From: Eugene Huang eugene.huang99@gmail.com

[ Upstream commit 9c691a42b8926c8966561265cdae3ddc7464d3a2 ]

Same topology as the HP Omen 16-k0005TX, except with the rt1316 amp on link2.

Link: https://github.com/thesofproject/linux/issues/4088 Signed-off-by: Eugene Huang eugene.huang99@gmail.com Reviewed-by: Pierre-Louis Bossart pierre-louis.bossart@linux.intel.com Reviewed-by: Péter Ujfalusi peter.ujfalusi@linux.intel.com Signed-off-by: Bard Liao yung-chuan.liao@linux.intel.com Link: https://lore.kernel.org/r/20230314090553.498664-3-yung-chuan.liao@linux.inte... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- .../intel/common/soc-acpi-intel-adl-match.c | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+)

diff --git a/sound/soc/intel/common/soc-acpi-intel-adl-match.c b/sound/soc/intel/common/soc-acpi-intel-adl-match.c index 0102574025e90..6e21e1640acfa 100644 --- a/sound/soc/intel/common/soc-acpi-intel-adl-match.c +++ b/sound/soc/intel/common/soc-acpi-intel-adl-match.c @@ -354,6 +354,20 @@ static const struct snd_soc_acpi_link_adr adl_sdw_rt711_link0_rt1316_link3[] = { {} };

+static const struct snd_soc_acpi_link_adr adl_sdw_rt711_link0_rt1316_link2[] = { + { + .mask = BIT(0), + .num_adr = ARRAY_SIZE(rt711_sdca_0_adr), + .adr_d = rt711_sdca_0_adr, + }, + { + .mask = BIT(2), + .num_adr = ARRAY_SIZE(rt1316_2_single_adr), + .adr_d = rt1316_2_single_adr, + }, + {} +}; + static const struct snd_soc_acpi_adr_device mx8373_2_adr[] = { { .adr = 0x000223019F837300ull, @@ -612,6 +626,12 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_sdw_machines[] = { .drv_name = "sof_sdw", .sof_tplg_filename = "sof-adl-rt711-l0-rt1316-l3.tplg", }, + { + .link_mask = 0x5, /* 2 active links required */ + .links = adl_sdw_rt711_link0_rt1316_link2, + .drv_name = "sof_sdw", + .sof_tplg_filename = "sof-adl-rt711-l0-rt1316-l2.tplg", + }, { .link_mask = 0x1, /* link0 required */ .links = adl_rvp,

From: Michael Kelley mikelley@microsoft.com

[ Upstream commit f8acb24aaf89fc46cd953229462ea8abe31b395f ]

Hyper-V should never specify a VM that is a Confidential VM and also running in the root partition. Nonetheless, explicitly block such a combination to guard against a compromised Hyper-V maliciously trying to exploit root partition functionality in a Confidential VM to expose Confidential VM secrets. No known bug is being fixed, but the attack surface for Confidential VMs on Hyper-V is reduced.

Signed-off-by: Michael Kelley mikelley@microsoft.com Link: https://lore.kernel.org/r/1678894453-95392-1-git-send-email-mikelley@microso... Signed-off-by: Wei Liu wei.liu@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/x86/kernel/cpu/mshyperv.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c index 831613959a92a..34d9e899e471e 100644 --- a/arch/x86/kernel/cpu/mshyperv.c +++ b/arch/x86/kernel/cpu/mshyperv.c @@ -291,12 +291,16 @@ static void __init ms_hyperv_init_platform(void) * To mirror what Windows does we should extract CPU management * features and use the ReservedIdentityBit to detect if Linux is the * root partition. But that requires negotiating CPU management - * interface (a process to be finalized). + * interface (a process to be finalized). For now, use the privilege + * flag as the indicator for running as root. * - * For now, use the privilege flag as the indicator for running as - * root. + * Hyper-V should never specify running as root and as a Confidential + * VM. But to protect against a compromised/malicious Hyper-V trying + * to exploit root behavior to expose Confidential VM memory, ignore + * the root partition setting if also a Confidential VM. */ - if (cpuid_ebx(HYPERV_CPUID_FEATURES) & HV_CPU_MANAGEMENT) { + if ((ms_hyperv.priv_high & HV_CPU_MANAGEMENT) && + !(ms_hyperv.priv_high & HV_ISOLATION)) { hv_root_partition = true; pr_info("Hyper-V: running as root partition\n"); }

From: Patrik Dahlström risca@dalakolonin.se

[ Upstream commit 49f76c499d38bf67803438eee88c8300d0f6ce09 ]

Calling dev_to_iio_dev() on a platform device pointer is undefined and will make adc NULL.

Signed-off-by: Patrik Dahlström risca@dalakolonin.se Link: https://lore.kernel.org/r/20230313205029.1881745-1-risca@dalakolonin.se Signed-off-by: Jonathan Cameron Jonathan.Cameron@huawei.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/iio/adc/palmas_gpadc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c index fd000345ec5cf..849a697a467e5 100644 --- a/drivers/iio/adc/palmas_gpadc.c +++ b/drivers/iio/adc/palmas_gpadc.c @@ -639,7 +639,7 @@ static int palmas_gpadc_probe(struct platform_device *pdev)

static int palmas_gpadc_remove(struct platform_device *pdev) { - struct iio_dev *indio_dev = dev_to_iio_dev(&pdev->dev); + struct iio_dev *indio_dev = dev_get_drvdata(&pdev->dev); struct palmas_gpadc *adc = iio_priv(indio_dev);

if (adc->wakeup1_enable || adc->wakeup2_enable)

From: Duy Nguyen duy.nguyen.rh@renesas.com

[ Upstream commit 44378cd113e5f15bb0a89f5ac5a0e687b52feb90 ]

da7213.c is missing pm_runtime_disable(), thus we will get below error when rmmod -> insmod.

$ rmmod snd-soc-da7213.ko $ insmod snd-soc-da7213.ko da7213 0-001a: Unbalanced pm_runtime_enable!"

[Kuninori adjusted to latest upstream]

Signed-off-by: Duy Nguyen duy.nguyen.rh@renesas.com Signed-off-by: Kuninori Morimoto kuninori.morimoto.gx@renesas.com Tested-by: Khanh Le khanh.le.xr@renesas.com Link: https://lore.kernel.org/r/87mt3xg2tk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- sound/soc/codecs/da7213.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c index 544ccbcfc8844..5678683c71bee 100644 --- a/sound/soc/codecs/da7213.c +++ b/sound/soc/codecs/da7213.c @@ -1996,6 +1996,11 @@ static int da7213_i2c_probe(struct i2c_client *i2c) return ret; }

+static void da7213_i2c_remove(struct i2c_client *i2c) +{ + pm_runtime_disable(&i2c->dev); +} + static int __maybe_unused da7213_runtime_suspend(struct device *dev) { struct da7213_priv *da7213 = dev_get_drvdata(dev); @@ -2039,6 +2044,7 @@ static struct i2c_driver da7213_i2c_driver = { .pm = &da7213_pm, }, .probe_new = da7213_i2c_probe, + .remove = da7213_i2c_remove, .id_table = da7213_i2c_id, };

From: Anh Tuan Phan tuananhlfc@gmail.com

[ Upstream commit f1594bc676579133a3cd906d7d27733289edfb86 ]

When compiling selftests with target mount_setattr I encountered some errors with the below messages: mount_setattr_test.c: In function ‘mount_setattr_thread’: mount_setattr_test.c:343:16: error: variable ‘attr’ has initializer but incomplete type 343 | struct mount_attr attr = { | ^~~~~~~~~~

These errors might be because of linux/mount.h is not included. This patch resolves that issue.

Signed-off-by: Anh Tuan Phan tuananhlfc@gmail.com Acked-by: Christian Brauner brauner@kernel.org Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/mount_setattr/mount_setattr_test.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/mount_setattr/mount_setattr_test.c b/tools/testing/selftests/mount_setattr/mount_setattr_test.c index 8c5fea68ae677..969647228817b 100644 --- a/tools/testing/selftests/mount_setattr/mount_setattr_test.c +++ b/tools/testing/selftests/mount_setattr/mount_setattr_test.c @@ -18,6 +18,7 @@ #include <grp.h> #include <stdbool.h> #include <stdarg.h> +#include <linux/mount.h>

#include "../kselftest_harness.h"

From: Daniel Golle daniel@makrotopia.org

[ Upstream commit ad651d68cee75e9ac20002254c4e5d09ee67a84b ]

The HG MXPD-483II 1310nm SFP module is meant to operate with 2500Base-X, however, in their EEPROM they incorrectly specify: Transceiver type : Ethernet: 1000BASE-LX ... BR, Nominal : 2600MBd

Use sfp_quirk_2500basex for this module to allow 2500Base-X mode anyway.

https://forum.banana-pi.org/t/bpi-r3-sfp-module-compatibility/14573/60

Reported-by: chowtom chowtom@gmail.com Tested-by: chowtom chowtom@gmail.com Signed-off-by: Daniel Golle daniel@makrotopia.org Reviewed-by: Russell King (Oracle) rmk+kernel@armlinux.org.uk Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/phy/sfp.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c index 5663a184644d5..766f86bdc4a09 100644 --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c @@ -395,6 +395,10 @@ static const struct sfp_quirk sfp_quirks[] = {

SFP_QUIRK_F("HALNy", "HL-GSFP", sfp_fixup_halny_gsfp),

+ // HG MXPD-483II-F 2.5G supports 2500Base-X, but incorrectly reports + // 2600MBd in their EERPOM + SFP_QUIRK_M("HG GENUINE", "MXPD-483II", sfp_quirk_2500basex), + // Huawei MA5671A can operate at 2500base-X, but report 1.2GBd NRZ in // their EEPROM SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,

From: Kalle Valo quic_kvalo@quicinc.com

[ Upstream commit cf5fa3ca0552f1b7ba8490de40700bbfb6979b17 ]

Currently ath11k breaks after hibernation, the reason being that ath11k expects that the wireless device will have power during suspend and the firmware will continue running. But of course during hibernation the power from the device is cut off and firmware is not running when resuming, so ath11k will fail.

(The reason why ath11k needs the firmware running is the interaction between mac80211 and MHI stack, it's a long story and more info in the bugzilla report.)

In SUSE kernels the watchdog timeout is reduced from the default 120 to 60 seconds:

CONFIG_DPM_WATCHDOG_TIMEOUT=60

But as the ath11k MHI timeout is 90 seconds the kernel will crash before will ath11k will recover in resume callback. To avoid the crash reduce the MHI timeout to just 20 seconds.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9

Link: https://bugzilla.kernel.org/show_bug.cgi?id=214649 Signed-off-by: Kalle Valo quic_kvalo@quicinc.com Signed-off-by: Kalle Valo kvalo@kernel.org Link: https://lore.kernel.org/r/20230329162038.8637-1-kvalo@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/wireless/ath/ath11k/mhi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/mhi.c b/drivers/net/wireless/ath/ath11k/mhi.c index 86995e8dc9135..a62ee05c54097 100644 --- a/drivers/net/wireless/ath/ath11k/mhi.c +++ b/drivers/net/wireless/ath/ath11k/mhi.c @@ -16,7 +16,7 @@ #include "pci.h" #include "pcic.h"

-#define MHI_TIMEOUT_DEFAULT_MS 90000 +#define MHI_TIMEOUT_DEFAULT_MS 20000 #define RDDM_DUMP_SIZE 0x420000

static struct mhi_channel_config ath11k_mhi_channels_qca6390[] = {

From: Vladimir Oltean vladimir.oltean@nxp.com

[ Upstream commit d564fa1ff19e893e2971d66e5c8f49dc1cdc8ffc ]

Commit c1d55d50139b ("asm-generic/io.h: Fix sparse warnings on big-endian architectures") missed fixing the 64-bit accessors.

Arnd explains in the attached link why the casts are necessary, even if __raw_readq() and __raw_writeq() do not take endian-specific types.

Link: https://lore.kernel.org/lkml/9105d6fc-880b-4734-857d-e3d30b87ccf6@app.fastma... Suggested-by: Arnd Bergmann arnd@arndb.de Signed-off-by: Vladimir Oltean vladimir.oltean@nxp.com Reviewed-by: Jonathan Cameron Jonathan.Cameron@huawei.com Signed-off-by: Arnd Bergmann arnd@arndb.de Signed-off-by: Sasha Levin sashal@kernel.org --- include/asm-generic/io.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/asm-generic/io.h b/include/asm-generic/io.h index a68f8fbf423be..cde032f86856e 100644 --- a/include/asm-generic/io.h +++ b/include/asm-generic/io.h @@ -236,7 +236,7 @@ static inline u64 readq(const volatile void __iomem *addr)

log_read_mmio(64, addr, _THIS_IP_); __io_br(); - val = __le64_to_cpu(__raw_readq(addr)); + val = __le64_to_cpu((__le64 __force)__raw_readq(addr)); __io_ar(val); log_post_read_mmio(val, 64, addr, _THIS_IP_); return val; @@ -287,7 +287,7 @@ static inline void writeq(u64 value, volatile void __iomem *addr) { log_write_mmio(value, 64, addr, _THIS_IP_); __io_bw(); - __raw_writeq(__cpu_to_le64(value), addr); + __raw_writeq((u64 __force)__cpu_to_le64(value), addr); __io_aw(); log_post_write_mmio(value, 64, addr, _THIS_IP_); }

From: Jiri Slaby (SUSE) jirislaby@kernel.org

commit 2d4ee16d969c97996e80e4c9cb6de0acaff22c9f upstream.

Since gcc13, each member of an enum has the same type as the enum. And that is inherited from its members. Provided "REKEY_AFTER_MESSAGES = 1ULL << 60", the named type is unsigned long.

This generates warnings with gcc-13: error: format '%d' expects argument of type 'int', but argument 6 has type 'long unsigned int'

Cast those particular enum members to int when printing them.

Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113 Cc: Martin Liska mliska@suse.cz Signed-off-by: Jiri Slaby (SUSE) jirislaby@kernel.org Signed-off-by: Jason A. Donenfeld Jason@zx2c4.com Link: https://lore.kernel.org/all/20221213225208.3343692-2-Jason@zx2c4.com/ Signed-off-by: Jakub Kicinski kuba@kernel.org Cc: Chris Clayton chris2553@googlemail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/wireguard/timers.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/net/wireguard/timers.c +++ b/drivers/net/wireguard/timers.c @@ -46,7 +46,7 @@ static void wg_expired_retransmit_handsh if (peer->timer_handshake_attempts > MAX_TIMER_HANDSHAKES) { pr_debug("%s: Handshake for peer %llu (%pISpfsc) did not complete after %d attempts, giving up\n", peer->device->dev->name, peer->internal_id, - &peer->endpoint.addr, MAX_TIMER_HANDSHAKES + 2); + &peer->endpoint.addr, (int)MAX_TIMER_HANDSHAKES + 2);

del_timer(&peer->timer_send_keepalive); /* We drop all packets without a keypair and don't try again, @@ -64,7 +64,7 @@ static void wg_expired_retransmit_handsh ++peer->timer_handshake_attempts; pr_debug("%s: Handshake for peer %llu (%pISpfsc) did not complete after %d seconds, retrying (try %d)\n", peer->device->dev->name, peer->internal_id, - &peer->endpoint.addr, REKEY_TIMEOUT, + &peer->endpoint.addr, (int)REKEY_TIMEOUT, peer->timer_handshake_attempts + 1);

/* We clear the endpoint address src address, in case this is @@ -94,7 +94,7 @@ static void wg_expired_new_handshake(str

pr_debug("%s: Retrying handshake with peer %llu (%pISpfsc) because we stopped hearing back after %d seconds\n", peer->device->dev->name, peer->internal_id, - &peer->endpoint.addr, KEEPALIVE_TIMEOUT + REKEY_TIMEOUT); + &peer->endpoint.addr, (int)(KEEPALIVE_TIMEOUT + REKEY_TIMEOUT)); /* We clear the endpoint address src address, in case this is the cause * of trouble. */ @@ -126,7 +126,7 @@ static void wg_queued_expired_zero_key_m

pr_debug("%s: Zeroing out all keys for peer %llu (%pISpfsc), since we haven't received a new one in %d seconds\n", peer->device->dev->name, peer->internal_id, - &peer->endpoint.addr, REJECT_AFTER_TIME * 3); + &peer->endpoint.addr, (int)REJECT_AFTER_TIME * 3); wg_noise_handshake_clear(&peer->handshake); wg_noise_keypairs_clear(&peer->keypairs); wg_peer_put(peer);

From: syed saba kareem syed.sabakareem@amd.com

commit 4b19211435950a78af032c26ad64a5268e6012be upstream.

Pink Sardine is based on ACP6.3 architecture. This patch fixes the typo mistake acp6.2 -> acp6.3

Signed-off-by: syed saba kareem syed.sabakareem@amd.com Link: https://lore.kernel.org/r/20221104121001.207992-1-Syed.SabaKareem@amd.com Signed-off-by: Mark Brown broonie@kernel.org Cc: Mario Limonciello mario.limonciello@amd.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- include/sound/acp62_chip_offset_byte.h | 444 --------------------------------- include/sound/acp63_chip_offset_byte.h | 444 +++++++++++++++++++++++++++++++++ sound/soc/amd/Kconfig | 4 sound/soc/amd/ps/acp62.h | 98 ------- sound/soc/amd/ps/acp63.h | 98 +++++++ sound/soc/amd/ps/pci-ps.c | 132 ++++----- sound/soc/amd/ps/ps-mach.c | 30 +- sound/soc/amd/ps/ps-pdm-dma.c | 188 ++++++------- 8 files changed, 719 insertions(+), 719 deletions(-) rename include/sound/{acp62_chip_offset_byte.h => acp63_chip_offset_byte.h} (99%) rename sound/soc/amd/ps/{acp62.h => acp63.h} (90%)

--- a/include/sound/acp62_chip_offset_byte.h +++ /dev/null @@ -1,444 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0+ */ -/* - * AMD ACP 6.2 Register Documentation - * - * Copyright 2022 Advanced Micro Devices, Inc. - */ - -#ifndef _acp_ip_OFFSET_HEADER -#define _acp_ip_OFFSET_HEADER - -/* Registers from ACP_DMA block */ -#define ACP_DMA_CNTL_0 0x0000000 -#define ACP_DMA_CNTL_1 0x0000004 -#define ACP_DMA_CNTL_2 0x0000008 -#define ACP_DMA_CNTL_3 0x000000C -#define ACP_DMA_CNTL_4 0x0000010 -#define ACP_DMA_CNTL_5 0x0000014 -#define ACP_DMA_CNTL_6 0x0000018 -#define ACP_DMA_CNTL_7 0x000001C -#define ACP_DMA_DSCR_STRT_IDX_0 0x0000020 -#define ACP_DMA_DSCR_STRT_IDX_1 0x0000024 -#define ACP_DMA_DSCR_STRT_IDX_2 0x0000028 -#define ACP_DMA_DSCR_STRT_IDX_3 0x000002C -#define ACP_DMA_DSCR_STRT_IDX_4 0x0000030 -#define ACP_DMA_DSCR_STRT_IDX_5 0x0000034 -#define ACP_DMA_DSCR_STRT_IDX_6 0x0000038 -#define ACP_DMA_DSCR_STRT_IDX_7 0x000003C -#define ACP_DMA_DSCR_CNT_0 0x0000040 -#define ACP_DMA_DSCR_CNT_1 0x0000044 -#define ACP_DMA_DSCR_CNT_2 0x0000048 -#define ACP_DMA_DSCR_CNT_3 0x000004C -#define ACP_DMA_DSCR_CNT_4 0x0000050 -#define ACP_DMA_DSCR_CNT_5 0x0000054 -#define ACP_DMA_DSCR_CNT_6 0x0000058 -#define ACP_DMA_DSCR_CNT_7 0x000005C -#define ACP_DMA_PRIO_0 0x0000060 -#define ACP_DMA_PRIO_1 0x0000064 -#define ACP_DMA_PRIO_2 0x0000068 -#define ACP_DMA_PRIO_3 0x000006C -#define ACP_DMA_PRIO_4 0x0000070 -#define ACP_DMA_PRIO_5 0x0000074 -#define ACP_DMA_PRIO_6 0x0000078 -#define ACP_DMA_PRIO_7 0x000007C -#define ACP_DMA_CUR_DSCR_0 0x0000080 -#define ACP_DMA_CUR_DSCR_1 0x0000084 -#define ACP_DMA_CUR_DSCR_2 0x0000088 -#define ACP_DMA_CUR_DSCR_3 0x000008C -#define ACP_DMA_CUR_DSCR_4 0x0000090 -#define ACP_DMA_CUR_DSCR_5 0x0000094 -#define ACP_DMA_CUR_DSCR_6 0x0000098 -#define ACP_DMA_CUR_DSCR_7 0x000009C -#define ACP_DMA_CUR_TRANS_CNT_0 0x00000A0 -#define ACP_DMA_CUR_TRANS_CNT_1 0x00000A4 -#define ACP_DMA_CUR_TRANS_CNT_2 0x00000A8 -#define ACP_DMA_CUR_TRANS_CNT_3 0x00000AC -#define ACP_DMA_CUR_TRANS_CNT_4 0x00000B0 -#define ACP_DMA_CUR_TRANS_CNT_5 0x00000B4 -#define ACP_DMA_CUR_TRANS_CNT_6 0x00000B8 -#define ACP_DMA_CUR_TRANS_CNT_7 0x00000BC -#define ACP_DMA_ERR_STS_0 0x00000C0 -#define ACP_DMA_ERR_STS_1 0x00000C4 -#define ACP_DMA_ERR_STS_2 0x00000C8 -#define ACP_DMA_ERR_STS_3 0x00000CC -#define ACP_DMA_ERR_STS_4 0x00000D0 -#define ACP_DMA_ERR_STS_5 0x00000D4 -#define ACP_DMA_ERR_STS_6 0x00000D8 -#define ACP_DMA_ERR_STS_7 0x00000DC -#define ACP_DMA_DESC_BASE_ADDR 0x00000E0 -#define ACP_DMA_DESC_MAX_NUM_DSCR 0x00000E4 -#define ACP_DMA_CH_STS 0x00000E8 -#define ACP_DMA_CH_GROUP 0x00000EC -#define ACP_DMA_CH_RST_STS 0x00000F0 - -/* Registers from ACP_AXI2AXIATU block */ -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_1 0x0000C00 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_1 0x0000C04 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_2 0x0000C08 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_2 0x0000C0C -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_3 0x0000C10 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_3 0x0000C14 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_4 0x0000C18 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_4 0x0000C1C -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_5 0x0000C20 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_5 0x0000C24 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_6 0x0000C28 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_6 0x0000C2C -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_7 0x0000C30 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_7 0x0000C34 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_8 0x0000C38 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_8 0x0000C3C -#define ACPAXI2AXI_ATU_CTRL 0x0000C40 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_9 0x0000C44 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_9 0x0000C48 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_10 0x0000C4C -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_10 0x0000C50 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_11 0x0000C54 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_11 0x0000C58 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_12 0x0000C5C -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_12 0x0000C60 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_13 0x0000C64 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_13 0x0000C68 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_14 0x0000C6C -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_14 0x0000C70 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_15 0x0000C74 -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_15 0x0000C78 -#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_16 0x0000C7C -#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_16 0x0000C80 - -/* Registers from ACP_CLKRST block */ -#define ACP_SOFT_RESET 0x0001000 -#define ACP_CONTROL 0x0001004 -#define ACP_STATUS 0x0001008 -#define ACP_DYNAMIC_CG_MASTER_CONTROL 0x0001010 -#define ACP_ZSC_DSP_CTRL 0x0001014 -#define ACP_ZSC_STS 0x0001018 -#define ACP_PGFSM_CONTROL 0x0001024 -#define ACP_PGFSM_STATUS 0x0001028 -#define ACP_CLKMUX_SEL 0x000102C - -/* Registers from ACP_AON block */ -#define ACP_PME_EN 0x0001400 -#define ACP_DEVICE_STATE 0x0001404 -#define AZ_DEVICE_STATE 0x0001408 -#define ACP_PIN_CONFIG 0x0001440 -#define ACP_PAD_PULLUP_CTRL 0x0001444 -#define ACP_PAD_PULLDOWN_CTRL 0x0001448 -#define ACP_PAD_DRIVE_STRENGTH_CTRL 0x000144C -#define ACP_PAD_SCHMEN_CTRL 0x0001450 -#define ACP_SW_PAD_KEEPER_EN 0x0001454 -#define ACP_SW_WAKE_EN 0x0001458 -#define ACP_I2S_WAKE_EN 0x000145C -#define ACP_SW1_WAKE_EN 0x0001460 - -/* Registers from ACP_P1_MISC block */ -#define ACP_EXTERNAL_INTR_ENB 0x0001A00 -#define ACP_EXTERNAL_INTR_CNTL 0x0001A04 -#define ACP_EXTERNAL_INTR_CNTL1 0x0001A08 -#define ACP_EXTERNAL_INTR_STAT 0x0001A0C -#define ACP_EXTERNAL_INTR_STAT1 0x0001A10 -#define ACP_ERROR_STATUS 0x0001A4C -#define ACP_P1_SW_I2S_ERROR_REASON 0x0001A50 -#define ACP_P1_SW_POS_TRACK_I2S_TX_CTRL 0x0001A6C -#define ACP_P1_SW_I2S_TX_DMA_POS 0x0001A70 -#define ACP_P1_SW_POS_TRACK_I2S_RX_CTRL 0x0001A74 -#define ACP_P1_SW_I2S_RX_DMA_POS 0x0001A78 -#define ACP_P1_DMIC_I2S_GPIO_INTR_CTRL 0x0001A7C -#define ACP_P1_DMIC_I2S_GPIO_INTR_STATUS 0x0001A80 -#define ACP_SCRATCH_REG_BASE_ADDR 0x0001A84 -#define ACP_P1_SW_POS_TRACK_BT_TX_CTRL 0x0001A88 -#define ACP_P1_SW_BT_TX_DMA_POS 0x0001A8C -#define ACP_P1_SW_POS_TRACK_HS_TX_CTRL 0x0001A90 -#define ACP_P1_SW_HS_TX_DMA_POS 0x0001A94 -#define ACP_P1_SW_POS_TRACK_BT_RX_CTRL 0x0001A98 -#define ACP_P1_SW_BT_RX_DMA_POS 0x0001A9C -#define ACP_P1_SW_POS_TRACK_HS_RX_CTRL 0x0001AA0 -#define ACP_P1_SW_HS_RX_DMA_POS 0x0001AA4 - -/* Registers from ACP_AUDIO_BUFFERS block */ -#define ACP_I2S_RX_RINGBUFADDR 0x0002000 -#define ACP_I2S_RX_RINGBUFSIZE 0x0002004 -#define ACP_I2S_RX_LINKPOSITIONCNTR 0x0002008 -#define ACP_I2S_RX_FIFOADDR 0x000200C -#define ACP_I2S_RX_FIFOSIZE 0x0002010 -#define ACP_I2S_RX_DMA_SIZE 0x0002014 -#define ACP_I2S_RX_LINEARPOSITIONCNTR_HIGH 0x0002018 -#define ACP_I2S_RX_LINEARPOSITIONCNTR_LOW 0x000201C -#define ACP_I2S_RX_INTR_WATERMARK_SIZE 0x0002020 -#define ACP_I2S_TX_RINGBUFADDR 0x0002024 -#define ACP_I2S_TX_RINGBUFSIZE 0x0002028 -#define ACP_I2S_TX_LINKPOSITIONCNTR 0x000202C -#define ACP_I2S_TX_FIFOADDR 0x0002030 -#define ACP_I2S_TX_FIFOSIZE 0x0002034 -#define ACP_I2S_TX_DMA_SIZE 0x0002038 -#define ACP_I2S_TX_LINEARPOSITIONCNTR_HIGH 0x000203C -#define ACP_I2S_TX_LINEARPOSITIONCNTR_LOW 0x0002040 -#define ACP_I2S_TX_INTR_WATERMARK_SIZE 0x0002044 -#define ACP_BT_RX_RINGBUFADDR 0x0002048 -#define ACP_BT_RX_RINGBUFSIZE 0x000204C -#define ACP_BT_RX_LINKPOSITIONCNTR 0x0002050 -#define ACP_BT_RX_FIFOADDR 0x0002054 -#define ACP_BT_RX_FIFOSIZE 0x0002058 -#define ACP_BT_RX_DMA_SIZE 0x000205C -#define ACP_BT_RX_LINEARPOSITIONCNTR_HIGH 0x0002060 -#define ACP_BT_RX_LINEARPOSITIONCNTR_LOW 0x0002064 -#define ACP_BT_RX_INTR_WATERMARK_SIZE 0x0002068 -#define ACP_BT_TX_RINGBUFADDR 0x000206C -#define ACP_BT_TX_RINGBUFSIZE 0x0002070 -#define ACP_BT_TX_LINKPOSITIONCNTR 0x0002074 -#define ACP_BT_TX_FIFOADDR 0x0002078 -#define ACP_BT_TX_FIFOSIZE 0x000207C -#define ACP_BT_TX_DMA_SIZE 0x0002080 -#define ACP_BT_TX_LINEARPOSITIONCNTR_HIGH 0x0002084 -#define ACP_BT_TX_LINEARPOSITIONCNTR_LOW 0x0002088 -#define ACP_BT_TX_INTR_WATERMARK_SIZE 0x000208C -#define ACP_HS_RX_RINGBUFADDR 0x0002090 -#define ACP_HS_RX_RINGBUFSIZE 0x0002094 -#define ACP_HS_RX_LINKPOSITIONCNTR 0x0002098 -#define ACP_HS_RX_FIFOADDR 0x000209C -#define ACP_HS_RX_FIFOSIZE 0x00020A0 -#define ACP_HS_RX_DMA_SIZE 0x00020A4 -#define ACP_HS_RX_LINEARPOSITIONCNTR_HIGH 0x00020A8 -#define ACP_HS_RX_LINEARPOSITIONCNTR_LOW 0x00020AC -#define ACP_HS_RX_INTR_WATERMARK_SIZE 0x00020B0 -#define ACP_HS_TX_RINGBUFADDR 0x00020B4 -#define ACP_HS_TX_RINGBUFSIZE 0x00020B8 -#define ACP_HS_TX_LINKPOSITIONCNTR 0x00020BC -#define ACP_HS_TX_FIFOADDR 0x00020C0 -#define ACP_HS_TX_FIFOSIZE 0x00020C4 -#define ACP_HS_TX_DMA_SIZE 0x00020C8 -#define ACP_HS_TX_LINEARPOSITIONCNTR_HIGH 0x00020CC -#define ACP_HS_TX_LINEARPOSITIONCNTR_LOW 0x00020D0 -#define ACP_HS_TX_INTR_WATERMARK_SIZE 0x00020D4 - -/* Registers from ACP_I2S_TDM block */ -#define ACP_I2STDM_IER 0x0002400 -#define ACP_I2STDM_IRER 0x0002404 -#define ACP_I2STDM_RXFRMT 0x0002408 -#define ACP_I2STDM_ITER 0x000240C -#define ACP_I2STDM_TXFRMT 0x0002410 -#define ACP_I2STDM0_MSTRCLKGEN 0x0002414 -#define ACP_I2STDM1_MSTRCLKGEN 0x0002418 -#define ACP_I2STDM2_MSTRCLKGEN 0x000241C -#define ACP_I2STDM_REFCLKGEN 0x0002420 - -/* Registers from ACP_BT_TDM block */ -#define ACP_BTTDM_IER 0x0002800 -#define ACP_BTTDM_IRER 0x0002804 -#define ACP_BTTDM_RXFRMT 0x0002808 -#define ACP_BTTDM_ITER 0x000280C -#define ACP_BTTDM_TXFRMT 0x0002810 -#define ACP_HSTDM_IER 0x0002814 -#define ACP_HSTDM_IRER 0x0002818 -#define ACP_HSTDM_RXFRMT 0x000281C -#define ACP_HSTDM_ITER 0x0002820 -#define ACP_HSTDM_TXFRMT 0x0002824 - -/* Registers from ACP_WOV block */ -#define ACP_WOV_PDM_ENABLE 0x0002C04 -#define ACP_WOV_PDM_DMA_ENABLE 0x0002C08 -#define ACP_WOV_RX_RINGBUFADDR 0x0002C0C -#define ACP_WOV_RX_RINGBUFSIZE 0x0002C10 -#define ACP_WOV_RX_LINKPOSITIONCNTR 0x0002C14 -#define ACP_WOV_RX_LINEARPOSITIONCNTR_HIGH 0x0002C18 -#define ACP_WOV_RX_LINEARPOSITIONCNTR_LOW 0x0002C1C -#define ACP_WOV_RX_INTR_WATERMARK_SIZE 0x0002C20 -#define ACP_WOV_PDM_FIFO_FLUSH 0x0002C24 -#define ACP_WOV_PDM_NO_OF_CHANNELS 0x0002C28 -#define ACP_WOV_PDM_DECIMATION_FACTOR 0x0002C2C -#define ACP_WOV_PDM_VAD_CTRL 0x0002C30 -#define ACP_WOV_WAKE 0x0002C54 -#define ACP_WOV_BUFFER_STATUS 0x0002C58 -#define ACP_WOV_MISC_CTRL 0x0002C5C -#define ACP_WOV_CLK_CTRL 0x0002C60 -#define ACP_PDM_VAD_DYNAMIC_CLK_GATING_EN 0x0002C64 -#define ACP_WOV_ERROR_STATUS_REGISTER 0x0002C68 -#define ACP_PDM_CLKDIV 0x0002C6C - -/* Registers from ACP_P1_AUDIO_BUFFERS block */ -#define ACP_P1_I2S_RX_RINGBUFADDR 0x0003A00 -#define ACP_P1_I2S_RX_RINGBUFSIZE 0x0003A04 -#define ACP_P1_I2S_RX_LINKPOSITIONCNTR 0x0003A08 -#define ACP_P1_I2S_RX_FIFOADDR 0x0003A0C -#define ACP_P1_I2S_RX_FIFOSIZE 0x0003A10 -#define ACP_P1_I2S_RX_DMA_SIZE 0x0003A14 -#define ACP_P1_I2S_RX_LINEARPOSITIONCNTR_HIGH 0x0003A18 -#define ACP_P1_I2S_RX_LINEARPOSITIONCNTR_LOW 0x0003A1C -#define ACP_P1_I2S_RX_INTR_WATERMARK_SIZE 0x0003A20 -#define ACP_P1_I2S_TX_RINGBUFADDR 0x0003A24 -#define ACP_P1_I2S_TX_RINGBUFSIZE 0x0003A28 -#define ACP_P1_I2S_TX_LINKPOSITIONCNTR 0x0003A2C -#define ACP_P1_I2S_TX_FIFOADDR 0x0003A30 -#define ACP_P1_I2S_TX_FIFOSIZE 0x0003A34 -#define ACP_P1_I2S_TX_DMA_SIZE 0x0003A38 -#define ACP_P1_I2S_TX_LINEARPOSITIONCNTR_HIGH 0x0003A3C -#define ACP_P1_I2S_TX_LINEARPOSITIONCNTR_LOW 0x0003A40 -#define ACP_P1_I2S_TX_INTR_WATERMARK_SIZE 0x0003A44 -#define ACP_P1_BT_RX_RINGBUFADDR 0x0003A48 -#define ACP_P1_BT_RX_RINGBUFSIZE 0x0003A4C -#define ACP_P1_BT_RX_LINKPOSITIONCNTR 0x0003A50 -#define ACP_P1_BT_RX_FIFOADDR 0x0003A54 -#define ACP_P1_BT_RX_FIFOSIZE 0x0003A58 -#define ACP_P1_BT_RX_DMA_SIZE 0x0003A5C -#define ACP_P1_BT_RX_LINEARPOSITIONCNTR_HIGH 0x0003A60 -#define ACP_P1_BT_RX_LINEARPOSITIONCNTR_LOW 0x0003A64 -#define ACP_P1_BT_RX_INTR_WATERMARK_SIZE 0x0003A68 -#define ACP_P1_BT_TX_RINGBUFADDR 0x0003A6C -#define ACP_P1_BT_TX_RINGBUFSIZE 0x0003A70 -#define ACP_P1_BT_TX_LINKPOSITIONCNTR 0x0003A74 -#define ACP_P1_BT_TX_FIFOADDR 0x0003A78 -#define ACP_P1_BT_TX_FIFOSIZE 0x0003A7C -#define ACP_P1_BT_TX_DMA_SIZE 0x0003A80 -#define ACP_P1_BT_TX_LINEARPOSITIONCNTR_HIGH 0x0003A84 -#define ACP_P1_BT_TX_LINEARPOSITIONCNTR_LOW 0x0003A88 -#define ACP_P1_BT_TX_INTR_WATERMARK_SIZE 0x0003A8C -#define ACP_P1_HS_RX_RINGBUFADDR 0x0003A90 -#define ACP_P1_HS_RX_RINGBUFSIZE 0x0003A94 -#define ACP_P1_HS_RX_LINKPOSITIONCNTR 0x0003A98 -#define ACP_P1_HS_RX_FIFOADDR 0x0003A9C -#define ACP_P1_HS_RX_FIFOSIZE 0x0003AA0 -#define ACP_P1_HS_RX_DMA_SIZE 0x0003AA4 -#define ACP_P1_HS_RX_LINEARPOSITIONCNTR_HIGH 0x0003AA8 -#define ACP_P1_HS_RX_LINEARPOSITIONCNTR_LOW 0x0003AAC -#define ACP_P1_HS_RX_INTR_WATERMARK_SIZE 0x0003AB0 -#define ACP_P1_HS_TX_RINGBUFADDR 0x0003AB4 -#define ACP_P1_HS_TX_RINGBUFSIZE 0x0003AB8 -#define ACP_P1_HS_TX_LINKPOSITIONCNTR 0x0003ABC -#define ACP_P1_HS_TX_FIFOADDR 0x0003AC0 -#define ACP_P1_HS_TX_FIFOSIZE 0x0003AC4 -#define ACP_P1_HS_TX_DMA_SIZE 0x0003AC8 -#define ACP_P1_HS_TX_LINEARPOSITIONCNTR_HIGH 0x0003ACC -#define ACP_P1_HS_TX_LINEARPOSITIONCNTR_LOW 0x0003AD0 -#define ACP_P1_HS_TX_INTR_WATERMARK_SIZE 0x0003AD4 - -/* Registers from ACP_SCRATCH block */ -#define ACP_SCRATCH_REG_0 0x0010000 -#define ACP_SCRATCH_REG_1 0x0010004 -#define ACP_SCRATCH_REG_2 0x0010008 -#define ACP_SCRATCH_REG_3 0x001000C -#define ACP_SCRATCH_REG_4 0x0010010 -#define ACP_SCRATCH_REG_5 0x0010014 -#define ACP_SCRATCH_REG_6 0x0010018 -#define ACP_SCRATCH_REG_7 0x001001C -#define ACP_SCRATCH_REG_8 0x0010020 -#define ACP_SCRATCH_REG_9 0x0010024 -#define ACP_SCRATCH_REG_10 0x0010028 -#define ACP_SCRATCH_REG_11 0x001002C -#define ACP_SCRATCH_REG_12 0x0010030 -#define ACP_SCRATCH_REG_13 0x0010034 -#define ACP_SCRATCH_REG_14 0x0010038 -#define ACP_SCRATCH_REG_15 0x001003C -#define ACP_SCRATCH_REG_16 0x0010040 -#define ACP_SCRATCH_REG_17 0x0010044 -#define ACP_SCRATCH_REG_18 0x0010048 -#define ACP_SCRATCH_REG_19 0x001004C -#define ACP_SCRATCH_REG_20 0x0010050 -#define ACP_SCRATCH_REG_21 0x0010054 -#define ACP_SCRATCH_REG_22 0x0010058 -#define ACP_SCRATCH_REG_23 0x001005C -#define ACP_SCRATCH_REG_24 0x0010060 -#define ACP_SCRATCH_REG_25 0x0010064 -#define ACP_SCRATCH_REG_26 0x0010068 -#define ACP_SCRATCH_REG_27 0x001006C -#define ACP_SCRATCH_REG_28 0x0010070 -#define ACP_SCRATCH_REG_29 0x0010074 -#define ACP_SCRATCH_REG_30 0x0010078 -#define ACP_SCRATCH_REG_31 0x001007C -#define ACP_SCRATCH_REG_32 0x0010080 -#define ACP_SCRATCH_REG_33 0x0010084 -#define ACP_SCRATCH_REG_34 0x0010088 -#define ACP_SCRATCH_REG_35 0x001008C -#define ACP_SCRATCH_REG_36 0x0010090 -#define ACP_SCRATCH_REG_37 0x0010094 -#define ACP_SCRATCH_REG_38 0x0010098 -#define ACP_SCRATCH_REG_39 0x001009C -#define ACP_SCRATCH_REG_40 0x00100A0 -#define ACP_SCRATCH_REG_41 0x00100A4 -#define ACP_SCRATCH_REG_42 0x00100A8 -#define ACP_SCRATCH_REG_43 0x00100AC -#define ACP_SCRATCH_REG_44 0x00100B0 -#define ACP_SCRATCH_REG_45 0x00100B4 -#define ACP_SCRATCH_REG_46 0x00100B8 -#define ACP_SCRATCH_REG_47 0x00100BC -#define ACP_SCRATCH_REG_48 0x00100C0 -#define ACP_SCRATCH_REG_49 0x00100C4 -#define ACP_SCRATCH_REG_50 0x00100C8 -#define ACP_SCRATCH_REG_51 0x00100CC -#define ACP_SCRATCH_REG_52 0x00100D0 -#define ACP_SCRATCH_REG_53 0x00100D4 -#define ACP_SCRATCH_REG_54 0x00100D8 -#define ACP_SCRATCH_REG_55 0x00100DC -#define ACP_SCRATCH_REG_56 0x00100E0 -#define ACP_SCRATCH_REG_57 0x00100E4 -#define ACP_SCRATCH_REG_58 0x00100E8 -#define ACP_SCRATCH_REG_59 0x00100EC -#define ACP_SCRATCH_REG_60 0x00100F0 -#define ACP_SCRATCH_REG_61 0x00100F4 -#define ACP_SCRATCH_REG_62 0x00100F8 -#define ACP_SCRATCH_REG_63 0x00100FC -#define ACP_SCRATCH_REG_64 0x0010100 -#define ACP_SCRATCH_REG_65 0x0010104 -#define ACP_SCRATCH_REG_66 0x0010108 -#define ACP_SCRATCH_REG_67 0x001010C -#define ACP_SCRATCH_REG_68 0x0010110 -#define ACP_SCRATCH_REG_69 0x0010114 -#define ACP_SCRATCH_REG_70 0x0010118 -#define ACP_SCRATCH_REG_71 0x001011C -#define ACP_SCRATCH_REG_72 0x0010120 -#define ACP_SCRATCH_REG_73 0x0010124 -#define ACP_SCRATCH_REG_74 0x0010128 -#define ACP_SCRATCH_REG_75 0x001012C -#define ACP_SCRATCH_REG_76 0x0010130 -#define ACP_SCRATCH_REG_77 0x0010134 -#define ACP_SCRATCH_REG_78 0x0010138 -#define ACP_SCRATCH_REG_79 0x001013C -#define ACP_SCRATCH_REG_80 0x0010140 -#define ACP_SCRATCH_REG_81 0x0010144 -#define ACP_SCRATCH_REG_82 0x0010148 -#define ACP_SCRATCH_REG_83 0x001014C -#define ACP_SCRATCH_REG_84 0x0010150 -#define ACP_SCRATCH_REG_85 0x0010154 -#define ACP_SCRATCH_REG_86 0x0010158 -#define ACP_SCRATCH_REG_87 0x001015C -#define ACP_SCRATCH_REG_88 0x0010160 -#define ACP_SCRATCH_REG_89 0x0010164 -#define ACP_SCRATCH_REG_90 0x0010168 -#define ACP_SCRATCH_REG_91 0x001016C -#define ACP_SCRATCH_REG_92 0x0010170 -#define ACP_SCRATCH_REG_93 0x0010174 -#define ACP_SCRATCH_REG_94 0x0010178 -#define ACP_SCRATCH_REG_95 0x001017C -#define ACP_SCRATCH_REG_96 0x0010180 -#define ACP_SCRATCH_REG_97 0x0010184 -#define ACP_SCRATCH_REG_98 0x0010188 -#define ACP_SCRATCH_REG_99 0x001018C -#define ACP_SCRATCH_REG_100 0x0010190 -#define ACP_SCRATCH_REG_101 0x0010194 -#define ACP_SCRATCH_REG_102 0x0010198 -#define ACP_SCRATCH_REG_103 0x001019C -#define ACP_SCRATCH_REG_104 0x00101A0 -#define ACP_SCRATCH_REG_105 0x00101A4 -#define ACP_SCRATCH_REG_106 0x00101A8 -#define ACP_SCRATCH_REG_107 0x00101AC -#define ACP_SCRATCH_REG_108 0x00101B0 -#define ACP_SCRATCH_REG_109 0x00101B4 -#define ACP_SCRATCH_REG_110 0x00101B8 -#define ACP_SCRATCH_REG_111 0x00101BC -#define ACP_SCRATCH_REG_112 0x00101C0 -#define ACP_SCRATCH_REG_113 0x00101C4 -#define ACP_SCRATCH_REG_114 0x00101C8 -#define ACP_SCRATCH_REG_115 0x00101CC -#define ACP_SCRATCH_REG_116 0x00101D0 -#define ACP_SCRATCH_REG_117 0x00101D4 -#define ACP_SCRATCH_REG_118 0x00101D8 -#define ACP_SCRATCH_REG_119 0x00101DC -#define ACP_SCRATCH_REG_120 0x00101E0 -#define ACP_SCRATCH_REG_121 0x00101E4 -#define ACP_SCRATCH_REG_122 0x00101E8 -#define ACP_SCRATCH_REG_123 0x00101EC -#define ACP_SCRATCH_REG_124 0x00101F0 -#define ACP_SCRATCH_REG_125 0x00101F4 -#define ACP_SCRATCH_REG_126 0x00101F8 -#define ACP_SCRATCH_REG_127 0x00101FC -#define ACP_SCRATCH_REG_128 0x0010200 -#endif --- /dev/null +++ b/include/sound/acp63_chip_offset_byte.h @@ -0,0 +1,444 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * AMD ACP 6.3 Register Documentation + * + * Copyright 2022 Advanced Micro Devices, Inc. + */ + +#ifndef _acp_ip_OFFSET_HEADER +#define _acp_ip_OFFSET_HEADER + +/* Registers from ACP_DMA block */ +#define ACP_DMA_CNTL_0 0x0000000 +#define ACP_DMA_CNTL_1 0x0000004 +#define ACP_DMA_CNTL_2 0x0000008 +#define ACP_DMA_CNTL_3 0x000000C +#define ACP_DMA_CNTL_4 0x0000010 +#define ACP_DMA_CNTL_5 0x0000014 +#define ACP_DMA_CNTL_6 0x0000018 +#define ACP_DMA_CNTL_7 0x000001C +#define ACP_DMA_DSCR_STRT_IDX_0 0x0000020 +#define ACP_DMA_DSCR_STRT_IDX_1 0x0000024 +#define ACP_DMA_DSCR_STRT_IDX_2 0x0000028 +#define ACP_DMA_DSCR_STRT_IDX_3 0x000002C +#define ACP_DMA_DSCR_STRT_IDX_4 0x0000030 +#define ACP_DMA_DSCR_STRT_IDX_5 0x0000034 +#define ACP_DMA_DSCR_STRT_IDX_6 0x0000038 +#define ACP_DMA_DSCR_STRT_IDX_7 0x000003C +#define ACP_DMA_DSCR_CNT_0 0x0000040 +#define ACP_DMA_DSCR_CNT_1 0x0000044 +#define ACP_DMA_DSCR_CNT_2 0x0000048 +#define ACP_DMA_DSCR_CNT_3 0x000004C +#define ACP_DMA_DSCR_CNT_4 0x0000050 +#define ACP_DMA_DSCR_CNT_5 0x0000054 +#define ACP_DMA_DSCR_CNT_6 0x0000058 +#define ACP_DMA_DSCR_CNT_7 0x000005C +#define ACP_DMA_PRIO_0 0x0000060 +#define ACP_DMA_PRIO_1 0x0000064 +#define ACP_DMA_PRIO_2 0x0000068 +#define ACP_DMA_PRIO_3 0x000006C +#define ACP_DMA_PRIO_4 0x0000070 +#define ACP_DMA_PRIO_5 0x0000074 +#define ACP_DMA_PRIO_6 0x0000078 +#define ACP_DMA_PRIO_7 0x000007C +#define ACP_DMA_CUR_DSCR_0 0x0000080 +#define ACP_DMA_CUR_DSCR_1 0x0000084 +#define ACP_DMA_CUR_DSCR_2 0x0000088 +#define ACP_DMA_CUR_DSCR_3 0x000008C +#define ACP_DMA_CUR_DSCR_4 0x0000090 +#define ACP_DMA_CUR_DSCR_5 0x0000094 +#define ACP_DMA_CUR_DSCR_6 0x0000098 +#define ACP_DMA_CUR_DSCR_7 0x000009C +#define ACP_DMA_CUR_TRANS_CNT_0 0x00000A0 +#define ACP_DMA_CUR_TRANS_CNT_1 0x00000A4 +#define ACP_DMA_CUR_TRANS_CNT_2 0x00000A8 +#define ACP_DMA_CUR_TRANS_CNT_3 0x00000AC +#define ACP_DMA_CUR_TRANS_CNT_4 0x00000B0 +#define ACP_DMA_CUR_TRANS_CNT_5 0x00000B4 +#define ACP_DMA_CUR_TRANS_CNT_6 0x00000B8 +#define ACP_DMA_CUR_TRANS_CNT_7 0x00000BC +#define ACP_DMA_ERR_STS_0 0x00000C0 +#define ACP_DMA_ERR_STS_1 0x00000C4 +#define ACP_DMA_ERR_STS_2 0x00000C8 +#define ACP_DMA_ERR_STS_3 0x00000CC +#define ACP_DMA_ERR_STS_4 0x00000D0 +#define ACP_DMA_ERR_STS_5 0x00000D4 +#define ACP_DMA_ERR_STS_6 0x00000D8 +#define ACP_DMA_ERR_STS_7 0x00000DC +#define ACP_DMA_DESC_BASE_ADDR 0x00000E0 +#define ACP_DMA_DESC_MAX_NUM_DSCR 0x00000E4 +#define ACP_DMA_CH_STS 0x00000E8 +#define ACP_DMA_CH_GROUP 0x00000EC +#define ACP_DMA_CH_RST_STS 0x00000F0 + +/* Registers from ACP_AXI2AXIATU block */ +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_1 0x0000C00 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_1 0x0000C04 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_2 0x0000C08 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_2 0x0000C0C +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_3 0x0000C10 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_3 0x0000C14 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_4 0x0000C18 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_4 0x0000C1C +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_5 0x0000C20 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_5 0x0000C24 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_6 0x0000C28 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_6 0x0000C2C +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_7 0x0000C30 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_7 0x0000C34 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_8 0x0000C38 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_8 0x0000C3C +#define ACPAXI2AXI_ATU_CTRL 0x0000C40 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_9 0x0000C44 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_9 0x0000C48 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_10 0x0000C4C +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_10 0x0000C50 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_11 0x0000C54 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_11 0x0000C58 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_12 0x0000C5C +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_12 0x0000C60 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_13 0x0000C64 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_13 0x0000C68 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_14 0x0000C6C +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_14 0x0000C70 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_15 0x0000C74 +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_15 0x0000C78 +#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_16 0x0000C7C +#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_16 0x0000C80 + +/* Registers from ACP_CLKRST block */ +#define ACP_SOFT_RESET 0x0001000 +#define ACP_CONTROL 0x0001004 +#define ACP_STATUS 0x0001008 +#define ACP_DYNAMIC_CG_MASTER_CONTROL 0x0001010 +#define ACP_ZSC_DSP_CTRL 0x0001014 +#define ACP_ZSC_STS 0x0001018 +#define ACP_PGFSM_CONTROL 0x0001024 +#define ACP_PGFSM_STATUS 0x0001028 +#define ACP_CLKMUX_SEL 0x000102C + +/* Registers from ACP_AON block */ +#define ACP_PME_EN 0x0001400 +#define ACP_DEVICE_STATE 0x0001404 +#define AZ_DEVICE_STATE 0x0001408 +#define ACP_PIN_CONFIG 0x0001440 +#define ACP_PAD_PULLUP_CTRL 0x0001444 +#define ACP_PAD_PULLDOWN_CTRL 0x0001448 +#define ACP_PAD_DRIVE_STRENGTH_CTRL 0x000144C +#define ACP_PAD_SCHMEN_CTRL 0x0001450 +#define ACP_SW_PAD_KEEPER_EN 0x0001454 +#define ACP_SW_WAKE_EN 0x0001458 +#define ACP_I2S_WAKE_EN 0x000145C +#define ACP_SW1_WAKE_EN 0x0001460 + +/* Registers from ACP_P1_MISC block */ +#define ACP_EXTERNAL_INTR_ENB 0x0001A00 +#define ACP_EXTERNAL_INTR_CNTL 0x0001A04 +#define ACP_EXTERNAL_INTR_CNTL1 0x0001A08 +#define ACP_EXTERNAL_INTR_STAT 0x0001A0C +#define ACP_EXTERNAL_INTR_STAT1 0x0001A10 +#define ACP_ERROR_STATUS 0x0001A4C +#define ACP_P1_SW_I2S_ERROR_REASON 0x0001A50 +#define ACP_P1_SW_POS_TRACK_I2S_TX_CTRL 0x0001A6C +#define ACP_P1_SW_I2S_TX_DMA_POS 0x0001A70 +#define ACP_P1_SW_POS_TRACK_I2S_RX_CTRL 0x0001A74 +#define ACP_P1_SW_I2S_RX_DMA_POS 0x0001A78 +#define ACP_P1_DMIC_I2S_GPIO_INTR_CTRL 0x0001A7C +#define ACP_P1_DMIC_I2S_GPIO_INTR_STATUS 0x0001A80 +#define ACP_SCRATCH_REG_BASE_ADDR 0x0001A84 +#define ACP_P1_SW_POS_TRACK_BT_TX_CTRL 0x0001A88 +#define ACP_P1_SW_BT_TX_DMA_POS 0x0001A8C +#define ACP_P1_SW_POS_TRACK_HS_TX_CTRL 0x0001A90 +#define ACP_P1_SW_HS_TX_DMA_POS 0x0001A94 +#define ACP_P1_SW_POS_TRACK_BT_RX_CTRL 0x0001A98 +#define ACP_P1_SW_BT_RX_DMA_POS 0x0001A9C +#define ACP_P1_SW_POS_TRACK_HS_RX_CTRL 0x0001AA0 +#define ACP_P1_SW_HS_RX_DMA_POS 0x0001AA4 + +/* Registers from ACP_AUDIO_BUFFERS block */ +#define ACP_I2S_RX_RINGBUFADDR 0x0002000 +#define ACP_I2S_RX_RINGBUFSIZE 0x0002004 +#define ACP_I2S_RX_LINKPOSITIONCNTR 0x0002008 +#define ACP_I2S_RX_FIFOADDR 0x000200C +#define ACP_I2S_RX_FIFOSIZE 0x0002010 +#define ACP_I2S_RX_DMA_SIZE 0x0002014 +#define ACP_I2S_RX_LINEARPOSITIONCNTR_HIGH 0x0002018 +#define ACP_I2S_RX_LINEARPOSITIONCNTR_LOW 0x000201C +#define ACP_I2S_RX_INTR_WATERMARK_SIZE 0x0002020 +#define ACP_I2S_TX_RINGBUFADDR 0x0002024 +#define ACP_I2S_TX_RINGBUFSIZE 0x0002028 +#define ACP_I2S_TX_LINKPOSITIONCNTR 0x000202C +#define ACP_I2S_TX_FIFOADDR 0x0002030 +#define ACP_I2S_TX_FIFOSIZE 0x0002034 +#define ACP_I2S_TX_DMA_SIZE 0x0002038 +#define ACP_I2S_TX_LINEARPOSITIONCNTR_HIGH 0x000203C +#define ACP_I2S_TX_LINEARPOSITIONCNTR_LOW 0x0002040 +#define ACP_I2S_TX_INTR_WATERMARK_SIZE 0x0002044 +#define ACP_BT_RX_RINGBUFADDR 0x0002048 +#define ACP_BT_RX_RINGBUFSIZE 0x000204C +#define ACP_BT_RX_LINKPOSITIONCNTR 0x0002050 +#define ACP_BT_RX_FIFOADDR 0x0002054 +#define ACP_BT_RX_FIFOSIZE 0x0002058 +#define ACP_BT_RX_DMA_SIZE 0x000205C +#define ACP_BT_RX_LINEARPOSITIONCNTR_HIGH 0x0002060 +#define ACP_BT_RX_LINEARPOSITIONCNTR_LOW 0x0002064 +#define ACP_BT_RX_INTR_WATERMARK_SIZE 0x0002068 +#define ACP_BT_TX_RINGBUFADDR 0x000206C +#define ACP_BT_TX_RINGBUFSIZE 0x0002070 +#define ACP_BT_TX_LINKPOSITIONCNTR 0x0002074 +#define ACP_BT_TX_FIFOADDR 0x0002078 +#define ACP_BT_TX_FIFOSIZE 0x000207C +#define ACP_BT_TX_DMA_SIZE 0x0002080 +#define ACP_BT_TX_LINEARPOSITIONCNTR_HIGH 0x0002084 +#define ACP_BT_TX_LINEARPOSITIONCNTR_LOW 0x0002088 +#define ACP_BT_TX_INTR_WATERMARK_SIZE 0x000208C +#define ACP_HS_RX_RINGBUFADDR 0x0002090 +#define ACP_HS_RX_RINGBUFSIZE 0x0002094 +#define ACP_HS_RX_LINKPOSITIONCNTR 0x0002098 +#define ACP_HS_RX_FIFOADDR 0x000209C +#define ACP_HS_RX_FIFOSIZE 0x00020A0 +#define ACP_HS_RX_DMA_SIZE 0x00020A4 +#define ACP_HS_RX_LINEARPOSITIONCNTR_HIGH 0x00020A8 +#define ACP_HS_RX_LINEARPOSITIONCNTR_LOW 0x00020AC +#define ACP_HS_RX_INTR_WATERMARK_SIZE 0x00020B0 +#define ACP_HS_TX_RINGBUFADDR 0x00020B4 +#define ACP_HS_TX_RINGBUFSIZE 0x00020B8 +#define ACP_HS_TX_LINKPOSITIONCNTR 0x00020BC +#define ACP_HS_TX_FIFOADDR 0x00020C0 +#define ACP_HS_TX_FIFOSIZE 0x00020C4 +#define ACP_HS_TX_DMA_SIZE 0x00020C8 +#define ACP_HS_TX_LINEARPOSITIONCNTR_HIGH 0x00020CC +#define ACP_HS_TX_LINEARPOSITIONCNTR_LOW 0x00020D0 +#define ACP_HS_TX_INTR_WATERMARK_SIZE 0x00020D4 + +/* Registers from ACP_I2S_TDM block */ +#define ACP_I2STDM_IER 0x0002400 +#define ACP_I2STDM_IRER 0x0002404 +#define ACP_I2STDM_RXFRMT 0x0002408 +#define ACP_I2STDM_ITER 0x000240C +#define ACP_I2STDM_TXFRMT 0x0002410 +#define ACP_I2STDM0_MSTRCLKGEN 0x0002414 +#define ACP_I2STDM1_MSTRCLKGEN 0x0002418 +#define ACP_I2STDM2_MSTRCLKGEN 0x000241C +#define ACP_I2STDM_REFCLKGEN 0x0002420 + +/* Registers from ACP_BT_TDM block */ +#define ACP_BTTDM_IER 0x0002800 +#define ACP_BTTDM_IRER 0x0002804 +#define ACP_BTTDM_RXFRMT 0x0002808 +#define ACP_BTTDM_ITER 0x000280C +#define ACP_BTTDM_TXFRMT 0x0002810 +#define ACP_HSTDM_IER 0x0002814 +#define ACP_HSTDM_IRER 0x0002818 +#define ACP_HSTDM_RXFRMT 0x000281C +#define ACP_HSTDM_ITER 0x0002820 +#define ACP_HSTDM_TXFRMT 0x0002824 + +/* Registers from ACP_WOV block */ +#define ACP_WOV_PDM_ENABLE 0x0002C04 +#define ACP_WOV_PDM_DMA_ENABLE 0x0002C08 +#define ACP_WOV_RX_RINGBUFADDR 0x0002C0C +#define ACP_WOV_RX_RINGBUFSIZE 0x0002C10 +#define ACP_WOV_RX_LINKPOSITIONCNTR 0x0002C14 +#define ACP_WOV_RX_LINEARPOSITIONCNTR_HIGH 0x0002C18 +#define ACP_WOV_RX_LINEARPOSITIONCNTR_LOW 0x0002C1C +#define ACP_WOV_RX_INTR_WATERMARK_SIZE 0x0002C20 +#define ACP_WOV_PDM_FIFO_FLUSH 0x0002C24 +#define ACP_WOV_PDM_NO_OF_CHANNELS 0x0002C28 +#define ACP_WOV_PDM_DECIMATION_FACTOR 0x0002C2C +#define ACP_WOV_PDM_VAD_CTRL 0x0002C30 +#define ACP_WOV_WAKE 0x0002C54 +#define ACP_WOV_BUFFER_STATUS 0x0002C58 +#define ACP_WOV_MISC_CTRL 0x0002C5C +#define ACP_WOV_CLK_CTRL 0x0002C60 +#define ACP_PDM_VAD_DYNAMIC_CLK_GATING_EN 0x0002C64 +#define ACP_WOV_ERROR_STATUS_REGISTER 0x0002C68 +#define ACP_PDM_CLKDIV 0x0002C6C + +/* Registers from ACP_P1_AUDIO_BUFFERS block */ +#define ACP_P1_I2S_RX_RINGBUFADDR 0x0003A00 +#define ACP_P1_I2S_RX_RINGBUFSIZE 0x0003A04 +#define ACP_P1_I2S_RX_LINKPOSITIONCNTR 0x0003A08 +#define ACP_P1_I2S_RX_FIFOADDR 0x0003A0C +#define ACP_P1_I2S_RX_FIFOSIZE 0x0003A10 +#define ACP_P1_I2S_RX_DMA_SIZE 0x0003A14 +#define ACP_P1_I2S_RX_LINEARPOSITIONCNTR_HIGH 0x0003A18 +#define ACP_P1_I2S_RX_LINEARPOSITIONCNTR_LOW 0x0003A1C +#define ACP_P1_I2S_RX_INTR_WATERMARK_SIZE 0x0003A20 +#define ACP_P1_I2S_TX_RINGBUFADDR 0x0003A24 +#define ACP_P1_I2S_TX_RINGBUFSIZE 0x0003A28 +#define ACP_P1_I2S_TX_LINKPOSITIONCNTR 0x0003A2C +#define ACP_P1_I2S_TX_FIFOADDR 0x0003A30 +#define ACP_P1_I2S_TX_FIFOSIZE 0x0003A34 +#define ACP_P1_I2S_TX_DMA_SIZE 0x0003A38 +#define ACP_P1_I2S_TX_LINEARPOSITIONCNTR_HIGH 0x0003A3C +#define ACP_P1_I2S_TX_LINEARPOSITIONCNTR_LOW 0x0003A40 +#define ACP_P1_I2S_TX_INTR_WATERMARK_SIZE 0x0003A44 +#define ACP_P1_BT_RX_RINGBUFADDR 0x0003A48 +#define ACP_P1_BT_RX_RINGBUFSIZE 0x0003A4C +#define ACP_P1_BT_RX_LINKPOSITIONCNTR 0x0003A50 +#define ACP_P1_BT_RX_FIFOADDR 0x0003A54 +#define ACP_P1_BT_RX_FIFOSIZE 0x0003A58 +#define ACP_P1_BT_RX_DMA_SIZE 0x0003A5C +#define ACP_P1_BT_RX_LINEARPOSITIONCNTR_HIGH 0x0003A60 +#define ACP_P1_BT_RX_LINEARPOSITIONCNTR_LOW 0x0003A64 +#define ACP_P1_BT_RX_INTR_WATERMARK_SIZE 0x0003A68 +#define ACP_P1_BT_TX_RINGBUFADDR 0x0003A6C +#define ACP_P1_BT_TX_RINGBUFSIZE 0x0003A70 +#define ACP_P1_BT_TX_LINKPOSITIONCNTR 0x0003A74 +#define ACP_P1_BT_TX_FIFOADDR 0x0003A78 +#define ACP_P1_BT_TX_FIFOSIZE 0x0003A7C +#define ACP_P1_BT_TX_DMA_SIZE 0x0003A80 +#define ACP_P1_BT_TX_LINEARPOSITIONCNTR_HIGH 0x0003A84 +#define ACP_P1_BT_TX_LINEARPOSITIONCNTR_LOW 0x0003A88 +#define ACP_P1_BT_TX_INTR_WATERMARK_SIZE 0x0003A8C +#define ACP_P1_HS_RX_RINGBUFADDR 0x0003A90 +#define ACP_P1_HS_RX_RINGBUFSIZE 0x0003A94 +#define ACP_P1_HS_RX_LINKPOSITIONCNTR 0x0003A98 +#define ACP_P1_HS_RX_FIFOADDR 0x0003A9C +#define ACP_P1_HS_RX_FIFOSIZE 0x0003AA0 +#define ACP_P1_HS_RX_DMA_SIZE 0x0003AA4 +#define ACP_P1_HS_RX_LINEARPOSITIONCNTR_HIGH 0x0003AA8 +#define ACP_P1_HS_RX_LINEARPOSITIONCNTR_LOW 0x0003AAC +#define ACP_P1_HS_RX_INTR_WATERMARK_SIZE 0x0003AB0 +#define ACP_P1_HS_TX_RINGBUFADDR 0x0003AB4 +#define ACP_P1_HS_TX_RINGBUFSIZE 0x0003AB8 +#define ACP_P1_HS_TX_LINKPOSITIONCNTR 0x0003ABC +#define ACP_P1_HS_TX_FIFOADDR 0x0003AC0 +#define ACP_P1_HS_TX_FIFOSIZE 0x0003AC4 +#define ACP_P1_HS_TX_DMA_SIZE 0x0003AC8 +#define ACP_P1_HS_TX_LINEARPOSITIONCNTR_HIGH 0x0003ACC +#define ACP_P1_HS_TX_LINEARPOSITIONCNTR_LOW 0x0003AD0 +#define ACP_P1_HS_TX_INTR_WATERMARK_SIZE 0x0003AD4 + +/* Registers from ACP_SCRATCH block */ +#define ACP_SCRATCH_REG_0 0x0010000 +#define ACP_SCRATCH_REG_1 0x0010004 +#define ACP_SCRATCH_REG_2 0x0010008 +#define ACP_SCRATCH_REG_3 0x001000C +#define ACP_SCRATCH_REG_4 0x0010010 +#define ACP_SCRATCH_REG_5 0x0010014 +#define ACP_SCRATCH_REG_6 0x0010018 +#define ACP_SCRATCH_REG_7 0x001001C +#define ACP_SCRATCH_REG_8 0x0010020 +#define ACP_SCRATCH_REG_9 0x0010024 +#define ACP_SCRATCH_REG_10 0x0010028 +#define ACP_SCRATCH_REG_11 0x001002C +#define ACP_SCRATCH_REG_12 0x0010030 +#define ACP_SCRATCH_REG_13 0x0010034 +#define ACP_SCRATCH_REG_14 0x0010038 +#define ACP_SCRATCH_REG_15 0x001003C +#define ACP_SCRATCH_REG_16 0x0010040 +#define ACP_SCRATCH_REG_17 0x0010044 +#define ACP_SCRATCH_REG_18 0x0010048 +#define ACP_SCRATCH_REG_19 0x001004C +#define ACP_SCRATCH_REG_20 0x0010050 +#define ACP_SCRATCH_REG_21 0x0010054 +#define ACP_SCRATCH_REG_22 0x0010058 +#define ACP_SCRATCH_REG_23 0x001005C +#define ACP_SCRATCH_REG_24 0x0010060 +#define ACP_SCRATCH_REG_25 0x0010064 +#define ACP_SCRATCH_REG_26 0x0010068 +#define ACP_SCRATCH_REG_27 0x001006C +#define ACP_SCRATCH_REG_28 0x0010070 +#define ACP_SCRATCH_REG_29 0x0010074 +#define ACP_SCRATCH_REG_30 0x0010078 +#define ACP_SCRATCH_REG_31 0x001007C +#define ACP_SCRATCH_REG_32 0x0010080 +#define ACP_SCRATCH_REG_33 0x0010084 +#define ACP_SCRATCH_REG_34 0x0010088 +#define ACP_SCRATCH_REG_35 0x001008C +#define ACP_SCRATCH_REG_36 0x0010090 +#define ACP_SCRATCH_REG_37 0x0010094 +#define ACP_SCRATCH_REG_38 0x0010098 +#define ACP_SCRATCH_REG_39 0x001009C +#define ACP_SCRATCH_REG_40 0x00100A0 +#define ACP_SCRATCH_REG_41 0x00100A4 +#define ACP_SCRATCH_REG_42 0x00100A8 +#define ACP_SCRATCH_REG_43 0x00100AC +#define ACP_SCRATCH_REG_44 0x00100B0 +#define ACP_SCRATCH_REG_45 0x00100B4 +#define ACP_SCRATCH_REG_46 0x00100B8 +#define ACP_SCRATCH_REG_47 0x00100BC +#define ACP_SCRATCH_REG_48 0x00100C0 +#define ACP_SCRATCH_REG_49 0x00100C4 +#define ACP_SCRATCH_REG_50 0x00100C8 +#define ACP_SCRATCH_REG_51 0x00100CC +#define ACP_SCRATCH_REG_52 0x00100D0 +#define ACP_SCRATCH_REG_53 0x00100D4 +#define ACP_SCRATCH_REG_54 0x00100D8 +#define ACP_SCRATCH_REG_55 0x00100DC +#define ACP_SCRATCH_REG_56 0x00100E0 +#define ACP_SCRATCH_REG_57 0x00100E4 +#define ACP_SCRATCH_REG_58 0x00100E8 +#define ACP_SCRATCH_REG_59 0x00100EC +#define ACP_SCRATCH_REG_60 0x00100F0 +#define ACP_SCRATCH_REG_61 0x00100F4 +#define ACP_SCRATCH_REG_62 0x00100F8 +#define ACP_SCRATCH_REG_63 0x00100FC +#define ACP_SCRATCH_REG_64 0x0010100 +#define ACP_SCRATCH_REG_65 0x0010104 +#define ACP_SCRATCH_REG_66 0x0010108 +#define ACP_SCRATCH_REG_67 0x001010C +#define ACP_SCRATCH_REG_68 0x0010110 +#define ACP_SCRATCH_REG_69 0x0010114 +#define ACP_SCRATCH_REG_70 0x0010118 +#define ACP_SCRATCH_REG_71 0x001011C +#define ACP_SCRATCH_REG_72 0x0010120 +#define ACP_SCRATCH_REG_73 0x0010124 +#define ACP_SCRATCH_REG_74 0x0010128 +#define ACP_SCRATCH_REG_75 0x001012C +#define ACP_SCRATCH_REG_76 0x0010130 +#define ACP_SCRATCH_REG_77 0x0010134 +#define ACP_SCRATCH_REG_78 0x0010138 +#define ACP_SCRATCH_REG_79 0x001013C +#define ACP_SCRATCH_REG_80 0x0010140 +#define ACP_SCRATCH_REG_81 0x0010144 +#define ACP_SCRATCH_REG_82 0x0010148 +#define ACP_SCRATCH_REG_83 0x001014C +#define ACP_SCRATCH_REG_84 0x0010150 +#define ACP_SCRATCH_REG_85 0x0010154 +#define ACP_SCRATCH_REG_86 0x0010158 +#define ACP_SCRATCH_REG_87 0x001015C +#define ACP_SCRATCH_REG_88 0x0010160 +#define ACP_SCRATCH_REG_89 0x0010164 +#define ACP_SCRATCH_REG_90 0x0010168 +#define ACP_SCRATCH_REG_91 0x001016C +#define ACP_SCRATCH_REG_92 0x0010170 +#define ACP_SCRATCH_REG_93 0x0010174 +#define ACP_SCRATCH_REG_94 0x0010178 +#define ACP_SCRATCH_REG_95 0x001017C +#define ACP_SCRATCH_REG_96 0x0010180 +#define ACP_SCRATCH_REG_97 0x0010184 +#define ACP_SCRATCH_REG_98 0x0010188 +#define ACP_SCRATCH_REG_99 0x001018C +#define ACP_SCRATCH_REG_100 0x0010190 +#define ACP_SCRATCH_REG_101 0x0010194 +#define ACP_SCRATCH_REG_102 0x0010198 +#define ACP_SCRATCH_REG_103 0x001019C +#define ACP_SCRATCH_REG_104 0x00101A0 +#define ACP_SCRATCH_REG_105 0x00101A4 +#define ACP_SCRATCH_REG_106 0x00101A8 +#define ACP_SCRATCH_REG_107 0x00101AC +#define ACP_SCRATCH_REG_108 0x00101B0 +#define ACP_SCRATCH_REG_109 0x00101B4 +#define ACP_SCRATCH_REG_110 0x00101B8 +#define ACP_SCRATCH_REG_111 0x00101BC +#define ACP_SCRATCH_REG_112 0x00101C0 +#define ACP_SCRATCH_REG_113 0x00101C4 +#define ACP_SCRATCH_REG_114 0x00101C8 +#define ACP_SCRATCH_REG_115 0x00101CC +#define ACP_SCRATCH_REG_116 0x00101D0 +#define ACP_SCRATCH_REG_117 0x00101D4 +#define ACP_SCRATCH_REG_118 0x00101D8 +#define ACP_SCRATCH_REG_119 0x00101DC +#define ACP_SCRATCH_REG_120 0x00101E0 +#define ACP_SCRATCH_REG_121 0x00101E4 +#define ACP_SCRATCH_REG_122 0x00101E8 +#define ACP_SCRATCH_REG_123 0x00101EC +#define ACP_SCRATCH_REG_124 0x00101F0 +#define ACP_SCRATCH_REG_125 0x00101F4 +#define ACP_SCRATCH_REG_126 0x00101F8 +#define ACP_SCRATCH_REG_127 0x00101FC +#define ACP_SCRATCH_REG_128 0x0010200 +#endif --- a/sound/soc/amd/Kconfig +++ b/sound/soc/amd/Kconfig @@ -129,10 +129,10 @@ config SND_SOC_AMD_RPL_ACP6x If unsure select "N".

config SND_SOC_AMD_PS - tristate "AMD Audio Coprocessor-v6.2 Pink Sardine support" + tristate "AMD Audio Coprocessor-v6.3 Pink Sardine support" depends on X86 && PCI && ACPI help - This option enables Audio Coprocessor i.e ACP v6.2 support on + This option enables Audio Coprocessor i.e ACP v6.3 support on AMD Pink sardine platform. By enabling this flag build will be triggered for ACP PCI driver, ACP PDM DMA driver. Say m if you have such a device. --- a/sound/soc/amd/ps/acp62.h +++ /dev/null @@ -1,98 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0+ */ -/* - * AMD ALSA SoC PDM Driver - * - * Copyright (C) 2022 Advanced Micro Devices, Inc. All rights reserved. - */ - -#include <sound/acp62_chip_offset_byte.h> - -#define ACP_DEVICE_ID 0x15E2 -#define ACP6x_REG_START 0x1240000 -#define ACP6x_REG_END 0x1250200 -#define ACP6x_DEVS 3 -#define ACP6x_PDM_MODE 1 - -#define ACP_SOFT_RESET_SOFTRESET_AUDDONE_MASK 0x00010001 -#define ACP_PGFSM_CNTL_POWER_ON_MASK 1 -#define ACP_PGFSM_CNTL_POWER_OFF_MASK 0 -#define ACP_PGFSM_STATUS_MASK 3 -#define ACP_POWERED_ON 0 -#define ACP_POWER_ON_IN_PROGRESS 1 -#define ACP_POWERED_OFF 2 -#define ACP_POWER_OFF_IN_PROGRESS 3 - -#define ACP_ERROR_MASK 0x20000000 -#define ACP_EXT_INTR_STAT_CLEAR_MASK 0xFFFFFFFF -#define PDM_DMA_STAT 0x10 - -#define PDM_DMA_INTR_MASK 0x10000 -#define ACP_ERROR_STAT 29 -#define PDM_DECIMATION_FACTOR 2 -#define ACP_PDM_CLK_FREQ_MASK 7 -#define ACP_WOV_MISC_CTRL_MASK 0x10 -#define ACP_PDM_ENABLE 1 -#define ACP_PDM_DISABLE 0 -#define ACP_PDM_DMA_EN_STATUS 2 -#define TWO_CH 2 -#define DELAY_US 5 -#define ACP_COUNTER 20000 - -#define ACP_SRAM_PTE_OFFSET 0x03800000 -#define PAGE_SIZE_4K_ENABLE 2 -#define PDM_PTE_OFFSET 0 -#define PDM_MEM_WINDOW_START 0x4000000 - -#define CAPTURE_MIN_NUM_PERIODS 4 -#define CAPTURE_MAX_NUM_PERIODS 4 -#define CAPTURE_MAX_PERIOD_SIZE 8192 -#define CAPTURE_MIN_PERIOD_SIZE 4096 - -#define MAX_BUFFER (CAPTURE_MAX_PERIOD_SIZE * CAPTURE_MAX_NUM_PERIODS) -#define MIN_BUFFER MAX_BUFFER - -/* time in ms for runtime suspend delay */ -#define ACP_SUSPEND_DELAY_MS 2000 - -enum acp_config { - ACP_CONFIG_0 = 0, - ACP_CONFIG_1, - ACP_CONFIG_2, - ACP_CONFIG_3, - ACP_CONFIG_4, - ACP_CONFIG_5, - ACP_CONFIG_6, - ACP_CONFIG_7, - ACP_CONFIG_8, - ACP_CONFIG_9, - ACP_CONFIG_10, - ACP_CONFIG_11, - ACP_CONFIG_12, - ACP_CONFIG_13, - ACP_CONFIG_14, - ACP_CONFIG_15, -}; - -struct pdm_stream_instance { - u16 num_pages; - u16 channels; - dma_addr_t dma_addr; - u64 bytescount; - void __iomem *acp62_base; -}; - -struct pdm_dev_data { - u32 pdm_irq; - void __iomem *acp62_base; - struct snd_pcm_substream *capture_stream; -}; - -static inline u32 acp62_readl(void __iomem *base_addr) -{ - return readl(base_addr); -} - -static inline void acp62_writel(u32 val, void __iomem *base_addr) -{ - writel(val, base_addr); -} --- /dev/null +++ b/sound/soc/amd/ps/acp63.h @@ -0,0 +1,98 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * AMD ALSA SoC PDM Driver + * + * Copyright (C) 2022 Advanced Micro Devices, Inc. All rights reserved. + */ + +#include <sound/acp63_chip_offset_byte.h> + +#define ACP_DEVICE_ID 0x15E2 +#define ACP6x_REG_START 0x1240000 +#define ACP6x_REG_END 0x1250200 +#define ACP6x_DEVS 3 +#define ACP6x_PDM_MODE 1 + +#define ACP_SOFT_RESET_SOFTRESET_AUDDONE_MASK 0x00010001 +#define ACP_PGFSM_CNTL_POWER_ON_MASK 1 +#define ACP_PGFSM_CNTL_POWER_OFF_MASK 0 +#define ACP_PGFSM_STATUS_MASK 3 +#define ACP_POWERED_ON 0 +#define ACP_POWER_ON_IN_PROGRESS 1 +#define ACP_POWERED_OFF 2 +#define ACP_POWER_OFF_IN_PROGRESS 3 + +#define ACP_ERROR_MASK 0x20000000 +#define ACP_EXT_INTR_STAT_CLEAR_MASK 0xFFFFFFFF +#define PDM_DMA_STAT 0x10 + +#define PDM_DMA_INTR_MASK 0x10000 +#define ACP_ERROR_STAT 29 +#define PDM_DECIMATION_FACTOR 2 +#define ACP_PDM_CLK_FREQ_MASK 7 +#define ACP_WOV_MISC_CTRL_MASK 0x10 +#define ACP_PDM_ENABLE 1 +#define ACP_PDM_DISABLE 0 +#define ACP_PDM_DMA_EN_STATUS 2 +#define TWO_CH 2 +#define DELAY_US 5 +#define ACP_COUNTER 20000 + +#define ACP_SRAM_PTE_OFFSET 0x03800000 +#define PAGE_SIZE_4K_ENABLE 2 +#define PDM_PTE_OFFSET 0 +#define PDM_MEM_WINDOW_START 0x4000000 + +#define CAPTURE_MIN_NUM_PERIODS 4 +#define CAPTURE_MAX_NUM_PERIODS 4 +#define CAPTURE_MAX_PERIOD_SIZE 8192 +#define CAPTURE_MIN_PERIOD_SIZE 4096 + +#define MAX_BUFFER (CAPTURE_MAX_PERIOD_SIZE * CAPTURE_MAX_NUM_PERIODS) +#define MIN_BUFFER MAX_BUFFER + +/* time in ms for runtime suspend delay */ +#define ACP_SUSPEND_DELAY_MS 2000 + +enum acp_config { + ACP_CONFIG_0 = 0, + ACP_CONFIG_1, + ACP_CONFIG_2, + ACP_CONFIG_3, + ACP_CONFIG_4, + ACP_CONFIG_5, + ACP_CONFIG_6, + ACP_CONFIG_7, + ACP_CONFIG_8, + ACP_CONFIG_9, + ACP_CONFIG_10, + ACP_CONFIG_11, + ACP_CONFIG_12, + ACP_CONFIG_13, + ACP_CONFIG_14, + ACP_CONFIG_15, +}; + +struct pdm_stream_instance { + u16 num_pages; + u16 channels; + dma_addr_t dma_addr; + u64 bytescount; + void __iomem *acp63_base; +}; + +struct pdm_dev_data { + u32 pdm_irq; + void __iomem *acp63_base; + struct snd_pcm_substream *capture_stream; +}; + +static inline u32 acp63_readl(void __iomem *base_addr) +{ + return readl(base_addr); +} + +static inline void acp63_writel(u32 val, void __iomem *base_addr) +{ + writel(val, base_addr); +} --- a/sound/soc/amd/ps/pci-ps.c +++ b/sound/soc/amd/ps/pci-ps.c @@ -15,30 +15,30 @@ #include <sound/pcm_params.h> #include <linux/pm_runtime.h>

-#include "acp62.h" +#include "acp63.h"

-struct acp62_dev_data { - void __iomem *acp62_base; +struct acp63_dev_data { + void __iomem *acp63_base; struct resource *res; - bool acp62_audio_mode; + bool acp63_audio_mode; struct platform_device *pdev[ACP6x_DEVS]; };

-static int acp62_power_on(void __iomem *acp_base) +static int acp63_power_on(void __iomem *acp_base) { u32 val; int timeout;

- val = acp62_readl(acp_base + ACP_PGFSM_STATUS); + val = acp63_readl(acp_base + ACP_PGFSM_STATUS);

if (!val) return val;

if ((val & ACP_PGFSM_STATUS_MASK) != ACP_POWER_ON_IN_PROGRESS) - acp62_writel(ACP_PGFSM_CNTL_POWER_ON_MASK, acp_base + ACP_PGFSM_CONTROL); + acp63_writel(ACP_PGFSM_CNTL_POWER_ON_MASK, acp_base + ACP_PGFSM_CONTROL); timeout = 0; while (++timeout < 500) { - val = acp62_readl(acp_base + ACP_PGFSM_STATUS); + val = acp63_readl(acp_base + ACP_PGFSM_STATUS); if (!val) return 0; udelay(1); @@ -46,23 +46,23 @@ static int acp62_power_on(void __iomem * return -ETIMEDOUT; }

-static int acp62_reset(void __iomem *acp_base) +static int acp63_reset(void __iomem *acp_base) { u32 val; int timeout;

- acp62_writel(1, acp_base + ACP_SOFT_RESET); + acp63_writel(1, acp_base + ACP_SOFT_RESET); timeout = 0; while (++timeout < 500) { - val = acp62_readl(acp_base + ACP_SOFT_RESET); + val = acp63_readl(acp_base + ACP_SOFT_RESET); if (val & ACP_SOFT_RESET_SOFTRESET_AUDDONE_MASK) break; cpu_relax(); } - acp62_writel(0, acp_base + ACP_SOFT_RESET); + acp63_writel(0, acp_base + ACP_SOFT_RESET); timeout = 0; while (++timeout < 500) { - val = acp62_readl(acp_base + ACP_SOFT_RESET); + val = acp63_readl(acp_base + ACP_SOFT_RESET); if (!val) return 0; cpu_relax(); @@ -70,57 +70,57 @@ static int acp62_reset(void __iomem *acp return -ETIMEDOUT; }

-static void acp62_enable_interrupts(void __iomem *acp_base) +static void acp63_enable_interrupts(void __iomem *acp_base) { - acp62_writel(1, acp_base + ACP_EXTERNAL_INTR_ENB); + acp63_writel(1, acp_base + ACP_EXTERNAL_INTR_ENB); }

-static void acp62_disable_interrupts(void __iomem *acp_base) +static void acp63_disable_interrupts(void __iomem *acp_base) { - acp62_writel(ACP_EXT_INTR_STAT_CLEAR_MASK, acp_base + + acp63_writel(ACP_EXT_INTR_STAT_CLEAR_MASK, acp_base + ACP_EXTERNAL_INTR_STAT); - acp62_writel(0, acp_base + ACP_EXTERNAL_INTR_CNTL); - acp62_writel(0, acp_base + ACP_EXTERNAL_INTR_ENB); + acp63_writel(0, acp_base + ACP_EXTERNAL_INTR_CNTL); + acp63_writel(0, acp_base + ACP_EXTERNAL_INTR_ENB); }

-static int acp62_init(void __iomem *acp_base, struct device *dev) +static int acp63_init(void __iomem *acp_base, struct device *dev) { int ret;

- ret = acp62_power_on(acp_base); + ret = acp63_power_on(acp_base); if (ret) { dev_err(dev, "ACP power on failed\n"); return ret; } - acp62_writel(0x01, acp_base + ACP_CONTROL); - ret = acp62_reset(acp_base); + acp63_writel(0x01, acp_base + ACP_CONTROL); + ret = acp63_reset(acp_base); if (ret) { dev_err(dev, "ACP reset failed\n"); return ret; } - acp62_writel(0x03, acp_base + ACP_CLKMUX_SEL); - acp62_enable_interrupts(acp_base); + acp63_writel(0x03, acp_base + ACP_CLKMUX_SEL); + acp63_enable_interrupts(acp_base); return 0; }

-static int acp62_deinit(void __iomem *acp_base, struct device *dev) +static int acp63_deinit(void __iomem *acp_base, struct device *dev) { int ret;

- acp62_disable_interrupts(acp_base); - ret = acp62_reset(acp_base); + acp63_disable_interrupts(acp_base); + ret = acp63_reset(acp_base); if (ret) { dev_err(dev, "ACP reset failed\n"); return ret; } - acp62_writel(0, acp_base + ACP_CLKMUX_SEL); - acp62_writel(0, acp_base + ACP_CONTROL); + acp63_writel(0, acp_base + ACP_CLKMUX_SEL); + acp63_writel(0, acp_base + ACP_CONTROL); return 0; }

-static irqreturn_t acp62_irq_handler(int irq, void *dev_id) +static irqreturn_t acp63_irq_handler(int irq, void *dev_id) { - struct acp62_dev_data *adata; + struct acp63_dev_data *adata; struct pdm_dev_data *ps_pdm_data; u32 val;

@@ -128,10 +128,10 @@ static irqreturn_t acp62_irq_handler(int if (!adata) return IRQ_NONE;

- val = acp62_readl(adata->acp62_base + ACP_EXTERNAL_INTR_STAT); + val = acp63_readl(adata->acp63_base + ACP_EXTERNAL_INTR_STAT); if (val & BIT(PDM_DMA_STAT)) { ps_pdm_data = dev_get_drvdata(&adata->pdev[0]->dev); - acp62_writel(BIT(PDM_DMA_STAT), adata->acp62_base + ACP_EXTERNAL_INTR_STAT); + acp63_writel(BIT(PDM_DMA_STAT), adata->acp63_base + ACP_EXTERNAL_INTR_STAT); if (ps_pdm_data->capture_stream) snd_pcm_period_elapsed(ps_pdm_data->capture_stream); return IRQ_HANDLED; @@ -139,10 +139,10 @@ static irqreturn_t acp62_irq_handler(int return IRQ_NONE; }

-static int snd_acp62_probe(struct pci_dev *pci, +static int snd_acp63_probe(struct pci_dev *pci, const struct pci_device_id *pci_id) { - struct acp62_dev_data *adata; + struct acp63_dev_data *adata; struct platform_device_info pdevinfo[ACP6x_DEVS]; int index, ret; int val = 0x00; @@ -157,7 +157,7 @@ static int snd_acp62_probe(struct pci_de case 0x63: break; default: - dev_dbg(&pci->dev, "acp62 pci device not found\n"); + dev_dbg(&pci->dev, "acp63 pci device not found\n"); return -ENODEV; } if (pci_enable_device(pci)) { @@ -170,7 +170,7 @@ static int snd_acp62_probe(struct pci_de dev_err(&pci->dev, "pci_request_regions failed\n"); goto disable_pci; } - adata = devm_kzalloc(&pci->dev, sizeof(struct acp62_dev_data), + adata = devm_kzalloc(&pci->dev, sizeof(struct acp63_dev_data), GFP_KERNEL); if (!adata) { ret = -ENOMEM; @@ -178,18 +178,18 @@ static int snd_acp62_probe(struct pci_de }

addr = pci_resource_start(pci, 0); - adata->acp62_base = devm_ioremap(&pci->dev, addr, + adata->acp63_base = devm_ioremap(&pci->dev, addr, pci_resource_len(pci, 0)); - if (!adata->acp62_base) { + if (!adata->acp63_base) { ret = -ENOMEM; goto release_regions; } pci_set_master(pci); pci_set_drvdata(pci, adata); - ret = acp62_init(adata->acp62_base, &pci->dev); + ret = acp63_init(adata->acp63_base, &pci->dev); if (ret) goto release_regions; - val = acp62_readl(adata->acp62_base + ACP_PIN_CONFIG); + val = acp63_readl(adata->acp63_base + ACP_PIN_CONFIG); switch (val) { case ACP_CONFIG_0: case ACP_CONFIG_1: @@ -220,7 +220,7 @@ static int snd_acp62_probe(struct pci_de adata->res->flags = IORESOURCE_MEM; adata->res->start = addr; adata->res->end = addr + (ACP6x_REG_END - ACP6x_REG_START); - adata->acp62_audio_mode = ACP6x_PDM_MODE; + adata->acp63_audio_mode = ACP6x_PDM_MODE;

memset(&pdevinfo, 0, sizeof(pdevinfo)); pdevinfo[0].name = "acp_ps_pdm_dma"; @@ -248,7 +248,7 @@ static int snd_acp62_probe(struct pci_de ret = PTR_ERR(adata->pdev[index]); goto unregister_devs; } - ret = devm_request_irq(&pci->dev, pci->irq, acp62_irq_handler, + ret = devm_request_irq(&pci->dev, pci->irq, acp63_irq_handler, irqflags, "ACP_PCI_IRQ", adata); if (ret) { dev_err(&pci->dev, "ACP PCI IRQ request failed\n"); @@ -267,7 +267,7 @@ unregister_devs: for (--index; index >= 0; index--) platform_device_unregister(adata->pdev[index]); de_init: - if (acp62_deinit(adata->acp62_base, &pci->dev)) + if (acp63_deinit(adata->acp63_base, &pci->dev)) dev_err(&pci->dev, "ACP de-init failed\n"); release_regions: pci_release_regions(pci); @@ -277,46 +277,46 @@ disable_pci: return ret; }

-static int __maybe_unused snd_acp62_suspend(struct device *dev) +static int __maybe_unused snd_acp63_suspend(struct device *dev) { - struct acp62_dev_data *adata; + struct acp63_dev_data *adata; int ret;

adata = dev_get_drvdata(dev); - ret = acp62_deinit(adata->acp62_base, dev); + ret = acp63_deinit(adata->acp63_base, dev); if (ret) dev_err(dev, "ACP de-init failed\n"); return ret; }

-static int __maybe_unused snd_acp62_resume(struct device *dev) +static int __maybe_unused snd_acp63_resume(struct device *dev) { - struct acp62_dev_data *adata; + struct acp63_dev_data *adata; int ret;

adata = dev_get_drvdata(dev); - ret = acp62_init(adata->acp62_base, dev); + ret = acp63_init(adata->acp63_base, dev); if (ret) dev_err(dev, "ACP init failed\n"); return ret; }

-static const struct dev_pm_ops acp62_pm_ops = { - SET_RUNTIME_PM_OPS(snd_acp62_suspend, snd_acp62_resume, NULL) - SET_SYSTEM_SLEEP_PM_OPS(snd_acp62_suspend, snd_acp62_resume) +static const struct dev_pm_ops acp63_pm_ops = { + SET_RUNTIME_PM_OPS(snd_acp63_suspend, snd_acp63_resume, NULL) + SET_SYSTEM_SLEEP_PM_OPS(snd_acp63_suspend, snd_acp63_resume) };

-static void snd_acp62_remove(struct pci_dev *pci) +static void snd_acp63_remove(struct pci_dev *pci) { - struct acp62_dev_data *adata; + struct acp63_dev_data *adata; int ret, index;

adata = pci_get_drvdata(pci); - if (adata->acp62_audio_mode == ACP6x_PDM_MODE) { + if (adata->acp63_audio_mode == ACP6x_PDM_MODE) { for (index = 0; index < ACP6x_DEVS; index++) platform_device_unregister(adata->pdev[index]); } - ret = acp62_deinit(adata->acp62_base, &pci->dev); + ret = acp63_deinit(adata->acp63_base, &pci->dev); if (ret) dev_err(&pci->dev, "ACP de-init failed\n"); pm_runtime_forbid(&pci->dev); @@ -325,25 +325,25 @@ static void snd_acp62_remove(struct pci_ pci_disable_device(pci); }

-static const struct pci_device_id snd_acp62_ids[] = { +static const struct pci_device_id snd_acp63_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, ACP_DEVICE_ID), .class = PCI_CLASS_MULTIMEDIA_OTHER << 8, .class_mask = 0xffffff }, { 0, }, }; -MODULE_DEVICE_TABLE(pci, snd_acp62_ids); +MODULE_DEVICE_TABLE(pci, snd_acp63_ids);

-static struct pci_driver ps_acp62_driver = { +static struct pci_driver ps_acp63_driver = { .name = KBUILD_MODNAME, - .id_table = snd_acp62_ids, - .probe = snd_acp62_probe, - .remove = snd_acp62_remove, + .id_table = snd_acp63_ids, + .probe = snd_acp63_probe, + .remove = snd_acp63_remove, .driver = { - .pm = &acp62_pm_ops, + .pm = &acp63_pm_ops, } };

-module_pci_driver(ps_acp62_driver); +module_pci_driver(ps_acp63_driver);

MODULE_AUTHOR("Vijendar.Mukunda@amd.com"); MODULE_AUTHOR("Syed.SabaKareem@amd.com"); --- a/sound/soc/amd/ps/ps-mach.c +++ b/sound/soc/amd/ps/ps-mach.c @@ -13,11 +13,11 @@ #include <linux/io.h> #include <linux/dmi.h>

-#include "acp62.h" +#include "acp63.h"

#define DRV_NAME "acp_ps_mach"

-SND_SOC_DAILINK_DEF(acp62_pdm, +SND_SOC_DAILINK_DEF(acp63_pdm, DAILINK_COMP_ARRAY(COMP_CPU("acp_ps_pdm_dma.0")));

SND_SOC_DAILINK_DEF(dmic_codec, @@ -27,31 +27,31 @@ SND_SOC_DAILINK_DEF(dmic_codec, SND_SOC_DAILINK_DEF(pdm_platform, DAILINK_COMP_ARRAY(COMP_PLATFORM("acp_ps_pdm_dma.0")));

-static struct snd_soc_dai_link acp62_dai_pdm[] = { +static struct snd_soc_dai_link acp63_dai_pdm[] = { { - .name = "acp62-dmic-capture", + .name = "acp63-dmic-capture", .stream_name = "DMIC capture", .capture_only = 1, - SND_SOC_DAILINK_REG(acp62_pdm, dmic_codec, pdm_platform), + SND_SOC_DAILINK_REG(acp63_pdm, dmic_codec, pdm_platform), }, };

-static struct snd_soc_card acp62_card = { - .name = "acp62", +static struct snd_soc_card acp63_card = { + .name = "acp63", .owner = THIS_MODULE, - .dai_link = acp62_dai_pdm, + .dai_link = acp63_dai_pdm, .num_links = 1, };

-static int acp62_probe(struct platform_device *pdev) +static int acp63_probe(struct platform_device *pdev) { - struct acp62_pdm *machine = NULL; + struct acp63_pdm *machine = NULL; struct snd_soc_card *card; int ret;

- platform_set_drvdata(pdev, &acp62_card); + platform_set_drvdata(pdev, &acp63_card); card = platform_get_drvdata(pdev); - acp62_card.dev = &pdev->dev; + acp63_card.dev = &pdev->dev;

snd_soc_card_set_drvdata(card, machine); ret = devm_snd_soc_register_card(&pdev->dev, card); @@ -64,15 +64,15 @@ static int acp62_probe(struct platform_d return 0; }

-static struct platform_driver acp62_mach_driver = { +static struct platform_driver acp63_mach_driver = { .driver = { .name = "acp_ps_mach", .pm = &snd_soc_pm_ops, }, - .probe = acp62_probe, + .probe = acp63_probe, };

-module_platform_driver(acp62_mach_driver); +module_platform_driver(acp63_mach_driver);

MODULE_AUTHOR("Syed.SabaKareem@amd.com"); MODULE_LICENSE("GPL v2"); --- a/sound/soc/amd/ps/ps-pdm-dma.c +++ b/sound/soc/amd/ps/ps-pdm-dma.c @@ -14,11 +14,11 @@ #include <sound/soc-dai.h> #include <linux/pm_runtime.h>

-#include "acp62.h" +#include "acp63.h"

#define DRV_NAME "acp_ps_pdm_dma"

-static const struct snd_pcm_hardware acp62_pdm_hardware_capture = { +static const struct snd_pcm_hardware acp63_pdm_hardware_capture = { .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_BLOCK_TRANSFER | SNDRV_PCM_INFO_MMAP | @@ -37,61 +37,61 @@ static const struct snd_pcm_hardware acp .periods_max = CAPTURE_MAX_NUM_PERIODS, };

-static void acp62_init_pdm_ring_buffer(u32 physical_addr, u32 buffer_size, +static void acp63_init_pdm_ring_buffer(u32 physical_addr, u32 buffer_size, u32 watermark_size, void __iomem *acp_base) { - acp62_writel(physical_addr, acp_base + ACP_WOV_RX_RINGBUFADDR); - acp62_writel(buffer_size, acp_base + ACP_WOV_RX_RINGBUFSIZE); - acp62_writel(watermark_size, acp_base + ACP_WOV_RX_INTR_WATERMARK_SIZE); - acp62_writel(0x01, acp_base + ACPAXI2AXI_ATU_CTRL); + acp63_writel(physical_addr, acp_base + ACP_WOV_RX_RINGBUFADDR); + acp63_writel(buffer_size, acp_base + ACP_WOV_RX_RINGBUFSIZE); + acp63_writel(watermark_size, acp_base + ACP_WOV_RX_INTR_WATERMARK_SIZE); + acp63_writel(0x01, acp_base + ACPAXI2AXI_ATU_CTRL); }

-static void acp62_enable_pdm_clock(void __iomem *acp_base) +static void acp63_enable_pdm_clock(void __iomem *acp_base) { u32 pdm_clk_enable, pdm_ctrl;

pdm_clk_enable = ACP_PDM_CLK_FREQ_MASK; pdm_ctrl = 0x00;

- acp62_writel(pdm_clk_enable, acp_base + ACP_WOV_CLK_CTRL); - pdm_ctrl = acp62_readl(acp_base + ACP_WOV_MISC_CTRL); + acp63_writel(pdm_clk_enable, acp_base + ACP_WOV_CLK_CTRL); + pdm_ctrl = acp63_readl(acp_base + ACP_WOV_MISC_CTRL); pdm_ctrl |= ACP_WOV_MISC_CTRL_MASK; - acp62_writel(pdm_ctrl, acp_base + ACP_WOV_MISC_CTRL); + acp63_writel(pdm_ctrl, acp_base + ACP_WOV_MISC_CTRL); }

-static void acp62_enable_pdm_interrupts(void __iomem *acp_base) +static void acp63_enable_pdm_interrupts(void __iomem *acp_base) { u32 ext_int_ctrl;

- ext_int_ctrl = acp62_readl(acp_base + ACP_EXTERNAL_INTR_CNTL); + ext_int_ctrl = acp63_readl(acp_base + ACP_EXTERNAL_INTR_CNTL); ext_int_ctrl |= PDM_DMA_INTR_MASK; - acp62_writel(ext_int_ctrl, acp_base + ACP_EXTERNAL_INTR_CNTL); + acp63_writel(ext_int_ctrl, acp_base + ACP_EXTERNAL_INTR_CNTL); }

-static void acp62_disable_pdm_interrupts(void __iomem *acp_base) +static void acp63_disable_pdm_interrupts(void __iomem *acp_base) { u32 ext_int_ctrl;

- ext_int_ctrl = acp62_readl(acp_base + ACP_EXTERNAL_INTR_CNTL); + ext_int_ctrl = acp63_readl(acp_base + ACP_EXTERNAL_INTR_CNTL); ext_int_ctrl &= ~PDM_DMA_INTR_MASK; - acp62_writel(ext_int_ctrl, acp_base + ACP_EXTERNAL_INTR_CNTL); + acp63_writel(ext_int_ctrl, acp_base + ACP_EXTERNAL_INTR_CNTL); }

-static bool acp62_check_pdm_dma_status(void __iomem *acp_base) +static bool acp63_check_pdm_dma_status(void __iomem *acp_base) { bool pdm_dma_status; u32 pdm_enable, pdm_dma_enable;

pdm_dma_status = false; - pdm_enable = acp62_readl(acp_base + ACP_WOV_PDM_ENABLE); - pdm_dma_enable = acp62_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE); + pdm_enable = acp63_readl(acp_base + ACP_WOV_PDM_ENABLE); + pdm_dma_enable = acp63_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE); if ((pdm_enable & ACP_PDM_ENABLE) && (pdm_dma_enable & ACP_PDM_DMA_EN_STATUS)) pdm_dma_status = true;

return pdm_dma_status; }

-static int acp62_start_pdm_dma(void __iomem *acp_base) +static int acp63_start_pdm_dma(void __iomem *acp_base) { u32 pdm_enable; u32 pdm_dma_enable; @@ -100,12 +100,12 @@ static int acp62_start_pdm_dma(void __io pdm_enable = 0x01; pdm_dma_enable = 0x01;

- acp62_enable_pdm_clock(acp_base); - acp62_writel(pdm_enable, acp_base + ACP_WOV_PDM_ENABLE); - acp62_writel(pdm_dma_enable, acp_base + ACP_WOV_PDM_DMA_ENABLE); + acp63_enable_pdm_clock(acp_base); + acp63_writel(pdm_enable, acp_base + ACP_WOV_PDM_ENABLE); + acp63_writel(pdm_dma_enable, acp_base + ACP_WOV_PDM_DMA_ENABLE); timeout = 0; while (++timeout < ACP_COUNTER) { - pdm_dma_enable = acp62_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE); + pdm_dma_enable = acp63_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE); if ((pdm_dma_enable & 0x02) == ACP_PDM_DMA_EN_STATUS) return 0; udelay(DELAY_US); @@ -113,7 +113,7 @@ static int acp62_start_pdm_dma(void __io return -ETIMEDOUT; }

-static int acp62_stop_pdm_dma(void __iomem *acp_base) +static int acp63_stop_pdm_dma(void __iomem *acp_base) { u32 pdm_enable, pdm_dma_enable; int timeout; @@ -121,14 +121,14 @@ static int acp62_stop_pdm_dma(void __iom pdm_enable = 0x00; pdm_dma_enable = 0x00;

- pdm_enable = acp62_readl(acp_base + ACP_WOV_PDM_ENABLE); - pdm_dma_enable = acp62_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE); + pdm_enable = acp63_readl(acp_base + ACP_WOV_PDM_ENABLE); + pdm_dma_enable = acp63_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE); if (pdm_dma_enable & 0x01) { pdm_dma_enable = 0x02; - acp62_writel(pdm_dma_enable, acp_base + ACP_WOV_PDM_DMA_ENABLE); + acp63_writel(pdm_dma_enable, acp_base + ACP_WOV_PDM_DMA_ENABLE); timeout = 0; while (++timeout < ACP_COUNTER) { - pdm_dma_enable = acp62_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE); + pdm_dma_enable = acp63_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE); if ((pdm_dma_enable & 0x02) == 0x00) break; udelay(DELAY_US); @@ -138,13 +138,13 @@ static int acp62_stop_pdm_dma(void __iom } if (pdm_enable == ACP_PDM_ENABLE) { pdm_enable = ACP_PDM_DISABLE; - acp62_writel(pdm_enable, acp_base + ACP_WOV_PDM_ENABLE); + acp63_writel(pdm_enable, acp_base + ACP_WOV_PDM_ENABLE); } - acp62_writel(0x01, acp_base + ACP_WOV_PDM_FIFO_FLUSH); + acp63_writel(0x01, acp_base + ACP_WOV_PDM_FIFO_FLUSH); return 0; }

-static void acp62_config_dma(struct pdm_stream_instance *rtd, int direction) +static void acp63_config_dma(struct pdm_stream_instance *rtd, int direction) { u16 page_idx; u32 low, high, val; @@ -154,24 +154,24 @@ static void acp62_config_dma(struct pdm_ val = PDM_PTE_OFFSET;

/* Group Enable */ - acp62_writel(ACP_SRAM_PTE_OFFSET | BIT(31), rtd->acp62_base + + acp63_writel(ACP_SRAM_PTE_OFFSET | BIT(31), rtd->acp63_base + ACPAXI2AXI_ATU_BASE_ADDR_GRP_1); - acp62_writel(PAGE_SIZE_4K_ENABLE, rtd->acp62_base + + acp63_writel(PAGE_SIZE_4K_ENABLE, rtd->acp63_base + ACPAXI2AXI_ATU_PAGE_SIZE_GRP_1); for (page_idx = 0; page_idx < rtd->num_pages; page_idx++) { /* Load the low address of page int ACP SRAM through SRBM */ low = lower_32_bits(addr); high = upper_32_bits(addr);

- acp62_writel(low, rtd->acp62_base + ACP_SCRATCH_REG_0 + val); + acp63_writel(low, rtd->acp63_base + ACP_SCRATCH_REG_0 + val); high |= BIT(31); - acp62_writel(high, rtd->acp62_base + ACP_SCRATCH_REG_0 + val + 4); + acp63_writel(high, rtd->acp63_base + ACP_SCRATCH_REG_0 + val + 4); val += 8; addr += PAGE_SIZE; } }

-static int acp62_pdm_dma_open(struct snd_soc_component *component, +static int acp63_pdm_dma_open(struct snd_soc_component *component, struct snd_pcm_substream *substream) { struct snd_pcm_runtime *runtime; @@ -186,7 +186,7 @@ static int acp62_pdm_dma_open(struct snd return -EINVAL;

if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) - runtime->hw = acp62_pdm_hardware_capture; + runtime->hw = acp63_pdm_hardware_capture;

ret = snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS); @@ -196,17 +196,17 @@ static int acp62_pdm_dma_open(struct snd return ret; }

- acp62_enable_pdm_interrupts(adata->acp62_base); + acp63_enable_pdm_interrupts(adata->acp63_base);

if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) adata->capture_stream = substream;

- pdm_data->acp62_base = adata->acp62_base; + pdm_data->acp63_base = adata->acp63_base; runtime->private_data = pdm_data; return ret; }

-static int acp62_pdm_dma_hw_params(struct snd_soc_component *component, +static int acp63_pdm_dma_hw_params(struct snd_soc_component *component, struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params) { @@ -220,26 +220,26 @@ static int acp62_pdm_dma_hw_params(struc period_bytes = params_period_bytes(params); rtd->dma_addr = substream->runtime->dma_addr; rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT); - acp62_config_dma(rtd, substream->stream); - acp62_init_pdm_ring_buffer(PDM_MEM_WINDOW_START, size, - period_bytes, rtd->acp62_base); + acp63_config_dma(rtd, substream->stream); + acp63_init_pdm_ring_buffer(PDM_MEM_WINDOW_START, size, + period_bytes, rtd->acp63_base); return 0; }

-static u64 acp62_pdm_get_byte_count(struct pdm_stream_instance *rtd, +static u64 acp63_pdm_get_byte_count(struct pdm_stream_instance *rtd, int direction) { u32 high, low; u64 byte_count;

- high = acp62_readl(rtd->acp62_base + ACP_WOV_RX_LINEARPOSITIONCNTR_HIGH); + high = acp63_readl(rtd->acp63_base + ACP_WOV_RX_LINEARPOSITIONCNTR_HIGH); byte_count = high; - low = acp62_readl(rtd->acp62_base + ACP_WOV_RX_LINEARPOSITIONCNTR_LOW); + low = acp63_readl(rtd->acp63_base + ACP_WOV_RX_LINEARPOSITIONCNTR_LOW); byte_count = (byte_count << 32) | low; return byte_count; }

-static snd_pcm_uframes_t acp62_pdm_dma_pointer(struct snd_soc_component *comp, +static snd_pcm_uframes_t acp63_pdm_dma_pointer(struct snd_soc_component *comp, struct snd_pcm_substream *stream) { struct pdm_stream_instance *rtd; @@ -249,14 +249,14 @@ static snd_pcm_uframes_t acp62_pdm_dma_p rtd = stream->runtime->private_data; buffersize = frames_to_bytes(stream->runtime, stream->runtime->buffer_size); - bytescount = acp62_pdm_get_byte_count(rtd, stream->stream); + bytescount = acp63_pdm_get_byte_count(rtd, stream->stream); if (bytescount > rtd->bytescount) bytescount -= rtd->bytescount; pos = do_div(bytescount, buffersize); return bytes_to_frames(stream->runtime, pos); }

-static int acp62_pdm_dma_new(struct snd_soc_component *component, +static int acp63_pdm_dma_new(struct snd_soc_component *component, struct snd_soc_pcm_runtime *rtd) { struct device *parent = component->dev->parent; @@ -266,19 +266,19 @@ static int acp62_pdm_dma_new(struct snd_ return 0; }

-static int acp62_pdm_dma_close(struct snd_soc_component *component, +static int acp63_pdm_dma_close(struct snd_soc_component *component, struct snd_pcm_substream *substream) { struct pdm_dev_data *adata = dev_get_drvdata(component->dev); struct snd_pcm_runtime *runtime = substream->runtime;

- acp62_disable_pdm_interrupts(adata->acp62_base); + acp63_disable_pdm_interrupts(adata->acp63_base); adata->capture_stream = NULL; kfree(runtime->private_data); return 0; }

-static int acp62_pdm_dai_trigger(struct snd_pcm_substream *substream, +static int acp63_pdm_dai_trigger(struct snd_pcm_substream *substream, int cmd, struct snd_soc_dai *dai) { struct pdm_stream_instance *rtd; @@ -299,20 +299,20 @@ static int acp62_pdm_dai_trigger(struct case SNDRV_PCM_TRIGGER_START: case SNDRV_PCM_TRIGGER_RESUME: case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: - acp62_writel(ch_mask, rtd->acp62_base + ACP_WOV_PDM_NO_OF_CHANNELS); - acp62_writel(PDM_DECIMATION_FACTOR, rtd->acp62_base + + acp63_writel(ch_mask, rtd->acp63_base + ACP_WOV_PDM_NO_OF_CHANNELS); + acp63_writel(PDM_DECIMATION_FACTOR, rtd->acp63_base + ACP_WOV_PDM_DECIMATION_FACTOR); - rtd->bytescount = acp62_pdm_get_byte_count(rtd, substream->stream); - pdm_status = acp62_check_pdm_dma_status(rtd->acp62_base); + rtd->bytescount = acp63_pdm_get_byte_count(rtd, substream->stream); + pdm_status = acp63_check_pdm_dma_status(rtd->acp63_base); if (!pdm_status) - ret = acp62_start_pdm_dma(rtd->acp62_base); + ret = acp63_start_pdm_dma(rtd->acp63_base); break; case SNDRV_PCM_TRIGGER_STOP: case SNDRV_PCM_TRIGGER_SUSPEND: case SNDRV_PCM_TRIGGER_PAUSE_PUSH: - pdm_status = acp62_check_pdm_dma_status(rtd->acp62_base); + pdm_status = acp63_check_pdm_dma_status(rtd->acp63_base); if (pdm_status) - ret = acp62_stop_pdm_dma(rtd->acp62_base); + ret = acp63_stop_pdm_dma(rtd->acp63_base); break; default: ret = -EINVAL; @@ -321,11 +321,11 @@ static int acp62_pdm_dai_trigger(struct return ret; }

-static const struct snd_soc_dai_ops acp62_pdm_dai_ops = { - .trigger = acp62_pdm_dai_trigger, +static const struct snd_soc_dai_ops acp63_pdm_dai_ops = { + .trigger = acp63_pdm_dai_trigger, };

-static struct snd_soc_dai_driver acp62_pdm_dai_driver = { +static struct snd_soc_dai_driver acp63_pdm_dai_driver = { .name = "acp_ps_pdm_dma.0", .capture = { .rates = SNDRV_PCM_RATE_48000, @@ -335,19 +335,19 @@ static struct snd_soc_dai_driver acp62_p .rate_min = 48000, .rate_max = 48000, }, - .ops = &acp62_pdm_dai_ops, + .ops = &acp63_pdm_dai_ops, };

-static const struct snd_soc_component_driver acp62_pdm_component = { +static const struct snd_soc_component_driver acp63_pdm_component = { .name = DRV_NAME, - .open = acp62_pdm_dma_open, - .close = acp62_pdm_dma_close, - .hw_params = acp62_pdm_dma_hw_params, - .pointer = acp62_pdm_dma_pointer, - .pcm_construct = acp62_pdm_dma_new, + .open = acp63_pdm_dma_open, + .close = acp63_pdm_dma_close, + .hw_params = acp63_pdm_dma_hw_params, + .pointer = acp63_pdm_dma_pointer, + .pcm_construct = acp63_pdm_dma_new, };

-static int acp62_pdm_audio_probe(struct platform_device *pdev) +static int acp63_pdm_audio_probe(struct platform_device *pdev) { struct resource *res; struct pdm_dev_data *adata; @@ -363,16 +363,16 @@ static int acp62_pdm_audio_probe(struct if (!adata) return -ENOMEM;

- adata->acp62_base = devm_ioremap(&pdev->dev, res->start, resource_size(res)); - if (!adata->acp62_base) + adata->acp63_base = devm_ioremap(&pdev->dev, res->start, resource_size(res)); + if (!adata->acp63_base) return -ENOMEM;

adata->capture_stream = NULL;

dev_set_drvdata(&pdev->dev, adata); status = devm_snd_soc_register_component(&pdev->dev, - &acp62_pdm_component, - &acp62_pdm_dai_driver, 1); + &acp63_pdm_component, + &acp63_pdm_dai_driver, 1); if (status) { dev_err(&pdev->dev, "Fail to register acp pdm dai\n");

@@ -385,13 +385,13 @@ static int acp62_pdm_audio_probe(struct return 0; }

-static int acp62_pdm_audio_remove(struct platform_device *pdev) +static int acp63_pdm_audio_remove(struct platform_device *pdev) { pm_runtime_disable(&pdev->dev); return 0; }

-static int __maybe_unused acp62_pdm_resume(struct device *dev) +static int __maybe_unused acp63_pdm_resume(struct device *dev) { struct pdm_dev_data *adata; struct snd_pcm_runtime *runtime; @@ -404,47 +404,47 @@ static int __maybe_unused acp62_pdm_resu rtd = runtime->private_data; period_bytes = frames_to_bytes(runtime, runtime->period_size); buffer_len = frames_to_bytes(runtime, runtime->buffer_size); - acp62_config_dma(rtd, SNDRV_PCM_STREAM_CAPTURE); - acp62_init_pdm_ring_buffer(PDM_MEM_WINDOW_START, buffer_len, - period_bytes, adata->acp62_base); + acp63_config_dma(rtd, SNDRV_PCM_STREAM_CAPTURE); + acp63_init_pdm_ring_buffer(PDM_MEM_WINDOW_START, buffer_len, + period_bytes, adata->acp63_base); } - acp62_enable_pdm_interrupts(adata->acp62_base); + acp63_enable_pdm_interrupts(adata->acp63_base); return 0; }

-static int __maybe_unused acp62_pdm_suspend(struct device *dev) +static int __maybe_unused acp63_pdm_suspend(struct device *dev) { struct pdm_dev_data *adata;

adata = dev_get_drvdata(dev); - acp62_disable_pdm_interrupts(adata->acp62_base); + acp63_disable_pdm_interrupts(adata->acp63_base); return 0; }

-static int __maybe_unused acp62_pdm_runtime_resume(struct device *dev) +static int __maybe_unused acp63_pdm_runtime_resume(struct device *dev) { struct pdm_dev_data *adata;

adata = dev_get_drvdata(dev); - acp62_enable_pdm_interrupts(adata->acp62_base); + acp63_enable_pdm_interrupts(adata->acp63_base); return 0; }

-static const struct dev_pm_ops acp62_pdm_pm_ops = { - SET_RUNTIME_PM_OPS(acp62_pdm_suspend, acp62_pdm_runtime_resume, NULL) - SET_SYSTEM_SLEEP_PM_OPS(acp62_pdm_suspend, acp62_pdm_resume) +static const struct dev_pm_ops acp63_pdm_pm_ops = { + SET_RUNTIME_PM_OPS(acp63_pdm_suspend, acp63_pdm_runtime_resume, NULL) + SET_SYSTEM_SLEEP_PM_OPS(acp63_pdm_suspend, acp63_pdm_resume) };

-static struct platform_driver acp62_pdm_dma_driver = { - .probe = acp62_pdm_audio_probe, - .remove = acp62_pdm_audio_remove, +static struct platform_driver acp63_pdm_dma_driver = { + .probe = acp63_pdm_audio_probe, + .remove = acp63_pdm_audio_remove, .driver = { .name = "acp_ps_pdm_dma", - .pm = &acp62_pdm_pm_ops, + .pm = &acp63_pdm_pm_ops, }, };

-module_platform_driver(acp62_pdm_dma_driver); +module_platform_driver(acp63_pdm_dma_driver);

MODULE_AUTHOR("Syed.SabaKareem@amd.com"); MODULE_DESCRIPTION("AMD PINK SARDINE PDM Driver");

From: Ard Biesheuvel ardb@kernel.org

commit 2198d07c509f1db4a1185d1f65aaada794c6ea59 upstream.

All occurrences of the scs_load macro load the value of the shadow call stack pointer from the task which is current at that point. So instead of taking a task struct register argument in the scs_load macro to specify the task struct to load from, let's always reference the current task directly. This should make it much harder to exploit any instruction sequences reloading the shadow call stack pointer register from memory.

Signed-off-by: Ard Biesheuvel ardb@kernel.org Acked-by: Mark Rutland mark.rutland@arm.com Reviewed-by: Kees Cook keescook@chromium.org Link: https://lore.kernel.org/r/20230109174800.3286265-2-ardb@kernel.org Signed-off-by: Catalin Marinas catalin.marinas@arm.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm64/include/asm/scs.h | 7 ++++--- arch/arm64/kernel/entry.S | 4 ++-- arch/arm64/kernel/head.S | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-)

--- a/arch/arm64/include/asm/scs.h +++ b/arch/arm64/include/asm/scs.h @@ -9,15 +9,16 @@ #ifdef CONFIG_SHADOW_CALL_STACK scs_sp .req x18

- .macro scs_load tsk - ldr scs_sp, [\tsk, #TSK_TI_SCS_SP] + .macro scs_load_current + get_current_task scs_sp + ldr scs_sp, [scs_sp, #TSK_TI_SCS_SP] .endm

.macro scs_save tsk str scs_sp, [\tsk, #TSK_TI_SCS_SP] .endm #else - .macro scs_load tsk + .macro scs_load_current .endm

.macro scs_save tsk --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -272,7 +272,7 @@ alternative_if ARM64_HAS_ADDRESS_AUTH alternative_else_nop_endif 1:

- scs_load tsk + scs_load_current .else add x21, sp, #PT_REGS_SIZE get_current_task tsk @@ -845,7 +845,7 @@ SYM_FUNC_START(cpu_switch_to) msr sp_el0, x1 ptrauth_keys_install_kernel x1, x8, x9, x10 scs_save x0 - scs_load x1 + scs_load_current ret SYM_FUNC_END(cpu_switch_to) NOKPROBE(cpu_switch_to) --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -404,7 +404,7 @@ SYM_FUNC_END(create_kernel_mapping) stp xzr, xzr, [sp, #S_STACKFRAME] add x29, sp, #S_STACKFRAME

- scs_load \tsk + scs_load_current

adr_l \tmp1, __per_cpu_offset ldr w\tmp2, [\tsk, #TSK_TI_CPU]

From: Nicholas Piggin npiggin@gmail.com

commit 648a1783fe2551f5a091c9a5f8f463cb2cbf8745 upstream.

-mcpu=power10 will generate prefixed and pcrel code by default, which we do not support. The general kernel disables these with cflags, but those were missed for the boot wrapper.

Fixes: 4b2a9315f20d ("powerpc/64s: POWER10 CPU Kconfig build option") Cc: stable@vger.kernel.org # v6.1+ Reported-by: Danny Tsen dtsen@linux.ibm.com Signed-off-by: Nicholas Piggin npiggin@gmail.com Signed-off-by: Michael Ellerman mpe@ellerman.id.au Link: https://msgid.link/20230407040909.230998-1-npiggin@gmail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/powerpc/boot/Makefile | 2 ++ 1 file changed, 2 insertions(+)

--- a/arch/powerpc/boot/Makefile +++ b/arch/powerpc/boot/Makefile @@ -34,6 +34,8 @@ endif

BOOTCFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ -fno-strict-aliasing -O2 -msoft-float -mno-altivec -mno-vsx \ + $(call cc-option,-mno-prefixed) $(call cc-option,-mno-pcrel) \ + $(call cc-option,-mno-mma) \ $(call cc-option,-mno-spe) $(call cc-option,-mspe=no) \ -pipe -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \ $(LINUXINCLUDE)

From: Lukas Wunner lukas@wunner.de

commit f5eff5591b8f9c5effd25c92c758a127765f74c1 upstream.

In 2013, commits

2e35afaefe64 ("PCI: pciehp: Add reset_slot() method") 608c388122c7 ("PCI: Add slot reset option to pci_dev_reset()")

amended PCIe hotplug to mask Presence Detect Changed events during a Secondary Bus Reset. The reset thus no longer causes gratuitous slot bringdown and bringup.

However the commits neglected to serialize reset with code paths reading slot registers. For instance, a slot bringup due to an earlier hotplug event may see the Presence Detect State bit cleared during a concurrent Secondary Bus Reset.

In 2018, commit

5b3f7b7d062b ("PCI: pciehp: Avoid slot access during reset")

retrofitted the missing locking. It introduced a reset_lock which serializes a Secondary Bus Reset with other parts of pciehp.

Unfortunately the locking turns out to be overzealous: reset_lock is held for the entire enumeration and de-enumeration of hotplugged devices, including driver binding and unbinding.

Driver binding and unbinding acquires device_lock while the reset_lock of the ancestral hotplug port is held. A concurrent Secondary Bus Reset acquires the ancestral reset_lock while already holding the device_lock. The asymmetric locking order in the two code paths can lead to AB-BA deadlocks.

Michael Haeuptle reports such deadlocks on simultaneous hot-removal and vfio release (the latter implies a Secondary Bus Reset):

pciehp_ist() # down_read(reset_lock) pciehp_handle_presence_or_link_change() pciehp_disable_slot() __pciehp_disable_slot() remove_board() pciehp_unconfigure_device() pci_stop_and_remove_bus_device() pci_stop_bus_device() pci_stop_dev() device_release_driver() device_release_driver_internal() __device_driver_lock() # device_lock()

SYS_munmap() vfio_device_fops_release() vfio_device_group_close() vfio_device_close() vfio_device_last_close() vfio_pci_core_close_device() vfio_pci_core_disable() # device_lock() __pci_reset_function_locked() pci_reset_bus_function() pci_dev_reset_slot_function() pci_reset_hotplug_slot() pciehp_reset_slot() # down_write(reset_lock)

Ian May reports the same deadlock on simultaneous hot-removal and an AER-induced Secondary Bus Reset:

aer_recover_work_func() pcie_do_recovery() aer_root_reset() pci_bus_error_reset() pci_slot_reset() pci_slot_lock() # device_lock() pci_reset_hotplug_slot() pciehp_reset_slot() # down_write(reset_lock)

Fix by releasing the reset_lock during driver binding and unbinding, thereby splitting and shrinking the critical section.

Driver binding and unbinding is protected by the device_lock() and thus serialized with a Secondary Bus Reset. There's no need to additionally protect it with the reset_lock. However, pciehp does not bind and unbind devices directly, but rather invokes PCI core functions which also perform certain enumeration and de-enumeration steps.

The reset_lock's purpose is to protect slot registers, not enumeration and de-enumeration of hotplugged devices. That would arguably be the job of the PCI core, not the PCIe hotplug driver. After all, an AER-induced Secondary Bus Reset may as well happen during boot-time enumeration of the PCI hierarchy and there's no locking to prevent that either.

Exempting *de-enumeration* from the reset_lock is relatively harmless: A concurrent Secondary Bus Reset may foil config space accesses such as PME interrupt disablement. But if the device is physically gone, those accesses are pointless anyway. If the device is physically present and only logically removed through an Attention Button press or the sysfs "power" attribute, PME interrupts as well as DMA cannot come through because pciehp_unconfigure_device() disables INTx and Bus Master bits. That's still protected by the reset_lock in the present commit.

Exempting *enumeration* from the reset_lock also has limited impact: The exempted call to pci_bus_add_device() may perform device accesses through pcibios_bus_add_device() and pci_fixup_device() which are now no longer protected from a concurrent Secondary Bus Reset. Otherwise there should be no impact.

In essence, the present commit seeks to fix the AB-BA deadlocks while still retaining a best-effort reset protection for enumeration and de-enumeration of hotplugged devices -- until a general solution is implemented in the PCI core.

Link: https://lore.kernel.org/linux-pci/CS1PR8401MB0728FC6FDAB8A35C22BD90EC95F10@C... Link: https://lore.kernel.org/linux-pci/20200615143250.438252-1-ian.may@canonical.... Link: https://lore.kernel.org/linux-pci/ce878dab-c0c4-5bd0-a725-9805a075682d@amd.c... Link: https://lore.kernel.org/linux-pci/ed831249-384a-6d35-0831-70af191e9bce@huawe... Link: https://bugzilla.kernel.org/show_bug.cgi?id=215590 Fixes: 5b3f7b7d062b ("PCI: pciehp: Avoid slot access during reset") Link: https://lore.kernel.org/r/fef2b2e9edf245c049a8c5b94743c0f74ff5008a.168119190... Reported-by: Michael Haeuptle michael.haeuptle@hpe.com Reported-by: Ian May ian.may@canonical.com Reported-by: Andrey Grodzovsky andrey2805@gmail.com Reported-by: Rahul Kumar rahul.kumar1@amd.com Reported-by: Jialin Zhang zhangjialin11@huawei.com Tested-by: Anatoli Antonovitch Anatoli.Antonovitch@amd.com Signed-off-by: Lukas Wunner lukas@wunner.de Signed-off-by: Bjorn Helgaas bhelgaas@google.com Cc: stable@vger.kernel.org # v4.19+ Cc: Dan Stein dstein@hpe.com Cc: Ashok Raj ashok.raj@intel.com Cc: Alex Michon amichon@kalrayinc.com Cc: Xiongfeng Wang wangxiongfeng2@huawei.com Cc: Alex Williamson alex.williamson@redhat.com Cc: Mika Westerberg mika.westerberg@linux.intel.com Cc: Sathyanarayanan Kuppuswamy sathyanarayanan.kuppuswamy@linux.intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/pci/hotplug/pciehp_pci.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)

--- a/drivers/pci/hotplug/pciehp_pci.c +++ b/drivers/pci/hotplug/pciehp_pci.c @@ -63,7 +63,14 @@ int pciehp_configure_device(struct contr

pci_assign_unassigned_bridge_resources(bridge); pcie_bus_configure_settings(parent); + + /* + * Release reset_lock during driver binding + * to avoid AB-BA deadlock with device_lock. + */ + up_read(&ctrl->reset_lock); pci_bus_add_devices(parent); + down_read_nested(&ctrl->reset_lock, ctrl->depth);

out: pci_unlock_rescan_remove(); @@ -104,7 +111,15 @@ void pciehp_unconfigure_device(struct co list_for_each_entry_safe_reverse(dev, temp, &parent->devices, bus_list) { pci_dev_get(dev); + + /* + * Release reset_lock during driver unbinding + * to avoid AB-BA deadlock with device_lock. + */ + up_read(&ctrl->reset_lock); pci_stop_and_remove_bus_device(dev); + down_read_nested(&ctrl->reset_lock, ctrl->depth); + /* * Ensure that no new Requests will be generated from * the device.

From: Dmitry Baryshkov dmitry.baryshkov@linaro.org

commit 1db6b0a4246ce708b89f5136571130b9987741d1 upstream.

All PCIe PHYs on sc8180x platform have 2 lanes, so change the number of lanes to 2.

Fixes: f839f14e24f2 ("phy: qcom-qmp: Add sc8180x PCIe support") Cc: stable@vger.kernel.org # 5.15 Sgned-off-by: Dmitry Baryshkov dmitry.baryshkov@linaro.org Link: https://lore.kernel.org/r/20230331151250.4049-1-dmitry.baryshkov@linaro.org Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/phy/qualcomm/phy-qcom-qmp-pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/phy/qualcomm/phy-qcom-qmp-pcie.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-pcie.c @@ -1738,7 +1738,7 @@ static const struct qmp_phy_cfg msm8998_ };

static const struct qmp_phy_cfg sc8180x_pciephy_cfg = { - .lanes = 1, + .lanes = 2,

.tables = { .serdes = sc8180x_qmp_pcie_serdes_tbl,

From: Badhri Jagan Sridharan badhri@google.com

commit 0db213ea8eed5534a5169e807f28103cbc9d23df upstream.

usb_udc_connect_control does not check to see if the udc has already been started. This causes gadget->ops->pullup to be called through usb_gadget_connect when invoked from usb_udc_vbus_handler even before usb_gadget_udc_start is called. Guard this by checking for udc->started in usb_udc_connect_control before invoking usb_gadget_connect.

Guarding udc->vbus, udc->started, gadget->connect, gadget->deactivate related functions with connect_lock. usb_gadget_connect_locked, usb_gadget_disconnect_locked, usb_udc_connect_control_locked, usb_gadget_udc_start_locked, usb_gadget_udc_stop_locked are called with this lock held as they can be simulataneously invoked from different code paths.

Adding an additional check to make sure udc is started(udc->started) before pullup callback is invoked.

Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler") Cc: stable@vger.kernel.org Signed-off-by: Badhri Jagan Sridharan badhri@google.com Link: https://lore.kernel.org/r/20230407030741.3163220-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/usb/gadget/udc/core.c | 148 +++++++++++++++++++++++++++++------------- 1 file changed, 104 insertions(+), 44 deletions(-)

--- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -37,6 +37,10 @@ static struct bus_type gadget_bus_type; * @vbus: for udcs who care about vbus status, this value is real vbus status; * for udcs who do not care about vbus status, this value is always true * @started: the UDC's started state. True if the UDC had started. + * @connect_lock: protects udc->vbus, udc->started, gadget->connect, gadget->deactivate related + * functions. usb_gadget_connect_locked, usb_gadget_disconnect_locked, + * usb_udc_connect_control_locked, usb_gadget_udc_start_locked, usb_gadget_udc_stop_locked are + * called with this lock held. * * This represents the internal data structure which is used by the UDC-class * to hold information about udc driver and gadget together. @@ -48,6 +52,7 @@ struct usb_udc { struct list_head list; bool vbus; bool started; + struct mutex connect_lock; };

static struct class *udc_class; @@ -660,17 +665,9 @@ out: } EXPORT_SYMBOL_GPL(usb_gadget_vbus_disconnect);

-/** - * usb_gadget_connect - software-controlled connect to USB host - * @gadget:the peripheral being connected - * - * Enables the D+ (or potentially D-) pullup. The host will start - * enumerating this gadget when the pullup is active and a VBUS session - * is active (the link is powered). - * - * Returns zero on success, else negative errno. - */ -int usb_gadget_connect(struct usb_gadget *gadget) +/* Internal version of usb_gadget_connect needs to be called with connect_lock held. */ +static int usb_gadget_connect_locked(struct usb_gadget *gadget) + __must_hold(&gadget->udc->connect_lock) { int ret = 0;

@@ -679,10 +676,12 @@ int usb_gadget_connect(struct usb_gadget goto out; }

- if (gadget->deactivated) { + if (gadget->deactivated || !gadget->udc->started) { /* * If gadget is deactivated we only save new state. * Gadget will be connected automatically after activation. + * + * udc first needs to be started before gadget can be pulled up. */ gadget->connected = true; goto out; @@ -697,22 +696,32 @@ out:

return ret; } -EXPORT_SYMBOL_GPL(usb_gadget_connect);

/** - * usb_gadget_disconnect - software-controlled disconnect from USB host - * @gadget:the peripheral being disconnected - * - * Disables the D+ (or potentially D-) pullup, which the host may see - * as a disconnect (when a VBUS session is active). Not all systems - * support software pullup controls. + * usb_gadget_connect - software-controlled connect to USB host + * @gadget:the peripheral being connected * - * Following a successful disconnect, invoke the ->disconnect() callback - * for the current gadget driver so that UDC drivers don't need to. + * Enables the D+ (or potentially D-) pullup. The host will start + * enumerating this gadget when the pullup is active and a VBUS session + * is active (the link is powered). * * Returns zero on success, else negative errno. */ -int usb_gadget_disconnect(struct usb_gadget *gadget) +int usb_gadget_connect(struct usb_gadget *gadget) +{ + int ret; + + mutex_lock(&gadget->udc->connect_lock); + ret = usb_gadget_connect_locked(gadget); + mutex_unlock(&gadget->udc->connect_lock); + + return ret; +} +EXPORT_SYMBOL_GPL(usb_gadget_connect); + +/* Internal version of usb_gadget_disconnect needs to be called with connect_lock held. */ +static int usb_gadget_disconnect_locked(struct usb_gadget *gadget) + __must_hold(&gadget->udc->connect_lock) { int ret = 0;

@@ -724,10 +733,12 @@ int usb_gadget_disconnect(struct usb_gad if (!gadget->connected) goto out;

- if (gadget->deactivated) { + if (gadget->deactivated || !gadget->udc->started) { /* * If gadget is deactivated we only save new state. * Gadget will stay disconnected after activation. + * + * udc should have been started before gadget being pulled down. */ gadget->connected = false; goto out; @@ -747,6 +758,30 @@ out:

return ret; } + +/** + * usb_gadget_disconnect - software-controlled disconnect from USB host + * @gadget:the peripheral being disconnected + * + * Disables the D+ (or potentially D-) pullup, which the host may see + * as a disconnect (when a VBUS session is active). Not all systems + * support software pullup controls. + * + * Following a successful disconnect, invoke the ->disconnect() callback + * for the current gadget driver so that UDC drivers don't need to. + * + * Returns zero on success, else negative errno. + */ +int usb_gadget_disconnect(struct usb_gadget *gadget) +{ + int ret; + + mutex_lock(&gadget->udc->connect_lock); + ret = usb_gadget_disconnect_locked(gadget); + mutex_unlock(&gadget->udc->connect_lock); + + return ret; +} EXPORT_SYMBOL_GPL(usb_gadget_disconnect);

/** @@ -767,10 +802,11 @@ int usb_gadget_deactivate(struct usb_gad if (gadget->deactivated) goto out;

+ mutex_lock(&gadget->udc->connect_lock); if (gadget->connected) { - ret = usb_gadget_disconnect(gadget); + ret = usb_gadget_disconnect_locked(gadget); if (ret) - goto out; + goto unlock;

/* * If gadget was being connected before deactivation, we want @@ -780,6 +816,8 @@ int usb_gadget_deactivate(struct usb_gad } gadget->deactivated = true;

+unlock: + mutex_unlock(&gadget->udc->connect_lock); out: trace_usb_gadget_deactivate(gadget, ret);

@@ -803,6 +841,7 @@ int usb_gadget_activate(struct usb_gadge if (!gadget->deactivated) goto out;

+ mutex_lock(&gadget->udc->connect_lock); gadget->deactivated = false;

/* @@ -810,7 +849,8 @@ int usb_gadget_activate(struct usb_gadge * while it was being deactivated, we call usb_gadget_connect(). */ if (gadget->connected) - ret = usb_gadget_connect(gadget); + ret = usb_gadget_connect_locked(gadget); + mutex_unlock(&gadget->udc->connect_lock);

out: trace_usb_gadget_activate(gadget, ret); @@ -1051,12 +1091,13 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);

/* ------------------------------------------------------------------------- */

-static void usb_udc_connect_control(struct usb_udc *udc) +/* Acquire connect_lock before calling this function. */ +static void usb_udc_connect_control_locked(struct usb_udc *udc) __must_hold(&udc->connect_lock) { - if (udc->vbus) - usb_gadget_connect(udc->gadget); + if (udc->vbus && udc->started) + usb_gadget_connect_locked(udc->gadget); else - usb_gadget_disconnect(udc->gadget); + usb_gadget_disconnect_locked(udc->gadget); }

/** @@ -1072,10 +1113,12 @@ void usb_udc_vbus_handler(struct usb_gad { struct usb_udc *udc = gadget->udc;

+ mutex_lock(&udc->connect_lock); if (udc) { udc->vbus = status; - usb_udc_connect_control(udc); + usb_udc_connect_control_locked(udc); } + mutex_unlock(&udc->connect_lock); } EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);

@@ -1097,7 +1140,7 @@ void usb_gadget_udc_reset(struct usb_gad EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);

/** - * usb_gadget_udc_start - tells usb device controller to start up + * usb_gadget_udc_start_locked - tells usb device controller to start up * @udc: The UDC to be started * * This call is issued by the UDC Class driver when it's about @@ -1108,8 +1151,11 @@ EXPORT_SYMBOL_GPL(usb_gadget_udc_reset); * necessary to have it powered on. * * Returns zero on success, else negative errno. + * + * Caller should acquire connect_lock before invoking this function. */ -static inline int usb_gadget_udc_start(struct usb_udc *udc) +static inline int usb_gadget_udc_start_locked(struct usb_udc *udc) + __must_hold(&udc->connect_lock) { int ret;

@@ -1126,7 +1172,7 @@ static inline int usb_gadget_udc_start(s }

/** - * usb_gadget_udc_stop - tells usb device controller we don't need it anymore + * usb_gadget_udc_stop_locked - tells usb device controller we don't need it anymore * @udc: The UDC to be stopped * * This call is issued by the UDC Class driver after calling @@ -1135,8 +1181,11 @@ static inline int usb_gadget_udc_start(s * The details are implementation specific, but it can go as * far as powering off UDC completely and disable its data * line pullups. + * + * Caller should acquire connect lock before invoking this function. */ -static inline void usb_gadget_udc_stop(struct usb_udc *udc) +static inline void usb_gadget_udc_stop_locked(struct usb_udc *udc) + __must_hold(&udc->connect_lock) { if (!udc->started) { dev_err(&udc->dev, "UDC had already stopped\n"); @@ -1295,6 +1344,7 @@ int usb_add_gadget(struct usb_gadget *ga

udc->gadget = gadget; gadget->udc = udc; + mutex_init(&udc->connect_lock);

udc->started = false;

@@ -1496,11 +1546,15 @@ static int gadget_bind_driver(struct dev if (ret) goto err_bind;

- ret = usb_gadget_udc_start(udc); - if (ret) + mutex_lock(&udc->connect_lock); + ret = usb_gadget_udc_start_locked(udc); + if (ret) { + mutex_unlock(&udc->connect_lock); goto err_start; + } usb_gadget_enable_async_callbacks(udc); - usb_udc_connect_control(udc); + usb_udc_connect_control_locked(udc); + mutex_unlock(&udc->connect_lock);

kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); return 0; @@ -1531,12 +1585,14 @@ static void gadget_unbind_driver(struct

kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);

- usb_gadget_disconnect(gadget); + mutex_lock(&udc->connect_lock); + usb_gadget_disconnect_locked(gadget); usb_gadget_disable_async_callbacks(udc); if (gadget->irq) synchronize_irq(gadget->irq); udc->driver->unbind(gadget); - usb_gadget_udc_stop(udc); + usb_gadget_udc_stop_locked(udc); + mutex_unlock(&udc->connect_lock);

mutex_lock(&udc_lock); driver->is_bound = false; @@ -1622,11 +1678,15 @@ static ssize_t soft_connect_store(struct }

if (sysfs_streq(buf, "connect")) { - usb_gadget_udc_start(udc); - usb_gadget_connect(udc->gadget); + mutex_lock(&udc->connect_lock); + usb_gadget_udc_start_locked(udc); + usb_gadget_connect_locked(udc->gadget); + mutex_unlock(&udc->connect_lock); } else if (sysfs_streq(buf, "disconnect")) { - usb_gadget_disconnect(udc->gadget); - usb_gadget_udc_stop(udc); + mutex_lock(&udc->connect_lock); + usb_gadget_disconnect_locked(udc->gadget); + usb_gadget_udc_stop_locked(udc); + mutex_unlock(&udc->connect_lock); } else { dev_err(dev, "unsupported command '%s'\n", buf); ret = -EINVAL;

From: Wesley Cheng quic_wcheng@quicinc.com

commit 02435a739b81ae24aff5d6e930efef9458e2af3c upstream.

It was observed that there are hosts that may complete pending SETUP transactions before the stop active transfers and controller halt occurs, leading to lingering endxfer commands on DEPs on subsequent pullup/gadget start iterations.

dwc3_gadget_ep_disable name=ep8in flags=0x3009 direction=1 dwc3_gadget_ep_disable name=ep4in flags=1 direction=1 dwc3_gadget_ep_disable name=ep3out flags=1 direction=0 usb_gadget_disconnect deactivated=0 connected=0 ret=0

The sequence shows that the USB gadget disconnect (dwc3_gadget_pullup(0)) routine completed successfully, allowing for the USB gadget to proceed with a USB gadget connect. However, if this occurs the system runs into an issue where:

BUG: spinlock already unlocked on CPU spin_bug+0x0 dwc3_remove_requests+0x278 dwc3_ep0_out_start+0xb0 __dwc3_gadget_start+0x25c

This is due to the pending endxfers, leading to gadget start (w/o lock held) to execute the remove requests, which will unlock the dwc3 spinlock as part of giveback.

To mitigate this, resolve the pending endxfers on the pullup disable path by re-locating the SETUP phase check after stop active transfers, since that is where the DWC3_EP_DELAY_STOP is potentially set. This also allows for handling of a host that may be unresponsive by using the completion timeout to trigger the stall and restart for EP0.

Fixes: c96683798e27 ("usb: dwc3: ep0: Don't prepare beyond Setup stage") Cc: stable@vger.kernel.org Acked-by: Thinh Nguyen Thinh.Nguyen@synopsys.com Signed-off-by: Wesley Cheng quic_wcheng@quicinc.com Link: https://lore.kernel.org/r/20230413195742.11821-2-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/usb/dwc3/gadget.c | 49 ++++++++++++++++++++++++++++++---------------- 1 file changed, 32 insertions(+), 17 deletions(-)

--- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -2522,29 +2522,17 @@ static int __dwc3_gadget_start(struct dw static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc) { unsigned long flags; + int ret;

spin_lock_irqsave(&dwc->lock, flags); dwc->connected = false;

/* - * Per databook, when we want to stop the gadget, if a control transfer - * is still in process, complete it and get the core into setup phase. + * Attempt to end pending SETUP status phase, and not wait for the + * function to do so. */ - if (dwc->ep0state != EP0_SETUP_PHASE) { - int ret; - - if (dwc->delayed_status) - dwc3_ep0_send_delayed_status(dwc); - - reinit_completion(&dwc->ep0_in_setup); - - spin_unlock_irqrestore(&dwc->lock, flags); - ret = wait_for_completion_timeout(&dwc->ep0_in_setup, - msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT)); - spin_lock_irqsave(&dwc->lock, flags); - if (ret == 0) - dev_warn(dwc->dev, "timed out waiting for SETUP phase\n"); - } + if (dwc->delayed_status) + dwc3_ep0_send_delayed_status(dwc);

/* * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a @@ -2558,6 +2546,33 @@ static int dwc3_gadget_soft_disconnect(s spin_unlock_irqrestore(&dwc->lock, flags);

/* + * Per databook, when we want to stop the gadget, if a control transfer + * is still in process, complete it and get the core into setup phase. + * In case the host is unresponsive to a SETUP transaction, forcefully + * stall the transfer, and move back to the SETUP phase, so that any + * pending endxfers can be executed. + */ + if (dwc->ep0state != EP0_SETUP_PHASE) { + reinit_completion(&dwc->ep0_in_setup); + + ret = wait_for_completion_timeout(&dwc->ep0_in_setup, + msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT)); + if (ret == 0) { + unsigned int dir; + + dev_warn(dwc->dev, "wait for SETUP phase timed out\n"); + spin_lock_irqsave(&dwc->lock, flags); + dir = !!dwc->ep0_expect_in; + if (dwc->ep0state == EP0_DATA_PHASE) + dwc3_ep0_end_control_data(dwc, dwc->eps[dir]); + else + dwc3_ep0_end_control_data(dwc, dwc->eps[!dir]); + dwc3_ep0_stall_and_restart(dwc); + spin_unlock_irqrestore(&dwc->lock, flags); + } + } + + /* * Note: if the GEVNTCOUNT indicates events in the event buffer, the * driver needs to acknowledge them before the controller can halt. * Simply let the interrupt handler acknowledges and handle the

From: Johan Hovold johan+linaro@kernel.org

commit 44d257e9012ee8040e41d224d0e5bfb5ef5427ea upstream.

Make sure to balance the runtime PM usage count on driver unbind by adding back the pm_runtime_allow() call that had been erroneously removed.

Fixes: 266d0493900a ("usb: dwc3: core: don't trigger runtime pm when remove driver") Cc: stable@vger.kernel.org # 5.9 Cc: Li Jun jun.li@nxp.com Acked-by: Thinh Nguyen Thinh.Nguyen@synopsys.com Signed-off-by: Johan Hovold johan+linaro@kernel.org Link: https://lore.kernel.org/r/20230404072524.19014-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/usb/dwc3/core.c | 1 + 1 file changed, 1 insertion(+)

--- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -1979,6 +1979,7 @@ static int dwc3_remove(struct platform_d dwc3_core_exit(dwc); dwc3_ulpi_exit(dwc);

+ pm_runtime_allow(&pdev->dev); pm_runtime_disable(&pdev->dev); pm_runtime_put_noidle(&pdev->dev); pm_runtime_set_suspended(&pdev->dev);

From: Chris Packham chris.packham@alliedtelesis.co.nz

commit 2a8e41ad337508fc5d598c0f9288890214f8e318 upstream.

On DT unaware platforms of_property_read_u32_array() returns -ENOSYS which wasn't handled by the code treating adi,pwm-active-state as optional. Update the code to use device_property_read_u32_array() which deals gracefully with DT unaware platforms.

Fixes: 86da28eed4fb ("hwmon: (adt7475) Add support for inverting pwm output") Reported-by: Mariusz Białończyk manio@skyboo.net Link: https://lore.kernel.org/linux-hwmon/52e26a67-9131-2dc0-40cb-db5c07370027@all... Signed-off-by: Chris Packham chris.packham@alliedtelesis.co.nz Link: https://lore.kernel.org/r/20230418233656.869055-2-chris.packham@alliedtelesi... Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck linux@roeck-us.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/hwmon/adt7475.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/hwmon/adt7475.c +++ b/drivers/hwmon/adt7475.c @@ -1604,9 +1604,9 @@ static int adt7475_set_pwm_polarity(stru int ret, i; u8 val;

- ret = of_property_read_u32_array(client->dev.of_node, - "adi,pwm-active-state", states, - ARRAY_SIZE(states)); + ret = device_property_read_u32_array(&client->dev, + "adi,pwm-active-state", states, + ARRAY_SIZE(states)); if (ret) return ret;

From: Thomas Gleixner tglx@linutronix.de

commit f7abf14f0001a5a47539d9f60bbdca649e43536b upstream.

For some unknown reason the introduction of the timer_wait_running callback missed to fixup posix CPU timers, which went unnoticed for almost four years. Marco reported recently that the WARN_ON() in timer_wait_running() triggers with a posix CPU timer test case.

Posix CPU timers have two execution models for expiring timers depending on CONFIG_POSIX_CPU_TIMERS_TASK_WORK:

1) If not enabled, the expiry happens in hard interrupt context so spin waiting on the remote CPU is reasonably time bound.

Implement an empty stub function for that case.

2) If enabled, the expiry happens in task work before returning to user space or guest mode. The expired timers are marked as firing and moved from the timer queue to a local list head with sighand lock held. Once the timers are moved, sighand lock is dropped and the expiry happens in fully preemptible context. That means the expiring task can be scheduled out, migrated, interrupted etc. So spin waiting on it is more than suboptimal.

The timer wheel has a timer_wait_running() mechanism for RT, which uses a per CPU timer-base expiry lock which is held by the expiry code and the task waiting for the timer function to complete blocks on that lock.

This does not work in the same way for posix CPU timers as there is no timer base and expiry for process wide timers can run on any task belonging to that process, but the concept of waiting on an expiry lock can be used too in a slightly different way:

- Add a mutex to struct posix_cputimers_work. This struct is per task and used to schedule the expiry task work from the timer interrupt.

- Add a task_struct pointer to struct cpu_timer which is used to store a the task which runs the expiry. That's filled in when the task moves the expired timers to the local expiry list. That's not affecting the size of the k_itimer union as there are bigger union members already

- Let the task take the expiry mutex around the expiry function

- Let the waiter acquire a task reference with rcu_read_lock() held and block on the expiry mutex

This avoids spin-waiting on a task which might not even be on a CPU and works nicely for RT too.

Fixes: ec8f954a40da ("posix-timers: Use a callback for cancel synchronization on PREEMPT_RT") Reported-by: Marco Elver elver@google.com Signed-off-by: Thomas Gleixner tglx@linutronix.de Tested-by: Marco Elver elver@google.com Tested-by: Sebastian Andrzej Siewior bigeasy@linutronix.de Reviewed-by: Frederic Weisbecker frederic@kernel.org Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87zg764ojw.ffs@tglx Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- include/linux/posix-timers.h | 17 +++++--- kernel/time/posix-cpu-timers.c | 81 +++++++++++++++++++++++++++++++++-------- kernel/time/posix-timers.c | 4 ++ 3 files changed, 82 insertions(+), 20 deletions(-)

--- a/include/linux/posix-timers.h +++ b/include/linux/posix-timers.h @@ -4,6 +4,7 @@

#include <linux/spinlock.h> #include <linux/list.h> +#include <linux/mutex.h> #include <linux/alarmtimer.h> #include <linux/timerqueue.h>

@@ -62,16 +63,18 @@ static inline int clockid_to_fd(const cl * cpu_timer - Posix CPU timer representation for k_itimer * @node: timerqueue node to queue in the task/sig * @head: timerqueue head on which this timer is queued - * @task: Pointer to target task + * @pid: Pointer to target task PID * @elist: List head for the expiry list * @firing: Timer is currently firing + * @handling: Pointer to the task which handles expiry */ struct cpu_timer { - struct timerqueue_node node; - struct timerqueue_head *head; - struct pid *pid; - struct list_head elist; - int firing; + struct timerqueue_node node; + struct timerqueue_head *head; + struct pid *pid; + struct list_head elist; + int firing; + struct task_struct __rcu *handling; };

static inline bool cpu_timer_enqueue(struct timerqueue_head *head, @@ -135,10 +138,12 @@ struct posix_cputimers { /** * posix_cputimers_work - Container for task work based posix CPU timer expiry * @work: The task work to be scheduled + * @mutex: Mutex held around expiry in context of this task work * @scheduled: @work has been scheduled already, no further processing */ struct posix_cputimers_work { struct callback_head work; + struct mutex mutex; unsigned int scheduled; };

--- a/kernel/time/posix-cpu-timers.c +++ b/kernel/time/posix-cpu-timers.c @@ -847,6 +847,8 @@ static u64 collect_timerqueue(struct tim return expires;

ctmr->firing = 1; + /* See posix_cpu_timer_wait_running() */ + rcu_assign_pointer(ctmr->handling, current); cpu_timer_dequeue(ctmr); list_add_tail(&ctmr->elist, firing); } @@ -1162,7 +1164,49 @@ static void handle_posix_cpu_timers(stru #ifdef CONFIG_POSIX_CPU_TIMERS_TASK_WORK static void posix_cpu_timers_work(struct callback_head *work) { + struct posix_cputimers_work *cw = container_of(work, typeof(*cw), work); + + mutex_lock(&cw->mutex); handle_posix_cpu_timers(current); + mutex_unlock(&cw->mutex); +} + +/* + * Invoked from the posix-timer core when a cancel operation failed because + * the timer is marked firing. The caller holds rcu_read_lock(), which + * protects the timer and the task which is expiring it from being freed. + */ +static void posix_cpu_timer_wait_running(struct k_itimer *timr) +{ + struct task_struct *tsk = rcu_dereference(timr->it.cpu.handling); + + /* Has the handling task completed expiry already? */ + if (!tsk) + return; + + /* Ensure that the task cannot go away */ + get_task_struct(tsk); + /* Now drop the RCU protection so the mutex can be locked */ + rcu_read_unlock(); + /* Wait on the expiry mutex */ + mutex_lock(&tsk->posix_cputimers_work.mutex); + /* Release it immediately again. */ + mutex_unlock(&tsk->posix_cputimers_work.mutex); + /* Drop the task reference. */ + put_task_struct(tsk); + /* Relock RCU so the callsite is balanced */ + rcu_read_lock(); +} + +static void posix_cpu_timer_wait_running_nsleep(struct k_itimer *timr) +{ + /* Ensure that timr->it.cpu.handling task cannot go away */ + rcu_read_lock(); + spin_unlock_irq(&timr->it_lock); + posix_cpu_timer_wait_running(timr); + rcu_read_unlock(); + /* @timr is on stack and is valid */ + spin_lock_irq(&timr->it_lock); }

/* @@ -1178,6 +1222,7 @@ void clear_posix_cputimers_work(struct t sizeof(p->posix_cputimers_work.work)); init_task_work(&p->posix_cputimers_work.work, posix_cpu_timers_work); + mutex_init(&p->posix_cputimers_work.mutex); p->posix_cputimers_work.scheduled = false; }

@@ -1256,6 +1301,18 @@ static inline void __run_posix_cpu_timer lockdep_posixtimer_exit(); }

+static void posix_cpu_timer_wait_running(struct k_itimer *timr) +{ + cpu_relax(); +} + +static void posix_cpu_timer_wait_running_nsleep(struct k_itimer *timr) +{ + spin_unlock_irq(&timr->it_lock); + cpu_relax(); + spin_lock_irq(&timr->it_lock); +} + static inline bool posix_cpu_timers_work_scheduled(struct task_struct *tsk) { return false; @@ -1364,6 +1421,8 @@ static void handle_posix_cpu_timers(stru */ if (likely(cpu_firing >= 0)) cpu_timer_fire(timer); + /* See posix_cpu_timer_wait_running() */ + rcu_assign_pointer(timer->it.cpu.handling, NULL); spin_unlock(&timer->it_lock); } } @@ -1498,23 +1557,16 @@ static int do_cpu_nanosleep(const clocki expires = cpu_timer_getexpires(&timer.it.cpu); error = posix_cpu_timer_set(&timer, 0, &zero_it, &it); if (!error) { - /* - * Timer is now unarmed, deletion can not fail. - */ + /* Timer is now unarmed, deletion can not fail. */ posix_cpu_timer_del(&timer); + } else { + while (error == TIMER_RETRY) { + posix_cpu_timer_wait_running_nsleep(&timer); + error = posix_cpu_timer_del(&timer); + } } - spin_unlock_irq(&timer.it_lock);

- while (error == TIMER_RETRY) { - /* - * We need to handle case when timer was or is in the - * middle of firing. In other cases we already freed - * resources. - */ - spin_lock_irq(&timer.it_lock); - error = posix_cpu_timer_del(&timer); - spin_unlock_irq(&timer.it_lock); - } + spin_unlock_irq(&timer.it_lock);

if ((it.it_value.tv_sec | it.it_value.tv_nsec) == 0) { /* @@ -1624,6 +1676,7 @@ const struct k_clock clock_posix_cpu = { .timer_del = posix_cpu_timer_del, .timer_get = posix_cpu_timer_get, .timer_rearm = posix_cpu_timer_rearm, + .timer_wait_running = posix_cpu_timer_wait_running, };

const struct k_clock clock_process = { --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -846,6 +846,10 @@ static struct k_itimer *timer_wait_runni rcu_read_lock(); unlock_timer(timer, *flags);

+ /* + * kc->timer_wait_running() might drop RCU lock. So @timer + * cannot be touched anymore after the function returns! + */ if (!WARN_ON_ONCE(!kc->timer_wait_running)) kc->timer_wait_running(timer);

From: Chengming Zhou zhouchengming@bytedance.com

commit 20de765f6d9da0c47b756429c60b41063b990a10 upstream.

We need to set QUEUE_FLAG_STATS for two cases: 1. blk_stat_enable_accounting() 2. blk_stat_add_callback()

So we should clear it only when ((q->stats->accounting == 0) && list_empty(&q->stats->callbacks)).

blk_stat_disable_accounting() only check if q->stats->accounting is 0 before clear the flag, this patch fix it.

Also add list_empty(&q->stats->callbacks)) check when enable, or the flag is already set.

The bug can be reproduced on kernel without BLK_DEV_THROTTLING (since it unconditionally enable accounting, see the next patch).

# cat /sys/block/sr0/queue/scheduler none mq-deadline [bfq]

# cat /sys/kernel/debug/block/sr0/state SAME_COMP|IO_STAT|INIT_DONE|STATS|REGISTERED|NOWAIT|30

# echo none > /sys/block/sr0/queue/scheduler

# cat /sys/kernel/debug/block/sr0/state SAME_COMP|IO_STAT|INIT_DONE|REGISTERED|NOWAIT

# cat /sys/block/sr0/queue/wbt_lat_usec 75000

We can see that after changing elevator from "bfq" to "none", "STATS" flag is lost even though WBT callback still need it.

Fixes: 68497092bde9 ("block: make queue stat accounting a reference") Cc: stable@vger.kernel.org # v5.17+ Signed-off-by: Chengming Zhou zhouchengming@bytedance.com Acked-by: Tejun Heo tj@kernel.org Link: https://lore.kernel.org/r/20230413062805.2081970-1-chengming.zhou@linux.dev Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- block/blk-stat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/block/blk-stat.c +++ b/block/blk-stat.c @@ -189,7 +189,7 @@ void blk_stat_disable_accounting(struct unsigned long flags;

spin_lock_irqsave(&q->stats->lock, flags); - if (!--q->stats->accounting) + if (!--q->stats->accounting && list_empty(&q->stats->callbacks)) blk_queue_flag_clear(QUEUE_FLAG_STATS, q); spin_unlock_irqrestore(&q->stats->lock, flags); } @@ -200,7 +200,7 @@ void blk_stat_enable_accounting(struct r unsigned long flags;

spin_lock_irqsave(&q->stats->lock, flags); - if (!q->stats->accounting++) + if (!q->stats->accounting++ && list_empty(&q->stats->callbacks)) blk_queue_flag_set(QUEUE_FLAG_STATS, q); spin_unlock_irqrestore(&q->stats->lock, flags); }

From: Christoph Hellwig hch@lst.de

commit 6715c98b6cf003f26b1b2f655393134e9d999a05 upstream.

Add a blk_crypto_config_supported_natively helper that wraps __blk_crypto_cfg_supported to retrieve the crypto_profile from the request queue. With this fscrypt can stop including blk-crypto-profile.h and rely on the public consumer interface in blk-crypto.h.

Signed-off-by: Christoph Hellwig hch@lst.de Reviewed-by: Eric Biggers ebiggers@google.com Link: https://lore.kernel.org/r/20221114042944.1009870-3-hch@lst.de Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Eric Biggers ebiggers@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- block/blk-crypto.c | 21 ++++++++++++--------- fs/crypto/inline_crypt.c | 6 ++---- include/linux/blk-crypto.h | 2 ++ 3 files changed, 16 insertions(+), 13 deletions(-)

--- a/block/blk-crypto.c +++ b/block/blk-crypto.c @@ -267,7 +267,6 @@ bool __blk_crypto_bio_prep(struct bio ** { struct bio *bio = *bio_ptr; const struct blk_crypto_key *bc_key = bio->bi_crypt_context->bc_key; - struct blk_crypto_profile *profile;

/* Error if bio has no data. */ if (WARN_ON_ONCE(!bio_has_data(bio))) { @@ -284,10 +283,9 @@ bool __blk_crypto_bio_prep(struct bio ** * Success if device supports the encryption context, or if we succeeded * in falling back to the crypto API. */ - profile = bdev_get_queue(bio->bi_bdev)->crypto_profile; - if (__blk_crypto_cfg_supported(profile, &bc_key->crypto_cfg)) + if (blk_crypto_config_supported_natively(bio->bi_bdev, + &bc_key->crypto_cfg)) return true; - if (blk_crypto_fallback_bio_prep(bio_ptr)) return true; fail: @@ -352,6 +350,13 @@ int blk_crypto_init_key(struct blk_crypt return 0; }

+bool blk_crypto_config_supported_natively(struct block_device *bdev, + const struct blk_crypto_config *cfg) +{ + return __blk_crypto_cfg_supported(bdev_get_queue(bdev)->crypto_profile, + cfg); +} + /* * Check if bios with @cfg can be en/decrypted by blk-crypto (i.e. either the * block_device it's submitted to supports inline crypto, or the @@ -361,8 +366,7 @@ bool blk_crypto_config_supported(struct const struct blk_crypto_config *cfg) { return IS_ENABLED(CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK) || - __blk_crypto_cfg_supported(bdev_get_queue(bdev)->crypto_profile, - cfg); + blk_crypto_config_supported_natively(bdev, cfg); }

/** @@ -383,8 +387,7 @@ bool blk_crypto_config_supported(struct int blk_crypto_start_using_key(struct block_device *bdev, const struct blk_crypto_key *key) { - if (__blk_crypto_cfg_supported(bdev_get_queue(bdev)->crypto_profile, - &key->crypto_cfg)) + if (blk_crypto_config_supported_natively(bdev, &key->crypto_cfg)) return 0; return blk_crypto_fallback_start_using_mode(key->crypto_cfg.crypto_mode); } @@ -407,7 +410,7 @@ int blk_crypto_evict_key(struct block_de { struct request_queue *q = bdev_get_queue(bdev);

- if (__blk_crypto_cfg_supported(q->crypto_profile, &key->crypto_cfg)) + if (blk_crypto_config_supported_natively(bdev, &key->crypto_cfg)) return __blk_crypto_evict_key(q->crypto_profile, key);

/* --- a/fs/crypto/inline_crypt.c +++ b/fs/crypto/inline_crypt.c @@ -12,7 +12,7 @@ * provides the key and IV to use. */

-#include <linux/blk-crypto-profile.h> +#include <linux/blk-crypto.h> #include <linux/blkdev.h> #include <linux/buffer_head.h> #include <linux/sched/mm.h> @@ -77,10 +77,8 @@ static void fscrypt_log_blk_crypto_impl( unsigned int i;

for (i = 0; i < num_devs; i++) { - struct request_queue *q = bdev_get_queue(devs[i]); - if (!IS_ENABLED(CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK) || - __blk_crypto_cfg_supported(q->crypto_profile, cfg)) { + blk_crypto_config_supported_natively(devs[i], cfg)) { if (!xchg(&mode->logged_blk_crypto_native, 1)) pr_info("fscrypt: %s using blk-crypto (native)\n", mode->friendly_name); --- a/include/linux/blk-crypto.h +++ b/include/linux/blk-crypto.h @@ -97,6 +97,8 @@ int blk_crypto_start_using_key(struct bl int blk_crypto_evict_key(struct block_device *bdev, const struct blk_crypto_key *key);

+bool blk_crypto_config_supported_natively(struct block_device *bdev, + const struct blk_crypto_config *cfg); bool blk_crypto_config_supported(struct block_device *bdev, const struct blk_crypto_config *cfg);

From: Bart Van Assche bvanassche@acm.org

commit 85168d416e5d3184b77dbec8fee75c9439894afa upstream.

Allow the compiler to verify consistency of function declarations and function definitions. This patch fixes the following sparse errors:

block/blk-crypto-profile.c:241:14: error: no previous prototype for ‘blk_crypto_get_keyslot’ [-Werror=missing-prototypes] 241 | blk_status_t blk_crypto_get_keyslot(struct blk_crypto_profile *profile, | ^~~~~~~~~~~~~~~~~~~~~~ block/blk-crypto-profile.c:318:6: error: no previous prototype for ‘blk_crypto_put_keyslot’ [-Werror=missing-prototypes] 318 | void blk_crypto_put_keyslot(struct blk_crypto_keyslot *slot) | ^~~~~~~~~~~~~~~~~~~~~~ block/blk-crypto-profile.c:344:6: error: no previous prototype for ‘__blk_crypto_cfg_supported’ [-Werror=missing-prototypes] 344 | bool __blk_crypto_cfg_supported(struct blk_crypto_profile *profile, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ block/blk-crypto-profile.c:373:5: error: no previous prototype for ‘__blk_crypto_evict_key’ [-Werror=missing-prototypes] 373 | int __blk_crypto_evict_key(struct blk_crypto_profile *profile, | ^~~~~~~~~~~~~~~~~~~~~~

Cc: Eric Biggers ebiggers@google.com Signed-off-by: Bart Van Assche bvanassche@acm.org Link: https://lore.kernel.org/r/20221123172923.434339-1-bvanassche@acm.org Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Eric Biggers ebiggers@google.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- block/blk-crypto-profile.c | 1 + 1 file changed, 1 insertion(+)

--- a/block/blk-crypto-profile.c +++ b/block/blk-crypto-profile.c @@ -32,6 +32,7 @@ #include <linux/wait.h> #include <linux/blkdev.h> #include <linux/blk-integrity.h> +#include "blk-crypto-internal.h"

struct blk_crypto_keyslot { atomic_t slot_refs;

From: Eric Biggers ebiggers@google.com

commit 70493a63ba04f754f7a7dd53a4fcc82700181490 upstream.

blk_crypto_evict_key() is only called in contexts such as inode eviction where failure is not an option. So there is nothing the caller can do with errors except log them. (dm-table.c does "use" the error code, but only to pass on to upper layers, so it doesn't really count.)

Just make blk_crypto_evict_key() return void and log errors itself.

Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers ebiggers@google.com Reviewed-by: Christoph Hellwig hch@lst.de Link: https://lore.kernel.org/r/20230315183907.53675-2-ebiggers@kernel.org Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- block/blk-crypto.c | 20 +++++++++----------- drivers/md/dm-table.c | 19 +++++-------------- include/linux/blk-crypto.h | 4 ++-- 3 files changed, 16 insertions(+), 27 deletions(-)

--- a/block/blk-crypto.c +++ b/block/blk-crypto.c @@ -13,6 +13,7 @@ #include <linux/blkdev.h> #include <linux/blk-crypto-profile.h> #include <linux/module.h> +#include <linux/ratelimit.h> #include <linux/slab.h>

#include "blk-crypto-internal.h" @@ -402,21 +403,18 @@ int blk_crypto_start_using_key(struct bl * Upper layers (filesystems) must call this function to ensure that a key is * evicted from any hardware that it might have been programmed into. The key * must not be in use by any in-flight IO when this function is called. - * - * Return: 0 on success or if the key wasn't in any keyslot; -errno on error. */ -int blk_crypto_evict_key(struct block_device *bdev, - const struct blk_crypto_key *key) +void blk_crypto_evict_key(struct block_device *bdev, + const struct blk_crypto_key *key) { struct request_queue *q = bdev_get_queue(bdev); + int err;

if (blk_crypto_config_supported_natively(bdev, &key->crypto_cfg)) - return __blk_crypto_evict_key(q->crypto_profile, key); - - /* - * If the block_device didn't support the key, then blk-crypto-fallback - * may have been used, so try to evict the key from blk-crypto-fallback. - */ - return blk_crypto_fallback_evict_key(key); + err = __blk_crypto_evict_key(q->crypto_profile, key); + else + err = blk_crypto_fallback_evict_key(key); + if (err) + pr_warn_ratelimited("%pg: error %d evicting key\n", bdev, err); } EXPORT_SYMBOL_GPL(blk_crypto_evict_key); --- a/drivers/md/dm-table.c +++ b/drivers/md/dm-table.c @@ -1203,21 +1203,12 @@ struct dm_crypto_profile { struct mapped_device *md; };

-struct dm_keyslot_evict_args { - const struct blk_crypto_key *key; - int err; -}; - static int dm_keyslot_evict_callback(struct dm_target *ti, struct dm_dev *dev, sector_t start, sector_t len, void *data) { - struct dm_keyslot_evict_args *args = data; - int err; + const struct blk_crypto_key *key = data;

- err = blk_crypto_evict_key(dev->bdev, args->key); - if (!args->err) - args->err = err; - /* Always try to evict the key from all devices. */ + blk_crypto_evict_key(dev->bdev, key); return 0; }

@@ -1230,7 +1221,6 @@ static int dm_keyslot_evict(struct blk_c { struct mapped_device *md = container_of(profile, struct dm_crypto_profile, profile)->md; - struct dm_keyslot_evict_args args = { key }; struct dm_table *t; int srcu_idx;

@@ -1243,11 +1233,12 @@ static int dm_keyslot_evict(struct blk_c

if (!ti->type->iterate_devices) continue; - ti->type->iterate_devices(ti, dm_keyslot_evict_callback, &args); + ti->type->iterate_devices(ti, dm_keyslot_evict_callback, + (void *)key); }

dm_put_live_table(md, srcu_idx); - return args.err; + return 0; }

static int --- a/include/linux/blk-crypto.h +++ b/include/linux/blk-crypto.h @@ -94,8 +94,8 @@ int blk_crypto_init_key(struct blk_crypt int blk_crypto_start_using_key(struct block_device *bdev, const struct blk_crypto_key *key);

-int blk_crypto_evict_key(struct block_device *bdev, - const struct blk_crypto_key *key); +void blk_crypto_evict_key(struct block_device *bdev, + const struct blk_crypto_key *key);

bool blk_crypto_config_supported_natively(struct block_device *bdev, const struct blk_crypto_config *cfg);

From: Nuno Sá nuno.sa@analog.com

commit 16313403d873ff17a587818b61f84c8cb4971cef upstream.

As stated in the device datasheet [1], bits a0 and a1 have to be set to 1 for the configuration mode.

[1]: https://www.analog.com/media/en/technical-documentation/data-sheets/ad2s1210...

Fixes: b19e9ad5e2cb9 ("staging:iio:resolver:ad2s1210 general driver cleanup") Cc: stable stable@kernel.org Signed-off-by: Nuno Sá nuno.sa@analog.com Link: https://lore.kernel.org/r/20230327145414.1505537-1-nuno.sa@analog.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/staging/iio/resolver/ad2s1210.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/iio/resolver/ad2s1210.c +++ b/drivers/staging/iio/resolver/ad2s1210.c @@ -101,7 +101,7 @@ struct ad2s1210_state { static const int ad2s1210_mode_vals[4][2] = { [MOD_POS] = { 0, 0 }, [MOD_VEL] = { 0, 1 }, - [MOD_CONFIG] = { 1, 0 }, + [MOD_CONFIG] = { 1, 1 }, };

static inline void ad2s1210_set_mode(enum ad2s1210_mode mode,

From: Johan Hovold johan+linaro@kernel.org

commit 735baf1b23458f71a8b15cb924af22c9ff9cd125 upstream.

Wire up the debugfs regset device pointer so that the controller is resumed before accessing registers to avoid crashing or locking up if it happens to be runtime suspended.

Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver") Cc: stable@vger.kernel.org # 4.15: 30332eeefec8: debugfs: regset32: Add Runtime PM support Cc: stable@vger.kernel.org # 4.15 Signed-off-by: Johan Hovold johan+linaro@kernel.org Link: https://lore.kernel.org/r/20230405090342.7363-1-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/usb/host/xhci-debugfs.c | 1 + 1 file changed, 1 insertion(+)

--- a/drivers/usb/host/xhci-debugfs.c +++ b/drivers/usb/host/xhci-debugfs.c @@ -133,6 +133,7 @@ static void xhci_debugfs_regset(struct x regset->regs = regs; regset->nregs = nregs; regset->base = hcd->regs + base; + regset->dev = hcd->self.controller;

debugfs_create_regset32((const char *)rgs->name, 0444, parent, regset); }

From: Ilpo Järvinen ilpo.jarvinen@linux.intel.com

commit 146a37e05d620cef4ad430e5d1c9c077fe6fa76f upstream.

There's a potential race before THRE/TEMT deasserts when DMA Tx is starting up (or the next batch of continuous Tx is being submitted). This can lead to misdetecting Tx empty condition.

It is entirely normal for THRE/TEMT to be set for some time after the DMA Tx had been setup in serial8250_tx_dma(). As Tx side is definitely not empty at that point, it seems incorrect for serial8250_tx_empty() claim Tx is empty.

Fix the race by also checking in serial8250_tx_empty() whether there's DMA Tx active.

Note: This fix only addresses in-kernel race mainly to make using TCSADRAIN/FLUSH robust. Userspace can still cause other races but they seem userspace concurrency control problems.

Fixes: 9ee4b83e51f74 ("serial: 8250: Add support for dmaengine") Cc: stable@vger.kernel.org Signed-off-by: Ilpo Järvinen ilpo.jarvinen@linux.intel.com Link: https://lore.kernel.org/r/20230317113318.31327-3-ilpo.jarvinen@linux.intel.c... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/tty/serial/8250/8250.h | 12 ++++++++++++ drivers/tty/serial/8250/8250_port.c | 7 ++++--- 2 files changed, 16 insertions(+), 3 deletions(-)

--- a/drivers/tty/serial/8250/8250.h +++ b/drivers/tty/serial/8250/8250.h @@ -365,6 +365,13 @@ static inline void serial8250_do_prepare if (dma->prepare_rx_dma) dma->prepare_rx_dma(p); } + +static inline bool serial8250_tx_dma_running(struct uart_8250_port *p) +{ + struct uart_8250_dma *dma = p->dma; + + return dma && dma->tx_running; +} #else static inline int serial8250_tx_dma(struct uart_8250_port *p) { @@ -380,6 +387,11 @@ static inline int serial8250_request_dma return -1; } static inline void serial8250_release_dma(struct uart_8250_port *p) { } + +static inline bool serial8250_tx_dma_running(struct uart_8250_port *p) +{ + return false; +} #endif

static inline int ns16550a_goto_highspeed(struct uart_8250_port *up) --- a/drivers/tty/serial/8250/8250_port.c +++ b/drivers/tty/serial/8250/8250_port.c @@ -2010,18 +2010,19 @@ static int serial8250_tx_threshold_handl static unsigned int serial8250_tx_empty(struct uart_port *port) { struct uart_8250_port *up = up_to_u8250p(port); + unsigned int result = 0; unsigned long flags; - u16 lsr;

serial8250_rpm_get(up);

spin_lock_irqsave(&port->lock, flags); - lsr = serial_lsr_in(up); + if (!serial8250_tx_dma_running(up) && uart_lsr_tx_empty(serial_lsr_in(up))) + result = TIOCSER_TEMT; spin_unlock_irqrestore(&port->lock, flags);

serial8250_rpm_put(up);

- return uart_lsr_tx_empty(lsr) ? TIOCSER_TEMT : 0; + return result; }

unsigned int serial8250_do_get_mctrl(struct uart_port *port)

From: Joel Fernandes (Google) joel@joelfernandes.org

commit 58d7668242647e661a20efe065519abd6454287e upstream.

For CONFIG_NO_HZ_FULL systems, the tick_do_timer_cpu cannot be offlined. However, cpu_is_hotpluggable() still returns true for those CPUs. This causes torture tests that do offlining to end up trying to offline this CPU causing test failures. Such failure happens on all architectures.

Fix the repeated error messages thrown by this (even if the hotplug errors are harmless) by asking the opinion of the nohz subsystem on whether the CPU can be hotplugged.

[ Apply Frederic Weisbecker feedback on refactoring tick_nohz_cpu_down(). ]

For drivers/base/ portion: Acked-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Acked-by: Frederic Weisbecker frederic@kernel.org Cc: Frederic Weisbecker frederic@kernel.org Cc: "Paul E. McKenney" paulmck@kernel.org Cc: Zhouyi Zhou zhouzhouyi@gmail.com Cc: Will Deacon will@kernel.org Cc: Marc Zyngier maz@kernel.org Cc: rcu rcu@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 2987557f52b9 ("driver-core/cpu: Expose hotpluggability to the rest of the kernel") Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Joel Fernandes (Google) joel@joelfernandes.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/base/cpu.c | 3 ++- include/linux/tick.h | 2 ++ kernel/time/tick-sched.c | 11 ++++++++--- 3 files changed, 12 insertions(+), 4 deletions(-)

--- a/drivers/base/cpu.c +++ b/drivers/base/cpu.c @@ -487,7 +487,8 @@ static const struct attribute_group *cpu bool cpu_is_hotpluggable(unsigned int cpu) { struct device *dev = get_cpu_device(cpu); - return dev && container_of(dev, struct cpu, dev)->hotpluggable; + return dev && container_of(dev, struct cpu, dev)->hotpluggable + && tick_nohz_cpu_hotpluggable(cpu); } EXPORT_SYMBOL_GPL(cpu_is_hotpluggable);

--- a/include/linux/tick.h +++ b/include/linux/tick.h @@ -216,6 +216,7 @@ extern void tick_nohz_dep_set_signal(str enum tick_dep_bits bit); extern void tick_nohz_dep_clear_signal(struct signal_struct *signal, enum tick_dep_bits bit); +extern bool tick_nohz_cpu_hotpluggable(unsigned int cpu);

/* * The below are tick_nohz_[set,clear]_dep() wrappers that optimize off-cases @@ -280,6 +281,7 @@ static inline void tick_nohz_full_add_cp

static inline void tick_nohz_dep_set_cpu(int cpu, enum tick_dep_bits bit) { } static inline void tick_nohz_dep_clear_cpu(int cpu, enum tick_dep_bits bit) { } +static inline bool tick_nohz_cpu_hotpluggable(unsigned int cpu) { return true; }

static inline void tick_dep_set(enum tick_dep_bits bit) { } static inline void tick_dep_clear(enum tick_dep_bits bit) { } --- a/kernel/time/tick-sched.c +++ b/kernel/time/tick-sched.c @@ -527,7 +527,7 @@ void __init tick_nohz_full_setup(cpumask tick_nohz_full_running = true; }

-static int tick_nohz_cpu_down(unsigned int cpu) +bool tick_nohz_cpu_hotpluggable(unsigned int cpu) { /* * The tick_do_timer_cpu CPU handles housekeeping duty (unbound @@ -535,8 +535,13 @@ static int tick_nohz_cpu_down(unsigned i * CPUs. It must remain online when nohz full is enabled. */ if (tick_nohz_full_running && tick_do_timer_cpu == cpu) - return -EBUSY; - return 0; + return false; + return true; +} + +static int tick_nohz_cpu_down(unsigned int cpu) +{ + return tick_nohz_cpu_hotpluggable(cpu) ? 0 : -EBUSY; }

void __init tick_nohz_init(void)

From: Jiaxun Yang jiaxun.yang@flygoat.com

commit ee1809ed7bc456a72dc8410b475b73021a3a68d5 upstream.

fw_getenv will use env entry to determine style of env, however it is legal for firmware to just pass a empty list.

Check if first entry exist before running strchr to avoid null pointer dereference.

Cc: stable@vger.kernel.org Link: https://github.com/clbr/n64bootloader/issues/5 Signed-off-by: Jiaxun Yang jiaxun.yang@flygoat.com Signed-off-by: Thomas Bogendoerfer tsbogend@alpha.franken.de Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/mips/fw/lib/cmdline.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/fw/lib/cmdline.c +++ b/arch/mips/fw/lib/cmdline.c @@ -53,7 +53,7 @@ char *fw_getenv(char *envname) { char *result = NULL;

- if (_fw_envp != NULL) { + if (_fw_envp != NULL && fw_envp(0) != NULL) { /* * Return a pointer to the given environment variable. * YAMON uses "name", "value" pairs, while U-Boot uses

From: Zhang Yuchen zhangyuchen.lcr@bytedance.com

commit 6d2555cde2918409b0331560e66f84a0ad4849c6 upstream.

The ipmi communication is not restored after a specific version of BMC is upgraded on our server. The ipmi driver does not respond after printing the following log:

ipmi_ssif: Invalid response getting flags: 1c 1

I found that after entering this branch, ssif_info->ssif_state always holds SSIF_GETTING_FLAGS and never return to IDLE.

As a result, the driver cannot be loaded, because the driver status is checked during the unload process and must be IDLE in shutdown_ssif():

while (ssif_info->ssif_state != SSIF_IDLE) schedule_timeout(1);

The process trigger this problem is:

1. One msg timeout and next msg start send, and call ssif_set_need_watch().

2. ssif_set_need_watch()->watch_timeout()->start_flag_fetch() change ssif_state to SSIF_GETTING_FLAGS.

3. In msg_done_handler() ssif_state == SSIF_GETTING_FLAGS, if an error message is received, the second branch does not modify the ssif_state.

4. All retry action need IS_SSIF_IDLE() == True. Include retry action in watch_timeout(), msg_done_handler(). Sending msg does not work either. SSIF_IDLE is also checked in start_next_msg().

5. The only thing that can be triggered in the SSIF driver is watch_timeout(), after destory_user(), this timer will stop too.

So, if enter this branch, the ssif_state will remain SSIF_GETTING_FLAGS and can't send msg, no timer started, can't unload.

We did a comparative test before and after adding this patch, and the result is effective.

Fixes: 259307074bfc ("ipmi: Add SMBus interface driver (SSIF)")

Cc: stable@vger.kernel.org Signed-off-by: Zhang Yuchen zhangyuchen.lcr@bytedance.com Message-Id: 20230412074907.80046-1-zhangyuchen.lcr@bytedance.com Signed-off-by: Corey Minyard minyard@acm.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/char/ipmi/ipmi_ssif.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/char/ipmi/ipmi_ssif.c +++ b/drivers/char/ipmi/ipmi_ssif.c @@ -786,9 +786,9 @@ static void msg_done_handler(struct ssif } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 || data[1] != IPMI_GET_MSG_FLAGS_CMD) { /* - * Don't abort here, maybe it was a queued - * response to a previous command. + * Recv error response, give up. */ + ssif_info->ssif_state = SSIF_IDLE; ipmi_ssif_unlock_cond(ssif_info, flags); dev_warn(&ssif_info->client->dev, "Invalid response getting flags: %x %x\n",

From: William Breathitt Gray william.gray@linaro.org

commit 9740827468cea80c42db29e7171a50e99acf7328 upstream.

The priv->chan_out_states array and actual DAC value can become mismatched if stx104_write_raw() is called concurrently. Prevent such a race condition by utilizing a mutex.

Fixes: 97a445dad37a ("iio: Add IIO support for the DAC on the Apex Embedded Systems STX104") Signed-off-by: William Breathitt Gray william.gray@linaro.org Link: https://lore.kernel.org/r/c95c9a77fcef36b2a052282146950f23bbc1ebdc.168079058... Cc: Stable@vger.kernel.org Signed-off-by: Jonathan Cameron Jonathan.Cameron@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/iio/addac/stx104.c | 8 ++++++++ 1 file changed, 8 insertions(+)

--- a/drivers/iio/addac/stx104.c +++ b/drivers/iio/addac/stx104.c @@ -15,6 +15,7 @@ #include <linux/kernel.h> #include <linux/module.h> #include <linux/moduleparam.h> +#include <linux/mutex.h> #include <linux/spinlock.h> #include <linux/types.h>

@@ -69,10 +70,12 @@ struct stx104_reg {

/** * struct stx104_iio - IIO device private data structure + * @lock: synchronization lock to prevent I/O race conditions * @chan_out_states: channels' output states * @reg: I/O address offset for the device registers */ struct stx104_iio { + struct mutex lock; unsigned int chan_out_states[STX104_NUM_OUT_CHAN]; struct stx104_reg __iomem *reg; }; @@ -182,9 +185,12 @@ static int stx104_write_raw(struct iio_d if ((unsigned int)val > 65535) return -EINVAL;

+ mutex_lock(&priv->lock); + priv->chan_out_states[chan->channel] = val; iowrite16(val, &priv->reg->dac[chan->channel]);

+ mutex_unlock(&priv->lock); return 0; } return -EINVAL; @@ -355,6 +361,8 @@ static int stx104_probe(struct device *d

indio_dev->name = dev_name(dev);

+ mutex_init(&priv->lock); + /* configure device for software trigger operation */ iowrite8(0, &priv->reg->acr);

From: Felix Fietkau nbd@nbd.name

commit 5b8ccdfb943f6a03c676d2ea816dd38c149e920b upstream.

According to the documentation, ieee80211_rx_list must not run concurrently with ieee80211_tx_status (or its variants).

Cc: stable@vger.kernel.org Fixes: 88046b2c9f6d ("mt76: add support for reporting tx status with skb") Reported-by: Brian Coverstone brian@mainsequence.net Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/net/wireless/mediatek/mt76/dma.c | 2 ++ drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 5 ++++- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 5 ++++- drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 5 ++++- drivers/net/wireless/mediatek/mt76/tx.c | 4 ++++ 5 files changed, 18 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/mediatek/mt76/dma.c +++ b/drivers/net/wireless/mediatek/mt76/dma.c @@ -436,7 +436,9 @@ free: free_skb: status.skb = tx_info.skb; hw = mt76_tx_status_get_hw(dev, tx_info.skb); + spin_lock_bh(&dev->rx_lock); ieee80211_tx_status_ext(hw, &status); + spin_unlock_bh(&dev->rx_lock);

return ret; } --- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c @@ -1279,8 +1279,11 @@ void mt7603_mac_add_txs(struct mt7603_de if (wcidx >= MT7603_WTBL_STA || !sta) goto out;

- if (mt7603_fill_txs(dev, msta, &info, txs_data)) + if (mt7603_fill_txs(dev, msta, &info, txs_data)) { + spin_lock_bh(&dev->mt76.rx_lock); ieee80211_tx_status_noskb(mt76_hw(dev), sta, &info); + spin_unlock_bh(&dev->mt76.rx_lock); + }

out: rcu_read_unlock(); --- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c @@ -1517,8 +1517,11 @@ static void mt7615_mac_add_txs(struct mt if (wcid->phy_idx && dev->mt76.phys[MT_BAND1]) mphy = dev->mt76.phys[MT_BAND1];

- if (mt7615_fill_txs(dev, msta, &info, txs_data)) + if (mt7615_fill_txs(dev, msta, &info, txs_data)) { + spin_lock_bh(&dev->mt76.rx_lock); ieee80211_tx_status_noskb(mphy->hw, sta, &info); + spin_unlock_bh(&dev->mt76.rx_lock); + }

out: rcu_read_unlock(); --- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c @@ -631,8 +631,11 @@ void mt76x02_send_tx_status(struct mt76x

mt76_tx_status_unlock(mdev, &list);

- if (!status.skb) + if (!status.skb) { + spin_lock_bh(&dev->mt76.rx_lock); ieee80211_tx_status_ext(mt76_hw(dev), &status); + spin_unlock_bh(&dev->mt76.rx_lock); + }

if (!len) goto out; --- a/drivers/net/wireless/mediatek/mt76/tx.c +++ b/drivers/net/wireless/mediatek/mt76/tx.c @@ -77,7 +77,9 @@ mt76_tx_status_unlock(struct mt76_dev *d }

hw = mt76_tx_status_get_hw(dev, skb); + spin_lock_bh(&dev->rx_lock); ieee80211_tx_status_ext(hw, &status); + spin_unlock_bh(&dev->rx_lock); } rcu_read_unlock(); } @@ -263,7 +265,9 @@ void __mt76_tx_complete_skb(struct mt76_ if (cb->pktid < MT_PACKET_ID_FIRST) { hw = mt76_tx_status_get_hw(dev, skb); status.sta = wcid_to_sta(wcid); + spin_lock_bh(&dev->rx_lock); ieee80211_tx_status_ext(hw, &status); + spin_unlock_bh(&dev->rx_lock); goto out; }

From: Heiner Kallweit hkallweit1@gmail.com

commit 9e4fa80ab7ef9eb4f7b1ea9fc31e0eb040e85e25 upstream.

Fix the name of the aoclk81 clock. Apparently name aoclk81 as used by the vendor driver was changed when mainlining the g12a clock driver.

Fixes: f41efceb46e6 ("pwm: meson: Add clock source configuration for Meson G12A") Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit hkallweit1@gmail.com Reviewed-by: Martin Blumenstingl martin.blumenstingl@googlemail.com Signed-off-by: Thierry Reding thierry.reding@gmail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/pwm/pwm-meson.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/pwm/pwm-meson.c +++ b/drivers/pwm/pwm-meson.c @@ -427,7 +427,7 @@ static const struct meson_pwm_data pwm_a };

static const char * const pwm_g12a_ao_ab_parent_names[] = { - "xtal", "aoclk81", "fclk_div4", "fclk_div5" + "xtal", "g12a_ao_clk81", "fclk_div4", "fclk_div5" };

static const struct meson_pwm_data pwm_g12a_ao_ab_data = { @@ -436,7 +436,7 @@ static const struct meson_pwm_data pwm_g };

static const char * const pwm_g12a_ao_cd_parent_names[] = { - "xtal", "aoclk81", + "xtal", "g12a_ao_clk81", };

static const struct meson_pwm_data pwm_g12a_ao_cd_data = {

From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org

commit 163bfb0cb1f6fbf961cf912cbde57399ea1ae0e8 upstream.

As per Hardware Programming Guide, when configuring pin as output, set the pin value before setting output-enable (OE). Similar approach is in main SoC TLMM pin controller.

Cc: stable@vger.kernel.org Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Reviewed-by: Konrad Dybcio konrad.dybcio@linaro.org Link: https://lore.kernel.org/r/20230309154949.658380-1-krzysztof.kozlowski@linaro... Signed-off-by: Linus Walleij linus.walleij@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c @@ -216,6 +216,15 @@ static int lpi_config_set(struct pinctrl } }

+ /* + * As per Hardware Programming Guide, when configuring pin as output, + * set the pin value before setting output-enable (OE). + */ + if (output_enabled) { + val = u32_encode_bits(value ? 1 : 0, LPI_GPIO_VALUE_OUT_MASK); + lpi_gpio_write(pctrl, group, LPI_GPIO_VALUE_REG, val); + } + val = lpi_gpio_read(pctrl, group, LPI_GPIO_CFG_REG);

u32p_replace_bits(&val, pullup, LPI_GPIO_PULL_MASK); @@ -225,11 +234,6 @@ static int lpi_config_set(struct pinctrl

lpi_gpio_write(pctrl, group, LPI_GPIO_CFG_REG, val);

- if (output_enabled) { - val = u32_encode_bits(value ? 1 : 0, LPI_GPIO_VALUE_OUT_MASK); - lpi_gpio_write(pctrl, group, LPI_GPIO_VALUE_REG, val); - } - return 0; }

From: Johannes Berg johannes.berg@intel.com

commit 675751bb20634f981498c7d66161584080cc061e upstream.

If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN):

BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0

CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab3 60f224fc 600477fa 60f35687 60c4f20f 601273dd 00000008 6101eb00 6101eab0 615be548 Call Trace: [<60047a58>] show_stack+0x25e/0x282 [<60c609e0>] dump_stack_lvl+0x96/0xfd [<60c50d4c>] print_report+0x1a7/0x5a8 [<603078d3>] kasan_report+0xc1/0xe9 [<60308950>] __asan_report_load8_noabort+0x1b/0x1d [<60232844>] irq_work_run_list+0x11a/0x13a [<602328b4>] irq_work_tick+0x24/0x34 [<6017f9dc>] update_process_times+0x162/0x196 [<6019f335>] tick_sched_handle+0x1a4/0x1c3 [<6019fd9e>] tick_sched_timer+0x79/0x10c [<601812b9>] __hrtimer_run_queues.constprop.0+0x425/0x695 [<60182913>] hrtimer_interrupt+0x16c/0x2c4 [<600486a3>] um_timer+0x164/0x183 [...]

Allocated by task 411: save_stack_trace+0x99/0xb5 stack_trace_save+0x81/0x9b kasan_save_stack+0x2d/0x54 kasan_set_track+0x34/0x3e kasan_save_alloc_info+0x25/0x28 ____kasan_kmalloc+0x8b/0x97 __kasan_kmalloc+0x10/0x12 __kmalloc+0xb2/0xe8 load_elf_phdrs+0xee/0x182 [...]

The buggy address belongs to the object at 000000006d640800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 584 bytes inside of freed 1024-byte region [000000006d640800, 000000006d640c00)

Add the appropriate irq_work_sync() so the work finishes before the buffers are destroyed.

Prior to the commit in the Fixes tag below, there was only a single global IRQ work, so this issue didn't exist.

Link: https://lore.kernel.org/linux-trace-kernel/20230427175920.a76159263122.I8295...

Cc: stable@vger.kernel.org Cc: Masami Hiramatsu mhiramat@kernel.org Fixes: 15693458c4bc ("tracing/ring-buffer: Move poll wake ups into ring buffer code") Signed-off-by: Johannes Berg johannes.berg@intel.com Signed-off-by: Steven Rostedt (Google) rostedt@goodmis.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/trace/ring_buffer.c | 4 ++++ 1 file changed, 4 insertions(+)

--- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1778,6 +1778,8 @@ static void rb_free_cpu_buffer(struct ri struct list_head *head = cpu_buffer->pages; struct buffer_page *bpage, *tmp;

+ irq_work_sync(&cpu_buffer->irq_work.work); + free_buffer_page(cpu_buffer->reader_page);

if (head) { @@ -1884,6 +1886,8 @@ ring_buffer_free(struct trace_buffer *bu

cpuhp_state_remove_instance(CPUHP_TRACE_RB_PREPARE, &buffer->node);

+ irq_work_sync(&buffer->irq_work.work); + for_each_buffer_cpu(buffer, cpu) rb_free_cpu_buffer(buffer->buffers[cpu]);

From: Jonathan McDowell noodles@earth.li

commit ca25c00ccbc5f942c63897ed23584cfc66e8ec81 upstream.

A failure loading the safexcel driver results in the following warning on boot, because the IRQ affinity has not been correctly cleaned up. Ensure we clean up the affinity and workqueues on a failure to load the driver.

crypto-safexcel: probe of f2800000.crypto failed with error -2 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 232 at kernel/irq/manage.c:1913 free_irq+0x300/0x340 Modules linked in: hwmon mdio_i2c crypto_safexcel(+) md5 sha256_generic libsha256 authenc libdes omap_rng rng_core nft_masq nft_nat nft_chain_nat nf_nat nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink fuse autofs4 CPU: 1 PID: 232 Comm: systemd-udevd Tainted: G W 6.1.6-00002-g9d4898824677 #3 Hardware name: MikroTik RB5009 (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : free_irq+0x300/0x340 lr : free_irq+0x2e0/0x340 sp : ffff800008fa3890 x29: ffff800008fa3890 x28: 0000000000000000 x27: 0000000000000000 x26: ffff8000008e6dc0 x25: ffff000009034cac x24: ffff000009034d50 x23: 0000000000000000 x22: 000000000000004a x21: ffff0000093e0d80 x20: ffff000009034c00 x19: ffff00000615fc00 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 000075f5c1584c5e x14: 0000000000000017 x13: 0000000000000000 x12: 0000000000000040 x11: ffff000000579b60 x10: ffff000000579b62 x9 : ffff800008bbe370 x8 : ffff000000579dd0 x7 : 0000000000000000 x6 : ffff000000579e18 x5 : ffff000000579da8 x4 : ffff800008ca0000 x3 : ffff800008ca0188 x2 : 0000000013033204 x1 : ffff000009034c00 x0 : ffff8000087eadf0 Call trace: free_irq+0x300/0x340 devm_irq_release+0x14/0x20 devres_release_all+0xa0/0x100 device_unbind_cleanup+0x14/0x60 really_probe+0x198/0x2d4 __driver_probe_device+0x74/0xdc driver_probe_device+0x3c/0x110 __driver_attach+0x8c/0x190 bus_for_each_dev+0x6c/0xc0 driver_attach+0x20/0x30 bus_add_driver+0x148/0x1fc driver_register+0x74/0x120 __platform_driver_register+0x24/0x30 safexcel_init+0x48/0x1000 [crypto_safexcel] do_one_initcall+0x4c/0x1b0 do_init_module+0x44/0x1cc load_module+0x1724/0x1be4 __do_sys_finit_module+0xbc/0x110 __arm64_sys_finit_module+0x1c/0x24 invoke_syscall+0x44/0x110 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x20/0x80 el0_svc+0x14/0x4c el0t_64_sync_handler+0xb0/0xb4 el0t_64_sync+0x148/0x14c ---[ end trace 0000000000000000 ]---

Fixes: 1b44c5a60c13 ("inside-secure - add SafeXcel EIP197 crypto engine driver") Signed-off-by: Jonathan McDowell noodles@earth.li Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/crypto/inside-secure/safexcel.c | 37 +++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 10 deletions(-)

--- a/drivers/crypto/inside-secure/safexcel.c +++ b/drivers/crypto/inside-secure/safexcel.c @@ -1631,19 +1631,23 @@ static int safexcel_probe_generic(void * &priv->ring[i].rdr); if (ret) { dev_err(dev, "Failed to initialize rings\n"); - return ret; + goto err_cleanup_rings; }

priv->ring[i].rdr_req = devm_kcalloc(dev, EIP197_DEFAULT_RING_SIZE, sizeof(*priv->ring[i].rdr_req), GFP_KERNEL); - if (!priv->ring[i].rdr_req) - return -ENOMEM; + if (!priv->ring[i].rdr_req) { + ret = -ENOMEM; + goto err_cleanup_rings; + }

ring_irq = devm_kzalloc(dev, sizeof(*ring_irq), GFP_KERNEL); - if (!ring_irq) - return -ENOMEM; + if (!ring_irq) { + ret = -ENOMEM; + goto err_cleanup_rings; + }

ring_irq->priv = priv; ring_irq->ring = i; @@ -1657,7 +1661,8 @@ static int safexcel_probe_generic(void * ring_irq); if (irq < 0) { dev_err(dev, "Failed to get IRQ ID for ring %d\n", i); - return irq; + ret = irq; + goto err_cleanup_rings; }

priv->ring[i].irq = irq; @@ -1669,8 +1674,10 @@ static int safexcel_probe_generic(void * snprintf(wq_name, 9, "wq_ring%d", i); priv->ring[i].workqueue = create_singlethread_workqueue(wq_name); - if (!priv->ring[i].workqueue) - return -ENOMEM; + if (!priv->ring[i].workqueue) { + ret = -ENOMEM; + goto err_cleanup_rings; + }

priv->ring[i].requests = 0; priv->ring[i].busy = false; @@ -1687,16 +1694,26 @@ static int safexcel_probe_generic(void * ret = safexcel_hw_init(priv); if (ret) { dev_err(dev, "HW init failed (%d)\n", ret); - return ret; + goto err_cleanup_rings; }

ret = safexcel_register_algorithms(priv); if (ret) { dev_err(dev, "Failed to register algorithms (%d)\n", ret); - return ret; + goto err_cleanup_rings; }

return 0; + +err_cleanup_rings: + for (i = 0; i < priv->config.rings; i++) { + if (priv->ring[i].irq) + irq_set_affinity_hint(priv->ring[i].irq, NULL); + if (priv->ring[i].workqueue) + destroy_workqueue(priv->ring[i].workqueue); + } + + return ret; }

static void safexcel_hw_reset_rings(struct safexcel_crypto_priv *priv)

From: Mario Limonciello mario.limonciello@amd.com

commit c79a3169b9f3633c215b55857eba5921e5b49217 upstream.

A number of platforms are emitting the error: ```ccp: unable to access the device: you might be running a broken BIOS.```

This is expected behavior as CCP is no longer accessible from the PSP's PCIe BAR so stop trying to probe CCP for 0x1649.

Cc: stable@vger.kernel.org Signed-off-by: Mario Limonciello mario.limonciello@amd.com Acked-by: Tom Lendacky thomas.lendacky@amd.com Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/crypto/ccp/sp-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/crypto/ccp/sp-pci.c +++ b/drivers/crypto/ccp/sp-pci.c @@ -451,9 +451,9 @@ static const struct pci_device_id sp_pci { PCI_VDEVICE(AMD, 0x1468), (kernel_ulong_t)&dev_vdata[2] }, { PCI_VDEVICE(AMD, 0x1486), (kernel_ulong_t)&dev_vdata[3] }, { PCI_VDEVICE(AMD, 0x15DF), (kernel_ulong_t)&dev_vdata[4] }, - { PCI_VDEVICE(AMD, 0x1649), (kernel_ulong_t)&dev_vdata[4] }, { PCI_VDEVICE(AMD, 0x14CA), (kernel_ulong_t)&dev_vdata[5] }, { PCI_VDEVICE(AMD, 0x15C7), (kernel_ulong_t)&dev_vdata[6] }, + { PCI_VDEVICE(AMD, 0x1649), (kernel_ulong_t)&dev_vdata[6] }, /* Last entry must be zero */ { 0, } };

From: Roberto Sassu roberto.sassu@huawei.com

commit d82dcd9e21b77d338dc4875f3d4111f0db314a7c upstream.

Reiserfs sets a security xattr at inode creation time in two stages: first, it calls reiserfs_security_init() to obtain the xattr from active LSMs; then, it calls reiserfs_security_write() to actually write that xattr.

Unfortunately, it seems there is a wrong expectation that LSMs provide the full xattr name in the form 'security.<suffix>'. However, LSMs always provided just the suffix, causing reiserfs to not write the xattr at all (if the suffix is shorter than the prefix), or to write an xattr with the wrong name.

Add a temporary buffer in reiserfs_security_write(), and write to it the full xattr name, before passing it to reiserfs_xattr_set_handle().

Also replace the name length check with a check that the full xattr name is not larger than XATTR_NAME_MAX.

Cc: stable@vger.kernel.org # v2.6.x Fixes: 57fe60df6241 ("reiserfs: add atomic addition of selinux attributes during inode creation") Signed-off-by: Roberto Sassu roberto.sassu@huawei.com Signed-off-by: Paul Moore paul@paul-moore.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/reiserfs/xattr_security.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/fs/reiserfs/xattr_security.c +++ b/fs/reiserfs/xattr_security.c @@ -82,11 +82,15 @@ int reiserfs_security_write(struct reise struct inode *inode, struct reiserfs_security_handle *sec) { + char xattr_name[XATTR_NAME_MAX + 1] = XATTR_SECURITY_PREFIX; int error; - if (strlen(sec->name) < sizeof(XATTR_SECURITY_PREFIX)) + + if (XATTR_SECURITY_PREFIX_LEN + strlen(sec->name) > XATTR_NAME_MAX) return -EINVAL;

- error = reiserfs_xattr_set_handle(th, inode, sec->name, sec->value, + strlcat(xattr_name, sec->name, sizeof(xattr_name)); + + error = reiserfs_xattr_set_handle(th, inode, xattr_name, sec->value, sec->length, XATTR_CREATE); if (error == -ENODATA || error == -EOPNOTSUPP) error = 0;

From: Oliver Upton oliver.upton@linux.dev

commit 0acc7239c20a8401b8968c2adace8f7c9b0295ae upstream.

KVM/arm64 had the lock ordering backwards on vcpu->mutex and kvm->lock from the very beginning. One such example is the way vCPU resets are handled: the kvm->lock is acquired while handling a guest CPU_ON PSCI call.

Add a dedicated lock to serialize writes to kvm_vcpu_arch::{mp_state, reset_state}. Promote all accessors of mp_state to {READ,WRITE}_ONCE() as readers do not acquire the mp_state_lock. While at it, plug yet another race by taking the mp_state_lock in the KVM_SET_MP_STATE ioctl handler.

As changes to MP state are now guarded with a dedicated lock, drop the kvm->lock acquisition from the PSCI CPU_ON path. Similarly, move the reader of reset_state outside of the kvm->lock and instead protect it with the mp_state_lock. Note that writes to reset_state::reset have been demoted to regular stores as both readers and writers acquire the mp_state_lock.

While the kvm->lock inversion still exists in kvm_reset_vcpu(), at least now PSCI CPU_ON no longer depends on it for serializing vCPU reset.

Cc: stable@vger.kernel.org Tested-by: Jeremy Linton jeremy.linton@arm.com Signed-off-by: Oliver Upton oliver.upton@linux.dev Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230327164747.2466958-2-oliver.upton@linux.dev Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 31 ++++++++++++++++++++++--------- arch/arm64/kvm/psci.c | 28 ++++++++++++++++------------ arch/arm64/kvm/reset.c | 9 +++++---- 4 files changed, 44 insertions(+), 25 deletions(-)

--- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -398,6 +398,7 @@ struct kvm_vcpu_arch {

/* vcpu power state */ struct kvm_mp_state mp_state; + spinlock_t mp_state_lock;

/* Cache some mmu pages needed inside spinlock regions */ struct kvm_mmu_memory_cache mmu_page_cache; --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -324,6 +324,8 @@ int kvm_arch_vcpu_create(struct kvm_vcpu { int err;

+ spin_lock_init(&vcpu->arch.mp_state_lock); + /* Force users to call KVM_ARM_VCPU_INIT */ vcpu->arch.target = -1; bitmap_zero(vcpu->arch.features, KVM_VCPU_MAX_FEATURES); @@ -441,34 +443,41 @@ void kvm_arch_vcpu_put(struct kvm_vcpu * vcpu->cpu = -1; }

-void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu) +static void __kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu) { - vcpu->arch.mp_state.mp_state = KVM_MP_STATE_STOPPED; + WRITE_ONCE(vcpu->arch.mp_state.mp_state, KVM_MP_STATE_STOPPED); kvm_make_request(KVM_REQ_SLEEP, vcpu); kvm_vcpu_kick(vcpu); }

+void kvm_arm_vcpu_power_off(struct kvm_vcpu *vcpu) +{ + spin_lock(&vcpu->arch.mp_state_lock); + __kvm_arm_vcpu_power_off(vcpu); + spin_unlock(&vcpu->arch.mp_state_lock); +} + bool kvm_arm_vcpu_stopped(struct kvm_vcpu *vcpu) { - return vcpu->arch.mp_state.mp_state == KVM_MP_STATE_STOPPED; + return READ_ONCE(vcpu->arch.mp_state.mp_state) == KVM_MP_STATE_STOPPED; }

static void kvm_arm_vcpu_suspend(struct kvm_vcpu *vcpu) { - vcpu->arch.mp_state.mp_state = KVM_MP_STATE_SUSPENDED; + WRITE_ONCE(vcpu->arch.mp_state.mp_state, KVM_MP_STATE_SUSPENDED); kvm_make_request(KVM_REQ_SUSPEND, vcpu); kvm_vcpu_kick(vcpu); }

static bool kvm_arm_vcpu_suspended(struct kvm_vcpu *vcpu) { - return vcpu->arch.mp_state.mp_state == KVM_MP_STATE_SUSPENDED; + return READ_ONCE(vcpu->arch.mp_state.mp_state) == KVM_MP_STATE_SUSPENDED; }

int kvm_arch_vcpu_ioctl_get_mpstate(struct kvm_vcpu *vcpu, struct kvm_mp_state *mp_state) { - *mp_state = vcpu->arch.mp_state; + *mp_state = READ_ONCE(vcpu->arch.mp_state);

return 0; } @@ -478,12 +487,14 @@ int kvm_arch_vcpu_ioctl_set_mpstate(stru { int ret = 0;

+ spin_lock(&vcpu->arch.mp_state_lock); + switch (mp_state->mp_state) { case KVM_MP_STATE_RUNNABLE: - vcpu->arch.mp_state = *mp_state; + WRITE_ONCE(vcpu->arch.mp_state, *mp_state); break; case KVM_MP_STATE_STOPPED: - kvm_arm_vcpu_power_off(vcpu); + __kvm_arm_vcpu_power_off(vcpu); break; case KVM_MP_STATE_SUSPENDED: kvm_arm_vcpu_suspend(vcpu); @@ -492,6 +503,8 @@ int kvm_arch_vcpu_ioctl_set_mpstate(stru ret = -EINVAL; }

+ spin_unlock(&vcpu->arch.mp_state_lock); + return ret; }

@@ -1202,7 +1215,7 @@ static int kvm_arch_vcpu_ioctl_vcpu_init if (test_bit(KVM_ARM_VCPU_POWER_OFF, vcpu->arch.features)) kvm_arm_vcpu_power_off(vcpu); else - vcpu->arch.mp_state.mp_state = KVM_MP_STATE_RUNNABLE; + WRITE_ONCE(vcpu->arch.mp_state.mp_state, KVM_MP_STATE_RUNNABLE);

return 0; } --- a/arch/arm64/kvm/psci.c +++ b/arch/arm64/kvm/psci.c @@ -62,6 +62,7 @@ static unsigned long kvm_psci_vcpu_on(st struct vcpu_reset_state *reset_state; struct kvm *kvm = source_vcpu->kvm; struct kvm_vcpu *vcpu = NULL; + int ret = PSCI_RET_SUCCESS; unsigned long cpu_id;

cpu_id = smccc_get_arg1(source_vcpu); @@ -76,11 +77,15 @@ static unsigned long kvm_psci_vcpu_on(st */ if (!vcpu) return PSCI_RET_INVALID_PARAMS; + + spin_lock(&vcpu->arch.mp_state_lock); if (!kvm_arm_vcpu_stopped(vcpu)) { if (kvm_psci_version(source_vcpu) != KVM_ARM_PSCI_0_1) - return PSCI_RET_ALREADY_ON; + ret = PSCI_RET_ALREADY_ON; else - return PSCI_RET_INVALID_PARAMS; + ret = PSCI_RET_INVALID_PARAMS; + + goto out_unlock; }

reset_state = &vcpu->arch.reset_state; @@ -96,7 +101,7 @@ static unsigned long kvm_psci_vcpu_on(st */ reset_state->r0 = smccc_get_arg3(source_vcpu);

- WRITE_ONCE(reset_state->reset, true); + reset_state->reset = true; kvm_make_request(KVM_REQ_VCPU_RESET, vcpu);

/* @@ -108,7 +113,9 @@ static unsigned long kvm_psci_vcpu_on(st vcpu->arch.mp_state.mp_state = KVM_MP_STATE_RUNNABLE; kvm_vcpu_wake_up(vcpu);

- return PSCI_RET_SUCCESS; +out_unlock: + spin_unlock(&vcpu->arch.mp_state_lock); + return ret; }

static unsigned long kvm_psci_vcpu_affinity_info(struct kvm_vcpu *vcpu) @@ -168,8 +175,11 @@ static void kvm_prepare_system_event(str * after this call is handled and before the VCPUs have been * re-initialized. */ - kvm_for_each_vcpu(i, tmp, vcpu->kvm) - tmp->arch.mp_state.mp_state = KVM_MP_STATE_STOPPED; + kvm_for_each_vcpu(i, tmp, vcpu->kvm) { + spin_lock(&tmp->arch.mp_state_lock); + WRITE_ONCE(tmp->arch.mp_state.mp_state, KVM_MP_STATE_STOPPED); + spin_unlock(&tmp->arch.mp_state_lock); + } kvm_make_all_cpus_request(vcpu->kvm, KVM_REQ_SLEEP);

memset(&vcpu->run->system_event, 0, sizeof(vcpu->run->system_event)); @@ -229,7 +239,6 @@ static unsigned long kvm_psci_check_allo

static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu) { - struct kvm *kvm = vcpu->kvm; u32 psci_fn = smccc_get_function(vcpu); unsigned long val; int ret = 1; @@ -254,9 +263,7 @@ static int kvm_psci_0_2_call(struct kvm_ kvm_psci_narrow_to_32bit(vcpu); fallthrough; case PSCI_0_2_FN64_CPU_ON: - mutex_lock(&kvm->lock); val = kvm_psci_vcpu_on(vcpu); - mutex_unlock(&kvm->lock); break; case PSCI_0_2_FN_AFFINITY_INFO: kvm_psci_narrow_to_32bit(vcpu); @@ -395,7 +402,6 @@ static int kvm_psci_1_x_call(struct kvm_

static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu) { - struct kvm *kvm = vcpu->kvm; u32 psci_fn = smccc_get_function(vcpu); unsigned long val;

@@ -405,9 +411,7 @@ static int kvm_psci_0_1_call(struct kvm_ val = PSCI_RET_SUCCESS; break; case KVM_PSCI_FN_CPU_ON: - mutex_lock(&kvm->lock); val = kvm_psci_vcpu_on(vcpu); - mutex_unlock(&kvm->lock); break; default: val = PSCI_RET_NOT_SUPPORTED; --- a/arch/arm64/kvm/reset.c +++ b/arch/arm64/kvm/reset.c @@ -255,15 +255,16 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu

mutex_lock(&vcpu->kvm->lock); ret = kvm_set_vm_width(vcpu); - if (!ret) { - reset_state = vcpu->arch.reset_state; - WRITE_ONCE(vcpu->arch.reset_state.reset, false); - } mutex_unlock(&vcpu->kvm->lock);

if (ret) return ret;

+ spin_lock(&vcpu->arch.mp_state_lock); + reset_state = vcpu->arch.reset_state; + vcpu->arch.reset_state.reset = false; + spin_unlock(&vcpu->arch.mp_state_lock); + /* Reset PMU outside of the non-preemptible section */ kvm_pmu_vcpu_reset(vcpu);

From: Oliver Upton oliver.upton@linux.dev

commit 4bba7f7def6f278266dadf845da472cfbfed784e upstream.

There are various bits of VM-scoped data that can only be configured before the first call to KVM_RUN, such as the hypercall bitmaps and the PMU. As these fields are protected by the kvm->lock and accessed while holding vcpu->mutex, this is yet another example of lock inversion.

Change out the kvm->lock for kvm->arch.config_lock in all of these instances. Opportunistically simplify the locking mechanics of the PMU configuration by holding the config_lock for the entirety of kvm_arm_pmu_v3_set_attr().

Note that this also addresses a couple of bugs. There is an unguarded read of the PMU version in KVM_ARM_VCPU_PMU_V3_FILTER which could race with KVM_ARM_VCPU_PMU_V3_SET_PMU. Additionally, until now writes to the per-vCPU vPMU irq were not serialized VM-wide, meaning concurrent calls to KVM_ARM_VCPU_PMU_V3_IRQ could lead to a false positive in pmu_irq_is_valid().

Cc: stable@vger.kernel.org Tested-by: Jeremy Linton jeremy.linton@arm.com Signed-off-by: Oliver Upton oliver.upton@linux.dev Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230327164747.2466958-4-oliver.upton@linux.dev Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm64/kvm/arm.c | 4 ++-- arch/arm64/kvm/guest.c | 2 ++ arch/arm64/kvm/hypercalls.c | 4 ++-- arch/arm64/kvm/pmu-emul.c | 23 ++++++----------------- 4 files changed, 12 insertions(+), 21 deletions(-)

--- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -616,9 +616,9 @@ int kvm_arch_vcpu_run_pid_change(struct if (kvm_vm_is_protected(kvm)) kvm_call_hyp_nvhe(__pkvm_vcpu_init_traps, vcpu);

- mutex_lock(&kvm->lock); + mutex_lock(&kvm->arch.config_lock); set_bit(KVM_ARCH_FLAG_HAS_RAN_ONCE, &kvm->arch.flags); - mutex_unlock(&kvm->lock); + mutex_unlock(&kvm->arch.config_lock);

return ret; } --- a/arch/arm64/kvm/guest.c +++ b/arch/arm64/kvm/guest.c @@ -951,7 +951,9 @@ int kvm_arm_vcpu_arch_set_attr(struct kv

switch (attr->group) { case KVM_ARM_VCPU_PMU_V3_CTRL: + mutex_lock(&vcpu->kvm->arch.config_lock); ret = kvm_arm_pmu_v3_set_attr(vcpu, attr); + mutex_unlock(&vcpu->kvm->arch.config_lock); break; case KVM_ARM_VCPU_TIMER_CTRL: ret = kvm_arm_timer_set_attr(vcpu, attr); --- a/arch/arm64/kvm/hypercalls.c +++ b/arch/arm64/kvm/hypercalls.c @@ -377,7 +377,7 @@ static int kvm_arm_set_fw_reg_bmap(struc if (val & ~fw_reg_features) return -EINVAL;

- mutex_lock(&kvm->lock); + mutex_lock(&kvm->arch.config_lock);

if (test_bit(KVM_ARCH_FLAG_HAS_RAN_ONCE, &kvm->arch.flags) && val != *fw_reg_bmap) { @@ -387,7 +387,7 @@ static int kvm_arm_set_fw_reg_bmap(struc

WRITE_ONCE(*fw_reg_bmap, val); out: - mutex_unlock(&kvm->lock); + mutex_unlock(&kvm->arch.config_lock); return ret; }

--- a/arch/arm64/kvm/pmu-emul.c +++ b/arch/arm64/kvm/pmu-emul.c @@ -850,7 +850,7 @@ static int kvm_arm_pmu_v3_set_pmu(struct struct arm_pmu *arm_pmu; int ret = -ENXIO;

- mutex_lock(&kvm->lock); + lockdep_assert_held(&kvm->arch.config_lock); mutex_lock(&arm_pmus_lock);

list_for_each_entry(entry, &arm_pmus, entry) { @@ -870,7 +870,6 @@ static int kvm_arm_pmu_v3_set_pmu(struct }

mutex_unlock(&arm_pmus_lock); - mutex_unlock(&kvm->lock); return ret; }

@@ -878,22 +877,20 @@ int kvm_arm_pmu_v3_set_attr(struct kvm_v { struct kvm *kvm = vcpu->kvm;

+ lockdep_assert_held(&kvm->arch.config_lock); + if (!kvm_vcpu_has_pmu(vcpu)) return -ENODEV;

if (vcpu->arch.pmu.created) return -EBUSY;

- mutex_lock(&kvm->lock); if (!kvm->arch.arm_pmu) { /* No PMU set, get the default one */ kvm->arch.arm_pmu = kvm_pmu_probe_armpmu(); - if (!kvm->arch.arm_pmu) { - mutex_unlock(&kvm->lock); + if (!kvm->arch.arm_pmu) return -ENODEV; - } } - mutex_unlock(&kvm->lock);

switch (attr->attr) { case KVM_ARM_VCPU_PMU_V3_IRQ: { @@ -937,19 +934,13 @@ int kvm_arm_pmu_v3_set_attr(struct kvm_v filter.action != KVM_PMU_EVENT_DENY)) return -EINVAL;

- mutex_lock(&kvm->lock); - - if (test_bit(KVM_ARCH_FLAG_HAS_RAN_ONCE, &kvm->arch.flags)) { - mutex_unlock(&kvm->lock); + if (test_bit(KVM_ARCH_FLAG_HAS_RAN_ONCE, &kvm->arch.flags)) return -EBUSY; - }

if (!kvm->arch.pmu_filter) { kvm->arch.pmu_filter = bitmap_alloc(nr_events, GFP_KERNEL_ACCOUNT); - if (!kvm->arch.pmu_filter) { - mutex_unlock(&kvm->lock); + if (!kvm->arch.pmu_filter) return -ENOMEM; - }

/* * The default depends on the first applied filter. @@ -968,8 +959,6 @@ int kvm_arm_pmu_v3_set_attr(struct kvm_v else bitmap_clear(kvm->arch.pmu_filter, filter.base_event, filter.nevents);

- mutex_unlock(&kvm->lock); - return 0; } case KVM_ARM_VCPU_PMU_V3_SET_PMU: {

From: Oliver Upton oliver.upton@linux.dev

commit 49e5d16b6fc003407a33a9961b4bcbb970bd1c76 upstream.

commit f00327731131 ("KVM: arm64: Use config_lock to protect vgic state") was meant to rectify a longstanding lock ordering issue in KVM where the kvm->lock is taken while holding vcpu->mutex. As it so happens, the aforementioned commit introduced yet another locking issue by acquiring the its_lock before acquiring the config lock.

This is obviously wrong, especially considering that the lock ordering is well documented in vgic.c. Reshuffle the locks once more to take the config_lock before the its_lock. While at it, sprinkle in the lockdep hinting that has become popular as of late to keep lockdep apprised of our ordering.

Cc: stable@vger.kernel.org Fixes: f00327731131 ("KVM: arm64: Use config_lock to protect vgic state") Signed-off-by: Oliver Upton oliver.upton@linux.dev Signed-off-by: Marc Zyngier maz@kernel.org Link: https://lore.kernel.org/r/20230412062733.988229-1-oliver.upton@linux.dev Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/arm64/kvm/vgic/vgic-its.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)

--- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -1958,6 +1958,16 @@ static int vgic_its_create(struct kvm_de mutex_init(&its->its_lock); mutex_init(&its->cmd_lock);

+ /* Yep, even more trickery for lock ordering... */ +#ifdef CONFIG_LOCKDEP + mutex_lock(&dev->kvm->arch.config_lock); + mutex_lock(&its->cmd_lock); + mutex_lock(&its->its_lock); + mutex_unlock(&its->its_lock); + mutex_unlock(&its->cmd_lock); + mutex_unlock(&dev->kvm->arch.config_lock); +#endif + its->vgic_its_base = VGIC_ADDR_UNDEF;

INIT_LIST_HEAD(&its->device_list); @@ -2752,15 +2762,14 @@ static int vgic_its_ctrl(struct kvm *kvm return 0;

mutex_lock(&kvm->lock); - mutex_lock(&its->its_lock);

if (!lock_all_vcpus(kvm)) { - mutex_unlock(&its->its_lock); mutex_unlock(&kvm->lock); return -EBUSY; }

mutex_lock(&kvm->arch.config_lock); + mutex_lock(&its->its_lock);

switch (attr) { case KVM_DEV_ARM_ITS_CTRL_RESET: @@ -2774,9 +2783,9 @@ static int vgic_its_ctrl(struct kvm *kvm break; }

+ mutex_unlock(&its->its_lock); mutex_unlock(&kvm->arch.config_lock); unlock_all_vcpus(kvm); - mutex_unlock(&its->its_lock); mutex_unlock(&kvm->lock); return ret; }

From: Nasir Osman nasir.osman@amd.com

[ Upstream commit 71c4ca2d3b079d0ba4d9b3033641fea906cebfb6 ]

[why] Newer ASICs such as DCN314 needs to allow for both self refresh and mem clk switching rather than just self refresh only. Otherwise, we can see some p-state hangs on ASICs that do support mem clk switching.

[how] Added an allow_self_refresh_only flag for dcn30_internal_validate_bw and created a validate_bw method for DCN314 with the allow_self_refresh_only flag set to false (to support mem clk switching).

Reviewed-by: Nicholas Kazlauskas Nicholas.Kazlauskas@amd.com Acked-by: Qingqing Zhuo qingqing.zhuo@amd.com Signed-off-by: Nasir Osman nasir.osman@amd.com Tested-by: Daniel Wheeler daniel.wheeler@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Stable-dep-of: 1e994cc0956b ("drm/amd/display: limit timing for single dimm memory") Signed-off-by: Sasha Levin sashal@kernel.org --- .../drm/amd/display/dc/dcn30/dcn30_resource.c | 16 +++--- .../drm/amd/display/dc/dcn30/dcn30_resource.h | 3 +- .../drm/amd/display/dc/dcn31/dcn31_resource.c | 2 +- .../amd/display/dc/dcn314/dcn314_resource.c | 57 ++++++++++++++++++- .../amd/display/dc/dcn314/dcn314_resource.h | 4 ++ .../drm/amd/display/dc/dml/dcn30/dcn30_fpu.c | 2 +- 6 files changed, 73 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c index 020f512e9690e..e958f838c8041 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c @@ -1641,7 +1641,8 @@ noinline bool dcn30_internal_validate_bw( display_e2e_pipe_params_st *pipes, int *pipe_cnt_out, int *vlevel_out, - bool fast_validate) + bool fast_validate, + bool allow_self_refresh_only) { bool out = false; bool repopulate_pipes = false; @@ -1668,7 +1669,7 @@ noinline bool dcn30_internal_validate_bw(

dml_log_pipe_params(&context->bw_ctx.dml, pipes, pipe_cnt);

- if (!fast_validate) { + if (!fast_validate || !allow_self_refresh_only) { /* * DML favors voltage over p-state, but we're more interested in * supporting p-state over voltage. We can't support p-state in @@ -1681,11 +1682,12 @@ noinline bool dcn30_internal_validate_bw( if (vlevel < context->bw_ctx.dml.soc.num_states) vlevel = dcn20_validate_apply_pipe_split_flags(dc, context, vlevel, split, merge); } - if (fast_validate || vlevel == context->bw_ctx.dml.soc.num_states || - vba->DRAMClockChangeSupport[vlevel][vba->maxMpcComb] == dm_dram_clock_change_unsupported) { + if (allow_self_refresh_only && + (fast_validate || vlevel == context->bw_ctx.dml.soc.num_states || + vba->DRAMClockChangeSupport[vlevel][vba->maxMpcComb] == dm_dram_clock_change_unsupported)) { /* - * If mode is unsupported or there's still no p-state support then - * fall back to favoring voltage. + * If mode is unsupported or there's still no p-state support + * then fall back to favoring voltage. * * We don't actually support prefetch mode 2, so require that we * at least support prefetch mode 1. @@ -2056,7 +2058,7 @@ bool dcn30_validate_bandwidth(struct dc *dc, BW_VAL_TRACE_COUNT();

DC_FP_START(); - out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate); + out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, true); DC_FP_END();

if (pipe_cnt == 0) diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.h b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.h index 7d063c7d6a4bf..8e6b8b7368fdb 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.h +++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.h @@ -64,7 +64,8 @@ bool dcn30_internal_validate_bw( display_e2e_pipe_params_st *pipes, int *pipe_cnt_out, int *vlevel_out, - bool fast_validate); + bool fast_validate, + bool allow_self_refresh_only); void dcn30_calculate_wm_and_dlg( struct dc *dc, struct dc_state *context, display_e2e_pipe_params_st *pipes, diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c index fddc21a5a04c4..d825f11b4feaa 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c @@ -1770,7 +1770,7 @@ bool dcn31_validate_bandwidth(struct dc *dc, BW_VAL_TRACE_COUNT();

DC_FP_START(); - out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate); + out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, true); DC_FP_END();

// Disable fast_validate to set min dcfclk in alculate_wm_and_dlg diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c index 9918bccd6defb..2f9c6d64b98bc 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c @@ -1689,6 +1689,61 @@ static void dcn314_get_panel_config_defaults(struct dc_panel_config *panel_confi *panel_config = panel_config_defaults; }

+bool dcn314_validate_bandwidth(struct dc *dc, + struct dc_state *context, + bool fast_validate) +{ + bool out = false; + + BW_VAL_TRACE_SETUP(); + + int vlevel = 0; + int pipe_cnt = 0; + display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_KERNEL); + DC_LOGGER_INIT(dc->ctx->logger); + + BW_VAL_TRACE_COUNT(); + + DC_FP_START(); + // do not support self refresh only + out = dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, fast_validate, false); + DC_FP_END(); + + // Disable fast_validate to set min dcfclk in calculate_wm_and_dlg + if (pipe_cnt == 0) + fast_validate = false; + + if (!out) + goto validate_fail; + + BW_VAL_TRACE_END_VOLTAGE_LEVEL(); + + if (fast_validate) { + BW_VAL_TRACE_SKIP(fast); + goto validate_out; + } + + dc->res_pool->funcs->calculate_wm_and_dlg(dc, context, pipes, pipe_cnt, vlevel); + + BW_VAL_TRACE_END_WATERMARKS(); + + goto validate_out; + +validate_fail: + DC_LOG_WARNING("Mode Validation Warning: %s failed validation.\n", + dml_get_status_message(context->bw_ctx.dml.vba.ValidationStatus[context->bw_ctx.dml.vba.soc.num_states])); + + BW_VAL_TRACE_SKIP(fail); + out = false; + +validate_out: + kfree(pipes); + + BW_VAL_TRACE_FINISH(); + + return out; +} + static struct resource_funcs dcn314_res_pool_funcs = { .destroy = dcn314_destroy_resource_pool, .link_enc_create = dcn31_link_encoder_create, @@ -1696,7 +1751,7 @@ static struct resource_funcs dcn314_res_pool_funcs = { .link_encs_assign = link_enc_cfg_link_encs_assign, .link_enc_unassign = link_enc_cfg_link_enc_unassign, .panel_cntl_create = dcn31_panel_cntl_create, - .validate_bandwidth = dcn31_validate_bandwidth, + .validate_bandwidth = dcn314_validate_bandwidth, .calculate_wm_and_dlg = dcn31_calculate_wm_and_dlg, .update_soc_for_wm_a = dcn31_update_soc_for_wm_a, .populate_dml_pipes = dcn314_populate_dml_pipes_from_context, diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.h b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.h index 0dd3153aa5c17..49ffe71018dfb 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.h +++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.h @@ -39,6 +39,10 @@ struct dcn314_resource_pool { struct resource_pool base; };

+bool dcn314_validate_bandwidth(struct dc *dc, + struct dc_state *context, + bool fast_validate); + struct resource_pool *dcn314_create_resource_pool( const struct dc_init_data *init_data, struct dc *dc); diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c index e1e92daba6686..990dbd736e2ce 100644 --- a/drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c +++ b/drivers/gpu/drm/amd/display/dc/dml/dcn30/dcn30_fpu.c @@ -636,7 +636,7 @@ int dcn30_find_dummy_latency_index_for_fw_based_mclk_switch(struct dc *dc, while (dummy_latency_index < max_latency_table_entries) { context->bw_ctx.dml.soc.dram_clock_change_latency_us = dc->clk_mgr->bw_params->dummy_pstate_table[dummy_latency_index].dummy_pstate_latency_us; - dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, false); + dcn30_internal_validate_bw(dc, context, pipes, &pipe_cnt, &vlevel, false, true);

if (context->bw_ctx.dml.soc.allow_dram_self_refresh_or_dram_clock_change_in_vblank == dm_allow_self_refresh_and_mclk_switch)

From: Hamza Mahfooz hamza.mahfooz@amd.com

[ Upstream commit 13b90cf900ab69dd5cab3cc5035bc7614037e64e ]

Currently, there are issues with enabling PSR-SU + DSC. This stems from the fact that DSC imposes a slice height on transmitted video data and we are not conforming to that slice height in PSR-SU regions. So, pass slice_height into su_y_granularity to feed the DSC slice height into PSR-SU code.

Acked-by: Harry Wentland harry.wentland@amd.com Signed-off-by: Hamza Mahfooz hamza.mahfooz@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Stable-dep-of: 0b5dfe12755f ("drm/amd/display: fix a divided-by-zero error") Signed-off-by: Sasha Levin sashal@kernel.org --- .../drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c | 3 ++ .../amd/display/modules/power/power_helpers.c | 31 +++++++++++++++++++ .../amd/display/modules/power/power_helpers.h | 3 ++ 3 files changed, 37 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c index 26291db0a3cf6..872d06fe14364 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_psr.c @@ -122,6 +122,9 @@ bool amdgpu_dm_link_setup_psr(struct dc_stream_state *stream) psr_config.allow_multi_disp_optimizations = (amdgpu_dc_feature_mask & DC_PSR_ALLOW_MULTI_DISP_OPT);

+ if (!psr_su_set_y_granularity(dc, link, stream, &psr_config)) + return false; + ret = dc_link_setup_psr(link, stream, &psr_config, &psr_context);

} diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c index 235259d6c5a16..01fc6a368d2e3 100644 --- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c +++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c @@ -907,3 +907,34 @@ bool mod_power_only_edp(const struct dc_state *context, const struct dc_stream_s { return context && context->stream_count == 1 && dc_is_embedded_signal(stream->signal); } + +bool psr_su_set_y_granularity(struct dc *dc, struct dc_link *link, + struct dc_stream_state *stream, + struct psr_config *config) +{ + uint16_t pic_height; + uint8_t slice_height; + + if ((link->connector_signal & SIGNAL_TYPE_EDP) && + (!dc->caps.edp_dsc_support || + link->panel_config.dsc.disable_dsc_edp || + !link->dpcd_caps.dsc_caps.dsc_basic_caps.fields.dsc_support.DSC_SUPPORT || + !stream->timing.dsc_cfg.num_slices_v)) + return true; + + pic_height = stream->timing.v_addressable + + stream->timing.v_border_top + stream->timing.v_border_bottom; + slice_height = pic_height / stream->timing.dsc_cfg.num_slices_v; + + if (slice_height) { + if (config->su_y_granularity && + (slice_height % config->su_y_granularity)) { + ASSERT(0); + return false; + } + + config->su_y_granularity = slice_height; + } + + return true; +} diff --git a/drivers/gpu/drm/amd/display/modules/power/power_helpers.h b/drivers/gpu/drm/amd/display/modules/power/power_helpers.h index 316452e9dbc91..bb16b37b83da7 100644 --- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.h +++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.h @@ -59,4 +59,7 @@ void mod_power_calc_psr_configs(struct psr_config *psr_config, const struct dc_stream_state *stream); bool mod_power_only_edp(const struct dc_state *context, const struct dc_stream_state *stream); +bool psr_su_set_y_granularity(struct dc *dc, struct dc_link *link, + struct dc_stream_state *stream, + struct psr_config *config); #endif /* MODULES_POWER_POWER_HELPERS_H_ */

From: David Matlack dmatlack@google.com

commit 2ed90cb0938a45b12eb947af062d12c7af0067b3 upstream.

Read mmu_invalidate_seq before dropping the mmap_lock so that KVM can detect if the results of vma_lookup() (e.g. vma_shift) become stale before it acquires kvm->mmu_lock. This fixes a theoretical bug where a VMA could be changed by userspace after vma_lookup() and before KVM reads the mmu_invalidate_seq, causing KVM to install page table entries based on a (possibly) no-longer-valid vma_shift.

Re-order the MMU cache top-up to earlier in user_mem_abort() so that it is not done after KVM has read mmu_invalidate_seq (i.e. so as to avoid inducing spurious fault retries).

It's unlikely that any sane userspace currently modifies VMAs in such a way as to trigger this race. And even with directed testing I was unable to reproduce it. But a sufficiently motivated host userspace might be able to exploit this race.

Note KVM/ARM had the same bug and was fixed in a separate, near identical patch (see Link).

Link: https://lore.kernel.org/kvm/20230313235454.2964067-1-dmatlack@google.com/ Fixes: 9955371cc014 ("RISC-V: KVM: Implement MMU notifiers") Cc: stable@vger.kernel.org Signed-off-by: David Matlack dmatlack@google.com Tested-by: Anup Patel anup@brainfault.org Signed-off-by: Anup Patel anup@brainfault.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/kvm/mmu.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)

--- a/arch/riscv/kvm/mmu.c +++ b/arch/riscv/kvm/mmu.c @@ -630,6 +630,13 @@ int kvm_riscv_gstage_map(struct kvm_vcpu !(memslot->flags & KVM_MEM_READONLY)) ? true : false; unsigned long vma_pagesize, mmu_seq;

+ /* We need minimum second+third level pages */ + ret = kvm_mmu_topup_memory_cache(pcache, gstage_pgd_levels); + if (ret) { + kvm_err("Failed to topup G-stage cache\n"); + return ret; + } + mmap_read_lock(current->mm);

vma = find_vma_intersection(current->mm, hva, hva + 1); @@ -650,6 +657,15 @@ int kvm_riscv_gstage_map(struct kvm_vcpu if (vma_pagesize == PMD_SIZE || vma_pagesize == PGDIR_SIZE) gfn = (gpa & huge_page_mask(hstate_vma(vma))) >> PAGE_SHIFT;

+ /* + * Read mmu_invalidate_seq so that KVM can detect if the results of + * vma_lookup() or gfn_to_pfn_prot() become stale priort to acquiring + * kvm->mmu_lock. + * + * Rely on mmap_read_unlock() for an implicit smp_rmb(), which pairs + * with the smp_wmb() in kvm_mmu_invalidate_end(). + */ + mmu_seq = kvm->mmu_invalidate_seq; mmap_read_unlock(current->mm);

if (vma_pagesize != PGDIR_SIZE && @@ -659,15 +675,6 @@ int kvm_riscv_gstage_map(struct kvm_vcpu return -EFAULT; }

- /* We need minimum second+third level pages */ - ret = kvm_mmu_topup_memory_cache(pcache, gstage_pgd_levels); - if (ret) { - kvm_err("Failed to topup G-stage cache\n"); - return ret; - } - - mmu_seq = kvm->mmu_invalidate_seq; - hfn = gfn_to_pfn_prot(kvm, gfn, is_write, &writable); if (hfn == KVM_PFN_ERR_HWPOISON) { send_sig_mceerr(BUS_MCEERR_AR, (void __user *)hva,

From: Namjae Jeon linkinjeon@kernel.org

commit eb307d09fe15844fdaebeb8cc8c9b9e925430aa5 upstream.

racy issue is triggered the bug by racing between closing a connection and rmmod. In ksmbd, rcu_barrier() is not called at module unload time, so nothing prevents ksmbd from getting unloaded while it still has RCU callbacks pending. It leads to trigger unintended execution of kernel code locally and use to defeat protections such as Kernel Lockdown

Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20477 Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ksmbd/server.c | 1 + 1 file changed, 1 insertion(+)

--- a/fs/ksmbd/server.c +++ b/fs/ksmbd/server.c @@ -614,6 +614,7 @@ err_unregister: static void __exit ksmbd_server_exit(void) { ksmbd_server_shutdown(); + rcu_barrier(); ksmbd_release_inode_hash(); }

From: Namjae Jeon linkinjeon@kernel.org

commit 6d7cb549c2ca20e1f07593f15e936fd54b763028 upstream.

If client send session setup request with unknown NTLMSSP message type, session that does not included channel can be created. It will cause session memleak. because ksmbd_sessions_deregister() does not destroy session if channel is not included. This patch return error response if client send the request unknown NTLMSSP message type.

Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20593 Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+)

--- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1799,6 +1799,10 @@ int smb2_sess_setup(struct ksmbd_work *w } kfree(sess->Preauth_HashValue); sess->Preauth_HashValue = NULL; + } else { + pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n", + le32_to_cpu(negblob->MessageType)); + rc = -EINVAL; } } else { /* TODO: need one more negotiation */

From: Namjae Jeon linkinjeon@kernel.org

commit 7b4323373d844954bb76e0e9f39c4e5fc785fa7b upstream.

Deadlock is triggered by sending multiple concurrent session setup requests. It should be reused after releasing when getting ctx for crypto. Multiple consecutive ctx uses cause deadlock while waiting for releasing due to the limited number of ctx.

Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-20591 Signed-off-by: Namjae Jeon linkinjeon@kernel.org Signed-off-by: Steve French stfrench@microsoft.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ksmbd/auth.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)

--- a/fs/ksmbd/auth.c +++ b/fs/ksmbd/auth.c @@ -221,22 +221,22 @@ int ksmbd_auth_ntlmv2(struct ksmbd_conn { char ntlmv2_hash[CIFS_ENCPWD_SIZE]; char ntlmv2_rsp[CIFS_HMAC_MD5_HASH_SIZE]; - struct ksmbd_crypto_ctx *ctx; + struct ksmbd_crypto_ctx *ctx = NULL; char *construct = NULL; int rc, len;

- ctx = ksmbd_crypto_ctx_find_hmacmd5(); - if (!ctx) { - ksmbd_debug(AUTH, "could not crypto alloc hmacmd5\n"); - return -ENOMEM; - } - rc = calc_ntlmv2_hash(conn, sess, ntlmv2_hash, domain_name); if (rc) { ksmbd_debug(AUTH, "could not get v2 hash rc %d\n", rc); goto out; }

+ ctx = ksmbd_crypto_ctx_find_hmacmd5(); + if (!ctx) { + ksmbd_debug(AUTH, "could not crypto alloc hmacmd5\n"); + return -ENOMEM; + } + rc = crypto_shash_setkey(CRYPTO_HMACMD5_TFM(ctx), ntlmv2_hash, CIFS_HMAC_MD5_HASH_SIZE); @@ -272,6 +272,8 @@ int ksmbd_auth_ntlmv2(struct ksmbd_conn ksmbd_debug(AUTH, "Could not generate md5 hash\n"); goto out; } + ksmbd_release_crypto_ctx(ctx); + ctx = NULL;

rc = ksmbd_gen_sess_key(sess, ntlmv2_hash, ntlmv2_rsp); if (rc) { @@ -282,7 +284,8 @@ int ksmbd_auth_ntlmv2(struct ksmbd_conn if (memcmp(ntlmv2->ntlmv2_hash, ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE) != 0) rc = -EINVAL; out: - ksmbd_release_crypto_ctx(ctx); + if (ctx) + ksmbd_release_crypto_ctx(ctx); kfree(construct); return rc; }

From: Reid Tonking reidt@ti.com

commit c770657bd2611b077ec1e7b1fe6aa92f249399bd upstream.

Using standard mode, rare false ACK responses were appearing with i2cdetect tool. This was happening due to NACK interrupt triggering ISR thread before register access interrupt was ready. Removing the NACK interrupt's ability to trigger ISR thread lets register access ready interrupt do this instead.

Cc: stable@vger.kernel.org # v3.7+ Fixes: 3b2f8f82dad7 ("i2c: omap: switch to threaded IRQ support") Signed-off-by: Reid Tonking reidt@ti.com Acked-by: Vignesh Raghavendra vigneshr@ti.com Reviewed-by: Tony Lindgren tony@atomide.com Signed-off-by: Wolfram Sang wsa@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/i2c/busses/i2c-omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/i2c/busses/i2c-omap.c +++ b/drivers/i2c/busses/i2c-omap.c @@ -1058,7 +1058,7 @@ omap_i2c_isr(int irq, void *dev_id) u16 stat;

stat = omap_i2c_read_reg(omap, OMAP_I2C_STAT_REG); - mask = omap_i2c_read_reg(omap, OMAP_I2C_IE_REG); + mask = omap_i2c_read_reg(omap, OMAP_I2C_IE_REG) & ~OMAP_I2C_STAT_NACK;

if (stat & mask) ret = IRQ_WAKE_THREAD;

From: Ondrej Mosnacek omosnace@redhat.com

commit 4f94559f40ad06d627c0fdfc3319cec778a2845b upstream.

This file defines both read and write operations, yet it is being created as read-only. This means that it can't be written to without the CAP_DAC_OVERRIDE capability. Fix the permissions to allow root to write to it without the need to override DAC perms.

Link: https://lore.kernel.org/linux-trace-kernel/20230503140114.3280002-1-omosnace...

Cc: stable@vger.kernel.org Cc: Masami Hiramatsu mhiramat@kernel.org Fixes: 03329f993978 ("tracing: Add tracefs file buffer_percentage") Signed-off-by: Ondrej Mosnacek omosnace@redhat.com Signed-off-by: Steven Rostedt (Google) rostedt@goodmis.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -9619,7 +9619,7 @@ init_tracer_tracefs(struct trace_array *

tr->buffer_percent = 50;

- trace_create_file("buffer_percent", TRACE_MODE_READ, d_tracer, + trace_create_file("buffer_percent", TRACE_MODE_WRITE, d_tracer, tr, &buffer_percent_fops);

create_trace_options_dir(tr);

From: Tim Huang tim.huang@amd.com

commit f7f28f268b861c29dd18086bb636abedf0ff59ff upstream.

If the gfx imu is poweroff when suspend, then it need to be re-enabled when resume.

Signed-off-by: Tim Huang tim.huang@amd.com Reviewed-by: Yifan Zhang yifan1.zhang@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 40 +++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 12 deletions(-)

--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -161,10 +161,15 @@ int smu_get_dpm_freq_range(struct smu_co

int smu_set_gfx_power_up_by_imu(struct smu_context *smu) { - if (!smu->ppt_funcs || !smu->ppt_funcs->set_gfx_power_up_by_imu) - return -EOPNOTSUPP; + int ret = 0; + struct amdgpu_device *adev = smu->adev;

- return smu->ppt_funcs->set_gfx_power_up_by_imu(smu); + if (smu->ppt_funcs->set_gfx_power_up_by_imu) { + ret = smu->ppt_funcs->set_gfx_power_up_by_imu(smu); + if (ret) + dev_err(adev->dev, "Failed to enable gfx imu!\n"); + } + return ret; }

static u32 smu_get_mclk(void *handle, bool low) @@ -195,6 +200,19 @@ static u32 smu_get_sclk(void *handle, bo return clk_freq * 100; }

+static int smu_set_gfx_imu_enable(struct smu_context *smu) +{ + struct amdgpu_device *adev = smu->adev; + + if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) + return 0; + + if (amdgpu_in_reset(smu->adev) || adev->in_s0ix) + return 0; + + return smu_set_gfx_power_up_by_imu(smu); +} + static int smu_dpm_set_vcn_enable(struct smu_context *smu, bool enable) { @@ -1386,15 +1404,9 @@ static int smu_hw_init(void *handle) }

if (smu->is_apu) { - if ((smu->ppt_funcs->set_gfx_power_up_by_imu) && - likely(adev->firmware.load_type == AMDGPU_FW_LOAD_PSP)) { - ret = smu->ppt_funcs->set_gfx_power_up_by_imu(smu); - if (ret) { - dev_err(adev->dev, "Failed to Enable gfx imu!\n"); - return ret; - } - } - + ret = smu_set_gfx_imu_enable(smu); + if (ret) + return ret; smu_dpm_set_vcn_enable(smu, true); smu_dpm_set_jpeg_enable(smu, true); smu_set_gfx_cgpg(smu, true); @@ -1670,6 +1682,10 @@ static int smu_resume(void *handle) return ret; }

+ ret = smu_set_gfx_imu_enable(smu); + if (ret) + return ret; + smu_set_gfx_cgpg(smu, true);

smu->disable_uclk_switch = 0;

From: Andrew Jones ajones@ventanamicro.com

commit 41cad8284d5e6bf1d49d3c10a6b52ee1ae866a20 upstream.

sbi_probe_extension() is specified with "Returns 0 if the given SBI extension ID (EID) is not available, or 1 if it is available unless defined as any other non-zero value by the implementation." Additionally, sbiret.value is a long. Fix the implementation to ensure any nonzero long value is considered a success, rather than only positive int values.

Fixes: b9dcd9e41587 ("RISC-V: Add basic support for SBI v0.2") Signed-off-by: Andrew Jones ajones@ventanamicro.com Reviewed-by: Conor Dooley conor.dooley@microchip.com Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230427163626.101042-1-ajones@ventanamicro.com Signed-off-by: Palmer Dabbelt palmer@rivosinc.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/riscv/include/asm/sbi.h | 2 +- arch/riscv/kernel/cpu_ops.c | 2 +- arch/riscv/kernel/sbi.c | 17 ++++++++--------- arch/riscv/kvm/main.c | 2 +- drivers/cpuidle/cpuidle-riscv-sbi.c | 2 +- drivers/perf/riscv_pmu_sbi.c | 2 +- 6 files changed, 13 insertions(+), 14 deletions(-)

--- a/arch/riscv/include/asm/sbi.h +++ b/arch/riscv/include/asm/sbi.h @@ -293,7 +293,7 @@ int sbi_remote_hfence_vvma_asid(const st unsigned long start, unsigned long size, unsigned long asid); -int sbi_probe_extension(int ext); +long sbi_probe_extension(int ext);

/* Check if current SBI specification version is 0.1 or not */ static inline int sbi_spec_is_0_1(void) --- a/arch/riscv/kernel/cpu_ops.c +++ b/arch/riscv/kernel/cpu_ops.c @@ -27,7 +27,7 @@ const struct cpu_operations cpu_ops_spin void __init cpu_set_ops(int cpuid) { #if IS_ENABLED(CONFIG_RISCV_SBI) - if (sbi_probe_extension(SBI_EXT_HSM) > 0) { + if (sbi_probe_extension(SBI_EXT_HSM)) { if (!cpuid) pr_info("SBI HSM extension detected\n"); cpu_ops[cpuid] = &cpu_ops_sbi; --- a/arch/riscv/kernel/sbi.c +++ b/arch/riscv/kernel/sbi.c @@ -581,19 +581,18 @@ static void sbi_srst_power_off(void) * sbi_probe_extension() - Check if an SBI extension ID is supported or not. * @extid: The extension ID to be probed. * - * Return: Extension specific nonzero value f yes, -ENOTSUPP otherwise. + * Return: 1 or an extension specific nonzero value if yes, 0 otherwise. */ -int sbi_probe_extension(int extid) +long sbi_probe_extension(int extid) { struct sbiret ret;

ret = sbi_ecall(SBI_EXT_BASE, SBI_EXT_BASE_PROBE_EXT, extid, 0, 0, 0, 0, 0); if (!ret.error) - if (ret.value) - return ret.value; + return ret.value;

- return -ENOTSUPP; + return 0; } EXPORT_SYMBOL(sbi_probe_extension);

@@ -662,26 +661,26 @@ void __init sbi_init(void) if (!sbi_spec_is_0_1()) { pr_info("SBI implementation ID=0x%lx Version=0x%lx\n", sbi_get_firmware_id(), sbi_get_firmware_version()); - if (sbi_probe_extension(SBI_EXT_TIME) > 0) { + if (sbi_probe_extension(SBI_EXT_TIME)) { __sbi_set_timer = __sbi_set_timer_v02; pr_info("SBI TIME extension detected\n"); } else { __sbi_set_timer = __sbi_set_timer_v01; } - if (sbi_probe_extension(SBI_EXT_IPI) > 0) { + if (sbi_probe_extension(SBI_EXT_IPI)) { __sbi_send_ipi = __sbi_send_ipi_v02; pr_info("SBI IPI extension detected\n"); } else { __sbi_send_ipi = __sbi_send_ipi_v01; } - if (sbi_probe_extension(SBI_EXT_RFENCE) > 0) { + if (sbi_probe_extension(SBI_EXT_RFENCE)) { __sbi_rfence = __sbi_rfence_v02; pr_info("SBI RFENCE extension detected\n"); } else { __sbi_rfence = __sbi_rfence_v01; } if ((sbi_spec_version >= sbi_mk_version(0, 3)) && - (sbi_probe_extension(SBI_EXT_SRST) > 0)) { + sbi_probe_extension(SBI_EXT_SRST)) { pr_info("SBI SRST extension detected\n"); pm_power_off = sbi_srst_power_off; sbi_srst_reboot_nb.notifier_call = sbi_srst_reboot; --- a/arch/riscv/kvm/main.c +++ b/arch/riscv/kvm/main.c @@ -84,7 +84,7 @@ int kvm_arch_init(void *opaque) return -ENODEV; }

- if (sbi_probe_extension(SBI_EXT_RFENCE) <= 0) { + if (!sbi_probe_extension(SBI_EXT_RFENCE)) { kvm_info("require SBI RFENCE extension\n"); return -ENODEV; } --- a/drivers/cpuidle/cpuidle-riscv-sbi.c +++ b/drivers/cpuidle/cpuidle-riscv-sbi.c @@ -612,7 +612,7 @@ static int __init sbi_cpuidle_init(void) * 2) SBI HSM extension is available */ if ((sbi_spec_version < sbi_mk_version(0, 3)) || - sbi_probe_extension(SBI_EXT_HSM) <= 0) { + !sbi_probe_extension(SBI_EXT_HSM)) { pr_info("HSM suspend not available\n"); return 0; } --- a/drivers/perf/riscv_pmu_sbi.c +++ b/drivers/perf/riscv_pmu_sbi.c @@ -869,7 +869,7 @@ static int __init pmu_sbi_devinit(void) struct platform_device *pdev;

if (sbi_spec_version < sbi_mk_version(0, 3) || - sbi_probe_extension(SBI_EXT_PMU) <= 0) { + !sbi_probe_extension(SBI_EXT_PMU)) { return 0; }

From: Zhihao Cheng chengzhihao1@huawei.com

commit b5fda08ef213352ac2df7447611eb4d383cce929 upstream.

Following process will cause a memleak for copied up znode:

dirty_cow_znode zn = copy_znode(c, znode); err = insert_old_idx(c, zbr->lnum, zbr->offs); if (unlikely(err)) return ERR_PTR(err); // No one refers to zn.

Fetch a reproducer in [Link].

Function copy_znode() is split into 2 parts: resource allocation and znode replacement, insert_old_idx() is split in similar way, so resource cleanup could be done in error handling path without corrupting metadata(mem & disk). It's okay that old index inserting is put behind of add_idx_dirt(), old index is used in layout_leb_in_gaps(), so the two processes do not depend on each other.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216705 Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") Cc: stable@vger.kernel.org Signed-off-by: Zhihao Cheng chengzhihao1@huawei.com Signed-off-by: Richard Weinberger richard@nod.at Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ubifs/tnc.c | 137 ++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 87 insertions(+), 50 deletions(-)

--- a/fs/ubifs/tnc.c +++ b/fs/ubifs/tnc.c @@ -44,6 +44,33 @@ enum { NOT_ON_MEDIA = 3, };

+static void do_insert_old_idx(struct ubifs_info *c, + struct ubifs_old_idx *old_idx) +{ + struct ubifs_old_idx *o; + struct rb_node **p, *parent = NULL; + + p = &c->old_idx.rb_node; + while (*p) { + parent = *p; + o = rb_entry(parent, struct ubifs_old_idx, rb); + if (old_idx->lnum < o->lnum) + p = &(*p)->rb_left; + else if (old_idx->lnum > o->lnum) + p = &(*p)->rb_right; + else if (old_idx->offs < o->offs) + p = &(*p)->rb_left; + else if (old_idx->offs > o->offs) + p = &(*p)->rb_right; + else { + ubifs_err(c, "old idx added twice!"); + kfree(old_idx); + } + } + rb_link_node(&old_idx->rb, parent, p); + rb_insert_color(&old_idx->rb, &c->old_idx); +} + /** * insert_old_idx - record an index node obsoleted since the last commit start. * @c: UBIFS file-system description object @@ -69,35 +96,15 @@ enum { */ static int insert_old_idx(struct ubifs_info *c, int lnum, int offs) { - struct ubifs_old_idx *old_idx, *o; - struct rb_node **p, *parent = NULL; + struct ubifs_old_idx *old_idx;

old_idx = kmalloc(sizeof(struct ubifs_old_idx), GFP_NOFS); if (unlikely(!old_idx)) return -ENOMEM; old_idx->lnum = lnum; old_idx->offs = offs; + do_insert_old_idx(c, old_idx);

- p = &c->old_idx.rb_node; - while (*p) { - parent = *p; - o = rb_entry(parent, struct ubifs_old_idx, rb); - if (lnum < o->lnum) - p = &(*p)->rb_left; - else if (lnum > o->lnum) - p = &(*p)->rb_right; - else if (offs < o->offs) - p = &(*p)->rb_left; - else if (offs > o->offs) - p = &(*p)->rb_right; - else { - ubifs_err(c, "old idx added twice!"); - kfree(old_idx); - return 0; - } - } - rb_link_node(&old_idx->rb, parent, p); - rb_insert_color(&old_idx->rb, &c->old_idx); return 0; }

@@ -199,23 +206,6 @@ static struct ubifs_znode *copy_znode(st __set_bit(DIRTY_ZNODE, &zn->flags); __clear_bit(COW_ZNODE, &zn->flags);

- ubifs_assert(c, !ubifs_zn_obsolete(znode)); - __set_bit(OBSOLETE_ZNODE, &znode->flags); - - if (znode->level != 0) { - int i; - const int n = zn->child_cnt; - - /* The children now have new parent */ - for (i = 0; i < n; i++) { - struct ubifs_zbranch *zbr = &zn->zbranch[i]; - - if (zbr->znode) - zbr->znode->parent = zn; - } - } - - atomic_long_inc(&c->dirty_zn_cnt); return zn; }

@@ -234,6 +224,42 @@ static int add_idx_dirt(struct ubifs_inf }

/** + * replace_znode - replace old znode with new znode. + * @c: UBIFS file-system description object + * @new_zn: new znode + * @old_zn: old znode + * @zbr: the branch of parent znode + * + * Replace old znode with new znode in TNC. + */ +static void replace_znode(struct ubifs_info *c, struct ubifs_znode *new_zn, + struct ubifs_znode *old_zn, struct ubifs_zbranch *zbr) +{ + ubifs_assert(c, !ubifs_zn_obsolete(old_zn)); + __set_bit(OBSOLETE_ZNODE, &old_zn->flags); + + if (old_zn->level != 0) { + int i; + const int n = new_zn->child_cnt; + + /* The children now have new parent */ + for (i = 0; i < n; i++) { + struct ubifs_zbranch *child = &new_zn->zbranch[i]; + + if (child->znode) + child->znode->parent = new_zn; + } + } + + zbr->znode = new_zn; + zbr->lnum = 0; + zbr->offs = 0; + zbr->len = 0; + + atomic_long_inc(&c->dirty_zn_cnt); +} + +/** * dirty_cow_znode - ensure a znode is not being committed. * @c: UBIFS file-system description object * @zbr: branch of znode to check @@ -265,21 +291,32 @@ static struct ubifs_znode *dirty_cow_zno return zn;

if (zbr->len) { - err = insert_old_idx(c, zbr->lnum, zbr->offs); - if (unlikely(err)) - return ERR_PTR(err); + struct ubifs_old_idx *old_idx; + + old_idx = kmalloc(sizeof(struct ubifs_old_idx), GFP_NOFS); + if (unlikely(!old_idx)) { + err = -ENOMEM; + goto out; + } + old_idx->lnum = zbr->lnum; + old_idx->offs = zbr->offs; + err = add_idx_dirt(c, zbr->lnum, zbr->len); - } else - err = 0; + if (err) { + kfree(old_idx); + goto out; + }

- zbr->znode = zn; - zbr->lnum = 0; - zbr->offs = 0; - zbr->len = 0; + do_insert_old_idx(c, old_idx); + } + + replace_znode(c, zn, znode, zbr);

- if (unlikely(err)) - return ERR_PTR(err); return zn; + +out: + kfree(zn); + return ERR_PTR(err); }

/**

From: Mårten Lindahl marten.lindahl@axis.com

commit 1fb815b38bb31d6af9bd0540b8652a0d6fe6cfd3 upstream.

When opening a ubifs tmpfile on an encrypted directory, function fscrypt_setup_filename allocates memory for the name that is to be stored in the directory entry, but after the name has been copied to the directory entry inode, the memory is not freed.

When running kmemleak on it we see that it is registered as a leak. The report below is triggered by a simple program 'tmpfile' just opening a tmpfile:

unreferenced object 0xffff88810178f380 (size 32): comm "tmpfile", pid 509, jiffies 4294934744 (age 1524.742s) backtrace: __kmem_cache_alloc_node __kmalloc fscrypt_setup_filename ubifs_tmpfile vfs_tmpfile path_openat

Free this memory after it has been copied to the inode.

Signed-off-by: Mårten Lindahl marten.lindahl@axis.com Reviewed-by: Zhihao Cheng chengzhihao1@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Richard Weinberger richard@nod.at Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ubifs/dir.c | 1 + 1 file changed, 1 insertion(+)

--- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -492,6 +492,7 @@ static int ubifs_tmpfile(struct user_nam unlock_2_inodes(dir, inode);

ubifs_release_budget(c, &req); + fscrypt_free_filename(&nm);

return finish_open_simple(file, 0);

From: Xiubo Li xiubli@redhat.com

commit aaf67de78807c59c35bafb5003d4fb457c764800 upstream.

When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash.

We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed.

Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/43272 Signed-off-by: Xiubo Li xiubli@redhat.com Reviewed-by: Luís Henriques lhenriques@suse.de Signed-off-by: Ilya Dryomov idryomov@gmail.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ceph/caps.c | 2 - fs/ceph/debugfs.c | 16 +++++++---- fs/ceph/mds_client.c | 72 ++++++++++++++++++++++++++++++++------------------- fs/ceph/mds_client.h | 3 -- fs/ceph/super.h | 2 + 5 files changed, 61 insertions(+), 34 deletions(-)

--- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -430,7 +430,7 @@ void ceph_reservation_status(struct ceph * * Called with i_ceph_lock held. */ -static struct ceph_cap *__get_cap_for_mds(struct ceph_inode_info *ci, int mds) +struct ceph_cap *__get_cap_for_mds(struct ceph_inode_info *ci, int mds) { struct ceph_cap *cap; struct rb_node *n = ci->i_caps.rb_node; --- a/fs/ceph/debugfs.c +++ b/fs/ceph/debugfs.c @@ -248,14 +248,20 @@ static int metrics_caps_show(struct seq_ return 0; }

-static int caps_show_cb(struct inode *inode, struct ceph_cap *cap, void *p) +static int caps_show_cb(struct inode *inode, int mds, void *p) { + struct ceph_inode_info *ci = ceph_inode(inode); struct seq_file *s = p; + struct ceph_cap *cap;

- seq_printf(s, "0x%-17llx%-3d%-17s%-17s\n", ceph_ino(inode), - cap->session->s_mds, - ceph_cap_string(cap->issued), - ceph_cap_string(cap->implemented)); + spin_lock(&ci->i_ceph_lock); + cap = __get_cap_for_mds(ci, mds); + if (cap) + seq_printf(s, "0x%-17llx%-3d%-17s%-17s\n", ceph_ino(inode), + cap->session->s_mds, + ceph_cap_string(cap->issued), + ceph_cap_string(cap->implemented)); + spin_unlock(&ci->i_ceph_lock); return 0; }

--- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -1632,8 +1632,8 @@ static void cleanup_session_requests(str * Caller must hold session s_mutex. */ int ceph_iterate_session_caps(struct ceph_mds_session *session, - int (*cb)(struct inode *, struct ceph_cap *, - void *), void *arg) + int (*cb)(struct inode *, int mds, void *), + void *arg) { struct list_head *p; struct ceph_cap *cap; @@ -1645,6 +1645,8 @@ int ceph_iterate_session_caps(struct cep spin_lock(&session->s_cap_lock); p = session->s_caps.next; while (p != &session->s_caps) { + int mds; + cap = list_entry(p, struct ceph_cap, session_caps); inode = igrab(&cap->ci->netfs.inode); if (!inode) { @@ -1652,6 +1654,7 @@ int ceph_iterate_session_caps(struct cep continue; } session->s_cap_iterator = cap; + mds = cap->mds; spin_unlock(&session->s_cap_lock);

if (last_inode) { @@ -1663,7 +1666,7 @@ int ceph_iterate_session_caps(struct cep old_cap = NULL; }

- ret = cb(inode, cap, arg); + ret = cb(inode, mds, arg); last_inode = inode;

spin_lock(&session->s_cap_lock); @@ -1696,20 +1699,25 @@ out: return ret; }

-static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap, - void *arg) +static int remove_session_caps_cb(struct inode *inode, int mds, void *arg) { struct ceph_inode_info *ci = ceph_inode(inode); bool invalidate = false; - int iputs; + struct ceph_cap *cap; + int iputs = 0;

- dout("removing cap %p, ci is %p, inode is %p\n", - cap, ci, &ci->netfs.inode); spin_lock(&ci->i_ceph_lock); - iputs = ceph_purge_inode_cap(inode, cap, &invalidate); + cap = __get_cap_for_mds(ci, mds); + if (cap) { + dout(" removing cap %p, ci is %p, inode is %p\n", + cap, ci, &ci->netfs.inode); + + iputs = ceph_purge_inode_cap(inode, cap, &invalidate); + } spin_unlock(&ci->i_ceph_lock);

- wake_up_all(&ci->i_cap_wq); + if (cap) + wake_up_all(&ci->i_cap_wq); if (invalidate) ceph_queue_invalidate(inode); while (iputs--) @@ -1780,8 +1788,7 @@ enum { * * caller must hold s_mutex. */ -static int wake_up_session_cb(struct inode *inode, struct ceph_cap *cap, - void *arg) +static int wake_up_session_cb(struct inode *inode, int mds, void *arg) { struct ceph_inode_info *ci = ceph_inode(inode); unsigned long ev = (unsigned long)arg; @@ -1792,12 +1799,14 @@ static int wake_up_session_cb(struct ino ci->i_requested_max_size = 0; spin_unlock(&ci->i_ceph_lock); } else if (ev == RENEWCAPS) { - if (cap->cap_gen < atomic_read(&cap->session->s_cap_gen)) { - /* mds did not re-issue stale cap */ - spin_lock(&ci->i_ceph_lock); + struct ceph_cap *cap; + + spin_lock(&ci->i_ceph_lock); + cap = __get_cap_for_mds(ci, mds); + /* mds did not re-issue stale cap */ + if (cap && cap->cap_gen < atomic_read(&cap->session->s_cap_gen)) cap->issued = cap->implemented = CEPH_CAP_PIN; - spin_unlock(&ci->i_ceph_lock); - } + spin_unlock(&ci->i_ceph_lock); } else if (ev == FORCE_RO) { } wake_up_all(&ci->i_cap_wq); @@ -1959,16 +1968,22 @@ out: * Yes, this is a bit sloppy. Our only real goal here is to respond to * memory pressure from the MDS, though, so it needn't be perfect. */ -static int trim_caps_cb(struct inode *inode, struct ceph_cap *cap, void *arg) +static int trim_caps_cb(struct inode *inode, int mds, void *arg) { int *remaining = arg; struct ceph_inode_info *ci = ceph_inode(inode); int used, wanted, oissued, mine; + struct ceph_cap *cap;

if (*remaining <= 0) return -1;

spin_lock(&ci->i_ceph_lock); + cap = __get_cap_for_mds(ci, mds); + if (!cap) { + spin_unlock(&ci->i_ceph_lock); + return 0; + } mine = cap->issued | cap->implemented; used = __ceph_caps_used(ci); wanted = __ceph_caps_file_wanted(ci); @@ -3911,26 +3926,22 @@ out_unlock: /* * Encode information about a cap for a reconnect with the MDS. */ -static int reconnect_caps_cb(struct inode *inode, struct ceph_cap *cap, - void *arg) +static int reconnect_caps_cb(struct inode *inode, int mds, void *arg) { union { struct ceph_mds_cap_reconnect v2; struct ceph_mds_cap_reconnect_v1 v1; } rec; - struct ceph_inode_info *ci = cap->ci; + struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_reconnect_state *recon_state = arg; struct ceph_pagelist *pagelist = recon_state->pagelist; struct dentry *dentry; + struct ceph_cap *cap; char *path; - int pathlen = 0, err; + int pathlen = 0, err = 0; u64 pathbase; u64 snap_follows;

- dout(" adding %p ino %llx.%llx cap %p %lld %s\n", - inode, ceph_vinop(inode), cap, cap->cap_id, - ceph_cap_string(cap->issued)); - dentry = d_find_primary(inode); if (dentry) { /* set pathbase to parent dir when msg_version >= 2 */ @@ -3947,6 +3958,15 @@ static int reconnect_caps_cb(struct inod }

spin_lock(&ci->i_ceph_lock); + cap = __get_cap_for_mds(ci, mds); + if (!cap) { + spin_unlock(&ci->i_ceph_lock); + goto out_err; + } + dout(" adding %p ino %llx.%llx cap %p %lld %s\n", + inode, ceph_vinop(inode), cap, cap->cap_id, + ceph_cap_string(cap->issued)); + cap->seq = 0; /* reset cap seq */ cap->issue_seq = 0; /* and issue_seq */ cap->mseq = 0; /* and migrate_seq */ --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -541,8 +541,7 @@ extern void ceph_flush_cap_releases(stru extern void ceph_queue_cap_reclaim_work(struct ceph_mds_client *mdsc); extern void ceph_reclaim_caps_nr(struct ceph_mds_client *mdsc, int nr); extern int ceph_iterate_session_caps(struct ceph_mds_session *session, - int (*cb)(struct inode *, - struct ceph_cap *, void *), + int (*cb)(struct inode *, int mds, void *), void *arg); extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);

--- a/fs/ceph/super.h +++ b/fs/ceph/super.h @@ -1190,6 +1190,8 @@ extern void ceph_kick_flushing_caps(stru struct ceph_mds_session *session); void ceph_kick_flushing_inode_caps(struct ceph_mds_session *session, struct ceph_inode_info *ci); +extern struct ceph_cap *__get_cap_for_mds(struct ceph_inode_info *ci, + int mds); extern struct ceph_cap *ceph_get_cap_for_mds(struct ceph_inode_info *ci, int mds); extern void ceph_take_cap_refs(struct ceph_inode_info *ci, int caps,

From: Dan Williams dan.j.williams@intel.com

commit 7701c8bef4f14bd9f7940c6ed0e6a73584115a96 upstream.

Decoders committed with 0-size lead to later crashes on shutdown as __cxl_dpa_release() assumes a 'struct resource' has been established in the in 'cxlds->dpa_res'. Just fail the driver load in this instance since there are deeper problems with the enumeration or the setup when this happens.

Fixes: 9c57cde0dcbd ("cxl/hdm: Enumerate allocated DPA") Cc: stable@vger.kernel.org Reviewed-by: Dave Jiang dave.jiang@intel.com Reviewed-by: Alison Schofield alison.schofield@intel.com Link: https://lore.kernel.org/r/168149843516.792294.11872242648319572632.stgit@dwi... Signed-off-by: Dan Williams dan.j.williams@intel.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/cxl/core/hdm.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)

--- a/drivers/cxl/core/hdm.c +++ b/drivers/cxl/core/hdm.c @@ -214,8 +214,11 @@ static int __cxl_dpa_reserve(struct cxl_

lockdep_assert_held_write(&cxl_dpa_rwsem);

- if (!len) - goto success; + if (!len) { + dev_warn(dev, "decoder%d.%d: empty reservation attempted\n", + port->id, cxled->cxld.id); + return -EINVAL; + }

if (cxled->dpa_res) { dev_dbg(dev, "decoder%d.%d: existing allocation %pr assigned\n", @@ -268,7 +271,6 @@ static int __cxl_dpa_reserve(struct cxl_ cxled->mode = CXL_DECODER_MIXED; }

-success: port->hdm_end++; get_device(&cxled->cxld.dev); return 0; @@ -727,6 +729,13 @@ static int init_hdm_decoder(struct cxl_p port->id, cxld->id); return -ENXIO; } + + if (size == 0) { + dev_warn(&port->dev, + "decoder%d.%d: Committed with zero size\n", + port->id, cxld->id); + return -ENXIO; + } port->commit_end = cxld->id; } else { /* unless / until type-2 drivers arrive, assume type-3 */

From: Jeffrey Hugo quic_jhugo@quicinc.com

commit 1d1493bdc25f498468a606a4ece947d155cfa3a9 upstream.

If firmware loading fails, the controller's pm_state is updated to MHI_PM_FW_DL_ERR unconditionally. This can corrupt the pm_state as the update is not done under the proper lock, and also does not validate the state transition. The firmware loading can fail due to a detected syserr, but if MHI_PM_FW_DL_ERR is unconditionally set as the pm_state, the handling of the syserr can break when it attempts to transition from syserr detect, to syserr process.

By grabbing the lock, we ensure we don't race with some other pm_state update. By using mhi_try_set_pm_state(), we check that the transition to MHI_PM_FW_DL_ERR is valid via the state machine logic. If it is not valid, then some other transition is occurring like syserr processing, and we assume that will resolve the firmware loading error.

Fixes: 12e050c77be0 ("bus: mhi: core: Move to an error state on any firmware load failure") Cc: stable@vger.kernel.org Signed-off-by: Jeffrey Hugo quic_jhugo@quicinc.com Reviewed-by: Carl Vanderlip quic_carlv@quicinc.com Reviewed-by: Manivannan Sadhasivam mani@kernel.org Link: https://lore.kernel.org/r/1681142292-27571-3-git-send-email-quic_jhugo@quici... Signed-off-by: Manivannan Sadhasivam manivannan.sadhasivam@linaro.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/bus/mhi/host/boot.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/drivers/bus/mhi/host/boot.c +++ b/drivers/bus/mhi/host/boot.c @@ -393,6 +393,7 @@ void mhi_fw_load_handler(struct mhi_cont { const struct firmware *firmware = NULL; struct device *dev = &mhi_cntrl->mhi_dev->dev; + enum mhi_pm_state new_state; const char *fw_name; void *buf; dma_addr_t dma_addr; @@ -510,14 +511,18 @@ error_ready_state: }

error_fw_load: - mhi_cntrl->pm_state = MHI_PM_FW_DL_ERR; - wake_up_all(&mhi_cntrl->state_event); + write_lock_irq(&mhi_cntrl->pm_lock); + new_state = mhi_tryset_pm_state(mhi_cntrl, MHI_PM_FW_DL_ERR); + write_unlock_irq(&mhi_cntrl->pm_lock); + if (new_state == MHI_PM_FW_DL_ERR) + wake_up_all(&mhi_cntrl->state_event); }

int mhi_download_amss_image(struct mhi_controller *mhi_cntrl) { struct image_info *image_info = mhi_cntrl->fbc_image; struct device *dev = &mhi_cntrl->mhi_dev->dev; + enum mhi_pm_state new_state; int ret;

if (!image_info) @@ -528,8 +533,11 @@ int mhi_download_amss_image(struct mhi_c &image_info->mhi_buf[image_info->entries - 1]); if (ret) { dev_err(dev, "MHI did not load AMSS, ret:%d\n", ret); - mhi_cntrl->pm_state = MHI_PM_FW_DL_ERR; - wake_up_all(&mhi_cntrl->state_event); + write_lock_irq(&mhi_cntrl->pm_lock); + new_state = mhi_tryset_pm_state(mhi_cntrl, MHI_PM_FW_DL_ERR); + write_unlock_irq(&mhi_cntrl->pm_lock); + if (new_state == MHI_PM_FW_DL_ERR) + wake_up_all(&mhi_cntrl->state_event); }

return ret;

From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org

commit 59257015ac8813d2430988aa01c2f4609a60e8e7 upstream.

The RX macro codec comes on some platforms in two variants - ADSP and ADSP bypassed - thus the clock-names varies from 3 to 5. The clocks must vary as well:

sc7280-idp.dtb: codec@3200000: clocks: [[202, 8], [202, 7], [203]] is too short

Fixes: 852fda58d99a ("ASoC: qcom: dt-bindings: Update bindings for clocks in lpass digital codes") Cc: stable@vger.kernel.org Acked-by: Rob Herring robh@kernel.org Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Link: https://lore.kernel.org/r/20230330071333.24308-1-krzysztof.kozlowski@linaro.... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- Documentation/devicetree/bindings/sound/qcom,lpass-rx-macro.yaml | 1 + 1 file changed, 1 insertion(+)

--- a/Documentation/devicetree/bindings/sound/qcom,lpass-rx-macro.yaml +++ b/Documentation/devicetree/bindings/sound/qcom,lpass-rx-macro.yaml @@ -27,6 +27,7 @@ properties: const: 0

clocks: + minItems: 3 maxItems: 5

clock-names:

From: Rae Moar rmoar@google.com

[ Upstream commit f9a301c3317daa921375da0aec82462ddf019928 ]

Fix bug in debugfs logs that causes an incorrect order of lines in the debugfs log.

Currently, the test counts lines that show the number of tests passed, failed, and skipped, as well as any suite diagnostic lines, appear prior to the individual results, which is a bug.

Ensure the order of printing for the debugfs log is correct. Additionally, add a KTAP header to so the debugfs logs can be valid KTAP.

This is an example of a log prior to these fixes:

KTAP version 1

# Subtest: kunit_status 1..2 # kunit_status: pass:2 fail:0 skip:0 total:2 # Totals: pass:2 fail:0 skip:0 total:2 ok 1 kunit_status_set_failure_test ok 2 kunit_status_mark_skipped_test ok 1 kunit_status

Note the two lines with stats are out of order. This is the same debugfs log after the fixes (in combination with the third patch to remove the extra line):

KTAP version 1 1..1 KTAP version 1 # Subtest: kunit_status 1..2 ok 1 kunit_status_set_failure_test ok 2 kunit_status_mark_skipped_test # kunit_status: pass:2 fail:0 skip:0 total:2 # Totals: pass:2 fail:0 skip:0 total:2 ok 1 kunit_status

Signed-off-by: Rae Moar rmoar@google.com Reviewed-by: David Gow davidgow@google.com Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- lib/kunit/debugfs.c | 14 ++++++++++++-- lib/kunit/test.c | 21 ++++++++++++++------- 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c index de0ee2e03ed60..b08bb1fba106d 100644 --- a/lib/kunit/debugfs.c +++ b/lib/kunit/debugfs.c @@ -55,14 +55,24 @@ static int debugfs_print_results(struct seq_file *seq, void *v) enum kunit_status success = kunit_suite_has_succeeded(suite); struct kunit_case *test_case;

- if (!suite || !suite->log) + if (!suite) return 0;

- seq_printf(seq, "%s", suite->log); + /* Print KTAP header so the debugfs log can be parsed as valid KTAP. */ + seq_puts(seq, "KTAP version 1\n"); + seq_puts(seq, "1..1\n"); + + /* Print suite header because it is not stored in the test logs. */ + seq_puts(seq, KUNIT_SUBTEST_INDENT "KTAP version 1\n"); + seq_printf(seq, KUNIT_SUBTEST_INDENT "# Subtest: %s\n", suite->name); + seq_printf(seq, KUNIT_SUBTEST_INDENT "1..%zd\n", kunit_suite_num_test_cases(suite));

kunit_suite_for_each_test_case(suite, test_case) debugfs_print_result(seq, suite, test_case);

+ if (suite->log) + seq_printf(seq, "%s", suite->log); + seq_printf(seq, "%s %d %s\n", kunit_status_to_ok_not_ok(success), 1, suite->name); return 0; diff --git a/lib/kunit/test.c b/lib/kunit/test.c index 0391159d0c235..184df6f701b48 100644 --- a/lib/kunit/test.c +++ b/lib/kunit/test.c @@ -149,10 +149,18 @@ EXPORT_SYMBOL_GPL(kunit_suite_num_test_cases);

static void kunit_print_suite_start(struct kunit_suite *suite) { - kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "KTAP version 1\n"); - kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "# Subtest: %s", + /* + * We do not log the test suite header as doing so would + * mean debugfs display would consist of the test suite + * header prior to individual test results. + * Hence directly printk the suite status, and we will + * separately seq_printf() the suite header for the debugfs + * representation. + */ + pr_info(KUNIT_SUBTEST_INDENT "KTAP version 1\n"); + pr_info(KUNIT_SUBTEST_INDENT "# Subtest: %s\n", suite->name); - kunit_log(KERN_INFO, suite, KUNIT_SUBTEST_INDENT "1..%zd", + pr_info(KUNIT_SUBTEST_INDENT "1..%zd\n", kunit_suite_num_test_cases(suite)); }

@@ -169,10 +177,9 @@ static void kunit_print_ok_not_ok(void *test_or_suite,

/* * We do not log the test suite results as doing so would - * mean debugfs display would consist of the test suite - * description and status prior to individual test results. - * Hence directly printk the suite status, and we will - * separately seq_printf() the suite status for the debugfs + * mean debugfs display would consist of an incorrect test + * number. Hence directly printk the suite result, and we will + * separately seq_printf() the suite results for the debugfs * representation. */ if (suite)

From: Ilpo Järvinen ilpo.jarvinen@linux.intel.com

[ Upstream commit 22a8be280383812235131dda18a8212a59fadd2d ]

malloc_and_init_memory() in fill_buf isn't checking if memalign() successfully allocated memory or not before accessing the memory.

Check the return value of memalign() and return NULL if allocating aligned memory fails.

Fixes: a2561b12fe39 ("selftests/resctrl: Add built in benchmark") Co-developed-by: Fenghua Yu fenghua.yu@intel.com Signed-off-by: Fenghua Yu fenghua.yu@intel.com Signed-off-by: Ilpo Järvinen ilpo.jarvinen@linux.intel.com Reviewed-by: Reinette Chatre reinette.chatre@intel.com Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/resctrl/fill_buf.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c index 56ccbeae0638d..c20d0a7ecbe63 100644 --- a/tools/testing/selftests/resctrl/fill_buf.c +++ b/tools/testing/selftests/resctrl/fill_buf.c @@ -68,6 +68,8 @@ static void *malloc_and_init_memory(size_t s) size_t s64;

void *p = memalign(PAGE_SIZE, s); + if (!p) + return NULL;

p64 = (uint64_t *)p; s64 = s / sizeof(uint64_t);

From: Ilpo Järvinen ilpo.jarvinen@linux.intel.com

[ Upstream commit fa10366cc6f4cc862871f8938426d85c2481f084 ]

resctrl_val() assumes ->setup() always returns either 0 to continue tests or < 0 in case of the normal termination of tests after x runs. The latter overlaps with normal error returns.

Define END_OF_TESTS (=1) to differentiate the normal termination of tests and return errors as negative values. Alter callers of ->setup() to handle errors properly.

Fixes: 790bf585b0ee ("selftests/resctrl: Add Cache Allocation Technology (CAT) selftest") Fixes: ecdbb911f22d ("selftests/resctrl: Add MBM test") Signed-off-by: Ilpo Järvinen ilpo.jarvinen@linux.intel.com Reviewed-by: Reinette Chatre reinette.chatre@intel.com Signed-off-by: Shuah Khan skhan@linuxfoundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- tools/testing/selftests/resctrl/cache.c | 4 +++- tools/testing/selftests/resctrl/cat_test.c | 2 +- tools/testing/selftests/resctrl/cmt_test.c | 2 +- tools/testing/selftests/resctrl/mba_test.c | 2 +- tools/testing/selftests/resctrl/mbm_test.c | 2 +- tools/testing/selftests/resctrl/resctrl.h | 2 ++ tools/testing/selftests/resctrl/resctrl_val.c | 4 +++- 7 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/resctrl/cache.c b/tools/testing/selftests/resctrl/cache.c index 68ff856d36f0b..0485863a169f2 100644 --- a/tools/testing/selftests/resctrl/cache.c +++ b/tools/testing/selftests/resctrl/cache.c @@ -244,10 +244,12 @@ int cat_val(struct resctrl_val_param *param) while (1) { if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) { ret = param->setup(1, param); - if (ret) { + if (ret == END_OF_TESTS) { ret = 0; break; } + if (ret < 0) + break; ret = reset_enable_llc_perf(bm_pid, param->cpu_no); if (ret) break; diff --git a/tools/testing/selftests/resctrl/cat_test.c b/tools/testing/selftests/resctrl/cat_test.c index 1c5e90c632548..2d3c7c77ab6cb 100644 --- a/tools/testing/selftests/resctrl/cat_test.c +++ b/tools/testing/selftests/resctrl/cat_test.c @@ -40,7 +40,7 @@ static int cat_setup(int num, ...)

/* Run NUM_OF_RUNS times */ if (p->num_of_runs >= NUM_OF_RUNS) - return -1; + return END_OF_TESTS;

if (p->num_of_runs == 0) { sprintf(schemata, "%lx", p->mask); diff --git a/tools/testing/selftests/resctrl/cmt_test.c b/tools/testing/selftests/resctrl/cmt_test.c index 8968e36db99d7..3b0454e7fc826 100644 --- a/tools/testing/selftests/resctrl/cmt_test.c +++ b/tools/testing/selftests/resctrl/cmt_test.c @@ -32,7 +32,7 @@ static int cmt_setup(int num, ...)

/* Run NUM_OF_RUNS times */ if (p->num_of_runs >= NUM_OF_RUNS) - return -1; + return END_OF_TESTS;

p->num_of_runs++;

diff --git a/tools/testing/selftests/resctrl/mba_test.c b/tools/testing/selftests/resctrl/mba_test.c index 1a1bdb6180cf2..f32289ae17aeb 100644 --- a/tools/testing/selftests/resctrl/mba_test.c +++ b/tools/testing/selftests/resctrl/mba_test.c @@ -41,7 +41,7 @@ static int mba_setup(int num, ...) return 0;

if (allocation < ALLOCATION_MIN || allocation > ALLOCATION_MAX) - return -1; + return END_OF_TESTS;

sprintf(allocation_str, "%d", allocation);

diff --git a/tools/testing/selftests/resctrl/mbm_test.c b/tools/testing/selftests/resctrl/mbm_test.c index 8392e5c55ed02..280187628054d 100644 --- a/tools/testing/selftests/resctrl/mbm_test.c +++ b/tools/testing/selftests/resctrl/mbm_test.c @@ -95,7 +95,7 @@ static int mbm_setup(int num, ...)

/* Run NUM_OF_RUNS times */ if (num_of_runs++ >= NUM_OF_RUNS) - return -1; + return END_OF_TESTS;

va_start(param, num); p = va_arg(param, struct resctrl_val_param *); diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h index f0ded31fb3c7c..f44fa2de4d986 100644 --- a/tools/testing/selftests/resctrl/resctrl.h +++ b/tools/testing/selftests/resctrl/resctrl.h @@ -37,6 +37,8 @@ #define ARCH_INTEL 1 #define ARCH_AMD 2

+#define END_OF_TESTS 1 + #define PARENT_EXIT(err_msg) \ do { \ perror(err_msg); \ diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c index 787546a528493..00864242d76c6 100644 --- a/tools/testing/selftests/resctrl/resctrl_val.c +++ b/tools/testing/selftests/resctrl/resctrl_val.c @@ -735,10 +735,12 @@ int resctrl_val(char **benchmark_cmd, struct resctrl_val_param *param) /* Test runs until the callback setup() tells the test to stop. */ while (1) { ret = param->setup(1, param); - if (ret) { + if (ret == END_OF_TESTS) { ret = 0; break; } + if (ret < 0) + break;

if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || !strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) {

From: Ondrej Mosnacek omosnace@redhat.com

[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ]

Make the flask.h target depend on the genheaders binary instead of classmap.h to ensure that it is rebuilt if any of the dependencies of genheaders are changed.

Notably this fixes flask.h not being rebuilt when initial_sid_to_string.h is modified.

Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") Signed-off-by: Ondrej Mosnacek omosnace@redhat.com Acked-by: Stephen Smalley stephen.smalley.work@gmail.com Signed-off-by: Paul Moore paul@paul-moore.com Signed-off-by: Sasha Levin sashal@kernel.org --- security/selinux/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/selinux/Makefile b/security/selinux/Makefile index 7761624448826..103c2776478a7 100644 --- a/security/selinux/Makefile +++ b/security/selinux/Makefile @@ -23,8 +23,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h

quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h - cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h + cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h

targets += flask.h av_permissions.h -$(obj)/flask.h: $(src)/include/classmap.h FORCE +$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE $(call if_changed,flask)

From: Lino Sanfilippo l.sanfilippo@kunbus.com

[ Upstream commit ed9be0e6c892a783800d77a41ca4c7255c6af8c5 ]

If in tpm_tis_probe_irq_single() an error occurs after the original interrupt vector has been read, restore the interrupts before the error is returned.

Since the caller does not check the error value, return -1 in any case that the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function tpm_tis_gen_interrupt() is not longer used, make it a void function.

Fixes: 1107d065fdf1 ("tpm_tis: Introduce intermediate layer for TPM access") Signed-off-by: Lino Sanfilippo l.sanfilippo@kunbus.com Tested-by: Jarkko Sakkinen jarkko@kernel.org Reviewed-by: Jarkko Sakkinen jarkko@kernel.org Signed-off-by: Jarkko Sakkinen jarkko@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/char/tpm/tpm_tis_core.c | 29 +++++++++++------------------ 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c index 3f98e587b3e84..33d98f3e0f7a6 100644 --- a/drivers/char/tpm/tpm_tis_core.c +++ b/drivers/char/tpm/tpm_tis_core.c @@ -732,7 +732,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id) return IRQ_HANDLED; }

-static int tpm_tis_gen_interrupt(struct tpm_chip *chip) +static void tpm_tis_gen_interrupt(struct tpm_chip *chip) { const char *desc = "attempting to generate an interrupt"; u32 cap2; @@ -741,7 +741,7 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)

ret = request_locality(chip, 0); if (ret < 0) - return ret; + return;

if (chip->flags & TPM_CHIP_FLAG_TPM2) ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); @@ -749,8 +749,6 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0);

release_locality(chip, 0); - - return ret; }

/* Register the IRQ and issue a command that will cause an interrupt. If an @@ -780,42 +778,37 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,

rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq); if (rc < 0) - return rc; + goto restore_irqs;

rc = tpm_tis_read32(priv, TPM_INT_STATUS(priv->locality), &int_status); if (rc < 0) - return rc; + goto restore_irqs;

/* Clear all existing */ rc = tpm_tis_write32(priv, TPM_INT_STATUS(priv->locality), int_status); if (rc < 0) - return rc; - + goto restore_irqs; /* Turn on */ rc = tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask | TPM_GLOBAL_INT_ENABLE); if (rc < 0) - return rc; + goto restore_irqs;

priv->irq_tested = false;

/* Generate an interrupt by having the core call through to * tpm_tis_send */ - rc = tpm_tis_gen_interrupt(chip); - if (rc < 0) - return rc; + tpm_tis_gen_interrupt(chip);

+restore_irqs: /* tpm_tis_send will either confirm the interrupt is working or it * will call disable_irq which undoes all of the above. */ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { - rc = tpm_tis_write8(priv, original_int_vec, - TPM_INT_VECTOR(priv->locality)); - if (rc < 0) - return rc; - - return 1; + tpm_tis_write8(priv, original_int_vec, + TPM_INT_VECTOR(priv->locality)); + return -1; }

return 0;

From: Lino Sanfilippo l.sanfilippo@kunbus.com

[ Upstream commit 6d789ad726950e612a7f31044260337237c5b490 ]

Both functions tpm_tis_probe_irq_single() and tpm_tis_probe_irq() may setup the interrupts and then return with an error. This case is indicated by a missing TPM_CHIP_FLAG_IRQ flag in chip->flags. Currently the interrupt setup is only undone if tpm_tis_probe_irq_single() fails. Undo the setup also if tpm_tis_probe_irq() fails.

Signed-off-by: Lino Sanfilippo l.sanfilippo@kunbus.com Tested-by: Michael Niewöhner linux@mniewoehner.de Tested-by: Jarkko Sakkinen jarkko@kernel.org Reviewed-by: Jarkko Sakkinen jarkko@kernel.org Signed-off-by: Jarkko Sakkinen jarkko@kernel.org Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/char/tpm/tpm_tis_core.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c index a2cbf9b6f4c92..4e6075d4e2643 100644 --- a/drivers/char/tpm/tpm_tis_core.c +++ b/drivers/char/tpm/tpm_tis_core.c @@ -1087,21 +1087,21 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, goto out_err; }

- if (irq) { + if (irq) tpm_tis_probe_irq_single(chip, intmask, IRQF_SHARED, irq); - if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { - dev_err(&chip->dev, FW_BUG + else + tpm_tis_probe_irq(chip, intmask); + + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { + dev_err(&chip->dev, FW_BUG "TPM interrupt not working, polling instead\n");

- rc = request_locality(chip, 0); - if (rc < 0) - goto out_err; - disable_interrupts(chip); - release_locality(chip, 0); - } - } else { - tpm_tis_probe_irq(chip, intmask); + rc = request_locality(chip, 0); + if (rc < 0) + goto out_err; + disable_interrupts(chip); + release_locality(chip, 0); } }

From: Lino Sanfilippo l.sanfilippo@kunbus.com

[ Upstream commit 7a2f55d0be296c4e81fd782f3d6c43ed4ec7e265 ]

Implement a usage counter for the (default) locality used by the TPM TIS driver: Request the locality from the TPM if it has not been claimed yet, otherwise only increment the counter. Also release the locality if the counter is 0 otherwise only decrement the counter. Since in case of SPI the register accesses are locked by means of the SPI bus mutex use a sleepable lock (i.e. also a mutex) to ensure thread-safety of the counter which may be accessed by both a userspace thread and the interrupt handler.

By doing this refactor the names of the amended functions to use a more appropriate prefix.

Signed-off-by: Lino Sanfilippo l.sanfilippo@kunbus.com Tested-by: Michael Niewöhner linux@mniewoehner.de Tested-by: Jarkko Sakkinen jarkko@kernel.org Reviewed-by: Jarkko Sakkinen jarkko@kernel.org Signed-off-by: Jarkko Sakkinen jarkko@kernel.org Stable-dep-of: 955df4f87760 ("tpm, tpm_tis: Claim locality when interrupts are reenabled on resume") Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/char/tpm/tpm_tis_core.c | 63 +++++++++++++++++++++++---------- drivers/char/tpm/tpm_tis_core.h | 2 ++ 2 files changed, 47 insertions(+), 18 deletions(-)

diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c index 39f27edb32879..c5fef63c6179d 100644 --- a/drivers/char/tpm/tpm_tis_core.c +++ b/drivers/char/tpm/tpm_tis_core.c @@ -136,16 +136,27 @@ static bool check_locality(struct tpm_chip *chip, int l) return false; }

-static int release_locality(struct tpm_chip *chip, int l) +static int __tpm_tis_relinquish_locality(struct tpm_tis_data *priv, int l) +{ + tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY); + + return 0; +} + +static int tpm_tis_relinquish_locality(struct tpm_chip *chip, int l) { struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);

- tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY); + mutex_lock(&priv->locality_count_mutex); + priv->locality_count--; + if (priv->locality_count == 0) + __tpm_tis_relinquish_locality(priv, l); + mutex_unlock(&priv->locality_count_mutex);

return 0; }

-static int request_locality(struct tpm_chip *chip, int l) +static int __tpm_tis_request_locality(struct tpm_chip *chip, int l) { struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); unsigned long stop, timeout; @@ -186,6 +197,20 @@ static int request_locality(struct tpm_chip *chip, int l) return -1; }

+static int tpm_tis_request_locality(struct tpm_chip *chip, int l) +{ + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + int ret = 0; + + mutex_lock(&priv->locality_count_mutex); + if (priv->locality_count == 0) + ret = __tpm_tis_request_locality(chip, l); + if (!ret) + priv->locality_count++; + mutex_unlock(&priv->locality_count_mutex); + return ret; +} + static u8 tpm_tis_status(struct tpm_chip *chip) { struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); @@ -652,7 +677,7 @@ static int probe_itpm(struct tpm_chip *chip) if (vendor != TPM_VID_INTEL) return 0;

- if (request_locality(chip, 0) != 0) + if (tpm_tis_request_locality(chip, 0) != 0) return -EBUSY;

rc = tpm_tis_send_data(chip, cmd_getticks, len); @@ -673,7 +698,7 @@ static int probe_itpm(struct tpm_chip *chip)

out: tpm_tis_ready(chip); - release_locality(chip, priv->locality); + tpm_tis_relinquish_locality(chip, priv->locality);

return rc; } @@ -765,14 +790,14 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, } priv->irq = irq;

- rc = request_locality(chip, 0); + rc = tpm_tis_request_locality(chip, 0); if (rc < 0) return rc;

rc = tpm_tis_read8(priv, TPM_INT_VECTOR(priv->locality), &original_int_vec); if (rc < 0) { - release_locality(chip, priv->locality); + tpm_tis_relinquish_locality(chip, priv->locality); return rc; }

@@ -811,7 +836,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, rc = -1; }

- release_locality(chip, priv->locality); + tpm_tis_relinquish_locality(chip, priv->locality);

return rc; } @@ -927,8 +952,8 @@ static const struct tpm_class_ops tpm_tis = { .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID, .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID, .req_canceled = tpm_tis_req_canceled, - .request_locality = request_locality, - .relinquish_locality = release_locality, + .request_locality = tpm_tis_request_locality, + .relinquish_locality = tpm_tis_relinquish_locality, .clk_enable = tpm_tis_clkrun_enable, };

@@ -962,6 +987,8 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, priv->timeout_min = TPM_TIMEOUT_USECS_MIN; priv->timeout_max = TPM_TIMEOUT_USECS_MAX; priv->phy_ops = phy_ops; + priv->locality_count = 0; + mutex_init(&priv->locality_count_mutex);

dev_set_drvdata(&chip->dev, priv);

@@ -1008,14 +1035,14 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; intmask &= ~TPM_GLOBAL_INT_ENABLE;

- rc = request_locality(chip, 0); + rc = tpm_tis_request_locality(chip, 0); if (rc < 0) { rc = -ENODEV; goto out_err; }

tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); - release_locality(chip, 0); + tpm_tis_relinquish_locality(chip, 0);

rc = tpm_chip_start(chip); if (rc) @@ -1075,13 +1102,13 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, * proper timeouts for the driver. */

- rc = request_locality(chip, 0); + rc = tpm_tis_request_locality(chip, 0); if (rc < 0) goto out_err;

rc = tpm_get_timeouts(chip);

- release_locality(chip, 0); + tpm_tis_relinquish_locality(chip, 0);

if (rc) { dev_err(dev, "Could not get TPM timeouts and durations\n"); @@ -1099,11 +1126,11 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, dev_err(&chip->dev, FW_BUG "TPM interrupt not working, polling instead\n");

- rc = request_locality(chip, 0); + rc = tpm_tis_request_locality(chip, 0); if (rc < 0) goto out_err; disable_interrupts(chip); - release_locality(chip, 0); + tpm_tis_relinquish_locality(chip, 0); } }

@@ -1176,13 +1203,13 @@ int tpm_tis_resume(struct device *dev) * an error code but for unknown reason it isn't handled. */ if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) { - ret = request_locality(chip, 0); + ret = tpm_tis_request_locality(chip, 0); if (ret < 0) return ret;

tpm1_do_selftest(chip);

- release_locality(chip, 0); + tpm_tis_relinquish_locality(chip, 0); }

return 0; diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h index b68479e0de10f..1d51d5168fb6e 100644 --- a/drivers/char/tpm/tpm_tis_core.h +++ b/drivers/char/tpm/tpm_tis_core.h @@ -91,6 +91,8 @@ enum tpm_tis_flags {

struct tpm_tis_data { u16 manufacturer_id; + struct mutex locality_count_mutex; + unsigned int locality_count; int locality; int irq; bool irq_tested;

From: Gao Xiang hsiangkao@linux.alibaba.com

[ Upstream commit cc4efd3dd2ac9f89143e5d881609747ecff04164 ]

Syzbot generated a crafted image [1] with a non-compact HEAD index of clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, which causes the following unexpected behavior as below:

BUG: unable to handle page fault for address: fffff52101a3fff9 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 23ffed067 P4D 23ffed067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 Workqueue: erofs_worker z_erofs_decompressqueue_work RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 ... Call Trace: <TASK> z_erofs_decompressqueue_work+0x99/0xe0 process_one_work+0x8f6/0x1170 worker_thread+0xa63/0x1210 kthread+0x270/0x300 ret_from_fork+0x1f/0x30

Note that normal images or images using compact indexes are not impacted. Let's fix this now.

[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com

Reported-and-tested-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") Signed-off-by: Gao Xiang hsiangkao@linux.alibaba.com Reviewed-by: Chao Yu chao@kernel.org Link: https://lore.kernel.org/r/20230410173714.104604-1-hsiangkao@linux.alibaba.co... Signed-off-by: Sasha Levin sashal@kernel.org --- fs/erofs/zmap.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 39cc014dba40c..bb91cc6499725 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -211,6 +211,10 @@ static int legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m, if (advise & Z_EROFS_VLE_DI_PARTIAL_REF) m->partialref = true; m->clusterofs = le16_to_cpu(di->di_clusterofs); + if (m->clusterofs >= 1 << vi->z_logical_clusterbits) { + DBG_BUGON(1); + return -EFSCORRUPTED; + } m->pblk = le32_to_cpu(di->di_u.blkaddr); break; default:

From: Jingbo Xu jefflexu@linux.alibaba.com

[ Upstream commit 1b3567a1969b26f709d82a874498c0754ea841c3 ]

Given on-disk i_xattr_icount is 16 bits and xattr_isize is calculated from i_xattr_icount multiplying 4, xattr_isize has a theoretical maximum of 256K (64K * 4).

Thus declare xattr_isize as unsigned int to avoid the potential overflow.

Fixes: bfb8674dc044 ("staging: erofs: add erofs in-memory stuffs") Signed-off-by: Jingbo Xu jefflexu@linux.alibaba.com Reviewed-by: Gao Xiang hsiangkao@linux.alibaba.com Reviewed-by: Chao Yu chao@kernel.org Link: https://lore.kernel.org/r/20230414061810.6479-1-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang hsiangkao@linux.alibaba.com Signed-off-by: Sasha Levin sashal@kernel.org --- fs/erofs/internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h index 4868000806d8b..340bd56a57559 100644 --- a/fs/erofs/internal.h +++ b/fs/erofs/internal.h @@ -311,7 +311,7 @@ struct erofs_inode {

unsigned char datalayout; unsigned char inode_isize; - unsigned short xattr_isize; + unsigned int xattr_isize;

unsigned int xattr_shared_count; unsigned int *xattr_shared_xattrs;

From: Matt Roper matthew.d.roper@intel.com

[ Upstream commit 3a38be31ec82920a871963c086393bc0ba26a655 ]

The bspec was recently updated to remove PCI ID 0x5698; this ID is actually reserved for future use and should not be treated as DG2-G11.

Bspec: 44477 Fixes: 8618b8489ba6 ("drm/i915: DG2 and ATS-M device ID updates") Signed-off-by: Matt Roper matthew.d.roper@intel.com Reviewed-by: Gustavo Sousa gustavo.sousa@intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20230208200905.680865-1-matthe... Signed-off-by: Sasha Levin sashal@kernel.org --- include/drm/i915_pciids.h | 1 - 1 file changed, 1 deletion(-)

diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h index 4a4c190f76984..8f648c32a9657 100644 --- a/include/drm/i915_pciids.h +++ b/include/drm/i915_pciids.h @@ -706,7 +706,6 @@ INTEL_VGA_DEVICE(0x5693, info), \ INTEL_VGA_DEVICE(0x5694, info), \ INTEL_VGA_DEVICE(0x5695, info), \ - INTEL_VGA_DEVICE(0x5698, info), \ INTEL_VGA_DEVICE(0x56A5, info), \ INTEL_VGA_DEVICE(0x56A6, info), \ INTEL_VGA_DEVICE(0x56B0, info), \

From: Dom Cobley popcornmix@gmail.com

[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ]

Currently we schedule a call to output_poll_execute from drm_kms_helper_poll_enable for 10s in future. Later we try to replace that in drm_helper_probe_single_connector_modes with a 0s schedule with delayed_event set.

But as there is already a job in the queue this fails, and the immediate job we wanted with delayed_event set doesn't occur until 10s later.

And that call acts as if connector state has changed, reprobing modes. This has a side effect of waking up a display that has been blanked.

Make sure we cancel the old job before submitting the immediate one.

Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event") Acked-by: Daniel Vetter daniel@ffwll.ch Signed-off-by: Dom Cobley popcornmix@gmail.com [Maxime: Switched to mod_delayed_work] Signed-off-by: Maxime Ripard maxime@cerno.tech Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/gpu/drm/drm_probe_helper.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c index 69b0b2b9cc1c5..3b968ad187cf3 100644 --- a/drivers/gpu/drm/drm_probe_helper.c +++ b/drivers/gpu/drm/drm_probe_helper.c @@ -557,8 +557,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector, */ dev->mode_config.delayed_event = true; if (dev->mode_config.poll_enabled) - schedule_delayed_work(&dev->mode_config.output_poll_work, - 0); + mod_delayed_work(system_wq, + &dev->mode_config.output_poll_work, + 0); }

/* Re-enable polling in case the global poll config changed. */

From: Terry Bowman terry.bowman@amd.com

[ Upstream commit 4e347bdf44c1fd4296a7b9657a2c0e1bd900fa50 ]

Leaf Fn00000007 contains avx512bw at bit 26 and avx512vl at bit 28. This is incorrect per the SDM. Correct avx512bw to be bit 30 and avx512lvl to be bit 31.

Fixes: c6b2f240bf8d ("tools/x86: Add a kcpuid tool to show raw CPU features") Signed-off-by: Terry Bowman terry.bowman@amd.com Signed-off-by: Borislav Petkov (AMD) bp@alien8.de Reviewed-by: Feng Tang feng.tang@intel.com Link: https://lore.kernel.org/r/20230206141832.4162264-2-terry.bowman@amd.com Signed-off-by: Sasha Levin sashal@kernel.org --- tools/arch/x86/kcpuid/cpuid.csv | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/arch/x86/kcpuid/cpuid.csv b/tools/arch/x86/kcpuid/cpuid.csv index 4f1c4b0c29e98..9914bdf4fc9ec 100644 --- a/tools/arch/x86/kcpuid/cpuid.csv +++ b/tools/arch/x86/kcpuid/cpuid.csv @@ -184,8 +184,8 @@ 7, 0, EBX, 27, avx512er, AVX512 Exponent Reciproca instr 7, 0, EBX, 28, avx512cd, AVX512 Conflict Detection instr 7, 0, EBX, 29, sha, Intel Secure Hash Algorithm Extensions instr - 7, 0, EBX, 26, avx512bw, AVX512 Byte & Word instr - 7, 0, EBX, 28, avx512vl, AVX512 Vector Length Extentions (VL) + 7, 0, EBX, 30, avx512bw, AVX512 Byte & Word instr + 7, 0, EBX, 31, avx512vl, AVX512 Vector Length Extentions (VL) 7, 0, ECX, 0, prefetchwt1, X 7, 0, ECX, 1, avx512vbmi, AVX512 Vector Byte Manipulation Instructions 7, 0, ECX, 2, umip, User-mode Instruction Prevention

From: Geert Uytterhoeven geert+renesas@glider.be

[ Upstream commit fb76b0fae3ca880363214e1dcd6513ab8bd529e7 ]

According to the R-Car Series, 3rd Generation Hardware User’s Manual Rev. 2.30, the System CPU cores on R-Car E3 do not have their own power supply, but use the common internal power supply (typical 1.03V).

Hence remove the "opp-microvolt" properties from the Operating Performance Points table. They are optional, and unused, when none of the CPU nodes is tied to a regulator using the "cpu-supply" property.

Fixes: dd7188eb4ed128dc ("arm64: dts: renesas: r8a77990: Add OPPs table for cpu devices") Signed-off-by: Geert Uytterhoeven geert+renesas@glider.be Link: https://lore.kernel.org/r/9232578d9d395d529f64db3333a371e31327f459.167656085... Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm64/boot/dts/renesas/r8a77990.dtsi | 3 --- 1 file changed, 3 deletions(-)

diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi index 3053b4b214978..3ed31ffd73a28 100644 --- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi +++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi @@ -49,17 +49,14 @@ opp-shared; opp-800000000 { opp-hz = /bits/ 64 <800000000>; - opp-microvolt = <820000>; clock-latency-ns = <300000>; }; opp-1000000000 { opp-hz = /bits/ 64 <1000000000>; - opp-microvolt = <820000>; clock-latency-ns = <300000>; }; opp-1200000000 { opp-hz = /bits/ 64 <1200000000>; - opp-microvolt = <820000>; clock-latency-ns = <300000>; opp-suspend; };

From: Lad Prabhakar prabhakar.mahadev-lad.rj@bp.renesas.com

[ Upstream commit 5da750ddd96454757a3b467e968e3fb70bb12bc8 ]