This is the start of the stable review cycle for the 6.2.3 release. There are 1001 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 09 Mar 2023 16:57:34 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.2.3-rc1.g... or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.2.y and the diffstat can be found below.
thanks,
greg k-h
------------- Pseudo-Shortlog of commits:
Greg Kroah-Hartman gregkh@linuxfoundation.org Linux 6.2.3-rc1
Jani Nikula jani.nikula@intel.com drm/edid: fix parsing of 3D modes from HDMI VSDB
Jani Nikula jani.nikula@intel.com drm/edid: fix AVI infoframe aspect ratio handling
Noralf Trønnes noralf@tronnes.org drm/gud: Fix UBSAN warning
John Harrison John.C.Harrison@Intel.com drm/i915: Don't use BAR mappings for ring buffers with LLC
John Harrison John.C.Harrison@Intel.com drm/i915: Don't use stolen memory for ring buffers with LLC
Mark Hawrylak mark.hawrylak@gmail.com drm/radeon: Fix eDP for single-display iMac11,2
Mavroudis Chatzilaridis mavchatz@protonmail.com drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
Mario Limonciello mario.limonciello@amd.com drm/amd: Fix initialization for nbio 7.5.1
Steve Sistare steven.sistare@oracle.com vfio/type1: restore locked_vm
Steve Sistare steven.sistare@oracle.com vfio/type1: track locked_vm per dma
Steve Sistare steven.sistare@oracle.com vfio/type1: prevent underflow of locked_vm via exec()
Steve Sistare steven.sistare@oracle.com vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR
Jacob Pan jacob.jun.pan@linux.intel.com iommu/vt-d: Fix PASID directory pointer coherency
Jacob Pan jacob.jun.pan@linux.intel.com iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode
Jason Gunthorpe jgg@ziepe.ca iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
Jason Gunthorpe jgg@ziepe.ca iommufd: Make sure to zero vfio_iommu_type1_info before copying to user
Manivannan Sadhasivam mani@kernel.org bus: mhi: ep: Save channel state locally during suspend and resume
Manivannan Sadhasivam mani@kernel.org bus: mhi: ep: Move chan->lock to the start of processing queued ch ring
Manivannan Sadhasivam mani@kernel.org bus: mhi: ep: Only send -ENOTCONN status if client driver is available
Lukas Wunner lukas@wunner.de PCI/DPC: Await readiness of secondary bus after reset
Damien Le Moal damien.lemoal@opensource.wdc.com PCI: Avoid FLR for AMD FCH AHCI adapters
Lukas Wunner lukas@wunner.de PCI: hotplug: Allow marking devices as disconnected during bind/unbind
Lukas Wunner lukas@wunner.de PCI: Unify delay handling for reset and resume
Lukas Wunner lukas@wunner.de PCI/PM: Observe reset delay irrespective of bridge_d3
H. Nikolaus Schaller hns@goldelico.com MIPS: DTS: CI20: fix otg power gpio
Guo Ren guoren@kernel.org riscv: ftrace: Reduce the detour code size to half
Guo Ren guoren@kernel.org riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
Björn Töpel bjorn@rivosinc.com riscv, mm: Perform BPF exhandler fixup on page fault
Andy Chiu andy.chiu@sifive.com riscv: ftrace: Fixup panic by disabling preemption
Andy Chiu andy.chiu@sifive.com riscv: jump_label: Fixup unaligned arch_static_branch function
Sergey Matyukevich sergey.matyukevich@syntacore.com riscv: mm: fix regression due to update_mmu_cache change
Mattias Nissler mnissler@rivosinc.com riscv: Avoid enabling interrupts in die()
Conor Dooley conor.dooley@microchip.com RISC-V: add a spin_shadow_stack declaration
Tomas Henzl thenzl@redhat.com scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
Tomas Henzl thenzl@redhat.com scsi: ses: Fix possible desc_ptr out-of-bounds accesses
Tomas Henzl thenzl@redhat.com scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
Tomas Henzl thenzl@redhat.com scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
James Bottomley jejb@linux.ibm.com scsi: ses: Don't attach if enclosure has no components
Saurav Kashyap skashyap@marvell.com scsi: qla2xxx: Remove increment of interface err cnt
Quinn Tran qutran@marvell.com scsi: qla2xxx: Fix erroneous link down
Quinn Tran qutran@marvell.com scsi: qla2xxx: Remove unintended flag clearing
Arun Easi aeasi@marvell.com scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
Shreyas Deodhar sdeodhar@marvell.com scsi: qla2xxx: Check if port is online before sending ELS
Quinn Tran qutran@marvell.com scsi: qla2xxx: Fix link failure in NPIV environment
Bart Van Assche bvanassche@acm.org scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
Kees Cook keescook@chromium.org scsi: aacraid: Allocate cmd_priv with scsicmd
Gavrilov Ilia Ilia.Gavrilov@infotecs.ru iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
Masami Hiramatsu (Google) mhiramat@kernel.org tracing/eprobe: Fix to add filter on eprobe description in README file
Antonio Alvarez Feijoo antonio.feijoo@suse.com tools/bootconfig: fix single & used for logical condition
Mukesh Ojha quic_mojha@quicinc.com ring-buffer: Handle race between rb_move_tail and rb_check_pages
Tong Tiangen tongtiangen@huawei.com memory tier: release the new_memtier in find_create_memory_tier()
Steven Rostedt rostedt@goodmis.org ktest.pl: Add RUN_TIMEOUT option with default unlimited
Steven Rostedt rostedt@goodmis.org ktest.pl: Fix missing "end_monitor" when machine check fails
Masami Hiramatsu (Google) mhiramat@kernel.org kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
Steven Rostedt rostedt@goodmis.org ktest.pl: Give back console on Ctrt^C on monitor
Yin Fengwei fengwei.yin@intel.com mm/thp: check and bail out if page in deferred queue already
Johannes Weiner hannes@cmpxchg.org mm: memcontrol: deprecate charge moving
John Ogness john.ogness@linutronix.de docs: gdbmacros: print newest record
Yan Zhao yan.y.zhao@intel.com vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd
Chen-Yu Tsai wenst@chromium.org remoteproc/mtk_scp: Move clk ops outside send_lock
Sakari Ailus sakari.ailus@linux.intel.com media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
Elvira Khabirova lineprinter0@gmail.com mips: fix syscall_get_nr
Dan Williams dan.j.williams@intel.com dax/kmem: Fix leak of memory-hotplug resources
Al Viro viro@zeniv.linux.org.uk alpha: fix FEN fault handling
Dhruva Gole d-gole@ti.com spi: spi-sn-f-ospi: fix duplicate flag while assigning to mode_bits
Marc Zyngier maz@kernel.org genirq/msi: Take the per-device MSI lock before validating the control structure
Thomas Gleixner tglx@linutronix.de genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced
Naoya Horiguchi naoya.horiguchi@nec.com mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON
Guilherme G. Piccoli gpiccoli@igalia.com panic: fix the panic_print NMI backtrace setting
Matthias Kaehlcke mka@chromium.org regulator: core: Use ktime_get_boottime() to determine how long a regulator was off
Xiubo Li xiubli@redhat.com ceph: update the time stamps and try to drop the suid/sgid
Ilya Dryomov idryomov@gmail.com rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
Alexander Mikhalitsyn alexander@mihalicyn.com fuse: add inode/permission checks to fileattr_get/fileattr_set
Peter Collingbourne pcc@google.com arm64: Reset KASAN tag in copy_highpage with HW tags only
Catalin Marinas catalin.marinas@arm.com arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP
Sudeep Holla sudeep.holla@arm.com arm64: acpi: Fix possible memory leak of ffh_ctxt
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org ARM: dts: exynos: correct TMU phandle in Odroid HC1
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org ARM: dts: exynos: correct TMU phandle in Odroid XU
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org ARM: dts: exynos: correct TMU phandle in Exynos5250
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org ARM: dts: exynos: correct TMU phandle in Exynos4
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org ARM: dts: exynos: correct TMU phandle in Exynos4210
Manivannan Sadhasivam mani@kernel.org ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node
Manivannan Sadhasivam mani@kernel.org ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node
Mika Westerberg mika.westerberg@linux.intel.com spi: intel: Check number of chip selects after reading the descriptor
Zev Weiss zev@bewilderbeest.net hwmon: (nct6775) Fix incorrect parenthesization in nct6775_write_fan_div()
Zev Weiss zev@bewilderbeest.net hwmon: (peci/cputemp) Fix off-by-one in coretemp_label allocation
Mikulas Patocka mpatocka@redhat.com dm flakey: fix a bug with 32-bit highmem systems
Mikulas Patocka mpatocka@redhat.com dm flakey: don't corrupt the zero page
Joe Thornber ejt@redhat.com dm cache: free background tracker's queued work in btracker_destroy
Mikulas Patocka mpatocka@redhat.com dm flakey: fix logic when corrupting a bio
Srinivas Pandruvada srinivas.pandruvada@linux.intel.com thermal: intel: powerclamp: Fix cur_state for multi package system
Manish Chopra manishc@marvell.com qede: fix interrupt coalescing configuration
Arnd Bergmann arnd@arndb.de cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies
Marc Bornand dev.mbornand@systemb.ch wifi: cfg80211: Set SSID if it is not already set
Alexander Wetzel alexander@wetzel-home.de wifi: cfg80211: Fix use after free for wext
Len Brown len.brown@intel.com wifi: ath11k: allow system suspend to survive ath11k
Bitterblue Smith rtl8821cerfe2@gmail.com wifi: rtl8xxxu: Use a longer retry limit of 48
Ping-Ke Shih pkshih@realtek.com wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice
Mike Snitzer snitzer@kernel.org dm: add cond_resched() to dm_wq_requeue_work()
Pingfan Liu piliu@redhat.com dm: add cond_resched() to dm_wq_work()
Mikulas Patocka mpatocka@redhat.com dm: send just one event on resize, not two
Louis Rannou lrannou@baylibre.com mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
Tudor Ambarus tudor.ambarus@linaro.org mtd: spi-nor: spansion: Consider reserved bits in CFR5 register
Takahiro Kuwano Takahiro.Kuwano@infineon.com mtd: spi-nor: sfdp: Fix index value for SCCR dwords
Dmitry Torokhov dmitry.torokhov@gmail.com Input: exc3000 - properly stop timer on shutdown
Dan Williams dan.j.williams@intel.com cxl/pmem: Fix nvdimm registration races
Jan Kara jack@suse.cz ext4: Fix possible corruption when moving a directory
Jun Nie jun.nie@linaro.org ext4: refuse to create ea block when umounted
Jun Nie jun.nie@linaro.org ext4: optimize ea_inode block expansion
Zhihao Cheng chengzhihao1@huawei.com jbd2: fix data missing when reusing bh which is ready to be checkpointed
Łukasz Stelmach l.stelmach@samsung.com ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
Dmitry Fomin fomindmitriyfoma@mail.ru ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
andrew.yang andrew.yang@mediatek.com mm/damon/paddr: fix missing folio_put()
Giovanni Cabiddu giovanni.cabiddu@intel.com crypto: qat - fix out-of-bounds read
Marc Zyngier maz@kernel.org irqdomain: Fix domain registration race
Johan Hovold johan+linaro@kernel.org irqdomain: Fix mapping-creation race
Johan Hovold johan+linaro@kernel.org irqdomain: Refactor __irq_domain_alloc_irqs()
Johan Hovold johan+linaro@kernel.org irqdomain: Drop bogus fwspec-mapping error handling
Johan Hovold johan+linaro@kernel.org irqdomain: Look for existing mapping only once
Johan Hovold johan+linaro@kernel.org irqdomain: Fix disassociation race
Johan Hovold johan+linaro@kernel.org irqdomain: Fix association race
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: seccomp: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: vm: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: dmabuf-heaps: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: drivers: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: futex: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: ipc: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: perf_events: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: mount_setattr: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: move_mount_set_group: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: rseq: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: sync: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: ptp: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: user_events: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: filesystems: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: gpio: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: media_tests: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: kcmp: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: membarrier: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: pidfd: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: clone3: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: arm64: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: pid_namespace: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: core: Fix incorrect kernel headers search path
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: sched: Fix incorrect kernel headers search path
Masami Hiramatsu (Google) mhiramat@kernel.org selftests/ftrace: Fix eprobe syntax test case to check filter support
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests/powerpc: Fix incorrect kernel headers search path
Pali Rohár pali@kernel.org powerpc/boot: Don't always pass -mcpu=powerpc when building 32-bit uImage
Roberto Sassu roberto.sassu@huawei.com ima: Align ima_file_mmap() parameters with mmap_file LSM hook
Matt Bobrowski mattbobrowski@google.com ima: fix error handling logic when file measurement failed
Jens Axboe axboe@kernel.dk brd: check for REQ_NOWAIT and set correct page allocation mask
Jens Axboe axboe@kernel.dk brd: return 0/-error from brd_insert_page()
Jens Axboe axboe@kernel.dk brd: mark as nowait compatible
Tom Lendacky thomas.lendacky@amd.com virt/sev-guest: Return -EIO if certificate buffer is not large enough
KP Singh kpsingh@kernel.org Documentation/hw-vuln: Document the interaction between IBRS and STIBP
KP Singh kpsingh@kernel.org x86/speculation: Allow enabling STIBP with legacy IBRS
Borislav Petkov (AMD) bp@alien8.de x86/microcode/AMD: Fix mixed steppings support
Borislav Petkov (AMD) bp@alien8.de x86/microcode/AMD: Add a @cpu parameter to the reloading functions
Borislav Petkov (AMD) bp@alien8.de x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
Yang Jihong yangjihong1@huawei.com x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
Yang Jihong yangjihong1@huawei.com x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
Sean Christopherson seanjc@google.com x86/reboot: Disable SVM, not just VMX, when stopping CPUs
Sean Christopherson seanjc@google.com x86/reboot: Disable virtualization in an emergency if SVM is supported
Sean Christopherson seanjc@google.com x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
Sean Christopherson seanjc@google.com x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
Mathieu Desnoyers mathieu.desnoyers@efficios.com selftests: x86: Fix incorrect kernel headers search path
Randy Dunlap rdunlap@infradead.org KVM: SVM: hyper-v: placate modpost section mismatch error
Peter Gonda pgonda@google.com KVM: SVM: Fix potential overflow in SEV's send|receive_update_data()
Sean Christopherson seanjc@google.com KVM: x86: Inject #GP on x2APIC WRMSR that sets reserved bits 63:32
Sean Christopherson seanjc@google.com KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
Sean Christopherson seanjc@google.com KVM: SVM: Don't put/load AVIC when setting virtual APIC mode
Sean Christopherson seanjc@google.com KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target
Sean Christopherson seanjc@google.com KVM: SVM: Flush the "current" TLB when activating AVIC
Sean Christopherson seanjc@google.com KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID
Sean Christopherson seanjc@google.com KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled
Sean Christopherson seanjc@google.com KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps
Sean Christopherson seanjc@google.com KVM: x86: Purge "highest ISR" cache when updating APICv state
Sean Christopherson seanjc@google.com KVM: Register /dev/kvm as the _very_ last thing during initialization
Alexandru Matei alexandru.matei@uipath.com KVM: VMX: Fix crash due to uninitialized current_vmcs
Sean Christopherson seanjc@google.com KVM: Destroy target device if coalesced MMIO unregistration fails
Hou Tao houtao1@huawei.com md: don't update recovery_cp when curr_resync is ACTIVE
Jan Kara jack@suse.cz udf: Fix file corruption when appending just after end of preallocated extent
Jan Kara jack@suse.cz udf: Detect system inodes linked into directory hierarchy
Jan Kara jack@suse.cz udf: Preserve link count of system files
Jan Kara jack@suse.cz udf: Do not update file length for failed writes to inline files
Jan Kara jack@suse.cz udf: Do not bother merging very long extents
Jan Kara jack@suse.cz udf: Truncate added extents on failed expansion
Jeff Xu jeffxu@google.com selftests/landlock: Test ptrace as much as possible with Yama
Jeff Xu jeffxu@google.com selftests/landlock: Skip overlayfs tests when not supported
Andrew Morton akpm@linux-foundation.org fs/cramfs/inode.c: initialize file_ra_state
Heming Zhao via Ocfs2-devel ocfs2-devel@oss.oracle.com ocfs2: fix non-auto defrag path not working issue
Heming Zhao via Ocfs2-devel ocfs2-devel@oss.oracle.com ocfs2: fix defrag path triggering jbd2 ASSERT
Jaegeuk Kim jaegeuk@kernel.org f2fs: Revert "f2fs: truncate blocks in batch in __complete_revoke_list()"
Jaegeuk Kim jaegeuk@kernel.org f2fs: fix kernel crash due to null io->bio
Eric Biggers ebiggers@google.com f2fs: fix cgroup writeback accounting with fs-layer encryption
Jaegeuk Kim jaegeuk@kernel.org f2fs: retry to update the inode page given data corruption
Eric Biggers ebiggers@google.com f2fs: fix information leak in f2fs_move_inline_dirents()
Alexander Aring aahringo@redhat.com fs: dlm: send FIN ack back in right cases
Alexander Aring aahringo@redhat.com fs: dlm: move sending fin message into state change handling
Alexander Aring aahringo@redhat.com fs: dlm: don't set stop rx flag after node reset
Alexander Aring aahringo@redhat.com fs: dlm: fix race setting stop tx flag
Alexander Aring aahringo@redhat.com fs: dlm: be sure to call dlm_send_queue_flush()
Alexander Aring aahringo@redhat.com fs: dlm: fix use after free in midcomms commit
Alexander Aring aahringo@redhat.com fs: dlm: start midcomms before scand
Yuezhang Mo Yuezhang.Mo@sony.com exfat: fix inode->i_blocks for non-512 byte sector size device
Sungjong Seo sj1557.seo@samsung.com exfat: redefine DIR_DELETED as the bad cluster number
Yuezhang Mo Yuezhang.Mo@sony.com exfat: fix unexpected EOF while reading dir
Yuezhang Mo Yuezhang.Mo@sony.com exfat: fix reporting fs error when reading dir beyond EOF
Dongliang Mu mudongliangabcd@gmail.com fs: hfsplus: fix UAF issue in hfsplus_put_super
Liu Shixin liushixin2@huawei.com hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
Jens Axboe axboe@kernel.dk io_uring: mark task TASK_RUNNING before handling resume/task work
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org ARM: dts: exynos: correct HDMI phy compatible in Exynos4
Joel Fernandes (Google) joel@joelfernandes.org torture: Fix hang during kthread shutdown phase
Hangyu Hua hbh25y@gmail.com ksmbd: fix possible memory leak in smb2_lock()
Namjae Jeon linkinjeon@kernel.org ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length
Namjae Jeon linkinjeon@kernel.org ksmbd: fix wrong data area length for smb2 lock request
Waiman Long longman@redhat.com locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath
Qu Wenruo wqu@suse.com btrfs: sysfs: update fs features directory asynchronously
Boris Burkov boris@bur.io btrfs: hold block group refcount during async discard
Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi
Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()
Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
Ronnie Sahlberg lsahlber@redhat.com cifs: return a single-use cfid if we did not get a lease
Ronnie Sahlberg lsahlber@redhat.com cifs: Check the lease context if we actually got a lease
Stefan Metzmacher metze@samba.org cifs: don't try to use rdma offload on encrypted connections
Stefan Metzmacher metze@samba.org cifs: split out smb3_use_rdma_offload() helper
Stefan Metzmacher metze@samba.org cifs: introduce cifs_io_parms in smb2_async_writev()
Paulo Alcantara pc@manguebit.com cifs: fix mount on old smb servers
Volker Lendecke vl@samba.org cifs: Fix uninitialized memory reads for oparms.mode
Volker Lendecke vl@samba.org cifs: Fix uninitialized memory read in smb3_qfs_tcon()
Paulo Alcantara pc@manguebit.com cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID
Nico Boehr nrb@linux.ibm.com KVM: s390: disable migration mode when dirty tracking is disabled
Vasily Gorbik gor@linux.ibm.com s390/kprobes: fix current_kprobe never cleared after kprobes reenter
Vasily Gorbik gor@linux.ibm.com s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
Sven Schnelle svens@linux.ibm.com s390/ipl: add loadparm parameter to eckd ipl/reipl data
Sven Schnelle svens@linux.ibm.com s390/ipl: add DEFINE_GENERIC_LOADPARM()
Ilya Leoshkevich iii@linux.ibm.com s390: discard .interp section
Gerald Schaefer gerald.schaefer@linux.ibm.com s390/extmem: return correct segment type in __segment_load()
Joseph Qi joseph.qi@linux.alibaba.com io_uring: fix fget leak when fs don't support nowait buffered read
Jens Axboe axboe@kernel.dk io_uring/poll: allow some retries for poll triggering spuriously
David Lamparter equinox@diac24.net io_uring: remove MSG_NOSIGNAL from recvmsg
Pavel Begunkov asml.silence@gmail.com io_uring/rsrc: disallow multi-source reg buffers
Jens Axboe axboe@kernel.dk io_uring: add reschedule point to handle_tw_list()
Jens Axboe axboe@kernel.dk io_uring: add a conditional reschedule to the IOPOLL cancelation loop
Jens Axboe axboe@kernel.dk io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
Pavel Begunkov asml.silence@gmail.com io_uring: use user visible tail in io_uring_poll()
Kees Cook keescook@chromium.org io_uring: Replace 0-length array with flexible array
Corey Minyard cminyard@mvista.com ipmi:ssif: Add a timer between request retries
Corey Minyard cminyard@mvista.com ipmi_ssif: Rename idle state and check
Corey Minyard cminyard@mvista.com ipmi:ssif: resend_msg() cannot fail
Christophe JAILLET christophe.jaillet@wanadoo.fr ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms'
Johan Hovold johan+linaro@kernel.org rtc: pm8xxx: fix set-alarm race
Jens Axboe axboe@kernel.dk block: be a bit more careful in checking for NULL bdev while polling
Jens Axboe axboe@kernel.dk block: clear bio->bi_bdev when putting a bio back in the cache
Jens Axboe axboe@kernel.dk block: don't allow multiple bios for IOCB_NOWAIT issue
Alper Nebi Yasak alpernebiyasak@gmail.com firmware: coreboot: framebuffer: Ignore reserved pixel color bits
Jun ASAKA JunASAKA@zzy040330.moe wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
Saravana Kannan saravanak@google.com driver core: fw_devlink: Avoid spurious error message
Asahi Lina lina@asahilina.net drm/shmem-helper: Revert accidental non-GPL export
Matt Roper matthew.d.roper@intel.com drm/i915/mtl: Correct implementation of Wa_18018781329
Paulo Alcantara pc@cjr.nz cifs: prevent data race in smb2_reconnect()
Jeff Layton jlayton@kernel.org nfsd: don't hand out delegation on setuid files being opened for write
Jeff Layton jlayton@kernel.org nfsd: zero out pointers after putting nfsd_files on COPY setup error
Mike Snitzer snitzer@kernel.org dm cache: add cond_resched() to various workqueue loops
Mike Snitzer snitzer@kernel.org dm thin: add cond_resched() to various workqueue loops
Aurabindo Pillai aurabindo.pillai@amd.com drm/amd/display: disable SubVP + DRR to prevent underflow
Nicholas Kazlauskas nicholas.kazlauskas@amd.com drm/amd/display: Disable HUBP/DPP PG on DCN314 for now
Darrell Kavanagh darrell.kavanagh@gmail.com drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
Nicholas Kazlauskas nicholas.kazlauskas@amd.com drm/amd/display: Enable P-state validation checks for DCN314
Bastien Nocera hadess@hadess.net HID: logitech-hidpp: Don't restart communication if not necessary
Mason Zhang Mason.Zhang@mediatek.com scsi: ufs: core: Fix device management cmd timeout flow
Greg Kroah-Hartman gregkh@linuxfoundation.org scsi: snic: Fix memory leak with using debugfs_lookup()
Wesley Chalmers Wesley.Chalmers@amd.com drm/amd/display: Do not commit pipe when updating DRR
Claudiu Beznea claudiu.beznea@microchip.com pinctrl: at91: use devm_kasprintf() to avoid potential leaks
Denis Pauk pauk.denis@gmail.com hwmon: (nct6775) B650/B660/X670 ASUS boards support
Denis Pauk pauk.denis@gmail.com hwmon: (nct6775) Directly call ASUS ACPI WMI method
Robin Murphy robin.murphy@arm.com hwmon: (coretemp) Simplify platform device handling
Andreas Gruenbacher agruenba@redhat.com gfs2: Improve gfs2_make_fs_rw error handling
Vladimir Stempen vladimir.stempen@amd.com drm/amd/display: fix FCLK pstate change underflow
Vitaly Prosyak vitaly.prosyak@amd.com Revert "drm/amdgpu: TA unload messages are not actually sent to psp when amdgpu is uninstalled"
Kees Cook keescook@chromium.org regulator: s5m8767: Bounds check id indexing into arrays
Kees Cook keescook@chromium.org regulator: max77802: Bounds check regulator id against opmode
Kees Cook keescook@chromium.org ASoC: kirkwood: Iterate over array indexes instead of using pointer math
강신형 s47.kang@samsung.com ASoC: soc-compress: Reposition and add pcm_mutex
Marijn Suijten marijn.suijten@somainline.org drm/msm/dpu: Add DSC hardware blocks to register snapshot
Jakob Koschel jkl820.git@gmail.com docs/scripts/gdb: add necessary make scripts_gdb step
farah kassabri fkassabri@habana.ai habanalabs: fix bug in timestamps registration code
Moti Haimovski mhaimovski@habana.ai habanalabs: extend fatal messages to contain PCI info
Thomas Zimmermann tzimmermann@suse.de drm/client: Test for connectors before sending hotplug event
Roman Li roman.li@amd.com drm/amd/display: Set hvm_enabled flag for S/G mode
Wayne Lin Wayne.Lin@amd.com drm/drm_print: correct format problem
Tomi Valkeinen tomi.valkeinen+renesas@ideasonboard.com drm: rcar-du: Fix setting a reserved bit in DPLLCR
Tomi Valkeinen tomi.valkeinen+renesas@ideasonboard.com drm: rcar-du: Add quirk for H3 ES1.x pclk workaround
Jiasheng Jiang jiasheng@iscas.ac.cn drm/msm/dsi: Add missing check for alloc_ordered_workqueue
José Expósito jose.exposito89@gmail.com HID: uclogic: Add support for XP-PEN Deco Pro MW
José Expósito jose.exposito89@gmail.com HID: uclogic: Add support for XP-PEN Deco Pro SW
José Expósito jose.exposito89@gmail.com HID: uclogic: Add battery quirk
José Expósito jose.exposito89@gmail.com HID: uclogic: Add frame type quirk
Brandon Syu Brandon.Syu@amd.com drm/amd/display: fix mapping to non-allocated address
Konstantin Meskhidze konstantin.meskhidze@huawei.com drm: amd: display: Fix memory leakage
Mario Limonciello mario.limonciello@amd.com drm/amd: Avoid ASSERT for some message failures
Thomas Zimmermann tzimmermann@suse.de Revert "fbcon: don't lose the console font across generic->chip driver switch"
Justin Tee justin.tee@broadcom.com scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write
Philip Yang Philip.Yang@amd.com drm/amdkfd: Page aligned memory reserve size
Mario Limonciello mario.limonciello@amd.com drm/amd: Avoid BUG() for case of SRIOV missing IP version
Liwei Song liwei.song@windriver.com drm/radeon: free iio for atombios when driver shutdown
Nicholas Kazlauskas nicholas.kazlauskas@amd.com drm/amd/display: Defer DIG FIFO disable after VID stream enable
Carlo Caione ccaione@baylibre.com drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
Jingyuan Liang jingyliang@chromium.org HID: Add Mapping for System Microphone Mute
Tomi Valkeinen tomi.valkeinen@ideasonboard.com drm/omap: dsi: Fix excessive stack usage
Roman Li roman.li@amd.com drm/amd/display: Fix potential null-deref in dm_resume
Ian Chen ian.chen@amd.com drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write
Dillon Varone Dillon.Varone@amd.com drm/amd/display: Reduce expected sdp bandwidth for dcn321
Allen Ballway ballway@chromium.org drm: panel-orientation-quirks: Add quirk for DynaBook K50
Hans de Goede hdegoede@redhat.com drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F
Eric Dumazet edumazet@google.com scm: add user copy checks to put_cmsg()
Moshe Shemesh moshe@nvidia.com devlink: Fix TP_STRUCT_entry in trace of devlink health report
Heiko Carstens hca@linux.ibm.com s390/kfence: fix page fault reporting
Michael Kelley mikelley@microsoft.com hv_netvsc: Check status in SEND_RNDIS_PKT completion message
Zong-Zhe Yang kevin_yang@realtek.com wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30
Moises Cardona moisesmcardona@gmail.com Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
Mario Limonciello mario.limonciello@amd.com Bluetooth: btusb: Add new PID/VID 0489:e0f2 for MT7921
Marcel Holtmann marcel@holtmann.org Bluetooth: Fix issue with Actions Semi ATS2851 based devices
Greg Kroah-Hartman gregkh@linuxfoundation.org PM: EM: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman gregkh@linuxfoundation.org PM: domains: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman gregkh@linuxfoundation.org time/debug: Fix memory leak with using debugfs_lookup()
Heiko Carstens hca@linux.ibm.com s390/idle: mark arch_cpu_idle() noinstr
Kees Cook keescook@chromium.org uaccess: Add minimum bounds check on kernel buffer size
Kees Cook keescook@chromium.org coda: Avoid partial allocation of sig_inputArgs
Shay Drory shayd@nvidia.com net/mlx5: fw_tracer: Fix debug print
Hans de Goede hdegoede@redhat.com ACPI: video: Fix Lenovo Ideapad Z570 DMI match
Lorenzo Bianconi lorenzo@kernel.org wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
Armin Wolf W_Armin@gmx.de platform/x86: dell-ddv: Add support for interface version 3
Zhang Rui rui.zhang@intel.com tools/power/x86/intel-speed-select: Add Emerald Rapid quirk
Sam James sam@gentoo.org gcc-plugins: drop -std=gnu++11 to fix GCC 13 build
Oliver Hartkopp socketcan@hartkopp.net can: isotp: check CAN address family in isotp_bind()
Alok Tiwari alok.a.tiwari@oracle.com netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj()
Vasily Gorbik gor@linux.ibm.com s390/mm,ptdump: avoid Kasan vs Memcpy Real markers swapping
Michael Schmitz schmitzmic@gmail.com m68k: Check syscall_trace_enter() return code
Florian Fainelli f.fainelli@gmail.com net: bcmgenet: Add a check for oversized packets
Kees Cook keescook@chromium.org crypto: hisilicon: Wipe entire pool on error
Feng Tang feng.tang@intel.com clocksource: Suspend the watchdog temporarily when high read latency detected
Tim Zimmermann tim@linux4.de thermal: intel: intel_pch: Add support for Wellsburg PCH
Dave Thaler dthaler@microsoft.com bpf, docs: Fix modulo zero, division by zero, overflow, and underflow
Mark Rutland mark.rutland@arm.com ACPI: Don't build ACPICA with '-Os'
Mark Rutland mark.rutland@arm.com Compiler attributes: GCC cold function alignment workarounds
Jesse Brandeburg jesse.brandeburg@intel.com ice: add missing checks for PF vsi type
Siddaraju DH siddaraju.dh@intel.com ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB
Pietro Borrello borrello@diag.uniroma1.it inet: fix fast path in __inet_hash_connect()
Jisoo Jang jisoo.jang@yonsei.ac.kr wifi: mt7601u: fix an integer underflow
Zong-Zhe Yang kevin_yang@realtek.com wifi: rtw89: fix assignation of TX BD RAM table
Jisoo Jang jisoo.jang@yonsei.ac.kr wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
Holger Hoffstätte holger@applied-asynchrony.com bpftool: Always disable stack protection for BPF objects
Breno Leitao leitao@debian.org x86/bugs: Reset speculation control settings on init
Jann Horn jannh@google.com timers: Prevent union confusion from unexpected restart_syscall()
Yang Li yang.lee@linux.alibaba.com thermal: intel: Fix unsigned comparison with less than zero
Kalle Valo quic_kvalo@quicinc.com wifi: ath11k: debugfs: fix to work with multiple PCI devices
Zqiang qiang1.zhang@intel.com rcu-tasks: Handle queue-shrink/callback-enqueue race condition
Zqiang qiang1.zhang@intel.com rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
Pingfan Liu kernelfans@gmail.com srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
Paul E. McKenney paulmck@kernel.org rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
Paul E. McKenney paulmck@kernel.org rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
Jisoo Jang jisoo.jang@yonsei.ac.kr wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
Nagarajan Maran quic_nmaran@quicinc.com wifi: ath11k: fix monitor mode bringup crash
Minsuk Kang linuxlovemin@yonsei.ac.kr wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
Kan Liang kan.liang@linux.intel.com perf/x86/intel/uncore: Add Meteor Lake support
Peter Zijlstra peterz@infradead.org cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG
Mark Rutland mark.rutland@arm.com cpuidle: drivers: firmware: psci: Dont instrument suspend code
Jens Axboe axboe@kernel.dk x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads
Peter Zijlstra peterz@infradead.org cpuidle, intel_idle: Fix CPUIDLE_FLAG_INIT_XSTATE
Michael Grzeschik m.grzeschik@pengutronix.de arm64: zynqmp: Enable hs termination flag for USB dwc3 controller
Qu Wenruo wqu@suse.com btrfs: scrub: improve tree block error reporting
Greg Kroah-Hartman gregkh@linuxfoundation.org trace/blktrace: fix memory leak with using debugfs_lookup()
Yu Kuai yukuai3@huawei.com blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()
Yu Kuai yukuai3@huawei.com blk-cgroup: dropping parent refcount after pd_free_fn() is done
Li Nan linan122@huawei.com blk-iocost: fix divide by 0 error in calc_lcoefs()
Jann Horn jannh@google.com fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected
Markuss Broks markuss.broks@gmail.com ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
Nicholas Piggin npiggin@gmail.com exit: Detect and fix irq disabled state in oops
Peter Zijlstra peterz@infradead.org context_tracking: Fix noinstr vs KASAN
Jan Kara jack@suse.cz udf: Define EFSCORRUPTED error code
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: msm8996: Add additional A2NoC clocks
Liang He windhl@126.com ARM: OMAP2+: omap4-common: Fix refcount leak bug
Bjorn Andersson quic_bjorande@quicinc.com rpmsg: glink: Release driver_override
Bjorn Andersson quic_bjorande@quicinc.com rpmsg: glink: Avoid infinite loop on intent for missing channel
Tasos Sahanidis tasos@tasossah.com media: saa7134: Use video_unregister_device for radio_dev
Duoming Zhou duoming@zju.edu.cn media: usb: siano: Fix use after free bugs caused by do_submit_urb
Hans Verkuil hverkuil-cisco@xs4all.nl media: i2c: ov7670: 0 instead of -EINVAL was returned
Hans de Goede hdegoede@redhat.com media: atomisp: Only set default_run_mode on first open of a stream/asd
Arnd Bergmann arnd@arndb.de media: atomisp: fix videobuf2 Kconfig depenendency
Duoming Zhou duoming@zju.edu.cn media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
Dong Chuanjian chuanjian@nfschina.com media: drivers/media/v4l2-core/v4l2-h264 : add detection of null pointers
Ming Qian ming.qian@nxp.com media: amphion: correct the unspecified color space
Ming Qian ming.qian@nxp.com media: imx-jpeg: Apply clk_bulk api instead of operating specific clk
Nicolas Dufresne nicolas.dufresne@collabora.com media: hantro: Fix JPEG encoder ENUM_FRMSIZE on RK3399
Ming Qian ming.qian@nxp.com media: v4l2-jpeg: ignore the unknown APP14 marker
Ming Qian ming.qian@nxp.com media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data
Arnd Bergmann arnd@arndb.de media: platform: mtk-mdp3: fix Kconfig dependencies
Arnd Bergmann arnd@arndb.de media: camss: csiphy-3ph: avoid undefined behavior
Qiheng Lin linqiheng@huawei.com media: platform: mtk-mdp3: Fix return value check in mdp_probe()
Jai Luthra j-luthra@ti.com media: i2c: imx219: Fix binning for RAW8 capture
Adam Ford aford173@gmail.com media: i2c: imx219: Split common registers from mode tables
Yuan Can yuancan@huawei.com media: i2c: ov772x: Fix memleak in ov772x_probe()
Laurent Pinchart laurent.pinchart@ideasonboard.com media: mc: Get media_device directly from pad
Jai Luthra j-luthra@ti.com media: ov5640: Handle delays when no reset_gpio set
Jai Luthra j-luthra@ti.com media: ov5640: Fix soft reset sequence and timings
Marco Felsch m.felsch@pengutronix.de media: i2c: tc358746: fix possible endianness issue
Marco Felsch m.felsch@pengutronix.de media: i2c: tc358746: fix ignoring read error in g_register callback
Marco Felsch m.felsch@pengutronix.de media: i2c: tc358746: fix missing return assignment
Shang XiaoJing shangxiaojing@huawei.com media: ov5675: Fix memleak in ov5675_init_controls()
Shang XiaoJing shangxiaojing@huawei.com media: ov2740: Fix memleak in ov2740_init_controls()
Shang XiaoJing shangxiaojing@huawei.com media: max9286: Fix memleak in max9286_v4l2_register()
Bastian Germann bage@linutronix.de builddeb: clean generated package content
Nathan Chancellor nathan@kernel.org s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64
Nathan Chancellor nathan@kernel.org powerpc: Remove linker flag from KBUILD_AFLAGS
Yang Yingliang yangyingliang@huawei.com media: imx: imx7-media-csi: fix missing clk_disable_unprepare() in imx7_csi_init()
Jiasheng Jiang jiasheng@iscas.ac.cn media: platform: ti: Add missing check for devm_regulator_get
Gaosheng Cui cuigaosheng1@huawei.com media: ti: cal: fix possible memory leak in cal_ctx_create()
Sibi Sankar quic_sibis@quicinc.com remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
Christoph Hellwig hch@lst.de Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after use"
Patrick Kelsey pat.kelsey@cornelisnetworks.com IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
Patrick Kelsey pat.kelsey@cornelisnetworks.com IB/hfi1: Fix math bugs in hfi1_can_pin_pages()
Bob Pearson rpearsonhpe@gmail.com RDMA/rxe: Fix missing memory barriers in rxe_queue.h
Long Li longli@microsoft.com RDMA/mana_ib: Fix a bug when the PF indicates more entries for registering memory on first packet
Bob Pearson rpearsonhpe@gmail.com Subject: RDMA/rxe: Handle zero length rdma
Bob Pearson rpearsonhpe@gmail.com RDMA/rxe: Replace rxe_map and rxe_phys_buf by xarray
Bob Pearson rpearsonhpe@gmail.com RDMA/rxe: Cleanup page variables in rxe_mr.c
Bob Pearson rpearsonhpe@gmail.com RDMA-rxe: Isolate mr code from atomic_write_reply()
Bob Pearson rpearsonhpe@gmail.com RDMA-rxe: Isolate mr code from atomic_reply()
Bob Pearson rpearsonhpe@gmail.com RDMA/rxe: Move rxe_map_mr_sg to rxe_mr.c
Bob Pearson rpearsonhpe@gmail.com RDMA/rxe: Cleanup mr_check_range
Tina Zhang tina.zhang@intel.com iommu/vt-d: Allow to use flush-queue when first level is default
Lu Baolu baolu.lu@linux.intel.com iommu/vt-d: Fix error handling in sva enable/disable paths
Eric Pilmore epilmore@gigaio.com dmaengine: ptdma: check for null desc before calling pt_cmd_callback
Kees Cook keescook@chromium.org dmaengine: dw-axi-dmac: Do not dereference NULL structure
Shravan Chippa shravan.chippa@microchip.com dmaengine: sf-pdma: pdma_desc memory leak fix
Vasant Hegde vasant.hegde@amd.com iommu/amd: Do not identity map v2 capable device when snp is enabled
Jason Gunthorpe jgg@ziepe.ca iommu: Fix error unwind in iommu_group_alloc()
Dan Carpenter error27@gmail.com iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()
Johan Hovold johan+linaro@kernel.org PCI: qcom: Fix host-init error handling
Neill Kapron nkapron@google.com phy: rockchip-typec: fix tcphy_get_mode error case
Geert Uytterhoeven geert+renesas@glider.be PCI: Fix dropping valid root bus resources with .end = zero
Serge Semin Sergey.Semin@baikalelectronics.ru dmaengine: dw-edma: Fix readq_ch() return value truncation
Alexander Stein alexander.stein@ew.tq-group.com usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev
Saravana Kannan saravanak@google.com mtd: mtdpart: Don't create platform device that'll never probe
Saravana Kannan saravanak@google.com driver core: fw_devlink: Make cycle detection more robust
Saravana Kannan saravanak@google.com driver core: fw_devlink: Improve check for fwnode with no device/driver
Saravana Kannan saravanak@google.com driver core: fw_devlink: Consolidate device link flag computation
Saravana Kannan saravanak@google.com driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle
Saravana Kannan saravanak@google.com driver core: fw_devlink: Don't purge child fwnode's consumer links
Saravana Kannan saravanak@google.com driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links
Peng Fan peng.fan@nxp.com tty: serial: imx: disable Ageing Timer interrupt request irq
Shenwei Wang shenwei.wang@nxp.com serial: fsl_lpuart: fix RS485 RTS polariy inverse issue
Mustafa Ismail mustafa.ismail@intel.com RDMA/irdma: Cap MSIX used to online CPUs + 1
Mark Tomlinson mark.tomlinson@alliedtelesis.co.nz usb: max-3421: Fix setting of I/O pins
Nikita Zhandarovich n.zhandarovich@fintech.ru RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()
Bernard Metzler bmt@zurich.ibm.com RDMA/siw: Fix user page pinning accounting
Andreas Kemnade andreas@kemnade.info power: supply: remove faulty cooling logic
Lu Baolu baolu.lu@linux.intel.com iommu/vt-d: Set No Execute Enable bit in PASID table entry
Sergio Paracuellos sergio.paracuellos@gmail.com PCI: mt7621: Delay phy ports initialization
Chunfeng Yun chunfeng.yun@mediatek.com phy: mediatek: remove temporary variable @mask_
Udipto Goswami quic_ugoswami@quicinc.com usb: gadget: configfs: Restrict symlink creation is UDC already binded
Dan Carpenter error27@gmail.com usb: musb: mediatek: don't unregister something that wasn't registered
Nikita Zhandarovich n.zhandarovich@fintech.ru RDMA/cxgb4: add null-ptr-check after ip_dev_find()
Sherry Sun sherry.sun@nxp.com tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma case
Christophe JAILLET christophe.jaillet@wanadoo.fr usb: early: xhci-dbc: Fix a potential out-of-bound memory access
Ivan Bornyakov i.bornyakov@metrotek.ru fpga: microchip-spi: rewrite status polling in a time measurable way
Ivan Bornyakov i.bornyakov@metrotek.ru fpga: microchip-spi: move SPI I/O buffers out of stack
Serge Semin Sergey.Semin@baikalelectronics.ru dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers
Fabian Vogt fabian@ritter-vogt.de fotg210-udc: Add missing completion handler
Yi Liu yi.l.liu@intel.com iommufd: Add three missing structures in ucmd_buffer
Nicolin Chen nicolinc@nvidia.com selftests: iommu: Fix test_cmd_destroy_access() call in user_copy
Chen Zhongjin chenzhongjin@huawei.com firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
Yang Yingliang yangyingliang@huawei.com drivers: base: transport_class: fix resource leak when transport_add_device() fails
Yang Yingliang yangyingliang@huawei.com drivers: base: transport_class: fix possible memory leak
Hanjun Guo guohanjun@huawei.com driver core: location: Free struct acpi_pld_info *pld before return false
Zhengchao Shao shaozhengchao@huawei.com driver core: fix resource leak in device_add()
Yang Yingliang yangyingliang@huawei.com iommu/exynos: Fix error handling in exynos_iommu_init()
Christophe JAILLET christophe.jaillet@wanadoo.fr misc: fastrpc: Fix an error handling path in fastrpc_rpmsg_probe()
Andy Shevchenko andriy.shevchenko@linux.intel.com misc/mei/hdcp: Use correct macros to initialize uuid_le
Andy Shevchenko andriy.shevchenko@linux.intel.com mei: pxp: Use correct macros to initialize uuid_le
George Kennedy george.kennedy@oracle.com VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
Yang Yingliang yangyingliang@huawei.com firmware: stratix10-svc: fix error handle while alloc/add device failed
Yang Yingliang yangyingliang@huawei.com firmware: stratix10-svc: add missing gen_pool_destroy() in stratix10_svc_drv_probe()
Xiongfeng Wang wangxiongfeng2@huawei.com applicom: Fix PCI device refcount leak in applicom_init()
Yuan Can yuancan@huawei.com eeprom: idt_89hpesx: Fix error handling in idt_init()
Duoming Zhou duoming@zju.edu.cn Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol"
Yi Yang yiyang13@huawei.com serial: tegra: Add missing clk_disable_unprepare() in tegra_uart_hw_init()
Bartosz Golaszewski bartosz.golaszewski@linaro.org tty: serial: qcom-geni-serial: stop operations in progress at shutdown
Sherry Sun sherry.sun@nxp.com tty: serial: fsl_lpuart: clear LPUART Status Register in lpuart32_shutdown()
Sherry Sun sherry.sun@nxp.com tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown()
Yicong Yang yangyicong@hisilicon.com hwtracing: hisi_ptt: Only add the supported devices to the filters list
Yang Yingliang yangyingliang@huawei.com PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc
Bjorn Helgaas bhelgaas@google.com PCI: switchtec: Return -EFAULT for copy_to_user() errors
Alexey V. Vissarionov gremlin@altlinux.org PCI/IOV: Enlarge virtfn sysfs name buffer
Andy Shevchenko andriy.shevchenko@linux.intel.com usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count
Mao Jinlong quic_jinlmao@quicinc.com coresight: cti: Add PM runtime call in enable_store
James Clark james.clark@arm.com coresight: cti: Prevent negative values of enable count
Junhao He hejunhao3@huawei.com coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR
Ricardo Ribalda ribalda@chromium.org media: uvcvideo: Refactor power_line_frequency_controls_limited
Ricardo Ribalda ribalda@chromium.org media: uvcvideo: Refactor uvc_ctrl_mappings_uvcXX
Ricardo Ribalda ribalda@chromium.org media: uvcvideo: Implement mask for V4L2_CTRL_TYPE_MENU
Hans Verkuil hverkuil-cisco@xs4all.nl media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()
Al Viro viro@zeniv.linux.org.uk alpha/boot/tools/objstrip: fix the check for ELF header
Wang Hai wanghai38@huawei.com kobject: Fix slab-out-of-bounds in fill_kobj_path()
Yang Yingliang yangyingliang@huawei.com driver core: fix potential null-ptr-deref in device_add()
Richard Fitzgerald rf@opensource.cirrus.com soundwire: cadence: Don't overflow the command FIFOs
Yang Yingliang yangyingliang@huawei.com i2c: qcom-geni: change i2c_master_hub to static
Hanna Hawa hhhawa@amazon.com i2c: designware: fix i2c_dw_clk_rate() return size to be u32
Gaosheng Cui cuigaosheng1@huawei.com usb: gadget: fusb300_udc: free irq on the error path in fusb300_probe()
Ferry Toth ftoth@exalondelft.nl iio: light: tsl2563: Do not hardcode interrupt trigger type
Miaoqian Lin linmq006@gmail.com RDMA/hns: Fix refcount leak in hns_roce_mmap
Geert Uytterhoeven geert+renesas@glider.be dmaengine: HISI_DMA should depend on ARCH_HISI
Miaoqian Lin linmq006@gmail.com RDMA/erdma: Fix refcount leak in erdma_mmap
Fenghua Yu fenghua.yu@intel.com dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0
Qiheng Lin linqiheng@huawei.com mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
Randy Dunlap rdunlap@infradead.org mfd: cs5535: Don't build on UML
Tom Fitzhenry tom@tom-fitzhenry.me.uk mfd: rk808: Re-add rk808-clkout to RK818
Ondrej Mosnacek omosnace@redhat.com sysctl: fix proc_dobool() usability
Masami Hiramatsu (Google) mhiramat@kernel.org selftests/ftrace: Fix probepoint testcase to ignore __pfx_* symbols
Arnd Bergmann arnd@arndb.de objtool: add UACCESS exceptions for __tsan_volatile_read/write
Kajol Jain kjain@linux.ibm.com perf tests stat_all_metrics: Change true workload to sleep workload for system wide check
Arnd Bergmann arnd@arndb.de printf: fix errname.c list
Yang Jihong yangjihong1@huawei.com perf record: Fix segfault with --overwrite and --max-size
Guillaume Tucker guillaume.tucker@collabora.com selftests: use printf instead of echo -ne
Masami Hiramatsu (Google) mhiramat@kernel.org selftests/ftrace: Fix bash specific "==" operator
Guillaume Tucker guillaume.tucker@collabora.com selftests: find echo binary to use -ne options
Randy Dunlap rdunlap@infradead.org sparc: allow PM configs for sparc32 COMPILE_TEST
Ian Rogers irogers@google.com perf stat: Avoid merging/aggregating metric counts twice
Yicong Yang yangyicong@hisilicon.com perf tools: Fix auto-complete on aarch64
Athira Rajeev atrajeev@linux.vnet.ibm.com perf test bpf: Skip test if kernel-debuginfo is not present
Ian Rogers irogers@google.com perf jevents: Correct bad character encoding
Namhyung Kim namhyung@kernel.org perf stat: Hide invalid uncore event output for aggr mode
Namhyung Kim namhyung@kernel.org perf intel-pt: Do not try to queue auxtrace data on pipe
Namhyung Kim namhyung@kernel.org perf inject: Use perf_data__read() for auxtrace
Andreas Ziegler br015@umbiko.net tools/tracing/rtla: osnoise_hist: use total duration for average calculation
Henning Schild henning.schild@siemens.com leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver
Andy Shevchenko andriy.shevchenko@linux.intel.com leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest()
Miaoqian Lin linmq006@gmail.com leds: led-core: Fix refcount leak in of_led_get()
Ian Rogers irogers@google.com perf llvm: Fix inadvertent file creation
Andreas Gruenbacher agruenba@redhat.com gfs2: jdata writepage fix
Shyam Prasad N sprasad@microsoft.com cifs: use tcon allocation functions even for dummy tcon
Zhang Xiaoxu zhangxiaoxu5@huawei.com cifs: Fix warning and UAF when destroy the MR list
Zhang Xiaoxu zhangxiaoxu5@huawei.com cifs: Fix lost destroy smbd connection when MR allocate failed
Chuck Lever chuck.lever@oracle.com NFSD: copy the whole verifier in nfsd_copy_write_verifier
Jeff Layton jlayton@kernel.org nfsd: don't fsync nfsd_files on last close
Jeff Layton jlayton@kernel.org nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open
Dai Ngo dai.ngo@oracle.com NFSD: fix problems with cleanup on errors in nfsd4_copy
Jeff Layton jlayton@kernel.org nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
Benjamin Coddington bcodding@redhat.com nfsd: fix race to check ls_layouts
Dai Ngo dai.ngo@oracle.com NFSD: fix leaked reference count of nfsd4_ssc_umount_item
Dai Ngo dai.ngo@oracle.com NFSD: enhance inter-server copy cleanup
Asahi Lina lina@asahilina.net drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()
Orlando Chamberlain orlandoch.dev@gmail.com ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks
Pietro Borrello borrello@diag.uniroma1.it hid: bigben_probe(): validate report count
Pietro Borrello borrello@diag.uniroma1.it HID: bigben: use spinlock to safely schedule workers
Pietro Borrello borrello@diag.uniroma1.it HID: bigben_worker() remove unneeded check on report_field
Pietro Borrello borrello@diag.uniroma1.it HID: bigben: use spinlock to protect concurrent accesses
Lucas Tanure lucas.tanure@collabora.com ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
Christophe JAILLET christophe.jaillet@wanadoo.fr spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
Lucas De Marchi lucas.demarchi@intel.com drm/i915: Fix GEN8_MISCCPCTL
Matt Roper matthew.d.roper@intel.com drm/i915/pvc: Annotate two more workaround/tuning registers as MCR
Wayne Boyer wayne.boyer@intel.com drm/i915/pvc: Implement recommended caching policy
NeilBrown neilb@suse.de NFS: fix disabling of swap
Benjamin Coddington bcodding@redhat.com nfs4trace: fix state manager flag printing
Mike Snitzer snitzer@kernel.org dm: remove flush_scheduled_work() during local_exit()
Steffen Aschbacher steffen.aschbacher@stihl.de ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
Vadim Pasternak vadimp@nvidia.com hwmon: (mlxreg-fan) Return zero speed for broken fan
William Zhang william.zhang@broadcom.com spi: bcm63xx-hsspi: Fix multi-bit mode setting
Bastien Nocera hadess@hadess.net HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support
Hamza Mahfooz hamza.mahfooz@amd.com drm/amd/display: don't call dc_interrupt_set() for disabled crtcs
William Zhang william.zhang@broadcom.com spi: bcm63xx-hsspi: Endianness fix for ARM based SoC
Srinivas Kandagatla srinivas.kandagatla@linaro.org ASoC: codecs: lpass: fix incorrect mclk rate
Srinivas Kandagatla srinivas.kandagatla@linaro.org ASoC: codecs: lpass: register mclk after runtime pm
Srinivas Kandagatla srinivas.kandagatla@linaro.org ASoC: qcom: q6apm-dai: Add SNDRV_PCM_INFO_BATCH flag
Srinivas Kandagatla srinivas.kandagatla@linaro.org ASoC: qcom: q6apm-dai: fix race condition while updating the position pointer
Srinivas Kandagatla srinivas.kandagatla@linaro.org ASoC: qcom: q6apm-lpass-dai: unprepare stream if its already prepared
Dmitry Torokhov dmitry.torokhov@gmail.com HID: retain initial quirks set up when creating HID devices
Allen Ballway ballway@chromium.org HID: multitouch: Add quirks for flipped axes
Jiasheng Jiang jiasheng@iscas.ac.cn scsi: aic94xx: Add missing check for dma_map_single()
Tomas Henzl thenzl@redhat.com scsi: mpt3sas: Fix a memory leak
Arnd Bergmann arnd@arndb.de drm/amdgpu: fix enum odm_combine_mode mismatch
Jaroslav Kysela perex@perex.cz ALSA: hda: Fix the control element identification for multiple codecs
Jonathan Cormier jcormier@criticallink.com hwmon: (ltc2945) Handle error case in ltc2945_value_store
Eugene Shalygin eugene.shalygin@gmail.com hwmon: (asus-ec-sensors) add missing mutex path
Jerome Neanne jneanne@baylibre.com regulator: tps65219: use generic set_bypass()
Jerome Brunet jbrunet@baylibre.com ASoC: dt-bindings: meson: fix gx-card codec node regex
Nathan Chancellor nathan@kernel.org ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
Kuninori Morimoto kuninori.morimoto.gx@renesas.com ASoC: rsnd: fixup #endif position
Arnd Bergmann arnd@arndb.de accel: fix CONFIG_DRM dependencies
Daniel Golle daniel@makrotopia.org regmap: apply reg_base and reg_downshift for single register ops
Mike Snitzer snitzer@kernel.org dm: improve shrinker debug names
Claudiu Beznea claudiu.beznea@microchip.com ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
Claudiu Beznea claudiu.beznea@microchip.com ASoC: mchp-spdifrx: fix controls that works with completion mechanism
Claudiu Beznea claudiu.beznea@microchip.com ASoC: mchp-spdifrx: fix return value in case completion times out
Claudiu Beznea claudiu.beznea@microchip.com ASoC: mchp-spdifrx: fix controls which rely on rsr register
Arnd Bergmann arnd@arndb.de spi: dw_bt1: fix MUX_MMIO dependencies
Amadeusz Sławiński amadeuszx.slawinski@linux.intel.com ASoC: topology: Properly access value coming from topology file
Haibo Chen haibo.chen@nxp.com gpio: vf610: connect GPIO label to dev name
Bartosz Golaszewski bartosz.golaszewski@linaro.org gpio: pca9570: rename platform_data to chip_data
Allen-KH Cheng allen-kh.cheng@mediatek.com dt-bindings: display: mediatek: Fix the fallback for mediatek,mt8186-disp-ccorr
Kuninori Morimoto kuninori.morimoto.gx@renesas.com ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
Nícolas F. R. A. Prado nfraprado@collabora.com drm/mediatek: Clean dangling pointer on bind error path
ruanjinjie ruanjinjie@huawei.com drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
Rob Clark robdclark@chromium.org drm/mediatek: Drop unbalanced obj unref
Miles Chen miles.chen@mediatek.com drm/mediatek: Use NULL instead of 0 for NULL pointer
Xinlei Lee xinlei.lee@mediatek.com drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/msm/dpu: set pdpu->is_rt_pipe early in dpu_plane_sspp_atomic_update()
Matt Roper matthew.d.roper@intel.com drm/i915/xehp: Annotate a couple more workaround registers as MCR
Lad Prabhakar prabhakar.mahadev-lad.rj@bp.renesas.com pinctrl: renesas: rzg2l: Fix configuring the GPIO pins as interrupts
Matt Roper matthew.d.roper@intel.com drm/i915/xehp: GAM registers don't need to be re-applied on engine resets
Matt Roper matthew.d.roper@intel.com drm/i915/mtl: Add initial gt workarounds
Mikko Perttunen mperttunen@nvidia.com drm/tegra: firewall: Check for is_addr_reg existence in IMM check
Mikko Perttunen mperttunen@nvidia.com gpu: host1x: Don't skip assigning syncpoints to channels
Mikko Perttunen mperttunen@nvidia.com gpu: host1x: Fix mask for syncpoint increment register
Guodong Liu Guodong.Liu@mediatek.com pinctrl: mediatek: Initialize variable *buf to zero
Guodong Liu Guodong.Liu@mediatek.com pinctrl: mediatek: Initialize variable pullen and pullup to zero
Andy Shevchenko andriy.shevchenko@linux.intel.com pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
farah kassabri fkassabri@habana.ai habanalabs: bugs fixes in timestamps buff alloc
Jiasheng Jiang jiasheng@iscas.ac.cn drm/msm/mdp5: Add check for kzalloc
Jiasheng Jiang jiasheng@iscas.ac.cn drm/msm/dpu: Add check for pstates
Jiasheng Jiang jiasheng@iscas.ac.cn drm/msm/dpu: Add check for cstate
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/msm: use strscpy instead of strncpy
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/msm/dpu: sc7180: add missing WB2 clock control
Bart Van Assche bvanassche@acm.org scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096
Konrad Dybcio konrad.dybcio@linaro.org drm/msm/dsi: Allow 2 CTRLs on v2.5.0
Jagan Teki jagan@amarulasolutions.com drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags
Daniel Mentz danielmentz@google.com drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
Randy Dunlap rdunlap@infradead.org regulator: tps65219: use IS_ERR() to detect an error pointer
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/bridge: lt9611: pass a pointer to the of node
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/bridge: lt9611: fix clock calculation
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/bridge: lt9611: fix programming of video modes
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/bridge: lt9611: fix polarity programming
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/bridge: lt9611: fix HPD reenablement
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/bridge: lt9611: fix sleep mode setup
Marijn Suijten marijn.suijten@somainline.org drm/msm/dpu: Disallow unallocated resources to be returned
Jiasheng Jiang jiasheng@iscas.ac.cn drm/msm/gem: Add check for kmalloc
Leo Liu leo.liu@amd.com drm/amdgpu: Use the sched from entity for amdgpu_cs trace
Alexey V. Vissarionov gremlin@altlinux.org ALSA: hda/ca0132: minor fix for allocation size
Akhil P Oommen quic_akhilpo@quicinc.com drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
Marek Vasut marex@denx.de drm/bridge: tc358767: Set default CLRSIPO count
Shengjiu Wang shengjiu.wang@nxp.com ASoC: fsl_sai: initialize is_dsp_mode flag
Quinn Tran qutran@marvell.com scsi: qla2xxx: edif: Fix clang warning
Quinn Tran qutran@marvell.com scsi: qla2xxx: Fix exchange oversubscription for management commands
Quinn Tran qutran@marvell.com scsi: qla2xxx: Fix exchange oversubscription
Abel Vesa abel.vesa@linaro.org drm/panel-edp: fix name for IVO product id 854b
Dmitry Baryshkov dmitry.baryshkov@linaro.org drm/msm: clean event_thread->worker in case of an error
Dave Stevenson dave.stevenson@raspberrypi.com drm/vc4: hdmi: Correct interlaced timings again
Dave Stevenson dave.stevenson@raspberrypi.com drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
Dave Stevenson dave.stevenson@raspberrypi.com drm/vc4: hvs: Correct interrupt masking bit assignment for HVS5
Dave Stevenson dave.stevenson@raspberrypi.com drm/vc4: hvs: SCALER_DISPBKGND_AUTOHS is only valid on HVS4
Dave Stevenson dave.stevenson@raspberrypi.com drm/vc4: hvs: Set AXI panic modes
Dave Stevenson dave.stevenson@raspberrypi.com drm/vc4: hvs: Configure the HVS COB allocations
Miaoqian Lin linmq006@gmail.com pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
Miaoqian Lin linmq006@gmail.com pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
Adam Skladowski a39.skl@gmail.com pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
Jiasheng Jiang jiasheng@iscas.ac.cn drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
Hui Tang tanghui20@huawei.com drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()
Armin Wolf W_Armin@gmx.de hwmon: (ftsteutates) Fix scaling of measurements
Maíra Canal mcanal@igalia.com drm/vc4: drop all currently held locks if deadlock happens
Thomas Zimmermann tzimmermann@suse.de drm/ast: Init iosys_map pointer as I/O memory for damage handling
Liang He windhl@126.com gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
Randolph Sapp rs@ti.com drm: tidss: Fix pixel format definition
Pin-yen Lin treapking@chromium.org drm/bridge: it6505: Guard bridge power in IRQ handler
Dave Stevenson dave.stevenson@raspberrypi.com drm/vc4: dpi: Fix format mapping for RGB565
Maxime Ripard maxime@cerno.tech drm/modes: Use strscpy() to copy command-line mode name
Yuan Can yuancan@huawei.com drm/vkms: Fix null-ptr-deref in vkms_release()
Yuan Can yuancan@huawei.com drm/vkms: Fix memory leak in vkms_init()
Yuan Can yuancan@huawei.com drm/bridge: megachips: Fix error handling in i2c_register_driver()
Geert Uytterhoeven geert+renesas@glider.be drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
Geert Uytterhoeven geert+renesas@glider.be drm: mxsfb: DRM_IMX_LCDIF should depend on ARCH_MXC
Frieder Schrempf frieder.schrempf@kontron.de drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match spec
Geert Uytterhoeven geert@linux-m68k.org drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
Shang XiaoJing shangxiaojing@huawei.com drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
Jiri Pirko jiri@nvidia.com sefltests: netdevsim: wait for devlink instance after netns removal
Roxana Nicolescu roxana.nicolescu@canonical.com selftest: fib_tests: Always cleanup before exit
Leon Romanovsky leon@kernel.org net/mlx5e: Align IPsec ASO result memory to be as required by hardware
Kees Cook keescook@chromium.org net/mlx4_en: Introduce flexible array to silence overflow warning
Horatiu Vultur horatiu.vultur@microchip.com net: lan966x: Fix possible deadlock inside PTP
Doug Berger opendmb@gmail.com net: bcmgenet: fix MoCA LED control
Shigeru Yoshida syoshida@redhat.com l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
Jakub Sitnicki jakub@cloudflare.com selftests/net: Interpret UDP_GRO cmsg data as an int value
D. Wythe alibuda@linux.alibaba.com net/smc: fix application data exception
D. Wythe alibuda@linux.alibaba.com net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
Florian Fainelli f.fainelli@gmail.com irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
Florian Fainelli f.fainelli@gmail.com irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
Andrii Nakryiko andrii@kernel.org bpf: Fix global subprog context argument resolution logic
Hengqi Chen hengqi.chen@gmail.com LoongArch, bpf: Use 4 instructions for function address in JIT
Maciej Fijalkowski maciej.fijalkowski@intel.com xsk: check IFF_UP earlier in Tx path
Frank Jungclaus frank.jungclaus@esd.eu can: esd_usb: Make use of can_change_state() and relocate checking skb for NULL
Frank Jungclaus frank.jungclaus@esd.eu can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
Ilya Leoshkevich iii@linux.ibm.com selftests/bpf: Fix xdp_do_redirect on s390x
Hou Tao houtao1@huawei.com bpf: Zeroing allocated object from slab in bpf memory allocator
Johannes Berg johannes.berg@intel.com wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta()
Alexei Starovoitov ast@kernel.org selftests/bpf: Fix map_kptr test.
Yongqin Liu yongqin.liu@linaro.org thermal/drivers/hisi: Drop second sensor hi3660
Vincent Guittot vincent.guittot@linaro.org tools/lib/thermal: Fix thermal_sampling_exit()
Johannes Berg johannes.berg@intel.com wifi: mac80211: fix off-by-one link setting
Arnd Bergmann arnd@arndb.de wifi: mac80211: avoid u32_encode_bits() warning
Andrei Otcheretianski andrei.otcheretianski@intel.com wifi: mac80211: Don't translate MLD addresses for multicast
Karthikeyan Periyasamy quic_periyasa@quicinc.com wifi: mac80211: fix non-MLO station association
Shayne Chen shayne.chen@mediatek.com wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
Lorenzo Bianconi lorenzo@kernel.org wifi: mac80211: move color collision detection report in a delayed work
Eric Farman farman@linux.ibm.com vfio/ccw: remove WARN_ON during shutdown
Herbert Xu herbert@gondor.apana.org.au crypto: crypto4xx - Call dma_unmap_page when done
Alexander Lobakin alobakin@pm.me crypto: octeontx2 - Fix objects shared between several modules
Werner Sembach wse@tuxedocomputers.com ACPI: resource: Do IRQ override on all TongFang GMxRGxx
Adam Niederer adam.niederer@gmail.com ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models
Ilya Leoshkevich iii@linux.ibm.com selftests/bpf: Fix out-of-srctree build
Zong-Zhe Yang kevin_yang@realtek.com wifi: rtw89: fix parsing offset for MCC C2H
Dan Carpenter error27@gmail.com wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
Hector Martin marcan@marcan.st wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection
Hector Martin marcan@marcan.st wifi: brcmfmac: pcie: Add IDs/properties for BCM4377
Hector Martin marcan@marcan.st wifi: brcmfmac: pcie: Add IDs/properties for BCM4355
Hector Martin marcan@marcan.st wifi: brcmfmac: Rename Cypress 89459 to BCM4355
Jiasheng Jiang jiasheng@iscas.ac.cn wifi: iwl4965: Add missing check for create_singlethread_workqueue()
Jiasheng Jiang jiasheng@iscas.ac.cn wifi: iwl3945: Add missing check for create_singlethread_workqueue
Matt Evans mev@rivosinc.com clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first use
Conor Dooley conor.dooley@microchip.com RISC-V: time: initialize hrtimer based broadcast clock event device
Randy Dunlap rdunlap@infradead.org m68k: /proc/hardware should depend on PROC_FS
Herbert Xu herbert@gondor.apana.org.au crypto: rsa-pkcs1pad - Use akcipher_request_complete
Pietro Borrello borrello@diag.uniroma1.it rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
Oleksandr Tyshchenko oleksandr_tyshchenko@epam.com xen/grant-dma-iommu: Implement a dummy probe_device() callback
Ilya Leoshkevich iii@linux.ibm.com libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
Halil Pasic pasic@linux.ibm.com s390/ap: fix status returned by ap_qact()
Halil Pasic pasic@linux.ibm.com s390/ap: fix status returned by ap_aqic()
Halil Pasic pasic@linux.ibm.com s390: vfio-ap: tighten the NIB validity check
Alex Elder elder@linaro.org net: ipa: generic command param fix
Zhengping Jiang jiangzp@google.com Bluetooth: hci_qca: get wakeup status from serdev device handle
Luiz Augusto von Dentz luiz.von.dentz@intel.com Bluetooth: L2CAP: Fix potential user-after-free
Kees Cook keescook@chromium.org Bluetooth: hci_conn: Refactor hci_bind_bis() since it always succeeds
Uwe Kleine-König u.kleine-koenig@pengutronix.de cpufreq: davinci: Fix clk use after free
Qi Zheng zhengqi.arch@bytedance.com OPP: fix error checking in opp_migrate_dentry()
David Howells dhowells@redhat.com rxrpc: Fix overwaking on call poking
Pietro Borrello borrello@diag.uniroma1.it tap: tap_open(): correctly initialize socket uid
Pietro Borrello borrello@diag.uniroma1.it tun: tun_chr_open(): correctly initialize socket uid
Pietro Borrello borrello@diag.uniroma1.it net: add sock_init_data_uid()
Vasily Gorbik gor@linux.ibm.com s390/boot: fix mem_detect extended area allocation
Vasily Gorbik gor@linux.ibm.com s390/mem_detect: rely on diag260() if sclp_early_get_memsize() fails
Alexander Gordeev agordeev@linux.ibm.com s390/boot: cleanup decompressor header files
Vasily Gorbik gor@linux.ibm.com s390/vmem: fix empty page tables cleanup under KASAN
Vasily Gorbik gor@linux.ibm.com s390/mem_detect: fix detect_memory() error handling
Miaoqian Lin linmq006@gmail.com irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
Miaoqian Lin linmq006@gmail.com irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
Miaoqian Lin linmq006@gmail.com irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
Miaoqian Lin linmq006@gmail.com irqchip: Fix refcount leak in platform_irqchip_probe
Jack Morgenstein jackm@nvidia.com net/mlx5: Enhance debug print in page allocation failure
Lorenzo Bianconi lorenzo@kernel.org wifi: mt76: mt7996: rely on mt76_connac2_mac_tx_rate_val
Aaron Ma aaron.ma@canonical.com wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read
Deren Wu deren.wu@mediatek.com wifi: mt76: add memory barrier to SDIO queue kick
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7915: fix WED TxS reporting
Lorenzo Bianconi lorenzo@kernel.org wifi: mt76: fix switch default case in mt7996_reverse_frag0_hdr_trans
Lorenzo Bianconi lorenzo@kernel.org wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup
Lorenzo Bianconi lorenzo@kernel.org wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit
Lorenzo Bianconi lorenzo@kernel.org wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit
Deren Wu deren.wu@mediatek.com wifi: mt76: mt7921: fix invalid remain_on_channel duration
Shayne Chen shayne.chen@mediatek.com wifi: mt76: connac: fix POWER_CTRL command name typo
Shayne Chen shayne.chen@mediatek.com wifi: mt76: mt7996: update register for CFEND_RATE
Shayne Chen shayne.chen@mediatek.com wifi: mt76: mt7996: fix chainmask calculation in mt7996_set_antenna()
Deren Wu deren.wu@mediatek.com wifi: mt76: mt7921: fix channel switch fail in monitor mode
Howard Hsu howard-yh.hsu@mediatek.com wifi: mt76: mt7915: rework mt7915_thermal_temp_store()
Howard Hsu howard-yh.hsu@mediatek.com wifi: mt76: mt7915: rework mt7915_mcu_set_thermal_throttling
Howard Hsu howard-yh.hsu@mediatek.com wifi: mt76: mt7915: call mt7915_mcu_set_thermal_throttling() only after init_work
Felix Fietkau nbd@nbd.name wifi: mt76: mt7921: fix deadlock in mt7921_abort_roc
Tonghao Zhang tong@infragraf.org bpftool: profile online CPUs instead of possible
Tom Lendacky thomas.lendacky@amd.com crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
Ilya Leoshkevich iii@linux.ibm.com selftests/bpf: Initialize tc in xdp_synproxy
Geert Uytterhoeven geert+renesas@glider.be can: rcar_canfd: Fix R-Car V3U GAFLCFG field accesses
Geert Uytterhoeven geert+renesas@glider.be can: rcar_canfd: Fix R-Car V3U CAN mode selection
Mark Brown broonie@kernel.org kselftest/arm64: Fix enumeration of systems without 128 bit SME
Gregory Greenman gregory.greenman@intel.com wifi: iwlwifi: mei: fix compilation errors in rfkill()
Ilya Leoshkevich iii@linux.ibm.com s390/bpf: Add expoline to tail calls
Kees Cook keescook@chromium.org drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size
Hans de Goede hdegoede@redhat.com leds: led-class: Add missing put_device() to led_put()
Herbert Xu herbert@gondor.apana.org.au crypto: xts - Handle EBUSY correctly
Daniel T. Lee danieltimlee@gmail.com selftests/bpf: Fix vmtest static compilation error
Siddharth Vadapalli s-vadapalli@ti.com net: ethernet: ti: am65-cpsw/cpts: Fix CPTS release action
Ashok Raj ashok.raj@intel.com x86/microcode: Adjust late loading result reporting message
Ashok Raj ashok.raj@intel.com x86/microcode: Check CPU capabilities after late microcode update correctly
Ashok Raj ashok.raj@intel.com x86/microcode: Add a parameter to microcode_check() to store CPU capabilities
Kumar Kartikeya Dwivedi memxor@gmail.com bpf: Fix partial dynptr stack slot reads/writes
Kumar Kartikeya Dwivedi memxor@gmail.com bpf: Fix missing var_off check for ARG_PTR_TO_DYNPTR
Kumar Kartikeya Dwivedi memxor@gmail.com bpf: Fix state pruning for STACK_DYNPTR stack slots
Yang Yingliang yangyingliang@huawei.com powercap: fix possible name leak in powercap_register_zone()
Herbert Xu herbert@gondor.apana.org.au crypto: seqiv - Handle EBUSY correctly
Herbert Xu herbert@gondor.apana.org.au crypto: essiv - Handle EBUSY correctly
Koba Ko koba.taiwan@gmail.com crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
Tiezhu Yang yangtiezhu@loongson.cn selftests/bpf: Fix build errors if CONFIG_NF_CONNTRACK=m
Armin Wolf W_Armin@gmx.de ACPI: battery: Fix missing NUL-termination with large strings
Shivani Baranwal quic_shivbara@quicinc.com wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
Miaoqian Lin linmq006@gmail.com wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
Minsuk Kang linuxlovemin@yonsei.ac.kr wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
Fedor Pchelkin pchelkin@ispras.ru wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
Fedor Pchelkin pchelkin@ispras.ru wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
Viorel Suman viorel.suman@nxp.com thermal/drivers/imx_sc_thermal: Fix the loop condition
Martin Blumenstingl martin.blumenstingl@googlemail.com wifi: rtw88: Use non-atomic sta iterator in rtw_ra_mask_info_update()
Martin Blumenstingl martin.blumenstingl@googlemail.com wifi: rtw88: Use rtw_iterate_vifs() for rtw_vif_watch_dog_iter()
Alexey Kodanev aleksei.kodanev@bell-sw.com wifi: orinoco: check return value of hermes_write_wordrec()
Bitterblue Smith rtl8821cerfe2@gmail.com wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
Jiasheng Jiang jiasheng@iscas.ac.cn wifi: rtw89: Add missing check for alloc_workqueue
Zong-Zhe Yang kevin_yang@realtek.com wifi: rtw89: fix potential leak in rtw89_append_probe_req_ie()
Dmitry Baryshkov dmitry.baryshkov@linaro.org thermal/drivers/tsens: limit num_sensors to 9 for msm8939
Dmitry Baryshkov dmitry.baryshkov@linaro.org thermal/drivers/tsens: fix slope values for msm8939
Dmitry Baryshkov dmitry.baryshkov@linaro.org thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
Dmitry Baryshkov dmitry.baryshkov@linaro.org thermal/drivers/tsens: Drop msm8976-specific defines
Christophe JAILLET christophe.jaillet@wanadoo.fr x86/signal: Fix the value returned by strict_sas_size()
Christophe JAILLET christophe.jaillet@wanadoo.fr s390/vfio-ap: fix an error handling path in vfio_ap_mdev_probe_queue()
Alexander Gordeev agordeev@linux.ibm.com s390/early: fix sclp_early_sccb variable lifetime
Lai Jiangshan jiangshan.ljs@antgroup.com workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex
Mark Brown broonie@kernel.org kselftest/arm64: Fix syscall-abi for systems without 128 bit SME
Mark Brown broonie@kernel.org arm64/sysreg: Fix errors in 32 bit enumeration values
Mark Brown broonie@kernel.org arm64/cpufeature: Fix field sign for DIT hwcap detection
Magnus Karlsson magnus.karlsson@intel.com selftests/xsk: print correct error codes when exiting
Magnus Karlsson magnus.karlsson@intel.com selftests/xsk: print correct payload for packet dump
Michal Suchanek msuchanek@suse.de bpf_doc: Fix build error with older python versions
Ludovic L'Hours ludovic.lhours@gmail.com libbpf: Fix map creation flags sanitization
Daniil Tatianin d-tatianin@yandex-team.ru ACPICA: nsrepair: handle cases without a return value correctly
Prashant Malani pmalani@chromium.org platform/chrome: cros_ec_typec: Update port DP VDO
David Rientjes rientjes@google.com crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
Herbert Xu herbert@gondor.apana.org.au lib/mpi: Fix buffer overrun when SG is too long
Frederic Weisbecker frederic@kernel.org rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
Frederic Weisbecker frederic@kernel.org rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
Frederic Weisbecker frederic@kernel.org rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
Zhen Lei thunder.leizhen@huawei.com genirq: Fix the return type of kstat_cpu_irqs_sum()
Mario Limonciello mario.limonciello@amd.com ACPICA: Drop port I/O validation for some regions
Lukas Bulwahn lukas.bulwahn@gmail.com crypto: ux500 - update debug config after ux500 cryp driver removal
Eric Biggers ebiggers@google.com crypto: x86/ghash - fix unaligned access in ghash_setkey()
Daniel T. Lee danieltimlee@gmail.com libbpf: Fix invalid return address register in s390
Yang Yingliang yangyingliang@huawei.com wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang yangyingliang@huawei.com wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang yangyingliang@huawei.com wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang yangyingliang@huawei.com wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang yangyingliang@huawei.com wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
Zhengchao Shao shaozhengchao@huawei.com wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
Zhang Changzhong zhangchangzhong@huawei.com wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
Wang Yufen wangyufen@huawei.com wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
Zhang Changzhong zhangchangzhong@huawei.com wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
Zhengchao Shao shaozhengchao@huawei.com wifi: ipw2200: fix memory leak in ipw_wdev_init()
Yang Yingliang yangyingliang@huawei.com wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
Andrii Nakryiko andrii@kernel.org libbpf: Fix btf__align_of() by taking into account field offsets
Andrii Nakryiko andrii@kernel.org libbpf: Fix single-line struct definition output in btf_dump
Li Zetao lizetao1@huawei.com wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
Ping-Ke Shih pkshih@realtek.com wifi: rtw89: 8852c: rfk: correct DPK settings
Ping-Ke Shih pkshih@realtek.com wifi: rtw89: 8852c: rfk: correct DACK setting
Yang Yingliang yangyingliang@huawei.com wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
Bitterblue Smith rtl8821cerfe2@gmail.com wifi: rtl8xxxu: Fix assignment to bit field priv->cck_agc_report_type
Bitterblue Smith rtl8821cerfe2@gmail.com wifi: rtl8xxxu: Fix assignment to bit field priv->pi_enabled
Zhengchao Shao shaozhengchao@huawei.com wifi: libertas: fix memory leak in lbs_init_adapter()
Yang Yingliang yangyingliang@huawei.com wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
Yang Yingliang yangyingliang@huawei.com wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang yangyingliang@huawei.com wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang yangyingliang@huawei.com wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
Yuan Can yuancan@huawei.com wifi: rsi: Fix memory leak in rsi_coex_attach()
Sean Wang sean.wang@mediatek.com wifi: mt76: mt7921: resource leaks at mt7921_check_offload_capability()
Deren Wu deren.wu@mediatek.com wifi: mt76: fix coverity uninit_use_in_call in mt76_connac2_reverse_frag0_hdr_trans()
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7915: fix unintended sign extension of mt7915_hw_queue_read()
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7996: fix unintended sign extension of mt7996_hw_queue_read()
Lorenzo Bianconi lorenzo@kernel.org wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
Lorenzo Bianconi lorenzo@kernel.org wifi: mt76: mt7996: fix endianness warning in mt7996_mcu_sta_he_tlv
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7996: drop always true condition of __mt7996_reg_addr()
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7915: drop always true condition of __mt7915_reg_addr()
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7996: check return value before accessing free_block_num
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7915: check return value before accessing free_block_num
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7996: fix integer handling issue of mt7996_rf_regval_set()
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_rx_radar_detected()
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_ie_countdown()
Ryder Lee ryder.lee@mediatek.com wifi: mt76: mt7915: fix mt7915_rate_txpower_get() resource leaks
Deren Wu deren.wu@mediatek.com wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host
Wang Yufen wangyufen@huawei.com wifi: mt76: mt7915: add missing of_node_put()
Jens Axboe axboe@kernel.dk block: use proper return value from bio_failfast()
Martin K. Petersen martin.petersen@oracle.com block: bio-integrity: Copy flags when bio_integrity_payload is cloned
Jinke Han hanjinke.666@bytedance.com block: Fix io statistics for cgroup in throttle path
Ming Lei ming.lei@redhat.com block: sync mixed merged request's failfast with 1st bio's
Jingbo Xu jefflexu@linux.alibaba.com erofs: relinquish volume with mutex held
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: pmk8350: Use the correct PON compatible
Liu Xiaodong xiaodong.liu@intel.com block: ublk: check IO buffer based on flag need_get_data
Denis Kenzior denkenz@gmail.com KEYS: asymmetric: Fix ECDSA use via keyctl uapi
silviazhao silviazhao-oc@zhaoxin.com x86/perf/zhaoxin: Add stepping check for ZXC
Kan Liang kan.liang@linux.intel.com perf/x86/intel/ds: Fix the conversion from TSC to perf time
Pietro Borrello borrello@diag.uniroma1.it sched/rt: pick_next_rt_entity(): check list_entry
Richard Guy Briggs rgb@redhat.com io_uring,audit: don't log IORING_OP_MADVISE
Qiheng Lin linqiheng@huawei.com s390/dasd: Fix potential memleak in dasd_eckd_init()
Petr Vorel pvorel@suse.cz arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sm6115: correct TLMM gpio-ranges
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: msm8953: correct TLMM gpio-ranges
Jamie Douglass jamiemdouglass@gmail.com arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sm8450: drop incorrect cells from serial
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sm8350: drop incorrect cells from serial
Dmitry Baryshkov dmitry.baryshkov@linaro.org arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC
Dmitry Baryshkov dmitry.baryshkov@linaro.org arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input
Kemeng Shi shikemeng@huaweicloud.com blk-mq: correct stale comment of .get_budget
Kemeng Shi shikemeng@huaweicloud.com blk-mq: Fix potential io hung for shared sbitmap per tagset
Kemeng Shi shikemeng@huaweicloud.com blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
Kemeng Shi shikemeng@huaweicloud.com blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
Kemeng Shi shikemeng@huaweicloud.com blk-mq: avoid sleep in blk_mq_alloc_request_hctx
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: sm8450-nagara: Correct firmware paths
Patrick Delaunay patrick.delaunay@foss.st.com ARM: dts: stm32: Update part number NVMEM description on stm32mp131
Allen-KH Cheng allen-kh.cheng@mediatek.com arm64: dts: mediatek: mt7986: Fix watchdog compatible
AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com arm64: dts: mediatek: mt8195: Fix watchdog compatible
AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com arm64: dts: mediatek: mt8186: Fix watchdog compatible
AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com arm64: dts: mt8186: Fix CPU map for single-cluster SoC
AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com arm64: dts: mt8192: Fix CPU map for single-cluster SoC
AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com arm64: dts: mt8195: Fix CPU map for single-cluster SoC
Kemeng Shi shikemeng@huaweicloud.com sbitmap: correct wake_batch recalculation to avoid potential IO hung
Kemeng Shi shikemeng@huaweicloud.com sbitmap: remove redundant check in __sbitmap_queue_get_batch
Peng Fan peng.fan@nxp.com ARM: dts: imx7s: correct iomuxc gpr mux controller cells
Ming Lei ming.lei@redhat.com ublk_drv: don't probe partitions if the ubq daemon isn't trusted
Ming Lei ming.lei@redhat.com ublk_drv: remove nr_aborted_queues from ublk_device
Samuel Holland samuel@sholland.org ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
Christian Hewitt christianshewitt@gmail.com arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN
Christian Hewitt christianshewitt@gmail.com arm64: dts: meson: radxa-zero: allow usb otg mode
Adam Ford aford173@gmail.com arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
Mikko Perttunen mperttunen@nvidia.com arm64: tegra: Mark host1x as dma-coherent on Tegra194/234
Thierry Reding treding@nvidia.com arm64: tegra: Sort nodes by unit-address, then alphabetically
Thierry Reding treding@nvidia.com arm64: tegra: Bump #address-cells and #size-cells
Waiman Long longman@redhat.com locking/rwsem: Disable preemption in all down_read*() and up_read() code paths
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal trip
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-g12b-odroid-go-ultra: fix rk818 pmic properties
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix invalid rtc node name
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gxl-s905w-jethome-jethub-j80: fix invalid rtc node name
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-axg-jethome-jethub-j1xx: fix supply name of USB controller node
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
Neil Armstrong neil.armstrong@linaro.org arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
Angus Chen angus.chen@jaguarmicro.com ARM: imx: Call ida_simple_remove() for ida_simple_get
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
Vaishnav Achath vaishnav.a@ti.com arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
Arnd Bergmann arnd@arndb.de ARM: s3c: fix s3c64xx_set_timer_source prototype
Stefan Wahren stefan.wahren@i2se.com ARM: bcm2835_defconfig: Enable the framebuffer
Chen-Yu Tsai wenst@chromium.org arm64: dts: mediatek: mt8192: Mark scp_adsp clock as broken
Yang Yingliang yangyingliang@huawei.com ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
Christian Hewitt christianshewitt@gmail.com arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
Robert Marko robimarko@gmail.com arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
Robert Marko robimarko@gmail.com arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
Robert Marko robimarko@gmail.com arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
Robert Marko robimarko@gmail.com arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
Robert Marko robimarko@gmail.com arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
Robert Marko robimarko@gmail.com arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
Dmitry Baryshkov dmitry.baryshkov@linaro.org arm64: dts: qcom: msm8956: use SoC-specific compat for tsens
Petr Vorel petr.vorel@gmail.com arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem
Petr Vorel petr.vorel@gmail.com arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size
Thierry Reding treding@nvidia.com arm64: tegra: Fix duplicate regulator on Jetson TX1
Dhruva Gole d-gole@ti.com arm64: dts: ti: k3-am62-main: Fix clocks for McSPI
Peter Zijlstra peterz@infradead.org cpuidle, intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE *again*
Martin Blumenstingl martin.blumenstingl@googlemail.com arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
Martin Blumenstingl martin.blumenstingl@googlemail.com arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
Martin Blumenstingl martin.blumenstingl@googlemail.com arm64: dts: meson-gx: Fix Ethernet MAC address unit name
Martin Blumenstingl martin.blumenstingl@googlemail.com arm64: dts: meson-axg: jethub-j1xx: Fix MAC address node names
Martin Blumenstingl martin.blumenstingl@googlemail.com arm64: dts: meson-gxl: jethub-j80: Fix Bluetooth MAC node name
Martin Blumenstingl martin.blumenstingl@googlemail.com arm64: dts: meson-gxl: jethub-j80: Fix WiFi MAC address node
Bjorn Andersson quic_bjorande@quicinc.com arm64: dts: qcom: sc8280xp: Vote for CX in USB controllers
Dmitry Baryshkov dmitry.baryshkov@linaro.org arm64: dts: qcom: msm8996-oneplus-common: drop vdda-supply from DSI PHY
Dmitry Baryshkov dmitry.baryshkov@linaro.org arm64: dts: qcom: sdm845: make DP node follow the schema
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sm8450: correct Soundwire wakeup interrupt name
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sc8280xp: correct SPMI bus address cells
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sc7280: correct SPMI bus address cells
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sc7180: correct SPMI bus address cells
Kishon Vijay Abraham I kvijayab@amd.com x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sdm845-xiaomi-beryllium: fix audio codec interrupt pin name
Krzysztof Kozlowski krzysztof.kozlowski@linaro.org arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
Chen-Yu Tsai wenst@chromium.org arm64: dts: mediatek: mt8186: Fix systimer 13 MHz clock description
Chen-Yu Tsai wenst@chromium.org arm64: dts: mediatek: mt8195: Fix systimer 13 MHz clock description
Chen-Yu Tsai wenst@chromium.org arm64: dts: mediatek: mt8192: Fix systimer 13 MHz clock description
Chen-Yu Tsai wenst@chromium.org arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com arm64: dts: mediatek: mt8195: Add power domain to U3PHY1 T-PHY
Yang Yingliang yangyingliang@huawei.com fs: dlm: fix return value check in dlm_memory_init()
Qiheng Lin linqiheng@huawei.com ARM: zynq: Fix refcount leak in zynq_early_slcr_init
Marek Vasut marex@denx.de arm64: dts: imx8m: Align SoC unique ID node unit address
Marijn Suijten marijn.suijten@somainline.org arm64: dts: qcom: sm6125-seine: Clean up gpio-keys (volume down)
Marijn Suijten marijn.suijten@somainline.org arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings
Marijn Suijten marijn.suijten@somainline.org arm64: dts: qcom: sm6350-lena: Flatten gpio-keys pinctrl state
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: sm8350-sagami: Add GPIO line names for PMIC GPIOs
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: sm8350-sagami: Configure SLG51000 PMIC on PDX215
Dzmitry Sankouski dsankouski@gmail.com arm64: dts: qcom: Re-enable resin on MSM8998 and SDM845 boards
Richard Acayan mailingradian@gmail.com arm64: dts: qcom: sdm670-google-sargo: keep pm660 ldo8 on
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: sm6350: Fix up the ramoops node
Marijn Suijten marijn.suijten@somainline.org arm64: dts: qcom: pmi8950: Correct rev_1250v channel label to mv
Marijn Suijten marijn.suijten@somainline.org arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of 4k
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: sm6115: Provide xo clk to rpmcc
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: sm6115: Fix UFS node
Konrad Dybcio konrad.dybcio@linaro.org arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up
Dmitry Baryshkov dmitry.baryshkov@linaro.org arm64: dts: qcom: qcs404: use symbol names for PCIe resets
Chen Hui judy.chenhui@huawei.com ARM: OMAP2+: Fix memory leak in realtime_counter_init()
Damien Le Moal damien.lemoal@opensource.wdc.com ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller"
Anders Roxell anders.roxell@linaro.org powerpc/mm: Rearrange if-else block to avoid clang warning
Vasant Hegde vasant.hegde@amd.com iommu: Attach device group to old domain in error path
Vasant Hegde vasant.hegde@amd.com iommu/amd: Improve page fault error reporting
Vasant Hegde vasant.hegde@amd.com iommu/amd: Skip attach device domain is same as new domain
Vasant Hegde vasant.hegde@amd.com iommu/amd: Fix error handling for pdev_pri_ats_enable()
Pietro Borrello borrello@diag.uniroma1.it HID: asus: use spinlock to safely schedule workers
Pietro Borrello borrello@diag.uniroma1.it HID: asus: use spinlock to protect concurrent accesses
-------------
Diffstat:
Documentation/admin-guide/cgroup-v1/memory.rst | 13 +- Documentation/admin-guide/hw-vuln/spectre.rst | 21 +- Documentation/admin-guide/kdump/gdbmacros.txt | 2 +- Documentation/bpf/instruction-set.rst | 16 +- Documentation/dev-tools/gdb-kernel-debugging.rst | 4 + .../bindings/display/mediatek/mediatek,ccorr.yaml | 2 +- .../bindings/sound/amlogic,gx-sound-card.yaml | 2 +- Documentation/hwmon/ftsteutates.rst | 4 + Documentation/virt/kvm/api.rst | 18 +- Documentation/virt/kvm/devices/vm.rst | 4 + Makefile | 4 +- arch/alpha/boot/tools/objstrip.c | 2 +- arch/alpha/kernel/traps.c | 30 +- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +- arch/arm/boot/dts/exynos4.dtsi | 2 +- arch/arm/boot/dts/exynos4210.dtsi | 1 - arch/arm/boot/dts/exynos5250.dtsi | 2 +- arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 - arch/arm/boot/dts/exynos5420.dtsi | 2 +- arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +- arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +- arch/arm/boot/dts/imx7s.dtsi | 2 +- arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +- arch/arm/boot/dts/qcom-sdx65.dtsi | 2 +- arch/arm/boot/dts/stm32mp131.dtsi | 1 + arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +- arch/arm/configs/bcm2835_defconfig | 1 + arch/arm/mach-imx/mmdc.c | 24 +- arch/arm/mach-omap1/timer.c | 2 +- arch/arm/mach-omap2/omap4-common.c | 1 + arch/arm/mach-omap2/timer.c | 1 + arch/arm/mach-s3c/s3c64xx.c | 3 +- arch/arm/mach-zynq/slcr.c | 1 + arch/arm64/Kconfig | 1 - .../dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 10 +- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 +- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- .../boot/dts/amlogic/meson-g12a-radxa-zero.dts | 1 - arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 - .../dts/amlogic/meson-g12b-odroid-go-ultra.dts | 2 +- .../boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +- arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +- .../dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- .../boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 - .../amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 6 +- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- .../boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 6 +- .../boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 +- arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 3 +- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 +- arch/arm64/boot/dts/mediatek/mt8186.dtsi | 17 +- arch/arm64/boot/dts/mediatek/mt8192.dtsi | 25 +- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 25 +- arch/arm64/boot/dts/nvidia/tegra132-norrin.dts | 16 +- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 232 +- arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts | 2564 +++++++++---------- arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi | 86 +- .../dts/nvidia/tegra186-p3509-0000+p3636-0001.dts | 1730 ++++++------- arch/arm64/boot/dts/nvidia/tegra186.dtsi | 470 ++-- arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi | 36 +- arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts | 2418 +++++++++--------- .../arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi | 2495 +++++++++---------- arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi | 36 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 1604 ++++++------ arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 66 +- arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts | 278 +-- arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi | 3 + arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 5 +- arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi | 86 +- arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts | 384 +-- arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 66 +- arch/arm64/boot/dts/nvidia/tegra210.dtsi | 310 +-- .../arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi | 70 +- .../dts/nvidia/tegra234-p3737-0000+p3701-0000.dts | 2588 ++++++++++---------- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 1895 +++++++------- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 63 +- arch/arm64/boot/dts/qcom/msm8953.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8956.dtsi | 4 + arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 48 +- .../boot/dts/qcom/msm8996-oneplus-common.dtsi | 1 - .../boot/dts/qcom/msm8996-sony-xperia-tone.dtsi | 5 +- arch/arm64/boot/dts/qcom/msm8996.dtsi | 22 +- arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts | 11 +- .../boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi | 11 +- arch/arm64/boot/dts/qcom/pmi8950.dtsi | 2 +- arch/arm64/boot/dts/qcom/pmk8350.dtsi | 2 +- arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 +- arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 +- arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 +- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 6 +- arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts | 1 + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 13 +- arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi | 11 +- arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts | 11 +- .../dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 13 +- arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 11 +- arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 - arch/arm64/boot/dts/qcom/sm6115.dtsi | 9 +- .../dts/qcom/sm6125-sony-xperia-seine-pdx201.dts | 19 +- arch/arm64/boot/dts/qcom/sm6125.dtsi | 6 +- .../dts/qcom/sm6350-sony-xperia-lena-pdx213.dts | 18 +- arch/arm64/boot/dts/qcom/sm6350.dtsi | 7 +- .../boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 7 +- .../dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts | 23 + .../dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts | 87 + .../boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi | 88 +- arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 - .../boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi | 6 +- arch/arm64/boot/dts/qcom/sm8450.dtsi | 6 +- .../boot/dts/renesas/beacon-renesom-baseboard.dtsi | 24 +- arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 6 +- .../boot/dts/ti/k3-j7200-common-proc-board.dts | 2 +- arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 +- arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 2 + arch/arm64/kernel/acpi.c | 8 +- arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/mm/copypage.c | 3 +- arch/arm64/tools/sysreg | 8 +- arch/loongarch/net/bpf_jit.c | 2 +- arch/loongarch/net/bpf_jit.h | 21 + arch/m68k/68000/entry.S | 2 + arch/m68k/Kconfig.devices | 1 + arch/m68k/coldfire/entry.S | 2 + arch/m68k/kernel/entry.S | 3 + arch/mips/boot/dts/ingenic/ci20.dts | 2 +- arch/mips/include/asm/syscall.h | 2 +- arch/powerpc/Makefile | 2 +- arch/powerpc/boot/Makefile | 14 +- arch/powerpc/mm/book3s64/radix_tlb.c | 11 +- arch/riscv/Kconfig | 2 +- arch/riscv/Makefile | 6 +- arch/riscv/include/asm/ftrace.h | 50 +- arch/riscv/include/asm/jump_label.h | 2 + arch/riscv/include/asm/pgtable.h | 2 +- arch/riscv/include/asm/thread_info.h | 1 + arch/riscv/kernel/ftrace.c | 65 +- arch/riscv/kernel/mcount-dyn.S | 42 +- arch/riscv/kernel/time.c | 3 + arch/riscv/kernel/traps.c | 5 +- arch/riscv/mm/fault.c | 10 +- arch/s390/boot/boot.h | 26 +- arch/s390/boot/decompressor.c | 1 + arch/s390/boot/decompressor.h | 26 - arch/s390/boot/kaslr.c | 6 - arch/s390/boot/mem_detect.c | 54 +- arch/s390/boot/startup.c | 21 +- arch/s390/include/asm/ap.h | 12 +- arch/s390/kernel/early.c | 1 - arch/s390/kernel/head64.S | 1 + arch/s390/kernel/idle.c | 2 +- arch/s390/kernel/ipl.c | 94 +- arch/s390/kernel/kprobes.c | 4 +- arch/s390/kernel/vdso64/Makefile | 2 +- arch/s390/kernel/vmlinux.lds.S | 1 + arch/s390/kvm/kvm-s390.c | 43 +- arch/s390/mm/dump_pagetables.c | 16 +- arch/s390/mm/extmem.c | 12 +- arch/s390/mm/fault.c | 49 +- arch/s390/mm/vmem.c | 6 +- arch/s390/net/bpf_jit_comp.c | 12 +- arch/sparc/Kconfig | 2 +- arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +- arch/x86/events/intel/ds.c | 35 +- arch/x86/events/intel/uncore.c | 7 + arch/x86/events/intel/uncore.h | 1 + arch/x86/events/intel/uncore_snb.c | 161 ++ arch/x86/events/zhaoxin/core.c | 8 +- arch/x86/include/asm/fpu/sched.h | 2 +- arch/x86/include/asm/fpu/xcr.h | 4 +- arch/x86/include/asm/microcode.h | 4 +- arch/x86/include/asm/microcode_amd.h | 4 +- arch/x86/include/asm/msr-index.h | 4 + arch/x86/include/asm/processor.h | 3 +- arch/x86/include/asm/reboot.h | 2 + arch/x86/include/asm/special_insns.h | 2 +- arch/x86/include/asm/virtext.h | 16 +- arch/x86/kernel/acpi/boot.c | 19 +- arch/x86/kernel/cpu/bugs.c | 35 +- arch/x86/kernel/cpu/common.c | 45 +- arch/x86/kernel/cpu/microcode/amd.c | 55 +- arch/x86/kernel/cpu/microcode/core.c | 26 +- arch/x86/kernel/crash.c | 17 +- arch/x86/kernel/fpu/context.h | 2 +- arch/x86/kernel/fpu/core.c | 6 +- arch/x86/kernel/kprobes/opt.c | 6 +- arch/x86/kernel/reboot.c | 88 +- arch/x86/kernel/signal.c | 2 +- arch/x86/kernel/smp.c | 6 +- arch/x86/kvm/lapic.c | 38 +- arch/x86/kvm/svm/avic.c | 53 +- arch/x86/kvm/svm/sev.c | 4 +- arch/x86/kvm/svm/svm.c | 2 +- arch/x86/kvm/svm/svm.h | 2 +- arch/x86/kvm/svm/svm_onhyperv.h | 4 +- arch/x86/kvm/vmx/hyperv.h | 11 - arch/x86/kvm/vmx/vmx.c | 9 +- block/bio-integrity.c | 1 + block/bio.c | 1 + block/blk-cgroup.c | 39 +- block/blk-core.c | 33 +- block/blk-iocost.c | 11 +- block/blk-merge.c | 35 +- block/blk-mq-sched.c | 7 +- block/blk-mq.c | 15 +- block/fops.c | 21 +- crypto/asymmetric_keys/public_key.c | 24 +- crypto/essiv.c | 7 +- crypto/rsa-pkcs1pad.c | 34 +- crypto/seqiv.c | 2 +- crypto/xts.c | 8 +- drivers/accel/Kconfig | 5 +- drivers/acpi/acpica/Makefile | 2 +- drivers/acpi/acpica/hwvalid.c | 7 +- drivers/acpi/acpica/nsrepair.c | 12 +- drivers/acpi/battery.c | 2 +- drivers/acpi/resource.c | 26 +- drivers/acpi/video_detect.c | 2 +- drivers/ata/ahci.c | 1 - drivers/base/core.c | 452 ++-- drivers/base/physical_location.c | 5 +- drivers/base/platform-msi.c | 1 + drivers/base/power/domain.c | 5 +- drivers/base/regmap/regmap.c | 6 + drivers/base/transport_class.c | 17 +- drivers/block/brd.c | 67 +- drivers/block/rbd.c | 20 +- drivers/block/ublk_drv.c | 23 +- drivers/bluetooth/btusb.c | 16 + drivers/bluetooth/hci_qca.c | 7 +- drivers/bus/mhi/ep/main.c | 35 +- drivers/char/applicom.c | 5 +- drivers/char/ipmi/ipmi_ipmb.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 104 +- drivers/char/pcmcia/cm4000_cs.c | 6 +- drivers/clocksource/timer-riscv.c | 10 +- drivers/cpufreq/davinci-cpufreq.c | 4 +- drivers/cpuidle/Kconfig.arm | 2 + drivers/crypto/amcc/crypto4xx_core.c | 10 +- drivers/crypto/ccp/ccp-dmaengine.c | 21 +- drivers/crypto/ccp/sev-dev.c | 15 +- drivers/crypto/hisilicon/sgl.c | 3 +- drivers/crypto/marvell/octeontx2/Makefile | 11 +- drivers/crypto/marvell/octeontx2/cn10k_cpt.c | 9 +- drivers/crypto/marvell/octeontx2/cn10k_cpt.h | 2 - drivers/crypto/marvell/octeontx2/otx2_cpt_common.h | 2 - .../marvell/octeontx2/otx2_cpt_mbox_common.c | 14 +- drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 11 + drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c | 2 + drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 2 + drivers/crypto/qat/qat_common/qat_algs.c | 2 +- drivers/crypto/ux500/Kconfig | 7 +- drivers/cxl/pmem.c | 1 + drivers/dax/bus.c | 2 +- drivers/dax/kmem.c | 4 +- drivers/dma/Kconfig | 2 +- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 - drivers/dma/dw-edma/dw-edma-core.c | 4 + drivers/dma/dw-edma/dw-edma-v0-core.c | 2 +- drivers/dma/idxd/device.c | 2 +- drivers/dma/idxd/init.c | 2 +- drivers/dma/idxd/sysfs.c | 4 +- drivers/dma/ptdma/ptdma-dmaengine.c | 2 +- drivers/dma/sf-pdma/sf-pdma.c | 3 +- drivers/dma/sf-pdma/sf-pdma.h | 1 - drivers/firmware/dmi-sysfs.c | 10 +- drivers/firmware/google/framebuffer-coreboot.c | 4 +- drivers/firmware/psci/psci.c | 31 +- drivers/firmware/stratix10-svc.c | 25 +- drivers/fpga/microchip-spi.c | 123 +- drivers/gpio/gpio-pca9570.c | 24 +- drivers/gpio/gpio-vf610.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 12 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 4 +- drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c | 5 + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 9 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 13 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 7 + .../drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c | 3 + drivers/gpu/drm/amd/display/dc/core/dc.c | 16 + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 6 - drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 14 +- drivers/gpu/drm/amd/display/dc/dc.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 1 - drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h | 3 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c | 9 + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h | 2 + .../display/dc/dcn314/dcn314_dio_stream_encoder.c | 6 +- .../drm/amd/display/dc/dcn314/dcn314_resource.c | 4 +- .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 +- .../display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +- .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 +- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 8 + .../gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 2 +- .../amd/display/dc/gpio/dcn20/hw_factory_dcn20.c | 6 +- .../amd/display/dc/gpio/dcn30/hw_factory_dcn30.c | 6 +- .../amd/display/dc/gpio/dcn32/hw_factory_dcn32.c | 6 +- drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h | 7 + .../drm/amd/display/dc/inc/hw/timing_generator.h | 1 + drivers/gpu/drm/amd/include/amd_shared.h | 1 + drivers/gpu/drm/ast/ast_mode.c | 2 +- drivers/gpu/drm/bridge/ite-it6505.c | 22 +- drivers/gpu/drm/bridge/lontium-lt9611.c | 65 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +- drivers/gpu/drm/bridge/tc358767.c | 8 +- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +- drivers/gpu/drm/drm_client.c | 5 + drivers/gpu/drm/drm_edid.c | 43 +- drivers/gpu/drm/drm_fbdev_generic.c | 5 - drivers/gpu/drm/drm_fourcc.c | 4 + drivers/gpu/drm/drm_gem_shmem_helper.c | 52 +- drivers/gpu/drm/drm_mipi_dsi.c | 52 + drivers/gpu/drm/drm_mode_config.c | 8 +- drivers/gpu/drm/drm_modes.c | 2 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 39 +- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 +- drivers/gpu/drm/gud/gud_pipe.c | 4 +- drivers/gpu/drm/i915/display/intel_quirks.c | 2 + drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 +- .../gpu/drm/i915/gt/intel_execlists_submission.c | 6 +- drivers/gpu/drm/i915/gt/intel_gt_mcr.c | 11 +- drivers/gpu/drm/i915/gt/intel_gt_regs.h | 25 +- drivers/gpu/drm/i915/gt/intel_ring.c | 6 +- drivers/gpu/drm/i915/gt/intel_workarounds.c | 199 +- drivers/gpu/drm/i915/gt/uc/intel_guc.c | 9 +- drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c | 5 +- drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 8 +- drivers/gpu/drm/i915/i915_drv.h | 4 + drivers/gpu/drm/i915/intel_device_info.c | 6 + drivers/gpu/drm/i915/intel_pm.c | 10 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 4 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 +- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 7 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 5 + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 15 +- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 + drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c | 2 + drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 +- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 3 + drivers/gpu/drm/msm/hdmi/hdmi.c | 4 + drivers/gpu/drm/msm/msm_drv.c | 2 +- drivers/gpu/drm/msm/msm_fence.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 4 + drivers/gpu/drm/mxsfb/Kconfig | 2 + drivers/gpu/drm/nouveau/include/nvif/outp.h | 3 +- drivers/gpu/drm/nouveau/nvif/outp.c | 2 +- drivers/gpu/drm/omapdrm/dss/dsi.c | 26 +- drivers/gpu/drm/panel/panel-edp.c | 2 +- drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c | 4 +- drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c | 3 +- drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 - drivers/gpu/drm/radeon/atombios_encoders.c | 5 +- drivers/gpu/drm/radeon/radeon_device.c | 1 + drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 31 +- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 49 + drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 + drivers/gpu/drm/rcar-du/rcar_du_regs.h | 8 +- drivers/gpu/drm/tegra/firewall.c | 3 + drivers/gpu/drm/tidss/tidss_dispc.c | 4 +- drivers/gpu/drm/tiny/ili9486.c | 13 +- drivers/gpu/drm/vc4/vc4_dpi.c | 2 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 16 +- drivers/gpu/drm/vc4/vc4_hvs.c | 129 +- drivers/gpu/drm/vc4/vc4_plane.c | 2 + drivers/gpu/drm/vc4/vc4_regs.h | 17 +- drivers/gpu/drm/vkms/vkms_drv.c | 10 +- drivers/gpu/host1x/hw/hw_host1x06_uclass.h | 2 +- drivers/gpu/host1x/hw/hw_host1x07_uclass.h | 2 +- drivers/gpu/host1x/hw/hw_host1x08_uclass.h | 2 +- drivers/gpu/host1x/hw/syncpt_hw.c | 3 - drivers/gpu/ipu-v3/ipu-common.c | 1 + drivers/hid/hid-asus.c | 37 +- drivers/hid/hid-bigbenff.c | 75 +- drivers/hid/hid-debug.c | 1 + drivers/hid/hid-ids.h | 2 + drivers/hid/hid-input.c | 12 + drivers/hid/hid-logitech-hidpp.c | 49 +- drivers/hid/hid-multitouch.c | 39 +- drivers/hid/hid-quirks.c | 2 +- drivers/hid/hid-uclogic-core.c | 26 +- drivers/hid/hid-uclogic-params.c | 14 + drivers/hid/hid-uclogic-params.h | 24 + drivers/hid/i2c-hid/i2c-hid-core.c | 6 +- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 42 + drivers/hid/i2c-hid/i2c-hid.h | 3 + drivers/hwmon/Kconfig | 2 +- drivers/hwmon/asus-ec-sensors.c | 1 + drivers/hwmon/coretemp.c | 128 +- drivers/hwmon/ftsteutates.c | 19 +- drivers/hwmon/ltc2945.c | 2 + drivers/hwmon/mlxreg-fan.c | 6 + drivers/hwmon/nct6775-core.c | 2 +- drivers/hwmon/nct6775-platform.c | 150 +- drivers/hwmon/peci/cputemp.c | 2 +- drivers/hwtracing/coresight/coresight-cti-core.c | 11 +- drivers/hwtracing/coresight/coresight-cti-sysfs.c | 13 +- drivers/hwtracing/coresight/coresight-etm4x-core.c | 18 +- drivers/hwtracing/ptt/hisi_ptt.c | 10 + drivers/i2c/busses/i2c-designware-common.c | 2 +- drivers/i2c/busses/i2c-designware-core.h | 2 +- drivers/i2c/busses/i2c-qcom-geni.c | 2 +- drivers/idle/intel_idle.c | 8 +- drivers/iio/light/tsl2563.c | 8 +- drivers/infiniband/hw/cxgb4/cm.c | 7 + drivers/infiniband/hw/cxgb4/restrack.c | 2 +- drivers/infiniband/hw/erdma/erdma_verbs.c | 4 +- drivers/infiniband/hw/hfi1/sdma.c | 4 +- drivers/infiniband/hw/hfi1/sdma.h | 15 +- drivers/infiniband/hw/hfi1/user_pages.c | 61 +- drivers/infiniband/hw/hns/hns_roce_main.c | 5 +- drivers/infiniband/hw/irdma/hw.c | 2 + drivers/infiniband/hw/mana/main.c | 22 +- drivers/infiniband/sw/rxe/rxe.h | 38 + drivers/infiniband/sw/rxe/rxe_loc.h | 12 +- drivers/infiniband/sw/rxe/rxe_mr.c | 604 +++-- drivers/infiniband/sw/rxe/rxe_queue.h | 108 +- drivers/infiniband/sw/rxe/rxe_resp.c | 202 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 56 +- drivers/infiniband/sw/rxe/rxe_verbs.h | 32 +- drivers/infiniband/sw/siw/siw_mem.c | 23 +- drivers/input/touchscreen/exc3000.c | 10 + drivers/iommu/amd/init.c | 16 +- drivers/iommu/amd/iommu.c | 41 +- drivers/iommu/exynos-iommu.c | 2 +- drivers/iommu/intel/iommu.c | 26 +- drivers/iommu/intel/pasid.c | 18 + drivers/iommu/iommu.c | 24 +- drivers/iommu/iommufd/device.c | 4 - drivers/iommu/iommufd/main.c | 3 + drivers/iommu/iommufd/vfio_compat.c | 2 +- drivers/irqchip/irq-alpine-msi.c | 1 + drivers/irqchip/irq-bcm7120-l2.c | 3 +- drivers/irqchip/irq-brcmstb-l2.c | 6 +- drivers/irqchip/irq-mvebu-gicp.c | 1 + drivers/irqchip/irq-ti-sci-intr.c | 1 + drivers/irqchip/irqchip.c | 8 +- drivers/leds/led-class.c | 6 +- drivers/leds/leds-is31fl319x.c | 7 +- drivers/leds/simple/simatic-ipc-leds-gpio.c | 2 + drivers/md/dm-bufio.c | 2 +- drivers/md/dm-cache-background-tracker.c | 8 + drivers/md/dm-cache-target.c | 4 + drivers/md/dm-flakey.c | 31 +- drivers/md/dm-ioctl.c | 13 +- drivers/md/dm-thin.c | 2 + drivers/md/dm-zoned-metadata.c | 2 +- drivers/md/dm.c | 30 +- drivers/md/dm.h | 2 +- drivers/md/md.c | 2 +- drivers/media/i2c/imx219.c | 255 +- drivers/media/i2c/max9286.c | 1 + drivers/media/i2c/ov2740.c | 4 +- drivers/media/i2c/ov5640.c | 56 +- drivers/media/i2c/ov5675.c | 4 +- drivers/media/i2c/ov7670.c | 2 +- drivers/media/i2c/ov772x.c | 3 +- drivers/media/i2c/tc358746.c | 9 +- drivers/media/mc/mc-entity.c | 8 +- drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 3 + drivers/media/pci/saa7134/saa7134-core.c | 2 +- drivers/media/platform/amphion/vpu_color.c | 6 +- drivers/media/platform/mediatek/mdp3/Kconfig | 7 +- .../media/platform/mediatek/mdp3/mtk-mdp3-core.c | 7 +- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 35 +- drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h | 4 +- drivers/media/platform/nxp/imx7-media-csi.c | 4 +- .../platform/qcom/camss/camss-csiphy-3ph-1-0.c | 3 +- drivers/media/platform/ti/cal/cal.c | 4 +- drivers/media/platform/ti/omap3isp/isp.c | 9 + drivers/media/platform/verisilicon/hantro_v4l2.c | 7 +- drivers/media/rc/ene_ir.c | 3 +- drivers/media/usb/siano/smsusb.c | 1 + drivers/media/usb/uvc/uvc_ctrl.c | 154 +- drivers/media/usb/uvc/uvc_driver.c | 18 +- drivers/media/usb/uvc/uvc_v4l2.c | 6 +- drivers/media/usb/uvc/uvcvideo.h | 6 +- drivers/media/v4l2-core/v4l2-h264.c | 4 + drivers/media/v4l2-core/v4l2-jpeg.c | 4 +- drivers/mfd/Kconfig | 1 + drivers/mfd/pcf50633-adc.c | 7 +- drivers/mfd/rk808.c | 1 + drivers/misc/eeprom/idt_89hpesx.c | 10 +- drivers/misc/fastrpc.c | 13 +- .../misc/habanalabs/common/command_submission.c | 33 +- drivers/misc/habanalabs/common/device.c | 38 +- drivers/misc/habanalabs/common/memory.c | 5 +- drivers/misc/mei/hdcp/mei_hdcp.c | 4 +- drivers/misc/mei/pxp/mei_pxp.c | 4 +- drivers/misc/vmw_vmci/vmci_host.c | 2 + drivers/mtd/mtdpart.c | 10 + drivers/mtd/spi-nor/core.c | 9 + drivers/mtd/spi-nor/core.h | 1 + drivers/mtd/spi-nor/sfdp.c | 6 +- drivers/mtd/spi-nor/spansion.c | 9 +- drivers/net/can/rcar/rcar_canfd.c | 23 +- drivers/net/can/usb/esd_usb.c | 52 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 + drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 +- drivers/net/ethernet/intel/ice/ice_main.c | 17 +- drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 22 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 2 +- .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 +- .../net/ethernet/microchip/lan966x/lan966x_ptp.c | 4 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 11 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 + drivers/net/ethernet/ti/am65-cpts.c | 15 +- drivers/net/ethernet/ti/am65-cpts.h | 5 + drivers/net/hyperv/netvsc.c | 18 + drivers/net/ipa/gsi.c | 3 +- drivers/net/ipa/gsi_reg.h | 1 - drivers/net/tap.c | 2 +- drivers/net/tun.c | 2 +- drivers/net/wireless/ath/ath11k/core.h | 1 - drivers/net/wireless/ath/ath11k/debugfs.c | 48 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 + drivers/net/wireless/ath/ath11k/pci.c | 2 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 33 +- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 + drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +- drivers/net/wireless/ath/ath9k/wmi.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/chip.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/common.c | 7 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 33 +- .../broadcom/brcm80211/include/brcm_hw_ids.h | 8 +- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 11 +- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 +- drivers/net/wireless/intel/iwlegacy/common.c | 4 +- drivers/net/wireless/intel/iwlwifi/mei/main.c | 6 +- drivers/net/wireless/intersil/orinoco/hw.c | 2 + drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- drivers/net/wireless/marvell/libertas/main.c | 3 +- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +- drivers/net/wireless/mediatek/mt76/dma.c | 16 +- drivers/net/wireless/mediatek/mt76/mt76_connac.h | 3 + .../net/wireless/mediatek/mt76/mt76_connac_mac.c | 9 +- .../net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +- drivers/net/wireless/mediatek/mt76/mt76x0/phy.c | 7 +- .../net/wireless/mediatek/mt76/mt7915/debugfs.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 19 +- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 24 +- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 3 - drivers/net/wireless/mediatek/mt76/mt7915/main.c | 11 + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 67 +- drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h | 4 + drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 1 - drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 1 + .../net/wireless/mediatek/mt76/mt7921/acpi_sar.c | 7 +- drivers/net/wireless/mediatek/mt76/mt7921/init.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 27 +- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 70 +- drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h | 2 + .../net/wireless/mediatek/mt76/mt7996/debugfs.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 18 +- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 52 +- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 5 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 20 +- drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 3 +- drivers/net/wireless/mediatek/mt76/mt7996/regs.h | 16 +- drivers/net/wireless/mediatek/mt76/sdio.c | 4 + drivers/net/wireless/mediatek/mt76/sdio_txrx.c | 4 + drivers/net/wireless/mediatek/mt7601u/dma.c | 3 +- drivers/net/wireless/microchip/wilc1000/netdev.c | 8 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c | 2 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 25 +- .../net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +- drivers/net/wireless/realtek/rtw88/coex.c | 2 +- drivers/net/wireless/realtek/rtw88/mac.c | 10 + drivers/net/wireless/realtek/rtw88/mac80211.c | 4 +- drivers/net/wireless/realtek/rtw88/main.c | 6 +- drivers/net/wireless/realtek/rtw88/main.h | 2 +- drivers/net/wireless/realtek/rtw88/ps.c | 4 +- drivers/net/wireless/realtek/rtw88/wow.c | 2 +- drivers/net/wireless/realtek/rtw89/core.c | 3 + drivers/net/wireless/realtek/rtw89/debug.c | 7 + drivers/net/wireless/realtek/rtw89/fw.c | 4 +- drivers/net/wireless/realtek/rtw89/fw.h | 34 +- drivers/net/wireless/realtek/rtw89/pci.c | 15 +- drivers/net/wireless/realtek/rtw89/pci.h | 15 +- drivers/net/wireless/realtek/rtw89/reg.h | 2 + drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c | 11 +- drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 + drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + drivers/net/wireless/wl3501_cs.c | 2 +- drivers/nvdimm/bus.c | 19 +- drivers/nvdimm/dimm_devs.c | 5 +- drivers/nvdimm/nd-core.h | 1 + drivers/opp/debugfs.c | 2 +- drivers/pci/controller/dwc/pcie-qcom.c | 13 +- drivers/pci/controller/pcie-mt7621.c | 2 + drivers/pci/endpoint/functions/pci-epf-vntb.c | 1 + drivers/pci/iov.c | 2 +- drivers/pci/pci-driver.c | 2 +- drivers/pci/pci.c | 59 +- drivers/pci/pci.h | 59 +- drivers/pci/pcie/dpc.c | 4 +- drivers/pci/probe.c | 2 +- drivers/pci/quirks.c | 1 + drivers/pci/switch/switchtec.c | 9 +- drivers/phy/mediatek/phy-mtk-io.h | 4 +- drivers/phy/rockchip/phy-rockchip-typec.c | 4 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 - drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/pinctrl-at91-pio4.c | 4 +- drivers/pinctrl/pinctrl-at91.c | 2 +- drivers/pinctrl/pinctrl-rockchip.c | 1 + drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 17 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + drivers/platform/chrome/cros_ec_typec.c | 2 +- drivers/platform/x86/dell/dell-wmi-ddv.c | 6 +- drivers/power/supply/power_supply_core.c | 93 - drivers/powercap/powercap_sys.c | 14 +- drivers/regulator/core.c | 6 +- drivers/regulator/max77802-regulator.c | 34 +- drivers/regulator/s5m8767.c | 6 +- drivers/regulator/tps65219-regulator.c | 22 +- drivers/remoteproc/mtk_scp_ipi.c | 11 +- drivers/remoteproc/qcom_q6v5_mss.c | 87 +- drivers/rpmsg/qcom_glink_native.c | 3 + drivers/rtc/rtc-pm8xxx.c | 24 +- drivers/s390/block/dasd_eckd.c | 4 +- drivers/s390/char/sclp_early.c | 2 +- drivers/s390/cio/vfio_ccw_drv.c | 2 +- drivers/s390/crypto/vfio_ap_ops.c | 12 +- drivers/scsi/aacraid/aachba.c | 5 +- drivers/scsi/aic94xx/aic94xx_task.c | 3 + drivers/scsi/hosts.c | 2 + drivers/scsi/lpfc/lpfc_sli.c | 19 +- drivers/scsi/mpi3mr/mpi3mr_app.c | 28 +- drivers/scsi/mpi3mr/mpi3mr_os.c | 4 + drivers/scsi/mpt3sas/mpt3sas_base.c | 3 + drivers/scsi/qla2xxx/qla_bsg.c | 9 +- drivers/scsi/qla2xxx/qla_def.h | 6 +- drivers/scsi/qla2xxx/qla_dfs.c | 10 +- drivers/scsi/qla2xxx/qla_edif.c | 11 +- drivers/scsi/qla2xxx/qla_edif_bsg.h | 15 +- drivers/scsi/qla2xxx/qla_init.c | 14 +- drivers/scsi/qla2xxx/qla_inline.h | 55 +- drivers/scsi/qla2xxx/qla_iocb.c | 95 +- drivers/scsi/qla2xxx/qla_isr.c | 6 +- drivers/scsi/qla2xxx/qla_nvme.c | 34 +- drivers/scsi/qla2xxx/qla_os.c | 9 +- drivers/scsi/ses.c | 64 +- drivers/scsi/snic/snic_debugfs.c | 4 +- drivers/soundwire/cadence_master.c | 3 +- drivers/spi/Kconfig | 1 - drivers/spi/spi-bcm63xx-hsspi.c | 14 +- drivers/spi/spi-intel.c | 8 +- drivers/spi/spi-sn-f-ospi.c | 2 +- drivers/spi/spi-synquacer.c | 7 +- drivers/staging/media/atomisp/Kconfig | 2 +- drivers/staging/media/atomisp/pci/atomisp_fops.c | 4 +- drivers/thermal/hisi_thermal.c | 4 - drivers/thermal/imx_sc_thermal.c | 4 +- drivers/thermal/intel/intel_pch_thermal.c | 8 + drivers/thermal/intel/intel_powerclamp.c | 20 +- drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +- drivers/thermal/qcom/tsens-v0_1.c | 28 +- drivers/thermal/qcom/tsens-v1.c | 61 +- drivers/thermal/qcom/tsens.c | 3 + drivers/thermal/qcom/tsens.h | 2 +- drivers/tty/serial/fsl_lpuart.c | 19 +- drivers/tty/serial/imx.c | 5 + drivers/tty/serial/qcom_geni_serial.c | 2 + drivers/tty/serial/serial-tegra.c | 7 +- drivers/ufs/core/ufshcd.c | 20 +- drivers/ufs/host/ufs-exynos.c | 2 +- drivers/usb/early/xhci-dbc.c | 3 +- drivers/usb/fotg210/fotg210-udc.c | 16 + drivers/usb/gadget/configfs.c | 6 + drivers/usb/gadget/udc/fusb300_udc.c | 10 +- drivers/usb/host/fsl-mph-dr-of.c | 3 +- drivers/usb/host/max3421-hcd.c | 2 +- drivers/usb/musb/mediatek.c | 3 +- drivers/usb/typec/mux/intel_pmc_mux.c | 4 +- drivers/vfio/group.c | 2 +- drivers/vfio/vfio_iommu_type1.c | 143 +- drivers/video/fbdev/core/fbcon.c | 17 +- drivers/virt/coco/sev-guest/sev-guest.c | 20 +- drivers/xen/grant-dma-iommu.c | 11 +- fs/btrfs/discard.c | 41 +- fs/btrfs/disk-io.c | 3 + fs/btrfs/fs.c | 4 + fs/btrfs/fs.h | 6 + fs/btrfs/scrub.c | 49 +- fs/btrfs/sysfs.c | 29 +- fs/btrfs/sysfs.h | 3 +- fs/btrfs/transaction.c | 5 + fs/ceph/file.c | 8 + fs/cifs/cached_dir.c | 43 +- fs/cifs/cifsacl.c | 34 +- fs/cifs/cifsproto.h | 20 +- fs/cifs/cifssmb.c | 17 +- fs/cifs/connect.c | 94 +- fs/cifs/dir.c | 19 +- fs/cifs/file.c | 35 +- fs/cifs/inode.c | 53 +- fs/cifs/link.c | 66 +- fs/cifs/misc.c | 67 + fs/cifs/smb1ops.c | 72 +- fs/cifs/smb2inode.c | 38 +- fs/cifs/smb2ops.c | 227 +- fs/cifs/smb2pdu.c | 212 +- fs/cifs/smbdirect.c | 4 +- fs/coda/upcall.c | 2 +- fs/cramfs/inode.c | 2 +- fs/dlm/lockspace.c | 16 +- fs/dlm/memory.c | 2 +- fs/dlm/midcomms.c | 55 +- fs/erofs/fscache.c | 2 +- fs/exfat/dir.c | 7 +- fs/exfat/exfat_fs.h | 2 +- fs/exfat/file.c | 3 +- fs/exfat/inode.c | 6 +- fs/exfat/namei.c | 2 +- fs/exfat/super.c | 3 +- fs/ext4/namei.c | 11 +- fs/ext4/xattr.c | 35 +- fs/f2fs/data.c | 10 +- fs/f2fs/inline.c | 13 +- fs/f2fs/inode.c | 13 +- fs/f2fs/segment.c | 9 +- fs/fuse/ioctl.c | 6 + fs/gfs2/aops.c | 3 +- fs/gfs2/super.c | 8 +- fs/hfs/bnode.c | 1 + fs/hfsplus/super.c | 4 +- fs/jbd2/transaction.c | 50 +- fs/ksmbd/smb2misc.c | 31 +- fs/ksmbd/smb2pdu.c | 28 +- fs/ksmbd/vfs_cache.c | 5 +- fs/lockd/svc.c | 2 +- fs/nfs/nfs4proc.c | 4 +- fs/nfs/nfs4trace.h | 42 +- fs/nfsd/filecache.c | 44 +- fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4proc.c | 160 +- fs/nfsd/nfs4state.c | 53 +- fs/nfsd/nfssvc.c | 2 +- fs/nfsd/trace.h | 31 - fs/nfsd/xdr4.h | 2 +- fs/ocfs2/move_extents.c | 34 +- fs/open.c | 5 +- fs/proc/proc_sysctl.c | 6 + fs/super.c | 21 +- fs/udf/file.c | 26 +- fs/udf/inode.c | 74 +- fs/udf/super.c | 1 + fs/udf/udf_i.h | 3 +- fs/udf/udf_sb.h | 2 + include/drm/drm_mipi_dsi.h | 4 + include/drm/drm_print.h | 2 +- include/linux/blkdev.h | 1 + include/linux/bpf.h | 7 + include/linux/compiler_attributes.h | 6 - include/linux/compiler_types.h | 27 + include/linux/context_tracking.h | 27 + include/linux/device.h | 1 + include/linux/fwnode.h | 12 +- include/linux/hid.h | 1 + include/linux/ima.h | 6 +- include/linux/kernel_stat.h | 2 +- include/linux/kprobes.h | 2 + include/linux/libnvdimm.h | 3 + include/linux/mlx4/qp.h | 1 + include/linux/msi.h | 2 + include/linux/nfs_ssc.h | 2 +- include/linux/poison.h | 3 + include/linux/rcupdate.h | 11 +- include/linux/rmap.h | 2 +- include/linux/transport_class.h | 8 +- include/linux/uaccess.h | 4 + include/net/sock.h | 7 +- include/sound/hda_codec.h | 1 + include/sound/soc-dapm.h | 1 + include/trace/events/devlink.h | 2 +- include/uapi/linux/io_uring.h | 2 +- include/uapi/linux/vfio.h | 15 +- include/ufs/ufshcd.h | 4 +- io_uring/io_uring.c | 13 +- io_uring/io_uring.h | 10 + io_uring/net.c | 2 +- io_uring/opdef.c | 1 + io_uring/poll.c | 14 +- io_uring/poll.h | 1 + io_uring/rsrc.c | 13 +- kernel/bpf/btf.c | 13 +- kernel/bpf/hashtab.c | 4 +- kernel/bpf/memalloc.c | 2 +- kernel/bpf/verifier.c | 258 +- kernel/context_tracking.c | 12 +- kernel/exit.c | 16 +- kernel/irq/irqdomain.c | 283 ++- kernel/irq/msi.c | 32 +- kernel/kprobes.c | 27 +- kernel/locking/lockdep.c | 3 + kernel/locking/rwsem.c | 49 +- kernel/panic.c | 49 +- kernel/pid_namespace.c | 17 + kernel/power/energy_model.c | 5 +- kernel/rcu/srcutree.c | 9 +- kernel/rcu/tasks.h | 77 +- kernel/rcu/tree_exp.h | 2 + kernel/resource.c | 14 - kernel/sched/rt.c | 5 +- kernel/sysctl.c | 43 +- kernel/time/clocksource.c | 45 +- kernel/time/hrtimer.c | 2 + kernel/time/posix-stubs.c | 2 + kernel/time/posix-timers.c | 2 + kernel/time/test_udelay.c | 2 +- kernel/torture.c | 2 +- kernel/trace/blktrace.c | 4 +- kernel/trace/ring_buffer.c | 42 +- kernel/trace/trace.c | 2 +- kernel/workqueue.c | 41 +- lib/bug.c | 15 +- lib/errname.c | 22 +- lib/kobject.c | 12 +- lib/mpi/mpicoder.c | 3 +- lib/sbitmap.c | 13 +- mm/damon/paddr.c | 7 +- mm/huge_memory.c | 3 + mm/hugetlb_vmemmap.c | 2 +- mm/memcontrol.c | 4 + mm/memory-failure.c | 8 +- mm/memory-tiers.c | 4 +- mm/rmap.c | 2 +- net/bluetooth/hci_conn.c | 12 +- net/bluetooth/l2cap_core.c | 24 - net/bluetooth/l2cap_sock.c | 8 + net/can/isotp.c | 3 + net/core/scm.c | 2 + net/core/sock.c | 15 +- net/ipv4/inet_hashtables.c | 12 +- net/l2tp/l2tp_ppp.c | 125 +- net/mac80211/cfg.c | 26 +- net/mac80211/ieee80211_i.h | 3 + net/mac80211/link.c | 3 + net/mac80211/rx.c | 32 +- net/mac80211/sta_info.c | 2 +- net/mac80211/tx.c | 2 +- net/netfilter/nf_tables_api.c | 3 + net/rds/message.c | 2 +- net/rxrpc/call_object.c | 6 +- net/smc/af_smc.c | 2 + net/smc/smc_core.c | 17 +- net/sunrpc/clnt.c | 2 + net/wireless/nl80211.c | 2 +- net/wireless/sme.c | 48 +- net/xdp/xsk.c | 59 +- scripts/bpf_doc.py | 2 +- scripts/gcc-plugins/Makefile | 2 +- scripts/package/mkdebian | 2 +- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_main.c | 9 +- security/security.c | 7 +- sound/pci/hda/Kconfig | 14 + sound/pci/hda/hda_codec.c | 13 +- sound/pci/hda/hda_controller.c | 1 + sound/pci/hda/hda_controller.h | 1 + sound/pci/hda/hda_intel.c | 8 +- sound/pci/hda/patch_ca0132.c | 2 +- sound/pci/hda/patch_realtek.c | 1 + sound/pci/ice1712/aureon.c | 2 +- sound/soc/atmel/mchp-spdifrx.c | 342 ++- sound/soc/codecs/lpass-rx-macro.c | 12 +- sound/soc/codecs/lpass-tx-macro.c | 12 +- sound/soc/codecs/lpass-va-macro.c | 20 +- sound/soc/codecs/lpass-wsa-macro.c | 9 +- sound/soc/codecs/tlv320adcx140.c | 2 +- sound/soc/fsl/fsl_sai.c | 1 + sound/soc/kirkwood/kirkwood-dma.c | 2 +- sound/soc/qcom/qdsp6/q6apm-dai.c | 22 +- sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 5 + sound/soc/sh/rcar/rsnd.h | 4 +- sound/soc/soc-compress.c | 11 +- sound/soc/soc-topology.c | 2 +- tools/bootconfig/scripts/ftrace2bconf.sh | 2 +- tools/bpf/bpftool/Makefile | 3 +- tools/bpf/bpftool/prog.c | 38 +- tools/lib/bpf/bpf_tracing.h | 2 +- tools/lib/bpf/btf.c | 13 + tools/lib/bpf/btf_dump.c | 7 +- tools/lib/bpf/libbpf.c | 2 +- tools/lib/bpf/nlattr.c | 2 +- tools/lib/thermal/sampling.c | 2 +- tools/objtool/check.c | 2 + tools/perf/Documentation/perf-intel-pt.txt | 30 + tools/perf/builtin-inject.c | 6 +- tools/perf/builtin-record.c | 16 +- tools/perf/perf-completion.sh | 11 +- tools/perf/pmu-events/metric_test.py | 4 +- tools/perf/tests/bpf.c | 6 +- tools/perf/tests/shell/stat_all_metrics.sh | 2 +- tools/perf/util/auxtrace.c | 3 + tools/perf/util/intel-pt.c | 6 + tools/perf/util/llvm-utils.c | 25 +- tools/perf/util/stat-display.c | 51 +- tools/perf/util/stat-shadow.c | 2 +- tools/power/x86/intel-speed-select/isst-config.c | 2 +- tools/testing/ktest/ktest.pl | 26 +- tools/testing/ktest/sample.conf | 5 + tools/testing/selftests/Makefile | 4 +- tools/testing/selftests/arm64/abi/syscall-abi.c | 8 + tools/testing/selftests/arm64/fp/Makefile | 2 +- .../selftests/arm64/signal/testcases/ssve_regs.c | 4 + .../selftests/arm64/signal/testcases/za_regs.c | 4 + tools/testing/selftests/arm64/tags/Makefile | 2 +- tools/testing/selftests/bpf/Makefile | 7 +- .../selftests/bpf/prog_tests/kfunc_dynptr_param.c | 2 +- .../selftests/bpf/prog_tests/xdp_do_redirect.c | 4 + tools/testing/selftests/bpf/progs/dynptr_fail.c | 10 +- tools/testing/selftests/bpf/progs/map_kptr.c | 12 +- tools/testing/selftests/bpf/progs/test_bpf_nf.c | 11 +- tools/testing/selftests/bpf/xdp_synproxy.c | 1 + tools/testing/selftests/bpf/xskxceiver.c | 22 +- tools/testing/selftests/clone3/Makefile | 2 +- tools/testing/selftests/core/Makefile | 2 +- tools/testing/selftests/dmabuf-heaps/Makefile | 2 +- tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 3 +- tools/testing/selftests/drivers/dma-buf/Makefile | 2 +- .../selftests/drivers/net/netdevsim/devlink.sh | 18 + .../selftests/drivers/s390x/uvdevice/Makefile | 3 +- tools/testing/selftests/filesystems/Makefile | 2 +- .../selftests/filesystems/binderfs/Makefile | 2 +- tools/testing/selftests/filesystems/epoll/Makefile | 2 +- .../test.d/dynevent/eprobes_syntax_errors.tc | 4 +- .../ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- .../selftests/ftrace/test.d/kprobe/probepoint.tc | 2 +- tools/testing/selftests/futex/functional/Makefile | 2 +- tools/testing/selftests/gpio/Makefile | 2 +- tools/testing/selftests/iommu/iommufd.c | 2 +- tools/testing/selftests/ipc/Makefile | 2 +- tools/testing/selftests/kcmp/Makefile | 2 +- tools/testing/selftests/landlock/fs_test.c | 47 + tools/testing/selftests/landlock/ptrace_test.c | 113 +- tools/testing/selftests/media_tests/Makefile | 2 +- tools/testing/selftests/membarrier/Makefile | 2 +- tools/testing/selftests/mount_setattr/Makefile | 2 +- .../selftests/move_mount_set_group/Makefile | 2 +- tools/testing/selftests/net/fib_tests.sh | 2 + tools/testing/selftests/net/udpgso_bench_rx.c | 6 +- tools/testing/selftests/perf_events/Makefile | 2 +- tools/testing/selftests/pid_namespace/Makefile | 2 +- tools/testing/selftests/pidfd/Makefile | 2 +- tools/testing/selftests/powerpc/ptrace/Makefile | 2 +- tools/testing/selftests/powerpc/security/Makefile | 2 +- tools/testing/selftests/powerpc/syscalls/Makefile | 2 +- tools/testing/selftests/powerpc/tm/Makefile | 2 +- tools/testing/selftests/ptp/Makefile | 2 +- tools/testing/selftests/rseq/Makefile | 2 +- tools/testing/selftests/sched/Makefile | 2 +- tools/testing/selftests/seccomp/Makefile | 2 +- tools/testing/selftests/sync/Makefile | 2 +- tools/testing/selftests/user_events/Makefile | 2 +- tools/testing/selftests/vm/Makefile | 2 +- tools/testing/selftests/x86/Makefile | 2 +- tools/tracing/rtla/src/osnoise_hist.c | 5 +- virt/kvm/coalesced_mmio.c | 8 +- virt/kvm/kvm_main.c | 31 +- 990 files changed, 18539 insertions(+), 14322 deletions(-)
From: Pietro Borrello borrello@diag.uniroma1.it
commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream.
asus driver has a worker that may access data concurrently. Proct the accesses using a spinlock.
Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-4-7860c5763c38@dia... Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/hid/hid-asus.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -98,6 +98,7 @@ struct asus_kbd_leds { struct hid_device *hdev; struct work_struct work; unsigned int brightness; + spinlock_t lock; bool removed; };
@@ -495,7 +496,12 @@ static void asus_kbd_backlight_set(struc { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); + unsigned long flags; + + spin_lock_irqsave(&led->lock, flags); led->brightness = brightness; + spin_unlock_irqrestore(&led->lock, flags); + schedule_work(&led->work); }
@@ -503,8 +509,14 @@ static enum led_brightness asus_kbd_back { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); + enum led_brightness brightness; + unsigned long flags;
- return led->brightness; + spin_lock_irqsave(&led->lock, flags); + brightness = led->brightness; + spin_unlock_irqrestore(&led->lock, flags); + + return brightness; }
static void asus_kbd_backlight_work(struct work_struct *work) @@ -512,11 +524,14 @@ static void asus_kbd_backlight_work(stru struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work); u8 buf[] = { FEATURE_KBD_REPORT_ID, 0xba, 0xc5, 0xc4, 0x00 }; int ret; + unsigned long flags;
if (led->removed) return;
+ spin_lock_irqsave(&led->lock, flags); buf[4] = led->brightness; + spin_unlock_irqrestore(&led->lock, flags);
ret = asus_kbd_set_report(led->hdev, buf, sizeof(buf)); if (ret < 0) @@ -584,6 +599,7 @@ static int asus_kbd_register_leds(struct drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set; drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get; INIT_WORK(&drvdata->kbd_backlight->work, asus_kbd_backlight_work); + spin_lock_init(&drvdata->kbd_backlight->lock);
ret = devm_led_classdev_register(&hdev->dev, &drvdata->kbd_backlight->cdev); if (ret < 0) { @@ -1119,9 +1135,13 @@ err_stop_hw: static void asus_remove(struct hid_device *hdev) { struct asus_drvdata *drvdata = hid_get_drvdata(hdev); + unsigned long flags;
if (drvdata->kbd_backlight) { + spin_lock_irqsave(&drvdata->kbd_backlight->lock, flags); drvdata->kbd_backlight->removed = true; + spin_unlock_irqrestore(&drvdata->kbd_backlight->lock, flags); + cancel_work_sync(&drvdata->kbd_backlight->work); }
From: Pietro Borrello borrello@diag.uniroma1.it
commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.
Use spinlocks to deal with workers introducing a wrapper asus_schedule_work(), and several spinlock checks. Otherwise, asus_kbd_backlight_set() may schedule led->work after the structure has been freed, causing a use-after-free.
Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@dia... Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Signed-off-by: Stefan Ghinea stefan.ghinea@windriver.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/hid/hid-asus.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
--- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -491,6 +491,16 @@ static int rog_nkey_led_init(struct hid_ return ret; }
+static void asus_schedule_work(struct asus_kbd_leds *led) +{ + unsigned long flags; + + spin_lock_irqsave(&led->lock, flags); + if (!led->removed) + schedule_work(&led->work); + spin_unlock_irqrestore(&led->lock, flags); +} + static void asus_kbd_backlight_set(struct led_classdev *led_cdev, enum led_brightness brightness) { @@ -502,7 +512,7 @@ static void asus_kbd_backlight_set(struc led->brightness = brightness; spin_unlock_irqrestore(&led->lock, flags);
- schedule_work(&led->work); + asus_schedule_work(led); }
static enum led_brightness asus_kbd_backlight_get(struct led_classdev *led_cdev) @@ -526,9 +536,6 @@ static void asus_kbd_backlight_work(stru int ret; unsigned long flags;
- if (led->removed) - return; - spin_lock_irqsave(&led->lock, flags); buf[4] = led->brightness; spin_unlock_irqrestore(&led->lock, flags);
From: Vasant Hegde vasant.hegde@amd.com
commit 080920e52148b4fbbf9360d5345fdcd7846e4841 upstream.
Current code throws kernel warning if it fails to enable pasid/pri [1]. Do not call pci_disable_[pasid/pri] if pci_enable_[pasid/pri] failed.
[1] https://lore.kernel.org/linux-iommu/15d0f9ff-2a56-b3e9-5b45-e6b23300ae3b@lee...
Reported-by: Matt Fagnani matt.fagnani@bell.net Signed-off-by: Vasant Hegde vasant.hegde@amd.com Reviewed-by: Suravee Suthikulpanit suravee.suthikulpanit@amd.com Link: https://lore.kernel.org/r/20230111121503.5931-1-vasant.hegde@amd.com Signed-off-by: Joerg Roedel jroedel@suse.de Cc: "Limonciello, Mario" Mario.Limonciello@amd.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/amd/iommu.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -1702,27 +1702,29 @@ static int pdev_pri_ats_enable(struct pc /* Only allow access to user-accessible pages */ ret = pci_enable_pasid(pdev, 0); if (ret) - goto out_err; + return ret;
/* First reset the PRI state of the device */ ret = pci_reset_pri(pdev); if (ret) - goto out_err; + goto out_err_pasid;
/* Enable PRI */ /* FIXME: Hardcode number of outstanding requests for now */ ret = pci_enable_pri(pdev, 32); if (ret) - goto out_err; + goto out_err_pasid;
ret = pci_enable_ats(pdev, PAGE_SHIFT); if (ret) - goto out_err; + goto out_err_pri;
return 0;
-out_err: +out_err_pri: pci_disable_pri(pdev); + +out_err_pasid: pci_disable_pasid(pdev);
return ret;
From: Vasant Hegde vasant.hegde@amd.com
commit f451c7a5a3b818ecfeba2ba258570769998baf3a upstream.
If device->domain is same as new domain then we can skip the device attach process.
Signed-off-by: Vasant Hegde vasant.hegde@amd.com Link: https://lore.kernel.org/r/20230215052642.6016-2-vasant.hegde@amd.com Signed-off-by: Joerg Roedel jroedel@suse.de Cc: "Limonciello, Mario" Mario.Limonciello@amd.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/amd/iommu.c | 7 +++++++ 1 file changed, 7 insertions(+)
--- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -2161,6 +2161,13 @@ static int amd_iommu_attach_device(struc struct amd_iommu *iommu = rlookup_amd_iommu(dev); int ret;
+ /* + * Skip attach device to domain if new domain is same as + * devices current domain + */ + if (dev_data->domain == domain) + return 0; + dev_data->defer_attach = false;
if (dev_data->domain)
From: Vasant Hegde vasant.hegde@amd.com
commit 996d120b4de2b0d6b592bd9fbbe6e244b81ab3cc upstream.
If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always setup and it will hit NULL pointer derefence (see below sample log).
Lets check whether domain is setup or not and log appropriate message.
Sample log: ---------- amdgpu 0000:00:01.0: amdgpu: SE 1, SH per SE 1, CU per SH 8, active_cu_number 6 BUG: kernel NULL pointer dereference, address: 0000000000000058 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 56 Comm: irq/24-AMD-Vi Not tainted 6.2.0-rc2+ #89 Hardware name: xxx RIP: 0010:report_iommu_fault+0x11/0x90 [...] Call Trace: <TASK> amd_iommu_int_thread+0x60c/0x760 ? __pfx_irq_thread_fn+0x10/0x10 irq_thread_fn+0x1f/0x60 irq_thread+0xea/0x1a0 ? preempt_count_add+0x6a/0xa0 ? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0xe9/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK>
Reported-by: Matt Fagnani matt.fagnani@bell.net Suggested-by: Joerg Roedel joro@8bytes.org Signed-off-by: Vasant Hegde vasant.hegde@amd.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216865 Link: https://lore.kernel.org/lkml/15d0f9ff-2a56-b3e9-5b45-e6b23300ae3b@leemhuis.i... Link: https://lore.kernel.org/r/20230215052642.6016-3-vasant.hegde@amd.com Cc: stable@vger.kernel.org [joro: Edit commit message] Signed-off-by: Joerg Roedel jroedel@suse.de Cc: "Limonciello, Mario" Mario.Limonciello@amd.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/amd/iommu.c | 9 +++++++++ 1 file changed, 9 insertions(+)
--- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -558,6 +558,15 @@ static void amd_iommu_report_page_fault( * prevent logging it. */ if (IS_IOMMU_MEM_TRANSACTION(flags)) { + /* Device not attached to domain properly */ + if (dev_data->domain == NULL) { + pr_err_ratelimited("Event logged [Device not attached to domain properly]\n"); + pr_err_ratelimited(" device=%04x:%02x:%02x.%x domain=0x%04x\n", + iommu->pci_seg->id, PCI_BUS_NUM(devid), PCI_SLOT(devid), + PCI_FUNC(devid), domain_id); + goto out; + } + if (!report_iommu_fault(&dev_data->domain->domain, &pdev->dev, address, IS_WRITE_REQUEST(flags) ?
From: Vasant Hegde vasant.hegde@amd.com
commit 2cc73c5712f97de98c38c2fafc1f288354a9f3c3 upstream.
iommu_attach_group() attaches all devices in a group to domain and then sets group domain (group->domain). Current code (__iommu_attach_group()) does not handle error path. This creates problem as devices to domain attachment is in inconsistent state.
Flow: - During boot iommu attach devices to default domain - Later some device driver (like amd/iommu_v2 or vfio) tries to attach device to new domain. - In iommu_attach_group() path we detach device from current domain. Then it tries to attach devices to new domain. - If it fails to attach device to new domain then device to domain link is broken. - iommu_attach_group() returns error. - At this stage iommu_attach_group() caller thinks, attaching device to new domain failed and devices are still attached to old domain. - But in reality device to old domain link is broken. It will result in all sort of failures (like IO page fault) later.
To recover from this situation, we need to attach all devices back to the old domain. Also log warning if it fails attach device back to old domain.
Suggested-by: Lu Baolu baolu.lu@linux.intel.com Reported-by: Matt Fagnani matt.fagnani@bell.net Signed-off-by: Vasant Hegde vasant.hegde@amd.com Reviewed-by: Jason Gunthorpe jgg@nvidia.com Tested-by: Matt Fagnani matt.fagnani@bell.net Link: https://lore.kernel.org/r/20230215052642.6016-1-vasant.hegde@amd.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216865 Link: https://lore.kernel.org/lkml/15d0f9ff-2a56-b3e9-5b45-e6b23300ae3b@leemhuis.i... Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/iommu.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
--- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -2124,8 +2124,22 @@ static int __iommu_attach_group(struct i
ret = __iommu_group_for_each_dev(group, domain, iommu_group_do_attach_device); - if (ret == 0) + if (ret == 0) { group->domain = domain; + } else { + /* + * To recover from the case when certain device within the + * group fails to attach to the new domain, we need force + * attaching all devices back to the old domain. The old + * domain is compatible for all devices in the group, + * hence the iommu driver should always return success. + */ + struct iommu_domain *old_domain = group->domain; + + group->domain = NULL; + WARN(__iommu_group_set_domain(group, old_domain), + "iommu driver failed to attach a compatible domain"); + }
return ret; }
From: Anders Roxell anders.roxell@linaro.org
commit d78c8e32890ef7eca79ffd67c96022c7f9d8cce4 upstream.
Clang warns:
arch/powerpc/mm/book3s64/radix_tlb.c:1191:23: error: variable 'hstart' is uninitialized when used here __tlbiel_va_range(hstart, hend, pid, ^~~~~~ arch/powerpc/mm/book3s64/radix_tlb.c:1191:31: error: variable 'hend' is uninitialized when used here __tlbiel_va_range(hstart, hend, pid, ^~~~
Rework the 'if (IS_ENABLE(CONFIG_TRANSPARENT_HUGEPAGE))' so hstart/hend is always initialized to silence the warnings. That will also simplify the 'else' path. Clang is getting confused with these warnings, but the warnings is a false-positive.
Suggested-by: Arnd Bergmann arnd@arndb.de Suggested-by: Nathan Chancellor nathan@kernel.org Reviewed-by: Christophe Leroy christophe.leroy@csgroup.eu Reviewed-by: Nathan Chancellor nathan@kernel.org Signed-off-by: Anders Roxell anders.roxell@linaro.org Signed-off-by: Michael Ellerman mpe@ellerman.id.au Link: https://lore.kernel.org/r/20220810114318.3220630-1-anders.roxell@linaro.org Signed-off-by: Daniel Díaz daniel.diaz@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/powerpc/mm/book3s64/radix_tlb.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
--- a/arch/powerpc/mm/book3s64/radix_tlb.c +++ b/arch/powerpc/mm/book3s64/radix_tlb.c @@ -1179,15 +1179,12 @@ static inline void __radix__flush_tlb_ra } } } else { - bool hflush = false; + bool hflush; unsigned long hstart, hend;
- if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) { - hstart = (start + PMD_SIZE - 1) & PMD_MASK; - hend = end & PMD_MASK; - if (hstart < hend) - hflush = true; - } + hstart = (start + PMD_SIZE - 1) & PMD_MASK; + hend = end & PMD_MASK; + hflush = IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && hstart < hend;
if (type == FLUSH_TYPE_LOCAL) { asm volatile("ptesync": : :"memory");
From: Damien Le Moal damien.lemoal@opensource.wdc.com
commit 6210038aeaf49c395c2da57572246d93ec67f6d4 upstream.
Commit 104ff59af73a ("ata: ahci: Add Tiger Lake UP{3,4} AHCI controller") enabled low power mode for the Tiger Lake AHIC adapter in the author system but created regressions for others. Revert this patch for now until a better solution is found to make this adapter eco-friendly.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217114 CC: stable@vger.kernel.org Signed-off-by: Damien Le Moal damien.lemoal@opensource.wdc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/ata/ahci.c | 1 - 1 file changed, 1 deletion(-)
--- a/drivers/ata/ahci.c +++ b/drivers/ata/ahci.c @@ -421,7 +421,6 @@ static const struct pci_device_id ahci_p { PCI_VDEVICE(INTEL, 0x34d3), board_ahci_low_power }, /* Ice Lake LP AHCI */ { PCI_VDEVICE(INTEL, 0x02d3), board_ahci_low_power }, /* Comet Lake PCH-U AHCI */ { PCI_VDEVICE(INTEL, 0x02d7), board_ahci_low_power }, /* Comet Lake PCH RAID */ - { PCI_VDEVICE(INTEL, 0xa0d3), board_ahci_low_power }, /* Tiger Lake UP{3,4} AHCI */
/* JMicron 360/1/3/5/6, match class to avoid IDE function */ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
From: Chen Hui judy.chenhui@huawei.com
[ Upstream commit ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac ]
The "sys_clk" resource is malloced by clk_get(), it is not released when the function return.
Fixes: fa6d79d27614 ("ARM: OMAP: Add initialisation for the real-time counter.") Signed-off-by: Chen Hui judy.chenhui@huawei.com Message-Id: 20221108141917.46796-1-judy.chenhui@huawei.com Signed-off-by: Tony Lindgren tony@atomide.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/mach-omap2/timer.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c index 620ba69c8f114..5677c4a08f376 100644 --- a/arch/arm/mach-omap2/timer.c +++ b/arch/arm/mach-omap2/timer.c @@ -76,6 +76,7 @@ static void __init realtime_counter_init(void) }
rate = clk_get_rate(sys_clk); + clk_put(sys_clk);
if (soc_is_dra7xx()) { /*
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 41a37d157a613444c97e8f71a5fb2a21116b70d7 ]
The commit e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") added names for PCIe resets, but it did not change the existing qcs404.dtsi to use these names. Do it now and use symbol names to make it easier to check and modify the dtsi in future.
Fixes: e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221226042154.2666748-14-dmitry.baryshkov@linaro.... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi index a5324eecb50a9..502dd6db491e2 100644 --- a/arch/arm64/boot/dts/qcom/qcs404.dtsi +++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi @@ -806,7 +806,7 @@ pcie_phy: phy@7786000 {
clocks = <&gcc GCC_PCIE_0_PIPE_CLK>; resets = <&gcc GCC_PCIEPHY_0_PHY_BCR>, - <&gcc 21>; + <&gcc GCC_PCIE_0_PIPE_ARES>; reset-names = "phy", "pipe";
clock-output-names = "pcie_0_pipe_clk"; @@ -1336,12 +1336,12 @@ pcie: pci@10000000 { <&gcc GCC_PCIE_0_SLV_AXI_CLK>; clock-names = "iface", "aux", "master_bus", "slave_bus";
- resets = <&gcc 18>, - <&gcc 17>, - <&gcc 15>, - <&gcc 19>, + resets = <&gcc GCC_PCIE_0_AXI_MASTER_ARES>, + <&gcc GCC_PCIE_0_AXI_SLAVE_ARES>, + <&gcc GCC_PCIE_0_AXI_MASTER_STICKY_ARES>, + <&gcc GCC_PCIE_0_CORE_STICKY_ARES>, <&gcc GCC_PCIE_0_BCR>, - <&gcc 16>; + <&gcc GCC_PCIE_0_AHB_ARES>; reset-names = "axi_m", "axi_s", "axi_m_sticky",
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit 43069b9cd358aebc692e654de91ee06ff66e26af ]
The hardware turns out to be pretty sluggish at assuming it can only do USB2 with just a USB2 phy assigned to it - before it needed about 6 minutes to acknowledge that.
Limit it to USB-HS explicitly to make USB come up about 720x faster.
Fixes: 9da65e441d4d ("arm64: dts: qcom: Add support for SONY Xperia X Performance / XZ / XZs (msm8996, Tone platform)") Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221124220147.102611-1-konrad.dybcio@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi index dec361b93ccea..be62899edf8e3 100644 --- a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi @@ -943,10 +943,6 @@ touch_int_sleep: touch-int-sleep-state { }; };
-/* - * For reasons that are currently unknown (but probably related to fusb301), USB takes about - * 6 minutes to wake up (nothing interesting in kernel logs), but then it works as it should. - */ &usb3 { status = "okay"; qcom,select-utmi-as-pipe-clk; @@ -955,6 +951,7 @@ &usb3 { &usb3_dwc3 { extcon = <&usb3_id>; dr_mode = "peripheral"; + maximum-speed = "high-speed"; phys = <&hsusb_phy1>; phy-names = "usb2-phy"; snps,hird-threshold = /bits/ 8 <0>;
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit 01b6041454e8bc4f5feb76e6bcdc83a48cea21f2 ]
In its current form, UFS did not even probe successfully - it failed when trying to set XO (ref_clk) to 300 MHz instead of doing so to the ICE clk. Moreover, the missing reg-names prevented ICE from working or being discovered at all. Fix both of these issues.
As a sidenote, the log reveals that this SoC uses UFS ICE v3.1.0.
Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi") Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Iskren Chernev me@iskren.info Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221208201401.530555-1-konrad.dybcio@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm6115.dtsi | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi index 572bf04adf906..3f4017bc667d6 100644 --- a/arch/arm64/boot/dts/qcom/sm6115.dtsi +++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi @@ -704,6 +704,7 @@ opp-202000000 { ufs_mem_hc: ufs@4804000 { compatible = "qcom,sm6115-ufshc", "qcom,ufshc", "jedec,ufs-2.0"; reg = <0x04804000 0x3000>, <0x04810000 0x8000>; + reg-names = "std", "ice"; interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>; phys = <&ufs_mem_phy_lanes>; phy-names = "ufsphy"; @@ -736,10 +737,10 @@ ufs_mem_hc: ufs@4804000 { <0 0>, <0 0>, <37500000 150000000>, - <75000000 300000000>, <0 0>, <0 0>, - <0 0>; + <0 0>, + <75000000 300000000>;
status = "disabled"; };
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit ad9514be8ddb9d3a8c262aa415c2f1c1f4cc97f9 ]
rpmcc used to rely on global clock lookup (and still does so for backwards compat reasons) of "xo_board", which was common back when we did not care about things like underscores in node names. Nowadays it expects to be fed a reference to the fixed clock. Satisfy that requirement to make sure rpm clock rates are not all stuck at zero.
Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi") Reported-by: Adam Skladowski a39.skl@gmail.com Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221208201401.530555-2-konrad.dybcio@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi index 3f4017bc667d6..81523ab7ff602 100644 --- a/arch/arm64/boot/dts/qcom/sm6115.dtsi +++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi @@ -296,6 +296,8 @@ rpm_requests: rpm-requests {
rpmcc: clock-controller { compatible = "qcom,rpmcc-sm6115", "qcom,rpmcc"; + clocks = <&xo_board>; + clock-names = "xo"; #clock-cells = <1>; };
From: Marijn Suijten marijn.suijten@somainline.org
[ Upstream commit be8de06dc397c45cb0f3fe04084089c3f06c419f ]
The framebuffer configuration for kumano griffin, written in kumano dtsi (which is overwritten in bahamut dts for its smaller panel) has to use a 1096x2560 configuration as this is what the panel (and framebuffer area) has been initialized to. Downstream userspace also has access to (and uses) this 2.5k mode by default, and only switches the panel to 4k when requested.
Fixes: d0a6ce59ea4e ("arm64: dts: qcom: sm8150: Add support for SONY Xperia 1 / 5 (Kumano platform)") Signed-off-by: Marijn Suijten marijn.suijten@somainline.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221209191733.1458031-1-marijn.suijten@somainline... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi index c958a8b167303..fd8c0097072ab 100644 --- a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi @@ -33,9 +33,10 @@ chosen { framebuffer: framebuffer@9c000000 { compatible = "simple-framebuffer"; reg = <0 0x9c000000 0 0x2300000>; - width = <1644>; - height = <3840>; - stride = <(1644 * 4)>; + /* Griffin BL initializes in 2.5k mode, not 4k */ + width = <1096>; + height = <2560>; + stride = <(1096 * 4)>; format = "a8r8g8b8"; /* * That's (going to be) a lot of clocks, but it's necessary due
From: Marijn Suijten marijn.suijten@somainline.org
[ Upstream commit 3c3d2cb221b8647d1c547b4c44d2d6060cc742a9 ]
This was pointed out in review but never followed up on thanks to sidetracked discussions about labels vs node names.
Fixes: 0d97fdf380b4 ("arm64: dts: qcom: Add configuration for PMI8950 peripheral") Signed-off-by: Marijn Suijten marijn.suijten@somainline.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Luca Weiss luca@z3ntu.xyz Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221209215437.1783067-1-marijn.suijten@somainline... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/pmi8950.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/pmi8950.dtsi b/arch/arm64/boot/dts/qcom/pmi8950.dtsi index 32d27e2187e38..8008f02434a9e 100644 --- a/arch/arm64/boot/dts/qcom/pmi8950.dtsi +++ b/arch/arm64/boot/dts/qcom/pmi8950.dtsi @@ -47,7 +47,7 @@ adc-chan@9 { adc-chan@a { reg = <VADC_REF_1250MV>; qcom,pre-scaling = <1 1>; - label = "ref_1250v"; + label = "ref_1250mv"; };
adc-chan@d {
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit 3b2ff50da499178cc418f4b319e279d1b52958ed ]
Fix up the ramoops node to make it match bindings and style:
- remove "removed-dma-pool" - don't pad size to 8 hex digits - change cc-size to ecc-size so that it's used - increase ecc-size from to 16 - remove the zeroed ftrace-size
Fixes: 5f82b9cda61e ("arm64: dts: qcom: Add SM6350 device tree") Reported-by: Luca Weiss luca.weiss@fairphone.com Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221210102600.589028-1-konrad.dybcio@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm6350.dtsi | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi index 43324bf291c30..00e43a0d2dd67 100644 --- a/arch/arm64/boot/dts/qcom/sm6350.dtsi +++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi @@ -342,13 +342,12 @@ last_log_region: memory@ffbc0000 { };
ramoops: ramoops@ffc00000 { - compatible = "removed-dma-pool", "ramoops"; - reg = <0 0xffc00000 0 0x00100000>; + compatible = "ramoops"; + reg = <0 0xffc00000 0 0x100000>; record-size = <0x1000>; console-size = <0x40000>; - ftrace-size = <0x0>; msg-size = <0x20000 0x20000>; - cc-size = <0x0>; + ecc-size = <16>; no-map; };
From: Richard Acayan mailingradian@gmail.com
[ Upstream commit 861b67fbdccd62a9319d7350b1924d95f597db09 ]
According to the downstream device tree, the regulator that powers the I/O for eMMC should not be turned off. Keep it always on just in case the eMMC driver fails and doesn't enable it, or unloads and disables it.
Fixes: 07c8ded6e373 ("arm64: dts: qcom: add sdm670 and pixel 3a device trees") Link: https://android.googlesource.com/kernel/msm/+/9ed6ddbe955d3b84d1416a1cf77e83... Signed-off-by: Richard Acayan mailingradian@gmail.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221205225237.200564-1-mailingradian@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts b/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts index cf2ae540db125..e3e61b9d1b9d7 100644 --- a/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts +++ b/arch/arm64/boot/dts/qcom/sdm670-google-sargo.dts @@ -256,6 +256,7 @@ vreg_l8a_1p8: ldo8 { regulator-min-microvolt = <1800000>; regulator-max-microvolt = <1800000>; regulator-enable-ramp-delay = <250>; + regulator-always-on; };
vreg_l9a_1p8: ldo9 {
From: Dzmitry Sankouski dsankouski@gmail.com
[ Upstream commit 4c881ab73a64cdbf8691e258ef17b740d27040a0 ]
resin node declaration was moved to pm8998.dtsi file (in disabled state). MSM8998 and SDM845 boards defining resin node did not previously have status="okay" and ended up disabled. Re-enable it by using resin node link from pm8998.dtsi with status="okay".
Fixes: f86ae6f23a9e ("arm64: dts: qcom: sagit: add initial device tree for sagit") Signed-off-by: Dzmitry Sankouski dsankouski@gmail.com Reviewed-by: Marijn Suijten marijn.suijten@somainline.org Reported-by: Marijn Suijten marijn.suijten@somainline.org Link: https://lore.kernel.org/linux-arm-msm/20221222115922.jlachctn4lxopp7a@SoMain... Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221228115243.201038-1-dsankouski@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts | 11 +++-------- .../boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi | 11 +++-------- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 11 +++-------- arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi | 11 +++-------- arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts | 11 +++-------- .../boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 11 +++-------- arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts | 11 +++-------- 7 files changed, 21 insertions(+), 56 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts b/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts index 310f7a2df1e83..510d12c8c5126 100644 --- a/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts +++ b/arch/arm64/boot/dts/qcom/msm8998-fxtec-pro1.dts @@ -364,14 +364,9 @@ cam_snapshot_pin_a: cam-snapshot-btn-active-state { }; };
-&pm8998_pon { - resin { - compatible = "qcom,pm8941-resin"; - interrupts = <GIC_SPI 0x8 1 IRQ_TYPE_EDGE_BOTH>; - bias-pull-up; - debounce = <15625>; - linux,code = <KEY_VOLUMEDOWN>; - }; +&pm8998_resin { + linux,code = <KEY_VOLUMEDOWN>; + status = "okay"; };
&qusb2phy { diff --git a/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi b/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi index 5da87baa2b23b..3bbd5df196bfc 100644 --- a/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8998-sony-xperia-yoshino.dtsi @@ -357,14 +357,9 @@ vib_default: vib-en-state { }; };
-&pm8998_pon { - resin { - compatible = "qcom,pm8941-resin"; - interrupts = <GIC_SPI 0x8 1 IRQ_TYPE_EDGE_BOTH>; - debounce = <15625>; - bias-pull-up; - linux,code = <KEY_VOLUMEUP>; - }; +&pm8998_resin { + linux,code = <KEY_VOLUMEUP>; + status = "okay"; };
&qusb2phy { diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts index f41c6d600ea8c..878801f540c54 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts @@ -615,14 +615,9 @@ vol_up_pin_a: vol-up-active-state { }; };
-&pm8998_pon { - resin { - compatible = "qcom,pm8941-resin"; - interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; - debounce = <15625>; - bias-pull-up; - linux,code = <KEY_VOLUMEDOWN>; - }; +&pm8998_resin { + linux,code = <KEY_VOLUMEDOWN>; + status = "okay"; };
&pmi8998_lpg { diff --git a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi index 1eb423e4be24c..943287804e1a6 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi +++ b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi @@ -482,14 +482,9 @@ &mss_pil { status = "okay"; };
-&pm8998_pon { - resin { - compatible = "qcom,pm8941-resin"; - interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; - debounce = <15625>; - bias-pull-up; - linux,code = <KEY_VOLUMEDOWN>; - }; +&pm8998_resin { + linux,code = <KEY_VOLUMEDOWN>; + status = "okay"; };
&sdhc_2 { diff --git a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts index bb77ccfdc68c0..e6191602c70a8 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts +++ b/arch/arm64/boot/dts/qcom/sdm845-shift-axolotl.dts @@ -522,14 +522,9 @@ pinconf { }; };
-&pm8998_pon { - volume_down_resin: resin { - compatible = "qcom,pm8941-resin"; - interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; - debounce = <15625>; - bias-pull-up; - linux,code = <KEY_VOLUMEDOWN>; - }; +&pm8998_resin { + linux,code = <KEY_VOLUMEDOWN>; + status = "okay"; };
&pmi8998_lpg { diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi index eb6b2b676eca4..1b12b1a4dcbc7 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi @@ -325,14 +325,9 @@ &pmi8998_wled { qcom,cabc; };
-&pm8998_pon { - resin { - compatible = "qcom,pm8941-resin"; - interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; - debounce = <15625>; - bias-pull-up; - linux,code = <KEY_VOLUMEDOWN>; - }; +&pm8998_resin { + linux,code = <KEY_VOLUMEDOWN>; + status = "okay"; };
&pmi8998_rradc { diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts index 38ba809a95cd6..fba229d0bd108 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts +++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-polaris.dts @@ -530,14 +530,9 @@ pinconf { }; };
-&pm8998_pon { - resin { - interrupts = <0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>; - compatible = "qcom,pm8941-resin"; - linux,code = <KEY_VOLUMEDOWN>; - debounce = <15625>; - bias-pull-up; - }; +&pm8998_resin { + linux,code = <KEY_VOLUMEDOWN>; + status = "okay"; };
&q6afedai {
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit 8875b1d71f112b30e4c7e65ed337096bc0cc396b ]
Remove the mention of this PMIC from the common DTSI, as it's not used on PDX214. Add the required nodes to support it on PDX215.
Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221118152028.59312-2-konrad.dybcio@linaro.org Stable-dep-of: dcc7cd5c46ca ("arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys") Signed-off-by: Sasha Levin sashal@kernel.org --- .../qcom/sm8350-sony-xperia-sagami-pdx215.dts | 66 +++++++++++++++++++ .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 2 +- 2 files changed, 67 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts index c74c973a69d2d..d4afaa393c9a9 100644 --- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts +++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts @@ -12,6 +12,72 @@ / { compatible = "sony,pdx215-generic", "qcom,sm8350"; };
+&i2c13 { + pmic@75 { + compatible = "dlg,slg51000"; + reg = <0x75>; + dlg,cs-gpios = <&pm8350b_gpios 1 GPIO_ACTIVE_HIGH>; + + pinctrl-names = "default"; + pinctrl-0 = <&cam_pwr_a_cs>; + + regulators { + slg51000_a_ldo1: ldo1 { + regulator-name = "slg51000_a_ldo1"; + regulator-min-microvolt = <2400000>; + regulator-max-microvolt = <3300000>; + }; + + slg51000_a_ldo2: ldo2 { + regulator-name = "slg51000_a_ldo2"; + regulator-min-microvolt = <2400000>; + regulator-max-microvolt = <3300000>; + }; + + slg51000_a_ldo3: ldo3 { + regulator-name = "slg51000_a_ldo3"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3750000>; + }; + + slg51000_a_ldo4: ldo4 { + regulator-name = "slg51000_a_ldo4"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3750000>; + }; + + slg51000_a_ldo5: ldo5 { + regulator-name = "slg51000_a_ldo5"; + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <1200000>; + }; + + slg51000_a_ldo6: ldo6 { + regulator-name = "slg51000_a_ldo6"; + regulator-min-microvolt = <500000>; + regulator-max-microvolt = <1200000>; + }; + + slg51000_a_ldo7: ldo7 { + regulator-name = "slg51000_a_ldo7"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3750000>; + }; + }; + }; +}; + +&pm8350b_gpios { + cam_pwr_a_cs: cam-pwr-a-cs-state { + pins = "gpio1"; + function = "normal"; + qcom,drive-strength = <PMIC_GPIO_STRENGTH_LOW>; + power-source = <1>; + drive-push-pull; + output-high; + }; +}; + &tlmm { gpio-line-names = "APPS_I2C_0_SDA", /* GPIO_0 */ "APPS_I2C_0_SCL", diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi index 1f2d660f8f86c..a10306d82a3a1 100644 --- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi @@ -3,6 +3,7 @@ * Copyright (c) 2021, Konrad Dybcio konrad.dybcio@somainline.org */
+#include <dt-bindings/pinctrl/qcom,pmic-gpio.h> #include <dt-bindings/regulator/qcom,rpmh-regulator.h> #include "sm8350.dtsi" #include "pm8350.dtsi" @@ -506,7 +507,6 @@ &i2c13 { clock-frequency = <100000>;
/* Qualcomm PM8008i/PM8008j (?) @ 8, 9, c, d */ - /* Dialog SLG51000 CMIC @ 75 */ };
&i2c15 {
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit 7c679f2a2af84edbec0c28171af8c42c6da9af14 ]
Sony ever so graciously provides GPIO line names in their downstream kernel (though sometimes they are not 100% accurate and you can judge that by simply looking at them and with what drivers they are used).
Add these to the PDX213&214 DTSIs to better document the hardware.
Diff between 223 and 224:
pm8350b < gpio-line-names = "NC", /* GPIO_1 */
gpio-line-names = "CAM_PWR_A_CS", /* GPIO_1 */
< "NC",
"CAM_PWR_LD_EN",
pm8350c < "NC",
"WLC_TXPWR_EN",
Which is due to different camera power wiring on 213 and lack of an additional SLG51000 PMIC on 214.
Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221118152028.59312-3-konrad.dybcio@linaro.org Stable-dep-of: dcc7cd5c46ca ("arm64: dts: qcom: sm8350-sagami: Rectify GPIO keys") Signed-off-by: Sasha Levin sashal@kernel.org --- .../qcom/sm8350-sony-xperia-sagami-pdx214.dts | 23 +++++++++++++++++++ .../qcom/sm8350-sony-xperia-sagami-pdx215.dts | 21 +++++++++++++++++ .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 20 ++++++++++++++++ 3 files changed, 64 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts index cc650508dc2d6..e6824c8c2774d 100644 --- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts +++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx214.dts @@ -17,3 +17,26 @@ &framebuffer { height = <2520>; stride = <(1080 * 4)>; }; + +&pm8350b_gpios { + gpio-line-names = "NC", /* GPIO_1 */ + "NC", + "NC", + "NC", + "SNAPSHOT_N", + "NC", + "NC", + "FOCUS_N"; +}; + +&pm8350c_gpios { + gpio-line-names = "FL_STROBE_TRIG_WIDE", /* GPIO_1 */ + "FL_STROBE_TRIG_TELE", + "NC", + "NC", + "NC", + "RGBC_IR_PWR_EN", + "NC", + "NC", + "WIDEC_PWR_EN"; +}; diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts index d4afaa393c9a9..c6f402c3ef352 100644 --- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts +++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami-pdx215.dts @@ -68,6 +68,15 @@ slg51000_a_ldo7: ldo7 { };
&pm8350b_gpios { + gpio-line-names = "CAM_PWR_A_CS", /* GPIO_1 */ + "NC", + "NC", + "NC", + "SNAPSHOT_N", + "CAM_PWR_LD_EN", + "NC", + "FOCUS_N"; + cam_pwr_a_cs: cam-pwr-a-cs-state { pins = "gpio1"; function = "normal"; @@ -78,6 +87,18 @@ cam_pwr_a_cs: cam-pwr-a-cs-state { }; };
+&pm8350c_gpios { + gpio-line-names = "FL_STROBE_TRIG_WIDE", /* GPIO_1 */ + "FL_STROBE_TRIG_TELE", + "NC", + "WLC_TXPWR_EN", + "NC", + "RGBC_IR_PWR_EN", + "NC", + "NC", + "WIDEC_PWR_EN"; +}; + &tlmm { gpio-line-names = "APPS_I2C_0_SDA", /* GPIO_0 */ "APPS_I2C_0_SCL", diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi index a10306d82a3a1..41c4101ec8f08 100644 --- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi @@ -534,6 +534,26 @@ &mpss { firmware-name = "qcom/sm8350/Sony/sagami/modem.mbn"; };
+&pm8350_gpios { + gpio-line-names = "ASSIGN1_THERM", /* GPIO_1 */ + "LCD_ID", + "SDR_MMW_THERM", + "RF_ID", + "NC", + "FP_LDO_EN", + "SP_ARI_PWR_ALARM", + "NC", + "G_ASSIST_N", + "PM8350_OPTION"; /* GPIO_10 */ +}; + +&pmk8350_gpios { + gpio-line-names = "NC", /* GPIO_1 */ + "NC", + "VOL_DOWN_N", + "PMK8350_OPTION"; +}; + &pmk8350_rtc { status = "okay"; };
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit dcc7cd5c46ca5e7bb8e4910ed8259597439c7246 ]
With enough pins set properly, the hardware buttons now also work like a charm.
Fixes: c2721b0c23d9 ("arm64: dts: qcom: Add support for Xperia 1 III / 5 III") Tested-by: Marijn Suijten marijn.suijten@somainline.org # On Xperia 1 III and Xperia 5 III Reviewed-by: Marijn Suijten marijn.suijten@somainline.org Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221229102712.983306-1-konrad.dybcio@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../dts/qcom/sm8350-sony-xperia-sagami.dtsi | 66 ++++++++++++++++++- 1 file changed, 64 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi index 41c4101ec8f08..8df6ccbedfae7 100644 --- a/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8350-sony-xperia-sagami.dtsi @@ -49,7 +49,35 @@ framebuffer: framebuffer@e1000000 { gpio-keys { compatible = "gpio-keys";
- /* For reasons still unknown, GAssist key and Camera Focus/Shutter don't work.. */ + pinctrl-names = "default"; + pinctrl-0 = <&focus_n &snapshot_n &vol_down_n &g_assist_n>; + + key-camera-focus { + label = "Camera Focus"; + linux,code = <KEY_CAMERA_FOCUS>; + gpios = <&pm8350b_gpios 8 GPIO_ACTIVE_LOW>; + debounce-interval = <15>; + linux,can-disable; + wakeup-source; + }; + + key-camera-snapshot { + label = "Camera Snapshot"; + linux,code = <KEY_CAMERA>; + gpios = <&pm8350b_gpios 5 GPIO_ACTIVE_LOW>; + debounce-interval = <15>; + linux,can-disable; + wakeup-source; + }; + + key-google-assist { + label = "Google Assistant Key"; + gpios = <&pm8350_gpios 9 GPIO_ACTIVE_LOW>; + linux,code = <KEY_LEFTMETA>; + debounce-interval = <15>; + linux,can-disable; + wakeup-source; + };
key-vol-down { label = "Volume Down"; @@ -57,7 +85,7 @@ key-vol-down { gpios = <&pmk8350_gpios 3 GPIO_ACTIVE_LOW>; debounce-interval = <15>; linux,can-disable; - gpio-key,wakeup; + wakeup-source; }; };
@@ -545,6 +573,32 @@ &pm8350_gpios { "NC", "G_ASSIST_N", "PM8350_OPTION"; /* GPIO_10 */ + + g_assist_n: g-assist-n-state { + pins = "gpio9"; + function = "normal"; + power-source = <1>; + bias-pull-up; + input-enable; + }; +}; + +&pm8350b_gpios { + snapshot_n: snapshot-n-state { + pins = "gpio5"; + function = "normal"; + power-source = <0>; + bias-pull-up; + input-enable; + }; + + focus_n: focus-n-state { + pins = "gpio8"; + function = "normal"; + power-source = <0>; + input-enable; + bias-pull-up; + }; };
&pmk8350_gpios { @@ -552,6 +606,14 @@ &pmk8350_gpios { "NC", "VOL_DOWN_N", "PMK8350_OPTION"; + + vol_down_n: vol-down-n-state { + pins = "gpio3"; + function = "normal"; + power-source = <0>; + bias-pull-up; + input-enable; + }; };
&pmk8350_rtc {
From: Marijn Suijten marijn.suijten@somainline.org
[ Upstream commit a40f5ae1ea64ab9e981faf47c31817dc4d7923e4 ]
Pinctrl states typically collate multiple related pins. In the case of gpio-keys there's no hardware-defined relation at all except all pins representing a key; and especially on Sony's lena board there's only one pin regardless. Flatten it similar to other boards [1].
As a drive-by fix, clean up the label string.
[1]: https://lore.kernel.org/linux-arm-msm/11174eb6-0a9d-7df1-6f06-da4010f76453@l...
Fixes: 2b8bbe985659 ("arm64: dts: qcom: sm6350-lena: Include pm6350 and configure buttons") Signed-off-by: Marijn Suijten marijn.suijten@somainline.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221222215906.324092-1-marijn.suijten@somainline.... Signed-off-by: Sasha Levin sashal@kernel.org --- .../qcom/sm6350-sony-xperia-lena-pdx213.dts | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts b/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts index 94f77d376662e..4916d0db5b47f 100644 --- a/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts +++ b/arch/arm64/boot/dts/qcom/sm6350-sony-xperia-lena-pdx213.dts @@ -35,10 +35,10 @@ framebuffer: framebuffer@a0000000 { gpio-keys { compatible = "gpio-keys"; pinctrl-names = "default"; - pinctrl-0 = <&gpio_keys_state>; + pinctrl-0 = <&vol_down_n>;
key-volume-down { - label = "volume_down"; + label = "Volume Down"; linux,code = <KEY_VOLUMEDOWN>; gpios = <&pm6350_gpios 2 GPIO_ACTIVE_LOW>; }; @@ -305,14 +305,12 @@ touchscreen@48 { };
&pm6350_gpios { - gpio_keys_state: gpio-keys-state { - key-volume-down-pins { - pins = "gpio2"; - function = PMIC_GPIO_FUNC_NORMAL; - power-source = <0>; - bias-disable; - input-enable; - }; + vol_down_n: vol-down-n-state { + pins = "gpio2"; + function = PMIC_GPIO_FUNC_NORMAL; + power-source = <0>; + bias-disable; + input-enable; }; };
From: Marijn Suijten marijn.suijten@somainline.org
[ Upstream commit 8416262b0ea46d84767141b074748f4d4f37736a ]
Reorder the clocks and corresponding names to match the QUSB2 phy schema, fixing the following CHECK_DTBS errors:
arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:0: 'cfg_ahb' was expected From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:1: 'ref' was expected From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml
Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125") Signed-off-by: Marijn Suijten marijn.suijten@somainline.org Reviewed-by: Martin Botka martin.botka@somainline.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221216213343.1140143-1-marijn.suijten@somainline... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm6125.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi index 7e25a4f85594f..bf9e8d45ee44f 100644 --- a/arch/arm64/boot/dts/qcom/sm6125.dtsi +++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi @@ -442,9 +442,9 @@ hsusb_phy1: phy@1613000 { reg = <0x01613000 0x180>; #phy-cells = <0>;
- clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>, - <&gcc GCC_AHB2PHY_USB_CLK>; - clock-names = "ref", "cfg_ahb"; + clocks = <&gcc GCC_AHB2PHY_USB_CLK>, + <&rpmcc RPM_SMD_XO_CLK_SRC>; + clock-names = "cfg_ahb", "ref";
resets = <&gcc GCC_QUSB2PHY_PRIM_BCR>; status = "disabled";
From: Marijn Suijten marijn.suijten@somainline.org
[ Upstream commit a9f6a13da473bb6c7406d2784d9e3792f6763cba ]
- Remove autorepeat (leave key repetition to userspace); - Remove unneeded status = "okay" (this is the default); - Remove unneeded linux,input-type <EV_KEY> (this is the default for gpio-keys); - Allow the interrupt line for this button to be disabled; - Use a full, descriptive node name; - Set proper bias on the GPIO via pinctrl; - Sort properties; - Replace deprecated gpio-key,wakeup property with wakeup-source.
Fixes: 82e1783890b7 ("arm64: dts: qcom: sm6125: Add support for Sony Xperia 10II") Signed-off-by: Marijn Suijten marijn.suijten@somainline.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221222192443.119103-1-marijn.suijten@somainline.... Signed-off-by: Sasha Levin sashal@kernel.org --- .../qcom/sm6125-sony-xperia-seine-pdx201.dts | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts b/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts index 0de6c5b7f742e..09cff5d1d0ae8 100644 --- a/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts +++ b/arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts @@ -41,17 +41,18 @@ extcon_usb: extcon-usb { };
gpio-keys { - status = "okay"; compatible = "gpio-keys"; - autorepeat;
- key-vol-dn { + pinctrl-0 = <&vol_down_n>; + pinctrl-names = "default"; + + key-volume-down { label = "Volume Down"; gpios = <&tlmm 47 GPIO_ACTIVE_LOW>; - linux,input-type = <1>; linux,code = <KEY_VOLUMEDOWN>; - gpio-key,wakeup; debounce-interval = <15>; + linux,can-disable; + wakeup-source; }; };
@@ -270,6 +271,14 @@ &sdhc_1 {
&tlmm { gpio-reserved-ranges = <22 2>, <28 6>; + + vol_down_n: vol-down-n-state { + pins = "gpio47"; + function = "gpio"; + drive-strength = <2>; + bias-disable; + input-enable; + }; };
&usb3 {
From: Marek Vasut marex@denx.de
[ Upstream commit ee0d68f219be8618f53d3f8808952e20525e3f30 ]
Align the SoC unique ID DT node unit address with its reg property.
Reviewed-by: Peng Fan peng.fan@nxp.com Fixes: cbff23797fa1 ("arm64: dts: imx8m: add NVMEM provider and consumer to read soc unique ID") Signed-off-by: Marek Vasut marex@denx.de Signed-off-by: Shawn Guo shawnguo@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi index 4ee89fdcf59bd..b45852e8087a9 100644 --- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi @@ -563,7 +563,7 @@ ocotp: efuse@30350000 { #address-cells = <1>; #size-cells = <1>;
- imx8mm_uid: unique-id@410 { + imx8mm_uid: unique-id@4 { reg = <0x4 0x8>; };
diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi index b7d91df71cc26..7601a031f85a0 100644 --- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi @@ -564,7 +564,7 @@ ocotp: efuse@30350000 { #address-cells = <1>; #size-cells = <1>;
- imx8mn_uid: unique-id@410 { + imx8mn_uid: unique-id@4 { reg = <0x4 0x8>; };
diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi index 03034b439c1f7..bafe0a572f7e9 100644 --- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi @@ -425,7 +425,7 @@ ocotp: efuse@30350000 { #address-cells = <1>; #size-cells = <1>;
- imx8mp_uid: unique-id@420 { + imx8mp_uid: unique-id@8 { reg = <0x8 0x8>; };
diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi index 7ce99c084e545..6eb5a98bb1bd4 100644 --- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi @@ -593,7 +593,7 @@ ocotp: efuse@30350000 { #address-cells = <1>; #size-cells = <1>;
- imx8mq_uid: soc-uid@410 { + imx8mq_uid: soc-uid@4 { reg = <0x4 0x8>; };
From: Qiheng Lin linqiheng@huawei.com
[ Upstream commit 9eedb910a3be0005b88c696a8552c0d4c9937cd4 ]
of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on error path. Add missing of_node_put() to avoid refcount leak.
Fixes: 3329659df030 ("ARM: zynq: Simplify SLCR initialization") Signed-off-by: Qiheng Lin linqiheng@huawei.com Link: https://lore.kernel.org/r/20221129140544.41293-1-linqiheng@huawei.com Signed-off-by: Michal Simek michal.simek@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/mach-zynq/slcr.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-zynq/slcr.c b/arch/arm/mach-zynq/slcr.c index 37707614885a5..9765b3f4c2fc5 100644 --- a/arch/arm/mach-zynq/slcr.c +++ b/arch/arm/mach-zynq/slcr.c @@ -213,6 +213,7 @@ int __init zynq_early_slcr_init(void) zynq_slcr_regmap = syscon_regmap_lookup_by_compatible("xlnx,zynq-slcr"); if (IS_ERR(zynq_slcr_regmap)) { pr_err("%s: failed to find zynq-slcr\n", __func__); + of_node_put(np); return -ENODEV; }
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 8113aa91360a013ebe00763bb0823b5a41b11c4d ]
It should check 'cb_cache', after calling kmem_cache_create("dlm_cb").
Fixes: 61bed0baa4db ("fs: dlm: use a non-static queue for callbacks") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: David Teigland teigland@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/dlm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c index eb7a08641fcf5..cdbaa452fc05a 100644 --- a/fs/dlm/memory.c +++ b/fs/dlm/memory.c @@ -51,7 +51,7 @@ int __init dlm_memory_init(void) cb_cache = kmem_cache_create("dlm_cb", sizeof(struct dlm_callback), __alignof__(struct dlm_callback), 0, NULL); - if (!rsb_cache) + if (!cb_cache) goto cb;
return 0;
From: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
[ Upstream commit a9f6721a3c92764582ed12296292fda4a7f2dd25 ]
Assign power domain to the U3PHY1 T-PHY in otder to keep this PHY alive after unused PD shutdown and to be able to completely cut and restore power to it, for example, to save some power during system suspend/sleep.
Fixes: 2b515194bf0c ("arm64: dts: mt8195: Add power domains controller") Signed-off-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20221214131117.108008-2-angelogioacchino.delregno@... Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi index c10cfeb1214d5..d6856691fc385 100644 --- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi @@ -1549,6 +1549,7 @@ u3phy1: t-phy@11e30000 { #address-cells = <1>; #size-cells = <1>; ranges = <0 0 0x11e30000 0xe00>; + power-domains = <&spm MT8195_POWER_DOMAIN_SSUSB_PCIE_PHY>; status = "disabled";
u2port1: usb-phy@0 {
From: Chen-Yu Tsai wenst@chromium.org
[ Upstream commit ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 ]
The systimer block derives its 13 MHz clock by dividing the main 26 MHz oscillator clock by 2 internally, not through the TOPCKGEN clock controller.
On the MT8183 this divider is set either by power-on-reset or by the bootloader. The bootloader may then make the divider unconfigurable to, but can be read out by, the operating system.
Making the systimer block take the 26 MHz clock directly requires changing the implementations. As an ABI compatible fix, change the input clock of the systimer block a fixed factor divide-by-2 clock that takes the 26 MHz oscillator as its input.
Fixes: 5bc8e2875ffb ("arm64: dts: mt8183: add systimer0 device node") Signed-off-by: Chen-Yu Tsai wenst@chromium.org Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20221201084229.3464449-2-wenst@chromium.org Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi index 402136bfd5350..268a1f28af8ce 100644 --- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi @@ -585,6 +585,15 @@ psci { method = "smc"; };
+ clk13m: fixed-factor-clock-13m { + compatible = "fixed-factor-clock"; + #clock-cells = <0>; + clocks = <&clk26m>; + clock-div = <2>; + clock-mult = <1>; + clock-output-names = "clk13m"; + }; + clk26m: oscillator { compatible = "fixed-clock"; #clock-cells = <0>; @@ -968,8 +977,7 @@ systimer: timer@10017000 { "mediatek,mt6765-timer"; reg = <0 0x10017000 0 0x1000>; interrupts = <GIC_SPI 200 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&topckgen CLK_TOP_CLK13M>; - clock-names = "clk13m"; + clocks = <&clk13m>; };
iommu: iommu@10205000 {
From: Chen-Yu Tsai wenst@chromium.org
[ Upstream commit f19f68e56b0c6631984a9f5023035d4bd09612bb ]
The systimer block derives its 13 MHz clock by dividing the main 26 MHz oscillator clock by 2 internally, not through the TOPCKGEN clock controller.
On the MT8192 this divider is fixed to /2 and is not configurable.
Making the systimer block take the 26 MHz clock directly requires changing the implementations. As an ABI compatible fix, change the input clock of the systimer block a fixed factor divide-by-2 clock that takes the 26 MHz oscillator as its input.
Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile") Signed-off-by: Chen-Yu Tsai wenst@chromium.org Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20221201084229.3464449-3-wenst@chromium.org Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8192.dtsi | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi index 424fc89cc6f7c..0d43a32734a37 100644 --- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi @@ -29,6 +29,15 @@ aliases { rdma4 = &rdma4; };
+ clk13m: fixed-factor-clock-13m { + compatible = "fixed-factor-clock"; + #clock-cells = <0>; + clocks = <&clk26m>; + clock-div = <2>; + clock-mult = <1>; + clock-output-names = "clk13m"; + }; + clk26m: oscillator0 { compatible = "fixed-clock"; #clock-cells = <0>; @@ -534,8 +543,7 @@ systimer: timer@10017000 { "mediatek,mt6765-timer"; reg = <0 0x10017000 0 0x1000>; interrupts = <GIC_SPI 233 IRQ_TYPE_LEVEL_HIGH 0>; - clocks = <&topckgen CLK_TOP_CSW_F26M_D2>; - clock-names = "clk13m"; + clocks = <&clk13m>; };
pwrap: pwrap@10026000 {
From: Chen-Yu Tsai wenst@chromium.org
[ Upstream commit 0f1c806b65d136a5fe0b88adad5ff1cb451fc401 ]
The systimer block derives its 13 MHz clock by dividing the main 26 MHz oscillator clock by 2 internally, not through the TOPCKGEN clock controller.
On the MT8195 this divider is set either by power-on-reset or by the bootloader. The bootloader may then make the divider unconfigurable to, but can be read out by, the operating system.
Making the systimer block take the 26 MHz clock directly requires changing the implementations. As an ABI compatible fix, change the input clock of the systimer block a fixed factor divide-by-2 clock that takes the 26 MHz oscillator as its input.
Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board") Signed-off-by: Chen-Yu Tsai wenst@chromium.org Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20221201084229.3464449-4-wenst@chromium.org Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi index d6856691fc385..d8d846a57d97f 100644 --- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi @@ -248,6 +248,15 @@ sound: mt8195-sound { status = "disabled"; };
+ clk13m: fixed-factor-clock-13m { + compatible = "fixed-factor-clock"; + #clock-cells = <0>; + clocks = <&clk26m>; + clock-div = <2>; + clock-mult = <1>; + clock-output-names = "clk13m"; + }; + clk26m: oscillator-26m { compatible = "fixed-clock"; #clock-cells = <0>; @@ -705,7 +714,7 @@ systimer: timer@10017000 { "mediatek,mt6765-timer"; reg = <0 0x10017000 0 0x1000>; interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH 0>; - clocks = <&topckgen CLK_TOP_CLK26M_D2>; + clocks = <&clk13m>; };
pwrap: pwrap@10024000 {
From: Chen-Yu Tsai wenst@chromium.org
[ Upstream commit b391efba57ff085233d5ead5e01817bf4b71d999 ]
The systimer block derives its 13 MHz clock by dividing the main 26 MHz oscillator clock by 2 internally. The 13 MHz clock is not a separate oscillator.
Fix this by making the 13 MHz clock a divide-by-2 fixed factor clock, taking its input from the main 26 MHz oscillator.
Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile") Signed-off-by: Chen-Yu Tsai wenst@chromium.org Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20221201084229.3464449-5-wenst@chromium.org Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8186.dtsi | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi index c326aeb33a109..857b0c22422f4 100644 --- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi @@ -214,10 +214,12 @@ l3_0: l3-cache { }; };
- clk13m: oscillator-13m { - compatible = "fixed-clock"; + clk13m: fixed-factor-clock-13m { + compatible = "fixed-factor-clock"; #clock-cells = <0>; - clock-frequency = <13000000>; + clocks = <&clk26m>; + clock-div = <2>; + clock-mult = <1>; clock-output-names = "clk13m"; };
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit 740862bb5f59b93efb390a417995f88a64bdc323 ]
The pin config entry should have a string, not number, for the GPIO used as WCD9340 audio codec interrupt.
Fixes: 89a32a4e769c ("arm64: dts: qcom: db845c: add analog audio support") Reported-by: Doug Anderson dianders@chromium.org Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Douglas Anderson dianders@chromium.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221222151319.122398-1-krzysztof.kozlowski@linaro... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts index 878801f540c54..75a4645936232 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts @@ -974,7 +974,7 @@ sdc2_card_det_n: sd-card-det-n { };
wcd_intr_default: wcd_intr_default { - pins = <54>; + pins = "gpio54"; function = "gpio";
input-enable;
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit e5011447376e1b050847ccb2ef7933176ce4de41 ]
The pin config entry should have a string, not number, for the GPIO used as WCD9340 audio codec interrupt.
Fixes: dd6459a0890a ("arm64: dts: qcom: split beryllium dts into common dtsi and tianma dts") Reported-by: Doug Anderson dianders@chromium.org Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Douglas Anderson dianders@chromium.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221222151319.122398-2-krzysztof.kozlowski@linaro... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi index 1b12b1a4dcbc7..d2866155dd870 100644 --- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi +++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium-common.dtsi @@ -467,7 +467,7 @@ sdc2_card_det_n: sd-card-det-n { };
wcd_intr_default: wcd_intr_default { - pins = <54>; + pins = "gpio54"; function = "gpio";
input-enable;
From: Kishon Vijay Abraham I kvijayab@amd.com
[ Upstream commit e2869bd7af608c343988429ceb1c2fe99644a01f ]
Section 5.2.12.12 Processor Local x2APIC Structure in the ACPI v6.5 spec mandates that both "enabled" and "online capable" Local APIC Flags should be used to determine if the processor is usable or not.
However, Linux doesn't use the "online capable" flag for x2APIC to determine if the processor is usable. As a result, cpu_possible_mask has incorrect value and results in more memory getting allocated for per_cpu variables than it is going to be used.
Make sure Linux parses both "enabled" and "online capable" flags for x2APIC to correctly determine if the processor is usable.
Fixes: aa06e20f1be6 ("x86/ACPI: Don't add CPUs that are not online capable") Reported-by: Leo Duran leo.duran@amd.com Signed-off-by: Kishon Vijay Abraham I kvijayab@amd.com Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Reviewed-by: Borislav Petkov (AMD) bp@alien8.de Reviewed-by: Zhang Rui rui.zhang@intel.com Acked-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Link: https://lore.kernel.org/r/20230105041059.39366-1-kvijayab@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/kernel/acpi/boot.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 907cc98b19380..518bda50068cb 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -188,6 +188,17 @@ static int acpi_register_lapic(int id, u32 acpiid, u8 enabled) return cpu; }
+static bool __init acpi_is_processor_usable(u32 lapic_flags) +{ + if (lapic_flags & ACPI_MADT_ENABLED) + return true; + + if (acpi_support_online_capable && (lapic_flags & ACPI_MADT_ONLINE_CAPABLE)) + return true; + + return false; +} + static int __init acpi_parse_x2apic(union acpi_subtable_headers *header, const unsigned long end) { @@ -212,6 +223,10 @@ acpi_parse_x2apic(union acpi_subtable_headers *header, const unsigned long end) if (apic_id == 0xffffffff) return 0;
+ /* don't register processors that cannot be onlined */ + if (!acpi_is_processor_usable(processor->lapic_flags)) + return 0; + /* * We need to register disabled CPU as well to permit * counting disabled CPUs. This allows us to size @@ -250,9 +265,7 @@ acpi_parse_lapic(union acpi_subtable_headers * header, const unsigned long end) return 0;
/* don't register processors that can not be onlined */ - if (acpi_support_online_capable && - !(processor->lapic_flags & ACPI_MADT_ENABLED) && - !(processor->lapic_flags & ACPI_MADT_ONLINE_CAPABLE)) + if (!acpi_is_processor_usable(processor->lapic_flags)) return 0;
/*
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit 1f75745537222172f84783d369bbd1fb2d4b6414 ]
The SPMI bus uses two address cells and zero size cells (second reg entry - SPMI_USID - is not the size):
spmi@c440000: #address-cells:0:0: 2 was expected
Fixes: 0f9dc5f09fbd ("arm64: dts: qcom: sc7180: Add SPMI PMIC arbiter device") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Stephen Boyd swboyd@chromium.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221213101921.47924-1-krzysztof.kozlowski@linaro.... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi index f71cf21a8dd8a..e45726be81c82 100644 --- a/arch/arm64/boot/dts/qcom/sc7180.dtsi +++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi @@ -3274,8 +3274,8 @@ spmi_bus: spmi@c440000 { interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; qcom,ee = <0>; qcom,channel = <0>; - #address-cells = <1>; - #size-cells = <1>; + #address-cells = <2>; + #size-cells = <0>; interrupt-controller; #interrupt-cells = <4>; cell-index = <0>;
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit 8da3786a91e56fe0c4aeb2c2209744474af6e517 ]
The SPMI bus uses two address cells and zero size cells (second reg entry - SPMI_USID - is not the size):
spmi@c440000: #address-cells:0:0: 2 was expected
Fixes: 14abf8dfe364 ("arm64: dts: qcom: sc7280: Add SPMI PMIC arbiter device for SC7280") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Stephen Boyd swboyd@chromium.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221213101921.47924-2-krzysztof.kozlowski@linaro.... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi index 0adf13399e649..3bedd45e14afd 100644 --- a/arch/arm64/boot/dts/qcom/sc7280.dtsi +++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi @@ -4246,8 +4246,8 @@ spmi_bus: spmi@c440000 { interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; qcom,ee = <0>; qcom,channel = <0>; - #address-cells = <1>; - #size-cells = <1>; + #address-cells = <2>; + #size-cells = <0>; interrupt-controller; #interrupt-cells = <4>; };
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit 76d9e8b4d54ae2cb91a68f0cb82624887de767a7 ]
The SPMI bus uses two address cells and zero size cells (second reg entry - SPMI_USID - is not the size):
spmi@c440000: #address-cells:0:0: 2 was expected
Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Stephen Boyd swboyd@chromium.org Reviewed-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221213101921.47924-3-krzysztof.kozlowski@linaro.... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi index 71cf81a8eb4da..d1bc0e60cfd47 100644 --- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi @@ -2051,8 +2051,8 @@ spmi_bus: spmi@c440000 { interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; qcom,ee = <0>; qcom,channel = <0>; - #address-cells = <1>; - #size-cells = <1>; + #address-cells = <2>; + #size-cells = <0>; interrupt-controller; #interrupt-cells = <4>; };
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit 5eafe69af43d77cb117f27201076ee50f48363f1 ]
The bindings expect second Soundwire interrupt to be "wakeup" (Linux driver takes by index):
sm8450-hdk.dtb: soundwire-controller@33b0000: interrupt-names:1: 'wakeup' was expected
Fixes: 14341e76dbc7 ("arm64: dts: qcom: sm8450: add Soundwire and LPASS") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221223132121.81130-1-krzysztof.kozlowski@linaro.... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi index 570475040d95c..eb3318516243c 100644 --- a/arch/arm64/boot/dts/qcom/sm8450.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi @@ -2263,7 +2263,7 @@ swr2: soundwire-controller@33b0000 { reg = <0 0x33b0000 0 0x2000>; interrupts-extended = <&intc GIC_SPI 496 IRQ_TYPE_LEVEL_HIGH>, <&intc GIC_SPI 520 IRQ_TYPE_LEVEL_HIGH>; - interrupt-names = "core", "wake"; + interrupt-names = "core", "wakeup";
clocks = <&vamacro>; clock-names = "iface";
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 19e509d5ea229244b9205f8671bb75b13738a1f9 ]
Drop the #clock-cells (probably a leftover from the times before the DP PHY split)
Fixes: eaac4e55a6f4 ("arm64: dts: qcom: sdm845: add displayport node") Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Reviewed-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230110042126.702147-1-dmitry.baryshkov@linaro.or... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 - 1 file changed, 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi index 65032b94b46d6..f36c23e7a2248 100644 --- a/arch/arm64/boot/dts/qcom/sdm845.dtsi +++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi @@ -4593,7 +4593,6 @@ mdss_dp: displayport-controller@ae90000 { <&dispcc DISP_CC_MDSS_DP_PIXEL_CLK>; clock-names = "core_iface", "core_aux", "ctrl_link", "ctrl_link_iface", "stream_pixel"; - #clock-cells = <1>; assigned-clocks = <&dispcc DISP_CC_MDSS_DP_LINK_CLK_SRC>, <&dispcc DISP_CC_MDSS_DP_PIXEL_CLK_SRC>; assigned-clock-parents = <&dp_phy 0>, <&dp_phy 1>;
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 1de4e112b97c77efb5cbee39db8541e33dd2b0d5 ]
14nm DSI PHY has the only supply, vcca. Drop the extra vdda-supply.
Fixes: 5a134c940cd3 ("arm64: dts: qcom: msm8996: add support for oneplus3(t)") Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230109042406.312047-1-dmitry.baryshkov@linaro.or... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi | 1 - 1 file changed, 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi index 20f5c103c63b7..2994337c60464 100644 --- a/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8996-oneplus-common.dtsi @@ -179,7 +179,6 @@ &dsi0_out { };
&dsi0_phy { - vdda-supply = <&vreg_l2a_1p25>; vcca-supply = <&vreg_l28a_0p925>; status = "okay"; };
From: Bjorn Andersson quic_bjorande@quicinc.com
[ Upstream commit fe07640280cd29ac2997a617a1fb5487feef9387 ]
Running GCC_USB30_*_MASTER_CLK at 200MHz requires CX at nominal level, not doing so results in occasional lockups. This was previously hidden by the fact that the display stack incorrectly voted for CX (instead of MMCX).
Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") Signed-off-by: Bjorn Andersson quic_bjorande@quicinc.com Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230112135117.3836655-1-quic_bjorande@quicinc.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi index d1bc0e60cfd47..8363e82369854 100644 --- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi @@ -1863,6 +1863,7 @@ usb_0: usb@a6f8800 { "ss_phy_irq";
power-domains = <&gcc USB30_PRIM_GDSC>; + required-opps = <&rpmhpd_opp_nom>;
resets = <&gcc GCC_USB30_PRIM_BCR>;
@@ -1917,6 +1918,7 @@ usb_1: usb@a8f8800 { "ss_phy_irq";
power-domains = <&gcc USB30_SEC_GDSC>; + required-opps = <&rpmhpd_opp_nom>;
resets = <&gcc GCC_USB30_SEC_BCR>;
From: Martin Blumenstingl martin.blumenstingl@googlemail.com
[ Upstream commit f95acdb2b4af21caae2c76a48e565158181386ca ]
Unit addresses should be written using lower-case hex characters. Use wifi_mac@c to fix a yaml schema validation error once the eFuse dt-bindings have been converted to a yaml schema: efuse: Unevaluated properties are not allowed ('wifi_mac@C' was unexpected)
Also node names should use hyphens instead of underscores as the latter can also cause warnings.
Fixes: abfaae24ecf3 ("arm64: dts: meson-gxl: add support for JetHub H1") Acked-by: Vyacheslav Bocharov adeep@lexina.in Signed-off-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Link: https://lore.kernel.org/r/20230111211350.1461860-2-martin.blumenstingl@googl... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts index 6831137c5c109..270483e007bc8 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts @@ -90,7 +90,7 @@ bt_mac: bt_mac@6 { reg = <0x6 0x6>; };
- wifi_mac: wifi_mac@C { + wifi_mac: wifi-mac@c { reg = <0xc 0x6>; }; };
From: Martin Blumenstingl martin.blumenstingl@googlemail.com
[ Upstream commit cb199de1d3aecb02556d8a6e26393015effa0a9f ]
Node names should use hyphens instead of underscores to not cause warnings.
Fixes: abfaae24ecf3 ("arm64: dts: meson-gxl: add support for JetHub H1") Suggested-by: Vyacheslav Bocharov adeep@lexina.in Signed-off-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Link: https://lore.kernel.org/r/20230111211350.1461860-3-martin.blumenstingl@googl... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts index 270483e007bc8..bb7412070cb26 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts @@ -86,7 +86,7 @@ sdio_pwrseq: sdio-pwrseq { };
&efuse { - bt_mac: bt_mac@6 { + bt_mac: bt-mac@6 { reg = <0x6 0x6>; };
From: Martin Blumenstingl martin.blumenstingl@googlemail.com
[ Upstream commit 2f66eeb06e3e8b1cac9e9093be3baadbac2709eb ]
Node names should use hyphens instead of underscores to not cause warnings.
Fixes: 59ec069d5055 ("arm64: dts: meson-axg: add support for JetHub D1p (j110)") Signed-off-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Link: https://lore.kernel.org/r/20230111211350.1461860-4-martin.blumenstingl@googl... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi index 5836b00309312..22fd43b5fd73c 100644 --- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi @@ -168,15 +168,15 @@ sn: sn@32 { reg = <0x32 0x20>; };
- eth_mac: eth_mac@0 { + eth_mac: eth-mac@0 { reg = <0x0 0x6>; };
- bt_mac: bt_mac@6 { + bt_mac: bt-mac@6 { reg = <0x6 0x6>; };
- wifi_mac: wifi_mac@c { + wifi_mac: wifi-mac@c { reg = <0xc 0x6>; };
From: Martin Blumenstingl martin.blumenstingl@googlemail.com
[ Upstream commit 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 ]
Unit names should use hyphens instead of underscores to not cause warnings.
Fixes: bfe59f92d306 ("ARM64: dts: amlogic: gxbb: Enable NVMEM") Suggested-by: Vyacheslav Bocharov adeep@lexina.in Signed-off-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Link: https://lore.kernel.org/r/20230111211350.1461860-5-martin.blumenstingl@googl... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi index 5eed15035b674..4371230b8fe31 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi @@ -233,7 +233,7 @@ sn: sn@14 { reg = <0x14 0x10>; };
- eth_mac: eth_mac@34 { + eth_mac: eth-mac@34 { reg = <0x34 0x10>; };
From: Martin Blumenstingl martin.blumenstingl@googlemail.com
[ Upstream commit e7303651bbc76c848007f1cfac1fbeaa65f600d1 ]
Documentation/devicetree/bindings/net/ethernet-phy.yaml defines that the node name for Ethernet PHYs should match the following pattern: ^ethernet-phy(@[a-f0-9]+)?$
Replace the underscore with a hyphen to adhere to this binding.
Fixes: 280c17df8fbf ("arm64: dts: meson: g12a: add mdio multiplexer") Signed-off-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Link: https://lore.kernel.org/r/20230111211350.1461860-6-martin.blumenstingl@googl... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi index 7f55d97f6c283..c063a144e0e7b 100644 --- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi @@ -1694,7 +1694,7 @@ int_mdio: mdio@1 { #address-cells = <1>; #size-cells = <0>;
- internal_ephy: ethernet_phy@8 { + internal_ephy: ethernet-phy@8 { compatible = "ethernet-phy-id0180.3301", "ethernet-phy-ieee802.3-c22"; interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
From: Martin Blumenstingl martin.blumenstingl@googlemail.com
[ Upstream commit f189c869ad92787ddd753558bcbae89d75825bb6 ]
Node names should be generic and use hyphens instead of underscores to not cause warnings. Also nodes without a reg property should not have a unit-address. Change the scpi_dvfs node to use clock-controller as node name without a unit address (since it does not have a reg property).
Fixes: 70db166a2baa ("ARM64: dts: meson-gxbb: Add SCPI with cpufreq & sensors Nodes") Signed-off-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Link: https://lore.kernel.org/r/20230111211350.1461860-7-martin.blumenstingl@googl... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi index 4371230b8fe31..09a016fd828aa 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi @@ -250,7 +250,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks";
- scpi_dvfs: scpi_clocks@0 { + scpi_dvfs: clock-controller { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
From: Peter Zijlstra peterz@infradead.org
[ Upstream commit 6d9c7f51b1d9179bf7c3542267c656a934e8af23 ]
So objtool found this bug:
vmlinux.o: warning: objtool: intel_idle_irq+0x10c: call to trace_hardirqs_off() leaves .noinstr.text section
As per commit 32d4fd5751ea ("cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE"):
"must not have tracing in idle functions"
Clearly people can't read and tinker along until splat dissapears. This straight up reverts commit d295ad34f236 ("intel_idle: Fix false positive RCU splats due to incorrect hardirqs state").
It doesn't re-introduce the problem because preceding patches fixed it properly.
Fixes: d295ad34f236 ("intel_idle: Fix false positive RCU splats due to incorrect hardirqs state") Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Signed-off-by: Ingo Molnar mingo@kernel.org Tested-by: Tony Lindgren tony@atomide.com Tested-by: Ulf Hansson ulf.hansson@linaro.org Acked-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Acked-by: Frederic Weisbecker frederic@kernel.org Link: https://lore.kernel.org/r/20230112195540.434302128@infradead.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/idle/intel_idle.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c index cfeb24d40d378..f060ac7376e69 100644 --- a/drivers/idle/intel_idle.c +++ b/drivers/idle/intel_idle.c @@ -168,13 +168,7 @@ static __cpuidle int intel_idle_irq(struct cpuidle_device *dev,
raw_local_irq_enable(); ret = __intel_idle(dev, drv, index); - - /* - * The lockdep hardirqs state may be changed to 'on' with timer - * tick interrupt followed by __do_softirq(). Use local_irq_disable() - * to keep the hardirqs state correct. - */ - local_irq_disable(); + raw_local_irq_disable();
return ret; }
From: Dhruva Gole d-gole@ti.com
[ Upstream commit 6be5d8e5d1804eb4cec29cd8a85dc9cb18683b5d ]
Fixes the clock Device ID's in the DT according to the tisci docs clock identifiers for AM62x
Fixes: c37c58fdeb8a ("arm64: dts: ti: k3-am62: Add more peripheral nodes") Reviewed-by: Bryan Brattlof bb@ti.com Signed-off-by: Dhruva Gole d-gole@ti.com Signed-off-by: Vignesh Raghavendra vigneshr@ti.com Link: https://lore.kernel.org/r/20230103054840.1133711-1-d-gole@ti.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi index 072903649d6ee..ae1ec58117c35 100644 --- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi +++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi @@ -413,7 +413,7 @@ main_spi0: spi@20100000 { #address-cells = <1>; #size-cells = <0>; power-domains = <&k3_pds 141 TI_SCI_PD_EXCLUSIVE>; - clocks = <&k3_clks 172 0>; + clocks = <&k3_clks 141 0>; status = "disabled"; };
@@ -424,7 +424,7 @@ main_spi1: spi@20110000 { #address-cells = <1>; #size-cells = <0>; power-domains = <&k3_pds 142 TI_SCI_PD_EXCLUSIVE>; - clocks = <&k3_clks 173 0>; + clocks = <&k3_clks 142 0>; status = "disabled"; };
@@ -435,7 +435,7 @@ main_spi2: spi@20120000 { #address-cells = <1>; #size-cells = <0>; power-domains = <&k3_pds 143 TI_SCI_PD_EXCLUSIVE>; - clocks = <&k3_clks 174 0>; + clocks = <&k3_clks 143 0>; status = "disabled"; };
From: Thierry Reding treding@nvidia.com
[ Upstream commit 29bcc1eaca315326d1cc883fbe9b451d1f9e3fa5 ]
When the top-level regulators were renamed, the 1.2V camera regulator accidentally ended up with the same DT node name as the 1.8V camera regulator.
Fixes: 097e01c61015 ("arm64: tegra: Rename top-level regulators") Signed-off-by: Thierry Reding treding@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi index dd9a17922fe5c..a87e103f3828d 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi @@ -1667,7 +1667,7 @@ vdd_hdmi: regulator-vdd-hdmi { vin-supply = <&vdd_5v0_sys>; };
- vdd_cam_1v2: regulator-vdd-cam-1v8 { + vdd_cam_1v2: regulator-vdd-cam-1v2 { compatible = "regulator-fixed"; regulator-name = "vdd-cam-1v2"; regulator-min-microvolt = <1200000>;
From: Petr Vorel petr.vorel@gmail.com
[ Upstream commit 26a91359aea4d89e7d3646d806eed0f3755b74bd ]
Original google firmware reports 12 MiB: [ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000003400000, size 12 MiB, limit 0xffffffffffffffff
which is actually 12*1024*1024 = 0xc00000.
This matches the aosp source [1]: &cont_splash_mem { reg = <0 0x03400000 0 0xc00000>; };
Fixes: 3cb6a271f4b0 ("arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem mapping") Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994")
[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/a...
Signed-off-by: Petr Vorel petr.vorel@gmail.com Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221226185440.440968-2-pevik@seznam.cz Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi index 79de9cc395c4c..123ec67fb385a 100644 --- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi @@ -2,7 +2,7 @@ /* * Copyright (c) 2015, LGE Inc. All rights reserved. * Copyright (c) 2016, The Linux Foundation. All rights reserved. - * Copyright (c) 2021, Petr Vorel petr.vorel@gmail.com + * Copyright (c) 2021-2022, Petr Vorel petr.vorel@gmail.com * Copyright (c) 2022, Dominik Kobinski dominikkobinski314@gmail.com */
@@ -49,7 +49,7 @@ ramoops@1ff00000 { };
cont_splash_mem: memory@3400000 { - reg = <0 0x03400000 0 0x1200000>; + reg = <0 0x03400000 0 0xc00000>; no-map; };
From: Petr Vorel petr.vorel@gmail.com
[ Upstream commit 4dee5aa44b924036511a744ceb3abb1ceeb96bb6 ]
It's disabled on downstream [1] thus not shown on downstream dmesg.
Removing it fixes warnings on v6.1:
[ 0.000000] OF: reserved mem: OVERLAP DETECTED! [ 0.000000] dfps_data_mem@3400000 (0x0000000003400000--0x0000000003401000) overlaps with memory@3400000 (0x0000000003400000--0x0000000004600000)
[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/a...
Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994")
Signed-off-by: Petr Vorel petr.vorel@gmail.com Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221226185440.440968-3-pevik@seznam.cz Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi index 123ec67fb385a..4bceb362a5c02 100644 --- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi @@ -15,6 +15,9 @@ /* cont_splash_mem has different memory mapping */ /delete-node/ &cont_splash_mem;
+/* disabled on downstream, conflicts with cont_splash_mem */ +/delete-node/ &dfps_data_mem; + / { model = "LG Nexus 5X"; compatible = "lg,bullhead", "qcom,msm8992";
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 0b3aa9aa629c10928e86f6c9666a5e0b14655b2a ]
The slope values used during tsens calibration differ between msm8976 and msm8956 SoCs. Use SoC-specific compat value for the msm8956 SoC.
Fixes: 0484d3ce0902 ("arm64: dts: qcom: Add DTS for MSM8976 and MSM8956 SoCs") Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230101194034.831222-16-dmitry.baryshkov@linaro.o... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8956.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/msm8956.dtsi b/arch/arm64/boot/dts/qcom/msm8956.dtsi index e432512d8716a..668e05185c21e 100644 --- a/arch/arm64/boot/dts/qcom/msm8956.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8956.dtsi @@ -12,6 +12,10 @@ &pmu { interrupts = <GIC_PPI 7 (GIC_CPU_MASK_SIMPLE(6) | IRQ_TYPE_LEVEL_HIGH)>; };
+&tsens { + compatible = "qcom,msm8956-tsens", "qcom,tsens-v1"; +}; + /* * You might be wondering.. why is it so empty out there? * Well, the SoCs are almost identical.
From: Robert Marko robimarko@gmail.com
[ Upstream commit 877cff3568c0f54511d77918ae16b2d6e9a0dfce ]
It seems that clock-output-names for the USB3 QMP PHY-s where set without actually checking what is the GCC clock driver expecting, so clock core could never actually find the parents for usb0_pipe_clk_src and usb1_pipe_clk_src clocks in the GCC driver.
So, correct the names to be what the driver expects so that parenting works.
Before: gcc_usb0_pipe_clk_src 0 0 0 125000000 0 0 50000 Y gcc_usb1_pipe_clk_src 0 0 0 125000000 0 0 50000 Y
After: usb3phy_0_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y usb0_pipe_clk_src 1 1 0 125000000 0 0 50000 Y gcc_usb0_pipe_clk 1 1 0 125000000 0 0 50000 Y usb3phy_1_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y usb1_pipe_clk_src 1 1 0 125000000 0 0 50000 Y gcc_usb1_pipe_clk 1 1 0 125000000 0 0 50000 Y
Fixes: 5e09bc51d07b ("arm64: dts: ipq8074: enable USB support") Signed-off-by: Robert Marko robimarko@gmail.com Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230108130440.670181-2-robimarko@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi index 4e51d8e3df043..9dcb48ebc4661 100644 --- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi +++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi @@ -137,7 +137,7 @@ usb1_ssphy: phy@58200 { #clock-cells = <0>; clocks = <&gcc GCC_USB1_PIPE_CLK>; clock-names = "pipe0"; - clock-output-names = "gcc_usb1_pipe_clk_src"; + clock-output-names = "usb3phy_1_cc_pipe_clk"; }; };
@@ -180,7 +180,7 @@ usb0_ssphy: phy@78200 { #clock-cells = <0>; clocks = <&gcc GCC_USB0_PIPE_CLK>; clock-names = "pipe0"; - clock-output-names = "gcc_usb0_pipe_clk_src"; + clock-output-names = "usb3phy_0_cc_pipe_clk"; }; };
From: Robert Marko robimarko@gmail.com
[ Upstream commit 100d9c94ccf15b02742c326cd04f422ab729153b ]
Serdes register space sizes are incorrect, update them to match the actual sizes from downstream QCA 5.4 kernel.
Fixes: 942bcd33ed45 ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes") Signed-off-by: Robert Marko robimarko@gmail.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230113164449.906002-1-robimarko@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi index 9dcb48ebc4661..90b0abf8bbbcd 100644 --- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi +++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi @@ -242,9 +242,9 @@ pcie_qmp1: phy@8e000 { status = "disabled";
pcie_phy1: phy@8e200 { - reg = <0x8e200 0x16c>, + reg = <0x8e200 0x130>, <0x8e400 0x200>, - <0x8e800 0x4f4>; + <0x8e800 0x1f8>; #phy-cells = <0>; #clock-cells = <0>; clocks = <&gcc GCC_PCIE1_PIPE_CLK>;
From: Robert Marko robimarko@gmail.com
[ Upstream commit 7ba33591b45f9d547a317e42f1c2acd19c925eb6 ]
IPQ8074 comes in 2 silicon versions: * v1 with 2x Gen2 PCIe ports and QMP PHY-s * v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s
v2 is the final and production version that is actually supported by the kernel, however it looks like PCIe related nodes were added for the v1 SoC.
Now that we have Gen3 QMP PHY support, we can start fixing the PCIe support by fixing the Gen3 QMP PHY node first.
Change the compatible to the Gen3 QMP PHY, correct the register space start and size, add the missing misc PCS register space.
Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") Signed-off-by: Robert Marko robimarko@gmail.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230113164449.906002-2-robimarko@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi index 90b0abf8bbbcd..f099785facf39 100644 --- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi +++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi @@ -197,9 +197,9 @@ qusb_phy_0: phy@79000 { status = "disabled"; };
- pcie_qmp0: phy@86000 { - compatible = "qcom,ipq8074-qmp-pcie-phy"; - reg = <0x00086000 0x1c4>; + pcie_qmp0: phy@84000 { + compatible = "qcom,ipq8074-qmp-gen3-pcie-phy"; + reg = <0x00084000 0x1bc>; #address-cells = <1>; #size-cells = <1>; ranges; @@ -213,10 +213,11 @@ pcie_qmp0: phy@86000 { "common"; status = "disabled";
- pcie_phy0: phy@86200 { - reg = <0x86200 0x16c>, - <0x86400 0x200>, - <0x86800 0x4f4>; + pcie_phy0: phy@84200 { + reg = <0x84200 0x16c>, + <0x84400 0x200>, + <0x84800 0x1f0>, + <0x84c00 0xf4>; #phy-cells = <0>; #clock-cells = <0>; clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
From: Robert Marko robimarko@gmail.com
[ Upstream commit 2055cb7dccea16bafa3adf9c5e3216949512c34a ]
Current ranges property set in Gen2 PCIe node is incorrect, replace it with the downstream 5.4 QCA kernel value.
Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") Signed-off-by: Robert Marko robimarko@gmail.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230113164449.906002-3-robimarko@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi index f099785facf39..df16ef5a90bb5 100644 --- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi +++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi @@ -773,9 +773,9 @@ pcie1: pci@10000000 { phy-names = "pciephy";
ranges = <0x81000000 0 0x10200000 0x10200000 - 0 0x100000 /* downstream I/O */ - 0x82000000 0 0x10300000 0x10300000 - 0 0xd00000>; /* non-prefetchable memory */ + 0 0x10000>, /* downstream I/O */ + <0x82000000 0 0x10220000 0x10220000 + 0 0xfde0000>; /* non-prefetchable memory */
interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "msi";
From: Robert Marko robimarko@gmail.com
[ Upstream commit 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 ]
IPQ8074 comes in 2 silicon versions: * v1 with 2x Gen2 PCIe ports and QMP PHY-s * v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s
v2 is the final and production version that is actually supported by the kernel, however it looks like PCIe related nodes were added for the v1 SoC.
Finish the PCIe fixup by using the correct compatible, adding missing ATU register space, declaring max-link-speed, use correct ranges, add missing clocks and resets.
Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") Signed-off-by: Robert Marko robimarko@gmail.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230113164449.906002-8-robimarko@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 30 +++++++++++++++------------ 1 file changed, 17 insertions(+), 13 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi index df16ef5a90bb5..e38aa76e54096 100644 --- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi +++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi @@ -818,16 +818,18 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ };
pcie0: pci@20000000 { - compatible = "qcom,pcie-ipq8074"; + compatible = "qcom,pcie-ipq8074-gen3"; reg = <0x20000000 0xf1d>, <0x20000f20 0xa8>, - <0x00080000 0x2000>, + <0x20001000 0x1000>, + <0x00080000 0x4000>, <0x20100000 0x1000>; - reg-names = "dbi", "elbi", "parf", "config"; + reg-names = "dbi", "elbi", "atu", "parf", "config"; device_type = "pci"; linux,pci-domain = <0>; bus-range = <0x00 0xff>; num-lanes = <1>; + max-link-speed = <3>; #address-cells = <3>; #size-cells = <2>;
@@ -835,9 +837,9 @@ pcie0: pci@20000000 { phy-names = "pciephy";
ranges = <0x81000000 0 0x20200000 0x20200000 - 0 0x100000 /* downstream I/O */ - 0x82000000 0 0x20300000 0x20300000 - 0 0xd00000>; /* non-prefetchable memory */ + 0 0x10000>, /* downstream I/O */ + <0x82000000 0 0x20220000 0x20220000 + 0 0xfde0000>; /* non-prefetchable memory */
interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "msi"; @@ -855,28 +857,30 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, <&gcc GCC_PCIE0_AXI_M_CLK>, <&gcc GCC_PCIE0_AXI_S_CLK>, - <&gcc GCC_PCIE0_AHB_CLK>, - <&gcc GCC_PCIE0_AUX_CLK>; - + <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>, + <&gcc GCC_PCIE0_RCHNG_CLK>; clock-names = "iface", "axi_m", "axi_s", - "ahb", - "aux"; + "axi_bridge", + "rchng"; + resets = <&gcc GCC_PCIE0_PIPE_ARES>, <&gcc GCC_PCIE0_SLEEP_ARES>, <&gcc GCC_PCIE0_CORE_STICKY_ARES>, <&gcc GCC_PCIE0_AXI_MASTER_ARES>, <&gcc GCC_PCIE0_AXI_SLAVE_ARES>, <&gcc GCC_PCIE0_AHB_ARES>, - <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>; + <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>, + <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>; reset-names = "pipe", "sleep", "sticky", "axi_m", "axi_s", "ahb", - "axi_m_sticky"; + "axi_m_sticky", + "axi_s_sticky"; status = "disabled"; }; };
From: Robert Marko robimarko@gmail.com
[ Upstream commit 0e8b90c0256cf9c9589e2cee517dedc987a34355 ]
Current PCIe QMP PHY output name were changed in ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes") however it did not account for the fact that GCC driver is relying on the old names to match them as they are being used as the parent for the gcc_pcie0_pipe_clk and gcc_pcie1_pipe_clk.
This broke parenting as GCC could not find the parent clock, so fix it by changing to the names that driver is expecting.
Fixes: 942bcd33ed45 ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes") Signed-off-by: Robert Marko robimarko@gmail.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230113164449.906002-9-robimarko@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi index e38aa76e54096..4294beeb494fd 100644 --- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi +++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi @@ -222,7 +222,7 @@ pcie_phy0: phy@84200 { #clock-cells = <0>; clocks = <&gcc GCC_PCIE0_PIPE_CLK>; clock-names = "pipe0"; - clock-output-names = "pcie_0_pipe_clk"; + clock-output-names = "pcie20_phy0_pipe_clk"; }; };
@@ -250,7 +250,7 @@ pcie_phy1: phy@8e200 { #clock-cells = <0>; clocks = <&gcc GCC_PCIE1_PIPE_CLK>; clock-names = "pipe0"; - clock-output-names = "pcie_1_pipe_clk"; + clock-output-names = "pcie20_phy1_pipe_clk"; }; };
From: Christian Hewitt christianshewitt@gmail.com
[ Upstream commit 3cbd431c2b34d84605d358c8c57654193fd661fb ]
Amlogic G12A devices experience CPU stalls and random board wedges when the system idles and CPU cores clock down to lower opp points. Recent vendor kernels include a change to remove 100-250MHz and other distro sources also remove the 500/667MHz points. Unless all 100-667Mhz opps are removed or the CPU governor forced to performance stalls are still observed, so let's remove them to improve stability and uptime.
Fixes: b190056fa9ee ("arm64: dts: meson-g12a: add cpus OPP table") Signed-off-by: Christian Hewitt christianshewitt@gmail.com Link: https://lore.kernel.org/r/20230119053031.21400-1-christianshewitt@gmail.com Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 -------------------- 1 file changed, 20 deletions(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi index 7677764eeee6e..f58fd2a6fe61c 100644 --- a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi @@ -58,26 +58,6 @@ cpu_opp_table: opp-table { compatible = "operating-points-v2"; opp-shared;
- opp-100000000 { - opp-hz = /bits/ 64 <100000000>; - opp-microvolt = <731000>; - }; - - opp-250000000 { - opp-hz = /bits/ 64 <250000000>; - opp-microvolt = <731000>; - }; - - opp-500000000 { - opp-hz = /bits/ 64 <500000000>; - opp-microvolt = <731000>; - }; - - opp-667000000 { - opp-hz = /bits/ 64 <666666666>; - opp-microvolt = <731000>; - }; - opp-1000000000 { opp-hz = /bits/ 64 <1000000000>; opp-microvolt = <731000>;
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 0414a100d6ab32721efa70ab55524540fdfe0ede ]
If platform_device_add() is not called or failed, it should call platform_device_put() in error case.
Fixes: 97933d6ced60 ("ARM: OMAP1: dmtimer: conversion to platform devices") Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com Message-Id: 20220701094602.2365099-1-yangyingliang@huawei.com Signed-off-by: Tony Lindgren tony@atomide.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/mach-omap1/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c index f5cd4bbf7566d..81a912c1145a9 100644 --- a/arch/arm/mach-omap1/timer.c +++ b/arch/arm/mach-omap1/timer.c @@ -158,7 +158,7 @@ static int __init omap1_dm_timer_init(void) kfree(pdata);
err_free_pdev: - platform_device_unregister(pdev); + platform_device_put(pdev);
return ret; }
From: Chen-Yu Tsai wenst@chromium.org
[ Upstream commit 089cd717e6ef03cf9cf7865777d67775de41339b ]
The scp_adsp clock controller is under the SCP_ADSP power domain. This power domain is currently not supported nor defined.
Mark the clock controller as broken for now, to avoid the system from trying to access it, and causing the CPU or bus to stall.
Fixes: 5d2b897bc6f5 ("arm64: dts: mediatek: Add mt8192 clock controllers") Signed-off-by: Chen-Yu Tsai wenst@chromium.org Reviewed-by: Nícolas F. R. A. Prado nfraprado@collabora.com Tested-by: Nícolas F. R. A. Prado nfraprado@collabora.com Link: https://lore.kernel.org/r/20221229101202.1655924-1-wenst@chromium.org Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi index 0d43a32734a37..46a1e457fab45 100644 --- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi @@ -586,6 +586,8 @@ scp_adsp: clock-controller@10720000 { compatible = "mediatek,mt8192-scp_adsp"; reg = <0 0x10720000 0 0x1000>; #clock-cells = <1>; + /* power domain dependency not upstreamed */ + status = "fail"; };
uart0: serial@11002000 {
From: Stefan Wahren stefan.wahren@i2se.com
[ Upstream commit afc8dd99840b7fb7190e769a893cda673bc3a907 ]
Booting Linux on a Raspberry Pi based on bcm2835_defconfig there is no display activity.
Enable CONFIG_FB which is nowadays required for CONFIG_FB_SIMPLE and CONFIG_FRAMEBUFFER_CONSOLE.
Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") Signed-off-by: Stefan Wahren stefan.wahren@i2se.com Link: https://lore.kernel.org/r/20230113205842.17051-1-stefan.wahren@i2se.com Signed-off-by: Florian Fainelli f.fainelli@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/configs/bcm2835_defconfig | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig index a51babd178c26..be0c984a66947 100644 --- a/arch/arm/configs/bcm2835_defconfig +++ b/arch/arm/configs/bcm2835_defconfig @@ -107,6 +107,7 @@ CONFIG_MEDIA_CAMERA_SUPPORT=y CONFIG_DRM=y CONFIG_DRM_V3D=y CONFIG_DRM_VC4=y +CONFIG_FB=y CONFIG_FB_SIMPLE=y CONFIG_FRAMEBUFFER_CONSOLE=y CONFIG_SOUND=y
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit 5bf52f5e4d12b8109f348cab60cb7d51092c4270 ]
The prototype does not match the definition, as gcc-13 points out:
arch/arm/mach-s3c/s3c64xx.c:169:13: error: conflicting types for 's3c64xx_set_timer_source' due to enum/integer mismatch; have 'void(unsigned int, unsigned int)' [-Werror=enum-int-mismatch] 169 | void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source) | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm/mach-s3c/s3c64xx.c:50: arch/arm/mach-s3c/s3c64xx.h:62:20: note: previous declaration of 's3c64xx_set_timer_source' with type 'void(enum s3c64xx_timer_mode, enum s3c64xx_timer_mode)' 62 | extern void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event, | ^~~~~~~~~~~~~~~~~~~~~~~~
Fixes: 4280506ac9bb ("ARM: SAMSUNG: Move all platforms to new clocksource driver") Signed-off-by: Arnd Bergmann arnd@arndb.de Link: https://lore.kernel.org/r/20230118090224.2162863-1-arnd@kernel.org Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/mach-s3c/s3c64xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm/mach-s3c/s3c64xx.c b/arch/arm/mach-s3c/s3c64xx.c index 0a8116c108fe4..dce2b0e953088 100644 --- a/arch/arm/mach-s3c/s3c64xx.c +++ b/arch/arm/mach-s3c/s3c64xx.c @@ -173,7 +173,8 @@ static struct samsung_pwm_variant s3c64xx_pwm_variant = { .tclk_mask = (1 << 7) | (1 << 6) | (1 << 5), };
-void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source) +void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event, + enum s3c64xx_timer_mode source) { s3c64xx_pwm_variant.output_mask = BIT(SAMSUNG_PWM_NUM) - 1; s3c64xx_pwm_variant.output_mask &= ~(BIT(event) | BIT(source));
From: Vaishnav Achath vaishnav.a@ti.com
[ Upstream commit 9ae21ac445e911e3541985c20052fc05d60f6879 ]
The WKUP_PADCONFIG register region in J7200 has multiple non-addressable regions, split the existing wkup_pmx region as follows to avoid the non-addressable regions and include all valid WKUP_PADCONFIG registers. Also update references to old nodes with new ones.
wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12) wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15) wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84) wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100)
J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) : https://www.ti.com/lit/ds/symlink/dra821u.pdf
Fixes: d361ed88455f ("arm64: dts: ti: Add support for J7200 SoC")
Signed-off-by: Vaishnav Achath vaishnav.a@ti.com Reviewed-by: Jayesh Choudhary j-choudhary@ti.com Signed-off-by: Vignesh Raghavendra vigneshr@ti.com Link: https://lore.kernel.org/r/20230119042622.22310-1-vaishnav.a@ti.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../dts/ti/k3-j7200-common-proc-board.dts | 2 +- .../boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 ++++++++++++++++++- 2 files changed, 29 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts index 6240856e48631..0d39d6b8cc0ca 100644 --- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts @@ -80,7 +80,7 @@ vdd_sd_dv: gpio-regulator-TLV71033 { }; };
-&wkup_pmx0 { +&wkup_pmx2 { mcu_cpsw_pins_default: mcu-cpsw-pins-default { pinctrl-single,pins = < J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ diff --git a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi index fe669deba4896..de56a0165bd0c 100644 --- a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi +++ b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi @@ -56,7 +56,34 @@ chipid@43000014 { wkup_pmx0: pinctrl@4301c000 { compatible = "pinctrl-single"; /* Proxy 0 addressing */ - reg = <0x00 0x4301c000 0x00 0x178>; + reg = <0x00 0x4301c000 0x00 0x34>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; + }; + + wkup_pmx1: pinctrl@0x4301c038 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ + reg = <0x00 0x4301c038 0x00 0x8>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; + }; + + wkup_pmx2: pinctrl@0x4301c068 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ + reg = <0x00 0x4301c068 0x00 0xec>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; + }; + + wkup_pmx3: pinctrl@0x4301c174 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ + reg = <0x00 0x4301c174 0x00 0x20>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit d15d2a617499882971ddb773a583015bf36fa492 ]
The property is wr-active:
exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+'
Fixes: b59b3afb94d4 ("ARM: dts: add fimd device support for exynos3250-rinato") Link: https://lore.kernel.org/r/20230120155404.323386-2-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts index 6d2c7bb191842..2eb682009815a 100644 --- a/arch/arm/boot/dts/exynos3250-rinato.dts +++ b/arch/arm/boot/dts/exynos3250-rinato.dts @@ -250,7 +250,7 @@ &fimd { i80-if-timings { cs-setup = <0>; wr-setup = <0>; - wr-act = <1>; + wr-active = <1>; wr-hold = <0>; }; };
From: Angus Chen angus.chen@jaguarmicro.com
[ Upstream commit ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 ]
The function call ida_simple_get maybe fail,we should deal with it. And if ida_simple_get success ,it need to call ida_simple_remove also. BTW,devm_kasprintf can handle id is zero for consistency.
Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") Signed-off-by: Angus Chen angus.chen@jaguarmicro.com Signed-off-by: Shawn Guo shawnguo@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c index af12668d0bf51..b9efe9da06e0b 100644 --- a/arch/arm/mach-imx/mmdc.c +++ b/arch/arm/mach-imx/mmdc.c @@ -99,6 +99,7 @@ struct mmdc_pmu { cpumask_t cpu; struct hrtimer hrtimer; unsigned int active_events; + int id; struct device *dev; struct perf_event *mmdc_events[MMDC_NUM_COUNTERS]; struct hlist_node node; @@ -433,8 +434,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer) static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, void __iomem *mmdc_base, struct device *dev) { - int mmdc_num; - *pmu_mmdc = (struct mmdc_pmu) { .pmu = (struct pmu) { .task_ctx_nr = perf_invalid_context, @@ -452,15 +451,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, .active_events = 0, };
- mmdc_num = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL); + pmu_mmdc->id = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL);
- return mmdc_num; + return pmu_mmdc->id; }
static int imx_mmdc_remove(struct platform_device *pdev) { struct mmdc_pmu *pmu_mmdc = platform_get_drvdata(pdev);
+ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); perf_pmu_unregister(&pmu_mmdc->pmu); iounmap(pmu_mmdc->mmdc_base); @@ -474,7 +474,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b { struct mmdc_pmu *pmu_mmdc; char *name; - int mmdc_num; int ret; const struct of_device_id *of_id = of_match_device(imx_mmdc_dt_ids, &pdev->dev); @@ -497,14 +496,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b cpuhp_mmdc_state = ret; }
- mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); - pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; - if (mmdc_num == 0) - name = "mmdc"; - else - name = devm_kasprintf(&pdev->dev, - GFP_KERNEL, "mmdc%d", mmdc_num); + ret = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); + if (ret < 0) + goto pmu_free;
+ name = devm_kasprintf(&pdev->dev, + GFP_KERNEL, "mmdc%d", ret); + + pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data;
hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC, @@ -525,6 +524,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b
pmu_register_err: pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret); + ida_simple_remove(&mmdc_ida, pmu_mmdc->id); cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); hrtimer_cancel(&pmu_mmdc->hrtimer); pmu_free:
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit 127f79212b07c5d9a6657a87e3eafdd889335814 ]
Fixes: scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-1-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi index 09a016fd828aa..467d2eaf817b2 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi @@ -250,7 +250,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks";
- scpi_dvfs: clock-controller { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit 5b7069d72f03c92a0ab919725017394ebce03a81 ]
Fixes: scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-2-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi index 417523dc4cc03..c87df0b2dfdea 100644 --- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi @@ -153,7 +153,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks";
- scpi_dvfs: clock-controller { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit 2ff650051493d5bdb6dd09d4c2850bb37db6be31 ]
Fixes: scpi: sensors:compatible: 'oneOf' conditional failed, one must be fixed: ['amlogic,meson-gxbb-scpi-sensors'] is too short 'arm,scpi-sensors' was expected
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-3-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi index c87df0b2dfdea..ff2b33313e637 100644 --- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi @@ -162,7 +162,7 @@ scpi_dvfs: clocks-0 { };
scpi_sensors: sensors { - compatible = "amlogic,meson-gxbb-scpi-sensors"; + compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors"; #thermal-sensor-cells = <1>; }; };
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit a69cb1042cea840bc7b60fea1c26a6b259e68bf2 ]
Fixes: usb@ffe09080: 'phy-supply' does not match any of the regexes: '^usb@[0-9a-f]+$', 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-4-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi index 22fd43b5fd73c..1916c007cba58 100644 --- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi @@ -303,7 +303,7 @@ &uart_AO_B {
&usb { status = "okay"; - phy-supply = <&usb_pwr>; + vbus-supply = <&usb_pwr>; };
&spicc1 {
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit e3bd275ccbacf5eb18eaa311cea39f8bf8655feb ]
Fixes: bluetooth: 'clock-names' does not match any of the regexes: 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-5-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 - 1 file changed, 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts index b331a013572f3..c490dbbf063bf 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts +++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts @@ -79,6 +79,5 @@ bluetooth { enable-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; max-speed = <2000000>; clocks = <&wifi32k>; - clock-names = "lpo"; }; };
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit 61ff70708b98a85516eccb3755084ac97b42cf48 ]
Fixes: bus@c8834000: rng: {...} should not be valid under {'type': 'object'}
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-6-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi index 467d2eaf817b2..11f89bfecb56a 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi @@ -532,7 +532,7 @@ periphs: bus@c8834000 { #size-cells = <2>; ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>;
- hwrng: rng { + hwrng: rng@0 { compatible = "amlogic,meson-rng"; reg = <0x0 0x0 0x0 0x4>; };
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit 11172a97c092eaeb0a65c6434df0fc73f886a495 ]
Fixes: pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-[0-9a-f])*$'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-7-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts index bb7412070cb26..a18d6d241a5ad 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts +++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905w-jethome-jethub-j80.dts @@ -239,7 +239,7 @@ &i2c_B { pinctrl-names = "default"; pinctrl-0 = <&i2c_b_pins>;
- pcf8563: pcf8563@51 { + pcf8563: rtc@51 { compatible = "nxp,pcf8563"; reg = <0x51>; status = "okay";
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit 956f52025c5dd92c80c12e31c99c854086a6fc55 ]
Fixes: pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-[0-9a-f])*$'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-8-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi index 1916c007cba58..e1605a9b0a13f 100644 --- a/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-axg-jethome-jethub-j1xx.dtsi @@ -217,7 +217,7 @@ &i2c1 { pinctrl-names = "default";
/* RTC */ - pcf8563: pcf8563@51 { + pcf8563: rtc@51 { compatible = "nxp,pcf8563"; reg = <0x51>; status = "okay";
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit d19189f70ba596798ea49166d2d1ef36a8df5289 ]
Fixes: bus@c8834000: eth-phy-mux: {...} should not be valid under {'type': 'object'}
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-9-443515289... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi index 04e9d0f1bde0f..5905a6df09b04 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi @@ -773,7 +773,7 @@ mux { }; };
- eth-phy-mux { + eth-phy-mux@55c { compatible = "mdio-mux-mmioreg", "mdio-mux"; #address-cells = <1>; #size-cells = <0>;
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit 6bb506ed36968207a8832f0143ebc127f0770eef ]
Fixes: adc-keys: 'update-button' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-10-44351528... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi index bcdf55f48a831..4e84ab87cc7db 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi +++ b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi @@ -17,7 +17,7 @@ adc-keys { io-channel-names = "buttons"; keyup-threshold-microvolt = <1800000>;
- update-button { + button-update { label = "update"; linux,code = <KEY_VENDOR>; press-threshold-microvolt = <1300000>;
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit d519a73332b6c3d14e15f8fd20d7c6f29ed13d41 ]
Fixes: adc_keys: 'key' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+'
Also fix the invalid "adc_keys" node name.
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-11-44351528... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts index cadba194b149b..6d0db667581fa 100644 --- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts @@ -17,13 +17,13 @@ / { compatible = "bananapi,bpi-m5", "amlogic,sm1"; model = "Banana Pi BPI-M5";
- adc_keys { + adc-keys { compatible = "adc-keys"; io-channels = <&saradc 2>; io-channel-names = "buttons"; keyup-threshold-microvolt = <1800000>;
- key { + button-sw3 { label = "SW3"; linux,code = <BTN_3>; press-threshold-microvolt = <1700000>;
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit eee64d8fbbdaab72bbab3e462f3a7b742d20c8c2 ]
Fixes: leds: status: {...} is not of type 'array'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-12-44351528... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts index 9ef210f17b4aa..393d3cb33b9ee 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts +++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts @@ -18,7 +18,7 @@ cvbs-connector { leds { compatible = "gpio-leds";
- status { + led { label = "n1:white:status"; gpios = <&gpio_ao GPIOAO_9 GPIO_ACTIVE_HIGH>; default-state = "on";
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit afdef3b188c934f79ad4b0a7bd8c692742f9b5af ]
Fixes: leds: status: {...} is not of type 'array'
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-13-44351528... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts index 6d8cc00fedc7f..5f2d4317ecfbf 100644 --- a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts +++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts @@ -16,7 +16,7 @@ / {
leds { compatible = "gpio-leds"; - status { + led { gpios = <&gpio_ao GPIOAO_13 GPIO_ACTIVE_LOW>; default-state = "off"; color = <LED_COLOR_ID_RED>;
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit ce9999722656f2433af9029571bc2b99448dda74 ]
Fixes: pmic@1c: '#clock-cells' is a required property pmic@1c: 'switch-supply' does not match any of the regexes: 'pinctrl-[0-9]+'
The switch supply is described by vcc9-supply per bindings documentation.
Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-14-44351528... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts index 1e40709610c52..c8e5a0a42b898 100644 --- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts +++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-go-ultra.dts @@ -381,6 +381,7 @@ rk818: pmic@1c { reg = <0x1c>; interrupt-parent = <&gpio_intc>; interrupts = <7 IRQ_TYPE_LEVEL_LOW>; /* GPIOAO_7 */ + #clock-cells = <1>;
vcc1-supply = <&vdd_sys>; vcc2-supply = <&vdd_sys>; @@ -391,7 +392,6 @@ rk818: pmic@1c { vcc8-supply = <&vcc_2v3>; vcc9-supply = <&vddao_3v3>; boost-supply = <&vdd_sys>; - switch-supply = <&vdd_sys>;
regulators { vddcpu_a: DCDC_REG1 {
From: Neil Armstrong neil.armstrong@linaro.org
[ Upstream commit 1d2f14117aa7773efff50f832b85fc7779e586e0 ]
Add an active trip tied to the on-board fan cooling device, which is better than describing it along the passive cooling maps.
Fixes: 33b14f663df8 ("arm64: dts: meson: add initial device-tree for ODROID-HC4") Reported-by: Ricardo Pardini ricardo@pardini.net Link: https://lore.kernel.org/r/20230124-topic-odroid-hc4-upstream-fix-fan-trip-v1... Tested-by: Ricardo Pardini ricardo@pardini.net [narmstrong: added Ricardo's tested-by from off-list chat] Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts index a1f0c38ccadda..74088e7280fee 100644 --- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts +++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts @@ -76,9 +76,17 @@ sound { };
&cpu_thermal { + trips { + cpu_active: cpu-active { + temperature = <60000>; /* millicelsius */ + hysteresis = <2000>; /* millicelsius */ + type = "active"; + }; + }; + cooling-maps { map { - trip = <&cpu_passive>; + trip = <&cpu_active>; cooling-device = <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; }; };
From: Waiman Long longman@redhat.com
[ Upstream commit 3f5245538a1964ae186ab7e1636020a41aa63143 ]
Commit:
91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner")
... assumes that when the owner field is changed to NULL, the lock will become free soon. But commit:
48dfb5d2560d ("locking/rwsem: Disable preemption while trying for rwsem lock")
... disabled preemption when acquiring rwsem for write.
However, preemption has not yet been disabled when acquiring a read lock on a rwsem. So a reader can add a RWSEM_READER_BIAS to count without setting owner to signal a reader, got preempted out by a RT task which then spins in the writer slowpath as owner remains NULL leading to live lock.
One easy way to fix this problem is to disable preemption at all the down_read*() and up_read() code paths as implemented in this patch.
Fixes: 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") Reported-by: Mukesh Ojha quic_mojha@quicinc.com Suggested-by: Peter Zijlstra peterz@infradead.org Signed-off-by: Waiman Long longman@redhat.com Signed-off-by: Ingo Molnar mingo@kernel.org Link: https://lore.kernel.org/r/20230126003628.365092-3-longman@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/locking/rwsem.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-)
diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c index 44873594de031..324fc370b6a68 100644 --- a/kernel/locking/rwsem.c +++ b/kernel/locking/rwsem.c @@ -1092,7 +1092,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat /* Ordered by sem->wait_lock against rwsem_mark_wake(). */ break; } - schedule(); + schedule_preempt_disabled(); lockevent_inc(rwsem_sleep_reader); }
@@ -1254,14 +1254,20 @@ static struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem) */ static inline int __down_read_common(struct rw_semaphore *sem, int state) { + int ret = 0; long count;
+ preempt_disable(); if (!rwsem_read_trylock(sem, &count)) { - if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) - return -EINTR; + if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) { + ret = -EINTR; + goto out; + } DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem); } - return 0; +out: + preempt_enable(); + return ret; }
static inline void __down_read(struct rw_semaphore *sem) @@ -1281,19 +1287,23 @@ static inline int __down_read_killable(struct rw_semaphore *sem)
static inline int __down_read_trylock(struct rw_semaphore *sem) { + int ret = 0; long tmp;
DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem);
+ preempt_disable(); tmp = atomic_long_read(&sem->count); while (!(tmp & RWSEM_READ_FAILED_MASK)) { if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp, tmp + RWSEM_READER_BIAS)) { rwsem_set_reader_owned(sem); - return 1; + ret = 1; + break; } } - return 0; + preempt_enable(); + return ret; }
/* @@ -1335,6 +1345,7 @@ static inline void __up_read(struct rw_semaphore *sem) DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
+ preempt_disable(); rwsem_clear_reader_owned(sem); tmp = atomic_long_add_return_release(-RWSEM_READER_BIAS, &sem->count); DEBUG_RWSEMS_WARN_ON(tmp < 0, sem); @@ -1343,6 +1354,7 @@ static inline void __up_read(struct rw_semaphore *sem) clear_nonspinnable(sem); rwsem_wake(sem); } + preempt_enable(); }
/* @@ -1662,6 +1674,12 @@ void down_read_non_owner(struct rw_semaphore *sem) { might_sleep(); __down_read(sem); + /* + * The owner value for a reader-owned lock is mostly for debugging + * purpose only and is not critical to the correct functioning of + * rwsem. So it is perfectly fine to set it in a preempt-enabled + * context here. + */ __rwsem_set_reader_owned(sem, NULL); } EXPORT_SYMBOL(down_read_non_owner);
From: Thierry Reding treding@nvidia.com
[ Upstream commit 2838cfddbc1c4e12dacf8219efb481ab11c114a4 ]
The #address-cells and #size-cells properties for the top-level bus were set to 1 because that was enough to represent the register ranges of all the IP blocks on that bus. However, most of these devices can do DMA to a larger address space, so translation of DMA addresses needs to happen in a 64-bit address space.
Partially this was already done by the memory controller increasing that address space by setting #address-cells and #size-cells to 2, but a full DMA address translation would still cause truncation when traversing to the top-level bus.
Fix this by setting #address-cells = <2> and #size-cells = <2> on the top-level bus and adjusting all "reg" and "ranges" properties of its children.
While at it, also move the PCI and GPU nodes back under the top-level bus where they belong. The were put outside of it to work around this same problem.
Signed-off-by: Thierry Reding treding@nvidia.com Stable-dep-of: 361238cdc525 ("arm64: tegra: Mark host1x as dma-coherent on Tegra194/234") Signed-off-by: Sasha Levin sashal@kernel.org --- .../boot/dts/nvidia/tegra194-p2972-0000.dts | 84 +- .../boot/dts/nvidia/tegra194-p3509-0000.dtsi | 54 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 1128 ++++++------ .../nvidia/tegra234-p3737-0000+p3701-0000.dts | 102 +- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 1530 +++++++++-------- 5 files changed, 1453 insertions(+), 1445 deletions(-)
diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts b/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts index bc1041d11f6dc..f018fc4c0f707 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts +++ b/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts @@ -2184,67 +2184,67 @@ sor@15b80000 { GPIO_ACTIVE_LOW>; }; }; - };
- pcie@14100000 { - status = "okay"; + pcie@14100000 { + status = "okay";
- vddio-pex-ctl-supply = <&vdd_1v8ao>; + vddio-pex-ctl-supply = <&vdd_1v8ao>;
- phys = <&p2u_hsio_0>; - phy-names = "p2u-0"; - }; + phys = <&p2u_hsio_0>; + phy-names = "p2u-0"; + };
- pcie@14140000 { - status = "okay"; + pcie@14140000 { + status = "okay";
- vddio-pex-ctl-supply = <&vdd_1v8ao>; + vddio-pex-ctl-supply = <&vdd_1v8ao>;
- phys = <&p2u_hsio_7>; - phy-names = "p2u-0"; - }; + phys = <&p2u_hsio_7>; + phy-names = "p2u-0"; + };
- pcie@14180000 { - status = "okay"; + pcie@14180000 { + status = "okay";
- vddio-pex-ctl-supply = <&vdd_1v8ao>; + vddio-pex-ctl-supply = <&vdd_1v8ao>;
- phys = <&p2u_hsio_2>, <&p2u_hsio_3>, <&p2u_hsio_4>, - <&p2u_hsio_5>; - phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3"; - }; + phys = <&p2u_hsio_2>, <&p2u_hsio_3>, <&p2u_hsio_4>, + <&p2u_hsio_5>; + phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3"; + };
- pcie@141a0000 { - status = "okay"; + pcie@141a0000 { + status = "okay";
- vddio-pex-ctl-supply = <&vdd_1v8ao>; - vpcie3v3-supply = <&vdd_3v3_pcie>; - vpcie12v-supply = <&vdd_12v_pcie>; + vddio-pex-ctl-supply = <&vdd_1v8ao>; + vpcie3v3-supply = <&vdd_3v3_pcie>; + vpcie12v-supply = <&vdd_12v_pcie>;
- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, - <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, - <&p2u_nvhs_6>, <&p2u_nvhs_7>; + phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, + <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, + <&p2u_nvhs_6>, <&p2u_nvhs_7>;
- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", - "p2u-5", "p2u-6", "p2u-7"; - }; + phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", + "p2u-5", "p2u-6", "p2u-7"; + };
- pcie-ep@141a0000 { - status = "disabled"; + pcie-ep@141a0000 { + status = "disabled";
- vddio-pex-ctl-supply = <&vdd_1v8ao>; + vddio-pex-ctl-supply = <&vdd_1v8ao>;
- reset-gpios = <&gpio TEGRA194_MAIN_GPIO(GG, 1) GPIO_ACTIVE_LOW>; + reset-gpios = <&gpio TEGRA194_MAIN_GPIO(GG, 1) GPIO_ACTIVE_LOW>;
- nvidia,refclk-select-gpios = <&gpio_aon TEGRA194_AON_GPIO(AA, 5) - GPIO_ACTIVE_HIGH>; + nvidia,refclk-select-gpios = <&gpio_aon TEGRA194_AON_GPIO(AA, 5) + GPIO_ACTIVE_HIGH>;
- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, - <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, - <&p2u_nvhs_6>, <&p2u_nvhs_7>; + phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, + <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, + <&p2u_nvhs_6>, <&p2u_nvhs_7>;
- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", - "p2u-5", "p2u-6", "p2u-7"; + phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", + "p2u-5", "p2u-6", "p2u-7"; + }; };
fan: pwm-fan { diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi index f212f6aced047..617fbfaaf02f6 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi @@ -2209,46 +2209,46 @@ sor@15b40000 { GPIO_ACTIVE_LOW>; }; }; - };
- pcie@14160000 { - status = "okay"; + pcie@14160000 { + status = "okay";
- vddio-pex-ctl-supply = <&vdd_1v8ao>; + vddio-pex-ctl-supply = <&vdd_1v8ao>;
- phys = <&p2u_hsio_11>; - phy-names = "p2u-0"; - }; + phys = <&p2u_hsio_11>; + phy-names = "p2u-0"; + };
- pcie@141a0000 { - status = "okay"; + pcie@141a0000 { + status = "okay";
- vddio-pex-ctl-supply = <&vdd_1v8ao>; + vddio-pex-ctl-supply = <&vdd_1v8ao>;
- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, - <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, - <&p2u_nvhs_6>, <&p2u_nvhs_7>; + phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, + <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, + <&p2u_nvhs_6>, <&p2u_nvhs_7>;
- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", - "p2u-5", "p2u-6", "p2u-7"; - }; + phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", + "p2u-5", "p2u-6", "p2u-7"; + };
- pcie-ep@141a0000 { - status = "disabled"; + pcie-ep@141a0000 { + status = "disabled";
- vddio-pex-ctl-supply = <&vdd_1v8ao>; + vddio-pex-ctl-supply = <&vdd_1v8ao>;
- reset-gpios = <&gpio TEGRA194_MAIN_GPIO(GG, 1) GPIO_ACTIVE_LOW>; + reset-gpios = <&gpio TEGRA194_MAIN_GPIO(GG, 1) GPIO_ACTIVE_LOW>;
- nvidia,refclk-select-gpios = <&gpio_aon TEGRA194_AON_GPIO(AA, 5) - GPIO_ACTIVE_HIGH>; + nvidia,refclk-select-gpios = <&gpio_aon TEGRA194_AON_GPIO(AA, 5) + GPIO_ACTIVE_HIGH>;
- phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, - <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, - <&p2u_nvhs_6>, <&p2u_nvhs_7>; + phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, + <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, + <&p2u_nvhs_6>, <&p2u_nvhs_7>;
- phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", - "p2u-5", "p2u-6", "p2u-7"; + phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", + "p2u-5", "p2u-6", "p2u-7"; + }; };
fan: pwm-fan { diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi index 4afcbd60e144e..b941b1c77713c 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi @@ -19,21 +19,22 @@ / { /* control backbone */ bus@0 { compatible = "simple-bus"; - #address-cells = <1>; - #size-cells = <1>; - ranges = <0x0 0x0 0x0 0x40000000>; + + #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x0 0x0 0x0 0x0 0x40000000>;
apbmisc: misc@100000 { compatible = "nvidia,tegra194-misc"; - reg = <0x00100000 0xf000>, - <0x0010f000 0x1000>; + reg = <0x0 0x00100000 0x0 0xf000>, + <0x0 0x0010f000 0x0 0x1000>; };
gpio: gpio@2200000 { compatible = "nvidia,tegra194-gpio"; reg-names = "security", "gpio"; - reg = <0x2200000 0x10000>, - <0x2210000 0x10000>; + reg = <0x0 0x2200000 0x0 0x10000>, + <0x0 0x2210000 0x0 0x10000>; interrupts = <GIC_SPI 288 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 289 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 290 IRQ_TYPE_LEVEL_HIGH>, @@ -91,7 +92,7 @@ gpio: gpio@2200000 {
cbb-noc@2300000 { compatible = "nvidia,tegra194-cbb-noc"; - reg = <0x02300000 0x1000>; + reg = <0x0 0x02300000 0x0 0x1000>; interrupts = <GIC_SPI 230 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>; nvidia,axi2apb = <&axi2apb>; @@ -101,12 +102,12 @@ cbb-noc@2300000 {
axi2apb: axi2apb@2390000 { compatible = "nvidia,tegra194-axi2apb"; - reg = <0x2390000 0x1000>, - <0x23a0000 0x1000>, - <0x23b0000 0x1000>, - <0x23c0000 0x1000>, - <0x23d0000 0x1000>, - <0x23e0000 0x1000>; + reg = <0x0 0x2390000 0x0 0x1000>, + <0x0 0x23a0000 0x0 0x1000>, + <0x0 0x23b0000 0x0 0x1000>, + <0x0 0x23c0000 0x0 0x1000>, + <0x0 0x23d0000 0x0 0x1000>, + <0x0 0x23e0000 0x0 0x1000>; status = "okay"; };
@@ -114,7 +115,7 @@ ethernet@2490000 { compatible = "nvidia,tegra194-eqos", "nvidia,tegra186-eqos", "snps,dwc-qos-ethernet-4.10"; - reg = <0x02490000 0x10000>; + reg = <0x0 0x02490000 0x0 0x10000>; interrupts = <GIC_SPI 194 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_AXI_CBB>, <&bpmp TEGRA194_CLK_EQOS_AXI>, @@ -140,7 +141,7 @@ ethernet@2490000 { gpcdma: dma-controller@2600000 { compatible = "nvidia,tegra194-gpcdma", "nvidia,tegra186-gpcdma"; - reg = <0x2600000 0x210000>; + reg = <0x0 0x2600000 0x0 0x210000>; resets = <&bpmp TEGRA194_RESET_GPCDMA>; reset-names = "gpcdma"; interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>, @@ -189,15 +190,16 @@ aconnect@2900000 { <&bpmp TEGRA194_CLK_APB2APE>; clock-names = "ape", "apb2ape"; power-domains = <&bpmp TEGRA194_POWER_DOMAIN_AUD>; - #address-cells = <1>; - #size-cells = <1>; - ranges = <0x02900000 0x02900000 0x200000>; status = "disabled";
+ #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x02900000 0x0 0x02900000 0x0 0x200000>; + adma: dma-controller@2930000 { compatible = "nvidia,tegra194-adma", "nvidia,tegra186-adma"; - reg = <0x02930000 0x20000>; + reg = <0x0 0x02930000 0x0 0x20000>; interrupt-parent = <&agic>; interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, @@ -242,8 +244,8 @@ agic: interrupt-controller@2a40000 { "nvidia,tegra210-agic"; #interrupt-cells = <3>; interrupt-controller; - reg = <0x02a41000 0x1000>, - <0x02a42000 0x2000>; + reg = <0x0 0x02a41000 0x0 0x1000>, + <0x0 0x02a42000 0x0 0x2000>; interrupts = <GIC_SPI 145 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>; @@ -255,20 +257,21 @@ agic: interrupt-controller@2a40000 { tegra_ahub: ahub@2900800 { compatible = "nvidia,tegra194-ahub", "nvidia,tegra186-ahub"; - reg = <0x02900800 0x800>; + reg = <0x0 0x02900800 0x0 0x800>; clocks = <&bpmp TEGRA194_CLK_AHUB>; clock-names = "ahub"; assigned-clocks = <&bpmp TEGRA194_CLK_AHUB>; assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; - #address-cells = <1>; - #size-cells = <1>; - ranges = <0x02900800 0x02900800 0x11800>; status = "disabled";
+ #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x02900800 0x0 0x02900800 0x0 0x11800>; + tegra_admaif: admaif@290f000 { compatible = "nvidia,tegra194-admaif", "nvidia,tegra186-admaif"; - reg = <0x0290f000 0x1000>; + reg = <0x0 0x0290f000 0x0 0x1000>; dmas = <&adma 1>, <&adma 1>, <&adma 2>, <&adma 2>, <&adma 3>, <&adma 3>, @@ -319,7 +322,7 @@ tegra_admaif: admaif@290f000 { tegra_i2s1: i2s@2901000 { compatible = "nvidia,tegra194-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901000 0x100>; + reg = <0x0 0x2901000 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_I2S1>, <&bpmp TEGRA194_CLK_I2S1_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -333,7 +336,7 @@ tegra_i2s1: i2s@2901000 { tegra_i2s2: i2s@2901100 { compatible = "nvidia,tegra194-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901100 0x100>; + reg = <0x0 0x2901100 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_I2S2>, <&bpmp TEGRA194_CLK_I2S2_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -347,7 +350,7 @@ tegra_i2s2: i2s@2901100 { tegra_i2s3: i2s@2901200 { compatible = "nvidia,tegra194-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901200 0x100>; + reg = <0x0 0x2901200 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_I2S3>, <&bpmp TEGRA194_CLK_I2S3_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -361,7 +364,7 @@ tegra_i2s3: i2s@2901200 { tegra_i2s4: i2s@2901300 { compatible = "nvidia,tegra194-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901300 0x100>; + reg = <0x0 0x2901300 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_I2S4>, <&bpmp TEGRA194_CLK_I2S4_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -375,7 +378,7 @@ tegra_i2s4: i2s@2901300 { tegra_i2s5: i2s@2901400 { compatible = "nvidia,tegra194-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901400 0x100>; + reg = <0x0 0x2901400 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_I2S5>, <&bpmp TEGRA194_CLK_I2S5_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -389,7 +392,7 @@ tegra_i2s5: i2s@2901400 { tegra_i2s6: i2s@2901500 { compatible = "nvidia,tegra194-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901500 0x100>; + reg = <0x0 0x2901500 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_I2S6>, <&bpmp TEGRA194_CLK_I2S6_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -403,7 +406,7 @@ tegra_i2s6: i2s@2901500 { tegra_dmic1: dmic@2904000 { compatible = "nvidia,tegra194-dmic", "nvidia,tegra210-dmic"; - reg = <0x2904000 0x100>; + reg = <0x0 0x2904000 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_DMIC1>; clock-names = "dmic"; assigned-clocks = <&bpmp TEGRA194_CLK_DMIC1>; @@ -416,7 +419,7 @@ tegra_dmic1: dmic@2904000 { tegra_dmic2: dmic@2904100 { compatible = "nvidia,tegra194-dmic", "nvidia,tegra210-dmic"; - reg = <0x2904100 0x100>; + reg = <0x0 0x2904100 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_DMIC2>; clock-names = "dmic"; assigned-clocks = <&bpmp TEGRA194_CLK_DMIC2>; @@ -429,7 +432,7 @@ tegra_dmic2: dmic@2904100 { tegra_dmic3: dmic@2904200 { compatible = "nvidia,tegra194-dmic", "nvidia,tegra210-dmic"; - reg = <0x2904200 0x100>; + reg = <0x0 0x2904200 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_DMIC3>; clock-names = "dmic"; assigned-clocks = <&bpmp TEGRA194_CLK_DMIC3>; @@ -442,7 +445,7 @@ tegra_dmic3: dmic@2904200 { tegra_dmic4: dmic@2904300 { compatible = "nvidia,tegra194-dmic", "nvidia,tegra210-dmic"; - reg = <0x2904300 0x100>; + reg = <0x0 0x2904300 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_DMIC4>; clock-names = "dmic"; assigned-clocks = <&bpmp TEGRA194_CLK_DMIC4>; @@ -455,7 +458,7 @@ tegra_dmic4: dmic@2904300 { tegra_dspk1: dspk@2905000 { compatible = "nvidia,tegra194-dspk", "nvidia,tegra186-dspk"; - reg = <0x2905000 0x100>; + reg = <0x0 0x2905000 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_DSPK1>; clock-names = "dspk"; assigned-clocks = <&bpmp TEGRA194_CLK_DSPK1>; @@ -468,7 +471,7 @@ tegra_dspk1: dspk@2905000 { tegra_dspk2: dspk@2905100 { compatible = "nvidia,tegra194-dspk", "nvidia,tegra186-dspk"; - reg = <0x2905100 0x100>; + reg = <0x0 0x2905100 0x0 0x100>; clocks = <&bpmp TEGRA194_CLK_DSPK2>; clock-names = "dspk"; assigned-clocks = <&bpmp TEGRA194_CLK_DSPK2>; @@ -481,7 +484,7 @@ tegra_dspk2: dspk@2905100 { tegra_sfc1: sfc@2902000 { compatible = "nvidia,tegra194-sfc", "nvidia,tegra210-sfc"; - reg = <0x2902000 0x200>; + reg = <0x0 0x2902000 0x0 0x200>; sound-name-prefix = "SFC1"; status = "disabled"; }; @@ -489,7 +492,7 @@ tegra_sfc1: sfc@2902000 { tegra_sfc2: sfc@2902200 { compatible = "nvidia,tegra194-sfc", "nvidia,tegra210-sfc"; - reg = <0x2902200 0x200>; + reg = <0x0 0x2902200 0x0 0x200>; sound-name-prefix = "SFC2"; status = "disabled"; }; @@ -497,7 +500,7 @@ tegra_sfc2: sfc@2902200 { tegra_sfc3: sfc@2902400 { compatible = "nvidia,tegra194-sfc", "nvidia,tegra210-sfc"; - reg = <0x2902400 0x200>; + reg = <0x0 0x2902400 0x0 0x200>; sound-name-prefix = "SFC3"; status = "disabled"; }; @@ -505,7 +508,7 @@ tegra_sfc3: sfc@2902400 { tegra_sfc4: sfc@2902600 { compatible = "nvidia,tegra194-sfc", "nvidia,tegra210-sfc"; - reg = <0x2902600 0x200>; + reg = <0x0 0x2902600 0x0 0x200>; sound-name-prefix = "SFC4"; status = "disabled"; }; @@ -513,7 +516,7 @@ tegra_sfc4: sfc@2902600 { tegra_mvc1: mvc@290a000 { compatible = "nvidia,tegra194-mvc", "nvidia,tegra210-mvc"; - reg = <0x290a000 0x200>; + reg = <0x0 0x290a000 0x0 0x200>; sound-name-prefix = "MVC1"; status = "disabled"; }; @@ -521,35 +524,35 @@ tegra_mvc1: mvc@290a000 { tegra_mvc2: mvc@290a200 { compatible = "nvidia,tegra194-mvc", "nvidia,tegra210-mvc"; - reg = <0x290a200 0x200>; + reg = <0x0 0x290a200 0x0 0x200>; sound-name-prefix = "MVC2"; status = "disabled"; };
tegra_amx1: amx@2903000 { compatible = "nvidia,tegra194-amx"; - reg = <0x2903000 0x100>; + reg = <0x0 0x2903000 0x0 0x100>; sound-name-prefix = "AMX1"; status = "disabled"; };
tegra_amx2: amx@2903100 { compatible = "nvidia,tegra194-amx"; - reg = <0x2903100 0x100>; + reg = <0x0 0x2903100 0x0 0x100>; sound-name-prefix = "AMX2"; status = "disabled"; };
tegra_amx3: amx@2903200 { compatible = "nvidia,tegra194-amx"; - reg = <0x2903200 0x100>; + reg = <0x0 0x2903200 0x0 0x100>; sound-name-prefix = "AMX3"; status = "disabled"; };
tegra_amx4: amx@2903300 { compatible = "nvidia,tegra194-amx"; - reg = <0x2903300 0x100>; + reg = <0x0 0x2903300 0x0 0x100>; sound-name-prefix = "AMX4"; status = "disabled"; }; @@ -557,7 +560,7 @@ tegra_amx4: amx@2903300 { tegra_adx1: adx@2903800 { compatible = "nvidia,tegra194-adx", "nvidia,tegra210-adx"; - reg = <0x2903800 0x100>; + reg = <0x0 0x2903800 0x0 0x100>; sound-name-prefix = "ADX1"; status = "disabled"; }; @@ -565,7 +568,7 @@ tegra_adx1: adx@2903800 { tegra_adx2: adx@2903900 { compatible = "nvidia,tegra194-adx", "nvidia,tegra210-adx"; - reg = <0x2903900 0x100>; + reg = <0x0 0x2903900 0x0 0x100>; sound-name-prefix = "ADX2"; status = "disabled"; }; @@ -573,7 +576,7 @@ tegra_adx2: adx@2903900 { tegra_adx3: adx@2903a00 { compatible = "nvidia,tegra194-adx", "nvidia,tegra210-adx"; - reg = <0x2903a00 0x100>; + reg = <0x0 0x2903a00 0x0 0x100>; sound-name-prefix = "ADX3"; status = "disabled"; }; @@ -581,7 +584,7 @@ tegra_adx3: adx@2903a00 { tegra_adx4: adx@2903b00 { compatible = "nvidia,tegra194-adx", "nvidia,tegra210-adx"; - reg = <0x2903b00 0x100>; + reg = <0x0 0x2903b00 0x0 0x100>; sound-name-prefix = "ADX4"; status = "disabled"; }; @@ -589,30 +592,31 @@ tegra_adx4: adx@2903b00 { tegra_ope1: processing-engine@2908000 { compatible = "nvidia,tegra194-ope", "nvidia,tegra210-ope"; - reg = <0x2908000 0x100>; - #address-cells = <1>; - #size-cells = <1>; - ranges; + reg = <0x0 0x2908000 0x0 0x100>; sound-name-prefix = "OPE1"; status = "disabled";
+ #address-cells = <2>; + #size-cells = <2>; + ranges; + equalizer@2908100 { compatible = "nvidia,tegra194-peq", "nvidia,tegra210-peq"; - reg = <0x2908100 0x100>; + reg = <0x0 0x2908100 0x0 0x100>; };
dynamic-range-compressor@2908200 { compatible = "nvidia,tegra194-mbdrc", "nvidia,tegra210-mbdrc"; - reg = <0x2908200 0x200>; + reg = <0x0 0x2908200 0x0 0x200>; }; };
tegra_amixer: amixer@290bb00 { compatible = "nvidia,tegra194-amixer", "nvidia,tegra210-amixer"; - reg = <0x290bb00 0x800>; + reg = <0x0 0x290bb00 0x0 0x800>; sound-name-prefix = "MIXER1"; status = "disabled"; }; @@ -620,7 +624,7 @@ tegra_amixer: amixer@290bb00 { tegra_asrc: asrc@2910000 { compatible = "nvidia,tegra194-asrc", "nvidia,tegra186-asrc"; - reg = <0x2910000 0x2000>; + reg = <0x0 0x2910000 0x0 0x2000>; sound-name-prefix = "ASRC1"; status = "disabled"; }; @@ -629,7 +633,7 @@ tegra_asrc: asrc@2910000 {
pinmux: pinmux@2430000 { compatible = "nvidia,tegra194-pinmux"; - reg = <0x2430000 0x17000>; + reg = <0x0 0x2430000 0x0 0x17000>; status = "okay";
pex_rst_c5_out_state: pinmux-pex-rst-c5-out { @@ -657,24 +661,24 @@ clkreq {
mc: memory-controller@2c00000 { compatible = "nvidia,tegra194-mc"; - reg = <0x02c00000 0x10000>, /* MC-SID */ - <0x02c10000 0x10000>, /* MC Broadcast*/ - <0x02c20000 0x10000>, /* MC0 */ - <0x02c30000 0x10000>, /* MC1 */ - <0x02c40000 0x10000>, /* MC2 */ - <0x02c50000 0x10000>, /* MC3 */ - <0x02b80000 0x10000>, /* MC4 */ - <0x02b90000 0x10000>, /* MC5 */ - <0x02ba0000 0x10000>, /* MC6 */ - <0x02bb0000 0x10000>, /* MC7 */ - <0x01700000 0x10000>, /* MC8 */ - <0x01710000 0x10000>, /* MC9 */ - <0x01720000 0x10000>, /* MC10 */ - <0x01730000 0x10000>, /* MC11 */ - <0x01740000 0x10000>, /* MC12 */ - <0x01750000 0x10000>, /* MC13 */ - <0x01760000 0x10000>, /* MC14 */ - <0x01770000 0x10000>; /* MC15 */ + reg = <0x0 0x02c00000 0x0 0x10000>, /* MC-SID */ + <0x0 0x02c10000 0x0 0x10000>, /* MC Broadcast*/ + <0x0 0x02c20000 0x0 0x10000>, /* MC0 */ + <0x0 0x02c30000 0x0 0x10000>, /* MC1 */ + <0x0 0x02c40000 0x0 0x10000>, /* MC2 */ + <0x0 0x02c50000 0x0 0x10000>, /* MC3 */ + <0x0 0x02b80000 0x0 0x10000>, /* MC4 */ + <0x0 0x02b90000 0x0 0x10000>, /* MC5 */ + <0x0 0x02ba0000 0x0 0x10000>, /* MC6 */ + <0x0 0x02bb0000 0x0 0x10000>, /* MC7 */ + <0x0 0x01700000 0x0 0x10000>, /* MC8 */ + <0x0 0x01710000 0x0 0x10000>, /* MC9 */ + <0x0 0x01720000 0x0 0x10000>, /* MC10 */ + <0x0 0x01730000 0x0 0x10000>, /* MC11 */ + <0x0 0x01740000 0x0 0x10000>, /* MC12 */ + <0x0 0x01750000 0x0 0x10000>, /* MC13 */ + <0x0 0x01760000 0x0 0x10000>, /* MC14 */ + <0x0 0x01770000 0x0 0x10000>; /* MC15 */ reg-names = "sid", "broadcast", "ch0", "ch1", "ch2", "ch3", "ch4", "ch5", "ch6", "ch7", "ch8", "ch9", "ch10", "ch11", "ch12", "ch13", "ch14", "ch15"; @@ -684,10 +688,9 @@ mc: memory-controller@2c00000 {
#address-cells = <2>; #size-cells = <2>; - - ranges = <0x01700000 0x0 0x01700000 0x0 0x100000>, - <0x02b80000 0x0 0x02b80000 0x0 0x040000>, - <0x02c00000 0x0 0x02c00000 0x0 0x100000>; + ranges = <0x0 0x01700000 0x0 0x01700000 0x0 0x100000>, + <0x0 0x02b80000 0x0 0x02b80000 0x0 0x040000>, + <0x0 0x02c00000 0x0 0x02c00000 0x0 0x100000>;
/* * Bit 39 of addresses passing through the memory @@ -704,7 +707,7 @@ mc: memory-controller@2c00000 { * * Limit the DMA range for memory clients to [38:0]. */ - dma-ranges = <0x0 0x0 0x0 0x80 0x0>; + dma-ranges = <0x0 0x0 0x0 0x0 0x80 0x0>;
emc: external-memory-controller@2c60000 { compatible = "nvidia,tegra194-emc"; @@ -722,7 +725,7 @@ emc: external-memory-controller@2c60000 {
timer@3010000 { compatible = "nvidia,tegra186-timer"; - reg = <0x03010000 0x000e0000>; + reg = <0x0 0x03010000 0x0 0x000e0000>; interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>, @@ -738,7 +741,7 @@ timer@3010000 {
uarta: serial@3100000 { compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart"; - reg = <0x03100000 0x40>; + reg = <0x0 0x03100000 0x0 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_UARTA>; @@ -750,7 +753,7 @@ uarta: serial@3100000 {
uartb: serial@3110000 { compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart"; - reg = <0x03110000 0x40>; + reg = <0x0 0x03110000 0x0 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_UARTB>; @@ -762,7 +765,7 @@ uartb: serial@3110000 {
uartd: serial@3130000 { compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart"; - reg = <0x03130000 0x40>; + reg = <0x0 0x03130000 0x0 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_UARTD>; @@ -774,7 +777,7 @@ uartd: serial@3130000 {
uarte: serial@3140000 { compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart"; - reg = <0x03140000 0x40>; + reg = <0x0 0x03140000 0x0 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_UARTE>; @@ -786,7 +789,7 @@ uarte: serial@3140000 {
uartf: serial@3150000 { compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart"; - reg = <0x03150000 0x40>; + reg = <0x0 0x03150000 0x0 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_UARTF>; @@ -798,7 +801,7 @@ uartf: serial@3150000 {
gen1_i2c: i2c@3160000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x03160000 0x10000>; + reg = <0x0 0x03160000 0x0 0x10000>; interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -815,7 +818,7 @@ gen1_i2c: i2c@3160000 {
uarth: serial@3170000 { compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart"; - reg = <0x03170000 0x40>; + reg = <0x0 0x03170000 0x0 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 207 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_UARTH>; @@ -827,7 +830,7 @@ uarth: serial@3170000 {
cam_i2c: i2c@3180000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x03180000 0x10000>; + reg = <0x0 0x03180000 0x0 0x10000>; interrupts = <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -845,7 +848,7 @@ cam_i2c: i2c@3180000 { /* shares pads with dpaux1 */ dp_aux_ch1_i2c: i2c@3190000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x03190000 0x10000>; + reg = <0x0 0x03190000 0x0 0x10000>; interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -866,7 +869,7 @@ dp_aux_ch1_i2c: i2c@3190000 { /* shares pads with dpaux0 */ dp_aux_ch0_i2c: i2c@31b0000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x031b0000 0x10000>; + reg = <0x0 0x031b0000 0x0 0x10000>; interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -887,7 +890,7 @@ dp_aux_ch0_i2c: i2c@31b0000 { /* shares pads with dpaux2 */ dp_aux_ch2_i2c: i2c@31c0000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x031c0000 0x10000>; + reg = <0x0 0x031c0000 0x0 0x10000>; interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -908,7 +911,7 @@ dp_aux_ch2_i2c: i2c@31c0000 { /* shares pads with dpaux3 */ dp_aux_ch3_i2c: i2c@31e0000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x031e0000 0x10000>; + reg = <0x0 0x031e0000 0x0 0x10000>; interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -928,7 +931,7 @@ dp_aux_ch3_i2c: i2c@31e0000 {
spi@3270000 { compatible = "nvidia,tegra194-qspi"; - reg = <0x3270000 0x1000>; + reg = <0x0 0x3270000 0x0 0x1000>; interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -941,7 +944,7 @@ spi@3270000 {
spi@3300000 { compatible = "nvidia,tegra194-qspi"; - reg = <0x3300000 0x1000>; + reg = <0x0 0x3300000 0x0 0x1000>; interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -955,7 +958,7 @@ spi@3300000 { pwm1: pwm@3280000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; - reg = <0x3280000 0x10000>; + reg = <0x0 0x3280000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_PWM1>; resets = <&bpmp TEGRA194_RESET_PWM1>; reset-names = "pwm"; @@ -966,7 +969,7 @@ pwm1: pwm@3280000 { pwm2: pwm@3290000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; - reg = <0x3290000 0x10000>; + reg = <0x0 0x3290000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_PWM2>; resets = <&bpmp TEGRA194_RESET_PWM2>; reset-names = "pwm"; @@ -977,7 +980,7 @@ pwm2: pwm@3290000 { pwm3: pwm@32a0000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; - reg = <0x32a0000 0x10000>; + reg = <0x0 0x32a0000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_PWM3>; resets = <&bpmp TEGRA194_RESET_PWM3>; reset-names = "pwm"; @@ -988,7 +991,7 @@ pwm3: pwm@32a0000 { pwm5: pwm@32c0000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; - reg = <0x32c0000 0x10000>; + reg = <0x0 0x32c0000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_PWM5>; resets = <&bpmp TEGRA194_RESET_PWM5>; reset-names = "pwm"; @@ -999,7 +1002,7 @@ pwm5: pwm@32c0000 { pwm6: pwm@32d0000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; - reg = <0x32d0000 0x10000>; + reg = <0x0 0x32d0000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_PWM6>; resets = <&bpmp TEGRA194_RESET_PWM6>; reset-names = "pwm"; @@ -1010,7 +1013,7 @@ pwm6: pwm@32d0000 { pwm7: pwm@32e0000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; - reg = <0x32e0000 0x10000>; + reg = <0x0 0x32e0000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_PWM7>; resets = <&bpmp TEGRA194_RESET_PWM7>; reset-names = "pwm"; @@ -1021,7 +1024,7 @@ pwm7: pwm@32e0000 { pwm8: pwm@32f0000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; - reg = <0x32f0000 0x10000>; + reg = <0x0 0x32f0000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_PWM8>; resets = <&bpmp TEGRA194_RESET_PWM8>; reset-names = "pwm"; @@ -1031,7 +1034,7 @@ pwm8: pwm@32f0000 {
sdmmc1: mmc@3400000 { compatible = "nvidia,tegra194-sdhci"; - reg = <0x03400000 0x10000>; + reg = <0x0 0x03400000 0x0 0x10000>; interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_SDMMC1>, <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>; @@ -1070,7 +1073,7 @@ sdmmc1: mmc@3400000 {
sdmmc3: mmc@3440000 { compatible = "nvidia,tegra194-sdhci"; - reg = <0x03440000 0x10000>; + reg = <0x0 0x03440000 0x0 0x10000>; interrupts = <GIC_SPI 64 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_SDMMC3>, <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>; @@ -1110,7 +1113,7 @@ sdmmc3: mmc@3440000 {
sdmmc4: mmc@3460000 { compatible = "nvidia,tegra194-sdhci"; - reg = <0x03460000 0x10000>; + reg = <0x0 0x03460000 0x0 0x10000>; interrupts = <GIC_SPI 65 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_SDMMC4>, <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>; @@ -1147,7 +1150,7 @@ sdmmc4: mmc@3460000 {
hda@3510000 { compatible = "nvidia,tegra194-hda"; - reg = <0x3510000 0x10000>; + reg = <0x0 0x3510000 0x0 0x10000>; interrupts = <GIC_SPI 161 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_HDA>, <&bpmp TEGRA194_CLK_HDA2HDMICODEC>, @@ -1166,8 +1169,8 @@ hda@3510000 {
xusb_padctl: padctl@3520000 { compatible = "nvidia,tegra194-xusb-padctl"; - reg = <0x03520000 0x1000>, - <0x03540000 0x1000>; + reg = <0x0 0x03520000 0x0 0x1000>, + <0x0 0x03540000 0x0 0x1000>; reg-names = "padctl", "ao"; interrupts = <GIC_SPI 167 IRQ_TYPE_LEVEL_HIGH>;
@@ -1274,8 +1277,8 @@ usb3-3 {
usb@3550000 { compatible = "nvidia,tegra194-xudc"; - reg = <0x03550000 0x8000>, - <0x03558000 0x1000>; + reg = <0x0 0x03550000 0x0 0x8000>, + <0x0 0x03558000 0x0 0x1000>; reg-names = "base", "fpci"; interrupts = <GIC_SPI 166 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_XUSB_CORE_DEV>, @@ -1296,8 +1299,8 @@ usb@3550000 {
usb@3610000 { compatible = "nvidia,tegra194-xusb"; - reg = <0x03610000 0x40000>, - <0x03600000 0x10000>; + reg = <0x0 0x03610000 0x0 0x40000>, + <0x0 0x03600000 0x0 0x10000>; reg-names = "hcd", "fpci";
interrupts = <GIC_SPI 163 IRQ_TYPE_LEVEL_HIGH>, @@ -1331,7 +1334,7 @@ usb@3610000 {
fuse@3820000 { compatible = "nvidia,tegra194-efuse"; - reg = <0x03820000 0x10000>; + reg = <0x0 0x03820000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_FUSE>; clock-names = "fuse"; }; @@ -1340,10 +1343,10 @@ gic: interrupt-controller@3881000 { compatible = "arm,gic-400"; #interrupt-cells = <3>; interrupt-controller; - reg = <0x03881000 0x1000>, - <0x03882000 0x2000>, - <0x03884000 0x2000>, - <0x03886000 0x2000>; + reg = <0x0 0x03881000 0x0 0x1000>, + <0x0 0x03882000 0x0 0x2000>, + <0x0 0x03884000 0x0 0x2000>, + <0x0 0x03886000 0x0 0x2000>; interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>; interrupt-parent = <&gic>; @@ -1351,7 +1354,7 @@ gic: interrupt-controller@3881000 {
cec@3960000 { compatible = "nvidia,tegra194-cec"; - reg = <0x03960000 0x10000>; + reg = <0x0 0x03960000 0x0 0x10000>; interrupts = <GIC_SPI 162 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_CEC>; clock-names = "cec"; @@ -1360,7 +1363,7 @@ cec@3960000 {
hte_lic: hardware-timestamp@3aa0000 { compatible = "nvidia,tegra194-gte-lic"; - reg = <0x3aa0000 0x10000>; + reg = <0x0 0x3aa0000 0x0 0x10000>; interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>; nvidia,int-threshold = <1>; nvidia,slices = <11>; @@ -1370,7 +1373,7 @@ hte_lic: hardware-timestamp@3aa0000 {
hsp_top0: hsp@3c00000 { compatible = "nvidia,tegra194-hsp"; - reg = <0x03c00000 0xa0000>; + reg = <0x0 0x03c00000 0x0 0xa0000>; interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>, @@ -1388,7 +1391,7 @@ hsp_top0: hsp@3c00000 {
p2u_hsio_0: phy@3e10000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e10000 0x10000>; + reg = <0x0 0x03e10000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1396,7 +1399,7 @@ p2u_hsio_0: phy@3e10000 {
p2u_hsio_1: phy@3e20000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e20000 0x10000>; + reg = <0x0 0x03e20000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1404,7 +1407,7 @@ p2u_hsio_1: phy@3e20000 {
p2u_hsio_2: phy@3e30000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e30000 0x10000>; + reg = <0x0 0x03e30000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1412,7 +1415,7 @@ p2u_hsio_2: phy@3e30000 {
p2u_hsio_3: phy@3e40000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e40000 0x10000>; + reg = <0x0 0x03e40000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1420,7 +1423,7 @@ p2u_hsio_3: phy@3e40000 {
p2u_hsio_4: phy@3e50000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e50000 0x10000>; + reg = <0x0 0x03e50000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1428,7 +1431,7 @@ p2u_hsio_4: phy@3e50000 {
p2u_hsio_5: phy@3e60000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e60000 0x10000>; + reg = <0x0 0x03e60000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1436,7 +1439,7 @@ p2u_hsio_5: phy@3e60000 {
p2u_hsio_6: phy@3e70000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e70000 0x10000>; + reg = <0x0 0x03e70000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1444,7 +1447,7 @@ p2u_hsio_6: phy@3e70000 {
p2u_hsio_7: phy@3e80000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e80000 0x10000>; + reg = <0x0 0x03e80000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1452,7 +1455,7 @@ p2u_hsio_7: phy@3e80000 {
p2u_hsio_8: phy@3e90000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03e90000 0x10000>; + reg = <0x0 0x03e90000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1460,7 +1463,7 @@ p2u_hsio_8: phy@3e90000 {
p2u_hsio_9: phy@3ea0000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03ea0000 0x10000>; + reg = <0x0 0x03ea0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1468,7 +1471,7 @@ p2u_hsio_9: phy@3ea0000 {
p2u_nvhs_0: phy@3eb0000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03eb0000 0x10000>; + reg = <0x0 0x03eb0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1476,7 +1479,7 @@ p2u_nvhs_0: phy@3eb0000 {
p2u_nvhs_1: phy@3ec0000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03ec0000 0x10000>; + reg = <0x0 0x03ec0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1484,7 +1487,7 @@ p2u_nvhs_1: phy@3ec0000 {
p2u_nvhs_2: phy@3ed0000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03ed0000 0x10000>; + reg = <0x0 0x03ed0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1492,7 +1495,7 @@ p2u_nvhs_2: phy@3ed0000 {
p2u_nvhs_3: phy@3ee0000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03ee0000 0x10000>; + reg = <0x0 0x03ee0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1500,7 +1503,7 @@ p2u_nvhs_3: phy@3ee0000 {
p2u_nvhs_4: phy@3ef0000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03ef0000 0x10000>; + reg = <0x0 0x03ef0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1508,7 +1511,7 @@ p2u_nvhs_4: phy@3ef0000 {
p2u_nvhs_5: phy@3f00000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03f00000 0x10000>; + reg = <0x0 0x03f00000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1516,7 +1519,7 @@ p2u_nvhs_5: phy@3f00000 {
p2u_nvhs_6: phy@3f10000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03f10000 0x10000>; + reg = <0x0 0x03f10000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1524,7 +1527,7 @@ p2u_nvhs_6: phy@3f10000 {
p2u_nvhs_7: phy@3f20000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03f20000 0x10000>; + reg = <0x0 0x03f20000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1532,7 +1535,7 @@ p2u_nvhs_7: phy@3f20000 {
p2u_hsio_10: phy@3f30000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03f30000 0x10000>; + reg = <0x0 0x03f30000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1540,7 +1543,7 @@ p2u_hsio_10: phy@3f30000 {
p2u_hsio_11: phy@3f40000 { compatible = "nvidia,tegra194-p2u"; - reg = <0x03f40000 0x10000>; + reg = <0x0 0x03f40000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1548,7 +1551,7 @@ p2u_hsio_11: phy@3f40000 {
sce-noc@b600000 { compatible = "nvidia,tegra194-sce-noc"; - reg = <0xb600000 0x1000>; + reg = <0x0 0xb600000 0x0 0x1000>; interrupts = <GIC_SPI 261 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>; nvidia,axi2apb = <&axi2apb>; @@ -1558,7 +1561,7 @@ sce-noc@b600000 {
rce-noc@be00000 { compatible = "nvidia,tegra194-rce-noc"; - reg = <0xbe00000 0x1000>; + reg = <0x0 0xbe00000 0x0 0x1000>; interrupts = <GIC_SPI 259 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 175 IRQ_TYPE_LEVEL_HIGH>; nvidia,axi2apb = <&axi2apb>; @@ -1568,7 +1571,7 @@ rce-noc@be00000 {
hsp_aon: hsp@c150000 { compatible = "nvidia,tegra194-hsp"; - reg = <0x0c150000 0x90000>; + reg = <0x0 0x0c150000 0x0 0x90000>; interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>, @@ -1583,7 +1586,7 @@ hsp_aon: hsp@c150000 {
hte_aon: hardware-timestamp@c1e0000 { compatible = "nvidia,tegra194-gte-aon"; - reg = <0xc1e0000 0x10000>; + reg = <0x0 0xc1e0000 0x0 0x10000>; interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>; nvidia,int-threshold = <1>; nvidia,slices = <3>; @@ -1593,7 +1596,7 @@ hte_aon: hardware-timestamp@c1e0000 {
gen2_i2c: i2c@c240000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x0c240000 0x10000>; + reg = <0x0 0x0c240000 0x0 0x10000>; interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -1610,7 +1613,7 @@ gen2_i2c: i2c@c240000 {
gen8_i2c: i2c@c250000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x0c250000 0x10000>; + reg = <0x0 0x0c250000 0x0 0x10000>; interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -1627,7 +1630,7 @@ gen8_i2c: i2c@c250000 {
uartc: serial@c280000 { compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart"; - reg = <0x0c280000 0x40>; + reg = <0x0 0x0c280000 0x0 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_UARTC>; @@ -1639,7 +1642,7 @@ uartc: serial@c280000 {
uartg: serial@c290000 { compatible = "nvidia,tegra194-uart", "nvidia,tegra20-uart"; - reg = <0x0c290000 0x40>; + reg = <0x0 0x0c290000 0x0 0x40>; reg-shift = <2>; interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_UARTG>; @@ -1651,7 +1654,7 @@ uartg: serial@c290000 {
rtc: rtc@c2a0000 { compatible = "nvidia,tegra194-rtc", "nvidia,tegra20-rtc"; - reg = <0x0c2a0000 0x10000>; + reg = <0x0 0x0c2a0000 0x0 0x10000>; interrupt-parent = <&pmc>; interrupts = <73 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_CLK_32K>; @@ -1662,8 +1665,8 @@ rtc: rtc@c2a0000 { gpio_aon: gpio@c2f0000 { compatible = "nvidia,tegra194-gpio-aon"; reg-names = "security", "gpio"; - reg = <0xc2f0000 0x1000>, - <0xc2f1000 0x1000>; + reg = <0x0 0xc2f0000 0x0 0x1000>, + <0x0 0xc2f1000 0x0 0x1000>; interrupts = <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>, @@ -1677,7 +1680,7 @@ gpio_aon: gpio@c2f0000 {
pinmux_aon: pinmux@c300000 { compatible = "nvidia,tegra194-pinmux-aon"; - reg = <0xc300000 0x4000>; + reg = <0x0 0xc300000 0x0 0x4000>;
status = "okay"; }; @@ -1685,7 +1688,7 @@ pinmux_aon: pinmux@c300000 { pwm4: pwm@c340000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; - reg = <0xc340000 0x10000>; + reg = <0x0 0xc340000 0x0 0x10000>; clocks = <&bpmp TEGRA194_CLK_PWM4>; resets = <&bpmp TEGRA194_RESET_PWM4>; reset-names = "pwm"; @@ -1695,11 +1698,11 @@ pwm4: pwm@c340000 {
pmc: pmc@c360000 { compatible = "nvidia,tegra194-pmc"; - reg = <0x0c360000 0x10000>, - <0x0c370000 0x10000>, - <0x0c380000 0x10000>, - <0x0c390000 0x10000>, - <0x0c3a0000 0x10000>; + reg = <0x0 0x0c360000 0x0 0x10000>, + <0x0 0x0c370000 0x0 0x10000>, + <0x0 0x0c380000 0x0 0x10000>, + <0x0 0x0c390000 0x0 0x10000>, + <0x0 0x0c3a0000 0x0 0x10000>; reg-names = "pmc", "wake", "aotag", "scratch", "misc";
#interrupt-cells = <2>; @@ -1727,7 +1730,7 @@ sdmmc3_1v8: sdmmc3-1v8 {
aon-noc@c600000 { compatible = "nvidia,tegra194-aon-noc"; - reg = <0xc600000 0x1000>; + reg = <0x0 0xc600000 0x0 0x1000>; interrupts = <GIC_SPI 260 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 172 IRQ_TYPE_LEVEL_HIGH>; nvidia,apbmisc = <&apbmisc>; @@ -1736,7 +1739,7 @@ aon-noc@c600000 {
bpmp-noc@d600000 { compatible = "nvidia,tegra194-bpmp-noc"; - reg = <0xd600000 0x1000>; + reg = <0x0 0xd600000 0x0 0x1000>; interrupts = <GIC_SPI 262 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>; nvidia,axi2apb = <&axi2apb>; @@ -1746,7 +1749,7 @@ bpmp-noc@d600000 {
iommu@10000000 { compatible = "nvidia,tegra194-smmu", "nvidia,smmu-500"; - reg = <0x10000000 0x800000>; + reg = <0x0 0x10000000 0x0 0x800000>; interrupts = <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, @@ -1822,8 +1825,8 @@ iommu@10000000 {
smmu: iommu@12000000 { compatible = "nvidia,tegra194-smmu", "nvidia,smmu-500"; - reg = <0x12000000 0x800000>, - <0x11000000 0x800000>; + reg = <0x0 0x12000000 0x0 0x800000>, + <0x0 0x11000000 0x0 0x800000>; interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 232 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>, @@ -1900,8 +1903,8 @@ smmu: iommu@12000000 {
host1x@13e00000 { compatible = "nvidia,tegra194-host1x"; - reg = <0x13e00000 0x10000>, - <0x13e10000 0x10000>; + reg = <0x0 0x13e00000 0x0 0x10000>, + <0x0 0x13e10000 0x0 0x10000>; reg-names = "hypervisor", "vm"; interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>; @@ -1911,10 +1914,10 @@ host1x@13e00000 { resets = <&bpmp TEGRA194_RESET_HOST1X>; reset-names = "host1x";
- #address-cells = <1>; - #size-cells = <1>; + #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x14800000 0x0 0x14800000 0x0 0x02800000>;
- ranges = <0x14800000 0x14800000 0x02800000>; interconnects = <&mc TEGRA194_MEMORY_CLIENT_HOST1XDMAR &emc>; interconnect-names = "dma-mem"; iommus = <&smmu TEGRA194_SID_HOST1X>; @@ -1931,7 +1934,7 @@ host1x@13e00000 {
nvdec@15140000 { compatible = "nvidia,tegra194-nvdec"; - reg = <0x15140000 0x00040000>; + reg = <0x0 0x15140000 0x0 0x00040000>; clocks = <&bpmp TEGRA194_CLK_NVDEC1>; clock-names = "nvdec"; resets = <&bpmp TEGRA194_RESET_NVDEC1>; @@ -1950,7 +1953,7 @@ nvdec@15140000 {
display-hub@15200000 { compatible = "nvidia,tegra194-display"; - reg = <0x15200000 0x00040000>; + reg = <0x0 0x15200000 0x0 0x00040000>; resets = <&bpmp TEGRA194_RESET_NVDISPLAY0_MISC>, <&bpmp TEGRA194_RESET_NVDISPLAY0_WGRP0>, <&bpmp TEGRA194_RESET_NVDISPLAY0_WGRP1>, @@ -1967,14 +1970,13 @@ display-hub@15200000 {
power-domains = <&bpmp TEGRA194_POWER_DOMAIN_DISP>;
- #address-cells = <1>; - #size-cells = <1>; - - ranges = <0x15200000 0x15200000 0x40000>; + #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x15200000 0x0 0x15200000 0x0 0x40000>;
display@15200000 { compatible = "nvidia,tegra194-dc"; - reg = <0x15200000 0x10000>; + reg = <0x0 0x15200000 0x0 0x10000>; interrupts = <GIC_SPI 153 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_NVDISPLAY_P0>; clock-names = "dc"; @@ -1992,7 +1994,7 @@ display@15200000 {
display@15210000 { compatible = "nvidia,tegra194-dc"; - reg = <0x15210000 0x10000>; + reg = <0x0 0x15210000 0x0 0x10000>; interrupts = <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_NVDISPLAY_P1>; clock-names = "dc"; @@ -2010,7 +2012,7 @@ display@15210000 {
display@15220000 { compatible = "nvidia,tegra194-dc"; - reg = <0x15220000 0x10000>; + reg = <0x0 0x15220000 0x0 0x10000>; interrupts = <GIC_SPI 155 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_NVDISPLAY_P2>; clock-names = "dc"; @@ -2028,7 +2030,7 @@ display@15220000 {
display@15230000 { compatible = "nvidia,tegra194-dc"; - reg = <0x15230000 0x10000>; + reg = <0x0 0x15230000 0x0 0x10000>; interrupts = <GIC_SPI 242 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_NVDISPLAY_P3>; clock-names = "dc"; @@ -2047,7 +2049,7 @@ display@15230000 {
vic@15340000 { compatible = "nvidia,tegra194-vic"; - reg = <0x15340000 0x00040000>; + reg = <0x0 0x15340000 0x0 0x00040000>; interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_VIC>; clock-names = "vic"; @@ -2064,7 +2066,7 @@ vic@15340000 {
nvjpg@15380000 { compatible = "nvidia,tegra194-nvjpg"; - reg = <0x15380000 0x40000>; + reg = <0x0 0x15380000 0x0 0x40000>; clocks = <&bpmp TEGRA194_CLK_NVJPG>; clock-names = "nvjpg"; resets = <&bpmp TEGRA194_RESET_NVJPG>; @@ -2080,7 +2082,7 @@ nvjpg@15380000 {
nvdec@15480000 { compatible = "nvidia,tegra194-nvdec"; - reg = <0x15480000 0x00040000>; + reg = <0x0 0x15480000 0x0 0x00040000>; clocks = <&bpmp TEGRA194_CLK_NVDEC>; clock-names = "nvdec"; resets = <&bpmp TEGRA194_RESET_NVDEC>; @@ -2099,7 +2101,7 @@ nvdec@15480000 {
nvenc@154c0000 { compatible = "nvidia,tegra194-nvenc"; - reg = <0x154c0000 0x40000>; + reg = <0x0 0x154c0000 0x0 0x40000>; clocks = <&bpmp TEGRA194_CLK_NVENC>; clock-names = "nvenc"; resets = <&bpmp TEGRA194_RESET_NVENC>; @@ -2118,7 +2120,7 @@ nvenc@154c0000 {
dpaux0: dpaux@155c0000 { compatible = "nvidia,tegra194-dpaux"; - reg = <0x155c0000 0x10000>; + reg = <0x0 0x155c0000 0x0 0x10000>; interrupts = <GIC_SPI 159 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_DPAUX>, <&bpmp TEGRA194_CLK_PLLDP>; @@ -2152,7 +2154,7 @@ i2c-bus {
dpaux1: dpaux@155d0000 { compatible = "nvidia,tegra194-dpaux"; - reg = <0x155d0000 0x10000>; + reg = <0x0 0x155d0000 0x0 0x10000>; interrupts = <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_DPAUX1>, <&bpmp TEGRA194_CLK_PLLDP>; @@ -2186,7 +2188,7 @@ i2c-bus {
dpaux2: dpaux@155e0000 { compatible = "nvidia,tegra194-dpaux"; - reg = <0x155e0000 0x10000>; + reg = <0x0 0x155e0000 0x0 0x10000>; interrupts = <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_DPAUX2>, <&bpmp TEGRA194_CLK_PLLDP>; @@ -2220,7 +2222,7 @@ i2c-bus {
dpaux3: dpaux@155f0000 { compatible = "nvidia,tegra194-dpaux"; - reg = <0x155f0000 0x10000>; + reg = <0x0 0x155f0000 0x0 0x10000>; interrupts = <GIC_SPI 246 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_DPAUX3>, <&bpmp TEGRA194_CLK_PLLDP>; @@ -2254,7 +2256,7 @@ i2c-bus {
nvenc@15a80000 { compatible = "nvidia,tegra194-nvenc"; - reg = <0x15a80000 0x00040000>; + reg = <0x0 0x15a80000 0x0 0x00040000>; clocks = <&bpmp TEGRA194_CLK_NVENC1>; clock-names = "nvenc"; resets = <&bpmp TEGRA194_RESET_NVENC1>; @@ -2273,7 +2275,7 @@ nvenc@15a80000 {
sor0: sor@15b00000 { compatible = "nvidia,tegra194-sor"; - reg = <0x15b00000 0x40000>; + reg = <0x0 0x15b00000 0x0 0x40000>; interrupts = <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_SOR0_REF>, <&bpmp TEGRA194_CLK_SOR0_OUT>, @@ -2297,7 +2299,7 @@ sor0: sor@15b00000 {
sor1: sor@15b40000 { compatible = "nvidia,tegra194-sor"; - reg = <0x15b40000 0x40000>; + reg = <0x0 0x15b40000 0x0 0x40000>; interrupts = <GIC_SPI 158 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_SOR1_REF>, <&bpmp TEGRA194_CLK_SOR1_OUT>, @@ -2321,7 +2323,7 @@ sor1: sor@15b40000 {
sor2: sor@15b80000 { compatible = "nvidia,tegra194-sor"; - reg = <0x15b80000 0x40000>; + reg = <0x0 0x15b80000 0x0 0x40000>; interrupts = <GIC_SPI 243 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_SOR2_REF>, <&bpmp TEGRA194_CLK_SOR2_OUT>, @@ -2345,7 +2347,7 @@ sor2: sor@15b80000 {
sor3: sor@15bc0000 { compatible = "nvidia,tegra194-sor"; - reg = <0x15bc0000 0x40000>; + reg = <0x0 0x15bc0000 0x0 0x40000>; interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA194_CLK_SOR3_REF>, <&bpmp TEGRA194_CLK_SOR3_OUT>, @@ -2368,482 +2370,484 @@ sor3: sor@15bc0000 { }; };
- gpu@17000000 { - compatible = "nvidia,gv11b"; - reg = <0x17000000 0x1000000>, - <0x18000000 0x1000000>; - interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>; - interrupt-names = "stall", "nonstall"; - clocks = <&bpmp TEGRA194_CLK_GPCCLK>, - <&bpmp TEGRA194_CLK_GPU_PWR>, - <&bpmp TEGRA194_CLK_FUSE>; - clock-names = "gpu", "pwr", "fuse"; - resets = <&bpmp TEGRA194_RESET_GPU>; - reset-names = "gpu"; - dma-coherent; + pcie@14100000 { + compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; + reg = <0x0 0x14100000 0x0 0x00020000>, /* appl registers (128K) */ + <0x0 0x30000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x0 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x0 0x30080000 0x0 0x00040000>; /* DBI reg space (256K) */ + reg-names = "appl", "config", "atu_dma", "dbi";
- power-domains = <&bpmp TEGRA194_POWER_DOMAIN_GPU>; - interconnects = <&mc TEGRA194_MEMORY_CLIENT_NVL1R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL1RHP &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL1W &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL2R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL2RHP &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL2W &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL3R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL3RHP &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL3W &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL4R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL4RHP &emc>, - <&mc TEGRA194_MEMORY_CLIENT_NVL4W &emc>; - interconnect-names = "dma-mem", "read-0-hp", "write-0", - "read-1", "read-1-hp", "write-1", - "read-2", "read-2-hp", "write-2", - "read-3", "read-3-hp", "write-3"; - }; - }; + status = "disabled";
- pcie@14100000 { - compatible = "nvidia,tegra194-pcie"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; - reg = <0x00 0x14100000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x30000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x30080000 0x0 0x00040000>; /* DBI reg space (256K) */ - reg-names = "appl", "config", "atu_dma", "dbi"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <1>; + linux,pci-domain = <1>;
- status = "disabled"; + clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_1>; + clock-names = "core";
- #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <1>; - linux,pci-domain = <1>; + resets = <&bpmp TEGRA194_RESET_PEX0_CORE_1_APB>, + <&bpmp TEGRA194_RESET_PEX0_CORE_1>; + reset-names = "apb", "core";
- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_1>; - clock-names = "core"; + interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_1_APB>, - <&bpmp TEGRA194_RESET_PEX0_CORE_1>; - reset-names = "apb", "core"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
- interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + nvidia,bpmp = <&bpmp 1>;
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- nvidia,bpmp = <&bpmp 1>; + bus-range = <0x0 0xff>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + ranges = <0x43000000 0x12 0x00000000 0x12 0x00000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */ + <0x02000000 0x0 0x40000000 0x12 0x30000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB - 64 KiB) */ + <0x01000000 0x0 0x00000000 0x12 0x3fff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
- bus-range = <0x0 0xff>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE1R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE1W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE1 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- ranges = <0x43000000 0x12 0x00000000 0x12 0x00000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */ - <0x02000000 0x0 0x40000000 0x12 0x30000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB - 64 KiB) */ - <0x01000000 0x0 0x00000000 0x12 0x3fff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */ + pcie@14120000 { + compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; + reg = <0x00 0x14120000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x32000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x32040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x32080000 0x0 0x00040000>; /* DBI reg space (256K) */ + reg-names = "appl", "config", "atu_dma", "dbi";
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE1R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE1W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE1 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; - }; + status = "disabled";
- pcie@14120000 { - compatible = "nvidia,tegra194-pcie"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; - reg = <0x00 0x14120000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x32000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x32040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x32080000 0x0 0x00040000>; /* DBI reg space (256K) */ - reg-names = "appl", "config", "atu_dma", "dbi"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <1>; + linux,pci-domain = <2>;
- status = "disabled"; + clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_2>; + clock-names = "core";
- #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <1>; - linux,pci-domain = <2>; + resets = <&bpmp TEGRA194_RESET_PEX0_CORE_2_APB>, + <&bpmp TEGRA194_RESET_PEX0_CORE_2>; + reset-names = "apb", "core";
- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_2>; - clock-names = "core"; + interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_2_APB>, - <&bpmp TEGRA194_RESET_PEX0_CORE_2>; - reset-names = "apb", "core"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>;
- interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + nvidia,bpmp = <&bpmp 2>;
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- nvidia,bpmp = <&bpmp 2>; + bus-range = <0x0 0xff>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + ranges = <0x43000000 0x12 0x40000000 0x12 0x40000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */ + <0x02000000 0x0 0x40000000 0x12 0x70000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB - 64 KiB) */ + <0x01000000 0x0 0x00000000 0x12 0x7fff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
- bus-range = <0x0 0xff>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE2AR &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE2AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE2 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- ranges = <0x43000000 0x12 0x40000000 0x12 0x40000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */ - <0x02000000 0x0 0x40000000 0x12 0x70000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB - 64 KiB) */ - <0x01000000 0x0 0x00000000 0x12 0x7fff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */ + pcie@14140000 { + compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; + reg = <0x00 0x14140000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x34000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x34040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x34080000 0x0 0x00040000>; /* DBI reg space (256K) */ + reg-names = "appl", "config", "atu_dma", "dbi";
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE2AR &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE2AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE2 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; - }; + status = "disabled";
- pcie@14140000 { - compatible = "nvidia,tegra194-pcie"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; - reg = <0x00 0x14140000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x34000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x34040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x34080000 0x0 0x00040000>; /* DBI reg space (256K) */ - reg-names = "appl", "config", "atu_dma", "dbi"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <1>; + linux,pci-domain = <3>;
- status = "disabled"; + clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_3>; + clock-names = "core";
- #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <1>; - linux,pci-domain = <3>; + resets = <&bpmp TEGRA194_RESET_PEX0_CORE_3_APB>, + <&bpmp TEGRA194_RESET_PEX0_CORE_3>; + reset-names = "apb", "core";
- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_3>; - clock-names = "core"; + interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_3_APB>, - <&bpmp TEGRA194_RESET_PEX0_CORE_3>; - reset-names = "apb", "core"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
- interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + nvidia,bpmp = <&bpmp 3>;
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- nvidia,bpmp = <&bpmp 3>; + bus-range = <0x0 0xff>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + ranges = <0x43000000 0x12 0x80000000 0x12 0x80000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */ + <0x02000000 0x0 0x40000000 0x12 0xb0000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB + 64 KiB) */ + <0x01000000 0x0 0x00000000 0x12 0xbfff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
- bus-range = <0x0 0xff>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE3R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE3W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE3 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- ranges = <0x43000000 0x12 0x80000000 0x12 0x80000000 0x0 0x30000000>, /* prefetchable memory (768 MiB) */ - <0x02000000 0x0 0x40000000 0x12 0xb0000000 0x0 0x0fff0000>, /* non-prefetchable memory (256 MiB + 64 KiB) */ - <0x01000000 0x0 0x00000000 0x12 0xbfff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */ + pcie@14160000 { + compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>; + reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x36000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x36080000 0x0 0x00040000>; /* DBI reg space (256K) */ + reg-names = "appl", "config", "atu_dma", "dbi";
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE3R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE3W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE3 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; - }; + status = "disabled";
- pcie@14160000 { - compatible = "nvidia,tegra194-pcie"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>; - reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x36000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x36080000 0x0 0x00040000>; /* DBI reg space (256K) */ - reg-names = "appl", "config", "atu_dma", "dbi"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <4>; + linux,pci-domain = <4>;
- status = "disabled"; + clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>; + clock-names = "core";
- #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <4>; - linux,pci-domain = <4>; + resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>, + <&bpmp TEGRA194_RESET_PEX0_CORE_4>; + reset-names = "apb", "core";
- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>; - clock-names = "core"; + interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>, - <&bpmp TEGRA194_RESET_PEX0_CORE_4>; - reset-names = "apb", "core"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>;
- interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + nvidia,bpmp = <&bpmp 4>;
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- nvidia,bpmp = <&bpmp 4>; + bus-range = <0x0 0xff>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + ranges = <0x43000000 0x14 0x00000000 0x14 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */ + <0x02000000 0x0 0x40000000 0x17 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */ + <0x01000000 0x0 0x00000000 0x17 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
- bus-range = <0x0 0xff>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE4R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE4W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE4 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- ranges = <0x43000000 0x14 0x00000000 0x14 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */ - <0x02000000 0x0 0x40000000 0x17 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */ - <0x01000000 0x0 0x00000000 0x17 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */ + pcie-ep@14160000 { + compatible = "nvidia,tegra194-pcie-ep"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>; + reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x36080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x14 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ + reg-names = "appl", "atu_dma", "dbi", "addr_space";
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE4R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE4W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE4 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; - }; + status = "disabled";
- pcie@14180000 { - compatible = "nvidia,tegra194-pcie"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; - reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x38000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x38080000 0x0 0x00040000>; /* DBI reg space (256K) */ - reg-names = "appl", "config", "atu_dma", "dbi"; + num-lanes = <4>; + num-ib-windows = <2>; + num-ob-windows = <8>;
- status = "disabled"; + clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>; + clock-names = "core";
- #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <8>; - linux,pci-domain = <0>; + resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>, + <&bpmp TEGRA194_RESET_PEX0_CORE_4>; + reset-names = "apb", "core";
- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>; - clock-names = "core"; + interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ + interrupt-names = "intr";
- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>, - <&bpmp TEGRA194_RESET_PEX0_CORE_0>; - reset-names = "apb", "core"; + nvidia,bpmp = <&bpmp 4>;
- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE4R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE4W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE4 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- nvidia,bpmp = <&bpmp 0>; + pcie@14180000 { + compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; + reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x38000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x38080000 0x0 0x00040000>; /* DBI reg space (256K) */ + reg-names = "appl", "config", "atu_dma", "dbi";
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + status = "disabled";
- bus-range = <0x0 0xff>; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <8>; + linux,pci-domain = <0>;
- ranges = <0x43000000 0x18 0x00000000 0x18 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */ - <0x02000000 0x0 0x40000000 0x1b 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */ - <0x01000000 0x0 0x00000000 0x1b 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */ + clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>; + clock-names = "core";
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE0R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE0W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE0 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; - }; + resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>, + <&bpmp TEGRA194_RESET_PEX0_CORE_0>; + reset-names = "apb", "core";
- pcie@141a0000 { - compatible = "nvidia,tegra194-pcie"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>; - reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x3a000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x3a080000 0x0 0x00040000>; /* DBI reg space (256K) */ - reg-names = "appl", "config", "atu_dma", "dbi"; + interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- status = "disabled"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
- #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <8>; - linux,pci-domain = <5>; + nvidia,bpmp = <&bpmp 0>;
- pinctrl-names = "default"; - pinctrl-0 = <&pex_rst_c5_out_state>, <&clkreq_c5_bi_dir_state>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>; - clock-names = "core"; + bus-range = <0x0 0xff>;
- resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>, - <&bpmp TEGRA194_RESET_PEX1_CORE_5>; - reset-names = "apb", "core"; + ranges = <0x43000000 0x18 0x00000000 0x18 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */ + <0x02000000 0x0 0x40000000 0x1b 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */ + <0x01000000 0x0 0x00000000 0x1b 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
- interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE0R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE0W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE0 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- nvidia,bpmp = <&bpmp 5>; + pcie-ep@14180000 { + compatible = "nvidia,tegra194-pcie-ep"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; + reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x38080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x18 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ + reg-names = "appl", "atu_dma", "dbi", "addr_space";
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; + status = "disabled";
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + num-lanes = <8>; + num-ib-windows = <2>; + num-ob-windows = <8>;
- bus-range = <0x0 0xff>; + clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>; + clock-names = "core";
- ranges = <0x43000000 0x1c 0x00000000 0x1c 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */ - <0x02000000 0x0 0x40000000 0x1f 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */ - <0x01000000 0x0 0x00000000 0x1f 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */ + resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>, + <&bpmp TEGRA194_RESET_PEX0_CORE_0>; + reset-names = "apb", "core";
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE5R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE5W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE5 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; - }; + interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ + interrupt-names = "intr";
- pcie-ep@14160000 { - compatible = "nvidia,tegra194-pcie-ep"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>; - reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x36080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x14 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ - reg-names = "appl", "atu_dma", "dbi", "addr_space"; + nvidia,bpmp = <&bpmp 0>;
- status = "disabled"; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- num-lanes = <4>; - num-ib-windows = <2>; - num-ob-windows = <8>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE0R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE0W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE0 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>; - clock-names = "core"; + pcie@141a0000 { + compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>; + reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x3a000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x3a080000 0x0 0x00040000>; /* DBI reg space (256K) */ + reg-names = "appl", "config", "atu_dma", "dbi";
- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>, - <&bpmp TEGRA194_RESET_PEX0_CORE_4>; - reset-names = "apb", "core"; + status = "disabled";
- interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ - interrupt-names = "intr"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <8>; + linux,pci-domain = <5>;
- nvidia,bpmp = <&bpmp 4>; + pinctrl-names = "default"; + pinctrl-0 = <&pex_rst_c5_out_state>, <&clkreq_c5_bi_dir_state>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>; + clock-names = "core";
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE4R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE4W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE4 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; - }; + resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>, + <&bpmp TEGRA194_RESET_PEX1_CORE_5>; + reset-names = "apb", "core";
- pcie-ep@14180000 { - compatible = "nvidia,tegra194-pcie-ep"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; - reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x38080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x18 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ - reg-names = "appl", "atu_dma", "dbi", "addr_space"; + interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- status = "disabled"; + nvidia,bpmp = <&bpmp 5>;
- num-lanes = <8>; - num-ib-windows = <2>; - num-ob-windows = <8>; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
- clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>; - clock-names = "core"; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>, - <&bpmp TEGRA194_RESET_PEX0_CORE_0>; - reset-names = "apb", "core"; + bus-range = <0x0 0xff>;
- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ - interrupt-names = "intr"; + ranges = <0x43000000 0x1c 0x00000000 0x1c 0x00000000 0x3 0x40000000>, /* prefetchable memory (13 GiB) */ + <0x02000000 0x0 0x40000000 0x1f 0x40000000 0x0 0xbfff0000>, /* non-prefetchable memory (3 GiB - 64 KiB) */ + <0x01000000 0x0 0x00000000 0x1f 0xffff0000 0x0 0x00010000>; /* downstream I/O (64 KiB) */
- nvidia,bpmp = <&bpmp 0>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE5R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE5W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE5 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + pcie-ep@141a0000 { + compatible = "nvidia,tegra194-pcie-ep"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>; + reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x1c 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ + reg-names = "appl", "atu_dma", "dbi", "addr_space";
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE0R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE0W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE0 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; - }; + status = "disabled";
- pcie-ep@141a0000 { - compatible = "nvidia,tegra194-pcie-ep"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>; - reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x1c 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ - reg-names = "appl", "atu_dma", "dbi", "addr_space"; + num-lanes = <8>; + num-ib-windows = <2>; + num-ob-windows = <8>;
- status = "disabled"; + pinctrl-names = "default"; + pinctrl-0 = <&clkreq_c5_bi_dir_state>;
- num-lanes = <8>; - num-ib-windows = <2>; - num-ob-windows = <8>; + clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>; + clock-names = "core";
- pinctrl-names = "default"; - pinctrl-0 = <&clkreq_c5_bi_dir_state>; + resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>, + <&bpmp TEGRA194_RESET_PEX1_CORE_5>; + reset-names = "apb", "core";
- clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>; - clock-names = "core"; + interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ + interrupt-names = "intr";
- resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>, - <&bpmp TEGRA194_RESET_PEX1_CORE_5>; - reset-names = "apb", "core"; + nvidia,bpmp = <&bpmp 5>;
- interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ - interrupt-names = "intr"; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- nvidia,bpmp = <&bpmp 5>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE5R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_PCIE5W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu TEGRA194_SID_PCIE5 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + };
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + gpu@17000000 { + compatible = "nvidia,gv11b"; + reg = <0x0 0x17000000 0x0 0x1000000>, + <0x0 0x18000000 0x0 0x1000000>; + interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "stall", "nonstall"; + clocks = <&bpmp TEGRA194_CLK_GPCCLK>, + <&bpmp TEGRA194_CLK_GPU_PWR>, + <&bpmp TEGRA194_CLK_FUSE>; + clock-names = "gpu", "pwr", "fuse"; + resets = <&bpmp TEGRA194_RESET_GPU>; + reset-names = "gpu"; + dma-coherent;
- interconnects = <&mc TEGRA194_MEMORY_CLIENT_PCIE5R &emc>, - <&mc TEGRA194_MEMORY_CLIENT_PCIE5W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu TEGRA194_SID_PCIE5 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_GPU>; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_NVL1R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL1RHP &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL1W &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL2R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL2RHP &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL2W &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL3R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL3RHP &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL3W &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL4R &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL4RHP &emc>, + <&mc TEGRA194_MEMORY_CLIENT_NVL4W &emc>; + interconnect-names = "dma-mem", "read-0-hp", "write-0", + "read-1", "read-1-hp", "write-1", + "read-2", "read-2-hp", "write-2", + "read-3", "read-3-hp", "write-3"; + }; };
sram@40000000 { compatible = "nvidia,tegra194-sysram", "mmio-sram"; reg = <0x0 0x40000000 0x0 0x50000>; + #address-cells = <1>; #size-cells = <1>; ranges = <0x0 0x0 0x40000000 0x50000>; + no-memory-wc;
cpu_bpmp_tx: sram@4e000 { diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts index 96aa2267b06d8..431f42a266f5b 100644 --- a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +++ b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts @@ -2048,6 +2048,57 @@ mgbe0_phy: phy@0 { }; }; }; + + pcie@14100000 { + status = "okay"; + + vddio-pex-ctl-supply = <&vdd_1v8_ao>; + + phys = <&p2u_hsio_3>; + phy-names = "p2u-0"; + }; + + pcie@14160000 { + status = "okay"; + + vddio-pex-ctl-supply = <&vdd_1v8_ao>; + + phys = <&p2u_hsio_4>, <&p2u_hsio_5>, <&p2u_hsio_6>, + <&p2u_hsio_7>; + phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3"; + }; + + pcie@141a0000 { + status = "okay"; + + vddio-pex-ctl-supply = <&vdd_1v8_ls>; + vpcie3v3-supply = <&vdd_3v3_pcie>; + vpcie12v-supply = <&vdd_12v_pcie>; + + phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, + <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, + <&p2u_nvhs_6>, <&p2u_nvhs_7>; + phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", + "p2u-5", "p2u-6", "p2u-7"; + }; + + pcie-ep@141a0000 { + status = "disabled"; + + vddio-pex-ctl-supply = <&vdd_1v8_ls>; + + reset-gpios = <&gpio TEGRA234_MAIN_GPIO(AF, 1) GPIO_ACTIVE_LOW>; + + nvidia,refclk-select-gpios = <&gpio_aon + TEGRA234_AON_GPIO(AA, 4) + GPIO_ACTIVE_HIGH>; + + phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, + <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, + <&p2u_nvhs_6>, <&p2u_nvhs_7>; + phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", + "p2u-5", "p2u-6", "p2u-7"; + }; };
gpio-keys { @@ -2145,57 +2196,6 @@ sound { label = "NVIDIA Jetson AGX Orin APE"; };
- pcie@14100000 { - status = "okay"; - - vddio-pex-ctl-supply = <&vdd_1v8_ao>; - - phys = <&p2u_hsio_3>; - phy-names = "p2u-0"; - }; - - pcie@14160000 { - status = "okay"; - - vddio-pex-ctl-supply = <&vdd_1v8_ao>; - - phys = <&p2u_hsio_4>, <&p2u_hsio_5>, <&p2u_hsio_6>, - <&p2u_hsio_7>; - phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3"; - }; - - pcie@141a0000 { - status = "okay"; - - vddio-pex-ctl-supply = <&vdd_1v8_ls>; - vpcie3v3-supply = <&vdd_3v3_pcie>; - vpcie12v-supply = <&vdd_12v_pcie>; - - phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, - <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, - <&p2u_nvhs_6>, <&p2u_nvhs_7>; - phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", - "p2u-5", "p2u-6", "p2u-7"; - }; - - pcie-ep@141a0000 { - status = "disabled"; - - vddio-pex-ctl-supply = <&vdd_1v8_ls>; - - reset-gpios = <&gpio TEGRA234_MAIN_GPIO(AF, 1) GPIO_ACTIVE_LOW>; - - nvidia,refclk-select-gpios = <&gpio_aon - TEGRA234_AON_GPIO(AA, 4) - GPIO_ACTIVE_HIGH>; - - phys = <&p2u_nvhs_0>, <&p2u_nvhs_1>, <&p2u_nvhs_2>, - <&p2u_nvhs_3>, <&p2u_nvhs_4>, <&p2u_nvhs_5>, - <&p2u_nvhs_6>, <&p2u_nvhs_7>; - phy-names = "p2u-0", "p2u-1", "p2u-2", "p2u-3", "p2u-4", - "p2u-5", "p2u-6", "p2u-7"; - }; - pwm-fan { compatible = "pwm-fan"; pwms = <&pwm3 0 45334>; diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi index eaf05ee9acd18..3d680ee0f4d17 100644 --- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi @@ -17,15 +17,15 @@ / {
bus@0 { compatible = "simple-bus"; - #address-cells = <1>; - #size-cells = <1>;
- ranges = <0x0 0x0 0x0 0x40000000>; + #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x0 0x0 0x0 0x0 0x40000000>;
gpcdma: dma-controller@2600000 { compatible = "nvidia,tegra234-gpcdma", "nvidia,tegra186-gpcdma"; - reg = <0x2600000 0x210000>; + reg = <0x0 0x2600000 0x0 0x210000>; resets = <&bpmp TEGRA234_RESET_GPCDMA>; reset-names = "gpcdma"; interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>, @@ -73,27 +73,29 @@ aconnect@2900000 { <&bpmp TEGRA234_CLK_APB2APE>; clock-names = "ape", "apb2ape"; power-domains = <&bpmp TEGRA234_POWER_DOMAIN_AUD>; - #address-cells = <1>; - #size-cells = <1>; - ranges = <0x02900000 0x02900000 0x200000>; status = "disabled";
+ #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x02900000 0x0 0x02900000 0x0 0x200000>; + tegra_ahub: ahub@2900800 { compatible = "nvidia,tegra234-ahub"; - reg = <0x02900800 0x800>; + reg = <0x0 0x02900800 0x0 0x800>; clocks = <&bpmp TEGRA234_CLK_AHUB>; clock-names = "ahub"; assigned-clocks = <&bpmp TEGRA234_CLK_AHUB>; assigned-clock-parents = <&bpmp TEGRA234_CLK_PLLA_OUT0>; - #address-cells = <1>; - #size-cells = <1>; - ranges = <0x02900800 0x02900800 0x11800>; status = "disabled";
+ #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x02900800 0x0 0x02900800 0x0 0x11800>; + tegra_i2s1: i2s@2901000 { compatible = "nvidia,tegra234-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901000 0x100>; + reg = <0x0 0x2901000 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_I2S1>, <&bpmp TEGRA234_CLK_I2S1_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -107,7 +109,7 @@ tegra_i2s1: i2s@2901000 { tegra_i2s2: i2s@2901100 { compatible = "nvidia,tegra234-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901100 0x100>; + reg = <0x0 0x2901100 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_I2S2>, <&bpmp TEGRA234_CLK_I2S2_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -121,7 +123,7 @@ tegra_i2s2: i2s@2901100 { tegra_i2s3: i2s@2901200 { compatible = "nvidia,tegra234-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901200 0x100>; + reg = <0x0 0x2901200 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_I2S3>, <&bpmp TEGRA234_CLK_I2S3_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -135,7 +137,7 @@ tegra_i2s3: i2s@2901200 { tegra_i2s4: i2s@2901300 { compatible = "nvidia,tegra234-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901300 0x100>; + reg = <0x0 0x2901300 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_I2S4>, <&bpmp TEGRA234_CLK_I2S4_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -149,7 +151,7 @@ tegra_i2s4: i2s@2901300 { tegra_i2s5: i2s@2901400 { compatible = "nvidia,tegra234-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901400 0x100>; + reg = <0x0 0x2901400 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_I2S5>, <&bpmp TEGRA234_CLK_I2S5_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -163,7 +165,7 @@ tegra_i2s5: i2s@2901400 { tegra_i2s6: i2s@2901500 { compatible = "nvidia,tegra234-i2s", "nvidia,tegra210-i2s"; - reg = <0x2901500 0x100>; + reg = <0x0 0x2901500 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_I2S6>, <&bpmp TEGRA234_CLK_I2S6_SYNC_INPUT>; clock-names = "i2s", "sync_input"; @@ -177,7 +179,7 @@ tegra_i2s6: i2s@2901500 { tegra_sfc1: sfc@2902000 { compatible = "nvidia,tegra234-sfc", "nvidia,tegra210-sfc"; - reg = <0x2902000 0x200>; + reg = <0x0 0x2902000 0x0 0x200>; sound-name-prefix = "SFC1"; status = "disabled"; }; @@ -185,7 +187,7 @@ tegra_sfc1: sfc@2902000 { tegra_sfc2: sfc@2902200 { compatible = "nvidia,tegra234-sfc", "nvidia,tegra210-sfc"; - reg = <0x2902200 0x200>; + reg = <0x0 0x2902200 0x0 0x200>; sound-name-prefix = "SFC2"; status = "disabled"; }; @@ -193,7 +195,7 @@ tegra_sfc2: sfc@2902200 { tegra_sfc3: sfc@2902400 { compatible = "nvidia,tegra234-sfc", "nvidia,tegra210-sfc"; - reg = <0x2902400 0x200>; + reg = <0x0 0x2902400 0x0 0x200>; sound-name-prefix = "SFC3"; status = "disabled"; }; @@ -201,7 +203,7 @@ tegra_sfc3: sfc@2902400 { tegra_sfc4: sfc@2902600 { compatible = "nvidia,tegra234-sfc", "nvidia,tegra210-sfc"; - reg = <0x2902600 0x200>; + reg = <0x0 0x2902600 0x0 0x200>; sound-name-prefix = "SFC4"; status = "disabled"; }; @@ -209,7 +211,7 @@ tegra_sfc4: sfc@2902600 { tegra_amx1: amx@2903000 { compatible = "nvidia,tegra234-amx", "nvidia,tegra194-amx"; - reg = <0x2903000 0x100>; + reg = <0x0 0x2903000 0x0 0x100>; sound-name-prefix = "AMX1"; status = "disabled"; }; @@ -217,7 +219,7 @@ tegra_amx1: amx@2903000 { tegra_amx2: amx@2903100 { compatible = "nvidia,tegra234-amx", "nvidia,tegra194-amx"; - reg = <0x2903100 0x100>; + reg = <0x0 0x2903100 0x0 0x100>; sound-name-prefix = "AMX2"; status = "disabled"; }; @@ -225,7 +227,7 @@ tegra_amx2: amx@2903100 { tegra_amx3: amx@2903200 { compatible = "nvidia,tegra234-amx", "nvidia,tegra194-amx"; - reg = <0x2903200 0x100>; + reg = <0x0 0x2903200 0x0 0x100>; sound-name-prefix = "AMX3"; status = "disabled"; }; @@ -233,7 +235,7 @@ tegra_amx3: amx@2903200 { tegra_amx4: amx@2903300 { compatible = "nvidia,tegra234-amx", "nvidia,tegra194-amx"; - reg = <0x2903300 0x100>; + reg = <0x0 0x2903300 0x0 0x100>; sound-name-prefix = "AMX4"; status = "disabled"; }; @@ -241,7 +243,7 @@ tegra_amx4: amx@2903300 { tegra_adx1: adx@2903800 { compatible = "nvidia,tegra234-adx", "nvidia,tegra210-adx"; - reg = <0x2903800 0x100>; + reg = <0x0 0x2903800 0x0 0x100>; sound-name-prefix = "ADX1"; status = "disabled"; }; @@ -249,7 +251,7 @@ tegra_adx1: adx@2903800 { tegra_adx2: adx@2903900 { compatible = "nvidia,tegra234-adx", "nvidia,tegra210-adx"; - reg = <0x2903900 0x100>; + reg = <0x0 0x2903900 0x0 0x100>; sound-name-prefix = "ADX2"; status = "disabled"; }; @@ -257,7 +259,7 @@ tegra_adx2: adx@2903900 { tegra_adx3: adx@2903a00 { compatible = "nvidia,tegra234-adx", "nvidia,tegra210-adx"; - reg = <0x2903a00 0x100>; + reg = <0x0 0x2903a00 0x0 0x100>; sound-name-prefix = "ADX3"; status = "disabled"; }; @@ -265,7 +267,7 @@ tegra_adx3: adx@2903a00 { tegra_adx4: adx@2903b00 { compatible = "nvidia,tegra234-adx", "nvidia,tegra210-adx"; - reg = <0x2903b00 0x100>; + reg = <0x0 0x2903b00 0x0 0x100>; sound-name-prefix = "ADX4"; status = "disabled"; }; @@ -274,7 +276,7 @@ tegra_adx4: adx@2903b00 { tegra_dmic1: dmic@2904000 { compatible = "nvidia,tegra234-dmic", "nvidia,tegra210-dmic"; - reg = <0x2904000 0x100>; + reg = <0x0 0x2904000 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_DMIC1>; clock-names = "dmic"; assigned-clocks = <&bpmp TEGRA234_CLK_DMIC1>; @@ -287,7 +289,7 @@ tegra_dmic1: dmic@2904000 { tegra_dmic2: dmic@2904100 { compatible = "nvidia,tegra234-dmic", "nvidia,tegra210-dmic"; - reg = <0x2904100 0x100>; + reg = <0x0 0x2904100 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_DMIC2>; clock-names = "dmic"; assigned-clocks = <&bpmp TEGRA234_CLK_DMIC2>; @@ -300,7 +302,7 @@ tegra_dmic2: dmic@2904100 { tegra_dmic3: dmic@2904200 { compatible = "nvidia,tegra234-dmic", "nvidia,tegra210-dmic"; - reg = <0x2904200 0x100>; + reg = <0x0 0x2904200 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_DMIC3>; clock-names = "dmic"; assigned-clocks = <&bpmp TEGRA234_CLK_DMIC3>; @@ -313,7 +315,7 @@ tegra_dmic3: dmic@2904200 { tegra_dmic4: dmic@2904300 { compatible = "nvidia,tegra234-dmic", "nvidia,tegra210-dmic"; - reg = <0x2904300 0x100>; + reg = <0x0 0x2904300 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_DMIC4>; clock-names = "dmic"; assigned-clocks = <&bpmp TEGRA234_CLK_DMIC4>; @@ -326,7 +328,7 @@ tegra_dmic4: dmic@2904300 { tegra_dspk1: dspk@2905000 { compatible = "nvidia,tegra234-dspk", "nvidia,tegra186-dspk"; - reg = <0x2905000 0x100>; + reg = <0x0 0x2905000 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_DSPK1>; clock-names = "dspk"; assigned-clocks = <&bpmp TEGRA234_CLK_DSPK1>; @@ -339,7 +341,7 @@ tegra_dspk1: dspk@2905000 { tegra_dspk2: dspk@2905100 { compatible = "nvidia,tegra234-dspk", "nvidia,tegra186-dspk"; - reg = <0x2905100 0x100>; + reg = <0x0 0x2905100 0x0 0x100>; clocks = <&bpmp TEGRA234_CLK_DSPK2>; clock-names = "dspk"; assigned-clocks = <&bpmp TEGRA234_CLK_DSPK2>; @@ -352,30 +354,31 @@ tegra_dspk2: dspk@2905100 { tegra_ope1: processing-engine@2908000 { compatible = "nvidia,tegra234-ope", "nvidia,tegra210-ope"; - reg = <0x2908000 0x100>; - #address-cells = <1>; - #size-cells = <1>; - ranges; + reg = <0x0 0x2908000 0x0 0x100>; sound-name-prefix = "OPE1"; status = "disabled";
+ #address-cells = <2>; + #size-cells = <2>; + ranges; + equalizer@2908100 { compatible = "nvidia,tegra234-peq", "nvidia,tegra210-peq"; - reg = <0x2908100 0x100>; + reg = <0x0 0x2908100 0x0 0x100>; };
dynamic-range-compressor@2908200 { compatible = "nvidia,tegra234-mbdrc", "nvidia,tegra210-mbdrc"; - reg = <0x2908200 0x200>; + reg = <0x0 0x2908200 0x0 0x200>; }; };
tegra_mvc1: mvc@290a000 { compatible = "nvidia,tegra234-mvc", "nvidia,tegra210-mvc"; - reg = <0x290a000 0x200>; + reg = <0x0 0x290a000 0x0 0x200>; sound-name-prefix = "MVC1"; status = "disabled"; }; @@ -383,7 +386,7 @@ tegra_mvc1: mvc@290a000 { tegra_mvc2: mvc@290a200 { compatible = "nvidia,tegra234-mvc", "nvidia,tegra210-mvc"; - reg = <0x290a200 0x200>; + reg = <0x0 0x290a200 0x0 0x200>; sound-name-prefix = "MVC2"; status = "disabled"; }; @@ -391,7 +394,7 @@ tegra_mvc2: mvc@290a200 { tegra_amixer: amixer@290bb00 { compatible = "nvidia,tegra234-amixer", "nvidia,tegra210-amixer"; - reg = <0x290bb00 0x800>; + reg = <0x0 0x290bb00 0x0 0x800>; sound-name-prefix = "MIXER1"; status = "disabled"; }; @@ -399,7 +402,7 @@ tegra_amixer: amixer@290bb00 { tegra_admaif: admaif@290f000 { compatible = "nvidia,tegra234-admaif", "nvidia,tegra186-admaif"; - reg = <0x0290f000 0x1000>; + reg = <0x0 0x0290f000 0x0 0x1000>; dmas = <&adma 1>, <&adma 1>, <&adma 2>, <&adma 2>, <&adma 3>, <&adma 3>, @@ -450,7 +453,7 @@ tegra_admaif: admaif@290f000 { tegra_asrc: asrc@2910000 { compatible = "nvidia,tegra234-asrc", "nvidia,tegra186-asrc"; - reg = <0x2910000 0x2000>; + reg = <0x0 0x2910000 0x0 0x2000>; sound-name-prefix = "ASRC1"; status = "disabled"; }; @@ -459,7 +462,7 @@ tegra_asrc: asrc@2910000 { adma: dma-controller@2930000 { compatible = "nvidia,tegra234-adma", "nvidia,tegra186-adma"; - reg = <0x02930000 0x20000>; + reg = <0x0 0x02930000 0x0 0x20000>; interrupt-parent = <&agic>; interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, @@ -504,8 +507,8 @@ agic: interrupt-controller@2a40000 { "nvidia,tegra210-agic"; #interrupt-cells = <3>; interrupt-controller; - reg = <0x02a41000 0x1000>, - <0x02a42000 0x2000>; + reg = <0x0 0x02a41000 0x0 0x1000>, + <0x0 0x02a42000 0x0 0x2000>; interrupts = <GIC_SPI 145 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>; @@ -517,14 +520,14 @@ agic: interrupt-controller@2a40000 {
misc@100000 { compatible = "nvidia,tegra234-misc"; - reg = <0x00100000 0xf000>, - <0x0010f000 0x1000>; + reg = <0x0 0x00100000 0x0 0xf000>, + <0x0 0x0010f000 0x0 0x1000>; status = "okay"; };
timer@2080000 { compatible = "nvidia,tegra234-timer"; - reg = <0x02080000 0x00121000>; + reg = <0x0 0x02080000 0x0 0x00121000>; interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>, @@ -546,9 +549,9 @@ timer@2080000 {
host1x@13e00000 { compatible = "nvidia,tegra234-host1x"; - reg = <0x13e00000 0x10000>, - <0x13e10000 0x10000>, - <0x13e40000 0x10000>; + reg = <0x0 0x13e00000 0x0 0x10000>, + <0x0 0x13e10000 0x0 0x10000>, + <0x0 0x13e40000 0x0 0x10000>; reg-names = "common", "hypervisor", "vm"; interrupts = <GIC_SPI 448 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 449 IRQ_TYPE_LEVEL_HIGH>, @@ -564,10 +567,10 @@ host1x@13e00000 { clocks = <&bpmp TEGRA234_CLK_HOST1X>; clock-names = "host1x";
- #address-cells = <1>; - #size-cells = <1>; + #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x14800000 0x0 0x14800000 0x0 0x02000000>;
- ranges = <0x14800000 0x14800000 0x02000000>; interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>; interconnect-names = "dma-mem"; iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>; @@ -592,7 +595,7 @@ host1x@13e00000 {
vic@15340000 { compatible = "nvidia,tegra234-vic"; - reg = <0x15340000 0x00040000>; + reg = <0x0 0x15340000 0x0 0x00040000>; interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA234_CLK_VIC>; clock-names = "vic"; @@ -609,7 +612,7 @@ vic@15340000 {
nvdec@15480000 { compatible = "nvidia,tegra234-nvdec"; - reg = <0x15480000 0x00040000>; + reg = <0x0 0x15480000 0x0 0x00040000>; clocks = <&bpmp TEGRA234_CLK_NVDEC>, <&bpmp TEGRA234_CLK_FUSE>, <&bpmp TEGRA234_CLK_TSEC_PKA>; @@ -647,8 +650,8 @@ nvdec@15480000 { gpio: gpio@2200000 { compatible = "nvidia,tegra234-gpio"; reg-names = "security", "gpio"; - reg = <0x02200000 0x10000>, - <0x02210000 0x10000>; + reg = <0x0 0x02200000 0x0 0x10000>, + <0x0 0x02210000 0x0 0x10000>; interrupts = <GIC_SPI 288 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 289 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 290 IRQ_TYPE_LEVEL_HIGH>, @@ -705,24 +708,24 @@ gpio: gpio@2200000 {
mc: memory-controller@2c00000 { compatible = "nvidia,tegra234-mc"; - reg = <0x02c00000 0x10000>, /* MC-SID */ - <0x02c10000 0x10000>, /* MC Broadcast*/ - <0x02c20000 0x10000>, /* MC0 */ - <0x02c30000 0x10000>, /* MC1 */ - <0x02c40000 0x10000>, /* MC2 */ - <0x02c50000 0x10000>, /* MC3 */ - <0x02b80000 0x10000>, /* MC4 */ - <0x02b90000 0x10000>, /* MC5 */ - <0x02ba0000 0x10000>, /* MC6 */ - <0x02bb0000 0x10000>, /* MC7 */ - <0x01700000 0x10000>, /* MC8 */ - <0x01710000 0x10000>, /* MC9 */ - <0x01720000 0x10000>, /* MC10 */ - <0x01730000 0x10000>, /* MC11 */ - <0x01740000 0x10000>, /* MC12 */ - <0x01750000 0x10000>, /* MC13 */ - <0x01760000 0x10000>, /* MC14 */ - <0x01770000 0x10000>; /* MC15 */ + reg = <0x0 0x02c00000 0x0 0x10000>, /* MC-SID */ + <0x0 0x02c10000 0x0 0x10000>, /* MC Broadcast*/ + <0x0 0x02c20000 0x0 0x10000>, /* MC0 */ + <0x0 0x02c30000 0x0 0x10000>, /* MC1 */ + <0x0 0x02c40000 0x0 0x10000>, /* MC2 */ + <0x0 0x02c50000 0x0 0x10000>, /* MC3 */ + <0x0 0x02b80000 0x0 0x10000>, /* MC4 */ + <0x0 0x02b90000 0x0 0x10000>, /* MC5 */ + <0x0 0x02ba0000 0x0 0x10000>, /* MC6 */ + <0x0 0x02bb0000 0x0 0x10000>, /* MC7 */ + <0x0 0x01700000 0x0 0x10000>, /* MC8 */ + <0x0 0x01710000 0x0 0x10000>, /* MC9 */ + <0x0 0x01720000 0x0 0x10000>, /* MC10 */ + <0x0 0x01730000 0x0 0x10000>, /* MC11 */ + <0x0 0x01740000 0x0 0x10000>, /* MC12 */ + <0x0 0x01750000 0x0 0x10000>, /* MC13 */ + <0x0 0x01760000 0x0 0x10000>, /* MC14 */ + <0x0 0x01770000 0x0 0x10000>; /* MC15 */ reg-names = "sid", "broadcast", "ch0", "ch1", "ch2", "ch3", "ch4", "ch5", "ch6", "ch7", "ch8", "ch9", "ch10", "ch11", "ch12", "ch13", "ch14", "ch15"; @@ -732,10 +735,9 @@ mc: memory-controller@2c00000 {
#address-cells = <2>; #size-cells = <2>; - - ranges = <0x01700000 0x0 0x01700000 0x0 0x100000>, - <0x02b80000 0x0 0x02b80000 0x0 0x040000>, - <0x02c00000 0x0 0x02c00000 0x0 0x100000>; + ranges = <0x0 0x01700000 0x0 0x01700000 0x0 0x100000>, + <0x0 0x02b80000 0x0 0x02b80000 0x0 0x040000>, + <0x0 0x02c00000 0x0 0x02c00000 0x0 0x100000>;
/* * Bit 39 of addresses passing through the memory @@ -752,7 +754,7 @@ mc: memory-controller@2c00000 { * * Limit the DMA range for memory clients to [38:0]. */ - dma-ranges = <0x0 0x0 0x0 0x80 0x0>; + dma-ranges = <0x0 0x0 0x0 0x0 0x80 0x0>;
emc: external-memory-controller@2c60000 { compatible = "nvidia,tegra234-emc"; @@ -771,7 +773,7 @@ emc: external-memory-controller@2c60000 {
uarta: serial@3100000 { compatible = "nvidia,tegra234-uart", "nvidia,tegra20-uart"; - reg = <0x03100000 0x10000>; + reg = <0x0 0x03100000 0x0 0x10000>; interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA234_CLK_UARTA>; clock-names = "serial"; @@ -782,7 +784,7 @@ uarta: serial@3100000 {
gen1_i2c: i2c@3160000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x3160000 0x100>; + reg = <0x0 0x3160000 0x0 0x100>; status = "disabled"; interrupts = <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>; clock-frequency = <400000>; @@ -801,7 +803,7 @@ gen1_i2c: i2c@3160000 {
cam_i2c: i2c@3180000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x3180000 0x100>; + reg = <0x0 0x3180000 0x0 0x100>; interrupts = <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clock-frequency = <400000>; @@ -820,7 +822,7 @@ cam_i2c: i2c@3180000 {
dp_aux_ch1_i2c: i2c@3190000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x3190000 0x100>; + reg = <0x0 0x3190000 0x0 0x100>; interrupts = <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clock-frequency = <100000>; @@ -839,7 +841,7 @@ dp_aux_ch1_i2c: i2c@3190000 {
dp_aux_ch0_i2c: i2c@31b0000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x31b0000 0x100>; + reg = <0x0 0x31b0000 0x0 0x100>; interrupts = <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clock-frequency = <100000>; @@ -858,7 +860,7 @@ dp_aux_ch0_i2c: i2c@31b0000 {
dp_aux_ch2_i2c: i2c@31c0000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x31c0000 0x100>; + reg = <0x0 0x31c0000 0x0 0x100>; interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clock-frequency = <100000>; @@ -877,14 +879,14 @@ dp_aux_ch2_i2c: i2c@31c0000 {
uarti: serial@31d0000 { compatible = "arm,sbsa-uart"; - reg = <0x31d0000 0x10000>; + reg = <0x0 0x31d0000 0x0 0x10000>; interrupts = <GIC_SPI 285 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; };
dp_aux_ch3_i2c: i2c@31e0000 { compatible = "nvidia,tegra194-i2c"; - reg = <0x31e0000 0x100>; + reg = <0x0 0x31e0000 0x0 0x100>; interrupts = <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clock-frequency = <100000>; @@ -903,7 +905,7 @@ dp_aux_ch3_i2c: i2c@31e0000 {
spi@3270000 { compatible = "nvidia,tegra234-qspi"; - reg = <0x3270000 0x1000>; + reg = <0x0 0x3270000 0x0 0x1000>; interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -916,7 +918,7 @@ spi@3270000 {
pwm1: pwm@3280000 { compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm"; - reg = <0x3280000 0x10000>; + reg = <0x0 0x3280000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_PWM1>; resets = <&bpmp TEGRA234_RESET_PWM1>; reset-names = "pwm"; @@ -926,7 +928,7 @@ pwm1: pwm@3280000 {
pwm2: pwm@3290000 { compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm"; - reg = <0x3290000 0x10000>; + reg = <0x0 0x3290000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_PWM2>; resets = <&bpmp TEGRA234_RESET_PWM2>; reset-names = "pwm"; @@ -936,7 +938,7 @@ pwm2: pwm@3290000 {
pwm3: pwm@32a0000 { compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm"; - reg = <0x32a0000 0x10000>; + reg = <0x0 0x32a0000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_PWM3>; resets = <&bpmp TEGRA234_RESET_PWM3>; reset-names = "pwm"; @@ -946,7 +948,7 @@ pwm3: pwm@32a0000 {
pwm5: pwm@32c0000 { compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm"; - reg = <0x32c0000 0x10000>; + reg = <0x0 0x32c0000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_PWM5>; resets = <&bpmp TEGRA234_RESET_PWM5>; reset-names = "pwm"; @@ -956,7 +958,7 @@ pwm5: pwm@32c0000 {
pwm6: pwm@32d0000 { compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm"; - reg = <0x32d0000 0x10000>; + reg = <0x0 0x32d0000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_PWM6>; resets = <&bpmp TEGRA234_RESET_PWM6>; reset-names = "pwm"; @@ -966,7 +968,7 @@ pwm6: pwm@32d0000 {
pwm7: pwm@32e0000 { compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm"; - reg = <0x32e0000 0x10000>; + reg = <0x0 0x32e0000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_PWM7>; resets = <&bpmp TEGRA234_RESET_PWM7>; reset-names = "pwm"; @@ -976,7 +978,7 @@ pwm7: pwm@32e0000 {
pwm8: pwm@32f0000 { compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm"; - reg = <0x32f0000 0x10000>; + reg = <0x0 0x32f0000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_PWM8>; resets = <&bpmp TEGRA234_RESET_PWM8>; reset-names = "pwm"; @@ -986,7 +988,7 @@ pwm8: pwm@32f0000 {
spi@3300000 { compatible = "nvidia,tegra234-qspi"; - reg = <0x3300000 0x1000>; + reg = <0x0 0x3300000 0x0 0x1000>; interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>; #address-cells = <1>; #size-cells = <0>; @@ -999,7 +1001,7 @@ spi@3300000 {
mmc@3400000 { compatible = "nvidia,tegra234-sdhci", "nvidia,tegra186-sdhci"; - reg = <0x03400000 0x20000>; + reg = <0x0 0x03400000 0x0 0x20000>; interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA234_CLK_SDMMC1>, <&bpmp TEGRA234_CLK_SDMMC_LEGACY_TM>; @@ -1034,7 +1036,7 @@ mmc@3400000 {
mmc@3460000 { compatible = "nvidia,tegra234-sdhci", "nvidia,tegra186-sdhci"; - reg = <0x03460000 0x20000>; + reg = <0x0 0x03460000 0x0 0x20000>; interrupts = <GIC_SPI 65 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA234_CLK_SDMMC4>, <&bpmp TEGRA234_CLK_SDMMC_LEGACY_TM>; @@ -1063,7 +1065,7 @@ mmc@3460000 {
hda@3510000 { compatible = "nvidia,tegra234-hda"; - reg = <0x3510000 0x10000>; + reg = <0x0 0x3510000 0x0 0x10000>; interrupts = <GIC_SPI 60 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA234_CLK_AZA_BIT>, <&bpmp TEGRA234_CLK_AZA_2XBIT>; @@ -1081,14 +1083,14 @@ hda@3510000 {
fuse@3810000 { compatible = "nvidia,tegra234-efuse"; - reg = <0x03810000 0x10000>; + reg = <0x0 0x03810000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_FUSE>; clock-names = "fuse"; };
hsp_top0: hsp@3c00000 { compatible = "nvidia,tegra234-hsp", "nvidia,tegra194-hsp"; - reg = <0x03c00000 0xa0000>; + reg = <0x0 0x03c00000 0x0 0xa0000>; interrupts = <GIC_SPI 176 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>, @@ -1106,7 +1108,7 @@ hsp_top0: hsp@3c00000 {
p2u_hsio_0: phy@3e00000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e00000 0x10000>; + reg = <0x0 0x03e00000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1114,7 +1116,7 @@ p2u_hsio_0: phy@3e00000 {
p2u_hsio_1: phy@3e10000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e10000 0x10000>; + reg = <0x0 0x03e10000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1122,7 +1124,7 @@ p2u_hsio_1: phy@3e10000 {
p2u_hsio_2: phy@3e20000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e20000 0x10000>; + reg = <0x0 0x03e20000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1130,7 +1132,7 @@ p2u_hsio_2: phy@3e20000 {
p2u_hsio_3: phy@3e30000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e30000 0x10000>; + reg = <0x0 0x03e30000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1138,7 +1140,7 @@ p2u_hsio_3: phy@3e30000 {
p2u_hsio_4: phy@3e40000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e40000 0x10000>; + reg = <0x0 0x03e40000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1146,7 +1148,7 @@ p2u_hsio_4: phy@3e40000 {
p2u_hsio_5: phy@3e50000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e50000 0x10000>; + reg = <0x0 0x03e50000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1154,7 +1156,7 @@ p2u_hsio_5: phy@3e50000 {
p2u_hsio_6: phy@3e60000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e60000 0x10000>; + reg = <0x0 0x03e60000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1162,7 +1164,7 @@ p2u_hsio_6: phy@3e60000 {
p2u_hsio_7: phy@3e70000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e70000 0x10000>; + reg = <0x0 0x03e70000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1170,7 +1172,7 @@ p2u_hsio_7: phy@3e70000 {
p2u_nvhs_0: phy@3e90000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03e90000 0x10000>; + reg = <0x0 0x03e90000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1178,7 +1180,7 @@ p2u_nvhs_0: phy@3e90000 {
p2u_nvhs_1: phy@3ea0000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03ea0000 0x10000>; + reg = <0x0 0x03ea0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1186,7 +1188,7 @@ p2u_nvhs_1: phy@3ea0000 {
p2u_nvhs_2: phy@3eb0000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03eb0000 0x10000>; + reg = <0x0 0x03eb0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1194,7 +1196,7 @@ p2u_nvhs_2: phy@3eb0000 {
p2u_nvhs_3: phy@3ec0000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03ec0000 0x10000>; + reg = <0x0 0x03ec0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1202,7 +1204,7 @@ p2u_nvhs_3: phy@3ec0000 {
p2u_nvhs_4: phy@3ed0000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03ed0000 0x10000>; + reg = <0x0 0x03ed0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1210,7 +1212,7 @@ p2u_nvhs_4: phy@3ed0000 {
p2u_nvhs_5: phy@3ee0000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03ee0000 0x10000>; + reg = <0x0 0x03ee0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1218,7 +1220,7 @@ p2u_nvhs_5: phy@3ee0000 {
p2u_nvhs_6: phy@3ef0000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03ef0000 0x10000>; + reg = <0x0 0x03ef0000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1226,7 +1228,7 @@ p2u_nvhs_6: phy@3ef0000 {
p2u_nvhs_7: phy@3f00000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f00000 0x10000>; + reg = <0x0 0x03f00000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1234,7 +1236,7 @@ p2u_nvhs_7: phy@3f00000 {
p2u_gbe_0: phy@3f20000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f20000 0x10000>; + reg = <0x0 0x03f20000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1242,7 +1244,7 @@ p2u_gbe_0: phy@3f20000 {
p2u_gbe_1: phy@3f30000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f30000 0x10000>; + reg = <0x0 0x03f30000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1250,7 +1252,7 @@ p2u_gbe_1: phy@3f30000 {
p2u_gbe_2: phy@3f40000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f40000 0x10000>; + reg = <0x0 0x03f40000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1258,7 +1260,7 @@ p2u_gbe_2: phy@3f40000 {
p2u_gbe_3: phy@3f50000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f50000 0x10000>; + reg = <0x0 0x03f50000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1266,7 +1268,7 @@ p2u_gbe_3: phy@3f50000 {
p2u_gbe_4: phy@3f60000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f60000 0x10000>; + reg = <0x0 0x03f60000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1274,7 +1276,7 @@ p2u_gbe_4: phy@3f60000 {
p2u_gbe_5: phy@3f70000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f70000 0x10000>; + reg = <0x0 0x03f70000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1282,7 +1284,7 @@ p2u_gbe_5: phy@3f70000 {
p2u_gbe_6: phy@3f80000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f80000 0x10000>; + reg = <0x0 0x03f80000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1290,7 +1292,7 @@ p2u_gbe_6: phy@3f80000 {
p2u_gbe_7: phy@3f90000 { compatible = "nvidia,tegra234-p2u"; - reg = <0x03f90000 0x10000>; + reg = <0x0 0x03f90000 0x0 0x10000>; reg-names = "ctl";
#phy-cells = <0>; @@ -1298,9 +1300,9 @@ p2u_gbe_7: phy@3f90000 {
ethernet@6800000 { compatible = "nvidia,tegra234-mgbe"; - reg = <0x06800000 0x10000>, - <0x06810000 0x10000>, - <0x068a0000 0x10000>; + reg = <0x0 0x06800000 0x0 0x10000>, + <0x0 0x06810000 0x0 0x10000>, + <0x0 0x068a0000 0x0 0x10000>; reg-names = "hypervisor", "mac", "xpcs"; interrupts = <GIC_SPI 384 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "common"; @@ -1332,9 +1334,9 @@ ethernet@6800000 {
ethernet@6900000 { compatible = "nvidia,tegra234-mgbe"; - reg = <0x06900000 0x10000>, - <0x06910000 0x10000>, - <0x069a0000 0x10000>; + reg = <0x0 0x06900000 0x0 0x10000>, + <0x0 0x06910000 0x0 0x10000>, + <0x0 0x069a0000 0x0 0x10000>; reg-names = "hypervisor", "mac", "xpcs"; interrupts = <GIC_SPI 392 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "common"; @@ -1366,9 +1368,9 @@ ethernet@6900000 {
ethernet@6a00000 { compatible = "nvidia,tegra234-mgbe"; - reg = <0x06a00000 0x10000>, - <0x06a10000 0x10000>, - <0x06aa0000 0x10000>; + reg = <0x0 0x06a00000 0x0 0x10000>, + <0x0 0x06a10000 0x0 0x10000>, + <0x0 0x06aa0000 0x0 0x10000>; reg-names = "hypervisor", "mac", "xpcs"; interrupts = <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "common"; @@ -1400,9 +1402,9 @@ ethernet@6a00000 {
ethernet@6b00000 { compatible = "nvidia,tegra234-mgbe"; - reg = <0x06b00000 0x10000>, - <0x06b10000 0x10000>, - <0x06ba0000 0x10000>; + reg = <0x0 0x06b00000 0x0 0x10000>, + <0x0 0x06b10000 0x0 0x10000>, + <0x0 0x06ba0000 0x0 0x10000>; reg-names = "hypervisor", "mac", "xpcs"; interrupts = <GIC_SPI 408 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "common"; @@ -1434,8 +1436,8 @@ ethernet@6b00000 {
smmu_niso1: iommu@8000000 { compatible = "nvidia,tegra234-smmu", "nvidia,smmu-500"; - reg = <0x8000000 0x1000000>, - <0x7000000 0x1000000>; + reg = <0x0 0x8000000 0x0 0x1000000>, + <0x0 0x7000000 0x0 0x1000000>; interrupts = <GIC_SPI 238 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 242 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 238 IRQ_TYPE_LEVEL_HIGH>, @@ -1576,21 +1578,21 @@ smmu_niso1: iommu@8000000 {
sce-fabric@b600000 { compatible = "nvidia,tegra234-sce-fabric"; - reg = <0xb600000 0x40000>; + reg = <0x0 0xb600000 0x0 0x40000>; interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>; status = "okay"; };
rce-fabric@be00000 { compatible = "nvidia,tegra234-rce-fabric"; - reg = <0xbe00000 0x40000>; + reg = <0x0 0xbe00000 0x0 0x40000>; interrupts = <GIC_SPI 175 IRQ_TYPE_LEVEL_HIGH>; status = "okay"; };
hsp_aon: hsp@c150000 { compatible = "nvidia,tegra234-hsp", "nvidia,tegra194-hsp"; - reg = <0x0c150000 0x90000>; + reg = <0x0 0x0c150000 0x0 0x90000>; interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>, @@ -1605,7 +1607,7 @@ hsp_aon: hsp@c150000 {
gen2_i2c: i2c@c240000 { compatible = "nvidia,tegra194-i2c"; - reg = <0xc240000 0x100>; + reg = <0x0 0xc240000 0x0 0x100>; interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clock-frequency = <100000>; @@ -1624,7 +1626,7 @@ gen2_i2c: i2c@c240000 {
gen8_i2c: i2c@c250000 { compatible = "nvidia,tegra194-i2c"; - reg = <0xc250000 0x100>; + reg = <0x0 0xc250000 0x0 0x100>; interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clock-frequency = <400000>; @@ -1643,7 +1645,7 @@ gen8_i2c: i2c@c250000 {
rtc@c2a0000 { compatible = "nvidia,tegra234-rtc", "nvidia,tegra20-rtc"; - reg = <0x0c2a0000 0x10000>; + reg = <0x0 0x0c2a0000 0x0 0x10000>; interrupt-parent = <&pmc>; interrupts = <73 IRQ_TYPE_LEVEL_HIGH>; clocks = <&bpmp TEGRA234_CLK_CLK_32K>; @@ -1654,8 +1656,8 @@ rtc@c2a0000 { gpio_aon: gpio@c2f0000 { compatible = "nvidia,tegra234-gpio-aon"; reg-names = "security", "gpio"; - reg = <0x0c2f0000 0x1000>, - <0x0c2f1000 0x1000>; + reg = <0x0 0x0c2f0000 0x0 0x1000>, + <0x0 0x0c2f1000 0x0 0x1000>; interrupts = <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>, @@ -1668,7 +1670,7 @@ gpio_aon: gpio@c2f0000 {
pwm4: pwm@c340000 { compatible = "nvidia,tegra234-pwm", "nvidia,tegra194-pwm"; - reg = <0xc340000 0x10000>; + reg = <0x0 0xc340000 0x0 0x10000>; clocks = <&bpmp TEGRA234_CLK_PWM4>; resets = <&bpmp TEGRA234_RESET_PWM4>; reset-names = "pwm"; @@ -1678,11 +1680,11 @@ pwm4: pwm@c340000 {
pmc: pmc@c360000 { compatible = "nvidia,tegra234-pmc"; - reg = <0x0c360000 0x10000>, - <0x0c370000 0x10000>, - <0x0c380000 0x10000>, - <0x0c390000 0x10000>, - <0x0c3a0000 0x10000>; + reg = <0x0 0x0c360000 0x0 0x10000>, + <0x0 0x0c370000 0x0 0x10000>, + <0x0 0x0c380000 0x0 0x10000>, + <0x0 0x0c390000 0x0 0x10000>, + <0x0 0x0c3a0000 0x0 0x10000>; reg-names = "pmc", "wake", "aotag", "scratch", "misc";
#interrupt-cells = <2>; @@ -1711,29 +1713,36 @@ sdmmc3_1v8: sdmmc3-1v8 {
aon-fabric@c600000 { compatible = "nvidia,tegra234-aon-fabric"; - reg = <0xc600000 0x40000>; + reg = <0x0 0xc600000 0x0 0x40000>; interrupts = <GIC_SPI 172 IRQ_TYPE_LEVEL_HIGH>; status = "okay"; };
bpmp-fabric@d600000 { compatible = "nvidia,tegra234-bpmp-fabric"; - reg = <0xd600000 0x40000>; + reg = <0x0 0xd600000 0x0 0x40000>; interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>; status = "okay"; };
dce-fabric@de00000 { compatible = "nvidia,tegra234-sce-fabric"; - reg = <0xde00000 0x40000>; + reg = <0x0 0xde00000 0x0 0x40000>; interrupts = <GIC_SPI 381 IRQ_TYPE_LEVEL_HIGH>; status = "okay"; };
+ ccplex@e000000 { + compatible = "nvidia,tegra234-ccplex-cluster"; + reg = <0x0 0x0e000000 0x0 0x5ffff>; + nvidia,bpmp = <&bpmp>; + status = "okay"; + }; + gic: interrupt-controller@f400000 { compatible = "arm,gic-v3"; - reg = <0x0f400000 0x010000>, /* GICD */ - <0x0f440000 0x200000>; /* GICR */ + reg = <0x0 0x0f400000 0x0 0x010000>, /* GICD */ + <0x0 0x0f440000 0x0 0x200000>; /* GICR */ interrupt-parent = <&gic>; interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
@@ -1744,7 +1753,7 @@ gic: interrupt-controller@f400000 {
smmu_iso: iommu@10000000 { compatible = "nvidia,tegra234-smmu", "nvidia,smmu-500"; - reg = <0x10000000 0x1000000>; + reg = <0x0 0x10000000 0x0 0x1000000>; interrupts = <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, @@ -1884,8 +1893,8 @@ smmu_iso: iommu@10000000 {
smmu_niso0: iommu@12000000 { compatible = "nvidia,tegra234-smmu", "nvidia,smmu-500"; - reg = <0x12000000 0x1000000>, - <0x11000000 0x1000000>; + reg = <0x0 0x12000000 0x0 0x1000000>, + <0x0 0x11000000 0x0 0x1000000>; interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 232 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>, @@ -2026,771 +2035,766 @@ smmu_niso0: iommu@12000000 {
cbb-fabric@13a00000 { compatible = "nvidia,tegra234-cbb-fabric"; - reg = <0x13a00000 0x400000>; + reg = <0x0 0x13a00000 0x0 0x400000>; interrupts = <GIC_SPI 231 IRQ_TYPE_LEVEL_HIGH>; status = "okay"; }; - };
- ccplex@e000000 { - compatible = "nvidia,tegra234-ccplex-cluster"; - reg = <0x0 0x0e000000 0x0 0x5ffff>; - nvidia,bpmp = <&bpmp>; - status = "okay"; - }; + pcie@140a0000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CA>; + reg = <0x00 0x140a0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x2a000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x2a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x2a080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x35 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- pcie@140a0000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CA>; - reg = <0x00 0x140a0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x2a000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x2a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x2a080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x35 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <4>; - num-viewport = <8>; - linux,pci-domain = <8>; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <4>; + num-viewport = <8>; + linux,pci-domain = <8>;
- clocks = <&bpmp TEGRA234_CLK_PEX2_C8_CORE>; - clock-names = "core"; + clocks = <&bpmp TEGRA234_CLK_PEX2_C8_CORE>; + clock-names = "core";
- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_8_APB>, - <&bpmp TEGRA234_RESET_PEX2_CORE_8>; - reset-names = "apb", "core"; + resets = <&bpmp TEGRA234_RESET_PEX2_CORE_8_APB>, + <&bpmp TEGRA234_RESET_PEX2_CORE_8>; + reset-names = "apb", "core";
- interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>;
- nvidia,bpmp = <&bpmp 8>; + nvidia,bpmp = <&bpmp 8>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- bus-range = <0x0 0xff>; + bus-range = <0x0 0xff>;
- ranges = <0x43000000 0x32 0x40000000 0x32 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ - <0x02000000 0x0 0x40000000 0x35 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x2a100000 0x00 0x2a100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + ranges = <0x43000000 0x32 0x40000000 0x32 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ + <0x02000000 0x0 0x40000000 0x35 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x2a100000 0x00 0x2a100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE8AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE8AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE8 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE8AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE8AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE8 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- status = "disabled"; - }; + status = "disabled"; + };
- pcie@140c0000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CB>; - reg = <0x00 0x140c0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x2c000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x2c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x2c080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x38 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <4>; - num-viewport = <8>; - linux,pci-domain = <9>; + pcie@140c0000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CB>; + reg = <0x00 0x140c0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x2c000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x2c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x2c080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x38 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- clocks = <&bpmp TEGRA234_CLK_PEX2_C9_CORE>; - clock-names = "core"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <4>; + num-viewport = <8>; + linux,pci-domain = <9>;
- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_9_APB>, - <&bpmp TEGRA234_RESET_PEX2_CORE_9>; - reset-names = "apb", "core"; + clocks = <&bpmp TEGRA234_CLK_PEX2_C9_CORE>; + clock-names = "core";
- interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 359 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + resets = <&bpmp TEGRA234_RESET_PEX2_CORE_9_APB>, + <&bpmp TEGRA234_RESET_PEX2_CORE_9>; + reset-names = "apb", "core";
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 359 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- nvidia,bpmp = <&bpmp 9>; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 358 IRQ_TYPE_LEVEL_HIGH>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + nvidia,bpmp = <&bpmp 9>;
- bus-range = <0x0 0xff>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- ranges = <0x43000000 0x35 0x40000000 0x35 0x40000000 0x2 0xc0000000>, /* prefetchable memory (11264 MB) */ - <0x02000000 0x0 0x40000000 0x38 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x2c100000 0x00 0x2c100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + bus-range = <0x0 0xff>;
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE9AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE9AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE9 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + ranges = <0x43000000 0x35 0x40000000 0x35 0x40000000 0x2 0xc0000000>, /* prefetchable memory (11264 MB) */ + <0x02000000 0x0 0x40000000 0x38 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x2c100000 0x00 0x2c100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- status = "disabled"; - }; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE9AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE9AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE9 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- pcie@140e0000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CC>; - reg = <0x00 0x140e0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x2e000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x2e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x2e080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x3b 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <4>; - num-viewport = <8>; - linux,pci-domain = <10>; + status = "disabled"; + };
- clocks = <&bpmp TEGRA234_CLK_PEX2_C10_CORE>; - clock-names = "core"; + pcie@140e0000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CC>; + reg = <0x00 0x140e0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x2e000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x2e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x2e080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x3b 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_10_APB>, - <&bpmp TEGRA234_RESET_PEX2_CORE_10>; - reset-names = "apb", "core"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <4>; + num-viewport = <8>; + linux,pci-domain = <10>;
- interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + clocks = <&bpmp TEGRA234_CLK_PEX2_C10_CORE>; + clock-names = "core";
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>; + resets = <&bpmp TEGRA234_RESET_PEX2_CORE_10_APB>, + <&bpmp TEGRA234_RESET_PEX2_CORE_10>; + reset-names = "apb", "core";
- nvidia,bpmp = <&bpmp 10>; + interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>;
- bus-range = <0x0 0xff>; + nvidia,bpmp = <&bpmp 10>;
- ranges = <0x43000000 0x38 0x40000000 0x38 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ - <0x02000000 0x0 0x40000000 0x3b 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x2e100000 0x00 0x2e100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE10AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE10AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE10 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + bus-range = <0x0 0xff>;
- status = "disabled"; - }; + ranges = <0x43000000 0x38 0x40000000 0x38 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ + <0x02000000 0x0 0x40000000 0x3b 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x2e100000 0x00 0x2e100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- pcie@14100000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>; - reg = <0x00 0x14100000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x30000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x30080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x20 0xb0000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <1>; - num-viewport = <8>; - linux,pci-domain = <1>; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE10AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE10AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE10 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- clocks = <&bpmp TEGRA234_CLK_PEX0_C1_CORE>; - clock-names = "core"; + status = "disabled"; + };
- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_1_APB>, - <&bpmp TEGRA234_RESET_PEX0_CORE_1>; - reset-names = "apb", "core"; + pcie-ep@140e0000 { + compatible = "nvidia,tegra234-pcie-ep"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CC>; + reg = <0x00 0x140e0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x2e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x2e080000 0x0 0x00040000>, /* DBI space (256K) */ + <0x38 0x40000000 0x3 0x00000000>; /* Address Space (12G) */ + reg-names = "appl", "atu_dma", "dbi", "addr_space";
- interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + num-lanes = <4>;
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&bpmp TEGRA234_CLK_PEX2_C10_CORE>; + clock-names = "core";
- nvidia,bpmp = <&bpmp 1>; + resets = <&bpmp TEGRA234_RESET_PEX2_CORE_10_APB>, + <&bpmp TEGRA234_RESET_PEX2_CORE_10>; + reset-names = "apb", "core";
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ + interrupt-names = "intr";
- bus-range = <0x0 0xff>; + nvidia,bpmp = <&bpmp 10>;
- ranges = <0x43000000 0x20 0x80000000 0x20 0x80000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */ - <0x02000000 0x0 0x40000000 0x20 0xa8000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x30100000 0x00 0x30100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + nvidia,enable-ext-refclk; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE1R &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE1W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE1 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE10AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE10AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE10 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- status = "disabled"; - }; + status = "disabled"; + };
- pcie@14120000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>; - reg = <0x00 0x14120000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x32000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x32040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x32080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x20 0xf0000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <1>; - num-viewport = <8>; - linux,pci-domain = <2>; + pcie@14100000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>; + reg = <0x00 0x14100000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x30000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x30080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x20 0xb0000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- clocks = <&bpmp TEGRA234_CLK_PEX0_C2_CORE>; - clock-names = "core"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <1>; + num-viewport = <8>; + linux,pci-domain = <1>;
- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_2_APB>, - <&bpmp TEGRA234_RESET_PEX0_CORE_2>; - reset-names = "apb", "core"; + clocks = <&bpmp TEGRA234_CLK_PEX0_C1_CORE>; + clock-names = "core";
- interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + resets = <&bpmp TEGRA234_RESET_PEX0_CORE_1_APB>, + <&bpmp TEGRA234_RESET_PEX0_CORE_1>; + reset-names = "apb", "core";
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- nvidia,bpmp = <&bpmp 2>; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + nvidia,bpmp = <&bpmp 1>;
- bus-range = <0x0 0xff>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- ranges = <0x43000000 0x20 0xc0000000 0x20 0xc0000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */ - <0x02000000 0x0 0x40000000 0x20 0xe8000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x32100000 0x00 0x32100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + bus-range = <0x0 0xff>;
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE2AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE2AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE2 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + ranges = <0x43000000 0x20 0x80000000 0x20 0x80000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */ + <0x02000000 0x0 0x40000000 0x20 0xa8000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x30100000 0x00 0x30100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- status = "disabled"; - }; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE1R &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE1W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE1 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- pcie@14140000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>; - reg = <0x00 0x14140000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x34000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x34040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x34080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x21 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <1>; - num-viewport = <8>; - linux,pci-domain = <3>; + status = "disabled"; + };
- clocks = <&bpmp TEGRA234_CLK_PEX0_C3_CORE>; - clock-names = "core"; + pcie@14120000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>; + reg = <0x00 0x14120000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x32000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x32040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x32080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x20 0xf0000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_3_APB>, - <&bpmp TEGRA234_RESET_PEX0_CORE_3>; - reset-names = "apb", "core"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <1>; + num-viewport = <8>; + linux,pci-domain = <2>;
- interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + clocks = <&bpmp TEGRA234_CLK_PEX0_C2_CORE>; + clock-names = "core";
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>; + resets = <&bpmp TEGRA234_RESET_PEX0_CORE_2_APB>, + <&bpmp TEGRA234_RESET_PEX0_CORE_2>; + reset-names = "apb", "core";
- nvidia,bpmp = <&bpmp 3>; + interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 48 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>;
- bus-range = <0x0 0xff>; + nvidia,bpmp = <&bpmp 2>;
- ranges = <0x43000000 0x21 0x00000000 0x21 0x00000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */ - <0x02000000 0x0 0x40000000 0x21 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x34100000 0x00 0x34100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE3R &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE3W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE3 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + bus-range = <0x0 0xff>;
- status = "disabled"; - }; + ranges = <0x43000000 0x20 0xc0000000 0x20 0xc0000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */ + <0x02000000 0x0 0x40000000 0x20 0xe8000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x32100000 0x00 0x32100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- pcie@14160000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4BB>; - reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x36000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x36080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x24 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <4>; - num-viewport = <8>; - linux,pci-domain = <4>; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE2AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE2AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE2 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- clocks = <&bpmp TEGRA234_CLK_PEX0_C4_CORE>; - clock-names = "core"; + status = "disabled"; + };
- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_4_APB>, - <&bpmp TEGRA234_RESET_PEX0_CORE_4>; - reset-names = "apb", "core"; + pcie@14140000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX1A>; + reg = <0x00 0x14140000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x34000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x34040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x34080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x21 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <1>; + num-viewport = <8>; + linux,pci-domain = <3>;
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&bpmp TEGRA234_CLK_PEX0_C3_CORE>; + clock-names = "core";
- nvidia,bpmp = <&bpmp 4>; + resets = <&bpmp TEGRA234_RESET_PEX0_CORE_3_APB>, + <&bpmp TEGRA234_RESET_PEX0_CORE_3>; + reset-names = "apb", "core";
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- bus-range = <0x0 0xff>; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
- ranges = <0x43000000 0x21 0x40000000 0x21 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ - <0x02000000 0x0 0x40000000 0x24 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x36100000 0x00 0x36100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + nvidia,bpmp = <&bpmp 3>;
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE4R &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE4W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE4 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- status = "disabled"; - }; + bus-range = <0x0 0xff>;
- pcie@14180000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4BA>; - reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x38000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x38080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x27 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <4>; - num-viewport = <8>; - linux,pci-domain = <0>; + ranges = <0x43000000 0x21 0x00000000 0x21 0x00000000 0x0 0x28000000>, /* prefetchable memory (640 MB) */ + <0x02000000 0x0 0x40000000 0x21 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x34100000 0x00 0x34100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- clocks = <&bpmp TEGRA234_CLK_PEX0_C0_CORE>; - clock-names = "core"; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE3R &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE3W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE3 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- resets = <&bpmp TEGRA234_RESET_PEX0_CORE_0_APB>, - <&bpmp TEGRA234_RESET_PEX0_CORE_0>; - reset-names = "apb", "core"; + status = "disabled"; + };
- interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + pcie@14160000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4BB>; + reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x36000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x36080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x24 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <4>; + num-viewport = <8>; + linux,pci-domain = <4>;
- nvidia,bpmp = <&bpmp 0>; + clocks = <&bpmp TEGRA234_CLK_PEX0_C4_CORE>; + clock-names = "core";
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + resets = <&bpmp TEGRA234_RESET_PEX0_CORE_4_APB>, + <&bpmp TEGRA234_RESET_PEX0_CORE_4>; + reset-names = "apb", "core";
- bus-range = <0x0 0xff>; + interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- ranges = <0x43000000 0x24 0x40000000 0x24 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ - <0x02000000 0x0 0x40000000 0x27 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x38100000 0x00 0x38100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>;
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE0R &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE0W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE0 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + nvidia,bpmp = <&bpmp 4>;
- status = "disabled"; - }; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- pcie@141a0000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8A>; - reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x3a000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x2b 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <8>; - num-viewport = <8>; - linux,pci-domain = <5>; + bus-range = <0x0 0xff>;
- clocks = <&bpmp TEGRA234_CLK_PEX1_C5_CORE>; - clock-names = "core"; + ranges = <0x43000000 0x21 0x40000000 0x21 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ + <0x02000000 0x0 0x40000000 0x24 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x36100000 0x00 0x36100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- resets = <&bpmp TEGRA234_RESET_PEX1_CORE_5_APB>, - <&bpmp TEGRA234_RESET_PEX1_CORE_5>; - reset-names = "apb", "core"; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE4R &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE4W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE4 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + status = "disabled"; + };
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; + pcie@14180000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4BA>; + reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x38000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x38080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x27 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- nvidia,bpmp = <&bpmp 5>; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <4>; + num-viewport = <8>; + linux,pci-domain = <0>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + clocks = <&bpmp TEGRA234_CLK_PEX0_C0_CORE>; + clock-names = "core";
- bus-range = <0x0 0xff>; + resets = <&bpmp TEGRA234_RESET_PEX0_CORE_0_APB>, + <&bpmp TEGRA234_RESET_PEX0_CORE_0>; + reset-names = "apb", "core";
- ranges = <0x43000000 0x28 0x00000000 0x28 0x00000000 0x3 0x28000000>, /* prefetchable memory (12928 MB) */ - <0x02000000 0x0 0x40000000 0x2b 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x3a100000 0x00 0x3a100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE5R &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE5W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE5 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>;
- status = "disabled"; - }; + nvidia,bpmp = <&bpmp 0>;
- pcie@141c0000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4A>; - reg = <0x00 0x141c0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x3c000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x3c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x3c080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x2e 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <4>; - num-viewport = <8>; - linux,pci-domain = <6>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>; + + bus-range = <0x0 0xff>;
- clocks = <&bpmp TEGRA234_CLK_PEX1_C6_CORE>; - clock-names = "core"; + ranges = <0x43000000 0x24 0x40000000 0x24 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ + <0x02000000 0x0 0x40000000 0x27 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x38100000 0x00 0x38100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- resets = <&bpmp TEGRA234_RESET_PEX1_CORE_6_APB>, - <&bpmp TEGRA234_RESET_PEX1_CORE_6>; - reset-names = "apb", "core"; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE0R &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE0W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE0 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + status = "disabled"; + };
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>; + pcie@141a0000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8A>; + reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x3a000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x2b 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- nvidia,bpmp = <&bpmp 6>; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <8>; + num-viewport = <8>; + linux,pci-domain = <5>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + clocks = <&bpmp TEGRA234_CLK_PEX1_C5_CORE>; + clock-names = "core";
- bus-range = <0x0 0xff>; + resets = <&bpmp TEGRA234_RESET_PEX1_CORE_5_APB>, + <&bpmp TEGRA234_RESET_PEX1_CORE_5>; + reset-names = "apb", "core";
- ranges = <0x43000000 0x2b 0x40000000 0x2b 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ - <0x02000000 0x0 0x40000000 0x2e 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x3c100000 0x00 0x3c100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE6AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE6AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE6 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
- status = "disabled"; - }; + nvidia,bpmp = <&bpmp 5>;
- pcie@141e0000 { - compatible = "nvidia,tegra234-pcie"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8B>; - reg = <0x00 0x141e0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x3e000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x00 0x3e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x3e080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x32 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ - reg-names = "appl", "config", "atu_dma", "dbi", "ecam"; - - #address-cells = <3>; - #size-cells = <2>; - device_type = "pci"; - num-lanes = <8>; - num-viewport = <8>; - linux,pci-domain = <7>; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>; + + bus-range = <0x0 0xff>;
- clocks = <&bpmp TEGRA234_CLK_PEX2_C7_CORE>; - clock-names = "core"; + ranges = <0x43000000 0x28 0x00000000 0x28 0x00000000 0x3 0x28000000>, /* prefetchable memory (12928 MB) */ + <0x02000000 0x0 0x40000000 0x2b 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x3a100000 0x00 0x3a100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_7_APB>, - <&bpmp TEGRA234_RESET_PEX2_CORE_7>; - reset-names = "apb", "core"; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE5R &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE5W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE5 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ - <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ - interrupt-names = "intr", "msi"; + status = "disabled"; + };
- #interrupt-cells = <1>; - interrupt-map-mask = <0 0 0 0>; - interrupt-map = <0 0 0 0 &gic GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>; + pcie-ep@141a0000 { + compatible = "nvidia,tegra234-pcie-ep"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8A>; + reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x27 0x40000000 0x4 0x00000000>; /* Address Space (16G) */ + reg-names = "appl", "atu_dma", "dbi", "addr_space";
- nvidia,bpmp = <&bpmp 7>; + num-lanes = <8>;
- nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + clocks = <&bpmp TEGRA234_CLK_PEX1_C5_CORE>; + clock-names = "core";
- bus-range = <0x0 0xff>; + resets = <&bpmp TEGRA234_RESET_PEX1_CORE_5_APB>, + <&bpmp TEGRA234_RESET_PEX1_CORE_5>; + reset-names = "apb", "core";
- ranges = <0x43000000 0x30 0x00000000 0x30 0x00000000 0x2 0x28000000>, /* prefetchable memory (8832 MB) */ - <0x02000000 0x0 0x40000000 0x32 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ - <0x01000000 0x0 0x3e100000 0x00 0x3e100000 0x0 0x00100000>; /* downstream I/O (1 MB) */ + interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ + interrupt-names = "intr";
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE7AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE7AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE7 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + nvidia,bpmp = <&bpmp 5>;
- status = "disabled"; - }; + nvidia,enable-ext-refclk; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>; + + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE5R &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE5W &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE5 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- pcie-ep@141a0000 { - compatible = "nvidia,tegra234-pcie-ep"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8A>; - reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x3a080000 0x0 0x00040000>, /* DBI reg space (256K) */ - <0x27 0x40000000 0x4 0x00000000>; /* Address Space (16G) */ - reg-names = "appl", "atu_dma", "dbi", "addr_space"; + status = "disabled"; + };
- num-lanes = <8>; + pcie@141c0000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4A>; + reg = <0x00 0x141c0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x3c000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x3c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x3c080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x2e 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- clocks = <&bpmp TEGRA234_CLK_PEX1_C5_CORE>; - clock-names = "core"; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <4>; + num-viewport = <8>; + linux,pci-domain = <6>;
- resets = <&bpmp TEGRA234_RESET_PEX1_CORE_5_APB>, - <&bpmp TEGRA234_RESET_PEX1_CORE_5>; - reset-names = "apb", "core"; + clocks = <&bpmp TEGRA234_CLK_PEX1_C6_CORE>; + clock-names = "core";
- interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ - interrupt-names = "intr"; + resets = <&bpmp TEGRA234_RESET_PEX1_CORE_6_APB>, + <&bpmp TEGRA234_RESET_PEX1_CORE_6>; + reset-names = "apb", "core";
- nvidia,bpmp = <&bpmp 5>; + interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 353 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- nvidia,enable-ext-refclk; - nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>;
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE5R &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE5W &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE5 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + nvidia,bpmp = <&bpmp 6>;
- status = "disabled"; - }; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- pcie-ep@141c0000{ - compatible = "nvidia,tegra234-pcie-ep"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4A>; - reg = <0x00 0x141c0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x3c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x3c080000 0x0 0x00040000>, /* DBI space (256K) */ - <0x2b 0x40000000 0x3 0x00000000>; /* Address Space (12G) */ - reg-names = "appl", "atu_dma", "dbi", "addr_space"; + bus-range = <0x0 0xff>;
- num-lanes = <4>; + ranges = <0x43000000 0x2b 0x40000000 0x2b 0x40000000 0x2 0xe8000000>, /* prefetchable memory (11904 MB) */ + <0x02000000 0x0 0x40000000 0x2e 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x3c100000 0x00 0x3c100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- clocks = <&bpmp TEGRA234_CLK_PEX1_C6_CORE>; - clock-names = "core"; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE6AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE6AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE6 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- resets = <&bpmp TEGRA234_RESET_PEX1_CORE_6_APB>, - <&bpmp TEGRA234_RESET_PEX1_CORE_6>; - reset-names = "apb", "core"; + status = "disabled"; + };
- interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ - interrupt-names = "intr"; + pcie-ep@141c0000 { + compatible = "nvidia,tegra234-pcie-ep"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4A>; + reg = <0x00 0x141c0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x3c040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x3c080000 0x0 0x00040000>, /* DBI space (256K) */ + <0x2b 0x40000000 0x3 0x00000000>; /* Address Space (12G) */ + reg-names = "appl", "atu_dma", "dbi", "addr_space";
- nvidia,bpmp = <&bpmp 6>; + num-lanes = <4>;
- nvidia,enable-ext-refclk; - nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + clocks = <&bpmp TEGRA234_CLK_PEX1_C6_CORE>; + clock-names = "core";
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE6AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE6AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE6 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + resets = <&bpmp TEGRA234_RESET_PEX1_CORE_6_APB>, + <&bpmp TEGRA234_RESET_PEX1_CORE_6>; + reset-names = "apb", "core";
- status = "disabled"; - }; + interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ + interrupt-names = "intr";
- pcie-ep@141e0000{ - compatible = "nvidia,tegra234-pcie-ep"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8B>; - reg = <0x00 0x141e0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x3e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x3e080000 0x0 0x00040000>, /* DBI space (256K) */ - <0x2e 0x40000000 0x4 0x00000000>; /* Address Space (16G) */ - reg-names = "appl", "atu_dma", "dbi", "addr_space"; + nvidia,bpmp = <&bpmp 6>;
- num-lanes = <8>; + nvidia,enable-ext-refclk; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- clocks = <&bpmp TEGRA234_CLK_PEX2_C7_CORE>; - clock-names = "core"; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE6AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE6AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso0 TEGRA234_SID_PCIE6 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_7_APB>, - <&bpmp TEGRA234_RESET_PEX2_CORE_7>; - reset-names = "apb", "core"; + status = "disabled"; + };
- interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ - interrupt-names = "intr"; + pcie@141e0000 { + compatible = "nvidia,tegra234-pcie"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8B>; + reg = <0x00 0x141e0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x3e000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x3e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x3e080000 0x0 0x00040000>, /* DBI reg space (256K) */ + <0x32 0x30000000 0x0 0x10000000>; /* ECAM (256MB) */ + reg-names = "appl", "config", "atu_dma", "dbi", "ecam";
- nvidia,bpmp = <&bpmp 7>; + #address-cells = <3>; + #size-cells = <2>; + device_type = "pci"; + num-lanes = <8>; + num-viewport = <8>; + linux,pci-domain = <7>;
- nvidia,enable-ext-refclk; - nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + clocks = <&bpmp TEGRA234_CLK_PEX2_C7_CORE>; + clock-names = "core";
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE7AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE7AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE7 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + resets = <&bpmp TEGRA234_RESET_PEX2_CORE_7_APB>, + <&bpmp TEGRA234_RESET_PEX2_CORE_7>; + reset-names = "apb", "core";
- status = "disabled"; - }; + interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>, /* controller interrupt */ + <GIC_SPI 355 IRQ_TYPE_LEVEL_HIGH>; /* MSI interrupt */ + interrupt-names = "intr", "msi";
- pcie-ep@140e0000{ - compatible = "nvidia,tegra234-pcie-ep"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CC>; - reg = <0x00 0x140e0000 0x0 0x00020000>, /* appl registers (128K) */ - <0x00 0x2e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x00 0x2e080000 0x0 0x00040000>, /* DBI space (256K) */ - <0x38 0x40000000 0x3 0x00000000>; /* Address Space (12G) */ - reg-names = "appl", "atu_dma", "dbi", "addr_space"; + #interrupt-cells = <1>; + interrupt-map-mask = <0 0 0 0>; + interrupt-map = <0 0 0 0 &gic GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>;
- num-lanes = <4>; + nvidia,bpmp = <&bpmp 7>;
- clocks = <&bpmp TEGRA234_CLK_PEX2_C10_CORE>; - clock-names = "core"; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>;
- resets = <&bpmp TEGRA234_RESET_PEX2_CORE_10_APB>, - <&bpmp TEGRA234_RESET_PEX2_CORE_10>; - reset-names = "apb", "core"; + bus-range = <0x0 0xff>;
- interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ - interrupt-names = "intr"; + ranges = <0x43000000 0x30 0x00000000 0x30 0x00000000 0x2 0x28000000>, /* prefetchable memory (8832 MB) */ + <0x02000000 0x0 0x40000000 0x32 0x28000000 0x0 0x08000000>, /* non-prefetchable memory (128 MB) */ + <0x01000000 0x0 0x3e100000 0x00 0x3e100000 0x0 0x00100000>; /* downstream I/O (1 MB) */
- nvidia,bpmp = <&bpmp 10>; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE7AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE7AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE7 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent;
- nvidia,enable-ext-refclk; - nvidia,aspm-cmrt-us = <60>; - nvidia,aspm-pwr-on-t-us = <20>; - nvidia,aspm-l0s-entrance-latency-us = <3>; + status = "disabled"; + };
- interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE10AR &emc>, - <&mc TEGRA234_MEMORY_CLIENT_PCIE10AW &emc>; - interconnect-names = "dma-mem", "write"; - iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE10 0x1000>; - iommu-map-mask = <0x0>; - dma-coherent; + pcie-ep@141e0000 { + compatible = "nvidia,tegra234-pcie-ep"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX8B>; + reg = <0x00 0x141e0000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x3e040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x3e080000 0x0 0x00040000>, /* DBI space (256K) */ + <0x2e 0x40000000 0x4 0x00000000>; /* Address Space (16G) */ + reg-names = "appl", "atu_dma", "dbi", "addr_space";
- status = "disabled"; + num-lanes = <8>; + + clocks = <&bpmp TEGRA234_CLK_PEX2_C7_CORE>; + clock-names = "core"; + + resets = <&bpmp TEGRA234_RESET_PEX2_CORE_7_APB>, + <&bpmp TEGRA234_RESET_PEX2_CORE_7>; + reset-names = "apb", "core"; + + interrupts = <GIC_SPI 354 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */ + interrupt-names = "intr"; + + nvidia,bpmp = <&bpmp 7>; + + nvidia,enable-ext-refclk; + nvidia,aspm-cmrt-us = <60>; + nvidia,aspm-pwr-on-t-us = <20>; + nvidia,aspm-l0s-entrance-latency-us = <3>; + + interconnects = <&mc TEGRA234_MEMORY_CLIENT_PCIE7AR &emc>, + <&mc TEGRA234_MEMORY_CLIENT_PCIE7AW &emc>; + interconnect-names = "dma-mem", "write"; + iommu-map = <0x0 &smmu_niso1 TEGRA234_SID_PCIE7 0x1000>; + iommu-map-mask = <0x0>; + dma-coherent; + + status = "disabled"; + }; };
sram@40000000 { compatible = "nvidia,tegra234-sysram", "mmio-sram"; reg = <0x0 0x40000000 0x0 0x80000>; + #address-cells = <1>; #size-cells = <1>; ranges = <0x0 0x0 0x40000000 0x80000>; + no-memory-wc;
cpu_bpmp_tx: sram@70000 {
From: Thierry Reding treding@nvidia.com
[ Upstream commit 79ed18d9ece474c15a2578e1cc5bfb4fce7a8eb7 ]
Nodes in device tree should be sorted by unit-address, followed by nodes without a unit-address, sorted alphabetically. Some exceptions are the top-level aliases, chosen, firmware, memory and reserved-memory nodes, which are expected to come first.
These rules apply recursively with some exceptions, such as pinmux nodes or regulator nodes, which often follow more complicated ordering (often by "importance").
While at it, change the name of some of the nodes to follow standard naming conventions, which helps with the sorting order and reduces the amount of warnings from the DT validation tools.
Signed-off-by: Thierry Reding treding@nvidia.com Stable-dep-of: 361238cdc525 ("arm64: tegra: Mark host1x as dma-coherent on Tegra194/234") Signed-off-by: Sasha Levin sashal@kernel.org --- .../arm64/boot/dts/nvidia/tegra132-norrin.dts | 16 +- arch/arm64/boot/dts/nvidia/tegra132.dtsi | 232 +- .../boot/dts/nvidia/tegra186-p2771-0000.dts | 2564 ++++++++--------- .../arm64/boot/dts/nvidia/tegra186-p3310.dtsi | 86 +- .../nvidia/tegra186-p3509-0000+p3636-0001.dts | 1730 +++++------ arch/arm64/boot/dts/nvidia/tegra186.dtsi | 470 +-- .../arm64/boot/dts/nvidia/tegra194-p2888.dtsi | 36 +- .../boot/dts/nvidia/tegra194-p2972-0000.dts | 2322 +++++++-------- .../boot/dts/nvidia/tegra194-p3509-0000.dtsi | 2435 ++++++++-------- .../arm64/boot/dts/nvidia/tegra194-p3668.dtsi | 36 +- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 519 ++-- .../arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 66 +- .../boot/dts/nvidia/tegra210-p2371-2180.dts | 278 +- .../arm64/boot/dts/nvidia/tegra210-p2595.dtsi | 3 + .../arm64/boot/dts/nvidia/tegra210-p2597.dtsi | 3 + .../arm64/boot/dts/nvidia/tegra210-p2894.dtsi | 86 +- .../boot/dts/nvidia/tegra210-p3450-0000.dts | 384 +-- arch/arm64/boot/dts/nvidia/tegra210-smaug.dts | 66 +- arch/arm64/boot/dts/nvidia/tegra210.dtsi | 310 +- .../boot/dts/nvidia/tegra234-p3701-0000.dtsi | 70 +- .../nvidia/tegra234-p3737-0000+p3701-0000.dts | 2486 ++++++++-------- arch/arm64/boot/dts/nvidia/tegra234.dtsi | 390 +-- 22 files changed, 7297 insertions(+), 7291 deletions(-)
diff --git a/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts b/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts index 3e8dee85d55f2..d4c034ac12447 100644 --- a/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts +++ b/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts @@ -1030,6 +1030,14 @@ clk32k_in: clock-32k { gpio-keys { compatible = "gpio-keys";
+ key-power { + label = "Power"; + gpios = <&gpio TEGRA_GPIO(Q, 0) GPIO_ACTIVE_LOW>; + linux,code = <KEY_POWER>; + debounce-interval = <10>; + wakeup-source; + }; + switch-lid { label = "Lid"; gpios = <&gpio TEGRA_GPIO(R, 4) GPIO_ACTIVE_LOW>; @@ -1038,14 +1046,6 @@ switch-lid { debounce-interval = <1>; wakeup-source; }; - - key-power { - label = "Power"; - gpios = <&gpio TEGRA_GPIO(Q, 0) GPIO_ACTIVE_LOW>; - linux,code = <KEY_POWER>; - debounce-interval = <10>; - wakeup-source; - }; };
panel: panel { diff --git a/arch/arm64/boot/dts/nvidia/tegra132.dtsi b/arch/arm64/boot/dts/nvidia/tegra132.dtsi index 858fc01cecb69..c017764bc27e9 100644 --- a/arch/arm64/boot/dts/nvidia/tegra132.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra132.dtsi @@ -893,122 +893,6 @@ throttle_heavy: heavy { }; };
- thermal-zones { - cpu-thermal { - polling-delay-passive = <1000>; - polling-delay = <0>; - - thermal-sensors = - <&soctherm TEGRA124_SOCTHERM_SENSOR_CPU>; - - trips { - cpu_shutdown_trip { - temperature = <105000>; - hysteresis = <1000>; - type = "critical"; - }; - - cpu_throttle_trip: throttle-trip { - temperature = <102000>; - hysteresis = <1000>; - type = "hot"; - }; - }; - - cooling-maps { - map0 { - trip = <&cpu_throttle_trip>; - cooling-device = <&throttle_heavy 1 1>; - }; - }; - }; - - mem-thermal { - polling-delay-passive = <0>; - polling-delay = <0>; - - thermal-sensors = - <&soctherm TEGRA124_SOCTHERM_SENSOR_MEM>; - - trips { - mem_shutdown_trip { - temperature = <101000>; - hysteresis = <1000>; - type = "critical"; - }; - mem_throttle_trip { - temperature = <99000>; - hysteresis = <1000>; - type = "hot"; - }; - }; - - cooling-maps { - /* - * There are currently no cooling maps, - * because there are no cooling devices. - */ - }; - }; - - gpu-thermal { - polling-delay-passive = <1000>; - polling-delay = <0>; - - thermal-sensors = - <&soctherm TEGRA124_SOCTHERM_SENSOR_GPU>; - - trips { - gpu_shutdown_trip { - temperature = <101000>; - hysteresis = <1000>; - type = "critical"; - }; - - gpu_throttle_trip: throttle-trip { - temperature = <99000>; - hysteresis = <1000>; - type = "hot"; - }; - }; - - cooling-maps { - map0 { - trip = <&gpu_throttle_trip>; - cooling-device = <&throttle_heavy 1 1>; - }; - }; - }; - - pllx-thermal { - polling-delay-passive = <0>; - polling-delay = <0>; - - thermal-sensors = - <&soctherm TEGRA124_SOCTHERM_SENSOR_PLLX>; - - trips { - pllx_shutdown_trip { - temperature = <105000>; - hysteresis = <1000>; - type = "critical"; - }; - pllx_throttle_trip { - temperature = <99000>; - hysteresis = <1000>; - type = "hot"; - }; - }; - - cooling-maps { - /* - * There are currently no cooling maps, - * because there are no cooling devices. - */ - }; - }; - }; - ahub@70300000 { compatible = "nvidia,tegra124-ahub"; reg = <0x0 0x70300000 0x0 0x200>, @@ -1255,6 +1139,122 @@ cpu@1 { }; };
+ thermal-zones { + cpu-thermal { + polling-delay-passive = <1000>; + polling-delay = <0>; + + thermal-sensors = + <&soctherm TEGRA124_SOCTHERM_SENSOR_CPU>; + + trips { + cpu_shutdown_trip { + temperature = <105000>; + hysteresis = <1000>; + type = "critical"; + }; + + cpu_throttle_trip: throttle-trip { + temperature = <102000>; + hysteresis = <1000>; + type = "hot"; + }; + }; + + cooling-maps { + map0 { + trip = <&cpu_throttle_trip>; + cooling-device = <&throttle_heavy 1 1>; + }; + }; + }; + + mem-thermal { + polling-delay-passive = <0>; + polling-delay = <0>; + + thermal-sensors = + <&soctherm TEGRA124_SOCTHERM_SENSOR_MEM>; + + trips { + mem_shutdown_trip { + temperature = <101000>; + hysteresis = <1000>; + type = "critical"; + }; + mem_throttle_trip { + temperature = <99000>; + hysteresis = <1000>; + type = "hot"; + }; + }; + + cooling-maps { + /* + * There are currently no cooling maps, + * because there are no cooling devices. + */ + }; + }; + + gpu-thermal { + polling-delay-passive = <1000>; + polling-delay = <0>; + + thermal-sensors = + <&soctherm TEGRA124_SOCTHERM_SENSOR_GPU>; + + trips { + gpu_shutdown_trip { + temperature = <101000>; + hysteresis = <1000>; + type = "critical"; + }; + + gpu_throttle_trip: throttle-trip { + temperature = <99000>; + hysteresis = <1000>; + type = "hot"; + }; + }; + + cooling-maps { + map0 { + trip = <&gpu_throttle_trip>; + cooling-device = <&throttle_heavy 1 1>; + }; + }; + }; + + pllx-thermal { + polling-delay-passive = <0>; + polling-delay = <0>; + + thermal-sensors = + <&soctherm TEGRA124_SOCTHERM_SENSOR_PLLX>; + + trips { + pllx_shutdown_trip { + temperature = <105000>; + hysteresis = <1000>; + type = "critical"; + }; + pllx_throttle_trip { + temperature = <99000>; + hysteresis = <1000>; + type = "hot"; + }; + }; + + cooling-maps { + /* + * There are currently no cooling maps, + * because there are no cooling devices. + */ + }; + }; + }; + timer { compatible = "arm,armv7-timer"; interrupts = <GIC_PPI 13 diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts index 47cf2013afcc3..15aa49fc45039 100644 --- a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts +++ b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts @@ -13,922 +13,984 @@ / { aconnect@2900000 { status = "okay";
- dma-controller@2930000 { - status = "okay"; - }; - - interrupt-controller@2a40000 { - status = "okay"; - }; - ahub@2900800 { status = "okay";
- ports { - #address-cells = <1>; - #size-cells = <0>; + i2s@2901000 { + status = "okay";
- port@0 { - reg = <0x0>; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_admaif0_ep: endpoint { - remote-endpoint = <&admaif0_ep>; + port@0 { + reg = <0>; + + i2s1_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s1_ep>; + }; }; - };
- port@1 { - reg = <0x1>; + i2s1_port: port@1 { + reg = <1>;
- xbar_admaif1_ep: endpoint { - remote-endpoint = <&admaif1_ep>; + i2s1_dap_ep: endpoint { + dai-format = "i2s"; + /* Placeholder for external Codec */ + }; }; }; + };
- port@2 { - reg = <0x2>; + i2s@2901100 { + status = "okay";
- xbar_admaif2_ep: endpoint { - remote-endpoint = <&admaif2_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@3 { - reg = <0x3>; + port@0 { + reg = <0>;
- xbar_admaif3_ep: endpoint { - remote-endpoint = <&admaif3_ep>; + i2s2_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s2_ep>; + }; }; - };
- port@4 { - reg = <0x4>; + i2s2_port: port@1 { + reg = <1>;
- xbar_admaif4_ep: endpoint { - remote-endpoint = <&admaif4_ep>; + i2s2_dap_ep: endpoint { + dai-format = "i2s"; + /* Placeholder for external Codec */ + }; }; }; + };
- port@5 { - reg = <0x5>; + i2s@2901200 { + status = "okay";
- xbar_admaif5_ep: endpoint { - remote-endpoint = <&admaif5_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@6 { - reg = <0x6>; + port@0 { + reg = <0>;
- xbar_admaif6_ep: endpoint { - remote-endpoint = <&admaif6_ep>; + i2s3_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s3_ep>; + }; }; - };
- port@7 { - reg = <0x7>; + i2s3_port: port@1 { + reg = <1>;
- xbar_admaif7_ep: endpoint { - remote-endpoint = <&admaif7_ep>; + i2s3_dap_ep: endpoint { + dai-format = "i2s"; + /* Placeholder for external Codec */ + }; }; }; + };
- port@8 { - reg = <0x8>; + i2s@2901300 { + status = "okay";
- xbar_admaif8_ep: endpoint { - remote-endpoint = <&admaif8_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@9 { - reg = <0x9>; + port@0 { + reg = <0>;
- xbar_admaif9_ep: endpoint { - remote-endpoint = <&admaif9_ep>; + i2s4_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s4_ep>; + }; }; - };
- port@a { - reg = <0xa>; + i2s4_port: port@1 { + reg = <1>;
- xbar_admaif10_ep: endpoint { - remote-endpoint = <&admaif10_ep>; + i2s4_dap_ep: endpoint { + dai-format = "i2s"; + /* Placeholder for external Codec */ + }; }; }; + };
- port@b { - reg = <0xb>; + i2s@2901400 { + status = "okay";
- xbar_admaif11_ep: endpoint { - remote-endpoint = <&admaif11_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@c { - reg = <0xc>; + port@0 { + reg = <0>;
- xbar_admaif12_ep: endpoint { - remote-endpoint = <&admaif12_ep>; + i2s5_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s5_ep>; + }; }; - };
- port@d { - reg = <0xd>; + i2s5_port: port@1 { + reg = <1>;
- xbar_admaif13_ep: endpoint { - remote-endpoint = <&admaif13_ep>; + i2s5_dap_ep: endpoint { + dai-format = "i2s"; + /* Placeholder for external Codec */ + }; }; }; + };
- port@e { - reg = <0xe>; + i2s@2901500 { + status = "okay";
- xbar_admaif14_ep: endpoint { - remote-endpoint = <&admaif14_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@f { - reg = <0xf>; + port@0 { + reg = <0>;
- xbar_admaif15_ep: endpoint { - remote-endpoint = <&admaif15_ep>; + i2s6_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s6_ep>; + }; }; - };
- port@10 { - reg = <0x10>; + i2s6_port: port@1 { + reg = <1>;
- xbar_admaif16_ep: endpoint { - remote-endpoint = <&admaif16_ep>; + i2s6_dap_ep: endpoint { + dai-format = "i2s"; + /* Placeholder for external Codec */ + }; }; }; + };
- port@11 { - reg = <0x11>; + sfc@2902000 { + status = "okay";
- xbar_admaif17_ep: endpoint { - remote-endpoint = <&admaif17_ep>; + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + sfc1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc1_in_ep>; + convert-rate = <44100>; + }; }; - };
- port@12 { - reg = <0x12>; + sfc1_out_port: port@1 { + reg = <1>;
- xbar_admaif18_ep: endpoint { - remote-endpoint = <&admaif18_ep>; + sfc1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc1_out_ep>; + convert-rate = <48000>; + }; }; }; + };
- port@13 { - reg = <0x13>; + sfc@2902200 { + status = "okay";
- xbar_admaif19_ep: endpoint { - remote-endpoint = <&admaif19_ep>; + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + sfc2_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc2_in_ep>; + }; }; - };
- xbar_i2s1_port: port@14 { - reg = <0x14>; + sfc2_out_port: port@1 { + reg = <1>;
- xbar_i2s1_ep: endpoint { - remote-endpoint = <&i2s1_cif_ep>; + sfc2_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc2_out_ep>; + }; }; }; + }; + + sfc@2902400 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_i2s2_port: port@15 { - reg = <0x15>; + port@0 { + reg = <0>;
- xbar_i2s2_ep: endpoint { - remote-endpoint = <&i2s2_cif_ep>; + sfc3_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc3_in_ep>; + }; }; - };
- xbar_i2s3_port: port@16 { - reg = <0x16>; + sfc3_out_port: port@1 { + reg = <1>;
- xbar_i2s3_ep: endpoint { - remote-endpoint = <&i2s3_cif_ep>; + sfc3_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc3_out_ep>; + }; }; }; + };
- xbar_i2s4_port: port@17 { - reg = <0x17>; + sfc@2902600 { + status = "okay";
- xbar_i2s4_ep: endpoint { - remote-endpoint = <&i2s4_cif_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_i2s5_port: port@18 { - reg = <0x18>; + port@0 { + reg = <0>;
- xbar_i2s5_ep: endpoint { - remote-endpoint = <&i2s5_cif_ep>; + sfc4_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc4_in_ep>; + }; }; - };
- xbar_i2s6_port: port@19 { - reg = <0x19>; + sfc4_out_port: port@1 { + reg = <1>;
- xbar_i2s6_ep: endpoint { - remote-endpoint = <&i2s6_cif_ep>; + sfc4_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc4_out_ep>; + }; }; }; + };
- xbar_dmic1_port: port@1a { - reg = <0x1a>; + amx@2903000 { + status = "okay";
- xbar_dmic1_ep: endpoint { - remote-endpoint = <&dmic1_cif_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_dmic2_port: port@1b { - reg = <0x1b>; + port@0 { + reg = <0>;
- xbar_dmic2_ep: endpoint { - remote-endpoint = <&dmic2_cif_ep>; + amx1_in1_ep: endpoint { + remote-endpoint = <&xbar_amx1_in1_ep>; + }; }; - };
- xbar_dmic3_port: port@1c { - reg = <0x1c>; + port@1 { + reg = <1>;
- xbar_dmic3_ep: endpoint { - remote-endpoint = <&dmic3_cif_ep>; + amx1_in2_ep: endpoint { + remote-endpoint = <&xbar_amx1_in2_ep>; + }; }; - };
- xbar_dspk1_port: port@1e { - reg = <0x1e>; + port@2 { + reg = <2>;
- xbar_dspk1_ep: endpoint { - remote-endpoint = <&dspk1_cif_ep>; + amx1_in3_ep: endpoint { + remote-endpoint = <&xbar_amx1_in3_ep>; + }; }; - };
- xbar_dspk2_port: port@1f { - reg = <0x1f>; + port@3 { + reg = <3>;
- xbar_dspk2_ep: endpoint { - remote-endpoint = <&dspk2_cif_ep>; + amx1_in4_ep: endpoint { + remote-endpoint = <&xbar_amx1_in4_ep>; + }; }; - };
- xbar_sfc1_in_port: port@20 { - reg = <0x20>; + amx1_out_port: port@4 { + reg = <4>;
- xbar_sfc1_in_ep: endpoint { - remote-endpoint = <&sfc1_cif_in_ep>; + amx1_out_ep: endpoint { + remote-endpoint = <&xbar_amx1_out_ep>; + }; }; }; + };
- port@21 { - reg = <0x21>; + amx@2903100 { + status = "okay";
- xbar_sfc1_out_ep: endpoint { - remote-endpoint = <&sfc1_cif_out_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_sfc2_in_port: port@22 { - reg = <0x22>; + port@0 { + reg = <0>;
- xbar_sfc2_in_ep: endpoint { - remote-endpoint = <&sfc2_cif_in_ep>; + amx2_in1_ep: endpoint { + remote-endpoint = <&xbar_amx2_in1_ep>; + }; }; - };
- port@23 { - reg = <0x23>; + port@1 { + reg = <1>;
- xbar_sfc2_out_ep: endpoint { - remote-endpoint = <&sfc2_cif_out_ep>; + amx2_in2_ep: endpoint { + remote-endpoint = <&xbar_amx2_in2_ep>; + }; }; - };
- xbar_sfc3_in_port: port@24 { - reg = <0x24>; + amx2_in3_port: port@2 { + reg = <2>;
- xbar_sfc3_in_ep: endpoint { - remote-endpoint = <&sfc3_cif_in_ep>; + amx2_in3_ep: endpoint { + remote-endpoint = <&xbar_amx2_in3_ep>; + }; }; - };
- port@25 { - reg = <0x25>; + amx2_in4_port: port@3 { + reg = <3>;
- xbar_sfc3_out_ep: endpoint { - remote-endpoint = <&sfc3_cif_out_ep>; + amx2_in4_ep: endpoint { + remote-endpoint = <&xbar_amx2_in4_ep>; + }; }; - };
- xbar_sfc4_in_port: port@26 { - reg = <0x26>; + amx2_out_port: port@4 { + reg = <4>;
- xbar_sfc4_in_ep: endpoint { - remote-endpoint = <&sfc4_cif_in_ep>; + amx2_out_ep: endpoint { + remote-endpoint = <&xbar_amx2_out_ep>; + }; }; }; + };
- port@27 { - reg = <0x27>; + amx@2903200 { + status = "okay";
- xbar_sfc4_out_ep: endpoint { - remote-endpoint = <&sfc4_cif_out_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mvc1_in_port: port@28 { - reg = <0x28>; + port@0 { + reg = <0>;
- xbar_mvc1_in_ep: endpoint { - remote-endpoint = <&mvc1_cif_in_ep>; + amx3_in1_ep: endpoint { + remote-endpoint = <&xbar_amx3_in1_ep>; + }; }; - };
- port@29 { - reg = <0x29>; + port@1 { + reg = <1>;
- xbar_mvc1_out_ep: endpoint { - remote-endpoint = <&mvc1_cif_out_ep>; + amx3_in2_ep: endpoint { + remote-endpoint = <&xbar_amx3_in2_ep>; + }; }; - };
- xbar_mvc2_in_port: port@2a { - reg = <0x2a>; + port@2 { + reg = <2>;
- xbar_mvc2_in_ep: endpoint { - remote-endpoint = <&mvc2_cif_in_ep>; + amx3_in3_ep: endpoint { + remote-endpoint = <&xbar_amx3_in3_ep>; + }; }; - };
- port@2b { - reg = <0x2b>; + port@3 { + reg = <3>;
- xbar_mvc2_out_ep: endpoint { - remote-endpoint = <&mvc2_cif_out_ep>; + amx3_in4_ep: endpoint { + remote-endpoint = <&xbar_amx3_in4_ep>; + }; }; - };
- xbar_amx1_in1_port: port@2c { - reg = <0x2c>; + amx3_out_port: port@4 { + reg = <4>;
- xbar_amx1_in1_ep: endpoint { - remote-endpoint = <&amx1_in1_ep>; + amx3_out_ep: endpoint { + remote-endpoint = <&xbar_amx3_out_ep>; + }; }; }; + };
- xbar_amx1_in2_port: port@2d { - reg = <0x2d>; + amx@2903300 { + status = "okay";
- xbar_amx1_in2_ep: endpoint { - remote-endpoint = <&amx1_in2_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx1_in3_port: port@2e { - reg = <0x2e>; + port@0 { + reg = <0>;
- xbar_amx1_in3_ep: endpoint { - remote-endpoint = <&amx1_in3_ep>; + amx4_in1_ep: endpoint { + remote-endpoint = <&xbar_amx4_in1_ep>; + }; }; - };
- xbar_amx1_in4_port: port@2f { - reg = <0x2f>; + port@1 { + reg = <1>;
- xbar_amx1_in4_ep: endpoint { - remote-endpoint = <&amx1_in4_ep>; + amx4_in2_ep: endpoint { + remote-endpoint = <&xbar_amx4_in2_ep>; + }; }; - };
- port@30 { - reg = <0x30>; + port@2 { + reg = <2>;
- xbar_amx1_out_ep: endpoint { - remote-endpoint = <&amx1_out_ep>; + amx4_in3_ep: endpoint { + remote-endpoint = <&xbar_amx4_in3_ep>; + }; }; - };
- xbar_amx2_in1_port: port@31 { - reg = <0x31>; + port@3 { + reg = <3>;
- xbar_amx2_in1_ep: endpoint { - remote-endpoint = <&amx2_in1_ep>; + amx4_in4_ep: endpoint { + remote-endpoint = <&xbar_amx4_in4_ep>; + }; }; - };
- xbar_amx2_in2_port: port@32 { - reg = <0x32>; + amx4_out_port: port@4 { + reg = <4>;
- xbar_amx2_in2_ep: endpoint { - remote-endpoint = <&amx2_in2_ep>; + amx4_out_ep: endpoint { + remote-endpoint = <&xbar_amx4_out_ep>; + }; }; }; + };
- xbar_amx2_in3_port: port@33 { - reg = <0x33>; + adx@2903800 { + status = "okay";
- xbar_amx2_in3_ep: endpoint { - remote-endpoint = <&amx2_in3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx2_in4_port: port@34 { - reg = <0x34>; + port@0 { + reg = <0>;
- xbar_amx2_in4_ep: endpoint { - remote-endpoint = <&amx2_in4_ep>; + adx1_in_ep: endpoint { + remote-endpoint = <&xbar_adx1_in_ep>; + }; }; - };
- port@35 { - reg = <0x35>; + adx1_out1_port: port@1 { + reg = <1>;
- xbar_amx2_out_ep: endpoint { - remote-endpoint = <&amx2_out_ep>; + adx1_out1_ep: endpoint { + remote-endpoint = <&xbar_adx1_out1_ep>; + }; }; - };
- xbar_amx3_in1_port: port@36 { - reg = <0x36>; + adx1_out2_port: port@2 { + reg = <2>;
- xbar_amx3_in1_ep: endpoint { - remote-endpoint = <&amx3_in1_ep>; + adx1_out2_ep: endpoint { + remote-endpoint = <&xbar_adx1_out2_ep>; + }; }; - };
- xbar_amx3_in2_port: port@37 { - reg = <0x37>; + adx1_out3_port: port@3 { + reg = <3>;
- xbar_amx3_in2_ep: endpoint { - remote-endpoint = <&amx3_in2_ep>; + adx1_out3_ep: endpoint { + remote-endpoint = <&xbar_adx1_out3_ep>; + }; }; - };
- xbar_amx3_in3_port: port@38 { - reg = <0x38>; + adx1_out4_port: port@4 { + reg = <4>;
- xbar_amx3_in3_ep: endpoint { - remote-endpoint = <&amx3_in3_ep>; + adx1_out4_ep: endpoint { + remote-endpoint = <&xbar_adx1_out4_ep>; + }; }; }; + };
- xbar_amx3_in4_port: port@39 { - reg = <0x39>; + adx@2903900 { + status = "okay";
- xbar_amx3_in4_ep: endpoint { - remote-endpoint = <&amx3_in4_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@3a { - reg = <0x3a>; + port@0 { + reg = <0>;
- xbar_amx3_out_ep: endpoint { - remote-endpoint = <&amx3_out_ep>; + adx2_in_ep: endpoint { + remote-endpoint = <&xbar_adx2_in_ep>; + }; }; - };
- xbar_amx4_in1_port: port@3b { - reg = <0x3b>; + adx2_out1_port: port@1 { + reg = <1>;
- xbar_amx4_in1_ep: endpoint { - remote-endpoint = <&amx4_in1_ep>; + adx2_out1_ep: endpoint { + remote-endpoint = <&xbar_adx2_out1_ep>; + }; }; - };
- xbar_amx4_in2_port: port@3c { - reg = <0x3c>; + adx2_out2_port: port@2 { + reg = <2>;
- xbar_amx4_in2_ep: endpoint { - remote-endpoint = <&amx4_in2_ep>; + adx2_out2_ep: endpoint { + remote-endpoint = <&xbar_adx2_out2_ep>; + }; }; - };
- xbar_amx4_in3_port: port@3d { - reg = <0x3d>; + adx2_out3_port: port@3 { + reg = <3>;
- xbar_amx4_in3_ep: endpoint { - remote-endpoint = <&amx4_in3_ep>; + adx2_out3_ep: endpoint { + remote-endpoint = <&xbar_adx2_out3_ep>; + }; }; - };
- xbar_amx4_in4_port: port@3e { - reg = <0x3e>; + adx2_out4_port: port@4 { + reg = <4>;
- xbar_amx4_in4_ep: endpoint { - remote-endpoint = <&amx4_in4_ep>; + adx2_out4_ep: endpoint { + remote-endpoint = <&xbar_adx2_out4_ep>; + }; }; }; + };
- port@3f { - reg = <0x3f>; + adx@2903a00 { + status = "okay";
- xbar_amx4_out_ep: endpoint { - remote-endpoint = <&amx4_out_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_adx1_in_port: port@40 { - reg = <0x40>; + port@0 { + reg = <0>;
- xbar_adx1_in_ep: endpoint { - remote-endpoint = <&adx1_in_ep>; + adx3_in_ep: endpoint { + remote-endpoint = <&xbar_adx3_in_ep>; + }; }; - };
- port@41 { - reg = <0x41>; + adx3_out1_port: port@1 { + reg = <1>;
- xbar_adx1_out1_ep: endpoint { - remote-endpoint = <&adx1_out1_ep>; + adx3_out1_ep: endpoint { + remote-endpoint = <&xbar_adx3_out1_ep>; + }; }; - };
- port@42 { - reg = <0x42>; + adx3_out2_port: port@2 { + reg = <2>;
- xbar_adx1_out2_ep: endpoint { - remote-endpoint = <&adx1_out2_ep>; + adx3_out2_ep: endpoint { + remote-endpoint = <&xbar_adx3_out2_ep>; + }; }; - };
- port@43 { - reg = <0x43>; + adx3_out3_port: port@3 { + reg = <3>;
- xbar_adx1_out3_ep: endpoint { - remote-endpoint = <&adx1_out3_ep>; + adx3_out3_ep: endpoint { + remote-endpoint = <&xbar_adx3_out3_ep>; + }; }; - };
- port@44 { - reg = <0x44>; + adx3_out4_port: port@4 { + reg = <4>;
- xbar_adx1_out4_ep: endpoint { - remote-endpoint = <&adx1_out4_ep>; + adx3_out4_ep: endpoint { + remote-endpoint = <&xbar_adx3_out4_ep>; + }; }; }; + };
- xbar_adx2_in_port: port@45 { - reg = <0x45>; + adx@2903b00 { + status = "okay";
- xbar_adx2_in_ep: endpoint { - remote-endpoint = <&adx2_in_ep>; + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + adx4_in_ep: endpoint { + remote-endpoint = <&xbar_adx4_in_ep>; + }; }; - };
- port@46 { - reg = <0x46>; + adx4_out1_port: port@1 { + reg = <1>;
- xbar_adx2_out1_ep: endpoint { - remote-endpoint = <&adx2_out1_ep>; + adx4_out1_ep: endpoint { + remote-endpoint = <&xbar_adx4_out1_ep>; + }; }; - };
- port@47 { - reg = <0x47>; + adx4_out2_port: port@2 { + reg = <2>;
- xbar_adx2_out2_ep: endpoint { - remote-endpoint = <&adx2_out2_ep>; + adx4_out2_ep: endpoint { + remote-endpoint = <&xbar_adx4_out2_ep>; + }; }; - };
- port@48 { - reg = <0x48>; + adx4_out3_port: port@3 { + reg = <3>;
- xbar_adx2_out3_ep: endpoint { - remote-endpoint = <&adx2_out3_ep>; + adx4_out3_ep: endpoint { + remote-endpoint = <&xbar_adx4_out3_ep>; + }; }; - };
- port@49 { - reg = <0x49>; + adx4_out4_port: port@4 { + reg = <4>;
- xbar_adx2_out4_ep: endpoint { - remote-endpoint = <&adx2_out4_ep>; + adx4_out4_ep: endpoint { + remote-endpoint = <&xbar_adx4_out4_ep>; + }; }; }; + };
- xbar_adx3_in_port: port@4a { - reg = <0x4a>; + dmic@2904000 { + status = "okay";
- xbar_adx3_in_ep: endpoint { - remote-endpoint = <&adx3_in_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@4b { - reg = <0x4b>; + port@0 { + reg = <0>;
- xbar_adx3_out1_ep: endpoint { - remote-endpoint = <&adx3_out1_ep>; + dmic1_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic1_ep>; + }; }; - };
- port@4c { - reg = <0x4c>; + dmic1_port: port@1 { + reg = <1>;
- xbar_adx3_out2_ep: endpoint { - remote-endpoint = <&adx3_out2_ep>; + dmic1_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- port@4d { - reg = <0x4d>; + dmic@2904100 { + status = "okay";
- xbar_adx3_out3_ep: endpoint { - remote-endpoint = <&adx3_out3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@4e { - reg = <0x4e>; + port@0 { + reg = <0>;
- xbar_adx3_out4_ep: endpoint { - remote-endpoint = <&adx3_out4_ep>; + dmic2_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic2_ep>; + }; }; - };
- xbar_adx4_in_port: port@4f { - reg = <0x4f>; + dmic2_port: port@1 { + reg = <1>;
- xbar_adx4_in_ep: endpoint { - remote-endpoint = <&adx4_in_ep>; + dmic2_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- port@50 { - reg = <0x50>; + dmic@2904200 { + status = "okay";
- xbar_adx4_out1_ep: endpoint { - remote-endpoint = <&adx4_out1_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@51 { - reg = <0x51>; + port@0 { + reg = <0>;
- xbar_adx4_out2_ep: endpoint { - remote-endpoint = <&adx4_out2_ep>; + dmic3_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic3_ep>; + }; }; - };
- port@52 { - reg = <0x52>; + dmic3_port: port@1 { + reg = <1>;
- xbar_adx4_out3_ep: endpoint { - remote-endpoint = <&adx4_out3_ep>; + dmic3_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- port@53 { - reg = <0x53>; + dspk@2905000 { + status = "okay";
- xbar_adx4_out4_ep: endpoint { - remote-endpoint = <&adx4_out4_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in1_port: port@54 { - reg = <0x54>; + port@0 { + reg = <0>;
- xbar_mixer_in1_ep: endpoint { - remote-endpoint = <&mixer_in1_ep>; + dspk1_cif_ep: endpoint { + remote-endpoint = <&xbar_dspk1_ep>; + }; }; - };
- xbar_mixer_in2_port: port@55 { - reg = <0x55>; + dspk1_port: port@1 { + reg = <1>;
- xbar_mixer_in2_ep: endpoint { - remote-endpoint = <&mixer_in2_ep>; + dspk1_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- xbar_mixer_in3_port: port@56 { - reg = <0x56>; + dspk@2905100 { + status = "okay";
- xbar_mixer_in3_ep: endpoint { - remote-endpoint = <&mixer_in3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in4_port: port@57 { - reg = <0x57>; + port@0 { + reg = <0>;
- xbar_mixer_in4_ep: endpoint { - remote-endpoint = <&mixer_in4_ep>; + dspk2_cif_ep: endpoint { + remote-endpoint = <&xbar_dspk2_ep>; + }; }; - };
- xbar_mixer_in5_port: port@58 { - reg = <0x58>; + dspk2_port: port@1 { + reg = <1>;
- xbar_mixer_in5_ep: endpoint { - remote-endpoint = <&mixer_in5_ep>; + dspk2_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- xbar_mixer_in6_port: port@59 { - reg = <0x59>; + processing-engine@2908000 { + status = "okay";
- xbar_mixer_in6_ep: endpoint { - remote-endpoint = <&mixer_in6_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in7_port: port@5a { - reg = <0x5a>; + port@0 { + reg = <0x0>;
- xbar_mixer_in7_ep: endpoint { - remote-endpoint = <&mixer_in7_ep>; + ope1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_ope1_in_ep>; + }; }; - };
- xbar_mixer_in8_port: port@5b { - reg = <0x5b>; + ope1_out_port: port@1 { + reg = <0x1>;
- xbar_mixer_in8_ep: endpoint { - remote-endpoint = <&mixer_in8_ep>; + ope1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_ope1_out_ep>; + }; }; }; + };
- xbar_mixer_in9_port: port@5c { - reg = <0x5c>; + mvc@290a000 { + status = "okay";
- xbar_mixer_in9_ep: endpoint { - remote-endpoint = <&mixer_in9_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in10_port: port@5d { - reg = <0x5d>; + port@0 { + reg = <0>;
- xbar_mixer_in10_ep: endpoint { - remote-endpoint = <&mixer_in10_ep>; + mvc1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc1_in_ep>; + }; }; - };
- port@5e { - reg = <0x5e>; + mvc1_out_port: port@1 { + reg = <1>;
- xbar_mixer_out1_ep: endpoint { - remote-endpoint = <&mixer_out1_ep>; + mvc1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc1_out_ep>; + }; }; }; + };
- port@5f { - reg = <0x5f>; + mvc@290a200 { + status = "okay";
- xbar_mixer_out2_ep: endpoint { - remote-endpoint = <&mixer_out2_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@60 { - reg = <0x60>; + port@0 { + reg = <0>;
- xbar_mixer_out3_ep: endpoint { - remote-endpoint = <&mixer_out3_ep>; + mvc2_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc2_in_ep>; + }; }; - };
- port@61 { - reg = <0x61>; + mvc2_out_port: port@1 { + reg = <1>;
- xbar_mixer_out4_ep: endpoint { - remote-endpoint = <&mixer_out4_ep>; + mvc2_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc2_out_ep>; + }; }; }; + };
- port@62 { - reg = <0x62>; + amixer@290bb00 { + status = "okay";
- xbar_mixer_out5_ep: endpoint { - remote-endpoint = <&mixer_out5_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_asrc_in1_port: port@63 { - reg = <0x63>; + port@0 { + reg = <0x0>;
- xbar_asrc_in1_ep: endpoint { - remote-endpoint = <&asrc_in1_ep>; + mixer_in1_ep: endpoint { + remote-endpoint = <&xbar_mixer_in1_ep>; + }; }; - };
- port@64 { - reg = <0x64>; + port@1 { + reg = <0x1>;
- xbar_asrc_out1_ep: endpoint { - remote-endpoint = <&asrc_out1_ep>; + mixer_in2_ep: endpoint { + remote-endpoint = <&xbar_mixer_in2_ep>; + }; }; - };
- xbar_asrc_in2_port: port@65 { - reg = <0x65>; + port@2 { + reg = <0x2>;
- xbar_asrc_in2_ep: endpoint { - remote-endpoint = <&asrc_in2_ep>; + mixer_in3_ep: endpoint { + remote-endpoint = <&xbar_mixer_in3_ep>; + }; }; - };
- port@66 { - reg = <0x66>; + port@3 { + reg = <0x3>;
- xbar_asrc_out2_ep: endpoint { - remote-endpoint = <&asrc_out2_ep>; + mixer_in4_ep: endpoint { + remote-endpoint = <&xbar_mixer_in4_ep>; + }; }; - };
- xbar_asrc_in3_port: port@67 { - reg = <0x67>; + port@4 { + reg = <0x4>;
- xbar_asrc_in3_ep: endpoint { - remote-endpoint = <&asrc_in3_ep>; + mixer_in5_ep: endpoint { + remote-endpoint = <&xbar_mixer_in5_ep>; + }; }; - };
- port@68 { - reg = <0x68>; + port@5 { + reg = <0x5>;
- xbar_asrc_out3_ep: endpoint { - remote-endpoint = <&asrc_out3_ep>; + mixer_in6_ep: endpoint { + remote-endpoint = <&xbar_mixer_in6_ep>; + }; }; - };
- xbar_asrc_in4_port: port@69 { - reg = <0x69>; + port@6 { + reg = <0x6>;
- xbar_asrc_in4_ep: endpoint { - remote-endpoint = <&asrc_in4_ep>; + mixer_in7_ep: endpoint { + remote-endpoint = <&xbar_mixer_in7_ep>; + }; }; - };
- port@6a { - reg = <0x6a>; + port@7 { + reg = <0x7>;
- xbar_asrc_out4_ep: endpoint { - remote-endpoint = <&asrc_out4_ep>; + mixer_in8_ep: endpoint { + remote-endpoint = <&xbar_mixer_in8_ep>; + }; }; - };
- xbar_asrc_in5_port: port@6b { - reg = <0x6b>; + port@8 { + reg = <0x8>;
- xbar_asrc_in5_ep: endpoint { - remote-endpoint = <&asrc_in5_ep>; + mixer_in9_ep: endpoint { + remote-endpoint = <&xbar_mixer_in9_ep>; + }; }; - };
- port@6c { - reg = <0x6c>; + port@9 { + reg = <0x9>;
- xbar_asrc_out5_ep: endpoint { - remote-endpoint = <&asrc_out5_ep>; + mixer_in10_ep: endpoint { + remote-endpoint = <&xbar_mixer_in10_ep>; + }; }; - };
- xbar_asrc_in6_port: port@6d { - reg = <0x6d>; + mixer_out1_port: port@a { + reg = <0xa>;
- xbar_asrc_in6_ep: endpoint { - remote-endpoint = <&asrc_in6_ep>; + mixer_out1_ep: endpoint { + remote-endpoint = <&xbar_mixer_out1_ep>; + }; }; - };
- port@6e { - reg = <0x6e>; + mixer_out2_port: port@b { + reg = <0xb>;
- xbar_asrc_out6_ep: endpoint { - remote-endpoint = <&asrc_out6_ep>; + mixer_out2_ep: endpoint { + remote-endpoint = <&xbar_mixer_out2_ep>; + }; }; - };
- xbar_asrc_in7_port: port@6f { - reg = <0x6f>; + mixer_out3_port: port@c { + reg = <0xc>;
- xbar_asrc_in7_ep: endpoint { - remote-endpoint = <&asrc_in7_ep>; + mixer_out3_ep: endpoint { + remote-endpoint = <&xbar_mixer_out3_ep>; + }; }; - };
- xbar_ope1_in_port: port@70 { - reg = <0x70>; + mixer_out4_port: port@d { + reg = <0xd>;
- xbar_ope1_in_ep: endpoint { - remote-endpoint = <&ope1_cif_in_ep>; + mixer_out4_ep: endpoint { + remote-endpoint = <&xbar_mixer_out4_ep>; + }; }; - };
- port@71 { - reg = <0x71>; + mixer_out5_port: port@e { + reg = <0xe>;
- xbar_ope1_out_ep: endpoint { - remote-endpoint = <&ope1_cif_out_ep>; + mixer_out5_ep: endpoint { + remote-endpoint = <&xbar_mixer_out5_ep>; + }; }; }; }; @@ -1102,33 +1164,7 @@ admaif19_ep: endpoint { }; };
- i2s@2901000 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - i2s1_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s1_ep>; - }; - }; - - i2s1_port: port@1 { - reg = <1>; - - i2s1_dap_ep: endpoint { - dai-format = "i2s"; - /* Placeholder for external Codec */ - }; - }; - }; - }; - - i2s@2901100 { + asrc@2910000 { status = "okay";
ports { @@ -1136,1064 +1172,1028 @@ ports { #size-cells = <0>;
port@0 { - reg = <0>; + reg = <0x0>;
- i2s2_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s2_ep>; + asrc_in1_ep: endpoint { + remote-endpoint = <&xbar_asrc_in1_ep>; }; };
- i2s2_port: port@1 { - reg = <1>; + port@1 { + reg = <0x1>;
- i2s2_dap_ep: endpoint { - dai-format = "i2s"; - /* Placeholder for external Codec */ + asrc_in2_ep: endpoint { + remote-endpoint = <&xbar_asrc_in2_ep>; }; }; - }; - }; - - i2s@2901200 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>;
- port@0 { - reg = <0>; + port@2 { + reg = <0x2>;
- i2s3_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s3_ep>; + asrc_in3_ep: endpoint { + remote-endpoint = <&xbar_asrc_in3_ep>; }; };
- i2s3_port: port@1 { - reg = <1>; + port@3 { + reg = <0x3>;
- i2s3_dap_ep: endpoint { - dai-format = "i2s"; - /* Placeholder for external Codec */ + asrc_in4_ep: endpoint { + remote-endpoint = <&xbar_asrc_in4_ep>; }; }; - }; - }; - - i2s@2901300 { - status = "okay";
- ports { - #address-cells = <1>; - #size-cells = <0>; + port@4 { + reg = <0x4>;
- port@0 { - reg = <0>; + asrc_in5_ep: endpoint { + remote-endpoint = <&xbar_asrc_in5_ep>; + }; + };
- i2s4_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s4_ep>; + port@5 { + reg = <0x5>; + + asrc_in6_ep: endpoint { + remote-endpoint = <&xbar_asrc_in6_ep>; }; };
- i2s4_port: port@1 { - reg = <1>; + port@6 { + reg = <0x6>;
- i2s4_dap_ep: endpoint { - dai-format = "i2s"; - /* Placeholder for external Codec */ + asrc_in7_ep: endpoint { + remote-endpoint = <&xbar_asrc_in7_ep>; }; }; - }; - };
- i2s@2901400 { - status = "okay"; + asrc_out1_port: port@7 { + reg = <0x7>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_out1_ep: endpoint { + remote-endpoint = <&xbar_asrc_out1_ep>; + }; + };
- port@0 { - reg = <0>; + asrc_out2_port: port@8 { + reg = <0x8>;
- i2s5_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s5_ep>; + asrc_out2_ep: endpoint { + remote-endpoint = <&xbar_asrc_out2_ep>; }; };
- i2s5_port: port@1 { - reg = <1>; + asrc_out3_port: port@9 { + reg = <0x9>;
- i2s5_dap_ep: endpoint { - dai-format = "i2s"; - /* Placeholder for external Codec */ + asrc_out3_ep: endpoint { + remote-endpoint = <&xbar_asrc_out3_ep>; }; }; - }; - };
- i2s@2901500 { - status = "okay"; + asrc_out4_port: port@a { + reg = <0xa>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_out4_ep: endpoint { + remote-endpoint = <&xbar_asrc_out4_ep>; + }; + };
- port@0 { - reg = <0>; + asrc_out5_port: port@b { + reg = <0xb>;
- i2s6_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s6_ep>; + asrc_out5_ep: endpoint { + remote-endpoint = <&xbar_asrc_out5_ep>; }; };
- i2s6_port: port@1 { - reg = <1>; + asrc_out6_port: port@c { + reg = <0xc>;
- i2s6_dap_ep: endpoint { - dai-format = "i2s"; - /* Placeholder for external Codec */ + asrc_out6_ep: endpoint { + remote-endpoint = <&xbar_asrc_out6_ep>; }; }; }; };
- dmic@2904000 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@0 { - reg = <0>; + port@0 { + reg = <0x0>;
- dmic1_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic1_ep>; - }; + xbar_admaif0_ep: endpoint { + remote-endpoint = <&admaif0_ep>; }; + };
- dmic1_port: port@1 { - reg = <1>; + port@1 { + reg = <0x1>;
- dmic1_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif1_ep: endpoint { + remote-endpoint = <&admaif1_ep>; }; }; - };
- dmic@2904100 { - status = "okay"; + port@2 { + reg = <0x2>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif2_ep: endpoint { + remote-endpoint = <&admaif2_ep>; + }; + };
- port@0 { - reg = <0>; + port@3 { + reg = <0x3>;
- dmic2_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic2_ep>; - }; + xbar_admaif3_ep: endpoint { + remote-endpoint = <&admaif3_ep>; }; + };
- dmic2_port: port@1 { - reg = <1>; + port@4 { + reg = <0x4>;
- dmic2_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif4_ep: endpoint { + remote-endpoint = <&admaif4_ep>; }; }; - };
- dmic@2904200 { - status = "okay"; + port@5 { + reg = <0x5>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif5_ep: endpoint { + remote-endpoint = <&admaif5_ep>; + }; + };
- port@0 { - reg = <0>; + port@6 { + reg = <0x6>;
- dmic3_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic3_ep>; - }; + xbar_admaif6_ep: endpoint { + remote-endpoint = <&admaif6_ep>; }; + };
- dmic3_port: port@1 { - reg = <1>; + port@7 { + reg = <0x7>;
- dmic3_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif7_ep: endpoint { + remote-endpoint = <&admaif7_ep>; }; }; - };
- dspk@2905000 { - status = "okay"; + port@8 { + reg = <0x8>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif8_ep: endpoint { + remote-endpoint = <&admaif8_ep>; + }; + };
- port@0 { - reg = <0>; + port@9 { + reg = <0x9>;
- dspk1_cif_ep: endpoint { - remote-endpoint = <&xbar_dspk1_ep>; - }; + xbar_admaif9_ep: endpoint { + remote-endpoint = <&admaif9_ep>; }; + };
- dspk1_port: port@1 { - reg = <1>; + port@a { + reg = <0xa>;
- dspk1_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif10_ep: endpoint { + remote-endpoint = <&admaif10_ep>; }; }; - };
- dspk@2905100 { - status = "okay"; + port@b { + reg = <0xb>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif11_ep: endpoint { + remote-endpoint = <&admaif11_ep>; + }; + };
- port@0 { - reg = <0>; + port@c { + reg = <0xc>;
- dspk2_cif_ep: endpoint { - remote-endpoint = <&xbar_dspk2_ep>; - }; + xbar_admaif12_ep: endpoint { + remote-endpoint = <&admaif12_ep>; }; + };
- dspk2_port: port@1 { - reg = <1>; + port@d { + reg = <0xd>;
- dspk2_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif13_ep: endpoint { + remote-endpoint = <&admaif13_ep>; }; }; - };
- sfc@2902000 { - status = "okay"; + port@e { + reg = <0xe>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif14_ep: endpoint { + remote-endpoint = <&admaif14_ep>; + }; + };
- port@0 { - reg = <0>; + port@f { + reg = <0xf>;
- sfc1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc1_in_ep>; - convert-rate = <44100>; - }; + xbar_admaif15_ep: endpoint { + remote-endpoint = <&admaif15_ep>; }; + };
- sfc1_out_port: port@1 { - reg = <1>; + port@10 { + reg = <0x10>;
- sfc1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc1_out_ep>; - convert-rate = <48000>; - }; + xbar_admaif16_ep: endpoint { + remote-endpoint = <&admaif16_ep>; }; }; - };
- sfc@2902200 { - status = "okay"; + port@11 { + reg = <0x11>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif17_ep: endpoint { + remote-endpoint = <&admaif17_ep>; + }; + };
- port@0 { - reg = <0>; + port@12 { + reg = <0x12>;
- sfc2_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc2_in_ep>; - }; + xbar_admaif18_ep: endpoint { + remote-endpoint = <&admaif18_ep>; }; + };
- sfc2_out_port: port@1 { - reg = <1>; + port@13 { + reg = <0x13>;
- sfc2_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc2_out_ep>; - }; + xbar_admaif19_ep: endpoint { + remote-endpoint = <&admaif19_ep>; }; }; - };
- sfc@2902400 { - status = "okay"; + xbar_i2s1_port: port@14 { + reg = <0x14>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_i2s1_ep: endpoint { + remote-endpoint = <&i2s1_cif_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_i2s2_port: port@15 { + reg = <0x15>;
- sfc3_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc3_in_ep>; - }; + xbar_i2s2_ep: endpoint { + remote-endpoint = <&i2s2_cif_ep>; }; + };
- sfc3_out_port: port@1 { - reg = <1>; + xbar_i2s3_port: port@16 { + reg = <0x16>;
- sfc3_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc3_out_ep>; - }; + xbar_i2s3_ep: endpoint { + remote-endpoint = <&i2s3_cif_ep>; }; }; - };
- sfc@2902600 { - status = "okay"; + xbar_i2s4_port: port@17 { + reg = <0x17>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_i2s4_ep: endpoint { + remote-endpoint = <&i2s4_cif_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_i2s5_port: port@18 { + reg = <0x18>;
- sfc4_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc4_in_ep>; - }; + xbar_i2s5_ep: endpoint { + remote-endpoint = <&i2s5_cif_ep>; }; + };
- sfc4_out_port: port@1 { - reg = <1>; + xbar_i2s6_port: port@19 { + reg = <0x19>;
- sfc4_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc4_out_ep>; - }; + xbar_i2s6_ep: endpoint { + remote-endpoint = <&i2s6_cif_ep>; }; }; - };
- mvc@290a000 { - status = "okay"; + xbar_dmic1_port: port@1a { + reg = <0x1a>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_dmic1_ep: endpoint { + remote-endpoint = <&dmic1_cif_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_dmic2_port: port@1b { + reg = <0x1b>;
- mvc1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc1_in_ep>; - }; + xbar_dmic2_ep: endpoint { + remote-endpoint = <&dmic2_cif_ep>; }; + };
- mvc1_out_port: port@1 { - reg = <1>; + xbar_dmic3_port: port@1c { + reg = <0x1c>;
- mvc1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc1_out_ep>; - }; + xbar_dmic3_ep: endpoint { + remote-endpoint = <&dmic3_cif_ep>; }; }; - };
- mvc@290a200 { - status = "okay"; + xbar_dspk1_port: port@1e { + reg = <0x1e>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_dspk1_ep: endpoint { + remote-endpoint = <&dspk1_cif_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_dspk2_port: port@1f { + reg = <0x1f>;
- mvc2_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc2_in_ep>; - }; + xbar_dspk2_ep: endpoint { + remote-endpoint = <&dspk2_cif_ep>; }; + };
- mvc2_out_port: port@1 { - reg = <1>; + xbar_sfc1_in_port: port@20 { + reg = <0x20>;
- mvc2_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc2_out_ep>; - }; + xbar_sfc1_in_ep: endpoint { + remote-endpoint = <&sfc1_cif_in_ep>; }; }; - };
- amx@2903000 { - status = "okay"; + port@21 { + reg = <0x21>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_sfc1_out_ep: endpoint { + remote-endpoint = <&sfc1_cif_out_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_sfc2_in_port: port@22 { + reg = <0x22>;
- amx1_in1_ep: endpoint { - remote-endpoint = <&xbar_amx1_in1_ep>; - }; + xbar_sfc2_in_ep: endpoint { + remote-endpoint = <&sfc2_cif_in_ep>; }; + };
- port@1 { - reg = <1>; + port@23 { + reg = <0x23>;
- amx1_in2_ep: endpoint { - remote-endpoint = <&xbar_amx1_in2_ep>; - }; + xbar_sfc2_out_ep: endpoint { + remote-endpoint = <&sfc2_cif_out_ep>; }; + };
- port@2 { - reg = <2>; + xbar_sfc3_in_port: port@24 { + reg = <0x24>;
- amx1_in3_ep: endpoint { - remote-endpoint = <&xbar_amx1_in3_ep>; - }; + xbar_sfc3_in_ep: endpoint { + remote-endpoint = <&sfc3_cif_in_ep>; }; + };
- port@3 { - reg = <3>; + port@25 { + reg = <0x25>;
- amx1_in4_ep: endpoint { - remote-endpoint = <&xbar_amx1_in4_ep>; - }; + xbar_sfc3_out_ep: endpoint { + remote-endpoint = <&sfc3_cif_out_ep>; }; + };
- amx1_out_port: port@4 { - reg = <4>; + xbar_sfc4_in_port: port@26 { + reg = <0x26>;
- amx1_out_ep: endpoint { - remote-endpoint = <&xbar_amx1_out_ep>; - }; + xbar_sfc4_in_ep: endpoint { + remote-endpoint = <&sfc4_cif_in_ep>; }; }; - };
- amx@2903100 { - status = "okay"; + port@27 { + reg = <0x27>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_sfc4_out_ep: endpoint { + remote-endpoint = <&sfc4_cif_out_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_mvc1_in_port: port@28 { + reg = <0x28>;
- amx2_in1_ep: endpoint { - remote-endpoint = <&xbar_amx2_in1_ep>; - }; + xbar_mvc1_in_ep: endpoint { + remote-endpoint = <&mvc1_cif_in_ep>; }; + };
- port@1 { - reg = <1>; - - amx2_in2_ep: endpoint { - remote-endpoint = <&xbar_amx2_in2_ep>; - }; + port@29 { + reg = <0x29>; + + xbar_mvc1_out_ep: endpoint { + remote-endpoint = <&mvc1_cif_out_ep>; }; + };
- amx2_in3_port: port@2 { - reg = <2>; + xbar_mvc2_in_port: port@2a { + reg = <0x2a>;
- amx2_in3_ep: endpoint { - remote-endpoint = <&xbar_amx2_in3_ep>; - }; + xbar_mvc2_in_ep: endpoint { + remote-endpoint = <&mvc2_cif_in_ep>; }; + };
- amx2_in4_port: port@3 { - reg = <3>; + port@2b { + reg = <0x2b>;
- amx2_in4_ep: endpoint { - remote-endpoint = <&xbar_amx2_in4_ep>; - }; + xbar_mvc2_out_ep: endpoint { + remote-endpoint = <&mvc2_cif_out_ep>; }; + };
- amx2_out_port: port@4 { - reg = <4>; + xbar_amx1_in1_port: port@2c { + reg = <0x2c>;
- amx2_out_ep: endpoint { - remote-endpoint = <&xbar_amx2_out_ep>; - }; + xbar_amx1_in1_ep: endpoint { + remote-endpoint = <&amx1_in1_ep>; }; }; - };
- amx@2903200 { - status = "okay"; + xbar_amx1_in2_port: port@2d { + reg = <0x2d>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx1_in2_ep: endpoint { + remote-endpoint = <&amx1_in2_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_amx1_in3_port: port@2e { + reg = <0x2e>;
- amx3_in1_ep: endpoint { - remote-endpoint = <&xbar_amx3_in1_ep>; - }; + xbar_amx1_in3_ep: endpoint { + remote-endpoint = <&amx1_in3_ep>; }; + };
- port@1 { - reg = <1>; + xbar_amx1_in4_port: port@2f { + reg = <0x2f>;
- amx3_in2_ep: endpoint { - remote-endpoint = <&xbar_amx3_in2_ep>; - }; + xbar_amx1_in4_ep: endpoint { + remote-endpoint = <&amx1_in4_ep>; }; + };
- port@2 { - reg = <2>; + port@30 { + reg = <0x30>;
- amx3_in3_ep: endpoint { - remote-endpoint = <&xbar_amx3_in3_ep>; - }; + xbar_amx1_out_ep: endpoint { + remote-endpoint = <&amx1_out_ep>; }; + };
- port@3 { - reg = <3>; + xbar_amx2_in1_port: port@31 { + reg = <0x31>;
- amx3_in4_ep: endpoint { - remote-endpoint = <&xbar_amx3_in4_ep>; - }; + xbar_amx2_in1_ep: endpoint { + remote-endpoint = <&amx2_in1_ep>; }; + };
- amx3_out_port: port@4 { - reg = <4>; + xbar_amx2_in2_port: port@32 { + reg = <0x32>;
- amx3_out_ep: endpoint { - remote-endpoint = <&xbar_amx3_out_ep>; - }; + xbar_amx2_in2_ep: endpoint { + remote-endpoint = <&amx2_in2_ep>; }; }; - };
- amx@2903300 { - status = "okay"; + xbar_amx2_in3_port: port@33 { + reg = <0x33>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx2_in3_ep: endpoint { + remote-endpoint = <&amx2_in3_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_amx2_in4_port: port@34 { + reg = <0x34>;
- amx4_in1_ep: endpoint { - remote-endpoint = <&xbar_amx4_in1_ep>; - }; + xbar_amx2_in4_ep: endpoint { + remote-endpoint = <&amx2_in4_ep>; }; + };
- port@1 { - reg = <1>; + port@35 { + reg = <0x35>;
- amx4_in2_ep: endpoint { - remote-endpoint = <&xbar_amx4_in2_ep>; - }; + xbar_amx2_out_ep: endpoint { + remote-endpoint = <&amx2_out_ep>; }; + };
- port@2 { - reg = <2>; + xbar_amx3_in1_port: port@36 { + reg = <0x36>;
- amx4_in3_ep: endpoint { - remote-endpoint = <&xbar_amx4_in3_ep>; - }; + xbar_amx3_in1_ep: endpoint { + remote-endpoint = <&amx3_in1_ep>; }; + };
- port@3 { - reg = <3>; + xbar_amx3_in2_port: port@37 { + reg = <0x37>;
- amx4_in4_ep: endpoint { - remote-endpoint = <&xbar_amx4_in4_ep>; - }; + xbar_amx3_in2_ep: endpoint { + remote-endpoint = <&amx3_in2_ep>; }; + };
- amx4_out_port: port@4 { - reg = <4>; + xbar_amx3_in3_port: port@38 { + reg = <0x38>;
- amx4_out_ep: endpoint { - remote-endpoint = <&xbar_amx4_out_ep>; - }; + xbar_amx3_in3_ep: endpoint { + remote-endpoint = <&amx3_in3_ep>; }; }; - };
- adx@2903800 { - status = "okay"; + xbar_amx3_in4_port: port@39 { + reg = <0x39>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx3_in4_ep: endpoint { + remote-endpoint = <&amx3_in4_ep>; + }; + };
- port@0 { - reg = <0>; + port@3a { + reg = <0x3a>;
- adx1_in_ep: endpoint { - remote-endpoint = <&xbar_adx1_in_ep>; - }; + xbar_amx3_out_ep: endpoint { + remote-endpoint = <&amx3_out_ep>; }; + };
- adx1_out1_port: port@1 { - reg = <1>; + xbar_amx4_in1_port: port@3b { + reg = <0x3b>;
- adx1_out1_ep: endpoint { - remote-endpoint = <&xbar_adx1_out1_ep>; - }; + xbar_amx4_in1_ep: endpoint { + remote-endpoint = <&amx4_in1_ep>; }; + };
- adx1_out2_port: port@2 { - reg = <2>; + xbar_amx4_in2_port: port@3c { + reg = <0x3c>;
- adx1_out2_ep: endpoint { - remote-endpoint = <&xbar_adx1_out2_ep>; - }; + xbar_amx4_in2_ep: endpoint { + remote-endpoint = <&amx4_in2_ep>; }; + };
- adx1_out3_port: port@3 { - reg = <3>; + xbar_amx4_in3_port: port@3d { + reg = <0x3d>;
- adx1_out3_ep: endpoint { - remote-endpoint = <&xbar_adx1_out3_ep>; - }; + xbar_amx4_in3_ep: endpoint { + remote-endpoint = <&amx4_in3_ep>; }; + };
- adx1_out4_port: port@4 { - reg = <4>; + xbar_amx4_in4_port: port@3e { + reg = <0x3e>;
- adx1_out4_ep: endpoint { - remote-endpoint = <&xbar_adx1_out4_ep>; - }; + xbar_amx4_in4_ep: endpoint { + remote-endpoint = <&amx4_in4_ep>; }; }; - };
- adx@2903900 { - status = "okay"; + port@3f { + reg = <0x3f>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx4_out_ep: endpoint { + remote-endpoint = <&amx4_out_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_adx1_in_port: port@40 { + reg = <0x40>;
- adx2_in_ep: endpoint { - remote-endpoint = <&xbar_adx2_in_ep>; - }; + xbar_adx1_in_ep: endpoint { + remote-endpoint = <&adx1_in_ep>; }; + };
- adx2_out1_port: port@1 { - reg = <1>; + port@41 { + reg = <0x41>;
- adx2_out1_ep: endpoint { - remote-endpoint = <&xbar_adx2_out1_ep>; - }; + xbar_adx1_out1_ep: endpoint { + remote-endpoint = <&adx1_out1_ep>; }; + };
- adx2_out2_port: port@2 { - reg = <2>; - - adx2_out2_ep: endpoint { - remote-endpoint = <&xbar_adx2_out2_ep>; - }; + port@42 { + reg = <0x42>; + + xbar_adx1_out2_ep: endpoint { + remote-endpoint = <&adx1_out2_ep>; }; + };
- adx2_out3_port: port@3 { - reg = <3>; + port@43 { + reg = <0x43>;
- adx2_out3_ep: endpoint { - remote-endpoint = <&xbar_adx2_out3_ep>; - }; + xbar_adx1_out3_ep: endpoint { + remote-endpoint = <&adx1_out3_ep>; }; + };
- adx2_out4_port: port@4 { - reg = <4>; + port@44 { + reg = <0x44>;
- adx2_out4_ep: endpoint { - remote-endpoint = <&xbar_adx2_out4_ep>; - }; + xbar_adx1_out4_ep: endpoint { + remote-endpoint = <&adx1_out4_ep>; }; }; - };
- adx@2903a00 { - status = "okay"; + xbar_adx2_in_port: port@45 { + reg = <0x45>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx2_in_ep: endpoint { + remote-endpoint = <&adx2_in_ep>; + }; + };
- port@0 { - reg = <0>; + port@46 { + reg = <0x46>;
- adx3_in_ep: endpoint { - remote-endpoint = <&xbar_adx3_in_ep>; - }; + xbar_adx2_out1_ep: endpoint { + remote-endpoint = <&adx2_out1_ep>; }; + };
- adx3_out1_port: port@1 { - reg = <1>; + port@47 { + reg = <0x47>;
- adx3_out1_ep: endpoint { - remote-endpoint = <&xbar_adx3_out1_ep>; - }; + xbar_adx2_out2_ep: endpoint { + remote-endpoint = <&adx2_out2_ep>; }; + };
- adx3_out2_port: port@2 { - reg = <2>; + port@48 { + reg = <0x48>;
- adx3_out2_ep: endpoint { - remote-endpoint = <&xbar_adx3_out2_ep>; - }; + xbar_adx2_out3_ep: endpoint { + remote-endpoint = <&adx2_out3_ep>; }; + };
- adx3_out3_port: port@3 { - reg = <3>; + port@49 { + reg = <0x49>;
- adx3_out3_ep: endpoint { - remote-endpoint = <&xbar_adx3_out3_ep>; - }; + xbar_adx2_out4_ep: endpoint { + remote-endpoint = <&adx2_out4_ep>; }; + };
- adx3_out4_port: port@4 { - reg = <4>; + xbar_adx3_in_port: port@4a { + reg = <0x4a>;
- adx3_out4_ep: endpoint { - remote-endpoint = <&xbar_adx3_out4_ep>; - }; + xbar_adx3_in_ep: endpoint { + remote-endpoint = <&adx3_in_ep>; }; }; - };
- adx@2903b00 { - status = "okay"; + port@4b { + reg = <0x4b>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx3_out1_ep: endpoint { + remote-endpoint = <&adx3_out1_ep>; + }; + };
- port@0 { - reg = <0>; + port@4c { + reg = <0x4c>;
- adx4_in_ep: endpoint { - remote-endpoint = <&xbar_adx4_in_ep>; - }; + xbar_adx3_out2_ep: endpoint { + remote-endpoint = <&adx3_out2_ep>; }; + };
- adx4_out1_port: port@1 { - reg = <1>; + port@4d { + reg = <0x4d>;
- adx4_out1_ep: endpoint { - remote-endpoint = <&xbar_adx4_out1_ep>; - }; + xbar_adx3_out3_ep: endpoint { + remote-endpoint = <&adx3_out3_ep>; }; + };
- adx4_out2_port: port@2 { - reg = <2>; + port@4e { + reg = <0x4e>;
- adx4_out2_ep: endpoint { - remote-endpoint = <&xbar_adx4_out2_ep>; - }; + xbar_adx3_out4_ep: endpoint { + remote-endpoint = <&adx3_out4_ep>; }; + };
- adx4_out3_port: port@3 { - reg = <3>; + xbar_adx4_in_port: port@4f { + reg = <0x4f>;
- adx4_out3_ep: endpoint { - remote-endpoint = <&xbar_adx4_out3_ep>; - }; + xbar_adx4_in_ep: endpoint { + remote-endpoint = <&adx4_in_ep>; }; + };
- adx4_out4_port: port@4 { - reg = <4>; + port@50 { + reg = <0x50>;
- adx4_out4_ep: endpoint { - remote-endpoint = <&xbar_adx4_out4_ep>; - }; + xbar_adx4_out1_ep: endpoint { + remote-endpoint = <&adx4_out1_ep>; }; }; - };
- processing-engine@2908000 { - status = "okay"; + port@51 { + reg = <0x51>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx4_out2_ep: endpoint { + remote-endpoint = <&adx4_out2_ep>; + }; + };
- port@0 { - reg = <0x0>; + port@52 { + reg = <0x52>;
- ope1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_ope1_in_ep>; - }; + xbar_adx4_out3_ep: endpoint { + remote-endpoint = <&adx4_out3_ep>; }; + };
- ope1_out_port: port@1 { - reg = <0x1>; + port@53 { + reg = <0x53>;
- ope1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_ope1_out_ep>; - }; + xbar_adx4_out4_ep: endpoint { + remote-endpoint = <&adx4_out4_ep>; }; }; - };
- amixer@290bb00 { - status = "okay"; + xbar_mixer_in1_port: port@54 { + reg = <0x54>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_mixer_in1_ep: endpoint { + remote-endpoint = <&mixer_in1_ep>; + }; + };
- port@0 { - reg = <0x0>; + xbar_mixer_in2_port: port@55 { + reg = <0x55>;
- mixer_in1_ep: endpoint { - remote-endpoint = <&xbar_mixer_in1_ep>; - }; + xbar_mixer_in2_ep: endpoint { + remote-endpoint = <&mixer_in2_ep>; }; + };
- port@1 { - reg = <0x1>; + xbar_mixer_in3_port: port@56 { + reg = <0x56>;
- mixer_in2_ep: endpoint { - remote-endpoint = <&xbar_mixer_in2_ep>; - }; + xbar_mixer_in3_ep: endpoint { + remote-endpoint = <&mixer_in3_ep>; }; + };
- port@2 { - reg = <0x2>; + xbar_mixer_in4_port: port@57 { + reg = <0x57>;
- mixer_in3_ep: endpoint { - remote-endpoint = <&xbar_mixer_in3_ep>; - }; + xbar_mixer_in4_ep: endpoint { + remote-endpoint = <&mixer_in4_ep>; }; + };
- port@3 { - reg = <0x3>; + xbar_mixer_in5_port: port@58 { + reg = <0x58>;
- mixer_in4_ep: endpoint { - remote-endpoint = <&xbar_mixer_in4_ep>; - }; + xbar_mixer_in5_ep: endpoint { + remote-endpoint = <&mixer_in5_ep>; }; + };
- port@4 { - reg = <0x4>; + xbar_mixer_in6_port: port@59 { + reg = <0x59>;
- mixer_in5_ep: endpoint { - remote-endpoint = <&xbar_mixer_in5_ep>; - }; + xbar_mixer_in6_ep: endpoint { + remote-endpoint = <&mixer_in6_ep>; }; + };
- port@5 { - reg = <0x5>; + xbar_mixer_in7_port: port@5a { + reg = <0x5a>;
- mixer_in6_ep: endpoint { - remote-endpoint = <&xbar_mixer_in6_ep>; - }; + xbar_mixer_in7_ep: endpoint { + remote-endpoint = <&mixer_in7_ep>; }; + };
- port@6 { - reg = <0x6>; - - mixer_in7_ep: endpoint { - remote-endpoint = <&xbar_mixer_in7_ep>; - }; + xbar_mixer_in8_port: port@5b { + reg = <0x5b>; + + xbar_mixer_in8_ep: endpoint { + remote-endpoint = <&mixer_in8_ep>; }; + };
- port@7 { - reg = <0x7>; + xbar_mixer_in9_port: port@5c { + reg = <0x5c>;
- mixer_in8_ep: endpoint { - remote-endpoint = <&xbar_mixer_in8_ep>; - }; + xbar_mixer_in9_ep: endpoint { + remote-endpoint = <&mixer_in9_ep>; }; + };
- port@8 { - reg = <0x8>; + xbar_mixer_in10_port: port@5d { + reg = <0x5d>;
- mixer_in9_ep: endpoint { - remote-endpoint = <&xbar_mixer_in9_ep>; - }; + xbar_mixer_in10_ep: endpoint { + remote-endpoint = <&mixer_in10_ep>; }; + };
- port@9 { - reg = <0x9>; + port@5e { + reg = <0x5e>;
- mixer_in10_ep: endpoint { - remote-endpoint = <&xbar_mixer_in10_ep>; - }; + xbar_mixer_out1_ep: endpoint { + remote-endpoint = <&mixer_out1_ep>; }; + };
- mixer_out1_port: port@a { - reg = <0xa>; + port@5f { + reg = <0x5f>;
- mixer_out1_ep: endpoint { - remote-endpoint = <&xbar_mixer_out1_ep>; - }; + xbar_mixer_out2_ep: endpoint { + remote-endpoint = <&mixer_out2_ep>; }; + };
- mixer_out2_port: port@b { - reg = <0xb>; + port@60 { + reg = <0x60>;
- mixer_out2_ep: endpoint { - remote-endpoint = <&xbar_mixer_out2_ep>; - }; + xbar_mixer_out3_ep: endpoint { + remote-endpoint = <&mixer_out3_ep>; }; + };
- mixer_out3_port: port@c { - reg = <0xc>; + port@61 { + reg = <0x61>;
- mixer_out3_ep: endpoint { - remote-endpoint = <&xbar_mixer_out3_ep>; - }; + xbar_mixer_out4_ep: endpoint { + remote-endpoint = <&mixer_out4_ep>; }; + };
- mixer_out4_port: port@d { - reg = <0xd>; + port@62 { + reg = <0x62>;
- mixer_out4_ep: endpoint { - remote-endpoint = <&xbar_mixer_out4_ep>; - }; + xbar_mixer_out5_ep: endpoint { + remote-endpoint = <&mixer_out5_ep>; }; + };
- mixer_out5_port: port@e { - reg = <0xe>; + xbar_asrc_in1_port: port@63 { + reg = <0x63>;
- mixer_out5_ep: endpoint { - remote-endpoint = <&xbar_mixer_out5_ep>; - }; + xbar_asrc_in1_ep: endpoint { + remote-endpoint = <&asrc_in1_ep>; }; }; - };
- asrc@2910000 { - status = "okay"; + port@64 { + reg = <0x64>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_asrc_out1_ep: endpoint { + remote-endpoint = <&asrc_out1_ep>; + }; + };
- port@0 { - reg = <0x0>; + xbar_asrc_in2_port: port@65 { + reg = <0x65>;
- asrc_in1_ep: endpoint { - remote-endpoint = <&xbar_asrc_in1_ep>; - }; + xbar_asrc_in2_ep: endpoint { + remote-endpoint = <&asrc_in2_ep>; }; + };
- port@1 { - reg = <0x1>; + port@66 { + reg = <0x66>;
- asrc_in2_ep: endpoint { - remote-endpoint = <&xbar_asrc_in2_ep>; - }; + xbar_asrc_out2_ep: endpoint { + remote-endpoint = <&asrc_out2_ep>; }; + };
- port@2 { - reg = <0x2>; + xbar_asrc_in3_port: port@67 { + reg = <0x67>;
- asrc_in3_ep: endpoint { - remote-endpoint = <&xbar_asrc_in3_ep>; - }; + xbar_asrc_in3_ep: endpoint { + remote-endpoint = <&asrc_in3_ep>; }; + };
- port@3 { - reg = <0x3>; + port@68 { + reg = <0x68>;
- asrc_in4_ep: endpoint { - remote-endpoint = <&xbar_asrc_in4_ep>; - }; + xbar_asrc_out3_ep: endpoint { + remote-endpoint = <&asrc_out3_ep>; }; + };
- port@4 { - reg = <0x4>; + xbar_asrc_in4_port: port@69 { + reg = <0x69>;
- asrc_in5_ep: endpoint { - remote-endpoint = <&xbar_asrc_in5_ep>; - }; + xbar_asrc_in4_ep: endpoint { + remote-endpoint = <&asrc_in4_ep>; }; + };
- port@5 { - reg = <0x5>; + port@6a { + reg = <0x6a>;
- asrc_in6_ep: endpoint { - remote-endpoint = <&xbar_asrc_in6_ep>; - }; + xbar_asrc_out4_ep: endpoint { + remote-endpoint = <&asrc_out4_ep>; }; + };
- port@6 { - reg = <0x6>; + xbar_asrc_in5_port: port@6b { + reg = <0x6b>;
- asrc_in7_ep: endpoint { - remote-endpoint = <&xbar_asrc_in7_ep>; - }; + xbar_asrc_in5_ep: endpoint { + remote-endpoint = <&asrc_in5_ep>; }; + };
- asrc_out1_port: port@7 { - reg = <0x7>; + port@6c { + reg = <0x6c>;
- asrc_out1_ep: endpoint { - remote-endpoint = <&xbar_asrc_out1_ep>; - }; + xbar_asrc_out5_ep: endpoint { + remote-endpoint = <&asrc_out5_ep>; }; + };
- asrc_out2_port: port@8 { - reg = <0x8>; + xbar_asrc_in6_port: port@6d { + reg = <0x6d>;
- asrc_out2_ep: endpoint { - remote-endpoint = <&xbar_asrc_out2_ep>; - }; + xbar_asrc_in6_ep: endpoint { + remote-endpoint = <&asrc_in6_ep>; }; + };
- asrc_out3_port: port@9 { - reg = <0x9>; + port@6e { + reg = <0x6e>;
- asrc_out3_ep: endpoint { - remote-endpoint = <&xbar_asrc_out3_ep>; - }; + xbar_asrc_out6_ep: endpoint { + remote-endpoint = <&asrc_out6_ep>; }; + };
- asrc_out4_port: port@a { - reg = <0xa>; + xbar_asrc_in7_port: port@6f { + reg = <0x6f>;
- asrc_out4_ep: endpoint { - remote-endpoint = <&xbar_asrc_out4_ep>; - }; + xbar_asrc_in7_ep: endpoint { + remote-endpoint = <&asrc_in7_ep>; }; + };
- asrc_out5_port: port@b { - reg = <0xb>; + xbar_ope1_in_port: port@70 { + reg = <0x70>;
- asrc_out5_ep: endpoint { - remote-endpoint = <&xbar_asrc_out5_ep>; - }; + xbar_ope1_in_ep: endpoint { + remote-endpoint = <&ope1_cif_in_ep>; }; + };
- asrc_out6_port: port@c { - reg = <0xc>; + port@71 { + reg = <0x71>;
- asrc_out6_ep: endpoint { - remote-endpoint = <&xbar_asrc_out6_ep>; - }; + xbar_ope1_out_ep: endpoint { + remote-endpoint = <&ope1_cif_out_ep>; }; }; }; }; + + dma-controller@2930000 { + status = "okay"; + }; + + interrupt-controller@2a40000 { + status = "okay"; + }; };
i2c@3160000 { @@ -2283,6 +2283,10 @@ mmc@3400000 { vmmc-supply = <&vdd_sd>; };
+ sata@3507000 { + status = "okay"; + }; + hda@3510000 { nvidia,model = "NVIDIA Jetson TX2 HDA"; status = "okay"; @@ -2471,10 +2475,6 @@ dpaux@155c0000 { }; };
- sata@3507000 { - status = "okay"; - }; - gpio-keys { compatible = "gpio-keys";
@@ -2489,21 +2489,21 @@ key-power { wakeup-source; };
- key-volume-up { - label = "Volume Up"; - gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 1) + key-volume-down { + label = "Volume Down"; + gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 2) GPIO_ACTIVE_LOW>; linux,input-type = <EV_KEY>; - linux,code = <KEY_VOLUMEUP>; + linux,code = <KEY_VOLUMEDOWN>; debounce-interval = <10>; };
- key-volume-down { - label = "Volume Down"; - gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 2) + key-volume-up { + label = "Volume Up"; + gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 1) GPIO_ACTIVE_LOW>; linux,input-type = <EV_KEY>; - linux,code = <KEY_VOLUMEDOWN>; + linux,code = <KEY_VOLUMEUP>; debounce-interval = <10>; }; }; diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi b/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi index aff857df25cf4..a4264ea417285 100644 --- a/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi @@ -190,32 +190,6 @@ pmc@c360000 { nvidia,invert-interrupt; };
- cpus { - cpu@0 { - enable-method = "psci"; - }; - - cpu@1 { - enable-method = "psci"; - }; - - cpu@2 { - enable-method = "psci"; - }; - - cpu@3 { - enable-method = "psci"; - }; - - cpu@4 { - enable-method = "psci"; - }; - - cpu@5 { - enable-method = "psci"; - }; - }; - bpmp { i2c { status = "okay"; @@ -235,6 +209,23 @@ pmic: pmic@3c { pinctrl-names = "default"; pinctrl-0 = <&max77620_default>;
+ fps { + fps0 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,shutdown-fps-time-period-us = <640>; + }; + + fps1 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; + maxim,shutdown-fps-time-period-us = <640>; + }; + + fps2 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,shutdown-fps-time-period-us = <640>; + }; + }; + max77620_default: pinmux { gpio0 { pins = "gpio0"; @@ -284,23 +275,6 @@ gpio7 { }; };
- fps { - fps0 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,shutdown-fps-time-period-us = <640>; - }; - - fps1 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; - maxim,shutdown-fps-time-period-us = <640>; - }; - - fps2 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,shutdown-fps-time-period-us = <640>; - }; - }; - regulators { in-sd0-supply = <&vdd_5v0_sys>; in-sd1-supply = <&vdd_5v0_sys>; @@ -387,6 +361,32 @@ vdd_pex: ldo8 { }; };
+ cpus { + cpu@0 { + enable-method = "psci"; + }; + + cpu@1 { + enable-method = "psci"; + }; + + cpu@2 { + enable-method = "psci"; + }; + + cpu@3 { + enable-method = "psci"; + }; + + cpu@4 { + enable-method = "psci"; + }; + + cpu@5 { + enable-method = "psci"; + }; + }; + psci { compatible = "arm,psci-1.0"; status = "okay"; diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p3509-0000+p3636-0001.dts b/arch/arm64/boot/dts/nvidia/tegra186-p3509-0000+p3636-0001.dts index 3e83a4d52eb1e..26f71651933d1 100644 --- a/arch/arm64/boot/dts/nvidia/tegra186-p3509-0000+p3636-0001.dts +++ b/arch/arm64/boot/dts/nvidia/tegra186-p3509-0000+p3636-0001.dts @@ -56,679 +56,282 @@ phy: ethernet-phy@0 { }; };
- memory-controller@2c00000 { - status = "okay"; - }; - - timer@3010000 { + aconnect@2900000 { status = "okay"; - };
- serial@3100000 { - status = "okay"; - }; + ahub@2900800 { + status = "okay";
- i2c@3160000 { - status = "okay"; - }; + i2s@2901000 { + status = "okay";
- i2c@3180000 { - status = "okay"; + ports { + #address-cells = <1>; + #size-cells = <0>;
- power-monitor@40 { - compatible = "ti,ina3221"; - reg = <0x40>; - #address-cells = <1>; - #size-cells = <0>; + port@0 { + reg = <0>;
- input@0 { - reg = <0>; - label = "VDD_IN"; - shunt-resistor-micro-ohms = <5>; - }; + i2s1_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s1_ep>; + }; + };
- input@1 { - reg = <1>; - label = "VDD_CPU_GPU"; - shunt-resistor-micro-ohms = <5>; - }; + i2s1_port: port@1 { + reg = <1>;
- input@2 { - reg = <2>; - label = "VDD_SOC"; - shunt-resistor-micro-ohms = <5>; + i2s1_dap_ep: endpoint { + dai-format = "i2s"; + /* Placeholder for external Codec */ + }; + }; + }; }; - }; - };
- ddc: i2c@3190000 { - status = "okay"; - }; + i2s@2901200 { + status = "okay";
- i2c@31c0000 { - status = "okay"; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- i2c@31e0000 { - status = "okay"; - }; + port@0 { + reg = <0>;
- /* SDMMC4 (eMMC) */ - mmc@3460000 { - status = "okay"; - bus-width = <8>; - non-removable; + i2s3_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s3_ep>; + }; + };
- vqmmc-supply = <&vdd_1v8_ap>; - vmmc-supply = <&vdd_3v3_sys>; - }; + i2s3_port: port@1 { + reg = <1>;
- hda@3510000 { - nvidia,model = "NVIDIA Jetson TX2 NX HDA"; - status = "okay"; - }; + i2s3_dap_ep: endpoint { + dai-format = "i2s"; + /* Placeholder for external Codec */ + }; + }; + }; + };
- padctl@3520000 { - status = "okay"; + dmic@2904000 { + status = "okay";
- avdd-pll-erefeut-supply = <&vdd_1v8_pll>; - avdd-usb-supply = <&vdd_3v3_sys>; - vclamp-usb-supply = <&vdd_1v8>; - vddio-hsic-supply = <&gnd>; + ports { + #address-cells = <1>; + #size-cells = <0>;
- pads { - usb2 { - status = "okay"; + port@0 { + reg = <0>;
- lanes { - micro_b: usb2-0 { - nvidia,function = "xusb"; - status = "okay"; + dmic1_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic1_ep>; + }; };
- usb2-1 { - nvidia,function = "xusb"; - status = "okay"; - }; + dmic1_port: port@1 { + reg = <1>;
- usb2-2 { - nvidia,function = "xusb"; - status = "okay"; + dmic1_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; };
- usb3 { + dmic@2904100 { status = "okay";
- lanes { - usb3-1 { - nvidia,function = "xusb"; - status = "okay"; + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + dmic2_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic2_ep>; + }; }; - }; - }; - };
- ports { - usb2-0 { - status = "okay"; - mode = "otg"; - vbus-supply = <&vdd_5v0_sys>; - usb-role-switch; + dmic2_port: port@1 { + reg = <1>;
- connector { - compatible = "gpio-usb-b-connector", - "usb-b-connector"; - label = "micro-USB"; - type = "micro"; - vbus-gpios = <&gpio - TEGRA186_MAIN_GPIO(L, 4) - GPIO_ACTIVE_LOW>; - id-gpios = <&pmic 0 GPIO_ACTIVE_HIGH>; + dmic2_dap_ep: endpoint { + /* Place holder for external Codec */ + }; + }; }; };
- usb2-1 { + admaif@290f000 { status = "okay"; - mode = "host";
- vbus-supply = <&vdd_5v0_sys>; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- usb2-2 { - status = "okay"; - mode = "host"; + admaif0_port: port@0 { + reg = <0x0>;
- vbus-supply = <&vdd_5v0_sys>; - }; + admaif0_ep: endpoint { + remote-endpoint = <&xbar_admaif0_ep>; + }; + };
- usb3-1 { - nvidia,usb2-companion = <1>; - vbus-supply = <&vdd_5v0_sys>; - status = "okay"; - }; - }; - }; + admaif1_port: port@1 { + reg = <0x1>;
- usb@3530000 { - status = "okay"; + admaif1_ep: endpoint { + remote-endpoint = <&xbar_admaif1_ep>; + }; + };
- phys = <&{/padctl@3520000/pads/usb2/lanes/usb2-0}>, - <&{/padctl@3520000/pads/usb2/lanes/usb2-1}>, - <&{/padctl@3520000/pads/usb2/lanes/usb2-2}>, - <&{/padctl@3520000/pads/usb3/lanes/usb3-1}>; - phy-names = "usb2-0", "usb2-1", "usb2-2", "usb3-1"; - }; + admaif2_port: port@2 { + reg = <0x2>;
- usb@3550000 { - status = "okay"; + admaif2_ep: endpoint { + remote-endpoint = <&xbar_admaif2_ep>; + }; + };
- phys = <µ_b>; - phy-names = "usb2-0"; - }; + admaif3_port: port@3 { + reg = <0x3>;
- hsp@3c00000 { - status = "okay"; - }; + admaif3_ep: endpoint { + remote-endpoint = <&xbar_admaif3_ep>; + }; + };
- i2c@c240000 { - status = "okay"; - }; + admaif4_port: port@4 { + reg = <0x4>;
- i2c@c250000 { - status = "okay"; + admaif4_ep: endpoint { + remote-endpoint = <&xbar_admaif4_ep>; + }; + };
- /* module ID EEPROM */ - eeprom@50 { - compatible = "atmel,24c02"; - reg = <0x50>; + admaif5_port: port@5 { + reg = <0x5>;
- label = "module"; - vcc-supply = <&vdd_1v8>; - address-width = <8>; - pagesize = <8>; - size = <256>; - read-only; - }; - - /* carrier board ID EEPROM */ - eeprom@57 { - compatible = "atmel,24c02"; - reg = <0x57>; - - label = "system"; - vcc-supply = <&vdd_1v8>; - address-width = <8>; - pagesize = <8>; - size = <256>; - read-only; - }; - }; - - rtc@c2a0000 { - status = "okay"; - }; - - pwm@c340000 { - status = "okay"; - }; - - pmc@c360000 { - nvidia,invert-interrupt; - }; - - pcie@10003000 { - status = "okay"; - - dvdd-pex-supply = <&vdd_pex>; - hvdd-pex-pll-supply = <&vdd_1v8>; - hvdd-pex-supply = <&vdd_1v8>; - vddio-pexctl-aud-supply = <&vdd_1v8>; - - pci@1,0 { - nvidia,num-lanes = <2>; - status = "okay"; - }; - - pci@2,0 { - nvidia,num-lanes = <1>; - status = "disabled"; - }; - - pci@3,0 { - nvidia,num-lanes = <1>; - status = "okay"; - }; - }; - - host1x@13e00000 { - status = "okay"; - - dpaux@15040000 { - status = "okay"; - }; - - display-hub@15200000 { - status = "okay"; - }; - - dsi@15300000 { - status = "disabled"; - }; - - /* DP */ - sor@15540000 { - status = "okay"; - - avdd-io-hdmi-dp-supply = <&vdd_hdmi_1v05>; - vdd-hdmi-dp-pll-supply = <&vdd_1v8_ap>; - - nvidia,dpaux = <&dpaux>; - }; - - /* HDMI */ - sor@15580000 { - status = "okay"; - - avdd-io-hdmi-dp-supply = <&vdd_hdmi_1v05>; - vdd-hdmi-dp-pll-supply = <&vdd_1v8_ap>; - hdmi-supply = <&vdd_hdmi>; - - nvidia,ddc-i2c-bus = <&ddc>; - nvidia,hpd-gpio = <&gpio TEGRA186_MAIN_GPIO(P, 1) - GPIO_ACTIVE_LOW>; - }; - - dpaux@155c0000 { - status = "okay"; - }; - }; - - gpu@17000000 { - status = "okay"; - }; - - fan: pwm-fan { - compatible = "pwm-fan"; - pwms = <&pwm4 0 45334>; - - cooling-levels = <0 64 128 255>; - #cooling-cells = <2>; - }; - - gpio-keys { - compatible = "gpio-keys"; - - key-power { - label = "Power"; - gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 0) - GPIO_ACTIVE_LOW>; - linux,input-type = <EV_KEY>; - linux,code = <KEY_POWER>; - debounce-interval = <10>; - wakeup-event-action = <EV_ACT_ASSERTED>; - wakeup-source; - }; - - key-volume-up { - label = "Volume Up"; - gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 1) - GPIO_ACTIVE_LOW>; - linux,input-type = <EV_KEY>; - linux,code = <KEY_VOLUMEUP>; - debounce-interval = <10>; - }; - - key-volume-down { - label = "Volume Down"; - gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 2) - GPIO_ACTIVE_LOW>; - linux,input-type = <EV_KEY>; - linux,code = <KEY_VOLUMEDOWN>; - debounce-interval = <10>; - }; - }; - - cpus { - cpu@0 { - enable-method = "psci"; - }; - - cpu@1 { - enable-method = "psci"; - }; - - cpu@2 { - enable-method = "psci"; - }; - - cpu@3 { - enable-method = "psci"; - }; - - cpu@4 { - enable-method = "psci"; - }; - - cpu@5 { - enable-method = "psci"; - }; - }; - - bpmp { - i2c { - status = "okay"; - - pmic: pmic@3c { - compatible = "maxim,max77620"; - reg = <0x3c>; - - interrupt-parent = <&pmc>; - interrupts = <24 IRQ_TYPE_LEVEL_LOW>; - #interrupt-cells = <2>; - interrupt-controller; - - #gpio-cells = <2>; - gpio-controller; - - pinctrl-names = "default"; - pinctrl-0 = <&max77620_default>; - - max77620_default: pinmux { - gpio0 { - pins = "gpio0"; - function = "gpio"; - }; - - gpio1 { - pins = "gpio1"; - function = "fps-out"; - maxim,active-fps-source = <MAX77620_FPS_SRC_0>; - }; - - gpio2 { - pins = "gpio2"; - function = "fps-out"; - maxim,active-fps-source = <MAX77620_FPS_SRC_1>; - }; - - gpio3 { - pins = "gpio3"; - function = "fps-out"; - maxim,active-fps-source = <MAX77620_FPS_SRC_1>; - }; - - gpio4 { - pins = "gpio4"; - function = "32k-out1"; - drive-push-pull = <1>; - }; - - gpio5 { - pins = "gpio5"; - function = "gpio"; - drive-push-pull = <0>; - }; - - gpio6 { - pins = "gpio6"; - function = "gpio"; - drive-push-pull = <1>; + admaif5_ep: endpoint { + remote-endpoint = <&xbar_admaif5_ep>; + }; };
- gpio7 { - pins = "gpio7"; - function = "gpio"; - drive-push-pull = <1>; - }; - }; + admaif6_port: port@6 { + reg = <0x6>;
- fps { - fps0 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,shutdown-fps-time-period-us = <640>; + admaif6_ep: endpoint { + remote-endpoint = <&xbar_admaif6_ep>; + }; };
- fps1 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; - maxim,shutdown-fps-time-period-us = <640>; - }; + admaif7_port: port@7 { + reg = <0x7>;
- fps2 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,shutdown-fps-time-period-us = <640>; + admaif7_ep: endpoint { + remote-endpoint = <&xbar_admaif7_ep>; + }; }; - }; - - regulators { - in-sd0-supply = <&vdd_5v0_sys>; - in-sd1-supply = <&vdd_5v0_sys>; - in-sd2-supply = <&vdd_5v0_sys>; - in-sd3-supply = <&vdd_5v0_sys>;
- in-ldo0-1-supply = <&vdd_5v0_sys>; - in-ldo2-supply = <&vdd_5v0_sys>; - in-ldo3-5-supply = <&vdd_5v0_sys>; - in-ldo4-6-supply = <&vdd_1v8>; - in-ldo7-8-supply = <&avdd_dsi_csi>; + admaif8_port: port@8 { + reg = <0x8>;
- sd0 { - regulator-name = "VDD_DDR_1V1_PMIC"; - regulator-min-microvolt = <1100000>; - regulator-max-microvolt = <1100000>; - regulator-always-on; - regulator-boot-on; + admaif8_ep: endpoint { + remote-endpoint = <&xbar_admaif8_ep>; + }; };
- avdd_dsi_csi: sd1 { - regulator-name = "AVDD_DSI_CSI_1V2"; - regulator-min-microvolt = <1200000>; - regulator-max-microvolt = <1200000>; - }; + admaif9_port: port@9 { + reg = <0x9>;
- vdd_1v8: sd2 { - regulator-name = "VDD_1V8"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; + admaif9_ep: endpoint { + remote-endpoint = <&xbar_admaif9_ep>; + }; };
- vdd_3v3_sys: sd3 { - regulator-name = "VDD_3V3_SYS"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; - }; + admaif10_port: port@a { + reg = <0xa>;
- vdd_1v8_pll: ldo0 { - regulator-name = "VDD_1V8_AP_PLL"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; + admaif10_ep: endpoint { + remote-endpoint = <&xbar_admaif10_ep>; + }; };
- ldo2 { - regulator-name = "VDDIO_3V3_AOHV"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; - regulator-always-on; - regulator-boot-on; - }; + admaif11_port: port@b { + reg = <0xb>;
- vddio_sdmmc1: ldo3 { - regulator-name = "VDDIO_SDMMC1_AP"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <3300000>; + admaif11_ep: endpoint { + remote-endpoint = <&xbar_admaif11_ep>; + }; };
- ldo4 { - regulator-name = "VDD_RTC"; - regulator-min-microvolt = <1000000>; - regulator-max-microvolt = <1000000>; - }; + admaif12_port: port@c { + reg = <0xc>;
- vddio_sdmmc3: ldo5 { - regulator-name = "VDDIO_SDMMC3_AP"; - regulator-min-microvolt = <2800000>; - regulator-max-microvolt = <2800000>; + admaif12_ep: endpoint { + remote-endpoint = <&xbar_admaif12_ep>; + }; };
- vdd_hdmi_1v05: ldo7 { - regulator-name = "VDD_HDMI_1V05"; - regulator-min-microvolt = <1050000>; - regulator-max-microvolt = <1050000>; - }; + admaif13_port: port@d { + reg = <0xd>;
- vdd_pex: ldo8 { - regulator-name = "VDD_PEX_1V05"; - regulator-min-microvolt = <1050000>; - regulator-max-microvolt = <1050000>; + admaif13_ep: endpoint { + remote-endpoint = <&xbar_admaif13_ep>; + }; }; - }; - }; - }; - }; - - psci { - compatible = "arm,psci-1.0"; - status = "okay"; - method = "smc"; - }; - - gnd: regulator-gnd { - compatible = "regulator-fixed"; - regulator-name = "GND"; - regulator-min-microvolt = <0>; - regulator-max-microvolt = <0>; - regulator-always-on; - regulator-boot-on; - }; - - vdd_5v0_sys: regulator-vdd-5v0-sys { - compatible = "regulator-fixed"; - regulator-name = "VDD_5V0_SYS"; - regulator-min-microvolt = <5000000>; - regulator-max-microvolt = <5000000>; - regulator-always-on; - regulator-boot-on; - }; - - vdd_1v8_ap: regulator-vdd-1v8-ap { - compatible = "regulator-fixed"; - regulator-name = "VDD_1V8_AP"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - - gpio = <&pmic 1 GPIO_ACTIVE_HIGH>; - enable-active-high; - - vin-supply = <&vdd_1v8>; - }; - - vdd_hdmi: regulator-vdd-hdmi { - compatible = "regulator-fixed"; - regulator-name = "VDD_5V0_HDMI_CON"; - regulator-min-microvolt = <5000000>; - regulator-max-microvolt = <5000000>; - - vin-supply = <&vdd_5v0_sys>; - }; - - thermal-zones { - cpu-thermal { - polling-delay = <0>; - polling-delay-passive = <500>; - status = "okay"; - - trips { - cpu_trip_critical: critical { - temperature = <96500>; - hysteresis = <0>; - type = "critical"; - }; - - cpu_trip_hot: hot { - temperature = <79000>; - hysteresis = <2000>; - type = "hot"; - }; - - cpu_trip_active: active { - temperature = <62000>; - hysteresis = <2000>; - type = "active"; - }; - - cpu_trip_passive: passive { - temperature = <45000>; - hysteresis = <2000>; - type = "passive"; - }; - }; - - cooling-maps { - cpu-critical { - cooling-device = <&fan 3 3>; - trip = <&cpu_trip_critical>; - };
- cpu-hot { - cooling-device = <&fan 2 2>; - trip = <&cpu_trip_hot>; - }; + admaif14_port: port@e { + reg = <0xe>;
- cpu-active { - cooling-device = <&fan 1 1>; - trip = <&cpu_trip_active>; - }; + admaif14_ep: endpoint { + remote-endpoint = <&xbar_admaif14_ep>; + }; + };
- cpu-passive { - cooling-device = <&fan 0 0>; - trip = <&cpu_trip_passive>; - }; - }; - }; + admaif15_port: port@f { + reg = <0xf>;
- aux-thermal { - polling-delay = <0>; - polling-delay-passive = <500>; - status = "okay"; + admaif15_ep: endpoint { + remote-endpoint = <&xbar_admaif15_ep>; + }; + };
- trips { - aux_alert0: critical { - temperature = <90000>; - hysteresis = <0>; - type = "critical"; - }; - }; - }; + admaif16_port: port@10 { + reg = <0x10>;
- gpu-thermal { - polling-delay = <0>; - polling-delay-passive = <500>; - status = "okay"; + admaif16_ep: endpoint { + remote-endpoint = <&xbar_admaif16_ep>; + }; + };
- trips { - gpu_alert0: critical { - temperature = <99000>; - hysteresis = <0>; - type = "critical"; - }; - }; - }; - }; + admaif17_port: port@11 { + reg = <0x11>;
- aconnect@2900000 { - status = "okay"; + admaif17_ep: endpoint { + remote-endpoint = <&xbar_admaif17_ep>; + }; + };
- dma-controller@2930000 { - status = "okay"; - }; + admaif18_port: port@12 { + reg = <0x12>;
- interrupt-controller@2a40000 { - status = "okay"; - }; + admaif18_ep: endpoint { + remote-endpoint = <&xbar_admaif18_ep>; + }; + };
- ahub@2900800 { - status = "okay"; + admaif19_port: port@13 { + reg = <0x13>; + + admaif19_ep: endpoint { + remote-endpoint = <&xbar_admaif19_ep>; + }; + }; + }; + };
ports { #address-cells = <1>; @@ -809,395 +412,708 @@ xbar_admaif8_ep: endpoint { port@9 { reg = <0x9>;
- xbar_admaif9_ep: endpoint { - remote-endpoint = <&admaif9_ep>; - }; - }; + xbar_admaif9_ep: endpoint { + remote-endpoint = <&admaif9_ep>; + }; + }; + + port@a { + reg = <0xa>; + + xbar_admaif10_ep: endpoint { + remote-endpoint = <&admaif10_ep>; + }; + }; + + port@b { + reg = <0xb>; + + xbar_admaif11_ep: endpoint { + remote-endpoint = <&admaif11_ep>; + }; + }; + + port@c { + reg = <0xc>; + + xbar_admaif12_ep: endpoint { + remote-endpoint = <&admaif12_ep>; + }; + }; + + port@d { + reg = <0xd>; + + xbar_admaif13_ep: endpoint { + remote-endpoint = <&admaif13_ep>; + }; + }; + + port@e { + reg = <0xe>; + + xbar_admaif14_ep: endpoint { + remote-endpoint = <&admaif14_ep>; + }; + }; + + port@f { + reg = <0xf>; + + xbar_admaif15_ep: endpoint { + remote-endpoint = <&admaif15_ep>; + }; + }; + + port@10 { + reg = <0x10>; + + xbar_admaif16_ep: endpoint { + remote-endpoint = <&admaif16_ep>; + }; + }; + + port@11 { + reg = <0x11>; + + xbar_admaif17_ep: endpoint { + remote-endpoint = <&admaif17_ep>; + }; + }; + + port@12 { + reg = <0x12>; + + xbar_admaif18_ep: endpoint { + remote-endpoint = <&admaif18_ep>; + }; + }; + + port@13 { + reg = <0x13>; + + xbar_admaif19_ep: endpoint { + remote-endpoint = <&admaif19_ep>; + }; + }; + + xbar_i2s1_port: port@14 { + reg = <0x14>; + + xbar_i2s1_ep: endpoint { + remote-endpoint = <&i2s1_cif_ep>; + }; + }; + + xbar_i2s3_port: port@16 { + reg = <0x16>; + + xbar_i2s3_ep: endpoint { + remote-endpoint = <&i2s3_cif_ep>; + }; + }; + + xbar_dmic1_port: port@1a { + reg = <0x1a>; + + xbar_dmic1_ep: endpoint { + remote-endpoint = <&dmic1_cif_ep>; + }; + }; + + xbar_dmic2_port: port@1b { + reg = <0x1b>; + + xbar_dmic2_ep: endpoint { + remote-endpoint = <&dmic2_cif_ep>; + }; + }; + }; + }; + + dma-controller@2930000 { + status = "okay"; + }; + + interrupt-controller@2a40000 { + status = "okay"; + }; + }; + + memory-controller@2c00000 { + status = "okay"; + }; + + timer@3010000 { + status = "okay"; + }; + + serial@3100000 { + status = "okay"; + }; + + i2c@3160000 { + status = "okay"; + }; + + i2c@3180000 { + status = "okay"; + + power-monitor@40 { + compatible = "ti,ina3221"; + reg = <0x40>; + #address-cells = <1>; + #size-cells = <0>; + + input@0 { + reg = <0>; + label = "VDD_IN"; + shunt-resistor-micro-ohms = <5>; + }; + + input@1 { + reg = <1>; + label = "VDD_CPU_GPU"; + shunt-resistor-micro-ohms = <5>; + }; + + input@2 { + reg = <2>; + label = "VDD_SOC"; + shunt-resistor-micro-ohms = <5>; + }; + }; + }; + + ddc: i2c@3190000 { + status = "okay"; + }; + + i2c@31c0000 { + status = "okay"; + }; + + i2c@31e0000 { + status = "okay"; + };
- port@a { - reg = <0xa>; + /* SDMMC4 (eMMC) */ + mmc@3460000 { + status = "okay"; + bus-width = <8>; + non-removable;
- xbar_admaif10_ep: endpoint { - remote-endpoint = <&admaif10_ep>; - }; - }; + vqmmc-supply = <&vdd_1v8_ap>; + vmmc-supply = <&vdd_3v3_sys>; + };
- port@b { - reg = <0xb>; + hda@3510000 { + nvidia,model = "NVIDIA Jetson TX2 NX HDA"; + status = "okay"; + };
- xbar_admaif11_ep: endpoint { - remote-endpoint = <&admaif11_ep>; - }; - }; + padctl@3520000 { + status = "okay";
- port@c { - reg = <0xc>; + avdd-pll-erefeut-supply = <&vdd_1v8_pll>; + avdd-usb-supply = <&vdd_3v3_sys>; + vclamp-usb-supply = <&vdd_1v8>; + vddio-hsic-supply = <&gnd>;
- xbar_admaif12_ep: endpoint { - remote-endpoint = <&admaif12_ep>; + pads { + usb2 { + status = "okay"; + + lanes { + micro_b: usb2-0 { + nvidia,function = "xusb"; + status = "okay"; }; - };
- port@d { - reg = <0xd>; + usb2-1 { + nvidia,function = "xusb"; + status = "okay"; + };
- xbar_admaif13_ep: endpoint { - remote-endpoint = <&admaif13_ep>; + usb2-2 { + nvidia,function = "xusb"; + status = "okay"; }; }; + };
- port@e { - reg = <0xe>; + usb3 { + status = "okay";
- xbar_admaif14_ep: endpoint { - remote-endpoint = <&admaif14_ep>; + lanes { + usb3-1 { + nvidia,function = "xusb"; + status = "okay"; }; }; + }; + };
- port@f { - reg = <0xf>; + ports { + usb2-0 { + status = "okay"; + mode = "otg"; + vbus-supply = <&vdd_5v0_sys>; + usb-role-switch;
- xbar_admaif15_ep: endpoint { - remote-endpoint = <&admaif15_ep>; - }; + connector { + compatible = "gpio-usb-b-connector", + "usb-b-connector"; + label = "micro-USB"; + type = "micro"; + vbus-gpios = <&gpio + TEGRA186_MAIN_GPIO(L, 4) + GPIO_ACTIVE_LOW>; + id-gpios = <&pmic 0 GPIO_ACTIVE_HIGH>; }; + };
- port@10 { - reg = <0x10>; + usb2-1 { + status = "okay"; + mode = "host";
- xbar_admaif16_ep: endpoint { - remote-endpoint = <&admaif16_ep>; - }; - }; + vbus-supply = <&vdd_5v0_sys>; + };
- port@11 { - reg = <0x11>; + usb2-2 { + status = "okay"; + mode = "host";
- xbar_admaif17_ep: endpoint { - remote-endpoint = <&admaif17_ep>; - }; - }; + vbus-supply = <&vdd_5v0_sys>; + };
- port@12 { - reg = <0x12>; + usb3-1 { + nvidia,usb2-companion = <1>; + vbus-supply = <&vdd_5v0_sys>; + status = "okay"; + }; + }; + };
- xbar_admaif18_ep: endpoint { - remote-endpoint = <&admaif18_ep>; - }; - }; + usb@3530000 { + status = "okay";
- port@13 { - reg = <0x13>; + phys = <&{/padctl@3520000/pads/usb2/lanes/usb2-0}>, + <&{/padctl@3520000/pads/usb2/lanes/usb2-1}>, + <&{/padctl@3520000/pads/usb2/lanes/usb2-2}>, + <&{/padctl@3520000/pads/usb3/lanes/usb3-1}>; + phy-names = "usb2-0", "usb2-1", "usb2-2", "usb3-1"; + };
- xbar_admaif19_ep: endpoint { - remote-endpoint = <&admaif19_ep>; - }; - }; + usb@3550000 { + status = "okay";
- xbar_i2s1_port: port@14 { - reg = <0x14>; + phys = <µ_b>; + phy-names = "usb2-0"; + };
- xbar_i2s1_ep: endpoint { - remote-endpoint = <&i2s1_cif_ep>; - }; - }; + hsp@3c00000 { + status = "okay"; + };
- xbar_i2s3_port: port@16 { - reg = <0x16>; + i2c@c240000 { + status = "okay"; + };
- xbar_i2s3_ep: endpoint { - remote-endpoint = <&i2s3_cif_ep>; - }; - }; + i2c@c250000 { + status = "okay";
- xbar_dmic1_port: port@1a { - reg = <0x1a>; + /* module ID EEPROM */ + eeprom@50 { + compatible = "atmel,24c02"; + reg = <0x50>;
- xbar_dmic1_ep: endpoint { - remote-endpoint = <&dmic1_cif_ep>; - }; - }; + label = "module"; + vcc-supply = <&vdd_1v8>; + address-width = <8>; + pagesize = <8>; + size = <256>; + read-only; + };
- xbar_dmic2_port: port@1b { - reg = <0x1b>; + /* carrier board ID EEPROM */ + eeprom@57 { + compatible = "atmel,24c02"; + reg = <0x57>;
- xbar_dmic2_ep: endpoint { - remote-endpoint = <&dmic2_cif_ep>; - }; - }; - }; + label = "system"; + vcc-supply = <&vdd_1v8>; + address-width = <8>; + pagesize = <8>; + size = <256>; + read-only; + }; + };
- admaif@290f000 { - status = "okay"; + rtc@c2a0000 { + status = "okay"; + };
- ports { - #address-cells = <1>; - #size-cells = <0>; + pwm@c340000 { + status = "okay"; + };
- admaif0_port: port@0 { - reg = <0x0>; + pmc@c360000 { + nvidia,invert-interrupt; + };
- admaif0_ep: endpoint { - remote-endpoint = <&xbar_admaif0_ep>; - }; - }; + pcie@10003000 { + status = "okay";
- admaif1_port: port@1 { - reg = <0x1>; + dvdd-pex-supply = <&vdd_pex>; + hvdd-pex-pll-supply = <&vdd_1v8>; + hvdd-pex-supply = <&vdd_1v8>; + vddio-pexctl-aud-supply = <&vdd_1v8>;
- admaif1_ep: endpoint { - remote-endpoint = <&xbar_admaif1_ep>; - }; - }; + pci@1,0 { + nvidia,num-lanes = <2>; + status = "okay"; + };
- admaif2_port: port@2 { - reg = <0x2>; + pci@2,0 { + nvidia,num-lanes = <1>; + status = "disabled"; + };
- admaif2_ep: endpoint { - remote-endpoint = <&xbar_admaif2_ep>; - }; - }; + pci@3,0 { + nvidia,num-lanes = <1>; + status = "okay"; + }; + };
- admaif3_port: port@3 { - reg = <0x3>; + host1x@13e00000 { + status = "okay";
- admaif3_ep: endpoint { - remote-endpoint = <&xbar_admaif3_ep>; - }; - }; + dpaux@15040000 { + status = "okay"; + };
- admaif4_port: port@4 { - reg = <0x4>; + display-hub@15200000 { + status = "okay"; + };
- admaif4_ep: endpoint { - remote-endpoint = <&xbar_admaif4_ep>; - }; - }; + dsi@15300000 { + status = "disabled"; + };
- admaif5_port: port@5 { - reg = <0x5>; + /* DP */ + sor@15540000 { + status = "okay";
- admaif5_ep: endpoint { - remote-endpoint = <&xbar_admaif5_ep>; - }; - }; + avdd-io-hdmi-dp-supply = <&vdd_hdmi_1v05>; + vdd-hdmi-dp-pll-supply = <&vdd_1v8_ap>;
- admaif6_port: port@6 { - reg = <0x6>; + nvidia,dpaux = <&dpaux>; + };
- admaif6_ep: endpoint { - remote-endpoint = <&xbar_admaif6_ep>; - }; - }; + /* HDMI */ + sor@15580000 { + status = "okay";
- admaif7_port: port@7 { - reg = <0x7>; + avdd-io-hdmi-dp-supply = <&vdd_hdmi_1v05>; + vdd-hdmi-dp-pll-supply = <&vdd_1v8_ap>; + hdmi-supply = <&vdd_hdmi>;
- admaif7_ep: endpoint { - remote-endpoint = <&xbar_admaif7_ep>; - }; - }; + nvidia,ddc-i2c-bus = <&ddc>; + nvidia,hpd-gpio = <&gpio TEGRA186_MAIN_GPIO(P, 1) + GPIO_ACTIVE_LOW>; + };
- admaif8_port: port@8 { - reg = <0x8>; + dpaux@155c0000 { + status = "okay"; + }; + };
- admaif8_ep: endpoint { - remote-endpoint = <&xbar_admaif8_ep>; - }; - }; + gpu@17000000 { + status = "okay"; + };
- admaif9_port: port@9 { - reg = <0x9>; + bpmp { + i2c { + status = "okay";
- admaif9_ep: endpoint { - remote-endpoint = <&xbar_admaif9_ep>; - }; - }; + pmic: pmic@3c { + compatible = "maxim,max77620"; + reg = <0x3c>;
- admaif10_port: port@a { - reg = <0xa>; + interrupt-parent = <&pmc>; + interrupts = <24 IRQ_TYPE_LEVEL_LOW>; + #interrupt-cells = <2>; + interrupt-controller;
- admaif10_ep: endpoint { - remote-endpoint = <&xbar_admaif10_ep>; - }; - }; + #gpio-cells = <2>; + gpio-controller;
- admaif11_port: port@b { - reg = <0xb>; + pinctrl-names = "default"; + pinctrl-0 = <&max77620_default>;
- admaif11_ep: endpoint { - remote-endpoint = <&xbar_admaif11_ep>; - }; + fps { + fps0 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,shutdown-fps-time-period-us = <640>; };
- admaif12_port: port@c { - reg = <0xc>; + fps1 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; + maxim,shutdown-fps-time-period-us = <640>; + };
- admaif12_ep: endpoint { - remote-endpoint = <&xbar_admaif12_ep>; - }; + fps2 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,shutdown-fps-time-period-us = <640>; }; + };
- admaif13_port: port@d { - reg = <0xd>; + max77620_default: pinmux { + gpio0 { + pins = "gpio0"; + function = "gpio"; + };
- admaif13_ep: endpoint { - remote-endpoint = <&xbar_admaif13_ep>; - }; + gpio1 { + pins = "gpio1"; + function = "fps-out"; + maxim,active-fps-source = <MAX77620_FPS_SRC_0>; };
- admaif14_port: port@e { - reg = <0xe>; + gpio2 { + pins = "gpio2"; + function = "fps-out"; + maxim,active-fps-source = <MAX77620_FPS_SRC_1>; + };
- admaif14_ep: endpoint { - remote-endpoint = <&xbar_admaif14_ep>; - }; + gpio3 { + pins = "gpio3"; + function = "fps-out"; + maxim,active-fps-source = <MAX77620_FPS_SRC_1>; };
- admaif15_port: port@f { - reg = <0xf>; + gpio4 { + pins = "gpio4"; + function = "32k-out1"; + drive-push-pull = <1>; + };
- admaif15_ep: endpoint { - remote-endpoint = <&xbar_admaif15_ep>; - }; + gpio5 { + pins = "gpio5"; + function = "gpio"; + drive-push-pull = <0>; };
- admaif16_port: port@10 { - reg = <0x10>; + gpio6 { + pins = "gpio6"; + function = "gpio"; + drive-push-pull = <1>; + };
- admaif16_ep: endpoint { - remote-endpoint = <&xbar_admaif16_ep>; - }; + gpio7 { + pins = "gpio7"; + function = "gpio"; + drive-push-pull = <1>; }; + };
- admaif17_port: port@11 { - reg = <0x11>; + regulators { + in-sd0-supply = <&vdd_5v0_sys>; + in-sd1-supply = <&vdd_5v0_sys>; + in-sd2-supply = <&vdd_5v0_sys>; + in-sd3-supply = <&vdd_5v0_sys>;
- admaif17_ep: endpoint { - remote-endpoint = <&xbar_admaif17_ep>; - }; + in-ldo0-1-supply = <&vdd_5v0_sys>; + in-ldo2-supply = <&vdd_5v0_sys>; + in-ldo3-5-supply = <&vdd_5v0_sys>; + in-ldo4-6-supply = <&vdd_1v8>; + in-ldo7-8-supply = <&avdd_dsi_csi>; + + sd0 { + regulator-name = "VDD_DDR_1V1_PMIC"; + regulator-min-microvolt = <1100000>; + regulator-max-microvolt = <1100000>; + regulator-always-on; + regulator-boot-on; };
- admaif18_port: port@12 { - reg = <0x12>; + avdd_dsi_csi: sd1 { + regulator-name = "AVDD_DSI_CSI_1V2"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1200000>; + };
- admaif18_ep: endpoint { - remote-endpoint = <&xbar_admaif18_ep>; - }; + vdd_1v8: sd2 { + regulator-name = "VDD_1V8"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; };
- admaif19_port: port@13 { - reg = <0x13>; + vdd_3v3_sys: sd3 { + regulator-name = "VDD_3V3_SYS"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + };
- admaif19_ep: endpoint { - remote-endpoint = <&xbar_admaif19_ep>; - }; + vdd_1v8_pll: ldo0 { + regulator-name = "VDD_1V8_AP_PLL"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; }; - }; - };
- i2s@2901000 { - status = "okay"; + ldo2 { + regulator-name = "VDDIO_3V3_AOHV"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-always-on; + regulator-boot-on; + };
- ports { - #address-cells = <1>; - #size-cells = <0>; + vddio_sdmmc1: ldo3 { + regulator-name = "VDDIO_SDMMC1_AP"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + };
- port@0 { - reg = <0>; + ldo4 { + regulator-name = "VDD_RTC"; + regulator-min-microvolt = <1000000>; + regulator-max-microvolt = <1000000>; + };
- i2s1_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s1_ep>; - }; + vddio_sdmmc3: ldo5 { + regulator-name = "VDDIO_SDMMC3_AP"; + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; };
- i2s1_port: port@1 { - reg = <1>; + vdd_hdmi_1v05: ldo7 { + regulator-name = "VDD_HDMI_1V05"; + regulator-min-microvolt = <1050000>; + regulator-max-microvolt = <1050000>; + };
- i2s1_dap_ep: endpoint { - dai-format = "i2s"; - /* Placeholder for external Codec */ - }; + vdd_pex: ldo8 { + regulator-name = "VDD_PEX_1V05"; + regulator-min-microvolt = <1050000>; + regulator-max-microvolt = <1050000>; }; }; }; + }; + };
- i2s@2901200 { - status = "okay"; + cpus { + cpu@0 { + enable-method = "psci"; + };
- ports { - #address-cells = <1>; - #size-cells = <0>; + cpu@1 { + enable-method = "psci"; + };
- port@0 { - reg = <0>; + cpu@2 { + enable-method = "psci"; + };
- i2s3_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s3_ep>; - }; - }; + cpu@3 { + enable-method = "psci"; + };
- i2s3_port: port@1 { - reg = <1>; + cpu@4 { + enable-method = "psci"; + };
- i2s3_dap_ep: endpoint { - dai-format = "i2s"; - /* Placeholder for external Codec */ - }; - }; - }; - }; + cpu@5 { + enable-method = "psci"; + }; + };
- dmic@2904000 { - status = "okay"; + gpio-keys { + compatible = "gpio-keys";
- ports { - #address-cells = <1>; - #size-cells = <0>; + key-power { + label = "Power"; + gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 0) + GPIO_ACTIVE_LOW>; + linux,input-type = <EV_KEY>; + linux,code = <KEY_POWER>; + debounce-interval = <10>; + wakeup-event-action = <EV_ACT_ASSERTED>; + wakeup-source; + };
- port@0 { - reg = <0>; + key-volume-down { + label = "Volume Down"; + gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 2) + GPIO_ACTIVE_LOW>; + linux,input-type = <EV_KEY>; + linux,code = <KEY_VOLUMEDOWN>; + debounce-interval = <10>; + };
- dmic1_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic1_ep>; - }; - }; + key-volume-up { + label = "Volume Up"; + gpios = <&gpio_aon TEGRA186_AON_GPIO(FF, 1) + GPIO_ACTIVE_LOW>; + linux,input-type = <EV_KEY>; + linux,code = <KEY_VOLUMEUP>; + debounce-interval = <10>; + }; + };
- dmic1_port: port@1 { - reg = <1>; + psci { + compatible = "arm,psci-1.0"; + status = "okay"; + method = "smc"; + };
- dmic1_dap_ep: endpoint { - /* Place holder for external Codec */ - }; - }; - }; - }; + fan: pwm-fan { + compatible = "pwm-fan"; + pwms = <&pwm4 0 45334>;
- dmic@2904100 { - status = "okay"; + cooling-levels = <0 64 128 255>; + #cooling-cells = <2>; + };
- ports { - #address-cells = <1>; - #size-cells = <0>; + gnd: regulator-gnd { + compatible = "regulator-fixed"; + regulator-name = "GND"; + regulator-min-microvolt = <0>; + regulator-max-microvolt = <0>; + regulator-always-on; + regulator-boot-on; + };
- port@0 { - reg = <0>; + vdd_5v0_sys: regulator-vdd-5v0-sys { + compatible = "regulator-fixed"; + regulator-name = "VDD_5V0_SYS"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + regulator-always-on; + regulator-boot-on; + };
- dmic2_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic2_ep>; - }; - }; + vdd_1v8_ap: regulator-vdd-1v8-ap { + compatible = "regulator-fixed"; + regulator-name = "VDD_1V8_AP"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>;
- dmic2_port: port@1 { - reg = <1>; + gpio = <&pmic 1 GPIO_ACTIVE_HIGH>; + enable-active-high;
- dmic2_dap_ep: endpoint { - /* Place holder for external Codec */ - }; - }; - }; - }; - }; + vin-supply = <&vdd_1v8>; + }; + + vdd_hdmi: regulator-vdd-hdmi { + compatible = "regulator-fixed"; + regulator-name = "VDD_5V0_HDMI_CON"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + + vin-supply = <&vdd_5v0_sys>; };
sound { @@ -1219,4 +1135,88 @@ sound {
label = "NVIDIA Jetson TX2 NX APE"; }; + + thermal-zones { + cpu-thermal { + polling-delay = <0>; + polling-delay-passive = <500>; + status = "okay"; + + trips { + cpu_trip_critical: critical { + temperature = <96500>; + hysteresis = <0>; + type = "critical"; + }; + + cpu_trip_hot: hot { + temperature = <79000>; + hysteresis = <2000>; + type = "hot"; + }; + + cpu_trip_active: active { + temperature = <62000>; + hysteresis = <2000>; + type = "active"; + }; + + cpu_trip_passive: passive { + temperature = <45000>; + hysteresis = <2000>; + type = "passive"; + }; + }; + + cooling-maps { + cpu-critical { + cooling-device = <&fan 3 3>; + trip = <&cpu_trip_critical>; + }; + + cpu-hot { + cooling-device = <&fan 2 2>; + trip = <&cpu_trip_hot>; + }; + + cpu-active { + cooling-device = <&fan 1 1>; + trip = <&cpu_trip_active>; + }; + + cpu-passive { + cooling-device = <&fan 0 0>; + trip = <&cpu_trip_passive>; + }; + }; + }; + + aux-thermal { + polling-delay = <0>; + polling-delay-passive = <500>; + status = "okay"; + + trips { + aux_alert0: critical { + temperature = <90000>; + hysteresis = <0>; + type = "critical"; + }; + }; + }; + + gpu-thermal { + polling-delay = <0>; + polling-delay-passive = <500>; + status = "okay"; + + trips { + gpu_alert0: critical { + temperature = <99000>; + hysteresis = <0>; + type = "critical"; + }; + }; + }; + }; }; diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi index b3f1494c02c11..0216b565a3703 100644 --- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi @@ -129,62 +129,6 @@ aconnect@2900000 { ranges = <0x02900000 0x0 0x02900000 0x200000>; status = "disabled";
- adma: dma-controller@2930000 { - compatible = "nvidia,tegra186-adma"; - reg = <0x02930000 0x20000>; - interrupt-parent = <&agic>; - interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>; - #dma-cells = <1>; - clocks = <&bpmp TEGRA186_CLK_AHUB>; - clock-names = "d_audio"; - status = "disabled"; - }; - - agic: interrupt-controller@2a40000 { - compatible = "nvidia,tegra186-agic", - "nvidia,tegra210-agic"; - #interrupt-cells = <3>; - interrupt-controller; - reg = <0x02a41000 0x1000>, - <0x02a42000 0x2000>; - interrupts = <GIC_SPI 145 - (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>; - clocks = <&bpmp TEGRA186_CLK_APE>; - clock-names = "clk"; - status = "disabled"; - }; - tegra_ahub: ahub@2900800 { compatible = "nvidia,tegra186-ahub"; reg = <0x02900800 0x800>; @@ -197,52 +141,6 @@ tegra_ahub: ahub@2900800 { ranges = <0x02900800 0x02900800 0x11800>; status = "disabled";
- tegra_admaif: admaif@290f000 { - compatible = "nvidia,tegra186-admaif"; - reg = <0x0290f000 0x1000>; - dmas = <&adma 1>, <&adma 1>, - <&adma 2>, <&adma 2>, - <&adma 3>, <&adma 3>, - <&adma 4>, <&adma 4>, - <&adma 5>, <&adma 5>, - <&adma 6>, <&adma 6>, - <&adma 7>, <&adma 7>, - <&adma 8>, <&adma 8>, - <&adma 9>, <&adma 9>, - <&adma 10>, <&adma 10>, - <&adma 11>, <&adma 11>, - <&adma 12>, <&adma 12>, - <&adma 13>, <&adma 13>, - <&adma 14>, <&adma 14>, - <&adma 15>, <&adma 15>, - <&adma 16>, <&adma 16>, - <&adma 17>, <&adma 17>, - <&adma 18>, <&adma 18>, - <&adma 19>, <&adma 19>, - <&adma 20>, <&adma 20>; - dma-names = "rx1", "tx1", - "rx2", "tx2", - "rx3", "tx3", - "rx4", "tx4", - "rx5", "tx5", - "rx6", "tx6", - "rx7", "tx7", - "rx8", "tx8", - "rx9", "tx9", - "rx10", "tx10", - "rx11", "tx11", - "rx12", "tx12", - "rx13", "tx13", - "rx14", "tx14", - "rx15", "tx15", - "rx16", "tx16", - "rx17", "tx17", - "rx18", "tx18", - "rx19", "tx19", - "rx20", "tx20"; - status = "disabled"; - }; - tegra_i2s1: i2s@2901000 { compatible = "nvidia,tegra186-i2s", "nvidia,tegra210-i2s"; @@ -327,78 +225,6 @@ tegra_i2s6: i2s@2901500 { status = "disabled"; };
- tegra_dmic1: dmic@2904000 { - compatible = "nvidia,tegra210-dmic"; - reg = <0x2904000 0x100>; - clocks = <&bpmp TEGRA186_CLK_DMIC1>; - clock-names = "dmic"; - assigned-clocks = <&bpmp TEGRA186_CLK_DMIC1>; - assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC1"; - status = "disabled"; - }; - - tegra_dmic2: dmic@2904100 { - compatible = "nvidia,tegra210-dmic"; - reg = <0x2904100 0x100>; - clocks = <&bpmp TEGRA186_CLK_DMIC2>; - clock-names = "dmic"; - assigned-clocks = <&bpmp TEGRA186_CLK_DMIC2>; - assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC2"; - status = "disabled"; - }; - - tegra_dmic3: dmic@2904200 { - compatible = "nvidia,tegra210-dmic"; - reg = <0x2904200 0x100>; - clocks = <&bpmp TEGRA186_CLK_DMIC3>; - clock-names = "dmic"; - assigned-clocks = <&bpmp TEGRA186_CLK_DMIC3>; - assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC3"; - status = "disabled"; - }; - - tegra_dmic4: dmic@2904300 { - compatible = "nvidia,tegra210-dmic"; - reg = <0x2904300 0x100>; - clocks = <&bpmp TEGRA186_CLK_DMIC4>; - clock-names = "dmic"; - assigned-clocks = <&bpmp TEGRA186_CLK_DMIC4>; - assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC4"; - status = "disabled"; - }; - - tegra_dspk1: dspk@2905000 { - compatible = "nvidia,tegra186-dspk"; - reg = <0x2905000 0x100>; - clocks = <&bpmp TEGRA186_CLK_DSPK1>; - clock-names = "dspk"; - assigned-clocks = <&bpmp TEGRA186_CLK_DSPK1>; - assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; - assigned-clock-rates = <12288000>; - sound-name-prefix = "DSPK1"; - status = "disabled"; - }; - - tegra_dspk2: dspk@2905100 { - compatible = "nvidia,tegra186-dspk"; - reg = <0x2905100 0x100>; - clocks = <&bpmp TEGRA186_CLK_DSPK2>; - clock-names = "dspk"; - assigned-clocks = <&bpmp TEGRA186_CLK_DSPK2>; - assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; - assigned-clock-rates = <12288000>; - sound-name-prefix = "DSPK2"; - status = "disabled"; - }; - tegra_sfc1: sfc@2902000 { compatible = "nvidia,tegra186-sfc", "nvidia,tegra210-sfc"; @@ -431,22 +257,6 @@ tegra_sfc4: sfc@2902600 { status = "disabled"; };
- tegra_mvc1: mvc@290a000 { - compatible = "nvidia,tegra186-mvc", - "nvidia,tegra210-mvc"; - reg = <0x290a000 0x200>; - sound-name-prefix = "MVC1"; - status = "disabled"; - }; - - tegra_mvc2: mvc@290a200 { - compatible = "nvidia,tegra186-mvc", - "nvidia,tegra210-mvc"; - reg = <0x290a200 0x200>; - sound-name-prefix = "MVC2"; - status = "disabled"; - }; - tegra_amx1: amx@2903000 { compatible = "nvidia,tegra186-amx", "nvidia,tegra210-amx"; @@ -511,6 +321,78 @@ tegra_adx4: adx@2903b00 { status = "disabled"; };
+ tegra_dmic1: dmic@2904000 { + compatible = "nvidia,tegra210-dmic"; + reg = <0x2904000 0x100>; + clocks = <&bpmp TEGRA186_CLK_DMIC1>; + clock-names = "dmic"; + assigned-clocks = <&bpmp TEGRA186_CLK_DMIC1>; + assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC1"; + status = "disabled"; + }; + + tegra_dmic2: dmic@2904100 { + compatible = "nvidia,tegra210-dmic"; + reg = <0x2904100 0x100>; + clocks = <&bpmp TEGRA186_CLK_DMIC2>; + clock-names = "dmic"; + assigned-clocks = <&bpmp TEGRA186_CLK_DMIC2>; + assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC2"; + status = "disabled"; + }; + + tegra_dmic3: dmic@2904200 { + compatible = "nvidia,tegra210-dmic"; + reg = <0x2904200 0x100>; + clocks = <&bpmp TEGRA186_CLK_DMIC3>; + clock-names = "dmic"; + assigned-clocks = <&bpmp TEGRA186_CLK_DMIC3>; + assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC3"; + status = "disabled"; + }; + + tegra_dmic4: dmic@2904300 { + compatible = "nvidia,tegra210-dmic"; + reg = <0x2904300 0x100>; + clocks = <&bpmp TEGRA186_CLK_DMIC4>; + clock-names = "dmic"; + assigned-clocks = <&bpmp TEGRA186_CLK_DMIC4>; + assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC4"; + status = "disabled"; + }; + + tegra_dspk1: dspk@2905000 { + compatible = "nvidia,tegra186-dspk"; + reg = <0x2905000 0x100>; + clocks = <&bpmp TEGRA186_CLK_DSPK1>; + clock-names = "dspk"; + assigned-clocks = <&bpmp TEGRA186_CLK_DSPK1>; + assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; + assigned-clock-rates = <12288000>; + sound-name-prefix = "DSPK1"; + status = "disabled"; + }; + + tegra_dspk2: dspk@2905100 { + compatible = "nvidia,tegra186-dspk"; + reg = <0x2905100 0x100>; + clocks = <&bpmp TEGRA186_CLK_DSPK2>; + clock-names = "dspk"; + assigned-clocks = <&bpmp TEGRA186_CLK_DSPK2>; + assigned-clock-parents = <&bpmp TEGRA186_CLK_PLL_A_OUT0>; + assigned-clock-rates = <12288000>; + sound-name-prefix = "DSPK2"; + status = "disabled"; + }; + tegra_ope1: processing-engine@2908000 { compatible = "nvidia,tegra186-ope", "nvidia,tegra210-ope"; @@ -534,6 +416,22 @@ dynamic-range-compressor@2908200 { }; };
+ tegra_mvc1: mvc@290a000 { + compatible = "nvidia,tegra186-mvc", + "nvidia,tegra210-mvc"; + reg = <0x290a000 0x200>; + sound-name-prefix = "MVC1"; + status = "disabled"; + }; + + tegra_mvc2: mvc@290a200 { + compatible = "nvidia,tegra186-mvc", + "nvidia,tegra210-mvc"; + reg = <0x290a200 0x200>; + sound-name-prefix = "MVC2"; + status = "disabled"; + }; + tegra_amixer: amixer@290bb00 { compatible = "nvidia,tegra186-amixer", "nvidia,tegra210-amixer"; @@ -542,6 +440,52 @@ tegra_amixer: amixer@290bb00 { status = "disabled"; };
+ tegra_admaif: admaif@290f000 { + compatible = "nvidia,tegra186-admaif"; + reg = <0x0290f000 0x1000>; + dmas = <&adma 1>, <&adma 1>, + <&adma 2>, <&adma 2>, + <&adma 3>, <&adma 3>, + <&adma 4>, <&adma 4>, + <&adma 5>, <&adma 5>, + <&adma 6>, <&adma 6>, + <&adma 7>, <&adma 7>, + <&adma 8>, <&adma 8>, + <&adma 9>, <&adma 9>, + <&adma 10>, <&adma 10>, + <&adma 11>, <&adma 11>, + <&adma 12>, <&adma 12>, + <&adma 13>, <&adma 13>, + <&adma 14>, <&adma 14>, + <&adma 15>, <&adma 15>, + <&adma 16>, <&adma 16>, + <&adma 17>, <&adma 17>, + <&adma 18>, <&adma 18>, + <&adma 19>, <&adma 19>, + <&adma 20>, <&adma 20>; + dma-names = "rx1", "tx1", + "rx2", "tx2", + "rx3", "tx3", + "rx4", "tx4", + "rx5", "tx5", + "rx6", "tx6", + "rx7", "tx7", + "rx8", "tx8", + "rx9", "tx9", + "rx10", "tx10", + "rx11", "tx11", + "rx12", "tx12", + "rx13", "tx13", + "rx14", "tx14", + "rx15", "tx15", + "rx16", "tx16", + "rx17", "tx17", + "rx18", "tx18", + "rx19", "tx19", + "rx20", "tx20"; + status = "disabled"; + }; + tegra_asrc: asrc@2910000 { compatible = "nvidia,tegra186-asrc"; reg = <0x2910000 0x2000>; @@ -549,6 +493,62 @@ tegra_asrc: asrc@2910000 { status = "disabled"; }; }; + + adma: dma-controller@2930000 { + compatible = "nvidia,tegra186-adma"; + reg = <0x02930000 0x20000>; + interrupt-parent = <&agic>; + interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>; + #dma-cells = <1>; + clocks = <&bpmp TEGRA186_CLK_AHUB>; + clock-names = "d_audio"; + status = "disabled"; + }; + + agic: interrupt-controller@2a40000 { + compatible = "nvidia,tegra186-agic", + "nvidia,tegra210-agic"; + #interrupt-cells = <3>; + interrupt-controller; + reg = <0x02a41000 0x1000>, + <0x02a42000 0x2000>; + interrupts = <GIC_SPI 145 + (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>; + clocks = <&bpmp TEGRA186_CLK_APE>; + clock-names = "clk"; + status = "disabled"; + }; };
mc: memory-controller@2c00000 { @@ -970,6 +970,34 @@ sdmmc4: mmc@3460000 { status = "disabled"; };
+ sata@3507000 { + compatible = "nvidia,tegra186-ahci"; + reg = <0x0 0x03507000 0x0 0x00002000>, /* AHCI */ + <0x0 0x03500000 0x0 0x00007000>, /* SATA */ + <0x0 0x03A90000 0x0 0x00010000>; /* SATA AUX */ + interrupts = <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>; + + power-domains = <&bpmp TEGRA186_POWER_DOMAIN_SAX>; + interconnects = <&mc TEGRA186_MEMORY_CLIENT_SATAR &emc>, + <&mc TEGRA186_MEMORY_CLIENT_SATAW &emc>; + interconnect-names = "dma-mem", "write"; + iommus = <&smmu TEGRA186_SID_SATA>; + + clocks = <&bpmp TEGRA186_CLK_SATA>, + <&bpmp TEGRA186_CLK_SATA_OOB>; + clock-names = "sata", "sata-oob"; + assigned-clocks = <&bpmp TEGRA186_CLK_SATA>, + <&bpmp TEGRA186_CLK_SATA_OOB>; + assigned-clock-parents = <&bpmp TEGRA186_CLK_PLLP_OUT0>, + <&bpmp TEGRA186_CLK_PLLP>; + assigned-clock-rates = <102000000>, + <204000000>; + resets = <&bpmp TEGRA186_RESET_SATA>, + <&bpmp TEGRA186_RESET_SATACOLD>; + reset-names = "sata", "sata-cold"; + status = "disabled"; + }; + hda@3510000 { compatible = "nvidia,tegra186-hda", "nvidia,tegra30-hda"; reg = <0x0 0x03510000 0x0 0x10000>; @@ -1286,18 +1314,13 @@ pmc: pmc@c360000 { #interrupt-cells = <2>; interrupt-controller;
- sdmmc1_3v3: sdmmc1-3v3 { - pins = "sdmmc1-hv"; - power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; - }; - sdmmc1_1v8: sdmmc1-1v8 { pins = "sdmmc1-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; };
- sdmmc2_3v3: sdmmc2-3v3 { - pins = "sdmmc2-hv"; + sdmmc1_3v3: sdmmc1-3v3 { + pins = "sdmmc1-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; };
@@ -1306,8 +1329,8 @@ sdmmc2_1v8: sdmmc2-1v8 { power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; };
- sdmmc3_3v3: sdmmc3-3v3 { - pins = "sdmmc3-hv"; + sdmmc2_3v3: sdmmc2-3v3 { + pins = "sdmmc2-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; };
@@ -1315,6 +1338,11 @@ sdmmc3_1v8: sdmmc3-1v8 { pins = "sdmmc3-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; }; + + sdmmc3_3v3: sdmmc3-3v3 { + pins = "sdmmc3-hv"; + power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; + }; };
ccplex@e000000 { @@ -1894,34 +1922,6 @@ cpu_bpmp_rx: sram@4f000 { }; };
- sata@3507000 { - compatible = "nvidia,tegra186-ahci"; - reg = <0x0 0x03507000 0x0 0x00002000>, /* AHCI */ - <0x0 0x03500000 0x0 0x00007000>, /* SATA */ - <0x0 0x03A90000 0x0 0x00010000>; /* SATA AUX */ - interrupts = <GIC_SPI 197 IRQ_TYPE_LEVEL_HIGH>; - - power-domains = <&bpmp TEGRA186_POWER_DOMAIN_SAX>; - interconnects = <&mc TEGRA186_MEMORY_CLIENT_SATAR &emc>, - <&mc TEGRA186_MEMORY_CLIENT_SATAW &emc>; - interconnect-names = "dma-mem", "write"; - iommus = <&smmu TEGRA186_SID_SATA>; - - clocks = <&bpmp TEGRA186_CLK_SATA>, - <&bpmp TEGRA186_CLK_SATA_OOB>; - clock-names = "sata", "sata-oob"; - assigned-clocks = <&bpmp TEGRA186_CLK_SATA>, - <&bpmp TEGRA186_CLK_SATA_OOB>; - assigned-clock-parents = <&bpmp TEGRA186_CLK_PLLP_OUT0>, - <&bpmp TEGRA186_CLK_PLLP>; - assigned-clock-rates = <102000000>, - <204000000>; - resets = <&bpmp TEGRA186_RESET_SATA>, - <&bpmp TEGRA186_RESET_SATACOLD>; - reset-names = "sata", "sata-cold"; - status = "disabled"; - }; - bpmp: bpmp { compatible = "nvidia,tegra186-bpmp"; interconnects = <&mc TEGRA186_MEMORY_CLIENT_BPMPR &emc>, @@ -2052,14 +2052,7 @@ L2_A57: l2-cache1 { }; };
- pmu_denver { - compatible = "nvidia,denver-pmu"; - interrupts = <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>; - interrupt-affinity = <&denver_0 &denver_1>; - }; - - pmu_a57 { + pmu-a57 { compatible = "arm,cortex-a57-pmu"; interrupts = <GIC_SPI 296 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>, @@ -2068,6 +2061,13 @@ pmu_a57 { interrupt-affinity = <&ca57_0 &ca57_1 &ca57_2 &ca57_3>; };
+ pmu-denver { + compatible = "nvidia,denver-pmu"; + interrupts = <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>; + interrupt-affinity = <&denver_0 &denver_1>; + }; + sound { status = "disabled";
diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi index cd272d407e012..5b59c1986e9b5 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi @@ -147,6 +147,24 @@ pmic: pmic@3c { pinctrl-names = "default"; pinctrl-0 = <&max20024_default>;
+ fps { + fps0 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,shutdown-fps-time-period-us = <640>; + }; + + fps1 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; + maxim,shutdown-fps-time-period-us = <640>; + maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>; + }; + + fps2 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,shutdown-fps-time-period-us = <640>; + }; + }; + max20024_default: pinmux { gpio0 { pins = "gpio0"; @@ -190,24 +208,6 @@ gpio7 { }; };
- fps { - fps0 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,shutdown-fps-time-period-us = <640>; - }; - - fps1 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; - maxim,shutdown-fps-time-period-us = <640>; - maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>; - }; - - fps2 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,shutdown-fps-time-period-us = <640>; - }; - }; - regulators { in-sd0-supply = <&vdd_5v0_sys>; in-sd1-supply = <&vdd_5v0_sys>; diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts b/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts index f018fc4c0f707..64a3398fe7a6d 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts +++ b/arch/arm64/boot/dts/nvidia/tegra194-p2972-0000.dts @@ -14,874 +14,830 @@ bus@0 { aconnect@2900000 { status = "okay";
- dma-controller@2930000 { - status = "okay"; - }; - - interrupt-controller@2a40000 { - status = "okay"; - }; - ahub@2900800 { status = "okay";
- ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0x0>; - - xbar_admaif0_ep: endpoint { - remote-endpoint = <&admaif0_ep>; - }; - }; - - port@1 { - reg = <0x1>; - - xbar_admaif1_ep: endpoint { - remote-endpoint = <&admaif1_ep>; - }; - }; - - port@2 { - reg = <0x2>; - - xbar_admaif2_ep: endpoint { - remote-endpoint = <&admaif2_ep>; - }; - }; - - port@3 { - reg = <0x3>; - - xbar_admaif3_ep: endpoint { - remote-endpoint = <&admaif3_ep>; - }; - }; - - port@4 { - reg = <0x4>; - - xbar_admaif4_ep: endpoint { - remote-endpoint = <&admaif4_ep>; - }; - }; - - port@5 { - reg = <0x5>; - - xbar_admaif5_ep: endpoint { - remote-endpoint = <&admaif5_ep>; - }; - }; - - port@6 { - reg = <0x6>; - - xbar_admaif6_ep: endpoint { - remote-endpoint = <&admaif6_ep>; - }; - }; - - port@7 { - reg = <0x7>; + i2s@2901000 { + status = "okay";
- xbar_admaif7_ep: endpoint { - remote-endpoint = <&admaif7_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@8 { - reg = <0x8>; + port@0 { + reg = <0>;
- xbar_admaif8_ep: endpoint { - remote-endpoint = <&admaif8_ep>; + i2s1_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s1_ep>; + }; }; - };
- port@9 { - reg = <0x9>; + i2s1_port: port@1 { + reg = <1>;
- xbar_admaif9_ep: endpoint { - remote-endpoint = <&admaif9_ep>; + i2s1_dap_ep: endpoint { + dai-format = "i2s"; + remote-endpoint = <&rt5658_ep>; + }; }; }; + };
- port@a { - reg = <0xa>; + i2s@2901100 { + status = "okay";
- xbar_admaif10_ep: endpoint { - remote-endpoint = <&admaif10_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@b { - reg = <0xb>; + port@0 { + reg = <0>;
- xbar_admaif11_ep: endpoint { - remote-endpoint = <&admaif11_ep>; + i2s2_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s2_ep>; + }; }; - };
- port@c { - reg = <0xc>; + i2s2_port: port@1 { + reg = <1>;
- xbar_admaif12_ep: endpoint { - remote-endpoint = <&admaif12_ep>; + i2s2_dap_ep: endpoint { + dai-format = "i2s"; + /* Place holder for external Codec */ + }; }; }; + };
- port@d { - reg = <0xd>; + i2s@2901300 { + status = "okay";
- xbar_admaif13_ep: endpoint { - remote-endpoint = <&admaif13_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@e { - reg = <0xe>; + port@0 { + reg = <0>;
- xbar_admaif14_ep: endpoint { - remote-endpoint = <&admaif14_ep>; + i2s4_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s4_ep>; + }; }; - };
- port@f { - reg = <0xf>; + i2s4_port: port@1 { + reg = <1>;
- xbar_admaif15_ep: endpoint { - remote-endpoint = <&admaif15_ep>; + i2s4_dap_ep: endpoint { + dai-format = "i2s"; + /* Place holder for external Codec */ + }; }; }; + };
- port@10 { - reg = <0x10>; + i2s@2901500 { + status = "okay";
- xbar_admaif16_ep: endpoint { - remote-endpoint = <&admaif16_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@11 { - reg = <0x11>; + port@0 { + reg = <0>;
- xbar_admaif17_ep: endpoint { - remote-endpoint = <&admaif17_ep>; + i2s6_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s6_ep>; + }; }; - };
- port@12 { - reg = <0x12>; + i2s6_port: port@1 { + reg = <1>;
- xbar_admaif18_ep: endpoint { - remote-endpoint = <&admaif18_ep>; + i2s6_dap_ep: endpoint { + dai-format = "i2s"; + /* Place holder for external Codec */ + }; }; }; + };
- port@13 { - reg = <0x13>; + sfc@2902000 { + status = "okay";
- xbar_admaif19_ep: endpoint { - remote-endpoint = <&admaif19_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_i2s1_port: port@14 { - reg = <0x14>; + port@0 { + reg = <0>;
- xbar_i2s1_ep: endpoint { - remote-endpoint = <&i2s1_cif_ep>; + sfc1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc1_in_ep>; + }; }; - };
- xbar_i2s2_port: port@15 { - reg = <0x15>; + sfc1_out_port: port@1 { + reg = <1>;
- xbar_i2s2_ep: endpoint { - remote-endpoint = <&i2s2_cif_ep>; + sfc1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc1_out_ep>; + }; }; }; + };
- xbar_i2s4_port: port@17 { - reg = <0x17>; + sfc@2902200 { + status = "okay";
- xbar_i2s4_ep: endpoint { - remote-endpoint = <&i2s4_cif_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_i2s6_port: port@19 { - reg = <0x19>; + port@0 { + reg = <0>;
- xbar_i2s6_ep: endpoint { - remote-endpoint = <&i2s6_cif_ep>; + sfc2_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc2_in_ep>; + }; }; - };
- xbar_dmic3_port: port@1c { - reg = <0x1c>; + sfc2_out_port: port@1 { + reg = <1>;
- xbar_dmic3_ep: endpoint { - remote-endpoint = <&dmic3_cif_ep>; + sfc2_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc2_out_ep>; + }; }; }; + };
- xbar_sfc1_in_port: port@20 { - reg = <0x20>; + sfc@2902400 { + status = "okay";
- xbar_sfc1_in_ep: endpoint { - remote-endpoint = <&sfc1_cif_in_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@21 { - reg = <0x21>; + port@0 { + reg = <0>;
- xbar_sfc1_out_ep: endpoint { - remote-endpoint = <&sfc1_cif_out_ep>; + sfc3_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc3_in_ep>; + }; }; - };
- xbar_sfc2_in_port: port@22 { - reg = <0x22>; + sfc3_out_port: port@1 { + reg = <1>;
- xbar_sfc2_in_ep: endpoint { - remote-endpoint = <&sfc2_cif_in_ep>; + sfc3_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc3_out_ep>; + }; }; }; + };
- port@23 { - reg = <0x23>; + sfc@2902600 { + status = "okay";
- xbar_sfc2_out_ep: endpoint { - remote-endpoint = <&sfc2_cif_out_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_sfc3_in_port: port@24 { - reg = <0x24>; + port@0 { + reg = <0>;
- xbar_sfc3_in_ep: endpoint { - remote-endpoint = <&sfc3_cif_in_ep>; + sfc4_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc4_in_ep>; + }; }; - };
- port@25 { - reg = <0x25>; + sfc4_out_port: port@1 { + reg = <1>;
- xbar_sfc3_out_ep: endpoint { - remote-endpoint = <&sfc3_cif_out_ep>; + sfc4_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc4_out_ep>; + }; }; }; + };
- xbar_sfc4_in_port: port@26 { - reg = <0x26>; + amx@2903000 { + status = "okay";
- xbar_sfc4_in_ep: endpoint { - remote-endpoint = <&sfc4_cif_in_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@27 { - reg = <0x27>; + port@0 { + reg = <0>;
- xbar_sfc4_out_ep: endpoint { - remote-endpoint = <&sfc4_cif_out_ep>; + amx1_in1_ep: endpoint { + remote-endpoint = <&xbar_amx1_in1_ep>; + }; }; - };
- xbar_mvc1_in_port: port@28 { - reg = <0x28>; + port@1 { + reg = <1>;
- xbar_mvc1_in_ep: endpoint { - remote-endpoint = <&mvc1_cif_in_ep>; + amx1_in2_ep: endpoint { + remote-endpoint = <&xbar_amx1_in2_ep>; + }; }; - };
- port@29 { - reg = <0x29>; + port@2 { + reg = <2>;
- xbar_mvc1_out_ep: endpoint { - remote-endpoint = <&mvc1_cif_out_ep>; + amx1_in3_ep: endpoint { + remote-endpoint = <&xbar_amx1_in3_ep>; + }; }; - };
- xbar_mvc2_in_port: port@2a { - reg = <0x2a>; + port@3 { + reg = <3>;
- xbar_mvc2_in_ep: endpoint { - remote-endpoint = <&mvc2_cif_in_ep>; + amx1_in4_ep: endpoint { + remote-endpoint = <&xbar_amx1_in4_ep>; + }; }; - };
- port@2b { - reg = <0x2b>; + amx1_out_port: port@4 { + reg = <4>;
- xbar_mvc2_out_ep: endpoint { - remote-endpoint = <&mvc2_cif_out_ep>; + amx1_out_ep: endpoint { + remote-endpoint = <&xbar_amx1_out_ep>; + }; }; }; + };
- xbar_amx1_in1_port: port@2c { - reg = <0x2c>; + amx@2903100 { + status = "okay";
- xbar_amx1_in1_ep: endpoint { - remote-endpoint = <&amx1_in1_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx1_in2_port: port@2d { - reg = <0x2d>; + port@0 { + reg = <0>;
- xbar_amx1_in2_ep: endpoint { - remote-endpoint = <&amx1_in2_ep>; + amx2_in1_ep: endpoint { + remote-endpoint = <&xbar_amx2_in1_ep>; + }; }; - };
- xbar_amx1_in3_port: port@2e { - reg = <0x2e>; + port@1 { + reg = <1>;
- xbar_amx1_in3_ep: endpoint { - remote-endpoint = <&amx1_in3_ep>; + amx2_in2_ep: endpoint { + remote-endpoint = <&xbar_amx2_in2_ep>; + }; }; - };
- xbar_amx1_in4_port: port@2f { - reg = <0x2f>; + amx2_in3_port: port@2 { + reg = <2>;
- xbar_amx1_in4_ep: endpoint { - remote-endpoint = <&amx1_in4_ep>; + amx2_in3_ep: endpoint { + remote-endpoint = <&xbar_amx2_in3_ep>; + }; }; - };
- port@30 { - reg = <0x30>; + amx2_in4_port: port@3 { + reg = <3>;
- xbar_amx1_out_ep: endpoint { - remote-endpoint = <&amx1_out_ep>; + amx2_in4_ep: endpoint { + remote-endpoint = <&xbar_amx2_in4_ep>; + }; }; - };
- xbar_amx2_in1_port: port@31 { - reg = <0x31>; + amx2_out_port: port@4 { + reg = <4>;
- xbar_amx2_in1_ep: endpoint { - remote-endpoint = <&amx2_in1_ep>; + amx2_out_ep: endpoint { + remote-endpoint = <&xbar_amx2_out_ep>; + }; }; }; + };
- xbar_amx2_in2_port: port@32 { - reg = <0x32>; + amx@2903200 { + status = "okay";
- xbar_amx2_in2_ep: endpoint { - remote-endpoint = <&amx2_in2_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx2_in3_port: port@33 { - reg = <0x33>; + port@0 { + reg = <0>;
- xbar_amx2_in3_ep: endpoint { - remote-endpoint = <&amx2_in3_ep>; + amx3_in1_ep: endpoint { + remote-endpoint = <&xbar_amx3_in1_ep>; + }; }; - };
- xbar_amx2_in4_port: port@34 { - reg = <0x34>; + port@1 { + reg = <1>;
- xbar_amx2_in4_ep: endpoint { - remote-endpoint = <&amx2_in4_ep>; + amx3_in2_ep: endpoint { + remote-endpoint = <&xbar_amx3_in2_ep>; + }; }; - };
- port@35 { - reg = <0x35>; + port@2 { + reg = <2>;
- xbar_amx2_out_ep: endpoint { - remote-endpoint = <&amx2_out_ep>; + amx3_in3_ep: endpoint { + remote-endpoint = <&xbar_amx3_in3_ep>; + }; }; - };
- xbar_amx3_in1_port: port@36 { - reg = <0x36>; + port@3 { + reg = <3>;
- xbar_amx3_in1_ep: endpoint { - remote-endpoint = <&amx3_in1_ep>; + amx3_in4_ep: endpoint { + remote-endpoint = <&xbar_amx3_in4_ep>; + }; }; - };
- xbar_amx3_in2_port: port@37 { - reg = <0x37>; + amx3_out_port: port@4 { + reg = <4>;
- xbar_amx3_in2_ep: endpoint { - remote-endpoint = <&amx3_in2_ep>; + amx3_out_ep: endpoint { + remote-endpoint = <&xbar_amx3_out_ep>; + }; }; }; + };
- xbar_amx3_in3_port: port@38 { - reg = <0x38>; + amx@2903300 { + status = "okay";
- xbar_amx3_in3_ep: endpoint { - remote-endpoint = <&amx3_in3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx3_in4_port: port@39 { - reg = <0x39>; + port@0 { + reg = <0>;
- xbar_amx3_in4_ep: endpoint { - remote-endpoint = <&amx3_in4_ep>; + amx4_in1_ep: endpoint { + remote-endpoint = <&xbar_amx4_in1_ep>; + }; }; - };
- port@3a { - reg = <0x3a>; + port@1 { + reg = <1>;
- xbar_amx3_out_ep: endpoint { - remote-endpoint = <&amx3_out_ep>; + amx4_in2_ep: endpoint { + remote-endpoint = <&xbar_amx4_in2_ep>; + }; }; - };
- xbar_amx4_in1_port: port@3b { - reg = <0x3b>; + port@2 { + reg = <2>;
- xbar_amx4_in1_ep: endpoint { - remote-endpoint = <&amx4_in1_ep>; + amx4_in3_ep: endpoint { + remote-endpoint = <&xbar_amx4_in3_ep>; + }; }; - };
- xbar_amx4_in2_port: port@3c { - reg = <0x3c>; + port@3 { + reg = <3>;
- xbar_amx4_in2_ep: endpoint { - remote-endpoint = <&amx4_in2_ep>; + amx4_in4_ep: endpoint { + remote-endpoint = <&xbar_amx4_in4_ep>; + }; }; - };
- xbar_amx4_in3_port: port@3d { - reg = <0x3d>; + amx4_out_port: port@4 { + reg = <4>;
- xbar_amx4_in3_ep: endpoint { - remote-endpoint = <&amx4_in3_ep>; + amx4_out_ep: endpoint { + remote-endpoint = <&xbar_amx4_out_ep>; + }; }; }; + };
- xbar_amx4_in4_port: port@3e { - reg = <0x3e>; + adx@2903800 { + status = "okay";
- xbar_amx4_in4_ep: endpoint { - remote-endpoint = <&amx4_in4_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@3f { - reg = <0x3f>; + port@0 { + reg = <0>;
- xbar_amx4_out_ep: endpoint { - remote-endpoint = <&amx4_out_ep>; + adx1_in_ep: endpoint { + remote-endpoint = <&xbar_adx1_in_ep>; + }; }; - };
- xbar_adx1_in_port: port@40 { - reg = <0x40>; + adx1_out1_port: port@1 { + reg = <1>;
- xbar_adx1_in_ep: endpoint { - remote-endpoint = <&adx1_in_ep>; + adx1_out1_ep: endpoint { + remote-endpoint = <&xbar_adx1_out1_ep>; + }; }; - };
- port@41 { - reg = <0x41>; + adx1_out2_port: port@2 { + reg = <2>;
- xbar_adx1_out1_ep: endpoint { - remote-endpoint = <&adx1_out1_ep>; + adx1_out2_ep: endpoint { + remote-endpoint = <&xbar_adx1_out2_ep>; + }; }; - };
- port@42 { - reg = <0x42>; + adx1_out3_port: port@3 { + reg = <3>;
- xbar_adx1_out2_ep: endpoint { - remote-endpoint = <&adx1_out2_ep>; + adx1_out3_ep: endpoint { + remote-endpoint = <&xbar_adx1_out3_ep>; + }; }; - };
- port@43 { - reg = <0x43>; + adx1_out4_port: port@4 { + reg = <4>;
- xbar_adx1_out3_ep: endpoint { - remote-endpoint = <&adx1_out3_ep>; + adx1_out4_ep: endpoint { + remote-endpoint = <&xbar_adx1_out4_ep>; + }; }; }; + };
- port@44 { - reg = <0x44>; + adx@2903900 { + status = "okay";
- xbar_adx1_out4_ep: endpoint { - remote-endpoint = <&adx1_out4_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_adx2_in_port: port@45 { - reg = <0x45>; + port@0 { + reg = <0>;
- xbar_adx2_in_ep: endpoint { - remote-endpoint = <&adx2_in_ep>; + adx2_in_ep: endpoint { + remote-endpoint = <&xbar_adx2_in_ep>; + }; }; - };
- port@46 { - reg = <0x46>; + adx2_out1_port: port@1 { + reg = <1>;
- xbar_adx2_out1_ep: endpoint { - remote-endpoint = <&adx2_out1_ep>; + adx2_out1_ep: endpoint { + remote-endpoint = <&xbar_adx2_out1_ep>; + }; }; - };
- port@47 { - reg = <0x47>; + adx2_out2_port: port@2 { + reg = <2>;
- xbar_adx2_out2_ep: endpoint { - remote-endpoint = <&adx2_out2_ep>; + adx2_out2_ep: endpoint { + remote-endpoint = <&xbar_adx2_out2_ep>; + }; }; - };
- port@48 { - reg = <0x48>; + adx2_out3_port: port@3 { + reg = <3>;
- xbar_adx2_out3_ep: endpoint { - remote-endpoint = <&adx2_out3_ep>; + adx2_out3_ep: endpoint { + remote-endpoint = <&xbar_adx2_out3_ep>; + }; }; - };
- port@49 { - reg = <0x49>; + adx2_out4_port: port@4 { + reg = <4>;
- xbar_adx2_out4_ep: endpoint { - remote-endpoint = <&adx2_out4_ep>; + adx2_out4_ep: endpoint { + remote-endpoint = <&xbar_adx2_out4_ep>; + }; }; }; + };
- xbar_adx3_in_port: port@4a { - reg = <0x4a>; + adx@2903a00 { + status = "okay";
- xbar_adx3_in_ep: endpoint { - remote-endpoint = <&adx3_in_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@4b { - reg = <0x4b>; + port@0 { + reg = <0>;
- xbar_adx3_out1_ep: endpoint { - remote-endpoint = <&adx3_out1_ep>; + adx3_in_ep: endpoint { + remote-endpoint = <&xbar_adx3_in_ep>; + }; }; - };
- port@4c { - reg = <0x4c>; + adx3_out1_port: port@1 { + reg = <1>;
- xbar_adx3_out2_ep: endpoint { - remote-endpoint = <&adx3_out2_ep>; + adx3_out1_ep: endpoint { + remote-endpoint = <&xbar_adx3_out1_ep>; + }; }; - };
- port@4d { - reg = <0x4d>; + adx3_out2_port: port@2 { + reg = <2>;
- xbar_adx3_out3_ep: endpoint { - remote-endpoint = <&adx3_out3_ep>; + adx3_out2_ep: endpoint { + remote-endpoint = <&xbar_adx3_out2_ep>; + }; }; - };
- port@4e { - reg = <0x4e>; + adx3_out3_port: port@3 { + reg = <3>;
- xbar_adx3_out4_ep: endpoint { - remote-endpoint = <&adx3_out4_ep>; + adx3_out3_ep: endpoint { + remote-endpoint = <&xbar_adx3_out3_ep>; + }; }; - };
- xbar_adx4_in_port: port@4f { - reg = <0x4f>; + adx3_out4_port: port@4 { + reg = <4>;
- xbar_adx4_in_ep: endpoint { - remote-endpoint = <&adx4_in_ep>; + adx3_out4_ep: endpoint { + remote-endpoint = <&xbar_adx3_out4_ep>; + }; }; }; + };
- port@50 { - reg = <0x50>; + adx@2903b00 { + status = "okay";
- xbar_adx4_out1_ep: endpoint { - remote-endpoint = <&adx4_out1_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@51 { - reg = <0x51>; + port@0 { + reg = <0>;
- xbar_adx4_out2_ep: endpoint { - remote-endpoint = <&adx4_out2_ep>; + adx4_in_ep: endpoint { + remote-endpoint = <&xbar_adx4_in_ep>; + }; }; - };
- port@52 { - reg = <0x52>; + adx4_out1_port: port@1 { + reg = <1>;
- xbar_adx4_out3_ep: endpoint { - remote-endpoint = <&adx4_out3_ep>; + adx4_out1_ep: endpoint { + remote-endpoint = <&xbar_adx4_out1_ep>; + }; }; - };
- port@53 { - reg = <0x53>; + adx4_out2_port: port@2 { + reg = <2>;
- xbar_adx4_out4_ep: endpoint { - remote-endpoint = <&adx4_out4_ep>; + adx4_out2_ep: endpoint { + remote-endpoint = <&xbar_adx4_out2_ep>; + }; }; - };
- xbar_mixer_in1_port: port@54 { - reg = <0x54>; + adx4_out3_port: port@3 { + reg = <3>;
- xbar_mixer_in1_ep: endpoint { - remote-endpoint = <&mixer_in1_ep>; + adx4_out3_ep: endpoint { + remote-endpoint = <&xbar_adx4_out3_ep>; + }; }; - };
- xbar_mixer_in2_port: port@55 { - reg = <0x55>; + adx4_out4_port: port@4 { + reg = <4>;
- xbar_mixer_in2_ep: endpoint { - remote-endpoint = <&mixer_in2_ep>; + adx4_out4_ep: endpoint { + remote-endpoint = <&xbar_adx4_out4_ep>; + }; }; }; + };
- xbar_mixer_in3_port: port@56 { - reg = <0x56>; + dmic@2904200 { + status = "okay";
- xbar_mixer_in3_ep: endpoint { - remote-endpoint = <&mixer_in3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in4_port: port@57 { - reg = <0x57>; + port@0 { + reg = <0>;
- xbar_mixer_in4_ep: endpoint { - remote-endpoint = <&mixer_in4_ep>; + dmic3_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic3_ep>; + }; }; - };
- xbar_mixer_in5_port: port@58 { - reg = <0x58>; + dmic3_port: port@1 { + reg = <1>;
- xbar_mixer_in5_ep: endpoint { - remote-endpoint = <&mixer_in5_ep>; + dmic3_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- xbar_mixer_in6_port: port@59 { - reg = <0x59>; + processing-engine@2908000 { + status = "okay";
- xbar_mixer_in6_ep: endpoint { - remote-endpoint = <&mixer_in6_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in7_port: port@5a { - reg = <0x5a>; + port@0 { + reg = <0x0>;
- xbar_mixer_in7_ep: endpoint { - remote-endpoint = <&mixer_in7_ep>; + ope1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_ope1_in_ep>; + }; }; - };
- xbar_mixer_in8_port: port@5b { - reg = <0x5b>; + ope1_out_port: port@1 { + reg = <0x1>;
- xbar_mixer_in8_ep: endpoint { - remote-endpoint = <&mixer_in8_ep>; + ope1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_ope1_out_ep>; + }; }; }; + };
- xbar_mixer_in9_port: port@5c { - reg = <0x5c>; + mvc@290a000 { + status = "okay";
- xbar_mixer_in9_ep: endpoint { - remote-endpoint = <&mixer_in9_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in10_port: port@5d { - reg = <0x5d>; + port@0 { + reg = <0>;
- xbar_mixer_in10_ep: endpoint { - remote-endpoint = <&mixer_in10_ep>; + mvc1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc1_in_ep>; + }; }; - };
- port@5e { - reg = <0x5e>; + mvc1_out_port: port@1 { + reg = <1>;
- xbar_mixer_out1_ep: endpoint { - remote-endpoint = <&mixer_out1_ep>; + mvc1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc1_out_ep>; + }; }; }; + };
- port@5f { - reg = <0x5f>; + mvc@290a200 { + status = "okay";
- xbar_mixer_out2_ep: endpoint { - remote-endpoint = <&mixer_out2_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@60 { - reg = <0x60>; + port@0 { + reg = <0>;
- xbar_mixer_out3_ep: endpoint { - remote-endpoint = <&mixer_out3_ep>; + mvc2_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc2_in_ep>; + }; }; - };
- port@61 { - reg = <0x61>; + mvc2_out_port: port@1 { + reg = <1>;
- xbar_mixer_out4_ep: endpoint { - remote-endpoint = <&mixer_out4_ep>; + mvc2_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc2_out_ep>; + }; }; }; + };
- port@62 { - reg = <0x62>; + amixer@290bb00 { + status = "okay";
- xbar_mixer_out5_ep: endpoint { - remote-endpoint = <&mixer_out5_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_asrc_in1_port: port@63 { - reg = <0x63>; + port@0 { + reg = <0x0>;
- xbar_asrc_in1_ep: endpoint { - remote-endpoint = <&asrc_in1_ep>; + mixer_in1_ep: endpoint { + remote-endpoint = <&xbar_mixer_in1_ep>; + }; }; - };
- port@64 { - reg = <0x64>; + port@1 { + reg = <0x1>;
- xbar_asrc_out1_ep: endpoint { - remote-endpoint = <&asrc_out1_ep>; + mixer_in2_ep: endpoint { + remote-endpoint = <&xbar_mixer_in2_ep>; + }; }; - };
- xbar_asrc_in2_port: port@65 { - reg = <0x65>; + port@2 { + reg = <0x2>;
- xbar_asrc_in2_ep: endpoint { - remote-endpoint = <&asrc_in2_ep>; + mixer_in3_ep: endpoint { + remote-endpoint = <&xbar_mixer_in3_ep>; + }; }; - };
- port@66 { - reg = <0x66>; + port@3 { + reg = <0x3>;
- xbar_asrc_out2_ep: endpoint { - remote-endpoint = <&asrc_out2_ep>; + mixer_in4_ep: endpoint { + remote-endpoint = <&xbar_mixer_in4_ep>; + }; }; - };
- xbar_asrc_in3_port: port@67 { - reg = <0x67>; + port@4 { + reg = <0x4>;
- xbar_asrc_in3_ep: endpoint { - remote-endpoint = <&asrc_in3_ep>; + mixer_in5_ep: endpoint { + remote-endpoint = <&xbar_mixer_in5_ep>; + }; }; - };
- port@68 { - reg = <0x68>; + port@5 { + reg = <0x5>;
- xbar_asrc_out3_ep: endpoint { - remote-endpoint = <&asrc_out3_ep>; + mixer_in6_ep: endpoint { + remote-endpoint = <&xbar_mixer_in6_ep>; + }; }; - };
- xbar_asrc_in4_port: port@69 { - reg = <0x69>; + port@6 { + reg = <0x6>;
- xbar_asrc_in4_ep: endpoint { - remote-endpoint = <&asrc_in4_ep>; + mixer_in7_ep: endpoint { + remote-endpoint = <&xbar_mixer_in7_ep>; + }; }; - };
- port@6a { - reg = <0x6a>; + port@7 { + reg = <0x7>;
- xbar_asrc_out4_ep: endpoint { - remote-endpoint = <&asrc_out4_ep>; + mixer_in8_ep: endpoint { + remote-endpoint = <&xbar_mixer_in8_ep>; + }; }; - };
- xbar_asrc_in5_port: port@6b { - reg = <0x6b>; + port@8 { + reg = <0x8>;
- xbar_asrc_in5_ep: endpoint { - remote-endpoint = <&asrc_in5_ep>; + mixer_in9_ep: endpoint { + remote-endpoint = <&xbar_mixer_in9_ep>; + }; }; - };
- port@6c { - reg = <0x6c>; + port@9 { + reg = <0x9>;
- xbar_asrc_out5_ep: endpoint { - remote-endpoint = <&asrc_out5_ep>; + mixer_in10_ep: endpoint { + remote-endpoint = <&xbar_mixer_in10_ep>; + }; }; - };
- xbar_asrc_in6_port: port@6d { - reg = <0x6d>; + mixer_out1_port: port@a { + reg = <0xa>;
- xbar_asrc_in6_ep: endpoint { - remote-endpoint = <&asrc_in6_ep>; + mixer_out1_ep: endpoint { + remote-endpoint = <&xbar_mixer_out1_ep>; + }; }; - };
- port@6e { - reg = <0x6e>; + mixer_out2_port: port@b { + reg = <0xb>;
- xbar_asrc_out6_ep: endpoint { - remote-endpoint = <&asrc_out6_ep>; + mixer_out2_ep: endpoint { + remote-endpoint = <&xbar_mixer_out2_ep>; + }; }; - };
- xbar_asrc_in7_port: port@6f { - reg = <0x6f>; + mixer_out3_port: port@c { + reg = <0xc>;
- xbar_asrc_in7_ep: endpoint { - remote-endpoint = <&asrc_in7_ep>; + mixer_out3_ep: endpoint { + remote-endpoint = <&xbar_mixer_out3_ep>; + }; }; - };
- xbar_ope1_in_port: port@70 { - reg = <0x70>; + mixer_out4_port: port@d { + reg = <0xd>;
- xbar_ope1_in_ep: endpoint { - remote-endpoint = <&ope1_cif_in_ep>; + mixer_out4_ep: endpoint { + remote-endpoint = <&xbar_mixer_out4_ep>; + }; }; - };
- port@71 { - reg = <0x71>; + mixer_out5_port: port@e { + reg = <0xe>;
- xbar_ope1_out_ep: endpoint { - remote-endpoint = <&ope1_cif_out_ep>; + mixer_out5_ep: endpoint { + remote-endpoint = <&xbar_mixer_out5_ep>; + }; }; }; }; @@ -1055,7 +1011,7 @@ admaif19_ep: endpoint { }; };
- i2s@2901000 { + asrc@2910000 { status = "okay";
ports { @@ -1063,936 +1019,980 @@ ports { #size-cells = <0>;
port@0 { - reg = <0>; + reg = <0x0>;
- i2s1_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s1_ep>; + asrc_in1_ep: endpoint { + remote-endpoint = <&xbar_asrc_in1_ep>; }; };
- i2s1_port: port@1 { - reg = <1>; + port@1 { + reg = <0x1>;
- i2s1_dap_ep: endpoint { - dai-format = "i2s"; - remote-endpoint = <&rt5658_ep>; + asrc_in2_ep: endpoint { + remote-endpoint = <&xbar_asrc_in2_ep>; }; }; - }; - };
- i2s@2901100 { - status = "okay"; + port@2 { + reg = <0x2>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_in3_ep: endpoint { + remote-endpoint = <&xbar_asrc_in3_ep>; + }; + };
- port@0 { - reg = <0>; + port@3 { + reg = <0x3>;
- i2s2_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s2_ep>; + asrc_in4_ep: endpoint { + remote-endpoint = <&xbar_asrc_in4_ep>; }; };
- i2s2_port: port@1 { - reg = <1>; + port@4 { + reg = <0x4>;
- i2s2_dap_ep: endpoint { - dai-format = "i2s"; - /* Place holder for external Codec */ + asrc_in5_ep: endpoint { + remote-endpoint = <&xbar_asrc_in5_ep>; }; }; - }; - };
- i2s@2901300 { - status = "okay"; + port@5 { + reg = <0x5>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_in6_ep: endpoint { + remote-endpoint = <&xbar_asrc_in6_ep>; + }; + };
- port@0 { - reg = <0>; + port@6 { + reg = <0x6>;
- i2s4_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s4_ep>; + asrc_in7_ep: endpoint { + remote-endpoint = <&xbar_asrc_in7_ep>; }; };
- i2s4_port: port@1 { - reg = <1>; + asrc_out1_port: port@7 { + reg = <0x7>;
- i2s4_dap_ep: endpoint { - dai-format = "i2s"; - /* Place holder for external Codec */ + asrc_out1_ep: endpoint { + remote-endpoint = <&xbar_asrc_out1_ep>; }; }; - }; - };
- i2s@2901500 { - status = "okay"; + asrc_out2_port: port@8 { + reg = <0x8>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_out2_ep: endpoint { + remote-endpoint = <&xbar_asrc_out2_ep>; + }; + };
- port@0 { - reg = <0>; + asrc_out3_port: port@9 { + reg = <0x9>;
- i2s6_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s6_ep>; + asrc_out3_ep: endpoint { + remote-endpoint = <&xbar_asrc_out3_ep>; }; };
- i2s6_port: port@1 { - reg = <1>; + asrc_out4_port: port@a { + reg = <0xa>;
- i2s6_dap_ep: endpoint { - dai-format = "i2s"; - /* Place holder for external Codec */ + asrc_out4_ep: endpoint { + remote-endpoint = <&xbar_asrc_out4_ep>; + }; + }; + + asrc_out5_port: port@b { + reg = <0xb>; + + asrc_out5_ep: endpoint { + remote-endpoint = <&xbar_asrc_out5_ep>; + }; + }; + + asrc_out6_port: port@c { + reg = <0xc>; + + asrc_out6_ep: endpoint { + remote-endpoint = <&xbar_asrc_out6_ep>; }; }; }; };
- dmic@2904200 { - status = "okay"; + ports { + #address-cells = <1>; + #size-cells = <0>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + port@0 { + reg = <0x0>;
- port@0 { - reg = <0>; + xbar_admaif0_ep: endpoint { + remote-endpoint = <&admaif0_ep>; + }; + };
- dmic3_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic3_ep>; - }; + port@1 { + reg = <0x1>; + + xbar_admaif1_ep: endpoint { + remote-endpoint = <&admaif1_ep>; }; + };
- dmic3_port: port@1 { - reg = <1>; + port@2 { + reg = <0x2>;
- dmic3_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif2_ep: endpoint { + remote-endpoint = <&admaif2_ep>; }; }; - };
- sfc@2902000 { - status = "okay"; + port@3 { + reg = <0x3>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif3_ep: endpoint { + remote-endpoint = <&admaif3_ep>; + }; + };
- port@0 { - reg = <0>; + port@4 { + reg = <0x4>; + + xbar_admaif4_ep: endpoint { + remote-endpoint = <&admaif4_ep>; + }; + }; + + port@5 { + reg = <0x5>; + + xbar_admaif5_ep: endpoint { + remote-endpoint = <&admaif5_ep>; + }; + }; + + port@6 { + reg = <0x6>; + + xbar_admaif6_ep: endpoint { + remote-endpoint = <&admaif6_ep>; + }; + }; + + port@7 { + reg = <0x7>; + + xbar_admaif7_ep: endpoint { + remote-endpoint = <&admaif7_ep>; + }; + }; + + port@8 { + reg = <0x8>;
- sfc1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc1_in_ep>; - }; + xbar_admaif8_ep: endpoint { + remote-endpoint = <&admaif8_ep>; }; + };
- sfc1_out_port: port@1 { - reg = <1>; + port@9 { + reg = <0x9>;
- sfc1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc1_out_ep>; - }; + xbar_admaif9_ep: endpoint { + remote-endpoint = <&admaif9_ep>; }; }; - };
- sfc@2902200 { - status = "okay"; + port@a { + reg = <0xa>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif10_ep: endpoint { + remote-endpoint = <&admaif10_ep>; + }; + };
- port@0 { - reg = <0>; + port@b { + reg = <0xb>;
- sfc2_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc2_in_ep>; - }; + xbar_admaif11_ep: endpoint { + remote-endpoint = <&admaif11_ep>; }; + };
- sfc2_out_port: port@1 { - reg = <1>; + port@c { + reg = <0xc>;
- sfc2_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc2_out_ep>; - }; + xbar_admaif12_ep: endpoint { + remote-endpoint = <&admaif12_ep>; }; }; - };
- sfc@2902400 { - status = "okay"; + port@d { + reg = <0xd>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif13_ep: endpoint { + remote-endpoint = <&admaif13_ep>; + }; + };
- port@0 { - reg = <0>; + port@e { + reg = <0xe>;
- sfc3_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc3_in_ep>; - }; + xbar_admaif14_ep: endpoint { + remote-endpoint = <&admaif14_ep>; }; + };
- sfc3_out_port: port@1 { - reg = <1>; + port@f { + reg = <0xf>;
- sfc3_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc3_out_ep>; - }; + xbar_admaif15_ep: endpoint { + remote-endpoint = <&admaif15_ep>; }; }; - };
- sfc@2902600 { - status = "okay"; + port@10 { + reg = <0x10>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif16_ep: endpoint { + remote-endpoint = <&admaif16_ep>; + }; + };
- port@0 { - reg = <0>; + port@11 { + reg = <0x11>;
- sfc4_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc4_in_ep>; - }; + xbar_admaif17_ep: endpoint { + remote-endpoint = <&admaif17_ep>; }; + };
- sfc4_out_port: port@1 { - reg = <1>; + port@12 { + reg = <0x12>;
- sfc4_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc4_out_ep>; - }; + xbar_admaif18_ep: endpoint { + remote-endpoint = <&admaif18_ep>; }; }; - };
- mvc@290a000 { - status = "okay"; + port@13 { + reg = <0x13>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif19_ep: endpoint { + remote-endpoint = <&admaif19_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_i2s1_port: port@14 { + reg = <0x14>;
- mvc1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc1_in_ep>; - }; + xbar_i2s1_ep: endpoint { + remote-endpoint = <&i2s1_cif_ep>; }; + };
- mvc1_out_port: port@1 { - reg = <1>; + xbar_i2s2_port: port@15 { + reg = <0x15>;
- mvc1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc1_out_ep>; - }; + xbar_i2s2_ep: endpoint { + remote-endpoint = <&i2s2_cif_ep>; }; }; - };
- mvc@290a200 { - status = "okay"; + xbar_i2s4_port: port@17 { + reg = <0x17>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_i2s4_ep: endpoint { + remote-endpoint = <&i2s4_cif_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_i2s6_port: port@19 { + reg = <0x19>;
- mvc2_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc2_in_ep>; - }; + xbar_i2s6_ep: endpoint { + remote-endpoint = <&i2s6_cif_ep>; }; + };
- mvc2_out_port: port@1 { - reg = <1>; + xbar_dmic3_port: port@1c { + reg = <0x1c>;
- mvc2_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc2_out_ep>; - }; + xbar_dmic3_ep: endpoint { + remote-endpoint = <&dmic3_cif_ep>; }; }; - };
- amx@2903000 { - status = "okay"; + xbar_sfc1_in_port: port@20 { + reg = <0x20>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_sfc1_in_ep: endpoint { + remote-endpoint = <&sfc1_cif_in_ep>; + }; + };
- port@0 { - reg = <0>; + port@21 { + reg = <0x21>;
- amx1_in1_ep: endpoint { - remote-endpoint = <&xbar_amx1_in1_ep>; - }; + xbar_sfc1_out_ep: endpoint { + remote-endpoint = <&sfc1_cif_out_ep>; }; + };
- port@1 { - reg = <1>; + xbar_sfc2_in_port: port@22 { + reg = <0x22>;
- amx1_in2_ep: endpoint { - remote-endpoint = <&xbar_amx1_in2_ep>; - }; + xbar_sfc2_in_ep: endpoint { + remote-endpoint = <&sfc2_cif_in_ep>; }; + };
- port@2 { - reg = <2>; + port@23 { + reg = <0x23>;
- amx1_in3_ep: endpoint { - remote-endpoint = <&xbar_amx1_in3_ep>; - }; + xbar_sfc2_out_ep: endpoint { + remote-endpoint = <&sfc2_cif_out_ep>; }; + };
- port@3 { - reg = <3>; + xbar_sfc3_in_port: port@24 { + reg = <0x24>;
- amx1_in4_ep: endpoint { - remote-endpoint = <&xbar_amx1_in4_ep>; - }; + xbar_sfc3_in_ep: endpoint { + remote-endpoint = <&sfc3_cif_in_ep>; }; + };
- amx1_out_port: port@4 { - reg = <4>; + port@25 { + reg = <0x25>;
- amx1_out_ep: endpoint { - remote-endpoint = <&xbar_amx1_out_ep>; - }; + xbar_sfc3_out_ep: endpoint { + remote-endpoint = <&sfc3_cif_out_ep>; }; }; - };
- amx@2903100 { - status = "okay"; + xbar_sfc4_in_port: port@26 { + reg = <0x26>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_sfc4_in_ep: endpoint { + remote-endpoint = <&sfc4_cif_in_ep>; + }; + };
- port@0 { - reg = <0>; + port@27 { + reg = <0x27>;
- amx2_in1_ep: endpoint { - remote-endpoint = <&xbar_amx2_in1_ep>; - }; + xbar_sfc4_out_ep: endpoint { + remote-endpoint = <&sfc4_cif_out_ep>; + }; + }; + + xbar_mvc1_in_port: port@28 { + reg = <0x28>; + + xbar_mvc1_in_ep: endpoint { + remote-endpoint = <&mvc1_cif_in_ep>; }; + };
- port@1 { - reg = <1>; + port@29 { + reg = <0x29>;
- amx2_in2_ep: endpoint { - remote-endpoint = <&xbar_amx2_in2_ep>; - }; + xbar_mvc1_out_ep: endpoint { + remote-endpoint = <&mvc1_cif_out_ep>; }; + };
- amx2_in3_port: port@2 { - reg = <2>; + xbar_mvc2_in_port: port@2a { + reg = <0x2a>;
- amx2_in3_ep: endpoint { - remote-endpoint = <&xbar_amx2_in3_ep>; - }; + xbar_mvc2_in_ep: endpoint { + remote-endpoint = <&mvc2_cif_in_ep>; }; + };
- amx2_in4_port: port@3 { - reg = <3>; + port@2b { + reg = <0x2b>;
- amx2_in4_ep: endpoint { - remote-endpoint = <&xbar_amx2_in4_ep>; - }; + xbar_mvc2_out_ep: endpoint { + remote-endpoint = <&mvc2_cif_out_ep>; }; + };
- amx2_out_port: port@4 { - reg = <4>; + xbar_amx1_in1_port: port@2c { + reg = <0x2c>;
- amx2_out_ep: endpoint { - remote-endpoint = <&xbar_amx2_out_ep>; - }; + xbar_amx1_in1_ep: endpoint { + remote-endpoint = <&amx1_in1_ep>; }; }; - };
- amx@2903200 { - status = "okay"; + xbar_amx1_in2_port: port@2d { + reg = <0x2d>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx1_in2_ep: endpoint { + remote-endpoint = <&amx1_in2_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_amx1_in3_port: port@2e { + reg = <0x2e>;
- amx3_in1_ep: endpoint { - remote-endpoint = <&xbar_amx3_in1_ep>; - }; + xbar_amx1_in3_ep: endpoint { + remote-endpoint = <&amx1_in3_ep>; }; + };
- port@1 { - reg = <1>; + xbar_amx1_in4_port: port@2f { + reg = <0x2f>;
- amx3_in2_ep: endpoint { - remote-endpoint = <&xbar_amx3_in2_ep>; - }; + xbar_amx1_in4_ep: endpoint { + remote-endpoint = <&amx1_in4_ep>; }; + };
- port@2 { - reg = <2>; + port@30 { + reg = <0x30>;
- amx3_in3_ep: endpoint { - remote-endpoint = <&xbar_amx3_in3_ep>; - }; + xbar_amx1_out_ep: endpoint { + remote-endpoint = <&amx1_out_ep>; }; + };
- port@3 { - reg = <3>; + xbar_amx2_in1_port: port@31 { + reg = <0x31>;
- amx3_in4_ep: endpoint { - remote-endpoint = <&xbar_amx3_in4_ep>; - }; + xbar_amx2_in1_ep: endpoint { + remote-endpoint = <&amx2_in1_ep>; }; + };
- amx3_out_port: port@4 { - reg = <4>; + xbar_amx2_in2_port: port@32 { + reg = <0x32>;
- amx3_out_ep: endpoint { - remote-endpoint = <&xbar_amx3_out_ep>; - }; + xbar_amx2_in2_ep: endpoint { + remote-endpoint = <&amx2_in2_ep>; }; }; - };
- amx@2903300 { - status = "okay"; + xbar_amx2_in3_port: port@33 { + reg = <0x33>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx2_in3_ep: endpoint { + remote-endpoint = <&amx2_in3_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_amx2_in4_port: port@34 { + reg = <0x34>;
- amx4_in1_ep: endpoint { - remote-endpoint = <&xbar_amx4_in1_ep>; - }; + xbar_amx2_in4_ep: endpoint { + remote-endpoint = <&amx2_in4_ep>; }; + };
- port@1 { - reg = <1>; + port@35 { + reg = <0x35>;
- amx4_in2_ep: endpoint { - remote-endpoint = <&xbar_amx4_in2_ep>; - }; + xbar_amx2_out_ep: endpoint { + remote-endpoint = <&amx2_out_ep>; }; + };
- port@2 { - reg = <2>; + xbar_amx3_in1_port: port@36 { + reg = <0x36>;
- amx4_in3_ep: endpoint { - remote-endpoint = <&xbar_amx4_in3_ep>; - }; + xbar_amx3_in1_ep: endpoint { + remote-endpoint = <&amx3_in1_ep>; }; + };
- port@3 { - reg = <3>; + xbar_amx3_in2_port: port@37 { + reg = <0x37>;
- amx4_in4_ep: endpoint { - remote-endpoint = <&xbar_amx4_in4_ep>; - }; + xbar_amx3_in2_ep: endpoint { + remote-endpoint = <&amx3_in2_ep>; }; + };
- amx4_out_port: port@4 { - reg = <4>; + xbar_amx3_in3_port: port@38 { + reg = <0x38>;
- amx4_out_ep: endpoint { - remote-endpoint = <&xbar_amx4_out_ep>; - }; + xbar_amx3_in3_ep: endpoint { + remote-endpoint = <&amx3_in3_ep>; }; }; - };
- adx@2903800 { - status = "okay"; + xbar_amx3_in4_port: port@39 { + reg = <0x39>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx3_in4_ep: endpoint { + remote-endpoint = <&amx3_in4_ep>; + }; + };
- port@0 { - reg = <0>; + port@3a { + reg = <0x3a>;
- adx1_in_ep: endpoint { - remote-endpoint = <&xbar_adx1_in_ep>; - }; + xbar_amx3_out_ep: endpoint { + remote-endpoint = <&amx3_out_ep>; }; + };
- adx1_out1_port: port@1 { - reg = <1>; + xbar_amx4_in1_port: port@3b { + reg = <0x3b>;
- adx1_out1_ep: endpoint { - remote-endpoint = <&xbar_adx1_out1_ep>; - }; + xbar_amx4_in1_ep: endpoint { + remote-endpoint = <&amx4_in1_ep>; }; + };
- adx1_out2_port: port@2 { - reg = <2>; + xbar_amx4_in2_port: port@3c { + reg = <0x3c>;
- adx1_out2_ep: endpoint { - remote-endpoint = <&xbar_adx1_out2_ep>; - }; + xbar_amx4_in2_ep: endpoint { + remote-endpoint = <&amx4_in2_ep>; }; + };
- adx1_out3_port: port@3 { - reg = <3>; + xbar_amx4_in3_port: port@3d { + reg = <0x3d>;
- adx1_out3_ep: endpoint { - remote-endpoint = <&xbar_adx1_out3_ep>; - }; + xbar_amx4_in3_ep: endpoint { + remote-endpoint = <&amx4_in3_ep>; }; + };
- adx1_out4_port: port@4 { - reg = <4>; + xbar_amx4_in4_port: port@3e { + reg = <0x3e>;
- adx1_out4_ep: endpoint { - remote-endpoint = <&xbar_adx1_out4_ep>; - }; + xbar_amx4_in4_ep: endpoint { + remote-endpoint = <&amx4_in4_ep>; }; }; - };
- adx@2903900 { - status = "okay"; + port@3f { + reg = <0x3f>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx4_out_ep: endpoint { + remote-endpoint = <&amx4_out_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_adx1_in_port: port@40 { + reg = <0x40>;
- adx2_in_ep: endpoint { - remote-endpoint = <&xbar_adx2_in_ep>; - }; + xbar_adx1_in_ep: endpoint { + remote-endpoint = <&adx1_in_ep>; }; + };
- adx2_out1_port: port@1 { - reg = <1>; - - adx2_out1_ep: endpoint { - remote-endpoint = <&xbar_adx2_out1_ep>; - }; + port@41 { + reg = <0x41>; + + xbar_adx1_out1_ep: endpoint { + remote-endpoint = <&adx1_out1_ep>; }; + };
- adx2_out2_port: port@2 { - reg = <2>; + port@42 { + reg = <0x42>;
- adx2_out2_ep: endpoint { - remote-endpoint = <&xbar_adx2_out2_ep>; - }; + xbar_adx1_out2_ep: endpoint { + remote-endpoint = <&adx1_out2_ep>; }; + };
- adx2_out3_port: port@3 { - reg = <3>; + port@43 { + reg = <0x43>;
- adx2_out3_ep: endpoint { - remote-endpoint = <&xbar_adx2_out3_ep>; - }; + xbar_adx1_out3_ep: endpoint { + remote-endpoint = <&adx1_out3_ep>; }; + };
- adx2_out4_port: port@4 { - reg = <4>; + port@44 { + reg = <0x44>;
- adx2_out4_ep: endpoint { - remote-endpoint = <&xbar_adx2_out4_ep>; - }; + xbar_adx1_out4_ep: endpoint { + remote-endpoint = <&adx1_out4_ep>; }; }; - };
- adx@2903a00 { - status = "okay"; + xbar_adx2_in_port: port@45 { + reg = <0x45>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx2_in_ep: endpoint { + remote-endpoint = <&adx2_in_ep>; + }; + };
- port@0 { - reg = <0>; + port@46 { + reg = <0x46>;
- adx3_in_ep: endpoint { - remote-endpoint = <&xbar_adx3_in_ep>; - }; + xbar_adx2_out1_ep: endpoint { + remote-endpoint = <&adx2_out1_ep>; }; + };
- adx3_out1_port: port@1 { - reg = <1>; + port@47 { + reg = <0x47>;
- adx3_out1_ep: endpoint { - remote-endpoint = <&xbar_adx3_out1_ep>; - }; + xbar_adx2_out2_ep: endpoint { + remote-endpoint = <&adx2_out2_ep>; }; + };
- adx3_out2_port: port@2 { - reg = <2>; + port@48 { + reg = <0x48>;
- adx3_out2_ep: endpoint { - remote-endpoint = <&xbar_adx3_out2_ep>; - }; + xbar_adx2_out3_ep: endpoint { + remote-endpoint = <&adx2_out3_ep>; }; + };
- adx3_out3_port: port@3 { - reg = <3>; + port@49 { + reg = <0x49>;
- adx3_out3_ep: endpoint { - remote-endpoint = <&xbar_adx3_out3_ep>; - }; + xbar_adx2_out4_ep: endpoint { + remote-endpoint = <&adx2_out4_ep>; }; + };
- adx3_out4_port: port@4 { - reg = <4>; + xbar_adx3_in_port: port@4a { + reg = <0x4a>;
- adx3_out4_ep: endpoint { - remote-endpoint = <&xbar_adx3_out4_ep>; - }; + xbar_adx3_in_ep: endpoint { + remote-endpoint = <&adx3_in_ep>; }; }; - };
- adx@2903b00 { - status = "okay"; + port@4b { + reg = <0x4b>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx3_out1_ep: endpoint { + remote-endpoint = <&adx3_out1_ep>; + }; + };
- port@0 { - reg = <0>; + port@4c { + reg = <0x4c>;
- adx4_in_ep: endpoint { - remote-endpoint = <&xbar_adx4_in_ep>; - }; + xbar_adx3_out2_ep: endpoint { + remote-endpoint = <&adx3_out2_ep>; }; + };
- adx4_out1_port: port@1 { - reg = <1>; + port@4d { + reg = <0x4d>;
- adx4_out1_ep: endpoint { - remote-endpoint = <&xbar_adx4_out1_ep>; - }; + xbar_adx3_out3_ep: endpoint { + remote-endpoint = <&adx3_out3_ep>; }; + };
- adx4_out2_port: port@2 { - reg = <2>; + port@4e { + reg = <0x4e>;
- adx4_out2_ep: endpoint { - remote-endpoint = <&xbar_adx4_out2_ep>; - }; + xbar_adx3_out4_ep: endpoint { + remote-endpoint = <&adx3_out4_ep>; }; + };
- adx4_out3_port: port@3 { - reg = <3>; + xbar_adx4_in_port: port@4f { + reg = <0x4f>;
- adx4_out3_ep: endpoint { - remote-endpoint = <&xbar_adx4_out3_ep>; - }; + xbar_adx4_in_ep: endpoint { + remote-endpoint = <&adx4_in_ep>; }; + };
- adx4_out4_port: port@4 { - reg = <4>; + port@50 { + reg = <0x50>;
- adx4_out4_ep: endpoint { - remote-endpoint = <&xbar_adx4_out4_ep>; - }; + xbar_adx4_out1_ep: endpoint { + remote-endpoint = <&adx4_out1_ep>; }; }; - };
- processing-engine@2908000 { - status = "okay"; + port@51 { + reg = <0x51>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx4_out2_ep: endpoint { + remote-endpoint = <&adx4_out2_ep>; + }; + };
- port@0 { - reg = <0x0>; + port@52 { + reg = <0x52>;
- ope1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_ope1_in_ep>; - }; + xbar_adx4_out3_ep: endpoint { + remote-endpoint = <&adx4_out3_ep>; }; + };
- ope1_out_port: port@1 { - reg = <0x1>; + port@53 { + reg = <0x53>;
- ope1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_ope1_out_ep>; - }; + xbar_adx4_out4_ep: endpoint { + remote-endpoint = <&adx4_out4_ep>; }; }; - };
- amixer@290bb00 { - status = "okay"; + xbar_mixer_in1_port: port@54 { + reg = <0x54>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_mixer_in1_ep: endpoint { + remote-endpoint = <&mixer_in1_ep>; + }; + };
- port@0 { - reg = <0x0>; + xbar_mixer_in2_port: port@55 { + reg = <0x55>;
- mixer_in1_ep: endpoint { - remote-endpoint = <&xbar_mixer_in1_ep>; - }; + xbar_mixer_in2_ep: endpoint { + remote-endpoint = <&mixer_in2_ep>; }; + };
- port@1 { - reg = <0x1>; + xbar_mixer_in3_port: port@56 { + reg = <0x56>;
- mixer_in2_ep: endpoint { - remote-endpoint = <&xbar_mixer_in2_ep>; - }; + xbar_mixer_in3_ep: endpoint { + remote-endpoint = <&mixer_in3_ep>; }; + };
- port@2 { - reg = <0x2>; + xbar_mixer_in4_port: port@57 { + reg = <0x57>;
- mixer_in3_ep: endpoint { - remote-endpoint = <&xbar_mixer_in3_ep>; - }; + xbar_mixer_in4_ep: endpoint { + remote-endpoint = <&mixer_in4_ep>; }; + };
- port@3 { - reg = <0x3>; + xbar_mixer_in5_port: port@58 { + reg = <0x58>;
- mixer_in4_ep: endpoint { - remote-endpoint = <&xbar_mixer_in4_ep>; - }; + xbar_mixer_in5_ep: endpoint { + remote-endpoint = <&mixer_in5_ep>; }; + };
- port@4 { - reg = <0x4>; + xbar_mixer_in6_port: port@59 { + reg = <0x59>;
- mixer_in5_ep: endpoint { - remote-endpoint = <&xbar_mixer_in5_ep>; - }; + xbar_mixer_in6_ep: endpoint { + remote-endpoint = <&mixer_in6_ep>; }; + };
- port@5 { - reg = <0x5>; + xbar_mixer_in7_port: port@5a { + reg = <0x5a>;
- mixer_in6_ep: endpoint { - remote-endpoint = <&xbar_mixer_in6_ep>; - }; + xbar_mixer_in7_ep: endpoint { + remote-endpoint = <&mixer_in7_ep>; }; + };
- port@6 { - reg = <0x6>; + xbar_mixer_in8_port: port@5b { + reg = <0x5b>;
- mixer_in7_ep: endpoint { - remote-endpoint = <&xbar_mixer_in7_ep>; - }; + xbar_mixer_in8_ep: endpoint { + remote-endpoint = <&mixer_in8_ep>; }; + };
- port@7 { - reg = <0x7>; + xbar_mixer_in9_port: port@5c { + reg = <0x5c>;
- mixer_in8_ep: endpoint { - remote-endpoint = <&xbar_mixer_in8_ep>; - }; + xbar_mixer_in9_ep: endpoint { + remote-endpoint = <&mixer_in9_ep>; }; + };
- port@8 { - reg = <0x8>; + xbar_mixer_in10_port: port@5d { + reg = <0x5d>;
- mixer_in9_ep: endpoint { - remote-endpoint = <&xbar_mixer_in9_ep>; - }; + xbar_mixer_in10_ep: endpoint { + remote-endpoint = <&mixer_in10_ep>; }; + };
- port@9 { - reg = <0x9>; + port@5e { + reg = <0x5e>;
- mixer_in10_ep: endpoint { - remote-endpoint = <&xbar_mixer_in10_ep>; - }; + xbar_mixer_out1_ep: endpoint { + remote-endpoint = <&mixer_out1_ep>; }; + };
- mixer_out1_port: port@a { - reg = <0xa>; + port@5f { + reg = <0x5f>;
- mixer_out1_ep: endpoint { - remote-endpoint = <&xbar_mixer_out1_ep>; - }; + xbar_mixer_out2_ep: endpoint { + remote-endpoint = <&mixer_out2_ep>; }; + };
- mixer_out2_port: port@b { - reg = <0xb>; + port@60 { + reg = <0x60>;
- mixer_out2_ep: endpoint { - remote-endpoint = <&xbar_mixer_out2_ep>; - }; + xbar_mixer_out3_ep: endpoint { + remote-endpoint = <&mixer_out3_ep>; }; + };
- mixer_out3_port: port@c { - reg = <0xc>; + port@61 { + reg = <0x61>;
- mixer_out3_ep: endpoint { - remote-endpoint = <&xbar_mixer_out3_ep>; - }; + xbar_mixer_out4_ep: endpoint { + remote-endpoint = <&mixer_out4_ep>; }; + };
- mixer_out4_port: port@d { - reg = <0xd>; + port@62 { + reg = <0x62>;
- mixer_out4_ep: endpoint { - remote-endpoint = <&xbar_mixer_out4_ep>; - }; + xbar_mixer_out5_ep: endpoint { + remote-endpoint = <&mixer_out5_ep>; }; + };
- mixer_out5_port: port@e { - reg = <0xe>; + xbar_asrc_in1_port: port@63 { + reg = <0x63>;
- mixer_out5_ep: endpoint { - remote-endpoint = <&xbar_mixer_out5_ep>; - }; + xbar_asrc_in1_ep: endpoint { + remote-endpoint = <&asrc_in1_ep>; }; }; - };
- asrc@2910000 { - status = "okay"; + port@64 { + reg = <0x64>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_asrc_out1_ep: endpoint { + remote-endpoint = <&asrc_out1_ep>; + }; + };
- port@0 { - reg = <0x0>; + xbar_asrc_in2_port: port@65 { + reg = <0x65>;
- asrc_in1_ep: endpoint { - remote-endpoint = <&xbar_asrc_in1_ep>; - }; + xbar_asrc_in2_ep: endpoint { + remote-endpoint = <&asrc_in2_ep>; }; + };
- port@1 { - reg = <0x1>; + port@66 { + reg = <0x66>;
- asrc_in2_ep: endpoint { - remote-endpoint = <&xbar_asrc_in2_ep>; - }; + xbar_asrc_out2_ep: endpoint { + remote-endpoint = <&asrc_out2_ep>; }; + };
- port@2 { - reg = <0x2>; + xbar_asrc_in3_port: port@67 { + reg = <0x67>;
- asrc_in3_ep: endpoint { - remote-endpoint = <&xbar_asrc_in3_ep>; - }; + xbar_asrc_in3_ep: endpoint { + remote-endpoint = <&asrc_in3_ep>; }; + };
- port@3 { - reg = <0x3>; + port@68 { + reg = <0x68>;
- asrc_in4_ep: endpoint { - remote-endpoint = <&xbar_asrc_in4_ep>; - }; + xbar_asrc_out3_ep: endpoint { + remote-endpoint = <&asrc_out3_ep>; }; + };
- port@4 { - reg = <0x4>; + xbar_asrc_in4_port: port@69 { + reg = <0x69>;
- asrc_in5_ep: endpoint { - remote-endpoint = <&xbar_asrc_in5_ep>; - }; + xbar_asrc_in4_ep: endpoint { + remote-endpoint = <&asrc_in4_ep>; }; + };
- port@5 { - reg = <0x5>; + port@6a { + reg = <0x6a>;
- asrc_in6_ep: endpoint { - remote-endpoint = <&xbar_asrc_in6_ep>; - }; + xbar_asrc_out4_ep: endpoint { + remote-endpoint = <&asrc_out4_ep>; }; + };
- port@6 { - reg = <0x6>; + xbar_asrc_in5_port: port@6b { + reg = <0x6b>;
- asrc_in7_ep: endpoint { - remote-endpoint = <&xbar_asrc_in7_ep>; - }; + xbar_asrc_in5_ep: endpoint { + remote-endpoint = <&asrc_in5_ep>; }; + };
- asrc_out1_port: port@7 { - reg = <0x7>; + port@6c { + reg = <0x6c>;
- asrc_out1_ep: endpoint { - remote-endpoint = <&xbar_asrc_out1_ep>; - }; + xbar_asrc_out5_ep: endpoint { + remote-endpoint = <&asrc_out5_ep>; }; + };
- asrc_out2_port: port@8 { - reg = <0x8>; + xbar_asrc_in6_port: port@6d { + reg = <0x6d>;
- asrc_out2_ep: endpoint { - remote-endpoint = <&xbar_asrc_out2_ep>; - }; + xbar_asrc_in6_ep: endpoint { + remote-endpoint = <&asrc_in6_ep>; }; + };
- asrc_out3_port: port@9 { - reg = <0x9>; + port@6e { + reg = <0x6e>;
- asrc_out3_ep: endpoint { - remote-endpoint = <&xbar_asrc_out3_ep>; - }; + xbar_asrc_out6_ep: endpoint { + remote-endpoint = <&asrc_out6_ep>; }; + };
- asrc_out4_port: port@a { - reg = <0xa>; + xbar_asrc_in7_port: port@6f { + reg = <0x6f>;
- asrc_out4_ep: endpoint { - remote-endpoint = <&xbar_asrc_out4_ep>; - }; + xbar_asrc_in7_ep: endpoint { + remote-endpoint = <&asrc_in7_ep>; }; + };
- asrc_out5_port: port@b { - reg = <0xb>; + xbar_ope1_in_port: port@70 { + reg = <0x70>;
- asrc_out5_ep: endpoint { - remote-endpoint = <&xbar_asrc_out5_ep>; - }; + xbar_ope1_in_ep: endpoint { + remote-endpoint = <&ope1_cif_in_ep>; }; + };
- asrc_out6_port: port@c { - reg = <0xc>; + port@71 { + reg = <0x71>;
- asrc_out6_ep: endpoint { - remote-endpoint = <&xbar_asrc_out6_ep>; - }; + xbar_ope1_out_ep: endpoint { + remote-endpoint = <&ope1_cif_out_ep>; }; }; }; }; + + dma-controller@2930000 { + status = "okay"; + }; + + interrupt-controller@2a40000 { + status = "okay"; + }; };
i2c@3160000 { @@ -2247,14 +2247,6 @@ pcie-ep@141a0000 { }; };
- fan: pwm-fan { - compatible = "pwm-fan"; - pwms = <&pwm4 0 45334>; - - cooling-levels = <0 64 128 255>; - #cooling-cells = <2>; - }; - gpio-keys { compatible = "gpio-keys";
@@ -2279,6 +2271,14 @@ key-power { }; };
+ fan: pwm-fan { + compatible = "pwm-fan"; + pwms = <&pwm4 0 45334>; + + cooling-levels = <0 64 128 255>; + #cooling-cells = <2>; + }; + sound { compatible = "nvidia,tegra186-audio-graph-card"; status = "okay"; diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi index 617fbfaaf02f6..4a17ea5e40fd0 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra194-p3509-0000.dtsi @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0
+#include <dt-bindings/gpio/tegra194-gpio.h> #include <dt-bindings/input/linux-event-codes.h> #include <dt-bindings/input/gpio-keys.h>
@@ -8,890 +9,880 @@ bus@0 { aconnect@2900000 { status = "okay";
- dma-controller@2930000 { - status = "okay"; - }; - - interrupt-controller@2a40000 { - status = "okay"; - }; - ahub@2900800 { status = "okay";
- ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0x0>; - - xbar_admaif0_ep: endpoint { - remote-endpoint = <&admaif0_ep>; - }; - }; - - port@1 { - reg = <0x1>; - - xbar_admaif1_ep: endpoint { - remote-endpoint = <&admaif1_ep>; - }; - }; - - port@2 { - reg = <0x2>; - - xbar_admaif2_ep: endpoint { - remote-endpoint = <&admaif2_ep>; - }; - }; - - port@3 { - reg = <0x3>; + i2s@2901200 { + status = "okay";
- xbar_admaif3_ep: endpoint { - remote-endpoint = <&admaif3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@4 { - reg = <0x4>; + port@0 { + reg = <0>;
- xbar_admaif4_ep: endpoint { - remote-endpoint = <&admaif4_ep>; + i2s3_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s3_ep>; + }; }; - };
- port@5 { - reg = <0x5>; + i2s3_port: port@1 { + reg = <1>;
- xbar_admaif5_ep: endpoint { - remote-endpoint = <&admaif5_ep>; + i2s3_dap_ep: endpoint { + dai-format = "i2s"; + /* Place holder for external Codec */ + }; }; }; + };
- port@6 { - reg = <0x6>; + i2s@2901400 { + status = "okay";
- xbar_admaif6_ep: endpoint { - remote-endpoint = <&admaif6_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@7 { - reg = <0x7>; + port@0 { + reg = <0>;
- xbar_admaif7_ep: endpoint { - remote-endpoint = <&admaif7_ep>; + i2s5_cif_ep: endpoint { + remote-endpoint = <&xbar_i2s5_ep>; + }; }; - };
- port@8 { - reg = <0x8>; + i2s5_port: port@1 { + reg = <1>;
- xbar_admaif8_ep: endpoint { - remote-endpoint = <&admaif8_ep>; + i2s5_dap_ep: endpoint { + dai-format = "i2s"; + /* Place holder for external Codec */ + }; }; }; + };
- port@9 { - reg = <0x9>; + sfc@2902000 { + status = "okay";
- xbar_admaif9_ep: endpoint { - remote-endpoint = <&admaif9_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@a { - reg = <0xa>; + port@0 { + reg = <0>;
- xbar_admaif10_ep: endpoint { - remote-endpoint = <&admaif10_ep>; + sfc1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc1_in_ep>; + convert-rate = <44100>; + }; }; - };
- port@b { - reg = <0xb>; + sfc1_out_port: port@1 { + reg = <1>;
- xbar_admaif11_ep: endpoint { - remote-endpoint = <&admaif11_ep>; + sfc1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc1_out_ep>; + convert-rate = <48000>; + }; }; }; + };
- port@c { - reg = <0xc>; + sfc@2902200 { + status = "okay";
- xbar_admaif12_ep: endpoint { - remote-endpoint = <&admaif12_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@d { - reg = <0xd>; + port@0 { + reg = <0>;
- xbar_admaif13_ep: endpoint { - remote-endpoint = <&admaif13_ep>; + sfc2_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc2_in_ep>; + }; }; - };
- port@e { - reg = <0xe>; + sfc2_out_port: port@1 { + reg = <1>;
- xbar_admaif14_ep: endpoint { - remote-endpoint = <&admaif14_ep>; + sfc2_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc2_out_ep>; + }; }; }; + };
- port@f { - reg = <0xf>; + sfc@2902400 { + status = "okay";
- xbar_admaif15_ep: endpoint { - remote-endpoint = <&admaif15_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@10 { - reg = <0x10>; + port@0 { + reg = <0>;
- xbar_admaif16_ep: endpoint { - remote-endpoint = <&admaif16_ep>; + sfc3_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc3_in_ep>; + }; }; - };
- port@11 { - reg = <0x11>; + sfc3_out_port: port@1 { + reg = <1>;
- xbar_admaif17_ep: endpoint { - remote-endpoint = <&admaif17_ep>; + sfc3_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc3_out_ep>; + }; }; }; + };
- port@12 { - reg = <0x12>; + sfc@2902600 { + status = "okay";
- xbar_admaif18_ep: endpoint { - remote-endpoint = <&admaif18_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@13 { - reg = <0x13>; + port@0 { + reg = <0>;
- xbar_admaif19_ep: endpoint { - remote-endpoint = <&admaif19_ep>; + sfc4_cif_in_ep: endpoint { + remote-endpoint = <&xbar_sfc4_in_ep>; + }; }; - };
- xbar_i2s3_port: port@16 { - reg = <0x16>; + sfc4_out_port: port@1 { + reg = <1>;
- xbar_i2s3_ep: endpoint { - remote-endpoint = <&i2s3_cif_ep>; + sfc4_cif_out_ep: endpoint { + remote-endpoint = <&xbar_sfc4_out_ep>; + }; }; }; + };
- xbar_i2s5_port: port@18 { - reg = <0x18>; + amx@2903000 { + status = "okay";
- xbar_i2s5_ep: endpoint { - remote-endpoint = <&i2s5_cif_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_dmic1_port: port@1a { - reg = <0x1a>; + port@0 { + reg = <0>;
- xbar_dmic1_ep: endpoint { - remote-endpoint = <&dmic1_cif_ep>; + amx1_in1_ep: endpoint { + remote-endpoint = <&xbar_amx1_in1_ep>; + }; }; - };
- xbar_dmic2_port: port@1b { - reg = <0x1b>; + port@1 { + reg = <1>;
- xbar_dmic2_ep: endpoint { - remote-endpoint = <&dmic2_cif_ep>; + amx1_in2_ep: endpoint { + remote-endpoint = <&xbar_amx1_in2_ep>; + }; }; - };
- xbar_dmic4_port: port@1d { - reg = <0x1d>; + port@2 { + reg = <2>;
- xbar_dmic4_ep: endpoint { - remote-endpoint = <&dmic4_cif_ep>; + amx1_in3_ep: endpoint { + remote-endpoint = <&xbar_amx1_in3_ep>; + }; }; - };
- xbar_dspk1_port: port@1e { - reg = <0x1e>; + port@3 { + reg = <3>;
- xbar_dspk1_ep: endpoint { - remote-endpoint = <&dspk1_cif_ep>; + amx1_in4_ep: endpoint { + remote-endpoint = <&xbar_amx1_in4_ep>; + }; }; - };
- xbar_dspk2_port: port@1f { - reg = <0x1f>; + amx1_out_port: port@4 { + reg = <4>;
- xbar_dspk2_ep: endpoint { - remote-endpoint = <&dspk2_cif_ep>; + amx1_out_ep: endpoint { + remote-endpoint = <&xbar_amx1_out_ep>; + }; }; }; + };
- xbar_sfc1_in_port: port@20 { - reg = <0x20>; + amx@2903100 { + status = "okay";
- xbar_sfc1_in_ep: endpoint { - remote-endpoint = <&sfc1_cif_in_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@21 { - reg = <0x21>; + port@0 { + reg = <0>;
- xbar_sfc1_out_ep: endpoint { - remote-endpoint = <&sfc1_cif_out_ep>; + amx2_in1_ep: endpoint { + remote-endpoint = <&xbar_amx2_in1_ep>; + }; }; - };
- xbar_sfc2_in_port: port@22 { - reg = <0x22>; + port@1 { + reg = <1>;
- xbar_sfc2_in_ep: endpoint { - remote-endpoint = <&sfc2_cif_in_ep>; + amx2_in2_ep: endpoint { + remote-endpoint = <&xbar_amx2_in2_ep>; + }; }; - };
- port@23 { - reg = <0x23>; + amx2_in3_port: port@2 { + reg = <2>;
- xbar_sfc2_out_ep: endpoint { - remote-endpoint = <&sfc2_cif_out_ep>; + amx2_in3_ep: endpoint { + remote-endpoint = <&xbar_amx2_in3_ep>; + }; }; - };
- xbar_sfc3_in_port: port@24 { - reg = <0x24>; + amx2_in4_port: port@3 { + reg = <3>;
- xbar_sfc3_in_ep: endpoint { - remote-endpoint = <&sfc3_cif_in_ep>; + amx2_in4_ep: endpoint { + remote-endpoint = <&xbar_amx2_in4_ep>; + }; }; - };
- port@25 { - reg = <0x25>; + amx2_out_port: port@4 { + reg = <4>;
- xbar_sfc3_out_ep: endpoint { - remote-endpoint = <&sfc3_cif_out_ep>; + amx2_out_ep: endpoint { + remote-endpoint = <&xbar_amx2_out_ep>; + }; }; }; + };
- xbar_sfc4_in_port: port@26 { - reg = <0x26>; + amx@2903200 { + status = "okay";
- xbar_sfc4_in_ep: endpoint { - remote-endpoint = <&sfc4_cif_in_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@27 { - reg = <0x27>; + port@0 { + reg = <0>;
- xbar_sfc4_out_ep: endpoint { - remote-endpoint = <&sfc4_cif_out_ep>; + amx3_in1_ep: endpoint { + remote-endpoint = <&xbar_amx3_in1_ep>; + }; }; - };
- xbar_mvc1_in_port: port@28 { - reg = <0x28>; + port@1 { + reg = <1>;
- xbar_mvc1_in_ep: endpoint { - remote-endpoint = <&mvc1_cif_in_ep>; + amx3_in2_ep: endpoint { + remote-endpoint = <&xbar_amx3_in2_ep>; + }; }; - }; - - port@29 { - reg = <0x29>;
- xbar_mvc1_out_ep: endpoint { - remote-endpoint = <&mvc1_cif_out_ep>; + port@2 { + reg = <2>; + + amx3_in3_ep: endpoint { + remote-endpoint = <&xbar_amx3_in3_ep>; + }; }; - };
- xbar_mvc2_in_port: port@2a { - reg = <0x2a>; + port@3 { + reg = <3>;
- xbar_mvc2_in_ep: endpoint { - remote-endpoint = <&mvc2_cif_in_ep>; + amx3_in4_ep: endpoint { + remote-endpoint = <&xbar_amx3_in4_ep>; + }; }; - };
- port@2b { - reg = <0x2b>; + amx3_out_port: port@4 { + reg = <4>;
- xbar_mvc2_out_ep: endpoint { - remote-endpoint = <&mvc2_cif_out_ep>; + amx3_out_ep: endpoint { + remote-endpoint = <&xbar_amx3_out_ep>; + }; }; }; + };
- xbar_amx1_in1_port: port@2c { - reg = <0x2c>; + amx@2903300 { + status = "okay";
- xbar_amx1_in1_ep: endpoint { - remote-endpoint = <&amx1_in1_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx1_in2_port: port@2d { - reg = <0x2d>; + port@0 { + reg = <0>;
- xbar_amx1_in2_ep: endpoint { - remote-endpoint = <&amx1_in2_ep>; + amx4_in1_ep: endpoint { + remote-endpoint = <&xbar_amx4_in1_ep>; + }; }; - };
- xbar_amx1_in3_port: port@2e { - reg = <0x2e>; + port@1 { + reg = <1>;
- xbar_amx1_in3_ep: endpoint { - remote-endpoint = <&amx1_in3_ep>; + amx4_in2_ep: endpoint { + remote-endpoint = <&xbar_amx4_in2_ep>; + }; }; - };
- xbar_amx1_in4_port: port@2f { - reg = <0x2f>; + port@2 { + reg = <2>;
- xbar_amx1_in4_ep: endpoint { - remote-endpoint = <&amx1_in4_ep>; + amx4_in3_ep: endpoint { + remote-endpoint = <&xbar_amx4_in3_ep>; + }; }; - };
- port@30 { - reg = <0x30>; + port@3 { + reg = <3>;
- xbar_amx1_out_ep: endpoint { - remote-endpoint = <&amx1_out_ep>; + amx4_in4_ep: endpoint { + remote-endpoint = <&xbar_amx4_in4_ep>; + }; }; - };
- xbar_amx2_in1_port: port@31 { - reg = <0x31>; + amx4_out_port: port@4 { + reg = <4>;
- xbar_amx2_in1_ep: endpoint { - remote-endpoint = <&amx2_in1_ep>; + amx4_out_ep: endpoint { + remote-endpoint = <&xbar_amx4_out_ep>; + }; }; }; + };
- xbar_amx2_in2_port: port@32 { - reg = <0x32>; + adx@2903800 { + status = "okay";
- xbar_amx2_in2_ep: endpoint { - remote-endpoint = <&amx2_in2_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx2_in3_port: port@33 { - reg = <0x33>; + port@0 { + reg = <0>;
- xbar_amx2_in3_ep: endpoint { - remote-endpoint = <&amx2_in3_ep>; + adx1_in_ep: endpoint { + remote-endpoint = <&xbar_adx1_in_ep>; + }; }; - };
- xbar_amx2_in4_port: port@34 { - reg = <0x34>; + adx1_out1_port: port@1 { + reg = <1>;
- xbar_amx2_in4_ep: endpoint { - remote-endpoint = <&amx2_in4_ep>; + adx1_out1_ep: endpoint { + remote-endpoint = <&xbar_adx1_out1_ep>; + }; }; - };
- port@35 { - reg = <0x35>; + adx1_out2_port: port@2 { + reg = <2>;
- xbar_amx2_out_ep: endpoint { - remote-endpoint = <&amx2_out_ep>; + adx1_out2_ep: endpoint { + remote-endpoint = <&xbar_adx1_out2_ep>; + }; }; - };
- xbar_amx3_in1_port: port@36 { - reg = <0x36>; + adx1_out3_port: port@3 { + reg = <3>;
- xbar_amx3_in1_ep: endpoint { - remote-endpoint = <&amx3_in1_ep>; + adx1_out3_ep: endpoint { + remote-endpoint = <&xbar_adx1_out3_ep>; + }; }; - };
- xbar_amx3_in2_port: port@37 { - reg = <0x37>; + adx1_out4_port: port@4 { + reg = <4>;
- xbar_amx3_in2_ep: endpoint { - remote-endpoint = <&amx3_in2_ep>; + adx1_out4_ep: endpoint { + remote-endpoint = <&xbar_adx1_out4_ep>; + }; }; }; + };
- xbar_amx3_in3_port: port@38 { - reg = <0x38>; + adx@2903900 { + status = "okay";
- xbar_amx3_in3_ep: endpoint { - remote-endpoint = <&amx3_in3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx3_in4_port: port@39 { - reg = <0x39>; + port@0 { + reg = <0>;
- xbar_amx3_in4_ep: endpoint { - remote-endpoint = <&amx3_in4_ep>; + adx2_in_ep: endpoint { + remote-endpoint = <&xbar_adx2_in_ep>; + }; }; - };
- port@3a { - reg = <0x3a>; + adx2_out1_port: port@1 { + reg = <1>;
- xbar_amx3_out_ep: endpoint { - remote-endpoint = <&amx3_out_ep>; + adx2_out1_ep: endpoint { + remote-endpoint = <&xbar_adx2_out1_ep>; + }; }; - };
- xbar_amx4_in1_port: port@3b { - reg = <0x3b>; + adx2_out2_port: port@2 { + reg = <2>;
- xbar_amx4_in1_ep: endpoint { - remote-endpoint = <&amx4_in1_ep>; + adx2_out2_ep: endpoint { + remote-endpoint = <&xbar_adx2_out2_ep>; + }; }; - };
- xbar_amx4_in2_port: port@3c { - reg = <0x3c>; + adx2_out3_port: port@3 { + reg = <3>;
- xbar_amx4_in2_ep: endpoint { - remote-endpoint = <&amx4_in2_ep>; + adx2_out3_ep: endpoint { + remote-endpoint = <&xbar_adx2_out3_ep>; + }; }; - };
- xbar_amx4_in3_port: port@3d { - reg = <0x3d>; + adx2_out4_port: port@4 { + reg = <4>;
- xbar_amx4_in3_ep: endpoint { - remote-endpoint = <&amx4_in3_ep>; + adx2_out4_ep: endpoint { + remote-endpoint = <&xbar_adx2_out4_ep>; + }; }; }; + };
- xbar_amx4_in4_port: port@3e { - reg = <0x3e>; + adx@2903a00 { + status = "okay";
- xbar_amx4_in4_ep: endpoint { - remote-endpoint = <&amx4_in4_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@3f { - reg = <0x3f>; + port@0 { + reg = <0>;
- xbar_amx4_out_ep: endpoint { - remote-endpoint = <&amx4_out_ep>; + adx3_in_ep: endpoint { + remote-endpoint = <&xbar_adx3_in_ep>; + }; }; - };
- xbar_adx1_in_port: port@40 { - reg = <0x40>; + adx3_out1_port: port@1 { + reg = <1>;
- xbar_adx1_in_ep: endpoint { - remote-endpoint = <&adx1_in_ep>; + adx3_out1_ep: endpoint { + remote-endpoint = <&xbar_adx3_out1_ep>; + }; }; - };
- port@41 { - reg = <0x41>; + adx3_out2_port: port@2 { + reg = <2>;
- xbar_adx1_out1_ep: endpoint { - remote-endpoint = <&adx1_out1_ep>; + adx3_out2_ep: endpoint { + remote-endpoint = <&xbar_adx3_out2_ep>; + }; }; - };
- port@42 { - reg = <0x42>; + adx3_out3_port: port@3 { + reg = <3>;
- xbar_adx1_out2_ep: endpoint { - remote-endpoint = <&adx1_out2_ep>; + adx3_out3_ep: endpoint { + remote-endpoint = <&xbar_adx3_out3_ep>; + }; }; - };
- port@43 { - reg = <0x43>; + adx3_out4_port: port@4 { + reg = <4>;
- xbar_adx1_out3_ep: endpoint { - remote-endpoint = <&adx1_out3_ep>; + adx3_out4_ep: endpoint { + remote-endpoint = <&xbar_adx3_out4_ep>; + }; }; }; + };
- port@44 { - reg = <0x44>; + adx@2903b00 { + status = "okay";
- xbar_adx1_out4_ep: endpoint { - remote-endpoint = <&adx1_out4_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_adx2_in_port: port@45 { - reg = <0x45>; + port@0 { + reg = <0>;
- xbar_adx2_in_ep: endpoint { - remote-endpoint = <&adx2_in_ep>; + adx4_in_ep: endpoint { + remote-endpoint = <&xbar_adx4_in_ep>; + }; }; - };
- port@46 { - reg = <0x46>; + adx4_out1_port: port@1 { + reg = <1>;
- xbar_adx2_out1_ep: endpoint { - remote-endpoint = <&adx2_out1_ep>; + adx4_out1_ep: endpoint { + remote-endpoint = <&xbar_adx4_out1_ep>; + }; }; - };
- port@47 { - reg = <0x47>; + adx4_out2_port: port@2 { + reg = <2>;
- xbar_adx2_out2_ep: endpoint { - remote-endpoint = <&adx2_out2_ep>; + adx4_out2_ep: endpoint { + remote-endpoint = <&xbar_adx4_out2_ep>; + }; }; - };
- port@48 { - reg = <0x48>; + adx4_out3_port: port@3 { + reg = <3>;
- xbar_adx2_out3_ep: endpoint { - remote-endpoint = <&adx2_out3_ep>; + adx4_out3_ep: endpoint { + remote-endpoint = <&xbar_adx4_out3_ep>; + }; }; - };
- port@49 { - reg = <0x49>; + adx4_out4_port: port@4 { + reg = <4>;
- xbar_adx2_out4_ep: endpoint { - remote-endpoint = <&adx2_out4_ep>; + adx4_out4_ep: endpoint { + remote-endpoint = <&xbar_adx4_out4_ep>; + }; }; }; + };
- xbar_adx3_in_port: port@4a { - reg = <0x4a>; + dmic@2904000 { + status = "okay";
- xbar_adx3_in_ep: endpoint { - remote-endpoint = <&adx3_in_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@4b { - reg = <0x4b>; + port@0 { + reg = <0>;
- xbar_adx3_out1_ep: endpoint { - remote-endpoint = <&adx3_out1_ep>; + dmic1_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic1_ep>; + }; }; - };
- port@4c { - reg = <0x4c>; + dmic1_port: port@1 { + reg = <1>;
- xbar_adx3_out2_ep: endpoint { - remote-endpoint = <&adx3_out2_ep>; + dmic1_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- port@4d { - reg = <0x4d>; + dmic@2904100 { + status = "okay";
- xbar_adx3_out3_ep: endpoint { - remote-endpoint = <&adx3_out3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@4e { - reg = <0x4e>; + port@0 { + reg = <0>;
- xbar_adx3_out4_ep: endpoint { - remote-endpoint = <&adx3_out4_ep>; + dmic2_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic2_ep>; + }; }; - };
- xbar_adx4_in_port: port@4f { - reg = <0x4f>; + dmic2_port: port@1 { + reg = <1>;
- xbar_adx4_in_ep: endpoint { - remote-endpoint = <&adx4_in_ep>; + dmic2_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- port@50 { - reg = <0x50>; + dmic@2904300 { + status = "okay";
- xbar_adx4_out1_ep: endpoint { - remote-endpoint = <&adx4_out1_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@51 { - reg = <0x51>; + port@0 { + reg = <0>;
- xbar_adx4_out2_ep: endpoint { - remote-endpoint = <&adx4_out2_ep>; + dmic4_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic4_ep>; + }; }; - };
- port@52 { - reg = <0x52>; + dmic4_port: port@1 { + reg = <1>;
- xbar_adx4_out3_ep: endpoint { - remote-endpoint = <&adx4_out3_ep>; + dmic4_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- port@53 { - reg = <0x53>; + dspk@2905000 { + status = "okay";
- xbar_adx4_out4_ep: endpoint { - remote-endpoint = <&adx4_out4_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in1_port: port@54 { - reg = <0x54>; + port@0 { + reg = <0>;
- xbar_mixer_in1_ep: endpoint { - remote-endpoint = <&mixer_in1_ep>; + dspk1_cif_ep: endpoint { + remote-endpoint = <&xbar_dspk1_ep>; + }; }; - };
- xbar_mixer_in2_port: port@55 { - reg = <0x55>; + dspk1_port: port@1 { + reg = <1>;
- xbar_mixer_in2_ep: endpoint { - remote-endpoint = <&mixer_in2_ep>; + dspk1_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- xbar_mixer_in3_port: port@56 { - reg = <0x56>; + dspk@2905100 { + status = "okay";
- xbar_mixer_in3_ep: endpoint { - remote-endpoint = <&mixer_in3_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in4_port: port@57 { - reg = <0x57>; + port@0 { + reg = <0>;
- xbar_mixer_in4_ep: endpoint { - remote-endpoint = <&mixer_in4_ep>; + dspk2_cif_ep: endpoint { + remote-endpoint = <&xbar_dspk2_ep>; + }; }; - };
- xbar_mixer_in5_port: port@58 { - reg = <0x58>; + dspk2_port: port@1 { + reg = <1>;
- xbar_mixer_in5_ep: endpoint { - remote-endpoint = <&mixer_in5_ep>; + dspk2_dap_ep: endpoint { + /* Place holder for external Codec */ + }; }; }; + };
- xbar_mixer_in6_port: port@59 { - reg = <0x59>; + processing-engine@2908000 { + status = "okay";
- xbar_mixer_in6_ep: endpoint { - remote-endpoint = <&mixer_in6_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in7_port: port@5a { - reg = <0x5a>; + port@0 { + reg = <0x0>;
- xbar_mixer_in7_ep: endpoint { - remote-endpoint = <&mixer_in7_ep>; + ope1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_ope1_in_ep>; + }; }; - };
- xbar_mixer_in8_port: port@5b { - reg = <0x5b>; + ope1_out_port: port@1 { + reg = <0x1>;
- xbar_mixer_in8_ep: endpoint { - remote-endpoint = <&mixer_in8_ep>; + ope1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_ope1_out_ep>; + }; }; }; + };
- xbar_mixer_in9_port: port@5c { - reg = <0x5c>; + mvc@290a000 { + status = "okay";
- xbar_mixer_in9_ep: endpoint { - remote-endpoint = <&mixer_in9_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mixer_in10_port: port@5d { - reg = <0x5d>; + port@0 { + reg = <0>;
- xbar_mixer_in10_ep: endpoint { - remote-endpoint = <&mixer_in10_ep>; + mvc1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc1_in_ep>; + }; }; - };
- port@5e { - reg = <0x5e>; + mvc1_out_port: port@1 { + reg = <1>;
- xbar_mixer_out1_ep: endpoint { - remote-endpoint = <&mixer_out1_ep>; + mvc1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc1_out_ep>; + }; }; }; + };
- port@5f { - reg = <0x5f>; + mvc@290a200 { + status = "okay";
- xbar_mixer_out2_ep: endpoint { - remote-endpoint = <&mixer_out2_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@60 { - reg = <0x60>; + port@0 { + reg = <0>;
- xbar_mixer_out3_ep: endpoint { - remote-endpoint = <&mixer_out3_ep>; + mvc2_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc2_in_ep>; + }; }; - };
- port@61 { - reg = <0x61>; + mvc2_out_port: port@1 { + reg = <1>;
- xbar_mixer_out4_ep: endpoint { - remote-endpoint = <&mixer_out4_ep>; + mvc2_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc2_out_ep>; + }; }; }; + };
- port@62 { - reg = <0x62>; + amixer@290bb00 { + status = "okay";
- xbar_mixer_out5_ep: endpoint { - remote-endpoint = <&mixer_out5_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_asrc_in1_port: port@63 { - reg = <0x63>; + port@0 { + reg = <0x0>;
- xbar_asrc_in1_ep: endpoint { - remote-endpoint = <&asrc_in1_ep>; + mixer_in1_ep: endpoint { + remote-endpoint = <&xbar_mixer_in1_ep>; + }; }; - };
- port@64 { - reg = <0x64>; + port@1 { + reg = <0x1>;
- xbar_asrc_out1_ep: endpoint { - remote-endpoint = <&asrc_out1_ep>; + mixer_in2_ep: endpoint { + remote-endpoint = <&xbar_mixer_in2_ep>; + }; }; - };
- xbar_asrc_in2_port: port@65 { - reg = <0x65>; + port@2 { + reg = <0x2>;
- xbar_asrc_in2_ep: endpoint { - remote-endpoint = <&asrc_in2_ep>; + mixer_in3_ep: endpoint { + remote-endpoint = <&xbar_mixer_in3_ep>; + }; }; - };
- port@66 { - reg = <0x66>; + port@3 { + reg = <0x3>;
- xbar_asrc_out2_ep: endpoint { - remote-endpoint = <&asrc_out2_ep>; + mixer_in4_ep: endpoint { + remote-endpoint = <&xbar_mixer_in4_ep>; + }; }; - };
- xbar_asrc_in3_port: port@67 { - reg = <0x67>; + port@4 { + reg = <0x4>;
- xbar_asrc_in3_ep: endpoint { - remote-endpoint = <&asrc_in3_ep>; + mixer_in5_ep: endpoint { + remote-endpoint = <&xbar_mixer_in5_ep>; + }; }; - };
- port@68 { - reg = <0x68>; + port@5 { + reg = <0x5>;
- xbar_asrc_out3_ep: endpoint { - remote-endpoint = <&asrc_out3_ep>; + mixer_in6_ep: endpoint { + remote-endpoint = <&xbar_mixer_in6_ep>; + }; }; - };
- xbar_asrc_in4_port: port@69 { - reg = <0x69>; + port@6 { + reg = <0x6>;
- xbar_asrc_in4_ep: endpoint { - remote-endpoint = <&asrc_in4_ep>; + mixer_in7_ep: endpoint { + remote-endpoint = <&xbar_mixer_in7_ep>; + }; }; - };
- port@6a { - reg = <0x6a>; + port@7 { + reg = <0x7>;
- xbar_asrc_out4_ep: endpoint { - remote-endpoint = <&asrc_out4_ep>; + mixer_in8_ep: endpoint { + remote-endpoint = <&xbar_mixer_in8_ep>; + }; }; - };
- xbar_asrc_in5_port: port@6b { - reg = <0x6b>; + port@8 { + reg = <0x8>;
- xbar_asrc_in5_ep: endpoint { - remote-endpoint = <&asrc_in5_ep>; + mixer_in9_ep: endpoint { + remote-endpoint = <&xbar_mixer_in9_ep>; + }; }; - };
- port@6c { - reg = <0x6c>; + port@9 { + reg = <0x9>;
- xbar_asrc_out5_ep: endpoint { - remote-endpoint = <&asrc_out5_ep>; + mixer_in10_ep: endpoint { + remote-endpoint = <&xbar_mixer_in10_ep>; + }; }; - };
- xbar_asrc_in6_port: port@6d { - reg = <0x6d>; + mixer_out1_port: port@a { + reg = <0xa>;
- xbar_asrc_in6_ep: endpoint { - remote-endpoint = <&asrc_in6_ep>; + mixer_out1_ep: endpoint { + remote-endpoint = <&xbar_mixer_out1_ep>; + }; }; - };
- port@6e { - reg = <0x6e>; + mixer_out2_port: port@b { + reg = <0xb>;
- xbar_asrc_out6_ep: endpoint { - remote-endpoint = <&asrc_out6_ep>; + mixer_out2_ep: endpoint { + remote-endpoint = <&xbar_mixer_out2_ep>; + }; }; - };
- xbar_asrc_in7_port: port@6f { - reg = <0x6f>; + mixer_out3_port: port@c { + reg = <0xc>;
- xbar_asrc_in7_ep: endpoint { - remote-endpoint = <&asrc_in7_ep>; + mixer_out3_ep: endpoint { + remote-endpoint = <&xbar_mixer_out3_ep>; + }; }; - };
- xbar_ope1_in_port: port@70 { - reg = <0x70>; + mixer_out4_port: port@d { + reg = <0xd>;
- xbar_ope1_in_ep: endpoint { - remote-endpoint = <&ope1_cif_in_ep>; + mixer_out4_ep: endpoint { + remote-endpoint = <&xbar_mixer_out4_ep>; + }; }; - };
- port@71 { - reg = <0x71>; + mixer_out5_port: port@e { + reg = <0xe>;
- xbar_ope1_out_ep: endpoint { - remote-endpoint = <&ope1_cif_out_ep>; + mixer_out5_ep: endpoint { + remote-endpoint = <&xbar_mixer_out5_ep>; + }; }; }; }; @@ -1065,7 +1056,7 @@ admaif19_ep: endpoint { }; };
- i2s@2901200 { + asrc@2910000 { status = "okay";
ports { @@ -1073,990 +1064,996 @@ ports { #size-cells = <0>;
port@0 { - reg = <0>; + reg = <0x0>;
- i2s3_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s3_ep>; + asrc_in1_ep: endpoint { + remote-endpoint = <&xbar_asrc_in1_ep>; }; };
- i2s3_port: port@1 { - reg = <1>; + port@1 { + reg = <0x1>;
- i2s3_dap_ep: endpoint { - dai-format = "i2s"; - /* Place holder for external Codec */ + asrc_in2_ep: endpoint { + remote-endpoint = <&xbar_asrc_in2_ep>; + }; + }; + + port@2 { + reg = <0x2>; + + asrc_in3_ep: endpoint { + remote-endpoint = <&xbar_asrc_in3_ep>; + }; + }; + + port@3 { + reg = <0x3>; + + asrc_in4_ep: endpoint { + remote-endpoint = <&xbar_asrc_in4_ep>; }; }; - }; - };
- i2s@2901400 { - status = "okay"; + port@4 { + reg = <0x4>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_in5_ep: endpoint { + remote-endpoint = <&xbar_asrc_in5_ep>; + }; + };
- port@0 { - reg = <0>; + port@5 { + reg = <0x5>;
- i2s5_cif_ep: endpoint { - remote-endpoint = <&xbar_i2s5_ep>; + asrc_in6_ep: endpoint { + remote-endpoint = <&xbar_asrc_in6_ep>; }; };
- i2s5_port: port@1 { - reg = <1>; + port@6 { + reg = <0x6>;
- i2s5_dap_ep: endpoint { - dai-format = "i2s"; - /* Place holder for external Codec */ + asrc_in7_ep: endpoint { + remote-endpoint = <&xbar_asrc_in7_ep>; }; }; - }; - };
- dmic@2904000 { - status = "okay"; + asrc_out1_port: port@7 { + reg = <0x7>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_out1_ep: endpoint { + remote-endpoint = <&xbar_asrc_out1_ep>; + }; + };
- port@0 { - reg = <0>; + asrc_out2_port: port@8 { + reg = <0x8>;
- dmic1_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic1_ep>; + asrc_out2_ep: endpoint { + remote-endpoint = <&xbar_asrc_out2_ep>; }; };
- dmic1_port: port@1 { - reg = <1>; + asrc_out3_port: port@9 { + reg = <0x9>;
- dmic1_dap_ep: endpoint { - /* Place holder for external Codec */ + asrc_out3_ep: endpoint { + remote-endpoint = <&xbar_asrc_out3_ep>; }; }; - }; - };
- dmic@2904100 { - status = "okay"; + asrc_out4_port: port@a { + reg = <0xa>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_out4_ep: endpoint { + remote-endpoint = <&xbar_asrc_out4_ep>; + }; + };
- port@0 { - reg = <0>; + asrc_out5_port: port@b { + reg = <0xb>;
- dmic2_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic2_ep>; + asrc_out5_ep: endpoint { + remote-endpoint = <&xbar_asrc_out5_ep>; }; };
- dmic2_port: port@1 { - reg = <1>; + asrc_out6_port: port@c { + reg = <0xc>;
- dmic2_dap_ep: endpoint { - /* Place holder for external Codec */ + asrc_out6_ep: endpoint { + remote-endpoint = <&xbar_asrc_out6_ep>; }; }; }; };
- dmic@2904300 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@0 { - reg = <0>; + port@0 { + reg = <0x0>;
- dmic4_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic4_ep>; - }; + xbar_admaif0_ep: endpoint { + remote-endpoint = <&admaif0_ep>; }; + };
- dmic4_port: port@1 { - reg = <1>; + port@1 { + reg = <0x1>;
- dmic4_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif1_ep: endpoint { + remote-endpoint = <&admaif1_ep>; }; }; - };
- dspk@2905000 { - status = "okay"; + port@2 { + reg = <0x2>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif2_ep: endpoint { + remote-endpoint = <&admaif2_ep>; + }; + };
- port@0 { - reg = <0>; + port@3 { + reg = <0x3>;
- dspk1_cif_ep: endpoint { - remote-endpoint = <&xbar_dspk1_ep>; - }; + xbar_admaif3_ep: endpoint { + remote-endpoint = <&admaif3_ep>; }; + };
- dspk1_port: port@1 { - reg = <1>; + port@4 { + reg = <0x4>;
- dspk1_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif4_ep: endpoint { + remote-endpoint = <&admaif4_ep>; }; }; - };
- dspk@2905100 { - status = "okay"; + port@5 { + reg = <0x5>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif5_ep: endpoint { + remote-endpoint = <&admaif5_ep>; + }; + };
- port@0 { - reg = <0>; + port@6 { + reg = <0x6>;
- dspk2_cif_ep: endpoint { - remote-endpoint = <&xbar_dspk2_ep>; - }; + xbar_admaif6_ep: endpoint { + remote-endpoint = <&admaif6_ep>; }; + };
- dspk2_port: port@1 { - reg = <1>; + port@7 { + reg = <0x7>;
- dspk2_dap_ep: endpoint { - /* Place holder for external Codec */ - }; + xbar_admaif7_ep: endpoint { + remote-endpoint = <&admaif7_ep>; }; }; - };
- sfc@2902000 { - status = "okay"; + port@8 { + reg = <0x8>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif8_ep: endpoint { + remote-endpoint = <&admaif8_ep>; + }; + };
- port@0 { - reg = <0>; + port@9 { + reg = <0x9>;
- sfc1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc1_in_ep>; - convert-rate = <44100>; - }; + xbar_admaif9_ep: endpoint { + remote-endpoint = <&admaif9_ep>; }; + };
- sfc1_out_port: port@1 { - reg = <1>; + port@a { + reg = <0xa>;
- sfc1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc1_out_ep>; - convert-rate = <48000>; - }; + xbar_admaif10_ep: endpoint { + remote-endpoint = <&admaif10_ep>; }; }; - };
- sfc@2902200 { - status = "okay"; + port@b { + reg = <0xb>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif11_ep: endpoint { + remote-endpoint = <&admaif11_ep>; + }; + };
- port@0 { - reg = <0>; + port@c { + reg = <0xc>;
- sfc2_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc2_in_ep>; - }; + xbar_admaif12_ep: endpoint { + remote-endpoint = <&admaif12_ep>; }; + };
- sfc2_out_port: port@1 { - reg = <1>; + port@d { + reg = <0xd>;
- sfc2_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc2_out_ep>; - }; + xbar_admaif13_ep: endpoint { + remote-endpoint = <&admaif13_ep>; }; }; - };
- sfc@2902400 { - status = "okay"; + port@e { + reg = <0xe>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif14_ep: endpoint { + remote-endpoint = <&admaif14_ep>; + }; + };
- port@0 { - reg = <0>; + port@f { + reg = <0xf>;
- sfc3_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc3_in_ep>; - }; + xbar_admaif15_ep: endpoint { + remote-endpoint = <&admaif15_ep>; }; + };
- sfc3_out_port: port@1 { - reg = <1>; + port@10 { + reg = <0x10>;
- sfc3_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc3_out_ep>; - }; + xbar_admaif16_ep: endpoint { + remote-endpoint = <&admaif16_ep>; }; }; - };
- sfc@2902600 { - status = "okay"; + port@11 { + reg = <0x11>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif17_ep: endpoint { + remote-endpoint = <&admaif17_ep>; + }; + };
- port@0 { - reg = <0>; + port@12 { + reg = <0x12>;
- sfc4_cif_in_ep: endpoint { - remote-endpoint = <&xbar_sfc4_in_ep>; - }; + xbar_admaif18_ep: endpoint { + remote-endpoint = <&admaif18_ep>; }; + };
- sfc4_out_port: port@1 { - reg = <1>; + port@13 { + reg = <0x13>;
- sfc4_cif_out_ep: endpoint { - remote-endpoint = <&xbar_sfc4_out_ep>; - }; + xbar_admaif19_ep: endpoint { + remote-endpoint = <&admaif19_ep>; }; }; - };
- mvc@290a000 { - status = "okay"; + xbar_i2s3_port: port@16 { + reg = <0x16>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_i2s3_ep: endpoint { + remote-endpoint = <&i2s3_cif_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_i2s5_port: port@18 { + reg = <0x18>;
- mvc1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc1_in_ep>; - }; + xbar_i2s5_ep: endpoint { + remote-endpoint = <&i2s5_cif_ep>; }; + };
- mvc1_out_port: port@1 { - reg = <1>; + xbar_dmic1_port: port@1a { + reg = <0x1a>;
- mvc1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc1_out_ep>; - }; + xbar_dmic1_ep: endpoint { + remote-endpoint = <&dmic1_cif_ep>; }; }; - };
- mvc@290a200 { - status = "okay"; + xbar_dmic2_port: port@1b { + reg = <0x1b>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_dmic2_ep: endpoint { + remote-endpoint = <&dmic2_cif_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_dmic4_port: port@1d { + reg = <0x1d>;
- mvc2_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc2_in_ep>; - }; + xbar_dmic4_ep: endpoint { + remote-endpoint = <&dmic4_cif_ep>; }; + };
- mvc2_out_port: port@1 { - reg = <1>; + xbar_dspk1_port: port@1e { + reg = <0x1e>;
- mvc2_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc2_out_ep>; - }; + xbar_dspk1_ep: endpoint { + remote-endpoint = <&dspk1_cif_ep>; }; }; - };
- amx@2903000 { - status = "okay"; + xbar_dspk2_port: port@1f { + reg = <0x1f>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_dspk2_ep: endpoint { + remote-endpoint = <&dspk2_cif_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_sfc1_in_port: port@20 { + reg = <0x20>;
- amx1_in1_ep: endpoint { - remote-endpoint = <&xbar_amx1_in1_ep>; - }; + xbar_sfc1_in_ep: endpoint { + remote-endpoint = <&sfc1_cif_in_ep>; }; + };
- port@1 { - reg = <1>; + port@21 { + reg = <0x21>;
- amx1_in2_ep: endpoint { - remote-endpoint = <&xbar_amx1_in2_ep>; - }; + xbar_sfc1_out_ep: endpoint { + remote-endpoint = <&sfc1_cif_out_ep>; }; + };
- port@2 { - reg = <2>; + xbar_sfc2_in_port: port@22 { + reg = <0x22>;
- amx1_in3_ep: endpoint { - remote-endpoint = <&xbar_amx1_in3_ep>; - }; + xbar_sfc2_in_ep: endpoint { + remote-endpoint = <&sfc2_cif_in_ep>; }; + };
- port@3 { - reg = <3>; + port@23 { + reg = <0x23>;
- amx1_in4_ep: endpoint { - remote-endpoint = <&xbar_amx1_in4_ep>; - }; + xbar_sfc2_out_ep: endpoint { + remote-endpoint = <&sfc2_cif_out_ep>; }; + };
- amx1_out_port: port@4 { - reg = <4>; + xbar_sfc3_in_port: port@24 { + reg = <0x24>;
- amx1_out_ep: endpoint { - remote-endpoint = <&xbar_amx1_out_ep>; - }; + xbar_sfc3_in_ep: endpoint { + remote-endpoint = <&sfc3_cif_in_ep>; }; }; - };
- amx@2903100 { - status = "okay"; + port@25 { + reg = <0x25>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_sfc3_out_ep: endpoint { + remote-endpoint = <&sfc3_cif_out_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_sfc4_in_port: port@26 { + reg = <0x26>;
- amx2_in1_ep: endpoint { - remote-endpoint = <&xbar_amx2_in1_ep>; - }; + xbar_sfc4_in_ep: endpoint { + remote-endpoint = <&sfc4_cif_in_ep>; }; + };
- port@1 { - reg = <1>; + port@27 { + reg = <0x27>;
- amx2_in2_ep: endpoint { - remote-endpoint = <&xbar_amx2_in2_ep>; - }; + xbar_sfc4_out_ep: endpoint { + remote-endpoint = <&sfc4_cif_out_ep>; }; + };
- amx2_in3_port: port@2 { - reg = <2>; + xbar_mvc1_in_port: port@28 { + reg = <0x28>;
- amx2_in3_ep: endpoint { - remote-endpoint = <&xbar_amx2_in3_ep>; - }; + xbar_mvc1_in_ep: endpoint { + remote-endpoint = <&mvc1_cif_in_ep>; }; + };
- amx2_in4_port: port@3 { - reg = <3>; + port@29 { + reg = <0x29>;
- amx2_in4_ep: endpoint { - remote-endpoint = <&xbar_amx2_in4_ep>; - }; + xbar_mvc1_out_ep: endpoint { + remote-endpoint = <&mvc1_cif_out_ep>; }; + };
- amx2_out_port: port@4 { - reg = <4>; + xbar_mvc2_in_port: port@2a { + reg = <0x2a>;
- amx2_out_ep: endpoint { - remote-endpoint = <&xbar_amx2_out_ep>; - }; + xbar_mvc2_in_ep: endpoint { + remote-endpoint = <&mvc2_cif_in_ep>; }; }; - };
- amx@2903200 { - status = "okay"; + port@2b { + reg = <0x2b>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_mvc2_out_ep: endpoint { + remote-endpoint = <&mvc2_cif_out_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_amx1_in1_port: port@2c { + reg = <0x2c>; + + xbar_amx1_in1_ep: endpoint { + remote-endpoint = <&amx1_in1_ep>; + }; + };
- amx3_in1_ep: endpoint { - remote-endpoint = <&xbar_amx3_in1_ep>; - }; + xbar_amx1_in2_port: port@2d { + reg = <0x2d>; + + xbar_amx1_in2_ep: endpoint { + remote-endpoint = <&amx1_in2_ep>; }; + };
- port@1 { - reg = <1>; + xbar_amx1_in3_port: port@2e { + reg = <0x2e>;
- amx3_in2_ep: endpoint { - remote-endpoint = <&xbar_amx3_in2_ep>; - }; + xbar_amx1_in3_ep: endpoint { + remote-endpoint = <&amx1_in3_ep>; }; + };
- port@2 { - reg = <2>; + xbar_amx1_in4_port: port@2f { + reg = <0x2f>;
- amx3_in3_ep: endpoint { - remote-endpoint = <&xbar_amx3_in3_ep>; - }; + xbar_amx1_in4_ep: endpoint { + remote-endpoint = <&amx1_in4_ep>; }; + };
- port@3 { - reg = <3>; + port@30 { + reg = <0x30>;
- amx3_in4_ep: endpoint { - remote-endpoint = <&xbar_amx3_in4_ep>; - }; + xbar_amx1_out_ep: endpoint { + remote-endpoint = <&amx1_out_ep>; }; + };
- amx3_out_port: port@4 { - reg = <4>; + xbar_amx2_in1_port: port@31 { + reg = <0x31>;
- amx3_out_ep: endpoint { - remote-endpoint = <&xbar_amx3_out_ep>; - }; + xbar_amx2_in1_ep: endpoint { + remote-endpoint = <&amx2_in1_ep>; }; }; - };
- amx@2903300 { - status = "okay"; + xbar_amx2_in2_port: port@32 { + reg = <0x32>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx2_in2_ep: endpoint { + remote-endpoint = <&amx2_in2_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_amx2_in3_port: port@33 { + reg = <0x33>;
- amx4_in1_ep: endpoint { - remote-endpoint = <&xbar_amx4_in1_ep>; - }; + xbar_amx2_in3_ep: endpoint { + remote-endpoint = <&amx2_in3_ep>; }; + };
- port@1 { - reg = <1>; + xbar_amx2_in4_port: port@34 { + reg = <0x34>;
- amx4_in2_ep: endpoint { - remote-endpoint = <&xbar_amx4_in2_ep>; - }; + xbar_amx2_in4_ep: endpoint { + remote-endpoint = <&amx2_in4_ep>; }; + };
- port@2 { - reg = <2>; + port@35 { + reg = <0x35>;
- amx4_in3_ep: endpoint { - remote-endpoint = <&xbar_amx4_in3_ep>; - }; + xbar_amx2_out_ep: endpoint { + remote-endpoint = <&amx2_out_ep>; }; + };
- port@3 { - reg = <3>; + xbar_amx3_in1_port: port@36 { + reg = <0x36>;
- amx4_in4_ep: endpoint { - remote-endpoint = <&xbar_amx4_in4_ep>; - }; + xbar_amx3_in1_ep: endpoint { + remote-endpoint = <&amx3_in1_ep>; }; + };
- amx4_out_port: port@4 { - reg = <4>; + xbar_amx3_in2_port: port@37 { + reg = <0x37>;
- amx4_out_ep: endpoint { - remote-endpoint = <&xbar_amx4_out_ep>; - }; + xbar_amx3_in2_ep: endpoint { + remote-endpoint = <&amx3_in2_ep>; }; }; - };
- adx@2903800 { - status = "okay"; + xbar_amx3_in3_port: port@38 { + reg = <0x38>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx3_in3_ep: endpoint { + remote-endpoint = <&amx3_in3_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_amx3_in4_port: port@39 { + reg = <0x39>;
- adx1_in_ep: endpoint { - remote-endpoint = <&xbar_adx1_in_ep>; - }; + xbar_amx3_in4_ep: endpoint { + remote-endpoint = <&amx3_in4_ep>; }; + };
- adx1_out1_port: port@1 { - reg = <1>; + port@3a { + reg = <0x3a>;
- adx1_out1_ep: endpoint { - remote-endpoint = <&xbar_adx1_out1_ep>; - }; + xbar_amx3_out_ep: endpoint { + remote-endpoint = <&amx3_out_ep>; }; + };
- adx1_out2_port: port@2 { - reg = <2>; + xbar_amx4_in1_port: port@3b { + reg = <0x3b>;
- adx1_out2_ep: endpoint { - remote-endpoint = <&xbar_adx1_out2_ep>; - }; + xbar_amx4_in1_ep: endpoint { + remote-endpoint = <&amx4_in1_ep>; }; + };
- adx1_out3_port: port@3 { - reg = <3>; + xbar_amx4_in2_port: port@3c { + reg = <0x3c>;
- adx1_out3_ep: endpoint { - remote-endpoint = <&xbar_adx1_out3_ep>; - }; + xbar_amx4_in2_ep: endpoint { + remote-endpoint = <&amx4_in2_ep>; }; + };
- adx1_out4_port: port@4 { - reg = <4>; + xbar_amx4_in3_port: port@3d { + reg = <0x3d>;
- adx1_out4_ep: endpoint { - remote-endpoint = <&xbar_adx1_out4_ep>; - }; + xbar_amx4_in3_ep: endpoint { + remote-endpoint = <&amx4_in3_ep>; }; }; - };
- adx@2903900 { - status = "okay"; + xbar_amx4_in4_port: port@3e { + reg = <0x3e>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx4_in4_ep: endpoint { + remote-endpoint = <&amx4_in4_ep>; + }; + };
- port@0 { - reg = <0>; + port@3f { + reg = <0x3f>;
- adx2_in_ep: endpoint { - remote-endpoint = <&xbar_adx2_in_ep>; - }; + xbar_amx4_out_ep: endpoint { + remote-endpoint = <&amx4_out_ep>; }; + };
- adx2_out1_port: port@1 { - reg = <1>; + xbar_adx1_in_port: port@40 { + reg = <0x40>;
- adx2_out1_ep: endpoint { - remote-endpoint = <&xbar_adx2_out1_ep>; - }; + xbar_adx1_in_ep: endpoint { + remote-endpoint = <&adx1_in_ep>; }; + };
- adx2_out2_port: port@2 { - reg = <2>; + port@41 { + reg = <0x41>;
- adx2_out2_ep: endpoint { - remote-endpoint = <&xbar_adx2_out2_ep>; - }; + xbar_adx1_out1_ep: endpoint { + remote-endpoint = <&adx1_out1_ep>; }; + };
- adx2_out3_port: port@3 { - reg = <3>; + port@42 { + reg = <0x42>;
- adx2_out3_ep: endpoint { - remote-endpoint = <&xbar_adx2_out3_ep>; - }; + xbar_adx1_out2_ep: endpoint { + remote-endpoint = <&adx1_out2_ep>; }; + };
- adx2_out4_port: port@4 { - reg = <4>; + port@43 { + reg = <0x43>;
- adx2_out4_ep: endpoint { - remote-endpoint = <&xbar_adx2_out4_ep>; - }; + xbar_adx1_out3_ep: endpoint { + remote-endpoint = <&adx1_out3_ep>; }; }; - };
- adx@2903a00 { - status = "okay"; + port@44 { + reg = <0x44>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx1_out4_ep: endpoint { + remote-endpoint = <&adx1_out4_ep>; + }; + };
- port@0 { - reg = <0>; + xbar_adx2_in_port: port@45 { + reg = <0x45>;
- adx3_in_ep: endpoint { - remote-endpoint = <&xbar_adx3_in_ep>; - }; + xbar_adx2_in_ep: endpoint { + remote-endpoint = <&adx2_in_ep>; + }; + }; + + port@46 { + reg = <0x46>; + + xbar_adx2_out1_ep: endpoint { + remote-endpoint = <&adx2_out1_ep>; }; + };
- adx3_out1_port: port@1 { - reg = <1>; + port@47 { + reg = <0x47>;
- adx3_out1_ep: endpoint { - remote-endpoint = <&xbar_adx3_out1_ep>; - }; + xbar_adx2_out2_ep: endpoint { + remote-endpoint = <&adx2_out2_ep>; }; + };
- adx3_out2_port: port@2 { - reg = <2>; + port@48 { + reg = <0x48>;
- adx3_out2_ep: endpoint { - remote-endpoint = <&xbar_adx3_out2_ep>; - }; + xbar_adx2_out3_ep: endpoint { + remote-endpoint = <&adx2_out3_ep>; }; + };
- adx3_out3_port: port@3 { - reg = <3>; + port@49 { + reg = <0x49>;
- adx3_out3_ep: endpoint { - remote-endpoint = <&xbar_adx3_out3_ep>; - }; + xbar_adx2_out4_ep: endpoint { + remote-endpoint = <&adx2_out4_ep>; }; + };
- adx3_out4_port: port@4 { - reg = <4>; + xbar_adx3_in_port: port@4a { + reg = <0x4a>;
- adx3_out4_ep: endpoint { - remote-endpoint = <&xbar_adx3_out4_ep>; - }; + xbar_adx3_in_ep: endpoint { + remote-endpoint = <&adx3_in_ep>; }; }; - };
- adx@2903b00 { - status = "okay"; + port@4b { + reg = <0x4b>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx3_out1_ep: endpoint { + remote-endpoint = <&adx3_out1_ep>; + }; + };
- port@0 { - reg = <0>; + port@4c { + reg = <0x4c>;
- adx4_in_ep: endpoint { - remote-endpoint = <&xbar_adx4_in_ep>; - }; + xbar_adx3_out2_ep: endpoint { + remote-endpoint = <&adx3_out2_ep>; }; + };
- adx4_out1_port: port@1 { - reg = <1>; + port@4d { + reg = <0x4d>;
- adx4_out1_ep: endpoint { - remote-endpoint = <&xbar_adx4_out1_ep>; - }; + xbar_adx3_out3_ep: endpoint { + remote-endpoint = <&adx3_out3_ep>; }; + };
- adx4_out2_port: port@2 { - reg = <2>; + port@4e { + reg = <0x4e>;
- adx4_out2_ep: endpoint { - remote-endpoint = <&xbar_adx4_out2_ep>; - }; + xbar_adx3_out4_ep: endpoint { + remote-endpoint = <&adx3_out4_ep>; }; + };
- adx4_out3_port: port@3 { - reg = <3>; + xbar_adx4_in_port: port@4f { + reg = <0x4f>;
- adx4_out3_ep: endpoint { - remote-endpoint = <&xbar_adx4_out3_ep>; - }; + xbar_adx4_in_ep: endpoint { + remote-endpoint = <&adx4_in_ep>; }; + };
- adx4_out4_port: port@4 { - reg = <4>; + port@50 { + reg = <0x50>;
- adx4_out4_ep: endpoint { - remote-endpoint = <&xbar_adx4_out4_ep>; - }; + xbar_adx4_out1_ep: endpoint { + remote-endpoint = <&adx4_out1_ep>; }; }; - };
- processing-engine@2908000 { - status = "okay"; + port@51 { + reg = <0x51>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx4_out2_ep: endpoint { + remote-endpoint = <&adx4_out2_ep>; + }; + };
- port@0 { - reg = <0x0>; + port@52 { + reg = <0x52>;
- ope1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_ope1_in_ep>; - }; + xbar_adx4_out3_ep: endpoint { + remote-endpoint = <&adx4_out3_ep>; }; + };
- ope1_out_port: port@1 { - reg = <0x1>; + port@53 { + reg = <0x53>;
- ope1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_ope1_out_ep>; - }; + xbar_adx4_out4_ep: endpoint { + remote-endpoint = <&adx4_out4_ep>; }; }; - };
- amixer@290bb00 { - status = "okay"; + xbar_mixer_in1_port: port@54 { + reg = <0x54>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_mixer_in1_ep: endpoint { + remote-endpoint = <&mixer_in1_ep>; + }; + };
- port@0 { - reg = <0x0>; + xbar_mixer_in2_port: port@55 { + reg = <0x55>;
- mixer_in1_ep: endpoint { - remote-endpoint = <&xbar_mixer_in1_ep>; - }; + xbar_mixer_in2_ep: endpoint { + remote-endpoint = <&mixer_in2_ep>; }; + };
- port@1 { - reg = <0x1>; + xbar_mixer_in3_port: port@56 { + reg = <0x56>;
- mixer_in2_ep: endpoint { - remote-endpoint = <&xbar_mixer_in2_ep>; - }; + xbar_mixer_in3_ep: endpoint { + remote-endpoint = <&mixer_in3_ep>; }; + };
- port@2 { - reg = <0x2>; + xbar_mixer_in4_port: port@57 { + reg = <0x57>;
- mixer_in3_ep: endpoint { - remote-endpoint = <&xbar_mixer_in3_ep>; - }; + xbar_mixer_in4_ep: endpoint { + remote-endpoint = <&mixer_in4_ep>; }; + };
- port@3 { - reg = <0x3>; + xbar_mixer_in5_port: port@58 { + reg = <0x58>;
- mixer_in4_ep: endpoint { - remote-endpoint = <&xbar_mixer_in4_ep>; - }; + xbar_mixer_in5_ep: endpoint { + remote-endpoint = <&mixer_in5_ep>; }; + };
- port@4 { - reg = <0x4>; + xbar_mixer_in6_port: port@59 { + reg = <0x59>;
- mixer_in5_ep: endpoint { - remote-endpoint = <&xbar_mixer_in5_ep>; - }; + xbar_mixer_in6_ep: endpoint { + remote-endpoint = <&mixer_in6_ep>; }; + };
- port@5 { - reg = <0x5>; + xbar_mixer_in7_port: port@5a { + reg = <0x5a>;
- mixer_in6_ep: endpoint { - remote-endpoint = <&xbar_mixer_in6_ep>; - }; + xbar_mixer_in7_ep: endpoint { + remote-endpoint = <&mixer_in7_ep>; }; + };
- port@6 { - reg = <0x6>; + xbar_mixer_in8_port: port@5b { + reg = <0x5b>;
- mixer_in7_ep: endpoint { - remote-endpoint = <&xbar_mixer_in7_ep>; - }; + xbar_mixer_in8_ep: endpoint { + remote-endpoint = <&mixer_in8_ep>; }; + };
- port@7 { - reg = <0x7>; + xbar_mixer_in9_port: port@5c { + reg = <0x5c>;
- mixer_in8_ep: endpoint { - remote-endpoint = <&xbar_mixer_in8_ep>; - }; + xbar_mixer_in9_ep: endpoint { + remote-endpoint = <&mixer_in9_ep>; }; + };
- port@8 { - reg = <0x8>; + xbar_mixer_in10_port: port@5d { + reg = <0x5d>;
- mixer_in9_ep: endpoint { - remote-endpoint = <&xbar_mixer_in9_ep>; - }; + xbar_mixer_in10_ep: endpoint { + remote-endpoint = <&mixer_in10_ep>; }; + };
- port@9 { - reg = <0x9>; + port@5e { + reg = <0x5e>;
- mixer_in10_ep: endpoint { - remote-endpoint = <&xbar_mixer_in10_ep>; - }; + xbar_mixer_out1_ep: endpoint { + remote-endpoint = <&mixer_out1_ep>; }; + };
- mixer_out1_port: port@a { - reg = <0xa>; - - mixer_out1_ep: endpoint { - remote-endpoint = <&xbar_mixer_out1_ep>; - }; + port@5f { + reg = <0x5f>; + + xbar_mixer_out2_ep: endpoint { + remote-endpoint = <&mixer_out2_ep>; }; + };
- mixer_out2_port: port@b { - reg = <0xb>; + port@60 { + reg = <0x60>;
- mixer_out2_ep: endpoint { - remote-endpoint = <&xbar_mixer_out2_ep>; - }; + xbar_mixer_out3_ep: endpoint { + remote-endpoint = <&mixer_out3_ep>; }; + };
- mixer_out3_port: port@c { - reg = <0xc>; + port@61 { + reg = <0x61>;
- mixer_out3_ep: endpoint { - remote-endpoint = <&xbar_mixer_out3_ep>; - }; + xbar_mixer_out4_ep: endpoint { + remote-endpoint = <&mixer_out4_ep>; }; + };
- mixer_out4_port: port@d { - reg = <0xd>; + port@62 { + reg = <0x62>;
- mixer_out4_ep: endpoint { - remote-endpoint = <&xbar_mixer_out4_ep>; - }; + xbar_mixer_out5_ep: endpoint { + remote-endpoint = <&mixer_out5_ep>; }; + };
- mixer_out5_port: port@e { - reg = <0xe>; + xbar_asrc_in1_port: port@63 { + reg = <0x63>;
- mixer_out5_ep: endpoint { - remote-endpoint = <&xbar_mixer_out5_ep>; - }; + xbar_asrc_in1_ep: endpoint { + remote-endpoint = <&asrc_in1_ep>; }; }; - };
- asrc@2910000 { - status = "okay"; + port@64 { + reg = <0x64>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_asrc_out1_ep: endpoint { + remote-endpoint = <&asrc_out1_ep>; + }; + };
- port@0 { - reg = <0x0>; + xbar_asrc_in2_port: port@65 { + reg = <0x65>;
- asrc_in1_ep: endpoint { - remote-endpoint = <&xbar_asrc_in1_ep>; - }; + xbar_asrc_in2_ep: endpoint { + remote-endpoint = <&asrc_in2_ep>; }; + };
- port@1 { - reg = <0x1>; + port@66 { + reg = <0x66>;
- asrc_in2_ep: endpoint { - remote-endpoint = <&xbar_asrc_in2_ep>; - }; + xbar_asrc_out2_ep: endpoint { + remote-endpoint = <&asrc_out2_ep>; }; + };
- port@2 { - reg = <0x2>; + xbar_asrc_in3_port: port@67 { + reg = <0x67>;
- asrc_in3_ep: endpoint { - remote-endpoint = <&xbar_asrc_in3_ep>; - }; + xbar_asrc_in3_ep: endpoint { + remote-endpoint = <&asrc_in3_ep>; }; + };
- port@3 { - reg = <0x3>; + port@68 { + reg = <0x68>;
- asrc_in4_ep: endpoint { - remote-endpoint = <&xbar_asrc_in4_ep>; - }; + xbar_asrc_out3_ep: endpoint { + remote-endpoint = <&asrc_out3_ep>; }; + };
- port@4 { - reg = <0x4>; + xbar_asrc_in4_port: port@69 { + reg = <0x69>;
- asrc_in5_ep: endpoint { - remote-endpoint = <&xbar_asrc_in5_ep>; - }; + xbar_asrc_in4_ep: endpoint { + remote-endpoint = <&asrc_in4_ep>; }; + };
- port@5 { - reg = <0x5>; + port@6a { + reg = <0x6a>;
- asrc_in6_ep: endpoint { - remote-endpoint = <&xbar_asrc_in6_ep>; - }; + xbar_asrc_out4_ep: endpoint { + remote-endpoint = <&asrc_out4_ep>; }; + };
- port@6 { - reg = <0x6>; + xbar_asrc_in5_port: port@6b { + reg = <0x6b>;
- asrc_in7_ep: endpoint { - remote-endpoint = <&xbar_asrc_in7_ep>; - }; + xbar_asrc_in5_ep: endpoint { + remote-endpoint = <&asrc_in5_ep>; }; + };
- asrc_out1_port: port@7 { - reg = <0x7>; + port@6c { + reg = <0x6c>;
- asrc_out1_ep: endpoint { - remote-endpoint = <&xbar_asrc_out1_ep>; - }; + xbar_asrc_out5_ep: endpoint { + remote-endpoint = <&asrc_out5_ep>; }; + };
- asrc_out2_port: port@8 { - reg = <0x8>; + xbar_asrc_in6_port: port@6d { + reg = <0x6d>;
- asrc_out2_ep: endpoint { - remote-endpoint = <&xbar_asrc_out2_ep>; - }; + xbar_asrc_in6_ep: endpoint { + remote-endpoint = <&asrc_in6_ep>; }; + };
- asrc_out3_port: port@9 { - reg = <0x9>; + port@6e { + reg = <0x6e>;
- asrc_out3_ep: endpoint { - remote-endpoint = <&xbar_asrc_out3_ep>; - }; + xbar_asrc_out6_ep: endpoint { + remote-endpoint = <&asrc_out6_ep>; }; + };
- asrc_out4_port: port@a { - reg = <0xa>; + xbar_asrc_in7_port: port@6f { + reg = <0x6f>;
- asrc_out4_ep: endpoint { - remote-endpoint = <&xbar_asrc_out4_ep>; - }; + xbar_asrc_in7_ep: endpoint { + remote-endpoint = <&asrc_in7_ep>; }; + };
- asrc_out5_port: port@b { - reg = <0xb>; + xbar_ope1_in_port: port@70 { + reg = <0x70>;
- asrc_out5_ep: endpoint { - remote-endpoint = <&xbar_asrc_out5_ep>; - }; + xbar_ope1_in_ep: endpoint { + remote-endpoint = <&ope1_cif_in_ep>; }; + };
- asrc_out6_port: port@c { - reg = <0xc>; + port@71 { + reg = <0x71>;
- asrc_out6_ep: endpoint { - remote-endpoint = <&xbar_asrc_out6_ep>; - }; + xbar_ope1_out_ep: endpoint { + remote-endpoint = <&ope1_cif_out_ep>; }; }; }; }; - };
- ddc: i2c@3190000 { - status = "okay"; + dma-controller@2930000 { + status = "okay"; + }; + + interrupt-controller@2a40000 { + status = "okay"; + }; };
i2c@3160000 { @@ -2073,6 +2070,26 @@ eeprom@57 { }; };
+ ddc: i2c@3190000 { + status = "okay"; + }; + + spi@3270000 { + status = "okay"; + + flash@0 { + compatible = "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <102000000>; + spi-tx-bus-width = <4>; + spi-rx-bus-width = <4>; + }; + }; + + pwm@32d0000 { + status = "okay"; + }; + hda@3510000 { nvidia,model = "NVIDIA Jetson Xavier NX HDA"; status = "okay"; @@ -2141,15 +2158,6 @@ usb3-2 { }; };
- usb@3610000 { - status = "okay"; - - phys = <&{/bus@0/padctl@3520000/pads/usb2/lanes/usb2-1}>, - <&{/bus@0/padctl@3520000/pads/usb2/lanes/usb2-2}>, - <&{/bus@0/padctl@3520000/pads/usb3/lanes/usb3-2}>; - phy-names = "usb2-1", "usb2-2", "usb3-2"; - }; - usb@3550000 { status = "okay";
@@ -2157,20 +2165,13 @@ usb@3550000 { phy-names = "usb2-0"; };
- spi@3270000 { + usb@3610000 { status = "okay";
- flash@0 { - compatible = "jedec,spi-nor"; - reg = <0>; - spi-max-frequency = <102000000>; - spi-tx-bus-width = <4>; - spi-rx-bus-width = <4>; - }; - }; - - pwm@32d0000 { - status = "okay"; + phys = <&{/bus@0/padctl@3520000/pads/usb2/lanes/usb2-1}>, + <&{/bus@0/padctl@3520000/pads/usb2/lanes/usb2-2}>, + <&{/bus@0/padctl@3520000/pads/usb3/lanes/usb3-2}>; + phy-names = "usb2-1", "usb2-2", "usb3-2"; };
host1x@13e00000 { @@ -2251,14 +2252,6 @@ pcie-ep@141a0000 { }; };
- fan: pwm-fan { - compatible = "pwm-fan"; - pwms = <&pwm6 0 45334>; - - cooling-levels = <0 64 128 255>; - #cooling-cells = <2>; - }; - gpio-keys { compatible = "gpio-keys";
@@ -2283,6 +2276,14 @@ key-power { }; };
+ fan: pwm-fan { + compatible = "pwm-fan"; + pwms = <&pwm6 0 45334>; + + cooling-levels = <0 64 128 255>; + #cooling-cells = <2>; + }; + vdd_5v0_sys: regulator-vdd-5v0-sys { compatible = "regulator-fixed"; regulator-name = "VDD_5V_SYS"; diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi index 0751edddf7d59..58f190b0f8687 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra194-p3668.dtsi @@ -121,6 +121,24 @@ pmic: pmic@3c { pinctrl-names = "default"; pinctrl-0 = <&max20024_default>;
+ fps { + fps0 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,shutdown-fps-time-period-us = <640>; + }; + + fps1 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; + maxim,shutdown-fps-time-period-us = <640>; + maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>; + }; + + fps2 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,shutdown-fps-time-period-us = <640>; + }; + }; + max20024_default: pinmux { gpio0 { pins = "gpio0"; @@ -164,24 +182,6 @@ gpio7 { }; };
- fps { - fps0 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,shutdown-fps-time-period-us = <640>; - }; - - fps1 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; - maxim,shutdown-fps-time-period-us = <640>; - maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>; - }; - - fps2 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,shutdown-fps-time-period-us = <640>; - }; - }; - regulators { in-sd0-supply = <&vdd_5v0_sys>; in-sd1-supply = <&vdd_5v0_sys>; diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi index b941b1c77713c..45a204d753b1b 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi @@ -111,6 +111,34 @@ axi2apb: axi2apb@2390000 { status = "okay"; };
+ pinmux: pinmux@2430000 { + compatible = "nvidia,tegra194-pinmux"; + reg = <0x0 0x2430000 0x0 0x17000>; + status = "okay"; + + pex_clkreq_c5_bi_dir_state: pinmux-pex-clkreq-c5-bi-dir { + clkreq { + nvidia,pins = "pex_l5_clkreq_n_pgg0"; + nvidia,schmitt = <TEGRA_PIN_DISABLE>; + nvidia,enable-input = <TEGRA_PIN_ENABLE>; + nvidia,io-hv = <TEGRA_PIN_ENABLE>; + nvidia,tristate = <TEGRA_PIN_DISABLE>; + nvidia,pull = <TEGRA_PIN_PULL_NONE>; + }; + }; + + pex_rst_c5_out_state: pinmux-pex-rst-c5-out { + pex_rst { + nvidia,pins = "pex_l5_rst_n_pgg1"; + nvidia,schmitt = <TEGRA_PIN_DISABLE>; + nvidia,enable-input = <TEGRA_PIN_DISABLE>; + nvidia,io-hv = <TEGRA_PIN_ENABLE>; + nvidia,tristate = <TEGRA_PIN_DISABLE>; + nvidia,pull = <TEGRA_PIN_PULL_NONE>; + }; + }; + }; + ethernet@2490000 { compatible = "nvidia,tegra194-eqos", "nvidia,tegra186-eqos", @@ -196,64 +224,6 @@ aconnect@2900000 { #size-cells = <2>; ranges = <0x0 0x02900000 0x0 0x02900000 0x0 0x200000>;
- adma: dma-controller@2930000 { - compatible = "nvidia,tegra194-adma", - "nvidia,tegra186-adma"; - reg = <0x0 0x02930000 0x0 0x20000>; - interrupt-parent = <&agic>; - interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>; - #dma-cells = <1>; - clocks = <&bpmp TEGRA194_CLK_AHUB>; - clock-names = "d_audio"; - status = "disabled"; - }; - - agic: interrupt-controller@2a40000 { - compatible = "nvidia,tegra194-agic", - "nvidia,tegra210-agic"; - #interrupt-cells = <3>; - interrupt-controller; - reg = <0x0 0x02a41000 0x0 0x1000>, - <0x0 0x02a42000 0x0 0x2000>; - interrupts = <GIC_SPI 145 - (GIC_CPU_MASK_SIMPLE(4) | - IRQ_TYPE_LEVEL_HIGH)>; - clocks = <&bpmp TEGRA194_CLK_APE>; - clock-names = "clk"; - status = "disabled"; - }; - tegra_ahub: ahub@2900800 { compatible = "nvidia,tegra194-ahub", "nvidia,tegra186-ahub"; @@ -268,57 +238,6 @@ tegra_ahub: ahub@2900800 { #size-cells = <2>; ranges = <0x0 0x02900800 0x0 0x02900800 0x0 0x11800>;
- tegra_admaif: admaif@290f000 { - compatible = "nvidia,tegra194-admaif", - "nvidia,tegra186-admaif"; - reg = <0x0 0x0290f000 0x0 0x1000>; - dmas = <&adma 1>, <&adma 1>, - <&adma 2>, <&adma 2>, - <&adma 3>, <&adma 3>, - <&adma 4>, <&adma 4>, - <&adma 5>, <&adma 5>, - <&adma 6>, <&adma 6>, - <&adma 7>, <&adma 7>, - <&adma 8>, <&adma 8>, - <&adma 9>, <&adma 9>, - <&adma 10>, <&adma 10>, - <&adma 11>, <&adma 11>, - <&adma 12>, <&adma 12>, - <&adma 13>, <&adma 13>, - <&adma 14>, <&adma 14>, - <&adma 15>, <&adma 15>, - <&adma 16>, <&adma 16>, - <&adma 17>, <&adma 17>, - <&adma 18>, <&adma 18>, - <&adma 19>, <&adma 19>, - <&adma 20>, <&adma 20>; - dma-names = "rx1", "tx1", - "rx2", "tx2", - "rx3", "tx3", - "rx4", "tx4", - "rx5", "tx5", - "rx6", "tx6", - "rx7", "tx7", - "rx8", "tx8", - "rx9", "tx9", - "rx10", "tx10", - "rx11", "tx11", - "rx12", "tx12", - "rx13", "tx13", - "rx14", "tx14", - "rx15", "tx15", - "rx16", "tx16", - "rx17", "tx17", - "rx18", "tx18", - "rx19", "tx19", - "rx20", "tx20"; - status = "disabled"; - interconnects = <&mc TEGRA194_MEMORY_CLIENT_APEDMAR &emc>, - <&mc TEGRA194_MEMORY_CLIENT_APEDMAW &emc>; - interconnect-names = "dma-mem", "write"; - iommus = <&smmu TEGRA194_SID_APE>; - }; - tegra_i2s1: i2s@2901000 { compatible = "nvidia,tegra194-i2s", "nvidia,tegra210-i2s"; @@ -403,84 +322,6 @@ tegra_i2s6: i2s@2901500 { status = "disabled"; };
- tegra_dmic1: dmic@2904000 { - compatible = "nvidia,tegra194-dmic", - "nvidia,tegra210-dmic"; - reg = <0x0 0x2904000 0x0 0x100>; - clocks = <&bpmp TEGRA194_CLK_DMIC1>; - clock-names = "dmic"; - assigned-clocks = <&bpmp TEGRA194_CLK_DMIC1>; - assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC1"; - status = "disabled"; - }; - - tegra_dmic2: dmic@2904100 { - compatible = "nvidia,tegra194-dmic", - "nvidia,tegra210-dmic"; - reg = <0x0 0x2904100 0x0 0x100>; - clocks = <&bpmp TEGRA194_CLK_DMIC2>; - clock-names = "dmic"; - assigned-clocks = <&bpmp TEGRA194_CLK_DMIC2>; - assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC2"; - status = "disabled"; - }; - - tegra_dmic3: dmic@2904200 { - compatible = "nvidia,tegra194-dmic", - "nvidia,tegra210-dmic"; - reg = <0x0 0x2904200 0x0 0x100>; - clocks = <&bpmp TEGRA194_CLK_DMIC3>; - clock-names = "dmic"; - assigned-clocks = <&bpmp TEGRA194_CLK_DMIC3>; - assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC3"; - status = "disabled"; - }; - - tegra_dmic4: dmic@2904300 { - compatible = "nvidia,tegra194-dmic", - "nvidia,tegra210-dmic"; - reg = <0x0 0x2904300 0x0 0x100>; - clocks = <&bpmp TEGRA194_CLK_DMIC4>; - clock-names = "dmic"; - assigned-clocks = <&bpmp TEGRA194_CLK_DMIC4>; - assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC4"; - status = "disabled"; - }; - - tegra_dspk1: dspk@2905000 { - compatible = "nvidia,tegra194-dspk", - "nvidia,tegra186-dspk"; - reg = <0x0 0x2905000 0x0 0x100>; - clocks = <&bpmp TEGRA194_CLK_DSPK1>; - clock-names = "dspk"; - assigned-clocks = <&bpmp TEGRA194_CLK_DSPK1>; - assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; - assigned-clock-rates = <12288000>; - sound-name-prefix = "DSPK1"; - status = "disabled"; - }; - - tegra_dspk2: dspk@2905100 { - compatible = "nvidia,tegra194-dspk", - "nvidia,tegra186-dspk"; - reg = <0x0 0x2905100 0x0 0x100>; - clocks = <&bpmp TEGRA194_CLK_DSPK2>; - clock-names = "dspk"; - assigned-clocks = <&bpmp TEGRA194_CLK_DSPK2>; - assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; - assigned-clock-rates = <12288000>; - sound-name-prefix = "DSPK2"; - status = "disabled"; - }; - tegra_sfc1: sfc@2902000 { compatible = "nvidia,tegra194-sfc", "nvidia,tegra210-sfc"; @@ -513,22 +354,6 @@ tegra_sfc4: sfc@2902600 { status = "disabled"; };
- tegra_mvc1: mvc@290a000 { - compatible = "nvidia,tegra194-mvc", - "nvidia,tegra210-mvc"; - reg = <0x0 0x290a000 0x0 0x200>; - sound-name-prefix = "MVC1"; - status = "disabled"; - }; - - tegra_mvc2: mvc@290a200 { - compatible = "nvidia,tegra194-mvc", - "nvidia,tegra210-mvc"; - reg = <0x0 0x290a200 0x0 0x200>; - sound-name-prefix = "MVC2"; - status = "disabled"; - }; - tegra_amx1: amx@2903000 { compatible = "nvidia,tegra194-amx"; reg = <0x0 0x2903000 0x0 0x100>; @@ -589,6 +414,84 @@ tegra_adx4: adx@2903b00 { status = "disabled"; };
+ tegra_dmic1: dmic@2904000 { + compatible = "nvidia,tegra194-dmic", + "nvidia,tegra210-dmic"; + reg = <0x0 0x2904000 0x0 0x100>; + clocks = <&bpmp TEGRA194_CLK_DMIC1>; + clock-names = "dmic"; + assigned-clocks = <&bpmp TEGRA194_CLK_DMIC1>; + assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC1"; + status = "disabled"; + }; + + tegra_dmic2: dmic@2904100 { + compatible = "nvidia,tegra194-dmic", + "nvidia,tegra210-dmic"; + reg = <0x0 0x2904100 0x0 0x100>; + clocks = <&bpmp TEGRA194_CLK_DMIC2>; + clock-names = "dmic"; + assigned-clocks = <&bpmp TEGRA194_CLK_DMIC2>; + assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC2"; + status = "disabled"; + }; + + tegra_dmic3: dmic@2904200 { + compatible = "nvidia,tegra194-dmic", + "nvidia,tegra210-dmic"; + reg = <0x0 0x2904200 0x0 0x100>; + clocks = <&bpmp TEGRA194_CLK_DMIC3>; + clock-names = "dmic"; + assigned-clocks = <&bpmp TEGRA194_CLK_DMIC3>; + assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC3"; + status = "disabled"; + }; + + tegra_dmic4: dmic@2904300 { + compatible = "nvidia,tegra194-dmic", + "nvidia,tegra210-dmic"; + reg = <0x0 0x2904300 0x0 0x100>; + clocks = <&bpmp TEGRA194_CLK_DMIC4>; + clock-names = "dmic"; + assigned-clocks = <&bpmp TEGRA194_CLK_DMIC4>; + assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC4"; + status = "disabled"; + }; + + tegra_dspk1: dspk@2905000 { + compatible = "nvidia,tegra194-dspk", + "nvidia,tegra186-dspk"; + reg = <0x0 0x2905000 0x0 0x100>; + clocks = <&bpmp TEGRA194_CLK_DSPK1>; + clock-names = "dspk"; + assigned-clocks = <&bpmp TEGRA194_CLK_DSPK1>; + assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; + assigned-clock-rates = <12288000>; + sound-name-prefix = "DSPK1"; + status = "disabled"; + }; + + tegra_dspk2: dspk@2905100 { + compatible = "nvidia,tegra194-dspk", + "nvidia,tegra186-dspk"; + reg = <0x0 0x2905100 0x0 0x100>; + clocks = <&bpmp TEGRA194_CLK_DSPK2>; + clock-names = "dspk"; + assigned-clocks = <&bpmp TEGRA194_CLK_DSPK2>; + assigned-clock-parents = <&bpmp TEGRA194_CLK_PLLA_OUT0>; + assigned-clock-rates = <12288000>; + sound-name-prefix = "DSPK2"; + status = "disabled"; + }; + tegra_ope1: processing-engine@2908000 { compatible = "nvidia,tegra194-ope", "nvidia,tegra210-ope"; @@ -613,6 +516,22 @@ dynamic-range-compressor@2908200 { }; };
+ tegra_mvc1: mvc@290a000 { + compatible = "nvidia,tegra194-mvc", + "nvidia,tegra210-mvc"; + reg = <0x0 0x290a000 0x0 0x200>; + sound-name-prefix = "MVC1"; + status = "disabled"; + }; + + tegra_mvc2: mvc@290a200 { + compatible = "nvidia,tegra194-mvc", + "nvidia,tegra210-mvc"; + reg = <0x0 0x290a200 0x0 0x200>; + sound-name-prefix = "MVC2"; + status = "disabled"; + }; + tegra_amixer: amixer@290bb00 { compatible = "nvidia,tegra194-amixer", "nvidia,tegra210-amixer"; @@ -621,6 +540,57 @@ tegra_amixer: amixer@290bb00 { status = "disabled"; };
+ tegra_admaif: admaif@290f000 { + compatible = "nvidia,tegra194-admaif", + "nvidia,tegra186-admaif"; + reg = <0x0 0x0290f000 0x0 0x1000>; + dmas = <&adma 1>, <&adma 1>, + <&adma 2>, <&adma 2>, + <&adma 3>, <&adma 3>, + <&adma 4>, <&adma 4>, + <&adma 5>, <&adma 5>, + <&adma 6>, <&adma 6>, + <&adma 7>, <&adma 7>, + <&adma 8>, <&adma 8>, + <&adma 9>, <&adma 9>, + <&adma 10>, <&adma 10>, + <&adma 11>, <&adma 11>, + <&adma 12>, <&adma 12>, + <&adma 13>, <&adma 13>, + <&adma 14>, <&adma 14>, + <&adma 15>, <&adma 15>, + <&adma 16>, <&adma 16>, + <&adma 17>, <&adma 17>, + <&adma 18>, <&adma 18>, + <&adma 19>, <&adma 19>, + <&adma 20>, <&adma 20>; + dma-names = "rx1", "tx1", + "rx2", "tx2", + "rx3", "tx3", + "rx4", "tx4", + "rx5", "tx5", + "rx6", "tx6", + "rx7", "tx7", + "rx8", "tx8", + "rx9", "tx9", + "rx10", "tx10", + "rx11", "tx11", + "rx12", "tx12", + "rx13", "tx13", + "rx14", "tx14", + "rx15", "tx15", + "rx16", "tx16", + "rx17", "tx17", + "rx18", "tx18", + "rx19", "tx19", + "rx20", "tx20"; + status = "disabled"; + interconnects = <&mc TEGRA194_MEMORY_CLIENT_APEDMAR &emc>, + <&mc TEGRA194_MEMORY_CLIENT_APEDMAW &emc>; + interconnect-names = "dma-mem", "write"; + iommus = <&smmu TEGRA194_SID_APE>; + }; + tegra_asrc: asrc@2910000 { compatible = "nvidia,tegra194-asrc", "nvidia,tegra186-asrc"; @@ -629,33 +599,63 @@ tegra_asrc: asrc@2910000 { status = "disabled"; }; }; - };
- pinmux: pinmux@2430000 { - compatible = "nvidia,tegra194-pinmux"; - reg = <0x0 0x2430000 0x0 0x17000>; - status = "okay"; - - pex_rst_c5_out_state: pinmux-pex-rst-c5-out { - pex_rst { - nvidia,pins = "pex_l5_rst_n_pgg1"; - nvidia,schmitt = <TEGRA_PIN_DISABLE>; - nvidia,enable-input = <TEGRA_PIN_DISABLE>; - nvidia,io-hv = <TEGRA_PIN_ENABLE>; - nvidia,tristate = <TEGRA_PIN_DISABLE>; - nvidia,pull = <TEGRA_PIN_PULL_NONE>; - }; + adma: dma-controller@2930000 { + compatible = "nvidia,tegra194-adma", + "nvidia,tegra186-adma"; + reg = <0x0 0x02930000 0x0 0x20000>; + interrupt-parent = <&agic>; + interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 16 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>; + #dma-cells = <1>; + clocks = <&bpmp TEGRA194_CLK_AHUB>; + clock-names = "d_audio"; + status = "disabled"; };
- clkreq_c5_bi_dir_state: pinmux-clkreq-c5-bi-dir { - clkreq { - nvidia,pins = "pex_l5_clkreq_n_pgg0"; - nvidia,schmitt = <TEGRA_PIN_DISABLE>; - nvidia,enable-input = <TEGRA_PIN_ENABLE>; - nvidia,io-hv = <TEGRA_PIN_ENABLE>; - nvidia,tristate = <TEGRA_PIN_DISABLE>; - nvidia,pull = <TEGRA_PIN_PULL_NONE>; - }; + agic: interrupt-controller@2a40000 { + compatible = "nvidia,tegra194-agic", + "nvidia,tegra210-agic"; + #interrupt-cells = <3>; + interrupt-controller; + reg = <0x0 0x02a41000 0x0 0x1000>, + <0x0 0x02a42000 0x0 0x2000>; + interrupts = <GIC_SPI 145 + (GIC_CPU_MASK_SIMPLE(4) | + IRQ_TYPE_LEVEL_HIGH)>; + clocks = <&bpmp TEGRA194_CLK_APE>; + clock-names = "clk"; + status = "disabled"; }; };
@@ -942,19 +942,6 @@ spi@3270000 { status = "disabled"; };
- spi@3300000 { - compatible = "nvidia,tegra194-qspi"; - reg = <0x0 0x3300000 0x0 0x1000>; - interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>; - #address-cells = <1>; - #size-cells = <0>; - clocks = <&bpmp TEGRA194_CLK_QSPI1>, - <&bpmp TEGRA194_CLK_QSPI1_PM>; - clock-names = "qspi", "qspi_out"; - resets = <&bpmp TEGRA194_RESET_QSPI1>; - status = "disabled"; - }; - pwm1: pwm@3280000 { compatible = "nvidia,tegra194-pwm", "nvidia,tegra186-pwm"; @@ -1032,6 +1019,19 @@ pwm8: pwm@32f0000 { #pwm-cells = <2>; };
+ spi@3300000 { + compatible = "nvidia,tegra194-qspi"; + reg = <0x0 0x3300000 0x0 0x1000>; + interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>; + #address-cells = <1>; + #size-cells = <0>; + clocks = <&bpmp TEGRA194_CLK_QSPI1>, + <&bpmp TEGRA194_CLK_QSPI1_PM>; + clock-names = "qspi", "qspi_out"; + resets = <&bpmp TEGRA194_RESET_QSPI1>; + status = "disabled"; + }; + sdmmc1: mmc@3400000 { compatible = "nvidia,tegra194-sdhci"; reg = <0x0 0x03400000 0x0 0x10000>; @@ -1707,17 +1707,14 @@ pmc: pmc@c360000 {
#interrupt-cells = <2>; interrupt-controller; - sdmmc1_3v3: sdmmc1-3v3 { - pins = "sdmmc1-hv"; - power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; - };
sdmmc1_1v8: sdmmc1-1v8 { pins = "sdmmc1-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; }; - sdmmc3_3v3: sdmmc3-3v3 { - pins = "sdmmc3-hv"; + + sdmmc1_3v3: sdmmc1-3v3 { + pins = "sdmmc1-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; };
@@ -1726,6 +1723,10 @@ sdmmc3_1v8: sdmmc3-1v8 { power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; };
+ sdmmc3_3v3: sdmmc3-3v3 { + pins = "sdmmc3-hv"; + power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; + }; };
aon-noc@c600000 { @@ -2373,10 +2374,10 @@ sor3: sor@15bc0000 { pcie@14100000 { compatible = "nvidia,tegra194-pcie"; power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; - reg = <0x0 0x14100000 0x0 0x00020000>, /* appl registers (128K) */ - <0x0 0x30000000 0x0 0x00040000>, /* configuration space (256K) */ - <0x0 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ - <0x0 0x30080000 0x0 0x00040000>; /* DBI reg space (256K) */ + reg = <0x00 0x14100000 0x0 0x00020000>, /* appl registers (128K) */ + <0x00 0x30000000 0x0 0x00040000>, /* configuration space (256K) */ + <0x00 0x30040000 0x0 0x00040000>, /* iATU_DMA reg space (256K) */ + <0x00 0x30080000 0x0 0x00040000>; /* DBI reg space (256K) */ reg-names = "appl", "config", "atu_dma", "dbi";
status = "disabled"; @@ -2726,7 +2727,7 @@ pcie@141a0000 { linux,pci-domain = <5>;
pinctrl-names = "default"; - pinctrl-0 = <&pex_rst_c5_out_state>, <&clkreq_c5_bi_dir_state>; + pinctrl-0 = <&pex_rst_c5_out_state>, <&pex_clkreq_c5_bi_dir_state>;
clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>; clock-names = "core"; @@ -2779,7 +2780,7 @@ pcie-ep@141a0000 { num-ob-windows = <8>;
pinctrl-names = "default"; - pinctrl-0 = <&clkreq_c5_bi_dir_state>; + pinctrl-0 = <&pex_clkreq_c5_bi_dir_state>;
clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>; clock-names = "core"; @@ -3121,6 +3122,13 @@ psci { method = "smc"; };
+ tcu: serial { + compatible = "nvidia,tegra194-tcu"; + mboxes = <&hsp_top0 TEGRA_HSP_MBOX_TYPE_SM TEGRA_HSP_SM_RX(0)>, + <&hsp_aon TEGRA_HSP_MBOX_TYPE_SM TEGRA_HSP_SM_TX(1)>; + mbox-names = "rx", "tx"; + }; + sound { status = "disabled";
@@ -3141,13 +3149,6 @@ sound { assigned-clock-rates = <258000000>; };
- tcu: serial { - compatible = "nvidia,tegra194-tcu"; - mboxes = <&hsp_top0 TEGRA_HSP_MBOX_TYPE_SM TEGRA_HSP_SM_RX(0)>, - <&hsp_aon TEGRA_HSP_MBOX_TYPE_SM TEGRA_HSP_SM_TX(1)>; - mbox-names = "rx", "tx"; - }; - thermal-zones { cpu-thermal { thermal-sensors = <&{/bpmp/thermal} TEGRA194_BPMP_THERMAL_ZONE_CPU>; diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi index 75eb743a72427..92163b6809801 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi @@ -31,6 +31,23 @@ serial@70006000 { status = "okay"; };
+ i2c@7000c500 { + status = "okay"; + + /* module ID EEPROM */ + eeprom@50 { + compatible = "atmel,24c02"; + reg = <0x50>; + + label = "module"; + vcc-supply = <&vdd_1v8>; + address-width = <8>; + pagesize = <8>; + size = <256>; + read-only; + }; + }; + i2c@7000d000 { status = "okay"; clock-frequency = <400000>; @@ -50,6 +67,22 @@ pmic: pmic@3c { pinctrl-names = "default"; pinctrl-0 = <&max77620_default>;
+ fps { + fps0 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,suspend-fps-time-period-us = <1280>; + }; + + fps1 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; + maxim,suspend-fps-time-period-us = <1280>; + }; + + fps2 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + }; + }; + max77620_default: pinmux { gpio0 { pins = "gpio0"; @@ -84,22 +117,6 @@ gpio5_6_7 { }; };
- fps { - fps0 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,suspend-fps-time-period-us = <1280>; - }; - - fps1 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; - maxim,suspend-fps-time-period-us = <1280>; - }; - - fps2 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - }; - }; - regulators { in-ldo0-1-supply = <&vdd_pre>; in-ldo7-8-supply = <&vdd_pre>; @@ -265,23 +282,6 @@ avdd_1v05: ldo8 { }; };
- i2c@7000c500 { - status = "okay"; - - /* module ID EEPROM */ - eeprom@50 { - compatible = "atmel,24c02"; - reg = <0x50>; - - label = "module"; - vcc-supply = <&vdd_1v8>; - address-width = <8>; - pagesize = <8>; - size = <256>; - read-only; - }; - }; - pmc@7000e400 { nvidia,invert-interrupt; nvidia,suspend-mode = <0>; diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts b/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts index 1e26ca91a9449..38f4ff229beff 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts +++ b/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts @@ -63,17 +63,17 @@ backlight: backlight@2c { pwms = <&pwm 0 29334>; pwm-names = "lp8557";
- /* 3 LED string */ - rom_14h { - rom-addr = /bits/ 8 <0x14>; - rom-val = /bits/ 8 <0x87>; - }; - /* boost frequency 1 MHz */ rom_13h { rom-addr = /bits/ 8 <0x13>; rom-val = /bits/ 8 <0x01>; }; + + /* 3 LED string */ + rom_14h { + rom-addr = /bits/ 8 <0x14>; + rom-val = /bits/ 8 <0x87>; + }; }; };
@@ -116,14 +116,6 @@ clock@70110000 { aconnect@702c0000 { status = "okay";
- dma-controller@702e2000 { - status = "okay"; - }; - - interrupt-controller@702f9000 { - status = "okay"; - }; - ahub@702d0800 { status = "okay";
@@ -261,81 +253,6 @@ i2s5_dap_ep: endpoint { }; };
- dmic@702d4000 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - dmic1_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic1_ep>; - }; - }; - - dmic1_port: port@1 { - reg = <1>; - - dmic1_dap_ep: endpoint { - /* Placeholder for external Codec */ - }; - }; - }; - }; - - dmic@702d4100 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - dmic2_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic2_ep>; - }; - }; - - dmic2_port: port@1 { - reg = <1>; - - dmic2_dap_ep: endpoint { - /* Placeholder for external Codec */ - }; - }; - }; - }; - - dmic@702d4200 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - dmic3_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic3_ep>; - }; - }; - - dmic3_port: port@1 { - reg = <1>; - - dmic3_dap_ep: endpoint { - /* Placeholder for external Codec */ - }; - }; - }; - }; - sfc@702d2000 { status = "okay";
@@ -436,56 +353,6 @@ sfc4_cif_out_ep: endpoint { }; };
- mvc@702da000 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - mvc1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc1_in_ep>; - }; - }; - - mvc1_out_port: port@1 { - reg = <1>; - - mvc1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc1_out_ep>; - }; - }; - }; - }; - - mvc@702da200 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - mvc2_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc2_in_ep>; - }; - }; - - mvc2_out_port: port@1 { - reg = <1>; - - mvc2_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc2_out_ep>; - }; - }; - }; - }; - amx@702d3000 { status = "okay";
@@ -682,6 +549,81 @@ adx2_out4_ep: endpoint { }; };
+ dmic@702d4000 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + dmic1_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic1_ep>; + }; + }; + + dmic1_port: port@1 { + reg = <1>; + + dmic1_dap_ep: endpoint { + /* Placeholder for external Codec */ + }; + }; + }; + }; + + dmic@702d4100 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + dmic2_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic2_ep>; + }; + }; + + dmic2_port: port@1 { + reg = <1>; + + dmic2_dap_ep: endpoint { + /* Placeholder for external Codec */ + }; + }; + }; + }; + + dmic@702d4200 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + dmic3_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic3_ep>; + }; + }; + + dmic3_port: port@1 { + reg = <1>; + + dmic3_dap_ep: endpoint { + /* Placeholder for external Codec */ + }; + }; + }; + }; + processing-engine@702d8000 { status = "okay";
@@ -732,6 +674,56 @@ ope2_cif_out_ep: endpoint { }; };
+ mvc@702da000 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + mvc1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc1_in_ep>; + }; + }; + + mvc1_out_port: port@1 { + reg = <1>; + + mvc1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc1_out_ep>; + }; + }; + }; + }; + + mvc@702da200 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + mvc2_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc2_in_ep>; + }; + }; + + mvc2_out_port: port@1 { + reg = <1>; + + mvc2_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc2_out_ep>; + }; + }; + }; + }; + amixer@702dbb00 { status = "okay";
@@ -1335,6 +1327,14 @@ xbar_ope2_out_ep: endpoint { }; }; }; + + dma-controller@702e2000 { + status = "okay"; + }; + + interrupt-controller@702f9000 { + status = "okay"; + }; };
sound { diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi index 6ae292da72949..65181da730fa6 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra210-p2595.dtsi @@ -1,4 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 + +#include <dt-bindings/pinctrl/pinctrl-tegra.h> + / { model = "NVIDIA Tegra210 P2595 I/O board"; compatible = "nvidia,p2595", "nvidia,tegra210"; diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi index a87e103f3828d..b4a1108c2dd74 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi @@ -1,5 +1,8 @@ // SPDX-License-Identifier: GPL-2.0 + +#include <dt-bindings/gpio/tegra-gpio.h> #include <dt-bindings/input/input.h> +#include <dt-bindings/pinctrl/pinctrl-tegra.h>
/ { model = "NVIDIA Tegra210 P2597 I/O board"; diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi index 8e657b10569d6..1f263fd32a7a0 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra210-p2894.dtsi @@ -1342,7 +1342,35 @@ pmic: pmic@3c { pinctrl-names = "default"; pinctrl-0 = <&max77620_default>;
- max77620_default: pinmux@0 { + fps { + #address-cells = <1>; + #size-cells = <0>; + + fps0 { + reg = <0>; + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + }; + + fps1 { + reg = <1>; + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; + maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>; + }; + + fps2 { + reg = <2>; + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + }; + }; + + hog-0 { + gpio-hog; + output-high; + gpios = <2 GPIO_ACTIVE_HIGH>, + <7 GPIO_ACTIVE_HIGH>; + }; + + max77620_default: pinmux { gpio0 { pins = "gpio0"; function = "gpio"; @@ -1383,34 +1411,6 @@ gpio5_6_7 { }; };
- hog-0 { - gpio-hog; - output-high; - gpios = <2 GPIO_ACTIVE_HIGH>, - <7 GPIO_ACTIVE_HIGH>; - }; - - fps { - #address-cells = <1>; - #size-cells = <0>; - - fps0 { - reg = <0>; - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - }; - - fps1 { - reg = <1>; - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; - maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>; - }; - - fps2 { - reg = <2>; - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - }; - }; - regulators { in-ldo0-1-supply = <&max77620_sd2>; in-ldo7-8-supply = <&max77620_sd2>; @@ -1592,20 +1592,6 @@ clk32k_in: clock-32k { #clock-cells = <0>; };
- gpio-keys { - compatible = "gpio-keys"; - status = "okay"; - - key-power { - debounce-interval = <30>; - gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>; - label = "Power"; - linux,code = <KEY_POWER>; - wakeup-event-action = <EV_ACT_ASSERTED>; - wakeup-source; - }; - }; - cpus { cpu@0 { enable-method = "psci"; @@ -1630,6 +1616,20 @@ cpu-sleep { }; };
+ gpio-keys { + compatible = "gpio-keys"; + status = "okay"; + + key-power { + debounce-interval = <30>; + gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>; + label = "Power"; + linux,code = <KEY_POWER>; + wakeup-event-action = <EV_ACT_ASSERTED>; + wakeup-source; + }; + }; + psci { compatible = "arm,psci-1.0"; method = "smc"; diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts b/arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts index 2041371ea7ff8..c9f488e14f377 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts +++ b/arch/arm64/boot/dts/nvidia/tegra210-p3450-0000.dts @@ -186,6 +186,22 @@ pmic: pmic@3c { pinctrl-names = "default"; pinctrl-0 = <&max77620_default>;
+ fps { + fps0 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + maxim,suspend-fps-time-period-us = <5120>; + }; + + fps1 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; + maxim,suspend-fps-time-period-us = <5120>; + }; + + fps2 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + }; + }; + max77620_default: pinmux { gpio0 { pins = "gpio0"; @@ -231,22 +247,6 @@ gpio5_6_7 { }; };
- fps { - fps0 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - maxim,suspend-fps-time-period-us = <5120>; - }; - - fps1 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; - maxim,suspend-fps-time-period-us = <5120>; - }; - - fps2 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - }; - }; - regulators { in-ldo0-1-supply = <&vdd_pre>; in-ldo2-supply = <&vdd_3v3_sys>; @@ -611,14 +611,6 @@ clock@70110000 { aconnect@702c0000 { status = "okay";
- dma-controller@702e2000 { - status = "okay"; - }; - - interrupt-controller@702f9000 { - status = "okay"; - }; - ahub@702d0800 { status = "okay";
@@ -678,56 +670,6 @@ i2s4_dap_ep: endpoint { }; };
- dmic@702d4000 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - dmic1_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic1_ep>; - }; - }; - - dmic1_port: port@1 { - reg = <1>; - - dmic1_dap_ep: endpoint { - /* Placeholder for external Codec */ - }; - }; - }; - }; - - dmic@702d4100 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - dmic2_cif_ep: endpoint { - remote-endpoint = <&xbar_dmic2_ep>; - }; - }; - - dmic2_port: port@1 { - reg = <1>; - - dmic2_dap_ep: endpoint { - /* Placeholder for external Codec */ - }; - }; - }; - }; - sfc@702d2000 { status = "okay";
@@ -828,56 +770,6 @@ sfc4_cif_out_ep: endpoint { }; };
- mvc@702da000 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - mvc1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc1_in_ep>; - }; - }; - - mvc1_out_port: port@1 { - reg = <1>; - - mvc1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc1_out_ep>; - }; - }; - }; - }; - - mvc@702da200 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>; - - port@0 { - reg = <0>; - - mvc2_cif_in_ep: endpoint { - remote-endpoint = <&xbar_mvc2_in_ep>; - }; - }; - - mvc2_out_port: port@1 { - reg = <1>; - - mvc2_cif_out_ep: endpoint { - remote-endpoint = <&xbar_mvc2_out_ep>; - }; - }; - }; - }; - amx@702d3000 { status = "okay";
@@ -1074,6 +966,56 @@ adx2_out4_ep: endpoint { }; };
+ dmic@702d4000 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + dmic1_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic1_ep>; + }; + }; + + dmic1_port: port@1 { + reg = <1>; + + dmic1_dap_ep: endpoint { + /* Placeholder for external Codec */ + }; + }; + }; + }; + + dmic@702d4100 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + dmic2_cif_ep: endpoint { + remote-endpoint = <&xbar_dmic2_ep>; + }; + }; + + dmic2_port: port@1 { + reg = <1>; + + dmic2_dap_ep: endpoint { + /* Placeholder for external Codec */ + }; + }; + }; + }; + processing-engine@702d8000 { status = "okay";
@@ -1124,6 +1066,56 @@ ope2_cif_out_ep: endpoint { }; };
+ mvc@702da000 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + mvc1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc1_in_ep>; + }; + }; + + mvc1_out_port: port@1 { + reg = <1>; + + mvc1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc1_out_ep>; + }; + }; + }; + }; + + mvc@702da200 { + status = "okay"; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + + mvc2_cif_in_ep: endpoint { + remote-endpoint = <&xbar_mvc2_in_ep>; + }; + }; + + mvc2_out_port: port@1 { + reg = <1>; + + mvc2_cif_out_ep: endpoint { + remote-endpoint = <&xbar_mvc2_out_ep>; + }; + }; + }; + }; + amixer@702dbb00 { status = "okay";
@@ -1695,6 +1687,14 @@ xbar_ope2_out_ep: endpoint { }; }; }; + + dma-controller@702e2000 { + status = "okay"; + }; + + interrupt-controller@702f9000 { + status = "okay"; + }; };
spi@70410000 { @@ -1739,69 +1739,17 @@ cpu-sleep { }; };
- fan: pwm-fan { - compatible = "pwm-fan"; - pwms = <&pwm 3 45334>; - - cooling-levels = <0 64 128 255>; - #cooling-cells = <2>; - }; - - thermal-zones { - cpu-thermal { - trips { - cpu_trip_critical: critical { - temperature = <96500>; - hysteresis = <0>; - type = "critical"; - }; - - cpu_trip_hot: hot { - temperature = <70000>; - hysteresis = <2000>; - type = "hot"; - }; - - cpu_trip_active: active { - temperature = <50000>; - hysteresis = <2000>; - type = "active"; - }; - - cpu_trip_passive: passive { - temperature = <30000>; - hysteresis = <2000>; - type = "passive"; - }; - }; - - cooling-maps { - cpu-critical { - cooling-device = <&fan 3 3>; - trip = <&cpu_trip_critical>; - }; - - cpu-hot { - cooling-device = <&fan 2 2>; - trip = <&cpu_trip_hot>; - }; - - cpu-active { - cooling-device = <&fan 1 1>; - trip = <&cpu_trip_active>; - }; - - cpu-passive { - cooling-device = <&fan 0 0>; - trip = <&cpu_trip_passive>; - }; - }; - }; - }; - gpio-keys { compatible = "gpio-keys";
+ key-force-recovery { + label = "Force Recovery"; + gpios = <&gpio TEGRA_GPIO(X, 6) GPIO_ACTIVE_LOW>; + linux,input-type = <EV_KEY>; + linux,code = <BTN_1>; + debounce-interval = <30>; + }; + key-power { label = "Power"; gpios = <&gpio TEGRA_GPIO(X, 5) GPIO_ACTIVE_LOW>; @@ -1811,14 +1759,6 @@ key-power { wakeup-event-action = <EV_ACT_ASSERTED>; wakeup-source; }; - - key-force-recovery { - label = "Force Recovery"; - gpios = <&gpio TEGRA_GPIO(X, 6) GPIO_ACTIVE_LOW>; - linux,input-type = <EV_KEY>; - linux,code = <BTN_1>; - debounce-interval = <30>; - }; };
psci { @@ -1826,6 +1766,14 @@ psci { method = "smc"; };
+ fan: pwm-fan { + compatible = "pwm-fan"; + pwms = <&pwm 3 45334>; + + cooling-levels = <0 64 128 255>; + #cooling-cells = <2>; + }; + vdd_5v0_sys: regulator-vdd-5v0-sys { compatible = "regulator-fixed";
@@ -1986,4 +1934,56 @@ sound {
label = "NVIDIA Jetson Nano APE"; }; + + thermal-zones { + cpu-thermal { + trips { + cpu_trip_critical: critical { + temperature = <96500>; + hysteresis = <0>; + type = "critical"; + }; + + cpu_trip_hot: hot { + temperature = <70000>; + hysteresis = <2000>; + type = "hot"; + }; + + cpu_trip_active: active { + temperature = <50000>; + hysteresis = <2000>; + type = "active"; + }; + + cpu_trip_passive: passive { + temperature = <30000>; + hysteresis = <2000>; + type = "passive"; + }; + }; + + cooling-maps { + cpu-critical { + cooling-device = <&fan 3 3>; + trip = <&cpu_trip_critical>; + }; + + cpu-hot { + cooling-device = <&fan 2 2>; + trip = <&cpu_trip_hot>; + }; + + cpu-active { + cooling-device = <&fan 1 1>; + trip = <&cpu_trip_active>; + }; + + cpu-passive { + cooling-device = <&fan 0 0>; + trip = <&cpu_trip_passive>; + }; + }; + }; + }; }; diff --git a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts index 7c569695b7052..d7d7c63e62e25 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts +++ b/arch/arm64/boot/dts/nvidia/tegra210-smaug.dts @@ -1389,6 +1389,23 @@ pmic: pmic@3c { pinctrl-names = "default"; pinctrl-0 = <&max77620_default>;
+ fps { + fps0 { + maxim,shutdown-fps-time-period-us = <5120>; + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + }; + + fps1 { + maxim,shutdown-fps-time-period-us = <5120>; + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; + maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>; + }; + + fps2 { + maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + }; + }; + max77620_default: pinmux { gpio0_1_2_7 { pins = "gpio0", "gpio1", "gpio2", "gpio7"; @@ -1409,32 +1426,15 @@ gpio3 { maxim,active-fps-power-down-slot = <2>; };
- gpio5_6 { - pins = "gpio5", "gpio6"; - function = "gpio"; - drive-push-pull = <1>; - }; - gpio4 { pins = "gpio4"; function = "32k-out1"; }; - }; - - fps { - fps0 { - maxim,shutdown-fps-time-period-us = <5120>; - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; - }; - - fps1 { - maxim,shutdown-fps-time-period-us = <5120>; - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN1>; - maxim,device-state-on-disabled-event = <MAX77620_FPS_INACTIVE_STATE_SLEEP>; - };
- fps2 { - maxim,fps-event-source = <MAX77620_FPS_EVENT_SRC_EN0>; + gpio5_6 { + pins = "gpio5", "gpio6"; + function = "gpio"; + drive-push-pull = <1>; }; };
@@ -1800,6 +1800,18 @@ key-power { wakeup-source; };
+ key-volume-down { + label = "Volume Down"; + gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>; + linux,code = <KEY_VOLUMEDOWN>; + }; + + key-volume-up { + label = "Volume Up"; + gpios = <&gpio TEGRA_GPIO(M, 4) GPIO_ACTIVE_LOW>; + linux,code = <KEY_VOLUMEUP>; + }; + switch-lid { label = "Lid"; gpios = <&gpio TEGRA_GPIO(B, 4) GPIO_ACTIVE_LOW>; @@ -1815,18 +1827,6 @@ switch-tablet-mode { linux,code = <SW_TABLET_MODE>; wakeup-source; }; - - key-volume-down { - label = "Volume Down"; - gpios = <&gpio TEGRA_GPIO(X, 7) GPIO_ACTIVE_LOW>; - linux,code = <KEY_VOLUMEDOWN>; - }; - - key-volume-up { - label = "Volume Up"; - gpios = <&gpio TEGRA_GPIO(M, 4) GPIO_ACTIVE_LOW>; - linux,code = <KEY_VOLUMEUP>; - }; };
max98357a { diff --git a/arch/arm64/boot/dts/nvidia/tegra210.dtsi b/arch/arm64/boot/dts/nvidia/tegra210.dtsi index bc0cacb20d7a3..980565bf02c9d 100644 --- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi @@ -555,19 +555,19 @@ pinmux: pinmux@700008d4 { reg = <0x0 0x700008d4 0x0 0x29c>, /* Pad control registers */ <0x0 0x70003000 0x0 0x294>; /* Mux registers */
- sdmmc1_3v3_drv: pinmux-sdmmc1-3v3-drv { + sdmmc1_1v8_drv: pinmux-sdmmc1-1v8-drv { sdmmc1 { nvidia,pins = "drive_sdmmc1"; - nvidia,pull-down-strength = <0x8>; - nvidia,pull-up-strength = <0x8>; + nvidia,pull-down-strength = <0x4>; + nvidia,pull-up-strength = <0x3>; }; };
- sdmmc1_1v8_drv: pinmux-sdmmc1-1v8-drv { + sdmmc1_3v3_drv: pinmux-sdmmc1-3v3-drv { sdmmc1 { nvidia,pins = "drive_sdmmc1"; - nvidia,pull-down-strength = <0x4>; - nvidia,pull-up-strength = <0x3>; + nvidia,pull-down-strength = <0x8>; + nvidia,pull-up-strength = <0x8>; }; };
@@ -579,19 +579,19 @@ sdmmc2 { }; };
- sdmmc3_3v3_drv: pinmux-sdmmc3-3v3-drv { + sdmmc3_1v8_drv: pinmux-sdmmc3-1v8-drv { sdmmc3 { nvidia,pins = "drive_sdmmc3"; - nvidia,pull-down-strength = <0x8>; - nvidia,pull-up-strength = <0x8>; + nvidia,pull-down-strength = <0x4>; + nvidia,pull-up-strength = <0x3>; }; };
- sdmmc3_1v8_drv: pinmux-sdmmc3-1v8-drv { + sdmmc3_3v3_drv: pinmux-sdmmc3-3v3-drv { sdmmc3 { nvidia,pins = "drive_sdmmc3"; - nvidia,pull-down-strength = <0x4>; - nvidia,pull-up-strength = <0x3>; + nvidia,pull-down-strength = <0x8>; + nvidia,pull-up-strength = <0x8>; }; };
@@ -852,6 +852,38 @@ tegra_pmc: pmc@7000e400 { #interrupt-cells = <2>; interrupt-controller;
+ pinmux { + pex_dpd_disable: pex-dpd-disable { + pins = "pex-bias", "pex-clk1", "pex-clk2"; + low-power-disable; + }; + + pex_dpd_enable: pex-dpd-enable { + pins = "pex-bias", "pex-clk1", "pex-clk2"; + low-power-enable; + }; + + sdmmc1_1v8: sdmmc1-1v8 { + pins = "sdmmc1"; + power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; + }; + + sdmmc1_3v3: sdmmc1-3v3 { + pins = "sdmmc1"; + power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; + }; + + sdmmc3_1v8: sdmmc3-1v8 { + pins = "sdmmc3"; + power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; + }; + + sdmmc3_3v3: sdmmc3-3v3 { + pins = "sdmmc3"; + power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; + }; + }; + powergates { pd_audio: aud { clocks = <&tegra_car TEGRA210_CLK_APE>, @@ -881,21 +913,12 @@ pd_sor: sor { #power-domain-cells = <0>; };
- pd_xusbss: xusba { - clocks = <&tegra_car TEGRA210_CLK_XUSB_SS>; - resets = <&tegra_car TEGRA210_CLK_XUSB_SS>; - #power-domain-cells = <0>; - }; - - pd_xusbdev: xusbb { - clocks = <&tegra_car TEGRA210_CLK_XUSB_DEV>; - resets = <&tegra_car 95>; - #power-domain-cells = <0>; - }; - - pd_xusbhost: xusbc { - clocks = <&tegra_car TEGRA210_CLK_XUSB_HOST>; - resets = <&tegra_car TEGRA210_CLK_XUSB_HOST>; + pd_venc: venc { + clocks = <&tegra_car TEGRA210_CLK_VI>, + <&tegra_car TEGRA210_CLK_CSI>; + resets = <&mc TEGRA210_MC_RESET_VI>, + <&tegra_car 20>, + <&tegra_car 52>; #power-domain-cells = <0>; };
@@ -907,45 +930,22 @@ pd_vic: vic { #power-domain-cells = <0>; };
- pd_venc: venc { - clocks = <&tegra_car TEGRA210_CLK_VI>, - <&tegra_car TEGRA210_CLK_CSI>; - resets = <&mc TEGRA210_MC_RESET_VI>, - <&tegra_car 20>, - <&tegra_car 52>; + pd_xusbss: xusba { + clocks = <&tegra_car TEGRA210_CLK_XUSB_SS>; + resets = <&tegra_car TEGRA210_CLK_XUSB_SS>; #power-domain-cells = <0>; }; - }; - - pinmux { - sdmmc1_3v3: sdmmc1-3v3 { - pins = "sdmmc1"; - power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; - }; - - sdmmc1_1v8: sdmmc1-1v8 { - pins = "sdmmc1"; - power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; - };
- sdmmc3_3v3: sdmmc3-3v3 { - pins = "sdmmc3"; - power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; - }; - - sdmmc3_1v8: sdmmc3-1v8 { - pins = "sdmmc3"; - power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; - }; - - pex_dpd_disable: pex-dpd-disable { - pins = "pex-bias", "pex-clk1", "pex-clk2"; - low-power-disable; + pd_xusbdev: xusbb { + clocks = <&tegra_car TEGRA210_CLK_XUSB_DEV>; + resets = <&tegra_car 95>; + #power-domain-cells = <0>; };
- pex_dpd_enable: pex-dpd-enable { - pins = "pex-bias", "pex-clk1", "pex-clk2"; - low-power-enable; + pd_xusbhost: xusbc { + clocks = <&tegra_car TEGRA210_CLK_XUSB_HOST>; + resets = <&tegra_car TEGRA210_CLK_XUSB_HOST>; + #power-domain-cells = <0>; }; }; }; @@ -1388,50 +1388,6 @@ aconnect@702c0000 { ranges = <0x702c0000 0x0 0x702c0000 0x00040000>; status = "disabled";
- adma: dma-controller@702e2000 { - compatible = "nvidia,tegra210-adma"; - reg = <0x702e2000 0x2000>; - interrupt-parent = <&agic>; - interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>; - #dma-cells = <1>; - clocks = <&tegra_car TEGRA210_CLK_D_AUDIO>; - clock-names = "d_audio"; - status = "disabled"; - }; - - agic: interrupt-controller@702f9000 { - compatible = "nvidia,tegra210-agic"; - #interrupt-cells = <3>; - interrupt-controller; - reg = <0x702f9000 0x1000>, - <0x702fa000 0x2000>; - interrupts = <GIC_SPI 102 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>; - clocks = <&tegra_car TEGRA210_CLK_APE>; - clock-names = "clk"; - status = "disabled"; - }; - tegra_ahub: ahub@702d0800 { compatible = "nvidia,tegra210-ahub"; reg = <0x702d0800 0x800>; @@ -1620,42 +1576,6 @@ tegra_i2s5: i2s@702d1400 { status = "disabled"; };
- tegra_dmic1: dmic@702d4000 { - compatible = "nvidia,tegra210-dmic"; - reg = <0x702d4000 0x100>; - clocks = <&tegra_car TEGRA210_CLK_DMIC1>; - clock-names = "dmic"; - assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC1>; - assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC1"; - status = "disabled"; - }; - - tegra_dmic2: dmic@702d4100 { - compatible = "nvidia,tegra210-dmic"; - reg = <0x702d4100 0x100>; - clocks = <&tegra_car TEGRA210_CLK_DMIC2>; - clock-names = "dmic"; - assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC2>; - assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC2"; - status = "disabled"; - }; - - tegra_dmic3: dmic@702d4200 { - compatible = "nvidia,tegra210-dmic"; - reg = <0x702d4200 0x100>; - clocks = <&tegra_car TEGRA210_CLK_DMIC3>; - clock-names = "dmic"; - assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC3>; - assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>; - assigned-clock-rates = <3072000>; - sound-name-prefix = "DMIC3"; - status = "disabled"; - }; - tegra_sfc1: sfc@702d2000 { compatible = "nvidia,tegra210-sfc"; reg = <0x702d2000 0x200>; @@ -1684,20 +1604,6 @@ tegra_sfc4: sfc@702d2600 { status = "disabled"; };
- tegra_mvc1: mvc@702da000 { - compatible = "nvidia,tegra210-mvc"; - reg = <0x702da000 0x200>; - sound-name-prefix = "MVC1"; - status = "disabled"; - }; - - tegra_mvc2: mvc@702da200 { - compatible = "nvidia,tegra210-mvc"; - reg = <0x702da200 0x200>; - sound-name-prefix = "MVC2"; - status = "disabled"; - }; - tegra_amx1: amx@702d3000 { compatible = "nvidia,tegra210-amx"; reg = <0x702d3000 0x100>; @@ -1726,6 +1632,42 @@ tegra_adx2: adx@702d3900 { status = "disabled"; };
+ tegra_dmic1: dmic@702d4000 { + compatible = "nvidia,tegra210-dmic"; + reg = <0x702d4000 0x100>; + clocks = <&tegra_car TEGRA210_CLK_DMIC1>; + clock-names = "dmic"; + assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC1>; + assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC1"; + status = "disabled"; + }; + + tegra_dmic2: dmic@702d4100 { + compatible = "nvidia,tegra210-dmic"; + reg = <0x702d4100 0x100>; + clocks = <&tegra_car TEGRA210_CLK_DMIC2>; + clock-names = "dmic"; + assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC2>; + assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC2"; + status = "disabled"; + }; + + tegra_dmic3: dmic@702d4200 { + compatible = "nvidia,tegra210-dmic"; + reg = <0x702d4200 0x100>; + clocks = <&tegra_car TEGRA210_CLK_DMIC3>; + clock-names = "dmic"; + assigned-clocks = <&tegra_car TEGRA210_CLK_DMIC3>; + assigned-clock-parents = <&tegra_car TEGRA210_CLK_PLL_A_OUT0>; + assigned-clock-rates = <3072000>; + sound-name-prefix = "DMIC3"; + status = "disabled"; + }; + tegra_ope1: processing-engine@702d8000 { compatible = "nvidia,tegra210-ope"; reg = <0x702d8000 0x100>; @@ -1766,6 +1708,20 @@ dynamic-range-compressor@702d8600 { }; };
+ tegra_mvc1: mvc@702da000 { + compatible = "nvidia,tegra210-mvc"; + reg = <0x702da000 0x200>; + sound-name-prefix = "MVC1"; + status = "disabled"; + }; + + tegra_mvc2: mvc@702da200 { + compatible = "nvidia,tegra210-mvc"; + reg = <0x702da200 0x200>; + sound-name-prefix = "MVC2"; + status = "disabled"; + }; + tegra_amixer: amixer@702dbb00 { compatible = "nvidia,tegra210-amixer"; reg = <0x702dbb00 0x800>; @@ -1856,6 +1812,50 @@ xbar_admaif10_ep: endpoint { }; }; }; + + adma: dma-controller@702e2000 { + compatible = "nvidia,tegra210-adma"; + reg = <0x702e2000 0x2000>; + interrupt-parent = <&agic>; + interrupts = <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 25 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 28 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 30 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 38 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>; + #dma-cells = <1>; + clocks = <&tegra_car TEGRA210_CLK_D_AUDIO>; + clock-names = "d_audio"; + status = "disabled"; + }; + + agic: interrupt-controller@702f9000 { + compatible = "nvidia,tegra210-agic"; + #interrupt-cells = <3>; + interrupt-controller; + reg = <0x702f9000 0x1000>, + <0x702fa000 0x2000>; + interrupts = <GIC_SPI 102 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>; + clocks = <&tegra_car TEGRA210_CLK_APE>; + clock-names = "clk"; + status = "disabled"; + }; };
spi@70410000 { diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi b/arch/arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi index 8b86ea9cb50c1..07aa5dc83fc6b 100644 --- a/arch/arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra234-p3701-0000.dtsi @@ -6,41 +6,6 @@ / { model = "NVIDIA Jetson AGX Orin"; compatible = "nvidia,p3701-0000", "nvidia,tegra234";
- vdd_1v8_ls: regulator-vdd-1v8-ls { - compatible = "regulator-fixed"; - regulator-name = "VDD_1V8_LS"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - regulator-always-on; - }; - - vdd_1v8_ao: regulator-vdd-1v8-ao { - compatible = "regulator-fixed"; - regulator-name = "VDD_1V8_AO"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - regulator-always-on; - }; - - vdd_3v3_pcie: regulator-vdd-3v3-pcie { - compatible = "regulator-fixed"; - regulator-name = "VDD_3V3_PCIE"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; - gpio = <&gpio TEGRA234_MAIN_GPIO(Z, 2) GPIO_ACTIVE_HIGH>; - regulator-boot-on; - enable-active-high; - }; - - vdd_12v_pcie: regulator-vdd-12v-pcie { - compatible = "regulator-fixed"; - regulator-name = "VDD_12V_PCIE"; - regulator-min-microvolt = <12000000>; - regulator-max-microvolt = <12000000>; - gpio = <&gpio TEGRA234_MAIN_GPIO(A, 1) GPIO_ACTIVE_LOW>; - regulator-boot-on; - }; - bus@0 { spi@3270000 { status = "okay"; @@ -75,4 +40,39 @@ pmc@c360000 { nvidia,invert-interrupt; }; }; + + vdd_1v8_ls: regulator-vdd-1v8-ls { + compatible = "regulator-fixed"; + regulator-name = "VDD_1V8_LS"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-always-on; + }; + + vdd_1v8_ao: regulator-vdd-1v8-ao { + compatible = "regulator-fixed"; + regulator-name = "VDD_1V8_AO"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-always-on; + }; + + vdd_3v3_pcie: regulator-vdd-3v3-pcie { + compatible = "regulator-fixed"; + regulator-name = "VDD_3V3_PCIE"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + gpio = <&gpio TEGRA234_MAIN_GPIO(Z, 2) GPIO_ACTIVE_HIGH>; + regulator-boot-on; + enable-active-high; + }; + + vdd_12v_pcie: regulator-vdd-12v-pcie { + compatible = "regulator-fixed"; + regulator-name = "VDD_12V_PCIE"; + regulator-min-microvolt = <12000000>; + regulator-max-microvolt = <12000000>; + gpio = <&gpio TEGRA234_MAIN_GPIO(A, 1) GPIO_ACTIVE_LOW>; + regulator-boot-on; + }; }; diff --git a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts index 431f42a266f5b..a4d1be2d32929 100644 --- a/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts +++ b/arch/arm64/boot/dts/nvidia/tegra234-p3737-0000+p3701-0000.dts @@ -17,6 +17,11 @@ aliases { serial1 = &uarta; };
+ chosen { + bootargs = "console=ttyTCU0,115200n8"; + stdout-path = "serial0:115200n8"; + }; + bus@0 { aconnect@2900000 { status = "okay"; @@ -24,997 +29,1001 @@ aconnect@2900000 { ahub@2900800 { status = "okay";
- ports { - #address-cells = <1>; - #size-cells = <0>; + i2s@2901000 { + status = "okay";
- port@0 { - reg = <0x0>; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_admaif0: endpoint { - remote-endpoint = <&admaif0>; + port@0 { + reg = <0>; + + i2s1_cif: endpoint { + remote-endpoint = <&xbar_i2s1>; + }; }; - };
- port@1 { - reg = <0x1>; + i2s1_port: port@1 { + reg = <1>;
- xbar_admaif1: endpoint { - remote-endpoint = <&admaif1>; + i2s1_dap: endpoint { + dai-format = "i2s"; + /* placeholder for external codec */ + }; }; }; + };
- port@2 { - reg = <0x2>; + i2s@2901100 { + status = "okay";
- xbar_admaif2: endpoint { - remote-endpoint = <&admaif2>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@3 { - reg = <0x3>; + port@0 { + reg = <0>;
- xbar_admaif3: endpoint { - remote-endpoint = <&admaif3>; + i2s2_cif: endpoint { + remote-endpoint = <&xbar_i2s2>; + }; }; - };
- port@4 { - reg = <0x4>; + i2s2_port: port@1 { + reg = <1>;
- xbar_admaif4: endpoint { - remote-endpoint = <&admaif4>; + i2s2_dap: endpoint { + dai-format = "i2s"; + /* placeholder for external codec */ + }; }; }; + };
- port@5 { - reg = <0x5>; + i2s@2901300 { + status = "okay";
- xbar_admaif5: endpoint { - remote-endpoint = <&admaif5>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@6 { - reg = <0x6>; + port@0 { + reg = <0>;
- xbar_admaif6: endpoint { - remote-endpoint = <&admaif6>; + i2s4_cif: endpoint { + remote-endpoint = <&xbar_i2s4>; + }; }; - };
- port@7 { - reg = <0x7>; + i2s4_port: port@1 { + reg = <1>;
- xbar_admaif7: endpoint { - remote-endpoint = <&admaif7>; + i2s4_dap: endpoint { + dai-format = "i2s"; + /* placeholder for external codec */ + }; }; }; + };
- port@8 { - reg = <0x8>; + i2s@2901500 { + status = "okay";
- xbar_admaif8: endpoint { - remote-endpoint = <&admaif8>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@9 { - reg = <0x9>; + port@0 { + reg = <0>;
- xbar_admaif9: endpoint { - remote-endpoint = <&admaif9>; + i2s6_cif: endpoint { + remote-endpoint = <&xbar_i2s6>; + }; }; - };
- port@a { - reg = <0xa>; + i2s6_port: port@1 { + reg = <1>;
- xbar_admaif10: endpoint { - remote-endpoint = <&admaif10>; + i2s6_dap: endpoint { + dai-format = "i2s"; + /* placeholder for external codec */ + }; }; }; + };
- port@b { - reg = <0xb>; + sfc@2902000 { + status = "okay";
- xbar_admaif11: endpoint { - remote-endpoint = <&admaif11>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@c { - reg = <0xc>; + port@0 { + reg = <0>;
- xbar_admaif12: endpoint { - remote-endpoint = <&admaif12>; + sfc1_cif_in: endpoint { + remote-endpoint = <&xbar_sfc1_in>; + }; }; - };
- port@d { - reg = <0xd>; + sfc1_out_port: port@1 { + reg = <1>;
- xbar_admaif13: endpoint { - remote-endpoint = <&admaif13>; + sfc1_cif_out: endpoint { + remote-endpoint = <&xbar_sfc1_out>; + }; }; }; + };
- port@e { - reg = <0xe>; + sfc@2902200 { + status = "okay";
- xbar_admaif14: endpoint { - remote-endpoint = <&admaif14>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@f { - reg = <0xf>; + port@0 { + reg = <0>;
- xbar_admaif15: endpoint { - remote-endpoint = <&admaif15>; + sfc2_cif_in: endpoint { + remote-endpoint = <&xbar_sfc2_in>; + }; }; - };
- port@10 { - reg = <0x10>; + sfc2_out_port: port@1 { + reg = <1>;
- xbar_admaif16: endpoint { - remote-endpoint = <&admaif16>; + sfc2_cif_out: endpoint { + remote-endpoint = <&xbar_sfc2_out>; + }; }; }; + };
- port@11 { - reg = <0x11>; + sfc@2902400 { + status = "okay";
- xbar_admaif17: endpoint { - remote-endpoint = <&admaif17>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@12 { - reg = <0x12>; + port@0 { + reg = <0>;
- xbar_admaif18: endpoint { - remote-endpoint = <&admaif18>; + sfc3_cif_in: endpoint { + remote-endpoint = <&xbar_sfc3_in>; + }; }; - };
- port@13 { - reg = <0x13>; + sfc3_out_port: port@1 { + reg = <1>;
- xbar_admaif19: endpoint { - remote-endpoint = <&admaif19>; + sfc3_cif_out: endpoint { + remote-endpoint = <&xbar_sfc3_out>; + }; }; }; + };
- xbar_i2s1_port: port@14 { - reg = <0x14>; + sfc@2902600 { + status = "okay";
- xbar_i2s1: endpoint { - remote-endpoint = <&i2s1_cif>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_i2s2_port: port@15 { - reg = <0x15>; + port@0 { + reg = <0>;
- xbar_i2s2: endpoint { - remote-endpoint = <&i2s2_cif>; + sfc4_cif_in: endpoint { + remote-endpoint = <&xbar_sfc4_in>; + }; }; - };
- xbar_i2s4_port: port@17 { - reg = <0x17>; + sfc4_out_port: port@1 { + reg = <1>;
- xbar_i2s4: endpoint { - remote-endpoint = <&i2s4_cif>; + sfc4_cif_out: endpoint { + remote-endpoint = <&xbar_sfc4_out>; + }; }; }; + };
- xbar_i2s6_port: port@19 { - reg = <0x19>; - - xbar_i2s6: endpoint { - remote-endpoint = <&i2s6_cif>; - }; - }; - - xbar_dmic3_port: port@1c { - reg = <0x1c>; - - xbar_dmic3: endpoint { - remote-endpoint = <&dmic3_cif>; - }; - }; - - xbar_sfc1_in_port: port@20 { - reg = <0x20>; + amx@2903000 { + status = "okay";
- xbar_sfc1_in: endpoint { - remote-endpoint = <&sfc1_cif_in>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@21 { - reg = <0x21>; + port@0 { + reg = <0>;
- xbar_sfc1_out: endpoint { - remote-endpoint = <&sfc1_cif_out>; + amx1_in1: endpoint { + remote-endpoint = <&xbar_amx1_in1>; + }; }; - };
- xbar_sfc2_in_port: port@22 { - reg = <0x22>; + port@1 { + reg = <1>;
- xbar_sfc2_in: endpoint { - remote-endpoint = <&sfc2_cif_in>; + amx1_in2: endpoint { + remote-endpoint = <&xbar_amx1_in2>; + }; }; - };
- port@23 { - reg = <0x23>; + port@2 { + reg = <2>;
- xbar_sfc2_out: endpoint { - remote-endpoint = <&sfc2_cif_out>; + amx1_in3: endpoint { + remote-endpoint = <&xbar_amx1_in3>; + }; }; - };
- xbar_sfc3_in_port: port@24 { - reg = <0x24>; + port@3 { + reg = <3>;
- xbar_sfc3_in: endpoint { - remote-endpoint = <&sfc3_cif_in>; + amx1_in4: endpoint { + remote-endpoint = <&xbar_amx1_in4>; + }; }; - };
- port@25 { - reg = <0x25>; + amx1_out_port: port@4 { + reg = <4>;
- xbar_sfc3_out: endpoint { - remote-endpoint = <&sfc3_cif_out>; + amx1_out: endpoint { + remote-endpoint = <&xbar_amx1_out>; + }; }; }; + };
- xbar_sfc4_in_port: port@26 { - reg = <0x26>; + amx@2903100 { + status = "okay";
- xbar_sfc4_in: endpoint { - remote-endpoint = <&sfc4_cif_in>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@27 { - reg = <0x27>; + port@0 { + reg = <0>;
- xbar_sfc4_out: endpoint { - remote-endpoint = <&sfc4_cif_out>; + amx2_in1: endpoint { + remote-endpoint = <&xbar_amx2_in1>; + }; }; - };
- xbar_mvc1_in_port: port@28 { - reg = <0x28>; + port@1 { + reg = <1>;
- xbar_mvc1_in: endpoint { - remote-endpoint = <&mvc1_cif_in>; + amx2_in2: endpoint { + remote-endpoint = <&xbar_amx2_in2>; + }; }; - };
- port@29 { - reg = <0x29>; + port@2 { + reg = <2>;
- xbar_mvc1_out: endpoint { - remote-endpoint = <&mvc1_cif_out>; + amx2_in3: endpoint { + remote-endpoint = <&xbar_amx2_in3>; + }; }; - };
- xbar_mvc2_in_port: port@2a { - reg = <0x2a>; + port@3 { + reg = <3>;
- xbar_mvc2_in: endpoint { - remote-endpoint = <&mvc2_cif_in>; + amx2_in4: endpoint { + remote-endpoint = <&xbar_amx2_in4>; + }; }; - };
- port@2b { - reg = <0x2b>; + amx2_out_port: port@4 { + reg = <4>;
- xbar_mvc2_out: endpoint { - remote-endpoint = <&mvc2_cif_out>; + amx2_out: endpoint { + remote-endpoint = <&xbar_amx2_out>; + }; }; }; + };
- xbar_amx1_in1_port: port@2c { - reg = <0x2c>; + amx@2903200 { + status = "okay";
- xbar_amx1_in1: endpoint { - remote-endpoint = <&amx1_in1>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx1_in2_port: port@2d { - reg = <0x2d>; + port@0 { + reg = <0>;
- xbar_amx1_in2: endpoint { - remote-endpoint = <&amx1_in2>; + amx3_in1: endpoint { + remote-endpoint = <&xbar_amx3_in1>; + }; }; - };
- xbar_amx1_in3_port: port@2e { - reg = <0x2e>; + port@1 { + reg = <1>;
- xbar_amx1_in3: endpoint { - remote-endpoint = <&amx1_in3>; + amx3_in2: endpoint { + remote-endpoint = <&xbar_amx3_in2>; + }; }; - };
- xbar_amx1_in4_port: port@2f { - reg = <0x2f>; + port@2 { + reg = <2>;
- xbar_amx1_in4: endpoint { - remote-endpoint = <&amx1_in4>; + amx3_in3: endpoint { + remote-endpoint = <&xbar_amx3_in3>; + }; }; - };
- port@30 { - reg = <0x30>; + port@3 { + reg = <3>;
- xbar_amx1_out: endpoint { - remote-endpoint = <&amx1_out>; + amx3_in4: endpoint { + remote-endpoint = <&xbar_amx3_in4>; + }; }; - };
- xbar_amx2_in1_port: port@31 { - reg = <0x31>; + amx3_out_port: port@4 { + reg = <4>;
- xbar_amx2_in1: endpoint { - remote-endpoint = <&amx2_in1>; + amx3_out: endpoint { + remote-endpoint = <&xbar_amx3_out>; + }; }; }; + };
- xbar_amx2_in2_port: port@32 { - reg = <0x32>; + amx@2903300 { + status = "okay";
- xbar_amx2_in2: endpoint { - remote-endpoint = <&amx2_in2>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx2_in3_port: port@33 { - reg = <0x33>; + port@0 { + reg = <0>;
- xbar_amx2_in3: endpoint { - remote-endpoint = <&amx2_in3>; + amx4_in1: endpoint { + remote-endpoint = <&xbar_amx4_in1>; + }; }; - };
- xbar_amx2_in4_port: port@34 { - reg = <0x34>; + port@1 { + reg = <1>;
- xbar_amx2_in4: endpoint { - remote-endpoint = <&amx2_in4>; + amx4_in2: endpoint { + remote-endpoint = <&xbar_amx4_in2>; + }; }; - };
- port@35 { - reg = <0x35>; + port@2 { + reg = <2>;
- xbar_amx2_out: endpoint { - remote-endpoint = <&amx2_out>; + amx4_in3: endpoint { + remote-endpoint = <&xbar_amx4_in3>; + }; }; - };
- xbar_amx3_in1_port: port@36 { - reg = <0x36>; + port@3 { + reg = <3>;
- xbar_amx3_in1: endpoint { - remote-endpoint = <&amx3_in1>; + amx4_in4: endpoint { + remote-endpoint = <&xbar_amx4_in4>; + }; }; - };
- xbar_amx3_in2_port: port@37 { - reg = <0x37>; + amx4_out_port: port@4 { + reg = <4>;
- xbar_amx3_in2: endpoint { - remote-endpoint = <&amx3_in2>; + amx4_out: endpoint { + remote-endpoint = <&xbar_amx4_out>; + }; }; }; + };
- xbar_amx3_in3_port: port@38 { - reg = <0x38>; + adx@2903800 { + status = "okay";
- xbar_amx3_in3: endpoint { - remote-endpoint = <&amx3_in3>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_amx3_in4_port: port@39 { - reg = <0x39>; + port@0 { + reg = <0>;
- xbar_amx3_in4: endpoint { - remote-endpoint = <&amx3_in4>; + adx1_in: endpoint { + remote-endpoint = <&xbar_adx1_in>; + }; }; - };
- port@3a { - reg = <0x3a>; + adx1_out1_port: port@1 { + reg = <1>;
- xbar_amx3_out: endpoint { - remote-endpoint = <&amx3_out>; + adx1_out1: endpoint { + remote-endpoint = <&xbar_adx1_out1>; + }; }; - };
- xbar_amx4_in1_port: port@3b { - reg = <0x3b>; + adx1_out2_port: port@2 { + reg = <2>;
- xbar_amx4_in1: endpoint { - remote-endpoint = <&amx4_in1>; + adx1_out2: endpoint { + remote-endpoint = <&xbar_adx1_out2>; + }; }; - };
- xbar_amx4_in2_port: port@3c { - reg = <0x3c>; + adx1_out3_port: port@3 { + reg = <3>;
- xbar_amx4_in2: endpoint { - remote-endpoint = <&amx4_in2>; + adx1_out3: endpoint { + remote-endpoint = <&xbar_adx1_out3>; + }; }; - };
- xbar_amx4_in3_port: port@3d { - reg = <0x3d>; + adx1_out4_port: port@4 { + reg = <4>;
- xbar_amx4_in3: endpoint { - remote-endpoint = <&amx4_in3>; + adx1_out4: endpoint { + remote-endpoint = <&xbar_adx1_out4>; + }; }; }; + };
- xbar_amx4_in4_port: port@3e { - reg = <0x3e>; + adx@2903900 { + status = "okay";
- xbar_amx4_in4: endpoint { - remote-endpoint = <&amx4_in4>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@3f { - reg = <0x3f>; + port@0 { + reg = <0>;
- xbar_amx4_out: endpoint { - remote-endpoint = <&amx4_out>; + adx2_in: endpoint { + remote-endpoint = <&xbar_adx2_in>; + }; }; - };
- xbar_adx1_in_port: port@40 { - reg = <0x40>; + adx2_out1_port: port@1 { + reg = <1>;
- xbar_adx1_in: endpoint { - remote-endpoint = <&adx1_in>; + adx2_out1: endpoint { + remote-endpoint = <&xbar_adx2_out1>; + }; }; - };
- port@41 { - reg = <0x41>; + adx2_out2_port: port@2 { + reg = <2>;
- xbar_adx1_out1: endpoint { - remote-endpoint = <&adx1_out1>; + adx2_out2: endpoint { + remote-endpoint = <&xbar_adx2_out2>; + }; }; - };
- port@42 { - reg = <0x42>; + adx2_out3_port: port@3 { + reg = <3>;
- xbar_adx1_out2: endpoint { - remote-endpoint = <&adx1_out2>; + adx2_out3: endpoint { + remote-endpoint = <&xbar_adx2_out3>; + }; }; - };
- port@43 { - reg = <0x43>; + adx2_out4_port: port@4 { + reg = <4>;
- xbar_adx1_out3: endpoint { - remote-endpoint = <&adx1_out3>; + adx2_out4: endpoint { + remote-endpoint = <&xbar_adx2_out4>; + }; }; }; + };
- port@44 { - reg = <0x44>; + adx@2903a00 { + status = "okay";
- xbar_adx1_out4: endpoint { - remote-endpoint = <&adx1_out4>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_adx2_in_port: port@45 { - reg = <0x45>; + port@0 { + reg = <0>;
- xbar_adx2_in: endpoint { - remote-endpoint = <&adx2_in>; + adx3_in: endpoint { + remote-endpoint = <&xbar_adx3_in>; + }; }; - };
- port@46 { - reg = <0x46>; + adx3_out1_port: port@1 { + reg = <1>;
- xbar_adx2_out1: endpoint { - remote-endpoint = <&adx2_out1>; + adx3_out1: endpoint { + remote-endpoint = <&xbar_adx3_out1>; + }; }; - };
- port@47 { - reg = <0x47>; + adx3_out2_port: port@2 { + reg = <2>;
- xbar_adx2_out2: endpoint { - remote-endpoint = <&adx2_out2>; + adx3_out2: endpoint { + remote-endpoint = <&xbar_adx3_out2>; + }; }; - };
- port@48 { - reg = <0x48>; + adx3_out3_port: port@3 { + reg = <3>;
- xbar_adx2_out3: endpoint { - remote-endpoint = <&adx2_out3>; + adx3_out3: endpoint { + remote-endpoint = <&xbar_adx3_out3>; + }; }; - };
- port@49 { - reg = <0x49>; + adx3_out4_port: port@4 { + reg = <4>;
- xbar_adx2_out4: endpoint { - remote-endpoint = <&adx2_out4>; + adx3_out4: endpoint { + remote-endpoint = <&xbar_adx3_out4>; + }; }; }; + };
- xbar_adx3_in_port: port@4a { - reg = <0x4a>; + adx@2903b00 { + status = "okay";
- xbar_adx3_in: endpoint { - remote-endpoint = <&adx3_in>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@4b { - reg = <0x4b>; + port@0 { + reg = <0>;
- xbar_adx3_out1: endpoint { - remote-endpoint = <&adx3_out1>; + adx4_in: endpoint { + remote-endpoint = <&xbar_adx4_in>; + }; }; - };
- port@4c { - reg = <0x4c>; + adx4_out1_port: port@1 { + reg = <1>;
- xbar_adx3_out2: endpoint { - remote-endpoint = <&adx3_out2>; + adx4_out1: endpoint { + remote-endpoint = <&xbar_adx4_out1>; + }; }; - };
- port@4d { - reg = <0x4d>; + adx4_out2_port: port@2 { + reg = <2>;
- xbar_adx3_out3: endpoint { - remote-endpoint = <&adx3_out3>; + adx4_out2: endpoint { + remote-endpoint = <&xbar_adx4_out2>; + }; }; - };
- port@4e { - reg = <0x4e>; + adx4_out3_port: port@3 { + reg = <3>;
- xbar_adx3_out4: endpoint { - remote-endpoint = <&adx3_out4>; + adx4_out3: endpoint { + remote-endpoint = <&xbar_adx4_out3>; + }; }; - };
- xbar_adx4_in_port: port@4f { - reg = <0x4f>; + adx4_out4_port: port@4 { + reg = <4>;
- xbar_adx4_in: endpoint { - remote-endpoint = <&adx4_in>; + adx4_out4: endpoint { + remote-endpoint = <&xbar_adx4_out4>; + }; }; }; + };
- port@50 { - reg = <0x50>; + dmic@2904200 { + status = "okay";
- xbar_adx4_out1: endpoint { - remote-endpoint = <&adx4_out1>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- port@51 { - reg = <0x51>; + port@0 { + reg = <0>;
- xbar_adx4_out2: endpoint { - remote-endpoint = <&adx4_out2>; + dmic3_cif: endpoint { + remote-endpoint = <&xbar_dmic3>; + }; }; - };
- port@52 { - reg = <0x52>; + dmic3_port: port@1 { + reg = <1>;
- xbar_adx4_out3: endpoint { - remote-endpoint = <&adx4_out3>; + dmic3_dap: endpoint { + /* placeholder for external codec */ + }; }; }; + };
- port@53 { - reg = <0x53>; + processing-engine@2908000 { + status = "okay";
- xbar_adx4_out4: endpoint { - remote-endpoint = <&adx4_out4>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mix_in1_port: port@54 { - reg = <0x54>; + port@0 { + reg = <0x0>;
- xbar_mix_in1: endpoint { - remote-endpoint = <&mix_in1>; + ope1_cif_in_ep: endpoint { + remote-endpoint = <&xbar_ope1_in_ep>; + }; }; - };
- xbar_mix_in2_port: port@55 { - reg = <0x55>; + ope1_out_port: port@1 { + reg = <0x1>;
- xbar_mix_in2: endpoint { - remote-endpoint = <&mix_in2>; + ope1_cif_out_ep: endpoint { + remote-endpoint = <&xbar_ope1_out_ep>; + }; }; }; + };
- xbar_mix_in3_port: port@56 { - reg = <0x56>; + mvc@290a000 { + status = "okay";
- xbar_mix_in3: endpoint { - remote-endpoint = <&mix_in3>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mix_in4_port: port@57 { - reg = <0x57>; + port@0 { + reg = <0>;
- xbar_mix_in4: endpoint { - remote-endpoint = <&mix_in4>; + mvc1_cif_in: endpoint { + remote-endpoint = <&xbar_mvc1_in>; + }; }; - };
- xbar_mix_in5_port: port@58 { - reg = <0x58>; + mvc1_out_port: port@1 { + reg = <1>;
- xbar_mix_in5: endpoint { - remote-endpoint = <&mix_in5>; + mvc1_cif_out: endpoint { + remote-endpoint = <&xbar_mvc1_out>; + }; }; }; + };
- xbar_mix_in6_port: port@59 { - reg = <0x59>; + mvc@290a200 { + status = "okay";
- xbar_mix_in6: endpoint { - remote-endpoint = <&mix_in6>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mix_in7_port: port@5a { - reg = <0x5a>; + port@0 { + reg = <0>;
- xbar_mix_in7: endpoint { - remote-endpoint = <&mix_in7>; + mvc2_cif_in: endpoint { + remote-endpoint = <&xbar_mvc2_in>; + }; }; - };
- xbar_mix_in8_port: port@5b { - reg = <0x5b>; + mvc2_out_port: port@1 { + reg = <1>;
- xbar_mix_in8: endpoint { - remote-endpoint = <&mix_in8>; + mvc2_cif_out: endpoint { + remote-endpoint = <&xbar_mvc2_out>; + }; }; }; + };
- xbar_mix_in9_port: port@5c { - reg = <0x5c>; + amixer@290bb00 { + status = "okay";
- xbar_mix_in9: endpoint { - remote-endpoint = <&mix_in9>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_mix_in10_port: port@5d { - reg = <0x5d>; + port@0 { + reg = <0x0>;
- xbar_mix_in10: endpoint { - remote-endpoint = <&mix_in10>; + mix_in1: endpoint { + remote-endpoint = <&xbar_mix_in1>; + }; }; - };
- port@5e { - reg = <0x5e>; + port@1 { + reg = <0x1>;
- xbar_mix_out1: endpoint { - remote-endpoint = <&mix_out1>; + mix_in2: endpoint { + remote-endpoint = <&xbar_mix_in2>; + }; }; - };
- port@5f { - reg = <0x5f>; + port@2 { + reg = <0x2>;
- xbar_mix_out2: endpoint { - remote-endpoint = <&mix_out2>; + mix_in3: endpoint { + remote-endpoint = <&xbar_mix_in3>; + }; }; - };
- port@60 { - reg = <0x60>; + port@3 { + reg = <0x3>;
- xbar_mix_out3: endpoint { - remote-endpoint = <&mix_out3>; + mix_in4: endpoint { + remote-endpoint = <&xbar_mix_in4>; + }; }; - };
- port@61 { - reg = <0x61>; + port@4 { + reg = <0x4>;
- xbar_mix_out4: endpoint { - remote-endpoint = <&mix_out4>; + mix_in5: endpoint { + remote-endpoint = <&xbar_mix_in5>; + }; }; - };
- port@62 { - reg = <0x62>; + port@5 { + reg = <0x5>;
- xbar_mix_out5: endpoint { - remote-endpoint = <&mix_out5>; + mix_in6: endpoint { + remote-endpoint = <&xbar_mix_in6>; + }; }; - };
- xbar_asrc_in1_port: port@63 { - reg = <0x63>; + port@6 { + reg = <0x6>;
- xbar_asrc_in1_ep: endpoint { - remote-endpoint = <&asrc_in1_ep>; + mix_in7: endpoint { + remote-endpoint = <&xbar_mix_in7>; + }; }; - };
- port@64 { - reg = <0x64>; + port@7 { + reg = <0x7>;
- xbar_asrc_out1_ep: endpoint { - remote-endpoint = <&asrc_out1_ep>; + mix_in8: endpoint { + remote-endpoint = <&xbar_mix_in8>; + }; }; - };
- xbar_asrc_in2_port: port@65 { - reg = <0x65>; + port@8 { + reg = <0x8>;
- xbar_asrc_in2_ep: endpoint { - remote-endpoint = <&asrc_in2_ep>; + mix_in9: endpoint { + remote-endpoint = <&xbar_mix_in9>; + }; }; - };
- port@66 { - reg = <0x66>; + port@9 { + reg = <0x9>;
- xbar_asrc_out2_ep: endpoint { - remote-endpoint = <&asrc_out2_ep>; + mix_in10: endpoint { + remote-endpoint = <&xbar_mix_in10>; + }; }; - };
- xbar_asrc_in3_port: port@67 { - reg = <0x67>; + mix_out1_port: port@a { + reg = <0xa>;
- xbar_asrc_in3_ep: endpoint { - remote-endpoint = <&asrc_in3_ep>; + mix_out1: endpoint { + remote-endpoint = <&xbar_mix_out1>; + }; }; - };
- port@68 { - reg = <0x68>; + mix_out2_port: port@b { + reg = <0xb>;
- xbar_asrc_out3_ep: endpoint { - remote-endpoint = <&asrc_out3_ep>; + mix_out2: endpoint { + remote-endpoint = <&xbar_mix_out2>; + }; }; - };
- xbar_asrc_in4_port: port@69 { - reg = <0x69>; + mix_out3_port: port@c { + reg = <0xc>;
- xbar_asrc_in4_ep: endpoint { - remote-endpoint = <&asrc_in4_ep>; + mix_out3: endpoint { + remote-endpoint = <&xbar_mix_out3>; + }; }; - };
- port@6a { - reg = <0x6a>; + mix_out4_port: port@d { + reg = <0xd>;
- xbar_asrc_out4_ep: endpoint { - remote-endpoint = <&asrc_out4_ep>; + mix_out4: endpoint { + remote-endpoint = <&xbar_mix_out4>; + }; }; - };
- xbar_asrc_in5_port: port@6b { - reg = <0x6b>; + mix_out5_port: port@e { + reg = <0xe>;
- xbar_asrc_in5_ep: endpoint { - remote-endpoint = <&asrc_in5_ep>; + mix_out5: endpoint { + remote-endpoint = <&xbar_mix_out5>; + }; }; }; + };
- port@6c { - reg = <0x6c>; + admaif@290f000 { + status = "okay";
- xbar_asrc_out5_ep: endpoint { - remote-endpoint = <&asrc_out5_ep>; - }; - }; + ports { + #address-cells = <1>; + #size-cells = <0>;
- xbar_asrc_in6_port: port@6d { - reg = <0x6d>; + admaif0_port: port@0 { + reg = <0x0>;
- xbar_asrc_in6_ep: endpoint { - remote-endpoint = <&asrc_in6_ep>; + admaif0: endpoint { + remote-endpoint = <&xbar_admaif0>; + }; }; - };
- port@6e { - reg = <0x6e>; + admaif1_port: port@1 { + reg = <0x1>;
- xbar_asrc_out6_ep: endpoint { - remote-endpoint = <&asrc_out6_ep>; + admaif1: endpoint { + remote-endpoint = <&xbar_admaif1>; + }; }; - };
- xbar_asrc_in7_port: port@6f { - reg = <0x6f>; + admaif2_port: port@2 { + reg = <0x2>;
- xbar_asrc_in7_ep: endpoint { - remote-endpoint = <&asrc_in7_ep>; + admaif2: endpoint { + remote-endpoint = <&xbar_admaif2>; + }; }; - };
- xbar_ope1_in_port: port@70 { - reg = <0x70>; + admaif3_port: port@3 { + reg = <0x3>;
- xbar_ope1_in_ep: endpoint { - remote-endpoint = <&ope1_cif_in_ep>; + admaif3: endpoint { + remote-endpoint = <&xbar_admaif3>; + }; }; - };
- port@71 { - reg = <0x71>; + admaif4_port: port@4 { + reg = <0x4>;
- xbar_ope1_out_ep: endpoint { - remote-endpoint = <&ope1_cif_out_ep>; + admaif4: endpoint { + remote-endpoint = <&xbar_admaif4>; + }; }; - }; - };
- i2s@2901000 { - status = "okay"; + admaif5_port: port@5 { + reg = <0x5>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + admaif5: endpoint { + remote-endpoint = <&xbar_admaif5>; + }; + };
- port@0 { - reg = <0>; + admaif6_port: port@6 { + reg = <0x6>;
- i2s1_cif: endpoint { - remote-endpoint = <&xbar_i2s1>; + admaif6: endpoint { + remote-endpoint = <&xbar_admaif6>; }; };
- i2s1_port: port@1 { - reg = <1>; + admaif7_port: port@7 { + reg = <0x7>;
- i2s1_dap: endpoint { - dai-format = "i2s"; - /* placeholder for external codec */ + admaif7: endpoint { + remote-endpoint = <&xbar_admaif7>; }; }; - }; - };
- i2s@2901100 { - status = "okay"; + admaif8_port: port@8 { + reg = <0x8>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + admaif8: endpoint { + remote-endpoint = <&xbar_admaif8>; + }; + };
- port@0 { - reg = <0>; + admaif9_port: port@9 { + reg = <0x9>;
- i2s2_cif: endpoint { - remote-endpoint = <&xbar_i2s2>; + admaif9: endpoint { + remote-endpoint = <&xbar_admaif9>; }; };
- i2s2_port: port@1 { - reg = <1>; + admaif10_port: port@a { + reg = <0xa>;
- i2s2_dap: endpoint { - dai-format = "i2s"; - /* placeholder for external codec */ + admaif10: endpoint { + remote-endpoint = <&xbar_admaif10>; }; }; - }; - };
- i2s@2901300 { - status = "okay"; + admaif11_port: port@b { + reg = <0xb>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + admaif11: endpoint { + remote-endpoint = <&xbar_admaif11>; + }; + };
- port@0 { - reg = <0>; + admaif12_port: port@c { + reg = <0xc>;
- i2s4_cif: endpoint { - remote-endpoint = <&xbar_i2s4>; + admaif12: endpoint { + remote-endpoint = <&xbar_admaif12>; }; };
- i2s4_port: port@1 { - reg = <1>; + admaif13_port: port@d { + reg = <0xd>;
- i2s4_dap: endpoint { - dai-format = "i2s"; - /* placeholder for external codec */ + admaif13: endpoint { + remote-endpoint = <&xbar_admaif13>; }; }; - }; - };
- i2s@2901500 { - status = "okay"; + admaif14_port: port@e { + reg = <0xe>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + admaif14: endpoint { + remote-endpoint = <&xbar_admaif14>; + }; + };
- port@0 { - reg = <0>; + admaif15_port: port@f { + reg = <0xf>;
- i2s6_cif: endpoint { - remote-endpoint = <&xbar_i2s6>; + admaif15: endpoint { + remote-endpoint = <&xbar_admaif15>; }; };
- i2s6_port: port@1 { - reg = <1>; + admaif16_port: port@10 { + reg = <0x10>;
- i2s6_dap: endpoint { - dai-format = "i2s"; - /* placeholder for external codec */ + admaif16: endpoint { + remote-endpoint = <&xbar_admaif16>; }; }; - }; - };
- sfc@2902000 { - status = "okay"; + admaif17_port: port@11 { + reg = <0x11>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + admaif17: endpoint { + remote-endpoint = <&xbar_admaif17>; + }; + };
- port@0 { - reg = <0>; + admaif18_port: port@12 { + reg = <0x12>;
- sfc1_cif_in: endpoint { - remote-endpoint = <&xbar_sfc1_in>; + admaif18: endpoint { + remote-endpoint = <&xbar_admaif18>; }; };
- sfc1_out_port: port@1 { - reg = <1>; + admaif19_port: port@13 { + reg = <0x13>;
- sfc1_cif_out: endpoint { - remote-endpoint = <&xbar_sfc1_out>; + admaif19: endpoint { + remote-endpoint = <&xbar_admaif19>; }; }; }; };
- sfc@2902200 { + asrc@2910000 { status = "okay";
ports { @@ -1022,972 +1031,968 @@ ports { #size-cells = <0>;
port@0 { - reg = <0>; + reg = <0x0>;
- sfc2_cif_in: endpoint { - remote-endpoint = <&xbar_sfc2_in>; + asrc_in1_ep: endpoint { + remote-endpoint = <&xbar_asrc_in1_ep>; }; };
- sfc2_out_port: port@1 { - reg = <1>; + port@1 { + reg = <0x1>;
- sfc2_cif_out: endpoint { - remote-endpoint = <&xbar_sfc2_out>; + asrc_in2_ep: endpoint { + remote-endpoint = <&xbar_asrc_in2_ep>; }; }; - }; - }; - - sfc@2902400 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>;
- port@0 { - reg = <0>; + port@2 { + reg = <0x2>;
- sfc3_cif_in: endpoint { - remote-endpoint = <&xbar_sfc3_in>; + asrc_in3_ep: endpoint { + remote-endpoint = <&xbar_asrc_in3_ep>; }; };
- sfc3_out_port: port@1 { - reg = <1>; + port@3 { + reg = <0x3>;
- sfc3_cif_out: endpoint { - remote-endpoint = <&xbar_sfc3_out>; + asrc_in4_ep: endpoint { + remote-endpoint = <&xbar_asrc_in4_ep>; }; }; - }; - };
- sfc@2902600 { - status = "okay"; + port@4 { + reg = <0x4>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_in5_ep: endpoint { + remote-endpoint = <&xbar_asrc_in5_ep>; + }; + };
- port@0 { - reg = <0>; + port@5 { + reg = <0x5>;
- sfc4_cif_in: endpoint { - remote-endpoint = <&xbar_sfc4_in>; + asrc_in6_ep: endpoint { + remote-endpoint = <&xbar_asrc_in6_ep>; }; };
- sfc4_out_port: port@1 { - reg = <1>; + port@6 { + reg = <0x6>;
- sfc4_cif_out: endpoint { - remote-endpoint = <&xbar_sfc4_out>; + asrc_in7_ep: endpoint { + remote-endpoint = <&xbar_asrc_in7_ep>; }; }; - }; - };
- amx@2903000 { - status = "okay"; + asrc_out1_port: port@7 { + reg = <0x7>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + asrc_out1_ep: endpoint { + remote-endpoint = <&xbar_asrc_out1_ep>; + }; + };
- port@0 { - reg = <0>; + asrc_out2_port: port@8 { + reg = <0x8>;
- amx1_in1: endpoint { - remote-endpoint = <&xbar_amx1_in1>; + asrc_out2_ep: endpoint { + remote-endpoint = <&xbar_asrc_out2_ep>; }; };
- port@1 { - reg = <1>; + asrc_out3_port: port@9 { + reg = <0x9>;
- amx1_in2: endpoint { - remote-endpoint = <&xbar_amx1_in2>; + asrc_out3_ep: endpoint { + remote-endpoint = <&xbar_asrc_out3_ep>; }; };
- port@2 { - reg = <2>; + asrc_out4_port: port@a { + reg = <0xa>;
- amx1_in3: endpoint { - remote-endpoint = <&xbar_amx1_in3>; + asrc_out4_ep: endpoint { + remote-endpoint = <&xbar_asrc_out4_ep>; }; };
- port@3 { - reg = <3>; + asrc_out5_port: port@b { + reg = <0xb>;
- amx1_in4: endpoint { - remote-endpoint = <&xbar_amx1_in4>; + asrc_out5_ep: endpoint { + remote-endpoint = <&xbar_asrc_out5_ep>; }; };
- amx1_out_port: port@4 { - reg = <4>; + asrc_out6_port: port@c { + reg = <0xc>;
- amx1_out: endpoint { - remote-endpoint = <&xbar_amx1_out>; + asrc_out6_ep: endpoint { + remote-endpoint = <&xbar_asrc_out6_ep>; }; }; }; };
- amx@2903100 { - status = "okay"; + ports { + #address-cells = <1>; + #size-cells = <0>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + port@0 { + reg = <0x0>;
- port@0 { - reg = <0>; + xbar_admaif0: endpoint { + remote-endpoint = <&admaif0>; + }; + };
- amx2_in1: endpoint { - remote-endpoint = <&xbar_amx2_in1>; - }; + port@1 { + reg = <0x1>; + + xbar_admaif1: endpoint { + remote-endpoint = <&admaif1>; }; + };
- port@1 { - reg = <1>; + port@2 { + reg = <0x2>;
- amx2_in2: endpoint { - remote-endpoint = <&xbar_amx2_in2>; - }; + xbar_admaif2: endpoint { + remote-endpoint = <&admaif2>; }; + };
- port@2 { - reg = <2>; + port@3 { + reg = <0x3>;
- amx2_in3: endpoint { - remote-endpoint = <&xbar_amx2_in3>; - }; + xbar_admaif3: endpoint { + remote-endpoint = <&admaif3>; }; + };
- port@3 { - reg = <3>; + port@4 { + reg = <0x4>;
- amx2_in4: endpoint { - remote-endpoint = <&xbar_amx2_in4>; - }; + xbar_admaif4: endpoint { + remote-endpoint = <&admaif4>; }; + };
- amx2_out_port: port@4 { - reg = <4>; + port@5 { + reg = <0x5>;
- amx2_out: endpoint { - remote-endpoint = <&xbar_amx2_out>; - }; + xbar_admaif5: endpoint { + remote-endpoint = <&admaif5>; + }; + }; + + port@6 { + reg = <0x6>; + + xbar_admaif6: endpoint { + remote-endpoint = <&admaif6>; + }; + }; + + port@7 { + reg = <0x7>; + + xbar_admaif7: endpoint { + remote-endpoint = <&admaif7>; + }; + }; + + port@8 { + reg = <0x8>; + + xbar_admaif8: endpoint { + remote-endpoint = <&admaif8>; }; }; - }; - - amx@2903200 { - status = "okay"; - - ports { - #address-cells = <1>; - #size-cells = <0>;
- port@0 { - reg = <0>; + port@9 { + reg = <0x9>;
- amx3_in1: endpoint { - remote-endpoint = <&xbar_amx3_in1>; - }; + xbar_admaif9: endpoint { + remote-endpoint = <&admaif9>; }; + };
- port@1 { - reg = <1>; + port@a { + reg = <0xa>;
- amx3_in2: endpoint { - remote-endpoint = <&xbar_amx3_in2>; - }; + xbar_admaif10: endpoint { + remote-endpoint = <&admaif10>; }; + };
- port@2 { - reg = <2>; + port@b { + reg = <0xb>;
- amx3_in3: endpoint { - remote-endpoint = <&xbar_amx3_in3>; - }; + xbar_admaif11: endpoint { + remote-endpoint = <&admaif11>; }; + };
- port@3 { - reg = <3>; + port@c { + reg = <0xc>;
- amx3_in4: endpoint { - remote-endpoint = <&xbar_amx3_in4>; - }; + xbar_admaif12: endpoint { + remote-endpoint = <&admaif12>; }; + };
- amx3_out_port: port@4 { - reg = <4>; + port@d { + reg = <0xd>;
- amx3_out: endpoint { - remote-endpoint = <&xbar_amx3_out>; - }; + xbar_admaif13: endpoint { + remote-endpoint = <&admaif13>; }; }; - };
- amx@2903300 { - status = "okay"; + port@e { + reg = <0xe>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_admaif14: endpoint { + remote-endpoint = <&admaif14>; + }; + };
- port@0 { - reg = <0>; + port@f { + reg = <0xf>;
- amx4_in1: endpoint { - remote-endpoint = <&xbar_amx4_in1>; - }; + xbar_admaif15: endpoint { + remote-endpoint = <&admaif15>; }; + };
- port@1 { - reg = <1>; + port@10 { + reg = <0x10>;
- amx4_in2: endpoint { - remote-endpoint = <&xbar_amx4_in2>; - }; + xbar_admaif16: endpoint { + remote-endpoint = <&admaif16>; }; + };
- port@2 { - reg = <2>; + port@11 { + reg = <0x11>;
- amx4_in3: endpoint { - remote-endpoint = <&xbar_amx4_in3>; - }; + xbar_admaif17: endpoint { + remote-endpoint = <&admaif17>; }; + };
- port@3 { - reg = <3>; + port@12 { + reg = <0x12>;
- amx4_in4: endpoint { - remote-endpoint = <&xbar_amx4_in4>; - }; + xbar_admaif18: endpoint { + remote-endpoint = <&admaif18>; }; + };
- amx4_out_port: port@4 { - reg = <4>; + port@13 { + reg = <0x13>;
- amx4_out: endpoint { - remote-endpoint = <&xbar_amx4_out>; - }; + xbar_admaif19: endpoint { + remote-endpoint = <&admaif19>; }; }; - };
- adx@2903800 { - status = "okay"; + xbar_i2s1_port: port@14 { + reg = <0x14>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_i2s1: endpoint { + remote-endpoint = <&i2s1_cif>; + }; + };
- port@0 { - reg = <0>; + xbar_i2s2_port: port@15 { + reg = <0x15>;
- adx1_in: endpoint { - remote-endpoint = <&xbar_adx1_in>; - }; + xbar_i2s2: endpoint { + remote-endpoint = <&i2s2_cif>; }; + };
- adx1_out1_port: port@1 { - reg = <1>; + xbar_i2s4_port: port@17 { + reg = <0x17>;
- adx1_out1: endpoint { - remote-endpoint = <&xbar_adx1_out1>; - }; + xbar_i2s4: endpoint { + remote-endpoint = <&i2s4_cif>; }; + };
- adx1_out2_port: port@2 { - reg = <2>; + xbar_i2s6_port: port@19 { + reg = <0x19>;
- adx1_out2: endpoint { - remote-endpoint = <&xbar_adx1_out2>; - }; + xbar_i2s6: endpoint { + remote-endpoint = <&i2s6_cif>; }; + };
- adx1_out3_port: port@3 { - reg = <3>; + xbar_dmic3_port: port@1c { + reg = <0x1c>;
- adx1_out3: endpoint { - remote-endpoint = <&xbar_adx1_out3>; - }; + xbar_dmic3: endpoint { + remote-endpoint = <&dmic3_cif>; }; + };
- adx1_out4_port: port@4 { - reg = <4>; + xbar_sfc1_in_port: port@20 { + reg = <0x20>;
- adx1_out4: endpoint { - remote-endpoint = <&xbar_adx1_out4>; - }; + xbar_sfc1_in: endpoint { + remote-endpoint = <&sfc1_cif_in>; }; }; - };
- adx@2903900 { - status = "okay"; + port@21 { + reg = <0x21>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_sfc1_out: endpoint { + remote-endpoint = <&sfc1_cif_out>; + }; + };
- port@0 { - reg = <0>; + xbar_sfc2_in_port: port@22 { + reg = <0x22>;
- adx2_in: endpoint { - remote-endpoint = <&xbar_adx2_in>; - }; + xbar_sfc2_in: endpoint { + remote-endpoint = <&sfc2_cif_in>; }; + };
- adx2_out1_port: port@1 { - reg = <1>; + port@23 { + reg = <0x23>;
- adx2_out1: endpoint { - remote-endpoint = <&xbar_adx2_out1>; - }; + xbar_sfc2_out: endpoint { + remote-endpoint = <&sfc2_cif_out>; }; + };
- adx2_out2_port: port@2 { - reg = <2>; + xbar_sfc3_in_port: port@24 { + reg = <0x24>;
- adx2_out2: endpoint { - remote-endpoint = <&xbar_adx2_out2>; - }; + xbar_sfc3_in: endpoint { + remote-endpoint = <&sfc3_cif_in>; }; + };
- adx2_out3_port: port@3 { - reg = <3>; + port@25 { + reg = <0x25>;
- adx2_out3: endpoint { - remote-endpoint = <&xbar_adx2_out3>; - }; + xbar_sfc3_out: endpoint { + remote-endpoint = <&sfc3_cif_out>; }; + };
- adx2_out4_port: port@4 { - reg = <4>; + xbar_sfc4_in_port: port@26 { + reg = <0x26>;
- adx2_out4: endpoint { - remote-endpoint = <&xbar_adx2_out4>; - }; + xbar_sfc4_in: endpoint { + remote-endpoint = <&sfc4_cif_in>; }; }; - };
- adx@2903a00 { - status = "okay"; + port@27 { + reg = <0x27>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_sfc4_out: endpoint { + remote-endpoint = <&sfc4_cif_out>; + }; + };
- port@0 { - reg = <0>; + xbar_mvc1_in_port: port@28 { + reg = <0x28>;
- adx3_in: endpoint { - remote-endpoint = <&xbar_adx3_in>; - }; + xbar_mvc1_in: endpoint { + remote-endpoint = <&mvc1_cif_in>; }; + };
- adx3_out1_port: port@1 { - reg = <1>; + port@29 { + reg = <0x29>;
- adx3_out1: endpoint { - remote-endpoint = <&xbar_adx3_out1>; - }; + xbar_mvc1_out: endpoint { + remote-endpoint = <&mvc1_cif_out>; }; + };
- adx3_out2_port: port@2 { - reg = <2>; + xbar_mvc2_in_port: port@2a { + reg = <0x2a>;
- adx3_out2: endpoint { - remote-endpoint = <&xbar_adx3_out2>; - }; + xbar_mvc2_in: endpoint { + remote-endpoint = <&mvc2_cif_in>; }; + };
- adx3_out3_port: port@3 { - reg = <3>; + port@2b { + reg = <0x2b>;
- adx3_out3: endpoint { - remote-endpoint = <&xbar_adx3_out3>; - }; + xbar_mvc2_out: endpoint { + remote-endpoint = <&mvc2_cif_out>; }; + };
- adx3_out4_port: port@4 { - reg = <4>; + xbar_amx1_in1_port: port@2c { + reg = <0x2c>;
- adx3_out4: endpoint { - remote-endpoint = <&xbar_adx3_out4>; - }; + xbar_amx1_in1: endpoint { + remote-endpoint = <&amx1_in1>; }; }; - };
- adx@2903b00 { - status = "okay"; + xbar_amx1_in2_port: port@2d { + reg = <0x2d>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx1_in2: endpoint { + remote-endpoint = <&amx1_in2>; + }; + };
- port@0 { - reg = <0>; + xbar_amx1_in3_port: port@2e { + reg = <0x2e>;
- adx4_in: endpoint { - remote-endpoint = <&xbar_adx4_in>; - }; + xbar_amx1_in3: endpoint { + remote-endpoint = <&amx1_in3>; }; + };
- adx4_out1_port: port@1 { - reg = <1>; + xbar_amx1_in4_port: port@2f { + reg = <0x2f>;
- adx4_out1: endpoint { - remote-endpoint = <&xbar_adx4_out1>; - }; + xbar_amx1_in4: endpoint { + remote-endpoint = <&amx1_in4>; }; + };
- adx4_out2_port: port@2 { - reg = <2>; + port@30 { + reg = <0x30>;
- adx4_out2: endpoint { - remote-endpoint = <&xbar_adx4_out2>; - }; + xbar_amx1_out: endpoint { + remote-endpoint = <&amx1_out>; }; + };
- adx4_out3_port: port@3 { - reg = <3>; + xbar_amx2_in1_port: port@31 { + reg = <0x31>;
- adx4_out3: endpoint { - remote-endpoint = <&xbar_adx4_out3>; - }; + xbar_amx2_in1: endpoint { + remote-endpoint = <&amx2_in1>; }; + };
- adx4_out4_port: port@4 { - reg = <4>; + xbar_amx2_in2_port: port@32 { + reg = <0x32>;
- adx4_out4: endpoint { - remote-endpoint = <&xbar_adx4_out4>; - }; + xbar_amx2_in2: endpoint { + remote-endpoint = <&amx2_in2>; }; }; - };
- dmic@2904200 { - status = "okay"; + xbar_amx2_in3_port: port@33 { + reg = <0x33>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx2_in3: endpoint { + remote-endpoint = <&amx2_in3>; + }; + };
- port@0 { - reg = <0>; + xbar_amx2_in4_port: port@34 { + reg = <0x34>;
- dmic3_cif: endpoint { - remote-endpoint = <&xbar_dmic3>; - }; + xbar_amx2_in4: endpoint { + remote-endpoint = <&amx2_in4>; }; + };
- dmic3_port: port@1 { - reg = <1>; + port@35 { + reg = <0x35>;
- dmic3_dap: endpoint { - /* placeholder for external codec */ - }; + xbar_amx2_out: endpoint { + remote-endpoint = <&amx2_out>; }; }; - };
- processing-engine@2908000 { - status = "okay"; + xbar_amx3_in1_port: port@36 { + reg = <0x36>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx3_in1: endpoint { + remote-endpoint = <&amx3_in1>; + }; + };
- port@0 { - reg = <0x0>; + xbar_amx3_in2_port: port@37 { + reg = <0x37>;
- ope1_cif_in_ep: endpoint { - remote-endpoint = <&xbar_ope1_in_ep>; - }; + xbar_amx3_in2: endpoint { + remote-endpoint = <&amx3_in2>; }; + };
- ope1_out_port: port@1 { - reg = <0x1>; + xbar_amx3_in3_port: port@38 { + reg = <0x38>;
- ope1_cif_out_ep: endpoint { - remote-endpoint = <&xbar_ope1_out_ep>; - }; + xbar_amx3_in3: endpoint { + remote-endpoint = <&amx3_in3>; }; }; - };
- mvc@290a000 { - status = "okay"; + xbar_amx3_in4_port: port@39 { + reg = <0x39>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx3_in4: endpoint { + remote-endpoint = <&amx3_in4>; + }; + };
- port@0 { - reg = <0>; + port@3a { + reg = <0x3a>;
- mvc1_cif_in: endpoint { - remote-endpoint = <&xbar_mvc1_in>; - }; + xbar_amx3_out: endpoint { + remote-endpoint = <&amx3_out>; }; + };
- mvc1_out_port: port@1 { - reg = <1>; + xbar_amx4_in1_port: port@3b { + reg = <0x3b>;
- mvc1_cif_out: endpoint { - remote-endpoint = <&xbar_mvc1_out>; - }; + xbar_amx4_in1: endpoint { + remote-endpoint = <&amx4_in1>; }; }; - };
- mvc@290a200 { - status = "okay"; + xbar_amx4_in2_port: port@3c { + reg = <0x3c>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx4_in2: endpoint { + remote-endpoint = <&amx4_in2>; + }; + };
- port@0 { - reg = <0>; + xbar_amx4_in3_port: port@3d { + reg = <0x3d>;
- mvc2_cif_in: endpoint { - remote-endpoint = <&xbar_mvc2_in>; - }; + xbar_amx4_in3: endpoint { + remote-endpoint = <&amx4_in3>; }; + };
- mvc2_out_port: port@1 { - reg = <1>; + xbar_amx4_in4_port: port@3e { + reg = <0x3e>;
- mvc2_cif_out: endpoint { - remote-endpoint = <&xbar_mvc2_out>; - }; + xbar_amx4_in4: endpoint { + remote-endpoint = <&amx4_in4>; }; }; - };
- amixer@290bb00 { - status = "okay"; + port@3f { + reg = <0x3f>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_amx4_out: endpoint { + remote-endpoint = <&amx4_out>; + }; + };
- port@0 { - reg = <0x0>; + xbar_adx1_in_port: port@40 { + reg = <0x40>;
- mix_in1: endpoint { - remote-endpoint = <&xbar_mix_in1>; - }; + xbar_adx1_in: endpoint { + remote-endpoint = <&adx1_in>; }; + };
- port@1 { - reg = <0x1>; + port@41 { + reg = <0x41>;
- mix_in2: endpoint { - remote-endpoint = <&xbar_mix_in2>; - }; + xbar_adx1_out1: endpoint { + remote-endpoint = <&adx1_out1>; }; + };
- port@2 { - reg = <0x2>; + port@42 { + reg = <0x42>;
- mix_in3: endpoint { - remote-endpoint = <&xbar_mix_in3>; - }; + xbar_adx1_out2: endpoint { + remote-endpoint = <&adx1_out2>; }; + };
- port@3 { - reg = <0x3>; + port@43 { + reg = <0x43>;
- mix_in4: endpoint { - remote-endpoint = <&xbar_mix_in4>; - }; + xbar_adx1_out3: endpoint { + remote-endpoint = <&adx1_out3>; }; + };
- port@4 { - reg = <0x4>; + port@44 { + reg = <0x44>;
- mix_in5: endpoint { - remote-endpoint = <&xbar_mix_in5>; - }; + xbar_adx1_out4: endpoint { + remote-endpoint = <&adx1_out4>; }; + };
- port@5 { - reg = <0x5>; + xbar_adx2_in_port: port@45 { + reg = <0x45>;
- mix_in6: endpoint { - remote-endpoint = <&xbar_mix_in6>; - }; + xbar_adx2_in: endpoint { + remote-endpoint = <&adx2_in>; }; + };
- port@6 { - reg = <0x6>; + port@46 { + reg = <0x46>;
- mix_in7: endpoint { - remote-endpoint = <&xbar_mix_in7>; - }; + xbar_adx2_out1: endpoint { + remote-endpoint = <&adx2_out1>; }; + };
- port@7 { - reg = <0x7>; + port@47 { + reg = <0x47>;
- mix_in8: endpoint { - remote-endpoint = <&xbar_mix_in8>; - }; + xbar_adx2_out2: endpoint { + remote-endpoint = <&adx2_out2>; }; + };
- port@8 { - reg = <0x8>; + port@48 { + reg = <0x48>;
- mix_in9: endpoint { - remote-endpoint = <&xbar_mix_in9>; - }; + xbar_adx2_out3: endpoint { + remote-endpoint = <&adx2_out3>; }; + };
- port@9 { - reg = <0x9>; + port@49 { + reg = <0x49>;
- mix_in10: endpoint { - remote-endpoint = <&xbar_mix_in10>; - }; + xbar_adx2_out4: endpoint { + remote-endpoint = <&adx2_out4>; }; + };
- mix_out1_port: port@a { - reg = <0xa>; + xbar_adx3_in_port: port@4a { + reg = <0x4a>;
- mix_out1: endpoint { - remote-endpoint = <&xbar_mix_out1>; - }; + xbar_adx3_in: endpoint { + remote-endpoint = <&adx3_in>; }; + };
- mix_out2_port: port@b { - reg = <0xb>; + port@4b { + reg = <0x4b>;
- mix_out2: endpoint { - remote-endpoint = <&xbar_mix_out2>; - }; + xbar_adx3_out1: endpoint { + remote-endpoint = <&adx3_out1>; }; + };
- mix_out3_port: port@c { - reg = <0xc>; + port@4c { + reg = <0x4c>;
- mix_out3: endpoint { - remote-endpoint = <&xbar_mix_out3>; - }; + xbar_adx3_out2: endpoint { + remote-endpoint = <&adx3_out2>; }; + };
- mix_out4_port: port@d { - reg = <0xd>; + port@4d { + reg = <0x4d>;
- mix_out4: endpoint { - remote-endpoint = <&xbar_mix_out4>; - }; + xbar_adx3_out3: endpoint { + remote-endpoint = <&adx3_out3>; }; + };
- mix_out5_port: port@e { - reg = <0xe>; + port@4e { + reg = <0x4e>;
- mix_out5: endpoint { - remote-endpoint = <&xbar_mix_out5>; - }; + xbar_adx3_out4: endpoint { + remote-endpoint = <&adx3_out4>; }; }; - };
- admaif@290f000 { - status = "okay"; + xbar_adx4_in_port: port@4f { + reg = <0x4f>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_adx4_in: endpoint { + remote-endpoint = <&adx4_in>; + }; + };
- admaif0_port: port@0 { - reg = <0x0>; + port@50 { + reg = <0x50>;
- admaif0: endpoint { - remote-endpoint = <&xbar_admaif0>; - }; + xbar_adx4_out1: endpoint { + remote-endpoint = <&adx4_out1>; }; + };
- admaif1_port: port@1 { - reg = <0x1>; + port@51 { + reg = <0x51>;
- admaif1: endpoint { - remote-endpoint = <&xbar_admaif1>; - }; + xbar_adx4_out2: endpoint { + remote-endpoint = <&adx4_out2>; }; + };
- admaif2_port: port@2 { - reg = <0x2>; + port@52 { + reg = <0x52>;
- admaif2: endpoint { - remote-endpoint = <&xbar_admaif2>; - }; + xbar_adx4_out3: endpoint { + remote-endpoint = <&adx4_out3>; }; + };
- admaif3_port: port@3 { - reg = <0x3>; + port@53 { + reg = <0x53>;
- admaif3: endpoint { - remote-endpoint = <&xbar_admaif3>; - }; + xbar_adx4_out4: endpoint { + remote-endpoint = <&adx4_out4>; }; + };
- admaif4_port: port@4 { - reg = <0x4>; + xbar_mix_in1_port: port@54 { + reg = <0x54>;
- admaif4: endpoint { - remote-endpoint = <&xbar_admaif4>; - }; + xbar_mix_in1: endpoint { + remote-endpoint = <&mix_in1>; }; + };
- admaif5_port: port@5 { - reg = <0x5>; + xbar_mix_in2_port: port@55 { + reg = <0x55>;
- admaif5: endpoint { - remote-endpoint = <&xbar_admaif5>; - }; + xbar_mix_in2: endpoint { + remote-endpoint = <&mix_in2>; }; + };
- admaif6_port: port@6 { - reg = <0x6>; + xbar_mix_in3_port: port@56 { + reg = <0x56>;
- admaif6: endpoint { - remote-endpoint = <&xbar_admaif6>; - }; + xbar_mix_in3: endpoint { + remote-endpoint = <&mix_in3>; }; + };
- admaif7_port: port@7 { - reg = <0x7>; + xbar_mix_in4_port: port@57 { + reg = <0x57>;
- admaif7: endpoint { - remote-endpoint = <&xbar_admaif7>; - }; + xbar_mix_in4: endpoint { + remote-endpoint = <&mix_in4>; }; + };
- admaif8_port: port@8 { - reg = <0x8>; + xbar_mix_in5_port: port@58 { + reg = <0x58>;
- admaif8: endpoint { - remote-endpoint = <&xbar_admaif8>; - }; + xbar_mix_in5: endpoint { + remote-endpoint = <&mix_in5>; }; + };
- admaif9_port: port@9 { - reg = <0x9>; + xbar_mix_in6_port: port@59 { + reg = <0x59>;
- admaif9: endpoint { - remote-endpoint = <&xbar_admaif9>; - }; + xbar_mix_in6: endpoint { + remote-endpoint = <&mix_in6>; }; + };
- admaif10_port: port@a { - reg = <0xa>; + xbar_mix_in7_port: port@5a { + reg = <0x5a>;
- admaif10: endpoint { - remote-endpoint = <&xbar_admaif10>; - }; + xbar_mix_in7: endpoint { + remote-endpoint = <&mix_in7>; }; + };
- admaif11_port: port@b { - reg = <0xb>; + xbar_mix_in8_port: port@5b { + reg = <0x5b>;
- admaif11: endpoint { - remote-endpoint = <&xbar_admaif11>; - }; + xbar_mix_in8: endpoint { + remote-endpoint = <&mix_in8>; }; + };
- admaif12_port: port@c { - reg = <0xc>; + xbar_mix_in9_port: port@5c { + reg = <0x5c>;
- admaif12: endpoint { - remote-endpoint = <&xbar_admaif12>; - }; + xbar_mix_in9: endpoint { + remote-endpoint = <&mix_in9>; }; + };
- admaif13_port: port@d { - reg = <0xd>; + xbar_mix_in10_port: port@5d { + reg = <0x5d>;
- admaif13: endpoint { - remote-endpoint = <&xbar_admaif13>; - }; + xbar_mix_in10: endpoint { + remote-endpoint = <&mix_in10>; }; + };
- admaif14_port: port@e { - reg = <0xe>; + port@5e { + reg = <0x5e>;
- admaif14: endpoint { - remote-endpoint = <&xbar_admaif14>; - }; + xbar_mix_out1: endpoint { + remote-endpoint = <&mix_out1>; }; + };
- admaif15_port: port@f { - reg = <0xf>; + port@5f { + reg = <0x5f>;
- admaif15: endpoint { - remote-endpoint = <&xbar_admaif15>; - }; + xbar_mix_out2: endpoint { + remote-endpoint = <&mix_out2>; }; + };
- admaif16_port: port@10 { - reg = <0x10>; + port@60 { + reg = <0x60>;
- admaif16: endpoint { - remote-endpoint = <&xbar_admaif16>; - }; + xbar_mix_out3: endpoint { + remote-endpoint = <&mix_out3>; }; + };
- admaif17_port: port@11 { - reg = <0x11>; + port@61 { + reg = <0x61>;
- admaif17: endpoint { - remote-endpoint = <&xbar_admaif17>; - }; + xbar_mix_out4: endpoint { + remote-endpoint = <&mix_out4>; }; + };
- admaif18_port: port@12 { - reg = <0x12>; + port@62 { + reg = <0x62>;
- admaif18: endpoint { - remote-endpoint = <&xbar_admaif18>; - }; + xbar_mix_out5: endpoint { + remote-endpoint = <&mix_out5>; }; + };
- admaif19_port: port@13 { - reg = <0x13>; + xbar_asrc_in1_port: port@63 { + reg = <0x63>;
- admaif19: endpoint { - remote-endpoint = <&xbar_admaif19>; - }; + xbar_asrc_in1_ep: endpoint { + remote-endpoint = <&asrc_in1_ep>; }; }; - };
- asrc@2910000 { - status = "okay"; + port@64 { + reg = <0x64>;
- ports { - #address-cells = <1>; - #size-cells = <0>; + xbar_asrc_out1_ep: endpoint { + remote-endpoint = <&asrc_out1_ep>; + }; + };
- port@0 { - reg = <0x0>; + xbar_asrc_in2_port: port@65 { + reg = <0x65>;
- asrc_in1_ep: endpoint { - remote-endpoint = <&xbar_asrc_in1_ep>; - }; + xbar_asrc_in2_ep: endpoint { + remote-endpoint = <&asrc_in2_ep>; }; + };
- port@1 { - reg = <0x1>; + port@66 { + reg = <0x66>;
- asrc_in2_ep: endpoint { - remote-endpoint = <&xbar_asrc_in2_ep>; - }; + xbar_asrc_out2_ep: endpoint { + remote-endpoint = <&asrc_out2_ep>; }; + };
- port@2 { - reg = <0x2>; + xbar_asrc_in3_port: port@67 { + reg = <0x67>;
- asrc_in3_ep: endpoint { - remote-endpoint = <&xbar_asrc_in3_ep>; - }; + xbar_asrc_in3_ep: endpoint { + remote-endpoint = <&asrc_in3_ep>; }; + };
- port@3 { - reg = <0x3>; + port@68 { + reg = <0x68>;
- asrc_in4_ep: endpoint { - remote-endpoint = <&xbar_asrc_in4_ep>; - }; + xbar_asrc_out3_ep: endpoint { + remote-endpoint = <&asrc_out3_ep>; }; + };
- port@4 { - reg = <0x4>; + xbar_asrc_in4_port: port@69 { + reg = <0x69>;
- asrc_in5_ep: endpoint { - remote-endpoint = <&xbar_asrc_in5_ep>; - }; + xbar_asrc_in4_ep: endpoint { + remote-endpoint = <&asrc_in4_ep>; }; + };
- port@5 { - reg = <0x5>; + port@6a { + reg = <0x6a>;
- asrc_in6_ep: endpoint { - remote-endpoint = <&xbar_asrc_in6_ep>; - }; + xbar_asrc_out4_ep: endpoint { + remote-endpoint = <&asrc_out4_ep>; }; + };
- port@6 { - reg = <0x6>; + xbar_asrc_in5_port: port@6b { + reg = <0x6b>;
- asrc_in7_ep: endpoint { - remote-endpoint = <&xbar_asrc_in7_ep>; - }; + xbar_asrc_in5_ep: endpoint { + remote-endpoint = <&asrc_in5_ep>; }; + };
- asrc_out1_port: port@7 { - reg = <0x7>; + port@6c { + reg = <0x6c>;
- asrc_out1_ep: endpoint { - remote-endpoint = <&xbar_asrc_out1_ep>; - }; + xbar_asrc_out5_ep: endpoint { + remote-endpoint = <&asrc_out5_ep>; }; + };
- asrc_out2_port: port@8 { - reg = <0x8>; + xbar_asrc_in6_port: port@6d { + reg = <0x6d>;
- asrc_out2_ep: endpoint { - remote-endpoint = <&xbar_asrc_out2_ep>; - }; + xbar_asrc_in6_ep: endpoint { + remote-endpoint = <&asrc_in6_ep>; }; + };
- asrc_out3_port: port@9 { - reg = <0x9>; + port@6e { + reg = <0x6e>;
- asrc_out3_ep: endpoint { - remote-endpoint = <&xbar_asrc_out3_ep>; - }; + xbar_asrc_out6_ep: endpoint { + remote-endpoint = <&asrc_out6_ep>; }; + };
- asrc_out4_port: port@a { - reg = <0xa>; + xbar_asrc_in7_port: port@6f { + reg = <0x6f>;
- asrc_out4_ep: endpoint { - remote-endpoint = <&xbar_asrc_out4_ep>; - }; + xbar_asrc_in7_ep: endpoint { + remote-endpoint = <&asrc_in7_ep>; }; + };
- asrc_out5_port: port@b { - reg = <0xb>; + xbar_ope1_in_port: port@70 { + reg = <0x70>;
- asrc_out5_ep: endpoint { - remote-endpoint = <&xbar_asrc_out5_ep>; - }; + xbar_ope1_in_ep: endpoint { + remote-endpoint = <&ope1_cif_in_ep>; }; + };
- asrc_out6_port: port@c { - reg = <0xc>; + port@71 { + reg = <0x71>;
- asrc_out6_ep: endpoint { - remote-endpoint = <&xbar_asrc_out6_ep>; - }; + xbar_ope1_out_ep: endpoint { + remote-endpoint = <&ope1_cif_out_ep>; }; }; }; @@ -2022,14 +2027,7 @@ hda@3510000 { nvidia,model = "NVIDIA Jetson AGX Orin HDA"; status = "okay"; }; - }; - - chosen { - bootargs = "console=ttyTCU0,115200n8"; - stdout-path = "serial0:115200n8"; - };
- bus@0 { ethernet@6800000 { status = "okay";
@@ -2129,6 +2127,14 @@ key-suspend { }; };
+ pwm-fan { + compatible = "pwm-fan"; + pwms = <&pwm3 0 45334>; + + cooling-levels = <0 95 178 255>; + #cooling-cells = <2>; + }; + serial { status = "okay"; }; @@ -2195,12 +2201,4 @@ sound {
label = "NVIDIA Jetson AGX Orin APE"; }; - - pwm-fan { - compatible = "pwm-fan"; - pwms = <&pwm3 0 45334>; - - cooling-levels = <0 95 178 255>; - #cooling-cells = <2>; - }; }; diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi index 3d680ee0f4d17..7a3112c82cdc7 100644 --- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi @@ -22,6 +22,94 @@ bus@0 { #size-cells = <2>; ranges = <0x0 0x0 0x0 0x0 0x0 0x40000000>;
+ misc@100000 { + compatible = "nvidia,tegra234-misc"; + reg = <0x0 0x00100000 0x0 0xf000>, + <0x0 0x0010f000 0x0 0x1000>; + status = "okay"; + }; + + timer@2080000 { + compatible = "nvidia,tegra234-timer"; + reg = <0x0 0x02080000 0x0 0x00121000>; + interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>; + status = "okay"; + }; + + gpio: gpio@2200000 { + compatible = "nvidia,tegra234-gpio"; + reg-names = "security", "gpio"; + reg = <0x0 0x02200000 0x0 0x10000>, + <0x0 0x02210000 0x0 0x10000>; + interrupts = <GIC_SPI 288 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 289 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 290 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 291 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 292 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 293 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 294 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 295 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 296 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 298 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 299 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 300 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 301 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 302 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 303 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 304 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 306 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 311 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 315 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 316 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>; + #interrupt-cells = <2>; + interrupt-controller; + #gpio-cells = <2>; + gpio-controller; + }; + gpcdma: dma-controller@2600000 { compatible = "nvidia,tegra234-gpcdma", "nvidia,tegra186-gpcdma"; @@ -518,194 +606,6 @@ agic: interrupt-controller@2a40000 { }; };
- misc@100000 { - compatible = "nvidia,tegra234-misc"; - reg = <0x0 0x00100000 0x0 0xf000>, - <0x0 0x0010f000 0x0 0x1000>; - status = "okay"; - }; - - timer@2080000 { - compatible = "nvidia,tegra234-timer"; - reg = <0x0 0x02080000 0x0 0x00121000>; - interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 15 IRQ_TYPE_LEVEL_HIGH>; - status = "okay"; - }; - - host1x@13e00000 { - compatible = "nvidia,tegra234-host1x"; - reg = <0x0 0x13e00000 0x0 0x10000>, - <0x0 0x13e10000 0x0 0x10000>, - <0x0 0x13e40000 0x0 0x10000>; - reg-names = "common", "hypervisor", "vm"; - interrupts = <GIC_SPI 448 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 449 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 450 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 451 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 452 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 453 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 454 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 455 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>; - interrupt-names = "syncpt0", "syncpt1", "syncpt2", "syncpt3", "syncpt4", - "syncpt5", "syncpt6", "syncpt7", "host1x"; - clocks = <&bpmp TEGRA234_CLK_HOST1X>; - clock-names = "host1x"; - - #address-cells = <2>; - #size-cells = <2>; - ranges = <0x0 0x14800000 0x0 0x14800000 0x0 0x02000000>; - - interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>; - interconnect-names = "dma-mem"; - iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>; - - /* Context isolation domains */ - iommu-map = <0 &smmu_niso0 TEGRA234_SID_HOST1X_CTX0 1>, - <1 &smmu_niso0 TEGRA234_SID_HOST1X_CTX1 1>, - <2 &smmu_niso0 TEGRA234_SID_HOST1X_CTX2 1>, - <3 &smmu_niso0 TEGRA234_SID_HOST1X_CTX3 1>, - <4 &smmu_niso0 TEGRA234_SID_HOST1X_CTX4 1>, - <5 &smmu_niso0 TEGRA234_SID_HOST1X_CTX5 1>, - <6 &smmu_niso0 TEGRA234_SID_HOST1X_CTX6 1>, - <7 &smmu_niso0 TEGRA234_SID_HOST1X_CTX7 1>, - <8 &smmu_niso1 TEGRA234_SID_HOST1X_CTX0 1>, - <9 &smmu_niso1 TEGRA234_SID_HOST1X_CTX1 1>, - <10 &smmu_niso1 TEGRA234_SID_HOST1X_CTX2 1>, - <11 &smmu_niso1 TEGRA234_SID_HOST1X_CTX3 1>, - <12 &smmu_niso1 TEGRA234_SID_HOST1X_CTX4 1>, - <13 &smmu_niso1 TEGRA234_SID_HOST1X_CTX5 1>, - <14 &smmu_niso1 TEGRA234_SID_HOST1X_CTX6 1>, - <15 &smmu_niso1 TEGRA234_SID_HOST1X_CTX7 1>; - - vic@15340000 { - compatible = "nvidia,tegra234-vic"; - reg = <0x0 0x15340000 0x0 0x00040000>; - interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&bpmp TEGRA234_CLK_VIC>; - clock-names = "vic"; - resets = <&bpmp TEGRA234_RESET_VIC>; - reset-names = "vic"; - - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_VIC>; - interconnects = <&mc TEGRA234_MEMORY_CLIENT_VICSRD &emc>, - <&mc TEGRA234_MEMORY_CLIENT_VICSWR &emc>; - interconnect-names = "dma-mem", "write"; - iommus = <&smmu_niso1 TEGRA234_SID_VIC>; - dma-coherent; - }; - - nvdec@15480000 { - compatible = "nvidia,tegra234-nvdec"; - reg = <0x0 0x15480000 0x0 0x00040000>; - clocks = <&bpmp TEGRA234_CLK_NVDEC>, - <&bpmp TEGRA234_CLK_FUSE>, - <&bpmp TEGRA234_CLK_TSEC_PKA>; - clock-names = "nvdec", "fuse", "tsec_pka"; - resets = <&bpmp TEGRA234_RESET_NVDEC>; - reset-names = "nvdec"; - power-domains = <&bpmp TEGRA234_POWER_DOMAIN_NVDEC>; - interconnects = <&mc TEGRA234_MEMORY_CLIENT_NVDECSRD &emc>, - <&mc TEGRA234_MEMORY_CLIENT_NVDECSWR &emc>; - interconnect-names = "dma-mem", "write"; - iommus = <&smmu_niso1 TEGRA234_SID_NVDEC>; - dma-coherent; - - nvidia,memory-controller = <&mc>; - - /* - * Placeholder values that firmware needs to update with the real - * offsets parsed from the microcode headers. - */ - nvidia,bl-manifest-offset = <0>; - nvidia,bl-data-offset = <0>; - nvidia,bl-code-offset = <0>; - nvidia,os-manifest-offset = <0>; - nvidia,os-data-offset = <0>; - nvidia,os-code-offset = <0>; - - /* - * Firmware needs to set this to "okay" once the above values have - * been updated. - */ - status = "disabled"; - }; - }; - - gpio: gpio@2200000 { - compatible = "nvidia,tegra234-gpio"; - reg-names = "security", "gpio"; - reg = <0x0 0x02200000 0x0 0x10000>, - <0x0 0x02210000 0x0 0x10000>; - interrupts = <GIC_SPI 288 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 289 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 290 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 291 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 292 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 293 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 294 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 295 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 296 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 297 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 298 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 299 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 300 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 301 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 302 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 303 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 304 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 305 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 306 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 308 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 309 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 311 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 312 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 313 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 314 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 315 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 316 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 317 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 318 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 319 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 320 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 321 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 322 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 323 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 324 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 325 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 326 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 327 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 328 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 329 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 330 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 333 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 334 IRQ_TYPE_LEVEL_HIGH>, - <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>; - #interrupt-cells = <2>; - interrupt-controller; - #gpio-cells = <2>; - gpio-controller; - }; - mc: memory-controller@2c00000 { compatible = "nvidia,tegra234-mc"; reg = <0x0 0x02c00000 0x0 0x10000>, /* MC-SID */ @@ -1690,18 +1590,13 @@ pmc: pmc@c360000 { #interrupt-cells = <2>; interrupt-controller;
- sdmmc1_3v3: sdmmc1-3v3 { - pins = "sdmmc1-hv"; - power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; - }; - sdmmc1_1v8: sdmmc1-1v8 { pins = "sdmmc1-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; };
- sdmmc3_3v3: sdmmc3-3v3 { - pins = "sdmmc3-hv"; + sdmmc1_3v3: sdmmc1-3v3 { + pins = "sdmmc1-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; };
@@ -1709,6 +1604,11 @@ sdmmc3_1v8: sdmmc3-1v8 { pins = "sdmmc3-hv"; power-source = <TEGRA_IO_PAD_VOLTAGE_1V8>; }; + + sdmmc3_3v3: sdmmc3-3v3 { + pins = "sdmmc3-hv"; + power-source = <TEGRA_IO_PAD_VOLTAGE_3V3>; + }; };
aon-fabric@c600000 { @@ -2040,6 +1940,106 @@ cbb-fabric@13a00000 { status = "okay"; };
+ host1x@13e00000 { + compatible = "nvidia,tegra234-host1x"; + reg = <0x0 0x13e00000 0x0 0x10000>, + <0x0 0x13e10000 0x0 0x10000>, + <0x0 0x13e40000 0x0 0x10000>; + reg-names = "common", "hypervisor", "vm"; + interrupts = <GIC_SPI 448 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 449 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 450 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 451 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 452 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 453 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 454 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 455 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>; + interrupt-names = "syncpt0", "syncpt1", "syncpt2", "syncpt3", "syncpt4", + "syncpt5", "syncpt6", "syncpt7", "host1x"; + clocks = <&bpmp TEGRA234_CLK_HOST1X>; + clock-names = "host1x"; + + #address-cells = <2>; + #size-cells = <2>; + ranges = <0x0 0x14800000 0x0 0x14800000 0x0 0x02000000>; + + interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>; + interconnect-names = "dma-mem"; + iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>; + + /* Context isolation domains */ + iommu-map = <0 &smmu_niso0 TEGRA234_SID_HOST1X_CTX0 1>, + <1 &smmu_niso0 TEGRA234_SID_HOST1X_CTX1 1>, + <2 &smmu_niso0 TEGRA234_SID_HOST1X_CTX2 1>, + <3 &smmu_niso0 TEGRA234_SID_HOST1X_CTX3 1>, + <4 &smmu_niso0 TEGRA234_SID_HOST1X_CTX4 1>, + <5 &smmu_niso0 TEGRA234_SID_HOST1X_CTX5 1>, + <6 &smmu_niso0 TEGRA234_SID_HOST1X_CTX6 1>, + <7 &smmu_niso0 TEGRA234_SID_HOST1X_CTX7 1>, + <8 &smmu_niso1 TEGRA234_SID_HOST1X_CTX0 1>, + <9 &smmu_niso1 TEGRA234_SID_HOST1X_CTX1 1>, + <10 &smmu_niso1 TEGRA234_SID_HOST1X_CTX2 1>, + <11 &smmu_niso1 TEGRA234_SID_HOST1X_CTX3 1>, + <12 &smmu_niso1 TEGRA234_SID_HOST1X_CTX4 1>, + <13 &smmu_niso1 TEGRA234_SID_HOST1X_CTX5 1>, + <14 &smmu_niso1 TEGRA234_SID_HOST1X_CTX6 1>, + <15 &smmu_niso1 TEGRA234_SID_HOST1X_CTX7 1>; + + vic@15340000 { + compatible = "nvidia,tegra234-vic"; + reg = <0x0 0x15340000 0x0 0x00040000>; + interrupts = <GIC_SPI 206 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&bpmp TEGRA234_CLK_VIC>; + clock-names = "vic"; + resets = <&bpmp TEGRA234_RESET_VIC>; + reset-names = "vic"; + + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_VIC>; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_VICSRD &emc>, + <&mc TEGRA234_MEMORY_CLIENT_VICSWR &emc>; + interconnect-names = "dma-mem", "write"; + iommus = <&smmu_niso1 TEGRA234_SID_VIC>; + dma-coherent; + }; + + nvdec@15480000 { + compatible = "nvidia,tegra234-nvdec"; + reg = <0x0 0x15480000 0x0 0x00040000>; + clocks = <&bpmp TEGRA234_CLK_NVDEC>, + <&bpmp TEGRA234_CLK_FUSE>, + <&bpmp TEGRA234_CLK_TSEC_PKA>; + clock-names = "nvdec", "fuse", "tsec_pka"; + resets = <&bpmp TEGRA234_RESET_NVDEC>; + reset-names = "nvdec"; + power-domains = <&bpmp TEGRA234_POWER_DOMAIN_NVDEC>; + interconnects = <&mc TEGRA234_MEMORY_CLIENT_NVDECSRD &emc>, + <&mc TEGRA234_MEMORY_CLIENT_NVDECSWR &emc>; + interconnect-names = "dma-mem", "write"; + iommus = <&smmu_niso1 TEGRA234_SID_NVDEC>; + dma-coherent; + + nvidia,memory-controller = <&mc>; + + /* + * Placeholder values that firmware needs to update with the real + * offsets parsed from the microcode headers. + */ + nvidia,bl-manifest-offset = <0>; + nvidia,bl-data-offset = <0>; + nvidia,bl-code-offset = <0>; + nvidia,os-manifest-offset = <0>; + nvidia,os-data-offset = <0>; + nvidia,os-code-offset = <0>; + + /* + * Firmware needs to set this to "okay" once the above values have + * been updated. + */ + status = "disabled"; + }; + }; + pcie@140a0000 { compatible = "nvidia,tegra234-pcie"; power-domains = <&bpmp TEGRA234_POWER_DOMAIN_PCIEX4CA>;
From: Mikko Perttunen mperttunen@nvidia.com
[ Upstream commit 361238cdc52523fd7b1f3aa447c0579f42448b00 ]
Ensure appropriate configuration is done to make the host1x device and context devices DMA coherent by adding the dma-coherent flag.
Fixes: b35f5b53a87b ("arm64: tegra: Add context isolation domains on Tegra234") Signed-off-by: Mikko Perttunen mperttunen@nvidia.com Signed-off-by: Thierry Reding treding@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/nvidia/tegra194.dtsi | 1 + arch/arm64/boot/dts/nvidia/tegra234.dtsi | 1 + 2 files changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi index 45a204d753b1b..76c672d2196be 100644 --- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi @@ -1922,6 +1922,7 @@ host1x@13e00000 { interconnects = <&mc TEGRA194_MEMORY_CLIENT_HOST1XDMAR &emc>; interconnect-names = "dma-mem"; iommus = <&smmu TEGRA194_SID_HOST1X>; + dma-coherent;
/* Context isolation domains */ iommu-map = <0 &smmu TEGRA194_SID_HOST1X_CTX0 1>, diff --git a/arch/arm64/boot/dts/nvidia/tegra234.dtsi b/arch/arm64/boot/dts/nvidia/tegra234.dtsi index 7a3112c82cdc7..cee86dcb68712 100644 --- a/arch/arm64/boot/dts/nvidia/tegra234.dtsi +++ b/arch/arm64/boot/dts/nvidia/tegra234.dtsi @@ -1967,6 +1967,7 @@ host1x@13e00000 { interconnects = <&mc TEGRA234_MEMORY_CLIENT_HOST1XDMAR &emc>; interconnect-names = "dma-mem"; iommus = <&smmu_niso1 TEGRA234_SID_HOST1X>; + dma-coherent;
/* Context isolation domains */ iommu-map = <0 &smmu_niso0 TEGRA234_SID_HOST1X_CTX0 1>,
From: Adam Ford aford173@gmail.com
[ Upstream commit d7f9492dfc03153ac56ab59066a196558748f575 ]
The board used to originally introduce the Beacon Embedded RZ/G2[M/N/H] boards had a GPIO expander with address 20, but this was changed when the final board went to production.
The production boards changed both the part itself and the address. With the incorrect address, the LCD cannot come up. If the LCD fails, the rcar-du driver fails to come up, and that also breaks HDMI.
Pre-release board were not shipped to the general public, so it should be safe to push this as a fix. Anyone with a production board would have video fail due to this GPIO expander change.
Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit") Signed-off-by: Adam Ford aford173@gmail.com Reviewed-by: Geert Uytterhoeven geert+renesas@glider.be Link: https://lore.kernel.org/r/20230114225647.227972-1-aford173@gmail.com Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Signed-off-by: Sasha Levin sashal@kernel.org --- .../dts/renesas/beacon-renesom-baseboard.dtsi | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-)
diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi index 8166e3c1ff4e5..cafde91b4721b 100644 --- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi @@ -437,20 +437,6 @@ wm8962_endpoint: endpoint { }; };
- /* 0 - lcd_reset */ - /* 1 - lcd_pwr */ - /* 2 - lcd_select */ - /* 3 - backlight-enable */ - /* 4 - Touch_shdwn */ - /* 5 - LCD_H_pol */ - /* 6 - lcd_V_pol */ - gpio_exp1: gpio@20 { - compatible = "onnn,pca9654"; - reg = <0x20>; - gpio-controller; - #gpio-cells = <2>; - }; - touchscreen@26 { compatible = "ilitek,ili2117"; reg = <0x26>; @@ -482,6 +468,16 @@ hd3ss3220_out_ep: endpoint { }; }; }; + + gpio_exp1: gpio@70 { + compatible = "nxp,pca9538"; + reg = <0x70>; + gpio-controller; + #gpio-cells = <2>; + gpio-line-names = "lcd_reset", "lcd_pwr", "lcd_select", + "backlight-enable", "Touch_shdwn", + "LCD_H_pol", "lcd_V_pol"; + }; };
&lvds0 {
From: Christian Hewitt christianshewitt@gmail.com
[ Upstream commit ce43ea00b927805c1fd0450ccc9b4b6069e292c5 ]
Setting dr_mode to "host" prevents otg which can be useful on a board with limited connectivity options. So don't force host mode.
Fixes: 26d1400f7457 ("arm64: dts: amlogic: add support for Radxa Zero") Signed-off-by: Christian Hewitt christianshewitt@gmail.com Acked-by: Neil Armstrong neil.armstrong@linaro.org Link: https://lore.kernel.org/r/20230127103913.3386435-1-christianshewitt@gmail.co... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts | 1 - 1 file changed, 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts index e3bb6df42ff3e..cf0a9be83fc47 100644 --- a/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts +++ b/arch/arm64/boot/dts/amlogic/meson-g12a-radxa-zero.dts @@ -401,5 +401,4 @@ &uart_AO {
&usb { status = "okay"; - dr_mode = "host"; };
From: Christian Hewitt christianshewitt@gmail.com
[ Upstream commit 856968e066bd77b113965f1a355ec7401edff65f ]
For proper warm (re)boot from SD card the BPI-M5 board requires TFLASH_VDD_EN and VDDIO_C pins to be switched to high impedance mode. This can be achieved using OPEN_DRAIN instead of ACTIVE_HIGH to leave the GPIO pins in input mode and retain high state (pin has the pull-up).
This change is inspired by meson-sm1-odroid.dtsi where OPEN_DRAIN has been used to resolve similar problems with the Odroid C4 board (TF_IO in the C4 dts is the equivalent regulator).
Fixes: 976e920183e4 ("arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts") Suggested-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Christian Hewitt christianshewitt@gmail.com Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Link: https://lore.kernel.org/r/20230127142221.3718184-2-christianshewitt@gmail.co... Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts index 6d0db667581fa..38ebe98ba9c6b 100644 --- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts @@ -123,7 +123,7 @@ vddio_c: regulator-vddio_c { regulator-min-microvolt = <1800000>; regulator-max-microvolt = <3300000>;
- enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>; + enable-gpio = <&gpio_ao GPIOE_2 GPIO_OPEN_DRAIN>; enable-active-high; regulator-always-on;
From: Samuel Holland samuel@sholland.org
[ Upstream commit 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 ]
The property named in the schema is 'enable-gpios', not 'enable-gpio'. This makes no difference at runtime, because the regulator is marked as always-on, but it breaks validation.
Fixes: 4701fc6e5dd9 ("ARM: dts: sun8i: add FriendlyARM NanoPi Duo2") Reviewed-by: Andre Przywara andre.przywara@arm.com Acked-by: Jernej Skrabec jernej.skrabec@gmail.com Signed-off-by: Samuel Holland samuel@sholland.org Link: https://lore.kernel.org/r/20221231225854.16320-2-samuel@sholland.org Signed-off-by: Jernej Skrabec jernej.skrabec@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts index 43641cb82398f..343b02b971555 100644 --- a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts +++ b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts @@ -57,7 +57,7 @@ reg_vdd_cpux: vdd-cpux-regulator { regulator-ramp-delay = <50>; /* 4ms */
enable-active-high; - enable-gpio = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ + enable-gpios = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ gpios = <&r_pio 0 6 GPIO_ACTIVE_HIGH>; /* PL6 */ gpios-states = <0x1>; states = <1100000 0>, <1300000 1>;
From: Ming Lei ming.lei@redhat.com
[ Upstream commit ed878d1c1c641c4a6bd366658fc8e6bc842b80d1 ]
No one uses 'nr_aborted_queues' any more, so remove it.
Reviewed-by: ZiyangZhang ZiyangZhang@linux.alibaba.com Signed-off-by: Ming Lei ming.lei@redhat.com Link: https://lore.kernel.org/r/20230106041711.914434-2-ming.lei@redhat.com Signed-off-by: Jens Axboe axboe@kernel.dk Stable-dep-of: 73a166d97492 ("ublk_drv: don't probe partitions if the ubq daemon isn't trusted") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/block/ublk_drv.c | 1 - 1 file changed, 1 deletion(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 6368b56eacf11..f44b9467720c9 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -159,7 +159,6 @@ struct ublk_device {
struct completion completion; unsigned int nr_queues_ready; - atomic_t nr_aborted_queues;
/* * Our ubq->daemon may be killed without any notification, so
From: Ming Lei ming.lei@redhat.com
[ Upstream commit 73a166d9749230d598320fdae3b687cdc0e2e205 ]
If any ubq daemon is unprivileged, the ublk char device is allowed for unprivileged user actually, and we can't trust the current user, so not probe partitions.
Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reviewed-by: ZiyangZhang ZiyangZhang@linux.alibaba.com Signed-off-by: Ming Lei ming.lei@redhat.com Link: https://lore.kernel.org/r/20230106041711.914434-3-ming.lei@redhat.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/block/ublk_drv.c | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index f44b9467720c9..450bd54fd0061 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -159,6 +159,7 @@ struct ublk_device {
struct completion completion; unsigned int nr_queues_ready; + unsigned int nr_privileged_daemon;
/* * Our ubq->daemon may be killed without any notification, so @@ -1178,6 +1179,9 @@ static void ublk_mark_io_ready(struct ublk_device *ub, struct ublk_queue *ubq) ubq->ubq_daemon = current; get_task_struct(ubq->ubq_daemon); ub->nr_queues_ready++; + + if (capable(CAP_SYS_ADMIN)) + ub->nr_privileged_daemon++; } if (ub->nr_queues_ready == ub->dev_info.nr_hw_queues) complete_all(&ub->completion); @@ -1534,6 +1538,10 @@ static int ublk_ctrl_start_dev(struct io_uring_cmd *cmd) if (ret) goto out_put_disk;
+ /* don't probe partitions if any one ubq daemon is un-trusted */ + if (ub->nr_privileged_daemon != ub->nr_queues_ready) + set_bit(GD_SUPPRESS_PART_SCAN, &disk->state); + get_device(&ub->cdev_dev); ret = add_disk(disk); if (ret) { @@ -1935,6 +1943,7 @@ static int ublk_ctrl_start_recovery(struct io_uring_cmd *cmd) /* set to NULL, otherwise new ubq_daemon cannot mmap the io_cmd_buf */ ub->mm = NULL; ub->nr_queues_ready = 0; + ub->nr_privileged_daemon = 0; init_completion(&ub->completion); ret = 0; out_unlock:
From: Peng Fan peng.fan@nxp.com
[ Upstream commit 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 ]
Per binding doc reg-mux.yaml, the #mux-control-cells should be 1
Signed-off-by: Peng Fan peng.fan@nxp.com Reviewed-by: Marco Felsch m.felsch@pengutronix.de Fixes: 94a905a79f2c ("ARM: dts: imx7s: add multiplexer controls") Signed-off-by: Shawn Guo shawnguo@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/imx7s.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi index 0fc9e6b8b05dc..11b9321badc51 100644 --- a/arch/arm/boot/dts/imx7s.dtsi +++ b/arch/arm/boot/dts/imx7s.dtsi @@ -513,7 +513,7 @@ gpr: iomuxc-gpr@30340000 {
mux: mux-controller { compatible = "mmio-mux"; - #mux-control-cells = <0>; + #mux-control-cells = <1>; mux-reg-masks = <0x14 0x00000010>; };
From: Kemeng Shi shikemeng@huaweicloud.com
[ Upstream commit 903e86f3a64d9573352bbab2f211fdbbaa5772b7 ]
Commit fbb564a557809 ("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()") mentioned that "Checking free bits when setting the target bits. Otherwise, it may reuse the busying bits." This commit add check to make sure all masked bits in word before cmpxchg is zero. Then the existing check after cmpxchg to check any zero bit is existing in masked bits in word is redundant.
Actually, old value of word before cmpxchg is stored in val and we will filter out busy bits in val by "(get_mask & ~val)" after cmpxchg. So we will not reuse busy bits methioned in commit fbb564a557809 ("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()"). Revert new-added check to remove redundant check.
Fixes: fbb564a55780 ("lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch()") Reviewed-by: Jan Kara jack@suse.cz Signed-off-by: Kemeng Shi shikemeng@huaweicloud.com Link: https://lore.kernel.org/r/20230116205059.3821738-3-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- lib/sbitmap.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/lib/sbitmap.c b/lib/sbitmap.c index 1fcede228fa25..2281fbb49d5c6 100644 --- a/lib/sbitmap.c +++ b/lib/sbitmap.c @@ -521,11 +521,9 @@ unsigned long __sbitmap_queue_get_batch(struct sbitmap_queue *sbq, int nr_tags,
get_mask = ((1UL << nr_tags) - 1) << nr; val = READ_ONCE(map->word); - do { - if ((val & ~get_mask) != val) - goto next; - } while (!atomic_long_try_cmpxchg(ptr, &val, - get_mask | val)); + while (!atomic_long_try_cmpxchg(ptr, &val, + get_mask | val)) + ; get_mask = (get_mask & ~val) >> nr; if (get_mask) { *offset = nr + (index << sb->shift);
From: Kemeng Shi shikemeng@huaweicloud.com
[ Upstream commit b5fcf7871acb7f9a3a8ed341a68bd86aba3e254a ]
Commit 180dccb0dba4f ("blk-mq: fix tag_get wait task can't be awakened") mentioned that in case of shared tags, there could be just one real active hctx(queue) because of lazy detection of tag idle. Then driver tag allocation may wait forever on this real active hctx(queue) if wake_batch is > hctx_max_depth where hctx_max_depth is available tags depth for the actve hctx(queue). However, the condition wake_batch > hctx_max_depth is not strong enough to avoid IO hung as the sbitmap_queue_wake_up will only wake up one wait queue for each wake_batch even though there is only one waiter in the woken wait queue. After this, there is only one tag to free and wake_batch may not be reached anymore. Commit 180dccb0dba4f ("blk-mq: fix tag_get wait task can't be awakened") methioned that driver tag allocation may wait forever. Actually, the inactive hctx(queue) will be truely idle after at most 30 seconds and will call blk_mq_tag_wakeup_all to wake one waiter per wait queue to break the hung. But IO hung for 30 seconds is also not acceptable. Set batch size to small enough that depth of the shared hctx(queue) is enough to wake up all of the queues like sbq_calc_wake_batch do to fix this potential IO hung.
Although hctx_max_depth will be clamped to at least 4 while wake_batch recalculation does not do the clamp, the wake_batch will be always recalculated to 1 when hctx_max_depth <= 4.
Fixes: 180dccb0dba4 ("blk-mq: fix tag_get wait task can't be awakened") Reviewed-by: Jan Kara jack@suse.cz Signed-off-by: Kemeng Shi shikemeng@huaweicloud.com Link: https://lore.kernel.org/r/20230116205059.3821738-6-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- lib/sbitmap.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/lib/sbitmap.c b/lib/sbitmap.c index 2281fbb49d5c6..888c51235bd3c 100644 --- a/lib/sbitmap.c +++ b/lib/sbitmap.c @@ -464,13 +464,10 @@ void sbitmap_queue_recalculate_wake_batch(struct sbitmap_queue *sbq, unsigned int users) { unsigned int wake_batch; - unsigned int min_batch; unsigned int depth = (sbq->sb.depth + users - 1) / users;
- min_batch = sbq->sb.depth >= (4 * SBQ_WAIT_QUEUES) ? 4 : 1; - wake_batch = clamp_val(depth / SBQ_WAIT_QUEUES, - min_batch, SBQ_WAKE_BATCH); + 1, SBQ_WAKE_BATCH);
WRITE_ONCE(sbq->wake_batch, wake_batch); }
From: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
[ Upstream commit cc4f0b13a887b483faa45084616998a21b63889d ]
MT8195 features the ARM DynamIQ technology and combines both four Cortex-A78 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster: fix the CPU map to reflect that.
Signed-off-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board") Link: https://lore.kernel.org/r/20230126103526.417039-2-angelogioacchino.delregno@... Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi index d8d846a57d97f..f0bd5754d19d0 100644 --- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi @@ -151,22 +151,20 @@ core2 { core3 { cpu = <&cpu3>; }; - };
- cluster1 { - core0 { + core4 { cpu = <&cpu4>; };
- core1 { + core5 { cpu = <&cpu5>; };
- core2 { + core6 { cpu = <&cpu6>; };
- core3 { + core7 { cpu = <&cpu7>; }; };
From: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
[ Upstream commit 160ce54d635455ffb5e9b42c5ba9cb9aaa98cdb2 ]
MT8192 features the ARM DynamIQ technology and combines both four Cortex-A76 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster: fix the CPU map to reflect that.
Signed-off-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile") Link: https://lore.kernel.org/r/20230126103526.417039-3-angelogioacchino.delregno@... Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8192.dtsi | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi index 46a1e457fab45..627e3bf1c544b 100644 --- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi @@ -158,19 +158,16 @@ core2 { core3 { cpu = <&cpu3>; }; - }; - - cluster1 { - core0 { + core4 { cpu = <&cpu4>; }; - core1 { + core5 { cpu = <&cpu5>; }; - core2 { + core6 { cpu = <&cpu6>; }; - core3 { + core7 { cpu = <&cpu7>; }; };
From: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
[ Upstream commit 1c473804b0c8a68c6ef2cf519b38ec6725ca4aa5 ]
MT8186 features the ARM DynamIQ technology and combines both two Cortex-A76 (big) and six Cortex-A55 (LITTLE) CPUs in one cluster: fix the CPU map to reflect that.
Signed-off-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile") Link: https://lore.kernel.org/r/20230126103526.417039-4-angelogioacchino.delregno@... Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8186.dtsi | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi index 857b0c22422f4..0d8d2799d86d1 100644 --- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi @@ -47,14 +47,12 @@ core4 { core5 { cpu = <&cpu5>; }; - };
- cluster1 { - core0 { + core6 { cpu = <&cpu6>; };
- core1 { + core7 { cpu = <&cpu7>; }; };
From: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
[ Upstream commit 22925af785fa3470efdf566339616d801119d348 ]
Specify #pwm-cells on pwm@11006000 to make it actually usable.
Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes") Signed-off-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20221128112028.58021-2-angelogioacchino.delregno@c... Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi index 146e18b5b1f46..7bb316922a3a9 100644 --- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi @@ -435,6 +435,7 @@ uart3: serial@11005000 { pwm: pwm@11006000 { compatible = "mediatek,mt7622-pwm"; reg = <0 0x11006000 0 0x1000>; + #pwm-cells = <2>; interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_LOW>; clocks = <&topckgen CLK_TOP_PWM_SEL>, <&pericfg CLK_PERI_PWM_PD>,
From: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
[ Upstream commit e5e961628d696237ddc3d53d9d5ac11f43e0bf67 ]
MT8186's watchdog embeds a reset controller and needs only the mediatek,mt8186-wdt compatible string as the MT6589 one is there for watchdogs that don't have any reset controller capability.
Fixes: 2e78620b1350 ("arm64: dts: Add MediaTek MT8186 dts and evaluation board and Makefile") Signed-off-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Co-developed-by: Allen-KH Cheng allen-kh.cheng@mediatek.com Signed-off-by: Allen-KH Cheng allen-kh.cheng@mediatek.com Reviewed-by: Nícolas F. R. A. Prado nfraprado@collabora.com Link: https://lore.kernel.org/r/20221108033209.22751-2-allen-kh.cheng@mediatek.com Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8186.dtsi | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi index 0d8d2799d86d1..a02bf4ab1504d 100644 --- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi @@ -333,8 +333,7 @@ pio: pinctrl@10005000 { };
watchdog: watchdog@10007000 { - compatible = "mediatek,mt8186-wdt", - "mediatek,mt6589-wdt"; + compatible = "mediatek,mt8186-wdt"; mediatek,disable-extrst; reg = <0 0x10007000 0 0x1000>; #reset-cells = <1>;
From: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com
[ Upstream commit 02938f460cde0d360dde48056c4d1c0a4bd49230 ]
MT8195's watchdog embeds a reset controller and needs only the mediatek,mt8195-wdt compatible string as the MT6589 one is there for watchdogs that don't have any reset controller capability.
Fixes: 37f2582883be ("arm64: dts: Add mediatek SoC mt8195 and evaluation board") Signed-off-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Co-developed-by: Allen-KH Cheng allen-kh.cheng@mediatek.com Signed-off-by: Allen-KH Cheng allen-kh.cheng@mediatek.com Reviewed-by: Nícolas F. R. A. Prado nfraprado@collabora.com Link: https://lore.kernel.org/r/20221108033209.22751-3-allen-kh.cheng@mediatek.com Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt8195.dtsi | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi index f0bd5754d19d0..c5b8abc0c5854 100644 --- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi @@ -694,8 +694,7 @@ power-domain@MT8195_POWER_DOMAIN_AUDIO { };
watchdog: watchdog@10007000 { - compatible = "mediatek,mt8195-wdt", - "mediatek,mt6589-wdt"; + compatible = "mediatek,mt8195-wdt"; mediatek,disable-extrst; reg = <0 0x10007000 0 0x100>; #reset-cells = <1>;
From: Allen-KH Cheng allen-kh.cheng@mediatek.com
[ Upstream commit 70d24df30d06e5c822ba94751166ef55d0e28a89 ]
MT7986's watchdog embeds a reset controller and needs only the mediatek,mt7986-wdt compatible string as the MT6589 one is there for watchdogs that don't have any reset controller capability.
Fixes: 50137c150f5f ("arm64: dts: mediatek: add basic mt7986 support") Signed-off-by: Allen-KH Cheng allen-kh.cheng@mediatek.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Reviewed-by: Nícolas F. R. A. Prado nfraprado@collabora.com Link: https://lore.kernel.org/r/20221108033209.22751-4-allen-kh.cheng@mediatek.com Signed-off-by: Matthias Brugger matthias.bgg@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi index 0e9406fc63e2d..0ed5e067928b5 100644 --- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi +++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi @@ -167,8 +167,7 @@ topckgen: topckgen@1001b000 { };
watchdog: watchdog@1001c000 { - compatible = "mediatek,mt7986-wdt", - "mediatek,mt6589-wdt"; + compatible = "mediatek,mt7986-wdt"; reg = <0 0x1001c000 0 0x1000>; interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH>; #reset-cells = <1>;
From: Patrick Delaunay patrick.delaunay@foss.st.com
[ Upstream commit 366384e495511bea8583e44173629a3012d62db0 ]
The STM32MP13x Device Part Number (also named RPN in reference manual) only uses the first 12 bits in OTP4, all the other bit are reserved and they can be different of zero; they must be masked in NVMEM result, so the number of bits must be defined in the nvmem cell description.
Fixes: 1da8779c0029 ("ARM: dts: stm32: add STM32MP13 SoCs support") Signed-off-by: Patrick Delaunay patrick.delaunay@foss.st.com Signed-off-by: Alexandre Torgue alexandre.torgue@foss.st.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/stm32mp131.dtsi | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/stm32mp131.dtsi b/arch/arm/boot/dts/stm32mp131.dtsi index accc3824f7e98..99d88096959eb 100644 --- a/arch/arm/boot/dts/stm32mp131.dtsi +++ b/arch/arm/boot/dts/stm32mp131.dtsi @@ -527,6 +527,7 @@ bsec: efuse@5c005000 {
part_number_otp: part_number_otp@4 { reg = <0x4 0x2>; + bits = <0 12>; }; ts_cal1: calib@5c { reg = <0x5c 0x2>;
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit e27f38e6255306527e32af85592d805f3360ff94 ]
Nagara is definitely not SM8350, fix it!
Fixes: c53532f7825c ("arm64: dts: qcom: pdx223: correct firmware paths") Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230203142309.1106349-1-konrad.dybcio@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi b/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi index 38256226d2297..e437e9a12069f 100644 --- a/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8450-sony-xperia-nagara.dtsi @@ -534,17 +534,17 @@ &pcie0_phy { };
&remoteproc_adsp { - firmware-name = "qcom/sm8350/Sony/nagara/adsp.mbn"; + firmware-name = "qcom/sm8450/Sony/nagara/adsp.mbn"; status = "okay"; };
&remoteproc_cdsp { - firmware-name = "qcom/sm8350/Sony/nagara/cdsp.mbn"; + firmware-name = "qcom/sm8450/Sony/nagara/cdsp.mbn"; status = "okay"; };
&remoteproc_slpi { - firmware-name = "qcom/sm8350/Sony/nagara/slpi.mbn"; + firmware-name = "qcom/sm8450/Sony/nagara/slpi.mbn"; status = "okay"; };
From: Kemeng Shi shikemeng@huaweicloud.com
[ Upstream commit 6ee858a3d3270a68902d66bb47c151a83622535c ]
Commit 1f5bd336b9150 ("blk-mq: add blk_mq_alloc_request_hctx") add blk_mq_alloc_request_hctx to send commands to a specific queue. If BLK_MQ_REQ_NOWAIT is not set in tag allocation, we may change to different hctx after sleep and get tag from unexpected hctx. So BLK_MQ_REQ_NOWAIT must be set in flags for blk_mq_alloc_request_hctx. After commit 600c3b0cea784 ("blk-mq: open code __blk_mq_alloc_request in blk_mq_alloc_request_hctx"), blk_mq_alloc_request_hctx return -EINVAL if both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED are not set instead of if BLK_MQ_REQ_NOWAIT is not set. So if BLK_MQ_REQ_NOWAIT is not set and BLK_MQ_REQ_RESERVED is set, blk_mq_alloc_request_hctx could alloc tag from unexpected hctx. I guess what we need here is that return -EINVAL if either BLK_MQ_REQ_NOWAIT or BLK_MQ_REQ_RESERVED is not set.
Currently both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED will be set if specific hctx is needed in nvme_auth_submit, nvmf_connect_io_queue and nvmf_connect_admin_queue. Fix the potential BLK_MQ_REQ_NOWAIT missed case in future.
Fixes: 600c3b0cea78 ("blk-mq: open code __blk_mq_alloc_request in blk_mq_alloc_request_hctx") Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Kemeng Shi shikemeng@huaweicloud.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-mq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c index 9c8dc70020bc9..dc29a7c82bb82 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -658,7 +658,8 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, * allocator for this for the rare use case of a command tied to * a specific queue. */ - if (WARN_ON_ONCE(!(flags & (BLK_MQ_REQ_NOWAIT | BLK_MQ_REQ_RESERVED)))) + if (WARN_ON_ONCE(!(flags & BLK_MQ_REQ_NOWAIT)) || + WARN_ON_ONCE(!(flags & BLK_MQ_REQ_RESERVED))) return ERR_PTR(-EINVAL);
if (hctx_idx >= q->nr_hw_queues)
From: Kemeng Shi shikemeng@huaweicloud.com
[ Upstream commit c31e76bcc379182fe67a82c618493b7b8868c672 ]
Commit 97889f9ac24f8 ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()") remove handle of TAG_SHARED in restart, then shared_hctx_restart counted for how many hardware queues are marked for restart is removed too. Remove the stale comment that we still count hardware queues need restart.
Fixes: 97889f9ac24f ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()") Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Kemeng Shi shikemeng@huaweicloud.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-mq-sched.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c index 23d1a90fec427..ae40cdb7a383c 100644 --- a/block/blk-mq-sched.c +++ b/block/blk-mq-sched.c @@ -19,8 +19,7 @@ #include "blk-wbt.h"
/* - * Mark a hardware queue as needing a restart. For shared queues, maintain - * a count of how many hardware queues are marked for restart. + * Mark a hardware queue as needing a restart. */ void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx) {
From: Kemeng Shi shikemeng@huaweicloud.com
[ Upstream commit 98b99e9412d0cde8c7b442bf5efb09528a2ede8b ]
For shared queues case, we will only wait on bitmap_tags if we fail to get driver tag. However, rq could be from breserved_tags, then two problems will occur: 1. io hung if no tag is currently allocated from bitmap_tags. 2. unnecessary wakeup when tag is freed to bitmap_tags while no tag is freed to breserved_tags. Wait on the bitmap which rq from to fix this.
Fixes: f906a6a0f426 ("blk-mq: improve tag waiting setup for non-shared tags") Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Kemeng Shi shikemeng@huaweicloud.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-mq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c index dc29a7c82bb82..8bc6778454e10 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1826,7 +1826,7 @@ static int blk_mq_dispatch_wake(wait_queue_entry_t *wait, unsigned mode, static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, struct request *rq) { - struct sbitmap_queue *sbq = &hctx->tags->bitmap_tags; + struct sbitmap_queue *sbq; struct wait_queue_head *wq; wait_queue_entry_t *wait; bool ret; @@ -1849,6 +1849,10 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, if (!list_empty_careful(&wait->entry)) return false;
+ if (blk_mq_tag_is_reserved(rq->mq_hctx->sched_tags, rq->internal_tag)) + sbq = &hctx->tags->breserved_tags; + else + sbq = &hctx->tags->bitmap_tags; wq = &bt_wait_ptr(sbq, hctx)->wait;
spin_lock_irq(&wq->lock);
From: Kemeng Shi shikemeng@huaweicloud.com
[ Upstream commit 47df9ce95cd568d3f84218c4f65e9fbd4dfeda55 ]
Commit f906a6a0f4268 ("blk-mq: improve tag waiting setup for non-shared tags") mark restart for unshared tags for improvement. At that time, tags is only shared betweens queues and we can check if tags is shared by test BLK_MQ_F_TAG_SHARED. Afterwards, commit 32bc15afed04b ("blk-mq: Facilitate a shared sbitmap per tagset") enabled tags share betweens hctxs inside a queue. We only mark restart for shared hctxs inside a queue and may cause io hung if there is no tag currently allocated by hctxs going to be marked restart. Wait on sbitmap_queue instead of mark restart for shared hctxs case to fix this.
Fixes: 32bc15afed04 ("blk-mq: Facilitate a shared sbitmap per tagset") Signed-off-by: Kemeng Shi shikemeng@huaweicloud.com Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-mq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/block/blk-mq.c b/block/blk-mq.c index 8bc6778454e10..b9e3b558367f1 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1831,7 +1831,8 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, wait_queue_entry_t *wait; bool ret;
- if (!(hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED)) { + if (!(hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED) && + !(blk_mq_is_shared_tags(hctx->flags))) { blk_mq_sched_mark_restart_hctx(hctx);
/* @@ -2101,7 +2102,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list, bool needs_restart; /* For non-shared tags, the RESTART check will suffice */ bool no_tag = prep == PREP_DISPATCH_NO_TAG && - (hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED); + ((hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED) || + blk_mq_is_shared_tags(hctx->flags));
if (nr_budgets) blk_mq_release_budgets(q, list);
From: Kemeng Shi shikemeng@huaweicloud.com
[ Upstream commit 01542f651a9f58a9b176c3d3dc3eefbacee53b78 ]
Commit 88022d7201e96 ("blk-mq: don't handle failure in .get_budget") remove BLK_STS_RESOURCE return value and we only check if we can get the budget from .get_budget() now. Correct stale comment that ".get_budget() returns BLK_STS_NO_RESOURCE" to ".get_budget() fails to get the budget".
Fixes: 88022d7201e9 ("blk-mq: don't handle failure in .get_budget") Signed-off-by: Kemeng Shi shikemeng@huaweicloud.com Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-mq-sched.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c index ae40cdb7a383c..06b312c691143 100644 --- a/block/blk-mq-sched.c +++ b/block/blk-mq-sched.c @@ -81,7 +81,7 @@ static bool blk_mq_dispatch_hctx_list(struct list_head *rq_list) /* * Only SCSI implements .get_budget and .put_budget, and SCSI restarts * its queue by itself in its completion handler, so we don't need to - * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. + * restart queue if .get_budget() fails to get the budget. * * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to * be run again. This is necessary to avoid starving flushes. @@ -209,7 +209,7 @@ static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx, /* * Only SCSI implements .get_budget and .put_budget, and SCSI restarts * its queue by itself in its completion handler, so we don't need to - * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. + * restart queue if .get_budget() fails to get the budget. * * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to * be run again. This is necessary to avoid starving flushes.
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit ac0d84d4556cecf81ba0b1631d25d9a395235a5c ]
In some cases the driver might need using GPLL0 to drive CPU clocks. Bring it in through the sys_apcs_aux clock.
Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230113120544.59320-15-dmitry.baryshkov@linaro.or... Stable-dep-of: 8ae72166c2b7 ("arm64: dts: qcom: msm8996 switch from RPM_SMD_BB_CLK1 to RPM_SMD_XO_CLK_SRC") Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi index d31464204f696..286f7b44057dd 100644 --- a/arch/arm64/boot/dts/qcom/msm8996.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi @@ -2940,8 +2940,8 @@ kryocc: clock-controller@6400000 { compatible = "qcom,msm8996-apcc"; reg = <0x06400000 0x90000>;
- clock-names = "xo"; - clocks = <&rpmcc RPM_SMD_BB_CLK1>; + clock-names = "xo", "sys_apcs_aux"; + clocks = <&rpmcc RPM_SMD_BB_CLK1>, <&apcs_glb>;
#clock-cells = <1>; };
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 8ae72166c2b73b0f2ce498ea15d4feceb9fef50e ]
The vendor kernel uses RPM_SMD_XO_CLK_SRC clock as an CXO clock rather than using the RPM_SMD_BB_CLK1 directly. Follow this example and switch msm8996.dtsi to use RPM_SMD_XO_CLK_SRC clock instead of RPM_SMB_BB_CLK1.
Fixes: 2b8c9c77c268 ("arm64: dts: qcom: msm8996: convert xo_board to RPM_SMD_BB_CLK1") Suggested-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230120061417.2623751-7-dmitry.baryshkov@linaro.o... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8996.dtsi | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi index 286f7b44057dd..a444d9b531228 100644 --- a/arch/arm64/boot/dts/qcom/msm8996.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi @@ -713,7 +713,7 @@ gcc: clock-controller@300000 { #power-domain-cells = <1>; reg = <0x00300000 0x90000>;
- clocks = <&rpmcc RPM_SMD_BB_CLK1>, + clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>, <&rpmcc RPM_SMD_LN_BB_CLK>, <&sleep_clk>, <&pciephy_0>, @@ -1050,7 +1050,7 @@ dsi0_phy: phy@994400 { #clock-cells = <1>; #phy-cells = <0>;
- clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_BB_CLK1>; + clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_XO_CLK_SRC>; clock-names = "iface", "ref"; status = "disabled"; }; @@ -1117,7 +1117,7 @@ dsi1_phy: phy@996400 { #clock-cells = <1>; #phy-cells = <0>;
- clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_BB_CLK1>; + clocks = <&mmcc MDSS_AHB_CLK>, <&rpmcc RPM_SMD_XO_CLK_SRC>; clock-names = "iface", "ref"; status = "disabled"; }; @@ -2941,7 +2941,7 @@ kryocc: clock-controller@6400000 { reg = <0x06400000 0x90000>;
clock-names = "xo", "sys_apcs_aux"; - clocks = <&rpmcc RPM_SMD_BB_CLK1>, <&apcs_glb>; + clocks = <&rpmcc RPM_SMD_XO_A_CLK_SRC>, <&apcs_glb>;
#clock-cells = <1>; }; @@ -3060,7 +3060,7 @@ sdhc1: mmc@7464900 { clock-names = "iface", "core", "xo"; clocks = <&gcc GCC_SDCC1_AHB_CLK>, <&gcc GCC_SDCC1_APPS_CLK>, - <&rpmcc RPM_SMD_BB_CLK1>; + <&rpmcc RPM_SMD_XO_CLK_SRC>; resets = <&gcc GCC_SDCC1_BCR>;
pinctrl-names = "default", "sleep"; @@ -3084,7 +3084,7 @@ sdhc2: mmc@74a4900 { clock-names = "iface", "core", "xo"; clocks = <&gcc GCC_SDCC2_AHB_CLK>, <&gcc GCC_SDCC2_APPS_CLK>, - <&rpmcc RPM_SMD_BB_CLK1>; + <&rpmcc RPM_SMD_XO_CLK_SRC>; resets = <&gcc GCC_SDCC2_BCR>;
pinctrl-names = "default", "sleep"; @@ -3406,7 +3406,7 @@ adsp_pil: remoteproc@9300000 { interrupt-names = "wdog", "fatal", "ready", "handover", "stop-ack";
- clocks = <&rpmcc RPM_SMD_BB_CLK1>; + clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>; clock-names = "xo";
memory-region = <&adsp_mem>;
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit 6027331e6eae9eb957d1b73a7e3255f4151d6163 ]
The serial/UART device node does not have children with unit addresses, so address/size cells are not correct.
Fixes: cf03cd7e12bd ("arm64: dts: qcom: sm8350: Set up WRAP0 QUPs") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230124084951.38195-2-krzysztof.kozlowski@linaro.... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 -- 1 file changed, 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi index fb3cd20a82b5e..646c64f0d1e28 100644 --- a/arch/arm64/boot/dts/qcom/sm8350.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi @@ -1043,8 +1043,6 @@ uart2: serial@98c000 { interrupts = <GIC_SPI 604 IRQ_TYPE_LEVEL_HIGH>; power-domains = <&rpmhpd SM8350_CX>; operating-points-v2 = <&qup_opp_table_100mhz>; - #address-cells = <1>; - #size-cells = <0>; status = "disabled"; };
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit 60d2da2c916956535cf37b7bf1ae8fefbf432e55 ]
The serial/UART device node does not have children with unit addresses, so address/size cells are not correct.
Fixes: f5837418479a ("arm64: dts: qcom: sm8450: add uart20 node") Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230124084951.38195-3-krzysztof.kozlowski@linaro.... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm8450.dtsi | 4 ---- 1 file changed, 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi index eb3318516243c..f57980a32b433 100644 --- a/arch/arm64/boot/dts/qcom/sm8450.dtsi +++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi @@ -997,8 +997,6 @@ uart20: serial@894000 { pinctrl-names = "default"; pinctrl-0 = <&qup_uart20_default>; interrupts = <GIC_SPI 587 IRQ_TYPE_LEVEL_HIGH>; - #address-cells = <1>; - #size-cells = <0>; status = "disabled"; };
@@ -1391,8 +1389,6 @@ uart7: serial@99c000 { pinctrl-names = "default"; pinctrl-0 = <&qup_uart7_tx>, <&qup_uart7_rx>; interrupts = <GIC_SPI 608 IRQ_TYPE_LEVEL_HIGH>; - #address-cells = <1>; - #size-cells = <0>; status = "disabled"; }; };
From: Jamie Douglass jamiemdouglass@gmail.com
[ Upstream commit d44106883d74992343710f18c4aaae937c7cefab ]
The memory region reserved by a previous commit (see fixes tag below) overlaps with the SMEM and MPSS memory regions, causing error messages in dmesg: OF: reserved mem: OVERLAP DETECTED! reserved@5000000 (0x0000000005000000--0x0000000007200000) overlaps with smem_region@6a00000 (0x0000000006a00000--0x0000000006c00000)
OF: reserved mem: OVERLAP DETECTED! reserved@6c00000 (0x0000000006c00000--0x0000000007200000) overlaps with memory@7000000 (0x0000000007000000--0x000000000ca00000)
This patch resolves both of these by splitting the previously reserved memory region into two sections either side of the SMEM region and by cutting off the second memory region to 0x7000000.
Fixes: 22c7e1a0fa45 ("arm64: dts: msm8992-bullhead: add memory hole region") Signed-off-by: Jamie Douglass jamiemdouglass@gmail.com Reviewed-by: Petr Vorel pvorel@suse.cz Tested-by: Petr Vorel pvorel@suse.cz Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230202054819.16079-1-jamiemdouglass@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi index 4bceb362a5c02..cdd796040703c 100644 --- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi @@ -56,8 +56,13 @@ cont_splash_mem: memory@3400000 { no-map; };
- removed_region: reserved@5000000 { - reg = <0 0x05000000 0 0x2200000>; + reserved@5000000 { + reg = <0x0 0x05000000 0x0 0x1a00000>; + no-map; + }; + + reserved@6c00000 { + reg = <0x0 0x06c00000 0x0 0x400000>; no-map; }; };
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit a4fb71497df23cb0d02d70fa2b8f8786328e325d ]
Correct the number of GPIOs in TLMM pin controller.
Fixes: 9fb08c801923 ("arm64: dts: qcom: Add MSM8953 device tree") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Luca Weiss luca@z3ntu.xyz Acked-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230202104452.299048-10-krzysztof.kozlowski@linar... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8953.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8953.dtsi b/arch/arm64/boot/dts/qcom/msm8953.dtsi index 32349174c4bd9..70f033656b555 100644 --- a/arch/arm64/boot/dts/qcom/msm8953.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8953.dtsi @@ -455,7 +455,7 @@ tlmm: pinctrl@1000000 { reg = <0x1000000 0x300000>; interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>; gpio-controller; - gpio-ranges = <&tlmm 0 0 155>; + gpio-ranges = <&tlmm 0 0 142>; #gpio-cells = <2>; interrupt-controller; #interrupt-cells = <2>;
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
[ Upstream commit 272fc52431611d779de132c4e03de6e0c1199731 ]
Correct the number of GPIOs in TLMM pin controller.
Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Iskren Chernev me@iskren.info Acked-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230202104452.299048-11-krzysztof.kozlowski@linar... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/sm6115.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi index 81523ab7ff602..9de56365703cf 100644 --- a/arch/arm64/boot/dts/qcom/sm6115.dtsi +++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi @@ -363,7 +363,7 @@ tlmm: pinctrl@500000 { reg-names = "west", "south", "east"; interrupts = <GIC_SPI 227 IRQ_TYPE_LEVEL_HIGH>; gpio-controller; - gpio-ranges = <&tlmm 0 0 121>; + gpio-ranges = <&tlmm 0 0 114>; /* GPIOs + ufs_reset */ #gpio-cells = <2>; interrupt-controller; #interrupt-cells = <2>;
From: Petr Vorel pvorel@suse.cz
[ Upstream commit 2866527093ddbc6356bb31f560f0b4b4decf3e2e ]
Enable pm8994_s1, pm8994_l{26,29,30,32} regulators. Use values from downstream kernel on bullhead rev 1.01.
NOTE: downstream kernel on angler rev 1.01 differences: * pm8994_l29: regulator-min-microvolt = <2700000> * pm8994_l{20,28,31}: use regulator-boot-on
Verification: [ 1.832460] s1: Bringing 0uV into 1025000-1025000uV ... [ 2.057667] l26: Bringing 0uV into 987500-987500uV ... [ 2.075722] l29: Bringing 0uV into 2800000-2800000uV [ 2.076604] l30: Bringing 0uV into 1800000-1800000uV [ 2.082431] l31: Bringing 0uV into 1262500-1262500uV [ 2.095767] l32: Bringing 0uV into 1800000-1800000uV
Fixes: f3b2c99e73be ("arm64: dts: Enable onboard SDHCI on msm8992") Signed-off-by: Petr Vorel pvorel@suse.cz Tested-by: Jamie Douglass jamiemdouglass@gmail.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230203100952.13857-1-pvorel@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- .../boot/dts/qcom/msm8992-lg-bullhead.dtsi | 32 ++++++------------- 1 file changed, 10 insertions(+), 22 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi index cdd796040703c..cd77dcb558722 100644 --- a/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8992-lg-bullhead.dtsi @@ -94,8 +94,8 @@ pm8994_regulators: regulators-0 { /* S1, S2, S6 and S12 are managed by RPMPD */
pm8994_s1: s1 { - regulator-min-microvolt = <800000>; - regulator-max-microvolt = <800000>; + regulator-min-microvolt = <1025000>; + regulator-max-microvolt = <1025000>; };
pm8994_s2: s2 { @@ -251,11 +251,8 @@ pm8994_l25: l25 { };
pm8994_l26: l26 { - /* - * TODO: value from downstream - * regulator-min-microvolt = <987500>; - * fails to apply - */ + regulator-min-microvolt = <987500>; + regulator-max-microvolt = <987500>; };
pm8994_l27: l27 { @@ -269,19 +266,13 @@ pm8994_l28: l28 { };
pm8994_l29: l29 { - /* - * TODO: Unsupported voltage range. - * regulator-min-microvolt = <2800000>; - * regulator-max-microvolt = <2800000>; - */ + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; };
pm8994_l30: l30 { - /* - * TODO: get this verified - * regulator-min-microvolt = <1800000>; - * regulator-max-microvolt = <1800000>; - */ + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; };
pm8994_l31: l31 { @@ -290,11 +281,8 @@ pm8994_l31: l31 { };
pm8994_l32: l32 { - /* - * TODO: get this verified - * regulator-min-microvolt = <1800000>; - * regulator-max-microvolt = <1800000>; - */ + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; }; };
From: Qiheng Lin linqiheng@huawei.com
[ Upstream commit 460e9bed82e49db1b823dcb4e421783854d86c40 ]
`dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it also needs to be freed before the error returns, just like the other cases in this function.
Fixes: 9e12e54c7a8f ("s390/dasd: Handle out-of-space constraint") Signed-off-by: Qiheng Lin linqiheng@huawei.com Link: https://lore.kernel.org/r/20221208133809.16796-1-linqiheng@huawei.com Signed-off-by: Stefan Haberland sth@linux.ibm.com Link: https://lore.kernel.org/r/20230210000253.1644903-3-sth@linux.ibm.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/s390/block/dasd_eckd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c index 5d0b9991e91a4..b20ce86b97b29 100644 --- a/drivers/s390/block/dasd_eckd.c +++ b/drivers/s390/block/dasd_eckd.c @@ -6956,8 +6956,10 @@ dasd_eckd_init(void) return -ENOMEM; dasd_vol_info_req = kmalloc(sizeof(*dasd_vol_info_req), GFP_KERNEL | GFP_DMA); - if (!dasd_vol_info_req) + if (!dasd_vol_info_req) { + kfree(dasd_reserve_req); return -ENOMEM; + } pe_handler_worker = kmalloc(sizeof(*pe_handler_worker), GFP_KERNEL | GFP_DMA); if (!pe_handler_worker) {
From: Richard Guy Briggs rgb@redhat.com
[ Upstream commit fbe870a72fd1ddc5e08c23764e23e5766f54aa87 ]
fadvise and madvise both provide hints for caching or access pattern for file and memory respectively. Skip them.
Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring") Signed-off-by: Richard Guy Briggs rgb@redhat.com Link: https://lore.kernel.org/r/b5dfdcd541115c86dbc774aa9dd502c964849c5f.167528264... Acked-by: Paul Moore paul@paul-moore.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- io_uring/opdef.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/io_uring/opdef.c b/io_uring/opdef.c index 3aa0d65c50e34..be45b76649a08 100644 --- a/io_uring/opdef.c +++ b/io_uring/opdef.c @@ -313,6 +313,7 @@ const struct io_op_def io_op_defs[] = { }, [IORING_OP_MADVISE] = { .name = "MADVISE", + .audit_skip = 1, .prep = io_madvise_prep, .issue = io_madvise, },
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 ]
Commit 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") removed any path which could make pick_next_rt_entity() return NULL. However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of pick_next_rt_entity()) still checks the error condition, which can never happen, since list_entry() never returns NULL. Remove the BUG_ON check, and instead emit a warning in the only possible error condition here: the queue being empty which should never happen.
Fixes: 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Reviewed-by: Phil Auld pauld@redhat.com Reviewed-by: Steven Rostedt (Google) rostedt@goodmis.org Link: https://lore.kernel.org/r/20230128-list-entry-null-check-sched-v3-1-b1a71bd1... Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/sched/rt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index ed2a47e4ddaec..0a11f44adee57 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -1777,6 +1777,8 @@ static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq) BUG_ON(idx >= MAX_RT_PRIO);
queue = array->queue + idx; + if (SCHED_WARN_ON(list_empty(queue))) + return NULL; next = list_entry(queue->next, struct sched_rt_entity, run_list);
return next; @@ -1789,7 +1791,8 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)
do { rt_se = pick_next_rt_entity(rt_rq); - BUG_ON(!rt_se); + if (unlikely(!rt_se)) + return NULL; rt_rq = group_rt_rq(rt_se); } while (rt_rq);
From: Kan Liang kan.liang@linux.intel.com
[ Upstream commit 89e97eb8cec0f1af5ebf2380308913256ca7915a ]
The time order is incorrect when the TSC in a PEBS record is used.
$perf record -e cycles:upp dd if=/dev/zero of=/dev/null count=10000 $ perf script --show-task-events perf-exec 0 0.000000: PERF_RECORD_COMM: perf-exec:915/915 dd 915 106.479872: PERF_RECORD_COMM exec: dd:915/915 dd 915 106.483270: PERF_RECORD_EXIT(915:915):(914:914) dd 915 106.512429: 1 cycles:upp: ffffffff96c011b7 [unknown] ([unknown]) ... ...
The perf time is from sched_clock_cpu(). The current PEBS code unconditionally convert the TSC to native_sched_clock(). There is a shift between the two clocks. If the TSC is stable, the shift is consistent, __sched_clock_offset. If the TSC is unstable, the shift has to be calculated at runtime.
This patch doesn't support the conversion when the TSC is unstable. The TSC unstable case is a corner case and very unlikely to happen. If it happens, the TSC in a PEBS record will be dropped and fall back to perf_event_clock().
Fixes: 47a3aeb39e8d ("perf/x86/intel/pebs: Fix PEBS timestamps overwritten") Reported-by: Namhyung Kim namhyung@kernel.org Signed-off-by: Kan Liang kan.liang@linux.intel.com Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Link: https://lore.kernel.org/all/CAM9d7cgWDVAq8-11RbJ2uGfwkKD6fA-OMwOKDrNUrU_=8Mg... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/events/intel/ds.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-)
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c index 88e58b6ee73c0..91b214231e03c 100644 --- a/arch/x86/events/intel/ds.c +++ b/arch/x86/events/intel/ds.c @@ -2,12 +2,14 @@ #include <linux/bitops.h> #include <linux/types.h> #include <linux/slab.h> +#include <linux/sched/clock.h>
#include <asm/cpu_entry_area.h> #include <asm/perf_event.h> #include <asm/tlbflush.h> #include <asm/insn.h> #include <asm/io.h> +#include <asm/timer.h>
#include "../perf_event.h"
@@ -1519,6 +1521,27 @@ static u64 get_data_src(struct perf_event *event, u64 aux) return val; }
+static void setup_pebs_time(struct perf_event *event, + struct perf_sample_data *data, + u64 tsc) +{ + /* Converting to a user-defined clock is not supported yet. */ + if (event->attr.use_clockid != 0) + return; + + /* + * Doesn't support the conversion when the TSC is unstable. + * The TSC unstable case is a corner case and very unlikely to + * happen. If it happens, the TSC in a PEBS record will be + * dropped and fall back to perf_event_clock(). + */ + if (!using_native_sched_clock() || !sched_clock_stable()) + return; + + data->time = native_sched_clock_from_tsc(tsc) + __sched_clock_offset; + data->sample_flags |= PERF_SAMPLE_TIME; +} + #define PERF_SAMPLE_ADDR_TYPE (PERF_SAMPLE_ADDR | \ PERF_SAMPLE_PHYS_ADDR | \ PERF_SAMPLE_DATA_PAGE_SIZE) @@ -1668,11 +1691,8 @@ static void setup_pebs_fixed_sample_data(struct perf_event *event, * * We can only do this for the default trace clock. */ - if (x86_pmu.intel_cap.pebs_format >= 3 && - event->attr.use_clockid == 0) { - data->time = native_sched_clock_from_tsc(pebs->tsc); - data->sample_flags |= PERF_SAMPLE_TIME; - } + if (x86_pmu.intel_cap.pebs_format >= 3) + setup_pebs_time(event, data, pebs->tsc);
if (has_branch_stack(event)) { data->br_stack = &cpuc->lbr_stack; @@ -1735,10 +1755,7 @@ static void setup_pebs_adaptive_sample_data(struct perf_event *event, perf_sample_data_init(data, 0, event->hw.last_period); data->period = event->hw.last_period;
- if (event->attr.use_clockid == 0) { - data->time = native_sched_clock_from_tsc(basic->tsc); - data->sample_flags |= PERF_SAMPLE_TIME; - } + setup_pebs_time(event, data, basic->tsc);
/* * We must however always use iregs for the unwinder to stay sane; the
From: silviazhao silviazhao-oc@zhaoxin.com
[ Upstream commit fd636b6a9bc6034f2e5bb869658898a2b472c037 ]
Some of Nano series processors will lead GP when accessing PMC fixed counter. Meanwhile, their hardware support for PMC has not announced externally. So exclude Nano CPUs from ZXC by checking stepping information. This is an unambiguous way to differentiate between ZXC and Nano CPUs.
Following are Nano and ZXC FMS information: Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D] ZXC FMS: Family=6, Model=F, Stepping=E-F OR Family=6, Model=0x19, Stepping=0-3
Fixes: 3a4ac121c2ca ("x86/perf: Add hardware performance events support for Zhaoxin CPU.")
Reported-by: Arjan 8vvbbqzo567a@nospam.xutrox.com Reported-by: Kevin Brace kevinbrace@gmx.com Signed-off-by: silviazhao silviazhao-oc@zhaoxin.com Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=212389 Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/events/zhaoxin/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/x86/events/zhaoxin/core.c b/arch/x86/events/zhaoxin/core.c index 949d845c922b4..3e9acdaeed1ec 100644 --- a/arch/x86/events/zhaoxin/core.c +++ b/arch/x86/events/zhaoxin/core.c @@ -541,7 +541,13 @@ __init int zhaoxin_pmu_init(void)
switch (boot_cpu_data.x86) { case 0x06: - if (boot_cpu_data.x86_model == 0x0f || boot_cpu_data.x86_model == 0x19) { + /* + * Support Zhaoxin CPU from ZXC series, exclude Nano series through FMS. + * Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D] + * ZXC FMS: Family=6, Model=F, Stepping=E-F OR Family=6, Model=0x19, Stepping=0-3 + */ + if ((boot_cpu_data.x86_model == 0x0f && boot_cpu_data.x86_stepping >= 0x0e) || + boot_cpu_data.x86_model == 0x19) {
x86_pmu.max_period = x86_pmu.cntval_mask >> 1;
From: Denis Kenzior denkenz@gmail.com
[ Upstream commit 10de7b54293995368c52d9aa153f3e7a359f04a1 ]
When support for ECDSA keys was added, constraints for data & signature sizes were never updated. This makes it impossible to use such keys via keyctl API from userspace.
Update constraint on max_data_size to 64 bytes in order to support SHA512-based signatures. Also update the signature length constraints per ECDSA signature encoding described in RFC 5480.
Fixes: 299f561a6693 ("x509: Add support for parsing x509 certs with ECDSA keys") Signed-off-by: Denis Kenzior denkenz@gmail.com Reviewed-by: Stefan Berger stefanb@linux.ibm.com Reviewed-by: Jarkko Sakkinen jarkko@kernel.org Signed-off-by: Jarkko Sakkinen jarkko@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- crypto/asymmetric_keys/public_key.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c index 2f8352e888602..eca5671ad3f22 100644 --- a/crypto/asymmetric_keys/public_key.c +++ b/crypto/asymmetric_keys/public_key.c @@ -186,8 +186,28 @@ static int software_key_query(const struct kernel_pkey_params *params,
len = crypto_akcipher_maxsize(tfm); info->key_size = len * 8; - info->max_data_size = len; - info->max_sig_size = len; + + if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) { + /* + * ECDSA key sizes are much smaller than RSA, and thus could + * operate on (hashed) inputs that are larger than key size. + * For example SHA384-hashed input used with secp256r1 + * based keys. Set max_data_size to be at least as large as + * the largest supported hash size (SHA512) + */ + info->max_data_size = 64; + + /* + * Verify takes ECDSA-Sig (described in RFC 5480) as input, + * which is actually 2 'key_size'-bit integers encoded in + * ASN.1. Account for the ASN.1 encoding overhead here. + */ + info->max_sig_size = 2 * (len + 3) + 2; + } else { + info->max_data_size = len; + info->max_sig_size = len; + } + info->max_enc_size = len; info->max_dec_size = len; info->supported_ops = (KEYCTL_SUPPORTS_ENCRYPT |
From: Liu Xiaodong xiaodong.liu@intel.com
[ Upstream commit 2f1e07dda1e1310873647abc40bbc49eaf3b10e3 ]
Currently, uring_cmd with UBLK_IO_FETCH_REQ or UBLK_IO_COMMIT_AND_FETCH_REQ is always checked whether userspace server has provided IO buffer even flag UBLK_F_NEED_GET_DATA is configured.
This is a excessive check. If UBLK_F_NEED_GET_DATA is configured, FETCH_RQ doesn't need to provide IO buffer; COMMIT_AND_FETCH_REQ also doesn't need to do that if the IO type is not READ.
Check ub_cmd->addr together with ublk_need_get_data() and IO type in ublk_ch_uring_cmd().
With this fix, userspace server doesn't need to preserve buffers for every ublk_io when flag UBLK_F_NEED_GET_DATA is configured, in order to save memory.
Signed-off-by: Liu Xiaodong xiaodong.liu@intel.com Fixes: c86019ff75c1 ("ublk_drv: add support for UBLK_IO_NEED_GET_DATA") Reviewed-by: Ming Lei ming.lei@redhat.com Link: https://lore.kernel.org/r/20230210141356.112321-1-xiaodong.liu@intel.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/block/ublk_drv.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 450bd54fd0061..4aec9be0ab77e 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -1206,6 +1206,7 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) u32 cmd_op = cmd->cmd_op; unsigned tag = ub_cmd->tag; int ret = -EINVAL; + struct request *req;
pr_devel("%s: received: cmd op %d queue %d tag %d result %d\n", __func__, cmd->cmd_op, ub_cmd->q_id, tag, @@ -1256,8 +1257,8 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) */ if (io->flags & UBLK_IO_FLAG_OWNED_BY_SRV) goto out; - /* FETCH_RQ has to provide IO buffer */ - if (!ub_cmd->addr) + /* FETCH_RQ has to provide IO buffer if NEED GET DATA is not enabled */ + if (!ub_cmd->addr && !ublk_need_get_data(ubq)) goto out; io->cmd = cmd; io->flags |= UBLK_IO_FLAG_ACTIVE; @@ -1266,8 +1267,12 @@ static int ublk_ch_uring_cmd(struct io_uring_cmd *cmd, unsigned int issue_flags) ublk_mark_io_ready(ub, ubq); break; case UBLK_IO_COMMIT_AND_FETCH_REQ: - /* FETCH_RQ has to provide IO buffer */ - if (!ub_cmd->addr) + req = blk_mq_tag_to_rq(ub->tag_set.tags[ub_cmd->q_id], tag); + /* + * COMMIT_AND_FETCH_REQ has to provide IO buffer if NEED GET DATA is + * not enabled or it is Read IO. + */ + if (!ub_cmd->addr && (!ublk_need_get_data(ubq) || req_op(req) == REQ_OP_READ)) goto out; if (!(io->flags & UBLK_IO_FLAG_OWNED_BY_SRV)) goto out;
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit c0ee8e0ba5cc17623e63349a168b41e407b1eef0 ]
A special compatible was introduced for PMK8350 both in the driver and the bindings to facilitate for 2 base registers (PBS & HLOS). Use it.
Fixes: b2de43136058 ("arm64: dts: qcom: pmk8350: Add peripherals for pmk8350") Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230213212930.2115182-1-konrad.dybcio@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/pmk8350.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/pmk8350.dtsi b/arch/arm64/boot/dts/qcom/pmk8350.dtsi index 32f5e6af8c11c..f26fb7d32faf2 100644 --- a/arch/arm64/boot/dts/qcom/pmk8350.dtsi +++ b/arch/arm64/boot/dts/qcom/pmk8350.dtsi @@ -21,7 +21,7 @@ pmk8350: pmic@PMK8350_SID { #size-cells = <0>;
pmk8350_pon: pon@1300 { - compatible = "qcom,pm8998-pon"; + compatible = "qcom,pmk8350-pon"; reg = <0x1300>, <0x800>; reg-names = "hlos", "pbs";
From: Jingbo Xu jefflexu@linux.alibaba.com
[ Upstream commit 7032809a44d752b9e2275833787e0aa88a7540af ]
Relinquish fscache volume with mutex held. Otherwise if a new domain is registered when the old domain with the same name gets removed from the list but not relinquished yet, fscache may complain the collision.
Fixes: 8b7adf1dff3d ("erofs: introduce fscache-based domain") Signed-off-by: Jingbo Xu jefflexu@linux.alibaba.com Reviewed-by: Jia Zhu zhujia.zj@bytedance.com Link: https://lore.kernel.org/r/20230209063913.46341-4-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang hsiangkao@linux.alibaba.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/erofs/fscache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c index 014e209623762..a7923d6661301 100644 --- a/fs/erofs/fscache.c +++ b/fs/erofs/fscache.c @@ -337,8 +337,8 @@ static void erofs_fscache_domain_put(struct erofs_domain *domain) kern_unmount(erofs_pseudo_mnt); erofs_pseudo_mnt = NULL; } - mutex_unlock(&erofs_domain_list_lock); fscache_relinquish_volume(domain->volume, NULL, false); + mutex_unlock(&erofs_domain_list_lock); kfree(domain->domain_id); kfree(domain); return;
From: Ming Lei ming.lei@redhat.com
[ Upstream commit 3ce6a115980c019928fcd06e01f64003886af79c ]
We support mixed merge for requests/bios with different fastfail settings. When request fails, each time we only handle the portion with same failfast setting, then bios with failfast can be failed immediately, and bios without failfast can be retried.
The idea is pretty good, but the current implementation has several defects:
1) initially RA bio doesn't set failfast, however bio merge code doesn't consider this point, and just check its failfast setting for deciding if mixed merge is required. Fix this issue by adding helper of bio_failfast().
2) when merging bio to request front, if this request is mixed merged, we have to sync request's faifast setting with 1st bio's failfast. Fix it by calling blk_update_mixed_merge().
3) when merging bio to request back, if this request is mixed merged, we have to mark the bio as failfast, because blk_update_request simply updates request failfast with 1st bio's failfast. Fix it by calling blk_update_mixed_merge().
Fixes one normal EXT4 READ IO failure issue, because it is observed that the normal READ IO is merged with RA IO, and the mixed merged request has different failfast setting with 1st bio's, so finally the normal READ IO doesn't get retried.
Cc: Tejun Heo tj@kernel.org Fixes: 80a761fd33cf ("block: implement mixed merge of different failfast requests") Signed-off-by: Ming Lei ming.lei@redhat.com Link: https://lore.kernel.org/r/20230209125527.667004-1-ming.lei@redhat.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-merge.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-)
diff --git a/block/blk-merge.c b/block/blk-merge.c index b7c193d67185d..30e4a99c2276b 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -757,6 +757,33 @@ void blk_rq_set_mixed_merge(struct request *rq) rq->rq_flags |= RQF_MIXED_MERGE; }
+static inline unsigned int bio_failfast(const struct bio *bio) +{ + if (bio->bi_opf & REQ_RAHEAD) + return REQ_FAILFAST_MASK; + + return bio->bi_opf & REQ_FAILFAST_MASK; +} + +/* + * After we are marked as MIXED_MERGE, any new RA bio has to be updated + * as failfast, and request's failfast has to be updated in case of + * front merge. + */ +static inline void blk_update_mixed_merge(struct request *req, + struct bio *bio, bool front_merge) +{ + if (req->rq_flags & RQF_MIXED_MERGE) { + if (bio->bi_opf & REQ_RAHEAD) + bio->bi_opf |= REQ_FAILFAST_MASK; + + if (front_merge) { + req->cmd_flags &= ~REQ_FAILFAST_MASK; + req->cmd_flags |= bio->bi_opf & REQ_FAILFAST_MASK; + } + } +} + static void blk_account_io_merge_request(struct request *req) { if (blk_do_io_stat(req)) { @@ -954,7 +981,7 @@ enum bio_merge_status { static enum bio_merge_status bio_attempt_back_merge(struct request *req, struct bio *bio, unsigned int nr_segs) { - const blk_opf_t ff = bio->bi_opf & REQ_FAILFAST_MASK; + const blk_opf_t ff = bio_failfast(bio);
if (!ll_back_merge_fn(req, bio, nr_segs)) return BIO_MERGE_FAILED; @@ -965,6 +992,8 @@ static enum bio_merge_status bio_attempt_back_merge(struct request *req, if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff) blk_rq_set_mixed_merge(req);
+ blk_update_mixed_merge(req, bio, false); + req->biotail->bi_next = bio; req->biotail = bio; req->__data_len += bio->bi_iter.bi_size; @@ -978,7 +1007,7 @@ static enum bio_merge_status bio_attempt_back_merge(struct request *req, static enum bio_merge_status bio_attempt_front_merge(struct request *req, struct bio *bio, unsigned int nr_segs) { - const blk_opf_t ff = bio->bi_opf & REQ_FAILFAST_MASK; + const blk_opf_t ff = bio_failfast(bio);
if (!ll_front_merge_fn(req, bio, nr_segs)) return BIO_MERGE_FAILED; @@ -989,6 +1018,8 @@ static enum bio_merge_status bio_attempt_front_merge(struct request *req, if ((req->cmd_flags & REQ_FAILFAST_MASK) != ff) blk_rq_set_mixed_merge(req);
+ blk_update_mixed_merge(req, bio, true); + bio->bi_next = req->bio; req->bio = bio;
From: Jinke Han hanjinke.666@bytedance.com
[ Upstream commit 0f7c8f0f7934c389b0f9fa1f151e753d8de6348f ]
In the current code, io statistics are missing for cgroup when bio was throttled by blk-throttle. Fix it by moving the unreaching code to submit_bio_noacct_nocheck.
Fixes: 3f98c753717c ("block: don't check bio in blk_throtl_dispatch_work_fn") Signed-off-by: Jinke Han hanjinke.666@bytedance.com Reviewed-by: Ming Lei ming.lei@redhat.com Acked-by: Muchun Song songmuchun@bytedance.com Reviewed-by: Christoph Hellwig hch@lst.de Link: https://lore.kernel.org/r/20230216032250.74230-1-hanjinke.666@bytedance.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-core.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
diff --git a/block/blk-core.c b/block/blk-core.c index b5098355d8b27..0a55844dfde27 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -684,6 +684,18 @@ static void __submit_bio_noacct_mq(struct bio *bio)
void submit_bio_noacct_nocheck(struct bio *bio) { + blk_cgroup_bio_start(bio); + blkcg_bio_issue_init(bio); + + if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) { + trace_block_bio_queue(bio); + /* + * Now that enqueuing has been traced, we need to trace + * completion as well. + */ + bio_set_flag(bio, BIO_TRACE_COMPLETION); + } + /* * We only want one ->submit_bio to be active at a time, else stack * usage with stacked devices could be a problem. Use current->bio_list @@ -788,17 +800,6 @@ void submit_bio_noacct(struct bio *bio)
if (blk_throtl_bio(bio)) return; - - blk_cgroup_bio_start(bio); - blkcg_bio_issue_init(bio); - - if (!bio_flagged(bio, BIO_TRACE_COMPLETION)) { - trace_block_bio_queue(bio); - /* Now that enqueuing has been traced, we need to trace - * completion as well. - */ - bio_set_flag(bio, BIO_TRACE_COMPLETION); - } submit_bio_noacct_nocheck(bio); return;
From: Martin K. Petersen martin.petersen@oracle.com
[ Upstream commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 ]
Make sure to copy the flags when a bio_integrity_payload is cloned. Otherwise per-I/O properties such as IP checksum flag will not be passed down to the HBA driver. Since the integrity buffer is owned by the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off to avoid a double free in the completion path.
Fixes: aae7df50190a ("block: Integrity checksum flag") Fixes: b1f01388574c ("block: Relocate bio integrity flags") Reported-by: Saurav Kashyap skashyap@marvell.com Tested-by: Saurav Kashyap skashyap@marvell.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Reviewed-by: Christoph Hellwig hch@lst.de Reviewed-by: Chaitanya Kulkarni kch@nvidia.com Link: https://lore.kernel.org/r/20230215171801.21062-1-martin.petersen@oracle.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/bio-integrity.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/block/bio-integrity.c b/block/bio-integrity.c index 3f5685c00e360..91ffee6fc8cb4 100644 --- a/block/bio-integrity.c +++ b/block/bio-integrity.c @@ -418,6 +418,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src,
bip->bip_vcnt = bip_src->bip_vcnt; bip->bip_iter = bip_src->bip_iter; + bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY;
return 0; }
From: Jens Axboe axboe@kernel.dk
[ Upstream commit f3ca73862453ac1e64fc6968a14bf66d839cd2d8 ]
kernel test robot complains about a type mismatch:
block/blk-merge.c:984:42: sparse: expected restricted blk_opf_t const [usertype] ff block/blk-merge.c:984:42: sparse: got unsigned int block/blk-merge.c:1010:42: sparse: sparse: incorrect type in initializer (different base types) @@ expected restricted blk_opf_t const [usertype] ff @@ got unsigned int @@ block/blk-merge.c:1010:42: sparse: expected restricted blk_opf_t const [usertype] ff block/blk-merge.c:1010:42: sparse: got unsigned int
because bio_failfast() is return an unsigned int rather than the appropriate blk_opt_f type. Fix it up.
Fixes: 3ce6a115980c ("block: sync mixed merged request's failfast with 1st bio's") Reported-by: kernel test robot lkp@intel.com Link: https://lore.kernel.org/oe-kbuild-all/202302170743.GXypM9Rt-lkp@intel.com/ Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-merge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/blk-merge.c b/block/blk-merge.c index 30e4a99c2276b..808b58129d3e4 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -757,7 +757,7 @@ void blk_rq_set_mixed_merge(struct request *rq) rq->rq_flags |= RQF_MIXED_MERGE; }
-static inline unsigned int bio_failfast(const struct bio *bio) +static inline blk_opf_t bio_failfast(const struct bio *bio) { if (bio->bi_opf & REQ_RAHEAD) return REQ_FAILFAST_MASK;
From: Wang Yufen wangyufen@huawei.com
[ Upstream commit 18425d7d74c5be88b13b970a21e52e2498abf4ba ]
Add missing of_node_put() after of_reserved_mem_lookup()
Fixes: 99ad32a4ca3a ("mt76: mt7915: add support for MT7986") Signed-off-by: Wang Yufen wangyufen@huawei.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7915/soc.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c index c06c56a0270d6..686c9bbd59293 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/soc.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/soc.c @@ -278,6 +278,7 @@ static int mt7986_wmac_coninfra_setup(struct mt7915_dev *dev) return -EINVAL;
rmem = of_reserved_mem_lookup(np); + of_node_put(np); if (!rmem) return -EINVAL;
From: Deren Wu deren.wu@mediatek.com
[ Upstream commit aec4cf2ea0797e28f18f8dbe01943a56d987fe56 ]
SDIO may need addtional 511 bytes to align bus operation. If the tailroom of this skb is not big enough, we would access invalid memory region. For low level operation, increase skb size to keep valid memory access in SDIO host.
Error message: [69.951] BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0xe9/0x1a0 [69.951] Read of size 64 at addr ffff88811c9cf000 by task kworker/u16:7/451 [69.951] CPU: 4 PID: 451 Comm: kworker/u16:7 Tainted: G W OE 6.1.0-rc5 #1 [69.951] Workqueue: kvub300c vub300_cmndwork_thread [vub300] [69.951] Call Trace: [69.951] <TASK> [69.952] dump_stack_lvl+0x49/0x63 [69.952] print_report+0x171/0x4a8 [69.952] kasan_report+0xb4/0x130 [69.952] kasan_check_range+0x149/0x1e0 [69.952] memcpy+0x24/0x70 [69.952] sg_copy_buffer+0xe9/0x1a0 [69.952] sg_copy_to_buffer+0x12/0x20 [69.952] __command_write_data.isra.0+0x23c/0xbf0 [vub300] [69.952] vub300_cmndwork_thread+0x17f3/0x58b0 [vub300] [69.952] process_one_work+0x7ee/0x1320 [69.952] worker_thread+0x53c/0x1240 [69.952] kthread+0x2b8/0x370 [69.952] ret_from_fork+0x1f/0x30 [69.952] </TASK>
[69.952] Allocated by task 854: [69.952] kasan_save_stack+0x26/0x50 [69.952] kasan_set_track+0x25/0x30 [69.952] kasan_save_alloc_info+0x1b/0x30 [69.952] __kasan_kmalloc+0x87/0xa0 [69.952] __kmalloc_node_track_caller+0x63/0x150 [69.952] kmalloc_reserve+0x31/0xd0 [69.952] __alloc_skb+0xfc/0x2b0 [69.952] __mt76_mcu_msg_alloc+0xbf/0x230 [mt76] [69.952] mt76_mcu_send_and_get_msg+0xab/0x110 [mt76] [69.952] __mt76_mcu_send_firmware.cold+0x94/0x15d [mt76] [69.952] mt76_connac_mcu_send_ram_firmware+0x415/0x54d [mt76_connac_lib] [69.952] mt76_connac2_load_ram.cold+0x118/0x4bc [mt76_connac_lib] [69.952] mt7921_run_firmware.cold+0x2e9/0x405 [mt7921_common] [69.952] mt7921s_mcu_init+0x45/0x80 [mt7921s] [69.953] mt7921_init_work+0xe1/0x2a0 [mt7921_common] [69.953] process_one_work+0x7ee/0x1320 [69.953] worker_thread+0x53c/0x1240 [69.953] kthread+0x2b8/0x370 [69.953] ret_from_fork+0x1f/0x30 [69.953] The buggy address belongs to the object at ffff88811c9ce800 which belongs to the cache kmalloc-2k of size 2048 [69.953] The buggy address is located 0 bytes to the right of 2048-byte region [ffff88811c9ce800, ffff88811c9cf000)
[69.953] Memory state around the buggy address: [69.953] ffff88811c9cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [69.953] ffff88811c9cef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [69.953] >ffff88811c9cf000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [69.953] ^ [69.953] ffff88811c9cf080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [69.953] ffff88811c9cf100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Fixes: 764dee47e2c1 ("mt76: sdio: move common code in mt76_sdio module") Suggested-by: Lorenzo Bianconi lorenzo@kernel.org Tested-by: YN Chen YN.Chen@mediatek.com Signed-off-by: Deren Wu deren.wu@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/sdio_txrx.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/sdio_txrx.c index bfc4de50a4d23..ddd8c0cc744df 100644 --- a/drivers/net/wireless/mediatek/mt76/sdio_txrx.c +++ b/drivers/net/wireless/mediatek/mt76/sdio_txrx.c @@ -254,6 +254,10 @@ static int mt76s_tx_run_queue(struct mt76_dev *dev, struct mt76_queue *q)
if (!test_bit(MT76_STATE_MCU_RUNNING, &dev->phy.state)) { __skb_put_zero(e->skb, 4); + err = __skb_grow(e->skb, roundup(e->skb->len, + sdio->func->cur_blksize)); + if (err) + return err; err = __mt76s_xmit_queue(dev, e->skb->data, e->skb->len); if (err)
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit 8b25301af01566f4b5a301fc1ad7c5d2b1788d7f ]
Coverity message: variable "buf" going out of scope leaks the storage.
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Addresses-Coverity-ID: 1527799 ("Resource leaks") Fixes: e3296759f347 ("wifi: mt76: mt7915: enable per bandwidth power limit support") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c index fb46c2c1784f2..a7fdcd1f3d988 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c @@ -996,7 +996,7 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf,
ret = mt7915_mcu_get_txpower_sku(phy, txpwr, sizeof(txpwr)); if (ret) - return ret; + goto out;
/* Txpower propagation path: TMAC -> TXV -> BBP */ len += scnprintf(buf + len, sz - len, @@ -1047,6 +1047,8 @@ mt7915_rate_txpower_get(struct file *file, char __user *user_buf, mt76_get_field(dev, reg, MT_WF_PHY_TPC_POWER));
ret = simple_read_from_buffer(user_buf, count, ppos, buf, len); + +out: kfree(buf); return ret; }
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit 5202b983f9894d31110e49c4ec6b57955b5eaa1a ]
Coverity message: using tainted "hdr->band" variable as an index into an array "(*dev).mt76.phys".
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Addresses-Coverity-ID: 1527797 ("Insecure data handling") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index 04e1d10bbd21e..a90b7ca2df63c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -412,6 +412,9 @@ mt7996_mcu_ie_countdown(struct mt7996_dev *dev, struct sk_buff *skb) struct header *hdr = (struct header *)data; struct tlv *tlv = (struct tlv *)(data + 4);
+ if (hdr->band >= ARRAY_SIZE(dev->mt76.phys)) + return; + if (hdr->band && dev->mt76.phys[hdr->band]) mphy = dev->mt76.phys[hdr->band];
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit f37c6e5c75029443bc72c45acf92b2f2de2945be ]
Coverity message: using tainted "r->band_idx" variable as an index into an array "(*dev).mt76.phys".
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Addresses-Coverity-ID: 1527812 ("Insecure data handling") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index a90b7ca2df63c..efb245c8ac840 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -335,6 +335,9 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
r = (struct mt7996_mcu_rdd_report *)skb->data;
+ if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys)) + return; + mphy = dev->mt76.phys[r->band_idx]; if (!mphy) return;
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit aab169ad3a7aa8678aed90d7fdbc243e3d4b32a6 ]
This code is supposed to set a u32 value, but casting will not work on big endian systems.
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Addresses-Coverity-ID: 1527816 ("Integer handling issues") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c index 2e4a8909b9e80..99b23aef53a50 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c @@ -653,8 +653,9 @@ static int mt7996_rf_regval_set(void *data, u64 val) { struct mt7996_dev *dev = data; + u32 val32 = val;
- return mt7996_mcu_rf_regval(dev, dev->mt76.debugfs_reg, (u32 *)&val, true); + return mt7996_mcu_rf_regval(dev, dev->mt76.debugfs_reg, &val32, true); }
DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get,
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit 59b27a7d472f100ac8998e15a63c47a03cced12a ]
Check return value of mt7915_mcu_get_eeprom_free_block() first before accessing free_block_num.
Fixes: bbc1d4154ec1 ("mt76: mt7915: add default calibrated data support") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- .../wireless/mediatek/mt76/mt7915/eeprom.c | 19 ++++++++++++------- .../net/wireless/mediatek/mt76/mt7915/mcu.c | 10 ++++++---- 2 files changed, 18 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c index 59069fb864147..24efa280dd868 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c @@ -110,18 +110,23 @@ static int mt7915_eeprom_load(struct mt7915_dev *dev) } else { u8 free_block_num; u32 block_num, i; + u32 eeprom_blk_size = MT7915_EEPROM_BLOCK_SIZE;
- mt7915_mcu_get_eeprom_free_block(dev, &free_block_num); - /* efuse info not enough */ + ret = mt7915_mcu_get_eeprom_free_block(dev, &free_block_num); + if (ret < 0) + return ret; + + /* efuse info isn't enough */ if (free_block_num >= 29) return -EINVAL;
/* read eeprom data from efuse */ - block_num = DIV_ROUND_UP(eeprom_size, - MT7915_EEPROM_BLOCK_SIZE); - for (i = 0; i < block_num; i++) - mt7915_mcu_get_eeprom(dev, - i * MT7915_EEPROM_BLOCK_SIZE); + block_num = DIV_ROUND_UP(eeprom_size, eeprom_blk_size); + for (i = 0; i < block_num; i++) { + ret = mt7915_mcu_get_eeprom(dev, i * eeprom_blk_size); + if (ret < 0) + return ret; + } }
return mt7915_check_eeprom(dev); diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index b2652de082baa..d9d6846ba8e02 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -2792,8 +2792,9 @@ int mt7915_mcu_get_eeprom(struct mt7915_dev *dev, u32 offset) int ret; u8 *buf;
- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_ACCESS), &req, - sizeof(req), true, &skb); + ret = mt76_mcu_send_and_get_msg(&dev->mt76, + MCU_EXT_QUERY(EFUSE_ACCESS), + &req, sizeof(req), true, &skb); if (ret) return ret;
@@ -2818,8 +2819,9 @@ int mt7915_mcu_get_eeprom_free_block(struct mt7915_dev *dev, u8 *block_num) struct sk_buff *skb; int ret;
- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_EXT_QUERY(EFUSE_FREE_BLOCK), &req, - sizeof(req), true, &skb); + ret = mt76_mcu_send_and_get_msg(&dev->mt76, + MCU_EXT_QUERY(EFUSE_FREE_BLOCK), + &req, sizeof(req), true, &skb); if (ret) return ret;
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit 783ef7da7a53c7ab98471f47fbabab6cf6f45c8f ]
Check return value of mt7996_mcu_get_eeprom_free_block() first before accessing free_block_num.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/mediatek/mt76/mt7996/eeprom.c | 18 ++++++++++++------ .../net/wireless/mediatek/mt76/mt7996/mcu.c | 5 +++-- 2 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c index b9f62bedbc485..5d8e0353627e1 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c @@ -65,17 +65,23 @@ static int mt7996_eeprom_load(struct mt7996_dev *dev) } else { u8 free_block_num; u32 block_num, i; + u32 eeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;
- /* TODO: check free block event */ - mt7996_mcu_get_eeprom_free_block(dev, &free_block_num); - /* efuse info not enough */ + ret = mt7996_mcu_get_eeprom_free_block(dev, &free_block_num); + if (ret < 0) + return ret; + + /* efuse info isn't enough */ if (free_block_num >= 59) return -EINVAL;
/* read eeprom data from efuse */ - block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, MT7996_EEPROM_BLOCK_SIZE); - for (i = 0; i < block_num; i++) - mt7996_mcu_get_eeprom(dev, i * MT7996_EEPROM_BLOCK_SIZE); + block_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size); + for (i = 0; i < block_num; i++) { + ret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size); + if (ret < 0) + return ret; + } }
return mt7996_check_eeprom(dev); diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index efb245c8ac840..da72684e43083 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -2927,8 +2927,9 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset) bool valid; int ret;
- ret = mt76_mcu_send_and_get_msg(&dev->mt76, MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL), &req, - sizeof(req), true, &skb); + ret = mt76_mcu_send_and_get_msg(&dev->mt76, + MCU_WM_UNI_CMD_QUERY(EFUSE_CTRL), + &req, sizeof(req), true, &skb); if (ret) return ret;
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit b0f7b9563358493dfe70d3e4c3ebeffc92d4b494 ]
smatch warnings: addr <= MT_CBTOP2_PHY_END(0xffffffff) is always true (<= u32max), so drop it.
Fixes: cd4c314a65d3 ("mt76: mt7915: refine register definition") Reported-by: kernel test robot lkp@intel.com Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c index 8388e2a658535..afa558c9a9302 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c @@ -495,7 +495,7 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr)
if (dev_is_pci(dev->mt76.dev) && ((addr >= MT_CBTOP1_PHY_START && addr <= MT_CBTOP1_PHY_END) || - (addr >= MT_CBTOP2_PHY_START && addr <= MT_CBTOP2_PHY_END))) + addr >= MT_CBTOP2_PHY_START)) return mt7915_reg_map_l1(dev, addr);
/* CONN_INFRA: covert to phyiscal addr and use layer 1 remap */ diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h index aca1b2f1e9e3b..7e0d86366c778 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h +++ b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h @@ -803,7 +803,6 @@ enum offs_rev { #define MT_CBTOP1_PHY_START 0x70000000 #define MT_CBTOP1_PHY_END __REG(CBTOP1_PHY_END) #define MT_CBTOP2_PHY_START 0xf0000000 -#define MT_CBTOP2_PHY_END 0xffffffff #define MT_INFRA_MCU_START 0x7c000000 #define MT_INFRA_MCU_END __REG(INFRA_MCU_ADDR_END) #define MT_CONN_INFRA_OFFSET(p) ((p) - MT_INFRA_BASE)
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit ef1ea24cb0ecfd42c1ff266d92613163792aec77 ]
addr <= MT_CBTOP2_PHY_END(0xffffffff) is always true (<= u32max), so drop it.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7996/regs.h | 1 - 2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c index 521769eb6b0e9..60781d046216a 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c @@ -149,7 +149,7 @@ static u32 __mt7996_reg_addr(struct mt7996_dev *dev, u32 addr)
if (dev_is_pci(dev->mt76.dev) && ((addr >= MT_CBTOP1_PHY_START && addr <= MT_CBTOP1_PHY_END) || - (addr >= MT_CBTOP2_PHY_START && addr <= MT_CBTOP2_PHY_END))) + addr >= MT_CBTOP2_PHY_START)) return mt7996_reg_map_l1(dev, addr);
/* CONN_INFRA: covert to phyiscal addr and use layer 1 remap */ diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h index 794f61b93a466..42980b97b4d41 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h +++ b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h @@ -463,7 +463,6 @@ enum base_rev { #define MT_CBTOP1_PHY_START 0x70000000 #define MT_CBTOP1_PHY_END 0x77ffffff #define MT_CBTOP2_PHY_START 0xf0000000 -#define MT_CBTOP2_PHY_END 0xffffffff #define MT_INFRA_MCU_START 0x7c000000 #define MT_INFRA_MCU_END 0x7c3fffff
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit 54ccb836ffb28eacba51b674cbe94cb5613f8441 ]
Fix the following sparse warnings in mt7996_mcu_sta_he_tlv routine:
warning: incorrect type in assignment (different base types) expected unsigned char got restricted __le16 [usertype] warning: incorrect type in assignment (different base types) expected unsigned char got restricted __le16 [usertype]
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index da72684e43083..a88fc7680b1a9 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -909,8 +909,8 @@ mt7996_mcu_sta_he_tlv(struct sk_buff *skb, struct ieee80211_sta *sta) he = (struct sta_rec_he_v2 *)tlv; for (i = 0; i < 11; i++) { if (i < 6) - he->he_mac_cap[i] = cpu_to_le16(elem->mac_cap_info[i]); - he->he_phy_cap[i] = cpu_to_le16(elem->phy_cap_info[i]); + he->he_mac_cap[i] = elem->mac_cap_info[i]; + he->he_phy_cap[i] = elem->phy_cap_info[i]; }
mcs_map = sta->deflink.he_cap.he_mcs_nss_supp;
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit 6e1abc51c945663bddebfa1beb9590ff5b250eb7 ]
After 'commit ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}. Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine.
Fixes: ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct mt76x02_rate_power") Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt76x0/phy.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c index 6c6c8ada7943b..d543ef3de65be 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x0/phy.c @@ -642,7 +642,12 @@ mt76x0_phy_get_target_power(struct mt76x02_dev *dev, u8 tx_mode, if (tx_rate > 9) return -EINVAL;
- *target_power = cur_power + dev->rate_power.vht[tx_rate]; + *target_power = cur_power; + if (tx_rate > 7) + *target_power += dev->rate_power.vht[tx_rate - 8]; + else + *target_power += dev->rate_power.ht[tx_rate]; + *target_pa_power = mt76x0_phy_get_rf_pa_mode(dev, 1, tx_rate); break; default:
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit 063cca0252b46970e7e9ca423d5e930be3179aa1 ]
In the expression "map[i].qid << 24" starts as u8, but is promoted to "signed int", then sign-extended to type "unsigned long", which is not intended. Cast to u32 to avoid the sign extension.
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Addresses-Coverity-ID: 1527813 ("Integer handling issues") Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c index 99b23aef53a50..3d4fbbbcc2062 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/debugfs.c @@ -457,7 +457,7 @@ mt7996_hw_queue_read(struct seq_file *s, u32 size, if (val & BIT(map[i].index)) continue;
- ctrl = BIT(31) | (map[i].pid << 10) | (map[i].qid << 24); + ctrl = BIT(31) | (map[i].pid << 10) | ((u32)map[i].qid << 24); mt76_wr(dev, MT_FL_Q0_CTRL, ctrl);
head = mt76_get_field(dev, MT_FL_Q2_CTRL,
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit edb0406bda4629ef496f52eb11cbea7e92ed301b ]
In the expression "map[i].qid << 24" starts as u8, but is promoted to "signed int", then sign-extended to type "unsigned long", which is not intended. Cast to u32 to avoid the sign extension.
Fixes: 776ec4e77aa6 ("mt76: mt7915: rework debugfs queue info") Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c index a7fdcd1f3d988..5a46813a59eac 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/debugfs.c @@ -811,7 +811,7 @@ mt7915_hw_queue_read(struct seq_file *s, u32 size, if (val & BIT(map[i].index)) continue;
- ctrl = BIT(31) | (map[i].pid << 10) | (map[i].qid << 24); + ctrl = BIT(31) | (map[i].pid << 10) | ((u32)map[i].qid << 24); mt76_wr(dev, MT_FL_Q0_CTRL, ctrl);
head = mt76_get_field(dev, MT_FL_Q2_CTRL,
From: Deren Wu deren.wu@mediatek.com
[ Upstream commit 0ffcb2a68b15bd63d5555a923ae7dfe8bfdb14a7 ]
The default case for frame_contorl is invalid. We should always assign addr3 of this frame properly.
Coverity error message: if (ieee80211_has_a4(hdr.frame_control)) (19) Event uninit_use_in_call: Using uninitialized value "hdr". Field "hdr.addr3" is uninitialized when calling "memcpy". memcpy(skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr)); else memcpy(skb_push(skb, sizeof(hdr) - 6), &hdr, sizeof(hdr) - 6);
Fixes: 0880d40871d1 ("mt76: connac: move mt76_connac2_reverse_frag0_hdr_trans in mt76-connac module") Signed-off-by: Deren Wu deren.wu@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c index fd60123fb2840..c8d0c84e688b8 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c @@ -930,7 +930,7 @@ int mt76_connac2_reverse_frag0_hdr_trans(struct ieee80211_vif *vif, ether_addr_copy(hdr.addr4, eth_hdr->h_source); break; default: - break; + return -EINVAL; }
skb_pull(skb, hdr_offset + sizeof(struct ethhdr) - 2);
From: Sean Wang sean.wang@mediatek.com
[ Upstream commit 47180ecf4541146836c5307c1d5526f8ac6a5a6d ]
Fixed coverity issue with resource leaks at variable "fw" going out of scope leaks the storage it points to mt7921_check_offload_capability().
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Addresses-Coverity-ID: 1527806 ("Resource leaks") Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Signed-off-by: Sean Wang sean.wang@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7921/init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c index 542dfd4251290..d4b681d7e1d22 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c @@ -175,7 +175,7 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm)
if (!fw || !fw->data || fw->size < sizeof(*hdr)) { dev_err(dev, "Invalid firmware\n"); - return -EINVAL; + goto out; }
data = fw->data; @@ -206,6 +206,7 @@ u8 mt7921_check_offload_capability(struct device *dev, const char *fw_wm) data += le16_to_cpu(rel_info->len) + rel_info->pad_len; }
+out: release_firmware(fw);
return features ? features->data : 0;
From: Yuan Can yuancan@huawei.com
[ Upstream commit 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f ]
The coex_cb needs to be freed when rsi_create_kthread() failed in rsi_coex_attach().
Fixes: 2108df3c4b18 ("rsi: add coex support") Signed-off-by: Yuan Can yuancan@huawei.com Reviewed-by: Simon Horman simon.horman@corigine.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221205061441.114632-1-yuancan@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c index 8a3d86897ea8e..45ac9371f2621 100644 --- a/drivers/net/wireless/rsi/rsi_91x_coex.c +++ b/drivers/net/wireless/rsi/rsi_91x_coex.c @@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common) rsi_coex_scheduler_thread, "Coex-Tx-Thread")) { rsi_dbg(ERR_ZONE, "%s: Unable to init tx thrd\n", __func__); + kfree(coex_cb); return -EINVAL; } return 0;
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 106031c1f4a850915190d7ec1026696282f9359b ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. All the SKBs have been dequeued from the old queue, so it's safe to enqueue these SKBs to a free queue, then free them after spin_unlock_irqrestore() at once. Compile tested only.
Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Acked-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207141411.46098-2-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c index 7e0f62d59fe17..a7e3250957dc9 100644 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c @@ -26,8 +26,10 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) struct rtl_priv *rtlpriv = rtl_priv(hw); struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; + struct sk_buff_head free_list; unsigned long flags;
+ skb_queue_head_init(&free_list); spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); while (skb_queue_len(&ring->queue)) { struct rtl_tx_desc *entry = &ring->desc[ring->idx]; @@ -37,10 +39,12 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, true, HW_DESC_TXBUFF_ADDR), skb->len, DMA_TO_DEVICE); - kfree_skb(skb); + __skb_queue_tail(&free_list, skb); ring->idx = (ring->idx + 1) % ring->entries; } spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); + + __skb_queue_purge(&free_list); }
static void _rtl8821ae_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 2611687fa7ffc84190f92292de0b80468de17220 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. All the SKBs have been dequeued from the old queue, so it's safe to enqueue these SKBs to a free queue, then free them after spin_unlock_irqrestore() at once. Compile tested only.
Fixes: 7fe3b3abb5da ("rtlwifi: rtl8188ee: rtl8821ae: Fix a queue locking problem") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Acked-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207141411.46098-3-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c index 58c2ab3d44bef..de61c9c0ddec4 100644 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c @@ -68,8 +68,10 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) struct rtl_priv *rtlpriv = rtl_priv(hw); struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; + struct sk_buff_head free_list; unsigned long flags;
+ skb_queue_head_init(&free_list); spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); while (skb_queue_len(&ring->queue)) { struct rtl_tx_desc *entry = &ring->desc[ring->idx]; @@ -79,10 +81,12 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, true, HW_DESC_TXBUFF_ADDR), skb->len, DMA_TO_DEVICE); - kfree_skb(skb); + __skb_queue_tail(&free_list, skb); ring->idx = (ring->idx + 1) % ring->entries; } spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); + + __skb_queue_purge(&free_list); }
static void _rtl88ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 313950c2114e7051c4e3020fd82495fa1fb526a8 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. All the SKBs have been dequeued from the old queue, so it's safe to enqueue these SKBs to a free queue, then free them after spin_unlock_irqrestore() at once. Compile tested only.
Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Acked-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207141411.46098-4-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c index 189cc6437600f..0ba3bbed6ed36 100644 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c @@ -30,8 +30,10 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) struct rtl_priv *rtlpriv = rtl_priv(hw); struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; + struct sk_buff_head free_list; unsigned long flags;
+ skb_queue_head_init(&free_list); spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); while (skb_queue_len(&ring->queue)) { struct rtl_tx_desc *entry = &ring->desc[ring->idx]; @@ -41,10 +43,12 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, true, HW_DESC_TXBUFF_ADDR), skb->len, DMA_TO_DEVICE); - kfree_skb(skb); + __skb_queue_tail(&free_list, skb); ring->idx = (ring->idx + 1) % ring->entries; } spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); + + __skb_queue_purge(&free_list); }
static void _rtl8723be_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 ]
It is not allowed to call consume_skb() from hardware interrupt context or with interrupts being disabled. So replace dev_kfree_skb() with dev_consume_skb_irq() under spin_lock_irqsave(). Compile tested only.
Fixes: 4bc85c1324aa ("Revert "iwlwifi: split the drivers for agn and legacy devices 3945/4965"") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Acked-by: Stanislaw Gruszka stf_xl@wp.pl Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207144013.70210-1-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/intel/iwlegacy/common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c index 341c17fe2af4d..96002121bb8b2 100644 --- a/drivers/net/wireless/intel/iwlegacy/common.c +++ b/drivers/net/wireless/intel/iwlegacy/common.c @@ -5174,7 +5174,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif) memset(&il->current_ht_config, 0, sizeof(struct il_ht_config));
/* new association get rid of ibss beacon skb */ - dev_kfree_skb(il->beacon_skb); + dev_consume_skb_irq(il->beacon_skb); il->beacon_skb = NULL; il->timestamp = 0;
@@ -5293,7 +5293,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif) }
spin_lock_irqsave(&il->lock, flags); - dev_kfree_skb(il->beacon_skb); + dev_consume_skb_irq(il->beacon_skb); il->beacon_skb = skb;
timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
From: Zhengchao Shao shaozhengchao@huawei.com
[ Upstream commit 16a03958618fb91bb1bc7077cf3211055162cc2f ]
When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not released. Add free memory to processing error path.
Fixes: 7919b89c8276 ("libertas: convert libertas driver to use an event/cmdresp queue") Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com Reviewed-by: Jiri Pirko jiri@nvidia.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221208121448.2845986-1-shaozhengchao@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/marvell/libertas/main.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c index 8f5220cee1123..ae975304cfcfa 100644 --- a/drivers/net/wireless/marvell/libertas/main.c +++ b/drivers/net/wireless/marvell/libertas/main.c @@ -869,6 +869,7 @@ static int lbs_init_adapter(struct lbs_private *priv) ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL); if (ret) { pr_err("Out of memory allocating event FIFO buffer\n"); + lbs_free_cmd_buffer(priv); goto out; }
From: Bitterblue Smith rtl8821cerfe2@gmail.com
[ Upstream commit 9e32b4a709f0f7b7adf5d9939c3bd47c78c4f003 ]
Just because priv->pi_enabled is only one bit doesn't mean it works like a bool. The value assigned to it loses all bits except bit 0, so only assign 0 or 1 to it.
This affects the RTL8188FU, but fixing the assignment didn't make a difference for my device.
Fixes: c888183b21f3 ("wifi: rtl8xxxu: Support new chip RTL8188FU") Signed-off-by: Bitterblue Smith rtl8821cerfe2@gmail.com Reviewed-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/4368d585-11ec-d3c7-ec12-7f0afdcedfda@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c index 2c4f403ba68f3..97e7ff7289fab 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c @@ -1122,7 +1122,7 @@ static void rtl8188fu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,
if (t == 0) { val32 = rtl8xxxu_read32(priv, REG_FPGA0_XA_HSSI_PARM1); - priv->pi_enabled = val32 & FPGA0_HSSI_PARM1_PI; + priv->pi_enabled = u32_get_bits(val32, FPGA0_HSSI_PARM1_PI); }
/* save RF path */
From: Bitterblue Smith rtl8821cerfe2@gmail.com
[ Upstream commit 639c26faf9b15922bc620af341545d6c5d6aab2d ]
Just because priv->cck_agc_report_type is only one bit doesn't mean it works like a bool. The value assigned to it loses all bits except bit 0, so only assign 0 or 1 to it.
This affects the RTL8192EU, but rtl8xxxu already can't connect to any networks with this chip, so it probably didn't bother anyone.
Fixes: 2ad2a813b803 ("wifi: rtl8xxxu: Fix the CCK RSSI calculation") Signed-off-by: Bitterblue Smith rtl8821cerfe2@gmail.com Reviewed-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/7bb4858c-5cef-9cae-5e08-7e8444e8ba89@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c index 3ed435401e570..799b03ec19806 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -4208,10 +4208,12 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) * should be equal or CCK RSSI report may be incorrect */ val32 = rtl8xxxu_read32(priv, REG_FPGA0_XA_HSSI_PARM2); - priv->cck_agc_report_type = val32 & FPGA0_HSSI_PARM2_CCK_HIGH_PWR; + priv->cck_agc_report_type = + u32_get_bits(val32, FPGA0_HSSI_PARM2_CCK_HIGH_PWR);
val32 = rtl8xxxu_read32(priv, REG_FPGA0_XB_HSSI_PARM2); - if (priv->cck_agc_report_type != (bool)(val32 & FPGA0_HSSI_PARM2_CCK_HIGH_PWR)) { + if (priv->cck_agc_report_type != + u32_get_bits(val32, FPGA0_HSSI_PARM2_CCK_HIGH_PWR)) { if (priv->cck_agc_report_type) val32 |= FPGA0_HSSI_PARM2_CCK_HIGH_PWR; else
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 4c2005ac87685907b3719b4f40215b578efd27c4 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested only.
Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Reviewed-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221208143517.2383424-1-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c index 799b03ec19806..c8b82c5810111 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -5276,7 +5276,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, pending = priv->rx_urb_pending_count; } else { skb = (struct sk_buff *)rx_urb->urb.context; - dev_kfree_skb(skb); + dev_kfree_skb_irq(skb); usb_free_urb(&rx_urb->urb); }
From: Ping-Ke Shih pkshih@realtek.com
[ Upstream commit b2bab7b14098dcf5d405fa8c76b2c3f6ce9184f9 ]
After filling calibration parameters, set BIT(0) to enable the hardware circuit, but original set incorrect bit that affects a little TX performance.
Fixes: 76599a8d0b7d ("rtw89: 8852c: rfk: add DACK") Signed-off-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221209020940.9573-2-pkshih@realtek.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c index 60cd676fe22c9..f5b0b57f33207 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c @@ -337,7 +337,7 @@ static void _dack_reload_by_path(struct rtw89_dev *rtwdev, (dack->dadck_d[path][index] << 14); addr = 0xc210 + offset; rtw89_phy_write32(rtwdev, addr, val32); - rtw89_phy_write32_set(rtwdev, addr, BIT(1)); + rtw89_phy_write32_set(rtwdev, addr, BIT(0)); }
static void _dack_reload(struct rtw89_dev *rtwdev, enum rtw89_rf_path path)
From: Ping-Ke Shih pkshih@realtek.com
[ Upstream commit 21b5f159a2ee47d30f418559f6ece0088c80199f ]
Some DPK settings are wrong, and causes bad TX performance occasionally. So, fix them by internal suggestions.
Fixes: da4cea16cb13 ("rtw89: 8852c: rfk: add DPK") Signed-off-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221209020940.9573-3-pkshih@realtek.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw89/reg.h | 2 ++ drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c | 9 ++++----- 2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/reg.h b/drivers/net/wireless/realtek/rtw89/reg.h index 5324e645728bb..ca6f6c3e63095 100644 --- a/drivers/net/wireless/realtek/rtw89/reg.h +++ b/drivers/net/wireless/realtek/rtw89/reg.h @@ -3671,6 +3671,8 @@ #define RR_TXRSV_GAPK BIT(19) #define RR_BIAS 0x5e #define RR_BIAS_GAPK BIT(19) +#define RR_TXAC 0x5f +#define RR_TXAC_IQG GENMASK(3, 0) #define RR_BIASA 0x60 #define RR_BIASA_TXG GENMASK(15, 12) #define RR_BIASA_TXA GENMASK(19, 16) diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c index f5b0b57f33207..f3a07b0e672f7 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852c_rfk.c @@ -1872,12 +1872,11 @@ static void _dpk_rf_setting(struct rtw89_dev *rtwdev, u8 gain, 0x50101 | BIT(rtwdev->dbcc_en)); rtw89_write_rf(rtwdev, path, RR_MOD_V1, RR_MOD_MASK, RF_DPK);
- if (dpk->bp[path][kidx].band == RTW89_BAND_6G && dpk->bp[path][kidx].ch >= 161) { + if (dpk->bp[path][kidx].band == RTW89_BAND_6G && dpk->bp[path][kidx].ch >= 161) rtw89_write_rf(rtwdev, path, RR_IQGEN, RR_IQGEN_BIAS, 0x8); - rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd); - } else { - rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd); - } + + rtw89_write_rf(rtwdev, path, RR_LOGEN, RR_LOGEN_RPT, 0xd); + rtw89_write_rf(rtwdev, path, RR_TXAC, RR_TXAC_IQG, 0x8);
rtw89_write_rf(rtwdev, path, RR_RXA2, RR_RXA2_ATT, 0x0); rtw89_write_rf(rtwdev, path, RR_TXIQK, RR_TXIQK_ATT2, 0x3);
From: Li Zetao lizetao1@huawei.com
[ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ]
There is a global-out-of-bounds reported by KASAN:
BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411
CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK>
The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough.
Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit.
Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree") Signed-off-by: Li Zetao lizetao1@huawei.com Acked-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221212025812.1541311-1-lizetao1@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------ 1 file changed, 20 insertions(+), 32 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c index a29321e2fa72f..5323ead30db03 100644 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c @@ -1598,18 +1598,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint) return true; }
-static bool _rtl8812ae_eq_n_byte(const char *str1, const char *str2, u32 num) -{ - if (num == 0) - return false; - while (num > 0) { - num--; - if (str1[num] != str2[num]) - return false; - } - return true; -} - static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw, u8 band, u8 channel) { @@ -1659,42 +1647,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, power_limit = power_limit > MAX_POWER_INDEX ? MAX_POWER_INDEX : power_limit;
- if (_rtl8812ae_eq_n_byte(pregulation, "FCC", 3)) + if (strcmp(pregulation, "FCC") == 0) regulation = 0; - else if (_rtl8812ae_eq_n_byte(pregulation, "MKK", 3)) + else if (strcmp(pregulation, "MKK") == 0) regulation = 1; - else if (_rtl8812ae_eq_n_byte(pregulation, "ETSI", 4)) + else if (strcmp(pregulation, "ETSI") == 0) regulation = 2; - else if (_rtl8812ae_eq_n_byte(pregulation, "WW13", 4)) + else if (strcmp(pregulation, "WW13") == 0) regulation = 3;
- if (_rtl8812ae_eq_n_byte(prate_section, "CCK", 3)) + if (strcmp(prate_section, "CCK") == 0) rate_section = 0; - else if (_rtl8812ae_eq_n_byte(prate_section, "OFDM", 4)) + else if (strcmp(prate_section, "OFDM") == 0) rate_section = 1; - else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) && - _rtl8812ae_eq_n_byte(prf_path, "1T", 2)) + else if (strcmp(prate_section, "HT") == 0 && + strcmp(prf_path, "1T") == 0) rate_section = 2; - else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) && - _rtl8812ae_eq_n_byte(prf_path, "2T", 2)) + else if (strcmp(prate_section, "HT") == 0 && + strcmp(prf_path, "2T") == 0) rate_section = 3; - else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) && - _rtl8812ae_eq_n_byte(prf_path, "1T", 2)) + else if (strcmp(prate_section, "VHT") == 0 && + strcmp(prf_path, "1T") == 0) rate_section = 4; - else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) && - _rtl8812ae_eq_n_byte(prf_path, "2T", 2)) + else if (strcmp(prate_section, "VHT") == 0 && + strcmp(prf_path, "2T") == 0) rate_section = 5;
- if (_rtl8812ae_eq_n_byte(pbandwidth, "20M", 3)) + if (strcmp(pbandwidth, "20M") == 0) bandwidth = 0; - else if (_rtl8812ae_eq_n_byte(pbandwidth, "40M", 3)) + else if (strcmp(pbandwidth, "40M") == 0) bandwidth = 1; - else if (_rtl8812ae_eq_n_byte(pbandwidth, "80M", 3)) + else if (strcmp(pbandwidth, "80M") == 0) bandwidth = 2; - else if (_rtl8812ae_eq_n_byte(pbandwidth, "160M", 4)) + else if (strcmp(pbandwidth, "160M") == 0) bandwidth = 3;
- if (_rtl8812ae_eq_n_byte(pband, "2.4G", 4)) { + if (strcmp(pband, "2.4G") == 0) { ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, BAND_ON_2_4G, channel); @@ -1718,7 +1706,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, regulation, bandwidth, rate_section, channel_index, rtlphy->txpwr_limit_2_4g[regulation][bandwidth] [rate_section][channel_index][RF90_PATH_A]); - } else if (_rtl8812ae_eq_n_byte(pband, "5G", 2)) { + } else if (strcmp(pband, "5G") == 0) { ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, BAND_ON_5G, channel);
From: Andrii Nakryiko andrii@kernel.org
[ Upstream commit 872aec4b5f635d94111d48ec3c57fbe078d64e7d ]
btf_dump APIs emit unnecessary tabs when emitting struct/union definition that fits on the single line. Before this patch we'd get:
struct blah {<tab>};
This patch fixes this and makes sure that we get more natural:
struct blah {};
Fixes: 44a726c3f23c ("bpftool: Print newline before '}' for struct with padding only fields") Signed-off-by: Andrii Nakryiko andrii@kernel.org Signed-off-by: Daniel Borkmann daniel@iogearbox.net Link: https://lore.kernel.org/bpf/20221212211505.558851-2-andrii@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/lib/bpf/btf_dump.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c index deb2bc9a0a7b0..69e80ee5f70e2 100644 --- a/tools/lib/bpf/btf_dump.c +++ b/tools/lib/bpf/btf_dump.c @@ -959,9 +959,12 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, * Keep `struct empty {}` on a single line, * only print newline when there are regular or padding fields. */ - if (vlen || t->size) + if (vlen || t->size) { btf_dump_printf(d, "\n"); - btf_dump_printf(d, "%s}", pfx(lvl)); + btf_dump_printf(d, "%s}", pfx(lvl)); + } else { + btf_dump_printf(d, "}"); + } if (packed) btf_dump_printf(d, " __attribute__((packed))"); }
From: Andrii Nakryiko andrii@kernel.org
[ Upstream commit 25a4481b4136af7794e1df2d6c90ed2f354d60ce ]
btf__align_of() is supposed to be return alignment requirement of a requested BTF type. For STRUCT/UNION it doesn't always return correct value, because it calculates alignment only based on field types. But for packed structs this is not enough, we need to also check field offsets and struct size. If field offset isn't aligned according to field type's natural alignment, then struct must be packed. Similarly, if struct size is not a multiple of struct's natural alignment, then struct must be packed as well.
This patch fixes this issue precisely by additionally checking these conditions.
Fixes: 3d208f4ca111 ("libbpf: Expose btf__align_of() API") Signed-off-by: Andrii Nakryiko andrii@kernel.org Signed-off-by: Daniel Borkmann daniel@iogearbox.net Link: https://lore.kernel.org/bpf/20221212211505.558851-5-andrii@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/lib/bpf/btf.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c index 71e165b09ed59..8cbcef959456d 100644 --- a/tools/lib/bpf/btf.c +++ b/tools/lib/bpf/btf.c @@ -688,8 +688,21 @@ int btf__align_of(const struct btf *btf, __u32 id) if (align <= 0) return libbpf_err(align); max_align = max(max_align, align); + + /* if field offset isn't aligned according to field + * type's alignment, then struct must be packed + */ + if (btf_member_bitfield_size(t, i) == 0 && + (m->offset % (8 * align)) != 0) + return 1; }
+ /* if struct/union size isn't a multiple of its alignment, + * then struct must be packed + */ + if ((t->size % max_align) != 0) + return 1; + return max_align; } default:
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 45fc6d7461f18df2f238caf0cbc5acc4163203d1 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when it's reset, so replace it with dev_kfree_skb_irq(). Compile tested only.
Fixes: 43f66a6ce8da ("Add ipw2200 wireless driver.") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221208143826.2385218-1-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c index ca802af8cddcc..cc66fd92278e4 100644 --- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c +++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c @@ -3427,7 +3427,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv, dma_unmap_single(&priv->pci_dev->dev, rxq->pool[i].dma_addr, IPW_RX_BUF_SIZE, DMA_FROM_DEVICE); - dev_kfree_skb(rxq->pool[i].skb); + dev_kfree_skb_irq(rxq->pool[i].skb); rxq->pool[i].skb = NULL; } list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
From: Zhengchao Shao shaozhengchao@huawei.com
[ Upstream commit 9fe21dc626117fb44a8eb393713a86a620128ce3 ]
In the error path of ipw_wdev_init(), exception value is returned, and the memory applied for in the function is not released. Also the memory is not released in ipw_pci_probe(). As a result, memory leakage occurs. So memory release needs to be added to the error path of ipw_wdev_init().
Fixes: a3caa99e6c68 ("libipw: initiate cfg80211 API conversion (v2)") Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221209012422.182669-1-shaozhengchao@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c index cc66fd92278e4..d382f20173256 100644 --- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c +++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c @@ -11383,9 +11383,14 @@ static int ipw_wdev_init(struct net_device *dev) set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
/* With that information in place, we can now register the wiphy... */ - if (wiphy_register(wdev->wiphy)) - rc = -EIO; + rc = wiphy_register(wdev->wiphy); + if (rc) + goto out; + + return 0; out: + kfree(priv->ieee->a_band.channels); + kfree(priv->ieee->bg_band.channels); return rc; }
From: Zhang Changzhong zhangchangzhong@huawei.com
[ Upstream commit deb962ec9e1c9a81babd3d37542ad4bd6ac3396e ]
The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add dev_kfree_skb() to fix it. Compile tested only.
Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Zhang Changzhong zhangchangzhong@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/1668684964-48622-1-git-send-email-zhangchangzhong@... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/microchip/wilc1000/netdev.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c index 9b319a455b96d..6f3ae0dff77ce 100644 --- a/drivers/net/wireless/microchip/wilc1000/netdev.c +++ b/drivers/net/wireless/microchip/wilc1000/netdev.c @@ -730,6 +730,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev)
if (skb->dev != ndev) { netdev_err(ndev, "Packet not destined to this device\n"); + dev_kfree_skb(skb); return NETDEV_TX_OK; }
From: Wang Yufen wangyufen@huawei.com
[ Upstream commit 2b88974ecb358990e1c33fabcd0b9e142bab7f21 ]
Fault injection test reports this issue:
kernel BUG at net/core/dev.c:10731! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI Call Trace: <TASK> wilc_netdev_ifc_init+0x19f/0x220 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5] wilc_cfg80211_init+0x30c/0x380 [wilc1000 884bf126e9e98af6a708f266a8dffd53f99e4bf5] wilc_bus_probe+0xad/0x2b0 [wilc1000_spi 1520a7539b6589cc6cde2ae826a523a33f8bacff] spi_probe+0xe4/0x140 really_probe+0x17e/0x3f0 __driver_probe_device+0xe3/0x170 driver_probe_device+0x49/0x120
The root case here is alloc_ordered_workqueue() fails, but cfg80211_unregister_netdevice() or unregister_netdev() not be called in error handling path. To fix add unregister_netdev goto lable to add the unregister operation in error handling path.
Fixes: 09ed8bfc5215 ("wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"") Signed-off-by: Wang Yufen wangyufen@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/1669289902-23639-1-git-send-email-wangyufen@huawei... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/microchip/wilc1000/netdev.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c index 6f3ae0dff77ce..e9f59de31b0b9 100644 --- a/drivers/net/wireless/microchip/wilc1000/netdev.c +++ b/drivers/net/wireless/microchip/wilc1000/netdev.c @@ -981,7 +981,7 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name, ndev->name); if (!wl->hif_workqueue) { ret = -ENOMEM; - goto error; + goto unregister_netdev; }
ndev->needs_free_netdev = true; @@ -996,6 +996,11 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name,
return vif;
+unregister_netdev: + if (rtnl_locked) + cfg80211_unregister_netdevice(ndev); + else + unregister_netdev(ndev); error: free_netdev(ndev); return ERR_PTR(ret);
From: Zhang Changzhong zhangchangzhong@huawei.com
[ Upstream commit 212fde3fe76e962598ce1d47b97cc78afdfc71b3 ]
The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only.
Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") Signed-off-by: Zhang Changzhong zhangchangzhong@huawei.com Reviewed-by: Arend van Spriel arend.vanspriel@broadcom.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/1668684782-47422-1-git-send-email-zhangchangzhong@... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 83ea251cfcecf..f599d5f896e89 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -336,6 +336,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, bphy_err(drvr, "%s: failed to expand headroom\n", brcmf_ifname(ifp)); atomic_inc(&drvr->bus_if->stats.pktcow_failed); + dev_kfree_skb(skb); goto done; } }
From: Zhengchao Shao shaozhengchao@huawei.com
[ Upstream commit b9f420032f2ba1e634b22ca7b433e5c40ea663af ]
After the DMA buffer is mapped to a physical address, address is stored in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr and later unmap the DMA buffer. But when count is always equal to pktids->array_size, physaddr isn't stored in pktids and the DMA buffer will not be unmapped anyway.
Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.") Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com Reviewed-by: Sebastian Andrzej Siewior bigeasy@linutronix.de Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207013114.1748936-1-shaozhengchao@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c index cec53f934940a..45fbcbdc7d9e4 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c @@ -347,8 +347,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev, count++; } while (count < pktids->array_size);
- if (count == pktids->array_size) + if (count == pktids->array_size) { + dma_unmap_single(dev, *physaddr, skb->len - data_offset, + pktids->direction); return -ENOMEM; + }
array[*idx].data_offset = data_offset; array[*idx].physaddr = *physaddr;
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 9388ce97b98216833c969191ee6df61a7201d797 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
Fixes: fc75122fabb5 ("libertas_tf: use irqsave() in USB's complete callback") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207150008.111743-2-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c index 75b5319d033f3..1750f5e93de21 100644 --- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c +++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c @@ -613,7 +613,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, spin_lock_irqsave(&priv->driver_lock, flags); memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN, recvlength - MESSAGE_HEADER_LEN); - kfree_skb(skb); + dev_kfree_skb_irq(skb); lbtf_cmd_response_rx(priv); spin_unlock_irqrestore(&priv->driver_lock, flags); }
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 3968e81ba644f10a7d45bae2539560db9edac501 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
Fixes: a3128feef6d5 ("libertas: use irqsave() in USB's complete callback") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207150008.111743-3-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c index 32fdc4150b605..2240b4db8c036 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.c +++ b/drivers/net/wireless/marvell/libertas/if_usb.c @@ -637,7 +637,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, priv->resp_len[i] = (recvlength - MESSAGE_HEADER_LEN); memcpy(priv->resp_buf[i], recvbuff + MESSAGE_HEADER_LEN, priv->resp_len[i]); - kfree_skb(skb); + dev_kfree_skb_irq(skb); lbs_notify_command_response(priv, i);
spin_unlock_irqrestore(&priv->driver_lock, flags);
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit f393df151540bf858effbd29ff572ab94e76a4c4 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
Fixes: d2e7b3425c47 ("libertas: disable functionality when interface is down") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207150008.111743-4-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/marvell/libertas/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c index ae975304cfcfa..78e8b5aecec0e 100644 --- a/drivers/net/wireless/marvell/libertas/main.c +++ b/drivers/net/wireless/marvell/libertas/main.c @@ -216,7 +216,7 @@ int lbs_stop_iface(struct lbs_private *priv)
spin_lock_irqsave(&priv->driver_lock, flags); priv->iface_running = false; - kfree_skb(priv->currenttxskb); + dev_kfree_skb_irq(priv->currenttxskb); priv->currenttxskb = NULL; priv->tx_pending_len = 0; spin_unlock_irqrestore(&priv->driver_lock, flags);
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 708a49a64237f19bd404852f297aaadbc9e7fee0 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
Fixes: f52b041aed77 ("libertas: Add spinlock to avoid race condition") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207150008.111743-5-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c index cb515c5584c1f..74cb7551f4275 100644 --- a/drivers/net/wireless/marvell/libertas/cmdresp.c +++ b/drivers/net/wireless/marvell/libertas/cmdresp.c @@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,
/* Free Tx and Rx packets */ spin_lock_irqsave(&priv->driver_lock, flags); - kfree_skb(priv->currenttxskb); + dev_kfree_skb_irq(priv->currenttxskb); priv->currenttxskb = NULL; priv->tx_pending_len = 0; spin_unlock_irqrestore(&priv->driver_lock, flags);
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 44bacbdf9066c590423259dbd6d520baac99c1a8 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221207150453.114742-1-yangyingliang@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/wl3501_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c index 1b532e00a56fb..7fb2f95134760 100644 --- a/drivers/net/wireless/wl3501_cs.c +++ b/drivers/net/wireless/wl3501_cs.c @@ -1328,7 +1328,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb, } else { ++dev->stats.tx_packets; dev->stats.tx_bytes += skb->len; - kfree_skb(skb); + dev_kfree_skb_irq(skb);
if (this->tx_buffer_cnt < 2) netif_stop_queue(dev);
From: Daniel T. Lee danieltimlee@gmail.com
[ Upstream commit 7244eb669397f309c3d014264823cdc9cb3f8e6b ]
There is currently an invalid register mapping in the s390 return address register. As the manual[1] states, the return address can be found at r14. In bpf_tracing.h, the s390 registers were named gprs(general purpose registers). This commit fixes the problem by correcting the mistyped mapping.
[1]: https://uclibc.org/docs/psABI-s390x.pdf#page=14
Fixes: 3cc31d794097 ("libbpf: Normalize PT_REGS_xxx() macro definitions") Signed-off-by: Daniel T. Lee danieltimlee@gmail.com Signed-off-by: Andrii Nakryiko andrii@kernel.org Link: https://lore.kernel.org/bpf/20221224071527.2292-7-danieltimlee@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/lib/bpf/bpf_tracing.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h index 2972dc25ff722..9c1b1689068d1 100644 --- a/tools/lib/bpf/bpf_tracing.h +++ b/tools/lib/bpf/bpf_tracing.h @@ -137,7 +137,7 @@ struct pt_regs___s390 { #define __PT_PARM3_REG gprs[4] #define __PT_PARM4_REG gprs[5] #define __PT_PARM5_REG gprs[6] -#define __PT_RET_REG grps[14] +#define __PT_RET_REG gprs[14] #define __PT_FP_REG gprs[11] /* Works only with CONFIG_FRAME_POINTER */ #define __PT_RC_REG gprs[2] #define __PT_SP_REG gprs[15]
From: Eric Biggers ebiggers@google.com
[ Upstream commit 116db2704c193fff6d73ea6c2219625f0c9bdfc8 ]
The key can be unaligned, so use the unaligned memory access helpers.
Fixes: 8ceee72808d1 ("crypto: ghash-clmulni-intel - use C implementation for setkey()") Signed-off-by: Eric Biggers ebiggers@google.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c index 1f1a95f3dd0ca..c0ab0ff4af655 100644 --- a/arch/x86/crypto/ghash-clmulni-intel_glue.c +++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c @@ -19,6 +19,7 @@ #include <crypto/internal/simd.h> #include <asm/cpu_device_id.h> #include <asm/simd.h> +#include <asm/unaligned.h>
#define GHASH_BLOCK_SIZE 16 #define GHASH_DIGEST_SIZE 16 @@ -54,15 +55,14 @@ static int ghash_setkey(struct crypto_shash *tfm, const u8 *key, unsigned int keylen) { struct ghash_ctx *ctx = crypto_shash_ctx(tfm); - be128 *x = (be128 *)key; u64 a, b;
if (keylen != GHASH_BLOCK_SIZE) return -EINVAL;
/* perform multiplication by 'x' in GF(2^128) */ - a = be64_to_cpu(x->a); - b = be64_to_cpu(x->b); + a = get_unaligned_be64(key); + b = get_unaligned_be64(key + 8);
ctx->shash.a = (b << 1) | (a >> 63); ctx->shash.b = (a << 1) | (b >> 63);
From: Lukas Bulwahn lukas.bulwahn@gmail.com
[ Upstream commit 49bc6a7786b7d03eab6912a88d09a7991a32174e ]
Commit 453de3eb08c4 ("crypto: ux500/cryp - delete driver") removes the config CRYPTO_DEV_UX500_CRYP, but leaves an obsolete reference in the dependencies of config CRYPTO_DEV_UX500_DEBUG.
Remove that obsolete reference, and adjust the description while at it.
Fixes: 453de3eb08c4 ("crypto: ux500/cryp - delete driver") Signed-off-by: Lukas Bulwahn lukas.bulwahn@gmail.com Acked-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/crypto/ux500/Kconfig | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/ux500/Kconfig b/drivers/crypto/ux500/Kconfig index dcbd7404768f1..ac89cd2de12a1 100644 --- a/drivers/crypto/ux500/Kconfig +++ b/drivers/crypto/ux500/Kconfig @@ -15,8 +15,7 @@ config CRYPTO_DEV_UX500_HASH Depends on UX500/STM DMA if running in DMA mode.
config CRYPTO_DEV_UX500_DEBUG - bool "Activate ux500 platform debug-mode for crypto and hash block" - depends on CRYPTO_DEV_UX500_CRYP || CRYPTO_DEV_UX500_HASH + bool "Activate debug-mode for UX500 crypto driver for HASH block" + depends on CRYPTO_DEV_UX500_HASH help - Say Y if you want to add debug prints to ux500_hash and - ux500_cryp devices. + Say Y if you want to add debug prints to ux500_hash devices.
From: Mario Limonciello mario.limonciello@amd.com
[ Upstream commit e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 ]
Microsoft introduced support in Windows XP for blocking port I/O to various regions. For Windows compatibility ACPICA has adopted the same protections and will disallow writes to those (presumably) the same regions.
On some systems the AML included with the firmware will issue 4 byte long writes to 0x80. These writes aren't making it over because of this blockage. The first 4 byte write attempt is rejected, and then subsequently 1 byte at a time each offset is tried. The first at 0x80 works, but then the next 3 bytes are rejected.
This manifests in bizarre failures for devices that expected the AML to write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit this failure and all 4 bytes are written.
Either some of these regions were wrong or some point after Windows XP some of these regions blocks have been lifted.
In the last 15 years there doesn't seem to be any reports popping up of this error in the Windows event viewer anymore. There is no documentation at Microsoft's developer site indicating that Windows ACPI interpreter blocks these regions. Between the lack of documentation and the fact that the writes actually do work in Windows 10 and 11, it's quite likely Windows doesn't actually enforce this anymore.
So to help the issue, only enforce Windows XP specific entries if the latest _OSI supported is Windows XP. Continue to enforce the ALWAYS_ILLEGAL entries.
Link: https://github.com/acpica/acpica/pull/817 Fixes: 7f0719039085 ("ACPICA: New: I/O port protection") Signed-off-by: Mario Limonciello mario.limonciello@amd.com Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/acpi/acpica/hwvalid.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c index 915b26448d2c9..0d392e7b0747b 100644 --- a/drivers/acpi/acpica/hwvalid.c +++ b/drivers/acpi/acpica/hwvalid.c @@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width); * * The table is used to implement the Microsoft port access rules that * first appeared in Windows XP. Some ports are always illegal, and some - * ports are only illegal if the BIOS calls _OSI with a win_XP string or - * later (meaning that the BIOS itelf is post-XP.) + * ports are only illegal if the BIOS calls _OSI with nothing newer than + * the specific _OSI strings. * * This provides ACPICA with the desired port protections and * Microsoft compatibility. @@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
/* Port illegality may depend on the _OSI calls made by the BIOS */
- if (acpi_gbl_osi_data >= port_info->osi_dependency) { + if (port_info->osi_dependency == ACPI_ALWAYS_ILLEGAL || + acpi_gbl_osi_data == port_info->osi_dependency) { ACPI_DEBUG_PRINT((ACPI_DB_VALUES, "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n", ACPI_FORMAT_UINT64(address),
From: Zhen Lei thunder.leizhen@huawei.com
[ Upstream commit 47904aed898a08f028572b9b5a5cc101ddfb2d82 ]
The type of member ->irqs_sum is unsigned long, but kstat_cpu_irqs_sum() returns int, which can result in truncation. Therefore, change the kstat_cpu_irqs_sum() function's return value to unsigned long to avoid truncation.
Fixes: f2c66cd8eedd ("/proc/stat: scalability of irq num per cpu") Reported-by: Elliott, Robert (Servers) elliott@hpe.com Signed-off-by: Zhen Lei thunder.leizhen@huawei.com Cc: Tejun Heo tj@kernel.org Cc: "Peter Zijlstra (Intel)" peterz@infradead.org Cc: Josh Don joshdon@google.com Cc: Andrew Morton akpm@linux-foundation.org Reviewed-by: Frederic Weisbecker frederic@kernel.org Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/kernel_stat.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h index ddb5a358fd829..90e2fdc17d79f 100644 --- a/include/linux/kernel_stat.h +++ b/include/linux/kernel_stat.h @@ -75,7 +75,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq); /* * Number of interrupts per cpu, since bootup */ -static inline unsigned int kstat_cpu_irqs_sum(unsigned int cpu) +static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu) { return kstat_cpu(cpu).irqs_sum; }
From: Frederic Weisbecker frederic@kernel.org
[ Upstream commit e4e1e8089c5fd948da12cb9f4adc93821036945f ]
Make sure we don't need to look again into the depths of git blame in order not to miss a subtle part about how rcu-tasks is dealing with exiting tasks.
Suggested-by: Boqun Feng boqun.feng@gmail.com Suggested-by: Neeraj Upadhyay quic_neeraju@quicinc.com Suggested-by: Paul E. McKenney paulmck@kernel.org Cc: Oleg Nesterov oleg@redhat.com Cc: Lai Jiangshan jiangshanlai@gmail.com Cc: Eric W. Biederman ebiederm@xmission.com Signed-off-by: Frederic Weisbecker frederic@kernel.org Signed-off-by: Paul E. McKenney paulmck@kernel.org Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()") Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/rcu/tasks.h | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h index fe9840d90e960..488ba8adf132c 100644 --- a/kernel/rcu/tasks.h +++ b/kernel/rcu/tasks.h @@ -827,11 +827,21 @@ static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop) static void rcu_tasks_postscan(struct list_head *hop) { /* - * Wait for tasks that are in the process of exiting. This - * does only part of the job, ensuring that all tasks that were - * previously exiting reach the point where they have disabled - * preemption, allowing the later synchronize_rcu() to finish - * the job. + * Exiting tasks may escape the tasklist scan. Those are vulnerable + * until their final schedule() with TASK_DEAD state. To cope with + * this, divide the fragile exit path part in two intersecting + * read side critical sections: + * + * 1) An _SRCU_ read side starting before calling exit_notify(), + * which may remove the task from the tasklist, and ending after + * the final preempt_disable() call in do_exit(). + * + * 2) An _RCU_ read side starting with the final preempt_disable() + * call in do_exit() and ending with the final call to schedule() + * with TASK_DEAD state. + * + * This handles the part 1). And postgp will handle part 2) with a + * call to synchronize_rcu(). */ synchronize_srcu(&tasks_rcu_exit_srcu); } @@ -898,7 +908,10 @@ static void rcu_tasks_postgp(struct rcu_tasks *rtp) * * In addition, this synchronize_rcu() waits for exiting tasks * to complete their final preempt_disable() region of execution, - * cleaning up after the synchronize_srcu() above. + * cleaning up after synchronize_srcu(&tasks_rcu_exit_srcu), + * enforcing the whole region before tasklist removal until + * the final schedule() with TASK_DEAD state to be an RCU TASKS + * read side critical section. */ synchronize_rcu(); } @@ -988,7 +1001,11 @@ void show_rcu_tasks_classic_gp_kthread(void) EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread); #endif // !defined(CONFIG_TINY_RCU)
-/* Do the srcu_read_lock() for the above synchronize_srcu(). */ +/* + * Contribute to protect against tasklist scan blind spot while the + * task is exiting and may be removed from the tasklist. See + * corresponding synchronize_srcu() for further details. + */ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) { preempt_disable(); @@ -996,7 +1013,11 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) preempt_enable(); }
-/* Do the srcu_read_unlock() for the above synchronize_srcu(). */ +/* + * Contribute to protect against tasklist scan blind spot while the + * task is exiting and may be removed from the tasklist. See + * corresponding synchronize_srcu() for further details. + */ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) { struct task_struct *t = current;
From: Frederic Weisbecker frederic@kernel.org
[ Upstream commit 44757092958bdd749775022f915b7ac974384c2a ]
Ever since the following commit:
5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()")
SRCU doesn't rely anymore on preemption to be disabled in order to modify the per-CPU counter. And even then it used to be done from the API itself.
Therefore and after checking further, it appears to be safe to remove the preemption disablement around __srcu_read_[un]lock() in exit_tasks_rcu_start() and exit_tasks_rcu_finish()
Suggested-by: Boqun Feng boqun.feng@gmail.com Suggested-by: Paul E. McKenney paulmck@kernel.org Suggested-by: Neeraj Upadhyay quic_neeraju@quicinc.com Cc: Lai Jiangshan jiangshanlai@gmail.com Signed-off-by: Frederic Weisbecker frederic@kernel.org Signed-off-by: Paul E. McKenney paulmck@kernel.org Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()") Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/rcu/tasks.h | 4 ---- 1 file changed, 4 deletions(-)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h index 488ba8adf132c..20617a2d04ed9 100644 --- a/kernel/rcu/tasks.h +++ b/kernel/rcu/tasks.h @@ -1008,9 +1008,7 @@ EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread); */ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) { - preempt_disable(); current->rcu_tasks_idx = __srcu_read_lock(&tasks_rcu_exit_srcu); - preempt_enable(); }
/* @@ -1022,9 +1020,7 @@ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) { struct task_struct *t = current;
- preempt_disable(); __srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx); - preempt_enable(); exit_tasks_rcu_finish_trace(t); }
From: Frederic Weisbecker frederic@kernel.org
[ Upstream commit 28319d6dc5e2ffefa452c2377dd0f71621b5bff0 ]
RCU Tasks and PID-namespace unshare can interact in do_exit() in a complicated circular dependency:
1) TASK A calls unshare(CLONE_NEWPID), this creates a new PID namespace that every subsequent child of TASK A will belong to. But TASK A doesn't itself belong to that new PID namespace.
2) TASK A forks() and creates TASK B. TASK A stays attached to its PID namespace (let's say PID_NS1) and TASK B is the first task belonging to the new PID namespace created by unshare() (let's call it PID_NS2).
3) Since TASK B is the first task attached to PID_NS2, it becomes the PID_NS2 child reaper.
4) TASK A forks() again and creates TASK C which get attached to PID_NS2. Note how TASK C has TASK A as a parent (belonging to PID_NS1) but has TASK B (belonging to PID_NS2) as a pid_namespace child_reaper.
5) TASK B exits and since it is the child reaper for PID_NS2, it has to kill all other tasks attached to PID_NS2, and wait for all of them to die before getting reaped itself (zap_pid_ns_process()).
6) TASK A calls synchronize_rcu_tasks() which leads to synchronize_srcu(&tasks_rcu_exit_srcu).
7) TASK B is waiting for TASK C to get reaped. But TASK B is under a tasks_rcu_exit_srcu SRCU critical section (exit_notify() is between exit_tasks_rcu_start() and exit_tasks_rcu_finish()), blocking TASK A.
8) TASK C exits and since TASK A is its parent, it waits for it to reap TASK C, but it can't because TASK A waits for TASK B that waits for TASK C.
Pid_namespace semantics can hardly be changed at this point. But the coverage of tasks_rcu_exit_srcu can be reduced instead.
The current task is assumed not to be concurrently reapable at this stage of exit_notify() and therefore tasks_rcu_exit_srcu can be temporarily relaxed without breaking its constraints, providing a way out of the deadlock scenario.
[ paulmck: Fix build failure by adding additional declaration. ]
Fixes: 3f95aa81d265 ("rcu: Make TASKS_RCU handle tasks that are almost done exiting") Reported-by: Pengfei Xu pengfei.xu@intel.com Suggested-by: Boqun Feng boqun.feng@gmail.com Suggested-by: Neeraj Upadhyay quic_neeraju@quicinc.com Suggested-by: Paul E. McKenney paulmck@kernel.org Cc: Oleg Nesterov oleg@redhat.com Cc: Lai Jiangshan jiangshanlai@gmail.com Cc: Eric W . Biederman ebiederm@xmission.com Signed-off-by: Frederic Weisbecker frederic@kernel.org Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/rcupdate.h | 2 ++ kernel/pid_namespace.c | 17 +++++++++++++++++ kernel/rcu/tasks.h | 15 +++++++++++++-- 3 files changed, 32 insertions(+), 2 deletions(-)
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h index 03abf883a281b..c0c79beac3fe6 100644 --- a/include/linux/rcupdate.h +++ b/include/linux/rcupdate.h @@ -238,6 +238,7 @@ void synchronize_rcu_tasks_rude(void);
#define rcu_note_voluntary_context_switch(t) rcu_tasks_qs(t, false) void exit_tasks_rcu_start(void); +void exit_tasks_rcu_stop(void); void exit_tasks_rcu_finish(void); #else /* #ifdef CONFIG_TASKS_RCU_GENERIC */ #define rcu_tasks_classic_qs(t, preempt) do { } while (0) @@ -246,6 +247,7 @@ void exit_tasks_rcu_finish(void); #define call_rcu_tasks call_rcu #define synchronize_rcu_tasks synchronize_rcu static inline void exit_tasks_rcu_start(void) { } +static inline void exit_tasks_rcu_stop(void) { } static inline void exit_tasks_rcu_finish(void) { } #endif /* #else #ifdef CONFIG_TASKS_RCU_GENERIC */
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index f4f8cb0435b45..fc21c5d5fd5de 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -244,7 +244,24 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns) set_current_state(TASK_INTERRUPTIBLE); if (pid_ns->pid_allocated == init_pids) break; + /* + * Release tasks_rcu_exit_srcu to avoid following deadlock: + * + * 1) TASK A unshare(CLONE_NEWPID) + * 2) TASK A fork() twice -> TASK B (child reaper for new ns) + * and TASK C + * 3) TASK B exits, kills TASK C, waits for TASK A to reap it + * 4) TASK A calls synchronize_rcu_tasks() + * -> synchronize_srcu(tasks_rcu_exit_srcu) + * 5) *DEADLOCK* + * + * It is considered safe to release tasks_rcu_exit_srcu here + * because we assume the current task can not be concurrently + * reaped at this point. + */ + exit_tasks_rcu_stop(); schedule(); + exit_tasks_rcu_start(); } __set_current_state(TASK_RUNNING);
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h index 20617a2d04ed9..03388e2e29df0 100644 --- a/kernel/rcu/tasks.h +++ b/kernel/rcu/tasks.h @@ -1016,16 +1016,27 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) * task is exiting and may be removed from the tasklist. See * corresponding synchronize_srcu() for further details. */ -void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) +void exit_tasks_rcu_stop(void) __releases(&tasks_rcu_exit_srcu) { struct task_struct *t = current;
__srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx); - exit_tasks_rcu_finish_trace(t); +} + +/* + * Contribute to protect against tasklist scan blind spot while the + * task is exiting and may be removed from the tasklist. See + * corresponding synchronize_srcu() for further details. + */ +void exit_tasks_rcu_finish(void) +{ + exit_tasks_rcu_stop(); + exit_tasks_rcu_finish_trace(current); }
#else /* #ifdef CONFIG_TASKS_RCU */ void exit_tasks_rcu_start(void) { } +void exit_tasks_rcu_stop(void) { } void exit_tasks_rcu_finish(void) { exit_tasks_rcu_finish_trace(current); } #endif /* #else #ifdef CONFIG_TASKS_RCU */
From: Herbert Xu herbert@gondor.apana.org.au
[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ]
The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes.
Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") Reported-by: Roberto Sassu roberto.sassu@huaweicloud.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Reviewed-by: Eric Biggers ebiggers@google.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- lib/mpi/mpicoder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c index 39c4c67310946..3cb6bd148fa9e 100644 --- a/lib/mpi/mpicoder.c +++ b/lib/mpi/mpicoder.c @@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
while (sg_miter_next(&miter)) { buff = miter.addr; - len = miter.length; + len = min_t(unsigned, miter.length, nbytes); + nbytes -= len;
for (x = 0; x < len; x++) { a <<= 8;
From: David Rientjes rientjes@google.com
[ Upstream commit 91dfd98216d817ec5f1c55890bacb7b4fe9b068a ]
For SEV_GET_ID2, the user provided length does not have a specified limitation because the length of the ID may change in the future. The kernel memory allocation, however, is implicitly limited to 4MB on x86 by the page allocator, otherwise the kzalloc() will fail.
When this happens, it is best not to spam the kernel log with the warning. Simply fail the allocation and return ENOMEM to the user.
Fixes: d6112ea0cb34 ("crypto: ccp - introduce SEV_GET_ID2 command") Reported-by: Andy Nguyen theflow@google.com Reported-by: Peter Gonda pgonda@google.com Suggested-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: David Rientjes rientjes@google.com Acked-by: Tom Lendacky thomas.lendacky@amd.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/crypto/ccp/sev-dev.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index 06fc7156c04f3..56998bc579d67 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -881,7 +881,14 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) input_address = (void __user *)input.address;
if (input.address && input.length) { - id_blob = kzalloc(input.length, GFP_KERNEL); + /* + * The length of the ID shouldn't be assumed by software since + * it may change in the future. The allocation size is limited + * to 1 << (PAGE_SHIFT + MAX_ORDER - 1) by the page allocator. + * If the allocation fails, simply return ENOMEM rather than + * warning in the kernel log. + */ + id_blob = kzalloc(input.length, GFP_KERNEL | __GFP_NOWARN); if (!id_blob) return -ENOMEM;
From: Prashant Malani pmalani@chromium.org
[ Upstream commit 8d2b28df6c3dc1581d856f52d9f78059ef2a568f ]
The port advertising DP support is a Type-C receptacle. Fix the port's DisplayPort VDO to reflect this.
Fixes: 1903adae0464 ("platform/chrome: cros_ec_typec: Add bit offset for DP VDO") Signed-off-by: Prashant Malani pmalani@chromium.org Reviewed-by: Benson Leung bleung@chromium.org Acked-by: Heikki Krogerus heikki.krogerus@linux.intel.com Link: https://lore.kernel.org/r/20221228004648.793339-6-pmalani@chromium.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/platform/chrome/cros_ec_typec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c index 001b0de95a46e..d1714b5d085be 100644 --- a/drivers/platform/chrome/cros_ec_typec.c +++ b/drivers/platform/chrome/cros_ec_typec.c @@ -27,7 +27,7 @@ #define DRV_NAME "cros-ec-typec"
#define DP_PORT_VDO (DP_CONF_SET_PIN_ASSIGN(BIT(DP_PIN_ASSIGN_C) | BIT(DP_PIN_ASSIGN_D)) | \ - DP_CAP_DFP_D) + DP_CAP_DFP_D | DP_CAP_RECEPTACLE)
/* Supported alt modes. */ enum {
From: Daniil Tatianin d-tatianin@yandex-team.ru
[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ]
Previously acpi_ns_simple_repair() would crash if expected_btypes contained any combination of ACPI_RTYPE_NONE with a different type, e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the !return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE for such cases.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
Link: https://github.com/acpica/acpica/pull/811 Fixes: 61db45ca2163 ("ACPICA: Restore code that repairs NULL package elements in return values.") Signed-off-by: Daniil Tatianin d-tatianin@yandex-team.ru Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/acpi/acpica/nsrepair.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c index 367fcd201f96e..ec512e06a48ed 100644 --- a/drivers/acpi/acpica/nsrepair.c +++ b/drivers/acpi/acpica/nsrepair.c @@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info, * Try to fix if there was no return object. Warning if failed to fix. */ if (!return_object) { - if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) { - if (package_index != ACPI_NOT_PACKAGE_ELEMENT) { + if (expected_btypes) { + if (!(expected_btypes & ACPI_RTYPE_NONE) && + package_index != ACPI_NOT_PACKAGE_ELEMENT) { ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname, ACPI_WARN_ALWAYS, @@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info, if (ACPI_SUCCESS(status)) { return (AE_OK); /* Repair was successful */ } - } else { + } + + if (expected_btypes != ACPI_RTYPE_NONE) { ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname, ACPI_WARN_ALWAYS, "Missing expected return value")); + return (AE_AML_NO_RETURN_VALUE); } - - return (AE_AML_NO_RETURN_VALUE); } }
From: Ludovic L'Hours ludovic.lhours@gmail.com
[ Upstream commit 6920b08661e3ad829206078b5c9879b24aea8dfc ]
As BPF_F_MMAPABLE flag is now conditionnaly set (by map_is_mmapable), it should not be toggled but disabled if not supported by kernel.
Fixes: 4fcac46c7e10 ("libbpf: only add BPF_F_MMAPABLE flag for data maps with global vars") Signed-off-by: Ludovic L'Hours ludovic.lhours@gmail.com Acked-by: Jiri Olsa jolsa@kernel.org Link: https://lore.kernel.org/r/20230108182018.24433-1-ludovic.lhours@gmail.com Signed-off-by: Martin KaFai Lau martin.lau@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/lib/bpf/libbpf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 2a82f49ce16f3..adf818da35dda 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -7355,7 +7355,7 @@ static int bpf_object__sanitize_maps(struct bpf_object *obj) if (!bpf_map__is_internal(m)) continue; if (!kernel_supports(obj, FEAT_ARRAY_MMAP)) - m->def.map_flags ^= BPF_F_MMAPABLE; + m->def.map_flags &= ~BPF_F_MMAPABLE; }
return 0;
From: Michal Suchanek msuchanek@suse.de
[ Upstream commit 5fbea42387eba1c7517fcad79099df706def7054 ]
The ability to subscript match result as an array is only available since python 3.6. Existing code in bpf_doc uses the older group() interface but commit 8a76145a2ec2 adds code using the new interface.
Use the old interface consistently to avoid build error on older distributions like the below:
+ make -j48 -s -C /dev/shm/kbuild/linux.33946/current ARCH=powerpc HOSTCC=gcc CROSS_COMPILE=powerpc64-suse-linux- clean TypeError: '_sre.SRE_Match' object is not subscriptable
Fixes: 8a76145a2ec2 ("bpf: explicitly define BPF_FUNC_xxx integer values") Signed-off-by: Michal Suchanek msuchanek@suse.de Signed-off-by: Andrii Nakryiko andrii@kernel.org Acked-by: Quentin Monnet quentin@isovalent.com Link: https://lore.kernel.org/bpf/20230109113442.20946-1-msuchanek@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- scripts/bpf_doc.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/bpf_doc.py b/scripts/bpf_doc.py index e8d90829f23ed..38d51e05c7a2b 100755 --- a/scripts/bpf_doc.py +++ b/scripts/bpf_doc.py @@ -271,7 +271,7 @@ class HeaderParser(object): if capture: fn_defines_str += self.line helper_name = capture.expand(r'bpf_\1') - self.helper_enum_vals[helper_name] = int(capture[2]) + self.helper_enum_vals[helper_name] = int(capture.group(2)) self.helper_enum_pos[helper_name] = i i += 1 else:
From: Magnus Karlsson magnus.karlsson@intel.com
[ Upstream commit 2d0b2ae2871ae6d42a9f0a4280e0fb5bff8d38b8 ]
Print the correct payload when the packet dump option is selected. The network to host conversion was forgotten and the payload was erronously declared to be an int instead of an unsigned int.
Fixes: facb7cb2e909 ("selftests/bpf: Xsk selftests - SKB POLL, NOPOLL") Signed-off-by: Magnus Karlsson magnus.karlsson@intel.com Acked-by: Maciej Fijalkowski maciej.fijalkowski@intel.com Link: https://lore.kernel.org/r/20230111093526.11682-2-magnus.karlsson@gmail.com Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/bpf/xskxceiver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c index 162d3a516f2ca..2ff43b22180fa 100644 --- a/tools/testing/selftests/bpf/xskxceiver.c +++ b/tools/testing/selftests/bpf/xskxceiver.c @@ -767,7 +767,7 @@ static void pkt_dump(void *pkt, u32 len) struct ethhdr *ethhdr; struct udphdr *udphdr; struct iphdr *iphdr; - int payload, i; + u32 payload, i;
ethhdr = pkt; iphdr = pkt + sizeof(*ethhdr); @@ -792,7 +792,7 @@ static void pkt_dump(void *pkt, u32 len) fprintf(stdout, "DEBUG>> L4: udp_hdr->src: %d\n", ntohs(udphdr->source)); fprintf(stdout, "DEBUG>> L4: udp_hdr->dst: %d\n", ntohs(udphdr->dest)); /*extract L5 frame */ - payload = *((uint32_t *)(pkt + PKT_HDR_SIZE)); + payload = ntohl(*((u32 *)(pkt + PKT_HDR_SIZE)));
fprintf(stdout, "DEBUG>> L5: payload: %d\n", payload); fprintf(stdout, "---------------------------------------\n");
From: Magnus Karlsson magnus.karlsson@intel.com
[ Upstream commit 085dcccfb7d3dc52ed708fc588587f319541bc83 ]
Print the correct error codes when exiting the test suite due to some terminal error. Some of these had a switched sign and some of them printed zero instead of errno.
Fixes: facb7cb2e909 ("selftests/bpf: Xsk selftests - SKB POLL, NOPOLL") Signed-off-by: Magnus Karlsson magnus.karlsson@intel.com Acked-by: Maciej Fijalkowski maciej.fijalkowski@intel.com Link: https://lore.kernel.org/r/20230111093526.11682-5-magnus.karlsson@gmail.com Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/bpf/xskxceiver.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c index 2ff43b22180fa..1b9f48daa2257 100644 --- a/tools/testing/selftests/bpf/xskxceiver.c +++ b/tools/testing/selftests/bpf/xskxceiver.c @@ -350,7 +350,7 @@ static bool ifobj_zc_avail(struct ifobject *ifobject) umem = calloc(1, sizeof(struct xsk_umem_info)); if (!umem) { munmap(bufs, umem_sz); - exit_with_error(-ENOMEM); + exit_with_error(ENOMEM); } umem->frame_size = XSK_UMEM__DEFAULT_FRAME_SIZE; ret = xsk_configure_umem(umem, bufs, umem_sz); @@ -936,7 +936,7 @@ static int receive_pkts(struct test_spec *test, struct pollfd *fds) if (ifobj->use_poll) { ret = poll(fds, 1, POLL_TMOUT); if (ret < 0) - exit_with_error(-ret); + exit_with_error(errno);
if (!ret) { if (!is_umem_valid(test->ifobj_tx)) @@ -963,7 +963,7 @@ static int receive_pkts(struct test_spec *test, struct pollfd *fds) if (xsk_ring_prod__needs_wakeup(&umem->fq)) { ret = poll(fds, 1, POLL_TMOUT); if (ret < 0) - exit_with_error(-ret); + exit_with_error(errno); } ret = xsk_ring_prod__reserve(&umem->fq, rcvd, &idx_fq); } @@ -1015,7 +1015,7 @@ static int __send_pkts(struct ifobject *ifobject, u32 *pkt_nb, struct pollfd *fd if (timeout) { if (ret < 0) { ksft_print_msg("ERROR: [%s] Poll error %d\n", - __func__, ret); + __func__, errno); return TEST_FAILURE; } if (ret == 0) @@ -1024,7 +1024,7 @@ static int __send_pkts(struct ifobject *ifobject, u32 *pkt_nb, struct pollfd *fd } if (ret <= 0) { ksft_print_msg("ERROR: [%s] Poll error %d\n", - __func__, ret); + __func__, errno); return TEST_FAILURE; } } @@ -1323,18 +1323,18 @@ static void thread_common_ops(struct test_spec *test, struct ifobject *ifobject) if (ifobject->xdp_flags & XDP_FLAGS_SKB_MODE) { if (opts.attach_mode != XDP_ATTACHED_SKB) { ksft_print_msg("ERROR: [%s] XDP prog not in SKB mode\n"); - exit_with_error(-EINVAL); + exit_with_error(EINVAL); } } else if (ifobject->xdp_flags & XDP_FLAGS_DRV_MODE) { if (opts.attach_mode != XDP_ATTACHED_DRV) { ksft_print_msg("ERROR: [%s] XDP prog not in DRV mode\n"); - exit_with_error(-EINVAL); + exit_with_error(EINVAL); } }
ret = xsk_socket__update_xskmap(ifobject->xsk->xsk, ifobject->xsk_map_fd); if (ret) - exit_with_error(-ret); + exit_with_error(errno); }
static void *worker_testapp_validate_tx(void *arg) @@ -1541,7 +1541,7 @@ static void swap_xsk_resources(struct ifobject *ifobj_tx, struct ifobject *ifobj
ret = xsk_socket__update_xskmap(ifobj_rx->xsk->xsk, ifobj_rx->xsk_map_fd); if (ret) - exit_with_error(-ret); + exit_with_error(errno); }
static void testapp_bpf_res(struct test_spec *test)
From: Mark Brown broonie@kernel.org
[ Upstream commit 50daf5b7c4ec4efcaf49a4128930f872bec7dbc0 ]
Since it was added our hwcap for DIT has specified that DIT is a signed field but this appears to be incorrect, the two values for the enumeration are:
0b0000 NI 0b0001 IMP
which look like a normal unsigned enumeration and the in-kernel DIT usage added by 01ab991fc0ee ("arm64: Enable data independent timing (DIT) in the kernel") detects the feature with an unsigned enum. Fix the hwcap to specify the field as unsigned.
Fixes: 7206dc93a58f ("arm64: Expose Arm v8.4 features") Reviewed-by: Mark Rutland mark.rutland@arm.com Signed-off-by: Mark Brown broonie@kernel.org Link: https://lore.kernel.org/r/20221207-arm64-sysreg-helpers-v3-1-0d71a7b174a8@ke... Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/kernel/cpufeature.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index a77315b338e61..ee40dca9f28ef 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -2777,7 +2777,7 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_FP_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_FPHP), HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_AdvSIMD_SHIFT, 4, FTR_SIGNED, 0, CAP_HWCAP, KERNEL_HWCAP_ASIMD), HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_AdvSIMD_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_ASIMDHP), - HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_DIT_SHIFT, 4, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DIT), + HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_DIT_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DIT), HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_DPB_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_DCPOP), HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_DPB_SHIFT, 4, FTR_UNSIGNED, 2, CAP_HWCAP, KERNEL_HWCAP_DCPODP), HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_JSCVT_SHIFT, 4, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_JSCVT),
From: Mark Brown broonie@kernel.org
[ Upstream commit 8c6e105558628b63292ae770198f11a1d5535660 ]
The recently converted 32 bit ID registers have errors in MVFR0_EL1.FPSP, MVFR0_EL1.SIMDReg and MVFR1_EL1.SIMDHP where enumeration values which should be 0b0010 are specified as 0b0001. Correct these.
Fixes: e79c94a2a487 ("arm64/sysreg: Convert MVFR0_EL1 to automatic generation") Fixes: c9b718eda706 ("arm64/sysreg: Convert MVFR1_EL1 to automatic generation") Reviewed-by: Mark Rutland mark.rutland@arm.com Signed-off-by: Mark Brown broonie@kernel.org Link: https://lore.kernel.org/r/20221207-arm64-sysreg-helpers-v3-2-0d71a7b174a8@ke... Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/tools/sysreg | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg index 184e58fd5631a..e8fb6684d7f3c 100644 --- a/arch/arm64/tools/sysreg +++ b/arch/arm64/tools/sysreg @@ -689,17 +689,17 @@ EndEnum Enum 11:8 FPDP 0b0000 NI 0b0001 VFPv2 - 0b0001 VFPv3 + 0b0010 VFPv3 EndEnum Enum 7:4 FPSP 0b0000 NI 0b0001 VFPv2 - 0b0001 VFPv3 + 0b0010 VFPv3 EndEnum Enum 3:0 SIMDReg 0b0000 NI 0b0001 IMP_16x64 - 0b0001 IMP_32x64 + 0b0010 IMP_32x64 EndEnum EndSysreg
@@ -718,7 +718,7 @@ EndEnum Enum 23:20 SIMDHP 0b0000 NI 0b0001 SIMDHP - 0b0001 SIMDHP_FLOAT + 0b0010 SIMDHP_FLOAT EndEnum Enum 19:16 SIMDSP 0b0000 NI
From: Mark Brown broonie@kernel.org
[ Upstream commit 97ec597b26df774a257e3f8e97353fd1b4471615 ]
SME does not mandate any specific VL so we may not have 128 bit SME but the algorithm used for enumerating VLs assumes that we will. Add the required check to ensure that the algorithm terminates.
Fixes: 43e3f85523e4 ("kselftest/arm64: Add SME support to syscall ABI test") Signed-off-by: Mark Brown broonie@kernel.org Link: https://lore.kernel.org/r/20221223-arm64-syscall-abi-sme-only-v1-1-4fabfbd62... Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/arm64/abi/syscall-abi.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/tools/testing/selftests/arm64/abi/syscall-abi.c b/tools/testing/selftests/arm64/abi/syscall-abi.c index dd7ebe536d05f..ffe719b50c215 100644 --- a/tools/testing/selftests/arm64/abi/syscall-abi.c +++ b/tools/testing/selftests/arm64/abi/syscall-abi.c @@ -390,6 +390,10 @@ static void test_one_syscall(struct syscall_cfg *cfg)
sme_vl &= PR_SME_VL_LEN_MASK;
+ /* Found lowest VL */ + if (sve_vq_from_vl(sme_vl) > sme_vq) + break; + if (sme_vq != sve_vq_from_vl(sme_vl)) sme_vq = sve_vq_from_vl(sme_vl);
@@ -461,6 +465,10 @@ int sme_count_vls(void)
vl &= PR_SME_VL_LEN_MASK;
+ /* Found lowest VL */ + if (sve_vq_from_vl(vl) > vq) + break; + if (vq != sve_vq_from_vl(vl)) vq = sve_vq_from_vl(vl);
From: Lai Jiangshan jiangshan.ljs@antgroup.com
[ Upstream commit 99c621ef243bda726fb8d982a274ded96570b410 ]
When unbind_workers() reads wq_unbound_cpumask to set the affinity of freshly-unbound kworkers, it only holds wq_pool_attach_mutex. This isn't sufficient as wq_unbound_cpumask is only protected by wq_pool_mutex.
Make wq_unbound_cpumask protected with wq_pool_attach_mutex and also remove the need of temporary saved_cpumask.
Fixes: 10a5a651e3af ("workqueue: Restrict kworker in the offline CPU pool running on housekeeping CPUs") Reported-by: Valentin Schneider vschneid@redhat.com Signed-off-by: Lai Jiangshan jiangshan.ljs@antgroup.com Signed-off-by: Tejun Heo tj@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/workqueue.c | 41 ++++++++++++++++------------------------- 1 file changed, 16 insertions(+), 25 deletions(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 07895deca2711..76ea87b0251ce 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -326,7 +326,7 @@ static struct rcuwait manager_wait = __RCUWAIT_INITIALIZER(manager_wait); static LIST_HEAD(workqueues); /* PR: list of all workqueues */ static bool workqueue_freezing; /* PL: have wqs started freezing? */
-/* PL: allowable cpus for unbound wqs and work items */ +/* PL&A: allowable cpus for unbound wqs and work items */ static cpumask_var_t wq_unbound_cpumask;
/* CPU where unbound work was last round robin scheduled from this CPU */ @@ -3952,7 +3952,8 @@ static void apply_wqattrs_cleanup(struct apply_wqattrs_ctx *ctx) /* allocate the attrs and pwqs for later installation */ static struct apply_wqattrs_ctx * apply_wqattrs_prepare(struct workqueue_struct *wq, - const struct workqueue_attrs *attrs) + const struct workqueue_attrs *attrs, + const cpumask_var_t unbound_cpumask) { struct apply_wqattrs_ctx *ctx; struct workqueue_attrs *new_attrs, *tmp_attrs; @@ -3968,14 +3969,15 @@ apply_wqattrs_prepare(struct workqueue_struct *wq, goto out_free;
/* - * Calculate the attrs of the default pwq. + * Calculate the attrs of the default pwq with unbound_cpumask + * which is wq_unbound_cpumask or to set to wq_unbound_cpumask. * If the user configured cpumask doesn't overlap with the * wq_unbound_cpumask, we fallback to the wq_unbound_cpumask. */ copy_workqueue_attrs(new_attrs, attrs); - cpumask_and(new_attrs->cpumask, new_attrs->cpumask, wq_unbound_cpumask); + cpumask_and(new_attrs->cpumask, new_attrs->cpumask, unbound_cpumask); if (unlikely(cpumask_empty(new_attrs->cpumask))) - cpumask_copy(new_attrs->cpumask, wq_unbound_cpumask); + cpumask_copy(new_attrs->cpumask, unbound_cpumask);
/* * We may create multiple pwqs with differing cpumasks. Make a @@ -4072,7 +4074,7 @@ static int apply_workqueue_attrs_locked(struct workqueue_struct *wq, wq->flags &= ~__WQ_ORDERED; }
- ctx = apply_wqattrs_prepare(wq, attrs); + ctx = apply_wqattrs_prepare(wq, attrs, wq_unbound_cpumask); if (!ctx) return -ENOMEM;
@@ -5334,7 +5336,7 @@ void thaw_workqueues(void) } #endif /* CONFIG_FREEZER */
-static int workqueue_apply_unbound_cpumask(void) +static int workqueue_apply_unbound_cpumask(const cpumask_var_t unbound_cpumask) { LIST_HEAD(ctxs); int ret = 0; @@ -5350,7 +5352,7 @@ static int workqueue_apply_unbound_cpumask(void) if (wq->flags & __WQ_ORDERED) continue;
- ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs); + ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs, unbound_cpumask); if (!ctx) { ret = -ENOMEM; break; @@ -5365,6 +5367,11 @@ static int workqueue_apply_unbound_cpumask(void) apply_wqattrs_cleanup(ctx); }
+ if (!ret) { + mutex_lock(&wq_pool_attach_mutex); + cpumask_copy(wq_unbound_cpumask, unbound_cpumask); + mutex_unlock(&wq_pool_attach_mutex); + } return ret; }
@@ -5383,7 +5390,6 @@ static int workqueue_apply_unbound_cpumask(void) int workqueue_set_unbound_cpumask(cpumask_var_t cpumask) { int ret = -EINVAL; - cpumask_var_t saved_cpumask;
/* * Not excluding isolated cpus on purpose. @@ -5397,23 +5403,8 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask) goto out_unlock; }
- if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL)) { - ret = -ENOMEM; - goto out_unlock; - } - - /* save the old wq_unbound_cpumask. */ - cpumask_copy(saved_cpumask, wq_unbound_cpumask); - - /* update wq_unbound_cpumask at first and apply it to wqs. */ - cpumask_copy(wq_unbound_cpumask, cpumask); - ret = workqueue_apply_unbound_cpumask(); - - /* restore the wq_unbound_cpumask when failed. */ - if (ret < 0) - cpumask_copy(wq_unbound_cpumask, saved_cpumask); + ret = workqueue_apply_unbound_cpumask(cpumask);
- free_cpumask_var(saved_cpumask); out_unlock: apply_wqattrs_unlock(); }
From: Alexander Gordeev agordeev@linux.ibm.com
[ Upstream commit 639886b71ddef085a0e7bb1f225b8ae3eda5c06f ]
Commit ada1da31ce34 ("s390/sclp: sort out physical vs virtual pointers usage") fixed the notion of virtual address for sclp_early_sccb pointer. However, it did not take into account that kasan_early_init() can also output messages and sclp_early_sccb should be adjusted by the time kasan_early_init() is called.
Currently it is not a problem, since virtual and physical addresses on s390 are the same. Nevertheless, should they ever differ, this would cause an invalid pointer access.
Fixes: ada1da31ce34 ("s390/sclp: sort out physical vs virtual pointers usage") Reviewed-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Alexander Gordeev agordeev@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/kernel/early.c | 1 - arch/s390/kernel/head64.S | 1 + drivers/s390/char/sclp_early.c | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c index 6030fdd6997bc..9693c8630e73f 100644 --- a/arch/s390/kernel/early.c +++ b/arch/s390/kernel/early.c @@ -288,7 +288,6 @@ static void __init sort_amode31_extable(void)
void __init startup_init(void) { - sclp_early_adjust_va(); reset_tod_clock(); check_image_bootable(); time_early_init(); diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S index d7b8b6ad574dc..3b3bf8329e6c1 100644 --- a/arch/s390/kernel/head64.S +++ b/arch/s390/kernel/head64.S @@ -25,6 +25,7 @@ ENTRY(startup_continue) larl %r14,init_task stg %r14,__LC_CURRENT larl %r15,init_thread_union+THREAD_SIZE-STACK_FRAME_OVERHEAD-__PT_SIZE + brasl %r14,sclp_early_adjust_va # allow sclp_early_printk #ifdef CONFIG_KASAN brasl %r14,kasan_early_init #endif diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c index c1c70a161c0e2..f480d6c7fd399 100644 --- a/drivers/s390/char/sclp_early.c +++ b/drivers/s390/char/sclp_early.c @@ -163,7 +163,7 @@ static void __init sclp_early_console_detect(struct init_sccb *sccb) sclp.has_linemode = 1; }
-void __init sclp_early_adjust_va(void) +void __init __no_sanitize_address sclp_early_adjust_va(void) { sclp_early_sccb = __va((unsigned long)sclp_early_sccb); }
From: Christophe JAILLET christophe.jaillet@wanadoo.fr
[ Upstream commit 08866d34c7099e981918d34aab5d6a437436628f ]
The commit in Fixes: has switch the order of a sysfs_create_group() and a kzalloc().
It correctly removed the now useless kfree() but forgot to add a sysfs_remove_group() in case of (unlikely) memory allocation failure.
Add it now.
Fixes: 260f3ea14138 ("s390/vfio-ap: move probe and remove callbacks to vfio_ap_ops.c") Signed-off-by: Christophe JAILLET christophe.jaillet@wanadoo.fr Signed-off-by: Alexander Gordeev agordeev@linux.ibm.com Link: https://lore.kernel.org/r/d0c0a35eec4fa87cb7f3910d8ac4dc0f7dc9008a.165928373... Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/s390/crypto/vfio_ap_ops.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index 9c01957e56b3f..b0b25bc95985b 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -1857,8 +1857,10 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) return ret;
q = kzalloc(sizeof(*q), GFP_KERNEL); - if (!q) - return -ENOMEM; + if (!q) { + ret = -ENOMEM; + goto err_remove_group; + }
q->apqn = to_ap_queue(&apdev->device)->qid; q->saved_isc = VFIO_AP_ISC_INVALID; @@ -1876,6 +1878,10 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) release_update_locks_for_mdev(matrix_mdev);
return 0; + +err_remove_group: + sysfs_remove_group(&apdev->device.kobj, &vfio_queue_attr_group); + return ret; }
void vfio_ap_mdev_remove_queue(struct ap_device *apdev)
From: Christophe JAILLET christophe.jaillet@wanadoo.fr
[ Upstream commit ef6dfc4b238a435ab552207ec09e4a82b6426d31 ]
Functions used with __setup() return 1 when the argument has been successfully parsed.
Reverse the returned value so that 1 is returned when kstrtobool() is successful (i.e. returns 0).
My understanding of these __setup() functions is that returning 1 or 0 does not change much anyway - so this is more of a cleanup than a functional fix.
I spot it and found it spurious while looking at something else. Even if the output is not perfect, you'll get the idea with:
$ git grep -B2 -A10 retu.*kstrtobool | grep __setup -B10
Fixes: 3aac3ebea08f ("x86/signal: Implement sigaltstack size validation") Signed-off-by: Christophe JAILLET christophe.jaillet@wanadoo.fr Signed-off-by: Ingo Molnar mingo@kernel.org Link: https://lore.kernel.org/r/73882d43ebe420c9d8fb82d0560021722b243000.167371755... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index 1504eb8d25aa6..004cb30b74198 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -360,7 +360,7 @@ static bool strict_sigaltstack_size __ro_after_init = false;
static int __init strict_sas_size(char *arg) { - return kstrtobool(arg, &strict_sigaltstack_size); + return kstrtobool(arg, &strict_sigaltstack_size) == 0; } __setup("strict_sas_size", strict_sas_size);
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 3bf0ea99e2e32b0335106b86d84404cc85bcd113 ]
Drop msm8976-specific defines, which duplicate generic ones.
Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976") Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Link: https://lore.kernel.org/r/20230101194034.831222-6-dmitry.baryshkov@linaro.or... Signed-off-by: Daniel Lezcano daniel.lezcano@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/thermal/qcom/tsens-v1.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c index 1d7f8a80bd13a..a795b08bb017e 100644 --- a/drivers/thermal/qcom/tsens-v1.c +++ b/drivers/thermal/qcom/tsens-v1.c @@ -78,11 +78,6 @@
#define MSM8976_CAL_SEL_MASK 0x3
-#define MSM8976_CAL_DEGC_PT1 30 -#define MSM8976_CAL_DEGC_PT2 120 -#define MSM8976_SLOPE_FACTOR 1000 -#define MSM8976_SLOPE_DEFAULT 3200 - /* eeprom layout data for qcs404/405 (v1) */ #define BASE0_MASK 0x000007f8 #define BASE1_MASK 0x0007f800 @@ -160,8 +155,8 @@ static void compute_intercept_slope_8976(struct tsens_priv *priv, priv->sensor[10].slope = 3286;
for (i = 0; i < priv->num_sensors; i++) { - priv->sensor[i].offset = (p1[i] * MSM8976_SLOPE_FACTOR) - - (MSM8976_CAL_DEGC_PT1 * + priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) - + (CAL_DEGC_PT1 * priv->sensor[i].slope); } }
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit a7d3006be5ca7b04e4b84b5ceaae55a700e511bd ]
Tsens driver mentions that msm8976 data should be used for both msm8976 and msm8956 SoCs. This is not quite correct, as according to the vendor kernels, msm8976 should use standard slope values (3200), while msm8956 really uses the slope values found in the driver.
Add separate compatibility string for msm8956, move slope value overrides to the corresponding init function and use the standard compute_intercept_slope() function for both platforms.
Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976") Cc: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Link: https://lore.kernel.org/r/20230101194034.831222-7-dmitry.baryshkov@linaro.or... Signed-off-by: Daniel Lezcano daniel.lezcano@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/thermal/qcom/tsens-v1.c | 56 ++++++++++++++++++--------------- drivers/thermal/qcom/tsens.c | 3 ++ drivers/thermal/qcom/tsens.h | 2 +- 3 files changed, 34 insertions(+), 27 deletions(-)
diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c index a795b08bb017e..9c443a2fb32ca 100644 --- a/drivers/thermal/qcom/tsens-v1.c +++ b/drivers/thermal/qcom/tsens-v1.c @@ -137,30 +137,6 @@ #define CAL_SEL_MASK 7 #define CAL_SEL_SHIFT 0
-static void compute_intercept_slope_8976(struct tsens_priv *priv, - u32 *p1, u32 *p2, u32 mode) -{ - int i; - - priv->sensor[0].slope = 3313; - priv->sensor[1].slope = 3275; - priv->sensor[2].slope = 3320; - priv->sensor[3].slope = 3246; - priv->sensor[4].slope = 3279; - priv->sensor[5].slope = 3257; - priv->sensor[6].slope = 3234; - priv->sensor[7].slope = 3269; - priv->sensor[8].slope = 3255; - priv->sensor[9].slope = 3239; - priv->sensor[10].slope = 3286; - - for (i = 0; i < priv->num_sensors; i++) { - priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) - - (CAL_DEGC_PT1 * - priv->sensor[i].slope); - } -} - static int calibrate_v1(struct tsens_priv *priv) { u32 base0 = 0, base1 = 0; @@ -286,7 +262,7 @@ static int calibrate_8976(struct tsens_priv *priv) break; }
- compute_intercept_slope_8976(priv, p1, p2, mode); + compute_intercept_slope(priv, p1, p2, mode); kfree(qfprom_cdata);
return 0; @@ -360,6 +336,22 @@ static const struct reg_field tsens_v1_regfields[MAX_REGFIELDS] = { [TRDY] = REG_FIELD(TM_TRDY_OFF, 0, 0), };
+static int __init init_8956(struct tsens_priv *priv) { + priv->sensor[0].slope = 3313; + priv->sensor[1].slope = 3275; + priv->sensor[2].slope = 3320; + priv->sensor[3].slope = 3246; + priv->sensor[4].slope = 3279; + priv->sensor[5].slope = 3257; + priv->sensor[6].slope = 3234; + priv->sensor[7].slope = 3269; + priv->sensor[8].slope = 3255; + priv->sensor[9].slope = 3239; + priv->sensor[10].slope = 3286; + + return init_common(priv); +} + static const struct tsens_ops ops_generic_v1 = { .init = init_common, .calibrate = calibrate_v1, @@ -372,13 +364,25 @@ struct tsens_plat_data data_tsens_v1 = { .fields = tsens_v1_regfields, };
+static const struct tsens_ops ops_8956 = { + .init = init_8956, + .calibrate = calibrate_8976, + .get_temp = get_temp_tsens_valid, +}; + +struct tsens_plat_data data_8956 = { + .num_sensors = 11, + .ops = &ops_8956, + .feat = &tsens_v1_feat, + .fields = tsens_v1_regfields, +}; + static const struct tsens_ops ops_8976 = { .init = init_common, .calibrate = calibrate_8976, .get_temp = get_temp_tsens_valid, };
-/* Valid for both MSM8956 and MSM8976. */ struct tsens_plat_data data_8976 = { .num_sensors = 11, .ops = &ops_8976, diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c index b5b136ff323f9..b191e19df93dc 100644 --- a/drivers/thermal/qcom/tsens.c +++ b/drivers/thermal/qcom/tsens.c @@ -983,6 +983,9 @@ static const struct of_device_id tsens_table[] = { }, { .compatible = "qcom,msm8939-tsens", .data = &data_8939, + }, { + .compatible = "qcom,msm8956-tsens", + .data = &data_8956, }, { .compatible = "qcom,msm8960-tsens", .data = &data_8960, diff --git a/drivers/thermal/qcom/tsens.h b/drivers/thermal/qcom/tsens.h index 899af128855f7..7dd5fc2468945 100644 --- a/drivers/thermal/qcom/tsens.h +++ b/drivers/thermal/qcom/tsens.h @@ -594,7 +594,7 @@ extern struct tsens_plat_data data_8960; extern struct tsens_plat_data data_8916, data_8939, data_8974, data_9607;
/* TSENS v1 targets */ -extern struct tsens_plat_data data_tsens_v1, data_8976; +extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956;
/* TSENS v2 targets */ extern struct tsens_plat_data data_8996, data_ipq8074, data_tsens_v2;
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 5aec3b035e0cbf3f042c2a03d654e5ad6748feb7 ]
According to the vendor kernels (msm-3.10, 3.14 and 3.18), msm8939 uses non-standard slope values for calibrating the sensors. Fill them accordingly.
Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939") Cc: Bryan O'Donoghue bryan.odonoghue@linaro.org Cc: Shawn Guo shawn.guo@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Acked-by: Shawn Guo shawn.guo@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Reviewed-by: Bryan O'Donoghue bryan.odonoghue@linaro.org Link: https://lore.kernel.org/r/20230101194034.831222-8-dmitry.baryshkov@linaro.or... Signed-off-by: Daniel Lezcano daniel.lezcano@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/thermal/qcom/tsens-v0_1.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c index 04d012e4f7288..af2659037f010 100644 --- a/drivers/thermal/qcom/tsens-v0_1.c +++ b/drivers/thermal/qcom/tsens-v0_1.c @@ -534,6 +534,21 @@ static int calibrate_9607(struct tsens_priv *priv) return 0; }
+static int __init init_8939(struct tsens_priv *priv) { + priv->sensor[0].slope = 2911; + priv->sensor[1].slope = 2789; + priv->sensor[2].slope = 2906; + priv->sensor[3].slope = 2763; + priv->sensor[4].slope = 2922; + priv->sensor[5].slope = 2867; + priv->sensor[6].slope = 2833; + priv->sensor[7].slope = 2838; + priv->sensor[8].slope = 2840; + priv->sensor[9].slope = 2852; + + return init_common(priv); +} + /* v0.1: 8916, 8939, 8974, 9607 */
static struct tsens_features tsens_v0_1_feat = { @@ -599,7 +614,7 @@ struct tsens_plat_data data_8916 = { };
static const struct tsens_ops ops_8939 = { - .init = init_common, + .init = init_8939, .calibrate = calibrate_8939, .get_temp = get_temp_common, };
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 903238a33c116edf5f64f7a3fd246e6169cccfa6 ]
On msm8939 last (hwid=10) sensor was added in the hw revision 3.0. Calibration data for it was placed outside of the main calibration data blob, so it is not accessible by the current blob-parsing code.
Moreover data for the sensor's p2 is not contiguous in the fuses. This makes it hard to use nvmem_cell API to parse calibration data in a generic way.
Since the sensor doesn't seem to be actually used by the existing hardware, disable the sensor for now.
Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939") Cc: Bryan O'Donoghue bryan.odonoghue@linaro.org Cc: Shawn Guo shawn.guo@linaro.org Acked-by: Shawn Guo shawn.guo@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Reviewed-by: Bryan O'Donoghue bryan.odonoghue@linaro.org Link: https://lore.kernel.org/r/20230101194034.831222-9-dmitry.baryshkov@linaro.or... Signed-off-by: Daniel Lezcano daniel.lezcano@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/thermal/qcom/tsens-v0_1.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c index af2659037f010..3158f13c54305 100644 --- a/drivers/thermal/qcom/tsens-v0_1.c +++ b/drivers/thermal/qcom/tsens-v0_1.c @@ -285,7 +285,7 @@ static int calibrate_8939(struct tsens_priv *priv) u32 p1[10], p2[10]; int mode = 0; u32 *qfprom_cdata; - u32 cdata[6]; + u32 cdata[4];
qfprom_cdata = (u32 *)qfprom_read(priv->dev, "calib"); if (IS_ERR(qfprom_cdata)) @@ -296,8 +296,6 @@ static int calibrate_8939(struct tsens_priv *priv) cdata[1] = qfprom_cdata[13]; cdata[2] = qfprom_cdata[0]; cdata[3] = qfprom_cdata[1]; - cdata[4] = qfprom_cdata[22]; - cdata[5] = qfprom_cdata[21];
mode = (cdata[0] & MSM8939_CAL_SEL_MASK) >> MSM8939_CAL_SEL_SHIFT; dev_dbg(priv->dev, "calibration mode is %d\n", mode); @@ -314,8 +312,6 @@ static int calibrate_8939(struct tsens_priv *priv) p2[6] = (cdata[2] & MSM8939_S6_P2_MASK) >> MSM8939_S6_P2_SHIFT; p2[7] = (cdata[3] & MSM8939_S7_P2_MASK) >> MSM8939_S7_P2_SHIFT; p2[8] = (cdata[3] & MSM8939_S8_P2_MASK) >> MSM8939_S8_P2_SHIFT; - p2[9] = (cdata[4] & MSM8939_S9_P2_MASK_0_4) >> MSM8939_S9_P2_SHIFT_0_4; - p2[9] |= ((cdata[5] & MSM8939_S9_P2_MASK_5) >> MSM8939_S9_P2_SHIFT_5) << 5; for (i = 0; i < priv->num_sensors; i++) p2[i] = (base1 + p2[i]) << 2; fallthrough; @@ -331,7 +327,6 @@ static int calibrate_8939(struct tsens_priv *priv) p1[6] = (cdata[2] & MSM8939_S6_P1_MASK) >> MSM8939_S6_P1_SHIFT; p1[7] = (cdata[3] & MSM8939_S7_P1_MASK) >> MSM8939_S7_P1_SHIFT; p1[8] = (cdata[3] & MSM8939_S8_P1_MASK) >> MSM8939_S8_P1_SHIFT; - p1[9] = (cdata[4] & MSM8939_S9_P1_MASK) >> MSM8939_S9_P1_SHIFT; for (i = 0; i < priv->num_sensors; i++) p1[i] = ((base0) + p1[i]) << 2; break; @@ -544,7 +539,7 @@ static int __init init_8939(struct tsens_priv *priv) { priv->sensor[6].slope = 2833; priv->sensor[7].slope = 2838; priv->sensor[8].slope = 2840; - priv->sensor[9].slope = 2852; + /* priv->sensor[9].slope = 2852; */
return init_common(priv); } @@ -620,9 +615,9 @@ static const struct tsens_ops ops_8939 = { };
struct tsens_plat_data data_8939 = { - .num_sensors = 10, + .num_sensors = 9, .ops = &ops_8939, - .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, 10 }, + .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, /* 10 */ },
.feat = &tsens_v0_1_feat, .fields = tsens_v0_1_regfields,
From: Zong-Zhe Yang kevin_yang@realtek.com
[ Upstream commit 4a0e218cc9c42d1903ade8b5a371dcf48cf918c5 ]
Do `kfree_skb(new)` before `goto out` to prevent potential leak.
Fixes: 895907779752 ("rtw89: 8852a: add ieee80211_ops::hw_scan") Signed-off-by: Zong-Zhe Yang kevin_yang@realtek.com Signed-off-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230103141054.17372-1-pkshih@realtek.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw89/fw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index de1f23779fc62..3b7af8faca505 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -2665,8 +2665,10 @@ static int rtw89_append_probe_req_ie(struct rtw89_dev *rtwdev,
list_add_tail(&info->list, &scan_info->pkt_list[band]); ret = rtw89_fw_h2c_add_pkt_offload(rtwdev, &info->id, new); - if (ret) + if (ret) { + kfree_skb(new); goto out; + }
kfree_skb(new); }
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit ed9e6166eb0984b718facb7ca59296098cc3aa64 ]
Add check for the return value of alloc_workqueue since it may return NULL pointer. Moreover, add destroy_workqueue when rtw89_load_firmware fails.
Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Acked-by: Ping-Ke Shih pkshih@realtek.com Reviewed-by: Leon Romanovsky leonro@nvidia.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230104142901.1611-1-jiasheng@iscas.ac.cn Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw89/core.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c index 931aff8b5dc95..e99eccf11c762 100644 --- a/drivers/net/wireless/realtek/rtw89/core.c +++ b/drivers/net/wireless/realtek/rtw89/core.c @@ -3124,6 +3124,8 @@ int rtw89_core_init(struct rtw89_dev *rtwdev) INIT_DELAYED_WORK(&rtwdev->cfo_track_work, rtw89_phy_cfo_track_work); INIT_DELAYED_WORK(&rtwdev->forbid_ba_work, rtw89_forbid_ba_work); rtwdev->txq_wq = alloc_workqueue("rtw89_tx_wq", WQ_UNBOUND | WQ_HIGHPRI, 0); + if (!rtwdev->txq_wq) + return -ENOMEM; spin_lock_init(&rtwdev->ba_lock); spin_lock_init(&rtwdev->rpwm_lock); mutex_init(&rtwdev->mutex); @@ -3149,6 +3151,7 @@ int rtw89_core_init(struct rtw89_dev *rtwdev) ret = rtw89_load_firmware(rtwdev); if (ret) { rtw89_warn(rtwdev, "no firmware loaded\n"); + destroy_workqueue(rtwdev->txq_wq); return ret; } rtw89_ser_init(rtwdev);
From: Bitterblue Smith rtl8821cerfe2@gmail.com
[ Upstream commit b39f662ce1648db0b9de32e6a849b098480793cb ]
The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?) when it's connected to a bluetooth audio device. The busy bluetooth traffic generates lots of C2H (card to host) messages, which are not freed correctly.
To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback() inside the loop where skb_dequeue() is called.
The RTL8192EU leaks memory because the C2H messages are added to the queue and left there forever. (This was fine in the past because it probably wasn't sending any C2H messages until commit e542e66b7c2e ("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit it sends a C2H message when the TX rate changes.)
To fix this, delete the check for rf_paths > 1 and the goto. Let the function process the C2H messages from RTL8192EU like the ones from the other chips.
Theoretically the RTL8188FU could also leak like RTL8723BU, but it most likely doesn't send C2H messages frequently enough.
This change was tested with RTL8723BU by Erhard F. I tested it with RTL8188FU and RTL8192EU.
Reported-by: Erhard F. erhard_f@mailbox.org Tested-by: Erhard F. erhard_f@mailbox.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=215197 Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna") Signed-off-by: Bitterblue Smith rtl8821cerfe2@gmail.com Reviewed-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/03b099c1-c671-d252-36f4-57b70d721f9d@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c index c8b82c5810111..75d393b5dbe5e 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -5552,9 +5552,6 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) btcoex = &priv->bt_coex; rarpt = &priv->ra_report;
- if (priv->rf_paths > 1) - goto out; - while (!skb_queue_empty(&priv->c2hcmd_queue)) { skb = skb_dequeue(&priv->c2hcmd_queue);
@@ -5587,10 +5584,9 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) default: break; } - }
-out: - dev_kfree_skb(skb); + dev_kfree_skb(skb); + } }
static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv,
From: Alexey Kodanev aleksei.kodanev@bell-sw.com
[ Upstream commit 1e346cbb096a5351a637ec1992beffbf330547f0 ]
There is currently no return check for writing an authentication type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like it was accidentally skipped.
This patch adds a return check similar to the other checks in __orinoco_hw_setup_enc() for hermes_write_wordrec().
Detected using the static analysis tool - Svace.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Alexey Kodanev aleksei.kodanev@bell-sw.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221227133306.201356-1-aleksei.kodanev@bell-sw.co... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/intersil/orinoco/hw.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/net/wireless/intersil/orinoco/hw.c b/drivers/net/wireless/intersil/orinoco/hw.c index 0aea35c9c11c7..4fcca08e50de2 100644 --- a/drivers/net/wireless/intersil/orinoco/hw.c +++ b/drivers/net/wireless/intersil/orinoco/hw.c @@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv) err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFAUTHENTICATION_AGERE, auth_flag); + if (err) + return err; } err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFWEPENABLED_AGERE,
From: Martin Blumenstingl martin.blumenstingl@googlemail.com
[ Upstream commit 313f6dc7c5ed723d0c5691553eff4c0090f16bb8 ]
USB and (upcoming) SDIO support may sleep in the read/write handlers. Make rtw_watch_dog_work() use rtw_iterate_vifs() to prevent "scheduling while atomic" or "Voluntary context switch within RCU read-side critical section!" warnings when accessing the registers using an SDIO card (which is where this issue has been spotted in the real world but it also affects USB cards).
Fixes: 78d5bf925f30 ("wifi: rtw88: iterate over vif/sta list non-atomically") Suggested-by: Ping-Ke Shih pkshih@realtek.com Reviewed-by: Ping-Ke Shih pkshih@realtek.com Tested-by: Sascha Hauer s.hauer@pengutronix.de Signed-off-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230108211324.442823-3-martin.blumenstingl@google... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw88/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c index 888427cf3bdf9..b2e78737bd5d0 100644 --- a/drivers/net/wireless/realtek/rtw88/main.c +++ b/drivers/net/wireless/realtek/rtw88/main.c @@ -241,8 +241,10 @@ static void rtw_watch_dog_work(struct work_struct *work) rtw_phy_dynamic_mechanism(rtwdev);
data.rtwdev = rtwdev; - /* use atomic version to avoid taking local->iflist_mtx mutex */ - rtw_iterate_vifs_atomic(rtwdev, rtw_vif_watch_dog_iter, &data); + /* rtw_iterate_vifs internally uses an atomic iterator which is needed + * to avoid taking local->iflist_mtx mutex + */ + rtw_iterate_vifs(rtwdev, rtw_vif_watch_dog_iter, &data);
/* fw supports only one station associated to enter lps, if there are * more than two stations associated to the AP, then we can not enter
From: Martin Blumenstingl martin.blumenstingl@googlemail.com
[ Upstream commit 2931978cd74f4a643deeea5b211523001d95aa44 ]
USB and (upcoming) SDIO support may sleep in the read/write handlers. Use non-atomic rtw_iterate_stas() in rtw_ra_mask_info_update() because the iterator function rtw_ra_mask_info_update_iter() needs to read and write registers from within rtw_update_sta_info(). Using the non-atomic iterator ensures that we can sleep during USB and SDIO register reads and writes. This fixes "scheduling while atomic" or "Voluntary context switch within RCU read-side critical section!" warnings as seen by SDIO card users (but it also affects USB cards).
Fixes: 78d5bf925f30 ("wifi: rtw88: iterate over vif/sta list non-atomically") Suggested-by: Ping-Ke Shih pkshih@realtek.com Reviewed-by: Ping-Ke Shih pkshih@realtek.com Tested-by: Sascha Hauer s.hauer@pengutronix.de Signed-off-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230108211324.442823-4-martin.blumenstingl@google... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw88/mac80211.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c index 776a9a9884b5d..3b92ac611d3fd 100644 --- a/drivers/net/wireless/realtek/rtw88/mac80211.c +++ b/drivers/net/wireless/realtek/rtw88/mac80211.c @@ -737,7 +737,7 @@ static void rtw_ra_mask_info_update(struct rtw_dev *rtwdev, br_data.rtwdev = rtwdev; br_data.vif = vif; br_data.mask = mask; - rtw_iterate_stas_atomic(rtwdev, rtw_ra_mask_info_update_iter, &br_data); + rtw_iterate_stas(rtwdev, rtw_ra_mask_info_update_iter, &br_data); }
static int rtw_ops_set_bitrate_mask(struct ieee80211_hw *hw, @@ -746,7 +746,9 @@ static int rtw_ops_set_bitrate_mask(struct ieee80211_hw *hw, { struct rtw_dev *rtwdev = hw->priv;
+ mutex_lock(&rtwdev->mutex); rtw_ra_mask_info_update(rtwdev, vif, mask); + mutex_unlock(&rtwdev->mutex);
return 0; }
From: Viorel Suman viorel.suman@nxp.com
[ Upstream commit 4b26b7c9cdefdcb478047c30901d2379ef9e50fc ]
The minimal resource ID is 0: IMX_SC_R_AP_0=0, so fix the loop condition. Aside of this - constify the array.
Fixes: 31fd4b9db13b ("thermal/drivers/imx_sc: Rely on the platform data to get the resource id") Signed-off-by: Viorel Suman viorel.suman@nxp.com Reviewed-by: Dong Aisheng Aisheng.dong@nxp.com Link: https://lore.kernel.org/r/20230117091956.61729-1-viorel.suman@oss.nxp.com Signed-off-by: Daniel Lezcano daniel.lezcano@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/thermal/imx_sc_thermal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/thermal/imx_sc_thermal.c b/drivers/thermal/imx_sc_thermal.c index 4df925e3a80bd..dfadb03580ae1 100644 --- a/drivers/thermal/imx_sc_thermal.c +++ b/drivers/thermal/imx_sc_thermal.c @@ -88,7 +88,7 @@ static int imx_sc_thermal_probe(struct platform_device *pdev) if (!resource_id) return -EINVAL;
- for (i = 0; resource_id[i] > 0; i++) { + for (i = 0; resource_id[i] >= 0; i++) {
sensor = devm_kzalloc(&pdev->dev, sizeof(*sensor), GFP_KERNEL); if (!sensor) @@ -127,7 +127,7 @@ static int imx_sc_thermal_probe(struct platform_device *pdev) return 0; }
-static int imx_sc_sensors[] = { IMX_SC_R_SYSTEM, IMX_SC_R_PMIC_0, -1 }; +static const int imx_sc_sensors[] = { IMX_SC_R_SYSTEM, IMX_SC_R_PMIC_0, -1 };
static const struct of_device_id imx_sc_thermal_table[] = { { .compatible = "fsl,imx-sc-thermal", .data = imx_sc_sensors },
From: Fedor Pchelkin pchelkin@ispras.ru
[ Upstream commit 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 ]
It is stated that ath9k_htc_rx_msg() either frees the provided skb or passes its management to another callback function. However, the skb is not freed in case there is no another callback function, and Syzkaller was able to cause a memory leak. Also minor comment fix.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Reported-by: syzbot+e008dccab31bd3647609@syzkaller.appspotmail.com Reported-by: syzbot+6692c72009680f7c4eb2@syzkaller.appspotmail.com Signed-off-by: Fedor Pchelkin pchelkin@ispras.ru Signed-off-by: Alexey Khoroshilov khoroshilov@ispras.ru Acked-by: Toke Høiland-Jørgensen toke@toke.dk Signed-off-by: Kalle Valo quic_kvalo@quicinc.com Link: https://lore.kernel.org/r/20230104123546.51427-1-pchelkin@ispras.ru Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index ca05b07a45e67..fe62ff668f757 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle, * HTC Messages are handled directly here and the obtained SKB * is freed. * - * Service messages (Data, WMI) passed to the corresponding + * Service messages (Data, WMI) are passed to the corresponding * endpoint RX handlers, which have to free the SKB. */ void ath9k_htc_rx_msg(struct htc_target *htc_handle, @@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, if (endpoint->ep_callbacks.rx) endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv, skb, epid); + else + goto invalid; } }
From: Fedor Pchelkin pchelkin@ispras.ru
[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ]
Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue.
The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 6ce708f54cc8 ("ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream") Fixes: 44b23b488d44 ("ath9k: hif_usb: Reduce indent 1 column") Reported-by: syzbot+e9632e3eb038d93d6bc6@syzkaller.appspotmail.com Signed-off-by: Fedor Pchelkin pchelkin@ispras.ru Signed-off-by: Alexey Khoroshilov khoroshilov@ispras.ru Acked-by: Toke Høiland-Jørgensen toke@toke.dk Signed-off-by: Kalle Valo quic_kvalo@quicinc.com Link: https://lore.kernel.org/r/20230104123615.51511-1-pchelkin@ispras.ru Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ath/ath9k/hif_usb.c | 31 +++++++++++++++++------- 1 file changed, 22 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index 1a2e0c7eeb023..de6c0824c9cab 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -561,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, memcpy(ptr, skb->data, rx_remain_len);
rx_pkt_len += rx_remain_len; - hif_dev->rx_remain_len = 0; skb_put(remain_skb, rx_pkt_len);
skb_pool[pool_index++] = remain_skb; - + hif_dev->remain_skb = NULL; + hif_dev->rx_remain_len = 0; } else { index = rx_remain_len; } @@ -584,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, pkt_len = get_unaligned_le16(ptr + index); pkt_tag = get_unaligned_le16(ptr + index + 2);
+ /* It is supposed that if we have an invalid pkt_tag or + * pkt_len then the whole input SKB is considered invalid + * and dropped; the associated packets already in skb_pool + * are dropped, too. + */ if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) { RX_STAT_INC(hif_dev, skb_dropped); - return; + goto invalid_pkt; }
if (pkt_len > 2 * MAX_RX_BUF_SIZE) { dev_err(&hif_dev->udev->dev, "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); RX_STAT_INC(hif_dev, skb_dropped); - return; + goto invalid_pkt; }
pad_len = 4 - (pkt_len & 0x3); @@ -605,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
if (index > MAX_RX_BUF_SIZE) { spin_lock(&hif_dev->rx_lock); - hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE; - hif_dev->rx_transfer_len = - MAX_RX_BUF_SIZE - chk_idx - 4; - hif_dev->rx_pad_len = pad_len; - nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC); if (!nskb) { dev_err(&hif_dev->udev->dev, @@ -617,6 +617,12 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, spin_unlock(&hif_dev->rx_lock); goto err; } + + hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE; + hif_dev->rx_transfer_len = + MAX_RX_BUF_SIZE - chk_idx - 4; + hif_dev->rx_pad_len = pad_len; + skb_reserve(nskb, 32); RX_STAT_INC(hif_dev, skb_allocated);
@@ -654,6 +660,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, skb_pool[i]->len, USB_WLAN_RX_PIPE); RX_STAT_INC(hif_dev, skb_completed); } + return; +invalid_pkt: + for (i = 0; i < pool_index; i++) { + dev_kfree_skb_any(skb_pool[i]); + RX_STAT_INC(hif_dev, skb_dropped); + } + return; }
static void ath9k_hif_usb_rx_cb(struct urb *urb)
From: Minsuk Kang linuxlovemin@yonsei.ac.kr
[ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ]
Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wmi_cmd(). The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->last_seq_id to 0 when a timeout occurred.
Found by a modified version of syzkaller.
BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx Write of size 4 Call Trace: memcpy ath9k_wmi_ctrl_rx ath9k_htc_rx_msg ath9k_hif_usb_reg_in_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer call_timer_fn run_timer_softirq __do_softirq irq_exit_rcu sysvec_apic_timer_interrupt
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Minsuk Kang linuxlovemin@yonsei.ac.kr Acked-by: Toke Høiland-Jørgensen toke@toke.dk Signed-off-by: Kalle Valo quic_kvalo@quicinc.com Link: https://lore.kernel.org/r/20230104124130.10996-1-linuxlovemin@yonsei.ac.kr Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ath/ath9k/wmi.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c index f315c54bd3ac0..19345b8f7bfd5 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.c +++ b/drivers/net/wireless/ath/ath9k/wmi.c @@ -341,6 +341,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, if (!time_left) { ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", wmi_cmd_to_name(cmd_id)); + wmi->last_seq_id = 0; mutex_unlock(&wmi->op_mutex); return -ETIMEDOUT; }
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit ed3f83b3459a67a3ab9d806490ac304b567b1c2d ]
crypto_alloc_shash() allocates resources, which should be released by crypto_free_shash(). When ath11k_peer_find() fails, there has memory leak. Add missing crypto_free_shash() to fix this.
Fixes: 243874c64c81 ("ath11k: handle RX fragments") Signed-off-by: Miaoqian Lin linmq006@gmail.com Reviewed-by: Leon Romanovsky leonro@nvidia.com Signed-off-by: Kalle Valo quic_kvalo@quicinc.com Link: https://lore.kernel.org/r/20230102081142.3937570-1-linmq006@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index c5a4c34d77499..0c53d88293eb7 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -3126,6 +3126,7 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id if (!peer) { ath11k_warn(ab, "failed to find the peer to set up fragment info\n"); spin_unlock_bh(&ab->base_lock); + crypto_free_shash(tfm); return -ENOENT; }
From: Shivani Baranwal quic_shivbara@quicinc.com
[ Upstream commit df4969ca135b9b3b2c38c07514aaa775112ac835 ]
The extended KCK key length check wrongly using the KEK key attribute for validation. Due to this GTK rekey offload is failing when the KCK key length is 24 bytes even though the driver advertising WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK flag. Use correct attribute to fix the same.
Fixes: 093a48d2aa4b ("cfg80211: support bigger kek/kck key length") Signed-off-by: Shivani Baranwal quic_shivbara@quicinc.com Signed-off-by: Veerendranath Jakkam quic_vjakkam@quicinc.com Link: https://lore.kernel.org/r/20221206143715.1802987-2-quic_vjakkam@quicinc.com Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 33a82ecab9d56..02b9a0280896c 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -13809,7 +13809,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) return -ERANGE; if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && - nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN)) + nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN)) return -ERANGE;
rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
From: Armin Wolf W_Armin@gmx.de
[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ]
When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later.
This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse).
Fix this by using strscpy() which ensures that the result is always NUL-terminated.
Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer") Signed-off-by: Armin Wolf W_Armin@gmx.de Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/acpi/battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index f4badcdde76e6..fb64bd217d826 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *battery,
if (element->type == ACPI_TYPE_STRING || element->type == ACPI_TYPE_BUFFER) - strncpy(ptr, element->string.pointer, 32); + strscpy(ptr, element->string.pointer, 32); else if (element->type == ACPI_TYPE_INTEGER) { strncpy(ptr, (u8 *)&element->integer.value, sizeof(u64));
From: Tiezhu Yang yangtiezhu@loongson.cn
[ Upstream commit 92afc5329a5b23d876b215b783d200352d5aaea6 ]
If CONFIG_NF_CONNTRACK=m, there are no definitions of NF_NAT_MANIP_SRC and NF_NAT_MANIP_DST in vmlinux.h, build test_bpf_nf.c failed.
$ make -C tools/testing/selftests/bpf/
CLNG-BPF [test_maps] test_bpf_nf.bpf.o progs/test_bpf_nf.c:160:42: error: use of undeclared identifier 'NF_NAT_MANIP_SRC' bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC); ^ progs/test_bpf_nf.c:163:42: error: use of undeclared identifier 'NF_NAT_MANIP_DST' bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST); ^ 2 errors generated.
Copy the definitions in include/net/netfilter/nf_nat.h to test_bpf_nf.c, in order to avoid redefinitions if CONFIG_NF_CONNTRACK=y, rename them with ___local suffix. This is similar with commit 1058b6a78db2 ("selftests/bpf: Do not fail build if CONFIG_NF_CONNTRACK=m/n").
Fixes: b06b45e82b59 ("selftests/bpf: add tests for bpf_ct_set_nat_info kfunc") Signed-off-by: Tiezhu Yang yangtiezhu@loongson.cn Acked-by: Jiri Olsa jolsa@kernel.org Tested-by: Jiri Olsa jolsa@kernel.org Acked-by: Yonghong Song yhs@fb.com Link: https://lore.kernel.org/r/1674028604-7113-1-git-send-email-yangtiezhu@loongs... Signed-off-by: Martin KaFai Lau martin.lau@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/bpf/progs/test_bpf_nf.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/test_bpf_nf.c b/tools/testing/selftests/bpf/progs/test_bpf_nf.c index 227e85e85ddaf..9fc603c9d673e 100644 --- a/tools/testing/selftests/bpf/progs/test_bpf_nf.c +++ b/tools/testing/selftests/bpf/progs/test_bpf_nf.c @@ -34,6 +34,11 @@ __be16 dport = 0; int test_exist_lookup = -ENOENT; u32 test_exist_lookup_mark = 0;
+enum nf_nat_manip_type___local { + NF_NAT_MANIP_SRC___local, + NF_NAT_MANIP_DST___local +}; + struct nf_conn;
struct bpf_ct_opts___local { @@ -58,7 +63,7 @@ int bpf_ct_change_timeout(struct nf_conn *, u32) __ksym; int bpf_ct_set_status(struct nf_conn *, u32) __ksym; int bpf_ct_change_status(struct nf_conn *, u32) __ksym; int bpf_ct_set_nat_info(struct nf_conn *, union nf_inet_addr *, - int port, enum nf_nat_manip_type) __ksym; + int port, enum nf_nat_manip_type___local) __ksym;
static __always_inline void nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32, @@ -157,10 +162,10 @@ nf_ct_test(struct nf_conn *(*lookup_fn)(void *, struct bpf_sock_tuple *, u32,
/* snat */ saddr.ip = bpf_get_prandom_u32(); - bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC); + bpf_ct_set_nat_info(ct, &saddr, sport, NF_NAT_MANIP_SRC___local); /* dnat */ daddr.ip = bpf_get_prandom_u32(); - bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST); + bpf_ct_set_nat_info(ct, &daddr, dport, NF_NAT_MANIP_DST___local);
ct_ins = bpf_ct_insert_entry(ct); if (ct_ins) {
From: Koba Ko koba.taiwan@gmail.com
[ Upstream commit 299bf602b3f92f1456aef59c6413591fb02e762a ]
The following warning appears during the CCP module re-initialization:
[ 140.965403] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:07.1/0000:03:00.2/dma/dma0chan0' [ 140.975736] CPU: 0 PID: 388 Comm: kworker/0:2 Kdump: loaded Not tainted 6.2.0-0.rc2.18.eln124.x86_64 #1 [ 140.985185] Hardware name: HPE ProLiant DL325 Gen10/ProLiant DL325 Gen10, BIOS A41 07/17/2020 [ 140.993761] Workqueue: events work_for_cpu_fn [ 140.998151] Call Trace: [ 141.000613] <TASK> [ 141.002726] dump_stack_lvl+0x33/0x46 [ 141.006415] sysfs_warn_dup.cold+0x17/0x23 [ 141.010542] sysfs_create_dir_ns+0xba/0xd0 [ 141.014670] kobject_add_internal+0xba/0x260 [ 141.018970] kobject_add+0x81/0xb0 [ 141.022395] device_add+0xdc/0x7e0 [ 141.025822] ? complete_all+0x20/0x90 [ 141.029510] __dma_async_device_channel_register+0xc9/0x130 [ 141.035119] dma_async_device_register+0x19e/0x3b0 [ 141.039943] ccp_dmaengine_register+0x334/0x3f0 [ccp] [ 141.045042] ccp5_init+0x662/0x6a0 [ccp] [ 141.049000] ? devm_kmalloc+0x40/0xd0 [ 141.052688] ccp_dev_init+0xbb/0xf0 [ccp] [ 141.056732] ? __pci_set_master+0x56/0xd0 [ 141.060768] sp_init+0x70/0x90 [ccp] [ 141.064377] sp_pci_probe+0x186/0x1b0 [ccp] [ 141.068596] local_pci_probe+0x41/0x80 [ 141.072374] work_for_cpu_fn+0x16/0x20 [ 141.076145] process_one_work+0x1c8/0x380 [ 141.080181] worker_thread+0x1ab/0x380 [ 141.083953] ? __pfx_worker_thread+0x10/0x10 [ 141.088250] kthread+0xda/0x100 [ 141.091413] ? __pfx_kthread+0x10/0x10 [ 141.095185] ret_from_fork+0x2c/0x50 [ 141.098788] </TASK> [ 141.100996] kobject_add_internal failed for dma0chan0 with -EEXIST, don't try to register things with the same name in the same directory. [ 141.113703] ccp 0000:03:00.2: ccp initialization failed
The /dma/dma0chan0 sysfs file is not removed since dma_chan object has been released in ccp_dma_release() before releasing dma device. A correct procedure would be: release dma channels first => unregister dma device => release ccp dma object.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216888 Fixes: 68dbe80f5b51 ("crypto: ccp - Release dma channels before dmaengine unrgister") Tested-by: Vladis Dronov vdronov@redhat.com Signed-off-by: Koba Ko koba.ko@canonical.com Reviewed-by: Vladis Dronov vdronov@redhat.com Acked-by: Tom Lendacky thomas.lendacky@amd.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/crypto/ccp/ccp-dmaengine.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c index 9f753cb4f5f18..b386a7063818b 100644 --- a/drivers/crypto/ccp/ccp-dmaengine.c +++ b/drivers/crypto/ccp/ccp-dmaengine.c @@ -642,14 +642,26 @@ static void ccp_dma_release(struct ccp_device *ccp) chan = ccp->ccp_dma_chan + i; dma_chan = &chan->dma_chan;
- if (dma_chan->client_count) - dma_release_channel(dma_chan); - tasklet_kill(&chan->cleanup_tasklet); list_del_rcu(&dma_chan->device_node); } }
+static void ccp_dma_release_channels(struct ccp_device *ccp) +{ + struct ccp_dma_chan *chan; + struct dma_chan *dma_chan; + unsigned int i; + + for (i = 0; i < ccp->cmd_q_count; i++) { + chan = ccp->ccp_dma_chan + i; + dma_chan = &chan->dma_chan; + + if (dma_chan->client_count) + dma_release_channel(dma_chan); + } +} + int ccp_dmaengine_register(struct ccp_device *ccp) { struct ccp_dma_chan *chan; @@ -770,8 +782,9 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) if (!dmaengine) return;
- ccp_dma_release(ccp); + ccp_dma_release_channels(ccp); dma_async_device_unregister(dma_dev); + ccp_dma_release(ccp);
kmem_cache_destroy(ccp->dma_desc_cache); kmem_cache_destroy(ccp->dma_cmd_cache);
From: Herbert Xu herbert@gondor.apana.org.au
[ Upstream commit b5a772adf45a32c68bef28e60621f12617161556 ]
As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request.
However, as the caller of essiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template...") Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Acked-by: Ard Biesheuvel ardb@kernel.org Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- crypto/essiv.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/crypto/essiv.c b/crypto/essiv.c index e33369df90344..307eba74b901e 100644 --- a/crypto/essiv.c +++ b/crypto/essiv.c @@ -171,7 +171,12 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err) struct aead_request *req = areq->data; struct essiv_aead_request_ctx *rctx = aead_request_ctx(req);
+ if (err == -EINPROGRESS) + goto out; + kfree(rctx->assoc); + +out: aead_request_complete(req, err); }
@@ -247,7 +252,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) err = enc ? crypto_aead_encrypt(subreq) : crypto_aead_decrypt(subreq);
- if (rctx->assoc && err != -EINPROGRESS) + if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY) kfree(rctx->assoc); return err; }
From: Herbert Xu herbert@gondor.apana.org.au
[ Upstream commit 32e62025e5e52fbe4812ef044759de7010b15dbc ]
As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request.
However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
Fixes: 0a270321dbf9 ("[CRYPTO] seqiv: Add Sequence Number IV Generator") Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- crypto/seqiv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/seqiv.c b/crypto/seqiv.c index 0899d527c2845..b1bcfe537daf1 100644 --- a/crypto/seqiv.c +++ b/crypto/seqiv.c @@ -23,7 +23,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err) struct aead_request *subreq = aead_request_ctx(req); struct crypto_aead *geniv;
- if (err == -EINPROGRESS) + if (err == -EINPROGRESS || err == -EBUSY) return;
if (err)
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 1b6599f741a4525ca761ecde46e5885ff1e6ba58 ]
In the error path after calling dev_set_name(), the device name is leaked. To fix this, calling dev_set_name() before device_register(), and call put_device() if it returns error.
All the resources is released in powercap_release(), so it can return from powercap_register_zone() directly.
Fixes: 75d2364ea0ca ("PowerCap: Add class driver") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/powercap/powercap_sys.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c index 1f968353d4799..e180dee0f83d0 100644 --- a/drivers/powercap/powercap_sys.c +++ b/drivers/powercap/powercap_sys.c @@ -530,9 +530,6 @@ struct powercap_zone *powercap_register_zone( power_zone->name = kstrdup(name, GFP_KERNEL); if (!power_zone->name) goto err_name_alloc; - dev_set_name(&power_zone->dev, "%s:%x", - dev_name(power_zone->dev.parent), - power_zone->id); power_zone->constraints = kcalloc(nr_constraints, sizeof(*power_zone->constraints), GFP_KERNEL); @@ -555,9 +552,16 @@ struct powercap_zone *powercap_register_zone( power_zone->dev_attr_groups[0] = &power_zone->dev_zone_attr_group; power_zone->dev_attr_groups[1] = NULL; power_zone->dev.groups = power_zone->dev_attr_groups; + dev_set_name(&power_zone->dev, "%s:%x", + dev_name(power_zone->dev.parent), + power_zone->id); result = device_register(&power_zone->dev); - if (result) - goto err_dev_ret; + if (result) { + put_device(&power_zone->dev); + mutex_unlock(&control_type->lock); + + return ERR_PTR(result); + }
control_type->nr_zones++; mutex_unlock(&control_type->lock);
From: Kumar Kartikeya Dwivedi memxor@gmail.com
[ Upstream commit d6fefa1105dacc8a742cdcf2f4bfb501c9e61349 ]
The root of the problem is missing liveness marking for STACK_DYNPTR slots. This leads to all kinds of problems inside stacksafe.
The verifier by default inside stacksafe ignores spilled_ptr in stack slots which do not have REG_LIVE_READ marks. Since this is being checked in the 'old' explored state, it must have already done clean_live_states for this old bpf_func_state. Hence, it won't be receiving any more liveness marks from to be explored insns (it has received REG_LIVE_DONE marking from liveness point of view).
What this means is that verifier considers that it's safe to not compare the stack slot if was never read by children states. While liveness marks are usually propagated correctly following the parentage chain for spilled registers (SCALAR_VALUE and PTR_* types), the same is not the case for STACK_DYNPTR.
clean_live_states hence simply rewrites these stack slots to the type STACK_INVALID since it sees no REG_LIVE_READ marks.
The end result is that we will never see STACK_DYNPTR slots in explored state. Even if verifier was conservatively matching !REG_LIVE_READ slots, very next check continuing the stacksafe loop on seeing STACK_INVALID would again prevent further checks.
Now as long as verifier stores an explored state which we can compare to when reaching a pruning point, we can abuse this bug to make verifier prune search for obviously unsafe paths using STACK_DYNPTR slots thinking they are never used hence safe.
Doing this in unprivileged mode is a bit challenging. add_new_state is only set when seeing BPF_F_TEST_STATE_FREQ (which requires privileges) or when jmps_processed difference is >= 2 and insn_processed difference is >= 8. So coming up with the unprivileged case requires a little more work, but it is still totally possible. The test case being discussed below triggers the heuristic even in unprivileged mode.
However, it no longer works since commit 8addbfc7b308 ("bpf: Gate dynptr API behind CAP_BPF").
Let's try to study the test step by step.
Consider the following program (C style BPF ASM):
0 r0 = 0; 1 r6 = &ringbuf_map; 3 r1 = r6; 4 r2 = 8; 5 r3 = 0; 6 r4 = r10; 7 r4 -= -16; 8 call bpf_ringbuf_reserve_dynptr; 9 if r0 == 0 goto pc+1; 10 goto pc+1; 11 *(r10 - 16) = 0xeB9F; 12 r1 = r10; 13 r1 -= -16; 14 r2 = 0; 15 call bpf_ringbuf_discard_dynptr; 16 r0 = 0; 17 exit;
We know that insn 12 will be a pruning point, hence if we force add_new_state for it, it will first verify the following path as safe in straight line exploration: 0 1 3 4 5 6 7 8 9 -> 10 -> (12) 13 14 15 16 17
Then, when we arrive at insn 12 from the following path: 0 1 3 4 5 6 7 8 9 -> 11 (12)
We will find a state that has been verified as safe already at insn 12. Since register state is same at this point, regsafe will pass. Next, in stacksafe, for spi = 0 and spi = 1 (location of our dynptr) is skipped seeing !REG_LIVE_READ. The rest matches, so stacksafe returns true. Next, refsafe is also true as reference state is unchanged in both states.
The states are considered equivalent and search is pruned.
Hence, we are able to construct a dynptr with arbitrary contents and use the dynptr API to operate on this arbitrary pointer and arbitrary size + offset.
To fix this, first define a mark_dynptr_read function that propagates liveness marks whenever a valid initialized dynptr is accessed by dynptr helpers. REG_LIVE_WRITTEN is marked whenever we initialize an uninitialized dynptr. This is done in mark_stack_slots_dynptr. It allows screening off mark_reg_read and not propagating marks upwards from that point.
This ensures that we either set REG_LIVE_READ64 on both dynptr slots, or none, so clean_live_states either sets both slots to STACK_INVALID or none of them. This is the invariant the checks inside stacksafe rely on.
Next, do a complete comparison of both stack slots whenever they have STACK_DYNPTR. Compare the dynptr type stored in the spilled_ptr, and also whether both form the same first_slot. Only then is the later path safe.
Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs") Acked-by: Eduard Zingerman eddyz87@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi memxor@gmail.com Link: https://lore.kernel.org/r/20230121002241.2113993-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/bpf/verifier.c | 88 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 84 insertions(+), 4 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 7ee2188272597..c42cb70150e96 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -781,6 +781,9 @@ static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_ state->stack[spi - 1].spilled_ptr.ref_obj_id = id; }
+ state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; + state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN; + return 0; }
@@ -805,6 +808,31 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re
__mark_reg_not_init(env, &state->stack[spi].spilled_ptr); __mark_reg_not_init(env, &state->stack[spi - 1].spilled_ptr); + + /* Why do we need to set REG_LIVE_WRITTEN for STACK_INVALID slot? + * + * While we don't allow reading STACK_INVALID, it is still possible to + * do <8 byte writes marking some but not all slots as STACK_MISC. Then, + * helpers or insns can do partial read of that part without failing, + * but check_stack_range_initialized, check_stack_read_var_off, and + * check_stack_read_fixed_off will do mark_reg_read for all 8-bytes of + * the slot conservatively. Hence we need to prevent those liveness + * marking walks. + * + * This was not a problem before because STACK_INVALID is only set by + * default (where the default reg state has its reg->parent as NULL), or + * in clean_live_states after REG_LIVE_DONE (at which point + * mark_reg_read won't walk reg->parent chain), but not randomly during + * verifier state exploration (like we did above). Hence, for our case + * parentage chain will still be live (i.e. reg->parent may be + * non-NULL), while earlier reg->parent was NULL, so we need + * REG_LIVE_WRITTEN to screen off read marker propagation when it is + * done later on reads or by mark_dynptr_read as well to unnecessary + * mark registers in verifier state. + */ + state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; + state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN; + return 0; }
@@ -2386,6 +2414,30 @@ static int mark_reg_read(struct bpf_verifier_env *env, return 0; }
+static int mark_dynptr_read(struct bpf_verifier_env *env, struct bpf_reg_state *reg) +{ + struct bpf_func_state *state = func(env, reg); + int spi, ret; + + /* For CONST_PTR_TO_DYNPTR, it must have already been done by + * check_reg_arg in check_helper_call and mark_btf_func_reg_size in + * check_kfunc_call. + */ + if (reg->type == CONST_PTR_TO_DYNPTR) + return 0; + spi = get_spi(reg->off); + /* Caller ensures dynptr is valid and initialized, which means spi is in + * bounds and spi is the first dynptr slot. Simply mark stack slot as + * read. + */ + ret = mark_reg_read(env, &state->stack[spi].spilled_ptr, + state->stack[spi].spilled_ptr.parent, REG_LIVE_READ64); + if (ret) + return ret; + return mark_reg_read(env, &state->stack[spi - 1].spilled_ptr, + state->stack[spi - 1].spilled_ptr.parent, REG_LIVE_READ64); +} + /* This function is supposed to be used by the following 32-bit optimization * code only. It returns TRUE if the source or destination register operates * on 64-bit, otherwise return FALSE. @@ -5992,6 +6044,8 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno,
meta->uninit_dynptr_regno = regno; } else /* MEM_RDONLY and None case from above */ { + int err; + /* For the reg->type == PTR_TO_STACK case, bpf_dynptr is never const */ if (reg->type == CONST_PTR_TO_DYNPTR && !(arg_type & MEM_RDONLY)) { verbose(env, "cannot pass pointer to const bpf_dynptr, the helper mutates it\n"); @@ -6025,6 +6079,10 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno, err_extra, regno); return -EINVAL; } + + err = mark_dynptr_read(env, reg); + if (err) + return err; } return 0; } @@ -13231,10 +13289,9 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old, return false; if (i % BPF_REG_SIZE != BPF_REG_SIZE - 1) continue; - if (!is_spilled_reg(&old->stack[spi])) - continue; - if (!regsafe(env, &old->stack[spi].spilled_ptr, - &cur->stack[spi].spilled_ptr, idmap)) + /* Both old and cur are having same slot_type */ + switch (old->stack[spi].slot_type[BPF_REG_SIZE - 1]) { + case STACK_SPILL: /* when explored and current stack slot are both storing * spilled registers, check that stored pointers types * are the same as well. @@ -13245,7 +13302,30 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old, * such verifier states are not equivalent. * return false to continue verification of this path */ + if (!regsafe(env, &old->stack[spi].spilled_ptr, + &cur->stack[spi].spilled_ptr, idmap)) + return false; + break; + case STACK_DYNPTR: + { + const struct bpf_reg_state *old_reg, *cur_reg; + + old_reg = &old->stack[spi].spilled_ptr; + cur_reg = &cur->stack[spi].spilled_ptr; + if (old_reg->dynptr.type != cur_reg->dynptr.type || + old_reg->dynptr.first_slot != cur_reg->dynptr.first_slot || + !check_ids(old_reg->ref_obj_id, cur_reg->ref_obj_id, idmap)) + return false; + break; + } + case STACK_MISC: + case STACK_ZERO: + case STACK_INVALID: + continue; + /* Ensure that new unhandled slot types return false by default */ + default: return false; + } } return true; }
From: Kumar Kartikeya Dwivedi memxor@gmail.com
[ Upstream commit 79168a669d8125453c8a271115f1ffd4294e61f6 ]
Currently, the dynptr function is not checking the variable offset part of PTR_TO_STACK that it needs to check. The fixed offset is considered when computing the stack pointer index, but if the variable offset was not a constant (such that it could not be accumulated in reg->off), we will end up a discrepency where runtime pointer does not point to the actual stack slot we mark as STACK_DYNPTR.
It is impossible to precisely track dynptr state when variable offset is not constant, hence, just like bpf_timer, kptr, bpf_spin_lock, etc. simply reject the case where reg->var_off is not constant. Then, consider both reg->off and reg->var_off.value when computing the stack pointer index.
A new helper dynptr_get_spi is introduced to hide over these details since the dynptr needs to be located in multiple places outside the process_dynptr_func checks, hence once we know it's a PTR_TO_STACK, we need to enforce these checks in all places.
Note that it is disallowed for unprivileged users to have a non-constant var_off, so this problem should only be possible to trigger from programs having CAP_PERFMON. However, its effects can vary.
Without the fix, it is possible to replace the contents of the dynptr arbitrarily by making verifier mark different stack slots than actual location and then doing writes to the actual stack address of dynptr at runtime.
Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs") Acked-by: Joanne Koong joannelkoong@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi memxor@gmail.com Link: https://lore.kernel.org/r/20230121002241.2113993-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/bpf/verifier.c | 84 +++++++++++++++---- .../bpf/prog_tests/kfunc_dynptr_param.c | 2 +- .../testing/selftests/bpf/progs/dynptr_fail.c | 4 +- 3 files changed, 69 insertions(+), 21 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c42cb70150e96..749e7f7a720f2 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -638,11 +638,34 @@ static void print_liveness(struct bpf_verifier_env *env, verbose(env, "D"); }
-static int get_spi(s32 off) +static int __get_spi(s32 off) { return (-off - 1) / BPF_REG_SIZE; }
+static int dynptr_get_spi(struct bpf_verifier_env *env, struct bpf_reg_state *reg) +{ + int off, spi; + + if (!tnum_is_const(reg->var_off)) { + verbose(env, "dynptr has to be at a constant offset\n"); + return -EINVAL; + } + + off = reg->off + reg->var_off.value; + if (off % BPF_REG_SIZE) { + verbose(env, "cannot pass in dynptr at an offset=%d\n", off); + return -EINVAL; + } + + spi = __get_spi(off); + if (spi < 1) { + verbose(env, "cannot pass in dynptr at an offset=%d\n", off); + return -EINVAL; + } + return spi; +} + static bool is_spi_bounds_valid(struct bpf_func_state *state, int spi, int nr_slots) { int allocated_slots = state->allocated_stack / BPF_REG_SIZE; @@ -754,7 +777,9 @@ static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_ enum bpf_dynptr_type type; int spi, i, id;
- spi = get_spi(reg->off); + spi = dynptr_get_spi(env, reg); + if (spi < 0) + return spi;
if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS)) return -EINVAL; @@ -792,7 +817,9 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re struct bpf_func_state *state = func(env, reg); int spi, i;
- spi = get_spi(reg->off); + spi = dynptr_get_spi(env, reg); + if (spi < 0) + return spi;
if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS)) return -EINVAL; @@ -844,7 +871,11 @@ static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_ if (reg->type == CONST_PTR_TO_DYNPTR) return false;
- spi = get_spi(reg->off); + spi = dynptr_get_spi(env, reg); + if (spi < 0) + return false; + + /* We will do check_mem_access to check and update stack bounds later */ if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS)) return true;
@@ -860,14 +891,15 @@ static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_ static bool is_dynptr_reg_valid_init(struct bpf_verifier_env *env, struct bpf_reg_state *reg) { struct bpf_func_state *state = func(env, reg); - int spi; - int i; + int spi, i;
/* This already represents first slot of initialized bpf_dynptr */ if (reg->type == CONST_PTR_TO_DYNPTR) return true;
- spi = get_spi(reg->off); + spi = dynptr_get_spi(env, reg); + if (spi < 0) + return false; if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS) || !state->stack[spi].spilled_ptr.dynptr.first_slot) return false; @@ -896,7 +928,9 @@ static bool is_dynptr_type_expected(struct bpf_verifier_env *env, struct bpf_reg if (reg->type == CONST_PTR_TO_DYNPTR) { return reg->dynptr.type == dynptr_type; } else { - spi = get_spi(reg->off); + spi = dynptr_get_spi(env, reg); + if (spi < 0) + return false; return state->stack[spi].spilled_ptr.dynptr.type == dynptr_type; } } @@ -2425,7 +2459,9 @@ static int mark_dynptr_read(struct bpf_verifier_env *env, struct bpf_reg_state * */ if (reg->type == CONST_PTR_TO_DYNPTR) return 0; - spi = get_spi(reg->off); + spi = dynptr_get_spi(env, reg); + if (spi < 0) + return spi; /* Caller ensures dynptr is valid and initialized, which means spi is in * bounds and spi is the first dynptr slot. Simply mark stack slot as * read. @@ -6007,12 +6043,15 @@ int process_dynptr_func(struct bpf_verifier_env *env, int regno, } /* CONST_PTR_TO_DYNPTR already has fixed and var_off as 0 due to * check_func_arg_reg_off's logic. We only need to check offset - * alignment for PTR_TO_STACK. + * and its alignment for PTR_TO_STACK. */ - if (reg->type == PTR_TO_STACK && (reg->off % BPF_REG_SIZE)) { - verbose(env, "cannot pass in dynptr at an offset=%d\n", reg->off); - return -EINVAL; + if (reg->type == PTR_TO_STACK) { + int err = dynptr_get_spi(env, reg); + + if (err < 0) + return err; } + /* MEM_UNINIT - Points to memory that is an appropriate candidate for * constructing a mutable bpf_dynptr object. * @@ -6420,15 +6459,16 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env, } }
-static u32 dynptr_ref_obj_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg) +static int dynptr_ref_obj_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg) { struct bpf_func_state *state = func(env, reg); int spi;
if (reg->type == CONST_PTR_TO_DYNPTR) return reg->ref_obj_id; - - spi = get_spi(reg->off); + spi = dynptr_get_spi(env, reg); + if (spi < 0) + return spi; return state->stack[spi].spilled_ptr.ref_obj_id; }
@@ -6502,7 +6542,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, * PTR_TO_STACK. */ if (reg->type == PTR_TO_STACK) { - spi = get_spi(reg->off); + spi = dynptr_get_spi(env, reg); + if (spi < 0) + return spi; if (!is_spi_bounds_valid(state, spi, BPF_DYNPTR_NR_SLOTS) || !state->stack[spi].spilled_ptr.ref_obj_id) { verbose(env, "arg %d is an unacquired reference\n", regno); @@ -7991,13 +8033,19 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn for (i = 0; i < MAX_BPF_FUNC_REG_ARGS; i++) { if (arg_type_is_dynptr(fn->arg_type[i])) { struct bpf_reg_state *reg = ®s[BPF_REG_1 + i]; + int ref_obj_id;
if (meta.ref_obj_id) { verbose(env, "verifier internal error: meta.ref_obj_id already set\n"); return -EFAULT; }
- meta.ref_obj_id = dynptr_ref_obj_id(env, reg); + ref_obj_id = dynptr_ref_obj_id(env, reg); + if (ref_obj_id < 0) { + verbose(env, "verifier internal error: failed to obtain dynptr ref_obj_id\n"); + return ref_obj_id; + } + meta.ref_obj_id = ref_obj_id; break; } } diff --git a/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c b/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c index a9229260a6cec..72800b1e8395a 100644 --- a/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c +++ b/tools/testing/selftests/bpf/prog_tests/kfunc_dynptr_param.c @@ -18,7 +18,7 @@ static struct { const char *expected_verifier_err_msg; int expected_runtime_err; } kfunc_dynptr_tests[] = { - {"not_valid_dynptr", "Expected an initialized dynptr as arg #1", 0}, + {"not_valid_dynptr", "cannot pass in dynptr at an offset=-8", 0}, {"not_ptr_to_stack", "arg#0 expected pointer to stack or dynptr_ptr", 0}, {"dynptr_data_null", NULL, -EBADMSG}, }; diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c index 78debc1b38207..02d57b95cf6ec 100644 --- a/tools/testing/selftests/bpf/progs/dynptr_fail.c +++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c @@ -382,7 +382,7 @@ int invalid_helper1(void *ctx)
/* A dynptr can't be passed into a helper function at a non-zero offset */ SEC("?raw_tp") -__failure __msg("Expected an initialized dynptr as arg #3") +__failure __msg("cannot pass in dynptr at an offset=-8") int invalid_helper2(void *ctx) { struct bpf_dynptr ptr; @@ -584,7 +584,7 @@ int invalid_read4(void *ctx)
/* Initializing a dynptr on an offset should fail */ SEC("?raw_tp") -__failure __msg("invalid write to stack") +__failure __msg("cannot pass in dynptr at an offset=0") int invalid_offset(void *ctx) { struct bpf_dynptr ptr;
From: Kumar Kartikeya Dwivedi memxor@gmail.com
[ Upstream commit ef8fc7a07c0e161841779d6fe3f6acd5a05c547c ]
Currently, while reads are disallowed for dynptr stack slots, writes are not. Reads don't work from both direct access and helpers, while writes do work in both cases, but have the effect of overwriting the slot_type.
While this is fine, handling for a few edge cases is missing. Firstly, a user can overwrite the stack slots of dynptr partially.
Consider the following layout: spi: [d][d][?] 2 1 0
First slot is at spi 2, second at spi 1. Now, do a write of 1 to 8 bytes for spi 1.
This will essentially either write STACK_MISC for all slot_types or STACK_MISC and STACK_ZERO (in case of size < BPF_REG_SIZE partial write of zeroes). The end result is that slot is scrubbed.
Now, the layout is: spi: [d][m][?] 2 1 0
Suppose if user initializes spi = 1 as dynptr. We get: spi: [d][d][d] 2 1 0
But this time, both spi 2 and spi 1 have first_slot = true.
Now, when passing spi 2 to dynptr helper, it will consider it as initialized as it does not check whether second slot has first_slot == false. And spi 1 should already work as normal.
This effectively replaced size + offset of first dynptr, hence allowing invalid OOB reads and writes.
Make a few changes to protect against this: When writing to PTR_TO_STACK using BPF insns, when we touch spi of a STACK_DYNPTR type, mark both first and second slot (regardless of which slot we touch) as STACK_INVALID. Reads are already prevented.
Second, prevent writing to stack memory from helpers if the range may contain any STACK_DYNPTR slots. Reads are already prevented.
For helpers, we cannot allow it to destroy dynptrs from the writes as depending on arguments, helper may take uninit_mem and dynptr both at the same time. This would mean that helper may write to uninit_mem before it reads the dynptr, which would be bad.
PTR_TO_MEM: [?????dd]
Depending on the code inside the helper, it may end up overwriting the dynptr contents first and then read those as the dynptr argument.
Verifier would only simulate destruction when it does byte by byte access simulation in check_helper_call for meta.access_size, and fail to catch this case, as it happens after argument checks.
The same would need to be done for any other non-trivial objects created on the stack in the future, such as bpf_list_head on stack, or bpf_rb_root on stack.
A common misunderstanding in the current code is that MEM_UNINIT means writes, but note that writes may also be performed even without MEM_UNINIT in case of helpers, in that case the code after handling meta && meta->raw_mode will complain when it sees STACK_DYNPTR. So that invalid read case also covers writes to potential STACK_DYNPTR slots. The only loophole was in case of meta->raw_mode which simulated writes through instructions which could overwrite them.
A future series sequenced after this will focus on the clean up of helper access checks and bugs around that.
Fixes: 97e03f521050 ("bpf: Add verifier support for dynptrs") Signed-off-by: Kumar Kartikeya Dwivedi memxor@gmail.com Link: https://lore.kernel.org/r/20230121002241.2113993-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/bpf/verifier.c | 88 +++++++++++++++++++ .../testing/selftests/bpf/progs/dynptr_fail.c | 6 +- 2 files changed, 91 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 749e7f7a720f2..68455fd56eea5 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -769,6 +769,8 @@ static void mark_dynptr_cb_reg(struct bpf_reg_state *reg, __mark_dynptr_reg(reg, type, true); }
+static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env, + struct bpf_func_state *state, int spi);
static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_state *reg, enum bpf_arg_type arg_type, int insn_idx) @@ -863,6 +865,55 @@ static int unmark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_re return 0; }
+static void __mark_reg_unknown(const struct bpf_verifier_env *env, + struct bpf_reg_state *reg); + +static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env, + struct bpf_func_state *state, int spi) +{ + int i; + + /* We always ensure that STACK_DYNPTR is never set partially, + * hence just checking for slot_type[0] is enough. This is + * different for STACK_SPILL, where it may be only set for + * 1 byte, so code has to use is_spilled_reg. + */ + if (state->stack[spi].slot_type[0] != STACK_DYNPTR) + return 0; + + /* Reposition spi to first slot */ + if (!state->stack[spi].spilled_ptr.dynptr.first_slot) + spi = spi + 1; + + if (dynptr_type_refcounted(state->stack[spi].spilled_ptr.dynptr.type)) { + verbose(env, "cannot overwrite referenced dynptr\n"); + return -EINVAL; + } + + mark_stack_slot_scratched(env, spi); + mark_stack_slot_scratched(env, spi - 1); + + /* Writing partially to one dynptr stack slot destroys both. */ + for (i = 0; i < BPF_REG_SIZE; i++) { + state->stack[spi].slot_type[i] = STACK_INVALID; + state->stack[spi - 1].slot_type[i] = STACK_INVALID; + } + + /* TODO: Invalidate any slices associated with this dynptr */ + + /* Do not release reference state, we are destroying dynptr on stack, + * not using some helper to release it. Just reset register. + */ + __mark_reg_not_init(env, &state->stack[spi].spilled_ptr); + __mark_reg_not_init(env, &state->stack[spi - 1].spilled_ptr); + + /* Same reason as unmark_stack_slots_dynptr above */ + state->stack[spi].spilled_ptr.live |= REG_LIVE_WRITTEN; + state->stack[spi - 1].spilled_ptr.live |= REG_LIVE_WRITTEN; + + return 0; +} + static bool is_dynptr_reg_valid_uninit(struct bpf_verifier_env *env, struct bpf_reg_state *reg) { struct bpf_func_state *state = func(env, reg); @@ -3406,6 +3457,10 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, env->insn_aux_data[insn_idx].sanitize_stack_spill = true; }
+ err = destroy_if_dynptr_stack_slot(env, state, spi); + if (err) + return err; + mark_stack_slot_scratched(env, spi); if (reg && !(off % BPF_REG_SIZE) && register_is_bounded(reg) && !register_is_null(reg) && env->bpf_capable) { @@ -3519,6 +3574,14 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env, if (err) return err;
+ for (i = min_off; i < max_off; i++) { + int spi; + + spi = __get_spi(i); + err = destroy_if_dynptr_stack_slot(env, state, spi); + if (err) + return err; + }
/* Variable offset writes destroy any spilled pointers in range. */ for (i = min_off; i < max_off; i++) { @@ -5546,6 +5609,31 @@ static int check_stack_range_initialized( }
if (meta && meta->raw_mode) { + /* Ensure we won't be overwriting dynptrs when simulating byte + * by byte access in check_helper_call using meta.access_size. + * This would be a problem if we have a helper in the future + * which takes: + * + * helper(uninit_mem, len, dynptr) + * + * Now, uninint_mem may overlap with dynptr pointer. Hence, it + * may end up writing to dynptr itself when touching memory from + * arg 1. This can be relaxed on a case by case basis for known + * safe cases, but reject due to the possibilitiy of aliasing by + * default. + */ + for (i = min_off; i < max_off + access_size; i++) { + int stack_off = -i - 1; + + spi = __get_spi(i); + /* raw_mode may write past allocated_stack */ + if (state->allocated_stack <= stack_off) + continue; + if (state->stack[spi].slot_type[stack_off % BPF_REG_SIZE] == STACK_DYNPTR) { + verbose(env, "potential write to dynptr at off=%d disallowed\n", i); + return -EACCES; + } + } meta->access_size = access_size; meta->regno = regno; return 0; diff --git a/tools/testing/selftests/bpf/progs/dynptr_fail.c b/tools/testing/selftests/bpf/progs/dynptr_fail.c index 02d57b95cf6ec..9dc3f23a82707 100644 --- a/tools/testing/selftests/bpf/progs/dynptr_fail.c +++ b/tools/testing/selftests/bpf/progs/dynptr_fail.c @@ -420,7 +420,7 @@ int invalid_write1(void *ctx) * offset */ SEC("?raw_tp") -__failure __msg("Expected an initialized dynptr as arg #3") +__failure __msg("cannot overwrite referenced dynptr") int invalid_write2(void *ctx) { struct bpf_dynptr ptr; @@ -444,7 +444,7 @@ int invalid_write2(void *ctx) * non-const offset */ SEC("?raw_tp") -__failure __msg("Expected an initialized dynptr as arg #1") +__failure __msg("cannot overwrite referenced dynptr") int invalid_write3(void *ctx) { struct bpf_dynptr ptr; @@ -476,7 +476,7 @@ static int invalid_write4_callback(__u32 index, void *data) * be invalidated as a dynptr */ SEC("?raw_tp") -__failure __msg("arg 1 is an unacquired reference") +__failure __msg("cannot overwrite referenced dynptr") int invalid_write4(void *ctx) { struct bpf_dynptr ptr;
From: Ashok Raj ashok.raj@intel.com
[ Upstream commit ab31c74455c64e69342ddab21fd9426fcbfefde7 ]
Add a parameter to store CPU capabilities before performing a microcode update so that CPU capabilities can be compared before and after update.
[ bp: Massage. ]
Signed-off-by: Ashok Raj ashok.raj@intel.com Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Link: https://lore.kernel.org/r/20230109153555.4986-2-ashok.raj@intel.com Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly") Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/include/asm/processor.h | 2 +- arch/x86/kernel/cpu/common.c | 21 +++++++++++++-------- arch/x86/kernel/cpu/microcode/core.c | 3 ++- 3 files changed, 16 insertions(+), 10 deletions(-)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h index 4e35c66edeb7d..f256a4ddd25da 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -697,7 +697,7 @@ bool xen_set_default_idle(void); #endif
void __noreturn stop_this_cpu(void *dummy); -void microcode_check(void); +void microcode_check(struct cpuinfo_x86 *prev_info);
enum l1tf_mitigations { L1TF_MITIGATION_OFF, diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index f3cc7699e1e1b..cda7ded29213e 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -2302,30 +2302,35 @@ void cpu_init_secondary(void) #endif
#ifdef CONFIG_MICROCODE_LATE_LOADING -/* +/** + * microcode_check() - Check if any CPU capabilities changed after an update. + * @prev_info: CPU capabilities stored before an update. + * * The microcode loader calls this upon late microcode load to recheck features, * only when microcode has been updated. Caller holds microcode_mutex and CPU * hotplug lock. + * + * Return: None */ -void microcode_check(void) +void microcode_check(struct cpuinfo_x86 *prev_info) { - struct cpuinfo_x86 info; - perf_check_microcode();
/* Reload CPUID max function as it might've changed. */ - info.cpuid_level = cpuid_eax(0); + prev_info->cpuid_level = cpuid_eax(0);
/* * Copy all capability leafs to pick up the synthetic ones so that * memcmp() below doesn't fail on that. The ones coming from CPUID will * get overwritten in get_cpu_cap(). */ - memcpy(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability)); + memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability, + sizeof(prev_info->x86_capability));
- get_cpu_cap(&info); + get_cpu_cap(prev_info);
- if (!memcmp(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability))) + if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability, + sizeof(prev_info->x86_capability))) return;
pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n"); diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c index 712aafff96e03..b2068ce2c86bf 100644 --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c @@ -438,6 +438,7 @@ static int __reload_late(void *info) static int microcode_reload_late(void) { int old = boot_cpu_data.microcode, ret; + struct cpuinfo_x86 prev_info;
pr_err("Attempting late microcode loading - it is dangerous and taints the kernel.\n"); pr_err("You should switch to early loading, if possible.\n"); @@ -447,7 +448,7 @@ static int microcode_reload_late(void)
ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); if (ret == 0) - microcode_check(); + microcode_check(&prev_info);
pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", old, boot_cpu_data.microcode);
From: Ashok Raj ashok.raj@intel.com
[ Upstream commit c0dd9245aa9e25a697181f6085692272c9ec61bc ]
The kernel caches each CPU's feature bits at boot in an x86_capability[] structure. However, the capabilities in the BSP's copy can be turned off as a result of certain command line parameters or configuration restrictions, for example the SGX bit. This can cause a mismatch when comparing the values before and after the microcode update.
Another example is X86_FEATURE_SRBDS_CTRL which gets added only after microcode update:
# --- cpuid.before 2023-01-21 14:54:15.652000747 +0100 # +++ cpuid.after 2023-01-21 14:54:26.632001024 +0100 # @@ -10,7 +10,7 @@ CPU: # 0x00000004 0x04: eax=0x00000000 ebx=0x00000000 ecx=0x00000000 edx=0x00000000 # 0x00000005 0x00: eax=0x00000040 ebx=0x00000040 ecx=0x00000003 edx=0x11142120 # 0x00000006 0x00: eax=0x000027f7 ebx=0x00000002 ecx=0x00000001 edx=0x00000000 # - 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002400 # + 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002e00 ^^^
and which proves for a gazillionth time that late loading is a bad bad idea.
microcode_check() is called after an update to report any previously cached CPUID bits which might have changed due to the update.
Therefore, store the cached CPU caps before the update and compare them with the CPU caps after the microcode update has succeeded.
Thus, the comparison is done between the CPUID *hardware* bits before and after the upgrade instead of using the cached, possibly runtime modified values in BSP's boot_cpu_data copy.
As a result, false warnings about CPUID bits changes are avoided.
[ bp: - Massage. - Add SRBDS_CTRL example. - Add kernel-doc. - Incorporate forgotten review feedback from dhansen. ]
Fixes: 1008c52c09dc ("x86/CPU: Add a microcode loader callback") Signed-off-by: Ashok Raj ashok.raj@intel.com Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Link: https://lore.kernel.org/r/20230109153555.4986-3-ashok.raj@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/include/asm/processor.h | 1 + arch/x86/kernel/cpu/common.c | 36 ++++++++++++++++++---------- arch/x86/kernel/cpu/microcode/core.c | 6 +++++ 3 files changed, 30 insertions(+), 13 deletions(-)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h index f256a4ddd25da..a77dee6a2bf2e 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -698,6 +698,7 @@ bool xen_set_default_idle(void);
void __noreturn stop_this_cpu(void *dummy); void microcode_check(struct cpuinfo_x86 *prev_info); +void store_cpu_caps(struct cpuinfo_x86 *info);
enum l1tf_mitigations { L1TF_MITIGATION_OFF, diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index cda7ded29213e..6a25e93f2a87c 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -2302,6 +2302,25 @@ void cpu_init_secondary(void) #endif
#ifdef CONFIG_MICROCODE_LATE_LOADING +/** + * store_cpu_caps() - Store a snapshot of CPU capabilities + * @curr_info: Pointer where to store it + * + * Returns: None + */ +void store_cpu_caps(struct cpuinfo_x86 *curr_info) +{ + /* Reload CPUID max function as it might've changed. */ + curr_info->cpuid_level = cpuid_eax(0); + + /* Copy all capability leafs and pick up the synthetic ones. */ + memcpy(&curr_info->x86_capability, &boot_cpu_data.x86_capability, + sizeof(curr_info->x86_capability)); + + /* Get the hardware CPUID leafs */ + get_cpu_cap(curr_info); +} + /** * microcode_check() - Check if any CPU capabilities changed after an update. * @prev_info: CPU capabilities stored before an update. @@ -2314,22 +2333,13 @@ void cpu_init_secondary(void) */ void microcode_check(struct cpuinfo_x86 *prev_info) { - perf_check_microcode(); - - /* Reload CPUID max function as it might've changed. */ - prev_info->cpuid_level = cpuid_eax(0); + struct cpuinfo_x86 curr_info;
- /* - * Copy all capability leafs to pick up the synthetic ones so that - * memcmp() below doesn't fail on that. The ones coming from CPUID will - * get overwritten in get_cpu_cap(). - */ - memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability, - sizeof(prev_info->x86_capability)); + perf_check_microcode();
- get_cpu_cap(prev_info); + store_cpu_caps(&curr_info);
- if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability, + if (!memcmp(&prev_info->x86_capability, &curr_info.x86_capability, sizeof(prev_info->x86_capability))) return;
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c index b2068ce2c86bf..a25ba851a9208 100644 --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c @@ -446,6 +446,12 @@ static int microcode_reload_late(void) atomic_set(&late_cpus_in, 0); atomic_set(&late_cpus_out, 0);
+ /* + * Take a snapshot before the microcode update in order to compare and + * check whether any bits changed after an update. + */ + store_cpu_caps(&prev_info); + ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); if (ret == 0) microcode_check(&prev_info);
From: Ashok Raj ashok.raj@intel.com
[ Upstream commit 6eab3abac7043226e5375e9ead0c7607ced6767b ]
During late microcode loading, the "Reload completed" message is issued unconditionally, regardless of success or failure.
Adjust the message to report the result of the update.
[ bp: Massage. ]
Fixes: 9bd681251b7c ("x86/microcode: Announce reload operation's completion") Suggested-by: Thomas Gleixner tglx@linutronix.de Signed-off-by: Ashok Raj ashok.raj@intel.com Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Reviewed-by: Tony Luck tony.luck@intel.com Link: https://lore.kernel.org/lkml/874judpqqd.ffs@tglx/ Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/kernel/cpu/microcode/core.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c index a25ba851a9208..3c4e732a61dff 100644 --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c @@ -453,11 +453,14 @@ static int microcode_reload_late(void) store_cpu_caps(&prev_info);
ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); - if (ret == 0) + if (!ret) { + pr_info("Reload succeeded, microcode revision: 0x%x -> 0x%x\n", + old, boot_cpu_data.microcode); microcode_check(&prev_info); - - pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", - old, boot_cpu_data.microcode); + } else { + pr_info("Reload failed, current microcode revision: 0x%x\n", + boot_cpu_data.microcode); + }
return ret; }
From: Siddharth Vadapalli s-vadapalli@ti.com
[ Upstream commit 4ad8766cd3982744e53f107f378d2c65b76ff9a8 ]
The am65_cpts_release() function is registered as a devm_action in the am65_cpts_create() function in am65-cpts driver. When the am65-cpsw driver invokes am65_cpts_create(), am65_cpts_release() is added in the set of devm actions associated with the am65-cpsw driver's device.
In the event of probe failure or probe deferral, the platform_drv_probe() function invokes dev_pm_domain_detach() which powers off the CPSW and the CPSW's CPTS hardware, both of which share the same power domain. Since the am65_cpts_disable() function invoked by the am65_cpts_release() function attempts to reset the CPTS hardware by writing to its registers, the CPTS hardware is assumed to be powered on at this point. However, the hardware is powered off before the devm actions are executed.
Fix this by getting rid of the devm action for am65_cpts_release() and invoking it directly on the cleanup and exit paths.
Fixes: f6bd59526ca5 ("net: ethernet: ti: introduce am654 common platform time sync driver") Signed-off-by: Siddharth Vadapalli s-vadapalli@ti.com Reviewed-by: Leon Romanovsky leonro@nvidia.com Reviewed-by: Tony Nguyen anthony.l.nguyen@intel.com Reviewed-by: Roger Quadros rogerq@kernel.org Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 ++ drivers/net/ethernet/ti/am65-cpts.c | 15 +++++---------- drivers/net/ethernet/ti/am65-cpts.h | 5 +++++ 3 files changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c index 6cda4b7c10cb6..3e17152798554 100644 --- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c +++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c @@ -2852,6 +2852,7 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev)
err_free_phylink: am65_cpsw_nuss_phylink_cleanup(common); + am65_cpts_release(common->cpts); err_of_clear: of_platform_device_destroy(common->mdio_dev, NULL); err_pm_clear: @@ -2880,6 +2881,7 @@ static int am65_cpsw_nuss_remove(struct platform_device *pdev) */ am65_cpsw_nuss_cleanup_ndev(common); am65_cpsw_nuss_phylink_cleanup(common); + am65_cpts_release(common->cpts);
of_platform_device_destroy(common->mdio_dev, NULL);
diff --git a/drivers/net/ethernet/ti/am65-cpts.c b/drivers/net/ethernet/ti/am65-cpts.c index 9535396b28cd9..a297890152d92 100644 --- a/drivers/net/ethernet/ti/am65-cpts.c +++ b/drivers/net/ethernet/ti/am65-cpts.c @@ -929,14 +929,13 @@ static int am65_cpts_of_parse(struct am65_cpts *cpts, struct device_node *node) return cpts_of_mux_clk_setup(cpts, node); }
-static void am65_cpts_release(void *data) +void am65_cpts_release(struct am65_cpts *cpts) { - struct am65_cpts *cpts = data; - ptp_clock_unregister(cpts->ptp_clock); am65_cpts_disable(cpts); clk_disable_unprepare(cpts->refclk); } +EXPORT_SYMBOL_GPL(am65_cpts_release);
struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs, struct device_node *node) @@ -1014,18 +1013,12 @@ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs, } cpts->phc_index = ptp_clock_index(cpts->ptp_clock);
- ret = devm_add_action_or_reset(dev, am65_cpts_release, cpts); - if (ret) { - dev_err(dev, "failed to add ptpclk reset action %d", ret); - return ERR_PTR(ret); - } - ret = devm_request_threaded_irq(dev, cpts->irq, NULL, am65_cpts_interrupt, IRQF_ONESHOT, dev_name(dev), cpts); if (ret < 0) { dev_err(cpts->dev, "error attaching irq %d\n", ret); - return ERR_PTR(ret); + goto reset_ptpclk; }
dev_info(dev, "CPTS ver 0x%08x, freq:%u, add_val:%u\n", @@ -1034,6 +1027,8 @@ struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs,
return cpts;
+reset_ptpclk: + am65_cpts_release(cpts); refclk_disable: clk_disable_unprepare(cpts->refclk); return ERR_PTR(ret); diff --git a/drivers/net/ethernet/ti/am65-cpts.h b/drivers/net/ethernet/ti/am65-cpts.h index bd08f4b2edd2d..6e14df0be1137 100644 --- a/drivers/net/ethernet/ti/am65-cpts.h +++ b/drivers/net/ethernet/ti/am65-cpts.h @@ -18,6 +18,7 @@ struct am65_cpts_estf_cfg { };
#if IS_ENABLED(CONFIG_TI_K3_AM65_CPTS) +void am65_cpts_release(struct am65_cpts *cpts); struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs, struct device_node *node); int am65_cpts_phc_index(struct am65_cpts *cpts); @@ -31,6 +32,10 @@ void am65_cpts_estf_disable(struct am65_cpts *cpts, int idx); void am65_cpts_suspend(struct am65_cpts *cpts); void am65_cpts_resume(struct am65_cpts *cpts); #else +static inline void am65_cpts_release(struct am65_cpts *cpts) +{ +} + static inline struct am65_cpts *am65_cpts_create(struct device *dev, void __iomem *regs, struct device_node *node)
From: Daniel T. Lee danieltimlee@gmail.com
[ Upstream commit 2514a31241e1e9067d379e0fbdb60e4bc2bf4659 ]
As stated in README.rst, in order to resolve errors with linker errors, 'LDLIBS=-static' should be used. Most problems will be solved by this option, but in the case of urandom_read, this won't fix the problem. So the Makefile is currently implemented to strip the 'static' option when compiling the urandom_read. However, stripping this static option isn't configured properly on $(LDLIBS) correctly, which is now causing errors on static compilation.
# LDLIBS=-static ./vmtest.sh ld.lld: error: attempted static link of dynamic object liburandom_read.so clang: error: linker command failed with exit code 1 (use -v to see invocation) make: *** [Makefile:190: /linux/tools/testing/selftests/bpf/urandom_read] Error 1 make: *** Waiting for unfinished jobs....
This commit fixes this problem by configuring the strip with $(LDLIBS).
Fixes: 68084a136420 ("selftests/bpf: Fix building bpf selftests statically") Signed-off-by: Daniel T. Lee danieltimlee@gmail.com Signed-off-by: Daniel Borkmann daniel@iogearbox.net Link: https://lore.kernel.org/bpf/20230125100440.21734-1-danieltimlee@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/bpf/Makefile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index c22c43bbee194..2323a2b98b815 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -181,14 +181,15 @@ endif # do not fail. Static builds leave urandom_read relying on system-wide shared libraries. $(OUTPUT)/liburandom_read.so: urandom_read_lib1.c urandom_read_lib2.c $(call msg,LIB,,$@) - $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) $^ $(LDLIBS) \ + $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) \ + $^ $(filter-out -static,$(LDLIBS)) \ -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \ -fPIC -shared -o $@
$(OUTPUT)/urandom_read: urandom_read.c urandom_read_aux.c $(OUTPUT)/liburandom_read.so $(call msg,BINARY,,$@) $(Q)$(CLANG) $(filter-out -static,$(CFLAGS) $(LDFLAGS)) $(filter %.c,$^) \ - liburandom_read.so $(LDLIBS) \ + liburandom_read.so $(filter-out -static,$(LDLIBS)) \ -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \ -Wl,-rpath=. -o $@
From: Herbert Xu herbert@gondor.apana.org.au
[ Upstream commit 51c082514c2dedf2711c99d93c196cc4eedceb40 ]
As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request.
However, as the caller of xts may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
Fixes: 8083b1bf8163 ("crypto: xts - add support for ciphertext stealing") Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Acked-by: Ard Biesheuvel ardb@kernel.org Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- crypto/xts.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/crypto/xts.c b/crypto/xts.c index 63c85b9e64e08..de6cbcf69bbd6 100644 --- a/crypto/xts.c +++ b/crypto/xts.c @@ -203,12 +203,12 @@ static void xts_encrypt_done(struct crypto_async_request *areq, int err) if (!err) { struct xts_request_ctx *rctx = skcipher_request_ctx(req);
- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; + rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; err = xts_xor_tweak_post(req, true);
if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) { err = xts_cts_final(req, crypto_skcipher_encrypt); - if (err == -EINPROGRESS) + if (err == -EINPROGRESS || err == -EBUSY) return; } } @@ -223,12 +223,12 @@ static void xts_decrypt_done(struct crypto_async_request *areq, int err) if (!err) { struct xts_request_ctx *rctx = skcipher_request_ctx(req);
- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; + rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; err = xts_xor_tweak_post(req, false);
if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) { err = xts_cts_final(req, crypto_skcipher_decrypt); - if (err == -EINPROGRESS) + if (err == -EINPROGRESS || err == -EBUSY) return; } }
From: Hans de Goede hdegoede@redhat.com
[ Upstream commit 445110941eb94709216363f9d807d2508e64abd7 ]
led_put() is used to "undo" a successful of_led_get() call, of_led_get() uses class_find_device_by_of_node() which returns a reference to the device which must be free-ed with put_device() when the caller is done with it.
Add a put_device() call to led_put() to free the reference returned by class_find_device_by_of_node().
And also add a put_device() in the error-exit case of try_module_get() failing.
Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()") Reviewed-by: Andy Shevchenko andy.shevchenko@gmail.com Reviewed-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Lee Jones lee@kernel.org Link: https://lore.kernel.org/r/20230120114524.408368-2-hdegoede@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/leds/led-class.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 6a8ea94834fa3..7391d2cf1370a 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -241,8 +241,10 @@ struct led_classdev *of_led_get(struct device_node *np, int index)
led_cdev = dev_get_drvdata(led_dev);
- if (!try_module_get(led_cdev->dev->parent->driver->owner)) + if (!try_module_get(led_cdev->dev->parent->driver->owner)) { + put_device(led_cdev->dev); return ERR_PTR(-ENODEV); + }
return led_cdev; } @@ -255,6 +257,7 @@ EXPORT_SYMBOL_GPL(of_led_get); void led_put(struct led_classdev *led_cdev) { module_put(led_cdev->dev->parent->driver->owner); + put_device(led_cdev->dev); } EXPORT_SYMBOL_GPL(led_put);
From: Kees Cook keescook@chromium.org
[ Upstream commit 4076ea2419cf15bc1e1580f8b24ddf675fbdb02c ]
Both Coverity and GCC with -Wstringop-overflow noticed that nvif_outp_acquire_dp() accidentally defined its second argument with 1 additional element:
drivers/gpu/drm/nouveau/dispnv50/disp.c: In function 'nv50_pior_atomic_enable': drivers/gpu/drm/nouveau/dispnv50/disp.c:1813:17: error: 'nvif_outp_acquire_dp' accessing 16 bytes in a region of size 15 [-Werror=stringop-overflow=] 1813 | nvif_outp_acquire_dp(&nv_encoder->outp, nv_encoder->dp.dpcd, 0, 0, false, false); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/dispnv50/disp.c:1813:17: note: referencing argument 2 of type 'u8[16]' {aka 'unsigned char[16]'} drivers/gpu/drm/nouveau/include/nvif/outp.h:24:5: note: in a call to function 'nvif_outp_acquire_dp' 24 | int nvif_outp_acquire_dp(struct nvif_outp *, u8 dpcd[16], | ^~~~~~~~~~~~~~~~~~~~
Avoid these warnings by defining the argument size using the matching define (DP_RECEIVER_CAP_SIZE, 15) instead of having it be a literal (and incorrect) value (16).
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Addresses-Coverity-ID: 1527269 ("Memory - corruptions") Addresses-Coverity-ID: 1527268 ("Memory - corruptions") Link: https://lore.kernel.org/lkml/202211100848.FFBA2432@keescook/ Link: https://lore.kernel.org/lkml/202211100848.F4C2819BB@keescook/ Fixes: 813443721331 ("drm/nouveau/disp: move DP link config into acquire") Reviewed-by: Lyude Paul lyude@redhat.com Cc: Ben Skeggs bskeggs@redhat.com Cc: Karol Herbst kherbst@redhat.com Cc: David Airlie airlied@gmail.com Cc: Daniel Vetter daniel@ffwll.ch Cc: Dave Airlie airlied@redhat.com Cc: "Gustavo A. R. Silva" gustavo@embeddedor.com Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Signed-off-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/r/20221127183036.never.139-kees@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/nouveau/include/nvif/outp.h | 3 ++- drivers/gpu/drm/nouveau/nvif/outp.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/nouveau/include/nvif/outp.h b/drivers/gpu/drm/nouveau/include/nvif/outp.h index 45daadec3c0c7..fa76a7b5e4b37 100644 --- a/drivers/gpu/drm/nouveau/include/nvif/outp.h +++ b/drivers/gpu/drm/nouveau/include/nvif/outp.h @@ -3,6 +3,7 @@ #define __NVIF_OUTP_H__ #include <nvif/object.h> #include <nvif/if0012.h> +#include <drm/display/drm_dp.h> struct nvif_disp;
struct nvif_outp { @@ -21,7 +22,7 @@ int nvif_outp_acquire_rgb_crt(struct nvif_outp *); int nvif_outp_acquire_tmds(struct nvif_outp *, int head, bool hdmi, u8 max_ac_packet, u8 rekey, u8 scdc, bool hda); int nvif_outp_acquire_lvds(struct nvif_outp *, bool dual, bool bpc8); -int nvif_outp_acquire_dp(struct nvif_outp *, u8 dpcd[16], +int nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE], int link_nr, int link_bw, bool hda, bool mst); void nvif_outp_release(struct nvif_outp *); int nvif_outp_infoframe(struct nvif_outp *, u8 type, struct nvif_outp_infoframe_v0 *, u32 size); diff --git a/drivers/gpu/drm/nouveau/nvif/outp.c b/drivers/gpu/drm/nouveau/nvif/outp.c index 7da39f1eae9fb..c24bc5eae3ecf 100644 --- a/drivers/gpu/drm/nouveau/nvif/outp.c +++ b/drivers/gpu/drm/nouveau/nvif/outp.c @@ -127,7 +127,7 @@ nvif_outp_acquire(struct nvif_outp *outp, u8 proto, struct nvif_outp_acquire_v0 }
int -nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[16], +nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE], int link_nr, int link_bw, bool hda, bool mst) { struct nvif_outp_acquire_v0 args;
From: Ilya Leoshkevich iii@linux.ibm.com
[ Upstream commit bb4ef8fc3d193ed8d5583fb47cbeff5d8fb8302f ]
All the indirect jumps in the eBPF JIT already use expolines, except for the tail call one.
Fixes: de5cb6eb514e ("s390: use expoline thunks in the BPF JIT") Signed-off-by: Ilya Leoshkevich iii@linux.ibm.com Link: https://lore.kernel.org/r/20230129190501.1624747-3-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/net/bpf_jit_comp.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c index af35052d06ed6..fbdba4c306bea 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -1393,8 +1393,16 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, /* lg %r1,bpf_func(%r1) */ EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, REG_1, REG_0, offsetof(struct bpf_prog, bpf_func)); - /* bc 0xf,tail_call_start(%r1) */ - _EMIT4(0x47f01000 + jit->tail_call_start); + if (nospec_uses_trampoline()) { + jit->seen |= SEEN_FUNC; + /* aghi %r1,tail_call_start */ + EMIT4_IMM(0xa70b0000, REG_1, jit->tail_call_start); + /* brcl 0xf,__s390_indirect_jump_r1 */ + EMIT6_PCREL_RILC(0xc0040000, 0xf, jit->r1_thunk_ip); + } else { + /* bc 0xf,tail_call_start(%r1) */ + _EMIT4(0x47f01000 + jit->tail_call_start); + } /* out: */ if (jit->prg_buf) { *(u16 *)(jit->prg_buf + patch_1_clrj + 2) =
From: Gregory Greenman gregory.greenman@intel.com
[ Upstream commit 9cbd5a8abca904441e36861e3a92961bec41d13f ]
The rfkill() callback was invoked with wrong parameters. It was missed since MEI is defined now as depending on BROKEN. Fix that.
Fixes: d288067ede4b ("wifi: iwlwifi: mei: avoid blocking sap messages handling due to rtnl lock") Fixes: 5aa7ce31bd84 ("wifi: iwlwifi: mei: make sure ownership confirmed message is sent") Fixes: 95170a46b7dd ("wifi: iwlwifi: mei: don't send SAP commands if AMT is disabled") Link: https://lore.kernel.org/r/20230126222821.305122-2-gregory.greenman@intel.com Signed-off-by: Gregory Greenman gregory.greenman@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/intel/iwlwifi/mei/main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mei/main.c b/drivers/net/wireless/intel/iwlwifi/mei/main.c index f9d11935ed97e..67dfb77fedf79 100644 --- a/drivers/net/wireless/intel/iwlwifi/mei/main.c +++ b/drivers/net/wireless/intel/iwlwifi/mei/main.c @@ -788,7 +788,7 @@ static void iwl_mei_handle_amt_state(struct mei_cl_device *cldev, if (mei->amt_enabled) iwl_mei_set_init_conf(mei); else if (iwl_mei_cache.ops) - iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false, false); + iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, false);
schedule_work(&mei->netdev_work);
@@ -829,7 +829,7 @@ static void iwl_mei_handle_csme_taking_ownership(struct mei_cl_device *cldev, */ mei->csme_taking_ownership = true;
- iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, true, true); + iwl_mei_cache.ops->rfkill(iwl_mei_cache.priv, true); } else { iwl_mei_send_sap_msg(cldev, SAP_MSG_NOTIF_CSME_OWNERSHIP_CONFIRMED); @@ -1774,7 +1774,7 @@ int iwl_mei_register(void *priv, const struct iwl_mei_ops *ops) if (mei->amt_enabled) iwl_mei_send_sap_msg(mei->cldev, SAP_MSG_NOTIF_WIFIDR_UP); - ops->rfkill(priv, mei->link_prot_state, false); + ops->rfkill(priv, mei->link_prot_state); } } ret = 0;
From: Mark Brown broonie@kernel.org
[ Upstream commit 5f389238534ac8ca4ee3ab12eeb89d3984d303a1 ]
The current signal handling tests for SME do not account for the fact that unlike SVE all SME vector lengths are optional so we can't guarantee that we will encounter the minimum possible VL, they will hang enumerating VLs on such systems. Abort enumeration when we find the lowest VL.
Fixes: 4963aeb35a9e ("kselftest/arm64: signal: Add SME signal handling tests") Signed-off-by: Mark Brown broonie@kernel.org Link: https://lore.kernel.org/r/20230131-arm64-kselftest-sig-sme-no-128-v1-1-d47c1... Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/arm64/signal/testcases/ssve_regs.c | 4 ++++ tools/testing/selftests/arm64/signal/testcases/za_regs.c | 4 ++++ 2 files changed, 8 insertions(+)
diff --git a/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c b/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c index d0a178945b1a8..c6b17c47cac4c 100644 --- a/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c +++ b/tools/testing/selftests/arm64/signal/testcases/ssve_regs.c @@ -34,6 +34,10 @@ static bool sme_get_vls(struct tdescr *td)
vl &= PR_SME_VL_LEN_MASK;
+ /* Did we find the lowest supported VL? */ + if (vq < sve_vq_from_vl(vl)) + break; + /* Skip missing VLs */ vq = sve_vq_from_vl(vl);
diff --git a/tools/testing/selftests/arm64/signal/testcases/za_regs.c b/tools/testing/selftests/arm64/signal/testcases/za_regs.c index ea45acb115d5b..174ad66566964 100644 --- a/tools/testing/selftests/arm64/signal/testcases/za_regs.c +++ b/tools/testing/selftests/arm64/signal/testcases/za_regs.c @@ -34,6 +34,10 @@ static bool sme_get_vls(struct tdescr *td)
vl &= PR_SME_VL_LEN_MASK;
+ /* Did we find the lowest supported VL? */ + if (vq < sve_vq_from_vl(vl)) + break; + /* Skip missing VLs */ vq = sve_vq_from_vl(vl);
From: Geert Uytterhoeven geert+renesas@glider.be
[ Upstream commit 0a016639ef92b28eb74ba4fed21bee1f1328513a ]
When adding support for R-Car V3U, the Global FD Configuration register (CFDGFDCFG) and the Channel-specific CAN-FD Configuration Registers (CFDCmFDCFG) were mixed up. Use the correct register, and apply the selected CAN mode to all available channels.
Annotate the corresponding register bits, to make it clear they do not exist on older variants.
Fixes: 45721c406dcf50d4 ("can: rcar_canfd: Add support for r8a779a0 SoC") Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Link: https://lore.kernel.org/all/388ddf312917eb9f6cc460a481f68402a876f9b5.1674499... Signed-off-by: Marc Kleine-Budde mkl@pengutronix.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/can/rcar/rcar_canfd.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c index f6fa7157b99b0..88de17d0bd79d 100644 --- a/drivers/net/can/rcar/rcar_canfd.c +++ b/drivers/net/can/rcar/rcar_canfd.c @@ -197,8 +197,8 @@ #define RCANFD_DCFG_DBRP(x) (((x) & 0xff) << 0)
/* RSCFDnCFDCmFDCFG */ -#define RCANFD_FDCFG_CLOE BIT(30) -#define RCANFD_FDCFG_FDOE BIT(28) +#define RCANFD_V3U_FDCFG_CLOE BIT(30) +#define RCANFD_V3U_FDCFG_FDOE BIT(28) #define RCANFD_FDCFG_TDCE BIT(9) #define RCANFD_FDCFG_TDCOC BIT(8) #define RCANFD_FDCFG_TDCO(x) (((x) & 0x7f) >> 16) @@ -429,8 +429,8 @@ #define RCANFD_C_RPGACC(r) (0x1900 + (0x04 * (r)))
/* R-Car V3U Classical and CAN FD mode specific register map */ -#define RCANFD_V3U_CFDCFG (0x1314) #define RCANFD_V3U_DCFG(m) (0x1400 + (0x20 * (m))) +#define RCANFD_V3U_FDCFG(m) (0x1404 + (0x20 * (m)))
#define RCANFD_V3U_GAFL_OFFSET (0x1800)
@@ -689,12 +689,13 @@ static void rcar_canfd_tx_failure_cleanup(struct net_device *ndev) static void rcar_canfd_set_mode(struct rcar_canfd_global *gpriv) { if (is_v3u(gpriv)) { - if (gpriv->fdmode) - rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_CFDCFG, - RCANFD_FDCFG_FDOE); - else - rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_CFDCFG, - RCANFD_FDCFG_CLOE); + u32 ch, val = gpriv->fdmode ? RCANFD_V3U_FDCFG_FDOE + : RCANFD_V3U_FDCFG_CLOE; + + for_each_set_bit(ch, &gpriv->channels_mask, + gpriv->info->max_channels) + rcar_canfd_set_bit(gpriv->base, RCANFD_V3U_FDCFG(ch), + val); } else { if (gpriv->fdmode) rcar_canfd_set_bit(gpriv->base, RCANFD_GRMCFG,
From: Geert Uytterhoeven geert+renesas@glider.be
[ Upstream commit 9be8c5583581244d8a77e41afa16b8b0a5ddabc0 ]
Each Global Acceptance Filter List Configuration Register (GAFLCFG) contains two fields, and stores the number of channel rules for one channel pair.
As R-Car V3U and later can have more than 2 channels, the field selection should be based on the LSB (even or odd) of the channel number, instead of on the full channel number.
Fixes: 45721c406dcf50d4 ("can: rcar_canfd: Add support for r8a779a0 SoC") Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Link: https://lore.kernel.org/all/36bcf0ffb96d6aaed970751f9546b901af638bcf.1674499... Signed-off-by: Marc Kleine-Budde mkl@pengutronix.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/can/rcar/rcar_canfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c index 88de17d0bd79d..77b21c82faf38 100644 --- a/drivers/net/can/rcar/rcar_canfd.c +++ b/drivers/net/can/rcar/rcar_canfd.c @@ -92,10 +92,10 @@ /* RSCFDnCFDGAFLCFG0 / RSCFDnGAFLCFG0 */ #define RCANFD_GAFLCFG_SETRNC(gpriv, n, x) \ (((x) & reg_v3u(gpriv, 0x1ff, 0xff)) << \ - (reg_v3u(gpriv, 16, 24) - (n) * reg_v3u(gpriv, 16, 8))) + (reg_v3u(gpriv, 16, 24) - ((n) & 1) * reg_v3u(gpriv, 16, 8)))
#define RCANFD_GAFLCFG_GETRNC(gpriv, n, x) \ - (((x) >> (reg_v3u(gpriv, 16, 24) - (n) * reg_v3u(gpriv, 16, 8))) & \ + (((x) >> (reg_v3u(gpriv, 16, 24) - ((n) & 1) * reg_v3u(gpriv, 16, 8))) & \ reg_v3u(gpriv, 0x1ff, 0xff))
/* RSCFDnCFDGAFLECTR / RSCFDnGAFLECTR */
From: Ilya Leoshkevich iii@linux.ibm.com
[ Upstream commit 354bb4a0e0b6be8f55bacbe7f08c94b4741f5658 ]
xdp_synproxy/xdp fails in CI with:
Error: bpf_tc_hook_create: File exists
The XDP version of the test should not be calling bpf_tc_hook_create(); the reason it's happening anyway is that if we don't specify --tc on the command line, tc variable remains uninitialized.
Fixes: 784d5dc0efc2 ("selftests/bpf: Add selftests for raw syncookie helpers in TC mode") Reported-by: Alexei Starovoitov ast@kernel.org Reported-by: Joanne Koong joannelkoong@gmail.com Signed-off-by: Ilya Leoshkevich iii@linux.ibm.com Link: https://lore.kernel.org/r/20230202235335.3403781-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/bpf/xdp_synproxy.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/bpf/xdp_synproxy.c b/tools/testing/selftests/bpf/xdp_synproxy.c index 410a1385a01dd..6dbe0b7451985 100644 --- a/tools/testing/selftests/bpf/xdp_synproxy.c +++ b/tools/testing/selftests/bpf/xdp_synproxy.c @@ -116,6 +116,7 @@ static void parse_options(int argc, char *argv[], unsigned int *ifindex, __u32 * *tcpipopts = 0; *ports = NULL; *single = false; + *tc = false;
while (true) { int opt;
From: Tom Lendacky thomas.lendacky@amd.com
[ Upstream commit 46a334a98f585ef78d51d8f5736596887bdd7f54 ]
Perform a cache flush on the SEV-ES TMR memory after allocation to prevent any possibility of the firmware encountering an error should dirty cache lines be present. Use clflush_cache_range() to flush the SEV-ES TMR memory.
Fixes: 97f9ac3db661 ("crypto: ccp - Add support for SEV-ES to the PSP driver") Signed-off-by: Tom Lendacky thomas.lendacky@amd.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/crypto/ccp/sev-dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c index 56998bc579d67..3e583f0324874 100644 --- a/drivers/crypto/ccp/sev-dev.c +++ b/drivers/crypto/ccp/sev-dev.c @@ -26,6 +26,7 @@ #include <linux/fs_struct.h>
#include <asm/smp.h> +#include <asm/cacheflush.h>
#include "psp-dev.h" #include "sev-dev.h" @@ -1334,7 +1335,10 @@ void sev_pci_init(void)
/* Obtain the TMR memory area for SEV-ES use */ sev_es_tmr = sev_fw_alloc(SEV_ES_TMR_SIZE); - if (!sev_es_tmr) + if (sev_es_tmr) + /* Must flush the cache before giving it to the firmware */ + clflush_cache_range(sev_es_tmr, SEV_ES_TMR_SIZE); + else dev_warn(sev->dev, "SEV: TMR allocation failed, SEV-ES support unavailable\n");
From: Tonghao Zhang tong@infragraf.org
[ Upstream commit 377c16fa3f3c60d21e4b05314c8be034ce37f2eb ]
The number of online cpu may be not equal to possible cpu. "bpftool prog profile" can not create pmu event on possible but on online cpu.
$ dmidecode -s system-product-name PowerEdge R620 $ cat /sys/devices/system/cpu/possible 0-47 $ cat /sys/devices/system/cpu/online 0-31
Disable cpu dynamically: $ echo 0 > /sys/devices/system/cpu/cpuX/online
If one cpu is offline, perf_event_open will return ENODEV. To fix this issue: * check value returned and skip offline cpu. * close pmu_fd immediately on error path, avoid fd leaking.
Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command") Signed-off-by: Tonghao Zhang tong@infragraf.org Cc: Quentin Monnet quentin@isovalent.com Cc: Alexei Starovoitov ast@kernel.org Cc: Daniel Borkmann daniel@iogearbox.net Cc: Andrii Nakryiko andrii@kernel.org Cc: Martin KaFai Lau martin.lau@linux.dev Cc: Song Liu song@kernel.org Cc: Yonghong Song yhs@fb.com Cc: John Fastabend john.fastabend@gmail.com Cc: KP Singh kpsingh@kernel.org Cc: Stanislav Fomichev sdf@google.com Cc: Hao Luo haoluo@google.com Cc: Jiri Olsa jolsa@kernel.org Acked-by: John Fastabend john.fastabend@gmail.com Link: https://lore.kernel.org/r/20230202131701.29519-1-tong@infragraf.org Signed-off-by: Martin KaFai Lau martin.lau@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/bpf/bpftool/prog.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-)
diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c index cfc9fdc1e8634..e87738dbffc10 100644 --- a/tools/bpf/bpftool/prog.c +++ b/tools/bpf/bpftool/prog.c @@ -2233,10 +2233,38 @@ static void profile_close_perf_events(struct profiler_bpf *obj) profile_perf_event_cnt = 0; }
+static int profile_open_perf_event(int mid, int cpu, int map_fd) +{ + int pmu_fd; + + pmu_fd = syscall(__NR_perf_event_open, &metrics[mid].attr, + -1 /*pid*/, cpu, -1 /*group_fd*/, 0); + if (pmu_fd < 0) { + if (errno == ENODEV) { + p_info("cpu %d may be offline, skip %s profiling.", + cpu, metrics[mid].name); + profile_perf_event_cnt++; + return 0; + } + return -1; + } + + if (bpf_map_update_elem(map_fd, + &profile_perf_event_cnt, + &pmu_fd, BPF_ANY) || + ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) { + close(pmu_fd); + return -1; + } + + profile_perf_events[profile_perf_event_cnt++] = pmu_fd; + return 0; +} + static int profile_open_perf_events(struct profiler_bpf *obj) { unsigned int cpu, m; - int map_fd, pmu_fd; + int map_fd;
profile_perf_events = calloc( sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric); @@ -2255,17 +2283,11 @@ static int profile_open_perf_events(struct profiler_bpf *obj) if (!metrics[m].selected) continue; for (cpu = 0; cpu < obj->rodata->num_cpu; cpu++) { - pmu_fd = syscall(__NR_perf_event_open, &metrics[m].attr, - -1/*pid*/, cpu, -1/*group_fd*/, 0); - if (pmu_fd < 0 || - bpf_map_update_elem(map_fd, &profile_perf_event_cnt, - &pmu_fd, BPF_ANY) || - ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) { + if (profile_open_perf_event(m, cpu, map_fd)) { p_err("failed to create event %s on cpu %d", metrics[m].name, cpu); return -1; } - profile_perf_events[profile_perf_event_cnt++] = pmu_fd; } } return 0;
From: Felix Fietkau nbd@nbd.name
[ Upstream commit de19b9c83654e323d83f839a550ca4af37fea15b ]
When mt7921_abort_roc is called with dev->mutex held, it can deadlock while calling cancel_work_sync(&phy->roc_work), because the work function could be waiting to acquire the mutex.
Fix this by flushing the work before taking the mutex
Reported-by: Mikhail Gavrilov mikhail.v.gavrilov@gmail.com Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support") Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/mediatek/mt76/mt7921/main.c | 22 ++++++------------- 1 file changed, 7 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c index 76ac5069638fe..722df8eea91f7 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c @@ -422,15 +422,15 @@ void mt7921_roc_timer(struct timer_list *timer)
static int mt7921_abort_roc(struct mt7921_phy *phy, struct mt7921_vif *vif) { - int err; - - if (!test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) - return 0; + int err = 0;
del_timer_sync(&phy->roc_timer); cancel_work_sync(&phy->roc_work); - err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id); - clear_bit(MT76_STATE_ROC, &phy->mt76->state); + + mt7921_mutex_acquire(phy->dev); + if (test_and_clear_bit(MT76_STATE_ROC, &phy->mt76->state)) + err = mt7921_mcu_abort_roc(phy, vif, phy->roc_token_id); + mt7921_mutex_release(phy->dev);
return err; } @@ -487,13 +487,8 @@ static int mt7921_cancel_remain_on_channel(struct ieee80211_hw *hw, { struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv; struct mt7921_phy *phy = mt7921_hw_phy(hw); - int err;
- mt7921_mutex_acquire(phy->dev); - err = mt7921_abort_roc(phy, mvif); - mt7921_mutex_release(phy->dev); - - return err; + return mt7921_abort_roc(phy, mvif); }
static int mt7921_set_channel(struct mt7921_phy *phy) @@ -1778,11 +1773,8 @@ static void mt7921_mgd_complete_tx(struct ieee80211_hw *hw, struct ieee80211_prep_tx_info *info) { struct mt7921_vif *mvif = (struct mt7921_vif *)vif->drv_priv; - struct mt7921_dev *dev = mt7921_hw_dev(hw);
- mt7921_mutex_acquire(dev); mt7921_abort_roc(mvif->phy, mvif); - mt7921_mutex_release(dev); }
const struct ieee80211_ops mt7921_ops = {
From: Howard Hsu howard-yh.hsu@mediatek.com
[ Upstream commit 7d12b38ab6f6b77198cd3a66db19587bbdd3308c ]
Enable thermal management by default shall not be executed during mcu init. This causes thermal configuration being reset to the firmware default settings.
Fixes: 0063b86c9120 ("mt76: mt7915e: Enable thermal management by default") Reviewed-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Howard Hsu howard-yh.hsu@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7915/init.c | 3 +-- drivers/net/wireless/mediatek/mt76/mt7915/main.c | 6 ++++++ 2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c index c810c31fbd6e9..41019ba24a048 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c @@ -201,8 +201,7 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) phy->throttle_temp[0] = 110; phy->throttle_temp[1] = 120;
- return mt7915_mcu_set_thermal_throttling(phy, - MT7915_THERMAL_THROTTLE_MAX); + return 0; }
static void mt7915_led_set_config(struct led_classdev *led_cdev, diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c index 0511d6a505b09..98af032eba097 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c @@ -57,6 +57,12 @@ int mt7915_run(struct ieee80211_hw *hw) mt7915_mac_enable_nf(dev, phy->mt76->band_idx); }
+ ret = mt7915_mcu_set_thermal_throttling(phy, + MT7915_THERMAL_THROTTLE_MAX); + + if (ret) + goto out; + ret = mt76_connac_mcu_set_rts_thresh(&dev->mt76, 0x92b, phy->mt76->band_idx); if (ret)
From: Howard Hsu howard-yh.hsu@mediatek.com
[ Upstream commit 5ad42d19f6596e54b091827c397fdb7c091d45f7 ]
This patch includes 2 changes: 1. Firmware expects to disable thermal protect first before reconfiguring. 2. Separate setting thermal_protect and setting thermal_tx_duty into different functions. These two firmware commands do not need to send together.
Fixes: 34b877d972be ("mt76: mt7915: add thermal cooling device support") Reviewed-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Howard Hsu howard-yh.hsu@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/mediatek/mt76/mt7915/init.c | 3 -- .../net/wireless/mediatek/mt76/mt7915/main.c | 5 ++ .../net/wireless/mediatek/mt76/mt7915/mcu.c | 54 +++++++++++-------- .../wireless/mediatek/mt76/mt7915/mt7915.h | 1 + 4 files changed, 37 insertions(+), 26 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c index 41019ba24a048..4c351bfd4b270 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c @@ -134,9 +134,6 @@ mt7915_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev, if (state > MT7915_CDEV_THROTTLE_MAX) return -EINVAL;
- if (phy->throttle_temp[0] > phy->throttle_temp[1]) - return 0; - if (state == phy->cdev_state) return 0;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c index 98af032eba097..7589af4b3dab7 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c @@ -60,6 +60,11 @@ int mt7915_run(struct ieee80211_hw *hw) ret = mt7915_mcu_set_thermal_throttling(phy, MT7915_THERMAL_THROTTLE_MAX);
+ if (ret) + goto out; + + ret = mt7915_mcu_set_thermal_protect(phy); + if (ret) goto out;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index d9d6846ba8e02..a861312ba3ed1 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -3060,6 +3060,29 @@ int mt7915_mcu_get_temperature(struct mt7915_phy *phy) }
int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state) +{ + struct mt7915_dev *dev = phy->dev; + struct mt7915_mcu_thermal_ctrl req = { + .band_idx = phy->mt76->band_idx, + .ctrl_id = THERMAL_PROTECT_DUTY_CONFIG, + }; + int level, ret; + + /* set duty cycle and level */ + for (level = 0; level < 4; level++) { + req.duty.duty_level = level; + req.duty.duty_cycle = state; + state /= 2; + + ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT), + &req, sizeof(req), false); + if (ret) + return ret; + } + return 0; +} + +int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy) { struct mt7915_dev *dev = phy->dev; struct { @@ -3072,29 +3095,18 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state) } __packed req = { .ctrl = { .band_idx = phy->mt76->band_idx, + .type.protect_type = 1, + .type.trigger_type = 1, }, }; - int level; - - if (!state) { - req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE; - goto out; - } - - /* set duty cycle and level */ - for (level = 0; level < 4; level++) { - int ret; + int ret;
- req.ctrl.ctrl_id = THERMAL_PROTECT_DUTY_CONFIG; - req.ctrl.duty.duty_level = level; - req.ctrl.duty.duty_cycle = state; - state /= 2; + req.ctrl.ctrl_id = THERMAL_PROTECT_DISABLE; + ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT), + &req, sizeof(req.ctrl), false);
- ret = mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT), - &req, sizeof(req.ctrl), false); - if (ret) - return ret; - } + if (ret) + return ret;
/* set high-temperature trigger threshold */ req.ctrl.ctrl_id = THERMAL_PROTECT_ENABLE; @@ -3103,10 +3115,6 @@ int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state) req.trigger_temp = cpu_to_le32(phy->throttle_temp[1]); req.sustain_time = cpu_to_le16(10);
-out: - req.ctrl.type.protect_type = 1; - req.ctrl.type.trigger_type = 1; - return mt76_mcu_send_msg(&dev->mt76, MCU_EXT_CMD(THERMAL_PROT), &req, sizeof(req), false); } diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h index 6351feba6bdf9..855779f86bde0 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h @@ -543,6 +543,7 @@ int mt7915_mcu_apply_tx_dpd(struct mt7915_phy *phy); int mt7915_mcu_get_chan_mib_info(struct mt7915_phy *phy, bool chan_switch); int mt7915_mcu_get_temperature(struct mt7915_phy *phy); int mt7915_mcu_set_thermal_throttling(struct mt7915_phy *phy, u8 state); +int mt7915_mcu_set_thermal_protect(struct mt7915_phy *phy); int mt7915_mcu_get_rx_rate(struct mt7915_phy *phy, struct ieee80211_vif *vif, struct ieee80211_sta *sta, struct rate_info *rate); int mt7915_mcu_rdd_background_enable(struct mt7915_phy *phy,
From: Howard Hsu howard-yh.hsu@mediatek.com
[ Upstream commit ecaccdae7a7e8f76eeb6544295ca0593c2f65a33 ]
Call mt7915_mcu_set_thermal_protect() through mt7915_thermal_temp_store() to update firmware trigger/restore temp directly.
Fixes: 02ee68b95d81 ("mt76: mt7915: add control knobs for thermal throttling") Reviewed-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Howard Hsu howard-yh.hsu@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/mediatek/mt76/mt7915/init.c | 18 ++++++++++++++++-- .../net/wireless/mediatek/mt76/mt7915/mt7915.h | 3 +++ 2 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c index 4c351bfd4b270..a80ae31e7abff 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c @@ -83,9 +83,23 @@ static ssize_t mt7915_thermal_temp_store(struct device *dev,
mutex_lock(&phy->dev->mt76.mutex); val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 60, 130); + + if ((i - 1 == MT7915_CRIT_TEMP_IDX && + val > phy->throttle_temp[MT7915_MAX_TEMP_IDX]) || + (i - 1 == MT7915_MAX_TEMP_IDX && + val < phy->throttle_temp[MT7915_CRIT_TEMP_IDX])) { + dev_err(phy->dev->mt76.dev, + "temp1_max shall be greater than temp1_crit."); + return -EINVAL; + } + phy->throttle_temp[i - 1] = val; mutex_unlock(&phy->dev->mt76.mutex);
+ ret = mt7915_mcu_set_thermal_protect(phy); + if (ret) + return ret; + return count; }
@@ -195,8 +209,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy) return PTR_ERR(hwmon);
/* initialize critical/maximum high temperature */ - phy->throttle_temp[0] = 110; - phy->throttle_temp[1] = 120; + phy->throttle_temp[MT7915_CRIT_TEMP_IDX] = 110; + phy->throttle_temp[MT7915_MAX_TEMP_IDX] = 120;
return 0; } diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h index 855779f86bde0..e58650bbbd14a 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mt7915.h @@ -70,6 +70,9 @@
#define MT7915_WED_RX_TOKEN_SIZE 12288
+#define MT7915_CRIT_TEMP_IDX 0 +#define MT7915_MAX_TEMP_IDX 1 + struct mt7915_vif; struct mt7915_sta; struct mt7915_dfs_pulse;
From: Deren Wu deren.wu@mediatek.com
[ Upstream commit 914189af23b83c9a83a0137a3a40f17de7d2c618 ]
When the chanctx enabled, IEEE80211_CONF_CHANGE_CHANNEL in .config() would not be called anymore. mt76 cannot control RF channel for monitor. Add monitor type set-channel flow in .change_chanctx().
Fixes: 41ac53c899bd ("wifi: mt76: mt7921: introduce chanctx support") Reviewed-by: Sean Wang sean.wang@mediatek.com Signed-off-by: Deren Wu deren.wu@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/mediatek/mt76/mt7921/main.c | 5 +- .../net/wireless/mediatek/mt76/mt7921/mcu.c | 68 +++++++++++++++++++ .../wireless/mediatek/mt76/mt7921/mt7921.h | 2 + 3 files changed, 74 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c index 722df8eea91f7..cdb0d61903935 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c @@ -1706,7 +1706,10 @@ static void mt7921_ctx_iter(void *priv, u8 *mac, if (ctx != mvif->ctx) return;
- mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->mt76, ctx); + if (vif->type & NL80211_IFTYPE_MONITOR) + mt7921_mcu_config_sniffer(mvif, ctx); + else + mt76_connac_mcu_uni_set_chctx(mvif->phy->mt76, &mvif->mt76, ctx); }
static void diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c index fb9c0f66cb27c..bd929b5f2504f 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c @@ -1093,6 +1093,74 @@ int mt7921_mcu_set_sniffer(struct mt7921_dev *dev, struct ieee80211_vif *vif, true); }
+int mt7921_mcu_config_sniffer(struct mt7921_vif *vif, + struct ieee80211_chanctx_conf *ctx) +{ + struct cfg80211_chan_def *chandef = &ctx->def; + int freq1 = chandef->center_freq1, freq2 = chandef->center_freq2; + const u8 ch_band[] = { + [NL80211_BAND_2GHZ] = 1, + [NL80211_BAND_5GHZ] = 2, + [NL80211_BAND_6GHZ] = 3, + }; + const u8 ch_width[] = { + [NL80211_CHAN_WIDTH_20_NOHT] = 0, + [NL80211_CHAN_WIDTH_20] = 0, + [NL80211_CHAN_WIDTH_40] = 0, + [NL80211_CHAN_WIDTH_80] = 1, + [NL80211_CHAN_WIDTH_160] = 2, + [NL80211_CHAN_WIDTH_80P80] = 3, + [NL80211_CHAN_WIDTH_5] = 4, + [NL80211_CHAN_WIDTH_10] = 5, + [NL80211_CHAN_WIDTH_320] = 6, + }; + struct { + struct { + u8 band_idx; + u8 pad[3]; + } __packed hdr; + struct config_tlv { + __le16 tag; + __le16 len; + u16 aid; + u8 ch_band; + u8 bw; + u8 control_ch; + u8 sco; + u8 center_ch; + u8 center_ch2; + u8 drop_err; + u8 pad[3]; + } __packed tlv; + } __packed req = { + .hdr = { + .band_idx = vif->mt76.band_idx, + }, + .tlv = { + .tag = cpu_to_le16(1), + .len = cpu_to_le16(sizeof(req.tlv)), + .control_ch = chandef->chan->hw_value, + .center_ch = ieee80211_frequency_to_channel(freq1), + .drop_err = 1, + }, + }; + if (chandef->chan->band < ARRAY_SIZE(ch_band)) + req.tlv.ch_band = ch_band[chandef->chan->band]; + if (chandef->width < ARRAY_SIZE(ch_width)) + req.tlv.bw = ch_width[chandef->width]; + + if (freq2) + req.tlv.center_ch2 = ieee80211_frequency_to_channel(freq2); + + if (req.tlv.control_ch < req.tlv.center_ch) + req.tlv.sco = 1; /* SCA */ + else if (req.tlv.control_ch > req.tlv.center_ch) + req.tlv.sco = 3; /* SCB */ + + return mt76_mcu_send_msg(vif->phy->mt76->dev, MCU_UNI_CMD(SNIFFER), + &req, sizeof(req), true); +} + int mt7921_mcu_uni_add_beacon_offload(struct mt7921_dev *dev, struct ieee80211_hw *hw, diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h index 15d6b7fe1c6c8..d4cfa26c373c3 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h @@ -529,6 +529,8 @@ void mt7921_set_ipv6_ns_work(struct work_struct *work);
int mt7921_mcu_set_sniffer(struct mt7921_dev *dev, struct ieee80211_vif *vif, bool enable); +int mt7921_mcu_config_sniffer(struct mt7921_vif *vif, + struct ieee80211_chanctx_conf *ctx);
int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, enum mt76_txq_id qid, struct mt76_wcid *wcid,
From: Shayne Chen shayne.chen@mediatek.com
[ Upstream commit eb1fdb9f5a2280de6820624cd02e0863babab683 ]
Fix per-band chainmask when restoring from the dev chainmask.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Shayne Chen shayne.chen@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c index 4421cd54311b1..c423b052e4f4c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c @@ -880,7 +880,10 @@ mt7996_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant) phy->mt76->antenna_mask = tx_ant;
/* restore to the origin chainmask which might have auxiliary path */ - if (hweight8(tx_ant) == max_nss) + if (hweight8(tx_ant) == max_nss && band_idx < MT_BAND2) + phy->mt76->chainmask = ((dev->chainmask >> shift) & + (BIT(dev->chainshift[band_idx + 1] - shift) - 1)) << shift; + else if (hweight8(tx_ant) == max_nss) phy->mt76->chainmask = (dev->chainmask >> shift) << shift; else phy->mt76->chainmask = tx_ant << shift;
From: Shayne Chen shayne.chen@mediatek.com
[ Upstream commit 793445cf812506375cbe4c59d0fb9f648f716e88 ]
In newer chipsets, CFEND_RATE setting has been moved to different hw module.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Shayne Chen shayne.chen@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +- drivers/net/wireless/mediatek/mt76/mt7996/mmio.c | 1 + drivers/net/wireless/mediatek/mt76/mt7996/regs.h | 15 ++++++++------- 3 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c index 0b3e28748e76b..ce4242f90e9f9 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c @@ -1690,7 +1690,7 @@ void mt7996_mac_set_timing(struct mt7996_phy *phy) else val = MT7996_CFEND_RATE_11B;
- mt76_rmw_field(dev, MT_AGG_ACR0(band_idx), MT_AGG_ACR_CFEND_RATE, val); + mt76_rmw_field(dev, MT_RATE_HRCR0(band_idx), MT_RATE_HRCR0_CFEND_RATE, val); mt76_clear(dev, MT_ARB_SCR(band_idx), MT_ARB_SCR_TX_DISABLE | MT_ARB_SCR_RX_DISABLE); } diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c index 60781d046216a..d8a2c1a744b25 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c @@ -21,6 +21,7 @@ static const struct __base mt7996_reg_base[] = { [WF_ETBF_BASE] = { { 0x820ea000, 0x820fa000, 0x830ea000 } }, [WF_LPON_BASE] = { { 0x820eb000, 0x820fb000, 0x830eb000 } }, [WF_MIB_BASE] = { { 0x820ed000, 0x820fd000, 0x830ed000 } }, + [WF_RATE_BASE] = { { 0x820ee000, 0x820fe000, 0x830ee000 } }, };
static const struct __map mt7996_reg_map[] = { diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h index 42980b97b4d41..7a28cae34e34b 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/regs.h +++ b/drivers/net/wireless/mediatek/mt76/mt7996/regs.h @@ -33,6 +33,7 @@ enum base_rev { WF_ETBF_BASE, WF_LPON_BASE, WF_MIB_BASE, + WF_RATE_BASE, __MT_REG_BASE_MAX, };
@@ -235,13 +236,6 @@ enum base_rev { FIELD_PREP(MT_WTBL_LMAC_ID, _id) | \ FIELD_PREP(MT_WTBL_LMAC_DW, _dw))
-/* AGG: band 0(0x820e2000), band 1(0x820f2000), band 2(0x830e2000) */ -#define MT_WF_AGG_BASE(_band) __BASE(WF_AGG_BASE, (_band)) -#define MT_WF_AGG(_band, ofs) (MT_WF_AGG_BASE(_band) + (ofs)) - -#define MT_AGG_ACR0(_band) MT_WF_AGG(_band, 0x054) -#define MT_AGG_ACR_CFEND_RATE GENMASK(13, 0) - /* ARB: band 0(0x820e3000), band 1(0x820f3000), band 2(0x830e3000) */ #define MT_WF_ARB_BASE(_band) __BASE(WF_ARB_BASE, (_band)) #define MT_WF_ARB(_band, ofs) (MT_WF_ARB_BASE(_band) + (ofs)) @@ -300,6 +294,13 @@ enum base_rev { #define MT_WF_RMAC_RSVD0(_band) MT_WF_RMAC(_band, 0x03e0) #define MT_WF_RMAC_RSVD0_EIFS_CLR BIT(21)
+/* RATE: band 0(0x820ee000), band 1(0x820fe000), band 2(0x830ee000) */ +#define MT_WF_RATE_BASE(_band) __BASE(WF_RATE_BASE, (_band)) +#define MT_WF_RATE(_band, ofs) (MT_WF_RATE_BASE(_band) + (ofs)) + +#define MT_RATE_HRCR0(_band) MT_WF_RATE(_band, 0x050) +#define MT_RATE_HRCR0_CFEND_RATE GENMASK(14, 0) + /* WFDMA0 */ #define MT_WFDMA0_BASE 0xd4000 #define MT_WFDMA0(ofs) (MT_WFDMA0_BASE + (ofs))
From: Shayne Chen shayne.chen@mediatek.com
[ Upstream commit 0d82fc956edb67b5755cc64ac6b9aee79cfbbff0 ]
Fix typo MCU_UNI_CMD_POWER_CREL to MCU_UNI_CMD_POWER_CTRL.
Fixes: 779d34de055e ("wifi: mt76: connac: add more unified command IDs") Signed-off-by: Shayne Chen shayne.chen@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 2 +- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h index f1e942b9a887b..82fdf6d794bcf 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h @@ -1198,7 +1198,7 @@ enum { MCU_UNI_CMD_REPT_MUAR = 0x09, MCU_UNI_CMD_WSYS_CONFIG = 0x0b, MCU_UNI_CMD_REG_ACCESS = 0x0d, - MCU_UNI_CMD_POWER_CREL = 0x0f, + MCU_UNI_CMD_POWER_CTRL = 0x0f, MCU_UNI_CMD_RX_HDR_TRANS = 0x12, MCU_UNI_CMD_SER = 0x13, MCU_UNI_CMD_TWT = 0x14, diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index a88fc7680b1a9..d781c6e0f33ac 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -2399,7 +2399,7 @@ mt7996_mcu_restart(struct mt76_dev *dev) .power_mode = 1, };
- return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CREL), &req, + return mt76_mcu_send_msg(dev, MCU_WM_UNI_CMD(POWER_CTRL), &req, sizeof(req), false); }
From: Deren Wu deren.wu@mediatek.com
[ Upstream commit c36457a8f34d1e0fc55fbbd7b8b2d716af3f6289 ]
round_jiffies_up() may change the duration reported from chip. We should take the real timeout for current channel privilege.
Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Signed-off-by: Deren Wu deren.wu@mediatek.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c index bd929b5f2504f..7253ce90234ef 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c @@ -174,7 +174,7 @@ mt7921_mcu_uni_roc_event(struct mt7921_dev *dev, struct sk_buff *skb) wake_up(&dev->phy.roc_wait); duration = le32_to_cpu(grant->max_interval); mod_timer(&dev->phy.roc_timer, - round_jiffies_up(jiffies + msecs_to_jiffies(duration))); + jiffies + msecs_to_jiffies(duration)); }
static void
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit 49bd78282e79ad177d14f37f4049f0605bf92dad ]
Always purge mcu skb queues in mt7915_mcu_exit routine even if mt7915_firmware_state fails.
Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index a861312ba3ed1..f566ba77b2ed4 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -2349,13 +2349,14 @@ void mt7915_mcu_exit(struct mt7915_dev *dev) __mt76_mcu_restart(&dev->mt76); if (mt7915_firmware_state(dev, false)) { dev_err(dev->mt76.dev, "Failed to exit mcu\n"); - return; + goto out; }
mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN); if (dev->hif2) mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1), MT_TOP_LPCR_HOST_FW_OWN); +out: skb_queue_purge(&dev->mt76.mcu.res_q); }
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit da5b4d93e141b52c5a71d0c41a042d1bcaf70d2e ]
Always purge mcu skb queues in mt7996_mcu_exit routine even if mt7996_firmware_state fails.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c index d781c6e0f33ac..d593ed9e3f73c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c @@ -2460,13 +2460,14 @@ void mt7996_mcu_exit(struct mt7996_dev *dev) __mt76_mcu_restart(&dev->mt76); if (mt7996_firmware_state(dev, false)) { dev_err(dev->mt76.dev, "Failed to exit mcu\n"); - return; + goto out; }
mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(0), MT_TOP_LPCR_HOST_FW_OWN); if (dev->hif2) mt76_wr(dev, MT_TOP_LPCR_HOST_BAND(1), MT_TOP_LPCR_HOST_FW_OWN); +out: skb_queue_purge(&dev->mt76.mcu.res_q); }
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit 3f7dda36e0b6dfa2cd26191f754ba061ab8191f2 ]
Fix device unregister memory leak and alway cleanup all configured rx queues in mt76_dma_tx_cleanup routine.
Fixes: 52546e27787e ("wifi: mt76: add WED RX support to dma queue alloc") Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/dma.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c index 06161815c180e..dee4449de9082 100644 --- a/drivers/net/wireless/mediatek/mt76/dma.c +++ b/drivers/net/wireless/mediatek/mt76/dma.c @@ -975,8 +975,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev) struct mt76_queue *q = &dev->q_rx[i];
netif_napi_del(&dev->napi[i]); - if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags)) - mt76_dma_rx_cleanup(dev, q); + mt76_dma_rx_cleanup(dev, q); }
mt76_free_pending_txwi(dev);
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit aed8d9b506c22848add261ffad8fdabc57f21964 ]
The switch default case for frame_contorl is invalid. Return -EINVAL error for it.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c index ce4242f90e9f9..96ced4c039ce1 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c @@ -469,7 +469,7 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap) ether_addr_copy(hdr.addr4, eth_hdr->h_source); break; default: - break; + return -EINVAL; }
skb_pull(skb, hdr_gap + sizeof(struct ethhdr) - 2);
From: Ryder Lee ryder.lee@mediatek.com
[ Upstream commit 0d7084e209a9e2c924cb0d6e7f1f978db2a54127 ]
The previous commit forgot to remove a leftover check.
Fixes: 43eaa3689507 ("wifi: mt76: add PPDU based TxS support for WED device") Reported-By: Sujuan Chen sujuan.chen@mediatek.com Signed-off-by: Ryder Lee ryder.lee@mediatek.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 3 --- 1 file changed, 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c index f0d5a3603902a..1a6def77db571 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c @@ -1061,9 +1061,6 @@ static void mt7915_mac_add_txs(struct mt7915_dev *dev, void *data) u16 wcidx; u8 pid;
- if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) > 1) - return; - wcidx = le32_get_bits(txs_data[2], MT_TXS2_WCID); pid = le32_get_bits(txs_data[3], MT_TXS3_PID);
From: Deren Wu deren.wu@mediatek.com
[ Upstream commit 5f54237ad798f41cb6a503271aa9ca47188cfb9b ]
Ensure the entry has been fully updated before SDIO bus worker access it. This patch would fix potential memory risk in both mt7663s and mt7921s.
Fixes: 764dee47e2c1 ("mt76: sdio: move common code in mt76_sdio module") Signed-off-by: Deren Wu deren.wu@mediatek.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/sdio.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c index 228bc7d45011c..419723118ded8 100644 --- a/drivers/net/wireless/mediatek/mt76/sdio.c +++ b/drivers/net/wireless/mediatek/mt76/sdio.c @@ -562,6 +562,10 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
q->entry[q->head].buf_sz = len; q->entry[q->head].skb = skb; + + /* ensure the entry fully updated before bus access */ + smp_wmb(); + q->head = (q->head + 1) % q->ndesc; q->queued++;
From: Aaron Ma aaron.ma@canonical.com
[ Upstream commit 888d89034f9eaeab9b5b75f13dbe35376c7dd471 ]
Kernel NULL pointer dereference when ACPI SAR table isn't implemented well. Fix the error code of return to mark the ACPI SAR table as invalid.
[ 5.077128] mt7921e 0000:06:00.0: sar cnt = 0 [ 5.077381] BUG: kernel NULL pointer dereference, address: 0000000000000004 [ 5.077630] #PF: supervisor read access in kernel mode [ 5.077883] #PF: error_code(0x0000) - not-present page [ 5.078138] PGD 0 P4D 0 [ 5.078398] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 5.079202] RIP: 0010:mt7921_init_acpi_sar+0x106/0x220 [mt7921_common] ... [ 5.080786] Call Trace: [ 5.080786] <TASK> [ 5.080786] mt7921_register_device+0x37d/0x490 [mt7921_common] [ 5.080786] mt7921_pci_probe.part.0+0x2ee/0x310 [mt7921e] [ 5.080786] mt7921_pci_probe+0x52/0x70 [mt7921e] [ 5.080786] local_pci_probe+0x47/0x90 [ 5.080786] pci_call_probe+0x55/0x190 [ 5.080786] pci_device_probe+0x84/0x120
Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support") Signed-off-by: Aaron Ma aaron.ma@canonical.com Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c b/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c index 47e034a9b0037..ed9241d4aa641 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/acpi_sar.c @@ -33,14 +33,17 @@ mt7921_acpi_read(struct mt7921_dev *dev, u8 *method, u8 **tbl, u32 *len) sar_root->package.elements[0].type != ACPI_TYPE_INTEGER) { dev_err(mdev->dev, "sar cnt = %d\n", sar_root->package.count); + ret = -EINVAL; goto free; }
if (!*tbl) { *tbl = devm_kzalloc(mdev->dev, sar_root->package.count, GFP_KERNEL); - if (!*tbl) + if (!*tbl) { + ret = -ENOMEM; goto free; + } } if (len) *len = sar_root->package.count; @@ -52,9 +55,9 @@ mt7921_acpi_read(struct mt7921_dev *dev, u8 *method, u8 **tbl, u32 *len) break; *(*tbl + i) = (u8)sar_unit->integer.value; } -free: ret = (i == sar_root->package.count) ? 0 : -EINVAL;
+free: kfree(sar_root);
return ret;
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit 0b8e2d69467f78a7c9d87b452220e87012435e33 ]
In order to fix a possible NULL pointer dereference in mt7996_mac_write_txwi() of vif pointer, export mt76_connac2_mac_tx_rate_val utility routine and reuse it in mt7996 driver.
Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/mediatek/mt76/mt76_connac.h | 3 ++ .../wireless/mediatek/mt76/mt76_connac_mac.c | 7 +-- .../net/wireless/mediatek/mt76/mt7996/mac.c | 48 +------------------ 3 files changed, 9 insertions(+), 49 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac.h index 8ba883b03e500..2ee9a3c8e25c4 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76_connac.h +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac.h @@ -370,6 +370,9 @@ void mt76_connac2_mac_write_txwi(struct mt76_dev *dev, __le32 *txwi, struct sk_buff *skb, struct mt76_wcid *wcid, struct ieee80211_key_conf *key, int pid, enum mt76_txq_id qid, u32 changed); +u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, + struct ieee80211_vif *vif, + bool beacon, bool mcast); bool mt76_connac2_mac_fill_txs(struct mt76_dev *dev, struct mt76_wcid *wcid, __le32 *txs_data); bool mt76_connac2_mac_add_txs_skb(struct mt76_dev *dev, struct mt76_wcid *wcid, diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c index c8d0c84e688b8..aed4ee95fb2ec 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c @@ -267,9 +267,9 @@ int mt76_connac_init_tx_queues(struct mt76_phy *phy, int idx, int n_desc, } EXPORT_SYMBOL_GPL(mt76_connac_init_tx_queues);
-static u16 -mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif, - bool beacon, bool mcast) +u16 mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, + struct ieee80211_vif *vif, + bool beacon, bool mcast) { u8 mode = 0, band = mphy->chandef.chan->band; int rateidx = 0, mcast_rate; @@ -319,6 +319,7 @@ mt76_connac2_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif, return FIELD_PREP(MT_TX_RATE_IDX, rateidx) | FIELD_PREP(MT_TX_RATE_MODE, mode); } +EXPORT_SYMBOL_GPL(mt76_connac2_mac_tx_rate_val);
static void mt76_connac2_mac_write_txwi_8023(__le32 *txwi, struct sk_buff *skb, diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c index 96ced4c039ce1..0eb9e4d73f2c1 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c @@ -959,51 +959,6 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi, } }
-static u16 -mt7996_mac_tx_rate_val(struct mt76_phy *mphy, struct ieee80211_vif *vif, - bool beacon, bool mcast) -{ - u8 mode = 0, band = mphy->chandef.chan->band; - int rateidx = 0, mcast_rate; - - if (beacon) { - struct cfg80211_bitrate_mask *mask; - - mask = &vif->bss_conf.beacon_tx_rate; - if (hweight16(mask->control[band].he_mcs[0]) == 1) { - rateidx = ffs(mask->control[band].he_mcs[0]) - 1; - mode = MT_PHY_TYPE_HE_SU; - goto out; - } else if (hweight16(mask->control[band].vht_mcs[0]) == 1) { - rateidx = ffs(mask->control[band].vht_mcs[0]) - 1; - mode = MT_PHY_TYPE_VHT; - goto out; - } else if (hweight8(mask->control[band].ht_mcs[0]) == 1) { - rateidx = ffs(mask->control[band].ht_mcs[0]) - 1; - mode = MT_PHY_TYPE_HT; - goto out; - } else if (hweight32(mask->control[band].legacy) == 1) { - rateidx = ffs(mask->control[band].legacy) - 1; - goto legacy; - } - } - - mcast_rate = vif->bss_conf.mcast_rate[band]; - if (mcast && mcast_rate > 0) - rateidx = mcast_rate - 1; - else - rateidx = ffs(vif->bss_conf.basic_rates) - 1; - -legacy: - rateidx = mt76_calculate_default_rate(mphy, rateidx); - mode = rateidx >> 8; - rateidx &= GENMASK(7, 0); - -out: - return FIELD_PREP(MT_TX_RATE_IDX, rateidx) | - FIELD_PREP(MT_TX_RATE_MODE, mode); -} - void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, struct sk_buff *skb, struct mt76_wcid *wcid, int pid, struct ieee80211_key_conf *key, u32 changed) @@ -1091,7 +1046,8 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi, /* Fixed rata is available just for 802.11 txd */ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; bool multicast = is_multicast_ether_addr(hdr->addr1); - u16 rate = mt7996_mac_tx_rate_val(mphy, vif, beacon, multicast); + u16 rate = mt76_connac2_mac_tx_rate_val(mphy, vif, beacon, + multicast);
/* fix to bw 20 */ val = MT_TXD6_FIXED_BW |
From: Jack Morgenstein jackm@nvidia.com
[ Upstream commit 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 ]
Provide more details to aid debugging.
Fixes: bf0bf77f6519 ("mlx5: Support communicating arbitrary host page size to firmware") Signed-off-by: Eran Ben Elisha eranbe@nvidia.com Signed-off-by: Majd Dibbiny majd@nvidia.com Signed-off-by: Jack Morgenstein jackm@nvidia.com Signed-off-by: Saeed Mahameed saeedm@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c index 0eb50be175cc4..64d4e7125e9bb 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c @@ -219,7 +219,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u32 function)
n = find_first_bit(&fp->bitmask, 8 * sizeof(fp->bitmask)); if (n >= MLX5_NUM_4K_IN_PAGE) { - mlx5_core_warn(dev, "alloc 4k bug\n"); + mlx5_core_warn(dev, "alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n", + fp->addr, n, fp->bitmask, MLX5_NUM_4K_IN_PAGE); return -ENOENT; } clear_bit(n, &fp->bitmask);
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit 6caa5a2b78f5f53c433d3a3781e53325da22f0ac ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
Fixes: f8410e626569 ("irqchip: Add IRQCHIP_PLATFORM_DRIVER_BEGIN/END and IRQCHIP_MATCH helper macros") Signed-off-by: Miaoqian Lin linmq006@gmail.com Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230102121318.3990586-1-linmq006@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/irqchip/irqchip.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/irqchip/irqchip.c b/drivers/irqchip/irqchip.c index 3570f0a588c4b..7899607fbee8d 100644 --- a/drivers/irqchip/irqchip.c +++ b/drivers/irqchip/irqchip.c @@ -38,8 +38,10 @@ int platform_irqchip_probe(struct platform_device *pdev) struct device_node *par_np = of_irq_find_parent(np); of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev);
- if (!irq_init_cb) + if (!irq_init_cb) { + of_node_put(par_np); return -EINVAL; + }
if (par_np == np) par_np = NULL; @@ -52,8 +54,10 @@ int platform_irqchip_probe(struct platform_device *pdev) * interrupt controller. The actual initialization callback of this * interrupt controller can check for specific domains as necessary. */ - if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) + if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) { + of_node_put(par_np); return -EPROBE_DEFER; + }
return irq_init_cb(np, par_np); }
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller") Signed-off-by: Miaoqian Lin linmq006@gmail.com Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230102082811.3947760-1-linmq006@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/irqchip/irq-alpine-msi.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c index 5ddb8e578ac6a..fc1ef7de37973 100644 --- a/drivers/irqchip/irq-alpine-msi.c +++ b/drivers/irqchip/irq-alpine-msi.c @@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv, }
gic_domain = irq_find_host(gic_node); + of_node_put(gic_node); if (!gic_domain) { pr_err("Failed to find the GIC domain\n"); return -ENXIO;
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit 9419e700021a393f67be36abd0c4f3acc6139041 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
Fixes: a68a63cb4dfc ("irqchip/irq-mvebu-gicp: Add new driver for Marvell GICP") Signed-off-by: Miaoqian Lin linmq006@gmail.com Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230102084208.3951758-1-linmq006@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/irqchip/irq-mvebu-gicp.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c index fe88a782173dd..c43a345061d53 100644 --- a/drivers/irqchip/irq-mvebu-gicp.c +++ b/drivers/irqchip/irq-mvebu-gicp.c @@ -221,6 +221,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev) }
parent_domain = irq_find_host(irq_parent_dn); + of_node_put(irq_parent_dn); if (!parent_domain) { dev_err(&pdev->dev, "failed to find parent IRQ domain\n"); return -ENODEV;
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit 02298b7bae12936ca313975b02e7f98b06670d37 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
Fixes: cd844b0715ce ("irqchip/ti-sci-intr: Add support for Interrupt Router driver") Signed-off-by: Miaoqian Lin linmq006@gmail.com Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230102085611.3955984-1-linmq006@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/irqchip/irq-ti-sci-intr.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-ti-sci-intr.c b/drivers/irqchip/irq-ti-sci-intr.c index fe8fad22bcf96..020ddf29efb80 100644 --- a/drivers/irqchip/irq-ti-sci-intr.c +++ b/drivers/irqchip/irq-ti-sci-intr.c @@ -236,6 +236,7 @@ static int ti_sci_intr_irq_domain_probe(struct platform_device *pdev) }
parent_domain = irq_find_host(parent_node); + of_node_put(parent_node); if (!parent_domain) { dev_err(dev, "Failed to find IRQ parent domain\n"); return -ENODEV;
From: Vasily Gorbik gor@linux.ibm.com
[ Upstream commit 3400c35a4090704e6c465449616ab7e67a9209e7 ]
Currently if for some reason sclp_early_read_info() fails, sclp_early_get_memsize() will not set max_physmem_end and it will stay uninitialized. Any garbage value other than 0 will lead to detect_memory() taking wrong path or returning a garbage value as max_physmem_end. To avoid that simply initialize max_physmem_end.
Fixes: 73045a08cf55 ("s390: unify identity mapping limits handling") Reported-by: Alexander Gordeev agordeev@linux.ibm.com Reviewed-by: Alexander Gordeev agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik gor@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/boot/mem_detect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c index 7fa1a32ea0f3f..0a5821ef4f1fd 100644 --- a/arch/s390/boot/mem_detect.c +++ b/arch/s390/boot/mem_detect.c @@ -165,7 +165,7 @@ static void search_mem_end(void)
unsigned long detect_memory(void) { - unsigned long max_physmem_end; + unsigned long max_physmem_end = 0;
sclp_early_get_memsize(&max_physmem_end);
From: Vasily Gorbik gor@linux.ibm.com
[ Upstream commit 108303b0a2d27cb14eed565e33e64ad9eefe5d7e ]
Commit b9ff81003cf1 ("s390/vmem: cleanup empty page tables") introduced empty page tables cleanup in vmem code, but when the kernel is built with KASAN enabled the code has no effect due to wrong KASAN shadow memory intersection condition, which effectively ignores any memory range below KASAN shadow. Fix intersection condition to make code work as anticipated.
Fixes: b9ff81003cf1 ("s390/vmem: cleanup empty page tables") Reviewed-by: Alexander Gordeev agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik gor@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/mm/vmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c index ee1a97078527b..9a0ce5315f36d 100644 --- a/arch/s390/mm/vmem.c +++ b/arch/s390/mm/vmem.c @@ -297,7 +297,7 @@ static void try_free_pmd_table(pud_t *pud, unsigned long start) if (end > VMALLOC_START) return; #ifdef CONFIG_KASAN - if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) + if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) return; #endif pmd = pmd_offset(pud, start); @@ -372,7 +372,7 @@ static void try_free_pud_table(p4d_t *p4d, unsigned long start) if (end > VMALLOC_START) return; #ifdef CONFIG_KASAN - if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) + if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) return; #endif
@@ -426,7 +426,7 @@ static void try_free_p4d_table(pgd_t *pgd, unsigned long start) if (end > VMALLOC_START) return; #ifdef CONFIG_KASAN - if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) + if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) return; #endif
From: Alexander Gordeev agordeev@linux.ibm.com
[ Upstream commit 9c3205b2b062420c26b33924b910880889acf832 ]
Move declarations to appropriate header files. Instead of cryptic casting directly assign struct vmlinux_info type to _vmlinux_info linker script variable - wich it actually is.
Reviewed-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Alexander Gordeev agordeev@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Stable-dep-of: 22476f47b6b7 ("s390/boot: fix mem_detect extended area allocation") Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/boot/boot.h | 24 ++++++++++++++++++++++-- arch/s390/boot/decompressor.c | 1 + arch/s390/boot/decompressor.h | 26 -------------------------- 3 files changed, 23 insertions(+), 28 deletions(-)
diff --git a/arch/s390/boot/boot.h b/arch/s390/boot/boot.h index 70418389414d3..f6e82cf7851e2 100644 --- a/arch/s390/boot/boot.h +++ b/arch/s390/boot/boot.h @@ -8,10 +8,26 @@
#ifndef __ASSEMBLY__
+struct vmlinux_info { + unsigned long default_lma; + void (*entry)(void); + unsigned long image_size; /* does not include .bss */ + unsigned long bss_size; /* uncompressed image .bss size */ + unsigned long bootdata_off; + unsigned long bootdata_size; + unsigned long bootdata_preserved_off; + unsigned long bootdata_preserved_size; + unsigned long dynsym_start; + unsigned long rela_dyn_start; + unsigned long rela_dyn_end; + unsigned long amode31_size; +}; + void startup_kernel(void); unsigned long detect_memory(void); bool is_ipl_block_dump(void); void store_ipl_parmblock(void); +unsigned long read_ipl_report(unsigned long safe_offset); void setup_boot_command_line(void); void parse_boot_command_line(void); void verify_facilities(void); @@ -20,6 +36,7 @@ void sclp_early_setup_buffer(void); void print_pgm_check_info(void); unsigned long get_random_base(unsigned long safe_addr); void __printf(1, 2) decompressor_printk(const char *fmt, ...); +void error(char *m);
/* Symbols defined by linker scripts */ extern const char kernel_version[]; @@ -31,8 +48,11 @@ extern char __boot_data_start[], __boot_data_end[]; extern char __boot_data_preserved_start[], __boot_data_preserved_end[]; extern char _decompressor_syms_start[], _decompressor_syms_end[]; extern char _stack_start[], _stack_end[]; - -unsigned long read_ipl_report(unsigned long safe_offset); +extern char _end[]; +extern unsigned char _compressed_start[]; +extern unsigned char _compressed_end[]; +extern struct vmlinux_info _vmlinux_info; +#define vmlinux _vmlinux_info
#endif /* __ASSEMBLY__ */ #endif /* BOOT_BOOT_H */ diff --git a/arch/s390/boot/decompressor.c b/arch/s390/boot/decompressor.c index b519a1f045d8f..d762733a07530 100644 --- a/arch/s390/boot/decompressor.c +++ b/arch/s390/boot/decompressor.c @@ -11,6 +11,7 @@ #include <linux/string.h> #include <asm/page.h> #include "decompressor.h" +#include "boot.h"
/* * gzip declarations diff --git a/arch/s390/boot/decompressor.h b/arch/s390/boot/decompressor.h index f75cc31a77dd9..92b81d2ea35d6 100644 --- a/arch/s390/boot/decompressor.h +++ b/arch/s390/boot/decompressor.h @@ -2,37 +2,11 @@ #ifndef BOOT_COMPRESSED_DECOMPRESSOR_H #define BOOT_COMPRESSED_DECOMPRESSOR_H
-#include <linux/stddef.h> - #ifdef CONFIG_KERNEL_UNCOMPRESSED static inline void *decompress_kernel(void) { return NULL; } #else void *decompress_kernel(void); #endif unsigned long mem_safe_offset(void); -void error(char *m); - -struct vmlinux_info { - unsigned long default_lma; - void (*entry)(void); - unsigned long image_size; /* does not include .bss */ - unsigned long bss_size; /* uncompressed image .bss size */ - unsigned long bootdata_off; - unsigned long bootdata_size; - unsigned long bootdata_preserved_off; - unsigned long bootdata_preserved_size; - unsigned long dynsym_start; - unsigned long rela_dyn_start; - unsigned long rela_dyn_end; - unsigned long amode31_size; -}; - -/* Symbols defined by linker scripts */ -extern char _end[]; -extern unsigned char _compressed_start[]; -extern unsigned char _compressed_end[]; -extern char _vmlinux_info[]; - -#define vmlinux (*(struct vmlinux_info *)_vmlinux_info)
#endif /* BOOT_COMPRESSED_DECOMPRESSOR_H */
From: Vasily Gorbik gor@linux.ibm.com
[ Upstream commit eb33f9eb304a4c18beb5ba6362eaa5c4beaf40d8 ]
In case sclp_early_get_memsize() fails but diag260() succeeds make sure some sane value is returned. This error scenario is highly unlikely, but this change makes system able to boot in such case.
Suggested-by: Alexander Gordeev agordeev@linux.ibm.com Reviewed-by: Alexander Gordeev agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik gor@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Stable-dep-of: 22476f47b6b7 ("s390/boot: fix mem_detect extended area allocation") Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/boot/mem_detect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c index 0a5821ef4f1fd..41792a3a5e364 100644 --- a/arch/s390/boot/mem_detect.c +++ b/arch/s390/boot/mem_detect.c @@ -176,7 +176,7 @@ unsigned long detect_memory(void)
if (!diag260()) { mem_detect.info_source = MEM_DETECT_DIAG260; - return max_physmem_end; + return max_physmem_end ?: get_mem_detect_end(); }
if (max_physmem_end) {
From: Vasily Gorbik gor@linux.ibm.com
[ Upstream commit 22476f47b6b7fb7d066c71f67ebc11892adb0849 ]
Allocation of mem_detect extended area was not considered neither in commit 9641b8cc733f ("s390/ipl: read IPL report at early boot") nor in commit b2d24b97b2a9 ("s390/kernel: add support for kernel address space layout randomization (KASLR)"). As a result mem_detect extended theoretically may overlap with ipl report or randomized kernel image position. But as mem_detect code will allocate extended area only upon exceeding 255 online regions (which should alternate with offline memory regions) it is not seen in practice.
To make sure mem_detect extended area does not overlap with ipl report or randomized kernel position extend usage of "safe_addr". Make initrd handling and mem_detect extended area allocation code move it further right and make KASLR takes in into consideration as well.
Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot") Fixes: b2d24b97b2a9 ("s390/kernel: add support for kernel address space layout randomization (KASLR)") Reviewed-by: Alexander Gordeev agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik gor@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/boot/boot.h | 4 +-- arch/s390/boot/kaslr.c | 6 ----- arch/s390/boot/mem_detect.c | 52 ++++++++++++------------------------- arch/s390/boot/startup.c | 21 ++++++++------- 4 files changed, 31 insertions(+), 52 deletions(-)
diff --git a/arch/s390/boot/boot.h b/arch/s390/boot/boot.h index f6e82cf7851e2..939a1b7806df2 100644 --- a/arch/s390/boot/boot.h +++ b/arch/s390/boot/boot.h @@ -24,10 +24,10 @@ struct vmlinux_info { };
void startup_kernel(void); -unsigned long detect_memory(void); +unsigned long detect_memory(unsigned long *safe_addr); bool is_ipl_block_dump(void); void store_ipl_parmblock(void); -unsigned long read_ipl_report(unsigned long safe_offset); +unsigned long read_ipl_report(unsigned long safe_addr); void setup_boot_command_line(void); void parse_boot_command_line(void); void verify_facilities(void); diff --git a/arch/s390/boot/kaslr.c b/arch/s390/boot/kaslr.c index e8d74d4f62aa5..58a8d8c8a1007 100644 --- a/arch/s390/boot/kaslr.c +++ b/arch/s390/boot/kaslr.c @@ -174,7 +174,6 @@ unsigned long get_random_base(unsigned long safe_addr) { unsigned long memory_limit = get_mem_detect_end(); unsigned long base_pos, max_pos, kernel_size; - unsigned long kasan_needs; int i;
memory_limit = min(memory_limit, ident_map_size); @@ -186,12 +185,7 @@ unsigned long get_random_base(unsigned long safe_addr) */ memory_limit -= kasan_estimate_memory_needs(memory_limit);
- if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size) { - if (safe_addr < initrd_data.start + initrd_data.size) - safe_addr = initrd_data.start + initrd_data.size; - } safe_addr = ALIGN(safe_addr, THREAD_SIZE); - kernel_size = vmlinux.image_size + vmlinux.bss_size; if (safe_addr + kernel_size > memory_limit) return 0; diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c index 41792a3a5e364..daa1593171835 100644 --- a/arch/s390/boot/mem_detect.c +++ b/arch/s390/boot/mem_detect.c @@ -16,29 +16,10 @@ struct mem_detect_info __bootdata(mem_detect); #define ENTRIES_EXTENDED_MAX \ (256 * (1020 / 2) * sizeof(struct mem_detect_block))
-/* - * To avoid corrupting old kernel memory during dump, find lowest memory - * chunk possible either right after the kernel end (decompressed kernel) or - * after initrd (if it is present and there is no hole between the kernel end - * and initrd) - */ -static void *mem_detect_alloc_extended(void) -{ - unsigned long offset = ALIGN(mem_safe_offset(), sizeof(u64)); - - if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && initrd_data.start && initrd_data.size && - initrd_data.start < offset + ENTRIES_EXTENDED_MAX) - offset = ALIGN(initrd_data.start + initrd_data.size, sizeof(u64)); - - return (void *)offset; -} - static struct mem_detect_block *__get_mem_detect_block_ptr(u32 n) { if (n < MEM_INLINED_ENTRIES) return &mem_detect.entries[n]; - if (unlikely(!mem_detect.entries_extended)) - mem_detect.entries_extended = mem_detect_alloc_extended(); return &mem_detect.entries_extended[n - MEM_INLINED_ENTRIES]; }
@@ -147,7 +128,7 @@ static int tprot(unsigned long addr) return rc; }
-static void search_mem_end(void) +static unsigned long search_mem_end(void) { unsigned long range = 1 << (MAX_PHYSMEM_BITS - 20); /* in 1MB blocks */ unsigned long offset = 0; @@ -159,33 +140,34 @@ static void search_mem_end(void) if (!tprot(pivot << 20)) offset = pivot; } - - add_mem_detect_block(0, (offset + 1) << 20); + return (offset + 1) << 20; }
-unsigned long detect_memory(void) +unsigned long detect_memory(unsigned long *safe_addr) { unsigned long max_physmem_end = 0;
sclp_early_get_memsize(&max_physmem_end); + mem_detect.entries_extended = (struct mem_detect_block *)ALIGN(*safe_addr, sizeof(u64));
if (!sclp_early_read_storage_info()) { mem_detect.info_source = MEM_DETECT_SCLP_STOR_INFO; - return max_physmem_end; - } - - if (!diag260()) { + } else if (!diag260()) { mem_detect.info_source = MEM_DETECT_DIAG260; - return max_physmem_end ?: get_mem_detect_end(); - } - - if (max_physmem_end) { + max_physmem_end = max_physmem_end ?: get_mem_detect_end(); + } else if (max_physmem_end) { add_mem_detect_block(0, max_physmem_end); mem_detect.info_source = MEM_DETECT_SCLP_READ_INFO; - return max_physmem_end; + } else { + max_physmem_end = search_mem_end(); + add_mem_detect_block(0, max_physmem_end); + mem_detect.info_source = MEM_DETECT_BIN_SEARCH; + } + + if (mem_detect.count > MEM_INLINED_ENTRIES) { + *safe_addr += (mem_detect.count - MEM_INLINED_ENTRIES) * + sizeof(struct mem_detect_block); }
- search_mem_end(); - mem_detect.info_source = MEM_DETECT_BIN_SEARCH; - return get_mem_detect_end(); + return max_physmem_end; } diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c index 47ca3264c0230..e0863d28759a5 100644 --- a/arch/s390/boot/startup.c +++ b/arch/s390/boot/startup.c @@ -57,16 +57,17 @@ unsigned long mem_safe_offset(void) } #endif
-static void rescue_initrd(unsigned long addr) +static unsigned long rescue_initrd(unsigned long safe_addr) { if (!IS_ENABLED(CONFIG_BLK_DEV_INITRD)) - return; + return safe_addr; if (!initrd_data.start || !initrd_data.size) - return; - if (addr <= initrd_data.start) - return; - memmove((void *)addr, (void *)initrd_data.start, initrd_data.size); - initrd_data.start = addr; + return safe_addr; + if (initrd_data.start < safe_addr) { + memmove((void *)safe_addr, (void *)initrd_data.start, initrd_data.size); + initrd_data.start = safe_addr; + } + return initrd_data.start + initrd_data.size; }
static void copy_bootdata(void) @@ -250,6 +251,7 @@ static unsigned long reserve_amode31(unsigned long safe_addr)
void startup_kernel(void) { + unsigned long max_physmem_end; unsigned long random_lma; unsigned long safe_addr; void *img; @@ -265,12 +267,13 @@ void startup_kernel(void) safe_addr = reserve_amode31(safe_addr); safe_addr = read_ipl_report(safe_addr); uv_query_info(); - rescue_initrd(safe_addr); + safe_addr = rescue_initrd(safe_addr); sclp_early_read_info(); setup_boot_command_line(); parse_boot_command_line(); sanitize_prot_virt_host(); - setup_ident_map_size(detect_memory()); + max_physmem_end = detect_memory(&safe_addr); + setup_ident_map_size(max_physmem_end); setup_vmalloc_size(); setup_kernel_memory_layout();
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit 584f3742890e966d2f0a1f3c418c9ead70b2d99e ]
Add sock_init_data_uid() to explicitly initialize the socket uid. To initialise the socket uid, sock_init_data() assumes a the struct socket* sock is always embedded in a struct socket_alloc, used to access the corresponding inode uid. This may not be true. Examples are sockets created in tun_chr_open() and tap_open().
Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Reviewed-by: Eric Dumazet edumazet@google.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- include/net/sock.h | 7 ++++++- net/core/sock.c | 15 ++++++++++++--- 2 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h index 5562097276336..c6584a3524638 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1956,7 +1956,12 @@ void sk_common_release(struct sock *sk); * Default socket callbacks and setup code */
-/* Initialise core socket variables */ +/* Initialise core socket variables using an explicit uid. */ +void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid); + +/* Initialise core socket variables. + * Assumes struct socket *sock is embedded in a struct socket_alloc. + */ void sock_init_data(struct socket *sock, struct sock *sk);
/* diff --git a/net/core/sock.c b/net/core/sock.c index 6f27c24016fee..63680f999bf6d 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -3381,7 +3381,7 @@ void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer) } EXPORT_SYMBOL(sk_stop_timer_sync);
-void sock_init_data(struct socket *sock, struct sock *sk) +void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid) { sk_init_common(sk); sk->sk_send_head = NULL; @@ -3401,11 +3401,10 @@ void sock_init_data(struct socket *sock, struct sock *sk) sk->sk_type = sock->type; RCU_INIT_POINTER(sk->sk_wq, &sock->wq); sock->sk = sk; - sk->sk_uid = SOCK_INODE(sock)->i_uid; } else { RCU_INIT_POINTER(sk->sk_wq, NULL); - sk->sk_uid = make_kuid(sock_net(sk)->user_ns, 0); } + sk->sk_uid = uid;
rwlock_init(&sk->sk_callback_lock); if (sk->sk_kern_sock) @@ -3463,6 +3462,16 @@ void sock_init_data(struct socket *sock, struct sock *sk) refcount_set(&sk->sk_refcnt, 1); atomic_set(&sk->sk_drops, 0); } +EXPORT_SYMBOL(sock_init_data_uid); + +void sock_init_data(struct socket *sock, struct sock *sk) +{ + kuid_t uid = sock ? + SOCK_INODE(sock)->i_uid : + make_kuid(sock_net(sk)->user_ns, 0); + + sock_init_data_uid(sock, sk, uid); +} EXPORT_SYMBOL(sock_init_data);
void lock_sock_nested(struct sock *sk, int subclass)
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit a096ccca6e503a5c575717ff8a36ace27510ab0a ]
sock_init_data() assumes that the `struct socket` passed in input is contained in a `struct socket_alloc` allocated with sock_alloc(). However, tun_chr_open() passes a `struct socket` embedded in a `struct tun_file` allocated with sk_alloc(). This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the `struct sock` in input. On default configuration, the type confused field overlaps with the high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`, NULL at the time of call, which makes the uid of all tun sockets 0, i.e., the root one. Fix the assignment by using sock_init_data_uid().
Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Reviewed-by: Eric Dumazet edumazet@google.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/tun.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index a7d17c680f4a0..745131b2d6dbf 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -3448,7 +3448,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) tfile->socket.file = file; tfile->socket.ops = &tun_socket_ops;
- sock_init_data(&tfile->socket, &tfile->sk); + sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid);
tfile->sk.sk_write_space = tun_sock_write_space; tfile->sk.sk_sndbuf = INT_MAX;
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ]
sock_init_data() assumes that the `struct socket` passed in input is contained in a `struct socket_alloc` allocated with sock_alloc(). However, tap_open() passes a `struct socket` embedded in a `struct tap_queue` allocated with sk_alloc(). This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the `struct sock` in input. On default configuration, the type confused field overlaps with padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu *tap` in `struct tap_queue`, which makes the uid of all tap sockets 0, i.e., the root one. Fix the assignment by using sock_init_data_uid().
Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Reviewed-by: Eric Dumazet edumazet@google.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/tap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/tap.c b/drivers/net/tap.c index a2be1994b3894..8941aa199ea33 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -533,7 +533,7 @@ static int tap_open(struct inode *inode, struct file *file) q->sock.state = SS_CONNECTED; q->sock.file = file; q->sock.ops = &tap_socket_ops; - sock_init_data(&q->sock, &q->sk); + sock_init_data_uid(&q->sock, &q->sk, inode->i_uid); q->sk.sk_write_space = tap_sock_write_space; q->sk.sk_destruct = tap_sock_destruct; q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;
From: David Howells dhowells@redhat.com
[ Upstream commit a33395ab85b9b9cff83948a03a1d6d96347935d8 ]
If an rxrpc call is given a poke, it will get woken up unconditionally, even if there's already a poke pending (for which there will have been a wake) or if the call refcount has gone to 0.
Fix this by only waking the call if it is still referenced and if it doesn't already have a poke pending.
Fixes: 15f661dc95da ("rxrpc: Implement a mechanism to send an event notification to a call") Signed-off-by: David Howells dhowells@redhat.com cc: Marc Dionne marc.dionne@auristor.com cc: linux-afs@lists.infradead.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/rxrpc/call_object.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c index f3c9f0201c156..7ce562f6dc8d5 100644 --- a/net/rxrpc/call_object.c +++ b/net/rxrpc/call_object.c @@ -54,12 +54,14 @@ void rxrpc_poke_call(struct rxrpc_call *call, enum rxrpc_call_poke_trace what) spin_lock_bh(&local->lock); busy = !list_empty(&call->attend_link); trace_rxrpc_poke_call(call, busy, what); + if (!busy && !rxrpc_try_get_call(call, rxrpc_call_get_poke)) + busy = true; if (!busy) { - rxrpc_get_call(call, rxrpc_call_get_poke); list_add_tail(&call->attend_link, &local->call_attend_q); } spin_unlock_bh(&local->lock); - rxrpc_wake_up_io_thread(local); + if (!busy) + rxrpc_wake_up_io_thread(local); } }
From: Qi Zheng zhengqi.arch@bytedance.com
[ Upstream commit eca4c0eea53432ec4b711b2a8ad282cbad231b4f ]
Since commit ff9fb72bc077 ("debugfs: return error values, not NULL") changed return value of debugfs_rename() in error cases from %NULL to %ERR_PTR(-ERROR), we should also check error values instead of NULL.
Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") Signed-off-by: Qi Zheng zhengqi.arch@bytedance.com Signed-off-by: Viresh Kumar viresh.kumar@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/opp/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c index 96a30a032c5f9..2c7fb683441ef 100644 --- a/drivers/opp/debugfs.c +++ b/drivers/opp/debugfs.c @@ -235,7 +235,7 @@ static void opp_migrate_dentry(struct opp_device *opp_dev,
dentry = debugfs_rename(rootdir, opp_dev->dentry, rootdir, opp_table->dentry_name); - if (!dentry) { + if (IS_ERR(dentry)) { dev_err(dev, "%s: Failed to rename link from: %s to %s\n", __func__, dev_name(opp_dev->dev), dev_name(dev)); return;
From: Uwe Kleine-König u.kleine-koenig@pengutronix.de
[ Upstream commit 5d8f384a9b4fc50f6a18405f1c08e5a87a77b5b3 ]
The remove function first frees the clks and only then calls cpufreq_unregister_driver(). If one of the cpufreq callbacks is called just before cpufreq_unregister_driver() is run, the freed clks might be used.
Fixes: 6601b8030de3 ("davinci: add generic CPUFreq driver for DaVinci") Signed-off-by: Uwe Kleine-König u.kleine-koenig@pengutronix.de Acked-by: Viresh Kumar viresh.kumar@linaro.org Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/cpufreq/davinci-cpufreq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/davinci-cpufreq.c b/drivers/cpufreq/davinci-cpufreq.c index 9e97f60f81996..ebb3a81026816 100644 --- a/drivers/cpufreq/davinci-cpufreq.c +++ b/drivers/cpufreq/davinci-cpufreq.c @@ -133,12 +133,14 @@ static int __init davinci_cpufreq_probe(struct platform_device *pdev)
static int __exit davinci_cpufreq_remove(struct platform_device *pdev) { + cpufreq_unregister_driver(&davinci_driver); + clk_put(cpufreq.armclk);
if (cpufreq.asyncclk) clk_put(cpufreq.asyncclk);
- return cpufreq_unregister_driver(&davinci_driver); + return 0; }
static struct platform_driver davinci_cpufreq_driver = {
From: Kees Cook keescook@chromium.org
[ Upstream commit a00a29b0eeea6caaaf9edc3dd284f81b072ee343 ]
The compiler thinks "conn" might be NULL after a call to hci_bind_bis(), which cannot happen. Avoid any confusion by just making it not return a value since it cannot fail. Fixes the warnings seen with GCC 13:
In function 'arch_atomic_dec_and_test', inlined from 'atomic_dec_and_test' at ../include/linux/atomic/atomic-instrumented.h:576:9, inlined from 'hci_conn_drop' at ../include/net/bluetooth/hci_core.h:1391:6, inlined from 'hci_connect_bis' at ../net/bluetooth/hci_conn.c:2124:3: ../arch/x86/include/asm/rmwcc.h:37:9: warning: array subscript 0 is outside array bounds of 'atomic_t[0]' [-Warray-bounds=] 37 | asm volatile (fullop CC_SET(cc) \ | ^~~ ... In function 'hci_connect_bis': cc1: note: source object is likely at address zero
Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Cc: Luiz Augusto von Dentz luiz.von.dentz@intel.com Cc: Marcel Holtmann marcel@holtmann.org Cc: Johan Hedberg johan.hedberg@gmail.com Cc: "David S. Miller" davem@davemloft.net Cc: Eric Dumazet edumazet@google.com Cc: Jakub Kicinski kuba@kernel.org Cc: Paolo Abeni pabeni@redhat.com Cc: linux-bluetooth@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook keescook@chromium.org Reviewed-by: Simon Horman simon.horman@corigine.com Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/bluetooth/hci_conn.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index acf563fbdfd95..61a34801e61ea 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -1981,16 +1981,14 @@ static void hci_iso_qos_setup(struct hci_dev *hdev, struct hci_conn *conn, qos->latency = conn->le_conn_latency; }
-static struct hci_conn *hci_bind_bis(struct hci_conn *conn, - struct bt_iso_qos *qos) +static void hci_bind_bis(struct hci_conn *conn, + struct bt_iso_qos *qos) { /* Update LINK PHYs according to QoS preference */ conn->le_tx_phy = qos->out.phy; conn->le_tx_phy = qos->out.phy; conn->iso_qos = *qos; conn->state = BT_BOUND; - - return conn; }
static int create_big_sync(struct hci_dev *hdev, void *data) @@ -2119,11 +2117,7 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst, if (IS_ERR(conn)) return conn;
- conn = hci_bind_bis(conn, qos); - if (!conn) { - hci_conn_drop(conn); - return ERR_PTR(-ENOMEM); - } + hci_bind_bis(conn, qos);
/* Add Basic Announcement into Peridic Adv Data if BASE is set */ if (base_len && base) {
From: Luiz Augusto von Dentz luiz.von.dentz@intel.com
[ Upstream commit df5703348813235874d851934e957c3723d71644 ]
This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which makes it possible that the chan is disconnected in the meantime.
Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending") Reported-by: Alexander Coffin alex.coffin@matician.com Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/bluetooth/l2cap_core.c | 24 ------------------------ net/bluetooth/l2cap_sock.c | 8 ++++++++ 2 files changed, 8 insertions(+), 24 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index a3e0dc6a6e732..adfc3ea06d088 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -2683,14 +2683,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) if (IS_ERR(skb)) return PTR_ERR(skb);
- /* Channel lock is released before requesting new skb and then - * reacquired thus we need to recheck channel state. - */ - if (chan->state != BT_CONNECTED) { - kfree_skb(skb); - return -ENOTCONN; - } - l2cap_do_send(chan, skb); return len; } @@ -2735,14 +2727,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) if (IS_ERR(skb)) return PTR_ERR(skb);
- /* Channel lock is released before requesting new skb and then - * reacquired thus we need to recheck channel state. - */ - if (chan->state != BT_CONNECTED) { - kfree_skb(skb); - return -ENOTCONN; - } - l2cap_do_send(chan, skb); err = len; break; @@ -2763,14 +2747,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) */ err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
- /* The channel could have been closed while segmenting, - * check that it is still connected. - */ - if (chan->state != BT_CONNECTED) { - __skb_queue_purge(&seg_queue); - err = -ENOTCONN; - } - if (err) break;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index ca8f07f3542b8..eebe256104bc0 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1624,6 +1624,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, if (!skb) return ERR_PTR(err);
+ /* Channel lock is released before requesting new skb and then + * reacquired thus we need to recheck channel state. + */ + if (chan->state != BT_CONNECTED) { + kfree_skb(skb); + return ERR_PTR(-ENOTCONN); + } + skb->priority = sk->sk_priority;
bt_cb(skb)->l2cap.chan = chan;
From: Zhengping Jiang jiangzp@google.com
[ Upstream commit 03b0093f7b310493bc944a20f725228cfe0d3fea ]
Bluetooth controller attached via the UART is handled by the serdev driver. Get the wakeup status from the device handle through serdev, instead of the parent path.
Fixes: c1a74160eaf1 ("Bluetooth: hci_qca: Add device_may_wakeup support") Signed-off-by: Zhengping Jiang jiangzp@google.com Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/bluetooth/hci_qca.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c index bbe9cf1cae27f..d331772809d56 100644 --- a/drivers/bluetooth/hci_qca.c +++ b/drivers/bluetooth/hci_qca.c @@ -1588,10 +1588,11 @@ static bool qca_wakeup(struct hci_dev *hdev) struct hci_uart *hu = hci_get_drvdata(hdev); bool wakeup;
- /* UART driver handles the interrupt from BT SoC.So we need to use - * device handle of UART driver to get the status of device may wakeup. + /* BT SoC attached through the serial bus is handled by the serdev driver. + * So we need to use the device handle of the serdev driver to get the + * status of device may wakeup. */ - wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent); + wakeup = device_may_wakeup(&hu->serdev->ctrl->dev); bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup);
return wakeup;
From: Alex Elder elder@linaro.org
[ Upstream commit 2df181f09c961377a55510a864216d48d787fe49 ]
Starting at IPA v4.11, the GSI_GENERIC_COMMAND GSI register got a new PARAMS field. The code that encodes a value into that field sets it unconditionally, which is wrong.
We currently only provide 0 as the field's value, so this error has no real effect. Still, it's a bug, so let's fix it.
Fix an (unrelated) incorrect comment as well. Fields in the ERROR_LOG GSI register actually *are* defined for IPA versions prior to v3.5.1.
Fixes: fe68c43ce388 ("net: ipa: support enhanced channel flow control") Signed-off-by: Alex Elder elder@linaro.org Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ipa/gsi.c | 3 ++- drivers/net/ipa/gsi_reg.h | 1 - 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c index bea2da1c4c51d..f1a3938294866 100644 --- a/drivers/net/ipa/gsi.c +++ b/drivers/net/ipa/gsi.c @@ -1666,7 +1666,8 @@ static int gsi_generic_command(struct gsi *gsi, u32 channel_id, val = u32_encode_bits(opcode, GENERIC_OPCODE_FMASK); val |= u32_encode_bits(channel_id, GENERIC_CHID_FMASK); val |= u32_encode_bits(GSI_EE_MODEM, GENERIC_EE_FMASK); - val |= u32_encode_bits(params, GENERIC_PARAMS_FMASK); + if (gsi->version >= IPA_VERSION_4_11) + val |= u32_encode_bits(params, GENERIC_PARAMS_FMASK);
timeout = !gsi_command(gsi, GSI_GENERIC_CMD_OFFSET, val);
diff --git a/drivers/net/ipa/gsi_reg.h b/drivers/net/ipa/gsi_reg.h index 3763359f208f7..e65f2f055cfff 100644 --- a/drivers/net/ipa/gsi_reg.h +++ b/drivers/net/ipa/gsi_reg.h @@ -372,7 +372,6 @@ enum gsi_general_id { #define GSI_ERROR_LOG_OFFSET \ (0x0001f200 + 0x4000 * GSI_EE_AP)
-/* Fields below are present for IPA v3.5.1 and above */ #define ERR_ARG3_FMASK GENMASK(3, 0) #define ERR_ARG2_FMASK GENMASK(7, 4) #define ERR_ARG1_FMASK GENMASK(11, 8)
From: Halil Pasic pasic@linux.ibm.com
[ Upstream commit a64a6d23874c574d30a9816124b2dc37467f3811 ]
The NIB is architecturally invalid if the address designates a storage location that is not installed or if it is zero.
Signed-off-by: Halil Pasic pasic@linux.ibm.com Reported-by: Janosch Frank frankja@linux.ibm.com Fixes: ec89b55e3bce ("s390: ap: implement PAPQ AQIC interception in kernel") Reviewed-by: Tony Krowiak akrowiak@linux.ibm.com Reviewed-by: Pierre Morel pmorel@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/s390/crypto/vfio_ap_ops.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index b0b25bc95985b..2bba5ed83dfcf 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -349,6 +349,8 @@ static int vfio_ap_validate_nib(struct kvm_vcpu *vcpu, dma_addr_t *nib) { *nib = vcpu->run->s.regs.gprs[2];
+ if (!*nib) + return -EINVAL; if (kvm_is_error_hva(gfn_to_hva(vcpu->kvm, *nib >> PAGE_SHIFT))) return -EINVAL;
From: Halil Pasic pasic@linux.ibm.com
[ Upstream commit 394740d7645ea767795074287769dd26dbd4d782 ]
There function ap_aqic() tries to grab the status from the wrong part of the register. Thus we always end up with zeros. Which is wrong, among others, because we detect failures via status.response_code.
Signed-off-by: Halil Pasic pasic@linux.ibm.com Reported-by: Janosch Frank frankja@linux.ibm.com Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables") Reviewed-by: Harald Freudenberger freude@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/include/asm/ap.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h index f508f5025e388..876afe46f316d 100644 --- a/arch/s390/include/asm/ap.h +++ b/arch/s390/include/asm/ap.h @@ -239,7 +239,10 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid, union { unsigned long value; struct ap_qirq_ctrl qirqctrl; - struct ap_queue_status status; + struct { + u32 _pad; + struct ap_queue_status status; + }; } reg1; unsigned long reg2 = pa_ind;
@@ -253,7 +256,7 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid, " lgr %[reg1],1\n" /* gr1 (status) into reg1 */ : [reg1] "+&d" (reg1) : [reg0] "d" (reg0), [reg2] "d" (reg2) - : "cc", "0", "1", "2"); + : "cc", "memory", "0", "1", "2");
return reg1.status; }
From: Halil Pasic pasic@linux.ibm.com
[ Upstream commit a2522c80f074c35254974fec39fffe8b8d75befe ]
Since commit 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables") the function ap_qact() tries to grab the status from the wrong part of the register. Thus we always end up with zeros. Which is wrong, among others, because we detect failures via status.response_code.
Signed-off-by: Halil Pasic pasic@linux.ibm.com Reported-by: Harald Freudenberger freude@linux.ibm.com Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables") Reviewed-by: Harald Freudenberger freude@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/include/asm/ap.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h index 876afe46f316d..57a2d6518d272 100644 --- a/arch/s390/include/asm/ap.h +++ b/arch/s390/include/asm/ap.h @@ -293,7 +293,10 @@ static inline struct ap_queue_status ap_qact(ap_qid_t qid, int ifbit, unsigned long reg0 = qid | (5UL << 24) | ((ifbit & 0x01) << 22); union { unsigned long value; - struct ap_queue_status status; + struct { + u32 _pad; + struct ap_queue_status status; + }; } reg1; unsigned long reg2;
From: Ilya Leoshkevich iii@linux.ibm.com
[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ]
The code assumes that everything that comes after nlmsgerr are nlattrs. When calculating their size, it does not account for the initial nlmsghdr. This may lead to accessing uninitialized memory.
Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP") Signed-off-by: Ilya Leoshkevich iii@linux.ibm.com Signed-off-by: Andrii Nakryiko andrii@kernel.org Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/lib/bpf/nlattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c index 3900d052ed19e..975e265eab3bf 100644 --- a/tools/lib/bpf/nlattr.c +++ b/tools/lib/bpf/nlattr.c @@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh) hlen += nlmsg_len(&err->msg);
attr = (struct nlattr *) ((void *) err + hlen); - alen = nlh->nlmsg_len - hlen; + alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;
if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen, extack_policy) != 0) {
From: Oleksandr Tyshchenko oleksandr_tyshchenko@epam.com
[ Upstream commit 2062f9fb6445451b189595e295765c69f43bc12e ]
Update stub IOMMU driver (which main purpose is to reuse generic IOMMU device-tree bindings by Xen grant DMA-mapping layer on Arm) according to the recent changes done in the following commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration").
With probe_device() callback being called during IOMMU device registration, the uninitialized callback just leads to the "kernel NULL pointer dereference" issue during boot. Fix that by adding a dummy callback.
Looks like the release_device() callback is not mandatory to be implemented as IOMMU framework makes sure that callback is initialized before dereferencing.
Reported-by: Viresh Kumar viresh.kumar@linaro.org Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") Signed-off-by: Oleksandr Tyshchenko oleksandr_tyshchenko@epam.com Tested-by: Viresh Kumar viresh.kumar@linaro.org Reviewed-by: Stefano Stabellini sstabellini@kernel.org Link: https://lore.kernel.org/r/20230208153649.3604857-1-olekstysh@gmail.com Signed-off-by: Juergen Gross jgross@suse.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/xen/grant-dma-iommu.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/xen/grant-dma-iommu.c b/drivers/xen/grant-dma-iommu.c index 16b8bc0c0b33d..6a9fe02c6bfcc 100644 --- a/drivers/xen/grant-dma-iommu.c +++ b/drivers/xen/grant-dma-iommu.c @@ -16,8 +16,15 @@ struct grant_dma_iommu_device { struct iommu_device iommu; };
-/* Nothing is really needed here */ -static const struct iommu_ops grant_dma_iommu_ops; +static struct iommu_device *grant_dma_iommu_probe_device(struct device *dev) +{ + return ERR_PTR(-ENODEV); +} + +/* Nothing is really needed here except a dummy probe_device callback */ +static const struct iommu_ops grant_dma_iommu_ops = { + .probe_device = grant_dma_iommu_probe_device, +};
static const struct of_device_id grant_dma_iommu_of_match[] = { { .compatible = "xen,grant-dma" },
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit 68762148d1b011d47bc2ceed7321739b5aea1e63 ]
rds_rm_zerocopy_callback() uses list_add_tail() with swapped arguments. This links the list head with the new entry, losing the references to the remaining part of the list.
Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") Suggested-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/rds/message.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/rds/message.c b/net/rds/message.c index c19c935612278..7af59d2443e5d 100644 --- a/net/rds/message.c +++ b/net/rds/message.c @@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, ck = &info->zcookies; memset(ck, 0, sizeof(*ck)); WARN_ON(!rds_zcookie_add(info, cookie)); - list_add_tail(&q->zcookie_head, &info->rs_zcookie_next); + list_add_tail(&info->rs_zcookie_next, &q->zcookie_head);
spin_unlock_irqrestore(&q->lock, flags); /* caller invokes rds_wake_sk_sleep() */
From: Herbert Xu herbert@gondor.apana.org.au
[ Upstream commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 ]
Use the akcipher_request_complete helper instead of calling the completion function directly. In fact the previous code was buggy in that EINPROGRESS was never passed back to the original caller.
Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm") Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- crypto/rsa-pkcs1pad.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-)
diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c index 6ee5b8a060c06..4e9d2244ee317 100644 --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -214,16 +214,14 @@ static void pkcs1pad_encrypt_sign_complete_cb( struct crypto_async_request *child_async_req, int err) { struct akcipher_request *req = child_async_req->data; - struct crypto_async_request async_req;
if (err == -EINPROGRESS) - return; + goto out; + + err = pkcs1pad_encrypt_sign_complete(req, err);
- async_req.data = req->base.data; - async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); - async_req.flags = child_async_req->flags; - req->base.complete(&async_req, - pkcs1pad_encrypt_sign_complete(req, err)); +out: + akcipher_request_complete(req, err); }
static int pkcs1pad_encrypt(struct akcipher_request *req) @@ -332,15 +330,14 @@ static void pkcs1pad_decrypt_complete_cb( struct crypto_async_request *child_async_req, int err) { struct akcipher_request *req = child_async_req->data; - struct crypto_async_request async_req;
if (err == -EINPROGRESS) - return; + goto out; + + err = pkcs1pad_decrypt_complete(req, err);
- async_req.data = req->base.data; - async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); - async_req.flags = child_async_req->flags; - req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err)); +out: + akcipher_request_complete(req, err); }
static int pkcs1pad_decrypt(struct akcipher_request *req) @@ -513,15 +510,14 @@ static void pkcs1pad_verify_complete_cb( struct crypto_async_request *child_async_req, int err) { struct akcipher_request *req = child_async_req->data; - struct crypto_async_request async_req;
if (err == -EINPROGRESS) - return; + goto out;
- async_req.data = req->base.data; - async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); - async_req.flags = child_async_req->flags; - req->base.complete(&async_req, pkcs1pad_verify_complete(req, err)); + err = pkcs1pad_verify_complete(req, err); + +out: + akcipher_request_complete(req, err); }
/*
From: Randy Dunlap rdunlap@infradead.org
[ Upstream commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d ]
When CONFIG_PROC_FS is not set, there is a build error for an unused function. Make PROC_HARDWARE depend on PROC_FS to prevent this error.
In file included from ../arch/m68k/kernel/setup.c:3: ../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function] 477 | static int hardware_proc_show(struct seq_file *m, void *v) | ^~~~~~~~~~~~~~~~~~
Fixes: 66d857b08b8c ("m68k: merge m68k and m68knommu arch directories") # v3.0 Signed-off-by: Randy Dunlap rdunlap@infradead.org Reviewed-by: Geert Uytterhoeven geert@linux-m68k.org Link: https://lore.kernel.org/r/20230209010825.24136-1-rdunlap@infradead.org Signed-off-by: Geert Uytterhoeven geert@linux-m68k.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/m68k/Kconfig.devices | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/m68k/Kconfig.devices b/arch/m68k/Kconfig.devices index 6a87b4a5fcac2..e6e3efac18407 100644 --- a/arch/m68k/Kconfig.devices +++ b/arch/m68k/Kconfig.devices @@ -19,6 +19,7 @@ config HEARTBEAT # We have a dedicated heartbeat LED. :-) config PROC_HARDWARE bool "/proc/hardware support" + depends on PROC_FS help Say Y here to support the /proc/hardware file, which gives you access to information about the machine you're running on,
From: Conor Dooley conor.dooley@microchip.com
[ Upstream commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 ]
Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize broadcast hrtimer based clock event device"), RISC-V needs to initiate hrtimer based broadcast clock event device before C3STOP can be used. Otherwise, the introduction of C3STOP for the RISC-V arch timer in commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") leaves us without any broadcast timer registered. This prevents the kernel from entering oneshot mode, which breaks timer behaviour, for example clock_nanosleep().
A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250 & C3STOP enabled, the sleep times are rounded up to the next jiffy: == CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 == Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179 Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193 Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000 Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000 Samples: 521 Samples: 521 Samples: 521 Samples: 521
Link: https://lore.kernel.org/linux-riscv/YzYTNQRxLr7Q9JR0@spud/ Fixes: 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") Suggested-by: Samuel Holland samuel@sholland.org Signed-off-by: Conor Dooley conor.dooley@microchip.com Signed-off-by: Anup Patel apatel@ventanamicro.com Reviewed-by: Samuel Holland samuel@sholland.org Acked-by: Palmer Dabbelt palmer@rivosinc.com Link: https://lore.kernel.org/r/20230103141102.772228-2-apatel@ventanamicro.com Signed-off-by: Daniel Lezcano daniel.lezcano@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/riscv/kernel/time.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/arch/riscv/kernel/time.c b/arch/riscv/kernel/time.c index 8217b0f67c6cb..1cf21db4fcc77 100644 --- a/arch/riscv/kernel/time.c +++ b/arch/riscv/kernel/time.c @@ -5,6 +5,7 @@ */
#include <linux/of_clk.h> +#include <linux/clockchips.h> #include <linux/clocksource.h> #include <linux/delay.h> #include <asm/sbi.h> @@ -29,6 +30,8 @@ void __init time_init(void)
of_clk_init(NULL); timer_probe(); + + tick_setup_hrtimer_broadcast(); }
void clocksource_arch_init(struct clocksource *cs)
From: Matt Evans mev@rivosinc.com
[ Upstream commit 225b9596cb0227c1c1b1e4a836dad43595c3e61a ]
A static key is used to select between SBI and Sstc timer usage in riscv_clock_next_event(), but currently the direction is resolved after cpuhp_setup_state() is called (which sets the next event). The first event will therefore fall through the sbi_set_timer() path; this breaks Sstc-only systems. So, apply the jump patching before first use.
Fixes: 9f7a8ff6391f ("RISC-V: Prefer sstc extension if available") Signed-off-by: Matt Evans mev@rivosinc.com Reviewed-by: Palmer Dabbelt palmer@rivosinc.com Acked-by: Palmer Dabbelt palmer@rivosinc.com Reviewed-by: Anup Patel anup@brainfault.org Link: https://lore.kernel.org/r/CDDAB2D0-264E-42F3-8E31-BA210BEB8EC1@rivosinc.com Signed-off-by: Daniel Lezcano daniel.lezcano@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/clocksource/timer-riscv.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c index a0d66fabf0732..a01c2bd241349 100644 --- a/drivers/clocksource/timer-riscv.c +++ b/drivers/clocksource/timer-riscv.c @@ -177,6 +177,11 @@ static int __init riscv_timer_init_dt(struct device_node *n) return error; }
+ if (riscv_isa_extension_available(NULL, SSTC)) { + pr_info("Timer interrupt in S-mode is available via sstc extension\n"); + static_branch_enable(&riscv_sstc_available); + } + error = cpuhp_setup_state(CPUHP_AP_RISCV_TIMER_STARTING, "clockevents/riscv/timer:starting", riscv_timer_starting_cpu, riscv_timer_dying_cpu); @@ -184,11 +189,6 @@ static int __init riscv_timer_init_dt(struct device_node *n) pr_err("cpu hp setup state failed for RISCV timer [%d]\n", error);
- if (riscv_isa_extension_available(NULL, SSTC)) { - pr_info("Timer interrupt in S-mode is available via sstc extension\n"); - static_branch_enable(&riscv_sstc_available); - } - return error; }
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb ]
Add the check for the return value of the create_singlethread_workqueue in order to avoid NULL pointer dereference.
Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Acked-by: Stanislaw Gruszka stf_xl@wp.pl Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230208063032.42763-2-jiasheng@iscas.ac.cn Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c index d7e99d50b287b..9eaf5ec133f9e 100644 --- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c +++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c @@ -3372,10 +3372,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log); * *****************************************************************************/
-static void +static int il3945_setup_deferred_work(struct il_priv *il) { il->workqueue = create_singlethread_workqueue(DRV_NAME); + if (!il->workqueue) + return -ENOMEM;
init_waitqueue_head(&il->wait_command_queue);
@@ -3392,6 +3394,8 @@ il3945_setup_deferred_work(struct il_priv *il) timer_setup(&il->watchdog, il_bg_watchdog, 0);
tasklet_setup(&il->irq_tasklet, il3945_irq_tasklet); + + return 0; }
static void @@ -3712,7 +3716,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) }
il_set_rxon_channel(il, &il->bands[NL80211_BAND_2GHZ].channels[5]); - il3945_setup_deferred_work(il); + err = il3945_setup_deferred_work(il); + if (err) + goto out_remove_sysfs; + il3945_setup_handlers(il); il_power_initialize(il);
@@ -3724,7 +3731,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
err = il3945_setup_mac(il); if (err) - goto out_remove_sysfs; + goto out_destroy_workqueue;
il_dbgfs_register(il, DRV_NAME);
@@ -3733,9 +3740,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
return 0;
-out_remove_sysfs: +out_destroy_workqueue: destroy_workqueue(il->workqueue); il->workqueue = NULL; +out_remove_sysfs: sysfs_remove_group(&pdev->dev.kobj, &il3945_attribute_group); out_release_irq: free_irq(il->pci_dev->irq, il);
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 ]
Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference.
Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Acked-by: Stanislaw Gruszka stf_xl@wp.pl Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230209010748.45454-1-jiasheng@iscas.ac.cn Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c index 721b4042b4bf7..4d3c544ff2e66 100644 --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c @@ -6211,10 +6211,12 @@ il4965_bg_txpower_work(struct work_struct *work) mutex_unlock(&il->mutex); }
-static void +static int il4965_setup_deferred_work(struct il_priv *il) { il->workqueue = create_singlethread_workqueue(DRV_NAME); + if (!il->workqueue) + return -ENOMEM;
init_waitqueue_head(&il->wait_command_queue);
@@ -6233,6 +6235,8 @@ il4965_setup_deferred_work(struct il_priv *il) timer_setup(&il->watchdog, il_bg_watchdog, 0);
tasklet_setup(&il->irq_tasklet, il4965_irq_tasklet); + + return 0; }
static void @@ -6618,7 +6622,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) goto out_disable_msi; }
- il4965_setup_deferred_work(il); + err = il4965_setup_deferred_work(il); + if (err) + goto out_free_irq; + il4965_setup_handlers(il);
/********************************************* @@ -6656,6 +6663,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) out_destroy_workqueue: destroy_workqueue(il->workqueue); il->workqueue = NULL; +out_free_irq: free_irq(il->pci_dev->irq, il); out_disable_msi: pci_disable_msi(il->pci_dev);
From: Hector Martin marcan@marcan.st
[ Upstream commit 54f01f56cf63ebb92ac37450d65c7e4da379d4ca ]
The commit that introduced support for this chip incorrectly claimed it is a Cypress-specific part, while in actuality it is just a variant of BCM4355 silicon (as evidenced by the chip ID).
The relationship between Cypress products and Broadcom products isn't entirely clear but given what little information is available and prior art in the driver, it seems the convention should be that originally Broadcom parts should retain the Broadcom name.
Thus, rename the relevant constants and firmware file. Also rename the specific 89459 PCIe ID to BCM43596, which seems to be the original subvariant name for this PCI ID (as defined in the out-of-tree bcmdhd driver).
Since Cypress added this part and will presumably be providing its supported firmware, we keep the CYW designation for this device.
We also drop the RAW device ID in this commit. We don't do this for the other chips since apparently some devices with them exist in the wild, but there is already a 4355 entry with the Broadcom subvendor and WCC firmware vendor, so adding a generic fallback to Cypress seems redundant (no reason why a device would have the raw device ID *and* an explicitly programmed subvendor).
Fixes: dce45ded7619 ("brcmfmac: Support 89459 pcie") Reviewed-by: Arend van Spriel arend.vanspriel@broadcom.com Signed-off-by: Hector Martin marcan@marcan.st Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230212063813.27622-2-marcan@marcan.st Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 5 ++--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 7 +++---- .../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 5 ++--- 3 files changed, 7 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c index 121893bbaa1d7..3e42c2bd0d9ad 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c @@ -726,6 +726,7 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci) case BRCM_CC_43664_CHIP_ID: case BRCM_CC_43666_CHIP_ID: return 0x200000; + case BRCM_CC_4355_CHIP_ID: case BRCM_CC_4359_CHIP_ID: return (ci->pub.chiprev < 9) ? 0x180000 : 0x160000; case BRCM_CC_4364_CHIP_ID: @@ -735,8 +736,6 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci) return 0x170000; case BRCM_CC_4378_CHIP_ID: return 0x352000; - case CY_CC_89459_CHIP_ID: - return ((ci->pub.chiprev < 9) ? 0x180000 : 0x160000); default: brcmf_err("unknown chip: %s\n", ci->pub.name); break; @@ -1426,8 +1425,8 @@ bool brcmf_chip_sr_capable(struct brcmf_chip *pub) addr = CORE_CC_REG(base, sr_control1); reg = chip->ops->read32(chip->ctx, addr); return reg != 0; + case BRCM_CC_4355_CHIP_ID: case CY_CC_4373_CHIP_ID: - case CY_CC_89459_CHIP_ID: /* explicitly check SR engine enable bit */ addr = CORE_CC_REG(base, sr_control0); reg = chip->ops->read32(chip->ctx, addr); diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c index b67f6d0810b6c..8f8d605a7f2da 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -51,6 +51,7 @@ enum brcmf_pcie_state { BRCMF_FW_DEF(43602, "brcmfmac43602-pcie"); BRCMF_FW_DEF(4350, "brcmfmac4350-pcie"); BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie"); +BRCMF_FW_CLM_DEF(4355, "brcmfmac4355-pcie"); BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie"); BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie"); BRCMF_FW_DEF(4358, "brcmfmac4358-pcie"); @@ -62,7 +63,6 @@ BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"); BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie"); BRCMF_FW_DEF(4371, "brcmfmac4371-pcie"); BRCMF_FW_CLM_DEF(4378B1, "brcmfmac4378b1-pcie"); -BRCMF_FW_DEF(4355, "brcmfmac89459-pcie");
/* firmware config files */ MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-pcie.txt"); @@ -78,6 +78,7 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C), BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350), BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C), + BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFFFFF, 4355), BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356), BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570), BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570), @@ -93,7 +94,6 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { BRCMF_FW_ENTRY(BRCM_CC_43666_CHIP_ID, 0xFFFFFFF0, 4366C), BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371), BRCMF_FW_ENTRY(BRCM_CC_4378_CHIP_ID, 0xFFFFFFFF, 4378B1), /* revision ID 3 */ - BRCMF_FW_ENTRY(CY_CC_89459_CHIP_ID, 0xFFFFFFFF, 4355), };
#define BRCMF_PCIE_FW_UP_TIMEOUT 5000 /* msec */ @@ -2609,9 +2609,8 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_2G_DEVICE_ID, BCA), BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID, BCA), BRCMF_PCIE_DEVICE(BRCM_PCIE_4371_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_43596_DEVICE_ID, CYW), BRCMF_PCIE_DEVICE(BRCM_PCIE_4378_DEVICE_ID, WCC), - BRCMF_PCIE_DEVICE(CY_PCIE_89459_DEVICE_ID, CYW), - BRCMF_PCIE_DEVICE(CY_PCIE_89459_RAW_DEVICE_ID, CYW), { /* end: all zeroes */ } };
diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h index f4939cf627672..28b6cf8ff2864 100644 --- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h @@ -37,6 +37,7 @@ #define BRCM_CC_4350_CHIP_ID 0x4350 #define BRCM_CC_43525_CHIP_ID 43525 #define BRCM_CC_4354_CHIP_ID 0x4354 +#define BRCM_CC_4355_CHIP_ID 0x4355 #define BRCM_CC_4356_CHIP_ID 0x4356 #define BRCM_CC_43566_CHIP_ID 43566 #define BRCM_CC_43567_CHIP_ID 43567 @@ -56,7 +57,6 @@ #define CY_CC_43012_CHIP_ID 43012 #define CY_CC_43439_CHIP_ID 43439 #define CY_CC_43752_CHIP_ID 43752 -#define CY_CC_89459_CHIP_ID 0x4355
/* USB Device IDs */ #define BRCM_USB_43143_DEVICE_ID 0xbd1e @@ -90,9 +90,8 @@ #define BRCM_PCIE_4366_2G_DEVICE_ID 0x43c4 #define BRCM_PCIE_4366_5G_DEVICE_ID 0x43c5 #define BRCM_PCIE_4371_DEVICE_ID 0x440d +#define BRCM_PCIE_43596_DEVICE_ID 0x4415 #define BRCM_PCIE_4378_DEVICE_ID 0x4425 -#define CY_PCIE_89459_DEVICE_ID 0x4415 -#define CY_PCIE_89459_RAW_DEVICE_ID 0x4355
/* brcmsmac IDs */ #define BCM4313_D11N2G_ID 0x4727 /* 4313 802.11n 2.4G device */
From: Hector Martin marcan@marcan.st
[ Upstream commit 69005e67ce54cb837b8218b002c1bb868c83b7a9 ]
This chip is present on at least these Apple T2 Macs:
* hawaii: MacBook Air 13" (Late 2018) * hawaii: MacBook Air 13" (True Tone, 2019)
Users report seeing PCI revision ID 12 for this chip, which Arend reports should be revision C2, but Apple has the firmware tagged as revision C1. Assume the right cutoff point for firmware versions is revision ID 11 then, and leave older revisions using the non-versioned firmware filename (Apple only uses C1 firmware builds).
Reviewed-by: Arend van Spriel arend.vanspriel@broadcom.com Signed-off-by: Hector Martin marcan@marcan.st Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230212063813.27622-3-marcan@marcan.st Stable-dep-of: 6a142f70774f ("wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection") Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 10 +++++++++- .../wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 + 2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c index 8f8d605a7f2da..a8d77569faf70 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -52,6 +52,7 @@ BRCMF_FW_DEF(43602, "brcmfmac43602-pcie"); BRCMF_FW_DEF(4350, "brcmfmac4350-pcie"); BRCMF_FW_DEF(4350C, "brcmfmac4350c2-pcie"); BRCMF_FW_CLM_DEF(4355, "brcmfmac4355-pcie"); +BRCMF_FW_CLM_DEF(4355C1, "brcmfmac4355c1-pcie"); BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie"); BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie"); BRCMF_FW_DEF(4358, "brcmfmac4358-pcie"); @@ -78,7 +79,8 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0x000000FF, 4350C), BRCMF_FW_ENTRY(BRCM_CC_4350_CHIP_ID, 0xFFFFFF00, 4350), BRCMF_FW_ENTRY(BRCM_CC_43525_CHIP_ID, 0xFFFFFFF0, 4365C), - BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFFFFF, 4355), + BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0x000007FF, 4355), + BRCMF_FW_ENTRY(BRCM_CC_4355_CHIP_ID, 0xFFFFF800, 4355C1), /* rev ID 12/C2 seen */ BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356), BRCMF_FW_ENTRY(BRCM_CC_43567_CHIP_ID, 0xFFFFFFFF, 43570), BRCMF_FW_ENTRY(BRCM_CC_43569_CHIP_ID, 0xFFFFFFFF, 43570), @@ -1994,6 +1996,11 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo) int ret;
switch (devinfo->ci->chip) { + case BRCM_CC_4355_CHIP_ID: + coreid = BCMA_CORE_CHIPCOMMON; + base = 0x8c0; + words = 0xb2; + break; case BRCM_CC_4378_CHIP_ID: coreid = BCMA_CORE_GCI; base = 0x1120; @@ -2590,6 +2597,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID, WCC), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4355_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID, WCC), diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h index 28b6cf8ff2864..6e27e39666551 100644 --- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h @@ -72,6 +72,7 @@ #define BRCM_PCIE_4350_DEVICE_ID 0x43a3 #define BRCM_PCIE_4354_DEVICE_ID 0x43df #define BRCM_PCIE_4354_RAW_DEVICE_ID 0x4354 +#define BRCM_PCIE_4355_DEVICE_ID 0x43dc #define BRCM_PCIE_4356_DEVICE_ID 0x43ec #define BRCM_PCIE_43567_DEVICE_ID 0x43d3 #define BRCM_PCIE_43570_DEVICE_ID 0x43d9
From: Hector Martin marcan@marcan.st
[ Upstream commit bf8bbd903f07aabfef8d4cb3b513163a3e974d2b ]
This chip is present on at least these Apple T2 Macs:
* tahiti: MacBook Pro 13" (2020, 2 TB3) * formosa: MacBook Pro 13" (Touch/2019) * fiji: MacBook Air 13" (Scissor, 2020)
Reviewed-by: Linus Walleij linus.walleij@linaro.org Reviewed-by: Arend van Spriel arend.vanspriel@broadcom.com Signed-off-by: Hector Martin marcan@marcan.st Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230212063813.27622-4-marcan@marcan.st Stable-dep-of: 6a142f70774f ("wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 5 +++++ .../net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 2 ++ 3 files changed, 8 insertions(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c index 3e42c2bd0d9ad..8073f31be27d9 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c @@ -733,6 +733,7 @@ static u32 brcmf_chip_tcm_rambase(struct brcmf_chip_priv *ci) case CY_CC_4373_CHIP_ID: return 0x160000; case CY_CC_43752_CHIP_ID: + case BRCM_CC_4377_CHIP_ID: return 0x170000; case BRCM_CC_4378_CHIP_ID: return 0x352000; diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c index a8d77569faf70..b752a65de2dcb 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -63,6 +63,7 @@ BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie"); BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"); BRCMF_FW_DEF(4366C, "brcmfmac4366c-pcie"); BRCMF_FW_DEF(4371, "brcmfmac4371-pcie"); +BRCMF_FW_CLM_DEF(4377B3, "brcmfmac4377b3-pcie"); BRCMF_FW_CLM_DEF(4378B1, "brcmfmac4378b1-pcie");
/* firmware config files */ @@ -95,6 +96,7 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { BRCMF_FW_ENTRY(BRCM_CC_43664_CHIP_ID, 0xFFFFFFF0, 4366C), BRCMF_FW_ENTRY(BRCM_CC_43666_CHIP_ID, 0xFFFFFFF0, 4366C), BRCMF_FW_ENTRY(BRCM_CC_4371_CHIP_ID, 0xFFFFFFFF, 4371), + BRCMF_FW_ENTRY(BRCM_CC_4377_CHIP_ID, 0xFFFFFFFF, 4377B3), /* revision ID 4 */ BRCMF_FW_ENTRY(BRCM_CC_4378_CHIP_ID, 0xFFFFFFFF, 4378B1), /* revision ID 3 */ };
@@ -2001,6 +2003,7 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo) base = 0x8c0; words = 0xb2; break; + case BRCM_CC_4377_CHIP_ID: case BRCM_CC_4378_CHIP_ID: coreid = BCMA_CORE_GCI; base = 0x1120; @@ -2618,7 +2621,9 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { BRCMF_PCIE_DEVICE(BRCM_PCIE_4366_5G_DEVICE_ID, BCA), BRCMF_PCIE_DEVICE(BRCM_PCIE_4371_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_43596_DEVICE_ID, CYW), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4377_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_4378_DEVICE_ID, WCC), + { /* end: all zeroes */ } };
diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h index 6e27e39666551..896615f579522 100644 --- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h +++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h @@ -52,6 +52,7 @@ #define BRCM_CC_43664_CHIP_ID 43664 #define BRCM_CC_43666_CHIP_ID 43666 #define BRCM_CC_4371_CHIP_ID 0x4371 +#define BRCM_CC_4377_CHIP_ID 0x4377 #define BRCM_CC_4378_CHIP_ID 0x4378 #define CY_CC_4373_CHIP_ID 0x4373 #define CY_CC_43012_CHIP_ID 43012 @@ -92,6 +93,7 @@ #define BRCM_PCIE_4366_5G_DEVICE_ID 0x43c5 #define BRCM_PCIE_4371_DEVICE_ID 0x440d #define BRCM_PCIE_43596_DEVICE_ID 0x4415 +#define BRCM_PCIE_4377_DEVICE_ID 0x4488 #define BRCM_PCIE_4378_DEVICE_ID 0x4425
/* brcmsmac IDs */
From: Hector Martin marcan@marcan.st
[ Upstream commit 6a142f70774fd10350a52a10ba1297d52da46780 ]
This chip exists in two revisions (B2=r3 and B3=r4) on different platforms, and was added without regard to doing proper firmware selection or differentiating between them. Fix this to have proper per-revision firmwares and support Apple NVRAM selection.
Revision B2 is present on at least these Apple T2 Macs:
kauai: MacBook Pro 15" (Touch/2018-2019) maui: MacBook Pro 13" (Touch/2018-2019) lanai: Mac mini (Late 2018) ekans: iMac Pro 27" (5K, Late 2017)
And these non-T2 Macs:
nihau: iMac 27" (5K, 2019)
Revision B3 is present on at least these Apple T2 Macs:
bali: MacBook Pro 16" (2019) trinidad: MacBook Pro 13" (2020, 4 TB3) borneo: MacBook Pro 16" (2019, 5600M) kahana: Mac Pro (2019) kahana: Mac Pro (2019, Rack) hanauma: iMac 27" (5K, 2020) kure: iMac 27" (5K, 2020, 5700/XT)
Also fix the firmware interface for 4364, from BCA to WCC.
Fixes: 24f0bd136264 ("brcmfmac: add the BRCM 4364 found in MacBook Pro 15,2") Reviewed-by: Linus Walleij linus.walleij@linaro.org Reviewed-by: Arend van Spriel arend.vanspriel@broadcom.com Signed-off-by: Hector Martin marcan@marcan.st Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230212063813.27622-5-marcan@marcan.st Signed-off-by: Sasha Levin sashal@kernel.org --- .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c index b752a65de2dcb..a9b9b2dc62d4f 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -57,7 +57,8 @@ BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-pcie"); BRCMF_FW_CLM_DEF(43570, "brcmfmac43570-pcie"); BRCMF_FW_DEF(4358, "brcmfmac4358-pcie"); BRCMF_FW_DEF(4359, "brcmfmac4359-pcie"); -BRCMF_FW_DEF(4364, "brcmfmac4364-pcie"); +BRCMF_FW_CLM_DEF(4364B2, "brcmfmac4364b2-pcie"); +BRCMF_FW_CLM_DEF(4364B3, "brcmfmac4364b3-pcie"); BRCMF_FW_DEF(4365B, "brcmfmac4365b-pcie"); BRCMF_FW_DEF(4365C, "brcmfmac4365c-pcie"); BRCMF_FW_DEF(4366B, "brcmfmac4366b-pcie"); @@ -88,7 +89,8 @@ static const struct brcmf_firmware_mapping brcmf_pcie_fwnames[] = { BRCMF_FW_ENTRY(BRCM_CC_43570_CHIP_ID, 0xFFFFFFFF, 43570), BRCMF_FW_ENTRY(BRCM_CC_4358_CHIP_ID, 0xFFFFFFFF, 4358), BRCMF_FW_ENTRY(BRCM_CC_4359_CHIP_ID, 0xFFFFFFFF, 4359), - BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0xFFFFFFFF, 4364), + BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0x0000000F, 4364B2), /* 3 */ + BRCMF_FW_ENTRY(BRCM_CC_4364_CHIP_ID, 0xFFFFFFF0, 4364B3), /* 4 */ BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0x0000000F, 4365B), BRCMF_FW_ENTRY(BRCM_CC_4365_CHIP_ID, 0xFFFFFFF0, 4365C), BRCMF_FW_ENTRY(BRCM_CC_4366_CHIP_ID, 0x0000000F, 4366B), @@ -2003,6 +2005,11 @@ static int brcmf_pcie_read_otp(struct brcmf_pciedev_info *devinfo) base = 0x8c0; words = 0xb2; break; + case BRCM_CC_4364_CHIP_ID: + coreid = BCMA_CORE_CHIPCOMMON; + base = 0x8c0; + words = 0x1a0; + break; case BRCM_CC_4377_CHIP_ID: case BRCM_CC_4378_CHIP_ID: coreid = BCMA_CORE_GCI; @@ -2611,7 +2618,7 @@ static const struct pci_device_id brcmf_pcie_devid_table[] = { BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_2G_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_5G_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_43602_RAW_DEVICE_ID, WCC), - BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, BCA), + BRCMF_PCIE_DEVICE(BRCM_PCIE_4364_DEVICE_ID, WCC), BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_DEVICE_ID, BCA), BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_2G_DEVICE_ID, BCA), BRCMF_PCIE_DEVICE(BRCM_PCIE_4365_5G_DEVICE_ID, BCA),
From: Dan Carpenter error27@gmail.com
[ Upstream commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 ]
This code re-uses "i" to be the iterator for both the inside and outside loops. It means the outside loop will exit earlier than intended.
Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size") Signed-off-by: Dan Carpenter error27@gmail.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/Y+ERnaDaZD7RtLvX@kili Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c index 4af57e6d43932..90e4011008981 100644 --- a/drivers/net/wireless/marvell/mwifiex/11n.c +++ b/drivers/net/wireless/marvell/mwifiex/11n.c @@ -878,7 +878,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid) */ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter) { - u8 i; + u8 i, j; u32 tx_win_size; struct mwifiex_private *priv;
@@ -909,8 +909,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter) if (tx_win_size != priv->add_ba_param.tx_win_size) { if (!priv->media_connected) continue; - for (i = 0; i < MAX_NUM_TID; i++) - mwifiex_send_delba_txbastream_tbl(priv, i); + for (j = 0; j < MAX_NUM_TID; j++) + mwifiex_send_delba_txbastream_tbl(priv, j); } } }
From: Zong-Zhe Yang kevin_yang@realtek.com
[ Upstream commit 24d72944d79e6795ba4330c114de0387386bf3aa ]
A 8-byte offset is missed during parsing C2Hs (chip to host packets) of MCC (multi-channel concurrent) series. So, we fix it.
Fixes: ef9dff4cb491 ("wifi: rtw89: mac: process MCC related C2H") Signed-off-by: Zong-Zhe Yang kevin_yang@realtek.com Signed-off-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230119064342.65391-1-pkshih@realtek.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw89/fw.h | 34 ++++++++++++------------- 1 file changed, 17 insertions(+), 17 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.h b/drivers/net/wireless/realtek/rtw89/fw.h index 4d2f9ea9e0022..2e4ca1cc5cae9 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.h +++ b/drivers/net/wireless/realtek/rtw89/fw.h @@ -3209,16 +3209,16 @@ static inline struct rtw89_fw_c2h_attr *RTW89_SKB_C2H_CB(struct sk_buff *skb) le32_get_bits(*((const __le32 *)(c2h) + 5), GENMASK(25, 24))
#define RTW89_GET_MAC_C2H_MCC_RCV_ACK_GROUP(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(1, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(1, 0)) #define RTW89_GET_MAC_C2H_MCC_RCV_ACK_H2C_FUNC(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8))
#define RTW89_GET_MAC_C2H_MCC_REQ_ACK_GROUP(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(1, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(1, 0)) #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_H2C_RETURN(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 2)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 2)) #define RTW89_GET_MAC_C2H_MCC_REQ_ACK_H2C_FUNC(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8))
struct rtw89_mac_mcc_tsf_rpt { u32 macid_x; @@ -3232,30 +3232,30 @@ struct rtw89_mac_mcc_tsf_rpt { static_assert(sizeof(struct rtw89_mac_mcc_tsf_rpt) <= RTW89_COMPLETION_BUF_SIZE);
#define RTW89_GET_MAC_C2H_MCC_TSF_RPT_MACID_X(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 0)) #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_MACID_Y(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8)) #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_GROUP(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(17, 16)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(17, 16)) #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_LOW_X(c2h) \ - le32_get_bits(*((const __le32 *)(c2h) + 1), GENMASK(31, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0)) #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_HIGH_X(c2h) \ - le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(31, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0)) #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_LOW_Y(c2h) \ - le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 5), GENMASK(31, 0)) #define RTW89_GET_MAC_C2H_MCC_TSF_RPT_TSF_HIGH_Y(c2h) \ - le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 6), GENMASK(31, 0))
#define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_STATUS(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(5, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(5, 0)) #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_GROUP(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(7, 6)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(7, 6)) #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_MACID(c2h) \ - le32_get_bits(*((const __le32 *)(c2h)), GENMASK(15, 8)) + le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(15, 8)) #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_TSF_LOW(c2h) \ - le32_get_bits(*((const __le32 *)(c2h) + 1), GENMASK(31, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 3), GENMASK(31, 0)) #define RTW89_GET_MAC_C2H_MCC_STATUS_RPT_TSF_HIGH(c2h) \ - le32_get_bits(*((const __le32 *)(c2h) + 2), GENMASK(31, 0)) + le32_get_bits(*((const __le32 *)(c2h) + 4), GENMASK(31, 0))
#define RTW89_FW_HDR_SIZE 32 #define RTW89_FW_SECTION_HDR_SIZE 16
From: Ilya Leoshkevich iii@linux.ibm.com
[ Upstream commit 0b0757244754ea1d0721195c824770f5576e119e ]
Building BPF selftests out of srctree fails with:
make: *** No rule to make target '/linux-build//ima_setup.sh', needed by 'ima_setup.sh'. Stop.
The culprit is the rule that defines convenient shorthands like "make test_progs", which builds $(OUTPUT)/test_progs. These shorthands make sense only for binaries that are built though; scripts that live in the source tree do not end up in $(OUTPUT).
Therefore drop $(TEST_PROGS) and $(TEST_PROGS_EXTENDED) from the rule.
The issue exists for a while, but it became a problem only after commit d68ae4982cb7 ("selftests/bpf: Install all required files to run selftests"), which added dependencies on these scripts.
Fixes: 03dcb78460c2 ("selftests/bpf: Add simple per-test targets to Makefile") Signed-off-by: Ilya Leoshkevich iii@linux.ibm.com Signed-off-by: Daniel Borkmann daniel@iogearbox.net Link: https://lore.kernel.org/bpf/20230208231211.283606-1-iii@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/bpf/Makefile | 2 -- 1 file changed, 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index 2323a2b98b815..43c559b7729b5 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -149,8 +149,6 @@ endif # NOTE: Semicolon at the end is critical to override lib.mk's default static # rule for binaries. $(notdir $(TEST_GEN_PROGS) \ - $(TEST_PROGS) \ - $(TEST_PROGS_EXTENDED) \ $(TEST_GEN_PROGS_EXTENDED) \ $(TEST_CUSTOM_PROGS)): %: $(OUTPUT)/% ;
From: Adam Niederer adam.niederer@gmail.com
[ Upstream commit cb18703c179713056bd7e3bdfc2260ab4e8658f0 ]
Fix a regression introduced by commit 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") on MAINGEAR Vector Pro 2 systems, which causes the built-in keyboard to not work. This restores the functionality by adding an IRQ override.
No other IRQs were being overridden before, so this should be all that is needed for these systems. I have personally tested this on the 15" model (MG-VCP2-15A3070T), and I have confirmation that the issue is present on the 17" model (MG-VCP2-17A3070T).
Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") Signed-off-by: Adam Niederer adam.niederer@gmail.com Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/acpi/resource.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c index 192d1784e409b..1d9d3364bc2b5 100644 --- a/drivers/acpi/resource.c +++ b/drivers/acpi/resource.c @@ -478,6 +478,24 @@ static const struct dmi_system_id schenker_gm_rg[] = { { } };
+static const struct dmi_system_id maingear_laptop[] = { + { + .ident = "MAINGEAR Vector Pro 2 15", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"), + DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-15A3070T"), + } + }, + { + .ident = "MAINGEAR Vector Pro 2 17", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"), + DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-17A3070T"), + }, + }, + { } +}; + struct irq_override_cmp { const struct dmi_system_id *system; unsigned char irq; @@ -493,6 +511,7 @@ static const struct irq_override_cmp override_table[] = { { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, };
static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
From: Werner Sembach wse@tuxedocomputers.com
[ Upstream commit 17bb7046e7ce038a73ee97eaa804e0300c5199e2 ]
Apply commit 7592b79ba4a9 ("ACPI: resource: do IRQ override on XMG Core 15") override for all vendors using this mainboard.
Signed-off-by: Werner Sembach wse@tuxedocomputers.com Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/acpi/resource.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c index 1d9d3364bc2b5..a222bda7e15b0 100644 --- a/drivers/acpi/resource.c +++ b/drivers/acpi/resource.c @@ -467,11 +467,10 @@ static const struct dmi_system_id lenovo_laptop[] = { { } };
-static const struct dmi_system_id schenker_gm_rg[] = { +static const struct dmi_system_id tongfang_gm_rg[] = { { - .ident = "XMG CORE 15 (M22)", + .ident = "TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD", .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"), }, }, @@ -510,7 +509,7 @@ static const struct irq_override_cmp override_table[] = { { asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, - { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + { tongfang_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, };
From: Alexander Lobakin alobakin@pm.me
[ Upstream commit 72bc4e71dbeedee0a446bcbc37c9bb25449072b7 ]
cn10k_cpt.o, otx2_cptlf.o and otx2_cpt_mbox_common.o are linked into both rvu_cptpf and rvu_cptvf modules:
scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: cn10k_cpt.o is added to multiple modules: rvu_cptpf rvu_cptvf scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: otx2_cptlf.o is added to multiple modules: rvu_cptpf rvu_cptvf scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: otx2_cpt_mbox_common.o is added to multiple modules: rvu_cptpf rvu_cptvf
Despite they're build under the same Kconfig option (CONFIG_CRYPTO_DEV_OCTEONTX2_CPT), it's better do link the common code into a standalone module and export the shared functions. Under certain circumstances, this can lead to the same situation as fixed by commit 637a642f5ca5 ("zstd: Fixing mixed module-builtin objects"). Plus, those three common object files are relatively big to duplicate them several times.
Introduce the new module, rvu_cptcommon, to provide the common functions to both modules.
Fixes: 19d8e8c7be15 ("crypto: octeontx2 - add virtual function driver support") Suggested-by: Masahiro Yamada masahiroy@kernel.org Signed-off-by: Alexander Lobakin alobakin@pm.me Reviewed-by: Masahiro Yamada masahiroy@kernel.org Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/crypto/marvell/octeontx2/Makefile | 11 +++++------ drivers/crypto/marvell/octeontx2/cn10k_cpt.c | 9 +++++++-- drivers/crypto/marvell/octeontx2/cn10k_cpt.h | 2 -- drivers/crypto/marvell/octeontx2/otx2_cpt_common.h | 2 -- .../marvell/octeontx2/otx2_cpt_mbox_common.c | 14 ++++++++++++-- drivers/crypto/marvell/octeontx2/otx2_cptlf.c | 11 +++++++++++ drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c | 2 ++ drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 2 ++ 8 files changed, 39 insertions(+), 14 deletions(-)
diff --git a/drivers/crypto/marvell/octeontx2/Makefile b/drivers/crypto/marvell/octeontx2/Makefile index 965297e969546..f0f2942c1d278 100644 --- a/drivers/crypto/marvell/octeontx2/Makefile +++ b/drivers/crypto/marvell/octeontx2/Makefile @@ -1,11 +1,10 @@ # SPDX-License-Identifier: GPL-2.0-only -obj-$(CONFIG_CRYPTO_DEV_OCTEONTX2_CPT) += rvu_cptpf.o rvu_cptvf.o +obj-$(CONFIG_CRYPTO_DEV_OCTEONTX2_CPT) += rvu_cptcommon.o rvu_cptpf.o rvu_cptvf.o
+rvu_cptcommon-objs := cn10k_cpt.o otx2_cptlf.o otx2_cpt_mbox_common.o rvu_cptpf-objs := otx2_cptpf_main.o otx2_cptpf_mbox.o \ - otx2_cpt_mbox_common.o otx2_cptpf_ucode.o otx2_cptlf.o \ - cn10k_cpt.o otx2_cpt_devlink.o -rvu_cptvf-objs := otx2_cptvf_main.o otx2_cptvf_mbox.o otx2_cptlf.o \ - otx2_cpt_mbox_common.o otx2_cptvf_reqmgr.o \ - otx2_cptvf_algs.o cn10k_cpt.o + otx2_cptpf_ucode.o otx2_cpt_devlink.o +rvu_cptvf-objs := otx2_cptvf_main.o otx2_cptvf_mbox.o \ + otx2_cptvf_reqmgr.o otx2_cptvf_algs.o
ccflags-y += -I$(srctree)/drivers/net/ethernet/marvell/octeontx2/af diff --git a/drivers/crypto/marvell/octeontx2/cn10k_cpt.c b/drivers/crypto/marvell/octeontx2/cn10k_cpt.c index 1499ef75b5c22..93d22b3289919 100644 --- a/drivers/crypto/marvell/octeontx2/cn10k_cpt.c +++ b/drivers/crypto/marvell/octeontx2/cn10k_cpt.c @@ -7,6 +7,9 @@ #include "otx2_cptlf.h" #include "cn10k_cpt.h"
+static void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num, + struct otx2_cptlf_info *lf); + static struct cpt_hw_ops otx2_hw_ops = { .send_cmd = otx2_cpt_send_cmd, .cpt_get_compcode = otx2_cpt_get_compcode, @@ -19,8 +22,8 @@ static struct cpt_hw_ops cn10k_hw_ops = { .cpt_get_uc_compcode = cn10k_cpt_get_uc_compcode, };
-void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num, - struct otx2_cptlf_info *lf) +static void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num, + struct otx2_cptlf_info *lf) { void __iomem *lmtline = lf->lmtline; u64 val = (lf->slot & 0x7FF); @@ -68,6 +71,7 @@ int cn10k_cptpf_lmtst_init(struct otx2_cptpf_dev *cptpf)
return 0; } +EXPORT_SYMBOL_NS_GPL(cn10k_cptpf_lmtst_init, CRYPTO_DEV_OCTEONTX2_CPT);
int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf) { @@ -91,3 +95,4 @@ int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf)
return 0; } +EXPORT_SYMBOL_NS_GPL(cn10k_cptvf_lmtst_init, CRYPTO_DEV_OCTEONTX2_CPT); diff --git a/drivers/crypto/marvell/octeontx2/cn10k_cpt.h b/drivers/crypto/marvell/octeontx2/cn10k_cpt.h index c091392b47e0f..aaefc7e38e060 100644 --- a/drivers/crypto/marvell/octeontx2/cn10k_cpt.h +++ b/drivers/crypto/marvell/octeontx2/cn10k_cpt.h @@ -28,8 +28,6 @@ static inline u8 otx2_cpt_get_uc_compcode(union otx2_cpt_res_s *result) return ((struct cn9k_cpt_res_s *)result)->uc_compcode; }
-void cn10k_cpt_send_cmd(union otx2_cpt_inst_s *cptinst, u32 insts_num, - struct otx2_cptlf_info *lf); int cn10k_cptpf_lmtst_init(struct otx2_cptpf_dev *cptpf); int cn10k_cptvf_lmtst_init(struct otx2_cptvf_dev *cptvf);
diff --git a/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h b/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h index 5012b7e669f07..6019066a6451a 100644 --- a/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h +++ b/drivers/crypto/marvell/octeontx2/otx2_cpt_common.h @@ -145,8 +145,6 @@ int otx2_cpt_send_mbox_msg(struct otx2_mbox *mbox, struct pci_dev *pdev);
int otx2_cpt_send_af_reg_requests(struct otx2_mbox *mbox, struct pci_dev *pdev); -int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, - u64 reg, u64 *val, int blkaddr); int otx2_cpt_add_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, u64 reg, u64 val, int blkaddr); int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, diff --git a/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c b/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c index a317319696eff..115997475beb3 100644 --- a/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c +++ b/drivers/crypto/marvell/octeontx2/otx2_cpt_mbox_common.c @@ -19,6 +19,7 @@ int otx2_cpt_send_mbox_msg(struct otx2_mbox *mbox, struct pci_dev *pdev) } return ret; } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_mbox_msg, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cpt_send_ready_msg(struct otx2_mbox *mbox, struct pci_dev *pdev) { @@ -36,14 +37,17 @@ int otx2_cpt_send_ready_msg(struct otx2_mbox *mbox, struct pci_dev *pdev)
return otx2_cpt_send_mbox_msg(mbox, pdev); } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_ready_msg, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cpt_send_af_reg_requests(struct otx2_mbox *mbox, struct pci_dev *pdev) { return otx2_cpt_send_mbox_msg(mbox, pdev); } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_send_af_reg_requests, CRYPTO_DEV_OCTEONTX2_CPT);
-int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, - u64 reg, u64 *val, int blkaddr) +static int otx2_cpt_add_read_af_reg(struct otx2_mbox *mbox, + struct pci_dev *pdev, u64 reg, + u64 *val, int blkaddr) { struct cpt_rd_wr_reg_msg *reg_msg;
@@ -91,6 +95,7 @@ int otx2_cpt_add_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
return 0; } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_add_write_af_reg, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, u64 reg, u64 *val, int blkaddr) @@ -103,6 +108,7 @@ int otx2_cpt_read_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
return otx2_cpt_send_mbox_msg(mbox, pdev); } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_read_af_reg, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cpt_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev, u64 reg, u64 val, int blkaddr) @@ -115,6 +121,7 @@ int otx2_cpt_write_af_reg(struct otx2_mbox *mbox, struct pci_dev *pdev,
return otx2_cpt_send_mbox_msg(mbox, pdev); } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_write_af_reg, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cpt_attach_rscrs_msg(struct otx2_cptlfs_info *lfs) { @@ -170,6 +177,7 @@ int otx2_cpt_detach_rsrcs_msg(struct otx2_cptlfs_info *lfs)
return ret; } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_detach_rsrcs_msg, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cpt_msix_offset_msg(struct otx2_cptlfs_info *lfs) { @@ -202,6 +210,7 @@ int otx2_cpt_msix_offset_msg(struct otx2_cptlfs_info *lfs) } return ret; } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_msix_offset_msg, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cpt_sync_mbox_msg(struct otx2_mbox *mbox) { @@ -216,3 +225,4 @@ int otx2_cpt_sync_mbox_msg(struct otx2_mbox *mbox)
return otx2_mbox_check_rsp_msgs(mbox, 0); } +EXPORT_SYMBOL_NS_GPL(otx2_cpt_sync_mbox_msg, CRYPTO_DEV_OCTEONTX2_CPT); diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c index c8350fcd60fab..71e5f79431afa 100644 --- a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c +++ b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c @@ -274,6 +274,8 @@ void otx2_cptlf_unregister_interrupts(struct otx2_cptlfs_info *lfs) } cptlf_disable_intrs(lfs); } +EXPORT_SYMBOL_NS_GPL(otx2_cptlf_unregister_interrupts, + CRYPTO_DEV_OCTEONTX2_CPT);
static int cptlf_do_register_interrrupts(struct otx2_cptlfs_info *lfs, int lf_num, int irq_offset, @@ -321,6 +323,7 @@ int otx2_cptlf_register_interrupts(struct otx2_cptlfs_info *lfs) otx2_cptlf_unregister_interrupts(lfs); return ret; } +EXPORT_SYMBOL_NS_GPL(otx2_cptlf_register_interrupts, CRYPTO_DEV_OCTEONTX2_CPT);
void otx2_cptlf_free_irqs_affinity(struct otx2_cptlfs_info *lfs) { @@ -334,6 +337,7 @@ void otx2_cptlf_free_irqs_affinity(struct otx2_cptlfs_info *lfs) free_cpumask_var(lfs->lf[slot].affinity_mask); } } +EXPORT_SYMBOL_NS_GPL(otx2_cptlf_free_irqs_affinity, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cptlf_set_irqs_affinity(struct otx2_cptlfs_info *lfs) { @@ -366,6 +370,7 @@ int otx2_cptlf_set_irqs_affinity(struct otx2_cptlfs_info *lfs) otx2_cptlf_free_irqs_affinity(lfs); return ret; } +EXPORT_SYMBOL_NS_GPL(otx2_cptlf_set_irqs_affinity, CRYPTO_DEV_OCTEONTX2_CPT);
int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri, int lfs_num) @@ -422,6 +427,7 @@ int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri, lfs->lfs_num = 0; return ret; } +EXPORT_SYMBOL_NS_GPL(otx2_cptlf_init, CRYPTO_DEV_OCTEONTX2_CPT);
void otx2_cptlf_shutdown(struct otx2_cptlfs_info *lfs) { @@ -431,3 +437,8 @@ void otx2_cptlf_shutdown(struct otx2_cptlfs_info *lfs) /* Send request to detach LFs */ otx2_cpt_detach_rsrcs_msg(lfs); } +EXPORT_SYMBOL_NS_GPL(otx2_cptlf_shutdown, CRYPTO_DEV_OCTEONTX2_CPT); + +MODULE_AUTHOR("Marvell"); +MODULE_DESCRIPTION("Marvell RVU CPT Common module"); +MODULE_LICENSE("GPL"); diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c index a402ccfac5577..ddf6e913c1c45 100644 --- a/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c +++ b/drivers/crypto/marvell/octeontx2/otx2_cptpf_main.c @@ -831,6 +831,8 @@ static struct pci_driver otx2_cpt_pci_driver = {
module_pci_driver(otx2_cpt_pci_driver);
+MODULE_IMPORT_NS(CRYPTO_DEV_OCTEONTX2_CPT); + MODULE_AUTHOR("Marvell"); MODULE_DESCRIPTION(OTX2_CPT_DRV_STRING); MODULE_LICENSE("GPL v2"); diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c index 3411e664cf50c..392e9fee05e81 100644 --- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c +++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c @@ -429,6 +429,8 @@ static struct pci_driver otx2_cptvf_pci_driver = {
module_pci_driver(otx2_cptvf_pci_driver);
+MODULE_IMPORT_NS(CRYPTO_DEV_OCTEONTX2_CPT); + MODULE_AUTHOR("Marvell"); MODULE_DESCRIPTION("Marvell RVU CPT Virtual Function Driver"); MODULE_LICENSE("GPL v2");
From: Herbert Xu herbert@gondor.apana.org.au
[ Upstream commit bcdda4301bdc4955d45f7e1ffefb6207967b067e ]
In crypto4xx_cipher_done, we should be unmapping the dst page, not mapping it.
This was flagged by a sparse warning about the unused addr variable. While we're at it, also fix a sparse warning regarding the unused ctx variable in crypto4xx_ahash_done (by actually using it).
Fixes: 049359d65527 ("crypto: amcc - Add crypt4xx driver") Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Tested-by: Christian Lamparter chunkeey@gmail.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c index 280f4b0e71334..50dc783821b69 100644 --- a/drivers/crypto/amcc/crypto4xx_core.c +++ b/drivers/crypto/amcc/crypto4xx_core.c @@ -522,7 +522,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, { struct skcipher_request *req; struct scatterlist *dst; - dma_addr_t addr;
req = skcipher_request_cast(pd_uinfo->async_req);
@@ -531,8 +530,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, req->cryptlen, req->dst); } else { dst = pd_uinfo->dest_va; - addr = dma_map_page(dev->core_dev->device, sg_page(dst), - dst->offset, dst->length, DMA_FROM_DEVICE); + dma_unmap_page(dev->core_dev->device, pd->dest, dst->length, + DMA_FROM_DEVICE); }
if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) { @@ -557,10 +556,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev, struct ahash_request *ahash_req;
ahash_req = ahash_request_cast(pd_uinfo->async_req); - ctx = crypto_tfm_ctx(ahash_req->base.tfm); + ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req));
- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, - crypto_tfm_ctx(ahash_req->base.tfm)); + crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx); crypto4xx_ret_sg_desc(dev, pd_uinfo);
if (pd_uinfo->state & PD_ENTRY_BUSY)
From: Eric Farman farman@linux.ibm.com
[ Upstream commit 1c06bb87afb2d95b8e9f4f2e3d0d6772c68f3e76 ]
The logic in vfio_ccw_sch_shutdown() always assumed that the input subchannel would point to a vfio_ccw_private struct, without checking that one exists. The blamed commit put in a check for this scenario, to prevent the possibility of a missing private.
The trouble is that check was put alongside a WARN_ON(), presuming that such a scenario would be a cause for concern. But this can be triggered by binding a subchannel to vfio-ccw, and rebooting the system before starting the mdev (via "mdevctl start" or similar) or after stopping it. In those cases, shutdown doesn't need to worry because either the private was never allocated, or it was cleaned up by vfio_ccw_mdev_remove().
Remove the WARN_ON() piece of this check, since there are plausible scenarios where private would be NULL in this path.
Fixes: 9e6f07cd1eaa ("vfio/ccw: create a parent struct") Signed-off-by: Eric Farman farman@linux.ibm.com Reviewed-by: Matthew Rosato mjrosato@linux.ibm.com Link: https://lore.kernel.org/r/20230210174227.2256424-1-farman@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/s390/cio/vfio_ccw_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c index 54aba7cceb33f..ff538a086fc77 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -225,7 +225,7 @@ static void vfio_ccw_sch_shutdown(struct subchannel *sch) struct vfio_ccw_parent *parent = dev_get_drvdata(&sch->dev); struct vfio_ccw_private *private = dev_get_drvdata(&parent->dev);
- if (WARN_ON(!private)) + if (!private) return;
vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_CLOSE);
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit 9288188438d85e22c23cfd6657ee8a801babc83c ]
Move color collision report in a dedicated delayed work and do not run it in interrupt context in order to rate-limit the number of events reported to userspace. Moreover grab wdev mutex in ieee80211_color_collision_detection_work routine since it is required by cfg80211_obss_color_collision_notify().
Tested-by: Nicolas Cavallari nicolas.cavallari@green-communications.fr Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Fixes: 5f9404abdf2a ("mac80211: add support for BSS color change") Link: https://lore.kernel.org/r/3f6cf60c892ad40c1cca4a55d62b1224ef1c6ce9.167464437... Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/cfg.c | 26 +++++++++++++++++++++++++- net/mac80211/ieee80211_i.h | 3 +++ net/mac80211/link.c | 3 +++ 3 files changed, 31 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 672eff6f5d328..d611e15301839 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -4622,6 +4622,20 @@ void ieee80211_color_change_finalize_work(struct work_struct *work) sdata_unlock(sdata); }
+void ieee80211_color_collision_detection_work(struct work_struct *work) +{ + struct delayed_work *delayed_work = to_delayed_work(work); + struct ieee80211_link_data *link = + container_of(delayed_work, struct ieee80211_link_data, + color_collision_detect_work); + struct ieee80211_sub_if_data *sdata = link->sdata; + + sdata_lock(sdata); + cfg80211_obss_color_collision_notify(sdata->dev, link->color_bitmap, + GFP_KERNEL); + sdata_unlock(sdata); +} + void ieee80211_color_change_finish(struct ieee80211_vif *vif) { struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); @@ -4636,11 +4650,21 @@ ieeee80211_obss_color_collision_notify(struct ieee80211_vif *vif, u64 color_bitmap, gfp_t gfp) { struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); + struct ieee80211_link_data *link = &sdata->deflink;
if (sdata->vif.bss_conf.color_change_active || sdata->vif.bss_conf.csa_active) return;
- cfg80211_obss_color_collision_notify(sdata->dev, color_bitmap, gfp); + if (delayed_work_pending(&link->color_collision_detect_work)) + return; + + link->color_bitmap = color_bitmap; + /* queue the color collision detection event every 500 ms in order to + * avoid sending too much netlink messages to userspace. + */ + ieee80211_queue_delayed_work(&sdata->local->hw, + &link->color_collision_detect_work, + msecs_to_jiffies(500)); } EXPORT_SYMBOL_GPL(ieeee80211_obss_color_collision_notify);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index d16606e84e22d..7ca9bde3c6d25 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -974,6 +974,8 @@ struct ieee80211_link_data { struct cfg80211_chan_def csa_chandef;
struct work_struct color_change_finalize_work; + struct delayed_work color_collision_detect_work; + u64 color_bitmap;
/* context reservation -- protected with chanctx_mtx */ struct ieee80211_chanctx *reserved_chanctx; @@ -1929,6 +1931,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
/* color change handling */ void ieee80211_color_change_finalize_work(struct work_struct *work); +void ieee80211_color_collision_detection_work(struct work_struct *work);
/* interface handling */ #define MAC80211_SUPPORTED_FEATURES_TX (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \ diff --git a/net/mac80211/link.c b/net/mac80211/link.c index d1f5a9f7c6470..8c8869cc1fb4c 100644 --- a/net/mac80211/link.c +++ b/net/mac80211/link.c @@ -39,6 +39,8 @@ void ieee80211_link_init(struct ieee80211_sub_if_data *sdata, ieee80211_csa_finalize_work); INIT_WORK(&link->color_change_finalize_work, ieee80211_color_change_finalize_work); + INIT_DELAYED_WORK(&link->color_collision_detect_work, + ieee80211_color_collision_detection_work); INIT_LIST_HEAD(&link->assigned_chanctx_list); INIT_LIST_HEAD(&link->reserved_chanctx_list); INIT_DELAYED_WORK(&link->dfs_cac_timer_work, @@ -66,6 +68,7 @@ void ieee80211_link_stop(struct ieee80211_link_data *link) if (link->sdata->vif.type == NL80211_IFTYPE_STATION) ieee80211_mgd_stop_link(link);
+ cancel_delayed_work_sync(&link->color_collision_detect_work); ieee80211_link_release_channel(link); }
From: Shayne Chen shayne.chen@mediatek.com
[ Upstream commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 ]
The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to u16 after being assigned to rate variable, which causes information loss in STA_STATS_FIELD_TYPE and later bitfields.
Signed-off-by: Shayne Chen shayne.chen@mediatek.com Link: https://lore.kernel.org/r/20230209110659.25447-1-shayne.chen@mediatek.com Fixes: 41cbb0f5a295 ("mac80211: add support for HE") Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index 04e0f132b1d9c..34cb833db25f5 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -2411,7 +2411,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,
static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo) { - u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate); + u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate);
if (rate == STA_STATS_RATE_INVALID) return -EINVAL;
From: Karthikeyan Periyasamy quic_periyasa@quicinc.com
[ Upstream commit aaacf1740f2f95e0c5449ff3bbcff252d69cf952 ]
Non-MLO station frames are dropped in Rx path due to the condition check in ieee80211_rx_is_valid_sta_link_id(). In multi-link AP scenario, non-MLO stations try to connect in any of the valid links in the ML AP, where the station valid_links and link_id params are valid in the ieee80211_sta object. But ieee80211_rx_is_valid_sta_link_id() always return false for the non-MLO stations by the assumption taken is valid_links and link_id are not valid in non-MLO stations object (ieee80211_sta), this assumption is wrong. Due to this assumption, non-MLO station frames are dropped which leads to failure in association.
Fix it by removing the condition check and allow the link validation check for the non-MLO stations.
Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Signed-off-by: Karthikeyan Periyasamy quic_periyasa@quicinc.com Link: https://lore.kernel.org/r/20230206160330.1613-1-quic_periyasa@quicinc.com Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/rx.c | 3 --- 1 file changed, 3 deletions(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index c6562a6d25035..3c4541ee9e6d4 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -4052,9 +4052,6 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) static bool ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id) { - if (!sta->mlo) - return false; - return !!(sta->valid_links & BIT(link_id)); }
From: Andrei Otcheretianski andrei.otcheretianski@intel.com
[ Upstream commit daf8fb4295dccc032515cdc1bd3873370063542b ]
MLD address translation should be done only for individually addressed frames. Otherwise, AAD calculation would be wrong and the decryption would fail.
Fixes: e66b7920aa5ac ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Signed-off-by: Andrei Otcheretianski andrei.otcheretianski@intel.com Link: https://lore.kernel.org/r/20230214101048.792414-1-andrei.otcheretianski@inte... Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 3c4541ee9e6d4..870b8d042b799 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -4840,7 +4840,8 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, hdr = (struct ieee80211_hdr *)rx->skb->data; }
- if (unlikely(rx->sta && rx->sta->sta.mlo)) { + if (unlikely(rx->sta && rx->sta->sta.mlo) && + is_unicast_ether_addr(hdr->addr1)) { /* translate to MLD addresses */ if (ether_addr_equal(link->conf->addr, hdr->addr1)) ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit 1d8d4af4347420d657be448f8be4c39c558f3b5d ]
gcc-9 triggers a false-postive warning in ieee80211_mlo_multicast_tx() for u32_encode_bits(ffs(links) - 1, ...), since ffs() can return zero on an empty bitmask, and the negative argument to u32_encode_bits() is then out of range:
In file included from include/linux/ieee80211.h:21, from include/net/cfg80211.h:23, from net/mac80211/tx.c:23: In function 'u32_encode_bits', inlined from 'ieee80211_mlo_multicast_tx' at net/mac80211/tx.c:4437:17, inlined from 'ieee80211_subif_start_xmit' at net/mac80211/tx.c:4485:3: include/linux/bitfield.h:177:3: error: call to '__field_overflow' declared with attribute error: value doesn't fit into mask 177 | __field_overflow(); \ | ^~~~~~~~~~~~~~~~~~ include/linux/bitfield.h:197:2: note: in expansion of macro '____MAKE_OP' 197 | ____MAKE_OP(u##size,u##size,,) | ^~~~~~~~~~~ include/linux/bitfield.h:200:1: note: in expansion of macro '__MAKE_OP' 200 | __MAKE_OP(32) | ^~~~~~~~~
Newer compiler versions do not cause problems with the zero argument because they do not consider this a __builtin_constant_p(). It's also harmless since the hweight16() check already guarantees that this cannot be 0.
Replace the ffs() with an equivalent find_first_bit() check that matches the later for_each_set_bit() style and avoids the warning.
Fixes: 963d0e8d08d9 ("wifi: mac80211: optionally implement MLO multicast TX") Signed-off-by: Arnd Bergmann arnd@arndb.de Link: https://lore.kernel.org/r/20230214132025.1532147-1-arnd@kernel.org Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index defe97a31724d..118648af979c7 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -4434,7 +4434,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev, u32 ctrl_flags = IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX;
if (hweight16(links) == 1) { - ctrl_flags |= u32_encode_bits(ffs(links) - 1, + ctrl_flags |= u32_encode_bits(find_first_bit(&links, 16) - 1, IEEE80211_TX_CTRL_MLO_LINK);
__ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags,
From: Johannes Berg johannes.berg@intel.com
[ Upstream commit cf08e29db760b144bde51e2444f3430c75763e26 ]
The convention for find_first_bit() is 0-based, while ffs() is 1-based, so this is now off-by-one. I cannot reproduce the gcc-9 problem, but since the -1 is now removed, I'm hoping it will still avoid the original issue.
Reported-by: Alexander Lobakin alexandr.lobakin@intel.com Fixes: 1d8d4af43474 ("wifi: mac80211: avoid u32_encode_bits() warning") Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 118648af979c7..7699fb4106701 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -4434,7 +4434,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev, u32 ctrl_flags = IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX;
if (hweight16(links) == 1) { - ctrl_flags |= u32_encode_bits(find_first_bit(&links, 16) - 1, + ctrl_flags |= u32_encode_bits(__ffs(links), IEEE80211_TX_CTRL_MLO_LINK);
__ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags,
From: Vincent Guittot vincent.guittot@linaro.org
[ Upstream commit a29cbd76aaf63f5493e962aa2fbaadcdc4615143 ]
thermal_sampling_init() suscribes to THERMAL_GENL_SAMPLING_GROUP_NAME group so thermal_sampling_exit() should unsubscribe from the same group.
Fixes: 47c4b0de080a ("tools/lib/thermal: Add a thermal library") Signed-off-by: Vincent Guittot vincent.guittot@linaro.org Link: https://lore.kernel.org/r/20230202102812.453357-1-vincent.guittot@linaro.org Signed-off-by: Daniel Lezcano daniel.lezcano@linaro.org Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/lib/thermal/sampling.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/lib/thermal/sampling.c b/tools/lib/thermal/sampling.c index ee818f4e9654d..70577423a9f0c 100644 --- a/tools/lib/thermal/sampling.c +++ b/tools/lib/thermal/sampling.c @@ -54,7 +54,7 @@ int thermal_sampling_fd(struct thermal_handler *th) thermal_error_t thermal_sampling_exit(struct thermal_handler *th) { if (nl_unsubscribe_thermal(th->sk_sampling, th->cb_sampling, - THERMAL_GENL_EVENT_GROUP_NAME)) + THERMAL_GENL_SAMPLING_GROUP_NAME)) return THERMAL_ERROR;
nl_thermal_disconnect(th->sk_sampling, th->cb_sampling);
From: Yongqin Liu yongqin.liu@linaro.org
[ Upstream commit 15cc25829a97c3957e520e971868aacc84341317 ]
The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm allocators") exposes a panic "BRK handler: Fatal exception" on the hi3660_thermal_probe funciton. This is because the function allocates memory for only one sensors array entry, but tries to fill up a second one.
Fix this by removing the unneeded second access.
Fixes: 7d3a2a2bbadb ("thermal/drivers/hisi: Fix number of sensors on hi3660") Signed-off-by: Yongqin Liu yongqin.liu@linaro.org Link: https://lore.kernel.org/linux-mm/20221101223321.1326815-5-keescook@chromium.... Link: https://lore.kernel.org/r/20230210141507.71014-1-yongqin.liu@linaro.org Signed-off-by: Daniel Lezcano daniel.lezcano@linaro.org Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/thermal/hisi_thermal.c | 4 ---- 1 file changed, 4 deletions(-)
diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c index d6974db7aaf76..15af90f5c7d91 100644 --- a/drivers/thermal/hisi_thermal.c +++ b/drivers/thermal/hisi_thermal.c @@ -427,10 +427,6 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data) data->sensor[0].irq_name = "tsensor_a73"; data->sensor[0].data = data;
- data->sensor[1].id = HI3660_LITTLE_SENSOR; - data->sensor[1].irq_name = "tsensor_a53"; - data->sensor[1].data = data; - return 0; }
From: Alexei Starovoitov ast@kernel.org
[ Upstream commit 62d101d5f422cde39b269f7eb4cbbe2f1e26f9d4 ]
The compiler is optimizing out majority of unref_ptr read/writes, so the test wasn't testing much. For example, one could delete '__kptr' tag from 'struct prog_test_ref_kfunc __kptr *unref_ptr;' and the test would still "pass".
Convert it to volatile stores. Confirmed by comparing bpf asm before/after.
Fixes: 2cbc469a6fc3 ("selftests/bpf: Add C tests for kptr") Signed-off-by: Alexei Starovoitov ast@kernel.org Acked-by: Stanislav Fomichev sdf@google.com Acked-by: Kumar Kartikeya Dwivedi memxor@gmail.com Link: https://lore.kernel.org/r/20230214235051.22938-1-alexei.starovoitov@gmail.co... Signed-off-by: Martin KaFai Lau martin.lau@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/bpf/progs/map_kptr.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/map_kptr.c b/tools/testing/selftests/bpf/progs/map_kptr.c index eb82178034934..228ec45365a8d 100644 --- a/tools/testing/selftests/bpf/progs/map_kptr.c +++ b/tools/testing/selftests/bpf/progs/map_kptr.c @@ -62,21 +62,23 @@ extern struct prog_test_ref_kfunc * bpf_kfunc_call_test_kptr_get(struct prog_test_ref_kfunc **p, int a, int b) __ksym; extern void bpf_kfunc_call_test_release(struct prog_test_ref_kfunc *p) __ksym;
+#define WRITE_ONCE(x, val) ((*(volatile typeof(x) *) &(x)) = (val)) + static void test_kptr_unref(struct map_value *v) { struct prog_test_ref_kfunc *p;
p = v->unref_ptr; /* store untrusted_ptr_or_null_ */ - v->unref_ptr = p; + WRITE_ONCE(v->unref_ptr, p); if (!p) return; if (p->a + p->b > 100) return; /* store untrusted_ptr_ */ - v->unref_ptr = p; + WRITE_ONCE(v->unref_ptr, p); /* store NULL */ - v->unref_ptr = NULL; + WRITE_ONCE(v->unref_ptr, NULL); }
static void test_kptr_ref(struct map_value *v) @@ -85,7 +87,7 @@ static void test_kptr_ref(struct map_value *v)
p = v->ref_ptr; /* store ptr_or_null_ */ - v->unref_ptr = p; + WRITE_ONCE(v->unref_ptr, p); if (!p) return; if (p->a + p->b > 100) @@ -99,7 +101,7 @@ static void test_kptr_ref(struct map_value *v) return; } /* store ptr_ */ - v->unref_ptr = p; + WRITE_ONCE(v->unref_ptr, p); bpf_kfunc_call_test_release(p);
p = bpf_kfunc_call_test_acquire(&(unsigned long){0});
From: Johannes Berg johannes.berg@intel.com
[ Upstream commit 0d846bdc11101ac0ba4d89c2be359af08cb9379b ]
There's at least one case in ieee80211_rx_for_interface() where we might pass &((struct sta_info *)NULL)->sta to it only to then do container_of(), and then checking the result for NULL, but checking the result of container_of() for NULL looks really odd.
Fix this by just passing the struct sta_info * instead.
Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/mac80211/rx.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 870b8d042b799..1ed345d072b3f 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -4073,13 +4073,8 @@ static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx, }
static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx, - struct ieee80211_sta *pubsta, - int link_id) + struct sta_info *sta, int link_id) { - struct sta_info *sta; - - sta = container_of(pubsta, struct sta_info, sta); - rx->link_id = link_id; rx->sta = sta;
@@ -4117,7 +4112,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) if (sta->sta.valid_links) link_id = ffs(sta->sta.valid_links) - 1;
- if (!ieee80211_rx_data_set_sta(&rx, &sta->sta, link_id)) + if (!ieee80211_rx_data_set_sta(&rx, sta, link_id)) return;
tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); @@ -4163,7 +4158,7 @@ void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
sta = container_of(pubsta, struct sta_info, sta);
- if (!ieee80211_rx_data_set_sta(&rx, pubsta, -1)) + if (!ieee80211_rx_data_set_sta(&rx, sta, -1)) return;
rcu_read_lock(); @@ -4871,6 +4866,7 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw, struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); struct ieee80211_fast_rx *fast_rx; struct ieee80211_rx_data rx; + struct sta_info *sta; int link_id = -1;
memset(&rx, 0, sizeof(rx)); @@ -4898,7 +4894,8 @@ static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw, * link_id is used only for stats purpose and updating the stats on * the deflink is fine? */ - if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id)) + sta = container_of(pubsta, struct sta_info, sta); + if (!ieee80211_rx_data_set_sta(&rx, sta, link_id)) goto drop;
fast_rx = rcu_dereference(rx.sta->fast_rx); @@ -4938,7 +4935,7 @@ static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx, link_id = status->link_id; }
- if (!ieee80211_rx_data_set_sta(rx, &sta->sta, link_id)) + if (!ieee80211_rx_data_set_sta(rx, sta, link_id)) return false;
return ieee80211_prepare_and_rx_handle(rx, skb, consume); @@ -5005,7 +5002,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, link_id = status->link_id;
if (pubsta) { - if (!ieee80211_rx_data_set_sta(&rx, pubsta, link_id)) + sta = container_of(pubsta, struct sta_info, sta); + if (!ieee80211_rx_data_set_sta(&rx, sta, link_id)) goto out;
/* @@ -5042,8 +5040,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, }
rx.sdata = prev_sta->sdata; - if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta, - link_id)) + if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) goto out;
if (!status->link_valid && prev_sta->sta.mlo) @@ -5056,8 +5053,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
if (prev_sta) { rx.sdata = prev_sta->sdata; - if (!ieee80211_rx_data_set_sta(&rx, &prev_sta->sta, - link_id)) + if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id)) goto out;
if (!status->link_valid && prev_sta->sta.mlo)
From: Hou Tao houtao1@huawei.com
[ Upstream commit 997849c4b969034e225153f41026657def66d286 ]
Currently the freed element in bpf memory allocator may be immediately reused, for htab map the reuse will reinitialize special fields in map value (e.g., bpf_spin_lock), but lookup procedure may still access these special fields, and it may lead to hard-lockup as shown below:
NMI backtrace for cpu 16 CPU: 16 PID: 2574 Comm: htab.bin Tainted: G L 6.1.0+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), RIP: 0010:queued_spin_lock_slowpath+0x283/0x2c0 ...... Call Trace: <TASK> copy_map_value_locked+0xb7/0x170 bpf_map_copy_value+0x113/0x3c0 __sys_bpf+0x1c67/0x2780 __x64_sys_bpf+0x1c/0x20 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ...... </TASK>
For htab map, just like the preallocated case, these is no need to initialize these special fields in map value again once these fields have been initialized. For preallocated htab map, these fields are initialized through __GFP_ZERO in bpf_map_area_alloc(), so do the similar thing for non-preallocated htab in bpf memory allocator. And there is no need to use __GFP_ZERO for per-cpu bpf memory allocator, because __alloc_percpu_gfp() does it implicitly.
Fixes: 0fd7c5d43339 ("bpf: Optimize call_rcu in non-preallocated hash map.") Signed-off-by: Hou Tao houtao1@huawei.com Link: https://lore.kernel.org/r/20230215082132.3856544-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/bpf.h | 7 +++++++ kernel/bpf/hashtab.c | 4 ++-- kernel/bpf/memalloc.c | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 634d37a599fa7..cf0d88109e3f9 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -346,6 +346,13 @@ static inline void bpf_obj_init(const struct btf_field_offs *foffs, void *obj) memset(obj + foffs->field_off[i], 0, foffs->field_sz[i]); }
+/* 'dst' must be a temporary buffer and should not point to memory that is being + * used in parallel by a bpf program or bpf syscall, otherwise the access from + * the bpf program or bpf syscall may be corrupted by the reinitialization, + * leading to weird problems. Even 'dst' is newly-allocated from bpf memory + * allocator, it is still possible for 'dst' to be used in parallel by a bpf + * program or bpf syscall. + */ static inline void check_and_init_map_value(struct bpf_map *map, void *dst) { bpf_obj_init(map->field_offs, dst); diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 66bded1443773..5dfcb5ad0d068 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -1004,8 +1004,6 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, l_new = ERR_PTR(-ENOMEM); goto dec_count; } - check_and_init_map_value(&htab->map, - l_new->key + round_up(key_size, 8)); }
memcpy(l_new->key, key, key_size); @@ -1592,6 +1590,7 @@ static int __htab_map_lookup_and_delete_elem(struct bpf_map *map, void *key, else copy_map_value(map, value, l->key + roundup_key_size); + /* Zeroing special fields in the temp buffer */ check_and_init_map_value(map, value); }
@@ -1792,6 +1791,7 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map, true); else copy_map_value(map, dst_val, value); + /* Zeroing special fields in the temp buffer */ check_and_init_map_value(map, dst_val); } if (do_delete) { diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c index 1db156405b68b..7b784823a52ef 100644 --- a/kernel/bpf/memalloc.c +++ b/kernel/bpf/memalloc.c @@ -143,7 +143,7 @@ static void *__alloc(struct bpf_mem_cache *c, int node) return obj; }
- return kmalloc_node(c->unit_size, flags, node); + return kmalloc_node(c->unit_size, flags | __GFP_ZERO, node); }
static struct mem_cgroup *get_memcg(const struct bpf_mem_cache *c)
From: Ilya Leoshkevich iii@linux.ibm.com
[ Upstream commit 06c1865b0b0c7820ea53af2394dd7aff31100295 ]
s390x cache line size is 256 bytes, so skb_shared_info must be aligned on a much larger boundary than for x86. This makes the maximum packet size smaller.
Signed-off-by: Ilya Leoshkevich iii@linux.ibm.com Link: https://lore.kernel.org/r/20230128000650.1516334-11-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov ast@kernel.org Stable-dep-of: 6c20822fada1 ("bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES") Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c index a50971c6cf4a5..ac70e871d62f8 100644 --- a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c +++ b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c @@ -65,7 +65,11 @@ static int attach_tc_prog(struct bpf_tc_hook *hook, int fd) /* The maximum permissible size is: PAGE_SIZE - sizeof(struct xdp_page_head) - * sizeof(struct skb_shared_info) - XDP_PACKET_HEADROOM = 3368 bytes */ +#if defined(__s390x__) +#define MAX_PKT_SIZE 3176 +#else #define MAX_PKT_SIZE 3368 +#endif static void test_max_pkt_size(int fd) { char data[MAX_PKT_SIZE + 1] = {};
From: Frank Jungclaus frank.jungclaus@esd.eu
[ Upstream commit 118469f88180438ef43dee93d71f77c00e7b425d ]
Move the supply for cf->data[3] (bit stream position of CAN error), in case of a bus- or protocol-error, outside of the "switch (ecc & SJA1000_ECC_MASK){}"-statement, because this bit stream position is independent of the error type.
Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Signed-off-by: Frank Jungclaus frank.jungclaus@esd.eu Link: https://lore.kernel.org/all/20230216190450.3901254-2-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde mkl@pengutronix.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/can/usb/esd_usb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c index 42323f5e6f3a0..5e182fadd875e 100644 --- a/drivers/net/can/usb/esd_usb.c +++ b/drivers/net/can/usb/esd_usb.c @@ -286,7 +286,6 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, cf->data[2] |= CAN_ERR_PROT_STUFF; break; default: - cf->data[3] = ecc & SJA1000_ECC_SEG; break; }
@@ -294,6 +293,9 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, if (!(ecc & SJA1000_ECC_DIR)) cf->data[2] |= CAN_ERR_PROT_TX;
+ /* Bit stream position in CAN frame as the error was detected */ + cf->data[3] = ecc & SJA1000_ECC_SEG; + if (priv->can.state == CAN_STATE_ERROR_WARNING || priv->can.state == CAN_STATE_ERROR_PASSIVE) { cf->data[1] = (txerr > rxerr) ?
From: Frank Jungclaus frank.jungclaus@esd.eu
[ Upstream commit 9684b000a86299b5968fef8ffbf1484def37452a ]
Start a rework initiated by Vincents remarks "You should not report the greatest of txerr and rxerr but the one which actually increased." [1] and "As far as I understand, those flags should be set only when the threshold is reached" [2] .
Therefore make use of can_change_state() to (among others) set the flags CAN_ERR_CRTL_[RT]X_WARNING and CAN_ERR_CRTL_[RT]X_PASSIVE, maintain CAN statistic counters for error_warning, error_passive and bus_off.
Relocate testing alloc_can_err_skb() for NULL to the end of esd_usb_rx_event(), to have things like can_bus_off(), can_change_state() working even in out of memory conditions.
Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Signed-off-by: Frank Jungclaus frank.jungclaus@esd.eu Link: [1] https://lore.kernel.org/all/CAMZ6RqKGBWe15aMkf8-QLf-cOQg99GQBebSm+1wEzTqHgvm... Link: [2] https://lore.kernel.org/all/CAMZ6Rq+QBO1yTX_o6GV0yhdBj-RzZSRGWDZBS0fs7zbSTy4... Link: https://lore.kernel.org/all/20230216190450.3901254-3-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde mkl@pengutronix.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/can/usb/esd_usb.c | 50 +++++++++++++++++------------------ 1 file changed, 25 insertions(+), 25 deletions(-)
diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c index 5e182fadd875e..578b25f873e58 100644 --- a/drivers/net/can/usb/esd_usb.c +++ b/drivers/net/can/usb/esd_usb.c @@ -239,41 +239,42 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv, msg->msg.rx.dlc, state, ecc, rxerr, txerr);
skb = alloc_can_err_skb(priv->netdev, &cf); - if (skb == NULL) { - stats->rx_dropped++; - return; - }
if (state != priv->old_state) { + enum can_state tx_state, rx_state; + enum can_state new_state = CAN_STATE_ERROR_ACTIVE; + priv->old_state = state;
switch (state & ESD_BUSSTATE_MASK) { case ESD_BUSSTATE_BUSOFF: - priv->can.state = CAN_STATE_BUS_OFF; - cf->can_id |= CAN_ERR_BUSOFF; - priv->can.can_stats.bus_off++; + new_state = CAN_STATE_BUS_OFF; can_bus_off(priv->netdev); break; case ESD_BUSSTATE_WARN: - priv->can.state = CAN_STATE_ERROR_WARNING; - priv->can.can_stats.error_warning++; + new_state = CAN_STATE_ERROR_WARNING; break; case ESD_BUSSTATE_ERRPASSIVE: - priv->can.state = CAN_STATE_ERROR_PASSIVE; - priv->can.can_stats.error_passive++; + new_state = CAN_STATE_ERROR_PASSIVE; break; default: - priv->can.state = CAN_STATE_ERROR_ACTIVE; + new_state = CAN_STATE_ERROR_ACTIVE; txerr = 0; rxerr = 0; break; } - } else { + + if (new_state != priv->can.state) { + tx_state = (txerr >= rxerr) ? new_state : 0; + rx_state = (txerr <= rxerr) ? new_state : 0; + can_change_state(priv->netdev, cf, + tx_state, rx_state); + } + } else if (skb) { priv->can.can_stats.bus_error++; stats->rx_errors++;
- cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR | - CAN_ERR_CNT; + cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
switch (ecc & SJA1000_ECC_MASK) { case SJA1000_ECC_BIT: @@ -295,21 +296,20 @@ static void esd_usb_rx_event(struct esd_usb_net_priv *priv,
/* Bit stream position in CAN frame as the error was detected */ cf->data[3] = ecc & SJA1000_ECC_SEG; - - if (priv->can.state == CAN_STATE_ERROR_WARNING || - priv->can.state == CAN_STATE_ERROR_PASSIVE) { - cf->data[1] = (txerr > rxerr) ? - CAN_ERR_CRTL_TX_PASSIVE : - CAN_ERR_CRTL_RX_PASSIVE; - } - cf->data[6] = txerr; - cf->data[7] = rxerr; }
priv->bec.txerr = txerr; priv->bec.rxerr = rxerr;
- netif_rx(skb); + if (skb) { + cf->can_id |= CAN_ERR_CNT; + cf->data[6] = txerr; + cf->data[7] = rxerr; + + netif_rx(skb); + } else { + stats->rx_dropped++; + } } }
From: Maciej Fijalkowski maciej.fijalkowski@intel.com
[ Upstream commit 1596dae2f17ec5c6e8c8f0e3fec78c5ae55c1e0b ]
Xsk Tx can be triggered via either sendmsg() or poll() syscalls. These two paths share a call to common function xsk_xmit() which has two sanity checks within. A pseudo code example to show the two paths:
__xsk_sendmsg() : xsk_poll(): if (unlikely(!xsk_is_bound(xs))) if (unlikely(!xsk_is_bound(xs))) return -ENXIO; return mask; if (unlikely(need_wait)) (...) return -EOPNOTSUPP; xsk_xmit() mark napi id (...) xsk_xmit()
xsk_xmit(): if (unlikely(!(xs->dev->flags & IFF_UP))) return -ENETDOWN; if (unlikely(!xs->tx)) return -ENOBUFS;
As it can be observed above, in sendmsg() napi id can be marked on interface that was not brought up and this causes a NULL ptr dereference:
[31757.505631] BUG: kernel NULL pointer dereference, address: 0000000000000018 [31757.512710] #PF: supervisor read access in kernel mode [31757.517936] #PF: error_code(0x0000) - not-present page [31757.523149] PGD 0 P4D 0 [31757.525726] Oops: 0000 [#1] PREEMPT SMP NOPTI [31757.530154] CPU: 26 PID: 95641 Comm: xdpsock Not tainted 6.2.0-rc5+ #40 [31757.536871] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [31757.547457] RIP: 0010:xsk_sendmsg+0xde/0x180 [31757.551799] Code: 00 75 a2 48 8b 00 a8 04 75 9b 84 d2 74 69 8b 85 14 01 00 00 85 c0 75 1b 48 8b 85 28 03 00 00 48 8b 80 98 00 00 00 48 8b 40 20 <8b> 40 18 89 85 14 01 00 00 8b bd 14 01 00 00 81 ff 00 01 00 00 0f [31757.570840] RSP: 0018:ffffc90034f27dc0 EFLAGS: 00010246 [31757.576143] RAX: 0000000000000000 RBX: ffffc90034f27e18 RCX: 0000000000000000 [31757.583389] RDX: 0000000000000001 RSI: ffffc90034f27e18 RDI: ffff88984cf3c100 [31757.590631] RBP: ffff88984714a800 R08: ffff88984714a800 R09: 0000000000000000 [31757.597877] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffa [31757.605123] R13: 0000000000000000 R14: 0000000000000003 R15: 0000000000000000 [31757.612364] FS: 00007fb4c5931180(0000) GS:ffff88afdfa00000(0000) knlGS:0000000000000000 [31757.620571] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [31757.626406] CR2: 0000000000000018 CR3: 000000184b41c003 CR4: 00000000007706e0 [31757.633648] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [31757.640894] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [31757.648139] PKRU: 55555554 [31757.650894] Call Trace: [31757.653385] <TASK> [31757.655524] sock_sendmsg+0x8f/0xa0 [31757.659077] ? sockfd_lookup_light+0x12/0x70 [31757.663416] __sys_sendto+0xfc/0x170 [31757.667051] ? do_sched_setscheduler+0xdb/0x1b0 [31757.671658] __x64_sys_sendto+0x20/0x30 [31757.675557] do_syscall_64+0x38/0x90 [31757.679197] entry_SYSCALL_64_after_hwframe+0x72/0xdc [31757.687969] Code: 8e f6 ff 44 8b 4c 24 2c 4c 8b 44 24 20 41 89 c4 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 3a 44 89 e7 48 89 44 24 08 e8 b5 8e f6 ff 48 [31757.707007] RSP: 002b:00007ffd49c73c70 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [31757.714694] RAX: ffffffffffffffda RBX: 000055a996565380 RCX: 00007fb4c5727c16 [31757.721939] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [31757.729184] RBP: 0000000000000040 R08: 0000000000000000 R09: 0000000000000000 [31757.736429] R10: 0000000000000040 R11: 0000000000000293 R12: 0000000000000000 [31757.743673] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [31757.754940] </TASK>
To fix this, let's make xsk_xmit a function that will be responsible for generic Tx, where RCU is handled accordingly and pull out sanity checks and xs->zc handling. Populate sanity checks to __xsk_sendmsg() and xsk_poll().
Fixes: ca2e1a627035 ("xsk: Mark napi_id on sendmsg()") Fixes: 18b1ab7aa76b ("xsk: Fix race at socket teardown") Signed-off-by: Maciej Fijalkowski maciej.fijalkowski@intel.com Reviewed-by: Alexander Lobakin aleksander.lobakin@intel.com Link: https://lore.kernel.org/r/20230215143309.13145-1-maciej.fijalkowski@intel.co... Signed-off-by: Martin KaFai Lau martin.lau@kernel.org Signed-off-by: Daniel Borkmann daniel@iogearbox.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/xdp/xsk.c | 59 ++++++++++++++++++++++++++++----------------------- 1 file changed, 33 insertions(+), 26 deletions(-)
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index 9f0561b67c12e..13f62d2402e71 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -511,7 +511,7 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs, return skb; }
-static int xsk_generic_xmit(struct sock *sk) +static int __xsk_generic_xmit(struct sock *sk) { struct xdp_sock *xs = xdp_sk(sk); u32 max_batch = TX_BATCH_SIZE; @@ -594,22 +594,13 @@ static int xsk_generic_xmit(struct sock *sk) return err; }
-static int xsk_xmit(struct sock *sk) +static int xsk_generic_xmit(struct sock *sk) { - struct xdp_sock *xs = xdp_sk(sk); int ret;
- if (unlikely(!(xs->dev->flags & IFF_UP))) - return -ENETDOWN; - if (unlikely(!xs->tx)) - return -ENOBUFS; - - if (xs->zc) - return xsk_wakeup(xs, XDP_WAKEUP_TX); - /* Drop the RCU lock since the SKB path might sleep. */ rcu_read_unlock(); - ret = xsk_generic_xmit(sk); + ret = __xsk_generic_xmit(sk); /* Reaquire RCU lock before going into common code. */ rcu_read_lock();
@@ -627,17 +618,31 @@ static bool xsk_no_wakeup(struct sock *sk) #endif }
+static int xsk_check_common(struct xdp_sock *xs) +{ + if (unlikely(!xsk_is_bound(xs))) + return -ENXIO; + if (unlikely(!(xs->dev->flags & IFF_UP))) + return -ENETDOWN; + + return 0; +} + static int __xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) { bool need_wait = !(m->msg_flags & MSG_DONTWAIT); struct sock *sk = sock->sk; struct xdp_sock *xs = xdp_sk(sk); struct xsk_buff_pool *pool; + int err;
- if (unlikely(!xsk_is_bound(xs))) - return -ENXIO; + err = xsk_check_common(xs); + if (err) + return err; if (unlikely(need_wait)) return -EOPNOTSUPP; + if (unlikely(!xs->tx)) + return -ENOBUFS;
if (sk_can_busy_loop(sk)) { if (xs->zc) @@ -649,8 +654,11 @@ static int __xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len return 0;
pool = xs->pool; - if (pool->cached_need_wakeup & XDP_WAKEUP_TX) - return xsk_xmit(sk); + if (pool->cached_need_wakeup & XDP_WAKEUP_TX) { + if (xs->zc) + return xsk_wakeup(xs, XDP_WAKEUP_TX); + return xsk_generic_xmit(sk); + } return 0; }
@@ -670,11 +678,11 @@ static int __xsk_recvmsg(struct socket *sock, struct msghdr *m, size_t len, int bool need_wait = !(flags & MSG_DONTWAIT); struct sock *sk = sock->sk; struct xdp_sock *xs = xdp_sk(sk); + int err;
- if (unlikely(!xsk_is_bound(xs))) - return -ENXIO; - if (unlikely(!(xs->dev->flags & IFF_UP))) - return -ENETDOWN; + err = xsk_check_common(xs); + if (err) + return err; if (unlikely(!xs->rx)) return -ENOBUFS; if (unlikely(need_wait)) @@ -713,21 +721,20 @@ static __poll_t xsk_poll(struct file *file, struct socket *sock, sock_poll_wait(file, sock, wait);
rcu_read_lock(); - if (unlikely(!xsk_is_bound(xs))) { - rcu_read_unlock(); - return mask; - } + if (xsk_check_common(xs)) + goto skip_tx;
pool = xs->pool;
if (pool->cached_need_wakeup) { if (xs->zc) xsk_wakeup(xs, pool->cached_need_wakeup); - else + else if (xs->tx) /* Poll needs to drive Tx also in copy mode */ - xsk_xmit(sk); + xsk_generic_xmit(sk); }
+skip_tx: if (xs->rx && !xskq_prod_is_empty(xs->rx)) mask |= EPOLLIN | EPOLLRDNORM; if (xs->tx && xsk_tx_writeable(xs))
From: Hengqi Chen hengqi.chen@gmail.com
[ Upstream commit 64f50f6575721ef03d001e907455cbe3baa2a5b1 ]
This patch fixes the following issue of function calls in JIT, like:
[ 29.346981] multi-func JIT bug 105 != 103
The issus can be reproduced by running the "inline simple bpf_loop call" verifier test.
This is because we are emiting 2-4 instructions for 64-bit immediate moves. During the first pass of JIT, the placeholder address is zero, emiting two instructions for it. In the extra pass, the function address is in XKVRANGE, emiting four instructions for it. This change the instruction index in JIT context. Let's always use 4 instructions for function address in JIT. So that the instruction sequences don't change between the first pass and the extra pass for function calls.
Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Signed-off-by: Hengqi Chen hengqi.chen@gmail.com Signed-off-by: Daniel Borkmann daniel@iogearbox.net Tested-by: Tiezhu Yang yangtiezhu@loongson.cn Link: https://lore.kernel.org/bpf/20230214152633.2265699-1-hengqi.chen@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/loongarch/net/bpf_jit.c | 2 +- arch/loongarch/net/bpf_jit.h | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index c4b1947ebf768..288003a9f0cae 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -841,7 +841,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext if (ret < 0) return ret;
- move_imm(ctx, t1, func_addr, is32); + move_addr(ctx, t1, func_addr); emit_insn(ctx, jirl, t1, LOONGARCH_GPR_RA, 0); move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); break; diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h index ca708024fdd3e..c335dc4eed370 100644 --- a/arch/loongarch/net/bpf_jit.h +++ b/arch/loongarch/net/bpf_jit.h @@ -82,6 +82,27 @@ static inline void emit_sext_32(struct jit_ctx *ctx, enum loongarch_gpr reg, boo emit_insn(ctx, addiw, reg, reg, 0); }
+static inline void move_addr(struct jit_ctx *ctx, enum loongarch_gpr rd, u64 addr) +{ + u64 imm_11_0, imm_31_12, imm_51_32, imm_63_52; + + /* lu12iw rd, imm_31_12 */ + imm_31_12 = (addr >> 12) & 0xfffff; + emit_insn(ctx, lu12iw, rd, imm_31_12); + + /* ori rd, rd, imm_11_0 */ + imm_11_0 = addr & 0xfff; + emit_insn(ctx, ori, rd, rd, imm_11_0); + + /* lu32id rd, imm_51_32 */ + imm_51_32 = (addr >> 32) & 0xfffff; + emit_insn(ctx, lu32id, rd, imm_51_32); + + /* lu52id rd, rd, imm_63_52 */ + imm_63_52 = (addr >> 52) & 0xfff; + emit_insn(ctx, lu52id, rd, rd, imm_63_52); +} + static inline void move_imm(struct jit_ctx *ctx, enum loongarch_gpr rd, long imm, bool is32) { long imm_11_0, imm_31_12, imm_51_32, imm_63_52, imm_51_0, imm_51_31;
From: Andrii Nakryiko andrii@kernel.org
[ Upstream commit d384dce281ed1b504fae2e279507827638d56fa3 ]
KPROBE program's user-facing context type is defined as typedef bpf_user_pt_regs_t. This leads to a problem when trying to passing kprobe/uprobe/usdt context argument into global subprog, as kernel always strip away mods and typedefs of user-supplied type, but takes expected type from bpf_ctx_convert as is, which causes mismatch.
Current way to work around this is to define a fake struct with the same name as expected typedef:
struct bpf_user_pt_regs_t {};
__noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... }
This patch fixes the issue by resolving expected type, if it's not a struct. It still leaves the above work-around working for backwards compatibility.
Fixes: 91cc1a99740e ("bpf: Annotate context types") Signed-off-by: Andrii Nakryiko andrii@kernel.org Signed-off-by: Daniel Borkmann daniel@iogearbox.net Acked-by: Stanislav Fomichev sdf@google.com Link: https://lore.kernel.org/bpf/20230216045954.3002473-2-andrii@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/bpf/btf.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index b7017cae6fd1e..530e200fbc477 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5573,6 +5573,7 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf, if (!ctx_struct) /* should not happen */ return NULL; +again: ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_struct->name_off); if (!ctx_tname) { /* should not happen */ @@ -5586,8 +5587,16 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf, * int socket_filter_bpf_prog(struct __sk_buff *skb) * { // no fields of skb are ever used } */ - if (strcmp(ctx_tname, tname)) - return NULL; + if (strcmp(ctx_tname, tname)) { + /* bpf_user_pt_regs_t is a typedef, so resolve it to + * underlying struct and check name again + */ + if (!btf_type_is_modifier(ctx_struct)) + return NULL; + while (btf_type_is_modifier(ctx_struct)) + ctx_struct = btf_type_by_id(btf_vmlinux, ctx_struct->type); + goto again; + } return ctx_type; }
From: Florian Fainelli f.fainelli@gmail.com
[ Upstream commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 ]
When support for the level triggered interrupt controller flavor was added with c0ca7262088e, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that.
Fixes: c0ca7262088e ("irqchip/brcmstb-l2: Add support for the BCM7271 L2 controller") Signed-off-by: Florian Fainelli f.fainelli@gmail.com Reviewed-by: Philippe Mathieu-Daudé philmd@linaro.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20221216230934.2478345-2-f.fainelli@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/irqchip/irq-brcmstb-l2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c index e4efc08ac5948..091b0fe7e3242 100644 --- a/drivers/irqchip/irq-brcmstb-l2.c +++ b/drivers/irqchip/irq-brcmstb-l2.c @@ -161,6 +161,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, *init_params) { unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN; + unsigned int set = 0; struct brcmstb_l2_intc_data *data; struct irq_chip_type *ct; int ret; @@ -208,9 +209,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) flags |= IRQ_GC_BE_IO;
+ if (init_params->handler == handle_level_irq) + set |= IRQ_LEVEL; + /* Allocate a single Generic IRQ chip for this node */ ret = irq_alloc_domain_generic_chips(data->domain, 32, 1, - np->full_name, init_params->handler, clr, 0, flags); + np->full_name, init_params->handler, clr, set, flags); if (ret) { pr_err("failed to allocate generic irq chip\n"); goto out_free_domain;
From: Florian Fainelli f.fainelli@gmail.com
[ Upstream commit 13a157b38ca5b4f9eed81442b8821db293755961 ]
When support for the interrupt controller was added with a5042de2688d, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that.
Fixes: a5042de2688d ("irqchip: bcm7120-l2: Add Broadcom BCM7120-style Level 2 interrupt controller") Signed-off-by: Florian Fainelli f.fainelli@gmail.com Reviewed-by: Philippe Mathieu-Daudé philmd@linaro.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20221216230934.2478345-3-f.fainelli@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/irqchip/irq-bcm7120-l2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c index bb6609cebdbce..1e9dab6e0d86f 100644 --- a/drivers/irqchip/irq-bcm7120-l2.c +++ b/drivers/irqchip/irq-bcm7120-l2.c @@ -279,7 +279,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn, flags |= IRQ_GC_BE_IO;
ret = irq_alloc_domain_generic_chips(data->domain, IRQS_PER_WORD, 1, - dn->full_name, handle_level_irq, clr, 0, flags); + dn->full_name, handle_level_irq, clr, + IRQ_LEVEL, flags); if (ret) { pr_err("failed to allocate generic irq chip\n"); goto out_free_domain;
From: D. Wythe alibuda@linux.alibaba.com
[ Upstream commit e40b801b3603a8f90b46acbacdea3505c27f01c0 ]
There is a certain chance to trigger the following panic:
PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48" #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7 #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60 #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7 #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715 #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654 #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62 [exception RIP: ib_alloc_mr+19] RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004 RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc] #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc] #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc]
The reason here is that when the server tries to create a second link, smc_llc_srv_add_link() has no protection and may add a new link to link group. This breaks the security environment protected by llc_conf_mutex.
Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server") Signed-off-by: D. Wythe alibuda@linux.alibaba.com Reviewed-by: Larysa Zaremba larysa.zaremba@intel.com Reviewed-by: Wenjia Zhang wenjia@linux.ibm.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/smc/af_smc.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index e12d4fa5aece6..d9413d43b1045 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1826,8 +1826,10 @@ static int smcr_serv_conf_first_link(struct smc_sock *smc) smc_llc_link_active(link); smcr_lgr_set_type(link->lgr, SMC_LGR_SINGLE);
+ mutex_lock(&link->lgr->llc_conf_mutex); /* initial contact - try to establish second link */ smc_llc_srv_add_link(link, NULL); + mutex_unlock(&link->lgr->llc_conf_mutex); return 0; }
From: D. Wythe alibuda@linux.alibaba.com
[ Upstream commit 475f9ff63ee8c296aa46c6e9e9ad9bdd301c6bdf ]
There is a certain probability that following exceptions will occur in the wrk benchmark test:
Running 10s test @ http://11.213.45.6:80 8 threads and 64 connections Thread Stats Avg Stdev Max +/- Stdev Latency 3.72ms 13.94ms 245.33ms 94.17% Req/Sec 1.96k 713.67 5.41k 75.16% 155262 requests in 10.10s, 23.10MB read Non-2xx or 3xx responses: 3
We will find that the error is HTTP 400 error, which is a serious exception in our test, which means the application data was corrupted.
Consider the following scenarios:
CPU0 CPU1
buf_desc->used = 0; cmpxchg(buf_desc->used, 0, 1) deal_with(buf_desc)
memset(buf_desc->cpu_addr,0);
This will cause the data received by a victim connection to be cleared, thus triggering an HTTP 400 error in the server.
This patch exchange the order between clear used and memset, add barrier to ensure memory consistency.
Fixes: 1c5526968e27 ("net/smc: Clear memory when release and reuse buffer") Signed-off-by: D. Wythe alibuda@linux.alibaba.com Reviewed-by: Wenjia Zhang wenjia@linux.ibm.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/smc/smc_core.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c index c305d8dd23f80..c19d4b7c1f28a 100644 --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -1120,8 +1120,9 @@ static void smcr_buf_unuse(struct smc_buf_desc *buf_desc, bool is_rmb,
smc_buf_free(lgr, is_rmb, buf_desc); } else { - buf_desc->used = 0; - memset(buf_desc->cpu_addr, 0, buf_desc->len); + /* memzero_explicit provides potential memory barrier semantics */ + memzero_explicit(buf_desc->cpu_addr, buf_desc->len); + WRITE_ONCE(buf_desc->used, 0); } }
@@ -1132,19 +1133,17 @@ static void smc_buf_unuse(struct smc_connection *conn, if (!lgr->is_smcd && conn->sndbuf_desc->is_vm) { smcr_buf_unuse(conn->sndbuf_desc, false, lgr); } else { - conn->sndbuf_desc->used = 0; - memset(conn->sndbuf_desc->cpu_addr, 0, - conn->sndbuf_desc->len); + memzero_explicit(conn->sndbuf_desc->cpu_addr, conn->sndbuf_desc->len); + WRITE_ONCE(conn->sndbuf_desc->used, 0); } } if (conn->rmb_desc) { if (!lgr->is_smcd) { smcr_buf_unuse(conn->rmb_desc, true, lgr); } else { - conn->rmb_desc->used = 0; - memset(conn->rmb_desc->cpu_addr, 0, - conn->rmb_desc->len + - sizeof(struct smcd_cdc_msg)); + memzero_explicit(conn->rmb_desc->cpu_addr, + conn->rmb_desc->len + sizeof(struct smcd_cdc_msg)); + WRITE_ONCE(conn->rmb_desc->used, 0); } } }
From: Jakub Sitnicki jakub@cloudflare.com
[ Upstream commit 436864095a95fcc611c20c44a111985fa9848730 ]
Data passed to user-space with a (SOL_UDP, UDP_GRO) cmsg carries an int (see udp_cmsg_recv), not a u16 value, as strace confirms:
recvmsg(8, {msg_name=..., msg_iov=[{iov_base="\0\0..."..., iov_len=96000}], msg_iovlen=1, msg_control=[{cmsg_len=20, <-- sizeof(cmsghdr) + 4 cmsg_level=SOL_UDP, cmsg_type=0x68}], <-- UDP_GRO msg_controllen=24, msg_flags=0}, 0) = 11200
Interpreting the data as an u16 value won't work on big-endian platforms. Since it is too late to back out of this API decision [1], fix the test.
[1]: https://lore.kernel.org/netdev/20230131174601.203127-1-jakub@cloudflare.com/
Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO") Suggested-by: Eric Dumazet edumazet@google.com Signed-off-by: Jakub Sitnicki jakub@cloudflare.com Reviewed-by: Eric Dumazet edumazet@google.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/net/udpgso_bench_rx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c index 4058c7451e70d..f35a924d4a303 100644 --- a/tools/testing/selftests/net/udpgso_bench_rx.c +++ b/tools/testing/selftests/net/udpgso_bench_rx.c @@ -214,11 +214,10 @@ static void do_verify_udp(const char *data, int len)
static int recv_msg(int fd, char *buf, int len, int *gso_size) { - char control[CMSG_SPACE(sizeof(uint16_t))] = {0}; + char control[CMSG_SPACE(sizeof(int))] = {0}; struct msghdr msg = {0}; struct iovec iov = {0}; struct cmsghdr *cmsg; - uint16_t *gsosizeptr; int ret;
iov.iov_base = buf; @@ -237,8 +236,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size) cmsg = CMSG_NXTHDR(&msg, cmsg)) { if (cmsg->cmsg_level == SOL_UDP && cmsg->cmsg_type == UDP_GRO) { - gsosizeptr = (uint16_t *) CMSG_DATA(cmsg); - *gso_size = *gsosizeptr; + *gso_size = *(int *)CMSG_DATA(cmsg); break; } }
From: Shigeru Yoshida syoshida@redhat.com
[ Upstream commit 9ca5e7ecab064f1f47da07f7c1ddf40e4bc0e5ac ]
When a file descriptor of pppol2tp socket is passed as file descriptor of UDP socket, a recursive deadlock occurs in l2tp_tunnel_register(). This situation is reproduced by the following program:
int main(void) { int sock; struct sockaddr_pppol2tp addr;
sock = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); if (sock < 0) { perror("socket"); return 1; }
addr.sa_family = AF_PPPOX; addr.sa_protocol = PX_PROTO_OL2TP; addr.pppol2tp.pid = 0; addr.pppol2tp.fd = sock; addr.pppol2tp.addr.sin_family = PF_INET; addr.pppol2tp.addr.sin_port = htons(0); addr.pppol2tp.addr.sin_addr.s_addr = inet_addr("192.168.0.1"); addr.pppol2tp.s_tunnel = 1; addr.pppol2tp.s_session = 0; addr.pppol2tp.d_tunnel = 0; addr.pppol2tp.d_session = 0;
if (connect(sock, (const struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("connect"); return 1; }
return 0; }
This program causes the following lockdep warning:
============================================ WARNING: possible recursive locking detected 6.2.0-rc5-00205-gc96618275234 #56 Not tainted -------------------------------------------- repro/8607 is trying to acquire lock: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x2b7/0x11c0
but task is already holding lock: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30
other info that might help us debug this: Possible unsafe locking scenario:
CPU0 ---- lock(sk_lock-AF_PPPOX); lock(sk_lock-AF_PPPOX);
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by repro/8607: #0: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30
stack backtrace: CPU: 0 PID: 8607 Comm: repro Not tainted 6.2.0-rc5-00205-gc96618275234 #56 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x178 __lock_acquire.cold+0x119/0x3b9 ? lockdep_hardirqs_on_prepare+0x410/0x410 lock_acquire+0x1e0/0x610 ? l2tp_tunnel_register+0x2b7/0x11c0 ? lock_downgrade+0x710/0x710 ? __fget_files+0x283/0x3e0 lock_sock_nested+0x3a/0xf0 ? l2tp_tunnel_register+0x2b7/0x11c0 l2tp_tunnel_register+0x2b7/0x11c0 ? sprintf+0xc4/0x100 ? l2tp_tunnel_del_work+0x6b0/0x6b0 ? debug_object_deactivate+0x320/0x320 ? lockdep_init_map_type+0x16d/0x7a0 ? lockdep_init_map_type+0x16d/0x7a0 ? l2tp_tunnel_create+0x2bf/0x4b0 ? l2tp_tunnel_create+0x3c6/0x4b0 pppol2tp_connect+0x14e1/0x1a30 ? pppol2tp_put_sk+0xd0/0xd0 ? aa_sk_perm+0x2b7/0xa80 ? aa_af_perm+0x260/0x260 ? bpf_lsm_socket_connect+0x9/0x10 ? pppol2tp_put_sk+0xd0/0xd0 __sys_connect_file+0x14f/0x190 __sys_connect+0x133/0x160 ? __sys_connect_file+0x190/0x190 ? lockdep_hardirqs_on+0x7d/0x100 ? ktime_get_coarse_real_ts64+0x1b7/0x200 ? ktime_get_coarse_real_ts64+0x147/0x200 ? __audit_syscall_entry+0x396/0x500 __x64_sys_connect+0x72/0xb0 do_syscall_64+0x38/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
This patch fixes the issue by getting/creating the tunnel before locking the pppol2tp socket.
Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") Cc: Cong Wang cong.wang@bytedance.com Signed-off-by: Shigeru Yoshida syoshida@redhat.com Reviewed-by: Guillaume Nault gnault@redhat.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/l2tp/l2tp_ppp.c | 125 ++++++++++++++++++++++++-------------------- 1 file changed, 67 insertions(+), 58 deletions(-)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index db2e584c625e5..f011af6601c9c 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -650,54 +650,22 @@ static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) return mtu - PPPOL2TP_HEADER_OVERHEAD; }
-/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket - */ -static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, - int sockaddr_len, int flags) +static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net, + const struct l2tp_connect_info *info, + bool *new_tunnel) { - struct sock *sk = sock->sk; - struct pppox_sock *po = pppox_sk(sk); - struct l2tp_session *session = NULL; - struct l2tp_connect_info info; struct l2tp_tunnel *tunnel; - struct pppol2tp_session *ps; - struct l2tp_session_cfg cfg = { 0, }; - bool drop_refcnt = false; - bool drop_tunnel = false; - bool new_session = false; - bool new_tunnel = false; int error;
- error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); - if (error < 0) - return error; + *new_tunnel = false;
- lock_sock(sk); - - /* Check for already bound sockets */ - error = -EBUSY; - if (sk->sk_state & PPPOX_CONNECTED) - goto end; - - /* We don't supporting rebinding anyway */ - error = -EALREADY; - if (sk->sk_user_data) - goto end; /* socket is already attached */ - - /* Don't bind if tunnel_id is 0 */ - error = -EINVAL; - if (!info.tunnel_id) - goto end; - - tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); - if (tunnel) - drop_tunnel = true; + tunnel = l2tp_tunnel_get(net, info->tunnel_id);
/* Special case: create tunnel context if session_id and * peer_session_id is 0. Otherwise look up tunnel using supplied * tunnel id. */ - if (!info.session_id && !info.peer_session_id) { + if (!info->session_id && !info->peer_session_id) { if (!tunnel) { struct l2tp_tunnel_cfg tcfg = { .encap = L2TP_ENCAPTYPE_UDP, @@ -706,40 +674,82 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, /* Prevent l2tp_tunnel_register() from trying to set up * a kernel socket. */ - if (info.fd < 0) { - error = -EBADF; - goto end; - } + if (info->fd < 0) + return ERR_PTR(-EBADF);
- error = l2tp_tunnel_create(info.fd, - info.version, - info.tunnel_id, - info.peer_tunnel_id, &tcfg, + error = l2tp_tunnel_create(info->fd, + info->version, + info->tunnel_id, + info->peer_tunnel_id, &tcfg, &tunnel); if (error < 0) - goto end; + return ERR_PTR(error);
l2tp_tunnel_inc_refcount(tunnel); - error = l2tp_tunnel_register(tunnel, sock_net(sk), - &tcfg); + error = l2tp_tunnel_register(tunnel, net, &tcfg); if (error < 0) { kfree(tunnel); - goto end; + return ERR_PTR(error); } - drop_tunnel = true; - new_tunnel = true; + + *new_tunnel = true; } } else { /* Error if we can't find the tunnel */ - error = -ENOENT; if (!tunnel) - goto end; + return ERR_PTR(-ENOENT);
/* Error if socket is not prepped */ - if (!tunnel->sock) - goto end; + if (!tunnel->sock) { + l2tp_tunnel_dec_refcount(tunnel); + return ERR_PTR(-ENOENT); + } }
+ return tunnel; +} + +/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket + */ +static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + int sockaddr_len, int flags) +{ + struct sock *sk = sock->sk; + struct pppox_sock *po = pppox_sk(sk); + struct l2tp_session *session = NULL; + struct l2tp_connect_info info; + struct l2tp_tunnel *tunnel; + struct pppol2tp_session *ps; + struct l2tp_session_cfg cfg = { 0, }; + bool drop_refcnt = false; + bool new_session = false; + bool new_tunnel = false; + int error; + + error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); + if (error < 0) + return error; + + /* Don't bind if tunnel_id is 0 */ + if (!info.tunnel_id) + return -EINVAL; + + tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel); + if (IS_ERR(tunnel)) + return PTR_ERR(tunnel); + + lock_sock(sk); + + /* Check for already bound sockets */ + error = -EBUSY; + if (sk->sk_state & PPPOX_CONNECTED) + goto end; + + /* We don't supporting rebinding anyway */ + error = -EALREADY; + if (sk->sk_user_data) + goto end; /* socket is already attached */ + if (tunnel->peer_tunnel_id == 0) tunnel->peer_tunnel_id = info.peer_tunnel_id;
@@ -840,8 +850,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, } if (drop_refcnt) l2tp_session_dec_refcount(session); - if (drop_tunnel) - l2tp_tunnel_dec_refcount(tunnel); + l2tp_tunnel_dec_refcount(tunnel); release_sock(sk);
return error;
From: Doug Berger opendmb@gmail.com
[ Upstream commit a7515af9fb8f0890fe540b108def4a86b9e8330a ]
When the bcmgenet_mii_config() code was refactored it was missed that the LED control for the MoCA interface got overwritten by the port_ctrl value. Its previous programming is restored here.
Fixes: 4f8d81b77e66 ("net: bcmgenet: Refactor register access in bcmgenet_mii_config") Signed-off-by: Doug Berger opendmb@gmail.com Acked-by: Florian Fainelli f.fainelli@gmail.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c index b615176338b26..be042905ada2a 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c @@ -176,15 +176,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable)
static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv) { - u32 reg; - - if (!GENET_IS_V5(priv)) { - /* Speed settings are set in bcmgenet_mii_setup() */ - reg = bcmgenet_sys_readl(priv, SYS_PORT_CTRL); - reg |= LED_ACT_SOURCE_MAC; - bcmgenet_sys_writel(priv, reg, SYS_PORT_CTRL); - } - if (priv->hw_params->flags & GENET_HAS_MOCA_LINK_DET) fixed_phy_set_link_update(priv->dev->phydev, bcmgenet_fixed_phy_link_update); @@ -217,6 +208,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
if (!phy_name) { phy_name = "MoCA"; + if (!GENET_IS_V5(priv)) + port_ctrl |= LED_ACT_SOURCE_MAC; bcmgenet_moca_phy_setup(priv); } break;
From: Horatiu Vultur horatiu.vultur@microchip.com
[ Upstream commit 3a70e0d4c9d74cb00f7c0ec022f5599f9f7ba07d ]
When doing timestamping in lan966x and having PROVE_LOCKING enabled the following warning is shown.
======================================================== WARNING: possible irq lock inversion dependency detected 6.2.0-rc7-01749-gc54e1f7f7e36 #2786 Tainted: G N -------------------------------------------------------- swapper/0/0 just changed the state of lock: c2609f50 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x16c/0x2e8 but this lock took another, SOFTIRQ-unsafe lock in the past: (&lan966x->ptp_ts_id_lock){+.+.}-{2:2}
and interrupts could create inverse lock ordering between them.
other info that might help us debug this: Possible interrupt unsafe locking scenario:
CPU0 CPU1 ---- ---- lock(&lan966x->ptp_ts_id_lock); local_irq_disable(); lock(_xmit_ETHER#2); lock(&lan966x->ptp_ts_id_lock); <Interrupt> lock(_xmit_ETHER#2);
*** DEADLOCK ***
5 locks held by swapper/0/0: #0: c1001e18 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0x0/0x33c #1: c105e7c4 (rcu_read_lock){....}-{1:2}, at: ndisc_send_skb+0x134/0x81c #2: c105e7d8 (rcu_read_lock_bh){....}-{1:2}, at: ip6_finish_output2+0x17c/0xc64 #3: c105e7d8 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x4c/0x1224 #4: c3056174 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x354/0x1224
the shortest dependencies between 2nd lock and 1st lock: -> (&lan966x->ptp_ts_id_lock){+.+.}-{2:2} { HARDIRQ-ON-W at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 lan966x_ptp_irq_handler+0x164/0x2a8 irq_thread_fn+0x1c/0x78 irq_thread+0x130/0x278 kthread+0xec/0x110 ret_from_fork+0x14/0x28 SOFTIRQ-ON-W at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 lan966x_ptp_irq_handler+0x164/0x2a8 irq_thread_fn+0x1c/0x78 irq_thread+0x130/0x278 kthread+0xec/0x110 ret_from_fork+0x14/0x28 INITIAL USE at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock_irqsave+0x4c/0x68 lan966x_ptp_txtstamp_request+0x128/0x1cc lan966x_port_xmit+0x224/0x43c dev_hard_start_xmit+0xa8/0x2f0 sch_direct_xmit+0x108/0x2e8 __dev_queue_xmit+0x41c/0x1224 packet_sendmsg+0xdb4/0x134c __sys_sendto+0xd0/0x154 sys_send+0x18/0x20 ret_fast_syscall+0x0/0x1c } ... key at: [<c174ba0c>] __key.2+0x0/0x8 ... acquired at: _raw_spin_lock_irqsave+0x4c/0x68 lan966x_ptp_txtstamp_request+0x128/0x1cc lan966x_port_xmit+0x224/0x43c dev_hard_start_xmit+0xa8/0x2f0 sch_direct_xmit+0x108/0x2e8 __dev_queue_xmit+0x41c/0x1224 packet_sendmsg+0xdb4/0x134c __sys_sendto+0xd0/0x154 sys_send+0x18/0x20 ret_fast_syscall+0x0/0x1c
-> (_xmit_ETHER#2){+.-.}-{2:2} { HARDIRQ-ON-W at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 netif_freeze_queues+0x38/0x68 dev_deactivate_many+0xac/0x388 dev_deactivate+0x38/0x6c linkwatch_do_dev+0x70/0x8c __linkwatch_run_queue+0xd4/0x1e8 linkwatch_event+0x24/0x34 process_one_work+0x284/0x744 worker_thread+0x28/0x4bc kthread+0xec/0x110 ret_from_fork+0x14/0x28 IN-SOFTIRQ-W at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 sch_direct_xmit+0x16c/0x2e8 __dev_queue_xmit+0x41c/0x1224 ip6_finish_output2+0x5f4/0xc64 ndisc_send_skb+0x4cc/0x81c addrconf_rs_timer+0xb0/0x2f8 call_timer_fn+0xb4/0x33c expire_timers+0xb4/0x10c run_timer_softirq+0xf8/0x2a8 __do_softirq+0xd4/0x5fc __irq_exit_rcu+0x138/0x17c irq_exit+0x8/0x28 __irq_svc+0x90/0xbc arch_cpu_idle+0x30/0x3c default_idle_call+0x44/0xac do_idle+0xc8/0x138 cpu_startup_entry+0x18/0x1c rest_init+0xcc/0x168 arch_post_acpi_subsys_init+0x0/0x8 INITIAL USE at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 netif_freeze_queues+0x38/0x68 dev_deactivate_many+0xac/0x388 dev_deactivate+0x38/0x6c linkwatch_do_dev+0x70/0x8c __linkwatch_run_queue+0xd4/0x1e8 linkwatch_event+0x24/0x34 process_one_work+0x284/0x744 worker_thread+0x28/0x4bc kthread+0xec/0x110 ret_from_fork+0x14/0x28 } ... key at: [<c175974c>] netdev_xmit_lock_key+0x8/0x1c8 ... acquired at: __lock_acquire+0x978/0x2978 lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 sch_direct_xmit+0x16c/0x2e8 __dev_queue_xmit+0x41c/0x1224 ip6_finish_output2+0x5f4/0xc64 ndisc_send_skb+0x4cc/0x81c addrconf_rs_timer+0xb0/0x2f8 call_timer_fn+0xb4/0x33c expire_timers+0xb4/0x10c run_timer_softirq+0xf8/0x2a8 __do_softirq+0xd4/0x5fc __irq_exit_rcu+0x138/0x17c irq_exit+0x8/0x28 __irq_svc+0x90/0xbc arch_cpu_idle+0x30/0x3c default_idle_call+0x44/0xac do_idle+0xc8/0x138 cpu_startup_entry+0x18/0x1c rest_init+0xcc/0x168 arch_post_acpi_subsys_init+0x0/0x8
stack backtrace: CPU: 0 PID: 0 Comm: swapper/0 Tainted: G N 6.2.0-rc7-01749-gc54e1f7f7e36 #2786 Hardware name: Generic DT based system unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from mark_lock.part.0+0x59c/0x93c mark_lock.part.0 from __lock_acquire+0x978/0x2978 __lock_acquire from lock_acquire.part.0+0xb0/0x248 lock_acquire.part.0 from _raw_spin_lock+0x38/0x48 _raw_spin_lock from sch_direct_xmit+0x16c/0x2e8 sch_direct_xmit from __dev_queue_xmit+0x41c/0x1224 __dev_queue_xmit from ip6_finish_output2+0x5f4/0xc64 ip6_finish_output2 from ndisc_send_skb+0x4cc/0x81c ndisc_send_skb from addrconf_rs_timer+0xb0/0x2f8 addrconf_rs_timer from call_timer_fn+0xb4/0x33c call_timer_fn from expire_timers+0xb4/0x10c expire_timers from run_timer_softirq+0xf8/0x2a8 run_timer_softirq from __do_softirq+0xd4/0x5fc __do_softirq from __irq_exit_rcu+0x138/0x17c __irq_exit_rcu from irq_exit+0x8/0x28 irq_exit from __irq_svc+0x90/0xbc Exception stack(0xc1001f20 to 0xc1001f68) 1f20: ffffffff ffffffff 00000001 c011f840 c100e000 c100e000 c1009314 c1009370 1f40: c10f0c1a c0d5e564 c0f5da8c 00000000 00000000 c1001f70 c010f0bc c010f0c0 1f60: 600f0013 ffffffff __irq_svc from arch_cpu_idle+0x30/0x3c arch_cpu_idle from default_idle_call+0x44/0xac default_idle_call from do_idle+0xc8/0x138 do_idle from cpu_startup_entry+0x18/0x1c cpu_startup_entry from rest_init+0xcc/0x168 rest_init from arch_post_acpi_subsys_init+0x0/0x8
Fix this by using spin_lock_irqsave/spin_lock_irqrestore also inside lan966x_ptp_irq_handler.
Fixes: e85a96e48e33 ("net: lan966x: Add support for ptp interrupts") Signed-off-by: Horatiu Vultur horatiu.vultur@microchip.com Link: https://lore.kernel.org/r/20230217210917.2649365-1-horatiu.vultur@microchip.... Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c index a8348437dd87f..61fbabf5bebc3 100644 --- a/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c +++ b/drivers/net/ethernet/microchip/lan966x/lan966x_ptp.c @@ -524,9 +524,9 @@ irqreturn_t lan966x_ptp_irq_handler(int irq, void *args) if (WARN_ON(!skb_match)) continue;
- spin_lock(&lan966x->ptp_ts_id_lock); + spin_lock_irqsave(&lan966x->ptp_ts_id_lock, flags); lan966x->ptp_skbs--; - spin_unlock(&lan966x->ptp_ts_id_lock); + spin_unlock_irqrestore(&lan966x->ptp_ts_id_lock, flags);
/* Get the h/w timestamp */ lan966x_get_hwtimestamp(lan966x, &ts, delay);
From: Kees Cook keescook@chromium.org
[ Upstream commit f8f185e39b4de91bc5235e5be0d829bea69d9b06 ]
The call "skb_copy_from_linear_data(skb, inl + 1, spc)" triggers a FORTIFY memcpy() warning on ppc64 platform:
In function ‘fortify_memcpy_chk’, inlined from ‘skb_copy_from_linear_data’ at ./include/linux/skbuff.h:4029:2, inlined from ‘build_inline_wqe’ at drivers/net/ethernet/mellanox/mlx4/en_tx.c:722:4, inlined from ‘mlx4_en_xmit’ at drivers/net/ethernet/mellanox/mlx4/en_tx.c:1066:3: ./include/linux/fortify-string.h:513:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 513 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Same behaviour on x86 you can get if you use "__always_inline" instead of "inline" for skb_copy_from_linear_data() in skbuff.h
The call here copies data into inlined tx destricptor, which has 104 bytes (MAX_INLINE) space for data payload. In this case "spc" is known in compile-time but the destination is used with hidden knowledge (real structure of destination is different from that the compiler can see). That cause the fortify warning because compiler can check bounds, but the real bounds are different. "spc" can't be bigger than 64 bytes (MLX4_INLINE_ALIGN), so the data can always fit into inlined tx descriptor. The fact that "inl" points into inlined tx descriptor is determined earlier in mlx4_en_xmit().
Avoid confusing the compiler with "inl + 1" constructions to get to past the inl header by introducing a flexible array "data" to the struct so that the compiler can see that we are not dealing with an array of inl structs, but rather, arbitrary data following the structure. There are no changes to the structure layout reported by pahole, and the resulting machine code is actually smaller.
Reported-by: Josef Oskera joskera@redhat.com Link: https://lore.kernel.org/lkml/20230217094541.2362873-1-joskera@redhat.com Fixes: f68f2ff91512 ("fortify: Detect struct member overflows in memcpy() at compile-time") Cc: Yishai Hadas yishaih@nvidia.com Signed-off-by: Kees Cook keescook@chromium.org Reviewed-by: Tariq Toukan tariqt@nvidia.com Link: https://lore.kernel.org/r/20230218183842.never.954-kees@kernel.org Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 22 +++++++++++----------- include/linux/mlx4/qp.h | 1 + 2 files changed, 12 insertions(+), 11 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c index c5758637b7bed..2f79378fbf6ec 100644 --- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c +++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c @@ -699,32 +699,32 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, inl->byte_count = cpu_to_be32(1 << 31 | skb->len); } else { inl->byte_count = cpu_to_be32(1 << 31 | MIN_PKT_LEN); - memset(((void *)(inl + 1)) + skb->len, 0, + memset(inl->data + skb->len, 0, MIN_PKT_LEN - skb->len); } - skb_copy_from_linear_data(skb, inl + 1, hlen); + skb_copy_from_linear_data(skb, inl->data, hlen); if (shinfo->nr_frags) - memcpy(((void *)(inl + 1)) + hlen, fragptr, + memcpy(inl->data + hlen, fragptr, skb_frag_size(&shinfo->frags[0]));
} else { inl->byte_count = cpu_to_be32(1 << 31 | spc); if (hlen <= spc) { - skb_copy_from_linear_data(skb, inl + 1, hlen); + skb_copy_from_linear_data(skb, inl->data, hlen); if (hlen < spc) { - memcpy(((void *)(inl + 1)) + hlen, + memcpy(inl->data + hlen, fragptr, spc - hlen); fragptr += spc - hlen; } - inl = (void *) (inl + 1) + spc; - memcpy(((void *)(inl + 1)), fragptr, skb->len - spc); + inl = (void *)inl->data + spc; + memcpy(inl->data, fragptr, skb->len - spc); } else { - skb_copy_from_linear_data(skb, inl + 1, spc); - inl = (void *) (inl + 1) + spc; - skb_copy_from_linear_data_offset(skb, spc, inl + 1, + skb_copy_from_linear_data(skb, inl->data, spc); + inl = (void *)inl->data + spc; + skb_copy_from_linear_data_offset(skb, spc, inl->data, hlen - spc); if (shinfo->nr_frags) - memcpy(((void *)(inl + 1)) + hlen - spc, + memcpy(inl->data + hlen - spc, fragptr, skb_frag_size(&shinfo->frags[0])); } diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h index 9db93e487496a..b6b626157b03a 100644 --- a/include/linux/mlx4/qp.h +++ b/include/linux/mlx4/qp.h @@ -446,6 +446,7 @@ enum {
struct mlx4_wqe_inline_seg { __be32 byte_count; + __u8 data[]; };
enum mlx4_update_qp_attr {
From: Leon Romanovsky leonro@nvidia.com
[ Upstream commit f2b6cfda76d2119871e10fa01ecdc7178401ef22 ]
Hardware requires an alignment to 64 bytes to return ASO data. Missing this alignment caused to unpredictable results while ASO events were generated.
Fixes: 8518d05b8f9a ("net/mlx5e: Create Advanced Steering Operation object for IPsec") Reported-by: Emeel Hakim ehakim@nvidia.com Signed-off-by: Leon Romanovsky leonro@nvidia.com Link: https://lore.kernel.org/r/de0302c572b90c9224a72868d4e0d657b6313c4b.167679761... Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h index 8bed9c3610754..d739d77d68986 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h @@ -119,7 +119,7 @@ struct mlx5e_ipsec_work { };
struct mlx5e_ipsec_aso { - u8 ctx[MLX5_ST_SZ_BYTES(ipsec_aso)]; + u8 __aligned(64) ctx[MLX5_ST_SZ_BYTES(ipsec_aso)]; dma_addr_t dma_addr; struct mlx5_aso *aso; /* Protect ASO WQ access, as it is global to whole IPsec */
From: Roxana Nicolescu roxana.nicolescu@canonical.com
[ Upstream commit b60417a9f2b890a8094477b2204d4f73c535725e ]
Usage of `set -e` before executing a command causes immediate exit on failure, without cleanup up the resources allocated at setup. This can affect the next tests that use the same resources, leading to a chain of failures.
A simple fix is to always call cleanup function when the script exists. This approach is already used by other existing tests.
Fixes: 1056691b2680 ("selftests: fib_tests: Make test results more verbose") Signed-off-by: Roxana Nicolescu roxana.nicolescu@canonical.com Link: https://lore.kernel.org/r/20230220110400.26737-2-roxana.nicolescu@canonical.... Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/net/fib_tests.sh | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh index 5637b5dadabdb..70ea8798b1f60 100755 --- a/tools/testing/selftests/net/fib_tests.sh +++ b/tools/testing/selftests/net/fib_tests.sh @@ -2065,6 +2065,8 @@ EOF ################################################################################ # main
+trap cleanup EXIT + while getopts :t:pPhv o do case $o in
From: Jiri Pirko jiri@nvidia.com
[ Upstream commit f922c7b1c1c45740d329bf248936fdb78c0cff6e ]
When devlink instance is put into network namespace and that network namespace gets deleted, devlink instance is moved back into init_ns. This is done as a part of cleanup_net() routine. Since cleanup_net() is called asynchronously from workqueue, there is no guarantee that the devlink instance move is done after "ip netns del" returns.
So fix this race by making sure that the devlink instance is present before any other operation.
Reported-by: Amir Tzin amirtz@nvidia.com Fixes: b74c37fd35a2 ("selftests: netdevsim: add tests for devlink reload with resources") Signed-off-by: Jiri Pirko jiri@nvidia.com Reviewed-by: Pavan Chebbi pavan.chebbi@broadcom.com Link: https://lore.kernel.org/r/20230220132336.198597-1-jiri@resnulli.us Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../selftests/drivers/net/netdevsim/devlink.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
diff --git a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh index a08c02abde121..7f7d20f222070 100755 --- a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh +++ b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh @@ -17,6 +17,18 @@ SYSFS_NET_DIR=/sys/bus/netdevsim/devices/$DEV_NAME/net/ DEBUGFS_DIR=/sys/kernel/debug/netdevsim/$DEV_NAME/ DL_HANDLE=netdevsim/$DEV_NAME
+wait_for_devlink() +{ + "$@" | grep -q $DL_HANDLE +} + +devlink_wait() +{ + local timeout=$1 + + busywait "$timeout" wait_for_devlink devlink dev +} + fw_flash_test() { RET=0 @@ -256,6 +268,9 @@ netns_reload_test() ip netns del testns2 ip netns del testns1
+ # Wait until netns async cleanup is done. + devlink_wait 2000 + log_test "netns reload test" }
@@ -348,6 +363,9 @@ resource_test() ip netns del testns2 ip netns del testns1
+ # Wait until netns async cleanup is done. + devlink_wait 2000 + log_test "resource test" }
From: Shang XiaoJing shangxiaojing@huawei.com
[ Upstream commit 834c23e4f798dcdc8af251b3c428ceef94741991 ]
drmm_mode_config_init() will call drm_mode_create_standard_properties() and won't check the ret value. When drm_mode_create_standard_properties() failed due to alloc, property will be a NULL pointer and may causes the null-ptr-deref. Fix the null-ptr-deref by adding the ret value check.
Found null-ptr-deref while testing insert module bochs: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm] Call Trace: <TASK> __drm_connector_init+0xb6c/0x1100 [drm] bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs] pci_device_probe+0x17d/0x340 really_probe+0x1db/0x5d0 __driver_probe_device+0x1e7/0x250 driver_probe_device+0x4a/0x120 __driver_attach+0xcd/0x2c0 bus_for_each_dev+0x11a/0x1b0 bus_add_driver+0x3d7/0x500 driver_register+0x18e/0x320 do_one_initcall+0xc4/0x3e0 do_init_module+0x1b4/0x630 load_module+0x5dca/0x7230 __do_sys_finit_module+0x100/0x170 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff65af9f839
Fixes: 6b4959f43a04 ("drm/atomic: atomic plane properties") Signed-off-by: Shang XiaoJing shangxiaojing@huawei.com Signed-off-by: Thomas Zimmermann tzimmermann@suse.de Link: https://patchwork.freedesktop.org/patch/msgid/20221118021651.2460-1-shangxia... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_mode_config.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c index 688c8afe0bf17..8525ef8515406 100644 --- a/drivers/gpu/drm/drm_mode_config.c +++ b/drivers/gpu/drm/drm_mode_config.c @@ -399,6 +399,8 @@ static void drm_mode_config_init_release(struct drm_device *dev, void *ptr) */ int drmm_mode_config_init(struct drm_device *dev) { + int ret; + mutex_init(&dev->mode_config.mutex); drm_modeset_lock_init(&dev->mode_config.connection_mutex); mutex_init(&dev->mode_config.idr_mutex); @@ -420,7 +422,11 @@ int drmm_mode_config_init(struct drm_device *dev) init_llist_head(&dev->mode_config.connector_free_list); INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn);
- drm_mode_create_standard_properties(dev); + ret = drm_mode_create_standard_properties(dev); + if (ret) { + drm_mode_config_cleanup(dev); + return ret; + }
/* Just to be sure */ dev->mode_config.num_fb = 0;
From: Geert Uytterhoeven geert@linux-m68k.org
[ Upstream commit 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 ]
As of commit eae06120f1974e1a ("drm: refuse ADDFB2 ioctl for broken bigendian drivers"), drivers must set the quirk_addfb_prefer_host_byte_order quirk to make the drm_mode_addfb() compat code work correctly on big-endian machines.
While that works fine for big-endian XRGB8888 and ARGB8888, which are mapped to the existing little-endian BGRX8888 and BGRA8888 formats, it does not work for big-endian XRGB1555 and RGB565, as the latter are not listed in the format database.
Fix this by adding the missing formats. Limit this to big-endian platforms, as there is currently no need to support these formats on little-endian platforms.
Fixes: 6960e6da9cec3f66 ("drm: fix drm_mode_addfb() on big endian machines.") Signed-off-by: Geert Uytterhoeven geert@linux-m68k.org Signed-off-by: Daniel Vetter daniel.vetter@ffwll.ch Link: https://patchwork.freedesktop.org/patch/msgid/3ee1f8144feb96c28742b22384189f... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_fourcc.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c index 6242dfbe92402..0f17dfa8702b4 100644 --- a/drivers/gpu/drm/drm_fourcc.c +++ b/drivers/gpu/drm/drm_fourcc.c @@ -190,6 +190,10 @@ const struct drm_format_info *__drm_format_info(u32 format) { .format = DRM_FORMAT_BGRA5551, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1, .has_alpha = true }, { .format = DRM_FORMAT_RGB565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, { .format = DRM_FORMAT_BGR565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, +#ifdef __BIG_ENDIAN + { .format = DRM_FORMAT_XRGB1555 | DRM_FORMAT_BIG_ENDIAN, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_RGB565 | DRM_FORMAT_BIG_ENDIAN, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, +#endif { .format = DRM_FORMAT_RGB888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, { .format = DRM_FORMAT_BGR888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, { .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 1, .cpp = { 4, 0, 0 }, .hsub = 1, .vsub = 1 },
From: Frieder Schrempf frieder.schrempf@kontron.de
[ Upstream commit 4b03d5e0d3e86ee492d54254927d020dc0fe8acf ]
The datasheet specifies a delay of 10 milliseconds, but the current driver only waits for 1 ms. Fix this to make sure the initialization sequence meets the spec.
Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver") Signed-off-by: Frieder Schrempf frieder.schrempf@kontron.de Reviewed-by: Alexander Stein alexander.stein@ew.tq-group.com Signed-off-by: Robert Foss robert.foss@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20221122081219.20143-1-frieder... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c index 7ba9467fff129..047c14ddbbf11 100644 --- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c +++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c @@ -346,7 +346,7 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge,
/* Deassert reset */ gpiod_set_value_cansleep(ctx->enable_gpio, 1); - usleep_range(1000, 1100); + usleep_range(10000, 11000);
/* Get the LVDS format from the bridge state. */ bridge_state = drm_atomic_get_new_bridge_state(state, bridge);
From: Geert Uytterhoeven geert+renesas@glider.be
[ Upstream commit 10ef5f2992006720318b9886961820155b3750fd ]
The Freescale/NXP i.MX LCDIFv3 LCD controller is only present on Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXC, to prevent asking the user about this driver when configuring a kernel without Freescale/NXP i.MX support.
Fixes: 9db35bb349a0ef32 ("drm: lcdif: Add support for i.MX8MP LCDIF variant") Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Reviewed-by: Marek Vasut marex@denx.de Signed-off-by: Marek Vasut marex@denx.de Link: https://patchwork.freedesktop.org/patch/msgid/6103c1aa65a7888c12d351ae63f298... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mxsfb/Kconfig | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig index 116f8168bda4a..aa4b0eb2a562b 100644 --- a/drivers/gpu/drm/mxsfb/Kconfig +++ b/drivers/gpu/drm/mxsfb/Kconfig @@ -24,6 +24,7 @@ config DRM_IMX_LCDIF tristate "i.MX LCDIFv3 LCD controller" depends on DRM && OF depends on COMMON_CLK + depends on ARCH_MXC || COMPILE_TEST select DRM_MXS select DRM_KMS_HELPER select DRM_GEM_DMA_HELPER
From: Geert Uytterhoeven geert+renesas@glider.be
[ Upstream commit 7783cc67862f9166c901bfa0f80b717aa8d354dd ]
Freescale/NXP i.MX LCDIF and eLCDIF LCD controllers are only present on Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXS || ARCH_MXC, to prevent asking the user about this driver when configuring a kernel without Freescale/NXP i.MX support.
Fixes: 45d59d704080cc0c ("drm: Add new driver for MXSFB controller") Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Reviewed-by: Marek Vasut marex@denx.de Signed-off-by: Marek Vasut marex@denx.de Link: https://patchwork.freedesktop.org/patch/msgid/98e74779ca2bc575d91afff03369e8... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mxsfb/Kconfig | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig index aa4b0eb2a562b..518b533453548 100644 --- a/drivers/gpu/drm/mxsfb/Kconfig +++ b/drivers/gpu/drm/mxsfb/Kconfig @@ -8,6 +8,7 @@ config DRM_MXSFB tristate "i.MX (e)LCDIF LCD controller" depends on DRM && OF depends on COMMON_CLK + depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST select DRM_MXS select DRM_KMS_HELPER select DRM_GEM_DMA_HELPER
From: Yuan Can yuancan@huawei.com
[ Upstream commit 4ecff954c370b82bce45bdca2846c5c5563e8a8a ]
A problem about insmod megachips-stdpxxxx-ge-b850v3-fw.ko failed is triggered with the following log given:
[ 4497.981497] Error: Driver 'stdp4028-ge-b850v3-fw' is already registered, aborting... insmod: ERROR: could not insert module megachips-stdpxxxx-ge-b850v3-fw.ko: Device or resource busy
The reason is that stdpxxxx_ge_b850v3_init() returns i2c_add_driver() directly without checking its return value, if i2c_add_driver() failed, it returns without calling i2c_del_driver() on the previous i2c driver, resulting the megachips-stdpxxxx-ge-b850v3-fw can never be installed later. A simple call graph is shown as below:
stdpxxxx_ge_b850v3_init() i2c_add_driver(&stdp4028_ge_b850v3_fw_driver) i2c_add_driver(&stdp2690_ge_b850v3_fw_driver) i2c_register_driver() driver_register() bus_add_driver() priv = kzalloc(...) # OOM happened # return without delete stdp4028_ge_b850v3_fw_driver
Fix by calling i2c_del_driver() on stdp4028_ge_b850v3_fw_driver when i2c_add_driver() returns error.
Fixes: fcfa0ddc18ed ("drm/bridge: Drivers for megachips-stdpxxxx-ge-b850v3-fw (LVDS-DP++)") Signed-off-by: Yuan Can yuancan@huawei.com Reviewed-by: Andrzej Hajda andrzej.hajda@intel.com Tested-by: Ian Ray ian.ray@ge.com Signed-off-by: Robert Foss robert.foss@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20221108091226.114524-1-yuanca... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c index 97359f807bfc3..cbfa05a6767b5 100644 --- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c @@ -440,7 +440,11 @@ static int __init stdpxxxx_ge_b850v3_init(void) if (ret) return ret;
- return i2c_add_driver(&stdp2690_ge_b850v3_fw_driver); + ret = i2c_add_driver(&stdp2690_ge_b850v3_fw_driver); + if (ret) + i2c_del_driver(&stdp4028_ge_b850v3_fw_driver); + + return ret; } module_init(stdpxxxx_ge_b850v3_init);
From: Yuan Can yuancan@huawei.com
[ Upstream commit 0d0b368b9d104b437e1f4850ae94bdb9a3601e89 ]
A memory leak was reported after the vkms module install failed.
unreferenced object 0xffff88810bc28520 (size 16): comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s) hex dump (first 16 bytes): 01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d............ backtrace: [<00000000e7561ff8>] kmalloc_trace+0x27/0x60 [<000000000b1954a0>] 0xffffffffc45200a9 [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0 [<000000001505ee87>] do_init_module+0x1a4/0x680 [<00000000958079ad>] load_module+0x6249/0x7110 [<00000000117e4696>] __do_sys_finit_module+0x140/0x200 [<00000000f74b12d2>] do_syscall_64+0x35/0x80 [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
The reason is that the vkms_init() returns without checking the return value of vkms_create(), and if the vkms_create() failed, the config allocated at the beginning of vkms_init() is leaked.
vkms_init() config = kmalloc(...) # config allocated ... return vkms_create() # vkms_create failed and config is leaked
Fix this problem by checking return value of vkms_create() and free the config if error happened.
Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type") Signed-off-by: Yuan Can yuancan@huawei.com Reviewed-by: Melissa Wen mwen@igalia.com Signed-off-by: Melissa Wen melissa.srw@gmail.com Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-2-yuancan... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vkms/vkms_drv.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c index 293dbca50c316..8a74f37d59123 100644 --- a/drivers/gpu/drm/vkms/vkms_drv.c +++ b/drivers/gpu/drm/vkms/vkms_drv.c @@ -218,6 +218,7 @@ static int vkms_create(struct vkms_config *config)
static int __init vkms_init(void) { + int ret; struct vkms_config *config;
config = kmalloc(sizeof(*config), GFP_KERNEL); @@ -230,7 +231,11 @@ static int __init vkms_init(void) config->writeback = enable_writeback; config->overlay = enable_overlay;
- return vkms_create(config); + ret = vkms_create(config); + if (ret) + kfree(config); + + return ret; }
static void vkms_destroy(struct vkms_config *config)
From: Yuan Can yuancan@huawei.com
[ Upstream commit 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 ]
A null-ptr-deref is triggered when it tries to destroy the workqueue in vkms->output.composer_workq in vkms_release().
KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24 RIP: 0010:destroy_workqueue+0x2f/0x710 ... Call Trace: <TASK> ? vkms_config_debugfs_init+0x50/0x50 [vkms] __devm_drm_dev_alloc+0x15a/0x1c0 [drm] vkms_init+0x245/0x1000 [vkms] do_one_initcall+0xd0/0x4f0 do_init_module+0x1a4/0x680 load_module+0x6249/0x7110 __do_sys_finit_module+0x140/0x200 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
The reason is that an OOM happened which triggers the destroy of the workqueue, however, the workqueue is alloced in the later process, thus a null-ptr-deref happened. A simple call graph is shown as below:
vkms_init() vkms_create() devm_drm_dev_alloc() __devm_drm_dev_alloc() devm_drm_dev_init() devm_add_action_or_reset() devm_add_action() # an error happened devm_drm_dev_init_release() drm_dev_put() kref_put() drm_dev_release() vkms_release() destroy_workqueue() # null-ptr-deref happened vkms_modeset_init() vkms_output_init() vkms_crtc_init() # where the workqueue get allocated
Fix this by checking if composer_workq is NULL before passing it to the destroy_workqueue() in vkms_release().
Fixes: 6c234fe37c57 ("drm/vkms: Implement CRC debugfs API") Signed-off-by: Yuan Can yuancan@huawei.com Reviewed-by: Melissa Wen mwen@igalia.com Signed-off-by: Melissa Wen melissa.srw@gmail.com Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vkms/vkms_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c index 8a74f37d59123..69346906ec813 100644 --- a/drivers/gpu/drm/vkms/vkms_drv.c +++ b/drivers/gpu/drm/vkms/vkms_drv.c @@ -57,7 +57,8 @@ static void vkms_release(struct drm_device *dev) { struct vkms_device *vkms = drm_device_to_vkms_device(dev);
- destroy_workqueue(vkms->output.composer_workq); + if (vkms->output.composer_workq) + destroy_workqueue(vkms->output.composer_workq); }
static void vkms_atomic_commit_tail(struct drm_atomic_state *old_state)
From: Maxime Ripard maxime@cerno.tech
[ Upstream commit 0f9aa074c92dd9274b811c1c3fa93736814a4b0d ]
The mode name in struct drm_cmdline_mode can hold 32 characters at most, which can easily get overrun. Switch to strscpy() to prevent such a thing.
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Addresses-Coverity-ID: 1527354 ("Security best practices violations") Fixes: a7ab155397dd ("drm/modes: Switch to named mode descriptors") Reviewed-by: Javier Martinez Canillas javierm@redhat.com Link: https://lore.kernel.org/r/20221128081938.742410-2-maxime@cerno.tech Signed-off-by: Maxime Ripard maxime@cerno.tech Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_modes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c index 3c8034a8c27bd..951afe8279da8 100644 --- a/drivers/gpu/drm/drm_modes.c +++ b/drivers/gpu/drm/drm_modes.c @@ -1809,7 +1809,7 @@ static int drm_mode_parse_cmdline_named_mode(const char *name, if (ret != name_end) continue;
- strcpy(cmdline_mode->name, mode->name); + strscpy(cmdline_mode->name, mode->name, sizeof(cmdline_mode->name)); cmdline_mode->pixel_clock = mode->pixel_clock_khz; cmdline_mode->xres = mode->xres; cmdline_mode->yres = mode->yres;
From: Dave Stevenson dave.stevenson@raspberrypi.com
[ Upstream commit 0870d86eac8a9abd89a0be1b719d5dc5bac936f0 ]
The mapping is incorrect for RGB565_1X16 as it should be DPI_FORMAT_18BIT_666_RGB_1 instead of DPI_FORMAT_18BIT_666_RGB_3.
Fixes: 08302c35b59d ("drm/vc4: Add DPI driver") Signed-off-by: Dave Stevenson dave.stevenson@raspberrypi.com Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Link: https://lore.kernel.org/r/20221013-rpi-dpi-improvements-v3-7-eb76e26a772d@ce... Signed-off-by: Maxime Ripard maxime@cerno.tech Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_dpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c index 1f8f44b7b5a5f..61ef7d232a12c 100644 --- a/drivers/gpu/drm/vc4/vc4_dpi.c +++ b/drivers/gpu/drm/vc4/vc4_dpi.c @@ -179,7 +179,7 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) DPI_FORMAT); break; case MEDIA_BUS_FMT_RGB565_1X16: - dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3, + dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_1, DPI_FORMAT); break; default:
From: Pin-yen Lin treapking@chromium.org
[ Upstream commit 5eb9a4314053bda7642643f70f49a2b415920812 ]
Add a pair of pm_runtime_get_if_in_use and pm_runtime_put_sync in the interrupt handler to make sure the bridge won't be powered off during the interrupt handlings. Also remove the irq_lock mutex because it's not guarding anything now.
Fixes: ab28896f1a83 ("drm/bridge: it6505: Improve synchronization between extcon subsystem") Signed-off-by: Pin-yen Lin treapking@chromium.org Reviewed-by: Robert Foss robert.foss@linaro.org Signed-off-by: Robert Foss robert.foss@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20221109095227.3320919-1-treap... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/ite-it6505.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c index 21a9b8422bda5..e7f7d0ce13805 100644 --- a/drivers/gpu/drm/bridge/ite-it6505.c +++ b/drivers/gpu/drm/bridge/ite-it6505.c @@ -412,7 +412,6 @@ struct it6505 { * Mutex protects extcon and interrupt functions from interfering * each other. */ - struct mutex irq_lock; struct mutex extcon_lock; struct mutex mode_lock; /* used to bridge_detect */ struct mutex aux_lock; /* used to aux data transfers */ @@ -2494,10 +2493,8 @@ static irqreturn_t it6505_int_threaded_handler(int unused, void *data) }; int int_status[3], i;
- mutex_lock(&it6505->irq_lock); - - if (it6505->enable_drv_hold || !it6505->powered) - goto unlock; + if (it6505->enable_drv_hold || pm_runtime_get_if_in_use(dev) <= 0) + return IRQ_HANDLED;
int_status[0] = it6505_read(it6505, INT_STATUS_01); int_status[1] = it6505_read(it6505, INT_STATUS_02); @@ -2515,16 +2512,14 @@ static irqreturn_t it6505_int_threaded_handler(int unused, void *data) if (it6505_test_bit(irq_vec[0].bit, (unsigned int *)int_status)) irq_vec[0].handler(it6505);
- if (!it6505->hpd_state) - goto unlock; - - for (i = 1; i < ARRAY_SIZE(irq_vec); i++) { - if (it6505_test_bit(irq_vec[i].bit, (unsigned int *)int_status)) - irq_vec[i].handler(it6505); + if (it6505->hpd_state) { + for (i = 1; i < ARRAY_SIZE(irq_vec); i++) { + if (it6505_test_bit(irq_vec[i].bit, (unsigned int *)int_status)) + irq_vec[i].handler(it6505); + } }
-unlock: - mutex_unlock(&it6505->irq_lock); + pm_runtime_put_sync(dev);
return IRQ_HANDLED; } @@ -3277,7 +3272,6 @@ static int it6505_i2c_probe(struct i2c_client *client, if (!it6505) return -ENOMEM;
- mutex_init(&it6505->irq_lock); mutex_init(&it6505->extcon_lock); mutex_init(&it6505->mode_lock); mutex_init(&it6505->aux_lock);
From: Randolph Sapp rs@ti.com
[ Upstream commit 2df0433b18f2735a49d2c3a968b40fa2881137c0 ]
There was a long-standing bug from a typo that created 2 ARGB1555 and ABGR1555 pixel format entries. Weston 10 has a sanity check that alerted me to this issue.
According to the Supported Pixel Data formats table we have the later entries should have been for Alpha-X instead.
Signed-off-by: Randolph Sapp rs@ti.com Fixes: 32a1795f57eecc ("drm/tidss: New driver for TI Keystone platform Display SubSystem") Reviewed-by: Aradhya Bhatia a-bhatia1@ti.com Acked-by: Andrew Davis afd@ti.com Signed-off-by: Tomi Valkeinen tomi.valkeinen@ideasonboard.com Link: https://patchwork.freedesktop.org/patch/msgid/20221202001803.1765805-1-rs@ti... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/tidss/tidss_dispc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c index ad93acc9abd2a..16301bdfead12 100644 --- a/drivers/gpu/drm/tidss/tidss_dispc.c +++ b/drivers/gpu/drm/tidss/tidss_dispc.c @@ -1858,8 +1858,8 @@ static const struct { { DRM_FORMAT_XBGR4444, 0x21, }, { DRM_FORMAT_RGBX4444, 0x22, },
- { DRM_FORMAT_ARGB1555, 0x25, }, - { DRM_FORMAT_ABGR1555, 0x26, }, + { DRM_FORMAT_XRGB1555, 0x25, }, + { DRM_FORMAT_XBGR1555, 0x26, },
{ DRM_FORMAT_XRGB8888, 0x27, }, { DRM_FORMAT_XBGR8888, 0x28, },
From: Liang He windhl@126.com
[ Upstream commit 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f ]
In ipu_add_client_devices(), we need to call of_node_put() for reference returned by of_graph_get_port_by_id() in fail path.
Fixes: 17e052175039 ("gpu: ipu-v3: Do not bail out on missing optional port nodes") Signed-off-by: Liang He windhl@126.com Reviewed-by: Philipp Zabel p.zabel@pengutronix.de Link: https://lore.kernel.org/r/20220720152227.1288413-1-windhl@126.com Signed-off-by: Philipp Zabel p.zabel@pengutronix.de Link: https://patchwork.freedesktop.org/patch/msgid/20220720152227.1288413-1-windh... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/ipu-v3/ipu-common.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c index 118318513e2d2..c35eac1116f5f 100644 --- a/drivers/gpu/ipu-v3/ipu-common.c +++ b/drivers/gpu/ipu-v3/ipu-common.c @@ -1165,6 +1165,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) pdev = platform_device_alloc(reg->name, id++); if (!pdev) { ret = -ENOMEM; + of_node_put(of_node); goto err_register; }
From: Thomas Zimmermann tzimmermann@suse.de
[ Upstream commit b1def7fadfa544bd2467581ce40b659583eb7e79 ]
Ast hardware scans out the primary plane from video memory, which is in I/O-memory space. Hence init the damage handler's iosys_map pointer as I/O memory.
Not all platforms support accessing I/O memory as system memory, although it's usually not a problem in ast's x86-based systems.
The error report is at [1].
Reported-by: kernel test robot lkp@intel.com Signed-off-by: Thomas Zimmermann tzimmermann@suse.de Reviewed-by: Jocelyn Falempe jfalempe@redhat.com Fixes: f2fa5a99ca81 ("drm/ast: Convert ast to SHMEM") Cc: Thomas Zimmermann tzimmermann@suse.de Cc: Jocelyn Falempe jfalempe@redhat.com Cc: Dave Airlie airlied@redhat.com Cc: dri-devel@lists.freedesktop.org Link: https://lore.kernel.org/lkml/202212170111.eInM0unS-lkp@intel.com/T/#u # 1 Link: https://patchwork.freedesktop.org/patch/msgid/20221216193005.30280-1-tzimmer... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/ast/ast_mode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c index 66a4a41c3fe94..d314b9e7c05f9 100644 --- a/drivers/gpu/drm/ast/ast_mode.c +++ b/drivers/gpu/drm/ast/ast_mode.c @@ -636,7 +636,7 @@ static void ast_handle_damage(struct ast_plane *ast_plane, struct iosys_map *src struct drm_framebuffer *fb, const struct drm_rect *clip) { - struct iosys_map dst = IOSYS_MAP_INIT_VADDR(ast_plane->vaddr); + struct iosys_map dst = IOSYS_MAP_INIT_VADDR_IOMEM(ast_plane->vaddr);
iosys_map_incr(&dst, drm_fb_clip_offset(fb->pitches[0], fb->format, clip)); drm_fb_memcpy(&dst, fb->pitches, src, fb, clip);
From: Maíra Canal mcanal@igalia.com
[ Upstream commit 479d4f0be4237ba33bc9432787aeb62c90e30f95 ]
If vc4_hdmi_reset_link() returns -EDEADLK, it means that a deadlock happened in the locking context. This situation should be addressed by dropping all currently held locks and block until the contended lock becomes available. Currently, vc4 is not dealing with the deadlock properly, producing the following output when PROVE_LOCKING is enabled:
[ 825.612809] ------------[ cut here ]------------ [ 825.612852] WARNING: CPU: 1 PID: 116 at drivers/gpu/drm/drm_modeset_lock.c:276 drm_modeset_drop_locks+0x60/0x68 [drm] [ 825.613458] Modules linked in: 8021q mrp garp stp llc raspberrypi_cpufreq brcmfmac brcmutil crct10dif_ce hci_uart cfg80211 btqca btbcm bluetooth vc4 raspberrypi_hwmon snd_soc_hdmi_codec cec clk_raspberrypi ecdh_generic drm_display_helper ecc rfkill drm_dma_helper drm_kms_helper pwm_bcm2835 bcm2835_thermal bcm2835_rng rng_core i2c_bcm2835 drm fuse ip_tables x_tables ipv6 [ 825.613735] CPU: 1 PID: 116 Comm: kworker/1:2 Tainted: G W 6.1.0-rc6-01399-g941aae326315 #3 [ 825.613759] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 825.613777] Workqueue: events output_poll_execute [drm_kms_helper] [ 825.614038] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 825.614063] pc : drm_modeset_drop_locks+0x60/0x68 [drm] [ 825.614603] lr : drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper] [ 825.614829] sp : ffff800008313bf0 [ 825.614844] x29: ffff800008313bf0 x28: ffffcd7778b8b000 x27: 0000000000000000 [ 825.614883] x26: 0000000000000001 x25: 0000000000000001 x24: ffff677cc35c2758 [ 825.614920] x23: ffffcd7707d01430 x22: ffffcd7707c3edc7 x21: 0000000000000001 [ 825.614958] x20: 0000000000000000 x19: ffff800008313c10 x18: 000000000000b6d3 [ 825.614995] x17: ffffcd777835e214 x16: ffffcd7777cef870 x15: fffff81000000000 [ 825.615033] x14: 0000000000000000 x13: 0000000000000099 x12: 0000000000000002 [ 825.615070] x11: 72917988020af800 x10: 72917988020af800 x9 : 72917988020af800 [ 825.615108] x8 : ffff677cc665e0a8 x7 : d00a8c180000110c x6 : ffffcd77774c0054 [ 825.615145] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 [ 825.615181] x2 : ffff677cc55e1880 x1 : ffffcd7777cef8ec x0 : ffff800008313c10 [ 825.615219] Call trace: [ 825.615232] drm_modeset_drop_locks+0x60/0x68 [drm] [ 825.615773] drm_helper_probe_detect+0x120/0x1b4 [drm_kms_helper] [ 825.616003] output_poll_execute+0xe4/0x224 [drm_kms_helper] [ 825.616233] process_one_work+0x2b4/0x618 [ 825.616264] worker_thread+0x24c/0x464 [ 825.616288] kthread+0xec/0x110 [ 825.616310] ret_from_fork+0x10/0x20 [ 825.616335] irq event stamp: 7634 [ 825.616349] hardirqs last enabled at (7633): [<ffffcd777831ee90>] _raw_spin_unlock_irq+0x3c/0x78 [ 825.616384] hardirqs last disabled at (7634): [<ffffcd7778315a78>] __schedule+0x134/0x9f0 [ 825.616411] softirqs last enabled at (7630): [<ffffcd7707aacea0>] local_bh_enable+0x4/0x30 [ipv6] [ 825.617019] softirqs last disabled at (7618): [<ffffcd7707aace70>] local_bh_disable+0x4/0x30 [ipv6] [ 825.617586] ---[ end trace 0000000000000000 ]---
Therefore, deal with the deadlock as suggested by [1], using the function drm_modeset_backoff().
[1] https://docs.kernel.org/gpu/drm-kms.html?highlight=kms#kms-locking
Fixes: 6bed2ea3cb38 ("drm/vc4: hdmi: Reset link on hotplug") Reported-by: Stefan Wahren stefan.wahren@i2se.com Signed-off-by: Maíra Canal mcanal@igalia.com Tested-by: Stefan Wahren stefan.wahren@i2se.com Signed-off-by: Maxime Ripard maxime@cerno.tech Link: https://patchwork.freedesktop.org/patch/msgid/20221229194638.178712-1-mcanal... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_hdmi.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index 7546103f14997..21338e6a95056 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -406,6 +406,7 @@ static void vc4_hdmi_handle_hotplug(struct vc4_hdmi *vc4_hdmi, { struct drm_connector *connector = &vc4_hdmi->connector; struct edid *edid; + int ret;
/* * NOTE: This function should really be called with @@ -434,7 +435,15 @@ static void vc4_hdmi_handle_hotplug(struct vc4_hdmi *vc4_hdmi, cec_s_phys_addr_from_edid(vc4_hdmi->cec_adap, edid); kfree(edid);
- vc4_hdmi_reset_link(connector, ctx); + for (;;) { + ret = vc4_hdmi_reset_link(connector, ctx); + if (ret == -EDEADLK) { + drm_modeset_backoff(ctx); + continue; + } + + break; + } }
static int vc4_hdmi_connector_detect_ctx(struct drm_connector *connector,
From: Armin Wolf W_Armin@gmx.de
[ Upstream commit ca8fd8c16a8b77dfcf7f6ce52d2c863220693a78 ]
A user complained that the ftsteutates driver was displaying bogus values since its introduction. This happens because the sensor measurements need to be scaled in order to produce meaningful results: - the fan speed needs to be multiplied by 60 since its in RPS - the temperature is in degrees celsius and needs an offset of 64 - the voltage is in 1/256 of 3.3V
The offical datasheet says the voltage needs to be divided by 256, but this is likely an off-by-one-error, since even the BIOS devides by 255 (otherwise 3.3V could not be measured).
The voltage channels additionally need a board-specific multiplier, however this can be done by the driver since its board-specific.
The reason the missing scaling of measurements is the way Fujitsu used this driver when it was still out-of-tree. Back then, all scaling was done in userspace by libsensors, even the generic one.
Tested on a Fujitsu DS3401-B1.
Fixes: 08426eda58e0 ("hwmon: Add driver for FTS BMC chip "Teutates"") Signed-off-by: Armin Wolf W_Armin@gmx.de Link: https://lore.kernel.org/r/20221224041855.83981-2-W_Armin@gmx.de Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Sasha Levin sashal@kernel.org --- Documentation/hwmon/ftsteutates.rst | 4 ++++ drivers/hwmon/ftsteutates.c | 19 +++++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/Documentation/hwmon/ftsteutates.rst b/Documentation/hwmon/ftsteutates.rst index 58a2483d8d0da..198fa8e2819da 100644 --- a/Documentation/hwmon/ftsteutates.rst +++ b/Documentation/hwmon/ftsteutates.rst @@ -22,6 +22,10 @@ enhancements. It can monitor up to 4 voltages, 16 temperatures and 8 fans. It also contains an integrated watchdog which is currently implemented in this driver.
+The 4 voltages require a board-specific multiplier, since the BMC can +only measure voltages up to 3.3V and thus relies on voltage dividers. +Consult your motherboard manual for details. + To clear a temperature or fan alarm, execute the following command with the correct path to the alarm file::
diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c index f5b8e724a8ca1..ffa0bb3648775 100644 --- a/drivers/hwmon/ftsteutates.c +++ b/drivers/hwmon/ftsteutates.c @@ -12,6 +12,7 @@ #include <linux/i2c.h> #include <linux/init.h> #include <linux/jiffies.h> +#include <linux/math.h> #include <linux/module.h> #include <linux/mutex.h> #include <linux/slab.h> @@ -347,13 +348,15 @@ static ssize_t in_value_show(struct device *dev, { struct fts_data *data = dev_get_drvdata(dev); int index = to_sensor_dev_attr(devattr)->index; - int err; + int value, err;
err = fts_update_device(data); if (err < 0) return err;
- return sprintf(buf, "%u\n", data->volt[index]); + value = DIV_ROUND_CLOSEST(data->volt[index] * 3300, 255); + + return sprintf(buf, "%d\n", value); }
static ssize_t temp_value_show(struct device *dev, @@ -361,13 +364,15 @@ static ssize_t temp_value_show(struct device *dev, { struct fts_data *data = dev_get_drvdata(dev); int index = to_sensor_dev_attr(devattr)->index; - int err; + int value, err;
err = fts_update_device(data); if (err < 0) return err;
- return sprintf(buf, "%u\n", data->temp_input[index]); + value = (data->temp_input[index] - 64) * 1000; + + return sprintf(buf, "%d\n", value); }
static ssize_t temp_fault_show(struct device *dev, @@ -436,13 +441,15 @@ static ssize_t fan_value_show(struct device *dev, { struct fts_data *data = dev_get_drvdata(dev); int index = to_sensor_dev_attr(devattr)->index; - int err; + int value, err;
err = fts_update_device(data); if (err < 0) return err;
- return sprintf(buf, "%u\n", data->fan_input[index]); + value = data->fan_input[index] * 60; + + return sprintf(buf, "%d\n", value); }
static ssize_t fan_source_show(struct device *dev,
From: Hui Tang tanghui20@huawei.com
[ Upstream commit 21e9a838f505178e109ccb3bf19d7808eb0326f4 ]
Because of the possilble failure of devm_kzalloc(), dpu_wb_conn might be NULL and will cause null pointer dereference later.
Therefore, it might be better to check it and directly return -ENOMEM.
Fixes: 77b001acdcfe ("drm/msm/dpu: add the writeback connector layer") Signed-off-by: Hui Tang tanghui20@huawei.com Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Patchwork: https://patchwork.freedesktop.org/patch/512277/ Link: https://lore.kernel.org/r/20221119055518.179937-1-tanghui20@huawei.com [DB: fixed typo in commit message] Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c index 088ec990a2f26..2a5a68366582b 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c @@ -70,6 +70,8 @@ int dpu_writeback_init(struct drm_device *dev, struct drm_encoder *enc, int rc = 0;
dpu_wb_conn = devm_kzalloc(dev->dev, sizeof(*dpu_wb_conn), GFP_KERNEL); + if (!dpu_wb_conn) + return -ENOMEM;
drm_connector_helper_add(&dpu_wb_conn->base.base, &dpu_wb_conn_helper_funcs);
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit afe4cb96153a0d8003e4e4ebd91b5c543e10df84 ]
Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference in `hdmi_hdcp.c` and `hdmi_hpd.c`.
Fixes: c6a57a50ad56 ("drm/msm/hdmi: add hdmi hdcp support (V3)") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Patchwork: https://patchwork.freedesktop.org/patch/517211/ Link: https://lore.kernel.org/r/20230106023011.3985-1-jiasheng@iscas.ac.cn Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c index 97372bb241d89..4ad36bc8fe5ed 100644 --- a/drivers/gpu/drm/msm/hdmi/hdmi.c +++ b/drivers/gpu/drm/msm/hdmi/hdmi.c @@ -120,6 +120,10 @@ static int msm_hdmi_init(struct hdmi *hdmi) int ret;
hdmi->workq = alloc_ordered_workqueue("msm_hdmi", 0); + if (!hdmi->workq) { + ret = -ENOMEM; + goto fail; + }
hdmi->i2c = msm_hdmi_i2c_init(hdmi); if (IS_ERR(hdmi->i2c)) {
From: Adam Skladowski a39.skl@gmail.com
[ Upstream commit a7cc0e2685082a0d79baec02df184dfa83cbfac3 ]
Adjust names of function for wcss pins, also fix third gpio in bt group.
Fixes: bcd11493f0ab ("pinctrl: qcom: Add a pinctrl driver for MSM8976 and 8956") Signed-off-by: Adam Skladowski a39.skl@gmail.com Reviewed-by: Marijn Suijten marijn.suijten@somainline.org Link: https://lore.kernel.org/r/20221231164250.74550-1-a39.skl@gmail.com Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/pinctrl/qcom/pinctrl-msm8976.c b/drivers/pinctrl/qcom/pinctrl-msm8976.c index ec43edf9b660a..e11d845847190 100644 --- a/drivers/pinctrl/qcom/pinctrl-msm8976.c +++ b/drivers/pinctrl/qcom/pinctrl-msm8976.c @@ -733,7 +733,7 @@ static const char * const codec_int2_groups[] = { "gpio74", }; static const char * const wcss_bt_groups[] = { - "gpio39", "gpio47", "gpio88", + "gpio39", "gpio47", "gpio48", }; static const char * const sdc3_groups[] = { "gpio39", "gpio40", "gpio41", @@ -958,9 +958,9 @@ static const struct msm_pingroup msm8976_groups[] = { PINGROUP(37, NA, NA, NA, qdss_tracedata_b, NA, NA, NA, NA, NA), PINGROUP(38, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b, NA), PINGROUP(39, wcss_bt, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), - PINGROUP(40, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), - PINGROUP(41, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), - PINGROUP(42, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), + PINGROUP(40, wcss_wlan2, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), + PINGROUP(41, wcss_wlan1, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), + PINGROUP(42, wcss_wlan0, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), PINGROUP(43, wcss_wlan, sdc3, NA, NA, qdss_tracedata_a, NA, NA, NA, NA), PINGROUP(44, wcss_wlan, sdc3, NA, NA, NA, NA, NA, NA, NA), PINGROUP(45, wcss_fm, NA, qdss_tracectl_a, NA, NA, NA, NA, NA, NA),
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit dcef18c8ac40aa85bb339f64c1dd31dd458b06fb ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
Fixes: d86f4d71e42a ("pinctrl: stm32: check irq controller availability at probe") Signed-off-by: Miaoqian Lin linmq006@gmail.com Link: https://lore.kernel.org/r/20230102082503.3944927-1-linmq006@gmail.com Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c index 1cddca506ad7e..cb33a23ab0c11 100644 --- a/drivers/pinctrl/stm32/pinctrl-stm32.c +++ b/drivers/pinctrl/stm32/pinctrl-stm32.c @@ -1382,6 +1382,7 @@ static struct irq_domain *stm32_pctrl_get_irq_domain(struct platform_device *pde return ERR_PTR(-ENXIO);
domain = irq_find_host(parent); + of_node_put(parent); if (!domain) /* domain not registered yet */ return ERR_PTR(-EPROBE_DEFER);
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit c818ae563bf99457f02e8170aabd6b174f629f65 ]
of_find_node_by_phandle() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
Fixes: d3e5116119bd ("pinctrl: add pinctrl driver for Rockchip SoCs") Signed-off-by: Miaoqian Lin linmq006@gmail.com Link: https://lore.kernel.org/r/20230102112845.3982407-1-linmq006@gmail.com Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/pinctrl-rockchip.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c index 5eeac92f610a0..0276b52f37168 100644 --- a/drivers/pinctrl/pinctrl-rockchip.c +++ b/drivers/pinctrl/pinctrl-rockchip.c @@ -3045,6 +3045,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np, np_config = of_find_node_by_phandle(be32_to_cpup(phandle)); ret = pinconf_generic_parse_dt_config(np_config, NULL, &grp->data[j].configs, &grp->data[j].nconfigs); + of_node_put(np_config); if (ret) return ret; }
From: Dave Stevenson dave.stevenson@raspberrypi.com
[ Upstream commit 1284365e3e8cc33849f90cae20bca36fd7544e24 ]
The HVS Composite Output Buffer (COB) is the memory used to generate the output pixel data. Until now the vc4 driver has been relying on the firmware to have set these to sensible values.
In testing triple screen support it has been noted that only 1 line was being assigned to HVS channel 2. Whilst that is fine for the transposer (TXP), and indeed needed as only some pixels have an alpha channel, it is insufficient to run a live display.
Split the COB more evenly between the 3 HVS channels.
Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") Signed-off-by: Dave Stevenson dave.stevenson@raspberrypi.com Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-1-1f8e0770798b@cerno... Signed-off-by: Maxime Ripard maxime@cerno.tech Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_hvs.c | 56 ++++++++++++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c index c4453a5ae163a..d615ba7db9209 100644 --- a/drivers/gpu/drm/vc4/vc4_hvs.c +++ b/drivers/gpu/drm/vc4/vc4_hvs.c @@ -776,7 +776,7 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) struct vc4_hvs *hvs = NULL; int ret; u32 dispctrl; - u32 reg; + u32 reg, top;
hvs = drmm_kzalloc(drm, sizeof(*hvs), GFP_KERNEL); if (!hvs) @@ -912,6 +912,60 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
HVS_WRITE(SCALER_DISPCTRL, dispctrl);
+ /* Recompute Composite Output Buffer (COB) allocations for the displays + */ + if (!vc4->is_vc5) { + /* The COB is 20736 pixels, or just over 10 lines at 2048 wide. + * The bottom 2048 pixels are full 32bpp RGBA (intended for the + * TXP composing RGBA to memory), whilst the remainder are only + * 24bpp RGB. + * + * Assign 3 lines to channels 1 & 2, and just over 4 lines to + * channel 0. + */ + #define VC4_COB_SIZE 20736 + #define VC4_COB_LINE_WIDTH 2048 + #define VC4_COB_NUM_LINES 3 + reg = 0; + top = VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES; + reg |= (top - 1) << 16; + HVS_WRITE(SCALER_DISPBASE2, reg); + reg = top; + top += VC4_COB_LINE_WIDTH * VC4_COB_NUM_LINES; + reg |= (top - 1) << 16; + HVS_WRITE(SCALER_DISPBASE1, reg); + reg = top; + top = VC4_COB_SIZE; + reg |= (top - 1) << 16; + HVS_WRITE(SCALER_DISPBASE0, reg); + } else { + /* The COB is 44416 pixels, or 10.8 lines at 4096 wide. + * The bottom 4096 pixels are full RGBA (intended for the TXP + * composing RGBA to memory), whilst the remainder are only + * RGB. Addressing is always pixel wide. + * + * Assign 3 lines of 4096 to channels 1 & 2, and just over 4 + * lines. to channel 0. + */ + #define VC5_COB_SIZE 44416 + #define VC5_COB_LINE_WIDTH 4096 + #define VC5_COB_NUM_LINES 3 + reg = 0; + top = VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES; + reg |= top << 16; + HVS_WRITE(SCALER_DISPBASE2, reg); + top += 16; + reg = top; + top += VC5_COB_LINE_WIDTH * VC5_COB_NUM_LINES; + reg |= top << 16; + HVS_WRITE(SCALER_DISPBASE1, reg); + top += 16; + reg = top; + top = VC5_COB_SIZE; + reg |= top << 16; + HVS_WRITE(SCALER_DISPBASE0, reg); + } + ret = devm_request_irq(dev, platform_get_irq(pdev, 0), vc4_hvs_irq_handler, 0, "vc4 hvs", drm); if (ret)
From: Dave Stevenson dave.stevenson@raspberrypi.com
[ Upstream commit df993fced230daa8452892406f3180c93ebf7e7b ]
The HVS can change AXI request mode based on how full the COB FIFOs are. Until now the vc4 driver has been relying on the firmware to have set these to sensible values.
With HVS channel 2 now being used for live video, change the panic mode for all channels to be explicitly set by the driver, and the same for all channels.
Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") Signed-off-by: Dave Stevenson dave.stevenson@raspberrypi.com Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-2-1f8e0770798b@cerno... Signed-off-by: Maxime Ripard maxime@cerno.tech Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++ drivers/gpu/drm/vc4/vc4_regs.h | 6 ++++++ 2 files changed, 17 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c index d615ba7db9209..b335815eac6a5 100644 --- a/drivers/gpu/drm/vc4/vc4_hvs.c +++ b/drivers/gpu/drm/vc4/vc4_hvs.c @@ -910,6 +910,17 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) SCALER_DISPCTRL_DSPEISLUR(2) | SCALER_DISPCTRL_SCLEIRQ);
+ /* Set AXI panic mode. + * VC4 panics when < 2 lines in FIFO. + * VC5 panics when less than 1 line in the FIFO. + */ + dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK | + SCALER_DISPCTRL_PANIC1_MASK | + SCALER_DISPCTRL_PANIC2_MASK); + dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0); + dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1); + dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2); + HVS_WRITE(SCALER_DISPCTRL, dispctrl);
/* Recompute Composite Output Buffer (COB) allocations for the displays diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h index f0290fad991de..f121905c404d1 100644 --- a/drivers/gpu/drm/vc4/vc4_regs.h +++ b/drivers/gpu/drm/vc4/vc4_regs.h @@ -220,6 +220,12 @@ #define SCALER_DISPCTRL 0x00000000 /* Global register for clock gating the HVS */ # define SCALER_DISPCTRL_ENABLE BIT(31) +# define SCALER_DISPCTRL_PANIC0_MASK VC4_MASK(25, 24) +# define SCALER_DISPCTRL_PANIC0_SHIFT 24 +# define SCALER_DISPCTRL_PANIC1_MASK VC4_MASK(27, 26) +# define SCALER_DISPCTRL_PANIC1_SHIFT 26 +# define SCALER_DISPCTRL_PANIC2_MASK VC4_MASK(29, 28) +# define SCALER_DISPCTRL_PANIC2_SHIFT 28 # define SCALER_DISPCTRL_DSP3_MUX_MASK VC4_MASK(19, 18) # define SCALER_DISPCTRL_DSP3_MUX_SHIFT 18
From: Dave Stevenson dave.stevenson@raspberrypi.com
[ Upstream commit 982ee94486863a41c6af9f2ab3f6681f72bc5c48 ]
The bit used for SCALER_DISPBKGND_AUTOHS in SCALER_DISPBKGNDX has been repurposed on HVS5 to configure whether a display can win back-to-back arbitration wins for the COB.
This is not desirable, therefore only select this bit on HVS4, and explicitly clear it on HVS5.
Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") Signed-off-by: Dave Stevenson dave.stevenson@raspberrypi.com Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-3-1f8e0770798b@cerno... Signed-off-by: Maxime Ripard maxime@cerno.tech Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_hvs.c | 10 ++++++---- drivers/gpu/drm/vc4/vc4_regs.h | 1 + 2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c index b335815eac6a5..57d99e7199ee5 100644 --- a/drivers/gpu/drm/vc4/vc4_hvs.c +++ b/drivers/gpu/drm/vc4/vc4_hvs.c @@ -370,28 +370,30 @@ static int vc4_hvs_init_channel(struct vc4_hvs *hvs, struct drm_crtc *crtc, * mode. */ dispctrl = SCALER_DISPCTRLX_ENABLE; + dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan));
- if (!vc4->is_vc5) + if (!vc4->is_vc5) { dispctrl |= VC4_SET_FIELD(mode->hdisplay, SCALER_DISPCTRLX_WIDTH) | VC4_SET_FIELD(mode->vdisplay, SCALER_DISPCTRLX_HEIGHT) | (oneshot ? SCALER_DISPCTRLX_ONESHOT : 0); - else + dispbkgndx |= SCALER_DISPBKGND_AUTOHS; + } else { dispctrl |= VC4_SET_FIELD(mode->hdisplay, SCALER5_DISPCTRLX_WIDTH) | VC4_SET_FIELD(mode->vdisplay, SCALER5_DISPCTRLX_HEIGHT) | (oneshot ? SCALER5_DISPCTRLX_ONESHOT : 0); + dispbkgndx &= ~SCALER5_DISPBKGND_BCK2BCK; + }
HVS_WRITE(SCALER_DISPCTRLX(chan), dispctrl);
- dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan)); dispbkgndx &= ~SCALER_DISPBKGND_GAMMA; dispbkgndx &= ~SCALER_DISPBKGND_INTERLACE;
HVS_WRITE(SCALER_DISPBKGNDX(chan), dispbkgndx | - SCALER_DISPBKGND_AUTOHS | ((!vc4->is_vc5) ? SCALER_DISPBKGND_GAMMA : 0) | (interlace ? SCALER_DISPBKGND_INTERLACE : 0));
diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h index f121905c404d1..95deacdc31e77 100644 --- a/drivers/gpu/drm/vc4/vc4_regs.h +++ b/drivers/gpu/drm/vc4/vc4_regs.h @@ -366,6 +366,7 @@
#define SCALER_DISPBKGND0 0x00000044 # define SCALER_DISPBKGND_AUTOHS BIT(31) +# define SCALER5_DISPBKGND_BCK2BCK BIT(31) # define SCALER_DISPBKGND_INTERLACE BIT(30) # define SCALER_DISPBKGND_GAMMA BIT(29) # define SCALER_DISPBKGND_TESTMODE_MASK VC4_MASK(28, 25)
From: Dave Stevenson dave.stevenson@raspberrypi.com
[ Upstream commit 87551ec650bb87d35f1b29bba6a2430896e08da0 ]
HVS5 has moved the interrupt enable bits around within the DISPCTRL register, therefore the configuration has to be updated to account for this.
Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") Signed-off-by: Dave Stevenson dave.stevenson@raspberrypi.com Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-4-1f8e0770798b@cerno... Signed-off-by: Maxime Ripard maxime@cerno.tech Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_hvs.c | 52 +++++++++++++++++++++++----------- drivers/gpu/drm/vc4/vc4_regs.h | 10 +++++-- 2 files changed, 44 insertions(+), 18 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c index 57d99e7199ee5..d9fc0d03023b0 100644 --- a/drivers/gpu/drm/vc4/vc4_hvs.c +++ b/drivers/gpu/drm/vc4/vc4_hvs.c @@ -660,7 +660,8 @@ void vc4_hvs_mask_underrun(struct vc4_hvs *hvs, int channel) return;
dispctrl = HVS_READ(SCALER_DISPCTRL); - dispctrl &= ~SCALER_DISPCTRL_DSPEISLUR(channel); + dispctrl &= ~(hvs->vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) : + SCALER_DISPCTRL_DSPEISLUR(channel));
HVS_WRITE(SCALER_DISPCTRL, dispctrl);
@@ -677,7 +678,8 @@ void vc4_hvs_unmask_underrun(struct vc4_hvs *hvs, int channel) return;
dispctrl = HVS_READ(SCALER_DISPCTRL); - dispctrl |= SCALER_DISPCTRL_DSPEISLUR(channel); + dispctrl |= (hvs->vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) : + SCALER_DISPCTRL_DSPEISLUR(channel));
HVS_WRITE(SCALER_DISPSTAT, SCALER_DISPSTAT_EUFLOW(channel)); @@ -703,6 +705,7 @@ static irqreturn_t vc4_hvs_irq_handler(int irq, void *data) int channel; u32 control; u32 status; + u32 dspeislur;
/* * NOTE: We don't need to protect the register access using @@ -719,9 +722,11 @@ static irqreturn_t vc4_hvs_irq_handler(int irq, void *data) control = HVS_READ(SCALER_DISPCTRL);
for (channel = 0; channel < SCALER_CHANNELS_COUNT; channel++) { + dspeislur = vc4->is_vc5 ? SCALER5_DISPCTRL_DSPEISLUR(channel) : + SCALER_DISPCTRL_DSPEISLUR(channel); /* Interrupt masking is not always honored, so check it here. */ if (status & SCALER_DISPSTAT_EUFLOW(channel) && - control & SCALER_DISPCTRL_DSPEISLUR(channel)) { + control & dspeislur) { vc4_hvs_mask_underrun(hvs, channel); vc4_hvs_report_underrun(dev);
@@ -898,19 +903,34 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) SCALER_DISPCTRL_DISPEIRQ(1) | SCALER_DISPCTRL_DISPEIRQ(2);
- dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ | - SCALER_DISPCTRL_SLVWREIRQ | - SCALER_DISPCTRL_SLVRDEIRQ | - SCALER_DISPCTRL_DSPEIEOF(0) | - SCALER_DISPCTRL_DSPEIEOF(1) | - SCALER_DISPCTRL_DSPEIEOF(2) | - SCALER_DISPCTRL_DSPEIEOLN(0) | - SCALER_DISPCTRL_DSPEIEOLN(1) | - SCALER_DISPCTRL_DSPEIEOLN(2) | - SCALER_DISPCTRL_DSPEISLUR(0) | - SCALER_DISPCTRL_DSPEISLUR(1) | - SCALER_DISPCTRL_DSPEISLUR(2) | - SCALER_DISPCTRL_SCLEIRQ); + if (!vc4->is_vc5) + dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ | + SCALER_DISPCTRL_SLVWREIRQ | + SCALER_DISPCTRL_SLVRDEIRQ | + SCALER_DISPCTRL_DSPEIEOF(0) | + SCALER_DISPCTRL_DSPEIEOF(1) | + SCALER_DISPCTRL_DSPEIEOF(2) | + SCALER_DISPCTRL_DSPEIEOLN(0) | + SCALER_DISPCTRL_DSPEIEOLN(1) | + SCALER_DISPCTRL_DSPEIEOLN(2) | + SCALER_DISPCTRL_DSPEISLUR(0) | + SCALER_DISPCTRL_DSPEISLUR(1) | + SCALER_DISPCTRL_DSPEISLUR(2) | + SCALER_DISPCTRL_SCLEIRQ); + else + dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ | + SCALER5_DISPCTRL_SLVEIRQ | + SCALER5_DISPCTRL_DSPEIEOF(0) | + SCALER5_DISPCTRL_DSPEIEOF(1) | + SCALER5_DISPCTRL_DSPEIEOF(2) | + SCALER5_DISPCTRL_DSPEIEOLN(0) | + SCALER5_DISPCTRL_DSPEIEOLN(1) | + SCALER5_DISPCTRL_DSPEIEOLN(2) | + SCALER5_DISPCTRL_DSPEISLUR(0) | + SCALER5_DISPCTRL_DSPEISLUR(1) | + SCALER5_DISPCTRL_DSPEISLUR(2) | + SCALER_DISPCTRL_SCLEIRQ); +
/* Set AXI panic mode. * VC4 panics when < 2 lines in FIFO. diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h index 95deacdc31e77..1256f0877ff66 100644 --- a/drivers/gpu/drm/vc4/vc4_regs.h +++ b/drivers/gpu/drm/vc4/vc4_regs.h @@ -234,15 +234,21 @@ * always enabled. */ # define SCALER_DISPCTRL_DSPEISLUR(x) BIT(13 + (x)) +# define SCALER5_DISPCTRL_DSPEISLUR(x) BIT(9 + ((x) * 4)) /* Enables Display 0 end-of-line-N contribution to * SCALER_DISPSTAT_IRQDISP0 */ # define SCALER_DISPCTRL_DSPEIEOLN(x) BIT(8 + ((x) * 2)) +# define SCALER5_DISPCTRL_DSPEIEOLN(x) BIT(8 + ((x) * 4)) /* Enables Display 0 EOF contribution to SCALER_DISPSTAT_IRQDISP0 */ # define SCALER_DISPCTRL_DSPEIEOF(x) BIT(7 + ((x) * 2)) +# define SCALER5_DISPCTRL_DSPEIEOF(x) BIT(7 + ((x) * 4))
-# define SCALER_DISPCTRL_SLVRDEIRQ BIT(6) -# define SCALER_DISPCTRL_SLVWREIRQ BIT(5) +# define SCALER5_DISPCTRL_DSPEIVST(x) BIT(6 + ((x) * 4)) + +# define SCALER_DISPCTRL_SLVRDEIRQ BIT(6) /* HVS4 only */ +# define SCALER_DISPCTRL_SLVWREIRQ BIT(5) /* HVS4 only */ +# define SCALER5_DISPCTRL_SLVEIRQ BIT(5) # define SCALER_DISPCTRL_DMAEIRQ BIT(4) /* Enables interrupt generation on the enabled EOF/EOLN/EISLUR * bits and short frames..
From: Dave Stevenson dave.stevenson@raspberrypi.com
[ Upstream commit 902973dc1a049c0d7bf0c222b8f2b3876f01b4a2 ]
Same as the xRGB8888 formats, HVS5 has managed to swap the colour channels for the xRGB1555 formats as well. Add the relevant config for pixel_order_hvs5.
Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") Signed-off-by: Dave Stevenson dave.stevenson@raspberrypi.com Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-6-1f8e0770798b@cerno... Signed-off-by: Maxime Ripard maxime@cerno.tech Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_plane.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c index bd5acc4a86876..eb08020154f30 100644 --- a/drivers/gpu/drm/vc4/vc4_plane.c +++ b/drivers/gpu/drm/vc4/vc4_plane.c @@ -75,11 +75,13 @@ static const struct hvs_format { .drm = DRM_FORMAT_ARGB1555, .hvs = HVS_PIXEL_FORMAT_RGBA5551, .pixel_order = HVS_PIXEL_ORDER_ABGR, + .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB, }, { .drm = DRM_FORMAT_XRGB1555, .hvs = HVS_PIXEL_FORMAT_RGBA5551, .pixel_order = HVS_PIXEL_ORDER_ABGR, + .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB, }, { .drm = DRM_FORMAT_RGB888,
From: Dave Stevenson dave.stevenson@raspberrypi.com
[ Upstream commit 771d6539f27bd55f43d8a95d53a7eeaaffa2681c ]
The back porch timings were correct, only the sync offset was wrong. Correct timing is now reported for 1080i and 576i, but the h offset is incorrect for 480i for non-obvious reasons.
Fixes: fb10dc451c0f ("drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes") Signed-off-by: Dave Stevenson dave.stevenson@raspberrypi.com Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-14-1f8e0770798b@cern... Signed-off-by: Maxime Ripard maxime@cerno.tech Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c index 21338e6a95056..3f3f94e7b8339 100644 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -1311,11 +1311,12 @@ static void vc5_hdmi_set_timings(struct vc4_hdmi *vc4_hdmi, VC4_SET_FIELD(mode->crtc_vdisplay, VC5_HDMI_VERTA_VAL)); u32 vertb = (VC4_SET_FIELD(mode->htotal >> (2 - pixel_rep), VC5_HDMI_VERTB_VSPO) | - VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end, + VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end + + interlaced, VC4_HDMI_VERTB_VBP)); u32 vertb_even = (VC4_SET_FIELD(0, VC5_HDMI_VERTB_VSPO) | VC4_SET_FIELD(mode->crtc_vtotal - - mode->crtc_vsync_end - interlaced, + mode->crtc_vsync_end, VC4_HDMI_VERTB_VBP)); unsigned long flags; unsigned char gcp;
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit c79bb6b92defdcb834ceeeed9c1cf591beb1b71a ]
If worker creation fails, nullify the event_thread->worker, so that msm_drm_uninit() doesn't try accessing invalid memory location. While we are at it, remove duplicate assignment to the ret variable.
Fixes: 1041dee2178f ("drm/msm: use kthread_create_worker instead of kthread_run") Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Patchwork: https://patchwork.freedesktop.org/patch/490106/ Link: https://lore.kernel.org/r/20220617233328.1143665-2-dmitry.baryshkov@linaro.o... Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/msm_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c index 45e81eb148a8d..ee2f60b6f09b3 100644 --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -491,7 +491,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) if (IS_ERR(priv->event_thread[i].worker)) { ret = PTR_ERR(priv->event_thread[i].worker); DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n"); - ret = PTR_ERR(priv->event_thread[i].worker); + priv->event_thread[i].worker = NULL; goto err_msm_uninit; }
From: Abel Vesa abel.vesa@linaro.org
[ Upstream commit 9cce08cadc6ce8670280d0a042cf0b6d2987d9f9 ]
The actual name is R133NW4K-R0.
Fixes: 0f9fa5f58c78 ("drm/panel-edp: add IVO M133NW4J-R3 panel entry") Signed-off-by: Abel Vesa abel.vesa@linaro.org Reviewed-by: Johan Hovold johan+linaro@kernel.org Tested-by: Steev Klimaszewski steev@kali.org Reviewed-by: Douglas Anderson dianders@chromium.org Signed-off-by: Douglas Anderson dianders@chromium.org Link: https://patchwork.freedesktop.org/patch/msgid/20221231142721.338643-1-abel.v... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/panel/panel-edp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c index 5cb8dc2ebe184..ef70928c3ccbc 100644 --- a/drivers/gpu/drm/panel/panel-edp.c +++ b/drivers/gpu/drm/panel/panel-edp.c @@ -1891,7 +1891,7 @@ static const struct edp_panel_entry edp_panels[] = { EDP_PANEL_ENTRY('C', 'M', 'N', 0x1247, &delay_200_500_e80_d50, "N120ACA-EA1"),
EDP_PANEL_ENTRY('I', 'V', 'O', 0x057d, &delay_200_500_e200, "R140NWF5 RH"), - EDP_PANEL_ENTRY('I', 'V', 'O', 0x854b, &delay_200_500_p2e100, "M133NW4J-R3"), + EDP_PANEL_ENTRY('I', 'V', 'O', 0x854b, &delay_200_500_p2e100, "R133NW4K-R0"),
EDP_PANEL_ENTRY('K', 'D', 'B', 0x0624, &kingdisplay_kd116n21_30nv_a010.delay, "116N21-30NV-A010"), EDP_PANEL_ENTRY('K', 'D', 'B', 0x1120, &delay_200_500_e80_d50, "116N29-30NK-C007"),
From: Quinn Tran qutran@marvell.com
[ Upstream commit 41e5afe51f75f2858f5563145348f6c26d307b8f ]
In large environment, it is possible to experience command timeout and escalation of path recovery. Currently the driver does not track the number of exchanges/commands sent to FW. If there is a delay for commands at the head of the queue, then this will create back pressure for commands at the back of the queue.
Check for exchange availability before command submission.
Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking") Signed-off-by: Quinn Tran qutran@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Reviewed-by: Himanshu Madhani himanshu.madhani@oracle.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/scsi/qla2xxx/qla_def.h | 6 +++- drivers/scsi/qla2xxx/qla_edif.c | 7 +++-- drivers/scsi/qla2xxx/qla_init.c | 13 ++++++++ drivers/scsi/qla2xxx/qla_inline.h | 52 +++++++++++++++++++++---------- drivers/scsi/qla2xxx/qla_iocb.c | 28 ++++++++++------- drivers/scsi/qla2xxx/qla_isr.c | 3 +- drivers/scsi/qla2xxx/qla_nvme.c | 15 ++++++++- 7 files changed, 88 insertions(+), 36 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h index a26a373be9da3..cd4eb11b07079 100644 --- a/drivers/scsi/qla2xxx/qla_def.h +++ b/drivers/scsi/qla2xxx/qla_def.h @@ -660,7 +660,7 @@ enum {
struct iocb_resource { u8 res_type; - u8 pad; + u8 exch_cnt; u16 iocb_cnt; };
@@ -3721,6 +3721,10 @@ struct qla_fw_resources { u16 iocbs_limit; u16 iocbs_qp_limit; u16 iocbs_used; + u16 exch_total; + u16 exch_limit; + u16 exch_used; + u16 pad; };
#define QLA_IOCB_PCT_LIMIT 95 diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c index e4240aae5f9e3..53186a1459629 100644 --- a/drivers/scsi/qla2xxx/qla_edif.c +++ b/drivers/scsi/qla2xxx/qla_edif.c @@ -2989,9 +2989,10 @@ qla28xx_start_scsi_edif(srb_t *sp) tot_dsds = nseg; req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
- sp->iores.res_type = RESOURCE_INI; + sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; + sp->iores.exch_cnt = 1; sp->iores.iocb_cnt = req_cnt; - if (qla_get_iocbs(sp->qpair, &sp->iores)) + if (qla_get_fw_resources(sp->qpair, &sp->iores)) goto queuing_error;
if (req->cnt < (req_cnt + 2)) { @@ -3185,7 +3186,7 @@ qla28xx_start_scsi_edif(srb_t *sp) mempool_free(sp->u.scmd.ct6_ctx, ha->ctx_mempool); sp->u.scmd.ct6_ctx = NULL; } - qla_put_iocbs(sp->qpair, &sp->iores); + qla_put_fw_resources(sp->qpair, &sp->iores); spin_unlock_irqrestore(lock, flags);
return QLA_FUNCTION_FAILED; diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c index 8d9ecabb1aac1..fd27fb5114796 100644 --- a/drivers/scsi/qla2xxx/qla_init.c +++ b/drivers/scsi/qla2xxx/qla_init.c @@ -128,12 +128,14 @@ static void qla24xx_abort_iocb_timeout(void *data) sp->cmd_sp)) { qpair->req->outstanding_cmds[handle] = NULL; cmdsp_found = 1; + qla_put_fw_resources(qpair, &sp->cmd_sp->iores); }
/* removing the abort */ if (qpair->req->outstanding_cmds[handle] == sp) { qpair->req->outstanding_cmds[handle] = NULL; sp_found = 1; + qla_put_fw_resources(qpair, &sp->iores); break; } } @@ -2000,6 +2002,7 @@ qla2x00_tmf_iocb_timeout(void *data) for (h = 1; h < sp->qpair->req->num_outstanding_cmds; h++) { if (sp->qpair->req->outstanding_cmds[h] == sp) { sp->qpair->req->outstanding_cmds[h] = NULL; + qla_put_fw_resources(sp->qpair, &sp->iores); break; } } @@ -3943,6 +3946,12 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha) ha->base_qpair->fwres.iocbs_limit = limit; ha->base_qpair->fwres.iocbs_qp_limit = limit / num_qps; ha->base_qpair->fwres.iocbs_used = 0; + + ha->base_qpair->fwres.exch_total = ha->orig_fw_xcb_count; + ha->base_qpair->fwres.exch_limit = (ha->orig_fw_xcb_count * + QLA_IOCB_PCT_LIMIT) / 100; + ha->base_qpair->fwres.exch_used = 0; + for (i = 0; i < ha->max_qpairs; i++) { if (ha->queue_pair_map[i]) { ha->queue_pair_map[i]->fwres.iocbs_total = @@ -3951,6 +3960,10 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha) ha->queue_pair_map[i]->fwres.iocbs_qp_limit = limit / num_qps; ha->queue_pair_map[i]->fwres.iocbs_used = 0; + ha->queue_pair_map[i]->fwres.exch_total = ha->orig_fw_xcb_count; + ha->queue_pair_map[i]->fwres.exch_limit = + (ha->orig_fw_xcb_count * QLA_IOCB_PCT_LIMIT) / 100; + ha->queue_pair_map[i]->fwres.exch_used = 0; } } } diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h index 5185dc5daf80d..2d5a275d8b000 100644 --- a/drivers/scsi/qla2xxx/qla_inline.h +++ b/drivers/scsi/qla2xxx/qla_inline.h @@ -380,13 +380,16 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha)
enum { RESOURCE_NONE, - RESOURCE_INI, + RESOURCE_IOCB = BIT_0, + RESOURCE_EXCH = BIT_1, /* exchange */ + RESOURCE_FORCE = BIT_2, };
static inline int -qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) +qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) { u16 iocbs_used, i; + u16 exch_used; struct qla_hw_data *ha = qp->vha->hw;
if (!ql2xenforce_iocb_limit) { @@ -394,10 +397,7 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) return 0; }
- if ((iores->iocb_cnt + qp->fwres.iocbs_used) < qp->fwres.iocbs_qp_limit) { - qp->fwres.iocbs_used += iores->iocb_cnt; - return 0; - } else { + if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) { /* no need to acquire qpair lock. It's just rough calculation */ iocbs_used = ha->base_qpair->fwres.iocbs_used; for (i = 0; i < ha->max_qpairs; i++) { @@ -405,30 +405,48 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used; }
- if ((iores->iocb_cnt + iocbs_used) < qp->fwres.iocbs_limit) { - qp->fwres.iocbs_used += iores->iocb_cnt; - return 0; - } else { + if ((iores->iocb_cnt + iocbs_used) >= qp->fwres.iocbs_limit) { + iores->res_type = RESOURCE_NONE; + return -ENOSPC; + } + } + + if (iores->res_type & RESOURCE_EXCH) { + exch_used = ha->base_qpair->fwres.exch_used; + for (i = 0; i < ha->max_qpairs; i++) { + if (ha->queue_pair_map[i]) + exch_used += ha->queue_pair_map[i]->fwres.exch_used; + } + + if ((exch_used + iores->exch_cnt) >= qp->fwres.exch_limit) { iores->res_type = RESOURCE_NONE; return -ENOSPC; } } + qp->fwres.iocbs_used += iores->iocb_cnt; + qp->fwres.exch_used += iores->exch_cnt; + return 0; }
static inline void -qla_put_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) +qla_put_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) { - switch (iores->res_type) { - case RESOURCE_NONE: - break; - default: + if (iores->res_type & RESOURCE_IOCB) { if (qp->fwres.iocbs_used >= iores->iocb_cnt) { qp->fwres.iocbs_used -= iores->iocb_cnt; } else { - // should not happen + /* should not happen */ qp->fwres.iocbs_used = 0; } - break; + } + + if (iores->res_type & RESOURCE_EXCH) { + if (qp->fwres.exch_used >= iores->exch_cnt) { + qp->fwres.exch_used -= iores->exch_cnt; + } else { + /* should not happen */ + qp->fwres.exch_used = 0; + } } iores->res_type = RESOURCE_NONE; } diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c index 42ce4e1fe7441..399ec8da2d73c 100644 --- a/drivers/scsi/qla2xxx/qla_iocb.c +++ b/drivers/scsi/qla2xxx/qla_iocb.c @@ -1589,9 +1589,10 @@ qla24xx_start_scsi(srb_t *sp) tot_dsds = nseg; req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
- sp->iores.res_type = RESOURCE_INI; + sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; + sp->iores.exch_cnt = 1; sp->iores.iocb_cnt = req_cnt; - if (qla_get_iocbs(sp->qpair, &sp->iores)) + if (qla_get_fw_resources(sp->qpair, &sp->iores)) goto queuing_error;
if (req->cnt < (req_cnt + 2)) { @@ -1678,7 +1679,7 @@ qla24xx_start_scsi(srb_t *sp) if (tot_dsds) scsi_dma_unmap(cmd);
- qla_put_iocbs(sp->qpair, &sp->iores); + qla_put_fw_resources(sp->qpair, &sp->iores); spin_unlock_irqrestore(&ha->hardware_lock, flags);
return QLA_FUNCTION_FAILED; @@ -1793,9 +1794,10 @@ qla24xx_dif_start_scsi(srb_t *sp) tot_prot_dsds = nseg; tot_dsds += nseg;
- sp->iores.res_type = RESOURCE_INI; + sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; + sp->iores.exch_cnt = 1; sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds); - if (qla_get_iocbs(sp->qpair, &sp->iores)) + if (qla_get_fw_resources(sp->qpair, &sp->iores)) goto queuing_error;
if (req->cnt < (req_cnt + 2)) { @@ -1883,7 +1885,7 @@ qla24xx_dif_start_scsi(srb_t *sp) } /* Cleanup will be performed by the caller (queuecommand) */
- qla_put_iocbs(sp->qpair, &sp->iores); + qla_put_fw_resources(sp->qpair, &sp->iores); spin_unlock_irqrestore(&ha->hardware_lock, flags);
return QLA_FUNCTION_FAILED; @@ -1952,9 +1954,10 @@ qla2xxx_start_scsi_mq(srb_t *sp) tot_dsds = nseg; req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
- sp->iores.res_type = RESOURCE_INI; + sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; + sp->iores.exch_cnt = 1; sp->iores.iocb_cnt = req_cnt; - if (qla_get_iocbs(sp->qpair, &sp->iores)) + if (qla_get_fw_resources(sp->qpair, &sp->iores)) goto queuing_error;
if (req->cnt < (req_cnt + 2)) { @@ -2041,7 +2044,7 @@ qla2xxx_start_scsi_mq(srb_t *sp) if (tot_dsds) scsi_dma_unmap(cmd);
- qla_put_iocbs(sp->qpair, &sp->iores); + qla_put_fw_resources(sp->qpair, &sp->iores); spin_unlock_irqrestore(&qpair->qp_lock, flags);
return QLA_FUNCTION_FAILED; @@ -2171,9 +2174,10 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp) tot_prot_dsds = nseg; tot_dsds += nseg;
- sp->iores.res_type = RESOURCE_INI; + sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; + sp->iores.exch_cnt = 1; sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds); - if (qla_get_iocbs(sp->qpair, &sp->iores)) + if (qla_get_fw_resources(sp->qpair, &sp->iores)) goto queuing_error;
if (req->cnt < (req_cnt + 2)) { @@ -2260,7 +2264,7 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp) } /* Cleanup will be performed by the caller (queuecommand) */
- qla_put_iocbs(sp->qpair, &sp->iores); + qla_put_fw_resources(sp->qpair, &sp->iores); spin_unlock_irqrestore(&qpair->qp_lock, flags);
return QLA_FUNCTION_FAILED; diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c index e19fde304e5c6..42d3d2de3d31f 100644 --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -3197,7 +3197,7 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) } return; } - qla_put_iocbs(sp->qpair, &sp->iores); + qla_put_fw_resources(sp->qpair, &sp->iores);
if (sp->cmd_type != TYPE_SRB) { req->outstanding_cmds[handle] = NULL; @@ -3618,7 +3618,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt) default: sp = qla2x00_get_sp_from_handle(vha, func, req, pkt); if (sp) { - qla_put_iocbs(sp->qpair, &sp->iores); sp->done(sp, res); return 0; } diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c index 02fdeb0d31ec4..582d88dd59abe 100644 --- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -445,13 +445,24 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp) goto queuing_error; } req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); + + sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; + sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = req_cnt; + if (qla_get_fw_resources(sp->qpair, &sp->iores)) { + rval = -EBUSY; + goto queuing_error; + } + if (req->cnt < (req_cnt + 2)) { if (IS_SHADOW_REG_CAPABLE(ha)) { cnt = *req->out_ptr; } else { cnt = rd_reg_dword_relaxed(req->req_q_out); - if (qla2x00_check_reg16_for_disconnect(vha, cnt)) + if (qla2x00_check_reg16_for_disconnect(vha, cnt)) { + rval = -EBUSY; goto queuing_error; + } }
if (req->ring_index < cnt) @@ -600,6 +611,8 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp) qla24xx_process_response_queue(vha, rsp);
queuing_error: + if (rval) + qla_put_fw_resources(sp->qpair, &sp->iores); spin_unlock_irqrestore(&qpair->qp_lock, flags);
return rval;
From: Quinn Tran qutran@marvell.com
[ Upstream commit 5f63a163ed2f12c34dd4ae9b2757962ec7bb86e5 ]
Add resource checking for management (non-I/O) commands.
Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking") Signed-off-by: Quinn Tran qutran@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/scsi/qla2xxx/qla_dfs.c | 10 ++++- drivers/scsi/qla2xxx/qla_inline.h | 5 ++- drivers/scsi/qla2xxx/qla_iocb.c | 67 +++++++++++++++++++++++++++++++ drivers/scsi/qla2xxx/qla_isr.c | 1 + 4 files changed, 80 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c index 777808af56347..1925cc6897b68 100644 --- a/drivers/scsi/qla2xxx/qla_dfs.c +++ b/drivers/scsi/qla2xxx/qla_dfs.c @@ -235,7 +235,7 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused) uint16_t mb[MAX_IOCB_MB_REG]; int rc; struct qla_hw_data *ha = vha->hw; - u16 iocbs_used, i; + u16 iocbs_used, i, exch_used;
rc = qla24xx_res_count_wait(vha, mb, SIZEOF_IOCB_MB_REG); if (rc != QLA_SUCCESS) { @@ -263,13 +263,19 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused) if (ql2xenforce_iocb_limit) { /* lock is not require. It's an estimate. */ iocbs_used = ha->base_qpair->fwres.iocbs_used; + exch_used = ha->base_qpair->fwres.exch_used; for (i = 0; i < ha->max_qpairs; i++) { - if (ha->queue_pair_map[i]) + if (ha->queue_pair_map[i]) { iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used; + exch_used += ha->queue_pair_map[i]->fwres.exch_used; + } }
seq_printf(s, "Driver: estimate iocb used [%d] high water limit [%d]\n", iocbs_used, ha->base_qpair->fwres.iocbs_limit); + + seq_printf(s, "estimate exchange used[%d] high water limit [%d] n", + exch_used, ha->base_qpair->fwres.exch_limit); }
return 0; diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h index 2d5a275d8b000..b0ee307b5d4b9 100644 --- a/drivers/scsi/qla2xxx/qla_inline.h +++ b/drivers/scsi/qla2xxx/qla_inline.h @@ -380,7 +380,7 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha)
enum { RESOURCE_NONE, - RESOURCE_IOCB = BIT_0, + RESOURCE_IOCB = BIT_0, RESOURCE_EXCH = BIT_1, /* exchange */ RESOURCE_FORCE = BIT_2, }; @@ -396,6 +396,8 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) iores->res_type = RESOURCE_NONE; return 0; } + if (iores->res_type & RESOURCE_FORCE) + goto force;
if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) { /* no need to acquire qpair lock. It's just rough calculation */ @@ -423,6 +425,7 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) return -ENOSPC; } } +force: qp->fwres.iocbs_used += iores->iocb_cnt; qp->fwres.exch_used += iores->exch_cnt; return 0; diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c index 399ec8da2d73c..4f48f098ea5a6 100644 --- a/drivers/scsi/qla2xxx/qla_iocb.c +++ b/drivers/scsi/qla2xxx/qla_iocb.c @@ -3817,6 +3817,65 @@ qla24xx_prlo_iocb(srb_t *sp, struct logio_entry_24xx *logio) logio->vp_index = sp->fcport->vha->vp_idx; }
+int qla_get_iocbs_resource(struct srb *sp) +{ + bool get_exch; + bool push_it_through = false; + + if (!ql2xenforce_iocb_limit) { + sp->iores.res_type = RESOURCE_NONE; + return 0; + } + sp->iores.res_type = RESOURCE_NONE; + + switch (sp->type) { + case SRB_TM_CMD: + case SRB_PRLI_CMD: + case SRB_ADISC_CMD: + push_it_through = true; + fallthrough; + case SRB_LOGIN_CMD: + case SRB_ELS_CMD_RPT: + case SRB_ELS_CMD_HST: + case SRB_ELS_CMD_HST_NOLOGIN: + case SRB_CT_CMD: + case SRB_NVME_LS: + case SRB_ELS_DCMD: + get_exch = true; + break; + + case SRB_FXIOCB_DCMD: + case SRB_FXIOCB_BCMD: + sp->iores.res_type = RESOURCE_NONE; + return 0; + + case SRB_SA_UPDATE: + case SRB_SA_REPLACE: + case SRB_MB_IOCB: + case SRB_ABT_CMD: + case SRB_NACK_PLOGI: + case SRB_NACK_PRLI: + case SRB_NACK_LOGO: + case SRB_LOGOUT_CMD: + case SRB_CTRL_VP: + push_it_through = true; + fallthrough; + default: + get_exch = false; + } + + sp->iores.res_type |= RESOURCE_IOCB; + sp->iores.iocb_cnt = 1; + if (get_exch) { + sp->iores.res_type |= RESOURCE_EXCH; + sp->iores.exch_cnt = 1; + } + if (push_it_through) + sp->iores.res_type |= RESOURCE_FORCE; + + return qla_get_fw_resources(sp->qpair, &sp->iores); +} + int qla2x00_start_sp(srb_t *sp) { @@ -3831,6 +3890,12 @@ qla2x00_start_sp(srb_t *sp) return -EIO;
spin_lock_irqsave(qp->qp_lock_ptr, flags); + rval = qla_get_iocbs_resource(sp); + if (rval) { + spin_unlock_irqrestore(qp->qp_lock_ptr, flags); + return -EAGAIN; + } + pkt = __qla2x00_alloc_iocbs(sp->qpair, sp); if (!pkt) { rval = EAGAIN; @@ -3931,6 +3996,8 @@ qla2x00_start_sp(srb_t *sp) wmb(); qla2x00_start_iocbs(vha, qp->req); done: + if (rval) + qla_put_fw_resources(sp->qpair, &sp->iores); spin_unlock_irqrestore(qp->qp_lock_ptr, flags); return rval; } diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c index 42d3d2de3d31f..759bea69de120 100644 --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -3112,6 +3112,7 @@ qla25xx_process_bidir_status_iocb(scsi_qla_host_t *vha, void *pkt, } bsg_reply->reply_payload_rcv_len = 0;
+ qla_put_fw_resources(sp->qpair, &sp->iores); done: /* Return the vendor specific reply to API */ bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = rval;
From: Quinn Tran qutran@marvell.com
[ Upstream commit 2f5fab1b6c3a8efc93ba52c28539c45a8d0142ad ]
clang warning:
drivers/scsi/qla2xxx/qla_edif_bsg.h:93:12: warning: field remote_pid within 'struct app_pinfo_req' is less aligned than 'port_id_t' and is usually due to 'struct app_pinfo_req' being packed, which can lead to unaligned accesses [-Wunaligned-access] port_id_t remote_pid; ^ 2 warnings generated.
Remove u32 field in remote_pid to silence warning.
Reported-by: kernel test robot lkp@intel.com Fixes: 7ebb336e45ef ("scsi: qla2xxx: edif: Add start + stop bsgs") Signed-off-by: Quinn Tran qutran@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/scsi/qla2xxx/qla_edif.c | 4 +++- drivers/scsi/qla2xxx/qla_edif_bsg.h | 15 ++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c index 53186a1459629..38d5bda1f2748 100644 --- a/drivers/scsi/qla2xxx/qla_edif.c +++ b/drivers/scsi/qla2xxx/qla_edif.c @@ -925,7 +925,9 @@ qla_edif_app_getfcinfo(scsi_qla_host_t *vha, struct bsg_job *bsg_job) if (!(fcport->flags & FCF_FCSP_DEVICE)) continue;
- tdid = app_req.remote_pid; + tdid.b.domain = app_req.remote_pid.domain; + tdid.b.area = app_req.remote_pid.area; + tdid.b.al_pa = app_req.remote_pid.al_pa;
ql_dbg(ql_dbg_edif, vha, 0x2058, "APP request entry - portid=%06x.\n", tdid.b24); diff --git a/drivers/scsi/qla2xxx/qla_edif_bsg.h b/drivers/scsi/qla2xxx/qla_edif_bsg.h index 0931f4e4e127a..514c265ba86e2 100644 --- a/drivers/scsi/qla2xxx/qla_edif_bsg.h +++ b/drivers/scsi/qla2xxx/qla_edif_bsg.h @@ -89,7 +89,20 @@ struct app_plogi_reply { struct app_pinfo_req { struct app_id app_info; uint8_t num_ports; - port_id_t remote_pid; + struct { +#ifdef __BIG_ENDIAN + uint8_t domain; + uint8_t area; + uint8_t al_pa; +#elif defined(__LITTLE_ENDIAN) + uint8_t al_pa; + uint8_t area; + uint8_t domain; +#else +#error "__BIG_ENDIAN or __LITTLE_ENDIAN must be defined!" +#endif + uint8_t rsvd_1; + } remote_pid; uint8_t version; uint8_t pad[VND_CMD_PAD_SIZE]; uint8_t reserved[VND_CMD_APP_RESERVED_SIZE];
From: Shengjiu Wang shengjiu.wang@nxp.com
[ Upstream commit a23924b7dd7b748fff8e305e1daf590fed2af21b ]
Initialize is_dsp_mode flag in the beginning of function fsl_sai_set_dai_fmt_tr().
When the DAIFMT is DAIFMT_DSP_B the first time, is_dsp_mode is true, then the second time DAIFMT is DAIFMT_I2S, is_dsp_mode still true, which is a wrong state. So need to initialize is_dsp_mode flag every time.
Fixes: a3f7dcc9cc03 ("ASoC: fsl-sai: Add SND_SOC_DAIFMT_DSP_A/B support.") Signed-off-by: Shengjiu Wang shengjiu.wang@nxp.com Reviewed-by: Iuliana Prodan iuliana.prodan@nxp.com Link: https://lore.kernel.org/r/1673852874-32200-1-git-send-email-shengjiu.wang@nx... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/fsl/fsl_sai.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c index 35a52c3a020d1..4967f2daa6d97 100644 --- a/sound/soc/fsl/fsl_sai.c +++ b/sound/soc/fsl/fsl_sai.c @@ -281,6 +281,7 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai, val_cr4 |= FSL_SAI_CR4_MF;
sai->is_pdm_mode = false; + sai->is_dsp_mode = false; /* DAI mode */ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { case SND_SOC_DAIFMT_I2S:
From: Marek Vasut marex@denx.de
[ Upstream commit 01338bb82fed40a6a234c2b36a92367c8671adf0 ]
The current CLRSIPO count is still marginal and does not work with high DSI clock rates in burst mode. Increase it further to allow the DSI link to work at up to 1Gbps lane speed. This returns the counts to defaults as provided by datasheet.
Fixes: ea6490b02240b ("drm/bridge: tc358767: increase CLRSIPO count") Signed-off-by: Marek Vasut marex@denx.de Acked-by: Maxime Ripard maxime@cerno.tech Link: https://patchwork.freedesktop.org/patch/msgid/20221016003556.406441-1-marex@... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/tc358767.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c index 2a58eb271f701..b9b681086fc49 100644 --- a/drivers/gpu/drm/bridge/tc358767.c +++ b/drivers/gpu/drm/bridge/tc358767.c @@ -1264,10 +1264,10 @@ static int tc_dsi_rx_enable(struct tc_data *tc) u32 value; int ret;
- regmap_write(tc->regmap, PPI_D0S_CLRSIPOCOUNT, 5); - regmap_write(tc->regmap, PPI_D1S_CLRSIPOCOUNT, 5); - regmap_write(tc->regmap, PPI_D2S_CLRSIPOCOUNT, 5); - regmap_write(tc->regmap, PPI_D3S_CLRSIPOCOUNT, 5); + regmap_write(tc->regmap, PPI_D0S_CLRSIPOCOUNT, 25); + regmap_write(tc->regmap, PPI_D1S_CLRSIPOCOUNT, 25); + regmap_write(tc->regmap, PPI_D2S_CLRSIPOCOUNT, 25); + regmap_write(tc->regmap, PPI_D3S_CLRSIPOCOUNT, 25); regmap_write(tc->regmap, PPI_D0S_ATMR, 0); regmap_write(tc->regmap, PPI_D1S_ATMR, 0); regmap_write(tc->regmap, PPI_TX_RX_TA, TTA_GET | TTA_SURE);
From: Akhil P Oommen quic_akhilpo@quicinc.com
[ Upstream commit dbeedbcb268d055d8895aceca427f897e12c2b50 ]
Fix the below kernel panic due to null pointer access: [ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 [ 18.513464] Mem abort info: [ 18.516346] ESR = 0x0000000096000005 [ 18.520204] EC = 0x25: DABT (current EL), IL = 32 bits [ 18.525706] SET = 0, FnV = 0 [ 18.528878] EA = 0, S1PTW = 0 [ 18.532117] FSC = 0x05: level 1 translation fault [ 18.537138] Data abort info: [ 18.540110] ISV = 0, ISS = 0x00000005 [ 18.544060] CM = 0, WnR = 0 [ 18.547109] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000112826000 [ 18.553738] [0000000000000048] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 18.562690] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP **Snip** [ 18.696758] Call trace: [ 18.699278] adreno_gpu_cleanup+0x30/0x88 [ 18.703396] a6xx_destroy+0xc0/0x130 [ 18.707066] a6xx_gpu_init+0x308/0x424 [ 18.710921] adreno_bind+0x178/0x288 [ 18.714590] component_bind_all+0xe0/0x214 [ 18.718797] msm_drm_bind+0x1d4/0x614 [ 18.722566] try_to_bring_up_aggregate_device+0x16c/0x1b8 [ 18.728105] __component_add+0xa0/0x158 [ 18.732048] component_add+0x20/0x2c [ 18.735719] adreno_probe+0x40/0xc0 [ 18.739300] platform_probe+0xb4/0xd4 [ 18.743068] really_probe+0xfc/0x284 [ 18.746738] __driver_probe_device+0xc0/0xec [ 18.751129] driver_probe_device+0x48/0x110 [ 18.755421] __device_attach_driver+0xa8/0xd0 [ 18.759900] bus_for_each_drv+0x90/0xdc [ 18.763843] __device_attach+0xfc/0x174 [ 18.767786] device_initial_probe+0x20/0x2c [ 18.772090] bus_probe_device+0x40/0xa0 [ 18.776032] deferred_probe_work_func+0x94/0xd0 [ 18.780686] process_one_work+0x190/0x3d0 [ 18.784805] worker_thread+0x280/0x3d4 [ 18.788659] kthread+0x104/0x1c0 [ 18.791981] ret_from_fork+0x10/0x20 [ 18.795654] Code: f9400408 aa0003f3 aa1f03f4 91142015 (f9402516) [ 18.801913] ---[ end trace 0000000000000000 ]--- [ 18.809039] Kernel panic - not syncing: Oops: Fatal exception
Fixes: 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}") Signed-off-by: Akhil P Oommen quic_akhilpo@quicinc.com Patchwork: https://patchwork.freedesktop.org/patch/515605/ Link: https://lore.kernel.org/r/20221221203925.v2.1.Ib978de92c4bd000b515486aad72e9... Signed-off-by: Rob Clark robdclark@chromium.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c index 3605f095b2de2..8175997663299 100644 --- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c +++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c @@ -1083,13 +1083,13 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu) { struct msm_gpu *gpu = &adreno_gpu->base; - struct msm_drm_private *priv = gpu->dev->dev_private; + struct msm_drm_private *priv = gpu->dev ? gpu->dev->dev_private : NULL; unsigned int i;
for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++) release_firmware(adreno_gpu->fw[i]);
- if (pm_runtime_enabled(&priv->gpu_pdev->dev)) + if (priv && pm_runtime_enabled(&priv->gpu_pdev->dev)) pm_runtime_disable(&priv->gpu_pdev->dev);
msm_gpu_cleanup(&adreno_gpu->base);
From: Alexey V. Vissarionov gremlin@altlinux.org
[ Upstream commit 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 ]
Although the "dma_chan" pointer occupies more or equal space compared to "*dma_chan", the allocation size should use the size of variable itself.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 01ef7dbffb41 ("ALSA: hda - Update CA0132 codec to load DSP firmware binary") Signed-off-by: Alexey V. Vissarionov gremlin@altlinux.org Link: https://lore.kernel.org/r/20230117111522.GA15213@altlinux.org Signed-off-by: Takashi Iwai tiwai@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- sound/pci/hda/patch_ca0132.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c index 0a292bf271f2e..acde4cd58785e 100644 --- a/sound/pci/hda/patch_ca0132.c +++ b/sound/pci/hda/patch_ca0132.c @@ -2455,7 +2455,7 @@ static int dspio_set_uint_param(struct hda_codec *codec, int mod_id, static int dspio_alloc_dma_chan(struct hda_codec *codec, unsigned int *dma_chan) { int status = 0; - unsigned int size = sizeof(dma_chan); + unsigned int size = sizeof(*dma_chan);
codec_dbg(codec, " dspio_alloc_dma_chan() -- begin\n"); status = dspio_scp(codec, MASTERCONTROL, 0x20,
From: Leo Liu leo.liu@amd.com
[ Upstream commit cf22ef78f22ce4df4757472c5dbd33c430c5b659 ]
The problem is that base sched hasn't been assigned yet at this moment, causing something like "ring=0" all the time from trace.
mpv:cs0-3473 [002] ..... 129.047431: amdgpu_cs: ring=0, dw=48, fences=0 mpv:cs0-3473 [002] ..... 129.089125: amdgpu_cs: ring=0, dw=48, fences=0 mpv:cs0-3473 [002] ..... 129.130987: amdgpu_cs: ring=0, dw=48, fences=0 mpv:cs0-3473 [002] ..... 129.172478: amdgpu_cs: ring=0, dw=48, fences=0
Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6") Signed-off-by: Leo Liu leo.liu@amd.com Reviewed-by: Christian König christian.koenig@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h index 677ad2016976d..98d91ebf5c26b 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h @@ -153,10 +153,10 @@ TRACE_EVENT(amdgpu_cs,
TP_fast_assign( __entry->bo_list = p->bo_list; - __entry->ring = to_amdgpu_ring(job->base.sched)->idx; + __entry->ring = to_amdgpu_ring(job->base.entity->rq->sched)->idx; __entry->dw = ib->length_dw; __entry->fences = amdgpu_fence_count_emitted( - to_amdgpu_ring(job->base.sched)); + to_amdgpu_ring(job->base.entity->rq->sched)); ), TP_printk("bo_list=%p, ring=%u, dw=%u, fences=%u", __entry->bo_list, __entry->ring, __entry->dw,
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit d839f0811a31322c087a859c2b181e2383daa7be ]
Add the check for the return value of kmalloc in order to avoid NULL pointer dereference in copy_from_user.
Fixes: 20224d715a88 ("drm/msm/submit: Move copy_from_user ahead of locking bos") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Patchwork: https://patchwork.freedesktop.org/patch/514678/ Link: https://lore.kernel.org/r/20221212091117.43511-1-jiasheng@iscas.ac.cn Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/msm_gem_submit.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index 73a2ca122c570..1c4be193fd23f 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -209,6 +209,10 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit, goto out; } submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL); + if (!submit->cmd[i].relocs) { + ret = -ENOMEM; + goto out; + } ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); if (ret) { ret = -EFAULT;
From: Marijn Suijten marijn.suijten@somainline.org
[ Upstream commit abc40122d9a69f56c04efb5a7485795f5ac799d1 ]
In the event that the topology requests resources that have not been created by the system (because they are typically not represented in dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC blocks, until their allocation/assignment is being sanity-checked in "drm/msm/dpu: Reject topologies for which no DSC blocks are available") remain NULL but will still be returned out of dpu_rm_get_assigned_resources, where the caller expects to get an array containing num_blks valid pointers (but instead gets these NULLs).
To prevent this from happening, where null-pointer dereferences typically result in a hard-to-debug platform lockup, num_blks shouldn't increase past NULL blocks and will print an error and break instead. After all, max_blks represents the static size of the maximum number of blocks whereas the actual amount varies per platform.
^1: which can happen after a git rebase ended up moving additions to _dpu_cfg to a different struct which has the same patch context.
Fixes: bb00a452d6f7 ("drm/msm/dpu: Refactor resource manager") Signed-off-by: Marijn Suijten marijn.suijten@somainline.org Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Patchwork: https://patchwork.freedesktop.org/patch/517636/ Link: https://lore.kernel.org/r/20230109231556.344977-1-marijn.suijten@somainline.... Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c index 73b3442e74679..7ada957adbbb8 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c @@ -660,6 +660,11 @@ int dpu_rm_get_assigned_resources(struct dpu_rm *rm, blks_size, enc_id); break; } + if (!hw_blks[i]) { + DPU_ERROR("Allocated resource %d unavailable to assign to enc %d\n", + type, enc_id); + break; + } blks[num_blks++] = hw_blks[i]; }
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit ae2d329f104b75a0a78dcaded29fe6283289cdf9 ]
On atomic_post_disable the bridge goes to the low power state. However the code disables too much of the chip, so the HPD event is not being detected and delivered to the host. Reduce the power saving in order to get the HPD event.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-2-dmitr... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/lontium-lt9611.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c index 7c0a99173b39f..2714184cc53f4 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9611.c +++ b/drivers/gpu/drm/bridge/lontium-lt9611.c @@ -448,12 +448,11 @@ static void lt9611_sleep_setup(struct lt9611 *lt9611) { 0x8023, 0x01 }, { 0x8157, 0x03 }, /* set addr pin as output */ { 0x8149, 0x0b }, - { 0x8151, 0x30 }, /* disable IRQ */ + { 0x8102, 0x48 }, /* MIPI Rx power down */ { 0x8123, 0x80 }, { 0x8130, 0x00 }, - { 0x8100, 0x01 }, /* bandgap power down */ - { 0x8101, 0x00 }, /* system clk power down */ + { 0x8011, 0x0a }, };
regmap_multi_reg_write(lt9611->regmap,
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit a7790f6bd38f3642b60ae3504a2c749135b89451 ]
The driver will reset the bridge in the atomic_pre_enable(). However this will also drop the HPD interrupt state. Instead of resetting the bridge, properly wake it up. This fixes the HPD interrupt delivery after the disable/enable cycle.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-3-dmitr... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/lontium-lt9611.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c index 2714184cc53f4..58f39b2792179 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9611.c +++ b/drivers/gpu/drm/bridge/lontium-lt9611.c @@ -856,12 +856,18 @@ static enum drm_mode_status lt9611_bridge_mode_valid(struct drm_bridge *bridge, static void lt9611_bridge_pre_enable(struct drm_bridge *bridge) { struct lt9611 *lt9611 = bridge_to_lt9611(bridge); + static const struct reg_sequence reg_cfg[] = { + { 0x8102, 0x12 }, + { 0x8123, 0x40 }, + { 0x8130, 0xea }, + { 0x8011, 0xfa }, + };
if (!lt9611->sleep) return;
- lt9611_reset(lt9611); - regmap_write(lt9611->regmap, 0x80ee, 0x01); + regmap_multi_reg_write(lt9611->regmap, + reg_cfg, ARRAY_SIZE(reg_cfg));
lt9611->sleep = false; }
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 0b157efa384ea417304b1da284ee2f603c607fc3 ]
Fix programming of hsync and vsync polarities
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-4-dmitr... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/lontium-lt9611.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c index 58f39b2792179..deb503ca956af 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9611.c +++ b/drivers/gpu/drm/bridge/lontium-lt9611.c @@ -207,7 +207,6 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod
/* stage 2 */ { 0x834a, 0x40 }, - { 0x831d, 0x10 },
/* MK limit */ { 0x832d, 0x38 }, @@ -222,11 +221,19 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod { 0x8325, 0x00 }, { 0x832a, 0x01 }, { 0x834a, 0x10 }, - { 0x831d, 0x10 }, - { 0x8326, 0x37 }, }; + u8 pol = 0x10;
- regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + if (mode->flags & DRM_MODE_FLAG_NHSYNC) + pol |= 0x2; + if (mode->flags & DRM_MODE_FLAG_NVSYNC) + pol |= 0x1; + regmap_write(lt9611->regmap, 0x831d, pol); + + if (mode->hdisplay == 3840) + regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2)); + else + regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
switch (mode->hdisplay) { case 640: @@ -236,7 +243,7 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod regmap_write(lt9611->regmap, 0x8326, 0x37); break; case 3840: - regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2)); + regmap_write(lt9611->regmap, 0x8326, 0x37); break; }
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit ad188aa47edaa033a270e1a3efae43836ff47569 ]
Program the upper part of the hfront_porch into the proper register.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-5-dmitr... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/lontium-lt9611.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c index deb503ca956af..f377052a45a44 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9611.c +++ b/drivers/gpu/drm/bridge/lontium-lt9611.c @@ -187,7 +187,8 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611,
regmap_write(lt9611->regmap, 0x8319, (u8)(hfront_porch % 256));
- regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256)); + regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256) | + ((hfront_porch / 256) << 4)); regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256)); }
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 2576eb26494eb0509dd9ceb0cd27771a7a5e3674 ]
Instead of having several fixed values for the pcr register, calculate it before programming. This allows the bridge to support most of the display modes.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-6-dmitr... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/lontium-lt9611.c | 32 +++++++++++-------------- 1 file changed, 14 insertions(+), 18 deletions(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c index f377052a45a44..e2799a0df8f8b 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9611.c +++ b/drivers/gpu/drm/bridge/lontium-lt9611.c @@ -192,8 +192,9 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611, regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256)); }
-static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode) +static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int postdiv) { + unsigned int pcr_m = mode->clock * 5 * postdiv / 27000; const struct reg_sequence reg_cfg[] = { { 0x830b, 0x01 }, { 0x830c, 0x10 }, @@ -236,24 +237,14 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod else regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
- switch (mode->hdisplay) { - case 640: - regmap_write(lt9611->regmap, 0x8326, 0x14); - break; - case 1920: - regmap_write(lt9611->regmap, 0x8326, 0x37); - break; - case 3840: - regmap_write(lt9611->regmap, 0x8326, 0x37); - break; - } + regmap_write(lt9611->regmap, 0x8326, pcr_m);
/* pcr rst */ regmap_write(lt9611->regmap, 0x8011, 0x5a); regmap_write(lt9611->regmap, 0x8011, 0xfa); }
-static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode) +static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int *postdiv) { unsigned int pclk = mode->clock; const struct reg_sequence reg_cfg[] = { @@ -271,12 +262,16 @@ static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode
regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg));
- if (pclk > 150000) + if (pclk > 150000) { regmap_write(lt9611->regmap, 0x812d, 0x88); - else if (pclk > 70000) + *postdiv = 1; + } else if (pclk > 70000) { regmap_write(lt9611->regmap, 0x812d, 0x99); - else + *postdiv = 2; + } else { regmap_write(lt9611->regmap, 0x812d, 0xaa); + *postdiv = 4; + }
/* * first divide pclk by 2 first @@ -895,14 +890,15 @@ static void lt9611_bridge_mode_set(struct drm_bridge *bridge, { struct lt9611 *lt9611 = bridge_to_lt9611(bridge); struct hdmi_avi_infoframe avi_frame; + unsigned int postdiv; int ret;
lt9611_bridge_pre_enable(bridge);
lt9611_mipi_input_digital(lt9611, mode); - lt9611_pll_setup(lt9611, mode); + lt9611_pll_setup(lt9611, mode, &postdiv); lt9611_mipi_video_setup(lt9611, mode); - lt9611_pcr_setup(lt9611, mode); + lt9611_pcr_setup(lt9611, mode, postdiv);
ret = drm_hdmi_avi_infoframe_from_display_mode(&avi_frame, <9611->connector,
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit b0a7f8736789935f62d6df32d441cdf05a5c05d2 ]
Pass a pointer to the OF node while registering lt9611 MIPI device.
Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-7-dmitr... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/bridge/lontium-lt9611.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c index e2799a0df8f8b..3b77238ca4aff 100644 --- a/drivers/gpu/drm/bridge/lontium-lt9611.c +++ b/drivers/gpu/drm/bridge/lontium-lt9611.c @@ -769,7 +769,7 @@ static const struct drm_connector_funcs lt9611_bridge_connector_funcs = { static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611, struct device_node *dsi_node) { - const struct mipi_dsi_device_info info = { "lt9611", 0, NULL }; + const struct mipi_dsi_device_info info = { "lt9611", 0, lt9611->dev->of_node}; struct mipi_dsi_device *dsi; struct mipi_dsi_host *host; struct device *dev = lt9611->dev;
From: Randy Dunlap rdunlap@infradead.org
[ Upstream commit 2bbba115c3c9a647bcb3201b014fcc3728fe75c8 ]
Fix pointer comparison to integer warning from gcc & sparse:
GCC: ../drivers/regulator/tps65219-regulator.c:370:26: warning: ordered comparison of pointer with integer zero [-Wextra] 370 | if (rdev < 0) { | ^
sparse warning: drivers/regulator/tps65219-regulator.c:370:26: sparse: error: incompatible types for operation (<): drivers/regulator/tps65219-regulator.c:370:26: sparse: struct regulator_dev *[assigned] rdev drivers/regulator/tps65219-regulator.c:370:26: sparse: int
Fixes: c12ac5fc3e0a ("regulator: drivers: Add TI TPS65219 PMIC regulators support") Signed-off-by: Randy Dunlap rdunlap@infradead.org Cc: Jerome Neanne jneanne@baylibre.com Cc: Tony Lindgren tony@atomide.com Cc: linux-omap@vger.kernel.org Cc: Liam Girdwood lgirdwood@gmail.com Cc: Mark Brown broonie@kernel.org Link: https://lore.kernel.org/r/20230114185736.2076-1-rdunlap@infradead.org Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/regulator/tps65219-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/regulator/tps65219-regulator.c b/drivers/regulator/tps65219-regulator.c index c484c943e4675..070159cb5f094 100644 --- a/drivers/regulator/tps65219-regulator.c +++ b/drivers/regulator/tps65219-regulator.c @@ -367,7 +367,7 @@ static int tps65219_regulator_probe(struct platform_device *pdev) irq_data[i].type = irq_type;
tps65219_get_rdev_by_name(irq_type->regulator_name, rdevtbl, rdev); - if (rdev < 0) { + if (IS_ERR(rdev)) { dev_err(tps->dev, "Failed to get rdev for %s\n", irq_type->regulator_name); return -EINVAL;
From: Daniel Mentz danielmentz@google.com
[ Upstream commit c9d27c6be518b4ef2966d9564654ef99292ea1b3 ]
The MIPI DCS specification demands that brightness values are sent in big endian byte order. It also states that one parameter (i.e. one byte) shall be sent/received for 8 bit wide values, and two parameters shall be used for values that are between 9 and 16 bits wide.
Add new functions to properly handle 16-bit brightness in big endian, since the two 8- and 16-bit cases are distinct from each other.
[richard: use separate functions instead of switch/case] [richard: split into 16-bit component]
Fixes: 1a9d759331b8 ("drm/dsi: Implement DCS set/get display brightness") Signed-off-by: Daniel Mentz danielmentz@google.com Link: https://android.googlesource.com/kernel/msm/+/754affd62d0ee268c686c53169b1db... [richard: fix 16-bit brightness_get] Signed-off-by: Richard Acayan mailingradian@gmail.com Tested-by: Caleb Connolly caleb@connolly.tech Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Reviewed-by: Sam Ravnborg sam@ravnborg.org Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20230116224909.23884-2-mailing... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_mipi_dsi.c | 52 ++++++++++++++++++++++++++++++++++ include/drm/drm_mipi_dsi.h | 4 +++ 2 files changed, 56 insertions(+)
diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c index 497ef4b6a90a4..4bc15fbd009d8 100644 --- a/drivers/gpu/drm/drm_mipi_dsi.c +++ b/drivers/gpu/drm/drm_mipi_dsi.c @@ -1224,6 +1224,58 @@ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, } EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness);
+/** + * mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value + * of the display + * @dsi: DSI peripheral device + * @brightness: brightness value + * + * Return: 0 on success or a negative error code on failure. + */ +int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi, + u16 brightness) +{ + u8 payload[2] = { brightness >> 8, brightness & 0xff }; + ssize_t err; + + err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_DISPLAY_BRIGHTNESS, + payload, sizeof(payload)); + if (err < 0) + return err; + + return 0; +} +EXPORT_SYMBOL(mipi_dsi_dcs_set_display_brightness_large); + +/** + * mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit + * brightness value of the display + * @dsi: DSI peripheral device + * @brightness: brightness value + * + * Return: 0 on success or a negative error code on failure. + */ +int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, + u16 *brightness) +{ + u8 brightness_be[2]; + ssize_t err; + + err = mipi_dsi_dcs_read(dsi, MIPI_DCS_GET_DISPLAY_BRIGHTNESS, + brightness_be, sizeof(brightness_be)); + if (err <= 0) { + if (err == 0) + err = -ENODATA; + + return err; + } + + *brightness = (brightness_be[0] << 8) | brightness_be[1]; + + return 0; +} +EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness_large); + static int mipi_dsi_drv_probe(struct device *dev) { struct mipi_dsi_driver *drv = to_mipi_dsi_driver(dev->driver); diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h index 20b21b577deaa..9054a5185e1a9 100644 --- a/include/drm/drm_mipi_dsi.h +++ b/include/drm/drm_mipi_dsi.h @@ -296,6 +296,10 @@ int mipi_dsi_dcs_set_display_brightness(struct mipi_dsi_device *dsi, u16 brightness); int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, u16 *brightness); +int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi, + u16 brightness); +int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, + u16 *brightness);
/** * mipi_dsi_dcs_write_seq - transmit a DCS command with payload
From: Jagan Teki jagan@amarulasolutions.com
[ Upstream commit 996e1defca34485dd2bd70b173f069aab5f21a65 ]
HFP/HBP/HSA/EOT_PACKET modes in Exynos DSI host specifies 0 = Enable and 1 = Disable.
The logic for checking these mode flags was correct before the MIPI_DSI*_NO_* mode flag conversion.
This patch is trying to fix this MIPI_DSI*_NO_* mode flags handling Exynos DSI host and update the mode_flags in relevant panel drivers.
Fixes: 0f3b68b66a6d ("drm/dsi: Add _NO_ to MIPI_DSI_* flags disabling features") Reviewed-by: Marek Vasut marex@denx.de Reviewed-by: Nicolas Boichat drinkcat@chromium.org Reported-by: Sébastien Szymanski sebastien.szymanski@armadeus.com Signed-off-by: Jagan Teki jagan@amarulasolutions.com Reviewed-by: Frieder Schrempf frieder.schrempf@kontron.de Signed-off-by: Marek Vasut marex@denx.de Link: https://patchwork.freedesktop.org/patch/msgid/20221212145745.15387-1-jagan@a... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 ++++---- drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c | 4 +++- drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c | 3 ++- drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 -- 4 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c index ec673223d6b7a..b5305b145ddbd 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c +++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c @@ -805,15 +805,15 @@ static int exynos_dsi_init_link(struct exynos_dsi *dsi) reg |= DSIM_AUTO_MODE; if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_HSE) reg |= DSIM_HSE_MODE; - if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP)) + if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP) reg |= DSIM_HFP_MODE; - if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP)) + if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP) reg |= DSIM_HBP_MODE; - if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA)) + if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA) reg |= DSIM_HSA_MODE; }
- if (!(dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET)) + if (dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET) reg |= DSIM_EOT_DISABLE;
switch (dsi->format) { diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c index 5c621b15e84c2..439ef30735128 100644 --- a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c +++ b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c @@ -692,7 +692,9 @@ static int s6e3ha2_probe(struct mipi_dsi_device *dsi)
dsi->lanes = 4; dsi->format = MIPI_DSI_FMT_RGB888; - dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS; + dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS | + MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP | + MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET;
ctx->supplies[0].supply = "vdd3"; ctx->supplies[1].supply = "vci"; diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c index e06fd35de814b..9c3e76171759a 100644 --- a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c +++ b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c @@ -446,7 +446,8 @@ static int s6e63j0x03_probe(struct mipi_dsi_device *dsi)
dsi->lanes = 1; dsi->format = MIPI_DSI_FMT_RGB888; - dsi->mode_flags = MIPI_DSI_MODE_NO_EOT_PACKET; + dsi->mode_flags = MIPI_DSI_MODE_VIDEO_NO_HFP | + MIPI_DSI_MODE_VIDEO_NO_HBP | MIPI_DSI_MODE_VIDEO_NO_HSA;
ctx->supplies[0].supply = "vdd3"; ctx->supplies[1].supply = "vci"; diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c index 54213beafaf5e..ebf4c2d39ea88 100644 --- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c @@ -990,8 +990,6 @@ static int s6e8aa0_probe(struct mipi_dsi_device *dsi) dsi->lanes = 4; dsi->format = MIPI_DSI_FMT_RGB888; dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST - | MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP - | MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET | MIPI_DSI_MODE_VSYNC_FLUSH | MIPI_DSI_MODE_VIDEO_AUTO_VERT;
ret = s6e8aa0_parse_dt(ctx);
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit 1ae654ded7c5a19dc13f57a4fe4434fef879b6f9 ]
v2.5.0 support was originally added for SC7280, but this hw is also present on SM8350, which has one more DSI host. Bump up the dsi count and fill in the register of the secondary host to allow it to probe.
This should not have any adverse effects on SC7280, as the secondary CTRL will only be touched if it's defined, anyway.
Fixes: 65c391b31994 ("drm/msm/dsi: Add DSI support for SC7280") Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Patchwork: https://patchwork.freedesktop.org/patch/519513/ Link: https://lore.kernel.org/r/20230120210101.2146852-1-konrad.dybcio@linaro.org Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c index 7e97c239ed489..e0bd452a9f1e6 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c +++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c @@ -209,8 +209,8 @@ static const struct msm_dsi_config sc7280_dsi_cfg = { .num_regulators = ARRAY_SIZE(sc7280_dsi_regulators), .bus_clk_names = dsi_sc7280_bus_clk_names, .num_bus_clks = ARRAY_SIZE(dsi_sc7280_bus_clk_names), - .io_start = { 0xae94000 }, - .num_dsi = 1, + .io_start = { 0xae94000, 0xae96000 }, + .num_dsi = 2, };
static const char * const dsi_qcm2290_bus_clk_names[] = {
From: Bart Van Assche bvanassche@acm.org
[ Upstream commit 86bd0c4a2a5dc4265884648cb92c681646509692 ]
The Exynos UFS controller only supports scatter/gather list elements that are aligned on a 4 KiB boundary. Fix DMA alignment in case PAGE_SIZE != 4096. Rename UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE into UFSHCD_QUIRK_4KB_DMA_ALIGNMENT.
Cc: Kiwoong Kim kwmad.kim@samsung.com Fixes: 2b2bfc8aa519 ("scsi: ufs: Introduce a quirk to allow only page-aligned sg entries") Signed-off-by: Bart Van Assche bvanassche@acm.org Reviewed-by: Alim Akhtar alim.akhtar@samsung.com Tested-by: Alim Akhtar alim.akhtar@samsung.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/ufs/core/ufshcd.c | 4 ++-- drivers/ufs/host/ufs-exynos.c | 2 +- include/ufs/ufshcd.h | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 3a1c4d31e010d..fd6f421ff4a46 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -5030,8 +5030,8 @@ static int ufshcd_slave_configure(struct scsi_device *sdev) ufshcd_hpb_configure(hba, sdev);
blk_queue_update_dma_pad(q, PRDT_DATA_BYTE_COUNT_PAD - 1); - if (hba->quirks & UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE) - blk_queue_update_dma_alignment(q, PAGE_SIZE - 1); + if (hba->quirks & UFSHCD_QUIRK_4KB_DMA_ALIGNMENT) + blk_queue_update_dma_alignment(q, 4096 - 1); /* * Block runtime-pm until all consumers are added. * Refer ufshcd_setup_links(). diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c index c3628a8645a56..3cdac89a28b81 100644 --- a/drivers/ufs/host/ufs-exynos.c +++ b/drivers/ufs/host/ufs-exynos.c @@ -1673,7 +1673,7 @@ static const struct exynos_ufs_drv_data exynos_ufs_drvs = { UFSHCD_QUIRK_BROKEN_OCS_FATAL_ERROR | UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL | UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING | - UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE, + UFSHCD_QUIRK_4KB_DMA_ALIGNMENT, .opts = EXYNOS_UFS_OPT_HAS_APB_CLK_CTRL | EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL | EXYNOS_UFS_OPT_BROKEN_RX_SEL_IDX | diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h index 727084cd79be4..97a09a14c6349 100644 --- a/include/ufs/ufshcd.h +++ b/include/ufs/ufshcd.h @@ -566,9 +566,9 @@ enum ufshcd_quirks { UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING = 1 << 13,
/* - * This quirk allows only sg entries aligned with page size. + * Align DMA SG entries on a 4 KiB boundary. */ - UFSHCD_QUIRK_ALIGN_SG_WITH_PAGE_SIZE = 1 << 14, + UFSHCD_QUIRK_4KB_DMA_ALIGNMENT = 1 << 14,
/* * This quirk needs to be enabled if the host controller does not
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 255f056181ac69278dcd8778f0be32a21b2d2a6a ]
Add missing DPU_CLK_CTRL_WB2 to sc7180_mdp clocks array.
Fixes: 51e4d60e6ba5 ("drm/msm/dpu: add writeback support for sc7180") Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Tested-by: Jessica Zhang quic_jesszhan@quicinc.com # Trogdor (sc7180) Patchwork: https://patchwork.freedesktop.org/patch/518504/ Link: https://lore.kernel.org/r/20230116103055.780767-1-dmitry.baryshkov@linaro.or... Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c index 2196e205efa5e..83f1dd2c22bd7 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c @@ -459,6 +459,8 @@ static const struct dpu_mdp_cfg sc7180_mdp[] = { .reg_off = 0x2B4, .bit_off = 8}, .clk_ctrls[DPU_CLK_CTRL_CURSOR1] = { .reg_off = 0x2C4, .bit_off = 8}, + .clk_ctrls[DPU_CLK_CTRL_WB2] = { + .reg_off = 0x3B8, .bit_off = 24}, }, };
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit d7fd8634f48d76aa799ed57beb7d87dab91bde80 ]
Using strncpy can result in non-NULL-terminated destination string. Use strscpy instead. This fixes following warning:
drivers/gpu/drm/msm/msm_fence.c: In function ‘msm_fence_context_alloc’: drivers/gpu/drm/msm/msm_fence.c:25:9: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation] 25 | strncpy(fctx->name, name, sizeof(fctx->name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers") Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Patchwork: https://patchwork.freedesktop.org/patch/518787/ Link: https://lore.kernel.org/r/20230118020152.1689213-1-dmitry.baryshkov@linaro.o... Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/msm_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c index a47e5837c528f..56641408ea742 100644 --- a/drivers/gpu/drm/msm/msm_fence.c +++ b/drivers/gpu/drm/msm/msm_fence.c @@ -22,7 +22,7 @@ msm_fence_context_alloc(struct drm_device *dev, volatile uint32_t *fenceptr, return ERR_PTR(-ENOMEM);
fctx->dev = dev; - strncpy(fctx->name, name, sizeof(fctx->name)); + strscpy(fctx->name, name, sizeof(fctx->name)); fctx->context = dma_fence_context_alloc(1); fctx->index = index++; fctx->fenceptr = fenceptr;
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit c96988b7d99327bb08bd9efd29a203b22cd88ace ]
As kzalloc may fail and return NULL pointer, it should be better to check cstate in order to avoid the NULL pointer dereference in __drm_atomic_helper_crtc_reset.
Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Patchwork: https://patchwork.freedesktop.org/patch/514163/ Link: https://lore.kernel.org/r/20221206080517.43786-1-jiasheng@iscas.ac.cn Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c index 13ce321283ff9..22c2787b7b381 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c @@ -968,7 +968,10 @@ static void dpu_crtc_reset(struct drm_crtc *crtc) if (crtc->state) dpu_crtc_destroy_state(crtc, crtc->state);
- __drm_atomic_helper_crtc_reset(crtc, &cstate->base); + if (cstate) + __drm_atomic_helper_crtc_reset(crtc, &cstate->base); + else + __drm_atomic_helper_crtc_reset(crtc, NULL); }
/**
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 ]
As kzalloc may fail and return NULL pointer, it should be better to check pstates in order to avoid the NULL pointer dereference.
Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Patchwork: https://patchwork.freedesktop.org/patch/514160/ Link: https://lore.kernel.org/r/20221206080236.43687-1-jiasheng@iscas.ac.cn Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c index 22c2787b7b381..c9d1c412628e9 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c @@ -1153,6 +1153,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, bool needs_dirtyfb = dpu_crtc_needs_dirtyfb(crtc_state);
pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL); + if (!pstates) + return -ENOMEM;
if (!crtc_state->enable || !crtc_state->active) { DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n",
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 ]
As kzalloc may fail and return NULL pointer, it should be better to check the return value in order to avoid the NULL pointer dereference.
Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Patchwork: https://patchwork.freedesktop.org/patch/514154/ Link: https://lore.kernel.org/r/20221206074819.18134-1-jiasheng@iscas.ac.cn Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c index e86421c69bd1f..86036dd4e1e82 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c @@ -1139,7 +1139,10 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc) if (crtc->state) mdp5_crtc_destroy_state(crtc, crtc->state);
- __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base); + if (mdp5_cstate) + __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base); + else + __drm_atomic_helper_crtc_reset(crtc, NULL); }
static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = {
From: farah kassabri fkassabri@habana.ai
[ Upstream commit 1693fef9e95dbe8ab767d208a02328fff13fbb94 ]
use argument instead of fixed GFP value for allocation in Timestamps buffers alloc function. change data type of size to size_t.
Fixes: 9158bf69e74f ("habanalabs: Timestamps buffers registration") Signed-off-by: farah kassabri fkassabri@habana.ai Reviewed-by: Oded Gabbay ogabbay@kernel.org Signed-off-by: Oded Gabbay ogabbay@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/misc/habanalabs/common/memory.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/habanalabs/common/memory.c b/drivers/misc/habanalabs/common/memory.c index 5e9ae7600d75e..047306e33baad 100644 --- a/drivers/misc/habanalabs/common/memory.c +++ b/drivers/misc/habanalabs/common/memory.c @@ -2089,12 +2089,13 @@ static int hl_ts_mmap(struct hl_mmap_mem_buf *buf, struct vm_area_struct *vma, v static int hl_ts_alloc_buf(struct hl_mmap_mem_buf *buf, gfp_t gfp, void *args) { struct hl_ts_buff *ts_buff = NULL; - u32 size, num_elements; + u32 num_elements; + size_t size; void *p;
num_elements = *(u32 *)args;
- ts_buff = kzalloc(sizeof(*ts_buff), GFP_KERNEL); + ts_buff = kzalloc(sizeof(*ts_buff), gfp); if (!ts_buff) return -ENOMEM;
From: Andy Shevchenko andriy.shevchenko@linux.intel.com
[ Upstream commit 2d578dd27871372f7159dd3206149ec616700d87 ]
Remove wrong of_node_put() in bcm2835_of_gpio_ranges_fallback(), there is no counterpart of_node_get() for it.
Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges") Signed-off-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Reviewed-by: Stefan Wahren stefan.wahren@i2se.com Tested-by: Stefan Wahren stefan.wahren@i2se.com Tested-by: Florian Fainelli f.fainelli@gmail.com Reviewed-by: Florian Fainelli f.fainelli@gmail.com Acked-by: Bartosz Golaszewski bartosz.golaszewski@linaro.org Link: https://lore.kernel.org/r/20230113215352.44272-3-andriy.shevchenko@linux.int... Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 -- 1 file changed, 2 deletions(-)
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c index 7857e612a1008..c7cdccdb4332a 100644 --- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c +++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c @@ -363,8 +363,6 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc, { struct pinctrl_dev *pctldev = of_pinctrl_get(np);
- of_node_put(np); - if (!pctldev) return 0;
From: Guodong Liu Guodong.Liu@mediatek.com
[ Upstream commit a298c70a10c604a6b3df5a0aa56597b705ba0f6b ]
Coverity spotted that pullen and pullup is not initialized to zero in mtk_pctrl_show_one_pin. The uninitialized variable pullen is used in assignment statement "rsel = pullen;" in mtk_pctrl_show_one_pin, and Uninitialized variable pullup is used when calling scnprintf. Fix this coverity by initializing pullen and pullup as zero.
Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") Signed-off-by: Guodong Liu Guodong.Liu@mediatek.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20230118062036.26258-2-Guodong.Liu@mediatek.com Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c index 475f4172d5085..3330f0ce9bd1d 100644 --- a/drivers/pinctrl/mediatek/pinctrl-paris.c +++ b/drivers/pinctrl/mediatek/pinctrl-paris.c @@ -640,7 +640,7 @@ static int mtk_hw_get_value_wrap(struct mtk_pinctrl *hw, unsigned int gpio, int ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, unsigned int gpio, char *buf, unsigned int buf_len) { - int pinmux, pullup, pullen, len = 0, r1 = -1, r0 = -1, rsel = -1; + int pinmux, pullup = 0, pullen = 0, len = 0, r1 = -1, r0 = -1, rsel = -1; const struct mtk_pin_desc *desc; u32 try_all_type = 0;
From: Guodong Liu Guodong.Liu@mediatek.com
[ Upstream commit 2e34f82ba214134ecf590fbe0cdbd87401645a8a ]
Coverity spotted that *buf is not initialized to zero in mtk_pctrl_dbg_show. Using uninitialized variable *buf as argument to %s when calling seq_printf. Fix this coverity by initializing *buf as zero.
Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") Signed-off-by: Guodong Liu Guodong.Liu@mediatek.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20230118062036.26258-3-Guodong.Liu@mediatek.com Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c index 3330f0ce9bd1d..37761a8e7a18f 100644 --- a/drivers/pinctrl/mediatek/pinctrl-paris.c +++ b/drivers/pinctrl/mediatek/pinctrl-paris.c @@ -717,7 +717,7 @@ static void mtk_pctrl_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s, unsigned int gpio) { struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); - char buf[PIN_DBG_BUF_SZ]; + char buf[PIN_DBG_BUF_SZ] = { 0 };
(void)mtk_pctrl_show_one_pin(hw, gpio, buf, PIN_DBG_BUF_SZ);
From: Mikko Perttunen mperttunen@nvidia.com
[ Upstream commit 79aad29c7d2d2cd64790115d3a6ebac28c00a8ec ]
On Tegra186+, the syncpoint ID has 10 bits of space. To allow using more than 256 syncpoints, fix the mask.
Fixes: 9abdd497cd0a ("gpu: host1x: Tegra234 device data and headers") Signed-off-by: Mikko Perttunen mperttunen@nvidia.com Signed-off-by: Thierry Reding treding@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/host1x/hw/hw_host1x06_uclass.h | 2 +- drivers/gpu/host1x/hw/hw_host1x07_uclass.h | 2 +- drivers/gpu/host1x/hw/hw_host1x08_uclass.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h index 5f831438d19bb..50c32de452fb1 100644 --- a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h +++ b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h @@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v) host1x_uclass_incr_syncpt_cond_f(v) static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v) { - return (v & 0xff) << 0; + return (v & 0x3ff) << 0; } #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \ host1x_uclass_incr_syncpt_indx_f(v) diff --git a/drivers/gpu/host1x/hw/hw_host1x07_uclass.h b/drivers/gpu/host1x/hw/hw_host1x07_uclass.h index 8cd2ef087d5d0..887b878f92f79 100644 --- a/drivers/gpu/host1x/hw/hw_host1x07_uclass.h +++ b/drivers/gpu/host1x/hw/hw_host1x07_uclass.h @@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v) host1x_uclass_incr_syncpt_cond_f(v) static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v) { - return (v & 0xff) << 0; + return (v & 0x3ff) << 0; } #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \ host1x_uclass_incr_syncpt_indx_f(v) diff --git a/drivers/gpu/host1x/hw/hw_host1x08_uclass.h b/drivers/gpu/host1x/hw/hw_host1x08_uclass.h index 724cccd71aa1a..4fb1d090edae5 100644 --- a/drivers/gpu/host1x/hw/hw_host1x08_uclass.h +++ b/drivers/gpu/host1x/hw/hw_host1x08_uclass.h @@ -53,7 +53,7 @@ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v) host1x_uclass_incr_syncpt_cond_f(v) static inline u32 host1x_uclass_incr_syncpt_indx_f(u32 v) { - return (v & 0xff) << 0; + return (v & 0x3ff) << 0; } #define HOST1X_UCLASS_INCR_SYNCPT_INDX_F(v) \ host1x_uclass_incr_syncpt_indx_f(v)
From: Mikko Perttunen mperttunen@nvidia.com
[ Upstream commit eb258cc1fd458e584082be987dbc6ec42668c05e ]
The code to write the syncpoint channel assignment register incorrectly skips the write if hypervisor registers are not available.
The register, however, is within the guest aperture so remove the check and assign syncpoints properly even on virtualized systems.
Fixes: c3f52220f276 ("gpu: host1x: Enable Tegra186 syncpoint protection") Signed-off-by: Mikko Perttunen mperttunen@nvidia.com Signed-off-by: Thierry Reding treding@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/host1x/hw/syncpt_hw.c | 3 --- 1 file changed, 3 deletions(-)
diff --git a/drivers/gpu/host1x/hw/syncpt_hw.c b/drivers/gpu/host1x/hw/syncpt_hw.c index dd39d67ccec36..8cf35b2eff3db 100644 --- a/drivers/gpu/host1x/hw/syncpt_hw.c +++ b/drivers/gpu/host1x/hw/syncpt_hw.c @@ -106,9 +106,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp, #if HOST1X_HW >= 6 struct host1x *host = sp->host;
- if (!host->hv_regs) - return; - host1x_sync_writel(host, HOST1X_SYNC_SYNCPT_CH_APP_CH(ch ? ch->id : 0xff), HOST1X_SYNC_SYNCPT_CH_APP(sp->id));
From: Mikko Perttunen mperttunen@nvidia.com
[ Upstream commit 1b5c09de25e8c08655c270a70e5e74e93b6bad1f ]
In the IMM opcode check, don't call is_addr_reg if it's not set.
Fixes: 8cc95f3fd35e ("drm/tegra: Add job firewall") Signed-off-by: Mikko Perttunen mperttunen@nvidia.com Signed-off-by: Thierry Reding treding@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/tegra/firewall.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/tegra/firewall.c b/drivers/gpu/drm/tegra/firewall.c index 1824d2db0e2ce..d53f890fa6893 100644 --- a/drivers/gpu/drm/tegra/firewall.c +++ b/drivers/gpu/drm/tegra/firewall.c @@ -97,6 +97,9 @@ static int fw_check_regs_imm(struct tegra_drm_firewall *fw, u32 offset) { bool is_addr;
+ if (!fw->client->ops->is_addr_reg) + return 0; + is_addr = fw->client->ops->is_addr_reg(fw->client->base.dev, fw->class, offset); if (is_addr)
From: Matt Roper matthew.d.roper@intel.com
[ Upstream commit 41bb543f5598fb44e0e8dbd723f5821be83b466b ]
This patch introduces initial gt workarounds for the MTL platform.
v2: drop redundant/stale comments specifying wa platforms affected (Lucas). v3: drop additional redundant stale comments (MattR)
Bspec: 66622
Signed-off-by: Matt Roper matthew.d.roper@intel.com Signed-off-by: Matt Atwood matthew.s.atwood@intel.com Reviewed-by: Rodrigo Vivi rodrigo.vivi@intel.com Signed-off-by: Radhakrishna Sripada radhakrishna.sripada@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230105234408.277750-1-matthe... Stable-dep-of: 49cbda6386ef ("drm/i915/xehp: GAM registers don't need to be re-applied on engine resets") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 6 +- .../drm/i915/gt/intel_execlists_submission.c | 6 +- drivers/gpu/drm/i915/gt/intel_gt_mcr.c | 11 +- drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 + drivers/gpu/drm/i915/gt/intel_workarounds.c | 115 +++++++++++++----- drivers/gpu/drm/i915/gt/uc/intel_guc.c | 9 +- .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 8 +- drivers/gpu/drm/i915/intel_device_info.c | 6 + 8 files changed, 123 insertions(+), 42 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c index d37931e16fd9b..34b0a9dadce4f 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c @@ -1476,10 +1476,12 @@ static int __intel_engine_stop_cs(struct intel_engine_cs *engine, intel_uncore_write_fw(uncore, mode, _MASKED_BIT_ENABLE(STOP_RING));
/* - * Wa_22011802037 : gen11, gen12, Prior to doing a reset, ensure CS is + * Wa_22011802037: Prior to doing a reset, ensure CS is * stopped, set ring stop bit and prefetch disable bit to halt CS */ - if (IS_GRAPHICS_VER(engine->i915, 11, 12)) + if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) || + (GRAPHICS_VER(engine->i915) >= 11 && + GRAPHICS_VER_FULL(engine->i915) < IP_VER(12, 70))) intel_uncore_write_fw(uncore, RING_MODE_GEN7(engine->mmio_base), _MASKED_BIT_ENABLE(GEN12_GFX_PREFETCH_DISABLE));
diff --git a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c index 21cb5b69d82eb..3c573d41d4046 100644 --- a/drivers/gpu/drm/i915/gt/intel_execlists_submission.c +++ b/drivers/gpu/drm/i915/gt/intel_execlists_submission.c @@ -2989,10 +2989,12 @@ static void execlists_reset_prepare(struct intel_engine_cs *engine) intel_engine_stop_cs(engine);
/* - * Wa_22011802037:gen11/gen12: In addition to stopping the cs, we need + * Wa_22011802037: In addition to stopping the cs, we need * to wait for any pending mi force wakeups */ - if (IS_GRAPHICS_VER(engine->i915, 11, 12)) + if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) || + (GRAPHICS_VER(engine->i915) >= 11 && + GRAPHICS_VER_FULL(engine->i915) < IP_VER(12, 70))) intel_engine_wait_for_pending_mi_fw(engine);
engine->execlists.reset_ccid = active_ccid(engine); diff --git a/drivers/gpu/drm/i915/gt/intel_gt_mcr.c b/drivers/gpu/drm/i915/gt/intel_gt_mcr.c index ea86c1ab5dc56..58ea3325bbdaa 100644 --- a/drivers/gpu/drm/i915/gt/intel_gt_mcr.c +++ b/drivers/gpu/drm/i915/gt/intel_gt_mcr.c @@ -162,8 +162,15 @@ void intel_gt_mcr_init(struct intel_gt *gt) if (MEDIA_VER(i915) >= 13 && gt->type == GT_MEDIA) { gt->steering_table[OADDRM] = xelpmp_oaddrm_steering_table; } else if (GRAPHICS_VER_FULL(i915) >= IP_VER(12, 70)) { - fuse = REG_FIELD_GET(GT_L3_EXC_MASK, - intel_uncore_read(gt->uncore, XEHP_FUSE4)); + /* Wa_14016747170 */ + if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || + IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) + fuse = REG_FIELD_GET(MTL_GT_L3_EXC_MASK, + intel_uncore_read(gt->uncore, + MTL_GT_ACTIVITY_FACTOR)); + else + fuse = REG_FIELD_GET(GT_L3_EXC_MASK, + intel_uncore_read(gt->uncore, XEHP_FUSE4));
/* * Despite the register field being named "exclude mask" the diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h index a5454af2a9cfd..c525fc07a9bcb 100644 --- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h +++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h @@ -413,6 +413,7 @@ #define TBIMR_FAST_CLIP REG_BIT(5)
#define VFLSKPD MCR_REG(0x62a8) +#define VF_PREFETCH_TLB_DIS REG_BIT(5) #define DIS_OVER_FETCH_CACHE REG_BIT(1) #define DIS_MULT_MISS_RD_SQUASH REG_BIT(0)
@@ -1528,6 +1529,9 @@
#define MTL_MEDIA_MC6 _MMIO(0x138048)
+#define MTL_GT_ACTIVITY_FACTOR _MMIO(0x138010) +#define MTL_GT_L3_EXC_MASK REG_GENMASK(5, 3) + #define GEN6_GT_THREAD_STATUS_REG _MMIO(0x13805c) #define GEN6_GT_THREAD_STATUS_CORE_MASK 0x7
diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c index a0740308555d8..09d533f6b962c 100644 --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c @@ -786,6 +786,32 @@ static void dg2_ctx_workarounds_init(struct intel_engine_cs *engine, wa_masked_en(wal, CACHE_MODE_1, MSAA_OPTIMIZATION_REDUC_DISABLE); }
+static void mtl_ctx_workarounds_init(struct intel_engine_cs *engine, + struct i915_wa_list *wal) +{ + struct drm_i915_private *i915 = engine->i915; + + if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || + IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) { + /* Wa_14014947963 */ + wa_masked_field_set(wal, VF_PREEMPTION, + PREEMPTION_VERTEX_COUNT, 0x4000); + + /* Wa_16013271637 */ + wa_mcr_masked_en(wal, XEHP_SLICE_COMMON_ECO_CHICKEN1, + MSC_MSAA_REODER_BUF_BYPASS_DISABLE); + + /* Wa_18019627453 */ + wa_mcr_masked_en(wal, VFLSKPD, VF_PREFETCH_TLB_DIS); + + /* Wa_18018764978 */ + wa_masked_en(wal, PSS_MODE2, SCOREBOARD_STALL_FLUSH_CONTROL); + } + + /* Wa_18019271663 */ + wa_masked_en(wal, CACHE_MODE_1, MSAA_OPTIMIZATION_REDUC_DISABLE); +} + static void fakewa_disable_nestedbb_mode(struct intel_engine_cs *engine, struct i915_wa_list *wal) { @@ -872,7 +898,9 @@ __intel_engine_init_ctx_wa(struct intel_engine_cs *engine, if (engine->class != RENDER_CLASS) goto done;
- if (IS_PONTEVECCHIO(i915)) + if (IS_METEORLAKE(i915)) + mtl_ctx_workarounds_init(engine, wal); + else if (IS_PONTEVECCHIO(i915)) ; /* noop; none at this time */ else if (IS_DG2(i915)) dg2_ctx_workarounds_init(engine, wal); @@ -1635,7 +1663,10 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) static void xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) { - /* FIXME: Actual workarounds will be added in future patch(es) */ + /* Wa_14014830051 */ + if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) || + IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0)) + wa_mcr_write_clr(wal, SARB_CHICKEN1, COMP_CKN_IN);
/* * Unlike older platforms, we no longer setup implicit steering here; @@ -2171,7 +2202,9 @@ void intel_engine_init_whitelist(struct intel_engine_cs *engine)
wa_init_start(w, engine->gt, "whitelist", engine->name);
- if (IS_PONTEVECCHIO(i915)) + if (IS_METEORLAKE(i915)) + ; /* noop; none at this time */ + else if (IS_PONTEVECCHIO(i915)) pvc_whitelist_build(engine); else if (IS_DG2(i915)) dg2_whitelist_build(engine); @@ -2281,6 +2314,34 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) { struct drm_i915_private *i915 = engine->i915;
+ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || + IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0)) { + /* Wa_22014600077 */ + wa_mcr_masked_en(wal, GEN10_CACHE_MODE_SS, + ENABLE_EU_COUNT_FOR_TDL_FLUSH); + } + + if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || + IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) || + IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) || + IS_DG2_G11(i915) || IS_DG2_G12(i915)) { + /* Wa_1509727124 */ + wa_mcr_masked_en(wal, GEN10_SAMPLER_MODE, + SC_DISABLE_POWER_OPTIMIZATION_EBB); + + /* Wa_22013037850 */ + wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW, + DISABLE_128B_EVICTION_COMMAND_UDW); + } + + if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) || + IS_DG2_G11(i915) || IS_DG2_G12(i915) || + IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0)) { + /* Wa_22012856258 */ + wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, + GEN12_DISABLE_READ_SUPPRESSION); + } + if (IS_DG2(i915)) { /* Wa_1509235366:dg2 */ wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS | @@ -2292,13 +2353,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, GEN12_ENABLE_LARGE_GRF_MODE); }
- if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) || - IS_DG2_G11(i915) || IS_DG2_G12(i915)) { - /* Wa_1509727124:dg2 */ - wa_mcr_masked_en(wal, GEN10_SAMPLER_MODE, - SC_DISABLE_POWER_OPTIMIZATION_EBB); - } - if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_A0, STEP_B0) || IS_DG2_GRAPHICS_STEP(i915, G11, STEP_A0, STEP_B0)) { /* Wa_14012419201:dg2 */ @@ -2330,14 +2384,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal)
if (IS_DG2_GRAPHICS_STEP(i915, G10, STEP_B0, STEP_FOREVER) || IS_DG2_G11(i915) || IS_DG2_G12(i915)) { - /* Wa_22013037850:dg2 */ - wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW, - DISABLE_128B_EVICTION_COMMAND_UDW); - - /* Wa_22012856258:dg2 */ - wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, - GEN12_DISABLE_READ_SUPPRESSION); - /* * Wa_22010960976:dg2 * Wa_14013347512:dg2 @@ -2950,6 +2996,27 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
add_render_compute_tuning_settings(i915, wal);
+ if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || + IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) || + IS_PONTEVECCHIO(i915) || + IS_DG2(i915)) { + /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + + /* Wa_22014226127 */ + wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE); + } + + if (IS_MTL_GRAPHICS_STEP(i915, M, STEP_A0, STEP_B0) || + IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) || + IS_DG2(i915)) { + /* Wa_18017747507 */ + wa_masked_en(wal, VFG_PREEMPTION_CHICKEN, POLYGON_TRIFAN_LINELOOP_DISABLE); + } + if (IS_PONTEVECCHIO(i915)) { /* Wa_16016694945 */ wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC); @@ -2991,17 +3058,8 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li /* Wa_14015227452:dg2,pvc */ wa_mcr_masked_en(wal, GEN9_ROW_CHICKEN4, XEHP_DIS_BBL_SYSPIPE);
- /* Wa_22014226127:dg2,pvc */ - wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE); - /* Wa_16015675438:dg2,pvc */ wa_masked_en(wal, FF_SLICE_CS_CHICKEN2, GEN12_PERF_FIX_BALANCING_CFE_DISABLE); - - /* Wa_18018781329:dg2,pvc */ - wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); }
if (IS_DG2(i915)) { @@ -3010,9 +3068,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li * Wa_22015475538:dg2 */ wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0_UDW, DIS_CHAIN_2XSIMD8); - - /* Wa_18017747507:dg2 */ - wa_masked_en(wal, VFG_PREEMPTION_CHICKEN, POLYGON_TRIFAN_LINELOOP_DISABLE); } }
diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc.c index 52aede324788e..ca940a00e84a3 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_guc.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_guc.c @@ -274,8 +274,9 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc) if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0)) flags |= GUC_WA_GAM_CREDITS;
- /* Wa_14014475959:dg2 */ - if (IS_DG2(gt->i915)) + /* Wa_14014475959 */ + if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) || + IS_DG2(gt->i915)) flags |= GUC_WA_HOLD_CCS_SWITCHOUT;
/* @@ -289,7 +290,9 @@ static u32 guc_ctl_wa_flags(struct intel_guc *guc) flags |= GUC_WA_DUAL_QUEUE;
/* Wa_22011802037: graphics version 11/12 */ - if (IS_GRAPHICS_VER(gt->i915, 11, 12)) + if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) || + (GRAPHICS_VER(gt->i915) >= 11 && + GRAPHICS_VER_FULL(gt->i915) < IP_VER(12, 70))) flags |= GUC_WA_PRE_PARSER;
/* Wa_16011777198:dg2 */ diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c index c10977cb06b97..ddf071865adc5 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c @@ -1621,7 +1621,7 @@ static void guc_engine_reset_prepare(struct intel_engine_cs *engine) intel_engine_stop_cs(engine);
/* - * Wa_22011802037:gen11/gen12: In addition to stopping the cs, we need + * Wa_22011802037: In addition to stopping the cs, we need * to wait for any pending mi force wakeups */ intel_engine_wait_for_pending_mi_fw(engine); @@ -4203,8 +4203,10 @@ static void guc_default_vfuncs(struct intel_engine_cs *engine) engine->flags |= I915_ENGINE_HAS_TIMESLICES;
/* Wa_14014475959:dg2 */ - if (IS_DG2(engine->i915) && engine->class == COMPUTE_CLASS) - engine->flags |= I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT; + if (engine->class == COMPUTE_CLASS) + if (IS_MTL_GRAPHICS_STEP(engine->i915, M, STEP_A0, STEP_B0) || + IS_DG2(engine->i915)) + engine->flags |= I915_ENGINE_USES_WA_HOLD_CCS_SWITCHOUT;
/* * TODO: GuC supports timeslicing and semaphores as well, but they're diff --git a/drivers/gpu/drm/i915/intel_device_info.c b/drivers/gpu/drm/i915/intel_device_info.c index 849baf6c3b3c6..05e90d09b2081 100644 --- a/drivers/gpu/drm/i915/intel_device_info.c +++ b/drivers/gpu/drm/i915/intel_device_info.c @@ -343,6 +343,12 @@ static void intel_ipver_early_init(struct drm_i915_private *i915)
ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_GRAPHICS), &runtime->graphics.ip); + /* Wa_22012778468 */ + if (runtime->graphics.ip.ver == 0x0 && + INTEL_INFO(i915)->platform == INTEL_METEORLAKE) { + RUNTIME_INFO(i915)->graphics.ip.ver = 12; + RUNTIME_INFO(i915)->graphics.ip.rel = 70; + } ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_DISPLAY), &runtime->display.ip); ip_ver_read(i915, i915_mmio_reg_offset(GMD_ID_MEDIA),
From: Matt Roper matthew.d.roper@intel.com
[ Upstream commit 49cbda6386efc5f023f396dca087aaba5d4f885e ]
Register reset characteristics (i.e., whether the register maintains or loses its value on engine reset) is an important factor that determines which wa_list we want to add workarounds to. We recently found out that the bspec documentation for the Xe_HP's "GAM" registers in the 0xC800 - 0xCFFF range was misleading; these registers do not actually lose their value on engine resets as the documentation implied. This means there's no need to re-apply workarounds touching these registers after a reset, and the corresponding workarounds should be moved from the 'engine' lists back to the 'gt' list.
v2: - Don't add Wa_18018781329 to xehpsdv; the original condition didn't include that platform. (Gustavo) - Move the MTL code to the GT function as-is for now; we'll take care of the additional fixes needed in a follow-up patch.
Cc: Gustavo Sousa gustavo.sousa@intel.com Fixes: edf176f48d87 ("drm/i915/dg2: Move misplaced 'ctx' & 'gt' wa's to engine wa list") Fixes: b2006061ae28 ("drm/i915/xehpsdv: Move render/compute engine reset domains related workarounds") Fixes: 41bb543f5598 ("drm/i915/mtl: Add initial gt workarounds") Signed-off-by: Matt Roper matthew.d.roper@intel.com Reviewed-by: Gustavo Sousa gustavo.sousa@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-1-matth... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/i915/gt/intel_workarounds.c | 77 ++++++++++++--------- 1 file changed, 44 insertions(+), 33 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c index 09d533f6b962c..9932d748b9d7b 100644 --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c @@ -1550,6 +1550,13 @@ xehpsdv_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
/* Wa_14011060649:xehpsdv */ wa_14011060649(gt, wal); + + /* Wa_14012362059:xehpsdv */ + wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); + + /* Wa_14014368820:xehpsdv */ + wa_write_or(wal, GEN12_GAMCNTRL_CTRL, + INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); }
static void @@ -1590,6 +1597,12 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) DSS_ROUTER_CLKGATE_DIS); }
+ if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0) || + IS_DG2_GRAPHICS_STEP(gt->i915, G11, STEP_A0, STEP_B0)) { + /* Wa_14012362059:dg2 */ + wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); + } + if (IS_DG2_GRAPHICS_STEP(gt->i915, G10, STEP_A0, STEP_B0)) { /* Wa_14010948348:dg2_g10 */ wa_write_or(wal, UNSLCGCTL9430, MSQDUNIT_CLKGATE_DIS); @@ -1635,6 +1648,12 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
/* Wa_14011028019:dg2_g10 */ wa_mcr_write_or(wal, SSMCGCTL9530, RTFUNIT_CLKGATE_DIS); + + /* Wa_14010680813:dg2_g10 */ + wa_write_or(wal, GEN12_GAMSTLB_CTRL, + CONTROL_BLOCK_CLKGATE_DIS | + EGRESS_BLOCK_CLKGATE_DIS | + TAG_BLOCK_CLKGATE_DIS); }
/* Wa_14014830051:dg2 */ @@ -1649,6 +1668,16 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
/* Wa_14015795083 */ wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); + + /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + + /* Wa_1509235366:dg2 */ + wa_write_or(wal, GEN12_GAMCNTRL_CTRL, + INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); }
static void @@ -1658,16 +1687,29 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal)
/* Wa_14015795083 */ wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); + + /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); }
static void xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) { - /* Wa_14014830051 */ if (IS_MTL_GRAPHICS_STEP(gt->i915, M, STEP_A0, STEP_B0) || - IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0)) + IS_MTL_GRAPHICS_STEP(gt->i915, P, STEP_A0, STEP_B0)) { + /* Wa_14014830051 */ wa_mcr_write_clr(wal, SARB_CHICKEN1, COMP_CKN_IN);
+ /* Wa_18018781329 */ + wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + } + /* * Unlike older platforms, we no longer setup implicit steering here; * all MCR accesses are explicitly steered. @@ -2342,12 +2384,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) GEN12_DISABLE_READ_SUPPRESSION); }
- if (IS_DG2(i915)) { - /* Wa_1509235366:dg2 */ - wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS | - GLOBAL_INVALIDATION_MODE); - } - if (IS_DG2_GRAPHICS_STEP(i915, G11, STEP_A0, STEP_B0)) { /* Wa_14013392000:dg2_g11 */ wa_mcr_masked_en(wal, GEN8_ROW_CHICKEN2, GEN12_ENABLE_LARGE_GRF_MODE); @@ -2432,18 +2468,6 @@ rcs_engine_wa_init(struct intel_engine_cs *engine, struct i915_wa_list *wal) wa_mcr_masked_en(wal, GEN9_HALF_SLICE_CHICKEN7, DG2_DISABLE_ROUND_ENABLE_ALLOW_FOR_SSLA);
- if (IS_DG2_GRAPHICS_STEP(engine->i915, G10, STEP_A0, STEP_B0)) { - /* Wa_14010680813:dg2_g10 */ - wa_write_or(wal, GEN12_GAMSTLB_CTRL, CONTROL_BLOCK_CLKGATE_DIS | - EGRESS_BLOCK_CLKGATE_DIS | TAG_BLOCK_CLKGATE_DIS); - } - - if (IS_DG2_GRAPHICS_STEP(engine->i915, G10, STEP_A0, STEP_B0) || - IS_DG2_GRAPHICS_STEP(engine->i915, G11, STEP_A0, STEP_B0)) { - /* Wa_14012362059:dg2 */ - wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); - } - if (IS_DG2_GRAPHICS_STEP(i915, G11, STEP_B0, STEP_FOREVER) || IS_DG2_G10(i915)) { /* Wa_22014600077:dg2 */ @@ -3000,12 +3024,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li IS_MTL_GRAPHICS_STEP(i915, P, STEP_A0, STEP_B0) || IS_PONTEVECCHIO(i915) || IS_DG2(i915)) { - /* Wa_18018781329 */ - wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); - /* Wa_22014226127 */ wa_mcr_write_or(wal, LSC_CHICKEN_BIT_0, DISABLE_D8_D16_COASLESCE); } @@ -3045,13 +3063,6 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li wa_mcr_masked_dis(wal, MLTICTXCTL, TDONRENDER); wa_mcr_write_or(wal, L3SQCREG1_CCS0, FLUSHALLNONCOH); } - - /* Wa_14012362059:xehpsdv */ - wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB); - - /* Wa_14014368820:xehpsdv */ - wa_write_or(wal, GEN12_GAMCNTRL_CTRL, INVALIDATION_BROADCAST_MODE_DIS | - GLOBAL_INVALIDATION_MODE); }
if (IS_DG2(i915) || IS_PONTEVECCHIO(i915)) {
From: Lad Prabhakar prabhakar.mahadev-lad.rj@bp.renesas.com
[ Upstream commit 00dfe29887761405ccd23cc0aa07cb86623bb2b7 ]
On the RZ/G2UL SoC we have less number of pins compared to RZ/G2L and also the pin configs are completely different. This patch makes sure we use the appropriate pin configs for each SoC (which is passed as part of the OF data) while configuring the GPIO pin as interrupts instead of using rzg2l_gpio_configs[] for all the SoCs.
Fixes: bfc69bdbaad1 ("pinctrl: renesas: rzg2l: Add RZ/G2UL support") Signed-off-by: Lad Prabhakar prabhakar.mahadev-lad.rj@bp.renesas.com Reviewed-by: Geert Uytterhoeven geert+renesas@glider.be Acked-by: Linus Walleij linus.walleij@linaro.org Link: https://lore.kernel.org/r/20230102221815.273719-3-prabhakar.mahadev-lad.rj@b... Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c index 5aa3836dbc226..6f762097557af 100644 --- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c +++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c @@ -130,6 +130,7 @@ struct rzg2l_dedicated_configs { struct rzg2l_pinctrl_data { const char * const *port_pins; const u32 *port_pin_configs; + unsigned int n_ports; struct rzg2l_dedicated_configs *dedicated_pins; unsigned int n_port_pins; unsigned int n_dedicated_pins; @@ -1124,7 +1125,7 @@ static struct { } };
-static int rzg2l_gpio_get_gpioint(unsigned int virq) +static int rzg2l_gpio_get_gpioint(unsigned int virq, const struct rzg2l_pinctrl_data *data) { unsigned int gpioint; unsigned int i; @@ -1133,13 +1134,13 @@ static int rzg2l_gpio_get_gpioint(unsigned int virq) port = virq / 8; bit = virq % 8;
- if (port >= ARRAY_SIZE(rzg2l_gpio_configs) || - bit >= RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[port])) + if (port >= data->n_ports || + bit >= RZG2L_GPIO_PORT_GET_PINCNT(data->port_pin_configs[port])) return -EINVAL;
gpioint = bit; for (i = 0; i < port; i++) - gpioint += RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[i]); + gpioint += RZG2L_GPIO_PORT_GET_PINCNT(data->port_pin_configs[i]);
return gpioint; } @@ -1239,7 +1240,7 @@ static int rzg2l_gpio_child_to_parent_hwirq(struct gpio_chip *gc, unsigned long flags; int gpioint, irq;
- gpioint = rzg2l_gpio_get_gpioint(child); + gpioint = rzg2l_gpio_get_gpioint(child, pctrl->data); if (gpioint < 0) return gpioint;
@@ -1313,8 +1314,8 @@ static void rzg2l_init_irq_valid_mask(struct gpio_chip *gc, port = offset / 8; bit = offset % 8;
- if (port >= ARRAY_SIZE(rzg2l_gpio_configs) || - bit >= RZG2L_GPIO_PORT_GET_PINCNT(rzg2l_gpio_configs[port])) + if (port >= pctrl->data->n_ports || + bit >= RZG2L_GPIO_PORT_GET_PINCNT(pctrl->data->port_pin_configs[port])) clear_bit(offset, valid_mask); } } @@ -1519,6 +1520,7 @@ static int rzg2l_pinctrl_probe(struct platform_device *pdev) static struct rzg2l_pinctrl_data r9a07g043_data = { .port_pins = rzg2l_gpio_names, .port_pin_configs = r9a07g043_gpio_configs, + .n_ports = ARRAY_SIZE(r9a07g043_gpio_configs), .dedicated_pins = rzg2l_dedicated_pins.common, .n_port_pins = ARRAY_SIZE(r9a07g043_gpio_configs) * RZG2L_PINS_PER_PORT, .n_dedicated_pins = ARRAY_SIZE(rzg2l_dedicated_pins.common), @@ -1527,6 +1529,7 @@ static struct rzg2l_pinctrl_data r9a07g043_data = { static struct rzg2l_pinctrl_data r9a07g044_data = { .port_pins = rzg2l_gpio_names, .port_pin_configs = rzg2l_gpio_configs, + .n_ports = ARRAY_SIZE(rzg2l_gpio_configs), .dedicated_pins = rzg2l_dedicated_pins.common, .n_port_pins = ARRAY_SIZE(rzg2l_gpio_names), .n_dedicated_pins = ARRAY_SIZE(rzg2l_dedicated_pins.common) +
From: Matt Roper matthew.d.roper@intel.com
[ Upstream commit 7649a5d1f263b8cc5c2827ef0443ead9bee9ae0e ]
GAMSTLB_CTRL and GAMCNTRL_CTRL became multicast/replicated registers on Xe_HP. They should be defined accordingly and use MCR-aware operations.
These registers have only been used for some dg2/xehpsdv workarounds, so this fix is mostly just for consistency/future-proofing; even lacking the MCR annotation, workarounds will always be properly applied in a multicast manner on these platforms.
Cc: Gustavo Sousa gustavo.sousa@intel.com Fixes: 58bc2453ab8a ("drm/i915: Define multicast registers as a new type") Signed-off-by: Matt Roper matthew.d.roper@intel.com Reviewed-by: Gustavo Sousa gustavo.sousa@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-3-matth... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 ++-- drivers/gpu/drm/i915/gt/intel_workarounds.c | 16 ++++++++-------- 2 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h index c525fc07a9bcb..0c7e7972cc1c4 100644 --- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h +++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h @@ -1093,12 +1093,12 @@ #define VEBX_MOD_CTRL MCR_REG(0xcf38) #define FORCE_MISS_FTLB REG_BIT(3)
-#define GEN12_GAMSTLB_CTRL _MMIO(0xcf4c) +#define XEHP_GAMSTLB_CTRL MCR_REG(0xcf4c) #define CONTROL_BLOCK_CLKGATE_DIS REG_BIT(12) #define EGRESS_BLOCK_CLKGATE_DIS REG_BIT(11) #define TAG_BLOCK_CLKGATE_DIS REG_BIT(7)
-#define GEN12_GAMCNTRL_CTRL _MMIO(0xcf54) +#define XEHP_GAMCNTRL_CTRL MCR_REG(0xcf54) #define INVALIDATION_BROADCAST_MODE_DIS REG_BIT(12) #define GLOBAL_INVALIDATION_MODE REG_BIT(2)
diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c index 9932d748b9d7b..dcc694b8bc8c7 100644 --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c @@ -1555,8 +1555,8 @@ xehpsdv_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) wa_mcr_write_or(wal, XEHP_MERT_MOD_CTRL, FORCE_MISS_FTLB);
/* Wa_14014368820:xehpsdv */ - wa_write_or(wal, GEN12_GAMCNTRL_CTRL, - INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); + wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL, + INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); }
static void @@ -1650,10 +1650,10 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) wa_mcr_write_or(wal, SSMCGCTL9530, RTFUNIT_CLKGATE_DIS);
/* Wa_14010680813:dg2_g10 */ - wa_write_or(wal, GEN12_GAMSTLB_CTRL, - CONTROL_BLOCK_CLKGATE_DIS | - EGRESS_BLOCK_CLKGATE_DIS | - TAG_BLOCK_CLKGATE_DIS); + wa_mcr_write_or(wal, XEHP_GAMSTLB_CTRL, + CONTROL_BLOCK_CLKGATE_DIS | + EGRESS_BLOCK_CLKGATE_DIS | + TAG_BLOCK_CLKGATE_DIS); }
/* Wa_14014830051:dg2 */ @@ -1676,8 +1676,8 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB);
/* Wa_1509235366:dg2 */ - wa_write_or(wal, GEN12_GAMCNTRL_CTRL, - INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); + wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL, + INVALIDATION_BROADCAST_MODE_DIS | GLOBAL_INVALIDATION_MODE); }
static void
From: Dmitry Baryshkov dmitry.baryshkov@linaro.org
[ Upstream commit 1d233b1cb149ec78c20fac58331b27bb460f9558 ]
The function dpu_plane_sspp_atomic_update() updates pdpu->is_rt_pipe flag, but after the commit 854f6f1c653b ("drm/msm/dpu: update the qos remap only if the client type changes") it sets the flag late, after all the qos functions have updated QoS programming. Move the flag update back to the place where it happened before the mentioned commit to let the pipe be programmed according to its current RT/non-RT state.
Fixes: 854f6f1c653b ("drm/msm/dpu: update the qos remap only if the client type changes") Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Patchwork: https://patchwork.freedesktop.org/patch/516239/ Link: https://lore.kernel.org/r/20221229191856.3508092-2-dmitry.baryshkov@linaro.o... Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c index 86719020afe20..bfd5be89e8b8d 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c @@ -1126,7 +1126,7 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) struct dpu_plane_state *pstate = to_dpu_plane_state(state); struct drm_crtc *crtc = state->crtc; struct drm_framebuffer *fb = state->fb; - bool is_rt_pipe, update_qos_remap; + bool is_rt_pipe; const struct dpu_format *fmt = to_dpu_format(msm_framebuffer_format(fb)); struct dpu_hw_pipe_cfg pipe_cfg; @@ -1138,6 +1138,9 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) pstate->pending = true;
is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT); + pstate->needs_qos_remap |= (is_rt_pipe != pdpu->is_rt_pipe); + pdpu->is_rt_pipe = is_rt_pipe; + _dpu_plane_set_qos_ctrl(plane, false, DPU_PLANE_QOS_PANIC_CTRL);
DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT @@ -1219,14 +1222,8 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) _dpu_plane_set_ot_limit(plane, crtc, &pipe_cfg); }
- update_qos_remap = (is_rt_pipe != pdpu->is_rt_pipe) || - pstate->needs_qos_remap; - - if (update_qos_remap) { - if (is_rt_pipe != pdpu->is_rt_pipe) - pdpu->is_rt_pipe = is_rt_pipe; - else if (pstate->needs_qos_remap) - pstate->needs_qos_remap = false; + if (pstate->needs_qos_remap) { + pstate->needs_qos_remap = false; _dpu_plane_set_qos_remap(plane); }
From: Xinlei Lee xinlei.lee@mediatek.com
[ Upstream commit 91aeaed2c1147e3b1157dc084d23f190856a6c23 ]
According to Figure 16 Turnaround Procedure on page 36 in [1], you can see the status of LP-00 -> LP10 -> LP11. This state can correspond to the state of DSI from LP00 -> LP11 in mtk_dsi_lane_ready function in mtk_dsi.c.
LP-00 -> LP10 -> LP11 takes about 2*TLPX time (refer to [1] page 51 to see that TLPX is 50ns)
The delay at the end of the mtk_dsi_lane_ready function should be greater than the 2*TLPX specified by the DSI spec, and less than the time specified by the DSI_RX (generally 6ms to 40ms), to avoid problems caused by the RX specification
[1]:mipi_D-PHY_specification_v1-1
Fixes: 39e8d062b03c ("drm/mediatek: Keep dsi as LP00 before dcs cmds transfer") Signed-off-by: Xinlei Lee xinlei.lee@mediatek.com Acked-by: Sam Ravnborg sam@ravnborg.org Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1673330093-6771-2-... Signed-off-by: Chun-Kuang Hu chunkuang.hu@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c index 3b7d13028fb6b..9e1363c9fcdb4 100644 --- a/drivers/gpu/drm/mediatek/mtk_dsi.c +++ b/drivers/gpu/drm/mediatek/mtk_dsi.c @@ -721,7 +721,7 @@ static void mtk_dsi_lane_ready(struct mtk_dsi *dsi) mtk_dsi_clk_ulp_mode_leave(dsi); mtk_dsi_lane0_ulp_mode_leave(dsi); mtk_dsi_clk_hs_mode(dsi, 0); - msleep(20); + usleep_range(1000, 3000); /* The reaction time after pulling up the mipi signal for dsi_rx */ } }
From: Miles Chen miles.chen@mediatek.com
[ Upstream commit 4744cde06f57dd6fbaac468663b1fe2f653eaa16 ]
Use NULL for NULL pointer to fix the following sparse warning: drivers/gpu/drm/mediatek/mtk_drm_gem.c:265:27: sparse: warning: Using plain integer as NULL pointer
Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function") Signed-off-by: Miles Chen miles.chen@mediatek.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230111024443.245... Signed-off-by: Chun-Kuang Hu chunkuang.hu@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c index 47e96b0289f98..06aadd5e7f5ba 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c @@ -262,6 +262,6 @@ void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, return;
vunmap(vaddr); - mtk_gem->kvaddr = 0; + mtk_gem->kvaddr = NULL; kfree(mtk_gem->pages); }
From: Rob Clark robdclark@chromium.org
[ Upstream commit 4deef811828e87e26a978d5d6433b261d4713849 ]
In the error path, mtk_drm_gem_object_mmap() is dropping an obj reference that it doesn't own.
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") Signed-off-by: Rob Clark robdclark@chromium.org Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230119231255.288... Signed-off-by: Chun-Kuang Hu chunkuang.hu@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 -- 1 file changed, 2 deletions(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c index 06aadd5e7f5ba..6c204ccfb9ece 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c @@ -164,8 +164,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj,
ret = dma_mmap_attrs(priv->dma_dev, vma, mtk_gem->cookie, mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs); - if (ret) - drm_gem_vm_close(vma);
return ret; }
From: ruanjinjie ruanjinjie@huawei.com
[ Upstream commit 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c ]
As the devm_kcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference.
Fixes: 31c5558dae05 ("drm/mediatek: Refactor plane init") Signed-off-by: ruanjinjie ruanjinjie@huawei.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221205095115.290... Signed-off-by: Chun-Kuang Hu chunkuang.hu@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c index 112615817dcbe..5071f1263216b 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c @@ -945,6 +945,8 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
mtk_crtc->planes = devm_kcalloc(dev, num_comp_planes, sizeof(struct drm_plane), GFP_KERNEL); + if (!mtk_crtc->planes) + return -ENOMEM;
for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) { ret = mtk_drm_crtc_init_comp_planes(drm_dev, mtk_crtc, i,
From: Nícolas F. R. A. Prado nfraprado@collabora.com
[ Upstream commit 36aa8c61af55675ed967900fbe5deb32d776f051 ]
mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that point, resulting in a panic. Clean the pointer when destroying the object in the error path to prevent this from happening.
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") Signed-off-by: Nícolas F. R. A. Prado nfraprado@collabora.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221122143949.349... Signed-off-by: Chun-Kuang Hu chunkuang.hu@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c index cd5b18ef79512..d3e57dd79f5f5 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -520,6 +520,7 @@ static int mtk_drm_bind(struct device *dev) err_deinit: mtk_drm_kms_deinit(drm); err_free: + private->drm = NULL; drm_dev_put(drm); return ret; }
From: Kuninori Morimoto kuninori.morimoto.gx@renesas.com
[ Upstream commit ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 ]
commit d3268a40d4b19f ("ASoC: soc-compress.c: fix NULL dereference") enables DPCM capture, but it should independent from playback. This patch fixup it.
Fixes: d3268a40d4b1 ("ASoC: soc-compress.c: fix NULL dereference") Link: https://lore.kernel.org/r/87tu0i6j7j.wl-kuninori.morimoto.gx@renesas.com Acked-by: Charles Keepax ckeepax@opensource.cirrus.com Acked-by: Pierre-Louis Bossart pierre-louis.bossart@linux.intel.com Signed-off-by: Kuninori Morimoto kuninori.morimoto.gx@renesas.com Link: https://lore.kernel.org/r/871qnkvo1s.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/soc-compress.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c index 870f13e1d389c..cb0ed2fea893a 100644 --- a/sound/soc/soc-compress.c +++ b/sound/soc/soc-compress.c @@ -623,7 +623,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) rtd->fe_compr = 1; if (rtd->dai_link->dpcm_playback) be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd; - else if (rtd->dai_link->dpcm_capture) + if (rtd->dai_link->dpcm_capture) be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd; memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops)); } else {
From: Allen-KH Cheng allen-kh.cheng@mediatek.com
[ Upstream commit 137272ef1b0f17a1815fec00d583515a0163f85e ]
The mt8186-disp-ccorr is not fully compatible with the mt8183-disp-ccorr implementation. It causes a crash when system resumes if it binds to the device.
We should use mt8192-disp-ccorr as fallback of mt8186-disp-ccorr.
Fixes: 8a26ea19d4dc ("dt-bindings: display: mediatek: add MT8186 SoC binding") Signed-off-by: Allen-KH Cheng allen-kh.cheng@mediatek.com Reviewed-by: Rob Herring robh@kernel.org Reviewed-by: Matthias Brugger matthias.bgg@gmail.com Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230118091829.755... Signed-off-by: Chun-Kuang Hu chunkuang.hu@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../devicetree/bindings/display/mediatek/mediatek,ccorr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml b/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml index 63fb02014a56a..117e3db43f84a 100644 --- a/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml +++ b/Documentation/devicetree/bindings/display/mediatek/mediatek,ccorr.yaml @@ -32,7 +32,7 @@ properties: - items: - enum: - mediatek,mt8186-disp-ccorr - - const: mediatek,mt8183-disp-ccorr + - const: mediatek,mt8192-disp-ccorr
reg: maxItems: 1
From: Bartosz Golaszewski bartosz.golaszewski@linaro.org
[ Upstream commit a3f7c1d6ddcbd487964c58ff246506a781e5be8f ]
By convention platform_data refers to structures passed to drivers by code that registers devices. When talking about model-specific data structures associated with OF compatibles, we usually call them chip_data.
In order to avoid confusion rename all mentions of platform_data to chip_data.
Fixes: fbb19fe17eae ("gpio: pca9570: add slg7xl45106 support") Signed-off-by: Bartosz Golaszewski bartosz.golaszewski@linaro.org Reviewed-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Reviewed-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpio/gpio-pca9570.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/drivers/gpio/gpio-pca9570.c b/drivers/gpio/gpio-pca9570.c index 6c07a8811a7a5..6a5a8e593ed55 100644 --- a/drivers/gpio/gpio-pca9570.c +++ b/drivers/gpio/gpio-pca9570.c @@ -18,11 +18,11 @@ #define SLG7XL45106_GPO_REG 0xDB
/** - * struct pca9570_platform_data - GPIO platformdata + * struct pca9570_chip_data - GPIO platformdata * @ngpio: no of gpios * @command: Command to be sent */ -struct pca9570_platform_data { +struct pca9570_chip_data { u16 ngpio; u32 command; }; @@ -36,7 +36,7 @@ struct pca9570_platform_data { */ struct pca9570 { struct gpio_chip chip; - const struct pca9570_platform_data *p_data; + const struct pca9570_chip_data *chip_data; struct mutex lock; u8 out; }; @@ -46,8 +46,8 @@ static int pca9570_read(struct pca9570 *gpio, u8 *value) struct i2c_client *client = to_i2c_client(gpio->chip.parent); int ret;
- if (gpio->p_data->command != 0) - ret = i2c_smbus_read_byte_data(client, gpio->p_data->command); + if (gpio->chip_data->command != 0) + ret = i2c_smbus_read_byte_data(client, gpio->chip_data->command); else ret = i2c_smbus_read_byte(client);
@@ -62,8 +62,8 @@ static int pca9570_write(struct pca9570 *gpio, u8 value) { struct i2c_client *client = to_i2c_client(gpio->chip.parent);
- if (gpio->p_data->command != 0) - return i2c_smbus_write_byte_data(client, gpio->p_data->command, value); + if (gpio->chip_data->command != 0) + return i2c_smbus_write_byte_data(client, gpio->chip_data->command, value);
return i2c_smbus_write_byte(client, value); } @@ -127,8 +127,8 @@ static int pca9570_probe(struct i2c_client *client) gpio->chip.get = pca9570_get; gpio->chip.set = pca9570_set; gpio->chip.base = -1; - gpio->p_data = device_get_match_data(&client->dev); - gpio->chip.ngpio = gpio->p_data->ngpio; + gpio->chip_data = device_get_match_data(&client->dev); + gpio->chip.ngpio = gpio->chip_data->ngpio; gpio->chip.can_sleep = true;
mutex_init(&gpio->lock); @@ -141,15 +141,15 @@ static int pca9570_probe(struct i2c_client *client) return devm_gpiochip_add_data(&client->dev, &gpio->chip, gpio); }
-static const struct pca9570_platform_data pca9570_gpio = { +static const struct pca9570_chip_data pca9570_gpio = { .ngpio = 4, };
-static const struct pca9570_platform_data pca9571_gpio = { +static const struct pca9570_chip_data pca9571_gpio = { .ngpio = 8, };
-static const struct pca9570_platform_data slg7xl45106_gpio = { +static const struct pca9570_chip_data slg7xl45106_gpio = { .ngpio = 8, .command = SLG7XL45106_GPO_REG, };
From: Haibo Chen haibo.chen@nxp.com
[ Upstream commit 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e ]
Current GPIO label is fixed, so can't distinguish different GPIO controllers through labels. Use dev name instead.
Fixes: 7f2691a19627 ("gpio: vf610: add gpiolib/IRQ chip driver for Vybrid") Signed-off-by: Clark Wang xiaoning.wang@nxp.com Signed-off-by: Haibo Chen haibo.chen@nxp.com Reviewed-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Bartosz Golaszewski bartosz.golaszewski@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpio/gpio-vf610.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c index 9033db00c360d..d3f3a69d49077 100644 --- a/drivers/gpio/gpio-vf610.c +++ b/drivers/gpio/gpio-vf610.c @@ -317,7 +317,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
gc = &port->gc; gc->parent = dev; - gc->label = "vf610-gpio"; + gc->label = dev_name(dev); gc->ngpio = VF610_GPIO_PER_PORT; gc->base = of_alias_get_id(np, "gpio") * VF610_GPIO_PER_PORT;
From: Amadeusz Sławiński amadeuszx.slawinski@linux.intel.com
[ Upstream commit c5d184c92df2b631fb81fe2ce6e96bfc5ba720e5 ]
When accessing values coming from topology, le32_to_cpu should be used. One of recent commits missed that.
Fixes: 86e2d14b6d1a ("ASoC: topology: Add header payload_size verification") Reviewed-by: Cezary Rojewski cezary.rojewski@intel.com Reviewed-by: Ranjani Sridharan ranjani.sridharan@linux.intel.com Signed-off-by: Amadeusz Sławiński amadeuszx.slawinski@linux.intel.com Link: https://lore.kernel.org/r/20230127231111.937721-2-amadeuszx.slawinski@linux.... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/soc-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index a79a2fb260b87..d68c48555a7e3 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -2408,7 +2408,7 @@ static int soc_valid_header(struct soc_tplg *tplg, return -EINVAL; }
- if (soc_tplg_get_hdr_offset(tplg) + hdr->payload_size >= tplg->fw->size) { + if (soc_tplg_get_hdr_offset(tplg) + le32_to_cpu(hdr->payload_size) >= tplg->fw->size) { dev_err(tplg->dev, "ASoC: invalid header of type %d at offset %ld payload_size %d\n", le32_to_cpu(hdr->type), soc_tplg_get_hdr_offset(tplg),
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit d4bde04318c0d33705e9a77d4c7df72f262011e0 ]
Selecting a symbol with additional dependencies requires adding the same dependency here:
WARNING: unmet direct dependencies detected for MUX_MMIO Depends on [n]: MULTIPLEXER [=y] && OF [=n] Selected by [y]: - SPI_DW_BT1 [=y] && SPI [=y] && SPI_MASTER [=y] && SPI_DESIGNWARE [=y] && (MIPS_BAIKAL_T1 || COMPILE_TEST [=y])
Drop the 'select' here to avoid the problem. Anyone using the dw-bt1 SPI driver should make sure they include the mux driver as well now.
Fixes: 7218838109fe ("spi: dw-bt1: Fix undefined devm_mux_control_get symbol") Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver") Link: https://lore.kernel.org/all/20221218192523.c6vnfo26ua6xqf26@mobilestation/ Signed-off-by: Arnd Bergmann arnd@arndb.de Reviewed-by: Serge Semin fancer.lancer@gmail.com Link: https://lore.kernel.org/r/20230130140156.3620863-1-arnd@kernel.org Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/spi/Kconfig | 1 - 1 file changed, 1 deletion(-)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig index 3b1c0878bb857..930c6075b78cf 100644 --- a/drivers/spi/Kconfig +++ b/drivers/spi/Kconfig @@ -295,7 +295,6 @@ config SPI_DW_BT1 tristate "Baikal-T1 SPI driver for DW SPI core" depends on MIPS_BAIKAL_T1 || COMPILE_TEST select MULTIPLEXER - select MUX_MMIO help Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI controllers. Two of them are pretty much normal: with IRQ, DMA,
From: Claudiu Beznea claudiu.beznea@microchip.com
[ Upstream commit fa09fa60385abbf99342494b280da8b4aebbc0e9 ]
The SPDIFRX block is clocked by 2 clocks: peripheral and generic clocks. Peripheral clock feeds user interface (registers) and generic clock feeds the receiver.
To enable the receiver the generic clock needs to be enabled and also the ENABLE bit of MCHP_SPDIFRX_MR register need to be set.
The signal control exported by mchp-spdifrx driver reports wrong status when the receiver is disabled. This can happen when requesting the signal and the capture was not previously started. To solve this the receiver needs to be enabled (by enabling generic clock and setting ENABLE bit of MR register) before reading the signal status.
As with this fix there are 2 paths now that need to control the generic clock and ENABLE bit of SPDIFRX_MR register (one path though controls, one path though configuration) a mutex has been introduced. We can't rely on subsystem locking as the controls are protected by struct snd_card::controls_rwsem semaphore and configuration is protected by a different lock (embedded in snd_pcm_stream_lock_irq()).
The introduction of mutex is also extended to other controls which rely on SPDIFRX_RSR.ULOCK bit as it has been discovered experimentally that having both clocks enabled but not the receiver (through ENABLE bit of SPDIFRX.MR) leads to inconsistent values of SPDIFRX_RSR.ULOCK. Thus on some controls we rely on software state (dev->trigger_enabled protected by mutex) to retrieve proper values.
Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") Signed-off-by: Claudiu Beznea claudiu.beznea@microchip.com Link: https://lore.kernel.org/r/20230130120647.638049-2-claudiu.beznea@microchip.c... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/atmel/mchp-spdifrx.c | 192 ++++++++++++++++++++++++--------- 1 file changed, 142 insertions(+), 50 deletions(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c index ec0705cc40fab..2d86e0ec930fa 100644 --- a/sound/soc/atmel/mchp-spdifrx.c +++ b/sound/soc/atmel/mchp-spdifrx.c @@ -233,11 +233,13 @@ struct mchp_spdifrx_dev { struct mchp_spdifrx_mixer_control control; spinlock_t blockend_lock; /* protect access to blockend_refcount */ int blockend_refcount; + struct mutex mlock; struct device *dev; struct regmap *regmap; struct clk *pclk; struct clk *gclk; unsigned int fmt; + unsigned int trigger_enabled; unsigned int gclk_enabled:1; };
@@ -353,47 +355,40 @@ static int mchp_spdifrx_trigger(struct snd_pcm_substream *substream, int cmd, struct snd_soc_dai *dai) { struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); - u32 mr; - int running; - int ret; - - regmap_read(dev->regmap, SPDIFRX_MR, &mr); - running = !!(mr & SPDIFRX_MR_RXEN_ENABLE); + int ret = 0;
switch (cmd) { case SNDRV_PCM_TRIGGER_START: case SNDRV_PCM_TRIGGER_RESUME: case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: - if (!running) { - mr &= ~SPDIFRX_MR_RXEN_MASK; - mr |= SPDIFRX_MR_RXEN_ENABLE; - /* enable overrun interrupts */ - regmap_write(dev->regmap, SPDIFRX_IER, - SPDIFRX_IR_OVERRUN); - } + mutex_lock(&dev->mlock); + /* Enable overrun interrupts */ + regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_OVERRUN); + + /* Enable receiver. */ + regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, + SPDIFRX_MR_RXEN_ENABLE); + dev->trigger_enabled = true; + mutex_unlock(&dev->mlock); break; case SNDRV_PCM_TRIGGER_STOP: case SNDRV_PCM_TRIGGER_SUSPEND: case SNDRV_PCM_TRIGGER_PAUSE_PUSH: - if (running) { - mr &= ~SPDIFRX_MR_RXEN_MASK; - mr |= SPDIFRX_MR_RXEN_DISABLE; - /* disable overrun interrupts */ - regmap_write(dev->regmap, SPDIFRX_IDR, - SPDIFRX_IR_OVERRUN); - } + mutex_lock(&dev->mlock); + /* Disable overrun interrupts */ + regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_OVERRUN); + + /* Disable receiver. */ + regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, + SPDIFRX_MR_RXEN_DISABLE); + dev->trigger_enabled = false; + mutex_unlock(&dev->mlock); break; default: - return -EINVAL; + ret = -EINVAL; }
- ret = regmap_write(dev->regmap, SPDIFRX_MR, mr); - if (ret) { - dev_err(dev->dev, "unable to enable/disable RX: %d\n", ret); - return ret; - } - - return 0; + return ret; }
static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, @@ -413,13 +408,6 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, return -EINVAL; }
- regmap_read(dev->regmap, SPDIFRX_MR, &mr); - - if (mr & SPDIFRX_MR_RXEN_ENABLE) { - dev_err(dev->dev, "PCM already running\n"); - return -EBUSY; - } - if (params_channels(params) != SPDIFRX_CHANNELS) { dev_err(dev->dev, "unsupported number of channels: %d\n", params_channels(params)); @@ -445,6 +433,13 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, return -EINVAL; }
+ mutex_lock(&dev->mlock); + if (dev->trigger_enabled) { + dev_err(dev->dev, "PCM already running\n"); + ret = -EBUSY; + goto unlock; + } + if (dev->gclk_enabled) { clk_disable_unprepare(dev->gclk); dev->gclk_enabled = 0; @@ -455,19 +450,24 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, dev_err(dev->dev, "unable to set gclk min rate: rate %u * ratio %u + 1\n", params_rate(params), SPDIFRX_GCLK_RATIO_MIN); - return ret; + goto unlock; } ret = clk_prepare_enable(dev->gclk); if (ret) { dev_err(dev->dev, "unable to enable gclk: %d\n", ret); - return ret; + goto unlock; } dev->gclk_enabled = 1;
dev_dbg(dev->dev, "GCLK range min set to %d\n", params_rate(params) * SPDIFRX_GCLK_RATIO_MIN + 1);
- return regmap_write(dev->regmap, SPDIFRX_MR, mr); + ret = regmap_write(dev->regmap, SPDIFRX_MR, mr); + +unlock: + mutex_unlock(&dev->mlock); + + return ret; }
static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream, @@ -475,10 +475,12 @@ static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream, { struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
+ mutex_lock(&dev->mlock); if (dev->gclk_enabled) { clk_disable_unprepare(dev->gclk); dev->gclk_enabled = 0; } + mutex_unlock(&dev->mlock); return 0; }
@@ -627,10 +629,24 @@ static int mchp_spdifrx_ulock_get(struct snd_kcontrol *kcontrol, u32 val; bool ulock_old = ctrl->ulock;
- regmap_read(dev->regmap, SPDIFRX_RSR, &val); - ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK); + mutex_lock(&dev->mlock); + + /* + * The RSR.ULOCK has wrong value if both pclk and gclk are enabled + * and the receiver is disabled. Thus we take into account the + * dev->trigger_enabled here to return a real status. + */ + if (dev->trigger_enabled) { + regmap_read(dev->regmap, SPDIFRX_RSR, &val); + ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK); + } else { + ctrl->ulock = 0; + } + uvalue->value.integer.value[0] = ctrl->ulock;
+ mutex_unlock(&dev->mlock); + return ulock_old != ctrl->ulock; }
@@ -643,8 +659,22 @@ static int mchp_spdifrx_badf_get(struct snd_kcontrol *kcontrol, u32 val; bool badf_old = ctrl->badf;
- regmap_read(dev->regmap, SPDIFRX_RSR, &val); - ctrl->badf = !!(val & SPDIFRX_RSR_BADF); + mutex_lock(&dev->mlock); + + /* + * The RSR.ULOCK has wrong value if both pclk and gclk are enabled + * and the receiver is disabled. Thus we take into account the + * dev->trigger_enabled here to return a real status. + */ + if (dev->trigger_enabled) { + regmap_read(dev->regmap, SPDIFRX_RSR, &val); + ctrl->badf = !!(val & SPDIFRX_RSR_BADF); + } else { + ctrl->badf = 0; + } + + mutex_unlock(&dev->mlock); + uvalue->value.integer.value[0] = ctrl->badf;
return badf_old != ctrl->badf; @@ -656,11 +686,48 @@ static int mchp_spdifrx_signal_get(struct snd_kcontrol *kcontrol, struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol); struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); struct mchp_spdifrx_mixer_control *ctrl = &dev->control; - u32 val; + u32 val = ~0U, loops = 10; + int ret; bool signal_old = ctrl->signal;
- regmap_read(dev->regmap, SPDIFRX_RSR, &val); - ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL); + mutex_lock(&dev->mlock); + + /* + * To get the signal we need to have receiver enabled. This + * could be enabled also from trigger() function thus we need to + * take care of not disabling the receiver when it runs. + */ + if (!dev->trigger_enabled) { + ret = clk_prepare_enable(dev->gclk); + if (ret) + goto unlock; + + regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, + SPDIFRX_MR_RXEN_ENABLE); + + /* Wait for RSR.ULOCK bit. */ + while (--loops) { + regmap_read(dev->regmap, SPDIFRX_RSR, &val); + if (!(val & SPDIFRX_RSR_ULOCK)) + break; + usleep_range(100, 150); + } + + regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, + SPDIFRX_MR_RXEN_DISABLE); + + clk_disable_unprepare(dev->gclk); + } else { + regmap_read(dev->regmap, SPDIFRX_RSR, &val); + } + +unlock: + mutex_unlock(&dev->mlock); + + if (!(val & SPDIFRX_RSR_ULOCK)) + ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL); + else + ctrl->signal = 0; uvalue->value.integer.value[0] = ctrl->signal;
return signal_old != ctrl->signal; @@ -685,18 +752,32 @@ static int mchp_spdifrx_rate_get(struct snd_kcontrol *kcontrol, u32 val; int rate;
- regmap_read(dev->regmap, SPDIFRX_RSR, &val); - - /* if the receiver is not locked, ISF data is invalid */ - if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) { + mutex_lock(&dev->mlock); + + /* + * The RSR.ULOCK has wrong value if both pclk and gclk are enabled + * and the receiver is disabled. Thus we take into account the + * dev->trigger_enabled here to return a real status. + */ + if (dev->trigger_enabled) { + regmap_read(dev->regmap, SPDIFRX_RSR, &val); + /* If the receiver is not locked, ISF data is invalid. */ + if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) { + ucontrol->value.integer.value[0] = 0; + goto unlock; + } + } else { + /* Reveicer is not locked, IFS data is invalid. */ ucontrol->value.integer.value[0] = 0; - return 0; + goto unlock; }
rate = clk_get_rate(dev->gclk);
ucontrol->value.integer.value[0] = rate / (32 * SPDIFRX_RSR_IFS(val));
+unlock: + mutex_unlock(&dev->mlock); return 0; }
@@ -913,7 +994,18 @@ static int mchp_spdifrx_probe(struct platform_device *pdev) "failed to get the PMC generated clock: %d\n", err); return err; } + + /* + * Signal control need a valid rate on gclk. hw_params() configures + * it propertly but requesting signal before any hw_params() has been + * called lead to invalid value returned for signal. Thus, configure + * gclk at a valid rate, here, in initialization, to simplify the + * control path. + */ + clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1); + spin_lock_init(&dev->blockend_lock); + mutex_init(&dev->mlock);
dev->dev = &pdev->dev; dev->regmap = regmap;
From: Claudiu Beznea claudiu.beznea@microchip.com
[ Upstream commit a4c4161d6eae3ef5f486d1638ef452d9bc1376b0 ]
wait_for_completion_interruptible_timeout() returns 0 in case of timeout. Check this into account when returning from function.
Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") Signed-off-by: Claudiu Beznea claudiu.beznea@microchip.com Link: https://lore.kernel.org/r/20230130120647.638049-3-claudiu.beznea@microchip.c... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/atmel/mchp-spdifrx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c index 2d86e0ec930fa..7f359371b31bf 100644 --- a/sound/soc/atmel/mchp-spdifrx.c +++ b/sound/soc/atmel/mchp-spdifrx.c @@ -524,9 +524,10 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev, ret = wait_for_completion_interruptible_timeout(&ch_stat->done, msecs_to_jiffies(100)); /* IP might not be started or valid stream might not be present */ - if (ret < 0) { + if (ret <= 0) { dev_dbg(dev->dev, "channel status for channel %d timeout\n", channel); + return ret ? : -ETIMEDOUT; }
memcpy(uvalue->value.iec958.status, ch_stat->data, @@ -580,7 +581,7 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev, dev_dbg(dev->dev, "user data for channel %d timeout\n", channel); mchp_spdifrx_isr_blockend_dis(dev); - return ret; + return ret ? : -ETIMEDOUT; }
spin_lock_irqsave(&user_data->lock, flags);
From: Claudiu Beznea claudiu.beznea@microchip.com
[ Upstream commit d3681df44e856aab523a6eb7ba15b5e41efcbb1c ]
Channel status get and channel subcode get controls relies on data returned by controls when certain IRQs are raised. To achieve that completions are used b/w controls and interrupt service routine. The concurrent accesses to these controls are protected by struct snd_card::controls_rwsem.
Issues identified: - reinit_completion() may be called while waiting for completion which should be avoided - in case of multiple threads waiting, the complete() call in interrupt will signal only one waiting thread per interrupt which may lead to timeout for the others - in case of channel status get as the CSC interrupt is not refcounted ISR may disable interrupt for threads that were just enabled it.
To solve these the access to controls were protected by a mutex. Along with this there is no need for spinlock to protect the software cache reads/updates b/w controls and ISR as the update is happening only when requested from control, and only one reader can reach the control.
Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") Signed-off-by: Claudiu Beznea claudiu.beznea@microchip.com Link: https://lore.kernel.org/r/20230130120647.638049-4-claudiu.beznea@microchip.c... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/atmel/mchp-spdifrx.c | 143 ++++++++++++++++++--------------- 1 file changed, 77 insertions(+), 66 deletions(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c index 7f359371b31bf..31ffaaf46dec0 100644 --- a/sound/soc/atmel/mchp-spdifrx.c +++ b/sound/soc/atmel/mchp-spdifrx.c @@ -217,7 +217,6 @@ struct mchp_spdifrx_ch_stat { struct mchp_spdifrx_user_data { unsigned char data[SPDIFRX_UD_BITS / 8]; struct completion done; - spinlock_t lock; /* protect access to user data */ };
struct mchp_spdifrx_mixer_control { @@ -231,8 +230,6 @@ struct mchp_spdifrx_mixer_control { struct mchp_spdifrx_dev { struct snd_dmaengine_dai_dma_data capture; struct mchp_spdifrx_mixer_control control; - spinlock_t blockend_lock; /* protect access to blockend_refcount */ - int blockend_refcount; struct mutex mlock; struct device *dev; struct regmap *regmap; @@ -277,37 +274,11 @@ static void mchp_spdifrx_channel_user_data_read(struct mchp_spdifrx_dev *dev, } }
-/* called from non-atomic context only */ -static void mchp_spdifrx_isr_blockend_en(struct mchp_spdifrx_dev *dev) -{ - unsigned long flags; - - spin_lock_irqsave(&dev->blockend_lock, flags); - dev->blockend_refcount++; - /* don't enable BLOCKEND interrupt if it's already enabled */ - if (dev->blockend_refcount == 1) - regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND); - spin_unlock_irqrestore(&dev->blockend_lock, flags); -} - -/* called from atomic/non-atomic context */ -static void mchp_spdifrx_isr_blockend_dis(struct mchp_spdifrx_dev *dev) -{ - unsigned long flags; - - spin_lock_irqsave(&dev->blockend_lock, flags); - dev->blockend_refcount--; - /* don't enable BLOCKEND interrupt if it's already enabled */ - if (dev->blockend_refcount == 0) - regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); - spin_unlock_irqrestore(&dev->blockend_lock, flags); -} - static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) { struct mchp_spdifrx_dev *dev = dev_id; struct mchp_spdifrx_mixer_control *ctrl = &dev->control; - u32 sr, imr, pending, idr = 0; + u32 sr, imr, pending; irqreturn_t ret = IRQ_NONE; int ch;
@@ -322,13 +293,10 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id)
if (pending & SPDIFRX_IR_BLOCKEND) { for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) { - spin_lock(&ctrl->user_data[ch].lock); mchp_spdifrx_channel_user_data_read(dev, ch); - spin_unlock(&ctrl->user_data[ch].lock); - complete(&ctrl->user_data[ch].done); } - mchp_spdifrx_isr_blockend_dis(dev); + regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); ret = IRQ_HANDLED; }
@@ -336,7 +304,7 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) if (pending & SPDIFRX_IR_CSC(ch)) { mchp_spdifrx_channel_status_read(dev, ch); complete(&ctrl->ch_stat[ch].done); - idr |= SPDIFRX_IR_CSC(ch); + regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(ch)); ret = IRQ_HANDLED; } } @@ -346,8 +314,6 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) ret = IRQ_HANDLED; }
- regmap_write(dev->regmap, SPDIFRX_IDR, idr); - return ret; }
@@ -517,23 +483,51 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev, { struct mchp_spdifrx_mixer_control *ctrl = &dev->control; struct mchp_spdifrx_ch_stat *ch_stat = &ctrl->ch_stat[channel]; - int ret; + int ret = 0; + + mutex_lock(&dev->mlock);
- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel)); - /* check for new data available */ - ret = wait_for_completion_interruptible_timeout(&ch_stat->done, - msecs_to_jiffies(100)); - /* IP might not be started or valid stream might not be present */ - if (ret <= 0) { - dev_dbg(dev->dev, "channel status for channel %d timeout\n", - channel); - return ret ? : -ETIMEDOUT; + /* + * We may reach this point with both clocks enabled but the receiver + * still disabled. To void waiting for completion and return with + * timeout check the dev->trigger_enabled. + * + * To retrieve data: + * - if the receiver is enabled CSC IRQ will update the data in software + * caches (ch_stat->data) + * - otherwise we just update it here the software caches with latest + * available information and return it; in this case we don't need + * spin locking as the IRQ is disabled and will not be raised from + * anywhere else. + */ + + if (dev->trigger_enabled) { + reinit_completion(&ch_stat->done); + regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel)); + /* Check for new data available */ + ret = wait_for_completion_interruptible_timeout(&ch_stat->done, + msecs_to_jiffies(100)); + /* Valid stream might not be present */ + if (ret <= 0) { + dev_dbg(dev->dev, "channel status for channel %d timeout\n", + channel); + regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(channel)); + ret = ret ? : -ETIMEDOUT; + goto unlock; + } else { + ret = 0; + } + } else { + /* Update software cache with latest channel status. */ + mchp_spdifrx_channel_status_read(dev, channel); }
memcpy(uvalue->value.iec958.status, ch_stat->data, sizeof(ch_stat->data));
- return 0; +unlock: + mutex_unlock(&dev->mlock); + return ret; }
static int mchp_spdifrx_cs1_get(struct snd_kcontrol *kcontrol, @@ -567,29 +561,49 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev, int channel, struct snd_ctl_elem_value *uvalue) { - unsigned long flags; struct mchp_spdifrx_mixer_control *ctrl = &dev->control; struct mchp_spdifrx_user_data *user_data = &ctrl->user_data[channel]; - int ret; + int ret = 0; + + mutex_lock(&dev->mlock); + + /* + * We may reach this point with both clocks enabled but the receiver + * still disabled. To void waiting for completion to just timeout we + * check here the dev->trigger_enabled flag. + * + * To retrieve data: + * - if the receiver is enabled we need to wait for blockend IRQ to read + * data to and update it for us in software caches + * - otherwise reading the SPDIFRX_CHUD() registers is enough. + */
- reinit_completion(&user_data->done); - mchp_spdifrx_isr_blockend_en(dev); - ret = wait_for_completion_interruptible_timeout(&user_data->done, - msecs_to_jiffies(100)); - /* IP might not be started or valid stream might not be present */ - if (ret <= 0) { - dev_dbg(dev->dev, "user data for channel %d timeout\n", - channel); - mchp_spdifrx_isr_blockend_dis(dev); - return ret ? : -ETIMEDOUT; + if (dev->trigger_enabled) { + reinit_completion(&user_data->done); + regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND); + ret = wait_for_completion_interruptible_timeout(&user_data->done, + msecs_to_jiffies(100)); + /* Valid stream might not be present. */ + if (ret <= 0) { + dev_dbg(dev->dev, "user data for channel %d timeout\n", + channel); + regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); + ret = ret ? : -ETIMEDOUT; + goto unlock; + } else { + ret = 0; + } + } else { + /* Update software cache with last available data. */ + mchp_spdifrx_channel_user_data_read(dev, channel); }
- spin_lock_irqsave(&user_data->lock, flags); memcpy(uvalue->value.iec958.subcode, user_data->data, sizeof(user_data->data)); - spin_unlock_irqrestore(&user_data->lock, flags);
- return 0; +unlock: + mutex_unlock(&dev->mlock); + return ret; }
static int mchp_spdifrx_subcode_ch1_get(struct snd_kcontrol *kcontrol, @@ -890,11 +904,9 @@ static int mchp_spdifrx_dai_probe(struct snd_soc_dai *dai) SPDIFRX_MR_AUTORST_NOACTION | SPDIFRX_MR_PACK_DISABLED);
- dev->blockend_refcount = 0; for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) { init_completion(&ctrl->ch_stat[ch].done); init_completion(&ctrl->user_data[ch].done); - spin_lock_init(&ctrl->user_data[ch].lock); }
/* Add controls */ @@ -1005,7 +1017,6 @@ static int mchp_spdifrx_probe(struct platform_device *pdev) */ clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1);
- spin_lock_init(&dev->blockend_lock); mutex_init(&dev->mlock);
dev->dev = &pdev->dev;
From: Claudiu Beznea claudiu.beznea@microchip.com
[ Upstream commit aaecdc32b7e35b4f9b457fb3509414aa9a932589 ]
CSC interrupts which might be used in controls are on bits 8 and 9 of SPDIFRX_IDR register. Thus disable all the interrupts that are exported by driver.
Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") Signed-off-by: Claudiu Beznea claudiu.beznea@microchip.com Link: https://lore.kernel.org/r/20230130120647.638049-5-claudiu.beznea@microchip.c... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/atmel/mchp-spdifrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c index 31ffaaf46dec0..b81fc77728dfc 100644 --- a/sound/soc/atmel/mchp-spdifrx.c +++ b/sound/soc/atmel/mchp-spdifrx.c @@ -921,7 +921,7 @@ static int mchp_spdifrx_dai_remove(struct snd_soc_dai *dai) struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai);
/* Disable interrupts */ - regmap_write(dev->regmap, SPDIFRX_IDR, 0xFF); + regmap_write(dev->regmap, SPDIFRX_IDR, GENMASK(14, 0));
clk_disable_unprepare(dev->pclk);
From: Mike Snitzer snitzer@kernel.org
[ Upstream commit c87791bcc455a91e51ca9800faaacc21c8d67785 ]
Commit e33c267ab70d ("mm: shrinkers: provide shrinkers with names") chose some fairly bad names for DM's shrinkers.
Fixes: e33c267ab70d ("mm: shrinkers: provide shrinkers with names") Signed-off-by : Mike Snitzer snitzer@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/md/dm-bufio.c | 2 +- drivers/md/dm-zoned-metadata.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c index bb786c39545ec..19caaf684ee34 100644 --- a/drivers/md/dm-bufio.c +++ b/drivers/md/dm-bufio.c @@ -1833,7 +1833,7 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign c->shrinker.scan_objects = dm_bufio_shrink_scan; c->shrinker.seeks = 1; c->shrinker.batch = 0; - r = register_shrinker(&c->shrinker, "md-%s:(%u:%u)", slab_name, + r = register_shrinker(&c->shrinker, "dm-bufio:(%u:%u)", MAJOR(bdev->bd_dev), MINOR(bdev->bd_dev)); if (r) goto bad; diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c index 0278482fac94a..c795ea7da7917 100644 --- a/drivers/md/dm-zoned-metadata.c +++ b/drivers/md/dm-zoned-metadata.c @@ -2945,7 +2945,7 @@ int dmz_ctr_metadata(struct dmz_dev *dev, int num_dev, zmd->mblk_shrinker.seeks = DEFAULT_SEEKS;
/* Metadata cache shrinker */ - ret = register_shrinker(&zmd->mblk_shrinker, "md-meta:(%u:%u)", + ret = register_shrinker(&zmd->mblk_shrinker, "dm-zoned-meta:(%u:%u)", MAJOR(dev->bdev->bd_dev), MINOR(dev->bdev->bd_dev)); if (ret) {
From: Daniel Golle daniel@makrotopia.org
[ Upstream commit 697c3892d825fb78f42ec8e53bed065dd728db3e ]
reg_base and reg_downshift currently don't have any effect if used with a regmap_bus or regmap_config which only offers single register operations (ie. reg_read, reg_write and optionally reg_update_bits).
Fix that and take them into account also for regmap_bus with only reg_read and read_write operations by applying reg_base and reg_downshift in _regmap_bus_reg_write, _regmap_bus_reg_read.
Also apply reg_base and reg_downshift in _regmap_update_bits, but only in case the operation is carried out with a reg_update_bits call defined in either regmap_bus or regmap_config.
Fixes: 0074f3f2b1e43d ("regmap: allow a defined reg_base to be added to every address") Fixes: 86fc59ef818beb ("regmap: add configurable downshift for addresses") Signed-off-by: Daniel Golle daniel@makrotopia.org Tested-by: Colin Foster colin.foster@in-advantage.com Link: https://lore.kernel.org/r/Y9clyVS3tQEHlUhA@makrotopia.org Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/regmap/regmap.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index d12d669157f24..d2a54eb0efd9b 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -1942,6 +1942,8 @@ static int _regmap_bus_reg_write(void *context, unsigned int reg, { struct regmap *map = context;
+ reg += map->reg_base; + reg >>= map->format.reg_downshift; return map->bus->reg_write(map->bus_context, reg, val); }
@@ -2840,6 +2842,8 @@ static int _regmap_bus_reg_read(void *context, unsigned int reg, { struct regmap *map = context;
+ reg += map->reg_base; + reg >>= map->format.reg_downshift; return map->bus->reg_read(map->bus_context, reg, val); }
@@ -3231,6 +3235,8 @@ static int _regmap_update_bits(struct regmap *map, unsigned int reg, *change = false;
if (regmap_volatile(map, reg) && map->reg_update_bits) { + reg += map->reg_base; + reg >>= map->format.reg_downshift; ret = map->reg_update_bits(map->bus_context, reg, mask, val); if (ret == 0 && change) *change = true;
Hi Greg,
On Tue, Mar 07, 2023 at 05:53:02PM +0100, Greg Kroah-Hartman wrote:
From: Daniel Golle daniel@makrotopia.org
[ Upstream commit 697c3892d825fb78f42ec8e53bed065dd728db3e ]
reg_base and reg_downshift currently don't have any effect if used with a regmap_bus or regmap_config which only offers single register operations (ie. reg_read, reg_write and optionally reg_update_bits).
Fix that and take them into account also for regmap_bus with only reg_read and read_write operations by applying reg_base and reg_downshift in _regmap_bus_reg_write, _regmap_bus_reg_read.
Also apply reg_base and reg_downshift in _regmap_update_bits, but only in case the operation is carried out with a reg_update_bits call defined in either regmap_bus or regmap_config.
I was waiting for this one to be back-ported. Anyone else can disagree with me, but I'm on the fence as to whether it should go back to stable branches.
The only user of reg_base and reg_downshift in 6.1 / 6.2 is drivers/mfd/ocelot-spi.c, and these don't use reg_read() or reg_write() so are unaffected by this fix.
On one hand, it isn't fixing any existing 'bugs'. On the other hand, the documentation I wrote was confusing / misleading, and people developing against the stable kernels might get behavior that they didn't expect. Daniel had the misfortune of experiencing this.
Again, I'm on the fence - I just want to make sure the scope is understood.
Thanks!
Fixes: 0074f3f2b1e43d ("regmap: allow a defined reg_base to be added to every address") Fixes: 86fc59ef818beb ("regmap: add configurable downshift for addresses") Signed-off-by: Daniel Golle daniel@makrotopia.org Tested-by: Colin Foster colin.foster@in-advantage.com Link: https://lore.kernel.org/r/Y9clyVS3tQEHlUhA@makrotopia.org Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org
drivers/base/regmap/regmap.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index d12d669157f24..d2a54eb0efd9b 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -1942,6 +1942,8 @@ static int _regmap_bus_reg_write(void *context, unsigned int reg, { struct regmap *map = context;
- reg += map->reg_base;
- reg >>= map->format.reg_downshift; return map->bus->reg_write(map->bus_context, reg, val);
} @@ -2840,6 +2842,8 @@ static int _regmap_bus_reg_read(void *context, unsigned int reg, { struct regmap *map = context;
- reg += map->reg_base;
- reg >>= map->format.reg_downshift; return map->bus->reg_read(map->bus_context, reg, val);
} @@ -3231,6 +3235,8 @@ static int _regmap_update_bits(struct regmap *map, unsigned int reg, *change = false; if (regmap_volatile(map, reg) && map->reg_update_bits) {
reg += map->reg_base;
ret = map->reg_update_bits(map->bus_context, reg, mask, val); if (ret == 0 && change) *change = true;reg >>= map->format.reg_downshift;
-- 2.39.2
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit 9f20c9f4b1e17e83e9ccc247cfdc0b61041bff3d ]
At the moment, accel drivers can be built-in even with CONFIG_DRM=m, but this causes a link failure:
x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_dev_init': ivpu_drv.c:(.text+0x1535): undefined reference to `drmm_kmalloc' x86_64-linux-ld: ivpu_drv.c:(.text+0x1562): undefined reference to `drmm_kmalloc' x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_remove': ivpu_drv.c:(.text+0x1faa): undefined reference to `drm_dev_unregister' x86_64-linux-ld: drivers/accel/ivpu/ivpu_drv.o: in function `ivpu_probe': ivpu_drv.c:(.text+0x1fef): undefined reference to `__devm_drm_dev_alloc'
The problem is that DRM_ACCEL is a 'bool' symbol, so driver that only depend on DRM_ACCEL but not also on DRM do not see the restriction to =m configs.
To ensure that each accel driver has an implied dependency on CONFIG_DRM, enclose the entire Kconfig file in an if/endif check.
Fixes: 8bf4889762a8 ("drivers/accel: define kconfig and register a new major") Signed-off-by: Arnd Bergmann arnd@arndb.de Reviewed-by: Stanislaw Gruszka stanislaw.gruszka@linux.intel.com Reviewed-by: Jeffrey Hugo quic_jhugo@quicinc.com Reviewed-by: Oded Gabbay ogabbay@kernel.org Signed-off-by: Jacek Lawrynowicz jacek.lawrynowicz@linux.intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230127221504.2522909-1-arnd@... (cherry picked from commit 3524c96a121952f214271622bb372661ced86101) Signed-off-by: Thomas Zimmermann tzimmermann@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/accel/Kconfig | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/Kconfig b/drivers/accel/Kconfig index c9ce849b2984a..c8177ae415b8b 100644 --- a/drivers/accel/Kconfig +++ b/drivers/accel/Kconfig @@ -6,9 +6,10 @@ # as, but not limited to, Machine-Learning and Deep-Learning acceleration # devices # +if DRM + menuconfig DRM_ACCEL bool "Compute Acceleration Framework" - depends on DRM help Framework for device drivers of compute acceleration devices, such as, but not limited to, Machine-Learning and Deep-Learning @@ -22,3 +23,5 @@ menuconfig DRM_ACCEL major number than GPUs, and will be exposed to user-space using different device files, called accel/accel* (in /dev, sysfs and debugfs). + +endif
From: Kuninori Morimoto kuninori.morimoto.gx@renesas.com
[ Upstream commit 49123b51cd896e00b256a27c2ce9e6bfe1bbc22f ]
commit 1f9c82b5ab83ff2 ("ASoC: rsnd: add debugfs support") added CONFIG_DEBUG_FS related definitions on rsnd.h, but it should be added inside of RSND_H. This patch fixup it.
Fixes: 1f9c82b5ab83 ("ASoC: rsnd: add debugfs support") Signed-off-by: Kuninori Morimoto kuninori.morimoto.gx@renesas.com Link: https://lore.kernel.org/r/877cx26t7r.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/sh/rcar/rsnd.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h index d9cd190d7e198..f8ef6836ef84e 100644 --- a/sound/soc/sh/rcar/rsnd.h +++ b/sound/soc/sh/rcar/rsnd.h @@ -901,8 +901,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type); if (!IS_BUILTIN(RSND_DEBUG_NO_DAI_CALL)) \ dev_dbg(dev, param)
-#endif - #ifdef CONFIG_DEBUG_FS int rsnd_debugfs_probe(struct snd_soc_component *component); void rsnd_debugfs_reg_show(struct seq_file *m, phys_addr_t _addr, @@ -913,3 +911,5 @@ void rsnd_debugfs_mod_reg_show(struct seq_file *m, struct rsnd_mod *mod, #else #define rsnd_debugfs_probe NULL #endif + +#endif /* RSND_H */
From: Nathan Chancellor nathan@kernel.org
[ Upstream commit 218674a45930c700486d27b765bf2f1b43f8cbf7 ]
Clang warns:
../sound/soc/atmel/mchp-spdifrx.c:455:3: error: variable 'mr' is uninitialized when used here [-Werror,-Wuninitialized] mr |= SPDIFRX_MR_ENDIAN_BIG; ^~ ../sound/soc/atmel/mchp-spdifrx.c:432:8: note: initialize the variable 'mr' to silence this warning u32 mr; ^ = 0 1 error generated.
Zero initialize mr so that these bitwise OR and assignment operation works unconditionally.
Fixes: fa09fa60385a ("ASoC: mchp-spdifrx: fix controls which rely on rsr register") Link: https://github.com/ClangBuiltLinux/linux/issues/1797 Signed-off-by: Nathan Chancellor nathan@kernel.org Reviewed-by: Claudiu Beznea claudiu.beznea@microchip.com Link: https://lore.kernel.org/r/20230202-mchp-spdifrx-fix-uninit-mr-v1-1-629a045d7... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/atmel/mchp-spdifrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c index b81fc77728dfc..76ce37f641ebd 100644 --- a/sound/soc/atmel/mchp-spdifrx.c +++ b/sound/soc/atmel/mchp-spdifrx.c @@ -362,7 +362,7 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) { struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); - u32 mr; + u32 mr = 0; int ret;
dev_dbg(dev->dev, "%s() rate=%u format=%#x width=%u channels=%u\n",
From: Jerome Brunet jbrunet@baylibre.com
[ Upstream commit 480b26226873c88e482575ceb0d0a38d76e1be57 ]
'codec' is a valid node name when there is a single codec in the link. Fix the node regular expression to apply this.
Fixes: fd00366b8e41 ("ASoC: meson: gx: add sound card dt-binding documentation") Signed-off-by: Jerome Brunet jbrunet@baylibre.com Reviewed-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Link: https://lore.kernel.org/r/20230202183653.486216-3-jbrunet@baylibre.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../devicetree/bindings/sound/amlogic,gx-sound-card.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml index 5b8d59245f82f..b358fd601ed38 100644 --- a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml +++ b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml @@ -62,7 +62,7 @@ patternProperties: description: phandle of the CPU DAI
patternProperties: - "^codec-[0-9]+$": + "^codec(-[0-9]+)?$": type: object additionalProperties: false description: |-
From: Jerome Neanne jneanne@baylibre.com
[ Upstream commit 0365df81145a4cfaae5f4da896160de512256e6d ]
Due to wrong interpretation of the specification, custom implementation was used instead of standard regmap helper. LINK: https://lore.kernel.org/all/c2014039-f1e8-6976-33d6-52e2dd4e7b66@baylibre.co...
Fixes: c12ac5fc3e0a ("regulator: drivers: Add TI TPS65219 PMIC regulators support")
Regulator does NOT require to be off to be switched to bypass mode.
Signed-off-by: Jerome Neanne jneanne@baylibre.com Link: https://lore.kernel.org/r/20230203140119.13029-1-jneanne@baylibre.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/regulator/tps65219-regulator.c | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-)
diff --git a/drivers/regulator/tps65219-regulator.c b/drivers/regulator/tps65219-regulator.c index 070159cb5f094..58f6541b6417b 100644 --- a/drivers/regulator/tps65219-regulator.c +++ b/drivers/regulator/tps65219-regulator.c @@ -173,24 +173,6 @@ static unsigned int tps65219_get_mode(struct regulator_dev *dev) return REGULATOR_MODE_NORMAL; }
-/* - * generic regulator_set_bypass_regmap does not fully match requirements - * TPS65219 Requires explicitly that regulator is disabled before switch - */ -static int tps65219_set_bypass(struct regulator_dev *dev, bool enable) -{ - struct tps65219 *tps = rdev_get_drvdata(dev); - unsigned int rid = rdev_get_id(dev); - - if (dev->desc->ops->is_enabled(dev)) { - dev_err(tps->dev, - "%s LDO%d enabled, must be shut down to set bypass ", - __func__, rid); - return -EBUSY; - } - return regulator_set_bypass_regmap(dev, enable); -} - /* Operations permitted on BUCK1/2/3 */ static const struct regulator_ops tps65219_bucks_ops = { .is_enabled = regulator_is_enabled_regmap, @@ -217,7 +199,7 @@ static const struct regulator_ops tps65219_ldos_1_2_ops = { .set_voltage_sel = regulator_set_voltage_sel_regmap, .list_voltage = regulator_list_voltage_linear_range, .map_voltage = regulator_map_voltage_linear_range, - .set_bypass = tps65219_set_bypass, + .set_bypass = regulator_set_bypass_regmap, .get_bypass = regulator_get_bypass_regmap, };
From: Eugene Shalygin eugene.shalygin@gmail.com
[ Upstream commit e2de0e6abd91b05411cb1f0953115dbbbe9b11ce ]
Add missing mutex path for ProArt X570-CREATOR WIFI.
Fixes: de8fbac5e59e (hwmon: (asus-ec-sensors) implement locking via the ACPI global lock) Signed-off-by: Eugene Shalygin eugene.shalygin@gmail.com Link: https://lore.kernel.org/r/20230121111728.168514-2-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwmon/asus-ec-sensors.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c index a901e4e33d81d..b4d65916b3c00 100644 --- a/drivers/hwmon/asus-ec-sensors.c +++ b/drivers/hwmon/asus-ec-sensors.c @@ -299,6 +299,7 @@ static const struct ec_board_info board_info_pro_art_x570_creator_wifi = { .sensors = SENSOR_SET_TEMP_CHIPSET_CPU_MB | SENSOR_TEMP_VRM | SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT | SENSOR_CURR_CPU | SENSOR_IN_CPU_CORE, + .mutex_path = ASUS_HW_ACCESS_MUTEX_ASMX, .family = family_amd_500_series, };
From: Jonathan Cormier jcormier@criticallink.com
[ Upstream commit 178b01eccfb0b8149682f61388400bd3d903dddc ]
ltc2945_val_to_reg errors were not being handled which would have resulted in register being set to 0 (clamped) instead of being left alone.
Fixes: 6700ce035f83 ("hwmon: Driver for Linear Technologies LTC2945")
Signed-off-by: Jonathan Cormier jcormier@criticallink.com Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwmon/ltc2945.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c index 9adebb59f6042..c06ab7317431f 100644 --- a/drivers/hwmon/ltc2945.c +++ b/drivers/hwmon/ltc2945.c @@ -248,6 +248,8 @@ static ssize_t ltc2945_value_store(struct device *dev,
/* convert to register value, then clamp and write result */ regval = ltc2945_val_to_reg(dev, reg, val); + if (regval < 0) + return regval; if (is_power_reg(reg)) { regval = clamp_val(regval, 0, 0xffffff); regbuf[0] = regval >> 16;
From: Jaroslav Kysela perex@perex.cz
[ Upstream commit d045bceff5a904bd79d71dede9f927c00ce4906f ]
Some motherboards have multiple HDA codecs connected to the serial bus. The current code may create multiple mixer controls with the almost identical identification.
The current code use id.device field from the control element structure to store the codec address to avoid such clashes for multiple codecs. Unfortunately, the user space do not handle this correctly. For mixer controls, only name and index are used for the identifiers.
This patch fixes this problem to compose the index using the codec address as an offset in case, when the control already exists. It is really unlikely that one codec will create 10 similar controls.
This patch adds new kernel module parameter 'ctl_dev_id' to allow select the old behaviour, too. The CONFIG_SND_HDA_CTL_DEV_ID Kconfig option sets the default value.
BugLink: https://github.com/alsa-project/alsa-lib/issues/294 BugLink: https://github.com/alsa-project/alsa-lib/issues/205 Fixes: 54d174031576 ("[ALSA] hda-codec - Fix connection list parsing") Fixes: 1afe206ab699 ("ALSA: hda - Try to find an empty control index when it's occupied") Signed-off-by: Jaroslav Kysela perex@perex.cz Link: https://lore.kernel.org/r/20230202092013.4066998-1-perex@perex.cz Signed-off-by: Takashi Iwai tiwai@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- include/sound/hda_codec.h | 1 + sound/pci/hda/Kconfig | 14 ++++++++++++++ sound/pci/hda/hda_codec.c | 13 ++++++++++--- sound/pci/hda/hda_controller.c | 1 + sound/pci/hda/hda_controller.h | 1 + sound/pci/hda/hda_intel.c | 5 +++++ 6 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h index eba23daf2c290..bbb7805e85d8e 100644 --- a/include/sound/hda_codec.h +++ b/include/sound/hda_codec.h @@ -259,6 +259,7 @@ struct hda_codec { unsigned int relaxed_resume:1; /* don't resume forcibly for jack */ unsigned int forced_resume:1; /* forced resume for jack */ unsigned int no_stream_clean_at_suspend:1; /* do not clean streams at suspend */ + unsigned int ctl_dev_id:1; /* old control element id build behaviour */
#ifdef CONFIG_PM unsigned long power_on_acct; diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig index 06d304db4183c..886255a03e8b4 100644 --- a/sound/pci/hda/Kconfig +++ b/sound/pci/hda/Kconfig @@ -302,6 +302,20 @@ config SND_HDA_INTEL_HDMI_SILENT_STREAM This feature can impact power consumption as resources are kept reserved both at transmitter and receiver.
+config SND_HDA_CTL_DEV_ID + bool "Use the device identifier field for controls" + depends on SND_HDA_INTEL + help + Say Y to use the device identifier field for (mixer) + controls (old behaviour until this option is available). + + When enabled, the multiple HDA codecs may set the device + field in control (mixer) element identifiers. The use + of this field is not recommended and defined for mixer controls. + + The old behaviour (Y) is obsolete and will be removed. Consider + to not enable this option. + endif
endmenu diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 2e728aad67713..9f79c0ac2bda7 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -3389,7 +3389,12 @@ int snd_hda_add_new_ctls(struct hda_codec *codec, kctl = snd_ctl_new1(knew, codec); if (!kctl) return -ENOMEM; - if (addr > 0) + /* Do not use the id.device field for MIXER elements. + * This field is for real device numbers (like PCM) but codecs + * are hidden components from the user space view (unrelated + * to the mixer element identification). + */ + if (addr > 0 && codec->ctl_dev_id) kctl->id.device = addr; if (idx > 0) kctl->id.index = idx; @@ -3400,9 +3405,11 @@ int snd_hda_add_new_ctls(struct hda_codec *codec, * the codec addr; if it still fails (or it's the * primary codec), then try another control index */ - if (!addr && codec->core.addr) + if (!addr && codec->core.addr) { addr = codec->core.addr; - else if (!idx && !knew->index) { + if (!codec->ctl_dev_id) + idx += 10 * addr; + } else if (!idx && !knew->index) { idx = find_empty_mixer_ctl_idx(codec, knew->name, 0); if (idx <= 0) diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c index 0ff286b7b66be..083df287c1a48 100644 --- a/sound/pci/hda/hda_controller.c +++ b/sound/pci/hda/hda_controller.c @@ -1231,6 +1231,7 @@ int azx_probe_codecs(struct azx *chip, unsigned int max_slots) continue; codec->jackpoll_interval = chip->jackpoll_interval; codec->beep_mode = chip->beep_mode; + codec->ctl_dev_id = chip->ctl_dev_id; codecs++; } } diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h index f5bf295eb8307..8556031bcd68e 100644 --- a/sound/pci/hda/hda_controller.h +++ b/sound/pci/hda/hda_controller.h @@ -124,6 +124,7 @@ struct azx { /* HD codec */ int codec_probe_mask; /* copied from probe_mask option */ unsigned int beep_mode; + bool ctl_dev_id;
#ifdef CONFIG_SND_HDA_PATCH_LOADER const struct firmware *fw; diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 87002670c0c92..2dbc082076f69 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -119,6 +119,7 @@ static bool beep_mode[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS-1)] = CONFIG_SND_HDA_INPUT_BEEP_MODE}; #endif static bool dmic_detect = 1; +static bool ctl_dev_id = IS_ENABLED(CONFIG_SND_HDA_CTL_DEV_ID) ? 1 : 0;
module_param_array(index, int, NULL, 0444); MODULE_PARM_DESC(index, "Index value for Intel HD audio interface."); @@ -157,6 +158,8 @@ module_param(dmic_detect, bool, 0444); MODULE_PARM_DESC(dmic_detect, "Allow DSP driver selection (bypass this driver) " "(0=off, 1=on) (default=1); " "deprecated, use snd-intel-dspcfg.dsp_driver option instead"); +module_param(ctl_dev_id, bool, 0444); +MODULE_PARM_DESC(ctl_dev_id, "Use control device identifier (based on codec address).");
#ifdef CONFIG_PM static int param_set_xint(const char *val, const struct kernel_param *kp); @@ -2278,6 +2281,8 @@ static int azx_probe_continue(struct azx *chip) chip->beep_mode = beep_mode[dev]; #endif
+ chip->ctl_dev_id = ctl_dev_id; + /* create codec instances */ if (bus->codec_mask) { err = azx_probe_codecs(chip, azx_max_codecs[chip->driver_type]);
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit 087bad7eb1f6945f8232f132953ecc2bda8bd38d ]
A conversion from 'bool' to 'enum odm_combine_mode' was incomplete, and gcc warns about this with many instances of
display/dc/dml/dcn20/display_mode_vba_20.c:3899:44: warning: implicit conversion from 'enum <anonymous>' to 'enum odm_combine_mode' [-Wenum-conversion] 3899 | locals->ODMCombineEnablePerState[i][k] = false;
Change the ones that we get a warning for, using the same numerical values to leave the behavior unchanged.
Fixes: 5fc11598166d ("drm/amd/display: expand dml structs") Link: https://lore.kernel.org/all/20201026210039.3884312-3-arnd@kernel.org/ Link: https://lore.kernel.org/all/20210927100659.1431744-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann arnd@arndb.de Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 ++++---- .../amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +++++----- .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 ++++++------ 3 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c index d3b5b6fedf042..6266b0788387e 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c @@ -3897,14 +3897,14 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
- locals->ODMCombineEnablePerState[i][k] = false; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; if (mode_lib->vba.ODMCapability) { if (locals->PlaneRequiredDISPCLKWithoutODMCombine > mode_lib->vba.MaxDispclkRoundedDownToDFSGranularity) { - locals->ODMCombineEnablePerState[i][k] = true; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { - locals->ODMCombineEnablePerState[i][k] = true; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; } } @@ -3957,7 +3957,7 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l locals->RequiredDISPCLK[i][j] = 0.0; locals->DISPCLK_DPPCLK_Support[i][j] = true; for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { - locals->ODMCombineEnablePerState[i][k] = false; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { locals->NoOfDPP[i][j][k] = 1; locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c index edd098c7eb927..989d83ee38421 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c @@ -4008,17 +4008,17 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
- locals->ODMCombineEnablePerState[i][k] = false; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; if (mode_lib->vba.ODMCapability) { if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) { - locals->ODMCombineEnablePerState[i][k] = true; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN20_MAX_DSC_IMAGE_WIDTH)) { - locals->ODMCombineEnablePerState[i][k] = true; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { - locals->ODMCombineEnablePerState[i][k] = true; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; } } @@ -4071,7 +4071,7 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode locals->RequiredDISPCLK[i][j] = 0.0; locals->DISPCLK_DPPCLK_Support[i][j] = true; for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { - locals->ODMCombineEnablePerState[i][k] = false; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { locals->NoOfDPP[i][j][k] = 1; locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c index 1d84ae50311d9..b7c2844d0cbee 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c @@ -4102,17 +4102,17 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0);
- locals->ODMCombineEnablePerState[i][k] = false; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; if (mode_lib->vba.ODMCapability) { if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) { - locals->ODMCombineEnablePerState[i][k] = true; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN21_MAX_DSC_IMAGE_WIDTH)) { - locals->ODMCombineEnablePerState[i][k] = true; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; } else if (locals->HActive[k] > DCN21_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { - locals->ODMCombineEnablePerState[i][k] = true; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; } } @@ -4165,7 +4165,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l locals->RequiredDISPCLK[i][j] = 0.0; locals->DISPCLK_DPPCLK_Support[i][j] = true; for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { - locals->ODMCombineEnablePerState[i][k] = false; + locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { locals->NoOfDPP[i][j][k] = 1; locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] @@ -5230,7 +5230,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l mode_lib->vba.ODMCombineEnabled[k] = locals->ODMCombineEnablePerState[mode_lib->vba.VoltageLevel][k]; } else { - mode_lib->vba.ODMCombineEnabled[k] = false; + mode_lib->vba.ODMCombineEnabled[k] = dm_odm_combine_mode_disabled; } mode_lib->vba.DSCEnabled[k] = locals->RequiresDSC[mode_lib->vba.VoltageLevel][k];
From: Tomas Henzl thenzl@redhat.com
[ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ]
Add a forgotten kfree().
Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl thenzl@redhat.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 69061545d9d2f..2ee9ea57554d7 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -5849,6 +5849,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n",
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit 32fe45274edb5926abc0fac7263d9f889d02d9cf ]
Add check for dma_map_single() and return error if it fails in order to avoid invalid DMA address.
Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") Link: https://lore.kernel.org/r/20230128110832.6792-1-jiasheng@iscas.ac.cn Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Reviewed-by: Jason Yan yanaijie@huawei.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/scsi/aic94xx/aic94xx_task.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c index ed119a3f6f2ed..7f02083001100 100644 --- a/drivers/scsi/aic94xx/aic94xx_task.c +++ b/drivers/scsi/aic94xx/aic94xx_task.c @@ -50,6 +50,9 @@ static int asd_map_scatterlist(struct sas_task *task, dma_addr_t dma = dma_map_single(&asd_ha->pcidev->dev, p, task->total_xfer_len, task->data_dir); + if (dma_mapping_error(&asd_ha->pcidev->dev, dma)) + return -ENOMEM; + sg_arr[0].bus_addr = cpu_to_le64((u64)dma); sg_arr[0].size = cpu_to_le32(task->total_xfer_len); sg_arr[0].flags |= ASD_SG_EL_LIST_EOL;
From: Allen Ballway ballway@chromium.org
[ Upstream commit a2f416bf062a38bb76cccd526d2d286b8e4db4d9 ]
Certain touchscreen devices, such as the ELAN9034, are oriented incorrectly and report touches on opposite points on the X and Y axes. For example, a 100x200 screen touched at (10,20) would report (90, 180) and vice versa.
This is fixed by adding device quirks to transform the touch points into the correct spaces, from X -> MAX(X) - X, and Y -> MAX(Y) - Y.
Signed-off-by: Allen Ballway ballway@chromium.org Signed-off-by: Jiri Kosina jkosina@suse.cz Stable-dep-of: 03a86105556e ("HID: retain initial quirks set up when creating HID devices") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-multitouch.c | 39 ++++++++++++++++++--- drivers/hid/hid-quirks.c | 6 ++++ drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 43 ++++++++++++++++++++++++ drivers/hid/i2c-hid/i2c-hid.h | 3 ++ 4 files changed, 87 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index 372cbdd223e09..e31be0cb8b850 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -71,6 +71,7 @@ MODULE_LICENSE("GPL"); #define MT_QUIRK_SEPARATE_APP_REPORT BIT(19) #define MT_QUIRK_FORCE_MULTI_INPUT BIT(20) #define MT_QUIRK_DISABLE_WAKEUP BIT(21) +#define MT_QUIRK_ORIENTATION_INVERT BIT(22)
#define MT_INPUTMODE_TOUCHSCREEN 0x02 #define MT_INPUTMODE_TOUCHPAD 0x03 @@ -1009,6 +1010,7 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, struct mt_usages *slot) { struct input_mt *mt = input->mt; + struct hid_device *hdev = td->hdev; __s32 quirks = app->quirks; bool valid = true; bool confidence_state = true; @@ -1086,6 +1088,10 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, int orientation = wide; int max_azimuth; int azimuth; + int x; + int y; + int cx; + int cy;
if (slot->a != DEFAULT_ZERO) { /* @@ -1104,6 +1110,9 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, if (azimuth > max_azimuth * 2) azimuth -= max_azimuth * 4; orientation = -azimuth; + if (quirks & MT_QUIRK_ORIENTATION_INVERT) + orientation = -orientation; + }
if (quirks & MT_QUIRK_TOUCH_SIZE_SCALING) { @@ -1115,10 +1124,23 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, minor = minor >> 1; }
- input_event(input, EV_ABS, ABS_MT_POSITION_X, *slot->x); - input_event(input, EV_ABS, ABS_MT_POSITION_Y, *slot->y); - input_event(input, EV_ABS, ABS_MT_TOOL_X, *slot->cx); - input_event(input, EV_ABS, ABS_MT_TOOL_Y, *slot->cy); + x = hdev->quirks & HID_QUIRK_X_INVERT ? + input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->x : + *slot->x; + y = hdev->quirks & HID_QUIRK_Y_INVERT ? + input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->y : + *slot->y; + cx = hdev->quirks & HID_QUIRK_X_INVERT ? + input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->cx : + *slot->cx; + cy = hdev->quirks & HID_QUIRK_Y_INVERT ? + input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->cy : + *slot->cy; + + input_event(input, EV_ABS, ABS_MT_POSITION_X, x); + input_event(input, EV_ABS, ABS_MT_POSITION_Y, y); + input_event(input, EV_ABS, ABS_MT_TOOL_X, cx); + input_event(input, EV_ABS, ABS_MT_TOOL_Y, cy); input_event(input, EV_ABS, ABS_MT_DISTANCE, !*slot->tip_state); input_event(input, EV_ABS, ABS_MT_ORIENTATION, orientation); input_event(input, EV_ABS, ABS_MT_PRESSURE, *slot->p); @@ -1735,6 +1757,15 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID) td->serial_maybe = true;
+ + /* Orientation is inverted if the X or Y axes are + * flipped, but normalized if both are inverted. + */ + if (hdev->quirks & (HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT) && + !((hdev->quirks & HID_QUIRK_X_INVERT) + && (hdev->quirks & HID_QUIRK_Y_INVERT))) + td->mtclass.quirks = MT_QUIRK_ORIENTATION_INVERT; + /* This allows the driver to correctly support devices * that emit events over several HID messages. */ diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c index 5bc91f68b3747..30e35f79def47 100644 --- a/drivers/hid/hid-quirks.c +++ b/drivers/hid/hid-quirks.c @@ -19,6 +19,7 @@ #include <linux/input/elan-i2c-ids.h>
#include "hid-ids.h" +#include "i2c-hid/i2c-hid.h"
/* * Alphabetically sorted by vendor then product. @@ -1298,6 +1299,11 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev) quirks = hid_gets_squirk(hdev); mutex_unlock(&dquirks_lock);
+ /* Get quirks specific to I2C devices */ + if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) && + hdev->bus == BUS_I2C) + quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product); + return quirks; } EXPORT_SYMBOL_GPL(hid_lookup_quirk); diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c index 8e0f67455c098..554a7dc285365 100644 --- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c @@ -10,8 +10,10 @@ #include <linux/types.h> #include <linux/dmi.h> #include <linux/mod_devicetable.h> +#include <linux/hid.h>
#include "i2c-hid.h" +#include "../hid-ids.h"
struct i2c_hid_desc_override { @@ -416,6 +418,28 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { { } /* Terminate list */ };
+static const struct hid_device_id i2c_hid_elan_flipped_quirks = { + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_ELAN, 0x2dcd), + HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT +}; + +/* + * This list contains devices which have specific issues based on the system + * they're on and not just the device itself. The driver_data will have a + * specific hid device to match against. + */ +static const struct dmi_system_id i2c_hid_dmi_quirk_table[] = { + { + .ident = "DynaBook K50/FR", + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dynabook Inc."), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "dynabook K50/FR"), + }, + .driver_data = (void *)&i2c_hid_elan_flipped_quirks, + }, + { } /* Terminate list */ +}; +
struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name) { @@ -450,3 +474,22 @@ char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, *size = override->hid_report_desc_size; return override->hid_report_desc; } + +u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) +{ + u32 quirks = 0; + const struct dmi_system_id *system_id = + dmi_first_match(i2c_hid_dmi_quirk_table); + + if (system_id) { + const struct hid_device_id *device_id = + (struct hid_device_id *)(system_id->driver_data); + + if (device_id && device_id->vendor == vendor && + device_id->product == product) + quirks = device_id->driver_data; + } + + return quirks; +} +EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks); diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h index 96c75510ad3f1..2c7b66d5caa0f 100644 --- a/drivers/hid/i2c-hid/i2c-hid.h +++ b/drivers/hid/i2c-hid/i2c-hid.h @@ -9,6 +9,7 @@ struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name); char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, unsigned int *size); +u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product); #else static inline struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name) @@ -16,6 +17,8 @@ static inline struct i2c_hid_desc static inline char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, unsigned int *size) { return NULL; } +static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) +{ return 0; } #endif
/**
From: Dmitry Torokhov dmitry.torokhov@gmail.com
[ Upstream commit 03a86105556e23650e4470c09f91cf7c360d5e28 ]
In certain circumstances, such as when creating I2C-connected HID devices, we want to pass and retain some quirks (axis inversion, etc). The source of such quirks may be device tree, or DMI data, or something else not readily available to the HID core itself and therefore cannot be reconstructed easily. To allow this, introduce "initial_quirks" field in hid_device structure and use it when determining the final set of quirks.
This fixes the problem with i2c-hid setting up device-tree sourced quirks too late and losing them on device rebind, and also allows to sever the tie between hid-code and i2c-hid when applying DMI-based quirks.
Fixes: b60d3c803d76 ("HID: i2c-hid-of: Expose the touchscreen-inverted properties") Fixes: a2f416bf062a ("HID: multitouch: Add quirks for flipped axes") Reviewed-by: Guenter Roeck groeck@chromium.org Tested-by: Allen Ballway ballway@chromium.org Signed-off-by: Dmitry Torokhov dmitry.torokhov@gmail.com Reviewed-by: Alistair Francis alistair@alistair23.me Link: https://lore.kernel.org/r/Y+LYwu3Zs13hdVDy@google.com Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-quirks.c | 8 +------- drivers/hid/i2c-hid/i2c-hid-core.c | 6 ++++-- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 1 - include/linux/hid.h | 1 + 4 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c index 30e35f79def47..66e64350f1386 100644 --- a/drivers/hid/hid-quirks.c +++ b/drivers/hid/hid-quirks.c @@ -19,7 +19,6 @@ #include <linux/input/elan-i2c-ids.h>
#include "hid-ids.h" -#include "i2c-hid/i2c-hid.h"
/* * Alphabetically sorted by vendor then product. @@ -1238,7 +1237,7 @@ EXPORT_SYMBOL_GPL(hid_quirks_exit); static unsigned long hid_gets_squirk(const struct hid_device *hdev) { const struct hid_device_id *bl_entry; - unsigned long quirks = 0; + unsigned long quirks = hdev->initial_quirks;
if (hid_match_id(hdev, hid_ignore_list)) quirks |= HID_QUIRK_IGNORE; @@ -1299,11 +1298,6 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev) quirks = hid_gets_squirk(hdev); mutex_unlock(&dquirks_lock);
- /* Get quirks specific to I2C devices */ - if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) && - hdev->bus == BUS_I2C) - quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product); - return quirks; } EXPORT_SYMBOL_GPL(hid_lookup_quirk); diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index b86b62f971080..72f2c379812c7 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -1035,6 +1035,10 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID); hid->product = le16_to_cpu(ihid->hdesc.wProductID);
+ hid->initial_quirks = quirks; + hid->initial_quirks |= i2c_hid_get_dmi_quirks(hid->vendor, + hid->product); + snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", client->name, (u16)hid->vendor, (u16)hid->product); strscpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys)); @@ -1048,8 +1052,6 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, goto err_mem_free; }
- hid->quirks |= quirks; - return 0;
err_mem_free: diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c index 554a7dc285365..210f17c3a0be0 100644 --- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c @@ -492,4 +492,3 @@ u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
return quirks; } -EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks); diff --git a/include/linux/hid.h b/include/linux/hid.h index 8677ae38599e4..48563dc09e171 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -619,6 +619,7 @@ struct hid_device { /* device report descriptor */ unsigned long status; /* see STAT flags above */ unsigned claimed; /* Claimed by hidinput, hiddev? */ unsigned quirks; /* Various quirks the device can pull on us */ + unsigned initial_quirks; /* Initial set of quirks supplied when creating device */ bool io_started; /* If IO has started */
struct list_head inputs; /* The list of inputs */
From: Srinivas Kandagatla srinivas.kandagatla@linaro.org
[ Upstream commit c2ac3aec474da0455df79c4a182f19687bc98d1d ]
prepare callback can be called multiple times, so unprepare the stream if its already prepared.
Without this DSP is not happy to setting the params on a already prepared graph.
Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support") Signed-off-by: Srinivas Kandagatla srinivas.kandagatla@linaro.org Link: https://lore.kernel.org/r/20230209122806.18923-2-srinivas.kandagatla@linaro.... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/qcom/qdsp6/q6apm-lpass-dais.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c index ce9e5646d8f3a..23d23bc6fbaa7 100644 --- a/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c +++ b/sound/soc/qcom/qdsp6/q6apm-lpass-dais.c @@ -127,6 +127,11 @@ static int q6apm_lpass_dai_prepare(struct snd_pcm_substream *substream, struct s int graph_id = dai->id; int rc;
+ if (dai_data->is_port_started[dai->id]) { + q6apm_graph_stop(dai_data->graph[dai->id]); + dai_data->is_port_started[dai->id] = false; + } + /** * It is recommend to load DSP with source graph first and then sink * graph, so sequence for playback and capture will be different
From: Srinivas Kandagatla srinivas.kandagatla@linaro.org
[ Upstream commit 84222ef54bfd8f043c23c8603fd5257a64b00780 ]
It is noticed that the position pointer value seems to get a get corrupted due to missing locking between updating and reading.
Fix this by adding a spinlock around the position pointer.
Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support") Signed-off-by: Srinivas Kandagatla srinivas.kandagatla@linaro.org Link: https://lore.kernel.org/r/20230209122806.18923-3-srinivas.kandagatla@linaro.... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/qcom/qdsp6/q6apm-dai.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c index ee59ef36b85a6..bd35067a40521 100644 --- a/sound/soc/qcom/qdsp6/q6apm-dai.c +++ b/sound/soc/qcom/qdsp6/q6apm-dai.c @@ -8,6 +8,7 @@ #include <linux/slab.h> #include <sound/soc.h> #include <sound/soc-dapm.h> +#include <linux/spinlock.h> #include <sound/pcm.h> #include <asm/dma.h> #include <linux/dma-mapping.h> @@ -53,6 +54,7 @@ struct q6apm_dai_rtd { uint16_t session_id; enum stream_state state; struct q6apm_graph *graph; + spinlock_t lock; };
struct q6apm_dai_data { @@ -99,20 +101,25 @@ static void event_handler(uint32_t opcode, uint32_t token, uint32_t *payload, vo { struct q6apm_dai_rtd *prtd = priv; struct snd_pcm_substream *substream = prtd->substream; + unsigned long flags;
switch (opcode) { case APM_CLIENT_EVENT_CMD_EOS_DONE: prtd->state = Q6APM_STREAM_STOPPED; break; case APM_CLIENT_EVENT_DATA_WRITE_DONE: + spin_lock_irqsave(&prtd->lock, flags); prtd->pos += prtd->pcm_count; + spin_unlock_irqrestore(&prtd->lock, flags); snd_pcm_period_elapsed(substream); if (prtd->state == Q6APM_STREAM_RUNNING) q6apm_write_async(prtd->graph, prtd->pcm_count, 0, 0, 0);
break; case APM_CLIENT_EVENT_DATA_READ_DONE: + spin_lock_irqsave(&prtd->lock, flags); prtd->pos += prtd->pcm_count; + spin_unlock_irqrestore(&prtd->lock, flags); snd_pcm_period_elapsed(substream); if (prtd->state == Q6APM_STREAM_RUNNING) q6apm_read(prtd->graph); @@ -253,6 +260,7 @@ static int q6apm_dai_open(struct snd_soc_component *component, if (prtd == NULL) return -ENOMEM;
+ spin_lock_init(&prtd->lock); prtd->substream = substream; prtd->graph = q6apm_graph_open(dev, (q6apm_cb)event_handler, prtd, graph_id); if (IS_ERR(prtd->graph)) { @@ -332,11 +340,17 @@ static snd_pcm_uframes_t q6apm_dai_pointer(struct snd_soc_component *component, { struct snd_pcm_runtime *runtime = substream->runtime; struct q6apm_dai_rtd *prtd = runtime->private_data; + snd_pcm_uframes_t ptr; + unsigned long flags;
+ spin_lock_irqsave(&prtd->lock, flags); if (prtd->pos == prtd->pcm_size) prtd->pos = 0;
- return bytes_to_frames(runtime, prtd->pos); + ptr = bytes_to_frames(runtime, prtd->pos); + spin_unlock_irqrestore(&prtd->lock, flags); + + return ptr; }
static int q6apm_dai_hw_params(struct snd_soc_component *component,
From: Srinivas Kandagatla srinivas.kandagatla@linaro.org
[ Upstream commit aa759f3f9f4394a3af65ad1772fca6cb9dd9e4cc ]
At the moment, playing audio with PulseAudio with the qdsp6 driver results in distorted sound. It seems like its timer-based scheduling does not work properly with qdsp6 since setting tsched=0 in the PulseAudio configuration avoids the issue.
Apparently this happens when the pointer() callback is not accurate enough. There is a SNDRV_PCM_INFO_BATCH flag that can be used to stop PulseAudio from using timer-based scheduling by default.
According to https://www.alsa-project.org/pipermail/alsa-devel/2014-March/073816.html:
The flag is being used in the sense explained in the previous audio meeting -- the data transfer granularity isn't fine enough but aligned to the period size (or less).
q6apm-dai reports the position as multiple of
prtd->pcm_count = snd_pcm_lib_period_bytes(substream)
so it indeed just a multiple of the period size.
Therefore adding the flag here seems appropriate and makes audio work out of the box.
Comment log inspired by Stephan Gerhold sent for q6asm-dai.c few years back.
Fixes: 9b4fe0f1cd79 ("ASoC: qdsp6: audioreach: add q6apm-dai support") Signed-off-by: Srinivas Kandagatla srinivas.kandagatla@linaro.org Link: https://lore.kernel.org/r/20230209122806.18923-4-srinivas.kandagatla@linaro.... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/qcom/qdsp6/q6apm-dai.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/soc/qcom/qdsp6/q6apm-dai.c b/sound/soc/qcom/qdsp6/q6apm-dai.c index bd35067a40521..7f02f5b2c33fd 100644 --- a/sound/soc/qcom/qdsp6/q6apm-dai.c +++ b/sound/soc/qcom/qdsp6/q6apm-dai.c @@ -64,7 +64,8 @@ struct q6apm_dai_data { static struct snd_pcm_hardware q6apm_dai_hardware_capture = { .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_BLOCK_TRANSFER | SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_INTERLEAVED | - SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME), + SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME | + SNDRV_PCM_INFO_BATCH), .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE), .rates = SNDRV_PCM_RATE_8000_48000, .rate_min = 8000, @@ -82,7 +83,8 @@ static struct snd_pcm_hardware q6apm_dai_hardware_capture = { static struct snd_pcm_hardware q6apm_dai_hardware_playback = { .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_BLOCK_TRANSFER | SNDRV_PCM_INFO_MMAP_VALID | SNDRV_PCM_INFO_INTERLEAVED | - SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME), + SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_RESUME | + SNDRV_PCM_INFO_BATCH), .formats = (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE), .rates = SNDRV_PCM_RATE_8000_192000, .rate_min = 8000,
From: Srinivas Kandagatla srinivas.kandagatla@linaro.org
[ Upstream commit 1dc3459009c33e335f0d62b84dd39a6bbd7fd5d2 ]
move mclk out registration after runtime pm is enabled so that the clk framework can resume the codec if it requires to enable the mclk out.
Fixes: c96baa2949b2 ("ASoC: codecs: wsa-macro: add runtime pm support") Fixes: 72ad25eabda0 ("ASoC: codecs: va-macro: add runtime pm support") Fixes: 366ff79ed539 ("ASoC: codecs: rx-macro: add runtime pm support") Fixes: 1fb83bc5cf64 ("ASoC: codecs: tx-macro: add runtime pm support") Signed-off-by: Srinivas Kandagatla srinivas.kandagatla@linaro.org Link: https://lore.kernel.org/r/20230209122806.18923-6-srinivas.kandagatla@linaro.... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/codecs/lpass-rx-macro.c | 8 ++++---- sound/soc/codecs/lpass-tx-macro.c | 8 ++++---- sound/soc/codecs/lpass-va-macro.c | 20 ++++++++++---------- sound/soc/codecs/lpass-wsa-macro.c | 9 ++++----- 4 files changed, 22 insertions(+), 23 deletions(-)
diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c index a9ef9d5ffcc5c..dd6970d5eb8d1 100644 --- a/sound/soc/codecs/lpass-rx-macro.c +++ b/sound/soc/codecs/lpass-rx-macro.c @@ -3601,10 +3601,6 @@ static int rx_macro_probe(struct platform_device *pdev) if (ret) goto err_fsgen;
- ret = rx_macro_register_mclk_output(rx); - if (ret) - goto err_clkout; - ret = devm_snd_soc_register_component(dev, &rx_macro_component_drv, rx_macro_dai, ARRAY_SIZE(rx_macro_dai)); @@ -3618,6 +3614,10 @@ static int rx_macro_probe(struct platform_device *pdev) pm_runtime_set_active(dev); pm_runtime_enable(dev);
+ ret = rx_macro_register_mclk_output(rx); + if (ret) + goto err_clkout; + return 0;
err_clkout: diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c index 2ef62d6edc302..b9475ba55e203 100644 --- a/sound/soc/codecs/lpass-tx-macro.c +++ b/sound/soc/codecs/lpass-tx-macro.c @@ -2036,10 +2036,6 @@ static int tx_macro_probe(struct platform_device *pdev) if (ret) goto err_fsgen;
- ret = tx_macro_register_mclk_output(tx); - if (ret) - goto err_clkout; - ret = devm_snd_soc_register_component(dev, &tx_macro_component_drv, tx_macro_dai, ARRAY_SIZE(tx_macro_dai)); @@ -2052,6 +2048,10 @@ static int tx_macro_probe(struct platform_device *pdev) pm_runtime_set_active(dev); pm_runtime_enable(dev);
+ ret = tx_macro_register_mclk_output(tx); + if (ret) + goto err_clkout; + return 0;
err_clkout: diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c index b0b6cf29cba30..1623ba78ddb3d 100644 --- a/sound/soc/codecs/lpass-va-macro.c +++ b/sound/soc/codecs/lpass-va-macro.c @@ -1524,16 +1524,6 @@ static int va_macro_probe(struct platform_device *pdev) if (ret) goto err_mclk;
- ret = va_macro_register_fsgen_output(va); - if (ret) - goto err_clkout; - - va->fsgen = clk_hw_get_clk(&va->hw, "fsgen"); - if (IS_ERR(va->fsgen)) { - ret = PTR_ERR(va->fsgen); - goto err_clkout; - } - if (va->has_swr_master) { /* Set default CLK div to 1 */ regmap_update_bits(va->regmap, CDC_VA_TOP_CSR_SWR_MIC_CTL0, @@ -1560,6 +1550,16 @@ static int va_macro_probe(struct platform_device *pdev) pm_runtime_set_active(dev); pm_runtime_enable(dev);
+ ret = va_macro_register_fsgen_output(va); + if (ret) + goto err_clkout; + + va->fsgen = clk_hw_get_clk(&va->hw, "fsgen"); + if (IS_ERR(va->fsgen)) { + ret = PTR_ERR(va->fsgen); + goto err_clkout; + } + return 0;
err_clkout: diff --git a/sound/soc/codecs/lpass-wsa-macro.c b/sound/soc/codecs/lpass-wsa-macro.c index 5cfe96f6e430e..c0b86d69c72e3 100644 --- a/sound/soc/codecs/lpass-wsa-macro.c +++ b/sound/soc/codecs/lpass-wsa-macro.c @@ -2451,11 +2451,6 @@ static int wsa_macro_probe(struct platform_device *pdev) if (ret) goto err_fsgen;
- ret = wsa_macro_register_mclk_output(wsa); - if (ret) - goto err_clkout; - - ret = devm_snd_soc_register_component(dev, &wsa_macro_component_drv, wsa_macro_dai, ARRAY_SIZE(wsa_macro_dai)); @@ -2468,6 +2463,10 @@ static int wsa_macro_probe(struct platform_device *pdev) pm_runtime_set_active(dev); pm_runtime_enable(dev);
+ ret = wsa_macro_register_mclk_output(wsa); + if (ret) + goto err_clkout; + return 0;
err_clkout:
From: Srinivas Kandagatla srinivas.kandagatla@linaro.org
[ Upstream commit e7621434378c40b62ef858c14ae6415fb6469a8e ]
For some reason we ended up with incorrect mclk rate which should be 1920000 instead of 96000, So far we were getting lucky as the same clk is set to 192000 by wsa and va macro. This issue is discovered when there is no wsa macro active and only rx or tx path is tested. Fix this by setting correct rate.
Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro") Fixes: af3d54b99764 ("ASoC: codecs: lpass-rx-macro: add support for lpass rx macro") Signed-off-by: Srinivas Kandagatla srinivas.kandagatla@linaro.org Link: https://lore.kernel.org/r/20230209122806.18923-7-srinivas.kandagatla@linaro.... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/codecs/lpass-rx-macro.c | 4 ++-- sound/soc/codecs/lpass-tx-macro.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c index dd6970d5eb8d1..8621cfabcf5b6 100644 --- a/sound/soc/codecs/lpass-rx-macro.c +++ b/sound/soc/codecs/lpass-rx-macro.c @@ -366,7 +366,7 @@ #define CDC_RX_DSD1_CFG2 (0x0F8C) #define RX_MAX_OFFSET (0x0F8C)
-#define MCLK_FREQ 9600000 +#define MCLK_FREQ 19200000
#define RX_MACRO_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\ SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\ @@ -3579,7 +3579,7 @@ static int rx_macro_probe(struct platform_device *pdev)
/* set MCLK and NPL rates */ clk_set_rate(rx->mclk, MCLK_FREQ); - clk_set_rate(rx->npl, 2 * MCLK_FREQ); + clk_set_rate(rx->npl, MCLK_FREQ);
ret = clk_prepare_enable(rx->macro); if (ret) diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c index b9475ba55e203..2449a2df66df0 100644 --- a/sound/soc/codecs/lpass-tx-macro.c +++ b/sound/soc/codecs/lpass-tx-macro.c @@ -203,7 +203,7 @@ #define TX_MACRO_AMIC_UNMUTE_DELAY_MS 100 #define TX_MACRO_DMIC_HPF_DELAY_MS 300 #define TX_MACRO_AMIC_HPF_DELAY_MS 300 -#define MCLK_FREQ 9600000 +#define MCLK_FREQ 19200000
enum { TX_MACRO_AIF_INVALID = 0, @@ -2014,7 +2014,7 @@ static int tx_macro_probe(struct platform_device *pdev)
/* set MCLK and NPL rates */ clk_set_rate(tx->mclk, MCLK_FREQ); - clk_set_rate(tx->npl, 2 * MCLK_FREQ); + clk_set_rate(tx->npl, MCLK_FREQ);
ret = clk_prepare_enable(tx->macro); if (ret)
From: William Zhang william.zhang@broadcom.com
[ Upstream commit 85a84a61699990db6a025b5073f337f49933a875 ]
HSSPI controller uses big endian for the opcode in the message to the controller ping pong buffer. Use cpu_to_be16 to properly handle the endianness for both big and little endian host.
Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver") Signed-off-by: Kursad Oney kursad.oney@broadcom.com Signed-off-by: William Zhang william.zhang@broadcom.com Acked-by: Florian Fainelli f.fainelli@gmail.com
Link: https://lore.kernel.org/r/20230207065826.285013-7-william.zhang@broadcom.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/spi/spi-bcm63xx-hsspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c index b871fd810d801..a74345ed0e2ff 100644 --- a/drivers/spi/spi-bcm63xx-hsspi.c +++ b/drivers/spi/spi-bcm63xx-hsspi.c @@ -194,7 +194,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) tx += curr_step; }
- __raw_writew(opcode | curr_step, bs->fifo); + __raw_writew((u16)cpu_to_be16(opcode | curr_step), bs->fifo);
/* enable interrupt */ __raw_writel(HSSPI_PINGx_CMD_DONE(0),
From: Hamza Mahfooz hamza.mahfooz@amd.com
[ Upstream commit 4936458bf989d168f5a89015dd81067c4c2bdc64 ]
As made mention of in commit 4ea7fc09539b ("drm/amd/display: Do not program interrupt status on disabled crtc"), we shouldn't program disabled crtcs. So, filter out disabled crtcs in dm_set_vupdate_irq() and dm_set_vblank().
Reviewed-by: Harry Wentland harry.wentland@amd.com Fixes: 589d2739332d ("drm/amd/display: Use crtc enable/disable_vblank hooks") Fixes: d2574c33bb71 ("drm/amd/display: In VRR mode, do DRM core vblank handling at end of vblank. (v2)") Signed-off-by: Hamza Mahfooz hamza.mahfooz@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c index 22125daf9dcfe..78c2ed59e87d2 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c @@ -77,6 +77,9 @@ int dm_set_vupdate_irq(struct drm_crtc *crtc, bool enable) struct amdgpu_device *adev = drm_to_adev(crtc->dev); int rc;
+ if (acrtc->otg_inst == -1) + return 0; + irq_source = IRQ_TYPE_VUPDATE + acrtc->otg_inst;
rc = dc_interrupt_set(adev->dm.dc, irq_source, enable) ? 0 : -EBUSY; @@ -152,6 +155,9 @@ static inline int dm_set_vblank(struct drm_crtc *crtc, bool enable) struct vblank_control_work *work; int rc = 0;
+ if (acrtc->otg_inst == -1) + goto skip; + if (enable) { /* vblank irq on -> Only need vupdate irq in vrr mode */ if (amdgpu_dm_vrr_active(acrtc_state)) @@ -169,6 +175,7 @@ static inline int dm_set_vblank(struct drm_crtc *crtc, bool enable) if (!dc_interrupt_set(adev->dm.dc, irq_source, enable)) return -EBUSY;
+skip: if (amdgpu_in_reset(adev)) return 0;
From: Bastien Nocera hadess@hadess.net
[ Upstream commit 719acb4d3b7accc9cfbaf21c1c2d51dc7384aee2 ]
HID++ 1.0 devices only export whether Fast Scrolling is enabled, not whether they are capable of it. Reinstate the original quirks for the 3 supported mice so fast scrolling works again on those devices.
Fixes: 908d325e1665 ("HID: logitech-hidpp: Detect hi-res scrolling support") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216903 Signed-off-by: Bastien Nocera hadess@hadess.net Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Link: https://lore.kernel.org/r/20230116130937.391441-1-hadess@hadess.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-logitech-hidpp.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c index 9c1ee8e91e0ca..0c024ec1452cd 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -77,6 +77,7 @@ MODULE_PARM_DESC(disable_tap_to_click, #define HIDPP_QUIRK_HIDPP_WHEELS BIT(26) #define HIDPP_QUIRK_HIDPP_EXTRA_MOUSE_BTNS BIT(27) #define HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS BIT(28) +#define HIDPP_QUIRK_HI_RES_SCROLL_1P0 BIT(29)
/* These are just aliases for now */ #define HIDPP_QUIRK_KBD_SCROLL_WHEEL HIDPP_QUIRK_HIDPP_WHEELS @@ -3472,14 +3473,8 @@ static int hidpp_initialize_hires_scroll(struct hidpp_device *hidpp) hid_dbg(hidpp->hid_dev, "Detected HID++ 2.0 hi-res scrolling\n"); } } else { - struct hidpp_report response; - - ret = hidpp_send_rap_command_sync(hidpp, - REPORT_ID_HIDPP_SHORT, - HIDPP_GET_REGISTER, - HIDPP_ENABLE_FAST_SCROLL, - NULL, 0, &response); - if (!ret) { + /* We cannot detect fast scrolling support on HID++ 1.0 devices */ + if (hidpp->quirks & HIDPP_QUIRK_HI_RES_SCROLL_1P0) { hidpp->capabilities |= HIDPP_CAPABILITY_HIDPP10_FAST_SCROLL; hid_dbg(hidpp->hid_dev, "Detected HID++ 1.0 fast scroll\n"); } @@ -4297,9 +4292,15 @@ static const struct hid_device_id hidpp_devices[] = { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_T651), .driver_data = HIDPP_QUIRK_CLASS_WTP }, + { /* Mouse Logitech Anywhere MX */ + LDJ_DEVICE(0x1017), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 }, { /* Mouse logitech M560 */ LDJ_DEVICE(0x402d), .driver_data = HIDPP_QUIRK_DELAYED_INIT | HIDPP_QUIRK_CLASS_M560 }, + { /* Mouse Logitech M705 (firmware RQM17) */ + LDJ_DEVICE(0x101b), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 }, + { /* Mouse Logitech Performance MX */ + LDJ_DEVICE(0x101a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_1P0 }, { /* Keyboard logitech K400 */ LDJ_DEVICE(0x4024), .driver_data = HIDPP_QUIRK_CLASS_K400 },
From: William Zhang william.zhang@broadcom.com
[ Upstream commit 811ff802aaf878ebbbaeac0307a0164fa21e7d40 ]
Currently the driver always sets the controller to dual data bit mode for both tx and rx data in the profile mode control register even for single data bit transfer. Luckily the opcode is set correctly according to SPI transfer data bit width so it does not actually cause issues.
This change fixes the problem by setting tx and rx data bit mode field correctly according to the actual SPI transfer tx and rx data bit width.
Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver") Signed-off-by: William Zhang william.zhang@broadcom.com Link: https://lore.kernel.org/r/20230209200246.141520-11-william.zhang@broadcom.co... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/spi/spi-bcm63xx-hsspi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c index a74345ed0e2ff..9ec33745c1472 100644 --- a/drivers/spi/spi-bcm63xx-hsspi.c +++ b/drivers/spi/spi-bcm63xx-hsspi.c @@ -163,6 +163,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) int step_size = HSSPI_BUFFER_LEN; const u8 *tx = t->tx_buf; u8 *rx = t->rx_buf; + u32 val = 0;
bcm63xx_hsspi_set_clk(bs, spi, t->speed_hz); bcm63xx_hsspi_set_cs(bs, spi->chip_select, true); @@ -178,11 +179,16 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) step_size -= HSSPI_OPCODE_LEN;
if ((opcode == HSSPI_OP_READ && t->rx_nbits == SPI_NBITS_DUAL) || - (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) + (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) { opcode |= HSSPI_OP_MULTIBIT;
- __raw_writel(1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT | - 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT | 0xff, + if (t->rx_nbits == SPI_NBITS_DUAL) + val |= 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT; + if (t->tx_nbits == SPI_NBITS_DUAL) + val |= 1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT; + } + + __raw_writel(val | 0xff, bs->regs + HSSPI_PROFILE_MODE_CTRL_REG(chip_select));
while (pending > 0) {
From: Vadim Pasternak vadimp@nvidia.com
[ Upstream commit a1ffd3c46267ee5c807acd780e15df9bb692223f ]
Currently for broken fan driver returns value calculated based on error code (0xFF) in related fan speed register. Thus, for such fan user gets fan{n}_fault to 1 and fan{n}_input with misleading value.
Add check for fan fault prior return speed value and return zero if fault is detected.
Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver") Signed-off-by: Vadim Pasternak vadimp@nvidia.com Link: https://lore.kernel.org/r/20230212145730.24247-1-vadimp@nvidia.com Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwmon/mlxreg-fan.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c index b48bd7c961d66..96017cc8da7ec 100644 --- a/drivers/hwmon/mlxreg-fan.c +++ b/drivers/hwmon/mlxreg-fan.c @@ -155,6 +155,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, if (err) return err;
+ if (MLXREG_FAN_GET_FAULT(regval, tacho->mask)) { + /* FAN is broken - return zero for FAN speed. */ + *val = 0; + return 0; + } + *val = MLXREG_FAN_GET_RPM(regval, fan->divider, fan->samples); break;
From: Steffen Aschbacher steffen.aschbacher@stihl.de
[ Upstream commit 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d ]
When the 'ti,gpio-config' property is not defined, the device_property_count_u32() will return an error, rather than zero.
The current check, only handles a return value of zero, which assumes that the property is defined and has nothing defined.
This change extends the check to also check for an error case (most likely to be hit by the case that the 'ti,gpio-config' is not defined).
In case that the 'ti,gpio-config' and the returned 'gpio_count' is not correct, there is a 'if (gpio_count != ADCX140_NUM_GPIO_CFGS)' check, a few lines lower that will return -EINVAL. This means that someone tried to define 'ti,gpio-config', but with the wrong number of GPIOs.
Fixes: d5214321498a ("ASoC: tlv320adcx140: Add support for configuring GPIO pin") Signed-off-by: Steffen Aschbacher steffen.aschbacher@stihl.de Signed-off-by: Alexandru Ardelean alex@shruggie.ro Link: https://lore.kernel.org/r/20230213073805.14640-1-alex@shruggie.ro Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/codecs/tlv320adcx140.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c index 91a22d9279158..530f321d08e9c 100644 --- a/sound/soc/codecs/tlv320adcx140.c +++ b/sound/soc/codecs/tlv320adcx140.c @@ -925,7 +925,7 @@ static int adcx140_configure_gpio(struct adcx140_priv *adcx140)
gpio_count = device_property_count_u32(adcx140->dev, "ti,gpio-config"); - if (gpio_count == 0) + if (gpio_count <= 0) return 0;
if (gpio_count != ADCX140_NUM_GPIO_CFGS)
From: Mike Snitzer snitzer@kernel.org
[ Upstream commit 0b22ff5360f5c4e11050b89206370fdf7dc0a226 ]
Commit acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal") switched from using system workqueue to a single workqueue local to DM. But it didn't eliminate the call to flush_scheduled_work() that was introduced purely for the benefit of deferred device removal with commit 2c140a246dc ("dm: allow remove to be deferred").
Since DM core uses its own workqueue (and queue_work) there is no need to call flush_scheduled_work() from local_exit(). local_exit()'s destroy_workqueue(deferred_remove_workqueue) handles flushing work started with queue_work().
Fixes: acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal") Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/md/dm.c | 1 - 1 file changed, 1 deletion(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c index b424a6ee27baf..eba9bc06856bf 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -231,7 +231,6 @@ static int __init local_init(void)
static void local_exit(void) { - flush_scheduled_work(); destroy_workqueue(deferred_remove_workqueue);
unregister_blkdev(_major, _name);
From: Benjamin Coddington bcodding@redhat.com
[ Upstream commit b46d80bd2d6e7e063c625a20de54248afe8d4889 ]
__print_flags wants a mask, not the enum value. Add two more flags.
Fixes: 511ba52e4c01 ("NFS4: Trace state recovery operation") Signed-off-by: Benjamin Coddington bcodding@redhat.com Signed-off-by: Anna Schumaker Anna.Schumaker@Netapp.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfs/nfs4trace.h | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-)
diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h index 214bc56f92d2b..d27919d7241d3 100644 --- a/fs/nfs/nfs4trace.h +++ b/fs/nfs/nfs4trace.h @@ -292,32 +292,34 @@ TRACE_DEFINE_ENUM(NFS4CLNT_MOVED); TRACE_DEFINE_ENUM(NFS4CLNT_LEASE_MOVED); TRACE_DEFINE_ENUM(NFS4CLNT_DELEGATION_EXPIRED); TRACE_DEFINE_ENUM(NFS4CLNT_RUN_MANAGER); +TRACE_DEFINE_ENUM(NFS4CLNT_MANAGER_AVAILABLE); TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_RUNNING); TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_READ); TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_RW); +TRACE_DEFINE_ENUM(NFS4CLNT_DELEGRETURN_DELAYED);
#define show_nfs4_clp_state(state) \ __print_flags(state, "|", \ - { NFS4CLNT_MANAGER_RUNNING, "MANAGER_RUNNING" }, \ - { NFS4CLNT_CHECK_LEASE, "CHECK_LEASE" }, \ - { NFS4CLNT_LEASE_EXPIRED, "LEASE_EXPIRED" }, \ - { NFS4CLNT_RECLAIM_REBOOT, "RECLAIM_REBOOT" }, \ - { NFS4CLNT_RECLAIM_NOGRACE, "RECLAIM_NOGRACE" }, \ - { NFS4CLNT_DELEGRETURN, "DELEGRETURN" }, \ - { NFS4CLNT_SESSION_RESET, "SESSION_RESET" }, \ - { NFS4CLNT_LEASE_CONFIRM, "LEASE_CONFIRM" }, \ - { NFS4CLNT_SERVER_SCOPE_MISMATCH, \ - "SERVER_SCOPE_MISMATCH" }, \ - { NFS4CLNT_PURGE_STATE, "PURGE_STATE" }, \ - { NFS4CLNT_BIND_CONN_TO_SESSION, \ - "BIND_CONN_TO_SESSION" }, \ - { NFS4CLNT_MOVED, "MOVED" }, \ - { NFS4CLNT_LEASE_MOVED, "LEASE_MOVED" }, \ - { NFS4CLNT_DELEGATION_EXPIRED, "DELEGATION_EXPIRED" }, \ - { NFS4CLNT_RUN_MANAGER, "RUN_MANAGER" }, \ - { NFS4CLNT_RECALL_RUNNING, "RECALL_RUNNING" }, \ - { NFS4CLNT_RECALL_ANY_LAYOUT_READ, "RECALL_ANY_LAYOUT_READ" }, \ - { NFS4CLNT_RECALL_ANY_LAYOUT_RW, "RECALL_ANY_LAYOUT_RW" }) + { BIT(NFS4CLNT_MANAGER_RUNNING), "MANAGER_RUNNING" }, \ + { BIT(NFS4CLNT_CHECK_LEASE), "CHECK_LEASE" }, \ + { BIT(NFS4CLNT_LEASE_EXPIRED), "LEASE_EXPIRED" }, \ + { BIT(NFS4CLNT_RECLAIM_REBOOT), "RECLAIM_REBOOT" }, \ + { BIT(NFS4CLNT_RECLAIM_NOGRACE), "RECLAIM_NOGRACE" }, \ + { BIT(NFS4CLNT_DELEGRETURN), "DELEGRETURN" }, \ + { BIT(NFS4CLNT_SESSION_RESET), "SESSION_RESET" }, \ + { BIT(NFS4CLNT_LEASE_CONFIRM), "LEASE_CONFIRM" }, \ + { BIT(NFS4CLNT_SERVER_SCOPE_MISMATCH), "SERVER_SCOPE_MISMATCH" }, \ + { BIT(NFS4CLNT_PURGE_STATE), "PURGE_STATE" }, \ + { BIT(NFS4CLNT_BIND_CONN_TO_SESSION), "BIND_CONN_TO_SESSION" }, \ + { BIT(NFS4CLNT_MOVED), "MOVED" }, \ + { BIT(NFS4CLNT_LEASE_MOVED), "LEASE_MOVED" }, \ + { BIT(NFS4CLNT_DELEGATION_EXPIRED), "DELEGATION_EXPIRED" }, \ + { BIT(NFS4CLNT_RUN_MANAGER), "RUN_MANAGER" }, \ + { BIT(NFS4CLNT_MANAGER_AVAILABLE), "MANAGER_AVAILABLE" }, \ + { BIT(NFS4CLNT_RECALL_RUNNING), "RECALL_RUNNING" }, \ + { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_READ), "RECALL_ANY_LAYOUT_READ" }, \ + { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_RW), "RECALL_ANY_LAYOUT_RW" }, \ + { BIT(NFS4CLNT_DELEGRETURN_DELAYED), "DELERETURN_DELAYED" })
TRACE_EVENT(nfs4_state_mgr, TP_PROTO(
From: NeilBrown neilb@suse.de
[ Upstream commit 5bab56fff53ce161ed859d9559a10361d4f79578 ]
When swap is activated to a file on an NFSv4 mount we arrange that the state manager thread is always present as starting a new thread requires memory allocations that might block waiting for swap.
Unfortunately the code for allowing the state manager thread to exit when swap is disabled was not tested properly and does not work. This can be seen by examining /proc/fs/nfsfs/servers after disabling swap and unmounting the filesystem. The servers file will still list one entry. Also a "ps" listing will show the state manager thread is still present.
There are two problems. 1/ rpc_clnt_swap_deactivate() doesn't walk up the ->cl_parent list to find the primary client on which the state manager runs.
2/ The thread is not woken up properly and it immediately goes back to sleep without checking whether it is really needed. Using nfs4_schedule_state_manager() ensures a proper wake-up.
Reported-by: Olga Kornievskaia aglo@umich.edu Fixes: 4dc73c679114 ("NFSv4: keep state manager thread active if swap is enabled") Signed-off-by: NeilBrown neilb@suse.de Signed-off-by: Anna Schumaker Anna.Schumaker@Netapp.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfs/nfs4proc.c | 4 +++- net/sunrpc/clnt.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 40d749f29ed3f..4214286e01450 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -10604,7 +10604,9 @@ static void nfs4_disable_swap(struct inode *inode) /* The state manager thread will now exit once it is * woken. */ - wake_up_var(&NFS_SERVER(inode)->nfs_client->cl_state); + struct nfs_client *clp = NFS_SERVER(inode)->nfs_client; + + nfs4_schedule_state_manager(clp); }
static const struct inode_operations nfs4_dir_inode_operations = { diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index 0b0b9f1eed469..fd7e1c630493e 100644 --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c @@ -3350,6 +3350,8 @@ rpc_clnt_swap_deactivate_callback(struct rpc_clnt *clnt, void rpc_clnt_swap_deactivate(struct rpc_clnt *clnt) { + while (clnt != clnt->cl_parent) + clnt = clnt->cl_parent; if (atomic_dec_if_positive(&clnt->cl_swapper) == 0) rpc_clnt_iterate_for_each_xprt(clnt, rpc_clnt_swap_deactivate_callback, NULL);
From: Wayne Boyer wayne.boyer@intel.com
[ Upstream commit e3995e08a39a41691742b380023a0d480247afb0 ]
As per the performance tuning guide, set the HOSTCACHEEN bit to implement the recommended caching policy on PVC.
Signed-off-by: Wayne Boyer wayne.boyer@intel.com Reviewed-by: Matt Roper matthew.d.roper@intel.com Signed-off-by: Matt Roper matthew.d.roper@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20221130170723.2460014-1-wayne... Stable-dep-of: effc0905d741 ("drm/i915/pvc: Annotate two more workaround/tuning registers as MCR") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/i915/gt/intel_gt_regs.h | 1 + drivers/gpu/drm/i915/gt/intel_workarounds.c | 1 + 2 files changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h index 0c7e7972cc1c4..838f73165ebbc 100644 --- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h +++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h @@ -970,6 +970,7 @@ #define GEN7_L3AGDIS (1 << 19)
#define XEHPC_LNCFMISCCFGREG0 _MMIO(0xb01c) +#define XEHPC_HOSTCACHEEN REG_BIT(1) #define XEHPC_OVRLSCCC REG_BIT(0)
#define GEN7_L3CNTLREG2 _MMIO(0xb020) diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c index dcc694b8bc8c7..c2d9d07af7ee9 100644 --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c @@ -2973,6 +2973,7 @@ add_render_compute_tuning_settings(struct drm_i915_private *i915, if (IS_PONTEVECCHIO(i915)) { wa_write(wal, XEHPC_L3SCRUB, SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK); + wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN); }
if (IS_DG2(i915)) {
From: Matt Roper matthew.d.roper@intel.com
[ Upstream commit effc0905d741b4138806747407baf8de98390c72 ]
XEHPC_LNCFMISCCFGREG0 and XEHPC_L3SCRUB are both in MCR register ranges on PVC (with HALFBSLICE and L3BANK replication respectively), so they should be explicitly declared as MCR registers and use MCR-aware workaround handlers.
The workarounds/tuning settings should still be applied properly on PVC even without the MCR annotation, but readback verification on CONFIG_DRM_I915_DEBUG_GEM builds could potentitally give false positive "workaround lost on load" warnings on parts fused such that a unicast read targets a terminated register instance.
Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly") Signed-off-by: Matt Roper matthew.d.roper@intel.com Reviewed-by: Gustavo Sousa gustavo.sousa@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230201222831.608281-1-matthe... (cherry picked from commit 4039e44237e8ebb06f0e4af549fbedf7c41df9db) Signed-off-by: Jani Nikula jani.nikula@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/i915/gt/intel_gt_regs.h | 4 ++-- drivers/gpu/drm/i915/gt/intel_workarounds.c | 14 ++++++++++---- 2 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h index 838f73165ebbc..0d47c930956e0 100644 --- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h +++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h @@ -969,7 +969,7 @@ #define GEN7_WA_FOR_GEN7_L3_CONTROL 0x3C47FF8C #define GEN7_L3AGDIS (1 << 19)
-#define XEHPC_LNCFMISCCFGREG0 _MMIO(0xb01c) +#define XEHPC_LNCFMISCCFGREG0 MCR_REG(0xb01c) #define XEHPC_HOSTCACHEEN REG_BIT(1) #define XEHPC_OVRLSCCC REG_BIT(0)
@@ -1032,7 +1032,7 @@ #define XEHP_L3SCQREG7 MCR_REG(0xb188) #define BLEND_FILL_CACHING_OPT_DIS REG_BIT(3)
-#define XEHPC_L3SCRUB _MMIO(0xb18c) +#define XEHPC_L3SCRUB MCR_REG(0xb18c) #define SCRUB_CL_DWNGRADE_SHARED REG_BIT(12) #define SCRUB_RATE_PER_BANK_MASK REG_GENMASK(2, 0) #define SCRUB_RATE_4B_PER_CLK REG_FIELD_PREP(SCRUB_RATE_PER_BANK_MASK, 0x6) diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c index c2d9d07af7ee9..80b0e9a56330c 100644 --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c @@ -224,6 +224,12 @@ wa_write(struct i915_wa_list *wal, i915_reg_t reg, u32 set) wa_write_clr_set(wal, reg, ~0, set); }
+static void +wa_mcr_write(struct i915_wa_list *wal, i915_mcr_reg_t reg, u32 set) +{ + wa_mcr_write_clr_set(wal, reg, ~0, set); +} + static void wa_write_or(struct i915_wa_list *wal, i915_reg_t reg, u32 set) { @@ -2971,9 +2977,9 @@ add_render_compute_tuning_settings(struct drm_i915_private *i915, struct i915_wa_list *wal) { if (IS_PONTEVECCHIO(i915)) { - wa_write(wal, XEHPC_L3SCRUB, - SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK); - wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN); + wa_mcr_write(wal, XEHPC_L3SCRUB, + SCRUB_CL_DWNGRADE_SHARED | SCRUB_RATE_4B_PER_CLK); + wa_mcr_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_HOSTCACHEEN); }
if (IS_DG2(i915)) { @@ -3038,7 +3044,7 @@ general_render_compute_wa_init(struct intel_engine_cs *engine, struct i915_wa_li
if (IS_PONTEVECCHIO(i915)) { /* Wa_16016694945 */ - wa_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC); + wa_mcr_masked_en(wal, XEHPC_LNCFMISCCFGREG0, XEHPC_OVRLSCCC); }
if (IS_XEHPSDV(i915)) {
From: Lucas De Marchi lucas.demarchi@intel.com
[ Upstream commit 6a8b2e4984f73f8d00c8c16b87a8b115d34088e4 ]
Register 0x9424 is not replicated on any platform, so it shouldn't be declared with REG_MCR(). Declaring it with _MMIO() is basically duplicate of the GEN7 version, so just remove the GEN8 and change all the callers to use the right functions.
Old versions of the gen8 bspec page used to contain a table with MCR registers, apparently implying 0x9400 - 0x94ff registers were replicated. However that table went away and there is no information related to the ranges for gen8 anymore. Moreover the current behavior of the driver wouldn't do anything special for 0x9424 since there is no equivalent table in intel_gt_mcr.c: the driver would just fallback to intel_uncore_{read,write}(). Therefore, do not care about the possible special case for gen8 and just use the register as non-MCR for all the platforms.
One place doing read + write is also converted to intel_uncore_rmw().
v2: Reword commit message adding the justification wrt gen8
Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly") Cc: Balasubramani Vivekanandan balasubramani.vivekanandan@intel.com Cc: Rodrigo Vivi rodrigo.vivi@intel.com Cc: Gustavo Sousa gustavo.sousa@intel.com Cc: Matt Atwood matthew.s.atwood@intel.com Cc: Ashutosh Dixit ashutosh.dixit@intel.com Signed-off-by: Lucas De Marchi lucas.demarchi@intel.com Reviewed-by: Matt Roper matthew.d.roper@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230206165410.3056073-1-lucas... (cherry picked from commit 869bace73ae2b4227e57ee3fd994bfa7d4808938) Signed-off-by: Jani Nikula jani.nikula@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/i915/gt/intel_gt_regs.h | 5 +---- drivers/gpu/drm/i915/gt/intel_workarounds.c | 4 ++-- drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c | 5 ++--- drivers/gpu/drm/i915/intel_pm.c | 10 +++++----- 4 files changed, 10 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h index 0d47c930956e0..3b6ef0eb47e76 100644 --- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h +++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h @@ -681,10 +681,7 @@ #define GEN6_RSTCTL _MMIO(0x9420)
#define GEN7_MISCCPCTL _MMIO(0x9424) -#define GEN7_DOP_CLOCK_GATE_ENABLE (1 << 0) - -#define GEN8_MISCCPCTL MCR_REG(0x9424) -#define GEN8_DOP_CLOCK_GATE_ENABLE REG_BIT(0) +#define GEN7_DOP_CLOCK_GATE_ENABLE REG_BIT(0) #define GEN12_DOP_CLOCK_GATE_RENDER_ENABLE REG_BIT(1) #define GEN8_DOP_CLOCK_GATE_CFCLK_ENABLE (1 << 2) #define GEN8_DOP_CLOCK_GATE_GUC_ENABLE (1 << 4) diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c index 80b0e9a56330c..d92b006d4cd2e 100644 --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c @@ -1673,7 +1673,7 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) wa_mcr_write_or(wal, XEHP_SQCM, EN_32B_ACCESS);
/* Wa_14015795083 */ - wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); + wa_write_clr(wal, GEN7_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE);
/* Wa_18018781329 */ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); @@ -1692,7 +1692,7 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) pvc_init_mcr(gt, wal);
/* Wa_14015795083 */ - wa_mcr_write_clr(wal, GEN8_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE); + wa_write_clr(wal, GEN7_MISCCPCTL, GEN12_DOP_CLOCK_GATE_RENDER_ENABLE);
/* Wa_18018781329 */ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c index 5b86b2e286e07..42c5d9d2e2182 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_fw.c @@ -38,9 +38,8 @@ static void guc_prepare_xfer(struct intel_gt *gt)
if (GRAPHICS_VER(uncore->i915) == 9) { /* DOP Clock Gating Enable for GuC clocks */ - intel_gt_mcr_multicast_write(gt, GEN8_MISCCPCTL, - GEN8_DOP_CLOCK_GATE_GUC_ENABLE | - intel_gt_mcr_read_any(gt, GEN8_MISCCPCTL)); + intel_uncore_rmw(uncore, GEN7_MISCCPCTL, 0, + GEN8_DOP_CLOCK_GATE_GUC_ENABLE);
/* allows for 5us (in 10ns units) before GT can go to RC6 */ intel_uncore_write(uncore, GUC_ARAT_C6DIS, 0x1FF); diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c index 73c88b1c9545c..ac61df46d02c5 100644 --- a/drivers/gpu/drm/i915/intel_pm.c +++ b/drivers/gpu/drm/i915/intel_pm.c @@ -4299,8 +4299,8 @@ static void gen8_set_l3sqc_credits(struct drm_i915_private *dev_priv, u32 val;
/* WaTempDisableDOPClkGating:bdw */ - misccpctl = intel_gt_mcr_multicast_rmw(to_gt(dev_priv), GEN8_MISCCPCTL, - GEN8_DOP_CLOCK_GATE_ENABLE, 0); + misccpctl = intel_uncore_rmw(&dev_priv->uncore, GEN7_MISCCPCTL, + GEN7_DOP_CLOCK_GATE_ENABLE, 0);
val = intel_gt_mcr_read_any(to_gt(dev_priv), GEN8_L3SQCREG1); val &= ~L3_PRIO_CREDITS_MASK; @@ -4314,7 +4314,7 @@ static void gen8_set_l3sqc_credits(struct drm_i915_private *dev_priv, */ intel_gt_mcr_read_any(to_gt(dev_priv), GEN8_L3SQCREG1); udelay(1); - intel_gt_mcr_multicast_write(to_gt(dev_priv), GEN8_MISCCPCTL, misccpctl); + intel_uncore_write(&dev_priv->uncore, GEN7_MISCCPCTL, misccpctl); }
static void icl_init_clock_gating(struct drm_i915_private *dev_priv) @@ -4465,8 +4465,8 @@ static void skl_init_clock_gating(struct drm_i915_private *dev_priv) gen9_init_clock_gating(dev_priv);
/* WaDisableDopClockGating:skl */ - intel_gt_mcr_multicast_rmw(to_gt(dev_priv), GEN8_MISCCPCTL, - GEN8_DOP_CLOCK_GATE_ENABLE, 0); + intel_uncore_rmw(&dev_priv->uncore, GEN7_MISCCPCTL, + GEN7_DOP_CLOCK_GATE_ENABLE, 0);
/* WAC6entrylatency:skl */ intel_uncore_rmw(&dev_priv->uncore, FBC_LLC_READ_CTRL, 0, FBC_LLC_FULLY_OPEN);
From: Christophe JAILLET christophe.jaillet@wanadoo.fr
[ Upstream commit e6a0b671880207566e1ece983bf989dde60bc1d7 ]
wait_for_completion_timeout() never returns a <0 value. It returns either on timeout or a positive value (at least 1, or number of jiffies left till timeout)
So, fix the error handling path and return -ETIMEDOUT should a timeout occur.
Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform") Signed-off-by: Christophe JAILLET christophe.jaillet@wanadoo.fr Acked-by: Jassi Brar jaswinder.singh@linaro.org Link: https://lore.kernel.org/r/c2040bf3cfa201fd8890cfab14fa5a701ffeca14.167646607... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/spi/spi-synquacer.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c index 47cbe73137c23..dc188f9202c97 100644 --- a/drivers/spi/spi-synquacer.c +++ b/drivers/spi/spi-synquacer.c @@ -472,10 +472,9 @@ static int synquacer_spi_transfer_one(struct spi_master *master, read_fifo(sspi); }
- if (status < 0) { - dev_err(sspi->dev, "failed to transfer. status: 0x%x\n", - status); - return status; + if (status == 0) { + dev_err(sspi->dev, "failed to transfer. Timeout.\n"); + return -ETIMEDOUT; }
return 0;
From: Lucas Tanure lucas.tanure@collabora.com
[ Upstream commit fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b ]
Add struct snd_pcm_substream forward declaration
Fixes: 078a85f2806f ("ASoC: dapm: Only power up active channels from a DAI") Signed-off-by: Lucas Tanure lucas.tanure@collabora.com Reviewed-by: Charles Keepax ckeepax@opensource.cirrus.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20230215132851.1626881-1-lucas.tanure@collabora.co... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- include/sound/soc-dapm.h | 1 + 1 file changed, 1 insertion(+)
diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h index 77495e5988c12..64915ebd641ee 100644 --- a/include/sound/soc-dapm.h +++ b/include/sound/soc-dapm.h @@ -16,6 +16,7 @@ #include <sound/asoc.h>
struct device; +struct snd_pcm_substream; struct snd_soc_pcm_runtime; struct soc_enum;
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 ]
bigben driver has a worker that may access data concurrently. Proct the accesses using a spinlock.
Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-1-7860c5763c38@dia... Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-bigbenff.c | 52 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 50 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c index e8b16665860d6..ed3d2d7bc1dd4 100644 --- a/drivers/hid/hid-bigbenff.c +++ b/drivers/hid/hid-bigbenff.c @@ -174,6 +174,7 @@ static __u8 pid0902_rdesc_fixed[] = { struct bigben_device { struct hid_device *hid; struct hid_report *report; + spinlock_t lock; bool removed; u8 led_state; /* LED1 = 1 .. LED4 = 8 */ u8 right_motor_on; /* right motor off/on 0/1 */ @@ -190,12 +191,27 @@ static void bigben_worker(struct work_struct *work) struct bigben_device *bigben = container_of(work, struct bigben_device, worker); struct hid_field *report_field = bigben->report->field[0]; + bool do_work_led = false; + bool do_work_ff = false; + u8 *buf; + u32 len; + unsigned long flags;
if (bigben->removed || !report_field) return;
+ buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); + if (!buf) + return; + + len = hid_report_len(bigben->report); + + /* LED work */ + spin_lock_irqsave(&bigben->lock, flags); + if (bigben->work_led) { bigben->work_led = false; + do_work_led = true; report_field->value[0] = 0x01; /* 1 = led message */ report_field->value[1] = 0x08; /* reserved value, always 8 */ report_field->value[2] = bigben->led_state; @@ -204,11 +220,22 @@ static void bigben_worker(struct work_struct *work) report_field->value[5] = 0x00; /* padding */ report_field->value[6] = 0x00; /* padding */ report_field->value[7] = 0x00; /* padding */ - hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT); + hid_output_report(bigben->report, buf); + } + + spin_unlock_irqrestore(&bigben->lock, flags); + + if (do_work_led) { + hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len, + bigben->report->type, HID_REQ_SET_REPORT); }
+ /* FF work */ + spin_lock_irqsave(&bigben->lock, flags); + if (bigben->work_ff) { bigben->work_ff = false; + do_work_ff = true; report_field->value[0] = 0x02; /* 2 = rumble effect message */ report_field->value[1] = 0x08; /* reserved value, always 8 */ report_field->value[2] = bigben->right_motor_on; @@ -217,8 +244,17 @@ static void bigben_worker(struct work_struct *work) report_field->value[5] = 0x00; /* padding */ report_field->value[6] = 0x00; /* padding */ report_field->value[7] = 0x00; /* padding */ - hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT); + hid_output_report(bigben->report, buf); + } + + spin_unlock_irqrestore(&bigben->lock, flags); + + if (do_work_ff) { + hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len, + bigben->report->type, HID_REQ_SET_REPORT); } + + kfree(buf); }
static int hid_bigben_play_effect(struct input_dev *dev, void *data, @@ -228,6 +264,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, struct bigben_device *bigben = hid_get_drvdata(hid); u8 right_motor_on; u8 left_motor_force; + unsigned long flags;
if (!bigben) { hid_err(hid, "no device data\n"); @@ -242,9 +279,12 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data,
if (right_motor_on != bigben->right_motor_on || left_motor_force != bigben->left_motor_force) { + spin_lock_irqsave(&bigben->lock, flags); bigben->right_motor_on = right_motor_on; bigben->left_motor_force = left_motor_force; bigben->work_ff = true; + spin_unlock_irqrestore(&bigben->lock, flags); + schedule_work(&bigben->worker); }
@@ -259,6 +299,7 @@ static void bigben_set_led(struct led_classdev *led, struct bigben_device *bigben = hid_get_drvdata(hid); int n; bool work; + unsigned long flags;
if (!bigben) { hid_err(hid, "no device data\n"); @@ -267,6 +308,7 @@ static void bigben_set_led(struct led_classdev *led,
for (n = 0; n < NUM_LEDS; n++) { if (led == bigben->leds[n]) { + spin_lock_irqsave(&bigben->lock, flags); if (value == LED_OFF) { work = (bigben->led_state & BIT(n)); bigben->led_state &= ~BIT(n); @@ -274,6 +316,7 @@ static void bigben_set_led(struct led_classdev *led, work = !(bigben->led_state & BIT(n)); bigben->led_state |= BIT(n); } + spin_unlock_irqrestore(&bigben->lock, flags);
if (work) { bigben->work_led = true; @@ -307,8 +350,12 @@ static enum led_brightness bigben_get_led(struct led_classdev *led) static void bigben_remove(struct hid_device *hid) { struct bigben_device *bigben = hid_get_drvdata(hid); + unsigned long flags;
+ spin_lock_irqsave(&bigben->lock, flags); bigben->removed = true; + spin_unlock_irqrestore(&bigben->lock, flags); + cancel_work_sync(&bigben->worker); hid_hw_stop(hid); } @@ -362,6 +409,7 @@ static int bigben_probe(struct hid_device *hid, set_bit(FF_RUMBLE, hidinput->input->ffbit);
INIT_WORK(&bigben->worker, bigben_worker); + spin_lock_init(&bigben->lock);
error = input_ff_create_memless(hidinput->input, NULL, hid_bigben_play_effect);
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b ]
bigben_worker() checks report_field to be non-NULL. The check has been added in commit 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") to prevent a NULL pointer crash. However, the true root cause was a missing check for output reports, patched in commit c7bf714f8755 ("HID: check empty report_list in bigben_probe()"), where the type-confused report list_entry was overlapping with a NULL pointer, which was then causing the crash.
Fixes: 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-2-7860c5763c38@dia... Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-bigbenff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c index ed3d2d7bc1dd4..b98c5f31c184b 100644 --- a/drivers/hid/hid-bigbenff.c +++ b/drivers/hid/hid-bigbenff.c @@ -197,7 +197,7 @@ static void bigben_worker(struct work_struct *work) u32 len; unsigned long flags;
- if (bigben->removed || !report_field) + if (bigben->removed) return;
buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL);
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit 76ca8da989c7d97a7f76c75d475fe95a584439d7 ]
Use spinlocks to deal with workers introducing a wrapper bigben_schedule_work(), and several spinlock checks. Otherwise, bigben_set_led() may schedule bigben->worker after the structure has been freed, causing a use-after-free.
Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@dia... Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-bigbenff.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c index b98c5f31c184b..9d6560db762b1 100644 --- a/drivers/hid/hid-bigbenff.c +++ b/drivers/hid/hid-bigbenff.c @@ -185,6 +185,15 @@ struct bigben_device { struct work_struct worker; };
+static inline void bigben_schedule_work(struct bigben_device *bigben) +{ + unsigned long flags; + + spin_lock_irqsave(&bigben->lock, flags); + if (!bigben->removed) + schedule_work(&bigben->worker); + spin_unlock_irqrestore(&bigben->lock, flags); +}
static void bigben_worker(struct work_struct *work) { @@ -197,9 +206,6 @@ static void bigben_worker(struct work_struct *work) u32 len; unsigned long flags;
- if (bigben->removed) - return; - buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); if (!buf) return; @@ -285,7 +291,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, bigben->work_ff = true; spin_unlock_irqrestore(&bigben->lock, flags);
- schedule_work(&bigben->worker); + bigben_schedule_work(bigben); }
return 0; @@ -320,7 +326,7 @@ static void bigben_set_led(struct led_classdev *led,
if (work) { bigben->work_led = true; - schedule_work(&bigben->worker); + bigben_schedule_work(bigben); } return; } @@ -450,7 +456,7 @@ static int bigben_probe(struct hid_device *hid, bigben->left_motor_force = 0; bigben->work_led = true; bigben->work_ff = true; - schedule_work(&bigben->worker); + bigben_schedule_work(bigben);
hid_info(hid, "LED and force feedback support for BigBen gamepad\n");
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit b94335f899542a0da5fafc38af8edcaf90195843 ]
bigben_probe() does not validate that the output report has the needed report values in the first field. A malicious device registering a report with one field and a single value causes an head OOB write in bigben_worker() when accessing report_field->value[1] to report_field->value[7]. Use hid_validate_values() which takes care of all the needed checks.
Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma... Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-bigbenff.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c index 9d6560db762b1..a02cb517b4c47 100644 --- a/drivers/hid/hid-bigbenff.c +++ b/drivers/hid/hid-bigbenff.c @@ -371,7 +371,6 @@ static int bigben_probe(struct hid_device *hid, { struct bigben_device *bigben; struct hid_input *hidinput; - struct list_head *report_list; struct led_classdev *led; char *name; size_t name_sz; @@ -396,14 +395,12 @@ static int bigben_probe(struct hid_device *hid, return error; }
- report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; - if (list_empty(report_list)) { + bigben->report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 8); + if (!bigben->report) { hid_err(hid, "no output report found\n"); error = -ENODEV; goto error_hw_stop; } - bigben->report = list_entry(report_list->next, - struct hid_report, list);
if (list_empty(&hid->inputs)) { hid_err(hid, "no inputs found\n");
From: Orlando Chamberlain orlandoch.dev@gmail.com
[ Upstream commit 5beb5627a2481aade9aa630b7ebb7f99442321b6 ]
Commit 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD") caused only AMD gpu's with PX to have their audio component register with vga_switcheroo. This meant that Apple Macbooks with apple-gmux as the gpu switcher no longer had the audio client registering, so when the gpu is powered off by vga_switcheroo snd_hda_intel is unaware that it should have suspended the device:
amdgpu: switched off snd_hda_intel 0000:03:00.1: Unable to change power state from D3hot to D0, device inaccessible snd_hda_intel 0000:03:00.1: CORB reset timeout#2, CORBRP = 65535
To resolve this, we use apple_gmux_detect() and register a vga_switcheroo audio client when apple-gmux is detected.
Fixes: 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD") Link: https://lore.kernel.org/all/20230210044826.9834-9-orlandoch.dev@gmail.com/ Signed-off-by: Orlando Chamberlain orlandoch.dev@gmail.com Link: https://lore.kernel.org/r/20230216103450.12925-1-orlandoch.dev@gmail.com Signed-off-by: Takashi Iwai tiwai@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- sound/pci/hda/hda_intel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index 2dbc082076f69..81c4a45254ff2 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -50,6 +50,7 @@ #include <sound/intel-dsp-config.h> #include <linux/vgaarb.h> #include <linux/vga_switcheroo.h> +#include <linux/apple-gmux.h> #include <linux/firmware.h> #include <sound/hda_codec.h> #include "hda_controller.h" @@ -1466,7 +1467,7 @@ static struct pci_dev *get_bound_vga(struct pci_dev *pci) * vgaswitcheroo. */ if (((p->class >> 16) == PCI_BASE_CLASS_DISPLAY) && - atpx_present()) + (atpx_present() || apple_gmux_detect(NULL, NULL))) return p; pci_dev_put(p); }
From: Asahi Lina lina@asahilina.net
[ Upstream commit ddddedaa0db99481c5e5abe628ad54f65e8765bc ]
Other functions touching shmem->sgt take the pages lock, so do that here too. drm_gem_shmem_get_pages() & co take the same lock, so move to the _locked() variants to avoid recursive locking.
Discovered while auditing locking to write the Rust abstractions.
Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") Fixes: 4fa3d66f132b ("drm/shmem: Do dma_unmap_sg before purging pages") Signed-off-by: Asahi Lina lina@asahilina.net Reviewed-by: Javier Martinez Canillas javierm@redhat.com Signed-off-by: Javier Martinez Canillas javierm@redhat.com Link: https://patchwork.freedesktop.org/patch/msgid/20230205125124.2260-1-lina@asa... (cherry picked from commit aa8c85affe3facd3842c8912186623415931cc72) Signed-off-by: Javier Martinez Canillas javierm@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_gem_shmem_helper.c | 54 ++++++++++++++++---------- 1 file changed, 34 insertions(+), 20 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index b602cd72a1205..2c559b310cad3 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -681,23 +681,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem) } EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table);
-/** - * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a - * scatter/gather table for a shmem GEM object. - * @shmem: shmem GEM object - * - * This function returns a scatter/gather table suitable for driver usage. If - * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg - * table created. - * - * This is the main function for drivers to get at backing storage, and it hides - * and difference between dma-buf imported and natively allocated objects. - * drm_gem_shmem_get_sg_table() should not be directly called by drivers. - * - * Returns: - * A pointer to the scatter/gather table of pinned pages or errno on failure. - */ -struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) +static struct sg_table *drm_gem_shmem_get_pages_sgt_locked(struct drm_gem_shmem_object *shmem) { struct drm_gem_object *obj = &shmem->base; int ret; @@ -708,7 +692,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
WARN_ON(obj->import_attach);
- ret = drm_gem_shmem_get_pages(shmem); + ret = drm_gem_shmem_get_pages_locked(shmem); if (ret) return ERR_PTR(ret);
@@ -730,10 +714,40 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) sg_free_table(sgt); kfree(sgt); err_put_pages: - drm_gem_shmem_put_pages(shmem); + drm_gem_shmem_put_pages_locked(shmem); return ERR_PTR(ret); } -EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt); + +/** + * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a + * scatter/gather table for a shmem GEM object. + * @shmem: shmem GEM object + * + * This function returns a scatter/gather table suitable for driver usage. If + * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg + * table created. + * + * This is the main function for drivers to get at backing storage, and it hides + * and difference between dma-buf imported and natively allocated objects. + * drm_gem_shmem_get_sg_table() should not be directly called by drivers. + * + * Returns: + * A pointer to the scatter/gather table of pinned pages or errno on failure. + */ +struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) +{ + int ret; + struct sg_table *sgt; + + ret = mutex_lock_interruptible(&shmem->pages_lock); + if (ret) + return ERR_PTR(ret); + sgt = drm_gem_shmem_get_pages_sgt_locked(shmem); + mutex_unlock(&shmem->pages_lock); + + return sgt; +} +EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt);
/** * drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from
From: Dai Ngo dai.ngo@oracle.com
[ Upstream commit df24ac7a2e3a9d0bc68f1756a880e50bfe4b4522 ]
Currently nfsd4_setup_inter_ssc returns the vfsmount of the source server's export when the mount completes. After the copy is done nfsd4_cleanup_inter_ssc is called with the vfsmount of the source server and it searches nfsd_ssc_mount_list for a matching entry to do the clean up.
The problems with this approach are (1) the need to search the nfsd_ssc_mount_list and (2) the code has to handle the case where the matching entry is not found which looks ugly.
The enhancement is instead of nfsd4_setup_inter_ssc returning the vfsmount, it returns the nfsd4_ssc_umount_item which has the vfsmount embedded in it. When nfsd4_cleanup_inter_ssc is called it's passed with the nfsd4_ssc_umount_item directly to do the clean up so no searching is needed and there is no need to handle the 'not found' case.
Signed-off-by: Dai Ngo dai.ngo@oracle.com Signed-off-by: Chuck Lever chuck.lever@oracle.com [ cel: adjusted whitespace and variable/function names ] Reviewed-by: Olga Kornievskaia kolga@netapp.com Stable-dep-of: 34e8f9ec4c9a ("NFSD: fix leaked reference count of nfsd4_ssc_umount_item") Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfs4proc.c | 111 ++++++++++++++++------------------------ fs/nfsd/xdr4.h | 2 +- include/linux/nfs_ssc.h | 2 +- 3 files changed, 46 insertions(+), 69 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index f189ba7995f5a..dbaf33398c827 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1293,15 +1293,15 @@ extern void nfs_sb_deactive(struct super_block *sb); * setup a work entry in the ssc delayed unmount list. */ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, - struct nfsd4_ssc_umount_item **retwork, struct vfsmount **ss_mnt) + struct nfsd4_ssc_umount_item **nsui) { struct nfsd4_ssc_umount_item *ni = NULL; struct nfsd4_ssc_umount_item *work = NULL; struct nfsd4_ssc_umount_item *tmp; DEFINE_WAIT(wait); + __be32 status = 0;
- *ss_mnt = NULL; - *retwork = NULL; + *nsui = NULL; work = kzalloc(sizeof(*work), GFP_KERNEL); try_again: spin_lock(&nn->nfsd_ssc_lock); @@ -1325,12 +1325,12 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, finish_wait(&nn->nfsd_ssc_waitq, &wait); goto try_again; } - *ss_mnt = ni->nsui_vfsmount; + *nsui = ni; refcount_inc(&ni->nsui_refcnt); spin_unlock(&nn->nfsd_ssc_lock); kfree(work);
- /* return vfsmount in ss_mnt */ + /* return vfsmount in (*nsui)->nsui_vfsmount */ return 0; } if (work) { @@ -1338,31 +1338,32 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, refcount_set(&work->nsui_refcnt, 2); work->nsui_busy = true; list_add_tail(&work->nsui_list, &nn->nfsd_ssc_mount_list); - *retwork = work; - } + *nsui = work; + } else + status = nfserr_resource; spin_unlock(&nn->nfsd_ssc_lock); - return 0; + return status; }
-static void nfsd4_ssc_update_dul_work(struct nfsd_net *nn, - struct nfsd4_ssc_umount_item *work, struct vfsmount *ss_mnt) +static void nfsd4_ssc_update_dul(struct nfsd_net *nn, + struct nfsd4_ssc_umount_item *nsui, + struct vfsmount *ss_mnt) { - /* set nsui_vfsmount, clear busy flag and wakeup waiters */ spin_lock(&nn->nfsd_ssc_lock); - work->nsui_vfsmount = ss_mnt; - work->nsui_busy = false; + nsui->nsui_vfsmount = ss_mnt; + nsui->nsui_busy = false; wake_up_all(&nn->nfsd_ssc_waitq); spin_unlock(&nn->nfsd_ssc_lock); }
-static void nfsd4_ssc_cancel_dul_work(struct nfsd_net *nn, - struct nfsd4_ssc_umount_item *work) +static void nfsd4_ssc_cancel_dul(struct nfsd_net *nn, + struct nfsd4_ssc_umount_item *nsui) { spin_lock(&nn->nfsd_ssc_lock); - list_del(&work->nsui_list); + list_del(&nsui->nsui_list); wake_up_all(&nn->nfsd_ssc_waitq); spin_unlock(&nn->nfsd_ssc_lock); - kfree(work); + kfree(nsui); }
/* @@ -1370,7 +1371,7 @@ static void nfsd4_ssc_cancel_dul_work(struct nfsd_net *nn, */ static __be32 nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, - struct vfsmount **mount) + struct nfsd4_ssc_umount_item **nsui) { struct file_system_type *type; struct vfsmount *ss_mnt; @@ -1381,7 +1382,6 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, char *ipaddr, *dev_name, *raw_data; int len, raw_len; __be32 status = nfserr_inval; - struct nfsd4_ssc_umount_item *work = NULL; struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
naddr = &nss->u.nl4_addr; @@ -1389,6 +1389,7 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, naddr->addr_len, (struct sockaddr *)&tmp_addr, sizeof(tmp_addr)); + *nsui = NULL; if (tmp_addrlen == 0) goto out_err;
@@ -1431,10 +1432,10 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, goto out_free_rawdata; snprintf(dev_name, len + 5, "%s%s%s:/", startsep, ipaddr, endsep);
- status = nfsd4_ssc_setup_dul(nn, ipaddr, &work, &ss_mnt); + status = nfsd4_ssc_setup_dul(nn, ipaddr, nsui); if (status) goto out_free_devname; - if (ss_mnt) + if ((*nsui)->nsui_vfsmount) goto out_done;
/* Use an 'internal' mount: SB_KERNMOUNT -> MNT_INTERNAL */ @@ -1442,15 +1443,12 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, module_put(type->owner); if (IS_ERR(ss_mnt)) { status = nfserr_nodev; - if (work) - nfsd4_ssc_cancel_dul_work(nn, work); + nfsd4_ssc_cancel_dul(nn, *nsui); goto out_free_devname; } - if (work) - nfsd4_ssc_update_dul_work(nn, work, ss_mnt); + nfsd4_ssc_update_dul(nn, *nsui, ss_mnt); out_done: status = 0; - *mount = ss_mnt;
out_free_devname: kfree(dev_name); @@ -1474,7 +1472,7 @@ nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp, static __be32 nfsd4_setup_inter_ssc(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - struct nfsd4_copy *copy, struct vfsmount **mount) + struct nfsd4_copy *copy) { struct svc_fh *s_fh = NULL; stateid_t *s_stid = ©->cp_src_stateid; @@ -1487,7 +1485,7 @@ nfsd4_setup_inter_ssc(struct svc_rqst *rqstp, if (status) goto out;
- status = nfsd4_interssc_connect(copy->cp_src, rqstp, mount); + status = nfsd4_interssc_connect(copy->cp_src, rqstp, ©->ss_nsui); if (status) goto out;
@@ -1505,45 +1503,27 @@ nfsd4_setup_inter_ssc(struct svc_rqst *rqstp, }
static void -nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp, +nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp, struct nfsd_file *dst) { - bool found = false; - long timeout; - struct nfsd4_ssc_umount_item *tmp; - struct nfsd4_ssc_umount_item *ni = NULL; struct nfsd_net *nn = net_generic(dst->nf_net, nfsd_net_id); + long timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout);
nfs42_ssc_close(filp); nfsd_file_put(dst); fput(filp);
- if (!nn) { - mntput(ss_mnt); - return; - } spin_lock(&nn->nfsd_ssc_lock); - timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout); - list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) { - if (ni->nsui_vfsmount->mnt_sb == ss_mnt->mnt_sb) { - list_del(&ni->nsui_list); - /* - * vfsmount can be shared by multiple exports, - * decrement refcnt. If the count drops to 1 it - * will be unmounted when nsui_expire expires. - */ - refcount_dec(&ni->nsui_refcnt); - ni->nsui_expire = jiffies + timeout; - list_add_tail(&ni->nsui_list, &nn->nfsd_ssc_mount_list); - found = true; - break; - } - } + list_del(&nsui->nsui_list); + /* + * vfsmount can be shared by multiple exports, + * decrement refcnt. If the count drops to 1 it + * will be unmounted when nsui_expire expires. + */ + refcount_dec(&nsui->nsui_refcnt); + nsui->nsui_expire = jiffies + timeout; + list_add_tail(&nsui->nsui_list, &nn->nfsd_ssc_mount_list); spin_unlock(&nn->nfsd_ssc_lock); - if (!found) { - mntput(ss_mnt); - return; - } }
#else /* CONFIG_NFSD_V4_2_INTER_SSC */ @@ -1551,15 +1531,13 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp, static __be32 nfsd4_setup_inter_ssc(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - struct nfsd4_copy *copy, - struct vfsmount **mount) + struct nfsd4_copy *copy) { - *mount = NULL; return nfserr_inval; }
static void -nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct file *filp, +nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp, struct nfsd_file *dst) { } @@ -1700,7 +1678,7 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); - dst->ss_mnt = src->ss_mnt; + dst->ss_nsui = src->ss_nsui; }
static void cleanup_async_copy(struct nfsd4_copy *copy) @@ -1749,8 +1727,8 @@ static int nfsd4_do_async_copy(void *data) if (nfsd4_ssc_is_inter(copy)) { struct file *filp;
- filp = nfs42_ssc_open(copy->ss_mnt, ©->c_fh, - ©->stateid); + filp = nfs42_ssc_open(copy->ss_nsui->nsui_vfsmount, + ©->c_fh, ©->stateid); if (IS_ERR(filp)) { switch (PTR_ERR(filp)) { case -EBADF: @@ -1764,7 +1742,7 @@ static int nfsd4_do_async_copy(void *data) } nfserr = nfsd4_do_copy(copy, filp, copy->nf_dst->nf_file, false); - nfsd4_cleanup_inter_ssc(copy->ss_mnt, filp, copy->nf_dst); + nfsd4_cleanup_inter_ssc(copy->ss_nsui, filp, copy->nf_dst); } else { nfserr = nfsd4_do_copy(copy, copy->nf_src->nf_file, copy->nf_dst->nf_file, false); @@ -1790,8 +1768,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, status = nfserr_notsupp; goto out; } - status = nfsd4_setup_inter_ssc(rqstp, cstate, copy, - ©->ss_mnt); + status = nfsd4_setup_inter_ssc(rqstp, cstate, copy); if (status) return nfserr_offload_denied; } else { diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index 4fd2cf6d1d2dc..510978e602da6 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -571,7 +571,7 @@ struct nfsd4_copy { struct task_struct *copy_task; refcount_t refcount;
- struct vfsmount *ss_mnt; + struct nfsd4_ssc_umount_item *ss_nsui; struct nfs_fh c_fh; nfs4_stateid stateid; }; diff --git a/include/linux/nfs_ssc.h b/include/linux/nfs_ssc.h index 75843c00f326a..22265b1ff0800 100644 --- a/include/linux/nfs_ssc.h +++ b/include/linux/nfs_ssc.h @@ -53,6 +53,7 @@ static inline void nfs42_ssc_close(struct file *filep) if (nfs_ssc_client_tbl.ssc_nfs4_ops) (*nfs_ssc_client_tbl.ssc_nfs4_ops->sco_close)(filep); } +#endif
struct nfsd4_ssc_umount_item { struct list_head nsui_list; @@ -66,7 +67,6 @@ struct nfsd4_ssc_umount_item { struct vfsmount *nsui_vfsmount; char nsui_ipaddr[RPC_MAX_ADDRBUFLEN + 1]; }; -#endif
/* * NFS_FS
From: Dai Ngo dai.ngo@oracle.com
[ Upstream commit 34e8f9ec4c9ac235f917747b23a200a5e0ec857b ]
The reference count of nfsd4_ssc_umount_item is not decremented on error conditions. This prevents the laundromat from unmounting the vfsmount of the source file.
This patch decrements the reference count of nfsd4_ssc_umount_item on error.
Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.") Signed-off-by: Dai Ngo dai.ngo@oracle.com Reviewed-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfs4proc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index dbaf33398c827..e2dde8a1837be 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1814,13 +1814,17 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, out: return status; out_err: + if (nfsd4_ssc_is_inter(copy)) { + /* + * Source's vfsmount of inter-copy will be unmounted + * by the laundromat. Use copy instead of async_copy + * since async_copy->ss_nsui might not be set yet. + */ + refcount_dec(©->ss_nsui->nsui_refcnt); + } if (async_copy) cleanup_async_copy(async_copy); status = nfserrno(-ENOMEM); - /* - * source's vfsmount of inter-copy will be unmounted - * by the laundromat - */ goto out; }
From: Benjamin Coddington bcodding@redhat.com
[ Upstream commit fb610c4dbc996415d57d7090957ecddd4fd64fb6 ]
Its possible for __break_lease to find the layout's lease before we've added the layout to the owner's ls_layouts list. In that case, setting ls_recalled = true without actually recalling the layout will cause the server to never send a recall callback.
Move the check for ls_layouts before setting ls_recalled.
Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") Signed-off-by: Benjamin Coddington bcodding@redhat.com Reviewed-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfs4layouts.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c index 3564d1c6f6104..e8a80052cb1ba 100644 --- a/fs/nfsd/nfs4layouts.c +++ b/fs/nfsd/nfs4layouts.c @@ -323,11 +323,11 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls) if (ls->ls_recalled) goto out_unlock;
- ls->ls_recalled = true; - atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls); if (list_empty(&ls->ls_layouts)) goto out_unlock;
+ ls->ls_recalled = true; + atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls); trace_nfsd_layout_recall(&ls->ls_stid.sc_stateid);
refcount_inc(&ls->ls_stid.sc_count);
From: Jeff Layton jlayton@kernel.org
[ Upstream commit 6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f ]
There are two different flavors of the nfsd4_copy struct. One is embedded in the compound and is used directly in synchronous copies. The other is dynamically allocated, refcounted and tracked in the client struture. For the embedded one, the cleanup just involves releasing any nfsd_files held on its behalf. For the async one, the cleanup is a bit more involved, and we need to dequeue it from lists, unhash it, etc.
There is at least one potential refcount leak in this code now. If the kthread_create call fails, then both the src and dst nfsd_files in the original nfsd4_copy object are leaked.
The cleanup in this codepath is also sort of weird. In the async copy case, we'll have up to four nfsd_file references (src and dst for both flavors of copy structure). They are both put at the end of nfsd4_do_async_copy, even though the ones held on behalf of the embedded one outlive that structure.
Change it so that we always clean up the nfsd_file refs held by the embedded copy structure before nfsd4_copy returns. Rework cleanup_async_copy to handle both inter and intra copies. Eliminate nfsd4_cleanup_intra_ssc since it now becomes a no-op.
Signed-off-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Stable-dep-of: 81e722978ad2 ("NFSD: fix problems with cleanup on errors in nfsd4_copy") Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfs4proc.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index e2dde8a1837be..b74cbc9a0e7f3 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1510,7 +1510,6 @@ nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp, long timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout);
nfs42_ssc_close(filp); - nfsd_file_put(dst); fput(filp);
spin_lock(&nn->nfsd_ssc_lock); @@ -1560,13 +1559,6 @@ nfsd4_setup_intra_ssc(struct svc_rqst *rqstp, ©->nf_dst); }
-static void -nfsd4_cleanup_intra_ssc(struct nfsd_file *src, struct nfsd_file *dst) -{ - nfsd_file_put(src); - nfsd_file_put(dst); -} - static void nfsd4_cb_offload_release(struct nfsd4_callback *cb) { struct nfsd4_cb_offload *cbo = @@ -1681,12 +1673,18 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) dst->ss_nsui = src->ss_nsui; }
+static void release_copy_files(struct nfsd4_copy *copy) +{ + if (copy->nf_src) + nfsd_file_put(copy->nf_src); + if (copy->nf_dst) + nfsd_file_put(copy->nf_dst); +} + static void cleanup_async_copy(struct nfsd4_copy *copy) { nfs4_free_copy_state(copy); - nfsd_file_put(copy->nf_dst); - if (!nfsd4_ssc_is_inter(copy)) - nfsd_file_put(copy->nf_src); + release_copy_files(copy); spin_lock(©->cp_clp->async_lock); list_del(©->copies); spin_unlock(©->cp_clp->async_lock); @@ -1746,7 +1744,6 @@ static int nfsd4_do_async_copy(void *data) } else { nfserr = nfsd4_do_copy(copy, copy->nf_src->nf_file, copy->nf_dst->nf_file, false); - nfsd4_cleanup_intra_ssc(copy->nf_src, copy->nf_dst); }
do_callback: @@ -1809,9 +1806,9 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, } else { status = nfsd4_do_copy(copy, copy->nf_src->nf_file, copy->nf_dst->nf_file, true); - nfsd4_cleanup_intra_ssc(copy->nf_src, copy->nf_dst); } out: + release_copy_files(copy); return status; out_err: if (nfsd4_ssc_is_inter(copy)) {
From: Dai Ngo dai.ngo@oracle.com
[ Upstream commit 81e722978ad21072470b73d8f6a50ad62c7d5b7d ]
When nfsd4_copy fails to allocate memory for async_copy->cp_src, or nfs4_init_copy_state fails, it calls cleanup_async_copy to do the cleanup for the async_copy which causes page fault since async_copy is not yet initialized.
This patche rearranges the order of initializing the fields in async_copy and adds checks in cleanup_async_copy to skip un-initialized fields.
Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy") Fixes: 87689df69491 ("NFSD: Shrink size of struct nfsd4_copy") Signed-off-by: Dai Ngo dai.ngo@oracle.com Reviewed-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfs4proc.c | 12 ++++++++---- fs/nfsd/nfs4state.c | 5 +++-- 2 files changed, 11 insertions(+), 6 deletions(-)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index b74cbc9a0e7f3..92674077fc88e 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1685,9 +1685,12 @@ static void cleanup_async_copy(struct nfsd4_copy *copy) { nfs4_free_copy_state(copy); release_copy_files(copy); - spin_lock(©->cp_clp->async_lock); - list_del(©->copies); - spin_unlock(©->cp_clp->async_lock); + if (copy->cp_clp) { + spin_lock(©->cp_clp->async_lock); + if (!list_empty(©->copies)) + list_del_init(©->copies); + spin_unlock(©->cp_clp->async_lock); + } nfs4_put_copy(copy); }
@@ -1784,12 +1787,13 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); if (!async_copy) goto out_err; + INIT_LIST_HEAD(&async_copy->copies); + refcount_set(&async_copy->refcount, 1); async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); if (!async_copy->cp_src) goto out_err; if (!nfs4_init_copy_state(nn, copy)) goto out_err; - refcount_set(&async_copy->refcount, 1); memcpy(©->cp_res.cb_stateid, ©->cp_stateid.cs_stid, sizeof(copy->cp_res.cb_stateid)); dup_copy_fields(copy, async_copy); diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index c69f27d3adb79..529de327d6f93 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -992,7 +992,6 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
stid->cs_stid.si_opaque.so_clid.cl_boot = (u32)nn->boot_time; stid->cs_stid.si_opaque.so_clid.cl_id = nn->s2s_cp_cl_id; - stid->cs_type = cs_type;
idr_preload(GFP_KERNEL); spin_lock(&nn->s2s_cp_lock); @@ -1003,6 +1002,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, idr_preload_end(); if (new_id < 0) return 0; + stid->cs_type = cs_type; return 1; }
@@ -1036,7 +1036,8 @@ void nfs4_free_copy_state(struct nfsd4_copy *copy) { struct nfsd_net *nn;
- WARN_ON_ONCE(copy->cp_stateid.cs_type != NFS4_COPY_STID); + if (copy->cp_stateid.cs_type != NFS4_COPY_STID) + return; nn = net_generic(copy->cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids,
From: Jeff Layton jlayton@kernel.org
[ Upstream commit dcd779dc46540e174a6ac8d52fbed23593407317 ]
The nested if statements here make no sense, as you can never reach "else" branch in the nested statement. Fix the error handling for when there is a courtesy client that holds a conflicting deny mode.
Fixes: 3d6942715180 ("NFSD: add support for share reservation conflict to courteous server") Reported-by: 張智諺 cc85nod@gmail.com Signed-off-by: Jeff Layton jlayton@kernel.org Reviewed-by: Dai Ngo dai.ngo@oracle.com Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfs4state.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 529de327d6f93..104c258255d62 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -5299,16 +5299,17 @@ nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, /* test and set deny mode */ spin_lock(&fp->fi_lock); status = nfs4_file_check_deny(fp, open->op_share_deny); - if (status == nfs_ok) { - if (status != nfserr_share_denied) { - set_deny(open->op_share_deny, stp); - fp->fi_share_deny |= - (open->op_share_deny & NFS4_SHARE_DENY_BOTH); - } else { - if (nfs4_resolve_deny_conflicts_locked(fp, false, - stp, open->op_share_deny, false)) - status = nfserr_jukebox; - } + switch (status) { + case nfs_ok: + set_deny(open->op_share_deny, stp); + fp->fi_share_deny |= + (open->op_share_deny & NFS4_SHARE_DENY_BOTH); + break; + case nfserr_share_denied: + if (nfs4_resolve_deny_conflicts_locked(fp, false, + stp, open->op_share_deny, false)) + status = nfserr_jukebox; + break; } spin_unlock(&fp->fi_lock);
From: Jeff Layton jlayton@kernel.org
[ Upstream commit 4c475eee02375ade6e864f1db16976ba0d96a0a2 ]
Most of the time, NFSv4 clients issue a COMMIT before the final CLOSE of an open stateid, so with NFSv4, the fsync in the nfsd_file_free path is usually a no-op and doesn't block.
We have a customer running knfsd over very slow storage (XFS over Ceph RBD). They were using the "async" export option because performance was more important than data integrity for this application. That export option turns NFSv4 COMMIT calls into no-ops. Due to the fsync in this codepath however, their final CLOSE calls would still stall (since a CLOSE effectively became a COMMIT).
I think this fsync is not strictly necessary. We only use that result to reset the write verifier. Instead of fsync'ing all of the data when we free an nfsd_file, we can just check for writeback errors when one is acquired and when it is freed.
If the client never comes back, then it'll never see the error anyway and there is no point in resetting it. If an error occurs after the nfsd_file is removed from the cache but before the inode is evicted, then it will reset the write verifier on the next nfsd_file_acquire, (since there will be an unseen error).
The only exception here is if something else opens and fsyncs the file during that window. Given that local applications work with this limitation today, I don't see that as an issue.
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2166658 Fixes: ac3a2585f018 ("nfsd: rework refcounting in filecache") Reported-and-tested-by: Pierguido Lambri plambri@redhat.com Signed-off-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/filecache.c | 44 ++++++++++++-------------------------------- fs/nfsd/trace.h | 31 ------------------------------- 2 files changed, 12 insertions(+), 63 deletions(-)
diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c index c0950edb26b0d..697acf5c3c681 100644 --- a/fs/nfsd/filecache.c +++ b/fs/nfsd/filecache.c @@ -331,37 +331,27 @@ nfsd_file_alloc(struct nfsd_file_lookup_key *key, unsigned int may) return nf; }
+/** + * nfsd_file_check_write_error - check for writeback errors on a file + * @nf: nfsd_file to check for writeback errors + * + * Check whether a nfsd_file has an unseen error. Reset the write + * verifier if so. + */ static void -nfsd_file_fsync(struct nfsd_file *nf) -{ - struct file *file = nf->nf_file; - int ret; - - if (!file || !(file->f_mode & FMODE_WRITE)) - return; - ret = vfs_fsync(file, 1); - trace_nfsd_file_fsync(nf, ret); - if (ret) - nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id)); -} - -static int nfsd_file_check_write_error(struct nfsd_file *nf) { struct file *file = nf->nf_file;
- if (!file || !(file->f_mode & FMODE_WRITE)) - return 0; - return filemap_check_wb_err(file->f_mapping, READ_ONCE(file->f_wb_err)); + if ((file->f_mode & FMODE_WRITE) && + filemap_check_wb_err(file->f_mapping, READ_ONCE(file->f_wb_err))) + nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id)); }
static void nfsd_file_hash_remove(struct nfsd_file *nf) { trace_nfsd_file_unhash(nf); - - if (nfsd_file_check_write_error(nf)) - nfsd_reset_write_verifier(net_generic(nf->nf_net, nfsd_net_id)); rhashtable_remove_fast(&nfsd_file_rhash_tbl, &nf->nf_rhash, nfsd_file_rhash_params); } @@ -387,23 +377,12 @@ nfsd_file_free(struct nfsd_file *nf) this_cpu_add(nfsd_file_total_age, age);
nfsd_file_unhash(nf); - - /* - * We call fsync here in order to catch writeback errors. It's not - * strictly required by the protocol, but an nfsd_file could get - * evicted from the cache before a COMMIT comes in. If another - * task were to open that file in the interim and scrape the error, - * then the client may never see it. By calling fsync here, we ensure - * that writeback happens before the entry is freed, and that any - * errors reported result in the write verifier changing. - */ - nfsd_file_fsync(nf); - if (nf->nf_mark) nfsd_file_mark_put(nf->nf_mark); if (nf->nf_file) { get_file(nf->nf_file); filp_close(nf->nf_file, NULL); + nfsd_file_check_write_error(nf); fput(nf->nf_file); }
@@ -1159,6 +1138,7 @@ nfsd_file_do_acquire(struct svc_rqst *rqstp, struct svc_fh *fhp, out: if (status == nfs_ok) { this_cpu_inc(nfsd_file_acquisitions); + nfsd_file_check_write_error(nf); *pnf = nf; } else { if (refcount_dec_and_test(&nf->nf_ref)) diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h index 8f9c82d9e075b..4183819ea0829 100644 --- a/fs/nfsd/trace.h +++ b/fs/nfsd/trace.h @@ -1202,37 +1202,6 @@ TRACE_EVENT(nfsd_file_close, ) );
-TRACE_EVENT(nfsd_file_fsync, - TP_PROTO( - const struct nfsd_file *nf, - int ret - ), - TP_ARGS(nf, ret), - TP_STRUCT__entry( - __field(void *, nf_inode) - __field(int, nf_ref) - __field(int, ret) - __field(unsigned long, nf_flags) - __field(unsigned char, nf_may) - __field(struct file *, nf_file) - ), - TP_fast_assign( - __entry->nf_inode = nf->nf_inode; - __entry->nf_ref = refcount_read(&nf->nf_ref); - __entry->ret = ret; - __entry->nf_flags = nf->nf_flags; - __entry->nf_may = nf->nf_may; - __entry->nf_file = nf->nf_file; - ), - TP_printk("inode=%p ref=%d flags=%s may=%s nf_file=%p ret=%d", - __entry->nf_inode, - __entry->nf_ref, - show_nf_flags(__entry->nf_flags), - show_nfsd_may_flags(__entry->nf_may), - __entry->nf_file, __entry->ret - ) -); - #include "cache.h"
TRACE_DEFINE_ENUM(RC_DROPIT);
From: Chuck Lever chuck.lever@oracle.com
[ Upstream commit 90d2175572470ba7f55da8447c72ddd4942923c4 ]
Currently, we're only memcpy'ing the first __be32. Ensure we copy into both words.
Fixes: 91d2e9b56cf5 ("NFSD: Clean up the nfsd_net::nfssvc_boot field") Reported-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfssvc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c index 325d3d3f12110..a0ecec54d3d7d 100644 --- a/fs/nfsd/nfssvc.c +++ b/fs/nfsd/nfssvc.c @@ -363,7 +363,7 @@ void nfsd_copy_write_verifier(__be32 verf[2], struct nfsd_net *nn)
do { read_seqbegin_or_lock(&nn->writeverf_lock, &seq); - memcpy(verf, nn->writeverf, sizeof(*verf)); + memcpy(verf, nn->writeverf, sizeof(nn->writeverf)); } while (need_seqretry(&nn->writeverf_lock, seq)); done_seqretry(&nn->writeverf_lock, seq); }
From: Zhang Xiaoxu zhangxiaoxu5@huawei.com
[ Upstream commit e9d3401d95d62a9531082cd2453ed42f2740e3fd ]
If the MR allocate failed, the smb direct connection info is NULL, then smbd_destroy() will directly return, then the connection info will be leaked.
Let's set the smb direct connection info to the server before call smbd_destroy().
Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Signed-off-by: Zhang Xiaoxu zhangxiaoxu5@huawei.com Acked-by: Paulo Alcantara (SUSE) pc@cjr.nz Reviewed-by: David Howells dhowells@redhat.com Reviewed-by: Tom Talpey tom@talpey.com Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/cifs/smbdirect.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c index 8c816b25ce7c6..101dab87cad1a 100644 --- a/fs/cifs/smbdirect.c +++ b/fs/cifs/smbdirect.c @@ -1700,6 +1700,7 @@ static struct smbd_connection *_smbd_get_connection(
allocate_mr_failed: /* At this point, need to a full transport shutdown */ + server->smbd_conn = info; smbd_destroy(server); return NULL;
From: Zhang Xiaoxu zhangxiaoxu5@huawei.com
[ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ]
If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR:
WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP: 0010:__flush_work.isra.0+0xf7/0x110 Call Trace: <TASK> __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 __kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF.
Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Acked-by: Paulo Alcantara (SUSE) pc@cjr.nz Reviewed-by: Tom Talpey tom@talpey.com Signed-off-by: Zhang Xiaoxu zhangxiaoxu5@huawei.com Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/cifs/smbdirect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c index 101dab87cad1a..cf923f211c512 100644 --- a/fs/cifs/smbdirect.c +++ b/fs/cifs/smbdirect.c @@ -2218,6 +2218,7 @@ static int allocate_mr_list(struct smbd_connection *info) atomic_set(&info->mr_ready_count, 0); atomic_set(&info->mr_used_count, 0); init_waitqueue_head(&info->wait_for_mr_cleanup); + INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); /* Allocate more MRs (2x) than hardware responder_resources */ for (i = 0; i < info->responder_resources * 2; i++) { smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); @@ -2245,13 +2246,13 @@ static int allocate_mr_list(struct smbd_connection *info) list_add_tail(&smbdirect_mr->list, &info->mr_list); atomic_inc(&info->mr_ready_count); } - INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); return 0;
out: kfree(smbdirect_mr);
list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) { + list_del(&smbdirect_mr->list); ib_dereg_mr(smbdirect_mr->mr); kfree(smbdirect_mr->sgl); kfree(smbdirect_mr);
From: Shyam Prasad N sprasad@microsoft.com
[ Upstream commit df57109bd50b9ed6911f3c2aa914189fe4c1fe2c ]
In smb2_reconnect_server, we allocate a dummy tcon for calling reconnect for just the session. This should be allocated using tconInfoAlloc, and not kmalloc.
Fixes: 3663c9045f51 ("cifs: check reconnects for channels of active tcons too") Signed-off-by: Shyam Prasad N sprasad@microsoft.com Reviewed-by: Paulo Alcantara (SUSE) pc@cjr.nz Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/cifs/smb2pdu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 2c9ffa921e6f6..3b93680a319e4 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -3898,7 +3898,7 @@ void smb2_reconnect_server(struct work_struct *work) goto done;
/* allocate a dummy tcon struct used for reconnect */ - tcon = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL); + tcon = tconInfoAlloc(); if (!tcon) { resched = true; list_for_each_entry_safe(ses, ses2, &tmp_ses_list, rlist) { @@ -3921,7 +3921,7 @@ void smb2_reconnect_server(struct work_struct *work) list_del_init(&ses->rlist); cifs_put_smb_ses(ses); } - kfree(tcon); + tconInfoFree(tcon);
done: cifs_dbg(FYI, "Reconnecting tcons and channels finished\n");
From: Andreas Gruenbacher agruenba@redhat.com
[ Upstream commit cbb60951ce18c9b6e91d2eb97deb41d8ff616622 ]
The ->writepage() and ->writepages() operations are supposed to write entire pages. However, on filesystems with a block size smaller than PAGE_SIZE, __gfs2_jdata_writepage() only adds the first block to the current transaction instead of adding the entire page. Fix that.
Fixes: 18ec7d5c3f43 ("[GFS2] Make journaled data files identical to normal files on disk") Signed-off-by: Andreas Gruenbacher agruenba@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/gfs2/aops.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c index e782b4f1d1043..2f04c0ff7470b 100644 --- a/fs/gfs2/aops.c +++ b/fs/gfs2/aops.c @@ -127,7 +127,6 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w { struct inode *inode = page->mapping->host; struct gfs2_inode *ip = GFS2_I(inode); - struct gfs2_sbd *sdp = GFS2_SB(inode);
if (PageChecked(page)) { ClearPageChecked(page); @@ -135,7 +134,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w create_empty_buffers(page, inode->i_sb->s_blocksize, BIT(BH_Dirty)|BIT(BH_Uptodate)); } - gfs2_page_add_databufs(ip, page, 0, sdp->sd_vfs->s_blocksize); + gfs2_page_add_databufs(ip, page, 0, PAGE_SIZE); } return gfs2_write_jdata_page(page, wbc); }
From: Ian Rogers irogers@google.com
[ Upstream commit 9f19aab47ced012eddef1e2bc96007efc7713b61 ]
The LLVM template is first echo-ed into command_out and then command_out executed. The echo surrounds the template with double quotes, however, the template itself may contain quotes. This is generally innocuous but in tools/perf/tests/bpf-script-test-prologue.c we see: ... SEC("func=null_lseek file->f_mode offset orig") ... where the first double quote ends the double quote of the echo, then the > redirects output into a file called f_mode.
To avoid this inadvertent behavior substitute redirects and similar characters to be ASCII control codes, then substitute the output in the echo back again.
Fixes: 5eab5a7ee032acaa ("perf llvm: Display eBPF compiling command in debug output") Signed-off-by: Ian Rogers irogers@google.com Cc: Alexander Shishkin alexander.shishkin@linux.intel.com Cc: Andrii Nakryiko andrii@kernel.org Cc: bpf@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: Jiri Olsa jolsa@kernel.org Cc: llvm@lists.linux.dev Cc: Mark Rutland mark.rutland@arm.com Cc: Namhyung Kim namhyung@kernel.org Cc: Nathan Chancellor nathan@kernel.org Cc: Nick Desaulniers ndesaulniers@google.com Cc: Peter Zijlstra peterz@infradead.org Cc: Tom Rix trix@redhat.com Link: https://lore.kernel.org/r/20230105082609.344538-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/util/llvm-utils.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c index 650ffe336f3aa..4e8e243a6e4bd 100644 --- a/tools/perf/util/llvm-utils.c +++ b/tools/perf/util/llvm-utils.c @@ -531,14 +531,37 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf,
pr_debug("llvm compiling command template: %s\n", template);
+ /* + * Below, substitute control characters for values that can cause the + * echo to misbehave, then substitute the values back. + */ err = -ENOMEM; - if (asprintf(&command_echo, "echo -n "%s"", template) < 0) + if (asprintf(&command_echo, "echo -n \a%s\a", template) < 0) goto errout;
+#define SWAP_CHAR(a, b) do { if (*p == a) *p = b; } while (0) + for (char *p = command_echo; *p; p++) { + SWAP_CHAR('<', '\001'); + SWAP_CHAR('>', '\002'); + SWAP_CHAR('"', '\003'); + SWAP_CHAR(''', '\004'); + SWAP_CHAR('|', '\005'); + SWAP_CHAR('&', '\006'); + SWAP_CHAR('\a', '"'); + } err = read_from_pipe(command_echo, (void **) &command_out, NULL); if (err) goto errout;
+ for (char *p = command_out; *p; p++) { + SWAP_CHAR('\001', '<'); + SWAP_CHAR('\002', '>'); + SWAP_CHAR('\003', '"'); + SWAP_CHAR('\004', '''); + SWAP_CHAR('\005', '|'); + SWAP_CHAR('\006', '&'); + } +#undef SWAP_CHAR pr_debug("llvm compiling command : %s\n", command_out);
err = read_from_pipe(template, &obj_buf, &obj_buf_sz);
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit da1afe8e6099980fe1e2fd7436dca284af9d3f29 ]
class_find_device_by_of_node() calls class_find_device(), it will take the reference, use the put_device() to drop the reference when not need anymore.
Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()") Signed-off-by: Miaoqian Lin linmq006@gmail.com Signed-off-by: Lee Jones lee@kernel.org Link: https://lore.kernel.org/r/20221220121807.1543790-1-linmq006@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/leds/led-class.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c index 7391d2cf1370a..aa39b2a48fdff 100644 --- a/drivers/leds/led-class.c +++ b/drivers/leds/led-class.c @@ -235,6 +235,7 @@ struct led_classdev *of_led_get(struct device_node *np, int index)
led_dev = class_find_device_by_of_node(leds_class, led_node); of_node_put(led_node); + put_device(led_dev);
if (!led_dev) return ERR_PTR(-EPROBE_DEFER);
From: Andy Shevchenko andriy.shevchenko@linux.intel.com
[ Upstream commit a82c7cf803d98751cd3ddb35828faad925d71982 ]
Clang complains that devm_add_action() takes a parameter with a wrong type:
warning: cast from 'void (*)(struct mutex *)' to 'void (*)(void *)' converts to incompatible function type [-Wcast-function-type-strict] err = devm_add_action(dev, (void (*)(void *))mutex_destroy, &is31->lock); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated.
It appears that the commit e1af5c815586 ("leds: is31fl319x: Fix devm vs. non-devm ordering") missed two things:
- whilst the commit mentions devm_add_action_or_reset() the actual change utilised devm_add_action() call by mistake - strictly speaking the parameter is not compatible by type
Fix both issues by switching to devm_add_action_or_reset() and adding a wrapper for mutex_destroy() call.
Reported-by: kernel test robot lkp@intel.com Fixes: e1af5c815586 ("leds: is31fl319x: Fix devm vs. non-devm ordering") Signed-off-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Tested-by: Vincent Knecht vincent.knecht@mailoo.org Signed-off-by: Lee Jones lee@kernel.org Link: https://lore.kernel.org/r/20221228093238.82713-1-andriy.shevchenko@linux.int... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/leds/leds-is31fl319x.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/leds/leds-is31fl319x.c b/drivers/leds/leds-is31fl319x.c index b2f4c4ec7c567..7c908414ac7e0 100644 --- a/drivers/leds/leds-is31fl319x.c +++ b/drivers/leds/leds-is31fl319x.c @@ -495,6 +495,11 @@ static inline int is31fl3196_db_to_gain(u32 dezibel) return dezibel / IS31FL3196_AUDIO_GAIN_DB_STEP; }
+static void is31f1319x_mutex_destroy(void *lock) +{ + mutex_destroy(lock); +} + static int is31fl319x_probe(struct i2c_client *client) { struct is31fl319x_chip *is31; @@ -511,7 +516,7 @@ static int is31fl319x_probe(struct i2c_client *client) return -ENOMEM;
mutex_init(&is31->lock); - err = devm_add_action(dev, (void (*)(void *))mutex_destroy, &is31->lock); + err = devm_add_action_or_reset(dev, is31f1319x_mutex_destroy, &is31->lock); if (err) return err;
From: Henning Schild henning.schild@siemens.com
[ Upstream commit c64964ebee2a415384385205950ee7a05f78451e ]
If we register a "leds-gpio" platform device for GPIO pins that do not exist we get a -EPROBE_DEFER and the probe will be tried again later. If there is no driver to provide that pin we will poll forever and also create a lot of log messages.
So check if that GPIO driver is configured, if so it will come up eventually. If not, we exit our probe function early and do not even bother registering the "leds-gpio". This method was chosen over "Kconfig depends" since this way we can add support for more devices and GPIO backends more easily without "depends":ing on all GPIO backends.
Fixes: a6c80bec3c93 ("leds: simatic-ipc-leds-gpio: Add GPIO version of Siemens driver") Signed-off-by: Henning Schild henning.schild@siemens.com Reviewed-by: Andy Shevchenko andy.shevchenko@gmail.com Signed-off-by: Lee Jones lee@kernel.org Link: https://lore.kernel.org/r/20221007153323.1326-1-henning.schild@siemens.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/leds/simple/simatic-ipc-leds-gpio.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/leds/simple/simatic-ipc-leds-gpio.c b/drivers/leds/simple/simatic-ipc-leds-gpio.c index 07f0d79d604d4..e8d329b5a68c3 100644 --- a/drivers/leds/simple/simatic-ipc-leds-gpio.c +++ b/drivers/leds/simple/simatic-ipc-leds-gpio.c @@ -77,6 +77,8 @@ static int simatic_ipc_leds_gpio_probe(struct platform_device *pdev)
switch (plat->devmode) { case SIMATIC_IPC_DEVICE_127E: + if (!IS_ENABLED(CONFIG_PINCTRL_BROXTON)) + return -ENODEV; simatic_ipc_led_gpio_table = &simatic_ipc_led_gpio_table_127e; break; case SIMATIC_IPC_DEVICE_227G:
From: Andreas Ziegler br015@umbiko.net
[ Upstream commit fe137a4fe0e77eb95396cfc5c3dd7df404421aa4 ]
Sampled durations must be weighted by observed quantity, to arrive at a correct average duration value.
Perform calculation of total duration by summing (duration * count).
Link: https://lkml.kernel.org/r/20230103103400.275566-2-br015@umbiko.net
Fixes: 829a6c0b5698 ("rtla/osnoise: Add the hist mode")
Signed-off-by: Andreas Ziegler br015@umbiko.net Acked-by: Daniel Bristot de Oliveira bristot@kernel.org Signed-off-by: Steven Rostedt (Google) rostedt@goodmis.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/tracing/rtla/src/osnoise_hist.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/tracing/rtla/src/osnoise_hist.c b/tools/tracing/rtla/src/osnoise_hist.c index 5d7ea479ac89f..fe34452fc4ec0 100644 --- a/tools/tracing/rtla/src/osnoise_hist.c +++ b/tools/tracing/rtla/src/osnoise_hist.c @@ -121,6 +121,7 @@ static void osnoise_hist_update_multiple(struct osnoise_tool *tool, int cpu, { struct osnoise_hist_params *params = tool->params; struct osnoise_hist_data *data = tool->data; + unsigned long long total_duration; int entries = data->entries; int bucket; int *hist; @@ -131,10 +132,12 @@ static void osnoise_hist_update_multiple(struct osnoise_tool *tool, int cpu, if (data->bucket_size) bucket = duration / data->bucket_size;
+ total_duration = duration * count; + hist = data->hist[cpu].samples; data->hist[cpu].count += count; update_min(&data->hist[cpu].min_sample, &duration); - update_sum(&data->hist[cpu].sum_sample, &duration); + update_sum(&data->hist[cpu].sum_sample, &total_duration); update_max(&data->hist[cpu].max_sample, &duration);
if (bucket < entries)
From: Namhyung Kim namhyung@kernel.org
[ Upstream commit 1746212daeba95e9ae1639227dc0c3591d41deeb ]
In copy_bytes(), it reads the data from the (input) fd and writes it to the output file. But it does with the read(2) unconditionally which caused a problem of mixing buffered vs unbuffered I/O together.
You can see the problem when using pipes.
$ perf record -e intel_pt// -o- true | perf inject -b > /dev/null [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.000 MB - ] 0x45c0 [0x30]: failed to process type: 71
It should use perf_data__read() to honor the 'use_stdio' setting.
Fixes: 601366678c93618f ("perf data: Allow to use stdio functions for pipe mode") Reviewed-by: Adrian Hunter adrian.hunter@intel.com Reviewed-by: James Clark james.clark@arm.com Signed-off-by: Namhyung Kim namhyung@kernel.org Cc: Ian Rogers irogers@google.com Cc: Ingo Molnar mingo@kernel.org Cc: Jiri Olsa jolsa@kernel.org Cc: Leo Yan leo.yan@linaro.org Cc: Namhyung Kim namhyung@kernel.org Cc: Peter Zijlstra peterz@infradead.org Cc: Stephane Eranian eranian@google.com Link: https://lore.kernel.org/r/20230131023350.1903992-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/builtin-inject.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c index 3f4e4dd5abf31..f8182417b7341 100644 --- a/tools/perf/builtin-inject.c +++ b/tools/perf/builtin-inject.c @@ -215,14 +215,14 @@ static int perf_event__repipe_event_update(struct perf_tool *tool,
#ifdef HAVE_AUXTRACE_SUPPORT
-static int copy_bytes(struct perf_inject *inject, int fd, off_t size) +static int copy_bytes(struct perf_inject *inject, struct perf_data *data, off_t size) { char buf[4096]; ssize_t ssz; int ret;
while (size > 0) { - ssz = read(fd, buf, min(size, (off_t)sizeof(buf))); + ssz = perf_data__read(data, buf, min(size, (off_t)sizeof(buf))); if (ssz < 0) return -errno; ret = output_bytes(inject, buf, ssz); @@ -260,7 +260,7 @@ static s64 perf_event__repipe_auxtrace(struct perf_session *session, ret = output_bytes(inject, event, event->header.size); if (ret < 0) return ret; - ret = copy_bytes(inject, perf_data__fd(session->data), + ret = copy_bytes(inject, session->data, event->auxtrace.size); } else { ret = output_bytes(inject, event,
From: Namhyung Kim namhyung@kernel.org
[ Upstream commit aeb802f872a7c42e4381f36041e77d1745908255 ]
When it processes AUXTRACE_INFO, it calls to auxtrace_queue_data() to collect AUXTRACE data first. That won't work with pipe since it needs lseek() to read the scattered aux data.
$ perf record -o- -e intel_pt// true | perf report -i- --itrace=i100 # To display the perf.data header info, please use --header/--header-only options. # 0x4118 [0xa0]: failed to process type: 70 Error: failed to process sample
For the pipe mode, it can handle the aux data as it gets. But there's no guarantee it can get the aux data in time. So the following warning will be shown at the beginning:
WARNING: Intel PT with pipe mode is not recommended. The output cannot relied upon. In particular, time stamps and the order of events may be incorrect.
Fixes: dbd134322e74f19d ("perf intel-pt: Add support for decoding AUX area samples") Reviewed-by: Adrian Hunter adrian.hunter@intel.com Reviewed-by: James Clark james.clark@arm.com Signed-off-by: Namhyung Kim namhyung@kernel.org Cc: Adrian Hunter adrian.hunter@intel.com Cc: Ian Rogers irogers@google.com Cc: Ingo Molnar mingo@kernel.org Cc: Jiri Olsa jolsa@kernel.org Cc: Leo Yan leo.yan@linaro.org Cc: Peter Zijlstra peterz@infradead.org Cc: Stephane Eranian eranian@google.com Link: https://lore.kernel.org/r/20230131023350.1903992-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/Documentation/perf-intel-pt.txt | 30 ++++++++++++++++++++++ tools/perf/util/auxtrace.c | 3 +++ tools/perf/util/intel-pt.c | 6 +++++ 3 files changed, 39 insertions(+)
diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt index 7b6ccd2fa3bf1..9d485a9cdb198 100644 --- a/tools/perf/Documentation/perf-intel-pt.txt +++ b/tools/perf/Documentation/perf-intel-pt.txt @@ -1821,6 +1821,36 @@ Can be compiled and traced: $
+Pipe mode +--------- +Pipe mode is a problem for Intel PT and possibly other auxtrace users. +It's not recommended to use a pipe as data output with Intel PT because +of the following reason. + +Essentially the auxtrace buffers do not behave like the regular perf +event buffers. That is because the head and tail are updated by +software, but in the auxtrace case the data is written by hardware. +So the head and tail do not get updated as data is written. + +In the Intel PT case, the head and tail are updated only when the trace +is disabled by software, for example: + - full-trace, system wide : when buffer passes watermark + - full-trace, not system-wide : when buffer passes watermark or + context switches + - snapshot mode : as above but also when a snapshot is made + - sample mode : as above but also when a sample is made + +That means finished-round ordering doesn't work. An auxtrace buffer +can turn up that has data that extends back in time, possibly to the +very beginning of tracing. + +For a perf.data file, that problem is solved by going through the trace +and queuing up the auxtrace buffers in advance. + +For pipe mode, the order of events and timestamps can presumably +be messed up. + + EXAMPLE -------
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c index c2e323cd7d496..d4b04fa07a119 100644 --- a/tools/perf/util/auxtrace.c +++ b/tools/perf/util/auxtrace.c @@ -1133,6 +1133,9 @@ int auxtrace_queue_data(struct perf_session *session, bool samples, bool events) if (auxtrace__dont_decode(session)) return 0;
+ if (perf_data__is_pipe(session->data)) + return 0; + if (!session->auxtrace || !session->auxtrace->queue_data) return -EINVAL;
diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c index 6d3921627e332..b8b29756fbf13 100644 --- a/tools/perf/util/intel-pt.c +++ b/tools/perf/util/intel-pt.c @@ -4379,6 +4379,12 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
intel_pt_setup_pebs_events(pt);
+ if (perf_data__is_pipe(session->data)) { + pr_warning("WARNING: Intel PT with pipe mode is not recommended.\n" + " The output cannot relied upon. In particular,\n" + " timestamps and the order of events may be incorrect.\n"); + } + if (pt->sampling_mode || list_empty(&session->auxtrace_index)) err = auxtrace_queue_data(session, true, true); else
From: Namhyung Kim namhyung@kernel.org
[ Upstream commit dd15480a3d67b9cf04a1f6f5d60f1c0dc018e22f ]
The current display code for perf stat iterates given cpus and build the aggr map to collect the event data for the aggregation mode.
But uncore events have their own cpu maps and it won't guarantee that it'd match to the aggr map. For example, per-package uncore events would generate a single value for each socket. When user asks per-core aggregation mode, the output would contain 0 values for other cores.
Thus it needs to check the uncore PMU's cpumask and if it matches to the current aggregation id.
Before: $ sudo ./perf stat -a --per-core -e power/energy-pkg/ sleep 1
Performance counter stats for 'system wide':
S0-D0-C0 1 3.73 Joules power/energy-pkg/ S0-D0-C1 0 <not counted> Joules power/energy-pkg/ S0-D0-C2 0 <not counted> Joules power/energy-pkg/ S0-D0-C3 0 <not counted> Joules power/energy-pkg/
1.001404046 seconds time elapsed
Some events weren't counted. Try disabling the NMI watchdog: echo 0 > /proc/sys/kernel/nmi_watchdog perf stat ... echo 1 > /proc/sys/kernel/nmi_watchdog
The core 1, 2 and 3 should not be printed because the event is handled in a cpu in the core 0 only. With this change, the output becomes like below.
After: $ sudo ./perf stat -a --per-core -e power/energy-pkg/ sleep 1
Performance counter stats for 'system wide':
S0-D0-C0 1 2.09 Joules power/energy-pkg/
Fixes: b897613510890d6e ("perf stat: Update event skip condition for system-wide per-thread mode and merged uncore and hybrid events") Signed-off-by: Namhyung Kim namhyung@kernel.org Tested-by: Ian Rogers irogers@google.com Acked-by: Ian Rogers irogers@google.com Cc: Adrian Hunter adrian.hunter@intel.com Cc: Athira Rajeev atrajeev@linux.vnet.ibm.com Cc: Ingo Molnar mingo@kernel.org Cc: Jiri Olsa jolsa@kernel.org Cc: Michael Petlan mpetlan@redhat.com Cc: Namhyung Kim namhyung@kernel.org Cc: Peter Zijlstra peterz@infradead.org Link: https://lore.kernel.org/r/20230125192431.2929677-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/util/stat-display.c | 51 ++++++++++++++++++++++++++++++---- 1 file changed, 46 insertions(+), 5 deletions(-)
diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c index 8bd8b0142630c..1b5cb20efd237 100644 --- a/tools/perf/util/stat-display.c +++ b/tools/perf/util/stat-display.c @@ -787,6 +787,51 @@ static void uniquify_counter(struct perf_stat_config *config, struct evsel *coun uniquify_event_name(counter); }
+/** + * should_skip_zero_count() - Check if the event should print 0 values. + * @config: The perf stat configuration (including aggregation mode). + * @counter: The evsel with its associated cpumap. + * @id: The aggregation id that is being queried. + * + * Due to mismatch between the event cpumap or thread-map and the + * aggregation mode, sometimes it'd iterate the counter with the map + * which does not contain any values. + * + * For example, uncore events have dedicated CPUs to manage them, + * result for other CPUs should be zero and skipped. + * + * Return: %true if the value should NOT be printed, %false if the value + * needs to be printed like "<not counted>" or "<not supported>". + */ +static bool should_skip_zero_counter(struct perf_stat_config *config, + struct evsel *counter, + const struct aggr_cpu_id *id) +{ + struct perf_cpu cpu; + int idx; + + /* + * Skip value 0 when enabling --per-thread globally, + * otherwise it will have too many 0 output. + */ + if (config->aggr_mode == AGGR_THREAD && config->system_wide) + return true; + /* + * Skip value 0 when it's an uncore event and the given aggr id + * does not belong to the PMU cpumask. + */ + if (!counter->pmu || !counter->pmu->is_uncore) + return false; + + perf_cpu_map__for_each_cpu(cpu, idx, counter->pmu->cpus) { + struct aggr_cpu_id own_id = config->aggr_get_id(config, cpu); + + if (aggr_cpu_id__equal(id, &own_id)) + return false; + } + return true; +} + static void print_counter_aggrdata(struct perf_stat_config *config, struct evsel *counter, int s, struct outstate *os) @@ -814,11 +859,7 @@ static void print_counter_aggrdata(struct perf_stat_config *config, ena = aggr->counts.ena; run = aggr->counts.run;
- /* - * Skip value 0 when enabling --per-thread globally, otherwise it will - * have too many 0 output. - */ - if (val == 0 && config->aggr_mode == AGGR_THREAD && config->system_wide) + if (val == 0 && should_skip_zero_counter(config, counter, &id)) return;
if (!metric_only) {
From: Ian Rogers irogers@google.com
[ Upstream commit d2e3dc829e389d686194d06f0a64adda4158faae ]
A character encoding issue added a "3D" character that breaks the metrics test.
Fixes: 40769665b63d8c84 ("perf jevents: Parse metrics during conversion") Reviewed-by: Kajol Jain kjain@linux.ibm.com Signed-off-by: Ian Rogers irogers@google.com Cc: Adrian Hunter adrian.hunter@intel.com Cc: Alexander Shishkin alexander.shishkin@linux.intel.com Cc: Caleb Biggers caleb.biggers@intel.com Cc: Florian Fischer florian.fischer@muhq.space Cc: Ian Rogers irogers@google.com Cc: Ingo Molnar mingo@redhat.com Cc: James Clark james.clark@arm.com Cc: Jing Zhang renyu.zj@linux.alibaba.com Cc: Jiri Olsa jolsa@kernel.org Cc: John Garry john.g.garry@oracle.com Cc: Kan Liang kan.liang@linux.intel.com Cc: Kang Minchul tegongkang@gmail.com Cc: Kim Phillips kim.phillips@amd.com Cc: Leo Yan leo.yan@linaro.org Cc: Mark Rutland mark.rutland@arm.com Cc: Mike Leach mike.leach@linaro.org Cc: Namhyung Kim namhyung@kernel.org Cc: Perry Taylor perry.taylor@intel.com Cc: Peter Zijlstra peterz@infradead.org Cc: Ravi Bangoria ravi.bangoria@amd.com Cc: Rob Herring robh@kernel.org Cc: Sandipan Das sandipan.das@amd.com Cc: Stephane Eranian eranian@google.com Cc: Will Deacon will@kernel.org Cc: Xing Zhengjun zhengjun.xing@linux.intel.com Cc: linux-arm-kernel@lists.infradead.org Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20230126233645.200509-14-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/pmu-events/metric_test.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/pmu-events/metric_test.py b/tools/perf/pmu-events/metric_test.py index 15315d0f716ca..6980f452df0ad 100644 --- a/tools/perf/pmu-events/metric_test.py +++ b/tools/perf/pmu-events/metric_test.py @@ -87,8 +87,8 @@ class TestMetricExpressions(unittest.TestCase): after = r'min((a + b if c > 1 else c + d), e + f)' self.assertEqual(ParsePerfJson(before).ToPerfJson(), after)
- before =3D r'a if b else c if d else e' - after =3D r'(a if b else (c if d else e))' + before = r'a if b else c if d else e' + after = r'(a if b else (c if d else e))' self.assertEqual(ParsePerfJson(before).ToPerfJson(), after)
def test_ToPython(self):
From: Athira Rajeev atrajeev@linux.vnet.ibm.com
[ Upstream commit 34266f904abd45731bdade2e92d0536c092ee9bc ]
Perf BPF filter test fails in environment where "kernel-debuginfo" is not installed.
Test failure logs:
<<>> 42: BPF filter : 42.1: Basic BPF filtering : Ok 42.2: BPF pinning : Ok 42.3: BPF prologue generation : FAILED! <<>>
Enabling verbose option provided debug logs, which says debuginfo needs to be installed. Snippet of verbose logs:
<<>> 42.3: BPF prologue generation : --- start --- test child forked, pid 28218 <<>> Rebuild with CONFIG_DEBUG_INFO=y, or install an appropriate debuginfo package. bpf_probe: failed to convert perf probe events Failed to add events selected by BPF test child finished with -1 ---- end ---- BPF filter subtest 3: FAILED! <<>>
Here the subtest "BPF prologue generation" failed and logs shows debuginfo is needed. After installing kernel-debuginfo package, testcase passes.
The "BPF prologue generation" subtest failed because, the do_test() returns TEST_FAIL without checking the error type returned by parse_events_load_bpf_obj().
parse_events_load_bpf_obj() can also return error of type -ENODATA incase kernel-debuginfo package is not installed. Fix this by adding check for -ENODATA error.
Test result after the patch changes:
Test failure logs:
<<>> 42: BPF filter : 42.1: Basic BPF filtering : Ok 42.2: BPF pinning : Ok 42.3: BPF prologue generation : Skip (clang/debuginfo isn't installed or environment missing BPF support) <<>>
Fixes: ba1fae431e74bb42 ("perf test: Add 'perf test BPF'") Signed-off-by: Athira Rajeev atrajeev@linux.vnet.ibm.com Cc: Andi Kleen ak@linux.intel.com Cc: Disha Goel disgoel@linux.ibm.com Cc: Ian Rogers irogers@google.com Cc: James Clark james.clark@arm.com Cc: Jiri Olsa jolsa@kernel.org Cc: Kajol Jain kjain@linux.ibm.com Cc: Madhavan Srinivasan maddy@linux.vnet.ibm.com Cc: Michael Ellerman mpe@ellerman.id.au Cc: Nageswara R Sastry rnsastry@linux.ibm.com Cc: Namhyung Kim namhyung@kernel.org Cc: Wang Nan wangnan0@huawei.com Cc: linuxppc-dev@lists.ozlabs.org Link: http://lore.kernel.org/linux-perf-users/Y7bIk77mdE4j8Jyi@kernel.org Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/tests/bpf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c index 17c023823713d..6a4235a9cf57e 100644 --- a/tools/perf/tests/bpf.c +++ b/tools/perf/tests/bpf.c @@ -126,6 +126,10 @@ static int do_test(struct bpf_object *obj, int (*func)(void),
err = parse_events_load_bpf_obj(&parse_state, &parse_state.list, obj, NULL); parse_events_error__exit(&parse_error); + if (err == -ENODATA) { + pr_debug("Failed to add events selected by BPF, debuginfo package not installed\n"); + return TEST_SKIP; + } if (err || list_empty(&parse_state.list)) { pr_debug("Failed to add events selected by BPF\n"); return TEST_FAIL; @@ -368,7 +372,7 @@ static struct test_case bpf_tests[] = { "clang isn't installed or environment missing BPF support"), #ifdef HAVE_BPF_PROLOGUE TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test, - "clang isn't installed or environment missing BPF support"), + "clang/debuginfo isn't installed or environment missing BPF support"), #else TEST_CASE_REASON("BPF prologue generation", bpf_prologue_test, "not compiled in"), #endif
From: Yicong Yang yangyicong@hisilicon.com
[ Upstream commit ffd1240e8f0814262ceb957dbe961f6e0aef1e7a ]
On aarch64 CPU related events are not under event_source/devices/cpu/events, they're under event_source/devices/armv8_pmuv3_0/events on my machine. Using current auto-complete script will generate below error:
[root@localhost bin]# perf stat -e ls: cannot access '/sys/bus/event_source/devices/cpu/events': No such file or directory
Fix this by not testing /sys/bus/event_source/devices/cpu/events on aarch64 machine.
Fixes: 74cd5815d9af6e6c ("perf tool: Improve bash command line auto-complete for multiple events with comma") Reviewed-by: James Clark james.clark@arm.com Signed-off-by: Yicong Yang yangyicong@hisilicon.com Cc: Alexander Shishkin alexander.shishkin@linux.intel.com Cc: Ingo Molnar mingo@redhat.com Cc: Jin Yao yao.jin@linux.intel.com Cc: Jiri Olsa jolsa@kernel.org Cc: Mark Rutland mark.rutland@arm.com Cc: Namhyung Kim namhyung@kernel.org Cc: Peter Zijlstra peterz@infradead.org Cc: linux-arm-kernel@lists.infradead.org Cc: linuxarm@huawei.com Cc: prime.zeng@hisilicon.com Link: https://lore.kernel.org/r/20230207035057.43394-1-yangyicong@huawei.com Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/perf-completion.sh | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/tools/perf/perf-completion.sh b/tools/perf/perf-completion.sh index fdf75d45efff7..978249d7868c2 100644 --- a/tools/perf/perf-completion.sh +++ b/tools/perf/perf-completion.sh @@ -165,7 +165,12 @@ __perf_main ()
local cur1=${COMP_WORDS[COMP_CWORD]} local raw_evts=$($cmd list --raw-dump) - local arr s tmp result + local arr s tmp result cpu_evts + + # aarch64 doesn't have /sys/bus/event_source/devices/cpu/events + if [[ `uname -m` != aarch64 ]]; then + cpu_evts=$(ls /sys/bus/event_source/devices/cpu/events) + fi
if [[ "$cur1" == */* && ${cur1#*/} =~ ^[A-Z] ]]; then OLD_IFS="$IFS" @@ -183,9 +188,9 @@ __perf_main () fi done
- evts=${result}" "$(ls /sys/bus/event_source/devices/cpu/events) + evts=${result}" "${cpu_evts} else - evts=${raw_evts}" "$(ls /sys/bus/event_source/devices/cpu/events) + evts=${raw_evts}" "${cpu_evts} fi
if [[ "$cur1" == , ]]; then
From: Ian Rogers irogers@google.com
[ Upstream commit 37f322cd58d81a9d46456531281c908de9ef6e42 ]
The added perf_stat_merge_counters combines uncore counters. When metrics are enabled, the counts are merged into a metric_leader via the stat-shadow saved_value logic. As the leader now is passed an aggregated count, it leads to all counters being added together twice and counts appearing approximately doubled in metrics.
This change disables the saved_value merging of counts for evsels that are merged. It is recommended that later changes remove the saved_value entirely as the two layers of aggregation in the code is confusing.
Fixes: 942c5593393d9418 ("perf stat: Add perf_stat_merge_counters()") Reported-by: Perry Taylor perry.taylor@intel.com Signed-off-by: Ian Rogers irogers@google.com Acked-by: Namhyung Kim namhyung@kernel.org Cc: Alexander Shishkin alexander.shishkin@linux.intel.com Cc: Eduard Zingerman eddyz87@gmail.com Cc: Florian Fischer florian.fischer@muhq.space Cc: Ingo Molnar mingo@redhat.com Cc: James Clark james.clark@arm.com Cc: Jiri Olsa jolsa@kernel.org Cc: Mark Rutland mark.rutland@arm.com Cc: Namhyung Kim namhyung@kernel.org Cc: Peter Zijlstra peterz@infradead.org Cc: Stephane Eranian eranian@google.com Cc: Xing Zhengjun zhengjun.xing@linux.intel.com Link: https://lore.kernel.org/r/20230209064447.83733-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/util/stat-shadow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c index cadb2df23c878..4cd05d9205e3b 100644 --- a/tools/perf/util/stat-shadow.c +++ b/tools/perf/util/stat-shadow.c @@ -311,7 +311,7 @@ void perf_stat__update_shadow_stats(struct evsel *counter, u64 count, update_stats(&v->stats, count); if (counter->metric_leader) v->metric_total += count; - } else if (counter->metric_leader) { + } else if (counter->metric_leader && !counter->merged_stat) { v = saved_value_lookup(counter->metric_leader, map_idx, true, STAT_NONE, 0, st, rsd.cgrp); v->metric_total += count;
From: Randy Dunlap rdunlap@infradead.org
[ Upstream commit 7be6a87c2473957090995b7eb541e31d57a2c801 ]
When doing randconfig builds for sparc32 with COMPILE_TEST, some (non-Sparc) drivers cause kconfig warnings with the Kconfig symbols PM, PM_GENERIC_DOMAINS, or PM_GENERIC_DOMAINS_OF.
This is due to arch/sparc/Kconfig not using the PM Kconfig for Sparc32:
if SPARC64 source "kernel/power/Kconfig" endif
Arnd suggested adding "|| COMPILE_TEST" to the conditional, instead of trying to track down every driver that selects any of these PM symbols.
Fixes the following kconfig warnings:
WARNING: unmet direct dependencies detected for PM Depends on [n]: SPARC64 [=n] Selected by [y]: - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
WARNING: unmet direct dependencies detected for PM Depends on [n]: SPARC64 [=n] Selected by [y]: - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y])
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS Depends on [n]: SPARC64 [=n] && PM [=y] Selected by [y]: - QCOM_GDSC [=y] && COMMON_CLK [=y] && PM [=y] - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) - MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] - BCM2835_POWER [=y] && (ARCH_BCM2835 || COMPILE_TEST [=y] && OF [=y]) && PM [=y] - BCM_PMB [=y] && (ARCH_BCMBCA || COMPILE_TEST [=y] && OF [=y]) && PM [=y] - ROCKCHIP_PM_DOMAINS [=y] && (ARCH_ROCKCHIP || COMPILE_TEST [=y]) && PM [=y] Selected by [m]: - ARM_SCPI_POWER_DOMAIN [=m] && (ARM_SCPI_PROTOCOL [=m] || COMPILE_TEST [=y] && OF [=y]) && PM [=y] - MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] - QCOM_AOSS_QMP [=m] && (ARCH_QCOM || COMPILE_TEST [=y]) && MAILBOX [=y] && COMMON_CLK [=y] && PM [=y]
WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS_OF Depends on [n]: SPARC64 [=n] && PM_GENERIC_DOMAINS [=y] && OF [=y] Selected by [y]: - MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] Selected by [m]: - MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y]
Link: https://lkml.kernel.org/r/20230205004357.29459-1-rdunlap@infradead.org Fixes: bdde6b3c8ba4 ("sparc64: Hibernation support") Signed-off-by: Randy Dunlap rdunlap@infradead.org Suggested-by: Arnd Bergmann arnd@arndb.de Acked-by: Sam Ravnborg sam@ravnborg.org Cc: "David S. Miller" davem@davemloft.net Cc: Kirill Tkhai tkhai@yandex.ru Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/sparc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig index 4d3d1af90d521..84437a4c65454 100644 --- a/arch/sparc/Kconfig +++ b/arch/sparc/Kconfig @@ -283,7 +283,7 @@ config ARCH_FORCE_MAX_ORDER This config option is actually maximum order plus one. For example, a value of 13 means that the largest free memory block is 2^12 pages.
-if SPARC64 +if SPARC64 || COMPILE_TEST source "kernel/power/Kconfig" endif
From: Guillaume Tucker guillaume.tucker@collabora.com
[ Upstream commit 4ebe33398c40c1118b4d8546978036c0e0032d1b ]
Find the actual echo binary using $(which echo) and use it for formatted output with -ne. On some systems, the default echo command doesn't handle the -e option and the output looks like this (arm64 build):
-ne Emit Tests for alsa
-ne Emit Tests for amd-pstate
-ne Emit Tests for arm64
This is for example the case with the KernelCI Docker images e.g. kernelci/gcc-10:x86-kselftest-kernelci. With the actual echo binary (e.g. in /bin/echo), the output is formatted as expected (x86 build this time):
Emit Tests for alsa Emit Tests for amd-pstate Skipping non-existent dir: arm64
Only the install target is using "echo -ne" so keep the $ECHO variable local to it.
Reported-by: "kernelci.org bot" bot@kernelci.org Fixes: 3297a4df805d ("kselftests: Enable the echo command to print newlines in Makefile") Signed-off-by: Guillaume Tucker guillaume.tucker@collabora.com Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/Makefile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile index 41b649452560c..9619d0f3b2ffb 100644 --- a/tools/testing/selftests/Makefile +++ b/tools/testing/selftests/Makefile @@ -234,10 +234,11 @@ ifdef INSTALL_PATH @# While building kselftest-list.text skip also non-existent TARGET dirs: @# they could be the result of a build failure and should NOT be @# included in the generated runlist. + ECHO=`which echo`; \ for TARGET in $(TARGETS); do \ BUILD_TARGET=$$BUILD/$$TARGET; \ - [ ! -d $(INSTALL_PATH)/$$TARGET ] && echo "Skipping non-existent dir: $$TARGET" && continue; \ - echo -ne "Emit Tests for $$TARGET\n"; \ + [ ! -d $(INSTALL_PATH)/$$TARGET ] && $$ECHO "Skipping non-existent dir: $$TARGET" && continue; \ + $$ECHO -ne "Emit Tests for $$TARGET\n"; \ $(MAKE) -s --no-print-directory OUTPUT=$$BUILD_TARGET COLLECTION=$$TARGET \ -C $$TARGET emit_tests >> $(TEST_LIST); \ done;
From: Masami Hiramatsu (Google) mhiramat@kernel.org
[ Upstream commit 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 ]
Since commit a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable") introduced bash specific "==" comparation operator, that test will fail when we run it on a posix-shell. `checkbashisms` warned it as below.
possible bashism in ftrace/func_event_triggers.tc line 45 (should be 'b = a'): if [ "$e" == $val ]; then
This replaces it with "=".
Fixes: a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable") Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Reviewed-by: Steven Rostedt (Google) rostedt@goodmis.org Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc index 3eea2abf68f9e..2ad7d4b501cc1 100644 --- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc @@ -42,7 +42,7 @@ test_event_enabled() {
while [ $check_times -ne 0 ]; do e=`cat $EVENT_ENABLE` - if [ "$e" == $val ]; then + if [ "$e" = $val ]; then return 0 fi sleep $SLEEP_TIME
From: Guillaume Tucker guillaume.tucker@collabora.com
[ Upstream commit 9e34fad00fc889abbb99d751a4c22cf2bded10df ]
Rather than trying to guess which implementation of "echo" to run with support for "-ne" options, use "printf" instead of "echo -ne". It handles escape characters as a standard feature and it is widespread among modern shells.
Reported-by: "kernelci.org bot" bot@kernelci.org Suggested-by: David Laight David.Laight@ACULAB.COM Fixes: 3297a4df805d ("kselftests: Enable the echo command to print newlines in Makefile") Fixes: 79c16b1120fe ("selftests: find echo binary to use -ne options") Signed-off-by: Guillaume Tucker guillaume.tucker@collabora.com Reviewed-by: Guenter Roeck groeck@chromium.org Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/Makefile | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile index 9619d0f3b2ffb..06578963f4f1d 100644 --- a/tools/testing/selftests/Makefile +++ b/tools/testing/selftests/Makefile @@ -234,11 +234,10 @@ ifdef INSTALL_PATH @# While building kselftest-list.text skip also non-existent TARGET dirs: @# they could be the result of a build failure and should NOT be @# included in the generated runlist. - ECHO=`which echo`; \ for TARGET in $(TARGETS); do \ BUILD_TARGET=$$BUILD/$$TARGET; \ - [ ! -d $(INSTALL_PATH)/$$TARGET ] && $$ECHO "Skipping non-existent dir: $$TARGET" && continue; \ - $$ECHO -ne "Emit Tests for $$TARGET\n"; \ + [ ! -d $(INSTALL_PATH)/$$TARGET ] && printf "Skipping non-existent dir: $$TARGET\n" && continue; \ + printf "Emit Tests for $$TARGET\n"; \ $(MAKE) -s --no-print-directory OUTPUT=$$BUILD_TARGET COLLECTION=$$TARGET \ -C $$TARGET emit_tests >> $(TEST_LIST); \ done;
From: Yang Jihong yangjihong1@huawei.com
[ Upstream commit 91621be65d6812cd74b2ea09573ff9ee0cbf5666 ]
When --overwrite and --max-size options of perf record are used together, a segmentation fault occurs. The following is an example:
# perf record -e sched:sched* --overwrite --max-size 1K -a -- sleep 1 [ perf record: Woken up 1 times to write data ] perf: Segmentation fault Obtained 12 stack frames. ./perf/perf(+0x197673) [0x55f99710b673] /lib/x86_64-linux-gnu/libc.so.6(+0x3ef0f) [0x7fa45f3cff0f] ./perf/perf(+0x8eb40) [0x55f997002b40] ./perf/perf(+0x1f6882) [0x55f99716a882] ./perf/perf(+0x794c2) [0x55f996fed4c2] ./perf/perf(+0x7b7c7) [0x55f996fef7c7] ./perf/perf(+0x9074b) [0x55f99700474b] ./perf/perf(+0x12e23c) [0x55f9970a223c] ./perf/perf(+0x12e54a) [0x55f9970a254a] ./perf/perf(+0x7db60) [0x55f996ff1b60] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe6) [0x7fa45f3b2c86] ./perf/perf(+0x7dfe9) [0x55f996ff1fe9] Segmentation fault (core dumped)
backtrace of the core file is as follows:
(gdb) bt #0 record__bytes_written (rec=0x55f99755a200 <record>) at builtin-record.c:234 #1 record__output_max_size_exceeded (rec=0x55f99755a200 <record>) at builtin-record.c:242 #2 record__write (map=0x0, size=12816, bf=0x55f9978da2e0, rec=0x55f99755a200 <record>) at builtin-record.c:263 #3 process_synthesized_event (tool=tool@entry=0x55f99755a200 <record>, event=event@entry=0x55f9978da2e0, sample=sample@entry=0x0, machine=machine@entry=0x55f997893658) at builtin-record.c:618 #4 0x000055f99716a883 in __perf_event__synthesize_id_index (tool=tool@entry=0x55f99755a200 <record>, process=process@entry=0x55f997002aa0 <process_synthesized_event>, evlist=0x55f9978928b0, machine=machine@entry=0x55f997893658, from=from@entry=0) at util/synthetic-events.c:1895 #5 0x000055f99716a91f in perf_event__synthesize_id_index (tool=tool@entry=0x55f99755a200 <record>, process=process@entry=0x55f997002aa0 <process_synthesized_event>, evlist=<optimized out>, machine=machine@entry=0x55f997893658) at util/synthetic-events.c:1905 #6 0x000055f996fed4c3 in record__synthesize (tail=tail@entry=true, rec=0x55f99755a200 <record>) at builtin-record.c:1997 #7 0x000055f996fef7c8 in __cmd_record (argc=argc@entry=2, argv=argv@entry=0x7ffc67551260, rec=0x55f99755a200 <record>) at builtin-record.c:2802 #8 0x000055f99700474c in cmd_record (argc=<optimized out>, argv=0x7ffc67551260) at builtin-record.c:4258 #9 0x000055f9970a223d in run_builtin (p=0x55f997564d88 <commands+264>, argc=10, argv=0x7ffc67551260) at perf.c:330 #10 0x000055f9970a254b in handle_internal_command (argc=10, argv=0x7ffc67551260) at perf.c:384 #11 0x000055f996ff1b61 in run_argv (argcp=<synthetic pointer>, argv=<synthetic pointer>) at perf.c:428 #12 main (argc=<optimized out>, argv=0x7ffc67551260) at perf.c:562
The reason is that record__bytes_written accesses the freed memory rec->thread_data, The process is as follows: __cmd_record -> record__free_thread_data -> zfree(&rec->thread_data) // free rec->thread_data -> record__synthesize -> perf_event__synthesize_id_index -> process_synthesized_event -> record__write -> record__bytes_written // access rec->thread_data
We add a member variable "thread_bytes_written" in the struct "record" to save the data size written by the threads.
Fixes: 6d57581659f72299 ("perf record: Add support for limit perf output file size") Signed-off-by: Yang Jihong yangjihong1@huawei.com Acked-by: Namhyung Kim namhyung@kernel.org Cc: Alexander Shishkin alexander.shishkin@linux.intel.com Cc: Ingo Molnar mingo@redhat.com Cc: Jiri Olsa jolsa@kernel.org Cc: Jiwei Sun jiwei.sun@windriver.com Cc: Mark Rutland mark.rutland@arm.com Cc: Peter Zijlstra peterz@infradead.org Link: https://lore.kernel.org/r/CAM9d7ci_TRrqBQVQNW8=GwakUr7SsZpYxaaty-S4bxF8zJWyq... Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/builtin-record.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c index 29dcd454b8e21..8374117e66f6e 100644 --- a/tools/perf/builtin-record.c +++ b/tools/perf/builtin-record.c @@ -154,6 +154,7 @@ struct record { struct perf_tool tool; struct record_opts opts; u64 bytes_written; + u64 thread_bytes_written; struct perf_data data; struct auxtrace_record *itr; struct evlist *evlist; @@ -226,14 +227,7 @@ static bool switch_output_time(struct record *rec)
static u64 record__bytes_written(struct record *rec) { - int t; - u64 bytes_written = rec->bytes_written; - struct record_thread *thread_data = rec->thread_data; - - for (t = 0; t < rec->nr_threads; t++) - bytes_written += thread_data[t].bytes_written; - - return bytes_written; + return rec->bytes_written + rec->thread_bytes_written; }
static bool record__output_max_size_exceeded(struct record *rec) @@ -255,10 +249,12 @@ static int record__write(struct record *rec, struct mmap *map __maybe_unused, return -1; }
- if (map && map->file) + if (map && map->file) { thread->bytes_written += size; - else + rec->thread_bytes_written += size; + } else { rec->bytes_written += size; + }
if (record__output_max_size_exceeded(rec) && !done) { fprintf(stderr, "[ perf record: perf size limit reached (%" PRIu64 " KB),"
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 ]
On most architectures, gcc -Wextra warns about the list of error numbers containing both EDEADLK and EDEADLOCK:
lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init] 15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err | ^~~ lib/errname.c:172:2: note: in expansion of macro 'E' 172 | E(EDEADLK), /* EDEADLOCK */ | ^
On parisc, a similar error happens with -ECANCELLED, which is an alias for ECANCELED.
Make the EDEADLK printing conditional on the number being distinct from EDEADLOCK, and remove the -ECANCELLED bit completely as it can never be hit.
To ensure these are correct, add static_assert lines that verify all the remaining aliases are in fact identical to the canonical name.
Fixes: 57f5677e535b ("printf: add support for printing symbolic error names") Cc: Petr Mladek pmladek@suse.com Suggested-by: Rasmus Villemoes linux@rasmusvillemoes.dk Acked-by: Uwe Kleine-König uwe@kleine-koenig.org Reviewed-by: Andy Shevchenko andy.shevchenko@gmail.com Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/ Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann arnd@arndb.de Reviewed-by: Sergey Senozhatsky senozhatsky@chromium.org Acked-by: Rasmus Villemoes linux@rasmusvillemoes.dk Reviewed-by: Petr Mladek pmladek@suse.com Signed-off-by: Petr Mladek pmladek@suse.com Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- lib/errname.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/lib/errname.c b/lib/errname.c index 05cbf731545f0..67739b174a8cc 100644 --- a/lib/errname.c +++ b/lib/errname.c @@ -21,6 +21,7 @@ static const char *names_0[] = { E(EADDRNOTAVAIL), E(EADV), E(EAFNOSUPPORT), + E(EAGAIN), /* EWOULDBLOCK */ E(EALREADY), E(EBADE), E(EBADF), @@ -31,15 +32,17 @@ static const char *names_0[] = { E(EBADSLT), E(EBFONT), E(EBUSY), -#ifdef ECANCELLED - E(ECANCELLED), -#endif + E(ECANCELED), /* ECANCELLED */ E(ECHILD), E(ECHRNG), E(ECOMM), E(ECONNABORTED), + E(ECONNREFUSED), /* EREFUSED */ E(ECONNRESET), + E(EDEADLK), /* EDEADLOCK */ +#if EDEADLK != EDEADLOCK /* mips, sparc, powerpc */ E(EDEADLOCK), +#endif E(EDESTADDRREQ), E(EDOM), E(EDOTDOT), @@ -166,14 +169,17 @@ static const char *names_0[] = { E(EUSERS), E(EXDEV), E(EXFULL), - - E(ECANCELED), /* ECANCELLED */ - E(EAGAIN), /* EWOULDBLOCK */ - E(ECONNREFUSED), /* EREFUSED */ - E(EDEADLK), /* EDEADLOCK */ }; #undef E
+#ifdef EREFUSED /* parisc */ +static_assert(EREFUSED == ECONNREFUSED); +#endif +#ifdef ECANCELLED /* parisc */ +static_assert(ECANCELLED == ECANCELED); +#endif +static_assert(EAGAIN == EWOULDBLOCK); /* everywhere */ + #define E(err) [err - 512 + BUILD_BUG_ON_ZERO(err < 512 || err > 550)] = "-" #err static const char *names_512[] = { E(ERESTARTSYS),
From: Kajol Jain kjain@linux.ibm.com
[ Upstream commit f9fa0778ee7349a9aa3d2ea10e9f2ab843a0b44e ]
Testcase stat_all_metrics.sh fails in powerpc:
98: perf all metrics test : FAILED!
Logs with verbose:
[command]# ./perf test 98 -vv 98: perf all metrics test : --- start --- test child forked, pid 13262 Testing BRU_STALL_CPI Testing COMPLETION_STALL_CPI ---- Testing TOTAL_LOCAL_NODE_PUMPS_P23 Metric 'TOTAL_LOCAL_NODE_PUMPS_P23' not printed in: Error: Invalid event (hv_24x7/PM_PB_LNS_PUMP23,chip=3/) in per-thread mode, enable system wide with '-a'. Testing TOTAL_LOCAL_NODE_PUMPS_RETRIES_P01 Metric 'TOTAL_LOCAL_NODE_PUMPS_RETRIES_P01' not printed in: Error: Invalid event (hv_24x7/PM_PB_RTY_LNS_PUMP01,chip=3/) in per-thread mode, enable system wide with '-a'. ----
Based on above logs, we could see some of the hv-24x7 metric events fails, and logs suggest to run the metric event with -a option. This change happened after the commit a4b8cfcabb1d90ec ("perf stat: Delay metric parsing"), which delayed the metric parsing phase and now before metric parsing phase perf tool identifies, whether target is system-wide or not. With this change, perf_event_open will fails with workload monitoring for uncore events as expected.
The perf all metric test case fails as some of the hv-24x7 metric events may need bigger workload with system wide monitoring to get the data. Fix this issue by changing current system wide check from true workload to sleep 0.01 workload.
Result with the patch changes in powerpc:
98: perf all metrics test : Ok
Fixes: a4b8cfcabb1d90ec ("perf stat: Delay metric parsing") Suggested-by: Ian Rogers irogers@google.com Reviewed-by: Athira Rajeev atrajeev@linux.vnet.ibm.com Signed-off-by: Kajol Jain kjain@linux.ibm.com Tested-by: Disha Goel disgoel@linux.ibm.com Tested-by: Ian Rogers irogers@google.com Cc: Madhavan Srinivasan maddy@linux.ibm.com Cc: Nageswara R Sastry rnsastry@linux.ibm.com Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20230215093827.124921-1-kjain@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo acme@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/perf/tests/shell/stat_all_metrics.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/tests/shell/stat_all_metrics.sh b/tools/perf/tests/shell/stat_all_metrics.sh index 6e79349e42bef..22e9cb294b40e 100755 --- a/tools/perf/tests/shell/stat_all_metrics.sh +++ b/tools/perf/tests/shell/stat_all_metrics.sh @@ -11,7 +11,7 @@ for m in $(perf list --raw-dump metrics); do continue fi # Failed so try system wide. - result=$(perf stat -M "$m" -a true 2>&1) + result=$(perf stat -M "$m" -a sleep 0.01 2>&1) if [[ "$result" =~ "${m:0:50}" ]] then continue
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit d5d469247264e56960705dc5ae7e1d014861fe40 ]
A lot of the tsan helpers are already excempt from the UACCESS warnings, but some more functions were added that need the same thing:
kernel/kcsan/core.o: warning: objtool: __tsan_volatile_read16+0x0: call to __tsan_unaligned_read16() with UACCESS enabled kernel/kcsan/core.o: warning: objtool: __tsan_volatile_write16+0x0: call to __tsan_unaligned_write16() with UACCESS enabled vmlinux.o: warning: objtool: __tsan_unaligned_volatile_read16+0x4: call to __tsan_unaligned_read16() with UACCESS enabled vmlinux.o: warning: objtool: __tsan_unaligned_volatile_write16+0x4: call to __tsan_unaligned_write16() with UACCESS enabled
As Marco points out, these functions don't even call each other explicitly but instead gcc (but not clang) notices the functions being identical and turns one symbol into a direct branch to the other.
Link: https://lkml.kernel.org/r/20230215130058.3836177-4-arnd@kernel.org Fixes: 75d75b7a4d54 ("kcsan: Support distinguishing volatile accesses") Signed-off-by: Arnd Bergmann arnd@arndb.de Acked-by: Marco Elver elver@google.com Cc: Alexander Potapenko glider@google.com Cc: Andrey Konovalov andreyknvl@gmail.com Cc: Andrey Ryabinin ryabinin.a.a@gmail.com Cc: Dmitry Vyukov dvyukov@google.com Cc: Josh Poimboeuf jpoimboe@kernel.org Cc: Kuan-Ying Lee Kuan-Ying.Lee@mediatek.com Cc: Peter Zijlstra (Intel) peterz@infradead.org Cc: Vincenzo Frascino vincenzo.frascino@arm.com Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/objtool/check.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c index 4b7c8b33069e5..b1a5f658673f0 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -1186,6 +1186,8 @@ static const char *uaccess_safe_builtin[] = { "__tsan_atomic64_compare_exchange_val", "__tsan_atomic_thread_fence", "__tsan_atomic_signal_fence", + "__tsan_unaligned_read16", + "__tsan_unaligned_write16", /* KCOV */ "write_comp_data", "check_kcov_mode",
From: Masami Hiramatsu (Google) mhiramat@kernel.org
[ Upstream commit 96cd93af794cf3ef83ae1ad7291160029d7b525e ]
Fix kprobe probepoint testcase to ignore __pfx_* prefix symbols. Those are introduced by commit b341b20d648b ("x86: Add prefix symbols for function padding") for identifying PADDING_BYTES of NOPs. Since kprobe events can not probe these prefix symbols, this testcase has to skip those symbols.
Link: https://lore.kernel.org/all/167309835609.640500.9664678940260305746.stgit@de...
Fixes: b341b20d648b ("x86: Add prefix symbols for function padding") Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Reviewed-by: Steven Rostedt (Google) rostedt@goodmis.org Acked-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc index 624269c8d5343..68425987a5dd9 100644 --- a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc +++ b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc @@ -21,7 +21,7 @@ set_offs() { # prev target next
# We have to decode symbol addresses to get correct offsets. # If the offset is not an instruction boundary, it cause -EILSEQ. -set_offs `grep -A1 -B1 ${TARGET_FUNC} /proc/kallsyms | cut -f 1 -d " " | xargs` +set_offs `grep -v __pfx_ /proc/kallsyms | grep -A1 -B1 ${TARGET_FUNC} | cut -f 1 -d " " | xargs`
UINT_TEST=no # printf "%x" -1 returns (unsigned long)-1.
From: Ondrej Mosnacek omosnace@redhat.com
[ Upstream commit f1aa2eb5ea05ccd1fd92d235346e60e90a1ed949 ]
Currently proc_dobool expects a (bool *) in table->data, but sizeof(int) in table->maxsize, because it uses do_proc_dointvec() directly.
This is unsafe for at least two reasons: 1. A sysctl table definition may use { .data = &variable, .maxsize = sizeof(variable) }, not realizing that this makes the sysctl unusable (see the Fixes: tag) and that they need to use the completely counterintuitive sizeof(int) instead. 2. proc_dobool() will currently try to parse an array of values if given .maxsize >= 2*sizeof(int), but will try to write values of type bool by offsets of sizeof(int), so it will not work correctly with neither an (int *) nor a (bool *). There is no .maxsize validation to prevent this.
Fix this by: 1. Constraining proc_dobool() to allow only one value and .maxsize == sizeof(bool). 2. Wrapping the original struct ctl_table in a temporary one with .data pointing to a local int variable and .maxsize set to sizeof(int) and passing this one to proc_dointvec(), converting the value to/from bool as needed (using proc_dou8vec_minmax() as an example). 3. Extending sysctl_check_table() to enforce proc_dobool() expectations. 4. Fixing the proc_dobool() docstring (it was just copy-pasted from proc_douintvec, apparently...). 5. Converting all existing proc_dobool() users to set .maxsize to sizeof(bool) instead of sizeof(int).
Fixes: 83efeeeb3d04 ("tty: Allow TIOCSTI to be disabled") Fixes: a2071573d634 ("sysctl: introduce new proc handler proc_dobool") Signed-off-by: Ondrej Mosnacek omosnace@redhat.com Acked-by: Kees Cook keescook@chromium.org Signed-off-by: Luis Chamberlain mcgrof@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- fs/lockd/svc.c | 2 +- fs/proc/proc_sysctl.c | 6 ++++++ kernel/sysctl.c | 43 ++++++++++++++++++++++++------------------- mm/hugetlb_vmemmap.c | 2 +- 4 files changed, 32 insertions(+), 21 deletions(-)
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c index 59ef8a1f843f3..914ea1c3537d1 100644 --- a/fs/lockd/svc.c +++ b/fs/lockd/svc.c @@ -496,7 +496,7 @@ static struct ctl_table nlm_sysctls[] = { { .procname = "nsm_use_hostnames", .data = &nsm_use_hostnames, - .maxlen = sizeof(int), + .maxlen = sizeof(bool), .mode = 0644, .proc_handler = proc_dobool, }, diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c index 48f2d60bd78a2..436025e0f77a6 100644 --- a/fs/proc/proc_sysctl.c +++ b/fs/proc/proc_sysctl.c @@ -1124,6 +1124,11 @@ static int sysctl_check_table_array(const char *path, struct ctl_table *table) err |= sysctl_err(path, table, "array not allowed"); }
+ if (table->proc_handler == proc_dobool) { + if (table->maxlen != sizeof(bool)) + err |= sysctl_err(path, table, "array not allowed"); + } + return err; }
@@ -1136,6 +1141,7 @@ static int sysctl_check_table(const char *path, struct ctl_table *table) err |= sysctl_err(path, entry, "Not a file");
if ((entry->proc_handler == proc_dostring) || + (entry->proc_handler == proc_dobool) || (entry->proc_handler == proc_dointvec) || (entry->proc_handler == proc_douintvec) || (entry->proc_handler == proc_douintvec_minmax) || diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 137d4abe3eda1..1c240d2c99bcb 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -425,21 +425,6 @@ static void proc_put_char(void **buf, size_t *size, char c) } }
-static int do_proc_dobool_conv(bool *negp, unsigned long *lvalp, - int *valp, - int write, void *data) -{ - if (write) { - *(bool *)valp = *lvalp; - } else { - int val = *(bool *)valp; - - *lvalp = (unsigned long)val; - *negp = false; - } - return 0; -} - static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp, int *valp, int write, void *data) @@ -710,16 +695,36 @@ int do_proc_douintvec(struct ctl_table *table, int write, * @lenp: the size of the user buffer * @ppos: file position * - * Reads/writes up to table->maxlen/sizeof(unsigned int) integer - * values from/to the user buffer, treated as an ASCII string. + * Reads/writes one integer value from/to the user buffer, + * treated as an ASCII string. + * + * table->data must point to a bool variable and table->maxlen must + * be sizeof(bool). * * Returns 0 on success. */ int proc_dobool(struct ctl_table *table, int write, void *buffer, size_t *lenp, loff_t *ppos) { - return do_proc_dointvec(table, write, buffer, lenp, ppos, - do_proc_dobool_conv, NULL); + struct ctl_table tmp; + bool *data = table->data; + int res, val; + + /* Do not support arrays yet. */ + if (table->maxlen != sizeof(bool)) + return -EINVAL; + + tmp = *table; + tmp.maxlen = sizeof(val); + tmp.data = &val; + + val = READ_ONCE(*data); + res = proc_dointvec(&tmp, write, buffer, lenp, ppos); + if (res) + return res; + if (write) + WRITE_ONCE(*data, val); + return 0; }
/** diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c index 45e93a545dd7e..a559037cce00c 100644 --- a/mm/hugetlb_vmemmap.c +++ b/mm/hugetlb_vmemmap.c @@ -581,7 +581,7 @@ static struct ctl_table hugetlb_vmemmap_sysctls[] = { { .procname = "hugetlb_optimize_vmemmap", .data = &vmemmap_optimize_enabled, - .maxlen = sizeof(int), + .maxlen = sizeof(vmemmap_optimize_enabled), .mode = 0644, .proc_handler = proc_dobool, },
From: Tom Fitzhenry tom@tom-fitzhenry.me.uk
[ Upstream commit 5d69b181cd0db10dc8327d28ce837b3623cd531a ]
Fixes RK818 (e.g. on Pinephone Pro) to register its clock, without which dependent devices (e.g. wifi/BT, via sdio-wifi-pwrseq) fail to probe.
This line was removed in commit 3633daacea2e ("mfd: rk808: Permit having multiple PMIC instances"), but only from RK818.
Fixes: 3633daacea2e ("mfd: rk808: Permit having multiple PMIC instances") Signed-off-by: Tom Fitzhenry tom@tom-fitzhenry.me.uk Reviewed-by: Javier Martinez Canillas javierm@redhat.com Acked-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Lee Jones lee@kernel.org Link: https://lore.kernel.org/r/20230102111147.2580861-1-tom@tom-fitzhenry.me.uk Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/mfd/rk808.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/rk808.c b/drivers/mfd/rk808.c index f44fc3f080a8e..0f22ef61e8170 100644 --- a/drivers/mfd/rk808.c +++ b/drivers/mfd/rk808.c @@ -189,6 +189,7 @@ static const struct mfd_cell rk817s[] = { };
static const struct mfd_cell rk818s[] = { + { .name = "rk808-clkout", .id = PLATFORM_DEVID_NONE, }, { .name = "rk808-regulator", .id = PLATFORM_DEVID_NONE, }, { .name = "rk808-rtc",
From: Randy Dunlap rdunlap@infradead.org
[ Upstream commit 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 ]
The cs5535-mfd driver uses CPU-specific data that is not available for ARCH=um builds, so don't allow it to be built for UML.
Prevents these build errors:
In file included from ../arch/x86/include/asm/olpc.h:7, from ../drivers/mfd/cs5535-mfd.c:17: ../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’: ../arch/x86/include/asm/geode.h:16:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && ../arch/x86/include/asm/geode.h:16:46: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && ../arch/x86/include/asm/geode.h:17:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ 17 | (boot_cpu_data.x86 == 5) && ../arch/x86/include/asm/geode.h:18:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ 18 | (boot_cpu_data.x86_model == 5)); ../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’: ../arch/x86/include/asm/geode.h:23:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && ../arch/x86/include/asm/geode.h:23:46: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && ../arch/x86/include/asm/geode.h:24:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ 24 | (boot_cpu_data.x86 == 5) && ../arch/x86/include/asm/geode.h:25:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ 25 | (boot_cpu_data.x86_model == 10));
Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Randy Dunlap rdunlap@infradead.org Signed-off-by: Lee Jones lee@kernel.org Link: https://lore.kernel.org/r/20221201012541.11809-1-rdunlap@infradead.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/mfd/Kconfig | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig index 30db49f318668..7ed31fbd8c7fa 100644 --- a/drivers/mfd/Kconfig +++ b/drivers/mfd/Kconfig @@ -15,6 +15,7 @@ config MFD_CS5535 tristate "AMD CS5535 and CS5536 southbridge core functions" select MFD_CORE depends on PCI && (X86_32 || (X86 && COMPILE_TEST)) + depends on !UML help This is the core driver for CS5535/CS5536 MFD functions. This is necessary for using the board's GPIO and MFGPT functionality.
From: Qiheng Lin linqiheng@huawei.com
[ Upstream commit 8b450dcff23aa254844492831a8e2b508a9d522d ]
`req` is allocated in pcf50633_adc_async_read(), but adc_enqueue_request() could fail to insert the `req` into queue. We need to check the return value and free it in the case of failure.
Fixes: 08c3e06a5eb2 ("mfd: PCF50633 adc driver") Signed-off-by: Qiheng Lin linqiheng@huawei.com Signed-off-by: Lee Jones lee@kernel.org Link: https://lore.kernel.org/r/20221208061555.8776-1-linqiheng@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/mfd/pcf50633-adc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c index 5cd653e615125..191b1bc6141c2 100644 --- a/drivers/mfd/pcf50633-adc.c +++ b/drivers/mfd/pcf50633-adc.c @@ -136,6 +136,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, void *callback_param) { struct pcf50633_adc_request *req; + int ret;
/* req is freed when the result is ready, in interrupt handler */ req = kmalloc(sizeof(*req), GFP_KERNEL); @@ -147,7 +148,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, req->callback = callback; req->callback_param = callback_param;
- return adc_enqueue_request(pcf, req); + ret = adc_enqueue_request(pcf, req); + if (ret) + kfree(req); + + return ret; } EXPORT_SYMBOL_GPL(pcf50633_adc_async_read);
From: Fenghua Yu fenghua.yu@intel.com
[ Upstream commit 9735bde36487da43d3c3fc910df49639f72decbf ]
On DSA/IAX 1.0, TC-A and TC-B in GRPCFG are set as 1 to have best performance and cannot be changed through sysfs knobs unless override option is given.
The same values should be set on DSA 2.0 as well.
Fixes: ea7c8f598c32 ("dmaengine: idxd: restore traffic class defaults after wq reset") Fixes: ade8a86b512c ("dmaengine: idxd: Set defaults for GRPCFG traffic class") Signed-off-by: Fenghua Yu fenghua.yu@intel.com Reviewed-by: Dave Jiang dave.jiang@intel.com Link: https://lore.kernel.org/r/20221209172141.562648-1-fenghua.yu@intel.com Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/dma/idxd/device.c | 2 +- drivers/dma/idxd/init.c | 2 +- drivers/dma/idxd/sysfs.c | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c index 29dbb0f52e186..8b4573dc7ecc5 100644 --- a/drivers/dma/idxd/device.c +++ b/drivers/dma/idxd/device.c @@ -701,7 +701,7 @@ static void idxd_groups_clear_state(struct idxd_device *idxd) group->use_rdbuf_limit = false; group->rdbufs_allowed = 0; group->rdbufs_reserved = 0; - if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) { + if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) { group->tc_a = 1; group->tc_b = 1; } else { diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c index 529ea09c90940..e63b0c674d883 100644 --- a/drivers/dma/idxd/init.c +++ b/drivers/dma/idxd/init.c @@ -295,7 +295,7 @@ static int idxd_setup_groups(struct idxd_device *idxd) }
idxd->groups[i] = group; - if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) { + if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) { group->tc_a = 1; group->tc_b = 1; } else { diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c index 3229dfc786507..18cd8151dee02 100644 --- a/drivers/dma/idxd/sysfs.c +++ b/drivers/dma/idxd/sysfs.c @@ -387,7 +387,7 @@ static ssize_t group_traffic_class_a_store(struct device *dev, if (idxd->state == IDXD_DEV_ENABLED) return -EPERM;
- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) + if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) return -EPERM;
if (val < 0 || val > 7) @@ -429,7 +429,7 @@ static ssize_t group_traffic_class_b_store(struct device *dev, if (idxd->state == IDXD_DEV_ENABLED) return -EPERM;
- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) + if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) return -EPERM;
if (val < 0 || val > 7)
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit ee84146c05ad2316b9a7222d0ec4413e0bf30eeb ]
rdma_user_mmap_entry_get() take reference, we should release it when not need anymore, add the missing rdma_user_mmap_entry_put() in the error path to fix it.
Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") Signed-off-by: Miaoqian Lin linmq006@gmail.com Link: https://lore.kernel.org/r/20221220121139.1540564-1-linmq006@gmail.com Acked-by: Cheng Xu chengyou@linux.alibaba.com Signed-off-by: Leon Romanovsky leon@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/erdma/erdma_verbs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c index 5dab1e87975ba..9c30d78730aa1 100644 --- a/drivers/infiniband/hw/erdma/erdma_verbs.c +++ b/drivers/infiniband/hw/erdma/erdma_verbs.c @@ -1110,12 +1110,14 @@ int erdma_mmap(struct ib_ucontext *ctx, struct vm_area_struct *vma) prot = pgprot_device(vma->vm_page_prot); break; default: - return -EINVAL; + err = -EINVAL; + goto put_entry; }
err = rdma_user_mmap_io(ctx, vma, PFN_DOWN(entry->address), PAGE_SIZE, prot, rdma_entry);
+put_entry: rdma_user_mmap_entry_put(rdma_entry); return err; }
From: Geert Uytterhoeven geert+renesas@glider.be
[ Upstream commit dcca9d045c0852584ad092123c7f6e6526a633b1 ]
The HiSilicon DMA Engine is only present on HiSilicon SoCs. Hence add a dependency on ARCH_HISI, to prevent asking the user about this driver when configuring a kernel without HiSilicon SoC support.
Fixes: e9f08b65250d73ab ("dmaengine: hisilicon: Add Kunpeng DMA engine support") Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Link: https://lore.kernel.org/r/363a1816d36cd3cf604d88ec90f97c75f604de64.166904419... Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/dma/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig index b6d48d54f42fc..7b95f07c6f1af 100644 --- a/drivers/dma/Kconfig +++ b/drivers/dma/Kconfig @@ -245,7 +245,7 @@ config FSL_RAID
config HISI_DMA tristate "HiSilicon DMA Engine support" - depends on ARM64 || COMPILE_TEST + depends on ARCH_HISI || COMPILE_TEST depends on PCI_MSI select DMA_ENGINE select DMA_VIRTUAL_CHANNELS
From: Miaoqian Lin linmq006@gmail.com
[ Upstream commit cf6a05c8494a8ae7fec8e5f1229b45ca5b4bcd30 ]
rdma_user_mmap_entry_get_pgoff() takes the reference. Add missing rdma_user_mmap_entry_put() to release the reference.
Fixes: 0045e0d3f42e ("RDMA/hns: Support direct wqe of userspace") Signed-off-by: Miaoqian Lin linmq006@gmail.com Acked-by Haoyue Xu xuhaoyue1@hisilicon.com Link: https://lore.kernel.org/r/20221223072900.802728-1-linmq006@gmail.com Signed-off-by: Leon Romanovsky leon@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/hns/hns_roce_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 8ba68ac12388d..946ba1109e878 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -443,14 +443,15 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) prot = pgprot_device(vma->vm_page_prot); break; default: - return -EINVAL; + ret = -EINVAL; + goto out; }
ret = rdma_user_mmap_io(uctx, vma, pfn, rdma_entry->npages * PAGE_SIZE, prot, rdma_entry);
+out: rdma_user_mmap_entry_put(rdma_entry); - return ret; }
From: Ferry Toth ftoth@exalondelft.nl
[ Upstream commit 027641b52fe37b64af61025298ce160c8b9b7a73 ]
Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_RAISING, let's respect the settings specified in the firmware description. To be compatible with the older firmware descriptions, if trigger type is not set up there, we'll set it to default (raising edge).
Fixes: 388be4883952 ("staging:iio: tsl2563 abi fixes and interrupt handling") Fixes: bdab1001738f ("staging:iio:light:tsl2563 remove old style event registration.") Signed-off-by: Ferry Toth ftoth@exalondelft.nl Signed-off-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Link: https://lore.kernel.org/r/20221207190348.9347-1-andriy.shevchenko@linux.inte... Signed-off-by: Jonathan Cameron Jonathan.Cameron@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iio/light/tsl2563.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c index d0e42b73203a6..71302ae864d99 100644 --- a/drivers/iio/light/tsl2563.c +++ b/drivers/iio/light/tsl2563.c @@ -704,6 +704,7 @@ static int tsl2563_probe(struct i2c_client *client) struct iio_dev *indio_dev; struct tsl2563_chip *chip; struct tsl2563_platform_data *pdata = client->dev.platform_data; + unsigned long irq_flags; int err = 0; u8 id = 0;
@@ -759,10 +760,15 @@ static int tsl2563_probe(struct i2c_client *client) indio_dev->info = &tsl2563_info_no_irq;
if (client->irq) { + irq_flags = irq_get_trigger_type(client->irq); + if (irq_flags == IRQF_TRIGGER_NONE) + irq_flags = IRQF_TRIGGER_RISING; + irq_flags |= IRQF_ONESHOT; + err = devm_request_threaded_irq(&client->dev, client->irq, NULL, &tsl2563_event_handler, - IRQF_TRIGGER_RISING | IRQF_ONESHOT, + irq_flags, "tsl2563_event", indio_dev); if (err) {
From: Gaosheng Cui cuigaosheng1@huawei.com
[ Upstream commit a8d3392e0e5cfeb03f0cea1f2bc3f5f183c1deb4 ]
When request_irq(ires1->start) failed in w5300_hw_probe(), irq ires->start has not been freed, and on the clean_up3 error path, we also need to free ires1->start irq, fix it.
In addition, We should add free_irq in fusb300_remove(), and give the lables a proper name so that they can be understood easily, so add free_irq in fusb300_remove(), and update clean_up3 to err_alloc_request.
Fixes: 0fe6f1d1f612 ("usb: udc: add Faraday fusb300 driver") Signed-off-by: Gaosheng Cui cuigaosheng1@huawei.com Link: https://lore.kernel.org/r/20221123014121.1989721-1-cuigaosheng1@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/usb/gadget/udc/fusb300_udc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c index 5954800d652ca..08ba9c8c1e677 100644 --- a/drivers/usb/gadget/udc/fusb300_udc.c +++ b/drivers/usb/gadget/udc/fusb300_udc.c @@ -1346,6 +1346,7 @@ static int fusb300_remove(struct platform_device *pdev) usb_del_gadget_udc(&fusb300->gadget); iounmap(fusb300->reg); free_irq(platform_get_irq(pdev, 0), fusb300); + free_irq(platform_get_irq(pdev, 1), fusb300);
fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); for (i = 0; i < FUSB300_MAX_NUM_EP; i++) @@ -1431,7 +1432,7 @@ static int fusb300_probe(struct platform_device *pdev) IRQF_SHARED, udc_name, fusb300); if (ret < 0) { pr_err("request_irq1 error (%d)\n", ret); - goto clean_up; + goto err_request_irq1; }
INIT_LIST_HEAD(&fusb300->gadget.ep_list); @@ -1470,7 +1471,7 @@ static int fusb300_probe(struct platform_device *pdev) GFP_KERNEL); if (fusb300->ep0_req == NULL) { ret = -ENOMEM; - goto clean_up3; + goto err_alloc_request; }
init_controller(fusb300); @@ -1485,7 +1486,10 @@ static int fusb300_probe(struct platform_device *pdev) err_add_udc: fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
-clean_up3: +err_alloc_request: + free_irq(ires1->start, fusb300); + +err_request_irq1: free_irq(ires->start, fusb300);
clean_up:
From: Hanna Hawa hhhawa@amazon.com
[ Upstream commit f2e1fa99550dd7a882229e2c2cd9ecab4ce773d0 ]
Make i2c_dw_clk_rate() to return u32 instead of unsigned long, as the function return the value of get_clk_rate_khz() which returns u32.
Fixes: b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided") Signed-off-by: Hanna Hawa hhhawa@amazon.com Reviewed-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Acked-by: Jarkko Nikula jarkko.nikula@linux.intel.com Signed-off-by: Wolfram Sang wsa@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/i2c/busses/i2c-designware-common.c | 2 +- drivers/i2c/busses/i2c-designware-core.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c index 581e02cc979a0..2f2e99882b011 100644 --- a/drivers/i2c/busses/i2c-designware-common.c +++ b/drivers/i2c/busses/i2c-designware-common.c @@ -465,7 +465,7 @@ void __i2c_dw_disable(struct dw_i2c_dev *dev) dev_warn(dev->dev, "timeout in disabling adapter\n"); }
-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev) +u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev) { /* * Clock is not necessary if we got LCNT/HCNT values directly from diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h index 95ebc5eaa5d12..6bc2edec14f2f 100644 --- a/drivers/i2c/busses/i2c-designware-core.h +++ b/drivers/i2c/busses/i2c-designware-core.h @@ -320,7 +320,7 @@ int i2c_dw_init_regmap(struct dw_i2c_dev *dev); u32 i2c_dw_scl_hcnt(u32 ic_clk, u32 tSYMBOL, u32 tf, int cond, int offset); u32 i2c_dw_scl_lcnt(u32 ic_clk, u32 tLOW, u32 tf, int offset); int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev); -unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev); +u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev); int i2c_dw_prepare_clk(struct dw_i2c_dev *dev, bool prepare); int i2c_dw_acquire_lock(struct dw_i2c_dev *dev); void i2c_dw_release_lock(struct dw_i2c_dev *dev);
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 597688792c4d9939e1900f5840ca18804e9d4290 ]
i2c_master_hub is only used in i2c-qcom-geni.c now, change it to static.
Fixes: cacd9643eca7 ("i2c: qcom-geni: add support for I2C Master Hub variant") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Reviewed-by: Bjorn Andersson andersson@kernel.org Signed-off-by: Wolfram Sang wsa@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/i2c/busses/i2c-qcom-geni.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c index fd70794bfceec..a378f679b499d 100644 --- a/drivers/i2c/busses/i2c-qcom-geni.c +++ b/drivers/i2c/busses/i2c-qcom-geni.c @@ -1025,7 +1025,7 @@ static const struct dev_pm_ops geni_i2c_pm_ops = { NULL) };
-const struct geni_i2c_desc i2c_master_hub = { +static const struct geni_i2c_desc i2c_master_hub = { .has_core_clk = true, .icc_ddr = NULL, .no_dma_support = true,
From: Richard Fitzgerald rf@opensource.cirrus.com
[ Upstream commit 7cbfee2e2e40d2be54196362a845a3ea0a3f877d ]
The command FIFOs in the Cadence IP can be configured during design up to 32 entries, and the code in cadence_master.c was assuming the full 32-entry FIFO. But all current Intel implementations use an 8-entry FIFO.
Up to now the longest message used was 6 entries so this wasn't causing any problem. But future Cirrus Logic codecs have downloadable firmware or tuning blobs. It is more efficient for the codec driver to issue long transfers that can take advantage of any queuing in the Soundwire controller and avoid the overhead of repeatedly writing the page registers.
Signed-off-by: Richard Fitzgerald rf@opensource.cirrus.com Reviewed-by: Pierre-Louis Bossart pierre-louis.bossart@linux.intel.com Fixes: 2f52a5177caa ("soundwire: cdns: Add cadence library") Link: https://lore.kernel.org/r/20221202161812.4186897-2-rf@opensource.cirrus.com Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/soundwire/cadence_master.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c index a1de363eba3ff..27699f341f2c5 100644 --- a/drivers/soundwire/cadence_master.c +++ b/drivers/soundwire/cadence_master.c @@ -127,7 +127,8 @@ MODULE_PARM_DESC(cdns_mcp_int_mask, "Cadence MCP IntMask");
#define CDNS_MCP_CMD_BASE 0x80 #define CDNS_MCP_RESP_BASE 0x80 -#define CDNS_MCP_CMD_LEN 0x20 +/* FIFO can hold 8 commands */ +#define CDNS_MCP_CMD_LEN 8 #define CDNS_MCP_CMD_WORD_LEN 0x4
#define CDNS_MCP_CMD_SSP_TAG BIT(31)
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit f6837f34a34973ef6600c08195ed300e24e97317 ]
I got the following null-ptr-deref report while doing fault injection test:
BUG: kernel NULL pointer dereference, address: 0000000000000058 CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+ RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK> klist_remove+0xf1/0x1c0 device_release_driver_internal+0x196/0x210 bus_remove_device+0x1bd/0x240 device_add+0xd3d/0x1100 w1_add_master_device+0x476/0x490 [wire] ds2482_probe+0x303/0x3e0 [ds2482]
This is how it happened:
w1_alloc_dev() // The dev->driver is set to w1_master_driver. memcpy(&dev->dev, device, sizeof(struct device)); device_add() bus_add_device() dpm_sysfs_add() // It fails, calls bus_remove_device.
// error path bus_remove_device() // The dev->driver is not null, but driver is not bound. __device_release_driver() klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref.
// normal path bus_probe_device() // It's not called yet. device_bind_driver()
If dev->driver is set, in the error path after calling bus_add_device() in device_add(), bus_remove_device() is called, then the device will be detached from driver. But device_bind_driver() is not called yet, so it causes null-ptr-deref while access the 'knode_driver'. To fix this, set dev->driver to null in the error path before calling bus_remove_device().
Fixes: 57eee3d23e88 ("Driver core: Call device_pm_add() after bus_add_device() in device_add()") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Link: https://lore.kernel.org/r/20221205034904.2077765-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/base/core.c b/drivers/base/core.c index a3e14143ec0cf..506289e6b04dd 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -3513,6 +3513,7 @@ int device_add(struct device *dev) device_pm_remove(dev); dpm_sysfs_remove(dev); DPMError: + dev->driver = NULL; bus_remove_device(dev); BusError: device_remove_attrs(dev);
From: Wang Hai wanghai38@huawei.com
[ Upstream commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 ]
In kobject_get_path(), if kobj->name is changed between calls get_kobj_path_length() and fill_kobj_path() and the length becomes longer, then fill_kobj_path() will have an out-of-bounds bug.
The actual current problem occurs when the ixgbe probe.
In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name length becomes longer, out-of-bounds will occur.
cpu0 cpu1 ixgbe_probe register_netdev(netdev) netdev_register_kobject device_add kobject_uevent // Sending ADD events systemd-udevd // rename netdev dev_change_name device_rename kobject_rename ixgbe_mii_bus_init | mdiobus_register | __mdiobus_register | device_register | device_add | kobject_uevent | kobject_get_path | len = get_kobj_path_length // old name | path = kzalloc(len, gfp_mask); | kobj->name = name; /* name length becomes * longer */ fill_kobj_path /* kobj path length is * longer than path, * resulting in out of * bounds when filling path */
This is the kasan report:
================================================================== BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673
Workqueue: events work_for_cpu_fn Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_address_description.constprop.0+0x86/0x1e7 print_report+0x36/0x4f kasan_report+0xad/0x130 kasan_check_range+0x35/0x1c0 memcpy+0x39/0x60 fill_kobj_path+0x50/0xc0 kobject_get_path+0x5a/0xc0 kobject_uevent_env+0x140/0x460 device_add+0x5c7/0x910 __mdiobus_register+0x14e/0x490 ixgbe_probe.cold+0x441/0x574 [ixgbe] local_pci_probe+0x78/0xc0 work_for_cpu_fn+0x26/0x40 process_one_work+0x3b6/0x6a0 worker_thread+0x368/0x520 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30
This reproducer triggers that bug:
while: do rmmod ixgbe sleep 0.5 modprobe ixgbe sleep 0.5
When calling fill_kobj_path() to fill path, if the name length of kobj becomes longer, return failure and retry. This fixes the problem.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai wanghai38@huawei.com Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- lib/kobject.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/lib/kobject.c b/lib/kobject.c index 985ee1c4f2c60..d20ce15eec2d0 100644 --- a/lib/kobject.c +++ b/lib/kobject.c @@ -112,7 +112,7 @@ static int get_kobj_path_length(const struct kobject *kobj) return length; }
-static void fill_kobj_path(const struct kobject *kobj, char *path, int length) +static int fill_kobj_path(const struct kobject *kobj, char *path, int length) { const struct kobject *parent;
@@ -121,12 +121,16 @@ static void fill_kobj_path(const struct kobject *kobj, char *path, int length) int cur = strlen(kobject_name(parent)); /* back up enough to print this name with '/' */ length -= cur; + if (length <= 0) + return -EINVAL; memcpy(path + length, kobject_name(parent), cur); *(path + --length) = '/'; }
pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj), kobj, __func__, path); + + return 0; }
/** @@ -141,13 +145,17 @@ char *kobject_get_path(const struct kobject *kobj, gfp_t gfp_mask) char *path; int len;
+retry: len = get_kobj_path_length(kobj); if (len == 0) return NULL; path = kzalloc(len, gfp_mask); if (!path) return NULL; - fill_kobj_path(kobj, path, len); + if (fill_kobj_path(kobj, path, len)) { + kfree(path); + goto retry; + }
return path; }
From: Al Viro viro@zeniv.linux.org.uk
[ Upstream commit 1878787797cbb019eeefe6f905514dcd557302b6 ]
Just memcmp() with ELFMAG - that's the normal way to do it in userland code, which that thing is. Besides, that has the benefit of actually building - str_has_prefix() is *NOT* present in <string.h>.
Fixes: 5f14596e55de "alpha: Replace strncmp with str_has_prefix" Signed-off-by: Al Viro viro@zeniv.linux.org.uk Signed-off-by: Sasha Levin sashal@kernel.org --- arch/alpha/boot/tools/objstrip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/alpha/boot/tools/objstrip.c b/arch/alpha/boot/tools/objstrip.c index 08b430d25a315..7cf92d172dce9 100644 --- a/arch/alpha/boot/tools/objstrip.c +++ b/arch/alpha/boot/tools/objstrip.c @@ -148,7 +148,7 @@ main (int argc, char *argv[]) #ifdef __ELF__ elf = (struct elfhdr *) buf;
- if (elf->e_ident[0] == 0x7f && str_has_prefix((char *)elf->e_ident + 1, "ELF")) { + if (memcmp(&elf->e_ident[EI_MAG0], ELFMAG, SELFMAG) == 0) { if (elf->e_type != ET_EXEC) { fprintf(stderr, "%s: %s is not an ELF executable\n", prog_name, inname);
From: Hans Verkuil hverkuil-cisco@xs4all.nl
[ Upstream commit 9f582f0418ed1c18f92c9e4628075d6ec9a7d9fb ]
Check for inactive controls in uvc_ctrl_is_accessible().
Use the new value for the master_id controls if present, otherwise use the existing value to determine if it is OK to set the control. Doing this here avoids attempting to set an inactive control, which will return an error from the USB device, which returns an invalid errorcode.
This fixes: warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO test VIDIOC_G/S_CTRL: OK warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO warn: v4l2-test-controls.cpp(816): s_ext_ctrls returned EIO test VIDIOC_G/S/TRY_EXT_CTRLS: OK
Tested with: v4l2-ctl -c auto_exposure=1 OK v4l2-ctl -c exposure_time_absolute=251 OK v4l2-ctl -c auto_exposure=3 OK v4l2-ctl -c exposure_time_absolute=251 VIDIOC_S_EXT_CTRLS: failed: Input/output error exposure_time_absolute: Input/output error ERROR v4l2-ctl -c auto_exposure=3,exposure_time_absolute=251,auto_exposure=1 v4l2-ctl -C auto_exposure,exposure_time_absolute auto_exposure: 1 exposure_time_absolute: 251
Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Reviewed-by: Ricardo Ribalda ribalda@chromium.org Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/usb/uvc/uvc_ctrl.c | 42 +++++++++++++++++++++++++++++++- drivers/media/usb/uvc/uvc_v4l2.c | 3 +-- drivers/media/usb/uvc/uvcvideo.h | 3 ++- 3 files changed, 44 insertions(+), 4 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index c95a2229f4fa9..6f5aaaf09ee01 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1085,11 +1085,28 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id, return 0; }
+/* + * Check if control @v4l2_id can be accessed by the given control @ioctl + * (VIDIOC_G_EXT_CTRLS, VIDIOC_TRY_EXT_CTRLS or VIDIOC_S_EXT_CTRLS). + * + * For set operations on slave controls, check if the master's value is set to + * manual, either in the others controls set in the same ioctl call, or from + * the master's current value. This catches VIDIOC_S_EXT_CTRLS calls that set + * both the master and slave control, such as for instance setting + * auto_exposure=1, exposure_time_absolute=251. + */ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, - bool read) + const struct v4l2_ext_controls *ctrls, + unsigned long ioctl) { + struct uvc_control_mapping *master_map = NULL; + struct uvc_control *master_ctrl = NULL; struct uvc_control_mapping *mapping; struct uvc_control *ctrl; + bool read = ioctl == VIDIOC_G_EXT_CTRLS; + s32 val; + int ret; + int i;
if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0) return -EACCES; @@ -1104,6 +1121,29 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) && !read) return -EACCES;
+ if (ioctl != VIDIOC_S_EXT_CTRLS || !mapping->master_id) + return 0; + + /* + * Iterate backwards in cases where the master control is accessed + * multiple times in the same ioctl. We want the last value. + */ + for (i = ctrls->count - 1; i >= 0; i--) { + if (ctrls->controls[i].id == mapping->master_id) + return ctrls->controls[i].value == + mapping->master_manual ? 0 : -EACCES; + } + + __uvc_find_control(ctrl->entity, mapping->master_id, &master_map, + &master_ctrl, 0); + + if (!master_ctrl || !(master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR)) + return 0; + + ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val); + if (ret >= 0 && val != mapping->master_manual) + return -EACCES; + return 0; }
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index f4d4c33b6dfbd..3edb54c086b24 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -1020,8 +1020,7 @@ static int uvc_ctrl_check_access(struct uvc_video_chain *chain, int ret = 0;
for (i = 0; i < ctrls->count; ++ctrl, ++i) { - ret = uvc_ctrl_is_accessible(chain, ctrl->id, - ioctl == VIDIOC_G_EXT_CTRLS); + ret = uvc_ctrl_is_accessible(chain, ctrl->id, ctrls, ioctl); if (ret) break; } diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index df93db259312e..a151f583cd156 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -761,7 +761,8 @@ static inline int uvc_ctrl_rollback(struct uvc_fh *handle) int uvc_ctrl_get(struct uvc_video_chain *chain, struct v4l2_ext_control *xctrl); int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl); int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, - bool read); + const struct v4l2_ext_controls *ctrls, + unsigned long ioctl);
int uvc_xu_ctrl_query(struct uvc_video_chain *chain, struct uvc_xu_control_query *xqry);
From: Ricardo Ribalda ribalda@chromium.org
[ Upstream commit 40140eda661ea4be219ef194a4f43b7b5e3bbd27 ]
Replace the count with a mask field that lets us choose not only the max value, but also the minimum value and what values are valid in between.
Suggested-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Ricardo Ribalda ribalda@chromium.org Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Stable-dep-of: 3aa8628eb78a ("media: uvcvideo: Refactor power_line_frequency_controls_limited") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/usb/uvc/uvc_ctrl.c | 33 +++++++++++++++++++++--------- drivers/media/usb/uvc/uvc_driver.c | 4 +++- drivers/media/usb/uvc/uvc_v4l2.c | 3 ++- drivers/media/usb/uvc/uvcvideo.h | 2 +- 4 files changed, 29 insertions(+), 13 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 6f5aaaf09ee01..32c182987d52c 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -6,6 +6,7 @@ * Laurent Pinchart (laurent.pinchart@ideasonboard.com) */
+#include <linux/bitops.h> #include <linux/kernel.h> #include <linux/list.h> #include <linux/module.h> @@ -525,7 +526,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { .v4l2_type = V4L2_CTRL_TYPE_MENU, .data_type = UVC_CTRL_DATA_TYPE_BITMASK, .menu_info = exposure_auto_controls, - .menu_count = ARRAY_SIZE(exposure_auto_controls), + .menu_mask = GENMASK(V4L2_EXPOSURE_APERTURE_PRIORITY, + V4L2_EXPOSURE_AUTO), .slave_ids = { V4L2_CID_EXPOSURE_ABSOLUTE, }, }, { @@ -731,7 +733,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings_uvc11[] = { .v4l2_type = V4L2_CTRL_TYPE_MENU, .data_type = UVC_CTRL_DATA_TYPE_ENUM, .menu_info = power_line_frequency_controls, - .menu_count = ARRAY_SIZE(power_line_frequency_controls) - 1, + .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ, + V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), }, };
@@ -745,7 +748,8 @@ static const struct uvc_control_mapping uvc_ctrl_mappings_uvc15[] = { .v4l2_type = V4L2_CTRL_TYPE_MENU, .data_type = UVC_CTRL_DATA_TYPE_ENUM, .menu_info = power_line_frequency_controls, - .menu_count = ARRAY_SIZE(power_line_frequency_controls), + .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO, + V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), }, };
@@ -975,7 +979,9 @@ static s32 __uvc_ctrl_get_value(struct uvc_control_mapping *mapping, const struct uvc_menu_info *menu = mapping->menu_info; unsigned int i;
- for (i = 0; i < mapping->menu_count; ++i, ++menu) { + for (i = 0; BIT(i) <= mapping->menu_mask; ++i, ++menu) { + if (!test_bit(i, &mapping->menu_mask)) + continue; if (menu->value == value) { value = i; break; @@ -1209,12 +1215,14 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
switch (mapping->v4l2_type) { case V4L2_CTRL_TYPE_MENU: - v4l2_ctrl->minimum = 0; - v4l2_ctrl->maximum = mapping->menu_count - 1; + v4l2_ctrl->minimum = ffs(mapping->menu_mask) - 1; + v4l2_ctrl->maximum = fls(mapping->menu_mask) - 1; v4l2_ctrl->step = 1;
menu = mapping->menu_info; - for (i = 0; i < mapping->menu_count; ++i, ++menu) { + for (i = 0; BIT(i) <= mapping->menu_mask; ++i, ++menu) { + if (!test_bit(i, &mapping->menu_mask)) + continue; if (menu->value == v4l2_ctrl->default_value) { v4l2_ctrl->default_value = i; break; @@ -1329,7 +1337,7 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, goto done; }
- if (query_menu->index >= mapping->menu_count) { + if (!test_bit(query_menu->index, &mapping->menu_mask)) { ret = -EINVAL; goto done; } @@ -1837,8 +1845,13 @@ int uvc_ctrl_set(struct uvc_fh *handle, break;
case V4L2_CTRL_TYPE_MENU: - if (xctrl->value < 0 || xctrl->value >= mapping->menu_count) + if (xctrl->value < (ffs(mapping->menu_mask) - 1) || + xctrl->value > (fls(mapping->menu_mask) - 1)) return -ERANGE; + + if (!test_bit(xctrl->value, &mapping->menu_mask)) + return -EINVAL; + value = mapping->menu_info[xctrl->value].value;
/* @@ -2277,7 +2290,7 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
INIT_LIST_HEAD(&map->ev_subs);
- size = sizeof(*mapping->menu_info) * mapping->menu_count; + size = sizeof(*mapping->menu_info) * fls(mapping->menu_mask); map->menu_info = kmemdup(mapping->menu_info, size, GFP_KERNEL); if (map->menu_info == NULL) { kfree(map->name); diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index e4bcb50113607..1c8d936ef4799 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -7,6 +7,7 @@ */
#include <linux/atomic.h> +#include <linux/bits.h> #include <linux/gpio/consumer.h> #include <linux/kernel.h> #include <linux/list.h> @@ -2384,7 +2385,8 @@ static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = { .v4l2_type = V4L2_CTRL_TYPE_MENU, .data_type = UVC_CTRL_DATA_TYPE_ENUM, .menu_info = power_line_frequency_controls_limited, - .menu_count = ARRAY_SIZE(power_line_frequency_controls_limited), + .menu_mask = + GENMASK(ARRAY_SIZE(power_line_frequency_controls_limited) - 1, 0), };
static const struct uvc_device_info uvc_ctrl_power_line_limited = { diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 3edb54c086b24..0774a11360c03 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -6,6 +6,7 @@ * Laurent Pinchart (laurent.pinchart@ideasonboard.com) */
+#include <linux/bits.h> #include <linux/compat.h> #include <linux/kernel.h> #include <linux/list.h> @@ -80,7 +81,7 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, goto free_map; }
- map->menu_count = xmap->menu_count; + map->menu_mask = GENMASK(xmap->menu_count - 1, 0); break;
default: diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index a151f583cd156..f75e5864bbf72 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -117,7 +117,7 @@ struct uvc_control_mapping { u32 data_type;
const struct uvc_menu_info *menu_info; - u32 menu_count; + unsigned long menu_mask;
u32 master_id; s32 master_manual;
From: Ricardo Ribalda ribalda@chromium.org
[ Upstream commit 96a160b068e09b4ed5a32e2179e5219fc3545eca ]
Convert the array of structs into an array of pointers, that way the mappings can be reused.
Signed-off-by: Ricardo Ribalda ribalda@chromium.org Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Stable-dep-of: 3aa8628eb78a ("media: uvcvideo: Refactor power_line_frequency_controls_limited") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/usb/uvc/uvc_ctrl.c | 74 ++++++++++++++++---------------- 1 file changed, 37 insertions(+), 37 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 32c182987d52c..3c46c33b9e571 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -723,34 +723,40 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { }, };
-static const struct uvc_control_mapping uvc_ctrl_mappings_uvc11[] = { - { - .id = V4L2_CID_POWER_LINE_FREQUENCY, - .entity = UVC_GUID_UVC_PROCESSING, - .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, - .size = 2, - .offset = 0, - .v4l2_type = V4L2_CTRL_TYPE_MENU, - .data_type = UVC_CTRL_DATA_TYPE_ENUM, - .menu_info = power_line_frequency_controls, - .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ, - V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), - }, +static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc11 = { + .id = V4L2_CID_POWER_LINE_FREQUENCY, + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, + .size = 2, + .offset = 0, + .v4l2_type = V4L2_CTRL_TYPE_MENU, + .data_type = UVC_CTRL_DATA_TYPE_ENUM, + .menu_info = power_line_frequency_controls, + .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ, + V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), };
-static const struct uvc_control_mapping uvc_ctrl_mappings_uvc15[] = { - { - .id = V4L2_CID_POWER_LINE_FREQUENCY, - .entity = UVC_GUID_UVC_PROCESSING, - .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, - .size = 2, - .offset = 0, - .v4l2_type = V4L2_CTRL_TYPE_MENU, - .data_type = UVC_CTRL_DATA_TYPE_ENUM, - .menu_info = power_line_frequency_controls, - .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO, - V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), - }, +static const struct uvc_control_mapping *uvc_ctrl_mappings_uvc11[] = { + &uvc_ctrl_power_line_mapping_uvc11, + NULL, /* Sentinel */ +}; + +static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc15 = { + .id = V4L2_CID_POWER_LINE_FREQUENCY, + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, + .size = 2, + .offset = 0, + .v4l2_type = V4L2_CTRL_TYPE_MENU, + .data_type = UVC_CTRL_DATA_TYPE_ENUM, + .menu_info = power_line_frequency_controls, + .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_AUTO, + V4L2_CID_POWER_LINE_FREQUENCY_DISABLED), +}; + +static const struct uvc_control_mapping *uvc_ctrl_mappings_uvc15[] = { + &uvc_ctrl_power_line_mapping_uvc15, + NULL, /* Sentinel */ };
/* ------------------------------------------------------------------------ @@ -2474,8 +2480,7 @@ static void uvc_ctrl_prune_entity(struct uvc_device *dev, static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain, struct uvc_control *ctrl) { - const struct uvc_control_mapping *mappings; - unsigned int num_mappings; + const struct uvc_control_mapping **mappings; unsigned int i;
/* @@ -2542,16 +2547,11 @@ static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain, }
/* Finally process version-specific mappings. */ - if (chain->dev->uvc_version < 0x0150) { - mappings = uvc_ctrl_mappings_uvc11; - num_mappings = ARRAY_SIZE(uvc_ctrl_mappings_uvc11); - } else { - mappings = uvc_ctrl_mappings_uvc15; - num_mappings = ARRAY_SIZE(uvc_ctrl_mappings_uvc15); - } + mappings = chain->dev->uvc_version < 0x0150 + ? uvc_ctrl_mappings_uvc11 : uvc_ctrl_mappings_uvc15;
- for (i = 0; i < num_mappings; ++i) { - const struct uvc_control_mapping *mapping = &mappings[i]; + for (i = 0; mappings[i]; ++i) { + const struct uvc_control_mapping *mapping = mappings[i];
if (uvc_entity_match_guid(ctrl->entity, mapping->entity) && ctrl->info.selector == mapping->selector)
From: Ricardo Ribalda ribalda@chromium.org
[ Upstream commit 3aa8628eb78a63d0bf93e159846e9c92bccc8f69 ]
Move the control mapping to uvc_ctrl.c. This way we do not have references to UVC controls or V4L2 controls in uvc_driver.c.
This also fixes a bug introduced in commit 382075604a68 ("media: uvcvideo: Limit power line control for Quanta UVC Webcam"). The offending commit caused the power line control menu entries to have incorrect indices compared to the V4L2_CID_POWER_LINE_FREQUENCY_* enumeration. Now that the limited mapping reuses the correct menu_info array, the indices correctly map to the V4L2 control specification.
Fixes: 382075604a68 ("media: uvcvideo: Limit power line control for Quanta UVC Webcam") Signed-off-by: Ricardo Ribalda ribalda@chromium.org Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/usb/uvc/uvc_ctrl.c | 13 +++++++++++++ drivers/media/usb/uvc/uvc_driver.c | 18 ------------------ drivers/media/usb/uvc/uvcvideo.h | 1 + 3 files changed, 14 insertions(+), 18 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 3c46c33b9e571..44b0cfb8ee1c7 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -723,6 +723,19 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { }, };
+const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = { + .id = V4L2_CID_POWER_LINE_FREQUENCY, + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, + .size = 2, + .offset = 0, + .v4l2_type = V4L2_CTRL_TYPE_MENU, + .data_type = UVC_CTRL_DATA_TYPE_ENUM, + .menu_info = power_line_frequency_controls, + .menu_mask = GENMASK(V4L2_CID_POWER_LINE_FREQUENCY_60HZ, + V4L2_CID_POWER_LINE_FREQUENCY_50HZ), +}; + static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_uvc11 = { .id = V4L2_CID_POWER_LINE_FREQUENCY, .entity = UVC_GUID_UVC_PROCESSING, diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 1c8d936ef4799..d5ff8df20f18a 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -2371,24 +2371,6 @@ MODULE_PARM_DESC(timeout, "Streaming control requests timeout"); * Driver initialization and cleanup */
-static const struct uvc_menu_info power_line_frequency_controls_limited[] = { - { 1, "50 Hz" }, - { 2, "60 Hz" }, -}; - -static const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited = { - .id = V4L2_CID_POWER_LINE_FREQUENCY, - .entity = UVC_GUID_UVC_PROCESSING, - .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, - .size = 2, - .offset = 0, - .v4l2_type = V4L2_CTRL_TYPE_MENU, - .data_type = UVC_CTRL_DATA_TYPE_ENUM, - .menu_info = power_line_frequency_controls_limited, - .menu_mask = - GENMASK(ARRAY_SIZE(power_line_frequency_controls_limited) - 1, 0), -}; - static const struct uvc_device_info uvc_ctrl_power_line_limited = { .mappings = (const struct uvc_control_mapping *[]) { &uvc_ctrl_power_line_mapping_limited, diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index f75e5864bbf72..1227ae63f85b7 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -728,6 +728,7 @@ int uvc_status_start(struct uvc_device *dev, gfp_t flags); void uvc_status_stop(struct uvc_device *dev);
/* Controls */ +extern const struct uvc_control_mapping uvc_ctrl_power_line_mapping_limited; extern const struct v4l2_subscribed_event_ops uvc_ctrl_sub_ev_ops;
int uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
From: Junhao He hejunhao3@huawei.com
[ Upstream commit 589d928248b72f8377d45904a14bcf686aa8bbeb ]
The TRCSEQRSTEVR and TRCSEQSTR registers are not implemented if the TRCIDR5.NUMSEQSTATE == 0. Skip accessing the registers in such cases.
Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") Signed-off-by: Junhao He hejunhao3@huawei.com Reviewed-by: Mike Leach mike.leach@linaro.org Reviewed-by: Anshuman Khandual anshuman.khandual@arm.com Signed-off-by: Suzuki K Poulose suzuki.poulose@arm.com Link: https://lore.kernel.org/r/20230114091632.60095-1-hejunhao3@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../hwtracing/coresight/coresight-etm4x-core.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 1cc052979e016..77bca6932f017 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -427,8 +427,10 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) etm4x_relaxed_write32(csa, config->vipcssctlr, TRCVIPCSSCTLR); for (i = 0; i < drvdata->nrseqstate - 1; i++) etm4x_relaxed_write32(csa, config->seq_ctrl[i], TRCSEQEVRn(i)); - etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); - etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); + if (drvdata->nrseqstate) { + etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); + } etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); for (i = 0; i < drvdata->nr_cntr; i++) { etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); @@ -1634,8 +1636,10 @@ static int __etm4_cpu_save(struct etmv4_drvdata *drvdata) for (i = 0; i < drvdata->nrseqstate - 1; i++) state->trcseqevr[i] = etm4x_read32(csa, TRCSEQEVRn(i));
- state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); - state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); + if (drvdata->nrseqstate) { + state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); + state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); + } state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR);
for (i = 0; i < drvdata->nr_cntr; i++) { @@ -1763,8 +1767,10 @@ static void __etm4_cpu_restore(struct etmv4_drvdata *drvdata) for (i = 0; i < drvdata->nrseqstate - 1; i++) etm4x_relaxed_write32(csa, state->trcseqevr[i], TRCSEQEVRn(i));
- etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); - etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); + if (drvdata->nrseqstate) { + etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); + etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); + } etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR);
for (i = 0; i < drvdata->nr_cntr; i++) {
From: James Clark james.clark@arm.com
[ Upstream commit 3244fb6dbbf1ffc114cdf382cc167bdd8c18088a ]
Writing 0 to the enable control repeatedly results in a negative value for enable_req_count. After this, writing 1 to the enable control appears to not work until the count returns to positive.
Change it so that it's impossible for enable_req_count to be < 0. Return an error to indicate that the disable request was invalid.
Fixes: 835d722ba10a ("coresight: cti: Initial CoreSight CTI Driver") Tested-by: Jinlong Mao quic_jinlmao@quicinc.com Signed-off-by: James Clark james.clark@arm.com Reviewed-by: Mike Leach mike.leach@linaro.org Signed-off-by: Suzuki K Poulose suzuki.poulose@arm.com Link: https://lore.kernel.org/r/20230110110736.2709917-2-james.clark@arm.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwtracing/coresight/coresight-cti-core.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c index d2cf4f4848e1b..838872f2484d3 100644 --- a/drivers/hwtracing/coresight/coresight-cti-core.c +++ b/drivers/hwtracing/coresight/coresight-cti-core.c @@ -151,9 +151,16 @@ static int cti_disable_hw(struct cti_drvdata *drvdata) { struct cti_config *config = &drvdata->config; struct coresight_device *csdev = drvdata->csdev; + int ret = 0;
spin_lock(&drvdata->spinlock);
+ /* don't allow negative refcounts, return an error */ + if (!atomic_read(&drvdata->config.enable_req_count)) { + ret = -EINVAL; + goto cti_not_disabled; + } + /* check refcount - disable on 0 */ if (atomic_dec_return(&drvdata->config.enable_req_count) > 0) goto cti_not_disabled; @@ -171,12 +178,12 @@ static int cti_disable_hw(struct cti_drvdata *drvdata) coresight_disclaim_device_unlocked(csdev); CS_LOCK(drvdata->base); spin_unlock(&drvdata->spinlock); - return 0; + return ret;
/* not disabled this call */ cti_not_disabled: spin_unlock(&drvdata->spinlock); - return 0; + return ret; }
void cti_write_single_reg(struct cti_drvdata *drvdata, int offset, u32 value)
From: Mao Jinlong quic_jinlmao@quicinc.com
[ Upstream commit eff674a9b86a6ffdd10c3af3863545acf7f1ce4f ]
In commit 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()") PM runtime calls are removed from cti_enable_hw/cti_disable_hw. When enabling CTI by writing enable sysfs node, clock for accessing CTI register won't be enabled. Device will crash due to register access issue. Add PM runtime call in enable_store to fix this issue.
Fixes: 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()") Signed-off-by: Mao Jinlong quic_jinlmao@quicinc.com [Change to only call pm_runtime_put if a disable happened] Tested-by: Jinlong Mao quic_jinlmao@quicinc.com Signed-off-by: James Clark james.clark@arm.com Signed-off-by: Suzuki K Poulose suzuki.poulose@arm.com Link: https://lore.kernel.org/r/20230110110736.2709917-3-james.clark@arm.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwtracing/coresight/coresight-cti-sysfs.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-cti-sysfs.c b/drivers/hwtracing/coresight/coresight-cti-sysfs.c index 6d59c815ecf5e..71e7a8266bb32 100644 --- a/drivers/hwtracing/coresight/coresight-cti-sysfs.c +++ b/drivers/hwtracing/coresight/coresight-cti-sysfs.c @@ -108,10 +108,19 @@ static ssize_t enable_store(struct device *dev, if (ret) return ret;
- if (val) + if (val) { + ret = pm_runtime_resume_and_get(dev->parent); + if (ret) + return ret; ret = cti_enable(drvdata->csdev); - else + if (ret) + pm_runtime_put(dev->parent); + } else { ret = cti_disable(drvdata->csdev); + if (!ret) + pm_runtime_put(dev->parent); + } + if (ret) return ret; return size;
From: Andy Shevchenko andriy.shevchenko@linux.intel.com
[ Upstream commit c3194949ae8fcbe2b7e38670e7c6a5cfd2605edc ]
When acpi_dev_get_memory_resources() fails, the reference count is left bumped. Drop it as it's done in the other error paths.
Fixes: 43d596e32276 ("usb: typec: intel_pmc_mux: Check the port status before connect") Signed-off-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Reviewed-by: Heikki Krogerus heikki.krogerus@linux.intel.com Link: https://lore.kernel.org/r/20230102202933.15968-1-andriy.shevchenko@linux.int... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/usb/typec/mux/intel_pmc_mux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c index fdbf3694e21f4..87e2c91306070 100644 --- a/drivers/usb/typec/mux/intel_pmc_mux.c +++ b/drivers/usb/typec/mux/intel_pmc_mux.c @@ -614,8 +614,10 @@ static int pmc_usb_probe_iom(struct pmc_usb *pmc)
INIT_LIST_HEAD(&resource_list); ret = acpi_dev_get_memory_resources(adev, &resource_list); - if (ret < 0) + if (ret < 0) { + acpi_dev_put(adev); return ret; + }
rentry = list_first_entry_or_null(&resource_list, struct resource_entry, node); if (rentry)
From: Alexey V. Vissarionov gremlin@altlinux.org
[ Upstream commit ea0b5aa5f184cf8293c93163f0fb00505190d431 ]
The sysfs link name "virtfn%u" constructed by pci_iov_sysfs_link() requires 17 bytes to contain the longest possible string. Increase VIRTFN_ID_LEN to accommodate that.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[bhelgaas: commit log, comment at #define] Fixes: dd7cc44d0bce ("PCI: add SR-IOV API for Physical Function driver") Link: https://lore.kernel.org/r/20221218033347.23743-1-gremlin@altlinux.org Signed-off-by: Alexey V. Vissarionov gremlin@altlinux.org Signed-off-by: Bjorn Helgaas bhelgaas@google.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pci/iov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c index 952217572113c..b2e8322755c17 100644 --- a/drivers/pci/iov.c +++ b/drivers/pci/iov.c @@ -14,7 +14,7 @@ #include <linux/delay.h> #include "pci.h"
-#define VIRTFN_ID_LEN 16 +#define VIRTFN_ID_LEN 17 /* "virtfn%u\0" for 2^32 - 1 */
int pci_iov_virtfn_bus(struct pci_dev *dev, int vf_id) {
From: Bjorn Helgaas bhelgaas@google.com
[ Upstream commit ddc10938e08cd7aac63d8385f7305f7889df5179 ]
switchtec_dev_read() didn't handle copy_to_user() errors correctly: it assigned "rc = -EFAULT", but actually returned either "size", -ENXIO, or -EBADMSG instead.
Update the failure cases to unlock mrpc_mutex and return -EFAULT directly.
Link: https://lore.kernel.org/r/20221216162126.207863-3-helgaas@kernel.org Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver") Signed-off-by: Bjorn Helgaas bhelgaas@google.com Reviewed-by: Logan Gunthorpe logang@deltatee.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pci/switch/switchtec.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c index 75be4fe225090..0c1faa6c1973a 100644 --- a/drivers/pci/switch/switchtec.c +++ b/drivers/pci/switch/switchtec.c @@ -606,21 +606,20 @@ static ssize_t switchtec_dev_read(struct file *filp, char __user *data, rc = copy_to_user(data, &stuser->return_code, sizeof(stuser->return_code)); if (rc) { - rc = -EFAULT; - goto out; + mutex_unlock(&stdev->mrpc_mutex); + return -EFAULT; }
data += sizeof(stuser->return_code); rc = copy_to_user(data, &stuser->data, size - sizeof(stuser->return_code)); if (rc) { - rc = -EFAULT; - goto out; + mutex_unlock(&stdev->mrpc_mutex); + return -EFAULT; }
stuser_set_state(stuser, MRPC_IDLE);
-out: mutex_unlock(&stdev->mrpc_mutex);
if (stuser->status == SWITCHTEC_MRPC_STATUS_DONE ||
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit fd858402c6d0a80e0b543886b9f7865c6d76d5d6 ]
8e4bfbe644a6 ("PCI: endpoint: pci-epf-vntb: fix error handle in epf_ntb_mw_bar_init()") added a "num_mws" parameter to epf_ntb_mw_bar_clear() but failed to add kernel-doc for num_mws.
Add kernel-doc for num_mws on epf_ntb_mw_bar_clear().
Fixes: 8e4bfbe644a6 ("PCI: endpoint: pci-epf-vntb: fix error handle in epf_ntb_mw_bar_init()") Link: https://lore.kernel.org/r/20230103024907.293853-1-yangyingliang@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Bjorn Helgaas bhelgaas@google.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pci/endpoint/functions/pci-epf-vntb.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c index 04698e7995a54..b7c7a8af99f4f 100644 --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c @@ -652,6 +652,7 @@ static int epf_ntb_mw_bar_init(struct epf_ntb *ntb) /** * epf_ntb_mw_bar_clear() - Clear Memory window BARs * @ntb: NTB device that facilitates communication between HOST and VHOST + * @num_mws: the number of Memory window BARs that to be cleared */ static void epf_ntb_mw_bar_clear(struct epf_ntb *ntb, int num_mws) {
From: Yicong Yang yangyicong@hisilicon.com
[ Upstream commit b8d976c7d41a28c0fccf22c7113be9a29dc07e5c ]
The PTT device can only support the devices on the same PCIe core, within BDF range [lower_bdf, upper_bdf]. It's not correct to assume the devices on the root bus are from the same PCIe core, there are cases that root ports from different PCIe core are sharing the same bus. So check when initializing the filters list.
Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device") Signed-off-by: Yicong Yang yangyicong@hisilicon.com Reviewed-by: Jonathan Cameron Jonathan.Cameron@huawei.com Signed-off-by: Suzuki K Poulose suzuki.poulose@arm.com Link: https://lore.kernel.org/r/20230112112201.16283-1-yangyicong@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwtracing/ptt/hisi_ptt.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c index 5d5526aa60c40..30f1525639b57 100644 --- a/drivers/hwtracing/ptt/hisi_ptt.c +++ b/drivers/hwtracing/ptt/hisi_ptt.c @@ -356,8 +356,18 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt)
static int hisi_ptt_init_filters(struct pci_dev *pdev, void *data) { + struct pci_dev *root_port = pcie_find_root_port(pdev); struct hisi_ptt_filter_desc *filter; struct hisi_ptt *hisi_ptt = data; + u32 port_devid; + + if (!root_port) + return 0; + + port_devid = PCI_DEVID(root_port->bus->number, root_port->devfn); + if (port_devid < hisi_ptt->lower_bdf || + port_devid > hisi_ptt->upper_bdf) + return 0;
/* * We won't fail the probe if filter allocation failed here. The filters
From: Sherry Sun sherry.sun@nxp.com
[ Upstream commit 1d4bd0e4ae4ba95892bef919a8d4d3f08f122d7e ]
UARTBAUD_RDMAE and UARTBAUD_TDMAE are enabled in lpuart32_startup(), but lpuart32_shutdown() not disable them, only free the dma ring buffer and release the dma channels, so here disable the Rx/Tx DMA first in lpuart32_shutdown().
Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") Signed-off-by: Sherry Sun sherry.sun@nxp.com Link: https://lore.kernel.org/r/20221125101953.18753-3-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/tty/serial/fsl_lpuart.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 5e69fb73f570f..5d1c28e094bb2 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -1796,6 +1796,11 @@ static void lpuart32_shutdown(struct uart_port *port)
spin_lock_irqsave(&port->lock, flags);
+ /* disable Rx/Tx DMA */ + temp = lpuart32_read(port, UARTBAUD); + temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE); + lpuart32_write(port, temp, UARTBAUD); + /* disable Rx/Tx and interrupts */ temp = lpuart32_read(port, UARTCTRL); temp &= ~(UARTCTRL_TE | UARTCTRL_RE |
From: Sherry Sun sherry.sun@nxp.com
[ Upstream commit 4029dfc034febb54f6dd8ea83568accc943bc088 ]
The LPUART Status Register needs to be cleared when closing the uart port to get a clean environment when reopening the uart.
Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") Signed-off-by: Sherry Sun sherry.sun@nxp.com Link: https://lore.kernel.org/r/20221125101953.18753-4-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/tty/serial/fsl_lpuart.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 5d1c28e094bb2..986ec8323c526 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -1796,6 +1796,10 @@ static void lpuart32_shutdown(struct uart_port *port)
spin_lock_irqsave(&port->lock, flags);
+ /* clear status */ + temp = lpuart32_read(&sport->port, UARTSTAT); + lpuart32_write(&sport->port, temp, UARTSTAT); + /* disable Rx/Tx DMA */ temp = lpuart32_read(port, UARTBAUD); temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE);
From: Bartosz Golaszewski bartosz.golaszewski@linaro.org
[ Upstream commit d8aca2f96813d51df574a811eda9a2cbed00f261 ]
We don't stop transmissions in progress at shutdown. This is fine with FIFO SE mode but with DMA (support for which we'll introduce later) it causes trouble so fix it now.
Fixes: e83766334f96 ("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART shutdown") Signed-off-by: Bartosz Golaszewski bartosz.golaszewski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Link: https://lore.kernel.org/r/20221229155030.418800-2-brgl@bgdev.pl Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/tty/serial/qcom_geni_serial.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c index 57f04f8bf5043..851a5d2133aa2 100644 --- a/drivers/tty/serial/qcom_geni_serial.c +++ b/drivers/tty/serial/qcom_geni_serial.c @@ -891,6 +891,8 @@ static int setup_fifos(struct qcom_geni_serial_port *port) static void qcom_geni_serial_shutdown(struct uart_port *uport) { disable_irq(uport->irq); + qcom_geni_serial_stop_tx(uport); + qcom_geni_serial_stop_rx(uport); }
static int qcom_geni_serial_port_setup(struct uart_port *uport)
On Tue, 7 Mar 2023 at 18:32, Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
From: Bartosz Golaszewski bartosz.golaszewski@linaro.org
[ Upstream commit d8aca2f96813d51df574a811eda9a2cbed00f261 ]
We don't stop transmissions in progress at shutdown. This is fine with FIFO SE mode but with DMA (support for which we'll introduce later) it causes trouble so fix it now.
Fixes: e83766334f96 ("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART shutdown") Signed-off-by: Bartosz Golaszewski bartosz.golaszewski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Link: https://lore.kernel.org/r/20221229155030.418800-2-brgl@bgdev.pl Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org
drivers/tty/serial/qcom_geni_serial.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c index 57f04f8bf5043..851a5d2133aa2 100644 --- a/drivers/tty/serial/qcom_geni_serial.c +++ b/drivers/tty/serial/qcom_geni_serial.c @@ -891,6 +891,8 @@ static int setup_fifos(struct qcom_geni_serial_port *port) static void qcom_geni_serial_shutdown(struct uart_port *uport) { disable_irq(uport->irq);
qcom_geni_serial_stop_tx(uport);
qcom_geni_serial_stop_rx(uport);
}
Greg,
Please drop this patch from all stable branches as it has caused a problem in current master and - once fixed - is only relevant for new (DMA) code.
Bartosz
On Tue, Mar 07, 2023 at 06:53:46PM +0100, Bartosz Golaszewski wrote:
On Tue, 7 Mar 2023 at 18:32, Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
From: Bartosz Golaszewski bartosz.golaszewski@linaro.org
[ Upstream commit d8aca2f96813d51df574a811eda9a2cbed00f261 ]
We don't stop transmissions in progress at shutdown. This is fine with FIFO SE mode but with DMA (support for which we'll introduce later) it causes trouble so fix it now.
Fixes: e83766334f96 ("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART shutdown") Signed-off-by: Bartosz Golaszewski bartosz.golaszewski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Link: https://lore.kernel.org/r/20221229155030.418800-2-brgl@bgdev.pl Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org
drivers/tty/serial/qcom_geni_serial.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c index 57f04f8bf5043..851a5d2133aa2 100644 --- a/drivers/tty/serial/qcom_geni_serial.c +++ b/drivers/tty/serial/qcom_geni_serial.c @@ -891,6 +891,8 @@ static int setup_fifos(struct qcom_geni_serial_port *port) static void qcom_geni_serial_shutdown(struct uart_port *uport) { disable_irq(uport->irq);
qcom_geni_serial_stop_tx(uport);
qcom_geni_serial_stop_rx(uport);
}
Greg,
Please drop this patch from all stable branches as it has caused a problem in current master and - once fixed - is only relevant for new (DMA) code.
Now dropped from all queues, thanks.
greg k-h
From: Yi Yang yiyang13@huawei.com
[ Upstream commit 38f28cfe9d08e3a47ef008798b275fef8118fc20 ]
Add the missing clk_disable_unprepare() before return from tegra_uart_hw_init() in the error handling path. When request_irq() fails in tegra_uart_startup(), 'tup->uart_clk' has been enabled, fix it by adding clk_disable_unprepare().
Fixes: cc9ca4d95846 ("serial: tegra: Only print FIFO error message when an error occurs") Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors") Signed-off-by: Yi Yang yiyang13@huawei.com Link: https://lore.kernel.org/r/20221126020852.113378-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/tty/serial/serial-tegra.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c index e5b9773db5e36..1cf08b33456c9 100644 --- a/drivers/tty/serial/serial-tegra.c +++ b/drivers/tty/serial/serial-tegra.c @@ -1046,6 +1046,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) if (tup->cdata->fifo_mode_enable_status) { ret = tegra_uart_wait_fifo_mode_enabled(tup); if (ret < 0) { + clk_disable_unprepare(tup->uart_clk); dev_err(tup->uport.dev, "Failed to enable FIFO mode: %d\n", ret); return ret; @@ -1067,6 +1068,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) */ ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD); if (ret < 0) { + clk_disable_unprepare(tup->uart_clk); dev_err(tup->uport.dev, "Failed to set baud rate\n"); return ret; } @@ -1226,10 +1228,13 @@ static int tegra_uart_startup(struct uart_port *u) dev_name(u->dev), tup); if (ret < 0) { dev_err(u->dev, "Failed to register ISR for IRQ %d\n", u->irq); - goto fail_hw_init; + goto fail_request_irq; } return 0;
+fail_request_irq: + /* tup->uart_clk is already enabled in tegra_uart_hw_init */ + clk_disable_unprepare(tup->uart_clk); fail_hw_init: if (!tup->use_rx_pio) tegra_uart_dma_channel_free(tup, true);
From: Duoming Zhou duoming@zju.edu.cn
[ Upstream commit 70fae37a09268455b8ab4f64647086b61da6f39c ]
This reverts commit be826ada52f1fcabed5b5217c94609ebf5967211.
The function monitor_card() is a timer handler that runs in an atomic context, but it calls usleep_range() that can sleep. As a result, the sleep-in-atomic-context bugs will happen. The process is shown below:
(atomic context) monitor_card() set_protocol() usleep_range() //sleep
The origin commit c1986ee9bea3 ("[PATCH] New Omnikey Cardman 4000 driver") works fine.
Fixes: be826ada52f1 ("char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol") Signed-off-by: Duoming Zhou duoming@zju.edu.cn Link: https://lore.kernel.org/r/20230118141000.5580-1-duoming@zju.edu.cn Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/char/pcmcia/cm4000_cs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c index adaec8fd4b16c..e656f42a28ac2 100644 --- a/drivers/char/pcmcia/cm4000_cs.c +++ b/drivers/char/pcmcia/cm4000_cs.c @@ -529,7 +529,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) DEBUGP(5, dev, "NumRecBytes is valid\n"); break; } - usleep_range(10000, 11000); + /* can not sleep as this is in atomic context */ + mdelay(10); } if (i == 100) { DEBUGP(5, dev, "Timeout waiting for NumRecBytes getting " @@ -549,7 +550,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) } break; } - usleep_range(10000, 11000); + /* can not sleep as this is in atomic context */ + mdelay(10); }
/* check whether it is a short PTS reply? */
From: Yuan Can yuancan@huawei.com
[ Upstream commit d717a3ab282f51ec45142f911f7ef8a55c057de5 ]
A problem about idt_89hpesx create debugfs failed is triggered with the following log given:
[ 4973.269647] debugfs: Directory 'idt_csr' with parent '/' already present!
The reason is that idt_init() returns i2c_add_driver() directly without checking its return value, if i2c_add_driver() failed, it returns without destroy the newly created debugfs, resulting the debugfs of idt_csr can never be created later.
idt_init() debugfs_create_dir() # create debugfs directory i2c_add_driver() driver_register() bus_add_driver() priv = kzalloc(...) # OOM happened # return without destroy debugfs directory
Fix by removing debugfs when i2c_add_driver() returns error.
Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver") Signed-off-by: Yuan Can yuancan@huawei.com Acked-by: Serge Semin fancer.lancer@gmail.com Link: https://lore.kernel.org/r/20221110020030.47711-1-yuancan@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/misc/eeprom/idt_89hpesx.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c index 4e07ee9cb500e..7075d0b378811 100644 --- a/drivers/misc/eeprom/idt_89hpesx.c +++ b/drivers/misc/eeprom/idt_89hpesx.c @@ -1566,12 +1566,20 @@ static struct i2c_driver idt_driver = { */ static int __init idt_init(void) { + int ret; + /* Create Debugfs directory first */ if (debugfs_initialized()) csr_dbgdir = debugfs_create_dir("idt_csr", NULL);
/* Add new i2c-device driver */ - return i2c_add_driver(&idt_driver); + ret = i2c_add_driver(&idt_driver); + if (ret) { + debugfs_remove_recursive(csr_dbgdir); + return ret; + } + + return 0; } module_init(idt_init);
From: Xiongfeng Wang wangxiongfeng2@huawei.com
[ Upstream commit ce4273d89c52167d6fe20572136c58117eae0657 ]
As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the input parameter @from if it is not NULL.
If we break the loop in applicom_init() with 'dev' not NULL, we need to call pci_dev_put() to decrease the refcount. Add the missing pci_dev_put() to avoid refcount leak.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xiongfeng Wang wangxiongfeng2@huawei.com Link: https://lore.kernel.org/r/20221122114035.24194-1-wangxiongfeng2@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/char/applicom.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c index 36203d3fa6ea6..69314532f38cd 100644 --- a/drivers/char/applicom.c +++ b/drivers/char/applicom.c @@ -197,8 +197,10 @@ static int __init applicom_init(void) if (!pci_match_id(applicom_pci_tbl, dev)) continue; - if (pci_enable_device(dev)) + if (pci_enable_device(dev)) { + pci_dev_put(dev); return -EIO; + }
RamIO = ioremap(pci_resource_start(dev, 0), LEN_RAM_IO);
@@ -207,6 +209,7 @@ static int __init applicom_init(void) "space at 0x%llx\n", (unsigned long long)pci_resource_start(dev, 0)); pci_disable_device(dev); + pci_dev_put(dev); return -EIO; }
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 9175ee1a99d57ec07d66ff572e1d5a724477ab37 ]
In error path in stratix10_svc_drv_probe(), gen_pool_destroy() should be called to destroy the memory pool that created by svc_create_memory_pool().
Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Dinh Nguyen dinguyen@kernel.org Link: https://lore.kernel.org/r/20221129163602.462369-1-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/firmware/stratix10-svc.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c index b4081f4d88a37..1a5640b3ab422 100644 --- a/drivers/firmware/stratix10-svc.c +++ b/drivers/firmware/stratix10-svc.c @@ -1138,13 +1138,17 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
/* allocate service controller and supporting channel */ controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); - if (!controller) - return -ENOMEM; + if (!controller) { + ret = -ENOMEM; + goto err_destroy_pool; + }
chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL, sizeof(*chans), GFP_KERNEL | __GFP_ZERO); - if (!chans) - return -ENOMEM; + if (!chans) { + ret = -ENOMEM; + goto err_destroy_pool; + }
controller->dev = dev; controller->num_chans = SVC_NUM_CHANNEL; @@ -1159,7 +1163,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL); if (ret) { dev_err(dev, "failed to allocate FIFO\n"); - return ret; + goto err_destroy_pool; } spin_lock_init(&controller->svc_fifo_lock);
@@ -1221,6 +1225,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
err_free_kfifo: kfifo_free(&controller->svc_fifo); +err_destroy_pool: + gen_pool_destroy(genpool); return ret; }
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit d66a4c20ae55ac88136b4a3befd944c093ffa677 ]
If add device "stratix10-rsu" failed in stratix10_svc_drv_probe(), the 'svc_fifo' and 'genpool' need be freed in the error path.
If allocate or add device "intel-fcs" failed in stratix10_svc_drv_probe(), the device "stratix10-rsu" need be unregistered in the error path.
Fixes: e6281c26674e ("firmware: stratix10-svc: Add support for FCS") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Signed-off-by: Dinh Nguyen dinguyen@kernel.org Link: https://lore.kernel.org/r/20221129163602.462369-2-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/firmware/stratix10-svc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c index 1a5640b3ab422..bde1f543f5298 100644 --- a/drivers/firmware/stratix10-svc.c +++ b/drivers/firmware/stratix10-svc.c @@ -1202,19 +1202,20 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) ret = platform_device_add(svc->stratix10_svc_rsu); if (ret) { platform_device_put(svc->stratix10_svc_rsu); - return ret; + goto err_free_kfifo; }
svc->intel_svc_fcs = platform_device_alloc(INTEL_FCS, 1); if (!svc->intel_svc_fcs) { dev_err(dev, "failed to allocate %s device\n", INTEL_FCS); - return -ENOMEM; + ret = -ENOMEM; + goto err_unregister_dev; }
ret = platform_device_add(svc->intel_svc_fcs); if (ret) { platform_device_put(svc->intel_svc_fcs); - return ret; + goto err_unregister_dev; }
dev_set_drvdata(dev, svc); @@ -1223,6 +1224,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
return 0;
+err_unregister_dev: + platform_device_unregister(svc->stratix10_svc_rsu); err_free_kfifo: kfifo_free(&controller->svc_fifo); err_destroy_pool:
From: George Kennedy george.kennedy@oracle.com
[ Upstream commit 1a726cb47fd204109c767409fa9ca15a96328f14 ]
The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so.
general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace: <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40 __x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs") Reported-by: syzkaller syzkaller@googlegroups.com Signed-off-by: George Kennedy george.kennedy@oracle.com Reviewed-by: Vishnu Dasa vdasa@vmware.com Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@o... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/misc/vmw_vmci/vmci_host.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c index da1e2a773823e..857b9851402a6 100644 --- a/drivers/misc/vmw_vmci/vmci_host.c +++ b/drivers/misc/vmw_vmci/vmci_host.c @@ -242,6 +242,8 @@ static int vmci_host_setup_notify(struct vmci_ctx *context, context->notify_page = NULL; return VMCI_ERROR_GENERIC; } + if (context->notify_page == NULL) + return VMCI_ERROR_UNAVAILABLE;
/* * Map the locked page and set up notify pointer.
From: Andy Shevchenko andriy.shevchenko@linux.intel.com
[ Upstream commit 503b676dde2780330c90a10b37a844686601a784 ]
GUID_INIT() is for internal guid_t type and shouldn't be used for the uuid_le. I.o.w. relying on the implementation details is layering violation. Use correct macros to initialize uuid_le.
Fixes: c2004ce99ed7 ("mei: pxp: export pavp client to me client bus") Signed-off-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Acked-by: Tomas Winkler tomas.winkler@intel.com Link: https://lore.kernel.org/r/20221228160558.21311-1-andriy.shevchenko@linux.int... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/misc/mei/pxp/mei_pxp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/mei/pxp/mei_pxp.c b/drivers/misc/mei/pxp/mei_pxp.c index 8dd09b1722ebd..7ee1fa7b1cb31 100644 --- a/drivers/misc/mei/pxp/mei_pxp.c +++ b/drivers/misc/mei/pxp/mei_pxp.c @@ -238,8 +238,8 @@ static void mei_pxp_remove(struct mei_cl_device *cldev) }
/* fbf6fcf1-96cf-4e2e-a6a6-1bab8cbe36b1 : PAVP GUID*/ -#define MEI_GUID_PXP GUID_INIT(0xfbf6fcf1, 0x96cf, 0x4e2e, 0xA6, \ - 0xa6, 0x1b, 0xab, 0x8c, 0xbe, 0x36, 0xb1) +#define MEI_GUID_PXP UUID_LE(0xfbf6fcf1, 0x96cf, 0x4e2e, 0xA6, \ + 0xa6, 0x1b, 0xab, 0x8c, 0xbe, 0x36, 0xb1)
static struct mei_cl_device_id mei_pxp_tbl[] = { { .uuid = MEI_GUID_PXP, .version = MEI_CL_VERSION_ANY },
From: Andy Shevchenko andriy.shevchenko@linux.intel.com
[ Upstream commit 512ba04d8211dd1a54dd36adc3ecc527a28069c5 ]
GUID_INIT() is for internal guid_t type and shouldn't be used for the uuid_le. I.o.w. relying on the implementation details is layering violation. Use correct macros to initialize uuid_le.
Fixes: 64e9bbdd9588 ("misc/mei/hdcp: Client driver for HDCP application") Signed-off-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Acked-by: Tomas Winkler tomas.winkler@intel.com Link: https://lore.kernel.org/r/20221228160500.21220-1-andriy.shevchenko@linux.int... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/misc/mei/hdcp/mei_hdcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c index e889a8bd7ac88..e0dcd5c114db1 100644 --- a/drivers/misc/mei/hdcp/mei_hdcp.c +++ b/drivers/misc/mei/hdcp/mei_hdcp.c @@ -859,8 +859,8 @@ static void mei_hdcp_remove(struct mei_cl_device *cldev) dev_warn(&cldev->dev, "mei_cldev_disable() failed\n"); }
-#define MEI_UUID_HDCP GUID_INIT(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \ - 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04) +#define MEI_UUID_HDCP UUID_LE(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \ + 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04)
static const struct mei_cl_device_id mei_hdcp_tbl[] = { { .uuid = MEI_UUID_HDCP, .version = MEI_CL_VERSION_ANY },
From: Christophe JAILLET christophe.jaillet@wanadoo.fr
[ Upstream commit 11819ed2b70da94acc41fec34178a011c4d3d25d ]
If of_platform_populate() fails, some resources need to be freed as already done in the other error handling paths.
Fixes: 278d56f970ae ("misc: fastrpc: Reference count channel context") Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support") Signed-off-by: Christophe JAILLET christophe.jaillet@wanadoo.fr Link: https://lore.kernel.org/r/b909d2f3273b794ea0f1f78d14bc24affb08ea5f.166939827... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/misc/fastrpc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 5310606113fe5..7ccaca1b7cb8b 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -2315,7 +2315,18 @@ static int fastrpc_rpmsg_probe(struct rpmsg_device *rpdev) data->domain_id = domain_id; data->rpdev = rpdev;
- return of_platform_populate(rdev->of_node, NULL, NULL, rdev); + err = of_platform_populate(rdev->of_node, NULL, NULL, rdev); + if (err) + goto populate_error; + + return 0; + +populate_error: + if (data->fdevice) + misc_deregister(&data->fdevice->miscdev); + if (data->secure_fdevice) + misc_deregister(&data->secure_fdevice->miscdev); + fdev_error: kfree(data); return err;
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit 53719876e064643a6e58b5e6067a149a0fd191ec ]
If platform_driver_register() fails, it don't need unregister and call kmem_cache_free() to free the memory allocated before calling register.
Fixes: bbc4d205d93f ("iommu/exynos: Fix driver initialization sequence") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Reviewed-by: Sam Protsenko semen.protsenko@linaro.org Link: https://lore.kernel.org/r/20230104095702.2591122-1-yangyingliang@huawei.com Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iommu/exynos-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c index b0cde22119875..c1d579c24740b 100644 --- a/drivers/iommu/exynos-iommu.c +++ b/drivers/iommu/exynos-iommu.c @@ -1446,7 +1446,7 @@ static int __init exynos_iommu_init(void)
return 0; err_reg_driver: - platform_driver_unregister(&exynos_sysmmu_driver); + kmem_cache_free(lv2table_kmem_cache, zero_lv2_table); err_zero_lv2: kmem_cache_destroy(lv2table_kmem_cache); return ret;
From: Zhengchao Shao shaozhengchao@huawei.com
[ Upstream commit 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 ]
When calling kobject_add() failed in device_add(), it will call cleanup_glue_dir() to free resource. But in kobject_add(), dev->kobj.parent has been set to NULL. This will cause resource leak.
The process is as follows: device_add() get_device_parent() class_dir_create_and_add() kobject_add() //kobject_get() ... dev->kobj.parent = kobj; ... kobject_add() //failed, but set dev->kobj.parent = NULL ... glue_dir = get_glue_dir(dev) //glue_dir = NULL, and goto //"Error" label ... cleanup_glue_dir() //becaues glue_dir is NULL, not call //kobject_put()
The preceding problem may cause insmod mac80211_hwsim.ko to failed. sysfs: cannot create duplicate filename '/devices/virtual/mac80211_hwsim' Call Trace: <TASK> dump_stack_lvl+0x8e/0xd1 sysfs_warn_dup.cold+0x1c/0x29 sysfs_create_dir_ns+0x224/0x280 kobject_add_internal+0x2aa/0x880 kobject_add+0x135/0x1a0 get_device_parent+0x3d7/0x590 device_add+0x2aa/0x1cb0 device_create_groups_vargs+0x1eb/0x260 device_create+0xdc/0x110 mac80211_hwsim_new_radio+0x31e/0x4790 [mac80211_hwsim] init_mac80211_hwsim+0x48d/0x1000 [mac80211_hwsim] do_one_initcall+0x10f/0x630 do_init_module+0x19f/0x5e0 load_module+0x64b7/0x6eb0 __do_sys_finit_module+0x140/0x200 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> kobject_add_internal failed for mac80211_hwsim with -EEXIST, don't try to register things with the same name in the same directory.
Fixes: cebf8fd16900 ("driver core: fix race between creating/querying glue dir and its cleanup") Signed-off-by: Zhengchao Shao shaozhengchao@huawei.com Link: https://lore.kernel.org/r/20221123012042.335252-1-shaozhengchao@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index 506289e6b04dd..9fccf7b4e7ea3 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -3413,7 +3413,7 @@ int device_add(struct device *dev) /* we require the name to be set before, and pass NULL */ error = kobject_add(&dev->kobj, dev->kobj.parent, NULL); if (error) { - glue_dir = get_glue_dir(dev); + glue_dir = kobj; goto Error; }
From: Hanjun Guo guohanjun@huawei.com
[ Upstream commit 0d150f967e8410e1e6712484543eec709356a65d ]
struct acpi_pld_info *pld should be freed before the return of allocation failure, to prevent memory leak, add the ACPI_FREE() to fix it.
Fixes: bc443c31def5 ("driver core: location: Check for allocations failure") Signed-off-by: Hanjun Guo guohanjun@huawei.com Link: https://lore.kernel.org/r/1669102648-11517-1-git-send-email-guohanjun@huawei... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/physical_location.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/base/physical_location.c b/drivers/base/physical_location.c index 87af641cfe1a3..951819e71b4ad 100644 --- a/drivers/base/physical_location.c +++ b/drivers/base/physical_location.c @@ -24,8 +24,11 @@ bool dev_add_physical_location(struct device *dev)
dev->physical_location = kzalloc(sizeof(*dev->physical_location), GFP_KERNEL); - if (!dev->physical_location) + if (!dev->physical_location) { + ACPI_FREE(pld); return false; + } + dev->physical_location->panel = pld->panel; dev->physical_location->vertical_position = pld->vertical_position; dev->physical_location->horizontal_position = pld->horizontal_position;
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit a86367803838b369fe5486ac18771d14723c258c ]
Current some drivers(like iscsi) call transport_register_device() failed, they don't call transport_destroy_device() to release the memory allocated in transport_setup_device(), because they don't know what was done, it should be internal thing to release the resource in register function. So fix this leak by calling destroy function inside register function.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Link: https://lore.kernel.org/r/20221110102307.3492557-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/transport_class.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/include/linux/transport_class.h b/include/linux/transport_class.h index 63076fb835e34..2efc271a96fa6 100644 --- a/include/linux/transport_class.h +++ b/include/linux/transport_class.h @@ -70,8 +70,14 @@ void transport_destroy_device(struct device *); static inline int transport_register_device(struct device *dev) { + int ret; + transport_setup_device(dev); - return transport_add_device(dev); + ret = transport_add_device(dev); + if (ret) + transport_destroy_device(dev); + + return ret; }
static inline void
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit e5da06b27ff5a148e42265c8e306670a9d913969 ]
The normal call sequence of using transport class is:
Add path: transport_setup_device() transport_setup_classdev() // call sas_host_setup() here transport_add_device() // if fails, need call transport_destroy_device() transport_configure_device()
Remove path: transport_remove_device() transport_remove_classdev // call sas_host_remove() here transport_destroy_device()
If transport_add_device() fails, need call transport_destroy_device() to free memory, but in this case, ->remove() is not called, and the resources allocated in ->setup() are leaked. So fix these leaks by calling ->remove() in transport_add_class_device() if it returns error.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Link: https://lore.kernel.org/r/20221115031638.3816551-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/transport_class.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/drivers/base/transport_class.c b/drivers/base/transport_class.c index ccc86206e5087..09ee2a1e35bbd 100644 --- a/drivers/base/transport_class.c +++ b/drivers/base/transport_class.c @@ -155,12 +155,27 @@ static int transport_add_class_device(struct attribute_container *cont, struct device *dev, struct device *classdev) { + struct transport_class *tclass = class_to_transport_class(cont->class); int error = attribute_container_add_class_device(classdev); struct transport_container *tcont = attribute_container_to_transport_container(cont);
- if (!error && tcont->statistics) + if (error) + goto err_remove; + + if (tcont->statistics) { error = sysfs_create_group(&classdev->kobj, tcont->statistics); + if (error) + goto err_del; + } + + return 0; + +err_del: + attribute_container_class_device_del(classdev); +err_remove: + if (tclass->remove) + tclass->remove(tcont, dev, classdev);
return error; }
From: Chen Zhongjin chenzhongjin@huawei.com
[ Upstream commit 18e126e97c961f7a93823795c879d7c085fe5098 ]
KASAN reported a null-ptr-deref error:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: <TASK> kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]---
It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del().
However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted.
Move error handling to after list_add_tail to fix this.
Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle") Signed-off-by: Chen Zhongjin chenzhongjin@huawei.com Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/firmware/dmi-sysfs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c index 66727ad3361b9..402217c570333 100644 --- a/drivers/firmware/dmi-sysfs.c +++ b/drivers/firmware/dmi-sysfs.c @@ -603,16 +603,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, *ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL, "%d-%d", dh->type, entry->instance);
- if (*ret) { - kobject_put(&entry->kobj); - return; - } - /* Thread on the global list for cleanup */ spin_lock(&entry_list_lock); list_add_tail(&entry->list, &entry_list); spin_unlock(&entry_list_lock);
+ if (*ret) { + kobject_put(&entry->kobj); + return; + } + /* Handle specializations by type */ switch (dh->type) { case DMI_ENTRY_SYSTEM_EVENT_LOG:
From: Nicolin Chen nicolinc@nvidia.com
[ Upstream commit 9fabbdf338b701f2d763d9edbc3e82ce1e7fa1b4 ]
The test_cmd_destroy_access() should end with a semicolon, so add one. There is a test_ioctl_destroy(ioas_id) following already, so drop one.
Fixes: 57f0988706fe ("iommufd: Add a selftest") Link: https://lore.kernel.org/r/20230120074204.1368-1-nicolinc@nvidia.com Signed-off-by: Nicolin Chen nicolinc@nvidia.com Reviewed-by: Kevin Tian kevin.tian@intel.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/iommu/iommufd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/iommu/iommufd.c b/tools/testing/selftests/iommu/iommufd.c index 8aa8a346cf221..fa08209268c42 100644 --- a/tools/testing/selftests/iommu/iommufd.c +++ b/tools/testing/selftests/iommu/iommufd.c @@ -1259,7 +1259,7 @@ TEST_F(iommufd_mock_domain, user_copy)
test_cmd_destroy_access_pages( access_cmd.id, access_cmd.access_pages.out_access_pages_id); - test_cmd_destroy_access(access_cmd.id) test_ioctl_destroy(ioas_id); + test_cmd_destroy_access(access_cmd.id);
test_ioctl_destroy(ioas_id); }
From: Yi Liu yi.l.liu@intel.com
[ Upstream commit 84798f2849942bb5e8817417adfdfa6241df2835 ]
struct iommu_ioas_copy, struct iommu_option and struct iommu_vfio_ioas are missed in ucmd_buffer. Although they are smaller than the size of ucmd_buffer, it is safer to list them in ucmd_buffer explicitly.
Fixes: aad37e71d5c4 ("iommufd: IOCTLs for the io_pagetable") Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") Link: https://lore.kernel.org/r/20230120122040.280219-1-yi.l.liu@intel.com Signed-off-by: Yi Liu yi.l.liu@intel.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iommu/iommufd/main.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c index 083e6fcbe10ad..3fbe636c3d8a6 100644 --- a/drivers/iommu/iommufd/main.c +++ b/drivers/iommu/iommufd/main.c @@ -252,9 +252,12 @@ union ucmd_buffer { struct iommu_destroy destroy; struct iommu_ioas_alloc alloc; struct iommu_ioas_allow_iovas allow_iovas; + struct iommu_ioas_copy ioas_copy; struct iommu_ioas_iova_ranges iova_ranges; struct iommu_ioas_map map; struct iommu_ioas_unmap unmap; + struct iommu_option option; + struct iommu_vfio_ioas vfio_ioas; #ifdef CONFIG_IOMMUFD_TEST struct iommu_test_cmd test; #endif
From: Fabian Vogt fabian@ritter-vogt.de
[ Upstream commit e55f67391fa986f7357edba0ca59e668d99c3a5f ]
This is used when responding to GET_STATUS requests. Without this, it crashes on completion.
Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") Signed-off-by: Fabian Vogt fabian@ritter-vogt.de Signed-off-by: Linus Walleij linus.walleij@linaro.org Link: https://lore.kernel.org/r/20230123073508.2350402-2-linus.walleij@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/usb/fotg210/fotg210-udc.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
diff --git a/drivers/usb/fotg210/fotg210-udc.c b/drivers/usb/fotg210/fotg210-udc.c index eb076746f0320..7ba7fb52ddaac 100644 --- a/drivers/usb/fotg210/fotg210-udc.c +++ b/drivers/usb/fotg210/fotg210-udc.c @@ -710,6 +710,20 @@ static int fotg210_is_epnstall(struct fotg210_ep *ep) return value & INOUTEPMPSR_STL_EP ? 1 : 0; }
+/* For EP0 requests triggered by this driver (currently GET_STATUS response) */ +static void fotg210_ep0_complete(struct usb_ep *_ep, struct usb_request *req) +{ + struct fotg210_ep *ep; + struct fotg210_udc *fotg210; + + ep = container_of(_ep, struct fotg210_ep, ep); + fotg210 = ep->fotg210; + + if (req->status || req->actual != req->length) { + dev_warn(&fotg210->gadget.dev, "EP0 request failed: %d\n", req->status); + } +} + static void fotg210_get_status(struct fotg210_udc *fotg210, struct usb_ctrlrequest *ctrl) { @@ -1261,6 +1275,8 @@ int fotg210_udc_probe(struct platform_device *pdev) if (fotg210->ep0_req == NULL) goto err_map;
+ fotg210->ep0_req->complete = fotg210_ep0_complete; + fotg210_init(fotg210);
fotg210_disable_unplug(fotg210);
From: Serge Semin Sergey.Semin@baikalelectronics.ru
[ Upstream commit 13b6299cf66165a442089fa895a7f70250703584 ]
Interleaved DMA transfer support was added by 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support"), but depending on the selected channel, either source or destination address are left uninitialized which was obviously wrong.
Initialize the destination address of the eDMA burst descriptors for DEV_TO_MEM interleaved operations and the source address for MEM_TO_DEV operations.
Link: https://lore.kernel.org/r/20230113171409.30470-5-Sergey.Semin@baikalelectron... Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support") Tested-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Signed-off-by: Serge Semin Sergey.Semin@baikalelectronics.ru Signed-off-by: Lorenzo Pieralisi lpieralisi@kernel.org Signed-off-by: Bjorn Helgaas bhelgaas@google.com Reviewed-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Acked-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/dma/dw-edma/dw-edma-core.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c index c54b24ff5206a..52bdf04aff511 100644 --- a/drivers/dma/dw-edma/dw-edma-core.c +++ b/drivers/dma/dw-edma/dw-edma-core.c @@ -455,6 +455,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) * and destination addresses are increased * by the same portion (data length) */ + } else if (xfer->type == EDMA_XFER_INTERLEAVED) { + burst->dar = dst_addr; } } else { burst->dar = dst_addr; @@ -470,6 +472,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) * and destination addresses are increased * by the same portion (data length) */ + } else if (xfer->type == EDMA_XFER_INTERLEAVED) { + burst->sar = src_addr; } }
From: Ivan Bornyakov i.bornyakov@metrotek.ru
[ Upstream commit 1da53d23a41c5f77963984d8da5623ed56918ada ]
As spi-summary doc says:
I/O buffers use the usual Linux rules, and must be DMA-safe. You'd normally allocate them from the heap or free page pool. Don't use the stack, or anything that's declared "static".
Replace spi_write() with spi_write_then_read(), which is dma-safe for on-stack buffers. Use cacheline aligned buffers for transfers used in spi_sync_transfer().
Although everything works OK with stack-located I/O buffers, better follow the doc to be safe.
Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager") Signed-off-by: Ivan Bornyakov i.bornyakov@metrotek.ru Acked-by: Conor Dooley conor.dooley@microchip.com Acked-by: Xu Yilun yilun.xu@intel.com Link: https://lore.kernel.org/r/20221230092922.18822-2-i.bornyakov@metrotek.ru Signed-off-by: Xu Yilun yilun.xu@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/fpga/microchip-spi.c | 93 ++++++++++++++++++------------------ 1 file changed, 47 insertions(+), 46 deletions(-)
diff --git a/drivers/fpga/microchip-spi.c b/drivers/fpga/microchip-spi.c index 7436976ea9048..bb69f5beefe78 100644 --- a/drivers/fpga/microchip-spi.c +++ b/drivers/fpga/microchip-spi.c @@ -42,46 +42,55 @@ struct mpf_priv { struct spi_device *spi; bool program_mode; + u8 tx __aligned(ARCH_KMALLOC_MINALIGN); + u8 rx; };
-static int mpf_read_status(struct spi_device *spi) +static int mpf_read_status(struct mpf_priv *priv) { - u8 status = 0, status_command = MPF_SPI_READ_STATUS; - struct spi_transfer xfers[2] = { 0 }; - int ret; - /* * HW status is returned on MISO in the first byte after CS went * active. However, first reading can be inadequate, so we submit * two identical SPI transfers and use result of the later one. */ - xfers[0].tx_buf = &status_command; - xfers[1].tx_buf = &status_command; - xfers[0].rx_buf = &status; - xfers[1].rx_buf = &status; - xfers[0].len = 1; - xfers[1].len = 1; - xfers[0].cs_change = 1; + struct spi_transfer xfers[2] = { + { + .tx_buf = &priv->tx, + .rx_buf = &priv->rx, + .len = 1, + .cs_change = 1, + }, { + .tx_buf = &priv->tx, + .rx_buf = &priv->rx, + .len = 1, + }, + }; + u8 status; + int ret; + + priv->tx = MPF_SPI_READ_STATUS; + + ret = spi_sync_transfer(priv->spi, xfers, 2); + if (ret) + return ret;
- ret = spi_sync_transfer(spi, xfers, 2); + status = priv->rx;
if ((status & MPF_STATUS_SPI_VIOLATION) || (status & MPF_STATUS_SPI_ERROR)) - ret = -EIO; + return -EIO;
- return ret ? : status; + return status; }
static enum fpga_mgr_states mpf_ops_state(struct fpga_manager *mgr) { struct mpf_priv *priv = mgr->priv; - struct spi_device *spi; bool program_mode; int status;
- spi = priv->spi; program_mode = priv->program_mode; - status = mpf_read_status(spi); + status = mpf_read_status(priv);
if (!program_mode && !status) return FPGA_MGR_STATE_OPERATING; @@ -186,12 +195,12 @@ static int mpf_ops_parse_header(struct fpga_manager *mgr, }
/* Poll HW status until busy bit is cleared and mask bits are set. */ -static int mpf_poll_status(struct spi_device *spi, u8 mask) +static int mpf_poll_status(struct mpf_priv *priv, u8 mask) { int status, retries = MPF_STATUS_POLL_RETRIES;
while (retries--) { - status = mpf_read_status(spi); + status = mpf_read_status(priv); if (status < 0) return status;
@@ -205,32 +214,32 @@ static int mpf_poll_status(struct spi_device *spi, u8 mask) return -EBUSY; }
-static int mpf_spi_write(struct spi_device *spi, const void *buf, size_t buf_size) +static int mpf_spi_write(struct mpf_priv *priv, const void *buf, size_t buf_size) { - int status = mpf_poll_status(spi, 0); + int status = mpf_poll_status(priv, 0);
if (status < 0) return status;
- return spi_write(spi, buf, buf_size); + return spi_write_then_read(priv->spi, buf, buf_size, NULL, 0); }
-static int mpf_spi_write_then_read(struct spi_device *spi, +static int mpf_spi_write_then_read(struct mpf_priv *priv, const void *txbuf, size_t txbuf_size, void *rxbuf, size_t rxbuf_size) { const u8 read_command[] = { MPF_SPI_READ_DATA }; int ret;
- ret = mpf_spi_write(spi, txbuf, txbuf_size); + ret = mpf_spi_write(priv, txbuf, txbuf_size); if (ret) return ret;
- ret = mpf_poll_status(spi, MPF_STATUS_READY); + ret = mpf_poll_status(priv, MPF_STATUS_READY); if (ret < 0) return ret;
- return spi_write_then_read(spi, read_command, sizeof(read_command), + return spi_write_then_read(priv->spi, read_command, sizeof(read_command), rxbuf, rxbuf_size); }
@@ -242,7 +251,6 @@ static int mpf_ops_write_init(struct fpga_manager *mgr, const u8 isc_en_command[] = { MPF_SPI_ISC_ENABLE }; struct mpf_priv *priv = mgr->priv; struct device *dev = &mgr->dev; - struct spi_device *spi; u32 isc_ret = 0; int ret;
@@ -251,9 +259,7 @@ static int mpf_ops_write_init(struct fpga_manager *mgr, return -EOPNOTSUPP; }
- spi = priv->spi; - - ret = mpf_spi_write_then_read(spi, isc_en_command, sizeof(isc_en_command), + ret = mpf_spi_write_then_read(priv, isc_en_command, sizeof(isc_en_command), &isc_ret, sizeof(isc_ret)); if (ret || isc_ret) { dev_err(dev, "Failed to enable ISC: spi_ret %d, isc_ret %u\n", @@ -261,7 +267,7 @@ static int mpf_ops_write_init(struct fpga_manager *mgr, return -EFAULT; }
- ret = mpf_spi_write(spi, program_mode, sizeof(program_mode)); + ret = mpf_spi_write(priv, program_mode, sizeof(program_mode)); if (ret) { dev_err(dev, "Failed to enter program mode: %d\n", ret); return ret; @@ -274,11 +280,9 @@ static int mpf_ops_write_init(struct fpga_manager *mgr,
static int mpf_ops_write(struct fpga_manager *mgr, const char *buf, size_t count) { - u8 spi_frame_command[] = { MPF_SPI_FRAME }; struct spi_transfer xfers[2] = { 0 }; struct mpf_priv *priv = mgr->priv; struct device *dev = &mgr->dev; - struct spi_device *spi; int ret, i;
if (count % MPF_SPI_FRAME_SIZE) { @@ -287,18 +291,18 @@ static int mpf_ops_write(struct fpga_manager *mgr, const char *buf, size_t count return -EINVAL; }
- spi = priv->spi; - - xfers[0].tx_buf = spi_frame_command; - xfers[0].len = sizeof(spi_frame_command); + xfers[0].tx_buf = &priv->tx; + xfers[0].len = 1;
for (i = 0; i < count / MPF_SPI_FRAME_SIZE; i++) { xfers[1].tx_buf = buf + i * MPF_SPI_FRAME_SIZE; xfers[1].len = MPF_SPI_FRAME_SIZE;
- ret = mpf_poll_status(spi, 0); - if (ret >= 0) - ret = spi_sync_transfer(spi, xfers, ARRAY_SIZE(xfers)); + ret = mpf_poll_status(priv, 0); + if (ret >= 0) { + priv->tx = MPF_SPI_FRAME; + ret = spi_sync_transfer(priv->spi, xfers, ARRAY_SIZE(xfers)); + }
if (ret) { dev_err(dev, "Failed to write bitstream frame %d/%zu\n", @@ -317,12 +321,9 @@ static int mpf_ops_write_complete(struct fpga_manager *mgr, const u8 release_command[] = { MPF_SPI_RELEASE }; struct mpf_priv *priv = mgr->priv; struct device *dev = &mgr->dev; - struct spi_device *spi; int ret;
- spi = priv->spi; - - ret = mpf_spi_write(spi, isc_dis_command, sizeof(isc_dis_command)); + ret = mpf_spi_write(priv, isc_dis_command, sizeof(isc_dis_command)); if (ret) { dev_err(dev, "Failed to disable ISC: %d\n", ret); return ret; @@ -330,7 +331,7 @@ static int mpf_ops_write_complete(struct fpga_manager *mgr,
usleep_range(1000, 2000);
- ret = mpf_spi_write(spi, release_command, sizeof(release_command)); + ret = mpf_spi_write(priv, release_command, sizeof(release_command)); if (ret) { dev_err(dev, "Failed to exit program mode: %d\n", ret); return ret;
From: Ivan Bornyakov i.bornyakov@metrotek.ru
[ Upstream commit 88e705697e801299a13ecaf2ba54599964fe711c ]
Original busy loop with retries count in mpf_poll_status() is not too reliable, as it takes different times on different systems. Replace it with read_poll_timeout() macro.
While at it, fix polling stop condition to met function's original intention declared in the comment. The issue with original polling stop condition is that it stops if any of mask bits is set, while intention was to stop if all mask bits is set. This was not noticible because only MPF_STATUS_READY is passed as mask argument and it is BIT(1).
Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager") Signed-off-by: Ivan Bornyakov i.bornyakov@metrotek.ru Reviewed-by: Ilpo Järvinen ilpo.jarvinen@linux.intel.com Acked-by: Conor Dooley conor.dooley@microchip.com Acked-by: Xu Yilun yilun.xu@intel.com Link: https://lore.kernel.org/r/20221230092922.18822-3-i.bornyakov@metrotek.ru Signed-off-by: Xu Yilun yilun.xu@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/fpga/microchip-spi.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
diff --git a/drivers/fpga/microchip-spi.c b/drivers/fpga/microchip-spi.c index bb69f5beefe78..137fafdf57a6f 100644 --- a/drivers/fpga/microchip-spi.c +++ b/drivers/fpga/microchip-spi.c @@ -6,6 +6,7 @@ #include <asm/unaligned.h> #include <linux/delay.h> #include <linux/fpga/fpga-mgr.h> +#include <linux/iopoll.h> #include <linux/module.h> #include <linux/of_device.h> #include <linux/spi/spi.h> @@ -33,7 +34,7 @@
#define MPF_BITS_PER_COMPONENT_SIZE 22
-#define MPF_STATUS_POLL_RETRIES 10000 +#define MPF_STATUS_POLL_TIMEOUT (2 * USEC_PER_SEC) #define MPF_STATUS_BUSY BIT(0) #define MPF_STATUS_READY BIT(1) #define MPF_STATUS_SPI_VIOLATION BIT(2) @@ -194,24 +195,25 @@ static int mpf_ops_parse_header(struct fpga_manager *mgr, return 0; }
-/* Poll HW status until busy bit is cleared and mask bits are set. */ static int mpf_poll_status(struct mpf_priv *priv, u8 mask) { - int status, retries = MPF_STATUS_POLL_RETRIES; + int ret, status;
- while (retries--) { - status = mpf_read_status(priv); - if (status < 0) - return status; - - if (status & MPF_STATUS_BUSY) - continue; - - if (!mask || (status & mask)) - return status; - } + /* + * Busy poll HW status. Polling stops if any of the following + * conditions are met: + * - timeout is reached + * - mpf_read_status() returns an error + * - busy bit is cleared AND mask bits are set + */ + ret = read_poll_timeout(mpf_read_status, status, + (status < 0) || + ((status & (MPF_STATUS_BUSY | mask)) == mask), + 0, MPF_STATUS_POLL_TIMEOUT, false, priv); + if (ret < 0) + return ret;
- return -EBUSY; + return status; }
static int mpf_spi_write(struct mpf_priv *priv, const void *buf, size_t buf_size)
From: Christophe JAILLET christophe.jaillet@wanadoo.fr
[ Upstream commit a4a97ab3db5c081eb6e7dba91306adefb461e0bd ]
If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xdbc_trace() is called.
Reserve an extra byte, which will be zeroed automatically because 'buf' is a static variable, in order to avoid troubles, should it happen.
Fixes: aeb9dd1de98c ("usb/early: Add driver for xhci debug capability") Signed-off-by: Christophe JAILLET christophe.jaillet@wanadoo.fr Link: https://lore.kernel.org/r/d6a7562c5e839a195cee85db6dc81817f9372cb1.167501618... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/usb/early/xhci-dbc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c index 7970471548202..f3e23be227d41 100644 --- a/drivers/usb/early/xhci-dbc.c +++ b/drivers/usb/early/xhci-dbc.c @@ -874,7 +874,8 @@ static int xdbc_bulk_write(const char *bytes, int size)
static void early_xdbc_write(struct console *con, const char *str, u32 n) { - static char buf[XDBC_MAX_PACKET]; + /* static variables are zeroed, so buf is always NULL terminated */ + static char buf[XDBC_MAX_PACKET + 1]; int chunk, ret; int use_cr = 0;
From: Sherry Sun sherry.sun@nxp.com
[ Upstream commit 9ad9df8447547febe9dd09b040f4528a09e495f0 ]
The RXWATER value must be greater than 0 according to the LPUART reference manual. And when the number of datawords in the receive FIFO is greater than RXWATER, an interrupt or a DMA request is generated, so no need to set the different value for lpuart interrupt case and dma case. Here delete the wrong RXWATER setting for dma case directly.
Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") Signed-off-by: Sherry Sun sherry.sun@nxp.com Link: https://lore.kernel.org/r/20230130064449.9564-4-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/tty/serial/fsl_lpuart.c | 6 ------ 1 file changed, 6 deletions(-)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 986ec8323c526..f34fabdc2bb7d 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -1683,12 +1683,6 @@ static void lpuart32_configure(struct lpuart_port *sport) { unsigned long temp;
- if (sport->lpuart_dma_rx_use) { - /* RXWATER must be 0 */ - temp = lpuart32_read(&sport->port, UARTWATER); - temp &= ~(UARTWATER_WATER_MASK << UARTWATER_RXWATER_OFF); - lpuart32_write(&sport->port, temp, UARTWATER); - } temp = lpuart32_read(&sport->port, UARTCTRL); if (!sport->lpuart_dma_rx_use) temp |= UARTCTRL_RIE;
From: Nikita Zhandarovich n.zhandarovich@fintech.ru
[ Upstream commit ef42520240aacfc0d46c8d780c051d135a8dc9b7 ]
ip_dev_find() may return NULL and assign it to pdev which is dereferenced later. Fix this by checking the return value of ip_dev_find() for NULL similar to the way it is done with other instances of said function.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection") Signed-off-by: Nikita Zhandarovich n.zhandarovich@fintech.ru Link: https://lore.kernel.org/r/20230201172103.17261-1-n.zhandarovich@fintech.ru Signed-off-by: Leon Romanovsky leon@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/cxgb4/cm.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index 499a425a33791..ea3ddf0d24114 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -4144,6 +4144,10 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
if (neigh->dev->flags & IFF_LOOPBACK) { pdev = ip_dev_find(&init_net, iph->daddr); + if (!pdev) { + pr_err("%s - failed to find device!\n", __func__); + goto free_dst; + } e = cxgb4_l2t_get(dev->rdev.lldi.l2t, neigh, pdev, 0); pi = (struct port_info *)netdev_priv(pdev);
From: Dan Carpenter error27@gmail.com
[ Upstream commit ba883de971d1ad018f3083d9195b8abe54d87407 ]
This function only calls mtk_otg_switch_init() when the ->port_mode is MUSB_OTG so the clean up code should only call mtk_otg_switch_exit() for that mode.
Fixes: 0990366bab3c ("usb: musb: Add support for MediaTek musb controller") Signed-off-by: Dan Carpenter error27@gmail.com Link: https://lore.kernel.org/r/Y8/3TqpqiSr0RxFH@kili Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/usb/musb/mediatek.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/musb/mediatek.c b/drivers/usb/musb/mediatek.c index cad991380b0cf..27b9bd2583400 100644 --- a/drivers/usb/musb/mediatek.c +++ b/drivers/usb/musb/mediatek.c @@ -294,7 +294,8 @@ static int mtk_musb_init(struct musb *musb) err_phy_power_on: phy_exit(glue->phy); err_phy_init: - mtk_otg_switch_exit(glue); + if (musb->port_mode == MUSB_OTG) + mtk_otg_switch_exit(glue); return ret; }
From: Udipto Goswami quic_ugoswami@quicinc.com
[ Upstream commit 89e7252d6c7e7eeb31971cd7df987316ecc64ff5 ]
During enumeration or composition switch,a userspace process agnostic of the conventions of configs can try to create function symlinks even after the UDC is bound to current config which is not correct. Potentially it can create duplicates within the current config.
Prevent this by adding a check if udc_name already exists, then bail out of cfg_link.
Following is an example:
Step1: ln -s X1 ffs.a -->cfg_link --> usb_get_function(ffs.a) ->ffs_alloc
CFG->FUNC_LIST: <ffs.a> C->FUNCTION: <empty>
Step2: echo udc.name > /config/usb_gadget/g1/UDC --> UDC_store ->composite_bind ->usb_add_function
CFG->FUNC_LIST: <empty> C->FUNCTION: <ffs.a>
Step3: ln -s Y1 ffs.a -->cfg_link -->usb_get_function(ffs.a) ->ffs_alloc
CFG->FUNC_LIST: <ffs.a> C->FUNCTION: <ffs.a>
both the lists corresponds to the same function instance ffs.a but the usb_function* pointer is different because in step 3 ffs_alloc has created a new reference to usb_function* for ffs.a and added it to cfg_list.
Step4: Now a composition switch involving <ffs.b,ffs.a> is executed.
the composition switch will involve 3 things: 1. unlinking the previous functions existing 2. creating new symlinks 3. writing UDC
However, the composition switch is generally taken care by userspace process which creates the symlinks in its own nomenclature(X*) and removes only those. So it won't be able to remove Y1 which user had created by own.
Due to this the new symlinks cannot be created for ffs.a since the entry already exists in CFG->FUNC_LIST.
The state of the CFG->FUNC_LIST is as follows: CFG->FUNC_LIST: <ffs.a>
Fixes: 88af8bbe4ef7 ("usb: gadget: the start of the configfs interface") Signed-off-by: Krishna Kurapati PSSNV quic_kriskura@quicinc.com Signed-off-by: Udipto Goswami quic_ugoswami@quicinc.com Link: https://lore.kernel.org/r/20230201132308.31523-1-quic_ugoswami@quicinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/usb/gadget/configfs.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index 0853536cbf2e6..2ff34dc129c40 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -430,6 +430,12 @@ static int config_usb_cfg_link( * from another gadget or a random directory. * Also a function instance can only be linked once. */ + + if (gi->composite.gadget_driver.udc_name) { + ret = -EINVAL; + goto out; + } + list_for_each_entry(iter, &gi->available_func, cfs_list) { if (iter != fi) continue;
From: Chunfeng Yun chunfeng.yun@mediatek.com
[ Upstream commit 49094d928618309877c50e589f23e639a3b0c453 ]
Remove the temporary @mask_, this may cause build warning when use clang compiler for powerpc, but can't reproduce it when compile for arm64. the build warning is caused by:
"warning: result of comparison of constant 18446744073709551615 with expression of type (aka 'unsigned long') is always false [-Wtautological-constant-out-of-range-compare]"
More information provided in below lore link.
After removing @mask_, there is a "CHECK:MACRO_ARG_REUSE" when run checkpatch.pl, but due to @mask is constant, no reuse problem will happen.
Link: https://lore.kernel.org/lkml/202212160357.jJuesD8n-lkp@intel.com/t/ Fixes: 84513eccd678 ("phy: mediatek: fix build warning of FIELD_PREP()") Reported-by: kernel test robot lkp@intel.com Signed-off-by: Chunfeng Yun chunfeng.yun@mediatek.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Link: https://lore.kernel.org/r/20230118084343.26913-1-chunfeng.yun@mediatek.com Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/phy/mediatek/phy-mtk-io.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/mediatek/phy-mtk-io.h b/drivers/phy/mediatek/phy-mtk-io.h index d20ad5e5be814..58f06db822cb0 100644 --- a/drivers/phy/mediatek/phy-mtk-io.h +++ b/drivers/phy/mediatek/phy-mtk-io.h @@ -39,8 +39,8 @@ static inline void mtk_phy_update_bits(void __iomem *reg, u32 mask, u32 val) /* field @mask shall be constant and continuous */ #define mtk_phy_update_field(reg, mask, val) \ ({ \ - typeof(mask) mask_ = (mask); \ - mtk_phy_update_bits(reg, mask_, FIELD_PREP(mask_, val)); \ + BUILD_BUG_ON_MSG(!__builtin_constant_p(mask), "mask is not constant"); \ + mtk_phy_update_bits(reg, mask, FIELD_PREP(mask, val)); \ })
#endif
From: Sergio Paracuellos sergio.paracuellos@gmail.com
[ Upstream commit 0cb2a8f3456ff1cc51d571e287a48e8fddc98ec2 ]
Some devices like ZBT WE1326 and ZBT WF3526-P and some Netgear models need to delay phy port initialization after calling the mt7621_pcie_init_port() driver function to get into reliable boots for both warm and hard resets.
The delay required to detect the ports seems to be in the range [75-100] milliseconds.
If the ports are not detected the controller is not functional.
There is no datasheet or something similar to really understand why this extra delay is needed only for these devices and it is not for most of the boards that are built on mt7621 SoC.
This issue has been reported by openWRT community and the complete discussion is in [0]. The 100 milliseconds delay has been tested in all devices to validate it.
Add the extra 100 milliseconds delay to fix the issue.
[0]: https://github.com/openwrt/openwrt/pull/11220
Link: https://lore.kernel.org/r/20221231074041.264738-1-sergio.paracuellos@gmail.c... Fixes: 2bdd5238e756 ("PCI: mt7621: Add MediaTek MT7621 PCIe host controller driver") Signed-off-by: Sergio Paracuellos sergio.paracuellos@gmail.com Signed-off-by: Lorenzo Pieralisi lpieralisi@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pci/controller/pcie-mt7621.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/pci/controller/pcie-mt7621.c b/drivers/pci/controller/pcie-mt7621.c index ee7aad09d6277..63a5f4463a9f6 100644 --- a/drivers/pci/controller/pcie-mt7621.c +++ b/drivers/pci/controller/pcie-mt7621.c @@ -60,6 +60,7 @@ #define PCIE_PORT_LINKUP BIT(0) #define PCIE_PORT_CNT 3
+#define INIT_PORTS_DELAY_MS 100 #define PERST_DELAY_MS 100
/** @@ -369,6 +370,7 @@ static int mt7621_pcie_init_ports(struct mt7621_pcie *pcie) } }
+ msleep(INIT_PORTS_DELAY_MS); mt7621_pcie_reset_ep_deassert(pcie);
tmp = NULL;
From: Lu Baolu baolu.lu@linux.intel.com
[ Upstream commit e06d24435596c8afcaa81c0c498f5b0ec4ee2b7c ]
Setup No Execute Enable bit (Bit 133) of a scalable mode PASID entry. This is to allow the use of XD bit of the first level page table.
Fixes: ddf09b6d43ec ("iommu/vt-d: Setup pasid entries for iova over first level") Signed-off-by: Ashok Raj ashok.raj@intel.com Signed-off-by: Lu Baolu baolu.lu@linux.intel.com Reviewed-by: Kevin Tian kevin.tian@intel.com Link: https://lore.kernel.org/r/20230126095438.354205-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iommu/intel/pasid.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c index fb3c7020028d0..ec964ac7d7972 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -364,6 +364,16 @@ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value) pasid_set_bits(&pe->val[1], 1 << 23, value << 23); }
+/* + * Setup No Execute Enable bit (Bit 133) of a scalable mode PASID + * entry. It is required when XD bit of the first level page table + * entry is about to be set. + */ +static inline void pasid_set_nxe(struct pasid_entry *pe) +{ + pasid_set_bits(&pe->val[2], 1 << 5, 1 << 5); +} + /* * Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode * PASID entry. @@ -557,6 +567,7 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu, pasid_set_domain_id(pte, did); pasid_set_address_width(pte, iommu->agaw); pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap)); + pasid_set_nxe(pte);
/* Setup Present and PASID Granular Transfer Type: */ pasid_set_translation_type(pte, PASID_ENTRY_PGTT_FL_ONLY);
From: Andreas Kemnade andreas@kemnade.info
[ Upstream commit c85c191694cb1cf290b11059b3d2de8a2732ffd0 ]
The rn5t618 power driver fails to register a cooling device because POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX is missing but availability is not checked before registering cooling device. After improved error checking in the thermal code, the registration of the power supply fails entirely.
Checking for availability of _MAX before registering cooling device fixes the rn5t618 problem. But the whole logic feels questionable.
First, the logic is inverted here: the code tells: max_current = max_cooling but 0 = max_cooling, so there needs to be some inversion in the code which cannot be found. Comparing with other cooling devices, it can be found that value for fan speed is not inverted, value for cpufreq cooling is inverted (similar situation as here lowest frequency = max cooling)
Second, analyzing usage of _MAX: it is seems that maximum capabilities of charging controller are specified and not of the battery. Probably there is not too much mismatch in the drivers actually implementing that. So nothing has exploded yet. So there is no easy and safe way to specifify a max cooling value now.
Conclusion for now (as a regression fix) just remove the cooling device registration and do it properly later on.
Fixes: e49a1e1ee078 ("thermal/core: fix error code in __thermal_cooling_device_register()") Fixes: 952aeeb3ee28 ("power_supply: Register power supply for thermal cooling device") Signed-off-by: Andreas Kemnade andreas@kemnade.info Signed-off-by: Sebastian Reichel sebastian.reichel@collabora.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/power/supply/power_supply_core.c | 93 ------------------------ 1 file changed, 93 deletions(-)
diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c index 7c790c41e2fe3..cc5b2e22b42ac 100644 --- a/drivers/power/supply/power_supply_core.c +++ b/drivers/power/supply/power_supply_core.c @@ -1186,83 +1186,6 @@ static void psy_unregister_thermal(struct power_supply *psy) thermal_zone_device_unregister(psy->tzd); }
-/* thermal cooling device callbacks */ -static int ps_get_max_charge_cntl_limit(struct thermal_cooling_device *tcd, - unsigned long *state) -{ - struct power_supply *psy; - union power_supply_propval val; - int ret; - - psy = tcd->devdata; - ret = power_supply_get_property(psy, - POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val); - if (ret) - return ret; - - *state = val.intval; - - return ret; -} - -static int ps_get_cur_charge_cntl_limit(struct thermal_cooling_device *tcd, - unsigned long *state) -{ - struct power_supply *psy; - union power_supply_propval val; - int ret; - - psy = tcd->devdata; - ret = power_supply_get_property(psy, - POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val); - if (ret) - return ret; - - *state = val.intval; - - return ret; -} - -static int ps_set_cur_charge_cntl_limit(struct thermal_cooling_device *tcd, - unsigned long state) -{ - struct power_supply *psy; - union power_supply_propval val; - int ret; - - psy = tcd->devdata; - val.intval = state; - ret = psy->desc->set_property(psy, - POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val); - - return ret; -} - -static const struct thermal_cooling_device_ops psy_tcd_ops = { - .get_max_state = ps_get_max_charge_cntl_limit, - .get_cur_state = ps_get_cur_charge_cntl_limit, - .set_cur_state = ps_set_cur_charge_cntl_limit, -}; - -static int psy_register_cooler(struct power_supply *psy) -{ - /* Register for cooling device if psy can control charging */ - if (psy_has_property(psy->desc, POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT)) { - psy->tcd = thermal_cooling_device_register( - (char *)psy->desc->name, - psy, &psy_tcd_ops); - return PTR_ERR_OR_ZERO(psy->tcd); - } - - return 0; -} - -static void psy_unregister_cooler(struct power_supply *psy) -{ - if (IS_ERR_OR_NULL(psy->tcd)) - return; - thermal_cooling_device_unregister(psy->tcd); -} #else static int psy_register_thermal(struct power_supply *psy) { @@ -1272,15 +1195,6 @@ static int psy_register_thermal(struct power_supply *psy) static void psy_unregister_thermal(struct power_supply *psy) { } - -static int psy_register_cooler(struct power_supply *psy) -{ - return 0; -} - -static void psy_unregister_cooler(struct power_supply *psy) -{ -} #endif
static struct power_supply *__must_check @@ -1354,10 +1268,6 @@ __power_supply_register(struct device *parent, if (rc) goto register_thermal_failed;
- rc = psy_register_cooler(psy); - if (rc) - goto register_cooler_failed; - rc = power_supply_create_triggers(psy); if (rc) goto create_triggers_failed; @@ -1387,8 +1297,6 @@ __power_supply_register(struct device *parent, add_hwmon_sysfs_failed: power_supply_remove_triggers(psy); create_triggers_failed: - psy_unregister_cooler(psy); -register_cooler_failed: psy_unregister_thermal(psy); register_thermal_failed: wakeup_init_failed: @@ -1540,7 +1448,6 @@ void power_supply_unregister(struct power_supply *psy) sysfs_remove_link(&psy->dev.kobj, "powers"); power_supply_remove_hwmon_sysfs(psy); power_supply_remove_triggers(psy); - psy_unregister_cooler(psy); psy_unregister_thermal(psy); device_init_wakeup(&psy->dev, false); device_unregister(&psy->dev);
From: Bernard Metzler bmt@zurich.ibm.com
[ Upstream commit 65a8fc30fb6722fc25adec6d7dd5b53b0bb85820 ]
To avoid racing with other user memory reservations, immediately account full amount of pages to be pinned.
Fixes: 2251334dcac9 ("rdma/siw: application buffer management") Reported-by: Jason Gunthorpe jgg@nvidia.com Suggested-by: Alistair Popple apopple@nvidia.com Reviewed-by: Alistair Popple apopple@nvidia.com Signed-off-by: Bernard Metzler bmt@zurich.ibm.com Link: https://lore.kernel.org/r/20230202101000.402990-1-bmt@zurich.ibm.com Signed-off-by: Leon Romanovsky leon@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/siw/siw_mem.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c index b2b33dd3b4fa1..f51ab2ccf1511 100644 --- a/drivers/infiniband/sw/siw/siw_mem.c +++ b/drivers/infiniband/sw/siw/siw_mem.c @@ -398,7 +398,7 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable)
mlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
- if (num_pages + atomic64_read(&mm_s->pinned_vm) > mlock_limit) { + if (atomic64_add_return(num_pages, &mm_s->pinned_vm) > mlock_limit) { rv = -ENOMEM; goto out_sem_up; } @@ -411,30 +411,27 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) goto out_sem_up; } for (i = 0; num_pages; i++) { - int got, nents = min_t(int, num_pages, PAGES_PER_CHUNK); - - umem->page_chunk[i].plist = + int nents = min_t(int, num_pages, PAGES_PER_CHUNK); + struct page **plist = kcalloc(nents, sizeof(struct page *), GFP_KERNEL); - if (!umem->page_chunk[i].plist) { + + if (!plist) { rv = -ENOMEM; goto out_sem_up; } - got = 0; + umem->page_chunk[i].plist = plist; while (nents) { - struct page **plist = &umem->page_chunk[i].plist[got]; - rv = pin_user_pages(first_page_va, nents, foll_flags, plist, NULL); if (rv < 0) goto out_sem_up;
umem->num_pages += rv; - atomic64_add(rv, &mm_s->pinned_vm); first_page_va += rv * PAGE_SIZE; + plist += rv; nents -= rv; - got += rv; + num_pages -= rv; } - num_pages -= got; } out_sem_up: mmap_read_unlock(mm_s); @@ -442,6 +439,10 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) if (rv > 0) return umem;
+ /* Adjust accounting for pages not pinned */ + if (num_pages) + atomic64_sub(num_pages, &mm_s->pinned_vm); + siw_umem_release(umem, false);
return ERR_PTR(rv);
From: Nikita Zhandarovich n.zhandarovich@fintech.ru
[ Upstream commit 283861a4c52c1ea4df3dd1b6fc75a50796ce3524 ]
If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is dereferenced later regardless of whether it is empty. This patch adds a simple sanity check to fix the issue.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference") Signed-off-by: Nikita Zhandarovich n.zhandarovich@fintech.ru Link: https://lore.kernel.org/r/20230202184850.29882-1-n.zhandarovich@fintech.ru Signed-off-by: Leon Romanovsky leon@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/cxgb4/cm.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index ea3ddf0d24114..ced615b5ea096 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -2676,6 +2676,9 @@ static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb) u16 tcp_opt = ntohs(req->tcp_opt);
ep = get_ep_from_tid(dev, tid); + if (!ep) + return 0; + pr_debug("ep %p tid %u\n", ep, ep->hwtid); ep->snd_seq = be32_to_cpu(req->snd_isn); ep->rcv_seq = be32_to_cpu(req->rcv_isn);
From: Mark Tomlinson mark.tomlinson@alliedtelesis.co.nz
[ Upstream commit a7efe3fc7cbe27c6eb2c2a3ab612194f8f800f4c ]
To update the I/O pins, the registers are read/modified/written. The read operation incorrectly always read the first register. Although wrong, there wasn't any impact as all the output pins are always written, and the inputs are read only anyway.
Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.") Signed-off-by: Mark Tomlinson mark.tomlinson@alliedtelesis.co.nz Link: https://lore.kernel.org/r/20230207033337.18112-1-mark.tomlinson@alliedtelesi... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/usb/host/max3421-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c index 352e3ac2b377b..19111e83ac131 100644 --- a/drivers/usb/host/max3421-hcd.c +++ b/drivers/usb/host/max3421-hcd.c @@ -1436,7 +1436,7 @@ max3421_spi_thread(void *dev_id) * use spi_wr_buf(). */ for (i = 0; i < ARRAY_SIZE(max3421_hcd->iopins); ++i) { - u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1); + u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1 + i);
val = ((val & 0xf0) | (max3421_hcd->iopins[i] & 0x0f));
From: Mustafa Ismail mustafa.ismail@intel.com
[ Upstream commit 9cd9842c46996ef62173c36619c746f57416bcb0 ]
The irdma driver can use a maximum number of msix vectors equal to num_online_cpus() + 1 and the kernel warning stack below is shown if that number is exceeded.
The kernel throws a warning as the driver tries to update the affinity hint with a CPU mask greater than the max CPU IDs. Fix this by capping the MSIX vectors to num_online_cpus() + 1.
WARNING: CPU: 7 PID: 23655 at include/linux/cpumask.h:106 irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] RIP: 0010:irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] Call Trace: irdma_rt_init_hw+0xa62/0x1290 [irdma] ? irdma_alloc_local_mac_entry+0x1a0/0x1a0 [irdma] ? __is_kernel_percpu_address+0x63/0x310 ? rcu_read_lock_held_common+0xe/0xb0 ? irdma_lan_unregister_qset+0x280/0x280 [irdma] ? irdma_request_reset+0x80/0x80 [irdma] ? ice_get_qos_params+0x84/0x390 [ice] irdma_probe+0xa40/0xfc0 [irdma] ? rcu_read_lock_bh_held+0xd0/0xd0 ? irdma_remove+0x140/0x140 [irdma] ? rcu_read_lock_sched_held+0x62/0xe0 ? down_write+0x187/0x3d0 ? auxiliary_match_id+0xf0/0x1a0 ? irdma_remove+0x140/0x140 [irdma] auxiliary_bus_probe+0xa6/0x100 __driver_probe_device+0x4a4/0xd50 ? __device_attach_driver+0x2c0/0x2c0 driver_probe_device+0x4a/0x110 __driver_attach+0x1aa/0x350 bus_for_each_dev+0x11d/0x1b0 ? subsys_dev_iter_init+0xe0/0xe0 bus_add_driver+0x3b1/0x610 driver_register+0x18e/0x410 ? 0xffffffffc0b88000 irdma_init_module+0x50/0xaa [irdma] do_one_initcall+0x103/0x5f0 ? perf_trace_initcall_level+0x420/0x420 ? do_init_module+0x4e/0x700 ? __kasan_kmalloc+0x7d/0xa0 ? kmem_cache_alloc_trace+0x188/0x2b0 ? kasan_unpoison+0x21/0x50 do_init_module+0x1d1/0x700 load_module+0x3867/0x5260 ? layout_and_allocate+0x3990/0x3990 ? rcu_read_lock_held_common+0xe/0xb0 ? rcu_read_lock_sched_held+0x62/0xe0 ? rcu_read_lock_bh_held+0xd0/0xd0 ? __vmalloc_node_range+0x46b/0x890 ? lock_release+0x5c8/0xba0 ? alloc_vm_area+0x120/0x120 ? selinux_kernel_module_from_file+0x2a5/0x300 ? __inode_security_revalidate+0xf0/0xf0 ? __do_sys_init_module+0x1db/0x260 __do_sys_init_module+0x1db/0x260 ? load_module+0x5260/0x5260 ? do_syscall_64+0x22/0x450 do_syscall_64+0xa5/0x450 entry_SYSCALL_64_after_hwframe+0x66/0xdb
Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") Signed-off-by: Mustafa Ismail mustafa.ismail@intel.com Signed-off-by: Shiraz Saleem shiraz.saleem@intel.com Signed-off-by: Sindhu Devale sindhu.devale@intel.com Link: https://lore.kernel.org/r/20230207201938.1329-1-sindhu.devale@intel.com Signed-off-by: Leon Romanovsky leon@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/irdma/hw.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c index ab246447520bd..2e1e2bad04011 100644 --- a/drivers/infiniband/hw/irdma/hw.c +++ b/drivers/infiniband/hw/irdma/hw.c @@ -483,6 +483,8 @@ static int irdma_save_msix_info(struct irdma_pci_f *rf) iw_qvlist->num_vectors = rf->msix_count; if (rf->msix_count <= num_online_cpus()) rf->msix_shared = true; + else if (rf->msix_count > num_online_cpus() + 1) + rf->msix_count = num_online_cpus() + 1;
pmsix = rf->msix_entries; for (i = 0, ceq_idx = 0; i < rf->msix_count; i++, iw_qvinfo++) {
From: Shenwei Wang shenwei.wang@nxp.com
[ Upstream commit 3957b9501a5a8fa709ae4a47483714491471f6db ]
The previous 'commit 846651eca073 ("serial: fsl_lpuart: RS485 RTS polariy is inverse")' only fixed the inverse issue on lpuart 8bit platforms.
This is a follow-up patch to fix the RS485 polarity inverse issue on lpuart 32bit platforms.
Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") Reported-by: Sherry Sun sherry.sun@nxp.com Signed-off-by: Shenwei Wang shenwei.wang@nxp.com Link: https://lore.kernel.org/r/20230207162420.3647904-1-shenwei.wang@nxp.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/tty/serial/fsl_lpuart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index f34fabdc2bb7d..23910ac724b11 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -1387,9 +1387,9 @@ static int lpuart32_config_rs485(struct uart_port *port, struct ktermios *termio * Note: UART is assumed to be active high. */ if (rs485->flags & SER_RS485_RTS_ON_SEND) - modem &= ~UARTMODEM_TXRTSPOL; - else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) modem |= UARTMODEM_TXRTSPOL; + else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem &= ~UARTMODEM_TXRTSPOL; }
lpuart32_write(&sport->port, modem, UARTMODIR);
From: Peng Fan peng.fan@nxp.com
[ Upstream commit ef25e16ea9674b713a68c3bda821556ce9901254 ]
There maybe pending USR interrupt before requesting irq, however uart_add_one_port has not executed, so there will be kernel panic: [ 0.795668] Unable to handle kernel NULL pointer dereference at virtual addre ss 0000000000000080 [ 0.802701] Mem abort info: [ 0.805367] ESR = 0x0000000096000004 [ 0.808950] EC = 0x25: DABT (current EL), IL = 32 bits [ 0.814033] SET = 0, FnV = 0 [ 0.816950] EA = 0, S1PTW = 0 [ 0.819950] FSC = 0x04: level 0 translation fault [ 0.824617] Data abort info: [ 0.827367] ISV = 0, ISS = 0x00000004 [ 0.831033] CM = 0, WnR = 0 [ 0.833866] [0000000000000080] user address but active_mm is swapper [ 0.839951] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 0.845953] Modules linked in: [ 0.848869] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.1+g56321e101aca #1 [ 0.855617] Hardware name: Freescale i.MX8MP EVK (DT) [ 0.860452] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.867117] pc : __imx_uart_rxint.constprop.0+0x11c/0x2c0 [ 0.872283] lr : imx_uart_int+0xf8/0x1ec
The issue only happends in the inmate linux when Jailhouse hypervisor enabled. The test procedure is: while true; do jailhouse enable imx8mp.cell jailhouse cell linux xxxx sleep 10 jailhouse cell destroy 1 jailhouse disable sleep 5 done
And during the upper test, press keys to the 2nd linux console. When `jailhouse cell destroy 1`, the 2nd linux has no chance to put the uart to a quiese state, so USR1/2 may has pending interrupts. Then when `jailhosue cell linux xx` to start 2nd linux again, the issue trigger.
In order to disable irqs before requesting them, both UCR1 and UCR2 irqs should be disabled, so here fix that, disable the Ageing Timer interrupt in UCR2 as UCR1 does.
Fixes: 8a61f0c70ae6 ("serial: imx: Disable irqs before requesting them") Suggested-by: Sherry Sun sherry.sun@nxp.com Reviewed-by: Sherry Sun sherry.sun@nxp.com Signed-off-by: Peng Fan peng.fan@nxp.com Acked-by: Jason Liu jason.hui.liu@nxp.com Link: https://lore.kernel.org/r/20230206013016.29352-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/tty/serial/imx.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c index 757825edb0cd9..5f35343f81309 100644 --- a/drivers/tty/serial/imx.c +++ b/drivers/tty/serial/imx.c @@ -2374,6 +2374,11 @@ static int imx_uart_probe(struct platform_device *pdev) ucr1 &= ~(UCR1_ADEN | UCR1_TRDYEN | UCR1_IDEN | UCR1_RRDYEN | UCR1_RTSDEN); imx_uart_writel(sport, ucr1, UCR1);
+ /* Disable Ageing Timer interrupt */ + ucr2 = imx_uart_readl(sport, UCR2); + ucr2 &= ~UCR2_ATEN; + imx_uart_writel(sport, ucr2, UCR2); + /* * In case RS485 is enabled without GPIO RTS control, the UART IP * is used to control CTS signal. Keep both the UART and Receiver
From: Saravana Kannan saravanak@google.com
[ Upstream commit 67cad5c67019c38126b749621665b6723d3ae7e6 ]
fw_devlink uses DL_FLAG_SYNC_STATE_ONLY device link flag for two purposes:
1. To allow a parent device to proxy its child device's dependency on a supplier so that the supplier doesn't get its sync_state() callback before the child device/consumer can be added and probed. In this usage scenario, we need to ignore cycles for ensure correctness of sync_state() callbacks.
2. When there are dependency cycles in firmware, we don't know which of those dependencies are valid. So, we have to ignore them all wrt probe ordering while still making sure the sync_state() callbacks come correctly.
However, when detecting dependency cycles, there can be multiple dependency cycles between two devices that we need to detect. For example:
A -> B -> A and A -> C -> B -> A.
To detect multiple cycles correct, we need to be able to differentiate DL_FLAG_SYNC_STATE_ONLY device links used for (1) vs (2) above.
To allow this differentiation, add a DL_FLAG_CYCLE that can be use to mark use case (2). We can then use the DL_FLAG_CYCLE to decide which DL_FLAG_SYNC_STATE_ONLY device links to follow when looking for dependency cycles.
Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") Signed-off-by: Saravana Kannan saravanak@google.com Tested-by: Colin Foster colin.foster@in-advantage.com Tested-by: Sudeep Holla sudeep.holla@arm.com Tested-by: Douglas Anderson dianders@chromium.org Tested-by: Geert Uytterhoeven geert+renesas@glider.be Tested-by: Luca Weiss luca.weiss@fairphone.com # qcom/sm7225-fairphone-fp4 Link: https://lore.kernel.org/r/20230207014207.1678715-6-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 28 ++++++++++++++++++---------- include/linux/device.h | 1 + 2 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index 9fccf7b4e7ea3..609d1b04ee75a 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -272,6 +272,12 @@ static bool device_is_ancestor(struct device *dev, struct device *target) return false; }
+static inline bool device_link_flag_is_sync_state_only(u32 flags) +{ + return (flags & ~(DL_FLAG_INFERRED | DL_FLAG_CYCLE)) == + (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED); +} + /** * device_is_dependent - Check if one device depends on another one * @dev: Device to check dependencies for. @@ -298,8 +304,7 @@ int device_is_dependent(struct device *dev, void *target) return ret;
list_for_each_entry(link, &dev->links.consumers, s_node) { - if ((link->flags & ~DL_FLAG_INFERRED) == - (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) + if (device_link_flag_is_sync_state_only(link->flags)) continue;
if (link->consumer == target) @@ -372,8 +377,7 @@ static int device_reorder_to_tail(struct device *dev, void *not_used)
device_for_each_child(dev, NULL, device_reorder_to_tail); list_for_each_entry(link, &dev->links.consumers, s_node) { - if ((link->flags & ~DL_FLAG_INFERRED) == - (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) + if (device_link_flag_is_sync_state_only(link->flags)) continue; device_reorder_to_tail(link->consumer, NULL); } @@ -634,7 +638,8 @@ postcore_initcall(devlink_class_init); DL_FLAG_AUTOREMOVE_SUPPLIER | \ DL_FLAG_AUTOPROBE_CONSUMER | \ DL_FLAG_SYNC_STATE_ONLY | \ - DL_FLAG_INFERRED) + DL_FLAG_INFERRED | \ + DL_FLAG_CYCLE)
#define DL_ADD_VALID_FLAGS (DL_MANAGED_LINK_FLAGS | DL_FLAG_STATELESS | \ DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE) @@ -703,8 +708,6 @@ struct device_link *device_link_add(struct device *consumer, if (!consumer || !supplier || consumer == supplier || flags & ~DL_ADD_VALID_FLAGS || (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) || - (flags & DL_FLAG_SYNC_STATE_ONLY && - (flags & ~DL_FLAG_INFERRED) != DL_FLAG_SYNC_STATE_ONLY) || (flags & DL_FLAG_AUTOPROBE_CONSUMER && flags & (DL_FLAG_AUTOREMOVE_CONSUMER | DL_FLAG_AUTOREMOVE_SUPPLIER))) @@ -720,6 +723,10 @@ struct device_link *device_link_add(struct device *consumer, if (!(flags & DL_FLAG_STATELESS)) flags |= DL_FLAG_MANAGED;
+ if (flags & DL_FLAG_SYNC_STATE_ONLY && + !device_link_flag_is_sync_state_only(flags)) + return NULL; + device_links_write_lock(); device_pm_lock();
@@ -1672,7 +1679,7 @@ static void fw_devlink_relax_link(struct device_link *link) if (!(link->flags & DL_FLAG_INFERRED)) return;
- if (link->flags == (DL_FLAG_MANAGED | FW_DEVLINK_FLAGS_PERMISSIVE)) + if (device_link_flag_is_sync_state_only(link->flags)) return;
pm_runtime_drop_link(link); @@ -1796,8 +1803,8 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) return ret;
list_for_each_entry(link, &con->links.consumers, s_node) { - if ((link->flags & ~DL_FLAG_INFERRED) == - (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) + if (!(link->flags & DL_FLAG_CYCLE) && + device_link_flag_is_sync_state_only(link->flags)) continue;
if (!fw_devlink_relax_cycle(link->consumer, sup)) @@ -1806,6 +1813,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) ret = 1;
fw_devlink_relax_link(link); + link->flags |= DL_FLAG_CYCLE; } return ret; } diff --git a/include/linux/device.h b/include/linux/device.h index 44e3acae7b36e..f4d20655d2d7e 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -328,6 +328,7 @@ enum device_link_state { #define DL_FLAG_MANAGED BIT(6) #define DL_FLAG_SYNC_STATE_ONLY BIT(7) #define DL_FLAG_INFERRED BIT(8) +#define DL_FLAG_CYCLE BIT(9)
/** * enum dl_dev_state - Device driver presence tracking information.
From: Saravana Kannan saravanak@google.com
[ Upstream commit 3a2dbc510c437ca392516b0105bad8e7970e6614 ]
When a device X is bound successfully to a driver, if it has a child firmware node Y that doesn't have a struct device created by then, we delete fwnode links where the child firmware node Y is the supplier. We did this to avoid blocking the consumers of the child firmware node Y from deferring probe indefinitely.
While that a step in the right direction, it's better to make the consumers of the child firmware node Y to be consumers of the device X because device X is probably implementing whatever functionality is represented by child firmware node Y. By doing this, we capture the device dependencies more accurately and ensure better probe/suspend/resume ordering.
Signed-off-by: Saravana Kannan saravanak@google.com Tested-by: Colin Foster colin.foster@in-advantage.com Tested-by: Sudeep Holla sudeep.holla@arm.com Tested-by: Douglas Anderson dianders@chromium.org Tested-by: Geert Uytterhoeven geert+renesas@glider.be Tested-by: Luca Weiss luca.weiss@fairphone.com # qcom/sm7225-fairphone-fp4 Link: https://lore.kernel.org/r/20230207014207.1678715-2-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Stable-dep-of: 6a6dfdf8b3ff ("driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 97 ++++++++++++++++++++++++++++++++++++--------- 1 file changed, 79 insertions(+), 18 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index 609d1b04ee75a..b29c483e9ca7b 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -54,11 +54,12 @@ static LIST_HEAD(deferred_sync); static unsigned int defer_sync_state_count = 1; static DEFINE_MUTEX(fwnode_link_lock); static bool fw_devlink_is_permissive(void); +static void __fw_devlink_link_to_consumers(struct device *dev); static bool fw_devlink_drv_reg_done; static bool fw_devlink_best_effort;
/** - * fwnode_link_add - Create a link between two fwnode_handles. + * __fwnode_link_add - Create a link between two fwnode_handles. * @con: Consumer end of the link. * @sup: Supplier end of the link. * @@ -74,22 +75,18 @@ static bool fw_devlink_best_effort; * Attempts to create duplicate links between the same pair of fwnode handles * are ignored and there is no reference counting. */ -int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup) +static int __fwnode_link_add(struct fwnode_handle *con, + struct fwnode_handle *sup) { struct fwnode_link *link; - int ret = 0; - - mutex_lock(&fwnode_link_lock);
list_for_each_entry(link, &sup->consumers, s_hook) if (link->consumer == con) - goto out; + return 0;
link = kzalloc(sizeof(*link), GFP_KERNEL); - if (!link) { - ret = -ENOMEM; - goto out; - } + if (!link) + return -ENOMEM;
link->supplier = sup; INIT_LIST_HEAD(&link->s_hook); @@ -100,9 +97,17 @@ int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup) list_add(&link->c_hook, &con->suppliers); pr_debug("%pfwP Linked as a fwnode consumer to %pfwP\n", con, sup); -out: - mutex_unlock(&fwnode_link_lock);
+ return 0; +} + +int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup) +{ + int ret; + + mutex_lock(&fwnode_link_lock); + ret = __fwnode_link_add(con, sup); + mutex_unlock(&fwnode_link_lock); return ret; }
@@ -181,6 +186,51 @@ void fw_devlink_purge_absent_suppliers(struct fwnode_handle *fwnode) } EXPORT_SYMBOL_GPL(fw_devlink_purge_absent_suppliers);
+/** + * __fwnode_links_move_consumers - Move consumer from @from to @to fwnode_handle + * @from: move consumers away from this fwnode + * @to: move consumers to this fwnode + * + * Move all consumer links from @from fwnode to @to fwnode. + */ +static void __fwnode_links_move_consumers(struct fwnode_handle *from, + struct fwnode_handle *to) +{ + struct fwnode_link *link, *tmp; + + list_for_each_entry_safe(link, tmp, &from->consumers, s_hook) { + __fwnode_link_add(link->consumer, to); + __fwnode_link_del(link); + } +} + +/** + * __fw_devlink_pickup_dangling_consumers - Pick up dangling consumers + * @fwnode: fwnode from which to pick up dangling consumers + * @new_sup: fwnode of new supplier + * + * If the @fwnode has a corresponding struct device and the device supports + * probing (that is, added to a bus), then we want to let fw_devlink create + * MANAGED device links to this device, so leave @fwnode and its descendant's + * fwnode links alone. + * + * Otherwise, move its consumers to the new supplier @new_sup. + */ +static void __fw_devlink_pickup_dangling_consumers(struct fwnode_handle *fwnode, + struct fwnode_handle *new_sup) +{ + struct fwnode_handle *child; + + if (fwnode->dev && fwnode->dev->bus) + return; + + fwnode->flags |= FWNODE_FLAG_NOT_DEVICE; + __fwnode_links_move_consumers(fwnode, new_sup); + + fwnode_for_each_available_child_node(fwnode, child) + __fw_devlink_pickup_dangling_consumers(child, new_sup); +} + #ifdef CONFIG_SRCU static DEFINE_MUTEX(device_links_lock); DEFINE_STATIC_SRCU(device_links_srcu); @@ -1274,16 +1324,23 @@ void device_links_driver_bound(struct device *dev) * them. So, fw_devlink no longer needs to create device links to any * of the device's suppliers. * - * Also, if a child firmware node of this bound device is not added as - * a device by now, assume it is never going to be added and make sure - * other devices don't defer probe indefinitely by waiting for such a - * child device. + * Also, if a child firmware node of this bound device is not added as a + * device by now, assume it is never going to be added. Make this bound + * device the fallback supplier to the dangling consumers of the child + * firmware node because this bound device is probably implementing the + * child firmware node functionality and we don't want the dangling + * consumers to defer probe indefinitely waiting for a device for the + * child firmware node. */ if (dev->fwnode && dev->fwnode->dev == dev) { struct fwnode_handle *child; fwnode_links_purge_suppliers(dev->fwnode); + mutex_lock(&fwnode_link_lock); fwnode_for_each_available_child_node(dev->fwnode, child) - fw_devlink_purge_absent_suppliers(child); + __fw_devlink_pickup_dangling_consumers(child, + dev->fwnode); + __fw_devlink_link_to_consumers(dev); + mutex_unlock(&fwnode_link_lock); } device_remove_file(dev, &dev_attr_waiting_for_supplier);
@@ -1863,7 +1920,11 @@ static int fw_devlink_create_devlink(struct device *con, fwnode_is_ancestor_of(sup_handle, con->fwnode)) return -EINVAL;
- sup_dev = get_dev_from_fwnode(sup_handle); + if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE) + sup_dev = fwnode_get_next_parent_dev(sup_handle); + else + sup_dev = get_dev_from_fwnode(sup_handle); + if (sup_dev) { /* * If it's one of those drivers that don't actually bind to
From: Saravana Kannan saravanak@google.com
[ Upstream commit 6a6dfdf8b3ff337be5a447e9f4e71969f18370ad ]
To improve detection and handling of dependency cycles, we need to be able to mark fwnode links as being part of cycles. fwnode links marked as being part of a cycle should not block their consumers from probing.
Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") Signed-off-by: Saravana Kannan saravanak@google.com Tested-by: Colin Foster colin.foster@in-advantage.com Tested-by: Sudeep Holla sudeep.holla@arm.com Tested-by: Douglas Anderson dianders@chromium.org Tested-by: Geert Uytterhoeven geert+renesas@glider.be Tested-by: Luca Weiss luca.weiss@fairphone.com # qcom/sm7225-fairphone-fp4 Link: https://lore.kernel.org/r/20230207014207.1678715-7-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 50 +++++++++++++++++++++++++++++++++--------- include/linux/fwnode.h | 11 +++++++++- 2 files changed, 50 insertions(+), 11 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index b29c483e9ca7b..bd8ae74e5cdcb 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -76,13 +76,15 @@ static bool fw_devlink_best_effort; * are ignored and there is no reference counting. */ static int __fwnode_link_add(struct fwnode_handle *con, - struct fwnode_handle *sup) + struct fwnode_handle *sup, u8 flags) { struct fwnode_link *link;
list_for_each_entry(link, &sup->consumers, s_hook) - if (link->consumer == con) + if (link->consumer == con) { + link->flags |= flags; return 0; + }
link = kzalloc(sizeof(*link), GFP_KERNEL); if (!link) @@ -92,6 +94,7 @@ static int __fwnode_link_add(struct fwnode_handle *con, INIT_LIST_HEAD(&link->s_hook); link->consumer = con; INIT_LIST_HEAD(&link->c_hook); + link->flags = flags;
list_add(&link->s_hook, &sup->consumers); list_add(&link->c_hook, &con->suppliers); @@ -106,7 +109,7 @@ int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup) int ret;
mutex_lock(&fwnode_link_lock); - ret = __fwnode_link_add(con, sup); + ret = __fwnode_link_add(con, sup, 0); mutex_unlock(&fwnode_link_lock); return ret; } @@ -126,6 +129,19 @@ static void __fwnode_link_del(struct fwnode_link *link) kfree(link); }
+/** + * __fwnode_link_cycle - Mark a fwnode link as being part of a cycle. + * @link: the fwnode_link to be marked + * + * The fwnode_link_lock needs to be held when this function is called. + */ +static void __fwnode_link_cycle(struct fwnode_link *link) +{ + pr_debug("%pfwf: Relaxing link with %pfwf\n", + link->consumer, link->supplier); + link->flags |= FWLINK_FLAG_CYCLE; +} + /** * fwnode_links_purge_suppliers - Delete all supplier links of fwnode_handle. * @fwnode: fwnode whose supplier links need to be deleted @@ -199,7 +215,7 @@ static void __fwnode_links_move_consumers(struct fwnode_handle *from, struct fwnode_link *link, *tmp;
list_for_each_entry_safe(link, tmp, &from->consumers, s_hook) { - __fwnode_link_add(link->consumer, to); + __fwnode_link_add(link->consumer, to, link->flags); __fwnode_link_del(link); } } @@ -1041,6 +1057,21 @@ static bool dev_is_best_effort(struct device *dev) (dev->fwnode && (dev->fwnode->flags & FWNODE_FLAG_BEST_EFFORT)); }
+static struct fwnode_handle *fwnode_links_check_suppliers( + struct fwnode_handle *fwnode) +{ + struct fwnode_link *link; + + if (!fwnode || fw_devlink_is_permissive()) + return NULL; + + list_for_each_entry(link, &fwnode->suppliers, c_hook) + if (!(link->flags & FWLINK_FLAG_CYCLE)) + return link->supplier; + + return NULL; +} + /** * device_links_check_suppliers - Check presence of supplier drivers. * @dev: Consumer device. @@ -1068,11 +1099,8 @@ int device_links_check_suppliers(struct device *dev) * probe. */ mutex_lock(&fwnode_link_lock); - if (dev->fwnode && !list_empty(&dev->fwnode->suppliers) && - !fw_devlink_is_permissive()) { - sup_fw = list_first_entry(&dev->fwnode->suppliers, - struct fwnode_link, - c_hook)->supplier; + sup_fw = fwnode_links_check_suppliers(dev->fwnode); + if (sup_fw) { if (!dev_is_best_effort(dev)) { fwnode_ret = -EPROBE_DEFER; dev_err_probe(dev, -EPROBE_DEFER, @@ -1261,7 +1289,9 @@ static ssize_t waiting_for_supplier_show(struct device *dev, bool val;
device_lock(dev); - val = !list_empty(&dev->fwnode->suppliers); + mutex_lock(&fwnode_link_lock); + val = !!fwnode_links_check_suppliers(dev->fwnode); + mutex_unlock(&fwnode_link_lock); device_unlock(dev); return sysfs_emit(buf, "%u\n", val); } diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h index 89b9bdfca925c..fdf2ee0285b7a 100644 --- a/include/linux/fwnode.h +++ b/include/linux/fwnode.h @@ -18,7 +18,7 @@ struct fwnode_operations; struct device;
/* - * fwnode link flags + * fwnode flags * * LINKS_ADDED: The fwnode has already be parsed to add fwnode links. * NOT_DEVICE: The fwnode will never be populated as a struct device. @@ -36,6 +36,7 @@ struct device; #define FWNODE_FLAG_INITIALIZED BIT(2) #define FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD BIT(3) #define FWNODE_FLAG_BEST_EFFORT BIT(4) +#define FWNODE_FLAG_VISITED BIT(5)
struct fwnode_handle { struct fwnode_handle *secondary; @@ -46,11 +47,19 @@ struct fwnode_handle { u8 flags; };
+/* + * fwnode link flags + * + * CYCLE: The fwnode link is part of a cycle. Don't defer probe. + */ +#define FWLINK_FLAG_CYCLE BIT(0) + struct fwnode_link { struct fwnode_handle *supplier; struct list_head s_hook; struct fwnode_handle *consumer; struct list_head c_hook; + u8 flags; };
/**
From: Saravana Kannan saravanak@google.com
[ Upstream commit cd115c0409f283edde94bd5a9a42dc42bee0aba8 ]
Consolidate the code that computes the flags to be used when creating a device link from a fwnode link.
Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") Signed-off-by: Saravana Kannan saravanak@google.com Tested-by: Colin Foster colin.foster@in-advantage.com Tested-by: Sudeep Holla sudeep.holla@arm.com Tested-by: Douglas Anderson dianders@chromium.org Tested-by: Geert Uytterhoeven geert+renesas@glider.be Tested-by: Luca Weiss luca.weiss@fairphone.com # qcom/sm7225-fairphone-fp4 Link: https://lore.kernel.org/r/20230207014207.1678715-8-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 28 +++++++++++++++------------- include/linux/fwnode.h | 1 - 2 files changed, 15 insertions(+), 14 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index bd8ae74e5cdcb..05c3e9a09b323 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -1727,8 +1727,11 @@ static int __init fw_devlink_strict_setup(char *arg) } early_param("fw_devlink.strict", fw_devlink_strict_setup);
-u32 fw_devlink_get_flags(void) +static inline u32 fw_devlink_get_flags(u8 fwlink_flags) { + if (fwlink_flags & FWLINK_FLAG_CYCLE) + return FW_DEVLINK_FLAGS_PERMISSIVE | DL_FLAG_CYCLE; + return fw_devlink_flags; }
@@ -1909,7 +1912,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) * fw_devlink_create_devlink - Create a device link from a consumer to fwnode * @con: consumer device for the device link * @sup_handle: fwnode handle of supplier - * @flags: devlink flags + * @link: fwnode link that's being converted to a device link * * This function will try to create a device link between the consumer device * @con and the supplier device represented by @sup_handle. @@ -1926,10 +1929,17 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) * possible to do that in the future */ static int fw_devlink_create_devlink(struct device *con, - struct fwnode_handle *sup_handle, u32 flags) + struct fwnode_handle *sup_handle, + struct fwnode_link *link) { struct device *sup_dev; int ret = 0; + u32 flags; + + if (con->fwnode == link->consumer) + flags = fw_devlink_get_flags(link->flags); + else + flags = FW_DEVLINK_FLAGS_PERMISSIVE;
/* * In some cases, a device P might also be a supplier to its child node @@ -2055,7 +2065,6 @@ static void __fw_devlink_link_to_consumers(struct device *dev) struct fwnode_link *link, *tmp;
list_for_each_entry_safe(link, tmp, &fwnode->consumers, s_hook) { - u32 dl_flags = fw_devlink_get_flags(); struct device *con_dev; bool own_link = true; int ret; @@ -2085,14 +2094,13 @@ static void __fw_devlink_link_to_consumers(struct device *dev) con_dev = NULL; } else { own_link = false; - dl_flags = FW_DEVLINK_FLAGS_PERMISSIVE; } }
if (!con_dev) continue;
- ret = fw_devlink_create_devlink(con_dev, fwnode, dl_flags); + ret = fw_devlink_create_devlink(con_dev, fwnode, link); put_device(con_dev); if (!own_link || ret == -EAGAIN) continue; @@ -2133,19 +2141,13 @@ static void __fw_devlink_link_to_suppliers(struct device *dev, bool own_link = (dev->fwnode == fwnode); struct fwnode_link *link, *tmp; struct fwnode_handle *child = NULL; - u32 dl_flags; - - if (own_link) - dl_flags = fw_devlink_get_flags(); - else - dl_flags = FW_DEVLINK_FLAGS_PERMISSIVE;
list_for_each_entry_safe(link, tmp, &fwnode->suppliers, c_hook) { int ret; struct device *sup_dev; struct fwnode_handle *sup = link->supplier;
- ret = fw_devlink_create_devlink(dev, sup, dl_flags); + ret = fw_devlink_create_devlink(dev, sup, link); if (!own_link || ret == -EAGAIN) continue;
diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h index fdf2ee0285b7a..5700451b300fb 100644 --- a/include/linux/fwnode.h +++ b/include/linux/fwnode.h @@ -207,7 +207,6 @@ static inline void fwnode_dev_initialized(struct fwnode_handle *fwnode, fwnode->flags &= ~FWNODE_FLAG_INITIALIZED; }
-extern u32 fw_devlink_get_flags(void); extern bool fw_devlink_is_strict(void); int fwnode_link_add(struct fwnode_handle *con, struct fwnode_handle *sup); void fwnode_links_purge(struct fwnode_handle *fwnode);
From: Saravana Kannan saravanak@google.com
[ Upstream commit 411c0d58ca6faa9bc4b9f5382118a31c7bb92a6f ]
fw_devlink shouldn't defer the probe of a device to wait on a supplier that'll never have a struct device or will never be probed by a driver. We currently check if a supplier falls into this category, but don't check its ancestors. We need to check the ancestors too because if the ancestor will never probe, then the supplier will never probe either.
Signed-off-by: Saravana Kannan saravanak@google.com Tested-by: Colin Foster colin.foster@in-advantage.com Tested-by: Sudeep Holla sudeep.holla@arm.com Tested-by: Douglas Anderson dianders@chromium.org Tested-by: Geert Uytterhoeven geert+renesas@glider.be Tested-by: Luca Weiss luca.weiss@fairphone.com # qcom/sm7225-fairphone-fp4 Link: https://lore.kernel.org/r/20230207014207.1678715-3-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Stable-dep-of: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 40 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index 05c3e9a09b323..8f32e2cbcc63a 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -1908,6 +1908,35 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) return ret; }
+static bool fwnode_init_without_drv(struct fwnode_handle *fwnode) +{ + struct device *dev; + bool ret; + + if (!(fwnode->flags & FWNODE_FLAG_INITIALIZED)) + return false; + + dev = get_dev_from_fwnode(fwnode); + ret = !dev || dev->links.status == DL_DEV_NO_DRIVER; + put_device(dev); + + return ret; +} + +static bool fwnode_ancestor_init_without_drv(struct fwnode_handle *fwnode) +{ + struct fwnode_handle *parent; + + fwnode_for_each_parent_node(fwnode, parent) { + if (fwnode_init_without_drv(parent)) { + fwnode_handle_put(parent); + return true; + } + } + + return false; +} + /** * fw_devlink_create_devlink - Create a device link from a consumer to fwnode * @con: consumer device for the device link @@ -1996,9 +2025,16 @@ static int fw_devlink_create_devlink(struct device *con, goto out; }
- /* Supplier that's already initialized without a struct device. */ - if (sup_handle->flags & FWNODE_FLAG_INITIALIZED) + /* + * Supplier or supplier's ancestor already initialized without a struct + * device or being probed by a driver. + */ + if (fwnode_init_without_drv(sup_handle) || + fwnode_ancestor_init_without_drv(sup_handle)) { + dev_dbg(con, "Not linking %pfwP - Might never probe\n", + sup_handle); return -EINVAL; + }
/* * DL_FLAG_SYNC_STATE_ONLY doesn't block probing and supports
From: Saravana Kannan saravanak@google.com
[ Upstream commit 3fb16866b51ded6c016b664caad53f8d4fd9dc56 ]
fw_devlink could only detect a single and simple cycle because it relied mainly on device link cycle detection code that only checked for cycles between devices. The expectation was that the firmware wouldn't have complicated cycles and multiple cycles between devices. That expectation has been proven to be wrong.
For example, fw_devlink could handle:
+-+ +-+ |A+------> |B+ +-+ +++ ^ | | | +----------+
But it couldn't handle even something as "simple" as:
+---------------------+ | | v | +-+ +-+ +++ |A+------> |B+------> |C| +-+ +++ +-+ ^ | | | +----------+
But firmware has even more complicated cycles like:
+---------------------+ | | v | +-+ +---+ +++ +--+A+------>| B +-----> |C|<--+ | +-+ ++--+ +++ | | ^ | ^ | | | | | | | | | +---------+ +---------+ | | | +------------------------------+
And this is without including parent child dependencies or nodes in the cycle that are just firmware nodes that'll never have a struct device created for them.
The proper way to treat these devices it to not force any probe ordering between them, while still enforce dependencies between node in the cycles (A, B and C) and their consumers.
So this patch goes all out and just deals with all types of cycles. It does this by:
1. Following dependencies across device links, parent-child and fwnode links. 2. When it find cycles, it mark the device links and fwnode links as such instead of just deleting them or making the indistinguishable from proxy SYNC_STATE_ONLY device links.
This way, when new nodes get added, we can immediately find and mark any new cycles whether the new node is a device or firmware node.
Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") Signed-off-by: Saravana Kannan saravanak@google.com Tested-by: Colin Foster colin.foster@in-advantage.com Tested-by: Sudeep Holla sudeep.holla@arm.com Tested-by: Douglas Anderson dianders@chromium.org Tested-by: Geert Uytterhoeven geert+renesas@glider.be Tested-by: Luca Weiss luca.weiss@fairphone.com # qcom/sm7225-fairphone-fp4 Link: https://lore.kernel.org/r/20230207014207.1678715-9-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 248 +++++++++++++++++++++++--------------------- 1 file changed, 129 insertions(+), 119 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index 8f32e2cbcc63a..126b10c8e0ce9 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -1866,47 +1866,6 @@ static void fw_devlink_unblock_consumers(struct device *dev) device_links_write_unlock(); }
-/** - * fw_devlink_relax_cycle - Convert cyclic links to SYNC_STATE_ONLY links - * @con: Device to check dependencies for. - * @sup: Device to check against. - * - * Check if @sup depends on @con or any device dependent on it (its child or - * its consumer etc). When such a cyclic dependency is found, convert all - * device links created solely by fw_devlink into SYNC_STATE_ONLY device links. - * This is the equivalent of doing fw_devlink=permissive just between the - * devices in the cycle. We need to do this because, at this point, fw_devlink - * can't tell which of these dependencies is not a real dependency. - * - * Return 1 if a cycle is found. Otherwise, return 0. - */ -static int fw_devlink_relax_cycle(struct device *con, void *sup) -{ - struct device_link *link; - int ret; - - if (con == sup) - return 1; - - ret = device_for_each_child(con, sup, fw_devlink_relax_cycle); - if (ret) - return ret; - - list_for_each_entry(link, &con->links.consumers, s_node) { - if (!(link->flags & DL_FLAG_CYCLE) && - device_link_flag_is_sync_state_only(link->flags)) - continue; - - if (!fw_devlink_relax_cycle(link->consumer, sup)) - continue; - - ret = 1; - - fw_devlink_relax_link(link); - link->flags |= DL_FLAG_CYCLE; - } - return ret; -}
static bool fwnode_init_without_drv(struct fwnode_handle *fwnode) { @@ -1937,6 +1896,111 @@ static bool fwnode_ancestor_init_without_drv(struct fwnode_handle *fwnode) return false; }
+/** + * __fw_devlink_relax_cycles - Relax and mark dependency cycles. + * @con: Potential consumer device. + * @sup_handle: Potential supplier's fwnode. + * + * Needs to be called with fwnode_lock and device link lock held. + * + * Check if @sup_handle or any of its ancestors or suppliers direct/indirectly + * depend on @con. This function can detect multiple cyles between @sup_handle + * and @con. When such dependency cycles are found, convert all device links + * created solely by fw_devlink into SYNC_STATE_ONLY device links. Also, mark + * all fwnode links in the cycle with FWLINK_FLAG_CYCLE so that when they are + * converted into a device link in the future, they are created as + * SYNC_STATE_ONLY device links. This is the equivalent of doing + * fw_devlink=permissive just between the devices in the cycle. We need to do + * this because, at this point, fw_devlink can't tell which of these + * dependencies is not a real dependency. + * + * Return true if one or more cycles were found. Otherwise, return false. + */ +static bool __fw_devlink_relax_cycles(struct device *con, + struct fwnode_handle *sup_handle) +{ + struct device *sup_dev = NULL, *par_dev = NULL; + struct fwnode_link *link; + struct device_link *dev_link; + bool ret = false; + + if (!sup_handle) + return false; + + /* + * We aren't trying to find all cycles. Just a cycle between con and + * sup_handle. + */ + if (sup_handle->flags & FWNODE_FLAG_VISITED) + return false; + + sup_handle->flags |= FWNODE_FLAG_VISITED; + + sup_dev = get_dev_from_fwnode(sup_handle); + + /* Termination condition. */ + if (sup_dev == con) { + ret = true; + goto out; + } + + /* + * If sup_dev is bound to a driver and @con hasn't started binding to a + * driver, sup_dev can't be a consumer of @con. So, no need to check + * further. + */ + if (sup_dev && sup_dev->links.status == DL_DEV_DRIVER_BOUND && + con->links.status == DL_DEV_NO_DRIVER) { + ret = false; + goto out; + } + + list_for_each_entry(link, &sup_handle->suppliers, c_hook) { + if (__fw_devlink_relax_cycles(con, link->supplier)) { + __fwnode_link_cycle(link); + ret = true; + } + } + + /* + * Give priority to device parent over fwnode parent to account for any + * quirks in how fwnodes are converted to devices. + */ + if (sup_dev) + par_dev = get_device(sup_dev->parent); + else + par_dev = fwnode_get_next_parent_dev(sup_handle); + + if (par_dev && __fw_devlink_relax_cycles(con, par_dev->fwnode)) + ret = true; + + if (!sup_dev) + goto out; + + list_for_each_entry(dev_link, &sup_dev->links.suppliers, c_node) { + /* + * Ignore a SYNC_STATE_ONLY flag only if it wasn't marked as + * such due to a cycle. + */ + if (device_link_flag_is_sync_state_only(dev_link->flags) && + !(dev_link->flags & DL_FLAG_CYCLE)) + continue; + + if (__fw_devlink_relax_cycles(con, + dev_link->supplier->fwnode)) { + fw_devlink_relax_link(dev_link); + dev_link->flags |= DL_FLAG_CYCLE; + ret = true; + } + } + +out: + sup_handle->flags &= ~FWNODE_FLAG_VISITED; + put_device(sup_dev); + put_device(par_dev); + return ret; +} + /** * fw_devlink_create_devlink - Create a device link from a consumer to fwnode * @con: consumer device for the device link @@ -1989,6 +2053,21 @@ static int fw_devlink_create_devlink(struct device *con, fwnode_is_ancestor_of(sup_handle, con->fwnode)) return -EINVAL;
+ /* + * SYNC_STATE_ONLY device links don't block probing and supports cycles. + * So cycle detection isn't necessary and shouldn't be done. + */ + if (!(flags & DL_FLAG_SYNC_STATE_ONLY)) { + device_links_write_lock(); + if (__fw_devlink_relax_cycles(con, sup_handle)) { + __fwnode_link_cycle(link); + flags = fw_devlink_get_flags(link->flags); + dev_info(con, "Fixed dependency cycle(s) with %pfwf\n", + sup_handle); + } + device_links_write_unlock(); + } + if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE) sup_dev = fwnode_get_next_parent_dev(sup_handle); else @@ -2002,23 +2081,16 @@ static int fw_devlink_create_devlink(struct device *con, */ if (sup_dev->links.status == DL_DEV_NO_DRIVER && sup_handle->flags & FWNODE_FLAG_INITIALIZED) { + dev_dbg(con, + "Not linking %pfwf - dev might never probe\n", + sup_handle); ret = -EINVAL; goto out; }
- /* - * If this fails, it is due to cycles in device links. Just - * give up on this link and treat it as invalid. - */ - if (!device_link_add(con, sup_dev, flags) && - !(flags & DL_FLAG_SYNC_STATE_ONLY)) { - dev_info(con, "Fixing up cyclic dependency with %s\n", - dev_name(sup_dev)); - device_links_write_lock(); - fw_devlink_relax_cycle(con, sup_dev); - device_links_write_unlock(); - device_link_add(con, sup_dev, - FW_DEVLINK_FLAGS_PERMISSIVE); + if (!device_link_add(con, sup_dev, flags)) { + dev_err(con, "Failed to create device link with %s\n", + dev_name(sup_dev)); ret = -EINVAL; }
@@ -2031,49 +2103,12 @@ static int fw_devlink_create_devlink(struct device *con, */ if (fwnode_init_without_drv(sup_handle) || fwnode_ancestor_init_without_drv(sup_handle)) { - dev_dbg(con, "Not linking %pfwP - Might never probe\n", + dev_dbg(con, "Not linking %pfwf - might never become dev\n", sup_handle); return -EINVAL; }
- /* - * DL_FLAG_SYNC_STATE_ONLY doesn't block probing and supports - * cycles. So cycle detection isn't necessary and shouldn't be - * done. - */ - if (flags & DL_FLAG_SYNC_STATE_ONLY) - return -EAGAIN; - - /* - * If we can't find the supplier device from its fwnode, it might be - * due to a cyclic dependency between fwnodes. Some of these cycles can - * be broken by applying logic. Check for these types of cycles and - * break them so that devices in the cycle probe properly. - * - * If the supplier's parent is dependent on the consumer, then the - * consumer and supplier have a cyclic dependency. Since fw_devlink - * can't tell which of the inferred dependencies are incorrect, don't - * enforce probe ordering between any of the devices in this cyclic - * dependency. Do this by relaxing all the fw_devlink device links in - * this cycle and by treating the fwnode link between the consumer and - * the supplier as an invalid dependency. - */ - sup_dev = fwnode_get_next_parent_dev(sup_handle); - if (sup_dev && device_is_dependent(con, sup_dev)) { - dev_info(con, "Fixing up cyclic dependency with %pfwP (%s)\n", - sup_handle, dev_name(sup_dev)); - device_links_write_lock(); - fw_devlink_relax_cycle(con, sup_dev); - device_links_write_unlock(); - ret = -EINVAL; - } else { - /* - * Can't check for cycles or no cycles. So let's try - * again later. - */ - ret = -EAGAIN; - } - + ret = -EAGAIN; out: put_device(sup_dev); return ret; @@ -2156,10 +2191,7 @@ static void __fw_devlink_link_to_consumers(struct device *dev) * * The function creates normal (non-SYNC_STATE_ONLY) device links between @dev * and the real suppliers of @dev. Once these device links are created, the - * fwnode links are deleted. When such device links are successfully created, - * this function is called recursively on those supplier devices. This is - * needed to detect and break some invalid cycles in fwnode links. See - * fw_devlink_create_devlink() for more details. + * fwnode links are deleted. * * In addition, it also looks at all the suppliers of the entire fwnode tree * because some of the child devices of @dev that have not been added yet @@ -2180,7 +2212,6 @@ static void __fw_devlink_link_to_suppliers(struct device *dev,
list_for_each_entry_safe(link, tmp, &fwnode->suppliers, c_hook) { int ret; - struct device *sup_dev; struct fwnode_handle *sup = link->supplier;
ret = fw_devlink_create_devlink(dev, sup, link); @@ -2188,27 +2219,6 @@ static void __fw_devlink_link_to_suppliers(struct device *dev, continue;
__fwnode_link_del(link); - - /* If no device link was created, nothing more to do. */ - if (ret) - continue; - - /* - * If a device link was successfully created to a supplier, we - * now need to try and link the supplier to all its suppliers. - * - * This is needed to detect and delete false dependencies in - * fwnode links that haven't been converted to a device link - * yet. See comments in fw_devlink_create_devlink() for more - * details on the false dependency. - * - * Without deleting these false dependencies, some devices will - * never probe because they'll keep waiting for their false - * dependency fwnode links to be converted to device links. - */ - sup_dev = get_dev_from_fwnode(sup); - __fw_devlink_link_to_suppliers(sup_dev, sup_dev->fwnode); - put_device(sup_dev); }
/*
From: Saravana Kannan saravanak@google.com
[ Upstream commit fb42378dcc7f247df56f0ecddfdae85487495fbc ]
These "nvmem-cells" platform devices never get probed because there's no platform driver for it and it's never used anywhere else. So it's a waste of memory. These devices also cause fw_devlink to block nvmem consumers of "nvmem-cells" partition from probing because the supplier device never probes.
So stop creating platform devices for nvmem-cells partitions to avoid wasting memory and to avoid blocking probing of consumers.
Reported-by: Maxim Kiselev bigunclemax@gmail.com Fixes: bcdf0315a61a ("mtd: call of_platform_populate() for MTD partitions") Signed-off-by: Saravana Kannan saravanak@google.com Tested-by: Maksim Kiselev bigunclemax@gmail.com Tested-by: Douglas Anderson dianders@chromium.org Tested-by: Geert Uytterhoeven geert+renesas@glider.be Tested-by: Luca Weiss luca.weiss@fairphone.com # qcom/sm7225-fairphone-fp4 Link: https://lore.kernel.org/r/20230207014207.1678715-13-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/mtd/mtdpart.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c index d442fa94c8720..85f5ee6f06fc6 100644 --- a/drivers/mtd/mtdpart.c +++ b/drivers/mtd/mtdpart.c @@ -577,6 +577,7 @@ static int mtd_part_of_parse(struct mtd_info *master, { struct mtd_part_parser *parser; struct device_node *np; + struct device_node *child; struct property *prop; struct device *dev; const char *compat; @@ -594,6 +595,15 @@ static int mtd_part_of_parse(struct mtd_info *master, else np = of_get_child_by_name(np, "partitions");
+ /* + * Don't create devices that are added to a bus but will never get + * probed. That'll cause fw_devlink to block probing of consumers of + * this partition until the partition device is probed. + */ + for_each_child_of_node(np, child) + if (of_device_is_compatible(child, "nvmem-cells")) + of_node_set_flag(child, OF_POPULATED); + of_property_for_each_string(np, "compatible", prop, compat) { parser = mtd_part_get_compatible_parser(compat); if (!parser)
From: Alexander Stein alexander.stein@ew.tq-group.com
[ Upstream commit e2ffae3ed92a9f768902c1cf82642c3a09cd0345 ]
This sets both of_node fields and takes a of_node reference as well.
Fixes: bb160ee61c04 ("drivers/usb/host/ehci-fsl: Fix interrupt setup in host mode.") Signed-off-by: Alexander Stein alexander.stein@ew.tq-group.com Reviewed-by: Rob Herring robh@kernel.org Link: https://lore.kernel.org/r/20230207110531.1060252-4-alexander.stein@ew.tq-gro... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/usb/host/fsl-mph-dr-of.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c index e5df175228928..46c6a152b8655 100644 --- a/drivers/usb/host/fsl-mph-dr-of.c +++ b/drivers/usb/host/fsl-mph-dr-of.c @@ -112,8 +112,7 @@ static struct platform_device *fsl_usb2_device_register( goto error; }
- pdev->dev.of_node = ofdev->dev.of_node; - pdev->dev.of_node_reused = true; + device_set_of_node_from_dev(&pdev->dev, &ofdev->dev);
retval = platform_device_add(pdev); if (retval)
From: Serge Semin Sergey.Semin@baikalelectronics.ru
[ Upstream commit 5fdca4a995bcd4cf61bda40af154a730589dc524 ]
Previously, readq_ch() did a 64-bit readq(), but truncated the result by storing it in the u32 "value". Change "value" to u64 to avoid the truncation.
Note: the method is currently unused, so the bug hasn't caused any problem so far.
Fixes: 04e0a39fc10f ("dmaengine: dw-edma: Add writeq() and readq() for 64 bits architectures") Signed-off-by: Serge Semin Sergey.Semin@baikalelectronics.ru Signed-off-by: Bjorn Helgaas bhelgaas@google.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/dma/dw-edma/dw-edma-v0-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c index 77e6cfe52e0a3..a3816ba632851 100644 --- a/drivers/dma/dw-edma/dw-edma-v0-core.c +++ b/drivers/dma/dw-edma/dw-edma-v0-core.c @@ -192,7 +192,7 @@ static inline void writeq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch, static inline u64 readq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch, const void __iomem *addr) { - u32 value; + u64 value;
if (dw->chip->mf == EDMA_MF_EDMA_LEGACY) { u32 viewport_sel;
From: Geert Uytterhoeven geert+renesas@glider.be
[ Upstream commit 9d8ba74a181b1c81def21168795ed96cbe6f05ed ]
On r8a7791/koelsch:
kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xc3a34e00 (size 64): comm "swapper/0", pid 1, jiffies 4294937460 (age 199.080s) hex dump (first 32 bytes): b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...].......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<fe3aa979>] __kmalloc+0xf0/0x140 [<34bd6bc0>] resource_list_create_entry+0x18/0x38 [<767046bc>] pci_add_resource_offset+0x20/0x68 [<b3f3edf2>] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390
When coalescing two resources for a contiguous aperture, the second resource is enlarged to cover the full contiguous range, while the first resource is marked invalid. This invalidation is done by clearing the flags, start, and end members.
When adding the initial resources to the bus later, invalid resources are skipped. Unfortunately, the check for an invalid resource considers only the end member, causing false positives.
E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no longer registered with pci_bus_insert_busn_res() (causing the memory leak), nor printed:
pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges: pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000 pci-rcar-gen2 ee090000.pci: PCI: revision 11 pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00 -pci_bus 0000:00: root bus resource [bus 00] pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff]
Fix this by only skipping resources where all of the flags, start, and end members are zero.
Fixes: 7c3855c423b17f6c ("PCI: Coalesce host bridge contiguous apertures") Link: https://lore.kernel.org/r/da0fcd5e86c74239be79c7cb03651c0fce31b515.167603667... Tested-by: Niklas Schnelle schnelle@linux.ibm.com Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Signed-off-by: Bjorn Helgaas bhelgaas@google.com Acked-by: Kai-Heng Feng kai.heng.feng@canonical.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pci/probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index 1779582fb5007..5988584825482 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -996,7 +996,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge) resource_list_for_each_entry_safe(window, n, &resources) { offset = window->offset; res = window->res; - if (!res->end) + if (!res->flags && !res->start && !res->end) continue;
list_move_tail(&window->node, &bridge->windows);
From: Neill Kapron nkapron@google.com
[ Upstream commit 4ca651df07183e29cdad7272255e23aec0169a1b ]
The existing logic in tcphy_get_mode() can cause the phy to be incorrectly configured to USB UFP or DisplayPort mode when extcon_get_state returns an error code.
extcon_get_state() can return 0, 1, or a negative error code.
It is possible to get into the failing state with an extcon driver which does not support the extcon connector id specified as the second argument to extcon_get_state().
tcphy_get_mode() ->extcon_get_state() -->find_cable_index_by_id() --->return -EINVAL;
Fixes: e96be45cb84e ("phy: Add USB Type-C PHY driver for rk3399") Signed-off-by: Neill Kapron nkapron@google.com Reviewed-by: Lee Jones lee@kernel.org Link: https://lore.kernel.org/r/20230126001013.3707873-1-nkapron@google.com Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/phy/rockchip/phy-rockchip-typec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c index d76440ae10ff4..6aea512e5d4ee 100644 --- a/drivers/phy/rockchip/phy-rockchip-typec.c +++ b/drivers/phy/rockchip/phy-rockchip-typec.c @@ -821,10 +821,10 @@ static int tcphy_get_mode(struct rockchip_typec_phy *tcphy) mode = MODE_DFP_USB; id = EXTCON_USB_HOST;
- if (ufp) { + if (ufp > 0) { mode = MODE_UFP_USB; id = EXTCON_USB; - } else if (dp) { + } else if (dp > 0) { mode = MODE_DFP_DP; id = EXTCON_DISP_DP;
From: Johan Hovold johan+linaro@kernel.org
[ Upstream commit 997e010de9134474dbfde52be03efd7d1bce902d ]
Implement the new host_deinit() callback so that the PHY is powered off and regulators and clocks are disabled also on late host-init errors.
Link: https://lore.kernel.org/r/20221017114705.8277-2-johan+linaro@kernel.org Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver") Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Lorenzo Pieralisi lpieralisi@kernel.org Signed-off-by: Bjorn Helgaas bhelgaas@google.com Reviewed-by: Manivannan Sadhasivam mani@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pci/controller/dwc/pcie-qcom.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c index 77e5dc7b88ad4..7e23c74fb4230 100644 --- a/drivers/pci/controller/dwc/pcie-qcom.c +++ b/drivers/pci/controller/dwc/pcie-qcom.c @@ -1534,8 +1534,19 @@ static int qcom_pcie_host_init(struct dw_pcie_rp *pp) return ret; }
+static void qcom_pcie_host_deinit(struct dw_pcie_rp *pp) +{ + struct dw_pcie *pci = to_dw_pcie_from_pp(pp); + struct qcom_pcie *pcie = to_qcom_pcie(pci); + + qcom_ep_reset_assert(pcie); + phy_power_off(pcie->phy); + pcie->cfg->ops->deinit(pcie); +} + static const struct dw_pcie_host_ops qcom_pcie_dw_ops = { - .host_init = qcom_pcie_host_init, + .host_init = qcom_pcie_host_init, + .host_deinit = qcom_pcie_host_deinit, };
/* Qcom IP rev.: 2.1.0 Synopsys IP rev.: 4.01a */
From: Dan Carpenter error27@gmail.com
[ Upstream commit 4ca446b127c568b59cb8d9748b6f70499624bb18 ]
This condition needs to match the previous "if (epcp->state == LISTEN) {" exactly to avoid a NULL dereference of either "listen_ep" or "ep". The problem is that "epcp" has been re-assigned so just testing "if (epcp->state == LISTEN) {" a second time is not sufficient.
Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information") Signed-off-by: Dan Carpenter error27@gmail.com Link: https://lore.kernel.org/r/Y+usKuWIKr4dimZh@kili Signed-off-by: Leon Romanovsky leon@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/cxgb4/restrack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c index ff645b955a082..fd22c85d35f4f 100644 --- a/drivers/infiniband/hw/cxgb4/restrack.c +++ b/drivers/infiniband/hw/cxgb4/restrack.c @@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg, if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history)) goto err_cancel_table;
- if (epcp->state == LISTEN) { + if (listen_ep) { if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid)) goto err_cancel_table; if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog))
From: Jason Gunthorpe jgg@nvidia.com
[ Upstream commit 4daa861174d56023c2068ddb03de0752f07fa199 ]
If either iommu_group_grate_file() fails then the iommu_group is leaked.
Destroy it on these error paths.
Found by kselftest/iommu/iommufd_fail_nth
Fixes: bc7d12b91bd3 ("iommu: Implement reserved_regions iommu-group sysfs file") Fixes: c52c72d3dee8 ("iommu: Add sysfs attribyte for domain type") Signed-off-by: Jason Gunthorpe jgg@nvidia.com Reviewed-by: Lu Baolu baolu.lu@linux.intel.com Link: https://lore.kernel.org/r/0-v1-8f616bee028d+8b-iommu_group_alloc_leak_jgg@nv... Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iommu/iommu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 9ff8cda2de7c6..50d858f36a81b 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -774,12 +774,16 @@ struct iommu_group *iommu_group_alloc(void)
ret = iommu_group_create_file(group, &iommu_group_attr_reserved_regions); - if (ret) + if (ret) { + kobject_put(group->devices_kobj); return ERR_PTR(ret); + }
ret = iommu_group_create_file(group, &iommu_group_attr_type); - if (ret) + if (ret) { + kobject_put(group->devices_kobj); return ERR_PTR(ret); + }
pr_debug("Allocated group %d\n", group->id);
From: Vasant Hegde vasant.hegde@amd.com
[ Upstream commit 18792e99ea2fea27c72eb1ecca1879e5e6be304d ]
Flow: - Booted system with SNP enabled, memory encryption off and IOMMU DMA translation mode - AMD driver detects v2 capable device and amd_iommu_def_domain_type() returns identity mode - amd_iommu_domain_alloc() returns NULL an SNP is enabled - System will fail to register device
On SNP enabled system, passthrough mode is not supported. IOMMU default domain is set to translation mode. We need to return zero from amd_iommu_def_domain_type() so that it allocates translation domain.
Fixes: fb2accadaa94 ("iommu/amd: Introduce function to check and enable SNP") CC: Suravee Suthikulpanit suravee.suthikulpanit@amd.com Signed-off-by: Vasant Hegde vasant.hegde@amd.com Link: https://lore.kernel.org/r/20230207091752.7656-1-vasant.hegde@amd.com Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iommu/amd/iommu.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 9dc41c48c29d6..ff4f3d4da3402 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -2405,12 +2405,17 @@ static int amd_iommu_def_domain_type(struct device *dev) return 0;
/* - * Do not identity map IOMMUv2 capable devices when memory encryption is - * active, because some of those devices (AMD GPUs) don't have the - * encryption bit in their DMA-mask and require remapping. + * Do not identity map IOMMUv2 capable devices when: + * - memory encryption is active, because some of those devices + * (AMD GPUs) don't have the encryption bit in their DMA-mask + * and require remapping. + * - SNP is enabled, because it prohibits DTE[Mode]=0. */ - if (!cc_platform_has(CC_ATTR_MEM_ENCRYPT) && dev_data->iommu_v2) + if (dev_data->iommu_v2 && + !cc_platform_has(CC_ATTR_MEM_ENCRYPT) && + !amd_iommu_snp_en) { return IOMMU_DOMAIN_IDENTITY; + }
return 0; }
From: Shravan Chippa shravan.chippa@microchip.com
[ Upstream commit b02e07015a5ac7bbc029da931ae17914b8ae0339 ]
Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally allocate a new sf_pdma_desc each time it is called.
The driver previously recycled descs, by checking the in_use flag, only allocating additional descs if the existing one was in use. This logic was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel"), but sf_pdma_free_desc() was not changed to handle the new behaviour.
As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous descriptor is leaked, over time leading to memory starvation:
unreferenced object 0xffffffe008447300 (size 192): comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s) hex dump (first 32 bytes): 00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................ 00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p............. backtrace: [<00000000064a04f4>] kmemleak_alloc+0x1e/0x28 [<00000000018927a7>] kmem_cache_alloc+0x11e/0x178 [<000000002aea8d16>] sf_pdma_prep_dma_memcpy+0x40/0x112
Add the missing kfree() to sf_pdma_free_desc(), and remove the redundant in_use flag.
Fixes: b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") Signed-off-by: Shravan Chippa shravan.chippa@microchip.com Reviewed-by: Conor Dooley conor.dooley@microchip.com Link: https://lore.kernel.org/r/20230120100623.3530634-1-shravan.chippa@microchip.... Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/dma/sf-pdma/sf-pdma.c | 3 +-- drivers/dma/sf-pdma/sf-pdma.h | 1 - 2 files changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/dma/sf-pdma/sf-pdma.c b/drivers/dma/sf-pdma/sf-pdma.c index 6b524eb6bcf3a..e578ad5569494 100644 --- a/drivers/dma/sf-pdma/sf-pdma.c +++ b/drivers/dma/sf-pdma/sf-pdma.c @@ -96,7 +96,6 @@ sf_pdma_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dest, dma_addr_t src, if (!desc) return NULL;
- desc->in_use = true; desc->dirn = DMA_MEM_TO_MEM; desc->async_tx = vchan_tx_prep(&chan->vchan, &desc->vdesc, flags);
@@ -290,7 +289,7 @@ static void sf_pdma_free_desc(struct virt_dma_desc *vdesc) struct sf_pdma_desc *desc;
desc = to_sf_pdma_desc(vdesc); - desc->in_use = false; + kfree(desc); }
static void sf_pdma_donebh_tasklet(struct tasklet_struct *t) diff --git a/drivers/dma/sf-pdma/sf-pdma.h b/drivers/dma/sf-pdma/sf-pdma.h index dcb3687bd5da2..5c398a83b491a 100644 --- a/drivers/dma/sf-pdma/sf-pdma.h +++ b/drivers/dma/sf-pdma/sf-pdma.h @@ -78,7 +78,6 @@ struct sf_pdma_desc { u64 src_addr; struct virt_dma_desc vdesc; struct sf_pdma_chan *chan; - bool in_use; enum dma_transfer_direction dirn; struct dma_async_tx_descriptor *async_tx; };
From: Kees Cook keescook@chromium.org
[ Upstream commit be4d46edeee4b2459d2f53f37ada88bbfb634b6c ]
If "vdesc" is NULL, it cannot be used with vd_to_axi_desc(). Leave "bytes" unchanged at 0. Seen under GCC 13 with -Warray-bounds:
../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: In function 'dma_chan_tx_status': ../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c:329:46: warning: array subscript 0 is outside array bounds of 'struct virt_dma_desc[46116860184273879]' [-Warray-bounds=] 329 | bytes = vd_to_axi_desc(vdesc)->length; | ^~
Fixes: 8e55444da65c ("dmaengine: dw-axi-dmac: Support burst residue granularity") Cc: Eugeniy Paltsev Eugeniy.Paltsev@synopsys.com Cc: Vinod Koul vkoul@kernel.org Cc: dmaengine@vger.kernel.org Signed-off-by: Kees Cook keescook@chromium.org Reviewed-by: Andy Shevchenko andriy.shevchenko@linux.intel.com Link: https://lore.kernel.org/r/20230127223623.never.507-kees@kernel.org Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 -- 1 file changed, 2 deletions(-)
diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c index bf85aa0979ecb..152c5d98524d7 100644 --- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c @@ -325,8 +325,6 @@ dma_chan_tx_status(struct dma_chan *dchan, dma_cookie_t cookie, len = vd_to_axi_desc(vdesc)->hw_desc[0].len; completed_length = completed_blocks * len; bytes = length - completed_length; - } else { - bytes = vd_to_axi_desc(vdesc)->length; }
spin_unlock_irqrestore(&chan->vc.lock, flags);
From: Eric Pilmore epilmore@gigaio.com
[ Upstream commit 928469986171a6f763b34b039427f5667ba3fd50 ]
Resolves a panic that can occur on AMD systems, typically during host shutdown, after the PTDMA driver had been exercised. The issue was the pt_issue_pending() function is mistakenly assuming that there will be at least one descriptor in the Submitted queue when the function is called. However, it is possible that both the Submitted and Issued queues could be empty, which could result in pt_cmd_callback() being mistakenly called with a NULL pointer. Ref: Bugzilla Bug 216856.
Fixes: 6fa7e0e836e2 ("dmaengine: ptdma: fix concurrency issue with multiple dma transfer") Signed-off-by: Eric Pilmore epilmore@gigaio.com Link: https://lore.kernel.org/r/20230210075142.58253-1-epilmore@gigaio.com Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/dma/ptdma/ptdma-dmaengine.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/ptdma/ptdma-dmaengine.c b/drivers/dma/ptdma/ptdma-dmaengine.c index cc22d162ce250..1aa65e5de0f3a 100644 --- a/drivers/dma/ptdma/ptdma-dmaengine.c +++ b/drivers/dma/ptdma/ptdma-dmaengine.c @@ -254,7 +254,7 @@ static void pt_issue_pending(struct dma_chan *dma_chan) spin_unlock_irqrestore(&chan->vc.lock, flags);
/* If there was nothing active, start processing */ - if (engine_is_idle) + if (engine_is_idle && desc) pt_cmd_callback(desc, 0); }
From: Lu Baolu baolu.lu@linux.intel.com
[ Upstream commit 60b1daa3b168fbc648ae2ad28a84759223e49e18 ]
Roll back all previous actions in error paths of intel_iommu_enable_sva() and intel_iommu_disable_sva().
Fixes: d5b9e4bfe0d8 ("iommu/vt-d: Report prq to io-pgfault framework") Reviewed-by: Kevin Tian kevin.tian@intel.com Signed-off-by: Lu Baolu baolu.lu@linux.intel.com Link: https://lore.kernel.org/r/20230208051559.700109-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iommu/intel/iommu.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 59df7e42fd533..994dffa1db57a 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4642,8 +4642,12 @@ static int intel_iommu_enable_sva(struct device *dev) return -EINVAL;
ret = iopf_queue_add_device(iommu->iopf_queue, dev); - if (!ret) - ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev); + if (ret) + return ret; + + ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev); + if (ret) + iopf_queue_remove_device(iommu->iopf_queue, dev);
return ret; } @@ -4655,8 +4659,12 @@ static int intel_iommu_disable_sva(struct device *dev) int ret;
ret = iommu_unregister_device_fault_handler(dev); - if (!ret) - ret = iopf_queue_remove_device(iommu->iopf_queue, dev); + if (ret) + return ret; + + ret = iopf_queue_remove_device(iommu->iopf_queue, dev); + if (ret) + iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev);
return ret; }
From: Tina Zhang tina.zhang@intel.com
[ Upstream commit 257ec290741924f8df678927d0dfecb1deebb9c5 ]
Commit 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode is on") forced default domains to be strict mode as long as IOMMU caching-mode is flagged. The reason for doing this is that when vIOMMU uses VT-d caching mode to synchronize shadowing page tables, the strict mode shows better performance.
However, this optimization is orthogonal to the first-level page table because the Intel VT-d architecture does not define the caching mode of the first-level page table. Refer to VT-d spec, section 6.1, "When the CM field is reported as Set, any software updates to remapping structures other than first-stage mapping (including updates to not- present entries or present entries whose programming resulted in translation faults) requires explicit invalidation of the caches." Exclude the first-level page table from this optimization.
Generally using first-stage translation in vIOMMU implies nested translation enabled in the physical IOMMU. In this case the first-stage page table is wholly captured by the guest. The vIOMMU only needs to transfer the cache invalidations on vIOMMU to the physical IOMMU. Forcing the default domain to strict mode will cause more frequent cache invalidations, resulting in performance degradation. In a real performance benchmark test measured by iperf receive, the performance result on Sapphire Rapids 100Gb NIC shows: w/ this fix ~51 Gbits/s, w/o this fix ~39.3 Gbits/s.
Theoretically a first-stage IOMMU page table can still be shadowed in absence of the caching mode, e.g. with host write-protecting guest IOMMU page table to synchronize changed PTEs with the physical IOMMU page table. In this case the shadowing overhead is decoupled from emulating IOTLB invalidation then the overhead of the latter part is solely decided by the frequency of IOTLB invalidations. Hence allowing guest default dma domain to be lazy can also benefit the overall performance by reducing the total VM-exit numbers.
Fixes: 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode is on") Reported-by: Sanjay Kumar sanjay.k.kumar@intel.com Suggested-by: Sanjay Kumar sanjay.k.kumar@intel.com Signed-off-by: Tina Zhang tina.zhang@intel.com Reviewed-by: Kevin Tian kevin.tian@intel.com Link: https://lore.kernel.org/r/20230214025618.2292889-1-tina.zhang@intel.com Signed-off-by: Lu Baolu baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iommu/intel/iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 994dffa1db57a..b40ef352b0efc 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4005,7 +4005,8 @@ int __init intel_iommu_init(void) * is likely to be much lower than the overhead of synchronizing * the virtual and physical IOMMU page-tables. */ - if (cap_caching_mode(iommu->cap)) { + if (cap_caching_mode(iommu->cap) && + !first_level_by_default(IOMMU_DOMAIN_DMA)) { pr_info_once("IOMMU batching disallowed due to virtualization\n"); iommu_set_dma_strict(); }
From: Bob Pearson rpearsonhpe@gmail.com
[ Upstream commit ade58da2a73de1b65616e4b1080dc078d1ce0b5d ]
Remove blank lines and replace EFAULT by EINVAL when an invalid mr type is used.
Link: https://lore.kernel.org/r/20230119235936.19728-2-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson rpearsonhpe@gmail.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe_mr.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index 072eac4b65d29..632ee1e516a1a 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -26,8 +26,6 @@ u8 rxe_get_next_key(u32 last_key)
int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length) { - - switch (mr->ibmr.type) { case IB_MR_TYPE_DMA: return 0; @@ -41,7 +39,7 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length)
default: rxe_dbg_mr(mr, "type (%d) not supported\n", mr->ibmr.type); - return -EFAULT; + return -EINVAL; } }
From: Bob Pearson rpearsonhpe@gmail.com
[ Upstream commit db4729a5251992ed535da09c0fcf9b590ac7fe6c ]
Move rxe_map_mr_sg() to rxe_mr.c where it makes a little more sense.
Link: https://lore.kernel.org/r/20230119235936.19728-3-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson rpearsonhpe@gmail.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe_loc.h | 2 ++ drivers/infiniband/sw/rxe/rxe_mr.c | 36 +++++++++++++++++++++++++++ drivers/infiniband/sw/rxe/rxe_verbs.c | 36 --------------------------- 3 files changed, 38 insertions(+), 36 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h index 948ce4902b10f..29b6c21430453 100644 --- a/drivers/infiniband/sw/rxe/rxe_loc.h +++ b/drivers/infiniband/sw/rxe/rxe_loc.h @@ -69,6 +69,8 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length, enum rxe_mr_copy_dir dir); int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma, void *addr, int length, enum rxe_mr_copy_dir dir); +int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, + int sg_nents, unsigned int *sg_offset); void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length); struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key, enum rxe_mr_lookup_type type); diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index 632ee1e516a1a..229c7259644cf 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -223,6 +223,42 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) return err; }
+static int rxe_set_page(struct ib_mr *ibmr, u64 addr) +{ + struct rxe_mr *mr = to_rmr(ibmr); + struct rxe_map *map; + struct rxe_phys_buf *buf; + + if (unlikely(mr->nbuf == mr->num_buf)) + return -ENOMEM; + + map = mr->map[mr->nbuf / RXE_BUF_PER_MAP]; + buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP]; + + buf->addr = addr; + buf->size = ibmr->page_size; + mr->nbuf++; + + return 0; +} + +int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, + int sg_nents, unsigned int *sg_offset) +{ + struct rxe_mr *mr = to_rmr(ibmr); + int n; + + mr->nbuf = 0; + + n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); + + mr->page_shift = ilog2(ibmr->page_size); + mr->page_mask = ibmr->page_size - 1; + mr->offset = ibmr->iova & mr->page_mask; + + return n; +} + static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, size_t *offset_out) { diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c index 025b35bf014e2..7a902e0a0607d 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.c +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c @@ -948,42 +948,6 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, return ERR_PTR(err); }
-static int rxe_set_page(struct ib_mr *ibmr, u64 addr) -{ - struct rxe_mr *mr = to_rmr(ibmr); - struct rxe_map *map; - struct rxe_phys_buf *buf; - - if (unlikely(mr->nbuf == mr->num_buf)) - return -ENOMEM; - - map = mr->map[mr->nbuf / RXE_BUF_PER_MAP]; - buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP]; - - buf->addr = addr; - buf->size = ibmr->page_size; - mr->nbuf++; - - return 0; -} - -static int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, - int sg_nents, unsigned int *sg_offset) -{ - struct rxe_mr *mr = to_rmr(ibmr); - int n; - - mr->nbuf = 0; - - n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); - - mr->page_shift = ilog2(ibmr->page_size); - mr->page_mask = ibmr->page_size - 1; - mr->offset = ibmr->iova & mr->page_mask; - - return n; -} - static ssize_t parent_show(struct device *device, struct device_attribute *attr, char *buf) {
From: Bob Pearson rpearsonhpe@gmail.com
[ Upstream commit f04d5b3d916c61752ac2c2adea5dfe78f8e12f78 ]
Isolate mr specific code from atomic_reply() in rxe_resp.c into a subroutine rxe_mr_do_atomic_op() in rxe_mr.c. Minor cleanups to rxe_check_range() and iova_to_vaddr(). Move enum resp_state to rxe.h
Link: https://lore.kernel.org/r/20230119235936.19728-4-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson rpearsonhpe@gmail.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe.h | 38 +++++++++++++ drivers/infiniband/sw/rxe/rxe_loc.h | 2 + drivers/infiniband/sw/rxe/rxe_mr.c | 83 ++++++++++++++++++---------- drivers/infiniband/sw/rxe/rxe_resp.c | 82 ++++----------------------- 4 files changed, 105 insertions(+), 100 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h index ab334900fcc3d..2415f3704f576 100644 --- a/drivers/infiniband/sw/rxe/rxe.h +++ b/drivers/infiniband/sw/rxe/rxe.h @@ -57,6 +57,44 @@ #define rxe_dbg_mw(mw, fmt, ...) ibdev_dbg((mw)->ibmw.device, \ "mw#%d %s: " fmt, (mw)->elem.index, __func__, ##__VA_ARGS__)
+/* responder states */ +enum resp_states { + RESPST_NONE, + RESPST_GET_REQ, + RESPST_CHK_PSN, + RESPST_CHK_OP_SEQ, + RESPST_CHK_OP_VALID, + RESPST_CHK_RESOURCE, + RESPST_CHK_LENGTH, + RESPST_CHK_RKEY, + RESPST_EXECUTE, + RESPST_READ_REPLY, + RESPST_ATOMIC_REPLY, + RESPST_ATOMIC_WRITE_REPLY, + RESPST_PROCESS_FLUSH, + RESPST_COMPLETE, + RESPST_ACKNOWLEDGE, + RESPST_CLEANUP, + RESPST_DUPLICATE_REQUEST, + RESPST_ERR_MALFORMED_WQE, + RESPST_ERR_UNSUPPORTED_OPCODE, + RESPST_ERR_MISALIGNED_ATOMIC, + RESPST_ERR_PSN_OUT_OF_SEQ, + RESPST_ERR_MISSING_OPCODE_FIRST, + RESPST_ERR_MISSING_OPCODE_LAST_C, + RESPST_ERR_MISSING_OPCODE_LAST_D1E, + RESPST_ERR_TOO_MANY_RDMA_ATM_REQ, + RESPST_ERR_RNR, + RESPST_ERR_RKEY_VIOLATION, + RESPST_ERR_INVALIDATE_RKEY, + RESPST_ERR_LENGTH, + RESPST_ERR_CQ_OVERFLOW, + RESPST_ERROR, + RESPST_RESET, + RESPST_DONE, + RESPST_EXIT, +}; + void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name); diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h index 29b6c21430453..bcb1bbcf50dff 100644 --- a/drivers/infiniband/sw/rxe/rxe_loc.h +++ b/drivers/infiniband/sw/rxe/rxe_loc.h @@ -72,6 +72,8 @@ int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma, int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, unsigned int *sg_offset); void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length); +int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, + u64 compare, u64 swap_add, u64 *orig_val); struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key, enum rxe_mr_lookup_type type); int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length); diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index 229c7259644cf..df9741474f1f0 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -32,13 +32,15 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length)
case IB_MR_TYPE_USER: case IB_MR_TYPE_MEM_REG: - if (iova < mr->ibmr.iova || length > mr->ibmr.length || - iova > mr->ibmr.iova + mr->ibmr.length - length) - return -EFAULT; + if (iova < mr->ibmr.iova || + iova + length > mr->ibmr.iova + mr->ibmr.length) { + rxe_dbg_mr(mr, "iova/length out of range"); + return -EINVAL; + } return 0;
default: - rxe_dbg_mr(mr, "type (%d) not supported\n", mr->ibmr.type); + rxe_dbg_mr(mr, "mr type not supported\n"); return -EINVAL; } } @@ -299,37 +301,22 @@ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) { size_t offset; int m, n; - void *addr;
- if (mr->state != RXE_MR_STATE_VALID) { - rxe_dbg_mr(mr, "Not in valid state\n"); - addr = NULL; - goto out; - } + if (mr->state != RXE_MR_STATE_VALID) + return NULL;
- if (!mr->map) { - addr = (void *)(uintptr_t)iova; - goto out; - } + if (mr->ibmr.type == IB_MR_TYPE_DMA) + return (void *)(uintptr_t)iova;
- if (mr_check_range(mr, iova, length)) { - rxe_dbg_mr(mr, "Range violation\n"); - addr = NULL; - goto out; - } + if (mr_check_range(mr, iova, length)) + return NULL;
lookup_iova(mr, iova, &m, &n, &offset);
- if (offset + length > mr->map[m]->buf[n].size) { - rxe_dbg_mr(mr, "Crosses page boundary\n"); - addr = NULL; - goto out; - } - - addr = (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset; + if (offset + length > mr->map[m]->buf[n].size) + return NULL;
-out: - return addr; + return (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset; }
int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length) @@ -538,6 +525,46 @@ int copy_data( return err; }
+/* Guarantee atomicity of atomic operations at the machine level. */ +static DEFINE_SPINLOCK(atomic_ops_lock); + +int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, + u64 compare, u64 swap_add, u64 *orig_val) +{ + u64 *va; + u64 value; + + if (mr->state != RXE_MR_STATE_VALID) { + rxe_dbg_mr(mr, "mr not in valid state"); + return RESPST_ERR_RKEY_VIOLATION; + } + + va = iova_to_vaddr(mr, iova, sizeof(u64)); + if (!va) { + rxe_dbg_mr(mr, "iova out of range"); + return RESPST_ERR_RKEY_VIOLATION; + } + + if ((uintptr_t)va & 0x7) { + rxe_dbg_mr(mr, "iova not aligned"); + return RESPST_ERR_MISALIGNED_ATOMIC; + } + + spin_lock_bh(&atomic_ops_lock); + value = *orig_val = *va; + + if (opcode == IB_OPCODE_RC_COMPARE_SWAP) { + if (value == compare) + *va = swap_add; + } else { + value += swap_add; + *va = value; + } + spin_unlock_bh(&atomic_ops_lock); + + return 0; +} + int advance_dma_data(struct rxe_dma_info *dma, unsigned int length) { struct rxe_sge *sge = &dma->sge[dma->cur_sge]; diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index c74972244f08f..9d4b4e9b42fc9 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -10,43 +10,6 @@ #include "rxe_loc.h" #include "rxe_queue.h"
-enum resp_states { - RESPST_NONE, - RESPST_GET_REQ, - RESPST_CHK_PSN, - RESPST_CHK_OP_SEQ, - RESPST_CHK_OP_VALID, - RESPST_CHK_RESOURCE, - RESPST_CHK_LENGTH, - RESPST_CHK_RKEY, - RESPST_EXECUTE, - RESPST_READ_REPLY, - RESPST_ATOMIC_REPLY, - RESPST_ATOMIC_WRITE_REPLY, - RESPST_PROCESS_FLUSH, - RESPST_COMPLETE, - RESPST_ACKNOWLEDGE, - RESPST_CLEANUP, - RESPST_DUPLICATE_REQUEST, - RESPST_ERR_MALFORMED_WQE, - RESPST_ERR_UNSUPPORTED_OPCODE, - RESPST_ERR_MISALIGNED_ATOMIC, - RESPST_ERR_PSN_OUT_OF_SEQ, - RESPST_ERR_MISSING_OPCODE_FIRST, - RESPST_ERR_MISSING_OPCODE_LAST_C, - RESPST_ERR_MISSING_OPCODE_LAST_D1E, - RESPST_ERR_TOO_MANY_RDMA_ATM_REQ, - RESPST_ERR_RNR, - RESPST_ERR_RKEY_VIOLATION, - RESPST_ERR_INVALIDATE_RKEY, - RESPST_ERR_LENGTH, - RESPST_ERR_CQ_OVERFLOW, - RESPST_ERROR, - RESPST_RESET, - RESPST_DONE, - RESPST_EXIT, -}; - static char *resp_state_name[] = { [RESPST_NONE] = "NONE", [RESPST_GET_REQ] = "GET_REQ", @@ -725,17 +688,12 @@ static enum resp_states process_flush(struct rxe_qp *qp, return RESPST_ACKNOWLEDGE; }
-/* Guarantee atomicity of atomic operations at the machine level. */ -static DEFINE_SPINLOCK(atomic_ops_lock); - static enum resp_states atomic_reply(struct rxe_qp *qp, - struct rxe_pkt_info *pkt) + struct rxe_pkt_info *pkt) { - u64 *vaddr; - enum resp_states ret; struct rxe_mr *mr = qp->resp.mr; struct resp_res *res = qp->resp.res; - u64 value; + int err;
if (!res) { res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_MASK); @@ -743,32 +701,14 @@ static enum resp_states atomic_reply(struct rxe_qp *qp, }
if (!res->replay) { - if (mr->state != RXE_MR_STATE_VALID) { - ret = RESPST_ERR_RKEY_VIOLATION; - goto out; - } - - vaddr = iova_to_vaddr(mr, qp->resp.va + qp->resp.offset, - sizeof(u64)); - - /* check vaddr is 8 bytes aligned. */ - if (!vaddr || (uintptr_t)vaddr & 7) { - ret = RESPST_ERR_MISALIGNED_ATOMIC; - goto out; - } - - spin_lock_bh(&atomic_ops_lock); - res->atomic.orig_val = value = *vaddr; - - if (pkt->opcode == IB_OPCODE_RC_COMPARE_SWAP) { - if (value == atmeth_comp(pkt)) - value = atmeth_swap_add(pkt); - } else { - value += atmeth_swap_add(pkt); - } + u64 iova = qp->resp.va + qp->resp.offset;
- *vaddr = value; - spin_unlock_bh(&atomic_ops_lock); + err = rxe_mr_do_atomic_op(mr, iova, pkt->opcode, + atmeth_comp(pkt), + atmeth_swap_add(pkt), + &res->atomic.orig_val); + if (err) + return err;
qp->resp.msn++;
@@ -780,9 +720,7 @@ static enum resp_states atomic_reply(struct rxe_qp *qp, qp->resp.status = IB_WC_SUCCESS; }
- ret = RESPST_ACKNOWLEDGE; -out: - return ret; + return RESPST_ACKNOWLEDGE; }
#ifdef CONFIG_64BIT
From: Bob Pearson rpearsonhpe@gmail.com
[ Upstream commit d8bdb0ebca086b5845d782e800ad2bf2a7eb4877 ]
Isolate mr specific code from atomic_write_reply() in rxe_resp.c into a subroutine rxe_mr_do_atomic_write() in rxe_mr.c. Check length for atomic write operation. Make iova_to_vaddr() static.
Link: https://lore.kernel.org/r/20230119235936.19728-5-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson rpearsonhpe@gmail.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe_loc.h | 2 +- drivers/infiniband/sw/rxe/rxe_mr.c | 38 ++++++++++++++++- drivers/infiniband/sw/rxe/rxe_resp.c | 61 ++++++++++------------------ 3 files changed, 59 insertions(+), 42 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h index bcb1bbcf50dff..ad8bd6bd728a4 100644 --- a/drivers/infiniband/sw/rxe/rxe_loc.h +++ b/drivers/infiniband/sw/rxe/rxe_loc.h @@ -71,9 +71,9 @@ int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma, void *addr, int length, enum rxe_mr_copy_dir dir); int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, unsigned int *sg_offset); -void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length); int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, u64 compare, u64 swap_add, u64 *orig_val); +int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value); struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key, enum rxe_mr_lookup_type type); int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length); diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index df9741474f1f0..5c4ce43914fa2 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -297,7 +297,7 @@ static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, } }
-void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) +static void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) { size_t offset; int m, n; @@ -565,6 +565,42 @@ int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, return 0; }
+/* only implemented for 64 bit architectures */ +#if defined CONFIG_64BIT +int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) +{ + u64 *va; + + /* See IBA oA19-28 */ + if (unlikely(mr->state != RXE_MR_STATE_VALID)) { + rxe_dbg_mr(mr, "mr not in valid state"); + return RESPST_ERR_RKEY_VIOLATION; + } + + va = iova_to_vaddr(mr, iova, sizeof(value)); + if (unlikely(!va)) { + rxe_dbg_mr(mr, "iova out of range"); + return RESPST_ERR_RKEY_VIOLATION; + } + + /* See IBA A19.4.2 */ + if (unlikely((uintptr_t)va & 0x7 || iova & 0x7)) { + rxe_dbg_mr(mr, "misaligned address"); + return RESPST_ERR_MISALIGNED_ATOMIC; + } + + /* Do atomic write after all prior operations have completed */ + smp_store_release(va, value); + + return 0; +} +#else +int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) +{ + return RESPST_ERR_UNSUPPORTED_OPCODE; +} +#endif + int advance_dma_data(struct rxe_dma_info *dma, unsigned int length) { struct rxe_sge *sge = &dma->sge[dma->cur_sge]; diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index 9d4b4e9b42fc9..cd2d88de287ca 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -723,30 +723,32 @@ static enum resp_states atomic_reply(struct rxe_qp *qp, return RESPST_ACKNOWLEDGE; }
-#ifdef CONFIG_64BIT -static enum resp_states do_atomic_write(struct rxe_qp *qp, - struct rxe_pkt_info *pkt) +static enum resp_states atomic_write_reply(struct rxe_qp *qp, + struct rxe_pkt_info *pkt) { - struct rxe_mr *mr = qp->resp.mr; - int payload = payload_size(pkt); - u64 src, *dst; - - if (mr->state != RXE_MR_STATE_VALID) - return RESPST_ERR_RKEY_VIOLATION; + struct resp_res *res = qp->resp.res; + struct rxe_mr *mr; + u64 value; + u64 iova; + int err;
- memcpy(&src, payload_addr(pkt), payload); + if (!res) { + res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_WRITE_MASK); + qp->resp.res = res; + }
- dst = iova_to_vaddr(mr, qp->resp.va + qp->resp.offset, payload); - /* check vaddr is 8 bytes aligned. */ - if (!dst || (uintptr_t)dst & 7) - return RESPST_ERR_MISALIGNED_ATOMIC; + if (res->replay) + return RESPST_ACKNOWLEDGE;
- /* Do atomic write after all prior operations have completed */ - smp_store_release(dst, src); + mr = qp->resp.mr; + value = *(u64 *)payload_addr(pkt); + iova = qp->resp.va + qp->resp.offset;
- /* decrease resp.resid to zero */ - qp->resp.resid -= sizeof(payload); + err = rxe_mr_do_atomic_write(mr, iova, value); + if (err) + return err;
+ qp->resp.resid = 0; qp->resp.msn++;
/* next expected psn, read handles this separately */ @@ -755,29 +757,8 @@ static enum resp_states do_atomic_write(struct rxe_qp *qp,
qp->resp.opcode = pkt->opcode; qp->resp.status = IB_WC_SUCCESS; - return RESPST_ACKNOWLEDGE; -} -#else -static enum resp_states do_atomic_write(struct rxe_qp *qp, - struct rxe_pkt_info *pkt) -{ - return RESPST_ERR_UNSUPPORTED_OPCODE; -} -#endif /* CONFIG_64BIT */ - -static enum resp_states atomic_write_reply(struct rxe_qp *qp, - struct rxe_pkt_info *pkt) -{ - struct resp_res *res = qp->resp.res;
- if (!res) { - res = rxe_prepare_res(qp, pkt, RXE_ATOMIC_WRITE_MASK); - qp->resp.res = res; - } - - if (res->replay) - return RESPST_ACKNOWLEDGE; - return do_atomic_write(qp, pkt); + return RESPST_ACKNOWLEDGE; }
static struct sk_buff *prepare_ack_packet(struct rxe_qp *qp,
From: Bob Pearson rpearsonhpe@gmail.com
[ Upstream commit 325a7eb85199ec9c5b5a7af812f43ea16b735569 ]
Cleanup usage of mr->page_shift and mr->page_mask and introduce an extractor for mr->ibmr.page_size. Normal usage in the kernel has page_mask masking out offset in page rather than masking out the page number. The rxe driver had reversed that which was confusing. Implicitly there can be a per mr page_size which was not uniformly supported.
Link: https://lore.kernel.org/r/20230119235936.19728-6-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson rpearsonhpe@gmail.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe_mr.c | 31 ++++++++++++--------------- drivers/infiniband/sw/rxe/rxe_verbs.h | 11 +++++++--- 2 files changed, 22 insertions(+), 20 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index 5c4ce43914fa2..2181165ea40d7 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -62,6 +62,9 @@ static void rxe_mr_init(int access, struct rxe_mr *mr) mr->lkey = mr->ibmr.lkey = lkey; mr->rkey = mr->ibmr.rkey = rkey;
+ mr->ibmr.page_size = PAGE_SIZE; + mr->page_mask = PAGE_MASK; + mr->page_shift = PAGE_SHIFT; mr->state = RXE_MR_STATE_INVALID; }
@@ -151,9 +154,6 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, goto err_release_umem; }
- mr->page_shift = PAGE_SHIFT; - mr->page_mask = PAGE_SIZE - 1; - num_buf = 0; map = mr->map; if (length > 0) { @@ -182,7 +182,7 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, goto err_release_umem; } buf->addr = (uintptr_t)vaddr; - buf->size = PAGE_SIZE; + buf->size = mr_page_size(mr); num_buf++; buf++;
@@ -191,10 +191,9 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
mr->umem = umem; mr->access = access; - mr->offset = ib_umem_offset(umem); + mr->page_offset = ib_umem_offset(umem); mr->state = RXE_MR_STATE_VALID; mr->ibmr.type = IB_MR_TYPE_USER; - mr->ibmr.page_size = PAGE_SIZE;
return 0;
@@ -248,29 +247,27 @@ int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, unsigned int *sg_offset) { struct rxe_mr *mr = to_rmr(ibmr); - int n; - - mr->nbuf = 0; + unsigned int page_size = mr_page_size(mr);
- n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); + mr->page_shift = ilog2(page_size); + mr->page_mask = ~((u64)page_size - 1); + mr->page_offset = ibmr->iova & (page_size - 1);
- mr->page_shift = ilog2(ibmr->page_size); - mr->page_mask = ibmr->page_size - 1; - mr->offset = ibmr->iova & mr->page_mask; + mr->nbuf = 0;
- return n; + return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); }
static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, size_t *offset_out) { - size_t offset = iova - mr->ibmr.iova + mr->offset; + size_t offset = iova - mr->ibmr.iova + mr->page_offset; int map_index; int buf_index; u64 length;
if (likely(mr->page_shift)) { - *offset_out = offset & mr->page_mask; + *offset_out = offset & (mr_page_size(mr) - 1); offset >>= mr->page_shift; *n_out = offset & mr->map_mask; *m_out = offset >> mr->map_shift; @@ -329,7 +326,7 @@ int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length) if (mr->ibmr.type == IB_MR_TYPE_DMA) return -EFAULT;
- offset = (iova - mr->ibmr.iova + mr->offset) & mr->page_mask; + offset = (iova - mr->ibmr.iova + mr->page_offset) & mr->page_mask; while (length > 0) { u8 *va; int bytes; diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h index 19ddfa8904803..bfc94caaeec57 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.h +++ b/drivers/infiniband/sw/rxe/rxe_verbs.h @@ -310,11 +310,11 @@ struct rxe_mr { u32 lkey; u32 rkey; enum rxe_mr_state state; - u32 offset; int access;
- int page_shift; - int page_mask; + unsigned int page_offset; + unsigned int page_shift; + u64 page_mask; int map_shift; int map_mask;
@@ -329,6 +329,11 @@ struct rxe_mr { struct rxe_map **map; };
+static inline unsigned int mr_page_size(struct rxe_mr *mr) +{ + return mr ? mr->ibmr.page_size : PAGE_SIZE; +} + enum rxe_mw_state { RXE_MW_STATE_INVALID = RXE_MR_STATE_INVALID, RXE_MW_STATE_FREE = RXE_MR_STATE_FREE,
From: Bob Pearson rpearsonhpe@gmail.com
[ Upstream commit 592627ccbdff0ec6fff00fc761142a76db750dd4 ]
Replace struct rxe-phys_buf and struct rxe_map by struct xarray in rxe_verbs.h. This allows using rcu locking on reads for the memory maps stored in each mr.
This is based off of a sketch of a patch from Jason Gunthorpe in the link below. Some changes were needed to make this work. It applies cleanly to the current for-next and passes the pyverbs, perftest and the same blktests test cases which run today.
Link: https://lore.kernel.org/r/20230119235936.19728-7-rpearsonhpe@gmail.com Link: https://lore.kernel.org/linux-rdma/Y3gvZr6%2FNCii9Avy@nvidia.com/ Co-developed-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Bob Pearson rpearsonhpe@gmail.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Stable-dep-of: 5ff31dfcd6d2 ("Subject: RDMA/rxe: Handle zero length rdma") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe_loc.h | 6 +- drivers/infiniband/sw/rxe/rxe_mr.c | 529 ++++++++++++-------------- drivers/infiniband/sw/rxe/rxe_verbs.h | 21 +- 3 files changed, 254 insertions(+), 302 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h index ad8bd6bd728a4..1bb0cb479eb12 100644 --- a/drivers/infiniband/sw/rxe/rxe_loc.h +++ b/drivers/infiniband/sw/rxe/rxe_loc.h @@ -64,9 +64,9 @@ void rxe_mr_init_dma(int access, struct rxe_mr *mr); int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, int access, struct rxe_mr *mr); int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr); -int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length); -int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length, - enum rxe_mr_copy_dir dir); +int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length); +int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, + unsigned int length, enum rxe_mr_copy_dir dir); int copy_data(struct rxe_pd *pd, int access, struct rxe_dma_info *dma, void *addr, int length, enum rxe_mr_copy_dir dir); int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index 2181165ea40d7..c80458634962c 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -62,60 +62,31 @@ static void rxe_mr_init(int access, struct rxe_mr *mr) mr->lkey = mr->ibmr.lkey = lkey; mr->rkey = mr->ibmr.rkey = rkey;
+ mr->access = access; mr->ibmr.page_size = PAGE_SIZE; mr->page_mask = PAGE_MASK; mr->page_shift = PAGE_SHIFT; mr->state = RXE_MR_STATE_INVALID; }
-static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf) -{ - int i; - int num_map; - struct rxe_map **map = mr->map; - - num_map = (num_buf + RXE_BUF_PER_MAP - 1) / RXE_BUF_PER_MAP; - - mr->map = kmalloc_array(num_map, sizeof(*map), GFP_KERNEL); - if (!mr->map) - goto err1; - - for (i = 0; i < num_map; i++) { - mr->map[i] = kmalloc(sizeof(**map), GFP_KERNEL); - if (!mr->map[i]) - goto err2; - } - - BUILD_BUG_ON(!is_power_of_2(RXE_BUF_PER_MAP)); - - mr->map_shift = ilog2(RXE_BUF_PER_MAP); - mr->map_mask = RXE_BUF_PER_MAP - 1; - - mr->num_buf = num_buf; - mr->num_map = num_map; - mr->max_buf = num_map * RXE_BUF_PER_MAP; - - return 0; - -err2: - for (i--; i >= 0; i--) - kfree(mr->map[i]); - - kfree(mr->map); - mr->map = NULL; -err1: - return -ENOMEM; -} - void rxe_mr_init_dma(int access, struct rxe_mr *mr) { rxe_mr_init(access, mr);
- mr->access = access; mr->state = RXE_MR_STATE_VALID; mr->ibmr.type = IB_MR_TYPE_DMA; }
+static unsigned long rxe_mr_iova_to_index(struct rxe_mr *mr, u64 iova) +{ + return (iova >> mr->page_shift) - (mr->ibmr.iova >> mr->page_shift); +} + +static unsigned long rxe_mr_iova_to_page_offset(struct rxe_mr *mr, u64 iova) +{ + return iova & (mr_page_size(mr) - 1); +} + static bool is_pmem_page(struct page *pg) { unsigned long paddr = page_to_phys(pg); @@ -125,82 +96,98 @@ static bool is_pmem_page(struct page *pg) IORES_DESC_PERSISTENT_MEMORY); }
+static int rxe_mr_fill_pages_from_sgt(struct rxe_mr *mr, struct sg_table *sgt) +{ + XA_STATE(xas, &mr->page_list, 0); + struct sg_page_iter sg_iter; + struct page *page; + bool persistent = !!(mr->access & IB_ACCESS_FLUSH_PERSISTENT); + + __sg_page_iter_start(&sg_iter, sgt->sgl, sgt->orig_nents, 0); + if (!__sg_page_iter_next(&sg_iter)) + return 0; + + do { + xas_lock(&xas); + while (true) { + page = sg_page_iter_page(&sg_iter); + + if (persistent && !is_pmem_page(page)) { + rxe_dbg_mr(mr, "Page can't be persistent\n"); + xas_set_err(&xas, -EINVAL); + break; + } + + xas_store(&xas, page); + if (xas_error(&xas)) + break; + xas_next(&xas); + if (!__sg_page_iter_next(&sg_iter)) + break; + } + xas_unlock(&xas); + } while (xas_nomem(&xas, GFP_KERNEL)); + + return xas_error(&xas); +} + int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova, int access, struct rxe_mr *mr) { - struct rxe_map **map; - struct rxe_phys_buf *buf = NULL; - struct ib_umem *umem; - struct sg_page_iter sg_iter; - int num_buf; - void *vaddr; + struct ib_umem *umem; int err;
+ rxe_mr_init(access, mr); + + xa_init(&mr->page_list); + umem = ib_umem_get(&rxe->ib_dev, start, length, access); if (IS_ERR(umem)) { rxe_dbg_mr(mr, "Unable to pin memory region err = %d\n", (int)PTR_ERR(umem)); - err = PTR_ERR(umem); - goto err_out; + return PTR_ERR(umem); }
- num_buf = ib_umem_num_pages(umem); - - rxe_mr_init(access, mr); - - err = rxe_mr_alloc(mr, num_buf); + err = rxe_mr_fill_pages_from_sgt(mr, &umem->sgt_append.sgt); if (err) { - rxe_dbg_mr(mr, "Unable to allocate memory for map\n"); - goto err_release_umem; + ib_umem_release(umem); + return err; }
- num_buf = 0; - map = mr->map; - if (length > 0) { - bool persistent_access = access & IB_ACCESS_FLUSH_PERSISTENT; - - buf = map[0]->buf; - for_each_sgtable_page (&umem->sgt_append.sgt, &sg_iter, 0) { - struct page *pg = sg_page_iter_page(&sg_iter); + mr->umem = umem; + mr->ibmr.type = IB_MR_TYPE_USER; + mr->state = RXE_MR_STATE_VALID;
- if (persistent_access && !is_pmem_page(pg)) { - rxe_dbg_mr(mr, "Unable to register persistent access to non-pmem device\n"); - err = -EINVAL; - goto err_release_umem; - } + return 0; +}
- if (num_buf >= RXE_BUF_PER_MAP) { - map++; - buf = map[0]->buf; - num_buf = 0; - } +static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf) +{ + XA_STATE(xas, &mr->page_list, 0); + int i = 0; + int err;
- vaddr = page_address(pg); - if (!vaddr) { - rxe_dbg_mr(mr, "Unable to get virtual address\n"); - err = -ENOMEM; - goto err_release_umem; - } - buf->addr = (uintptr_t)vaddr; - buf->size = mr_page_size(mr); - num_buf++; - buf++; + xa_init(&mr->page_list);
+ do { + xas_lock(&xas); + while (i != num_buf) { + xas_store(&xas, XA_ZERO_ENTRY); + if (xas_error(&xas)) + break; + xas_next(&xas); + i++; } - } + xas_unlock(&xas); + } while (xas_nomem(&xas, GFP_KERNEL));
- mr->umem = umem; - mr->access = access; - mr->page_offset = ib_umem_offset(umem); - mr->state = RXE_MR_STATE_VALID; - mr->ibmr.type = IB_MR_TYPE_USER; + err = xas_error(&xas); + if (err) + return err;
- return 0; + mr->num_buf = num_buf;
-err_release_umem: - ib_umem_release(umem); -err_out: - return err; + return 0; }
int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) @@ -214,7 +201,6 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) if (err) goto err1;
- mr->max_buf = max_pages; mr->state = RXE_MR_STATE_FREE; mr->ibmr.type = IB_MR_TYPE_MEM_REG;
@@ -224,206 +210,122 @@ int rxe_mr_init_fast(int max_pages, struct rxe_mr *mr) return err; }
-static int rxe_set_page(struct ib_mr *ibmr, u64 addr) +static int rxe_set_page(struct ib_mr *ibmr, u64 iova) { struct rxe_mr *mr = to_rmr(ibmr); - struct rxe_map *map; - struct rxe_phys_buf *buf; + struct page *page = virt_to_page(iova & mr->page_mask); + bool persistent = !!(mr->access & IB_ACCESS_FLUSH_PERSISTENT); + int err; + + if (persistent && !is_pmem_page(page)) { + rxe_dbg_mr(mr, "Page cannot be persistent\n"); + return -EINVAL; + }
if (unlikely(mr->nbuf == mr->num_buf)) return -ENOMEM;
- map = mr->map[mr->nbuf / RXE_BUF_PER_MAP]; - buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP]; + err = xa_err(xa_store(&mr->page_list, mr->nbuf, page, GFP_KERNEL)); + if (err) + return err;
- buf->addr = addr; - buf->size = ibmr->page_size; mr->nbuf++; - return 0; }
-int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, +int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sgl, int sg_nents, unsigned int *sg_offset) { struct rxe_mr *mr = to_rmr(ibmr); unsigned int page_size = mr_page_size(mr);
+ mr->nbuf = 0; mr->page_shift = ilog2(page_size); mr->page_mask = ~((u64)page_size - 1); - mr->page_offset = ibmr->iova & (page_size - 1); - - mr->nbuf = 0; + mr->page_offset = mr->ibmr.iova & (page_size - 1);
- return ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); + return ib_sg_to_pages(ibmr, sgl, sg_nents, sg_offset, rxe_set_page); }
-static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, - size_t *offset_out) +static int rxe_mr_copy_xarray(struct rxe_mr *mr, u64 iova, void *addr, + unsigned int length, enum rxe_mr_copy_dir dir) { - size_t offset = iova - mr->ibmr.iova + mr->page_offset; - int map_index; - int buf_index; - u64 length; - - if (likely(mr->page_shift)) { - *offset_out = offset & (mr_page_size(mr) - 1); - offset >>= mr->page_shift; - *n_out = offset & mr->map_mask; - *m_out = offset >> mr->map_shift; - } else { - map_index = 0; - buf_index = 0; - - length = mr->map[map_index]->buf[buf_index].size; + unsigned int page_offset = rxe_mr_iova_to_page_offset(mr, iova); + unsigned long index = rxe_mr_iova_to_index(mr, iova); + unsigned int bytes; + struct page *page; + void *va;
- while (offset >= length) { - offset -= length; - buf_index++; - - if (buf_index == RXE_BUF_PER_MAP) { - map_index++; - buf_index = 0; - } - length = mr->map[map_index]->buf[buf_index].size; - } + while (length) { + page = xa_load(&mr->page_list, index); + if (!page) + return -EFAULT;
- *m_out = map_index; - *n_out = buf_index; - *offset_out = offset; + bytes = min_t(unsigned int, length, + mr_page_size(mr) - page_offset); + va = kmap_local_page(page); + if (dir == RXE_FROM_MR_OBJ) + memcpy(addr, va + page_offset, bytes); + else + memcpy(va + page_offset, addr, bytes); + kunmap_local(va); + + page_offset = 0; + addr += bytes; + length -= bytes; + index++; } -} - -static void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) -{ - size_t offset; - int m, n;
- if (mr->state != RXE_MR_STATE_VALID) - return NULL; - - if (mr->ibmr.type == IB_MR_TYPE_DMA) - return (void *)(uintptr_t)iova; - - if (mr_check_range(mr, iova, length)) - return NULL; - - lookup_iova(mr, iova, &m, &n, &offset); - - if (offset + length > mr->map[m]->buf[n].size) - return NULL; - - return (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset; + return 0; }
-int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, int length) +static void rxe_mr_copy_dma(struct rxe_mr *mr, u64 iova, void *addr, + unsigned int length, enum rxe_mr_copy_dir dir) { - size_t offset; - - if (length == 0) - return 0; - - if (mr->ibmr.type == IB_MR_TYPE_DMA) - return -EFAULT; - - offset = (iova - mr->ibmr.iova + mr->page_offset) & mr->page_mask; - while (length > 0) { - u8 *va; - int bytes; - - bytes = mr->ibmr.page_size - offset; - if (bytes > length) - bytes = length; - - va = iova_to_vaddr(mr, iova, length); - if (!va) - return -EFAULT; - - arch_wb_cache_pmem(va, bytes); + unsigned int page_offset = iova & (PAGE_SIZE - 1); + unsigned int bytes; + struct page *page; + u8 *va;
- length -= bytes; + while (length) { + page = virt_to_page(iova & mr->page_mask); + bytes = min_t(unsigned int, length, + PAGE_SIZE - page_offset); + va = kmap_local_page(page); + + if (dir == RXE_TO_MR_OBJ) + memcpy(va + page_offset, addr, bytes); + else + memcpy(addr, va + page_offset, bytes); + + kunmap_local(va); + page_offset = 0; iova += bytes; - offset = 0; + addr += bytes; + length -= bytes; } - - return 0; }
-/* copy data from a range (vaddr, vaddr+length-1) to or from - * a mr object starting at iova. - */ -int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length, - enum rxe_mr_copy_dir dir) +int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, + unsigned int length, enum rxe_mr_copy_dir dir) { - int err; - int bytes; - u8 *va; - struct rxe_map **map; - struct rxe_phys_buf *buf; - int m; - int i; - size_t offset; + int err;
if (length == 0) return 0;
if (mr->ibmr.type == IB_MR_TYPE_DMA) { - u8 *src, *dest; - - src = (dir == RXE_TO_MR_OBJ) ? addr : ((void *)(uintptr_t)iova); - - dest = (dir == RXE_TO_MR_OBJ) ? ((void *)(uintptr_t)iova) : addr; - - memcpy(dest, src, length); - + rxe_mr_copy_dma(mr, iova, addr, length, dir); return 0; }
- WARN_ON_ONCE(!mr->map); - err = mr_check_range(mr, iova, length); - if (err) { - err = -EFAULT; - goto err1; - } - - lookup_iova(mr, iova, &m, &i, &offset); - - map = mr->map + m; - buf = map[0]->buf + i; - - while (length > 0) { - u8 *src, *dest; - - va = (u8 *)(uintptr_t)buf->addr + offset; - src = (dir == RXE_TO_MR_OBJ) ? addr : va; - dest = (dir == RXE_TO_MR_OBJ) ? va : addr; - - bytes = buf->size - offset; - - if (bytes > length) - bytes = length; - - memcpy(dest, src, bytes); - - length -= bytes; - addr += bytes; - - offset = 0; - buf++; - i++; - - if (i == RXE_BUF_PER_MAP) { - i = 0; - map++; - buf = map[0]->buf; - } + if (unlikely(err)) { + rxe_dbg_mr(mr, "iova out of range"); + return err; }
- return 0; - -err1: - return err; + return rxe_mr_copy_xarray(mr, iova, addr, length, dir); }
/* copy data in or out of a wqe, i.e. sg list @@ -495,7 +397,6 @@ int copy_data(
if (bytes > 0) { iova = sge->addr + offset; - err = rxe_mr_copy(mr, iova, addr, bytes, dir); if (err) goto err2; @@ -522,50 +423,111 @@ int copy_data( return err; }
+int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length) +{ + unsigned int page_offset; + unsigned long index; + struct page *page; + unsigned int bytes; + int err; + u8 *va; + + if (length == 0) + return 0; + + if (mr->ibmr.type == IB_MR_TYPE_DMA) + return -EFAULT; + + err = mr_check_range(mr, iova, length); + if (err) + return err; + + while (length > 0) { + index = rxe_mr_iova_to_index(mr, iova); + page = xa_load(&mr->page_list, index); + page_offset = rxe_mr_iova_to_page_offset(mr, iova); + if (!page) + return -EFAULT; + bytes = min_t(unsigned int, length, + mr_page_size(mr) - page_offset); + + va = kmap_local_page(page); + arch_wb_cache_pmem(va + page_offset, bytes); + kunmap_local(va); + + length -= bytes; + iova += bytes; + page_offset = 0; + } + + return 0; +} + /* Guarantee atomicity of atomic operations at the machine level. */ static DEFINE_SPINLOCK(atomic_ops_lock);
int rxe_mr_do_atomic_op(struct rxe_mr *mr, u64 iova, int opcode, u64 compare, u64 swap_add, u64 *orig_val) { - u64 *va; + unsigned int page_offset; + struct page *page; u64 value; + u64 *va;
- if (mr->state != RXE_MR_STATE_VALID) { + if (unlikely(mr->state != RXE_MR_STATE_VALID)) { rxe_dbg_mr(mr, "mr not in valid state"); return RESPST_ERR_RKEY_VIOLATION; }
- va = iova_to_vaddr(mr, iova, sizeof(u64)); - if (!va) { - rxe_dbg_mr(mr, "iova out of range"); - return RESPST_ERR_RKEY_VIOLATION; + if (mr->ibmr.type == IB_MR_TYPE_DMA) { + page_offset = iova & (PAGE_SIZE - 1); + page = virt_to_page(iova & PAGE_MASK); + } else { + unsigned long index; + int err; + + err = mr_check_range(mr, iova, sizeof(value)); + if (err) { + rxe_dbg_mr(mr, "iova out of range"); + return RESPST_ERR_RKEY_VIOLATION; + } + page_offset = rxe_mr_iova_to_page_offset(mr, iova); + index = rxe_mr_iova_to_index(mr, iova); + page = xa_load(&mr->page_list, index); + if (!page) + return RESPST_ERR_RKEY_VIOLATION; }
- if ((uintptr_t)va & 0x7) { + if (unlikely(page_offset & 0x7)) { rxe_dbg_mr(mr, "iova not aligned"); return RESPST_ERR_MISALIGNED_ATOMIC; }
+ va = kmap_local_page(page); + spin_lock_bh(&atomic_ops_lock); - value = *orig_val = *va; + value = *orig_val = va[page_offset >> 3];
if (opcode == IB_OPCODE_RC_COMPARE_SWAP) { if (value == compare) - *va = swap_add; + va[page_offset >> 3] = swap_add; } else { value += swap_add; - *va = value; + va[page_offset >> 3] = value; } spin_unlock_bh(&atomic_ops_lock);
+ kunmap_local(va); + return 0; }
-/* only implemented for 64 bit architectures */ #if defined CONFIG_64BIT +/* only implemented or called for 64 bit architectures */ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) { + unsigned int page_offset; + struct page *page; u64 *va;
/* See IBA oA19-28 */ @@ -574,20 +536,38 @@ int rxe_mr_do_atomic_write(struct rxe_mr *mr, u64 iova, u64 value) return RESPST_ERR_RKEY_VIOLATION; }
- va = iova_to_vaddr(mr, iova, sizeof(value)); - if (unlikely(!va)) { - rxe_dbg_mr(mr, "iova out of range"); - return RESPST_ERR_RKEY_VIOLATION; + if (mr->ibmr.type == IB_MR_TYPE_DMA) { + page_offset = iova & (PAGE_SIZE - 1); + page = virt_to_page(iova & PAGE_MASK); + } else { + unsigned long index; + int err; + + /* See IBA oA19-28 */ + err = mr_check_range(mr, iova, sizeof(value)); + if (unlikely(err)) { + rxe_dbg_mr(mr, "iova out of range"); + return RESPST_ERR_RKEY_VIOLATION; + } + page_offset = rxe_mr_iova_to_page_offset(mr, iova); + index = rxe_mr_iova_to_index(mr, iova); + page = xa_load(&mr->page_list, index); + if (!page) + return RESPST_ERR_RKEY_VIOLATION; }
/* See IBA A19.4.2 */ - if (unlikely((uintptr_t)va & 0x7 || iova & 0x7)) { + if (unlikely(page_offset & 0x7)) { rxe_dbg_mr(mr, "misaligned address"); return RESPST_ERR_MISALIGNED_ATOMIC; }
+ va = kmap_local_page(page); + /* Do atomic write after all prior operations have completed */ - smp_store_release(va, value); + smp_store_release(&va[page_offset >> 3], value); + + kunmap_local(va);
return 0; } @@ -631,12 +611,6 @@ int advance_dma_data(struct rxe_dma_info *dma, unsigned int length) return 0; }
-/* (1) find the mr corresponding to lkey/rkey - * depending on lookup_type - * (2) verify that the (qp) pd matches the mr pd - * (3) verify that the mr can support the requested access - * (4) verify that mr state is valid - */ struct rxe_mr *lookup_mr(struct rxe_pd *pd, int access, u32 key, enum rxe_mr_lookup_type type) { @@ -757,15 +731,10 @@ int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata) void rxe_mr_cleanup(struct rxe_pool_elem *elem) { struct rxe_mr *mr = container_of(elem, typeof(*mr), elem); - int i;
rxe_put(mr_pd(mr)); ib_umem_release(mr->umem);
- if (mr->map) { - for (i = 0; i < mr->num_map; i++) - kfree(mr->map[i]); - - kfree(mr->map); - } + if (mr->ibmr.type != IB_MR_TYPE_DMA) + xa_destroy(&mr->page_list); } diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h index bfc94caaeec57..c269ae2a32243 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.h +++ b/drivers/infiniband/sw/rxe/rxe_verbs.h @@ -283,17 +283,6 @@ enum rxe_mr_lookup_type { RXE_LOOKUP_REMOTE, };
-#define RXE_BUF_PER_MAP (PAGE_SIZE / sizeof(struct rxe_phys_buf)) - -struct rxe_phys_buf { - u64 addr; - u64 size; -}; - -struct rxe_map { - struct rxe_phys_buf buf[RXE_BUF_PER_MAP]; -}; - static inline int rkey_is_mw(u32 rkey) { u32 index = rkey >> 8; @@ -311,22 +300,16 @@ struct rxe_mr { u32 rkey; enum rxe_mr_state state; int access; + atomic_t num_mw;
unsigned int page_offset; unsigned int page_shift; u64 page_mask; - int map_shift; - int map_mask;
u32 num_buf; u32 nbuf;
- u32 max_buf; - u32 num_map; - - atomic_t num_mw; - - struct rxe_map **map; + struct xarray page_list; };
static inline unsigned int mr_page_size(struct rxe_mr *mr)
From: Bob Pearson rpearsonhpe@gmail.com
[ Upstream commit 5ff31dfcd6d23f9c1bd5dd1a2c648ba499659357 ]
Currently the rxe driver does not handle all cases of zero length rdma operations correctly. The client does not have to provide an rkey for zero length RDMA read or write operations so the rkey provided may be invalid and should not be used to lookup an mr.
This patch corrects the driver to ignore the provided rkey if the reth length is zero for read or write operations and make sure to set the mr to NULL. In read_reply() if length is zero rxe_recheck_mr() is not called. Warnings are added in the routines in rxe_mr.c to catch NULL MRs when the length is non-zero.
Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20230202044240.6304-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson rpearsonhpe@gmail.com Reviewed-by: Daisuke Matsuda matsuda-daisuke@fujitsu.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe_mr.c | 7 ++++ drivers/infiniband/sw/rxe/rxe_resp.c | 59 +++++++++++++++++++++------- 2 files changed, 51 insertions(+), 15 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index c80458634962c..5e9a03831bf9f 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -314,6 +314,9 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, if (length == 0) return 0;
+ if (WARN_ON(!mr)) + return -EINVAL; + if (mr->ibmr.type == IB_MR_TYPE_DMA) { rxe_mr_copy_dma(mr, iova, addr, length, dir); return 0; @@ -432,6 +435,10 @@ int rxe_flush_pmem_iova(struct rxe_mr *mr, u64 iova, unsigned int length) int err; u8 *va;
+ /* mr must be valid even if length is zero */ + if (WARN_ON(!mr)) + return -EINVAL; + if (length == 0) return 0;
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index cd2d88de287ca..0cc1ba91d48cc 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -420,13 +420,23 @@ static enum resp_states rxe_resp_check_length(struct rxe_qp *qp, return RESPST_CHK_RKEY; }
+/* if the reth length field is zero we can assume nothing + * about the rkey value and should not validate or use it. + * Instead set qp->resp.rkey to 0 which is an invalid rkey + * value since the minimum index part is 1. + */ static void qp_resp_from_reth(struct rxe_qp *qp, struct rxe_pkt_info *pkt) { + unsigned int length = reth_len(pkt); + qp->resp.va = reth_va(pkt); qp->resp.offset = 0; - qp->resp.rkey = reth_rkey(pkt); - qp->resp.resid = reth_len(pkt); - qp->resp.length = reth_len(pkt); + qp->resp.resid = length; + qp->resp.length = length; + if (pkt->mask & RXE_READ_OR_WRITE_MASK && length == 0) + qp->resp.rkey = 0; + else + qp->resp.rkey = reth_rkey(pkt); }
static void qp_resp_from_atmeth(struct rxe_qp *qp, struct rxe_pkt_info *pkt) @@ -437,6 +447,10 @@ static void qp_resp_from_atmeth(struct rxe_qp *qp, struct rxe_pkt_info *pkt) qp->resp.resid = sizeof(u64); }
+/* resolve the packet rkey to qp->resp.mr or set qp->resp.mr to NULL + * if an invalid rkey is received or the rdma length is zero. For middle + * or last packets use the stored value of mr. + */ static enum resp_states check_rkey(struct rxe_qp *qp, struct rxe_pkt_info *pkt) { @@ -473,10 +487,12 @@ static enum resp_states check_rkey(struct rxe_qp *qp, return RESPST_EXECUTE; }
- /* A zero-byte op is not required to set an addr or rkey. See C9-88 */ + /* A zero-byte read or write op is not required to + * set an addr or rkey. See C9-88 + */ if ((pkt->mask & RXE_READ_OR_WRITE_MASK) && - (pkt->mask & RXE_RETH_MASK) && - reth_len(pkt) == 0) { + (pkt->mask & RXE_RETH_MASK) && reth_len(pkt) == 0) { + qp->resp.mr = NULL; return RESPST_EXECUTE; }
@@ -555,6 +571,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp, return RESPST_EXECUTE;
err: + qp->resp.mr = NULL; if (mr) rxe_put(mr); if (mw) @@ -885,7 +902,11 @@ static enum resp_states read_reply(struct rxe_qp *qp, }
if (res->state == rdatm_res_state_new) { - if (!res->replay) { + if (!res->replay || qp->resp.length == 0) { + /* if length == 0 mr will be NULL (is ok) + * otherwise qp->resp.mr holds a ref on mr + * which we transfer to mr and drop below. + */ mr = qp->resp.mr; qp->resp.mr = NULL; } else { @@ -899,6 +920,10 @@ static enum resp_states read_reply(struct rxe_qp *qp, else opcode = IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST; } else { + /* re-lookup mr from rkey on all later packets. + * length will be non-zero. This can fail if someone + * modifies or destroys the mr since the first packet. + */ mr = rxe_recheck_mr(qp, res->read.rkey); if (!mr) return RESPST_ERR_RKEY_VIOLATION; @@ -916,18 +941,16 @@ static enum resp_states read_reply(struct rxe_qp *qp, skb = prepare_ack_packet(qp, &ack_pkt, opcode, payload, res->cur_psn, AETH_ACK_UNLIMITED); if (!skb) { - if (mr) - rxe_put(mr); - return RESPST_ERR_RNR; + state = RESPST_ERR_RNR; + goto err_out; }
err = rxe_mr_copy(mr, res->read.va, payload_addr(&ack_pkt), payload, RXE_FROM_MR_OBJ); - if (mr) - rxe_put(mr); if (err) { kfree_skb(skb); - return RESPST_ERR_RKEY_VIOLATION; + state = RESPST_ERR_RKEY_VIOLATION; + goto err_out; }
if (bth_pad(&ack_pkt)) { @@ -936,9 +959,12 @@ static enum resp_states read_reply(struct rxe_qp *qp, memset(pad, 0, bth_pad(&ack_pkt)); }
+ /* rxe_xmit_packet always consumes the skb */ err = rxe_xmit_packet(qp, &ack_pkt, skb); - if (err) - return RESPST_ERR_RNR; + if (err) { + state = RESPST_ERR_RNR; + goto err_out; + }
res->read.va += payload; res->read.resid -= payload; @@ -955,6 +981,9 @@ static enum resp_states read_reply(struct rxe_qp *qp, state = RESPST_CLEANUP; }
+err_out: + if (mr) + rxe_put(mr); return state; }
From: Long Li longli@microsoft.com
[ Upstream commit 89d42b8c85b4c67d310c5ccaf491acbf71a260c3 ]
When registering memory in a large chunk that doesn't fit into a single PF message, the PF may return GDMA_STATUS_MORE_ENTRIES on the first message if there are more messages needed for registering more chunks.
Fix the VF to make it process the correct return code.
Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Link: https://lore.kernel.org/r/1676507522-21018-1-git-send-email-longli@linuxonhy... Signed-off-by: Long Li longli@microsoft.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/mana/main.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c index 8b3bc302d6f3a..7be4c3adb4e2b 100644 --- a/drivers/infiniband/hw/mana/main.c +++ b/drivers/infiniband/hw/mana/main.c @@ -249,7 +249,8 @@ static int mana_ib_gd_first_dma_region(struct mana_ib_dev *dev, struct gdma_context *gc, struct gdma_create_dma_region_req *create_req, - size_t num_pages, mana_handle_t *gdma_region) + size_t num_pages, mana_handle_t *gdma_region, + u32 expected_status) { struct gdma_create_dma_region_resp create_resp = {}; unsigned int create_req_msg_size; @@ -261,7 +262,7 @@ mana_ib_gd_first_dma_region(struct mana_ib_dev *dev,
err = mana_gd_send_request(gc, create_req_msg_size, create_req, sizeof(create_resp), &create_resp); - if (err || create_resp.hdr.status) { + if (err || create_resp.hdr.status != expected_status) { ibdev_dbg(&dev->ib_dev, "Failed to create DMA region: %d, 0x%x\n", err, create_resp.hdr.status); @@ -372,14 +373,21 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
page_addr_list = create_req->page_addr_list; rdma_umem_for_each_dma_block(umem, &biter, page_sz) { + u32 expected_status = 0; + page_addr_list[tail++] = rdma_block_iter_dma_address(&biter); if (tail < num_pages_to_handle) continue;
+ if (num_pages_processed + num_pages_to_handle < + num_pages_total) + expected_status = GDMA_STATUS_MORE_ENTRIES; + if (!num_pages_processed) { /* First create message */ err = mana_ib_gd_first_dma_region(dev, gc, create_req, - tail, gdma_region); + tail, gdma_region, + expected_status); if (err) goto out;
@@ -392,14 +400,8 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem, page_addr_list = add_req->page_addr_list; } else { /* Subsequent create messages */ - u32 expected_s = 0; - - if (num_pages_processed + num_pages_to_handle < - num_pages_total) - expected_s = GDMA_STATUS_MORE_ENTRIES; - err = mana_ib_gd_add_dma_region(dev, gc, add_req, tail, - expected_s); + expected_status); if (err) break; }
From: Bob Pearson rpearsonhpe@gmail.com
[ Upstream commit a77a52385e9a761f896a88a4162e69fb7ccafe3f ]
An earlier patch which introduced smp_load_acquire/smp_store_release into rxe_queue.h incorrectly assumed that surrounding spin-locks in rxe_verbs.c around queue updates for kernel ulps was sufficient to protect the passing of data through the queues between the ulp and the rxe tasklets. But this was incorrect. The typical sequence was
ulp rxe requester tasklet ------------------------ --------------------- spin_lock_irqsave() wqe = queue_head(queue) if (!queue_full(q)) { if (!wqe) spin_unlock_irqrestore return; return -ENOMEM } <process wqe> wqe = queue_producer_addr(q) <fill in wqe> queue_advance_consumer(queue) queue_advance_producer(q) spin_unlock_irqrestore()
queue_head() calls queue_empty() which calls smp_load_acquire() For user space apps queue_advance_producer() calls smp_store_release() so that there is a memory barrier between the producer and the consumer but for kernel ulps queue_advance_produce() just incremented the producer index because the lock function is a release function. But to work the barrier has to come between filling in the wqe and updating the producer index. This patch adds the missing barriers. It also changes the enum names for the ulp queue types to QUEUE_TYPE_FROM/TO_ULP instead of QUEUE_TYPE_TO/FROM_DRIVER which is very ambiguous. This bug is suspected as the cause of very rare lockups in a very high scale storage application. It is a bug in any case and should be corrected.
Fixes: 0a67c46d2e99 ("RDMA/rxe: Protect user space index loads/stores") Link: https://lore.kernel.org/r/20230214071053.5395-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson rpearsonhpe@gmail.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/sw/rxe/rxe_queue.h | 108 ++++++++++++++++---------- drivers/infiniband/sw/rxe/rxe_verbs.c | 20 ++--- 2 files changed, 76 insertions(+), 52 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_queue.h b/drivers/infiniband/sw/rxe/rxe_queue.h index ed44042782fa7..c711cb98b9496 100644 --- a/drivers/infiniband/sw/rxe/rxe_queue.h +++ b/drivers/infiniband/sw/rxe/rxe_queue.h @@ -35,19 +35,26 @@ /** * enum queue_type - type of queue * @QUEUE_TYPE_TO_CLIENT: Queue is written by rxe driver and - * read by client. Used by rxe driver only. + * read by client which may be a user space + * application or a kernel ulp. + * Used by rxe internals only. * @QUEUE_TYPE_FROM_CLIENT: Queue is written by client and - * read by rxe driver. Used by rxe driver only. - * @QUEUE_TYPE_TO_DRIVER: Queue is written by client and - * read by rxe driver. Used by kernel client only. - * @QUEUE_TYPE_FROM_DRIVER: Queue is written by rxe driver and - * read by client. Used by kernel client only. + * read by rxe driver. + * Used by rxe internals only. + * @QUEUE_TYPE_FROM_ULP: Queue is written by kernel ulp and + * read by rxe driver. + * Used by kernel verbs APIs only on + * behalf of ulps. + * @QUEUE_TYPE_TO_ULP: Queue is written by rxe driver and + * read by kernel ulp. + * Used by kernel verbs APIs only on + * behalf of ulps. */ enum queue_type { QUEUE_TYPE_TO_CLIENT, QUEUE_TYPE_FROM_CLIENT, - QUEUE_TYPE_TO_DRIVER, - QUEUE_TYPE_FROM_DRIVER, + QUEUE_TYPE_FROM_ULP, + QUEUE_TYPE_TO_ULP, };
struct rxe_queue_buf; @@ -62,9 +69,9 @@ struct rxe_queue { u32 index_mask; enum queue_type type; /* private copy of index for shared queues between - * kernel space and user space. Kernel reads and writes + * driver and clients. Driver reads and writes * this copy and then replicates to rxe_queue_buf - * for read access by user space. + * for read access by clients. */ u32 index; }; @@ -97,19 +104,21 @@ static inline u32 queue_get_producer(const struct rxe_queue *q,
switch (type) { case QUEUE_TYPE_FROM_CLIENT: - /* protect user index */ + /* used by rxe, client owns the index */ prod = smp_load_acquire(&q->buf->producer_index); break; case QUEUE_TYPE_TO_CLIENT: + /* used by rxe which owns the index */ prod = q->index; break; - case QUEUE_TYPE_FROM_DRIVER: - /* protect driver index */ - prod = smp_load_acquire(&q->buf->producer_index); - break; - case QUEUE_TYPE_TO_DRIVER: + case QUEUE_TYPE_FROM_ULP: + /* used by ulp which owns the index */ prod = q->buf->producer_index; break; + case QUEUE_TYPE_TO_ULP: + /* used by ulp, rxe owns the index */ + prod = smp_load_acquire(&q->buf->producer_index); + break; }
return prod; @@ -122,19 +131,21 @@ static inline u32 queue_get_consumer(const struct rxe_queue *q,
switch (type) { case QUEUE_TYPE_FROM_CLIENT: + /* used by rxe which owns the index */ cons = q->index; break; case QUEUE_TYPE_TO_CLIENT: - /* protect user index */ + /* used by rxe, client owns the index */ cons = smp_load_acquire(&q->buf->consumer_index); break; - case QUEUE_TYPE_FROM_DRIVER: - cons = q->buf->consumer_index; - break; - case QUEUE_TYPE_TO_DRIVER: - /* protect driver index */ + case QUEUE_TYPE_FROM_ULP: + /* used by ulp, rxe owns the index */ cons = smp_load_acquire(&q->buf->consumer_index); break; + case QUEUE_TYPE_TO_ULP: + /* used by ulp which owns the index */ + cons = q->buf->consumer_index; + break; }
return cons; @@ -172,24 +183,31 @@ static inline void queue_advance_producer(struct rxe_queue *q,
switch (type) { case QUEUE_TYPE_FROM_CLIENT: - pr_warn("%s: attempt to advance client index\n", - __func__); + /* used by rxe, client owns the index */ + if (WARN_ON(1)) + pr_warn("%s: attempt to advance client index\n", + __func__); break; case QUEUE_TYPE_TO_CLIENT: + /* used by rxe which owns the index */ prod = q->index; prod = (prod + 1) & q->index_mask; q->index = prod; - /* protect user index */ + /* release so client can read it safely */ smp_store_release(&q->buf->producer_index, prod); break; - case QUEUE_TYPE_FROM_DRIVER: - pr_warn("%s: attempt to advance driver index\n", - __func__); - break; - case QUEUE_TYPE_TO_DRIVER: + case QUEUE_TYPE_FROM_ULP: + /* used by ulp which owns the index */ prod = q->buf->producer_index; prod = (prod + 1) & q->index_mask; - q->buf->producer_index = prod; + /* release so rxe can read it safely */ + smp_store_release(&q->buf->producer_index, prod); + break; + case QUEUE_TYPE_TO_ULP: + /* used by ulp, rxe owns the index */ + if (WARN_ON(1)) + pr_warn("%s: attempt to advance driver index\n", + __func__); break; } } @@ -201,24 +219,30 @@ static inline void queue_advance_consumer(struct rxe_queue *q,
switch (type) { case QUEUE_TYPE_FROM_CLIENT: - cons = q->index; - cons = (cons + 1) & q->index_mask; + /* used by rxe which owns the index */ + cons = (q->index + 1) & q->index_mask; q->index = cons; - /* protect user index */ + /* release so client can read it safely */ smp_store_release(&q->buf->consumer_index, cons); break; case QUEUE_TYPE_TO_CLIENT: - pr_warn("%s: attempt to advance client index\n", - __func__); + /* used by rxe, client owns the index */ + if (WARN_ON(1)) + pr_warn("%s: attempt to advance client index\n", + __func__); + break; + case QUEUE_TYPE_FROM_ULP: + /* used by ulp, rxe owns the index */ + if (WARN_ON(1)) + pr_warn("%s: attempt to advance driver index\n", + __func__); break; - case QUEUE_TYPE_FROM_DRIVER: + case QUEUE_TYPE_TO_ULP: + /* used by ulp which owns the index */ cons = q->buf->consumer_index; cons = (cons + 1) & q->index_mask; - q->buf->consumer_index = cons; - break; - case QUEUE_TYPE_TO_DRIVER: - pr_warn("%s: attempt to advance driver index\n", - __func__); + /* release so rxe can read it safely */ + smp_store_release(&q->buf->consumer_index, cons); break; } } diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c index 7a902e0a0607d..a3aee247aa157 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.c +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c @@ -245,7 +245,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) int num_sge = ibwr->num_sge; int full;
- full = queue_full(rq->queue, QUEUE_TYPE_TO_DRIVER); + full = queue_full(rq->queue, QUEUE_TYPE_FROM_ULP); if (unlikely(full)) return -ENOMEM;
@@ -256,7 +256,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) for (i = 0; i < num_sge; i++) length += ibwr->sg_list[i].length;
- recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_TO_DRIVER); + recv_wqe = queue_producer_addr(rq->queue, QUEUE_TYPE_FROM_ULP); recv_wqe->wr_id = ibwr->wr_id;
memcpy(recv_wqe->dma.sge, ibwr->sg_list, @@ -268,7 +268,7 @@ static int post_one_recv(struct rxe_rq *rq, const struct ib_recv_wr *ibwr) recv_wqe->dma.cur_sge = 0; recv_wqe->dma.sge_offset = 0;
- queue_advance_producer(rq->queue, QUEUE_TYPE_TO_DRIVER); + queue_advance_producer(rq->queue, QUEUE_TYPE_FROM_ULP);
return 0; } @@ -623,17 +623,17 @@ static int post_one_send(struct rxe_qp *qp, const struct ib_send_wr *ibwr,
spin_lock_irqsave(&qp->sq.sq_lock, flags);
- full = queue_full(sq->queue, QUEUE_TYPE_TO_DRIVER); + full = queue_full(sq->queue, QUEUE_TYPE_FROM_ULP);
if (unlikely(full)) { spin_unlock_irqrestore(&qp->sq.sq_lock, flags); return -ENOMEM; }
- send_wqe = queue_producer_addr(sq->queue, QUEUE_TYPE_TO_DRIVER); + send_wqe = queue_producer_addr(sq->queue, QUEUE_TYPE_FROM_ULP); init_send_wqe(qp, ibwr, mask, length, send_wqe);
- queue_advance_producer(sq->queue, QUEUE_TYPE_TO_DRIVER); + queue_advance_producer(sq->queue, QUEUE_TYPE_FROM_ULP);
spin_unlock_irqrestore(&qp->sq.sq_lock, flags);
@@ -821,12 +821,12 @@ static int rxe_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
spin_lock_irqsave(&cq->cq_lock, flags); for (i = 0; i < num_entries; i++) { - cqe = queue_head(cq->queue, QUEUE_TYPE_FROM_DRIVER); + cqe = queue_head(cq->queue, QUEUE_TYPE_TO_ULP); if (!cqe) break;
memcpy(wc++, &cqe->ibwc, sizeof(*wc)); - queue_advance_consumer(cq->queue, QUEUE_TYPE_FROM_DRIVER); + queue_advance_consumer(cq->queue, QUEUE_TYPE_TO_ULP); } spin_unlock_irqrestore(&cq->cq_lock, flags);
@@ -838,7 +838,7 @@ static int rxe_peek_cq(struct ib_cq *ibcq, int wc_cnt) struct rxe_cq *cq = to_rcq(ibcq); int count;
- count = queue_count(cq->queue, QUEUE_TYPE_FROM_DRIVER); + count = queue_count(cq->queue, QUEUE_TYPE_TO_ULP);
return (count > wc_cnt) ? wc_cnt : count; } @@ -854,7 +854,7 @@ static int rxe_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags) if (cq->notify != IB_CQ_NEXT_COMP) cq->notify = flags & IB_CQ_SOLICITED_MASK;
- empty = queue_empty(cq->queue, QUEUE_TYPE_FROM_DRIVER); + empty = queue_empty(cq->queue, QUEUE_TYPE_TO_ULP);
if ((flags & IB_CQ_REPORT_MISSED_EVENTS) && !empty) ret = 1;
From: Patrick Kelsey pat.kelsey@cornelisnetworks.com
[ Upstream commit a0d198f79a8d033bd46605b779859193649f1f99 ]
Fix arithmetic and logic errors in hfi1_can_pin_pages() that would allow hfi1 to attempt pinning pages in cases where it should not because of resource limits or lack of required capability.
Fixes: 2c97ce4f3c29 ("IB/hfi1: Add pin query function") Link: https://lore.kernel.org/r/167656658362.2223096.10954762619837718026.stgit@aw... Signed-off-by: Brendan Cunningham bcunningham@cornelisnetworks.com Signed-off-by: Patrick Kelsey pat.kelsey@cornelisnetworks.com Signed-off-by: Dennis Dalessandro dennis.dalessandro@cornelisnetworks.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/hfi1/user_pages.c | 61 ++++++++++++++++--------- 1 file changed, 40 insertions(+), 21 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/user_pages.c b/drivers/infiniband/hw/hfi1/user_pages.c index 7bce963e2ae69..36aaedc651456 100644 --- a/drivers/infiniband/hw/hfi1/user_pages.c +++ b/drivers/infiniband/hw/hfi1/user_pages.c @@ -29,33 +29,52 @@ MODULE_PARM_DESC(cache_size, "Send and receive side cache size limit (in MB)"); bool hfi1_can_pin_pages(struct hfi1_devdata *dd, struct mm_struct *mm, u32 nlocked, u32 npages) { - unsigned long ulimit = rlimit(RLIMIT_MEMLOCK), pinned, cache_limit, - size = (cache_size * (1UL << 20)); /* convert to bytes */ - unsigned int usr_ctxts = - dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt; - bool can_lock = capable(CAP_IPC_LOCK); + unsigned long ulimit_pages; + unsigned long cache_limit_pages; + unsigned int usr_ctxts;
/* - * Calculate per-cache size. The calculation below uses only a quarter - * of the available per-context limit. This leaves space for other - * pinning. Should we worry about shared ctxts? + * Perform RLIMIT_MEMLOCK based checks unless CAP_IPC_LOCK is present. */ - cache_limit = (ulimit / usr_ctxts) / 4; - - /* If ulimit isn't set to "unlimited" and is smaller than cache_size. */ - if (ulimit != (-1UL) && size > cache_limit) - size = cache_limit; - - /* Convert to number of pages */ - size = DIV_ROUND_UP(size, PAGE_SIZE); - - pinned = atomic64_read(&mm->pinned_vm); + if (!capable(CAP_IPC_LOCK)) { + ulimit_pages = + DIV_ROUND_DOWN_ULL(rlimit(RLIMIT_MEMLOCK), PAGE_SIZE); + + /* + * Pinning these pages would exceed this process's locked memory + * limit. + */ + if (atomic64_read(&mm->pinned_vm) + npages > ulimit_pages) + return false; + + /* + * Only allow 1/4 of the user's RLIMIT_MEMLOCK to be used for HFI + * caches. This fraction is then equally distributed among all + * existing user contexts. Note that if RLIMIT_MEMLOCK is + * 'unlimited' (-1), the value of this limit will be > 2^42 pages + * (2^64 / 2^12 / 2^8 / 2^2). + * + * The effectiveness of this check may be reduced if I/O occurs on + * some user contexts before all user contexts are created. This + * check assumes that this process is the only one using this + * context (e.g., the corresponding fd was not passed to another + * process for concurrent access) as there is no per-context, + * per-process tracking of pinned pages. It also assumes that each + * user context has only one cache to limit. + */ + usr_ctxts = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt; + if (nlocked + npages > (ulimit_pages / usr_ctxts / 4)) + return false; + }
- /* First, check the absolute limit against all pinned pages. */ - if (pinned + npages >= ulimit && !can_lock) + /* + * Pinning these pages would exceed the size limit for this cache. + */ + cache_limit_pages = cache_size * (1024 * 1024) / PAGE_SIZE; + if (nlocked + npages > cache_limit_pages) return false;
- return ((nlocked + npages) <= size) || can_lock; + return true; }
int hfi1_acquire_user_pages(struct mm_struct *mm, unsigned long vaddr, size_t npages,
From: Patrick Kelsey pat.kelsey@cornelisnetworks.com
[ Upstream commit fd8958efe8779d3db19c9124fce593ce681ac709 ]
Fix three sources of error involving struct sdma_txreq.num_descs.
When _extend_sdma_tx_descs() extends the descriptor array, it uses the value of tx->num_descs to determine how many existing entries from the tx's original, internal descriptor array to copy to the newly allocated one. As this value was incremented before the call, the copy loop will access one entry past the internal descriptor array, copying its contents into the corresponding slot in the new array.
If the call to _extend_sdma_tx_descs() fails, _pad_smda_tx_descs() then invokes __sdma_tx_clean() which uses the value of tx->num_desc to drive a loop that unmaps all descriptor entries in use. As this value was incremented before the call, the unmap loop will invoke sdma_unmap_desc() on a descriptor entry whose contents consist of whatever random data was copied into it during (1), leading to cascading further calls into the kernel and driver using arbitrary data.
_sdma_close_tx() was using tx->num_descs instead of tx->num_descs - 1.
Fix all of the above by: - Only increment .num_descs after .descp is extended. - Use .num_descs - 1 instead of .num_descs for last .descp entry.
Fixes: f4d26d81ad7f ("staging/rdma/hfi1: Add coalescing support for SDMA TX descriptors") Link: https://lore.kernel.org/r/167656658879.2223096.10026561343022570690.stgit@aw... Signed-off-by: Brendan Cunningham bcunningham@cornelisnetworks.com Signed-off-by: Patrick Kelsey pat.kelsey@cornelisnetworks.com Signed-off-by: Dennis Dalessandro dennis.dalessandro@cornelisnetworks.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/hw/hfi1/sdma.c | 4 ++-- drivers/infiniband/hw/hfi1/sdma.h | 15 +++++++-------- 2 files changed, 9 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c index a95b654f52540..8ed20392e9f0d 100644 --- a/drivers/infiniband/hw/hfi1/sdma.c +++ b/drivers/infiniband/hw/hfi1/sdma.c @@ -3160,8 +3160,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) { int rval = 0;
- tx->num_desc++; - if ((unlikely(tx->num_desc == tx->desc_limit))) { + if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) { rval = _extend_sdma_tx_descs(dd, tx); if (rval) { __sdma_txclean(dd, tx); @@ -3174,6 +3173,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) SDMA_MAP_NONE, dd->sdma_pad_phys, sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); + tx->num_desc++; _sdma_close_tx(dd, tx); return rval; } diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h index d8170fcbfbdd5..b023fc461bd51 100644 --- a/drivers/infiniband/hw/hfi1/sdma.h +++ b/drivers/infiniband/hw/hfi1/sdma.h @@ -631,14 +631,13 @@ static inline void sdma_txclean(struct hfi1_devdata *dd, struct sdma_txreq *tx) static inline void _sdma_close_tx(struct hfi1_devdata *dd, struct sdma_txreq *tx) { - tx->descp[tx->num_desc].qw[0] |= - SDMA_DESC0_LAST_DESC_FLAG; - tx->descp[tx->num_desc].qw[1] |= - dd->default_desc1; + u16 last_desc = tx->num_desc - 1; + + tx->descp[last_desc].qw[0] |= SDMA_DESC0_LAST_DESC_FLAG; + tx->descp[last_desc].qw[1] |= dd->default_desc1; if (tx->flags & SDMA_TXREQ_F_URGENT) - tx->descp[tx->num_desc].qw[1] |= - (SDMA_DESC1_HEAD_TO_HOST_FLAG | - SDMA_DESC1_INT_REQ_FLAG); + tx->descp[last_desc].qw[1] |= (SDMA_DESC1_HEAD_TO_HOST_FLAG | + SDMA_DESC1_INT_REQ_FLAG); }
static inline int _sdma_txadd_daddr( @@ -655,6 +654,7 @@ static inline int _sdma_txadd_daddr( type, addr, len); WARN_ON(len > tx->tlen); + tx->num_desc++; tx->tlen -= len; /* special cases for last */ if (!tx->tlen) { @@ -666,7 +666,6 @@ static inline int _sdma_txadd_daddr( _sdma_close_tx(dd, tx); } } - tx->num_desc++; return rval; }
From: Christoph Hellwig hch@lst.de
[ Upstream commit a899d542b687c9b04ccbd9eefabc829ba5fef791 ]
This reverts commit fc156629b23a21181e473e60341e3a78af25a1d4.
This commit manages to do three API violations at once:
- dereference the return value of dma_alloc_attrs with the DMA_ATTR_NO_KERNEL_MAPPING mapping, which is clearly forbidden and will do the wrong thing on various dma mapping implementations. The fact that dma-direct uses a struct page as a cookie is an undocumented implementation detail - include dma-map-ops.h and use pgprot_dmacoherent despite a clear comment documenting that this is not acceptable - use of the VM_DMA_COHERENT for something that is not the dma-mapping code - use of VM_FLUSH_RESET_PERMS for vmap, while it is only supported for vmalloc
Acked-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Signed-off-by: Christoph Hellwig hch@lst.de Signed-off-by: Sibi Sankar quic_sibis@quicinc.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230117085840.32356-6-quic_sibis@quicinc.com Stable-dep-of: 57f72170a2b2 ("remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/remoteproc/qcom_q6v5_mss.c | 38 +++++------------------------- 1 file changed, 6 insertions(+), 32 deletions(-)
diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c index fddb63cffee07..a8b141db4de63 100644 --- a/drivers/remoteproc/qcom_q6v5_mss.c +++ b/drivers/remoteproc/qcom_q6v5_mss.c @@ -10,7 +10,6 @@ #include <linux/clk.h> #include <linux/delay.h> #include <linux/devcoredump.h> -#include <linux/dma-map-ops.h> #include <linux/dma-mapping.h> #include <linux/interrupt.h> #include <linux/kernel.h> @@ -933,52 +932,27 @@ static void q6v5proc_halt_axi_port(struct q6v5 *qproc, static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, const char *fw_name) { - unsigned long dma_attrs = DMA_ATTR_FORCE_CONTIGUOUS | DMA_ATTR_NO_KERNEL_MAPPING; - unsigned long flags = VM_DMA_COHERENT | VM_FLUSH_RESET_PERMS; - struct page **pages; - struct page *page; + unsigned long dma_attrs = DMA_ATTR_FORCE_CONTIGUOUS; dma_addr_t phys; void *metadata; int mdata_perm; int xferop_ret; size_t size; - void *vaddr; - int count; + void *ptr; int ret; - int i;
metadata = qcom_mdt_read_metadata(fw, &size, fw_name, qproc->dev); if (IS_ERR(metadata)) return PTR_ERR(metadata);
- page = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); - if (!page) { + ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); + if (!ptr) { kfree(metadata); dev_err(qproc->dev, "failed to allocate mdt buffer\n"); return -ENOMEM; }
- count = PAGE_ALIGN(size) >> PAGE_SHIFT; - pages = kmalloc_array(count, sizeof(struct page *), GFP_KERNEL); - if (!pages) { - ret = -ENOMEM; - goto free_dma_attrs; - } - - for (i = 0; i < count; i++) - pages[i] = nth_page(page, i); - - vaddr = vmap(pages, count, flags, pgprot_dmacoherent(PAGE_KERNEL)); - kfree(pages); - if (!vaddr) { - dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n", &phys, size); - ret = -EBUSY; - goto free_dma_attrs; - } - - memcpy(vaddr, metadata, size); - - vunmap(vaddr); + memcpy(ptr, metadata, size);
/* Hypervisor mapping to access metadata by modem */ mdata_perm = BIT(QCOM_SCM_VMID_HLOS); @@ -1008,7 +982,7 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, "mdt buffer not reclaimed system may become unstable\n");
free_dma_attrs: - dma_free_attrs(qproc->dev, size, page, phys, dma_attrs); + dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); kfree(metadata);
return ret < 0 ? ret : 0;
From: Sibi Sankar quic_sibis@quicinc.com
[ Upstream commit 57f72170a2b2a362c35bb9407fc844eac5afdec1 ]
Any access to the dynamically allocated metadata region by the application processor after assigning it to the remote Q6 will result in a XPU violation. Fix this by replacing the dynamically allocated memory region with a no-map carveout and unmap the modem metadata memory region before passing control to the remote Q6.
Reported-and-tested-by: Amit Pundir amit.pundir@linaro.org Fixes: 6c5a9dc2481b ("remoteproc: qcom: Make secure world call for mem ownership switch") Signed-off-by: Sibi Sankar quic_sibis@quicinc.com Reviewed-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230117085840.32356-7-quic_sibis@quicinc.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/remoteproc/qcom_q6v5_mss.c | 59 +++++++++++++++++++++++++++--- 1 file changed, 53 insertions(+), 6 deletions(-)
diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c index a8b141db4de63..7dbab5fcbe1e7 100644 --- a/drivers/remoteproc/qcom_q6v5_mss.c +++ b/drivers/remoteproc/qcom_q6v5_mss.c @@ -17,6 +17,7 @@ #include <linux/module.h> #include <linux/of_address.h> #include <linux/of_device.h> +#include <linux/of_reserved_mem.h> #include <linux/platform_device.h> #include <linux/pm_domain.h> #include <linux/pm_runtime.h> @@ -210,6 +211,9 @@ struct q6v5 { size_t mba_size; size_t dp_size;
+ phys_addr_t mdata_phys; + size_t mdata_size; + phys_addr_t mpss_phys; phys_addr_t mpss_reloc; size_t mpss_size; @@ -945,15 +949,35 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, if (IS_ERR(metadata)) return PTR_ERR(metadata);
- ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); - if (!ptr) { - kfree(metadata); - dev_err(qproc->dev, "failed to allocate mdt buffer\n"); - return -ENOMEM; + if (qproc->mdata_phys) { + if (size > qproc->mdata_size) { + ret = -EINVAL; + dev_err(qproc->dev, "metadata size outside memory range\n"); + goto free_metadata; + } + + phys = qproc->mdata_phys; + ptr = memremap(qproc->mdata_phys, size, MEMREMAP_WC); + if (!ptr) { + ret = -EBUSY; + dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n", + &qproc->mdata_phys, size); + goto free_metadata; + } + } else { + ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); + if (!ptr) { + ret = -ENOMEM; + dev_err(qproc->dev, "failed to allocate mdt buffer\n"); + goto free_metadata; + } }
memcpy(ptr, metadata, size);
+ if (qproc->mdata_phys) + memunmap(ptr); + /* Hypervisor mapping to access metadata by modem */ mdata_perm = BIT(QCOM_SCM_VMID_HLOS); ret = q6v5_xfer_mem_ownership(qproc, &mdata_perm, false, true, @@ -982,7 +1006,9 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw, "mdt buffer not reclaimed system may become unstable\n");
free_dma_attrs: - dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); + if (!qproc->mdata_phys) + dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); +free_metadata: kfree(metadata);
return ret < 0 ? ret : 0; @@ -1810,6 +1836,7 @@ static int q6v5_init_reset(struct q6v5 *qproc) static int q6v5_alloc_memory_region(struct q6v5 *qproc) { struct device_node *child; + struct reserved_mem *rmem; struct device_node *node; struct resource r; int ret; @@ -1856,6 +1883,26 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc) qproc->mpss_phys = qproc->mpss_reloc = r.start; qproc->mpss_size = resource_size(&r);
+ if (!child) { + node = of_parse_phandle(qproc->dev->of_node, "memory-region", 2); + } else { + child = of_get_child_by_name(qproc->dev->of_node, "metadata"); + node = of_parse_phandle(child, "memory-region", 0); + of_node_put(child); + } + + if (!node) + return 0; + + rmem = of_reserved_mem_lookup(node); + if (!rmem) { + dev_err(qproc->dev, "unable to resolve metadata region\n"); + return -EINVAL; + } + + qproc->mdata_phys = rmem->base; + qproc->mdata_size = rmem->size; + return 0; }
From: Gaosheng Cui cuigaosheng1@huawei.com
[ Upstream commit 7acd650a0484d92985a0d6d867d980c6dd019885 ]
The memory of ctx is allocated in cal_ctx_create(), but it will not be freed when cal_ctx_v4l2_init() fails, so add kfree() when cal_ctx_v4l2_init() fails to fix it.
Fixes: d68a94e98a89 ("media: ti-vpe: cal: Split video device initialization and registration") Signed-off-by: Gaosheng Cui cuigaosheng1@huawei.com Signed-off-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/ti/cal/cal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/ti/cal/cal.c b/drivers/media/platform/ti/cal/cal.c index 56b61c0583cf8..1236215ec70eb 100644 --- a/drivers/media/platform/ti/cal/cal.c +++ b/drivers/media/platform/ti/cal/cal.c @@ -1050,8 +1050,10 @@ static struct cal_ctx *cal_ctx_create(struct cal_dev *cal, int inst) ctx->cport = inst;
ret = cal_ctx_v4l2_init(ctx); - if (ret) + if (ret) { + kfree(ctx); return NULL; + }
return ctx; }
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 ]
Add check for the return value of devm_regulator_get since it may return error pointer.
Fixes: 448de7e7850b ("[media] omap3isp: OMAP3 ISP core") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Signed-off-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/ti/omap3isp/isp.c | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/drivers/media/platform/ti/omap3isp/isp.c b/drivers/media/platform/ti/omap3isp/isp.c index 1d40bb59ff814..e7327e38482de 100644 --- a/drivers/media/platform/ti/omap3isp/isp.c +++ b/drivers/media/platform/ti/omap3isp/isp.c @@ -2307,7 +2307,16 @@ static int isp_probe(struct platform_device *pdev)
/* Regulators */ isp->isp_csiphy1.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy1"); + if (IS_ERR(isp->isp_csiphy1.vdd)) { + ret = PTR_ERR(isp->isp_csiphy1.vdd); + goto error; + } + isp->isp_csiphy2.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy2"); + if (IS_ERR(isp->isp_csiphy2.vdd)) { + ret = PTR_ERR(isp->isp_csiphy2.vdd); + goto error; + }
/* Clocks *
From: Yang Yingliang yangyingliang@huawei.com
[ Upstream commit cea606d9e996a77eed57fc60709e0728341450e3 ]
Add missing clk_disable_unprepare(), if imx7_csi_dma_setup() fails in imx7_csi_init().
Fixes: ff43ca911978 ("media: imx: imx7-media-csi: Move CSI configuration before source start") Signed-off-by: Yang Yingliang yangyingliang@huawei.com Reviewed-by: Rui Miguel Silva rmfrfs@gmail.com Signed-off-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/nxp/imx7-media-csi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/nxp/imx7-media-csi.c b/drivers/media/platform/nxp/imx7-media-csi.c index 886374d3a6ff1..1ef92c8c0098c 100644 --- a/drivers/media/platform/nxp/imx7-media-csi.c +++ b/drivers/media/platform/nxp/imx7-media-csi.c @@ -638,8 +638,10 @@ static int imx7_csi_init(struct imx7_csi *csi) imx7_csi_configure(csi);
ret = imx7_csi_dma_setup(csi); - if (ret < 0) + if (ret < 0) { + clk_disable_unprepare(csi->mclk); return ret; + }
return 0; }
From: Nathan Chancellor nathan@kernel.org
[ Upstream commit 31f48f16264bc70962fb3e7ec62da64d0a2ba04a ]
When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it points out that KBUILD_AFLAGS contains a linker flag, which will be unused:
clang: error: -Wl,-a32: 'linker' input unused [-Werror,-Wunused-command-line-argument]
This was likely supposed to be '-Wa,-a$(BITS)'. However, this change is unnecessary, as all supported versions of clang and gcc will pass '-a64' or '-a32' to GNU as based on the value of '-m'; the behavior of the latest stable release of the oldest supported major version of each compiler is shown below and each compiler's latest release exhibits the same behavior (GCC 12.2.0 and Clang 15.0.6).
$ powerpc64-linux-gcc --version | head -1 powerpc64-linux-gcc (GCC) 5.5.0
$ powerpc64-linux-gcc -m64 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as ' .../as -a64 -mppc64 -many -mbig -o /dev/null /tmp/cctwuBzZ.s
$ powerpc64-linux-gcc -m32 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as ' .../as -a32 -mppc -many -mbig -o /dev/null /tmp/ccaZP4mF.sg
$ clang --version | head -1 Ubuntu clang version 11.1.0-++20211011094159+1fdec59bffc1-1~exp1~20211011214622.5
$ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \ -x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as "/usr/bin/powerpc64-linux-gnu-as" "-a64" "-mppc64" "-many" "-o" "/dev/null" "/tmp/null-80267c.s"
$ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \ -x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as "/usr/bin/powerpc64-linux-gnu-as" "-a32" "-mppc" "-many" "-o" "/dev/null" "/tmp/null-ab8f8d.s"
Remove this flag altogether to avoid future issues.
Fixes: 1421dc6d4829 ("powerpc/kbuild: Use flags variables rather than overriding LD/CC/AS") Signed-off-by: Nathan Chancellor nathan@kernel.org Reviewed-by: Nick Desaulniers ndesaulniers@google.com Tested-by: Linux Kernel Functional Testing lkft@linaro.org Tested-by: Anders Roxell anders.roxell@linaro.org Acked-by: Michael Ellerman mpe@ellerman.id.au Signed-off-by: Masahiro Yamada masahiroy@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/powerpc/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile index dc4cbf0a5ca95..4fd630efe39d3 100644 --- a/arch/powerpc/Makefile +++ b/arch/powerpc/Makefile @@ -90,7 +90,7 @@ aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian
ifeq ($(HAS_BIARCH),y) KBUILD_CFLAGS += -m$(BITS) -KBUILD_AFLAGS += -m$(BITS) -Wl,-a$(BITS) +KBUILD_AFLAGS += -m$(BITS) KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION) endif
From: Nathan Chancellor nathan@kernel.org
[ Upstream commit fd8589dce8107e2ce62e92f76089654462dd67b4 ]
When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it points out that there is a linking phase flag added to CFLAGS, which will only be used for compiling
clang-16: error: argument unused during compilation: '-shared' [-Werror,-Wunused-command-line-argument]
'-shared' is already present in ldflags-y so it can just be dropped.
Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") Signed-off-by: Nathan Chancellor nathan@kernel.org Acked-by: Heiko Carstens hca@linux.ibm.com Reviewed-by: Sven Schnelle svens@linux.ibm.com Tested-by: Linux Kernel Functional Testing lkft@linaro.org Tested-by: Anders Roxell anders.roxell@linaro.org Signed-off-by: Masahiro Yamada masahiroy@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/kernel/vdso64/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile index 9e2b95a222a98..1605ba45ac4c0 100644 --- a/arch/s390/kernel/vdso64/Makefile +++ b/arch/s390/kernel/vdso64/Makefile @@ -25,7 +25,7 @@ KBUILD_AFLAGS_64 := $(filter-out -m64,$(KBUILD_AFLAGS)) KBUILD_AFLAGS_64 += -m64 -s
KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS)) -KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin +KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \ --hash-style=both --build-id=sha1 -T
From: Bastian Germann bage@linutronix.de
[ Upstream commit c9f9cf2560e40b62015c6c4a04be60f55ce5240e ]
For each binary Debian package, a directory with the package name is created in the debian directory. Correct the generated file matches in the package's clean target, which were renamed without adjusting the target.
Fixes: 1694e94e4f46 ("builddeb: match temporary directory name to the package name") Signed-off-by: Bastian Germann bage@linutronix.de Signed-off-by: Masahiro Yamada masahiroy@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- scripts/package/mkdebian | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian index 6cf383225b8b5..c3bbef7a6754f 100755 --- a/scripts/package/mkdebian +++ b/scripts/package/mkdebian @@ -236,7 +236,7 @@ binary-arch: build-arch KBUILD_BUILD_VERSION=${revision} -f $(srctree)/Makefile intdeb-pkg
clean: - rm -rf debian/*tmp debian/files + rm -rf debian/files debian/linux-* $(MAKE) clean
binary: binary-arch
From: Shang XiaoJing shangxiaojing@huawei.com
[ Upstream commit 8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2 ]
There is a kmemleak when testing the media/i2c/max9286.c with bpf mock device:
kmemleak: 5 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
unreferenced object 0xffff88810defc400 (size 256): comm "python3", pid 278, jiffies 4294737563 (age 31.978s) hex dump (first 32 bytes): 28 06 a7 0a 81 88 ff ff 00 fe 22 12 81 88 ff ff (........."..... 10 c4 ef 0d 81 88 ff ff 10 c4 ef 0d 81 88 ff ff ................ backtrace: [<00000000191de6a7>] __kmalloc_node+0x44/0x1b0 [<000000002f4912b7>] kvmalloc_node+0x34/0x180 [<0000000057dc4cae>] v4l2_ctrl_new+0x325/0x10f0 [videodev] [<0000000026030272>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] [<00000000f0d9ea2f>] max9286_probe+0x76e/0xbff [max9286] [<00000000ea8f6455>] i2c_device_probe+0x28d/0x680 [<0000000087529af3>] really_probe+0x17c/0x3f0 [<00000000b08be526>] __driver_probe_device+0xe3/0x170 [<000000004382edea>] driver_probe_device+0x49/0x120 [<000000007bde528a>] __device_attach_driver+0xf7/0x150 [<000000009f9c6ab4>] bus_for_each_drv+0x114/0x180 [<00000000c8aaf588>] __device_attach+0x1e5/0x2d0 [<0000000041cc06b9>] bus_probe_device+0x126/0x140 [<000000002309860d>] device_add+0x810/0x1130 [<000000002827bf98>] i2c_new_client_device+0x359/0x4f0 [<00000000593bdc85>] of_i2c_register_device+0xf1/0x110
max9286_v4l2_register() calls v4l2_ctrl_new_std(), but won't free the created v412_ctrl when fwnode_graph_get_endpoint_by_id() failed, which causes the memleak. Call v4l2_ctrl_handler_free() to free the v412_ctrl.
Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver") Signed-off-by: Shang XiaoJing shangxiaojing@huawei.com Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/max9286.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c index 9c083cf142319..d034a67042e35 100644 --- a/drivers/media/i2c/max9286.c +++ b/drivers/media/i2c/max9286.c @@ -932,6 +932,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv) err_put_node: fwnode_handle_put(ep); err_async: + v4l2_ctrl_handler_free(&priv->ctrls); max9286_v4l2_notifier_unregister(priv);
return ret;
From: Shang XiaoJing shangxiaojing@huawei.com
[ Upstream commit 2d899592ed7829d0d5140853bac4d58742a6b8af ]
There is a kmemleak when testing the media/i2c/ov2740.c with bpf mock device:
unreferenced object 0xffff8881090e19e0 (size 16): comm "51-i2c-ov2740", pid 278, jiffies 4294781584 (age 23.613s) hex dump (first 16 bytes): 00 f3 7c 0b 81 88 ff ff 80 75 6a 09 81 88 ff ff ..|......uj..... backtrace: [<000000004e9fad8f>] __kmalloc_node+0x44/0x1b0 [<0000000039c802f4>] kvmalloc_node+0x34/0x180 [<000000009b8b5c63>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [<0000000038644056>] ov2740_probe+0x37d/0x84f [ov2740] [<0000000092489f59>] i2c_device_probe+0x28d/0x680 [<000000001038babe>] really_probe+0x17c/0x3f0 [<0000000098c7af1c>] __driver_probe_device+0xe3/0x170 [<00000000e1b3dc24>] device_driver_attach+0x34/0x80 [<000000005a04a34d>] bind_store+0x10b/0x1a0 [<00000000ce25d4f2>] drv_attr_store+0x49/0x70 [<000000007d9f4e9a>] sysfs_kf_write+0x8c/0xb0 [<00000000be6cff0f>] kernfs_fop_write_iter+0x216/0x2e0 [<0000000031ddb40a>] vfs_write+0x658/0x810 [<0000000041beecdd>] ksys_write+0xd6/0x1b0 [<0000000023755840>] do_syscall_64+0x38/0x90 [<00000000b2cc2da2>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
ov2740_init_controls() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak.
Fixes: 866edc895171 ("media: i2c: Add ov2740 image sensor driver") Signed-off-by: Shang XiaoJing shangxiaojing@huawei.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/ov2740.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov2740.c b/drivers/media/i2c/ov2740.c index f3731f932a946..89d126240c345 100644 --- a/drivers/media/i2c/ov2740.c +++ b/drivers/media/i2c/ov2740.c @@ -629,8 +629,10 @@ static int ov2740_init_controls(struct ov2740 *ov2740) V4L2_CID_TEST_PATTERN, ARRAY_SIZE(ov2740_test_pattern_menu) - 1, 0, 0, ov2740_test_pattern_menu); - if (ctrl_hdlr->error) + if (ctrl_hdlr->error) { + v4l2_ctrl_handler_free(ctrl_hdlr); return ctrl_hdlr->error; + }
ov2740->sd.ctrl_handler = ctrl_hdlr;
From: Shang XiaoJing shangxiaojing@huawei.com
[ Upstream commit dd74ed6c213003533e3abf4c204374ef01d86978 ]
There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock device:
AssertionError: unreferenced object 0xffff888107362160 (size 16): comm "python3", pid 277, jiffies 4294832798 (age 20.722s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0 [<000000008a725aac>] kvmalloc_node+0x34/0x180 [<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675] [<00000000153d886c>] i2c_device_probe+0x28d/0x680 [<000000004afb7e8f>] really_probe+0x17c/0x3f0 [<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170 [<000000000a001029>] driver_probe_device+0x49/0x120 [<00000000e39743c7>] __device_attach_driver+0xf7/0x150 [<00000000d32fd070>] bus_for_each_drv+0x114/0x180 [<000000009083ac41>] __device_attach+0x1e5/0x2d0 [<0000000015b4a830>] bus_probe_device+0x126/0x140 [<000000007813deaf>] device_add+0x810/0x1130 [<000000007becb867>] i2c_new_client_device+0x386/0x540 [<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110 [<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0
ov5675_init_controls() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak.
Fixes: bf27502b1f3b ("media: ov5675: Add support for OV5675 sensor") Signed-off-by: Shang XiaoJing shangxiaojing@huawei.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/ov5675.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov5675.c b/drivers/media/i2c/ov5675.c index 94dc8cb7a7c00..a6e6b367d1283 100644 --- a/drivers/media/i2c/ov5675.c +++ b/drivers/media/i2c/ov5675.c @@ -820,8 +820,10 @@ static int ov5675_init_controls(struct ov5675 *ov5675) v4l2_ctrl_new_std(ctrl_hdlr, &ov5675_ctrl_ops, V4L2_CID_VFLIP, 0, 1, 1, 0);
- if (ctrl_hdlr->error) + if (ctrl_hdlr->error) { + v4l2_ctrl_handler_free(ctrl_hdlr); return ctrl_hdlr->error; + }
ov5675->sd.ctrl_handler = ctrl_hdlr;
From: Marco Felsch m.felsch@pengutronix.de
[ Upstream commit 0605081142070a41de8f1deb8fdaeb8677e97741 ]
It was intended to return an error if tc358746_update_bits() call fail. Fix this by storing the return code.
Addresses-Coverity-ID: 1527252 ("Control flow issues")
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") Signed-off-by: Marco Felsch m.felsch@pengutronix.de Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/tc358746.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c index d1f552bd81d42..e7f27cbb57907 100644 --- a/drivers/media/i2c/tc358746.c +++ b/drivers/media/i2c/tc358746.c @@ -406,7 +406,7 @@ tc358746_apply_pll_config(struct tc358746 *tc358746)
val = PLL_FRS(ilog2(post)) | RESETB | PLL_EN; mask = PLL_FRS_MASK | RESETB | PLL_EN; - tc358746_update_bits(tc358746, PLLCTL1_REG, mask, val); + err = tc358746_update_bits(tc358746, PLLCTL1_REG, mask, val); if (err) return err;
From: Marco Felsch m.felsch@pengutronix.de
[ Upstream commit 9d33802c8bcf96c4099ffea4f392afa52897e556 ]
Currently we ignore the return value of tc358746_read() and return alawys return 0 which is wrong. Fix this by returning the actual return value of the read operation which is either 0 on success or an error value.
Addresses-Coverity-ID: 1527254 ("Error handling issues")
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") Signed-off-by: Marco Felsch m.felsch@pengutronix.de Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/tc358746.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c index e7f27cbb57907..c5a0df300a06d 100644 --- a/drivers/media/i2c/tc358746.c +++ b/drivers/media/i2c/tc358746.c @@ -988,6 +988,7 @@ static int __maybe_unused tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) { struct tc358746 *tc358746 = to_tc358746(sd); + int err;
/* 32-bit registers starting from CLW_DPHYCONTTX */ reg->size = reg->reg < CLW_DPHYCONTTX_REG ? 2 : 4; @@ -995,12 +996,12 @@ tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) if (!pm_runtime_get_if_in_use(sd->dev)) return 0;
- tc358746_read(tc358746, reg->reg, (u32 *)®->val); + err = tc358746_read(tc358746, reg->reg, (u32 *)®->val);
pm_runtime_mark_last_busy(sd->dev); pm_runtime_put_sync_autosuspend(sd->dev);
- return 0; + return err; }
static int __maybe_unused
From: Marco Felsch m.felsch@pengutronix.de
[ Upstream commit 5ad2e46030ad97de7fdbdaf63bb1af45c7caf3dd ]
Using the u64 v4l2_dbg_register.val directly can lead to unexpected results depending on machine endianness. Fix this by using a local variable which is assigned afterwards. Since tc358746_read() will init the val variable to 0 we can assing it without checking the return value first.
Addresses-Coverity-ID: 1527256 ("Integer handling issues")
Reported-by: coverity-bot keescook+coverity-bot@chromium.org Fixes: 80a21da36051 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") Signed-off-by: Marco Felsch m.felsch@pengutronix.de Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/tc358746.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/tc358746.c b/drivers/media/i2c/tc358746.c index c5a0df300a06d..4063754a67320 100644 --- a/drivers/media/i2c/tc358746.c +++ b/drivers/media/i2c/tc358746.c @@ -988,6 +988,7 @@ static int __maybe_unused tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) { struct tc358746 *tc358746 = to_tc358746(sd); + u32 val; int err;
/* 32-bit registers starting from CLW_DPHYCONTTX */ @@ -996,7 +997,8 @@ tc358746_g_register(struct v4l2_subdev *sd, struct v4l2_dbg_register *reg) if (!pm_runtime_get_if_in_use(sd->dev)) return 0;
- err = tc358746_read(tc358746, reg->reg, (u32 *)®->val); + err = tc358746_read(tc358746, reg->reg, &val); + reg->val = val;
pm_runtime_mark_last_busy(sd->dev); pm_runtime_put_sync_autosuspend(sd->dev);
From: Jai Luthra j-luthra@ti.com
[ Upstream commit decea0a98b7ac04536c7d659f74783e8d67a06c0 ]
Move the register-based reset out of the init_setting[] and into the powerup_sequence function. The sensor is power cycled and reset using the gpio pins so the soft reset is not always necessary.
This also ensures that soft reset honors the timing sequence from the datasheet [1].
[1] https://cdn.sparkfun.com/datasheets/Sensors/LightImaging/OV5640_datasheet.pd...
Fixes: 19a81c1426c1 ("[media] add Omnivision OV5640 sensor driver") Reported-by: Nishanth Menon nm@ti.com Suggested-by: Jacopo Mondi jacopo.mondi@ideasonboard.com Signed-off-by: Jai Luthra j-luthra@ti.com Reviewed-by: Jacopo Mondi jacopo.mondi@ideasonaboard.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/ov5640.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-)
diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c index e0f908af581b8..75dada60298b5 100644 --- a/drivers/media/i2c/ov5640.c +++ b/drivers/media/i2c/ov5640.c @@ -50,6 +50,7 @@ #define OV5640_REG_SYS_CTRL0 0x3008 #define OV5640_REG_SYS_CTRL0_SW_PWDN 0x42 #define OV5640_REG_SYS_CTRL0_SW_PWUP 0x02 +#define OV5640_REG_SYS_CTRL0_SW_RST 0x82 #define OV5640_REG_CHIP_ID 0x300a #define OV5640_REG_IO_MIPI_CTRL00 0x300e #define OV5640_REG_PAD_OUTPUT_ENABLE01 0x3017 @@ -532,7 +533,7 @@ static const struct v4l2_mbus_framefmt ov5640_default_fmt = { };
static const struct reg_value ov5640_init_setting[] = { - {0x3103, 0x11, 0, 0}, {0x3008, 0x82, 0, 5}, {0x3008, 0x42, 0, 0}, + {0x3103, 0x11, 0, 0}, {0x3103, 0x03, 0, 0}, {0x3630, 0x36, 0, 0}, {0x3631, 0x0e, 0, 0}, {0x3632, 0xe2, 0, 0}, {0x3633, 0x12, 0, 0}, {0x3621, 0xe0, 0, 0}, {0x3704, 0xa0, 0, 0}, {0x3703, 0x5a, 0, 0}, @@ -2429,19 +2430,32 @@ static void ov5640_reset(struct ov5640_dev *sensor) if (!sensor->reset_gpio) return;
- gpiod_set_value_cansleep(sensor->reset_gpio, 0); + if (sensor->pwdn_gpio) { + gpiod_set_value_cansleep(sensor->reset_gpio, 0);
- /* camera power cycle */ - ov5640_power(sensor, false); - usleep_range(5000, 10000); - ov5640_power(sensor, true); - usleep_range(5000, 10000); + /* camera power cycle */ + ov5640_power(sensor, false); + usleep_range(5000, 10000); + ov5640_power(sensor, true); + usleep_range(5000, 10000);
- gpiod_set_value_cansleep(sensor->reset_gpio, 1); - usleep_range(1000, 2000); + gpiod_set_value_cansleep(sensor->reset_gpio, 1); + usleep_range(1000, 2000);
- gpiod_set_value_cansleep(sensor->reset_gpio, 0); + gpiod_set_value_cansleep(sensor->reset_gpio, 0); + } else { + /* software reset */ + ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, + OV5640_REG_SYS_CTRL0_SW_RST); + } usleep_range(20000, 25000); + + /* + * software standby: allows registers programming; + * exit at restore_mode() for CSI, s_stream(1) for DVP + */ + ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, + OV5640_REG_SYS_CTRL0_SW_PWDN); }
static int ov5640_set_power_on(struct ov5640_dev *sensor)
From: Jai Luthra j-luthra@ti.com
[ Upstream commit d7ff69139908842adf824be4f50c7e9ac5886c04 ]
Some module manufacturers [1][2] don't expose the RESETB and PWDN pins of the sensor directly through the 15-pin FFC connector. Instead wiring ~PWDN gpio to the sensor pins with appropriate delays.
In such cases, reset_gpio will not be available to the driver, but it will still be toggled when the sensor is powered on, and thus we should still honor the wait time of >= 5ms + 1ms + 20ms (see figure 2-3 in [3]) before attempting any i/o operations over SCCB.
Also, rename the function to ov5640_powerup_sequence to better match the datasheet (section 2.7).
[1] https://digilent.com/reference/_media/reference/add-ons/pcam-5c/pcam_5c_sch.... [2] https://www.alinx.com/public/upload/file/AN5641_User_Manual.pdf [3] https://cdn.sparkfun.com/datasheets/Sensors/LightImaging/OV5640_datasheet.pd...
Fixes: 19a81c1426c1 ("[media] add Omnivision OV5640 sensor driver") Reported-by: Nishanth Menon nm@ti.com Signed-off-by: Jai Luthra j-luthra@ti.com Reviewed-by: Jacopo Mondi jacopo.mondi@ideasonboard.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/ov5640.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c index 75dada60298b5..c159f297ab92a 100644 --- a/drivers/media/i2c/ov5640.c +++ b/drivers/media/i2c/ov5640.c @@ -2425,11 +2425,22 @@ static void ov5640_power(struct ov5640_dev *sensor, bool enable) gpiod_set_value_cansleep(sensor->pwdn_gpio, enable ? 0 : 1); }
-static void ov5640_reset(struct ov5640_dev *sensor) +/* + * From section 2.7 power up sequence: + * t0 + t1 + t2 >= 5ms Delay from DOVDD stable to PWDN pull down + * t3 >= 1ms Delay from PWDN pull down to RESETB pull up + * t4 >= 20ms Delay from RESETB pull up to SCCB (i2c) stable + * + * Some modules don't expose RESETB/PWDN pins directly, instead providing a + * "PWUP" GPIO which is wired through appropriate delays and inverters to the + * pins. + * + * In such cases, this gpio should be mapped to pwdn_gpio in the driver, and we + * should still toggle the pwdn_gpio below with the appropriate delays, while + * the calls to reset_gpio will be ignored. + */ +static void ov5640_powerup_sequence(struct ov5640_dev *sensor) { - if (!sensor->reset_gpio) - return; - if (sensor->pwdn_gpio) { gpiod_set_value_cansleep(sensor->reset_gpio, 0);
@@ -2478,8 +2489,7 @@ static int ov5640_set_power_on(struct ov5640_dev *sensor) goto xclk_off; }
- ov5640_reset(sensor); - ov5640_power(sensor, true); + ov5640_powerup_sequence(sensor);
ret = ov5640_init_slave_id(sensor); if (ret)
From: Laurent Pinchart laurent.pinchart@ideasonboard.com
[ Upstream commit a967a3a788028f541e4db54beabcebc3648997db ]
Various functions access the media_device from a pad by going through the entity the pad belongs to. Remove the level of indirection and get the media_device from the pad directly.
Fixes: 9e3576a1ae2b ("media: mc: convert pipeline funcs to take media_pad") Signed-off-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Reviewed-by: Tomi Valkeinen tomi.valkeinen@ideasonboard.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/mc/mc-entity.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c index b8bcbc734eaf4..f268cf66053e1 100644 --- a/drivers/media/mc/mc-entity.c +++ b/drivers/media/mc/mc-entity.c @@ -703,7 +703,7 @@ static int media_pipeline_populate(struct media_pipeline *pipe, __must_check int __media_pipeline_start(struct media_pad *pad, struct media_pipeline *pipe) { - struct media_device *mdev = pad->entity->graph_obj.mdev; + struct media_device *mdev = pad->graph_obj.mdev; struct media_pipeline_pad *err_ppad; struct media_pipeline_pad *ppad; int ret; @@ -851,7 +851,7 @@ EXPORT_SYMBOL_GPL(__media_pipeline_start); __must_check int media_pipeline_start(struct media_pad *pad, struct media_pipeline *pipe) { - struct media_device *mdev = pad->entity->graph_obj.mdev; + struct media_device *mdev = pad->graph_obj.mdev; int ret;
mutex_lock(&mdev->graph_mutex); @@ -888,7 +888,7 @@ EXPORT_SYMBOL_GPL(__media_pipeline_stop);
void media_pipeline_stop(struct media_pad *pad) { - struct media_device *mdev = pad->entity->graph_obj.mdev; + struct media_device *mdev = pad->graph_obj.mdev;
mutex_lock(&mdev->graph_mutex); __media_pipeline_stop(pad); @@ -898,7 +898,7 @@ EXPORT_SYMBOL_GPL(media_pipeline_stop);
__must_check int media_pipeline_alloc_start(struct media_pad *pad) { - struct media_device *mdev = pad->entity->graph_obj.mdev; + struct media_device *mdev = pad->graph_obj.mdev; struct media_pipeline *new_pipe = NULL; struct media_pipeline *pipe; int ret;
From: Yuan Can yuancan@huawei.com
[ Upstream commit 7485edb2b6ca5960205c0a49bedfd09bba30e521 ]
A memory leak was reported when testing ov772x with bpf mock device:
AssertionError: unreferenced object 0xffff888109afa7a8 (size 8): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 8 bytes): 80 22 88 15 81 88 ff ff ."...... backtrace: [<000000009990b438>] __kmalloc_node+0x44/0x1b0 [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 [<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x] [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 [<00000000e0b6db89>] really_probe+0x17c/0x3f0 [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 [<0000000048370519>] driver_probe_device+0x49/0x120 [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 [<00000000358e5596>] __device_attach+0x1e5/0x2d0 [<0000000043f83c5d>] bus_probe_device+0x126/0x140 [<00000000ee0f3046>] device_add+0x810/0x1130 [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 [<00000000a9f2159d>] of_i2c_notify+0x100/0x160 unreferenced object 0xffff888119825c00 (size 256): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 32 bytes): 00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^...... 10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .............. backtrace: [<000000009990b438>] __kmalloc_node+0x44/0x1b0 [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 [<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev] [<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] [<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x] [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 [<00000000e0b6db89>] really_probe+0x17c/0x3f0 [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 [<0000000048370519>] driver_probe_device+0x49/0x120 [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 [<00000000358e5596>] __device_attach+0x1e5/0x2d0 [<0000000043f83c5d>] bus_probe_device+0x126/0x140 [<00000000ee0f3046>] device_add+0x810/0x1130 [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110
The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() are leaked.
Fixes: 1112babde214 ("media: i2c: Copy ov772x soc_camera sensor driver") Signed-off-by: Yuan Can yuancan@huawei.com Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/ov772x.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c index 4189e3fc3d535..a238e63425f8c 100644 --- a/drivers/media/i2c/ov772x.c +++ b/drivers/media/i2c/ov772x.c @@ -1462,7 +1462,7 @@ static int ov772x_probe(struct i2c_client *client) priv->subdev.ctrl_handler = &priv->hdl; if (priv->hdl.error) { ret = priv->hdl.error; - goto error_mutex_destroy; + goto error_ctrl_free; }
priv->clk = clk_get(&client->dev, NULL); @@ -1515,7 +1515,6 @@ static int ov772x_probe(struct i2c_client *client) clk_put(priv->clk); error_ctrl_free: v4l2_ctrl_handler_free(&priv->hdl); -error_mutex_destroy: mutex_destroy(&priv->lock);
return ret;
From: Adam Ford aford173@gmail.com
[ Upstream commit 8508455961d5a9e8907bcfd8dcd58f19d9b6ce47 ]
There are four modes, and each mode has a table of registers. Some of the registers are common to all modes, so create new tables for these common registers to reduce duplicate code.
Signed-off-by: Adam Ford aford173@gmail.com Reviewed-by: Dave Stevenson dave.stevenson@raspberrypi.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Stable-dep-of: ef86447e775f ("media: i2c: imx219: Fix binning for RAW8 capture") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/imx219.c | 206 +++++++++++-------------------------- 1 file changed, 59 insertions(+), 147 deletions(-)
diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c index 77bd79a5954ed..7f44d62047b67 100644 --- a/drivers/media/i2c/imx219.c +++ b/drivers/media/i2c/imx219.c @@ -145,23 +145,61 @@ struct imx219_mode { struct imx219_reg_list reg_list; };
-/* - * Register sets lifted off the i2C interface from the Raspberry Pi firmware - * driver. - * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7. - */ -static const struct imx219_reg mode_3280x2464_regs[] = { - {0x0100, 0x00}, +static const struct imx219_reg imx219_common_regs[] = { + {0x0100, 0x00}, /* Mode Select */ + + /* To Access Addresses 3000-5fff, send the following commands */ {0x30eb, 0x0c}, {0x30eb, 0x05}, {0x300a, 0xff}, {0x300b, 0xff}, {0x30eb, 0x05}, {0x30eb, 0x09}, - {0x0114, 0x01}, - {0x0128, 0x00}, - {0x012a, 0x18}, + + /* PLL Clock Table */ + {0x0301, 0x05}, /* VTPXCK_DIV */ + {0x0303, 0x01}, /* VTSYSCK_DIV */ + {0x0304, 0x03}, /* PREPLLCK_VT_DIV 0x03 = AUTO set */ + {0x0305, 0x03}, /* PREPLLCK_OP_DIV 0x03 = AUTO set */ + {0x0306, 0x00}, /* PLL_VT_MPY */ + {0x0307, 0x39}, + {0x030b, 0x01}, /* OP_SYS_CLK_DIV */ + {0x030c, 0x00}, /* PLL_OP_MPY */ + {0x030d, 0x72}, + + /* Undocumented registers */ + {0x455e, 0x00}, + {0x471e, 0x4b}, + {0x4767, 0x0f}, + {0x4750, 0x14}, + {0x4540, 0x00}, + {0x47b4, 0x14}, + {0x4713, 0x30}, + {0x478b, 0x10}, + {0x478f, 0x10}, + {0x4793, 0x10}, + {0x4797, 0x0e}, + {0x479b, 0x0e}, + + /* Frame Bank Register Group "A" */ + {0x0162, 0x0d}, /* Line_Length_A */ + {0x0163, 0x78}, + {0x0170, 0x01}, /* X_ODD_INC_A */ + {0x0171, 0x01}, /* Y_ODD_INC_A */ + + /* Output setup registers */ + {0x0114, 0x01}, /* CSI 2-Lane Mode */ + {0x0128, 0x00}, /* DPHY Auto Mode */ + {0x012a, 0x18}, /* EXCK_Freq */ {0x012b, 0x00}, +}; + +/* + * Register sets lifted off the i2C interface from the Raspberry Pi firmware + * driver. + * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7. + */ +static const struct imx219_reg mode_3280x2464_regs[] = { {0x0164, 0x00}, {0x0165, 0x00}, {0x0166, 0x0c}, @@ -174,53 +212,15 @@ static const struct imx219_reg mode_3280x2464_regs[] = { {0x016d, 0xd0}, {0x016e, 0x09}, {0x016f, 0xa0}, - {0x0170, 0x01}, - {0x0171, 0x01}, - {0x0174, 0x00}, + {0x0174, 0x00}, /* No-Binning */ {0x0175, 0x00}, - {0x0301, 0x05}, - {0x0303, 0x01}, - {0x0304, 0x03}, - {0x0305, 0x03}, - {0x0306, 0x00}, - {0x0307, 0x39}, - {0x030b, 0x01}, - {0x030c, 0x00}, - {0x030d, 0x72}, {0x0624, 0x0c}, {0x0625, 0xd0}, {0x0626, 0x09}, {0x0627, 0xa0}, - {0x455e, 0x00}, - {0x471e, 0x4b}, - {0x4767, 0x0f}, - {0x4750, 0x14}, - {0x4540, 0x00}, - {0x47b4, 0x14}, - {0x4713, 0x30}, - {0x478b, 0x10}, - {0x478f, 0x10}, - {0x4793, 0x10}, - {0x4797, 0x0e}, - {0x479b, 0x0e}, - {0x0162, 0x0d}, - {0x0163, 0x78}, };
static const struct imx219_reg mode_1920_1080_regs[] = { - {0x0100, 0x00}, - {0x30eb, 0x05}, - {0x30eb, 0x0c}, - {0x300a, 0xff}, - {0x300b, 0xff}, - {0x30eb, 0x05}, - {0x30eb, 0x09}, - {0x0114, 0x01}, - {0x0128, 0x00}, - {0x012a, 0x18}, - {0x012b, 0x00}, - {0x0162, 0x0d}, - {0x0163, 0x78}, {0x0164, 0x02}, {0x0165, 0xa8}, {0x0166, 0x0a}, @@ -233,49 +233,15 @@ static const struct imx219_reg mode_1920_1080_regs[] = { {0x016d, 0x80}, {0x016e, 0x04}, {0x016f, 0x38}, - {0x0170, 0x01}, - {0x0171, 0x01}, - {0x0174, 0x00}, + {0x0174, 0x00}, /* No-Binning */ {0x0175, 0x00}, - {0x0301, 0x05}, - {0x0303, 0x01}, - {0x0304, 0x03}, - {0x0305, 0x03}, - {0x0306, 0x00}, - {0x0307, 0x39}, - {0x030b, 0x01}, - {0x030c, 0x00}, - {0x030d, 0x72}, {0x0624, 0x07}, {0x0625, 0x80}, {0x0626, 0x04}, {0x0627, 0x38}, - {0x455e, 0x00}, - {0x471e, 0x4b}, - {0x4767, 0x0f}, - {0x4750, 0x14}, - {0x4540, 0x00}, - {0x47b4, 0x14}, - {0x4713, 0x30}, - {0x478b, 0x10}, - {0x478f, 0x10}, - {0x4793, 0x10}, - {0x4797, 0x0e}, - {0x479b, 0x0e}, };
static const struct imx219_reg mode_1640_1232_regs[] = { - {0x0100, 0x00}, - {0x30eb, 0x0c}, - {0x30eb, 0x05}, - {0x300a, 0xff}, - {0x300b, 0xff}, - {0x30eb, 0x05}, - {0x30eb, 0x09}, - {0x0114, 0x01}, - {0x0128, 0x00}, - {0x012a, 0x18}, - {0x012b, 0x00}, {0x0164, 0x00}, {0x0165, 0x00}, {0x0166, 0x0c}, @@ -288,53 +254,15 @@ static const struct imx219_reg mode_1640_1232_regs[] = { {0x016d, 0x68}, {0x016e, 0x04}, {0x016f, 0xd0}, - {0x0170, 0x01}, - {0x0171, 0x01}, - {0x0174, 0x01}, + {0x0174, 0x01}, /* x2-Binning */ {0x0175, 0x01}, - {0x0301, 0x05}, - {0x0303, 0x01}, - {0x0304, 0x03}, - {0x0305, 0x03}, - {0x0306, 0x00}, - {0x0307, 0x39}, - {0x030b, 0x01}, - {0x030c, 0x00}, - {0x030d, 0x72}, {0x0624, 0x06}, {0x0625, 0x68}, {0x0626, 0x04}, {0x0627, 0xd0}, - {0x455e, 0x00}, - {0x471e, 0x4b}, - {0x4767, 0x0f}, - {0x4750, 0x14}, - {0x4540, 0x00}, - {0x47b4, 0x14}, - {0x4713, 0x30}, - {0x478b, 0x10}, - {0x478f, 0x10}, - {0x4793, 0x10}, - {0x4797, 0x0e}, - {0x479b, 0x0e}, - {0x0162, 0x0d}, - {0x0163, 0x78}, };
static const struct imx219_reg mode_640_480_regs[] = { - {0x0100, 0x00}, - {0x30eb, 0x05}, - {0x30eb, 0x0c}, - {0x300a, 0xff}, - {0x300b, 0xff}, - {0x30eb, 0x05}, - {0x30eb, 0x09}, - {0x0114, 0x01}, - {0x0128, 0x00}, - {0x012a, 0x18}, - {0x012b, 0x00}, - {0x0162, 0x0d}, - {0x0163, 0x78}, {0x0164, 0x03}, {0x0165, 0xe8}, {0x0166, 0x08}, @@ -347,35 +275,12 @@ static const struct imx219_reg mode_640_480_regs[] = { {0x016d, 0x80}, {0x016e, 0x01}, {0x016f, 0xe0}, - {0x0170, 0x01}, - {0x0171, 0x01}, - {0x0174, 0x03}, + {0x0174, 0x03}, /* x2-analog binning */ {0x0175, 0x03}, - {0x0301, 0x05}, - {0x0303, 0x01}, - {0x0304, 0x03}, - {0x0305, 0x03}, - {0x0306, 0x00}, - {0x0307, 0x39}, - {0x030b, 0x01}, - {0x030c, 0x00}, - {0x030d, 0x72}, {0x0624, 0x06}, {0x0625, 0x68}, {0x0626, 0x04}, {0x0627, 0xd0}, - {0x455e, 0x00}, - {0x471e, 0x4b}, - {0x4767, 0x0f}, - {0x4750, 0x14}, - {0x4540, 0x00}, - {0x47b4, 0x14}, - {0x4713, 0x30}, - {0x478b, 0x10}, - {0x478f, 0x10}, - {0x4793, 0x10}, - {0x4797, 0x0e}, - {0x479b, 0x0e}, };
static const struct imx219_reg raw8_framefmt_regs[] = { @@ -1041,6 +946,13 @@ static int imx219_start_streaming(struct imx219 *imx219) if (ret < 0) return ret;
+ /* Send all registers that are common to all modes */ + ret = imx219_write_regs(imx219, imx219_common_regs, ARRAY_SIZE(imx219_common_regs)); + if (ret) { + dev_err(&client->dev, "%s failed to send mfg header\n", __func__); + goto err_rpm_put; + } + /* Apply default values of current mode */ reg_list = &imx219->mode->reg_list; ret = imx219_write_regs(imx219, reg_list->regs, reg_list->num_of_regs);
From: Jai Luthra j-luthra@ti.com
[ Upstream commit ef86447e775fb1f2ced00d4c7fff2c0a1c63f165 ]
2x2 binning works fine for RAW10 capture, but for RAW8 1232p mode it leads to corrupted frames [1][2].
Using the special 2x2 analog binning mode fixes the issue, but causes artefacts for RAW10 1232p capture. So here we choose the binning mode depending upon the frame format selected.
As both binning modes work fine for 480p RAW8 and RAW10 capture, it can share the same code path as 1232p for selecting binning mode.
[1] https://forums.raspberrypi.com/viewtopic.php?t=332103 [2] https://github.com/raspberrypi/libcamera-apps/issues/281
Fixes: 22da1d56e982 ("media: i2c: imx219: Add support for RAW8 bit bayer format") Signed-off-by: Jai Luthra j-luthra@ti.com Reviewed-by: Dave Stevenson dave.stevenson@raspberrypi.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/imx219.c | 57 ++++++++++++++++++++++++++++++++------ 1 file changed, 49 insertions(+), 8 deletions(-)
diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c index 7f44d62047b67..7a14688f8c228 100644 --- a/drivers/media/i2c/imx219.c +++ b/drivers/media/i2c/imx219.c @@ -89,6 +89,12 @@
#define IMX219_REG_ORIENTATION 0x0172
+/* Binning Mode */ +#define IMX219_REG_BINNING_MODE 0x0174 +#define IMX219_BINNING_NONE 0x0000 +#define IMX219_BINNING_2X2 0x0101 +#define IMX219_BINNING_2X2_ANALOG 0x0303 + /* Test Pattern Control */ #define IMX219_REG_TEST_PATTERN 0x0600 #define IMX219_TEST_PATTERN_DISABLE 0 @@ -143,6 +149,9 @@ struct imx219_mode {
/* Default register values */ struct imx219_reg_list reg_list; + + /* 2x2 binning is used */ + bool binning; };
static const struct imx219_reg imx219_common_regs[] = { @@ -212,8 +221,6 @@ static const struct imx219_reg mode_3280x2464_regs[] = { {0x016d, 0xd0}, {0x016e, 0x09}, {0x016f, 0xa0}, - {0x0174, 0x00}, /* No-Binning */ - {0x0175, 0x00}, {0x0624, 0x0c}, {0x0625, 0xd0}, {0x0626, 0x09}, @@ -233,8 +240,6 @@ static const struct imx219_reg mode_1920_1080_regs[] = { {0x016d, 0x80}, {0x016e, 0x04}, {0x016f, 0x38}, - {0x0174, 0x00}, /* No-Binning */ - {0x0175, 0x00}, {0x0624, 0x07}, {0x0625, 0x80}, {0x0626, 0x04}, @@ -254,8 +259,6 @@ static const struct imx219_reg mode_1640_1232_regs[] = { {0x016d, 0x68}, {0x016e, 0x04}, {0x016f, 0xd0}, - {0x0174, 0x01}, /* x2-Binning */ - {0x0175, 0x01}, {0x0624, 0x06}, {0x0625, 0x68}, {0x0626, 0x04}, @@ -275,8 +278,6 @@ static const struct imx219_reg mode_640_480_regs[] = { {0x016d, 0x80}, {0x016e, 0x01}, {0x016f, 0xe0}, - {0x0174, 0x03}, /* x2-analog binning */ - {0x0175, 0x03}, {0x0624, 0x06}, {0x0625, 0x68}, {0x0626, 0x04}, @@ -390,6 +391,7 @@ static const struct imx219_mode supported_modes[] = { .num_of_regs = ARRAY_SIZE(mode_3280x2464_regs), .regs = mode_3280x2464_regs, }, + .binning = false, }, { /* 1080P 30fps cropped */ @@ -406,6 +408,7 @@ static const struct imx219_mode supported_modes[] = { .num_of_regs = ARRAY_SIZE(mode_1920_1080_regs), .regs = mode_1920_1080_regs, }, + .binning = false, }, { /* 2x2 binned 30fps mode */ @@ -422,6 +425,7 @@ static const struct imx219_mode supported_modes[] = { .num_of_regs = ARRAY_SIZE(mode_1640_1232_regs), .regs = mode_1640_1232_regs, }, + .binning = true, }, { /* 640x480 30fps mode */ @@ -438,6 +442,7 @@ static const struct imx219_mode supported_modes[] = { .num_of_regs = ARRAY_SIZE(mode_640_480_regs), .regs = mode_640_480_regs, }, + .binning = true, }, };
@@ -884,6 +889,35 @@ static int imx219_set_framefmt(struct imx219 *imx219) return -EINVAL; }
+static int imx219_set_binning(struct imx219 *imx219) +{ + if (!imx219->mode->binning) { + return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, + IMX219_REG_VALUE_16BIT, + IMX219_BINNING_NONE); + } + + switch (imx219->fmt.code) { + case MEDIA_BUS_FMT_SRGGB8_1X8: + case MEDIA_BUS_FMT_SGRBG8_1X8: + case MEDIA_BUS_FMT_SGBRG8_1X8: + case MEDIA_BUS_FMT_SBGGR8_1X8: + return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, + IMX219_REG_VALUE_16BIT, + IMX219_BINNING_2X2_ANALOG); + + case MEDIA_BUS_FMT_SRGGB10_1X10: + case MEDIA_BUS_FMT_SGRBG10_1X10: + case MEDIA_BUS_FMT_SGBRG10_1X10: + case MEDIA_BUS_FMT_SBGGR10_1X10: + return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, + IMX219_REG_VALUE_16BIT, + IMX219_BINNING_2X2); + } + + return -EINVAL; +} + static const struct v4l2_rect * __imx219_get_pad_crop(struct imx219 *imx219, struct v4l2_subdev_state *sd_state, @@ -968,6 +1002,13 @@ static int imx219_start_streaming(struct imx219 *imx219) goto err_rpm_put; }
+ ret = imx219_set_binning(imx219); + if (ret) { + dev_err(&client->dev, "%s failed to set binning: %d\n", + __func__, ret); + goto err_rpm_put; + } + /* Apply customized values from user */ ret = __v4l2_ctrl_handler_setup(imx219->sd.ctrl_handler); if (ret)
From: Qiheng Lin linqiheng@huawei.com
[ Upstream commit 1963689bed4d500236938d90c91cdd5e63c1eb28 ]
In case of error, the function mtk_mutex_get() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). And also fix the err_free_mutex case.
Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Signed-off-by: Qiheng Lin linqiheng@huawei.com Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c index 2d1f6ae9f0802..97edcd9d1c817 100644 --- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c +++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c @@ -207,8 +207,8 @@ static int mdp_probe(struct platform_device *pdev) } for (i = 0; i < MDP_PIPE_MAX; i++) { mdp->mdp_mutex[i] = mtk_mutex_get(&mm_pdev->dev); - if (!mdp->mdp_mutex[i]) { - ret = -ENODEV; + if (IS_ERR(mdp->mdp_mutex[i])) { + ret = PTR_ERR(mdp->mdp_mutex[i]); goto err_free_mutex; } } @@ -289,7 +289,8 @@ static int mdp_probe(struct platform_device *pdev) mdp_comp_destroy(mdp); err_free_mutex: for (i = 0; i < MDP_PIPE_MAX; i++) - mtk_mutex_put(mdp->mdp_mutex[i]); + if (!IS_ERR_OR_NULL(mdp->mdp_mutex[i])) + mtk_mutex_put(mdp->mdp_mutex[i]); err_destroy_device: kfree(mdp); err_return:
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit 05fb9ace34b8645cb76f7e3a21b5c7b754329cae ]
Marking a case of the switch statement as unreachable means the compiler treats it as undefined behavior, which is then caught by an objtool warning:
drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.o: warning: objtool: csiphy_lanes_enable() falls through to next function csiphy_lanes_disable()
Instead of simply continuing execution at a random place of the driver, print a warning and return from to the caller, which makes it possible to understand what happens and avoids the warning.
Fixes: 53655d2a0ff2 ("media: camss: csiphy-3ph: add support for SM8250 CSI DPHY") Signed-off-by: Arnd Bergmann arnd@arndb.de Reviewed-by: Robert Foss robert.foss@linaro.org Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c index 451a4c9b3d30d..04baa80494c66 100644 --- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c +++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c @@ -429,7 +429,8 @@ static void csiphy_gen2_config_lanes(struct csiphy_device *csiphy, array_size = ARRAY_SIZE(lane_regs_sm8250[0]); break; default: - unreachable(); + WARN(1, "unknown cspi version\n"); + return; }
for (l = 0; l < 5; l++) {
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit e3f7feb6d89311f369dd4ad903ea62e45328cdbe ]
The new mdp3 driver uses 'select' to force-enable a couple of drivers it depends on. This is error-prone and likely to cause dependency loops as well as warnings like:
WARNING: unmet direct dependencies detected for VIDEO_MEDIATEK_VPU Depends on [n]: MEDIA_SUPPORT [=m] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && V4L_MEM2MEM_DRIVERS [=n] && VIDEO_DEV [=m] && (ARCH_MEDIATEK [=y] || COMPILE_TEST [=y]) Selected by [m]: - VIDEO_MEDIATEK_MDP3 [=m] && MEDIA_SUPPORT [=m] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && (MTK_IOMMU [=m] || COMPILE_TEST [=y]) && VIDEO_DEV [=m] && (ARCH_MEDIATEK [=y] || COMPILE_TEST [=y]) && HAS_DMA [=y] && REMOTEPROC [=y]
This specific warning was already addressed in a previous patch, but there are similar unnecessary 'select' statements, so turn those into 'depends on'. This also means the dependency on ARCH_MEDIATEK is redundant and can be dropped.
Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Fixes: 9195a860ef0a ("media: platform: mtk-mdp3: remove unused VIDEO_MEDIATEK_VPU config") Signed-off-by: Arnd Bergmann arnd@arndb.de Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/mediatek/mdp3/Kconfig | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/mediatek/mdp3/Kconfig b/drivers/media/platform/mediatek/mdp3/Kconfig index 846e759a8f6a9..602329c447501 100644 --- a/drivers/media/platform/mediatek/mdp3/Kconfig +++ b/drivers/media/platform/mediatek/mdp3/Kconfig @@ -3,14 +3,13 @@ config VIDEO_MEDIATEK_MDP3 tristate "MediaTek MDP v3 driver" depends on MTK_IOMMU || COMPILE_TEST depends on VIDEO_DEV - depends on ARCH_MEDIATEK || COMPILE_TEST depends on HAS_DMA depends on REMOTEPROC + depends on MTK_MMSYS + depends on MTK_CMDQ + depends on MTK_SCP select VIDEOBUF2_DMA_CONTIG select V4L2_MEM2MEM_DEV - select MTK_MMSYS - select MTK_CMDQ - select MTK_SCP default n help It is a v4l2 driver and present in MediaTek MT8183 SoC.
From: Ming Qian ming.qian@nxp.com
[ Upstream commit 41959c4f973b837a12061b84d3a436fc64c73a30 ]
The curr pointer has advanced 14 bytes in jpeg_parse_app14_data. 1. jpeg_get_word_be(stream), it goes forward 2 bytes. 2. jpeg_skip(stream, 11), it goes forward 11 bytes. 3. jpeg_get_byte(stream), it goes forward 1 bytes.
so the remain bytes of this segment should be (lp - 2 - 11 - 1), but not (lp - 2 - 11).
if driver skip 1 extra bytes, the following parsing may go wrong.
Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") Signed-off-by: Ming Qian ming.qian@nxp.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c index c2513b775f6a7..75c2af763d55e 100644 --- a/drivers/media/v4l2-core/v4l2-jpeg.c +++ b/drivers/media/v4l2-core/v4l2-jpeg.c @@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, *tf = ret;
/* skip the rest of the segment, this ensures at least it is complete */ - skip = lp - 2 - 11; + skip = lp - 2 - 11 - 1; return jpeg_skip(stream, skip); }
From: Ming Qian ming.qian@nxp.com
[ Upstream commit 251c0ea6efd3c3ea0f8a55fdd96c749a98639bd3 ]
The legal identifier of APP14 is "Adobe\0", but sometimes it may be "This is an unknown APP marker . Compliant decoders must ignore it." In this case, just ignore it. It won't affect the decode result.
Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") Signed-off-by: Ming Qian ming.qian@nxp.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c index 75c2af763d55e..94435a7b68169 100644 --- a/drivers/media/v4l2-core/v4l2-jpeg.c +++ b/drivers/media/v4l2-core/v4l2-jpeg.c @@ -460,7 +460,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, /* Check for "Adobe\0" in Ap1..6 */ if (stream->curr + 6 > stream->end || strncmp(stream->curr, "Adobe\0", 6)) - return -EINVAL; + return jpeg_skip(stream, lp - 2);
/* get to Ap12 */ ret = jpeg_skip(stream, 11);
From: Nicolas Dufresne nicolas.dufresne@collabora.com
[ Upstream commit 29bd426764dee14a09e37700406f4a5920825fcc ]
Since 79c987de8b354, enumerating framesize on format set with "MODE_NONE" (any raw formats) is reporting an invalid frmsize.
Size: Stepwise 0x0 - 0x0 with step 0/0
Before this change, the driver would return EINVAL, which is also invalid but worked in GStreamer. The original intent was not to implement it, hence the -ENOTTY return in this change. While drivers should implement ENUM_FRMSIZE for all formats and queues, this change is limited in scope to fix the regression.
This fixes taking picture in Gnome Cheese software, or any software using GSteamer to encode JPEG with hardware acceleration.
Fixes: 79c987de8b35 ("media: hantro: Use post processor scaling capacities") Reported-by: Robert Mader robert.mader@collabora.com Signed-off-by: Nicolas Dufresne nicolas.dufresne@collabora.com Reviewed-by: Benjamin Gaignard benjamin.gaignard@collabora.com Reviewed-by: Ezequiel Garcia ezequiel@vanguardiasur.com.ar Tested-by: Robert Mader robert.mader@collabora.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/verisilicon/hantro_v4l2.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c index 2c7a805289e7b..30e650edaea8a 100644 --- a/drivers/media/platform/verisilicon/hantro_v4l2.c +++ b/drivers/media/platform/verisilicon/hantro_v4l2.c @@ -161,8 +161,11 @@ static int vidioc_enum_framesizes(struct file *file, void *priv, }
/* For non-coded formats check if postprocessing scaling is possible */ - if (fmt->codec_mode == HANTRO_MODE_NONE && hantro_needs_postproc(ctx, fmt)) { - return hanto_postproc_enum_framesizes(ctx, fsize); + if (fmt->codec_mode == HANTRO_MODE_NONE) { + if (hantro_needs_postproc(ctx, fmt)) + return hanto_postproc_enum_framesizes(ctx, fsize); + else + return -ENOTTY; } else if (fsize->index != 0) { vpu_debug(0, "invalid frame size index (expected 0, got %d)\n", fsize->index);
From: Ming Qian ming.qian@nxp.com
[ Upstream commit 61fe43dc9f454bc3caa99dbdd8f5fa3ba813981a ]
using the api of clk_bulk can simplify the code. and the clock of the jpeg codec may be changed, the clk_bulk api can be compatible with the future change.
Fixes: 4c2e5156d9fa ("media: imx-jpeg: Add pm-runtime support for imx-jpeg") Signed-off-by: Ming Qian ming.qian@nxp.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../media/platform/nxp/imx-jpeg/mxc-jpeg.c | 35 +++++-------------- .../media/platform/nxp/imx-jpeg/mxc-jpeg.h | 4 +-- 2 files changed, 10 insertions(+), 29 deletions(-)
diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c index 6cd015a35f7c4..f085f14d676ad 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c @@ -2472,19 +2472,12 @@ static int mxc_jpeg_probe(struct platform_device *pdev) jpeg->mode = mode;
/* Get clocks */ - jpeg->clk_ipg = devm_clk_get(dev, "ipg"); - if (IS_ERR(jpeg->clk_ipg)) { - dev_err(dev, "failed to get clock: ipg\n"); - ret = PTR_ERR(jpeg->clk_ipg); - goto err_clk; - } - - jpeg->clk_per = devm_clk_get(dev, "per"); - if (IS_ERR(jpeg->clk_per)) { - dev_err(dev, "failed to get clock: per\n"); - ret = PTR_ERR(jpeg->clk_per); + ret = devm_clk_bulk_get_all(&pdev->dev, &jpeg->clks); + if (ret < 0) { + dev_err(dev, "failed to get clock\n"); goto err_clk; } + jpeg->num_clks = ret;
ret = mxc_jpeg_attach_pm_domains(jpeg); if (ret < 0) { @@ -2581,32 +2574,20 @@ static int mxc_jpeg_runtime_resume(struct device *dev) struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev); int ret;
- ret = clk_prepare_enable(jpeg->clk_ipg); - if (ret < 0) { - dev_err(dev, "failed to enable clock: ipg\n"); - goto err_ipg; - } - - ret = clk_prepare_enable(jpeg->clk_per); + ret = clk_bulk_prepare_enable(jpeg->num_clks, jpeg->clks); if (ret < 0) { - dev_err(dev, "failed to enable clock: per\n"); - goto err_per; + dev_err(dev, "failed to enable clock\n"); + return ret; }
return 0; - -err_per: - clk_disable_unprepare(jpeg->clk_ipg); -err_ipg: - return ret; }
static int mxc_jpeg_runtime_suspend(struct device *dev) { struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev);
- clk_disable_unprepare(jpeg->clk_ipg); - clk_disable_unprepare(jpeg->clk_per); + clk_bulk_disable_unprepare(jpeg->num_clks, jpeg->clks);
return 0; } diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h index 8fa8c0aec5a2d..87157db780826 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.h @@ -120,8 +120,8 @@ struct mxc_jpeg_dev { spinlock_t hw_lock; /* hardware access lock */ unsigned int mode; struct mutex lock; /* v4l2 ioctls serialization */ - struct clk *clk_ipg; - struct clk *clk_per; + struct clk_bulk_data *clks; + int num_clks; struct platform_device *pdev; struct device *dev; void __iomem *base_reg;
From: Ming Qian ming.qian@nxp.com
[ Upstream commit 809060c8a357e020010dd8f797a5efd3c5432b13 ]
in the E.2.1 of Rec. ITU-T H.264 (06/2019), 0 of colour primaries is reserved, and 2 is unspecified. driver can map V4L2_COLORSPACE_LAST to 0, and map V4L2_COLORSPACE_DEFAULT to 2.
v4l2_xfer_func and v4l2_ycbcr_encoding are similar case.
Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support") Signed-off-by: Ming Qian ming.qian@nxp.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/amphion/vpu_color.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/amphion/vpu_color.c b/drivers/media/platform/amphion/vpu_color.c index 80b9a53fd1c14..4ae435cbc5cda 100644 --- a/drivers/media/platform/amphion/vpu_color.c +++ b/drivers/media/platform/amphion/vpu_color.c @@ -17,7 +17,7 @@ #include "vpu_helpers.h"
static const u8 colorprimaries[] = { - 0, + V4L2_COLORSPACE_LAST, V4L2_COLORSPACE_REC709, /*Rec. ITU-R BT.709-6*/ 0, 0, @@ -31,7 +31,7 @@ static const u8 colorprimaries[] = { };
static const u8 colortransfers[] = { - 0, + V4L2_XFER_FUNC_LAST, V4L2_XFER_FUNC_709, /*Rec. ITU-R BT.709-6*/ 0, 0, @@ -53,7 +53,7 @@ static const u8 colortransfers[] = { };
static const u8 colormatrixcoefs[] = { - 0, + V4L2_YCBCR_ENC_LAST, V4L2_YCBCR_ENC_709, /*Rec. ITU-R BT.709-6*/ 0, 0,
From: Dong Chuanjian chuanjian@nfschina.com
[ Upstream commit be3ae7cf4326e95bb1d5413b63baabc26f4a1324 ]
When the pointer variable is judged to be null, null is returned directly.
[hverkuil: fix two checkpatch warnings]
Signed-off-by: Dong Chuanjian chuanjian@nfschina.com Acked-by: Nicolas Dufresne nicolas.dufresne@collabora.com Fixes: d3f756ad629b ("media: v4l2: Trace calculated p/b0/b1 initial reflist") Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/v4l2-core/v4l2-h264.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/media/v4l2-core/v4l2-h264.c b/drivers/media/v4l2-core/v4l2-h264.c index 72bd64f651981..c00197d095e75 100644 --- a/drivers/media/v4l2-core/v4l2-h264.c +++ b/drivers/media/v4l2-core/v4l2-h264.c @@ -305,6 +305,8 @@ static const char *format_ref_list_p(const struct v4l2_h264_reflist_builder *bui int n = 0, i;
*out_str = kmalloc(tmp_str_size, GFP_KERNEL); + if (!(*out_str)) + return NULL;
n += snprintf(*out_str + n, tmp_str_size - n, "|");
@@ -343,6 +345,8 @@ static const char *format_ref_list_b(const struct v4l2_h264_reflist_builder *bui int n = 0, i;
*out_str = kmalloc(tmp_str_size, GFP_KERNEL); + if (!(*out_str)) + return NULL;
n += snprintf(*out_str + n, tmp_str_size - n, "|");
From: Duoming Zhou duoming@zju.edu.cn
[ Upstream commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17 ]
When the ene device is detaching, function ene_remove() will be called. But there is no function to cancel tx_sim_timer in ene_remove(), the timer handler ene_tx_irqsim() could race with ene_remove(). As a result, the UAF bugs could happen, the process is shown below.
(cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) ene_remove() | (wait a time) | ene_tx_irqsim() | dev->hw_lock //USE | ene_tx_sample(dev) //USE
Fix by adding del_timer_sync(&dev->tx_sim_timer) in ene_remove(), The tx_sim_timer could stop before ene device is deallocated.
What's more, The rc_unregister_device() and del_timer_sync() should be called first in ene_remove() and the deallocated functions such as free_irq(), release_region() and so on should be called behind them. Because the rc_unregister_device() is well synchronized. Otherwise, race conditions may happen. The situations that may lead to race conditions are shown below.
Firstly, the rx receiver is disabled with ene_rx_disable() before rc_unregister_device() in ene_remove(), which means it can be enabled again if a process opens /dev/lirc0 between ene_rx_disable() and rc_unregister_device().
Secondly, the irqaction descriptor is freed by free_irq() before the rc device is unregistered, which means irqaction descriptor may be accessed again after it is deallocated.
Thirdly, the timer can call ene_tx_sample() that can write to the io ports, which means the io ports could be accessed again after they are deallocated by release_region().
Therefore, the rc_unregister_device() and del_timer_sync() should be called first in ene_remove().
Suggested by: Sean Young sean@mess.org
Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver") Signed-off-by: Duoming Zhou duoming@zju.edu.cn Signed-off-by: Sean Young sean@mess.org Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/rc/ene_ir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c index e09270916fbca..11ee21a7db8f0 100644 --- a/drivers/media/rc/ene_ir.c +++ b/drivers/media/rc/ene_ir.c @@ -1106,6 +1106,8 @@ static void ene_remove(struct pnp_dev *pnp_dev) struct ene_device *dev = pnp_get_drvdata(pnp_dev); unsigned long flags;
+ rc_unregister_device(dev->rdev); + del_timer_sync(&dev->tx_sim_timer); spin_lock_irqsave(&dev->hw_lock, flags); ene_rx_disable(dev); ene_rx_restore_hw_buffer(dev); @@ -1113,7 +1115,6 @@ static void ene_remove(struct pnp_dev *pnp_dev)
free_irq(dev->irq, dev); release_region(dev->hw_io, ENE_IO_SIZE); - rc_unregister_device(dev->rdev); kfree(dev); }
From: Arnd Bergmann arnd@arndb.de
[ Upstream commit be94be1b7fc7e51f9ccef20a0ef76583587275f3 ]
The recent conversion missed the Kconfig bit, so it can now end up in a link error on randconfig builds:
ld.lld: error: undefined symbol: vb2_vmalloc_memops
referenced by atomisp_fops.c drivers/staging/media/atomisp/pci/atomisp_fops.o:(atomisp_open) in archive vmlinux.a
Link: https://lore.kernel.org/r/20230104082212.3770415-1-arnd@kernel.org
Fixes: cb48ae89be3b ("media: atomisp: Convert to videobuf2") Signed-off-by: Arnd Bergmann arnd@arndb.de Tested-by: Andy Shevchenko andy@kernel.org Signed-off-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/staging/media/atomisp/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/atomisp/Kconfig b/drivers/staging/media/atomisp/Kconfig index 2c8d7fdcc5f7a..c9bff98e5309a 100644 --- a/drivers/staging/media/atomisp/Kconfig +++ b/drivers/staging/media/atomisp/Kconfig @@ -14,7 +14,7 @@ config VIDEO_ATOMISP depends on VIDEO_DEV && INTEL_ATOMISP depends on PMIC_OPREGION select IOSF_MBI - select VIDEOBUF_VMALLOC + select VIDEOBUF2_VMALLOC select VIDEO_V4L2_SUBDEV_API help Say Y here if your platform supports Intel Atom SoC
From: Hans de Goede hdegoede@redhat.com
[ Upstream commit 60ec70a71a9f9975a5d2dd4a7d97c20da0e41976 ]
Calling v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode) when the stream is already active (through another /dev/video# node) causes the stream to stop.
Move the call to set the default run-mode so that it is only done on the first open of one of the 4 /dev/video# nodes of one of the 2 streams (atomisp-sub-devices / asd-s).
Fixes: 2c45e343c581 ("media: atomisp: set per-device's default mode") Reviewed-by: Andy Shevchenko andy@kernel.org Signed-off-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/staging/media/atomisp/pci/atomisp_fops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp_fops.c index acea7492847d8..9b9d50d7166a0 100644 --- a/drivers/staging/media/atomisp/pci/atomisp_fops.c +++ b/drivers/staging/media/atomisp/pci/atomisp_fops.c @@ -821,13 +821,13 @@ static int atomisp_open(struct file *file) goto done;
atomisp_subdev_init_struct(asd); + /* Ensure that a mode is set */ + v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode);
done: pipe->users++; mutex_unlock(&isp->mutex);
- /* Ensure that a mode is set */ - v4l2_ctrl_s_ctrl(asd->run_mode, pipe->default_run_mode);
return 0;
From: Hans Verkuil hverkuil-cisco@xs4all.nl
[ Upstream commit 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a ]
If the media bus is unsupported, then return -EINVAL. Instead it returned 'ret' which happened to be 0.
This fixes a smatch warning:
ov7670.c:1843 ov7670_parse_dt() warn: missing error code? 'ret'
Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Fixes: 01b8444828fc ("media: v4l2: i2c: ov7670: Implement OF mbus configuration") Acked-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/i2c/ov7670.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c index 11d3bef65d43c..6e423cbcdc462 100644 --- a/drivers/media/i2c/ov7670.c +++ b/drivers/media/i2c/ov7670.c @@ -1840,7 +1840,7 @@ static int ov7670_parse_dt(struct device *dev,
if (bus_cfg.bus_type != V4L2_MBUS_PARALLEL) { dev_err(dev, "Unsupported media bus type\n"); - return ret; + return -EINVAL; } info->mbus_config = bus_cfg.bus.parallel.flags;
From: Duoming Zhou duoming@zju.edu.cn
[ Upstream commit ebad8e731c1c06adf04621d6fd327b860c0861b5 ]
There are UAF bugs caused by do_submit_urb(). One of the KASan reports is shown below:
[ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890 [ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49 [ 36.408316] [ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8 [ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 [ 36.416157] Workqueue: 0x0 (events) [ 36.417654] Call Trace: [ 36.418546] <TASK> [ 36.419320] dump_stack_lvl+0x96/0xd0 [ 36.420522] print_address_description+0x75/0x350 [ 36.421992] print_report+0x11b/0x250 [ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0 [ 36.424806] ? __virt_addr_valid+0xcf/0x170 [ 36.426069] ? worker_thread+0x4a2/0x890 [ 36.427355] kasan_report+0x131/0x160 [ 36.428556] ? worker_thread+0x4a2/0x890 [ 36.430053] worker_thread+0x4a2/0x890 [ 36.431297] ? worker_clr_flags+0x90/0x90 [ 36.432479] kthread+0x166/0x190 [ 36.433493] ? kthread_blkcg+0x50/0x50 [ 36.434669] ret_from_fork+0x22/0x30 [ 36.435923] </TASK> [ 36.436684] [ 36.437215] Allocated by task 24: [ 36.438289] kasan_set_track+0x50/0x80 [ 36.439436] __kasan_kmalloc+0x89/0xa0 [ 36.440566] smsusb_probe+0x374/0xc90 [ 36.441920] usb_probe_interface+0x2d1/0x4c0 [ 36.443253] really_probe+0x1d5/0x580 [ 36.444539] __driver_probe_device+0xe3/0x130 [ 36.446085] driver_probe_device+0x49/0x220 [ 36.447423] __device_attach_driver+0x19e/0x1b0 [ 36.448931] bus_for_each_drv+0xcb/0x110 [ 36.450217] __device_attach+0x132/0x1f0 [ 36.451470] bus_probe_device+0x59/0xf0 [ 36.452563] device_add+0x4ec/0x7b0 [ 36.453830] usb_set_configuration+0xc63/0xe10 [ 36.455230] usb_generic_driver_probe+0x3b/0x80 [ 36.456166] printk: console [ttyGS0] disabled [ 36.456569] usb_probe_device+0x90/0x110 [ 36.459523] really_probe+0x1d5/0x580 [ 36.461027] __driver_probe_device+0xe3/0x130 [ 36.462465] driver_probe_device+0x49/0x220 [ 36.463847] __device_attach_driver+0x19e/0x1b0 [ 36.465229] bus_for_each_drv+0xcb/0x110 [ 36.466466] __device_attach+0x132/0x1f0 [ 36.467799] bus_probe_device+0x59/0xf0 [ 36.469010] device_add+0x4ec/0x7b0 [ 36.470125] usb_new_device+0x863/0xa00 [ 36.471374] hub_event+0x18c7/0x2220 [ 36.472746] process_one_work+0x34c/0x5b0 [ 36.474041] worker_thread+0x4b7/0x890 [ 36.475216] kthread+0x166/0x190 [ 36.476267] ret_from_fork+0x22/0x30 [ 36.477447] [ 36.478160] Freed by task 24: [ 36.479239] kasan_set_track+0x50/0x80 [ 36.480512] kasan_save_free_info+0x2b/0x40 [ 36.481808] ____kasan_slab_free+0x122/0x1a0 [ 36.483173] __kmem_cache_free+0xc4/0x200 [ 36.484563] smsusb_term_device+0xcd/0xf0 [ 36.485896] smsusb_probe+0xc85/0xc90 [ 36.486976] usb_probe_interface+0x2d1/0x4c0 [ 36.488303] really_probe+0x1d5/0x580 [ 36.489498] __driver_probe_device+0xe3/0x130 [ 36.491140] driver_probe_device+0x49/0x220 [ 36.492475] __device_attach_driver+0x19e/0x1b0 [ 36.493988] bus_for_each_drv+0xcb/0x110 [ 36.495171] __device_attach+0x132/0x1f0 [ 36.496617] bus_probe_device+0x59/0xf0 [ 36.497875] device_add+0x4ec/0x7b0 [ 36.498972] usb_set_configuration+0xc63/0xe10 [ 36.500264] usb_generic_driver_probe+0x3b/0x80 [ 36.501740] usb_probe_device+0x90/0x110 [ 36.503084] really_probe+0x1d5/0x580 [ 36.504241] __driver_probe_device+0xe3/0x130 [ 36.505548] driver_probe_device+0x49/0x220 [ 36.506766] __device_attach_driver+0x19e/0x1b0 [ 36.508368] bus_for_each_drv+0xcb/0x110 [ 36.509646] __device_attach+0x132/0x1f0 [ 36.510911] bus_probe_device+0x59/0xf0 [ 36.512103] device_add+0x4ec/0x7b0 [ 36.513215] usb_new_device+0x863/0xa00 [ 36.514736] hub_event+0x18c7/0x2220 [ 36.516130] process_one_work+0x34c/0x5b0 [ 36.517396] worker_thread+0x4b7/0x890 [ 36.518591] kthread+0x166/0x190 [ 36.519599] ret_from_fork+0x22/0x30 [ 36.520851] [ 36.521405] Last potentially related work creation: [ 36.523143] kasan_save_stack+0x3f/0x60 [ 36.524275] kasan_record_aux_stack_noalloc+0x9d/0xb0 [ 36.525831] insert_work+0x25/0x130 [ 36.527039] __queue_work+0x4d4/0x620 [ 36.528236] queue_work_on+0x72/0xb0 [ 36.529344] __usb_hcd_giveback_urb+0x13f/0x1b0 [ 36.530819] dummy_timer+0x350/0x1a40 [ 36.532149] call_timer_fn+0x2c/0x190 [ 36.533567] expire_timers+0x69/0x1f0 [ 36.534736] __run_timers+0x289/0x2d0 [ 36.535841] run_timer_softirq+0x2d/0x60 [ 36.537110] __do_softirq+0x116/0x380 [ 36.538377] [ 36.538950] Second to last potentially related work creation: [ 36.540855] kasan_save_stack+0x3f/0x60 [ 36.542084] kasan_record_aux_stack_noalloc+0x9d/0xb0 [ 36.543592] insert_work+0x25/0x130 [ 36.544891] __queue_work+0x4d4/0x620 [ 36.546168] queue_work_on+0x72/0xb0 [ 36.547328] __usb_hcd_giveback_urb+0x13f/0x1b0 [ 36.548805] dummy_timer+0x350/0x1a40 [ 36.550116] call_timer_fn+0x2c/0x190 [ 36.551570] expire_timers+0x69/0x1f0 [ 36.552762] __run_timers+0x289/0x2d0 [ 36.553916] run_timer_softirq+0x2d/0x60 [ 36.555118] __do_softirq+0x116/0x380 [ 36.556239] [ 36.556807] The buggy address belongs to the object at ffff888005960000 [ 36.556807] which belongs to the cache kmalloc-4k of size 4096 [ 36.560652] The buggy address is located 232 bytes inside of [ 36.560652] 4096-byte region [ffff888005960000, ffff888005961000) [ 36.564791] [ 36.565355] The buggy address belongs to the physical page: [ 36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00 [ 36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0 [ 36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000 [ 36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 36.580175] page dumped because: kasan: bad access detected [ 36.581994] [ 36.582548] Memory state around the buggy address: [ 36.583983] ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 36.586240] ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.591071] ^ [ 36.593295] ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.595705] ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 36.598026] ================================================================== [ 36.600224] Disabling lock debugging due to kernel taint [ 36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I [ 36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G B 6.2.0-rc3-15798-8 [ 36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 [ 36.615026] Workqueue: events do_submit_urb [ 36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 [ 36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 [ 36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 [ 36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 [ 36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 [ 36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f [ 36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 [ 36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 [ 36.636438] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 36.639092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 [ 36.643411] Call Trace: [ 36.644215] <TASK> [ 36.644902] smscore_getbuffer+0x3e/0x1e0 [ 36.646147] do_submit_urb+0x4f/0x190 [ 36.647449] process_one_work+0x34c/0x5b0 [ 36.648777] worker_thread+0x4b7/0x890 [ 36.649984] ? worker_clr_flags+0x90/0x90 [ 36.651166] kthread+0x166/0x190 [ 36.652151] ? kthread_blkcg+0x50/0x50 [ 36.653547] ret_from_fork+0x22/0x30 [ 36.655051] </TASK> [ 36.655733] Modules linked in: [ 36.656787] ---[ end trace 0000000000000000 ]--- [ 36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 [ 36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 [ 36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 [ 36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 [ 36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 [ 36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f [ 36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 [ 36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 [ 36.679184] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 36.681655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 [ 36.685733] Kernel panic - not syncing: Fatal exception [ 36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff) [ 36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]---
When the siano device is plugged in, it may call the following functions to initialize the device.
smsusb_probe()-->smsusb_init_device()-->smscore_start_device().
When smscore_start_device() gets failed, the function smsusb_term_device() will be called and smsusb_device_t will be deallocated. Although we use usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests and wait for them to finish, the worker threads that are scheduled by smsusb_onresponse() may be still running. As a result, the UAF bugs could happen.
We add cancel_work_sync() in smsusb_stop_streaming() in order that the worker threads could finish before the smsusb_device_t is deallocated.
Fixes: dd47fbd40e6e ("[media] smsusb: don't sleep while atomic") Signed-off-by: Duoming Zhou duoming@zju.edu.cn Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/usb/siano/smsusb.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c index fe9c7b3a950e8..6f443c542c6da 100644 --- a/drivers/media/usb/siano/smsusb.c +++ b/drivers/media/usb/siano/smsusb.c @@ -179,6 +179,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
for (i = 0; i < MAX_URBS; i++) { usb_kill_urb(&dev->surbs[i].urb); + cancel_work_sync(&dev->surbs[i].wq);
if (dev->surbs[i].cb) { smscore_putbuffer(dev->coredev, dev->surbs[i].cb);
From: Tasos Sahanidis tasos@tasossah.com
[ Upstream commit bc7635c6435c77a0c168e2cc6535740adfaff4e4 ]
The radio device doesn't use vb2, thus calling vb2_video_unregister_device() which results in the following warning being printed on module unload.
WARNING: CPU: 1 PID: 215963 at drivers/media/common/videobuf2/videobuf2-v4l2.c:1236 vb2_video_unregister_device+0xc6/0xe0 [videobuf2_v4l2]
Fixes: 11788d9b7e91 ("media: media/pci: use vb2_video_unregister_device()") Signed-off-by: Tasos Sahanidis tasos@tasossah.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/pci/saa7134/saa7134-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c index 96328b0af1641..cf2871306987c 100644 --- a/drivers/media/pci/saa7134/saa7134-core.c +++ b/drivers/media/pci/saa7134/saa7134-core.c @@ -978,7 +978,7 @@ static void saa7134_unregister_video(struct saa7134_dev *dev) } if (dev->radio_dev) { if (video_is_registered(dev->radio_dev)) - vb2_video_unregister_device(dev->radio_dev); + video_unregister_device(dev->radio_dev); else video_device_release(dev->radio_dev); dev->radio_dev = NULL;
From: Bjorn Andersson quic_bjorande@quicinc.com
[ Upstream commit 3e74ec2f39362bffbd42854acbb67c7f4cb808f9 ]
In the event that an intent advertisement arrives on an unknown channel the fifo is not advanced, resulting in the same message being handled over and over.
Fixes: dacbb35e930f ("rpmsg: glink: Receive and store the remote intent buffers") Signed-off-by: Bjorn Andersson quic_bjorande@quicinc.com Reviewed-by: Chris Lew quic_clew@quicinc.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230214234231.2069751-1-quic_bjorande@quicinc.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/rpmsg/qcom_glink_native.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c index 115c0a1eddb10..bb917746ad4bb 100644 --- a/drivers/rpmsg/qcom_glink_native.c +++ b/drivers/rpmsg/qcom_glink_native.c @@ -954,6 +954,7 @@ static void qcom_glink_handle_intent(struct qcom_glink *glink, spin_unlock_irqrestore(&glink->idr_lock, flags); if (!channel) { dev_err(glink->dev, "intents for non-existing channel\n"); + qcom_glink_rx_advance(glink, ALIGN(msglen, 8)); return; }
From: Bjorn Andersson quic_bjorande@quicinc.com
[ Upstream commit fb80ef67e8ff6a00d3faad4cb348dafdb8eccfd8 ]
Upon termination of the rpmsg_device, driver_override needs to be freed to avoid leaking the potentially assigned string.
Fixes: 42cd402b8fd4 ("rpmsg: Fix kfree() of static memory on setting driver_override") Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device") Reviewed-by: Chris Lew quic_clew@quicinc.com Signed-off-by: Bjorn Andersson quic_bjorande@quicinc.com Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230109223931.1706429-1-quic_bjorande@quicinc.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/rpmsg/qcom_glink_native.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c index bb917746ad4bb..35df1b0a515bf 100644 --- a/drivers/rpmsg/qcom_glink_native.c +++ b/drivers/rpmsg/qcom_glink_native.c @@ -1447,6 +1447,7 @@ static void qcom_glink_rpdev_release(struct device *dev) { struct rpmsg_device *rpdev = to_rpmsg_device(dev);
+ kfree(rpdev->driver_override); kfree(rpdev); }
@@ -1690,6 +1691,7 @@ static void qcom_glink_device_release(struct device *dev)
/* Release qcom_glink_alloc_channel() reference */ kref_put(&channel->refcount, qcom_glink_channel_release); + kfree(rpdev->driver_override); kfree(rpdev); }
From: Liang He windhl@126.com
[ Upstream commit 7c32919a378782c95c72bc028b5c30dfe8c11f82 ]
In omap4_sram_init(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.
Signed-off-by: Liang He windhl@126.com Message-Id: 20220628112939.160737-1-windhl@126.com Signed-off-by: Tony Lindgren tony@atomide.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/mach-omap2/omap4-common.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c index 6d1eb4eefefe5..d9ed2a5dcd5ef 100644 --- a/arch/arm/mach-omap2/omap4-common.c +++ b/arch/arm/mach-omap2/omap4-common.c @@ -140,6 +140,7 @@ static int __init omap4_sram_init(void) __func__); else sram_sync = (void __iomem *)gen_pool_alloc(sram_pool, PAGE_SIZE); + of_node_put(np);
return 0; }
From: Konrad Dybcio konrad.dybcio@linaro.org
[ Upstream commit 67fb53745e0b38275fa0b422b6a3c6c1c028c9a2 ]
On eMMC devices, the UFS clocks aren't started in the bootloader (or well, at least it should not be, as that would just leak power..), which results in platform reboots when trying to access the unclocked UFS hardware, which unfortunately happens on each and every boot, as interconnect calls sync_state and goes over each and every path.
Signed-off-by: Konrad Dybcio konrad.dybcio@linaro.org Reviewed-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Tested-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org #db820c Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20221210200353.418391-6-konrad.dybcio@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/qcom/msm8996.dtsi | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi index a444d9b531228..71678749d66f6 100644 --- a/arch/arm64/boot/dts/qcom/msm8996.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi @@ -830,9 +830,11 @@ a2noc: interconnect@583000 { compatible = "qcom,msm8996-a2noc"; reg = <0x00583000 0x7000>; #interconnect-cells = <1>; - clock-names = "bus", "bus_a"; + clock-names = "bus", "bus_a", "aggre2_ufs_axi", "ufs_axi"; clocks = <&rpmcc RPM_SMD_AGGR2_NOC_CLK>, - <&rpmcc RPM_SMD_AGGR2_NOC_A_CLK>; + <&rpmcc RPM_SMD_AGGR2_NOC_A_CLK>, + <&gcc GCC_AGGRE2_UFS_AXI_CLK>, + <&gcc GCC_UFS_AXI_CLK>; };
mnoc: interconnect@5a4000 {
From: Jan Kara jack@suse.cz
[ Upstream commit 3d2d7e61553dbcc8ba45201d8ae4f383742c8202 ]
Similarly to other filesystems define EFSCORRUPTED error code for reporting internal filesystem corruption.
Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- fs/udf/udf_sb.h | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h index 291b56dd011ee..6bccff3c70f54 100644 --- a/fs/udf/udf_sb.h +++ b/fs/udf/udf_sb.h @@ -55,6 +55,8 @@ #define MF_DUPLICATE_MD 0x01 #define MF_MIRROR_FE_LOADED 0x02
+#define EFSCORRUPTED EUCLEAN + struct udf_meta_data { __u32 s_meta_file_loc; __u32 s_mirror_file_loc;
From: Peter Zijlstra peterz@infradead.org
[ Upstream commit 0e26e1de0032779e43929174339429c16307a299 ]
Low level noinstr context-tracking code is calling out to instrumented code on KASAN:
vmlinux.o: warning: objtool: __ct_user_enter+0x72: call to __kasan_check_write() leaves .noinstr.text section vmlinux.o: warning: objtool: __ct_user_exit+0x47: call to __kasan_check_write() leaves .noinstr.text section
Use even lower level atomic methods to avoid the instrumentation.
Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Signed-off-by: Ingo Molnar mingo@kernel.org Link: https://lore.kernel.org/r/20230112195542.458034262@infradead.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/context_tracking.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c index 77978e3723771..a09f1c19336ae 100644 --- a/kernel/context_tracking.c +++ b/kernel/context_tracking.c @@ -510,7 +510,7 @@ void noinstr __ct_user_enter(enum ctx_state state) * In this we case we don't care about any concurrency/ordering. */ if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) - atomic_set(&ct->state, state); + arch_atomic_set(&ct->state, state); } else { /* * Even if context tracking is disabled on this CPU, because it's outside @@ -527,7 +527,7 @@ void noinstr __ct_user_enter(enum ctx_state state) */ if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) { /* Tracking for vtime only, no concurrent RCU EQS accounting */ - atomic_set(&ct->state, state); + arch_atomic_set(&ct->state, state); } else { /* * Tracking for vtime and RCU EQS. Make sure we don't race @@ -535,7 +535,7 @@ void noinstr __ct_user_enter(enum ctx_state state) * RCU only requires RCU_DYNTICKS_IDX increments to be fully * ordered. */ - atomic_add(state, &ct->state); + arch_atomic_add(state, &ct->state); } } } @@ -630,12 +630,12 @@ void noinstr __ct_user_exit(enum ctx_state state) * In this we case we don't care about any concurrency/ordering. */ if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) - atomic_set(&ct->state, CONTEXT_KERNEL); + arch_atomic_set(&ct->state, CONTEXT_KERNEL);
} else { if (!IS_ENABLED(CONFIG_CONTEXT_TRACKING_IDLE)) { /* Tracking for vtime only, no concurrent RCU EQS accounting */ - atomic_set(&ct->state, CONTEXT_KERNEL); + arch_atomic_set(&ct->state, CONTEXT_KERNEL); } else { /* * Tracking for vtime and RCU EQS. Make sure we don't race @@ -643,7 +643,7 @@ void noinstr __ct_user_exit(enum ctx_state state) * RCU only requires RCU_DYNTICKS_IDX increments to be fully * ordered. */ - atomic_sub(state, &ct->state); + arch_atomic_sub(state, &ct->state); } } }
From: Nicholas Piggin npiggin@gmail.com
[ Upstream commit 001c28e57187570e4b5aa4492c7a957fb6d65d7b ]
If a task oopses with irqs disabled, this can cause various cascading problems in the oops path such as sleep-from-invalid warnings, and potentially worse.
Since commit 0258b5fd7c712 ("coredump: Limit coredumps to a single thread group"), the unconditional irq enable in coredump_task_exit() will "fix" the irq state to be enabled early in do_exit(), so currently this may not be triggerable, but that is coincidental and fragile.
Detect and fix the irqs_disabled() condition in the oops path before calling do_exit(), similarly to the way in_atomic() is handled.
Reported-by: Michael Ellerman mpe@ellerman.id.au Signed-off-by: Nicholas Piggin npiggin@gmail.com Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Acked-by: "Eric W. Biederman" ebiederm@xmission.com Link: https://lore.kernel.org/lkml/20221004094401.708299-1-npiggin@gmail.com/ Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/exit.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/kernel/exit.c b/kernel/exit.c index 15dc2ec80c467..bccfa4218356e 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -807,6 +807,8 @@ void __noreturn do_exit(long code) struct task_struct *tsk = current; int group_dead;
+ WARN_ON(irqs_disabled()); + synchronize_group_exit(tsk, code);
WARN_ON(tsk->plug); @@ -938,6 +940,11 @@ void __noreturn make_task_dead(int signr) if (unlikely(!tsk->pid)) panic("Attempted to kill the idle task!");
+ if (unlikely(irqs_disabled())) { + pr_info("note: %s[%d] exited with irqs disabled\n", + current->comm, task_pid_nr(current)); + local_irq_enable(); + } if (unlikely(in_atomic())) { pr_info("note: %s[%d] exited with preempt_count %d\n", current->comm, task_pid_nr(current),
From: Markuss Broks markuss.broks@gmail.com
[ Upstream commit 5d5aa219a790d61cad2c38e1aa32058f16ad2f0b ]
For some reason, the driver adding support for Exynos5420 MIPI phy back in 2016 wasn't used on Exynos5420, which caused a kernel panic. Add the proper compatible for it.
Signed-off-by: Markuss Broks markuss.broks@gmail.com Link: https://lore.kernel.org/r/20230121201844.46872-2-markuss.broks@gmail.com Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/exynos5420.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi index 9f2523a873d9d..62263eb91b3cc 100644 --- a/arch/arm/boot/dts/exynos5420.dtsi +++ b/arch/arm/boot/dts/exynos5420.dtsi @@ -592,7 +592,7 @@ dp_phy: dp-video-phy { };
mipi_phy: mipi-video-phy { - compatible = "samsung,s5pv210-mipi-video-phy"; + compatible = "samsung,exynos5420-mipi-video-phy"; syscon = <&pmu_system_controller>; #phy-cells = <1>; };
From: Jann Horn jannh@google.com
[ Upstream commit 47d586913f2abec4d240bae33417f537fda987ec ]
Currently, filp_close() and generic_shutdown_super() use printk() to log messages when bugs are detected. This is problematic because infrastructure like syzkaller has no idea that this message indicates a bug. In addition, some people explicitly want their kernels to BUG() when kernel data corruption has been detected (CONFIG_BUG_ON_DATA_CORRUPTION). And finally, when generic_shutdown_super() detects remaining inodes on a system without CONFIG_BUG_ON_DATA_CORRUPTION, it would be nice if later accesses to a busy inode would at least crash somewhat cleanly rather than walking through freed memory.
To address all three, use CHECK_DATA_CORRUPTION() when kernel bugs are detected.
Signed-off-by: Jann Horn jannh@google.com Reviewed-by: Christian Brauner (Microsoft) brauner@kernel.org Reviewed-by: Kees Cook keescook@chromium.org Signed-off-by: Christian Brauner (Microsoft) brauner@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- fs/open.c | 5 +++-- fs/super.c | 21 +++++++++++++++++---- include/linux/poison.h | 3 +++ 3 files changed, 23 insertions(+), 6 deletions(-)
diff --git a/fs/open.c b/fs/open.c index 82c1a28b33089..ceb88ac0ca3b2 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1411,8 +1411,9 @@ int filp_close(struct file *filp, fl_owner_t id) { int retval = 0;
- if (!file_count(filp)) { - printk(KERN_ERR "VFS: Close: file count is 0\n"); + if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, + "VFS: Close: file count is 0 (f_op=%ps)", + filp->f_op)) { return 0; }
diff --git a/fs/super.c b/fs/super.c index 12c08cb20405d..cf737ec2bd05c 100644 --- a/fs/super.c +++ b/fs/super.c @@ -491,10 +491,23 @@ void generic_shutdown_super(struct super_block *sb) if (sop->put_super) sop->put_super(sb);
- if (!list_empty(&sb->s_inodes)) { - printk("VFS: Busy inodes after unmount of %s. " - "Self-destruct in 5 seconds. Have a nice day...\n", - sb->s_id); + if (CHECK_DATA_CORRUPTION(!list_empty(&sb->s_inodes), + "VFS: Busy inodes after unmount of %s (%s)", + sb->s_id, sb->s_type->name)) { + /* + * Adding a proper bailout path here would be hard, but + * we can at least make it more likely that a later + * iput_final() or such crashes cleanly. + */ + struct inode *inode; + + spin_lock(&sb->s_inode_list_lock); + list_for_each_entry(inode, &sb->s_inodes, i_sb_list) { + inode->i_op = VFS_PTR_POISON; + inode->i_sb = VFS_PTR_POISON; + inode->i_mapping = VFS_PTR_POISON; + } + spin_unlock(&sb->s_inode_list_lock); } } spin_lock(&sb_lock); diff --git a/include/linux/poison.h b/include/linux/poison.h index 2d3249eb0e62d..0e8a1f2ceb2f1 100644 --- a/include/linux/poison.h +++ b/include/linux/poison.h @@ -84,4 +84,7 @@ /********** kernel/bpf/ **********/ #define BPF_PTR_POISON ((void *)(0xeB9FUL + POISON_POINTER_DELTA))
+/********** VFS **********/ +#define VFS_PTR_POISON ((void *)(0xF5 + POISON_POINTER_DELTA)) + #endif
From: Li Nan linan122@huawei.com
[ Upstream commit 984af1e66b4126cf145153661cc24c213e2ec231 ]
echo max of u64 to cost.model can cause divide by 0 error.
# echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model
divide error: 0000 [#1] PREEMPT SMP RIP: 0010:calc_lcoefs+0x4c/0xc0 Call Trace: <TASK> ioc_refresh_params+0x2b3/0x4f0 ioc_cost_model_write+0x3cb/0x4c0 ? _copy_from_iter+0x6d/0x6c0 ? kernfs_fop_write_iter+0xfc/0x270 cgroup_file_write+0xa0/0x200 kernfs_fop_write_iter+0x17d/0x270 vfs_write+0x414/0x620 ksys_write+0x73/0x160 __x64_sys_write+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
calc_lcoefs() uses the input value of cost.model in DIV_ROUND_UP_ULL, overflow would happen if bps plus IOC_PAGE_SIZE is greater than ULLONG_MAX, it can cause divide by 0 error.
Fix the problem by setting basecost
Signed-off-by: Li Nan linan122@huawei.com Signed-off-by: Yu Kuai yukuai3@huawei.com Acked-by: Tejun Heo tj@kernel.org Link: https://lore.kernel.org/r/20230117070806.3857142-5-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-iocost.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 6955605629e4f..ec7219caea165 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -866,9 +866,14 @@ static void calc_lcoefs(u64 bps, u64 seqiops, u64 randiops,
*page = *seqio = *randio = 0;
- if (bps) - *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC, - DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE)); + if (bps) { + u64 bps_pages = DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE); + + if (bps_pages) + *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC, bps_pages); + else + *page = 1; + }
if (seqiops) { v = DIV64_U64_ROUND_UP(VTIME_PER_SEC, seqiops);
From: Yu Kuai yukuai3@huawei.com
[ Upstream commit c7241babf0855d8a6180cd1743ff0ec34de40b4e ]
Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is called before child, then UAF can be triggered. Hence it's better to guarantee the order of pd_free_fn().
Currently refcount of parent blkg is dropped in __blkg_release(), which is before pd_free_fn() is called in blkg_free_work_fn() while blkg_free_work_fn() is called asynchronously.
This patch make sure pd_free_fn() called from removing cgroup is ordered by delaying dropping parent refcount after calling pd_free_fn() for child.
BTW, pd_free_fn() will also be called from blkcg_deactivate_policy() from deleting device, and following patches will guarantee the order.
Signed-off-by: Yu Kuai yukuai3@huawei.com Acked-by: Tejun Heo tj@kernel.org Reviewed-by: Christoph Hellwig hch@lst.de Link: https://lore.kernel.org/r/20230119110350.2287325-2-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-cgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 9ac1efb053e08..aa890e3e4e509 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -124,6 +124,8 @@ static void blkg_free_workfn(struct work_struct *work) if (blkg->pd[i]) blkcg_policy[i]->pd_free_fn(blkg->pd[i]);
+ if (blkg->parent) + blkg_put(blkg->parent); if (blkg->q) blk_put_queue(blkg->q); free_percpu(blkg->iostat_cpu); @@ -158,8 +160,6 @@ static void __blkg_release(struct rcu_head *rcu)
/* release the blkcg and parent blkg refs this blkg has been holding */ css_put(&blkg->blkcg->css); - if (blkg->parent) - blkg_put(blkg->parent); blkg_free(blkg); }
From: Yu Kuai yukuai3@huawei.com
[ Upstream commit f1c006f1c6850c14040f8337753a63119bba39b9 ]
Currently parent pd can be freed before child pd:
t1: remove cgroup C1 blkcg_destroy_blkgs blkg_destroy list_del_init(&blkg->q_node) // remove blkg from queue list percpu_ref_kill(&blkg->refcnt) blkg_release call_rcu
t2: from t1 __blkg_release blkg_free schedule_work t4: deactivate policy blkcg_deactivate_policy pd_free_fn // parent of C1 is freed first t3: from t2 blkg_free_workfn pd_free_fn
If policy(for example, ioc_timer_fn() from iocost) access parent pd from child pd after pd_offline_fn(), then UAF can be triggered.
Fix the problem by delaying 'list_del_init(&blkg->q_node)' from blkg_destroy() to blkg_free_workfn(), and using a new disk level mutex to synchronize blkg_free_workfn() and blkcg_deactivate_policy().
Signed-off-by: Yu Kuai yukuai3@huawei.com Acked-by: Tejun Heo tj@kernel.org Reviewed-by: Christoph Hellwig hch@lst.de Link: https://lore.kernel.org/r/20230119110350.2287325-4-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- block/blk-cgroup.c | 35 +++++++++++++++++++++++++++++------ include/linux/blkdev.h | 1 + 2 files changed, 30 insertions(+), 6 deletions(-)
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index aa890e3e4e509..45881f8c79130 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -118,16 +118,32 @@ static void blkg_free_workfn(struct work_struct *work) { struct blkcg_gq *blkg = container_of(work, struct blkcg_gq, free_work); + struct request_queue *q = blkg->q; int i;
+ /* + * pd_free_fn() can also be called from blkcg_deactivate_policy(), + * in order to make sure pd_free_fn() is called in order, the deletion + * of the list blkg->q_node is delayed to here from blkg_destroy(), and + * blkcg_mutex is used to synchronize blkg_free_workfn() and + * blkcg_deactivate_policy(). + */ + if (q) + mutex_lock(&q->blkcg_mutex); + for (i = 0; i < BLKCG_MAX_POLS; i++) if (blkg->pd[i]) blkcg_policy[i]->pd_free_fn(blkg->pd[i]);
if (blkg->parent) blkg_put(blkg->parent); - if (blkg->q) - blk_put_queue(blkg->q); + + if (q) { + list_del_init(&blkg->q_node); + mutex_unlock(&q->blkcg_mutex); + blk_put_queue(q); + } + free_percpu(blkg->iostat_cpu); percpu_ref_exit(&blkg->refcnt); kfree(blkg); @@ -458,9 +474,14 @@ static void blkg_destroy(struct blkcg_gq *blkg) lockdep_assert_held(&blkg->q->queue_lock); lockdep_assert_held(&blkcg->lock);
- /* Something wrong if we are trying to remove same group twice */ - WARN_ON_ONCE(list_empty(&blkg->q_node)); - WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node)); + /* + * blkg stays on the queue list until blkg_free_workfn(), see details in + * blkg_free_workfn(), hence this function can be called from + * blkcg_destroy_blkgs() first and again from blkg_destroy_all() before + * blkg_free_workfn(). + */ + if (hlist_unhashed(&blkg->blkcg_node)) + return;
for (i = 0; i < BLKCG_MAX_POLS; i++) { struct blkcg_policy *pol = blkcg_policy[i]; @@ -472,7 +493,6 @@ static void blkg_destroy(struct blkcg_gq *blkg) blkg->online = false;
radix_tree_delete(&blkcg->blkg_tree, blkg->q->id); - list_del_init(&blkg->q_node); hlist_del_init_rcu(&blkg->blkcg_node);
/* @@ -1273,6 +1293,7 @@ int blkcg_init_disk(struct gendisk *disk) int ret;
INIT_LIST_HEAD(&q->blkg_list); + mutex_init(&q->blkcg_mutex);
new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL); if (!new_blkg) @@ -1510,6 +1531,7 @@ void blkcg_deactivate_policy(struct request_queue *q, if (queue_is_mq(q)) blk_mq_freeze_queue(q);
+ mutex_lock(&q->blkcg_mutex); spin_lock_irq(&q->queue_lock);
__clear_bit(pol->plid, q->blkcg_pols); @@ -1528,6 +1550,7 @@ void blkcg_deactivate_policy(struct request_queue *q, }
spin_unlock_irq(&q->queue_lock); + mutex_unlock(&q->blkcg_mutex);
if (queue_is_mq(q)) blk_mq_unfreeze_queue(q); diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 43d4e073b1115..10ee92db680c9 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -484,6 +484,7 @@ struct request_queue { DECLARE_BITMAP (blkcg_pols, BLKCG_MAX_POLS); struct blkcg_gq *root_blkg; struct list_head blkg_list; + struct mutex blkcg_mutex; #endif
struct queue_limits limits;
From: Greg Kroah-Hartman gregkh@linuxfoundation.org
[ Upstream commit 83e8864fee26f63a7435e941b7c36a20fd6fe93e ]
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once.
Cc: Jens Axboe axboe@kernel.dk Cc: Steven Rostedt rostedt@goodmis.org Cc: Masami Hiramatsu mhiramat@kernel.org Cc: linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-trace-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Reviewed-by: Bart Van Assche bvanassche@acm.org Link: https://lore.kernel.org/r/20230202141956.2299521-1-gregkh@linuxfoundation.or... Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/trace/blktrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 918a7d12df8ff..5743be5594153 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -320,8 +320,8 @@ static void blk_trace_free(struct request_queue *q, struct blk_trace *bt) * under 'q->debugfs_dir', thus lookup and remove them. */ if (!bt->dir) { - debugfs_remove(debugfs_lookup("dropped", q->debugfs_dir)); - debugfs_remove(debugfs_lookup("msg", q->debugfs_dir)); + debugfs_lookup_and_remove("dropped", q->debugfs_dir); + debugfs_lookup_and_remove("msg", q->debugfs_dir); } else { debugfs_remove(bt->dir); }
From: Qu Wenruo wqu@suse.com
[ Upstream commit 28232909ba43561887508a6ef46d7f33a648f375 ]
[BUG] When debugging a scrub related metadata error, it turns out that our metadata error reporting is not ideal.
The only 3 error messages are:
- BTRFS error (device dm-2): bdev /dev/mapper/test-scratch1 errs: wr 0, rd 0, flush 0, corrupt 0, gen 1 Showing we have metadata generation mismatch errors.
- BTRFS error (device dm-2): unable to fixup (regular) error at logical 7110656 on dev /dev/mapper/test-scratch1 Showing which tree blocks are corrupted.
- BTRFS warning (device dm-2): checksum/header error at logical 24772608 on dev /dev/mapper/test-scratch2, physical 3801088: metadata node (level 1) in tree 5 Showing which physical range the corrupted metadata is at.
We have to combine the above 3 to know we have a corrupted metadata with generation mismatch.
And this is already the better case, if we have other problems, like fsid mismatch, we can not even know the cause.
[CAUSE] The problem is caused by the fact that, scrub_checksum_tree_block() never outputs any error message.
It just return two bits for scrub: sblock->header_error, and sblock->generation_error.
And later we report error in scrub_print_warning(), but unfortunately we only have two bits, there is not really much thing we can done to print any detailed errors.
[FIX] This patch will do the following to enhance the error reporting of metadata scrub:
- Add extra warning (ratelimited) for every error we hit This can help us to distinguish the different types of errors. Some errors can help us to know what's going wrong immediately, like bytenr mismatch.
- Re-order the checks Currently we check bytenr first, then immediately generation. This can lead to false generation mismatch reports, while the fsid mismatches.
Here is the new output for the bug I'm debugging (we forgot to writeback tree blocks for commit roots):
BTRFS warning (device dm-2): tree block 24117248 mirror 1 has bad fsid, has b77cd862-f150-4c71-90ec-7baf0544d83f want 17df6abf-23cd-445f-b350-5b3e40bfd2fc BTRFS warning (device dm-2): tree block 24117248 mirror 0 has bad fsid, has b77cd862-f150-4c71-90ec-7baf0544d83f want 17df6abf-23cd-445f-b350-5b3e40bfd2fc
Now we can immediately know it's some tree blocks didn't even get written back, other than the original confusing generation mismatch.
Signed-off-by: Qu Wenruo wqu@suse.com Reviewed-by: David Sterba dsterba@suse.com Signed-off-by: David Sterba dsterba@suse.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/btrfs/scrub.c | 49 +++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 40 insertions(+), 9 deletions(-)
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c index 52b346795f660..a5d026041be45 100644 --- a/fs/btrfs/scrub.c +++ b/fs/btrfs/scrub.c @@ -2053,20 +2053,33 @@ static int scrub_checksum_tree_block(struct scrub_block *sblock) * a) don't have an extent buffer and * b) the page is already kmapped */ - if (sblock->logical != btrfs_stack_header_bytenr(h)) + if (sblock->logical != btrfs_stack_header_bytenr(h)) { sblock->header_error = 1; - - if (sector->generation != btrfs_stack_header_generation(h)) { - sblock->header_error = 1; - sblock->generation_error = 1; + btrfs_warn_rl(fs_info, + "tree block %llu mirror %u has bad bytenr, has %llu want %llu", + sblock->logical, sblock->mirror_num, + btrfs_stack_header_bytenr(h), + sblock->logical); + goto out; }
- if (!scrub_check_fsid(h->fsid, sector)) + if (!scrub_check_fsid(h->fsid, sector)) { sblock->header_error = 1; + btrfs_warn_rl(fs_info, + "tree block %llu mirror %u has bad fsid, has %pU want %pU", + sblock->logical, sblock->mirror_num, + h->fsid, sblock->dev->fs_devices->fsid); + goto out; + }
- if (memcmp(h->chunk_tree_uuid, fs_info->chunk_tree_uuid, - BTRFS_UUID_SIZE)) + if (memcmp(h->chunk_tree_uuid, fs_info->chunk_tree_uuid, BTRFS_UUID_SIZE)) { sblock->header_error = 1; + btrfs_warn_rl(fs_info, + "tree block %llu mirror %u has bad chunk tree uuid, has %pU want %pU", + sblock->logical, sblock->mirror_num, + h->chunk_tree_uuid, fs_info->chunk_tree_uuid); + goto out; + }
shash->tfm = fs_info->csum_shash; crypto_shash_init(shash); @@ -2079,9 +2092,27 @@ static int scrub_checksum_tree_block(struct scrub_block *sblock) }
crypto_shash_final(shash, calculated_csum); - if (memcmp(calculated_csum, on_disk_csum, sctx->fs_info->csum_size)) + if (memcmp(calculated_csum, on_disk_csum, sctx->fs_info->csum_size)) { sblock->checksum_error = 1; + btrfs_warn_rl(fs_info, + "tree block %llu mirror %u has bad csum, has " CSUM_FMT " want " CSUM_FMT, + sblock->logical, sblock->mirror_num, + CSUM_FMT_VALUE(fs_info->csum_size, on_disk_csum), + CSUM_FMT_VALUE(fs_info->csum_size, calculated_csum)); + goto out; + } + + if (sector->generation != btrfs_stack_header_generation(h)) { + sblock->header_error = 1; + sblock->generation_error = 1; + btrfs_warn_rl(fs_info, + "tree block %llu mirror %u has bad generation, has %llu want %llu", + sblock->logical, sblock->mirror_num, + btrfs_stack_header_generation(h), + sector->generation); + }
+out: return sblock->header_error || sblock->checksum_error; }
From: Michael Grzeschik m.grzeschik@pengutronix.de
[ Upstream commit 32405e532d358a2f9d4befae928b9883c8597616 ]
Since we need to support legacy phys with the dwc3 controller, we enable this quirk on the zynqmp platforms.
Signed-off-by: Michael Grzeschik m.grzeschik@pengutronix.de Link: https://lore.kernel.org/r/20221023215649.221726-1-m.grzeschik@pengutronix.de Signed-off-by: Michal Simek michal.simek@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi index 4325cb8526edc..f92df478f0eea 100644 --- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi @@ -858,6 +858,7 @@ dwc3_0: usb@fe200000 { clock-names = "bus_early", "ref"; iommus = <&smmu 0x860>; snps,quirk-frame-length-adjustment = <0x20>; + snps,resume-hs-terminations; /* dma-coherent; */ }; }; @@ -884,6 +885,7 @@ dwc3_1: usb@fe300000 { clock-names = "bus_early", "ref"; iommus = <&smmu 0x861>; snps,quirk-frame-length-adjustment = <0x20>; + snps,resume-hs-terminations; /* dma-coherent; */ }; };
From: Peter Zijlstra peterz@infradead.org
[ Upstream commit 821ad23d0eaff73ef599ece39ecc77482df20a8c ]
Fix instrumentation bugs objtool found:
vmlinux.o: warning: objtool: intel_idle_s2idle+0xd5: call to fpu_idle_fpregs() leaves .noinstr.text section vmlinux.o: warning: objtool: intel_idle_xstate+0x11: call to fpu_idle_fpregs() leaves .noinstr.text section vmlinux.o: warning: objtool: fpu_idle_fpregs+0x9: call to xfeatures_in_use() leaves .noinstr.text section
Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Signed-off-by: Ingo Molnar mingo@kernel.org Tested-by: Tony Lindgren tony@atomide.com Tested-by: Ulf Hansson ulf.hansson@linaro.org Acked-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Acked-by: Frederic Weisbecker frederic@kernel.org Link: https://lore.kernel.org/r/20230112195540.494977795@infradead.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/include/asm/fpu/xcr.h | 4 ++-- arch/x86/include/asm/special_insns.h | 2 +- arch/x86/kernel/fpu/core.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/arch/x86/include/asm/fpu/xcr.h b/arch/x86/include/asm/fpu/xcr.h index 9656a5bc6feae..9a710c0604457 100644 --- a/arch/x86/include/asm/fpu/xcr.h +++ b/arch/x86/include/asm/fpu/xcr.h @@ -5,7 +5,7 @@ #define XCR_XFEATURE_ENABLED_MASK 0x00000000 #define XCR_XFEATURE_IN_USE_MASK 0x00000001
-static inline u64 xgetbv(u32 index) +static __always_inline u64 xgetbv(u32 index) { u32 eax, edx;
@@ -27,7 +27,7 @@ static inline void xsetbv(u32 index, u64 value) * * Callers should check X86_FEATURE_XGETBV1. */ -static inline u64 xfeatures_in_use(void) +static __always_inline u64 xfeatures_in_use(void) { return xgetbv(XCR_XFEATURE_IN_USE_MASK); } diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h index 35f709f619fb4..c2e322189f853 100644 --- a/arch/x86/include/asm/special_insns.h +++ b/arch/x86/include/asm/special_insns.h @@ -295,7 +295,7 @@ static inline int enqcmds(void __iomem *dst, const void *src) return 0; }
-static inline void tile_release(void) +static __always_inline void tile_release(void) { /* * Instruction opcode for TILERELEASE; supported in binutils diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c index 9baa89a8877d0..dccce58201b7c 100644 --- a/arch/x86/kernel/fpu/core.c +++ b/arch/x86/kernel/fpu/core.c @@ -853,12 +853,12 @@ int fpu__exception_code(struct fpu *fpu, int trap_nr) * Initialize register state that may prevent from entering low-power idle. * This function will be invoked from the cpuidle driver only when needed. */ -void fpu_idle_fpregs(void) +noinstr void fpu_idle_fpregs(void) { /* Note: AMX_TILE being enabled implies XGETBV1 support */ if (cpu_feature_enabled(X86_FEATURE_AMX_TILE) && (xfeatures_in_use() & XFEATURE_MASK_XTILE)) { tile_release(); - fpregs_deactivate(¤t->thread.fpu); + __this_cpu_write(fpu_fpregs_owner_ctx, NULL); } }
From: Jens Axboe axboe@kernel.dk
[ Upstream commit cb3ea4b7671b7cfbac3ee609976b790aebd0bbda ]
We don't set it on PF_KTHREAD threads as they never return to userspace, and PF_IO_WORKER threads are identical in that regard. As they keep running in the kernel until they die, skip setting the FPU flag on them.
More of a cosmetic thing that was found while debugging and issue and pondering why the FPU flag is set on these threads.
Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Ingo Molnar mingo@kernel.org Acked-by: Peter Zijlstra peterz@infradead.org Link: https://lore.kernel.org/r/560c844c-f128-555b-40c6-31baff27537f@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/include/asm/fpu/sched.h | 2 +- arch/x86/kernel/fpu/context.h | 2 +- arch/x86/kernel/fpu/core.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/include/asm/fpu/sched.h b/arch/x86/include/asm/fpu/sched.h index b2486b2cbc6e0..c2d6cd78ed0c2 100644 --- a/arch/x86/include/asm/fpu/sched.h +++ b/arch/x86/include/asm/fpu/sched.h @@ -39,7 +39,7 @@ extern void fpu_flush_thread(void); static inline void switch_fpu_prepare(struct fpu *old_fpu, int cpu) { if (cpu_feature_enabled(X86_FEATURE_FPU) && - !(current->flags & PF_KTHREAD)) { + !(current->flags & (PF_KTHREAD | PF_IO_WORKER))) { save_fpregs_to_fpstate(old_fpu); /* * The save operation preserved register state, so the diff --git a/arch/x86/kernel/fpu/context.h b/arch/x86/kernel/fpu/context.h index 958accf2ccf07..9fcfa5c4dad79 100644 --- a/arch/x86/kernel/fpu/context.h +++ b/arch/x86/kernel/fpu/context.h @@ -57,7 +57,7 @@ static inline void fpregs_restore_userregs(void) struct fpu *fpu = ¤t->thread.fpu; int cpu = smp_processor_id();
- if (WARN_ON_ONCE(current->flags & PF_KTHREAD)) + if (WARN_ON_ONCE(current->flags & (PF_KTHREAD | PF_IO_WORKER))) return;
if (!fpregs_state_valid(fpu, cpu)) { diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c index dccce58201b7c..caf33486dc5ee 100644 --- a/arch/x86/kernel/fpu/core.c +++ b/arch/x86/kernel/fpu/core.c @@ -426,7 +426,7 @@ void kernel_fpu_begin_mask(unsigned int kfpu_mask)
this_cpu_write(in_kernel_fpu, true);
- if (!(current->flags & PF_KTHREAD) && + if (!(current->flags & (PF_KTHREAD | PF_IO_WORKER)) && !test_thread_flag(TIF_NEED_FPU_LOAD)) { set_thread_flag(TIF_NEED_FPU_LOAD); save_fpregs_to_fpstate(¤t->thread.fpu);
From: Mark Rutland mark.rutland@arm.com
[ Upstream commit 393e2ea30aec634b37004d401863428e120d5e1b ]
The PSCI suspend code is currently instrumentable, which is not safe as instrumentation (e.g. ftrace) may try to make use of RCU during idle periods when RCU is not watching.
To fix this we need to ensure that psci_suspend_finisher() and anything it calls are not instrumented. We can do this fairly simply by marking psci_suspend_finisher() and the psci*_cpu_suspend() functions as noinstr, and the underlying helper functions as __always_inline.
When CONFIG_DEBUG_VIRTUAL=y, __pa_symbol() can expand to an out-of-line instrumented function, so we must use __pa_symbol_nodebug() within psci_suspend_finisher().
The raw SMCCC invocation functions are written in assembly, and are not subject to compiler instrumentation.
Signed-off-by: Mark Rutland mark.rutland@arm.com Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Signed-off-by: Ingo Molnar mingo@kernel.org Link: https://lore.kernel.org/r/20230126151323.349423061@infradead.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/firmware/psci/psci.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-)
diff --git a/drivers/firmware/psci/psci.c b/drivers/firmware/psci/psci.c index 447ee4ea5c903..f78249fe2512a 100644 --- a/drivers/firmware/psci/psci.c +++ b/drivers/firmware/psci/psci.c @@ -108,9 +108,10 @@ bool psci_power_state_is_valid(u32 state) return !(state & ~valid_mask); }
-static unsigned long __invoke_psci_fn_hvc(unsigned long function_id, - unsigned long arg0, unsigned long arg1, - unsigned long arg2) +static __always_inline unsigned long +__invoke_psci_fn_hvc(unsigned long function_id, + unsigned long arg0, unsigned long arg1, + unsigned long arg2) { struct arm_smccc_res res;
@@ -118,9 +119,10 @@ static unsigned long __invoke_psci_fn_hvc(unsigned long function_id, return res.a0; }
-static unsigned long __invoke_psci_fn_smc(unsigned long function_id, - unsigned long arg0, unsigned long arg1, - unsigned long arg2) +static __always_inline unsigned long +__invoke_psci_fn_smc(unsigned long function_id, + unsigned long arg0, unsigned long arg1, + unsigned long arg2) { struct arm_smccc_res res;
@@ -128,7 +130,7 @@ static unsigned long __invoke_psci_fn_smc(unsigned long function_id, return res.a0; }
-static int psci_to_linux_errno(int errno) +static __always_inline int psci_to_linux_errno(int errno) { switch (errno) { case PSCI_RET_SUCCESS: @@ -169,7 +171,8 @@ int psci_set_osi_mode(bool enable) return psci_to_linux_errno(err); }
-static int __psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point) +static __always_inline int +__psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point) { int err;
@@ -177,13 +180,15 @@ static int __psci_cpu_suspend(u32 fn, u32 state, unsigned long entry_point) return psci_to_linux_errno(err); }
-static int psci_0_1_cpu_suspend(u32 state, unsigned long entry_point) +static __always_inline int +psci_0_1_cpu_suspend(u32 state, unsigned long entry_point) { return __psci_cpu_suspend(psci_0_1_function_ids.cpu_suspend, state, entry_point); }
-static int psci_0_2_cpu_suspend(u32 state, unsigned long entry_point) +static __always_inline int +psci_0_2_cpu_suspend(u32 state, unsigned long entry_point) { return __psci_cpu_suspend(PSCI_FN_NATIVE(0_2, CPU_SUSPEND), state, entry_point); @@ -450,10 +455,12 @@ late_initcall(psci_debugfs_init) #endif
#ifdef CONFIG_CPU_IDLE -static int psci_suspend_finisher(unsigned long state) +static noinstr int psci_suspend_finisher(unsigned long state) { u32 power_state = state; - phys_addr_t pa_cpu_resume = __pa_symbol(cpu_resume); + phys_addr_t pa_cpu_resume; + + pa_cpu_resume = __pa_symbol_nodebug((unsigned long)cpu_resume);
return psci_ops.cpu_suspend(power_state, pa_cpu_resume); }
From: Peter Zijlstra peterz@infradead.org
[ Upstream commit 5a5d7e9badd2cb8065db171961bd30bd3595e4b6 ]
In order to avoid WARN/BUG from generating nested or even recursive warnings, force rcu_is_watching() true during WARN/lockdep_rcu_suspicious().
Notably things like unwinding the stack can trigger rcu_dereference() warnings, which then triggers more unwinding which then triggers more warnings etc..
Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Signed-off-by: Ingo Molnar mingo@kernel.org Link: https://lore.kernel.org/r/20230126151323.408156109@infradead.org Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/context_tracking.h | 27 +++++++++++++++++++++++++++ kernel/locking/lockdep.c | 3 +++ kernel/panic.c | 5 +++++ lib/bug.c | 15 ++++++++++++++- 4 files changed, 49 insertions(+), 1 deletion(-)
diff --git a/include/linux/context_tracking.h b/include/linux/context_tracking.h index dcef4a9e4d63e..d4afa8508a806 100644 --- a/include/linux/context_tracking.h +++ b/include/linux/context_tracking.h @@ -130,9 +130,36 @@ static __always_inline unsigned long ct_state_inc(int incby) return arch_atomic_add_return(incby, this_cpu_ptr(&context_tracking.state)); }
+static __always_inline bool warn_rcu_enter(void) +{ + bool ret = false; + + /* + * Horrible hack to shut up recursive RCU isn't watching fail since + * lots of the actual reporting also relies on RCU. + */ + preempt_disable_notrace(); + if (rcu_dynticks_curr_cpu_in_eqs()) { + ret = true; + ct_state_inc(RCU_DYNTICKS_IDX); + } + + return ret; +} + +static __always_inline void warn_rcu_exit(bool rcu) +{ + if (rcu) + ct_state_inc(RCU_DYNTICKS_IDX); + preempt_enable_notrace(); +} + #else static inline void ct_idle_enter(void) { } static inline void ct_idle_exit(void) { } + +static __always_inline bool warn_rcu_enter(void) { return false; } +static __always_inline void warn_rcu_exit(bool rcu) { } #endif /* !CONFIG_CONTEXT_TRACKING_IDLE */
#endif diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c index e3375bc40dadc..50d4863974e7a 100644 --- a/kernel/locking/lockdep.c +++ b/kernel/locking/lockdep.c @@ -55,6 +55,7 @@ #include <linux/rcupdate.h> #include <linux/kprobes.h> #include <linux/lockdep.h> +#include <linux/context_tracking.h>
#include <asm/sections.h>
@@ -6555,6 +6556,7 @@ void lockdep_rcu_suspicious(const char *file, const int line, const char *s) { struct task_struct *curr = current; int dl = READ_ONCE(debug_locks); + bool rcu = warn_rcu_enter();
/* Note: the following can be executed concurrently, so be careful. */ pr_warn("\n"); @@ -6595,5 +6597,6 @@ void lockdep_rcu_suspicious(const char *file, const int line, const char *s) lockdep_print_held_locks(curr); pr_warn("\nstack backtrace:\n"); dump_stack(); + warn_rcu_exit(rcu); } EXPORT_SYMBOL_GPL(lockdep_rcu_suspicious); diff --git a/kernel/panic.c b/kernel/panic.c index 463c9295bc28a..487f5b03bf835 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -34,6 +34,7 @@ #include <linux/ratelimit.h> #include <linux/debugfs.h> #include <linux/sysfs.h> +#include <linux/context_tracking.h> #include <trace/events/error_report.h> #include <asm/sections.h>
@@ -679,6 +680,7 @@ void __warn(const char *file, int line, void *caller, unsigned taint, void warn_slowpath_fmt(const char *file, int line, unsigned taint, const char *fmt, ...) { + bool rcu = warn_rcu_enter(); struct warn_args args;
pr_warn(CUT_HERE); @@ -693,11 +695,13 @@ void warn_slowpath_fmt(const char *file, int line, unsigned taint, va_start(args.args, fmt); __warn(file, line, __builtin_return_address(0), taint, NULL, &args); va_end(args.args); + warn_rcu_exit(rcu); } EXPORT_SYMBOL(warn_slowpath_fmt); #else void __warn_printk(const char *fmt, ...) { + bool rcu = warn_rcu_enter(); va_list args;
pr_warn(CUT_HERE); @@ -705,6 +709,7 @@ void __warn_printk(const char *fmt, ...) va_start(args, fmt); vprintk(fmt, args); va_end(args); + warn_rcu_exit(rcu); } EXPORT_SYMBOL(__warn_printk); #endif diff --git a/lib/bug.c b/lib/bug.c index c223a2575b721..e0ff219899902 100644 --- a/lib/bug.c +++ b/lib/bug.c @@ -47,6 +47,7 @@ #include <linux/sched.h> #include <linux/rculist.h> #include <linux/ftrace.h> +#include <linux/context_tracking.h>
extern struct bug_entry __start___bug_table[], __stop___bug_table[];
@@ -153,7 +154,7 @@ struct bug_entry *find_bug(unsigned long bugaddr) return module_find_bug(bugaddr); }
-enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) +static enum bug_trap_type __report_bug(unsigned long bugaddr, struct pt_regs *regs) { struct bug_entry *bug; const char *file; @@ -209,6 +210,18 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) return BUG_TRAP_TYPE_BUG; }
+enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) +{ + enum bug_trap_type ret; + bool rcu = false; + + rcu = warn_rcu_enter(); + ret = __report_bug(bugaddr, regs); + warn_rcu_exit(rcu); + + return ret; +} + static void clear_once_table(struct bug_entry *start, struct bug_entry *end) { struct bug_entry *bug;
From: Kan Liang kan.liang@linux.intel.com
[ Upstream commit c828441f21ddc819a28b5723a72e3c840e9de1c6 ]
The uncore subsystem for Meteor Lake is similar to the previous Alder Lake. The main difference is that MTL provides PMU support for different tiles, while ADL only provides PMU support for the whole package. On ADL, there are CBOX, ARB, and clockbox uncore PMON units. On MTL, they are split into CBOX/HAC_CBOX, ARB/HAC_ARB, and cncu/sncu which provides a fixed counter for clockticks. Also, new MSR addresses are introduced on MTL.
The IMC uncore PMON is the same as Alder Lake. Add new PCIIDs of IMC for Meteor Lake.
Signed-off-by: Kan Liang kan.liang@linux.intel.com Signed-off-by: Ingo Molnar mingo@kernel.org Link: https://lore.kernel.org/r/20230210190238.1726237-1-kan.liang@linux.intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/events/intel/uncore.c | 7 ++ arch/x86/events/intel/uncore.h | 1 + arch/x86/events/intel/uncore_snb.c | 161 +++++++++++++++++++++++++++++ 3 files changed, 169 insertions(+)
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c index 459b1aafd4d4a..27b34f5b87600 100644 --- a/arch/x86/events/intel/uncore.c +++ b/arch/x86/events/intel/uncore.c @@ -1765,6 +1765,11 @@ static const struct intel_uncore_init_fun adl_uncore_init __initconst = { .mmio_init = adl_uncore_mmio_init, };
+static const struct intel_uncore_init_fun mtl_uncore_init __initconst = { + .cpu_init = mtl_uncore_cpu_init, + .mmio_init = adl_uncore_mmio_init, +}; + static const struct intel_uncore_init_fun icx_uncore_init __initconst = { .cpu_init = icx_uncore_cpu_init, .pci_init = icx_uncore_pci_init, @@ -1832,6 +1837,8 @@ static const struct x86_cpu_id intel_uncore_match[] __initconst = { X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &adl_uncore_init), X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &adl_uncore_init), X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &adl_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE, &mtl_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, &mtl_uncore_init), X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &spr_uncore_init), X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &spr_uncore_init), X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT_D, &snr_uncore_init), diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h index e278e2e7c051a..305a54d88beee 100644 --- a/arch/x86/events/intel/uncore.h +++ b/arch/x86/events/intel/uncore.h @@ -602,6 +602,7 @@ void skl_uncore_cpu_init(void); void icl_uncore_cpu_init(void); void tgl_uncore_cpu_init(void); void adl_uncore_cpu_init(void); +void mtl_uncore_cpu_init(void); void tgl_uncore_mmio_init(void); void tgl_l_uncore_mmio_init(void); void adl_uncore_mmio_init(void); diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c index 1f4869227efb9..7fd4334e12a17 100644 --- a/arch/x86/events/intel/uncore_snb.c +++ b/arch/x86/events/intel/uncore_snb.c @@ -109,6 +109,19 @@ #define PCI_DEVICE_ID_INTEL_RPL_23_IMC 0xA728 #define PCI_DEVICE_ID_INTEL_RPL_24_IMC 0xA729 #define PCI_DEVICE_ID_INTEL_RPL_25_IMC 0xA72A +#define PCI_DEVICE_ID_INTEL_MTL_1_IMC 0x7d00 +#define PCI_DEVICE_ID_INTEL_MTL_2_IMC 0x7d01 +#define PCI_DEVICE_ID_INTEL_MTL_3_IMC 0x7d02 +#define PCI_DEVICE_ID_INTEL_MTL_4_IMC 0x7d05 +#define PCI_DEVICE_ID_INTEL_MTL_5_IMC 0x7d10 +#define PCI_DEVICE_ID_INTEL_MTL_6_IMC 0x7d14 +#define PCI_DEVICE_ID_INTEL_MTL_7_IMC 0x7d15 +#define PCI_DEVICE_ID_INTEL_MTL_8_IMC 0x7d16 +#define PCI_DEVICE_ID_INTEL_MTL_9_IMC 0x7d21 +#define PCI_DEVICE_ID_INTEL_MTL_10_IMC 0x7d22 +#define PCI_DEVICE_ID_INTEL_MTL_11_IMC 0x7d23 +#define PCI_DEVICE_ID_INTEL_MTL_12_IMC 0x7d24 +#define PCI_DEVICE_ID_INTEL_MTL_13_IMC 0x7d28
#define IMC_UNCORE_DEV(a) \ @@ -205,6 +218,32 @@ #define ADL_UNC_ARB_PERFEVTSEL0 0x2FD0 #define ADL_UNC_ARB_MSR_OFFSET 0x8
+/* MTL Cbo register */ +#define MTL_UNC_CBO_0_PER_CTR0 0x2448 +#define MTL_UNC_CBO_0_PERFEVTSEL0 0x2442 + +/* MTL HAC_ARB register */ +#define MTL_UNC_HAC_ARB_CTR 0x2018 +#define MTL_UNC_HAC_ARB_CTRL 0x2012 + +/* MTL ARB register */ +#define MTL_UNC_ARB_CTR 0x2418 +#define MTL_UNC_ARB_CTRL 0x2412 + +/* MTL cNCU register */ +#define MTL_UNC_CNCU_FIXED_CTR 0x2408 +#define MTL_UNC_CNCU_FIXED_CTRL 0x2402 +#define MTL_UNC_CNCU_BOX_CTL 0x240e + +/* MTL sNCU register */ +#define MTL_UNC_SNCU_FIXED_CTR 0x2008 +#define MTL_UNC_SNCU_FIXED_CTRL 0x2002 +#define MTL_UNC_SNCU_BOX_CTL 0x200e + +/* MTL HAC_CBO register */ +#define MTL_UNC_HBO_CTR 0x2048 +#define MTL_UNC_HBO_CTRL 0x2042 + DEFINE_UNCORE_FORMAT_ATTR(event, event, "config:0-7"); DEFINE_UNCORE_FORMAT_ATTR(umask, umask, "config:8-15"); DEFINE_UNCORE_FORMAT_ATTR(chmask, chmask, "config:8-11"); @@ -598,6 +637,115 @@ void adl_uncore_cpu_init(void) uncore_msr_uncores = adl_msr_uncores; }
+static struct intel_uncore_type mtl_uncore_cbox = { + .name = "cbox", + .num_counters = 2, + .perf_ctr_bits = 48, + .perf_ctr = MTL_UNC_CBO_0_PER_CTR0, + .event_ctl = MTL_UNC_CBO_0_PERFEVTSEL0, + .event_mask = ADL_UNC_RAW_EVENT_MASK, + .msr_offset = SNB_UNC_CBO_MSR_OFFSET, + .ops = &icl_uncore_msr_ops, + .format_group = &adl_uncore_format_group, +}; + +static struct intel_uncore_type mtl_uncore_hac_arb = { + .name = "hac_arb", + .num_counters = 2, + .num_boxes = 2, + .perf_ctr_bits = 48, + .perf_ctr = MTL_UNC_HAC_ARB_CTR, + .event_ctl = MTL_UNC_HAC_ARB_CTRL, + .event_mask = ADL_UNC_RAW_EVENT_MASK, + .msr_offset = SNB_UNC_CBO_MSR_OFFSET, + .ops = &icl_uncore_msr_ops, + .format_group = &adl_uncore_format_group, +}; + +static struct intel_uncore_type mtl_uncore_arb = { + .name = "arb", + .num_counters = 2, + .num_boxes = 2, + .perf_ctr_bits = 48, + .perf_ctr = MTL_UNC_ARB_CTR, + .event_ctl = MTL_UNC_ARB_CTRL, + .event_mask = ADL_UNC_RAW_EVENT_MASK, + .msr_offset = SNB_UNC_CBO_MSR_OFFSET, + .ops = &icl_uncore_msr_ops, + .format_group = &adl_uncore_format_group, +}; + +static struct intel_uncore_type mtl_uncore_hac_cbox = { + .name = "hac_cbox", + .num_counters = 2, + .num_boxes = 2, + .perf_ctr_bits = 48, + .perf_ctr = MTL_UNC_HBO_CTR, + .event_ctl = MTL_UNC_HBO_CTRL, + .event_mask = ADL_UNC_RAW_EVENT_MASK, + .msr_offset = SNB_UNC_CBO_MSR_OFFSET, + .ops = &icl_uncore_msr_ops, + .format_group = &adl_uncore_format_group, +}; + +static void mtl_uncore_msr_init_box(struct intel_uncore_box *box) +{ + wrmsrl(uncore_msr_box_ctl(box), SNB_UNC_GLOBAL_CTL_EN); +} + +static struct intel_uncore_ops mtl_uncore_msr_ops = { + .init_box = mtl_uncore_msr_init_box, + .disable_event = snb_uncore_msr_disable_event, + .enable_event = snb_uncore_msr_enable_event, + .read_counter = uncore_msr_read_counter, +}; + +static struct intel_uncore_type mtl_uncore_cncu = { + .name = "cncu", + .num_counters = 1, + .num_boxes = 1, + .box_ctl = MTL_UNC_CNCU_BOX_CTL, + .fixed_ctr_bits = 48, + .fixed_ctr = MTL_UNC_CNCU_FIXED_CTR, + .fixed_ctl = MTL_UNC_CNCU_FIXED_CTRL, + .single_fixed = 1, + .event_mask = SNB_UNC_CTL_EV_SEL_MASK, + .format_group = &icl_uncore_clock_format_group, + .ops = &mtl_uncore_msr_ops, + .event_descs = icl_uncore_events, +}; + +static struct intel_uncore_type mtl_uncore_sncu = { + .name = "sncu", + .num_counters = 1, + .num_boxes = 1, + .box_ctl = MTL_UNC_SNCU_BOX_CTL, + .fixed_ctr_bits = 48, + .fixed_ctr = MTL_UNC_SNCU_FIXED_CTR, + .fixed_ctl = MTL_UNC_SNCU_FIXED_CTRL, + .single_fixed = 1, + .event_mask = SNB_UNC_CTL_EV_SEL_MASK, + .format_group = &icl_uncore_clock_format_group, + .ops = &mtl_uncore_msr_ops, + .event_descs = icl_uncore_events, +}; + +static struct intel_uncore_type *mtl_msr_uncores[] = { + &mtl_uncore_cbox, + &mtl_uncore_hac_arb, + &mtl_uncore_arb, + &mtl_uncore_hac_cbox, + &mtl_uncore_cncu, + &mtl_uncore_sncu, + NULL +}; + +void mtl_uncore_cpu_init(void) +{ + mtl_uncore_cbox.num_boxes = icl_get_cbox_num(); + uncore_msr_uncores = mtl_msr_uncores; +} + enum { SNB_PCI_UNCORE_IMC, }; @@ -1264,6 +1412,19 @@ static const struct pci_device_id tgl_uncore_pci_ids[] = { IMC_UNCORE_DEV(RPL_23), IMC_UNCORE_DEV(RPL_24), IMC_UNCORE_DEV(RPL_25), + IMC_UNCORE_DEV(MTL_1), + IMC_UNCORE_DEV(MTL_2), + IMC_UNCORE_DEV(MTL_3), + IMC_UNCORE_DEV(MTL_4), + IMC_UNCORE_DEV(MTL_5), + IMC_UNCORE_DEV(MTL_6), + IMC_UNCORE_DEV(MTL_7), + IMC_UNCORE_DEV(MTL_8), + IMC_UNCORE_DEV(MTL_9), + IMC_UNCORE_DEV(MTL_10), + IMC_UNCORE_DEV(MTL_11), + IMC_UNCORE_DEV(MTL_12), + IMC_UNCORE_DEV(MTL_13), { /* end: all zeroes */ } };
From: Minsuk Kang linuxlovemin@yonsei.ac.kr
[ Upstream commit f099c5c9e2ba08a379bd354a82e05ef839ae29ac ]
This patch fixes a use-after-free in ath9k that occurs in ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access 'drv_priv' that has already been freed by ieee80211_free_hw(), called by ath9k_htc_hw_deinit(). The patch moves ath9k_destroy_wmi() before ieee80211_free_hw(). Note that urbs from the driver should be killed before freeing 'wmi' with ath9k_destroy_wmi() as their callbacks will access 'wmi'.
Found by a modified version of syzkaller.
================================================================== BUG: KASAN: use-after-free in ath9k_destroy_wmi+0x38/0x40 Read of size 8 at addr ffff8881069132a0 by task kworker/0:1/7
CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #131 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x8e/0xd1 print_address_description.constprop.0.cold+0x93/0x334 ? ath9k_destroy_wmi+0x38/0x40 ? ath9k_destroy_wmi+0x38/0x40 kasan_report.cold+0x83/0xdf ? ath9k_destroy_wmi+0x38/0x40 ath9k_destroy_wmi+0x38/0x40 ath9k_hif_usb_disconnect+0x329/0x3f0 ? ath9k_hif_usb_suspend+0x120/0x120 ? usb_disable_interface+0xfc/0x180 usb_unbind_interface+0x19b/0x7e0 ? usb_autoresume_device+0x50/0x50 device_release_driver_internal+0x44d/0x520 bus_remove_device+0x2e5/0x5a0 device_del+0x5b2/0xe30 ? __device_link_del+0x370/0x370 ? usb_remove_ep_devs+0x43/0x80 ? remove_intf_ep_devs+0x112/0x1a0 usb_disable_device+0x1e3/0x5a0 usb_disconnect+0x267/0x870 hub_event+0x168d/0x3950 ? rcu_read_lock_sched_held+0xa1/0xd0 ? hub_port_debounce+0x2e0/0x2e0 ? check_irq_usage+0x860/0xf20 ? drain_workqueue+0x281/0x360 ? lock_release+0x640/0x640 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 process_one_work+0x92b/0x1460 ? pwq_dec_nr_in_flight+0x330/0x330 ? rwlock_bug.part.0+0x90/0x90 worker_thread+0x95/0xe00 ? __kthread_parkme+0x115/0x1e0 ? process_one_work+0x1460/0x1460 kthread+0x3a1/0x480 ? set_kthread_struct+0x120/0x120 ret_from_fork+0x1f/0x30
The buggy address belongs to the page: page:ffffea00041a44c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106913 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 7, ts 38347963444, free_ts 41399957635 prep_new_page+0x1aa/0x240 get_page_from_freelist+0x159a/0x27c0 __alloc_pages+0x2da/0x6a0 alloc_pages+0xec/0x1e0 kmalloc_order+0x39/0xf0 kmalloc_order_trace+0x19/0x120 __kmalloc+0x308/0x390 wiphy_new_nm+0x6f5/0x1dd0 ieee80211_alloc_hw_nm+0x36d/0x2230 ath9k_htc_probe_device+0x9d/0x1e10 ath9k_htc_hw_init+0x34/0x50 ath9k_hif_usb_firmware_cb+0x25f/0x4e0 request_firmware_work_func+0x131/0x240 process_one_work+0x92b/0x1460 worker_thread+0x95/0xe00 kthread+0x3a1/0x480 page last free stack trace: free_pcp_prepare+0x3d3/0x7f0 free_unref_page+0x1e/0x3d0 device_release+0xa4/0x240 kobject_put+0x186/0x4c0 put_device+0x20/0x30 ath9k_htc_disconnect_device+0x1cf/0x2c0 ath9k_htc_hw_deinit+0x26/0x30 ath9k_hif_usb_disconnect+0x2d9/0x3f0 usb_unbind_interface+0x19b/0x7e0 device_release_driver_internal+0x44d/0x520 bus_remove_device+0x2e5/0x5a0 device_del+0x5b2/0xe30 usb_disable_device+0x1e3/0x5a0 usb_disconnect+0x267/0x870 hub_event+0x168d/0x3950 process_one_work+0x92b/0x1460
Memory state around the buggy address: ffff888106913180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888106913200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888106913280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^ ffff888106913300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888106913380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================
Reported-by: Dokyung Song dokyungs@yonsei.ac.kr Reported-by: Jisoo Jang jisoo.jang@yonsei.ac.kr Reported-by: Minsuk Kang linuxlovemin@yonsei.ac.kr Signed-off-by: Minsuk Kang linuxlovemin@yonsei.ac.kr Acked-by: Toke Høiland-Jørgensen toke@toke.dk Signed-off-by: Kalle Valo quic_kvalo@quicinc.com Link: https://lore.kernel.org/r/20221205014308.1617597-1-linuxlovemin@yonsei.ac.kr Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ath/ath9k/hif_usb.c | 2 -- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index de6c0824c9cab..f521dfa2f1945 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -1424,8 +1424,6 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
if (hif_dev->flags & HIF_USB_READY) { ath9k_htc_hw_deinit(hif_dev->htc_handle, unplugged); - ath9k_hif_usb_dev_deinit(hif_dev); - ath9k_destroy_wmi(hif_dev->htc_handle->drv_priv); ath9k_htc_hw_free(hif_dev->htc_handle); }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c index 07ac88fb1c577..96a3185a96d75 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c @@ -988,6 +988,8 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
ath9k_deinit_device(htc_handle->drv_priv); ath9k_stop_wmi(htc_handle->drv_priv); + ath9k_hif_usb_dealloc_urbs((struct hif_device_usb *)htc_handle->hif_dev); + ath9k_destroy_wmi(htc_handle->drv_priv); ieee80211_free_hw(htc_handle->drv_priv->hw); } }
From: Nagarajan Maran quic_nmaran@quicinc.com
[ Upstream commit 950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7 ]
When the interface is brought up in monitor mode, it leads to NULL pointer dereference crash. This crash happens when the packet type is extracted for a SKB. This extraction which is present in the received msdu delivery path,is not needed for the monitor ring packets since they are all RAW packets. Hence appending the flags with "RX_FLAG_ONLY_MONITOR" to skip that extraction.
Observed calltrace:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000064 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000048517000 [0000000000000064] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: ath11k_pci ath11k qmi_helpers CPU: 2 PID: 1781 Comm: napi/-271 Not tainted 6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6 Hardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k] lr : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k] sp : ffff80000ef5bb10 x29: ffff80000ef5bb10 x28: 0000000000000000 x27: ffff000007baafa0 x26: ffff000014a91ed0 x25: 0000000000000000 x24: 0000000000000000 x23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600 x20: 0000000000000000 x19: ffff800002b77740 x18: 0000000000000006 x17: 736564203634343a x16: 656e694c20657079 x15: 0000000000000143 x14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8 x11: ffff80000a591d30 x10: ffff80000a579d40 x9 : c0000000ffffefff x8 : 0000000000000003 x7 : 0000000000017fe8 x6 : ffff80000a579ce8 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 3a35ec12ed7f8900 x1 : 0000000000000000 x0 : 0000000000000052 Call trace: ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k] ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k] ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k] ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k] ath11k_dp_service_srng+0x234/0x338 [ath11k] ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k] __napi_poll+0x5c/0x190 napi_threaded_poll+0xf0/0x118 kthread+0xf4/0x110 ret_from_fork+0x10/0x20
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Reported-by: Florian Schmidt florian@fls.name Link: https://bugzilla.kernel.org/show_bug.cgi?id=216573 Signed-off-by: Nagarajan Maran quic_nmaran@quicinc.com Signed-off-by: Kalle Valo quic_kvalo@quicinc.com Link: https://lore.kernel.org/r/20221129142532.23421-1-quic_nmaran@quicinc.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 0c53d88293eb7..e964e1b722871 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -5023,6 +5023,7 @@ static int ath11k_dp_rx_mon_deliver(struct ath11k *ar, u32 mac_id, } else { rxs->flag |= RX_FLAG_ALLOW_SAME_PN; } + rxs->flag |= RX_FLAG_ONLY_MONITOR; ath11k_update_radiotap(ar, ppduinfo, mon_skb, rxs);
ath11k_dp_rx_deliver_msdu(ar, napi, mon_skb, rxs);
From: Jisoo Jang jisoo.jang@yonsei.ac.kr
[ Upstream commit 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 ]
This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in brcmf_fil_iovar_data_get(). The patch ensures buf is null-terminated.
Found by a modified version of syzkaller.
[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 47.601565][ T1897] ================================================================== [ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0 [ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897 [ 47.604336][ T1897] [ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131 [ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event [ 47.607453][ T1897] Call Trace: [ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 [ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334 [ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609434][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609863][ T1897] kasan_report.cold+0x83/0xdf [ 47.610366][ T1897] ? strsep+0x1b2/0x1f0 [ 47.610882][ T1897] strsep+0x1b2/0x1f0 [ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0 [ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 [ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0 [ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 [ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260 [ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 47.616288][ T1897] brcmf_attach+0x246/0xd40 [ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 [ 47.617280][ T1897] ? kmemdup+0x43/0x50 [ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 [ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 [ 47.619429][ T1897] ? usb_probe_device+0x250/0x250 [ 47.619950][ T1897] really_probe+0x205/0xb70 [ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0 [ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.622209][ T1897] driver_probe_device+0x4e/0x150 [ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0 [ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0 [ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30 [ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160 [ 47.625437][ T1897] __device_attach+0x23f/0x3a0 [ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0 [ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0 [ 47.627057][ T1897] bus_probe_device+0x1da/0x290 [ 47.627557][ T1897] device_add+0xb7b/0x1eb0 [ 47.628027][ T1897] ? wait_for_completion+0x290/0x290 [ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 [ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0 [ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0 [ 47.630385][ T1897] usb_probe_device+0xbb/0x250 [ 47.630927][ T1897] ? usb_suspend+0x590/0x590 [ 47.631397][ T1897] really_probe+0x205/0xb70 [ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0 [ 47.633002][ T1897] ? usb_generic_driver_match+0x75/0x90 [ 47.633573][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.634170][ T1897] driver_probe_device+0x4e/0x150 [ 47.634703][ T1897] __device_attach_driver+0x1cc/0x2a0 [ 47.635248][ T1897] bus_for_each_drv+0x156/0x1d0 [ 47.635748][ T1897] ? bus_rescan_devices+0x30/0x30 [ 47.636271][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.636881][ T1897] ? trace_hardirqs_on+0x46/0x160 [ 47.637396][ T1897] __device_attach+0x23f/0x3a0 [ 47.637904][ T1897] ? device_bind_driver+0xd0/0xd0 [ 47.638426][ T1897] ? kobject_uevent_env+0x287/0x14b0 [ 47.638985][ T1897] bus_probe_device+0x1da/0x290 [ 47.639512][ T1897] device_add+0xb7b/0x1eb0 [ 47.639977][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 [ 47.640612][ T1897] ? kfree+0x14a/0x6b0 [ 47.641055][ T1897] ? __usb_get_extra_descriptor+0x116/0x160 [ 47.641679][ T1897] usb_new_device.cold+0x49c/0x1029 [ 47.642245][ T1897] ? hub_disconnect+0x450/0x450 [ 47.642756][ T1897] ? rwlock_bug.part.0+0x90/0x90 [ 47.643273][ T1897] ? _raw_spin_unlock_irq+0x24/0x30 [ 47.643822][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.644445][ T1897] hub_event+0x1c98/0x3950 [ 47.644939][ T1897] ? hub_port_debounce+0x2e0/0x2e0 [ 47.645467][ T1897] ? check_irq_usage+0x861/0xf20 [ 47.645975][ T1897] ? drain_workqueue+0x280/0x360 [ 47.646506][ T1897] ? lock_release+0x640/0x640 [ 47.646994][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 47.647572][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.648111][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.648735][ T1897] process_one_work+0x92b/0x1460 [ 47.649262][ T1897] ? pwq_dec_nr_in_flight+0x330/0x330 [ 47.649816][ T1897] ? rwlock_bug.part.0+0x90/0x90 [ 47.650336][ T1897] worker_thread+0x95/0xe00 [ 47.650830][ T1897] ? __kthread_parkme+0x115/0x1e0 [ 47.651361][ T1897] ? process_one_work+0x1460/0x1460 [ 47.651904][ T1897] kthread+0x3a1/0x480 [ 47.652329][ T1897] ? set_kthread_struct+0x120/0x120 [ 47.652878][ T1897] ret_from_fork+0x1f/0x30 [ 47.653370][ T1897] [ 47.653608][ T1897] [ 47.653848][ T1897] addr ffffc90001f6f000 is located in stack of task kworker/0:2/1897 at offset 512 in frame: [ 47.654891][ T1897] brcmf_c_preinit_dcmds+0x0/0xc40 [ 47.655442][ T1897] [ 47.655690][ T1897] this frame has 4 objects: [ 47.656151][ T1897] [48, 56) 'ptr' [ 47.656159][ T1897] [80, 148) 'revinfo' [ 47.656534][ T1897] [192, 210) 'eventmask' [ 47.656953][ T1897] [256, 512) 'buf' [ 47.657410][ T1897] [ 47.658035][ T1897] Memory state around the buggy address: [ 47.658743][ T1897] ffffc90001f6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.659577][ T1897] ffffc90001f6ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.660394][ T1897] >ffffc90001f6f000: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 [ 47.661199][ T1897] ^ [ 47.661625][ T1897] ffffc90001f6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 47.662455][ T1897] ffffc90001f6f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 [ 47.663318][ T1897] ================================================================== [ 47.664147][ T1897] Disabling lock debugging due to kernel taint
Reported-by: Dokyung Song dokyungs@yonsei.ac.kr Reported-by: Jisoo Jang jisoo.jang@yonsei.ac.kr Reported-by: Minsuk Kang linuxlovemin@yonsei.ac.kr Signed-off-by: Jisoo Jang jisoo.jang@yonsei.ac.kr Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221115043458.37562-1-jisoo.jang@yonsei.ac.kr Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c index 4a309e5a5707b..5b484bbac8a79 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c @@ -299,6 +299,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) err); goto done; } + buf[sizeof(buf) - 1] = '\0'; ptr = (char *)buf; strsep(&ptr, "\n");
From: Paul E. McKenney paulmck@kernel.org
[ Upstream commit 0cae5ded535c3a80aed94f119bbd4ee3ae284a65 ]
Currently, RCU_LOCKDEP_WARN() checks the condition before checking to see if lockdep is still enabled. This is necessary to avoid the false-positive splats fixed by commit 3066820034b5dd ("rcu: Reject RCU_LOCKDEP_WARN() false positives"). However, the current state can result in false-positive splats during early boot before lockdep is fully initialized. This commit therefore checks debug_lockdep_rcu_enabled() both before and after checking the condition, thus avoiding both sets of false-positive error reports.
Reported-by: Steven Rostedt rostedt@goodmis.org Reported-by: Masami Hiramatsu (Google) mhiramat@kernel.org Reported-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Signed-off-by: Paul E. McKenney paulmck@kernel.org Reviewed-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Boqun Feng boqun.feng@gmail.com Cc: Matthew Wilcox willy@infradead.org Cc: Thomas Gleixner tglx@linutronix.de Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/rcupdate.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h index c0c79beac3fe6..8d4bf695e7666 100644 --- a/include/linux/rcupdate.h +++ b/include/linux/rcupdate.h @@ -376,11 +376,18 @@ static inline int debug_lockdep_rcu_enabled(void) * RCU_LOCKDEP_WARN - emit lockdep splat if specified condition is met * @c: condition to check * @s: informative message + * + * This checks debug_lockdep_rcu_enabled() before checking (c) to + * prevent early boot splats due to lockdep not yet being initialized, + * and rechecks it after checking (c) to prevent false-positive splats + * due to races with lockdep being disabled. See commit 3066820034b5dd + * ("rcu: Reject RCU_LOCKDEP_WARN() false positives") for more detail. */ #define RCU_LOCKDEP_WARN(c, s) \ do { \ static bool __section(".data.unlikely") __warned; \ - if ((c) && debug_lockdep_rcu_enabled() && !__warned) { \ + if (debug_lockdep_rcu_enabled() && (c) && \ + debug_lockdep_rcu_enabled() && !__warned) { \ __warned = true; \ lockdep_rcu_suspicious(__FILE__, __LINE__, s); \ } \
From: Paul E. McKenney paulmck@kernel.org
[ Upstream commit 2d7f00b2f01301d6e41fd4a28030dab0442265be ]
The normal grace period's RCU CPU stall warnings are invoked from the scheduling-clock interrupt handler, and can thus invoke smp_processor_id() with impunity, which allows them to directly invoke dump_cpu_task(). In contrast, the expedited grace period's RCU CPU stall warnings are invoked from process context, which causes the dump_cpu_task() function's calls to smp_processor_id() to complain bitterly in debug kernels.
This commit therefore causes synchronize_rcu_expedited_wait() to disable preemption around its call to dump_cpu_task().
Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/rcu/tree_exp.h | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h index ed6c3cce28f23..927abaf6c822e 100644 --- a/kernel/rcu/tree_exp.h +++ b/kernel/rcu/tree_exp.h @@ -667,7 +667,9 @@ static void synchronize_rcu_expedited_wait(void) mask = leaf_node_cpu_bit(rnp, cpu); if (!(READ_ONCE(rnp->expmask) & mask)) continue; + preempt_disable(); // For smp_processor_id() in dump_cpu_task(). dump_cpu_task(cpu); + preempt_enable(); } } jiffies_stall = 3 * rcu_exp_jiffies_till_stall_check() + 3;
From: Pingfan Liu kernelfans@gmail.com
[ Upstream commit 7f24626d6dd844bfc6d1f492d214d29c86d02550 ]
Commit 994f706872e6 ("srcu: Make Tree SRCU able to operate without snp_node array") assumes that cpu 0 is always online. However, there really are situations when some other CPU is the boot CPU, for example, when booting a kdump kernel with the maxcpus=1 boot parameter.
On PowerPC, the kdump kernel can hang as follows: ... [ 1.740036] systemd[1]: Hostname set to <xyz.com> [ 243.686240] INFO: task systemd:1 blocked for more than 122 seconds. [ 243.686264] Not tainted 6.1.0-rc1 #1 [ 243.686272] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 243.686281] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000 [ 243.686296] Call Trace: [ 243.686301] [c000000016657640] [c000000016657670] 0xc000000016657670 (unreliable) [ 243.686317] [c000000016657830] [c00000001001dec0] __switch_to+0x130/0x220 [ 243.686333] [c000000016657890] [c000000010f607b8] __schedule+0x1f8/0x580 [ 243.686347] [c000000016657940] [c000000010f60bb4] schedule+0x74/0x140 [ 243.686361] [c0000000166579b0] [c000000010f699b8] schedule_timeout+0x168/0x1c0 [ 243.686374] [c000000016657a80] [c000000010f61de8] __wait_for_common+0x148/0x360 [ 243.686387] [c000000016657b20] [c000000010176bb0] __flush_work.isra.0+0x1c0/0x3d0 [ 243.686401] [c000000016657bb0] [c0000000105f2768] fsnotify_wait_marks_destroyed+0x28/0x40 [ 243.686415] [c000000016657bd0] [c0000000105f21b8] fsnotify_destroy_group+0x68/0x160 [ 243.686428] [c000000016657c40] [c0000000105f6500] inotify_release+0x30/0xa0 [ 243.686440] [c000000016657cb0] [c0000000105751a8] __fput+0xc8/0x350 [ 243.686452] [c000000016657d00] [c00000001017d524] task_work_run+0xe4/0x170 [ 243.686464] [c000000016657d50] [c000000010020e94] do_notify_resume+0x134/0x140 [ 243.686478] [c000000016657d80] [c00000001002eb18] interrupt_exit_user_prepare_main+0x198/0x270 [ 243.686493] [c000000016657de0] [c00000001002ec60] syscall_exit_prepare+0x70/0x180 [ 243.686505] [c000000016657e10] [c00000001000bf7c] system_call_vectored_common+0xfc/0x280 [ 243.686520] --- interrupt: 3000 at 0x7fffa47d5ba4 [ 243.686528] NIP: 00007fffa47d5ba4 LR: 0000000000000000 CTR: 0000000000000000 [ 243.686538] REGS: c000000016657e80 TRAP: 3000 Not tainted (6.1.0-rc1) [ 243.686548] MSR: 800000000000d033 <SF,EE,PR,ME,IR,DR,RI,LE> CR: 42044440 XER: 00000000 [ 243.686572] IRQMASK: 0 [ 243.686572] GPR00: 0000000000000006 00007ffffa606710 00007fffa48e7200 0000000000000000 [ 243.686572] GPR04: 0000000000000002 000000000000000a 0000000000000000 0000000000000001 [ 243.686572] GPR08: 000001000c172dd0 0000000000000000 0000000000000000 0000000000000000 [ 243.686572] GPR12: 0000000000000000 00007fffa4ff4bc0 0000000000000000 0000000000000000 [ 243.686572] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 243.686572] GPR20: 0000000132dfdc50 000000000000000e 0000000000189375 0000000000000000 [ 243.686572] GPR24: 00007ffffa606ae0 0000000000000005 000001000c185490 000001000c172570 [ 243.686572] GPR28: 000001000c172990 000001000c184850 000001000c172e00 00007fffa4fedd98 [ 243.686683] NIP [00007fffa47d5ba4] 0x7fffa47d5ba4 [ 243.686691] LR [0000000000000000] 0x0 [ 243.686698] --- interrupt: 3000 [ 243.686708] INFO: task kworker/u16:1:24 blocked for more than 122 seconds. [ 243.686717] Not tainted 6.1.0-rc1 #1 [ 243.686724] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 243.686733] task:kworker/u16:1 state:D stack:0 pid:24 ppid:2 flags:0x00000800 [ 243.686747] Workqueue: events_unbound fsnotify_mark_destroy_workfn [ 243.686758] Call Trace: [ 243.686762] [c0000000166736e0] [c00000004fd91000] 0xc00000004fd91000 (unreliable) [ 243.686775] [c0000000166738d0] [c00000001001dec0] __switch_to+0x130/0x220 [ 243.686788] [c000000016673930] [c000000010f607b8] __schedule+0x1f8/0x580 [ 243.686801] [c0000000166739e0] [c000000010f60bb4] schedule+0x74/0x140 [ 243.686814] [c000000016673a50] [c000000010f699b8] schedule_timeout+0x168/0x1c0 [ 243.686827] [c000000016673b20] [c000000010f61de8] __wait_for_common+0x148/0x360 [ 243.686840] [c000000016673bc0] [c000000010210840] __synchronize_srcu.part.0+0xa0/0xe0 [ 243.686855] [c000000016673c30] [c0000000105f2c64] fsnotify_mark_destroy_workfn+0xc4/0x1a0 [ 243.686868] [c000000016673ca0] [c000000010174ea8] process_one_work+0x2a8/0x570 [ 243.686882] [c000000016673d40] [c000000010175208] worker_thread+0x98/0x5e0 [ 243.686895] [c000000016673dc0] [c0000000101828d4] kthread+0x124/0x130 [ 243.686908] [c000000016673e10] [c00000001000cd40] ret_from_kernel_thread+0x5c/0x64 [ 366.566274] INFO: task systemd:1 blocked for more than 245 seconds. [ 366.566298] Not tainted 6.1.0-rc1 #1 [ 366.566305] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 366.566314] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000 [ 366.566329] Call Trace: ...
The above splat occurs because PowerPC really does use maxcpus=1 instead of nr_cpus=1 in the kernel command line. Consequently, the (quite possibly non-zero) kdump CPU is the only online CPU in the kdump kernel. SRCU unconditionally queues a sdp->work on cpu 0, for which no worker thread has been created, so sdp->work will be never executed and __synchronize_srcu() will never be completed.
This commit therefore replaces CPU ID 0 with get_boot_cpu_id() in key places in Tree SRCU. Since the CPU indicated by get_boot_cpu_id() is guaranteed to be online, this avoids the above splat.
Signed-off-by: Pingfan Liu kernelfans@gmail.com Cc: "Paul E. McKenney" paulmck@kernel.org Cc: Lai Jiangshan jiangshanlai@gmail.com Cc: Josh Triplett josh@joshtriplett.org Cc: Steven Rostedt rostedt@goodmis.org Cc: Mathieu Desnoyers mathieu.desnoyers@efficios.com To: rcu@vger.kernel.org Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/rcu/srcutree.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c index ca4b5dcec675b..16953784a0bdf 100644 --- a/kernel/rcu/srcutree.c +++ b/kernel/rcu/srcutree.c @@ -726,7 +726,7 @@ static void srcu_gp_start(struct srcu_struct *ssp) int state;
if (smp_load_acquire(&ssp->srcu_size_state) < SRCU_SIZE_WAIT_BARRIER) - sdp = per_cpu_ptr(ssp->sda, 0); + sdp = per_cpu_ptr(ssp->sda, get_boot_cpu_id()); else sdp = this_cpu_ptr(ssp->sda); lockdep_assert_held(&ACCESS_PRIVATE(ssp, lock)); @@ -837,7 +837,8 @@ static void srcu_gp_end(struct srcu_struct *ssp) /* Initiate callback invocation as needed. */ ss_state = smp_load_acquire(&ssp->srcu_size_state); if (ss_state < SRCU_SIZE_WAIT_BARRIER) { - srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, 0), cbdelay); + srcu_schedule_cbs_sdp(per_cpu_ptr(ssp->sda, get_boot_cpu_id()), + cbdelay); } else { idx = rcu_seq_ctr(gpseq) % ARRAY_SIZE(snp->srcu_have_cbs); srcu_for_each_node_breadth_first(ssp, snp) { @@ -1161,7 +1162,7 @@ static unsigned long srcu_gp_start_if_needed(struct srcu_struct *ssp, idx = __srcu_read_lock_nmisafe(ssp); ss_state = smp_load_acquire(&ssp->srcu_size_state); if (ss_state < SRCU_SIZE_WAIT_CALL) - sdp = per_cpu_ptr(ssp->sda, 0); + sdp = per_cpu_ptr(ssp->sda, get_boot_cpu_id()); else sdp = raw_cpu_ptr(ssp->sda); spin_lock_irqsave_sdp_contention(sdp, &flags); @@ -1497,7 +1498,7 @@ void srcu_barrier(struct srcu_struct *ssp)
idx = __srcu_read_lock_nmisafe(ssp); if (smp_load_acquire(&ssp->srcu_size_state) < SRCU_SIZE_WAIT_BARRIER) - srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, 0)); + srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, get_boot_cpu_id())); else for_each_possible_cpu(cpu) srcu_barrier_one_cpu(ssp, per_cpu_ptr(ssp->sda, cpu));
From: Zqiang qiang1.zhang@intel.com
[ Upstream commit ea5c8987fef20a8cca07e428aa28bc64649c5104 ]
The synchronize_rcu_tasks_rude() function invokes rcu_tasks_rude_wait_gp() to wait one rude RCU-tasks grace period. The rcu_tasks_rude_wait_gp() function in turn checks if there is only a single online CPU. If so, it will immediately return, because a call to synchronize_rcu_tasks_rude() is by definition a grace period on a single-CPU system. (We could have blocked!)
Unfortunately, this check uses num_online_cpus() without synchronization, which can result in too-short grace periods. To see this, consider the following scenario:
CPU0 CPU1 (going offline) migration/1 task: cpu_stopper_thread -> take_cpu_down -> _cpu_disable (dec __num_online_cpus) ->cpuhp_invoke_callback preempt_disable access old_data0 task1 del old_data0 ..... synchronize_rcu_tasks_rude() task1 schedule out .... task2 schedule in rcu_tasks_rude_wait_gp() ->__num_online_cpus == 1 ->return .... task1 schedule in ->free old_data0 preempt_enable
When CPU1 decrements __num_online_cpus, its value becomes 1. However, CPU1 has not finished going offline, and will take one last trip through the scheduler and the idle loop before it actually stops executing instructions. Because synchronize_rcu_tasks_rude() is mostly used for tracing, and because both the scheduler and the idle loop can be traced, this means that CPU0's prematurely ended grace period might disrupt the tracing on CPU1. Given that this disruption might include CPU1 executing instructions in memory that was just now freed (and maybe reallocated), this is a matter of some concern.
This commit therefore removes that problematic single-CPU check from the rcu_tasks_rude_wait_gp() function. This dispenses with the single-CPU optimization, but there is no evidence indicating that this optimization is important. In addition, synchronize_rcu_tasks_generic() contains a similar optimization (albeit only for early boot), which also splats. (As in exactly why are you invoking synchronize_rcu_tasks_rude() so early in boot, anyway???)
It is OK for the synchronize_rcu_tasks_rude() function's check to be unsynchronized because the only times that this check can evaluate to true is when there is only a single CPU running with preemption disabled.
While in the area, this commit also fixes a minor bug in which a call to synchronize_rcu_tasks_rude() would instead be attributed to synchronize_rcu_tasks().
[ paulmck: Add "synchronize_" prefix and "()" suffix. ]
Signed-off-by: Zqiang qiang1.zhang@intel.com Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/rcu/tasks.h | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h index 03388e2e29df0..947d0318b4a2d 100644 --- a/kernel/rcu/tasks.h +++ b/kernel/rcu/tasks.h @@ -560,8 +560,9 @@ static int __noreturn rcu_tasks_kthread(void *arg) static void synchronize_rcu_tasks_generic(struct rcu_tasks *rtp) { /* Complain if the scheduler has not started. */ - WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE, - "synchronize_rcu_tasks called too soon"); + if (WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE, + "synchronize_%s() called too soon", rtp->name)) + return;
// If the grace-period kthread is running, use it. if (READ_ONCE(rtp->kthread_ptr)) { @@ -1064,9 +1065,6 @@ static void rcu_tasks_be_rude(struct work_struct *work) // Wait for one rude RCU-tasks grace period. static void rcu_tasks_rude_wait_gp(struct rcu_tasks *rtp) { - if (num_online_cpus() <= 1) - return; // Fastpath for only one CPU. - rtp->n_ipis += cpumask_weight(cpu_online_mask); schedule_on_each_cpu(rcu_tasks_be_rude); }
From: Zqiang qiang1.zhang@intel.com
[ Upstream commit a4fcfbee8f6274f9b3f9a71dd5b03e6772ce33f3 ]
The rcu_tasks_need_gpcb() determines whether or not: (1) There are callbacks needing another grace period, (2) There are callbacks ready to be invoked, and (3) It would be a good time to shrink back down to a single-CPU callback list. This third case is interesting because some other CPU might be adding new callbacks, which might suddenly make this a very bad time to be shrinking.
This is currently handled by requiring call_rcu_tasks_generic() to enqueue callbacks under the protection of rcu_read_lock() and requiring rcu_tasks_need_gpcb() to wait for an RCU grace period to elapse before finalizing the transition. This works well in practice.
Unfortunately, the current code assumes that a grace period whose end is detected by the poll_state_synchronize_rcu() in the second "if" condition actually ended before the earlier code counted the callbacks queued on CPUs other than CPU 0 (local variable "ncbsnz"). Given the current code, it is possible that a long-delayed call_rcu_tasks_generic() invocation will queue a callback on a non-zero CPU after these CPUs have had their callbacks counted and zero has been stored to ncbsnz. Such a callback would trigger the WARN_ON_ONCE() in the second "if" statement.
To see this, consider the following sequence of events:
o CPU 0 invokes rcu_tasks_one_gp(), and counts fewer than rcu_task_collapse_lim callbacks. It sees at least one callback queued on some other CPU, thus setting ncbsnz to a non-zero value.
o CPU 1 invokes call_rcu_tasks_generic() and loads 42 from ->percpu_enqueue_lim. It therefore decides to enqueue its callback onto CPU 1's callback list, but is delayed.
o CPU 0 sees the rcu_task_cb_adjust is non-zero and that the number of callbacks does not exceed rcu_task_collapse_lim. It therefore checks percpu_enqueue_lim, and sees that its value is greater than the value one. CPU 0 therefore starts the shift back to a single callback list. It sets ->percpu_enqueue_lim to 1, but CPU 1 has already read the old value of 42. It also gets a grace-period state value from get_state_synchronize_rcu().
o CPU 0 sees that ncbsnz is non-zero in its second "if" statement, so it declines to finalize the shrink operation.
o CPU 0 again invokes rcu_tasks_one_gp(), and counts fewer than rcu_task_collapse_lim callbacks. It also sees that there are no callback queued on any other CPU, and thus sets ncbsnz to zero.
o CPU 1 resumes execution and enqueues its callback onto its own list. This invalidates the value of ncbsnz.
o CPU 0 sees the rcu_task_cb_adjust is non-zero and that the number of callbacks does not exceed rcu_task_collapse_lim. It therefore checks percpu_enqueue_lim, but sees that its value is already unity. It therefore does not get a new grace-period state value.
o CPU 0 sees that rcu_task_cb_adjust is non-zero, ncbsnz is zero, and that poll_state_synchronize_rcu() says that the grace period has completed. it therefore finalizes the shrink operation, setting ->percpu_dequeue_lim to the value one.
o CPU 0 does a debug check, scanning the other CPUs' callback lists. It sees that CPU 1's list has a callback, so it (rightly) triggers the WARN_ON_ONCE(). After all, the new value of ->percpu_dequeue_lim says to not bother looking at CPU 1's callback list, which means that this callback will never be invoked. This can result in hangs and maybe even OOMs.
Based on long experience with rcutorture, this is an extremely low-probability race condition, but it really can happen, especially in preemptible kernels or within guest OSes.
This commit therefore checks for completion of the grace period before counting callbacks. With this change, in the above failure scenario CPU 0 would know not to prematurely end the shrink operation because the grace period would not have completed before the count operation started.
[ paulmck: Adjust grace-period end rather than adding RCU reader. ] [ paulmck: Avoid spurious WARN_ON_ONCE() with ->percpu_dequeue_lim check. ]
Signed-off-by: Zqiang qiang1.zhang@intel.com Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/rcu/tasks.h | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h index 947d0318b4a2d..d5a4a129a85e9 100644 --- a/kernel/rcu/tasks.h +++ b/kernel/rcu/tasks.h @@ -384,6 +384,7 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) { int cpu; unsigned long flags; + bool gpdone = poll_state_synchronize_rcu(rtp->percpu_dequeue_gpseq); long n; long ncbs = 0; long ncbsnz = 0; @@ -425,21 +426,23 @@ static int rcu_tasks_need_gpcb(struct rcu_tasks *rtp) WRITE_ONCE(rtp->percpu_enqueue_shift, order_base_2(nr_cpu_ids)); smp_store_release(&rtp->percpu_enqueue_lim, 1); rtp->percpu_dequeue_gpseq = get_state_synchronize_rcu(); + gpdone = false; pr_info("Starting switch %s to CPU-0 callback queuing.\n", rtp->name); } raw_spin_unlock_irqrestore(&rtp->cbs_gbl_lock, flags); } - if (rcu_task_cb_adjust && !ncbsnz && - poll_state_synchronize_rcu(rtp->percpu_dequeue_gpseq)) { + if (rcu_task_cb_adjust && !ncbsnz && gpdone) { raw_spin_lock_irqsave(&rtp->cbs_gbl_lock, flags); if (rtp->percpu_enqueue_lim < rtp->percpu_dequeue_lim) { WRITE_ONCE(rtp->percpu_dequeue_lim, 1); pr_info("Completing switch %s to CPU-0 callback queuing.\n", rtp->name); } - for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) { - struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu); + if (rtp->percpu_dequeue_lim == 1) { + for (cpu = rtp->percpu_dequeue_lim; cpu < nr_cpu_ids; cpu++) { + struct rcu_tasks_percpu *rtpcp = per_cpu_ptr(rtp->rtpcpu, cpu);
- WARN_ON_ONCE(rcu_segcblist_n_cbs(&rtpcp->cblist)); + WARN_ON_ONCE(rcu_segcblist_n_cbs(&rtpcp->cblist)); + } } raw_spin_unlock_irqrestore(&rtp->cbs_gbl_lock, flags); }
From: Kalle Valo quic_kvalo@quicinc.com
[ Upstream commit 323d91d4684d238f6bc3693fed93caf795378fe0 ]
ath11k fails to load if there are multiple ath11k PCI devices with same name:
ath11k_pci 0000:01:00.0: Hardware name qcn9074 hw1.0 debugfs: Directory 'ath11k' with parent '/' already present! ath11k_pci 0000:01:00.0: failed to create ath11k debugfs ath11k_pci 0000:01:00.0: failed to create soc core: -17 ath11k_pci 0000:01:00.0: failed to init core: -17 ath11k_pci: probe of 0000:01:00.0 failed with error -17
Fix this by creating a directory for each ath11k device using schema <bus>-<devname>, for example "pci-0000:06:00.0". This directory created under the top-level ath11k directory, for example /sys/kernel/debug/ath11k.
The reference to the toplevel ath11k directory is not stored anymore within ath11k, instead it's retrieved using debugfs_lookup(). If the directory does not exist it will be created. After the last directory from the ath11k directory is removed, for example when doing rmmod ath11k, the empty ath11k directory is left in place, it's a minor cosmetic issue anyway.
Here's an example hierarchy with one WCN6855:
ath11k `-- pci-0000:06:00.0 |-- mac0 | |-- dfs_block_radar_events | |-- dfs_simulate_radar | |-- ext_rx_stats | |-- ext_tx_stats | |-- fw_dbglog_config | |-- fw_stats | | |-- beacon_stats | | |-- pdev_stats | | `-- vdev_stats | |-- htt_stats | |-- htt_stats_reset | |-- htt_stats_type | `-- pktlog_filter |-- simulate_fw_crash `-- soc_dp_stats
I didn't have a test setup where I could connect multiple ath11k devices to the same the host, so I have only tested this with one device.
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
Tested-by: Robert Marko robert.marko@sartura.hr Signed-off-by: Kalle Valo quic_kvalo@quicinc.com Link: https://lore.kernel.org/r/20221220121231.20120-1-kvalo@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ath/ath11k/core.h | 1 - drivers/net/wireless/ath/ath11k/debugfs.c | 48 +++++++++++++++++++---- 2 files changed, 40 insertions(+), 9 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h index 22460b0abf037..ac34c57e4bc69 100644 --- a/drivers/net/wireless/ath/ath11k/core.h +++ b/drivers/net/wireless/ath/ath11k/core.h @@ -912,7 +912,6 @@ struct ath11k_base { enum ath11k_dfs_region dfs_region; #ifdef CONFIG_ATH11K_DEBUGFS struct dentry *debugfs_soc; - struct dentry *debugfs_ath11k; #endif struct ath11k_soc_dp_stats soc_stats;
diff --git a/drivers/net/wireless/ath/ath11k/debugfs.c b/drivers/net/wireless/ath/ath11k/debugfs.c index ccdf3d5ba1ab6..5bb6fd17fdf6f 100644 --- a/drivers/net/wireless/ath/ath11k/debugfs.c +++ b/drivers/net/wireless/ath/ath11k/debugfs.c @@ -976,10 +976,6 @@ int ath11k_debugfs_pdev_create(struct ath11k_base *ab) if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags)) return 0;
- ab->debugfs_soc = debugfs_create_dir(ab->hw_params.name, ab->debugfs_ath11k); - if (IS_ERR(ab->debugfs_soc)) - return PTR_ERR(ab->debugfs_soc); - debugfs_create_file("simulate_fw_crash", 0600, ab->debugfs_soc, ab, &fops_simulate_fw_crash);
@@ -1001,15 +997,51 @@ void ath11k_debugfs_pdev_destroy(struct ath11k_base *ab)
int ath11k_debugfs_soc_create(struct ath11k_base *ab) { - ab->debugfs_ath11k = debugfs_create_dir("ath11k", NULL); + struct dentry *root; + bool dput_needed; + char name[64]; + int ret; + + root = debugfs_lookup("ath11k", NULL); + if (!root) { + root = debugfs_create_dir("ath11k", NULL); + if (IS_ERR_OR_NULL(root)) + return PTR_ERR(root); + + dput_needed = false; + } else { + /* a dentry from lookup() needs dput() after we don't use it */ + dput_needed = true; + } + + scnprintf(name, sizeof(name), "%s-%s", ath11k_bus_str(ab->hif.bus), + dev_name(ab->dev)); + + ab->debugfs_soc = debugfs_create_dir(name, root); + if (IS_ERR_OR_NULL(ab->debugfs_soc)) { + ret = PTR_ERR(ab->debugfs_soc); + goto out; + } + + ret = 0;
- return PTR_ERR_OR_ZERO(ab->debugfs_ath11k); +out: + if (dput_needed) + dput(root); + + return ret; }
void ath11k_debugfs_soc_destroy(struct ath11k_base *ab) { - debugfs_remove_recursive(ab->debugfs_ath11k); - ab->debugfs_ath11k = NULL; + debugfs_remove_recursive(ab->debugfs_soc); + ab->debugfs_soc = NULL; + + /* We are not removing ath11k directory on purpose, even if it + * would be empty. This simplifies the directory handling and it's + * a minor cosmetic issue to leave an empty ath11k directory to + * debugfs. + */ } EXPORT_SYMBOL(ath11k_debugfs_soc_destroy);
From: Yang Li yang.lee@linux.alibaba.com
[ Upstream commit e7fcfe67f9f410736b758969477b17ea285e8e6c ]
The return value from the call to intel_tcc_get_tjmax() is int, which can be a negative error code. However, the return value is being assigned to an u32 variable 'tj_max', so making 'tj_max' an int.
Eliminate the following warning: ./drivers/thermal/intel/intel_soc_dts_iosf.c:394:5-11: WARNING: Unsigned expression compared with zero: tj_max < 0
Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3637 Reported-by: Abaci Robot abaci@linux.alibaba.com Signed-off-by: Yang Li yang.lee@linux.alibaba.com Acked-by: Zhang Rui rui.zhang@intel.com Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/thermal/intel/intel_soc_dts_iosf.c b/drivers/thermal/intel/intel_soc_dts_iosf.c index 342b0bb5a56d9..8651ff1abe754 100644 --- a/drivers/thermal/intel/intel_soc_dts_iosf.c +++ b/drivers/thermal/intel/intel_soc_dts_iosf.c @@ -405,7 +405,7 @@ struct intel_soc_dts_sensors *intel_soc_dts_iosf_init( { struct intel_soc_dts_sensors *sensors; bool notification; - u32 tj_max; + int tj_max; int ret; int i;
From: Jann Horn jannh@google.com
[ Upstream commit 9f76d59173d9d146e96c66886b671c1915a5c5e5 ]
The nanosleep syscalls use the restart_block mechanism, with a quirk: The `type` and `rmtp`/`compat_rmtp` fields are set up unconditionally on syscall entry, while the rest of the restart_block is only set up in the unlikely case that the syscall is actually interrupted by a signal (or pseudo-signal) that doesn't have a signal handler.
If the restart_block was set up by a previous syscall (futex(..., FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then, this will clobber some of the union fields used by futex_wait_restart() and do_restart_poll().
If userspace afterwards wrongly calls the restart_syscall syscall, futex_wait_restart()/do_restart_poll() will read struct fields that have been clobbered.
This doesn't actually lead to anything particularly interesting because none of the union fields contain trusted kernel data, and futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much sense to apply seccomp filters to their arguments.
So the current consequences are just of the "if userspace does bad stuff, it can damage itself, and that's not a problem" flavor.
But still, it seems like a hazard for future developers, so invalidate the restart_block when partly setting it up in the nanosleep syscalls.
Signed-off-by: Jann Horn jannh@google.com Signed-off-by: Thomas Gleixner tglx@linutronix.de Link: https://lore.kernel.org/r/20230105134403.754986-1-jannh@google.com Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/time/hrtimer.c | 2 ++ kernel/time/posix-stubs.c | 2 ++ kernel/time/posix-timers.c | 2 ++ 3 files changed, 6 insertions(+)
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index 3ae661ab62603..e4f0e3b0c4f4f 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -2126,6 +2126,7 @@ SYSCALL_DEFINE2(nanosleep, struct __kernel_timespec __user *, rqtp, if (!timespec64_valid(&tu)) return -EINVAL;
+ current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; current->restart_block.nanosleep.rmtp = rmtp; return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL, @@ -2147,6 +2148,7 @@ SYSCALL_DEFINE2(nanosleep_time32, struct old_timespec32 __user *, rqtp, if (!timespec64_valid(&tu)) return -EINVAL;
+ current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; current->restart_block.nanosleep.compat_rmtp = rmtp; return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL, diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c index 90ea5f373e50e..828aeecbd1e8a 100644 --- a/kernel/time/posix-stubs.c +++ b/kernel/time/posix-stubs.c @@ -147,6 +147,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags, return -EINVAL; if (flags & TIMER_ABSTIME) rmtp = NULL; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; current->restart_block.nanosleep.rmtp = rmtp; texp = timespec64_to_ktime(t); @@ -240,6 +241,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags, return -EINVAL; if (flags & TIMER_ABSTIME) rmtp = NULL; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; current->restart_block.nanosleep.compat_rmtp = rmtp; texp = timespec64_to_ktime(t); diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c index 5dead89308b74..0c8a87a11b39d 100644 --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -1270,6 +1270,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags, return -EINVAL; if (flags & TIMER_ABSTIME) rmtp = NULL; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; current->restart_block.nanosleep.rmtp = rmtp;
@@ -1297,6 +1298,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags, return -EINVAL; if (flags & TIMER_ABSTIME) rmtp = NULL; + current->restart_block.fn = do_no_restart_syscall; current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; current->restart_block.nanosleep.compat_rmtp = rmtp;
From: Breno Leitao leitao@debian.org
[ Upstream commit 0125acda7d76b943ca55811df40ed6ec0ecf670f ]
Currently, x86_spec_ctrl_base is read at boot time and speculative bits are set if Kconfig items are enabled. For example, IBRS is enabled if CONFIG_CPU_IBRS_ENTRY is configured, etc. These MSR bits are not cleared if the mitigations are disabled.
This is a problem when kexec-ing a kernel that has the mitigation disabled from a kernel that has the mitigation enabled. In this case, the MSR bits are not cleared during the new kernel boot. As a result, this might have some performance degradation that is hard to pinpoint.
This problem does not happen if the machine is (hard) rebooted because the bit will be cleared by default.
[ bp: Massage. ]
Suggested-by: Pawan Gupta pawan.kumar.gupta@linux.intel.com Signed-off-by: Breno Leitao leitao@debian.org Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Link: https://lore.kernel.org/r/20221128153148.1129350-1-leitao@debian.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/include/asm/msr-index.h | 4 ++++ arch/x86/kernel/cpu/bugs.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index d3fe82c5d6b66..978a3e203cdbb 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -49,6 +49,10 @@ #define SPEC_CTRL_RRSBA_DIS_S_SHIFT 6 /* Disable RRSBA behavior */ #define SPEC_CTRL_RRSBA_DIS_S BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT)
+/* A mask for bits which the kernel toggles when controlling mitigations */ +#define SPEC_CTRL_MITIGATIONS_MASK (SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD \ + | SPEC_CTRL_RRSBA_DIS_S) + #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */ #define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index bca0bd8f48464..374bc620fb867 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -144,9 +144,17 @@ void __init check_bugs(void) * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD * init code as it is not enumerated and depends on the family. */ - if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) + if (cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL)) { rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+ /* + * Previously running kernel (kexec), may have some controls + * turned ON. Clear them and let the mitigations setup below + * rediscover them based on configuration. + */ + x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK; + } + /* Select the proper CPU mitigations before patching alternatives: */ spectre_v1_select_mitigation(); spectre_v2_select_mitigation();
From: Holger Hoffstätte holger@applied-asynchrony.com
[ Upstream commit 878625e1c7a10dfbb1fdaaaae2c4d2a58fbce627 ]
When the clang toolchain has stack protection enabled in order to be consistent with gcc - which just happens to be the case on Gentoo - the bpftool build fails:
[...] clang \ -I. \ -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/include/uapi/ \ -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/bpf/bpftool/bootstrap/libbpf/include \ -g -O2 -Wall -target bpf -c skeleton/pid_iter.bpf.c -o pid_iter.bpf.o clang \ -I. \ -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/include/uapi/ \ -I/tmp/portage/dev-util/bpftool-6.0.12/work/linux-6.0/tools/bpf/bpftool/bootstrap/libbpf/include \ -g -O2 -Wall -target bpf -c skeleton/profiler.bpf.c -o profiler.bpf.o skeleton/profiler.bpf.c:40:14: error: A call to built-in function '__stack_chk_fail' is not supported. int BPF_PROG(fentry_XXX) ^ skeleton/profiler.bpf.c:94:14: error: A call to built-in function '__stack_chk_fail' is not supported. int BPF_PROG(fexit_XXX) ^ 2 errors generated. [...]
Since stack-protector makes no sense for the BPF bits just unconditionally disable it.
Bug: https://bugs.gentoo.org/890638 Signed-off-by: Holger Hoffstätte holger@applied-asynchrony.com Signed-off-by: Daniel Borkmann daniel@iogearbox.net Acked-by: Quentin Monnet quentin@isovalent.com Link: https://lore.kernel.org/bpf/74cd9d2e-6052-312a-241e-2b514a75c92c@applied-asy... Signed-off-by: Sasha Levin sashal@kernel.org --- tools/bpf/bpftool/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/bpf/bpftool/Makefile b/tools/bpf/bpftool/Makefile index f610e184ce02a..270066aff8bf1 100644 --- a/tools/bpf/bpftool/Makefile +++ b/tools/bpf/bpftool/Makefile @@ -215,7 +215,8 @@ $(OUTPUT)%.bpf.o: skeleton/%.bpf.c $(OUTPUT)vmlinux.h $(LIBBPF_BOOTSTRAP) -I$(or $(OUTPUT),.) \ -I$(srctree)/tools/include/uapi/ \ -I$(LIBBPF_BOOTSTRAP_INCLUDE) \ - -g -O2 -Wall -target bpf -c $< -o $@ + -g -O2 -Wall -fno-stack-protector \ + -target bpf -c $< -o $@ $(Q)$(LLVM_STRIP) -g $@
$(OUTPUT)%.skel.h: $(OUTPUT)%.bpf.o $(BPFTOOL_BOOTSTRAP)
From: Jisoo Jang jisoo.jang@yonsei.ac.kr
[ Upstream commit 660145d708be52f946a82e5b633c020f58f996de ]
Fix a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with a CLM version string by memcpy() in brcmf_fil_iovar_data_get(). Ensure buf is null-terminated.
Found by a modified version of syzkaller.
[ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22 [ 33.021554][ T1896] ================================================================== [ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110 [ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896 [ 33.023852][ T1896] [ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 [ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event [ 33.026581][ T1896] Call Trace: [ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d [ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334 [ 33.028037][ T1896] ? strreplace+0xf2/0x110 [ 33.028403][ T1896] ? strreplace+0xf2/0x110 [ 33.028807][ T1896] kasan_report.cold+0x83/0xdf [ 33.029283][ T1896] ? strreplace+0xf2/0x110 [ 33.029666][ T1896] strreplace+0xf2/0x110 [ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40 [ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0 [ 33.032091][ T1896] ? find_held_lock+0x2d/0x110 [ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260 [ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 33.033582][ T1896] brcmf_attach+0x246/0xd40 [ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50 [ 33.034383][ T1896] ? kmemdup+0x30/0x40 [ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690 [ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 33.035833][ T1896] usb_probe_interface+0x25f/0x710 [ 33.036315][ T1896] really_probe+0x1be/0xa90 [ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460 [ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0 [ 33.037383][ T1896] driver_probe_device+0x49/0x120 [ 33.037790][ T1896] __device_attach_driver+0x18a/0x250 [ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120 [ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0 [ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20 [ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120 [ 33.042330][ T1896] __device_attach+0x207/0x330 [ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0 [ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0 [ 33.043515][ T1896] bus_probe_device+0x1a2/0x260 [ 33.043914][ T1896] device_add+0xa61/0x1ce0 [ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660 [ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 [ 33.045531][ T1896] usb_set_configuration+0x984/0x1770 [ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230 [ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90 [ 33.046931][ T1896] usb_probe_device+0x9c/0x220 [ 33.047434][ T1896] really_probe+0x1be/0xa90 [ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460 [ 33.048134][ T1896] driver_probe_device+0x49/0x120 [ 33.048516][ T1896] __device_attach_driver+0x18a/0x250 [ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120 [ 33.049437][ T1896] bus_for_each_drv+0x123/0x1a0 [ 33.049814][ T1896] ? bus_rescan_devices+0x20/0x20 [ 33.050164][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.050579][ T1896] ? trace_hardirqs_on+0x1c/0x120 [ 33.050936][ T1896] __device_attach+0x207/0x330 [ 33.051399][ T1896] ? device_bind_driver+0xb0/0xb0 [ 33.051888][ T1896] ? kobject_uevent_env+0x230/0x12c0 [ 33.052314][ T1896] bus_probe_device+0x1a2/0x260 [ 33.052688][ T1896] device_add+0xa61/0x1ce0 [ 33.053121][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 [ 33.053568][ T1896] usb_new_device.cold+0x463/0xf66 [ 33.053953][ T1896] ? hub_disconnect+0x400/0x400 [ 33.054313][ T1896] ? rwlock_bug.part.0+0x90/0x90 [ 33.054661][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.055094][ T1896] hub_event+0x10d5/0x3330 [ 33.055530][ T1896] ? hub_port_debounce+0x280/0x280 [ 33.055934][ T1896] ? __lock_acquire+0x1671/0x5790 [ 33.056387][ T1896] ? wq_calc_node_cpumask+0x170/0x2a0 [ 33.056924][ T1896] ? lock_release+0x640/0x640 [ 33.057383][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 33.057916][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 33.058402][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 33.059019][ T1896] process_one_work+0x873/0x13e0 [ 33.059488][ T1896] ? lock_release+0x640/0x640 [ 33.059932][ T1896] ? pwq_dec_nr_in_flight+0x320/0x320 [ 33.060446][ T1896] ? rwlock_bug.part.0+0x90/0x90 [ 33.060898][ T1896] worker_thread+0x8b/0xd10 [ 33.061348][ T1896] ? __kthread_parkme+0xd9/0x1d0 [ 33.061810][ T1896] ? process_one_work+0x13e0/0x13e0 [ 33.062288][ T1896] kthread+0x379/0x450 [ 33.062660][ T1896] ? _raw_spin_unlock_irq+0x24/0x30 [ 33.063148][ T1896] ? set_kthread_struct+0x100/0x100 [ 33.063606][ T1896] ret_from_fork+0x1f/0x30 [ 33.064070][ T1896] [ 33.064313][ T1896] [ 33.064545][ T1896] addr ffffc90001d6efc8 is located in stack of task kworker/0:2/1896 at offset 512 in frame: [ 33.065478][ T1896] brcmf_c_preinit_dcmds+0x0/0xc40 [ 33.065973][ T1896] [ 33.066191][ T1896] this frame has 4 objects: [ 33.066614][ T1896] [48, 56) 'ptr' [ 33.066618][ T1896] [80, 148) 'revinfo' [ 33.066957][ T1896] [192, 210) 'eventmask' [ 33.067338][ T1896] [256, 512) 'buf' [ 33.067742][ T1896] [ 33.068304][ T1896] Memory state around the buggy address: [ 33.068838][ T1896] ffffc90001d6ee80: f2 00 00 02 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 [ 33.069545][ T1896] ffffc90001d6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.070626][ T1896] >ffffc90001d6ef80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 [ 33.072052][ T1896] ^ [ 33.073043][ T1896] ffffc90001d6f000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.074230][ T1896] ffffc90001d6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.074914][ T1896] ================================================================== [ 33.075713][ T1896] Disabling lock debugging due to kernel taint
Reviewed-by: Arend van Sprielarend.vanspriel@broadcom.com Signed-off-by: Jisoo Jang jisoo.jang@yonsei.ac.kr Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221230075139.56591-1-jisoo.jang@yonsei.ac.kr Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c index 5b484bbac8a79..f235beaddddba 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c @@ -320,15 +320,17 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) if (err) { brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err); } else { + buf[sizeof(buf) - 1] = '\0'; clmver = (char *)buf; - /* store CLM version for adding it to revinfo debugfs file */ - memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver));
/* Replace all newline/linefeed characters with space * character */ strreplace(clmver, '\n', ' ');
+ /* store CLM version for adding it to revinfo debugfs file */ + memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver)); + brcmf_dbg(INFO, "CLM version = %s\n", clmver); }
From: Zong-Zhe Yang kevin_yang@realtek.com
[ Upstream commit 7f495de6ae7d31f098970fb45a038c9f69b1bf75 ]
TX BD's RAM table describes how HW allocates usable buffer section for each TX channel at fetch time. The total RAM size for TX BD is chip-dependent. For 8852BE, it has only half size (32) for TX channels of single band. Original table arrange total size (64) for dual band. It will overflow on 8852BE circuit and cause section conflicts between different TX channels.
So, we do the changes below. * add another table for single band chip and export both kind of tables * point to the expected one in rtw89_pci_info by chip
Signed-off-by: Zong-Zhe Yang kevin_yang@realtek.com Signed-off-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230113090632.60957-4-pkshih@realtek.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw89/pci.c | 15 ++++++++++++++- drivers/net/wireless/realtek/rtw89/pci.h | 15 +++++++++------ drivers/net/wireless/realtek/rtw89/rtw8852ae.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852be.c | 1 + drivers/net/wireless/realtek/rtw89/rtw8852ce.c | 1 + 5 files changed, 26 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c index 1c4500ba777c6..0ea734c81b4f0 100644 --- a/drivers/net/wireless/realtek/rtw89/pci.c +++ b/drivers/net/wireless/realtek/rtw89/pci.c @@ -1384,7 +1384,7 @@ static int rtw89_pci_ops_tx_write(struct rtw89_dev *rtwdev, struct rtw89_core_tx return 0; }
-static const struct rtw89_pci_bd_ram bd_ram_table[RTW89_TXCH_NUM] = { +const struct rtw89_pci_bd_ram rtw89_bd_ram_table_dual[RTW89_TXCH_NUM] = { [RTW89_TXCH_ACH0] = {.start_idx = 0, .max_num = 5, .min_num = 2}, [RTW89_TXCH_ACH1] = {.start_idx = 5, .max_num = 5, .min_num = 2}, [RTW89_TXCH_ACH2] = {.start_idx = 10, .max_num = 5, .min_num = 2}, @@ -1399,11 +1399,24 @@ static const struct rtw89_pci_bd_ram bd_ram_table[RTW89_TXCH_NUM] = { [RTW89_TXCH_CH11] = {.start_idx = 55, .max_num = 5, .min_num = 1}, [RTW89_TXCH_CH12] = {.start_idx = 60, .max_num = 4, .min_num = 1}, }; +EXPORT_SYMBOL(rtw89_bd_ram_table_dual); + +const struct rtw89_pci_bd_ram rtw89_bd_ram_table_single[RTW89_TXCH_NUM] = { + [RTW89_TXCH_ACH0] = {.start_idx = 0, .max_num = 5, .min_num = 2}, + [RTW89_TXCH_ACH1] = {.start_idx = 5, .max_num = 5, .min_num = 2}, + [RTW89_TXCH_ACH2] = {.start_idx = 10, .max_num = 5, .min_num = 2}, + [RTW89_TXCH_ACH3] = {.start_idx = 15, .max_num = 5, .min_num = 2}, + [RTW89_TXCH_CH8] = {.start_idx = 20, .max_num = 4, .min_num = 1}, + [RTW89_TXCH_CH9] = {.start_idx = 24, .max_num = 4, .min_num = 1}, + [RTW89_TXCH_CH12] = {.start_idx = 28, .max_num = 4, .min_num = 1}, +}; +EXPORT_SYMBOL(rtw89_bd_ram_table_single);
static void rtw89_pci_reset_trx_rings(struct rtw89_dev *rtwdev) { struct rtw89_pci *rtwpci = (struct rtw89_pci *)rtwdev->priv; const struct rtw89_pci_info *info = rtwdev->pci_info; + const struct rtw89_pci_bd_ram *bd_ram_table = *info->bd_ram_table; struct rtw89_pci_tx_ring *tx_ring; struct rtw89_pci_rx_ring *rx_ring; struct rtw89_pci_dma_ring *bd_ring; diff --git a/drivers/net/wireless/realtek/rtw89/pci.h b/drivers/net/wireless/realtek/rtw89/pci.h index 7d033501d4d95..1e19740db8c54 100644 --- a/drivers/net/wireless/realtek/rtw89/pci.h +++ b/drivers/net/wireless/realtek/rtw89/pci.h @@ -750,6 +750,12 @@ struct rtw89_pci_ch_dma_addr_set { struct rtw89_pci_ch_dma_addr rx[RTW89_RXCH_NUM]; };
+struct rtw89_pci_bd_ram { + u8 start_idx; + u8 max_num; + u8 min_num; +}; + struct rtw89_pci_info { enum mac_ax_bd_trunc_mode txbd_trunc_mode; enum mac_ax_bd_trunc_mode rxbd_trunc_mode; @@ -785,6 +791,7 @@ struct rtw89_pci_info { u32 tx_dma_ch_mask; const struct rtw89_pci_bd_idx_addr *bd_idx_addr_low_power; const struct rtw89_pci_ch_dma_addr_set *dma_addr_set; + const struct rtw89_pci_bd_ram (*bd_ram_table)[RTW89_TXCH_NUM];
int (*ltr_set)(struct rtw89_dev *rtwdev, bool en); u32 (*fill_txaddr_info)(struct rtw89_dev *rtwdev, @@ -798,12 +805,6 @@ struct rtw89_pci_info { struct rtw89_pci_isrs *isrs); };
-struct rtw89_pci_bd_ram { - u8 start_idx; - u8 max_num; - u8 min_num; -}; - struct rtw89_pci_tx_data { dma_addr_t dma; }; @@ -1057,6 +1058,8 @@ static inline bool rtw89_pci_ltr_is_err_reg_val(u32 val) extern const struct dev_pm_ops rtw89_pm_ops; extern const struct rtw89_pci_ch_dma_addr_set rtw89_pci_ch_dma_addr_set; extern const struct rtw89_pci_ch_dma_addr_set rtw89_pci_ch_dma_addr_set_v1; +extern const struct rtw89_pci_bd_ram rtw89_bd_ram_table_dual[RTW89_TXCH_NUM]; +extern const struct rtw89_pci_bd_ram rtw89_bd_ram_table_single[RTW89_TXCH_NUM];
struct pci_device_id;
diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c index 0cd8c0c44d19d..d835a44a1d0d0 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852ae.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852ae.c @@ -44,6 +44,7 @@ static const struct rtw89_pci_info rtw8852a_pci_info = { .tx_dma_ch_mask = 0, .bd_idx_addr_low_power = NULL, .dma_addr_set = &rtw89_pci_ch_dma_addr_set, + .bd_ram_table = &rtw89_bd_ram_table_dual,
.ltr_set = rtw89_pci_ltr_set, .fill_txaddr_info = rtw89_pci_fill_txaddr_info, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852be.c b/drivers/net/wireless/realtek/rtw89/rtw8852be.c index 0ef2ca8efeb0e..ecf39d2d9f81f 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852be.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852be.c @@ -46,6 +46,7 @@ static const struct rtw89_pci_info rtw8852b_pci_info = { BIT(RTW89_TXCH_CH10) | BIT(RTW89_TXCH_CH11), .bd_idx_addr_low_power = NULL, .dma_addr_set = &rtw89_pci_ch_dma_addr_set, + .bd_ram_table = &rtw89_bd_ram_table_single,
.ltr_set = rtw89_pci_ltr_set, .fill_txaddr_info = rtw89_pci_fill_txaddr_info, diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c index 35901f64d17de..80490a5437df6 100644 --- a/drivers/net/wireless/realtek/rtw89/rtw8852ce.c +++ b/drivers/net/wireless/realtek/rtw89/rtw8852ce.c @@ -53,6 +53,7 @@ static const struct rtw89_pci_info rtw8852c_pci_info = { .tx_dma_ch_mask = 0, .bd_idx_addr_low_power = &rtw8852c_bd_idx_addr_low_power, .dma_addr_set = &rtw89_pci_ch_dma_addr_set_v1, + .bd_ram_table = &rtw89_bd_ram_table_dual,
.ltr_set = rtw89_pci_ltr_set_v1, .fill_txaddr_info = rtw89_pci_fill_txaddr_info_v1,
From: Jisoo Jang jisoo.jang@yonsei.ac.kr
[ Upstream commit 803f3176c5df3b5582c27ea690f204abb60b19b9 ]
Fix an integer underflow that leads to a null pointer dereference in 'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet could be manipulated, which could trigger an integer underflow of 'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be bypassed, eventually leading to a dereference of the pointer 'p', which is a null pointer.
Ensure that 'dma_len' is greater than 'min_seg_len'.
Found by a modified version of syzkaller.
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+ #139 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 RIP: 0010:skb_add_rx_frag+0x143/0x370 Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: mt7601u_rx_tasklet+0xc73/0x1270 ? mt7601u_submit_rx_buf.isra.0+0x510/0x510 ? tasklet_action_common.isra.0+0x79/0x2f0 tasklet_action_common.isra.0+0x206/0x2f0 __do_softirq+0x1b5/0x880 ? tasklet_unlock+0x30/0x30 run_ksoftirqd+0x26/0x50 smpboot_thread_fn+0x34f/0x7d0 ? smpboot_register_percpu_thread+0x370/0x370 kthread+0x3a1/0x480 ? set_kthread_struct+0x120/0x120 ret_from_fork+0x1f/0x30 Modules linked in: 88XXau(O) 88x2bu(O) ---[ end trace 57f34f93b4da0f9b ]--- RIP: 0010:skb_add_rx_frag+0x143/0x370 Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 FS: 0000000000000000(0000) GS:ffff88811a800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554
Signed-off-by: Jisoo Jang jisoo.jang@yonsei.ac.kr Acked-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221229092906.2328282-1-jisoo.jang@yonsei.ac.kr Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt7601u/dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c index 457147394edc4..773a1cc2f8520 100644 --- a/drivers/net/wireless/mediatek/mt7601u/dma.c +++ b/drivers/net/wireless/mediatek/mt7601u/dma.c @@ -123,7 +123,8 @@ static u16 mt7601u_rx_next_seg_len(u8 *data, u32 data_len) if (data_len < min_seg_len || WARN_ON_ONCE(!dma_len) || WARN_ON_ONCE(dma_len + MT_DMA_HDRS > data_len) || - WARN_ON_ONCE(dma_len & 0x3)) + WARN_ON_ONCE(dma_len & 0x3) || + WARN_ON_ONCE(dma_len < min_seg_len)) return 0;
return MT_DMA_HDRS + dma_len;
From: Pietro Borrello borrello@diag.uniroma1.it
[ Upstream commit 21cbd90a6fab7123905386985e3e4a80236b8714 ]
__inet_hash_connect() has a fast path taken if sk_head(&tb->owners) is equal to the sk parameter. sk_head() returns the hlist_entry() with respect to the sk_node field. However entries in the tb->owners list are inserted with respect to the sk_bind_node field with sk_add_bind_node(). Thus the check would never pass and the fast path never execute.
This fast path has never been executed or tested as this bug seems to be present since commit 1da177e4c3f4 ("Linux-2.6.12-rc2"), thus remove it to reduce code complexity.
Signed-off-by: Pietro Borrello borrello@diag.uniroma1.it Reviewed-by: Kuniyuki Iwashima kuniyu@amazon.com Reviewed-by: Eric Dumazet edumazet@google.com Link: https://lore.kernel.org/r/20230112-inet_hash_connect_bind_head-v3-1-b591fd21... Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- net/ipv4/inet_hashtables.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-)
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index f58d73888638b..7a13dd7f546b6 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -1008,17 +1008,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, u32 index;
if (port) { - head = &hinfo->bhash[inet_bhashfn(net, port, - hinfo->bhash_size)]; - tb = inet_csk(sk)->icsk_bind_hash; - spin_lock_bh(&head->lock); - if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) { - inet_ehash_nolisten(sk, NULL, NULL); - spin_unlock_bh(&head->lock); - return 0; - } - spin_unlock(&head->lock); - /* No definite answer... Walk to established hash table */ + local_bh_disable(); ret = check_established(death_row, sk, port, NULL); local_bh_enable(); return ret;
From: Siddaraju DH siddaraju.dh@intel.com
[ Upstream commit 8aa4318c3a122b8670bc09af142de3872ca63b88 ]
The PHY provides only 39b timestamp. With current timing implementation, we discard lower 7b, leaving 32b timestamp. The driver reconstructs the full 64b timestamp by correlating the 32b timestamp with cached_time for performance. The reconstruction algorithm does both forward & backward interpolation.
The 32b timeval has overflow duration of 2^32 counts ~= 4.23 second. Due to interpolation in both direction, its now ~= 2.125 second IIRC, going with at least half a duration, the cached_time is updated with periodic thread of 1 second (worst-case) periodicity.
But the 1 second periodicity is based on System-timer. With PPB adjustments, if the 1588 timers increments at say double the rate, (2s in-place of 1s), the Nyquist rate/half duration sampling/update of cached_time with 1 second periodic thread will lead to incorrect interpolations.
Hence we should restrict the PPB adjustments to at least half duration of cached_time update which translates to 500,000,000 PPB.
Since the periodicity of the cached-time system thread can vary, it is good to have some buffer time and considering practicality of PPB adjustments, limiting the max_adj to 100,000,000.
Signed-off-by: Siddaraju DH siddaraju.dh@intel.com Tested-by: Gurucharan G gurucharanx.g@intel.com (A Contingent worker at Intel) Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c index d63161d73eb16..3abc8db1d0659 100644 --- a/drivers/net/ethernet/intel/ice/ice_ptp.c +++ b/drivers/net/ethernet/intel/ice/ice_ptp.c @@ -2269,7 +2269,7 @@ static void ice_ptp_set_caps(struct ice_pf *pf) snprintf(info->name, sizeof(info->name) - 1, "%s-%s-clk", dev_driver_string(dev), dev_name(dev)); info->owner = THIS_MODULE; - info->max_adj = 999999999; + info->max_adj = 100000000; info->adjtime = ice_ptp_adjtime; info->adjfine = ice_ptp_adjfine; info->gettimex64 = ice_ptp_gettimex64;
From: Jesse Brandeburg jesse.brandeburg@intel.com
[ Upstream commit 6a8d013e904ad9a66706fcc926ec9993bed7d190 ]
There were a few places we had missed checking the VSI type to make sure it was definitely a PF VSI, before calling setup functions intended only for the PF VSI.
This doesn't fix any explicit bugs but cleans up the code in a few places and removes one explicit != vsi->type check that can be superseded by this code (it's a super set)
Signed-off-by: Jesse Brandeburg jesse.brandeburg@intel.com Tested-by: Gurucharan G gurucharanx.g@intel.com (A Contingent worker at Intel) Signed-off-by: Tony Nguyen anthony.l.nguyen@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/intel/ice/ice_main.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c index 8ec24f6cf6beb..3811462824390 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -6182,15 +6182,12 @@ int ice_vsi_cfg(struct ice_vsi *vsi) { int err;
- if (vsi->netdev) { + if (vsi->netdev && vsi->type == ICE_VSI_PF) { ice_set_rx_mode(vsi->netdev);
- if (vsi->type != ICE_VSI_LB) { - err = ice_vsi_vlan_setup(vsi); - - if (err) - return err; - } + err = ice_vsi_vlan_setup(vsi); + if (err) + return err; } ice_vsi_cfg_dcb_rings(vsi);
@@ -6371,7 +6368,7 @@ static int ice_up_complete(struct ice_vsi *vsi)
if (vsi->port_info && (vsi->port_info->phy.link_info.link_info & ICE_AQ_LINK_UP) && - vsi->netdev) { + vsi->netdev && vsi->type == ICE_VSI_PF) { ice_print_link_msg(vsi, true); netif_tx_start_all_queues(vsi->netdev); netif_carrier_on(vsi->netdev); @@ -6382,7 +6379,9 @@ static int ice_up_complete(struct ice_vsi *vsi) * set the baseline so counters are ready when interface is up */ ice_update_eth_stats(vsi); - ice_service_task_schedule(pf); + + if (vsi->type == ICE_VSI_PF) + ice_service_task_schedule(pf);
return 0; }
From: Mark Rutland mark.rutland@arm.com
[ Upstream commit c27cd083cfb9d392f304657ed00fcde1136704e7 ]
Contemporary versions of GCC (e.g. GCC 12.2.0) drop the alignment specified by '-falign-functions=N' for functions marked with the __cold__ attribute, and potentially for callees of __cold__ functions as these may be implicitly marked as __cold__ by the compiler. LLVM appears to respect '-falign-functions=N' in such cases.
This has been reported to GCC in bug 88345:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345
... which also covers alignment being dropped when '-Os' is used, which will be addressed in a separate patch.
Currently, use of '-falign-functions=N' is limited to CONFIG_FUNCTION_ALIGNMENT, which is largely used for performance and/or analysis reasons (e.g. with CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B), but isn't necessary for correct functionality. However, this dropped alignment isn't great for the performance and/or analysis cases.
Subsequent patches will use CONFIG_FUNCTION_ALIGNMENT as part of arm64's ftrace implementation, which will require all instrumented functions to be aligned to at least 8-bytes.
This patch works around the dropped alignment by avoiding the use of the __cold__ attribute when CONFIG_FUNCTION_ALIGNMENT is non-zero, and by specifically aligning abort(), which GCC implicitly marks as __cold__. As the __cold macro is now dependent upon config options (which is against the policy described at the top of compiler_attributes.h), it is moved into compiler_types.h.
I've tested this by building and booting a kernel configured with defconfig + CONFIG_EXPERT=y + CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y, and looking for misaligned text symbols in /proc/kallsyms:
* arm64:
Before: # uname -rm 6.2.0-rc3 aarch64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 5009
After: # uname -rm 6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 919
* x86_64:
Before: # uname -rm 6.2.0-rc3 x86_64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 11537
After: # uname -rm 6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 2805
There's clearly a substantial reduction in the number of misaligned symbols. From manual inspection, the remaining unaligned text labels are a combination of ACPICA functions (due to the use of '-Os'), static call trampolines, and non-function labels in assembly, which will be dealt with in subsequent patches.
Signed-off-by: Mark Rutland mark.rutland@arm.com Cc: Florent Revest revest@chromium.org Cc: Masami Hiramatsu mhiramat@kernel.org Cc: Peter Zijlstra peterz@infradead.org Cc: Steven Rostedt rostedt@goodmis.org Cc: Will Deacon will@kernel.org Cc: Miguel Ojeda ojeda@kernel.org Cc: Nick Desaulniers ndesaulniers@google.com Link: https://lore.kernel.org/r/20230123134603.1064407-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/compiler_attributes.h | 6 ------ include/linux/compiler_types.h | 27 +++++++++++++++++++++++++++ kernel/exit.c | 9 ++++++++- 3 files changed, 35 insertions(+), 7 deletions(-)
diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h index 898b3458b24a0..b83126452c651 100644 --- a/include/linux/compiler_attributes.h +++ b/include/linux/compiler_attributes.h @@ -75,12 +75,6 @@ # define __assume_aligned(a, ...) #endif
-/* - * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-col... - * gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-cold-label-at... - */ -#define __cold __attribute__((__cold__)) - /* * Note the long name. * diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h index 7c1afe0f4129c..aab34e30128e9 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -79,6 +79,33 @@ static inline void __chk_io_ptr(const volatile void __iomem *ptr) { } /* Attributes */ #include <linux/compiler_attributes.h>
+#if CONFIG_FUNCTION_ALIGNMENT > 0 +#define __function_aligned __aligned(CONFIG_FUNCTION_ALIGNMENT) +#else +#define __function_aligned +#endif + +/* + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-col... + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Label-Attributes.html#index-cold-label-at... + * + * When -falign-functions=N is in use, we must avoid the cold attribute as + * contemporary versions of GCC drop the alignment for cold functions. Worse, + * GCC can implicitly mark callees of cold functions as cold themselves, so + * it's not sufficient to add __function_aligned here as that will not ensure + * that callees are correctly aligned. + * + * See: + * + * https://lore.kernel.org/lkml/Y77%2FqVgvaJidFpYt@FVFF77S0Q05N + * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c9 + */ +#if !defined(CONFIG_CC_IS_GCC) || (CONFIG_FUNCTION_ALIGNMENT == 0) +#define __cold __attribute__((__cold__)) +#else +#define __cold +#endif + /* Builtins */
/* diff --git a/kernel/exit.c b/kernel/exit.c index bccfa4218356e..f2afdb0add7c5 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -1905,7 +1905,14 @@ bool thread_group_exited(struct pid *pid) } EXPORT_SYMBOL(thread_group_exited);
-__weak void abort(void) +/* + * This needs to be __function_aligned as GCC implicitly makes any + * implementation of abort() cold and drops alignment specified by + * -falign-functions=N. + * + * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345#c11 + */ +__weak __function_aligned void abort(void) { BUG();
From: Mark Rutland mark.rutland@arm.com
[ Upstream commit 8f9e0a52810dd83406c768972d022c37e7a18f1f ]
The ACPICA code has been built with '-Os' since the beginning of git history, though there's no explanatory comment as to why.
This is unfortunate as GCC drops the alignment specificed by '-falign-functions=N' when '-Os' is used, as reported in GCC bug 88345:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345
This prevents CONFIG_FUNCTION_ALIGNMENT and CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B from having their expected effect on the ACPICA code. This is doubly unfortunate as in subsequent patches arm64 will depend upon CONFIG_FUNCTION_ALIGNMENT for its ftrace implementation.
Drop the '-Os' flag when building the ACPICA code. With this removed, the code builds cleanly and works correctly in testing so far.
I've tested this by selecting CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y, building and booting a kernel using ACPI, and looking for misaligned text symbols:
* arm64:
Before, v6.2-rc3: # uname -rm 6.2.0-rc3 aarch64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 5009
Before, v6.2-rc3 + fixed __cold: # uname -rm 6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 919
After: # uname -rm 6.2.0-rc3-00002-g267bddc38572 aarch64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 323 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l 0
* x86_64:
Before, v6.2-rc3: # uname -rm 6.2.0-rc3 x86_64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 11537
Before, v6.2-rc3 + fixed __cold: # uname -rm 6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 2805
After: # uname -rm 6.2.0-rc3-00002-g267bddc38572 x86_64 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l 1357 # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l 0
With the patch applied, the remaining unaligned text labels are a combination of static call trampolines and labels in assembly, which can be dealt with in subsequent patches.
Signed-off-by: Mark Rutland mark.rutland@arm.com Acked-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Cc: Florent Revest revest@chromium.org Cc: Len Brown lenb@kernel.org Cc: Masami Hiramatsu mhiramat@kernel.org Cc: Peter Zijlstra peterz@infradead.org Cc: Robert Moore robert.moore@intel.com Cc: Steven Rostedt rostedt@goodmis.org Cc: Will Deacon will@kernel.org Cc: linux-acpi@vger.kernel.org Link: https://lore.kernel.org/r/20230123134603.1064407-4-mark.rutland@arm.com Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/acpi/acpica/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile index 9e0d95d76fff7..30f3fc13c29d1 100644 --- a/drivers/acpi/acpica/Makefile +++ b/drivers/acpi/acpica/Makefile @@ -3,7 +3,7 @@ # Makefile for ACPICA Core interpreter #
-ccflags-y := -Os -D_LINUX -DBUILDING_ACPICA +ccflags-y := -D_LINUX -DBUILDING_ACPICA ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT
# use acpi.o to put all files here into acpi.o modparam namespace
From: Dave Thaler dthaler@microsoft.com
[ Upstream commit 0eb9d19e2201068260e439a5c96dc85f9f3722a2 ]
Fix modulo zero, division by zero, overflow, and underflow. Also clarify how a negative immediate value is used in unsigned division.
Signed-off-by: Dave Thaler dthaler@microsoft.com Signed-off-by: Daniel Borkmann daniel@iogearbox.net Link: https://lore.kernel.org/bpf/20230124001218.827-1-dthaler1968@googlemail.com Signed-off-by: Sasha Levin sashal@kernel.org --- Documentation/bpf/instruction-set.rst | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/Documentation/bpf/instruction-set.rst b/Documentation/bpf/instruction-set.rst index e672d5ec6cc7b..2d3fe59bd260f 100644 --- a/Documentation/bpf/instruction-set.rst +++ b/Documentation/bpf/instruction-set.rst @@ -99,19 +99,26 @@ code value description BPF_ADD 0x00 dst += src BPF_SUB 0x10 dst -= src BPF_MUL 0x20 dst *= src -BPF_DIV 0x30 dst /= src +BPF_DIV 0x30 dst = (src != 0) ? (dst / src) : 0 BPF_OR 0x40 dst |= src BPF_AND 0x50 dst &= src BPF_LSH 0x60 dst <<= src BPF_RSH 0x70 dst >>= src BPF_NEG 0x80 dst = ~src -BPF_MOD 0x90 dst %= src +BPF_MOD 0x90 dst = (src != 0) ? (dst % src) : dst BPF_XOR 0xa0 dst ^= src BPF_MOV 0xb0 dst = src BPF_ARSH 0xc0 sign extending shift right BPF_END 0xd0 byte swap operations (see `Byte swap instructions`_ below) ======== ===== ==========================================================
+Underflow and overflow are allowed during arithmetic operations, meaning +the 64-bit or 32-bit value will wrap. If eBPF program execution would +result in division by zero, the destination register is instead set to zero. +If execution would result in modulo by zero, for ``BPF_ALU64`` the value of +the destination register is unchanged whereas for ``BPF_ALU`` the upper +32 bits of the destination register are zeroed. + ``BPF_ADD | BPF_X | BPF_ALU`` means::
dst_reg = (u32) dst_reg + (u32) src_reg; @@ -128,6 +135,11 @@ BPF_END 0xd0 byte swap operations (see `Byte swap instructions`_ below)
dst_reg = dst_reg ^ imm32
+Also note that the division and modulo operations are unsigned. Thus, for +``BPF_ALU``, 'imm' is first interpreted as an unsigned 32-bit value, whereas +for ``BPF_ALU64``, 'imm' is first sign extended to 64 bits and the result +interpreted as an unsigned 64-bit value. There are no instructions for +signed division or modulo.
Byte swap instructions ~~~~~~~~~~~~~~~~~~~~~~
From: Tim Zimmermann tim@linux4.de
[ Upstream commit 40dc1929089fc844ea06d9f8bdb6211ed4517c2e ]
Add the PCI ID for the Wellsburg C610 series chipset PCH.
The driver can read the temperature from the Wellsburg PCH with only the PCI ID added and no other modifications.
Signed-off-by: Tim Zimmermann tim@linux4.de Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/thermal/intel/intel_pch_thermal.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/drivers/thermal/intel/intel_pch_thermal.c b/drivers/thermal/intel/intel_pch_thermal.c index dabf11a687a15..9e27f430e0345 100644 --- a/drivers/thermal/intel/intel_pch_thermal.c +++ b/drivers/thermal/intel/intel_pch_thermal.c @@ -29,6 +29,7 @@ #define PCH_THERMAL_DID_CNL_LP 0x02F9 /* CNL-LP PCH */ #define PCH_THERMAL_DID_CML_H 0X06F9 /* CML-H PCH */ #define PCH_THERMAL_DID_LWB 0xA1B1 /* Lewisburg PCH */ +#define PCH_THERMAL_DID_WBG 0x8D24 /* Wellsburg PCH */
/* Wildcat Point-LP PCH Thermal registers */ #define WPT_TEMP 0x0000 /* Temperature */ @@ -350,6 +351,7 @@ enum board_ids { board_cnl, board_cml, board_lwb, + board_wbg, };
static const struct board_info { @@ -380,6 +382,10 @@ static const struct board_info { .name = "pch_lewisburg", .ops = &pch_dev_ops_wpt, }, + [board_wbg] = { + .name = "pch_wellsburg", + .ops = &pch_dev_ops_wpt, + }, };
static int intel_pch_thermal_probe(struct pci_dev *pdev, @@ -495,6 +501,8 @@ static const struct pci_device_id intel_pch_thermal_id[] = { .driver_data = board_cml, }, { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_LWB), .driver_data = board_lwb, }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WBG), + .driver_data = board_wbg, }, { 0, }, }; MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id);
From: Feng Tang feng.tang@intel.com
[ Upstream commit b7082cdfc464bf9231300605d03eebf943dda307 ]
Bugs have been reported on 8 sockets x86 machines in which the TSC was wrongly disabled when the system is under heavy workload.
[ 818.380354] clocksource: timekeeping watchdog on CPU336: hpet wd-wd read-back delay of 1203520ns [ 818.436160] clocksource: wd-tsc-wd read-back delay of 181880ns, clock-skew test skipped! [ 819.402962] clocksource: timekeeping watchdog on CPU338: hpet wd-wd read-back delay of 324000ns [ 819.448036] clocksource: wd-tsc-wd read-back delay of 337240ns, clock-skew test skipped! [ 819.880863] clocksource: timekeeping watchdog on CPU339: hpet read-back delay of 150280ns, attempt 3, marking unstable [ 819.936243] tsc: Marking TSC unstable due to clocksource watchdog [ 820.068173] TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'. [ 820.092382] sched_clock: Marking unstable (818769414384, 1195404998) [ 820.643627] clocksource: Checking clocksource tsc synchronization from CPU 267 to CPUs 0,4,25,70,126,430,557,564. [ 821.067990] clocksource: Switched to clocksource hpet
This can be reproduced by running memory intensive 'stream' tests, or some of the stress-ng subcases such as 'ioport'.
The reason for these issues is the when system is under heavy load, the read latency of the clocksources can be very high. Even lightweight TSC reads can show high latencies, and latencies are much worse for external clocksources such as HPET or the APIC PM timer. These latencies can result in false-positive clocksource-unstable determinations.
These issues were initially reported by a customer running on a production system, and this problem was reproduced on several generations of Xeon servers, especially when running the stress-ng test. These Xeon servers were not production systems, but they did have the latest steppings and firmware.
Given that the clocksource watchdog is a continual diagnostic check with frequency of twice a second, there is no need to rush it when the system is under heavy load. Therefore, when high clocksource read latencies are detected, suspend the watchdog timer for 5 minutes.
Signed-off-by: Feng Tang feng.tang@intel.com Acked-by: Waiman Long longman@redhat.com Cc: John Stultz jstultz@google.com Cc: Thomas Gleixner tglx@linutronix.de Cc: Stephen Boyd sboyd@kernel.org Cc: Feng Tang feng.tang@intel.com Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/time/clocksource.c | 45 ++++++++++++++++++++++++++++----------- 1 file changed, 32 insertions(+), 13 deletions(-)
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c index 9cf32ccda715d..8cd74b89d5776 100644 --- a/kernel/time/clocksource.c +++ b/kernel/time/clocksource.c @@ -384,6 +384,15 @@ void clocksource_verify_percpu(struct clocksource *cs) } EXPORT_SYMBOL_GPL(clocksource_verify_percpu);
+static inline void clocksource_reset_watchdog(void) +{ + struct clocksource *cs; + + list_for_each_entry(cs, &watchdog_list, wd_list) + cs->flags &= ~CLOCK_SOURCE_WATCHDOG; +} + + static void clocksource_watchdog(struct timer_list *unused) { u64 csnow, wdnow, cslast, wdlast, delta; @@ -391,6 +400,7 @@ static void clocksource_watchdog(struct timer_list *unused) int64_t wd_nsec, cs_nsec; struct clocksource *cs; enum wd_read_status read_ret; + unsigned long extra_wait = 0; u32 md;
spin_lock(&watchdog_lock); @@ -410,13 +420,30 @@ static void clocksource_watchdog(struct timer_list *unused)
read_ret = cs_watchdog_read(cs, &csnow, &wdnow);
- if (read_ret != WD_READ_SUCCESS) { - if (read_ret == WD_READ_UNSTABLE) - /* Clock readout unreliable, so give it up. */ - __clocksource_unstable(cs); + if (read_ret == WD_READ_UNSTABLE) { + /* Clock readout unreliable, so give it up. */ + __clocksource_unstable(cs); continue; }
+ /* + * When WD_READ_SKIP is returned, it means the system is likely + * under very heavy load, where the latency of reading + * watchdog/clocksource is very big, and affect the accuracy of + * watchdog check. So give system some space and suspend the + * watchdog check for 5 minutes. + */ + if (read_ret == WD_READ_SKIP) { + /* + * As the watchdog timer will be suspended, and + * cs->last could keep unchanged for 5 minutes, reset + * the counters. + */ + clocksource_reset_watchdog(); + extra_wait = HZ * 300; + break; + } + /* Clocksource initialized ? */ if (!(cs->flags & CLOCK_SOURCE_WATCHDOG) || atomic_read(&watchdog_reset_pending)) { @@ -512,7 +539,7 @@ static void clocksource_watchdog(struct timer_list *unused) * pair clocksource_stop_watchdog() clocksource_start_watchdog(). */ if (!timer_pending(&watchdog_timer)) { - watchdog_timer.expires += WATCHDOG_INTERVAL; + watchdog_timer.expires += WATCHDOG_INTERVAL + extra_wait; add_timer_on(&watchdog_timer, next_cpu); } out: @@ -537,14 +564,6 @@ static inline void clocksource_stop_watchdog(void) watchdog_running = 0; }
-static inline void clocksource_reset_watchdog(void) -{ - struct clocksource *cs; - - list_for_each_entry(cs, &watchdog_list, wd_list) - cs->flags &= ~CLOCK_SOURCE_WATCHDOG; -} - static void clocksource_resume_watchdog(void) { atomic_inc(&watchdog_reset_pending);
From: Kees Cook keescook@chromium.org
[ Upstream commit aa85923a954e7704bc9d3847dabeb8540aa98d13 ]
To work around a Clang __builtin_object_size bug that shows up under CONFIG_FORTIFY_SOURCE and UBSAN_BOUNDS, move the per-loop-iteration mem_block wipe into a single wipe of the entire pool structure after the loop.
Reported-by: Nathan Chancellor nathan@kernel.org Link: https://github.com/ClangBuiltLinux/linux/issues/1780 Cc: Weili Qian qianweili@huawei.com Cc: Zhou Wang wangzhou1@hisilicon.com Cc: Herbert Xu herbert@gondor.apana.org.au Cc: "David S. Miller" davem@davemloft.net Cc: linux-crypto@vger.kernel.org Signed-off-by: Kees Cook keescook@chromium.org Tested-by: Nathan Chancellor nathan@kernel.org # build Link: https://lore.kernel.org/r/20230106041945.never.831-kees@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/crypto/hisilicon/sgl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/crypto/hisilicon/sgl.c b/drivers/crypto/hisilicon/sgl.c index 2b6f2281cfd6c..0974b00414050 100644 --- a/drivers/crypto/hisilicon/sgl.c +++ b/drivers/crypto/hisilicon/sgl.c @@ -124,9 +124,8 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev, for (j = 0; j < i; j++) { dma_free_coherent(dev, block_size, block[j].sgl, block[j].sgl_dma); - memset(block + j, 0, sizeof(*block)); } - kfree(pool); + kfree_sensitive(pool); return ERR_PTR(-ENOMEM); } EXPORT_SYMBOL_GPL(hisi_acc_create_sgl_pool);
From: Florian Fainelli f.fainelli@gmail.com
[ Upstream commit 5c0862c2c962052ed5055220a00ac1cefb92fbcd ]
Occasionnaly we may get oversized packets from the hardware which exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early check which drops the packet to avoid invoking skb_over_panic() and move on to processing the next packet.
Signed-off-by: Florian Fainelli f.fainelli@gmail.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 21973046b12b4..d937daa8ee883 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -2316,6 +2316,14 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring, __func__, p_index, ring->c_index, ring->read_ptr, dma_length_status);
+ if (unlikely(len > RX_BUF_LENGTH)) { + netif_err(priv, rx_status, dev, "oversized packet\n"); + dev->stats.rx_length_errors++; + dev->stats.rx_errors++; + dev_kfree_skb_any(skb); + goto next; + } + if (unlikely(!(dma_flag & DMA_EOP) || !(dma_flag & DMA_SOP))) { netif_err(priv, rx_status, dev, "dropping fragmented packet!\n");
From: Michael Schmitz schmitzmic@gmail.com
[ Upstream commit 2ca8a1de4437f21562e57f9ac123914747a8e7a1 ]
Check return code of syscall_trace_enter(), and skip syscall if -1. Return code will be left at what had been set by ptrace or seccomp (in regs->d0).
No regression seen in testing with strace on ARAnyM.
Signed-off-by: Michael Schmitz schmitzmic@gmail.com Reviewed-by: Geert Uytterhoeven geert@linux-m68k.org Link: https://lore.kernel.org/r/20230112035529.13521-2-schmitzmic@gmail.com Signed-off-by: Geert Uytterhoeven geert@linux-m68k.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/m68k/68000/entry.S | 2 ++ arch/m68k/coldfire/entry.S | 2 ++ arch/m68k/kernel/entry.S | 3 +++ 3 files changed, 7 insertions(+)
diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S index 997b549330156..7d63e2f1555a0 100644 --- a/arch/m68k/68000/entry.S +++ b/arch/m68k/68000/entry.S @@ -45,6 +45,8 @@ do_trace: jbsr syscall_trace_enter RESTORE_SWITCH_STACK addql #4,%sp + addql #1,%d0 + jeq ret_from_exception movel %sp@(PT_OFF_ORIG_D0),%d1 movel #-ENOSYS,%d0 cmpl #NR_syscalls,%d1 diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S index 9f337c70243a3..35104c5417ff4 100644 --- a/arch/m68k/coldfire/entry.S +++ b/arch/m68k/coldfire/entry.S @@ -90,6 +90,8 @@ ENTRY(system_call) jbsr syscall_trace_enter RESTORE_SWITCH_STACK addql #4,%sp + addql #1,%d0 + jeq ret_from_exception movel %d3,%a0 jbsr %a0@ movel %d0,%sp@(PT_OFF_D0) /* save the return value */ diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S index 18f278bdbd218..42879e6eb651d 100644 --- a/arch/m68k/kernel/entry.S +++ b/arch/m68k/kernel/entry.S @@ -184,9 +184,12 @@ do_trace_entry: jbsr syscall_trace_enter RESTORE_SWITCH_STACK addql #4,%sp + addql #1,%d0 | optimization for cmpil #-1,%d0 + jeq ret_from_syscall movel %sp@(PT_OFF_ORIG_D0),%d0 cmpl #NR_syscalls,%d0 jcs syscall + jra ret_from_syscall badsys: movel #-ENOSYS,%sp@(PT_OFF_D0) jra ret_from_syscall
From: Vasily Gorbik gor@linux.ibm.com
[ Upstream commit 05178996e1a77e2a4664536e6d101a086a905034 ]
---[ Real Memory Copy Area Start ]--- 0x001bfffffffff000-0x001c000000000000 4K PTE I ---[ Kasan Shadow Start ]--- ---[ Real Memory Copy Area End ]--- 0x001c000000000000-0x001c000200000000 8G PMD RW NX ... ---[ Kasan Shadow End ]---
ptdump does a stable sort of markers. Move kasan markers after memcpy real to avoid swapping.
Reviewed-by: Alexander Gordeev agordeev@linux.ibm.com Signed-off-by: Vasily Gorbik gor@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/mm/dump_pagetables.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c index 9953819d79596..ba5f802688781 100644 --- a/arch/s390/mm/dump_pagetables.c +++ b/arch/s390/mm/dump_pagetables.c @@ -33,10 +33,6 @@ enum address_markers_idx { #endif IDENTITY_AFTER_NR, IDENTITY_AFTER_END_NR, -#ifdef CONFIG_KASAN - KASAN_SHADOW_START_NR, - KASAN_SHADOW_END_NR, -#endif VMEMMAP_NR, VMEMMAP_END_NR, VMALLOC_NR, @@ -47,6 +43,10 @@ enum address_markers_idx { ABS_LOWCORE_END_NR, MEMCPY_REAL_NR, MEMCPY_REAL_END_NR, +#ifdef CONFIG_KASAN + KASAN_SHADOW_START_NR, + KASAN_SHADOW_END_NR, +#endif };
static struct addr_marker address_markers[] = { @@ -62,10 +62,6 @@ static struct addr_marker address_markers[] = { #endif [IDENTITY_AFTER_NR] = {(unsigned long)_end, "Identity Mapping Start"}, [IDENTITY_AFTER_END_NR] = {0, "Identity Mapping End"}, -#ifdef CONFIG_KASAN - [KASAN_SHADOW_START_NR] = {KASAN_SHADOW_START, "Kasan Shadow Start"}, - [KASAN_SHADOW_END_NR] = {KASAN_SHADOW_END, "Kasan Shadow End"}, -#endif [VMEMMAP_NR] = {0, "vmemmap Area Start"}, [VMEMMAP_END_NR] = {0, "vmemmap Area End"}, [VMALLOC_NR] = {0, "vmalloc Area Start"}, @@ -76,6 +72,10 @@ static struct addr_marker address_markers[] = { [ABS_LOWCORE_END_NR] = {0, "Lowcore Area End"}, [MEMCPY_REAL_NR] = {0, "Real Memory Copy Area Start"}, [MEMCPY_REAL_END_NR] = {0, "Real Memory Copy Area End"}, +#ifdef CONFIG_KASAN + [KASAN_SHADOW_START_NR] = {KASAN_SHADOW_START, "Kasan Shadow Start"}, + [KASAN_SHADOW_END_NR] = {KASAN_SHADOW_END, "Kasan Shadow End"}, +#endif { -1, NULL } };
From: Alok Tiwari alok.a.tiwari@oracle.com
[ Upstream commit dac7f50a45216d652887fb92d6cd3b7ca7f006ea ]
static analyzer detect null pointer dereference case for 'type' function __nft_obj_type_get() can return NULL value which require to handle if type is NULL pointer return -ENOENT.
This is a theoretical issue, since an existing object has a type, but better add this failsafe check.
Signed-off-by: Alok Tiwari alok.a.tiwari@oracle.com Signed-off-by: Pablo Neira Ayuso pablo@netfilter.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 8c09e4d12ac1e..fc8256b00b320 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6999,6 +6999,9 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, return -EOPNOTSUPP;
type = __nft_obj_type_get(objtype); + if (WARN_ON_ONCE(!type)) + return -ENOENT; + nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
From: Oliver Hartkopp socketcan@hartkopp.net
[ Upstream commit c6adf659a8ba85913e16a571d5a9bcd17d3d1234 ]
Add missing check to block non-AF_CAN binds.
Syzbot created some code which matched the right sockaddr struct size but used AF_XDP (0x2C) instead of AF_CAN (0x1D) in the address family field:
bind$xdp(r2, &(0x7f0000000540)={0x2c, 0x0, r4, 0x0, r2}, 0x10) ^^^^ This has no funtional impact but the userspace should be notified about the wrong address family field content.
Link: https://syzkaller.appspot.com/text?tag=CrashLog&x=11ff9d8c480000 Reported-by: syzbot+5aed6c3aaba661f5b917@syzkaller.appspotmail.com Signed-off-by: Oliver Hartkopp socketcan@hartkopp.net Link: https://lore.kernel.org/all/20230104201844.13168-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde mkl@pengutronix.de Signed-off-by: Sasha Levin sashal@kernel.org --- net/can/isotp.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/net/can/isotp.c b/net/can/isotp.c index fc81d77724a13..9bc344851704e 100644 --- a/net/can/isotp.c +++ b/net/can/isotp.c @@ -1220,6 +1220,9 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) if (len < ISOTP_MIN_NAMELEN) return -EINVAL;
+ if (addr->can_family != AF_CAN) + return -EINVAL; + /* sanitize tx CAN identifier */ if (tx_id & CAN_EFF_FLAG) tx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK);
From: Sam James sam@gentoo.org
[ Upstream commit 5a6b64adc18d9adfb497a529ff004d59b6df151f ]
The latest GCC 13 snapshot (13.0.1 20230129) gives the following: ``` cc1: error: cannot load plugin ./scripts/gcc-plugins/randomize_layout_plugin.so :./scripts/gcc-plugins/randomize_layout_plugin.so: undefined symbol: tree_code_type ```
This ends up being because of https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git%3Bh=b0241ce6e37031 upstream in GCC which changes the visibility of some types used by the kernel's plugin infrastructure like tree_code_type.
After discussion with the GCC folks, we found that the kernel needs to be building plugins with the same flags used to build GCC - and GCC defaults to gnu++17 right now. The minimum GCC version needed to build the kernel is GCC 5.1 and GCC 5.1 already defaults to gnu++14 anyway, so just drop the flag, as all GCCs that could be used to build GCC already default to an acceptable version which was >= the version we forced via flags until now.
Bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108634 Signed-off-by: Sam James sam@gentoo.org Signed-off-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/r/20230201230009.2252783-1-sam@gentoo.org Signed-off-by: Sasha Levin sashal@kernel.org --- scripts/gcc-plugins/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile index b34d11e226366..320afd3cf8e82 100644 --- a/scripts/gcc-plugins/Makefile +++ b/scripts/gcc-plugins/Makefile @@ -29,7 +29,7 @@ GCC_PLUGINS_DIR = $(shell $(CC) -print-file-name=plugin) plugin_cxxflags = -Wp,-MMD,$(depfile) $(KBUILD_HOSTCXXFLAGS) -fPIC \ -include $(srctree)/include/linux/compiler-version.h \ -DPLUGIN_VERSION=$(call stringify,$(KERNELVERSION)) \ - -I $(GCC_PLUGINS_DIR)/include -I $(obj) -std=gnu++11 \ + -I $(GCC_PLUGINS_DIR)/include -I $(obj) \ -fno-rtti -fno-exceptions -fasynchronous-unwind-tables \ -ggdb -Wno-narrowing -Wno-unused-variable \ -Wno-format-diag
From: Zhang Rui rui.zhang@intel.com
[ Upstream commit 61f9fdcdcd01f9a996b6db4e7092fcdfe8414ad5 ]
Need memory frequency quirk as Sapphire Rapids in Emerald Rapids. So add Emerald Rapids CPU model check in is_spr_platform().
Signed-off-by: Zhang Rui rui.zhang@intel.com [srinivas.pandruvada@linux.intel.com: Subject, changelog and code edits] Signed-off-by: Srinivas Pandruvada srinivas.pandruvada@linux.intel.com Signed-off-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/power/x86/intel-speed-select/isst-config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/power/x86/intel-speed-select/isst-config.c b/tools/power/x86/intel-speed-select/isst-config.c index a160bad291eb7..be3668d37d654 100644 --- a/tools/power/x86/intel-speed-select/isst-config.c +++ b/tools/power/x86/intel-speed-select/isst-config.c @@ -110,7 +110,7 @@ int is_skx_based_platform(void)
int is_spr_platform(void) { - if (cpu_model == 0x8F) + if (cpu_model == 0x8F || cpu_model == 0xCF) return 1;
return 0;
From: Armin Wolf W_Armin@gmx.de
[ Upstream commit 3e899fec5dfce37701d49d656954a825275bf867 ]
While trying to solve a bugreport on bugzilla, i learned that some devices (for example the Dell XPS 17 9710) provide a more recent DDV WMI interface (version 3). Since the new interface version just adds an additional method, no code changes are necessary apart from whitelisting the version.
Signed-off-by: Armin Wolf W_Armin@gmx.de Link: https://lore.kernel.org/r/20230126194021.381092-2-W_Armin@gmx.de Reviewed-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/platform/x86/dell/dell-wmi-ddv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/x86/dell/dell-wmi-ddv.c b/drivers/platform/x86/dell/dell-wmi-ddv.c index 2bb449845d143..9cb6ae42dbdc8 100644 --- a/drivers/platform/x86/dell/dell-wmi-ddv.c +++ b/drivers/platform/x86/dell/dell-wmi-ddv.c @@ -26,7 +26,8 @@
#define DRIVER_NAME "dell-wmi-ddv"
-#define DELL_DDV_SUPPORTED_INTERFACE 2 +#define DELL_DDV_SUPPORTED_VERSION_MIN 2 +#define DELL_DDV_SUPPORTED_VERSION_MAX 3 #define DELL_DDV_GUID "8A42EA14-4F2A-FD45-6422-0087F7A7E608"
#define DELL_EPPID_LENGTH 20 @@ -49,6 +50,7 @@ enum dell_ddv_method { DELL_DDV_BATTERY_RAW_ANALYTICS_START = 0x0E, DELL_DDV_BATTERY_RAW_ANALYTICS = 0x0F, DELL_DDV_BATTERY_DESIGN_VOLTAGE = 0x10, + DELL_DDV_BATTERY_RAW_ANALYTICS_A_BLOCK = 0x11, /* version 3 */
DELL_DDV_INTERFACE_VERSION = 0x12,
@@ -340,7 +342,7 @@ static int dell_wmi_ddv_probe(struct wmi_device *wdev, const void *context) return ret;
dev_dbg(&wdev->dev, "WMI interface version: %d\n", version); - if (version != DELL_DDV_SUPPORTED_INTERFACE) + if (version < DELL_DDV_SUPPORTED_VERSION_MIN || version > DELL_DDV_SUPPORTED_VERSION_MAX) return -ENODEV;
data = devm_kzalloc(&wdev->dev, sizeof(*data), GFP_KERNEL);
From: Lorenzo Bianconi lorenzo@kernel.org
[ Upstream commit 1b88b47e898edef0e56e3a2f4e49f052a136153d ]
Free rx_head skb in mt76_dma_rx_cleanup routine in order to avoid possible memory leak at module unload.
Signed-off-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/mediatek/mt76/dma.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c index dee4449de9082..d147dc698c9db 100644 --- a/drivers/net/wireless/mediatek/mt76/dma.c +++ b/drivers/net/wireless/mediatek/mt76/dma.c @@ -737,6 +737,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q) return;
spin_lock_bh(&q->lock); + do { buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL); if (!buf) @@ -744,6 +745,12 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
skb_free_frag(buf); } while (1); + + if (q->rx_head) { + dev_kfree_skb(q->rx_head); + q->rx_head = NULL; + } + spin_unlock_bh(&q->lock);
if (!q->rx_page.va) @@ -769,12 +776,6 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid) mt76_dma_rx_cleanup(dev, q); mt76_dma_sync_idx(dev, q); mt76_dma_rx_fill(dev, q); - - if (!q->rx_head) - return; - - dev_kfree_skb(q->rx_head); - q->rx_head = NULL; }
static void
From: Hans de Goede hdegoede@redhat.com
[ Upstream commit 2d11eae42d52a131f06061015e49dc0f085c5bfc ]
Multiple Ideapad Z570 variants need acpi_backlight=native to force native use on these pre Windows 8 machines since acpi_video backlight control does not work here.
The original DMI quirk matches on a product_name of "102434U" but other variants may have different product_name-s such as e.g. "1024D9U".
Move to checking product_version instead as is more or less standard for Lenovo DMI quirks for similar reasons.
Signed-off-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/acpi/video_detect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c index a8c02608dde45..710ac640267dd 100644 --- a/drivers/acpi/video_detect.c +++ b/drivers/acpi/video_detect.c @@ -434,7 +434,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = { /* Lenovo Ideapad Z570 */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), - DMI_MATCH(DMI_PRODUCT_NAME, "102434U"), + DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"), }, }, {
From: Shay Drory shayd@nvidia.com
[ Upstream commit 988c2352273997a242f15c4fc3711773515006a2 ]
The debug message specify tdsn, but takes as an argument the tmsn. The correct argument is tmsn, hence, fix the print.
Signed-off-by: Shay Drory shayd@nvidia.com Reviewed-by: Moshe Shemesh moshe@nvidia.com Signed-off-by: Saeed Mahameed saeedm@nvidia.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c index 5b05b884b5fb3..d7b2ee5de1158 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c @@ -603,7 +603,7 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, } else { cur_string = mlx5_tracer_message_get(tracer, tracer_event); if (!cur_string) { - pr_debug("%s Got string event for unknown string tdsm: %d\n", + pr_debug("%s Got string event for unknown string tmsn: %d\n", __func__, tracer_event->string_event.tmsn); return -1; }
From: Kees Cook keescook@chromium.org
[ Upstream commit 48df133578c70185a95a49390d42df1996ddba2a ]
GCC does not like having a partially allocated object, since it cannot reason about it for bounds checking when it is passed to other code. Instead, fully allocate sig_inputArgs. (Alternatively, sig_inputArgs should be defined as a struct coda_in_hdr, if it is actually not using any other part of the union.) Seen under GCC 13:
../fs/coda/upcall.c: In function 'coda_upcall': ../fs/coda/upcall.c:801:22: warning: array subscript 'union inputArgs[0]' is partly outside array bounds of 'unsigned char[20]' [-Warray-bounds=] 801 | sig_inputArgs->ih.opcode = CODA_SIGNAL; | ^~
Cc: Jan Harkes jaharkes@cs.cmu.edu Cc: coda@cs.cmu.edu Cc: codalist@coda.cs.cmu.edu Signed-off-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/r/20230127223921.never.882-kees@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- fs/coda/upcall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c index 59f6cfd06f96a..cd6a3721f6f69 100644 --- a/fs/coda/upcall.c +++ b/fs/coda/upcall.c @@ -791,7 +791,7 @@ static int coda_upcall(struct venus_comm *vcp, sig_req = kmalloc(sizeof(struct upc_req), GFP_KERNEL); if (!sig_req) goto exit;
- sig_inputArgs = kvzalloc(sizeof(struct coda_in_hdr), GFP_KERNEL); + sig_inputArgs = kvzalloc(sizeof(*sig_inputArgs), GFP_KERNEL); if (!sig_inputArgs) { kfree(sig_req); goto exit;
From: Kees Cook keescook@chromium.org
[ Upstream commit 04ffde1319a715bd0550ded3580d4ea3bc003776 ]
While there is logic about the difference between ksize and usize, copy_struct_from_user() didn't check the size of the destination buffer (when it was known) against ksize. Add this check so there is an upper bounds check on the possible memset() call, otherwise lower bounds checks made by callers will trigger bounds warnings under -Warray-bounds. Seen under GCC 13:
In function 'copy_struct_from_user', inlined from 'iommufd_fops_ioctl' at ../drivers/iommu/iommufd/main.c:333:8: ../include/linux/fortify-string.h:59:33: warning: '__builtin_memset' offset [57, 4294967294] is out of the bounds [0, 56] of object 'buf' with type 'union ucmd_buffer' [-Warray-bounds=] 59 | #define __underlying_memset __builtin_memset | ^ ../include/linux/fortify-string.h:453:9: note: in expansion of macro '__underlying_memset' 453 | __underlying_memset(p, c, __fortify_size); \ | ^~~~~~~~~~~~~~~~~~~ ../include/linux/fortify-string.h:461:25: note: in expansion of macro '__fortify_memset_chk' 461 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \ | ^~~~~~~~~~~~~~~~~~~~ ../include/linux/uaccess.h:334:17: note: in expansion of macro 'memset' 334 | memset(dst + size, 0, rest); | ^~~~~~ ../drivers/iommu/iommufd/main.c: In function 'iommufd_fops_ioctl': ../drivers/iommu/iommufd/main.c:311:27: note: 'buf' declared here 311 | union ucmd_buffer buf; | ^~~
Cc: Christian Brauner brauner@kernel.org Cc: Rasmus Villemoes linux@rasmusvillemoes.dk Cc: Arnd Bergmann arnd@arndb.de Cc: Dinh Nguyen dinguyen@kernel.org Cc: Catalin Marinas catalin.marinas@arm.com Cc: Andrew Morton akpm@linux-foundation.org Cc: Geert Uytterhoeven geert@linux-m68k.org Cc: Alexander Potapenko glider@google.com Acked-by: Aleksa Sarai cyphar@cyphar.com Signed-off-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/lkml/20230203193523.never.667-kees@kernel.org/ Signed-off-by: Sasha Levin sashal@kernel.org --- include/linux/uaccess.h | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index afb18f198843b..ab9728138ad67 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -329,6 +329,10 @@ copy_struct_from_user(void *dst, size_t ksize, const void __user *src, size_t size = min(ksize, usize); size_t rest = max(ksize, usize) - size;
+ /* Double check if ksize is larger than a known object size. */ + if (WARN_ON_ONCE(ksize > __builtin_object_size(dst, 1))) + return -E2BIG; + /* Deal with trailing bytes. */ if (usize < ksize) { memset(dst + size, 0, rest);
From: Heiko Carstens hca@linux.ibm.com
[ Upstream commit a9cbc1b471d291c865907542394f1c483b93a811 ]
linux-next commit ("cpuidle: tracing: Warn about !rcu_is_watching()") adds a new warning which hits on s390's arch_cpu_idle() function:
RCU not on for: arch_cpu_idle+0x0/0x28 WARNING: CPU: 2 PID: 0 at include/linux/trace_recursion.h:162 arch_ftrace_ops_list_func+0x24c/0x258 Modules linked in: CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.2.0-rc6-next-20230202 #4 Hardware name: IBM 8561 T01 703 (z/VM 7.3.0) Krnl PSW : 0404d00180000000 00000000002b55c0 (arch_ftrace_ops_list_func+0x250/0x258) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3 Krnl GPRS: c0000000ffffbfff 0000000080000002 0000000000000026 0000000000000000 0000037ffffe3a28 0000037ffffe3a20 0000000000000000 0000000000000000 0000000000000000 0000000000f4acf6 00000000001044f0 0000037ffffe3cb0 0000000000000000 0000000000000000 00000000002b55bc 0000037ffffe3bb8 Krnl Code: 00000000002b55b0: c02000840051 larl %r2,0000000001335652 00000000002b55b6: c0e5fff512d1 brasl %r14,0000000000157b58 #00000000002b55bc: af000000 mc 0,0 >00000000002b55c0: a7f4ffe7 brc 15,00000000002b558e 00000000002b55c4: 0707 bcr 0,%r7 00000000002b55c6: 0707 bcr 0,%r7 00000000002b55c8: eb6ff0480024 stmg %r6,%r15,72(%r15) 00000000002b55ce: b90400ef lgr %r14,%r15 Call Trace: [<00000000002b55c0>] arch_ftrace_ops_list_func+0x250/0x258 ([<00000000002b55bc>] arch_ftrace_ops_list_func+0x24c/0x258) [<0000000000f5f0fc>] ftrace_common+0x1c/0x20 [<00000000001044f6>] arch_cpu_idle+0x6/0x28 [<0000000000f4acf6>] default_idle_call+0x76/0x128 [<00000000001cc374>] do_idle+0xf4/0x1b0 [<00000000001cc6ce>] cpu_startup_entry+0x36/0x40 [<0000000000119d00>] smp_start_secondary+0x140/0x150 [<0000000000f5d2ae>] restart_int_handler+0x6e/0x90
Mark arch_cpu_idle() noinstr like all other architectures with CONFIG_ARCH_WANTS_NO_INSTR (should) have it to fix this.
Reviewed-by: Sven Schnelle svens@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/kernel/idle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c index 4bf1ee293f2b3..a0da049e73609 100644 --- a/arch/s390/kernel/idle.c +++ b/arch/s390/kernel/idle.c @@ -44,7 +44,7 @@ void account_idle_time_irq(void) S390_lowcore.last_update_timer = idle->timer_idle_exit; }
-void arch_cpu_idle(void) +void noinstr arch_cpu_idle(void) { struct s390_idle_data *idle = this_cpu_ptr(&s390_idle); unsigned long idle_time;
From: Greg Kroah-Hartman gregkh@linuxfoundation.org
[ Upstream commit 5b268d8abaec6cbd4bd70d062e769098d96670aa ]
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once.
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Thomas Gleixner tglx@linutronix.de Link: https://lore.kernel.org/r/20230202151214.2306822-1-gregkh@linuxfoundation.or... Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/time/test_udelay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/test_udelay.c b/kernel/time/test_udelay.c index 13b11eb62685e..20d5df631570e 100644 --- a/kernel/time/test_udelay.c +++ b/kernel/time/test_udelay.c @@ -149,7 +149,7 @@ module_init(udelay_test_init); static void __exit udelay_test_exit(void) { mutex_lock(&udelay_test_lock); - debugfs_remove(debugfs_lookup(DEBUGFS_FILENAME, NULL)); + debugfs_lookup_and_remove(DEBUGFS_FILENAME, NULL); mutex_unlock(&udelay_test_lock); }
From: Greg Kroah-Hartman gregkh@linuxfoundation.org
[ Upstream commit 0b6200e1e9f53dabdc30d0f6c51af9a5f664d32b ]
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once.
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Reviewed-by: Ulf Hansson ulf.hansson@linaro.org Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/power/domain.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c index 967bcf9d415ea..6097644ebdc51 100644 --- a/drivers/base/power/domain.c +++ b/drivers/base/power/domain.c @@ -220,13 +220,10 @@ static void genpd_debug_add(struct generic_pm_domain *genpd);
static void genpd_debug_remove(struct generic_pm_domain *genpd) { - struct dentry *d; - if (!genpd_debugfs_dir) return;
- d = debugfs_lookup(genpd->name, genpd_debugfs_dir); - debugfs_remove(d); + debugfs_lookup_and_remove(genpd->name, genpd_debugfs_dir); }
static void genpd_update_accounting(struct generic_pm_domain *genpd)
From: Greg Kroah-Hartman gregkh@linuxfoundation.org
[ Upstream commit a0e8c13ccd6a9a636d27353da62c2410c4eca337 ]
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once.
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/power/energy_model.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c index f82111837b8d1..7b44f5b89fa15 100644 --- a/kernel/power/energy_model.c +++ b/kernel/power/energy_model.c @@ -87,10 +87,7 @@ static void em_debug_create_pd(struct device *dev)
static void em_debug_remove_pd(struct device *dev) { - struct dentry *debug_dir; - - debug_dir = debugfs_lookup(dev_name(dev), rootdir); - debugfs_remove_recursive(debug_dir); + debugfs_lookup_and_remove(dev_name(dev), rootdir); }
static int __init em_debug_init(void)
From: Marcel Holtmann marcel@holtmann.org
[ Upstream commit 5d44f76fab0839799b19cbc88d13575da968dc08 ]
Their devices claim to support the erroneous data reporting, but don't actually support the required commands. So blacklist them and add a quirk.
< HCI Command: Read Default Erroneous Data Reporting (0x03|0x005a) plen 0
HCI Event: Command Status (0x0f) plen 4
Read Default Erroneous Data Reporting (0x03|0x005a) ncmd 1 Status: Unknown HCI Command (0x01)
T: Bus=02 Lev=02 Prnt=08 Port=02 Cnt=01 Dev#= 10 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=10d7 ProdID=b012 Rev=88.91 S: Manufacturer=Actions S: Product=general adapter S: SerialNumber=ACTIONS1234 C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=01(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=01(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=01(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=01(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=01(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=01(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Marcel Holtmann marcel@holtmann.org Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/bluetooth/btusb.c | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 2ad4efdd9e40b..afd2f08ffe30f 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -64,6 +64,7 @@ static struct usb_driver btusb_driver; #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED BIT(24) #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25) #define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26) +#define BTUSB_ACTIONS_SEMI BIT(27)
static const struct usb_device_id btusb_table[] = { /* Generic Bluetooth USB device */ @@ -677,6 +678,9 @@ static const struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH },
+ /* Actions Semiconductor ATS2851 based devices */ + { USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI }, + /* Silicon Wave based devices */ { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
@@ -4098,6 +4102,11 @@ static int btusb_probe(struct usb_interface *intf, set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags); }
+ if (id->driver_info & BTUSB_ACTIONS_SEMI) { + /* Support is advertised, but not implemented */ + set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks); + } + if (!reset) set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
From: Mario Limonciello mario.limonciello@amd.com
[ Upstream commit 83458a5f272b303479e7d2f451600817a7350b6b ]
This bluetooth device is found in a combo WLAN/BT card for a MediaTek 7921e.
The device information:
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0f2 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
Cc: Sean Wang sean.wang@mediatek.com Cc: Anson Tsao anson.tsao@amd.com Signed-off-by: Mario Limonciello mario.limonciello@amd.com Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index afd2f08ffe30f..acfd40f1cc75c 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -567,6 +567,9 @@ static const struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0489, 0xe0e0), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES },
From: Moises Cardona moisesmcardona@gmail.com
[ Upstream commit 1eec3b95b5ce7fb2cdd273ac4f8b24b1ed6776a1 ]
This patch adds VID:PID 13d3:3529 to the btusb.c file.
This VID:PID is found in the Realtek RTL8821CE module (M.2 module AW-CB304NF on an ASUS E210MA laptop)
Output of /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3529 Rev= 1.10 S: Manufacturer=Realtek S: Product=Bluetooth Radio C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Moises Cardona moisesmcardona@gmail.com Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/bluetooth/btusb.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index acfd40f1cc75c..18bc947187115 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -493,6 +493,10 @@ static const struct usb_device_id blacklist_table[] = { { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01), .driver_info = BTUSB_IGNORE },
+ /* Realtek 8821CE Bluetooth devices */ + { USB_DEVICE(0x13d3, 0x3529), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + /* Realtek 8822CE Bluetooth devices */ { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH },
From: Zong-Zhe Yang kevin_yang@realtek.com
[ Upstream commit c074da21dd346e0cfef5d08b0715078d7aea7f8d ]
Only 8852C chip has valid pages on RTW89_DBG_SEL_MAC_30. To other chips, this section is an address hole. It will lead to crash if trying to access this section on chips except for 8852C. So, we avoid that.
Signed-off-by: Zong-Zhe Yang kevin_yang@realtek.com Signed-off-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230119063529.61563-2-pkshih@realtek.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/realtek/rtw89/debug.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/debug.c b/drivers/net/wireless/realtek/rtw89/debug.c index 8297e35bfa52b..6730eea930ece 100644 --- a/drivers/net/wireless/realtek/rtw89/debug.c +++ b/drivers/net/wireless/realtek/rtw89/debug.c @@ -615,6 +615,7 @@ rtw89_debug_priv_mac_reg_dump_select(struct file *filp, struct seq_file *m = (struct seq_file *)filp->private_data; struct rtw89_debugfs_priv *debugfs_priv = m->private; struct rtw89_dev *rtwdev = debugfs_priv->rtwdev; + const struct rtw89_chip_info *chip = rtwdev->chip; char buf[32]; size_t buf_size; int sel; @@ -634,6 +635,12 @@ rtw89_debug_priv_mac_reg_dump_select(struct file *filp, return -EINVAL; }
+ if (sel == RTW89_DBG_SEL_MAC_30 && chip->chip_id != RTL8852C) { + rtw89_info(rtwdev, "sel %d is address hole on chip %d\n", sel, + chip->chip_id); + return -EINVAL; + } + debugfs_priv->cb_data = sel; rtw89_info(rtwdev, "select mac page dump %d\n", debugfs_priv->cb_data);
From: Michael Kelley mikelley@microsoft.com
[ Upstream commit dca5161f9bd052e9e73be90716ffd57e8762c697 ]
Completion responses to SEND_RNDIS_PKT messages are currently processed regardless of the status in the response, so that resources associated with the request are freed. While this is appropriate, code bugs that cause sending a malformed message, or errors on the Hyper-V host, go undetected. Fix this by checking the status and outputting a rate-limited message if there is an error.
Signed-off-by: Michael Kelley mikelley@microsoft.com Reviewed-by: Haiyang Zhang haiyangz@microsoft.com Link: https://lore.kernel.org/r/1676264881-48928-1-git-send-email-mikelley@microso... Signed-off-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/hyperv/netvsc.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c index 79f4e13620a46..da737d959e81c 100644 --- a/drivers/net/hyperv/netvsc.c +++ b/drivers/net/hyperv/netvsc.c @@ -851,6 +851,7 @@ static void netvsc_send_completion(struct net_device *ndev, u32 msglen = hv_pkt_datalen(desc); struct nvsp_message *pkt_rqst; u64 cmd_rqst; + u32 status;
/* First check if this is a VMBUS completion without data payload */ if (!msglen) { @@ -922,6 +923,23 @@ static void netvsc_send_completion(struct net_device *ndev, break;
case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE: + if (msglen < sizeof(struct nvsp_message_header) + + sizeof(struct nvsp_1_message_send_rndis_packet_complete)) { + if (net_ratelimit()) + netdev_err(ndev, "nvsp_rndis_pkt_complete length too small: %u\n", + msglen); + return; + } + + /* If status indicates an error, output a message so we know + * there's a problem. But process the completion anyway so the + * resources are released. + */ + status = nvsp_packet->msg.v1_msg.send_rndis_pkt_complete.status; + if (status != NVSP_STAT_SUCCESS && net_ratelimit()) + netdev_err(ndev, "nvsp_rndis_pkt_complete error status: %x\n", + status); + netvsc_send_tx_complete(ndev, net_device, incoming_channel, desc, budget); break;
From: Heiko Carstens hca@linux.ibm.com
[ Upstream commit d9c2cf67b9cfd643ba85d51bc865a89a92e4f979 ]
Baoquan He reported lots of KFENCE reports when /proc/kcore is read, e.g. with crash or even simpler with dd:
BUG: KFENCE: invalid read in copy_from_kernel_nofault+0x5e/0x120 Invalid read at 0x00000000f4f5149f: copy_from_kernel_nofault+0x5e/0x120 read_kcore+0x6b2/0x870 proc_reg_read+0x9a/0xf0 vfs_read+0x94/0x270 ksys_read+0x70/0x100 __do_syscall+0x1d0/0x200 system_call+0x82/0xb0
The reason for this is that read_kcore() simply reads memory that might have been unmapped by KFENCE with copy_from_kernel_nofault(). Any fault due to pages being unmapped by KFENCE would be handled gracefully by the fault handler (exception table fixup).
However the s390 fault handler first reports the fault, and only afterwards would perform the exception table fixup. Most architectures have this in reversed order, which also avoids the false positive KFENCE reports when an unmapped page is accessed.
Therefore change the s390 fault handler so it handles exception table fixups before KFENCE page faults are reported.
Reported-by: Baoquan He bhe@redhat.com Tested-by: Baoquan He bhe@redhat.com Acked-by: Alexander Potapenko glider@google.com Link: https://lore.kernel.org/r/20230213183858.1473681-1-hca@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sasha Levin sashal@kernel.org --- arch/s390/mm/fault.c | 49 +++++++++++++++++++++++++++++++------------- 1 file changed, 35 insertions(+), 14 deletions(-)
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c index 9649d9382e0ae..8e84ed2bb944e 100644 --- a/arch/s390/mm/fault.c +++ b/arch/s390/mm/fault.c @@ -96,6 +96,20 @@ static enum fault_type get_fault_type(struct pt_regs *regs) return KERNEL_FAULT; }
+static unsigned long get_fault_address(struct pt_regs *regs) +{ + unsigned long trans_exc_code = regs->int_parm_long; + + return trans_exc_code & __FAIL_ADDR_MASK; +} + +static bool fault_is_write(struct pt_regs *regs) +{ + unsigned long trans_exc_code = regs->int_parm_long; + + return (trans_exc_code & store_indication) == 0x400; +} + static int bad_address(void *p) { unsigned long dummy; @@ -228,15 +242,26 @@ static noinline void do_sigsegv(struct pt_regs *regs, int si_code) (void __user *)(regs->int_parm_long & __FAIL_ADDR_MASK)); }
-static noinline void do_no_context(struct pt_regs *regs) +static noinline void do_no_context(struct pt_regs *regs, vm_fault_t fault) { + enum fault_type fault_type; + unsigned long address; + bool is_write; + if (fixup_exception(regs)) return; + fault_type = get_fault_type(regs); + if ((fault_type == KERNEL_FAULT) && (fault == VM_FAULT_BADCONTEXT)) { + address = get_fault_address(regs); + is_write = fault_is_write(regs); + if (kfence_handle_page_fault(address, is_write, regs)) + return; + } /* * Oops. The kernel tried to access some bad page. We'll have to * terminate things with extreme prejudice. */ - if (get_fault_type(regs) == KERNEL_FAULT) + if (fault_type == KERNEL_FAULT) printk(KERN_ALERT "Unable to handle kernel pointer dereference" " in virtual kernel address space\n"); else @@ -255,7 +280,7 @@ static noinline void do_low_address(struct pt_regs *regs) die (regs, "Low-address protection"); }
- do_no_context(regs); + do_no_context(regs, VM_FAULT_BADACCESS); }
static noinline void do_sigbus(struct pt_regs *regs) @@ -286,28 +311,28 @@ static noinline void do_fault_error(struct pt_regs *regs, vm_fault_t fault) fallthrough; case VM_FAULT_BADCONTEXT: case VM_FAULT_PFAULT: - do_no_context(regs); + do_no_context(regs, fault); break; case VM_FAULT_SIGNAL: if (!user_mode(regs)) - do_no_context(regs); + do_no_context(regs, fault); break; default: /* fault & VM_FAULT_ERROR */ if (fault & VM_FAULT_OOM) { if (!user_mode(regs)) - do_no_context(regs); + do_no_context(regs, fault); else pagefault_out_of_memory(); } else if (fault & VM_FAULT_SIGSEGV) { /* Kernel mode? Handle exceptions or die */ if (!user_mode(regs)) - do_no_context(regs); + do_no_context(regs, fault); else do_sigsegv(regs, SEGV_MAPERR); } else if (fault & VM_FAULT_SIGBUS) { /* Kernel mode? Handle exceptions or die */ if (!user_mode(regs)) - do_no_context(regs); + do_no_context(regs, fault); else do_sigbus(regs); } else @@ -334,7 +359,6 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) struct mm_struct *mm; struct vm_area_struct *vma; enum fault_type type; - unsigned long trans_exc_code; unsigned long address; unsigned int flags; vm_fault_t fault; @@ -351,9 +375,8 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) return 0;
mm = tsk->mm; - trans_exc_code = regs->int_parm_long; - address = trans_exc_code & __FAIL_ADDR_MASK; - is_write = (trans_exc_code & store_indication) == 0x400; + address = get_fault_address(regs); + is_write = fault_is_write(regs);
/* * Verify that the fault happened in user space, that @@ -364,8 +387,6 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) type = get_fault_type(regs); switch (type) { case KERNEL_FAULT: - if (kfence_handle_page_fault(address, is_write, regs)) - return 0; goto out; case USER_FAULT: case GMAP_FAULT:
From: Moshe Shemesh moshe@nvidia.com
[ Upstream commit d0ab772c1f1558af84f3293a52e9e886e08e0754 ]
Fix a bug in trace point definition for devlink health report, as TP_STRUCT_entry of reporter_name should get reporter_name and not msg.
Note no fixes tag as this is a harmless bug as both reporter_name and msg are strings and TP_fast_assign for this entry is correct.
Signed-off-by: Moshe Shemesh moshe@nvidia.com Reviewed-by: Jiri Pirko jiri@nvidia.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- include/trace/events/devlink.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/trace/events/devlink.h b/include/trace/events/devlink.h index 24969184c5348..77ff7cfc6049a 100644 --- a/include/trace/events/devlink.h +++ b/include/trace/events/devlink.h @@ -88,7 +88,7 @@ TRACE_EVENT(devlink_health_report, __string(bus_name, devlink_to_dev(devlink)->bus->name) __string(dev_name, dev_name(devlink_to_dev(devlink))) __string(driver_name, devlink_to_dev(devlink)->driver->name) - __string(reporter_name, msg) + __string(reporter_name, reporter_name) __string(msg, msg) ),
From: Eric Dumazet edumazet@google.com
[ Upstream commit 5f1eb1ff58ea122e24adf0bc940f268ed2227462 ]
This is a followup of commit 2558b8039d05 ("net: use a bounce buffer for copying skb->mark")
x86 and powerpc define user_access_begin, meaning that they are not able to perform user copy checks when using user_write_access_begin() / unsafe_copy_to_user() and friends [1]
Instead of waiting bugs to trigger on other arches, add a check_object_size() in put_cmsg() to make sure that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y will perform more security checks.
[1] We can not generically call check_object_size() from unsafe_copy_to_user() because UACCESS is enabled at this point.
Signed-off-by: Eric Dumazet edumazet@google.com Cc: Kees Cook keescook@chromium.org Acked-by: Kees Cook keescook@chromium.org Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- net/core/scm.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/net/core/scm.c b/net/core/scm.c index 5c356f0dee30c..acb7d776fa6ec 100644 --- a/net/core/scm.c +++ b/net/core/scm.c @@ -229,6 +229,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) if (msg->msg_control_is_user) { struct cmsghdr __user *cm = msg->msg_control_user;
+ check_object_size(data, cmlen - sizeof(*cm), true); + if (!user_write_access_begin(cm, cmlen)) goto efault;
From: Hans de Goede hdegoede@redhat.com
[ Upstream commit 8a238d7f7eea7592e0764bc3b9e79e7c6354b04c ]
The Lenovo Yoga Tab 3 X90F has a portrait 1600x2560 LCD used in landscape mode, add a quirk for this.
Signed-off-by: Hans de Goede hdegoede@redhat.com Reviewed-by: Javier Martinez Canillas javierm@redhat.com Link: https://patchwork.freedesktop.org/patch/msgid/20221127181539.104223-1-hdegoe... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_panel_orientation_quirks.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c index 3659f0465a724..23d63a4d42d9c 100644 --- a/drivers/gpu/drm/drm_panel_orientation_quirks.c +++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c @@ -127,6 +127,12 @@ static const struct drm_dmi_panel_orientation_data lcd1600x2560_leftside_up = { .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, };
+static const struct drm_dmi_panel_orientation_data lcd1600x2560_rightside_up = { + .width = 1600, + .height = 2560, + .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, +}; + static const struct dmi_system_id orientation_data[] = { { /* Acer One 10 (S1003) */ .matches = { @@ -331,6 +337,13 @@ static const struct dmi_system_id orientation_data[] = { DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21"), }, .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Lenovo Yoga Tab 3 X90F */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), + DMI_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), + DMI_MATCH(DMI_PRODUCT_VERSION, "Blade3-10A-001"), + }, + .driver_data = (void *)&lcd1600x2560_rightside_up, }, { /* Nanote UMPC-01 */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "RWC CO.,LTD"),
From: Allen Ballway ballway@chromium.org
[ Upstream commit a3caf7ea0c3d5872ed0f2c51f5476aee0c47a73a ]
Like the ASUS T100HAN for which there is already a quirk, the DynaBook K50 has a 800x1280 portrait screen mounted in the tablet part of a landscape oriented 2-in-1. Update the quirk to be more generic and apply to this device.
Signed-off-by: Allen Ballway ballway@chromium.org Reviewed-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Hans de Goede hdegoede@redhat.com Link: https://patchwork.freedesktop.org/patch/msgid/20221130170811.1.Iee9a49454754... Signed-off-by: Sasha Levin sashal@kernel.org --- .../gpu/drm/drm_panel_orientation_quirks.c | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c index 23d63a4d42d9c..b409fe256fd0a 100644 --- a/drivers/gpu/drm/drm_panel_orientation_quirks.c +++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c @@ -30,12 +30,6 @@ struct drm_dmi_panel_orientation_data { int orientation; };
-static const struct drm_dmi_panel_orientation_data asus_t100ha = { - .width = 800, - .height = 1280, - .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, -}; - static const struct drm_dmi_panel_orientation_data gpd_micropc = { .width = 720, .height = 1280, @@ -97,6 +91,12 @@ static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = { .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, };
+static const struct drm_dmi_panel_orientation_data lcd800x1280_leftside_up = { + .width = 800, + .height = 1280, + .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, +}; + static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = { .width = 800, .height = 1280, @@ -157,7 +157,7 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), }, - .driver_data = (void *)&asus_t100ha, + .driver_data = (void *)&lcd800x1280_leftside_up, }, { /* Asus T101HA */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), @@ -202,6 +202,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Hi10 pro tablet"), }, .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Dynabook K50 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dynabook Inc."), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "dynabook K50/FR"), + }, + .driver_data = (void *)&lcd800x1280_leftside_up, }, { /* GPD MicroPC (generic strings, also match on bios date) */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
From: Dillon Varone Dillon.Varone@amd.com
[ Upstream commit 6b81090d6d4cc0fd818c9ec9dbb6906f921ad396 ]
[Description] Modify soc BB to reduce expected sdp bandwidth and align with measurements to fix underflow issues.
Reviewed-by: Jun Lei Jun.Lei@amd.com Acked-by: Jasdeep Dhillon jdhillon@amd.com Signed-off-by: Dillon Varone Dillon.Varone@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c index f4b176599be7a..0ea406145c1d7 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c @@ -136,7 +136,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3_21_soc = { .urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096, .urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096, .urgent_out_of_order_return_per_channel_vm_only_bytes = 4096, - .pct_ideal_sdp_bw_after_urgent = 100.0, + .pct_ideal_sdp_bw_after_urgent = 90.0, .pct_ideal_fabric_bw_after_urgent = 67.0, .pct_ideal_dram_sdp_bw_after_urgent_pixel_only = 20.0, .pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm = 60.0, // N/A, for now keep as is until DML implemented
From: Ian Chen ian.chen@amd.com
[ Upstream commit 639f6ad6df7f47db48b59956b469a6917a136afb ]
[WHY] It causes regression AMD source will not write DPCD 340.
Reviewed-by: Wayne Lin Wayne.Lin@amd.com Acked-by: Jasdeep Dhillon jdhillon@amd.com Signed-off-by: Ian Chen ian.chen@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/core/dc_link.c | 6 ------ drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 14 +++----------- drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 1 - 3 files changed, 3 insertions(+), 18 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c index c88f044666fee..754fc86341494 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c @@ -1916,12 +1916,6 @@ struct dc_link *link_create(const struct link_init_data *init_params) if (false == dc_link_construct(link, init_params)) goto construct_fail;
- /* - * Must use preferred_link_setting, not reported_link_cap or verified_link_cap, - * since struct preferred_link_setting won't be reset after S3. - */ - link->preferred_link_setting.dpcd_source_device_specific_field_support = true; - return link;
construct_fail: diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c index dedd1246ce588..475ad3eed002d 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c @@ -6554,18 +6554,10 @@ void dpcd_set_source_specific_data(struct dc_link *link)
uint8_t hblank_size = (uint8_t)link->dc->caps.min_horizontal_blanking_period;
- if (link->preferred_link_setting.dpcd_source_device_specific_field_support) { - result_write_min_hblank = core_link_write_dpcd(link, - DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size), - sizeof(hblank_size)); - - if (result_write_min_hblank == DC_ERROR_UNEXPECTED) - link->preferred_link_setting.dpcd_source_device_specific_field_support = false; - } else { - DC_LOG_DC("Sink device does not support 00340h DPCD write. Skipping on purpose.\n"); - } + result_write_min_hblank = core_link_write_dpcd(link, + DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size), + sizeof(hblank_size)); } - DC_TRACE_LEVEL_MESSAGE(DAL_TRACE_LEVEL_INFORMATION, WPP_BIT_FLAG_DC_DETECTION_DP_CAPS, "result=%u link_index=%u enum dce_version=%d DPCD=0x%04X min_hblank=%u branch_dev_id=0x%x branch_dev_name='%c%c%c%c%c%c'", diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h index 2c54b6e0498bf..296793d8b2bf2 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h +++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h @@ -149,7 +149,6 @@ struct dc_link_settings { enum dc_link_spread link_spread; bool use_link_rate_set; uint8_t link_rate_set; - bool dpcd_source_device_specific_field_support; };
union dc_dp_ffe_preset {
From: Roman Li roman.li@amd.com
[ Upstream commit 7a7175a2cd84b7874bebbf8e59f134557a34161b ]
[Why] Fixing smatch error: dm_resume() error: we previously assumed 'aconnector->dc_link' could be null
[How] Check if dc_link null at the beginning of the loop, so further checks can be dropped.
Reported-by: kernel test robot lkp@intel.com Reported-by: Dan Carpenter dan.carpenter@oracle.com
Reviewed-by: Wayne Lin Wayne.Lin@amd.com Acked-by: Jasdeep Dhillon jdhillon@amd.com Signed-off-by: Roman Li roman.li@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index af16d6bb974b7..69f0ccc18aa82 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -2747,12 +2747,14 @@ static int dm_resume(void *handle) drm_for_each_connector_iter(connector, &iter) { aconnector = to_amdgpu_dm_connector(connector);
+ if (!aconnector->dc_link) + continue; + /* * this is the case when traversing through already created * MST connectors, should be skipped */ - if (aconnector->dc_link && - aconnector->dc_link->type == dc_connection_mst_branch) + if (aconnector->dc_link->type == dc_connection_mst_branch) continue;
mutex_lock(&aconnector->hpd_lock);
From: Tomi Valkeinen tomi.valkeinen@ideasonboard.com
[ Upstream commit cfca78971b9233aef0891507a98fba62046d4542 ]
dsi_dump_dsi_irqs(), a function used for debugfs prints, has a large struct in its frame, which can result in:
drivers/gpu/drm/omapdrm/dss/dsi.c:1126:1: warning: the frame size of 1060 bytes is larger than 1024 bytes [-Wframe-larger-than=]
As the performance of the function is of no concern, let's allocate the struct with kmalloc instead.
Compile-tested only.
Signed-off-by: Tomi Valkeinen tomi.valkeinen@ideasonboard.com Reported-by: kernel test robot lkp@intel.com Reviewed-by: Arnd Bergmann arnd@arndb.de Link: https://patchwork.freedesktop.org/patch/msgid/20220916082206.167427-1-tomi.v... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/omapdrm/dss/dsi.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c index a6845856cbce4..4c1084eb01759 100644 --- a/drivers/gpu/drm/omapdrm/dss/dsi.c +++ b/drivers/gpu/drm/omapdrm/dss/dsi.c @@ -1039,22 +1039,26 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) { struct dsi_data *dsi = s->private; unsigned long flags; - struct dsi_irq_stats stats; + struct dsi_irq_stats *stats; + + stats = kmalloc(sizeof(*stats), GFP_KERNEL); + if (!stats) + return -ENOMEM;
spin_lock_irqsave(&dsi->irq_stats_lock, flags);
- stats = dsi->irq_stats; + *stats = dsi->irq_stats; memset(&dsi->irq_stats, 0, sizeof(dsi->irq_stats)); dsi->irq_stats.last_reset = jiffies;
spin_unlock_irqrestore(&dsi->irq_stats_lock, flags);
seq_printf(s, "period %u ms\n", - jiffies_to_msecs(jiffies - stats.last_reset)); + jiffies_to_msecs(jiffies - stats->last_reset));
- seq_printf(s, "irqs %d\n", stats.irq_count); + seq_printf(s, "irqs %d\n", stats->irq_count); #define PIS(x) \ - seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1]); + seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1]);
seq_printf(s, "-- DSI%d interrupts --\n", dsi->module_id + 1); PIS(VC0); @@ -1078,10 +1082,10 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
#define PIS(x) \ seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \ - stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ - stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ - stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ - stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]); + stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ + stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ + stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ + stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
seq_printf(s, "-- VC interrupts --\n"); PIS(CS); @@ -1097,7 +1101,7 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p)
#define PIS(x) \ seq_printf(s, "%-20s %10d\n", #x, \ - stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]); + stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
seq_printf(s, "-- CIO interrupts --\n"); PIS(ERRSYNCESC1); @@ -1122,6 +1126,8 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) PIS(ULPSACTIVENOT_ALL1); #undef PIS
+ kfree(stats); + return 0; } #endif
From: Jingyuan Liang jingyliang@chromium.org
[ Upstream commit 2d60f9f4f26785a00273cb81fe60eff129ebd449 ]
HUTRR110 added a new usage code for a key that is supposed to mute/unmute microphone system-wide.
Map the new usage code(0x01 0xa9) to keycode KEY_MICMUTE. Additionally hid-debug is adjusted to recognize this keycode as well.
Signed-off-by: Jingyuan Liang jingyliang@chromium.org Reviewed-by: Dmitry Torokhov dmitry.torokhov@gmail.com Signed-off-by: Jiri Kosina jkosina@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-debug.c | 1 + drivers/hid/hid-input.c | 8 ++++++++ 2 files changed, 9 insertions(+)
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c index e213bdde543af..e7ef1ea107c9e 100644 --- a/drivers/hid/hid-debug.c +++ b/drivers/hid/hid-debug.c @@ -975,6 +975,7 @@ static const char *keys[KEY_MAX + 1] = { [KEY_CAMERA_ACCESS_DISABLE] = "CameraAccessDisable", [KEY_CAMERA_ACCESS_TOGGLE] = "CameraAccessToggle", [KEY_DICTATE] = "Dictate", + [KEY_MICMUTE] = "MicrophoneMute", [KEY_BRIGHTNESS_MIN] = "BrightnessMin", [KEY_BRIGHTNESS_MAX] = "BrightnessMax", [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto", diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c index 77c8c49852b5c..bd0cfccfb7a25 100644 --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -793,6 +793,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel break; }
+ if ((usage->hid & 0xf0) == 0xa0) { /* SystemControl */ + switch (usage->hid & 0xf) { + case 0x9: map_key_clear(KEY_MICMUTE); break; + default: goto ignore; + } + break; + } + if ((usage->hid & 0xf0) == 0xb0) { /* SC - Display */ switch (usage->hid & 0xf) { case 0x05: map_key_clear(KEY_SWITCHVIDEOMODE); break;
From: Carlo Caione ccaione@baylibre.com
[ Upstream commit 77772e607522daa61f3af74df018559db75c43d6 ]
The pixel data for the ILI9486 is always 16-bits wide and it must be sent over the SPI bus. When the controller is only able to deal with 8-bit transfers, this 16-bits data needs to be swapped before the sending to account for the big endian bus, this is on the contrary not needed when the SPI controller already supports 16-bits transfers.
The decision about swapping the pixel data or not is taken in the MIPI DBI code by probing the controller capabilities: if the controller only suppors 8-bit transfers the data is swapped, otherwise it is not.
This swapping/non-swapping is relying on the assumption that when the controller does support 16-bit transactions then the data is sent unswapped in 16-bits-per-word over SPI.
The problem with the ILI9486 driver is that it is forcing 8-bit transactions also for controllers supporting 16-bits, violating the assumption and corrupting the pixel data.
Align the driver to what is done in the MIPI DBI code by adjusting the transfer size to the maximum allowed by the SPI controller.
Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Signed-off-by: Carlo Caione ccaione@baylibre.com Reviewed-by: Kamlesh Gurudasani kamlesh.gurudasani@gmail.com Signed-off-by: Neil Armstrong neil.armstrong@linaro.org Link: https://patchwork.freedesktop.org/patch/msgid/20221116-s905x_spi_ili9486-v4-... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/tiny/ili9486.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/tiny/ili9486.c b/drivers/gpu/drm/tiny/ili9486.c index 1bb847466b107..a63b15817f112 100644 --- a/drivers/gpu/drm/tiny/ili9486.c +++ b/drivers/gpu/drm/tiny/ili9486.c @@ -43,6 +43,7 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, size_t num) { struct spi_device *spi = mipi->spi; + unsigned int bpw = 8; void *data = par; u32 speed_hz; int i, ret; @@ -56,8 +57,6 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, * The displays are Raspberry Pi HATs and connected to the 8-bit only * SPI controller, so 16-bit command and parameters need byte swapping * before being transferred as 8-bit on the big endian SPI bus. - * Pixel data bytes have already been swapped before this function is - * called. */ buf[0] = cpu_to_be16(*cmd); gpiod_set_value_cansleep(mipi->dc, 0); @@ -71,12 +70,18 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, for (i = 0; i < num; i++) buf[i] = cpu_to_be16(par[i]); num *= 2; - speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num); data = buf; }
+ /* + * Check whether pixel data bytes needs to be swapped or not + */ + if (*cmd == MIPI_DCS_WRITE_MEMORY_START && !mipi->swap_bytes) + bpw = 16; + gpiod_set_value_cansleep(mipi->dc, 1); - ret = mipi_dbi_spi_transfer(spi, speed_hz, 8, data, num); + speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num); + ret = mipi_dbi_spi_transfer(spi, speed_hz, bpw, data, num); free: kfree(buf);
From: Nicholas Kazlauskas nicholas.kazlauskas@amd.com
[ Upstream commit 2d90a1c054831338d57b39aec4d273cf3e867590 ]
[Why] On some monitors we see a brief flash of corruption during the monitor disable sequence caused by FIFO being disabled in the middle of an active DP stream.
[How] Wait until DP vid stream is disabled before turning off the FIFO.
The FIFO reset on DP unblank should take care of clearing any FIFO error, if any.
Acked-by: Aurabindo Pillai aurabindo.pillai@amd.com Signed-off-by: Nicholas Kazlauskas nicholas.kazlauskas@amd.com Reviewed-by: Syed Hassan Syed.Hassan@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c index 38842f938bed0..0926db0183383 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c +++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dio_stream_encoder.c @@ -278,10 +278,10 @@ static void enc314_stream_encoder_dp_blank( struct dc_link *link, struct stream_encoder *enc) { - /* New to DCN314 - disable the FIFO before VID stream disable. */ - enc314_disable_fifo(enc); - enc1_stream_encoder_dp_blank(link, enc); + + /* Disable FIFO after the DP vid stream is disabled to avoid corruption. */ + enc314_disable_fifo(enc); }
static void enc314_stream_encoder_dp_unblank(
From: Liwei Song liwei.song@windriver.com
[ Upstream commit 4773fadedca918faec443daaca5e4ea1c0ced144 ]
Fix below kmemleak when unload radeon driver:
unreferenced object 0xffff9f8608ede200 (size 512): comm "systemd-udevd", pid 326, jiffies 4294682822 (age 716.338s) hex dump (first 32 bytes): 00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500 [<00000000b6883cea>] atom_parse+0x117/0x230 [radeon] [<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon] [<00000000683f672e>] si_init+0x57/0x750 [radeon] [<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon] [<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon] [<00000000b5155064>] drm_dev_register+0xdd/0x1d0 [<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon] [<00000000e69ecca3>] pci_device_probe+0xe1/0x160 [<0000000019484b76>] really_probe.part.0+0xc1/0x2c0 [<000000003f2649da>] __driver_probe_device+0x96/0x130 [<00000000231c5bb1>] driver_probe_device+0x24/0xf0 [<0000000000a42377>] __driver_attach+0x77/0x190 [<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0 [<00000000633166d2>] driver_attach+0x1e/0x30 [<00000000313b05b8>] bus_add_driver+0x12c/0x1e0
iio was allocated in atom_index_iio() called by atom_parse(), but it doesn't got released when the dirver is shutdown. Fix this kmemleak by free it in radeon_atombios_fini().
Signed-off-by: Liwei Song liwei.song@windriver.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/radeon/radeon_device.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c index 6344454a77217..4f9729b4a8119 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1023,6 +1023,7 @@ void radeon_atombios_fini(struct radeon_device *rdev) { if (rdev->mode_info.atom_context) { kfree(rdev->mode_info.atom_context->scratch); + kfree(rdev->mode_info.atom_context->iio); } kfree(rdev->mode_info.atom_context); rdev->mode_info.atom_context = NULL;
From: Mario Limonciello mario.limonciello@amd.com
[ Upstream commit 93fec4f8c158584065134b4d45e875499bf517c8 ]
No need to crash the kernel. AMDGPU will now fail to probe.
Reviewed-by: Alex Deucher alexander.deucher@amd.com Reviewed-by: Lijo Lazar lijo.lazar@amd.com Signed-off-by: Mario Limonciello mario.limonciello@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c index 7a2fc920739bb..ba092072308fa 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c @@ -380,7 +380,7 @@ static int psp_init_sriov_microcode(struct psp_context *psp) adev->virt.autoload_ucode_id = AMDGPU_UCODE_ID_CP_MES1_DATA; break; default: - BUG(); + ret = -EINVAL; break; } return ret;
From: Philip Yang Philip.Yang@amd.com
[ Upstream commit 0c2dece8fb541ab07b68c3312a1065fa9c927a81 ]
Use page aligned size to reserve memory usage because page aligned TTM BO size is used to unreserve memory usage, otherwise no page aligned size causes memory usage accounting unbalanced.
Change vram_used definition type to int64_t to be able to trigger WARN_ONCE(adev && adev->kfd.vram_used < 0, "..."), to help debug the accounting issue with warning and backtrace.
Signed-off-by: Philip Yang Philip.Yang@amd.com Reviewed-by: Felix Kuehling Felix.Kuehling@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 12 +++++++----- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 9 +++++++-- 3 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h index 0040deaf8a83a..90a5254ec1387 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h @@ -97,7 +97,7 @@ struct amdgpu_amdkfd_fence {
struct amdgpu_kfd_dev { struct kfd_dev *dev; - uint64_t vram_used; + int64_t vram_used; uint64_t vram_used_aligned; bool init_complete; struct work_struct reset_work; diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c index 3b5c53712d319..05b884fe0a927 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c @@ -1612,6 +1612,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( struct amdgpu_bo *bo; struct drm_gem_object *gobj = NULL; u32 domain, alloc_domain; + uint64_t aligned_size; u64 alloc_flags; int ret;
@@ -1667,22 +1668,23 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( * the memory. */ if ((*mem)->aql_queue) - size = size >> 1; + size >>= 1; + aligned_size = PAGE_ALIGN(size);
(*mem)->alloc_flags = flags;
amdgpu_sync_create(&(*mem)->sync);
- ret = amdgpu_amdkfd_reserve_mem_limit(adev, size, flags); + ret = amdgpu_amdkfd_reserve_mem_limit(adev, aligned_size, flags); if (ret) { pr_debug("Insufficient memory\n"); goto err_reserve_limit; }
pr_debug("\tcreate BO VA 0x%llx size 0x%llx domain %s\n", - va, size, domain_string(alloc_domain)); + va, (*mem)->aql_queue ? size << 1 : size, domain_string(alloc_domain));
- ret = amdgpu_gem_object_create(adev, size, 1, alloc_domain, alloc_flags, + ret = amdgpu_gem_object_create(adev, aligned_size, 1, alloc_domain, alloc_flags, bo_type, NULL, &gobj); if (ret) { pr_debug("Failed to create BO on domain %s. ret %d\n", @@ -1739,7 +1741,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( /* Don't unreserve system mem limit twice */ goto err_reserve_limit; err_bo_create: - amdgpu_amdkfd_unreserve_mem_limit(adev, size, flags); + amdgpu_amdkfd_unreserve_mem_limit(adev, aligned_size, flags); err_reserve_limit: mutex_destroy(&(*mem)->lock); if (gobj) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 6d291aa6386bd..f79b8e964140e 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -1127,8 +1127,13 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, }
/* Update the VRAM usage count */ - if (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) - WRITE_ONCE(pdd->vram_usage, pdd->vram_usage + args->size); + if (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) { + uint64_t size = args->size; + + if (flags & KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM) + size >>= 1; + WRITE_ONCE(pdd->vram_usage, pdd->vram_usage + PAGE_ALIGN(size)); + }
mutex_unlock(&p->mutex);
From: Justin Tee justin.tee@broadcom.com
[ Upstream commit 21681b81b9ae548c5dae7ae00d931197a27f480c ]
During the sysfs firmware write process, a use-after-free read warning is logged from the lpfc_wr_object() routine:
BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc] Use-after-free read at 0x0000000000cf164d (in kfence-#111): lpfc_wr_object+0x235/0x310 [lpfc] lpfc_write_firmware.cold+0x206/0x30d [lpfc] lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc] lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc] kernfs_fop_write_iter+0x121/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1ef/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x59/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The driver accessed wr_object pointer data, which was initialized into mailbox payload memory, after the mailbox object was released back to the mailbox pool.
Fix by moving the mailbox free calls to the end of the routine ensuring that we don't reference internal mailbox memory after release.
Signed-off-by: Justin Tee justin.tee@broadcom.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/scsi/lpfc/lpfc_sli.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index 182aaae603868..55a0d4013439f 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -20819,6 +20819,7 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, struct lpfc_mbx_wr_object *wr_object; LPFC_MBOXQ_t *mbox; int rc = 0, i = 0; + int mbox_status = 0; uint32_t shdr_status, shdr_add_status, shdr_add_status_2; uint32_t shdr_change_status = 0, shdr_csf = 0; uint32_t mbox_tmo; @@ -20864,11 +20865,15 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, wr_object->u.request.bde_count = i; bf_set(lpfc_wr_object_write_length, &wr_object->u.request, written); if (!phba->sli4_hba.intr_enable) - rc = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL); + mbox_status = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL); else { mbox_tmo = lpfc_mbox_tmo_val(phba, mbox); - rc = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo); + mbox_status = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo); } + + /* The mbox status needs to be maintained to detect MBOX_TIMEOUT. */ + rc = mbox_status; + /* The IOCTL status is embedded in the mailbox subheader. */ shdr_status = bf_get(lpfc_mbox_hdr_status, &wr_object->header.cfg_shdr.response); @@ -20883,10 +20888,6 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, &wr_object->u.response); }
- if (!phba->sli4_hba.intr_enable) - mempool_free(mbox, phba->mbox_mem_pool); - else if (rc != MBX_TIMEOUT) - mempool_free(mbox, phba->mbox_mem_pool); if (shdr_status || shdr_add_status || shdr_add_status_2 || rc) { lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, "3025 Write Object mailbox failed with " @@ -20904,6 +20905,12 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, lpfc_log_fw_write_cmpl(phba, shdr_status, shdr_add_status, shdr_add_status_2, shdr_change_status, shdr_csf); + + if (!phba->sli4_hba.intr_enable) + mempool_free(mbox, phba->mbox_mem_pool); + else if (mbox_status != MBX_TIMEOUT) + mempool_free(mbox, phba->mbox_mem_pool); + return rc; }
From: Thomas Zimmermann tzimmermann@suse.de
[ Upstream commit 12d5796d55f9fd9e4b621003127c99e176665064 ]
This reverts commit ae1287865f5361fa138d4d3b1b6277908b54eac9.
Always free the console font when deinitializing the framebuffer console. Subsequent framebuffer consoles will then use the default font. Rely on userspace to load any user-configured font for these consoles.
Commit ae1287865f53 ("fbcon: don't lose the console font across generic->chip driver switch") was introduced to work around losing the font during graphics-device handover. [1][2] It kept a dangling pointer with the font data between loading the two consoles, which is fairly adventurous hack. It also never covered cases when the other consoles, such as VGA text mode, where involved.
The problem has meanwhile been solved in userspace. Systemd comes with a udev rule that re-installs the configured font when a console comes up. [3] So the kernel workaround can be removed.
This also removes one of the two special cases triggered by setting FBINFO_MISC_FIRMWARE in an fbdev driver.
Tested during device handover from efifb and simpledrm to radeon. Udev reloads the configured console font for the new driver's terminal.
Signed-off-by: Thomas Zimmermann tzimmermann@suse.de Link: https://bugzilla.redhat.com/show_bug.cgi?id=892340 # 1 Link: https://bugzilla.redhat.com/show_bug.cgi?id=1074624 # 2 Link: https://cgit.freedesktop.org/systemd/systemd/tree/src/vconsole/90-vconsole.r... # 3 Reviewed-by: Javier Martinez Canillas javierm@redhat.com Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-3-tzimmer... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/video/fbdev/core/fbcon.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 1b14c21af2b74..2bc8baa90c0f2 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -958,7 +958,7 @@ static const char *fbcon_startup(void) set_blitting_type(vc, info);
/* Setup default font */ - if (!p->fontdata && !vc->vc_font.data) { + if (!p->fontdata) { if (!fontname[0] || !(font = find_font(fontname))) font = get_default_font(info->var.xres, info->var.yres, @@ -968,8 +968,6 @@ static const char *fbcon_startup(void) vc->vc_font.height = font->height; vc->vc_font.data = (void *)(p->fontdata = font->data); vc->vc_font.charcount = font->charcount; - } else { - p->fontdata = vc->vc_font.data; }
cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); @@ -1135,9 +1133,9 @@ static void fbcon_init(struct vc_data *vc, int init) ops->p = &fb_display[fg_console]; }
-static void fbcon_free_font(struct fbcon_display *p, bool freefont) +static void fbcon_free_font(struct fbcon_display *p) { - if (freefont && p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0)) + if (p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0)) kfree(p->fontdata - FONT_EXTRA_WORDS * sizeof(int)); p->fontdata = NULL; p->userfont = 0; @@ -1172,8 +1170,8 @@ static void fbcon_deinit(struct vc_data *vc) struct fb_info *info; struct fbcon_ops *ops; int idx; - bool free_font = true;
+ fbcon_free_font(p); idx = con2fb_map[vc->vc_num];
if (idx == -1) @@ -1184,8 +1182,6 @@ static void fbcon_deinit(struct vc_data *vc) if (!info) goto finished;
- if (info->flags & FBINFO_MISC_FIRMWARE) - free_font = false; ops = info->fbcon_par;
if (!ops) @@ -1197,9 +1193,8 @@ static void fbcon_deinit(struct vc_data *vc) ops->initialized = false; finished:
- fbcon_free_font(p, free_font); - if (free_font) - vc->vc_font.data = NULL; + fbcon_free_font(p); + vc->vc_font.data = NULL;
if (vc->vc_hi_font_mask && vc->vc_screenbuf) set_vc_hi_font(vc, false);
From: Mario Limonciello mario.limonciello@amd.com
[ Upstream commit 3e5019ee67760cd61b2a5fd605e1289c2f92d983 ]
On DCN314 when resuming from s0i3 an ASSERT is shown indicating that `VBIOSSMC_MSG_SetHardMinDcfclkByFreq` returned `VBIOSSMC_Result_Failed`.
This isn't a driver bug; it's a BIOS/configuration bug. To make this easier to triage, add an explicit warning when this issue happens.
This matches the behavior utilized for failures with `VBIOSSMC_MSG_TransferTableDram2Smu` configuration.
Signed-off-by: Mario Limonciello mario.limonciello@amd.com Reviewed-by: Harry Wentland harry.wentland@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c index f47cfe6b42bd2..0765334f08259 100644 --- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c +++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_smu.c @@ -146,6 +146,9 @@ static int dcn314_smu_send_msg_with_param(struct clk_mgr_internal *clk_mgr, if (msg_id == VBIOSSMC_MSG_TransferTableDram2Smu && param == TABLE_WATERMARKS) DC_LOG_WARNING("Watermarks table not configured properly by SMU"); + else if (msg_id == VBIOSSMC_MSG_SetHardMinDcfclkByFreq || + msg_id == VBIOSSMC_MSG_SetMinDeepSleepDcfclk) + DC_LOG_WARNING("DCFCLK_DPM is not enabled by BIOS"); else ASSERT(0); REG_WRITE(MP1_SMN_C2PMSG_91, VBIOSSMC_Result_OK);
From: Konstantin Meskhidze konstantin.meskhidze@huawei.com
[ Upstream commit 6b8701be1f66064ca72733c5f6e13748cdbf8397 ]
This commit fixes memory leakage in dc_construct_ctx() function.
Signed-off-by: Konstantin Meskhidze konstantin.meskhidze@huawei.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index 0cb8d1f934d12..c03e86e49fea3 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -862,6 +862,7 @@ static bool dc_construct_ctx(struct dc *dc,
dc_ctx->perf_trace = dc_perf_trace_create(); if (!dc_ctx->perf_trace) { + kfree(dc_ctx); ASSERT_CRITICAL(false); return false; }
From: Brandon Syu Brandon.Syu@amd.com
[ Upstream commit 9190d4a263264eabf715f5fc1827da45e3fdc247 ]
[Why] There is an issue mapping non-allocated location of memory. It would allocate gpio registers from an array out of bounds.
[How] Patch correct numbers of bounds for using.
Tested-by: Daniel Wheeler Daniel.Wheeler@amd.com Reviewed-by: Martin Leung Martin.Leung@amd.com Acked-by: Rodrigo Siqueira Rodrigo.Siqueira@amd.com Signed-off-by: Brandon Syu Brandon.Syu@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- .../gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c | 6 ++++-- .../gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c | 6 ++++-- .../gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c | 6 ++++-- drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h | 7 +++++++ 4 files changed, 19 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c index 9b63c6c0cc844..e0bd0c722e006 100644 --- a/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c +++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn20/hw_factory_dcn20.c @@ -138,7 +138,8 @@ static const struct ddc_sh_mask ddc_shift[] = { DDC_MASK_SH_LIST_DCN2(__SHIFT, 3), DDC_MASK_SH_LIST_DCN2(__SHIFT, 4), DDC_MASK_SH_LIST_DCN2(__SHIFT, 5), - DDC_MASK_SH_LIST_DCN2(__SHIFT, 6) + DDC_MASK_SH_LIST_DCN2(__SHIFT, 6), + DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT) };
static const struct ddc_sh_mask ddc_mask[] = { @@ -147,7 +148,8 @@ static const struct ddc_sh_mask ddc_mask[] = { DDC_MASK_SH_LIST_DCN2(_MASK, 3), DDC_MASK_SH_LIST_DCN2(_MASK, 4), DDC_MASK_SH_LIST_DCN2(_MASK, 5), - DDC_MASK_SH_LIST_DCN2(_MASK, 6) + DDC_MASK_SH_LIST_DCN2(_MASK, 6), + DDC_MASK_SH_LIST_DCN2_VGA(_MASK) };
#include "../generic_regs.h" diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c index 687d4f128480e..36a5736c58c92 100644 --- a/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c +++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn30/hw_factory_dcn30.c @@ -145,7 +145,8 @@ static const struct ddc_sh_mask ddc_shift[] = { DDC_MASK_SH_LIST_DCN2(__SHIFT, 3), DDC_MASK_SH_LIST_DCN2(__SHIFT, 4), DDC_MASK_SH_LIST_DCN2(__SHIFT, 5), - DDC_MASK_SH_LIST_DCN2(__SHIFT, 6) + DDC_MASK_SH_LIST_DCN2(__SHIFT, 6), + DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT) };
static const struct ddc_sh_mask ddc_mask[] = { @@ -154,7 +155,8 @@ static const struct ddc_sh_mask ddc_mask[] = { DDC_MASK_SH_LIST_DCN2(_MASK, 3), DDC_MASK_SH_LIST_DCN2(_MASK, 4), DDC_MASK_SH_LIST_DCN2(_MASK, 5), - DDC_MASK_SH_LIST_DCN2(_MASK, 6) + DDC_MASK_SH_LIST_DCN2(_MASK, 6), + DDC_MASK_SH_LIST_DCN2_VGA(_MASK) };
#include "../generic_regs.h" diff --git a/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c b/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c index 9fd8b269dd79c..985f10b397509 100644 --- a/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c +++ b/drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c @@ -149,7 +149,8 @@ static const struct ddc_sh_mask ddc_shift[] = { DDC_MASK_SH_LIST_DCN2(__SHIFT, 3), DDC_MASK_SH_LIST_DCN2(__SHIFT, 4), DDC_MASK_SH_LIST_DCN2(__SHIFT, 5), - DDC_MASK_SH_LIST_DCN2(__SHIFT, 6) + DDC_MASK_SH_LIST_DCN2(__SHIFT, 6), + DDC_MASK_SH_LIST_DCN2_VGA(__SHIFT) };
static const struct ddc_sh_mask ddc_mask[] = { @@ -158,7 +159,8 @@ static const struct ddc_sh_mask ddc_mask[] = { DDC_MASK_SH_LIST_DCN2(_MASK, 3), DDC_MASK_SH_LIST_DCN2(_MASK, 4), DDC_MASK_SH_LIST_DCN2(_MASK, 5), - DDC_MASK_SH_LIST_DCN2(_MASK, 6) + DDC_MASK_SH_LIST_DCN2(_MASK, 6), + DDC_MASK_SH_LIST_DCN2_VGA(_MASK) };
#include "../generic_regs.h" diff --git a/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h b/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h index 308a543178a56..59884ef651b39 100644 --- a/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h +++ b/drivers/gpu/drm/amd/display/dc/gpio/ddc_regs.h @@ -113,6 +113,13 @@ (PHY_AUX_CNTL__AUX## cd ##_PAD_RXSEL## mask_sh),\ (DC_GPIO_AUX_CTRL_5__DDC_PAD## cd ##_I2CMODE## mask_sh)}
+#define DDC_MASK_SH_LIST_DCN2_VGA(mask_sh) \ + {DDC_MASK_SH_LIST_COMMON(mask_sh),\ + 0,\ + 0,\ + 0,\ + 0} + struct ddc_registers { struct gpio_registers gpio; uint32_t ddc_setup;
From: José Expósito jose.exposito89@gmail.com
[ Upstream commit 14b71e6ad8ca59dd734c7fa9676f3d60bddee2a9 ]
The report descriptor used to get information about UGEE v2 devices is incorrect in the XP-PEN Deco Pro SW. It indicates that the device frame is of type UCLOGIC_PARAMS_FRAME_BUTTONS but the device has a frame of type UCLOGIC_PARAMS_FRAME_MOUSE.
Here is the original report descriptor:
0x0e 0x03 0xc8 0xb3 0x34 0x65 0x08 0x00 0xff 0x1f 0xd8 0x13 0x00 0x00 ^ This byte should be 2
Add a quirk to be able to fix the reported frame type.
Tested-by: Mia Kanashi chad@redpilled.dev Tested-by: Andreas Grosse andig.mail@t-online.de Signed-off-by: José Expósito jose.exposito89@gmail.com Signed-off-by: Jiri Kosina jkosina@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-uclogic-core.c | 20 +------------------- drivers/hid/hid-uclogic-params.c | 5 +++++ drivers/hid/hid-uclogic-params.h | 23 +++++++++++++++++++++++ 3 files changed, 29 insertions(+), 19 deletions(-)
diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c index cfbbc39807a69..739984b8fa1b8 100644 --- a/drivers/hid/hid-uclogic-core.c +++ b/drivers/hid/hid-uclogic-core.c @@ -22,25 +22,6 @@
#include "hid-ids.h"
-/* Driver data */ -struct uclogic_drvdata { - /* Interface parameters */ - struct uclogic_params params; - /* Pointer to the replacement report descriptor. NULL if none. */ - __u8 *desc_ptr; - /* - * Size of the replacement report descriptor. - * Only valid if desc_ptr is not NULL - */ - unsigned int desc_size; - /* Pen input device */ - struct input_dev *pen_input; - /* In-range timer */ - struct timer_list inrange_timer; - /* Last rotary encoder state, or U8_MAX for none */ - u8 re_state; -}; - /** * uclogic_inrange_timeout - handle pen in-range state timeout. * Emulate input events normally generated when pen goes out of range for @@ -202,6 +183,7 @@ static int uclogic_probe(struct hid_device *hdev, } timer_setup(&drvdata->inrange_timer, uclogic_inrange_timeout, 0); drvdata->re_state = U8_MAX; + drvdata->quirks = id->driver_data; hid_set_drvdata(hdev, drvdata);
/* Initialize the device and retrieve interface parameters */ diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c index 3c5eea3df3288..e052538a62fb3 100644 --- a/drivers/hid/hid-uclogic-params.c +++ b/drivers/hid/hid-uclogic-params.c @@ -1298,6 +1298,7 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params, struct hid_device *hdev) { int rc = 0; + struct uclogic_drvdata *drvdata; struct usb_interface *iface; __u8 bInterfaceNumber; const int str_desc_len = 12; @@ -1316,6 +1317,7 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params, goto cleanup; }
+ drvdata = hid_get_drvdata(hdev); iface = to_usb_interface(hdev->dev.parent); bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber;
@@ -1382,6 +1384,9 @@ static int uclogic_params_ugee_v2_init(struct uclogic_params *params, p.pen.subreport_list[0].id = UCLOGIC_RDESC_V1_FRAME_ID;
/* Initialize the frame interface */ + if (drvdata->quirks & UCLOGIC_MOUSE_FRAME_QUIRK) + frame_type = UCLOGIC_PARAMS_FRAME_MOUSE; + switch (frame_type) { case UCLOGIC_PARAMS_FRAME_DIAL: case UCLOGIC_PARAMS_FRAME_MOUSE: diff --git a/drivers/hid/hid-uclogic-params.h b/drivers/hid/hid-uclogic-params.h index a97477c02ff82..10a05c7fd9398 100644 --- a/drivers/hid/hid-uclogic-params.h +++ b/drivers/hid/hid-uclogic-params.h @@ -19,6 +19,8 @@ #include <linux/usb.h> #include <linux/hid.h>
+#define UCLOGIC_MOUSE_FRAME_QUIRK BIT(0) + /* Types of pen in-range reporting */ enum uclogic_params_pen_inrange { /* Normal reports: zero - out of proximity, one - in proximity */ @@ -215,6 +217,27 @@ struct uclogic_params { struct uclogic_params_frame frame_list[3]; };
+/* Driver data */ +struct uclogic_drvdata { + /* Interface parameters */ + struct uclogic_params params; + /* Pointer to the replacement report descriptor. NULL if none. */ + __u8 *desc_ptr; + /* + * Size of the replacement report descriptor. + * Only valid if desc_ptr is not NULL + */ + unsigned int desc_size; + /* Pen input device */ + struct input_dev *pen_input; + /* In-range timer */ + struct timer_list inrange_timer; + /* Last rotary encoder state, or U8_MAX for none */ + u8 re_state; + /* Device quirks */ + unsigned long quirks; +}; + /* Initialize a tablet interface and discover its parameters */ extern int uclogic_params_init(struct uclogic_params *params, struct hid_device *hdev);
From: José Expósito jose.exposito89@gmail.com
[ Upstream commit f60c377f52de37f8705c5fc6d57737fdaf309ff9 ]
Some UGEE v2 tablets have a wireless version with an internal battery and their firmware is able to report their battery level.
However, there was not found a field on their descriptor indicating whether the tablet has battery or not, making it mandatory to classify such devices through the UCLOGIC_BATTERY_QUIRK quirk.
Tested-by: Mia Kanashi chad@redpilled.dev Tested-by: Andreas Grosse andig.mail@t-online.de Signed-off-by: José Expósito jose.exposito89@gmail.com Signed-off-by: Jiri Kosina jkosina@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-uclogic-params.c | 5 +++++ drivers/hid/hid-uclogic-params.h | 1 + 2 files changed, 6 insertions(+)
diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c index e052538a62fb3..23624d5b07b5a 100644 --- a/drivers/hid/hid-uclogic-params.c +++ b/drivers/hid/hid-uclogic-params.c @@ -1222,6 +1222,11 @@ static int uclogic_params_ugee_v2_init_frame_mouse(struct uclogic_params *p) */ static bool uclogic_params_ugee_v2_has_battery(struct hid_device *hdev) { + struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev); + + if (drvdata->quirks & UCLOGIC_BATTERY_QUIRK) + return true; + /* The XP-PEN Deco LW vendor, product and version are identical to the * Deco L. The only difference reported by their firmware is the product * name. Add a quirk to support battery reporting on the wireless diff --git a/drivers/hid/hid-uclogic-params.h b/drivers/hid/hid-uclogic-params.h index 10a05c7fd9398..b0e7f3807939b 100644 --- a/drivers/hid/hid-uclogic-params.h +++ b/drivers/hid/hid-uclogic-params.h @@ -20,6 +20,7 @@ #include <linux/hid.h>
#define UCLOGIC_MOUSE_FRAME_QUIRK BIT(0) +#define UCLOGIC_BATTERY_QUIRK BIT(1)
/* Types of pen in-range reporting */ enum uclogic_params_pen_inrange {
From: José Expósito jose.exposito89@gmail.com
[ Upstream commit 7744ca571af55b794595cff2da9d51a26904998f ]
The XP-PEN Deco Pro SW is a UGEE v2 device with a frame with 8 buttons, a bitmap dial and a mouse; however, the UCLOGIC_MOUSE_FRAME_QUIRK is required because it reports an incorrect frame type. Its pen has 2 buttons, supports tilt and pressure.
It can be connected using a USB cable or, to use it in wireless mode, using a USB Bluetooth dongle. When it is connected in wireless mode the device battery is used to power it.
All the pieces to support it are already in place. Add its ID and quirks in order to support the device.
Signed-off-by: José Expósito jose.exposito89@gmail.com Signed-off-by: Jiri Kosina jkosina@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 ++ drivers/hid/hid-uclogic-core.c | 3 +++ drivers/hid/hid-uclogic-params.c | 2 ++ 4 files changed, 8 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h index 9e36b4cd905ee..c662994d73381 100644 --- a/drivers/hid/hid-ids.h +++ b/drivers/hid/hid-ids.h @@ -1300,6 +1300,7 @@ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2 0x0905 #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L 0x0935 #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S 0x0909 +#define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW 0x0933 #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06 0x0078 #define USB_DEVICE_ID_UGEE_TABLET_G5 0x0074 #define USB_DEVICE_ID_UGEE_TABLET_EX07S 0x0071 diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c index bd0cfccfb7a25..0f8a5152e48b1 100644 --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -378,6 +378,8 @@ static const struct hid_device_id hid_battery_quirks[] = { HID_BATTERY_QUIRK_IGNORE }, { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L), HID_BATTERY_QUIRK_AVOID_QUERY }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW), + HID_BATTERY_QUIRK_AVOID_QUERY }, { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15), HID_BATTERY_QUIRK_IGNORE }, { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100), diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c index 739984b8fa1b8..7c05d38d3afad 100644 --- a/drivers/hid/hid-uclogic-core.c +++ b/drivers/hid/hid-uclogic-core.c @@ -513,6 +513,9 @@ static const struct hid_device_id uclogic_devices[] = { USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L) }, { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW), + .driver_data = UCLOGIC_MOUSE_FRAME_QUIRK | UCLOGIC_BATTERY_QUIRK }, { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06) }, { } diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c index 23624d5b07b5a..492a30f83575a 100644 --- a/drivers/hid/hid-uclogic-params.c +++ b/drivers/hid/hid-uclogic-params.c @@ -1671,6 +1671,8 @@ int uclogic_params_init(struct uclogic_params *params, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L): case VID_PID(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S): + case VID_PID(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW): rc = uclogic_params_ugee_v2_init(&p, hdev); if (rc != 0) goto cleanup;
From: José Expósito jose.exposito89@gmail.com
[ Upstream commit 9266a88156d1fbb8e50d6eeff7bac44ad4eaecc2 ]
The XP-PEN Deco Pro MW is a UGEE v2 device with a frame with 8 buttons, a bitmap dial and a mouse. Its pen has 2 buttons, supports tilt and pressure.
It can be connected using a USB cable or, to use it in wireless mode, using a USB Bluetooth dongle. When it is connected in wireless mode the device battery is used to power it.
All the pieces to support it are already in place. Add its ID and quirks in order to support the device.
Link: https://github.com/DIGImend/digimend-kernel-drivers/issues/622 Tested-by: Andreas Grosse andig.mail@t-online.de Signed-off-by: José Expósito jose.exposito89@gmail.com Signed-off-by: Jiri Kosina jkosina@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 ++ drivers/hid/hid-uclogic-core.c | 3 +++ drivers/hid/hid-uclogic-params.c | 2 ++ 4 files changed, 8 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h index c662994d73381..2235d78784b1b 100644 --- a/drivers/hid/hid-ids.h +++ b/drivers/hid/hid-ids.h @@ -1299,6 +1299,7 @@ #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01 0x0042 #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2 0x0905 #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L 0x0935 +#define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW 0x0934 #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S 0x0909 #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW 0x0933 #define USB_DEVICE_ID_UGEE_XPPEN_TABLET_STAR06 0x0078 diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c index 0f8a5152e48b1..c3c7d0abb01ad 100644 --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -378,6 +378,8 @@ static const struct hid_device_id hid_battery_quirks[] = { HID_BATTERY_QUIRK_IGNORE }, { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L), HID_BATTERY_QUIRK_AVOID_QUERY }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW), + HID_BATTERY_QUIRK_AVOID_QUERY }, { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW), HID_BATTERY_QUIRK_AVOID_QUERY }, { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15), diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c index 7c05d38d3afad..bfbb51f8b5beb 100644 --- a/drivers/hid/hid-uclogic-core.c +++ b/drivers/hid/hid-uclogic-core.c @@ -511,6 +511,9 @@ static const struct hid_device_id uclogic_devices[] = { USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2) }, { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L) }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW), + .driver_data = UCLOGIC_MOUSE_FRAME_QUIRK | UCLOGIC_BATTERY_QUIRK }, { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S) }, { HID_USB_DEVICE(USB_VENDOR_ID_UGEE, diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c index 492a30f83575a..0cc03c11ecc22 100644 --- a/drivers/hid/hid-uclogic-params.c +++ b/drivers/hid/hid-uclogic-params.c @@ -1669,6 +1669,8 @@ int uclogic_params_init(struct uclogic_params *params, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO01_V2): case VID_PID(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_L): + case VID_PID(USB_VENDOR_ID_UGEE, + USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_MW): case VID_PID(USB_VENDOR_ID_UGEE, USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_S): case VID_PID(USB_VENDOR_ID_UGEE,
From: Jiasheng Jiang jiasheng@iscas.ac.cn
[ Upstream commit 115906ca7b535afb1fe7b5406c566ccd3873f82b ]
Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference.
Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Patchwork: https://patchwork.freedesktop.org/patch/517646/ Link: https://lore.kernel.org/r/20230110021651.12770-1-jiasheng@iscas.ac.cn Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c index 89aadd3b3202b..f167a45f1fbdd 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_host.c +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c @@ -1977,6 +1977,9 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi)
/* setup workqueue */ msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0); + if (!msm_host->workqueue) + return -ENOMEM; + INIT_WORK(&msm_host->err_work, dsi_err_worker);
msm_dsi->id = msm_host->id;
From: Tomi Valkeinen tomi.valkeinen+renesas@ideasonboard.com
[ Upstream commit 4f548bc48a2b4c4e54eecfddb6f7d24aa1b98768 ]
rcar_du_crtc.c does a soc_device_match() in rcar_du_crtc_set_display_timing() to find out if the SoC is H3 ES1.x, and if so, apply a workaround.
We will need another H3 ES1.x check in the following patch, so rather than adding more soc_device_match() calls, let's add a rcar_du_device_info entry for the ES1, and a quirk flag, RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY, for the workaround.
Signed-off-by: Tomi Valkeinen tomi.valkeinen+renesas@ideasonboard.com Reviewed-by: Laurent Pinchart laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 8 +---- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 ++++++++++++++++++++++++++ drivers/gpu/drm/rcar-du/rcar_du_drv.h | 1 + 3 files changed, 50 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c index 3619e1ddeb620..f2d3266509cc1 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c @@ -10,7 +10,6 @@ #include <linux/clk.h> #include <linux/mutex.h> #include <linux/platform_device.h> -#include <linux/sys_soc.h>
#include <drm/drm_atomic.h> #include <drm/drm_atomic_helper.h> @@ -204,11 +203,6 @@ static void rcar_du_escr_divider(struct clk *clk, unsigned long target, } }
-static const struct soc_device_attribute rcar_du_r8a7795_es1[] = { - { .soc_id = "r8a7795", .revision = "ES1.*" }, - { /* sentinel */ } -}; - static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) { const struct drm_display_mode *mode = &rcrtc->crtc.state->adjusted_mode; @@ -238,7 +232,7 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) * no post-divider when a display PLL is present (as shown by * the workaround breaking HDMI output on M3-W during testing). */ - if (soc_device_match(rcar_du_r8a7795_es1)) { + if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY) { target *= 2; div = 1; } diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c index d003e8d9e7a26..c479996f8e91e 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c @@ -16,6 +16,7 @@ #include <linux/platform_device.h> #include <linux/pm.h> #include <linux/slab.h> +#include <linux/sys_soc.h> #include <linux/wait.h>
#include <drm/drm_atomic_helper.h> @@ -386,6 +387,42 @@ static const struct rcar_du_device_info rcar_du_r8a7795_info = { .dpll_mask = BIT(2) | BIT(1), };
+static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = { + .gen = 3, + .features = RCAR_DU_FEATURE_CRTC_IRQ + | RCAR_DU_FEATURE_CRTC_CLOCK + | RCAR_DU_FEATURE_VSP1_SOURCE + | RCAR_DU_FEATURE_INTERLACED + | RCAR_DU_FEATURE_TVM_SYNC, + .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY, + .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0), + .routes = { + /* + * R8A7795 has one RGB output, two HDMI outputs and one + * LVDS output. + */ + [RCAR_DU_OUTPUT_DPAD0] = { + .possible_crtcs = BIT(3), + .port = 0, + }, + [RCAR_DU_OUTPUT_HDMI0] = { + .possible_crtcs = BIT(1), + .port = 1, + }, + [RCAR_DU_OUTPUT_HDMI1] = { + .possible_crtcs = BIT(2), + .port = 2, + }, + [RCAR_DU_OUTPUT_LVDS0] = { + .possible_crtcs = BIT(0), + .port = 3, + }, + }, + .num_lvds = 1, + .num_rpf = 5, + .dpll_mask = BIT(2) | BIT(1), +}; + static const struct rcar_du_device_info rcar_du_r8a7796_info = { .gen = 3, .features = RCAR_DU_FEATURE_CRTC_IRQ @@ -554,6 +591,11 @@ static const struct of_device_id rcar_du_of_table[] = {
MODULE_DEVICE_TABLE(of, rcar_du_of_table);
+static const struct soc_device_attribute rcar_du_soc_table[] = { + { .soc_id = "r8a7795", .revision = "ES1.*", .data = &rcar_du_r8a7795_es1_info }, + { /* sentinel */ } +}; + const char *rcar_du_output_name(enum rcar_du_output output) { static const char * const names[] = { @@ -645,6 +687,7 @@ static void rcar_du_shutdown(struct platform_device *pdev)
static int rcar_du_probe(struct platform_device *pdev) { + const struct soc_device_attribute *soc_attr; struct rcar_du_device *rcdu; unsigned int mask; int ret; @@ -659,8 +702,13 @@ static int rcar_du_probe(struct platform_device *pdev) return PTR_ERR(rcdu);
rcdu->dev = &pdev->dev; + rcdu->info = of_device_get_match_data(rcdu->dev);
+ soc_attr = soc_device_match(rcar_du_soc_table); + if (soc_attr) + rcdu->info = soc_attr->data; + platform_set_drvdata(pdev, rcdu);
/* I/O resources */ diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h index 5cfa2bb7ad93d..df87ccab146f4 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h +++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h @@ -34,6 +34,7 @@ struct rcar_du_device; #define RCAR_DU_FEATURE_NO_BLENDING BIT(5) /* PnMR.SPIM does not have ALP nor EOR bits */
#define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */ +#define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */
enum rcar_du_output { RCAR_DU_OUTPUT_DPAD0,
From: Tomi Valkeinen tomi.valkeinen+renesas@ideasonboard.com
[ Upstream commit 5fbc2f3b91d27e12b614947048764099570cbb55 ]
On H3 ES1.x two bits in DPLLCR are used to select the DU input dot clock source. These are bits 20 and 21 for DU2, and bits 22 and 23 for DU1. On non-ES1.x, only the higher bits are used (bits 21 and 23), and the lower bits are reserved and should be set to 0.
The current code always sets the lower bits, even on non-ES1.x.
For both DU1 and DU2, on all SoC versions, when writing zeroes to those bits the input clock is DCLKIN, and thus there's no difference between ES1.x and non-ES1.x.
For DU1, writing 0b10 to the bits (or only writing the higher bit) results in using PLL0 as the input clock, so in this case there's also no difference between ES1.x and non-ES1.x.
However, for DU2, writing 0b10 to the bits results in using PLL0 as the input clock on ES1.x, whereas on non-ES1.x it results in using PLL1. On ES1.x you need to write 0b11 to select PLL1.
The current code always writes 0b11 to PLCS0 field to select PLL1 on all SoC versions, which works but causes an illegal (in the sense of not allowed by the documentation) write to a reserved bit field.
To remove the illegal bit write on PLSC0 we need to handle the input dot clock selection differently for ES1.x and non-ES1.x.
Add a new quirk, RCAR_DU_QUIRK_H3_ES1_PLL, for this. This way we can always set the bit 21 on PLSC0 when choosing the PLL as the source clock, and additionally set the bit 20 when on ES1.x.
Signed-off-by: Tomi Valkeinen tomi.valkeinen+renesas@ideasonboard.com Reviewed-by: Laurent Pinchart laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Laurent Pinchart laurent.pinchart+renesas@ideasonboard.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 23 ++++++++++++++++++++--- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 3 ++- drivers/gpu/drm/rcar-du/rcar_du_drv.h | 1 + drivers/gpu/drm/rcar-du/rcar_du_regs.h | 8 ++------ 4 files changed, 25 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c index f2d3266509cc1..b7dd59fe119e6 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c @@ -245,13 +245,30 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) | DPLLCR_N(dpll.n) | DPLLCR_M(dpll.m) | DPLLCR_STBY;
- if (rcrtc->index == 1) + if (rcrtc->index == 1) { dpllcr |= DPLLCR_PLCS1 | DPLLCR_INCS_DOTCLKIN1; - else - dpllcr |= DPLLCR_PLCS0 + } else { + dpllcr |= DPLLCR_PLCS0_PLL | DPLLCR_INCS_DOTCLKIN0;
+ /* + * On ES2.x we have a single mux controlled via bit 21, + * which selects between DCLKIN source (bit 21 = 0) and + * a PLL source (bit 21 = 1), where the PLL is always + * PLL1. + * + * On ES1.x we have an additional mux, controlled + * via bit 20, for choosing between PLL0 (bit 20 = 0) + * and PLL1 (bit 20 = 1). We always want to use PLL1, + * so on ES1.x, in addition to setting bit 21, we need + * to set the bit 20. + */ + + if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PLL) + dpllcr |= DPLLCR_PLCS0_H3ES1X_PLL1; + } + rcar_du_group_write(rcrtc->group, DPLLCR, dpllcr);
escr = ESCR_DCLKSEL_DCLKIN | div; diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c index c479996f8e91e..53c9669a3851c 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c +++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c @@ -394,7 +394,8 @@ static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = { | RCAR_DU_FEATURE_VSP1_SOURCE | RCAR_DU_FEATURE_INTERLACED | RCAR_DU_FEATURE_TVM_SYNC, - .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY, + .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY + | RCAR_DU_QUIRK_H3_ES1_PLL, .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0), .routes = { /* diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h index df87ccab146f4..acc3673fefe18 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h +++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h @@ -35,6 +35,7 @@ struct rcar_du_device;
#define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */ #define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */ +#define RCAR_DU_QUIRK_H3_ES1_PLL BIT(2) /* H3 ES1 PLL setup differs from non-ES1 */
enum rcar_du_output { RCAR_DU_OUTPUT_DPAD0, diff --git a/drivers/gpu/drm/rcar-du/rcar_du_regs.h b/drivers/gpu/drm/rcar-du/rcar_du_regs.h index c1bcb0e8b5b4e..789ae9285108e 100644 --- a/drivers/gpu/drm/rcar-du/rcar_du_regs.h +++ b/drivers/gpu/drm/rcar-du/rcar_du_regs.h @@ -283,12 +283,8 @@ #define DPLLCR 0x20044 #define DPLLCR_CODE (0x95 << 24) #define DPLLCR_PLCS1 (1 << 23) -/* - * PLCS0 is bit 21, but H3 ES1.x requires bit 20 to be set as well. As bit 20 - * isn't implemented by other SoC in the Gen3 family it can safely be set - * unconditionally. - */ -#define DPLLCR_PLCS0 (3 << 20) +#define DPLLCR_PLCS0_PLL (1 << 21) +#define DPLLCR_PLCS0_H3ES1X_PLL1 (1 << 20) #define DPLLCR_CLKE (1 << 18) #define DPLLCR_FDPLL(n) ((n) << 12) #define DPLLCR_N(n) ((n) << 5)
From: Wayne Lin Wayne.Lin@amd.com
[ Upstream commit d987150b539271b0394f24c1c648d2846662adb4 ]
[why & how] __drm_dbg() parameter set format is wrong and not aligned with the format under CONFIG_DRM_USE_DYNAMIC_DEBUG is on. Fix it.
Signed-off-by: Wayne Lin Wayne.Lin@amd.com Signed-off-by: Harry Wentland harry.wentland@amd.com Acked-by: Harry Wentland harry.wentland@amd.com Reviewed-by: Lyude Paul lyude@redhat.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- include/drm/drm_print.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/drm/drm_print.h b/include/drm/drm_print.h index a44fb7ef257f6..094ded23534c7 100644 --- a/include/drm/drm_print.h +++ b/include/drm/drm_print.h @@ -521,7 +521,7 @@ __printf(1, 2) void __drm_err(const char *format, ...);
#if !defined(CONFIG_DRM_USE_DYNAMIC_DEBUG) -#define __drm_dbg(fmt, ...) ___drm_dbg(NULL, fmt, ##__VA_ARGS__) +#define __drm_dbg(cat, fmt, ...) ___drm_dbg(NULL, cat, fmt, ##__VA_ARGS__) #else #define __drm_dbg(cat, fmt, ...) \ _dynamic_func_call_cls(cat, fmt, ___drm_dbg, \
From: Roman Li roman.li@amd.com
[ Upstream commit 40e9f3f067bc6fb47b878f8ba0a9cc7b93abbf49 ]
[Why] After enabling S/G on dcn314 a screen corruption may be observed. HostVM flag should be set in S/G mode to be included in DML calculations.
[How] In S/G mode gpu_vm_support flag is set. Use its value to init is_hvm_enabled.
Reviewed-by: Nicholas Kazlauskas Nicholas.Kazlauskas@amd.com Acked-by: Alan Liu HaoPing.Liu@amd.com Signed-off-by: Roman Li roman.li@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 69f0ccc18aa82..027ffa5ccda46 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1239,7 +1239,7 @@ static void mmhub_read_system_context(struct amdgpu_device *adev, struct dc_phy_ pa_config->gart_config.page_table_end_addr = page_table_end.quad_part << 12; pa_config->gart_config.page_table_base_addr = page_table_base.quad_part;
- pa_config->is_hvm_enabled = 0; + pa_config->is_hvm_enabled = adev->mode_info.gpu_vm_support;
}
From: Thomas Zimmermann tzimmermann@suse.de
[ Upstream commit c2bb3be64eb7182285846123219230375af61abd ]
Test for connectors in the client code and remove a similar test from the generic fbdev emulation. Do nothing if the test fails. Not having connectors indicates a driver bug.
Signed-off-by: Thomas Zimmermann tzimmermann@suse.de Reviewed-by: Javier Martinez Canillas javierm@redhat.com Link: https://patchwork.freedesktop.org/patch/msgid/20230125200415.14123-2-tzimmer... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_client.c | 5 +++++ drivers/gpu/drm/drm_fbdev_generic.c | 5 ----- 2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c index 056ab9d5f313b..313cbabb12b2d 100644 --- a/drivers/gpu/drm/drm_client.c +++ b/drivers/gpu/drm/drm_client.c @@ -198,6 +198,11 @@ void drm_client_dev_hotplug(struct drm_device *dev) if (!drm_core_check_feature(dev, DRIVER_MODESET)) return;
+ if (!dev->mode_config.num_connector) { + drm_dbg_kms(dev, "No connectors found, will not send hotplug events!\n"); + return; + } + mutex_lock(&dev->clientlist_mutex); list_for_each_entry(client, &dev->clientlist, list) { if (!client->funcs || !client->funcs->hotplug) diff --git a/drivers/gpu/drm/drm_fbdev_generic.c b/drivers/gpu/drm/drm_fbdev_generic.c index 593aa3283792b..215fe16ff1fb4 100644 --- a/drivers/gpu/drm/drm_fbdev_generic.c +++ b/drivers/gpu/drm/drm_fbdev_generic.c @@ -390,11 +390,6 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client) if (dev->fb_helper) return drm_fb_helper_hotplug_event(dev->fb_helper);
- if (!dev->mode_config.num_connector) { - drm_dbg_kms(dev, "No connectors found, will not create framebuffer!\n"); - return 0; - } - drm_fb_helper_prepare(dev, fb_helper, &drm_fb_helper_generic_funcs);
ret = drm_fb_helper_init(dev, fb_helper);
From: Moti Haimovski mhaimovski@habana.ai
[ Upstream commit 2a0a839b6a28f7c4c528bb75b740c7f38ef79a37 ]
This commit attaches the PCI device address to driver fatal messages in order to ease debugging in multi-device setups.
Signed-off-by: Moti Haimovski mhaimovski@habana.ai Reviewed-by: Oded Gabbay ogabbay@kernel.org Signed-off-by: Oded Gabbay ogabbay@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/misc/habanalabs/common/device.c | 38 ++++++++++++++++--------- 1 file changed, 25 insertions(+), 13 deletions(-)
diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c index 87ab329e65d49..f7b9c3871518b 100644 --- a/drivers/misc/habanalabs/common/device.c +++ b/drivers/misc/habanalabs/common/device.c @@ -1566,7 +1566,8 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) if (rc == -EBUSY) { if (hdev->device_fini_pending) { dev_crit(hdev->dev, - "Failed to kill all open processes, stopping hard reset\n"); + "%s Failed to kill all open processes, stopping hard reset\n", + dev_name(&(hdev)->pdev->dev)); goto out_err; }
@@ -1576,7 +1577,8 @@ int hl_device_reset(struct hl_device *hdev, u32 flags)
if (rc) { dev_crit(hdev->dev, - "Failed to kill all open processes, stopping hard reset\n"); + "%s Failed to kill all open processes, stopping hard reset\n", + dev_name(&(hdev)->pdev->dev)); goto out_err; }
@@ -1627,14 +1629,16 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) * ensure driver puts the driver in a unusable state */ dev_crit(hdev->dev, - "Consecutive FW fatal errors received, stopping hard reset\n"); + "%s Consecutive FW fatal errors received, stopping hard reset\n", + dev_name(&(hdev)->pdev->dev)); rc = -EIO; goto out_err; }
if (hdev->kernel_ctx) { dev_crit(hdev->dev, - "kernel ctx was alive during hard reset, something is terribly wrong\n"); + "%s kernel ctx was alive during hard reset, something is terribly wrong\n", + dev_name(&(hdev)->pdev->dev)); rc = -EBUSY; goto out_err; } @@ -1752,9 +1756,13 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) hdev->reset_info.needs_reset = false;
if (hard_reset) - dev_info(hdev->dev, "Successfully finished resetting the device\n"); + dev_info(hdev->dev, + "Successfully finished resetting the %s device\n", + dev_name(&(hdev)->pdev->dev)); else - dev_dbg(hdev->dev, "Successfully finished resetting the device\n"); + dev_dbg(hdev->dev, + "Successfully finished resetting the %s device\n", + dev_name(&(hdev)->pdev->dev));
if (hard_reset) { hdev->reset_info.hard_reset_cnt++; @@ -1789,7 +1797,9 @@ int hl_device_reset(struct hl_device *hdev, u32 flags) hdev->reset_info.in_compute_reset = 0;
if (hard_reset) { - dev_err(hdev->dev, "Failed to reset! Device is NOT usable\n"); + dev_err(hdev->dev, + "%s Failed to reset! Device is NOT usable\n", + dev_name(&(hdev)->pdev->dev)); hdev->reset_info.hard_reset_cnt++; } else if (reset_upon_device_release) { spin_unlock(&hdev->reset_info.lock); @@ -2186,7 +2196,8 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass) }
dev_notice(hdev->dev, - "Successfully added device to habanalabs driver\n"); + "Successfully added device %s to habanalabs driver\n", + dev_name(&(hdev)->pdev->dev));
hdev->init_done = true;
@@ -2235,11 +2246,11 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass) device_cdev_sysfs_add(hdev); if (hdev->pdev) dev_err(&hdev->pdev->dev, - "Failed to initialize hl%d. Device is NOT usable !\n", - hdev->cdev_idx); + "Failed to initialize hl%d. Device %s is NOT usable !\n", + hdev->cdev_idx, dev_name(&(hdev)->pdev->dev)); else - pr_err("Failed to initialize hl%d. Device is NOT usable !\n", - hdev->cdev_idx); + pr_err("Failed to initialize hl%d. Device %s is NOT usable !\n", + hdev->cdev_idx, dev_name(&(hdev)->pdev->dev));
return rc; } @@ -2295,7 +2306,8 @@ void hl_device_fini(struct hl_device *hdev)
if (ktime_compare(ktime_get(), timeout) > 0) { dev_crit(hdev->dev, - "Failed to remove device because reset function did not finish\n"); + "%s Failed to remove device because reset function did not finish\n", + dev_name(&(hdev)->pdev->dev)); return; } }
From: farah kassabri fkassabri@habana.ai
[ Upstream commit ac5af9900f82b7034de7c9eb1d70d030ba325607 ]
Protect re-using the same timestamp buffer record before actually adding it to the to interrupt wait list. Mark ts buff offset as in use in the spinlock protection area of the interrupt wait list to avoid getting in the re-use section in ts_buff_get_kernel_ts_record before adding the node to the list. this scenario might happen when multiple threads are racing on same offset and one thread could set data in the ts buff in ts_buff_get_kernel_ts_record then the other thread takes over and get to ts_buff_get_kernel_ts_record and we will try to re-use the same ts buff offset then we will try to delete a non existing node from the list.
Signed-off-by: farah kassabri fkassabri@habana.ai Reviewed-by: Oded Gabbay ogabbay@kernel.org Signed-off-by: Oded Gabbay ogabbay@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../habanalabs/common/command_submission.c | 33 ++++++++++++------- 1 file changed, 22 insertions(+), 11 deletions(-)
diff --git a/drivers/misc/habanalabs/common/command_submission.c b/drivers/misc/habanalabs/common/command_submission.c index ea0e5101c10ed..6367cbea4ca2a 100644 --- a/drivers/misc/habanalabs/common/command_submission.c +++ b/drivers/misc/habanalabs/common/command_submission.c @@ -3119,19 +3119,18 @@ static int ts_buff_get_kernel_ts_record(struct hl_mmap_mem_buf *buf, goto start_over; } } else { + /* Fill up the new registration node info */ + requested_offset_record->ts_reg_info.buf = buf; + requested_offset_record->ts_reg_info.cq_cb = cq_cb; + requested_offset_record->ts_reg_info.timestamp_kernel_addr = + (u64 *) ts_buff->user_buff_address + ts_offset; + requested_offset_record->cq_kernel_addr = + (u64 *) cq_cb->kernel_address + cq_offset; + requested_offset_record->cq_target_value = target_value; + spin_unlock_irqrestore(wait_list_lock, flags); }
- /* Fill up the new registration node info */ - requested_offset_record->ts_reg_info.in_use = 1; - requested_offset_record->ts_reg_info.buf = buf; - requested_offset_record->ts_reg_info.cq_cb = cq_cb; - requested_offset_record->ts_reg_info.timestamp_kernel_addr = - (u64 *) ts_buff->user_buff_address + ts_offset; - requested_offset_record->cq_kernel_addr = - (u64 *) cq_cb->kernel_address + cq_offset; - requested_offset_record->cq_target_value = target_value; - *pend = requested_offset_record;
dev_dbg(buf->mmg->dev, "Found available node in TS kernel CB %p\n", @@ -3179,7 +3178,7 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx, goto put_cq_cb; }
- /* Find first available record */ + /* get ts buffer record */ rc = ts_buff_get_kernel_ts_record(buf, cq_cb, ts_offset, cq_counters_offset, target_value, &interrupt->wait_list_lock, &pend); @@ -3227,7 +3226,19 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx, * Note that we cannot have sorted list by target value, * in order to shorten the list pass loop, since * same list could have nodes for different cq counter handle. + * Note: + * Mark ts buff offset as in use here in the spinlock protection area + * to avoid getting in the re-use section in ts_buff_get_kernel_ts_record + * before adding the node to the list. this scenario might happen when + * multiple threads are racing on same offset and one thread could + * set the ts buff in ts_buff_get_kernel_ts_record then the other thread + * takes over and get to ts_buff_get_kernel_ts_record and then we will try + * to re-use the same ts buff offset, and will try to delete a non existing + * node from the list. */ + if (register_ts_record) + pend->ts_reg_info.in_use = 1; + list_add_tail(&pend->wait_list_node, &interrupt->wait_list_head); spin_unlock_irqrestore(&interrupt->wait_list_lock, flags);
From: Jakob Koschel jkl820.git@gmail.com
[ Upstream commit 6b219431037bf98c9efd49716aea9b68440477a3 ]
In order to debug the kernel successfully with gdb you need to run 'make scripts_gdb' nowadays.
This was changed with the following commit:
Commit 67274c083438340ad16c ("scripts/gdb: delay generation of gdb constants.py")
In order to have a complete guide for beginners this remark should be added to the offial documentation.
Signed-off-by: Jakob Koschel jkl820.git@gmail.com Link: https://lore.kernel.org/r/20230112-documentation-gdb-v2-1-292785c43dc9@gmail... Signed-off-by: Jonathan Corbet corbet@lwn.net Signed-off-by: Sasha Levin sashal@kernel.org --- Documentation/dev-tools/gdb-kernel-debugging.rst | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/Documentation/dev-tools/gdb-kernel-debugging.rst b/Documentation/dev-tools/gdb-kernel-debugging.rst index 8e0f1fe8d17ad..895285c037c72 100644 --- a/Documentation/dev-tools/gdb-kernel-debugging.rst +++ b/Documentation/dev-tools/gdb-kernel-debugging.rst @@ -39,6 +39,10 @@ Setup this mode. In this case, you should build the kernel with CONFIG_RANDOMIZE_BASE disabled if the architecture supports KASLR.
+- Build the gdb scripts (required on kernels v5.1 and above):: + + make scripts_gdb + - Enable the gdb stub of QEMU/KVM, either
- at VM startup time by appending "-s" to the QEMU command line
From: Marijn Suijten marijn.suijten@somainline.org
[ Upstream commit a7efe60e36b9c0e966d7f82ac90a89b591d984e9 ]
Add missing DSC hardware block register ranges to the snapshot utility to include them in dmesg (on MSM_DISP_SNAPSHOT_DUMP_IN_CONSOLE) and the kms debugfs file.
Signed-off-by: Marijn Suijten marijn.suijten@somainline.org Reviewed-by: Neil Armstrong neil.armstrong@linaro.org Reviewed-by: Abhinav Kumar quic_abhinavk@quicinc.com Patchwork: https://patchwork.freedesktop.org/patch/520175/ Link: https://lore.kernel.org/r/20230125101412.216924-1-marijn.suijten@somainline.... Signed-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c index b71199511a52d..09757166a064a 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c @@ -930,6 +930,11 @@ static void dpu_kms_mdp_snapshot(struct msm_disp_state *disp_state, struct msm_k msm_disp_snapshot_add_block(disp_state, cat->mdp[0].len, dpu_kms->mmio + cat->mdp[0].base, "top");
+ /* dump DSC sub-blocks HW regs info */ + for (i = 0; i < cat->dsc_count; i++) + msm_disp_snapshot_add_block(disp_state, cat->dsc[i].len, + dpu_kms->mmio + cat->dsc[i].base, "dsc_%d", i); + pm_runtime_put_sync(&dpu_kms->pdev->dev); }
From: 강신형 s47.kang@samsung.com
[ Upstream commit aa9ff6a4955fdba02b54fbc4386db876603703b7 ]
If panic_on_warn is set and compress stream(DPCM) is started, then kernel panic occurred because card->pcm_mutex isn't held appropriately. In the following functions, warning were issued at this line "snd_soc_dpcm_mutex_assert_held".
static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe, struct snd_soc_pcm_runtime *be, int stream) { ... snd_soc_dpcm_mutex_assert_held(fe); ... }
void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream) { ... snd_soc_dpcm_mutex_assert_held(fe); ... }
void snd_soc_runtime_action(struct snd_soc_pcm_runtime *rtd, int stream, int action) { ... snd_soc_dpcm_mutex_assert_held(rtd); ... }
int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir, int event) { ... snd_soc_dpcm_mutex_assert_held(fe); ... }
These functions are called by soc_compr_set_params_fe, soc_compr_open_fe and soc_compr_free_fe without pcm_mutex locking. And this is call stack.
[ 414.527841][ T2179] pc : dpcm_process_paths+0x5a4/0x750 [ 414.527848][ T2179] lr : dpcm_process_paths+0x37c/0x750 [ 414.527945][ T2179] Call trace: [ 414.527949][ T2179] dpcm_process_paths+0x5a4/0x750 [ 414.527955][ T2179] soc_compr_open_fe+0xb0/0x2cc [ 414.527972][ T2179] snd_compr_open+0x180/0x248 [ 414.527981][ T2179] snd_open+0x15c/0x194 [ 414.528003][ T2179] chrdev_open+0x1b0/0x220 [ 414.528023][ T2179] do_dentry_open+0x30c/0x594 [ 414.528045][ T2179] vfs_open+0x34/0x44 [ 414.528053][ T2179] path_openat+0x914/0xb08 [ 414.528062][ T2179] do_filp_open+0xc0/0x170 [ 414.528068][ T2179] do_sys_openat2+0x94/0x18c [ 414.528076][ T2179] __arm64_sys_openat+0x78/0xa4 [ 414.528084][ T2179] invoke_syscall+0x48/0x10c [ 414.528094][ T2179] el0_svc_common+0xbc/0x104 [ 414.528099][ T2179] do_el0_svc+0x34/0xd8 [ 414.528103][ T2179] el0_svc+0x34/0xc4 [ 414.528125][ T2179] el0t_64_sync_handler+0x8c/0xfc [ 414.528133][ T2179] el0t_64_sync+0x1a0/0x1a4 [ 414.528142][ T2179] Kernel panic - not syncing: panic_on_warn set ...
So, I reposition and add pcm_mutex to resolve lockdep error.
Signed-off-by: Shinhyung Kang s47.kang@samsung.com Link: https://lore.kernel.org/r/016401d90ac4%247b6848c0%247238da40%24@samsung.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/soc-compress.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c index cb0ed2fea893a..e7aa6f360cabe 100644 --- a/sound/soc/soc-compress.c +++ b/sound/soc/soc-compress.c @@ -149,6 +149,8 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream) if (ret < 0) goto be_err;
+ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); + /* calculate valid and active FE <-> BE dpcms */ dpcm_process_paths(fe, stream, &list, 1); fe->dpcm[stream].runtime = fe_substream->runtime; @@ -184,7 +186,6 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream) fe->dpcm[stream].state = SND_SOC_DPCM_STATE_OPEN; fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO;
- mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); snd_soc_runtime_activate(fe, stream); mutex_unlock(&fe->card->pcm_mutex);
@@ -215,7 +216,6 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream)
mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); snd_soc_runtime_deactivate(fe, stream); - mutex_unlock(&fe->card->pcm_mutex);
fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE;
@@ -234,6 +234,8 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream)
dpcm_be_disconnect(fe, stream);
+ mutex_unlock(&fe->card->pcm_mutex); + fe->dpcm[stream].runtime = NULL;
snd_soc_link_compr_shutdown(cstream, 0); @@ -409,8 +411,9 @@ static int soc_compr_set_params_fe(struct snd_compr_stream *cstream, ret = snd_soc_link_compr_set_params(cstream); if (ret < 0) goto out; - + mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); dpcm_dapm_stream_event(fe, stream, SND_SOC_DAPM_STREAM_START); + mutex_unlock(&fe->card->pcm_mutex); fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE;
out:
From: Kees Cook keescook@chromium.org
[ Upstream commit b3bcedc0402fcdc5c8624c433562d9d1882749d8 ]
Walking the dram->cs array was seen as accesses beyond the first array item by the compiler. Instead, use the array index directly. This allows for run-time bounds checking under CONFIG_UBSAN_BOUNDS as well. Seen with GCC 13 with -fstrict-flex-arrays:
../sound/soc/kirkwood/kirkwood-dma.c: In function 'kirkwood_dma_conf_mbus_windows.constprop': ../sound/soc/kirkwood/kirkwood-dma.c:90:24: warning: array subscript 0 is outside array bounds of 'const struct mbus_dram_window[0]' [-Warray-bounds=] 90 | if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) { | ~~^~~~~~
Cc: Liam Girdwood lgirdwood@gmail.com Cc: Mark Brown broonie@kernel.org Cc: Jaroslav Kysela perex@perex.cz Cc: Takashi Iwai tiwai@suse.com Cc: alsa-devel@alsa-project.org Signed-off-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/r/20230127224128.never.410-kees@kernel.org Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/kirkwood/kirkwood-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c index 700a18561a940..640cebd2983e2 100644 --- a/sound/soc/kirkwood/kirkwood-dma.c +++ b/sound/soc/kirkwood/kirkwood-dma.c @@ -86,7 +86,7 @@ kirkwood_dma_conf_mbus_windows(void __iomem *base, int win,
/* try to find matching cs for current dma address */ for (i = 0; i < dram->num_cs; i++) { - const struct mbus_dram_window *cs = dram->cs + i; + const struct mbus_dram_window *cs = &dram->cs[i]; if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) { writel(cs->base & 0xffff0000, base + KIRKWOOD_AUDIO_WIN_BASE_REG(win));
From: Kees Cook keescook@chromium.org
[ Upstream commit 4fd8bcec5fd7c0d586206fa2f42bd67b06cdaa7e ]
Explicitly bounds-check the id before accessing the opmode array. Seen with GCC 13:
../drivers/regulator/max77802-regulator.c: In function 'max77802_enable': ../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=] 217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ) | ~~~~~~~~~~~~~~~~^~~~ ../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode' 62 | unsigned int opmode[MAX77802_REG_MAX]; | ^~~~~~
Cc: Javier Martinez Canillas javier@dowhile0.org Cc: Liam Girdwood lgirdwood@gmail.com Cc: Mark Brown broonie@kernel.org Signed-off-by: Kees Cook keescook@chromium.org Acked-by: Javier Martinez Canillas javierm@redhat.com Link: https://lore.kernel.org/r/20230127225203.never.864-kees@kernel.org Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/regulator/max77802-regulator.c | 34 ++++++++++++++++++-------- 1 file changed, 24 insertions(+), 10 deletions(-)
diff --git a/drivers/regulator/max77802-regulator.c b/drivers/regulator/max77802-regulator.c index 21e0eb0f43f94..befe5f319819b 100644 --- a/drivers/regulator/max77802-regulator.c +++ b/drivers/regulator/max77802-regulator.c @@ -94,9 +94,11 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev) { unsigned int val = MAX77802_OFF_PWRREQ; struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); - int id = rdev_get_id(rdev); + unsigned int id = rdev_get_id(rdev); int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) + return -EINVAL; max77802->opmode[id] = val; return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg, rdev->desc->enable_mask, val << shift); @@ -110,7 +112,7 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev) static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) { struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); - int id = rdev_get_id(rdev); + unsigned int id = rdev_get_id(rdev); unsigned int val; int shift = max77802_get_opmode_shift(id);
@@ -127,6 +129,9 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) return -EINVAL; }
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) + return -EINVAL; + max77802->opmode[id] = val; return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg, rdev->desc->enable_mask, val << shift); @@ -135,8 +140,10 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) static unsigned max77802_get_mode(struct regulator_dev *rdev) { struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); - int id = rdev_get_id(rdev); + unsigned int id = rdev_get_id(rdev);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) + return -EINVAL; return max77802_map_mode(max77802->opmode[id]); }
@@ -160,10 +167,13 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev, unsigned int mode) { struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); - int id = rdev_get_id(rdev); + unsigned int id = rdev_get_id(rdev); unsigned int val; int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) + return -EINVAL; + /* * If the regulator has been disabled for suspend * then is invalid to try setting a suspend mode. @@ -209,9 +219,11 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev, static int max77802_enable(struct regulator_dev *rdev) { struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); - int id = rdev_get_id(rdev); + unsigned int id = rdev_get_id(rdev); int shift = max77802_get_opmode_shift(id);
+ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) + return -EINVAL; if (max77802->opmode[id] == MAX77802_OFF_PWRREQ) max77802->opmode[id] = MAX77802_OPMODE_NORMAL;
@@ -495,7 +507,7 @@ static int max77802_pmic_probe(struct platform_device *pdev)
for (i = 0; i < MAX77802_REG_MAX; i++) { struct regulator_dev *rdev; - int id = regulators[i].id; + unsigned int id = regulators[i].id; int shift = max77802_get_opmode_shift(id); int ret;
@@ -513,10 +525,12 @@ static int max77802_pmic_probe(struct platform_device *pdev) * the hardware reports OFF as the regulator operating mode. * Default to operating mode NORMAL in that case. */ - if (val == MAX77802_STATUS_OFF) - max77802->opmode[id] = MAX77802_OPMODE_NORMAL; - else - max77802->opmode[id] = val; + if (id < ARRAY_SIZE(max77802->opmode)) { + if (val == MAX77802_STATUS_OFF) + max77802->opmode[id] = MAX77802_OPMODE_NORMAL; + else + max77802->opmode[id] = val; + }
rdev = devm_regulator_register(&pdev->dev, ®ulators[i], &config);
From: Kees Cook keescook@chromium.org
[ Upstream commit e314e15a0b58f9d051c00b25951073bcdae61953 ]
The compiler has no way to know if "id" is within the array bounds of the regulators array. Add a check for this and a build-time check that the regulators and reg_voltage_map arrays are sized the same. Seen with GCC 13:
../drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe': ../drivers/regulator/s5m8767.c:936:35: warning: array subscript [0, 36] is outside array bounds of 'struct regulator_desc[37]' [-Warray-bounds=] 936 | regulators[id].vsel_reg = | ~~~~~~~~~~^~~~
Cc: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Cc: Liam Girdwood lgirdwood@gmail.com Cc: Mark Brown broonie@kernel.org Cc: linux-samsung-soc@vger.kernel.org Signed-off-by: Kees Cook keescook@chromium.org Reviewed-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Link: https://lore.kernel.org/r/20230128005358.never.313-kees@kernel.org Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/regulator/s5m8767.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c index 35269f9982105..754c6fcc6e642 100644 --- a/drivers/regulator/s5m8767.c +++ b/drivers/regulator/s5m8767.c @@ -923,10 +923,14 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
for (i = 0; i < pdata->num_regulators; i++) { const struct sec_voltage_desc *desc; - int id = pdata->regulators[i].id; + unsigned int id = pdata->regulators[i].id; int enable_reg, enable_val; struct regulator_dev *rdev;
+ BUILD_BUG_ON(ARRAY_SIZE(regulators) != ARRAY_SIZE(reg_voltage_map)); + if (WARN_ON_ONCE(id >= ARRAY_SIZE(regulators))) + continue; + desc = reg_voltage_map[id]; if (desc) { regulators[id].n_voltages =
From: Vitaly Prosyak vitaly.prosyak@amd.com
[ Upstream commit 39934d3ed5725c5e3570ed1b67f612f1ea60ce03 ]
This reverts commit fac53471d0ea9693d314aa2df08d62b2e7e3a0f8. The following change: move the drm_dev_unplug call after amdgpu_driver_unload_kms in amdgpu_pci_remove. The reason is the following: amdgpu_pci_remove calls drm_dev_unregister and it should be called first to ensure userspace can't access the device instance anymore. If we call drm_dev_unplug after amdgpu_driver_unload_kms then we observe IGT PCI software unplug test failure (kernel hung) for all ASICs. This is how this regression was found.
After this revert, the following commands do work not, but it would be fixed in the next commit: - sudo modprobe -r amdgpu - sudo modprobe amdgpu
Signed-off-by: Vitaly Prosyak vitaly.prosyak@amd.com Reviewed-by Alex Deucher alexander.deucher@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index fbf2f24169eb5..d8e79de839d65 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -4022,7 +4022,8 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)
amdgpu_gart_dummy_page_fini(adev);
- amdgpu_device_unmap_mmio(adev); + if (drm_dev_is_unplugged(adev_to_drm(adev))) + amdgpu_device_unmap_mmio(adev);
}
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c index 3fe277bc233f4..7f598977d6942 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c @@ -2236,6 +2236,8 @@ amdgpu_pci_remove(struct pci_dev *pdev) struct drm_device *dev = pci_get_drvdata(pdev); struct amdgpu_device *adev = drm_to_adev(dev);
+ drm_dev_unplug(dev); + if (adev->pm.rpm_mode != AMDGPU_RUNPM_NONE) { pm_runtime_get_sync(dev->dev); pm_runtime_forbid(dev->dev); @@ -2275,8 +2277,6 @@ amdgpu_pci_remove(struct pci_dev *pdev)
amdgpu_driver_unload_kms(dev);
- drm_dev_unplug(dev); - /* * Flush any in flight DMA operations from device. * Clear the Bus Master Enable bit and then wait on the PCIe Device
From: Vladimir Stempen vladimir.stempen@amd.com
[ Upstream commit 972243f973eb0821084e5833d5f7f4ed025f42da ]
[Why] Currently we set FCLK p-state change watermark calculated based on dummy p-state latency when UCLK p-state is not supported
[How] Calculate FCLK p-state change watermark based on on FCLK pstate change latency in case UCLK p-state is not supported
Reviewed-by: Nevenko Stupar Nevenko.Stupar@amd.com Acked-by: Alex Hung alex.hung@amd.com Signed-off-by: Vladimir Stempen vladimir.stempen@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c index f94abd124021e..8450f59c26186 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c @@ -2038,6 +2038,10 @@ void dcn32_calculate_wm_and_dlg_fpu(struct dc *dc, struct dc_state *context, */ context->bw_ctx.bw.dcn.watermarks.a = context->bw_ctx.bw.dcn.watermarks.c; context->bw_ctx.bw.dcn.watermarks.a.cstate_pstate.pstate_change_ns = 0; + /* Calculate FCLK p-state change watermark based on FCLK pstate change latency in case + * UCLK p-state is not supported, to avoid underflow in case FCLK pstate is supported + */ + context->bw_ctx.bw.dcn.watermarks.a.cstate_pstate.fclk_pstate_change_ns = get_fclk_watermark(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000; } else { /* Set A: * All clocks min.
From: Andreas Gruenbacher agruenba@redhat.com
[ Upstream commit b66f723bb552ad59c2acb5d45ea45c890f84498b ]
In gfs2_make_fs_rw(), make sure to call gfs2_consist() to report an inconsistency and mark the filesystem as withdrawn when gfs2_find_jhead() fails.
At the end of gfs2_make_fs_rw(), when we discover that the filesystem has been withdrawn, make sure we report an error. This also replaces the gfs2_withdrawn() check after gfs2_find_jhead().
Reported-by: Tetsuo Handa penguin-kernel@i-love.sakura.ne.jp Cc: syzbot+f51cb4b9afbd87ec06f2@syzkaller.appspotmail.com Signed-off-by: Andreas Gruenbacher agruenba@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/gfs2/super.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c index 999cc146d7083..a07cf31f58ec3 100644 --- a/fs/gfs2/super.c +++ b/fs/gfs2/super.c @@ -138,8 +138,10 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) return -EIO;
error = gfs2_find_jhead(sdp->sd_jdesc, &head, false); - if (error || gfs2_withdrawn(sdp)) + if (error) { + gfs2_consist(sdp); return error; + }
if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT)) { gfs2_consist(sdp); @@ -151,7 +153,9 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) gfs2_log_pointers_init(sdp, head.lh_blkno);
error = gfs2_quota_init(sdp); - if (!error && !gfs2_withdrawn(sdp)) + if (!error && gfs2_withdrawn(sdp)) + error = -EIO; + if (!error) set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); return error; }
From: Robin Murphy robin.murphy@arm.com
[ Upstream commit 6d03bbff456befeccdd4d663177c4d6c75d0c4ff ]
Coretemp's platform driver is unconventional. All the real work is done globally by the initcall and CPU hotplug notifiers, while the "driver" effectively just wraps an allocation and the registration of the hwmon interface in a long-winded round-trip through the driver core. The whole logic of dynamically creating and destroying platform devices to bring the interfaces up and down is error prone, since it assumes platform_device_add() will synchronously bind the driver and set drvdata before it returns, thus results in a NULL dereference if drivers_autoprobe is turned off for the platform bus. Furthermore, the unusual approach of doing that from within a CPU hotplug notifier, already commented in the code that it deadlocks suspend, also causes lockdep issues for other drivers or subsystems which may want to legitimately register a CPU hotplug notifier from a platform bus notifier.
All of these issues can be solved by ripping this unusual behaviour out completely, simply tying the platform devices to the lifetime of the module itself, and directly managing the hwmon interfaces from the hotplug notifiers. There is a slight user-visible change in that /sys/bus/platform/drivers/coretemp will no longer appear, and /sys/devices/platform/coretemp.n will remain present if package n is hotplugged off, but hwmon users should really only be looking for the presence of the hwmon interfaces, whose behaviour remains unchanged.
Link: https://lore.kernel.org/lkml/20220922101036.87457-1-janusz.krzysztofik@linux... Link: https://gitlab.freedesktop.org/drm/intel/issues/6641 Signed-off-by: Robin Murphy robin.murphy@arm.com Signed-off-by: Janusz Krzysztofik janusz.krzysztofik@linux.intel.com Link: https://lore.kernel.org/r/20230103114620.15319-1-janusz.krzysztofik@linux.in... Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwmon/coretemp.c | 128 ++++++++++++++++++--------------------- 1 file changed, 58 insertions(+), 70 deletions(-)
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c index ca7a9b373bbd6..3e440ebe2508c 100644 --- a/drivers/hwmon/coretemp.c +++ b/drivers/hwmon/coretemp.c @@ -588,66 +588,49 @@ static void coretemp_remove_core(struct platform_data *pdata, int indx) ida_free(&pdata->ida, indx - BASE_SYSFS_ATTR_NO); }
-static int coretemp_probe(struct platform_device *pdev) +static int coretemp_device_add(int zoneid) { - struct device *dev = &pdev->dev; + struct platform_device *pdev; struct platform_data *pdata; + int err;
/* Initialize the per-zone data structures */ - pdata = devm_kzalloc(dev, sizeof(struct platform_data), GFP_KERNEL); + pdata = kzalloc(sizeof(*pdata), GFP_KERNEL); if (!pdata) return -ENOMEM;
- pdata->pkg_id = pdev->id; + pdata->pkg_id = zoneid; ida_init(&pdata->ida); - platform_set_drvdata(pdev, pdata);
- pdata->hwmon_dev = devm_hwmon_device_register_with_groups(dev, DRVNAME, - pdata, NULL); - return PTR_ERR_OR_ZERO(pdata->hwmon_dev); -} - -static int coretemp_remove(struct platform_device *pdev) -{ - struct platform_data *pdata = platform_get_drvdata(pdev); - int i; + pdev = platform_device_alloc(DRVNAME, zoneid); + if (!pdev) { + err = -ENOMEM; + goto err_free_pdata; + }
- for (i = MAX_CORE_DATA - 1; i >= 0; --i) - if (pdata->core_data[i]) - coretemp_remove_core(pdata, i); + err = platform_device_add(pdev); + if (err) + goto err_put_dev;
- ida_destroy(&pdata->ida); + platform_set_drvdata(pdev, pdata); + zone_devices[zoneid] = pdev; return 0; -}
-static struct platform_driver coretemp_driver = { - .driver = { - .name = DRVNAME, - }, - .probe = coretemp_probe, - .remove = coretemp_remove, -}; +err_put_dev: + platform_device_put(pdev); +err_free_pdata: + kfree(pdata); + return err; +}
-static struct platform_device *coretemp_device_add(unsigned int cpu) +static void coretemp_device_remove(int zoneid) { - int err, zoneid = topology_logical_die_id(cpu); - struct platform_device *pdev; - - if (zoneid < 0) - return ERR_PTR(-ENOMEM); - - pdev = platform_device_alloc(DRVNAME, zoneid); - if (!pdev) - return ERR_PTR(-ENOMEM); - - err = platform_device_add(pdev); - if (err) { - platform_device_put(pdev); - return ERR_PTR(err); - } + struct platform_device *pdev = zone_devices[zoneid]; + struct platform_data *pdata = platform_get_drvdata(pdev);
- zone_devices[zoneid] = pdev; - return pdev; + ida_destroy(&pdata->ida); + kfree(pdata); + platform_device_unregister(pdev); }
static int coretemp_cpu_online(unsigned int cpu) @@ -671,7 +654,10 @@ static int coretemp_cpu_online(unsigned int cpu) if (!cpu_has(c, X86_FEATURE_DTHERM)) return -ENODEV;
- if (!pdev) { + pdata = platform_get_drvdata(pdev); + if (!pdata->hwmon_dev) { + struct device *hwmon; + /* Check the microcode version of the CPU */ if (chk_ucode_version(cpu)) return -EINVAL; @@ -682,9 +668,11 @@ static int coretemp_cpu_online(unsigned int cpu) * online. So, initialize per-pkg data structures and * then bring this core online. */ - pdev = coretemp_device_add(cpu); - if (IS_ERR(pdev)) - return PTR_ERR(pdev); + hwmon = hwmon_device_register_with_groups(&pdev->dev, DRVNAME, + pdata, NULL); + if (IS_ERR(hwmon)) + return PTR_ERR(hwmon); + pdata->hwmon_dev = hwmon;
/* * Check whether pkgtemp support is available. @@ -694,7 +682,6 @@ static int coretemp_cpu_online(unsigned int cpu) coretemp_add_core(pdev, cpu, 1); }
- pdata = platform_get_drvdata(pdev); /* * Check whether a thread sibling is already online. If not add the * interface for this CPU core. @@ -713,18 +700,14 @@ static int coretemp_cpu_offline(unsigned int cpu) struct temp_data *tdata; int i, indx = -1, target;
- /* - * Don't execute this on suspend as the device remove locks - * up the machine. - */ + /* No need to tear down any interfaces for suspend */ if (cpuhp_tasks_frozen) return 0;
/* If the physical CPU device does not exist, just return */ - if (!pdev) - return 0; - pd = platform_get_drvdata(pdev); + if (!pd->hwmon_dev) + return 0;
for (i = 0; i < NUM_REAL_CORES; i++) { if (pd->cpu_map[i] == topology_core_id(cpu)) { @@ -756,13 +739,14 @@ static int coretemp_cpu_offline(unsigned int cpu) }
/* - * If all cores in this pkg are offline, remove the device. This - * will invoke the platform driver remove function, which cleans up - * the rest. + * If all cores in this pkg are offline, remove the interface. */ + tdata = pd->core_data[PKG_SYSFS_ATTR_NO]; if (cpumask_empty(&pd->cpumask)) { - zone_devices[topology_logical_die_id(cpu)] = NULL; - platform_device_unregister(pdev); + if (tdata) + coretemp_remove_core(pd, PKG_SYSFS_ATTR_NO); + hwmon_device_unregister(pd->hwmon_dev); + pd->hwmon_dev = NULL; return 0; }
@@ -770,7 +754,6 @@ static int coretemp_cpu_offline(unsigned int cpu) * Check whether this core is the target for the package * interface. We need to assign it to some other cpu. */ - tdata = pd->core_data[PKG_SYSFS_ATTR_NO]; if (tdata && tdata->cpu == cpu) { target = cpumask_first(&pd->cpumask); mutex_lock(&tdata->update_lock); @@ -789,7 +772,7 @@ static enum cpuhp_state coretemp_hp_online;
static int __init coretemp_init(void) { - int err; + int i, err;
/* * CPUID.06H.EAX[0] indicates whether the CPU has thermal @@ -805,20 +788,22 @@ static int __init coretemp_init(void) if (!zone_devices) return -ENOMEM;
- err = platform_driver_register(&coretemp_driver); - if (err) - goto outzone; + for (i = 0; i < max_zones; i++) { + err = coretemp_device_add(i); + if (err) + goto outzone; + }
err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/coretemp:online", coretemp_cpu_online, coretemp_cpu_offline); if (err < 0) - goto outdrv; + goto outzone; coretemp_hp_online = err; return 0;
-outdrv: - platform_driver_unregister(&coretemp_driver); outzone: + while (i--) + coretemp_device_remove(i); kfree(zone_devices); return err; } @@ -826,8 +811,11 @@ module_init(coretemp_init)
static void __exit coretemp_exit(void) { + int i; + cpuhp_remove_state(coretemp_hp_online); - platform_driver_unregister(&coretemp_driver); + for (i = 0; i < max_zones; i++) + coretemp_device_remove(i); kfree(zone_devices); } module_exit(coretemp_exit)
From: Denis Pauk pauk.denis@gmail.com
[ Upstream commit c3b3747d02f571da2543e719066a50dd966989d8 ]
New ASUS B650/B660/X670 boards firmware have not exposed WMI monitoring GUID and entrypoint method WMBD could be implemented for different device UID.
Implement the direct call to entrypoint method for monitoring the device UID of B550/X570 boards.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk pauk.denis@gmail.com Co-developed-by: Ahmad Khalifa ahmad@khalifa.ws Signed-off-by: Ahmad Khalifa ahmad@khalifa.ws Link: https://lore.kernel.org/r/20230111212241.7456-1-pauk.denis@gmail.com [groeck: Fix multi-line formatting] Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/nct6775-platform.c | 98 ++++++++++++++++++++++---------- 2 files changed, 70 insertions(+), 30 deletions(-)
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig index 3176c33af6c69..300ce8115ce4f 100644 --- a/drivers/hwmon/Kconfig +++ b/drivers/hwmon/Kconfig @@ -1516,7 +1516,7 @@ config SENSORS_NCT6775_CORE config SENSORS_NCT6775 tristate "Platform driver for Nuvoton NCT6775F and compatibles" depends on !PPC - depends on ACPI_WMI || ACPI_WMI=n + depends on ACPI || ACPI=n select HWMON_VID select SENSORS_NCT6775_CORE help diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c index bf43f73dc835f..e5d4a79cd5f7d 100644 --- a/drivers/hwmon/nct6775-platform.c +++ b/drivers/hwmon/nct6775-platform.c @@ -17,7 +17,6 @@ #include <linux/module.h> #include <linux/platform_device.h> #include <linux/regmap.h> -#include <linux/wmi.h>
#include "nct6775.h"
@@ -107,40 +106,50 @@ struct nct6775_sio_data { void (*sio_exit)(struct nct6775_sio_data *sio_data); };
-#define ASUSWMI_MONITORING_GUID "466747A0-70EC-11DE-8A39-0800200C9A66" +#define ASUSWMI_METHOD "WMBD" #define ASUSWMI_METHODID_RSIO 0x5253494F #define ASUSWMI_METHODID_WSIO 0x5753494F #define ASUSWMI_METHODID_RHWM 0x5248574D #define ASUSWMI_METHODID_WHWM 0x5748574D #define ASUSWMI_UNSUPPORTED_METHOD 0xFFFFFFFE +#define ASUSWMI_DEVICE_HID "PNP0C14" +#define ASUSWMI_DEVICE_UID "ASUSWMI" + +#if IS_ENABLED(CONFIG_ACPI) +/* + * ASUS boards have only one device with WMI "WMBD" method and have provided + * access to only one SuperIO chip at 0x0290. + */ +static struct acpi_device *asus_acpi_dev; +#endif
static int nct6775_asuswmi_evaluate_method(u32 method_id, u8 bank, u8 reg, u8 val, u32 *retval) { -#if IS_ENABLED(CONFIG_ACPI_WMI) +#if IS_ENABLED(CONFIG_ACPI) + acpi_handle handle = acpi_device_handle(asus_acpi_dev); u32 args = bank | (reg << 8) | (val << 16); - struct acpi_buffer input = { (acpi_size) sizeof(args), &args }; - struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; + struct acpi_object_list input; + union acpi_object params[3]; + unsigned long long result; acpi_status status; - union acpi_object *obj; - u32 tmp = ASUSWMI_UNSUPPORTED_METHOD; - - status = wmi_evaluate_method(ASUSWMI_MONITORING_GUID, 0, - method_id, &input, &output);
+ params[0].type = ACPI_TYPE_INTEGER; + params[0].integer.value = 0; + params[1].type = ACPI_TYPE_INTEGER; + params[1].integer.value = method_id; + params[2].type = ACPI_TYPE_BUFFER; + params[2].buffer.length = sizeof(args); + params[2].buffer.pointer = (void *)&args; + input.count = 3; + input.pointer = params; + + status = acpi_evaluate_integer(handle, ASUSWMI_METHOD, &input, &result); if (ACPI_FAILURE(status)) return -EIO;
- obj = output.pointer; - if (obj && obj->type == ACPI_TYPE_INTEGER) - tmp = obj->integer.value; - if (retval) - *retval = tmp; + *retval = (u32)result & 0xFFFFFFFF;
- kfree(obj); - - if (tmp == ASUSWMI_UNSUPPORTED_METHOD) - return -ENODEV; return 0; #else return -EOPNOTSUPP; @@ -1099,6 +1108,45 @@ static const char * const asus_wmi_boards[] = { "TUF GAMING Z490-PLUS (WI-FI)", };
+#if IS_ENABLED(CONFIG_ACPI) +/* + * Callback for acpi_bus_for_each_dev() to find the right device + * by _UID and _HID and return 1 to stop iteration. + */ +static int nct6775_asuswmi_device_match(struct device *dev, void *data) +{ + struct acpi_device *adev = to_acpi_device(dev); + const char *uid = acpi_device_uid(adev); + const char *hid = acpi_device_hid(adev); + + if (hid && !strcmp(hid, ASUSWMI_DEVICE_HID) && uid && !strcmp(uid, data)) { + asus_acpi_dev = adev; + return 1; + } + + return 0; +} +#endif + +static enum sensor_access nct6775_determine_access(const char *device_uid) +{ +#if IS_ENABLED(CONFIG_ACPI) + u8 tmp; + + acpi_bus_for_each_dev(nct6775_asuswmi_device_match, (void *)device_uid); + if (!asus_acpi_dev) + return access_direct; + + /* if reading chip id via ACPI succeeds, use WMI "WMBD" method for access */ + if (!nct6775_asuswmi_read(0, NCT6775_PORT_CHIPID, &tmp) && tmp) { + pr_debug("Using Asus WMBD method of %s to access %#x chip.\n", device_uid, tmp); + return access_asuswmi; + } +#endif + + return access_direct; +} + static int __init sensors_nct6775_platform_init(void) { int i, err; @@ -1109,7 +1157,6 @@ static int __init sensors_nct6775_platform_init(void) int sioaddr[2] = { 0x2e, 0x4e }; enum sensor_access access = access_direct; const char *board_vendor, *board_name; - u8 tmp;
err = platform_driver_register(&nct6775_driver); if (err) @@ -1122,15 +1169,8 @@ static int __init sensors_nct6775_platform_init(void) !strcmp(board_vendor, "ASUSTeK COMPUTER INC.")) { err = match_string(asus_wmi_boards, ARRAY_SIZE(asus_wmi_boards), board_name); - if (err >= 0) { - /* if reading chip id via WMI succeeds, use WMI */ - if (!nct6775_asuswmi_read(0, NCT6775_PORT_CHIPID, &tmp) && tmp) { - pr_info("Using Asus WMI to access %#x chip.\n", tmp); - access = access_asuswmi; - } else { - pr_err("Can't read ChipID by Asus WMI.\n"); - } - } + if (err >= 0) + access = nct6775_determine_access(ASUSWMI_DEVICE_UID); }
/*
From: Denis Pauk pauk.denis@gmail.com
[ Upstream commit e2e09989ccc21ad428d6393450add78584b143bd ]
Boards such as: "EX-B660M-V5 PRO D4", "PRIME B650-PLUS", "PRIME B650M-A", "PRIME B650M-A AX", "PRIME B650M-A II", "PRIME B650M-A WIFI", "PRIME B650M-A WIFI II", "PRIME B660M-A D4", "PRIME B660M-A WIFI D4", "PRIME X670-P", "PRIME X670-P WIFI", "PRIME X670E-PRO WIFI", "Pro B660M-C-D4", "ProArt B660-CREATOR D4", "ProArt X670E-CREATOR WIFI", "ROG CROSSHAIR X670E EXTREME", "ROG CROSSHAIR X670E GENE", "ROG CROSSHAIR X670E HERO", "ROG MAXIMUS XIII EXTREME GLACIAL", "ROG MAXIMUS Z690 EXTREME", "ROG MAXIMUS Z690 EXTREME GLACIAL", "ROG STRIX B650-A GAMING WIFI", "ROG STRIX B650E-E GAMING WIFI", "ROG STRIX B650E-F GAMING WIFI", "ROG STRIX B650E-I GAMING WIFI", "ROG STRIX B660-A GAMING WIFI D4", "ROG STRIX B660-F GAMING WIFI", "ROG STRIX B660-G GAMING WIFI", "ROG STRIX B660-I GAMING WIFI", "ROG STRIX X670E-A GAMING WIFI", "ROG STRIX X670E-E GAMING WIFI", "ROG STRIX X670E-F GAMING WIFI", "ROG STRIX X670E-I GAMING WIFI", "ROG STRIX Z590-A GAMING WIFI II", "ROG STRIX Z690-A GAMING WIFI D4", "TUF GAMING B650-PLUS", "TUF GAMING B650-PLUS WIFI", "TUF GAMING B650M-PLUS", "TUF GAMING B650M-PLUS WIFI", "TUF GAMING B660M-PLUS WIFI", "TUF GAMING X670E-PLUS", "TUF GAMING X670E-PLUS WIFI", "TUF GAMING Z590-PLUS WIFI", have got a NCT6799D chip, but by default there's no use of it because of resource conflict with WMI method.
This commit adds such boards to the monitoring list with new ACPI device UID.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204807 Signed-off-by: Denis Pauk pauk.denis@gmail.com Co-developed-by: Ahmad Khalifa ahmad@khalifa.ws Signed-off-by: Ahmad Khalifa ahmad@khalifa.ws Tested-by: Jeroen Beerstra jeroen@beerstra.org Tested-by: Slawomir Stepien sst@poczta.fm Link: https://lore.kernel.org/r/20230111212241.7456-2-pauk.denis@gmail.com Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hwmon/nct6775-platform.c | 52 ++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+)
diff --git a/drivers/hwmon/nct6775-platform.c b/drivers/hwmon/nct6775-platform.c index e5d4a79cd5f7d..76c6b564d7fc4 100644 --- a/drivers/hwmon/nct6775-platform.c +++ b/drivers/hwmon/nct6775-platform.c @@ -114,6 +114,7 @@ struct nct6775_sio_data { #define ASUSWMI_UNSUPPORTED_METHOD 0xFFFFFFFE #define ASUSWMI_DEVICE_HID "PNP0C14" #define ASUSWMI_DEVICE_UID "ASUSWMI" +#define ASUSMSI_DEVICE_UID "AsusMbSwInterface"
#if IS_ENABLED(CONFIG_ACPI) /* @@ -1108,6 +1109,52 @@ static const char * const asus_wmi_boards[] = { "TUF GAMING Z490-PLUS (WI-FI)", };
+static const char * const asus_msi_boards[] = { + "EX-B660M-V5 PRO D4", + "PRIME B650-PLUS", + "PRIME B650M-A", + "PRIME B650M-A AX", + "PRIME B650M-A II", + "PRIME B650M-A WIFI", + "PRIME B650M-A WIFI II", + "PRIME B660M-A D4", + "PRIME B660M-A WIFI D4", + "PRIME X670-P", + "PRIME X670-P WIFI", + "PRIME X670E-PRO WIFI", + "Pro B660M-C-D4", + "ProArt B660-CREATOR D4", + "ProArt X670E-CREATOR WIFI", + "ROG CROSSHAIR X670E EXTREME", + "ROG CROSSHAIR X670E GENE", + "ROG CROSSHAIR X670E HERO", + "ROG MAXIMUS XIII EXTREME GLACIAL", + "ROG MAXIMUS Z690 EXTREME", + "ROG MAXIMUS Z690 EXTREME GLACIAL", + "ROG STRIX B650-A GAMING WIFI", + "ROG STRIX B650E-E GAMING WIFI", + "ROG STRIX B650E-F GAMING WIFI", + "ROG STRIX B650E-I GAMING WIFI", + "ROG STRIX B660-A GAMING WIFI D4", + "ROG STRIX B660-F GAMING WIFI", + "ROG STRIX B660-G GAMING WIFI", + "ROG STRIX B660-I GAMING WIFI", + "ROG STRIX X670E-A GAMING WIFI", + "ROG STRIX X670E-E GAMING WIFI", + "ROG STRIX X670E-F GAMING WIFI", + "ROG STRIX X670E-I GAMING WIFI", + "ROG STRIX Z590-A GAMING WIFI II", + "ROG STRIX Z690-A GAMING WIFI D4", + "TUF GAMING B650-PLUS", + "TUF GAMING B650-PLUS WIFI", + "TUF GAMING B650M-PLUS", + "TUF GAMING B650M-PLUS WIFI", + "TUF GAMING B660M-PLUS WIFI", + "TUF GAMING X670E-PLUS", + "TUF GAMING X670E-PLUS WIFI", + "TUF GAMING Z590-PLUS WIFI", +}; + #if IS_ENABLED(CONFIG_ACPI) /* * Callback for acpi_bus_for_each_dev() to find the right device @@ -1171,6 +1218,11 @@ static int __init sensors_nct6775_platform_init(void) board_name); if (err >= 0) access = nct6775_determine_access(ASUSWMI_DEVICE_UID); + + err = match_string(asus_msi_boards, ARRAY_SIZE(asus_msi_boards), + board_name); + if (err >= 0) + access = nct6775_determine_access(ASUSMSI_DEVICE_UID); }
/*
From: Claudiu Beznea claudiu.beznea@microchip.com
[ Upstream commit 1c4e5c470a56f7f7c649c0c70e603abc1eab15c4 ]
Use devm_kasprintf() instead of kasprintf() to avoid any potential leaks. At the moment drivers have no remove functionality thus there is no need for fixes tag.
Signed-off-by: Claudiu Beznea claudiu.beznea@microchip.com Link: https://lore.kernel.org/r/20230203132714.1931596-1-claudiu.beznea@microchip.... Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pinctrl/pinctrl-at91-pio4.c | 4 ++-- drivers/pinctrl/pinctrl-at91.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c index 39b233f73e132..373eed8bc4be9 100644 --- a/drivers/pinctrl/pinctrl-at91-pio4.c +++ b/drivers/pinctrl/pinctrl-at91-pio4.c @@ -1149,8 +1149,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
pin_desc[i].number = i; /* Pin naming convention: P(bank_name)(bank_pin_number). */ - pin_desc[i].name = kasprintf(GFP_KERNEL, "P%c%d", - bank + 'A', line); + pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d", + bank + 'A', line);
group->name = group_names[i] = pin_desc[i].name; group->pin = pin_desc[i].number; diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c index 1e1813d7c5508..c405296e49896 100644 --- a/drivers/pinctrl/pinctrl-at91.c +++ b/drivers/pinctrl/pinctrl-at91.c @@ -1885,7 +1885,7 @@ static int at91_gpio_probe(struct platform_device *pdev) }
for (i = 0; i < chip->ngpio; i++) - names[i] = kasprintf(GFP_KERNEL, "pio%c%d", alias_idx + 'A', i); + names[i] = devm_kasprintf(&pdev->dev, GFP_KERNEL, "pio%c%d", alias_idx + 'A', i);
chip->names = (const char *const *)names;
From: Wesley Chalmers Wesley.Chalmers@amd.com
[ Upstream commit 8f0d304d21b351d65e8c434c5399a40231876ba1 ]
[WHY] DRR and Pipe cannot be updated on the same frame, or else underflow will occur.
Reviewed-by: Jun Lei Jun.Lei@amd.com Acked-by: Qingqing Zhuo qingqing.zhuo@amd.com Signed-off-by: Wesley Chalmers Wesley.Chalmers@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/core/dc.c | 15 +++++++++++++++ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h | 3 ++- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c | 9 +++++++++ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h | 2 ++ .../drm/amd/display/dc/inc/hw/timing_generator.h | 1 + 5 files changed, 29 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index c03e86e49fea3..698ef50e83f3f 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -3335,6 +3335,21 @@ static void commit_planes_for_stream(struct dc *dc,
dc_z10_restore(dc);
+ if (update_type == UPDATE_TYPE_FULL) { + /* wait for all double-buffer activity to clear on all pipes */ + int pipe_idx; + + for (pipe_idx = 0; pipe_idx < dc->res_pool->pipe_count; pipe_idx++) { + struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[pipe_idx]; + + if (!pipe_ctx->stream) + continue; + + if (pipe_ctx->stream_res.tg->funcs->wait_drr_doublebuffer_pending_clear) + pipe_ctx->stream_res.tg->funcs->wait_drr_doublebuffer_pending_clear(pipe_ctx->stream_res.tg); + } + } + if (get_seamless_boot_stream_count(context) > 0 && surface_count > 0) { /* Optimize seamless boot flag keeps clocks and watermarks high until * first flip. After first flip, optimization is required to lower diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h index 88ac5f6f4c96c..0b37bb0e184b2 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h @@ -519,7 +519,8 @@ struct dcn_optc_registers { type OTG_CRC_DATA_STREAM_COMBINE_MODE;\ type OTG_CRC_DATA_STREAM_SPLIT_MODE;\ type OTG_CRC_DATA_FORMAT;\ - type OTG_V_TOTAL_LAST_USED_BY_DRR; + type OTG_V_TOTAL_LAST_USED_BY_DRR;\ + type OTG_DRR_TIMING_DBUF_UPDATE_PENDING;
#define TG_REG_FIELD_LIST_DCN3_2(type) \ type OTG_H_TIMING_DIV_MODE_MANUAL; diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c index 867d60151aebb..08b92715e2e64 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c @@ -291,6 +291,14 @@ static void optc3_set_timing_double_buffer(struct timing_generator *optc, bool e OTG_DRR_TIMING_DBUF_UPDATE_MODE, mode); }
+void optc3_wait_drr_doublebuffer_pending_clear(struct timing_generator *optc) +{ + struct optc *optc1 = DCN10TG_FROM_TG(optc); + + REG_WAIT(OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, 0, 2, 100000); /* 1 vupdate at 5hz */ + +} + void optc3_set_vtotal_min_max(struct timing_generator *optc, int vtotal_min, int vtotal_max) { optc1_set_vtotal_min_max(optc, vtotal_min, vtotal_max); @@ -360,6 +368,7 @@ static struct timing_generator_funcs dcn30_tg_funcs = { .program_manual_trigger = optc2_program_manual_trigger, .setup_manual_trigger = optc2_setup_manual_trigger, .get_hw_timing = optc1_get_hw_timing, + .wait_drr_doublebuffer_pending_clear = optc3_wait_drr_doublebuffer_pending_clear, };
void dcn30_timing_generator_init(struct optc *optc1) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h index dd45a5499b078..fb06dc9a48937 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.h @@ -279,6 +279,7 @@ SF(OTG0_OTG_DRR_TRIGGER_WINDOW, OTG_DRR_TRIGGER_WINDOW_END_X, mask_sh),\ SF(OTG0_OTG_DRR_V_TOTAL_CHANGE, OTG_DRR_V_TOTAL_CHANGE_LIMIT, mask_sh),\ SF(OTG0_OTG_H_TIMING_CNTL, OTG_H_TIMING_DIV_BY2, mask_sh),\ + SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, mask_sh),\ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_MODE, mask_sh),\ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_BLANK_DATA_DOUBLE_BUFFER_EN, mask_sh)
@@ -317,6 +318,7 @@ SF(OTG0_OTG_DRR_TRIGGER_WINDOW, OTG_DRR_TRIGGER_WINDOW_END_X, mask_sh),\ SF(OTG0_OTG_DRR_V_TOTAL_CHANGE, OTG_DRR_V_TOTAL_CHANGE_LIMIT, mask_sh),\ SF(OTG0_OTG_H_TIMING_CNTL, OTG_H_TIMING_DIV_MODE, mask_sh),\ + SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_PENDING, mask_sh),\ SF(OTG0_OTG_DOUBLE_BUFFER_CONTROL, OTG_DRR_TIMING_DBUF_UPDATE_MODE, mask_sh)
void dcn30_timing_generator_init(struct optc *optc1); diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h index 0e42e721dd15a..1d9f9c53d2bd6 100644 --- a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h +++ b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h @@ -331,6 +331,7 @@ struct timing_generator_funcs { uint32_t vtotal_change_limit);
void (*init_odm)(struct timing_generator *tg); + void (*wait_drr_doublebuffer_pending_clear)(struct timing_generator *tg); };
#endif
From: Greg Kroah-Hartman gregkh@linuxfoundation.org
[ Upstream commit ad0e4e2fab928477f74d742e6e77d79245d3d3e7 ]
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once.
Link: https://lore.kernel.org/r/20230202141009.2290380-1-gregkh@linuxfoundation.or... Cc: Karan Tilak Kumar kartilak@cisco.com Cc: Sesidhar Baddela sebaddel@cisco.com Cc: "James E.J. Bottomley" jejb@linux.ibm.com Cc: "Martin K. Petersen" martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/scsi/snic/snic_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/snic/snic_debugfs.c b/drivers/scsi/snic/snic_debugfs.c index 57bdc3ba49d9c..9dd975b36b5bd 100644 --- a/drivers/scsi/snic/snic_debugfs.c +++ b/drivers/scsi/snic/snic_debugfs.c @@ -437,6 +437,6 @@ void snic_trc_debugfs_init(void) void snic_trc_debugfs_term(void) { - debugfs_remove(debugfs_lookup(TRC_FILE, snic_glob->trc_root)); - debugfs_remove(debugfs_lookup(TRC_ENABLE_FILE, snic_glob->trc_root)); + debugfs_lookup_and_remove(TRC_FILE, snic_glob->trc_root); + debugfs_lookup_and_remove(TRC_ENABLE_FILE, snic_glob->trc_root); }
From: Mason Zhang Mason.Zhang@mediatek.com
[ Upstream commit 36822124f9de200cedc2f42516301b50d386a6cd ]
In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times out and clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and return. hba->dev_cmd.complete struct is not set to NULL.
When this happens, if cmd has been completed by device, then we will call complete() in __ufshcd_transfer_req_compl(). Because the complete struct is allocated on the stack, the following crash will occur:
ipanic_die+0x24/0x38 [mrdump] die+0x344/0x748 arm64_notify_die+0x44/0x104 do_debug_exception+0x104/0x1e0 el1_dbg+0x38/0x54 el1_sync_handler+0x40/0x88 el1_sync+0x8c/0x140 queued_spin_lock_slowpath+0x2e4/0x3c0 __ufshcd_transfer_req_compl+0x3b0/0x1164 ufshcd_trc_handler+0x15c/0x308 ufshcd_host_reset_and_restore+0x54/0x260 ufshcd_reset_and_restore+0x28c/0x57c ufshcd_err_handler+0xeb8/0x1b6c process_one_work+0x288/0x964 worker_thread+0x4bc/0xc7c kthread+0x15c/0x264 ret_from_fork+0x10/0x30
Link: https://lore.kernel.org/r/20221216032532.1280-1-mason.zhang@mediatek.com Signed-off-by: Mason Zhang Mason.Zhang@mediatek.com Reviewed-by: Bart Van Assche bvanassche@acm.org Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/ufs/core/ufshcd.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index fd6f421ff4a46..2ddc1aba0ad75 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -3008,6 +3008,22 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, } else { dev_err(hba->dev, "%s: failed to clear tag %d\n", __func__, lrbp->task_tag); + + spin_lock_irqsave(&hba->outstanding_lock, flags); + pending = test_bit(lrbp->task_tag, + &hba->outstanding_reqs); + if (pending) + hba->dev_cmd.complete = NULL; + spin_unlock_irqrestore(&hba->outstanding_lock, flags); + + if (!pending) { + /* + * The completion handler ran while we tried to + * clear the command. + */ + time_left = 1; + goto retry; + } } }
From: Bastien Nocera hadess@hadess.net
[ Upstream commit 498ba20690357691103de0f766960355247c78be ]
Don't stop and restart communication with the device unless we need to modify the connect flags used because of a device quirk.
Signed-off-by: Bastien Nocera hadess@hadess.net Link: https://lore.kernel.org/r/20230125121723.3122-1-hadess@hadess.net Signed-off-by: Benjamin Tissoires benjamin.tissoires@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/hid/hid-logitech-hidpp.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c index 0c024ec1452cd..5efc591a02a03 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -4102,6 +4102,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) bool connected; unsigned int connect_mask = HID_CONNECT_DEFAULT; struct hidpp_ff_private_data data; + bool will_restart = false;
/* report_fixup needs drvdata to be set before we call hid_parse */ hidpp = devm_kzalloc(&hdev->dev, sizeof(*hidpp), GFP_KERNEL); @@ -4157,6 +4158,10 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) return ret; }
+ if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT || + hidpp->quirks & HIDPP_QUIRK_UNIFYING) + will_restart = true; + INIT_WORK(&hidpp->work, delayed_work_cb); mutex_init(&hidpp->send_mutex); init_waitqueue_head(&hidpp->wait); @@ -4171,7 +4176,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) * Plain USB connections need to actually call start and open * on the transport driver to allow incoming data. */ - ret = hid_hw_start(hdev, 0); + ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask); if (ret) { hid_err(hdev, "hw start failed\n"); goto hid_hw_start_fail; @@ -4208,6 +4213,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) hidpp->wireless_feature_index = 0; else if (ret) goto hid_hw_init_fail; + ret = 0; }
if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) { @@ -4222,19 +4228,21 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
hidpp_connect_event(hidpp);
- /* Reset the HID node state */ - hid_device_io_stop(hdev); - hid_hw_close(hdev); - hid_hw_stop(hdev); + if (will_restart) { + /* Reset the HID node state */ + hid_device_io_stop(hdev); + hid_hw_close(hdev); + hid_hw_stop(hdev);
- if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) - connect_mask &= ~HID_CONNECT_HIDINPUT; + if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) + connect_mask &= ~HID_CONNECT_HIDINPUT;
- /* Now export the actual inputs and hidraw nodes to the world */ - ret = hid_hw_start(hdev, connect_mask); - if (ret) { - hid_err(hdev, "%s:hid_hw_start returned error\n", __func__); - goto hid_hw_start_fail; + /* Now export the actual inputs and hidraw nodes to the world */ + ret = hid_hw_start(hdev, connect_mask); + if (ret) { + hid_err(hdev, "%s:hid_hw_start returned error\n", __func__); + goto hid_hw_start_fail; + } }
if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) {
From: Nicholas Kazlauskas nicholas.kazlauskas@amd.com
[ Upstream commit 37d184b548db0f64d4a878960b2c6988b38a3e7e ]
[Why] To align with DCN31 behavior. This helps avoid p-state hangs in the case where underflow does occur.
[How] Flip the bit to true.
Reviewed-by: Hansen Dsouza hansen.dsouza@amd.com Acked-by: Qingqing Zhuo qingqing.zhuo@amd.com Signed-off-by: Nicholas Kazlauskas nicholas.kazlauskas@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c index 79850a68f62ab..bc7f2b735327e 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c @@ -901,7 +901,7 @@ static const struct dc_debug_options debug_defaults_drv = { .max_downscale_src_width = 4096,/*upto true 4k*/ .disable_pplib_wm_range = false, .scl_reset_length10 = true, - .sanity_checks = false, + .sanity_checks = true, .underflow_assert_delay_us = 0xFFFFFFFF, .dwb_fi_phase = -1, // -1 = disable, .dmub_command_table = true,
From: Darrell Kavanagh darrell.kavanagh@gmail.com
[ Upstream commit 38b2d8efd03d2e56431b611e3523f0158306451d ]
Another Lenovo convertable where the panel is installed landscape but is reported to the kernel as portrait.
Signed-off-by: Darrell Kavanagh darrell.kavanagh@gmail.com Reviewed-by: Hans de Goede hdegoede@redhat.com Signed-off-by: Hans de Goede hdegoede@redhat.com Link: https://patchwork.freedesktop.org/patch/msgid/20230214164659.3583-1-darrell.... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c index b409fe256fd0a..5522d610c5cfd 100644 --- a/drivers/gpu/drm/drm_panel_orientation_quirks.c +++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c @@ -322,6 +322,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGL"), }, .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Lenovo IdeaPad Duet 3 10IGL5 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Duet 3 10IGL5"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, }, { /* Lenovo Yoga Book X90F / X91F / X91L */ .matches = { /* Non exact match to match all versions */
From: Nicholas Kazlauskas nicholas.kazlauskas@amd.com
[ Upstream commit b7c67f72408b11b922f23f06c7df0f6743a2e89d ]
[Why] The DMCUB implementation required to workaround corruption is not currently stable and may cause intermittent corruption or hangs.
[How] Disable PG until the sequence is stable.
Reviewed-by: Hansen Dsouza hansen.dsouza@amd.com Acked-by: Qingqing Zhuo qingqing.zhuo@amd.com Signed-off-by: Nicholas Kazlauskas nicholas.kazlauskas@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c index bc7f2b735327e..73f519dbdb531 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c @@ -892,6 +892,8 @@ static const struct dc_debug_options debug_defaults_drv = { .force_abm_enable = false, .timing_trace = false, .clock_trace = true, + .disable_dpp_power_gate = true, + .disable_hubp_power_gate = true, .disable_pplib_clock_request = false, .pipe_split_policy = MPC_SPLIT_DYNAMIC, .force_single_disp_pipe_split = false,
From: Aurabindo Pillai aurabindo.pillai@amd.com
[ Upstream commit 80c6d6804f31451848a3956a70c2bcb1f07cfcb0 ]
[Why&How] Temporarily disable SubVP+DRR since Xorg has an architectural limitation where freesync will not work in a multi monitor configuration. SubVP+DRR requires that freesync be working.
Whether OS has variable refresh setting enabled or not, the state on the crtc remains same unless an application requests VRR. Due to this, there is no way to know whether freesync will actually work or not while we are on the desktop from the kernel's perspective.
If userspace does not have a limitation with multi-display freesync (for example wayland), then this feature can be enabled by adding a dcfeaturemask option to amdgpu on the kernel cmdline like:
amdgpu.dcfeaturemask=0x200
Signed-off-by: Aurabindo Pillai aurabindo.pillai@amd.com Reviewed-by: Rodrigo Siqueira Rodrigo.Siqueira@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +++++ drivers/gpu/drm/amd/display/dc/dc.h | 2 +- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ++++ drivers/gpu/drm/amd/include/amd_shared.h | 1 + 4 files changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 027ffa5ccda46..1ba8a2905f824 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1551,6 +1551,11 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) if (amdgpu_dc_feature_mask & DC_DISABLE_LTTPR_DP2_0) init_data.flags.allow_lttpr_non_transparent_mode.bits.DP2_0 = true;
+ /* Disable SubVP + DRR config by default */ + init_data.flags.disable_subvp_drr = true; + if (amdgpu_dc_feature_mask & DC_ENABLE_SUBVP_DRR) + init_data.flags.disable_subvp_drr = false; + init_data.flags.seamless_boot_edp_requested = false;
if (check_seamless_boot_capability(adev)) { diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h index 85ebeaa2de186..37998dc0fc144 100644 --- a/drivers/gpu/drm/amd/display/dc/dc.h +++ b/drivers/gpu/drm/amd/display/dc/dc.h @@ -410,7 +410,7 @@ struct dc_config { bool force_bios_enable_lttpr; uint8_t force_bios_fixed_vs; int sdpif_request_limit_words_per_umc; - + bool disable_subvp_drr; };
enum visual_confirm { diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c index 8450f59c26186..69e205ac58b25 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c @@ -877,6 +877,10 @@ static bool subvp_drr_schedulable(struct dc *dc, struct dc_state *context, struc int16_t stretched_drr_us = 0; int16_t drr_stretched_vblank_us = 0; int16_t max_vblank_mallregion = 0; + const struct dc_config *config = &dc->config; + + if (config->disable_subvp_drr) + return false;
// Find SubVP pipe for (i = 0; i < dc->res_pool->pipe_count; i++) { diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h index f175e65b853a0..e4a22c68517d1 100644 --- a/drivers/gpu/drm/amd/include/amd_shared.h +++ b/drivers/gpu/drm/amd/include/amd_shared.h @@ -240,6 +240,7 @@ enum DC_FEATURE_MASK { DC_DISABLE_LTTPR_DP2_0 = (1 << 6), //0x40, disabled by default DC_PSR_ALLOW_SMU_OPT = (1 << 7), //0x80, disabled by default DC_PSR_ALLOW_MULTI_DISP_OPT = (1 << 8), //0x100, disabled by default + DC_ENABLE_SUBVP_DRR = (1 << 9), // 0x200, disabled by default };
enum DC_DEBUG_MASK {
From: Mike Snitzer snitzer@kernel.org
[ Upstream commit e4f80303c2353952e6e980b23914e4214487f2a6 ]
Otherwise on resource constrained systems these workqueues may be too greedy.
Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/md/dm-thin.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index 64cfcf46881dc..e4c1a8a21bbd0 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -2207,6 +2207,7 @@ static void process_thin_deferred_bios(struct thin_c *tc) throttle_work_update(&pool->throttle); dm_pool_issue_prefetches(pool->pmd); } + cond_resched(); } blk_finish_plug(&plug); } @@ -2289,6 +2290,7 @@ static void process_thin_deferred_cells(struct thin_c *tc) else pool->process_cell(tc, cell); } + cond_resched(); } while (!list_empty(&cells)); }
From: Mike Snitzer snitzer@kernel.org
[ Upstream commit 76227f6dc805e9e960128bcc6276647361e0827c ]
Otherwise on resource constrained systems these workqueues may be too greedy.
Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/md/dm-cache-target.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c index 5e92fac90b675..17fde3e5a1f7b 100644 --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -1805,6 +1805,7 @@ static void process_deferred_bios(struct work_struct *ws)
else commit_needed = process_bio(cache, bio) || commit_needed; + cond_resched(); }
if (commit_needed) @@ -1827,6 +1828,7 @@ static void requeue_deferred_bios(struct cache *cache) while ((bio = bio_list_pop(&bios))) { bio->bi_status = BLK_STS_DM_REQUEUE; bio_endio(bio); + cond_resched(); } }
@@ -1867,6 +1869,8 @@ static void check_migrations(struct work_struct *ws) r = mg_start(cache, op, NULL); if (r) break; + + cond_resched(); } }
From: Jeff Layton jlayton@kernel.org
[ Upstream commit 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d ]
At first, I thought this might be a source of nfsd_file overputs, but the current callers seem to avoid an extra put when nfsd4_verify_copy returns an error.
Still, it's "bad form" to leave the pointers filled out when we don't have a reference to them anymore, and that might lead to bugs later. Zero them out as a defensive coding measure.
Signed-off-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfs4proc.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 92674077fc88e..e02ff76fad82c 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1214,8 +1214,10 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; out_put_dst: nfsd_file_put(*dst); + *dst = NULL; out_put_src: nfsd_file_put(*src); + *src = NULL; goto out; }
From: Jeff Layton jlayton@kernel.org
[ Upstream commit 826b67e6376c2a788e3a62c4860dcd79500a27d5 ]
We had a bug report that xfstest generic/355 was failing on NFSv4.0. This test sets various combinations of setuid/setgid modes and tests whether DIO writes will cause them to be stripped.
What I found was that the server did properly strip those bits, but the client didn't notice because it held a delegation that was not recalled. The recall didn't occur because the client itself was the one generating the activity and we avoid recalls in that case.
Clearing setuid bits is an "implicit" activity. The client didn't specifically request that we do that, so we need the server to issue a CB_RECALL, or avoid the situation entirely by not issuing a delegation.
The easiest fix here is to simply not give out a delegation if the file is being opened for write, and the mode has the setuid and/or setgid bit set. Note that there is a potential race between the mode and lease being set, so we test for this condition both before and after setting the lease.
This patch fixes generic/355, generic/683 and generic/684 for me. (Note that 355 fails only on v4.0, and 683 and 684 require NFSv4.2 to run and fail).
Reported-by: Boyang Xue bxue@redhat.com Signed-off-by: Jeff Layton jlayton@kernel.org Signed-off-by: Chuck Lever chuck.lever@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/nfsd/nfs4state.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 104c258255d62..8852a05126926 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -5440,6 +5440,23 @@ nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp, return 0; }
+/* + * We avoid breaking delegations held by a client due to its own activity, but + * clearing setuid/setgid bits on a write is an implicit activity and the client + * may not notice and continue using the old mode. Avoid giving out a delegation + * on setuid/setgid files when the client is requesting an open for write. + */ +static int +nfsd4_verify_setuid_write(struct nfsd4_open *open, struct nfsd_file *nf) +{ + struct inode *inode = file_inode(nf->nf_file); + + if ((open->op_share_access & NFS4_SHARE_ACCESS_WRITE) && + (inode->i_mode & (S_ISUID|S_ISGID))) + return -EAGAIN; + return 0; +} + static struct nfs4_delegation * nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, struct svc_fh *parent) @@ -5473,6 +5490,8 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, spin_lock(&fp->fi_lock); if (nfs4_delegation_exists(clp, fp)) status = -EAGAIN; + else if (nfsd4_verify_setuid_write(open, nf)) + status = -EAGAIN; else if (!fp->fi_deleg_file) { fp->fi_deleg_file = nf; /* increment early to prevent fi_deleg_file from being @@ -5513,6 +5532,14 @@ nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp, if (status) goto out_unlock;
+ /* + * Now that the deleg is set, check again to ensure that nothing + * raced in and changed the mode while we weren't lookng. + */ + status = nfsd4_verify_setuid_write(open, fp->fi_deleg_file); + if (status) + goto out_unlock; + spin_lock(&state_lock); spin_lock(&fp->fi_lock); if (fp->fi_had_conflict)
From: Paulo Alcantara pc@cjr.nz
[ Upstream commit 3c0070f54b3128de498c2dd9934a21f0dd867111 ]
Make sure to get an up-to-date TCP_Server_Info::nr_targets value prior to waiting the server to be reconnected in smb2_reconnect(). It is set in cifs_tcp_ses_needs_reconnect() and protected by TCP_Server_Info::srv_lock.
Signed-off-by: Paulo Alcantara (SUSE) pc@cjr.nz Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/cifs/smb2pdu.c | 119 +++++++++++++++++++++++++--------------------- 1 file changed, 64 insertions(+), 55 deletions(-)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 3b93680a319e4..5a063af8a094e 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -139,6 +139,66 @@ smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd, return; }
+static int wait_for_server_reconnect(struct TCP_Server_Info *server, + __le16 smb2_command, bool retry) +{ + int timeout = 10; + int rc; + + spin_lock(&server->srv_lock); + if (server->tcpStatus != CifsNeedReconnect) { + spin_unlock(&server->srv_lock); + return 0; + } + timeout *= server->nr_targets; + spin_unlock(&server->srv_lock); + + /* + * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE + * here since they are implicitly done when session drops. + */ + switch (smb2_command) { + /* + * BB Should we keep oplock break and add flush to exceptions? + */ + case SMB2_TREE_DISCONNECT: + case SMB2_CANCEL: + case SMB2_CLOSE: + case SMB2_OPLOCK_BREAK: + return -EAGAIN; + } + + /* + * Give demultiplex thread up to 10 seconds to each target available for + * reconnect -- should be greater than cifs socket timeout which is 7 + * seconds. + * + * On "soft" mounts we wait once. Hard mounts keep retrying until + * process is killed or server comes back on-line. + */ + do { + rc = wait_event_interruptible_timeout(server->response_q, + (server->tcpStatus != CifsNeedReconnect), + timeout * HZ); + if (rc < 0) { + cifs_dbg(FYI, "%s: aborting reconnect due to received signal\n", + __func__); + return -ERESTARTSYS; + } + + /* are we still trying to reconnect? */ + spin_lock(&server->srv_lock); + if (server->tcpStatus != CifsNeedReconnect) { + spin_unlock(&server->srv_lock); + return 0; + } + spin_unlock(&server->srv_lock); + } while (retry); + + cifs_dbg(FYI, "%s: gave up waiting on reconnect\n", __func__); + return -EHOSTDOWN; +} + static int smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, struct TCP_Server_Info *server) @@ -146,7 +206,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, int rc = 0; struct nls_table *nls_codepage; struct cifs_ses *ses; - int retries;
/* * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so @@ -184,61 +243,11 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, (!tcon->ses->server) || !server) return -EIO;
- ses = tcon->ses; - retries = server->nr_targets; - - /* - * Give demultiplex thread up to 10 seconds to each target available for - * reconnect -- should be greater than cifs socket timeout which is 7 - * seconds. - */ - while (server->tcpStatus == CifsNeedReconnect) { - /* - * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE - * here since they are implicitly done when session drops. - */ - switch (smb2_command) { - /* - * BB Should we keep oplock break and add flush to exceptions? - */ - case SMB2_TREE_DISCONNECT: - case SMB2_CANCEL: - case SMB2_CLOSE: - case SMB2_OPLOCK_BREAK: - return -EAGAIN; - } - - rc = wait_event_interruptible_timeout(server->response_q, - (server->tcpStatus != CifsNeedReconnect), - 10 * HZ); - if (rc < 0) { - cifs_dbg(FYI, "%s: aborting reconnect due to a received signal by the process\n", - __func__); - return -ERESTARTSYS; - } - - /* are we still trying to reconnect? */ - spin_lock(&server->srv_lock); - if (server->tcpStatus != CifsNeedReconnect) { - spin_unlock(&server->srv_lock); - break; - } - spin_unlock(&server->srv_lock); - - if (retries && --retries) - continue; + rc = wait_for_server_reconnect(server, smb2_command, tcon->retry); + if (rc) + return rc;
- /* - * on "soft" mounts we wait once. Hard mounts keep - * retrying until process is killed or server comes - * back on-line - */ - if (!tcon->retry) { - cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n"); - return -EHOSTDOWN; - } - retries = server->nr_targets; - } + ses = tcon->ses;
spin_lock(&ses->chan_lock); if (!cifs_chan_needs_reconnect(ses, server) && !tcon->need_reconnect) {
From: Matt Roper matthew.d.roper@intel.com
[ Upstream commit eda94a6e6a4f2d3d1574ff4f2bd4b9f844504f71 ]
Workaround Wa_18018781329 has applied to several recent Xe_HP-based platforms. However there are some extra gotchas to implementing this properly for MTL that we need to take into account:
* Due to the separation of media and render/compute into separate GTs, this workaround needs to be implemented on each GT, not just the primary GT. Since each class of register only exists on one of the two GTs, we should program the appropriate registers on each GT.
* As with past Xe_HP platforms, the registers on the primary GT (Xe_LPG IP) are multicast/replicated registers and should be handled with the MCR-aware functions. However the registers on the media GT (Xe_LPM+ IP) are regular singleton registers and should _not_ use MCR handling. We need to create separate register definitions for the Xe_HP multicast form and the Xe_LPM+ singleton form and use each in the appropriate place.
* Starting with MTL, workarounds documented by the hardware teams are technically associated with IP versions/steppings rather than top-level platforms. That means we should take care to check the media IP version rather than the graphics IP version when deciding whether the workaround is needed on the Xe_LPM+ media GT (in this case the workaround applies to both IPs and the stepping bounds are identical, but we should still write the code appropriately to set a proper precedent for future workaround implementations).
* It's worth noting that the GSC register and the CCS register are defined with the same MMIO offset (0xCF30). Since the CCS is only relevant to the primary GT and the GSC is only relevant to the media GT there isn't actually a clash here (the media GT automatically adds the additional 0x380000 GSI offset). However there's currently a glitch in the bspec where the CCS register doesn't show up at all and the GSC register is listed as existing on both GTs. That's a known documentation problem for several registers with shared GSC/CCS offsets; rest assured that the CCS register really does still exist.
Cc: Gustavo Sousa gustavo.sousa@intel.com Signed-off-by: Matt Roper matthew.d.roper@intel.com Fixes: 41bb543f5598 ("drm/i915/mtl: Add initial gt workarounds") Reviewed-by: Gustavo Sousa gustavo.sousa@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230125234159.3015385-2-matth... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/i915/gt/intel_gt_regs.h | 7 +++++-- drivers/gpu/drm/i915/gt/intel_workarounds.c | 22 ++++++++++++++------- drivers/gpu/drm/i915/i915_drv.h | 4 ++++ 3 files changed, 24 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/intel_gt_regs.h b/drivers/gpu/drm/i915/gt/intel_gt_regs.h index 3b6ef0eb47e76..9758b0b635601 100644 --- a/drivers/gpu/drm/i915/gt/intel_gt_regs.h +++ b/drivers/gpu/drm/i915/gt/intel_gt_regs.h @@ -1087,8 +1087,11 @@ #define XEHP_MERT_MOD_CTRL MCR_REG(0xcf28) #define RENDER_MOD_CTRL MCR_REG(0xcf2c) #define COMP_MOD_CTRL MCR_REG(0xcf30) -#define VDBX_MOD_CTRL MCR_REG(0xcf34) -#define VEBX_MOD_CTRL MCR_REG(0xcf38) +#define XELPMP_GSC_MOD_CTRL _MMIO(0xcf30) /* media GT only */ +#define XEHP_VDBX_MOD_CTRL MCR_REG(0xcf34) +#define XELPMP_VDBX_MOD_CTRL _MMIO(0xcf34) +#define XEHP_VEBX_MOD_CTRL MCR_REG(0xcf38) +#define XELPMP_VEBX_MOD_CTRL _MMIO(0xcf38) #define FORCE_MISS_FTLB REG_BIT(3)
#define XEHP_GAMSTLB_CTRL MCR_REG(0xcf4c) diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c index d92b006d4cd2e..e13052c5dae19 100644 --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c @@ -1678,8 +1678,8 @@ dg2_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) /* Wa_18018781329 */ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, XEHP_VDBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, XEHP_VEBX_MOD_CTRL, FORCE_MISS_FTLB);
/* Wa_1509235366:dg2 */ wa_mcr_write_or(wal, XEHP_GAMCNTRL_CTRL, @@ -1697,8 +1697,8 @@ pvc_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) /* Wa_18018781329 */ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, XEHP_VDBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_mcr_write_or(wal, XEHP_VEBX_MOD_CTRL, FORCE_MISS_FTLB); }
static void @@ -1712,8 +1712,6 @@ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) /* Wa_18018781329 */ wa_mcr_write_or(wal, RENDER_MOD_CTRL, FORCE_MISS_FTLB); wa_mcr_write_or(wal, COMP_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VDBX_MOD_CTRL, FORCE_MISS_FTLB); - wa_mcr_write_or(wal, VEBX_MOD_CTRL, FORCE_MISS_FTLB); }
/* @@ -1726,7 +1724,17 @@ xelpg_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) static void xelpmp_gt_workarounds_init(struct intel_gt *gt, struct i915_wa_list *wal) { - /* FIXME: Actual workarounds will be added in future patch(es) */ + if (IS_MTL_MEDIA_STEP(gt->i915, STEP_A0, STEP_B0)) { + /* + * Wa_18018781329 + * + * Note that although these registers are MCR on the primary + * GT, the media GT's versions are regular singleton registers. + */ + wa_write_or(wal, XELPMP_GSC_MOD_CTRL, FORCE_MISS_FTLB); + wa_write_or(wal, XELPMP_VDBX_MOD_CTRL, FORCE_MISS_FTLB); + wa_write_or(wal, XELPMP_VEBX_MOD_CTRL, FORCE_MISS_FTLB); + }
debug_dump_steering(gt); } diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h index a380db36d52c4..03c3a59d0939b 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -726,6 +726,10 @@ IS_SUBPLATFORM(const struct drm_i915_private *i915, (IS_SUBPLATFORM(__i915, INTEL_METEORLAKE, INTEL_SUBPLATFORM_##variant) && \ IS_GRAPHICS_STEP(__i915, since, until))
+#define IS_MTL_MEDIA_STEP(__i915, since, until) \ + (IS_METEORLAKE(__i915) && \ + IS_MEDIA_STEP(__i915, since, until)) + /* * DG2 hardware steppings are a bit unusual. The hardware design was forked to * create three variants (G10, G11, and G12) which each have distinct
From: Asahi Lina lina@asahilina.net
[ Upstream commit 047a754558d640eaa080fce3b22ca9f3d4e04626 ]
The referenced commit added a wrapper for drm_gem_shmem_get_pages_sgt(), but in the process it accidentally changed the export type from GPL to non-GPL. Switch it back to GPL.
Reported-by: Dmitry Osipenko dmitry.osipenko@collabora.com Fixes: ddddedaa0db9 ("drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()") Signed-off-by: Asahi Lina lina@asahilina.net Signed-off-by: Thomas Zimmermann tzimmermann@suse.de Link: https://patchwork.freedesktop.org/patch/msgid/20230227-shmem-export-fix-v1-1... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 2c559b310cad3..7af9da886d4e5 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -747,7 +747,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem)
return sgt; } -EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt); +EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt);
/** * drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from
From: Saravana Kannan saravanak@google.com
[ Upstream commit 6309872413f14f3d58c13ae4dc85b1a7004b4193 ]
fw_devlink can sometimes try to create a device link with the consumer and supplier as the same device. These attempts will fail (correctly), but are harmless. So, avoid printing an error for these cases. Also, add more detail to the error message.
Fixes: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust") Reported-by: Vladimir Oltean vladimir.oltean@nxp.com Reported-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Signed-off-by: Saravana Kannan saravanak@google.com Link: https://lore.kernel.org/r/20230225064148.274376-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index 126b10c8e0ce9..6ed21587be287 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -2088,9 +2088,9 @@ static int fw_devlink_create_devlink(struct device *con, goto out; }
- if (!device_link_add(con, sup_dev, flags)) { - dev_err(con, "Failed to create device link with %s\n", - dev_name(sup_dev)); + if (con != sup_dev && !device_link_add(con, sup_dev, flags)) { + dev_err(con, "Failed to create device link (0x%x) with %s\n", + flags, dev_name(sup_dev)); ret = -EINVAL; }
From: Jun ASAKA JunASAKA@zzy040330.moe
commit c6015bf3ff1ffb3caa27eb913797438a0fc634a0 upstream.
Fixing transmission failure which results in "authentication with ... timed out". This can be fixed by disable the REG_TXPAUSE.
Signed-off-by: Jun ASAKA JunASAKA@zzy040330.moe Reviewed-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20221217030659.12577-1-JunASAKA@zzy040330.moe Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c @@ -1744,6 +1744,11 @@ static void rtl8192e_enable_rf(struct rt val8 = rtl8xxxu_read8(priv, REG_PAD_CTRL1); val8 &= ~BIT(0); rtl8xxxu_write8(priv, REG_PAD_CTRL1, val8); + + /* + * Fix transmission failure of rtl8192e. + */ + rtl8xxxu_write8(priv, REG_TXPAUSE, 0x00); }
static s8 rtl8192e_cck_rssi(struct rtl8xxxu_priv *priv, u8 cck_agc_rpt)
From: Alper Nebi Yasak alpernebiyasak@gmail.com
commit e6acaf25cba14661211bb72181c35dd13b24f5b3 upstream.
The coreboot framebuffer doesn't support transparency, its 'reserved' bit field is merely padding for byte/word alignment of pixel colors [1]. When trying to match the framebuffer to a simplefb format, the kernel driver unnecessarily requires the format's transparency bit field to exactly match this padding, even if the former is zero-width.
Due to a coreboot bug [2] (fixed upstream), some boards misreport the reserved field's size as equal to its position (0x18 for both on a 'Lick' Chromebook), and the driver fails to probe where it would have otherwise worked fine with e.g. the a8r8g8b8 or x8r8g8b8 formats.
Remove the transparency comparison with reserved bits. When the bits-per-pixel and other color components match, transparency will already be in a subset of the reserved field. Not forcing it to match reserved bits allows the driver to work on the boards which misreport the reserved field. It also enables using simplefb formats that don't have transparency bits, although this doesn't currently happen due to format support and ordering in linux/platform_data/simplefb.h.
[1] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.19/src/commonlib/in... [2] https://review.coreboot.org/plugins/gitiles/coreboot/+/4.13/src/drivers/inte...
Signed-off-by: Alper Nebi Yasak alpernebiyasak@gmail.com Link: https://lore.kernel.org/r/20230122190433.195941-1-alpernebiyasak@gmail.com Cc: Salvatore Bonaccorso carnil@debian.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/firmware/google/framebuffer-coreboot.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/firmware/google/framebuffer-coreboot.c +++ b/drivers/firmware/google/framebuffer-coreboot.c @@ -43,9 +43,7 @@ static int framebuffer_probe(struct core fb->green_mask_pos == formats[i].green.offset && fb->green_mask_size == formats[i].green.length && fb->blue_mask_pos == formats[i].blue.offset && - fb->blue_mask_size == formats[i].blue.length && - fb->reserved_mask_pos == formats[i].transp.offset && - fb->reserved_mask_size == formats[i].transp.length) + fb->blue_mask_size == formats[i].blue.length) pdata.format = formats[i].name; } if (!pdata.format)
From: Jens Axboe axboe@kernel.dk
commit 67d59247d4b52c917e373f05a807027756ab216f upstream.
If we're doing a large IO request which needs to be split into multiple bios for issue, then we can run into the same situation as the below marked commit fixes - parts will complete just fine, one or more parts will fail to allocate a request. This will result in a partially completed read or write request, where the caller gets EAGAIN even though parts of the IO completed just fine.
Do the same for large bios as we do for splits - fail a NOWAIT request with EAGAIN. This isn't technically fixing an issue in the below marked patch, but for stable purposes, we should have either none of them or both.
This depends on: 613b14884b85 ("block: handle bio_split_to_limits() NULL return")
Cc: stable@vger.kernel.org # 5.15+ Fixes: 9cea62b2cbab ("block: don't allow splitting of a REQ_NOWAIT bio") Link: https://github.com/axboe/liburing/issues/766 Reported-and-tested-by: Michael Kelley mikelley@microsoft.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- block/fops.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
--- a/block/fops.c +++ b/block/fops.c @@ -221,6 +221,24 @@ static ssize_t __blkdev_direct_IO(struct bio_endio(bio); break; } + if (iocb->ki_flags & IOCB_NOWAIT) { + /* + * This is nonblocking IO, and we need to allocate + * another bio if we have data left to map. As we + * cannot guarantee that one of the sub bios will not + * fail getting issued FOR NOWAIT and as error results + * are coalesced across all of them, be safe and ask for + * a retry of this from blocking context. + */ + if (unlikely(iov_iter_count(iter))) { + bio_release_pages(bio, false); + bio_clear_flag(bio, BIO_REFFED); + bio_put(bio); + blk_finish_plug(&plug); + return -EAGAIN; + } + bio->bi_opf |= REQ_NOWAIT; + }
if (is_read) { if (dio->flags & DIO_SHOULD_DIRTY) @@ -228,9 +246,6 @@ static ssize_t __blkdev_direct_IO(struct } else { task_io_account_write(bio->bi_iter.bi_size); } - if (iocb->ki_flags & IOCB_NOWAIT) - bio->bi_opf |= REQ_NOWAIT; - dio->size += bio->bi_iter.bi_size; pos += bio->bi_iter.bi_size;
From: Jens Axboe axboe@kernel.dk
commit 11eb695feb636fa5211067189cad25ac073e7fe5 upstream.
This isn't strictly needed in terms of correctness, but it does allow polling to know if the bio has been put already by a different task and hence avoid polling something that we don't need to.
Cc: stable@vger.kernel.org Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") Reviewed-by: Keith Busch kbusch@kernel.org Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- block/bio.c | 1 + 1 file changed, 1 insertion(+)
--- a/block/bio.c +++ b/block/bio.c @@ -773,6 +773,7 @@ static inline void bio_put_percpu_cache(
if ((bio->bi_opf & REQ_POLLED) && !WARN_ON_ONCE(in_interrupt())) { bio->bi_next = cache->free_list; + bio->bi_bdev = NULL; cache->free_list = bio; cache->nr++; } else {
From: Jens Axboe axboe@kernel.dk
commit 310726c33ad76cebdee312dbfafc12c1b44bf977 upstream.
Wei reports a crash with an application using polled IO:
PGD 14265e067 P4D 14265e067 PUD 47ec50067 PMD 0 Oops: 0000 [#1] SMP CPU: 0 PID: 21915 Comm: iocore_0 Kdump: loaded Tainted: G S 5.12.0-0_fbk12_clang_7346_g1bb6f2e7058f #1 Hardware name: Wiwynn Delta Lake MP T8/Delta Lake-Class2, BIOS Y3DLM08 04/10/2022 RIP: 0010:bio_poll+0x25/0x200 Code: 0f 1f 44 00 00 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 28 65 48 8b 04 25 28 00 00 00 48 89 44 24 20 48 8b 47 08 <48> 8b 80 70 02 00 00 4c 8b 70 50 8b 6f 34 31 db 83 fd ff 75 25 65 RSP: 0018:ffffc90005fafdf8 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 74b43cd65dd66600 RDX: 0000000000000003 RSI: ffffc90005fafe78 RDI: ffff8884b614e140 RBP: ffff88849964df78 R08: 0000000000000000 R09: 0000000000000008 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88849964df00 R13: ffffc90005fafe78 R14: ffff888137d3c378 R15: 0000000000000001 FS: 00007fd195000640(0000) GS:ffff88903f400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000270 CR3: 0000000466121001 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: iocb_bio_iopoll+0x1d/0x30 io_do_iopoll+0xac/0x250 __se_sys_io_uring_enter+0x3c5/0x5a0 ? __x64_sys_write+0x89/0xd0 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x94f225d Code: 24 cc 00 00 00 41 8b 84 24 d0 00 00 00 c1 e0 04 83 e0 10 41 09 c2 8b 33 8b 53 04 4c 8b 43 18 4c 63 4b 0c b8 aa 01 00 00 0f 05 <85> c0 0f 88 85 00 00 00 29 03 45 84 f6 0f 84 88 00 00 00 41 f6 c7 RSP: 002b:00007fd194ffcd88 EFLAGS: 00000202 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 00007fd194ffcdc0 RCX: 00000000094f225d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 RBP: 00007fd194ffcdb0 R08: 0000000000000000 R09: 0000000000000008 R10: 0000000000000001 R11: 0000000000000202 R12: 00007fd269d68030 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
which is due to bio->bi_bdev being NULL. This can happen if we have two tasks doing polled IO, and task B ends up completing IO from task A if they are sharing a poll queue. If task B completes the IO and puts the bio into our cache, then it can allocate that bio again before task A is done polling for it. As that would necessitate a preempt between the two tasks, it's enough to just be a bit more careful in checking for whether or not bio->bi_bdev is NULL.
Reported-and-tested-by: Wei Zhang wzhang@meta.com Cc: stable@vger.kernel.org Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") Reviewed-by: Keith Busch kbusch@kernel.org Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- block/blk-core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
--- a/block/blk-core.c +++ b/block/blk-core.c @@ -854,10 +854,16 @@ EXPORT_SYMBOL(submit_bio); */ int bio_poll(struct bio *bio, struct io_comp_batch *iob, unsigned int flags) { - struct request_queue *q = bdev_get_queue(bio->bi_bdev); blk_qc_t cookie = READ_ONCE(bio->bi_cookie); + struct block_device *bdev; + struct request_queue *q; int ret = 0;
+ bdev = READ_ONCE(bio->bi_bdev); + if (!bdev) + return 0; + + q = bdev_get_queue(bdev); if (cookie == BLK_QC_T_NONE || !test_bit(QUEUE_FLAG_POLL, &q->queue_flags)) return 0; @@ -917,7 +923,7 @@ int iocb_bio_iopoll(struct kiocb *kiocb, */ rcu_read_lock(); bio = READ_ONCE(kiocb->private); - if (bio && bio->bi_bdev) + if (bio) ret = bio_poll(bio, iob, flags); rcu_read_unlock();
From: Johan Hovold johan+linaro@kernel.org
commit c88db0eff9722fc2b6c4d172a50471d20e08ecc6 upstream.
Make sure to disable the alarm before updating the four alarm time registers to avoid spurious alarms during the update.
Note that the disable needs to be done outside of the ctrl_reg_lock section to prevent a racing alarm interrupt from disabling the newly set alarm when the lock is released.
Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC") Cc: stable@vger.kernel.org # 3.1 Signed-off-by: Johan Hovold johan+linaro@kernel.org Reviewed-by: David Collins quic_collinsd@quicinc.com Link: https://lore.kernel.org/r/20230202155448.6715-2-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni alexandre.belloni@bootlin.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/rtc/rtc-pm8xxx.c | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-)
--- a/drivers/rtc/rtc-pm8xxx.c +++ b/drivers/rtc/rtc-pm8xxx.c @@ -221,7 +221,6 @@ static int pm8xxx_rtc_set_alarm(struct d { int rc, i; u8 value[NUM_8_BIT_RTC_REGS]; - unsigned int ctrl_reg; unsigned long secs, irq_flags; struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev); const struct pm8xxx_rtc_regs *regs = rtc_dd->regs; @@ -233,6 +232,11 @@ static int pm8xxx_rtc_set_alarm(struct d secs >>= 8; }
+ rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl, + regs->alarm_en, 0); + if (rc) + return rc; + spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value, @@ -242,19 +246,11 @@ static int pm8xxx_rtc_set_alarm(struct d goto rtc_rw_fail; }
- rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg); - if (rc) - goto rtc_rw_fail; - - if (alarm->enabled) - ctrl_reg |= regs->alarm_en; - else - ctrl_reg &= ~regs->alarm_en; - - rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg); - if (rc) { - dev_err(dev, "Write to RTC alarm control register failed\n"); - goto rtc_rw_fail; + if (alarm->enabled) { + rc = regmap_update_bits(rtc_dd->regmap, regs->alarm_ctrl, + regs->alarm_en, regs->alarm_en); + if (rc) + goto rtc_rw_fail; }
dev_dbg(dev, "Alarm Set for h:m:s=%ptRt, y-m-d=%ptRdr\n",
From: Christophe JAILLET christophe.jaillet@wanadoo.fr
commit befb28f2676a65a5a4cc4626ae224461d8785af6 upstream.
'This should be 'retry_time_ms' instead of 'max_retries'.
Fixes: 63c4eb347164 ("ipmi:ipmb: Add initial support for IPMI over IPMB") Signed-off-by: Christophe JAILLET christophe.jaillet@wanadoo.fr Message-Id: 0d8670cff2c656e99a832a249e77dc90578f67de.1675591429.git.christophe.jaillet@wanadoo.fr Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard cminyard@mvista.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/char/ipmi/ipmi_ipmb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/char/ipmi/ipmi_ipmb.c +++ b/drivers/char/ipmi/ipmi_ipmb.c @@ -27,7 +27,7 @@ MODULE_PARM_DESC(bmcaddr, "Address to us
static unsigned int retry_time_ms = 250; module_param(retry_time_ms, uint, 0644); -MODULE_PARM_DESC(max_retries, "Timeout time between retries, in milliseconds."); +MODULE_PARM_DESC(retry_time_ms, "Timeout time between retries, in milliseconds.");
static unsigned int max_retries = 1; module_param(max_retries, uint, 0644);
From: Corey Minyard cminyard@mvista.com
commit 95767ed78a181d5404202627499f9cde56053b96 upstream.
The resend_msg() function cannot fail, but there was error handling around using it. Rework the handling of the error, and fix the out of retries debug reporting that was wrong around this, too.
Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard cminyard@mvista.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/char/ipmi/ipmi_ssif.c | 28 +++++++--------------------- 1 file changed, 7 insertions(+), 21 deletions(-)
--- a/drivers/char/ipmi/ipmi_ssif.c +++ b/drivers/char/ipmi/ipmi_ssif.c @@ -602,7 +602,7 @@ static void ssif_alert(struct i2c_client start_get(ssif_info); }
-static int start_resend(struct ssif_info *ssif_info); +static void start_resend(struct ssif_info *ssif_info);
static void msg_done_handler(struct ssif_info *ssif_info, int result, unsigned char *data, unsigned int len) @@ -909,31 +909,17 @@ static void msg_written_handler(struct s if (result < 0) { ssif_info->retries_left--; if (ssif_info->retries_left > 0) { - if (!start_resend(ssif_info)) { - ssif_inc_stat(ssif_info, send_retries); - return; - } - /* request failed, just return the error. */ - ssif_inc_stat(ssif_info, send_errors); - - if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) - dev_dbg(&ssif_info->client->dev, - "%s: Out of retries\n", __func__); - msg_done_handler(ssif_info, -EIO, NULL, 0); + start_resend(ssif_info); return; }
ssif_inc_stat(ssif_info, send_errors);
- /* - * Got an error on transmit, let the done routine - * handle it. - */ if (ssif_info->ssif_debug & SSIF_DEBUG_MSG) dev_dbg(&ssif_info->client->dev, - "%s: Error %d\n", __func__, result); + "%s: Out of retries\n", __func__);
- msg_done_handler(ssif_info, result, NULL, 0); + msg_done_handler(ssif_info, -EIO, NULL, 0); return; }
@@ -996,7 +982,7 @@ static void msg_written_handler(struct s } }
-static int start_resend(struct ssif_info *ssif_info) +static void start_resend(struct ssif_info *ssif_info) { int command;
@@ -1021,7 +1007,6 @@ static int start_resend(struct ssif_info
ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE, command, ssif_info->data, I2C_SMBUS_BLOCK_DATA); - return 0; }
static int start_send(struct ssif_info *ssif_info, @@ -1036,7 +1021,8 @@ static int start_send(struct ssif_info * ssif_info->retries_left = SSIF_SEND_RETRIES; memcpy(ssif_info->data + 1, data, len); ssif_info->data_len = len; - return start_resend(ssif_info); + start_resend(ssif_info); + return 0; }
/* Must be called with the message lock held. */
From: Corey Minyard cminyard@mvista.com
commit 8230831c43a328c2be6d28c65d3f77e14c59986b upstream.
Rename the SSIF_IDLE() to IS_SSIF_IDLE(), since that is more clear, and rename SSIF_NORMAL to SSIF_IDLE, since that's more accurate.
Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard cminyard@mvista.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/char/ipmi/ipmi_ssif.c | 46 +++++++++++++++++++++--------------------- 1 file changed, 23 insertions(+), 23 deletions(-)
--- a/drivers/char/ipmi/ipmi_ssif.c +++ b/drivers/char/ipmi/ipmi_ssif.c @@ -92,7 +92,7 @@ #define SSIF_WATCH_WATCHDOG_TIMEOUT msecs_to_jiffies(250)
enum ssif_intf_state { - SSIF_NORMAL, + SSIF_IDLE, SSIF_GETTING_FLAGS, SSIF_GETTING_EVENTS, SSIF_CLEARING_FLAGS, @@ -100,8 +100,8 @@ enum ssif_intf_state { /* FIXME - add watchdog stuff. */ };
-#define SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_NORMAL \ - && (ssif)->curr_msg == NULL) +#define IS_SSIF_IDLE(ssif) ((ssif)->ssif_state == SSIF_IDLE \ + && (ssif)->curr_msg == NULL)
/* * Indexes into stats[] in ssif_info below. @@ -348,9 +348,9 @@ static void return_hosed_msg(struct ssif
/* * Must be called with the message lock held. This will release the - * message lock. Note that the caller will check SSIF_IDLE and start a - * new operation, so there is no need to check for new messages to - * start in here. + * message lock. Note that the caller will check IS_SSIF_IDLE and + * start a new operation, so there is no need to check for new + * messages to start in here. */ static void start_clear_flags(struct ssif_info *ssif_info, unsigned long *flags) { @@ -367,7 +367,7 @@ static void start_clear_flags(struct ssi
if (start_send(ssif_info, msg, 3) != 0) { /* Error, just go to normal state. */ - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; } }
@@ -382,7 +382,7 @@ static void start_flag_fetch(struct ssif mb[0] = (IPMI_NETFN_APP_REQUEST << 2); mb[1] = IPMI_GET_MSG_FLAGS_CMD; if (start_send(ssif_info, mb, 2) != 0) - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; }
static void check_start_send(struct ssif_info *ssif_info, unsigned long *flags, @@ -393,7 +393,7 @@ static void check_start_send(struct ssif
flags = ipmi_ssif_lock_cond(ssif_info, &oflags); ssif_info->curr_msg = NULL; - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; ipmi_ssif_unlock_cond(ssif_info, flags); ipmi_free_smi_msg(msg); } @@ -407,7 +407,7 @@ static void start_event_fetch(struct ssi
msg = ipmi_alloc_smi_msg(); if (!msg) { - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; ipmi_ssif_unlock_cond(ssif_info, flags); return; } @@ -430,7 +430,7 @@ static void start_recv_msg_fetch(struct
msg = ipmi_alloc_smi_msg(); if (!msg) { - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; ipmi_ssif_unlock_cond(ssif_info, flags); return; } @@ -448,9 +448,9 @@ static void start_recv_msg_fetch(struct
/* * Must be called with the message lock held. This will release the - * message lock. Note that the caller will check SSIF_IDLE and start a - * new operation, so there is no need to check for new messages to - * start in here. + * message lock. Note that the caller will check IS_SSIF_IDLE and + * start a new operation, so there is no need to check for new + * messages to start in here. */ static void handle_flags(struct ssif_info *ssif_info, unsigned long *flags) { @@ -466,7 +466,7 @@ static void handle_flags(struct ssif_inf /* Events available. */ start_event_fetch(ssif_info, flags); else { - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; ipmi_ssif_unlock_cond(ssif_info, flags); } } @@ -568,7 +568,7 @@ static void watch_timeout(struct timer_l if (ssif_info->watch_timeout) { mod_timer(&ssif_info->watch_timer, jiffies + ssif_info->watch_timeout); - if (SSIF_IDLE(ssif_info)) { + if (IS_SSIF_IDLE(ssif_info)) { start_flag_fetch(ssif_info, flags); /* Releases lock */ return; } @@ -756,7 +756,7 @@ static void msg_done_handler(struct ssif }
switch (ssif_info->ssif_state) { - case SSIF_NORMAL: + case SSIF_IDLE: ipmi_ssif_unlock_cond(ssif_info, flags); if (!msg) break; @@ -774,7 +774,7 @@ static void msg_done_handler(struct ssif * Error fetching flags, or invalid length, * just give up for now. */ - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; ipmi_ssif_unlock_cond(ssif_info, flags); dev_warn(&ssif_info->client->dev, "Error getting flags: %d %d, %x\n", @@ -809,7 +809,7 @@ static void msg_done_handler(struct ssif "Invalid response clearing flags: %x %x\n", data[0], data[1]); } - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; ipmi_ssif_unlock_cond(ssif_info, flags); break;
@@ -887,7 +887,7 @@ static void msg_done_handler(struct ssif }
flags = ipmi_ssif_lock_cond(ssif_info, &oflags); - if (SSIF_IDLE(ssif_info) && !ssif_info->stopping) { + if (IS_SSIF_IDLE(ssif_info) && !ssif_info->stopping) { if (ssif_info->req_events) start_event_fetch(ssif_info, flags); else if (ssif_info->req_flags) @@ -1032,7 +1032,7 @@ static void start_next_msg(struct ssif_i unsigned long oflags;
restart: - if (!SSIF_IDLE(ssif_info)) { + if (!IS_SSIF_IDLE(ssif_info)) { ipmi_ssif_unlock_cond(ssif_info, flags); return; } @@ -1255,7 +1255,7 @@ static void shutdown_ssif(void *send_inf dev_set_drvdata(&ssif_info->client->dev, NULL);
/* make sure the driver is not looking for flags any more. */ - while (ssif_info->ssif_state != SSIF_NORMAL) + while (ssif_info->ssif_state != SSIF_IDLE) schedule_timeout(1);
ssif_info->stopping = true; @@ -1825,7 +1825,7 @@ static int ssif_probe(struct i2c_client }
spin_lock_init(&ssif_info->lock); - ssif_info->ssif_state = SSIF_NORMAL; + ssif_info->ssif_state = SSIF_IDLE; timer_setup(&ssif_info->retry_timer, retry_timeout, 0); timer_setup(&ssif_info->watch_timer, watch_timeout, 0);
From: Corey Minyard cminyard@mvista.com
commit 00bb7e763ec9f384cb382455cb6ba5588b5375cf upstream.
The IPMI spec has a time (T6) specified between request retries. Add the handling for that.
Reported by: Tony Camuso tcamuso@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Corey Minyard cminyard@mvista.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/char/ipmi/ipmi_ssif.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-)
--- a/drivers/char/ipmi/ipmi_ssif.c +++ b/drivers/char/ipmi/ipmi_ssif.c @@ -74,7 +74,8 @@ /* * Timer values */ -#define SSIF_MSG_USEC 60000 /* 60ms between message tries. */ +#define SSIF_MSG_USEC 60000 /* 60ms between message tries (T3). */ +#define SSIF_REQ_RETRY_USEC 60000 /* 60ms between send retries (T6). */ #define SSIF_MSG_PART_USEC 5000 /* 5ms for a message part */
/* How many times to we retry sending/receiving the message. */ @@ -82,7 +83,9 @@ #define SSIF_RECV_RETRIES 250
#define SSIF_MSG_MSEC (SSIF_MSG_USEC / 1000) +#define SSIF_REQ_RETRY_MSEC (SSIF_REQ_RETRY_USEC / 1000) #define SSIF_MSG_JIFFIES ((SSIF_MSG_USEC * 1000) / TICK_NSEC) +#define SSIF_REQ_RETRY_JIFFIES ((SSIF_REQ_RETRY_USEC * 1000) / TICK_NSEC) #define SSIF_MSG_PART_JIFFIES ((SSIF_MSG_PART_USEC * 1000) / TICK_NSEC)
/* @@ -229,6 +232,9 @@ struct ssif_info { bool got_alert; bool waiting_alert;
+ /* Used to inform the timeout that it should do a resend. */ + bool do_resend; + /* * If set to true, this will request events the next time the * state machine is idle. @@ -538,22 +544,28 @@ static void start_get(struct ssif_info * ssif_info->recv, I2C_SMBUS_BLOCK_DATA); }
+static void start_resend(struct ssif_info *ssif_info); + static void retry_timeout(struct timer_list *t) { struct ssif_info *ssif_info = from_timer(ssif_info, t, retry_timer); unsigned long oflags, *flags; - bool waiting; + bool waiting, resend;
if (ssif_info->stopping) return;
flags = ipmi_ssif_lock_cond(ssif_info, &oflags); + resend = ssif_info->do_resend; + ssif_info->do_resend = false; waiting = ssif_info->waiting_alert; ssif_info->waiting_alert = false; ipmi_ssif_unlock_cond(ssif_info, flags);
if (waiting) start_get(ssif_info); + if (resend) + start_resend(ssif_info); }
static void watch_timeout(struct timer_list *t) @@ -602,8 +614,6 @@ static void ssif_alert(struct i2c_client start_get(ssif_info); }
-static void start_resend(struct ssif_info *ssif_info); - static void msg_done_handler(struct ssif_info *ssif_info, int result, unsigned char *data, unsigned int len) { @@ -909,7 +919,13 @@ static void msg_written_handler(struct s if (result < 0) { ssif_info->retries_left--; if (ssif_info->retries_left > 0) { - start_resend(ssif_info); + /* + * Wait the retry timeout time per the spec, + * then redo the send. + */ + ssif_info->do_resend = true; + mod_timer(&ssif_info->retry_timer, + jiffies + SSIF_REQ_RETRY_JIFFIES); return; }
@@ -1320,8 +1336,10 @@ static int do_cmd(struct i2c_client *cli ret = i2c_smbus_write_block_data(client, SSIF_IPMI_REQUEST, len, msg); if (ret) { retry_cnt--; - if (retry_cnt > 0) + if (retry_cnt > 0) { + msleep(SSIF_REQ_RETRY_MSEC); goto retry1; + } return -ENODEV; }
@@ -1462,8 +1480,10 @@ retry_write: 32, msg); if (ret) { retry_cnt--; - if (retry_cnt > 0) + if (retry_cnt > 0) { + msleep(SSIF_REQ_RETRY_MSEC); goto retry_write; + } dev_err(&client->dev, "Could not write multi-part start, though the BMC said it could handle it. Just limit sends to one part.\n"); return ret; }
From: Kees Cook keescook@chromium.org
commit 36632d062975a9ff4410c90dd6d37922b68d0920 upstream.
Zero-length arrays are deprecated[1]. Replace struct io_uring_buf_ring's "bufs" with a flexible array member. (How is the size of this array verified?) Detected with GCC 13, using -fstrict-flex-arrays=3:
In function 'io_ring_buffer_select', inlined from 'io_buffer_select' at io_uring/kbuf.c:183:10: io_uring/kbuf.c:141:23: warning: array subscript 255 is outside the bounds of an interior zero-length array 'struct io_uring_buf[0]' [-Wzero-length-bounds] 141 | buf = &br->bufs[head]; | ^~~~~~~~~~~~~~~ In file included from include/linux/io_uring.h:7, from io_uring/kbuf.c:10: include/uapi/linux/io_uring.h: In function 'io_buffer_select': include/uapi/linux/io_uring.h:628:41: note: while referencing 'bufs' 628 | struct io_uring_buf bufs[0]; | ^~~~
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-a...
Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Cc: Jens Axboe axboe@kernel.dk Cc: Pavel Begunkov asml.silence@gmail.com Cc: "Gustavo A. R. Silva" gustavoars@kernel.org Cc: stable@vger.kernel.org Cc: io-uring@vger.kernel.org Signed-off-by: Kees Cook keescook@chromium.org Reviewed-by: Gustavo A. R. Silva gustavoars@kernel.org Link: https://lore.kernel.org/r/20230105190507.gonna.131-kees@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- include/uapi/linux/io_uring.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/uapi/linux/io_uring.h +++ b/include/uapi/linux/io_uring.h @@ -625,7 +625,7 @@ struct io_uring_buf_ring { __u16 resv3; __u16 tail; }; - struct io_uring_buf bufs[0]; + __DECLARE_FLEX_ARRAY(struct io_uring_buf, bufs); }; };
From: Pavel Begunkov asml.silence@gmail.com
commit c10bb64684813a326174c3eebcafb3ee5af52ca3 upstream.
We return POLLIN from io_uring_poll() depending on whether there are CQEs for the userspace, and so we should use the user visible tail pointer instead of a transient cached value.
Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov asml.silence@gmail.com Link: https://lore.kernel.org/r/228ffcbf30ba98856f66ffdb9a6a60ead1dd96c0.167448426... Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2790,7 +2790,7 @@ static __poll_t io_uring_poll(struct fil * pushes them to do the flush. */
- if (io_cqring_events(ctx) || io_has_work(ctx)) + if (__io_cqring_events_user(ctx) || io_has_work(ctx)) mask |= EPOLLIN | EPOLLRDNORM;
return mask;
From: Jens Axboe axboe@kernel.dk
commit b5d3ae202fbfe055aa2a8ae8524531ee1dcab717 upstream.
If TIF_NOTIFY_RESUME is set, then we need to call resume_user_mode_work() for PF_IO_WORKER threads. They never return to usermode, hence never get a chance to process any items that are marked by this flag. Most notably this includes the final put of files, but also any throttling markers set by block cgroups.
Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/io_uring.h | 8 ++++++++ 1 file changed, 8 insertions(+)
--- a/io_uring/io_uring.h +++ b/io_uring/io_uring.h @@ -3,6 +3,7 @@
#include <linux/errno.h> #include <linux/lockdep.h> +#include <linux/resume_user_mode.h> #include <linux/io_uring_types.h> #include <uapi/linux/eventpoll.h> #include "io-wq.h" @@ -270,6 +271,13 @@ static inline int io_run_task_work(void) */ if (test_thread_flag(TIF_NOTIFY_SIGNAL)) clear_notify_signal(); + /* + * PF_IO_WORKER never returns to userspace, so check here if we have + * notify work that needs processing. + */ + if (current->flags & PF_IO_WORKER && + test_thread_flag(TIF_NOTIFY_RESUME)) + resume_user_mode_work(NULL); if (task_work_pending(current)) { __set_current_state(TASK_RUNNING); task_work_run();
From: Jens Axboe axboe@kernel.dk
commit fcc926bb857949dbfa51a7d95f3f5ebc657f198c upstream.
If the kernel is configured with CONFIG_PREEMPT_NONE, we could be sitting in a tight loop reaping events but not giving them a chance to finish. This results in a trace ala:
rcu: INFO: rcu_sched self-detected stall on CPU rcu: 2-...!: (5249 ticks this GP) idle=935c/1/0x4000000000000000 softirq=4265/4274 fqs=1 (t=5251 jiffies g=465 q=4135 ncpus=4) rcu: rcu_sched kthread starved for 5249 jiffies! g465 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_sched kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_sched state:R running task stack:0 pid:12 ppid:2 flags:0x00000008 Call trace: __switch_to+0xb0/0xc8 __schedule+0x43c/0x520 schedule+0x4c/0x98 schedule_timeout+0xbc/0xdc rcu_gp_fqs_loop+0x308/0x344 rcu_gp_kthread+0xd8/0xf0 kthread+0xb8/0xc8 ret_from_fork+0x10/0x20 rcu: Stack dump where RCU GP kthread last ran: Task dump for CPU 0: task:kworker/u8:10 state:R running task stack:0 pid:89 ppid:2 flags:0x0000000a Workqueue: events_unbound io_ring_exit_work Call trace: __switch_to+0xb0/0xc8 0xffff0000c8fefd28 CPU: 2 PID: 95 Comm: kworker/u8:13 Not tainted 6.2.0-rc5-00042-g40316e337c80-dirty #2759 Hardware name: linux,dummy-virt (DT) Workqueue: events_unbound io_ring_exit_work pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : io_do_iopoll+0x344/0x360 lr : io_do_iopoll+0xb8/0x360 sp : ffff800009bebc60 x29: ffff800009bebc60 x28: 0000000000000000 x27: 0000000000000000 x26: ffff0000c0f67d48 x25: ffff0000c0f67840 x24: ffff800008950024 x23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c27d3200 x20: ffff0000c0f67840 x19: ffff0000c0f67800 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000001 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000179 x10: 0000000000000870 x9 : ffff800009bebd60 x8 : ffff0000c27d3ad0 x7 : fefefefefefefeff x6 : 0000646e756f626e x5 : ffff0000c0f67840 x4 : 0000000000000000 x3 : ffff0000c2398000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: io_do_iopoll+0x344/0x360 io_uring_try_cancel_requests+0x21c/0x334 io_ring_exit_work+0x90/0x40c process_one_work+0x1a4/0x254 worker_thread+0x1ec/0x258 kthread+0xb8/0xc8 ret_from_fork+0x10/0x20
Add a cond_resched() in the cancelation IOPOLL loop to fix this.
Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/io_uring.c | 1 + 1 file changed, 1 insertion(+)
--- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -3053,6 +3053,7 @@ static __cold bool io_uring_try_cancel_r while (!wq_list_empty(&ctx->iopoll_list)) { io_iopoll_try_reap_events(ctx); ret = true; + cond_resched(); } }
From: Jens Axboe axboe@kernel.dk
commit f58680085478dd292435727210122960d38e8014 upstream.
If CONFIG_PREEMPT_NONE is set and the task_work chains are long, we could be running into issues blocking others for too long. Add a reschedule check in handle_tw_list(), and flush the ctx if we need to reschedule.
Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/io_uring.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
--- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1143,10 +1143,16 @@ static unsigned int handle_tw_list(struc /* if not contended, grab and improve batching */ *locked = mutex_trylock(&(*ctx)->uring_lock); percpu_ref_get(&(*ctx)->refs); - } + } else if (!*locked) + *locked = mutex_trylock(&(*ctx)->uring_lock); req->io_task_work.func(req, locked); node = next; count++; + if (unlikely(need_resched())) { + ctx_flush_and_put(*ctx, locked); + *ctx = NULL; + cond_resched(); + } }
return count;
From: Pavel Begunkov asml.silence@gmail.com
commit edd478269640b360c6f301f2baa04abdda563ef3 upstream.
If two or more mappings go back to back to each other they can be passed into io_uring to be registered as a single registered buffer. That would even work if mappings came from different sources, e.g. it's possible to mix in this way anon pages and pages from shmem or hugetlb. That is not a problem but it'd rather be less prone if we forbid such mixing.
Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov asml.silence@gmail.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/rsrc.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
--- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1162,14 +1162,17 @@ struct page **io_pin_pages(unsigned long pret = pin_user_pages(ubuf, nr_pages, FOLL_WRITE | FOLL_LONGTERM, pages, vmas); if (pret == nr_pages) { + struct file *file = vmas[0]->vm_file; + /* don't support file backed memory */ for (i = 0; i < nr_pages; i++) { - struct vm_area_struct *vma = vmas[i]; - - if (vma_is_shmem(vma)) + if (vmas[i]->vm_file != file) { + ret = -EINVAL; + break; + } + if (!file) continue; - if (vma->vm_file && - !is_file_hugepages(vma->vm_file)) { + if (!vma_is_shmem(vmas[i]) && !is_file_hugepages(file)) { ret = -EOPNOTSUPP; break; }
From: David Lamparter equinox@diac24.net
commit 7605c43d67face310b4b87dee1a28bc0c8cd8c0f upstream.
MSG_NOSIGNAL is not applicable for the receiving side, SIGPIPE is generated when trying to write to a "broken pipe". AF_PACKET's packet_recvmsg() does enforce this, giving back EINVAL when MSG_NOSIGNAL is set - making it unuseable in io_uring's recvmsg.
Remove MSG_NOSIGNAL from io_recvmsg_prep().
Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: David Lamparter equinox@diac24.net Cc: Eric Dumazet edumazet@google.com Cc: Jens Axboe axboe@kernel.dk Reviewed-by: Eric Dumazet edumazet@google.com Link: https://lore.kernel.org/r/20230224150123.128346-1-equinox@diac24.net Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/io_uring/net.c +++ b/io_uring/net.c @@ -568,7 +568,7 @@ int io_recvmsg_prep(struct io_kiocb *req sr->flags = READ_ONCE(sqe->ioprio); if (sr->flags & ~(RECVMSG_FLAGS)) return -EINVAL; - sr->msg_flags = READ_ONCE(sqe->msg_flags) | MSG_NOSIGNAL; + sr->msg_flags = READ_ONCE(sqe->msg_flags); if (sr->msg_flags & MSG_DONTWAIT) req->flags |= REQ_F_NOWAIT; if (sr->msg_flags & MSG_ERRQUEUE)
From: Jens Axboe axboe@kernel.dk
commit c16bda37594f83147b167d381d54c010024efecf upstream.
If we get woken spuriously when polling and fail the operation with -EAGAIN again, then we generally only allow polling again if data had been transferred at some point. This is indicated with REQ_F_PARTIAL_IO. However, if the spurious poll triggers when the socket was originally empty, then we haven't transferred data yet and we will fail the poll re-arm. This either punts the socket to io-wq if it's blocking, or it fails the request with -EAGAIN if not. Neither condition is desirable, as the former will slow things down, while the latter will make the application confused.
We want to ensure that a repeated poll trigger doesn't lead to infinite work making no progress, that's what the REQ_F_PARTIAL_IO check was for. But it doesn't protect against a loop post the first receive, and it's unnecessarily strict if we started out with an empty socket.
Add a somewhat random retry count, just to put an upper limit on the potential number of retries that will be done. This should be high enough that we won't really hit it in practice, unless something needs to be aborted anyway.
Cc: stable@vger.kernel.org # v5.10+ Link: https://github.com/axboe/liburing/issues/364 Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/poll.c | 14 ++++++++++++-- io_uring/poll.h | 1 + 2 files changed, 13 insertions(+), 2 deletions(-)
--- a/io_uring/poll.c +++ b/io_uring/poll.c @@ -650,6 +650,14 @@ static void io_async_queue_proc(struct f __io_queue_proc(&apoll->poll, pt, head, &apoll->double_poll); }
+/* + * We can't reliably detect loops in repeated poll triggers and issue + * subsequently failing. But rather than fail these immediately, allow a + * certain amount of retries before we give up. Given that this condition + * should _rarely_ trigger even once, we should be fine with a larger value. + */ +#define APOLL_MAX_RETRY 128 + static struct async_poll *io_req_alloc_apoll(struct io_kiocb *req, unsigned issue_flags) { @@ -665,14 +673,18 @@ static struct async_poll *io_req_alloc_a if (entry == NULL) goto alloc_apoll; apoll = container_of(entry, struct async_poll, cache); + apoll->poll.retries = APOLL_MAX_RETRY; } else { alloc_apoll: apoll = kmalloc(sizeof(*apoll), GFP_ATOMIC); if (unlikely(!apoll)) return NULL; + apoll->poll.retries = APOLL_MAX_RETRY; } apoll->double_poll = NULL; req->apoll = apoll; + if (unlikely(!--apoll->poll.retries)) + return NULL; return apoll; }
@@ -694,8 +706,6 @@ int io_arm_poll_handler(struct io_kiocb return IO_APOLL_ABORTED; if (!file_can_poll(req->file)) return IO_APOLL_ABORTED; - if ((req->flags & (REQ_F_POLLED|REQ_F_PARTIAL_IO)) == REQ_F_POLLED) - return IO_APOLL_ABORTED; if (!(req->flags & REQ_F_APOLL_MULTISHOT)) mask |= EPOLLONESHOT;
--- a/io_uring/poll.h +++ b/io_uring/poll.h @@ -12,6 +12,7 @@ struct io_poll { struct file *file; struct wait_queue_head *head; __poll_t events; + int retries; struct wait_queue_entry wait; };
From: Joseph Qi joseph.qi@linux.alibaba.com
commit 54aa7f2330b82884f4a1afce0220add6e8312f8b upstream.
Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1]
Do the following steps can reproduce this BUG: mount -t ocfs2 /dev/vdc /mnt/ocfs2 cp testfile /mnt/ocfs2/ ./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1 umount /mnt/ocfs2
Then umount will fail, and it outputs: umount: /mnt/ocfs2: target is busy.
While tracing umount, it blames mnt_get_count() not return as expected. Do a deep investigation for fget()/fput() on related code flow, I've finally found that fget() leaks since ocfs2 doesn't support nowait buffered read.
io_issue_sqe |-io_assign_file // do fget() first |-io_read |-io_iter_do_read |-ocfs2_file_read_iter // return -EOPNOTSUPP |-kiocb_done |-io_rw_done |-__io_complete_rw_common // set REQ_F_REISSUE |-io_resubmit_prep |-io_req_prep_async // override req->file, leak happens
This was introduced by commit a196c78b5443 in v5.18. Fix it by don't re-assign req->file if it has already been assigned.
[1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@lin...
Fixes: a196c78b5443 ("io_uring: assign non-fixed early for async work") Cc: stable@vger.kernel.org Reported-by: Heming Zhao heming.zhao@suse.com Signed-off-by: Joseph Qi joseph.qi@linux.alibaba.com Cc: Xiaoguang Wang xiaoguang.wang@linux.alibaba.com Link: https://lore.kernel.org/r/20230228045459.13524-1-joseph.qi@linux.alibaba.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1728,7 +1728,7 @@ int io_req_prep_async(struct io_kiocb *r const struct io_op_def *def = &io_op_defs[req->opcode];
/* assign early for deferred execution for non-fixed file */ - if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE)) + if (def->needs_file && !(req->flags & REQ_F_FIXED_FILE) && !req->file) req->file = io_file_get_normal(req, req->cqe.fd); if (!def->prep_async) return 0;
From: Gerald Schaefer gerald.schaefer@linux.ibm.com
commit 8c42dd78df148c90e48efff204cce38743906a79 upstream.
Commit f05f62d04271f ("s390/vmem: get rid of memory segment list") reshuffled the call to vmem_add_mapping() in __segment_load(), which now overwrites rc after it was set to contain the segment type code.
As result, __segment_load() will now always return 0 on success, which corresponds to the segment type code SEG_TYPE_SW, i.e. a writeable segment. This results in a kernel crash when loading a read-only segment as dcssblk block device, and trying to write to it.
Instead of reshuffling code again, make sure to return the segment type on success, and also describe this rather delicate and unexpected logic in the function comment. Also initialize new segtype variable with invalid value, to prevent possible future confusion.
Fixes: f05f62d04271 ("s390/vmem: get rid of memory segment list") Cc: stable@vger.kernel.org # 5.9+ Signed-off-by: Gerald Schaefer gerald.schaefer@linux.ibm.com Reviewed-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/s390/mm/extmem.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
--- a/arch/s390/mm/extmem.c +++ b/arch/s390/mm/extmem.c @@ -289,15 +289,17 @@ segment_overlaps_others (struct dcss_seg
/* * real segment loading function, called from segment_load + * Must return either an error code < 0, or the segment type code >= 0 */ static int __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long *end) { unsigned long start_addr, end_addr, dummy; struct dcss_segment *seg; - int rc, diag_cc; + int rc, diag_cc, segtype;
start_addr = end_addr = 0; + segtype = -1; seg = kmalloc(sizeof(*seg), GFP_KERNEL | GFP_DMA); if (seg == NULL) { rc = -ENOMEM; @@ -326,9 +328,9 @@ __segment_load (char *name, int do_nonsh seg->res_name[8] = '\0'; strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name)); seg->res->name = seg->res_name; - rc = seg->vm_segtype; - if (rc == SEG_TYPE_SC || - ((rc == SEG_TYPE_SR || rc == SEG_TYPE_ER) && !do_nonshared)) + segtype = seg->vm_segtype; + if (segtype == SEG_TYPE_SC || + ((segtype == SEG_TYPE_SR || segtype == SEG_TYPE_ER) && !do_nonshared)) seg->res->flags |= IORESOURCE_READONLY;
/* Check for overlapping resources before adding the mapping. */ @@ -386,7 +388,7 @@ __segment_load (char *name, int do_nonsh out_free: kfree(seg); out: - return rc; + return rc < 0 ? rc : segtype; }
/*
From: Ilya Leoshkevich iii@linux.ibm.com
commit e9c9cb90e76ffaabcc7ca8f275d9e82195fd6367 upstream.
When debugging vmlinux with QEMU + GDB, the following GDB error may occur:
(gdb) c Continuing. Warning: Cannot insert breakpoint -1. Cannot access memory at address 0xffffffffffff95c0
Command aborted. (gdb)
The reason is that, when .interp section is present, GDB tries to locate the file specified in it in memory and put a number of breakpoints there (see enable_break() function in gdb/solib-svr4.c). Sometimes GDB finds a bogus location that matches its heuristics, fails to set a breakpoint and stops. This makes further debugging impossible.
The .interp section contains misleading information anyway (vmlinux does not need ld.so), so fix by discarding it.
Signed-off-by: Ilya Leoshkevich iii@linux.ibm.com Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/s390/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+)
--- a/arch/s390/kernel/vmlinux.lds.S +++ b/arch/s390/kernel/vmlinux.lds.S @@ -228,5 +228,6 @@ SECTIONS DISCARDS /DISCARD/ : { *(.eh_frame) + *(.interp) } }
From: Sven Schnelle svens@linux.ibm.com
commit c676aac66f5b2b03a1090bc6b1891486255f7159 upstream.
In the current code each reipl type implements its own pair of loadparm show/store functions. Add a macro to deduplicate the code a bit.
Reviewed-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Sven Schnelle svens@linux.ibm.com Fixes: 87fd22e0ae92 ("s390/ipl: add eckd support") Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/s390/kernel/ipl.c | 91 ++++++++++-------------------------------- 1 file changed, 20 insertions(+), 71 deletions(-)
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c index 406766c894fb..d7b433261145 100644 --- a/arch/s390/kernel/ipl.c +++ b/arch/s390/kernel/ipl.c @@ -888,23 +888,26 @@ static ssize_t reipl_generic_loadparm_store(struct ipl_parameter_block *ipb, return len; }
-/* FCP wrapper */ -static ssize_t reipl_fcp_loadparm_show(struct kobject *kobj, - struct kobj_attribute *attr, char *page) -{ - return reipl_generic_loadparm_show(reipl_block_fcp, page); -} - -static ssize_t reipl_fcp_loadparm_store(struct kobject *kobj, - struct kobj_attribute *attr, - const char *buf, size_t len) -{ - return reipl_generic_loadparm_store(reipl_block_fcp, buf, len); -} - -static struct kobj_attribute sys_reipl_fcp_loadparm_attr = - __ATTR(loadparm, 0644, reipl_fcp_loadparm_show, - reipl_fcp_loadparm_store); +#define DEFINE_GENERIC_LOADPARM(name) \ +static ssize_t reipl_##name##_loadparm_show(struct kobject *kobj, \ + struct kobj_attribute *attr, char *page) \ +{ \ + return reipl_generic_loadparm_show(reipl_block_##name, page); \ +} \ +static ssize_t reipl_##name##_loadparm_store(struct kobject *kobj, \ + struct kobj_attribute *attr, \ + const char *buf, size_t len) \ +{ \ + return reipl_generic_loadparm_store(reipl_block_##name, buf, len); \ +} \ +static struct kobj_attribute sys_reipl_##name##_loadparm_attr = \ + __ATTR(loadparm, 0644, reipl_##name##_loadparm_show, \ + reipl_##name##_loadparm_store) + +DEFINE_GENERIC_LOADPARM(fcp); +DEFINE_GENERIC_LOADPARM(nvme); +DEFINE_GENERIC_LOADPARM(ccw); +DEFINE_GENERIC_LOADPARM(nss);
static ssize_t reipl_fcp_clear_show(struct kobject *kobj, struct kobj_attribute *attr, char *page) @@ -994,24 +997,6 @@ DEFINE_IPL_ATTR_RW(reipl_nvme, bootprog, "%lld\n", "%lld\n", DEFINE_IPL_ATTR_RW(reipl_nvme, br_lba, "%lld\n", "%lld\n", reipl_block_nvme->nvme.br_lba);
-/* nvme wrapper */ -static ssize_t reipl_nvme_loadparm_show(struct kobject *kobj, - struct kobj_attribute *attr, char *page) -{ - return reipl_generic_loadparm_show(reipl_block_nvme, page); -} - -static ssize_t reipl_nvme_loadparm_store(struct kobject *kobj, - struct kobj_attribute *attr, - const char *buf, size_t len) -{ - return reipl_generic_loadparm_store(reipl_block_nvme, buf, len); -} - -static struct kobj_attribute sys_reipl_nvme_loadparm_attr = - __ATTR(loadparm, 0644, reipl_nvme_loadparm_show, - reipl_nvme_loadparm_store); - static struct attribute *reipl_nvme_attrs[] = { &sys_reipl_nvme_fid_attr.attr, &sys_reipl_nvme_nsid_attr.attr, @@ -1047,38 +1032,6 @@ static struct kobj_attribute sys_reipl_nvme_clear_attr = /* CCW reipl device attributes */ DEFINE_IPL_CCW_ATTR_RW(reipl_ccw, device, reipl_block_ccw->ccw);
-/* NSS wrapper */ -static ssize_t reipl_nss_loadparm_show(struct kobject *kobj, - struct kobj_attribute *attr, char *page) -{ - return reipl_generic_loadparm_show(reipl_block_nss, page); -} - -static ssize_t reipl_nss_loadparm_store(struct kobject *kobj, - struct kobj_attribute *attr, - const char *buf, size_t len) -{ - return reipl_generic_loadparm_store(reipl_block_nss, buf, len); -} - -/* CCW wrapper */ -static ssize_t reipl_ccw_loadparm_show(struct kobject *kobj, - struct kobj_attribute *attr, char *page) -{ - return reipl_generic_loadparm_show(reipl_block_ccw, page); -} - -static ssize_t reipl_ccw_loadparm_store(struct kobject *kobj, - struct kobj_attribute *attr, - const char *buf, size_t len) -{ - return reipl_generic_loadparm_store(reipl_block_ccw, buf, len); -} - -static struct kobj_attribute sys_reipl_ccw_loadparm_attr = - __ATTR(loadparm, 0644, reipl_ccw_loadparm_show, - reipl_ccw_loadparm_store); - static ssize_t reipl_ccw_clear_show(struct kobject *kobj, struct kobj_attribute *attr, char *page) { @@ -1251,10 +1204,6 @@ static struct kobj_attribute sys_reipl_nss_name_attr = __ATTR(name, 0644, reipl_nss_name_show, reipl_nss_name_store);
-static struct kobj_attribute sys_reipl_nss_loadparm_attr = - __ATTR(loadparm, 0644, reipl_nss_loadparm_show, - reipl_nss_loadparm_store); - static struct attribute *reipl_nss_attrs[] = { &sys_reipl_nss_name_attr.attr, &sys_reipl_nss_loadparm_attr.attr,
From: Sven Schnelle svens@linux.ibm.com
commit 6bb361d5d8eb1dbc9e0b190eeee27a2ac4d1119f upstream.
commit 87fd22e0ae92 ("s390/ipl: add eckd support") missed to add the loadparm attribute to the new eckd ipl/reipl data.
Fixes: 87fd22e0ae92 ("s390/ipl: add eckd support") Cc: stable@vger.kernel.org Signed-off-by: Sven Schnelle svens@linux.ibm.com Reviewed-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/s390/kernel/ipl.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c index d7b433261145..5f0f5c86963a 100644 --- a/arch/s390/kernel/ipl.c +++ b/arch/s390/kernel/ipl.c @@ -593,6 +593,7 @@ static struct attribute *ipl_eckd_attrs[] = { &sys_ipl_type_attr.attr, &sys_ipl_eckd_bootprog_attr.attr, &sys_ipl_eckd_br_chr_attr.attr, + &sys_ipl_ccw_loadparm_attr.attr, &sys_ipl_device_attr.attr, &sys_ipl_secure_attr.attr, &sys_ipl_has_secure_attr.attr, @@ -908,6 +909,7 @@ DEFINE_GENERIC_LOADPARM(fcp); DEFINE_GENERIC_LOADPARM(nvme); DEFINE_GENERIC_LOADPARM(ccw); DEFINE_GENERIC_LOADPARM(nss); +DEFINE_GENERIC_LOADPARM(eckd);
static ssize_t reipl_fcp_clear_show(struct kobject *kobj, struct kobj_attribute *attr, char *page) @@ -1129,6 +1131,7 @@ static struct attribute *reipl_eckd_attrs[] = { &sys_reipl_eckd_device_attr.attr, &sys_reipl_eckd_bootprog_attr.attr, &sys_reipl_eckd_br_chr_attr.attr, + &sys_reipl_eckd_loadparm_attr.attr, NULL, };
From: Vasily Gorbik gor@linux.ibm.com
commit 42e19e6f04984088b6f9f0507c4c89a8152d9730 upstream.
Recent test_kprobe_missed kprobes kunit test uncovers the following error (reported when CONFIG_DEBUG_ATOMIC_SLEEP is enabled):
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 662, name: kunit_try_catch preempt_count: 0, expected: 0 RCU nest depth: 0, expected: 0 no locks held by kunit_try_catch/662. irq event stamp: 280 hardirqs last enabled at (279): [<00000003e60a3d42>] __do_pgm_check+0x17a/0x1c0 hardirqs last disabled at (280): [<00000003e3bd774a>] kprobe_exceptions_notify+0x27a/0x318 softirqs last enabled at (0): [<00000003e3c5c890>] copy_process+0x14a8/0x4c80 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 46 PID: 662 Comm: kunit_try_catch Tainted: G N 6.2.0-173644-g44c18d77f0c0 #2 Hardware name: IBM 3931 A01 704 (LPAR) Call Trace: [<00000003e60a3a00>] dump_stack_lvl+0x120/0x198 [<00000003e3d02e82>] __might_resched+0x60a/0x668 [<00000003e60b9908>] __mutex_lock+0xc0/0x14e0 [<00000003e60bad5a>] mutex_lock_nested+0x32/0x40 [<00000003e3f7b460>] unregister_kprobe+0x30/0xd8 [<00000003e51b2602>] test_kprobe_missed+0xf2/0x268 [<00000003e51b5406>] kunit_try_run_case+0x10e/0x290 [<00000003e51b7dfa>] kunit_generic_run_threadfn_adapter+0x62/0xb8 [<00000003e3ce30f8>] kthread+0x2d0/0x398 [<00000003e3b96afa>] __ret_from_fork+0x8a/0xe8 [<00000003e60ccada>] ret_from_fork+0xa/0x40
The reason for this error report is that kprobes handling code failed to restore irqs.
The problem is that when kprobe is triggered from another kprobe post_handler current sequence of enable_singlestep / disable_singlestep is the following: enable_singlestep <- original kprobe (saves kprobe_saved_imask) enable_singlestep <- kprobe triggered from post_handler (clobbers kprobe_saved_imask) disable_singlestep <- kprobe triggered from post_handler (restores kprobe_saved_imask) disable_singlestep <- original kprobe (restores wrong clobbered kprobe_saved_imask)
There is just one kprobe_ctlblk per cpu and both calls saves and loads irq mask to kprobe_saved_imask. To fix the problem simply move resume_execution (which calls disable_singlestep) before calling post_handler. This also fixes the problem that post_handler is called with pt_regs which were not yet adjusted after single-stepping.
Cc: stable@vger.kernel.org Fixes: 4ba069b802c2 ("[S390] add kprobes support.") Reviewed-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Vasily Gorbik gor@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/s390/kernel/kprobes.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/s390/kernel/kprobes.c +++ b/arch/s390/kernel/kprobes.c @@ -432,12 +432,11 @@ static int post_kprobe_handler(struct pt if (!p) return 0;
+ resume_execution(p, regs); if (kcb->kprobe_status != KPROBE_REENTER && p->post_handler) { kcb->kprobe_status = KPROBE_HIT_SSDONE; p->post_handler(p, regs, 0); } - - resume_execution(p, regs); pop_kprobe(kcb); preempt_enable_no_resched();
From: Vasily Gorbik gor@linux.ibm.com
commit cd57953936f2213dfaccce10d20f396956222c7d upstream.
Recent test_kprobe_missed kprobes kunit test uncovers the following problem. Once kprobe is triggered from another kprobe (kprobe reenter), all future kprobes on this cpu are considered as kprobe reenter, thus pre_handler and post_handler are not being called and kprobes are counted as "missed".
Commit b9599798f953 ("[S390] kprobes: activation and deactivation") introduced a simpler scheme for kprobes (de)activation and status tracking by using push_kprobe/pop_kprobe, which supposed to work for both initial kprobe entry as well as kprobe reentry and helps to avoid handling those two cases differently. The problem is that a sequence of calls in case of kprobes reenter: push_kprobe() <- NULL (current_kprobe) push_kprobe() <- kprobe1 (current_kprobe) pop_kprobe() -> kprobe1 (current_kprobe) pop_kprobe() -> kprobe1 (current_kprobe) leaves "kprobe1" as "current_kprobe" on this cpu, instead of setting it to NULL. In fact push_kprobe/pop_kprobe can only store a single state (there is just one prev_kprobe in kprobe_ctlblk). Which is a hack but sufficient, there is no need to have another prev_kprobe just to store NULL. To make a simple and backportable fix simply reset "prev_kprobe" when kprobe is poped from this "stack". No need to worry about "kprobe_status" in this case, because its value is only checked when current_kprobe != NULL.
Cc: stable@vger.kernel.org Fixes: b9599798f953 ("[S390] kprobes: activation and deactivation") Reviewed-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Vasily Gorbik gor@linux.ibm.com Signed-off-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/s390/kernel/kprobes.c | 1 + 1 file changed, 1 insertion(+)
--- a/arch/s390/kernel/kprobes.c +++ b/arch/s390/kernel/kprobes.c @@ -278,6 +278,7 @@ static void pop_kprobe(struct kprobe_ctl { __this_cpu_write(current_kprobe, kcb->prev_kprobe.kp); kcb->kprobe_status = kcb->prev_kprobe.status; + kcb->prev_kprobe.kp = NULL; } NOKPROBE_SYMBOL(pop_kprobe);
From: Nico Boehr nrb@linux.ibm.com
commit f2d3155e2a6bac44d16f04415a321e8707d895c6 upstream.
Migration mode is a VM attribute which enables tracking of changes in storage attributes (PGSTE). It assumes dirty tracking is enabled on all memslots to keep a dirty bitmap of pages with changed storage attributes.
When enabling migration mode, we currently check that dirty tracking is enabled for all memslots. However, userspace can disable dirty tracking without disabling migration mode.
Since migration mode is pointless with dirty tracking disabled, disable migration mode whenever userspace disables dirty tracking on any slot.
Also update the documentation to clarify that dirty tracking must be enabled when enabling migration mode, which is already enforced by the code in kvm_s390_vm_start_migration().
Also highlight in the documentation for KVM_S390_GET_CMMA_BITS that it can now fail with -EINVAL when dirty tracking is disabled while migration mode is on. Move all the error codes to a table so this stays readable.
To disable migration mode, slots_lock should be held, which is taken in kvm_set_memory_region() and thus held in kvm_arch_prepare_memory_region().
Restructure the prepare code a bit so all the sanity checking is done before disabling migration mode. This ensures migration mode isn't disabled when some sanity check fails.
Cc: stable@vger.kernel.org Fixes: 190df4a212a7 ("KVM: s390: CMMA tracking, ESSA emulation, migration mode") Signed-off-by: Nico Boehr nrb@linux.ibm.com Reviewed-by: Janosch Frank frankja@linux.ibm.com Reviewed-by: Claudio Imbrenda imbrenda@linux.ibm.com Link: https://lore.kernel.org/r/20230127140532.230651-2-nrb@linux.ibm.com Message-Id: 20230127140532.230651-2-nrb@linux.ibm.com [frankja@linux.ibm.com: fixed commit message typo, moved api.rst error table upwards] Signed-off-by: Janosch Frank frankja@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- Documentation/virt/kvm/api.rst | 18 ++++++++----- Documentation/virt/kvm/devices/vm.rst | 4 ++ arch/s390/kvm/kvm-s390.c | 47 +++++++++++++++++++++++----------- 3 files changed, 48 insertions(+), 21 deletions(-)
--- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -4457,6 +4457,18 @@ not holding a previously reported uncorr :Parameters: struct kvm_s390_cmma_log (in, out) :Returns: 0 on success, a negative value on error
+Errors: + + ====== ============================================================= + ENOMEM not enough memory can be allocated to complete the task + ENXIO if CMMA is not enabled + EINVAL if KVM_S390_CMMA_PEEK is not set but migration mode was not enabled + EINVAL if KVM_S390_CMMA_PEEK is not set but dirty tracking has been + disabled (and thus migration mode was automatically disabled) + EFAULT if the userspace address is invalid or if no page table is + present for the addresses (e.g. when using hugepages). + ====== ============================================================= + This ioctl is used to get the values of the CMMA bits on the s390 architecture. It is meant to be used in two scenarios:
@@ -4537,12 +4549,6 @@ mask is unused.
values points to the userspace buffer where the result will be stored.
-This ioctl can fail with -ENOMEM if not enough memory can be allocated to -complete the task, with -ENXIO if CMMA is not enabled, with -EINVAL if -KVM_S390_CMMA_PEEK is not set but migration mode was not enabled, with --EFAULT if the userspace address is invalid or if no page table is -present for the addresses (e.g. when using hugepages). - 4.108 KVM_S390_SET_CMMA_BITS ----------------------------
--- a/Documentation/virt/kvm/devices/vm.rst +++ b/Documentation/virt/kvm/devices/vm.rst @@ -302,6 +302,10 @@ Allows userspace to start migration mode Setting this attribute when migration mode is already active will have no effects.
+Dirty tracking must be enabled on all memslots, else -EINVAL is returned. When +dirty tracking is disabled on any memslot, migration mode is automatically +stopped. + :Parameters: none :Returns: -ENOMEM if there is not enough free memory to start migration mode; -EINVAL if the state of the VM is invalid (e.g. no memory defined); --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -5633,23 +5633,40 @@ int kvm_arch_prepare_memory_region(struc if (kvm_s390_pv_get_handle(kvm)) return -EINVAL;
- if (change == KVM_MR_DELETE || change == KVM_MR_FLAGS_ONLY) - return 0; - - /* A few sanity checks. We can have memory slots which have to be - located/ended at a segment boundary (1MB). The memory in userland is - ok to be fragmented into various different vmas. It is okay to mmap() - and munmap() stuff in this slot after doing this call at any time */ - - if (new->userspace_addr & 0xffffful) - return -EINVAL; + if (change != KVM_MR_DELETE && change != KVM_MR_FLAGS_ONLY) { + /* + * A few sanity checks. We can have memory slots which have to be + * located/ended at a segment boundary (1MB). The memory in userland is + * ok to be fragmented into various different vmas. It is okay to mmap() + * and munmap() stuff in this slot after doing this call at any time + */ + + if (new->userspace_addr & 0xffffful) + return -EINVAL; + + size = new->npages * PAGE_SIZE; + if (size & 0xffffful) + return -EINVAL; + + if ((new->base_gfn * PAGE_SIZE) + size > kvm->arch.mem_limit) + return -EINVAL; + }
- size = new->npages * PAGE_SIZE; - if (size & 0xffffful) - return -EINVAL; + if (!kvm->arch.migration_mode) + return 0;
- if ((new->base_gfn * PAGE_SIZE) + size > kvm->arch.mem_limit) - return -EINVAL; + /* + * Turn off migration mode when: + * - userspace creates a new memslot with dirty logging off, + * - userspace modifies an existing memslot (MOVE or FLAGS_ONLY) and + * dirty logging is turned off. + * Migration mode expects dirty page logging being enabled to store + * its dirty bitmap. + */ + if (change != KVM_MR_DELETE && + !(new->flags & KVM_MEM_LOG_DIRTY_PAGES)) + WARN(kvm_s390_vm_stop_migration(kvm), + "Failed to stop migration mode");
return 0; }
From: Paulo Alcantara pc@manguebit.com
commit b9ee2e307c6b06384b6f9e393a9b8e048e8fc277 upstream.
Do not map STATUS_OBJECT_NAME_INVALID to -EREMOTE under non-DFS shares, or 'nodfs' mounts or CONFIG_CIFS_DFS_UPCALL=n builds. Otherwise, in the slow path, get a referral to figure out whether it is an actual DFS link.
This could be simply reproduced under a non-DFS share by running the following
$ mount.cifs //srv/share /mnt -o ... $ cat /mnt/$(printf '\U110000') cat: '/mnt/'$'\364\220\200\200': Object is remote
Fixes: c877ce47e137 ("cifs: reduce roundtrips on create/qinfo requests") CC: stable@vger.kernel.org # 6.2 Signed-off-by: Paulo Alcantara (SUSE) pc@manguebit.com Reviewed-by: Ronnie Sahlberg lsahlber@redhat.com Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/cifsproto.h | 20 +++++++++++---- fs/cifs/misc.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++++++++ fs/cifs/smb2inode.c | 21 ++++++++-------- fs/cifs/smb2ops.c | 23 ++++++++++------- 4 files changed, 106 insertions(+), 25 deletions(-)
--- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -670,11 +670,21 @@ static inline int get_dfs_path(const uns int match_target_ip(struct TCP_Server_Info *server, const char *share, size_t share_len, bool *result); - -int cifs_dfs_query_info_nonascii_quirk(const unsigned int xid, - struct cifs_tcon *tcon, - struct cifs_sb_info *cifs_sb, - const char *dfs_link_path); +int cifs_inval_name_dfs_link_error(const unsigned int xid, + struct cifs_tcon *tcon, + struct cifs_sb_info *cifs_sb, + const char *full_path, + bool *islink); +#else +static inline int cifs_inval_name_dfs_link_error(const unsigned int xid, + struct cifs_tcon *tcon, + struct cifs_sb_info *cifs_sb, + const char *full_path, + bool *islink) +{ + *islink = false; + return 0; +} #endif
static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options) --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -21,6 +21,7 @@ #include "cifsfs.h" #ifdef CONFIG_CIFS_DFS_UPCALL #include "dns_resolve.h" +#include "dfs_cache.h" #endif #include "fs_context.h" #include "cached_dir.h" @@ -1300,4 +1301,70 @@ int cifs_update_super_prepath(struct cif cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH; return 0; } + +/* + * Handle weird Windows SMB server behaviour. It responds with + * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request for + * "<server><dfsname><linkpath>" DFS reference, where <dfsname> contains + * non-ASCII unicode symbols. + */ +int cifs_inval_name_dfs_link_error(const unsigned int xid, + struct cifs_tcon *tcon, + struct cifs_sb_info *cifs_sb, + const char *full_path, + bool *islink) +{ + struct cifs_ses *ses = tcon->ses; + size_t len; + char *path; + char *ref_path; + + *islink = false; + + /* + * Fast path - skip check when @full_path doesn't have a prefix path to + * look up or tcon is not DFS. + */ + if (strlen(full_path) < 2 || !cifs_sb || + (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS) || + !is_tcon_dfs(tcon) || !ses->server->origin_fullpath) + return 0; + + /* + * Slow path - tcon is DFS and @full_path has prefix path, so attempt + * to get a referral to figure out whether it is an DFS link. + */ + len = strnlen(tcon->tree_name, MAX_TREE_SIZE + 1) + strlen(full_path) + 1; + path = kmalloc(len, GFP_KERNEL); + if (!path) + return -ENOMEM; + + scnprintf(path, len, "%s%s", tcon->tree_name, full_path); + ref_path = dfs_cache_canonical_path(path + 1, cifs_sb->local_nls, + cifs_remap(cifs_sb)); + kfree(path); + + if (IS_ERR(ref_path)) { + if (PTR_ERR(ref_path) != -EINVAL) + return PTR_ERR(ref_path); + } else { + struct dfs_info3_param *refs = NULL; + int num_refs = 0; + + /* + * XXX: we are not using dfs_cache_find() here because we might + * end filling all the DFS cache and thus potentially + * removing cached DFS targets that the client would eventually + * need during failover. + */ + if (ses->server->ops->get_dfs_refer && + !ses->server->ops->get_dfs_refer(xid, ses, ref_path, &refs, + &num_refs, cifs_sb->local_nls, + cifs_remap(cifs_sb))) + *islink = refs[0].server_type == DFS_TYPE_LINK; + free_dfs_info_array(refs, num_refs); + kfree(ref_path); + } + return 0; +} #endif --- a/fs/cifs/smb2inode.c +++ b/fs/cifs/smb2inode.c @@ -526,12 +526,13 @@ int smb2_query_path_info(const unsigned struct cifs_sb_info *cifs_sb, const char *full_path, struct cifs_open_info_data *data, bool *adjust_tz, bool *reparse) { - int rc; __u32 create_options = 0; struct cifsFileInfo *cfile; struct cached_fid *cfid = NULL; struct kvec err_iov[3] = {}; int err_buftype[3] = {}; + bool islink; + int rc, rc2;
*adjust_tz = false; *reparse = false; @@ -579,15 +580,15 @@ int smb2_query_path_info(const unsigned SMB2_OP_QUERY_INFO, cfile, NULL, NULL, NULL, NULL); goto out; - } else if (rc != -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && - hdr->Status == STATUS_OBJECT_NAME_INVALID) { - /* - * Handle weird Windows SMB server behaviour. It responds with - * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request - * for "<server><dfsname><linkpath>" DFS reference, - * where <dfsname> contains non-ASCII unicode symbols. - */ - rc = -EREMOTE; + } else if (rc != -EREMOTE && hdr->Status == STATUS_OBJECT_NAME_INVALID) { + rc2 = cifs_inval_name_dfs_link_error(xid, tcon, cifs_sb, + full_path, &islink); + if (rc2) { + rc = rc2; + goto out; + } + if (islink) + rc = -EREMOTE; } if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb && (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)) --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -794,7 +794,6 @@ static int smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon, struct cifs_sb_info *cifs_sb, const char *full_path) { - int rc; __le16 *utf16_path; __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; int err_buftype = CIFS_NO_BUFFER; @@ -802,6 +801,8 @@ smb2_is_path_accessible(const unsigned i struct kvec err_iov = {}; struct cifs_fid fid; struct cached_fid *cfid; + bool islink; + int rc, rc2;
rc = open_cached_dir(xid, tcon, full_path, cifs_sb, true, &cfid); if (!rc) { @@ -830,15 +831,17 @@ smb2_is_path_accessible(const unsigned i
if (unlikely(!hdr || err_buftype == CIFS_NO_BUFFER)) goto out; - /* - * Handle weird Windows SMB server behaviour. It responds with - * STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request - * for "<server><dfsname><linkpath>" DFS reference, - * where <dfsname> contains non-ASCII unicode symbols. - */ - if (rc != -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && - hdr->Status == STATUS_OBJECT_NAME_INVALID) - rc = -EREMOTE; + + if (rc != -EREMOTE && hdr->Status == STATUS_OBJECT_NAME_INVALID) { + rc2 = cifs_inval_name_dfs_link_error(xid, tcon, cifs_sb, + full_path, &islink); + if (rc2) { + rc = rc2; + goto out; + } + if (islink) + rc = -EREMOTE; + } if (rc == -EREMOTE && IS_ENABLED(CONFIG_CIFS_DFS_UPCALL) && cifs_sb && (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_DFS)) rc = -EOPNOTSUPP;
From: Volker Lendecke vl@samba.org
commit d447e794a37288ec7a080aa1b044a8d9deebbab7 upstream.
oparms was not fully initialized
Signed-off-by: Volker Lendecke vl@samba.org Reviewed-by: Paulo Alcantara (SUSE) pc@cjr.nz Cc: stable@vger.kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/smb2ops.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
--- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -729,12 +729,13 @@ smb3_qfs_tcon(const unsigned int xid, st struct cifs_fid fid; struct cached_fid *cfid = NULL;
- oparms.tcon = tcon; - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), + .fid = &fid, + };
rc = open_cached_dir(xid, tcon, "", cifs_sb, false, &cfid); if (rc == 0)
From: Volker Lendecke vl@samba.org
commit de036dcaca65cf94bf7ff09c571c077f02bc92b4 upstream.
Use a struct assignment with implicit member initialization
Signed-off-by: Volker Lendecke vl@samba.org Cc: stable@vger.kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/cached_dir.c | 13 +-- fs/cifs/cifsacl.c | 34 ++++----- fs/cifs/cifssmb.c | 17 ++-- fs/cifs/dir.c | 19 ++--- fs/cifs/file.c | 35 +++++---- fs/cifs/inode.c | 53 +++++++------- fs/cifs/link.c | 66 +++++++++-------- fs/cifs/smb1ops.c | 72 ++++++++++--------- fs/cifs/smb2inode.c | 17 ++-- fs/cifs/smb2ops.c | 191 ++++++++++++++++++++++++++------------------------- 10 files changed, 274 insertions(+), 243 deletions(-)
--- a/fs/cifs/cached_dir.c +++ b/fs/cifs/cached_dir.c @@ -181,12 +181,13 @@ int open_cached_dir(unsigned int xid, st rqst[0].rq_iov = open_iov; rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
- oparms.tcon = tcon; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE); - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.disposition = FILE_OPEN; - oparms.fid = pfid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_FILE), + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .fid = pfid, + };
rc = SMB2_open_init(tcon, server, &rqst[0], &oplock, &oparms, utf16_path); --- a/fs/cifs/cifsacl.c +++ b/fs/cifs/cifsacl.c @@ -1428,14 +1428,15 @@ static struct cifs_ntsd *get_cifs_acl_by tcon = tlink_tcon(tlink); xid = get_xid();
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = READ_CONTROL; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.disposition = FILE_OPEN; - oparms.path = path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = READ_CONTROL, + .create_options = cifs_create_options(cifs_sb, 0), + .disposition = FILE_OPEN, + .path = path, + .fid = &fid, + };
rc = CIFS_open(xid, &oparms, &oplock, NULL); if (!rc) { @@ -1494,14 +1495,15 @@ int set_cifs_acl(struct cifs_ntsd *pnnts else access_flags = WRITE_DAC;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = access_flags; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.disposition = FILE_OPEN; - oparms.path = path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = access_flags, + .create_options = cifs_create_options(cifs_sb, 0), + .disposition = FILE_OPEN, + .path = path, + .fid = &fid, + };
rc = CIFS_open(xid, &oparms, &oplock, NULL); if (rc) { --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -5372,14 +5372,15 @@ CIFSSMBSetPathInfoFB(const unsigned int struct cifs_fid fid; int rc;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = GENERIC_WRITE; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.disposition = FILE_OPEN; - oparms.path = fileName; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = GENERIC_WRITE, + .create_options = cifs_create_options(cifs_sb, 0), + .disposition = FILE_OPEN, + .path = fileName, + .fid = &fid, + };
rc = CIFS_open(xid, &oparms, &oplock, NULL); if (rc) --- a/fs/cifs/dir.c +++ b/fs/cifs/dir.c @@ -304,15 +304,16 @@ static int cifs_do_create(struct inode * if (!tcon->unix_ext && (mode & S_IWUGO) == 0) create_options |= CREATE_OPTION_READONLY;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = desired_access; - oparms.create_options = cifs_create_options(cifs_sb, create_options); - oparms.disposition = disposition; - oparms.path = full_path; - oparms.fid = fid; - oparms.reconnect = false; - oparms.mode = mode; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = desired_access, + .create_options = cifs_create_options(cifs_sb, create_options), + .disposition = disposition, + .path = full_path, + .fid = fid, + .mode = mode, + }; rc = server->ops->open(xid, &oparms, oplock, buf); if (rc) { cifs_dbg(FYI, "cifs_create returned 0x%x\n", rc); --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -260,14 +260,15 @@ static int cifs_nt_open(const char *full if (f_flags & O_DIRECT) create_options |= CREATE_NO_BUFFER;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = desired_access; - oparms.create_options = cifs_create_options(cifs_sb, create_options); - oparms.disposition = disposition; - oparms.path = full_path; - oparms.fid = fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = desired_access, + .create_options = cifs_create_options(cifs_sb, create_options), + .disposition = disposition, + .path = full_path, + .fid = fid, + };
rc = server->ops->open(xid, &oparms, oplock, buf); if (rc) @@ -848,14 +849,16 @@ cifs_reopen_file(struct cifsFileInfo *cf if (server->ops->get_lease_key) server->ops->get_lease_key(inode, &cfile->fid);
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = desired_access; - oparms.create_options = cifs_create_options(cifs_sb, create_options); - oparms.disposition = disposition; - oparms.path = full_path; - oparms.fid = &cfile->fid; - oparms.reconnect = true; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = desired_access, + .create_options = cifs_create_options(cifs_sb, create_options), + .disposition = disposition, + .path = full_path, + .fid = &cfile->fid, + .reconnect = true, + };
/* * Can not refresh inode by passing in file_info buf to be returned by --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -508,14 +508,15 @@ cifs_sfu_type(struct cifs_fattr *fattr, return PTR_ERR(tlink); tcon = tlink_tcon(tlink);
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = GENERIC_READ; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); - oparms.disposition = FILE_OPEN; - oparms.path = path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = GENERIC_READ, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_OPEN, + .path = path, + .fid = &fid, + };
if (tcon->ses->server->oplocks) oplock = REQ_OPLOCK; @@ -1518,14 +1519,15 @@ cifs_rename_pending_delete(const char *f goto out; }
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = DELETE | FILE_WRITE_ATTRIBUTES; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); - oparms.disposition = FILE_OPEN; - oparms.path = full_path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = DELETE | FILE_WRITE_ATTRIBUTES, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_OPEN, + .path = full_path, + .fid = &fid, + };
rc = CIFS_open(xid, &oparms, &oplock, NULL); if (rc != 0) @@ -2112,15 +2114,16 @@ cifs_do_rename(const unsigned int xid, s if (to_dentry->d_parent != from_dentry->d_parent) goto do_rename_exit;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - /* open the file to be renamed -- we need DELETE perms */ - oparms.desired_access = DELETE; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); - oparms.disposition = FILE_OPEN; - oparms.path = from_path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + /* open the file to be renamed -- we need DELETE perms */ + .desired_access = DELETE, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_OPEN, + .path = from_path, + .fid = &fid, + };
rc = CIFS_open(xid, &oparms, &oplock, NULL); if (rc == 0) { --- a/fs/cifs/link.c +++ b/fs/cifs/link.c @@ -271,14 +271,15 @@ cifs_query_mf_symlink(unsigned int xid, int buf_type = CIFS_NO_BUFFER; FILE_ALL_INFO file_info;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = GENERIC_READ; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); - oparms.disposition = FILE_OPEN; - oparms.path = path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = GENERIC_READ, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_OPEN, + .path = path, + .fid = &fid, + };
rc = CIFS_open(xid, &oparms, &oplock, &file_info); if (rc) @@ -313,14 +314,15 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_open_parms oparms; struct cifs_io_parms io_parms = {0};
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = GENERIC_WRITE; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); - oparms.disposition = FILE_CREATE; - oparms.path = path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = GENERIC_WRITE, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_CREATE, + .path = path, + .fid = &fid, + };
rc = CIFS_open(xid, &oparms, &oplock, NULL); if (rc) @@ -355,13 +357,14 @@ smb3_query_mf_symlink(unsigned int xid, __u8 oplock = SMB2_OPLOCK_LEVEL_NONE; struct smb2_file_all_info *pfile_info = NULL;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = GENERIC_READ; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); - oparms.disposition = FILE_OPEN; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = GENERIC_READ, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_OPEN, + .fid = &fid, + };
utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); if (utf16_path == NULL) @@ -421,14 +424,15 @@ smb3_create_mf_symlink(unsigned int xid, if (!utf16_path) return -ENOMEM;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = GENERIC_WRITE; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); - oparms.disposition = FILE_CREATE; - oparms.fid = &fid; - oparms.reconnect = false; - oparms.mode = 0644; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = GENERIC_WRITE, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_CREATE, + .fid = &fid, + .mode = 0644, + };
rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, NULL, NULL); --- a/fs/cifs/smb1ops.c +++ b/fs/cifs/smb1ops.c @@ -576,14 +576,15 @@ static int cifs_query_path_info(const un if (!(le32_to_cpu(fi.Attributes) & ATTR_REPARSE)) return 0;
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.disposition = FILE_OPEN; - oparms.path = full_path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = FILE_READ_ATTRIBUTES, + .create_options = cifs_create_options(cifs_sb, 0), + .disposition = FILE_OPEN, + .path = full_path, + .fid = &fid, + };
/* Need to check if this is a symbolic link or not */ tmprc = CIFS_open(xid, &oparms, &oplock, NULL); @@ -823,14 +824,15 @@ smb_set_file_info(struct inode *inode, c goto out; }
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = SYNCHRONIZE | FILE_WRITE_ATTRIBUTES; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR); - oparms.disposition = FILE_OPEN; - oparms.path = full_path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = SYNCHRONIZE | FILE_WRITE_ATTRIBUTES, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR), + .disposition = FILE_OPEN, + .path = full_path, + .fid = &fid, + };
cifs_dbg(FYI, "calling SetFileInfo since SetPathInfo for times not supported by this server\n"); rc = CIFS_open(xid, &oparms, &oplock, NULL); @@ -998,15 +1000,16 @@ cifs_query_symlink(const unsigned int xi goto out; }
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.create_options = cifs_create_options(cifs_sb, - OPEN_REPARSE_POINT); - oparms.disposition = FILE_OPEN; - oparms.path = full_path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = FILE_READ_ATTRIBUTES, + .create_options = cifs_create_options(cifs_sb, + OPEN_REPARSE_POINT), + .disposition = FILE_OPEN, + .path = full_path, + .fid = &fid, + };
rc = CIFS_open(xid, &oparms, &oplock, NULL); if (rc) @@ -1115,15 +1118,16 @@ cifs_make_node(unsigned int xid, struct
cifs_dbg(FYI, "sfu compat create special file\n");
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = GENERIC_WRITE; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | - CREATE_OPTION_SPECIAL); - oparms.disposition = FILE_CREATE; - oparms.path = full_path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = GENERIC_WRITE, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | + CREATE_OPTION_SPECIAL), + .disposition = FILE_CREATE, + .path = full_path, + .fid = &fid, + };
if (tcon->ses->server->oplocks) oplock = REQ_OPLOCK; --- a/fs/cifs/smb2inode.c +++ b/fs/cifs/smb2inode.c @@ -105,14 +105,15 @@ static int smb2_compound_op(const unsign goto finished; }
- vars->oparms.tcon = tcon; - vars->oparms.desired_access = desired_access; - vars->oparms.disposition = create_disposition; - vars->oparms.create_options = cifs_create_options(cifs_sb, create_options); - vars->oparms.fid = &fid; - vars->oparms.reconnect = false; - vars->oparms.mode = mode; - vars->oparms.cifs_sb = cifs_sb; + vars->oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = desired_access, + .disposition = create_disposition, + .create_options = cifs_create_options(cifs_sb, create_options), + .fid = &fid, + .mode = mode, + .cifs_sb = cifs_sb, + };
rqst[num_rqst].rq_iov = &vars->open_iov[0]; rqst[num_rqst].rq_nvec = SMB2_CREATE_IOV_SIZE; --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -772,12 +772,13 @@ smb2_qfs_tcon(const unsigned int xid, st struct cifs_open_parms oparms; struct cifs_fid fid;
- oparms.tcon = tcon; - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), + .fid = &fid, + };
rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL, NULL, NULL); @@ -818,12 +819,13 @@ smb2_is_path_accessible(const unsigned i if (!utf16_path) return -ENOMEM;
- oparms.tcon = tcon; - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), + .fid = &fid, + };
rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, &err_iov, &err_buftype); @@ -1101,13 +1103,13 @@ smb2_set_ea(const unsigned int xid, stru rqst[0].rq_iov = open_iov; rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
- memset(&oparms, 0, sizeof(oparms)); - oparms.tcon = tcon; - oparms.desired_access = FILE_WRITE_EA; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_WRITE_EA, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), + .fid = &fid, + };
rc = SMB2_open_init(tcon, server, &rqst[0], &oplock, &oparms, utf16_path); @@ -1457,12 +1459,12 @@ smb2_ioctl_query_info(const unsigned int rqst[0].rq_iov = &vars->open_iov[0]; rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
- memset(&oparms, 0, sizeof(oparms)); - oparms.tcon = tcon; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, create_options); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, create_options), + .fid = &fid, + };
if (qi.flags & PASSTHRU_FSCTL) { switch (qi.info_type & FSCTL_DEVICE_ACCESS_MASK) { @@ -2092,12 +2094,13 @@ smb3_notify(const unsigned int xid, stru }
tcon = cifs_sb_master_tcon(cifs_sb); - oparms.tcon = tcon; - oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), + .fid = &fid, + };
rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, NULL, NULL); @@ -2163,12 +2166,13 @@ smb2_query_dir_first(const unsigned int rqst[0].rq_iov = open_iov; rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
- oparms.tcon = tcon; - oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.fid = fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), + .fid = fid, + };
rc = SMB2_open_init(tcon, server, &rqst[0], &oplock, &oparms, utf16_path); @@ -2494,12 +2498,13 @@ smb2_query_info_compound(const unsigned rqst[0].rq_iov = open_iov; rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
- oparms.tcon = tcon; - oparms.desired_access = desired_access; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = desired_access, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), + .fid = &fid, + };
rc = SMB2_open_init(tcon, server, &rqst[0], &oplock, &oparms, utf16_path); @@ -2627,12 +2632,13 @@ smb311_queryfs(const unsigned int xid, s if (!tcon->posix_extensions) return smb2_queryfs(xid, tcon, cifs_sb, buf);
- oparms.tcon = tcon; - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, 0), + .fid = &fid, + };
rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL, NULL, NULL); @@ -2920,13 +2926,13 @@ smb2_query_symlink(const unsigned int xi rqst[0].rq_iov = open_iov; rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
- memset(&oparms, 0, sizeof(oparms)); - oparms.tcon = tcon; - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, create_options); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, create_options), + .fid = &fid, + };
rc = SMB2_open_init(tcon, server, &rqst[0], &oplock, &oparms, utf16_path); @@ -3060,13 +3066,13 @@ smb2_query_reparse_tag(const unsigned in rqst[0].rq_iov = open_iov; rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
- memset(&oparms, 0, sizeof(oparms)); - oparms.tcon = tcon; - oparms.desired_access = FILE_READ_ATTRIBUTES; - oparms.disposition = FILE_OPEN; - oparms.create_options = cifs_create_options(cifs_sb, OPEN_REPARSE_POINT); - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = FILE_READ_ATTRIBUTES, + .disposition = FILE_OPEN, + .create_options = cifs_create_options(cifs_sb, OPEN_REPARSE_POINT), + .fid = &fid, + };
rc = SMB2_open_init(tcon, server, &rqst[0], &oplock, &oparms, utf16_path); @@ -3200,17 +3206,20 @@ get_smb2_acl_by_path(struct cifs_sb_info return ERR_PTR(rc); }
- oparms.tcon = tcon; - oparms.desired_access = READ_CONTROL; - oparms.disposition = FILE_OPEN; - /* - * When querying an ACL, even if the file is a symlink we want to open - * the source not the target, and so the protocol requires that the - * client specify this flag when opening a reparse point - */ - oparms.create_options = cifs_create_options(cifs_sb, 0) | OPEN_REPARSE_POINT; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = READ_CONTROL, + .disposition = FILE_OPEN, + /* + * When querying an ACL, even if the file is a symlink + * we want to open the source not the target, and so + * the protocol requires that the client specify this + * flag when opening a reparse point + */ + .create_options = cifs_create_options(cifs_sb, 0) | + OPEN_REPARSE_POINT, + .fid = &fid, + };
if (info & SACL_SECINFO) oparms.desired_access |= SYSTEM_SECURITY; @@ -3269,13 +3278,14 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, _ return rc; }
- oparms.tcon = tcon; - oparms.desired_access = access_flags; - oparms.create_options = cifs_create_options(cifs_sb, 0); - oparms.disposition = FILE_OPEN; - oparms.path = path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .desired_access = access_flags, + .create_options = cifs_create_options(cifs_sb, 0), + .disposition = FILE_OPEN, + .path = path, + .fid = &fid, + };
rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, NULL, NULL); @@ -5138,15 +5148,16 @@ smb2_make_node(unsigned int xid, struct
cifs_dbg(FYI, "sfu compat create special file\n");
- oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = GENERIC_WRITE; - oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | - CREATE_OPTION_SPECIAL); - oparms.disposition = FILE_CREATE; - oparms.path = full_path; - oparms.fid = &fid; - oparms.reconnect = false; + oparms = (struct cifs_open_parms) { + .tcon = tcon, + .cifs_sb = cifs_sb, + .desired_access = GENERIC_WRITE, + .create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR | + CREATE_OPTION_SPECIAL), + .disposition = FILE_CREATE, + .path = full_path, + .fid = &fid, + };
if (tcon->ses->server->oplocks) oplock = REQ_OPLOCK;
From: Paulo Alcantara pc@manguebit.com
commit d99e86ebde2d7b3a04190f8d14de5bf6814bf10f upstream.
The client was sending rfc1002 session request packet with a wrong length field set, therefore failing to mount shares against old SMB servers over port 139.
Fix this by calculating the correct length as specified in rfc1002.
Fixes: d7173623bf0b ("cifs: use ALIGN() and round_up() macros") Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) pc@manguebit.com Reviewed-by: Ronnie Sahlberg lsahlber@redhat.com Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/connect.c | 104 ++++++++++++++++++++---------------------------------- 1 file changed, 40 insertions(+), 64 deletions(-)
--- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -2843,72 +2843,48 @@ ip_rfc1001_connect(struct TCP_Server_Inf * negprot - BB check reconnection in case where second * sessinit is sent but no second negprot */ - struct rfc1002_session_packet *ses_init_buf; - unsigned int req_noscope_len; - struct smb_hdr *smb_buf; - - ses_init_buf = kzalloc(sizeof(struct rfc1002_session_packet), - GFP_KERNEL); - - if (ses_init_buf) { - ses_init_buf->trailer.session_req.called_len = 32; - - if (server->server_RFC1001_name[0] != 0) - rfc1002mangle(ses_init_buf->trailer. - session_req.called_name, - server->server_RFC1001_name, - RFC1001_NAME_LEN_WITH_NULL); - else - rfc1002mangle(ses_init_buf->trailer. - session_req.called_name, - DEFAULT_CIFS_CALLED_NAME, - RFC1001_NAME_LEN_WITH_NULL); - - ses_init_buf->trailer.session_req.calling_len = 32; - - /* - * calling name ends in null (byte 16) from old smb - * convention. - */ - if (server->workstation_RFC1001_name[0] != 0) - rfc1002mangle(ses_init_buf->trailer. - session_req.calling_name, - server->workstation_RFC1001_name, - RFC1001_NAME_LEN_WITH_NULL); - else - rfc1002mangle(ses_init_buf->trailer. - session_req.calling_name, - "LINUX_CIFS_CLNT", - RFC1001_NAME_LEN_WITH_NULL); - - ses_init_buf->trailer.session_req.scope1 = 0; - ses_init_buf->trailer.session_req.scope2 = 0; - smb_buf = (struct smb_hdr *)ses_init_buf; - - /* sizeof RFC1002_SESSION_REQUEST with no scopes */ - req_noscope_len = sizeof(struct rfc1002_session_packet) - 2; - - /* == cpu_to_be32(0x81000044) */ - smb_buf->smb_buf_length = - cpu_to_be32((RFC1002_SESSION_REQUEST << 24) | req_noscope_len); - rc = smb_send(server, smb_buf, 0x44); - kfree(ses_init_buf); - /* - * RFC1001 layer in at least one server - * requires very short break before negprot - * presumably because not expecting negprot - * to follow so fast. This is a simple - * solution that works without - * complicating the code and causes no - * significant slowing down on mount - * for everyone else - */ - usleep_range(1000, 2000); - } + struct rfc1002_session_packet req = {}; + struct smb_hdr *smb_buf = (struct smb_hdr *)&req; + unsigned int len; + + req.trailer.session_req.called_len = sizeof(req.trailer.session_req.called_name); + + if (server->server_RFC1001_name[0] != 0) + rfc1002mangle(req.trailer.session_req.called_name, + server->server_RFC1001_name, + RFC1001_NAME_LEN_WITH_NULL); + else + rfc1002mangle(req.trailer.session_req.called_name, + DEFAULT_CIFS_CALLED_NAME, + RFC1001_NAME_LEN_WITH_NULL); + + req.trailer.session_req.calling_len = sizeof(req.trailer.session_req.calling_name); + + /* calling name ends in null (byte 16) from old smb convention */ + if (server->workstation_RFC1001_name[0] != 0) + rfc1002mangle(req.trailer.session_req.calling_name, + server->workstation_RFC1001_name, + RFC1001_NAME_LEN_WITH_NULL); + else + rfc1002mangle(req.trailer.session_req.calling_name, + "LINUX_CIFS_CLNT", + RFC1001_NAME_LEN_WITH_NULL); + + /* + * As per rfc1002, @len must be the number of bytes that follows the + * length field of a rfc1002 session request payload. + */ + len = sizeof(req) - offsetof(struct rfc1002_session_packet, trailer.session_req); + + smb_buf->smb_buf_length = cpu_to_be32((RFC1002_SESSION_REQUEST << 24) | len); + rc = smb_send(server, smb_buf, len); /* - * else the negprot may still work without this - * even though malloc failed + * RFC1001 layer in at least one server requires very short break before + * negprot presumably because not expecting negprot to follow so fast. + * This is a simple solution that works without complicating the code + * and causes no significant slowing down on mount for everyone else */ + usleep_range(1000, 2000);
return rc; }
From: Stefan Metzmacher metze@samba.org
commit d643a8a446fc46c06837d08a056f69da2ff16025 upstream.
This will simplify the following changes and makes it easy to get in passed in from the caller in future.
Signed-off-by: Stefan Metzmacher metze@samba.org Cc: Steve French smfrench@gmail.com Cc: Tom Talpey tom@talpey.com Cc: Long Li longli@microsoft.com Cc: Namjae Jeon linkinjeon@kernel.org Cc: David Howells dhowells@redhat.com Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/smb2pdu.c | 53 +++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 39 insertions(+), 14 deletions(-)
--- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -4504,10 +4504,27 @@ smb2_async_writev(struct cifs_writedata struct kvec iov[1]; struct smb_rqst rqst = { }; unsigned int total_len; + struct cifs_io_parms _io_parms; + struct cifs_io_parms *io_parms = NULL;
if (!wdata->server) server = wdata->server = cifs_pick_channel(tcon->ses);
+ /* + * in future we may get cifs_io_parms passed in from the caller, + * but for now we construct it here... + */ + _io_parms = (struct cifs_io_parms) { + .tcon = tcon, + .server = server, + .offset = wdata->offset, + .length = wdata->bytes, + .persistent_fid = wdata->cfile->fid.persistent_fid, + .volatile_fid = wdata->cfile->fid.volatile_fid, + .pid = wdata->pid, + }; + io_parms = &_io_parms; + rc = smb2_plain_req_init(SMB2_WRITE, tcon, server, (void **) &req, &total_len); if (rc) @@ -4517,26 +4534,31 @@ smb2_async_writev(struct cifs_writedata flags |= CIFS_TRANSFORM_REQ;
shdr = (struct smb2_hdr *)req; - shdr->Id.SyncId.ProcessId = cpu_to_le32(wdata->cfile->pid); + shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid);
- req->PersistentFileId = wdata->cfile->fid.persistent_fid; - req->VolatileFileId = wdata->cfile->fid.volatile_fid; + req->PersistentFileId = io_parms->persistent_fid; + req->VolatileFileId = io_parms->volatile_fid; req->WriteChannelInfoOffset = 0; req->WriteChannelInfoLength = 0; req->Channel = 0; - req->Offset = cpu_to_le64(wdata->offset); + req->Offset = cpu_to_le64(io_parms->offset); req->DataOffset = cpu_to_le16( offsetof(struct smb2_write_req, Buffer)); req->RemainingBytes = 0;
- trace_smb3_write_enter(0 /* xid */, wdata->cfile->fid.persistent_fid, - tcon->tid, tcon->ses->Suid, wdata->offset, wdata->bytes); + trace_smb3_write_enter(0 /* xid */, + io_parms->persistent_fid, + io_parms->tcon->tid, + io_parms->tcon->ses->Suid, + io_parms->offset, + io_parms->length); + #ifdef CONFIG_CIFS_SMB_DIRECT /* * If we want to do a server RDMA read, fill in and append * smbd_buffer_descriptor_v1 to the end of write request */ - if (server->rdma && !server->sign && wdata->bytes >= + if (server->rdma && !server->sign && io_parms->length >= server->smbd_conn->rdma_readwrite_threshold) {
struct smbd_buffer_descriptor_v1 *v1; @@ -4590,14 +4612,14 @@ smb2_async_writev(struct cifs_writedata } #endif cifs_dbg(FYI, "async write at %llu %u bytes\n", - wdata->offset, wdata->bytes); + io_parms->offset, io_parms->length);
#ifdef CONFIG_CIFS_SMB_DIRECT /* For RDMA read, I/O size is in RemainingBytes not in Length */ if (!wdata->mr) - req->Length = cpu_to_le32(wdata->bytes); + req->Length = cpu_to_le32(io_parms->length); #else - req->Length = cpu_to_le32(wdata->bytes); + req->Length = cpu_to_le32(io_parms->length); #endif
if (wdata->credits.value > 0) { @@ -4605,7 +4627,7 @@ smb2_async_writev(struct cifs_writedata SMB2_MAX_BUFFER_SIZE)); shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
- rc = adjust_credits(server, &wdata->credits, wdata->bytes); + rc = adjust_credits(server, &wdata->credits, io_parms->length); if (rc) goto async_writev_out;
@@ -4618,9 +4640,12 @@ smb2_async_writev(struct cifs_writedata
if (rc) { trace_smb3_write_err(0 /* no xid */, - req->PersistentFileId, - tcon->tid, tcon->ses->Suid, wdata->offset, - wdata->bytes, rc); + io_parms->persistent_fid, + io_parms->tcon->tid, + io_parms->tcon->ses->Suid, + io_parms->offset, + io_parms->length, + rc); kref_put(&wdata->refcount, release); cifs_stats_fail_inc(tcon, SMB2_WRITE_HE); }
From: Stefan Metzmacher metze@samba.org
commit a6559cc1d35d3eeafb0296aca347b2f745a28a74 upstream.
We should have the logic to decide if we want rdma offload in a single spot in order to advance it in future.
Signed-off-by: Stefan Metzmacher metze@samba.org Cc: Steve French smfrench@gmail.com Cc: Tom Talpey tom@talpey.com Cc: Long Li longli@microsoft.com Cc: Namjae Jeon linkinjeon@kernel.org Cc: David Howells dhowells@redhat.com Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/smb2pdu.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-)
--- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -4063,6 +4063,32 @@ SMB2_flush(const unsigned int xid, struc return rc; }
+#ifdef CONFIG_CIFS_SMB_DIRECT +static inline bool smb3_use_rdma_offload(struct cifs_io_parms *io_parms) +{ + struct TCP_Server_Info *server = io_parms->server; + struct cifs_tcon *tcon = io_parms->tcon; + + /* we can only offload if we're connected */ + if (!server || !tcon) + return false; + + /* we can only offload on an rdma connection */ + if (!server->rdma || !server->smbd_conn) + return false; + + /* we don't support signed offload yet */ + if (server->sign) + return false; + + /* offload also has its overhead, so only do it if desired */ + if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) + return false; + + return true; +} +#endif /* CONFIG_CIFS_SMB_DIRECT */ + /* * To form a chain of read requests, any read requests after the first should * have the end_of_chain boolean set to true. @@ -4106,9 +4132,7 @@ smb2_new_read_req(void **buf, unsigned i * If we want to do a RDMA write, fill in and append * smbd_buffer_descriptor_v1 to the end of read request */ - if (server->rdma && rdata && !server->sign && - rdata->bytes >= server->smbd_conn->rdma_readwrite_threshold) { - + if (smb3_use_rdma_offload(io_parms)) { struct smbd_buffer_descriptor_v1 *v1; bool need_invalidate = server->dialect == SMB30_PROT_ID;
@@ -4558,9 +4582,7 @@ smb2_async_writev(struct cifs_writedata * If we want to do a server RDMA read, fill in and append * smbd_buffer_descriptor_v1 to the end of write request */ - if (server->rdma && !server->sign && io_parms->length >= - server->smbd_conn->rdma_readwrite_threshold) { - + if (smb3_use_rdma_offload(io_parms)) { struct smbd_buffer_descriptor_v1 *v1; bool need_invalidate = server->dialect == SMB30_PROT_ID;
From: Stefan Metzmacher metze@samba.org
commit 3891f6c7655a39065e44980f51ba46bb32be3133 upstream.
The aim of using encryption on a connection is to keep the data confidential, so we must not use plaintext rdma offload for that data!
It seems that current windows servers and ksmbd would allow this, but that's no reason to expose the users data in plaintext! And servers hopefully reject this in future.
Note modern windows servers support signed or encrypted offload, see MS-SMB2 2.2.3.1.6 SMB2_RDMA_TRANSFORM_CAPABILITIES, but we don't support that yet.
Signed-off-by: Stefan Metzmacher metze@samba.org Cc: Steve French smfrench@gmail.com Cc: Tom Talpey tom@talpey.com Cc: Long Li longli@microsoft.com Cc: Namjae Jeon linkinjeon@kernel.org Cc: David Howells dhowells@redhat.com Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+)
--- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -4081,6 +4081,10 @@ static inline bool smb3_use_rdma_offload if (server->sign) return false;
+ /* we don't support encrypted offload yet */ + if (smb3_encryption_required(tcon)) + return false; + /* offload also has its overhead, so only do it if desired */ if (io_parms->length < server->smbd_conn->rdma_readwrite_threshold) return false;
From: Ronnie Sahlberg lsahlber@redhat.com
commit 66d45ca1350a3bb8d5f4db8879ccad3ed492337a upstream.
Some servers may return that we got a lease in rsp->OplockLevel but then in the lease context contradict this and say we got no lease at all. Thus we need to check the context if we have a lease. Additionally, If we do not get a lease we need to make sure we close the handle before we return an error to the caller.
Signed-off-by: Ronnie Sahlberg lsahlber@redhat.com Cc: stable@vger.kernel.org Reviewed-by: Bharath SM bharathsm@microsoft.com Reviewed-by: Paulo Alcantara (SUSE) pc@manguebit.com Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/cached_dir.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
--- a/fs/cifs/cached_dir.c +++ b/fs/cifs/cached_dir.c @@ -221,8 +221,7 @@ int open_cached_dir(unsigned int xid, st } goto oshr_free; } - - atomic_inc(&tcon->num_remote_opens); + cfid->is_open = true;
o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base; oparms.fid->persistent_fid = o_rsp->PersistentFileId; @@ -239,7 +238,8 @@ int open_cached_dir(unsigned int xid, st &oparms.fid->epoch, oparms.fid->lease_key, &oplock, NULL, NULL); - + if (!(oplock & SMB2_LEASE_READ_CACHING_HE)) + goto oshr_free; qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base; if (le32_to_cpu(qi_rsp->OutputBufferLength) < sizeof(struct smb2_file_all_info)) goto oshr_free; @@ -262,7 +262,6 @@ int open_cached_dir(unsigned int xid, st cfid->dentry = dentry; cfid->tcon = tcon; cfid->time = jiffies; - cfid->is_open = true; cfid->has_lease = true;
oshr_free: @@ -282,12 +281,17 @@ oshr_free: } spin_unlock(&cfids->cfid_list_lock); if (rc) { + if (cfid->is_open) + SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, + cfid->fid.volatile_fid); free_cached_dir(cfid); cfid = NULL; }
- if (rc == 0) + if (rc == 0) { *ret_cfid = cfid; + atomic_inc(&tcon->num_remote_opens); + }
return rc; }
From: Ronnie Sahlberg lsahlber@redhat.com
commit 8e843bf38f7be0766642a91523cfa65f2b021a8a upstream.
If we did not get a lease we can still return a single use cfid to the caller. The cfid will not have has_lease set and will thus not be shared with any other concurrent users and will be freed immediately when the caller drops the handle.
This avoids extra roundtrips for servers that do not support directory leases where they would first fail to get a cfid with a lease and then fallback to try a normal SMB2_open()
Signed-off-by: Ronnie Sahlberg lsahlber@redhat.com Cc: stable@vger.kernel.org Reviewed-by: Bharath SM bharathsm@microsoft.com Reviewed-by: Paulo Alcantara (SUSE) pc@manguebit.com Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cifs/cached_dir.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
--- a/fs/cifs/cached_dir.c +++ b/fs/cifs/cached_dir.c @@ -14,6 +14,7 @@
static struct cached_fid *init_cached_dir(const char *path); static void free_cached_dir(struct cached_fid *cfid); +static void smb2_close_cached_fid(struct kref *ref);
static struct cached_fid *find_or_create_cached_dir(struct cached_fids *cfids, const char *path, @@ -221,6 +222,7 @@ int open_cached_dir(unsigned int xid, st } goto oshr_free; } + cfid->tcon = tcon; cfid->is_open = true;
o_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base; @@ -233,7 +235,6 @@ int open_cached_dir(unsigned int xid, st if (o_rsp->OplockLevel != SMB2_OPLOCK_LEVEL_LEASE) goto oshr_free;
- smb2_parse_contexts(server, o_rsp, &oparms.fid->epoch, oparms.fid->lease_key, &oplock, @@ -260,7 +261,6 @@ int open_cached_dir(unsigned int xid, st } } cfid->dentry = dentry; - cfid->tcon = tcon; cfid->time = jiffies; cfid->has_lease = true;
@@ -271,7 +271,7 @@ oshr_free: free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base); free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base); spin_lock(&cfids->cfid_list_lock); - if (!cfid->has_lease) { + if (rc && !cfid->has_lease) { if (cfid->on_list) { list_del(&cfid->entry); cfid->on_list = false; @@ -280,6 +280,15 @@ oshr_free: rc = -ENOENT; } spin_unlock(&cfids->cfid_list_lock); + if (!rc && !cfid->has_lease) { + /* + * We are guaranteed to have two references at this point. + * One for the caller and one for a potential lease. + * Release the Lease-ref so that the directory will be closed + * when the caller closes the cached handle. + */ + kref_put(&cfid->refcount, smb2_close_cached_fid); + } if (rc) { if (cfid->is_open) SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, @@ -340,6 +349,7 @@ smb2_close_cached_fid(struct kref *ref) if (cfid->is_open) { SMB2_close(0, cfid->tcon, cfid->fid.persistent_fid, cfid->fid.volatile_fid); + atomic_dec(&cfid->tcon->num_remote_opens); }
free_cached_dir(cfid);
From: Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com
commit e39ea831ebad4ab15c4748cb62a397a8abcca36e upstream.
Commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") introduced an array mrioc->evtack_cmds but initialization of the array elements was missed. They are just zero cleared. The function mpi3mr_complete_evt_ack() refers host_tag field of the elements. Due to the zero value of the host_tag field, the function calls clear_bit() for mrico->evtack_cmds_bitmap with wrong bit index. This results in memory access to invalid address and "BUG: KASAN: use-after-free". This BUG was observed at eHBA-9600 firmware update to version 8.3.1.0. To fix it, add the missing initialization of mrioc->evtack_cmds.
Link: https://lore.kernel.org/r/20230214005019.1897251-5-shinichiro.kawasaki@wdc.c... Cc: stable@vger.kernel.org Fixes: c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") Signed-off-by: Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com Reviewed-by: Damien Le Moal damien.lemoal@opensource.wdc.com Acked-by: Sathya Prakash Veerichetty sathya.prakash@broadcom.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/mpi3mr/mpi3mr_os.c | 4 ++++ 1 file changed, 4 insertions(+)
--- a/drivers/scsi/mpi3mr/mpi3mr_os.c +++ b/drivers/scsi/mpi3mr/mpi3mr_os.c @@ -4952,6 +4952,10 @@ mpi3mr_probe(struct pci_dev *pdev, const mpi3mr_init_drv_cmd(&mrioc->dev_rmhs_cmds[i], MPI3MR_HOSTTAG_DEVRMCMD_MIN + i);
+ for (i = 0; i < MPI3MR_NUM_EVTACKCMD; i++) + mpi3mr_init_drv_cmd(&mrioc->evtack_cmds[i], + MPI3MR_HOSTTAG_EVTACKCMD_MIN + i); + if (pdev->revision) mrioc->enable_segqueue = true;
From: Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com
commit fb428a2005fc1260d18b989cc5199f281617f44d upstream.
The function mpi3mr_get_all_tgt_info() has four issues:
1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64).
2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices.
3) It copies num_device by calling memcpy(). Substitution is enough.
4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds".
Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the correct length to sg_copy_from_buffer().
Link: https://lore.kernel.org/r/20230214005019.1897251-2-shinichiro.kawasaki@wdc.c... Cc: stable@vger.kernel.org Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands") Signed-off-by: Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com Acked-by: Sathya Prakash Veerichetty sathya.prakash@broadcom.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/mpi3mr/mpi3mr_app.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c @@ -312,7 +312,7 @@ static long mpi3mr_get_all_tgt_info(stru num_devices++; spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
- if ((job->request_payload.payload_len == sizeof(u32)) || + if ((job->request_payload.payload_len <= sizeof(u64)) || list_empty(&mrioc->tgtdev_list)) { sg_copy_from_buffer(job->request_payload.sg_list, job->request_payload.sg_cnt, @@ -320,14 +320,14 @@ static long mpi3mr_get_all_tgt_info(stru return 0; }
- kern_entrylen = (num_devices - 1) * sizeof(*devmap_info); - size = sizeof(*alltgt_info) + kern_entrylen; + kern_entrylen = num_devices * sizeof(*devmap_info); + size = sizeof(u64) + kern_entrylen; alltgt_info = kzalloc(size, GFP_KERNEL); if (!alltgt_info) return -ENOMEM;
devmap_info = alltgt_info->dmi; - memset((u8 *)devmap_info, 0xFF, (kern_entrylen + sizeof(*devmap_info))); + memset((u8 *)devmap_info, 0xFF, kern_entrylen); spin_lock_irqsave(&mrioc->tgtdev_lock, flags); list_for_each_entry(tgtdev, &mrioc->tgtdev_list, list) { if (i < num_devices) { @@ -344,9 +344,10 @@ static long mpi3mr_get_all_tgt_info(stru num_devices = i; spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
- memcpy(&alltgt_info->num_devices, &num_devices, sizeof(num_devices)); + alltgt_info->num_devices = num_devices;
- usr_entrylen = (job->request_payload.payload_len - sizeof(u32)) / sizeof(*devmap_info); + usr_entrylen = (job->request_payload.payload_len - sizeof(u64)) / + sizeof(*devmap_info); usr_entrylen *= sizeof(*devmap_info); min_entrylen = min(usr_entrylen, kern_entrylen); if (min_entrylen && (!memcpy(&alltgt_info->dmi, devmap_info, min_entrylen))) { @@ -358,7 +359,7 @@ static long mpi3mr_get_all_tgt_info(stru
sg_copy_from_buffer(job->request_payload.sg_list, job->request_payload.sg_cnt, - alltgt_info, job->request_payload.payload_len); + alltgt_info, (min_entrylen + sizeof(u64))); rval = 0; out: kfree(alltgt_info);
From: Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com
commit eeb270aee3e085411399f129fc14fa04bd6d83cf upstream.
In the function mpi3mr_get_all_tgt_info(), devmap_info points to alltgt_info->dmi then there is no need to memcpy() data from devmap_info to alltgt_info->dmi. Remove the unnecessary memcpy(). This also allows to remove the local variable 'rval' and the goto label 'out'.
Link: https://lore.kernel.org/r/20230214005019.1897251-3-shinichiro.kawasaki@wdc.c... Cc: stable@vger.kernel.org Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands") Signed-off-by: Shin'ichiro Kawasaki shinichiro.kawasaki@wdc.com Acked-by: Sathya Prakash Veerichetty sathya.prakash@broadcom.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/mpi3mr/mpi3mr_app.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c +++ b/drivers/scsi/mpi3mr/mpi3mr_app.c @@ -293,7 +293,6 @@ out: static long mpi3mr_get_all_tgt_info(struct mpi3mr_ioc *mrioc, struct bsg_job *job) { - long rval = -EINVAL; u16 num_devices = 0, i = 0, size; unsigned long flags; struct mpi3mr_tgt_dev *tgtdev; @@ -304,7 +303,7 @@ static long mpi3mr_get_all_tgt_info(stru if (job->request_payload.payload_len < sizeof(u32)) { dprint_bsg_err(mrioc, "%s: invalid size argument\n", __func__); - return rval; + return -EINVAL; }
spin_lock_irqsave(&mrioc->tgtdev_lock, flags); @@ -350,20 +349,12 @@ static long mpi3mr_get_all_tgt_info(stru sizeof(*devmap_info); usr_entrylen *= sizeof(*devmap_info); min_entrylen = min(usr_entrylen, kern_entrylen); - if (min_entrylen && (!memcpy(&alltgt_info->dmi, devmap_info, min_entrylen))) { - dprint_bsg_err(mrioc, "%s:%d: device map info copy failed\n", - __func__, __LINE__); - rval = -EFAULT; - goto out; - }
sg_copy_from_buffer(job->request_payload.sg_list, job->request_payload.sg_cnt, alltgt_info, (min_entrylen + sizeof(u64))); - rval = 0; -out: kfree(alltgt_info); - return rval; + return 0; } /** * mpi3mr_get_change_count - Get topology change count
From: Boris Burkov boris@bur.io
commit 2b5463fcbdfb24e898916bcae2b1359042d26963 upstream.
Async discard does not acquire the block group reference count while it holds a reference on the discard list. This is generally OK, as the paths which destroy block groups tend to try to synchronize on cancelling async discard work. However, relying on cancelling work requires careful analysis to be sure it is safe from races with unpinning scheduling more work.
While I am unable to find a race with unpinning in the current code for either the unused bgs or relocation paths, I believe we have one in an older version of auto relocation in a Meta internal build. This suggests that this is in fact an error prone model, and could be fragile to future changes to these bg deletion paths.
To make this ownership more clear, add a refcount for async discard. If work is queued for a block group, its refcount should be incremented, and when work is completed or canceled, it should be decremented.
CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Boris Burkov boris@bur.io Signed-off-by: David Sterba dsterba@suse.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/btrfs/discard.c | 41 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 38 insertions(+), 3 deletions(-)
--- a/fs/btrfs/discard.c +++ b/fs/btrfs/discard.c @@ -78,6 +78,7 @@ static struct list_head *get_discard_lis static void __add_to_discard_list(struct btrfs_discard_ctl *discard_ctl, struct btrfs_block_group *block_group) { + lockdep_assert_held(&discard_ctl->lock); if (!btrfs_run_discard_work(discard_ctl)) return;
@@ -89,6 +90,8 @@ static void __add_to_discard_list(struct BTRFS_DISCARD_DELAY); block_group->discard_state = BTRFS_DISCARD_RESET_CURSOR; } + if (list_empty(&block_group->discard_list)) + btrfs_get_block_group(block_group);
list_move_tail(&block_group->discard_list, get_discard_list(discard_ctl, block_group)); @@ -108,8 +111,12 @@ static void add_to_discard_list(struct b static void add_to_discard_unused_list(struct btrfs_discard_ctl *discard_ctl, struct btrfs_block_group *block_group) { + bool queued; + spin_lock(&discard_ctl->lock);
+ queued = !list_empty(&block_group->discard_list); + if (!btrfs_run_discard_work(discard_ctl)) { spin_unlock(&discard_ctl->lock); return; @@ -121,6 +128,8 @@ static void add_to_discard_unused_list(s block_group->discard_eligible_time = (ktime_get_ns() + BTRFS_DISCARD_UNUSED_DELAY); block_group->discard_state = BTRFS_DISCARD_RESET_CURSOR; + if (!queued) + btrfs_get_block_group(block_group); list_add_tail(&block_group->discard_list, &discard_ctl->discard_list[BTRFS_DISCARD_INDEX_UNUSED]);
@@ -131,6 +140,7 @@ static bool remove_from_discard_list(str struct btrfs_block_group *block_group) { bool running = false; + bool queued = false;
spin_lock(&discard_ctl->lock);
@@ -140,7 +150,16 @@ static bool remove_from_discard_list(str }
block_group->discard_eligible_time = 0; + queued = !list_empty(&block_group->discard_list); list_del_init(&block_group->discard_list); + /* + * If the block group is currently running in the discard workfn, we + * don't want to deref it, since it's still being used by the workfn. + * The workfn will notice this case and deref the block group when it is + * finished. + */ + if (queued && !running) + btrfs_put_block_group(block_group);
spin_unlock(&discard_ctl->lock);
@@ -214,10 +233,12 @@ again: if (block_group && now >= block_group->discard_eligible_time) { if (block_group->discard_index == BTRFS_DISCARD_INDEX_UNUSED && block_group->used != 0) { - if (btrfs_is_block_group_data_only(block_group)) + if (btrfs_is_block_group_data_only(block_group)) { __add_to_discard_list(discard_ctl, block_group); - else + } else { list_del_init(&block_group->discard_list); + btrfs_put_block_group(block_group); + } goto again; } if (block_group->discard_state == BTRFS_DISCARD_RESET_CURSOR) { @@ -511,6 +532,15 @@ static void btrfs_discard_workfn(struct spin_lock(&discard_ctl->lock); discard_ctl->prev_discard = trimmed; discard_ctl->prev_discard_time = now; + /* + * If the block group was removed from the discard list while it was + * running in this workfn, then we didn't deref it, since this function + * still owned that reference. But we set the discard_ctl->block_group + * back to NULL, so we can use that condition to know that now we need + * to deref the block_group. + */ + if (discard_ctl->block_group == NULL) + btrfs_put_block_group(block_group); discard_ctl->block_group = NULL; __btrfs_discard_schedule_work(discard_ctl, now, false); spin_unlock(&discard_ctl->lock); @@ -651,8 +681,12 @@ void btrfs_discard_punt_unused_bgs_list( list_for_each_entry_safe(block_group, next, &fs_info->unused_bgs, bg_list) { list_del_init(&block_group->bg_list); - btrfs_put_block_group(block_group); btrfs_discard_queue_work(&fs_info->discard_ctl, block_group); + /* + * This put is for the get done by btrfs_mark_bg_unused. + * Queueing discard incremented it for discard's reference. + */ + btrfs_put_block_group(block_group); } spin_unlock(&fs_info->unused_bgs_lock); } @@ -683,6 +717,7 @@ static void btrfs_discard_purge_list(str if (block_group->used == 0) btrfs_mark_bg_unused(block_group); spin_lock(&discard_ctl->lock); + btrfs_put_block_group(block_group); } } spin_unlock(&discard_ctl->lock);
From: Qu Wenruo wqu@suse.com
commit b7625f461da6734a21c38ba6e7558538a116a2e3 upstream.
[BUG] Since the introduction of per-fs feature sysfs interface (/sys/fs/btrfs/<UUID>/features/), the content of that directory is never updated.
Thus for the following case, that directory will not show the new features like RAID56:
# mkfs.btrfs -f $dev1 $dev2 $dev3 # mount $dev1 $mnt # btrfs balance start -f -mconvert=raid5 $mnt # ls /sys/fs/btrfs/$uuid/features/ extended_iref free_space_tree no_holes skinny_metadata
While after unmount and mount, we got the correct features:
# umount $mnt # mount $dev1 $mnt # ls /sys/fs/btrfs/$uuid/features/ extended_iref free_space_tree no_holes raid56 skinny_metadata
[CAUSE] Because we never really try to update the content of per-fs features/ directory.
We had an attempt to update the features directory dynamically in commit 14e46e04958d ("btrfs: synchronize incompat feature bits with sysfs files"), but unfortunately it get reverted in commit e410e34fad91 ("Revert "btrfs: synchronize incompat feature bits with sysfs files""). The problem in the original patch is, in the context of btrfs_create_chunk(), we can not afford to update the sysfs group.
The exported but never utilized function, btrfs_sysfs_feature_update() is the leftover of such attempt. As even if we go sysfs_update_group(), new files will need extra memory allocation, and we have no way to specify the sysfs update to go GFP_NOFS.
[FIX] This patch will address the old problem by doing asynchronous sysfs update in the cleaner thread.
This involves the following changes:
- Make __btrfs_(set|clear)_fs_(incompat|compat_ro) helpers to set BTRFS_FS_FEATURE_CHANGED flag when needed
- Update btrfs_sysfs_feature_update() to use sysfs_update_group() And drop unnecessary arguments.
- Call btrfs_sysfs_feature_update() in cleaner_kthread If we have the BTRFS_FS_FEATURE_CHANGED flag set.
- Wake up cleaner_kthread in btrfs_commit_transaction if we have BTRFS_FS_FEATURE_CHANGED flag
By this, all the previously dangerous call sites like btrfs_create_chunk() need no new changes, as above helpers would have already set the BTRFS_FS_FEATURE_CHANGED flag.
The real work happens at cleaner_kthread, thus we pay the cost of delaying the update to sysfs directory, but the delayed time should be small enough that end user can not distinguish though it might get delayed if the cleaner thread is busy with removing subvolumes or defrag.
CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Anand Jain anand.jain@oracle.com Signed-off-by: Qu Wenruo wqu@suse.com Reviewed-by: David Sterba dsterba@suse.com Signed-off-by: David Sterba dsterba@suse.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/btrfs/disk-io.c | 3 +++ fs/btrfs/fs.c | 4 ++++ fs/btrfs/fs.h | 6 ++++++ fs/btrfs/sysfs.c | 29 ++++++++--------------------- fs/btrfs/sysfs.h | 3 +-- fs/btrfs/transaction.c | 5 +++++ 6 files changed, 27 insertions(+), 23 deletions(-)
--- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -1910,6 +1910,9 @@ static int cleaner_kthread(void *arg) goto sleep; }
+ if (test_and_clear_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags)) + btrfs_sysfs_feature_update(fs_info); + btrfs_run_delayed_iputs(fs_info);
again = btrfs_clean_one_deleted_snapshot(fs_info); --- a/fs/btrfs/fs.c +++ b/fs/btrfs/fs.c @@ -24,6 +24,7 @@ void __btrfs_set_fs_incompat(struct btrf name, flag); } spin_unlock(&fs_info->super_lock); + set_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags); } }
@@ -46,6 +47,7 @@ void __btrfs_clear_fs_incompat(struct bt name, flag); } spin_unlock(&fs_info->super_lock); + set_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags); } }
@@ -68,6 +70,7 @@ void __btrfs_set_fs_compat_ro(struct btr name, flag); } spin_unlock(&fs_info->super_lock); + set_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags); } }
@@ -90,5 +93,6 @@ void __btrfs_clear_fs_compat_ro(struct b name, flag); } spin_unlock(&fs_info->super_lock); + set_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags); } } --- a/fs/btrfs/fs.h +++ b/fs/btrfs/fs.h @@ -125,6 +125,12 @@ enum { */ BTRFS_FS_NO_OVERCOMMIT,
+ /* + * Indicate if we have some features changed, this is mostly for + * cleaner thread to update the sysfs interface. + */ + BTRFS_FS_FEATURE_CHANGED, + #if BITS_PER_LONG == 32 /* Indicate if we have error/warn message printed on 32bit systems */ BTRFS_FS_32BIT_ERROR, --- a/fs/btrfs/sysfs.c +++ b/fs/btrfs/sysfs.c @@ -2272,36 +2272,23 @@ void btrfs_sysfs_del_one_qgroup(struct b * Change per-fs features in /sys/fs/btrfs/UUID/features to match current * values in superblock. Call after any changes to incompat/compat_ro flags */ -void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info, - u64 bit, enum btrfs_feature_set set) +void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info) { - struct btrfs_fs_devices *fs_devs; struct kobject *fsid_kobj; - u64 __maybe_unused features; - int __maybe_unused ret; + int ret;
if (!fs_info) return;
- /* - * See 14e46e04958df74 and e410e34fad913dd, feature bit updates are not - * safe when called from some contexts (eg. balance) - */ - features = get_features(fs_info, set); - ASSERT(bit & supported_feature_masks[set]); - - fs_devs = fs_info->fs_devices; - fsid_kobj = &fs_devs->fsid_kobj; - + fsid_kobj = &fs_info->fs_devices->fsid_kobj; if (!fsid_kobj->state_initialized) return;
- /* - * FIXME: this is too heavy to update just one value, ideally we'd like - * to use sysfs_update_group but some refactoring is needed first. - */ - sysfs_remove_group(fsid_kobj, &btrfs_feature_attr_group); - ret = sysfs_create_group(fsid_kobj, &btrfs_feature_attr_group); + ret = sysfs_update_group(fsid_kobj, &btrfs_feature_attr_group); + if (ret < 0) + btrfs_warn(fs_info, + "failed to update /sys/fs/btrfs/%pU/features: %d", + fs_info->fs_devices->fsid, ret); }
int __init btrfs_init_sysfs(void) --- a/fs/btrfs/sysfs.h +++ b/fs/btrfs/sysfs.h @@ -19,8 +19,7 @@ void btrfs_sysfs_remove_device(struct bt int btrfs_sysfs_add_fsid(struct btrfs_fs_devices *fs_devs); void btrfs_sysfs_remove_fsid(struct btrfs_fs_devices *fs_devs); void btrfs_sysfs_update_sprout_fsid(struct btrfs_fs_devices *fs_devices); -void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info, - u64 bit, enum btrfs_feature_set set); +void btrfs_sysfs_feature_update(struct btrfs_fs_info *fs_info); void btrfs_kobject_uevent(struct block_device *bdev, enum kobject_action action);
int __init btrfs_init_sysfs(void); --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -2464,6 +2464,11 @@ int btrfs_commit_transaction(struct btrf wake_up(&fs_info->transaction_wait); btrfs_trans_state_lockdep_release(fs_info, BTRFS_LOCKDEP_TRANS_UNBLOCKED);
+ /* If we have features changed, wake up the cleaner to update sysfs. */ + if (test_bit(BTRFS_FS_FEATURE_CHANGED, &fs_info->flags) && + fs_info->cleaner_kthread) + wake_up_process(fs_info->cleaner_kthread); + ret = btrfs_write_and_wait_transaction(trans); if (ret) { btrfs_handle_fs_error(fs_info, ret,
From: Waiman Long longman@redhat.com
commit b613c7f31476c44316bfac1af7cac714b7d6bef9 upstream.
A non-first waiter can potentially spin in the for loop of rwsem_down_write_slowpath() without sleeping but fail to acquire the lock even if the rwsem is free if the following sequence happens:
Non-first RT waiter First waiter Lock holder ------------------- ------------ ----------- Acquire wait_lock rwsem_try_write_lock(): Set handoff bit if RT or wait too long Set waiter->handoff_set Release wait_lock Acquire wait_lock Inherit waiter->handoff_set Release wait_lock Clear owner Release lock if (waiter.handoff_set) { rwsem_spin_on_owner((); if (OWNER_NULL) goto trylock_again; } trylock_again: Acquire wait_lock rwsem_try_write_lock(): if (first->handoff_set && (waiter != first)) return false; Release wait_lock
A non-first waiter cannot really acquire the rwsem even if it mistakenly believes that it can spin on OWNER_NULL value. If that waiter happens to be an RT task running on the same CPU as the first waiter, it can block the first waiter from acquiring the rwsem leading to live lock. Fix this problem by making sure that a non-first waiter cannot spin in the slowpath loop without sleeping.
Fixes: d257cc8cb8d5 ("locking/rwsem: Make handoff bit handling more consistent") Signed-off-by: Waiman Long longman@redhat.com Signed-off-by: Ingo Molnar mingo@kernel.org Tested-by: Mukesh Ojha quic_mojha@quicinc.com Reviewed-by: Mukesh Ojha quic_mojha@quicinc.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230126003628.365092-2-longman@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/locking/rwsem.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
--- a/kernel/locking/rwsem.c +++ b/kernel/locking/rwsem.c @@ -624,18 +624,16 @@ static inline bool rwsem_try_write_lock( */ if (first->handoff_set && (waiter != first)) return false; - - /* - * First waiter can inherit a previously set handoff - * bit and spin on rwsem if lock acquisition fails. - */ - if (waiter == first) - waiter->handoff_set = true; }
new = count;
if (count & RWSEM_LOCK_MASK) { + /* + * A waiter (first or not) can set the handoff bit + * if it is an RT task or wait in the wait queue + * for too long. + */ if (has_handoff || (!rt_task(waiter->task) && !time_after(jiffies, waiter->timeout))) return false; @@ -651,11 +649,12 @@ static inline bool rwsem_try_write_lock( } while (!atomic_long_try_cmpxchg_acquire(&sem->count, &count, new));
/* - * We have either acquired the lock with handoff bit cleared or - * set the handoff bit. + * We have either acquired the lock with handoff bit cleared or set + * the handoff bit. Only the first waiter can have its handoff_set + * set here to enable optimistic spinning in slowpath loop. */ if (new & RWSEM_FLAG_HANDOFF) { - waiter->handoff_set = true; + first->handoff_set = true; lockevent_inc(rwsem_wlock_handoff); return false; }
From: Namjae Jeon linkinjeon@kernel.org
commit 8f8c43b125882ac14372f8dca0c8e50a59e78d79 upstream.
When turning debug mode on, The following error message from ksmbd_smb2_check_message() is coming.
ksmbd: cli req padded more than expected. Length 112 not 88 for cmd:10 mid:14
data area length calculation for smb2 lock request in smb2_get_data_area_len() is incorrect.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ksmbd/smb2misc.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-)
--- a/fs/ksmbd/smb2misc.c +++ b/fs/ksmbd/smb2misc.c @@ -149,15 +149,11 @@ static int smb2_get_data_area_len(unsign break; case SMB2_LOCK: { - int lock_count; + unsigned short lock_count;
- /* - * smb2_lock request size is 48 included single - * smb2_lock_element structure size. - */ - lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount) - 1; + lock_count = le16_to_cpu(((struct smb2_lock_req *)hdr)->LockCount); if (lock_count > 0) { - *off = __SMB2_HEADER_STRUCTURE_SIZE + 48; + *off = offsetof(struct smb2_lock_req, locks); *len = sizeof(struct smb2_lock_element) * lock_count; } break;
From: Namjae Jeon linkinjeon@kernel.org
commit fb533473d1595fe79ecb528fda1de33552b07178 upstream.
ksmbd allowed the actual frame length to be smaller than the rfc1002 length. If allowed, it is possible to allocates a large amount of memory that can be limited by credit management and can eventually cause memory exhaustion problem. This patch do not allow it except SMB2 Negotiate request which will be validated when message handling proceeds. Also, Allow a message that padded to 8byte boundary.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ksmbd/smb2misc.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
--- a/fs/ksmbd/smb2misc.c +++ b/fs/ksmbd/smb2misc.c @@ -408,20 +408,19 @@ int ksmbd_smb2_check_message(struct ksmb goto validate_credit;
/* - * windows client also pad up to 8 bytes when compounding. - * If pad is longer than eight bytes, log the server behavior - * (once), since may indicate a problem but allow it and - * continue since the frame is parseable. + * SMB2 NEGOTIATE request will be validated when message + * handling proceeds. */ - if (clc_len < len) { - ksmbd_debug(SMB, - "cli req padded more than expected. Length %d not %d for cmd:%d mid:%llu\n", - len, clc_len, command, - le64_to_cpu(hdr->MessageId)); + if (command == SMB2_NEGOTIATE_HE) goto validate_credit; - }
- ksmbd_debug(SMB, + /* + * Allow a message that padded to 8byte boundary. + */ + if (clc_len < len && (len - clc_len) < 8) + goto validate_credit; + + pr_err_ratelimited( "cli req too short, len %d not %d. cmd:%d mid:%llu\n", len, clc_len, command, le64_to_cpu(hdr->MessageId));
From: Hangyu Hua hbh25y@gmail.com
commit d3ca9f7aeba793d74361d88a8800b2f205c9236b upstream.
argv needs to be free when setup_async_work fails or when the current process is woken up.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Hangyu Hua hbh25y@gmail.com Acked-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ksmbd/smb2pdu.c | 28 +++++++++++++--------------- fs/ksmbd/vfs_cache.c | 5 ++--- 2 files changed, 15 insertions(+), 18 deletions(-)
--- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6644,7 +6644,7 @@ int smb2_cancel(struct ksmbd_work *work) struct ksmbd_conn *conn = work->conn; struct smb2_hdr *hdr = smb2_get_msg(work->request_buf); struct smb2_hdr *chdr; - struct ksmbd_work *cancel_work = NULL, *iter; + struct ksmbd_work *iter; struct list_head *command_list;
ksmbd_debug(SMB, "smb2 cancel called on mid %llu, async flags 0x%x\n", @@ -6666,7 +6666,9 @@ int smb2_cancel(struct ksmbd_work *work) "smb2 with AsyncId %llu cancelled command = 0x%x\n", le64_to_cpu(hdr->Id.AsyncId), le16_to_cpu(chdr->Command)); - cancel_work = iter; + iter->state = KSMBD_WORK_CANCELLED; + if (iter->cancel_fn) + iter->cancel_fn(iter->cancel_argv); break; } spin_unlock(&conn->request_lock); @@ -6685,18 +6687,12 @@ int smb2_cancel(struct ksmbd_work *work) "smb2 with mid %llu cancelled command = 0x%x\n", le64_to_cpu(hdr->MessageId), le16_to_cpu(chdr->Command)); - cancel_work = iter; + iter->state = KSMBD_WORK_CANCELLED; break; } spin_unlock(&conn->request_lock); }
- if (cancel_work) { - cancel_work->state = KSMBD_WORK_CANCELLED; - if (cancel_work->cancel_fn) - cancel_work->cancel_fn(cancel_work->cancel_argv); - } - /* For SMB2_CANCEL command itself send no response*/ work->send_no_response = 1; return 0; @@ -7061,6 +7057,14 @@ skip:
ksmbd_vfs_posix_lock_wait(flock);
+ spin_lock(&work->conn->request_lock); + spin_lock(&fp->f_lock); + list_del(&work->fp_entry); + work->cancel_fn = NULL; + kfree(argv); + spin_unlock(&fp->f_lock); + spin_unlock(&work->conn->request_lock); + if (work->state != KSMBD_WORK_ACTIVE) { list_del(&smb_lock->llist); spin_lock(&work->conn->llist_lock); @@ -7069,9 +7073,6 @@ skip: locks_free_lock(flock);
if (work->state == KSMBD_WORK_CANCELLED) { - spin_lock(&fp->f_lock); - list_del(&work->fp_entry); - spin_unlock(&fp->f_lock); rsp->hdr.Status = STATUS_CANCELLED; kfree(smb_lock); @@ -7093,9 +7094,6 @@ skip: list_del(&smb_lock->clist); spin_unlock(&work->conn->llist_lock);
- spin_lock(&fp->f_lock); - list_del(&work->fp_entry); - spin_unlock(&fp->f_lock); goto retry; } else if (!rc) { spin_lock(&work->conn->llist_lock); --- a/fs/ksmbd/vfs_cache.c +++ b/fs/ksmbd/vfs_cache.c @@ -364,12 +364,11 @@ static void __put_fd_final(struct ksmbd_
static void set_close_state_blocked_works(struct ksmbd_file *fp) { - struct ksmbd_work *cancel_work, *ctmp; + struct ksmbd_work *cancel_work;
spin_lock(&fp->f_lock); - list_for_each_entry_safe(cancel_work, ctmp, &fp->blocked_works, + list_for_each_entry(cancel_work, &fp->blocked_works, fp_entry) { - list_del(&cancel_work->fp_entry); cancel_work->state = KSMBD_WORK_CLOSED; cancel_work->cancel_fn(cancel_work->cancel_argv); }
From: Joel Fernandes (Google) joel@joelfernandes.org
commit d52d3a2bf408ff86f3a79560b5cce80efb340239 upstream.
During rcutorture shutdown, the rcu_torture_cleanup() function calls torture_cleanup_begin(), which sets the fullstop global variable to FULLSTOP_RMMOD. This causes the rcutorture threads for readers and fakewriters to exit all of their "while" loops and start shutting down.
They then call torture_kthread_stopping(), which in turn waits for kthread_stop() to be called. However, rcu_torture_cleanup() has not yet called kthread_stop() on those threads, and before it gets a chance to do so, multiple instances of torture_kthread_stopping() invoke schedule_timeout_interruptible(1) in a tight loop. Tracing confirms that TIMER_SOFTIRQ can then continuously execute timer callbacks. If that TIMER_SOFTIRQ preempts the task executing rcu_torture_cleanup(), that task might never invoke kthread_stop().
This commit improves this situation by increasing the timeout passed to schedule_timeout_interruptible() from one jiffy to 1/20th of a second. This change prevents TIMER_SOFTIRQ from monopolizing its CPU, thus allowing rcu_torture_cleanup() to carry out the needed kthread_stop() invocations. Testing has shown 100 runs of TREE07 passing reliably, as oppose to the tens-of-percent failure rates seen beforehand.
Cc: Paul McKenney paulmck@kernel.org Cc: Frederic Weisbecker fweisbec@gmail.com Cc: Zhouyi Zhou zhouzhouyi@gmail.com Cc: stable@vger.kernel.org # 6.0.x Signed-off-by: Joel Fernandes (Google) joel@joelfernandes.org Tested-by: Zhouyi Zhou zhouzhouyi@gmail.com Reviewed-by: Davidlohr Bueso dave@stgolabs.net Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/torture.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/torture.c +++ b/kernel/torture.c @@ -915,7 +915,7 @@ void torture_kthread_stopping(char *titl VERBOSE_TOROUT_STRING(buf); while (!kthread_should_stop()) { torture_shutdown_absorb(title); - schedule_timeout_uninterruptible(1); + schedule_timeout_uninterruptible(HZ / 20); } } EXPORT_SYMBOL_GPL(torture_kthread_stopping);
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
commit af1c89ddb74f170eccd5a57001d7317560b638ea upstream.
The HDMI phy compatible was missing vendor prefix.
Fixes: ed80d4cab772 ("ARM: dts: add hdmi related nodes for exynos4 SoCs") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230125094513.155063-1-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/exynos4.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/exynos4.dtsi +++ b/arch/arm/boot/dts/exynos4.dtsi @@ -605,7 +605,7 @@ status = "disabled";
hdmi_i2c_phy: hdmiphy@38 { - compatible = "exynos4210-hdmiphy"; + compatible = "samsung,exynos4210-hdmiphy"; reg = <0x38>; }; };
From: Jens Axboe axboe@kernel.dk
commit 2f2bb1ffc9983e227424d0787289da5483b0c74f upstream.
Just like for task_work, set the task mode to TASK_RUNNING before doing any potential resume work. We're not holding any locks at this point, but we may have already set the task state to TASK_INTERRUPTIBLE in preparation for going to sleep waiting for events. Ensure that we set it back to TASK_RUNNING if we have work to process, to avoid warnings on calling blocking operations with !TASK_RUNNING.
Fixes: b5d3ae202fbf ("io_uring: handle TIF_NOTIFY_RESUME when checking for task_work") Reported-by: kernel test robot oliver.sang@intel.com Link: https://lore.kernel.org/oe-lkp/202302062208.24d3e563-oliver.sang@intel.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- io_uring/io_uring.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
--- a/io_uring/io_uring.h +++ b/io_uring/io_uring.h @@ -276,8 +276,10 @@ static inline int io_run_task_work(void) * notify work that needs processing. */ if (current->flags & PF_IO_WORKER && - test_thread_flag(TIF_NOTIFY_RESUME)) + test_thread_flag(TIF_NOTIFY_RESUME)) { + __set_current_state(TASK_RUNNING); resume_user_mode_work(NULL); + } if (task_work_pending(current)) { __set_current_state(TASK_RUNNING); task_work_run();
From: Liu Shixin liushixin2@huawei.com
commit a9dc087fd3c484fd1ed18c5efb290efaaf44ce03 upstream.
Syzbot found a kernel BUG in hfs_bnode_put():
kernel BUG at fs/hfs/bnode.c:466! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wb_workfn (flush-7:0) RIP: 0010:hfs_bnode_put+0x46f/0x480 fs/hfs/bnode.c:466 Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56 RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293 RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1 R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80 R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> hfs_write_inode+0x1bc/0xb40 write_inode fs/fs-writeback.c:1440 [inline] __writeback_single_inode+0x4d6/0x670 fs/fs-writeback.c:1652 writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1878 __writeback_inodes_wb+0x125/0x420 fs/fs-writeback.c:1949 wb_writeback+0x440/0x7b0 fs/fs-writeback.c:2054 wb_check_start_all fs/fs-writeback.c:2176 [inline] wb_do_writeback fs/fs-writeback.c:2202 [inline] wb_workfn+0x827/0xef0 fs/fs-writeback.c:2235 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK>
The BUG_ON() is triggered at here:
/* Dispose of resources used by a node */ void hfs_bnode_put(struct hfs_bnode *node) { if (node) { <skipped> BUG_ON(!atomic_read(&node->refcnt)); <- we have issue here!!!! <skipped> } }
By tracing the refcnt, I found the node is created by hfs_bmap_alloc() with refcnt 1. Then the node is used by hfs_btree_write(). There is a missing of hfs_bnode_get() after find the node. The issue happened in following path:
<alloc> hfs_bmap_alloc hfs_bnode_find __hfs_bnode_create <- allocate a new node with refcnt 1. hfs_bnode_put <- decrease the refcnt
<write> hfs_btree_write hfs_bnode_find __hfs_bnode_create hfs_bnode_findhash <- find the node without refcnt increased. hfs_bnode_put <- trigger the BUG_ON() since refcnt is 0.
Link: https://lkml.kernel.org/r/20221212021627.3766829-1-liushixin2@huawei.com Reported-by: syzbot+5b04b49a7ec7226c7426@syzkaller.appspotmail.com Signed-off-by: Liu Shixin liushixin2@huawei.com Cc: Fabio M. De Francesco fmdefrancesco@gmail.com Cc: Viacheslav Dubeyko slava@dubeyko.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/hfs/bnode.c | 1 + 1 file changed, 1 insertion(+)
--- a/fs/hfs/bnode.c +++ b/fs/hfs/bnode.c @@ -274,6 +274,7 @@ static struct hfs_bnode *__hfs_bnode_cre tree->node_hash[hash] = node; tree->node_hash_cnt++; } else { + hfs_bnode_get(node2); spin_unlock(&tree->hash_lock); kfree(node); wait_event(node2->lock_wq, !test_bit(HFS_BNODE_NEW, &node2->flags));
From: Dongliang Mu mudongliangabcd@gmail.com
commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 upstream.
The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio.
As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close.
To fix this error, we move all iput calls before hfsplus_btree_close.
Note that this patch is tested on Syzbot.
Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com Reported-by: syzbot+57e3e98f7e3b80f64d56@syzkaller.appspotmail.com Tested-by: Dongliang Mu mudongliangabcd@gmail.com Signed-off-by: Dongliang Mu mudongliangabcd@gmail.com Cc: Bart Van Assche bvanassche@acm.org Cc: Jens Axboe axboe@kernel.dk Cc: Muchun Song songmuchun@bytedance.com Cc: Roman Gushchin roman.gushchin@linux.dev Cc: "Theodore Ts'o" tytso@mit.edu Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/hfsplus/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/hfsplus/super.c +++ b/fs/hfsplus/super.c @@ -295,11 +295,11 @@ static void hfsplus_put_super(struct sup hfsplus_sync_fs(sb, 1); }
+ iput(sbi->alloc_file); + iput(sbi->hidden_dir); hfs_btree_close(sbi->attr_tree); hfs_btree_close(sbi->cat_tree); hfs_btree_close(sbi->ext_tree); - iput(sbi->alloc_file); - iput(sbi->hidden_dir); kfree(sbi->s_vhdr_buf); kfree(sbi->s_backup_vhdr_buf); unload_nls(sbi->nls);
From: Yuezhang Mo Yuezhang.Mo@sony.com
commit 706fdcac002316893434d753be8cfb549fe1d40d upstream.
Since seekdir() does not check whether the position is valid, the position may exceed the size of the directory. We found that for a directory with discontinuous clusters, if the position exceeds the size of the directory and the excess size is greater than or equal to the cluster size, exfat_readdir() will return -EIO, causing a file system error and making the file system unavailable.
Reproduce this bug by:
seekdir(dir, dir_size + cluster_size); dirent = readdir(dir);
The following log will be printed if mount with 'errors=remount-ro'.
[11166.712896] exFAT-fs (sdb1): error, invalid access to FAT (entry 0xffffffff) [11166.712905] exFAT-fs (sdb1): Filesystem has been set read-only
Fixes: 1e5654de0f51 ("exfat: handle wrong stream entry size in exfat_readdir()") Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Yuezhang Mo Yuezhang.Mo@sony.com Reviewed-by: Andy Wu Andy.Wu@sony.com Reviewed-by: Aoyama Wataru wataru.aoyama@sony.com Reviewed-by: Sungjong Seo sj1557.seo@samsung.com Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/exfat/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -100,7 +100,7 @@ static int exfat_readdir(struct inode *i clu.dir = ei->hint_bmap.clu; }
- while (clu_offset > 0) { + while (clu_offset > 0 && clu.dir != EXFAT_EOF_CLUSTER) { if (exfat_get_next_cluster(sb, &(clu.dir))) return -EIO;
From: Yuezhang Mo Yuezhang.Mo@sony.com
commit 6cb5d1a16a51d080fbc1649a5144cbc5ca7d6f88 upstream.
If the position is not aligned with the dentry size, the return value of readdir() will be NULL and errno is 0, which means the end of the directory stream is reached.
If the position is aligned with dentry size, but there is no file or directory at the position, exfat_readdir() will continue to get dentry from the next dentry. So the dentry gotten by readdir() may not be at the position.
After this commit, if the position is not aligned with the dentry size, round the position up to the dentry size and continue to get the dentry.
Fixes: ca06197382bd ("exfat: add directory operations") Cc: stable@vger.kernel.org # v5.7+ Reported-by: Wang Yugui wangyugui@e16-tech.com Signed-off-by: Yuezhang Mo Yuezhang.Mo@sony.com Reviewed-by: Andy Wu Andy.Wu@sony.com Reviewed-by: Aoyama Wataru wataru.aoyama@sony.com Reviewed-by: Sungjong Seo sj1557.seo@samsung.com Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/exfat/dir.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
--- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -234,10 +234,7 @@ static int exfat_iterate(struct file *fi fake_offset = 1; }
- if (cpos & (DENTRY_SIZE - 1)) { - err = -ENOENT; - goto unlock; - } + cpos = round_up(cpos, DENTRY_SIZE);
/* name buffer should be allocated before use */ err = exfat_alloc_namebuf(nb);
From: Sungjong Seo sj1557.seo@samsung.com
commit bdaadfd343e3cba49ad0b009ff4b148dad0fa404 upstream.
When a file or a directory is deleted, the hint for the cluster of its parent directory in its in-memory inode is set as DIR_DELETED. Therefore, DIR_DELETED must be one of invalid cluster numbers. According to the exFAT specification, a volume can have at most 2^32-11 clusters. However, DIR_DELETED is wrongly defined as 0xFFFF0321, which could be a valid cluster number. To fix it, let's redefine DIR_DELETED as 0xFFFFFFF7, the bad cluster number.
Fixes: 1acf1a564b60 ("exfat: add in-memory and on-disk structures and headers") Cc: stable@vger.kernel.org # v5.7+ Reported-by: Yuezhang Mo Yuezhang.Mo@sony.com Signed-off-by: Sungjong Seo sj1557.seo@samsung.com Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/exfat/exfat_fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/exfat/exfat_fs.h +++ b/fs/exfat/exfat_fs.h @@ -50,7 +50,7 @@ enum { #define ES_IDX_LAST_FILENAME(name_len) \ (ES_IDX_FIRST_FILENAME + EXFAT_FILENAME_ENTRY_NUM(name_len) - 1)
-#define DIR_DELETED 0xFFFF0321 +#define DIR_DELETED 0xFFFFFFF7
/* type values */ #define TYPE_UNUSED 0x0000
From: Yuezhang Mo Yuezhang.Mo@sony.com
commit 39c1ce8eafc0ff64fb9e28536ccc7df6a8e2999d upstream.
inode->i_blocks is not real number of blocks, but 512 byte ones.
Fixes: 98d917047e8b ("exfat: add file operations") Cc: stable@vger.kernel.org # v5.7+ Reported-by: Wang Yugui wangyugui@e16-tech.com Tested-by: Wang Yugui wangyugui@e16-tech.com Signed-off-by: Yuezhang Mo Yuezhang.Mo@sony.com Reviewed-by: Andy Wu Andy.Wu@sony.com Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/exfat/file.c | 3 +-- fs/exfat/inode.c | 6 ++---- fs/exfat/namei.c | 2 +- fs/exfat/super.c | 3 +-- 4 files changed, 5 insertions(+), 9 deletions(-)
--- a/fs/exfat/file.c +++ b/fs/exfat/file.c @@ -209,8 +209,7 @@ void exfat_truncate(struct inode *inode) if (err) goto write_size;
- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> - inode->i_blkbits; + inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9; write_size: aligned_size = i_size_read(inode); if (aligned_size & (blocksize - 1)) { --- a/fs/exfat/inode.c +++ b/fs/exfat/inode.c @@ -220,8 +220,7 @@ static int exfat_map_cluster(struct inod num_clusters += num_to_be_allocated; *clu = new_clu.dir;
- inode->i_blocks += - num_to_be_allocated << sbi->sect_per_clus_bits; + inode->i_blocks += EXFAT_CLU_TO_B(num_to_be_allocated, sbi) >> 9;
/* * Move *clu pointer along FAT chains (hole care) because the @@ -576,8 +575,7 @@ static int exfat_fill_inode(struct inode
exfat_save_attr(inode, info->attr);
- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> - inode->i_blkbits; + inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9; inode->i_mtime = info->mtime; inode->i_ctime = info->mtime; ei->i_crtime = info->crtime; --- a/fs/exfat/namei.c +++ b/fs/exfat/namei.c @@ -396,7 +396,7 @@ static int exfat_find_empty_entry(struct ei->i_size_ondisk += sbi->cluster_size; ei->i_size_aligned += sbi->cluster_size; ei->flags = p_dir->flags; - inode->i_blocks += 1 << sbi->sect_per_clus_bits; + inode->i_blocks += sbi->cluster_size >> 9; }
return dentry; --- a/fs/exfat/super.c +++ b/fs/exfat/super.c @@ -373,8 +373,7 @@ static int exfat_read_root(struct inode inode->i_op = &exfat_dir_inode_operations; inode->i_fop = &exfat_dir_operations;
- inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> - inode->i_blkbits; + inode->i_blocks = round_up(i_size_read(inode), sbi->cluster_size) >> 9; ei->i_pos = ((loff_t)sbi->root_dir << 32) | 0xffffffff; ei->i_size_aligned = i_size_read(inode); ei->i_size_ondisk = i_size_read(inode);
From: Alexander Aring aahringo@redhat.com
commit aad633dc0cf90093998b1ae0ba9f19b5f1dab644 upstream.
The scand kthread can send dlm messages out, especially dlm remove messages to free memory for unused rsb on other nodes. To send out dlm messages, midcomms must be initialized. This patch moves the midcomms start before scand is started.
Cc: stable@vger.kernel.org Fixes: e7fd41792fc0 ("[DLM] The core of the DLM for GFS2/CLVM") Signed-off-by: Alexander Aring aahringo@redhat.com Signed-off-by: David Teigland teigland@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/dlm/lockspace.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
--- a/fs/dlm/lockspace.c +++ b/fs/dlm/lockspace.c @@ -381,23 +381,23 @@ static int threads_start(void) { int error;
- error = dlm_scand_start(); + /* Thread for sending/receiving messages for all lockspace's */ + error = dlm_midcomms_start(); if (error) { - log_print("cannot start dlm_scand thread %d", error); + log_print("cannot start dlm midcomms %d", error); goto fail; }
- /* Thread for sending/receiving messages for all lockspace's */ - error = dlm_midcomms_start(); + error = dlm_scand_start(); if (error) { - log_print("cannot start dlm midcomms %d", error); - goto scand_fail; + log_print("cannot start dlm_scand thread %d", error); + goto midcomms_fail; }
return 0;
- scand_fail: - dlm_scand_stop(); + midcomms_fail: + dlm_midcomms_stop(); fail: return error; }
From: Alexander Aring aahringo@redhat.com
commit 724b6bab0d75f1dc01fdfbf7fe8d4217a5cb90ba upstream.
While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning:
[ 151.760477] ================================================================== [ 151.761803] BUG: KASAN: use-after-free in dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.763414] Read of size 4 at addr ffff88811a980c60 by task lock_torture/1347
[ 151.765284] CPU: 7 PID: 1347 Comm: lock_torture Not tainted 6.1.0-rc4+ #2828 [ 151.766778] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+16134+e5908aa2 04/01/2014 [ 151.768726] Call Trace: [ 151.769277] <TASK> [ 151.769748] dump_stack_lvl+0x5b/0x86 [ 151.770556] print_report+0x180/0x4c8 [ 151.771378] ? kasan_complete_mode_report_info+0x7c/0x1e0 [ 151.772241] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.773069] kasan_report+0x93/0x1a0 [ 151.773668] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.774514] __asan_load4+0x7e/0xa0 [ 151.775089] dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.775890] ? create_message.isra.29.constprop.64+0x57/0xc0 [ 151.776770] send_common+0x19f/0x1b0 [ 151.777342] ? remove_from_waiters+0x60/0x60 [ 151.778017] ? lock_downgrade+0x410/0x410 [ 151.778648] ? __this_cpu_preempt_check+0x13/0x20 [ 151.779421] ? rcu_lockdep_current_cpu_online+0x88/0xc0 [ 151.780292] _convert_lock+0x46/0x150 [ 151.780893] convert_lock+0x7b/0xc0 [ 151.781459] dlm_lock+0x3ac/0x580 [ 151.781993] ? 0xffffffffc0540000 [ 151.782522] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.783379] ? dlm_scan_rsbs+0xa70/0xa70 [ 151.784003] ? preempt_count_sub+0xd6/0x130 [ 151.784661] ? is_module_address+0x47/0x70 [ 151.785309] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.786166] ? 0xffffffffc0540000 [ 151.786693] ? lockdep_init_map_type+0xc3/0x360 [ 151.787414] ? 0xffffffffc0540000 [ 151.787947] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.789004] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.789858] ? 0xffffffffc0540000 [ 151.790392] ? lock_torture_cleanup+0x20/0x20 [dlm_locktorture] [ 151.791347] ? delay_tsc+0x94/0xc0 [ 151.791898] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.792735] ? torture_start+0x30/0x30 [dlm_locktorture] [ 151.793606] lock_torture+0x177/0x270 [dlm_locktorture] [ 151.794448] ? torture_dlm_lock_sync.isra.3+0x150/0x150 [dlm_locktorture] [ 151.795539] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.796476] ? do_raw_spin_lock+0x11e/0x1e0 [ 151.797152] ? mark_held_locks+0x34/0xb0 [ 151.797784] ? _raw_spin_unlock_irqrestore+0x30/0x70 [ 151.798581] ? __kthread_parkme+0x79/0x110 [ 151.799246] ? trace_preempt_on+0x2a/0xf0 [ 151.799902] ? __kthread_parkme+0x79/0x110 [ 151.800579] ? preempt_count_sub+0xd6/0x130 [ 151.801271] ? __kasan_check_read+0x11/0x20 [ 151.801963] ? __kthread_parkme+0xec/0x110 [ 151.802630] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.803569] kthread+0x192/0x1d0 [ 151.804104] ? kthread_complete_and_exit+0x30/0x30 [ 151.804881] ret_from_fork+0x1f/0x30 [ 151.805480] </TASK>
[ 151.806111] Allocated by task 1347: [ 151.806681] kasan_save_stack+0x26/0x50 [ 151.807308] kasan_set_track+0x25/0x30 [ 151.807920] kasan_save_alloc_info+0x1e/0x30 [ 151.808609] __kasan_slab_alloc+0x63/0x80 [ 151.809263] kmem_cache_alloc+0x1ad/0x830 [ 151.809916] dlm_allocate_mhandle+0x17/0x20 [ 151.810590] dlm_midcomms_get_mhandle+0x96/0x260 [ 151.811344] _create_message+0x95/0x180 [ 151.811994] create_message.isra.29.constprop.64+0x57/0xc0 [ 151.812880] send_common+0x129/0x1b0 [ 151.813467] _convert_lock+0x46/0x150 [ 151.814074] convert_lock+0x7b/0xc0 [ 151.814648] dlm_lock+0x3ac/0x580 [ 151.815199] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.816258] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.817129] lock_torture+0x177/0x270 [dlm_locktorture] [ 151.817986] kthread+0x192/0x1d0 [ 151.818518] ret_from_fork+0x1f/0x30
[ 151.819369] Freed by task 1336: [ 151.819890] kasan_save_stack+0x26/0x50 [ 151.820514] kasan_set_track+0x25/0x30 [ 151.821128] kasan_save_free_info+0x2e/0x50 [ 151.821812] __kasan_slab_free+0x107/0x1a0 [ 151.822483] kmem_cache_free+0x204/0x5e0 [ 151.823152] dlm_free_mhandle+0x18/0x20 [ 151.823781] dlm_mhandle_release+0x2e/0x40 [ 151.824454] rcu_core+0x583/0x1330 [ 151.825047] rcu_core_si+0xe/0x20 [ 151.825594] __do_softirq+0xf4/0x5c2
[ 151.826450] Last potentially related work creation: [ 151.827238] kasan_save_stack+0x26/0x50 [ 151.827870] __kasan_record_aux_stack+0xa2/0xc0 [ 151.828609] kasan_record_aux_stack_noalloc+0xb/0x20 [ 151.829415] call_rcu+0x4c/0x760 [ 151.829954] dlm_mhandle_delete+0x97/0xb0 [ 151.830718] dlm_process_incoming_buffer+0x2fc/0xb30 [ 151.831524] process_dlm_messages+0x16e/0x470 [ 151.832245] process_one_work+0x505/0xa10 [ 151.832905] worker_thread+0x67/0x650 [ 151.833507] kthread+0x192/0x1d0 [ 151.834046] ret_from_fork+0x1f/0x30
[ 151.834900] The buggy address belongs to the object at ffff88811a980c30 which belongs to the cache dlm_mhandle of size 88 [ 151.836894] The buggy address is located 48 bytes inside of 88-byte region [ffff88811a980c30, ffff88811a980c88)
[ 151.839007] The buggy address belongs to the physical page: [ 151.839904] page:0000000076cf5d62 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11a980 [ 151.841378] flags: 0x8000000000000200(slab|zone=2) [ 151.842141] raw: 8000000000000200 0000000000000000 dead000000000122 ffff8881089b43c0 [ 151.843401] raw: 0000000000000000 0000000000220022 00000001ffffffff 0000000000000000 [ 151.844640] page dumped because: kasan: bad access detected
[ 151.845822] Memory state around the buggy address: [ 151.846602] ffff88811a980b00: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb [ 151.847761] ffff88811a980b80: fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb [ 151.848921] >ffff88811a980c00: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb [ 151.850076] ^ [ 151.851085] ffff88811a980c80: fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb [ 151.852269] ffff88811a980d00: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fc [ 151.853428] ================================================================== [ 151.855618] Disabling lock debugging due to kernel taint
It is accessing a mhandle in dlm_midcomms_commit_mhandle() and the mhandle was freed by a call_rcu() call in dlm_process_incoming_buffer(), dlm_mhandle_delete(). It looks like it was freed because an ack of this message was received. There is a short race between committing the dlm message to be transmitted and getting an ack back. If the ack is faster than returning from dlm_midcomms_commit_msg_3_2(), then we run into a use-after free because we still need to reference the mhandle when calling srcu_read_unlock().
To avoid that, we don't allow that mhandle to be freed between dlm_midcomms_commit_msg_3_2() and srcu_read_unlock() by using rcu read lock. We can do that because mhandle is protected by rcu handling.
Cc: stable@vger.kernel.org Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") Signed-off-by: Alexander Aring aahringo@redhat.com Signed-off-by: David Teigland teigland@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/dlm/midcomms.c | 7 +++++++ 1 file changed, 7 insertions(+)
--- a/fs/dlm/midcomms.c +++ b/fs/dlm/midcomms.c @@ -1214,8 +1214,15 @@ void dlm_midcomms_commit_mhandle(struct dlm_free_mhandle(mh); break; case DLM_VERSION_3_2: + /* held rcu read lock here, because we sending the + * dlm message out, when we do that we could receive + * an ack back which releases the mhandle and we + * get a use after free. + */ + rcu_read_lock(); dlm_midcomms_commit_msg_3_2(mh, name, namelen); srcu_read_unlock(&nodes_srcu, mh->idx); + rcu_read_unlock(); break; default: srcu_read_unlock(&nodes_srcu, mh->idx);
From: Alexander Aring aahringo@redhat.com
commit 7354fa4ef697191effedc2ae9a8293427708bbf5 upstream.
If we release a midcomms node structure, there should be nothing left inside the dlm midcomms send queue. However, sometimes this is not true because I believe some DLM_FIN message was not acked... if we run into a shutdown timeout, then we should be sure there is no pending send dlm message inside this queue when releasing midcomms node structure.
Cc: stable@vger.kernel.org Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") Signed-off-by: Alexander Aring aahringo@redhat.com Signed-off-by: David Teigland teigland@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/dlm/midcomms.c | 1 + 1 file changed, 1 insertion(+)
--- a/fs/dlm/midcomms.c +++ b/fs/dlm/midcomms.c @@ -1402,6 +1402,7 @@ static void midcomms_node_release(struct struct midcomms_node *node = container_of(rcu, struct midcomms_node, rcu);
WARN_ON_ONCE(atomic_read(&node->send_queue_cnt)); + dlm_send_queue_flush(node); kfree(node); }
From: Alexander Aring aahringo@redhat.com
commit 164272113b685927126c938b4a9cbd2075eb15ee upstream.
This patch sets the stop tx flag before we commit the dlm message. This flag will report about unexpected transmissions after we send the DLM_FIN message out, which should be the last message sent. When we commit the dlm fin message, it could be that we already got an ack back and the CLOSED state change already happened. We should not set this flag when we are in CLOSED state. To avoid this race we simply set the tx flag before the state change can be in progress by moving it before dlm_midcomms_commit_mhandle().
Cc: stable@vger.kernel.org Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") Signed-off-by: Alexander Aring aahringo@redhat.com Signed-off-by: David Teigland teigland@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/dlm/midcomms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/dlm/midcomms.c +++ b/fs/dlm/midcomms.c @@ -406,6 +406,7 @@ static int dlm_send_fin(struct midcomms_ if (!mh) return -ENOMEM;
+ set_bit(DLM_NODE_FLAG_STOP_TX, &node->flags); mh->ack_rcv = ack_rcv;
m_header = (struct dlm_header *)ppc; @@ -417,7 +418,6 @@ static int dlm_send_fin(struct midcomms_
pr_debug("sending fin msg to node %d\n", node->nodeid); dlm_midcomms_commit_mhandle(mh, NULL, 0); - set_bit(DLM_NODE_FLAG_STOP_TX, &node->flags);
return 0; }
From: Alexander Aring aahringo@redhat.com
commit 15c63db8e86a72e0d5cfb9bf0cd1870e39a3e5fe upstream.
Similar to the stop tx flag, the rx flag should warn about a dlm message being received at DLM_FIN state change, when we are assuming no other dlm application messages. If we receive a FIN message and we are in the state DLM_FIN_WAIT2 we call midcomms_node_reset() which puts the midcomms node into DLM_CLOSED state. Afterwards we should not set the DLM_NODE_FLAG_STOP_RX flag any more. This patch changes the setting DLM_NODE_FLAG_STOP_RX in those state changes when we receive a FIN message and we assume there will be no other dlm application messages received until we hit DLM_CLOSED state.
Cc: stable@vger.kernel.org Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") Signed-off-by: Alexander Aring aahringo@redhat.com Signed-off-by: David Teigland teigland@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/dlm/midcomms.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/dlm/midcomms.c +++ b/fs/dlm/midcomms.c @@ -524,6 +524,7 @@ static void dlm_midcomms_receive_buffer( break; case DLM_FIN_WAIT1: node->state = DLM_CLOSING; + set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); pr_debug("switch node %d to state %s\n", node->nodeid, dlm_state_str(node->state)); break; @@ -544,8 +545,6 @@ static void dlm_midcomms_receive_buffer( return; } spin_unlock(&node->state_lock); - - set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); break; default: WARN_ON_ONCE(test_bit(DLM_NODE_FLAG_STOP_RX, &node->flags));
From: Alexander Aring aahringo@redhat.com
commit a58496361802070996f9bd76e941d109c4a85ebd upstream.
This patch moves the send fin handling, which should appear in a specific state change, into the state change handling while the per node state_lock is held. I experienced issues with other messages because we changed the state and a fin message was sent out in a different state.
Cc: stable@vger.kernel.org Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") Signed-off-by: Alexander Aring aahringo@redhat.com Signed-off-by: David Teigland teigland@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/dlm/midcomms.c | 33 +++++++++------------------------ 1 file changed, 9 insertions(+), 24 deletions(-)
--- a/fs/dlm/midcomms.c +++ b/fs/dlm/midcomms.c @@ -402,7 +402,7 @@ static int dlm_send_fin(struct midcomms_ struct dlm_mhandle *mh; char *ppc;
- mh = dlm_midcomms_get_mhandle(node->nodeid, mb_len, GFP_NOFS, &ppc); + mh = dlm_midcomms_get_mhandle(node->nodeid, mb_len, GFP_ATOMIC, &ppc); if (!mh) return -ENOMEM;
@@ -518,8 +518,8 @@ static void dlm_midcomms_receive_buffer( node->state = DLM_LAST_ACK; pr_debug("switch node %d to state %s case 1\n", node->nodeid, dlm_state_str(node->state)); - spin_unlock(&node->state_lock); - goto send_fin; + set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); + dlm_send_fin(node, dlm_pas_fin_ack_rcv); } break; case DLM_FIN_WAIT1: @@ -563,12 +563,6 @@ static void dlm_midcomms_receive_buffer( log_print_ratelimited("ignore dlm msg because seq mismatch, seq: %u, expected: %u, nodeid: %d", seq, node->seq_next, node->nodeid); } - - return; - -send_fin: - set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); - dlm_send_fin(node, dlm_pas_fin_ack_rcv); }
static struct midcomms_node * @@ -1368,11 +1362,11 @@ void dlm_midcomms_remove_member(int node case DLM_CLOSE_WAIT: /* passive shutdown DLM_LAST_ACK case 2 */ node->state = DLM_LAST_ACK; - spin_unlock(&node->state_lock); - pr_debug("switch node %d to state %s case 2\n", node->nodeid, dlm_state_str(node->state)); - goto send_fin; + set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); + dlm_send_fin(node, dlm_pas_fin_ack_rcv); + break; case DLM_LAST_ACK: /* probably receive fin caught it, do nothing */ break; @@ -1388,12 +1382,6 @@ void dlm_midcomms_remove_member(int node spin_unlock(&node->state_lock);
srcu_read_unlock(&nodes_srcu, idx); - return; - -send_fin: - set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); - dlm_send_fin(node, dlm_pas_fin_ack_rcv); - srcu_read_unlock(&nodes_srcu, idx); }
static void midcomms_node_release(struct rcu_head *rcu) @@ -1425,6 +1413,7 @@ static void midcomms_shutdown(struct mid node->state = DLM_FIN_WAIT1; pr_debug("switch node %d to state %s case 2\n", node->nodeid, dlm_state_str(node->state)); + dlm_send_fin(node, dlm_act_fin_ack_rcv); break; case DLM_CLOSED: /* we have what we want */ @@ -1438,12 +1427,8 @@ static void midcomms_shutdown(struct mid } spin_unlock(&node->state_lock);
- if (node->state == DLM_FIN_WAIT1) { - dlm_send_fin(node, dlm_act_fin_ack_rcv); - - if (DLM_DEBUG_FENCE_TERMINATION) - msleep(5000); - } + if (DLM_DEBUG_FENCE_TERMINATION) + msleep(5000);
/* wait for other side dlm + fin */ ret = wait_event_timeout(node->shutdown_wait,
From: Alexander Aring aahringo@redhat.com
commit 00908b3388255fc1d3782b744d07f327712f401f upstream.
This patch moves to send a ack back for receiving a FIN message only when we are in valid states. In other cases and there might be a sender waiting for a ack we just let it timeout at the senders time and hopefully all other cleanups will remove the FIN message on their sending queue. As an example we should never send out an ACK being in LAST_ACK state or we cannot assume a working socket communication when we are in CLOSED state.
Cc: stable@vger.kernel.org Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect") Signed-off-by: Alexander Aring aahringo@redhat.com Signed-off-by: David Teigland teigland@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/dlm/midcomms.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
--- a/fs/dlm/midcomms.c +++ b/fs/dlm/midcomms.c @@ -375,7 +375,7 @@ static int dlm_send_ack(int nodeid, uint struct dlm_msg *msg; char *ppc;
- msg = dlm_lowcomms_new_msg(nodeid, mb_len, GFP_NOFS, &ppc, + msg = dlm_lowcomms_new_msg(nodeid, mb_len, GFP_ATOMIC, &ppc, NULL, NULL); if (!msg) return -ENOMEM; @@ -498,15 +498,14 @@ static void dlm_midcomms_receive_buffer(
switch (p->header.h_cmd) { case DLM_FIN: - /* send ack before fin */ - dlm_send_ack(node->nodeid, node->seq_next); - spin_lock(&node->state_lock); pr_debug("receive fin msg from node %d with state %s\n", node->nodeid, dlm_state_str(node->state));
switch (node->state) { case DLM_ESTABLISHED: + dlm_send_ack(node->nodeid, node->seq_next); + node->state = DLM_CLOSE_WAIT; pr_debug("switch node %d to state %s\n", node->nodeid, dlm_state_str(node->state)); @@ -523,12 +522,14 @@ static void dlm_midcomms_receive_buffer( } break; case DLM_FIN_WAIT1: + dlm_send_ack(node->nodeid, node->seq_next); node->state = DLM_CLOSING; set_bit(DLM_NODE_FLAG_STOP_RX, &node->flags); pr_debug("switch node %d to state %s\n", node->nodeid, dlm_state_str(node->state)); break; case DLM_FIN_WAIT2: + dlm_send_ack(node->nodeid, node->seq_next); midcomms_node_reset(node); pr_debug("switch node %d to state %s\n", node->nodeid, dlm_state_str(node->state));
From: Eric Biggers ebiggers@google.com
commit 9a5571cff4ffcfc24847df9fd545cc5799ac0ee5 upstream.
When converting an inline directory to a regular one, f2fs is leaking uninitialized memory to disk because it doesn't initialize the entire directory block. Fix this by zero-initializing the block.
This bug was introduced by commit 4ec17d688d74 ("f2fs: avoid unneeded initializing when converting inline dentry"), which didn't consider the security implications of leaking uninitialized memory to disk.
This was found by running xfstest generic/435 on a KMSAN-enabled kernel.
Fixes: 4ec17d688d74 ("f2fs: avoid unneeded initializing when converting inline dentry") Cc: stable@vger.kernel.org # v4.3+ Signed-off-by: Eric Biggers ebiggers@google.com Reviewed-by: Chao Yu chao@kernel.org Signed-off-by: Jaegeuk Kim jaegeuk@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/f2fs/inline.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
--- a/fs/f2fs/inline.c +++ b/fs/f2fs/inline.c @@ -422,18 +422,17 @@ static int f2fs_move_inline_dirents(stru
dentry_blk = page_address(page);
+ /* + * Start by zeroing the full block, to ensure that all unused space is + * zeroed and no uninitialized memory is leaked to disk. + */ + memset(dentry_blk, 0, F2FS_BLKSIZE); + make_dentry_ptr_inline(dir, &src, inline_dentry); make_dentry_ptr_block(dir, &dst, dentry_blk);
/* copy data from inline dentry block to new dentry block */ memcpy(dst.bitmap, src.bitmap, src.nr_bitmap); - memset(dst.bitmap + src.nr_bitmap, 0, dst.nr_bitmap - src.nr_bitmap); - /* - * we do not need to zero out remainder part of dentry and filename - * field, since we have used bitmap for marking the usage status of - * them, besides, we can also ignore copying/zeroing reserved space - * of dentry block, because them haven't been used so far. - */ memcpy(dst.dentry, src.dentry, SIZE_OF_DIR_ENTRY * src.max); memcpy(dst.filename, src.filename, src.max * F2FS_SLOT_LEN);
From: Jaegeuk Kim jaegeuk@kernel.org
commit 3aa51c61cb4a4dcb40df51ac61171e9ac5a35321 upstream.
If the storage gives a corrupted node block due to short power failure and reset, f2fs stops the entire operations by setting the checkpoint failure flag.
Let's give more chances to live by re-issuing IOs for a while in such critical path.
Cc: stable@vger.kernel.org Suggested-by: Randall Huang huangrandall@google.com Suggested-by: Chao Yu chao@kernel.org Reviewed-by: Chao Yu chao@kernel.org Signed-off-by: Jaegeuk Kim jaegeuk@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/f2fs/inode.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
--- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -714,18 +714,19 @@ void f2fs_update_inode_page(struct inode { struct f2fs_sb_info *sbi = F2FS_I_SB(inode); struct page *node_page; + int count = 0; retry: node_page = f2fs_get_node_page(sbi, inode->i_ino); if (IS_ERR(node_page)) { int err = PTR_ERR(node_page);
- if (err == -ENOMEM) { - cond_resched(); + /* The node block was truncated. */ + if (err == -ENOENT) + return; + + if (err == -ENOMEM || ++count <= DEFAULT_RETRY_IO_COUNT) goto retry; - } else if (err != -ENOENT) { - f2fs_stop_checkpoint(sbi, false, - STOP_CP_REASON_UPDATE_INODE); - } + f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_UPDATE_INODE); return; } f2fs_update_inode(inode, node_page);
From: Eric Biggers ebiggers@google.com
commit 844545c51a5b2a524b22a2fe9d0b353b827d24b4 upstream.
When writing a page from an encrypted file that is using filesystem-layer encryption (not inline encryption), f2fs encrypts the pagecache page into a bounce page, then writes the bounce page.
It also passes the bounce page to wbc_account_cgroup_owner(). That's incorrect, because the bounce page is a newly allocated temporary page that doesn't have the memory cgroup of the original pagecache page. This makes wbc_account_cgroup_owner() not account the I/O to the owner of the pagecache page as it should.
Fix this by always passing the pagecache page to wbc_account_cgroup_owner().
Fixes: 578c647879f7 ("f2fs: implement cgroup writeback support") Cc: stable@vger.kernel.org Reported-by: Matthew Wilcox (Oracle) willy@infradead.org Signed-off-by: Eric Biggers ebiggers@google.com Acked-by: Tejun Heo tj@kernel.org Reviewed-by: Chao Yu chao@kernel.org Signed-off-by: Jaegeuk Kim jaegeuk@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/f2fs/data.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -741,7 +741,7 @@ int f2fs_submit_page_bio(struct f2fs_io_ }
if (fio->io_wbc && !is_read_io(fio->op)) - wbc_account_cgroup_owner(fio->io_wbc, page, PAGE_SIZE); + wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
inc_page_count(fio->sbi, is_read_io(fio->op) ? __read_io_type(page) : WB_DATA_TYPE(fio->page)); @@ -948,7 +948,7 @@ alloc_new: }
if (fio->io_wbc) - wbc_account_cgroup_owner(fio->io_wbc, page, PAGE_SIZE); + wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
inc_page_count(fio->sbi, WB_DATA_TYPE(page));
@@ -1022,7 +1022,7 @@ alloc_new: }
if (fio->io_wbc) - wbc_account_cgroup_owner(fio->io_wbc, bio_page, PAGE_SIZE); + wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
io->last_block_in_bio = fio->new_blkaddr;
From: Jaegeuk Kim jaegeuk@kernel.org
commit 267c159f9c7bcb7009dae16889b880c5ed8759a8 upstream.
We should return when io->bio is null before doing anything. Otherwise, panic.
BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs] Call Trace: <TASK> f2fs_submit_merged_write+0x1d/0x30 [f2fs] commit_checkpoint+0x110/0x1e0 [f2fs] f2fs_write_checkpoint+0x9f7/0xf00 [f2fs] ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] __checkpoint_and_complete_reqs+0x84/0x190 [f2fs] ? preempt_count_add+0x82/0xc0 ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] issue_checkpoint_thread+0x4c/0xf0 [f2fs] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0xff/0x130 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK>
Cc: stable@vger.kernel.org # v5.18+ Fixes: 64bf0eef0171 ("f2fs: pass the bio operation to bio_alloc_bioset") Reviewed-by: Chao Yu chao@kernel.org Signed-off-by: Jaegeuk Kim jaegeuk@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/f2fs/data.c | 4 ++++ 1 file changed, 4 insertions(+)
--- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -655,6 +655,9 @@ static void __f2fs_submit_merged_write(s
f2fs_down_write(&io->io_rwsem);
+ if (!io->bio) + goto unlock_out; + /* change META to META_FLUSH in the checkpoint procedure */ if (type >= META_FLUSH) { io->fio.type = META_FLUSH; @@ -663,6 +666,7 @@ static void __f2fs_submit_merged_write(s io->bio->bi_opf |= REQ_PREFLUSH | REQ_FUA; } __submit_merged_bio(io); +unlock_out: f2fs_up_write(&io->io_rwsem); }
From: Jaegeuk Kim jaegeuk@kernel.org
commit c7dbc06688292db34c1bb9c715e29ac4935af994 upstream.
We should not truncate replaced blocks, and were supposed to truncate the first part as well.
This reverts commit 78a99fe6254cad4be310cd84af39f6c46b668c72.
Cc: stable@vger.kernel.org Reviewed-by: Chao Yu chao@kernel.org Signed-off-by: Jaegeuk Kim jaegeuk@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/f2fs/segment.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
--- a/fs/f2fs/segment.c +++ b/fs/f2fs/segment.c @@ -262,19 +262,24 @@ static void __complete_revoke_list(struc bool revoke) { struct revoke_entry *cur, *tmp; + pgoff_t start_index = 0; bool truncate = is_inode_flag_set(inode, FI_ATOMIC_REPLACE);
list_for_each_entry_safe(cur, tmp, head, list) { - if (revoke) + if (revoke) { __replace_atomic_write_block(inode, cur->index, cur->old_addr, NULL, true); + } else if (truncate) { + f2fs_truncate_hole(inode, start_index, cur->index); + start_index = cur->index + 1; + }
list_del(&cur->list); kmem_cache_free(revoke_entry_slab, cur); }
if (!revoke && truncate) - f2fs_do_truncate_blocks(inode, 0, false); + f2fs_do_truncate_blocks(inode, start_index * PAGE_SIZE, false); }
static int __f2fs_commit_atomic_write(struct inode *inode)
From: Heming Zhao via Ocfs2-devel ocfs2-devel@oss.oracle.com
commit 60eed1e3d45045623e46944ebc7c42c30a4350f0 upstream.
code path:
ocfs2_ioctl_move_extents ocfs2_move_extents ocfs2_defrag_extent __ocfs2_move_extent + ocfs2_journal_access_di + ocfs2_split_extent //sub-paths call jbd2_journal_restart + ocfs2_journal_dirty //crash by jbs2 ASSERT
crash stacks:
PID: 11297 TASK: ffff974a676dcd00 CPU: 67 COMMAND: "defragfs.ocfs2" #0 [ffffb25d8dad3900] machine_kexec at ffffffff8386fe01 #1 [ffffb25d8dad3958] __crash_kexec at ffffffff8395959d #2 [ffffb25d8dad3a20] crash_kexec at ffffffff8395a45d #3 [ffffb25d8dad3a38] oops_end at ffffffff83836d3f #4 [ffffb25d8dad3a58] do_trap at ffffffff83833205 #5 [ffffb25d8dad3aa0] do_invalid_op at ffffffff83833aa6 #6 [ffffb25d8dad3ac0] invalid_op at ffffffff84200d18 [exception RIP: jbd2_journal_dirty_metadata+0x2ba] RIP: ffffffffc09ca54a RSP: ffffb25d8dad3b70 RFLAGS: 00010207 RAX: 0000000000000000 RBX: ffff9706eedc5248 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff97337029ea28 RDI: ffff9706eedc5250 RBP: ffff9703c3520200 R8: 000000000f46b0b2 R9: 0000000000000000 R10: 0000000000000001 R11: 00000001000000fe R12: ffff97337029ea28 R13: 0000000000000000 R14: ffff9703de59bf60 R15: ffff9706eedc5250 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffb25d8dad3ba8] ocfs2_journal_dirty at ffffffffc137fb95 [ocfs2] #8 [ffffb25d8dad3be8] __ocfs2_move_extent at ffffffffc139a950 [ocfs2] #9 [ffffb25d8dad3c80] ocfs2_defrag_extent at ffffffffc139b2d2 [ocfs2]
Analysis
This bug has the same root cause of 'commit 7f27ec978b0e ("ocfs2: call ocfs2_journal_access_di() before ocfs2_journal_dirty() in ocfs2_write_end_nolock()")'. For this bug, jbd2_journal_restart() is called by ocfs2_split_extent() during defragmenting.
How to fix
For ocfs2_split_extent() can handle journal operations totally by itself. Caller doesn't need to call journal access/dirty pair, and caller only needs to call journal start/stop pair. The fix method is to remove journal access/dirty from __ocfs2_move_extent().
The discussion for this patch: https://oss.oracle.com/pipermail/ocfs2-devel/2023-February/000647.html
Link: https://lkml.kernel.org/r/20230217003717.32469-1-heming.zhao@suse.com Signed-off-by: Heming Zhao heming.zhao@suse.com Reviewed-by: Joseph Qi joseph.qi@linux.alibaba.com Cc: Mark Fasheh mark@fasheh.com Cc: Joel Becker jlbec@evilplan.org Cc: Junxiao Bi junxiao.bi@oracle.com Cc: Changwei Ge gechangwei@live.cn Cc: Gang He ghe@suse.com Cc: Jun Piao piaojun@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ocfs2/move_extents.c | 10 ---------- 1 file changed, 10 deletions(-)
--- a/fs/ocfs2/move_extents.c +++ b/fs/ocfs2/move_extents.c @@ -105,14 +105,6 @@ static int __ocfs2_move_extent(handle_t */ replace_rec.e_flags = ext_flags & ~OCFS2_EXT_REFCOUNTED;
- ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), - context->et.et_root_bh, - OCFS2_JOURNAL_ACCESS_WRITE); - if (ret) { - mlog_errno(ret); - goto out; - } - ret = ocfs2_split_extent(handle, &context->et, path, index, &replace_rec, context->meta_ac, &context->dealloc); @@ -121,8 +113,6 @@ static int __ocfs2_move_extent(handle_t goto out; }
- ocfs2_journal_dirty(handle, context->et.et_root_bh); - context->new_phys_cpos = new_p_cpos;
/*
From: Heming Zhao via Ocfs2-devel ocfs2-devel@oss.oracle.com
commit 236b9254f8d1edc273ad88b420aa85fbd84f492d upstream.
This fixes three issues on move extents ioctl without auto defrag:
a) In ocfs2_find_victim_alloc_group(), we have to convert bits to block first in case of global bitmap.
b) In ocfs2_probe_alloc_group(), when finding enough bits in block group bitmap, we have to back off move_len to start pos as well, otherwise it may corrupt filesystem.
c) In ocfs2_ioctl_move_extents(), set me_threshold both for non-auto and auto defrag paths. Otherwise it will set move_max_hop to 0 and finally cause unexpectedly ENOSPC error.
Currently there are no tools triggering the above issues since defragfs.ocfs2 enables auto defrag by default. Tested with manually changing defragfs.ocfs2 to run non auto defrag path.
Link: https://lkml.kernel.org/r/20230220050526.22020-1-heming.zhao@suse.com Signed-off-by: Heming Zhao heming.zhao@suse.com Reviewed-by: Joseph Qi joseph.qi@linux.alibaba.com Cc: Mark Fasheh mark@fasheh.com Cc: Joel Becker jlbec@evilplan.org Cc: Junxiao Bi junxiao.bi@oracle.com Cc: Changwei Ge gechangwei@live.cn Cc: Gang He ghe@suse.com Cc: Jun Piao piaojun@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ocfs2/move_extents.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
--- a/fs/ocfs2/move_extents.c +++ b/fs/ocfs2/move_extents.c @@ -434,7 +434,7 @@ static int ocfs2_find_victim_alloc_group bg = (struct ocfs2_group_desc *)gd_bh->b_data;
if (vict_blkno < (le64_to_cpu(bg->bg_blkno) + - le16_to_cpu(bg->bg_bits))) { + (le16_to_cpu(bg->bg_bits) << bits_per_unit))) {
*ret_bh = gd_bh; *vict_bit = (vict_blkno - blkno) >> @@ -549,6 +549,7 @@ static void ocfs2_probe_alloc_group(stru last_free_bits++;
if (last_free_bits == move_len) { + i -= move_len; *goal_bit = i; *phys_cpos = base_cpos + i; break; @@ -1020,18 +1021,19 @@ int ocfs2_ioctl_move_extents(struct file
context->range = ⦥
+ /* + * ok, the default theshold for the defragmentation + * is 1M, since our maximum clustersize was 1M also. + * any thought? + */ + if (!range.me_threshold) + range.me_threshold = 1024 * 1024; + + if (range.me_threshold > i_size_read(inode)) + range.me_threshold = i_size_read(inode); + if (range.me_flags & OCFS2_MOVE_EXT_FL_AUTO_DEFRAG) { context->auto_defrag = 1; - /* - * ok, the default theshold for the defragmentation - * is 1M, since our maximum clustersize was 1M also. - * any thought? - */ - if (!range.me_threshold) - range.me_threshold = 1024 * 1024; - - if (range.me_threshold > i_size_read(inode)) - range.me_threshold = i_size_read(inode);
if (range.me_flags & OCFS2_MOVE_EXT_FL_PART_DEFRAG) context->partial = 1;
From: Andrew Morton akpm@linux-foundation.org
commit 3e35102666f873a135d31a726ac1ec8af4905206 upstream.
file_ra_state_init() assumes that the file_ra_state has been zeroed out. Fixes a KMSAN used-unintialized issue (at least).
Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous") Reported-by: syzbot syzbot+8ce7f8308d91e6b8bbe2@syzkaller.appspotmail.com Link: https://lkml.kernel.org/r/0000000000008f74e905f56df987@google.com Cc: Matthew Wilcox willy@infradead.org Cc: Nicolas Pitre nico@fluxnic.net Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/cramfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cramfs/inode.c +++ b/fs/cramfs/inode.c @@ -183,7 +183,7 @@ static void *cramfs_blkdev_read(struct s unsigned int len) { struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping; - struct file_ra_state ra; + struct file_ra_state ra = {}; struct page *pages[BLKS_PER_BUF]; unsigned i, blocknr, buffer; unsigned long devsize;
From: Jeff Xu jeffxu@google.com
commit 366617a69e60610912836570546f118006ebc7cb upstream.
overlayfs may be disabled in the kernel configuration, causing related tests to fail. Check that overlayfs is supported at runtime, so we can skip layout2_overlay.* accordingly.
Signed-off-by: Jeff Xu jeffxu@google.com Reviewed-by: Guenter Roeck groeck@chromium.org Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230113053229.1281774-2-jeffxu@google.com [mic: Reword comments and constify variables] Signed-off-by: Mickaël Salaün mic@digikod.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/landlock/fs_test.c | 47 +++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+)
--- a/tools/testing/selftests/landlock/fs_test.c +++ b/tools/testing/selftests/landlock/fs_test.c @@ -11,6 +11,7 @@ #include <fcntl.h> #include <linux/landlock.h> #include <sched.h> +#include <stdio.h> #include <string.h> #include <sys/capability.h> #include <sys/mount.h> @@ -89,6 +90,40 @@ static const char dir_s3d3[] = TMP_DIR " * └── s3d3 */
+static bool fgrep(FILE *const inf, const char *const str) +{ + char line[32]; + const int slen = strlen(str); + + while (!feof(inf)) { + if (!fgets(line, sizeof(line), inf)) + break; + if (strncmp(line, str, slen)) + continue; + + return true; + } + + return false; +} + +static bool supports_overlayfs(void) +{ + bool res; + FILE *const inf = fopen("/proc/filesystems", "r"); + + /* + * Consider that the filesystem is supported if we cannot get the + * supported ones. + */ + if (!inf) + return true; + + res = fgrep(inf, "nodev\toverlay\n"); + fclose(inf); + return res; +} + static void mkdir_parents(struct __test_metadata *const _metadata, const char *const path) { @@ -4001,6 +4036,9 @@ FIXTURE(layout2_overlay) {};
FIXTURE_SETUP(layout2_overlay) { + if (!supports_overlayfs()) + SKIP(return, "overlayfs is not supported"); + prepare_layout(_metadata);
create_directory(_metadata, LOWER_BASE); @@ -4037,6 +4075,9 @@ FIXTURE_SETUP(layout2_overlay)
FIXTURE_TEARDOWN(layout2_overlay) { + if (!supports_overlayfs()) + SKIP(return, "overlayfs is not supported"); + EXPECT_EQ(0, remove_path(lower_do1_fl3)); EXPECT_EQ(0, remove_path(lower_dl1_fl2)); EXPECT_EQ(0, remove_path(lower_fl1)); @@ -4068,6 +4109,9 @@ FIXTURE_TEARDOWN(layout2_overlay)
TEST_F_FORK(layout2_overlay, no_restriction) { + if (!supports_overlayfs()) + SKIP(return, "overlayfs is not supported"); + ASSERT_EQ(0, test_open(lower_fl1, O_RDONLY)); ASSERT_EQ(0, test_open(lower_dl1, O_RDONLY)); ASSERT_EQ(0, test_open(lower_dl1_fl2, O_RDONLY)); @@ -4231,6 +4275,9 @@ TEST_F_FORK(layout2_overlay, same_conten size_t i; const char *path_entry;
+ if (!supports_overlayfs()) + SKIP(return, "overlayfs is not supported"); + /* Sets rules on base directories (i.e. outside overlay scope). */ ruleset_fd = create_ruleset(_metadata, ACCESS_RW, layer1_base); ASSERT_LE(0, ruleset_fd);
From: Jeff Xu jeffxu@google.com
commit 8677e555f17f51321d0730b945aeb7d4b95f998f upstream.
Update ptrace tests according to all potential Yama security policies. This is required to make such tests pass even if Yama is enabled.
Tests are not skipped but they now check both Landlock and Yama boundary restrictions at run time to keep a maximum test coverage (i.e. positive and negative testing).
Signed-off-by: Jeff Xu jeffxu@google.com Link: https://lore.kernel.org/r/20230114020306.1407195-2-jeffxu@google.com Cc: stable@vger.kernel.org [mic: Add curly braces around EXPECT_EQ() to make it build, and improve commit message] Co-developed-by: Mickaël Salaün mic@digikod.net Signed-off-by: Mickaël Salaün mic@digikod.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/landlock/ptrace_test.c | 113 +++++++++++++++++++++---- 1 file changed, 96 insertions(+), 17 deletions(-)
--- a/tools/testing/selftests/landlock/ptrace_test.c +++ b/tools/testing/selftests/landlock/ptrace_test.c @@ -19,6 +19,12 @@
#include "common.h"
+/* Copied from security/yama/yama_lsm.c */ +#define YAMA_SCOPE_DISABLED 0 +#define YAMA_SCOPE_RELATIONAL 1 +#define YAMA_SCOPE_CAPABILITY 2 +#define YAMA_SCOPE_NO_ATTACH 3 + static void create_domain(struct __test_metadata *const _metadata) { int ruleset_fd; @@ -60,6 +66,25 @@ static int test_ptrace_read(const pid_t return 0; }
+static int get_yama_ptrace_scope(void) +{ + int ret; + char buf[2] = {}; + const int fd = open("/proc/sys/kernel/yama/ptrace_scope", O_RDONLY); + + if (fd < 0) + return 0; + + if (read(fd, buf, 1) < 0) { + close(fd); + return -1; + } + + ret = atoi(buf); + close(fd); + return ret; +} + /* clang-format off */ FIXTURE(hierarchy) {}; /* clang-format on */ @@ -232,8 +257,51 @@ TEST_F(hierarchy, trace) pid_t child, parent; int status, err_proc_read; int pipe_child[2], pipe_parent[2]; + int yama_ptrace_scope; char buf_parent; long ret; + bool can_read_child, can_trace_child, can_read_parent, can_trace_parent; + + yama_ptrace_scope = get_yama_ptrace_scope(); + ASSERT_LE(0, yama_ptrace_scope); + + if (yama_ptrace_scope > YAMA_SCOPE_DISABLED) + TH_LOG("Incomplete tests due to Yama restrictions (scope %d)", + yama_ptrace_scope); + + /* + * can_read_child is true if a parent process can read its child + * process, which is only the case when the parent process is not + * isolated from the child with a dedicated Landlock domain. + */ + can_read_child = !variant->domain_parent; + + /* + * can_trace_child is true if a parent process can trace its child + * process. This depends on two conditions: + * - The parent process is not isolated from the child with a dedicated + * Landlock domain. + * - Yama allows tracing children (up to YAMA_SCOPE_RELATIONAL). + */ + can_trace_child = can_read_child && + yama_ptrace_scope <= YAMA_SCOPE_RELATIONAL; + + /* + * can_read_parent is true if a child process can read its parent + * process, which is only the case when the child process is not + * isolated from the parent with a dedicated Landlock domain. + */ + can_read_parent = !variant->domain_child; + + /* + * can_trace_parent is true if a child process can trace its parent + * process. This depends on two conditions: + * - The child process is not isolated from the parent with a dedicated + * Landlock domain. + * - Yama is disabled (YAMA_SCOPE_DISABLED). + */ + can_trace_parent = can_read_parent && + yama_ptrace_scope <= YAMA_SCOPE_DISABLED;
/* * Removes all effective and permitted capabilities to not interfere @@ -264,16 +332,21 @@ TEST_F(hierarchy, trace) /* Waits for the parent to be in a domain, if any. */ ASSERT_EQ(1, read(pipe_parent[0], &buf_child, 1));
- /* Tests PTRACE_ATTACH and PTRACE_MODE_READ on the parent. */ + /* Tests PTRACE_MODE_READ on the parent. */ err_proc_read = test_ptrace_read(parent); + if (can_read_parent) { + EXPECT_EQ(0, err_proc_read); + } else { + EXPECT_EQ(EACCES, err_proc_read); + } + + /* Tests PTRACE_ATTACH on the parent. */ ret = ptrace(PTRACE_ATTACH, parent, NULL, 0); - if (variant->domain_child) { + if (can_trace_parent) { + EXPECT_EQ(0, ret); + } else { EXPECT_EQ(-1, ret); EXPECT_EQ(EPERM, errno); - EXPECT_EQ(EACCES, err_proc_read); - } else { - EXPECT_EQ(0, ret); - EXPECT_EQ(0, err_proc_read); } if (ret == 0) { ASSERT_EQ(parent, waitpid(parent, &status, 0)); @@ -283,11 +356,11 @@ TEST_F(hierarchy, trace)
/* Tests child PTRACE_TRACEME. */ ret = ptrace(PTRACE_TRACEME); - if (variant->domain_parent) { + if (can_trace_child) { + EXPECT_EQ(0, ret); + } else { EXPECT_EQ(-1, ret); EXPECT_EQ(EPERM, errno); - } else { - EXPECT_EQ(0, ret); }
/* @@ -296,7 +369,7 @@ TEST_F(hierarchy, trace) */ ASSERT_EQ(1, write(pipe_child[1], ".", 1));
- if (!variant->domain_parent) { + if (can_trace_child) { ASSERT_EQ(0, raise(SIGSTOP)); }
@@ -321,7 +394,7 @@ TEST_F(hierarchy, trace) ASSERT_EQ(1, read(pipe_child[0], &buf_parent, 1));
/* Tests child PTRACE_TRACEME. */ - if (!variant->domain_parent) { + if (can_trace_child) { ASSERT_EQ(child, waitpid(child, &status, 0)); ASSERT_EQ(1, WIFSTOPPED(status)); ASSERT_EQ(0, ptrace(PTRACE_DETACH, child, NULL, 0)); @@ -331,17 +404,23 @@ TEST_F(hierarchy, trace) EXPECT_EQ(ESRCH, errno); }
- /* Tests PTRACE_ATTACH and PTRACE_MODE_READ on the child. */ + /* Tests PTRACE_MODE_READ on the child. */ err_proc_read = test_ptrace_read(child); + if (can_read_child) { + EXPECT_EQ(0, err_proc_read); + } else { + EXPECT_EQ(EACCES, err_proc_read); + } + + /* Tests PTRACE_ATTACH on the child. */ ret = ptrace(PTRACE_ATTACH, child, NULL, 0); - if (variant->domain_parent) { + if (can_trace_child) { + EXPECT_EQ(0, ret); + } else { EXPECT_EQ(-1, ret); EXPECT_EQ(EPERM, errno); - EXPECT_EQ(EACCES, err_proc_read); - } else { - EXPECT_EQ(0, ret); - EXPECT_EQ(0, err_proc_read); } + if (ret == 0) { ASSERT_EQ(child, waitpid(child, &status, 0)); ASSERT_EQ(1, WIFSTOPPED(status));
From: Jan Kara jack@suse.cz
commit 70bfb3a8d661d4fdc742afc061b88a7f3fc9f500 upstream.
When a file expansion failed because we didn't have enough space for indirect extents make sure we truncate extents created so far so that we don't leave extents beyond EOF.
CC: stable@vger.kernel.org Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/udf/inode.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
--- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -521,8 +521,10 @@ static int udf_do_extend_file(struct ino }
if (fake) { - udf_add_aext(inode, last_pos, &last_ext->extLocation, - last_ext->extLength, 1); + err = udf_add_aext(inode, last_pos, &last_ext->extLocation, + last_ext->extLength, 1); + if (err < 0) + goto out_err; count++; } else { struct kernel_lb_addr tmploc; @@ -556,7 +558,7 @@ static int udf_do_extend_file(struct ino err = udf_add_aext(inode, last_pos, &last_ext->extLocation, last_ext->extLength, 1); if (err) - return err; + goto out_err; count++; } if (new_block_bytes) { @@ -565,7 +567,7 @@ static int udf_do_extend_file(struct ino err = udf_add_aext(inode, last_pos, &last_ext->extLocation, last_ext->extLength, 1); if (err) - return err; + goto out_err; count++; }
@@ -579,6 +581,11 @@ out: return -EIO;
return count; +out_err: + /* Remove extents we've created so far */ + udf_clear_extent_cache(inode); + udf_truncate_extents(inode); + return err; }
/* Extend the final block of the file to final_block_len bytes */
From: Jan Kara jack@suse.cz
commit 53cafe1d6d8ef9f93318e5bfccc0d24f27d41ced upstream.
When merging very long extents we try to push as much length as possible to the first extent. However this is unnecessarily complicated and not really worth the trouble. Furthermore there was a bug in the logic resulting in corrupting extents in the file as syzbot reproducer shows. So just don't bother with the merging of extents that are too long together.
CC: stable@vger.kernel.org Reported-by: syzbot+60f291a24acecb3c2bd5@syzkaller.appspotmail.com Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/udf/inode.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)
--- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1087,23 +1087,8 @@ static void udf_merge_extents(struct ino blocksize - 1) >> blocksize_bits)))) {
if (((li->extLength & UDF_EXTENT_LENGTH_MASK) + - (lip1->extLength & UDF_EXTENT_LENGTH_MASK) + - blocksize - 1) & ~UDF_EXTENT_LENGTH_MASK) { - lip1->extLength = (lip1->extLength - - (li->extLength & - UDF_EXTENT_LENGTH_MASK) + - UDF_EXTENT_LENGTH_MASK) & - ~(blocksize - 1); - li->extLength = (li->extLength & - UDF_EXTENT_FLAG_MASK) + - (UDF_EXTENT_LENGTH_MASK + 1) - - blocksize; - lip1->extLocation.logicalBlockNum = - li->extLocation.logicalBlockNum + - ((li->extLength & - UDF_EXTENT_LENGTH_MASK) >> - blocksize_bits); - } else { + (lip1->extLength & UDF_EXTENT_LENGTH_MASK) + + blocksize - 1) <= UDF_EXTENT_LENGTH_MASK) { li->extLength = lip1->extLength + (((li->extLength & UDF_EXTENT_LENGTH_MASK) +
From: Jan Kara jack@suse.cz
commit 256fe4162f8b5a1625b8603ca5f7ff79725bfb47 upstream.
When write to inline file fails (or happens only partly), we still updated length of inline data as if the whole write succeeded. Fix the update of length of inline data to happen only if the write succeeds.
Reported-by: syzbot+0937935b993956ba28ab@syzkaller.appspotmail.com CC: stable@vger.kernel.org Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/udf/file.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-)
--- a/fs/udf/file.c +++ b/fs/udf/file.c @@ -149,26 +149,24 @@ static ssize_t udf_file_write_iter(struc goto out;
down_write(&iinfo->i_data_sem); - if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { - loff_t end = iocb->ki_pos + iov_iter_count(from); - - if (inode->i_sb->s_blocksize < - (udf_file_entry_alloc_offset(inode) + end)) { - err = udf_expand_file_adinicb(inode); - if (err) { - inode_unlock(inode); - udf_debug("udf_expand_adinicb: err=%d\n", err); - return err; - } - } else { - iinfo->i_lenAlloc = max(end, inode->i_size); - up_write(&iinfo->i_data_sem); + if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB && + inode->i_sb->s_blocksize < (udf_file_entry_alloc_offset(inode) + + iocb->ki_pos + iov_iter_count(from))) { + err = udf_expand_file_adinicb(inode); + if (err) { + inode_unlock(inode); + udf_debug("udf_expand_adinicb: err=%d\n", err); + return err; } } else up_write(&iinfo->i_data_sem);
retval = __generic_file_write_iter(iocb, from); out: + down_write(&iinfo->i_data_sem); + if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB && retval > 0) + iinfo->i_lenAlloc = inode->i_size; + up_write(&iinfo->i_data_sem); inode_unlock(inode);
if (retval > 0) {
From: Jan Kara jack@suse.cz
commit fc8033a34a3ca7d23353e645e6dde5d364ac5f12 upstream.
System files in UDF filesystem have link count 0. To not confuse VFS we fudge the link count to be 1 when reading such inodes however we forget to restore the link count of 0 when writing such inodes. Fix that.
CC: stable@vger.kernel.org Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/udf/inode.c | 9 +++++++-- fs/udf/super.c | 1 + fs/udf/udf_i.h | 3 ++- 3 files changed, 10 insertions(+), 3 deletions(-)
--- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1373,6 +1373,7 @@ reread: ret = -EIO; goto out; } + iinfo->i_hidden = hidden_inode; iinfo->i_unique = 0; iinfo->i_lenEAttr = 0; iinfo->i_lenExtents = 0; @@ -1708,8 +1709,12 @@ static int udf_update_inode(struct inode
if (S_ISDIR(inode->i_mode) && inode->i_nlink > 0) fe->fileLinkCount = cpu_to_le16(inode->i_nlink - 1); - else - fe->fileLinkCount = cpu_to_le16(inode->i_nlink); + else { + if (iinfo->i_hidden) + fe->fileLinkCount = cpu_to_le16(0); + else + fe->fileLinkCount = cpu_to_le16(inode->i_nlink); + }
fe->informationLength = cpu_to_le64(inode->i_size);
--- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -147,6 +147,7 @@ static struct inode *udf_alloc_inode(str ei->i_next_alloc_goal = 0; ei->i_strat4096 = 0; ei->i_streamdir = 0; + ei->i_hidden = 0; init_rwsem(&ei->i_data_sem); ei->cached_extent.lstart = -1; spin_lock_init(&ei->i_extent_cache_lock); --- a/fs/udf/udf_i.h +++ b/fs/udf/udf_i.h @@ -44,7 +44,8 @@ struct udf_inode_info { unsigned i_use : 1; /* unallocSpaceEntry */ unsigned i_strat4096 : 1; unsigned i_streamdir : 1; - unsigned reserved : 25; + unsigned i_hidden : 1; /* hidden system inode */ + unsigned reserved : 24; __u8 *i_data; struct kernel_lb_addr i_locStreamdir; __u64 i_lenStreams;
From: Jan Kara jack@suse.cz
commit 85a37983ec69cc9fcd188bc37c4de15ee326355a upstream.
When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious corruption of the filesystem and kernel confusion as noticed by syzbot fuzzed images. Refuse to access system inodes linked into directory hierarchy and vice versa.
CC: stable@vger.kernel.org Reported-by: syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/udf/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1885,8 +1885,13 @@ struct inode *__udf_iget(struct super_bl if (!inode) return ERR_PTR(-ENOMEM);
- if (!(inode->i_state & I_NEW)) + if (!(inode->i_state & I_NEW)) { + if (UDF_I(inode)->i_hidden != hidden_inode) { + iput(inode); + return ERR_PTR(-EFSCORRUPTED); + } return inode; + }
memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr)); err = udf_read_inode(inode, hidden_inode);
From: Jan Kara jack@suse.cz
commit 36ec52ea038b18a53e198116ef7d7e70c87db046 upstream.
When we append new block just after the end of preallocated extent, the code in inode_getblk() wrongly determined we're going to use the preallocated extent which resulted in adding block into a wrong logical offset in the file. Sequence like this manifests it:
xfs_io -f -c "pwrite 0x2cacf 0xd122" -c "truncate 0x2dd6f" \ -c "pwrite 0x27fd9 0x69a9" -c "pwrite 0x32981 0x7244" <file>
The code that determined the use of preallocated extent is actually stale because udf_do_extend_file() does not create preallocation anymore so after calling that function we are sure there's no usable preallocation. Just remove the faulty condition.
CC: stable@vger.kernel.org Fixes: 16d055656814 ("udf: Discard preallocation before extending file with a hole") Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/udf/inode.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-)
--- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -799,19 +799,17 @@ static sector_t inode_getblk(struct inod c = 0; offset = 0; count += ret; - /* We are not covered by a preallocated extent? */ - if ((laarr[0].extLength & UDF_EXTENT_FLAG_MASK) != - EXT_NOT_RECORDED_ALLOCATED) { - /* Is there any real extent? - otherwise we overwrite - * the fake one... */ - if (count) - c = !c; - laarr[c].extLength = EXT_NOT_RECORDED_NOT_ALLOCATED | - inode->i_sb->s_blocksize; - memset(&laarr[c].extLocation, 0x00, - sizeof(struct kernel_lb_addr)); - count++; - } + /* + * Is there any real extent? - otherwise we overwrite the fake + * one... + */ + if (count) + c = !c; + laarr[c].extLength = EXT_NOT_RECORDED_NOT_ALLOCATED | + inode->i_sb->s_blocksize; + memset(&laarr[c].extLocation, 0x00, + sizeof(struct kernel_lb_addr)); + count++; endnum = c + 1; lastblock = 1; } else {
From: Hou Tao houtao1@huawei.com
commit 1d1f25bfda432a6b61bd0205d426226bbbd73504 upstream.
Don't update recovery_cp when curr_resync is MD_RESYNC_ACTIVE, otherwise md may skip the resync of the first 3 sectors if the resync procedure is interrupted before the first calling of ->sync_request() as shown below:
md_do_sync thread control thread // setup resync mddev->recovery_cp = 0 j = 0 mddev->curr_resync = MD_RESYNC_ACTIVE
// e.g., set array as idle set_bit(MD_RECOVERY_INTR, &&mddev_recovery) // resync loop // check INTR before calling sync_request !test_bit(MD_RECOVERY_INTR, &mddev->recovery
// resync interrupted // update recovery_cp from 0 to 3 // the resync of three 3 sectors will be skipped mddev->recovery_cp = 3
Fixes: eac58d08d493 ("md: Use enum for overloaded magic numbers used by mddev->curr_resync") Cc: stable@vger.kernel.org # 6.0+ Signed-off-by: Hou Tao houtao1@huawei.com Reviewed-by: Logan Gunthorpe logang@deltatee.com Signed-off-by: Song Liu song@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -9030,7 +9030,7 @@ void md_do_sync(struct md_thread *thread mddev->pers->sync_request(mddev, max_sectors, &skipped);
if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) && - mddev->curr_resync >= MD_RESYNC_ACTIVE) { + mddev->curr_resync > MD_RESYNC_ACTIVE) { if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) { if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) { if (mddev->curr_resync >= mddev->recovery_cp) {
From: Sean Christopherson seanjc@google.com
commit b1cb1fac22abf102ffeb29dd3eeca208a3869d54 upstream.
Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() does not destroy the target device.
BUG: memory leak unreferenced object 0xffff888112a54880 (size 64): comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) hex dump (first 32 bytes): 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... backtrace: [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
BUG: leak checking failed
Fixes: 5d3c4c79384a ("KVM: Stop looking for coalesced MMIO zones if the bus is destroyed") Cc: stable@vger.kernel.org Reported-by: 柳菁峰 liujingfeng@qianxin.com Reported-by: Michal Luczaj mhal@rbox.co Link: https://lore.kernel.org/r/20221219171924.67989-1-seanjc@google.com Link: https://lore.kernel.org/all/20230118220003.1239032-1-mhal@rbox.co Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- virt/kvm/coalesced_mmio.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
--- a/virt/kvm/coalesced_mmio.c +++ b/virt/kvm/coalesced_mmio.c @@ -187,15 +187,17 @@ int kvm_vm_ioctl_unregister_coalesced_mm r = kvm_io_bus_unregister_dev(kvm, zone->pio ? KVM_PIO_BUS : KVM_MMIO_BUS, &dev->dev);
+ kvm_iodevice_destructor(&dev->dev); + /* * On failure, unregister destroys all devices on the * bus _except_ the target device, i.e. coalesced_zones - * has been modified. No need to restart the walk as - * there aren't any zones left. + * has been modified. Bail after destroying the target + * device, there's no need to restart the walk as there + * aren't any zones left. */ if (r) break; - kvm_iodevice_destructor(&dev->dev); } }
From: Alexandru Matei alexandru.matei@uipath.com
commit 93827a0a36396f2fd6368a54a020f420c8916e9b upstream.
KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is updated, evmcs_touch_msr_bitmap function uses current_vmcs per-cpu variable to mark that the msr bitmap was changed.
vmx_vcpu_create() modifies the msr bitmap via vmx_disable_intercept_for_msr -> vmx_msr_bitmap_l01_changed which in the end calls this function. The function checks for current_vmcs if it is null but the check is insufficient because current_vmcs is not initialized. Because of this, the code might incorrectly write to the structure pointed by current_vmcs value left by another task. Preemption is not disabled, the current task can be preempted and moved to another CPU while current_vmcs is accessed multiple times from evmcs_touch_msr_bitmap() which leads to crash.
The manipulation of MSR bitmaps by callers happens only for vmcs01 so the solution is to use vmx->vmcs01.vmcs instead of current_vmcs.
BUG: kernel NULL pointer dereference, address: 0000000000000338 PGD 4e1775067 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI ... RIP: 0010:vmx_msr_bitmap_l01_changed+0x39/0x50 [kvm_intel] ... Call Trace: vmx_disable_intercept_for_msr+0x36/0x260 [kvm_intel] vmx_vcpu_create+0xe6/0x540 [kvm_intel] kvm_arch_vcpu_create+0x1d1/0x2e0 [kvm] kvm_vm_ioctl_create_vcpu+0x178/0x430 [kvm] kvm_vm_ioctl+0x53f/0x790 [kvm] __x64_sys_ioctl+0x8a/0xc0 do_syscall_64+0x5c/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: ceef7d10dfb6 ("KVM: x86: VMX: hyper-v: Enlightened MSR-Bitmap support") Cc: stable@vger.kernel.org Suggested-by: Sean Christopherson seanjc@google.com Signed-off-by: Alexandru Matei alexandru.matei@uipath.com Link: https://lore.kernel.org/r/20230123221208.4964-1-alexandru.matei@uipath.com Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/vmx/hyperv.h | 11 ----------- arch/x86/kvm/vmx/vmx.c | 9 +++++++-- 2 files changed, 7 insertions(+), 13 deletions(-)
--- a/arch/x86/kvm/vmx/hyperv.h +++ b/arch/x86/kvm/vmx/hyperv.h @@ -190,16 +190,6 @@ static inline u16 evmcs_read16(unsigned return *(u16 *)((char *)current_evmcs + offset); }
-static inline void evmcs_touch_msr_bitmap(void) -{ - if (unlikely(!current_evmcs)) - return; - - if (current_evmcs->hv_enlightenments_control.msr_bitmap) - current_evmcs->hv_clean_fields &= - ~HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP; -} - static inline void evmcs_load(u64 phys_addr) { struct hv_vp_assist_page *vp_ap = @@ -219,7 +209,6 @@ static inline u64 evmcs_read64(unsigned static inline u32 evmcs_read32(unsigned long field) { return 0; } static inline u16 evmcs_read16(unsigned long field) { return 0; } static inline void evmcs_load(u64 phys_addr) {} -static inline void evmcs_touch_msr_bitmap(void) {} #endif /* IS_ENABLED(CONFIG_HYPERV) */
#define EVMPTR_INVALID (-1ULL) --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -3865,8 +3865,13 @@ static void vmx_msr_bitmap_l01_changed(s * 'Enlightened MSR Bitmap' feature L0 needs to know that MSR * bitmap has changed. */ - if (static_branch_unlikely(&enable_evmcs)) - evmcs_touch_msr_bitmap(); + if (IS_ENABLED(CONFIG_HYPERV) && static_branch_unlikely(&enable_evmcs)) { + struct hv_enlightened_vmcs *evmcs = (void *)vmx->vmcs01.vmcs; + + if (evmcs->hv_enlightenments_control.msr_bitmap) + evmcs->hv_clean_fields &= + ~HV_VMX_ENLIGHTENED_CLEAN_FIELD_MSR_BITMAP; + }
vmx->nested.force_msr_bitmap_recalc = true; }
From: Sean Christopherson seanjc@google.com
commit 2b01281273738bf2d6551da48d65db2df3f28998 upstream.
Register /dev/kvm, i.e. expose KVM to userspace, only after all other setup has completed. Once /dev/kvm is exposed, userspace can start invoking KVM ioctls, creating VMs, etc... If userspace creates a VM before KVM is done with its configuration, bad things may happen, e.g. KVM will fail to properly migrate vCPU state if a VM is created before KVM has registered preemption notifiers.
Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson seanjc@google.com Message-Id: 20221130230934.1014142-2-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- virt/kvm/kvm_main.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-)
--- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -5995,12 +5995,6 @@ int kvm_init(void *opaque, unsigned vcpu
kvm_chardev_ops.owner = module;
- r = misc_register(&kvm_dev); - if (r) { - pr_err("kvm: misc device register failed\n"); - goto out_unreg; - } - register_syscore_ops(&kvm_syscore_ops);
kvm_preempt_ops.sched_in = kvm_sched_in; @@ -6009,11 +6003,24 @@ int kvm_init(void *opaque, unsigned vcpu kvm_init_debug();
r = kvm_vfio_ops_init(); - WARN_ON(r); + if (WARN_ON_ONCE(r)) + goto err_vfio; + + /* + * Registration _must_ be the very last thing done, as this exposes + * /dev/kvm to userspace, i.e. all infrastructure must be setup! + */ + r = misc_register(&kvm_dev); + if (r) { + pr_err("kvm: misc device register failed\n"); + goto err_register; + }
return 0;
-out_unreg: +err_register: + kvm_vfio_ops_exit(); +err_vfio: kvm_async_pf_deinit(); out_free_4: for_each_possible_cpu(cpu) @@ -6039,8 +6046,14 @@ void kvm_exit(void) { int cpu;
- debugfs_remove_recursive(kvm_debugfs_dir); + /* + * Note, unregistering /dev/kvm doesn't strictly need to come first, + * fops_get(), a.k.a. try_module_get(), prevents acquiring references + * to KVM while the module is being stopped. + */ misc_deregister(&kvm_dev); + + debugfs_remove_recursive(kvm_debugfs_dir); for_each_possible_cpu(cpu) free_cpumask_var(per_cpu(cpu_kick_mask, cpu)); kmem_cache_destroy(kvm_vcpu_cache);
From: Sean Christopherson seanjc@google.com
commit 97a71c444a147ae41c7d0ab5b3d855d7f762f3ed upstream.
Purge the "highest ISR" cache when updating APICv state on a vCPU. The cache must not be used when APICv is active as hardware may emulate EOIs (and other operations) without exiting to KVM.
This fixes a bug where KVM will effectively block IRQs in perpetuity due to the "highest ISR" never getting reset if APICv is activated on a vCPU while an IRQ is in-service. Hardware emulates the EOI and KVM never gets a chance to update its cache.
Fixes: b26a695a1d78 ("kvm: lapic: Introduce APICv update helper function") Cc: stable@vger.kernel.org Cc: Suravee Suthikulpanit suravee.suthikulpanit@amd.com Cc: Maxim Levitsky mlevitsk@redhat.com Reviewed-by: Paolo Bonzini pbonzini@redhat.com Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Signed-off-by: Sean Christopherson seanjc@google.com Message-Id: 20230106011306.85230-3-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/lapic.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2429,6 +2429,7 @@ void kvm_apic_update_apicv(struct kvm_vc */ apic->isr_count = count_vectors(apic->regs + APIC_ISR); } + apic->highest_isr_cache = -1; }
void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event) @@ -2484,7 +2485,6 @@ void kvm_lapic_reset(struct kvm_vcpu *vc kvm_lapic_set_reg(apic, APIC_TMR + 0x10 * i, 0); } kvm_apic_update_apicv(vcpu); - apic->highest_isr_cache = -1; update_divide_count(apic); atomic_set(&apic->lapic_timer.pending, 0);
@@ -2772,7 +2772,6 @@ int kvm_apic_set_state(struct kvm_vcpu * __start_apic_timer(apic, APIC_TMCCT); kvm_lapic_set_reg(apic, APIC_TMCCT, 0); kvm_apic_update_apicv(vcpu); - apic->highest_isr_cache = -1; if (apic->apicv_active) { static_call_cond(kvm_x86_apicv_post_state_restore)(vcpu); static_call_cond(kvm_x86_hwapic_irr_update)(vcpu, apic_find_highest_irr(apic));
From: Sean Christopherson seanjc@google.com
commit 0a19807b464fb10aa79b9dd7f494bc317438fada upstream.
When emulating a x2APIC write in response to an APICv/AVIC trap, get the the written value from the vAPIC page without checking that reads are allowed for the target register. AVIC can generate trap-like VM-Exits on writes to EOI, and so KVM needs to get the written value from the backing page without running afoul of EOI's write-only behavior.
Alternatively, EOI could be special cased to always write '0', e.g. so that the sanity check could be preserved, but x2APIC on AMD is actually supposed to disallow non-zero writes (not emulated by KVM), and the sanity check was a byproduct of how the KVM code was written, i.e. wasn't added to guard against anything in particular.
Fixes: 70c8327c11c6 ("KVM: x86: Bug the VM if an accelerated x2APIC trap occurs on a "bad" reg") Fixes: 1bd9dfec9fd4 ("KVM: x86: Do not block APIC write for non ICR registers") Reported-by: Alejandro Jimenez alejandro.j.jimenez@oracle.com Cc: stable@vger.kernel.org Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Signed-off-by: Sean Christopherson seanjc@google.com Message-Id: 20230106011306.85230-2-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/lapic.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
--- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2284,23 +2284,18 @@ void kvm_apic_write_nodecode(struct kvm_ struct kvm_lapic *apic = vcpu->arch.apic; u64 val;
- if (apic_x2apic_mode(apic)) { - if (KVM_BUG_ON(kvm_lapic_msr_read(apic, offset, &val), vcpu->kvm)) - return; - } else { - val = kvm_lapic_get_reg(apic, offset); - } - /* * ICR is a single 64-bit register when x2APIC is enabled. For legacy * xAPIC, ICR writes need to go down the common (slightly slower) path * to get the upper half from ICR2. */ if (apic_x2apic_mode(apic) && offset == APIC_ICR) { + val = kvm_lapic_get_reg64(apic, APIC_ICR); kvm_apic_send_ipi(apic, (u32)val, (u32)(val >> 32)); trace_kvm_apic_write(APIC_ICR, val); } else { /* TODO: optimize to just emulate side effect w/o one more write */ + val = kvm_lapic_get_reg(apic, offset); kvm_lapic_reg_write(apic, offset, (u32)val); } }
From: Sean Christopherson seanjc@google.com
commit a58a66afc464d6d2ec294cd3102f36f3652e7ce4 upstream.
Don't inhibit APICv/AVIC due to an xAPIC ID mismatch if the APIC is hardware disabled. The ID cannot be consumed while the APIC is disabled, and the ID is guaranteed to be set back to the vcpu_id when the APIC is hardware enabled (architectural behavior correctly emulated by KVM).
Fixes: 3743c2f02517 ("KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base") Cc: stable@vger.kernel.org Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Signed-off-by: Sean Christopherson seanjc@google.com Message-Id: 20230106011306.85230-6-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/lapic.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2072,6 +2072,9 @@ static void kvm_lapic_xapic_id_updated(s { struct kvm *kvm = apic->vcpu->kvm;
+ if (!kvm_apic_hw_enabled(apic)) + return; + if (KVM_BUG_ON(apic_x2apic_mode(apic), kvm)) return;
From: Sean Christopherson seanjc@google.com
commit f651a008954803d7bb2d85b7042d0fd46133d782 upstream.
Truncate the vcpu_id, a.k.a. x2APIC ID, to an 8-bit value when comparing it against the xAPIC ID to avoid false positives (sort of) on systems with >255 CPUs, i.e. with IDs that don't fit into a u8. The intent of APIC_ID_MODIFIED is to inhibit APICv/AVIC when the xAPIC is changed from it's original value,
The mismatch isn't technically a false positive, as architecturally the xAPIC IDs do end up being aliased in this scenario, and neither APICv nor AVIC correctly handles IPI virtualization when there is aliasing. However, KVM already deliberately does not honor the aliasing behavior that results when an x2APIC ID gets truncated to an xAPIC ID. I.e. the resulting APICv/AVIC behavior is aligned with KVM's existing behavior when KVM's x2APIC hotplug hack is effectively enabled.
If/when KVM provides a way to disable the hotplug hack, APICv/AVIC can piggyback whatever logic disables the optimized APIC map (which is what provides the hotplug hack), i.e. so that KVM's optimized map and APIC virtualization yield the same behavior.
For now, fix the immediate problem of APIC virtualization being disabled for large VMs, which is a much more pressing issue than ensuring KVM honors architectural behavior for APIC ID aliasing.
Fixes: 3743c2f02517 ("KVM: x86: inhibit APICv/AVIC on changes to APIC ID or APIC base") Reported-by: Suravee Suthikulpanit suravee.suthikulpanit@amd.com Cc: stable@vger.kernel.org Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Signed-off-by: Sean Christopherson seanjc@google.com Message-Id: 20230106011306.85230-7-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/lapic.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2078,7 +2078,12 @@ static void kvm_lapic_xapic_id_updated(s if (KVM_BUG_ON(apic_x2apic_mode(apic), kvm)) return;
- if (kvm_xapic_id(apic) == apic->vcpu->vcpu_id) + /* + * Deliberately truncate the vCPU ID when detecting a modified APIC ID + * to avoid false positives if the vCPU ID, i.e. x2APIC ID, is a 32-bit + * value. + */ + if (kvm_xapic_id(apic) == (u8)apic->vcpu->vcpu_id) return;
kvm_set_apicv_inhibit(apic->vcpu->kvm, APICV_INHIBIT_REASON_APIC_ID_MODIFIED);
From: Sean Christopherson seanjc@google.com
commit 0ccf3e7cb95a2db8ddb2a44812037ffba8166dc9 upstream.
Flush the TLB when activating AVIC as the CPU can insert into the TLB while AVIC is "locally" disabled. KVM doesn't treat "APIC hardware disabled" as VM-wide AVIC inhibition, and so when a vCPU has its APIC hardware disabled, AVIC is not guaranteed to be inhibited. As a result, KVM may create a valid NPT mapping for the APIC base, which the CPU can cache as a non-AVIC translation.
Note, Intel handles this in vmx_set_virtual_apic_mode().
Reviewed-by: Paolo Bonzini pbonzini@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson seanjc@google.com Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Message-Id: 20230106011306.85230-4-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/svm/avic.c | 6 ++++++ 1 file changed, 6 insertions(+)
--- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -86,6 +86,12 @@ static void avic_activate_vmcb(struct vc /* Disabling MSR intercept for x2APIC registers */ svm_set_x2apic_msr_interception(svm, false); } else { + /* + * Flush the TLB, the guest may have inserted a non-APIC + * mapping into the TLB while AVIC was disabled. + */ + kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, &svm->vcpu); + /* For xAVIC and hybrid-xAVIC modes */ vmcb->control.avic_physical_id |= AVIC_MAX_PHYSICAL_ID; /* Enabling MSR intercept for x2APIC registers */
From: Sean Christopherson seanjc@google.com
commit 5aede752a839904059c2b5d68be0dc4501c6c15f upstream.
Emulate ICR writes on AVIC IPI failures due to invalid targets using the same logic as failures due to invalid types. AVIC acceleration fails if _any_ of the targets are invalid, and crucially VM-Exits before sending IPIs to targets that _are_ valid. In logical mode, the destination is a bitmap, i.e. a single IPI can target multiple logical IDs. Doing nothing causes KVM to drop IPIs if at least one target is valid and at least one target is invalid.
Fixes: 18f40c53e10f ("svm: Add VMEXIT handlers for AVIC") Cc: stable@vger.kernel.org Reviewed-by: Paolo Bonzini pbonzini@redhat.com Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Signed-off-by: Sean Christopherson seanjc@google.com Message-Id: 20230106011306.85230-5-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/svm/avic.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
--- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -502,14 +502,18 @@ int avic_incomplete_ipi_interception(str trace_kvm_avic_incomplete_ipi(vcpu->vcpu_id, icrh, icrl, id, index);
switch (id) { + case AVIC_IPI_FAILURE_INVALID_TARGET: case AVIC_IPI_FAILURE_INVALID_INT_TYPE: /* * Emulate IPIs that are not handled by AVIC hardware, which - * only virtualizes Fixed, Edge-Triggered INTRs. The exit is - * a trap, e.g. ICR holds the correct value and RIP has been - * advanced, KVM is responsible only for emulating the IPI. - * Sadly, hardware may sometimes leave the BUSY flag set, in - * which case KVM needs to emulate the ICR write as well in + * only virtualizes Fixed, Edge-Triggered INTRs, and falls over + * if _any_ targets are invalid, e.g. if the logical mode mask + * is a superset of running vCPUs. + * + * The exit is a trap, e.g. ICR holds the correct value and RIP + * has been advanced, KVM is responsible only for emulating the + * IPI. Sadly, hardware may sometimes leave the BUSY flag set, + * in which case KVM needs to emulate the ICR write as well in * order to clear the BUSY flag. */ if (icrl & APIC_ICR_BUSY) @@ -525,8 +529,6 @@ int avic_incomplete_ipi_interception(str */ avic_kick_target_vcpus(vcpu->kvm, apic, icrl, icrh, index); break; - case AVIC_IPI_FAILURE_INVALID_TARGET: - break; case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE: WARN_ONCE(1, "Invalid backing page\n"); break;
From: Sean Christopherson seanjc@google.com
commit e0bead97e7590da888148feb9e9133bc278c534b upstream.
Move the VMCB updates from avic_refresh_apicv_exec_ctrl() into avic_set_virtual_apic_mode() and invert the dependency being said functions to avoid calling avic_vcpu_{load,put}() and avic_set_pi_irte_mode() when "only" setting the virtual APIC mode.
avic_set_virtual_apic_mode() is invoked from common x86 with preemption enabled, which makes avic_vcpu_{load,put}() unhappy. Luckily, calling those and updating IRTE stuff is unnecessary as the only reason avic_set_virtual_apic_mode() is called is to handle transitions between xAPIC and x2APIC that don't also toggle APICv activation. And if activation doesn't change, there's no need to fiddle with the physical APIC ID table or update IRTE.
The "full" refresh is guaranteed to be called if activation changes in this case as the only call to the "set" path is:
kvm_vcpu_update_apicv(vcpu); static_call_cond(kvm_x86_set_virtual_apic_mode)(vcpu);
and kvm_vcpu_update_apicv() invokes the refresh if activation changes:
if (apic->apicv_active == activate) goto out;
apic->apicv_active = activate; kvm_apic_update_apicv(vcpu); static_call(kvm_x86_refresh_apicv_exec_ctrl)(vcpu);
Rename the helper to reflect that it is also called during "refresh".
WARNING: CPU: 183 PID: 49186 at arch/x86/kvm/svm/avic.c:1081 avic_vcpu_put+0xde/0xf0 [kvm_amd] CPU: 183 PID: 49186 Comm: stable Tainted: G O 6.0.0-smp--fcddbca45f0a-sink #34 Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 RIP: 0010:avic_vcpu_put+0xde/0xf0 [kvm_amd] avic_refresh_apicv_exec_ctrl+0x142/0x1c0 [kvm_amd] avic_set_virtual_apic_mode+0x5a/0x70 [kvm_amd] kvm_lapic_set_base+0x149/0x1a0 [kvm] kvm_set_apic_base+0x8f/0xd0 [kvm] kvm_set_msr_common+0xa3a/0xdc0 [kvm] svm_set_msr+0x364/0x6b0 [kvm_amd] __kvm_set_msr+0xb8/0x1c0 [kvm] kvm_emulate_wrmsr+0x58/0x1d0 [kvm] msr_interception+0x1c/0x30 [kvm_amd] svm_invoke_exit_handler+0x31/0x100 [kvm_amd] svm_handle_exit+0xfc/0x160 [kvm_amd] vcpu_enter_guest+0x21bb/0x23e0 [kvm] vcpu_run+0x92/0x450 [kvm] kvm_arch_vcpu_ioctl_run+0x43e/0x6e0 [kvm] kvm_vcpu_ioctl+0x559/0x620 [kvm]
Fixes: 05c4fe8c1bd9 ("KVM: SVM: Refresh AVIC configuration when changing APIC mode") Cc: stable@vger.kernel.org Cc: Suravee Suthikulpanit suravee.suthikulpanit@amd.com Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Signed-off-by: Sean Christopherson seanjc@google.com Message-Id: 20230106011306.85230-8-seanjc@google.com Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/svm/avic.c | 31 +++++++++++++++---------------- arch/x86/kvm/svm/svm.c | 2 +- arch/x86/kvm/svm/svm.h | 2 +- 3 files changed, 17 insertions(+), 18 deletions(-)
--- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -747,18 +747,6 @@ void avic_apicv_post_state_restore(struc avic_handle_ldr_update(vcpu); }
-void avic_set_virtual_apic_mode(struct kvm_vcpu *vcpu) -{ - if (!lapic_in_kernel(vcpu) || avic_mode == AVIC_MODE_NONE) - return; - - if (kvm_get_apic_mode(vcpu) == LAPIC_MODE_INVALID) { - WARN_ONCE(true, "Invalid local APIC state (vcpu_id=%d)", vcpu->vcpu_id); - return; - } - avic_refresh_apicv_exec_ctrl(vcpu); -} - static int avic_set_pi_irte_mode(struct kvm_vcpu *vcpu, bool activate) { int ret = 0; @@ -1100,17 +1088,18 @@ void avic_vcpu_put(struct kvm_vcpu *vcpu WRITE_ONCE(*(svm->avic_physical_id_cache), entry); }
- -void avic_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu) +void avic_refresh_virtual_apic_mode(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); struct vmcb *vmcb = svm->vmcb01.ptr; - bool activated = kvm_vcpu_apicv_active(vcpu); + + if (!lapic_in_kernel(vcpu) || avic_mode == AVIC_MODE_NONE) + return;
if (!enable_apicv) return;
- if (activated) { + if (kvm_vcpu_apicv_active(vcpu)) { /** * During AVIC temporary deactivation, guest could update * APIC ID, DFR and LDR registers, which would not be trapped @@ -1124,6 +1113,16 @@ void avic_refresh_apicv_exec_ctrl(struct avic_deactivate_vmcb(svm); } vmcb_mark_dirty(vmcb, VMCB_AVIC); +} + +void avic_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu) +{ + bool activated = kvm_vcpu_apicv_active(vcpu); + + if (!enable_apicv) + return; + + avic_refresh_virtual_apic_mode(vcpu);
if (activated) avic_vcpu_load(vcpu, vcpu->cpu); --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -4771,7 +4771,7 @@ static struct kvm_x86_ops svm_x86_ops __ .enable_nmi_window = svm_enable_nmi_window, .enable_irq_window = svm_enable_irq_window, .update_cr8_intercept = svm_update_cr8_intercept, - .set_virtual_apic_mode = avic_set_virtual_apic_mode, + .set_virtual_apic_mode = avic_refresh_virtual_apic_mode, .refresh_apicv_exec_ctrl = avic_refresh_apicv_exec_ctrl, .check_apicv_inhibit_reasons = avic_check_apicv_inhibit_reasons, .apicv_post_state_restore = avic_apicv_post_state_restore, --- a/arch/x86/kvm/svm/svm.h +++ b/arch/x86/kvm/svm/svm.h @@ -648,7 +648,7 @@ void avic_vcpu_blocking(struct kvm_vcpu void avic_vcpu_unblocking(struct kvm_vcpu *vcpu); void avic_ring_doorbell(struct kvm_vcpu *vcpu); unsigned long avic_vcpu_get_apicv_inhibit_reasons(struct kvm_vcpu *vcpu); -void avic_set_virtual_apic_mode(struct kvm_vcpu *vcpu); +void avic_refresh_virtual_apic_mode(struct kvm_vcpu *vcpu);
/* sev.c */
From: Sean Christopherson seanjc@google.com
commit ba5838abb05334e4abfdff1490585c7f365e0424 upstream.
Inject a #GP if the guest attempts to set reserved bits in the x2APIC-only Self-IPI register. Bits 7:0 hold the vector, all other bits are reserved.
Reported-by: Marc Orr marcorr@google.com Cc: Ben Gardon bgardon@google.com Cc: Venkatesh Srinivas venkateshs@chromium.org Cc: stable@vger.kernel.org Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Link: https://lore.kernel.org/r/20230107011025.565472-2-seanjc@google.com Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/lapic.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2227,10 +2227,14 @@ static int kvm_lapic_reg_write(struct kv break;
case APIC_SELF_IPI: - if (apic_x2apic_mode(apic)) - kvm_apic_send_ipi(apic, APIC_DEST_SELF | (val & APIC_VECTOR_MASK), 0); - else + /* + * Self-IPI exists only when x2APIC is enabled. Bits 7:0 hold + * the vector, everything else is reserved. + */ + if (!apic_x2apic_mode(apic) || (val & ~APIC_VECTOR_MASK)) ret = 1; + else + kvm_apic_send_ipi(apic, APIC_DEST_SELF | val, 0); break; default: ret = 1;
From: Sean Christopherson seanjc@google.com
commit ab52be1b310bcb39e6745d34a8f0e8475d67381a upstream.
Reject attempts to set bits 63:32 for 32-bit x2APIC registers, i.e. all x2APIC registers except ICR. Per Intel's SDM:
Non-zero writes (by WRMSR instruction) to reserved bits to these registers will raise a general protection fault exception
Opportunistically fix a typo in a nearby comment.
Reported-by: Marc Orr marcorr@google.com Cc: stable@vger.kernel.org Reviewed-by: Maxim Levitsky mlevitsk@redhat.com Link: https://lore.kernel.org/r/20230107011025.565472-3-seanjc@google.com Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/lapic.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -2949,13 +2949,17 @@ static int kvm_lapic_msr_read(struct kvm static int kvm_lapic_msr_write(struct kvm_lapic *apic, u32 reg, u64 data) { /* - * ICR is a 64-bit register in x2APIC mode (and Hyper'v PV vAPIC) and + * ICR is a 64-bit register in x2APIC mode (and Hyper-V PV vAPIC) and * can be written as such, all other registers remain accessible only * through 32-bit reads/writes. */ if (reg == APIC_ICR) return kvm_x2apic_icr_write(apic, data);
+ /* Bits 63:32 are reserved in all other registers. */ + if (data >> 32) + return 1; + return kvm_lapic_reg_write(apic, reg, (u32)data); }
From: Peter Gonda pgonda@google.com
commit f94f053aa3a5d6ff17951870483d9eb9e13de2e2 upstream.
KVM_SEV_SEND_UPDATE_DATA and KVM_SEV_RECEIVE_UPDATE_DATA have an integer overflow issue. Params.guest_len and offset are both 32 bits wide, with a large params.guest_len the check to confirm a page boundary is not crossed can falsely pass:
/* Check if we are crossing the page boundary * offset = params.guest_uaddr & (PAGE_SIZE - 1); if ((params.guest_len + offset > PAGE_SIZE))
Add an additional check to confirm that params.guest_len itself is not greater than PAGE_SIZE.
Note, this isn't a security concern as overflow can happen if and only if params.guest_len is greater than 0xfffff000, and the FW spec says these commands fail with lengths greater than 16KB, i.e. the PSP will detect KVM's goof.
Fixes: 15fb7de1a7f5 ("KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command") Fixes: d3d1af85e2c7 ("KVM: SVM: Add KVM_SEND_UPDATE_DATA command") Reported-by: Andy Nguyen theflow@google.com Suggested-by: Thomas Lendacky thomas.lendacky@amd.com Signed-off-by: Peter Gonda pgonda@google.com Cc: David Rientjes rientjes@google.com Cc: Paolo Bonzini pbonzini@redhat.com Cc: Sean Christopherson seanjc@google.com Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Tom Lendacky thomas.lendacky@amd.com Link: https://lore.kernel.org/r/20230207171354.4012821-1-pgonda@google.com Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/svm/sev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -1293,7 +1293,7 @@ static int sev_send_update_data(struct k
/* Check if we are crossing the page boundary */ offset = params.guest_uaddr & (PAGE_SIZE - 1); - if ((params.guest_len + offset > PAGE_SIZE)) + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE) return -EINVAL;
/* Pin guest memory */ @@ -1473,7 +1473,7 @@ static int sev_receive_update_data(struc
/* Check if we are crossing the page boundary */ offset = params.guest_uaddr & (PAGE_SIZE - 1); - if ((params.guest_len + offset > PAGE_SIZE)) + if (params.guest_len > PAGE_SIZE || (params.guest_len + offset) > PAGE_SIZE) return -EINVAL;
hdr = psp_copy_user_blob(params.hdr_uaddr, params.hdr_len);
From: Randy Dunlap rdunlap@infradead.org
commit 45dd9bc75d9adc9483f0c7d662ba6e73ed698a0b upstream.
modpost reports section mismatch errors/warnings: WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data) WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data) WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data)
This "(unknown) (section: .init.data)" all refer to svm_x86_ops.
Tag svm_hv_hardware_setup() with __init to fix a modpost warning as the non-stub implementation accesses __initdata (svm_x86_ops), i.e. would generate a use-after-free if svm_hv_hardware_setup() were actually invoked post-init. The helper is only called from svm_hardware_setup(), which is also __init, i.e. lack of __init is benign other than the modpost warning.
Fixes: 1e0c7d40758b ("KVM: SVM: hyper-v: Remote TLB flush for SVM") Signed-off-by: Randy Dunlap rdunlap@infradead.org Cc: Vineeth Pillai viremana@linux.microsoft.com Cc: Paolo Bonzini pbonzini@redhat.com Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Reviewed-by: Sean Christopherson seanjc@google.com Reviewed-by: Vitaly Kuznetsov vkuznets@redhat.com Message-Id: 20230222073315.9081-1-rdunlap@infradead.org Signed-off-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/svm/svm_onhyperv.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/svm/svm_onhyperv.h +++ b/arch/x86/kvm/svm/svm_onhyperv.h @@ -30,7 +30,7 @@ static inline void svm_hv_init_vmcb(stru hve->hv_enlightenments_control.msr_bitmap = 1; }
-static inline void svm_hv_hardware_setup(void) +static inline __init void svm_hv_hardware_setup(void) { if (npt_enabled && ms_hyperv.nested_features & HV_X64_NESTED_ENLIGHTENED_TLB) { @@ -84,7 +84,7 @@ static inline void svm_hv_init_vmcb(stru { }
-static inline void svm_hv_hardware_setup(void) +static inline __init void svm_hv_hardware_setup(void) { }
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit ac5ec90e94fe8eddb4499e51398640fa6a89d657 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/x86/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/x86/Makefile +++ b/tools/testing/selftests/x86/Makefile @@ -34,7 +34,7 @@ BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=% BINARIES_32 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_32)) BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
-CFLAGS := -O2 -g -std=gnu99 -pthread -Wall +CFLAGS := -O2 -g -std=gnu99 -pthread -Wall $(KHDR_INCLUDES)
# call32_from_64 in thunks.S uses absolute addresses. ifeq ($(CAN_BUILD_WITH_NOPIE),1)
From: Sean Christopherson seanjc@google.com
commit 6a3236580b0b1accc3976345e723104f74f6f8e6 upstream.
Set GIF=1 prior to disabling SVM to ensure that INIT is recognized if the kernel is disabling SVM in an emergency, e.g. if the kernel is about to jump into a crash kernel or may reboot without doing a full CPU RESET. If GIF is left cleared, the new kernel (or firmware) will be unabled to awaken APs. Eat faults on STGI (due to EFER.SVME=0) as it's possible that SVM could be disabled via NMI shootdown between reading EFER.SVME and executing STGI.
Link: https://lore.kernel.org/all/cbcb6f35-e5d7-c1c9-4db9-fe5cc4de579a@amd.com Cc: stable@vger.kernel.org Cc: Andrew Cooper Andrew.Cooper3@citrix.com Cc: Tom Lendacky thomas.lendacky@amd.com Reviewed-by: Thomas Gleixner tglx@linutronix.de Link: https://lore.kernel.org/r/20221130233650.1404148-3-seanjc@google.com Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/include/asm/virtext.h | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/virtext.h +++ b/arch/x86/include/asm/virtext.h @@ -126,7 +126,21 @@ static inline void cpu_svm_disable(void)
wrmsrl(MSR_VM_HSAVE_PA, 0); rdmsrl(MSR_EFER, efer); - wrmsrl(MSR_EFER, efer & ~EFER_SVME); + if (efer & EFER_SVME) { + /* + * Force GIF=1 prior to disabling SVM to ensure INIT and NMI + * aren't blocked, e.g. if a fatal error occurred between CLGI + * and STGI. Note, STGI may #UD if SVM is disabled from NMI + * context between reading EFER and executing STGI. In that + * case, GIF must already be set, otherwise the NMI would have + * been blocked, so just eat the fault. + */ + asm_volatile_goto("1: stgi\n\t" + _ASM_EXTABLE(1b, %l[fault]) + ::: "memory" : fault); +fault: + wrmsrl(MSR_EFER, efer & ~EFER_SVME); + } }
/** Makes sure SVM is disabled, if it is supported on the CPU
From: Sean Christopherson seanjc@google.com
commit 26044aff37a5455b19a91785086914fd33053ef4 upstream.
Disable virtualization in crash_nmi_callback() and rework the emergency_vmx_disable_all() path to do an NMI shootdown if and only if a shootdown has not already occurred. NMI crash shootdown fundamentally can't support multiple invocations as responding CPUs are deliberately put into halt state without unblocking NMIs. But, the emergency reboot path doesn't have any work of its own, it simply cares about disabling virtualization, i.e. so long as a shootdown occurred, emergency reboot doesn't care who initiated the shootdown, or when.
If "crash_kexec_post_notifiers" is specified on the kernel command line, panic() will invoke crash_smp_send_stop() and result in a second call to nmi_shootdown_cpus() during native_machine_emergency_restart().
Invoke the callback _before_ disabling virtualization, as the current VMCS needs to be cleared before doing VMXOFF. Note, this results in a subtle change in ordering between disabling virtualization and stopping Intel PT on the responding CPUs. While VMX and Intel PT do interact, VMXOFF and writes to MSR_IA32_RTIT_CTL do not induce faults between one another, which is all that matters when panicking.
Harden nmi_shootdown_cpus() against multiple invocations to try and capture any such kernel bugs via a WARN instead of hanging the system during a crash/dump, e.g. prior to the recent hardening of register_nmi_handler(), re-registering the NMI handler would trigger a double list_add() and hang the system if CONFIG_BUG_ON_DATA_CORRUPTION=y.
list_add double add: new=ffffffff82220800, prev=ffffffff8221cfe8, next=ffffffff82220800. WARNING: CPU: 2 PID: 1319 at lib/list_debug.c:29 __list_add_valid+0x67/0x70 Call Trace: __register_nmi_handler+0xcf/0x130 nmi_shootdown_cpus+0x39/0x90 native_machine_emergency_restart+0x1c9/0x1d0 panic+0x237/0x29b
Extract the disabling logic to a common helper to deduplicate code, and to prepare for doing the shootdown in the emergency reboot path if SVM is supported.
Note, prior to commit ed72736183c4 ("x86/reboot: Force all cpus to exit VMX root if VMX is supported"), nmi_shootdown_cpus() was subtly protected against a second invocation by a cpu_vmx_enabled() check as the kdump handler would disable VMX if it ran first.
Fixes: ed72736183c4 ("x86/reboot: Force all cpus to exit VMX root if VMX is supported") Cc: stable@vger.kernel.org Reported-by: Guilherme G. Piccoli gpiccoli@igalia.com Cc: Vitaly Kuznetsov vkuznets@redhat.com Cc: Paolo Bonzini pbonzini@redhat.com Link: https://lore.kernel.org/all/20220427224924.592546-2-gpiccoli@igalia.com Tested-by: Guilherme G. Piccoli gpiccoli@igalia.com Reviewed-by: Thomas Gleixner tglx@linutronix.de Link: https://lore.kernel.org/r/20221130233650.1404148-2-seanjc@google.com Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/include/asm/reboot.h | 2 + arch/x86/kernel/crash.c | 17 ---------- arch/x86/kernel/reboot.c | 65 ++++++++++++++++++++++++++++++++++-------- 3 files changed, 56 insertions(+), 28 deletions(-)
--- a/arch/x86/include/asm/reboot.h +++ b/arch/x86/include/asm/reboot.h @@ -25,6 +25,8 @@ void __noreturn machine_real_restart(uns #define MRR_BIOS 0 #define MRR_APM 1
+void cpu_emergency_disable_virtualization(void); + typedef void (*nmi_shootdown_cb)(int, struct pt_regs*); void nmi_panic_self_stop(struct pt_regs *regs); void nmi_shootdown_cpus(nmi_shootdown_cb callback); --- a/arch/x86/kernel/crash.c +++ b/arch/x86/kernel/crash.c @@ -37,7 +37,6 @@ #include <linux/kdebug.h> #include <asm/cpu.h> #include <asm/reboot.h> -#include <asm/virtext.h> #include <asm/intel_pt.h> #include <asm/crash.h> #include <asm/cmdline.h> @@ -81,15 +80,6 @@ static void kdump_nmi_callback(int cpu, */ cpu_crash_vmclear_loaded_vmcss();
- /* Disable VMX or SVM if needed. - * - * We need to disable virtualization on all CPUs. - * Having VMX or SVM enabled on any CPU may break rebooting - * after the kdump kernel has finished its task. - */ - cpu_emergency_vmxoff(); - cpu_emergency_svm_disable(); - /* * Disable Intel PT to stop its logging */ @@ -148,12 +138,7 @@ void native_machine_crash_shutdown(struc */ cpu_crash_vmclear_loaded_vmcss();
- /* Booting kdump kernel with VMX or SVM enabled won't work, - * because (among other limitations) we can't disable paging - * with the virt flags. - */ - cpu_emergency_vmxoff(); - cpu_emergency_svm_disable(); + cpu_emergency_disable_virtualization();
/* * Disable Intel PT to stop its logging --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -528,10 +528,7 @@ static inline void kb_wait(void) } }
-static void vmxoff_nmi(int cpu, struct pt_regs *regs) -{ - cpu_emergency_vmxoff(); -} +static inline void nmi_shootdown_cpus_on_restart(void);
/* Use NMIs as IPIs to tell all CPUs to disable virtualization */ static void emergency_vmx_disable_all(void) @@ -554,7 +551,7 @@ static void emergency_vmx_disable_all(vo __cpu_emergency_vmxoff();
/* Halt and exit VMX root operation on the other CPUs. */ - nmi_shootdown_cpus(vmxoff_nmi); + nmi_shootdown_cpus_on_restart(); } }
@@ -795,6 +792,17 @@ void machine_crash_shutdown(struct pt_re /* This is the CPU performing the emergency shutdown work. */ int crashing_cpu = -1;
+/* + * Disable virtualization, i.e. VMX or SVM, to ensure INIT is recognized during + * reboot. VMX blocks INIT if the CPU is post-VMXON, and SVM blocks INIT if + * GIF=0, i.e. if the crash occurred between CLGI and STGI. + */ +void cpu_emergency_disable_virtualization(void) +{ + cpu_emergency_vmxoff(); + cpu_emergency_svm_disable(); +} + #if defined(CONFIG_SMP)
static nmi_shootdown_cb shootdown_callback; @@ -817,7 +825,14 @@ static int crash_nmi_callback(unsigned i return NMI_HANDLED; local_irq_disable();
- shootdown_callback(cpu, regs); + if (shootdown_callback) + shootdown_callback(cpu, regs); + + /* + * Prepare the CPU for reboot _after_ invoking the callback so that the + * callback can safely use virtualization instructions, e.g. VMCLEAR. + */ + cpu_emergency_disable_virtualization();
atomic_dec(&waiting_for_crash_ipi); /* Assume hlt works */ @@ -828,18 +843,32 @@ static int crash_nmi_callback(unsigned i return NMI_HANDLED; }
-/* - * Halt all other CPUs, calling the specified function on each of them +/** + * nmi_shootdown_cpus - Stop other CPUs via NMI + * @callback: Optional callback to be invoked from the NMI handler + * + * The NMI handler on the remote CPUs invokes @callback, if not + * NULL, first and then disables virtualization to ensure that + * INIT is recognized during reboot. * - * This function can be used to halt all other CPUs on crash - * or emergency reboot time. The function passed as parameter - * will be called inside a NMI handler on all CPUs. + * nmi_shootdown_cpus() can only be invoked once. After the first + * invocation all other CPUs are stuck in crash_nmi_callback() and + * cannot respond to a second NMI. */ void nmi_shootdown_cpus(nmi_shootdown_cb callback) { unsigned long msecs; + local_irq_disable();
+ /* + * Avoid certain doom if a shootdown already occurred; re-registering + * the NMI handler will cause list corruption, modifying the callback + * will do who knows what, etc... + */ + if (WARN_ON_ONCE(crash_ipi_issued)) + return; + /* Make a note of crashing cpu. Will be used in NMI callback. */ crashing_cpu = safe_smp_processor_id();
@@ -867,7 +896,17 @@ void nmi_shootdown_cpus(nmi_shootdown_cb msecs--; }
- /* Leave the nmi callback set */ + /* + * Leave the nmi callback set, shootdown is a one-time thing. Clearing + * the callback could result in a NULL pointer dereference if a CPU + * (finally) responds after the timeout expires. + */ +} + +static inline void nmi_shootdown_cpus_on_restart(void) +{ + if (!crash_ipi_issued) + nmi_shootdown_cpus(NULL); }
/* @@ -897,6 +936,8 @@ void nmi_shootdown_cpus(nmi_shootdown_cb /* No other CPUs to shoot down */ }
+static inline void nmi_shootdown_cpus_on_restart(void) { } + void run_crash_ipi_callback(struct pt_regs *regs) { }
From: Sean Christopherson seanjc@google.com
commit d81f952aa657b76cea381384bef1fea35c5fd266 upstream.
Disable SVM on all CPUs via NMI shootdown during an emergency reboot. Like VMX, SVM can block INIT, e.g. if the emergency reboot is triggered between CLGI and STGI, and thus can prevent bringing up other CPUs via INIT-SIPI-SIPI.
Cc: stable@vger.kernel.org Reviewed-by: Thomas Gleixner tglx@linutronix.de Link: https://lore.kernel.org/r/20221130233650.1404148-4-seanjc@google.com Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kernel/reboot.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-)
--- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -530,27 +530,26 @@ static inline void kb_wait(void)
static inline void nmi_shootdown_cpus_on_restart(void);
-/* Use NMIs as IPIs to tell all CPUs to disable virtualization */ -static void emergency_vmx_disable_all(void) +static void emergency_reboot_disable_virtualization(void) { /* Just make sure we won't change CPUs while doing this */ local_irq_disable();
/* - * Disable VMX on all CPUs before rebooting, otherwise we risk hanging - * the machine, because the CPU blocks INIT when it's in VMX root. + * Disable virtualization on all CPUs before rebooting to avoid hanging + * the system, as VMX and SVM block INIT when running in the host. * * We can't take any locks and we may be on an inconsistent state, so - * use NMIs as IPIs to tell the other CPUs to exit VMX root and halt. + * use NMIs as IPIs to tell the other CPUs to disable VMX/SVM and halt. * - * Do the NMI shootdown even if VMX if off on _this_ CPU, as that - * doesn't prevent a different CPU from being in VMX root operation. + * Do the NMI shootdown even if virtualization is off on _this_ CPU, as + * other CPUs may have virtualization enabled. */ - if (cpu_has_vmx()) { - /* Safely force _this_ CPU out of VMX root operation. */ - __cpu_emergency_vmxoff(); + if (cpu_has_vmx() || cpu_has_svm(NULL)) { + /* Safely force _this_ CPU out of VMX/SVM operation. */ + cpu_emergency_disable_virtualization();
- /* Halt and exit VMX root operation on the other CPUs. */ + /* Disable VMX/SVM and halt on other CPUs. */ nmi_shootdown_cpus_on_restart(); } } @@ -587,7 +586,7 @@ static void native_machine_emergency_res unsigned short mode;
if (reboot_emergency) - emergency_vmx_disable_all(); + emergency_reboot_disable_virtualization();
tboot_shutdown(TB_SHUTDOWN_REBOOT);
From: Sean Christopherson seanjc@google.com
commit a2b07fa7b93321c059af0c6d492cc9a4f1e390aa upstream.
Disable SVM and more importantly force GIF=1 when halting a CPU or rebooting the machine. Similar to VMX, SVM allows software to block INITs via CLGI, and thus can be problematic for a crash/reboot. The window for failure is smaller with SVM as INIT is only blocked while GIF=0, i.e. between CLGI and STGI, but the window does exist.
Fixes: fba4f472b33a ("x86/reboot: Turn off KVM when halting a CPU") Cc: stable@vger.kernel.org Reviewed-by: Thomas Gleixner tglx@linutronix.de Link: https://lore.kernel.org/r/20221130233650.1404148-5-seanjc@google.com Signed-off-by: Sean Christopherson seanjc@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/smp.c +++ b/arch/x86/kernel/smp.c @@ -32,7 +32,7 @@ #include <asm/mce.h> #include <asm/trace/irq_vectors.h> #include <asm/kexec.h> -#include <asm/virtext.h> +#include <asm/reboot.h>
/* * Some notes on x86 processor bugs affecting SMP operation: @@ -122,7 +122,7 @@ static int smp_stop_nmi_callback(unsigne if (raw_smp_processor_id() == atomic_read(&stopping_cpu)) return NMI_HANDLED;
- cpu_emergency_vmxoff(); + cpu_emergency_disable_virtualization(); stop_this_cpu(NULL);
return NMI_HANDLED; @@ -134,7 +134,7 @@ static int smp_stop_nmi_callback(unsigne DEFINE_IDTENTRY_SYSVEC(sysvec_reboot) { ack_APIC_irq(); - cpu_emergency_vmxoff(); + cpu_emergency_disable_virtualization(); stop_this_cpu(NULL); }
From: Yang Jihong yangjihong1@huawei.com
commit 868a6fc0ca2407622d2833adefe1c4d284766c4c upstream.
Since the following commit:
commit f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code")
modified the update timing of the KPROBE_FLAG_OPTIMIZED, a optimized_kprobe may be in the optimizing or unoptimizing state when op.kp->flags has KPROBE_FLAG_OPTIMIZED and op->list is not empty.
The __recover_optprobed_insn check logic is incorrect, a kprobe in the unoptimizing state may be incorrectly determined as unoptimizing. As a result, incorrect instructions are copied.
The optprobe_queued_unopt function needs to be exported for invoking in arch directory.
Link: https://lore.kernel.org/all/20230216034247.32348-2-yangjihong1@huawei.com/
Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") Cc: stable@vger.kernel.org Signed-off-by: Yang Jihong yangjihong1@huawei.com Acked-by: Masami Hiramatsu (Google) mhiramat@kernel.org Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kernel/kprobes/opt.c | 4 ++-- include/linux/kprobes.h | 1 + kernel/kprobes.c | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-)
--- a/arch/x86/kernel/kprobes/opt.c +++ b/arch/x86/kernel/kprobes/opt.c @@ -46,8 +46,8 @@ unsigned long __recover_optprobed_insn(k /* This function only handles jump-optimized kprobe */ if (kp && kprobe_optimized(kp)) { op = container_of(kp, struct optimized_kprobe, kp); - /* If op->list is not empty, op is under optimizing */ - if (list_empty(&op->list)) + /* If op is optimized or under unoptimizing */ + if (list_empty(&op->list) || optprobe_queued_unopt(op)) goto found; } } --- a/include/linux/kprobes.h +++ b/include/linux/kprobes.h @@ -378,6 +378,7 @@ extern void opt_pre_handler(struct kprob DEFINE_INSN_CACHE_OPS(optinsn);
extern void wait_for_kprobe_optimizer(void); +bool optprobe_queued_unopt(struct optimized_kprobe *op); #else /* !CONFIG_OPTPROBES */ static inline void wait_for_kprobe_optimizer(void) { } #endif /* CONFIG_OPTPROBES */ --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -662,7 +662,7 @@ void wait_for_kprobe_optimizer(void) mutex_unlock(&kprobe_mutex); }
-static bool optprobe_queued_unopt(struct optimized_kprobe *op) +bool optprobe_queued_unopt(struct optimized_kprobe *op) { struct optimized_kprobe *_op;
From: Yang Jihong yangjihong1@huawei.com
commit f1c97a1b4ef709e3f066f82e3ba3108c3b133ae6 upstream.
When arch_prepare_optimized_kprobe calculating jump destination address, it copies original instructions from jmp-optimized kprobe (see __recover_optprobed_insn), and calculated based on length of original instruction.
arch_check_optimized_kprobe does not check KPROBE_FLAG_OPTIMATED when checking whether jmp-optimized kprobe exists. As a result, setup_detour_execution may jump to a range that has been overwritten by jump destination address, resulting in an inval opcode error.
For example, assume that register two kprobes whose addresses are <func+9> and <func+11> in "func" function. The original code of "func" function is as follows:
0xffffffff816cb5e9 <+9>: push %r12 0xffffffff816cb5eb <+11>: xor %r12d,%r12d 0xffffffff816cb5ee <+14>: test %rdi,%rdi 0xffffffff816cb5f1 <+17>: setne %r12b 0xffffffff816cb5f5 <+21>: push %rbp
1.Register the kprobe for <func+11>, assume that is kp1, corresponding optimized_kprobe is op1. After the optimization, "func" code changes to:
0xffffffff816cc079 <+9>: push %r12 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 0xffffffff816cc080 <+16>: incl 0xf(%rcx) 0xffffffff816cc083 <+19>: xchg %eax,%ebp 0xffffffff816cc084 <+20>: (bad) 0xffffffff816cc085 <+21>: push %rbp
Now op1->flags == KPROBE_FLAG_OPTIMATED;
2. Register the kprobe for <func+9>, assume that is kp2, corresponding optimized_kprobe is op2.
register_kprobe(kp2) register_aggr_kprobe alloc_aggr_kprobe __prepare_optimized_kprobe arch_prepare_optimized_kprobe __recover_optprobed_insn // copy original bytes from kp1->optinsn.copied_insn, // jump address = <func+14>
3. disable kp1:
disable_kprobe(kp1) __disable_kprobe ... if (p == orig_p || aggr_kprobe_disabled(orig_p)) { ret = disarm_kprobe(orig_p, true) // add op1 in unoptimizing_list, not unoptimized orig_p->flags |= KPROBE_FLAG_DISABLED; // op1->flags == KPROBE_FLAG_OPTIMATED | KPROBE_FLAG_DISABLED ...
4. unregister kp2 __unregister_kprobe_top ... if (!kprobe_disabled(ap) && !kprobes_all_disarmed) { optimize_kprobe(op) ... if (arch_check_optimized_kprobe(op) < 0) // because op1 has KPROBE_FLAG_DISABLED, here not return return; p->kp.flags |= KPROBE_FLAG_OPTIMIZED; // now op2 has KPROBE_FLAG_OPTIMIZED }
"func" code now is:
0xffffffff816cc079 <+9>: int3 0xffffffff816cc07a <+10>: push %rsp 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 0xffffffff816cc080 <+16>: incl 0xf(%rcx) 0xffffffff816cc083 <+19>: xchg %eax,%ebp 0xffffffff816cc084 <+20>: (bad) 0xffffffff816cc085 <+21>: push %rbp
5. if call "func", int3 handler call setup_detour_execution:
if (p->flags & KPROBE_FLAG_OPTIMIZED) { ... regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX; ... }
The code for the destination address is
0xffffffffa021072c: push %r12 0xffffffffa021072e: xor %r12d,%r12d 0xffffffffa0210731: jmp 0xffffffff816cb5ee <func+14>
However, <func+14> is not a valid start instruction address. As a result, an error occurs.
Link: https://lore.kernel.org/all/20230216034247.32348-3-yangjihong1@huawei.com/
Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") Signed-off-by: Yang Jihong yangjihong1@huawei.com Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu (Google) mhiramat@kernel.org Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kernel/kprobes/opt.c | 2 +- include/linux/kprobes.h | 1 + kernel/kprobes.c | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/kprobes/opt.c +++ b/arch/x86/kernel/kprobes/opt.c @@ -353,7 +353,7 @@ int arch_check_optimized_kprobe(struct o
for (i = 1; i < op->optinsn.size; i++) { p = get_kprobe(op->kp.addr + i); - if (p && !kprobe_disabled(p)) + if (p && !kprobe_disarmed(p)) return -EEXIST; }
--- a/include/linux/kprobes.h +++ b/include/linux/kprobes.h @@ -379,6 +379,7 @@ DEFINE_INSN_CACHE_OPS(optinsn);
extern void wait_for_kprobe_optimizer(void); bool optprobe_queued_unopt(struct optimized_kprobe *op); +bool kprobe_disarmed(struct kprobe *p); #else /* !CONFIG_OPTPROBES */ static inline void wait_for_kprobe_optimizer(void) { } #endif /* CONFIG_OPTPROBES */ --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -458,7 +458,7 @@ static inline int kprobe_optready(struct }
/* Return true if the kprobe is disarmed. Note: p must be on hash list */ -static inline bool kprobe_disarmed(struct kprobe *p) +bool kprobe_disarmed(struct kprobe *p) { struct optimized_kprobe *op;
From: Borislav Petkov (AMD) bp@alien8.de
commit 2355370cd941cbb20882cc3f34460f9f2b8f9a18 upstream.
It is always the BSP.
No functional changes.
Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Link: https://lore.kernel.org/r/20230130161709.11615-2-bp@alien8.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kernel/cpu/microcode/amd.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-)
--- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -553,8 +553,7 @@ void load_ucode_amd_ap(unsigned int cpui apply_microcode_early_amd(cpuid_1_eax, cp.data, cp.size, false); }
-static enum ucode_state -load_microcode_amd(bool save, u8 family, const u8 *data, size_t size); +static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size);
int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) { @@ -572,7 +571,7 @@ int __init save_microcode_in_initrd_amd( if (!desc.mc) return -EINVAL;
- ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size); + ret = load_microcode_amd(x86_family(cpuid_1_eax), desc.data, desc.size); if (ret > UCODE_UPDATED) return -EINVAL;
@@ -850,8 +849,7 @@ static enum ucode_state __load_microcode return UCODE_OK; }
-static enum ucode_state -load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) +static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) { struct ucode_patch *p; enum ucode_state ret; @@ -875,10 +873,6 @@ load_microcode_amd(bool save, u8 family, ret = UCODE_NEW; }
- /* save BSP's matching patch for early load */ - if (!save) - return ret; - memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE));
@@ -905,14 +899,9 @@ static enum ucode_state request_microcod { char fw_name[36] = "amd-ucode/microcode_amd.bin"; struct cpuinfo_x86 *c = &cpu_data(cpu); - bool bsp = c->cpu_index == boot_cpu_data.cpu_index; enum ucode_state ret = UCODE_NFOUND; const struct firmware *fw;
- /* reload ucode container only on the boot cpu */ - if (!bsp) - return UCODE_OK; - if (c->x86 >= 0x15) snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
@@ -925,7 +914,7 @@ static enum ucode_state request_microcod if (!verify_container(fw->data, fw->size, false)) goto fw_release;
- ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size); + ret = load_microcode_amd(c->x86, fw->data, fw->size);
fw_release: release_firmware(fw);
From: Borislav Petkov (AMD) bp@alien8.de
commit a5ad92134bd153a9ccdcddf09a95b088f36c3cce upstream.
Will be used in a subsequent change.
Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Link: https://lore.kernel.org/r/20230130161709.11615-3-bp@alien8.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/include/asm/microcode.h | 4 ++-- arch/x86/include/asm/microcode_amd.h | 4 ++-- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/microcode/core.c | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-)
--- a/arch/x86/include/asm/microcode.h +++ b/arch/x86/include/asm/microcode.h @@ -125,13 +125,13 @@ static inline unsigned int x86_cpuid_fam #ifdef CONFIG_MICROCODE extern void __init load_ucode_bsp(void); extern void load_ucode_ap(void); -void reload_early_microcode(void); +void reload_early_microcode(unsigned int cpu); extern bool initrd_gone; void microcode_bsp_resume(void); #else static inline void __init load_ucode_bsp(void) { } static inline void load_ucode_ap(void) { } -static inline void reload_early_microcode(void) { } +static inline void reload_early_microcode(unsigned int cpu) { } static inline void microcode_bsp_resume(void) { } #endif
--- a/arch/x86/include/asm/microcode_amd.h +++ b/arch/x86/include/asm/microcode_amd.h @@ -47,12 +47,12 @@ struct microcode_amd { extern void __init load_ucode_amd_bsp(unsigned int family); extern void load_ucode_amd_ap(unsigned int family); extern int __init save_microcode_in_initrd_amd(unsigned int family); -void reload_ucode_amd(void); +void reload_ucode_amd(unsigned int cpu); #else static inline void __init load_ucode_amd_bsp(unsigned int family) {} static inline void load_ucode_amd_ap(unsigned int family) {} static inline int __init save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } -static inline void reload_ucode_amd(void) {} +static inline void reload_ucode_amd(unsigned int cpu) {} #endif #endif /* _ASM_X86_MICROCODE_AMD_H */ --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -578,7 +578,7 @@ int __init save_microcode_in_initrd_amd( return 0; }
-void reload_ucode_amd(void) +void reload_ucode_amd(unsigned int cpu) { struct microcode_amd *mc; u32 rev, dummy __always_unused; --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c @@ -298,7 +298,7 @@ struct cpio_data find_microcode_in_initr #endif }
-void reload_early_microcode(void) +void reload_early_microcode(unsigned int cpu) { int vendor, family;
@@ -312,7 +312,7 @@ void reload_early_microcode(void) break; case X86_VENDOR_AMD: if (family >= 0x10) - reload_ucode_amd(); + reload_ucode_amd(cpu); break; default: break; @@ -567,7 +567,7 @@ void microcode_bsp_resume(void) if (uci->mc) microcode_ops->apply_microcode(cpu); else - reload_early_microcode(); + reload_early_microcode(cpu); }
static struct syscore_ops mc_syscore_ops = {
From: Borislav Petkov (AMD) bp@alien8.de
commit 7ff6edf4fef38ab404ee7861f257e28eaaeed35f upstream.
The AMD side of the loader has always claimed to support mixed steppings. But somewhere along the way, it broke that by assuming that the cached patch blob is a single one instead of it being one per *node*.
So turn it into a per-node one so that each node can stash the blob relevant for it.
[ NB: Fixes tag is not really the exactly correct one but it is good enough. ]
Fixes: fe055896c040 ("x86/microcode: Merge the early microcode loader") Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Cc: stable@kernel.org # 2355370cd941 ("x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter") Cc: stable@kernel.org # a5ad92134bd1 ("x86/microcode/AMD: Add a @cpu parameter to the reloading functions") Link: https://lore.kernel.org/r/20230130161709.11615-4-bp@alien8.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kernel/cpu/microcode/amd.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-)
--- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -55,7 +55,9 @@ struct cont_desc { };
static u32 ucode_new_rev; -static u8 amd_ucode_patch[PATCH_MAX_SIZE]; + +/* One blob per node. */ +static u8 amd_ucode_patch[MAX_NUMNODES][PATCH_MAX_SIZE];
/* * Microcode patch container file is prepended to the initrd in cpio @@ -428,7 +430,7 @@ apply_microcode_early_amd(u32 cpuid_1_ea patch = (u8 (*)[PATCH_MAX_SIZE])__pa_nodebug(&amd_ucode_patch); #else new_rev = &ucode_new_rev; - patch = &amd_ucode_patch; + patch = &amd_ucode_patch[0]; #endif
desc.cpuid_1_eax = cpuid_1_eax; @@ -580,10 +582,10 @@ int __init save_microcode_in_initrd_amd(
void reload_ucode_amd(unsigned int cpu) { - struct microcode_amd *mc; u32 rev, dummy __always_unused; + struct microcode_amd *mc;
- mc = (struct microcode_amd *)amd_ucode_patch; + mc = (struct microcode_amd *)amd_ucode_patch[cpu_to_node(cpu)];
rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
@@ -851,6 +853,8 @@ static enum ucode_state __load_microcode
static enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size) { + struct cpuinfo_x86 *c; + unsigned int nid, cpu; struct ucode_patch *p; enum ucode_state ret;
@@ -863,18 +867,22 @@ static enum ucode_state load_microcode_a return ret; }
- p = find_patch(0); - if (!p) { - return ret; - } else { - if (boot_cpu_data.microcode >= p->patch_id) - return ret; + for_each_node(nid) { + cpu = cpumask_first(cpumask_of_node(nid)); + c = &cpu_data(cpu); + + p = find_patch(cpu); + if (!p) + continue; + + if (c->microcode >= p->patch_id) + continue;
ret = UCODE_NEW; - }
- memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); - memcpy(amd_ucode_patch, p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); + memset(&amd_ucode_patch[nid], 0, PATCH_MAX_SIZE); + memcpy(&amd_ucode_patch[nid], p->data, min_t(u32, p->size, PATCH_MAX_SIZE)); + }
return ret; }
From: KP Singh kpsingh@kernel.org
commit 6921ed9049bc7457f66c1596c5b78aec0dae4a9d upstream.
When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation() determines that STIBP is not needed.
The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.
Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for enabling STIBP (through seccomp/prctl() by default or always-on, if selected by spectre_v2_user kernel cmdline parameter).
[ bp: Massage. ]
Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Reported-by: José Oliveira joseloliveira11@gmail.com Reported-by: Rodrigo Branco rodrigo@kernelhacking.com Signed-off-by: KP Singh kpsingh@kernel.org Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230220120127.1975241-1-kpsingh@kernel.org Link: https://lore.kernel.org/r/20230221184908.2349578-1-kpsingh@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kernel/cpu/bugs.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
--- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1132,14 +1132,18 @@ spectre_v2_parse_user_cmdline(void) return SPECTRE_V2_USER_CMD_AUTO; }
-static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) +static inline bool spectre_v2_in_eibrs_mode(enum spectre_v2_mitigation mode) { - return mode == SPECTRE_V2_IBRS || - mode == SPECTRE_V2_EIBRS || + return mode == SPECTRE_V2_EIBRS || mode == SPECTRE_V2_EIBRS_RETPOLINE || mode == SPECTRE_V2_EIBRS_LFENCE; }
+static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode) +{ + return spectre_v2_in_eibrs_mode(mode) || mode == SPECTRE_V2_IBRS; +} + static void __init spectre_v2_user_select_mitigation(void) { @@ -1202,12 +1206,19 @@ spectre_v2_user_select_mitigation(void) }
/* - * If no STIBP, IBRS or enhanced IBRS is enabled, or SMT impossible, - * STIBP is not required. + * If no STIBP, enhanced IBRS is enabled, or SMT impossible, STIBP + * is not required. + * + * Enhanced IBRS also protects against cross-thread branch target + * injection in user-mode as the IBRS bit remains always set which + * implicitly enables cross-thread protections. However, in legacy IBRS + * mode, the IBRS bit is set only on kernel entry and cleared on return + * to userspace. This disables the implicit cross-thread protection, + * so allow for STIBP to be selected in that case. */ if (!boot_cpu_has(X86_FEATURE_STIBP) || !smt_possible || - spectre_v2_in_ibrs_mode(spectre_v2_enabled)) + spectre_v2_in_eibrs_mode(spectre_v2_enabled)) return;
/* @@ -2335,7 +2346,7 @@ static ssize_t mmio_stale_data_show_stat
static char *stibp_state(void) { - if (spectre_v2_in_ibrs_mode(spectre_v2_enabled)) + if (spectre_v2_in_eibrs_mode(spectre_v2_enabled)) return "";
switch (spectre_v2_user_stibp) {
From: KP Singh kpsingh@kernel.org
commit e02b50ca442e88122e1302d4dbc1b71a4808c13f upstream.
Explain why STIBP is needed with legacy IBRS as currently implemented (KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled.
Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Signed-off-by: KP Singh kpsingh@kernel.org Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Link: https://lore.kernel.org/r/20230227060541.1939092-2-kpsingh@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- Documentation/admin-guide/hw-vuln/spectre.rst | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
--- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -479,8 +479,16 @@ Spectre variant 2 On Intel Skylake-era systems the mitigation covers most, but not all, cases. See :ref:`[3] <spec_ref3>` for more details.
- On CPUs with hardware mitigation for Spectre variant 2 (e.g. Enhanced - IBRS on x86), retpoline is automatically disabled at run time. + On CPUs with hardware mitigation for Spectre variant 2 (e.g. IBRS + or enhanced IBRS on x86), retpoline is automatically disabled at run time. + + Systems which support enhanced IBRS (eIBRS) enable IBRS protection once at + boot, by setting the IBRS bit, and they're automatically protected against + Spectre v2 variant attacks, including cross-thread branch target injections + on SMT systems (STIBP). In other words, eIBRS enables STIBP too. + + Legacy IBRS systems clear the IBRS bit on exit to userspace and + therefore explicitly enable STIBP for that
The retpoline mitigation is turned on by default on vulnerable CPUs. It can be forced on or off by the administrator @@ -504,9 +512,12 @@ Spectre variant 2 For Spectre variant 2 mitigation, individual user programs can be compiled with return trampolines for indirect branches. This protects them from consuming poisoned entries in the branch - target buffer left by malicious software. Alternatively, the - programs can disable their indirect branch speculation via prctl() - (See :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`). + target buffer left by malicious software. + + On legacy IBRS systems, at return to userspace, implicit STIBP is disabled + because the kernel clears the IBRS bit. In this case, the userspace programs + can disable indirect branch speculation via prctl() (See + :ref:`Documentation/userspace-api/spec_ctrl.rst <set_spec_ctrl>`). On x86, this will turn on STIBP to guard against attacks from the sibling thread when the user program is running, and use IBPB to flush the branch target buffer when switching to/from the program.
From: Tom Lendacky thomas.lendacky@amd.com
commit dd093fb08e8f8a958fec4eef36f9f09eac047f60 upstream.
Commit
47894e0fa6a5 ("virt/sev-guest: Prevent IV reuse in the SNP guest driver")
changed the behavior associated with the return value when the caller does not supply a large enough certificate buffer. Prior to the commit a value of -EIO was returned. Now, 0 is returned. This breaks the established ABI with the user.
Change the code to detect the buffer size error and return -EIO.
Fixes: 47894e0fa6a5 ("virt/sev-guest: Prevent IV reuse in the SNP guest driver") Reported-by: Larry Dewey larry.dewey@amd.com Signed-off-by: Tom Lendacky thomas.lendacky@amd.com Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Tested-by: Larry Dewey larry.dewey@amd.com Cc: stable@kernel.org Link: https://lore.kernel.org/r/2afbcae6daf13f7ad5a4296692e0a0fe1bc1e4ee.167708397... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/virt/coco/sev-guest/sev-guest.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
--- a/drivers/virt/coco/sev-guest/sev-guest.c +++ b/drivers/virt/coco/sev-guest/sev-guest.c @@ -377,9 +377,26 @@ static int handle_guest_request(struct s snp_dev->input.data_npages = certs_npages; }
+ /* + * Increment the message sequence number. There is no harm in doing + * this now because decryption uses the value stored in the response + * structure and any failure will wipe the VMPCK, preventing further + * use anyway. + */ + snp_inc_msg_seqno(snp_dev); + if (fw_err) *fw_err = err;
+ /* + * If an extended guest request was issued and the supplied certificate + * buffer was not large enough, a standard guest request was issued to + * prevent IV reuse. If the standard request was successful, return -EIO + * back to the caller as would have originally been returned. + */ + if (!rc && err == SNP_GUEST_REQ_INVALID_LEN) + return -EIO; + if (rc) { dev_alert(snp_dev->dev, "Detected error from ASP request. rc: %d, fw_err: %llu\n", @@ -395,9 +412,6 @@ static int handle_guest_request(struct s goto disable_vmpck; }
- /* Increment to new message sequence after payload decryption was successful. */ - snp_inc_msg_seqno(snp_dev); - return 0;
disable_vmpck:
From: Jens Axboe axboe@kernel.dk
commit 67205f80be9910207481406c47f7d85e703fb2e9 upstream.
By default, non-mq drivers do not support nowait. This causes io_uring to use a slower path as the driver cannot be trust not to block. brd can safely set the nowait flag, as worst case all it does is a NOIO allocation.
For io_uring, this makes a substantial difference. Before:
submitter=0, tid=453, file=/dev/ram0, node=-1 polled=0, fixedbufs=1/0, register_files=1, buffered=0, QD=128 Engine=io_uring, sq_ring=128, cq_ring=128 IOPS=440.03K, BW=1718MiB/s, IOS/call=32/31 IOPS=428.96K, BW=1675MiB/s, IOS/call=32/32 IOPS=442.59K, BW=1728MiB/s, IOS/call=32/31 IOPS=419.65K, BW=1639MiB/s, IOS/call=32/32 IOPS=426.82K, BW=1667MiB/s, IOS/call=32/31
and after:
submitter=0, tid=354, file=/dev/ram0, node=-1 polled=0, fixedbufs=1/0, register_files=1, buffered=0, QD=128 Engine=io_uring, sq_ring=128, cq_ring=128 IOPS=3.37M, BW=13.15GiB/s, IOS/call=32/31 IOPS=3.45M, BW=13.46GiB/s, IOS/call=32/31 IOPS=3.43M, BW=13.42GiB/s, IOS/call=32/32 IOPS=3.43M, BW=13.39GiB/s, IOS/call=32/31 IOPS=3.43M, BW=13.38GiB/s, IOS/call=32/31
or about an 8x in difference. Now that brd is prepared to deal with REQ_NOWAIT reads/writes, mark it as supporting that.
Cc: stable@vger.kernel.org # 5.10+ Link: https://lore.kernel.org/linux-block/20230203103005.31290-1-p.raghav@samsung.... Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/block/brd.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -412,6 +412,7 @@ static int brd_alloc(int i) /* Tell the block layer that this is not a rotational device */ blk_queue_flag_set(QUEUE_FLAG_NONROT, disk->queue); blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, disk->queue); + blk_queue_flag_set(QUEUE_FLAG_NOWAIT, disk->queue); err = add_disk(disk); if (err) goto out_cleanup_disk;
From: Jens Axboe axboe@kernel.dk
commit db0ccc44a20b4bb3039c0f6885a1f9c3323c7673 upstream.
It currently returns a page, but callers just check for NULL/page to gauge success. Clean this up and return the appropriate error directly instead.
Cc: stable@vger.kernel.org # 5.10+ Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/block/brd.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-)
--- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -78,11 +78,9 @@ static struct page *brd_lookup_page(stru }
/* - * Look up and return a brd's page for a given sector. - * If one does not exist, allocate an empty page, and insert that. Then - * return it. + * Insert a new page for a given sector, if one does not already exist. */ -static struct page *brd_insert_page(struct brd_device *brd, sector_t sector) +static int brd_insert_page(struct brd_device *brd, sector_t sector) { pgoff_t idx; struct page *page; @@ -90,7 +88,7 @@ static struct page *brd_insert_page(stru
page = brd_lookup_page(brd, sector); if (page) - return page; + return 0;
/* * Must use NOIO because we don't want to recurse back into the @@ -99,11 +97,11 @@ static struct page *brd_insert_page(stru gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM; page = alloc_page(gfp_flags); if (!page) - return NULL; + return -ENOMEM;
if (radix_tree_preload(GFP_NOIO)) { __free_page(page); - return NULL; + return -ENOMEM; }
spin_lock(&brd->brd_lock); @@ -120,8 +118,7 @@ static struct page *brd_insert_page(stru spin_unlock(&brd->brd_lock);
radix_tree_preload_end(); - - return page; + return 0; }
/* @@ -174,16 +171,17 @@ static int copy_to_brd_setup(struct brd_ { unsigned int offset = (sector & (PAGE_SECTORS-1)) << SECTOR_SHIFT; size_t copy; + int ret;
copy = min_t(size_t, n, PAGE_SIZE - offset); - if (!brd_insert_page(brd, sector)) - return -ENOSPC; + ret = brd_insert_page(brd, sector); + if (ret) + return ret; if (copy < n) { sector += copy >> SECTOR_SHIFT; - if (!brd_insert_page(brd, sector)) - return -ENOSPC; + ret = brd_insert_page(brd, sector); } - return 0; + return ret; }
/*
From: Jens Axboe axboe@kernel.dk
commit 6ded703c56c21bfb259725d4f1831a5feb563e9b upstream.
If REQ_NOWAIT is set, then do a non-blocking allocation if the operation is a write and we need to insert a new page. Currently REQ_NOWAIT cannot be set as the queue isn't marked as supporting nowait, this change is in preparation for allowing that.
radix_tree_preload() warns on attempting to call it with an allocation mask that doesn't allow blocking. While that warning could arguably be removed, we need to handle radix insertion failures anyway as they are more likely if we cannot block to get memory.
Remove legacy BUG_ON()'s and turn them into proper errors instead, one for the allocation failure and one for finding a page that doesn't match the correct index.
Cc: stable@vger.kernel.org # 5.10+ Reviewed-by: Christoph Hellwig hch@lst.de Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/block/brd.c | 48 ++++++++++++++++++++++++++++-------------------- 1 file changed, 28 insertions(+), 20 deletions(-)
--- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -80,26 +80,21 @@ static struct page *brd_lookup_page(stru /* * Insert a new page for a given sector, if one does not already exist. */ -static int brd_insert_page(struct brd_device *brd, sector_t sector) +static int brd_insert_page(struct brd_device *brd, sector_t sector, gfp_t gfp) { pgoff_t idx; struct page *page; - gfp_t gfp_flags; + int ret = 0;
page = brd_lookup_page(brd, sector); if (page) return 0;
- /* - * Must use NOIO because we don't want to recurse back into the - * block or filesystem layers from page reclaim. - */ - gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM; - page = alloc_page(gfp_flags); + page = alloc_page(gfp | __GFP_ZERO | __GFP_HIGHMEM); if (!page) return -ENOMEM;
- if (radix_tree_preload(GFP_NOIO)) { + if (gfpflags_allow_blocking(gfp) && radix_tree_preload(gfp)) { __free_page(page); return -ENOMEM; } @@ -110,15 +105,17 @@ static int brd_insert_page(struct brd_de if (radix_tree_insert(&brd->brd_pages, idx, page)) { __free_page(page); page = radix_tree_lookup(&brd->brd_pages, idx); - BUG_ON(!page); - BUG_ON(page->index != idx); + if (!page) + ret = -ENOMEM; + else if (page->index != idx) + ret = -EIO; } else { brd->brd_nr_pages++; } spin_unlock(&brd->brd_lock);
radix_tree_preload_end(); - return 0; + return ret; }
/* @@ -167,19 +164,20 @@ static void brd_free_pages(struct brd_de /* * copy_to_brd_setup must be called before copy_to_brd. It may sleep. */ -static int copy_to_brd_setup(struct brd_device *brd, sector_t sector, size_t n) +static int copy_to_brd_setup(struct brd_device *brd, sector_t sector, size_t n, + gfp_t gfp) { unsigned int offset = (sector & (PAGE_SECTORS-1)) << SECTOR_SHIFT; size_t copy; int ret;
copy = min_t(size_t, n, PAGE_SIZE - offset); - ret = brd_insert_page(brd, sector); + ret = brd_insert_page(brd, sector, gfp); if (ret) return ret; if (copy < n) { sector += copy >> SECTOR_SHIFT; - ret = brd_insert_page(brd, sector); + ret = brd_insert_page(brd, sector, gfp); } return ret; } @@ -254,20 +252,26 @@ static void copy_from_brd(void *dst, str * Process a single bvec of a bio. */ static int brd_do_bvec(struct brd_device *brd, struct page *page, - unsigned int len, unsigned int off, enum req_op op, + unsigned int len, unsigned int off, blk_opf_t opf, sector_t sector) { void *mem; int err = 0;
- if (op_is_write(op)) { - err = copy_to_brd_setup(brd, sector, len); + if (op_is_write(opf)) { + /* + * Must use NOIO because we don't want to recurse back into the + * block or filesystem layers from page reclaim. + */ + gfp_t gfp = opf & REQ_NOWAIT ? GFP_NOWAIT : GFP_NOIO; + + err = copy_to_brd_setup(brd, sector, len, gfp); if (err) goto out; }
mem = kmap_atomic(page); - if (!op_is_write(op)) { + if (!op_is_write(opf)) { copy_from_brd(mem + off, brd, sector, len); flush_dcache_page(page); } else { @@ -296,8 +300,12 @@ static void brd_submit_bio(struct bio *b (len & (SECTOR_SIZE - 1)));
err = brd_do_bvec(brd, bvec.bv_page, len, bvec.bv_offset, - bio_op(bio), sector); + bio->bi_opf, sector); if (err) { + if (err == -ENOMEM && bio->bi_opf & REQ_NOWAIT) { + bio_wouldblock_error(bio); + return; + } bio_io_error(bio); return; }
From: Matt Bobrowski mattbobrowski@google.com
commit 6dc387d52eb67f45d68caa263704fa4e39ef8e76 upstream.
Restore the error handling logic so that when file measurement fails, the respective iint entry is not left with the digest data being populated with zeroes.
Fixes: 54f03916fb89 ("ima: permit fsverity's file digests in the IMA measurement list") Cc: stable@vger.kernel.org # 5.19 Signed-off-by: Matt Bobrowski mattbobrowski@google.com Signed-off-by: Mimi Zohar zohar@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- security/integrity/ima/ima_api.c | 2 +- security/integrity/ima/ima_main.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
--- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -292,7 +292,7 @@ int ima_collect_measurement(struct integ result = ima_calc_file_hash(file, &hash.hdr); }
- if (result == -ENOMEM) + if (result && result != -EBADF && result != -EINVAL) goto out;
length = sizeof(hash.hdr) + hash.hdr.length; --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -337,7 +337,7 @@ static int process_measurement(struct fi hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
rc = ima_collect_measurement(iint, file, buf, size, hash_algo, modsig); - if (rc == -ENOMEM) + if (rc != 0 && rc != -EBADF && rc != -EINVAL) goto out_locked;
if (!pathbuf) /* ima_rdwr_violation possibly pre-fetched */
From: Roberto Sassu roberto.sassu@huawei.com
commit 4971c268b85e1c7a734a61622fc0813c86e2362e upstream.
Commit 98de59bfe4b2f ("take calculation of final prot in security_mmap_file() into a helper") moved the code to update prot, to be the actual protections applied to the kernel, to a new helper called mmap_prot().
However, while without the helper ima_file_mmap() was getting the updated prot, with the helper ima_file_mmap() gets the original prot, which contains the protections requested by the application.
A possible consequence of this change is that, if an application calls mmap() with only PROT_READ, and the kernel applies PROT_EXEC in addition, that application would have access to executable memory without having this event recorded in the IMA measurement list. This situation would occur for example if the application, before mmap(), calls the personality() system call with READ_IMPLIES_EXEC as the first argument.
Align ima_file_mmap() parameters with those of the mmap_file LSM hook, so that IMA can receive both the requested prot and the final prot. Since the requested protections are stored in a new variable, and the final protections are stored in the existing variable, this effectively restores the original behavior of the MMAP_CHECK hook.
Cc: stable@vger.kernel.org Fixes: 98de59bfe4b2 ("take calculation of final prot in security_mmap_file() into a helper") Signed-off-by: Roberto Sassu roberto.sassu@huawei.com Reviewed-by: Stefan Berger stefanb@linux.ibm.com Signed-off-by: Mimi Zohar zohar@linux.ibm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- include/linux/ima.h | 6 ++++-- security/integrity/ima/ima_main.c | 7 +++++-- security/security.c | 7 ++++--- 3 files changed, 13 insertions(+), 7 deletions(-)
--- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -21,7 +21,8 @@ extern int ima_file_check(struct file *f extern void ima_post_create_tmpfile(struct user_namespace *mnt_userns, struct inode *inode); extern void ima_file_free(struct file *file); -extern int ima_file_mmap(struct file *file, unsigned long prot); +extern int ima_file_mmap(struct file *file, unsigned long reqprot, + unsigned long prot, unsigned long flags); extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); extern int ima_load_data(enum kernel_load_data_id id, bool contents); extern int ima_post_load_data(char *buf, loff_t size, @@ -76,7 +77,8 @@ static inline void ima_file_free(struct return; }
-static inline int ima_file_mmap(struct file *file, unsigned long prot) +static inline int ima_file_mmap(struct file *file, unsigned long reqprot, + unsigned long prot, unsigned long flags) { return 0; } --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -397,7 +397,9 @@ out: /** * ima_file_mmap - based on policy, collect/store measurement. * @file: pointer to the file to be measured (May be NULL) - * @prot: contains the protection that will be applied by the kernel. + * @reqprot: protection requested by the application + * @prot: protection that will be applied by the kernel + * @flags: operational flags * * Measure files being mmapped executable based on the ima_must_measure() * policy decision. @@ -405,7 +407,8 @@ out: * On success return 0. On integrity appraisal error, assuming the file * is in policy and IMA-appraisal is in enforcing mode, return -EACCES. */ -int ima_file_mmap(struct file *file, unsigned long prot) +int ima_file_mmap(struct file *file, unsigned long reqprot, + unsigned long prot, unsigned long flags) { u32 secid;
--- a/security/security.c +++ b/security/security.c @@ -1661,12 +1661,13 @@ static inline unsigned long mmap_prot(st int security_mmap_file(struct file *file, unsigned long prot, unsigned long flags) { + unsigned long prot_adj = mmap_prot(file, prot); int ret; - ret = call_int_hook(mmap_file, 0, file, prot, - mmap_prot(file, prot), flags); + + ret = call_int_hook(mmap_file, 0, file, prot, prot_adj, flags); if (ret) return ret; - return ima_file_mmap(file, prot); + return ima_file_mmap(file, prot, prot_adj, flags); }
int security_mmap_addr(unsigned long addr)
From: Pali Rohár pali@kernel.org
commit ff7c76f66d8bad4e694c264c789249e1d3a8205d upstream.
When CONFIG_TARGET_CPU is specified then pass its value to the compiler -mcpu option. This fixes following build error when building kernel with powerpc e500 SPE capable cross compilers:
BOOTAS arch/powerpc/boot/crt0.o powerpc-linux-gnuspe-gcc: error: unrecognized argument in option ‘-mcpu=powerpc’ powerpc-linux-gnuspe-gcc: note: valid arguments to ‘-mcpu=’ are: 8540 8548 native make[1]: *** [arch/powerpc/boot/Makefile:231: arch/powerpc/boot/crt0.o] Error 1
Similar change was already introduced for the main powerpc Makefile in commit 446cda1b21d9 ("powerpc/32: Don't always pass -mcpu=powerpc to the compiler").
Fixes: 40a75584e526 ("powerpc/boot: Build wrapper for an appropriate CPU") Cc: stable@vger.kernel.org # v5.19+ Signed-off-by: Pali Rohár pali@kernel.org Signed-off-by: Christophe Leroy christophe.leroy@csgroup.eu Signed-off-by: Michael Ellerman mpe@ellerman.id.au Link: https://lore.kernel.org/r/2ae3ae5887babfdacc34435bff0944b3f336100a.167463232... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/powerpc/boot/Makefile | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
--- a/arch/powerpc/boot/Makefile +++ b/arch/powerpc/boot/Makefile @@ -39,13 +39,19 @@ BOOTCFLAGS := -Wall -Wundef -Wstrict- $(LINUXINCLUDE)
ifdef CONFIG_PPC64_BOOT_WRAPPER -ifdef CONFIG_CPU_LITTLE_ENDIAN -BOOTCFLAGS += -m64 -mcpu=powerpc64le +BOOTCFLAGS += -m64 else -BOOTCFLAGS += -m64 -mcpu=powerpc64 +BOOTCFLAGS += -m32 endif + +ifdef CONFIG_TARGET_CPU_BOOL +BOOTCFLAGS += -mcpu=$(CONFIG_TARGET_CPU) +else ifdef CONFIG_PPC64_BOOT_WRAPPER +ifdef CONFIG_CPU_LITTLE_ENDIAN +BOOTCFLAGS += -mcpu=powerpc64le else -BOOTCFLAGS += -m32 -mcpu=powerpc +BOOTCFLAGS += -mcpu=powerpc64 +endif endif
BOOTCFLAGS += -isystem $(shell $(BOOTCC) -print-file-name=include)
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 4f11410bf6da87defe8fd59b0413f0d9f71744da upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Acked-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Michael Ellerman mpe@ellerman.id.au Link: https://lore.kernel.org/r/20230127135755.79929-22-mathieu.desnoyers@efficios... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/powerpc/ptrace/Makefile | 2 +- tools/testing/selftests/powerpc/security/Makefile | 2 +- tools/testing/selftests/powerpc/syscalls/Makefile | 2 +- tools/testing/selftests/powerpc/tm/Makefile | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-)
--- a/tools/testing/selftests/powerpc/ptrace/Makefile +++ b/tools/testing/selftests/powerpc/ptrace/Makefile @@ -33,7 +33,7 @@ TESTS_64 := $(patsubst %,$(OUTPUT)/%,$(T $(TESTS_64): CFLAGS += -m64 $(TM_TESTS): CFLAGS += -I../tm -mhtm
-CFLAGS += -I../../../../../usr/include -fno-pie +CFLAGS += $(KHDR_INCLUDES) -fno-pie
$(OUTPUT)/ptrace-gpr: ptrace-gpr.S $(OUTPUT)/ptrace-pkey $(OUTPUT)/core-pkey: LDLIBS += -pthread --- a/tools/testing/selftests/powerpc/security/Makefile +++ b/tools/testing/selftests/powerpc/security/Makefile @@ -5,7 +5,7 @@ TEST_PROGS := mitigation-patching.sh
top_srcdir = ../../../../..
-CFLAGS += -I../../../../../usr/include +CFLAGS += $(KHDR_INCLUDES)
include ../../lib.mk
--- a/tools/testing/selftests/powerpc/syscalls/Makefile +++ b/tools/testing/selftests/powerpc/syscalls/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0-only TEST_GEN_PROGS := ipc_unmuxed rtas_filter
-CFLAGS += -I../../../../../usr/include +CFLAGS += $(KHDR_INCLUDES)
top_srcdir = ../../../../.. include ../../lib.mk --- a/tools/testing/selftests/powerpc/tm/Makefile +++ b/tools/testing/selftests/powerpc/tm/Makefile @@ -17,7 +17,7 @@ $(TEST_GEN_PROGS): ../harness.c ../utils CFLAGS += -mhtm
$(OUTPUT)/tm-syscall: tm-syscall-asm.S -$(OUTPUT)/tm-syscall: CFLAGS += -I../../../../../usr/include +$(OUTPUT)/tm-syscall: CFLAGS += $(KHDR_INCLUDES) $(OUTPUT)/tm-tmspr: CFLAGS += -pthread $(OUTPUT)/tm-vmx-unavail: CFLAGS += -pthread -m64 $(OUTPUT)/tm-resched-dscr: ../pmu/lib.c
From: Masami Hiramatsu (Google) mhiramat@kernel.org
commit a457e944df92789ab31aaf35fae9db064e3c51c4 upstream.
Fix eprobe syntax test case to check whether the kernel supports the filter on eprobe for filter syntax test command. Without this fix, this test case will fail if the kernel supports eprobe but doesn't support the filter on eprobe.
Link: https://lore.kernel.org/all/167309834742.640500.379128668288448035.stgit@dev...
Fixes: 9e14bae7d049 ("selftests/ftrace: Add eprobe syntax error testcase") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Reviewed-by: Steven Rostedt (Google) rostedt@goodmis.org Acked-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
--- a/tools/testing/selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc +++ b/tools/testing/selftests/ftrace/test.d/dynevent/eprobes_syntax_errors.tc @@ -22,6 +22,8 @@ check_error 'e:foo/^bar.1 syscalls/sys_e check_error 'e:foo/bar syscalls/sys_enter_openat arg=^dfd' # BAD_FETCH_ARG check_error 'e:foo/bar syscalls/sys_enter_openat ^arg=$foo' # BAD_ATTACH_ARG
-check_error 'e:foo/bar syscalls/sys_enter_openat if ^' # NO_EP_FILTER +if grep -q '<attached-group>.<attached-event>.*[if <filter>]' README; then + check_error 'e:foo/bar syscalls/sys_enter_openat if ^' # NO_EP_FILTER +fi
exit 0
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 0d2cace5af50806a6b32ab73d367b80e46acda0f upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/sched/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/sched/Makefile +++ b/tools/testing/selftests/sched/Makefile @@ -4,7 +4,7 @@ ifneq ($(shell $(CC) --version 2>&1 | he CLANG_FLAGS += -no-integrated-as endif
-CFLAGS += -O2 -Wall -g -I./ -I../../../../usr/include/ -Wl,-rpath=./ \ +CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) -Wl,-rpath=./ \ $(CLANG_FLAGS) LDLIBS += -lpthread
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 145df2fdc38f24b3e52e4c2a59b02d874a074fbd upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/core/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/core/Makefile +++ b/tools/testing/selftests/core/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only -CFLAGS += -g -I../../../../usr/include/ +CFLAGS += -g $(KHDR_INCLUDES)
TEST_GEN_PROGS := close_range_test
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit e81ff69f66969a16a98a2e0977c1860f1c182c74 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/pid_namespace/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/pid_namespace/Makefile +++ b/tools/testing/selftests/pid_namespace/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 -CFLAGS += -g -I../../../../usr/include/ +CFLAGS += -g $(KHDR_INCLUDES)
TEST_GEN_PROGS = regression_enomem
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 7482c19173b7eb044d476b3444d7ee55bc669d03 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Acked-by: Shuah Khan skhan@linuxfoundation.org Acked-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/arm64/fp/Makefile | 2 +- tools/testing/selftests/arm64/tags/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
--- a/tools/testing/selftests/arm64/fp/Makefile +++ b/tools/testing/selftests/arm64/fp/Makefile @@ -3,7 +3,7 @@ # A proper top_srcdir is needed by KSFT(lib.mk) top_srcdir = $(realpath ../../../../../)
-CFLAGS += -I$(top_srcdir)/usr/include/ +CFLAGS += $(KHDR_INCLUDES)
TEST_GEN_PROGS := fp-stress \ sve-ptrace sve-probe-vls \ --- a/tools/testing/selftests/arm64/tags/Makefile +++ b/tools/testing/selftests/arm64/tags/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0
-CFLAGS += -I../../../../../usr/include/ +CFLAGS += $(KHDR_INCLUDES) TEST_GEN_PROGS := tags_test TEST_PROGS := run_tags_test.sh
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 612cf4d283414a5ee2733db6608d917deb45fa46 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Acked-by: Shuah Khan skhan@linuxfoundation.org Acked-by: Christian Brauner brauner@kernel.org Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/clone3/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/clone3/Makefile +++ b/tools/testing/selftests/clone3/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 -CFLAGS += -g -std=gnu99 -I../../../../usr/include/ +CFLAGS += -g -std=gnu99 $(KHDR_INCLUDES) LDLIBS += -lcap
TEST_GEN_PROGS := clone3 clone3_clear_sighand clone3_set_tid \
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 3f7d71768795c386019f2295c1986d00035c9f0f upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/pidfd/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/pidfd/Makefile +++ b/tools/testing/selftests/pidfd/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only -CFLAGS += -g -I../../../../usr/include/ -pthread -Wall +CFLAGS += -g $(KHDR_INCLUDES) -pthread -Wall
TEST_GEN_PROGS := pidfd_test pidfd_fdinfo_test pidfd_open_test \ pidfd_poll_test pidfd_wait pidfd_getfd_test pidfd_setns_test
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 498bb027726371ba4a94686d251f9be1d437573e upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/membarrier/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/membarrier/Makefile +++ b/tools/testing/selftests/membarrier/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only -CFLAGS += -g -I../../../../usr/include/ +CFLAGS += -g $(KHDR_INCLUDES) LDLIBS += -lpthread
TEST_GEN_PROGS := membarrier_test_single_thread \
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 5d74231a2caad259f6669d8d6112814cef6bcd60 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/kcmp/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/kcmp/Makefile +++ b/tools/testing/selftests/kcmp/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only -CFLAGS += -I../../../../usr/include/ +CFLAGS += $(KHDR_INCLUDES)
TEST_GEN_PROGS := kcmp_test
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit f2f9592b736087f695230410fb8dc1afd3cafbbb upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/media_tests/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/media_tests/Makefile +++ b/tools/testing/selftests/media_tests/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 # -CFLAGS += -I../ -I../../../../usr/include/ +CFLAGS += -I../ $(KHDR_INCLUDES) TEST_GEN_PROGS := media_device_test media_device_open video_device_test
include ../lib.mk
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 8bb9c1808628babcc7b99ec2439bf102379bd4ac upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/gpio/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/gpio/Makefile +++ b/tools/testing/selftests/gpio/Makefile @@ -3,6 +3,6 @@ TEST_PROGS := gpio-mockup.sh gpio-sim.sh TEST_FILES := gpio-mockup-sysfs.sh TEST_GEN_PROGS_EXTENDED := gpio-mockup-cdev gpio-chip-info gpio-line-name -CFLAGS += -O2 -g -Wall -I../../../../usr/include/ $(KHDR_INCLUDES) +CFLAGS += -O2 -g -Wall $(KHDR_INCLUDES)
include ../lib.mk
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit c2d3cf3653a8ff6e4b402d55e7f84790ac08a8ad upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/filesystems/Makefile | 2 +- tools/testing/selftests/filesystems/binderfs/Makefile | 2 +- tools/testing/selftests/filesystems/epoll/Makefile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
--- a/tools/testing/selftests/filesystems/Makefile +++ b/tools/testing/selftests/filesystems/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0
-CFLAGS += -I../../../../usr/include/ +CFLAGS += $(KHDR_INCLUDES) TEST_GEN_PROGS := devpts_pts TEST_GEN_PROGS_EXTENDED := dnotify_test
--- a/tools/testing/selftests/filesystems/binderfs/Makefile +++ b/tools/testing/selftests/filesystems/binderfs/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0
-CFLAGS += -I../../../../../usr/include/ -pthread +CFLAGS += $(KHDR_INCLUDES) -pthread TEST_GEN_PROGS := binderfs_test
binderfs_test: binderfs_test.c ../../kselftest.h ../../kselftest_harness.h --- a/tools/testing/selftests/filesystems/epoll/Makefile +++ b/tools/testing/selftests/filesystems/epoll/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0
-CFLAGS += -I../../../../../usr/include/ +CFLAGS += $(KHDR_INCLUDES) LDLIBS += -lpthread TEST_GEN_PROGS := epoll_wakeup_test
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit f3886fd28987c119a98493f625cb9940b5f1c9a0 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/user_events/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/user_events/Makefile +++ b/tools/testing/selftests/user_events/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 -CFLAGS += -Wl,-no-as-needed -Wall -I../../../../usr/include +CFLAGS += -Wl,-no-as-needed -Wall $(KHDR_INCLUDES) LDLIBS += -lrt -lpthread -lm
TEST_GEN_PROGS = ftrace_test dyn_test perf_test
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 01ede99e9de16e7a1ed689c99f41022aa878f2f4 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/ptp/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/ptp/Makefile +++ b/tools/testing/selftests/ptp/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 -CFLAGS += -I../../../../usr/include/ +CFLAGS += $(KHDR_INCLUDES) TEST_PROGS := testptp LDLIBS += -lrt all: $(TEST_PROGS)
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 5ad0c8e42c13623bd996e19ce76f2596e16eb0db upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Acked-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/sync/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/sync/Makefile +++ b/tools/testing/selftests/sync/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 CFLAGS += -O2 -g -std=gnu89 -pthread -Wall -Wextra -CFLAGS += -I../../../../usr/include/ +CFLAGS += $(KHDR_INCLUDES) LDFLAGS += -pthread
.PHONY: all clean
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 2279bfc03211045c8f43a76b01889a5ca86acd5a upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/rseq/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/rseq/Makefile +++ b/tools/testing/selftests/rseq/Makefile @@ -4,7 +4,7 @@ ifneq ($(shell $(CC) --version 2>&1 | he CLANG_FLAGS += -no-integrated-as endif
-CFLAGS += -O2 -Wall -g -I./ -I../../../../usr/include/ -L$(OUTPUT) -Wl,-rpath=./ \ +CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) -L$(OUTPUT) -Wl,-rpath=./ \ $(CLANG_FLAGS) LDLIBS += -lpthread -ldl
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 65c68af0131bfef8e395c325735b6c40638cb931 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/move_mount_set_group/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/move_mount_set_group/Makefile +++ b/tools/testing/selftests/move_mount_set_group/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 # Makefile for mount selftests. -CFLAGS = -g -I../../../../usr/include/ -Wall -O2 +CFLAGS = -g $(KHDR_INCLUDES) -Wall -O2
TEST_GEN_FILES += move_mount_set_group_test
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 5d11f2d0eb39d2b5c5e8f05e1f650c4a4de69918 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/mount_setattr/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/mount_setattr/Makefile +++ b/tools/testing/selftests/mount_setattr/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 # Makefile for mount selftests. -CFLAGS = -g -I../../../../usr/include/ -Wall -O2 -pthread +CFLAGS = -g $(KHDR_INCLUDES) -Wall -O2 -pthread
TEST_GEN_FILES += mount_setattr_test
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 465cbb1b9a9fd5f6907adb2d761facaf1a46bfbe upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/perf_events/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/perf_events/Makefile +++ b/tools/testing/selftests/perf_events/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 -CFLAGS += -Wl,-no-as-needed -Wall -I../../../../usr/include +CFLAGS += -Wl,-no-as-needed -Wall $(KHDR_INCLUDES) LDFLAGS += -lpthread
TEST_GEN_PROGS := sigtrap_threads remove_on_exec
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit ecf9fdb5c2a9d63c732acccb6318feb73dd1589f upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/ipc/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/ipc/Makefile +++ b/tools/testing/selftests/ipc/Makefile @@ -10,7 +10,7 @@ ifeq ($(ARCH),x86_64) CFLAGS := -DCONFIG_X86_64 -D__x86_64__ endif
-CFLAGS += -I../../../../usr/include/ +CFLAGS += $(KHDR_INCLUDES)
TEST_GEN_PROGS := msgque
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 24c55275ba0d538def2b1220002d0e808a85d50f upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/futex/functional/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/futex/functional/Makefile +++ b/tools/testing/selftests/futex/functional/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 -INCLUDES := -I../include -I../../ -I../../../../../usr/include/ +INCLUDES := -I../include -I../../ $(KHDR_INCLUDES) CFLAGS := $(CFLAGS) -g -O2 -Wall -D_GNU_SOURCE -pthread $(INCLUDES) $(KHDR_INCLUDES) LDLIBS := -lpthread -lrt
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 07f0148aafe8c95a3a76cd59e9e75b4d78d1d31d upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/drivers/dma-buf/Makefile | 2 +- tools/testing/selftests/drivers/s390x/uvdevice/Makefile | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
--- a/tools/testing/selftests/drivers/dma-buf/Makefile +++ b/tools/testing/selftests/drivers/dma-buf/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only -CFLAGS += -I../../../../../usr/include/ +CFLAGS += $(KHDR_INCLUDES)
TEST_GEN_PROGS := udmabuf
--- a/tools/testing/selftests/drivers/s390x/uvdevice/Makefile +++ b/tools/testing/selftests/drivers/s390x/uvdevice/Makefile @@ -11,10 +11,9 @@ else TEST_GEN_PROGS := test_uvdevice
top_srcdir ?= ../../../../../.. -khdr_dir = $(top_srcdir)/usr/include LINUX_TOOL_ARCH_INCLUDE = $(top_srcdir)/tools/arch/$(ARCH)/include
-CFLAGS += -Wall -Werror -static -I$(khdr_dir) -I$(LINUX_TOOL_ARCH_INCLUDE) +CFLAGS += -Wall -Werror -static $(KHDR_INCLUDES) -I$(LINUX_TOOL_ARCH_INCLUDE)
include ../../../lib.mk
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit f80f09b59fdd45753dd80ac623981ad00ece4c2d upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/dmabuf-heaps/Makefile | 2 +- tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
--- a/tools/testing/selftests/dmabuf-heaps/Makefile +++ b/tools/testing/selftests/dmabuf-heaps/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 -CFLAGS += -static -O3 -Wl,-no-as-needed -Wall +CFLAGS += -static -O3 -Wl,-no-as-needed -Wall $(KHDR_INCLUDES)
TEST_GEN_PROGS = dmabuf-heap
--- a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c +++ b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c @@ -13,10 +13,9 @@ #include <sys/types.h>
#include <linux/dma-buf.h> +#include <linux/dma-heap.h> #include <drm/drm.h>
-#include "../../../../include/uapi/linux/dma-heap.h" - #define DEVPATH "/dev/dma_heap"
static int check_vgem(int fd)
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 8eb3751c73bec746f61fb6bada60d1074d92b8c3 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/vm/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/vm/Makefile +++ b/tools/testing/selftests/vm/Makefile @@ -25,7 +25,7 @@ MACHINE ?= $(shell echo $(uname_M) | sed # LDLIBS. MAKEFLAGS += --no-builtin-rules
-CFLAGS = -Wall -I $(top_srcdir) -I $(top_srcdir)/usr/include $(EXTRA_CFLAGS) $(KHDR_INCLUDES) +CFLAGS = -Wall -I $(top_srcdir) $(EXTRA_CFLAGS) $(KHDR_INCLUDES) LDLIBS = -lrt -lpthread TEST_GEN_FILES = cow TEST_GEN_FILES += compaction_test
From: Mathieu Desnoyers mathieu.desnoyers@efficios.com
commit 07d42dd854446ba3177ad7a217870a5b4edee165 upstream.
Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...).
Signed-off-by: Mathieu Desnoyers mathieu.desnoyers@efficios.com Cc: Shuah Khan shuah@kernel.org Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar mingo@redhat.com Cc: stable@vger.kernel.org # 5.18+ Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/selftests/seccomp/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/seccomp/Makefile +++ b/tools/testing/selftests/seccomp/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 -CFLAGS += -Wl,-no-as-needed -Wall -isystem ../../../../usr/include/ +CFLAGS += -Wl,-no-as-needed -Wall $(KHDR_INCLUDES) LDFLAGS += -lpthread LDLIBS += -lcap
From: Johan Hovold johan+linaro@kernel.org
commit b06730a571a9ff1ba5bd6b20bf9e50e5a12f1ec6 upstream.
The sanity check for an already mapped virq is done outside of the irq_domain_mutex-protected section which means that an (unlikely) racing association may not be detected.
Fix this by factoring out the association implementation, which will also be used in a follow-on change to fix a shared-interrupt mapping race.
Fixes: ddaf144c61da ("irqdomain: Refactor irq_domain_associate_many()") Cc: stable@vger.kernel.org # 3.11 Tested-by: Hsin-Yi Wang hsinyi@chromium.org Tested-by: Mark-PK Tsai mark-pk.tsai@mediatek.com Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230213104302.17307-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/irq/irqdomain.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
--- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -559,8 +559,8 @@ static void irq_domain_disassociate(stru irq_domain_clear_mapping(domain, hwirq); }
-int irq_domain_associate(struct irq_domain *domain, unsigned int virq, - irq_hw_number_t hwirq) +static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq, + irq_hw_number_t hwirq) { struct irq_data *irq_data = irq_get_irq_data(virq); int ret; @@ -573,7 +573,6 @@ int irq_domain_associate(struct irq_doma if (WARN(irq_data->domain, "error: virq%i is already associated", virq)) return -EINVAL;
- mutex_lock(&irq_domain_mutex); irq_data->hwirq = hwirq; irq_data->domain = domain; if (domain->ops->map) { @@ -590,7 +589,6 @@ int irq_domain_associate(struct irq_doma } irq_data->domain = NULL; irq_data->hwirq = 0; - mutex_unlock(&irq_domain_mutex); return ret; }
@@ -601,12 +599,23 @@ int irq_domain_associate(struct irq_doma
domain->mapcount++; irq_domain_set_mapping(domain, hwirq, irq_data); - mutex_unlock(&irq_domain_mutex);
irq_clear_status_flags(virq, IRQ_NOREQUEST);
return 0; } + +int irq_domain_associate(struct irq_domain *domain, unsigned int virq, + irq_hw_number_t hwirq) +{ + int ret; + + mutex_lock(&irq_domain_mutex); + ret = irq_domain_associate_locked(domain, virq, hwirq); + mutex_unlock(&irq_domain_mutex); + + return ret; +} EXPORT_SYMBOL_GPL(irq_domain_associate);
void irq_domain_associate_many(struct irq_domain *domain, unsigned int irq_base,
From: Johan Hovold johan+linaro@kernel.org
commit 3f883c38f5628f46b30bccf090faec054088e262 upstream.
The global irq_domain_mutex is held when mapping interrupts from non-hierarchical domains but currently not when disposing them.
This specifically means that updates of the domain mapcount is racy (currently only used for statistics in debugfs).
Make sure to hold the global irq_domain_mutex also when disposing mappings from non-hierarchical domains.
Fixes: 9dc6be3d4193 ("genirq/irqdomain: Add map counter") Cc: stable@vger.kernel.org # 4.13 Tested-by: Hsin-Yi Wang hsinyi@chromium.org Tested-by: Mark-PK Tsai mark-pk.tsai@mediatek.com Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230213104302.17307-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/irq/irqdomain.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -538,6 +538,9 @@ static void irq_domain_disassociate(stru return;
hwirq = irq_data->hwirq; + + mutex_lock(&irq_domain_mutex); + irq_set_status_flags(irq, IRQ_NOREQUEST);
/* remove chip and handler */ @@ -557,6 +560,8 @@ static void irq_domain_disassociate(stru
/* Clear reverse map for this hwirq */ irq_domain_clear_mapping(domain, hwirq); + + mutex_unlock(&irq_domain_mutex); }
static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq,
From: Johan Hovold johan+linaro@kernel.org
commit 6e6f75c9c98d2d246d90411ff2b6f0cd271f4cba upstream.
Avoid looking for an existing mapping twice when creating a new mapping using irq_create_fwspec_mapping() by factoring out the actual allocation which is shared with irq_create_mapping_affinity().
The new helper function will also be used to fix a shared-interrupt mapping race, hence the Fixes tag.
Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang hsinyi@chromium.org Tested-by: Mark-PK Tsai mark-pk.tsai@mediatek.com Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230213104302.17307-5-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/irq/irqdomain.c | 60 ++++++++++++++++++++++++++----------------------- 1 file changed, 33 insertions(+), 27 deletions(-)
--- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -682,6 +682,34 @@ unsigned int irq_create_direct_mapping(s EXPORT_SYMBOL_GPL(irq_create_direct_mapping); #endif
+static unsigned int __irq_create_mapping_affinity(struct irq_domain *domain, + irq_hw_number_t hwirq, + const struct irq_affinity_desc *affinity) +{ + struct device_node *of_node = irq_domain_get_of_node(domain); + int virq; + + pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq); + + /* Allocate a virtual interrupt number */ + virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node), + affinity); + if (virq <= 0) { + pr_debug("-> virq allocation failed\n"); + return 0; + } + + if (irq_domain_associate(domain, virq, hwirq)) { + irq_free_desc(virq); + return 0; + } + + pr_debug("irq %lu on domain %s mapped to virtual irq %u\n", + hwirq, of_node_full_name(of_node), virq); + + return virq; +} + /** * irq_create_mapping_affinity() - Map a hardware interrupt into linux irq space * @domain: domain owning this hardware interrupt or NULL for default domain @@ -694,14 +722,11 @@ EXPORT_SYMBOL_GPL(irq_create_direct_mapp * on the number returned from that call. */ unsigned int irq_create_mapping_affinity(struct irq_domain *domain, - irq_hw_number_t hwirq, - const struct irq_affinity_desc *affinity) + irq_hw_number_t hwirq, + const struct irq_affinity_desc *affinity) { - struct device_node *of_node; int virq;
- pr_debug("irq_create_mapping(0x%p, 0x%lx)\n", domain, hwirq); - /* Look for default domain if necessary */ if (domain == NULL) domain = irq_default_domain; @@ -709,34 +734,15 @@ unsigned int irq_create_mapping_affinity WARN(1, "%s(, %lx) called with NULL domain\n", __func__, hwirq); return 0; } - pr_debug("-> using domain @%p\n", domain); - - of_node = irq_domain_get_of_node(domain);
/* Check if mapping already exists */ virq = irq_find_mapping(domain, hwirq); if (virq) { - pr_debug("-> existing mapping on virq %d\n", virq); + pr_debug("existing mapping on virq %d\n", virq); return virq; }
- /* Allocate a virtual interrupt number */ - virq = irq_domain_alloc_descs(-1, 1, hwirq, of_node_to_nid(of_node), - affinity); - if (virq <= 0) { - pr_debug("-> virq allocation failed\n"); - return 0; - } - - if (irq_domain_associate(domain, virq, hwirq)) { - irq_free_desc(virq); - return 0; - } - - pr_debug("irq %lu on domain %s mapped to virtual irq %u\n", - hwirq, of_node_full_name(of_node), virq); - - return virq; + return __irq_create_mapping_affinity(domain, hwirq, affinity); } EXPORT_SYMBOL_GPL(irq_create_mapping_affinity);
@@ -841,7 +847,7 @@ unsigned int irq_create_fwspec_mapping(s return 0; } else { /* Create mapping */ - virq = irq_create_mapping(domain, hwirq); + virq = __irq_create_mapping_affinity(domain, hwirq, NULL); if (!virq) return virq; }
From: Johan Hovold johan+linaro@kernel.org
commit e3b7ab025e931accdc2c12acf9b75c6197f1c062 upstream.
In case a newly allocated IRQ ever ends up not having any associated struct irq_data it would not even be possible to dispose the mapping.
Replace the bogus disposal with a WARN_ON().
This will also be used to fix a shared-interrupt mapping race, hence the CC-stable tag.
Fixes: 1e2a7d78499e ("irqdomain: Don't set type when mapping an IRQ") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang hsinyi@chromium.org Tested-by: Mark-PK Tsai mark-pk.tsai@mediatek.com Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230213104302.17307-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/irq/irqdomain.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
--- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -853,13 +853,8 @@ unsigned int irq_create_fwspec_mapping(s }
irq_data = irq_get_irq_data(virq); - if (!irq_data) { - if (irq_domain_is_hierarchy(domain)) - irq_domain_free_irqs(virq, 1); - else - irq_dispose_mapping(virq); + if (WARN_ON(!irq_data)) return 0; - }
/* Store trigger type */ irqd_set_trigger_type(irq_data, type);
From: Johan Hovold johan+linaro@kernel.org
commit d55f7f4c58c07beb5050a834bf57ae2ede599c7e upstream.
Refactor __irq_domain_alloc_irqs() so that it can be called internally while holding the irq_domain_mutex.
This will be used to fix a shared-interrupt mapping race, hence the Fixes tag.
Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang hsinyi@chromium.org Tested-by: Mark-PK Tsai mark-pk.tsai@mediatek.com Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230213104302.17307-6-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/irq/irqdomain.c | 88 ++++++++++++++++++++++++++----------------------- 1 file changed, 48 insertions(+), 40 deletions(-)
--- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -1441,40 +1441,12 @@ int irq_domain_alloc_irqs_hierarchy(stru return domain->ops->alloc(domain, irq_base, nr_irqs, arg); }
-/** - * __irq_domain_alloc_irqs - Allocate IRQs from domain - * @domain: domain to allocate from - * @irq_base: allocate specified IRQ number if irq_base >= 0 - * @nr_irqs: number of IRQs to allocate - * @node: NUMA node id for memory allocation - * @arg: domain specific argument - * @realloc: IRQ descriptors have already been allocated if true - * @affinity: Optional irq affinity mask for multiqueue devices - * - * Allocate IRQ numbers and initialized all data structures to support - * hierarchy IRQ domains. - * Parameter @realloc is mainly to support legacy IRQs. - * Returns error code or allocated IRQ number - * - * The whole process to setup an IRQ has been split into two steps. - * The first step, __irq_domain_alloc_irqs(), is to allocate IRQ - * descriptor and required hardware resources. The second step, - * irq_domain_activate_irq(), is to program the hardware with preallocated - * resources. In this way, it's easier to rollback when failing to - * allocate resources. - */ -int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base, - unsigned int nr_irqs, int node, void *arg, - bool realloc, const struct irq_affinity_desc *affinity) +static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base, + unsigned int nr_irqs, int node, void *arg, + bool realloc, const struct irq_affinity_desc *affinity) { int i, ret, virq;
- if (domain == NULL) { - domain = irq_default_domain; - if (WARN(!domain, "domain is NULL; cannot allocate IRQ\n")) - return -EINVAL; - } - if (realloc && irq_base >= 0) { virq = irq_base; } else { @@ -1493,24 +1465,18 @@ int __irq_domain_alloc_irqs(struct irq_d goto out_free_desc; }
- mutex_lock(&irq_domain_mutex); ret = irq_domain_alloc_irqs_hierarchy(domain, virq, nr_irqs, arg); - if (ret < 0) { - mutex_unlock(&irq_domain_mutex); + if (ret < 0) goto out_free_irq_data; - }
for (i = 0; i < nr_irqs; i++) { ret = irq_domain_trim_hierarchy(virq + i); - if (ret) { - mutex_unlock(&irq_domain_mutex); + if (ret) goto out_free_irq_data; - } } - + for (i = 0; i < nr_irqs; i++) irq_domain_insert_irq(virq + i); - mutex_unlock(&irq_domain_mutex);
return virq;
@@ -1520,6 +1486,48 @@ out_free_desc: irq_free_descs(virq, nr_irqs); return ret; } + +/** + * __irq_domain_alloc_irqs - Allocate IRQs from domain + * @domain: domain to allocate from + * @irq_base: allocate specified IRQ number if irq_base >= 0 + * @nr_irqs: number of IRQs to allocate + * @node: NUMA node id for memory allocation + * @arg: domain specific argument + * @realloc: IRQ descriptors have already been allocated if true + * @affinity: Optional irq affinity mask for multiqueue devices + * + * Allocate IRQ numbers and initialized all data structures to support + * hierarchy IRQ domains. + * Parameter @realloc is mainly to support legacy IRQs. + * Returns error code or allocated IRQ number + * + * The whole process to setup an IRQ has been split into two steps. + * The first step, __irq_domain_alloc_irqs(), is to allocate IRQ + * descriptor and required hardware resources. The second step, + * irq_domain_activate_irq(), is to program the hardware with preallocated + * resources. In this way, it's easier to rollback when failing to + * allocate resources. + */ +int __irq_domain_alloc_irqs(struct irq_domain *domain, int irq_base, + unsigned int nr_irqs, int node, void *arg, + bool realloc, const struct irq_affinity_desc *affinity) +{ + int ret; + + if (domain == NULL) { + domain = irq_default_domain; + if (WARN(!domain, "domain is NULL; cannot allocate IRQ\n")) + return -EINVAL; + } + + mutex_lock(&irq_domain_mutex); + ret = irq_domain_alloc_irqs_locked(domain, irq_base, nr_irqs, node, arg, + realloc, affinity); + mutex_unlock(&irq_domain_mutex); + + return ret; +} EXPORT_SYMBOL_GPL(__irq_domain_alloc_irqs);
/* The irq_data was moved, fix the revmap to refer to the new location */
From: Johan Hovold johan+linaro@kernel.org
commit 601363cc08da25747feb87c55573dd54de91d66a upstream.
Parallel probing of devices that share interrupts (e.g. when a driver uses asynchronous probing) can currently result in two mappings for the same hardware interrupt to be created due to missing serialisation.
Make sure to hold the irq_domain_mutex when creating mappings so that looking for an existing mapping before creating a new one is done atomically.
Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers") Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") Link: https://lore.kernel.org/r/YuJXMHoT4ijUxnRb@hovoldconsulting.com Cc: stable@vger.kernel.org # 4.8 Cc: Dmitry Torokhov dtor@chromium.org Cc: Jon Hunter jonathanh@nvidia.com Tested-by: Hsin-Yi Wang hsinyi@chromium.org Tested-by: Mark-PK Tsai mark-pk.tsai@mediatek.com Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230213104302.17307-7-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/irq/irqdomain.c | 64 +++++++++++++++++++++++++++++++++++-------------- 1 file changed, 46 insertions(+), 18 deletions(-)
--- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -25,6 +25,9 @@ static DEFINE_MUTEX(irq_domain_mutex);
static struct irq_domain *irq_default_domain;
+static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base, + unsigned int nr_irqs, int node, void *arg, + bool realloc, const struct irq_affinity_desc *affinity); static void irq_domain_check_hierarchy(struct irq_domain *domain);
struct irqchip_fwid { @@ -682,9 +685,9 @@ unsigned int irq_create_direct_mapping(s EXPORT_SYMBOL_GPL(irq_create_direct_mapping); #endif
-static unsigned int __irq_create_mapping_affinity(struct irq_domain *domain, - irq_hw_number_t hwirq, - const struct irq_affinity_desc *affinity) +static unsigned int irq_create_mapping_affinity_locked(struct irq_domain *domain, + irq_hw_number_t hwirq, + const struct irq_affinity_desc *affinity) { struct device_node *of_node = irq_domain_get_of_node(domain); int virq; @@ -699,7 +702,7 @@ static unsigned int __irq_create_mapping return 0; }
- if (irq_domain_associate(domain, virq, hwirq)) { + if (irq_domain_associate_locked(domain, virq, hwirq)) { irq_free_desc(virq); return 0; } @@ -735,14 +738,20 @@ unsigned int irq_create_mapping_affinity return 0; }
+ mutex_lock(&irq_domain_mutex); + /* Check if mapping already exists */ virq = irq_find_mapping(domain, hwirq); if (virq) { pr_debug("existing mapping on virq %d\n", virq); - return virq; + goto out; }
- return __irq_create_mapping_affinity(domain, hwirq, affinity); + virq = irq_create_mapping_affinity_locked(domain, hwirq, affinity); +out: + mutex_unlock(&irq_domain_mutex); + + return virq; } EXPORT_SYMBOL_GPL(irq_create_mapping_affinity);
@@ -809,6 +818,8 @@ unsigned int irq_create_fwspec_mapping(s if (WARN_ON(type & ~IRQ_TYPE_SENSE_MASK)) type &= IRQ_TYPE_SENSE_MASK;
+ mutex_lock(&irq_domain_mutex); + /* * If we've already configured this interrupt, * don't do it again, or hell will break loose. @@ -821,7 +832,7 @@ unsigned int irq_create_fwspec_mapping(s * interrupt number. */ if (type == IRQ_TYPE_NONE || type == irq_get_trigger_type(virq)) - return virq; + goto out;
/* * If the trigger type has not been set yet, then set @@ -829,35 +840,45 @@ unsigned int irq_create_fwspec_mapping(s */ if (irq_get_trigger_type(virq) == IRQ_TYPE_NONE) { irq_data = irq_get_irq_data(virq); - if (!irq_data) - return 0; + if (!irq_data) { + virq = 0; + goto out; + }
irqd_set_trigger_type(irq_data, type); - return virq; + goto out; }
pr_warn("type mismatch, failed to map hwirq-%lu for %s!\n", hwirq, of_node_full_name(to_of_node(fwspec->fwnode))); - return 0; + virq = 0; + goto out; }
if (irq_domain_is_hierarchy(domain)) { - virq = irq_domain_alloc_irqs(domain, 1, NUMA_NO_NODE, fwspec); - if (virq <= 0) - return 0; + virq = irq_domain_alloc_irqs_locked(domain, -1, 1, NUMA_NO_NODE, + fwspec, false, NULL); + if (virq <= 0) { + virq = 0; + goto out; + } } else { /* Create mapping */ - virq = __irq_create_mapping_affinity(domain, hwirq, NULL); + virq = irq_create_mapping_affinity_locked(domain, hwirq, NULL); if (!virq) - return virq; + goto out; }
irq_data = irq_get_irq_data(virq); - if (WARN_ON(!irq_data)) - return 0; + if (WARN_ON(!irq_data)) { + virq = 0; + goto out; + }
/* Store trigger type */ irqd_set_trigger_type(irq_data, type); +out: + mutex_unlock(&irq_domain_mutex);
return virq; } @@ -1888,6 +1909,13 @@ void irq_domain_set_info(struct irq_doma irq_set_handler_data(virq, handler_data); }
+static int irq_domain_alloc_irqs_locked(struct irq_domain *domain, int irq_base, + unsigned int nr_irqs, int node, void *arg, + bool realloc, const struct irq_affinity_desc *affinity) +{ + return -EINVAL; +} + static void irq_domain_check_hierarchy(struct irq_domain *domain) { }
From: Marc Zyngier maz@kernel.org
commit 8932c32c3053accd50702b36e944ac2016cd103c upstream.
Hierarchical domains created using irq_domain_create_hierarchy() are currently added to the domain list before having been fully initialised.
This specifically means that a racing allocation request might fail to allocate irq data for the inner domains of a hierarchy in case the parent domain pointer has not yet been set up.
Note that this is not really any issue for irqchip drivers that are registered early (e.g. via IRQCHIP_DECLARE() or IRQCHIP_ACPI_DECLARE()) but could potentially cause trouble with drivers that are registered later (e.g. modular drivers using IRQCHIP_PLATFORM_DRIVER_BEGIN(), gpiochip drivers, etc.).
Fixes: afb7da83b9f4 ("irqdomain: Introduce helper function irq_domain_add_hierarchy()") Cc: stable@vger.kernel.org # 3.19 Signed-off-by: Marc Zyngier maz@kernel.org [ johan: add commit message ] Signed-off-by: Johan Hovold johan+linaro@kernel.org Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230213104302.17307-8-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/irq/irqdomain.c | 62 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 43 insertions(+), 19 deletions(-)
--- a/kernel/irq/irqdomain.c +++ b/kernel/irq/irqdomain.c @@ -126,23 +126,12 @@ void irq_domain_free_fwnode(struct fwnod } EXPORT_SYMBOL_GPL(irq_domain_free_fwnode);
-/** - * __irq_domain_add() - Allocate a new irq_domain data structure - * @fwnode: firmware node for the interrupt controller - * @size: Size of linear map; 0 for radix mapping only - * @hwirq_max: Maximum number of interrupts supported by controller - * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no - * direct mapping - * @ops: domain callbacks - * @host_data: Controller private data pointer - * - * Allocates and initializes an irq_domain structure. - * Returns pointer to IRQ domain, or NULL on failure. - */ -struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, - irq_hw_number_t hwirq_max, int direct_max, - const struct irq_domain_ops *ops, - void *host_data) +static struct irq_domain *__irq_domain_create(struct fwnode_handle *fwnode, + unsigned int size, + irq_hw_number_t hwirq_max, + int direct_max, + const struct irq_domain_ops *ops, + void *host_data) { struct irqchip_fwid *fwid; struct irq_domain *domain; @@ -230,12 +219,44 @@ struct irq_domain *__irq_domain_add(stru
irq_domain_check_hierarchy(domain);
+ return domain; +} + +static void __irq_domain_publish(struct irq_domain *domain) +{ mutex_lock(&irq_domain_mutex); debugfs_add_domain_dir(domain); list_add(&domain->link, &irq_domain_list); mutex_unlock(&irq_domain_mutex);
pr_debug("Added domain %s\n", domain->name); +} + +/** + * __irq_domain_add() - Allocate a new irq_domain data structure + * @fwnode: firmware node for the interrupt controller + * @size: Size of linear map; 0 for radix mapping only + * @hwirq_max: Maximum number of interrupts supported by controller + * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no + * direct mapping + * @ops: domain callbacks + * @host_data: Controller private data pointer + * + * Allocates and initializes an irq_domain structure. + * Returns pointer to IRQ domain, or NULL on failure. + */ +struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size, + irq_hw_number_t hwirq_max, int direct_max, + const struct irq_domain_ops *ops, + void *host_data) +{ + struct irq_domain *domain; + + domain = __irq_domain_create(fwnode, size, hwirq_max, direct_max, + ops, host_data); + if (domain) + __irq_domain_publish(domain); + return domain; } EXPORT_SYMBOL_GPL(__irq_domain_add); @@ -1138,12 +1159,15 @@ struct irq_domain *irq_domain_create_hie struct irq_domain *domain;
if (size) - domain = irq_domain_create_linear(fwnode, size, ops, host_data); + domain = __irq_domain_create(fwnode, size, size, 0, ops, host_data); else - domain = irq_domain_create_tree(fwnode, ops, host_data); + domain = __irq_domain_create(fwnode, 0, ~0, 0, ops, host_data); + if (domain) { domain->parent = parent; domain->flags |= flags; + + __irq_domain_publish(domain); }
return domain;
From: Giovanni Cabiddu giovanni.cabiddu@intel.com
commit f6044cc3030e139f60c281386f28bda6e3049d66 upstream.
When preparing an AER-CTR request, the driver copies the key provided by the user into a data structure that is accessible by the firmware. If the target device is QAT GEN4, the key size is rounded up by 16 since a rounded up size is expected by the device. If the key size is rounded up before the copy, the size used for copying the key might be bigger than the size of the region containing the key, causing an out-of-bounds read.
Fix by doing the copy first and then update the keylen.
This is to fix the following warning reported by KASAN:
[ 138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] [ 138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340
[ 138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45 [ 138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022 [ 138.150663] Call Trace: [ 138.150668] <TASK> [ 138.150922] kasan_check_range+0x13a/0x1c0 [ 138.150931] memcpy+0x1f/0x60 [ 138.150940] qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] [ 138.151006] qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat] [ 138.151073] crypto_skcipher_setkey+0x82/0x160 [ 138.151085] ? prepare_keybuf+0xa2/0xd0 [ 138.151095] test_skcipher_vec_cfg+0x2b8/0x800
Fixes: 67916c951689 ("crypto: qat - add AES-CTR support for QAT GEN4 devices") Cc: stable@vger.kernel.org Reported-by: Vladis Dronov vdronov@redhat.com Signed-off-by: Giovanni Cabiddu giovanni.cabiddu@intel.com Reviewed-by: Fiona Trahe fiona.trahe@intel.com Reviewed-by: Vladis Dronov vdronov@redhat.com Tested-by: Vladis Dronov vdronov@redhat.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/crypto/qat/qat_common/qat_algs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/qat/qat_common/qat_algs.c +++ b/drivers/crypto/qat/qat_common/qat_algs.c @@ -435,8 +435,8 @@ static void qat_alg_skcipher_init_com(st } else if (aes_v2_capable && mode == ICP_QAT_HW_CIPHER_CTR_MODE) { ICP_QAT_FW_LA_SLICE_TYPE_SET(header->serv_specif_flags, ICP_QAT_FW_LA_USE_UCS_SLICE_TYPE); - keylen = round_up(keylen, 16); memcpy(cd->ucs_aes.key, key, keylen); + keylen = round_up(keylen, 16); } else { memcpy(cd->aes.key, key, keylen); }
From: andrew.yang andrew.yang@mediatek.com
commit 3f98c9a62c338bbe06a215c9491e6166ea39bf82 upstream.
damon_get_folio() would always increase folio _refcount and folio_isolate_lru() would increase folio _refcount if the folio's lru flag is set.
If an unevictable folio isolated successfully, there will be two more _refcount. The one from folio_isolate_lru() will be decreased in folio_puback_lru(), but the other one from damon_get_folio() will be left behind. This causes a pin page.
Whatever the case, the _refcount from damon_get_folio() should be decreased.
Link: https://lkml.kernel.org/r/20230222064223.6735-1-andrew.yang@mediatek.com Fixes: 57223ac29584 ("mm/damon/paddr: support the pageout scheme") Signed-off-by: andrew.yang andrew.yang@mediatek.com Reviewed-by: SeongJae Park sj@kernel.org Cc: stable@vger.kernel.org [5.16.x] Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: SeongJae Park sj@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- mm/damon/paddr.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
--- a/mm/damon/paddr.c +++ b/mm/damon/paddr.c @@ -219,12 +219,11 @@ static unsigned long damon_pa_pageout(st put_page(page); continue; } - if (PageUnevictable(page)) { + if (PageUnevictable(page)) putback_lru_page(page); - } else { + else list_add(&page->lru, &page_list); - put_page(page); - } + put_page(page); } applied = reclaim_pages(&page_list); cond_resched();
From: Dmitry Fomin fomindmitriyfoma@mail.ru
commit 951606a14a8901e3551fe4d8d3cedd73fe954ce1 upstream.
If snd_ctl_add() fails in aureon_add_controls(), it immediately returns and leaves ice->gpio_mutex locked. ice->gpio_mutex locks in snd_ice1712_save_gpio_status and unlocks in snd_ice1712_restore_gpio_status(ice).
It seems that the mutex is required only for aureon_cs8415_get(), so snd_ice1712_restore_gpio_status(ice) can be placed just after that. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dmitry Fomin fomindmitriyfoma@mail.ru Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230225184322.6286-1-fomindmitriyfoma@mail.ru Signed-off-by: Takashi Iwai tiwai@suse.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- sound/pci/ice1712/aureon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/ice1712/aureon.c +++ b/sound/pci/ice1712/aureon.c @@ -1892,6 +1892,7 @@ static int aureon_add_controls(struct sn unsigned char id; snd_ice1712_save_gpio_status(ice); id = aureon_cs8415_get(ice, CS8415_ID); + snd_ice1712_restore_gpio_status(ice); if (id != 0x41) dev_info(ice->card->dev, "No CS8415 chip. Skipping CS8415 controls.\n"); @@ -1909,7 +1910,6 @@ static int aureon_add_controls(struct sn kctl->id.device = ice->pcm->device; } } - snd_ice1712_restore_gpio_status(ice); }
return 0;
From: Łukasz Stelmach l.stelmach@samsung.com
commit ea24b9953bcd3889f77a66e7f1d7e86e995dd9c3 upstream.
HP EliteDesk 800 G6 Tower PC (103c:870c) requires a quirk for enabling headset-mic.
Signed-off-by: Łukasz Stelmach l.stelmach@samsung.com Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=217008 Link: https://lore.kernel.org/r/20230223074749.1026060-1-l.stelmach@samsung.com Signed-off-by: Takashi Iwai tiwai@suse.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -11617,6 +11617,7 @@ static const struct snd_pci_quirk alc662 SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), + SND_PCI_QUIRK(0x103c, 0x870c, "HP", ALC897_FIXUP_HP_HSMIC_VERB), SND_PCI_QUIRK(0x103c, 0x8719, "HP", ALC897_FIXUP_HP_HSMIC_VERB), SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2), SND_PCI_QUIRK(0x103c, 0x877e, "HP 288 Pro G6", ALC671_FIXUP_HP_HEADSET_MIC2),
From: Zhihao Cheng chengzhihao1@huawei.com
commit e6b9bd7290d334451ce054e98e752abc055e0034 upstream.
Following process will make data lost and could lead to a filesystem corrupted problem:
1. jh(bh) is inserted into T1->t_checkpoint_list, bh is dirty, and jh->b_transaction = NULL 2. T1 is added into journal->j_checkpoint_transactions. 3. Get bh prepare to write while doing checkpoing: PA PB do_get_write_access jbd2_log_do_checkpoint spin_lock(&jh->b_state_lock) if (buffer_dirty(bh)) clear_buffer_dirty(bh) // clear buffer dirty set_buffer_jbddirty(bh) transaction = journal->j_checkpoint_transactions jh = transaction->t_checkpoint_list if (!buffer_dirty(bh)) __jbd2_journal_remove_checkpoint(jh) // bh won't be flushed jbd2_cleanup_journal_tail __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved) 4. Aborting journal/Power-cut before writing latest bh on journal area.
In this way we get a corrupted filesystem with bh's data lost.
Fix it by moving the clearing of buffer_dirty bit just before the call to __jbd2_journal_file_buffer(), both bit clearing and jh->b_transaction assignment are under journal->j_list_lock locked, so that jbd2_log_do_checkpoint() will wait until jh's new transaction fininshed even bh is currently not dirty. And journal_shrink_one_cp_list() won't remove jh from checkpoint list if the buffer head is reused in do_get_write_access().
Fetch a reproducer in [Link].
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216898 Cc: stable@kernel.org Signed-off-by: Zhihao Cheng chengzhihao1@huawei.com Signed-off-by: zhanchengbin zhanchengbin1@huawei.com Suggested-by: Jan Kara jack@suse.cz Reviewed-by: Jan Kara jack@suse.cz Link: https://lore.kernel.org/r/20230110015327.1181863-1-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/jbd2/transaction.c | 50 +++++++++++++++++++++++++++++--------------------- 1 file changed, 29 insertions(+), 21 deletions(-)
--- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -1010,36 +1010,28 @@ repeat: * ie. locked but not dirty) or tune2fs (which may actually have * the buffer dirtied, ugh.) */
- if (buffer_dirty(bh)) { + if (buffer_dirty(bh) && jh->b_transaction) { + warn_dirty_buffer(bh); /* - * First question: is this buffer already part of the current - * transaction or the existing committing transaction? - */ - if (jh->b_transaction) { - J_ASSERT_JH(jh, - jh->b_transaction == transaction || - jh->b_transaction == - journal->j_committing_transaction); - if (jh->b_next_transaction) - J_ASSERT_JH(jh, jh->b_next_transaction == - transaction); - warn_dirty_buffer(bh); - } - /* - * In any case we need to clean the dirty flag and we must - * do it under the buffer lock to be sure we don't race - * with running write-out. + * We need to clean the dirty flag and we must do it under the + * buffer lock to be sure we don't race with running write-out. */ JBUFFER_TRACE(jh, "Journalling dirty buffer"); clear_buffer_dirty(bh); + /* + * The buffer is going to be added to BJ_Reserved list now and + * nothing guarantees jbd2_journal_dirty_metadata() will be + * ever called for it. So we need to set jbddirty bit here to + * make sure the buffer is dirtied and written out when the + * journaling machinery is done with it. + */ set_buffer_jbddirty(bh); }
- unlock_buffer(bh); - error = -EROFS; if (is_handle_aborted(handle)) { spin_unlock(&jh->b_state_lock); + unlock_buffer(bh); goto out; } error = 0; @@ -1049,8 +1041,10 @@ repeat: * b_next_transaction points to it */ if (jh->b_transaction == transaction || - jh->b_next_transaction == transaction) + jh->b_next_transaction == transaction) { + unlock_buffer(bh); goto done; + }
/* * this is the first time this transaction is touching this buffer, @@ -1074,10 +1068,24 @@ repeat: */ smp_wmb(); spin_lock(&journal->j_list_lock); + if (test_clear_buffer_dirty(bh)) { + /* + * Execute buffer dirty clearing and jh->b_transaction + * assignment under journal->j_list_lock locked to + * prevent bh being removed from checkpoint list if + * the buffer is in an intermediate state (not dirty + * and jh->b_transaction is NULL). + */ + JBUFFER_TRACE(jh, "Journalling dirty buffer"); + set_buffer_jbddirty(bh); + } __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved); spin_unlock(&journal->j_list_lock); + unlock_buffer(bh); goto done; } + unlock_buffer(bh); + /* * If there is already a copy-out version of this buffer, then we don't * need to make another one
From: Jun Nie jun.nie@linaro.org
commit 1e9d62d252812575ded7c620d8fc67c32ff06c16 upstream.
Copy ea data from inode entry when expanding ea block if possible. Then remove the ea entry if expansion success. Thus memcpy to a temporary buffer may be avoided.
If the expansion fails, we do not need to recovery the removed ea entry neither in this way.
Reported-by: syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d0... Link: https://lore.kernel.org/r/20230103014517.495275-2-jun.nie@linaro.org Cc: stable@kernel.org Signed-off-by: Jun Nie jun.nie@linaro.org Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ext4/xattr.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
--- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -2567,9 +2567,8 @@ static int ext4_xattr_move_to_block(hand
is = kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS); bs = kzalloc(sizeof(struct ext4_xattr_block_find), GFP_NOFS); - buffer = kvmalloc(value_size, GFP_NOFS); b_entry_name = kmalloc(entry->e_name_len + 1, GFP_NOFS); - if (!is || !bs || !buffer || !b_entry_name) { + if (!is || !bs || !b_entry_name) { error = -ENOMEM; goto out; } @@ -2581,12 +2580,18 @@ static int ext4_xattr_move_to_block(hand
/* Save the entry name and the entry value */ if (entry->e_value_inum) { + buffer = kvmalloc(value_size, GFP_NOFS); + if (!buffer) { + error = -ENOMEM; + goto out; + } + error = ext4_xattr_inode_get(inode, entry, buffer, value_size); if (error) goto out; } else { size_t value_offs = le16_to_cpu(entry->e_value_offs); - memcpy(buffer, (void *)IFIRST(header) + value_offs, value_size); + buffer = (void *)IFIRST(header) + value_offs; }
memcpy(b_entry_name, entry->e_name, entry->e_name_len); @@ -2601,25 +2606,26 @@ static int ext4_xattr_move_to_block(hand if (error) goto out;
- /* Remove the chosen entry from the inode */ - error = ext4_xattr_ibody_set(handle, inode, &i, is); - if (error) - goto out; - i.value = buffer; i.value_len = value_size; error = ext4_xattr_block_find(inode, &i, bs); if (error) goto out;
- /* Add entry which was removed from the inode into the block */ + /* Move ea entry from the inode into the block */ error = ext4_xattr_block_set(handle, inode, &i, bs); if (error) goto out; - error = 0; + + /* Remove the chosen entry from the inode */ + i.value = NULL; + i.value_len = 0; + error = ext4_xattr_ibody_set(handle, inode, &i, is); + out: kfree(b_entry_name); - kvfree(buffer); + if (entry->e_value_inum && buffer) + kvfree(buffer); if (is) brelse(is->iloc.bh); if (bs)
From: Jun Nie jun.nie@linaro.org
commit f31173c19901a96bb2ebf6bcfec8a08df7095c91 upstream.
The ea block expansion need to access s_root while it is already set as NULL when umount is triggered. Refuse this request to avoid panic.
Reported-by: syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d0... Link: https://lore.kernel.org/r/20230103014517.495275-3-jun.nie@linaro.org Cc: stable@kernel.org Signed-off-by: Jun Nie jun.nie@linaro.org Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ext4/xattr.c | 7 +++++++ 1 file changed, 7 insertions(+)
--- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1438,6 +1438,13 @@ static struct inode *ext4_xattr_inode_cr uid_t owner[2] = { i_uid_read(inode), i_gid_read(inode) }; int err;
+ if (inode->i_sb->s_root == NULL) { + ext4_warning(inode->i_sb, + "refuse to create EA inode when umounting"); + WARN_ON(1); + return ERR_PTR(-EINVAL); + } + /* * Let the next inode be the goal, so we try and allocate the EA inode * in the same group, or nearby one.
From: Jan Kara jack@suse.cz
commit 0813299c586b175d7edb25f56412c54b812d0379 upstream.
When we are renaming a directory to a different directory, we need to update '..' entry in the moved directory. However nothing prevents moved directory from being modified and even converted from the inline format to the normal format. When such race happens the rename code gets confused and we crash. Fix the problem by locking the moved directory.
CC: stable@vger.kernel.org Fixes: 32f7f22c0b52 ("ext4: let ext4_rename handle inline dir") Signed-off-by: Jan Kara jack@suse.cz Link: https://lore.kernel.org/r/20230126112221.11866-1-jack@suse.cz Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ext4/namei.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -3872,9 +3872,16 @@ static int ext4_rename(struct user_names if (new.dir != old.dir && EXT4_DIR_LINK_MAX(new.dir)) goto end_rename; } + /* + * We need to protect against old.inode directory getting + * converted from inline directory format into a normal one. + */ + inode_lock_nested(old.inode, I_MUTEX_NONDIR2); retval = ext4_rename_dir_prepare(handle, &old); - if (retval) + if (retval) { + inode_unlock(old.inode); goto end_rename; + } } /* * If we're renaming a file within an inline_data dir and adding or @@ -4006,6 +4013,8 @@ end_rename: } else { ext4_journal_stop(handle); } + if (old.dir_bh) + inode_unlock(old.inode); release_bh: brelse(old.dir_bh); brelse(old.bh);
From: Dan Williams dan.j.williams@intel.com
commit f57aec443c24d2e8e1f3b5b4856aea12ddda4254 upstream.
A loop of the form:
while true; do modprobe cxl_pci; modprobe -r cxl_pci; done
...fails with the following crash signature:
BUG: kernel NULL pointer dereference, address: 0000000000000040 [..] RIP: 0010:cxl_internal_send_cmd+0x5/0xb0 [cxl_core] [..] Call Trace: <TASK> cxl_pmem_ctl+0x121/0x240 [cxl_pmem] nvdimm_get_config_data+0xd6/0x1a0 [libnvdimm] nd_label_data_init+0x135/0x7e0 [libnvdimm] nvdimm_probe+0xd6/0x1c0 [libnvdimm] nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm] really_probe+0xde/0x380 __driver_probe_device+0x78/0x170 driver_probe_device+0x1f/0x90 __device_attach_driver+0x85/0x110 bus_for_each_drv+0x7d/0xc0 __device_attach+0xb4/0x1e0 bus_probe_device+0x9f/0xc0 device_add+0x445/0x9c0 nd_async_device_register+0xe/0x40 [libnvdimm] async_run_entry_fn+0x30/0x130
...namely that the bottom half of async nvdimm device registration runs after the CXL has already torn down the context that cxl_pmem_ctl() needs. Unlike the ACPI NFIT case that benefits from launching multiple nvdimm device registrations in parallel from those listed in the table, CXL is already marked PROBE_PREFER_ASYNCHRONOUS. So provide for a synchronous registration path to preclude this scenario.
Fixes: 21083f51521f ("cxl/pmem: Register 'pmem' / cxl_nvdimm devices") Cc: stable@vger.kernel.org Reported-by: Dave Jiang dave.jiang@intel.com Signed-off-by: Dan Williams dan.j.williams@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/cxl/pmem.c | 1 + drivers/nvdimm/bus.c | 19 ++++++++++++++++--- drivers/nvdimm/dimm_devs.c | 5 ++++- drivers/nvdimm/nd-core.h | 1 + include/linux/libnvdimm.h | 3 +++ 5 files changed, 25 insertions(+), 4 deletions(-)
--- a/drivers/cxl/pmem.c +++ b/drivers/cxl/pmem.c @@ -76,6 +76,7 @@ static int cxl_nvdimm_probe(struct devic return rc;
set_bit(NDD_LABELING, &flags); + set_bit(NDD_REGISTER_SYNC, &flags); set_bit(ND_CMD_GET_CONFIG_SIZE, &cmd_mask); set_bit(ND_CMD_GET_CONFIG_DATA, &cmd_mask); set_bit(ND_CMD_SET_CONFIG_DATA, &cmd_mask); --- a/drivers/nvdimm/bus.c +++ b/drivers/nvdimm/bus.c @@ -508,7 +508,7 @@ static void nd_async_device_unregister(v put_device(dev); }
-void nd_device_register(struct device *dev) +static void __nd_device_register(struct device *dev, bool sync) { if (!dev) return; @@ -531,11 +531,24 @@ void nd_device_register(struct device *d } get_device(dev);
- async_schedule_dev_domain(nd_async_device_register, dev, - &nd_async_domain); + if (sync) + nd_async_device_register(dev, 0); + else + async_schedule_dev_domain(nd_async_device_register, dev, + &nd_async_domain); +} + +void nd_device_register(struct device *dev) +{ + __nd_device_register(dev, false); } EXPORT_SYMBOL(nd_device_register);
+void nd_device_register_sync(struct device *dev) +{ + __nd_device_register(dev, true); +} + void nd_device_unregister(struct device *dev, enum nd_async_mode mode) { bool killed; --- a/drivers/nvdimm/dimm_devs.c +++ b/drivers/nvdimm/dimm_devs.c @@ -624,7 +624,10 @@ struct nvdimm *__nvdimm_create(struct nv nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); device_initialize(dev); lockdep_set_class(&dev->mutex, &nvdimm_key); - nd_device_register(dev); + if (test_bit(NDD_REGISTER_SYNC, &flags)) + nd_device_register_sync(dev); + else + nd_device_register(dev);
return nvdimm; } --- a/drivers/nvdimm/nd-core.h +++ b/drivers/nvdimm/nd-core.h @@ -107,6 +107,7 @@ int nvdimm_bus_create_ndctl(struct nvdim void nvdimm_bus_destroy_ndctl(struct nvdimm_bus *nvdimm_bus); void nd_synchronize(void); void nd_device_register(struct device *dev); +void nd_device_register_sync(struct device *dev); struct nd_label_id; char *nd_label_gen_id(struct nd_label_id *label_id, const uuid_t *uuid, u32 flags); --- a/include/linux/libnvdimm.h +++ b/include/linux/libnvdimm.h @@ -41,6 +41,9 @@ enum { */ NDD_INCOHERENT = 7,
+ /* dimm provider wants synchronous registration by __nvdimm_create() */ + NDD_REGISTER_SYNC = 8, + /* need to set a limit somewhere, but yes, this is likely overkill */ ND_IOCTL_MAX_BUFLEN = SZ_4M, ND_CMD_MAX_ELEM = 5,
From: Dmitry Torokhov dmitry.torokhov@gmail.com
commit 79c81d137d36f9635bbcbc3916c0cccb418a61dd upstream.
We need to stop the timer on driver unbind or probe failures, otherwise we get UAF/Oops.
Fixes: 7e577a17f2ee ("Input: add I2C attached EETI EXC3000 multi touch driver") Reported-by: "Stahl, Michael" mstahl@moba.de Link: https://lore.kernel.org/r/Y9dK57BFqtlf8NmN@google.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov dmitry.torokhov@gmail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/input/touchscreen/exc3000.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
--- a/drivers/input/touchscreen/exc3000.c +++ b/drivers/input/touchscreen/exc3000.c @@ -109,6 +109,11 @@ static inline void exc3000_schedule_time mod_timer(&data->timer, jiffies + msecs_to_jiffies(EXC3000_TIMEOUT_MS)); }
+static void exc3000_shutdown_timer(void *timer) +{ + timer_shutdown_sync(timer); +} + static int exc3000_read_frame(struct exc3000_data *data, u8 *buf) { struct i2c_client *client = data->client; @@ -386,6 +391,11 @@ static int exc3000_probe(struct i2c_clie if (error) return error;
+ error = devm_add_action_or_reset(&client->dev, exc3000_shutdown_timer, + &data->timer); + if (error) + return error; + error = devm_request_threaded_irq(&client->dev, client->irq, NULL, exc3000_interrupt, IRQF_ONESHOT, client->name, data);
From: Takahiro Kuwano Takahiro.Kuwano@infineon.com
commit ad9679f3811899fd1c21dc7bdd715e8e1cfb46b9 upstream.
Array index for SCCR 22th DOWRD should be 21.
Fixes: 981a8d60e01f ("mtd: spi-nor: Parse SFDP SCCR Map") Signed-off-by: Takahiro Kuwano Takahiro.Kuwano@infineon.com Signed-off-by: Tudor Ambarus tudor.ambarus@linaro.org Reviewed-by: Michael Walle michael@walle.cc Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/d8a2a77c2c95cf776e7dcae6392d29fdcf5d6307.167202636... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/mtd/spi-nor/sfdp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/spi-nor/sfdp.c +++ b/drivers/mtd/spi-nor/sfdp.c @@ -1228,7 +1228,7 @@ static int spi_nor_parse_sccr(struct spi
le32_to_cpu_array(dwords, sccr_header->length);
- if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[22])) + if (FIELD_GET(SCCR_DWORD22_OCTAL_DTR_EN_VOLATILE, dwords[21])) nor->flags |= SNOR_F_IO_MODE_EN_VOLATILE;
out:
From: Tudor Ambarus tudor.ambarus@linaro.org
commit 3f592a869f87723314f0cb1ac232bd3bf8245be8 upstream.
CFR5[6] is reserved bit and must be always 1. Set it to comply with flash requirements. While fixing SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_{EN, DS} definition, stop using magic numbers and describe the missing bit fields in CFR5 register. This is useful for both readability and future possible addition of Octal STR mode support.
Fixes: c3266af101f2 ("mtd: spi-nor: spansion: add support for Cypress Semper flash") Cc: stable@vger.kernel.org Reported-by: Takahiro Kuwano Takahiro.Kuwano@infineon.com Signed-off-by: Tudor Ambarus tudor.ambarus@linaro.org Reviewed-by: Dhruva Gole d-gole@ti.com Reviewed-by: Pratyush Yadav ptyadav@amazon.de Tested-by: Dhruva Gole d-gole@ti.com Link: https://lore.kernel.org/linux-mtd/20230110164703.83413-1-tudor.ambarus@linar... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/mtd/spi-nor/spansion.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/mtd/spi-nor/spansion.c +++ b/drivers/mtd/spi-nor/spansion.c @@ -21,8 +21,13 @@ #define SPINOR_REG_CYPRESS_CFR3V 0x00800004 #define SPINOR_REG_CYPRESS_CFR3V_PGSZ BIT(4) /* Page size. */ #define SPINOR_REG_CYPRESS_CFR5V 0x00800006 -#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_EN 0x3 -#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_DS 0 +#define SPINOR_REG_CYPRESS_CFR5_BIT6 BIT(6) +#define SPINOR_REG_CYPRESS_CFR5_DDR BIT(1) +#define SPINOR_REG_CYPRESS_CFR5_OPI BIT(0) +#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_EN \ + (SPINOR_REG_CYPRESS_CFR5_BIT6 | SPINOR_REG_CYPRESS_CFR5_DDR | \ + SPINOR_REG_CYPRESS_CFR5_OPI) +#define SPINOR_REG_CYPRESS_CFR5V_OCT_DTR_DS SPINOR_REG_CYPRESS_CFR5_BIT6 #define SPINOR_OP_CYPRESS_RD_FAST 0xee
/* Cypress SPI NOR flash operations. */
From: Louis Rannou lrannou@baylibre.com
commit f0f0cfdc3a024e21161714f2e05f0df3b84d42ad upstream.
spi_nor_set_erase_type() was used either to set or to mask out an erase type. When we used it to mask out an erase type a shift-out-of-bounds was hit: UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int'
The setting of the size_{shift, mask} and of the opcode are unnecessary when the erase size is zero, as throughout the code just the erase size is considered to determine whether an erase type is supported or not. Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF is an unused opcode. Thus when masking out an erase type, just set the erase size to zero. This will fix the shift-out-of-bounds.
Fixes: 5390a8df769e ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories") Cc: stable@vger.kernel.org Reported-by: Alexander Stein Alexander.Stein@tq-group.com Signed-off-by: Louis Rannou lrannou@baylibre.com Tested-by: Alexander Stein Alexander.Stein@tq-group.com Link: https://lore.kernel.org/r/20230203070754.50677-1-tudor.ambarus@linaro.org [ta: refine changes, new commit message, fix compilation error] Signed-off-by: Tudor Ambarus tudor.ambarus@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/mtd/spi-nor/core.c | 9 +++++++++ drivers/mtd/spi-nor/core.h | 1 + drivers/mtd/spi-nor/sfdp.c | 4 ++-- 3 files changed, 12 insertions(+), 2 deletions(-)
--- a/drivers/mtd/spi-nor/core.c +++ b/drivers/mtd/spi-nor/core.c @@ -2027,6 +2027,15 @@ void spi_nor_set_erase_type(struct spi_n }
/** + * spi_nor_mask_erase_type() - mask out a SPI NOR erase type + * @erase: pointer to a structure that describes a SPI NOR erase type + */ +void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase) +{ + erase->size = 0; +} + +/** * spi_nor_init_uniform_erase_map() - Initialize uniform erase map * @map: the erase map of the SPI NOR * @erase_mask: bitmask encoding erase types that can erase the entire --- a/drivers/mtd/spi-nor/core.h +++ b/drivers/mtd/spi-nor/core.h @@ -684,6 +684,7 @@ void spi_nor_set_pp_settings(struct spi_
void spi_nor_set_erase_type(struct spi_nor_erase_type *erase, u32 size, u8 opcode); +void spi_nor_mask_erase_type(struct spi_nor_erase_type *erase); struct spi_nor_erase_region * spi_nor_region_next(struct spi_nor_erase_region *region); void spi_nor_init_uniform_erase_map(struct spi_nor_erase_map *map, --- a/drivers/mtd/spi-nor/sfdp.c +++ b/drivers/mtd/spi-nor/sfdp.c @@ -875,7 +875,7 @@ static int spi_nor_init_non_uniform_eras */ for (i = 0; i < SNOR_ERASE_TYPE_MAX; i++) if (!(regions_erase_type & BIT(erase[i].idx))) - spi_nor_set_erase_type(&erase[i], 0, 0xFF); + spi_nor_mask_erase_type(&erase[i]);
return 0; } @@ -1089,7 +1089,7 @@ static int spi_nor_parse_4bait(struct sp erase_type[i].opcode = (dwords[1] >> erase_type[i].idx * 8) & 0xFF; else - spi_nor_set_erase_type(&erase_type[i], 0u, 0xFF); + spi_nor_mask_erase_type(&erase_type[i]); }
/*
From: Mikulas Patocka mpatocka@redhat.com
commit 7533afa1d27ba1234146d31d2402c195cf195962 upstream.
Device mapper sends an uevent when the device is suspended, using the function set_capacity_and_notify. However, this causes a race condition with udev.
Udev skips scanning dm devices that are suspended. If we send an uevent while we are suspended, udev will be racing with device mapper resume code. If the device mapper resume code wins the race, udev will process the uevent after the device is resumed and it will properly scan the device.
However, if udev wins the race, it will receive the uevent, find out that the dm device is suspended and skip scanning the device. This causes bugs such as systemd unmounting the device - see https://bugzilla.redhat.com/show_bug.cgi?id=2158628
This commit fixes this race.
We replace the function set_capacity_and_notify with set_capacity, so that the uevent is not sent at this point. In do_resume, we detect if the capacity has changed and we pass a boolean variable need_resize_uevent to dm_kobject_uevent. dm_kobject_uevent adds "RESIZE=1" to the uevent if need_resize_uevent is set.
Signed-off-by: Mikulas Patocka mpatocka@redhat.com Tested-by: Peter Rajnoha prajnoha@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/md/dm-ioctl.c | 13 ++++++++++--- drivers/md/dm.c | 27 +++++++++++++-------------- drivers/md/dm.h | 2 +- 3 files changed, 24 insertions(+), 18 deletions(-)
--- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -482,7 +482,7 @@ static struct mapped_device *dm_hash_ren dm_table_event(table); dm_put_live_table(hc->md, srcu_idx);
- if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr)) + if (!dm_kobject_uevent(hc->md, KOBJ_CHANGE, param->event_nr, false)) param->flags |= DM_UEVENT_GENERATED_FLAG;
md = hc->md; @@ -995,7 +995,7 @@ static int dev_remove(struct file *filp,
dm_ima_measure_on_device_remove(md, false);
- if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr)) + if (!dm_kobject_uevent(md, KOBJ_REMOVE, param->event_nr, false)) param->flags |= DM_UEVENT_GENERATED_FLAG;
dm_put(md); @@ -1129,6 +1129,7 @@ static int do_resume(struct dm_ioctl *pa struct hash_cell *hc; struct mapped_device *md; struct dm_table *new_map, *old_map = NULL; + bool need_resize_uevent = false;
down_write(&_hash_lock);
@@ -1149,6 +1150,8 @@ static int do_resume(struct dm_ioctl *pa
/* Do we need to load a new map ? */ if (new_map) { + sector_t old_size, new_size; + /* Suspend if it isn't already suspended */ if (param->flags & DM_SKIP_LOCKFS_FLAG) suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG; @@ -1157,6 +1160,7 @@ static int do_resume(struct dm_ioctl *pa if (!dm_suspended_md(md)) dm_suspend(md, suspend_flags);
+ old_size = dm_get_size(md); old_map = dm_swap_table(md, new_map); if (IS_ERR(old_map)) { dm_sync_table(md); @@ -1164,6 +1168,9 @@ static int do_resume(struct dm_ioctl *pa dm_put(md); return PTR_ERR(old_map); } + new_size = dm_get_size(md); + if (old_size && new_size && old_size != new_size) + need_resize_uevent = true;
if (dm_table_get_mode(new_map) & FMODE_WRITE) set_disk_ro(dm_disk(md), 0); @@ -1176,7 +1183,7 @@ static int do_resume(struct dm_ioctl *pa if (!r) { dm_ima_measure_on_device_resume(md, new_map ? true : false);
- if (!dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr)) + if (!dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr, need_resize_uevent)) param->flags |= DM_UEVENT_GENERATED_FLAG; } } --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2171,10 +2171,7 @@ static struct dm_table *__bind(struct ma if (size != dm_get_size(md)) memset(&md->geometry, 0, sizeof(md->geometry));
- if (!get_capacity(md->disk)) - set_capacity(md->disk, size); - else - set_capacity_and_notify(md->disk, size); + set_capacity(md->disk, size);
dm_table_event_callback(t, event_callback, md);
@@ -2967,23 +2964,25 @@ EXPORT_SYMBOL_GPL(dm_internal_resume_fas * Event notification. *---------------------------------------------------------------*/ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, - unsigned cookie) + unsigned cookie, bool need_resize_uevent) { int r; unsigned noio_flag; char udev_cookie[DM_COOKIE_LENGTH]; - char *envp[] = { udev_cookie, NULL }; - - noio_flag = memalloc_noio_save(); - - if (!cookie) - r = kobject_uevent(&disk_to_dev(md->disk)->kobj, action); - else { + char *envp[3] = { NULL, NULL, NULL }; + char **envpp = envp; + if (cookie) { snprintf(udev_cookie, DM_COOKIE_LENGTH, "%s=%u", DM_COOKIE_ENV_VAR_NAME, cookie); - r = kobject_uevent_env(&disk_to_dev(md->disk)->kobj, - action, envp); + *envpp++ = udev_cookie; } + if (need_resize_uevent) { + *envpp++ = "RESIZE=1"; + } + + noio_flag = memalloc_noio_save(); + + r = kobject_uevent_env(&disk_to_dev(md->disk)->kobj, action, envp);
memalloc_noio_restore(noio_flag);
--- a/drivers/md/dm.h +++ b/drivers/md/dm.h @@ -203,7 +203,7 @@ int dm_get_table_device(struct mapped_de void dm_put_table_device(struct mapped_device *md, struct dm_dev *d);
int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action, - unsigned cookie); + unsigned cookie, bool need_resize_uevent);
void dm_internal_suspend(struct mapped_device *md); void dm_internal_resume(struct mapped_device *md);
From: Pingfan Liu piliu@redhat.com
commit 0ca44fcef241768fd25ee763b3d203b9852f269b upstream.
Otherwise the while() loop in dm_wq_work() can result in a "dead loop" on systems that have preemption disabled. This is particularly problematic on single cpu systems.
Cc: stable@vger.kernel.org Signed-off-by: Pingfan Liu piliu@redhat.com Acked-by: Ming Lei ming.lei@redhat.com Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/md/dm.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2565,6 +2565,7 @@ static void dm_wq_work(struct work_struc break;
submit_bio_noacct(bio); + cond_resched(); } }
From: Mike Snitzer snitzer@kernel.org
commit f77692d65d54665d81815349cc727baa85e8b71d upstream.
Otherwise the while() loop in dm_wq_requeue_work() can result in a "dead loop" on systems that have preemption disabled. This is particularly problematic on single cpu systems.
Fixes: 8b211aaccb915 ("dm: add two stage requeue mechanism") Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/md/dm.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1007,6 +1007,7 @@ static void dm_wq_requeue_work(struct wo io->next = NULL; __dm_io_complete(io, false); io = next; + cond_resched(); } }
From: Ping-Ke Shih pkshih@realtek.com
commit 4a267bc5ea8f159b614d0549030216d0434eccca upstream.
Use power state to decide whether we can enter or leave IPS accurately, and then prevent to power on/off twice.
The commit 6bf3a083407b ("wifi: rtw88: add flag check before enter or leave IPS") would like to prevent this as well, but it still can't entirely handle all cases. The exception is that WiFi gets connected and does suspend/resume, it will power on twice and cause it failed to power on after resuming, like:
rtw_8723de 0000:03:00.0: failed to poll offset=0x6 mask=0x2 value=0x2 rtw_8723de 0000:03:00.0: mac power on failed rtw_8723de 0000:03:00.0: failed to power on mac rtw_8723de 0000:03:00.0: leave idle state failed rtw_8723de 0000:03:00.0: failed to leave ips state rtw_8723de 0000:03:00.0: failed to leave idle state rtw_8723de 0000:03:00.0: failed to send h2c command
To fix this, introduce new flag RTW_FLAG_POWERON to reflect power state, and call rtw_mac_pre_system_cfg() to configure registers properly between power-off/-on.
Reported-by: Paul Gover pmw.gover@yahoo.co.uk Link: https://bugzilla.kernel.org/show_bug.cgi?id=217016 Fixes: 6bf3a083407b ("wifi: rtw88: add flag check before enter or leave IPS") Cc: Stable@vger.kernel.org Signed-off-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230216053633.20366-1-pkshih@realtek.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/wireless/realtek/rtw88/coex.c | 2 +- drivers/net/wireless/realtek/rtw88/mac.c | 10 ++++++++++ drivers/net/wireless/realtek/rtw88/main.h | 2 +- drivers/net/wireless/realtek/rtw88/ps.c | 4 ++-- drivers/net/wireless/realtek/rtw88/wow.c | 2 +- 5 files changed, 15 insertions(+), 5 deletions(-)
--- a/drivers/net/wireless/realtek/rtw88/coex.c +++ b/drivers/net/wireless/realtek/rtw88/coex.c @@ -4056,7 +4056,7 @@ void rtw_coex_display_coex_info(struct r rtwdev->stats.tx_throughput, rtwdev->stats.rx_throughput); seq_printf(m, "%-40s = %u/ %u/ %u\n", "IPS/ Low Power/ PS mode", - test_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags), + !test_bit(RTW_FLAG_POWERON, rtwdev->flags), test_bit(RTW_FLAG_LEISURE_PS_DEEP, rtwdev->flags), rtwdev->lps_conf.mode);
--- a/drivers/net/wireless/realtek/rtw88/mac.c +++ b/drivers/net/wireless/realtek/rtw88/mac.c @@ -273,6 +273,11 @@ static int rtw_mac_power_switch(struct r if (rtw_pwr_seq_parser(rtwdev, pwr_seq)) return -EINVAL;
+ if (pwr_on) + set_bit(RTW_FLAG_POWERON, rtwdev->flags); + else + clear_bit(RTW_FLAG_POWERON, rtwdev->flags); + return 0; }
@@ -335,6 +340,11 @@ int rtw_mac_power_on(struct rtw_dev *rtw ret = rtw_mac_power_switch(rtwdev, true); if (ret == -EALREADY) { rtw_mac_power_switch(rtwdev, false); + + ret = rtw_mac_pre_system_cfg(rtwdev); + if (ret) + goto err; + ret = rtw_mac_power_switch(rtwdev, true); if (ret) goto err; --- a/drivers/net/wireless/realtek/rtw88/main.h +++ b/drivers/net/wireless/realtek/rtw88/main.h @@ -356,7 +356,7 @@ enum rtw_flags { RTW_FLAG_RUNNING, RTW_FLAG_FW_RUNNING, RTW_FLAG_SCANNING, - RTW_FLAG_INACTIVE_PS, + RTW_FLAG_POWERON, RTW_FLAG_LEISURE_PS, RTW_FLAG_LEISURE_PS_DEEP, RTW_FLAG_DIG_DISABLE, --- a/drivers/net/wireless/realtek/rtw88/ps.c +++ b/drivers/net/wireless/realtek/rtw88/ps.c @@ -25,7 +25,7 @@ static int rtw_ips_pwr_up(struct rtw_dev
int rtw_enter_ips(struct rtw_dev *rtwdev) { - if (test_and_set_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags)) + if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags)) return 0;
rtw_coex_ips_notify(rtwdev, COEX_IPS_ENTER); @@ -50,7 +50,7 @@ int rtw_leave_ips(struct rtw_dev *rtwdev { int ret;
- if (!test_and_clear_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags)) + if (test_bit(RTW_FLAG_POWERON, rtwdev->flags)) return 0;
rtw_hci_link_ps(rtwdev, false); --- a/drivers/net/wireless/realtek/rtw88/wow.c +++ b/drivers/net/wireless/realtek/rtw88/wow.c @@ -592,7 +592,7 @@ static int rtw_wow_leave_no_link_ps(stru if (rtw_get_lps_deep_mode(rtwdev) != LPS_DEEP_MODE_NONE) rtw_leave_lps_deep(rtwdev); } else { - if (test_bit(RTW_FLAG_INACTIVE_PS, rtwdev->flags)) { + if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags)) { rtw_wow->ips_enabled = true; ret = rtw_leave_ips(rtwdev); if (ret)
From: Bitterblue Smith rtl8821cerfe2@gmail.com
commit 2a86aa9a1892d60ef2e3f310f5b42b8b05546d65 upstream.
The Realtek rate control algorithm goes back and forth a lot between the highest and the lowest rate it's allowed to use. This is due to a lot of frames being dropped because the retry limits set by IEEE80211_CONF_CHANGE_RETRY_LIMITS are too low. (Experimentally, they are 4 for long frames and 7 for short frames.)
The vendor drivers hardcode the value 48 for both retry limits (for station mode), which makes dropped frames very rare and thus the rate control is more stable.
Because most Realtek chips handle the rate control in the firmware, which can't be modified, ignore the limits set by IEEE80211_CONF_CHANGE_RETRY_LIMITS and use the value 48 (set during chip initialisation), same as the vendor drivers.
Cc: stable@vger.kernel.org Signed-off-by: Bitterblue Smith rtl8821cerfe2@gmail.com Reviewed-by: Ping-Ke Shih pkshih@realtek.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/477d745b-6bac-111d-403c-487fc19aa30d@gmail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 9 --------- 1 file changed, 9 deletions(-)
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -5954,7 +5954,6 @@ static int rtl8xxxu_config(struct ieee80 { struct rtl8xxxu_priv *priv = hw->priv; struct device *dev = &priv->udev->dev; - u16 val16; int ret = 0, channel; bool ht40;
@@ -5964,14 +5963,6 @@ static int rtl8xxxu_config(struct ieee80 __func__, hw->conf.chandef.chan->hw_value, changed, hw->conf.chandef.width);
- if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) { - val16 = ((hw->conf.long_frame_max_tx_count << - RETRY_LIMIT_LONG_SHIFT) & RETRY_LIMIT_LONG_MASK) | - ((hw->conf.short_frame_max_tx_count << - RETRY_LIMIT_SHORT_SHIFT) & RETRY_LIMIT_SHORT_MASK); - rtl8xxxu_write16(priv, REG_RETRY_LIMIT, val16); - } - if (changed & IEEE80211_CONF_CHANGE_CHANNEL) { switch (hw->conf.chandef.width) { case NL80211_CHAN_WIDTH_20_NOHT:
From: Len Brown len.brown@intel.com
commit 7c15430822e71e90203d87e6d0cfe83fa058b0dc upstream.
When ath11k runs into internal errors upon suspend, it returns an error code to pci_pm_suspend, which aborts the entire system suspend.
The driver should not abort system suspend, but should keep its internal errors to itself, and allow the system to suspend. Otherwise, a user can suspend a laptop by closing the lid and sealing it into a case, assuming that is will suspend, rather than heating up and draining the battery when in transit.
In practice, the ath11k device seems to have plenty of transient errors, and subsequent suspend cycles after this failure often succeed.
https://bugzilla.kernel.org/show_bug.cgi?id=216968
Fixes: d1b0c33850d29 ("ath11k: implement suspend for QCA6390 PCI devices")
Signed-off-by: Len Brown len.brown@intel.com Cc: stable@vger.kernel.org Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230201183201.14431-1-len.brown@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/wireless/ath/ath11k/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath11k/pci.c +++ b/drivers/net/wireless/ath/ath11k/pci.c @@ -979,7 +979,7 @@ static __maybe_unused int ath11k_pci_pm_ if (ret) ath11k_warn(ab, "failed to suspend core: %d\n", ret);
- return ret; + return 0; }
static __maybe_unused int ath11k_pci_pm_resume(struct device *dev)
From: Alexander Wetzel alexander@wetzel-home.de
commit 015b8cc5e7c4d7bb671f1984d7b7338c310b185b upstream.
Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection.
Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory.
Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work.
Fixes: fffd0934b939 ("cfg80211: rework key operation") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230124141856.356646-1-alexander@wetzel-home.de Signed-off-by: Alexander Wetzel alexander@wetzel-home.de Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- net/wireless/sme.c | 31 ++++++++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-)
--- a/net/wireless/sme.c +++ b/net/wireless/sme.c @@ -285,6 +285,15 @@ void cfg80211_conn_work(struct work_stru wiphy_unlock(&rdev->wiphy); }
+static void cfg80211_step_auth_next(struct cfg80211_conn *conn, + struct cfg80211_bss *bss) +{ + memcpy(conn->bssid, bss->bssid, ETH_ALEN); + conn->params.bssid = conn->bssid; + conn->params.channel = bss->channel; + conn->state = CFG80211_CONN_AUTHENTICATE_NEXT; +} + /* Returned bss is reference counted and must be cleaned up appropriately. */ static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev) { @@ -302,10 +311,7 @@ static struct cfg80211_bss *cfg80211_get if (!bss) return NULL;
- memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN); - wdev->conn->params.bssid = wdev->conn->bssid; - wdev->conn->params.channel = bss->channel; - wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT; + cfg80211_step_auth_next(wdev->conn, bss); schedule_work(&rdev->conn_work);
return bss; @@ -597,7 +603,12 @@ static int cfg80211_sme_connect(struct w wdev->conn->params.ssid_len = wdev->u.client.ssid_len;
/* see if we have the bss already */ - bss = cfg80211_get_conn_bss(wdev); + bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel, + wdev->conn->params.bssid, + wdev->conn->params.ssid, + wdev->conn->params.ssid_len, + wdev->conn_bss_type, + IEEE80211_PRIVACY(wdev->conn->params.privacy));
if (prev_bssid) { memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN); @@ -608,6 +619,7 @@ static int cfg80211_sme_connect(struct w if (bss) { enum nl80211_timeout_reason treason;
+ cfg80211_step_auth_next(wdev->conn, bss); err = cfg80211_conn_do_work(wdev, &treason); cfg80211_put_bss(wdev->wiphy, bss); } else { @@ -1468,6 +1480,15 @@ int cfg80211_connect(struct cfg80211_reg } else { if (WARN_ON(connkeys)) return -EINVAL; + + /* connect can point to wdev->wext.connect which + * can hold key data from a previous connection + */ + connect->key = NULL; + connect->key_len = 0; + connect->key_idx = 0; + connect->crypto.cipher_group = 0; + connect->crypto.n_ciphers_pairwise = 0; }
wdev->connect_keys = connkeys;
From: Marc Bornand dev.mbornand@systemb.ch
commit c38c701851011c94ce3be1ccb3593678d2933fd8 upstream.
When a connection was established without going through NL80211_CMD_CONNECT, the ssid was never set in the wireless_dev struct. Now we set it in __cfg80211_connect_result() when it is not already set.
When using a userspace configuration that does not call cfg80211_connect() (can be checked with breakpoints in the kernel), this patch should allow `networkctl status device_name` to output the SSID instead of null.
Cc: stable@vger.kernel.org Reported-by: Yohan Prod'homme kernel@zoddo.fr Fixes: 7b0a0e3c3a88 (wifi: cfg80211: do some rework towards MLO link APIs) Link: https://bugzilla.kernel.org/show_bug.cgi?id=216711 Signed-off-by: Marc Bornand dev.mbornand@systemb.ch Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- net/wireless/sme.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
--- a/net/wireless/sme.c +++ b/net/wireless/sme.c @@ -736,6 +736,7 @@ void __cfg80211_connect_result(struct ne { struct wireless_dev *wdev = dev->ieee80211_ptr; const struct element *country_elem = NULL; + const struct element *ssid; const u8 *country_data; u8 country_datalen; #ifdef CONFIG_CFG80211_WEXT @@ -895,6 +896,22 @@ void __cfg80211_connect_result(struct ne country_data, country_datalen); kfree(country_data);
+ if (!wdev->u.client.ssid_len) { + rcu_read_lock(); + for_each_valid_link(cr, link) { + ssid = ieee80211_bss_get_elem(cr->links[link].bss, + WLAN_EID_SSID); + + if (!ssid || !ssid->datalen) + continue; + + memcpy(wdev->u.client.ssid, ssid->data, ssid->datalen); + wdev->u.client.ssid_len = ssid->datalen; + break; + } + rcu_read_unlock(); + } + return; out: for_each_valid_link(cr, link)
From: Arnd Bergmann arnd@arndb.de
commit 7787943a3a8ade6594a68db28c166adbb1d3708c upstream.
Some ARMv4 processors don't support suspend, which leads to a build failure with the tegra and qualcomm cpuidle driver:
WARNING: unmet direct dependencies detected for ARM_CPU_SUSPEND Depends on [n]: ARCH_SUSPEND_POSSIBLE [=n] Selected by [y]: - ARM_TEGRA_CPUIDLE [=y] && CPU_IDLE [=y] && (ARM [=y] || ARM64) && (ARCH_TEGRA [=n] || COMPILE_TEST [=y]) && !ARM64 && MMU [=y]
arch/arm/kernel/sleep.o: in function `__cpu_suspend': (.text+0x68): undefined reference to `cpu_sa110_suspend_size' (.text+0x68): undefined reference to `cpu_fa526_suspend_size'
Add an explicit dependency to make randconfig builds avoid this combination.
Fixes: faae6c9f2e68 ("cpuidle: tegra: Enable compile testing") Fixes: a871be6b8eee ("cpuidle: Convert Qualcomm SPM driver to a generic CPUidle driver") Link: https://lore.kernel.org/all/20211013160125.772873-1-arnd@kernel.org/ Cc: All applicable stable@vger.kernel.org Reviewed-by: Dmitry Osipenko digetx@gmail.com Signed-off-by: Arnd Bergmann arnd@arndb.de Acked-by: Thierry Reding treding@nvidia.com Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/cpuidle/Kconfig.arm | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/cpuidle/Kconfig.arm +++ b/drivers/cpuidle/Kconfig.arm @@ -102,6 +102,7 @@ config ARM_MVEBU_V7_CPUIDLE config ARM_TEGRA_CPUIDLE bool "CPU Idle Driver for NVIDIA Tegra SoCs" depends on (ARCH_TEGRA || COMPILE_TEST) && !ARM64 && MMU + depends on ARCH_SUSPEND_POSSIBLE select ARCH_NEEDS_CPU_IDLE_COUPLED if SMP select ARM_CPU_SUSPEND help @@ -110,6 +111,7 @@ config ARM_TEGRA_CPUIDLE config ARM_QCOM_SPM_CPUIDLE bool "CPU Idle Driver for Qualcomm Subsystem Power Manager (SPM)" depends on (ARCH_QCOM || COMPILE_TEST) && !ARM64 && MMU + depends on ARCH_SUSPEND_POSSIBLE select ARM_CPU_SUSPEND select CPU_IDLE_MULTIPLE_DRIVERS select DT_IDLE_STATES
From: Manish Chopra manishc@marvell.com
commit 908d4bb7c54caa58253a363d63e797a468eaf321 upstream.
On default driver load device gets configured with unexpected higher interrupt coalescing values instead of default expected values as memory allocated from krealloc() is not supposed to be zeroed out and may contain garbage values.
Fix this by allocating the memory of required size first with kcalloc() and then use krealloc() to resize and preserve the contents across down/up of the interface.
Signed-off-by: Manish Chopra manishc@marvell.com Fixes: b0ec5489c480 ("qede: preserve per queue stats across up/down of interface") Cc: stable@vger.kernel.org Cc: Bhaskar Upadhaya bupadhaya@marvell.com Cc: David S. Miller davem@davemloft.net Link: https://bugzilla.redhat.com/show_bug.cgi?id=2160054 Signed-off-by: Alok Prasad palok@marvell.com Signed-off-by: Ariel Elior aelior@marvell.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/ethernet/qlogic/qede/qede_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c +++ b/drivers/net/ethernet/qlogic/qede/qede_main.c @@ -970,8 +970,15 @@ static int qede_alloc_fp_array(struct qe goto err; }
- mem = krealloc(edev->coal_entry, QEDE_QUEUE_CNT(edev) * - sizeof(*edev->coal_entry), GFP_KERNEL); + if (!edev->coal_entry) { + mem = kcalloc(QEDE_MAX_RSS_CNT(edev), + sizeof(*edev->coal_entry), GFP_KERNEL); + } else { + mem = krealloc(edev->coal_entry, + QEDE_QUEUE_CNT(edev) * sizeof(*edev->coal_entry), + GFP_KERNEL); + } + if (!mem) { DP_ERR(edev, "coalesce entry allocation failed\n"); kfree(edev->coal_entry);
From: Srinivas Pandruvada srinivas.pandruvada@linux.intel.com
commit 8e47363588377e1bdb65e2b020b409cfb44dd260 upstream.
The powerclamp cooling device cur_state shows actual idle observed by package C-state idle counters. But the implementation is not sufficient for multi package or multi die system. The cur_state value is incorrect. On these systems, these counters must be read from each package/die and somehow aggregate them. But there is no good method for aggregation.
It was not a problem when explicit CPU model addition was required to enable intel powerclamp. In this way certain CPU models could have been avoided. But with the removal of CPU model check with the availability of Package C-state counters, the driver is loaded on most of the recent systems.
For multi package/die systems, just show the actual target idle state, the system is trying to achieve. In powerclamp this is the user set state minus one.
Also there is no use of starting a worker thread for polling package C-state counters and applying any compensation for multiple package or multiple die systems.
Fixes: b721ca0d1927 ("thermal/powerclamp: remove cpu whitelist") Signed-off-by: Srinivas Pandruvada srinivas.pandruvada@linux.intel.com Cc: 4.14+ stable@vger.kernel.org # 4.14+ Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/thermal/intel/intel_powerclamp.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
--- a/drivers/thermal/intel/intel_powerclamp.c +++ b/drivers/thermal/intel/intel_powerclamp.c @@ -57,6 +57,7 @@
static unsigned int target_mwait; static struct dentry *debug_dir; +static bool poll_pkg_cstate_enable;
/* user selected target */ static unsigned int set_target_ratio; @@ -261,6 +262,9 @@ static unsigned int get_compensation(int { unsigned int comp = 0;
+ if (!poll_pkg_cstate_enable) + return 0; + /* we only use compensation if all adjacent ones are good */ if (ratio == 1 && cal_data[ratio].confidence >= CONFIDENCE_OK && @@ -519,7 +523,8 @@ static int start_power_clamp(void) control_cpu = cpumask_first(cpu_online_mask);
clamping = true; - schedule_delayed_work(&poll_pkg_cstate_work, 0); + if (poll_pkg_cstate_enable) + schedule_delayed_work(&poll_pkg_cstate_work, 0);
/* start one kthread worker per online cpu */ for_each_online_cpu(cpu) { @@ -585,11 +590,15 @@ static int powerclamp_get_max_state(stru static int powerclamp_get_cur_state(struct thermal_cooling_device *cdev, unsigned long *state) { - if (true == clamping) - *state = pkg_cstate_ratio_cur; - else + if (clamping) { + if (poll_pkg_cstate_enable) + *state = pkg_cstate_ratio_cur; + else + *state = set_target_ratio; + } else { /* to save power, do not poll idle ratio while not clamping */ *state = -1; /* indicates invalid state */ + }
return 0; } @@ -712,6 +721,9 @@ static int __init powerclamp_init(void) goto exit_unregister; }
+ if (topology_max_packages() == 1 && topology_max_die_per_package() == 1) + poll_pkg_cstate_enable = true; + cooling_dev = thermal_cooling_device_register("intel_powerclamp", NULL, &powerclamp_cooling_ops); if (IS_ERR(cooling_dev)) {
From: Mikulas Patocka mpatocka@redhat.com
commit aa56b9b75996ff4c76a0a4181c2fa0206c3d91cc upstream.
If "corrupt_bio_byte" is set to corrupt reads and corrupt_bio_flags is used, dm-flakey would erroneously return all writes as errors. Likewise, if "corrupt_bio_byte" is set to corrupt writes, dm-flakey would return errors for all reads.
Fix the logic so that if fc->corrupt_bio_byte is non-zero, dm-flakey will not abort reads on writes with an error.
Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka mpatocka@redhat.com Reviewed-by: Sweet Tea Dorminy sweettea-kernel@dorminy.me Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/md/dm-flakey.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
--- a/drivers/md/dm-flakey.c +++ b/drivers/md/dm-flakey.c @@ -361,9 +361,11 @@ static int flakey_map(struct dm_target * /* * Corrupt matching writes. */ - if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == WRITE)) { - if (all_corrupt_bio_flags_match(bio, fc)) - corrupt_bio_data(bio, fc); + if (fc->corrupt_bio_byte) { + if (fc->corrupt_bio_rw == WRITE) { + if (all_corrupt_bio_flags_match(bio, fc)) + corrupt_bio_data(bio, fc); + } goto map_bio; }
@@ -389,13 +391,14 @@ static int flakey_end_io(struct dm_targe return DM_ENDIO_DONE;
if (!*error && pb->bio_submitted && (bio_data_dir(bio) == READ)) { - if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) && - all_corrupt_bio_flags_match(bio, fc)) { - /* - * Corrupt successful matching READs while in down state. - */ - corrupt_bio_data(bio, fc); - + if (fc->corrupt_bio_byte) { + if ((fc->corrupt_bio_rw == READ) && + all_corrupt_bio_flags_match(bio, fc)) { + /* + * Corrupt successful matching READs while in down state. + */ + corrupt_bio_data(bio, fc); + } } else if (!test_bit(DROP_WRITES, &fc->flags) && !test_bit(ERROR_WRITES, &fc->flags)) { /*
From: Joe Thornber ejt@redhat.com
commit 95ab80a8a0fef2ce0cc494a306dd283948066ce7 upstream.
Otherwise the kernel can BUG with:
[ 2245.426978] ============================================================================= [ 2245.435155] BUG bt_work (Tainted: G B W ): Objects remaining in bt_work on __kmem_cache_shutdown() [ 2245.445233] ----------------------------------------------------------------------------- [ 2245.445233] [ 2245.454879] Slab 0x00000000b0ce2b30 objects=64 used=2 fp=0x000000000a3c6a4e flags=0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 2245.467300] CPU: 7 PID: 10805 Comm: lvm Kdump: loaded Tainted: G B W 6.0.0-rc2 #19 [ 2245.476078] Hardware name: Dell Inc. PowerEdge R7525/0590KW, BIOS 2.5.6 10/06/2021 [ 2245.483646] Call Trace: [ 2245.486100] <TASK> [ 2245.488206] dump_stack_lvl+0x34/0x48 [ 2245.491878] slab_err+0x95/0xcd [ 2245.495028] __kmem_cache_shutdown.cold+0x31/0x136 [ 2245.499821] kmem_cache_destroy+0x49/0x130 [ 2245.503928] btracker_destroy+0x12/0x20 [dm_cache] [ 2245.508728] smq_destroy+0x15/0x60 [dm_cache_smq] [ 2245.513435] dm_cache_policy_destroy+0x12/0x20 [dm_cache] [ 2245.518834] destroy+0xc0/0x110 [dm_cache] [ 2245.522933] dm_table_destroy+0x5c/0x120 [dm_mod] [ 2245.527649] __dm_destroy+0x10e/0x1c0 [dm_mod] [ 2245.532102] dev_remove+0x117/0x190 [dm_mod] [ 2245.536384] ctl_ioctl+0x1a2/0x290 [dm_mod] [ 2245.540579] dm_ctl_ioctl+0xa/0x20 [dm_mod] [ 2245.544773] __x64_sys_ioctl+0x8a/0xc0 [ 2245.548524] do_syscall_64+0x5c/0x90 [ 2245.552104] ? syscall_exit_to_user_mode+0x12/0x30 [ 2245.556897] ? do_syscall_64+0x69/0x90 [ 2245.560648] ? do_syscall_64+0x69/0x90 [ 2245.564394] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 2245.569447] RIP: 0033:0x7fe52583ec6b ... [ 2245.646771] ------------[ cut here ]------------ [ 2245.651395] kmem_cache_destroy bt_work: Slab cache still has objects when called from btracker_destroy+0x12/0x20 [dm_cache] [ 2245.651408] WARNING: CPU: 7 PID: 10805 at mm/slab_common.c:478 kmem_cache_destroy+0x128/0x130
Found using: lvm2-testsuite --only "cache-single-split.sh"
Ben bisected and found that commit 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") first exposed dm-cache's incomplete cleanup of its background tracker work objects.
Reported-by: Benjamin Marzinski bmarzins@redhat.com Tested-by: Benjamin Marzinski bmarzins@redhat.com Cc: stable@vger.kernel.org # 6.0+ Signed-off-by: Joe Thornber ejt@redhat.com Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/md/dm-cache-background-tracker.c | 8 ++++++++ 1 file changed, 8 insertions(+)
--- a/drivers/md/dm-cache-background-tracker.c +++ b/drivers/md/dm-cache-background-tracker.c @@ -60,6 +60,14 @@ EXPORT_SYMBOL_GPL(btracker_create);
void btracker_destroy(struct background_tracker *b) { + struct bt_work *w, *tmp; + + BUG_ON(!list_empty(&b->issued)); + list_for_each_entry_safe (w, tmp, &b->queued, list) { + list_del(&w->list); + kmem_cache_free(b->work_cache, w); + } + kmem_cache_destroy(b->work_cache); kfree(b); }
From: Mikulas Patocka mpatocka@redhat.com
commit f50714b57aecb6b3dc81d578e295f86d9c73f078 upstream.
When we need to zero some range on a block device, the function __blkdev_issue_zero_pages submits a write bio with the bio vector pointing to the zero page. If we use dm-flakey with corrupt bio writes option, it will corrupt the content of the zero page which results in crashes of various userspace programs. Glibc assumes that memory returned by mmap is zeroed and it uses it for calloc implementation; if the newly mapped memory is not zeroed, calloc will return non-zeroed memory.
Fix this bug by testing if the page is equal to ZERO_PAGE(0) and avoiding the corruption in this case.
Cc: stable@vger.kernel.org Fixes: a00f5276e266 ("dm flakey: Properly corrupt multi-page bios.") Signed-off-by: Mikulas Patocka mpatocka@redhat.com Reviewed-by: Sweet Tea Dorminy sweettea-kernel@dorminy.me Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/md/dm-flakey.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-flakey.c +++ b/drivers/md/dm-flakey.c @@ -303,8 +303,11 @@ static void corrupt_bio_data(struct bio */ bio_for_each_segment(bvec, bio, iter) { if (bio_iter_len(bio, iter) > corrupt_bio_byte) { - char *segment = (page_address(bio_iter_page(bio, iter)) - + bio_iter_offset(bio, iter)); + char *segment; + struct page *page = bio_iter_page(bio, iter); + if (unlikely(page == ZERO_PAGE(0))) + break; + segment = (page_address(page) + bio_iter_offset(bio, iter)); segment[corrupt_bio_byte] = fc->corrupt_bio_value; DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
From: Mikulas Patocka mpatocka@redhat.com
commit 8eb29c4fbf9661e6bd4dd86197a37ffe0ecc9d50 upstream.
The function page_address does not work with 32-bit systems with high memory. Use bvec_kmap_local/kunmap_local instead.
Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka mpatocka@redhat.com Reviewed-by: Sweet Tea Dorminy sweettea-kernel@dorminy.me Signed-off-by: Mike Snitzer snitzer@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/md/dm-flakey.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-flakey.c +++ b/drivers/md/dm-flakey.c @@ -307,8 +307,9 @@ static void corrupt_bio_data(struct bio struct page *page = bio_iter_page(bio, iter); if (unlikely(page == ZERO_PAGE(0))) break; - segment = (page_address(page) + bio_iter_offset(bio, iter)); + segment = bvec_kmap_local(&bvec); segment[corrupt_bio_byte] = fc->corrupt_bio_value; + kunmap_local(segment); DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
From: Zev Weiss zev@bewilderbeest.net
commit f00093608fa790580da309bb9feb5108fbe7c331 upstream.
The find_last_bit() call produces the index of the highest-numbered core in core_mask; because cores are numbered from zero, the number of elements we need to allocate is one more than that.
Signed-off-by: Zev Weiss zev@bewilderbeest.net Cc: stable@kernel.org # v5.18 Fixes: bf3608f338e9 ("hwmon: peci: Add cputemp driver") Reviewed-by: Iwona Winiarska iwona.winiarska@intel.com Link: https://lore.kernel.org/r/20230202021825.21486-1-zev@bewilderbeest.net Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/hwmon/peci/cputemp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwmon/peci/cputemp.c +++ b/drivers/hwmon/peci/cputemp.c @@ -402,7 +402,7 @@ static int create_temp_label(struct peci unsigned long core_max = find_last_bit(priv->core_mask, CORE_NUMS_MAX); int i;
- priv->coretemp_label = devm_kzalloc(priv->dev, core_max * sizeof(char *), GFP_KERNEL); + priv->coretemp_label = devm_kzalloc(priv->dev, (core_max + 1) * sizeof(char *), GFP_KERNEL); if (!priv->coretemp_label) return -ENOMEM;
From: Zev Weiss zev@bewilderbeest.net
commit 2fbb848b65cde5b876cce52ebcb34de4aaa5a94a upstream.
Commit 4ef2774511dc ("hwmon: (nct6775) Convert register access to regmap API") fumbled the shifting & masking of the fan_div values such that odd-numbered fan divisors would always be set to zero. Fix it so that we actually OR in the bits we meant to.
Signed-off-by: Zev Weiss zev@bewilderbeest.net Fixes: 4ef2774511dc ("hwmon: (nct6775) Convert register access to regmap API") Cc: stable@kernel.org # v5.19+ Link: https://lore.kernel.org/r/20230102212857.5670-1-zev@bewilderbeest.net Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/hwmon/nct6775-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwmon/nct6775-core.c +++ b/drivers/hwmon/nct6775-core.c @@ -1150,7 +1150,7 @@ static int nct6775_write_fan_div(struct if (err) return err; reg &= 0x70 >> oddshift; - reg |= data->fan_div[nr] & (0x7 << oddshift); + reg |= (data->fan_div[nr] & 0x7) << oddshift; return nct6775_write_value(data, fandiv_reg, reg); }
From: Mika Westerberg mika.westerberg@linux.intel.com
commit 574fbb95cd9d88bdc9c9c4c64223a38a61d7de9a upstream.
The flash decriptor contains the number of flash components that we use to figure out how many flash chips there are connected. Therefore we need to read it first before deciding how many chip selects the controller has.
Reported-by: Marcin Witkowski marcin.witkowski@intel.com Fixes: 3f03c618bebb ("spi: intel: Add support for second flash chip") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg mika.westerberg@linux.intel.com Link: https://lore.kernel.org/r/20230215110040.42186-1-mika.westerberg@linux.intel... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/spi/spi-intel.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-intel.c b/drivers/spi/spi-intel.c index f619212b0d5c..627287925fed 100644 --- a/drivers/spi/spi-intel.c +++ b/drivers/spi/spi-intel.c @@ -1368,14 +1368,14 @@ static int intel_spi_populate_chip(struct intel_spi *ispi) if (!spi_new_device(ispi->master, &chip)) return -ENODEV;
- /* Add the second chip if present */ - if (ispi->master->num_chipselect < 2) - return 0; - ret = intel_spi_read_desc(ispi); if (ret) return ret;
+ /* Add the second chip if present */ + if (ispi->master->num_chipselect < 2) + return 0; + chip.platform_data = NULL; chip.chip_select = 1;
From: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org
commit 157178a7912e00a0aa0371dc9041952c1a21d112 upstream.
SDX65 uses the Qcom version of the SMMU-500 IP. So use "qcom,smmu-500" compatible as the fallback to the SoC specific compatible.
Cc: stable@vger.kernel.org # 5.19 Fixes: 98187f7b74bf ("ARM: dts: qcom: sdx65: Enable ARM SMMU") Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230123131931.263024-4-manivannan.sadhasivam@lina... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/qcom-sdx65.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/qcom-sdx65.dtsi +++ b/arch/arm/boot/dts/qcom-sdx65.dtsi @@ -455,7 +455,7 @@ };
apps_smmu: iommu@15000000 { - compatible = "qcom,sdx65-smmu-500", "arm,mmu-500"; + compatible = "qcom,sdx65-smmu-500", "qcom,smmu-500", "arm,mmu-500"; reg = <0x15000000 0x40000>; #iommu-cells = <2>; #global-interrupts = <1>;
From: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org
commit af4ab377543853b690cc85b4c46cf976ab560dc2 upstream.
SDX55 uses the Qcom version of the SMMU-500 IP. So use "qcom,smmu-500" compatible as the fallback to the SoC specific compatible.
Cc: stable@vger.kernel.org # 5.12 Fixes: a2bdfdfba2af ("ARM: dts: qcom: sdx55: Enable ARM SMMU") Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Signed-off-by: Bjorn Andersson andersson@kernel.org Link: https://lore.kernel.org/r/20230123131931.263024-3-manivannan.sadhasivam@lina... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/qcom-sdx55.dtsi +++ b/arch/arm/boot/dts/qcom-sdx55.dtsi @@ -578,7 +578,7 @@ };
apps_smmu: iommu@15000000 { - compatible = "qcom,sdx55-smmu-500", "arm,mmu-500"; + compatible = "qcom,sdx55-smmu-500", "qcom,smmu-500", "arm,mmu-500"; reg = <0x15000000 0x20000>; #iommu-cells = <2>; #global-interrupts = <1>;
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
commit 408ab6786dbf6dd696488054c9559681112ef994 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. Since thermal-sensors property is already defined in included exynos4-cpu-thermal.dtsi, drop it from exynos4210.dtsi to fix the error and remoev redundancy.
Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230209105841.779596-2-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/exynos4210.dtsi | 1 - 1 file changed, 1 deletion(-)
--- a/arch/arm/boot/dts/exynos4210.dtsi +++ b/arch/arm/boot/dts/exynos4210.dtsi @@ -393,7 +393,6 @@ &cpu_thermal { polling-delay-passive = <0>; polling-delay = <0>; - thermal-sensors = <&tmu 0>; };
&gic {
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
commit 8e4505e617a80f601e2f53a917611777f128f925 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle.
Fixes: 328829a6ad70 ("ARM: dts: define default thermal-zones for exynos4") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230209105841.779596-1-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi +++ b/arch/arm/boot/dts/exynos4-cpu-thermal.dtsi @@ -10,7 +10,7 @@ / { thermal-zones { cpu_thermal: cpu-thermal { - thermal-sensors = <&tmu 0>; + thermal-sensors = <&tmu>; polling-delay-passive = <0>; polling-delay = <0>; trips {
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
commit a3583e92d188ec6c58c7f603ac5e72dd8a11c21a upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. This was not critical before, but since rework of thermal Devicetree initialization in the commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization"), this leads to errors registering thermal zones other than first one:
thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 thermal_sys: Failed to find thermal zone for tmu id=0 exynos-tmu 10064000.tmu: Failed to register sensor: -2 exynos-tmu: probe of 10064000.tmu failed with error -2
Fixes: f1722d7dd8b8 ("ARM: dts: Define default thermal-zones for exynos5422") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230209105841.779596-6-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi @@ -50,7 +50,7 @@
thermal-zones { cpu0_thermal: cpu0-thermal { - thermal-sensors = <&tmu_cpu0 0>; + thermal-sensors = <&tmu_cpu0>; polling-delay-passive = <250>; polling-delay = <0>; trips { @@ -139,7 +139,7 @@ }; }; cpu1_thermal: cpu1-thermal { - thermal-sensors = <&tmu_cpu1 0>; + thermal-sensors = <&tmu_cpu1>; polling-delay-passive = <250>; polling-delay = <0>; trips { @@ -212,7 +212,7 @@ }; }; cpu2_thermal: cpu2-thermal { - thermal-sensors = <&tmu_cpu2 0>; + thermal-sensors = <&tmu_cpu2>; polling-delay-passive = <250>; polling-delay = <0>; trips { @@ -285,7 +285,7 @@ }; }; cpu3_thermal: cpu3-thermal { - thermal-sensors = <&tmu_cpu3 0>; + thermal-sensors = <&tmu_cpu3>; polling-delay-passive = <250>; polling-delay = <0>; trips { @@ -358,7 +358,7 @@ }; }; gpu_thermal: gpu-thermal { - thermal-sensors = <&tmu_gpu 0>; + thermal-sensors = <&tmu_gpu>; polling-delay-passive = <250>; polling-delay = <0>; trips {
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
commit 33e2c595e2e4016991ead44933a29d1ef93d5f26 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle.
Cc: stable@vger.kernel.org Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") Link: https://lore.kernel.org/r/20230209105841.779596-3-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/exynos5250.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/exynos5250.dtsi +++ b/arch/arm/boot/dts/exynos5250.dtsi @@ -1107,7 +1107,7 @@ &cpu_thermal { polling-delay-passive = <0>; polling-delay = <0>; - thermal-sensors = <&tmu 0>; + thermal-sensors = <&tmu>;
cooling-maps { map0 {
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
commit 9372eca505e7a19934d750b4b4c89a3652738e66 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. Since thermal-sensors property is already defined in included exynosi5410.dtsi, drop it from exynos5410-odroidxu.dts to fix the error and remoev redundancy.
Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230209105841.779596-4-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 - 1 file changed, 1 deletion(-)
--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts +++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts @@ -120,7 +120,6 @@ };
&cpu0_thermal { - thermal-sensors = <&tmu_cpu0 0>; polling-delay-passive = <0>; polling-delay = <0>;
From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org
commit 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 upstream.
TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. This was not critical before, but since rework of thermal Devicetree initialization in the commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization"), this leads to errors registering thermal zones other than first one:
thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 thermal_sys: Failed to find thermal zone for tmu id=0 exynos-tmu 10064000.tmu: Failed to register sensor: -2 exynos-tmu: probe of 10064000.tmu failed with error -2
Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230209105841.779596-5-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts +++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts @@ -31,7 +31,7 @@
thermal-zones { cpu0_thermal: cpu0-thermal { - thermal-sensors = <&tmu_cpu0 0>; + thermal-sensors = <&tmu_cpu0>; trips { cpu0_alert0: cpu-alert-0 { temperature = <70000>; /* millicelsius */ @@ -86,7 +86,7 @@ }; }; cpu1_thermal: cpu1-thermal { - thermal-sensors = <&tmu_cpu1 0>; + thermal-sensors = <&tmu_cpu1>; trips { cpu1_alert0: cpu-alert-0 { temperature = <70000>; @@ -130,7 +130,7 @@ }; }; cpu2_thermal: cpu2-thermal { - thermal-sensors = <&tmu_cpu2 0>; + thermal-sensors = <&tmu_cpu2>; trips { cpu2_alert0: cpu-alert-0 { temperature = <70000>; @@ -174,7 +174,7 @@ }; }; cpu3_thermal: cpu3-thermal { - thermal-sensors = <&tmu_cpu3 0>; + thermal-sensors = <&tmu_cpu3>; trips { cpu3_alert0: cpu-alert-0 { temperature = <70000>; @@ -218,7 +218,7 @@ }; }; gpu_thermal: gpu-thermal { - thermal-sensors = <&tmu_gpu 0>; + thermal-sensors = <&tmu_gpu>; trips { gpu_alert0: gpu-alert-0 { temperature = <70000>;
From: Sudeep Holla sudeep.holla@arm.com
commit 1b561d3949f8478c5403c9752b5533211a757226 upstream.
Allocated 'ffh_ctxt' memory leak is possible if the SMCCC version and conduit checks fail and -EOPNOTSUPP is returned without freeing the allocated memory.
Fix the same by moving the allocation after the SMCCC version and conduit checks.
Fixes: 1d280ce099db ("arm64: Add architecture specific ACPI FFH Opregion callbacks") Cc: stable@vger.kernel.org # 6.2.x Cc: Will Deacon will@kernel.org Reported-by: kernel test robot lkp@intel.com Reported-by: Dan Carpenter error27@gmail.com Suggested-by: Dan Carpenter error27@gmail.com Link: https://lore.kernel.org/r/202302191417.dAl9NuE8-lkp@intel.com/ Signed-off-by: Sudeep Holla sudeep.holla@arm.com Link: https://lore.kernel.org/r/20230223135742.2952091-1-sudeep.holla@arm.com Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm64/kernel/acpi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c index 378453faa87e..dba8fcec7f33 100644 --- a/arch/arm64/kernel/acpi.c +++ b/arch/arm64/kernel/acpi.c @@ -435,10 +435,6 @@ int acpi_ffh_address_space_arch_setup(void *handler_ctxt, void **region_ctxt) enum arm_smccc_conduit conduit; struct acpi_ffh_data *ffh_ctxt;
- ffh_ctxt = kzalloc(sizeof(*ffh_ctxt), GFP_KERNEL); - if (!ffh_ctxt) - return -ENOMEM; - if (arm_smccc_get_version() < ARM_SMCCC_VERSION_1_2) return -EOPNOTSUPP;
@@ -448,6 +444,10 @@ int acpi_ffh_address_space_arch_setup(void *handler_ctxt, void **region_ctxt) return -EOPNOTSUPP; }
+ ffh_ctxt = kzalloc(sizeof(*ffh_ctxt), GFP_KERNEL); + if (!ffh_ctxt) + return -ENOMEM; + if (conduit == SMCCC_CONDUIT_SMC) { ffh_ctxt->invoke_ffh_fn = __arm_smccc_smc; ffh_ctxt->invoke_ffh64_fn = arm_smccc_1_2_smc;
From: Catalin Marinas catalin.marinas@arm.com
commit 060a2c92d1b627c86c5c42ca69baf00457c00c5a upstream.
Revert the HUGETLB_PAGE_FREE_VMEMMAP selection from commit 1e63ac088f20 ("arm64: mm: hugetlb: enable HUGETLB_PAGE_FREE_VMEMMAP for arm64") but keep the flush_dcache_page() compound_head() change as it aligns with the corresponding check in the __sync_icache_dcache() function.
The original config option was renamed in commit 47010c040dec ("mm: hugetlb_vmemmap: cleanup CONFIG_HUGETLB_PAGE_FREE_VMEMMAP*") to HUGETLB_PAGE_OPTIMIZE_VMEMMAP and the flush_dcache_page() check was further simplified by commit 2da1c30929a2 ("mm: hugetlb_vmemmap: delete hugetlb_optimize_vmemmap_enabled()").
The reason for the revert is that the generic vmemmap_remap_pte() function changes both the permissions (writeable to read-only) and the output address (pfn) of the vmemmap ptes. This is deemed UNPREDICTABLE by the Arm architecture without a break-before-make sequence (make the PTE invalid, TLBI, write the new valid PTE). However, such sequence is not possible since the vmemmap may be concurrently accessed by the kernel. Disable the optimisation until a better solution is found.
Fixes: 1e63ac088f20 ("arm64: mm: hugetlb: enable HUGETLB_PAGE_FREE_VMEMMAP for arm64") Cc: stable@vger.kernel.org # 5.19.x Cc: Muchun Song muchun.song@linux.dev Cc: Will Deacon will@kernel.org Cc: Anshuman Khandual anshuman.khandual@arm.com Link: https://lore.kernel.org/r/Y9pZALdn3pKiJUeQ@arm.com Reviewed-by: Anshuman Khandual anshuman.khandual@arm.com Link: https://lore.kernel.org/r/20230222175232.540851-1-catalin.marinas@arm.com Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm64/Kconfig | 1 - 1 file changed, 1 deletion(-)
--- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -100,7 +100,6 @@ config ARM64 select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT select ARCH_WANT_FRAME_POINTERS select ARCH_WANT_HUGE_PMD_SHARE if ARM64_4K_PAGES || (ARM64_16K_PAGES && !ARM64_VA_BITS_36) - select ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP select ARCH_WANT_LD_ORPHAN_WARN select ARCH_WANTS_NO_INSTR select ARCH_WANTS_THP_SWAP if ARM64_4K_PAGES
From: Peter Collingbourne pcc@google.com
commit e74a68468062d7ebd8ce17069e12ccc64cc6a58c upstream.
During page migration, the copy_highpage function is used to copy the page data to the target page. If the source page is a userspace page with MTE tags, the KASAN tag of the target page must have the match-all tag in order to avoid tag check faults during subsequent accesses to the page by the kernel. However, the target page may have been allocated in a number of ways, some of which will use the KASAN allocator and will therefore end up setting the KASAN tag to a non-match-all tag. Therefore, update the target page's KASAN tag to match the source page.
We ended up unintentionally fixing this issue as a result of a bad merge conflict resolution between commit e059853d14ca ("arm64: mte: Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags""), which preserved a tag reset for PG_mte_tagged pages which was considered to be unnecessary at the time. Because SW tags KASAN uses separate tag storage, update the code to only reset the tags when HW tags KASAN is enabled.
Signed-off-by: Peter Collingbourne pcc@google.com Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830... Reported-by: "Kuan-Ying Lee (李冠穎)" Kuan-Ying.Lee@mediatek.com Cc: stable@vger.kernel.org # 6.1 Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"") Reviewed-by: Andrey Konovalov andreyknvl@gmail.com Link: https://lore.kernel.org/r/20230215050911.1433132-1-pcc@google.com Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm64/mm/copypage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/arm64/mm/copypage.c +++ b/arch/arm64/mm/copypage.c @@ -22,7 +22,8 @@ void copy_highpage(struct page *to, stru copy_page(kto, kfrom);
if (system_supports_mte() && page_mte_tagged(from)) { - page_kasan_tag_reset(to); + if (kasan_hw_tags_enabled()) + page_kasan_tag_reset(to); /* It's a new page, shouldn't have been tagged yet */ WARN_ON_ONCE(!try_page_mte_tagging(to)); mte_copy_page_tags(kto, kfrom);
From: Alexander Mikhalitsyn aleksandr.mikhalitsyn@canonical.com
commit 1cc4606d19e3710bfab3f6704b87ff9580493c69 upstream.
It looks like these checks were accidentally lost during the conversion to fileattr API.
Fixes: 72227eac177d ("fuse: convert to fileattr") Cc: stable@vger.kernel.org # v5.13 Signed-off-by: Alexander Mikhalitsyn aleksandr.mikhalitsyn@canonical.com Signed-off-by: Miklos Szeredi mszeredi@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/fuse/ioctl.c | 6 ++++++ 1 file changed, 6 insertions(+)
--- a/fs/fuse/ioctl.c +++ b/fs/fuse/ioctl.c @@ -419,6 +419,12 @@ static struct fuse_file *fuse_priv_ioctl struct fuse_mount *fm = get_fuse_mount(inode); bool isdir = S_ISDIR(inode->i_mode);
+ if (!fuse_allow_current_process(fm->fc)) + return ERR_PTR(-EACCES); + + if (fuse_is_bad(inode)) + return ERR_PTR(-EIO); + if (!S_ISREG(inode->i_mode) && !isdir) return ERR_PTR(-ENOTTY);
From: Ilya Dryomov idryomov@gmail.com
commit f7c4d9b133c7a04ca619355574e96b6abf209fba upstream.
If getting an ID or setting up a work queue in rbd_dev_create() fails, use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts is triggered in do_rbd_add(). The root cause is that the ownership of these structures is transfered to rbd_dev prematurely and they all end up getting freed when rbd_dev_create() calls rbd_dev_free() prior to returning to do_rbd_add().
Found by Linux Verification Center (linuxtesting.org) with SVACE, an incomplete patch submitted by Natalia Petrova n.petrova@fintech.ru.
Cc: stable@vger.kernel.org Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue") Signed-off-by: Ilya Dryomov idryomov@gmail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/block/rbd.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
--- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -5292,8 +5292,7 @@ static void rbd_dev_release(struct devic module_put(THIS_MODULE); }
-static struct rbd_device *__rbd_dev_create(struct rbd_client *rbdc, - struct rbd_spec *spec) +static struct rbd_device *__rbd_dev_create(struct rbd_spec *spec) { struct rbd_device *rbd_dev;
@@ -5338,9 +5337,6 @@ static struct rbd_device *__rbd_dev_crea rbd_dev->dev.parent = &rbd_root_dev; device_initialize(&rbd_dev->dev);
- rbd_dev->rbd_client = rbdc; - rbd_dev->spec = spec; - return rbd_dev; }
@@ -5353,12 +5349,10 @@ static struct rbd_device *rbd_dev_create { struct rbd_device *rbd_dev;
- rbd_dev = __rbd_dev_create(rbdc, spec); + rbd_dev = __rbd_dev_create(spec); if (!rbd_dev) return NULL;
- rbd_dev->opts = opts; - /* get an id and fill in device name */ rbd_dev->dev_id = ida_simple_get(&rbd_dev_id_ida, 0, minor_to_rbd_dev_id(1 << MINORBITS), @@ -5375,6 +5369,10 @@ static struct rbd_device *rbd_dev_create /* we have a ref from do_rbd_add() */ __module_get(THIS_MODULE);
+ rbd_dev->rbd_client = rbdc; + rbd_dev->spec = spec; + rbd_dev->opts = opts; + dout("%s rbd_dev %p dev_id %d\n", __func__, rbd_dev, rbd_dev->dev_id); return rbd_dev;
@@ -6736,7 +6734,7 @@ static int rbd_dev_probe_parent(struct r goto out_err; }
- parent = __rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec); + parent = __rbd_dev_create(rbd_dev->parent_spec); if (!parent) { ret = -ENOMEM; goto out_err; @@ -6746,8 +6744,8 @@ static int rbd_dev_probe_parent(struct r * Images related by parent/child relationships always share * rbd_client and spec/parent_spec, so bump their refcounts. */ - __rbd_get_client(rbd_dev->rbd_client); - rbd_spec_get(rbd_dev->parent_spec); + parent->rbd_client = __rbd_get_client(rbd_dev->rbd_client); + parent->spec = rbd_spec_get(rbd_dev->parent_spec);
__set_bit(RBD_DEV_FLAG_READONLY, &parent->flags);
From: Xiubo Li xiubli@redhat.com
commit e027253c4b77d395798600a90b6a96fe4adf4d5e upstream.
The fallocate will try to clear the suid/sgid if a unprevileged user changed the file.
There is no POSIX item requires that we should clear the suid/sgid in fallocate code path but this is the default behaviour for most of the filesystems and the VFS layer. And also the same for the write code path, which have already support it.
And also we need to update the time stamps since the fallocate will change the file contents.
Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/58054 Signed-off-by: Xiubo Li xiubli@redhat.com Reviewed-by: Jeff Layton jlayton@kernel.org Signed-off-by: Ilya Dryomov idryomov@gmail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ceph/file.c | 8 ++++++++ 1 file changed, 8 insertions(+)
--- a/fs/ceph/file.c +++ b/fs/ceph/file.c @@ -2102,6 +2102,9 @@ static long ceph_fallocate(struct file * loff_t endoff = 0; loff_t size;
+ dout("%s %p %llx.%llx mode %x, offset %llu length %llu\n", __func__, + inode, ceph_vinop(inode), mode, offset, length); + if (mode != (FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE)) return -EOPNOTSUPP;
@@ -2136,6 +2139,10 @@ static long ceph_fallocate(struct file * if (ret < 0) goto unlock;
+ ret = file_modified(file); + if (ret) + goto put_caps; + filemap_invalidate_lock(inode->i_mapping); ceph_fscache_invalidate(inode, false); ceph_zero_pagecache_range(inode, offset, length); @@ -2151,6 +2158,7 @@ static long ceph_fallocate(struct file * } filemap_invalidate_unlock(inode->i_mapping);
+put_caps: ceph_put_cap_refs(ci, got); unlock: inode_unlock(inode);
From: Matthias Kaehlcke mka@chromium.org
commit 80d2c29e09e663761c2778167a625b25ffe01b6f upstream.
For regulators with 'off-on-delay-us' the regulator framework currently uses ktime_get() to determine how long the regulator has been off before re-enabling it (after a delay if needed). A problem with using ktime_get() is that it doesn't account for the time the system is suspended. As a result a regulator with a longer 'off-on-delay' (e.g. 500ms) that was switched off during suspend might still incurr in a delay on resume before it is re-enabled, even though the regulator might have been off for hours. ktime_get_boottime() accounts for suspend time, use it instead of ktime_get().
Fixes: a8ce7bd89689 ("regulator: core: Fix off_on_delay handling") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Matthias Kaehlcke mka@chromium.org Reviewed-by: Stephen Boyd swboyd@chromium.org Link: https://lore.kernel.org/r/20230223003301.v2.1.I9719661b8eb0a73b8c416f9c26cf5... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/regulator/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -1584,7 +1584,7 @@ static int set_machine_constraints(struc }
if (rdev->desc->off_on_delay) - rdev->last_off = ktime_get(); + rdev->last_off = ktime_get_boottime();
/* If the constraints say the regulator should be on at this point * and we have control then make sure it is enabled. @@ -2673,7 +2673,7 @@ static int _regulator_do_enable(struct r * this regulator was disabled. */ ktime_t end = ktime_add_us(rdev->last_off, rdev->desc->off_on_delay); - s64 remaining = ktime_us_delta(end, ktime_get()); + s64 remaining = ktime_us_delta(end, ktime_get_boottime());
if (remaining > 0) _regulator_delay_helper(remaining); @@ -2912,7 +2912,7 @@ static int _regulator_do_disable(struct }
if (rdev->desc->off_on_delay) - rdev->last_off = ktime_get(); + rdev->last_off = ktime_get_boottime();
trace_regulator_disable_complete(rdev_get_name(rdev));
From: Guilherme G. Piccoli gpiccoli@igalia.com
commit b905039e428d639adeebb719b76f98865ea38d4d upstream.
Commit 8d470a45d1a6 ("panic: add option to dump all CPUs backtraces in panic_print") introduced a setting for the "panic_print" kernel parameter to allow users to request a NMI backtrace on panic. Problem is that the panic_print handling happens after the secondary CPUs are already disabled, hence this option ended-up being kind of a no-op - kernel skips the NMI trace in idling CPUs, which is the case of offline CPUs.
Fix it by checking the NMI backtrace bit in the panic_print prior to the CPU disabling function.
Link: https://lkml.kernel.org/r/20230226160838.414257-1-gpiccoli@igalia.com Fixes: 8d470a45d1a6 ("panic: add option to dump all CPUs backtraces in panic_print") Signed-off-by: Guilherme G. Piccoli gpiccoli@igalia.com Cc: stable@vger.kernel.org Cc: Baoquan He bhe@redhat.com Cc: Dave Young dyoung@redhat.com Cc: Feng Tang feng.tang@intel.com Cc: HATAYAMA Daisuke d.hatayama@jp.fujitsu.com Cc: Hidehiro Kawai hidehiro.kawai.ez@hitachi.com Cc: Kees Cook keescook@chromium.org Cc: Michael Kelley mikelley@microsoft.com Cc: Petr Mladek pmladek@suse.com Cc: Vivek Goyal vgoyal@redhat.com Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/panic.c | 44 ++++++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 18 deletions(-)
--- a/kernel/panic.c +++ b/kernel/panic.c @@ -212,9 +212,6 @@ static void panic_print_sys_info(bool co return; }
- if (panic_print & PANIC_PRINT_ALL_CPU_BT) - trigger_all_cpu_backtrace(); - if (panic_print & PANIC_PRINT_TASK_INFO) show_state();
@@ -244,6 +241,30 @@ void check_panic_on_warn(const char *ori origin, limit); }
+/* + * Helper that triggers the NMI backtrace (if set in panic_print) + * and then performs the secondary CPUs shutdown - we cannot have + * the NMI backtrace after the CPUs are off! + */ +static void panic_other_cpus_shutdown(bool crash_kexec) +{ + if (panic_print & PANIC_PRINT_ALL_CPU_BT) + trigger_all_cpu_backtrace(); + + /* + * Note that smp_send_stop() is the usual SMP shutdown function, + * which unfortunately may not be hardened to work in a panic + * situation. If we want to do crash dump after notifier calls + * and kmsg_dump, we will need architecture dependent extra + * bits in addition to stopping other CPUs, hence we rely on + * crash_smp_send_stop() for that. + */ + if (!crash_kexec) + smp_send_stop(); + else + crash_smp_send_stop(); +} + /** * panic - halt the system * @fmt: The text string to print @@ -334,23 +355,10 @@ void panic(const char *fmt, ...) * * Bypass the panic_cpu check and call __crash_kexec directly. */ - if (!_crash_kexec_post_notifiers) { + if (!_crash_kexec_post_notifiers) __crash_kexec(NULL);
- /* - * Note smp_send_stop is the usual smp shutdown function, which - * unfortunately means it may not be hardened to work in a - * panic situation. - */ - smp_send_stop(); - } else { - /* - * If we want to do crash dump after notifier calls and - * kmsg_dump, we will need architecture dependent extra - * works in addition to stopping other CPUs. - */ - crash_smp_send_stop(); - } + panic_other_cpus_shutdown(_crash_kexec_post_notifiers);
/* * Run any panic handlers, including those that might need to
From: Naoya Horiguchi naoya.horiguchi@nec.com
commit 6da6b1d4a7df8c35770186b53ef65d388398e139 upstream.
After a memory error happens on a clean folio, a process unexpectedly receives SIGBUS when it accesses the error page. This SIGBUS killing is pointless and simply degrades the level of RAS of the system, because the clean folio can be dropped without any data lost on memory error handling as we do for a clean pagecache.
When memory_failure() is called on a clean folio, try_to_unmap() is called twice (one from split_huge_page() and one from hwpoison_user_mappings()). The root cause of the issue is that pte conversion to hwpoisoned entry is now done in the first call of try_to_unmap() because PageHWPoison is already set at this point, while it's actually expected to be done in the second call. This behavior disturbs the error handling operation like removing pagecache, which results in the malfunction described above.
So convert TTU_IGNORE_HWPOISON into TTU_HWPOISON and set TTU_HWPOISON only when we really intend to convert pte to hwpoison entry. This can prevent other callers of try_to_unmap() from accidentally converting to hwpoison entries.
Link: https://lkml.kernel.org/r/20230221085905.1465385-1-naoya.horiguchi@linux.dev Fixes: a42634a6c07d ("readahead: Use a folio in read_pages()") Signed-off-by: Naoya Horiguchi naoya.horiguchi@nec.com Cc: David Hildenbrand david@redhat.com Cc: Hugh Dickins hughd@google.com Cc: Matthew Wilcox willy@infradead.org Cc: Miaohe Lin linmiaohe@huawei.com Cc: Minchan Kim minchan@kernel.org Cc: Vlastimil Babka vbabka@suse.cz Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- include/linux/rmap.h | 2 +- mm/memory-failure.c | 8 ++++---- mm/rmap.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-)
--- a/include/linux/rmap.h +++ b/include/linux/rmap.h @@ -94,7 +94,7 @@ enum ttu_flags { TTU_SPLIT_HUGE_PMD = 0x4, /* split huge PMD if any */ TTU_IGNORE_MLOCK = 0x8, /* ignore mlock */ TTU_SYNC = 0x10, /* avoid racy checks with PVMW_SYNC */ - TTU_IGNORE_HWPOISON = 0x20, /* corrupted page is recoverable */ + TTU_HWPOISON = 0x20, /* do convert pte to hwpoison entry */ TTU_BATCH_FLUSH = 0x40, /* Batch TLB flushes where possible * and caller guarantees they will * do a final flush if necessary */ --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1034,7 +1034,7 @@ static int me_pagecache_dirty(struct pag * cache and swap cache(ie. page is freshly swapped in). So it could be * referenced concurrently by 2 types of PTEs: * normal PTEs and swap PTEs. We try to handle them consistently by calling - * try_to_unmap(TTU_IGNORE_HWPOISON) to convert the normal PTEs to swap PTEs, + * try_to_unmap(!TTU_HWPOISON) to convert the normal PTEs to swap PTEs, * and then * - clear dirty bit to prevent IO * - remove from LRU @@ -1415,7 +1415,7 @@ static bool hwpoison_user_mappings(struc int flags, struct page *hpage) { struct folio *folio = page_folio(hpage); - enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_SYNC; + enum ttu_flags ttu = TTU_IGNORE_MLOCK | TTU_SYNC | TTU_HWPOISON; struct address_space *mapping; LIST_HEAD(tokill); bool unmap_success; @@ -1445,7 +1445,7 @@ static bool hwpoison_user_mappings(struc
if (PageSwapCache(p)) { pr_err("%#lx: keeping poisoned page in swap cache\n", pfn); - ttu |= TTU_IGNORE_HWPOISON; + ttu &= ~TTU_HWPOISON; }
/* @@ -1460,7 +1460,7 @@ static bool hwpoison_user_mappings(struc if (page_mkclean(hpage)) { SetPageDirty(hpage); } else { - ttu |= TTU_IGNORE_HWPOISON; + ttu &= ~TTU_HWPOISON; pr_info("%#lx: corrupted page was clean: dropped without side effects\n", pfn); } --- a/mm/rmap.c +++ b/mm/rmap.c @@ -1615,7 +1615,7 @@ static bool try_to_unmap_one(struct foli /* Update high watermark before we lower rss */ update_hiwater_rss(mm);
- if (PageHWPoison(subpage) && !(flags & TTU_IGNORE_HWPOISON)) { + if (PageHWPoison(subpage) && (flags & TTU_HWPOISON)) { pteval = swp_entry_to_pte(make_hwpoison_entry(subpage)); if (folio_test_hugetlb(folio)) { hugetlb_count_sub(folio_nr_pages(folio), mm);
From: Thomas Gleixner tglx@linutronix.de
commit 0fb7fb713461e44b12e72c292bf90ee300f40710 upstream.
Miquel reported a warning in the MSI core which is triggered when interrupts are freed via platform_msi_device_domain_free().
This code got reworked to use core functions for freeing the MSI descriptors, but nothing took care to clear the msi_desc->irq entry, which then triggers the warning in msi_free_msi_desc() which uses desc->irq to validate that the descriptor has been torn down. The same issue exists in msi_domain_populate_irqs().
Up to the point that msi_free_msi_descs() grew a warning for this case, this went un-noticed.
Provide the counterpart of msi_domain_populate_irqs() and invoke it in platform_msi_device_domain_free() before freeing the interrupts and MSI descriptors and also in the error path of msi_domain_populate_irqs().
Fixes: 2f2940d16823 ("genirq/msi: Remove filter from msi_free_descs_free_range()") Reported-by: Miquel Raynal miquel.raynal@bootlin.com Signed-off-by: Thomas Gleixner tglx@linutronix.de Tested-by: Miquel Raynal miquel.raynal@bootlin.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87mt4wkwnv.ffs@tglx Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/base/platform-msi.c | 1 + include/linux/msi.h | 2 ++ kernel/irq/msi.c | 23 ++++++++++++++++++++++- 3 files changed, 25 insertions(+), 1 deletion(-)
diff --git a/drivers/base/platform-msi.c b/drivers/base/platform-msi.c index 5883e7634a2b..f37ad34c80ec 100644 --- a/drivers/base/platform-msi.c +++ b/drivers/base/platform-msi.c @@ -324,6 +324,7 @@ void platform_msi_device_domain_free(struct irq_domain *domain, unsigned int vir struct platform_msi_priv_data *data = domain->host_data;
msi_lock_descs(data->dev); + msi_domain_depopulate_descs(data->dev, virq, nr_irqs); irq_domain_free_irqs_common(domain, virq, nr_irqs); msi_free_msi_descs_range(data->dev, virq, virq + nr_irqs - 1); msi_unlock_descs(data->dev); diff --git a/include/linux/msi.h b/include/linux/msi.h index a112b913fff9..15dd71817996 100644 --- a/include/linux/msi.h +++ b/include/linux/msi.h @@ -631,6 +631,8 @@ int msi_domain_prepare_irqs(struct irq_domain *domain, struct device *dev, int nvec, msi_alloc_info_t *args); int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev, int virq, int nvec, msi_alloc_info_t *args); +void msi_domain_depopulate_descs(struct device *dev, int virq, int nvec); + struct irq_domain * __platform_msi_create_device_domain(struct device *dev, unsigned int nvec, diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c index efd21b79bf32..d169ee0c1799 100644 --- a/kernel/irq/msi.c +++ b/kernel/irq/msi.c @@ -1109,14 +1109,35 @@ int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev, return 0;
fail: - for (--virq; virq >= virq_base; virq--) + for (--virq; virq >= virq_base; virq--) { + msi_domain_depopulate_descs(dev, virq, 1); irq_domain_free_irqs_common(domain, virq, 1); + } msi_domain_free_descs(dev, &ctrl); unlock: msi_unlock_descs(dev); return ret; }
+void msi_domain_depopulate_descs(struct device *dev, int virq_base, int nvec) +{ + struct msi_ctrl ctrl = { + .domid = MSI_DEFAULT_DOMAIN, + .first = virq_base, + .last = virq_base + nvec - 1, + }; + struct msi_desc *desc; + struct xarray *xa; + unsigned long idx; + + if (!msi_ctrl_valid(dev, &ctrl)) + return; + + xa = &dev->msi.data->__domains[ctrl.domid].store; + xa_for_each_range(xa, idx, desc, ctrl.first, ctrl.last) + desc->irq = 0; +} + /* * Carefully check whether the device can use reservation mode. If * reservation mode is enabled then the early activation will assign a
From: Marc Zyngier maz@kernel.org
commit 0af2795f936f1ea1f9f1497447145dfcc7ed2823 upstream.
Calling msi_ctrl_valid() ultimately results in calling msi_get_device_domain(), which requires holding the device MSI lock.
However, in msi_domain_populate_irqs() the lock is taken right after having called msi_ctrl_valid(), which is just a tad too late.
Take the lock before invoking msi_ctrl_valid().
Fixes: 40742716f294 ("genirq/msi: Make msi_add_simple_msi_descs() device domain aware") Reported-by: "Russell King (Oracle)" linux@armlinux.org.uk Signed-off-by: Marc Zyngier maz@kernel.org Signed-off-by: Thomas Gleixner tglx@linutronix.de Tested-by: Russell King (Oracle) rmk+kernel@armlinux.org.uk Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/Y/Opu6ETe3ZzZ/8E@shell.armlinux.org.uk Link: https://lore.kernel.org/r/20230220190101.314446-1-maz@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/irq/msi.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c index 783a3e6a0b10..13d96495e6d0 100644 --- a/kernel/irq/msi.c +++ b/kernel/irq/msi.c @@ -1084,10 +1084,13 @@ int msi_domain_populate_irqs(struct irq_domain *domain, struct device *dev, struct xarray *xa; int ret, virq;
- if (!msi_ctrl_valid(dev, &ctrl)) - return -EINVAL; - msi_lock_descs(dev); + + if (!msi_ctrl_valid(dev, &ctrl)) { + ret = -EINVAL; + goto unlock; + } + ret = msi_domain_add_simple_msi_descs(dev, &ctrl); if (ret) goto unlock;
From: Dhruva Gole d-gole@ti.com
commit 078a5517d22342eb0474046d3e891427a2552e3c upstream.
Replace the SPI_TX_OCTAL flag that appeared two time with SPI_RX_OCTAL in the chain of '|' operators while assigning to mode_bits
Fixes: 1b74dd64c861 ("spi: Add Socionext F_OSPI SPI flash controller driver")
Reported-by: David Binderman dcb314@hotmail.com Link: https://lore.kernel.org/all/DB6P189MB0568F3BE9384315F5C8C1A3E9CA49@DB6P189MB...
Cc: stable@vger.kernel.org Signed-off-by: Dhruva Gole d-gole@ti.com Link: https://lore.kernel.org/r/20230223095202.924626-1-d-gole@ti.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/spi/spi-sn-f-ospi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/spi/spi-sn-f-ospi.c b/drivers/spi/spi-sn-f-ospi.c index 348c6e1edd38..333b22dfd8db 100644 --- a/drivers/spi/spi-sn-f-ospi.c +++ b/drivers/spi/spi-sn-f-ospi.c @@ -611,7 +611,7 @@ static int f_ospi_probe(struct platform_device *pdev) return -ENOMEM;
ctlr->mode_bits = SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL - | SPI_RX_DUAL | SPI_RX_QUAD | SPI_TX_OCTAL + | SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL | SPI_MODE_0 | SPI_MODE_1 | SPI_LSB_FIRST; ctlr->mem_ops = &f_ospi_mem_ops; ctlr->bus_num = -1;
From: Al Viro viro@zeniv.linux.org.uk
commit 977a3009547dad4a5bc95d91be4a58c9f7eedac0 upstream.
Type 3 instruction fault (FPU insn with FPU disabled) is handled by quietly enabling FPU and returning. Which is fine, except that we need to do that both for fault in userland and in the kernel; the latter *can* legitimately happen - all it takes is this:
.global _start _start: call_pal 0xae lda $0, 0 ldq $0, 0($0)
- call_pal CLRFEN to clear "FPU enabled" flag and arrange for a signal delivery (SIGSEGV in this case).
Fixed by moving the handling of type 3 into the common part of do_entIF(), before we check for kernel vs. user mode.
Incidentally, the check for kernel mode is unidiomatic; the normal way to do that is !user_mode(regs). The difference is that the open-coded variant treats any of bits 63..3 of regs->ps being set as "it's user mode" while the normal approach is to check just the bit 3. PS is a 4-bit register and regs->ps always will have bits 63..4 clear, so the open-coded variant here is actually equivalent to !user_mode(regs). Harder to follow, though...
Cc: stable@vger.kernel.org Reviewed-by: Richard Henderson rth@twiddle.net Signed-off-by: Al Viro viro@zeniv.linux.org.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/alpha/kernel/traps.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
--- a/arch/alpha/kernel/traps.c +++ b/arch/alpha/kernel/traps.c @@ -233,7 +233,21 @@ do_entIF(unsigned long type, struct pt_r { int signo, code;
- if ((regs->ps & ~IPL_MAX) == 0) { + if (type == 3) { /* FEN fault */ + /* Irritating users can call PAL_clrfen to disable the + FPU for the process. The kernel will then trap in + do_switch_stack and undo_switch_stack when we try + to save and restore the FP registers. + + Given that GCC by default generates code that uses the + FP registers, PAL_clrfen is not useful except for DoS + attacks. So turn the bleeding FPU back on and be done + with it. */ + current_thread_info()->pcb.flags |= 1; + __reload_thread(¤t_thread_info()->pcb); + return; + } + if (!user_mode(regs)) { if (type == 1) { const unsigned int *data = (const unsigned int *) regs->pc; @@ -366,20 +380,6 @@ do_entIF(unsigned long type, struct pt_r } break;
- case 3: /* FEN fault */ - /* Irritating users can call PAL_clrfen to disable the - FPU for the process. The kernel will then trap in - do_switch_stack and undo_switch_stack when we try - to save and restore the FP registers. - - Given that GCC by default generates code that uses the - FP registers, PAL_clrfen is not useful except for DoS - attacks. So turn the bleeding FPU back on and be done - with it. */ - current_thread_info()->pcb.flags |= 1; - __reload_thread(¤t_thread_info()->pcb); - return; - case 5: /* illoc */ default: /* unexpected instruction-fault type */ ;
From: Dan Williams dan.j.williams@intel.com
commit e686c32590f40bffc45f105c04c836ffad3e531a upstream.
While experimenting with CXL region removal the following corruption of /proc/iomem appeared.
Before: f010000000-f04fffffff : CXL Window 0 f010000000-f02fffffff : region4 f010000000-f02fffffff : dax4.0 f010000000-f02fffffff : System RAM (kmem)
After (modprobe -r cxl_test): f010000000-f02fffffff : **redacted binary garbage** f010000000-f02fffffff : System RAM (kmem)
...and testing further the same is visible with persistent memory assigned to kmem:
Before: 480000000-243fffffff : Persistent Memory 480000000-57e1fffff : namespace3.0 580000000-243fffffff : dax3.0 580000000-243fffffff : System RAM (kmem)
After (ndctl disable-region all): 480000000-243fffffff : Persistent Memory 580000000-243fffffff : ***redacted binary garbage*** 580000000-243fffffff : System RAM (kmem)
The corrupted data is from a use-after-free of the "dax4.0" and "dax3.0" resources, and it also shows that the "System RAM (kmem)" resource is not being removed. The bug does not appear after "modprobe -r kmem", it requires the parent of "dax4.0" and "dax3.0" to be removed which re-parents the leaked "System RAM (kmem)" instances. Those in turn reference the freed resource as a parent.
First up for the fix is release_mem_region_adjustable() needs to reliably delete the resource inserted by add_memory_driver_managed(). That is thwarted by a check for IORESOURCE_SYSRAM that predates the dax/kmem driver, from commit:
65c78784135f ("kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable")
That appears to be working around the behavior of HMM's "MEMORY_DEVICE_PUBLIC" facility that has since been deleted. With that check removed the "System RAM (kmem)" resource gets removed, but corruption still occurs occasionally because the "dax" resource is not reliably removed.
The dax range information is freed before the device is unregistered, so the driver can not reliably recall (another use after free) what it is meant to release. Lastly if that use after free got lucky, the driver was covering up the leak of "System RAM (kmem)" due to its use of release_resource() which detaches, but does not free, child resources. The switch to remove_resource() forces remove_memory() to be responsible for the deletion of the resource added by add_memory_driver_managed().
Fixes: c2f3011ee697 ("device-dax: add an allocation interface for device-dax instances") Cc: stable@vger.kernel.org Cc: Oscar Salvador osalvador@suse.de Cc: David Hildenbrand david@redhat.com Cc: Pavel Tatashin pasha.tatashin@soleen.com Reviewed-by: Vishal Verma vishal.l.verma@intel.com Reviewed-by: Pasha Tatashin pasha.tatashin@soleen.com Reviewed-by: Dave Jiang dave.jiang@intel.com Link: https://lore.kernel.org/r/167653656244.3147810.5705900882794040229.stgit@dwi... Signed-off-by: Dan Williams dan.j.williams@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/dax/bus.c | 2 +- drivers/dax/kmem.c | 4 ++-- kernel/resource.c | 14 -------------- 3 files changed, 3 insertions(+), 17 deletions(-)
--- a/drivers/dax/bus.c +++ b/drivers/dax/bus.c @@ -427,8 +427,8 @@ static void unregister_dev_dax(void *dev dev_dbg(dev, "%s\n", __func__);
kill_dev_dax(dev_dax); - free_dev_dax_ranges(dev_dax); device_del(dev); + free_dev_dax_ranges(dev_dax); put_device(dev); }
--- a/drivers/dax/kmem.c +++ b/drivers/dax/kmem.c @@ -146,7 +146,7 @@ static int dev_dax_kmem_probe(struct dev if (rc) { dev_warn(dev, "mapping%d: %#llx-%#llx memory add failed\n", i, range.start, range.end); - release_resource(res); + remove_resource(res); kfree(res); data->res[i] = NULL; if (mapped) @@ -195,7 +195,7 @@ static void dev_dax_kmem_remove(struct d
rc = remove_memory(range.start, range_len(&range)); if (rc == 0) { - release_resource(data->res[i]); + remove_resource(data->res[i]); kfree(data->res[i]); data->res[i] = NULL; success++; --- a/kernel/resource.c +++ b/kernel/resource.c @@ -1343,20 +1343,6 @@ retry: continue; }
- /* - * All memory regions added from memory-hotplug path have the - * flag IORESOURCE_SYSTEM_RAM. If the resource does not have - * this flag, we know that we are dealing with a resource coming - * from HMM/devm. HMM/devm use another mechanism to add/release - * a resource. This goes via devm_request_mem_region and - * devm_release_mem_region. - * HMM/devm take care to release their resources when they want, - * so if we are dealing with them, let us just back off here. - */ - if (!(res->flags & IORESOURCE_SYSRAM)) { - break; - } - if (!(res->flags & IORESOURCE_MEM)) break;
From: Elvira Khabirova lineprinter0@gmail.com
commit 85cc91e2ba4262a602ec65e2b76c4391a9e60d3d upstream.
The implementation of syscall_get_nr on mips used to ignore the task argument and return the syscall number of the calling thread instead of the target thread.
The bug was exposed to user space by commit 201766a20e30f ("ptrace: add PTRACE_GET_SYSCALL_INFO request") and detected by strace test suite.
Link: https://github.com/strace/strace/issues/235 Fixes: c2d9f1775731 ("MIPS: Fix syscall_get_nr for the syscall exit tracing.") Cc: stable@vger.kernel.org # v3.19+ Co-developed-by: Dmitry V. Levin ldv@strace.io Signed-off-by: Dmitry V. Levin ldv@strace.io Signed-off-by: Elvira Khabirova lineprinter0@gmail.com Signed-off-by: Thomas Bogendoerfer tsbogend@alpha.franken.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/mips/include/asm/syscall.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/include/asm/syscall.h +++ b/arch/mips/include/asm/syscall.h @@ -38,7 +38,7 @@ static inline bool mips_syscall_is_indir static inline long syscall_get_nr(struct task_struct *task, struct pt_regs *regs) { - return current_thread_info()->syscall; + return task_thread_info(task)->syscall; }
static inline void mips_syscall_update_nr(struct task_struct *task,
From: Sakari Ailus sakari.ailus@linux.intel.com
commit 909d3096ac99fa2289f9b8945a3eab2269947a0a upstream.
Get the PM runtime usage_count and forbid PM runtime at driver unbind. The opposite is being done in probe() already.
Fixes: commit c2a6a07afe4a ("media: intel-ipu3: cio2: add new MIPI-CSI2 driver") Cc: stable@vger.kernel.org # for >= 4.16 Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Reviewed-by: Bingbu Cao bingbu.cao@intel.com Signed-off-by: Mauro Carvalho Chehab mchehab@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +++ b/drivers/media/pci/intel/ipu3/ipu3-cio2-main.c @@ -1843,6 +1843,9 @@ static void cio2_pci_remove(struct pci_d v4l2_device_unregister(&cio2->v4l2_dev); media_device_cleanup(&cio2->media_dev); mutex_destroy(&cio2->lock); + + pm_runtime_forbid(&pci_dev->dev); + pm_runtime_get_noresume(&pci_dev->dev); }
static int __maybe_unused cio2_runtime_suspend(struct device *dev)
From: Chen-Yu Tsai wenst@chromium.org
commit e46ceea3148163166ef9b7bcac578e72dd30c064 upstream.
Clocks are properly reference counted and do not need to be inside the lock range.
Right now this triggers a false-positive lockdep warning on MT8192 based Chromebooks, through a combination of mtk-scp that has a cros-ec-rpmsg sub-device, the (actual) cros-ec I2C adapter registration, I2C client (not on cros-ec) probe doing i2c transfers and enabling clocks.
This is a false positive because the cros-ec-rpmsg under mtk-scp does not have an I2C adapter, and also each I2C adapter and cros-ec instance have their own mutex.
Move the clk operations outside of the send_lock range.
Fixes: 63c13d61eafe ("remoteproc/mediatek: add SCP support for mt8183") Signed-off-by: Chen-Yu Tsai wenst@chromium.org Reviewed-by: AngeloGioacchino Del Regno angelogioacchino.delregno@collabora.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230104083110.736377-1-wenst@chromium.org [Fixed "Fixes:" tag line] Signed-off-by: Mathieu Poirier mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/remoteproc/mtk_scp_ipi.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
--- a/drivers/remoteproc/mtk_scp_ipi.c +++ b/drivers/remoteproc/mtk_scp_ipi.c @@ -164,21 +164,21 @@ int scp_ipi_send(struct mtk_scp *scp, u3 WARN_ON(len > sizeof(send_obj->share_buf)) || WARN_ON(!buf)) return -EINVAL;
- mutex_lock(&scp->send_lock); - ret = clk_prepare_enable(scp->clk); if (ret) { dev_err(scp->dev, "failed to enable clock\n"); - goto unlock_mutex; + return ret; }
+ mutex_lock(&scp->send_lock); + /* Wait until SCP receives the last command */ timeout = jiffies + msecs_to_jiffies(2000); do { if (time_after(jiffies, timeout)) { dev_err(scp->dev, "%s: IPI timeout!\n", __func__); ret = -ETIMEDOUT; - goto clock_disable; + goto unlock_mutex; } } while (readl(scp->reg_base + scp->data->host_to_scp_reg));
@@ -205,10 +205,9 @@ int scp_ipi_send(struct mtk_scp *scp, u3 ret = 0; }
-clock_disable: - clk_disable_unprepare(scp->clk); unlock_mutex: mutex_unlock(&scp->send_lock); + clk_disable_unprepare(scp->clk);
return ret; }
From: Yan Zhao yan.y.zhao@intel.com
commit d649c34cb916b015fdcb487e51409fcc5caeca8d upstream.
group->iommufd is not initialized for the iommufd_ctx_put()
[20018.331541] BUG: kernel NULL pointer dereference, address: 0000000000000000 [20018.377508] RIP: 0010:iommufd_ctx_put+0x5/0x10 [iommufd] ... [20018.476483] Call Trace: [20018.479214] <TASK> [20018.481555] vfio_group_fops_unl_ioctl+0x506/0x690 [vfio] [20018.487586] __x64_sys_ioctl+0x6a/0xb0 [20018.491773] ? trace_hardirqs_on+0xc5/0xe0 [20018.496347] do_syscall_64+0x67/0x90 [20018.500340] entry_SYSCALL_64_after_hwframe+0x4b/0xb5
Fixes: 9eefba8002c2 ("vfio: Move vfio group specific code into group.c") Cc: stable@vger.kernel.org Signed-off-by: Yan Zhao yan.y.zhao@intel.com Reviewed-by: Jason Gunthorpe jgg@nvidia.com Reviewed-by: Yi Liu yi.l.liu@intel.com Link: https://lore.kernel.org/r/20230222074938.13681-1-yan.y.zhao@intel.com Signed-off-by: Alex Williamson alex.williamson@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/vfio/group.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/group.c b/drivers/vfio/group.c index 0e9036e2b9c4..160deff6649b 100644 --- a/drivers/vfio/group.c +++ b/drivers/vfio/group.c @@ -137,7 +137,7 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group,
ret = iommufd_vfio_compat_ioas_id(iommufd, &ioas_id); if (ret) { - iommufd_ctx_put(group->iommufd); + iommufd_ctx_put(iommufd); goto out_unlock; }
From: John Ogness john.ogness@linutronix.de
commit f2e4cca2f670c8e52fbb551a295f2afc9aa2bd72 upstream.
@head_id points to the newest record, but the printing loop exits when it increments to this value (before printing).
Exit the printing loop after the newest record has been printed.
The python-based function in scripts/gdb/linux/dmesg.py already does this correctly.
Fixes: e60768311af8 ("scripts/gdb: update for lockless printk ringbuffer") Cc: stable@vger.kernel.org Signed-off-by: John Ogness john.ogness@linutronix.de Reviewed-by: Petr Mladek pmladek@suse.com Signed-off-by: Petr Mladek pmladek@suse.com Link: https://lore.kernel.org/r/20221229134339.197627-1-john.ogness@linutronix.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- Documentation/admin-guide/kdump/gdbmacros.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/Documentation/admin-guide/kdump/gdbmacros.txt +++ b/Documentation/admin-guide/kdump/gdbmacros.txt @@ -312,10 +312,10 @@ define dmesg set var $prev_flags = $info->flags end
- set var $id = ($id + 1) & $id_mask if ($id == $end_id) loop_break end + set var $id = ($id + 1) & $id_mask end end document dmesg
From: Johannes Weiner hannes@cmpxchg.org
commit da34a8484d162585e22ed8c1e4114aa2f60e3567 upstream.
Charge moving mode in cgroup1 allows memory to follow tasks as they migrate between cgroups. This is, and always has been, a questionable thing to do - for several reasons.
First, it's expensive. Pages need to be identified, locked and isolated from various MM operations, and reassigned, one by one.
Second, it's unreliable. Once pages are charged to a cgroup, there isn't always a clear owner task anymore. Cache isn't moved at all, for example. Mapped memory is moved - but if trylocking or isolating a page fails, it's arbitrarily left behind. Frequent moving between domains may leave a task's memory scattered all over the place.
Third, it isn't really needed. Launcher tasks can kick off workload tasks directly in their target cgroup. Using dedicated per-workload groups allows fine-grained policy adjustments - no need to move tasks and their physical pages between control domains. The feature was never forward-ported to cgroup2, and it hasn't been missed.
Despite it being a niche usecase, the maintenance overhead of supporting it is enormous. Because pages are moved while they are live and subject to various MM operations, the synchronization rules are complicated. There are lock_page_memcg() in MM and FS code, which non-cgroup people don't understand. In some cases we've been able to shift code and cgroup API calls around such that we can rely on native locking as much as possible. But that's fragile, and sometimes we need to hold MM locks for longer than we otherwise would (pte lock e.g.).
Mark the feature deprecated. Hopefully we can remove it soon.
And backport into -stable kernels so that people who develop against earlier kernels are warned about this deprecation as early as possible.
[akpm@linux-foundation.org: fix memory.rst underlining] Link: https://lkml.kernel.org/r/Y5COd+qXwk/S+n8N@cmpxchg.org Signed-off-by: Johannes Weiner hannes@cmpxchg.org Acked-by: Shakeel Butt shakeelb@google.com Acked-by: Hugh Dickins hughd@google.com Acked-by: Michal Hocko mhocko@suse.com Cc: Muchun Song songmuchun@bytedance.com Cc: Roman Gushchin roman.gushchin@linux.dev Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- Documentation/admin-guide/cgroup-v1/memory.rst | 13 +++++++++++-- mm/memcontrol.c | 4 ++++ 2 files changed, 15 insertions(+), 2 deletions(-)
--- a/Documentation/admin-guide/cgroup-v1/memory.rst +++ b/Documentation/admin-guide/cgroup-v1/memory.rst @@ -86,6 +86,8 @@ Brief summary of control files. memory.swappiness set/show swappiness parameter of vmscan (See sysctl's vm.swappiness) memory.move_charge_at_immigrate set/show controls of moving charges + This knob is deprecated and shouldn't be + used. memory.oom_control set/show oom controls. memory.numa_stat show the number of memory usage per numa node @@ -717,8 +719,15 @@ NOTE2: It is recommended to set the soft limit always below the hard limit, otherwise the hard limit will take precedence.
-8. Move charges at task migration -================================= +8. Move charges at task migration (DEPRECATED!) +=============================================== + +THIS IS DEPRECATED! + +It's expensive and unreliable! It's better practice to launch workload +tasks directly from inside their target cgroup. Use dedicated workload +cgroups to allow fine-grained policy adjustments without having to +move physical pages between control domains.
Users can move charges associated with a task along with task migration, that is, uncharge task's pages from the old cgroup and charge them to the new cgroup. --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -3914,6 +3914,10 @@ static int mem_cgroup_move_charge_write( { struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+ pr_warn_once("Cgroup memory moving (move_charge_at_immigrate) is deprecated. " + "Please report your usecase to linux-mm@kvack.org if you " + "depend on this functionality.\n"); + if (val & ~MOVE_MASK) return -EINVAL;
From: Yin Fengwei fengwei.yin@intel.com
commit 81e506bec9be1eceaf5a2c654e28ba5176ef48d8 upstream.
Kernel build regression with LLVM was reported here: https://lore.kernel.org/all/Y1GCYXGtEVZbcv%2F5@dev-arch.thelio-3990X/ with commit f35b5d7d676e ("mm: align larger anonymous mappings on THP boundaries"). And the commit f35b5d7d676e was reverted.
It turned out the regression is related with madvise(MADV_DONTNEED) was used by ld.lld. But with none PMD_SIZE aligned parameter len. trace-bpfcc captured: 531607 531732 ld.lld do_madvise.part.0 start: 0x7feca9000000, len: 0x7fb000, behavior: 0x4 531607 531793 ld.lld do_madvise.part.0 start: 0x7fec86a00000, len: 0x7fb000, behavior: 0x4
If the underneath physical page is THP, the madvise(MADV_DONTNEED) can trigger split_queue_lock contention raised significantly. perf showed following data: 14.85% 0.00% ld.lld [kernel.kallsyms] [k] entry_SYSCALL_64_after_hwframe 11.52% entry_SYSCALL_64_after_hwframe do_syscall_64 __x64_sys_madvise do_madvise.part.0 zap_page_range unmap_single_vma unmap_page_range page_remove_rmap deferred_split_huge_page __lock_text_start native_queued_spin_lock_slowpath
If THP can't be removed from rmap as whole THP, partial THP will be removed from rmap by removing sub-pages from rmap. Even the THP head page is added to deferred queue already, the split_queue_lock will be acquired and check whether the THP head page is in the queue already. Thus, the contention of split_queue_lock is raised.
Before acquire split_queue_lock, check and bail out early if the THP head page is in the queue already. The checking without holding split_queue_lock could race with deferred_split_scan, but it doesn't impact the correctness here.
Test result of building kernel with ld.lld: commit 7b5a0b664ebe (parent commit of f35b5d7d676e): time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all 6:07.99 real, 26367.77 user, 5063.35 sys
commit f35b5d7d676e: time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all 7:22.15 real, 26235.03 user, 12504.55 sys
commit f35b5d7d676e with the fixing patch: time -f "\t%E real,\t%U user,\t%S sys" make LD=ld.lld -skj96 allmodconfig all 6:08.49 real, 26520.15 user, 5047.91 sys
Link: https://lkml.kernel.org/r/20221223135207.2275317-1-fengwei.yin@intel.com Signed-off-by: Yin Fengwei fengwei.yin@intel.com Tested-by: Nathan Chancellor nathan@kernel.org Acked-by: David Rientjes rientjes@google.com Reviewed-by: "Huang, Ying" ying.huang@intel.com Cc: Feng Tang feng.tang@intel.com Cc: Matthew Wilcox willy@infradead.org Cc: Rik van Riel riel@surriel.com Cc: Xing Zhengjun zhengjun.xing@linux.intel.com Cc: Yang Shi shy828301@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- mm/huge_memory.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2837,6 +2837,9 @@ void deferred_split_huge_page(struct pag if (PageSwapCache(page)) return;
+ if (!list_empty(page_deferred_list(page))) + return; + spin_lock_irqsave(&ds_queue->split_queue_lock, flags); if (list_empty(page_deferred_list(page))) { count_vm_event(THP_DEFERRED_SPLIT_PAGE);
From: Steven Rostedt rostedt@goodmis.org
commit 83d29d439cd3ef23041570d55841f814af2ecac0 upstream.
When monitoring the console output, the stdout is being redirected to do so. If Ctrl^C is hit during this mode, the stdout is not back to the console, the user does not see anything they type (no echo).
Add "end_monitor" to the SIGINT interrupt handler to give back the console on Ctrl^C.
Cc: stable@vger.kernel.org Fixes: 9f2cdcbbb90e7 ("ktest: Give console process a dedicated tty") Signed-off-by: Steven Rostedt rostedt@goodmis.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/ktest/ktest.pl | 3 +++ 1 file changed, 3 insertions(+)
--- a/tools/testing/ktest/ktest.pl +++ b/tools/testing/ktest/ktest.pl @@ -4200,6 +4200,9 @@ sub send_email { }
sub cancel_test { + if ($monitor_cnt) { + end_monitor; + } if ($email_when_canceled) { my $name = get_test_name; send_email("KTEST: Your [$name] test was cancelled",
From: Masami Hiramatsu (Google) mhiramat@kernel.org
commit 4fbd2f83fda0ca44a2ec6421ca3508b355b31858 upstream.
Since forcibly unoptimized kprobes will be put on the freeing_list directly in the unoptimize_kprobe(), do_unoptimize_kprobes() must continue to check the freeing_list even if unoptimizing_list is empty.
This bug can happen if a kprobe is put in an instruction which is in the middle of the jump-replaced instruction sequence of an optprobe, *and* the optprobe is recently unregistered and queued on unoptimizing_list. In this case, the optprobe will be unoptimized forcibly (means immediately) and put it into the freeing_list, expecting the optprobe will be handled in do_unoptimize_kprobe(). But if there is no other optprobes on the unoptimizing_list, current code returns from the do_unoptimize_kprobe() soon and does not handle the optprobe which is on the freeing_list. Then the optprobe will hit the WARN_ON_ONCE() in the do_free_cleaned_kprobes(), because it is not handled in the latter loop of the do_unoptimize_kprobe().
To solve this issue, do not return from do_unoptimize_kprobes() immediately even if unoptimizing_list is empty.
Moreover, this change affects another case. kill_optimized_kprobes() expects kprobe_optimizer() will just free the optprobe on freeing_list. So I changed it to just do list_move() to freeing_list if optprobes are on unoptimizing list. And the do_unoptimize_kprobe() will skip arch_disarm_kprobe() if the probe on freeing_list has gone flag.
Link: https://lore.kernel.org/all/Y8URdIfVr3pq2X8w@xpf.sh.intel.com/ Link: https://lore.kernel.org/all/167448024501.3253718.13037333683110512967.stgit@...
Fixes: e4add247789e ("kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic") Reported-by: Pengfei Xu pengfei.xu@intel.com Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Cc: stable@vger.kernel.org Acked-by: Steven Rostedt (Google) rostedt@goodmis.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/kprobes.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-)
--- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -555,17 +555,15 @@ static void do_unoptimize_kprobes(void) /* See comment in do_optimize_kprobes() */ lockdep_assert_cpus_held();
- /* Unoptimization must be done anytime */ - if (list_empty(&unoptimizing_list)) - return; + if (!list_empty(&unoptimizing_list)) + arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list);
- arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list); - /* Loop on 'freeing_list' for disarming */ + /* Loop on 'freeing_list' for disarming and removing from kprobe hash list */ list_for_each_entry_safe(op, tmp, &freeing_list, list) { /* Switching from detour code to origin */ op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED; - /* Disarm probes if marked disabled */ - if (kprobe_disabled(&op->kp)) + /* Disarm probes if marked disabled and not gone */ + if (kprobe_disabled(&op->kp) && !kprobe_gone(&op->kp)) arch_disarm_kprobe(&op->kp); if (kprobe_unused(&op->kp)) { /* @@ -797,14 +795,13 @@ static void kill_optimized_kprobe(struct op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
if (kprobe_unused(p)) { - /* Enqueue if it is unused */ - list_add(&op->list, &freeing_list); /* - * Remove unused probes from the hash list. After waiting - * for synchronization, this probe is reclaimed. - * (reclaiming is done by do_free_cleaned_kprobes().) + * Unused kprobe is on unoptimizing or freeing list. We move it + * to freeing_list and let the kprobe_optimizer() remove it from + * the kprobe hash list and free it. */ - hlist_del_rcu(&op->kp.hlist); + if (optprobe_queued_unopt(op)) + list_move(&op->list, &freeing_list); }
/* Don't touch the code, because it is already freed. */
From: Steven Rostedt rostedt@goodmis.org
commit e8bf9b98d40dbdf4e39362e3b85a70c61da68cb7 upstream.
In the "reboot" command, it does a check of the machine to see if it is still alive with a simple "ssh echo" command. If it fails, it will assume that a normal "ssh reboot" is not possible and force a power cycle.
In this case, the "start_monitor" is executed, but the "end_monitor" is not, and this causes the screen will not be given back to the console. That is, after the test, a "reset" command needs to be performed, as "echo" is turned off.
Cc: stable@vger.kernel.org Fixes: 6474ace999edd ("ktest.pl: Powercycle the box on reboot if no connection can be made") Signed-off-by: Steven Rostedt rostedt@goodmis.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/ktest/ktest.pl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/tools/testing/ktest/ktest.pl +++ b/tools/testing/ktest/ktest.pl @@ -1495,7 +1495,8 @@ sub reboot {
# Still need to wait for the reboot to finish wait_for_monitor($time, $reboot_success_line); - + } + if ($powercycle || $time) { end_monitor; } }
From: Steven Rostedt rostedt@goodmis.org
commit 4e7d2a8f0b52abf23b1dc13b3d88bc0923383cd5 upstream.
There is a disconnect between the run_command function and the wait_for_input. The wait_for_input has a default timeout of 2 minutes. But if that happens, the run_command loop will exit out to the waitpid() of the executing command. This fails in that it no longer monitors the command, and also, the ssh to the test box can hang when its finished, as it's waiting for the pipe it's writing to to flush, but the loop that reads that pipe has already exited, leaving the command stuck, and the test hangs.
Instead, make the default "wait_for_input" of the run_command infinite, and allow the user to override it if they want with a default timeout option "RUN_TIMEOUT".
But this fixes the hang that happens when the pipe is full and the ssh session never exits.
Cc: stable@vger.kernel.org Fixes: 6e98d1b4415fe ("ktest: Add timeout to ssh command") Signed-off-by: Steven Rostedt rostedt@goodmis.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/testing/ktest/ktest.pl | 20 ++++++++++++++++---- tools/testing/ktest/sample.conf | 5 +++++ 2 files changed, 21 insertions(+), 4 deletions(-)
--- a/tools/testing/ktest/ktest.pl +++ b/tools/testing/ktest/ktest.pl @@ -178,6 +178,7 @@ my $store_failures; my $store_successes; my $test_name; my $timeout; +my $run_timeout; my $connect_timeout; my $config_bisect_exec; my $booted_timeout; @@ -340,6 +341,7 @@ my %option_map = ( "STORE_SUCCESSES" => $store_successes, "TEST_NAME" => $test_name, "TIMEOUT" => $timeout, + "RUN_TIMEOUT" => $run_timeout, "CONNECT_TIMEOUT" => $connect_timeout, "CONFIG_BISECT_EXEC" => $config_bisect_exec, "BOOTED_TIMEOUT" => $booted_timeout, @@ -1858,6 +1860,14 @@ sub run_command { $command =~ s/$SSH_USER/$ssh_user/g; $command =~ s/$MACHINE/$machine/g;
+ if (!defined($timeout)) { + $timeout = $run_timeout; + } + + if (!defined($timeout)) { + $timeout = -1; # tell wait_for_input to wait indefinitely + } + doprint("$command ... "); $start_time = time;
@@ -1884,13 +1894,10 @@ sub run_command {
while (1) { my $fp = *CMD; - if (defined($timeout)) { - doprint "timeout = $timeout\n"; - } my $line = wait_for_input($fp, $timeout); if (!defined($line)) { my $now = time; - if (defined($timeout) && (($now - $start_time) >= $timeout)) { + if ($timeout >= 0 && (($now - $start_time) >= $timeout)) { doprint "Hit timeout of $timeout, killing process\n"; $hit_timeout = 1; kill 9, $pid; @@ -2062,6 +2069,11 @@ sub wait_for_input { $time = $timeout; }
+ if ($time < 0) { + # Negative number means wait indefinitely + undef $time; + } + $rin = ''; vec($rin, fileno($fp), 1) = 1; vec($rin, fileno(*STDIN), 1) = 1; --- a/tools/testing/ktest/sample.conf +++ b/tools/testing/ktest/sample.conf @@ -817,6 +817,11 @@ # is issued instead of a reboot. # CONNECT_TIMEOUT = 25
+# The timeout in seconds for how long to wait for any running command +# to timeout. If not defined, it will let it go indefinitely. +# (default undefined) +#RUN_TIMEOUT = 600 + # In between tests, a reboot of the box may occur, and this # is the time to wait for the console after it stops producing # output. Some machines may not produce a large lag on reboot
From: Tong Tiangen tongtiangen@huawei.com
commit 93419139fa14124c1c507d804f2b28866ebee28d upstream.
In find_create_memory_tier(), if failed to register device, then we should release new_memtier from the tier list and put device instead of memtier.
Link: https://lkml.kernel.org/r/20230129040651.1329208-1-tongtiangen@huawei.com Fixes: 9832fb87834e ("mm/demotion: expose memory tier details via sysfs") Signed-off-by: Tong Tiangen tongtiangen@huawei.com Cc: Aneesh Kumar K.V aneesh.kumar@linux.ibm.com Cc: Hanjun Guo guohanjun@huawei.com Cc: Kefeng Wang wangkefeng.wang@huawei.com Cc: Guohanjun guohanjun@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- mm/memory-tiers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/memory-tiers.c +++ b/mm/memory-tiers.c @@ -211,8 +211,8 @@ static struct memory_tier *find_create_m
ret = device_register(&new_memtier->dev); if (ret) { - list_del(&memtier->list); - put_device(&memtier->dev); + list_del(&new_memtier->list); + put_device(&new_memtier->dev); return ERR_PTR(ret); } memtier = new_memtier;
From: Mukesh Ojha quic_mojha@quicinc.com
commit 8843e06f67b14f71c044bf6267b2387784c7e198 upstream.
It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at same time RB_FLAG was cleared when doing integrity check rb_check_pages():
rb_check_pages() rb_handle_head_page(): -------- -------- rb_head_page_deactivate() rb_head_page_set_normal() rb_head_page_activate()
We do intergrity test of the list to check if the list is corrupted and it is still worth doing it. So, let's refactor rb_check_pages() such that we no longer clear and set flag during the list sanity checking.
[1] and [2] are the test to reproduce and the crash report respectively.
1: ``` read_trace.sh while true; do # the "trace" file is closed after read head -1 /sys/kernel/tracing/trace > /dev/null done ``` ``` repro.sh sysctl -w kernel.panic_on_warn=1 # function tracer will writing enough data into ring_buffer echo function > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ```
2: ------------[ cut here ]------------ WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 rb_move_tail+0x450/0x470 Modules linked in: CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:rb_move_tail+0x450/0x470 Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 f8 02 0f 84 ce fb ff ff e9 db RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203 RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2 R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000 R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108 FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 Call Trace: <TASK> ring_buffer_lock_reserve+0x136/0x360 ? __do_softirq+0x287/0x2df ? __pfx_rcu_softirq_qs+0x10/0x10 trace_function+0x21/0x110 ? __pfx_rcu_softirq_qs+0x10/0x10 ? __do_softirq+0x287/0x2df function_trace_call+0xf6/0x120 0xffffffffc038f097 ? rcu_softirq_qs+0x5/0x140 rcu_softirq_qs+0x5/0x140 __do_softirq+0x287/0x2df run_ksoftirqd+0x2a/0x30 smpboot_thread_fn+0x188/0x220 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0xe7/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> ---[ end trace 0000000000000000 ]---
[ crash report and test reproducer credit goes to Zheng Yejian]
Link: https://lore.kernel.org/linux-trace-kernel/1676376403-16462-1-git-send-email...
Cc: mhiramat@kernel.org Cc: stable@vger.kernel.org Fixes: 1039221cc278 ("ring-buffer: Do not disable recording when there is an iterator") Reported-by: Zheng Yejian zhengyejian1@huawei.com Signed-off-by: Mukesh Ojha quic_mojha@quicinc.com Signed-off-by: Steven Rostedt (Google) rostedt@goodmis.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/trace/ring_buffer.c | 42 ++++++++++-------------------------------- 1 file changed, 10 insertions(+), 32 deletions(-)
--- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1581,19 +1581,6 @@ static int rb_check_bpage(struct ring_bu }
/** - * rb_check_list - make sure a pointer to a list has the last bits zero - */ -static int rb_check_list(struct ring_buffer_per_cpu *cpu_buffer, - struct list_head *list) -{ - if (RB_WARN_ON(cpu_buffer, rb_list_head(list->prev) != list->prev)) - return 1; - if (RB_WARN_ON(cpu_buffer, rb_list_head(list->next) != list->next)) - return 1; - return 0; -} - -/** * rb_check_pages - integrity check of buffer pages * @cpu_buffer: CPU buffer with pages to test * @@ -1602,36 +1589,27 @@ static int rb_check_list(struct ring_buf */ static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer) { - struct list_head *head = cpu_buffer->pages; - struct buffer_page *bpage, *tmp; + struct list_head *head = rb_list_head(cpu_buffer->pages); + struct list_head *tmp;
- /* Reset the head page if it exists */ - if (cpu_buffer->head_page) - rb_set_head_page(cpu_buffer); - - rb_head_page_deactivate(cpu_buffer); - - if (RB_WARN_ON(cpu_buffer, head->next->prev != head)) - return -1; - if (RB_WARN_ON(cpu_buffer, head->prev->next != head)) + if (RB_WARN_ON(cpu_buffer, + rb_list_head(rb_list_head(head->next)->prev) != head)) return -1;
- if (rb_check_list(cpu_buffer, head)) + if (RB_WARN_ON(cpu_buffer, + rb_list_head(rb_list_head(head->prev)->next) != head)) return -1;
- list_for_each_entry_safe(bpage, tmp, head, list) { + for (tmp = rb_list_head(head->next); tmp != head; tmp = rb_list_head(tmp->next)) { if (RB_WARN_ON(cpu_buffer, - bpage->list.next->prev != &bpage->list)) + rb_list_head(rb_list_head(tmp->next)->prev) != tmp)) return -1; + if (RB_WARN_ON(cpu_buffer, - bpage->list.prev->next != &bpage->list)) - return -1; - if (rb_check_list(cpu_buffer, &bpage->list)) + rb_list_head(rb_list_head(tmp->prev)->next) != tmp)) return -1; }
- rb_head_page_activate(cpu_buffer); - return 0; }
From: Antonio Alvarez Feijoo antonio.feijoo@suse.com
commit cf8c59a3756b2735c409a9b3ac1e4ec556546a7a upstream.
A single & will create a background process and return true, so the grep command will run even if the file checked in the first condition does not exist.
Link: https://lore.kernel.org/all/20230112114215.17103-1-antonio.feijoo@suse.com/
Fixes: 1eaad3ac3f39 ("tools/bootconfig: Use per-group/all enable option in ftrace2bconf script") Signed-off-by: Antonio Alvarez Feijoo antonio.feijoo@suse.com Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu (Google) mhiramat@kernel.org Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- tools/bootconfig/scripts/ftrace2bconf.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/bootconfig/scripts/ftrace2bconf.sh +++ b/tools/bootconfig/scripts/ftrace2bconf.sh @@ -93,7 +93,7 @@ referred_vars() { }
event_is_enabled() { # enable-file - test -f $1 & grep -q "1" $1 + test -f $1 && grep -q "1" $1 }
per_event_options() { # event-dir
From: Masami Hiramatsu (Google) mhiramat@kernel.org
commit 133921530c42960c07d25d12677f9e131a2b0cdf upstream.
Fix to add a description of the filter on eprobe in README file. This is required to identify the kernel supports the filter on eprobe or not.
Link: https://lore.kernel.org/all/167309833728.640500.12232259238201433587.stgit@d...
Fixes: 752be5c5c910 ("tracing/eprobe: Add eprobe filter support") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) mhiramat@kernel.org Reviewed-by: Steven Rostedt (Google) rostedt@goodmis.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -5598,7 +5598,7 @@ static const char readme_msg[] = #ifdef CONFIG_HIST_TRIGGERS "\t s:[synthetic/]<event> <field> [<field>]\n" #endif - "\t e[:[<group>/][<event>]] <attached-group>.<attached-event> [<args>]\n" + "\t e[:[<group>/][<event>]] <attached-group>.<attached-event> [<args>] [if <filter>]\n" "\t -:[<group>/][<event>]\n" #ifdef CONFIG_KPROBE_EVENTS "\t place: [<module>:]<symbol>[+<offset>]|<memaddr>\n"
From: Gavrilov Ilia Ilia.Gavrilov@infotecs.ru
commit b6b26d86c61c441144c72f842f7469bb686e1211 upstream.
The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format string sscanf() has no width limitation.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") Cc: stable@vger.kernel.org Signed-off-by: Ilia.Gavrilov Ilia.Gavrilov@infotecs.ru Reviewed-by: Kim Phillips kim.phillips@amd.com Link: https://lore.kernel.org/r/20230202082719.1513849-1-Ilia.Gavrilov@infotecs.ru Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/amd/init.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
--- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3475,15 +3475,26 @@ found: return 1; }
+#define ACPIID_LEN (ACPIHID_UID_LEN + ACPIHID_HID_LEN) + static int __init parse_ivrs_acpihid(char *str) { u32 seg = 0, bus, dev, fn; char *hid, *uid, *p, *addr; - char acpiid[ACPIHID_UID_LEN + ACPIHID_HID_LEN] = {0}; + char acpiid[ACPIID_LEN] = {0}; int i;
addr = strchr(str, '@'); if (!addr) { + addr = strchr(str, '='); + if (!addr) + goto not_found; + + ++addr; + + if (strlen(addr) > ACPIID_LEN) + goto not_found; + if (sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid) == 4 || sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid) == 5) { pr_warn("ivrs_acpihid%s option format deprecated; use ivrs_acpihid=%s@%04x:%02x:%02x.%d instead\n", @@ -3496,6 +3507,9 @@ static int __init parse_ivrs_acpihid(cha /* We have the '@', make it the terminator to get just the acpiid */ *addr++ = 0;
+ if (strlen(str) > ACPIID_LEN + 1) + goto not_found; + if (sscanf(str, "=%s", acpiid) != 1) goto not_found;
From: Kees Cook keescook@chromium.org
commit 7ab734fc759828707dae22fe48b1eb4dcf70beea upstream.
The aac_priv() helper assumes that the private cmd area immediately follows struct scsi_cmnd. Allocate this space as part of scsicmd, else there is a risk of heap overflow. Seen with GCC 13:
../drivers/scsi/aacraid/aachba.c: In function 'aac_probe_container': ../drivers/scsi/aacraid/aachba.c:841:26: warning: array subscript 16 is outside array bounds of 'void[392]' [-Warray-bounds=] 841 | status = cmd_priv->status; | ^~ In file included from ../include/linux/resource_ext.h:11, from ../include/linux/pci.h:40, from ../drivers/scsi/aacraid/aachba.c:22: In function 'kmalloc', inlined from 'kzalloc' at ../include/linux/slab.h:720:9, inlined from 'aac_probe_container' at ../drivers/scsi/aacraid/aachba.c:821:30: ../include/linux/slab.h:580:24: note: at offset 392 into object of size 392 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~
Fixes: 76a3451b64c6 ("scsi: aacraid: Move the SCSI pointer to private command data") Link: https://lore.kernel.org/r/20230128000409.never.976-kees@kernel.org Cc: Bart Van Assche bvanassche@acm.org Cc: Hannes Reinecke hare@suse.de Cc: Himanshu Madhani himanshu.madhani@oracle.com Cc: Adaptec OEM Raid Solutions aacraid@microsemi.com Cc: "James E.J. Bottomley" jejb@linux.ibm.com Cc: "Martin K. Petersen" martin.petersen@oracle.com Cc: linux-scsi@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Kees Cook keescook@chromium.org Reviewed-by: Vegard Nossum vegard.nossum@oracle.com Reviewed-by: Hannes Reinecke hare@suse.de Reviewed-by: Bart Van Assche bvanassche@acm.org Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/aacraid/aachba.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/scsi/aacraid/aachba.c +++ b/drivers/scsi/aacraid/aachba.c @@ -818,8 +818,8 @@ static void aac_probe_container_scsi_don
int aac_probe_container(struct aac_dev *dev, int cid) { - struct scsi_cmnd *scsicmd = kzalloc(sizeof(*scsicmd), GFP_KERNEL); - struct aac_cmd_priv *cmd_priv = aac_priv(scsicmd); + struct aac_cmd_priv *cmd_priv; + struct scsi_cmnd *scsicmd = kzalloc(sizeof(*scsicmd) + sizeof(*cmd_priv), GFP_KERNEL); struct scsi_device *scsidev = kzalloc(sizeof(*scsidev), GFP_KERNEL); int status;
@@ -838,6 +838,7 @@ int aac_probe_container(struct aac_dev * while (scsicmd->device == scsidev) schedule(); kfree(scsidev); + cmd_priv = aac_priv(scsicmd); status = cmd_priv->status; kfree(scsicmd); return status;
From: Bart Van Assche bvanassche@acm.org
commit fc663711b94468f4e1427ebe289c9f05669699c9 upstream.
Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. This fixes a bug introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core").
Fix the following kernel warning:
proc_dir_entry 'scsi/scsi_debug' already registered WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0 Call Trace: proc_mkdir+0xb5/0xe0 scsi_proc_hostdir_add+0xb5/0x170 scsi_host_alloc+0x683/0x6c0 sdebug_driver_probe+0x6b/0x2d0 [scsi_debug] really_probe+0x159/0x540 __driver_probe_device+0xdc/0x230 driver_probe_device+0x4f/0x120 __device_attach_driver+0xef/0x180 bus_for_each_drv+0xe5/0x130 __device_attach+0x127/0x290 device_initial_probe+0x17/0x20 bus_probe_device+0x110/0x130 device_add+0x673/0xc80 device_register+0x1e/0x30 sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug] scsi_debug_init+0x64f/0x1000 [scsi_debug] do_one_initcall+0xd7/0x470 do_init_module+0xe7/0x330 load_module+0x122a/0x12c0 __do_sys_finit_module+0x124/0x1a0 __x64_sys_finit_module+0x46/0x50 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Link: https://lore.kernel.org/r/20230210205200.36973-3-bvanassche@acm.org Cc: Alan Stern stern@rowland.harvard.edu Cc: Yi Zhang yi.zhang@redhat.com Cc: stable@vger.kernel.org Fixes: 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core") Reported-by: Yi Zhang yi.zhang@redhat.com Signed-off-by: Bart Van Assche bvanassche@acm.org Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/hosts.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/scsi/hosts.c +++ b/drivers/scsi/hosts.c @@ -181,6 +181,7 @@ void scsi_remove_host(struct Scsi_Host * scsi_forget_host(shost); mutex_unlock(&shost->scan_mutex); scsi_proc_host_rm(shost); + scsi_proc_hostdir_rm(shost->hostt);
/* * New SCSI devices cannot be attached anymore because of the SCSI host @@ -340,6 +341,7 @@ static void scsi_host_dev_release(struct struct Scsi_Host *shost = dev_to_shost(dev); struct device *parent = dev->parent;
+ /* In case scsi_remove_host() has not been called. */ scsi_proc_hostdir_rm(shost->hostt);
/* Wait for functions invoked through call_rcu(&scmd->rcu, ...) */
On 3/7/23 09:02, Greg Kroah-Hartman wrote:
From: Bart Van Assche bvanassche@acm.org
commit fc663711b94468f4e1427ebe289c9f05669699c9 upstream.
Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. This fixes a bug introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core").
Hi Greg,
This patch introduces a new bug and the new bug is easier to trigger than the bug fixed by this patch. How about waiting with applying this patch on any stable branch until the fix for this patch has landed upstream?
Thanks,
Bart.
On Tue, Mar 07, 2023 at 09:57:55AM -0800, Bart Van Assche wrote:
On 3/7/23 09:02, Greg Kroah-Hartman wrote:
From: Bart Van Assche bvanassche@acm.org
commit fc663711b94468f4e1427ebe289c9f05669699c9 upstream.
Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. This fixes a bug introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core").
Hi Greg,
This patch introduces a new bug and the new bug is easier to trigger than the bug fixed by this patch. How about waiting with applying this patch on any stable branch until the fix for this patch has landed upstream?
Ok, now dropped from all queues, sorry for the delay. Please let us know when the fix has landed in Linus's tree so we can add this, and the fix, back in.
thanks,
greg k-h
From: Quinn Tran qutran@marvell.com
commit b1ae65c082f74536ec292b15766f2846f0238373 upstream.
User experienced symptoms of adapter failure in NPIV environment. NPIV hosts were allowed to trigger chip reset back to back due to NPIV link state being slow to come online.
Fix link failure in NPIV environment by removing NPIV host from directly being able to perform chip reset.
kernel: qla2xxx [0000:04:00.1]-6009:261: Loop down - aborting ISP. kernel: qla2xxx [0000:04:00.1]-6009:262: Loop down - aborting ISP. kernel: qla2xxx [0000:04:00.1]-6009:281: Loop down - aborting ISP. kernel: qla2xxx [0000:04:00.1]-6009:285: Loop down - aborting ISP
Fixes: 0d6e61bc6a4f ("[SCSI] qla2xxx: Correct various NPIV issues.") Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran qutran@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Reviewed-by: Himanshu Madhani himanshu.madhani@oracle.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/qla2xxx/qla_os.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -7447,7 +7447,7 @@ qla2x00_timer(struct timer_list *t)
/* if the loop has been down for 4 minutes, reinit adapter */ if (atomic_dec_and_test(&vha->loop_down_timer) != 0) { - if (!(vha->device_flags & DFLG_NO_CABLE)) { + if (!(vha->device_flags & DFLG_NO_CABLE) && !vha->vp_idx) { ql_log(ql_log_warn, vha, 0x6009, "Loop down - aborting ISP.\n");
From: Shreyas Deodhar sdeodhar@marvell.com
commit 0c227dc22ca18856055983f27594feb2e0149965 upstream.
CT Ping and ELS cmds fail for NVMe targets. Check if port is online before sending ELS instead of sending login.
Cc: stable@vger.kernel.org Signed-off-by: Shreyas Deodhar sdeodhar@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Reviewed-by: Himanshu Madhani himanshu.madhani@oracle.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/qla2xxx/qla_bsg.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_bsg.c +++ b/drivers/scsi/qla2xxx/qla_bsg.c @@ -278,8 +278,8 @@ qla2x00_process_els(struct bsg_job *bsg_ const char *type; int req_sg_cnt, rsp_sg_cnt; int rval = (DID_ERROR << 16); - uint16_t nextlid = 0; uint32_t els_cmd = 0; + int qla_port_allocated = 0;
if (bsg_request->msgcode == FC_BSG_RPT_ELS) { rport = fc_bsg_to_rport(bsg_job); @@ -329,9 +329,9 @@ qla2x00_process_els(struct bsg_job *bsg_ /* make sure the rport is logged in, * if not perform fabric login */ - if (qla2x00_fabric_login(vha, fcport, &nextlid)) { + if (atomic_read(&fcport->state) != FCS_ONLINE) { ql_dbg(ql_dbg_user, vha, 0x7003, - "Failed to login port %06X for ELS passthru.\n", + "Port %06X is not online for ELS passthru.\n", fcport->d_id.b24); rval = -EIO; goto done; @@ -348,6 +348,7 @@ qla2x00_process_els(struct bsg_job *bsg_ goto done; }
+ qla_port_allocated = 1; /* Initialize all required fields of fcport */ fcport->vha = vha; fcport->d_id.b.al_pa = @@ -432,7 +433,7 @@ done_unmap_sg: goto done_free_fcport;
done_free_fcport: - if (bsg_request->msgcode != FC_BSG_RPT_ELS) + if (qla_port_allocated) qla2x00_free_fcport(fcport); done: return rval;
From: Arun Easi aeasi@marvell.com
commit c75e6aef5039830cce5d4cf764dd204522f89e6b upstream.
The following message and call trace was seen with debug kernels:
DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map error [device address=0x00000002a3ff38d8] [size=1024 bytes] [mapped as single] WARNING: CPU: 0 PID: 2930 at kernel/dma/debug.c:1017 check_unmap+0xf42/0x1990
Call Trace: debug_dma_unmap_page+0xc9/0x100 qla_nvme_ls_unmap+0x141/0x210 [qla2xxx]
Remove DMA mapping from the driver altogether, as it is already done by FC layer. This prevents the warning.
Fixes: c85ab7d9e27a ("scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests") Cc: stable@vger.kernel.org Signed-off-by: Arun Easi aeasi@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Reviewed-by: Himanshu Madhani himanshu.madhani@oracle.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/qla2xxx/qla_nvme.c | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -170,18 +170,6 @@ out: qla2xxx_rel_qpair_sp(sp->qpair, sp); }
-static void qla_nvme_ls_unmap(struct srb *sp, struct nvmefc_ls_req *fd) -{ - if (sp->flags & SRB_DMA_VALID) { - struct srb_iocb *nvme = &sp->u.iocb_cmd; - struct qla_hw_data *ha = sp->fcport->vha->hw; - - dma_unmap_single(&ha->pdev->dev, nvme->u.nvme.cmd_dma, - fd->rqstlen, DMA_TO_DEVICE); - sp->flags &= ~SRB_DMA_VALID; - } -} - static void qla_nvme_release_ls_cmd_kref(struct kref *kref) { struct srb *sp = container_of(kref, struct srb, cmd_kref); @@ -199,7 +187,6 @@ static void qla_nvme_release_ls_cmd_kref
fd = priv->fd;
- qla_nvme_ls_unmap(sp, fd); fd->done(fd, priv->comp_status); out: qla2x00_rel_sp(sp); @@ -365,13 +352,10 @@ static int qla_nvme_ls_req(struct nvme_f nvme->u.nvme.rsp_len = fd->rsplen; nvme->u.nvme.rsp_dma = fd->rspdma; nvme->u.nvme.timeout_sec = fd->timeout; - nvme->u.nvme.cmd_dma = dma_map_single(&ha->pdev->dev, fd->rqstaddr, - fd->rqstlen, DMA_TO_DEVICE); + nvme->u.nvme.cmd_dma = fd->rqstdma; dma_sync_single_for_device(&ha->pdev->dev, nvme->u.nvme.cmd_dma, fd->rqstlen, DMA_TO_DEVICE);
- sp->flags |= SRB_DMA_VALID; - rval = qla2x00_start_sp(sp); if (rval != QLA_SUCCESS) { ql_log(ql_log_warn, vha, 0x700e, @@ -379,7 +363,6 @@ static int qla_nvme_ls_req(struct nvme_f wake_up(&sp->nvme_ls_waitq); sp->priv = NULL; priv->sp = NULL; - qla_nvme_ls_unmap(sp, fd); qla2x00_rel_sp(sp); return rval; }
From: Quinn Tran qutran@marvell.com
commit 7e8a936a2d0f98dd6e5d05d4838affabe606cabc upstream.
FCF_ASYNC_SENT flag is used in session management. This flag is cleared in task management path by accident. Remove unintended flag clearing.
Fixes: 388a49959ee4 ("scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd") Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran qutran@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Reviewed-by: Himanshu Madhani himanshu.madhani@oracle.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/qla2xxx/qla_init.c | 1 - 1 file changed, 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_init.c +++ b/drivers/scsi/qla2xxx/qla_init.c @@ -2076,7 +2076,6 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, done_free_sp: /* ref: INIT */ kref_put(&sp->cmd_kref, qla2x00_sp_release); - fcport->flags &= ~FCF_ASYNC_SENT; done: return rval; }
From: Quinn Tran qutran@marvell.com
commit 3fbc74feb642deb688cc97f76d40b7287ddd4cb1 upstream.
If after an adapter reset the appearance of link is not recovered, the devices are not rediscovered. This is result of a race condition between adapter reset (abort_isp) and the topology scan. During adapter reset, the ABORT_ISP_ACTIVE flag is set. Topology scan usually occurred after adapter reset. In this case, the topology scan came earlier than usual where it ran into problem due to ABORT_ISP_ACTIVE flag was still set.
kernel: qla2xxx [0000:13:00.0]-1005:1: Cmd 0x6a aborted with timeout since ISP Abort is pending kernel: qla2xxx [0000:13:00.0]-28a0:1: MBX_GET_PORT_NAME failed, No FL Port. kernel: qla2xxx [0000:13:00.0]-286b:1: qla2x00_configure_loop: exiting normally. local port wwpn 51402ec0123d9a80 id 012300) kernel: qla2xxx [0000:13:00.0]-8017:1: ADAPTER RESET SUCCEEDED nexus=1:0:15.
Allow adapter reset to complete before any scan can start.
Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran qutran@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Reviewed-by: Himanshu Madhani himanshu.madhani@oracle.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/qla2xxx/qla_os.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -7094,9 +7094,12 @@ qla2x00_do_dpc(void *data) } } loop_resync_check: - if (test_and_clear_bit(LOOP_RESYNC_NEEDED, + if (!qla2x00_reset_active(base_vha) && + test_and_clear_bit(LOOP_RESYNC_NEEDED, &base_vha->dpc_flags)) { - + /* + * Allow abort_isp to complete before moving on to scanning. + */ ql_dbg(ql_dbg_dpc, base_vha, 0x400f, "Loop resync scheduled.\n");
From: Saurav Kashyap skashyap@marvell.com
commit d676a9e3d9efb7e93df460bcf4c445496c16314f upstream.
Residual underrun is not an interface error, hence no need to increment that count.
Fixes: dbf1f53cfd23 ("scsi: qla2xxx: Implementation to get and manage host, target stats and initiator port") Cc: stable@vger.kernel.org Signed-off-by: Saurav Kashyap skashyap@marvell.com Signed-off-by: Nilesh Javali njavali@marvell.com Reviewed-by: Himanshu Madhani himanshu.madhani@oracle.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/qla2xxx/qla_isr.c | 2 -- 1 file changed, 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -3363,8 +3363,6 @@ qla2x00_status_entry(scsi_qla_host_t *vh "Dropped frame(s) detected (0x%x of 0x%x bytes).\n", resid, scsi_bufflen(cp));
- vha->interface_err_cnt++; - res = DID_ERROR << 16 | lscsi_status; goto check_scsi_status; }
From: James Bottomley jejb@linux.ibm.com
commit 3fe97ff3d94934649abb0652028dd7296170c8d0 upstream.
An enclosure with no components can't usefully be operated by the driver (since effectively it has nothing to manage), so report the problem and don't attach. Not attaching also fixes an oops which could occur if the driver tries to manage a zero component enclosure.
[mkp: Switched to KERN_WARNING since this scenario is common]
Link: https://lore.kernel.org/r/c5deac044ac409e32d9ad9968ce0dcbc996bfc7a.camel@lin... Cc: stable@vger.kernel.org Reported-by: Ding Hui dinghui@sangfor.com.cn Signed-off-by: James Bottomley James.Bottomley@HansenPartnership.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/ses.c | 6 ++++++ 1 file changed, 6 insertions(+)
--- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -704,6 +704,12 @@ static int ses_intf_add(struct device *c type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE) components += type_ptr[1]; } + + if (components == 0) { + sdev_printk(KERN_WARNING, sdev, "enclosure has no enumerated components\n"); + goto err_free; + } + ses_dev->page1 = buf; ses_dev->page1_len = len; buf = NULL;
From: Tomas Henzl thenzl@redhat.com
commit 9b4f5028e493cb353a5c8f5c45073eeea0303abd upstream.
A fix for:
BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271
Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we expect the size to be sanitized before first access to addl_desc_ptr[1]. Make sure we don't walk beyond end of page.
Link: https://lore.kernel.org/r/20230202162451.15346-2-thenzl@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Tomas Henzl thenzl@redhat.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/ses.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -603,9 +603,11 @@ static void ses_enclosure_data_process(s /* these elements are optional */ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || - type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) + type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) { addl_desc_ptr += addl_desc_ptr[1] + 2; - + if (addl_desc_ptr + 1 >= ses_dev->page10 + ses_dev->page10_len) + addl_desc_ptr = NULL; + } } } kfree(buf);
From: Tomas Henzl thenzl@redhat.com
commit db95d4df71cb55506425b6e4a5f8d68e3a765b63 upstream.
Sanitize possible addl_desc_ptr out-of-bounds accesses in ses_enclosure_data_process().
Link: https://lore.kernel.org/r/20230202162451.15346-3-thenzl@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Tomas Henzl thenzl@redhat.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/ses.c | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-)
--- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -433,8 +433,8 @@ int ses_match_host(struct enclosure_devi } #endif /* 0 */
-static void ses_process_descriptor(struct enclosure_component *ecomp, - unsigned char *desc) +static int ses_process_descriptor(struct enclosure_component *ecomp, + unsigned char *desc, int max_desc_len) { int eip = desc[0] & 0x10; int invalid = desc[0] & 0x80; @@ -445,22 +445,32 @@ static void ses_process_descriptor(struc unsigned char *d;
if (invalid) - return; + return 0;
switch (proto) { case SCSI_PROTOCOL_FCP: if (eip) { + if (max_desc_len <= 7) + return 1; d = desc + 4; slot = d[3]; } break; case SCSI_PROTOCOL_SAS: + if (eip) { + if (max_desc_len <= 27) + return 1; d = desc + 4; slot = d[3]; d = desc + 8; - } else + } else { + if (max_desc_len <= 23) + return 1; d = desc + 4; + } + + /* only take the phy0 addr */ addr = (u64)d[12] << 56 | (u64)d[13] << 48 | @@ -477,6 +487,8 @@ static void ses_process_descriptor(struc } ecomp->slot = slot; scomp->addr = addr; + + return 0; }
struct efd { @@ -549,7 +561,7 @@ static void ses_enclosure_data_process(s /* skip past overall descriptor */ desc_ptr += len + 4; } - if (ses_dev->page10) + if (ses_dev->page10 && ses_dev->page10_len > 9) addl_desc_ptr = ses_dev->page10 + 8; type_ptr = ses_dev->page1_types; components = 0; @@ -557,6 +569,7 @@ static void ses_enclosure_data_process(s for (j = 0; j < type_ptr[1]; j++) { char *name = NULL; struct enclosure_component *ecomp; + int max_desc_len;
if (desc_ptr) { if (desc_ptr >= buf + page7_len) { @@ -583,10 +596,14 @@ static void ses_enclosure_data_process(s ecomp = &edev->component[components++];
if (!IS_ERR(ecomp)) { - if (addl_desc_ptr) - ses_process_descriptor( - ecomp, - addl_desc_ptr); + if (addl_desc_ptr) { + max_desc_len = ses_dev->page10_len - + (addl_desc_ptr - ses_dev->page10); + if (ses_process_descriptor(ecomp, + addl_desc_ptr, + max_desc_len)) + addl_desc_ptr = NULL; + } if (create) enclosure_component_register( ecomp);
From: Tomas Henzl thenzl@redhat.com
commit 801ab13d50cf3d26170ee073ea8bb4eececb76ab upstream.
Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process().
Link: https://lore.kernel.org/r/20230202162451.15346-4-thenzl@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Tomas Henzl thenzl@redhat.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/ses.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
--- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -572,15 +572,19 @@ static void ses_enclosure_data_process(s int max_desc_len;
if (desc_ptr) { - if (desc_ptr >= buf + page7_len) { + if (desc_ptr + 3 >= buf + page7_len) { desc_ptr = NULL; } else { len = (desc_ptr[2] << 8) + desc_ptr[3]; desc_ptr += 4; - /* Add trailing zero - pushes into - * reserved space */ - desc_ptr[len] = '\0'; - name = desc_ptr; + if (desc_ptr + len > buf + page7_len) + desc_ptr = NULL; + else { + /* Add trailing zero - pushes into + * reserved space */ + desc_ptr[len] = '\0'; + name = desc_ptr; + } } } if (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
From: Tomas Henzl thenzl@redhat.com
commit 578797f0c8cbc2e3ec5fc0dab87087b4c7073686 upstream.
A fix for:
BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013
When edev->components is zero, accessing edev->component[0] members is wrong.
Link: https://lore.kernel.org/r/20230202162451.15346-5-thenzl@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Tomas Henzl thenzl@redhat.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/scsi/ses.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -856,7 +856,8 @@ static void ses_intf_remove_enclosure(st kfree(ses_dev->page2); kfree(ses_dev);
- kfree(edev->component[0].scratch); + if (edev->components) + kfree(edev->component[0].scratch);
put_device(&edev->edev); enclosure_unregister(edev);
From: Conor Dooley conor.dooley@microchip.com
commit eb9be8310c58c166f9fae3b71c0ad9d6741b4897 upstream.
The patchwork automation reported a sparse complaint that spin_shadow_stack was not declared and should be static: ../arch/riscv/kernel/traps.c:335:15: warning: symbol 'spin_shadow_stack' was not declared. Should it be static?
However, this is used in entry.S and therefore shouldn't be static. The same applies to the shadow_stack that this pseudo spinlock is trying to protect, so do like its charge and add a declaration to thread_info.h
Signed-off-by: Conor Dooley conor.dooley@microchip.com Fixes: 7e1864332fbc ("riscv: fix race when vmap stack overflow") Reviewed-by: Guo Ren guoren@kernel.org Link: https://lore.kernel.org/r/20230210185945.915806-1-conor@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/include/asm/thread_info.h | 1 + 1 file changed, 1 insertion(+)
--- a/arch/riscv/include/asm/thread_info.h +++ b/arch/riscv/include/asm/thread_info.h @@ -43,6 +43,7 @@ #ifndef __ASSEMBLY__
extern long shadow_stack[SHADOW_OVERFLOW_STACK_SIZE / sizeof(long)]; +extern unsigned long spin_shadow_stack;
#include <asm/processor.h> #include <asm/csr.h>
From: Mattias Nissler mnissler@rivosinc.com
commit 130aee3fd9981297ff9354e5d5609cd59aafbbea upstream.
While working on something else, I noticed that the kernel would start accepting interrupts again after crashing in an interrupt handler. Since the kernel is already in inconsistent state, enabling interrupts is dangerous and opens up risk of kernel state deteriorating further. Interrupts do get enabled via what looks like an unintended side effect of spin_unlock_irq, so switch to the more cautious spin_lock_irqsave/spin_unlock_irqrestore instead.
Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code") Signed-off-by: Mattias Nissler mnissler@rivosinc.com Reviewed-by: Björn Töpel bjorn@kernel.org Link: https://lore.kernel.org/r/20230215144828.3370316-1-mnissler@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/kernel/traps.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
--- a/arch/riscv/kernel/traps.c +++ b/arch/riscv/kernel/traps.c @@ -34,10 +34,11 @@ void die(struct pt_regs *regs, const cha static int die_counter; int ret; long cause; + unsigned long flags;
oops_enter();
- spin_lock_irq(&die_lock); + spin_lock_irqsave(&die_lock, flags); console_verbose(); bust_spinlocks(1);
@@ -54,7 +55,7 @@ void die(struct pt_regs *regs, const cha
bust_spinlocks(0); add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); - spin_unlock_irq(&die_lock); + spin_unlock_irqrestore(&die_lock, flags); oops_exit();
if (in_interrupt())
From: Sergey Matyukevich sergey.matyukevich@syntacore.com
commit b49f700668fff7565b945dce823def79bff59bb0 upstream.
This is a partial revert of the commit 4bd1d80efb5a ("riscv: mm: notify remote harts about mmu cache updates"). Original commit included two loosely related changes serving the same purpose of fixing stale TLB entries causing user-space application crash: - introduce deferred per-ASID TLB flush for CPUs not running the task - switch to per-ASID TLB flush on all CPUs running the task in update_mmu_cache
According to report and discussion in [1], the second part caused a regression on Renesas RZ/Five SoC. For now restore the old behavior of the update_mmu_cache.
[1] https://lore.kernel.org/linux-riscv/20220829205219.283543-1-geomatsi@gmail.c...
Fixes: 4bd1d80efb5a ("riscv: mm: notify remote harts about mmu cache updates") Reported-by: "Lad, Prabhakar" prabhakar.csengg@gmail.com Signed-off-by: Sergey Matyukevich sergey.matyukevich@syntacore.com Link: trailer, so that it can be parsed with git's trailer functionality? Reviewed-by: Conor Dooley conor.dooley@microchip.com Link: https://lore.kernel.org/r/20230129211818.686557-1-geomatsi@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/include/asm/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/riscv/include/asm/pgtable.h +++ b/arch/riscv/include/asm/pgtable.h @@ -415,7 +415,7 @@ static inline void update_mmu_cache(stru * Relying on flush_tlb_fix_spurious_fault would suffice, but * the extra traps reduce performance. So, eagerly SFENCE.VMA. */ - flush_tlb_page(vma, address); + local_flush_tlb_page(address); }
#define __HAVE_ARCH_UPDATE_MMU_TLB
From: Andy Chiu andy.chiu@sifive.com
commit 9ddfc3cd806081ce1f6c9c2f988cbb031f35d28f upstream.
Runtime code patching must be done at a naturally aligned address, or we may execute on a partial instruction.
We have encountered problems traced back to static jump functions during the test. We switched the tracer randomly for every 1~5 seconds on a dual-core QEMU setup and found the kernel sucking at a static branch where it jumps to itself.
The reason is that the static branch was 2-byte but not 4-byte aligned. Then, the kernel would patch the instruction, either J or NOP, with two half-word stores if the machine does not have efficient unaligned accesses. Thus, moments exist where half of the NOP mixes with the other half of the J when transitioning the branch. In our particular case, on a little-endian machine, the upper half of the NOP was mixed with the lower part of the J when enabling the branch, resulting in a jump that jumped to itself. Conversely, it would result in a HINT instruction when disabling the branch, but it might not be observable.
ARM64 does not have this problem since all instructions must be 4-byte aligned.
Fixes: ebc00dde8a97 ("riscv: Add jump-label implementation") Link: https://lore.kernel.org/linux-riscv/20220913094252.3555240-6-andy.chiu@sifiv... Reviewed-by: Greentime Hu greentime.hu@sifive.com Signed-off-by: Andy Chiu andy.chiu@sifive.com Signed-off-by: Guo Ren guoren@kernel.org Link: https://lore.kernel.org/r/20230206090440.1255001-1-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/include/asm/jump_label.h | 2 ++ 1 file changed, 2 insertions(+)
--- a/arch/riscv/include/asm/jump_label.h +++ b/arch/riscv/include/asm/jump_label.h @@ -18,6 +18,7 @@ static __always_inline bool arch_static_ const bool branch) { asm_volatile_goto( + " .align 2 \n\t" " .option push \n\t" " .option norelax \n\t" " .option norvc \n\t" @@ -39,6 +40,7 @@ static __always_inline bool arch_static_ const bool branch) { asm_volatile_goto( + " .align 2 \n\t" " .option push \n\t" " .option norelax \n\t" " .option norvc \n\t"
From: Andy Chiu andy.chiu@sifive.com
commit 8547649981e6631328cd64f583667501ae385531 upstream.
In RISCV, we must use an AUIPC + JALR pair to encode an immediate, forming a jump that jumps to an address over 4K. This may cause errors if we want to enable kernel preemption and remove dependency from patching code with stop_machine(). For example, if a task was switched out on auipc. And, if we changed the ftrace function before it was switched back, then it would jump to an address that has updated 11:0 bits mixing with previous XLEN:12 part.
p: patched area performed by dynamic ftrace ftrace_prologue: p| REG_S ra, -SZREG(sp) p| auipc ra, 0x? ------------> preempted ... change ftrace function ... p| jalr -?(ra) <------------- switched back p| REG_L ra, -SZREG(sp) func: xxx ret
Fixes: afc76b8b8011 ("riscv: Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT") Signed-off-by: Andy Chiu andy.chiu@sifive.com Signed-off-by: Guo Ren guoren@kernel.org Link: https://lore.kernel.org/r/20230112090603.1295340-2-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -138,7 +138,7 @@ config RISCV select HAVE_DYNAMIC_FTRACE_WITH_REGS if HAVE_DYNAMIC_FTRACE select HAVE_FTRACE_MCOUNT_RECORD if !XIP_KERNEL select HAVE_FUNCTION_GRAPH_TRACER - select HAVE_FUNCTION_TRACER if !XIP_KERNEL + select HAVE_FUNCTION_TRACER if !XIP_KERNEL && !PREEMPTION
config ARCH_MMAP_RND_BITS_MIN default 18 if 64BIT
From: Björn Töpel bjorn@rivosinc.com
commit 416721ff05fddc58ca531b6f069de250301de6e5 upstream.
Commit 21855cac82d3 ("riscv/mm: Prevent kernel module to access user memory without uaccess routines") added early exits/deaths for page faults stemming from accesses to user-space without using proper uaccess routines (where sstatus.SUM is set).
Unfortunatly, this is too strict for some BPF programs, which relies on BPF exhandler fixups. These BPF programs loads "BTF pointers". A BTF pointers could either be a valid kernel pointer or NULL, but not a userspace address.
Resolve the problem by calling the fixup handler in the early exit path.
Fixes: 21855cac82d3 ("riscv/mm: Prevent kernel module to access user memory without uaccess routines") Signed-off-by: Björn Töpel bjorn@rivosinc.com Link: https://lore.kernel.org/r/20230214162515.184827-1-bjorn@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/mm/fault.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
--- a/arch/riscv/mm/fault.c +++ b/arch/riscv/mm/fault.c @@ -267,10 +267,12 @@ asmlinkage void do_page_fault(struct pt_ if (user_mode(regs)) flags |= FAULT_FLAG_USER;
- if (!user_mode(regs) && addr < TASK_SIZE && - unlikely(!(regs->status & SR_SUM))) - die_kernel_fault("access to user memory without uaccess routines", - addr, regs); + if (!user_mode(regs) && addr < TASK_SIZE && unlikely(!(regs->status & SR_SUM))) { + if (fixup_exception(regs)) + return; + + die_kernel_fault("access to user memory without uaccess routines", addr, regs); + }
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
From: Guo Ren guoren@linux.alibaba.com
commit 409c8fb20c66df7150e592747412438c04aeb11f upstream.
When CONFIG_RISCV_ISA_C=n, -fpatchable-function-entry=8 would generate more nops than we expect. Because it treat nop opcode as 0x00000013 instead of 0x0001.
Dump of assembler code for function dw_pcie_free_msi: 0xffffffff806fce94 <+0>: sd ra,-8(sp) 0xffffffff806fce98 <+4>: auipc ra,0xff90f 0xffffffff806fce9c <+8>: jalr -684(ra) # 0xffffffff8000bbec <ftrace_caller> 0xffffffff806fcea0 <+12>: ld ra,-8(sp) 0xffffffff806fcea4 <+16>: nop /* wasted */ 0xffffffff806fcea8 <+20>: nop /* wasted */ 0xffffffff806fceac <+24>: nop /* wasted */ 0xffffffff806fceb0 <+28>: nop /* wasted */ 0xffffffff806fceb4 <+0>: addi sp,sp,-48 0xffffffff806fceb8 <+4>: sd s0,32(sp) 0xffffffff806fcebc <+8>: sd s1,24(sp) 0xffffffff806fcec0 <+12>: sd s2,16(sp) 0xffffffff806fcec4 <+16>: sd s3,8(sp) 0xffffffff806fcec8 <+20>: sd ra,40(sp) 0xffffffff806fcecc <+24>: addi s0,sp,48
Signed-off-by: Guo Ren guoren@linux.alibaba.com Signed-off-by: Guo Ren guoren@kernel.org Link: https://lore.kernel.org/r/20230112090603.1295340-3-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/Makefile | 4 ++++ 1 file changed, 4 insertions(+)
--- a/arch/riscv/Makefile +++ b/arch/riscv/Makefile @@ -11,7 +11,11 @@ LDFLAGS_vmlinux := ifeq ($(CONFIG_DYNAMIC_FTRACE),y) LDFLAGS_vmlinux := --no-relax KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY +ifeq ($(CONFIG_RISCV_ISA_C),y) CC_FLAGS_FTRACE := -fpatchable-function-entry=8 +else + CC_FLAGS_FTRACE := -fpatchable-function-entry=4 +endif endif
ifeq ($(CONFIG_CMODEL_MEDLOW),y)
From: Guo Ren guoren@linux.alibaba.com
commit 6724a76cff85ee271bbbff42ac527e4643b2ec52 upstream.
Use a temporary register to reduce the size of detour code from 16 bytes to 8 bytes. The previous implementation is from 'commit afc76b8b8011 ("riscv: Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT")'.
Before the patch: <func_prolog>: 0: REG_S ra, -SZREG(sp) 4: auipc ra, ? 8: jalr ?(ra) 12: REG_L ra, -SZREG(sp) (func_boddy)
After the patch: <func_prolog>: 0: auipc t0, ? 4: jalr t0, ?(t0) (func_boddy)
This patch not just reduces the size of detour code, but also fixes an important issue:
An Ftrace callback registered with FTRACE_OPS_FL_IPMODIFY flag can actually change the instruction pointer, e.g. to "replace" the given kernel function with a new one, which is needed for livepatching, etc.
In this case, the trampoline (ftrace_regs_caller) would not return to <func_prolog+12> but would rather jump to the new function. So, "REG_L ra, -SZREG(sp)" would not run and the original return address would not be restored. The kernel is likely to hang or crash as a result.
This can be easily demonstrated if one tries to "replace", say, cmdline_proc_show() with a new function with the same signature using instruction_pointer_set(&fregs->regs, new_func_addr) in the Ftrace callback.
Link: https://lore.kernel.org/linux-riscv/20221122075440.1165172-1-suagrfillet@gma... Link: https://lore.kernel.org/linux-riscv/d7d5730b-ebef-68e5-5046-e763e1ee6164@yad... Co-developed-by: Song Shuai suagrfillet@gmail.com Signed-off-by: Song Shuai suagrfillet@gmail.com Signed-off-by: Guo Ren guoren@linux.alibaba.com Signed-off-by: Guo Ren guoren@kernel.org Cc: Evgenii Shatokhin e.shatokhin@yadro.com Reviewed-by: Evgenii Shatokhin e.shatokhin@yadro.com Link: https://lore.kernel.org/r/20230112090603.1295340-4-guoren@kernel.org Cc: stable@vger.kernel.org Fixes: 10626c32e382 ("riscv/ftrace: Add basic support") Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/Makefile | 4 +- arch/riscv/include/asm/ftrace.h | 50 +++++++++++++++++++++++------- arch/riscv/kernel/ftrace.c | 65 +++++++++++----------------------------- arch/riscv/kernel/mcount-dyn.S | 42 +++++++++---------------- 4 files changed, 75 insertions(+), 86 deletions(-)
--- a/arch/riscv/Makefile +++ b/arch/riscv/Makefile @@ -12,9 +12,9 @@ ifeq ($(CONFIG_DYNAMIC_FTRACE),y) LDFLAGS_vmlinux := --no-relax KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY ifeq ($(CONFIG_RISCV_ISA_C),y) - CC_FLAGS_FTRACE := -fpatchable-function-entry=8 -else CC_FLAGS_FTRACE := -fpatchable-function-entry=4 +else + CC_FLAGS_FTRACE := -fpatchable-function-entry=2 endif endif
--- a/arch/riscv/include/asm/ftrace.h +++ b/arch/riscv/include/asm/ftrace.h @@ -42,6 +42,14 @@ struct dyn_arch_ftrace { * 2) jalr: setting low-12 offset to ra, jump to ra, and set ra to * return address (original pc + 4) * + *<ftrace enable>: + * 0: auipc t0/ra, 0x? + * 4: jalr t0/ra, ?(t0/ra) + * + *<ftrace disable>: + * 0: nop + * 4: nop + * * Dynamic ftrace generates probes to call sites, so we must deal with * both auipc and jalr at the same time. */ @@ -52,25 +60,43 @@ struct dyn_arch_ftrace { #define AUIPC_OFFSET_MASK (0xfffff000) #define AUIPC_PAD (0x00001000) #define JALR_SHIFT 20 -#define JALR_BASIC (0x000080e7) -#define AUIPC_BASIC (0x00000097) +#define JALR_RA (0x000080e7) +#define AUIPC_RA (0x00000097) +#define JALR_T0 (0x000282e7) +#define AUIPC_T0 (0x00000297) #define NOP4 (0x00000013)
-#define make_call(caller, callee, call) \ +#define to_jalr_t0(offset) \ + (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_T0) + +#define to_auipc_t0(offset) \ + ((offset & JALR_SIGN_MASK) ? \ + (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_T0) : \ + ((offset & AUIPC_OFFSET_MASK) | AUIPC_T0)) + +#define make_call_t0(caller, callee, call) \ do { \ - call[0] = to_auipc_insn((unsigned int)((unsigned long)callee - \ - (unsigned long)caller)); \ - call[1] = to_jalr_insn((unsigned int)((unsigned long)callee - \ - (unsigned long)caller)); \ + unsigned int offset = \ + (unsigned long) callee - (unsigned long) caller; \ + call[0] = to_auipc_t0(offset); \ + call[1] = to_jalr_t0(offset); \ } while (0)
-#define to_jalr_insn(offset) \ - (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_BASIC) +#define to_jalr_ra(offset) \ + (((offset & JALR_OFFSET_MASK) << JALR_SHIFT) | JALR_RA)
-#define to_auipc_insn(offset) \ +#define to_auipc_ra(offset) \ ((offset & JALR_SIGN_MASK) ? \ - (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_BASIC) : \ - ((offset & AUIPC_OFFSET_MASK) | AUIPC_BASIC)) + (((offset & AUIPC_OFFSET_MASK) + AUIPC_PAD) | AUIPC_RA) : \ + ((offset & AUIPC_OFFSET_MASK) | AUIPC_RA)) + +#define make_call_ra(caller, callee, call) \ +do { \ + unsigned int offset = \ + (unsigned long) callee - (unsigned long) caller; \ + call[0] = to_auipc_ra(offset); \ + call[1] = to_jalr_ra(offset); \ +} while (0)
/* * Let auipc+jalr be the basic *mcount unit*, so we make it 8 bytes here. --- a/arch/riscv/kernel/ftrace.c +++ b/arch/riscv/kernel/ftrace.c @@ -55,12 +55,15 @@ static int ftrace_check_current_call(uns }
static int __ftrace_modify_call(unsigned long hook_pos, unsigned long target, - bool enable) + bool enable, bool ra) { unsigned int call[2]; unsigned int nops[2] = {NOP4, NOP4};
- make_call(hook_pos, target, call); + if (ra) + make_call_ra(hook_pos, target, call); + else + make_call_t0(hook_pos, target, call);
/* Replace the auipc-jalr pair at once. Return -EPERM on write error. */ if (patch_text_nosync @@ -70,42 +73,13 @@ static int __ftrace_modify_call(unsigned return 0; }
-/* - * Put 5 instructions with 16 bytes at the front of function within - * patchable function entry nops' area. - * - * 0: REG_S ra, -SZREG(sp) - * 1: auipc ra, 0x? - * 2: jalr -?(ra) - * 3: REG_L ra, -SZREG(sp) - * - * So the opcodes is: - * 0: 0xfe113c23 (sd)/0xfe112e23 (sw) - * 1: 0x???????? -> auipc - * 2: 0x???????? -> jalr - * 3: 0xff813083 (ld)/0xffc12083 (lw) - */ -#if __riscv_xlen == 64 -#define INSN0 0xfe113c23 -#define INSN3 0xff813083 -#elif __riscv_xlen == 32 -#define INSN0 0xfe112e23 -#define INSN3 0xffc12083 -#endif - -#define FUNC_ENTRY_SIZE 16 -#define FUNC_ENTRY_JMP 4 - int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) { - unsigned int call[4] = {INSN0, 0, 0, INSN3}; - unsigned long target = addr; - unsigned long caller = rec->ip + FUNC_ENTRY_JMP; + unsigned int call[2];
- call[1] = to_auipc_insn((unsigned int)(target - caller)); - call[2] = to_jalr_insn((unsigned int)(target - caller)); + make_call_t0(rec->ip, addr, call);
- if (patch_text_nosync((void *)rec->ip, call, FUNC_ENTRY_SIZE)) + if (patch_text_nosync((void *)rec->ip, call, MCOUNT_INSN_SIZE)) return -EPERM;
return 0; @@ -114,15 +88,14 @@ int ftrace_make_call(struct dyn_ftrace * int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec, unsigned long addr) { - unsigned int nops[4] = {NOP4, NOP4, NOP4, NOP4}; + unsigned int nops[2] = {NOP4, NOP4};
- if (patch_text_nosync((void *)rec->ip, nops, FUNC_ENTRY_SIZE)) + if (patch_text_nosync((void *)rec->ip, nops, MCOUNT_INSN_SIZE)) return -EPERM;
return 0; }
- /* * This is called early on, and isn't wrapped by * ftrace_arch_code_modify_{prepare,post_process}() and therefor doesn't hold @@ -144,10 +117,10 @@ int ftrace_init_nop(struct module *mod, int ftrace_update_ftrace_func(ftrace_func_t func) { int ret = __ftrace_modify_call((unsigned long)&ftrace_call, - (unsigned long)func, true); + (unsigned long)func, true, true); if (!ret) { ret = __ftrace_modify_call((unsigned long)&ftrace_regs_call, - (unsigned long)func, true); + (unsigned long)func, true, true); }
return ret; @@ -159,16 +132,16 @@ int ftrace_modify_call(struct dyn_ftrace unsigned long addr) { unsigned int call[2]; - unsigned long caller = rec->ip + FUNC_ENTRY_JMP; + unsigned long caller = rec->ip; int ret;
- make_call(caller, old_addr, call); + make_call_t0(caller, old_addr, call); ret = ftrace_check_current_call(caller, call);
if (ret) return ret;
- return __ftrace_modify_call(caller, addr, true); + return __ftrace_modify_call(caller, addr, true, false); } #endif
@@ -203,12 +176,12 @@ int ftrace_enable_ftrace_graph_caller(vo int ret;
ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call, - (unsigned long)&prepare_ftrace_return, true); + (unsigned long)&prepare_ftrace_return, true, true); if (ret) return ret;
return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call, - (unsigned long)&prepare_ftrace_return, true); + (unsigned long)&prepare_ftrace_return, true, true); }
int ftrace_disable_ftrace_graph_caller(void) @@ -216,12 +189,12 @@ int ftrace_disable_ftrace_graph_caller(v int ret;
ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call, - (unsigned long)&prepare_ftrace_return, false); + (unsigned long)&prepare_ftrace_return, false, true); if (ret) return ret;
return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call, - (unsigned long)&prepare_ftrace_return, false); + (unsigned long)&prepare_ftrace_return, false, true); } #endif /* CONFIG_DYNAMIC_FTRACE */ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */ --- a/arch/riscv/kernel/mcount-dyn.S +++ b/arch/riscv/kernel/mcount-dyn.S @@ -13,8 +13,8 @@
.text
-#define FENTRY_RA_OFFSET 12 -#define ABI_SIZE_ON_STACK 72 +#define FENTRY_RA_OFFSET 8 +#define ABI_SIZE_ON_STACK 80 #define ABI_A0 0 #define ABI_A1 8 #define ABI_A2 16 @@ -23,10 +23,10 @@ #define ABI_A5 40 #define ABI_A6 48 #define ABI_A7 56 -#define ABI_RA 64 +#define ABI_T0 64 +#define ABI_RA 72
.macro SAVE_ABI - addi sp, sp, -SZREG addi sp, sp, -ABI_SIZE_ON_STACK
REG_S a0, ABI_A0(sp) @@ -37,6 +37,7 @@ REG_S a5, ABI_A5(sp) REG_S a6, ABI_A6(sp) REG_S a7, ABI_A7(sp) + REG_S t0, ABI_T0(sp) REG_S ra, ABI_RA(sp) .endm
@@ -49,24 +50,18 @@ REG_L a5, ABI_A5(sp) REG_L a6, ABI_A6(sp) REG_L a7, ABI_A7(sp) + REG_L t0, ABI_T0(sp) REG_L ra, ABI_RA(sp)
addi sp, sp, ABI_SIZE_ON_STACK - addi sp, sp, SZREG .endm
#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS .macro SAVE_ALL - addi sp, sp, -SZREG addi sp, sp, -PT_SIZE_ON_STACK
- REG_S x1, PT_EPC(sp) - addi sp, sp, PT_SIZE_ON_STACK - REG_L x1, (sp) - addi sp, sp, -PT_SIZE_ON_STACK + REG_S t0, PT_EPC(sp) REG_S x1, PT_RA(sp) - REG_L x1, PT_EPC(sp) - REG_S x2, PT_SP(sp) REG_S x3, PT_GP(sp) REG_S x4, PT_TP(sp) @@ -100,15 +95,11 @@ .endm
.macro RESTORE_ALL + REG_L t0, PT_EPC(sp) REG_L x1, PT_RA(sp) - addi sp, sp, PT_SIZE_ON_STACK - REG_S x1, (sp) - addi sp, sp, -PT_SIZE_ON_STACK - REG_L x1, PT_EPC(sp) REG_L x2, PT_SP(sp) REG_L x3, PT_GP(sp) REG_L x4, PT_TP(sp) - REG_L x5, PT_T0(sp) REG_L x6, PT_T1(sp) REG_L x7, PT_T2(sp) REG_L x8, PT_S0(sp) @@ -137,17 +128,16 @@ REG_L x31, PT_T6(sp)
addi sp, sp, PT_SIZE_ON_STACK - addi sp, sp, SZREG .endm #endif /* CONFIG_DYNAMIC_FTRACE_WITH_REGS */
ENTRY(ftrace_caller) SAVE_ABI
- addi a0, ra, -FENTRY_RA_OFFSET + addi a0, t0, -FENTRY_RA_OFFSET la a1, function_trace_op REG_L a2, 0(a1) - REG_L a1, ABI_SIZE_ON_STACK(sp) + mv a1, ra mv a3, sp
ftrace_call: @@ -155,8 +145,8 @@ ftrace_call: call ftrace_stub
#ifdef CONFIG_FUNCTION_GRAPH_TRACER - addi a0, sp, ABI_SIZE_ON_STACK - REG_L a1, ABI_RA(sp) + addi a0, sp, ABI_RA + REG_L a1, ABI_T0(sp) addi a1, a1, -FENTRY_RA_OFFSET #ifdef HAVE_FUNCTION_GRAPH_FP_TEST mv a2, s0 @@ -166,17 +156,17 @@ ftrace_graph_call: call ftrace_stub #endif RESTORE_ABI - ret + jr t0 ENDPROC(ftrace_caller)
#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS ENTRY(ftrace_regs_caller) SAVE_ALL
- addi a0, ra, -FENTRY_RA_OFFSET + addi a0, t0, -FENTRY_RA_OFFSET la a1, function_trace_op REG_L a2, 0(a1) - REG_L a1, PT_SIZE_ON_STACK(sp) + mv a1, ra mv a3, sp
ftrace_regs_call: @@ -196,6 +186,6 @@ ftrace_graph_regs_call: #endif
RESTORE_ALL - ret + jr t0 ENDPROC(ftrace_regs_caller) #endif /* CONFIG_DYNAMIC_FTRACE_WITH_REGS */
From: H. Nikolaus Schaller hns@goldelico.com
commit 0cb4228f6cc9ed0ca2be0d9ddf29168a8e3a3905 upstream.
According to schematics it is PF15 and not PF14 (MIC_SW_EN). Seems as if it was hidden and not noticed during testing since there is no sound DT node.
Fixes: 158c774d3c64 ("MIPS: Ingenic: Add missing nodes for Ingenic SoCs and boards.") Cc: stable@vger.kernel.org Signed-off-by: H. Nikolaus Schaller hns@goldelico.com Acked-by: Paul Cercueil paul@crapouillou.net Signed-off-by: Thomas Bogendoerfer tsbogend@alpha.franken.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/mips/boot/dts/ingenic/ci20.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/mips/boot/dts/ingenic/ci20.dts +++ b/arch/mips/boot/dts/ingenic/ci20.dts @@ -113,7 +113,7 @@ regulator-min-microvolt = <5000000>; regulator-max-microvolt = <5000000>;
- gpio = <&gpf 14 GPIO_ACTIVE_LOW>; + gpio = <&gpf 15 GPIO_ACTIVE_LOW>; enable-active-high; }; };
From: Lukas Wunner lukas@wunner.de
commit 8ef0217227b42e2c34a18de316cee3da16c9bf1e upstream.
If a PCI bridge is suspended to D3cold upon entering system sleep, resuming it entails a Fundamental Reset per PCIe r6.0 sec 5.8.
The delay prescribed after a Fundamental Reset in PCIe r6.0 sec 6.6.1 is sought to be observed by:
pci_pm_resume_noirq() pci_pm_bridge_power_up_actions() pci_bridge_wait_for_secondary_bus()
However, pci_bridge_wait_for_secondary_bus() bails out if the bridge_d3 flag is not set. That flag indicates whether a bridge is allowed to suspend to D3cold at *runtime*.
Hence *no* delay is observed on resume from system sleep if runtime D3cold is forbidden. That doesn't make any sense, so drop the bridge_d3 check from pci_bridge_wait_for_secondary_bus().
The purpose of the bridge_d3 check was probably to avoid delays if a bridge remained in D0 during suspend. However the sole caller of pci_bridge_wait_for_secondary_bus(), pci_pm_bridge_power_up_actions(), is only invoked if the previous power state was D3cold. Hence the additional bridge_d3 check seems superfluous.
Fixes: ad9001f2f411 ("PCI/PM: Add missing link delays required by the PCIe spec") Link: https://lore.kernel.org/r/eb37fa345285ec8bacabbf06b020b803f77bdd3d.167376951... Tested-by: Ravi Kishore Koppuravuri ravi.kishore.koppuravuri@intel.com Signed-off-by: Lukas Wunner lukas@wunner.de Signed-off-by: Bjorn Helgaas bhelgaas@google.com Reviewed-by: Mika Westerberg mika.westerberg@linux.intel.com Reviewed-by: Kuppuswamy Sathyanarayanan sathyanarayanan.kuppuswamy@linux.intel.com Cc: stable@vger.kernel.org # v5.5+ Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/pci/pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -4957,7 +4957,7 @@ void pci_bridge_wait_for_secondary_bus(s if (pci_dev_is_disconnected(dev)) return;
- if (!pci_is_bridge(dev) || !dev->bridge_d3) + if (!pci_is_bridge(dev)) return;
down_read(&pci_bus_sem);
From: Lukas Wunner lukas@wunner.de
commit ac91e6980563ed53afadd925fa6585ffd2bc4a2c upstream.
Sheng Bi reports that pci_bridge_secondary_bus_reset() may fail to wait for devices on the secondary bus to become accessible after reset:
Although it does call pci_dev_wait(), it erroneously passes the bridge's pci_dev rather than that of a child. The bridge of course is always accessible while its secondary bus is reset, so pci_dev_wait() returns immediately.
Sheng Bi proposes introducing a new pci_bridge_secondary_bus_wait() function which is called from pci_bridge_secondary_bus_reset():
https://lore.kernel.org/linux-pci/20220523171517.32407-1-windy.bi.enflame@gm...
However we already have pci_bridge_wait_for_secondary_bus() which does almost exactly what we need. So far it's only called on resume from D3cold (which implies a Fundamental Reset per PCIe r6.0 sec 5.8). Re-using it for Secondary Bus Resets is a leaner and more rational approach than introducing a new function.
That only requires a few minor tweaks:
- Amend pci_bridge_wait_for_secondary_bus() to await accessibility of the first device on the secondary bus by calling pci_dev_wait() after performing the prescribed delays. pci_dev_wait() needs two parameters, a reset reason and a timeout, which callers must now pass to pci_bridge_wait_for_secondary_bus(). The timeout is 1 sec for resume (PCIe r6.0 sec 6.6.1) and 60 sec for reset (commit 821cdad5c46c ("PCI: Wait up to 60 seconds for device to become ready after FLR")). Introduce a PCI_RESET_WAIT macro for the 1 sec timeout.
- Amend pci_bridge_wait_for_secondary_bus() to return 0 on success or -ENOTTY on error for consumption by pci_bridge_secondary_bus_reset().
- Drop an unnecessary 1 sec delay from pci_reset_secondary_bus() which is now performed by pci_bridge_wait_for_secondary_bus(). A static delay this long is only necessary for Conventional PCI, so modern PCIe systems benefit from shorter reset times as a side effect.
Fixes: 6b2f1351af56 ("PCI: Wait for device to become ready after secondary bus reset") Link: https://lore.kernel.org/r/da77c92796b99ec568bd070cbe4725074a117038.167376951... Reported-by: Sheng Bi windy.bi.enflame@gmail.com Tested-by: Ravi Kishore Koppuravuri ravi.kishore.koppuravuri@intel.com Signed-off-by: Lukas Wunner lukas@wunner.de Signed-off-by: Bjorn Helgaas bhelgaas@google.com Reviewed-by: Mika Westerberg mika.westerberg@linux.intel.com Reviewed-by: Kuppuswamy Sathyanarayanan sathyanarayanan.kuppuswamy@linux.intel.com Cc: stable@vger.kernel.org # v4.17+ Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/pci/pci-driver.c | 2 - drivers/pci/pci.c | 54 ++++++++++++++++++++--------------------------- drivers/pci/pci.h | 10 +++++++- 3 files changed, 34 insertions(+), 32 deletions(-)
--- a/drivers/pci/pci-driver.c +++ b/drivers/pci/pci-driver.c @@ -572,7 +572,7 @@ static void pci_pm_default_resume_early(
static void pci_pm_bridge_power_up_actions(struct pci_dev *pci_dev) { - pci_bridge_wait_for_secondary_bus(pci_dev); + pci_bridge_wait_for_secondary_bus(pci_dev, "resume", PCI_RESET_WAIT); /* * When powering on a bridge from D3cold, the whole hierarchy may be * powered on into D0uninitialized state, resume them to give them a --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -1174,7 +1174,7 @@ static int pci_dev_wait(struct pci_dev * return -ENOTTY; }
- if (delay > 1000) + if (delay > PCI_RESET_WAIT) pci_info(dev, "not ready %dms after %s; waiting\n", delay - 1, reset_type);
@@ -1183,7 +1183,7 @@ static int pci_dev_wait(struct pci_dev * pci_read_config_dword(dev, PCI_COMMAND, &id); }
- if (delay > 1000) + if (delay > PCI_RESET_WAIT) pci_info(dev, "ready %dms after %s\n", delay - 1, reset_type);
@@ -4941,24 +4941,31 @@ static int pci_bus_max_d3cold_delay(cons /** * pci_bridge_wait_for_secondary_bus - Wait for secondary bus to be accessible * @dev: PCI bridge + * @reset_type: reset type in human-readable form + * @timeout: maximum time to wait for devices on secondary bus (milliseconds) * * Handle necessary delays before access to the devices on the secondary - * side of the bridge are permitted after D3cold to D0 transition. + * side of the bridge are permitted after D3cold to D0 transition + * or Conventional Reset. * * For PCIe this means the delays in PCIe 5.0 section 6.6.1. For * conventional PCI it means Tpvrh + Trhfa specified in PCI 3.0 section * 4.3.2. + * + * Return 0 on success or -ENOTTY if the first device on the secondary bus + * failed to become accessible. */ -void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev) +int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type, + int timeout) { struct pci_dev *child; int delay;
if (pci_dev_is_disconnected(dev)) - return; + return 0;
if (!pci_is_bridge(dev)) - return; + return 0;
down_read(&pci_bus_sem);
@@ -4970,14 +4977,14 @@ void pci_bridge_wait_for_secondary_bus(s */ if (!dev->subordinate || list_empty(&dev->subordinate->devices)) { up_read(&pci_bus_sem); - return; + return 0; }
/* Take d3cold_delay requirements into account */ delay = pci_bus_max_d3cold_delay(dev->subordinate); if (!delay) { up_read(&pci_bus_sem); - return; + return 0; }
child = list_first_entry(&dev->subordinate->devices, struct pci_dev, @@ -4986,14 +4993,12 @@ void pci_bridge_wait_for_secondary_bus(s
/* * Conventional PCI and PCI-X we need to wait Tpvrh + Trhfa before - * accessing the device after reset (that is 1000 ms + 100 ms). In - * practice this should not be needed because we don't do power - * management for them (see pci_bridge_d3_possible()). + * accessing the device after reset (that is 1000 ms + 100 ms). */ if (!pci_is_pcie(dev)) { pci_dbg(dev, "waiting %d ms for secondary bus\n", 1000 + delay); msleep(1000 + delay); - return; + return 0; }
/* @@ -5010,11 +5015,11 @@ void pci_bridge_wait_for_secondary_bus(s * configuration requests if we only wait for 100 ms (see * https://bugzilla.kernel.org/show_bug.cgi?id=203885). * - * Therefore we wait for 100 ms and check for the device presence. - * If it is still not present give it an additional 100 ms. + * Therefore we wait for 100 ms and check for the device presence + * until the timeout expires. */ if (!pcie_downstream_port(dev)) - return; + return 0;
if (pcie_get_speed_cap(dev) <= PCIE_SPEED_5_0GT) { pci_dbg(dev, "waiting %d ms for downstream link\n", delay); @@ -5025,14 +5030,11 @@ void pci_bridge_wait_for_secondary_bus(s if (!pcie_wait_for_link_delay(dev, true, delay)) { /* Did not train, no need to wait any further */ pci_info(dev, "Data Link Layer Link Active not set in 1000 msec\n"); - return; + return -ENOTTY; } }
- if (!pci_device_is_present(child)) { - pci_dbg(child, "waiting additional %d ms to become accessible\n", delay); - msleep(delay); - } + return pci_dev_wait(child, reset_type, timeout - delay); }
void pci_reset_secondary_bus(struct pci_dev *dev) @@ -5051,15 +5053,6 @@ void pci_reset_secondary_bus(struct pci_
ctrl &= ~PCI_BRIDGE_CTL_BUS_RESET; pci_write_config_word(dev, PCI_BRIDGE_CONTROL, ctrl); - - /* - * Trhfa for conventional PCI is 2^25 clock cycles. - * Assuming a minimum 33MHz clock this results in a 1s - * delay before we can consider subordinate devices to - * be re-initialized. PCIe has some ways to shorten this, - * but we don't make use of them yet. - */ - ssleep(1); }
void __weak pcibios_reset_secondary_bus(struct pci_dev *dev) @@ -5078,7 +5071,8 @@ int pci_bridge_secondary_bus_reset(struc { pcibios_reset_secondary_bus(dev);
- return pci_dev_wait(dev, "bus reset", PCIE_RESET_READY_POLL_MS); + return pci_bridge_wait_for_secondary_bus(dev, "bus reset", + PCIE_RESET_READY_POLL_MS); } EXPORT_SYMBOL_GPL(pci_bridge_secondary_bus_reset);
--- a/drivers/pci/pci.h +++ b/drivers/pci/pci.h @@ -64,6 +64,13 @@ struct pci_cap_saved_state *pci_find_sav #define PCI_PM_D3HOT_WAIT 10 /* msec */ #define PCI_PM_D3COLD_WAIT 100 /* msec */
+/* + * Following exit from Conventional Reset, devices must be ready within 1 sec + * (PCIe r6.0 sec 6.6.1). A D3cold to D0 transition implies a Conventional + * Reset (PCIe r6.0 sec 5.8). + */ +#define PCI_RESET_WAIT 1000 /* msec */ + void pci_update_current_state(struct pci_dev *dev, pci_power_t state); void pci_refresh_power_state(struct pci_dev *dev); int pci_power_up(struct pci_dev *dev); @@ -86,8 +93,9 @@ void pci_msi_init(struct pci_dev *dev); void pci_msix_init(struct pci_dev *dev); bool pci_bridge_d3_possible(struct pci_dev *dev); void pci_bridge_d3_update(struct pci_dev *dev); -void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev); void pci_bridge_reconfigure_ltr(struct pci_dev *dev); +int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type, + int timeout);
static inline void pci_wakeup_event(struct pci_dev *dev) {
From: Lukas Wunner lukas@wunner.de
commit 74ff8864cc842be994853095dba6db48e716400a upstream.
On surprise removal, pciehp_unconfigure_device() and acpiphp's trim_stale_devices() call pci_dev_set_disconnected() to mark removed devices as permanently offline. Thereby, the PCI core and drivers know to skip device accesses.
However pci_dev_set_disconnected() takes the device_lock and thus waits for a concurrent driver bind or unbind to complete. As a result, the driver's ->probe and ->remove hooks have no chance to learn that the device is gone.
That doesn't make any sense, so drop the device_lock and instead use atomic xchg() and cmpxchg() operations to update the device state.
As a byproduct, an AB-BA deadlock reported by Anatoli is fixed which occurs on surprise removal with AER concurrently performing a bus reset.
AER bus reset:
INFO: task irq/26-aerdrv:95 blocked for more than 120 seconds. Tainted: G W 6.2.0-rc3-custom-norework-jan11+ schedule rwsem_down_write_slowpath down_write_nested pciehp_reset_slot # acquires reset_lock pci_reset_hotplug_slot pci_slot_reset # acquires device_lock pci_bus_error_reset aer_root_reset pcie_do_recovery aer_process_err_devices aer_isr
pciehp surprise removal:
INFO: task irq/26-pciehp:96 blocked for more than 120 seconds. Tainted: G W 6.2.0-rc3-custom-norework-jan11+ schedule_preempt_disabled __mutex_lock mutex_lock_nested pci_dev_set_disconnected # acquires device_lock pci_walk_bus pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist # acquires reset_lock
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215590 Fixes: a6bd101b8f84 ("PCI: Unify device inaccessible") Link: https://lore.kernel.org/r/3dc88ea82bdc0e37d9000e413d5ebce481cbd629.167420568... Reported-by: Anatoli Antonovitch anatoli.antonovitch@amd.com Signed-off-by: Lukas Wunner lukas@wunner.de Signed-off-by: Bjorn Helgaas bhelgaas@google.com Cc: stable@vger.kernel.org # v4.20+ Cc: Keith Busch kbusch@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/pci/pci.h | 43 +++++++++++++------------------------------ 1 file changed, 13 insertions(+), 30 deletions(-)
--- a/drivers/pci/pci.h +++ b/drivers/pci/pci.h @@ -318,53 +318,36 @@ struct pci_sriov { * @dev: PCI device to set new error_state * @new: the state we want dev to be in * - * Must be called with device_lock held. + * If the device is experiencing perm_failure, it has to remain in that state. + * Any other transition is allowed. * * Returns true if state has been changed to the requested state. */ static inline bool pci_dev_set_io_state(struct pci_dev *dev, pci_channel_state_t new) { - bool changed = false; + pci_channel_state_t old;
- device_lock_assert(&dev->dev); switch (new) { case pci_channel_io_perm_failure: - switch (dev->error_state) { - case pci_channel_io_frozen: - case pci_channel_io_normal: - case pci_channel_io_perm_failure: - changed = true; - break; - } - break; + xchg(&dev->error_state, pci_channel_io_perm_failure); + return true; case pci_channel_io_frozen: - switch (dev->error_state) { - case pci_channel_io_frozen: - case pci_channel_io_normal: - changed = true; - break; - } - break; + old = cmpxchg(&dev->error_state, pci_channel_io_normal, + pci_channel_io_frozen); + return old != pci_channel_io_perm_failure; case pci_channel_io_normal: - switch (dev->error_state) { - case pci_channel_io_frozen: - case pci_channel_io_normal: - changed = true; - break; - } - break; + old = cmpxchg(&dev->error_state, pci_channel_io_frozen, + pci_channel_io_normal); + return old != pci_channel_io_perm_failure; + default: + return false; } - if (changed) - dev->error_state = new; - return changed; }
static inline int pci_dev_set_disconnected(struct pci_dev *dev, void *unused) { - device_lock(&dev->dev); pci_dev_set_io_state(dev, pci_channel_io_perm_failure); - device_unlock(&dev->dev);
return 0; }
From: Damien Le Moal damien.lemoal@opensource.wdc.com
commit 63ba51db24ed1b8f8088a897290eb6c036c5435d upstream.
PCI passthrough to VMs does not work with AMD FCH AHCI adapters: the guest OS fails to correctly probe devices attached to the controller due to FIS communication failures:
ata4: softreset failed (1st FIS failed) ... ata4.00: qc timeout after 5000 msecs (cmd 0xec) ata4.00: failed to IDENTIFY (I/O error, err_mask=0x4)
Forcing the "bus" reset method before unbinding & binding the adapter to the vfio-pci driver solves this issue, e.g.:
echo "bus" > /sys/bus/pci/devices/<ID>/reset_method
gives a working guest OS, indicating that the default FLR reset method doesn't work correctly.
Apply quirk_no_flr() to AMD FCH AHCI devices to work around this issue.
Link: https://lore.kernel.org/r/20230128013951.523247-1-damien.lemoal@opensource.w... Reported-by: Niklas Cassel niklas.cassel@wdc.com Signed-off-by: Damien Le Moal damien.lemoal@opensource.wdc.com Signed-off-by: Bjorn Helgaas bhelgaas@google.com Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
--- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -5340,6 +5340,7 @@ static void quirk_no_flr(struct pci_dev DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1487, quirk_no_flr); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x148c, quirk_no_flr); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x149c, quirk_no_flr); +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x7901, quirk_no_flr); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr);
From: Lukas Wunner lukas@wunner.de
commit 53b54ad074de1896f8b021615f65b27f557ce874 upstream.
pci_bridge_wait_for_secondary_bus() is called after a Secondary Bus Reset, but not after a DPC-induced Hot Reset.
As a result, the delays prescribed by PCIe r6.0 sec 6.6.1 are not observed and devices on the secondary bus may be accessed before they're ready.
One affected device is Intel's Ponte Vecchio HPC GPU. It comprises a PCIe switch whose upstream port is not immediately ready after reset. Because its config space is restored too early, it remains in D0uninitialized, its subordinate devices remain inaccessible and DPC recovery fails with messages such as:
i915 0000:8c:00.0: can't change power state from D3cold to D0 (config space inaccessible) intel_vsec 0000:8e:00.1: can't change power state from D3cold to D0 (config space inaccessible) pcieport 0000:89:02.0: AER: device recovery failed
Fix it.
Link: https://lore.kernel.org/r/9f5ff00e1593d8d9a4b452398b98aa14d23fca11.167376951... Tested-by: Ravi Kishore Koppuravuri ravi.kishore.koppuravuri@intel.com Signed-off-by: Lukas Wunner lukas@wunner.de Signed-off-by: Bjorn Helgaas bhelgaas@google.com Reviewed-by: Mika Westerberg mika.westerberg@linux.intel.com Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/pci/pci.c | 3 --- drivers/pci/pci.h | 6 ++++++ drivers/pci/pcie/dpc.c | 4 ++-- 3 files changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -167,9 +167,6 @@ static int __init pcie_port_pm_setup(cha } __setup("pcie_port_pm=", pcie_port_pm_setup);
-/* Time to wait after a reset for device to become responsive */ -#define PCIE_RESET_READY_POLL_MS 60000 - /** * pci_bus_max_busnr - returns maximum PCI bus number of given bus' children * @bus: pointer to PCI bus structure to search --- a/drivers/pci/pci.h +++ b/drivers/pci/pci.h @@ -70,6 +70,12 @@ struct pci_cap_saved_state *pci_find_sav * Reset (PCIe r6.0 sec 5.8). */ #define PCI_RESET_WAIT 1000 /* msec */ +/* + * Devices may extend the 1 sec period through Request Retry Status completions + * (PCIe r6.0 sec 2.3.1). The spec does not provide an upper limit, but 60 sec + * ought to be enough for any device to become responsive. + */ +#define PCIE_RESET_READY_POLL_MS 60000 /* msec */
void pci_update_current_state(struct pci_dev *dev, pci_power_t state); void pci_refresh_power_state(struct pci_dev *dev); --- a/drivers/pci/pcie/dpc.c +++ b/drivers/pci/pcie/dpc.c @@ -170,8 +170,8 @@ pci_ers_result_t dpc_reset_link(struct p pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS, PCI_EXP_DPC_STATUS_TRIGGER);
- if (!pcie_wait_for_link(pdev, true)) { - pci_info(pdev, "Data Link Layer Link Active not set in 1000 msec\n"); + if (pci_bridge_wait_for_secondary_bus(pdev, "DPC", + PCIE_RESET_READY_POLL_MS)) { clear_bit(PCI_DPC_RECOVERED, &pdev->priv_flags); ret = PCI_ERS_RESULT_DISCONNECT; } else {
From: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org
commit e6cebcc27519dcf1652e604c73b9fd4f416987c0 upstream.
For the STOP and RESET commands, only send the channel disconnect status -ENOTCONN if client driver is available. Otherwise, it will result in null pointer dereference.
Cc: stable@vger.kernel.org # 5.19 Fixes: e827569062a8 ("bus: mhi: ep: Add support for processing command rings") Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Reviewed-by: Jeffrey Hugo quic_jhugo@quicinc.com Link: https://lore.kernel.org/r/20221228161704.255268-4-manivannan.sadhasivam@lina... Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/bus/mhi/ep/main.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/bus/mhi/ep/main.c +++ b/drivers/bus/mhi/ep/main.c @@ -196,9 +196,11 @@ static int mhi_ep_process_cmd_ring(struc mhi_ep_mmio_disable_chdb(mhi_cntrl, ch_id);
/* Send channel disconnect status to client drivers */ - result.transaction_status = -ENOTCONN; - result.bytes_xferd = 0; - mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); + if (mhi_chan->xfer_cb) { + result.transaction_status = -ENOTCONN; + result.bytes_xferd = 0; + mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); + }
/* Set channel state to STOP */ mhi_chan->state = MHI_CH_STATE_STOP; @@ -228,9 +230,11 @@ static int mhi_ep_process_cmd_ring(struc mhi_ep_ring_reset(mhi_cntrl, ch_ring);
/* Send channel disconnect status to client driver */ - result.transaction_status = -ENOTCONN; - result.bytes_xferd = 0; - mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); + if (mhi_chan->xfer_cb) { + result.transaction_status = -ENOTCONN; + result.bytes_xferd = 0; + mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result); + }
/* Set channel state to DISABLED */ mhi_chan->state = MHI_CH_STATE_DISABLED;
From: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org
commit 8d6a1fea53864cd9545741f48f4ae4df804db557 upstream.
There is a good chance that while the channel ring gets processed, the STOP or RESET command for the channel might be received from the MHI host. In those cases, the entire channel ring processing needs to be protected by chan->lock to prevent the race where the corresponding channel ring might be reset.
While at it, let's also add a sanity check to make sure that the ring is started before processing it. Because, if the STOP/RESET command gets processed while mhi_ep_ch_ring_worker() waited for chan->lock, the ring would've been reset.
Cc: stable@vger.kernel.org # 5.19 Fixes: 03c0bb8ec983 ("bus: mhi: ep: Add support for processing channel rings") Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Reviewed-by: Jeffrey Hugo quic_jhugo@quicinc.com Link: https://lore.kernel.org/r/20221228161704.255268-6-manivannan.sadhasivam@lina... Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/bus/mhi/ep/main.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
--- a/drivers/bus/mhi/ep/main.c +++ b/drivers/bus/mhi/ep/main.c @@ -723,24 +723,37 @@ static void mhi_ep_ch_ring_worker(struct list_del(&itr->node); ring = itr->ring;
+ chan = &mhi_cntrl->mhi_chan[ring->ch_id]; + mutex_lock(&chan->lock); + + /* + * The ring could've stopped while we waited to grab the (chan->lock), so do + * a sanity check before going further. + */ + if (!ring->started) { + mutex_unlock(&chan->lock); + kfree(itr); + continue; + } + /* Update the write offset for the ring */ ret = mhi_ep_update_wr_offset(ring); if (ret) { dev_err(dev, "Error updating write offset for ring\n"); + mutex_unlock(&chan->lock); kfree(itr); continue; }
/* Sanity check to make sure there are elements in the ring */ if (ring->rd_offset == ring->wr_offset) { + mutex_unlock(&chan->lock); kfree(itr); continue; }
el = &ring->ring_cache[ring->rd_offset]; - chan = &mhi_cntrl->mhi_chan[ring->ch_id];
- mutex_lock(&chan->lock); dev_dbg(dev, "Processing the ring for channel (%u)\n", ring->ch_id); ret = mhi_ep_process_ch_ring(ring, el); if (ret) {
From: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org
commit 8a1c24bb908f9ecbc4be0fea014df67d43161551 upstream.
During suspend and resume, the channel state needs to be saved locally. Otherwise, the endpoint may access the channels while they were being suspended and causing access violations.
Fix it by saving the channel state locally during suspend and resume.
Cc: stable@vger.kernel.org # 5.19 Fixes: e4b7b5f0f30a ("bus: mhi: ep: Add support for suspending and resuming channels") Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com) Link: https://lore.kernel.org/r/20221228161704.255268-7-manivannan.sadhasivam@lina... Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/bus/mhi/ep/main.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/bus/mhi/ep/main.c +++ b/drivers/bus/mhi/ep/main.c @@ -1136,6 +1136,7 @@ void mhi_ep_suspend_channels(struct mhi_
dev_dbg(&mhi_chan->mhi_dev->dev, "Suspending channel\n"); /* Set channel state to SUSPENDED */ + mhi_chan->state = MHI_CH_STATE_SUSPENDED; tmp &= ~CHAN_CTX_CHSTATE_MASK; tmp |= FIELD_PREP(CHAN_CTX_CHSTATE_MASK, MHI_CH_STATE_SUSPENDED); mhi_cntrl->ch_ctx_cache[i].chcfg = cpu_to_le32(tmp); @@ -1165,6 +1166,7 @@ void mhi_ep_resume_channels(struct mhi_e
dev_dbg(&mhi_chan->mhi_dev->dev, "Resuming channel\n"); /* Set channel state to RUNNING */ + mhi_chan->state = MHI_CH_STATE_RUNNING; tmp &= ~CHAN_CTX_CHSTATE_MASK; tmp |= FIELD_PREP(CHAN_CTX_CHSTATE_MASK, MHI_CH_STATE_RUNNING); mhi_cntrl->ch_ctx_cache[i].chcfg = cpu_to_le32(tmp);
From: Jason Gunthorpe jgg@nvidia.com
commit b3551ead616318ea155558cdbe7e91495b8d9b33 upstream.
Missed a zero initialization here. Most of the struct is filled with a copy_from_user(), however minsz for that copy is smaller than the actual struct by 8 bytes, thus we don't fill the padding.
Cc: stable@vger.kernel.org # 6.1+ Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") Link: https://lore.kernel.org/r/0-v1-a74499ece799+1a-iommufd_get_info_leak_jgg@nvi... Reviewed-by: Kevin Tian kevin.tian@intel.com Reported-by: syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/iommufd/vfio_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/iommufd/vfio_compat.c +++ b/drivers/iommu/iommufd/vfio_compat.c @@ -381,7 +381,7 @@ static int iommufd_vfio_iommu_get_info(s }; size_t minsz = offsetofend(struct vfio_iommu_type1_info, iova_pgsizes); struct vfio_info_cap_header __user *last_cap = NULL; - struct vfio_iommu_type1_info info; + struct vfio_iommu_type1_info info = {}; struct iommufd_ioas *ioas; size_t total_cap_size; int rc;
From: Jason Gunthorpe jgg@nvidia.com
commit b4ff830eca097df51af10a9be29e8cc817327919 upstream.
The hwpt is added to the hwpt_list only during its creation, it is never added again. This hunk is some missed leftover from rework. Adding it twice will corrupt the linked list in some cases.
It effects HWPT specific attachment, which is something the test suite cannot cover until we can create a legitimate struct device with a non-system iommu "driver" (ie we need the bus removed from the iommu code)
Cc: stable@vger.kernel.org Fixes: e8d57210035b ("iommufd: Add kAPI toward external drivers for physical devices") Link: https://lore.kernel.org/r/1-v1-4336b5cb2fe4+1d7-iommufd_hwpt_jgg@nvidia.com Reviewed-by: Kevin Tian kevin.tian@intel.com Reported-by: Kevin Tian kevin.tian@intel.com Signed-off-by: Jason Gunthorpe jgg@nvidia.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/iommufd/device.c | 4 ---- 1 file changed, 4 deletions(-)
--- a/drivers/iommu/iommufd/device.c +++ b/drivers/iommu/iommufd/device.c @@ -346,10 +346,6 @@ int iommufd_device_attach(struct iommufd rc = iommufd_device_do_attach(idev, hwpt); if (rc) goto out_put_pt_obj; - - mutex_lock(&hwpt->ioas->mutex); - list_add_tail(&hwpt->hwpt_item, &hwpt->ioas->hwpt_list); - mutex_unlock(&hwpt->ioas->mutex); break; } case IOMMUFD_OBJ_IOAS: {
From: Jacob Pan jacob.jun.pan@linux.intel.com
commit 16a75bbe480c3598b3af57a2504ea89b1e32c3ac upstream.
Intel IOMMU driver implements IOTLB flush queue with domain selective or PASID selective invalidations. In this case there's no need to track IOVA page range and sync IOTLBs, which may cause significant performance hit.
This patch adds a check to avoid IOVA gather page and IOTLB sync for the lazy path.
The performance difference on Sapphire Rapids 100Gb NIC is improved by the following (as measured by iperf send):
w/o this fix~48 Gbits/s. with this fix ~54 Gbits/s
Cc: stable@vger.kernel.org Fixes: 2a2b8eaa5b25 ("iommu: Handle freelists when using deferred flushing in iommu drivers") Reviewed-by: Robin Murphy robin.murphy@arm.com Reviewed-by: Kevin Tian kevin.tian@intel.com Tested-by: Sanjay Kumar sanjay.k.kumar@intel.com Signed-off-by: Sanjay Kumar sanjay.k.kumar@intel.com Signed-off-by: Jacob Pan jacob.jun.pan@linux.intel.com Link: https://lore.kernel.org/r/20230209175330.1783556-1-jacob.jun.pan@linux.intel... Signed-off-by: Lu Baolu baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/intel/iommu.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4347,7 +4347,12 @@ static size_t intel_iommu_unmap(struct i if (dmar_domain->max_addr == iova + size) dmar_domain->max_addr = iova;
- iommu_iotlb_gather_add_page(domain, gather, iova, size); + /* + * We do not use page-selective IOTLB invalidation in flush queue, + * so there is no need to track page and sync iotlb. + */ + if (!iommu_iotlb_gather_queued(gather)) + iommu_iotlb_gather_add_page(domain, gather, iova, size);
return size; }
From: Jacob Pan jacob.jun.pan@linux.intel.com
commit 194b3348bdbb7db65375c72f3f774aee4cc6614e upstream.
On platforms that do not support IOMMU Extended capability bit 0 Page-walk Coherency, CPU caches are not snooped when IOMMU is accessing any translation structures. IOMMU access goes only directly to memory. Intel IOMMU code was missing a flush for the PASID table directory that resulted in the unrecoverable fault as shown below.
This patch adds clflush calls whenever allocating and updating a PASID table directory to ensure cache coherency.
On the reverse direction, there's no need to clflush the PASID directory pointer when we deactivate a context entry in that IOMMU hardware will not see the old PASID directory pointer after we clear the context entry. PASID directory entries are also never freed once allocated.
DMAR: DRHD: handling fault status reg 3 DMAR: [DMA Read NO_PASID] Request device [00:0d.2] fault addr 0x1026a4000 [fault reason 0x51] SM: Present bit in Directory Entry is clear DMAR: Dump dmar1 table entries for IOVA 0x1026a4000 DMAR: scalable mode root entry: hi 0x0000000102448001, low 0x0000000101b3e001 DMAR: context entry: hi 0x0000000000000000, low 0x0000000101b4d401 DMAR: pasid dir entry: 0x0000000101b4e001 DMAR: pasid table entry[0]: 0x0000000000000109 DMAR: pasid table entry[1]: 0x0000000000000001 DMAR: pasid table entry[2]: 0x0000000000000000 DMAR: pasid table entry[3]: 0x0000000000000000 DMAR: pasid table entry[4]: 0x0000000000000000 DMAR: pasid table entry[5]: 0x0000000000000000 DMAR: pasid table entry[6]: 0x0000000000000000 DMAR: pasid table entry[7]: 0x0000000000000000 DMAR: PTE not present at level 4
Cc: stable@vger.kernel.org Fixes: 0bbeb01a4faf ("iommu/vt-d: Manage scalalble mode PASID tables") Reviewed-by: Kevin Tian kevin.tian@intel.com Reported-by: Sukumar Ghorai sukumar.ghorai@intel.com Signed-off-by: Ashok Raj ashok.raj@intel.com Signed-off-by: Jacob Pan jacob.jun.pan@linux.intel.com Link: https://lore.kernel.org/r/20230209212843.1788125-1-jacob.jun.pan@linux.intel... Signed-off-by: Lu Baolu baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel jroedel@suse.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iommu/intel/pasid.c | 7 +++++++ 1 file changed, 7 insertions(+)
--- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -128,6 +128,9 @@ int intel_pasid_alloc_table(struct devic pasid_table->max_pasid = 1 << (order + PAGE_SHIFT + 3); info->pasid_table = pasid_table;
+ if (!ecap_coherent(info->iommu->ecap)) + clflush_cache_range(pasid_table->table, size); + return 0; }
@@ -215,6 +218,10 @@ retry: free_pgtable_page(entries); goto retry; } + if (!ecap_coherent(info->iommu->ecap)) { + clflush_cache_range(entries, VTD_PAGE_SIZE); + clflush_cache_range(&dir[dir_index].val, sizeof(*dir)); + } }
return &entries[index];
From: Steve Sistare steven.sistare@oracle.com
commit ef3a3f6a294ba65fd906a291553935881796f8a5 upstream.
Disable the VFIO_UPDATE_VADDR capability if mediated devices are present. Their kernel threads could be blocked indefinitely by a misbehaving userland while trying to pin/unpin pages while vaddrs are being updated.
Do not allow groups to be added to the container while vaddr's are invalid, so we never need to block user threads from pinning, and can delete the vaddr-waiting code in a subsequent patch.
Fixes: c3cbab24db38 ("vfio/type1: implement interfaces to update vaddr") Cc: stable@vger.kernel.org Signed-off-by: Steve Sistare steven.sistare@oracle.com Reviewed-by: Kevin Tian kevin.tian@intel.com Reviewed-by: Jason Gunthorpe jgg@nvidia.com Link: https://lore.kernel.org/r/1675184289-267876-2-git-send-email-steven.sistare@... Signed-off-by: Alex Williamson alex.williamson@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/vfio/vfio_iommu_type1.c | 44 ++++++++++++++++++++++++++++++++++++++-- include/uapi/linux/vfio.h | 15 ++++++++----- 2 files changed, 51 insertions(+), 8 deletions(-)
--- a/drivers/vfio/vfio_iommu_type1.c +++ b/drivers/vfio/vfio_iommu_type1.c @@ -861,6 +861,12 @@ static int vfio_iommu_type1_pin_pages(vo
mutex_lock(&iommu->lock);
+ if (WARN_ONCE(iommu->vaddr_invalid_count, + "vfio_pin_pages not allowed with VFIO_UPDATE_VADDR\n")) { + ret = -EBUSY; + goto pin_done; + } + /* * Wait for all necessary vaddr's to be valid so they can be used in * the main loop without dropping the lock, to avoid racing vs unmap. @@ -1343,6 +1349,12 @@ static int vfio_dma_do_unmap(struct vfio
mutex_lock(&iommu->lock);
+ /* Cannot update vaddr if mdev is present. */ + if (invalidate_vaddr && !list_empty(&iommu->emulated_iommu_groups)) { + ret = -EBUSY; + goto unlock; + } + pgshift = __ffs(iommu->pgsize_bitmap); pgsize = (size_t)1 << pgshift;
@@ -2194,11 +2206,16 @@ static int vfio_iommu_type1_attach_group struct iommu_domain_geometry *geo; LIST_HEAD(iova_copy); LIST_HEAD(group_resv_regions); - int ret = -EINVAL; + int ret = -EBUSY;
mutex_lock(&iommu->lock);
+ /* Attach could require pinning, so disallow while vaddr is invalid. */ + if (iommu->vaddr_invalid_count) + goto out_unlock; + /* Check for duplicates */ + ret = -EINVAL; if (vfio_iommu_find_iommu_group(iommu, iommu_group)) goto out_unlock;
@@ -2669,6 +2686,16 @@ static int vfio_domains_have_enforce_cac return ret; }
+static bool vfio_iommu_has_emulated(struct vfio_iommu *iommu) +{ + bool ret; + + mutex_lock(&iommu->lock); + ret = !list_empty(&iommu->emulated_iommu_groups); + mutex_unlock(&iommu->lock); + return ret; +} + static int vfio_iommu_type1_check_extension(struct vfio_iommu *iommu, unsigned long arg) { @@ -2677,8 +2704,13 @@ static int vfio_iommu_type1_check_extens case VFIO_TYPE1v2_IOMMU: case VFIO_TYPE1_NESTING_IOMMU: case VFIO_UNMAP_ALL: - case VFIO_UPDATE_VADDR: return 1; + case VFIO_UPDATE_VADDR: + /* + * Disable this feature if mdevs are present. They cannot + * safely pin/unpin/rw while vaddrs are being updated. + */ + return iommu && !vfio_iommu_has_emulated(iommu); case VFIO_DMA_CC_IOMMU: if (!iommu) return 0; @@ -3147,6 +3179,13 @@ static int vfio_iommu_type1_dma_rw(void size_t done;
mutex_lock(&iommu->lock); + + if (WARN_ONCE(iommu->vaddr_invalid_count, + "vfio_dma_rw not allowed with VFIO_UPDATE_VADDR\n")) { + ret = -EBUSY; + goto out; + } + while (count > 0) { ret = vfio_iommu_type1_dma_rw_chunk(iommu, user_iova, data, count, write, &done); @@ -3158,6 +3197,7 @@ static int vfio_iommu_type1_dma_rw(void user_iova += done; }
+out: mutex_unlock(&iommu->lock); return ret; } --- a/include/uapi/linux/vfio.h +++ b/include/uapi/linux/vfio.h @@ -49,7 +49,11 @@ /* Supports VFIO_DMA_UNMAP_FLAG_ALL */ #define VFIO_UNMAP_ALL 9
-/* Supports the vaddr flag for DMA map and unmap */ +/* + * Supports the vaddr flag for DMA map and unmap. Not supported for mediated + * devices, so this capability is subject to change as groups are added or + * removed. + */ #define VFIO_UPDATE_VADDR 10
/* @@ -1343,8 +1347,7 @@ struct vfio_iommu_type1_info_dma_avail { * Map process virtual addresses to IO virtual addresses using the * provided struct vfio_dma_map. Caller sets argsz. READ &/ WRITE required. * - * If flags & VFIO_DMA_MAP_FLAG_VADDR, update the base vaddr for iova, and - * unblock translation of host virtual addresses in the iova range. The vaddr + * If flags & VFIO_DMA_MAP_FLAG_VADDR, update the base vaddr for iova. The vaddr * must have previously been invalidated with VFIO_DMA_UNMAP_FLAG_VADDR. To * maintain memory consistency within the user application, the updated vaddr * must address the same memory object as originally mapped. Failure to do so @@ -1395,9 +1398,9 @@ struct vfio_bitmap { * must be 0. This cannot be combined with the get-dirty-bitmap flag. * * If flags & VFIO_DMA_UNMAP_FLAG_VADDR, do not unmap, but invalidate host - * virtual addresses in the iova range. Tasks that attempt to translate an - * iova's vaddr will block. DMA to already-mapped pages continues. This - * cannot be combined with the get-dirty-bitmap flag. + * virtual addresses in the iova range. DMA to already-mapped pages continues. + * Groups may not be added to the container while any addresses are invalid. + * This cannot be combined with the get-dirty-bitmap flag. */ struct vfio_iommu_type1_dma_unmap { __u32 argsz;
From: Steve Sistare steven.sistare@oracle.com
commit 046eca5018f8a5dd1dc2cedf87fb5843b9ea3026 upstream.
When a vfio container is preserved across exec, the task does not change, but it gets a new mm with locked_vm=0, and loses the count from existing dma mappings. If the user later unmaps a dma mapping, locked_vm underflows to a large unsigned value, and a subsequent dma map request fails with ENOMEM in __account_locked_vm.
To avoid underflow, grab and save the mm at the time a dma is mapped. Use that mm when adjusting locked_vm, rather than re-acquiring the saved task's mm, which may have changed. If the saved mm is dead, do nothing.
locked_vm is incremented for existing mappings in a subsequent patch.
Fixes: 73fa0d10d077 ("vfio: Type1 IOMMU implementation") Cc: stable@vger.kernel.org Signed-off-by: Steve Sistare steven.sistare@oracle.com Reviewed-by: Kevin Tian kevin.tian@intel.com Reviewed-by: Jason Gunthorpe jgg@nvidia.com Link: https://lore.kernel.org/r/1675184289-267876-3-git-send-email-steven.sistare@... Signed-off-by: Alex Williamson alex.williamson@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/vfio/vfio_iommu_type1.c | 41 +++++++++++++--------------------------- 1 file changed, 14 insertions(+), 27 deletions(-)
--- a/drivers/vfio/vfio_iommu_type1.c +++ b/drivers/vfio/vfio_iommu_type1.c @@ -100,6 +100,7 @@ struct vfio_dma { struct task_struct *task; struct rb_root pfn_list; /* Ex-user pinned pfn list */ unsigned long *bitmap; + struct mm_struct *mm; };
struct vfio_batch { @@ -420,8 +421,8 @@ static int vfio_lock_acct(struct vfio_dm if (!npage) return 0;
- mm = async ? get_task_mm(dma->task) : dma->task->mm; - if (!mm) + mm = dma->mm; + if (async && !mmget_not_zero(mm)) return -ESRCH; /* process exited */
ret = mmap_write_lock_killable(mm); @@ -794,8 +795,8 @@ static int vfio_pin_page_external(struct struct mm_struct *mm; int ret;
- mm = get_task_mm(dma->task); - if (!mm) + mm = dma->mm; + if (!mmget_not_zero(mm)) return -ENODEV;
ret = vaddr_get_pfns(mm, vaddr, 1, dma->prot, pfn_base, pages); @@ -805,7 +806,7 @@ static int vfio_pin_page_external(struct ret = 0;
if (do_accounting && !is_invalid_reserved_pfn(*pfn_base)) { - ret = vfio_lock_acct(dma, 1, true); + ret = vfio_lock_acct(dma, 1, false); if (ret) { put_pfn(*pfn_base, dma->prot); if (ret == -ENOMEM) @@ -1180,6 +1181,7 @@ static void vfio_remove_dma(struct vfio_ vfio_unmap_unpin(iommu, dma, true); vfio_unlink_dma(iommu, dma); put_task_struct(dma->task); + mmdrop(dma->mm); vfio_dma_bitmap_free(dma); if (dma->vaddr_invalid) { iommu->vaddr_invalid_count--; @@ -1664,29 +1666,15 @@ static int vfio_dma_do_map(struct vfio_i * against the locked memory limit and we need to be able to do both * outside of this call path as pinning can be asynchronous via the * external interfaces for mdev devices. RLIMIT_MEMLOCK requires a - * task_struct and VM locked pages requires an mm_struct, however - * holding an indefinite mm reference is not recommended, therefore we - * only hold a reference to a task. We could hold a reference to - * current, however QEMU uses this call path through vCPU threads, - * which can be killed resulting in a NULL mm and failure in the unmap - * path when called via a different thread. Avoid this problem by - * using the group_leader as threads within the same group require - * both CLONE_THREAD and CLONE_VM and will therefore use the same - * mm_struct. - * - * Previously we also used the task for testing CAP_IPC_LOCK at the - * time of pinning and accounting, however has_capability() makes use - * of real_cred, a copy-on-write field, so we can't guarantee that it - * matches group_leader, or in fact that it might not change by the - * time it's evaluated. If a process were to call MAP_DMA with - * CAP_IPC_LOCK but later drop it, it doesn't make sense that they - * possibly see different results for an iommu_mapped vfio_dma vs - * externally mapped. Therefore track CAP_IPC_LOCK in vfio_dma at the - * time of calling MAP_DMA. + * task_struct. Save the group_leader so that all DMA tracking uses + * the same task, to make debugging easier. VM locked pages requires + * an mm_struct, so grab the mm in case the task dies. */ get_task_struct(current->group_leader); dma->task = current->group_leader; dma->lock_cap = capable(CAP_IPC_LOCK); + dma->mm = current->mm; + mmgrab(dma->mm);
dma->pfn_list = RB_ROOT;
@@ -3131,9 +3119,8 @@ static int vfio_iommu_type1_dma_rw_chunk !(dma->prot & IOMMU_READ)) return -EPERM;
- mm = get_task_mm(dma->task); - - if (!mm) + mm = dma->mm; + if (!mmget_not_zero(mm)) return -EPERM;
if (kthread)
From: Steve Sistare steven.sistare@oracle.com
commit 18e292705ba21cc9b3227b9ad5b1c28973605ee5 upstream.
Track locked_vm per dma struct, and create a new subroutine, both for use in a subsequent patch. No functional change.
Fixes: c3cbab24db38 ("vfio/type1: implement interfaces to update vaddr") Cc: stable@vger.kernel.org Signed-off-by: Steve Sistare steven.sistare@oracle.com Reviewed-by: Kevin Tian kevin.tian@intel.com Reviewed-by: Jason Gunthorpe jgg@nvidia.com Link: https://lore.kernel.org/r/1675184289-267876-4-git-send-email-steven.sistare@... Signed-off-by: Alex Williamson alex.williamson@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/vfio/vfio_iommu_type1.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
--- a/drivers/vfio/vfio_iommu_type1.c +++ b/drivers/vfio/vfio_iommu_type1.c @@ -101,6 +101,7 @@ struct vfio_dma { struct rb_root pfn_list; /* Ex-user pinned pfn list */ unsigned long *bitmap; struct mm_struct *mm; + size_t locked_vm; };
struct vfio_batch { @@ -413,6 +414,19 @@ static int vfio_iova_put_vfio_pfn(struct return ret; }
+static int mm_lock_acct(struct task_struct *task, struct mm_struct *mm, + bool lock_cap, long npage) +{ + int ret = mmap_write_lock_killable(mm); + + if (ret) + return ret; + + ret = __account_locked_vm(mm, abs(npage), npage > 0, task, lock_cap); + mmap_write_unlock(mm); + return ret; +} + static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async) { struct mm_struct *mm; @@ -425,12 +439,9 @@ static int vfio_lock_acct(struct vfio_dm if (async && !mmget_not_zero(mm)) return -ESRCH; /* process exited */
- ret = mmap_write_lock_killable(mm); - if (!ret) { - ret = __account_locked_vm(mm, abs(npage), npage > 0, dma->task, - dma->lock_cap); - mmap_write_unlock(mm); - } + ret = mm_lock_acct(dma->task, mm, dma->lock_cap, npage); + if (!ret) + dma->locked_vm += npage;
if (async) mmput(mm);
From: Steve Sistare steven.sistare@oracle.com
commit 90fdd158a695d70403163f9a0e4efc5b20f3fd3e upstream.
When a vfio container is preserved across exec or fork-exec, the new task's mm has a locked_vm count of 0. After a dma vaddr is updated using VFIO_DMA_MAP_FLAG_VADDR, locked_vm remains 0, and the pinned memory does not count against the task's RLIMIT_MEMLOCK.
To restore the correct locked_vm count, when VFIO_DMA_MAP_FLAG_VADDR is used and the dma's mm has changed, add the dma's locked_vm count to the new mm->locked_vm, subject to the rlimit, and subtract it from the old mm->locked_vm.
Fixes: c3cbab24db38 ("vfio/type1: implement interfaces to update vaddr") Cc: stable@vger.kernel.org Signed-off-by: Steve Sistare steven.sistare@oracle.com Reviewed-by: Kevin Tian kevin.tian@intel.com Reviewed-by: Jason Gunthorpe jgg@nvidia.com Link: https://lore.kernel.org/r/1675184289-267876-5-git-send-email-steven.sistare@... Signed-off-by: Alex Williamson alex.williamson@redhat.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/vfio/vfio_iommu_type1.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+)
--- a/drivers/vfio/vfio_iommu_type1.c +++ b/drivers/vfio/vfio_iommu_type1.c @@ -1591,6 +1591,38 @@ static bool vfio_iommu_iova_dma_valid(st return list_empty(iova); }
+static int vfio_change_dma_owner(struct vfio_dma *dma) +{ + struct task_struct *task = current->group_leader; + struct mm_struct *mm = current->mm; + long npage = dma->locked_vm; + bool lock_cap; + int ret; + + if (mm == dma->mm) + return 0; + + lock_cap = capable(CAP_IPC_LOCK); + ret = mm_lock_acct(task, mm, lock_cap, npage); + if (ret) + return ret; + + if (mmget_not_zero(dma->mm)) { + mm_lock_acct(dma->task, dma->mm, dma->lock_cap, -npage); + mmput(dma->mm); + } + + if (dma->task != task) { + put_task_struct(dma->task); + dma->task = get_task_struct(task); + } + mmdrop(dma->mm); + dma->mm = mm; + mmgrab(dma->mm); + dma->lock_cap = lock_cap; + return 0; +} + static int vfio_dma_do_map(struct vfio_iommu *iommu, struct vfio_iommu_type1_dma_map *map) { @@ -1640,6 +1672,9 @@ static int vfio_dma_do_map(struct vfio_i dma->size != size) { ret = -EINVAL; } else { + ret = vfio_change_dma_owner(dma); + if (ret) + goto out_unlock; dma->vaddr = vaddr; dma->vaddr_invalid = false; iommu->vaddr_invalid_count--;
From: Mario Limonciello mario.limonciello@amd.com
commit 65a24000808f70ac69bd2a96381fa0c7341f20c0 upstream.
A mistake has been made in the BIOS for some ASICs with NBIO 7.5.1 where some NBIO registers aren't properly setup.
Ensure that they're set during initialization.
Tested-by: Richard Gong richard.gong@amd.com Signed-off-by: Mario Limonciello mario.limonciello@amd.com Acked-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Cc: stable@vger.kernel.org # 6.1.x Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c +++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_2.c @@ -382,6 +382,11 @@ static void nbio_v7_2_init_registers(str if (def != data) WREG32_PCIE_PORT(SOC15_REG_OFFSET(NBIO, 0, regBIF1_PCIE_MST_CTRL_3), data); break; + case IP_VERSION(7, 5, 1): + data = RREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2); + data &= ~RCC_DEV2_EPF0_STRAP2__STRAP_NO_SOFT_RESET_DEV2_F0_MASK; + WREG32_SOC15(NBIO, 0, regRCC_DEV2_EPF0_STRAP2, data); + fallthrough; default: def = data = RREG32_PCIE_PORT(SOC15_REG_OFFSET(NBIO, 0, regPCIE_CONFIG_CNTL)); data = REG_SET_FIELD(data, PCIE_CONFIG_CNTL,
From: Mavroudis Chatzilaridis mavchatz@protonmail.com
commit 5e438bf7f9a1705ebcae5fa89cdbfbc6932a7871 upstream.
This laptop uses inverted backlight PWM. Thus, without this quirk, backlight brightness decreases as the brightness value increases and vice versa.
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8013 Cc: stable@vger.kernel.org Signed-off-by: Mavroudis Chatzilaridis mavchatz@protonmail.com Reviewed-by: Jani Nikula jani.nikula@intel.com Signed-off-by: Jani Nikula jani.nikula@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230201184947.8835-1-mavchatz... (cherry picked from commit 83e7d6fd330d413cb2064e680ffea91b0512a520) Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/gpu/drm/i915/display/intel_quirks.c | 2 ++ 1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/i915/display/intel_quirks.c +++ b/drivers/gpu/drm/i915/display/intel_quirks.c @@ -199,6 +199,8 @@ static struct intel_quirk intel_quirks[] /* ECS Liva Q2 */ { 0x3185, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time }, { 0x3184, 0x1019, 0xa94d, quirk_increase_ddi_disabled_time }, + /* HP Notebook - 14-r206nv */ + { 0x0f31, 0x103c, 0x220f, quirk_invert_brightness }, };
void intel_init_quirks(struct drm_i915_private *i915)
linux-stable-mirror@lists.linaro.org