62f cifs: new mount option called retrans
005892f2a944 smb: client: don't clobber ->i_rdev from cached reparse points
222edc9359a6 cifs: new nt status codes from MS-SMB2
80e719af52b9 cifs: pick channel for tcon and tdis
56c978ef1555 cifs: minor comment cleanup
6008da8e76ac cifs: remove redundant variable tcon_exist
95d9120fd9b0 cifs: update internal module version number for cifs.ko
2bbd03ad1d98 ksmbd: vfs: fix all kernel-doc warnings
0988e25500d0 ksmbd: auth: fix most kernel-doc warnings
9198cebadcef cifs: remove unneeded return statement
2b8222b46d92 cifs: get rid of dup length check in parse_reparse_point()
a1975468bc0d cifs: Pass unbyteswapped eof value into SMB2_set_eof()
b312f2d94a42 smb3: Improve exception handling in allocate_mr_list()
b6a02523d103 cifs: fix in logging in cifs_chan_update_iface
f7e60be64713 smb: client: handle special files and symlinks in SMB3 POSIX
2f68be9f5e9d smb: client: cleanup smb2_query_reparse_point()
eed182ebb134 smb: client: allow creating symlinks via reparse points
95c6eac76fa5 smb: client: optimise reparse point querying
8dbc76e94b4b smb: client: allow creating special files via reparse points
a5a4a5bc172b smb: client: extend smb2_compound_op() to accept more commands
778c2e03cbf4 smb: client: Fix minor whitespace errors and warnings
757f636f8fb0 smb: client: introduce cifs_sfu_make_node()
52740954fa81 cifs: fix use after free for iface while disabling
secondary channels
789f47984ddf cifs: update internal module version number for cifs.ko
120608af2863 Missing field not being returned in ioctl CIFS_IOC_GET_MNT_INFO
d1e9469bb4de smb3: minor cleanup of session handling code
09f7cf2bba1b smb3: more minor cleanups for session handling routines
6e19e4e86f02 smb3: minor RDMA cleanup
d73d7f8d1faa cifs: print server capabilities in DebugData
a88a5c2bf942 smb: use crypto_shash_digest() in symlink_hash()
56ad4435b30b Add definition for new smb3.1.1 command type
5900e9b37aa2 SMB3: clarify some of the unused CreateOption flags
fdf07b15f7d7 cifs: Add client version details to NTLM authenticate message
--
Thanks,
Steve
On 5/6/24 2:30 PM, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
>
> spi: axi-spi-engine: move msg state to new struct
>
> to the 6.1-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> spi-axi-spi-engine-move-msg-state-to-new-struct.patch
> and it can be found in the queue-6.1 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
>
>
Does not meet the criteria for stable.
On 5/6/24 2:30 PM, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
>
> spi: axi-spi-engine: use devm_spi_alloc_host()
>
> to the 6.1-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> spi-axi-spi-engine-use-devm_spi_alloc_host.patch
> and it can be found in the queue-6.1 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
>
>
Does not meet the criteria for stable.
On 5/6/24 2:30 PM, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
>
> spi: axi-spi-engine: simplify driver data allocation
>
> to the 6.1-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum…
>
> The filename of the patch is:
> spi-axi-spi-engine-simplify-driver-data-allocation.patch
> and it can be found in the queue-6.1 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable(a)vger.kernel.org> know about it.
>
>
Does not meet the criteria for stable.