summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-01-30Merge tag 'sunxi-dt-for-6.3-1' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/dt - introduce Allwinner D1 DTSI - add boards: Dongshan Nezha STU, MangoPi MQ (Pro), Sipeed Lichee RV, Nezha - add D1 power controller node - Add SATA regulator to Bananapi M3 - fix regulator reference for nanopi-duo2 - fix GPIO node names - align HDMI CEC node name for h3-beelink-x2 - add DPHY interrupt to A64 and A33 * tag 'sunxi-dt-for-6.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: riscv: dts: allwinner: d1: Add power controller node riscv: Add the Allwinner SoC family Kconfig option riscv: dts: allwinner: Add Dongshan Nezha STU devicetree riscv: dts: allwinner: Add MangoPi MQ Pro devicetree riscv: dts: allwinner: Add Sipeed Lichee RV devicetrees riscv: dts: allwinner: Add Allwinner D1 Nezha devicetree riscv: dts: allwinner: Add MangoPi MQ devicetree riscv: dts: allwinner: Add the D1/D1s SoC devicetree dt-bindings: riscv: Add Allwinner D1/D1s board compatibles dt-bindings: vendor-prefixes: Add Allwinner D1/D1s board vendors MAINTAINERS: Match the sun20i family of Allwinner SoCs ARM: dts: sun8i: a83t: bananapi-m3: describe SATA disk regulator ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference ARM: dts: sunxi: Fix GPIO LED node names ARM: dts: sun8i: h3-beelink-x2: align HDMI CEC node names with dtschema arm64: dts: allwinner: a64: Add DPHY interrupt ARM: dts: sun8i: a33: Add DPHY interrupt Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30drm/i915/adlp: Fix typo for reference clockChaitanya Kumar Borah
Fix typo for reference clock from 24400 to 24000. Bspec: 55409 Fixes: 626426ff9ce4 ("drm/i915/adl_p: Add cdclk support for ADL-P") Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Signed-off-by: Jani Nikula <jani.nikula@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230112094131.550252-1-chaitanya.kumar.borah@intel.com (cherry picked from commit 2b6f7e39ccae065abfbe3b6e562ec95ccad09f1e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2023-01-30drm/i915: Fix potential bit_17 double-freeRob Clark
A userspace with multiple threads racing I915_GEM_SET_TILING to set the tiling to I915_TILING_NONE could trigger a double free of the bit_17 bitmask. (Or conversely leak memory on the transition to tiled.) Move allocation/free'ing of the bitmask within the section protected by the obj lock. Signed-off-by: Rob Clark <robdclark@chromium.org> Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex") Cc: <stable@vger.kernel.org> # v5.5+ [tursulin: Correct fixes tag and added cc stable.] Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230127200550.3531984-1-robdclark@gmail.com (cherry picked from commit 10e0cbaaf1104f449d695c80bcacf930dcd3c42e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2023-01-30drm/i915: Fix up locking around dumping requests listsJohn Harrison
The debugfs dump of requests was confused about what state requires the execlist lock versus the GuC lock. There was also a bunch of duplicated messy code between it and the error capture code. So refactor the hung request search into a re-usable function. And reduce the span of the execlist state lock to only the execlist specific code paths. In order to do that, also move the report of hold count (which is an execlist only concept) from the top level dump function to the lower level execlist specific function. Also, move the execlist specific code into the execlist source file. v2: Rename some functions and move to more appropriate files (Daniele). v3: Rename new execlist dump function (Daniele) Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Cc: Michael Cheng <michael.cheng@intel.com> Cc: Lucas De Marchi <lucas.demarchi@intel.com> Cc: Bruce Chang <yu.bruce.chang@intel.com> Cc: Alan Previn <alan.previn.teres.alexis@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-4-John.C.Harrison@Intel.com (cherry picked from commit a4be3dca53172d9d2091e4b474fb795c81ed3d6c) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2023-01-30drm/i915: Fix request ref counting during error capture & debugfs dumpJohn Harrison
When GuC support was added to error capture, the reference counting around the request object was broken. Fix it up. The context based search manages the spinlocking around the search internally. So it needs to grab the reference count internally as well. The execlist only request based search relies on external locking, so it needs an external reference count but within the spinlock not outside it. The only other caller of the context based search is the code for dumping engine state to debugfs. That code wasn't previously getting an explicit reference at all as it does everything while holding the execlist specific spinlock. So, that needs updaing as well as that spinlock doesn't help when using GuC submission. Rather than trying to conditionally get/put depending on submission model, just change it to always do the get/put. v2: Explicitly document adding an extra blank line in some dense code (Andy Shevchenko). Fix multiple potential null pointer derefs in case of no request found (some spotted by Tvrtko, but there was more!). Also fix a leaked request in case of !started and another in __guc_reset_context now that intel_context_find_active_request is actually reference counting the returned request. v3: Add a _get suffix to intel_context_find_active_request now that it grabs a reference (Daniele). v4: Split the intel_guc_find_hung_context change to a separate patch and rename intel_context_find_active_request_get to intel_context_get_active_request (Tvrtko). v5: s/locking/reference counting/ in commit message (Tvrtko) Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") Fixes: 573ba126aef3 ("drm/i915/guc: Capture error state on context reset") Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Andrzej Hajda <andrzej.hajda@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Cc: Michael Cheng <michael.cheng@intel.com> Cc: Lucas De Marchi <lucas.demarchi@intel.com> Cc: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay@intel.com> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Cc: Aravind Iddamsetty <aravind.iddamsetty@intel.com> Cc: Alan Previn <alan.previn.teres.alexis@intel.com> Cc: Bruce Chang <yu.bruce.chang@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-3-John.C.Harrison@Intel.com (cherry picked from commit 3700e353781e27f1bc7222f51f2cc36cbeb9b4ec) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2023-01-30drm/i915/guc: Fix locking when searching for a hung requestJohn Harrison
intel_guc_find_hung_context() was not acquiring the correct spinlock before searching the request list. So fix that up. While at it, add some extra whitespace padding for readability. Fixes: dc0dad365c5e ("drm/i915/guc: Fix for error capture after full GPU reset with GuC") Signed-off-by: John Harrison <John.C.Harrison@Intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Cc: Michael Cheng <michael.cheng@intel.com> Cc: Lucas De Marchi <lucas.demarchi@intel.com> Cc: Tejas Upadhyay <tejaskumarx.surendrakumar.upadhyay@intel.com> Cc: Chris Wilson <chris.p.wilson@intel.com> Cc: Bruce Chang <yu.bruce.chang@intel.com> Cc: Alan Previn <alan.previn.teres.alexis@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230127002842.3169194-2-John.C.Harrison@Intel.com (cherry picked from commit d1c3717501bcf56536e8b8c1bdaf5cd5357f6bb2) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2023-01-30drm/i915: Avoid potential vm use-after-freeRob Clark
Adding the vm to the vm_xa table makes it visible to userspace, which could try to race with us to close the vm. So we need to take our extra reference before putting it in the table. Signed-off-by: Rob Clark <robdclark@chromium.org> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Fixes: 9ec8795e7d91 ("drm/i915: Drop __rcu from gem_context->vm") Cc: <stable@vger.kernel.org> # v5.16+ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230119173321.2825472-1-robdclark@gmail.com (cherry picked from commit 99343c46d4e2b34c285d3d5f68ff04274c2f9fb4) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2023-01-30Merge tag 'fscache-fixes-20230130' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull fscache fixes from David Howells: "Fix two problems in fscache volume handling: - wake_up_bit() is incorrectly paired with wait_var_event(). The latter selects the waitqueue to use differently. - Missing barriers ordering between state bit and task state" * tag 'fscache-fixes-20230130' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work() fscache: Use wait_on_bit() to wait for the freeing of relinquished volume
2023-01-30Documentation: power: correct spellingRandy Dunlap
Correct spelling problems for Documentation/power/ as reported by codespell. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2023-01-30Merge tag 'tegra-for-6.3-arm64-dt' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/dt arm64: tegra: Device tree changes for v6.3-rc1 There are two big changes in this: one is to bump the #address-cells and the #size-cells properties to 2 so that bus address translations work correctly and another to sort nodes according to a scheme that we've been trying to follow, but where some inconsistencies have accumulated over the years. As for the rest, this adds mostly new things on Tegra234, such as USB host and device support and identification EEPROMs found on Jetson AGX Orin. Some cleanups are also included, such as the removal of unneeded properties or duplicated nodes. * tag 'tegra-for-6.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Drop I2C iommus and dma-coherent properties arm64: tegra: Mark host1x as dma-coherent on Tegra194/234 arm64: tegra: Populate the XUDC node for Tegra234 arm64: tegra: Add dma-coherent property for Tegra194 XUDC arm64: tegra: Populate Jetson AGX Orin EEPROMs arm64: tegra: Populate address/size cells for Tegra234 I2C arm64: tegra: Enable XUSB host function on Jetson AGX Orin arm64: tegra: Sort nodes by unit-address, then alphabetically arm64: tegra: Bump #address-cells and #size-cells arm64: tegra: Sort includes arm64: tegra: Fix duplicate regulator on Jetson TX1 arm64: tegra: Fix typo in gpio-ranges property Link: https://lore.kernel.org/r/20230127163719.460954-3-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'tegra-for-6.3-arm-dt' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/dt ARM: tegra: Device tree changes for v6.3-rc1 Just a single patch to properly sort nodes and make the DTS files easier to read. * tag 'tegra-for-6.3-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: Sort nodes by unit-address, then alphabetically Link: https://lore.kernel.org/r/20230127163719.460954-2-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'tegra-for-6.3-dt-bindings' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/dt dt-bindings: Changes for v6.3-rc1 Device tree files for 64-bit ARM Tegra SoCs have recently had to bump the #address-cells and #size-cells to 2 in order to support bus address translations across the entire device tree hierarchy. Explicitly allow this in DT schemas to prevent validation errors. * tag 'tegra-for-6.3-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: tegra: Allow #{address,size}-cells = <2> Link: https://lore.kernel.org/r/20230127163719.460954-1-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'renesas-dts-for-v6.3-tag2' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/dt Renesas DT updates for v6.3 (take two) - High Performance mode (1.8 GHz) support for the Cortex-A76 CPU cores on R-Car V4H, - GPIO interrupt support for the RZ/G2UL SoC and the RZ/G2UL SMARC EVK development board, - USB Function support for the RZ/N1D SoC, - Generic Sound Card driver examples for the Renesas R-Car Starter Kit Premier/Pro and Shimafugi Kingfisher development board stack, - Universal Flash Storage support for the Renesas Spider development board, - External Power Sequence Controller (PWC) support for the RZ/V2M SoC and the RZ/V2M Evaluation Kit 2.0, - IOMMU support for MMC on the R-Car S4-8 SoC, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v6.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (25 commits) arm64: dts: renesas: r8a779f0: Add iommus to MMC node arm64: dts: renesas: v2mevk2: Add PWC support arm64: dts: renesas: r9a09g011: Add PWC support arm64: dts: renesas: r9a09g011: Reword ethernet status arm64: dts: renesas: r8a774[be]1-beacon: Sync aliases with RZ/G2M arm64: dts: renesas: beacon-renesom: Fix audio clock rate arm64: dts: renesas: beacon-renesom: Update Ethernet PHY ID arm64: dts: renesas: beacon-renesom: Fix gpio expander reference arm64: dts: renesas: spider-cpu: Enable UFS device arm64: dts: renesas: Add ulcb{-kf} Simple Audio Card MIX + TDM Split dtsi arm64: dts: renesas: Add ulcb{-kf} Audio Graph Card MIX + TDM Split dtsi arm64: dts: renesas: Add ulcb{-kf} Audio Graph Card2 MIX + TDM Split dtsi arm64: dts: renesas: Add ulcb{-kf} Simple Audio Card dtsi arm64: dts: renesas: Add ulcb{-kf} Audio Graph Card2 dtsi arm64: dts: renesas: Add ulcb{-kf} Audio Graph Card dtsi arm64: dts: renesas: #sound-dai-cells is used when simple-card ARM: dts: renesas: #sound-dai-cells is used when simple-card arm64: dts: renesas: eagle: Add SCIF_CLK support ARM: dts: r9a06g032: Add the USBF controller node arm64: dts: renesas: rzg2ul-smarc-som: Add PHY interrupt support for ETH{0/1} ... Link: https://lore.kernel.org/r/cover.1674815099.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'renesas-dt-bindings-for-v6.3-tag1' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/dt Renesas DT binding updates for v6.3 - Document support for the Renesas RZ/V2M External Power Sequence Controller (PWC). * tag 'renesas-dt-bindings-for-v6.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: dt-bindings: soc: renesas: Add RZ/V2M PWC Link: https://lore.kernel.org/r/cover.1674815097.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'qcom-arm64-for-6.3' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/dt Qualcomm ARM64 Devicetree updates for v6.3 This introduces support for the new Snapdragon 8 Gen 2 (SM8550) platform. In addition to the adding support for the MTP on this platform, support the following devices is introduced: - GPLUS FL8005A - Google Zombie with LTE and NVMe - Google Zombie with NVMe - Lenovo Tab P11 - Motorola G5 Plus - Motorola G7 Power - Motorola Moto G6 - Samsung Galaxy J5 (2016) - Samsung Galaxy Tab A 8.0 - Samsung Galaxy Tab A 9.7 - Xiaomi Mi A1 - Xiaomi Mi A2 Lite - Xiaomi Redmi 5 Plus - Xiaomi Redmi Note 4X On IPQ8074 the PCIe PHY register regions and PHY clock names are corrected. On MSM8916 DMA for the I2C controllers are introduced and blsp_dma is unconditionally enabled. Per-sensor calibration data is provided for the thermal sensor (tsens) block. The GPLUS FL8005A device is introduced and gains support for touchscreen and flash LED. An additional Samsung Galaxy J5 variant is added, and support is added for hall sensor and MUIC. Per-sensor calibration information is introduced for the thermal sensor on MSM8956 as well. On MSM8996, GPLL0 is added as a possible Kryo clock controller input, a carveout is added to get modem metadata out of System RAM. Missing bus clocks are added for agnoc2. SDHCI1 is enabled on the Sony Xperia Tone platform and USB is limited to high-speed, to make USB work. MSM8998 gains the same modem carveout as other platforms, and the description of the clock hierarchy is improved. On QCS404 the clock hierarchy description is improved, the CDSP PAS node is adjusted to match the binding and the thermal sensor (tsens) gains per-sensor calibration information. On SC7180 the Data Capture and Compare block is intorduced, and a carveout for the modem metadata is introduced, to get this out of System RAM. Pazquel360 gains touchscreen support, the regulator off-on-time is adjusted for the Trogdor eDP and touchscreen. Data lane and frequency properties are introduced for the DisplayPort links. SC7280 also gets Data Capture and Compare support, as well as the dedicated modem metadata region. Herobrine gains DP audio support. IPA description is updated so that it's only active on boards with a modem. On SC8280XP the display subsystem is introduced, currently with support for most of the DisplayPort controllers. GPR, SoundWire and LPASS is introduced, for audio support. Missing I2C and SPI controllers are introduced. Support for EDP is introduced for the CRD, the Lenovo ThinkPad X13s and the SA8295P ADP automotive board. The SA8540P Ride platform enables one i2c and pcie controllers. A CMA region is defined for the CRD and X13s, to avoid allocation issues from the NVMe support. Fairphone FP3 gains NFC support and the Sony Xperia Nile platform gains a description of simplefb. SDM670 gains QFPROM definition. SDM845 gains a carveout for the modem metadata and support for the Data Capture and Compare block is introduced. Lenovo Yoga C630 firmware paths are aligned with all other Qualcomm platforms. On SM6125 apss SMMU is introduced and streams are defined for USB and SDHCI controllers. GPI DMA description is introduced, as well as missing SPI and I2C serial engines. On Sony Xperia 10 IIa regulator definitions are improved, SDHCI2 is introduced, and I2C and related GPI DMA blocks are enabled. On SM6350 IPA is introduced. DDR and L3 scaling is introduced based on CPUfreq. Fairphone FP4, on SM7225 also has IPA enabled, and the Flash LED is enabled as well. On SM8150 the display subsystem is introduced, with clock controller, DPU and two DSI controllers. The Data Capture and Compare block is introduced. For the Sony Xperia Kumano platform, GPIO keys and NFC support is introduced. For SM8350 PCIe is introduced, as is the display subsystem with display clock controller, DPU and two DSI controllers. #interconnect-cells is changed to 2, to align with other platforms and allow for active-only votes. The display is enabled and the LT9611uxc found on the SM8350 Hardware Development Kit board is described, to provide HDMI output. On SM8450 the display subsystem is introduced, with DPU and two DSI controllers. GIC-ITS support is introduced for both PCIe0 and PCIe1. SPMI bus support is introduced and pmics are wired up across the various devices. The display subsystem is enabled and the LT9611uxc is described to provide HDMI output on the SM8450 Hardware Development Kit. On Sony Xperia Nagara platform, GPIO keys and GPIO line names are introduced. As is the SLG51000 PMIC and camera regulators are defined. Support for SM8550 is introduced, with support for storage, USB, remoteprocs, PCIe, low-speed buses, crypto and display subsystem. These blocks are enabled on the MTP. Lastly, the work continue to align Devicetree source with bindings across all platforms. * tag 'qcom-arm64-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (320 commits) arm64: dts: qcom: sc7280: Add a carveout for modem metadata arm64: dts: qcom: sc7180: Add a carveout for modem metadata arm64: dts: qcom: sdm845: Add a carveout for modem metadata arm64: dts: qcom: msm8998: Add a carveout for modem metadata arm64: dts: qcom: msm8996: Add a carveout for modem metadata arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names arm64: dts: qcom: ipq8074: fix Gen3 PCIe node arm64: dts: qcom: ipq8074: set Gen2 PCIe pcie max-link-speed arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY arm64: dts: qcom: sdm845-db845c: drop label from I2C controllers arm64: dts: qcom: msm8996: support using GPLL0 as kryocc input arm64: dts: qcom: sm8450: Allow both GIC-ITS and internal MSI controller arm64: dts: qcom: sm8550-mtp: Add USB PHYs and HC nodes arm64: dts: qcom: sm8550: Add USB PHYs and controller nodes arm64: dts: qcom: sm8250: drop unused properties from tx-macro arm64: dts: qcom: sm8250: drop unused clock-frequency from wsa-macro arm64: dts: qcom: align OPP table node name with DT schema arm64: dts: qcom: rename mdp nodes to display-controller ... Link: https://lore.kernel.org/r/20230126202528.3691539-1-andersson@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'riscv-dt-for-v6.3-mw0' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/dt RISC-V Devicetrees for v6.3-mw0 Microchip: A vendor prefix for Aldec and both a binding and Devicetree for the Aldec TySoM devkit for PolarFire SoC. This Devicetree corresponds to what they are shipping in the SDK for rev2 boards. StarFive: Just the binding for the new StarFive JH7110 SoC and its first-party SDC the VisionFive 2. Other: I was expecting the Devicetree for the aforementioned board to be ready for this window, as the pinctrl driver had seem some review prior to v6.2 and both it & the base clock drivers are heavily based on the existing drivers for the JH7110. That didn't come to be.. Christmas, the RISC-V Summit in December and the Lunar New Year all playing a part perhaps. Because of that, both Palmer and I have the Kconfig.socs work in our branches, although in hindsight it probably wasn't needed here as I only added the TySoM Devicetree & the conflict would've been trivial. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> * tag 'riscv-dt-for-v6.3-mw0' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: microchip: add the Aldec TySoM's devicetree dt-bindings: riscv: microchip: document the Aldec TySoM dt-bindings: vendor-prefixes: Add entry for Aldec RISC-V: stop directly selecting drivers for SOC_CANAAN RISC-V: stop selecting SiFive clock and serial drivers directly RISC-V: stop selecting the PolarFire SoC clock driver RISC-V: kbuild: convert all use of SOC_FOO to ARCH_FOO RISC-V: kconfig.socs: convert usage of SOC_CANAAN to ARCH_CANAAN RISC-V: introduce ARCH_FOO kconfig aliases for SOC_FOO symbols dt-bindings: riscv: Add StarFive JH7110 SoC and VisionFive 2 board Link: https://lore.kernel.org/r/Y9LP+Za1h0fkBa58@spud Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'qcom-dts-for-6.3' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/dt Qualcomm ARM DT updates for v6.3 This introduces support for Acer Iconia Talk S A1-724 The Samsung Galaxy Tab 4 10.1 gains ADSP and backlight support. The Xperia Z2 Tablet gets charging enabled and the touchscreen is given a little bit more time to start up. APQ8064 and MSM8974 gains improvements in clock hierarchy. APQ8064 thermal sensor (tsens) driver gains per-censor calibration data. Lastly a set of patches that improves DT binding compliance. * tag 'qcom-dts-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (50 commits) ARM: dts: qcom: msm8226: add RPMCC node ARM: dts: qcom: apq8084: add clocks and clock-names to gcc device ARM: dts: qcom: align OPP table node name with DT schema ARM: dts: qcom: rename mdp nodes to display-controller ARM: dts: qcom-msm8974: rename mdss node to display-subsystem ARM: dts: qcom-msm8974: add SoC specific compat string to mdp5 node dt-bindings: qcom: Document samsung,gt58 and gt510 dt-bindings: qcom: Document bindings for msm8916-samsung-j5x ARM: dts: qcom: use qcom,gsi-loader for IPA ARM: dts: qcom-apq8084: specify per-sensor calibration cells ARM: dts: qcom-msm8974: specify per-sensor calibration cells dt-bindings: arm: qcom: Document MSM8939 SoC binding ARM: dts: qcom: msm8974: add xo clock to rpm clock controller dt-bindings: qcom: Document msm8916-gplus-fl8005a dt-bindings: vendor-prefixes: Add GPLUS ARM: dts: qcom: apq8026-samsung-matisse-wifi: Add display backlight dt-bindings: arm: qcom: Add SM6115(P) and Lenovo Tab P11 ARM: dts: qcom: add missing space before { dt-bindings: arm: qcom: add board-id/msm-id for MSM8956, SDM636 and SM4250 dt-bindings: arm: qcom: Add zombie with NVMe ... Link: https://lore.kernel.org/r/20230126174725.3681745-1-andersson@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'imx-fixes-6.2-2' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.2, round 2: - Update MAINTAINERS i.MX entry to match arm64 freescale DTS. - Drop misused 'uart-has-rtscts' from imx8m-venice boards. - Fix USB host over-current polarity for imx7d-smegw01 board. - Fix a typo in i.MX8DXL sc_pwrkey property name. - Fix GPIO watchdog property for i.MX8MM eDM SBC board. - Keep Ethernet PHY powered on imx8mm-verdin to avoid kernel crash. - Fix configuration of i.MX8MM pad UART1_DTE_RX. * tag 'imx-fixes-6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx7d-smegw01: Fix USB host over-current polarity arm64: dts: imx8mm-verdin: Do not power down eth-phy MAINTAINERS: match freescale ARM64 DT directory in i.MX entry arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX arm64: dts: freescale: imx8dxl: fix sc_pwrkey's property name linux,keycode arm64: dts: imx8m-venice: Remove incorrect 'uart-has-rtscts' arm64: dts: imx8mm: Reinstate GPIO watchdog always-running property on eDM SBC Link: https://lore.kernel.org/r/20230130003614.GP20713@T480 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30Merge tag 'sunxi-fixes-for-6.2-1' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes - Fix error handling in RSB init * tag 'sunxi-fixes-for-6.2-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: bus: sunxi-rsb: Fix error handling in sunxi_rsb_init() Link: https://lore.kernel.org/r/Y9RWcDdO0nj98KVj@jernej-laptop Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30MAINTAINERS: amd: drop inactive Brijesh SinghKrzysztof Kozlowski
Emails to Brijesh Singh bounce ("550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup"). Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Link: https://lore.kernel.org/r/20230127105935.99174-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2023-01-30block: Default to use cgroup support for BFQUlf Hansson
Assuming that both Kconfig options, BLK_CGROUP and IOSCHED_BFQ are set, we most likely want cgroup support for BFQ too (BFQ_GROUP_IOSCHED), so let's make it default y. Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://lore.kernel.org/r/20230130121240.159456-1-ulf.hansson@linaro.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
2023-01-30KVM: selftests: Fix build of rseq testMark Brown
The KVM rseq test is failing to build in -next due to a commit merged from the tip tree which adds a wrapper for sys_getcpu() to the rseq kselftests, conflicting with the wrapper already included in the KVM selftest: rseq_test.c:48:13: error: conflicting types for 'sys_getcpu' 48 | static void sys_getcpu(unsigned *cpu) | ^~~~~~~~~~ In file included from rseq_test.c:23: ../rseq/rseq.c:82:12: note: previous definition of 'sys_getcpu' was here 82 | static int sys_getcpu(unsigned *cpu, unsigned *node) | ^~~~~~~~~~ Fix this by removing the local wrapper and moving the result check up to the caller. Fixes: 99babd04b250 ("selftests/rseq: Implement rseq numa node id field selftest") Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Link: https://lore.kernel.org/r/20230106-fix-kvm-rseq-build-v1-1-b704d9831d02@kernel.org
2023-01-30MAINTAINERS: Promote Krzysztof to PCI controller maintainerLorenzo Pieralisi
Krzysztof has contributed significantly to the PCI controller subsystem recently through reviews, tooling and submissions. Update the MAINTAINERS file to grant him the role he deserves. Link: https://lore.kernel.org/r/20230130100850.24994-1-lpieralisi@kernel.org Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: Krzysztof Wilczyński <kw@linux.com>
2023-01-30watchdog: diag288_wdt: fix __diag288() inline assemblyAlexander Egorenkov
The DIAG 288 statement consumes an EBCDIC string the address of which is passed in a register. Use a "memory" clobber to tell the compiler that memory is accessed within the inline assembly. Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Cc: <stable@vger.kernel.org> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2023-01-30watchdog: diag288_wdt: do not use stack buffers for hardware dataAlexander Egorenkov
With CONFIG_VMAP_STACK=y the stack is allocated from the vmalloc space. Data passed to a hardware or a hypervisor interface that requires V=R can no longer be allocated on the stack. Use kmalloc() to get memory for a diag288 command. Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Cc: <stable@vger.kernel.org> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2023-01-30platform/x86: thinkpad_acpi: Fix thinklight LED brightness returning 255Hans de Goede
Reading the thinklight LED brightnes while the LED is on returns 255 (LED_FULL) but we advertise a max_brightness of 1, so this should be 1 (LED_ON). Fixes: db5e2a4ca0a7 ("platform/x86: thinkpad_acpi: Fix max_brightness of thinklight") Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20230127235723.412864-1-hdegoede@redhat.com
2023-01-30platform/x86/amd: pmc: add CONFIG_SERIO dependencyArnd Bergmann
Using the serio subsystem now requires the code to be reachable: x86_64-linux-ld: drivers/platform/x86/amd/pmc.o: in function `amd_pmc_suspend_handler': pmc.c:(.text+0x86c): undefined reference to `serio_bus' Add the usual dependency: as other users of serio use 'select' rather than 'depends on', use the same here. Fixes: 8e60615e8932 ("platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20230127093950.2368575-1-arnd@kernel.org Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-01-30platform/x86/amd/pmf: Ensure mutexes are initialized before useHans de Goede
As soon as the first handler or sysfs file is registered the mutex may get used. Move the initialization to before any handler registration / sysfs file creation. Likewise move the destruction of the mutex to after all the de-initialization is done. Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer") Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20230130132554.696025-1-hdegoede@redhat.com
2023-01-30platform/x86/amd/pmf: Fix to update SPS thermals when power supply changeShyam Sundar S K
Every power mode of static power slider has its own AC and DC power settings. When the power source changes from AC to DC, corresponding DC thermals were not updated from PMF config store and this leads the system to always run on AC power settings. Fix it by registering with power_supply notifier and apply DC settings upon getting notified by the power_supply handler. Fixes: da5ce22df5fe ("platform/x86/amd/pmf: Add support for PMF core layer") Suggested-by: Patil Rajesh Reddy <Patil.Reddy@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://lore.kernel.org/r/20230125095936.3292883-6-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-01-30platform/x86/amd/pmf: Fix to update SPS default pprof thermalsShyam Sundar S K
By design PMF static slider will be set to BALANCED during init, but updating to corresponding thermal values from the PMF config store was missed, leading to improper settings getting propagated to PMFW. Fixes: 4c71ae414474 ("platform/x86/amd/pmf: Add support SPS PMF feature") Suggested-by: Patil Rajesh Reddy <Patil.Reddy@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://lore.kernel.org/r/20230125095936.3292883-5-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-01-30platform/x86/amd/pmf: update to auto-mode limits only after AMT eventShyam Sundar S K
Auto-mode thermal limits should be updated only after receiving the AMT event. But due to a bug in the older commit, these settings were getting applied during the auto-mode init. Fix this by removing amd_pmf_set_automode() during auto-mode initialization. Fixes: 3f5571d99524 ("platform/x86/amd/pmf: Add support for Auto mode feature") Suggested-by: Patil Rajesh Reddy <Patil.Reddy@amd.com> Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://lore.kernel.org/r/20230125095936.3292883-4-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-01-30platform/x86/amd/pmf: Add helper routine to check pprof is balancedShyam Sundar S K
Add helper routine to check if the current platform profile is balanced mode and remove duplicate code occurrences. Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://lore.kernel.org/r/20230125095936.3292883-3-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-01-30platform/x86/amd/pmf: Add helper routine to update SPS thermalsShyam Sundar S K
Add helper routine to update the static slider information and remove the duplicate code occurrences after this change. Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://lore.kernel.org/r/20230125095936.3292883-2-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
2023-01-30ASoC: rt715-sdca: fix clock stop prepare timeout issueJack Yu
Modify clock_stop_timeout value for rt715-sdca according to the requirement of internal clock trimming. Signed-off-by: Jack Yu <jack.yu@realtek.com> Link: https://lore.kernel.org/r/574b6586267a458cac78c5ac4d5b10bd@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2023-01-30fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()Hou Tao
fscache_create_volume_work() uses wake_up_bit() to wake up the processes which are waiting for the completion of volume creation. According to comments in wake_up_bit() and waitqueue_active(), an extra smp_mb() is needed to guarantee the memory order between FSCACHE_VOLUME_CREATING flag and waitqueue_active() before invoking wake_up_bit(). Fixing it by using clear_and_wake_up_bit() to add the missing memory barrier. Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com> Signed-off-by: Hou Tao <houtao1@huawei.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Link: https://lore.kernel.org/r/20230113115211.2895845-3-houtao@huaweicloud.com/ # v3
2023-01-30fscache: Use wait_on_bit() to wait for the freeing of relinquished volumeHou Tao
The freeing of relinquished volume will wake up the pending volume acquisition by using wake_up_bit(), however it is mismatched with wait_var_event() used in fscache_wait_on_volume_collision() and it will never wake up the waiter in the wait-queue because these two functions operate on different wait-queues. According to the implementation in fscache_wait_on_volume_collision(), if the wake-up of pending acquisition is delayed longer than 20 seconds (e.g., due to the delay of on-demand fd closing), the first wait_var_event_timeout() will timeout and the following wait_var_event() will hang forever as shown below: FS-Cache: Potential volume collision new=00000024 old=00000022 ...... INFO: task mount:1148 blocked for more than 122 seconds. Not tainted 6.1.0-rc6+ #1 task:mount state:D stack:0 pid:1148 ppid:1 Call Trace: <TASK> __schedule+0x2f6/0xb80 schedule+0x67/0xe0 fscache_wait_on_volume_collision.cold+0x80/0x82 __fscache_acquire_volume+0x40d/0x4e0 erofs_fscache_register_volume+0x51/0xe0 [erofs] erofs_fscache_register_fs+0x19c/0x240 [erofs] erofs_fc_fill_super+0x746/0xaf0 [erofs] vfs_get_super+0x7d/0x100 get_tree_nodev+0x16/0x20 erofs_fc_get_tree+0x20/0x30 [erofs] vfs_get_tree+0x24/0xb0 path_mount+0x2fa/0xa90 do_mount+0x7c/0xa0 __x64_sys_mount+0x8b/0xe0 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Considering that wake_up_bit() is more selective, so fix it by using wait_on_bit() instead of wait_var_event() to wait for the freeing of relinquished volume. In addition because waitqueue_active() is used in wake_up_bit() and clear_bit() doesn't imply any memory barrier, use clear_and_wake_up_bit() to add the missing memory barrier between cursor->flags and waitqueue_active(). Fixes: 62ab63352350 ("fscache: Implement volume registration") Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com> Signed-off-by: Hou Tao <houtao1@huawei.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Link: https://lore.kernel.org/r/20230113115211.2895845-2-houtao@huaweicloud.com/ # v3
2023-01-30xfrm: fix bug with DSCP copy to v6 from v4 tunnelChristian Hopps
When copying the DSCP bits for decap-dscp into IPv6 don't assume the outer encap is always IPv6. Instead, as with the inner IPv4 case, copy the DSCP bits from the correctly saved "tos" value in the control block. Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input") Signed-off-by: Christian Hopps <chopps@chopps.org> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2023-01-30RDMA/usnic: use iommu_map_atomic() under spin_lock()Yang Yingliang
usnic_uiom_map_sorted_intervals() is called under spin_lock(), iommu_map() might sleep, use iommu_map_atomic() to avoid potential sleep in atomic context. Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20230129093757.637354-1-yangyingliang@huawei.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2023-01-30net: phy: fix null dereference in phy_attach_directColin Foster
Commit bc66fa87d4fd ("net: phy: Add link between phy dev and mac dev") introduced a link between net devices and phy devices. It fails to check whether dev is NULL, leading to a NULL dereference error. Fixes: bc66fa87d4fd ("net: phy: Add link between phy dev and mac dev") Signed-off-by: Colin Foster <colin.foster@in-advantage.com> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-01-30powerpc/64: Fix perf profiling asynchronous interrupt handlersNicholas Piggin
Interrupt entry sets the soft mask to IRQS_ALL_DISABLED to match the hard irq disabled state. So when should_hard_irq_enable() returns true because we want PMI interrupts in irq handlers, MSR[EE] is enabled but PMIs just get soft-masked. Fix this by clearing IRQS_PMI_DISABLED before enabling MSR[EE]. This also tidies some of the warnings, no need to duplicate them in both should_hard_irq_enable() and do_hard_irq_enable(). Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20230121100156.2824054-1-npiggin@gmail.com
2023-01-30powerpc/64s: Fix local irq disable when PMIs are disabledNicholas Piggin
When PMI interrupts are soft-masked, local_irq_save() will clear the PMI mask bit, allowing PMIs in and causing a race condition. This causes a deadlock in native_hpte_insert via hash_preload, which depends on PMIs being disabled since commit 8b91cee5eadd ("powerpc/64s/hash: Make hash faults work in NMI context"). native_hpte_insert calls local_irq_save(). It's possible the lpar hash code is also affected when tracing is enabled because __trace_hcall_entry() calls local_irq_save(). Fix this by making arch_local_irq_save() _or_ the IRQS_DISABLED bit into the mask. This was found with the stress_hpt option with a kbuild workload running together with `perf record -g`. Fixes: f442d004806e ("powerpc/64s: Add support to mask perf interrupts and replay them") Fixes: 8b91cee5eadd ("powerpc/64s/hash: Make hash faults work in NMI context") Signed-off-by: Nicholas Piggin <npiggin@gmail.com> [mpe: Just take the fix without the new warning] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20230121095352.2823517-1-npiggin@gmail.com
2023-01-30netrom: Fix use-after-free caused by accept on already connected socketHyunwoo Kim
If you call listen() and accept() on an already connect()ed AF_NETROM socket, accept() can successfully connect. This is because when the peer socket sends data to sendmsg, the skb with its own sk stored in the connected socket's sk->sk_receive_queue is connected, and nr_accept() dequeues the skb waiting in the sk->sk_receive_queue. As a result, nr_accept() allocates and returns a sock with the sk of the parent AF_NETROM socket. And here use-after-free can happen through complex race conditions: ``` cpu0 cpu1 1. socket_2 = socket(AF_NETROM) . . listen(socket_2) accepted_socket = accept(socket_2) 2. socket_1 = socket(AF_NETROM) nr_create() // sk refcount : 1 connect(socket_1) 3. write(accepted_socket) nr_sendmsg() nr_output() nr_kick() nr_send_iframe() nr_transmit_buffer() nr_route_frame() nr_loopback_queue() nr_loopback_timer() nr_rx_frame() nr_process_rx_frame(sk, skb); // sk : socket_1's sk nr_state3_machine() nr_queue_rx_frame() sock_queue_rcv_skb() sock_queue_rcv_skb_reason() __sock_queue_rcv_skb() __skb_queue_tail(list, skb); // list : socket_1's sk->sk_receive_queue 4. listen(socket_1) nr_listen() uaf_socket = accept(socket_1) nr_accept() skb_dequeue(&sk->sk_receive_queue); 5. close(accepted_socket) nr_release() nr_write_internal(sk, NR_DISCREQ) nr_transmit_buffer() // NR_DISCREQ nr_route_frame() nr_loopback_queue() nr_loopback_timer() nr_rx_frame() // sk : socket_1's sk nr_process_rx_frame() // NR_STATE_3 nr_state3_machine() // NR_DISCREQ nr_disconnect() nr_sk(sk)->state = NR_STATE_0; 6. close(socket_1) // sk refcount : 3 nr_release() // NR_STATE_0 sock_put(sk); // sk refcount : 0 sk_free(sk); close(uaf_socket) nr_release() sock_hold(sk); // UAF ``` KASAN report by syzbot: ``` BUG: KASAN: use-after-free in nr_release+0x66/0x460 net/netrom/af_netrom.c:520 Write of size 4 at addr ffff8880235d8080 by task syz-executor564/5128 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x461 mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x141/0x190 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] sock_hold include/net/sock.h:775 [inline] nr_release+0x66/0x460 net/netrom/af_netrom.c:520 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x1c/0x20 net/socket.c:1365 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaa8/0x2950 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x21c3/0x2450 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f6c19e3c9b9 Code: Unable to access opcode bytes at 0x7f6c19e3c98f. RSP: 002b:00007fffd4ba2ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: 0000000000000116 RBX: 0000000000000003 RCX: 00007f6c19e3c9b9 RDX: 0000000000000318 RSI: 00000000200bd000 RDI: 0000000000000006 RBP: 0000000000000003 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 000055555566a2c0 R13: 0000000000000011 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 5128: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0xd0 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x140/0x290 net/core/sock.c:2038 sk_alloc+0x3a/0x7a0 net/core/sock.c:2091 nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433 __sock_create+0x359/0x790 net/socket.c:1515 sock_create net/socket.c:1566 [inline] __sys_socket_create net/socket.c:1603 [inline] __sys_socket_create net/socket.c:1588 [inline] __sys_socket+0x133/0x250 net/socket.c:1636 __do_sys_socket net/socket.c:1649 [inline] __se_sys_socket net/socket.c:1647 [inline] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 5128: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:177 [inline] __cache_free mm/slab.c:3394 [inline] __do_kmem_cache_free mm/slab.c:3580 [inline] __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587 sk_prot_free net/core/sock.c:2074 [inline] __sk_destruct+0x5df/0x750 net/core/sock.c:2166 sk_destruct net/core/sock.c:2181 [inline] __sk_free+0x175/0x460 net/core/sock.c:2192 sk_free+0x7c/0xa0 net/core/sock.c:2203 sock_put include/net/sock.h:1991 [inline] nr_release+0x39e/0x460 net/netrom/af_netrom.c:554 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x1c/0x20 net/socket.c:1365 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaa8/0x2950 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x21c3/0x2450 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd ``` To fix this issue, nr_listen() returns -EINVAL for sockets that successfully nr_connect(). Reported-by: syzbot+caa188bdfc1eeafeb418@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-01-30net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoCAndrey Konovalov
Currently in phy_init_eee() the driver unconditionally configures the PHY to stop RX_CLK after entering Rx LPI state. This causes an LPI interrupt storm on my qcs404-base board. Change the PHY initialization so that for "qcom,qcs404-ethqos" compatible device RX_CLK continues to run even in Rx LPI state. Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2023-01-30powerpc/kvm: Fix unannotated intra-function call warningSathvika Vasireddy
objtool throws the following warning: arch/powerpc/kvm/booke.o: warning: objtool: kvmppc_fill_pt_regs+0x30: unannotated intra-function call Fix the warning by setting the value of 'nip' using the _THIS_IP_ macro, without using an assembly bl/mflr sequence to save the instruction pointer. Reported-by: kernel test robot <lkp@intel.com> Suggested-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Sathvika Vasireddy <sv@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20230128124158.1066251-1-sv@linux.ibm.com
2023-01-30powerpc/85xx: Fix unannotated intra-function call warningSathvika Vasireddy
objtool throws the following warning: arch/powerpc/kernel/head_85xx.o: warning: objtool: .head.text+0x1a6c: unannotated intra-function call Fix the warning by annotating KernelSPE symbol with SYM_FUNC_START_LOCAL and SYM_FUNC_END macros. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Sathvika Vasireddy <sv@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20230128124138.1066176-1-sv@linux.ibm.com
2023-01-29block, bfq: remove unused bfq_wr_max_time in struct bfq_dataKemeng Shi
bfqd->bfq_wr_max_time is set to 0 in bfq_init_queue and is never changed. It is only used in bfq_wr_duration when bfq_wr_max_time > 0 which never meets, so bfqd->bfq_wr_max_time is not used actually. Just remove it. Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230116095153.3810101-9-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2023-01-29block, bfq: remove unnecessary goto tag in bfq_dispatch_rq_from_bfqqKemeng Shi
We jump to tag only for returning current rq. Return directly to remove this tag. Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Link: https://lore.kernel.org/r/20230116095153.3810101-8-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2023-01-29block, bfq: remove redundant check in bfq_put_cooperatorKemeng Shi
We have already avoided a circular list in bfq_setup_merge (see comments in bfq_setup_merge() for details), so bfq_queue will not appear in it's new_bfqq list. Just remove this check. Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230116095153.3810101-7-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2023-01-29block, bfq: remove unnecessary dereference to get async_bfqqKemeng Shi
The async_bfqq is assigned with bfqq->bic->bfqq[0], use it directly. Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230116095153.3810101-6-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2023-01-29block, bfq: use helper macro RQ_BFQQ to get bfqq of requestKemeng Shi
Use helper macro RQ_BFQQ to get bfqq of request. Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com> Reviewed-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230116095153.3810101-5-shikemeng@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
generated by cgit (git 2.34.1) at 2025-09-19 00:20:44 +0000