diff -u linux-kvm-5.19.0/Documentation/process/code-of-conduct-interpretation.rst linux-kvm-5.19.0/Documentation/process/code-of-conduct-interpretation.rst --- linux-kvm-5.19.0/Documentation/process/code-of-conduct-interpretation.rst +++ linux-kvm-5.19.0/Documentation/process/code-of-conduct-interpretation.rst @@ -51,7 +51,7 @@ uncertain how to handle situations that come up. It will not be considered a violation report unless you want it to be. If you are uncertain about approaching the TAB or any other maintainers, please -reach out to our conflict mediator, Joanna Lee . +reach out to our conflict mediator, Joanna Lee . In the end, "be kind to each other" is really what the end goal is for everybody. We know everyone is human and we all fail at times, but the diff -u linux-kvm-5.19.0/arch/arm/mach-at91/pm_suspend.S linux-kvm-5.19.0/arch/arm/mach-at91/pm_suspend.S --- linux-kvm-5.19.0/arch/arm/mach-at91/pm_suspend.S +++ linux-kvm-5.19.0/arch/arm/mach-at91/pm_suspend.S @@ -169,10 +169,15 @@ cmp tmp1, #UDDRC_STAT_SELFREF_TYPE_SW bne sr_ena_2 - /* Put DDR PHY's DLL in bypass mode for non-backup modes. */ + /* Disable DX DLLs for non-backup modes. */ cmp r7, #AT91_PM_BACKUP beq sr_ena_3 + /* Do not soft reset the AC DLL. */ + ldr tmp1, [r3, DDR3PHY_ACDLLCR] + bic tmp1, tmp1, DDR3PHY_ACDLLCR_DLLSRST + str tmp1, [r3, DDR3PHY_ACDLLCR] + /* Disable DX DLLs. */ ldr tmp1, [r3, #DDR3PHY_DX0DLLCR] orr tmp1, tmp1, #DDR3PHY_DXDLLCR_DLLDIS diff -u linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts --- linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts +++ linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mm-tqma8mqml-mba8mx.dts @@ -34,11 +34,25 @@ off-on-delay-us = <12000>; }; - extcon_usbotg1: extcon-usbotg1 { - compatible = "linux,extcon-usb-gpio"; + connector { + compatible = "gpio-usb-b-connector", "usb-b-connector"; + type = "micro"; + label = "X19"; pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_usb1_extcon>; - id-gpio = <&gpio1 10 GPIO_ACTIVE_HIGH>; + pinctrl-0 = <&pinctrl_usb1_connector>; + id-gpios = <&gpio1 10 GPIO_ACTIVE_HIGH>; + + ports { + #address-cells = <1>; + #size-cells = <0>; + + port@0 { + reg = <0>; + usb_dr_connector: endpoint { + remote-endpoint = <&usb1_drd_sw>; + }; + }; + }; }; }; @@ -105,13 +119,19 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_usbotg1>; dr_mode = "otg"; - extcon = <&extcon_usbotg1>; srp-disable; hnp-disable; adp-disable; power-active-high; over-current-active-low; + usb-role-switch; status = "okay"; + + port { + usb1_drd_sw: endpoint { + remote-endpoint = <&usb_dr_connector>; + }; + }; }; &usbotg2 { @@ -231,7 +251,7 @@ ; }; - pinctrl_usb1_extcon: usb1-extcongrp { + pinctrl_usb1_connector: usb1-connectorgrp { fsl,pins = ; }; diff -u linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mm.dtsi linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mm.dtsi --- linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mm.dtsi +++ linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mm.dtsi @@ -1238,10 +1238,10 @@ clocks = <&clk IMX8MM_CLK_NAND_USDHC_BUS_RAWNAND_CLK>; }; - gpmi: nand-controller@33002000{ + gpmi: nand-controller@33002000 { compatible = "fsl,imx8mm-gpmi-nand", "fsl,imx7d-gpmi-nand"; #address-cells = <1>; - #size-cells = <1>; + #size-cells = <0>; reg = <0x33002000 0x2000>, <0x33004000 0x4000>; reg-names = "gpmi-nand", "bch"; interrupts = ; diff -u linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mn.dtsi linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mn.dtsi --- linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mn.dtsi +++ linux-kvm-5.19.0/arch/arm64/boot/dts/freescale/imx8mn.dtsi @@ -1101,7 +1101,7 @@ gpmi: nand-controller@33002000 { compatible = "fsl,imx8mn-gpmi-nand", "fsl,imx7d-gpmi-nand"; #address-cells = <1>; - #size-cells = <1>; + #size-cells = <0>; reg = <0x33002000 0x2000>, <0x33004000 0x4000>; reg-names = "gpmi-nand", "bch"; interrupts = ; diff -u linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sc7280.dtsi linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sc7280.dtsi --- linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sc7280.dtsi +++ linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sc7280.dtsi @@ -2177,7 +2177,8 @@ lpass_audiocc: clock-controller@3300000 { compatible = "qcom,sc7280-lpassaudiocc"; - reg = <0 0x03300000 0 0x30000>; + reg = <0 0x03300000 0 0x30000>, + <0 0x032a9000 0 0x1000>; clocks = <&rpmhcc RPMH_CXO_CLK>, <&lpass_aon LPASS_AON_CC_MAIN_RCG_CLK_SRC>; clock-names = "bi_tcxo", "lpass_aon_cc_main_rcg_clk_src"; diff -u linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sm8250.dtsi linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sm8250.dtsi --- linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sm8250.dtsi +++ linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sm8250.dtsi @@ -332,6 +332,7 @@ exit-latency-us = <6562>; min-residency-us = <9987>; local-timer-stop; + status = "disabled"; }; }; }; diff -u linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts --- linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts +++ linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts @@ -643,7 +643,7 @@ &uart1 { pinctrl-names = "default"; - pinctrl-0 = <&uart1m0_xfer &uart1m0_ctsn>; + pinctrl-0 = <&uart1m0_xfer &uart1m0_ctsn &uart1m0_rtsn>; status = "okay"; uart-has-rtscts; @@ -651,13 +651,14 @@ compatible = "brcm,bcm43438-bt"; clocks = <&rk817 1>; clock-names = "lpo"; - device-wakeup-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>; - host-wakeup-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>; + device-wakeup-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; shutdown-gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>; pinctrl-names = "default"; pinctrl-0 = <&bt_host_wake_l &bt_wake_l &bt_enable_h>; vbat-supply = <&vcc_sys>; vddio-supply = <&vcca1v8_pmu>; + max-speed = <3000000>; }; }; diff -u linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts --- linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts +++ linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts @@ -176,7 +176,7 @@ compatible = "rockchip,rk809"; reg = <0x20>; interrupt-parent = <&gpio0>; - interrupts = ; + interrupts = ; clock-output-names = "rk808-clkout1", "rk808-clkout2"; pinctrl-names = "default"; diff -u linux-kvm-5.19.0/arch/arm64/include/asm/cputype.h linux-kvm-5.19.0/arch/arm64/include/asm/cputype.h --- linux-kvm-5.19.0/arch/arm64/include/asm/cputype.h +++ linux-kvm-5.19.0/arch/arm64/include/asm/cputype.h @@ -41,7 +41,7 @@ (((midr) & MIDR_IMPLEMENTOR_MASK) >> MIDR_IMPLEMENTOR_SHIFT) #define MIDR_CPU_MODEL(imp, partnum) \ - (((imp) << MIDR_IMPLEMENTOR_SHIFT) | \ + ((_AT(u32, imp) << MIDR_IMPLEMENTOR_SHIFT) | \ (0xf << MIDR_ARCHITECTURE_SHIFT) | \ ((partnum) << MIDR_PARTNUM_SHIFT)) diff -u linux-kvm-5.19.0/arch/arm64/kvm/arm.c linux-kvm-5.19.0/arch/arm64/kvm/arm.c --- linux-kvm-5.19.0/arch/arm64/kvm/arm.c +++ linux-kvm-5.19.0/arch/arm64/kvm/arm.c @@ -2101,6 +2101,17 @@ * once the host stage 2 is installed. */ static_branch_enable(&kvm_protected_mode_initialized); + + /* + * Fixup the boot mode so that we don't take spurious round + * trips via EL2 on cpu_resume. Flush to the PoC for a good + * measure, so that it can be observed by a CPU coming out of + * suspend with the MMU off. + */ + __boot_cpu_mode[0] = __boot_cpu_mode[1] = BOOT_CPU_MODE_EL1; + dcache_clean_poc((unsigned long)__boot_cpu_mode, + (unsigned long)(__boot_cpu_mode + 2)); + on_each_cpu(_kvm_host_prot_finalize, &ret, 1); return ret; } diff -u linux-kvm-5.19.0/arch/arm64/mm/mmu.c linux-kvm-5.19.0/arch/arm64/mm/mmu.c --- linux-kvm-5.19.0/arch/arm64/mm/mmu.c +++ linux-kvm-5.19.0/arch/arm64/mm/mmu.c @@ -516,7 +516,7 @@ */ BUILD_BUG_ON(pgd_index(direct_map_end - 1) == pgd_index(direct_map_end)); - if (can_set_direct_map() || IS_ENABLED(CONFIG_KFENCE)) + if (can_set_direct_map()) flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; /* @@ -1499,11 +1499,7 @@ VM_BUG_ON(!mhp_range_allowed(start, size, true)); - /* - * KFENCE requires linear map to be mapped at page granularity, so that - * it is possible to protect/unprotect single pages in the KFENCE pool. - */ - if (can_set_direct_map() || IS_ENABLED(CONFIG_KFENCE)) + if (can_set_direct_map()) flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; __create_pgd_mapping(swapper_pg_dir, start, __phys_to_virt(start), diff -u linux-kvm-5.19.0/arch/powerpc/Kconfig linux-kvm-5.19.0/arch/powerpc/Kconfig --- linux-kvm-5.19.0/arch/powerpc/Kconfig +++ linux-kvm-5.19.0/arch/powerpc/Kconfig @@ -283,7 +283,7 @@ # config PPC_LONG_DOUBLE_128 - depends on PPC64 + depends on PPC64 && ALTIVEC def_bool $(success,test "$(shell,echo __LONG_DOUBLE_128__ | $(CC) -E -P -)" = 1) config PPC_BARRIER_NOSPEC diff -u linux-kvm-5.19.0/arch/riscv/kernel/machine_kexec.c linux-kvm-5.19.0/arch/riscv/kernel/machine_kexec.c --- linux-kvm-5.19.0/arch/riscv/kernel/machine_kexec.c +++ linux-kvm-5.19.0/arch/riscv/kernel/machine_kexec.c @@ -15,6 +15,8 @@ #include /* For unreachable() */ #include /* For cpu_down() */ #include +#include +#include /* * kexec_image_info - Print received image details @@ -154,6 +156,37 @@ cpus_stopped = 1; } +static void machine_kexec_mask_interrupts(void) +{ + unsigned int i; + struct irq_desc *desc; + + for_each_irq_desc(i, desc) { + struct irq_chip *chip; + int ret; + + chip = irq_desc_get_chip(desc); + if (!chip) + continue; + + /* + * First try to remove the active state. If this + * fails, try to EOI the interrupt. + */ + ret = irq_set_irqchip_state(i, IRQCHIP_STATE_ACTIVE, false); + + if (ret && irqd_irq_inprogress(&desc->irq_data) && + chip->irq_eoi) + chip->irq_eoi(&desc->irq_data); + + if (chip->irq_mask) + chip->irq_mask(&desc->irq_data); + + if (chip->irq_disable && !irqd_irq_disabled(&desc->irq_data)) + chip->irq_disable(&desc->irq_data); + } +} + /* * machine_crash_shutdown - Prepare to kexec after a kernel crash * @@ -169,6 +202,8 @@ crash_smp_send_stop(); crash_save_cpu(regs, smp_processor_id()); + machine_kexec_mask_interrupts(); + pr_info("Starting crashdump kernel...\n"); } diff -u linux-kvm-5.19.0/arch/riscv/kernel/setup.c linux-kvm-5.19.0/arch/riscv/kernel/setup.c --- linux-kvm-5.19.0/arch/riscv/kernel/setup.c +++ linux-kvm-5.19.0/arch/riscv/kernel/setup.c @@ -282,6 +282,7 @@ else pr_err("No DTB found in kernel mappings\n"); #endif + early_init_fdt_scan_reserved_mem(); misc_mem_init(); init_resources(); @@ -319,10 +320,11 @@ void free_initmem(void) { - if (IS_ENABLED(CONFIG_STRICT_KERNEL_RWX)) - set_kernel_memory(lm_alias(__init_begin), lm_alias(__init_end), - IS_ENABLED(CONFIG_64BIT) ? - set_memory_rw : set_memory_rw_nx); + if (IS_ENABLED(CONFIG_STRICT_KERNEL_RWX)) { + set_kernel_memory(lm_alias(__init_begin), lm_alias(__init_end), set_memory_rw_nx); + if (IS_ENABLED(CONFIG_64BIT)) + set_kernel_memory(__init_begin, __init_end, set_memory_nx); + } free_initmem_default(POISON_FREE_INITMEM); } diff -u linux-kvm-5.19.0/arch/riscv/kernel/traps.c linux-kvm-5.19.0/arch/riscv/kernel/traps.c --- linux-kvm-5.19.0/arch/riscv/kernel/traps.c +++ linux-kvm-5.19.0/arch/riscv/kernel/traps.c @@ -218,11 +218,29 @@ OVERFLOW_STACK_SIZE; } +/* + * A pseudo spinlock to protect the shadow stack from being used by multiple + * harts concurrently. This isn't a real spinlock because the lock side must + * be taken without a valid stack and only a single register, it's only taken + * while in the process of panicing anyway so the performance and error + * checking a proper spinlock gives us doesn't matter. + */ +unsigned long spin_shadow_stack; + asmlinkage void handle_bad_stack(struct pt_regs *regs) { unsigned long tsk_stk = (unsigned long)current->stack; unsigned long ovf_stk = (unsigned long)this_cpu_ptr(overflow_stack); + /* + * We're done with the shadow stack by this point, as we're on the + * overflow stack. Tell any other concurrent overflowing harts that + * they can proceed with panicing by releasing the pseudo-spinlock. + * + * This pairs with an amoswap.aq in handle_kernel_stack_overflow. + */ + smp_store_release(&spin_shadow_stack, 0); + console_verbose(); pr_emerg("Insufficient stack space to handle exception!\n"); diff -u linux-kvm-5.19.0/arch/riscv/mm/init.c linux-kvm-5.19.0/arch/riscv/mm/init.c --- linux-kvm-5.19.0/arch/riscv/mm/init.c +++ linux-kvm-5.19.0/arch/riscv/mm/init.c @@ -262,7 +262,6 @@ memblock_reserve(dtb_early_pa, fdt_totalsize(dtb_early_va)); } - early_init_fdt_scan_reserved_mem(); dma_contiguous_reserve(dma32_phys_limit); if (IS_ENABLED(CONFIG_64BIT)) hugetlb_cma_reserve(PUD_SHIFT - PAGE_SHIFT); diff -u linux-kvm-5.19.0/arch/s390/kernel/crash_dump.c linux-kvm-5.19.0/arch/s390/kernel/crash_dump.c --- linux-kvm-5.19.0/arch/s390/kernel/crash_dump.c +++ linux-kvm-5.19.0/arch/s390/kernel/crash_dump.c @@ -45,7 +45,7 @@ u64 fprs[16]; u32 fpc; u32 prefix; - u64 todpreg; + u32 todpreg; u64 timer; u64 todcmp; u64 vxrs_low[16]; diff -u linux-kvm-5.19.0/arch/s390/kvm/kvm-s390.c linux-kvm-5.19.0/arch/s390/kvm/kvm-s390.c --- linux-kvm-5.19.0/arch/s390/kvm/kvm-s390.c +++ linux-kvm-5.19.0/arch/s390/kvm/kvm-s390.c @@ -1189,6 +1189,8 @@ return 0; } +static void __kvm_s390_set_tod_clock(struct kvm *kvm, const struct kvm_s390_vm_tod_clock *gtod); + static int kvm_s390_set_tod_ext(struct kvm *kvm, struct kvm_device_attr *attr) { struct kvm_s390_vm_tod_clock gtod; @@ -1198,7 +1200,7 @@ if (!test_kvm_facility(kvm, 139) && gtod.epoch_idx) return -EINVAL; - kvm_s390_set_tod_clock(kvm, >od); + __kvm_s390_set_tod_clock(kvm, >od); VM_EVENT(kvm, 3, "SET: TOD extension: 0x%x, TOD base: 0x%llx", gtod.epoch_idx, gtod.tod); @@ -1229,7 +1231,7 @@ sizeof(gtod.tod))) return -EFAULT; - kvm_s390_set_tod_clock(kvm, >od); + __kvm_s390_set_tod_clock(kvm, >od); VM_EVENT(kvm, 3, "SET: TOD base: 0x%llx", gtod.tod); return 0; } @@ -1241,6 +1243,16 @@ if (attr->flags) return -EINVAL; + mutex_lock(&kvm->lock); + /* + * For protected guests, the TOD is managed by the ultravisor, so trying + * to change it will never bring the expected results. + */ + if (kvm_s390_pv_is_protected(kvm)) { + ret = -EOPNOTSUPP; + goto out_unlock; + } + switch (attr->attr) { case KVM_S390_VM_TOD_EXT: ret = kvm_s390_set_tod_ext(kvm, attr); @@ -1255,6 +1267,9 @@ ret = -ENXIO; break; } + +out_unlock: + mutex_unlock(&kvm->lock); return ret; } @@ -4265,13 +4280,6 @@ preempt_enable(); } -void kvm_s390_set_tod_clock(struct kvm *kvm, const struct kvm_s390_vm_tod_clock *gtod) -{ - mutex_lock(&kvm->lock); - __kvm_s390_set_tod_clock(kvm, gtod); - mutex_unlock(&kvm->lock); -} - int kvm_s390_try_set_tod_clock(struct kvm *kvm, const struct kvm_s390_vm_tod_clock *gtod) { if (!mutex_trylock(&kvm->lock)) diff -u linux-kvm-5.19.0/arch/s390/kvm/kvm-s390.h linux-kvm-5.19.0/arch/s390/kvm/kvm-s390.h --- linux-kvm-5.19.0/arch/s390/kvm/kvm-s390.h +++ linux-kvm-5.19.0/arch/s390/kvm/kvm-s390.h @@ -363,7 +363,6 @@ int kvm_s390_handle_sigp_pei(struct kvm_vcpu *vcpu); /* implemented in kvm-s390.c */ -void kvm_s390_set_tod_clock(struct kvm *kvm, const struct kvm_s390_vm_tod_clock *gtod); int kvm_s390_try_set_tod_clock(struct kvm *kvm, const struct kvm_s390_vm_tod_clock *gtod); long kvm_arch_fault_in_page(struct kvm_vcpu *vcpu, gpa_t gpa, int writable); int kvm_s390_store_status_unloaded(struct kvm_vcpu *vcpu, unsigned long addr); diff -u linux-kvm-5.19.0/arch/s390/kvm/pci.c linux-kvm-5.19.0/arch/s390/kvm/pci.c --- linux-kvm-5.19.0/arch/s390/kvm/pci.c +++ linux-kvm-5.19.0/arch/s390/kvm/pci.c @@ -126,7 +126,7 @@ return -EPERM; mutex_lock(&aift->aift_lock); - aift->kzdev = kcalloc(ZPCI_NR_DEVICES, sizeof(struct kvm_zdev), + aift->kzdev = kcalloc(ZPCI_NR_DEVICES, sizeof(struct kvm_zdev *), GFP_KERNEL); if (!aift->kzdev) { rc = -ENOMEM; diff -u linux-kvm-5.19.0/arch/x86/hyperv/hv_init.c linux-kvm-5.19.0/arch/x86/hyperv/hv_init.c --- linux-kvm-5.19.0/arch/x86/hyperv/hv_init.c +++ linux-kvm-5.19.0/arch/x86/hyperv/hv_init.c @@ -85,7 +85,7 @@ static int hv_cpu_init(unsigned int cpu) { union hv_vp_assist_msr_contents msr = { 0 }; - struct hv_vp_assist_page **hvp = &hv_vp_assist_page[smp_processor_id()]; + struct hv_vp_assist_page **hvp = &hv_vp_assist_page[cpu]; int ret; ret = hv_common_cpu_init(cpu); @@ -95,34 +95,32 @@ if (!hv_vp_assist_page) return 0; - if (!*hvp) { - if (hv_root_partition) { - /* - * For root partition we get the hypervisor provided VP assist - * page, instead of allocating a new page. - */ - rdmsrl(HV_X64_MSR_VP_ASSIST_PAGE, msr.as_uint64); - *hvp = memremap(msr.pfn << - HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_SHIFT, - PAGE_SIZE, MEMREMAP_WB); - } else { - /* - * The VP assist page is an "overlay" page (see Hyper-V TLFS's - * Section 5.2.1 "GPA Overlay Pages"). Here it must be zeroed - * out to make sure we always write the EOI MSR in - * hv_apic_eoi_write() *after* the EOI optimization is disabled - * in hv_cpu_die(), otherwise a CPU may not be stopped in the - * case of CPU offlining and the VM will hang. - */ + if (hv_root_partition) { + /* + * For root partition we get the hypervisor provided VP assist + * page, instead of allocating a new page. + */ + rdmsrl(HV_X64_MSR_VP_ASSIST_PAGE, msr.as_uint64); + *hvp = memremap(msr.pfn << HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_SHIFT, + PAGE_SIZE, MEMREMAP_WB); + } else { + /* + * The VP assist page is an "overlay" page (see Hyper-V TLFS's + * Section 5.2.1 "GPA Overlay Pages"). Here it must be zeroed + * out to make sure we always write the EOI MSR in + * hv_apic_eoi_write() *after* the EOI optimization is disabled + * in hv_cpu_die(), otherwise a CPU may not be stopped in the + * case of CPU offlining and the VM will hang. + */ + if (!*hvp) *hvp = __vmalloc(PAGE_SIZE, GFP_KERNEL | __GFP_ZERO); - if (*hvp) - msr.pfn = vmalloc_to_pfn(*hvp); - } - WARN_ON(!(*hvp)); - if (*hvp) { - msr.enable = 1; - wrmsrl(HV_X64_MSR_VP_ASSIST_PAGE, msr.as_uint64); - } + if (*hvp) + msr.pfn = vmalloc_to_pfn(*hvp); + + } + if (!WARN_ON(!(*hvp))) { + msr.enable = 1; + wrmsrl(HV_X64_MSR_VP_ASSIST_PAGE, msr.as_uint64); } return hyperv_init_ghcb(); diff -u linux-kvm-5.19.0/arch/x86/include/asm/cpufeatures.h linux-kvm-5.19.0/arch/x86/include/asm/cpufeatures.h --- linux-kvm-5.19.0/arch/x86/include/asm/cpufeatures.h +++ linux-kvm-5.19.0/arch/x86/include/asm/cpufeatures.h @@ -306,4 +306,7 @@ #define X86_FEATURE_RSB_VMEXIT_LITE (11*32+17) /* "" Fill RSB on VM exit when EIBRS is enabled */ + +#define X86_FEATURE_MSR_TSX_CTRL (11*32+20) /* "" MSR IA32_TSX_CTRL (Intel) implemented */ + /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX_VNNI (12*32+ 4) /* AVX VNNI instructions */ diff -u linux-kvm-5.19.0/arch/x86/include/asm/intel-family.h linux-kvm-5.19.0/arch/x86/include/asm/intel-family.h --- linux-kvm-5.19.0/arch/x86/include/asm/intel-family.h +++ linux-kvm-5.19.0/arch/x86/include/asm/intel-family.h @@ -107,6 +107,11 @@ #define INTEL_FAM6_SAPPHIRERAPIDS_X 0x8F /* Golden Cove */ +#define INTEL_FAM6_EMERALDRAPIDS_X 0xCF + +#define INTEL_FAM6_GRANITERAPIDS_X 0xAD +#define INTEL_FAM6_GRANITERAPIDS_D 0xAE + #define INTEL_FAM6_ALDERLAKE 0x97 /* Golden Cove / Gracemont */ #define INTEL_FAM6_ALDERLAKE_L 0x9A /* Golden Cove / Gracemont */ #define INTEL_FAM6_ALDERLAKE_N 0xBE @@ -115,7 +120,7 @@ #define INTEL_FAM6_RAPTORLAKE_P 0xBA #define INTEL_FAM6_RAPTORLAKE_S 0xBF -/* "Small Core" Processors (Atom) */ +/* "Small Core" Processors (Atom/E-Core) */ #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */ #define INTEL_FAM6_ATOM_BONNELL_MID 0x26 /* Silverthorne, Lincroft */ @@ -142,6 +147,10 @@ #define INTEL_FAM6_ATOM_TREMONT 0x96 /* Elkhart Lake */ #define INTEL_FAM6_ATOM_TREMONT_L 0x9C /* Jasper Lake */ +#define INTEL_FAM6_SIERRAFOREST_X 0xAF + +#define INTEL_FAM6_GRANDRIDGE 0xB6 + /* Xeon Phi */ #define INTEL_FAM6_XEON_PHI_KNL 0x57 /* Knights Landing */ diff -u linux-kvm-5.19.0/arch/x86/include/asm/msr-index.h linux-kvm-5.19.0/arch/x86/include/asm/msr-index.h --- linux-kvm-5.19.0/arch/x86/include/asm/msr-index.h +++ linux-kvm-5.19.0/arch/x86/include/asm/msr-index.h @@ -528,6 +528,11 @@ #define MSR_AMD64_CPUID_FN_1 0xc0011004 #define MSR_AMD64_LS_CFG 0xc0011020 #define MSR_AMD64_DC_CFG 0xc0011022 + +#define MSR_AMD64_DE_CFG 0xc0011029 +#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT 1 +#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE BIT_ULL(MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT) + #define MSR_AMD64_BU_CFG2 0xc001102a #define MSR_AMD64_IBSFETCHCTL 0xc0011030 #define MSR_AMD64_IBSFETCHLINAD 0xc0011031 @@ -630,9 +635,6 @@ #define FAM10H_MMIO_CONF_BASE_MASK 0xfffffffULL #define FAM10H_MMIO_CONF_BASE_SHIFT 20 #define MSR_FAM10H_NODE_ID 0xc001100c -#define MSR_F10H_DECFG 0xc0011029 -#define MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT 1 -#define MSR_F10H_DECFG_LFENCE_SERIALIZE BIT_ULL(MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT) /* K8 MSRs */ #define MSR_K8_TOP_MEM1 0xc001001a diff -u linux-kvm-5.19.0/arch/x86/include/asm/nospec-branch.h linux-kvm-5.19.0/arch/x86/include/asm/nospec-branch.h --- linux-kvm-5.19.0/arch/x86/include/asm/nospec-branch.h +++ linux-kvm-5.19.0/arch/x86/include/asm/nospec-branch.h @@ -309,7 +309,7 @@ /* The Intel SPEC CTRL MSR base value cache */ extern u64 x86_spec_ctrl_base; DECLARE_PER_CPU(u64, x86_spec_ctrl_current); -extern void write_spec_ctrl_current(u64 val, bool force); +extern void update_spec_ctrl_cond(u64 val); extern u64 spec_ctrl_current(void); /* diff -u linux-kvm-5.19.0/arch/x86/kernel/cpu/bugs.c linux-kvm-5.19.0/arch/x86/kernel/cpu/bugs.c --- linux-kvm-5.19.0/arch/x86/kernel/cpu/bugs.c +++ linux-kvm-5.19.0/arch/x86/kernel/cpu/bugs.c @@ -60,11 +60,18 @@ static DEFINE_MUTEX(spec_ctrl_mutex); +/* Update SPEC_CTRL MSR and its cached copy unconditionally */ +static void update_spec_ctrl(u64 val) +{ + this_cpu_write(x86_spec_ctrl_current, val); + wrmsrl(MSR_IA32_SPEC_CTRL, val); +} + /* * Keep track of the SPEC_CTRL MSR value for the current task, which may differ * from x86_spec_ctrl_base due to STIBP/SSB in __speculation_ctrl_update(). */ -void write_spec_ctrl_current(u64 val, bool force) +void update_spec_ctrl_cond(u64 val) { if (this_cpu_read(x86_spec_ctrl_current) == val) return; @@ -75,7 +82,7 @@ * When KERNEL_IBRS this MSR is written on return-to-user, unless * forced the update can be delayed until that time. */ - if (force || !cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS)) + if (!cpu_feature_enabled(X86_FEATURE_KERNEL_IBRS)) wrmsrl(MSR_IA32_SPEC_CTRL, val); } @@ -196,22 +203,15 @@ } /* - * NOTE: This function is *only* called for SVM. VMX spec_ctrl handling is - * done in vmenter.S. + * NOTE: This function is *only* called for SVM, since Intel uses + * MSR_IA32_SPEC_CTRL for SSBD. */ void x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest) { - u64 msrval, guestval = guest_spec_ctrl, hostval = spec_ctrl_current(); + u64 guestval, hostval; struct thread_info *ti = current_thread_info(); - if (static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) { - if (hostval != guestval) { - msrval = setguest ? guestval : hostval; - wrmsrl(MSR_IA32_SPEC_CTRL, msrval); - } - } - /* * If SSBD is not handled in MSR_SPEC_CTRL on AMD, update * MSR_AMD64_L2_CFG or MSR_VIRT_SPEC_CTRL if supported. @@ -1335,7 +1335,7 @@ if (ia32_cap & ARCH_CAP_RRSBA) { x86_spec_ctrl_base |= SPEC_CTRL_RRSBA_DIS_S; - write_spec_ctrl_current(x86_spec_ctrl_base, true); + update_spec_ctrl(x86_spec_ctrl_base); } } @@ -1457,7 +1457,7 @@ if (spectre_v2_in_ibrs_mode(mode)) { x86_spec_ctrl_base |= SPEC_CTRL_IBRS; - write_spec_ctrl_current(x86_spec_ctrl_base, true); + update_spec_ctrl(x86_spec_ctrl_base); } switch (mode) { @@ -1571,7 +1571,7 @@ static void update_stibp_msr(void * __unused) { u64 val = spec_ctrl_current() | (x86_spec_ctrl_base & SPEC_CTRL_STIBP); - write_spec_ctrl_current(val, true); + update_spec_ctrl(val); } /* Update x86_spec_ctrl_base in case SMT state changed. */ @@ -1804,7 +1804,7 @@ x86_amd_ssb_disable(); } else { x86_spec_ctrl_base |= SPEC_CTRL_SSBD; - write_spec_ctrl_current(x86_spec_ctrl_base, true); + update_spec_ctrl(x86_spec_ctrl_base); } } @@ -2055,7 +2055,7 @@ void x86_spec_ctrl_setup_ap(void) { if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) - write_spec_ctrl_current(x86_spec_ctrl_base, true); + update_spec_ctrl(x86_spec_ctrl_base); if (ssb_mode == SPEC_STORE_BYPASS_DISABLE) x86_amd_ssb_disable(); diff -u linux-kvm-5.19.0/arch/x86/kernel/process.c linux-kvm-5.19.0/arch/x86/kernel/process.c --- linux-kvm-5.19.0/arch/x86/kernel/process.c +++ linux-kvm-5.19.0/arch/x86/kernel/process.c @@ -600,7 +600,7 @@ } if (updmsr) - write_spec_ctrl_current(msr, false); + update_spec_ctrl_cond(msr); } static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk) diff -u linux-kvm-5.19.0/arch/x86/kvm/mmu/mmu.c linux-kvm-5.19.0/arch/x86/kvm/mmu/mmu.c --- linux-kvm-5.19.0/arch/x86/kvm/mmu/mmu.c +++ linux-kvm-5.19.0/arch/x86/kvm/mmu/mmu.c @@ -2309,6 +2309,7 @@ { bool list_unstable, zapped_root = false; + lockdep_assert_held_write(&kvm->mmu_lock); trace_kvm_mmu_prepare_zap_page(sp); ++kvm->stat.mmu_shadow_zapped; *nr_zapped = mmu_zap_unsync_children(kvm, sp, invalid_list); @@ -4092,14 +4093,14 @@ if (is_page_fault_stale(vcpu, fault, mmu_seq)) goto out_unlock; - r = make_mmu_pages_available(vcpu); - if (r) - goto out_unlock; - - if (is_tdp_mmu_fault) + if (is_tdp_mmu_fault) { r = kvm_tdp_mmu_map(vcpu, fault); - else + } else { + r = make_mmu_pages_available(vcpu); + if (r) + goto out_unlock; r = __direct_map(vcpu, fault); + } out_unlock: if (is_tdp_mmu_fault) diff -u linux-kvm-5.19.0/arch/x86/kvm/svm/nested.c linux-kvm-5.19.0/arch/x86/kvm/svm/nested.c --- linux-kvm-5.19.0/arch/x86/kvm/svm/nested.c +++ linux-kvm-5.19.0/arch/x86/kvm/svm/nested.c @@ -1085,6 +1085,9 @@ if (!svm->nested.initialized) return; + if (WARN_ON_ONCE(svm->vmcb != svm->vmcb01.ptr)) + svm_switch_vmcb(svm, &svm->vmcb01); + svm_vcpu_free_msrpm(svm->nested.msrpm); svm->nested.msrpm = NULL; @@ -1103,9 +1106,6 @@ svm->nested.initialized = false; } -/* - * Forcibly leave nested mode in order to be able to reset the VCPU later on. - */ void svm_leave_nested(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); diff -u linux-kvm-5.19.0/arch/x86/kvm/svm/sev.c linux-kvm-5.19.0/arch/x86/kvm/svm/sev.c --- linux-kvm-5.19.0/arch/x86/kvm/svm/sev.c +++ linux-kvm-5.19.0/arch/x86/kvm/svm/sev.c @@ -196,7 +196,7 @@ __set_bit(sev->asid, sev_reclaim_asid_bitmap); for_each_possible_cpu(cpu) { - sd = per_cpu(svm_data, cpu); + sd = per_cpu_ptr(&svm_data, cpu); sd->sev_vmcbs[sev->asid] = NULL; } @@ -2600,7 +2600,7 @@ void pre_sev_run(struct vcpu_svm *svm, int cpu) { - struct svm_cpu_data *sd = per_cpu(svm_data, cpu); + struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, cpu); int asid = sev_get_asid(svm->vcpu.kvm); /* Assign the asid allocated with this SEV guest */ diff -u linux-kvm-5.19.0/arch/x86/kvm/svm/svm.c linux-kvm-5.19.0/arch/x86/kvm/svm/svm.c --- linux-kvm-5.19.0/arch/x86/kvm/svm/svm.c +++ linux-kvm-5.19.0/arch/x86/kvm/svm/svm.c @@ -214,7 +214,7 @@ u32 zero1; } __attribute__((packed)); -DEFINE_PER_CPU(struct svm_cpu_data *, svm_data); +DEFINE_PER_CPU(struct svm_cpu_data, svm_data); /* * Only MSR_TSC_AUX is switched via the user return hook. EFER is switched via @@ -315,12 +315,6 @@ return 0; } -static int is_external_interrupt(u32 info) -{ - info &= SVM_EVTINJ_TYPE_MASK | SVM_EVTINJ_VALID; - return info == (SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_INTR); -} - static u32 svm_get_interrupt_shadow(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); @@ -509,12 +503,7 @@ pr_err("%s: err EOPNOTSUPP on %d\n", __func__, me); return -EINVAL; } - sd = per_cpu(svm_data, me); - if (!sd) { - pr_err("%s: svm_data is NULL on %d\n", __func__, me); - return -EINVAL; - } - + sd = per_cpu_ptr(&svm_data, me); sd->asid_generation = 1; sd->max_asid = cpuid_ebx(SVM_CPUID_FUNC) - 1; sd->next_asid = sd->max_asid + 1; @@ -525,7 +514,7 @@ wrmsrl(MSR_EFER, efer | EFER_SVME); - wrmsrl(MSR_VM_HSAVE_PA, __sme_page_pa(sd->save_area)); + wrmsrl(MSR_VM_HSAVE_PA, sd->save_area_pa); if (static_cpu_has(X86_FEATURE_TSCRATEMSR)) { /* @@ -574,42 +563,37 @@ static void svm_cpu_uninit(int cpu) { - struct svm_cpu_data *sd = per_cpu(svm_data, cpu); + struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, cpu); - if (!sd) + if (!sd->save_area) return; - per_cpu(svm_data, cpu) = NULL; kfree(sd->sev_vmcbs); __free_page(sd->save_area); - kfree(sd); + sd->save_area_pa = 0; + sd->save_area = NULL; } static int svm_cpu_init(int cpu) { - struct svm_cpu_data *sd; + struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, cpu); int ret = -ENOMEM; - sd = kzalloc(sizeof(struct svm_cpu_data), GFP_KERNEL); - if (!sd) - return ret; - sd->cpu = cpu; + memset(sd, 0, sizeof(struct svm_cpu_data)); sd->save_area = alloc_page(GFP_KERNEL | __GFP_ZERO); if (!sd->save_area) - goto free_cpu_data; + return ret; ret = sev_cpu_init(sd); if (ret) goto free_save_area; - per_cpu(svm_data, cpu) = sd; - + sd->save_area_pa = __sme_page_pa(sd->save_area); return 0; free_save_area: __free_page(sd->save_area); -free_cpu_data: - kfree(sd); + sd->save_area = NULL; return ret; } @@ -658,6 +642,15 @@ u32 offset; u32 *msrpm; + /* + * For non-nested case: + * If the L01 MSR bitmap does not intercept the MSR, then we need to + * save it. + * + * For nested case: + * If the L02 MSR bitmap does not intercept the MSR, then we need to + * save it. + */ msrpm = is_guest_mode(vcpu) ? to_svm(vcpu)->nested.msrpm: to_svm(vcpu)->msrpm; @@ -1328,7 +1321,7 @@ int i; for_each_online_cpu(i) - cmpxchg(&per_cpu(svm_data, i)->current_vmcb, vmcb, NULL); + cmpxchg(per_cpu_ptr(&svm_data.current_vmcb, i), vmcb, NULL); } static void svm_vcpu_free(struct kvm_vcpu *vcpu) @@ -1342,6 +1335,7 @@ */ svm_clear_current_vmcb(svm->vmcb); + svm_leave_nested(vcpu); svm_free_nested(svm); sev_free_vcpu(vcpu); @@ -1353,7 +1347,7 @@ static void svm_prepare_switch_to_guest(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); - struct svm_cpu_data *sd = per_cpu(svm_data, vcpu->cpu); + struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, vcpu->cpu); if (sev_es_guest(vcpu->kvm)) sev_es_unmap_ghcb(svm); @@ -1365,7 +1359,7 @@ * Save additional host state that will be restored on VMEXIT (sev-es) * or subsequent vmload of host save area. */ - vmsave(__sme_page_pa(sd->save_area)); + vmsave(sd->save_area_pa); if (sev_es_guest(vcpu->kvm)) { struct sev_es_save_area *hostsa; hostsa = (struct sev_es_save_area *)(page_address(sd->save_area) + 0x400); @@ -1390,7 +1384,7 @@ static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu) { struct vcpu_svm *svm = to_svm(vcpu); - struct svm_cpu_data *sd = per_cpu(svm_data, cpu); + struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, cpu); if (sd->current_vmcb != svm->vmcb) { sd->current_vmcb = svm->vmcb; @@ -2611,9 +2605,9 @@ msr->data = 0; switch (msr->index) { - case MSR_F10H_DECFG: - if (boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) - msr->data |= MSR_F10H_DECFG_LFENCE_SERIALIZE; + case MSR_AMD64_DE_CFG: + if (cpu_feature_enabled(X86_FEATURE_LFENCE_RDTSC)) + msr->data |= MSR_AMD64_DE_CFG_LFENCE_SERIALIZE; break; case MSR_IA32_PERF_CAPABILITIES: return 0; @@ -2714,7 +2708,7 @@ msr_info->data = 0x1E; } break; - case MSR_F10H_DECFG: + case MSR_AMD64_DE_CFG: msr_info->data = svm->msr_decfg; break; default: @@ -2943,7 +2937,7 @@ case MSR_VM_IGNNE: vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data); break; - case MSR_F10H_DECFG: { + case MSR_AMD64_DE_CFG: { struct kvm_msr_entry msr_entry; msr_entry.index = msr->index; @@ -3327,15 +3321,6 @@ return 0; } - if (is_external_interrupt(svm->vmcb->control.exit_int_info) && - exit_code != SVM_EXIT_EXCP_BASE + PF_VECTOR && - exit_code != SVM_EXIT_NPF && exit_code != SVM_EXIT_TASK_SWITCH && - exit_code != SVM_EXIT_INTR && exit_code != SVM_EXIT_NMI) - printk(KERN_ERR "%s: unexpected exit_int_info 0x%x " - "exit_code 0x%x\n", - __func__, svm->vmcb->control.exit_int_info, - exit_code); - if (exit_fastpath != EXIT_FASTPATH_NONE) return 1; @@ -3344,7 +3329,7 @@ static void reload_tss(struct kvm_vcpu *vcpu) { - struct svm_cpu_data *sd = per_cpu(svm_data, vcpu->cpu); + struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, vcpu->cpu); sd->tss_desc->type = 9; /* available 32/64-bit TSS */ load_TR_desc(); @@ -3352,7 +3337,7 @@ static void pre_svm_run(struct kvm_vcpu *vcpu) { - struct svm_cpu_data *sd = per_cpu(svm_data, vcpu->cpu); + struct svm_cpu_data *sd = per_cpu_ptr(&svm_data, vcpu->cpu); struct vcpu_svm *svm = to_svm(vcpu); /* @@ -3773,30 +3758,16 @@ return EXIT_FASTPATH_NONE; } -static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu) +static noinstr void svm_vcpu_enter_exit(struct kvm_vcpu *vcpu, bool spec_ctrl_intercepted) { struct vcpu_svm *svm = to_svm(vcpu); - unsigned long vmcb_pa = svm->current_vmcb->pa; guest_state_enter_irqoff(); - if (sev_es_guest(vcpu->kvm)) { - __svm_sev_es_vcpu_run(vmcb_pa); - } else { - struct svm_cpu_data *sd = per_cpu(svm_data, vcpu->cpu); - - /* - * Use a single vmcb (vmcb01 because it's always valid) for - * context switching guest state via VMLOAD/VMSAVE, that way - * the state doesn't need to be copied between vmcb01 and - * vmcb02 when switching vmcbs for nested virtualization. - */ - vmload(svm->vmcb01.pa); - __svm_vcpu_run(vmcb_pa, (unsigned long *)&vcpu->arch.regs); - vmsave(svm->vmcb01.pa); - - vmload(__sme_page_pa(sd->save_area)); - } + if (sev_es_guest(vcpu->kvm)) + __svm_sev_es_vcpu_run(svm, spec_ctrl_intercepted); + else + __svm_vcpu_run(svm, spec_ctrl_intercepted); guest_state_exit_irqoff(); } @@ -3804,6 +3775,7 @@ static __no_kcsan fastpath_t svm_vcpu_run(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); + bool spec_ctrl_intercepted = msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL); trace_kvm_entry(vcpu); @@ -3862,26 +3834,7 @@ if (!static_cpu_has(X86_FEATURE_V_SPEC_CTRL)) x86_spec_ctrl_set_guest(svm->spec_ctrl, svm->virt_spec_ctrl); - svm_vcpu_enter_exit(vcpu); - - /* - * We do not use IBRS in the kernel. If this vCPU has used the - * SPEC_CTRL MSR it may have left it on; save the value and - * turn it off. This is much more efficient than blindly adding - * it to the atomic save/restore list. Especially as the former - * (Saving guest MSRs on vmexit) doesn't even exist in KVM. - * - * For non-nested case: - * If the L01 MSR bitmap does not intercept the MSR, then we need to - * save it. - * - * For nested case: - * If the L02 MSR bitmap does not intercept the MSR, then we need to - * save it. - */ - if (!static_cpu_has(X86_FEATURE_V_SPEC_CTRL) && - unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) - svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + svm_vcpu_enter_exit(vcpu, spec_ctrl_intercepted); if (!sev_es_guest(vcpu->kvm)) reload_tss(vcpu); diff -u linux-kvm-5.19.0/arch/x86/kvm/vmx/nested.c linux-kvm-5.19.0/arch/x86/kvm/vmx/nested.c --- linux-kvm-5.19.0/arch/x86/kvm/vmx/nested.c +++ linux-kvm-5.19.0/arch/x86/kvm/vmx/nested.c @@ -6325,9 +6325,6 @@ return kvm_state.size; } -/* - * Forcibly leave nested mode in order to be able to reset the VCPU later on. - */ void vmx_leave_nested(struct kvm_vcpu *vcpu) { if (is_guest_mode(vcpu)) { diff -u linux-kvm-5.19.0/arch/x86/kvm/vmx/vmenter.S linux-kvm-5.19.0/arch/x86/kvm/vmx/vmenter.S --- linux-kvm-5.19.0/arch/x86/kvm/vmx/vmenter.S +++ linux-kvm-5.19.0/arch/x86/kvm/vmx/vmenter.S @@ -1,12 +1,12 @@ /* SPDX-License-Identifier: GPL-2.0 */ #include #include -#include #include #include #include #include #include +#include "kvm-asm-offsets.h" #include "run_flags.h" #define WORD_SIZE (BITS_PER_LONG / 8) diff -u linux-kvm-5.19.0/arch/x86/kvm/x86.c linux-kvm-5.19.0/arch/x86/kvm/x86.c --- linux-kvm-5.19.0/arch/x86/kvm/x86.c +++ linux-kvm-5.19.0/arch/x86/kvm/x86.c @@ -625,6 +625,12 @@ } EXPORT_SYMBOL_GPL(kvm_deliver_exception_payload); +/* Forcibly leave the nested mode in cases like a vCPU reset */ +static void kvm_leave_nested(struct kvm_vcpu *vcpu) +{ + kvm_x86_ops.nested_ops->leave_nested(vcpu); +} + static void kvm_multiple_exception(struct kvm_vcpu *vcpu, unsigned nr, bool has_error, u32 error_code, bool has_payload, unsigned long payload, bool reinject) @@ -1445,20 +1451,10 @@ MSR_ARCH_PERFMON_PERFCTR0 + 2, MSR_ARCH_PERFMON_PERFCTR0 + 3, MSR_ARCH_PERFMON_PERFCTR0 + 4, MSR_ARCH_PERFMON_PERFCTR0 + 5, MSR_ARCH_PERFMON_PERFCTR0 + 6, MSR_ARCH_PERFMON_PERFCTR0 + 7, - MSR_ARCH_PERFMON_PERFCTR0 + 8, MSR_ARCH_PERFMON_PERFCTR0 + 9, - MSR_ARCH_PERFMON_PERFCTR0 + 10, MSR_ARCH_PERFMON_PERFCTR0 + 11, - MSR_ARCH_PERFMON_PERFCTR0 + 12, MSR_ARCH_PERFMON_PERFCTR0 + 13, - MSR_ARCH_PERFMON_PERFCTR0 + 14, MSR_ARCH_PERFMON_PERFCTR0 + 15, - MSR_ARCH_PERFMON_PERFCTR0 + 16, MSR_ARCH_PERFMON_PERFCTR0 + 17, MSR_ARCH_PERFMON_EVENTSEL0, MSR_ARCH_PERFMON_EVENTSEL1, MSR_ARCH_PERFMON_EVENTSEL0 + 2, MSR_ARCH_PERFMON_EVENTSEL0 + 3, MSR_ARCH_PERFMON_EVENTSEL0 + 4, MSR_ARCH_PERFMON_EVENTSEL0 + 5, MSR_ARCH_PERFMON_EVENTSEL0 + 6, MSR_ARCH_PERFMON_EVENTSEL0 + 7, - MSR_ARCH_PERFMON_EVENTSEL0 + 8, MSR_ARCH_PERFMON_EVENTSEL0 + 9, - MSR_ARCH_PERFMON_EVENTSEL0 + 10, MSR_ARCH_PERFMON_EVENTSEL0 + 11, - MSR_ARCH_PERFMON_EVENTSEL0 + 12, MSR_ARCH_PERFMON_EVENTSEL0 + 13, - MSR_ARCH_PERFMON_EVENTSEL0 + 14, MSR_ARCH_PERFMON_EVENTSEL0 + 15, - MSR_ARCH_PERFMON_EVENTSEL0 + 16, MSR_ARCH_PERFMON_EVENTSEL0 + 17, MSR_K7_EVNTSEL0, MSR_K7_EVNTSEL1, MSR_K7_EVNTSEL2, MSR_K7_EVNTSEL3, MSR_K7_PERFCTR0, MSR_K7_PERFCTR1, MSR_K7_PERFCTR2, MSR_K7_PERFCTR3, @@ -1564,7 +1560,7 @@ MSR_IA32_VMX_EPT_VPID_CAP, MSR_IA32_VMX_VMFUNC, - MSR_F10H_DECFG, + MSR_AMD64_DE_CFG, MSR_IA32_UCODE_REV, MSR_IA32_ARCH_CAPABILITIES, MSR_IA32_PERF_CAPABILITIES, @@ -5037,7 +5033,7 @@ if (events->flags & KVM_VCPUEVENT_VALID_SMM) { if (!!(vcpu->arch.hflags & HF_SMM_MASK) != events->smi.smm) { - kvm_x86_ops.nested_ops->leave_nested(vcpu); + kvm_leave_nested(vcpu); kvm_smm_changed(vcpu, events->smi.smm); } @@ -6808,12 +6804,12 @@ intel_pt_validate_hw_cap(PT_CAP_num_address_ranges) * 2) continue; break; - case MSR_ARCH_PERFMON_PERFCTR0 ... MSR_ARCH_PERFMON_PERFCTR0 + 17: + case MSR_ARCH_PERFMON_PERFCTR0 ... MSR_ARCH_PERFMON_PERFCTR0 + 7: if (msrs_to_save_all[i] - MSR_ARCH_PERFMON_PERFCTR0 >= min(INTEL_PMC_MAX_GENERIC, x86_pmu.num_counters_gp)) continue; break; - case MSR_ARCH_PERFMON_EVENTSEL0 ... MSR_ARCH_PERFMON_EVENTSEL0 + 17: + case MSR_ARCH_PERFMON_EVENTSEL0 ... MSR_ARCH_PERFMON_EVENTSEL0 + 7: if (msrs_to_save_all[i] - MSR_ARCH_PERFMON_EVENTSEL0 >= min(INTEL_PMC_MAX_GENERIC, x86_pmu.num_counters_gp)) continue; @@ -11567,8 +11563,18 @@ WARN_ON_ONCE(!init_event && (old_cr0 || kvm_read_cr3(vcpu) || kvm_read_cr4(vcpu))); + /* + * SVM doesn't unconditionally VM-Exit on INIT and SHUTDOWN, thus it's + * possible to INIT the vCPU while L2 is active. Force the vCPU back + * into L1 as EFER.SVME is cleared on INIT (along with all other EFER + * bits), i.e. virtualization is disabled. + */ + if (is_guest_mode(vcpu)) + kvm_leave_nested(vcpu); + kvm_lapic_reset(vcpu, init_event); + WARN_ON_ONCE(is_guest_mode(vcpu) || is_smm(vcpu)); vcpu->arch.hflags = 0; vcpu->arch.smi_pending = 0; diff -u linux-kvm-5.19.0/arch/x86/kvm/xen.c linux-kvm-5.19.0/arch/x86/kvm/xen.c --- linux-kvm-5.19.0/arch/x86/kvm/xen.c +++ linux-kvm-5.19.0/arch/x86/kvm/xen.c @@ -954,6 +954,14 @@ return kvm_xen_hypercall_set_result(vcpu, run->xen.u.hcall.result); } +static inline int max_evtchn_port(struct kvm *kvm) +{ + if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode) + return EVTCHN_2L_NR_CHANNELS; + else + return COMPAT_EVTCHN_2L_NR_CHANNELS; +} + static bool wait_pending_event(struct kvm_vcpu *vcpu, int nr_ports, evtchn_port_t *ports) { @@ -1042,6 +1050,10 @@ *r = -EFAULT; goto out; } + if (ports[i] >= max_evtchn_port(vcpu->kvm)) { + *r = -EINVAL; + goto out; + } } if (sched_poll.nr_ports == 1) @@ -1216,6 +1228,7 @@ bool longmode; u64 input, params[6], r = -ENOSYS; bool handled = false; + u8 cpl; input = (u64)kvm_register_read(vcpu, VCPU_REGS_RAX); @@ -1243,9 +1256,17 @@ params[5] = (u64)kvm_r9_read(vcpu); } #endif + cpl = static_call(kvm_x86_get_cpl)(vcpu); trace_kvm_xen_hypercall(input, params[0], params[1], params[2], params[3], params[4], params[5]); + /* + * Only allow hypercall acceleration for CPL0. The rare hypercalls that + * are permitted in guest userspace can be handled by the VMM. + */ + if (unlikely(cpl > 0)) + goto handle_in_userspace; + switch (input) { case __HYPERVISOR_xen_version: if (params[0] == XENVER_version && vcpu->kvm->arch.xen.xen_version) { @@ -1280,10 +1301,11 @@ if (handled) return kvm_xen_hypercall_set_result(vcpu, r); +handle_in_userspace: vcpu->run->exit_reason = KVM_EXIT_XEN; vcpu->run->xen.type = KVM_EXIT_XEN_HCALL; vcpu->run->xen.u.hcall.longmode = longmode; - vcpu->run->xen.u.hcall.cpl = static_call(kvm_x86_get_cpl)(vcpu); + vcpu->run->xen.u.hcall.cpl = cpl; vcpu->run->xen.u.hcall.input = input; vcpu->run->xen.u.hcall.params[0] = params[0]; vcpu->run->xen.u.hcall.params[1] = params[1]; @@ -1298,14 +1320,6 @@ return 0; } -static inline int max_evtchn_port(struct kvm *kvm) -{ - if (IS_ENABLED(CONFIG_64BIT) && kvm->arch.xen.long_mode) - return EVTCHN_2L_NR_CHANNELS; - else - return COMPAT_EVTCHN_2L_NR_CHANNELS; -} - static void kvm_xen_check_poller(struct kvm_vcpu *vcpu, int port) { int poll_evtchn = vcpu->arch.xen.poll_evtchn; @@ -1667,18 +1681,18 @@ case EVTCHNSTAT_ipi: /* IPI must map back to the same port# */ if (data->u.evtchn.deliver.port.port != data->u.evtchn.send_port) - goto out; /* -EINVAL */ + goto out_noeventfd; /* -EINVAL */ break; case EVTCHNSTAT_interdomain: if (data->u.evtchn.deliver.port.port) { if (data->u.evtchn.deliver.port.port >= max_evtchn_port(kvm)) - goto out; /* -EINVAL */ + goto out_noeventfd; /* -EINVAL */ } else { eventfd = eventfd_ctx_fdget(data->u.evtchn.deliver.eventfd.fd); if (IS_ERR(eventfd)) { ret = PTR_ERR(eventfd); - goto out; + goto out_noeventfd; } } break; @@ -1718,6 +1732,7 @@ out: if (eventfd) eventfd_ctx_put(eventfd); +out_noeventfd: kfree(evtchnfd); return ret; } diff -u linux-kvm-5.19.0/block/blk-mq.c linux-kvm-5.19.0/block/blk-mq.c --- linux-kvm-5.19.0/block/blk-mq.c +++ linux-kvm-5.19.0/block/blk-mq.c @@ -1176,6 +1176,7 @@ (!blk_queue_nomerges(rq->q) && blk_rq_bytes(last) >= BLK_PLUG_FLUSH_SIZE)) { blk_mq_flush_plug_list(plug, false); + last = NULL; trace_block_plug(rq->q); } @@ -3963,9 +3964,14 @@ struct gendisk *blk_mq_alloc_disk_for_queue(struct request_queue *q, struct lock_class_key *lkclass) { + struct gendisk *disk; + if (!blk_get_queue(q)) return NULL; - return __alloc_disk_node(q, NUMA_NO_NODE, lkclass); + disk = __alloc_disk_node(q, NUMA_NO_NODE, lkclass); + if (!disk) + blk_put_queue(q); + return disk; } EXPORT_SYMBOL(blk_mq_alloc_disk_for_queue); diff -u linux-kvm-5.19.0/block/blk.h linux-kvm-5.19.0/block/blk.h --- linux-kvm-5.19.0/block/blk.h +++ linux-kvm-5.19.0/block/blk.h @@ -313,6 +313,7 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio); enum elv_merge blk_try_merge(struct request *rq, struct bio *bio); +void blk_set_default_limits(struct queue_limits *lim); int blk_dev_init(void); /* diff -u linux-kvm-5.19.0/debian.kvm/abi/abiname linux-kvm-5.19.0/debian.kvm/abi/abiname --- linux-kvm-5.19.0/debian.kvm/abi/abiname +++ linux-kvm-5.19.0/debian.kvm/abi/abiname @@ -1 +1 @@ -1017 +1018 diff -u linux-kvm-5.19.0/debian.kvm/abi/version linux-kvm-5.19.0/debian.kvm/abi/version --- linux-kvm-5.19.0/debian.kvm/abi/version +++ linux-kvm-5.19.0/debian.kvm/abi/version @@ -1 +1 @@ -5.19.0-1017.18 +5.19.0-1018.19 diff -u linux-kvm-5.19.0/debian.kvm/changelog linux-kvm-5.19.0/debian.kvm/changelog --- linux-kvm-5.19.0/debian.kvm/changelog +++ linux-kvm-5.19.0/debian.kvm/changelog @@ -1,3 +1,906 @@ +linux-kvm (5.19.0-1019.20) kinetic; urgency=medium + + * kinetic/linux-kvm: 5.19.0-1019.20 -proposed tracker (LP: #2004289) + + * Kinetic update: upstream stable patchset 2023-01-27 (LP: #2004051) + - [Config] updateconfigs following Ubuntu-5.19.0-35.36 rebase + + * kselftest net/fib_nexthop_nongw.sh fails (LP: #1998244) + - [Config] kvm: Add support for dummy net driver + + [ Ubuntu: 5.19.0-35.36 ] + + * kinetic/linux: 5.19.0-35.36 -proposed tracker (LP: #2004652) + * CVE-2023-0461 + - SAUCE: Fix inet_csk_listen_start after CVE-2023-0461 + + [ Ubuntu: 5.19.0-34.35 ] + + * kinetic/linux: 5.19.0-34.35 -proposed tracker (LP: #2004299) + * LXD containers using shiftfs on ZFS or TMPFS broken on 5.15.0-48.54 + (LP: #1990849) + - [SAUCE] shiftfs: fix -EOVERFLOW inside the container + * Kinetic update: upstream stable patchset 2023-01-27 (LP: #2004051) + - ASoC: fsl_sai: use local device pointer + - serial: Add rs485_supported to uart_port + - serial: fsl_lpuart: Fill in rs485_supported + - x86/sgx: Create utility to validate user provided offset and length + - x86/sgx: Add overflow check in sgx_validate_offset_length() + - binder: validate alloc->mm in ->mmap() handler + - ceph: Use kcalloc for allocating multiple elements + - ceph: fix NULL pointer dereference for req->r_session + - wifi: mac80211: fix memory free error when registering wiphy fail + - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support + - riscv: dts: sifive unleashed: Add PWM controlled LEDs + - audit: fix undefined behavior in bit shift for AUDIT_BIT + - wifi: airo: do not assign -1 to unsigned char + - wifi: mac80211: Fix ack frame idr leak when mesh has no route + - wifi: ath11k: Fix QCN9074 firmware boot on x86 + - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run + - selftests/bpf: Add verifier test for release_reference() + - Revert "net: macsec: report real_dev features when HW offloading is enabled" + - platform/x86: ideapad-laptop: Disable touchpad_switch + - platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1 + - platform/x86/intel/pmt: Sapphire Rapids PMT errata fix + - scsi: ibmvfc: Avoid path failures during live migration + - scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC + - drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) + - block, bfq: fix null pointer dereference in bfq_bio_bfqg() + - arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. + - nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked + - Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 + properly"" + - ALSA: usb-audio: add quirk to fix Hamedal C20 disconnect issue + - RISC-V: vdso: Do not add missing symbols to version section in linker script + - MIPS: pic32: treat port as signed integer + - xfrm: fix "disable_policy" on ipv4 early demux + - xfrm: replay: Fix ESN wrap around for GSO + - af_key: Fix send_acquire race with pfkey_register + - ARM: dts: am335x-pcm-953: Define fixed regulators in root node + - ASoC: hdac_hda: fix hda pcm buffer overflow issue + - ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove + - ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open() + - x86/hyperv: Restore VP assist page after cpu offlining/onlining + - scsi: storvsc: Fix handling of srb_status and capacity change events + - ASoC: max98373: Add checks for devm_kcalloc + - regulator: core: fix kobject release warning and memory leak in + regulator_register() + - spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld() + - regulator: core: fix UAF in destroy_regulator() + - bus: sunxi-rsb: Remove the shutdown callback + - bus: sunxi-rsb: Support atomic transfers + - tee: optee: fix possible memory leak in optee_register_device() + - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl + - selftests: mptcp: fix mibit vs mbit mix up + - net: liquidio: simplify if expression + - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI- + CAN-15975] + - net: dsa: sja1105: disallow C45 transactions on the BASE-TX MDIO bus + - nfc/nci: fix race with opening and closing + - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() + - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() + - netfilter: conntrack: Fix data-races around ct mark + - netfilter: nf_tables: do not set up extensions for end interval + - iavf: Fix a crash during reset task + - iavf: Do not restart Tx queues after reset task failure + - iavf: Fix race condition between iavf_shutdown and iavf_remove + - ARM: mxs: fix memory leak in mxs_machine_init() + - ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties + - net: ethernet: mtk_eth_soc: fix error handling in mtk_open() + - net/mlx4: Check retval of mlx4_bitmap_init + - net: mvpp2: fix possible invalid pointer dereference + - net/qla3xxx: fix potential memleak in ql3xxx_send() + - octeontx2-af: debugsfs: fix pci device refcount leak + - net: pch_gbe: fix pci device refcount leak while module exiting + - nfp: fill splittable of devlink_port_attrs correctly + - nfp: add port from netdev validation for EEPROM access + - macsec: Fix invalid error code set + - Drivers: hv: vmbus: fix double free in the error path of + vmbus_add_channel_work() + - Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() + - netfilter: ipset: regression in ip_set_hash_ip.c + - net/mlx5: Do not query pci info while pci disabled + - net/mlx5: Fix FW tracer timestamp calculation + - net/mlx5: Fix handling of entry refcount when command is not issued to FW + - tipc: set con sock in tipc_conn_alloc + - tipc: add an extra conn_get in tipc_conn_alloc + - tipc: check skb_linearize() return value in tipc_disc_rcv() + - xfrm: Fix oops in __xfrm_state_delete() + - xfrm: Fix ignored return value in xfrm6_init() + - net: wwan: iosm: use ACPI_FREE() but not kfree() in ipc_pcie_read_bios_cfg() + - sfc: fix potential memleak in __ef100_hard_start_xmit() + - net: sparx5: fix error handling in sparx5_port_open() + - net: sched: allow act_ct to be built without NF_NAT + - NFC: nci: fix memory leak in nci_rx_data_packet() + - regulator: twl6030: re-add TWL6032_SUBCLASS + - bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() + - dma-buf: fix racing conflict of dma_heap_add() + - netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface + - netfilter: flowtable_offload: add missing locking + - fs: do not update freeing inode i_io_list + - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). + - ipv4: Fix error return code in fib_table_insert() + - arcnet: fix potential memory leak in com20020_probe() + - s390/dasd: fix no record found for raw_track_access + - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION + - nfc: st-nci: fix memory leaks in EVT_TRANSACTION + - nfc: st-nci: fix incorrect sizing calculations in EVT_TRANSACTION + - net: enetc: cache accesses to &priv->si->hw + - net: enetc: preserve TX ring priority across reconfiguration + - octeontx2-pf: Add check for devm_kcalloc + - octeontx2-af: Fix reference count issue in rvu_sdp_init() + - net: thunderx: Fix the ACPI memory leak + - s390/crashdump: fix TOD programmable field size + - lib/vdso: use "grep -E" instead of "egrep" + - [Config] updateconfigs for CC_HAS_ASM_GOTO_TIED_OUTPUT + - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash + - nios2: add FORCE for vmlinuz.gz + - KVM: arm64: pkvm: Fixup boot mode to reflect that the kernel resumes from + EL1 + - usb: dwc3: exynos: Fix remove() function + - usb: cdnsp: Fix issue with Clear Feature Halt Endpoint + - usb: cdnsp: fix issue with ZLP - added TD_SIZE = 1 + - ext4: fix use-after-free in ext4_ext_shift_extents + - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency + - iio: light: apds9960: fix wrong register for gesture gain + - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails + - bus: ixp4xx: Don't touch bit 7 on IXP42x + - usb: dwc3: gadget: conditionally remove requests + - usb: dwc3: gadget: Return -ESHUTDOWN on ep disable + - usb: dwc3: gadget: Clear ep descriptor last + - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty + - gcov: clang: fix the buffer overflow issue + - mm: vmscan: fix extreme overreclaim and swap floods + - KVM: x86: nSVM: leave nested mode on vCPU free + - KVM: x86: forcibly leave nested mode on vCPU reset + - KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in + use + - KVM: x86: add kvm_leave_nested + - KVM: x86: remove exit_int_info warning in svm_handle_exit + - x86/tsx: Add a feature bit for TSX control MSR support + - x86/pm: Add enumeration check before spec MSRs save/restore setup + - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() + - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode + - ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 + - tools: iio: iio_generic_buffer: Fix read size + - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() + - Input: goodix - try resetting the controller when no config is set + - Input: soc_button_array - add use_low_level_irq module parameter + - Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[] + - Input: i8042 - apply probe defer to more ASUS ZenBook models + - ASoC: stm32: dfsdm: manage cb buffers cleanup + - xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too + - xen/platform-pci: add missing free_irq() in error path + - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() + - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) + - drm/amdgpu: disable BACO support on more cards + - zonefs: fix zone report size in __zonefs_io_error() + - platform/x86: hp-wmi: Ignore Smart Experience App event + - platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some + Yoga laptops + - [Config] updateconfigs for INET_TABLE_PERTURB_ORDER + - tcp: configurable source port perturb table size + - net: usb: qmi_wwan: add Telit 0x103a composition + - scsi: iscsi: Fix possible memory leak when device_register() failed + - gpu: host1x: Avoid trying to use GART on Tegra20 + - dm integrity: flush the journal on suspend + - dm integrity: clear the journal on suspend + - fuse: lock inode unconditionally in fuse_fallocate() + - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute + - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute + - wifi: wilc1000: validate number of channels + - btrfs: free btrfs_path before copying root refs to userspace + - btrfs: free btrfs_path before copying fspath to userspace + - btrfs: free btrfs_path before copying subvol info to userspace + - btrfs: zoned: fix missing endianness conversion in sb_write_pointer + - btrfs: use kvcalloc in btrfs_get_dev_zone_info + - btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() + - drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN + - drm/amdgpu: Enable Aldebaran devices to report CU Occupancy + - drm/amdgpu: always register an MMU notifier for userptr + - drm/i915: fix TLB invalidation for Gen12 video and compute engines + - wifi: cfg80211: Fix bitrates overflow issue + - spi: tegra210-quad: Don't initialise DMA if not supported + - s390/zcrypt: fix warning about field-spanning write + - selftests/net: give more time to udpgro bg processes to complete startup + - ACPI: video: Add backlight=native DMI quirk for Dell G15 5515 + - drm: panel-orientation-quirks: Add quirk for Nanote UMPC-01 + - s390: always build relocatable kernel + - nvme: quiet user passthrough command errors + - net: wwan: iosm: fix kernel test robot reported errors + - drm/amdgpu: Drop eviction lock when allocating PT BO + - arm64: dts: rockchip: fix quartz64-a bluetooth configuration + - power: supply: ip5xxx: Fix integer overflow in current_now calculation + - power: supply: ab8500: Defer thermal zone probe + - arm64: dts: rockchip: Fix Pine64 Quartz4-B PMIC interrupt + - regulator: rt5759: fix OOB in validate_desc() + - spi: tegra210-quad: Fix duplicate resource error + - selftests: mptcp: gives slow test-case more time + - selftests: mptcp: run mptcp_sockopt from a new netns + - bonding: fix ICMPv6 header handling when receiving IPv6 messages + - drm/i915: Fix warn in intel_display_power_*_domain() functions + - net/mlx5: SF: Fix probing active SFs during driver probe phase + - net/mlx5: cmdif, Print info on any firmware cmd failure to tracepoint + - net/mlx5: E-Switch, Set correctly vport destination + - net/mlx5e: Offload rule only when all encaps are valid + - net: phy: at803x: fix error return code in at803x_probe() + - zonefs: Fix race between modprobe and mount + - tsnep: Fix rotten packets + - blk-mq: fix queue reference leak on blk_mq_alloc_disk_for_queue failure + - test_kprobes: fix implicit declaration error of test_kprobes + - net: ethernet: mtk_eth_soc: fix resource leak in error path + - net: dm9051: Fix missing dev_kfree_skb() in dm9051_loop_rx() + - s390/ap: fix memory leak in ap_init_qci_info() + - fscache: fix OOB Read in __fscache_acquire_volume + - net: wwan: t7xx: Fix the ACPI memory leak + - virtio_net: Fix probe failed when modprobe virtio_net + - can: gs_usb: remove dma allocations + - cifs: fix missing unlock in cifs_file_copychunk_range() + - cifs: Use after free in debug code + - iio: adc: aspeed: Remove the trim valid dts property. + - dt-bindings: iio: adc: Remove the property "aspeed,trim-data-valid" + - mm/damon/sysfs-schemes: skip stats update if the scheme directory is removed + - virt/sev-guest: Prevent IV reuse in the SNP guest driver + - zonefs: Fix active zone accounting + - spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock + - spi: spi-imx: spi_imx_transfer_one(): check for DMA transfer first + - mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1 + - KVM: x86/mmu: Fix race condition in direct_page_fault + - KVM: x86/xen: Only do in-kernel acceleration of hypercalls for guest CPL0 + - KVM: x86/xen: Validate port number in SCHEDOP_poll + - drm/i915/gvt: Get reference to KVM iff attachment to VM is successful + - KVM: Update gfn_to_pfn_cache khva when it moves within the same page + - mm: fix unexpected changes to {failslab|fail_page_alloc}.attr + - mm: correctly charge compressed memory to its memcg + - LoongArch: Clear FPU/SIMD thread info flags for kernel thread + - LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty() + - ASoC: amd: yc: Add Alienware m17 R5 AMD into DMI table + - ASoC: Intel: soc-acpi: add ES83x6 support to IceLake + - ASoC: hda: intel-dsp-config: add ES83x6 quirk for IceLake + - ASoC: SOF: ipc3-topology: use old pipeline teardown flow with SOF2.1 and + older + - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context" + - Revert "tty: n_gsm: replace kicktimer with delayed_work" + - ASoC: sof_es8336: reduce pop noise on speaker + - pinctrl: qcom: sc8280xp: Rectify UFS reset pins + - platform/x86: thinkpad_acpi: Enable s2idle quirk for 21A1 machine type + - platform/x86: ideapad-laptop: Add module parameters to match DMI quirk + tables + - block: make blk_set_default_limits() private + - scsi: mpi3mr: Suppress command reply debug prints + - btrfs: free btrfs_path before copying inodes to userspace + - btrfs: do not modify log tree while holding a leaf from fs tree locked + - drm/i915/ttm: never purge busy objects + - drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code + - drm/amdgpu/psp: don't free PSP buffers on suspend + - drm/amd/amdgpu: reserve vm invalidation engine for firmware + - drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly + when the edid is read" + - btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino + - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() + - iio: health: afe4403: Fix oob read in afe4403_read_raw + - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw + - iio: light: rpr0521: add missing Kconfig dependencies + - bpf, perf: Use subprog name when reporting subprog ksymbol + - scripts/faddr2line: Fix regression in name resolution on ppc64le + - ARM: at91: rm9200: fix usb device clock id + - libbpf: Handle size overflow for ringbuf mmap + - hwmon: (ltc2947) fix temperature scaling + - hwmon: (ina3221) Fix shunt sum critical calculation + - hwmon: (i5500_temp) fix missing pci_disable_device() + - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails + - bpf: Do not copy spin lock field from user in bpf_selem_alloc + - nvmem: rmem: Fix return value check in rmem_read() + - of: property: decrement node refcount in of_fwnode_get_reference_args() + - ixgbevf: Fix resource leak in ixgbevf_init_module() + - i40e: Fix error handling in i40e_init_module() + - fm10k: Fix error handling in fm10k_init_module() + - iavf: Fix error handling in iavf_init_module() + - e100: Fix possible use after free in e100_xmit_prepare + - net/mlx5: DR, Fix uninitialized var warning + - net/mlx5: Fix uninitialized variable bug in outlen_write() + - net/mlx5e: Fix use-after-free when reverting termination table + - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() + - can: cc770: cc770_isa_probe(): add missing free_cc770dev() + - can: etas_es58x: es58x_init_netdev(): free netdev when register_candev() + - can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods + - can: m_can: Add check for devm_clk_get + - qlcnic: fix sleep-in-atomic-context bugs caused by msleep + - aquantia: Do not purge addresses when setting the number of rings + - wifi: cfg80211: fix buffer overflow in elem comparison + - wifi: cfg80211: don't allow multi-BSSID in S1G + - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration + - net: phy: fix null-ptr-deref while probe() failed + - net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() + - net: net_netdev: Fix error handling in ntb_netdev_init_module() + - net/9p: Fix a potential socket leak in p9_socket_open + - net: ethernet: nixge: fix NULL dereference + - net: wwan: iosm: fix kernel test robot reported error + - net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type + - dsa: lan9303: Correct stat name + - tipc: re-fetch skb cb after tipc_msg_validate + - net: hsr: Fix potential use-after-free + - net: mdiobus: fix unbalanced node reference count + - afs: Fix fileserver probe RTT handling + - net: tun: Fix use-after-free in tun_detach() + - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE + - sctp: fix memory leak in sctp_stream_outq_migrate() + - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed + - hwmon: (coretemp) Check for null before removing sysfs attrs + - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() + - riscv: vdso: fix section overlapping under some conditions + - riscv: mm: Proper page permissions after initmem free + - ALSA: dice: fix regression for Lexicon I-ONIX FW810S + - error-injection: Add prompt for function error injection + - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" + - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() + - x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 + - pinctrl: intel: Save and restore pins in "direct IRQ" mode + - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails + - net: stmmac: Set MAC's flow control register to reflect current settings + - mmc: mmc_test: Fix removal of debugfs file + - mmc: core: Fix ambiguous TRIM and DISCARD arg + - mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check + - mmc: sdhci-sprd: Fix no reset data and command after voltage switch + - mmc: sdhci: Fix voltage switch delay + - drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame + - drm/amdgpu: enable Vangogh VCN indirect sram mode + - drm/i915: Fix negative value passed as remaining time + - drm/i915: Never return 0 if not all requests retired + - tracing/osnoise: Fix duration type + - tracing: Fix race where histograms can be called before the event + - tracing: Free buffers when a used dynamic event is removed + - io_uring: cmpxchg for poll arm refs release + - io_uring/poll: fix poll_refs race with cancelation + - ASoC: ops: Fix bounds check for _sx controls + - pinctrl: single: Fix potential division by zero + - riscv: Sync efi page table's kernel mappings before switching + - riscv: fix race when vmap stack overflow + - riscv: kexec: Fixup irq controller broken in kexec crash path + - nvme: fix SRCU protection of nvme_ns_head list + - iommu/vt-d: Fix PCI device refcount leak in has_external_pci() + - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() + - mm: migrate: fix THP's mapcount on isolation + - Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is + enabled + - ipv4: Handle attempt to delete multipath route when fib_info contains an nh + reference + - ipv4: Fix route deletion when nexthop info is not specified + - i2c: npcm7xx: Fix error handling in npcm_i2c_init() + - i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set + - ACPI: HMAT: remove unnecessary variable initialization + - ACPI: HMAT: Fix initiator registration for single-initiator systems + - Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" + - char: tpm: Protect tpm_pm_suspend with locks + - Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() + - ipc/sem: Fix dangling sem_array access in semtimedop race + - clk: samsung: exynos7885: Correct "div4" clock parents + - libbpf: Use correct return pointer in attach_raw_tp + - clocksource/drivers/arm_arch_timer: Fix XGene-1 TVAL register math error + - clk: qcom: gcc-sc8280xp: add cxo as parent for three ufs ref clks + - vfs: fix copy_file_range() averts filesystem freeze protection + - net: wwan: iosm: fix crash in peek throughput test + - net: wwan: iosm: fix incorrect skb length + - mptcp: don't orphan ssk in mptcp_close() + - mptcp: fix sleep in atomic at close time + - hwmon: (asus-ec-sensors) Add checks for devm_kcalloc + - ASoC: tlv320adc3xxx: Fix build error for implicit function declaration + - mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in + damon_sysfs_set_schemes() + - i2c: Restore initial power state if probe fails + - i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer + - powerpc/bpf/32: Fix Oops on tail call tests + * 5.15.0-58.64 breaks xen bridge networking (pvh domU) (LP: #2002889) + - xen/netback: fix build warning + * NFS: client permission error after adding user to permissible group + (LP: #2003053) + - NFS: Clear the file access cache upon login + - NFS: Judge the file access cache's timestamp in rcu path + - NFS: Fix up a sparse warning + * cmsg_so_mark.sh / cmsg_time.sh / cmsg_ipv6.sh in net from + ubuntu_kernel_selftests hang with non-amd64 (LP: #2000667) + - selftests: net: fix cmsg_so_mark.sh test hang + * Set explicit CC in the headers package (LP: #1999750) + - [Packaging] Set explicit CC in the headers package + * powerpc-build in ubuntu_kernel_selftests failed on P9 with K-5.19 + (LP: #2000772) + - selftests/powerpc: Avoid GCC 12 uninitialised variable warning + * [SRU] SoF for RPL platform support (LP: #1992714) + - ASoC: SOC: Intel: introduce cl_init callback + - ASoC: SOF: Intel: add MeteorLake machines + - ASoC: SOF: Intel: Add support for MeteorLake (MTL) + - ASoC: Intel: common: add ACPI matching tables for Raptor Lake + - ASoC: SOF: Intel: pci-tgl: use RPL specific firmware definitions + - [Config] Enable SND_SOC_SOF_METEORLAKE as module + * Rear Audio port sometimes has no audio output after reboot(Cirrus Logic) + (LP: #1998905) + - ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock. + * Fix SUT can't displayed after resume from WB/CB with dGFX + installed(FR:6/10)[RX6300][RX6500] (LP: #1999836) + - drm/amd/display: No display after resume from WB/CB + * commit cf58599cded35cf4affed1e659c0e2c742d3fda7 seems to be missing in + kinetic master to remove "hio" reference from Makefile (LP: #1999556) + - Ubuntu: remove leftover reference to ubuntu/hio driver + * Add additional Mediatek MT7922 BT device ID (LP: #1998885) + - Bluetooth: btusb: Add a new VID/PID 0489/e0f2 for MT7922 + * Mute/mic LEDs no function on a HP platfrom (LP: #1998882) + - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook + * CVE-2023-0461 + - net/ulp: prevent ULP without clone op from entering the LISTEN status + - net/ulp: use consistent error code when blocking ULP + * CVE-2023-0179 + - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits + * CVE-2022-20369 + - NFSD: fix use-after-free in __nfs42_ssc_open() + * Kinetic update: upstream stable patchset 2023-01-23 (LP: #2003753) + - ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in + wm5102_probe" + - ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in + wm5110_probe" + - ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in + wm8997_probe" + - ASoC: mt6660: Keep the pm_runtime enables before component stuff in + mt6660_i2c_probe + - ASoC: rt1019: Fix the TDM settings + - ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK + - spi: intel: Fix the offset to get the 64K erase opcode + - ASoC: codecs: jz4725b: add missed Line In power control bit + - ASoC: codecs: jz4725b: fix reported volume for Master ctl + - ASoC: codecs: jz4725b: use right control for Capture Volume + - ASoC: codecs: jz4725b: fix capture selector naming + - ASoC: Intel: sof_sdw: add quirk variant for LAPBC710 NUC15 + - selftests/futex: fix build for clang + - selftests/intel_pstate: fix build for ARCH=x86_64 + - ASoC: rt1308-sdw: add the default value of some registers + - drm/amd/display: Remove wrong pipe control lock + - ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[] + - RDMA/efa: Add EFA 0xefa2 PCI ID + - btrfs: raid56: properly handle the error when unable to find the missing + stripe + - NFSv4: Retry LOCK on OLD_STATEID during delegation return + - ACPI: x86: Add another system to quirk list for forcing StorageD3Enable + - firmware: arm_scmi: Cleanup the core driver removal callback + - i2c: tegra: Allocate DMA memory for DMA engine + - i2c: i801: add lis3lv02d's I2C address for Vostro 5568 + - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid + - btrfs: remove pointless and double ulist frees in error paths of qgroup + tests + - x86/cpu: Add several Intel server CPU model numbers + - ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> + "Route" + - KVM: x86/pmu: Do not speculatively query Intel GP PMCs that don't exist yet + - hugetlbfs: don't delete error page from pagecache + - arm64: dts: qcom: sa8155p-adp: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8150-xperia-kumano: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8250-xperia-edo: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8350-hdk: Specify which LDO modes are allowed + - spi: stm32: Print summary 'callbacks suppressed' message + - ARM: dts: at91: sama7g5: fix signal name of pin PB2 + - ASoC: core: Fix use-after-free in snd_soc_exit() + - ASoC: tas2770: Fix set_tdm_slot in case of single slot + - ASoC: tas2764: Fix set_tdm_slot in case of single slot + - ARM: at91: pm: avoid soft resetting AC DLL + - serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl() + - serial: 8250_omap: remove wait loop from Errata i202 workaround + - serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() + - serial: 8250: omap: Flush PM QOS work on remove + - serial: imx: Add missing .thaw_noirq hook + - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send + - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() + - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() + - pinctrl: rockchip: list all pins in a possible mux route for PX30 + - scsi: scsi_transport_sas: Fix error handling in sas_phy_add() + - block: sed-opal: kmalloc the cmd/resp buffers + - bpf: Fix memory leaks in __check_func_call + - arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro + - siox: fix possible memory leak in siox_device_add() + - parport_pc: Avoid FIFO port location truncation + - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map + - drm/vc4: kms: Fix IS_ERR() vs NULL check for vc4_kms + - drm/panel: simple: set bpc field for logic technologies displays + - drm/drv: Fix potential memory leak in drm_dev_init() + - drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() + - arm64: dts: imx8mm: Fix NAND controller size-cells + - arm64: dts: imx8mn: Fix NAND controller size-cells + - ata: libata-transport: fix double ata_host_put() in ata_tport_add() + - ata: libata-transport: fix error handling in ata_tport_add() + - ata: libata-transport: fix error handling in ata_tlink_add() + - ata: libata-transport: fix error handling in ata_tdev_add() + - nfp: change eeprom length to max length enumerators + - MIPS: fix duplicate definitions for exported symbols + - MIPS: Loongson64: Add WARN_ON on kexec related kmalloc failed + - bpf: Initialize same number of free nodes for each pcpu_freelist + - net: bgmac: Drop free_netdev() from bgmac_enet_remove() + - mISDN: fix possible memory leak in mISDN_dsp_element_register() + - net: hinic: Fix error handling in hinic_module_init() + - net: stmmac: ensure tx function is not running in stmmac_xdp_release() + - soc: imx8m: Enable OCOTP clock before reading the register + - net: liquidio: release resources when liquidio driver open failed + - mISDN: fix misuse of put_device() in mISDN_register_device() + - net: macvlan: Use built-in RCU list checking + - net: caif: fix double disconnect client in chnl_net_open() + - bnxt_en: Remove debugfs when pci_register_driver failed + - net: mhi: Fix memory leak in mhi_net_dellink() + - net: dsa: make dsa_master_ioctl() see through port_hwtstamp_get() shims + - xen/pcpu: fix possible memory leak in register_pcpu() + - net: ionic: Fix error handling in ionic_init_module() + - net: ena: Fix error handling in ena_init() + - net: hns3: fix setting incorrect phy link ksettings for firmware in + resetting process + - bridge: switchdev: Fix memory leaks when changing VLAN protocol + - drbd: use after free in drbd_create_device() + - platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when + virtualized + - platform/surface: aggregator: Do not check for repeated unsequenced packets + - cifs: add check for returning value of SMB2_close_init + - net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail in + ag71xx_open() + - net/x25: Fix skb leak in x25_lapb_receive_frame() + - cifs: Fix wrong return value checking when GETFLAGS + - net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() + and sparx5_start() + - net: thunderbolt: Fix error handling in tbnet_init() + - cifs: add check for returning value of SMB2_set_info_init + - ftrace: Fix the possible incorrect kernel message + - ftrace: Optimize the allocation for mcount entries + - ftrace: Fix null pointer dereference in ftrace_add_mod() + - ring_buffer: Do not deactivate non-existant pages + - tracing: Fix memory leak in tracing_read_pipe() + - tracing/ring-buffer: Have polling block on watermark + - tracing: Fix memory leak in test_gen_synth_cmd() and + test_empty_synth_event() + - tracing: Fix wild-memory-access in register_synth_event() + - tracing: Fix race where eprobes can be called before the event + - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in + kprobe_event_gen_test_exit() + - tracing: kprobe: Fix potential null-ptr-deref on trace_array in + kprobe_event_gen_test_exit() + - drm/amd/display: Add HUBP surface flip interrupt handler + - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() + - ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro + - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 + - Revert "usb: dwc3: disable USB core PHY management" + - slimbus: qcom-ngd: Fix build error when CONFIG_SLIM_QCOM_NGD_CTRL=y && + CONFIG_QCOM_RPROC_COMMON=m + - slimbus: stream: correct presence rate frequencies + - speakup: fix a segfault caused by switching consoles + - USB: bcma: Make GPIO explicitly optional + - USB: serial: option: add Sierra Wireless EM9191 + - USB: serial: option: remove old LARA-R6 PID + - USB: serial: option: add u-blox LARA-R6 00B modem + - USB: serial: option: add u-blox LARA-L6 modem + - USB: serial: option: add Fibocom FM160 0x0111 composition + - usb: add NO_LPM quirk for Realforce 87U Keyboard + - usb: chipidea: fix deadlock in ci_otg_del_timer + - usb: cdns3: host: fix endless superspeed hub port reset + - usb: typec: mux: Enter safe mode only when pins need to be reconfigured + - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() + - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() + - iio: adc: mp2629: fix wrong comparison of channel + - iio: adc: mp2629: fix potential array out of bound access + - iio: pressure: ms5611: changed hardcoded SPI speed to value limited + - dm ioctl: fix misbehavior if list_versions races with module loading + - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs + - serial: 8250: Flush DMA Rx on RLSI + - serial: 8250_lpss: Configure DMA also w/o DMA filter + - Input: iforce - invert valid length check when fetching device IDs + - maccess: Fix writing offset in case of fault in + strncpy_from_kernel_nofault() + - net: phy: marvell: add sleep time after enabling the loopback bit + - scsi: zfcp: Fix double free of FSF request when qdio send fails + - iommu/vt-d: Preset Access bit for IOVA in FL non-leaf paging entries + - iommu/vt-d: Set SRE bit only when hardware has SRS cap + - firmware: coreboot: Register bus in module init + - mmc: core: properly select voltage range without power cycle + - mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce + timeout + - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() + - docs: update mediator contact information in CoC doc + - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() + - perf/x86/intel/pt: Fix sampling using single range output + - nvme: restrict management ioctls to admin + - nvme: ensure subsystem reset is single threaded + - serial: 8250_lpss: Use 16B DMA burst with Elkhart Lake + - perf: Improve missing SIGTRAP checking + - ring-buffer: Include dropped pages in counting dirty patches + - tracing: Fix warning on variable 'struct trace_array' + - net: use struct_group to copy ip/ipv6 header addresses + - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() + - scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() + - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case + - Input: i8042 - fix leaking of platform device on module removal + - macvlan: enforce a consistent minimal mtu + - tcp: cdg: allow tcp_cdg_release() to be called multiple times + - kcm: avoid potential race in kcm_tx_work + - kcm: close race conditions on sk_receive_queue + - 9p: trans_fd/p9_conn_cancel: drop client lock earlier + - gfs2: Check sb_bsize_shift after reading superblock + - gfs2: Switch from strlcpy to strscpy + - 9p/trans_fd: always use O_NONBLOCK read/write + - wifi: wext: use flex array destination for memcpy() + - mm: fs: initialize fsdata passed to write_begin/write_end interface + - net/9p: use a dedicated spinlock for trans_fd + - ntfs: fix use-after-free in ntfs_attr_find() + - ntfs: fix out-of-bounds read in ntfs_attr_find() + - ntfs: check overflow when iterating ATTR_RECORDs + - drm/msm/gpu: Fix crash during system suspend after unbind + - spi: tegra210-quad: Fix combined sequence + - ASoC: rt5682s: Fix the TDM Tx settings + - selftests/kexec: fix build for ARCH=x86_64 + - ASoC: Intel: sof_rt5682: Add quirk for Rex board + - ASoC: amd: yc: Adding Lenovo ThinkBook 14 Gen 4+ ARA and Lenovo ThinkBook 16 + Gen 4+ ARA to the Quirks List + - ASoC: amd: yc: Add Lenovo Thinkbook 14+ 2022 21D0 to quirks table + - drm/amdgpu: Adjust MES polling timeout for sriov + - platform/x86: thinkpad_acpi: Fix reporting a non present second fan on some + models + - drm/scheduler: fix fence ref counting + - cxl/mbox: Add a check on input payload size + - SUNRPC: Fix crasher in gss_unwrap_resp_integ() + - drm/rockchip: vop2: fix null pointer in plane_atomic_disable + - drm/rockchip: vop2: disable planes when disabling the crtc + - ksefltests: pidfd: Fix wait_states: Test terminated by timeout + - powerpc/64e: Fix amdgpu build on Book3E w/o AltiVec + - block: blk_add_rq_to_plug(): clear stale 'last' after flush + - firmware: arm_scmi: Make tx_prepare time out eventually + - drm/amd/display: Ignore Cable ID Feature + - drm/amdgpu: set fb_modifiers_not_supported in vkms + - drm/amd: Fail the suspend if resources can't be evicted + - cxl/pmem: Use size_add() against integer overflow + - tools/testing/cxl: Fix some error exits + - arm64/mm: fold check for KFENCE into can_set_direct_map() + - arm64: fix rodata=full again + - KVM: SVM: remove dead field from struct svm_cpu_data + - KVM: SVM: do not allocate struct svm_cpu_data dynamically + - KVM: SVM: restore host save area from assembly + - KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly + - arm64: dts: qcom: sc7280: Add the reset reg for lpass audiocc on SC7280 + - ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=N + - arm64: dts: qcom: sm8250: Disable the not yet supported cluster idle state + - tty: serial: fsl_lpuart: don't break the on-going transfer when global reset + - bnxt_en: refactor bnxt_cancel_reservations() + - bnxt_en: fix the handling of PCIE-AER + - mtd: onenand: omap2: add dependency on GPMC + - sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent + - sctp: clear out_curr if all frag chunks of current msg are pruned + - erofs: clean up .read_folio() and .readahead() in fscache mode + - io_uring: calculate CQEs from the user visible value + - pinctrl: mediatek: common-v2: Fix bias-disable for PULL_PU_PD_RSEL_TYPE + - selftests/bpf: Fix test_progs compilation failure in 32-bit arch + - arm64: dts: imx8mm-tqma8mqml-mba8mx: Fix USB DR + - cifs: Fix connections leak when tlink setup failed + - ata: libata-core: do not issue non-internal commands once EH is pending + - net: phy: dp83867: Fix SGMII FIFO depth for non OF devices + - mctp i2c: don't count unused / invalid keys for flow release + - octeon_ep: delete unnecessary napi rollback under set_queues_err in + octep_open() + - octeon_ep: ensure octep_get_link_status() successfully before + octep_link_up() + - octeon_ep: fix potential memory leak in octep_device_setup() + - octeon_ep: ensure get mac address successfully before eth_hw_addr_set() + - erofs: fix missing xas_retry() in fscache mode + - mlxsw: Avoid warnings when not offloaded FDB entry with IPv6 is removed + - net: hns3: fix incorrect hw rss hash type of rx packet + - net: hns3: fix return value check bug of rx copybreak + - netfs: Fix missing xas_retry() calls in xarray iteration + - netfs: Fix dodgy maths + - net: dsa: don't leak tagger-owned storage on switch driver unbind + - net: lan966x: Fix potential null-ptr-deref in lan966x_stats_init() + - s390: avoid using global register for current_stack_pointer + - netdevsim: Fix memory leak of nsim_dev->fa_cookie + - rethook: fix a potential memleak in rethook_alloc() + - drm/amd/pm: fix SMU13 runpm hang due to unintentional workaround + - drm/display: Don't assume dual mode adaptors support i2c sub-addressing + - drm/amd/display: Fix invalid DPIA AUX reply causing system hang + - drm/amd/display: Fix access timeout to DPIA AUX at boot time + - drm/amd/display: Support parsing VRAM info v3.0 from VBIOS + - usb: dwc3: Do not get extcon device when usb-role-switch is used + - nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro + - nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV7000 + - usb: typec: tipd: Prevent uninitialized event{1,2} in IRQ handler + - iio: accel: bma400: Ensure VDDIO is enable defore reading the chip ID. + - iio: pressure: ms5611: fixed value compensation bug + - ceph: avoid putting the realm twice when decoding snaps fails + - s390/dcssblk: fix deadlock when adding a DCSS + - blk-cgroup: properly pin the parent in blkcg_css_online + - x86/fpu: Drop fpregs lock before inheriting FPU permissions + - ASoC: SOF: topology: No need to assign core ID if token parsing failed + - perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and + throttling + - net: usb: smsc95xx: fix external PHY reset + - tracing: Fix potential null-pointer-access of entry in list 'tr->err_log' + - arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud + - KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign() + - netlink: Bounds-check struct nlmsgerr creation + - bpf: Prevent bpf program recursion for raw tracepoint probes + * Fix RPL-S support on powercap/intel_rapl (LP: #1990161) + - powercap: intel_rapl: Add support for RAPTORLAKE_P + - powercap: intel_rapl: Add support for RAPTORLAKE_S + * Kinetic update: upstream stable patchset 2023-01-04 (LP: #2001726) + - drm/amdkfd: handle CPU fault on COW mapping + - drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram() + - hwspinlock: qcom: correct MMIO max register for newer SoCs + - phy: stm32: fix an error code in probe + - wifi: cfg80211: silence a sparse RCU warning + - wifi: cfg80211: fix memory leak in query_regdb_file() + - soundwire: qcom: reinit broadcast completion + - soundwire: qcom: check for outanding writes before doing a read + - bpf, verifier: Fix memory leak in array reallocation for stack state + - bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues + - wifi: mac80211: Set TWT Information Frame Disabled bit as 1 + - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without + FILE + - HID: hyperv: fix possible memory leak in mousevsc_probe() + - bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues + - bpf: Fix sockmap calling sleepable function in teardown path + - bpf, sock_map: Move cancel_work_sync() out of sock lock + - bpf: Add helper macro bpf_for_each_reg_in_vstate + - bpf: Fix wrong reg type conversion in release_reference() + - net: gso: fix panic on frag_list with mixed head alloc types + - macsec: delete new rxsc when offload fails + - macsec: fix secy->n_rx_sc accounting + - macsec: fix detection of RXSCs when toggling offloading + - macsec: clear encryption keys from the stack after setting up offload + - octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT] + - net: tun: Fix memory leaks of napi_get_frags + - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() + - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer + - net: fman: Unregister ethernet device on removal + - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK + - phy: ralink: mt7621-pci: add sentinel to quirks table + - KVM: s390: pv: don't allow userspace to set the clock under PV + - net: lapbether: fix issue of dev reference count leakage in + lapbeth_device_event() + - hamradio: fix issue of dev reference count leakage in bpq_device_event() + - net: wwan: iosm: fix memory leak in ipc_wwan_dellink + - net: wwan: mhi: fix memory leak in mhi_mbim_dellink + - drm/vc4: Fix missing platform_unregister_drivers() call in + vc4_drm_register() + - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent + - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network + - can: af_can: fix NULL pointer dereference in can_rx_register() + - net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable() + - net: broadcom: Fix BCMGENET Kconfig + - tipc: fix the msg->req tlv len check in + tipc_nl_compat_name_table_dump_header + - dmaengine: pxa_dma: use platform_get_irq_optional + - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() + - dmaengine: ti: k3-udma-glue: fix memory leak when register device fail + - net: lapbether: fix issue of invalid opcode in lapbeth_open() + - drivers: net: xgene: disable napi when register irq failed in + xgene_enet_open() + - perf stat: Fix printing os->prefix in CSV metrics output + - perf tools: Add the include/perf/ directory to .gitignore + - netfilter: nfnetlink: fix potential dead lock in nfnetlink_rcv_msg() + - netfilter: Cleanup nft_net->module_list from nf_tables_exit_net() + - net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init() + - net: nixge: disable napi when enable interrupts failed in nixge_open() + - net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfg + - net/mlx5: Bridge, verify LAG state when adding bond to bridge + - net/mlx5: Allow async trigger completion execution on single CPU systems + - net/mlx5e: E-Switch, Fix comparing termination table instance + - net: cpsw: disable napi in cpsw_ndo_open() + - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() + - stmmac: intel: Update PCH PTP clock rate from 200MHz to 204.8MHz + - mctp: Fix an error handling path in mctp_init() + - cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in + cxgb4vf_open() + - stmmac: dwmac-loongson: fix missing pci_disable_msi() while module exiting + - stmmac: dwmac-loongson: fix missing pci_disable_device() in + loongson_dwmac_probe() + - stmmac: dwmac-loongson: fix missing of_node_put() while module exiting + - net: phy: mscc: macsec: clear encryption keys when freeing a flow + - net: atlantic: macsec: clear encryption keys from the stack + - ethernet: s2io: disable napi when start nic failed in s2io_card_up() + - net: mv643xx_eth: disable napi when init rxq or txq failed in + mv643xx_eth_open() + - ethernet: tundra: free irq when alloc ring failed in tsi108_open() + - net: macvlan: fix memory leaks of macvlan_common_newlink + - riscv: process: fix kernel info leakage + - riscv: vdso: fix build with llvm + - riscv: fix reserved memory setup + - arm64: efi: Fix handling of misaligned runtime regions and drop warning + - MIPS: jump_label: Fix compat branch range check + - mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI + - mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci_am654: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA + - ALSA: hda/hdmi - enable runtime pm for more AMD display audio + - ALSA: hda/ca0132: add quirk for EVGA Z390 DARK + - ALSA: hda: fix potential memleak in 'add_widget_node' + - ALSA: hda/realtek: Add Positivo C6300 model quirk + - ALSA: usb-audio: Yet more regression for for the delayed card registration + - ALSA: usb-audio: Add quirk entry for M-Audio Micro + - ALSA: usb-audio: Add DSD support for Accuphase DAC-60 + - vmlinux.lds.h: Fix placement of '.data..decrypted' section + - ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure + - nilfs2: fix deadlock in nilfs_count_free_blocks() + - nilfs2: fix use-after-free bug of ns_writer on remount + - drm/i915/dmabuf: fix sg_table handling in map_dma_buf + - drm/amdgpu: disable BACO on special BEIGE_GOBY card + - btrfs: fix match incorrectly in dev_args_match_device + - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() + - btrfs: zoned: initialize device's zone info for seeding + - mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI + - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() + - mm/damon/dbgfs: check if rm_contexts input is for a real context + - mm/memremap.c: map FS_DAX device memory as decrypted + - mm/shmem: use page_mapping() to detect page cache for uffd continue + - can: j1939: j1939_send_one(): fix missing CAN header initialization + - dmaengine: at_hdmac: Fix at_lli struct definition + - dmaengine: at_hdmac: Don't start transactions at tx_submit level + - dmaengine: at_hdmac: Start transfer for cyclic channels in issue_pending + - dmaengine: at_hdmac: Fix premature completion of desc in issue_pending + - dmaengine: at_hdmac: Do not call the complete callback on + device_terminate_all + - dmaengine: at_hdmac: Protect atchan->status with the channel lock + - dmaengine: at_hdmac: Fix concurrency problems by removing atc_complete_all() + - dmaengine: at_hdmac: Fix concurrency over descriptor + - dmaengine: at_hdmac: Free the memset buf without holding the chan lock + - dmaengine: at_hdmac: Fix concurrency over the active list + - dmaengine: at_hdmac: Fix descriptor handling when issuing it to hardware + - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors + - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable + - dmaengine: at_hdmac: Fix impossible condition + - dmaengine: at_hdmac: Check return code of dma_async_device_register + - drm/amdkfd: Migrate in CPU page fault use current mm + - net: tun: call napi_schedule_prep() to ensure we own a napi + - x86/cpu: Restore AMD's DE_CFG MSR after resume + - drm/i915/gvt: Add missing vfio_unregister_group_dev() call + - KVM: debugfs: Return retval of simple_attr_open() if it fails + - HID: wacom: Fix logic used for 3rd barrel switch emulation + - ALSA: arm: pxa: pxa2xx-ac97-lib: fix return value check of + platform_get_irq() + - spi: mediatek: Fix package division error + - drm/vc4: hdmi: Fix HSM clock too low on Pi4 + - PCI: hv: Fix the definition of vector in hv_compose_msi_msg() + - KVM: s390: pci: Fix allocation size of aift kzdev elements + - drm/i915/psr: Send update also on invalidate + - drm/i915: Do not set cache_dirty for DGFX + - dt-bindings: net: tsnep: Fix typo on generic nvmem property + - dmanegine: idxd: reformat opcap output to match bitmap_parse() input + - dmaengine: idxd: Fix max batch size for Intel IAA + - dmaengine: idxd: fix RO device state error after been disabled/reset + - dmaengine: stm32-dma: fix potential race between pause and resume + - net: ethernet: mtk-star-emac: disable napi when connect and start PHY failed + in mtk_star_enable() + - octeontx2-pf: Fix SQE threshold checking + - perf stat: Fix crash with --per-node --metric-only in CSV mode + - net: wwan: iosm: fix invalid mux header type + - net/mlx5e: Add missing sanity checks for max TX WQE size + - ice: Fix spurious interrupt during removal of trusted VF + - iavf: Fix VF driver counting VLAN 0 filters + - ALSA: memalloc: Don't fall back for SG-buffer with IOMMU + - eth: sp7021: drop free_netdev() from spl2sw_init_netdev() + - mmc: sdhci-brcmstb: Fix SDHCI_RESET_ALL for CQHCI + - ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41 + - drm/amdgpu: workaround for TLB seq race + - drm/amdkfd: Fix error handling in criu_checkpoint + - drm/amdkfd: Fix error handling in kfd_criu_restore_events + - btrfs: zoned: clone zoned device info when cloning a device + - net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unload + - spi: intel: Use correct mask for flash and protected regions + - dmaengine: idxd: Do not enable user type Work Queue without Shared Virtual + Addressing + - can: isotp: fix tx state handling for echo tx processing + - can: rcar_canfd: Add missing ECC error checks for channels 2-7 + - KVM: x86: use a separate asm-offsets.c file + - KVM: SVM: replace regs argument of __svm_vcpu_run() with vcpu_svm + - KVM: SVM: adjust register allocation for __svm_vcpu_run() + - KVM: SVM: retrieve VMCB from assembly + - KVM: SVM: move guest vmsave/vmload back to assembly + * AMD Rembrandt: DP tunneling fails with Thunderbolt monitors + (LP: #1983143) // Kinetic update: upstream stable patchset 2023-01-04 + (LP: #2001726) + - thunderbolt: Add DP OUT resource when DP tunnel is discovered + * CVE-2022-47520 + - wifi: wilc1000: validate pairwise and authentication suite offsets + * CVE-2022-3545 + - nfp: fix use-after-free in area_cache_get() + + -- Andrei Gherzan Thu, 09 Feb 2023 13:22:22 +0000 + linux-kvm (5.19.0-1018.19) kinetic; urgency=medium * kinetic/linux-kvm: 5.19.0-1018.19 -proposed tracker (LP: #2003418) diff -u linux-kvm-5.19.0/debian.kvm/config/annotations linux-kvm-5.19.0/debian.kvm/config/annotations --- linux-kvm-5.19.0/debian.kvm/config/annotations +++ linux-kvm-5.19.0/debian.kvm/config/annotations @@ -2,6 +2,9 @@ # FORMAT: 3 # ARCH: x86 +CONFIG_DUMMY policy<{'amd64': 'm'}> +CONFIG_DUMMY mark note + CONFIG_MODVERSIONS policy<{'amd64': 'y'}> CONFIG_MODVERSIONS mark note diff -u linux-kvm-5.19.0/debian.kvm/config/config.common.ubuntu linux-kvm-5.19.0/debian.kvm/config/config.common.ubuntu --- linux-kvm-5.19.0/debian.kvm/config/config.common.ubuntu +++ linux-kvm-5.19.0/debian.kvm/config/config.common.ubuntu @@ -321,6 +321,7 @@ CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y +CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y @@ -776,7 +777,7 @@ # CONFIG_DRM_DEBUG_MODESET_LOCK is not set CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y CONFIG_DST_CACHE=y -# CONFIG_DUMMY is not set +CONFIG_DUMMY=m # CONFIG_DUMMY_IRQ is not set # CONFIG_DW_XDATA_PCIE is not set # CONFIG_DYNAMIC_DEBUG is not set @@ -1310,6 +1311,7 @@ CONFIG_INET_IPCOMP=m CONFIG_INET_MPTCP_DIAG=y # CONFIG_INET_RAW_DIAG is not set +CONFIG_INET_TABLE_PERTURB_ORDER=16 CONFIG_INET_TCP_DIAG=y CONFIG_INET_TUNNEL=m # CONFIG_INET_UDP_DIAG is not set diff -u linux-kvm-5.19.0/debian.kvm/tracking-bug linux-kvm-5.19.0/debian.kvm/tracking-bug --- linux-kvm-5.19.0/debian.kvm/tracking-bug +++ linux-kvm-5.19.0/debian.kvm/tracking-bug @@ -1 +1 @@ -2003418 2023.01.02-2 +2004289 2023.01.30-1 diff -u linux-kvm-5.19.0/debian.master/abi/abiname linux-kvm-5.19.0/debian.master/abi/abiname --- linux-kvm-5.19.0/debian.master/abi/abiname +++ linux-kvm-5.19.0/debian.master/abi/abiname @@ -1 +1 @@ -30 +31 diff -u linux-kvm-5.19.0/debian.master/abi/version linux-kvm-5.19.0/debian.master/abi/version --- linux-kvm-5.19.0/debian.master/abi/version +++ linux-kvm-5.19.0/debian.master/abi/version @@ -1 +1 @@ -5.19.0-30.31 +5.19.0-34.35 diff -u linux-kvm-5.19.0/debian.master/changelog linux-kvm-5.19.0/debian.master/changelog --- linux-kvm-5.19.0/debian.master/changelog +++ linux-kvm-5.19.0/debian.master/changelog @@ -1,3 +1,921 @@ +linux (5.19.0-35.36) kinetic; urgency=medium + + * kinetic/linux: 5.19.0-35.36 -proposed tracker (LP: #2004652) + + * CVE-2023-0461 + - SAUCE: Fix inet_csk_listen_start after CVE-2023-0461 + + -- Luke Nowakowski-Krijger Fri, 03 Feb 2023 10:16:50 -0800 + +linux (5.19.0-34.35) kinetic; urgency=medium + + * kinetic/linux: 5.19.0-34.35 -proposed tracker (LP: #2004299) + + * LXD containers using shiftfs on ZFS or TMPFS broken on 5.15.0-48.54 + (LP: #1990849) + - [SAUCE] shiftfs: fix -EOVERFLOW inside the container + + * Kinetic update: upstream stable patchset 2023-01-27 (LP: #2004051) + - ASoC: fsl_sai: use local device pointer + - serial: Add rs485_supported to uart_port + - serial: fsl_lpuart: Fill in rs485_supported + - x86/sgx: Create utility to validate user provided offset and length + - x86/sgx: Add overflow check in sgx_validate_offset_length() + - binder: validate alloc->mm in ->mmap() handler + - ceph: Use kcalloc for allocating multiple elements + - ceph: fix NULL pointer dereference for req->r_session + - wifi: mac80211: fix memory free error when registering wiphy fail + - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support + - riscv: dts: sifive unleashed: Add PWM controlled LEDs + - audit: fix undefined behavior in bit shift for AUDIT_BIT + - wifi: airo: do not assign -1 to unsigned char + - wifi: mac80211: Fix ack frame idr leak when mesh has no route + - wifi: ath11k: Fix QCN9074 firmware boot on x86 + - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run + - selftests/bpf: Add verifier test for release_reference() + - Revert "net: macsec: report real_dev features when HW offloading is enabled" + - platform/x86: ideapad-laptop: Disable touchpad_switch + - platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1 + - platform/x86/intel/pmt: Sapphire Rapids PMT errata fix + - scsi: ibmvfc: Avoid path failures during live migration + - scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC + - drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) + - block, bfq: fix null pointer dereference in bfq_bio_bfqg() + - arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. + - nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked + - Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 + properly"" + - ALSA: usb-audio: add quirk to fix Hamedal C20 disconnect issue + - RISC-V: vdso: Do not add missing symbols to version section in linker script + - MIPS: pic32: treat port as signed integer + - xfrm: fix "disable_policy" on ipv4 early demux + - xfrm: replay: Fix ESN wrap around for GSO + - af_key: Fix send_acquire race with pfkey_register + - ARM: dts: am335x-pcm-953: Define fixed regulators in root node + - ASoC: hdac_hda: fix hda pcm buffer overflow issue + - ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove + - ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open() + - x86/hyperv: Restore VP assist page after cpu offlining/onlining + - scsi: storvsc: Fix handling of srb_status and capacity change events + - ASoC: max98373: Add checks for devm_kcalloc + - regulator: core: fix kobject release warning and memory leak in + regulator_register() + - spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld() + - regulator: core: fix UAF in destroy_regulator() + - bus: sunxi-rsb: Remove the shutdown callback + - bus: sunxi-rsb: Support atomic transfers + - tee: optee: fix possible memory leak in optee_register_device() + - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl + - selftests: mptcp: fix mibit vs mbit mix up + - net: liquidio: simplify if expression + - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI- + CAN-15975] + - net: dsa: sja1105: disallow C45 transactions on the BASE-TX MDIO bus + - nfc/nci: fix race with opening and closing + - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() + - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() + - netfilter: conntrack: Fix data-races around ct mark + - netfilter: nf_tables: do not set up extensions for end interval + - iavf: Fix a crash during reset task + - iavf: Do not restart Tx queues after reset task failure + - iavf: Fix race condition between iavf_shutdown and iavf_remove + - ARM: mxs: fix memory leak in mxs_machine_init() + - ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties + - net: ethernet: mtk_eth_soc: fix error handling in mtk_open() + - net/mlx4: Check retval of mlx4_bitmap_init + - net: mvpp2: fix possible invalid pointer dereference + - net/qla3xxx: fix potential memleak in ql3xxx_send() + - octeontx2-af: debugsfs: fix pci device refcount leak + - net: pch_gbe: fix pci device refcount leak while module exiting + - nfp: fill splittable of devlink_port_attrs correctly + - nfp: add port from netdev validation for EEPROM access + - macsec: Fix invalid error code set + - Drivers: hv: vmbus: fix double free in the error path of + vmbus_add_channel_work() + - Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() + - netfilter: ipset: regression in ip_set_hash_ip.c + - net/mlx5: Do not query pci info while pci disabled + - net/mlx5: Fix FW tracer timestamp calculation + - net/mlx5: Fix handling of entry refcount when command is not issued to FW + - tipc: set con sock in tipc_conn_alloc + - tipc: add an extra conn_get in tipc_conn_alloc + - tipc: check skb_linearize() return value in tipc_disc_rcv() + - xfrm: Fix oops in __xfrm_state_delete() + - xfrm: Fix ignored return value in xfrm6_init() + - net: wwan: iosm: use ACPI_FREE() but not kfree() in ipc_pcie_read_bios_cfg() + - sfc: fix potential memleak in __ef100_hard_start_xmit() + - net: sparx5: fix error handling in sparx5_port_open() + - net: sched: allow act_ct to be built without NF_NAT + - NFC: nci: fix memory leak in nci_rx_data_packet() + - regulator: twl6030: re-add TWL6032_SUBCLASS + - bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() + - dma-buf: fix racing conflict of dma_heap_add() + - netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface + - netfilter: flowtable_offload: add missing locking + - fs: do not update freeing inode i_io_list + - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). + - ipv4: Fix error return code in fib_table_insert() + - arcnet: fix potential memory leak in com20020_probe() + - s390/dasd: fix no record found for raw_track_access + - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION + - nfc: st-nci: fix memory leaks in EVT_TRANSACTION + - nfc: st-nci: fix incorrect sizing calculations in EVT_TRANSACTION + - net: enetc: cache accesses to &priv->si->hw + - net: enetc: preserve TX ring priority across reconfiguration + - octeontx2-pf: Add check for devm_kcalloc + - octeontx2-af: Fix reference count issue in rvu_sdp_init() + - net: thunderx: Fix the ACPI memory leak + - s390/crashdump: fix TOD programmable field size + - lib/vdso: use "grep -E" instead of "egrep" + - [Config] updateconfigs for CC_HAS_ASM_GOTO_TIED_OUTPUT + - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash + - nios2: add FORCE for vmlinuz.gz + - KVM: arm64: pkvm: Fixup boot mode to reflect that the kernel resumes from + EL1 + - usb: dwc3: exynos: Fix remove() function + - usb: cdnsp: Fix issue with Clear Feature Halt Endpoint + - usb: cdnsp: fix issue with ZLP - added TD_SIZE = 1 + - ext4: fix use-after-free in ext4_ext_shift_extents + - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency + - iio: light: apds9960: fix wrong register for gesture gain + - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails + - bus: ixp4xx: Don't touch bit 7 on IXP42x + - usb: dwc3: gadget: conditionally remove requests + - usb: dwc3: gadget: Return -ESHUTDOWN on ep disable + - usb: dwc3: gadget: Clear ep descriptor last + - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty + - gcov: clang: fix the buffer overflow issue + - mm: vmscan: fix extreme overreclaim and swap floods + - KVM: x86: nSVM: leave nested mode on vCPU free + - KVM: x86: forcibly leave nested mode on vCPU reset + - KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in + use + - KVM: x86: add kvm_leave_nested + - KVM: x86: remove exit_int_info warning in svm_handle_exit + - x86/tsx: Add a feature bit for TSX control MSR support + - x86/pm: Add enumeration check before spec MSRs save/restore setup + - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() + - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode + - ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 + - tools: iio: iio_generic_buffer: Fix read size + - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() + - Input: goodix - try resetting the controller when no config is set + - Input: soc_button_array - add use_low_level_irq module parameter + - Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[] + - Input: i8042 - apply probe defer to more ASUS ZenBook models + - ASoC: stm32: dfsdm: manage cb buffers cleanup + - xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too + - xen/platform-pci: add missing free_irq() in error path + - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() + - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) + - drm/amdgpu: disable BACO support on more cards + - zonefs: fix zone report size in __zonefs_io_error() + - platform/x86: hp-wmi: Ignore Smart Experience App event + - platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some + Yoga laptops + - [Config] updateconfigs for INET_TABLE_PERTURB_ORDER + - tcp: configurable source port perturb table size + - net: usb: qmi_wwan: add Telit 0x103a composition + - scsi: iscsi: Fix possible memory leak when device_register() failed + - gpu: host1x: Avoid trying to use GART on Tegra20 + - dm integrity: flush the journal on suspend + - dm integrity: clear the journal on suspend + - fuse: lock inode unconditionally in fuse_fallocate() + - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute + - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute + - wifi: wilc1000: validate number of channels + - btrfs: free btrfs_path before copying root refs to userspace + - btrfs: free btrfs_path before copying fspath to userspace + - btrfs: free btrfs_path before copying subvol info to userspace + - btrfs: zoned: fix missing endianness conversion in sb_write_pointer + - btrfs: use kvcalloc in btrfs_get_dev_zone_info + - btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() + - drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN + - drm/amdgpu: Enable Aldebaran devices to report CU Occupancy + - drm/amdgpu: always register an MMU notifier for userptr + - drm/i915: fix TLB invalidation for Gen12 video and compute engines + - wifi: cfg80211: Fix bitrates overflow issue + - spi: tegra210-quad: Don't initialise DMA if not supported + - s390/zcrypt: fix warning about field-spanning write + - selftests/net: give more time to udpgro bg processes to complete startup + - ACPI: video: Add backlight=native DMI quirk for Dell G15 5515 + - drm: panel-orientation-quirks: Add quirk for Nanote UMPC-01 + - s390: always build relocatable kernel + - nvme: quiet user passthrough command errors + - net: wwan: iosm: fix kernel test robot reported errors + - drm/amdgpu: Drop eviction lock when allocating PT BO + - arm64: dts: rockchip: fix quartz64-a bluetooth configuration + - power: supply: ip5xxx: Fix integer overflow in current_now calculation + - power: supply: ab8500: Defer thermal zone probe + - arm64: dts: rockchip: Fix Pine64 Quartz4-B PMIC interrupt + - regulator: rt5759: fix OOB in validate_desc() + - spi: tegra210-quad: Fix duplicate resource error + - selftests: mptcp: gives slow test-case more time + - selftests: mptcp: run mptcp_sockopt from a new netns + - bonding: fix ICMPv6 header handling when receiving IPv6 messages + - drm/i915: Fix warn in intel_display_power_*_domain() functions + - net/mlx5: SF: Fix probing active SFs during driver probe phase + - net/mlx5: cmdif, Print info on any firmware cmd failure to tracepoint + - net/mlx5: E-Switch, Set correctly vport destination + - net/mlx5e: Offload rule only when all encaps are valid + - net: phy: at803x: fix error return code in at803x_probe() + - zonefs: Fix race between modprobe and mount + - tsnep: Fix rotten packets + - blk-mq: fix queue reference leak on blk_mq_alloc_disk_for_queue failure + - test_kprobes: fix implicit declaration error of test_kprobes + - net: ethernet: mtk_eth_soc: fix resource leak in error path + - net: dm9051: Fix missing dev_kfree_skb() in dm9051_loop_rx() + - s390/ap: fix memory leak in ap_init_qci_info() + - fscache: fix OOB Read in __fscache_acquire_volume + - net: wwan: t7xx: Fix the ACPI memory leak + - virtio_net: Fix probe failed when modprobe virtio_net + - can: gs_usb: remove dma allocations + - cifs: fix missing unlock in cifs_file_copychunk_range() + - cifs: Use after free in debug code + - iio: adc: aspeed: Remove the trim valid dts property. + - dt-bindings: iio: adc: Remove the property "aspeed,trim-data-valid" + - mm/damon/sysfs-schemes: skip stats update if the scheme directory is removed + - virt/sev-guest: Prevent IV reuse in the SNP guest driver + - zonefs: Fix active zone accounting + - spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock + - spi: spi-imx: spi_imx_transfer_one(): check for DMA transfer first + - mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1 + - KVM: x86/mmu: Fix race condition in direct_page_fault + - KVM: x86/xen: Only do in-kernel acceleration of hypercalls for guest CPL0 + - KVM: x86/xen: Validate port number in SCHEDOP_poll + - drm/i915/gvt: Get reference to KVM iff attachment to VM is successful + - KVM: Update gfn_to_pfn_cache khva when it moves within the same page + - mm: fix unexpected changes to {failslab|fail_page_alloc}.attr + - mm: correctly charge compressed memory to its memcg + - LoongArch: Clear FPU/SIMD thread info flags for kernel thread + - LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty() + - ASoC: amd: yc: Add Alienware m17 R5 AMD into DMI table + - ASoC: Intel: soc-acpi: add ES83x6 support to IceLake + - ASoC: hda: intel-dsp-config: add ES83x6 quirk for IceLake + - ASoC: SOF: ipc3-topology: use old pipeline teardown flow with SOF2.1 and + older + - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context" + - Revert "tty: n_gsm: replace kicktimer with delayed_work" + - ASoC: sof_es8336: reduce pop noise on speaker + - pinctrl: qcom: sc8280xp: Rectify UFS reset pins + - platform/x86: thinkpad_acpi: Enable s2idle quirk for 21A1 machine type + - platform/x86: ideapad-laptop: Add module parameters to match DMI quirk + tables + - block: make blk_set_default_limits() private + - scsi: mpi3mr: Suppress command reply debug prints + - btrfs: free btrfs_path before copying inodes to userspace + - btrfs: do not modify log tree while holding a leaf from fs tree locked + - drm/i915/ttm: never purge busy objects + - drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code + - drm/amdgpu/psp: don't free PSP buffers on suspend + - drm/amd/amdgpu: reserve vm invalidation engine for firmware + - drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly + when the edid is read" + - btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino + - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() + - iio: health: afe4403: Fix oob read in afe4403_read_raw + - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw + - iio: light: rpr0521: add missing Kconfig dependencies + - bpf, perf: Use subprog name when reporting subprog ksymbol + - scripts/faddr2line: Fix regression in name resolution on ppc64le + - ARM: at91: rm9200: fix usb device clock id + - libbpf: Handle size overflow for ringbuf mmap + - hwmon: (ltc2947) fix temperature scaling + - hwmon: (ina3221) Fix shunt sum critical calculation + - hwmon: (i5500_temp) fix missing pci_disable_device() + - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails + - bpf: Do not copy spin lock field from user in bpf_selem_alloc + - nvmem: rmem: Fix return value check in rmem_read() + - of: property: decrement node refcount in of_fwnode_get_reference_args() + - ixgbevf: Fix resource leak in ixgbevf_init_module() + - i40e: Fix error handling in i40e_init_module() + - fm10k: Fix error handling in fm10k_init_module() + - iavf: Fix error handling in iavf_init_module() + - e100: Fix possible use after free in e100_xmit_prepare + - net/mlx5: DR, Fix uninitialized var warning + - net/mlx5: Fix uninitialized variable bug in outlen_write() + - net/mlx5e: Fix use-after-free when reverting termination table + - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() + - can: cc770: cc770_isa_probe(): add missing free_cc770dev() + - can: etas_es58x: es58x_init_netdev(): free netdev when register_candev() + - can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods + - can: m_can: Add check for devm_clk_get + - qlcnic: fix sleep-in-atomic-context bugs caused by msleep + - aquantia: Do not purge addresses when setting the number of rings + - wifi: cfg80211: fix buffer overflow in elem comparison + - wifi: cfg80211: don't allow multi-BSSID in S1G + - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration + - net: phy: fix null-ptr-deref while probe() failed + - net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() + - net: net_netdev: Fix error handling in ntb_netdev_init_module() + - net/9p: Fix a potential socket leak in p9_socket_open + - net: ethernet: nixge: fix NULL dereference + - net: wwan: iosm: fix kernel test robot reported error + - net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type + - dsa: lan9303: Correct stat name + - tipc: re-fetch skb cb after tipc_msg_validate + - net: hsr: Fix potential use-after-free + - net: mdiobus: fix unbalanced node reference count + - afs: Fix fileserver probe RTT handling + - net: tun: Fix use-after-free in tun_detach() + - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE + - sctp: fix memory leak in sctp_stream_outq_migrate() + - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed + - hwmon: (coretemp) Check for null before removing sysfs attrs + - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() + - riscv: vdso: fix section overlapping under some conditions + - riscv: mm: Proper page permissions after initmem free + - ALSA: dice: fix regression for Lexicon I-ONIX FW810S + - error-injection: Add prompt for function error injection + - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" + - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() + - x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 + - pinctrl: intel: Save and restore pins in "direct IRQ" mode + - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails + - net: stmmac: Set MAC's flow control register to reflect current settings + - mmc: mmc_test: Fix removal of debugfs file + - mmc: core: Fix ambiguous TRIM and DISCARD arg + - mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check + - mmc: sdhci-sprd: Fix no reset data and command after voltage switch + - mmc: sdhci: Fix voltage switch delay + - drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame + - drm/amdgpu: enable Vangogh VCN indirect sram mode + - drm/i915: Fix negative value passed as remaining time + - drm/i915: Never return 0 if not all requests retired + - tracing/osnoise: Fix duration type + - tracing: Fix race where histograms can be called before the event + - tracing: Free buffers when a used dynamic event is removed + - io_uring: cmpxchg for poll arm refs release + - io_uring/poll: fix poll_refs race with cancelation + - ASoC: ops: Fix bounds check for _sx controls + - pinctrl: single: Fix potential division by zero + - riscv: Sync efi page table's kernel mappings before switching + - riscv: fix race when vmap stack overflow + - riscv: kexec: Fixup irq controller broken in kexec crash path + - nvme: fix SRCU protection of nvme_ns_head list + - iommu/vt-d: Fix PCI device refcount leak in has_external_pci() + - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() + - mm: migrate: fix THP's mapcount on isolation + - Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is + enabled + - ipv4: Handle attempt to delete multipath route when fib_info contains an nh + reference + - ipv4: Fix route deletion when nexthop info is not specified + - i2c: npcm7xx: Fix error handling in npcm_i2c_init() + - i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set + - ACPI: HMAT: remove unnecessary variable initialization + - ACPI: HMAT: Fix initiator registration for single-initiator systems + - Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" + - char: tpm: Protect tpm_pm_suspend with locks + - Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() + - ipc/sem: Fix dangling sem_array access in semtimedop race + - clk: samsung: exynos7885: Correct "div4" clock parents + - libbpf: Use correct return pointer in attach_raw_tp + - clocksource/drivers/arm_arch_timer: Fix XGene-1 TVAL register math error + - clk: qcom: gcc-sc8280xp: add cxo as parent for three ufs ref clks + - vfs: fix copy_file_range() averts filesystem freeze protection + - net: wwan: iosm: fix crash in peek throughput test + - net: wwan: iosm: fix incorrect skb length + - mptcp: don't orphan ssk in mptcp_close() + - mptcp: fix sleep in atomic at close time + - hwmon: (asus-ec-sensors) Add checks for devm_kcalloc + - ASoC: tlv320adc3xxx: Fix build error for implicit function declaration + - mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in + damon_sysfs_set_schemes() + - i2c: Restore initial power state if probe fails + - i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer + - powerpc/bpf/32: Fix Oops on tail call tests + + * 5.15.0-58.64 breaks xen bridge networking (pvh domU) (LP: #2002889) + - xen/netback: fix build warning + + * NFS: client permission error after adding user to permissible group + (LP: #2003053) + - NFS: Clear the file access cache upon login + - NFS: Judge the file access cache's timestamp in rcu path + - NFS: Fix up a sparse warning + + * cmsg_so_mark.sh / cmsg_time.sh / cmsg_ipv6.sh in net from + ubuntu_kernel_selftests hang with non-amd64 (LP: #2000667) + - selftests: net: fix cmsg_so_mark.sh test hang + + * Set explicit CC in the headers package (LP: #1999750) + - [Packaging] Set explicit CC in the headers package + + * powerpc-build in ubuntu_kernel_selftests failed on P9 with K-5.19 + (LP: #2000772) + - selftests/powerpc: Avoid GCC 12 uninitialised variable warning + + * [SRU] SoF for RPL platform support (LP: #1992714) + - ASoC: SOC: Intel: introduce cl_init callback + - ASoC: SOF: Intel: add MeteorLake machines + - ASoC: SOF: Intel: Add support for MeteorLake (MTL) + - ASoC: Intel: common: add ACPI matching tables for Raptor Lake + - ASoC: SOF: Intel: pci-tgl: use RPL specific firmware definitions + - [Config] Enable SND_SOC_SOF_METEORLAKE as module + + * Rear Audio port sometimes has no audio output after reboot(Cirrus Logic) + (LP: #1998905) + - ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock. + + * Fix SUT can't displayed after resume from WB/CB with dGFX + installed(FR:6/10)[RX6300][RX6500] (LP: #1999836) + - drm/amd/display: No display after resume from WB/CB + + * commit cf58599cded35cf4affed1e659c0e2c742d3fda7 seems to be missing in + kinetic master to remove "hio" reference from Makefile (LP: #1999556) + - Ubuntu: remove leftover reference to ubuntu/hio driver + + * Add additional Mediatek MT7922 BT device ID (LP: #1998885) + - Bluetooth: btusb: Add a new VID/PID 0489/e0f2 for MT7922 + + * Mute/mic LEDs no function on a HP platfrom (LP: #1998882) + - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook + + * CVE-2023-0461 + - net/ulp: prevent ULP without clone op from entering the LISTEN status + - net/ulp: use consistent error code when blocking ULP + + * CVE-2023-0179 + - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits + + * CVE-2022-20369 + - NFSD: fix use-after-free in __nfs42_ssc_open() + + * Kinetic update: upstream stable patchset 2023-01-23 (LP: #2003753) + - ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in + wm5102_probe" + - ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in + wm5110_probe" + - ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in + wm8997_probe" + - ASoC: mt6660: Keep the pm_runtime enables before component stuff in + mt6660_i2c_probe + - ASoC: rt1019: Fix the TDM settings + - ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK + - spi: intel: Fix the offset to get the 64K erase opcode + - ASoC: codecs: jz4725b: add missed Line In power control bit + - ASoC: codecs: jz4725b: fix reported volume for Master ctl + - ASoC: codecs: jz4725b: use right control for Capture Volume + - ASoC: codecs: jz4725b: fix capture selector naming + - ASoC: Intel: sof_sdw: add quirk variant for LAPBC710 NUC15 + - selftests/futex: fix build for clang + - selftests/intel_pstate: fix build for ARCH=x86_64 + - ASoC: rt1308-sdw: add the default value of some registers + - drm/amd/display: Remove wrong pipe control lock + - ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[] + - RDMA/efa: Add EFA 0xefa2 PCI ID + - btrfs: raid56: properly handle the error when unable to find the missing + stripe + - NFSv4: Retry LOCK on OLD_STATEID during delegation return + - ACPI: x86: Add another system to quirk list for forcing StorageD3Enable + - firmware: arm_scmi: Cleanup the core driver removal callback + - i2c: tegra: Allocate DMA memory for DMA engine + - i2c: i801: add lis3lv02d's I2C address for Vostro 5568 + - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid + - btrfs: remove pointless and double ulist frees in error paths of qgroup + tests + - x86/cpu: Add several Intel server CPU model numbers + - ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> + "Route" + - KVM: x86/pmu: Do not speculatively query Intel GP PMCs that don't exist yet + - hugetlbfs: don't delete error page from pagecache + - arm64: dts: qcom: sa8155p-adp: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8150-xperia-kumano: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8250-xperia-edo: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8350-hdk: Specify which LDO modes are allowed + - spi: stm32: Print summary 'callbacks suppressed' message + - ARM: dts: at91: sama7g5: fix signal name of pin PB2 + - ASoC: core: Fix use-after-free in snd_soc_exit() + - ASoC: tas2770: Fix set_tdm_slot in case of single slot + - ASoC: tas2764: Fix set_tdm_slot in case of single slot + - ARM: at91: pm: avoid soft resetting AC DLL + - serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl() + - serial: 8250_omap: remove wait loop from Errata i202 workaround + - serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() + - serial: 8250: omap: Flush PM QOS work on remove + - serial: imx: Add missing .thaw_noirq hook + - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send + - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() + - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() + - pinctrl: rockchip: list all pins in a possible mux route for PX30 + - scsi: scsi_transport_sas: Fix error handling in sas_phy_add() + - block: sed-opal: kmalloc the cmd/resp buffers + - bpf: Fix memory leaks in __check_func_call + - arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro + - siox: fix possible memory leak in siox_device_add() + - parport_pc: Avoid FIFO port location truncation + - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map + - drm/vc4: kms: Fix IS_ERR() vs NULL check for vc4_kms + - drm/panel: simple: set bpc field for logic technologies displays + - drm/drv: Fix potential memory leak in drm_dev_init() + - drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() + - arm64: dts: imx8mm: Fix NAND controller size-cells + - arm64: dts: imx8mn: Fix NAND controller size-cells + - ata: libata-transport: fix double ata_host_put() in ata_tport_add() + - ata: libata-transport: fix error handling in ata_tport_add() + - ata: libata-transport: fix error handling in ata_tlink_add() + - ata: libata-transport: fix error handling in ata_tdev_add() + - nfp: change eeprom length to max length enumerators + - MIPS: fix duplicate definitions for exported symbols + - MIPS: Loongson64: Add WARN_ON on kexec related kmalloc failed + - bpf: Initialize same number of free nodes for each pcpu_freelist + - net: bgmac: Drop free_netdev() from bgmac_enet_remove() + - mISDN: fix possible memory leak in mISDN_dsp_element_register() + - net: hinic: Fix error handling in hinic_module_init() + - net: stmmac: ensure tx function is not running in stmmac_xdp_release() + - soc: imx8m: Enable OCOTP clock before reading the register + - net: liquidio: release resources when liquidio driver open failed + - mISDN: fix misuse of put_device() in mISDN_register_device() + - net: macvlan: Use built-in RCU list checking + - net: caif: fix double disconnect client in chnl_net_open() + - bnxt_en: Remove debugfs when pci_register_driver failed + - net: mhi: Fix memory leak in mhi_net_dellink() + - net: dsa: make dsa_master_ioctl() see through port_hwtstamp_get() shims + - xen/pcpu: fix possible memory leak in register_pcpu() + - net: ionic: Fix error handling in ionic_init_module() + - net: ena: Fix error handling in ena_init() + - net: hns3: fix setting incorrect phy link ksettings for firmware in + resetting process + - bridge: switchdev: Fix memory leaks when changing VLAN protocol + - drbd: use after free in drbd_create_device() + - platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when + virtualized + - platform/surface: aggregator: Do not check for repeated unsequenced packets + - cifs: add check for returning value of SMB2_close_init + - net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail in + ag71xx_open() + - net/x25: Fix skb leak in x25_lapb_receive_frame() + - cifs: Fix wrong return value checking when GETFLAGS + - net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() + and sparx5_start() + - net: thunderbolt: Fix error handling in tbnet_init() + - cifs: add check for returning value of SMB2_set_info_init + - ftrace: Fix the possible incorrect kernel message + - ftrace: Optimize the allocation for mcount entries + - ftrace: Fix null pointer dereference in ftrace_add_mod() + - ring_buffer: Do not deactivate non-existant pages + - tracing: Fix memory leak in tracing_read_pipe() + - tracing/ring-buffer: Have polling block on watermark + - tracing: Fix memory leak in test_gen_synth_cmd() and + test_empty_synth_event() + - tracing: Fix wild-memory-access in register_synth_event() + - tracing: Fix race where eprobes can be called before the event + - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in + kprobe_event_gen_test_exit() + - tracing: kprobe: Fix potential null-ptr-deref on trace_array in + kprobe_event_gen_test_exit() + - drm/amd/display: Add HUBP surface flip interrupt handler + - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() + - ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro + - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 + - Revert "usb: dwc3: disable USB core PHY management" + - slimbus: qcom-ngd: Fix build error when CONFIG_SLIM_QCOM_NGD_CTRL=y && + CONFIG_QCOM_RPROC_COMMON=m + - slimbus: stream: correct presence rate frequencies + - speakup: fix a segfault caused by switching consoles + - USB: bcma: Make GPIO explicitly optional + - USB: serial: option: add Sierra Wireless EM9191 + - USB: serial: option: remove old LARA-R6 PID + - USB: serial: option: add u-blox LARA-R6 00B modem + - USB: serial: option: add u-blox LARA-L6 modem + - USB: serial: option: add Fibocom FM160 0x0111 composition + - usb: add NO_LPM quirk for Realforce 87U Keyboard + - usb: chipidea: fix deadlock in ci_otg_del_timer + - usb: cdns3: host: fix endless superspeed hub port reset + - usb: typec: mux: Enter safe mode only when pins need to be reconfigured + - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() + - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() + - iio: adc: mp2629: fix wrong comparison of channel + - iio: adc: mp2629: fix potential array out of bound access + - iio: pressure: ms5611: changed hardcoded SPI speed to value limited + - dm ioctl: fix misbehavior if list_versions races with module loading + - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs + - serial: 8250: Flush DMA Rx on RLSI + - serial: 8250_lpss: Configure DMA also w/o DMA filter + - Input: iforce - invert valid length check when fetching device IDs + - maccess: Fix writing offset in case of fault in + strncpy_from_kernel_nofault() + - net: phy: marvell: add sleep time after enabling the loopback bit + - scsi: zfcp: Fix double free of FSF request when qdio send fails + - iommu/vt-d: Preset Access bit for IOVA in FL non-leaf paging entries + - iommu/vt-d: Set SRE bit only when hardware has SRS cap + - firmware: coreboot: Register bus in module init + - mmc: core: properly select voltage range without power cycle + - mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce + timeout + - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() + - docs: update mediator contact information in CoC doc + - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() + - perf/x86/intel/pt: Fix sampling using single range output + - nvme: restrict management ioctls to admin + - nvme: ensure subsystem reset is single threaded + - serial: 8250_lpss: Use 16B DMA burst with Elkhart Lake + - perf: Improve missing SIGTRAP checking + - ring-buffer: Include dropped pages in counting dirty patches + - tracing: Fix warning on variable 'struct trace_array' + - net: use struct_group to copy ip/ipv6 header addresses + - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() + - scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() + - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case + - Input: i8042 - fix leaking of platform device on module removal + - macvlan: enforce a consistent minimal mtu + - tcp: cdg: allow tcp_cdg_release() to be called multiple times + - kcm: avoid potential race in kcm_tx_work + - kcm: close race conditions on sk_receive_queue + - 9p: trans_fd/p9_conn_cancel: drop client lock earlier + - gfs2: Check sb_bsize_shift after reading superblock + - gfs2: Switch from strlcpy to strscpy + - 9p/trans_fd: always use O_NONBLOCK read/write + - wifi: wext: use flex array destination for memcpy() + - mm: fs: initialize fsdata passed to write_begin/write_end interface + - net/9p: use a dedicated spinlock for trans_fd + - ntfs: fix use-after-free in ntfs_attr_find() + - ntfs: fix out-of-bounds read in ntfs_attr_find() + - ntfs: check overflow when iterating ATTR_RECORDs + - drm/msm/gpu: Fix crash during system suspend after unbind + - spi: tegra210-quad: Fix combined sequence + - ASoC: rt5682s: Fix the TDM Tx settings + - selftests/kexec: fix build for ARCH=x86_64 + - ASoC: Intel: sof_rt5682: Add quirk for Rex board + - ASoC: amd: yc: Adding Lenovo ThinkBook 14 Gen 4+ ARA and Lenovo ThinkBook 16 + Gen 4+ ARA to the Quirks List + - ASoC: amd: yc: Add Lenovo Thinkbook 14+ 2022 21D0 to quirks table + - drm/amdgpu: Adjust MES polling timeout for sriov + - platform/x86: thinkpad_acpi: Fix reporting a non present second fan on some + models + - drm/scheduler: fix fence ref counting + - cxl/mbox: Add a check on input payload size + - SUNRPC: Fix crasher in gss_unwrap_resp_integ() + - drm/rockchip: vop2: fix null pointer in plane_atomic_disable + - drm/rockchip: vop2: disable planes when disabling the crtc + - ksefltests: pidfd: Fix wait_states: Test terminated by timeout + - powerpc/64e: Fix amdgpu build on Book3E w/o AltiVec + - block: blk_add_rq_to_plug(): clear stale 'last' after flush + - firmware: arm_scmi: Make tx_prepare time out eventually + - drm/amd/display: Ignore Cable ID Feature + - drm/amdgpu: set fb_modifiers_not_supported in vkms + - drm/amd: Fail the suspend if resources can't be evicted + - cxl/pmem: Use size_add() against integer overflow + - tools/testing/cxl: Fix some error exits + - arm64/mm: fold check for KFENCE into can_set_direct_map() + - arm64: fix rodata=full again + - KVM: SVM: remove dead field from struct svm_cpu_data + - KVM: SVM: do not allocate struct svm_cpu_data dynamically + - KVM: SVM: restore host save area from assembly + - KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly + - arm64: dts: qcom: sc7280: Add the reset reg for lpass audiocc on SC7280 + - ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=N + - arm64: dts: qcom: sm8250: Disable the not yet supported cluster idle state + - tty: serial: fsl_lpuart: don't break the on-going transfer when global reset + - bnxt_en: refactor bnxt_cancel_reservations() + - bnxt_en: fix the handling of PCIE-AER + - mtd: onenand: omap2: add dependency on GPMC + - sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent + - sctp: clear out_curr if all frag chunks of current msg are pruned + - erofs: clean up .read_folio() and .readahead() in fscache mode + - io_uring: calculate CQEs from the user visible value + - pinctrl: mediatek: common-v2: Fix bias-disable for PULL_PU_PD_RSEL_TYPE + - selftests/bpf: Fix test_progs compilation failure in 32-bit arch + - arm64: dts: imx8mm-tqma8mqml-mba8mx: Fix USB DR + - cifs: Fix connections leak when tlink setup failed + - ata: libata-core: do not issue non-internal commands once EH is pending + - net: phy: dp83867: Fix SGMII FIFO depth for non OF devices + - mctp i2c: don't count unused / invalid keys for flow release + - octeon_ep: delete unnecessary napi rollback under set_queues_err in + octep_open() + - octeon_ep: ensure octep_get_link_status() successfully before + octep_link_up() + - octeon_ep: fix potential memory leak in octep_device_setup() + - octeon_ep: ensure get mac address successfully before eth_hw_addr_set() + - erofs: fix missing xas_retry() in fscache mode + - mlxsw: Avoid warnings when not offloaded FDB entry with IPv6 is removed + - net: hns3: fix incorrect hw rss hash type of rx packet + - net: hns3: fix return value check bug of rx copybreak + - netfs: Fix missing xas_retry() calls in xarray iteration + - netfs: Fix dodgy maths + - net: dsa: don't leak tagger-owned storage on switch driver unbind + - net: lan966x: Fix potential null-ptr-deref in lan966x_stats_init() + - s390: avoid using global register for current_stack_pointer + - netdevsim: Fix memory leak of nsim_dev->fa_cookie + - rethook: fix a potential memleak in rethook_alloc() + - drm/amd/pm: fix SMU13 runpm hang due to unintentional workaround + - drm/display: Don't assume dual mode adaptors support i2c sub-addressing + - drm/amd/display: Fix invalid DPIA AUX reply causing system hang + - drm/amd/display: Fix access timeout to DPIA AUX at boot time + - drm/amd/display: Support parsing VRAM info v3.0 from VBIOS + - usb: dwc3: Do not get extcon device when usb-role-switch is used + - nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro + - nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV7000 + - usb: typec: tipd: Prevent uninitialized event{1,2} in IRQ handler + - iio: accel: bma400: Ensure VDDIO is enable defore reading the chip ID. + - iio: pressure: ms5611: fixed value compensation bug + - ceph: avoid putting the realm twice when decoding snaps fails + - s390/dcssblk: fix deadlock when adding a DCSS + - blk-cgroup: properly pin the parent in blkcg_css_online + - x86/fpu: Drop fpregs lock before inheriting FPU permissions + - ASoC: SOF: topology: No need to assign core ID if token parsing failed + - perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and + throttling + - net: usb: smsc95xx: fix external PHY reset + - tracing: Fix potential null-pointer-access of entry in list 'tr->err_log' + - arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud + - KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign() + - netlink: Bounds-check struct nlmsgerr creation + - bpf: Prevent bpf program recursion for raw tracepoint probes + + * Fix RPL-S support on powercap/intel_rapl (LP: #1990161) + - powercap: intel_rapl: Add support for RAPTORLAKE_P + - powercap: intel_rapl: Add support for RAPTORLAKE_S + + * Kinetic update: upstream stable patchset 2023-01-04 (LP: #2001726) + - drm/amdkfd: handle CPU fault on COW mapping + - drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram() + - hwspinlock: qcom: correct MMIO max register for newer SoCs + - phy: stm32: fix an error code in probe + - wifi: cfg80211: silence a sparse RCU warning + - wifi: cfg80211: fix memory leak in query_regdb_file() + - soundwire: qcom: reinit broadcast completion + - soundwire: qcom: check for outanding writes before doing a read + - bpf, verifier: Fix memory leak in array reallocation for stack state + - bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues + - wifi: mac80211: Set TWT Information Frame Disabled bit as 1 + - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without + FILE + - HID: hyperv: fix possible memory leak in mousevsc_probe() + - bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues + - bpf: Fix sockmap calling sleepable function in teardown path + - bpf, sock_map: Move cancel_work_sync() out of sock lock + - bpf: Add helper macro bpf_for_each_reg_in_vstate + - bpf: Fix wrong reg type conversion in release_reference() + - net: gso: fix panic on frag_list with mixed head alloc types + - macsec: delete new rxsc when offload fails + - macsec: fix secy->n_rx_sc accounting + - macsec: fix detection of RXSCs when toggling offloading + - macsec: clear encryption keys from the stack after setting up offload + - octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT] + - net: tun: Fix memory leaks of napi_get_frags + - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() + - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer + - net: fman: Unregister ethernet device on removal + - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK + - phy: ralink: mt7621-pci: add sentinel to quirks table + - KVM: s390: pv: don't allow userspace to set the clock under PV + - net: lapbether: fix issue of dev reference count leakage in + lapbeth_device_event() + - hamradio: fix issue of dev reference count leakage in bpq_device_event() + - net: wwan: iosm: fix memory leak in ipc_wwan_dellink + - net: wwan: mhi: fix memory leak in mhi_mbim_dellink + - drm/vc4: Fix missing platform_unregister_drivers() call in + vc4_drm_register() + - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent + - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network + - can: af_can: fix NULL pointer dereference in can_rx_register() + - net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable() + - net: broadcom: Fix BCMGENET Kconfig + - tipc: fix the msg->req tlv len check in + tipc_nl_compat_name_table_dump_header + - dmaengine: pxa_dma: use platform_get_irq_optional + - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() + - dmaengine: ti: k3-udma-glue: fix memory leak when register device fail + - net: lapbether: fix issue of invalid opcode in lapbeth_open() + - drivers: net: xgene: disable napi when register irq failed in + xgene_enet_open() + - perf stat: Fix printing os->prefix in CSV metrics output + - perf tools: Add the include/perf/ directory to .gitignore + - netfilter: nfnetlink: fix potential dead lock in nfnetlink_rcv_msg() + - netfilter: Cleanup nft_net->module_list from nf_tables_exit_net() + - net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init() + - net: nixge: disable napi when enable interrupts failed in nixge_open() + - net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfg + - net/mlx5: Bridge, verify LAG state when adding bond to bridge + - net/mlx5: Allow async trigger completion execution on single CPU systems + - net/mlx5e: E-Switch, Fix comparing termination table instance + - net: cpsw: disable napi in cpsw_ndo_open() + - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() + - stmmac: intel: Update PCH PTP clock rate from 200MHz to 204.8MHz + - mctp: Fix an error handling path in mctp_init() + - cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in + cxgb4vf_open() + - stmmac: dwmac-loongson: fix missing pci_disable_msi() while module exiting + - stmmac: dwmac-loongson: fix missing pci_disable_device() in + loongson_dwmac_probe() + - stmmac: dwmac-loongson: fix missing of_node_put() while module exiting + - net: phy: mscc: macsec: clear encryption keys when freeing a flow + - net: atlantic: macsec: clear encryption keys from the stack + - ethernet: s2io: disable napi when start nic failed in s2io_card_up() + - net: mv643xx_eth: disable napi when init rxq or txq failed in + mv643xx_eth_open() + - ethernet: tundra: free irq when alloc ring failed in tsi108_open() + - net: macvlan: fix memory leaks of macvlan_common_newlink + - riscv: process: fix kernel info leakage + - riscv: vdso: fix build with llvm + - riscv: fix reserved memory setup + - arm64: efi: Fix handling of misaligned runtime regions and drop warning + - MIPS: jump_label: Fix compat branch range check + - mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI + - mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci_am654: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA + - ALSA: hda/hdmi - enable runtime pm for more AMD display audio + - ALSA: hda/ca0132: add quirk for EVGA Z390 DARK + - ALSA: hda: fix potential memleak in 'add_widget_node' + - ALSA: hda/realtek: Add Positivo C6300 model quirk + - ALSA: usb-audio: Yet more regression for for the delayed card registration + - ALSA: usb-audio: Add quirk entry for M-Audio Micro + - ALSA: usb-audio: Add DSD support for Accuphase DAC-60 + - vmlinux.lds.h: Fix placement of '.data..decrypted' section + - ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure + - nilfs2: fix deadlock in nilfs_count_free_blocks() + - nilfs2: fix use-after-free bug of ns_writer on remount + - drm/i915/dmabuf: fix sg_table handling in map_dma_buf + - drm/amdgpu: disable BACO on special BEIGE_GOBY card + - btrfs: fix match incorrectly in dev_args_match_device + - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() + - btrfs: zoned: initialize device's zone info for seeding + - mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI + - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() + - mm/damon/dbgfs: check if rm_contexts input is for a real context + - mm/memremap.c: map FS_DAX device memory as decrypted + - mm/shmem: use page_mapping() to detect page cache for uffd continue + - can: j1939: j1939_send_one(): fix missing CAN header initialization + - dmaengine: at_hdmac: Fix at_lli struct definition + - dmaengine: at_hdmac: Don't start transactions at tx_submit level + - dmaengine: at_hdmac: Start transfer for cyclic channels in issue_pending + - dmaengine: at_hdmac: Fix premature completion of desc in issue_pending + - dmaengine: at_hdmac: Do not call the complete callback on + device_terminate_all + - dmaengine: at_hdmac: Protect atchan->status with the channel lock + - dmaengine: at_hdmac: Fix concurrency problems by removing atc_complete_all() + - dmaengine: at_hdmac: Fix concurrency over descriptor + - dmaengine: at_hdmac: Free the memset buf without holding the chan lock + - dmaengine: at_hdmac: Fix concurrency over the active list + - dmaengine: at_hdmac: Fix descriptor handling when issuing it to hardware + - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors + - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable + - dmaengine: at_hdmac: Fix impossible condition + - dmaengine: at_hdmac: Check return code of dma_async_device_register + - drm/amdkfd: Migrate in CPU page fault use current mm + - net: tun: call napi_schedule_prep() to ensure we own a napi + - x86/cpu: Restore AMD's DE_CFG MSR after resume + - drm/i915/gvt: Add missing vfio_unregister_group_dev() call + - KVM: debugfs: Return retval of simple_attr_open() if it fails + - HID: wacom: Fix logic used for 3rd barrel switch emulation + - ALSA: arm: pxa: pxa2xx-ac97-lib: fix return value check of + platform_get_irq() + - spi: mediatek: Fix package division error + - drm/vc4: hdmi: Fix HSM clock too low on Pi4 + - PCI: hv: Fix the definition of vector in hv_compose_msi_msg() + - KVM: s390: pci: Fix allocation size of aift kzdev elements + - drm/i915/psr: Send update also on invalidate + - drm/i915: Do not set cache_dirty for DGFX + - dt-bindings: net: tsnep: Fix typo on generic nvmem property + - dmanegine: idxd: reformat opcap output to match bitmap_parse() input + - dmaengine: idxd: Fix max batch size for Intel IAA + - dmaengine: idxd: fix RO device state error after been disabled/reset + - dmaengine: stm32-dma: fix potential race between pause and resume + - net: ethernet: mtk-star-emac: disable napi when connect and start PHY failed + in mtk_star_enable() + - octeontx2-pf: Fix SQE threshold checking + - perf stat: Fix crash with --per-node --metric-only in CSV mode + - net: wwan: iosm: fix invalid mux header type + - net/mlx5e: Add missing sanity checks for max TX WQE size + - ice: Fix spurious interrupt during removal of trusted VF + - iavf: Fix VF driver counting VLAN 0 filters + - ALSA: memalloc: Don't fall back for SG-buffer with IOMMU + - eth: sp7021: drop free_netdev() from spl2sw_init_netdev() + - mmc: sdhci-brcmstb: Fix SDHCI_RESET_ALL for CQHCI + - ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41 + - drm/amdgpu: workaround for TLB seq race + - drm/amdkfd: Fix error handling in criu_checkpoint + - drm/amdkfd: Fix error handling in kfd_criu_restore_events + - btrfs: zoned: clone zoned device info when cloning a device + - net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unload + - spi: intel: Use correct mask for flash and protected regions + - dmaengine: idxd: Do not enable user type Work Queue without Shared Virtual + Addressing + - can: isotp: fix tx state handling for echo tx processing + - can: rcar_canfd: Add missing ECC error checks for channels 2-7 + - KVM: x86: use a separate asm-offsets.c file + - KVM: SVM: replace regs argument of __svm_vcpu_run() with vcpu_svm + - KVM: SVM: adjust register allocation for __svm_vcpu_run() + - KVM: SVM: retrieve VMCB from assembly + - KVM: SVM: move guest vmsave/vmload back to assembly + + * AMD Rembrandt: DP tunneling fails with Thunderbolt monitors + (LP: #1983143) // Kinetic update: upstream stable patchset 2023-01-04 + (LP: #2001726) + - thunderbolt: Add DP OUT resource when DP tunnel is discovered + + * CVE-2022-47520 + - wifi: wilc1000: validate pairwise and authentication suite offsets + + * CVE-2022-3545 + - nfp: fix use-after-free in area_cache_get() + + -- Stefan Bader Wed, 01 Feb 2023 14:55:40 +0100 + linux (5.19.0-31.32) kinetic; urgency=medium * kinetic/linux: 5.19.0-31.32 -proposed tracker (LP: #2003423) diff -u linux-kvm-5.19.0/debian.master/config/config.common.ubuntu linux-kvm-5.19.0/debian.master/config/config.common.ubuntu --- linux-kvm-5.19.0/debian.master/config/config.common.ubuntu +++ linux-kvm-5.19.0/debian.master/config/config.common.ubuntu @@ -1579,6 +1579,7 @@ CONFIG_CC_CAN_LINK_STATIC=y CONFIG_CC_HAS_ASM_GOTO=y CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y +CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y CONFIG_CC_HAS_ASM_INLINE=y CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y @@ -5017,6 +5018,7 @@ CONFIG_INET_MPTCP_DIAG=m CONFIG_INET_RAW_DIAG=m CONFIG_INET_SCTP_DIAG=m +CONFIG_INET_TABLE_PERTURB_ORDER=16 CONFIG_INET_TCP_DIAG=m CONFIG_INET_TUNNEL=m CONFIG_INET_UDP_DIAG=m @@ -10834,12 +10836,14 @@ CONFIG_SND_SOC_SOF_INTEL_COMMON=m CONFIG_SND_SOC_SOF_INTEL_HIFI_EP_IPC=m CONFIG_SND_SOC_SOF_INTEL_ICL=m +CONFIG_SND_SOC_SOF_INTEL_MTL=m CONFIG_SND_SOC_SOF_INTEL_SOUNDWIRE=m CONFIG_SND_SOC_SOF_INTEL_SOUNDWIRE_LINK_BASELINE=m CONFIG_SND_SOC_SOF_INTEL_TGL=m CONFIG_SND_SOC_SOF_INTEL_TOPLEVEL=y CONFIG_SND_SOC_SOF_JASPERLAKE=m CONFIG_SND_SOC_SOF_MERRIFIELD=m +CONFIG_SND_SOC_SOF_METEORLAKE=m CONFIG_SND_SOC_SOF_MT8186=m CONFIG_SND_SOC_SOF_MT8195=m CONFIG_SND_SOC_SOF_MTK_COMMON=m diff -u linux-kvm-5.19.0/debian.master/tracking-bug linux-kvm-5.19.0/debian.master/tracking-bug --- linux-kvm-5.19.0/debian.master/tracking-bug +++ linux-kvm-5.19.0/debian.master/tracking-bug @@ -1 +1 @@ -2003423 2023.01.02-2 +2004652 2023.01.30-3 diff -u linux-kvm-5.19.0/debian.master/upstream-stable linux-kvm-5.19.0/debian.master/upstream-stable --- linux-kvm-5.19.0/debian.master/upstream-stable +++ linux-kvm-5.19.0/debian.master/upstream-stable @@ -3,3 +3,3 @@ - linux-5.15.y = v5.15.78 + linux-5.15.y = v5.15.82 linux-5.19.y = v5.19.17 - linux-6.0.y = v6.0.8 + linux-6.0.y = v6.0.12 diff -u linux-kvm-5.19.0/debian/changelog linux-kvm-5.19.0/debian/changelog --- linux-kvm-5.19.0/debian/changelog +++ linux-kvm-5.19.0/debian/changelog @@ -1,3 +1,906 @@ +linux-kvm (5.19.0-1019.20) kinetic; urgency=medium + + * kinetic/linux-kvm: 5.19.0-1019.20 -proposed tracker (LP: #2004289) + + * Kinetic update: upstream stable patchset 2023-01-27 (LP: #2004051) + - [Config] updateconfigs following Ubuntu-5.19.0-35.36 rebase + + * kselftest net/fib_nexthop_nongw.sh fails (LP: #1998244) + - [Config] kvm: Add support for dummy net driver + + [ Ubuntu: 5.19.0-35.36 ] + + * kinetic/linux: 5.19.0-35.36 -proposed tracker (LP: #2004652) + * CVE-2023-0461 + - SAUCE: Fix inet_csk_listen_start after CVE-2023-0461 + + [ Ubuntu: 5.19.0-34.35 ] + + * kinetic/linux: 5.19.0-34.35 -proposed tracker (LP: #2004299) + * LXD containers using shiftfs on ZFS or TMPFS broken on 5.15.0-48.54 + (LP: #1990849) + - [SAUCE] shiftfs: fix -EOVERFLOW inside the container + * Kinetic update: upstream stable patchset 2023-01-27 (LP: #2004051) + - ASoC: fsl_sai: use local device pointer + - serial: Add rs485_supported to uart_port + - serial: fsl_lpuart: Fill in rs485_supported + - x86/sgx: Create utility to validate user provided offset and length + - x86/sgx: Add overflow check in sgx_validate_offset_length() + - binder: validate alloc->mm in ->mmap() handler + - ceph: Use kcalloc for allocating multiple elements + - ceph: fix NULL pointer dereference for req->r_session + - wifi: mac80211: fix memory free error when registering wiphy fail + - wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support + - riscv: dts: sifive unleashed: Add PWM controlled LEDs + - audit: fix undefined behavior in bit shift for AUDIT_BIT + - wifi: airo: do not assign -1 to unsigned char + - wifi: mac80211: Fix ack frame idr leak when mesh has no route + - wifi: ath11k: Fix QCN9074 firmware boot on x86 + - spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run + - selftests/bpf: Add verifier test for release_reference() + - Revert "net: macsec: report real_dev features when HW offloading is enabled" + - platform/x86: ideapad-laptop: Disable touchpad_switch + - platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1 + - platform/x86/intel/pmt: Sapphire Rapids PMT errata fix + - scsi: ibmvfc: Avoid path failures during live migration + - scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC + - drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) + - block, bfq: fix null pointer dereference in bfq_bio_bfqg() + - arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. + - nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked + - Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 + properly"" + - ALSA: usb-audio: add quirk to fix Hamedal C20 disconnect issue + - RISC-V: vdso: Do not add missing symbols to version section in linker script + - MIPS: pic32: treat port as signed integer + - xfrm: fix "disable_policy" on ipv4 early demux + - xfrm: replay: Fix ESN wrap around for GSO + - af_key: Fix send_acquire race with pfkey_register + - ARM: dts: am335x-pcm-953: Define fixed regulators in root node + - ASoC: hdac_hda: fix hda pcm buffer overflow issue + - ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove + - ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open() + - x86/hyperv: Restore VP assist page after cpu offlining/onlining + - scsi: storvsc: Fix handling of srb_status and capacity change events + - ASoC: max98373: Add checks for devm_kcalloc + - regulator: core: fix kobject release warning and memory leak in + regulator_register() + - spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld() + - regulator: core: fix UAF in destroy_regulator() + - bus: sunxi-rsb: Remove the shutdown callback + - bus: sunxi-rsb: Support atomic transfers + - tee: optee: fix possible memory leak in optee_register_device() + - ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl + - selftests: mptcp: fix mibit vs mbit mix up + - net: liquidio: simplify if expression + - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI- + CAN-15975] + - net: dsa: sja1105: disallow C45 transactions on the BASE-TX MDIO bus + - nfc/nci: fix race with opening and closing + - net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() + - 9p/fd: fix issue of list_del corruption in p9_fd_cancel() + - netfilter: conntrack: Fix data-races around ct mark + - netfilter: nf_tables: do not set up extensions for end interval + - iavf: Fix a crash during reset task + - iavf: Do not restart Tx queues after reset task failure + - iavf: Fix race condition between iavf_shutdown and iavf_remove + - ARM: mxs: fix memory leak in mxs_machine_init() + - ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties + - net: ethernet: mtk_eth_soc: fix error handling in mtk_open() + - net/mlx4: Check retval of mlx4_bitmap_init + - net: mvpp2: fix possible invalid pointer dereference + - net/qla3xxx: fix potential memleak in ql3xxx_send() + - octeontx2-af: debugsfs: fix pci device refcount leak + - net: pch_gbe: fix pci device refcount leak while module exiting + - nfp: fill splittable of devlink_port_attrs correctly + - nfp: add port from netdev validation for EEPROM access + - macsec: Fix invalid error code set + - Drivers: hv: vmbus: fix double free in the error path of + vmbus_add_channel_work() + - Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() + - netfilter: ipset: regression in ip_set_hash_ip.c + - net/mlx5: Do not query pci info while pci disabled + - net/mlx5: Fix FW tracer timestamp calculation + - net/mlx5: Fix handling of entry refcount when command is not issued to FW + - tipc: set con sock in tipc_conn_alloc + - tipc: add an extra conn_get in tipc_conn_alloc + - tipc: check skb_linearize() return value in tipc_disc_rcv() + - xfrm: Fix oops in __xfrm_state_delete() + - xfrm: Fix ignored return value in xfrm6_init() + - net: wwan: iosm: use ACPI_FREE() but not kfree() in ipc_pcie_read_bios_cfg() + - sfc: fix potential memleak in __ef100_hard_start_xmit() + - net: sparx5: fix error handling in sparx5_port_open() + - net: sched: allow act_ct to be built without NF_NAT + - NFC: nci: fix memory leak in nci_rx_data_packet() + - regulator: twl6030: re-add TWL6032_SUBCLASS + - bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() + - dma-buf: fix racing conflict of dma_heap_add() + - netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface + - netfilter: flowtable_offload: add missing locking + - fs: do not update freeing inode i_io_list + - dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). + - ipv4: Fix error return code in fib_table_insert() + - arcnet: fix potential memory leak in com20020_probe() + - s390/dasd: fix no record found for raw_track_access + - nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION + - nfc: st-nci: fix memory leaks in EVT_TRANSACTION + - nfc: st-nci: fix incorrect sizing calculations in EVT_TRANSACTION + - net: enetc: cache accesses to &priv->si->hw + - net: enetc: preserve TX ring priority across reconfiguration + - octeontx2-pf: Add check for devm_kcalloc + - octeontx2-af: Fix reference count issue in rvu_sdp_init() + - net: thunderx: Fix the ACPI memory leak + - s390/crashdump: fix TOD programmable field size + - lib/vdso: use "grep -E" instead of "egrep" + - [Config] updateconfigs for CC_HAS_ASM_GOTO_TIED_OUTPUT + - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash + - nios2: add FORCE for vmlinuz.gz + - KVM: arm64: pkvm: Fixup boot mode to reflect that the kernel resumes from + EL1 + - usb: dwc3: exynos: Fix remove() function + - usb: cdnsp: Fix issue with Clear Feature Halt Endpoint + - usb: cdnsp: fix issue with ZLP - added TD_SIZE = 1 + - ext4: fix use-after-free in ext4_ext_shift_extents + - arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency + - iio: light: apds9960: fix wrong register for gesture gain + - iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails + - bus: ixp4xx: Don't touch bit 7 on IXP42x + - usb: dwc3: gadget: conditionally remove requests + - usb: dwc3: gadget: Return -ESHUTDOWN on ep disable + - usb: dwc3: gadget: Clear ep descriptor last + - nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty + - gcov: clang: fix the buffer overflow issue + - mm: vmscan: fix extreme overreclaim and swap floods + - KVM: x86: nSVM: leave nested mode on vCPU free + - KVM: x86: forcibly leave nested mode on vCPU reset + - KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in + use + - KVM: x86: add kvm_leave_nested + - KVM: x86: remove exit_int_info warning in svm_handle_exit + - x86/tsx: Add a feature bit for TSX control MSR support + - x86/pm: Add enumeration check before spec MSRs save/restore setup + - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() + - Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode + - ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 + - tools: iio: iio_generic_buffer: Fix read size + - serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() + - Input: goodix - try resetting the controller when no config is set + - Input: soc_button_array - add use_low_level_irq module parameter + - Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[] + - Input: i8042 - apply probe defer to more ASUS ZenBook models + - ASoC: stm32: dfsdm: manage cb buffers cleanup + - xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too + - xen/platform-pci: add missing free_irq() in error path + - platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() + - platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) + - drm/amdgpu: disable BACO support on more cards + - zonefs: fix zone report size in __zonefs_io_error() + - platform/x86: hp-wmi: Ignore Smart Experience App event + - platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some + Yoga laptops + - [Config] updateconfigs for INET_TABLE_PERTURB_ORDER + - tcp: configurable source port perturb table size + - net: usb: qmi_wwan: add Telit 0x103a composition + - scsi: iscsi: Fix possible memory leak when device_register() failed + - gpu: host1x: Avoid trying to use GART on Tegra20 + - dm integrity: flush the journal on suspend + - dm integrity: clear the journal on suspend + - fuse: lock inode unconditionally in fuse_fallocate() + - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute + - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute + - wifi: wilc1000: validate number of channels + - btrfs: free btrfs_path before copying root refs to userspace + - btrfs: free btrfs_path before copying fspath to userspace + - btrfs: free btrfs_path before copying subvol info to userspace + - btrfs: zoned: fix missing endianness conversion in sb_write_pointer + - btrfs: use kvcalloc in btrfs_get_dev_zone_info + - btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() + - drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN + - drm/amdgpu: Enable Aldebaran devices to report CU Occupancy + - drm/amdgpu: always register an MMU notifier for userptr + - drm/i915: fix TLB invalidation for Gen12 video and compute engines + - wifi: cfg80211: Fix bitrates overflow issue + - spi: tegra210-quad: Don't initialise DMA if not supported + - s390/zcrypt: fix warning about field-spanning write + - selftests/net: give more time to udpgro bg processes to complete startup + - ACPI: video: Add backlight=native DMI quirk for Dell G15 5515 + - drm: panel-orientation-quirks: Add quirk for Nanote UMPC-01 + - s390: always build relocatable kernel + - nvme: quiet user passthrough command errors + - net: wwan: iosm: fix kernel test robot reported errors + - drm/amdgpu: Drop eviction lock when allocating PT BO + - arm64: dts: rockchip: fix quartz64-a bluetooth configuration + - power: supply: ip5xxx: Fix integer overflow in current_now calculation + - power: supply: ab8500: Defer thermal zone probe + - arm64: dts: rockchip: Fix Pine64 Quartz4-B PMIC interrupt + - regulator: rt5759: fix OOB in validate_desc() + - spi: tegra210-quad: Fix duplicate resource error + - selftests: mptcp: gives slow test-case more time + - selftests: mptcp: run mptcp_sockopt from a new netns + - bonding: fix ICMPv6 header handling when receiving IPv6 messages + - drm/i915: Fix warn in intel_display_power_*_domain() functions + - net/mlx5: SF: Fix probing active SFs during driver probe phase + - net/mlx5: cmdif, Print info on any firmware cmd failure to tracepoint + - net/mlx5: E-Switch, Set correctly vport destination + - net/mlx5e: Offload rule only when all encaps are valid + - net: phy: at803x: fix error return code in at803x_probe() + - zonefs: Fix race between modprobe and mount + - tsnep: Fix rotten packets + - blk-mq: fix queue reference leak on blk_mq_alloc_disk_for_queue failure + - test_kprobes: fix implicit declaration error of test_kprobes + - net: ethernet: mtk_eth_soc: fix resource leak in error path + - net: dm9051: Fix missing dev_kfree_skb() in dm9051_loop_rx() + - s390/ap: fix memory leak in ap_init_qci_info() + - fscache: fix OOB Read in __fscache_acquire_volume + - net: wwan: t7xx: Fix the ACPI memory leak + - virtio_net: Fix probe failed when modprobe virtio_net + - can: gs_usb: remove dma allocations + - cifs: fix missing unlock in cifs_file_copychunk_range() + - cifs: Use after free in debug code + - iio: adc: aspeed: Remove the trim valid dts property. + - dt-bindings: iio: adc: Remove the property "aspeed,trim-data-valid" + - mm/damon/sysfs-schemes: skip stats update if the scheme directory is removed + - virt/sev-guest: Prevent IV reuse in the SNP guest driver + - zonefs: Fix active zone accounting + - spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock + - spi: spi-imx: spi_imx_transfer_one(): check for DMA transfer first + - mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1 + - KVM: x86/mmu: Fix race condition in direct_page_fault + - KVM: x86/xen: Only do in-kernel acceleration of hypercalls for guest CPL0 + - KVM: x86/xen: Validate port number in SCHEDOP_poll + - drm/i915/gvt: Get reference to KVM iff attachment to VM is successful + - KVM: Update gfn_to_pfn_cache khva when it moves within the same page + - mm: fix unexpected changes to {failslab|fail_page_alloc}.attr + - mm: correctly charge compressed memory to its memcg + - LoongArch: Clear FPU/SIMD thread info flags for kernel thread + - LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty() + - ASoC: amd: yc: Add Alienware m17 R5 AMD into DMI table + - ASoC: Intel: soc-acpi: add ES83x6 support to IceLake + - ASoC: hda: intel-dsp-config: add ES83x6 quirk for IceLake + - ASoC: SOF: ipc3-topology: use old pipeline teardown flow with SOF2.1 and + older + - Revert "tty: n_gsm: avoid call of sleeping functions from atomic context" + - Revert "tty: n_gsm: replace kicktimer with delayed_work" + - ASoC: sof_es8336: reduce pop noise on speaker + - pinctrl: qcom: sc8280xp: Rectify UFS reset pins + - platform/x86: thinkpad_acpi: Enable s2idle quirk for 21A1 machine type + - platform/x86: ideapad-laptop: Add module parameters to match DMI quirk + tables + - block: make blk_set_default_limits() private + - scsi: mpi3mr: Suppress command reply debug prints + - btrfs: free btrfs_path before copying inodes to userspace + - btrfs: do not modify log tree while holding a leaf from fs tree locked + - drm/i915/ttm: never purge busy objects + - drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code + - drm/amdgpu/psp: don't free PSP buffers on suspend + - drm/amd/amdgpu: reserve vm invalidation engine for firmware + - drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly + when the edid is read" + - btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino + - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() + - iio: health: afe4403: Fix oob read in afe4403_read_raw + - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw + - iio: light: rpr0521: add missing Kconfig dependencies + - bpf, perf: Use subprog name when reporting subprog ksymbol + - scripts/faddr2line: Fix regression in name resolution on ppc64le + - ARM: at91: rm9200: fix usb device clock id + - libbpf: Handle size overflow for ringbuf mmap + - hwmon: (ltc2947) fix temperature scaling + - hwmon: (ina3221) Fix shunt sum critical calculation + - hwmon: (i5500_temp) fix missing pci_disable_device() + - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails + - bpf: Do not copy spin lock field from user in bpf_selem_alloc + - nvmem: rmem: Fix return value check in rmem_read() + - of: property: decrement node refcount in of_fwnode_get_reference_args() + - ixgbevf: Fix resource leak in ixgbevf_init_module() + - i40e: Fix error handling in i40e_init_module() + - fm10k: Fix error handling in fm10k_init_module() + - iavf: Fix error handling in iavf_init_module() + - e100: Fix possible use after free in e100_xmit_prepare + - net/mlx5: DR, Fix uninitialized var warning + - net/mlx5: Fix uninitialized variable bug in outlen_write() + - net/mlx5e: Fix use-after-free when reverting termination table + - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() + - can: cc770: cc770_isa_probe(): add missing free_cc770dev() + - can: etas_es58x: es58x_init_netdev(): free netdev when register_candev() + - can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods + - can: m_can: Add check for devm_clk_get + - qlcnic: fix sleep-in-atomic-context bugs caused by msleep + - aquantia: Do not purge addresses when setting the number of rings + - wifi: cfg80211: fix buffer overflow in elem comparison + - wifi: cfg80211: don't allow multi-BSSID in S1G + - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration + - net: phy: fix null-ptr-deref while probe() failed + - net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() + - net: net_netdev: Fix error handling in ntb_netdev_init_module() + - net/9p: Fix a potential socket leak in p9_socket_open + - net: ethernet: nixge: fix NULL dereference + - net: wwan: iosm: fix kernel test robot reported error + - net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type + - dsa: lan9303: Correct stat name + - tipc: re-fetch skb cb after tipc_msg_validate + - net: hsr: Fix potential use-after-free + - net: mdiobus: fix unbalanced node reference count + - afs: Fix fileserver probe RTT handling + - net: tun: Fix use-after-free in tun_detach() + - packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE + - sctp: fix memory leak in sctp_stream_outq_migrate() + - net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed + - hwmon: (coretemp) Check for null before removing sysfs attrs + - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() + - riscv: vdso: fix section overlapping under some conditions + - riscv: mm: Proper page permissions after initmem free + - ALSA: dice: fix regression for Lexicon I-ONIX FW810S + - error-injection: Add prompt for function error injection + - tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" + - nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() + - x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 + - pinctrl: intel: Save and restore pins in "direct IRQ" mode + - v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails + - net: stmmac: Set MAC's flow control register to reflect current settings + - mmc: mmc_test: Fix removal of debugfs file + - mmc: core: Fix ambiguous TRIM and DISCARD arg + - mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check + - mmc: sdhci-sprd: Fix no reset data and command after voltage switch + - mmc: sdhci: Fix voltage switch delay + - drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame + - drm/amdgpu: enable Vangogh VCN indirect sram mode + - drm/i915: Fix negative value passed as remaining time + - drm/i915: Never return 0 if not all requests retired + - tracing/osnoise: Fix duration type + - tracing: Fix race where histograms can be called before the event + - tracing: Free buffers when a used dynamic event is removed + - io_uring: cmpxchg for poll arm refs release + - io_uring/poll: fix poll_refs race with cancelation + - ASoC: ops: Fix bounds check for _sx controls + - pinctrl: single: Fix potential division by zero + - riscv: Sync efi page table's kernel mappings before switching + - riscv: fix race when vmap stack overflow + - riscv: kexec: Fixup irq controller broken in kexec crash path + - nvme: fix SRCU protection of nvme_ns_head list + - iommu/vt-d: Fix PCI device refcount leak in has_external_pci() + - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() + - mm: migrate: fix THP's mapcount on isolation + - Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is + enabled + - ipv4: Handle attempt to delete multipath route when fib_info contains an nh + reference + - ipv4: Fix route deletion when nexthop info is not specified + - i2c: npcm7xx: Fix error handling in npcm_i2c_init() + - i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set + - ACPI: HMAT: remove unnecessary variable initialization + - ACPI: HMAT: Fix initiator registration for single-initiator systems + - Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" + - char: tpm: Protect tpm_pm_suspend with locks + - Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() + - ipc/sem: Fix dangling sem_array access in semtimedop race + - clk: samsung: exynos7885: Correct "div4" clock parents + - libbpf: Use correct return pointer in attach_raw_tp + - clocksource/drivers/arm_arch_timer: Fix XGene-1 TVAL register math error + - clk: qcom: gcc-sc8280xp: add cxo as parent for three ufs ref clks + - vfs: fix copy_file_range() averts filesystem freeze protection + - net: wwan: iosm: fix crash in peek throughput test + - net: wwan: iosm: fix incorrect skb length + - mptcp: don't orphan ssk in mptcp_close() + - mptcp: fix sleep in atomic at close time + - hwmon: (asus-ec-sensors) Add checks for devm_kcalloc + - ASoC: tlv320adc3xxx: Fix build error for implicit function declaration + - mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in + damon_sysfs_set_schemes() + - i2c: Restore initial power state if probe fails + - i2c: qcom-geni: fix error return code in geni_i2c_gpi_xfer + - powerpc/bpf/32: Fix Oops on tail call tests + * 5.15.0-58.64 breaks xen bridge networking (pvh domU) (LP: #2002889) + - xen/netback: fix build warning + * NFS: client permission error after adding user to permissible group + (LP: #2003053) + - NFS: Clear the file access cache upon login + - NFS: Judge the file access cache's timestamp in rcu path + - NFS: Fix up a sparse warning + * cmsg_so_mark.sh / cmsg_time.sh / cmsg_ipv6.sh in net from + ubuntu_kernel_selftests hang with non-amd64 (LP: #2000667) + - selftests: net: fix cmsg_so_mark.sh test hang + * Set explicit CC in the headers package (LP: #1999750) + - [Packaging] Set explicit CC in the headers package + * powerpc-build in ubuntu_kernel_selftests failed on P9 with K-5.19 + (LP: #2000772) + - selftests/powerpc: Avoid GCC 12 uninitialised variable warning + * [SRU] SoF for RPL platform support (LP: #1992714) + - ASoC: SOC: Intel: introduce cl_init callback + - ASoC: SOF: Intel: add MeteorLake machines + - ASoC: SOF: Intel: Add support for MeteorLake (MTL) + - ASoC: Intel: common: add ACPI matching tables for Raptor Lake + - ASoC: SOF: Intel: pci-tgl: use RPL specific firmware definitions + - [Config] Enable SND_SOC_SOF_METEORLAKE as module + * Rear Audio port sometimes has no audio output after reboot(Cirrus Logic) + (LP: #1998905) + - ALSA: hda/cirrus: Add extra 10 ms delay to allow PLL settle and lock. + * Fix SUT can't displayed after resume from WB/CB with dGFX + installed(FR:6/10)[RX6300][RX6500] (LP: #1999836) + - drm/amd/display: No display after resume from WB/CB + * commit cf58599cded35cf4affed1e659c0e2c742d3fda7 seems to be missing in + kinetic master to remove "hio" reference from Makefile (LP: #1999556) + - Ubuntu: remove leftover reference to ubuntu/hio driver + * Add additional Mediatek MT7922 BT device ID (LP: #1998885) + - Bluetooth: btusb: Add a new VID/PID 0489/e0f2 for MT7922 + * Mute/mic LEDs no function on a HP platfrom (LP: #1998882) + - ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook + * CVE-2023-0461 + - net/ulp: prevent ULP without clone op from entering the LISTEN status + - net/ulp: use consistent error code when blocking ULP + * CVE-2023-0179 + - netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits + * CVE-2022-20369 + - NFSD: fix use-after-free in __nfs42_ssc_open() + * Kinetic update: upstream stable patchset 2023-01-23 (LP: #2003753) + - ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in + wm5102_probe" + - ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in + wm5110_probe" + - ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in + wm8997_probe" + - ASoC: mt6660: Keep the pm_runtime enables before component stuff in + mt6660_i2c_probe + - ASoC: rt1019: Fix the TDM settings + - ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK + - spi: intel: Fix the offset to get the 64K erase opcode + - ASoC: codecs: jz4725b: add missed Line In power control bit + - ASoC: codecs: jz4725b: fix reported volume for Master ctl + - ASoC: codecs: jz4725b: use right control for Capture Volume + - ASoC: codecs: jz4725b: fix capture selector naming + - ASoC: Intel: sof_sdw: add quirk variant for LAPBC710 NUC15 + - selftests/futex: fix build for clang + - selftests/intel_pstate: fix build for ARCH=x86_64 + - ASoC: rt1308-sdw: add the default value of some registers + - drm/amd/display: Remove wrong pipe control lock + - ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[] + - RDMA/efa: Add EFA 0xefa2 PCI ID + - btrfs: raid56: properly handle the error when unable to find the missing + stripe + - NFSv4: Retry LOCK on OLD_STATEID during delegation return + - ACPI: x86: Add another system to quirk list for forcing StorageD3Enable + - firmware: arm_scmi: Cleanup the core driver removal callback + - i2c: tegra: Allocate DMA memory for DMA engine + - i2c: i801: add lis3lv02d's I2C address for Vostro 5568 + - drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid + - btrfs: remove pointless and double ulist frees in error paths of qgroup + tests + - x86/cpu: Add several Intel server CPU model numbers + - ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> + "Route" + - KVM: x86/pmu: Do not speculatively query Intel GP PMCs that don't exist yet + - hugetlbfs: don't delete error page from pagecache + - arm64: dts: qcom: sa8155p-adp: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8150-xperia-kumano: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8250-xperia-edo: Specify which LDO modes are allowed + - arm64: dts: qcom: sm8350-hdk: Specify which LDO modes are allowed + - spi: stm32: Print summary 'callbacks suppressed' message + - ARM: dts: at91: sama7g5: fix signal name of pin PB2 + - ASoC: core: Fix use-after-free in snd_soc_exit() + - ASoC: tas2770: Fix set_tdm_slot in case of single slot + - ASoC: tas2764: Fix set_tdm_slot in case of single slot + - ARM: at91: pm: avoid soft resetting AC DLL + - serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl() + - serial: 8250_omap: remove wait loop from Errata i202 workaround + - serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() + - serial: 8250: omap: Flush PM QOS work on remove + - serial: imx: Add missing .thaw_noirq hook + - tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send + - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() + - ASoC: soc-utils: Remove __exit for snd_soc_util_exit() + - pinctrl: rockchip: list all pins in a possible mux route for PX30 + - scsi: scsi_transport_sas: Fix error handling in sas_phy_add() + - block: sed-opal: kmalloc the cmd/resp buffers + - bpf: Fix memory leaks in __check_func_call + - arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro + - siox: fix possible memory leak in siox_device_add() + - parport_pc: Avoid FIFO port location truncation + - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map + - drm/vc4: kms: Fix IS_ERR() vs NULL check for vc4_kms + - drm/panel: simple: set bpc field for logic technologies displays + - drm/drv: Fix potential memory leak in drm_dev_init() + - drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() + - arm64: dts: imx8mm: Fix NAND controller size-cells + - arm64: dts: imx8mn: Fix NAND controller size-cells + - ata: libata-transport: fix double ata_host_put() in ata_tport_add() + - ata: libata-transport: fix error handling in ata_tport_add() + - ata: libata-transport: fix error handling in ata_tlink_add() + - ata: libata-transport: fix error handling in ata_tdev_add() + - nfp: change eeprom length to max length enumerators + - MIPS: fix duplicate definitions for exported symbols + - MIPS: Loongson64: Add WARN_ON on kexec related kmalloc failed + - bpf: Initialize same number of free nodes for each pcpu_freelist + - net: bgmac: Drop free_netdev() from bgmac_enet_remove() + - mISDN: fix possible memory leak in mISDN_dsp_element_register() + - net: hinic: Fix error handling in hinic_module_init() + - net: stmmac: ensure tx function is not running in stmmac_xdp_release() + - soc: imx8m: Enable OCOTP clock before reading the register + - net: liquidio: release resources when liquidio driver open failed + - mISDN: fix misuse of put_device() in mISDN_register_device() + - net: macvlan: Use built-in RCU list checking + - net: caif: fix double disconnect client in chnl_net_open() + - bnxt_en: Remove debugfs when pci_register_driver failed + - net: mhi: Fix memory leak in mhi_net_dellink() + - net: dsa: make dsa_master_ioctl() see through port_hwtstamp_get() shims + - xen/pcpu: fix possible memory leak in register_pcpu() + - net: ionic: Fix error handling in ionic_init_module() + - net: ena: Fix error handling in ena_init() + - net: hns3: fix setting incorrect phy link ksettings for firmware in + resetting process + - bridge: switchdev: Fix memory leaks when changing VLAN protocol + - drbd: use after free in drbd_create_device() + - platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when + virtualized + - platform/surface: aggregator: Do not check for repeated unsequenced packets + - cifs: add check for returning value of SMB2_close_init + - net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail in + ag71xx_open() + - net/x25: Fix skb leak in x25_lapb_receive_frame() + - cifs: Fix wrong return value checking when GETFLAGS + - net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() + and sparx5_start() + - net: thunderbolt: Fix error handling in tbnet_init() + - cifs: add check for returning value of SMB2_set_info_init + - ftrace: Fix the possible incorrect kernel message + - ftrace: Optimize the allocation for mcount entries + - ftrace: Fix null pointer dereference in ftrace_add_mod() + - ring_buffer: Do not deactivate non-existant pages + - tracing: Fix memory leak in tracing_read_pipe() + - tracing/ring-buffer: Have polling block on watermark + - tracing: Fix memory leak in test_gen_synth_cmd() and + test_empty_synth_event() + - tracing: Fix wild-memory-access in register_synth_event() + - tracing: Fix race where eprobes can be called before the event + - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in + kprobe_event_gen_test_exit() + - tracing: kprobe: Fix potential null-ptr-deref on trace_array in + kprobe_event_gen_test_exit() + - drm/amd/display: Add HUBP surface flip interrupt handler + - ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() + - ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro + - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 + - Revert "usb: dwc3: disable USB core PHY management" + - slimbus: qcom-ngd: Fix build error when CONFIG_SLIM_QCOM_NGD_CTRL=y && + CONFIG_QCOM_RPROC_COMMON=m + - slimbus: stream: correct presence rate frequencies + - speakup: fix a segfault caused by switching consoles + - USB: bcma: Make GPIO explicitly optional + - USB: serial: option: add Sierra Wireless EM9191 + - USB: serial: option: remove old LARA-R6 PID + - USB: serial: option: add u-blox LARA-R6 00B modem + - USB: serial: option: add u-blox LARA-L6 modem + - USB: serial: option: add Fibocom FM160 0x0111 composition + - usb: add NO_LPM quirk for Realforce 87U Keyboard + - usb: chipidea: fix deadlock in ci_otg_del_timer + - usb: cdns3: host: fix endless superspeed hub port reset + - usb: typec: mux: Enter safe mode only when pins need to be reconfigured + - iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() + - iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() + - iio: adc: mp2629: fix wrong comparison of channel + - iio: adc: mp2629: fix potential array out of bound access + - iio: pressure: ms5611: changed hardcoded SPI speed to value limited + - dm ioctl: fix misbehavior if list_versions races with module loading + - serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs + - serial: 8250: Flush DMA Rx on RLSI + - serial: 8250_lpss: Configure DMA also w/o DMA filter + - Input: iforce - invert valid length check when fetching device IDs + - maccess: Fix writing offset in case of fault in + strncpy_from_kernel_nofault() + - net: phy: marvell: add sleep time after enabling the loopback bit + - scsi: zfcp: Fix double free of FSF request when qdio send fails + - iommu/vt-d: Preset Access bit for IOVA in FL non-leaf paging entries + - iommu/vt-d: Set SRE bit only when hardware has SRS cap + - firmware: coreboot: Register bus in module init + - mmc: core: properly select voltage range without power cycle + - mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce + timeout + - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() + - docs: update mediator contact information in CoC doc + - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() + - perf/x86/intel/pt: Fix sampling using single range output + - nvme: restrict management ioctls to admin + - nvme: ensure subsystem reset is single threaded + - serial: 8250_lpss: Use 16B DMA burst with Elkhart Lake + - perf: Improve missing SIGTRAP checking + - ring-buffer: Include dropped pages in counting dirty patches + - tracing: Fix warning on variable 'struct trace_array' + - net: use struct_group to copy ip/ipv6 header addresses + - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() + - scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() + - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case + - Input: i8042 - fix leaking of platform device on module removal + - macvlan: enforce a consistent minimal mtu + - tcp: cdg: allow tcp_cdg_release() to be called multiple times + - kcm: avoid potential race in kcm_tx_work + - kcm: close race conditions on sk_receive_queue + - 9p: trans_fd/p9_conn_cancel: drop client lock earlier + - gfs2: Check sb_bsize_shift after reading superblock + - gfs2: Switch from strlcpy to strscpy + - 9p/trans_fd: always use O_NONBLOCK read/write + - wifi: wext: use flex array destination for memcpy() + - mm: fs: initialize fsdata passed to write_begin/write_end interface + - net/9p: use a dedicated spinlock for trans_fd + - ntfs: fix use-after-free in ntfs_attr_find() + - ntfs: fix out-of-bounds read in ntfs_attr_find() + - ntfs: check overflow when iterating ATTR_RECORDs + - drm/msm/gpu: Fix crash during system suspend after unbind + - spi: tegra210-quad: Fix combined sequence + - ASoC: rt5682s: Fix the TDM Tx settings + - selftests/kexec: fix build for ARCH=x86_64 + - ASoC: Intel: sof_rt5682: Add quirk for Rex board + - ASoC: amd: yc: Adding Lenovo ThinkBook 14 Gen 4+ ARA and Lenovo ThinkBook 16 + Gen 4+ ARA to the Quirks List + - ASoC: amd: yc: Add Lenovo Thinkbook 14+ 2022 21D0 to quirks table + - drm/amdgpu: Adjust MES polling timeout for sriov + - platform/x86: thinkpad_acpi: Fix reporting a non present second fan on some + models + - drm/scheduler: fix fence ref counting + - cxl/mbox: Add a check on input payload size + - SUNRPC: Fix crasher in gss_unwrap_resp_integ() + - drm/rockchip: vop2: fix null pointer in plane_atomic_disable + - drm/rockchip: vop2: disable planes when disabling the crtc + - ksefltests: pidfd: Fix wait_states: Test terminated by timeout + - powerpc/64e: Fix amdgpu build on Book3E w/o AltiVec + - block: blk_add_rq_to_plug(): clear stale 'last' after flush + - firmware: arm_scmi: Make tx_prepare time out eventually + - drm/amd/display: Ignore Cable ID Feature + - drm/amdgpu: set fb_modifiers_not_supported in vkms + - drm/amd: Fail the suspend if resources can't be evicted + - cxl/pmem: Use size_add() against integer overflow + - tools/testing/cxl: Fix some error exits + - arm64/mm: fold check for KFENCE into can_set_direct_map() + - arm64: fix rodata=full again + - KVM: SVM: remove dead field from struct svm_cpu_data + - KVM: SVM: do not allocate struct svm_cpu_data dynamically + - KVM: SVM: restore host save area from assembly + - KVM: SVM: move MSR_IA32_SPEC_CTRL save/restore to assembly + - arm64: dts: qcom: sc7280: Add the reset reg for lpass audiocc on SC7280 + - ASoC: fsl_asrc fsl_esai fsl_sai: allow CONFIG_PM=N + - arm64: dts: qcom: sm8250: Disable the not yet supported cluster idle state + - tty: serial: fsl_lpuart: don't break the on-going transfer when global reset + - bnxt_en: refactor bnxt_cancel_reservations() + - bnxt_en: fix the handling of PCIE-AER + - mtd: onenand: omap2: add dependency on GPMC + - sctp: remove the unnecessary sinfo_stream check in sctp_prsctp_prune_unsent + - sctp: clear out_curr if all frag chunks of current msg are pruned + - erofs: clean up .read_folio() and .readahead() in fscache mode + - io_uring: calculate CQEs from the user visible value + - pinctrl: mediatek: common-v2: Fix bias-disable for PULL_PU_PD_RSEL_TYPE + - selftests/bpf: Fix test_progs compilation failure in 32-bit arch + - arm64: dts: imx8mm-tqma8mqml-mba8mx: Fix USB DR + - cifs: Fix connections leak when tlink setup failed + - ata: libata-core: do not issue non-internal commands once EH is pending + - net: phy: dp83867: Fix SGMII FIFO depth for non OF devices + - mctp i2c: don't count unused / invalid keys for flow release + - octeon_ep: delete unnecessary napi rollback under set_queues_err in + octep_open() + - octeon_ep: ensure octep_get_link_status() successfully before + octep_link_up() + - octeon_ep: fix potential memory leak in octep_device_setup() + - octeon_ep: ensure get mac address successfully before eth_hw_addr_set() + - erofs: fix missing xas_retry() in fscache mode + - mlxsw: Avoid warnings when not offloaded FDB entry with IPv6 is removed + - net: hns3: fix incorrect hw rss hash type of rx packet + - net: hns3: fix return value check bug of rx copybreak + - netfs: Fix missing xas_retry() calls in xarray iteration + - netfs: Fix dodgy maths + - net: dsa: don't leak tagger-owned storage on switch driver unbind + - net: lan966x: Fix potential null-ptr-deref in lan966x_stats_init() + - s390: avoid using global register for current_stack_pointer + - netdevsim: Fix memory leak of nsim_dev->fa_cookie + - rethook: fix a potential memleak in rethook_alloc() + - drm/amd/pm: fix SMU13 runpm hang due to unintentional workaround + - drm/display: Don't assume dual mode adaptors support i2c sub-addressing + - drm/amd/display: Fix invalid DPIA AUX reply causing system hang + - drm/amd/display: Fix access timeout to DPIA AUX at boot time + - drm/amd/display: Support parsing VRAM info v3.0 from VBIOS + - usb: dwc3: Do not get extcon device when usb-role-switch is used + - nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro + - nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV7000 + - usb: typec: tipd: Prevent uninitialized event{1,2} in IRQ handler + - iio: accel: bma400: Ensure VDDIO is enable defore reading the chip ID. + - iio: pressure: ms5611: fixed value compensation bug + - ceph: avoid putting the realm twice when decoding snaps fails + - s390/dcssblk: fix deadlock when adding a DCSS + - blk-cgroup: properly pin the parent in blkcg_css_online + - x86/fpu: Drop fpregs lock before inheriting FPU permissions + - ASoC: SOF: topology: No need to assign core ID if token parsing failed + - perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and + throttling + - net: usb: smsc95xx: fix external PHY reset + - tracing: Fix potential null-pointer-access of entry in list 'tr->err_log' + - arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud + - KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign() + - netlink: Bounds-check struct nlmsgerr creation + - bpf: Prevent bpf program recursion for raw tracepoint probes + * Fix RPL-S support on powercap/intel_rapl (LP: #1990161) + - powercap: intel_rapl: Add support for RAPTORLAKE_P + - powercap: intel_rapl: Add support for RAPTORLAKE_S + * Kinetic update: upstream stable patchset 2023-01-04 (LP: #2001726) + - drm/amdkfd: handle CPU fault on COW mapping + - drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram() + - hwspinlock: qcom: correct MMIO max register for newer SoCs + - phy: stm32: fix an error code in probe + - wifi: cfg80211: silence a sparse RCU warning + - wifi: cfg80211: fix memory leak in query_regdb_file() + - soundwire: qcom: reinit broadcast completion + - soundwire: qcom: check for outanding writes before doing a read + - bpf, verifier: Fix memory leak in array reallocation for stack state + - bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues + - wifi: mac80211: Set TWT Information Frame Disabled bit as 1 + - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without + FILE + - HID: hyperv: fix possible memory leak in mousevsc_probe() + - bpf, sockmap: Fix sk->sk_forward_alloc warn_on in sk_stream_kill_queues + - bpf: Fix sockmap calling sleepable function in teardown path + - bpf, sock_map: Move cancel_work_sync() out of sock lock + - bpf: Add helper macro bpf_for_each_reg_in_vstate + - bpf: Fix wrong reg type conversion in release_reference() + - net: gso: fix panic on frag_list with mixed head alloc types + - macsec: delete new rxsc when offload fails + - macsec: fix secy->n_rx_sc accounting + - macsec: fix detection of RXSCs when toggling offloading + - macsec: clear encryption keys from the stack after setting up offload + - octeontx2-pf: NIX TX overwrites SQ_CTX_HW_S[SQ_INT] + - net: tun: Fix memory leaks of napi_get_frags + - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() + - bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer + - net: fman: Unregister ethernet device on removal + - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK + - phy: ralink: mt7621-pci: add sentinel to quirks table + - KVM: s390: pv: don't allow userspace to set the clock under PV + - net: lapbether: fix issue of dev reference count leakage in + lapbeth_device_event() + - hamradio: fix issue of dev reference count leakage in bpq_device_event() + - net: wwan: iosm: fix memory leak in ipc_wwan_dellink + - net: wwan: mhi: fix memory leak in mhi_mbim_dellink + - drm/vc4: Fix missing platform_unregister_drivers() call in + vc4_drm_register() + - tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent + - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network + - can: af_can: fix NULL pointer dereference in can_rx_register() + - net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable() + - net: broadcom: Fix BCMGENET Kconfig + - tipc: fix the msg->req tlv len check in + tipc_nl_compat_name_table_dump_header + - dmaengine: pxa_dma: use platform_get_irq_optional + - dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() + - dmaengine: ti: k3-udma-glue: fix memory leak when register device fail + - net: lapbether: fix issue of invalid opcode in lapbeth_open() + - drivers: net: xgene: disable napi when register irq failed in + xgene_enet_open() + - perf stat: Fix printing os->prefix in CSV metrics output + - perf tools: Add the include/perf/ directory to .gitignore + - netfilter: nfnetlink: fix potential dead lock in nfnetlink_rcv_msg() + - netfilter: Cleanup nft_net->module_list from nf_tables_exit_net() + - net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init() + - net: nixge: disable napi when enable interrupts failed in nixge_open() + - net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfg + - net/mlx5: Bridge, verify LAG state when adding bond to bridge + - net/mlx5: Allow async trigger completion execution on single CPU systems + - net/mlx5e: E-Switch, Fix comparing termination table instance + - net: cpsw: disable napi in cpsw_ndo_open() + - net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() + - stmmac: intel: Update PCH PTP clock rate from 200MHz to 204.8MHz + - mctp: Fix an error handling path in mctp_init() + - cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in + cxgb4vf_open() + - stmmac: dwmac-loongson: fix missing pci_disable_msi() while module exiting + - stmmac: dwmac-loongson: fix missing pci_disable_device() in + loongson_dwmac_probe() + - stmmac: dwmac-loongson: fix missing of_node_put() while module exiting + - net: phy: mscc: macsec: clear encryption keys when freeing a flow + - net: atlantic: macsec: clear encryption keys from the stack + - ethernet: s2io: disable napi when start nic failed in s2io_card_up() + - net: mv643xx_eth: disable napi when init rxq or txq failed in + mv643xx_eth_open() + - ethernet: tundra: free irq when alloc ring failed in tsi108_open() + - net: macvlan: fix memory leaks of macvlan_common_newlink + - riscv: process: fix kernel info leakage + - riscv: vdso: fix build with llvm + - riscv: fix reserved memory setup + - arm64: efi: Fix handling of misaligned runtime regions and drop warning + - MIPS: jump_label: Fix compat branch range check + - mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI + - mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci_am654: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI + - mmc: sdhci-esdhc-imx: use the correct host caps for MMC_CAP_8_BIT_DATA + - ALSA: hda/hdmi - enable runtime pm for more AMD display audio + - ALSA: hda/ca0132: add quirk for EVGA Z390 DARK + - ALSA: hda: fix potential memleak in 'add_widget_node' + - ALSA: hda/realtek: Add Positivo C6300 model quirk + - ALSA: usb-audio: Yet more regression for for the delayed card registration + - ALSA: usb-audio: Add quirk entry for M-Audio Micro + - ALSA: usb-audio: Add DSD support for Accuphase DAC-60 + - vmlinux.lds.h: Fix placement of '.data..decrypted' section + - ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure + - nilfs2: fix deadlock in nilfs_count_free_blocks() + - nilfs2: fix use-after-free bug of ns_writer on remount + - drm/i915/dmabuf: fix sg_table handling in map_dma_buf + - drm/amdgpu: disable BACO on special BEIGE_GOBY card + - btrfs: fix match incorrectly in dev_args_match_device + - btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() + - btrfs: zoned: initialize device's zone info for seeding + - mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI + - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() + - mm/damon/dbgfs: check if rm_contexts input is for a real context + - mm/memremap.c: map FS_DAX device memory as decrypted + - mm/shmem: use page_mapping() to detect page cache for uffd continue + - can: j1939: j1939_send_one(): fix missing CAN header initialization + - dmaengine: at_hdmac: Fix at_lli struct definition + - dmaengine: at_hdmac: Don't start transactions at tx_submit level + - dmaengine: at_hdmac: Start transfer for cyclic channels in issue_pending + - dmaengine: at_hdmac: Fix premature completion of desc in issue_pending + - dmaengine: at_hdmac: Do not call the complete callback on + device_terminate_all + - dmaengine: at_hdmac: Protect atchan->status with the channel lock + - dmaengine: at_hdmac: Fix concurrency problems by removing atc_complete_all() + - dmaengine: at_hdmac: Fix concurrency over descriptor + - dmaengine: at_hdmac: Free the memset buf without holding the chan lock + - dmaengine: at_hdmac: Fix concurrency over the active list + - dmaengine: at_hdmac: Fix descriptor handling when issuing it to hardware + - dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors + - dmaengine: at_hdmac: Don't allow CPU to reorder channel enable + - dmaengine: at_hdmac: Fix impossible condition + - dmaengine: at_hdmac: Check return code of dma_async_device_register + - drm/amdkfd: Migrate in CPU page fault use current mm + - net: tun: call napi_schedule_prep() to ensure we own a napi + - x86/cpu: Restore AMD's DE_CFG MSR after resume + - drm/i915/gvt: Add missing vfio_unregister_group_dev() call + - KVM: debugfs: Return retval of simple_attr_open() if it fails + - HID: wacom: Fix logic used for 3rd barrel switch emulation + - ALSA: arm: pxa: pxa2xx-ac97-lib: fix return value check of + platform_get_irq() + - spi: mediatek: Fix package division error + - drm/vc4: hdmi: Fix HSM clock too low on Pi4 + - PCI: hv: Fix the definition of vector in hv_compose_msi_msg() + - KVM: s390: pci: Fix allocation size of aift kzdev elements + - drm/i915/psr: Send update also on invalidate + - drm/i915: Do not set cache_dirty for DGFX + - dt-bindings: net: tsnep: Fix typo on generic nvmem property + - dmanegine: idxd: reformat opcap output to match bitmap_parse() input + - dmaengine: idxd: Fix max batch size for Intel IAA + - dmaengine: idxd: fix RO device state error after been disabled/reset + - dmaengine: stm32-dma: fix potential race between pause and resume + - net: ethernet: mtk-star-emac: disable napi when connect and start PHY failed + in mtk_star_enable() + - octeontx2-pf: Fix SQE threshold checking + - perf stat: Fix crash with --per-node --metric-only in CSV mode + - net: wwan: iosm: fix invalid mux header type + - net/mlx5e: Add missing sanity checks for max TX WQE size + - ice: Fix spurious interrupt during removal of trusted VF + - iavf: Fix VF driver counting VLAN 0 filters + - ALSA: memalloc: Don't fall back for SG-buffer with IOMMU + - eth: sp7021: drop free_netdev() from spl2sw_init_netdev() + - mmc: sdhci-brcmstb: Fix SDHCI_RESET_ALL for CQHCI + - ALSA: hda/realtek: Add quirk for ASUS Zenbook using CS35L41 + - drm/amdgpu: workaround for TLB seq race + - drm/amdkfd: Fix error handling in criu_checkpoint + - drm/amdkfd: Fix error handling in kfd_criu_restore_events + - btrfs: zoned: clone zoned device info when cloning a device + - net: ethernet: ti: am65-cpsw: Fix segmentation fault at module unload + - spi: intel: Use correct mask for flash and protected regions + - dmaengine: idxd: Do not enable user type Work Queue without Shared Virtual + Addressing + - can: isotp: fix tx state handling for echo tx processing + - can: rcar_canfd: Add missing ECC error checks for channels 2-7 + - KVM: x86: use a separate asm-offsets.c file + - KVM: SVM: replace regs argument of __svm_vcpu_run() with vcpu_svm + - KVM: SVM: adjust register allocation for __svm_vcpu_run() + - KVM: SVM: retrieve VMCB from assembly + - KVM: SVM: move guest vmsave/vmload back to assembly + * AMD Rembrandt: DP tunneling fails with Thunderbolt monitors + (LP: #1983143) // Kinetic update: upstream stable patchset 2023-01-04 + (LP: #2001726) + - thunderbolt: Add DP OUT resource when DP tunnel is discovered + * CVE-2022-47520 + - wifi: wilc1000: validate pairwise and authentication suite offsets + * CVE-2022-3545 + - nfp: fix use-after-free in area_cache_get() + + -- Andrei Gherzan Thu, 09 Feb 2023 13:22:22 +0000 + linux-kvm (5.19.0-1018.19) kinetic; urgency=medium * kinetic/linux-kvm: 5.19.0-1018.19 -proposed tracker (LP: #2003418) diff -u linux-kvm-5.19.0/debian/control linux-kvm-5.19.0/debian/control --- linux-kvm-5.19.0/debian/control +++ linux-kvm-5.19.0/debian/control @@ -52,7 +52,7 @@ XS-Testsuite: autopkgtest #XS-Testsuite-Depends: gcc-4.7 binutils -Package: linux-kvm-headers-5.19.0-1018 +Package: linux-kvm-headers-5.19.0-1019 Build-Profiles: Architecture: all Multi-Arch: foreign @@ -62,46 +62,46 @@ Description: Header files related to Linux kernel version 5.19.0 This package provides kernel header files for version 5.19.0, for sites that want the latest kernel headers. Please read - /usr/share/doc/linux-kvm-headers-5.19.0-1018/debian.README.gz for details + /usr/share/doc/linux-kvm-headers-5.19.0-1019/debian.README.gz for details -Package: linux-kvm-tools-5.19.0-1018 +Package: linux-kvm-tools-5.19.0-1019 Build-Profiles: Architecture: amd64 Section: devel Priority: optional Depends: ${misc:Depends}, ${shlibs:Depends}, linux-tools-common -Description: Linux kernel version specific tools for version 5.19.0-1018 +Description: Linux kernel version specific tools for version 5.19.0-1019 This package provides the architecture dependant parts for kernel version locked tools (such as perf and x86_energy_perf_policy) for - version 5.19.0-1018 on + version 5.19.0-1019 on 64 bit x86. - You probably want to install linux-tools-5.19.0-1018-. + You probably want to install linux-tools-5.19.0-1019-. -Package: linux-kvm-cloud-tools-5.19.0-1018 +Package: linux-kvm-cloud-tools-5.19.0-1019 Build-Profiles: Architecture: amd64 Section: devel Priority: optional Depends: ${misc:Depends}, ${shlibs:Depends}, linux-cloud-tools-common -Description: Linux kernel version specific cloud tools for version 5.19.0-1018 +Description: Linux kernel version specific cloud tools for version 5.19.0-1019 This package provides the architecture dependant parts for kernel - version locked tools for cloud tools for version 5.19.0-1018 on + version locked tools for cloud tools for version 5.19.0-1019 on 64 bit x86. - You probably want to install linux-cloud-tools-5.19.0-1018-. + You probably want to install linux-cloud-tools-5.19.0-1019-. -Package: linux-image-unsigned-5.19.0-1018-kvm +Package: linux-image-unsigned-5.19.0-1019-kvm Build-Profiles: Architecture: amd64 Section: kernel Priority: optional Provides: linux-image, fuse-module, ${linux:rprovides} -Depends: ${misc:Depends}, ${shlibs:Depends}, kmod, linux-base (>= 4.5ubuntu1~16.04.1), linux-modules-5.19.0-1018-kvm +Depends: ${misc:Depends}, ${shlibs:Depends}, kmod, linux-base (>= 4.5ubuntu1~16.04.1), linux-modules-5.19.0-1019-kvm Recommends: grub-pc | grub-efi-amd64 | grub-efi-ia32 | grub | lilo, initramfs-tools | linux-initramfs-tool Breaks: flash-kernel (<< 3.90ubuntu2) [arm64 armhf], s390-tools (<< 2.3.0-0ubuntu3) [s390x] -Conflicts: linux-image-5.19.0-1018-kvm -Suggests: fdutils, linux-kvm-doc-5.19.0 | linux-kvm-source-5.19.0, linux-kvm-tools, linux-headers-5.19.0-1018-kvm +Conflicts: linux-image-5.19.0-1019-kvm +Suggests: fdutils, linux-kvm-doc-5.19.0 | linux-kvm-source-5.19.0, linux-kvm-tools, linux-headers-5.19.0-1019-kvm Description: Linux kernel image for version 5.19.0 on 64 bit x86 SMP This package contains the unsigned Linux kernel image for version 5.19.0 on 64 bit x86 SMP. @@ -114,12 +114,12 @@ the linux-kvm meta-package, which will ensure that upgrades work correctly, and that supporting packages are also installed. -Package: linux-modules-5.19.0-1018-kvm +Package: linux-modules-5.19.0-1019-kvm Build-Profiles: Architecture: amd64 Section: kernel Priority: optional -Depends: ${misc:Depends}, ${shlibs:Depends}, linux-image-5.19.0-1018-kvm | linux-image-unsigned-5.19.0-1018-kvm +Depends: ${misc:Depends}, ${shlibs:Depends}, linux-image-5.19.0-1019-kvm | linux-image-unsigned-5.19.0-1019-kvm Built-Using: ${linux:BuiltUsing} Description: Linux kernel extra modules for version 5.19.0 on 64 bit x86 SMP Contains the corresponding System.map file, the modules built by the @@ -134,12 +134,12 @@ the linux-kvm meta-package, which will ensure that upgrades work correctly, and that supporting packages are also installed. -Package: linux-modules-extra-5.19.0-1018-kvm +Package: linux-modules-extra-5.19.0-1019-kvm Build-Profiles: Architecture: amd64 Section: kernel Priority: optional -Depends: ${misc:Depends}, ${shlibs:Depends}, linux-image-5.19.0-1018-kvm | linux-image-unsigned-5.19.0-1018-kvm, wireless-regdb +Depends: ${misc:Depends}, ${shlibs:Depends}, linux-image-5.19.0-1019-kvm | linux-image-unsigned-5.19.0-1019-kvm, wireless-regdb Description: Linux kernel extra modules for version 5.19.0 on 64 bit x86 SMP This package contains the Linux kernel extra modules for version 5.19.0 on 64 bit x86 SMP. @@ -156,21 +156,21 @@ the linux-kvm meta-package, which will ensure that upgrades work correctly, and that supporting packages are also installed. -Package: linux-headers-5.19.0-1018-kvm +Package: linux-headers-5.19.0-1019-kvm Build-Profiles: Architecture: amd64 Section: devel Priority: optional -Depends: ${misc:Depends}, linux-kvm-headers-5.19.0-1018, ${shlibs:Depends} +Depends: ${misc:Depends}, linux-kvm-headers-5.19.0-1019, ${shlibs:Depends} Provides: linux-headers, linux-headers-3.0 Description: Linux kernel headers for version 5.19.0 on 64 bit x86 SMP This package provides kernel header files for version 5.19.0 on 64 bit x86 SMP. . This is for sites that want the latest kernel headers. Please read - /usr/share/doc/linux-headers-5.19.0-1018/debian.README.gz for details. + /usr/share/doc/linux-headers-5.19.0-1019/debian.README.gz for details. -Package: linux-image-unsigned-5.19.0-1018-kvm-dbgsym +Package: linux-image-unsigned-5.19.0-1019-kvm-dbgsym Build-Profiles: Architecture: amd64 Section: devel @@ -187,31 +187,31 @@ is uncompressed, and unstripped. This package also includes the unstripped modules. -Package: linux-tools-5.19.0-1018-kvm +Package: linux-tools-5.19.0-1019-kvm Build-Profiles: Architecture: amd64 Section: devel Priority: optional -Depends: ${misc:Depends}, linux-kvm-tools-5.19.0-1018 -Description: Linux kernel version specific tools for version 5.19.0-1018 +Depends: ${misc:Depends}, linux-kvm-tools-5.19.0-1019 +Description: Linux kernel version specific tools for version 5.19.0-1019 This package provides the architecture dependant parts for kernel version locked tools (such as perf and x86_energy_perf_policy) for - version 5.19.0-1018 on + version 5.19.0-1019 on 64 bit x86. -Package: linux-cloud-tools-5.19.0-1018-kvm +Package: linux-cloud-tools-5.19.0-1019-kvm Build-Profiles: Architecture: amd64 Section: devel Priority: optional -Depends: ${misc:Depends}, linux-kvm-cloud-tools-5.19.0-1018 -Description: Linux kernel version specific cloud tools for version 5.19.0-1018 +Depends: ${misc:Depends}, linux-kvm-cloud-tools-5.19.0-1019 +Description: Linux kernel version specific cloud tools for version 5.19.0-1019 This package provides the architecture dependant parts for kernel - version locked tools for cloud for version 5.19.0-1018 on + version locked tools for cloud for version 5.19.0-1019 on 64 bit x86. -Package: linux-buildinfo-5.19.0-1018-kvm +Package: linux-buildinfo-5.19.0-1019-kvm Build-Profiles: Architecture: amd64 Section: kernel diff -u linux-kvm-5.19.0/debian/rules.d/2-binary-arch.mk linux-kvm-5.19.0/debian/rules.d/2-binary-arch.mk --- linux-kvm-5.19.0/debian/rules.d/2-binary-arch.mk +++ linux-kvm-5.19.0/debian/rules.d/2-binary-arch.mk @@ -318,8 +318,15 @@ cp $(builddir)/build-$*/.config $(hdrdir) chmod 644 $(hdrdir)/.config $(kmake) O=$(hdrdir) -j1 syncconfig prepare scripts - # We'll symlink this stuff + # Makefile may need per-arch-flavour CC settings, which are + # normally set via $(kmake) during build rm -f $(hdrdir)/Makefile + cp -a $(indep_hdrdir)/Makefile $(hdrdir)/Makefile + sed -i 's|\(^HOSTCC = \)gcc$$|\1$(gcc)|' $(hdrdir)/Makefile + sed -i 's|\(^CC = $$(CROSS_COMPILE)\)gcc$$|\1$(gcc)|' $(hdrdir)/Makefile + # Quick check for successful substitutions + grep '^HOSTCC .*$(gcc)$$' $(hdrdir)/Makefile + grep '^CC .*$(gcc)$$' $(hdrdir)/Makefile rm -rf $(hdrdir)/include2 $(hdrdir)/source # We do not need the retpoline information. find $(hdrdir) -name \*.o.ur-\* | xargs rm -f diff -u linux-kvm-5.19.0/drivers/acpi/video_detect.c linux-kvm-5.19.0/drivers/acpi/video_detect.c --- linux-kvm-5.19.0/drivers/acpi/video_detect.c +++ linux-kvm-5.19.0/drivers/acpi/video_detect.c @@ -580,4 +580,18 @@ }, /* + * Models which have nvidia-ec-wmi support, but should not use it. + * Note this indicates a likely firmware bug on these models and should + * be revisited if/when Linux gets support for dynamic mux mode. + */ + { + .callback = video_detect_force_native, + /* Dell G15 5515 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5515"), + }, + }, + + /* * Desktops which falsely report a backlight and which our heuristics * for this do not catch. diff -u linux-kvm-5.19.0/drivers/acpi/x86/utils.c linux-kvm-5.19.0/drivers/acpi/x86/utils.c --- linux-kvm-5.19.0/drivers/acpi/x86/utils.c +++ linux-kvm-5.19.0/drivers/acpi/x86/utils.c @@ -219,6 +219,12 @@ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 14 7425 2-in-1"), } }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 16 5625"), + } + }, {} }; diff -u linux-kvm-5.19.0/drivers/android/binder_alloc.c linux-kvm-5.19.0/drivers/android/binder_alloc.c --- linux-kvm-5.19.0/drivers/android/binder_alloc.c +++ linux-kvm-5.19.0/drivers/android/binder_alloc.c @@ -759,6 +759,12 @@ const char *failure_string; struct binder_buffer *buffer; + if (unlikely(vma->vm_mm != alloc->vma_vm_mm)) { + ret = -EINVAL; + failure_string = "invalid vma->vm_mm"; + goto err_invalid_mm; + } + mutex_lock(&binder_alloc_mmap_lock); if (alloc->buffer_size) { ret = -EBUSY; @@ -805,6 +811,7 @@ alloc->buffer_size = 0; err_already_mapped: mutex_unlock(&binder_alloc_mmap_lock); +err_invalid_mm: binder_alloc_debug(BINDER_DEBUG_USER_ERROR, "%s: %d %lx-%lx %s failed %d\n", __func__, alloc->pid, vma->vm_start, vma->vm_end, diff -u linux-kvm-5.19.0/drivers/bluetooth/btusb.c linux-kvm-5.19.0/drivers/bluetooth/btusb.c --- linux-kvm-5.19.0/drivers/bluetooth/btusb.c +++ linux-kvm-5.19.0/drivers/bluetooth/btusb.c @@ -504,6 +504,9 @@ { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, /* Additional Realtek 8723AE Bluetooth devices */ { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, diff -u linux-kvm-5.19.0/drivers/clocksource/arm_arch_timer.c linux-kvm-5.19.0/drivers/clocksource/arm_arch_timer.c --- linux-kvm-5.19.0/drivers/clocksource/arm_arch_timer.c +++ linux-kvm-5.19.0/drivers/clocksource/arm_arch_timer.c @@ -806,6 +806,9 @@ /* * XGene-1 implements CVAL in terms of TVAL, meaning * that the maximum timer range is 32bit. Shame on them. + * + * Note that TVAL is signed, thus has only 31 of its + * 32 bits to express magnitude. */ MIDR_ALL_VERSIONS(MIDR_CPU_MODEL(ARM_CPU_IMP_APM, APM_CPU_PART_POTENZA)), @@ -813,8 +816,8 @@ }; if (is_midr_in_range_list(read_cpuid_id(), broken_cval_midrs)) { - pr_warn_once("Broken CNTx_CVAL_EL1, limiting width to 32bits"); - return CLOCKSOURCE_MASK(32); + pr_warn_once("Broken CNTx_CVAL_EL1, using 31 bit TVAL instead.\n"); + return CLOCKSOURCE_MASK(31); } #endif return CLOCKSOURCE_MASK(arch_counter_get_width()); diff -u linux-kvm-5.19.0/drivers/firmware/arm_scmi/driver.c linux-kvm-5.19.0/drivers/firmware/arm_scmi/driver.c --- linux-kvm-5.19.0/drivers/firmware/arm_scmi/driver.c +++ linux-kvm-5.19.0/drivers/firmware/arm_scmi/driver.c @@ -1783,6 +1783,7 @@ return -ENOMEM; cinfo->dev = dev; + cinfo->rx_timeout_ms = info->desc->max_rx_timeout_ms; ret = info->desc->ops->chan_setup(cinfo, info->dev, tx); if (ret) @@ -2029,10 +2030,16 @@ sdev = scmi_get_protocol_device(child, info, id_table->protocol_id, id_table->name); - /* Set handle if not already set: device existed */ - if (sdev && !sdev->handle) - sdev->handle = - scmi_handle_get_from_info_unlocked(info); + if (sdev) { + /* Set handle if not already set: device existed */ + if (!sdev->handle) + sdev->handle = + scmi_handle_get_from_info_unlocked(info); + /* Relink consumer and suppliers */ + if (sdev->handle) + scmi_device_link_add(&sdev->dev, + sdev->handle->dev); + } } else { dev_err(info->dev, "Failed. SCMI protocol %d not active.\n", @@ -2230,20 +2237,17 @@ static int scmi_remove(struct platform_device *pdev) { - int ret = 0, id; + int ret, id; struct scmi_info *info = platform_get_drvdata(pdev); struct device_node *child; mutex_lock(&scmi_list_mutex); if (info->users) - ret = -EBUSY; - else - list_del(&info->node); + dev_warn(&pdev->dev, + "Still active SCMI users will be forcibly unbound.\n"); + list_del(&info->node); mutex_unlock(&scmi_list_mutex); - if (ret) - return ret; - scmi_notification_exit(&info->handle); mutex_lock(&info->protocols_mtx); @@ -2255,7 +2259,11 @@ idr_destroy(&info->active_protocols); /* Safe to free channels since no more users */ - return scmi_cleanup_txrx_channels(info); + ret = scmi_cleanup_txrx_channels(info); + if (ret) + dev_warn(&pdev->dev, "Failed to cleanup SCMI channels.\n"); + + return 0; } static ssize_t protocol_version_show(struct device *dev, diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c @@ -328,7 +328,6 @@ kfree(amdgpu_connector->edid); amdgpu_connector->edid = NULL; - drm_connector_update_edid_property(connector, NULL); } static int amdgpu_connector_ddc_get_modes(struct drm_connector *connector) diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -4123,15 +4123,18 @@ * at suspend time. * */ -static void amdgpu_device_evict_resources(struct amdgpu_device *adev) +static int amdgpu_device_evict_resources(struct amdgpu_device *adev) { + int ret; + /* No need to evict vram on APUs for suspend to ram or s2idle */ if ((adev->in_s3 || adev->in_s0ix) && (adev->flags & AMD_IS_APU)) - return; + return 0; - if (amdgpu_ttm_evict_resources(adev, TTM_PL_VRAM)) + ret = amdgpu_ttm_evict_resources(adev, TTM_PL_VRAM); + if (ret) DRM_WARN("evicting device resources failed\n"); - + return ret; } /* @@ -4188,7 +4191,9 @@ if (!adev->in_s0ix) amdgpu_amdkfd_suspend(adev, adev->in_runpm); - amdgpu_device_evict_resources(adev); + r = amdgpu_device_evict_resources(adev); + if (r) + return r; amdgpu_fence_driver_hw_fini(adev); diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c @@ -166,6 +166,7 @@ { amdgpu_bo_free_kernel(&mem_ctx->shared_bo, &mem_ctx->shared_mc_addr, &mem_ctx->shared_buf); + mem_ctx->shared_bo = NULL; } static void psp_free_shared_bufs(struct psp_context *psp) @@ -176,6 +177,7 @@ /* free TMR memory buffer */ pptr = amdgpu_sriov_vf(psp->adev) ? &tmr_buf : NULL; amdgpu_bo_free_kernel(&psp->tmr_bo, &psp->tmr_mc_addr, pptr); + psp->tmr_bo = NULL; /* free xgmi shared memory */ psp_ta_free_shared_buf(&psp->xgmi_context.context.mem_context); @@ -720,7 +722,7 @@ /* Set up Trusted Memory Region */ static int psp_tmr_init(struct psp_context *psp) { - int ret; + int ret = 0; int tmr_size; void *tmr_buf; void **pptr; @@ -747,10 +749,12 @@ } } - pptr = amdgpu_sriov_vf(psp->adev) ? &tmr_buf : NULL; - ret = amdgpu_bo_create_kernel(psp->adev, tmr_size, PSP_TMR_ALIGNMENT, - AMDGPU_GEM_DOMAIN_VRAM, - &psp->tmr_bo, &psp->tmr_mc_addr, pptr); + if (!psp->tmr_bo) { + pptr = amdgpu_sriov_vf(psp->adev) ? &tmr_buf : NULL; + ret = amdgpu_bo_create_kernel(psp->adev, tmr_size, PSP_TMR_ALIGNMENT, + AMDGPU_GEM_DOMAIN_VRAM, + &psp->tmr_bo, &psp->tmr_mc_addr, pptr); + } return ret; } @@ -2688,8 +2692,6 @@ } out: - psp_free_shared_bufs(psp); - return ret; } diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c @@ -500,6 +500,8 @@ adev_to_drm(adev)->mode_config.fb_base = adev->gmc.aper_base; + adev_to_drm(adev)->mode_config.fb_modifiers_not_supported = true; + r = amdgpu_display_modeset_create_props(adev); if (r) return r; diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -143,32 +143,6 @@ return 0; } -/* - * vm eviction_lock can be taken in MMU notifiers. Make sure no reclaim-FS - * happens while holding this lock anywhere to prevent deadlocks when - * an MMU notifier runs in reclaim-FS context. - */ -static inline void amdgpu_vm_eviction_lock(struct amdgpu_vm *vm) -{ - mutex_lock(&vm->eviction_lock); - vm->saved_flags = memalloc_noreclaim_save(); -} - -static inline int amdgpu_vm_eviction_trylock(struct amdgpu_vm *vm) -{ - if (mutex_trylock(&vm->eviction_lock)) { - vm->saved_flags = memalloc_noreclaim_save(); - return 1; - } - return 0; -} - -static inline void amdgpu_vm_eviction_unlock(struct amdgpu_vm *vm) -{ - memalloc_noreclaim_restore(vm->saved_flags); - mutex_unlock(&vm->eviction_lock); -} - /** * amdgpu_vm_bo_evicted - vm_bo is evicted * diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -1855,7 +1855,7 @@ { int ret; uint32_t num_devices, num_bos, num_objects; - uint64_t priv_size, priv_offset = 0; + uint64_t priv_size, priv_offset = 0, bo_priv_offset; if (!args->devices || !args->bos || !args->priv_data) return -EINVAL; @@ -1899,38 +1899,34 @@ if (ret) goto exit_unlock; - ret = criu_checkpoint_bos(p, num_bos, (uint8_t __user *)args->bos, - (uint8_t __user *)args->priv_data, &priv_offset); - if (ret) - goto exit_unlock; + /* Leave room for BOs in the private data. They need to be restored + * before events, but we checkpoint them last to simplify the error + * handling. + */ + bo_priv_offset = priv_offset; + priv_offset += num_bos * sizeof(struct kfd_criu_bo_priv_data); if (num_objects) { ret = kfd_criu_checkpoint_queues(p, (uint8_t __user *)args->priv_data, &priv_offset); if (ret) - goto close_bo_fds; + goto exit_unlock; ret = kfd_criu_checkpoint_events(p, (uint8_t __user *)args->priv_data, &priv_offset); if (ret) - goto close_bo_fds; + goto exit_unlock; ret = kfd_criu_checkpoint_svm(p, (uint8_t __user *)args->priv_data, &priv_offset); if (ret) - goto close_bo_fds; + goto exit_unlock; } -close_bo_fds: - if (ret) { - /* If IOCTL returns err, user assumes all FDs opened in criu_dump_bos are closed */ - uint32_t i; - struct kfd_criu_bo_bucket *bo_buckets = (struct kfd_criu_bo_bucket *) args->bos; - - for (i = 0; i < num_bos; i++) { - if (bo_buckets[i].alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) - close_fd(bo_buckets[i].dmabuf_fd); - } - } + /* This must be the last thing in this function that can fail. + * Otherwise we leak dmabuf file descriptors. + */ + ret = criu_checkpoint_bos(p, num_bos, (uint8_t __user *)args->bos, + (uint8_t __user *)args->priv_data, &bo_priv_offset); exit_unlock: mutex_unlock(&p->mutex); diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_events.c linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_events.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_events.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_events.c @@ -507,6 +507,7 @@ ret = create_other_event(p, ev, &ev_priv->event_id); break; } + mutex_unlock(&p->event_mutex); exit: if (ret) @@ -514,8 +515,6 @@ kfree(ev_priv); - mutex_unlock(&p->event_mutex); - return ret; } diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c linux-kvm-5.19.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -131,6 +131,14 @@ /* Number of bytes in PSP footer for firmware. */ #define PSP_FOOTER_BYTES 0x100 +/* + * DMUB Async to Sync Mechanism Status + */ +#define DMUB_ASYNC_TO_SYNC_ACCESS_FAIL 1 +#define DMUB_ASYNC_TO_SYNC_ACCESS_TIMEOUT 2 +#define DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS 3 +#define DMUB_ASYNC_TO_SYNC_ACCESS_INVALID 4 + /** * DOC: overview * @@ -1431,7 +1439,44 @@ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3460"), }, }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Tower Plus 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Tower 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex SFF Plus 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex SFF 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Micro Plus 7010"), + }, + }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex Micro 7010"), + }, + }, {} + /* TODO: refactor this from a fixed table to a dynamic option */ }; static void retrieve_dmi_info(struct amdgpu_display_manager *dm) @@ -1609,6 +1654,9 @@ if (amdgpu_dc_debug_mask & DC_DISABLE_CLOCK_GATING) adev->dm.dc->debug.disable_clock_gate = true; + /* TODO: Remove after DP2 receiver gets proper support of Cable ID feature */ + adev->dm.dc->debug.ignore_cable_id = true; + r = dm_dmub_hw_init(adev); if (r) { DRM_ERROR("DMUB interface failed to initialize: status=%d\n", r); @@ -1694,12 +1742,6 @@ } } - if (amdgpu_dm_initialize_drm_device(adev)) { - DRM_ERROR( - "amdgpu: failed to initialize sw for display support.\n"); - goto error; - } - /* Enable outbox notification only after IRQ handlers are registered and DMUB is alive. * It is expected that DMUB will resend any pending notifications at this point, for * example HPD from DPIA. @@ -1707,6 +1749,12 @@ if (dc_is_dmub_outbox_supported(adev->dm.dc)) dc_enable_dmub_outbox(adev->dm.dc); + if (amdgpu_dm_initialize_drm_device(adev)) { + DRM_ERROR( + "amdgpu: failed to initialize sw for display support.\n"); + goto error; + } + /* create fake encoders for MST */ dm_dp_create_fake_mst_encoders(adev); @@ -11774,6 +11822,8 @@ *operation_result = AUX_RET_ERROR_TIMEOUT; } else if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_FAIL) { *operation_result = AUX_RET_ERROR_ENGINE_ACQUIRE; + } else if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_INVALID) { + *operation_result = AUX_RET_ERROR_INVALID_REPLY; } else { *operation_result = AUX_RET_ERROR_UNKNOWN; } @@ -11821,6 +11871,16 @@ payload->reply[0] = adev->dm.dmub_notify->aux_reply.command; if (!payload->write && adev->dm.dmub_notify->aux_reply.length && payload->reply[0] == AUX_TRANSACTION_REPLY_AUX_ACK) { + + if (payload->length != adev->dm.dmub_notify->aux_reply.length) { + DRM_WARN("invalid read from DPIA AUX %x(%d) got length %d!\n", + payload->address, payload->length, + adev->dm.dmub_notify->aux_reply.length); + return amdgpu_dm_set_dmub_async_sync_status(is_cmd_aux, ctx, + DMUB_ASYNC_TO_SYNC_ACCESS_INVALID, + (uint32_t *)operation_result); + } + memcpy(payload->data, adev->dm.dmub_notify->aux_reply.data, adev->dm.dmub_notify->aux_reply.length); } diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c linux-kvm-5.19.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c @@ -1780,7 +1780,7 @@ for (j = 0; j < TIMEOUT_FOR_PIPE_ENABLE_MS*1000 && hubp->funcs->hubp_is_flip_pending(hubp); j++) - mdelay(1); + udelay(1); } } diff -u linux-kvm-5.19.0/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c linux-kvm-5.19.0/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c --- linux-kvm-5.19.0/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c @@ -376,7 +376,13 @@ if (((adev->pdev->device == 0x73A1) && (adev->pdev->revision == 0x00)) || ((adev->pdev->device == 0x73BF) && - (adev->pdev->revision == 0xCF))) + (adev->pdev->revision == 0xCF)) || + ((adev->pdev->device == 0x7422) && + (adev->pdev->revision == 0x00)) || + ((adev->pdev->device == 0x73A3) && + (adev->pdev->revision == 0x00)) || + ((adev->pdev->device == 0x73E3) && + (adev->pdev->revision == 0x00))) smu_baco->platform_support = false; } diff -u linux-kvm-5.19.0/drivers/gpu/drm/display/drm_dp_mst_topology.c linux-kvm-5.19.0/drivers/gpu/drm/display/drm_dp_mst_topology.c --- linux-kvm-5.19.0/drivers/gpu/drm/display/drm_dp_mst_topology.c +++ linux-kvm-5.19.0/drivers/gpu/drm/display/drm_dp_mst_topology.c @@ -5302,7 +5302,7 @@ mst_state = drm_atomic_get_mst_topology_state(state, mgr); if (IS_ERR(mst_state)) - return -EINVAL; + return PTR_ERR(mst_state); list_for_each_entry(pos, &mst_state->vcpis, next) { diff -u linux-kvm-5.19.0/drivers/gpu/drm/drm_internal.h linux-kvm-5.19.0/drivers/gpu/drm/drm_internal.h --- linux-kvm-5.19.0/drivers/gpu/drm/drm_internal.h +++ linux-kvm-5.19.0/drivers/gpu/drm/drm_internal.h @@ -104,7 +104,8 @@ static inline void drm_vblank_destroy_worker(struct drm_vblank_crtc *vblank) { - kthread_destroy_worker(vblank->worker); + if (vblank->worker) + kthread_destroy_worker(vblank->worker); } int drm_vblank_worker_init(struct drm_vblank_crtc *vblank); diff -u linux-kvm-5.19.0/drivers/gpu/drm/drm_panel_orientation_quirks.c linux-kvm-5.19.0/drivers/gpu/drm/drm_panel_orientation_quirks.c --- linux-kvm-5.19.0/drivers/gpu/drm/drm_panel_orientation_quirks.c +++ linux-kvm-5.19.0/drivers/gpu/drm/drm_panel_orientation_quirks.c @@ -134,6 +134,12 @@ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), }, .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Acer Switch V 10 (SW5-017) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SW5-017"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, }, { /* Anbernic Win600 */ .matches = { DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Anbernic"), @@ -319,6 +325,12 @@ DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21"), }, .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Nanote UMPC-01 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "RWC CO.,LTD"), + DMI_MATCH(DMI_PRODUCT_NAME, "UMPC-01"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, }, { /* OneGX1 Pro */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SYSTEM_MANUFACTURER"), diff -u linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_shmem.c linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_shmem.c --- linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +++ linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_shmem.c @@ -369,14 +369,14 @@ __start_cpu_write(obj); /* - * On non-LLC platforms, force the flush-on-acquire if this is ever + * On non-LLC igfx platforms, force the flush-on-acquire if this is ever * swapped-in. Our async flush path is not trust worthy enough yet(and * happens in the wrong order), and with some tricks it's conceivable * for userspace to change the cache-level to I915_CACHE_NONE after the * pages are swapped-in, and since execbuf binds the object before doing * the async flush, we have a race window. */ - if (!HAS_LLC(i915)) + if (!HAS_LLC(i915) && !IS_DGFX(i915)) obj->cache_dirty = true; } diff -u linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_ttm.c linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_ttm.c --- linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +++ linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_ttm.c @@ -660,6 +660,10 @@ WARN_ON_ONCE(obj->mm.madv == I915_MADV_WILLNEED); + err = ttm_bo_wait(bo, true, false); + if (err) + return err; + err = i915_ttm_move_notify(bo); if (err) return err; diff -u linux-kvm-5.19.0/drivers/gpu/drm/i915/gt/intel_gt.c linux-kvm-5.19.0/drivers/gpu/drm/i915/gt/intel_gt.c --- linux-kvm-5.19.0/drivers/gpu/drm/i915/gt/intel_gt.c +++ linux-kvm-5.19.0/drivers/gpu/drm/i915/gt/intel_gt.c @@ -679,8 +679,13 @@ return -EINTR; } - return timeout ? timeout : intel_uc_wait_for_idle(>->uc, - remaining_timeout); + if (timeout) + return timeout; + + if (remaining_timeout < 0) + remaining_timeout = 0; + + return intel_uc_wait_for_idle(>->uc, remaining_timeout); } int intel_gt_init(struct intel_gt *gt) @@ -1218,6 +1223,10 @@ if (!i915_mmio_reg_offset(rb.reg)) continue; + if (GRAPHICS_VER(i915) == 12 && (engine->class == VIDEO_DECODE_CLASS || + engine->class == VIDEO_ENHANCEMENT_CLASS)) + rb.bit = _MASKED_BIT_ENABLE(rb.bit); + intel_uncore_write_fw(uncore, rb.reg, rb.bit); awake |= engine->mask; } diff -u linux-kvm-5.19.0/drivers/gpu/drm/msm/msm_gpu.h linux-kvm-5.19.0/drivers/gpu/drm/msm/msm_gpu.h --- linux-kvm-5.19.0/drivers/gpu/drm/msm/msm_gpu.h +++ linux-kvm-5.19.0/drivers/gpu/drm/msm/msm_gpu.h @@ -282,6 +282,10 @@ static inline struct msm_gpu *dev_to_gpu(struct device *dev) { struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(dev); + + if (!adreno_smmu) + return NULL; + return container_of(adreno_smmu, struct msm_gpu, adreno_smmu); } diff -u linux-kvm-5.19.0/drivers/gpu/drm/panel/panel-simple.c linux-kvm-5.19.0/drivers/gpu/drm/panel/panel-simple.c --- linux-kvm-5.19.0/drivers/gpu/drm/panel/panel-simple.c +++ linux-kvm-5.19.0/drivers/gpu/drm/panel/panel-simple.c @@ -2384,6 +2384,7 @@ static const struct panel_desc logictechno_lt161010_2nh = { .timings = &logictechno_lt161010_2nh_timing, .num_timings = 1, + .bpc = 6, .size = { .width = 154, .height = 86, @@ -2413,6 +2414,7 @@ static const struct panel_desc logictechno_lt170410_2whc = { .timings = &logictechno_lt170410_2whc_timing, .num_timings = 1, + .bpc = 8, .size = { .width = 217, .height = 136, diff -u linux-kvm-5.19.0/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c linux-kvm-5.19.0/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c --- linux-kvm-5.19.0/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c +++ linux-kvm-5.19.0/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c @@ -875,10 +875,14 @@ { struct vop2_video_port *vp = to_vop2_video_port(crtc); struct vop2 *vop2 = vp->vop2; + struct drm_crtc_state *old_crtc_state; int ret; vop2_lock(vop2); + old_crtc_state = drm_atomic_get_old_crtc_state(state, crtc); + drm_atomic_helper_disable_planes_on_crtc(old_crtc_state, false); + drm_crtc_vblank_off(crtc); /* @@ -994,13 +998,15 @@ static void vop2_plane_atomic_disable(struct drm_plane *plane, struct drm_atomic_state *state) { - struct drm_plane_state *old_pstate = drm_atomic_get_old_plane_state(state, plane); + struct drm_plane_state *old_pstate = NULL; struct vop2_win *win = to_vop2_win(plane); struct vop2 *vop2 = win->vop2; drm_dbg(vop2->drm, "%s disable\n", win->data->name); - if (!old_pstate->crtc) + if (state) + old_pstate = drm_atomic_get_old_plane_state(state, plane); + if (old_pstate && !old_pstate->crtc) return; vop2_win_disable(win); diff -u linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_drv.c linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_drv.c --- linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_drv.c +++ linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_drv.c @@ -457,7 +457,12 @@ if (ret) return ret; - return platform_driver_register(&vc4_platform_driver); + ret = platform_driver_register(&vc4_platform_driver); + if (ret) + platform_unregister_drivers(component_drivers, + ARRAY_SIZE(component_drivers)); + + return ret; } static void __exit vc4_drm_unregister(void) diff -u linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_hdmi.c linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_hdmi.c --- linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_hdmi.c +++ linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_hdmi.c @@ -2732,9 +2732,16 @@ DRM_ERROR("Failed to get HDMI state machine clock\n"); return PTR_ERR(vc4_hdmi->hsm_clock); } + vc4_hdmi->audio_clock = vc4_hdmi->hsm_clock; vc4_hdmi->cec_clock = vc4_hdmi->hsm_clock; + vc4_hdmi->hsm_rpm_clock = devm_clk_get(dev, "hdmi"); + if (IS_ERR(vc4_hdmi->hsm_rpm_clock)) { + DRM_ERROR("Failed to get HDMI state machine clock\n"); + return PTR_ERR(vc4_hdmi->hsm_rpm_clock); + } + return 0; } @@ -2816,6 +2823,12 @@ return PTR_ERR(vc4_hdmi->hsm_clock); } + vc4_hdmi->hsm_rpm_clock = devm_clk_get(dev, "hdmi"); + if (IS_ERR(vc4_hdmi->hsm_rpm_clock)) { + DRM_ERROR("Failed to get HDMI state machine clock\n"); + return PTR_ERR(vc4_hdmi->hsm_rpm_clock); + } + vc4_hdmi->pixel_bvb_clock = devm_clk_get(dev, "bvb"); if (IS_ERR(vc4_hdmi->pixel_bvb_clock)) { DRM_ERROR("Failed to get pixel bvb clock\n"); @@ -2879,7 +2892,7 @@ { struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev); - clk_disable_unprepare(vc4_hdmi->hsm_clock); + clk_disable_unprepare(vc4_hdmi->hsm_rpm_clock); return 0; } @@ -2897,11 +2910,11 @@ * its frequency while the power domain is active so that it * keeps its rate. */ - ret = clk_set_min_rate(vc4_hdmi->hsm_clock, HSM_MIN_CLOCK_FREQ); + ret = clk_set_min_rate(vc4_hdmi->hsm_rpm_clock, HSM_MIN_CLOCK_FREQ); if (ret) return ret; - ret = clk_prepare_enable(vc4_hdmi->hsm_clock); + ret = clk_prepare_enable(vc4_hdmi->hsm_rpm_clock); if (ret) return ret; @@ -2914,7 +2927,7 @@ * case, it will lead to a silent CPU stall. Let's make sure we * prevent such a case. */ - rate = clk_get_rate(vc4_hdmi->hsm_clock); + rate = clk_get_rate(vc4_hdmi->hsm_rpm_clock); if (!rate) { ret = -EINVAL; goto err_disable_clk; diff -u linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_hdmi.h linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_hdmi.h --- linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_hdmi.h +++ linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_hdmi.h @@ -171,6 +171,7 @@ struct clk *cec_clock; struct clk *pixel_clock; struct clk *hsm_clock; + struct clk *hsm_rpm_clock; struct clk *audio_clock; struct clk *pixel_bvb_clock; diff -u linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_kms.c linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_kms.c --- linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_kms.c +++ linux-kvm-5.19.0/drivers/gpu/drm/vc4/vc4_kms.c @@ -197,8 +197,8 @@ struct drm_private_state *priv_state; priv_state = drm_atomic_get_new_private_obj_state(state, &vc4->hvs_channels); - if (IS_ERR(priv_state)) - return ERR_CAST(priv_state); + if (!priv_state) + return ERR_PTR(-EINVAL); return to_vc4_hvs_state(priv_state); } @@ -210,8 +210,8 @@ struct drm_private_state *priv_state; priv_state = drm_atomic_get_old_private_obj_state(state, &vc4->hvs_channels); - if (IS_ERR(priv_state)) - return ERR_CAST(priv_state); + if (!priv_state) + return ERR_PTR(-EINVAL); return to_vc4_hvs_state(priv_state); } diff -u linux-kvm-5.19.0/drivers/hid/wacom_wac.c linux-kvm-5.19.0/drivers/hid/wacom_wac.c --- linux-kvm-5.19.0/drivers/hid/wacom_wac.c +++ linux-kvm-5.19.0/drivers/hid/wacom_wac.c @@ -2483,11 +2483,12 @@ if (!delay_pen_events(wacom_wac) && wacom_wac->tool[0]) { int id = wacom_wac->id[0]; - if (wacom_wac->features.quirks & WACOM_QUIRK_PEN_BUTTON3 && - wacom_wac->hid_data.barrelswitch & wacom_wac->hid_data.barrelswitch2) { - wacom_wac->hid_data.barrelswitch = 0; - wacom_wac->hid_data.barrelswitch2 = 0; - wacom_wac->hid_data.barrelswitch3 = 1; + if (wacom_wac->features.quirks & WACOM_QUIRK_PEN_BUTTON3) { + int sw_state = wacom_wac->hid_data.barrelswitch | + (wacom_wac->hid_data.barrelswitch2 << 1); + wacom_wac->hid_data.barrelswitch = sw_state == 1; + wacom_wac->hid_data.barrelswitch2 = sw_state == 2; + wacom_wac->hid_data.barrelswitch3 = sw_state == 3; } input_report_key(input, BTN_STYLUS, wacom_wac->hid_data.barrelswitch); input_report_key(input, BTN_STYLUS2, wacom_wac->hid_data.barrelswitch2); diff -u linux-kvm-5.19.0/drivers/hv/vmbus_drv.c linux-kvm-5.19.0/drivers/hv/vmbus_drv.c --- linux-kvm-5.19.0/drivers/hv/vmbus_drv.c +++ linux-kvm-5.19.0/drivers/hv/vmbus_drv.c @@ -2078,6 +2078,7 @@ ret = device_register(&child_device_obj->device); if (ret) { pr_err("Unable to register child device\n"); + put_device(&child_device_obj->device); return ret; } diff -u linux-kvm-5.19.0/drivers/hwmon/asus-ec-sensors.c linux-kvm-5.19.0/drivers/hwmon/asus-ec-sensors.c --- linux-kvm-5.19.0/drivers/hwmon/asus-ec-sensors.c +++ linux-kvm-5.19.0/drivers/hwmon/asus-ec-sensors.c @@ -938,6 +938,8 @@ ec_data->nr_sensors = hweight_long(ec_data->board_info->sensors); ec_data->sensors = devm_kcalloc(dev, ec_data->nr_sensors, sizeof(struct ec_sensor), GFP_KERNEL); + if (!ec_data->sensors) + return -ENOMEM; status = setup_lock_data(dev); if (status) { diff -u linux-kvm-5.19.0/drivers/hwmon/coretemp.c linux-kvm-5.19.0/drivers/hwmon/coretemp.c --- linux-kvm-5.19.0/drivers/hwmon/coretemp.c +++ linux-kvm-5.19.0/drivers/hwmon/coretemp.c @@ -242,10 +242,13 @@ */ if (host_bridge && host_bridge->vendor == PCI_VENDOR_ID_INTEL) { for (i = 0; i < ARRAY_SIZE(tjmax_pci_table); i++) { - if (host_bridge->device == tjmax_pci_table[i].device) + if (host_bridge->device == tjmax_pci_table[i].device) { + pci_dev_put(host_bridge); return tjmax_pci_table[i].tjmax; + } } } + pci_dev_put(host_bridge); for (i = 0; i < ARRAY_SIZE(tjmax_table); i++) { if (strstr(c->x86_model_id, tjmax_table[i].id)) @@ -533,6 +536,10 @@ { struct temp_data *tdata = pdata->core_data[indx]; + /* if we errored on add then this is already gone */ + if (!tdata) + return; + /* Remove the sysfs attributes */ sysfs_remove_group(&pdata->hwmon_dev->kobj, &tdata->attr_group); diff -u linux-kvm-5.19.0/drivers/i2c/busses/i2c-imx.c linux-kvm-5.19.0/drivers/i2c/busses/i2c-imx.c --- linux-kvm-5.19.0/drivers/i2c/busses/i2c-imx.c +++ linux-kvm-5.19.0/drivers/i2c/busses/i2c-imx.c @@ -1132,7 +1132,8 @@ int i, result; unsigned int temp; int block_data = msgs->flags & I2C_M_RECV_LEN; - int use_dma = i2c_imx->dma && msgs->len >= DMA_THRESHOLD && !block_data; + int use_dma = i2c_imx->dma && msgs->flags & I2C_M_DMA_SAFE && + msgs->len >= DMA_THRESHOLD && !block_data; dev_dbg(&i2c_imx->adapter.dev, "<%s> write slave address: addr=0x%x\n", @@ -1298,7 +1299,8 @@ result = i2c_imx_read(i2c_imx, &msgs[i], is_lastmsg, atomic); } else { if (!atomic && - i2c_imx->dma && msgs[i].len >= DMA_THRESHOLD) + i2c_imx->dma && msgs[i].len >= DMA_THRESHOLD && + msgs[i].flags & I2C_M_DMA_SAFE) result = i2c_imx_dma_write(i2c_imx, &msgs[i]); else result = i2c_imx_write(i2c_imx, &msgs[i], atomic); diff -u linux-kvm-5.19.0/drivers/i2c/busses/i2c-npcm7xx.c linux-kvm-5.19.0/drivers/i2c/busses/i2c-npcm7xx.c --- linux-kvm-5.19.0/drivers/i2c/busses/i2c-npcm7xx.c +++ linux-kvm-5.19.0/drivers/i2c/busses/i2c-npcm7xx.c @@ -2365,8 +2365,17 @@ static int __init npcm_i2c_init(void) { + int ret; + npcm_i2c_debugfs_dir = debugfs_create_dir("npcm_i2c", NULL); - return platform_driver_register(&npcm_i2c_bus_driver); + + ret = platform_driver_register(&npcm_i2c_bus_driver); + if (ret) { + debugfs_remove_recursive(npcm_i2c_debugfs_dir); + return ret; + } + + return 0; } module_init(npcm_i2c_init); diff -u linux-kvm-5.19.0/drivers/i2c/busses/i2c-qcom-geni.c linux-kvm-5.19.0/drivers/i2c/busses/i2c-qcom-geni.c --- linux-kvm-5.19.0/drivers/i2c/busses/i2c-qcom-geni.c +++ linux-kvm-5.19.0/drivers/i2c/busses/i2c-qcom-geni.c @@ -616,7 +616,6 @@ dev_err(gi2c->se.dev, "I2C timeout gpi flags:%d addr:0x%x\n", gi2c->cur->flags, gi2c->cur->addr); gi2c->err = -ETIMEDOUT; - goto err; } if (gi2c->err) { diff -u linux-kvm-5.19.0/drivers/i2c/i2c-core-base.c linux-kvm-5.19.0/drivers/i2c/i2c-core-base.c --- linux-kvm-5.19.0/drivers/i2c/i2c-core-base.c +++ linux-kvm-5.19.0/drivers/i2c/i2c-core-base.c @@ -467,6 +467,7 @@ { struct i2c_client *client = i2c_verify_client(dev); struct i2c_driver *driver; + bool do_power_on; int status; if (!client) @@ -541,8 +542,8 @@ if (status < 0) goto err_clear_wakeup_irq; - status = dev_pm_domain_attach(&client->dev, - !i2c_acpi_waive_d0_probe(dev)); + do_power_on = !i2c_acpi_waive_d0_probe(dev); + status = dev_pm_domain_attach(&client->dev, do_power_on); if (status) goto err_clear_wakeup_irq; @@ -581,7 +582,7 @@ err_release_driver_resources: devres_release_group(&client->dev, client->devres_group_id); err_detach_pm_domain: - dev_pm_domain_detach(&client->dev, !i2c_acpi_waive_d0_probe(dev)); + dev_pm_domain_detach(&client->dev, do_power_on); err_clear_wakeup_irq: dev_pm_clear_wake_irq(&client->dev); device_init_wakeup(&client->dev, false); @@ -610,7 +611,7 @@ devres_release_group(&client->dev, client->devres_group_id); - dev_pm_domain_detach(&client->dev, !i2c_acpi_waive_d0_probe(dev)); + dev_pm_domain_detach(&client->dev, true); dev_pm_clear_wake_irq(&client->dev); device_init_wakeup(&client->dev, false); diff -u linux-kvm-5.19.0/drivers/iio/accel/bma400_core.c linux-kvm-5.19.0/drivers/iio/accel/bma400_core.c --- linux-kvm-5.19.0/drivers/iio/accel/bma400_core.c +++ linux-kvm-5.19.0/drivers/iio/accel/bma400_core.c @@ -621,16 +621,4 @@ int ret; - /* Try to read chip_id register. It must return 0x90. */ - ret = regmap_read(data->regmap, BMA400_CHIP_ID_REG, &val); - if (ret) { - dev_err(data->dev, "Failed to read chip id register\n"); - return ret; - } - - if (val != BMA400_ID_REG_VAL) { - dev_err(data->dev, "Chip ID mismatch\n"); - return -ENODEV; - } - data->regulators[BMA400_VDD_REGULATOR].supply = "vdd"; data->regulators[BMA400_VDDIO_REGULATOR].supply = "vddio"; @@ -657,6 +645,18 @@ if (ret) return ret; + /* Try to read chip_id register. It must return 0x90. */ + ret = regmap_read(data->regmap, BMA400_CHIP_ID_REG, &val); + if (ret) { + dev_err(data->dev, "Failed to read chip id register\n"); + return ret; + } + + if (val != BMA400_ID_REG_VAL) { + dev_err(data->dev, "Chip ID mismatch\n"); + return -ENODEV; + } + ret = bma400_get_power_mode(data); if (ret) { dev_err(data->dev, "Failed to get the initial power-mode\n"); diff -u linux-kvm-5.19.0/drivers/input/joystick/iforce/iforce-main.c linux-kvm-5.19.0/drivers/input/joystick/iforce/iforce-main.c --- linux-kvm-5.19.0/drivers/input/joystick/iforce/iforce-main.c +++ linux-kvm-5.19.0/drivers/input/joystick/iforce/iforce-main.c @@ -273,22 +273,22 @@ * Get device info. */ - if (!iforce_get_id_packet(iforce, 'M', buf, &len) || len < 3) + if (!iforce_get_id_packet(iforce, 'M', buf, &len) && len >= 3) input_dev->id.vendor = get_unaligned_le16(buf + 1); else dev_warn(&iforce->dev->dev, "Device does not respond to id packet M\n"); - if (!iforce_get_id_packet(iforce, 'P', buf, &len) || len < 3) + if (!iforce_get_id_packet(iforce, 'P', buf, &len) && len >= 3) input_dev->id.product = get_unaligned_le16(buf + 1); else dev_warn(&iforce->dev->dev, "Device does not respond to id packet P\n"); - if (!iforce_get_id_packet(iforce, 'B', buf, &len) || len < 3) + if (!iforce_get_id_packet(iforce, 'B', buf, &len) && len >= 3) iforce->device_memory.end = get_unaligned_le16(buf + 1); else dev_warn(&iforce->dev->dev, "Device does not respond to id packet B\n"); - if (!iforce_get_id_packet(iforce, 'N', buf, &len) || len < 2) + if (!iforce_get_id_packet(iforce, 'N', buf, &len) && len >= 2) ff_effects = buf[1]; else dev_warn(&iforce->dev->dev, "Device does not respond to id packet N\n"); diff -u linux-kvm-5.19.0/drivers/input/serio/i8042.c linux-kvm-5.19.0/drivers/input/serio/i8042.c --- linux-kvm-5.19.0/drivers/input/serio/i8042.c +++ linux-kvm-5.19.0/drivers/input/serio/i8042.c @@ -1565,8 +1565,6 @@ { int error; - i8042_platform_device = dev; - if (i8042_reset == I8042_RESET_ALWAYS) { error = i8042_controller_selftest(); if (error) @@ -1606,7 +1604,6 @@ i8042_free_aux_ports(); /* in case KBD failed but AUX not */ i8042_free_irqs(); i8042_controller_reset(false); - i8042_platform_device = NULL; return error; } @@ -1616,7 +1613,6 @@ i8042_unregister_ports(); i8042_free_irqs(); i8042_controller_reset(false); - i8042_platform_device = NULL; return 0; } diff -u linux-kvm-5.19.0/drivers/input/touchscreen/goodix.c linux-kvm-5.19.0/drivers/input/touchscreen/goodix.c --- linux-kvm-5.19.0/drivers/input/touchscreen/goodix.c +++ linux-kvm-5.19.0/drivers/input/touchscreen/goodix.c @@ -1164,6 +1164,7 @@ input_set_abs_params(ts->input_dev, ABS_MT_WIDTH_MAJOR, 0, 255, 0, 0); input_set_abs_params(ts->input_dev, ABS_MT_TOUCH_MAJOR, 0, 255, 0, 0); +retry_read_config: /* Read configuration and apply touchscreen parameters */ goodix_read_config(ts); @@ -1171,6 +1172,16 @@ touchscreen_parse_properties(ts->input_dev, true, &ts->prop); if (!ts->prop.max_x || !ts->prop.max_y || !ts->max_touch_num) { + if (!ts->reset_controller_at_probe && + ts->irq_pin_access_method != IRQ_PIN_ACCESS_NONE) { + dev_info(&ts->client->dev, "Config not set, resetting controller\n"); + /* Retry after a controller reset */ + ts->reset_controller_at_probe = true; + error = goodix_reset(ts); + if (error) + return error; + goto retry_read_config; + } dev_err(&ts->client->dev, "Invalid config (%d, %d, %d), using defaults\n", ts->prop.max_x, ts->prop.max_y, ts->max_touch_num); diff -u linux-kvm-5.19.0/drivers/iommu/intel/dmar.c linux-kvm-5.19.0/drivers/iommu/intel/dmar.c --- linux-kvm-5.19.0/drivers/iommu/intel/dmar.c +++ linux-kvm-5.19.0/drivers/iommu/intel/dmar.c @@ -820,6 +820,7 @@ info = dmar_alloc_pci_notify_info(dev, BUS_NOTIFY_ADD_DEVICE); if (!info) { + pci_dev_put(dev); return dmar_dev_scope_status; } else { dmar_pci_bus_add_dev(info); diff -u linux-kvm-5.19.0/drivers/iommu/intel/iommu.c linux-kvm-5.19.0/drivers/iommu/intel/iommu.c --- linux-kvm-5.19.0/drivers/iommu/intel/iommu.c +++ linux-kvm-5.19.0/drivers/iommu/intel/iommu.c @@ -1014,11 +1014,9 @@ domain_flush_cache(domain, tmp_page, VTD_PAGE_SIZE); pteval = ((uint64_t)virt_to_dma_pfn(tmp_page) << VTD_PAGE_SHIFT) | DMA_PTE_READ | DMA_PTE_WRITE; - if (domain_use_first_level(domain)) { - pteval |= DMA_FL_PTE_XD | DMA_FL_PTE_US; - if (iommu_is_dma_domain(&domain->domain)) - pteval |= DMA_FL_PTE_ACCESS; - } + if (domain_use_first_level(domain)) + pteval |= DMA_FL_PTE_XD | DMA_FL_PTE_US | DMA_FL_PTE_ACCESS; + if (cmpxchg64(&pte->val, 0ULL, pteval)) /* Someone else set it while we were thinking; use theirs. */ free_pgtable_page(tmp_page); @@ -3981,8 +3979,10 @@ struct pci_dev *pdev = NULL; for_each_pci_dev(pdev) - if (pdev->external_facing) + if (pdev->external_facing) { + pci_dev_put(pdev); return true; + } return false; } diff -u linux-kvm-5.19.0/drivers/isdn/mISDN/core.c linux-kvm-5.19.0/drivers/isdn/mISDN/core.c --- linux-kvm-5.19.0/drivers/isdn/mISDN/core.c +++ linux-kvm-5.19.0/drivers/isdn/mISDN/core.c @@ -222,7 +222,7 @@ err = get_free_devid(); if (err < 0) - goto error1; + return err; dev->id = err; device_initialize(&dev->dev); diff -u linux-kvm-5.19.0/drivers/mmc/host/sdhci-esdhc-imx.c linux-kvm-5.19.0/drivers/mmc/host/sdhci-esdhc-imx.c --- linux-kvm-5.19.0/drivers/mmc/host/sdhci-esdhc-imx.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci-esdhc-imx.c @@ -25,6 +25,7 @@ #include #include #include +#include "sdhci-cqhci.h" #include "sdhci-pltfm.h" #include "sdhci-esdhc.h" #include "cqhci.h" @@ -1288,7 +1289,7 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask) { - sdhci_reset(host, mask); + sdhci_and_cqhci_reset(host, mask); sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); @@ -1511,7 +1512,7 @@ * system resume back. */ cqhci_writel(cq_host, 0, CQHCI_CTL); - if (cqhci_readl(cq_host, CQHCI_CTL) && CQHCI_HALT) + if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT) dev_err(mmc_dev(host->mmc), "failed to exit halt state when enable CQE\n"); @@ -1671,14 +1672,14 @@ if (imx_data->socdata->flags & ESDHC_FLAG_ERR004536) host->quirks |= SDHCI_QUIRK_BROKEN_ADMA; - if (host->caps & MMC_CAP_8_BIT_DATA && + if (host->mmc->caps & MMC_CAP_8_BIT_DATA && imx_data->socdata->flags & ESDHC_FLAG_HS400) host->mmc->caps2 |= MMC_CAP2_HS400; if (imx_data->socdata->flags & ESDHC_FLAG_BROKEN_AUTO_CMD23) host->quirks2 |= SDHCI_QUIRK2_ACMD23_BROKEN; - if (host->caps & MMC_CAP_8_BIT_DATA && + if (host->mmc->caps & MMC_CAP_8_BIT_DATA && imx_data->socdata->flags & ESDHC_FLAG_HS400_ES) { host->mmc->caps2 |= MMC_CAP2_HS400_ES; host->mmc_host_ops.hs400_enhanced_strobe = diff -u linux-kvm-5.19.0/drivers/mmc/host/sdhci-pci-core.c linux-kvm-5.19.0/drivers/mmc/host/sdhci-pci-core.c --- linux-kvm-5.19.0/drivers/mmc/host/sdhci-pci-core.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci-pci-core.c @@ -1733,6 +1733,8 @@ } } + pci_dev_put(smbus_dev); + if (gen == AMD_CHIPSET_BEFORE_ML || gen == AMD_CHIPSET_CZ) chip->quirks2 |= SDHCI_QUIRK2_CLEAR_TRANSFERMODE_REG_BEFORE_CMD; diff -u linux-kvm-5.19.0/drivers/mmc/host/sdhci-sprd.c linux-kvm-5.19.0/drivers/mmc/host/sdhci-sprd.c --- linux-kvm-5.19.0/drivers/mmc/host/sdhci-sprd.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci-sprd.c @@ -470,7 +470,7 @@ } if (IS_ERR(sprd_host->pinctrl)) - return 0; + goto reset; switch (ios->signal_voltage) { case MMC_SIGNAL_VOLTAGE_180: @@ -498,6 +498,8 @@ /* Wait for 300 ~ 500 us for pin state stable */ usleep_range(300, 500); + +reset: sdhci_reset(host, SDHCI_RESET_CMD | SDHCI_RESET_DATA); return 0; diff -u linux-kvm-5.19.0/drivers/mmc/host/sdhci-tegra.c linux-kvm-5.19.0/drivers/mmc/host/sdhci-tegra.c --- linux-kvm-5.19.0/drivers/mmc/host/sdhci-tegra.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci-tegra.c @@ -28,6 +28,7 @@ #include +#include "sdhci-cqhci.h" #include "sdhci-pltfm.h" #include "cqhci.h" @@ -367,7 +368,7 @@ const struct sdhci_tegra_soc_data *soc_data = tegra_host->soc_data; u32 misc_ctrl, clk_ctrl, pad_ctrl; - sdhci_reset(host, mask); + sdhci_and_cqhci_reset(host, mask); if (!(mask & SDHCI_RESET_ALL)) return; diff -u linux-kvm-5.19.0/drivers/net/bonding/bond_main.c linux-kvm-5.19.0/drivers/net/bonding/bond_main.c --- linux-kvm-5.19.0/drivers/net/bonding/bond_main.c +++ linux-kvm-5.19.0/drivers/net/bonding/bond_main.c @@ -3204,16 +3204,23 @@ struct slave *slave) { struct slave *curr_active_slave, *curr_arp_slave; - struct icmp6hdr *hdr = icmp6_hdr(skb); struct in6_addr *saddr, *daddr; + struct { + struct ipv6hdr ip6; + struct icmp6hdr icmp6; + } *combined, _combined; if (skb->pkt_type == PACKET_OTHERHOST || - skb->pkt_type == PACKET_LOOPBACK || - hdr->icmp6_type != NDISC_NEIGHBOUR_ADVERTISEMENT) + skb->pkt_type == PACKET_LOOPBACK) goto out; - saddr = &ipv6_hdr(skb)->saddr; - daddr = &ipv6_hdr(skb)->daddr; + combined = skb_header_pointer(skb, 0, sizeof(_combined), &_combined); + if (!combined || combined->ip6.nexthdr != NEXTHDR_ICMP || + combined->icmp6.icmp6_type != NDISC_NEIGHBOUR_ADVERTISEMENT) + goto out; + + saddr = &combined->ip6.saddr; + daddr = &combined->ip6.saddr; slave_dbg(bond->dev, slave->dev, "%s: %s/%d av %d sv %d sip %pI6c tip %pI6c\n", __func__, slave->dev->name, bond_slave_state(slave), diff -u linux-kvm-5.19.0/drivers/net/can/rcar/rcar_canfd.c linux-kvm-5.19.0/drivers/net/can/rcar/rcar_canfd.c --- linux-kvm-5.19.0/drivers/net/can/rcar/rcar_canfd.c +++ linux-kvm-5.19.0/drivers/net/can/rcar/rcar_canfd.c @@ -80,8 +80,7 @@ /* RSCFDnCFDGERFL / RSCFDnGERFL */ #define RCANFD_GERFL_EEF0_7 GENMASK(23, 16) -#define RCANFD_GERFL_EEF1 BIT(17) -#define RCANFD_GERFL_EEF0 BIT(16) +#define RCANFD_GERFL_EEF(ch) BIT(16 + (ch)) #define RCANFD_GERFL_CMPOF BIT(3) /* CAN FD only */ #define RCANFD_GERFL_THLES BIT(2) #define RCANFD_GERFL_MES BIT(1) @@ -89,7 +88,7 @@ #define RCANFD_GERFL_ERR(gpriv, x) \ ((x) & (reg_v3u(gpriv, RCANFD_GERFL_EEF0_7, \ - RCANFD_GERFL_EEF0 | RCANFD_GERFL_EEF1) | \ + RCANFD_GERFL_EEF(0) | RCANFD_GERFL_EEF(1)) | \ RCANFD_GERFL_MES | \ ((gpriv)->fdmode ? RCANFD_GERFL_CMPOF : 0))) @@ -935,12 +934,8 @@ u32 ridx = ch + RCANFD_RFFIFO_IDX; gerfl = rcar_canfd_read(priv->base, RCANFD_GERFL); - if ((gerfl & RCANFD_GERFL_EEF0) && (ch == 0)) { - netdev_dbg(ndev, "Ch0: ECC Error flag\n"); - stats->tx_dropped++; - } - if ((gerfl & RCANFD_GERFL_EEF1) && (ch == 1)) { - netdev_dbg(ndev, "Ch1: ECC Error flag\n"); + if (gerfl & RCANFD_GERFL_EEF(ch)) { + netdev_dbg(ndev, "Ch%u: ECC Error flag\n", ch); stats->tx_dropped++; } if (gerfl & RCANFD_GERFL_MES) { diff -u linux-kvm-5.19.0/drivers/net/can/usb/gs_usb.c linux-kvm-5.19.0/drivers/net/can/usb/gs_usb.c --- linux-kvm-5.19.0/drivers/net/can/usb/gs_usb.c +++ linux-kvm-5.19.0/drivers/net/can/usb/gs_usb.c @@ -268,8 +268,6 @@ struct usb_anchor tx_submitted; atomic_t active_tx_urbs; - void *rxbuf[GS_MAX_RX_URBS]; - dma_addr_t rxbuf_dma[GS_MAX_RX_URBS]; }; /* usb interface struct */ @@ -587,9 +585,6 @@ if (urb->status) netdev_info(netdev, "usb xmit fail %u\n", txc->echo_id); - - usb_free_coherent(urb->dev, urb->transfer_buffer_length, - urb->transfer_buffer, urb->transfer_dma); } static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, @@ -618,8 +613,7 @@ if (!urb) goto nomem_urb; - hf = usb_alloc_coherent(dev->udev, dev->hf_size_tx, GFP_ATOMIC, - &urb->transfer_dma); + hf = kmalloc(dev->hf_size_tx, GFP_ATOMIC); if (!hf) { netdev_err(netdev, "No memory left for USB buffer\n"); goto nomem_hf; @@ -663,7 +657,7 @@ hf, dev->hf_size_tx, gs_usb_xmit_callback, txc); - urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + urb->transfer_flags |= URB_FREE_BUFFER; usb_anchor_urb(urb, &dev->tx_submitted); can_put_echo_skb(skb, netdev, idx, 0); @@ -678,8 +672,6 @@ gs_free_tx_context(txc); usb_unanchor_urb(urb); - usb_free_coherent(dev->udev, urb->transfer_buffer_length, - urb->transfer_buffer, urb->transfer_dma); if (rc == -ENODEV) { netif_device_detach(netdev); @@ -699,8 +691,7 @@ return NETDEV_TX_OK; badidx: - usb_free_coherent(dev->udev, urb->transfer_buffer_length, - urb->transfer_buffer, urb->transfer_dma); + kfree(hf); nomem_hf: usb_free_urb(urb); @@ -744,7 +735,6 @@ for (i = 0; i < GS_MAX_RX_URBS; i++) { struct urb *urb; u8 *buf; - dma_addr_t buf_dma; /* alloc rx urb */ urb = usb_alloc_urb(0, GFP_KERNEL); @@ -752,10 +742,8 @@ return -ENOMEM; /* alloc rx buffer */ - buf = usb_alloc_coherent(dev->udev, - dev->parent->hf_size_rx, - GFP_KERNEL, - &buf_dma); + buf = kmalloc(dev->parent->hf_size_rx, + GFP_KERNEL); if (!buf) { netdev_err(netdev, "No memory left for USB buffer\n"); @@ -763,8 +751,6 @@ return -ENOMEM; } - urb->transfer_dma = buf_dma; - /* fill, anchor, and submit rx urb */ usb_fill_bulk_urb(urb, dev->udev, @@ -773,7 +759,7 @@ buf, dev->parent->hf_size_rx, gs_usb_receive_bulk_callback, parent); - urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + urb->transfer_flags |= URB_FREE_BUFFER; usb_anchor_urb(urb, &parent->rx_submitted); @@ -786,17 +772,10 @@ "usb_submit failed (err=%d)\n", rc); usb_unanchor_urb(urb); - usb_free_coherent(dev->udev, - sizeof(struct gs_host_frame), - buf, - buf_dma); usb_free_urb(urb); break; } - dev->rxbuf[i] = buf; - dev->rxbuf_dma[i] = buf_dma; - /* Drop reference, * USB core will take care of freeing it */ @@ -854,7 +833,6 @@ int rc; struct gs_can *dev = netdev_priv(netdev); struct gs_usb *parent = dev->parent; - unsigned int i; netif_stop_queue(netdev); @@ -862,11 +840,6 @@ parent->active_channels--; if (!parent->active_channels) { usb_kill_anchored_urbs(&parent->rx_submitted); - for (i = 0; i < GS_MAX_RX_URBS; i++) - usb_free_coherent(dev->udev, - sizeof(struct gs_host_frame), - dev->rxbuf[i], - dev->rxbuf_dma[i]); } /* Stop sending URBs */ diff -u linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c --- linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c +++ linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_macsec.c @@ -585,6 +585,7 @@ ret = aq_mss_set_egress_sakey_record(hw, &key_rec, sa_idx); + memzero_explicit(&key_rec, sizeof(key_rec)); return ret; } @@ -932,6 +933,7 @@ ret = aq_mss_set_ingress_sakey_record(hw, &sa_key_record, sa_idx); + memzero_explicit(&sa_key_record, sizeof(sa_key_record)); return ret; } diff -u linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_main.c linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_main.c @@ -58,7 +58,7 @@ return ndev; } -static int aq_ndev_open(struct net_device *ndev) +int aq_ndev_open(struct net_device *ndev) { struct aq_nic_s *aq_nic = netdev_priv(ndev); int err = 0; @@ -88,7 +88,7 @@ return err; } -static int aq_ndev_close(struct net_device *ndev) +int aq_ndev_close(struct net_device *ndev) { struct aq_nic_s *aq_nic = netdev_priv(ndev); int err = 0; diff -u linux-kvm-5.19.0/drivers/net/ethernet/atheros/ag71xx.c linux-kvm-5.19.0/drivers/net/ethernet/atheros/ag71xx.c --- linux-kvm-5.19.0/drivers/net/ethernet/atheros/ag71xx.c +++ linux-kvm-5.19.0/drivers/net/ethernet/atheros/ag71xx.c @@ -1427,7 +1427,7 @@ if (ret) { netif_err(ag, link, ndev, "phylink_of_phy_connect filed with err: %i\n", ret); - goto err; + return ret; } max_frame_len = ag71xx_max_frame_len(ndev->mtu); @@ -1448,6 +1448,7 @@ err: ag71xx_rings_cleanup(ag); + phylink_disconnect_phy(ag->phylink); return ret; } diff -u linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bgmac.c linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bgmac.c --- linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bgmac.c +++ linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bgmac.c @@ -1568,7 +1568,6 @@ phy_disconnect(bgmac->net_dev->phydev); netif_napi_del(&bgmac->napi); bgmac_dma_free(bgmac); - free_netdev(bgmac->net_dev); } EXPORT_SYMBOL_GPL(bgmac_enet_remove); diff -u linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt.c linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt.c --- linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -9988,17 +9988,12 @@ return -ENODEV; } -int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset) +static void bnxt_clear_reservations(struct bnxt *bp, bool fw_reset) { struct bnxt_hw_resc *hw_resc = &bp->hw_resc; - int rc; if (!BNXT_NEW_RM(bp)) - return 0; /* no resource reservations required */ - - rc = bnxt_hwrm_func_resc_qcaps(bp, true); - if (rc) - netdev_err(bp->dev, "resc_qcaps failed\n"); + return; /* no resource reservations required */ hw_resc->resv_cp_rings = 0; hw_resc->resv_stat_ctxs = 0; @@ -10011,6 +10006,20 @@ bp->tx_nr_rings = 0; bp->rx_nr_rings = 0; } +} + +int bnxt_cancel_reservations(struct bnxt *bp, bool fw_reset) +{ + int rc; + + if (!BNXT_NEW_RM(bp)) + return 0; /* no resource reservations required */ + + rc = bnxt_hwrm_func_resc_qcaps(bp, true); + if (rc) + netdev_err(bp->dev, "resc_qcaps failed\n"); + + bnxt_clear_reservations(bp, fw_reset); return rc; } @@ -12899,8 +12908,8 @@ rcu_read_lock(); hlist_for_each_entry_rcu(fltr, head, hash) { if (bnxt_fltr_match(fltr, new_fltr)) { + rc = fltr->sw_id; rcu_read_unlock(); - rc = 0; goto err_free; } } @@ -13918,7 +13927,9 @@ pci_ers_result_t result = PCI_ERS_RESULT_DISCONNECT; struct net_device *netdev = pci_get_drvdata(pdev); struct bnxt *bp = netdev_priv(netdev); - int err = 0, off; + int retry = 0; + int err = 0; + int off; netdev_info(bp->dev, "PCI Slot Reset\n"); @@ -13946,11 +13957,36 @@ pci_restore_state(pdev); pci_save_state(pdev); + bnxt_inv_fw_health_reg(bp); + bnxt_try_map_fw_health_reg(bp); + + /* In some PCIe AER scenarios, firmware may take up to + * 10 seconds to become ready in the worst case. + */ + do { + err = bnxt_try_recover_fw(bp); + if (!err) + break; + retry++; + } while (retry < BNXT_FW_SLOT_RESET_RETRY); + + if (err) { + dev_err(&pdev->dev, "Firmware not ready\n"); + goto reset_exit; + } + err = bnxt_hwrm_func_reset(bp); if (!err) result = PCI_ERS_RESULT_RECOVERED; + + bnxt_ulp_irq_stop(bp); + bnxt_clear_int_mode(bp); + err = bnxt_init_int_mode(bp); + bnxt_ulp_irq_restart(bp, err); } +reset_exit: + bnxt_clear_reservations(bp, true); rtnl_unlock(); return result; @@ -14006,8 +14042,16 @@ static int __init bnxt_init(void) { + int err; + bnxt_debug_init(); - return pci_register_driver(&bnxt_pci_driver); + err = pci_register_driver(&bnxt_pci_driver); + if (err) { + bnxt_debug_exit(); + return err; + } + + return 0; } static void __exit bnxt_exit(void) diff -u linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt.h linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt.h --- linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt.h +++ linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt.h @@ -1621,6 +1621,7 @@ #define BNXT_FW_RETRY 5 #define BNXT_FW_IF_RETRY 10 +#define BNXT_FW_SLOT_RESET_RETRY 4 enum board_idx { BCM57301, diff -u linux-kvm-5.19.0/drivers/net/ethernet/engleder/tsnep_main.c linux-kvm-5.19.0/drivers/net/ethernet/engleder/tsnep_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/engleder/tsnep_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/engleder/tsnep_main.c @@ -504,6 +504,27 @@ return (budget != 0); } +static bool tsnep_tx_pending(struct tsnep_tx *tx) +{ + unsigned long flags; + struct tsnep_tx_entry *entry; + bool pending = false; + + spin_lock_irqsave(&tx->lock, flags); + + if (tx->read != tx->write) { + entry = &tx->entry[tx->read]; + if ((__le32_to_cpu(entry->desc_wb->properties) & + TSNEP_TX_DESC_OWNER_MASK) == + (entry->properties & TSNEP_TX_DESC_OWNER_MASK)) + pending = true; + } + + spin_unlock_irqrestore(&tx->lock, flags); + + return pending; +} + static int tsnep_tx_open(struct tsnep_adapter *adapter, void __iomem *addr, struct tsnep_tx *tx) { @@ -751,6 +772,19 @@ return done; } +static bool tsnep_rx_pending(struct tsnep_rx *rx) +{ + struct tsnep_rx_entry *entry; + + entry = &rx->entry[rx->read]; + if ((__le32_to_cpu(entry->desc_wb->properties) & + TSNEP_DESC_OWNER_COUNTER_MASK) == + (entry->properties & TSNEP_DESC_OWNER_COUNTER_MASK)) + return true; + + return false; +} + static int tsnep_rx_open(struct tsnep_adapter *adapter, void __iomem *addr, struct tsnep_rx *rx) { @@ -795,6 +829,17 @@ tsnep_rx_ring_cleanup(rx); } +static bool tsnep_pending(struct tsnep_queue *queue) +{ + if (queue->tx && tsnep_tx_pending(queue->tx)) + return true; + + if (queue->rx && tsnep_rx_pending(queue->rx)) + return true; + + return false; +} + static int tsnep_poll(struct napi_struct *napi, int budget) { struct tsnep_queue *queue = container_of(napi, struct tsnep_queue, @@ -815,9 +860,19 @@ if (!complete) return budget; - if (likely(napi_complete_done(napi, done))) + if (likely(napi_complete_done(napi, done))) { tsnep_enable_irq(queue->adapter, queue->irq_mask); + /* reschedule if work is already pending, prevent rotten packets + * which are transmitted or received after polling but before + * interrupt enable + */ + if (tsnep_pending(queue)) { + tsnep_disable_irq(queue->adapter, queue->irq_mask); + napi_schedule(napi); + } + } + return min(done, budget - 1); } diff -u linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc.c linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc.c --- linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc.c +++ linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc.c @@ -2058,7 +2058,7 @@ /* enable Tx ints by setting pkt thr to 1 */ enetc_txbdr_wr(hw, idx, ENETC_TBICR0, ENETC_TBICR0_ICEN | 0x1); - tbmr = ENETC_TBMR_EN; + tbmr = ENETC_TBMR_EN | ENETC_TBMR_SET_PRIO(tx_ring->prio); if (tx_ring->ndev->features & NETIF_F_HW_VLAN_CTAG_TX) tbmr |= ENETC_TBMR_VIH; @@ -2121,13 +2121,14 @@ static void enetc_setup_bdrs(struct enetc_ndev_priv *priv) { + struct enetc_hw *hw = &priv->si->hw; int i; for (i = 0; i < priv->num_tx_rings; i++) - enetc_setup_txbdr(&priv->si->hw, priv->tx_ring[i]); + enetc_setup_txbdr(hw, priv->tx_ring[i]); for (i = 0; i < priv->num_rx_rings; i++) - enetc_setup_rxbdr(&priv->si->hw, priv->rx_ring[i]); + enetc_setup_rxbdr(hw, priv->rx_ring[i]); } static void enetc_clear_rxbdr(struct enetc_hw *hw, struct enetc_bdr *rx_ring) @@ -2160,13 +2161,14 @@ static void enetc_clear_bdrs(struct enetc_ndev_priv *priv) { + struct enetc_hw *hw = &priv->si->hw; int i; for (i = 0; i < priv->num_tx_rings; i++) - enetc_clear_txbdr(&priv->si->hw, priv->tx_ring[i]); + enetc_clear_txbdr(hw, priv->tx_ring[i]); for (i = 0; i < priv->num_rx_rings; i++) - enetc_clear_rxbdr(&priv->si->hw, priv->rx_ring[i]); + enetc_clear_rxbdr(hw, priv->rx_ring[i]); udelay(1); } @@ -2174,13 +2176,13 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv) { struct pci_dev *pdev = priv->si->pdev; + struct enetc_hw *hw = &priv->si->hw; int i, j, err; for (i = 0; i < priv->bdr_int_num; i++) { int irq = pci_irq_vector(pdev, ENETC_BDR_INT_BASE_IDX + i); struct enetc_int_vector *v = priv->int_vector[i]; int entry = ENETC_BDR_INT_BASE_IDX + i; - struct enetc_hw *hw = &priv->si->hw; snprintf(v->name, sizeof(v->name), "%s-rxtx%d", priv->ndev->name, i); @@ -2268,13 +2270,14 @@ static void enetc_clear_interrupts(struct enetc_ndev_priv *priv) { + struct enetc_hw *hw = &priv->si->hw; int i; for (i = 0; i < priv->num_tx_rings; i++) - enetc_txbdr_wr(&priv->si->hw, i, ENETC_TBIER, 0); + enetc_txbdr_wr(hw, i, ENETC_TBIER, 0); for (i = 0; i < priv->num_rx_rings; i++) - enetc_rxbdr_wr(&priv->si->hw, i, ENETC_RBIER, 0); + enetc_rxbdr_wr(hw, i, ENETC_RBIER, 0); } static int enetc_phylink_connect(struct net_device *ndev) @@ -2441,6 +2444,7 @@ { struct enetc_ndev_priv *priv = netdev_priv(ndev); struct tc_mqprio_qopt *mqprio = type_data; + struct enetc_hw *hw = &priv->si->hw; struct enetc_bdr *tx_ring; int num_stack_tx_queues; u8 num_tc; @@ -2457,7 +2461,8 @@ /* Reset all ring priorities to 0 */ for (i = 0; i < priv->num_tx_rings; i++) { tx_ring = priv->tx_ring[i]; - enetc_set_bdr_prio(&priv->si->hw, tx_ring->index, 0); + tx_ring->prio = 0; + enetc_set_bdr_prio(hw, tx_ring->index, tx_ring->prio); } return 0; @@ -2476,7 +2481,8 @@ */ for (i = 0; i < num_tc; i++) { tx_ring = priv->tx_ring[i]; - enetc_set_bdr_prio(&priv->si->hw, tx_ring->index, i); + tx_ring->prio = i; + enetc_set_bdr_prio(hw, tx_ring->index, tx_ring->prio); } /* Reset the number of netdev queues based on the TC count */ @@ -2589,19 +2595,21 @@ static void enetc_enable_rxvlan(struct net_device *ndev, bool en) { struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct enetc_hw *hw = &priv->si->hw; int i; for (i = 0; i < priv->num_rx_rings; i++) - enetc_bdr_enable_rxvlan(&priv->si->hw, i, en); + enetc_bdr_enable_rxvlan(hw, i, en); } static void enetc_enable_txvlan(struct net_device *ndev, bool en) { struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct enetc_hw *hw = &priv->si->hw; int i; for (i = 0; i < priv->num_tx_rings; i++) - enetc_bdr_enable_txvlan(&priv->si->hw, i, en); + enetc_bdr_enable_txvlan(hw, i, en); } void enetc_set_features(struct net_device *ndev, netdev_features_t features) diff -u linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc.h linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc.h --- linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc.h +++ linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc.h @@ -95,6 +95,7 @@ void __iomem *rcir; }; u16 index; + u16 prio; int bd_count; /* # of BDs */ int next_to_use; int next_to_clean; @@ -467,19 +468,20 @@ static inline void enetc_get_max_cap(struct enetc_ndev_priv *priv) { + struct enetc_hw *hw = &priv->si->hw; u32 reg; - reg = enetc_port_rd(&priv->si->hw, ENETC_PSIDCAPR); + reg = enetc_port_rd(hw, ENETC_PSIDCAPR); priv->psfp_cap.max_streamid = reg & ENETC_PSIDCAPR_MSK; /* Port stream filter capability */ - reg = enetc_port_rd(&priv->si->hw, ENETC_PSFCAPR); + reg = enetc_port_rd(hw, ENETC_PSFCAPR); priv->psfp_cap.max_psfp_filter = reg & ENETC_PSFCAPR_MSK; /* Port stream gate capability */ - reg = enetc_port_rd(&priv->si->hw, ENETC_PSGCAPR); + reg = enetc_port_rd(hw, ENETC_PSGCAPR); priv->psfp_cap.max_psfp_gate = (reg & ENETC_PSGCAPR_SGIT_MSK); priv->psfp_cap.max_psfp_gatelist = (reg & ENETC_PSGCAPR_GCL_MSK) >> 16; /* Port flow meter capability */ - reg = enetc_port_rd(&priv->si->hw, ENETC_PFMCAPR); + reg = enetc_port_rd(hw, ENETC_PFMCAPR); priv->psfp_cap.max_psfp_meter = reg & ENETC_PFMCAPR_MSK; } diff -u linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc_qos.c linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc_qos.c --- linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc_qos.c +++ linux-kvm-5.19.0/drivers/net/ethernet/freescale/enetc/enetc_qos.c @@ -17,8 +17,9 @@ void enetc_sched_speed_set(struct enetc_ndev_priv *priv, int speed) { + struct enetc_hw *hw = &priv->si->hw; u32 old_speed = priv->speed; - u32 pspeed; + u32 pspeed, tmp; if (speed == old_speed) return; @@ -39,16 +40,15 @@ } priv->speed = speed; - enetc_port_wr(&priv->si->hw, ENETC_PMR, - (enetc_port_rd(&priv->si->hw, ENETC_PMR) - & (~ENETC_PMR_PSPEED_MASK)) - | pspeed); + tmp = enetc_port_rd(hw, ENETC_PMR); + enetc_port_wr(hw, ENETC_PMR, (tmp & ~ENETC_PMR_PSPEED_MASK) | pspeed); } static int enetc_setup_taprio(struct net_device *ndev, struct tc_taprio_qopt_offload *admin_conf) { struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct enetc_hw *hw = &priv->si->hw; struct enetc_cbd cbd = {.cmd = 0}; struct tgs_gcl_conf *gcl_config; struct tgs_gcl_data *gcl_data; @@ -61,15 +61,13 @@ int err; int i; - if (admin_conf->num_entries > enetc_get_max_gcl_len(&priv->si->hw)) + if (admin_conf->num_entries > enetc_get_max_gcl_len(hw)) return -EINVAL; gcl_len = admin_conf->num_entries; - tge = enetc_rd(&priv->si->hw, ENETC_QBV_PTGCR_OFFSET); + tge = enetc_rd(hw, ENETC_QBV_PTGCR_OFFSET); if (!admin_conf->enable) { - enetc_wr(&priv->si->hw, - ENETC_QBV_PTGCR_OFFSET, - tge & (~ENETC_QBV_TGE)); + enetc_wr(hw, ENETC_QBV_PTGCR_OFFSET, tge & ~ENETC_QBV_TGE); priv->active_offloads &= ~ENETC_F_QBV; @@ -117,14 +115,11 @@ cbd.cls = BDCR_CMD_PORT_GCL; cbd.status_flags = 0; - enetc_wr(&priv->si->hw, ENETC_QBV_PTGCR_OFFSET, - tge | ENETC_QBV_TGE); + enetc_wr(hw, ENETC_QBV_PTGCR_OFFSET, tge | ENETC_QBV_TGE); err = enetc_send_cmd(priv->si, &cbd); if (err) - enetc_wr(&priv->si->hw, - ENETC_QBV_PTGCR_OFFSET, - tge & (~ENETC_QBV_TGE)); + enetc_wr(hw, ENETC_QBV_PTGCR_OFFSET, tge & ~ENETC_QBV_TGE); enetc_cbd_free_data_mem(priv->si, data_size, tmp, &dma); @@ -138,6 +133,8 @@ { struct tc_taprio_qopt_offload *taprio = type_data; struct enetc_ndev_priv *priv = netdev_priv(ndev); + struct enetc_hw *hw = &priv->si->hw; + struct enetc_bdr *tx_ring; int err; int i; @@ -146,18 +143,20 @@ if (priv->tx_ring[i]->tsd_enable) return -EBUSY; - for (i = 0; i < priv->num_tx_rings; i++) - enetc_set_bdr_prio(&priv->si->hw, - priv->tx_ring[i]->index, - taprio->enable ? i : 0); + for (i = 0; i < priv->num_tx_rings; i++) { + tx_ring = priv->tx_ring[i]; + tx_ring->prio = taprio->enable ? i : 0; + enetc_set_bdr_prio(hw, tx_ring->index, tx_ring->prio); + } err = enetc_setup_taprio(ndev, taprio); - - if (err) - for (i = 0; i < priv->num_tx_rings; i++) - enetc_set_bdr_prio(&priv->si->hw, - priv->tx_ring[i]->index, - taprio->enable ? 0 : i); + if (err) { + for (i = 0; i < priv->num_tx_rings; i++) { + tx_ring = priv->tx_ring[i]; + tx_ring->prio = taprio->enable ? 0 : i; + enetc_set_bdr_prio(hw, tx_ring->index, tx_ring->prio); + } + } return err; } @@ -178,7 +177,7 @@ struct tc_cbs_qopt_offload *cbs = type_data; u32 port_transmit_rate = priv->speed; u8 tc_nums = netdev_get_num_tc(ndev); - struct enetc_si *si = priv->si; + struct enetc_hw *hw = &priv->si->hw; u32 hi_credit_bit, hi_credit_reg; u32 max_interference_size; u32 port_frame_max_size; @@ -199,15 +198,15 @@ * lower than this TC have been disabled. */ if (tc == prio_top && - enetc_get_cbs_enable(&si->hw, prio_next)) { + enetc_get_cbs_enable(hw, prio_next)) { dev_err(&ndev->dev, "Disable TC%d before disable TC%d\n", prio_next, tc); return -EINVAL; } - enetc_port_wr(&si->hw, ENETC_PTCCBSR1(tc), 0); - enetc_port_wr(&si->hw, ENETC_PTCCBSR0(tc), 0); + enetc_port_wr(hw, ENETC_PTCCBSR1(tc), 0); + enetc_port_wr(hw, ENETC_PTCCBSR0(tc), 0); return 0; } @@ -224,13 +223,13 @@ * higher than this TC have been enabled. */ if (tc == prio_next) { - if (!enetc_get_cbs_enable(&si->hw, prio_top)) { + if (!enetc_get_cbs_enable(hw, prio_top)) { dev_err(&ndev->dev, "Enable TC%d first before enable TC%d\n", prio_top, prio_next); return -EINVAL; } - bw_sum += enetc_get_cbs_bw(&si->hw, prio_top); + bw_sum += enetc_get_cbs_bw(hw, prio_top); } if (bw_sum + bw >= 100) { @@ -239,7 +238,7 @@ return -EINVAL; } - enetc_port_rd(&si->hw, ENETC_PTCMSDUR(tc)); + enetc_port_rd(hw, ENETC_PTCMSDUR(tc)); /* For top prio TC, the max_interfrence_size is maxSizedFrame. * @@ -259,8 +258,8 @@ u32 m0, ma, r0, ra; m0 = port_frame_max_size * 8; - ma = enetc_port_rd(&si->hw, ENETC_PTCMSDUR(prio_top)) * 8; - ra = enetc_get_cbs_bw(&si->hw, prio_top) * + ma = enetc_port_rd(hw, ENETC_PTCMSDUR(prio_top)) * 8; + ra = enetc_get_cbs_bw(hw, prio_top) * port_transmit_rate * 10000ULL; r0 = port_transmit_rate * 1000000ULL; max_interference_size = m0 + ma + @@ -280,10 +279,10 @@ hi_credit_reg = (u32)div_u64((ENETC_CLK * 100ULL) * hi_credit_bit, port_transmit_rate * 1000000ULL); - enetc_port_wr(&si->hw, ENETC_PTCCBSR1(tc), hi_credit_reg); + enetc_port_wr(hw, ENETC_PTCCBSR1(tc), hi_credit_reg); /* Set bw register and enable this traffic class */ - enetc_port_wr(&si->hw, ENETC_PTCCBSR0(tc), bw | ENETC_CBSE); + enetc_port_wr(hw, ENETC_PTCCBSR0(tc), bw | ENETC_CBSE); return 0; } @@ -293,6 +292,7 @@ struct enetc_ndev_priv *priv = netdev_priv(ndev); struct tc_etf_qopt_offload *qopt = type_data; u8 tc_nums = netdev_get_num_tc(ndev); + struct enetc_hw *hw = &priv->si->hw; int tc; if (!tc_nums) @@ -304,12 +304,11 @@ return -EINVAL; /* TSD and Qbv are mutually exclusive in hardware */ - if (enetc_rd(&priv->si->hw, ENETC_QBV_PTGCR_OFFSET) & ENETC_QBV_TGE) + if (enetc_rd(hw, ENETC_QBV_PTGCR_OFFSET) & ENETC_QBV_TGE) return -EBUSY; priv->tx_ring[tc]->tsd_enable = qopt->enable; - enetc_port_wr(&priv->si->hw, ENETC_PTCTSDR(tc), - qopt->enable ? ENETC_TSDE : 0); + enetc_port_wr(hw, ENETC_PTCTSDR(tc), qopt->enable ? ENETC_TSDE : 0); return 0; } diff -u linux-kvm-5.19.0/drivers/net/ethernet/huawei/hinic/hinic_main.c linux-kvm-5.19.0/drivers/net/ethernet/huawei/hinic/hinic_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -1478,8 +1478,15 @@ static int __init hinic_module_init(void) { + int ret; + hinic_dbg_register_debugfs(HINIC_DRV_NAME); - return pci_register_driver(&hinic_driver); + + ret = pci_register_driver(&hinic_driver); + if (ret) + hinic_dbg_unregister_debugfs(); + + return ret; } static void __exit hinic_module_exit(void) diff -u linux-kvm-5.19.0/drivers/net/ethernet/intel/i40e/i40e_main.c linux-kvm-5.19.0/drivers/net/ethernet/intel/i40e/i40e_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/intel/i40e/i40e_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -16529,6 +16529,8 @@ **/ static int __init i40e_init_module(void) { + int err; + pr_info("%s: %s\n", i40e_driver_name, i40e_driver_string); pr_info("%s: %s\n", i40e_driver_name, i40e_copyright); @@ -16546,7 +16548,14 @@ } i40e_dbg_init(); - return pci_register_driver(&i40e_driver); + err = pci_register_driver(&i40e_driver); + if (err) { + destroy_workqueue(i40e_wq); + i40e_dbg_exit(); + return err; + } + + return 0; } module_init(i40e_init_module); diff -u linux-kvm-5.19.0/drivers/net/ethernet/intel/iavf/iavf_main.c linux-kvm-5.19.0/drivers/net/ethernet/intel/iavf/iavf_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/intel/iavf/iavf_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/iavf/iavf_main.c @@ -2836,7 +2836,6 @@ iavf_free_queues(adapter); memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE); iavf_shutdown_adminq(&adapter->hw); - adapter->netdev->flags &= ~IFF_UP; adapter->flags &= ~IAVF_FLAG_RESET_PENDING; iavf_change_state(adapter, __IAVF_DOWN); wake_up(&adapter->down_waitqueue); @@ -2936,6 +2935,11 @@ iavf_disable_vf(adapter); mutex_unlock(&adapter->client_lock); mutex_unlock(&adapter->crit_lock); + if (netif_running(netdev)) { + rtnl_lock(); + dev_close(netdev); + rtnl_unlock(); + } return; /* Do not attempt to reinit. It's dead, Jim. */ } @@ -2948,6 +2952,7 @@ if (running) { netif_carrier_off(netdev); + netif_tx_stop_all_queues(netdev); adapter->link_up = false; iavf_napi_disable_all(adapter); } @@ -3087,6 +3092,16 @@ mutex_unlock(&adapter->client_lock); mutex_unlock(&adapter->crit_lock); + + if (netif_running(netdev)) { + /* Close device to ensure that Tx queues will not be started + * during netif_device_attach() at the end of the reset task. + */ + rtnl_lock(); + dev_close(netdev); + rtnl_unlock(); + } + dev_err(&adapter->pdev->dev, "failed to allocate resources during reinit\n"); reset_finish: rtnl_lock(); @@ -4936,23 +4951,21 @@ static void iavf_remove(struct pci_dev *pdev) { struct iavf_adapter *adapter = iavf_pdev_to_adapter(pdev); - struct net_device *netdev = adapter->netdev; struct iavf_fdir_fltr *fdir, *fdirtmp; struct iavf_vlan_filter *vlf, *vlftmp; + struct iavf_cloud_filter *cf, *cftmp; struct iavf_adv_rss *rss, *rsstmp; struct iavf_mac_filter *f, *ftmp; - struct iavf_cloud_filter *cf, *cftmp; - struct iavf_hw *hw = &adapter->hw; + struct net_device *netdev; + struct iavf_hw *hw; int err; - /* When reboot/shutdown is in progress no need to do anything - * as the adapter is already REMOVE state that was set during - * iavf_shutdown() callback. - */ - if (adapter->state == __IAVF_REMOVE) + netdev = adapter->netdev; + hw = &adapter->hw; + + if (test_and_set_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section)) return; - set_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section); /* Wait until port initialization is complete. * There are flows where register/unregister netdev may race. */ @@ -5092,6 +5105,8 @@ **/ static int __init iavf_init_module(void) { + int ret; + pr_info("iavf: %s\n", iavf_driver_string); pr_info("%s\n", iavf_copyright); @@ -5102,7 +5117,12 @@ pr_err("%s: Failed to create workqueue\n", iavf_driver_name); return -ENOMEM; } - return pci_register_driver(&iavf_driver); + + ret = pci_register_driver(&iavf_driver); + if (ret) + destroy_workqueue(iavf_wq); + + return ret; } module_init(iavf_init_module); diff -u linux-kvm-5.19.0/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c linux-kvm-5.19.0/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c --- linux-kvm-5.19.0/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c @@ -2385,6 +2385,8 @@ list_for_each_entry(f, &adapter->vlan_filter_list, list) { if (f->is_new_vlan) { f->is_new_vlan = false; + if (!f->vlan.vid) + continue; if (f->vlan.tpid == ETH_P_8021Q) set_bit(f->vlan.vid, adapter->vsi.active_cvlans); diff -u linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_base.c linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_base.c --- linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_base.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_base.c @@ -959,7 +959,7 @@ * associated to the queue to schedule NAPI handler */ q_vector = ring->q_vector; - if (q_vector) + if (q_vector && !(vsi->vf && ice_is_vf_disabled(vsi->vf))) ice_trigger_sw_intr(hw, q_vector); status = ice_dis_vsi_txq(vsi->port_info, txq_meta->vsi_idx, diff -u linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_lib.c linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_lib.c --- linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_lib.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_lib.c @@ -2220,6 +2220,31 @@ } /** + * ice_vsi_is_rx_queue_active + * @vsi: the VSI being configured + * + * Return true if at least one queue is active. + */ +bool ice_vsi_is_rx_queue_active(struct ice_vsi *vsi) +{ + struct ice_pf *pf = vsi->back; + struct ice_hw *hw = &pf->hw; + int i; + + ice_for_each_rxq(vsi, i) { + u32 rx_reg; + int pf_q; + + pf_q = vsi->rxq_map[i]; + rx_reg = rd32(hw, QRX_CTRL(pf_q)); + if (rx_reg & QRX_CTRL_QENA_STAT_M) + return true; + } + + return false; +} + +/** * ice_vsi_is_vlan_pruning_ena - check if VLAN pruning is enabled or not * @vsi: VSI to check whether or not VLAN pruning is enabled. * diff -u linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_vf_lib.c linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_vf_lib.c --- linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_vf_lib.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_vf_lib.c @@ -510,7 +510,10 @@ return -EINVAL; } ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, vf->vf_id); - ice_vsi_stop_all_rx_rings(vsi); + + if (ice_vsi_is_rx_queue_active(vsi)) + ice_vsi_stop_all_rx_rings(vsi); + dev_dbg(dev, "VF is already disabled, there is no need for resetting it, telling VM, all is fine %d\n", vf->vf_id); return 0; diff -u linux-kvm-5.19.0/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c linux-kvm-5.19.0/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -7352,6 +7352,7 @@ struct mvpp2 *priv) { struct resource *res; + void __iomem *base; res = platform_get_resource(pdev, IORESOURCE_MEM, 2); if (!res) { @@ -7362,9 +7363,12 @@ return 0; } - priv->cm3_base = devm_ioremap_resource(&pdev->dev, res); + base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(base)) + return PTR_ERR(base); - return PTR_ERR_OR_ZERO(priv->cm3_base); + priv->cm3_base = base; + return 0; } static int mvpp2_probe(struct platform_device *pdev) diff -u linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c --- linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c @@ -863,6 +863,7 @@ } sq->head = 0; + sq->cons_head = 0; sq->sqe_per_sqb = (pfvf->hw.sqb_size / sq->sqe_size) - 1; sq->num_sqbs = (qset->sqe_cnt + sq->sqe_per_sqb) / sq->sqe_per_sqb; /* Set SQE threshold to 10% of total SQEs */ diff -u linux-kvm-5.19.0/drivers/net/ethernet/mediatek/mtk_eth_soc.c linux-kvm-5.19.0/drivers/net/ethernet/mediatek/mtk_eth_soc.c --- linux-kvm-5.19.0/drivers/net/ethernet/mediatek/mtk_eth_soc.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mediatek/mtk_eth_soc.c @@ -2565,8 +2565,10 @@ u32 gdm_config = MTK_GDMA_TO_PDMA; err = mtk_start_dma(eth); - if (err) + if (err) { + phylink_disconnect_phy(mac->phylink); return err; + } if (eth->soc->offload_version && mtk_ppe_start(eth->ppe) == 0) gdm_config = MTK_GDMA_TO_PPE; @@ -3608,12 +3610,12 @@ eth->ppe = mtk_ppe_init(eth, eth->base + MTK_ETH_PPE_BASE, 2); if (!eth->ppe) { err = -ENOMEM; - goto err_free_dev; + goto err_deinit_mdio; } err = mtk_eth_offload_init(eth); if (err) - goto err_free_dev; + goto err_deinit_mdio; } for (i = 0; i < MTK_MAX_DEVS; i++) { diff -u linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/cmd.c linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/cmd.c --- linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/cmd.c @@ -45,6 +45,8 @@ #include "mlx5_core.h" #include "lib/eq.h" #include "lib/tout.h" +#define CREATE_TRACE_POINTS +#include "diag/cmd_tracepoint.h" enum { CMD_IF_REV = 5, @@ -785,27 +787,14 @@ static void cmd_status_print(struct mlx5_core_dev *dev, void *in, void *out) { u16 opcode, op_mod; - u32 syndrome; - u8 status; u16 uid; - int err; - - syndrome = MLX5_GET(mbox_out, out, syndrome); - status = MLX5_GET(mbox_out, out, status); opcode = MLX5_GET(mbox_in, in, opcode); op_mod = MLX5_GET(mbox_in, in, op_mod); uid = MLX5_GET(mbox_in, in, uid); - err = cmd_status_to_err(status); - if (!uid && opcode != MLX5_CMD_OP_DESTROY_MKEY) mlx5_cmd_out_err(dev, opcode, op_mod, out); - else - mlx5_core_dbg(dev, - "%s(0x%x) op_mod(0x%x) uid(%d) failed, status %s(0x%x), syndrome (0x%x), err(%d)\n", - mlx5_command_str(opcode), opcode, op_mod, uid, - cmd_status_str(status), status, syndrome, err); } int mlx5_cmd_check(struct mlx5_core_dev *dev, int err, void *in, void *out) @@ -1016,6 +1005,7 @@ cmd_ent_get(ent); set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state); + cmd_ent_get(ent); /* for the _real_ FW event on completion */ /* Skip sending command to fw if internal error */ if (mlx5_cmd_is_down(dev) || !opcode_allowed(&dev->cmd, ent->op)) { ent->ret = -ENXIO; @@ -1023,7 +1013,6 @@ return; } - cmd_ent_get(ent); /* for the _real_ FW event on completion */ /* ring doorbell after the descriptor is valid */ mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx); wmb(); @@ -1508,8 +1497,8 @@ return -EFAULT; err = sscanf(outlen_str, "%d", &outlen); - if (err < 0) - return err; + if (err != 1) + return -EINVAL; ptr = kzalloc(outlen, GFP_KERNEL); if (!ptr) @@ -1672,8 +1661,8 @@ cmd_ent_put(ent); /* timeout work was canceled */ if (!forced || /* Real FW completion */ - pci_channel_offline(dev->pdev) || /* FW is inaccessible */ - dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) + mlx5_cmd_is_down(dev) || /* No real FW completion is expected */ + !opcode_allowed(cmd, ent->op)) cmd_ent_put(ent); ent->ts2 = ktime_get_ns(); @@ -1770,12 +1759,17 @@ struct mlx5_cmd *cmd = &dev->cmd; int i; - for (i = 0; i < cmd->max_reg_cmds; i++) - while (down_trylock(&cmd->sem)) + for (i = 0; i < cmd->max_reg_cmds; i++) { + while (down_trylock(&cmd->sem)) { mlx5_cmd_trigger_completions(dev); + cond_resched(); + } + } - while (down_trylock(&cmd->pages_sem)) + while (down_trylock(&cmd->pages_sem)) { mlx5_cmd_trigger_completions(dev); + cond_resched(); + } /* Unlock cmdif */ up(&cmd->pages_sem); @@ -1887,6 +1881,16 @@ return err; } +static void mlx5_cmd_err_trace(struct mlx5_core_dev *dev, u16 opcode, u16 op_mod, void *out) +{ + u32 syndrome = MLX5_GET(mbox_out, out, syndrome); + u8 status = MLX5_GET(mbox_out, out, status); + + trace_mlx5_cmd(mlx5_command_str(opcode), opcode, op_mod, + cmd_status_str(status), status, syndrome, + cmd_status_to_err(status)); +} + static void cmd_status_log(struct mlx5_core_dev *dev, u16 opcode, u8 status, u32 syndrome, int err) { @@ -1909,7 +1913,7 @@ } /* preserve -EREMOTEIO for outbox.status != OK, otherwise return err as is */ -static int cmd_status_err(struct mlx5_core_dev *dev, int err, u16 opcode, void *out) +static int cmd_status_err(struct mlx5_core_dev *dev, int err, u16 opcode, u16 op_mod, void *out) { u32 syndrome = MLX5_GET(mbox_out, out, syndrome); u8 status = MLX5_GET(mbox_out, out, status); @@ -1917,8 +1921,10 @@ if (err == -EREMOTEIO) /* -EREMOTEIO is preserved */ err = -EIO; - if (!err && status != MLX5_CMD_STAT_OK) + if (!err && status != MLX5_CMD_STAT_OK) { err = -EREMOTEIO; + mlx5_cmd_err_trace(dev, opcode, op_mod, out); + } cmd_status_log(dev, opcode, status, syndrome, err); return err; @@ -1946,9 +1952,9 @@ { int err = cmd_exec(dev, in, in_size, out, out_size, NULL, NULL, false); u16 opcode = MLX5_GET(mbox_in, in, opcode); + u16 op_mod = MLX5_GET(mbox_in, in, op_mod); - err = cmd_status_err(dev, err, opcode, out); - return err; + return cmd_status_err(dev, err, opcode, op_mod, out); } EXPORT_SYMBOL(mlx5_cmd_do); @@ -1992,8 +1998,9 @@ { int err = cmd_exec(dev, in, in_size, out, out_size, NULL, NULL, true); u16 opcode = MLX5_GET(mbox_in, in, opcode); + u16 op_mod = MLX5_GET(mbox_in, in, op_mod); - err = cmd_status_err(dev, err, opcode, out); + err = cmd_status_err(dev, err, opcode, op_mod, out); return mlx5_cmd_check(dev, err, in, out); } EXPORT_SYMBOL(mlx5_cmd_exec_polling); @@ -2029,7 +2036,7 @@ struct mlx5_async_ctx *ctx; ctx = work->ctx; - status = cmd_status_err(ctx->dev, status, work->opcode, work->out); + status = cmd_status_err(ctx->dev, status, work->opcode, work->op_mod, work->out); work->user_callback(status, work); if (atomic_dec_and_test(&ctx->num_inflight)) complete(&ctx->inflight_done); @@ -2044,6 +2051,7 @@ work->ctx = ctx; work->user_callback = callback; work->opcode = MLX5_GET(mbox_in, in, opcode); + work->op_mod = MLX5_GET(mbox_in, in, op_mod); work->out = out; if (WARN_ON(!atomic_inc_not_zero(&ctx->num_inflight))) return -EIO; diff -u linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h --- linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h @@ -11,6 +11,27 @@ #define INL_HDR_START_SZ (sizeof(((struct mlx5_wqe_eth_seg *)NULL)->inline_hdr.start)) +/* IPSEC inline data includes: + * 1. ESP trailer: up to 255 bytes of padding, 1 byte for pad length, 1 byte for + * next header. + * 2. ESP authentication data: 16 bytes for ICV. + */ +#define MLX5E_MAX_TX_IPSEC_DS DIV_ROUND_UP(sizeof(struct mlx5_wqe_inline_seg) + \ + 255 + 1 + 1 + 16, MLX5_SEND_WQE_DS) + +/* 366 should be big enough to cover all L2, L3 and L4 headers with possible + * encapsulations. + */ +#define MLX5E_MAX_TX_INLINE_DS DIV_ROUND_UP(366 - INL_HDR_START_SZ + VLAN_HLEN, \ + MLX5_SEND_WQE_DS) + +/* Sync the calculation with mlx5e_sq_calc_wqe_attr. */ +#define MLX5E_MAX_TX_WQEBBS DIV_ROUND_UP(MLX5E_TX_WQE_EMPTY_DS_COUNT + \ + MLX5E_MAX_TX_INLINE_DS + \ + MLX5E_MAX_TX_IPSEC_DS + \ + MAX_SKB_FRAGS + 1, \ + MLX5_SEND_WQEBB_NUM_DS) + #define MLX5E_RX_ERR_CQE(cqe) (get_cqe_opcode(cqe) != MLX5_CQE_RESP_SEND) static inline @@ -424,6 +445,8 @@ static inline u16 mlx5e_stop_room_for_wqe(struct mlx5_core_dev *mdev, u16 wqe_size) { + WARN_ON_ONCE(PAGE_SIZE / MLX5_SEND_WQE_BB < mlx5e_get_max_sq_wqebbs(mdev)); + /* A WQE must not cross the page boundary, hence two conditions: * 1. Its size must not exceed the page size. * 2. If the WQE size is X, and the space remaining in a page is less @@ -436,7 +459,6 @@ "wqe_size %u is greater than max SQ WQEBBs %u", wqe_size, mlx5e_get_max_sq_wqebbs(mdev)); - return MLX5E_STOP_ROOM(wqe_size); } diff -u linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_main.c linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_main.c @@ -5442,6 +5442,13 @@ clear_bit(MLX5E_STATE_DESTROYING, &priv->state); + /* Validate the max_wqe_size_sq capability. */ + if (WARN_ON_ONCE(mlx5e_get_max_sq_wqebbs(priv->mdev) < MLX5E_MAX_TX_WQEBBS)) { + mlx5_core_warn(priv->mdev, "MLX5E: Max SQ WQEBBs firmware capability: %u, needed %lu\n", + mlx5e_get_max_sq_wqebbs(priv->mdev), MLX5E_MAX_TX_WQEBBS); + return -EIO; + } + /* max number of channels may have changed */ max_nch = mlx5e_calc_max_nch(priv->mdev, priv->netdev, profile); if (priv->channels.params.num_channels > max_nch) { diff -u linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c --- linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -1492,7 +1492,6 @@ struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *attr, struct netlink_ext_ack *extack, - bool *encap_valid, bool *vf_tun) { struct mlx5e_tc_flow_parse_attr *parse_attr; @@ -1509,7 +1508,6 @@ parse_attr = attr->parse_attr; esw_attr = attr->esw_attr; *vf_tun = false; - *encap_valid = true; for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++) { struct net_device *out_dev; @@ -1526,7 +1524,7 @@ goto out; } err = mlx5e_attach_encap(priv, flow, attr, out_dev, out_index, - extack, &encap_dev, encap_valid); + extack, &encap_dev); dev_put(out_dev); if (err) goto out; @@ -1590,8 +1588,8 @@ struct mlx5e_tc_flow_parse_attr *parse_attr; struct mlx5_flow_attr *attr = flow->attr; struct mlx5_esw_flow_attr *esw_attr; - bool vf_tun, encap_valid; u32 max_prio, max_chain; + bool vf_tun; int err = 0; parse_attr = attr->parse_attr; @@ -1681,7 +1679,7 @@ esw_attr->int_port = int_port; } - err = set_encap_dests(priv, flow, attr, extack, &encap_valid, &vf_tun); + err = set_encap_dests(priv, flow, attr, extack, &vf_tun); if (err) goto err_out; @@ -1711,7 +1709,7 @@ * (1) there's no error * (2) there's an encap action and we don't have valid neigh */ - if (!encap_valid || flow_flag_test(flow, SLOW)) + if (flow_flag_test(flow, SLOW)) flow->rule[0] = mlx5e_tc_offload_to_slow_path(esw, flow, &parse_attr->spec); else flow->rule[0] = mlx5e_tc_offload_fdb_rules(esw, flow, &parse_attr->spec, attr); @@ -3609,7 +3607,7 @@ struct mlx5e_post_act *post_act = get_post_action(flow->priv); struct mlx5_flow_attr *attr, *next_attr = NULL; struct mlx5e_post_act_handle *handle; - bool vf_tun, encap_valid = true; + bool vf_tun; int err; /* This is going in reverse order as needed. @@ -3631,13 +3629,10 @@ if (list_is_last(&attr->list, &flow->attrs)) break; - err = set_encap_dests(flow->priv, flow, attr, extack, &encap_valid, &vf_tun); + err = set_encap_dests(flow->priv, flow, attr, extack, &vf_tun); if (err) goto out_free; - if (!encap_valid) - flow_flag_set(flow, SLOW); - err = actions_prepare_mod_hdr_actions(flow->priv, flow, attr, extack); if (err) goto out_free; diff -u linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c --- linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c @@ -304,6 +304,8 @@ u16 ds_cnt_inl = 0; u16 ds_cnt_ids = 0; + /* Sync the calculation with MLX5E_MAX_TX_WQEBBS. */ + if (attr->insz) ds_cnt_ids = DIV_ROUND_UP(sizeof(struct mlx5_wqe_inline_seg) + attr->insz, MLX5_SEND_WQE_DS); @@ -316,6 +318,9 @@ inl += VLAN_HLEN; ds_cnt_inl = DIV_ROUND_UP(inl, MLX5_SEND_WQE_DS); + if (WARN_ON_ONCE(ds_cnt_inl > MLX5E_MAX_TX_INLINE_DS)) + netdev_warn(skb->dev, "ds_cnt_inl = %u > max %u\n", ds_cnt_inl, + (u16)MLX5E_MAX_TX_INLINE_DS); ds_cnt += ds_cnt_inl; } diff -u linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c --- linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c @@ -431,7 +431,7 @@ mlx5_lag_mpesw_is_activated(esw->dev)) dest[dest_idx].type = MLX5_FLOW_DESTINATION_TYPE_UPLINK; } - if (esw_attr->dests[attr_idx].flags & MLX5_ESW_DEST_ENCAP) { + if (esw_attr->dests[attr_idx].flags & MLX5_ESW_DEST_ENCAP_VALID) { if (pkt_reformat) { flow_act->action |= MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT; flow_act->pkt_reformat = esw_attr->dests[attr_idx].pkt_reformat; diff -u linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/main.c linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/main.c --- linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/main.c @@ -1735,7 +1735,8 @@ res = state == pci_channel_io_perm_failure ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET; - mlx5_pci_trace(dev, "Exit, result = %d, %s\n", res, result2str(res)); + mlx5_core_info(dev, "%s Device state = %d pci_status: %d. Exit, result = %d, %s\n", + __func__, dev->state, dev->pci_status, res, result2str(res)); return res; } @@ -1774,7 +1775,8 @@ struct mlx5_core_dev *dev = pci_get_drvdata(pdev); int err; - mlx5_pci_trace(dev, "Enter\n"); + mlx5_core_info(dev, "%s Device state = %d pci_status: %d. Enter\n", + __func__, dev->state, dev->pci_status); err = mlx5_pci_enable_device(dev); if (err) { @@ -1796,7 +1798,8 @@ res = PCI_ERS_RESULT_RECOVERED; out: - mlx5_pci_trace(dev, "Exit, err = %d, result = %d, %s\n", err, res, result2str(res)); + mlx5_core_info(dev, "%s Device state = %d pci_status: %d. Exit, err = %d, result = %d, %s\n", + __func__, dev->state, dev->pci_status, err, res, result2str(res)); return res; } diff -u linux-kvm-5.19.0/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c linux-kvm-5.19.0/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c --- linux-kvm-5.19.0/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c +++ linux-kvm-5.19.0/drivers/net/ethernet/microchip/lan966x/lan966x_ethtool.c @@ -716,6 +716,9 @@ snprintf(queue_name, sizeof(queue_name), "%s-stats", dev_name(lan966x->dev)); lan966x->stats_queue = create_singlethread_workqueue(queue_name); + if (!lan966x->stats_queue) + return -ENOMEM; + INIT_DELAYED_WORK(&lan966x->stats_work, lan966x_check_stats_work); queue_delayed_work(lan966x->stats_queue, &lan966x->stats_work, LAN966X_STATS_CHECK_DELAY); diff -u linux-kvm-5.19.0/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c linux-kvm-5.19.0/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c --- linux-kvm-5.19.0/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +++ linux-kvm-5.19.0/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c @@ -1230,6 +1230,9 @@ u8 data; port = nfp_port_from_netdev(netdev); + if (!port) + return -EOPNOTSUPP; + /* update port state to get latest interface */ set_bit(NFP_PORT_CHANGED, &port->flags); eth_port = nfp_port_get_eth_port(port); @@ -1275,15 +1278,15 @@ if (data < 0x3) { modinfo->type = ETH_MODULE_SFF_8436; - modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN; + modinfo->eeprom_len = ETH_MODULE_SFF_8436_MAX_LEN; } else { modinfo->type = ETH_MODULE_SFF_8636; - modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN; + modinfo->eeprom_len = ETH_MODULE_SFF_8636_MAX_LEN; } break; case NFP_INTERFACE_QSFP28: modinfo->type = ETH_MODULE_SFF_8636; - modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN; + modinfo->eeprom_len = ETH_MODULE_SFF_8636_MAX_LEN; break; default: netdev_err(netdev, "Unsupported module 0x%x detected\n", diff -u linux-kvm-5.19.0/drivers/net/ethernet/pensando/ionic/ionic_main.c linux-kvm-5.19.0/drivers/net/ethernet/pensando/ionic/ionic_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/pensando/ionic/ionic_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/pensando/ionic/ionic_main.c @@ -687,8 +687,14 @@ static int __init ionic_init_module(void) { + int ret; + ionic_debugfs_create(); - return ionic_bus_register_driver(); + ret = ionic_bus_register_driver(); + if (ret) + ionic_debugfs_destroy(); + + return ret; } static void __exit ionic_cleanup_module(void) diff -u linux-kvm-5.19.0/drivers/net/ethernet/renesas/ravb_main.c linux-kvm-5.19.0/drivers/net/ethernet/renesas/ravb_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/renesas/ravb_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/renesas/ravb_main.c @@ -3013,6 +3013,7 @@ ret = ravb_open(ndev); if (ret < 0) return ret; + ravb_set_rx_mode(ndev); netif_device_attach(ndev); } diff -u linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c --- linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c +++ linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c @@ -600,7 +600,6 @@ { plat->rx_queues_to_use = 8; plat->tx_queues_to_use = 8; - plat->clk_ptp_rate = 200000000; plat->use_phy_wol = 1; plat->safety_feat_cfg->tsoee = 1; @@ -625,6 +624,8 @@ plat->serdes_powerup = intel_serdes_powerup; plat->serdes_powerdown = intel_serdes_powerdown; + plat->clk_ptp_rate = 204800000; + return ehl_common_data(pdev, plat); } @@ -638,6 +639,8 @@ plat->bus_id = 1; plat->phy_interface = PHY_INTERFACE_MODE_RGMII; + plat->clk_ptp_rate = 204800000; + return ehl_common_data(pdev, plat); } @@ -654,6 +657,8 @@ plat->bus_id = 2; plat->addr64 = 32; + plat->clk_ptp_rate = 200000000; + intel_mgbe_pse_crossts_adj(intel_priv, EHL_PSE_ART_MHZ); return ehl_common_data(pdev, plat); @@ -693,6 +698,8 @@ plat->bus_id = 3; plat->addr64 = 32; + plat->clk_ptp_rate = 200000000; + intel_mgbe_pse_crossts_adj(intel_priv, EHL_PSE_ART_MHZ); return ehl_common_data(pdev, plat); @@ -728,7 +735,7 @@ { plat->rx_queues_to_use = 6; plat->tx_queues_to_use = 4; - plat->clk_ptp_rate = 200000000; + plat->clk_ptp_rate = 204800000; plat->speed_mode_2500 = intel_speed_mode_2500; plat->safety_feat_cfg->tsoee = 1; diff -u linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c --- linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +++ linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c @@ -75,20 +75,24 @@ plat->mdio_bus_data = devm_kzalloc(&pdev->dev, sizeof(*plat->mdio_bus_data), GFP_KERNEL); - if (!plat->mdio_bus_data) - return -ENOMEM; + if (!plat->mdio_bus_data) { + ret = -ENOMEM; + goto err_put_node; + } plat->mdio_bus_data->needs_reset = true; } plat->dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*plat->dma_cfg), GFP_KERNEL); - if (!plat->dma_cfg) - return -ENOMEM; + if (!plat->dma_cfg) { + ret = -ENOMEM; + goto err_put_node; + } /* Enable pci device */ ret = pci_enable_device(pdev); if (ret) { dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n", __func__); - return ret; + goto err_put_node; } /* Get the base address of device */ @@ -97,7 +101,7 @@ continue; ret = pcim_iomap_regions(pdev, BIT(0), pci_name(pdev)); if (ret) - return ret; + goto err_disable_device; break; } @@ -108,7 +112,8 @@ phy_mode = device_get_phy_mode(&pdev->dev); if (phy_mode < 0) { dev_err(&pdev->dev, "phy_mode not found\n"); - return phy_mode; + ret = phy_mode; + goto err_disable_device; } plat->phy_interface = phy_mode; @@ -125,6 +130,7 @@ if (res.irq < 0) { dev_err(&pdev->dev, "IRQ macirq not found\n"); ret = -ENODEV; + goto err_disable_msi; } res.wol_irq = of_irq_get_byname(np, "eth_wake_irq"); @@ -137,15 +143,31 @@ if (res.lpi_irq < 0) { dev_err(&pdev->dev, "IRQ eth_lpi not found\n"); ret = -ENODEV; + goto err_disable_msi; } - return stmmac_dvr_probe(&pdev->dev, plat, &res); + ret = stmmac_dvr_probe(&pdev->dev, plat, &res); + if (ret) + goto err_disable_msi; + + return ret; + +err_disable_msi: + pci_disable_msi(pdev); +err_disable_device: + pci_disable_device(pdev); +err_put_node: + of_node_put(plat->mdio_node); + return ret; } static void loongson_dwmac_remove(struct pci_dev *pdev) { + struct net_device *ndev = dev_get_drvdata(&pdev->dev); + struct stmmac_priv *priv = netdev_priv(ndev); int i; + of_node_put(priv->plat->mdio_node); stmmac_dvr_remove(&pdev->dev); for (i = 0; i < PCI_STD_NUM_BARS; i++) { @@ -155,6 +177,7 @@ break; } + pci_disable_msi(pdev); pci_disable_device(pdev); } diff -u linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c --- linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -1058,8 +1058,16 @@ ctrl |= priv->hw->link.duplex; /* Flow Control operation */ - if (tx_pause && rx_pause) - stmmac_mac_flow_ctrl(priv, duplex); + if (rx_pause && tx_pause) + priv->flow_ctrl = FLOW_AUTO; + else if (rx_pause && !tx_pause) + priv->flow_ctrl = FLOW_RX; + else if (!rx_pause && tx_pause) + priv->flow_ctrl = FLOW_TX; + else + priv->flow_ctrl = FLOW_OFF; + + stmmac_mac_flow_ctrl(priv, duplex); if (ctrl != old_ctrl) writel(ctrl, priv->ioaddr + MAC_CTRL_REG); @@ -6429,6 +6437,9 @@ struct stmmac_priv *priv = netdev_priv(dev); u32 chan; + /* Ensure tx function is not running */ + netif_tx_disable(dev); + /* Disable NAPI process */ stmmac_disable_all_queues(priv); diff -u linux-kvm-5.19.0/drivers/net/ethernet/sunplus/spl2sw_driver.c linux-kvm-5.19.0/drivers/net/ethernet/sunplus/spl2sw_driver.c --- linux-kvm-5.19.0/drivers/net/ethernet/sunplus/spl2sw_driver.c +++ linux-kvm-5.19.0/drivers/net/ethernet/sunplus/spl2sw_driver.c @@ -286,7 +286,6 @@ if (ret) { dev_err(&pdev->dev, "Failed to register net device \"%s\"!\n", ndev->name); - free_netdev(ndev); *r_ndev = NULL; return ret; } diff -u linux-kvm-5.19.0/drivers/net/macsec.c linux-kvm-5.19.0/drivers/net/macsec.c --- linux-kvm-5.19.0/drivers/net/macsec.c +++ linux-kvm-5.19.0/drivers/net/macsec.c @@ -1388,7 +1388,8 @@ return NULL; } -static struct macsec_rx_sc *create_rx_sc(struct net_device *dev, sci_t sci) +static struct macsec_rx_sc *create_rx_sc(struct net_device *dev, sci_t sci, + bool active) { struct macsec_rx_sc *rx_sc; struct macsec_dev *macsec; @@ -1412,7 +1413,7 @@ } rx_sc->sci = sci; - rx_sc->active = true; + rx_sc->active = active; refcount_set(&rx_sc->refcnt, 1); secy = &macsec_priv(dev)->secy; @@ -1821,6 +1822,7 @@ secy->key_len); err = macsec_offload(ops->mdo_add_rxsa, &ctx); + memzero_explicit(ctx.sa.key, secy->key_len); if (err) goto cleanup; } @@ -1865,7 +1867,7 @@ struct macsec_rx_sc *rx_sc; struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1]; struct macsec_secy *secy; - bool was_active; + bool active = true; int ret; if (!attrs[MACSEC_ATTR_IFINDEX]) @@ -1887,16 +1889,15 @@ secy = &macsec_priv(dev)->secy; sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]); - rx_sc = create_rx_sc(dev, sci); + if (tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]) + active = nla_get_u8(tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]); + + rx_sc = create_rx_sc(dev, sci, active); if (IS_ERR(rx_sc)) { rtnl_unlock(); return PTR_ERR(rx_sc); } - was_active = rx_sc->active; - if (tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]) - rx_sc->active = !!nla_get_u8(tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]); - if (macsec_is_offloaded(netdev_priv(dev))) { const struct macsec_ops *ops; struct macsec_context ctx; @@ -1920,7 +1921,8 @@ return 0; cleanup: - rx_sc->active = was_active; + del_rx_sc(secy, sci); + free_rx_sc(rx_sc); rtnl_unlock(); return ret; } @@ -2063,6 +2065,7 @@ secy->key_len); err = macsec_offload(ops->mdo_add_txsa, &ctx); + memzero_explicit(ctx.sa.key, secy->key_len); if (err) goto cleanup; } @@ -2559,7 +2562,7 @@ struct macsec_tx_sc *tx_sc = &secy->tx_sc; int i; - if (secy->n_rx_sc > 0) + if (secy->rx_sc) return true; for (i = 0; i < MACSEC_NUM_AN; i++) @@ -2643,11 +2646,6 @@ if (ret) goto rollback; - /* Force features update, since they are different for SW MACSec and - * HW offloading cases. - */ - netdev_update_features(dev); - rtnl_unlock(); return 0; @@ -3415,16 +3413,9 @@ return ret; } -#define SW_MACSEC_FEATURES \ +#define MACSEC_FEATURES \ (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST) -/* If h/w offloading is enabled, use real device features save for - * VLAN_FEATURES - they require additional ops - * HW_MACSEC - no reason to report it - */ -#define REAL_DEV_FEATURES(dev) \ - ((dev)->features & ~(NETIF_F_VLAN_FEATURES | NETIF_F_HW_MACSEC)) - static int macsec_dev_init(struct net_device *dev) { struct macsec_dev *macsec = macsec_priv(dev); @@ -3441,12 +3432,8 @@ return err; } - if (macsec_is_offloaded(macsec)) { - dev->features = REAL_DEV_FEATURES(real_dev); - } else { - dev->features = real_dev->features & SW_MACSEC_FEATURES; - dev->features |= NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE; - } + dev->features = real_dev->features & MACSEC_FEATURES; + dev->features |= NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE; dev->needed_headroom = real_dev->needed_headroom + MACSEC_NEEDED_HEADROOM; @@ -3478,10 +3465,7 @@ struct macsec_dev *macsec = macsec_priv(dev); struct net_device *real_dev = macsec->real_dev; - if (macsec_is_offloaded(macsec)) - return REAL_DEV_FEATURES(real_dev); - - features &= (real_dev->features & SW_MACSEC_FEATURES) | + features &= (real_dev->features & MACSEC_FEATURES) | NETIF_F_GSO_SOFTWARE | NETIF_F_SOFT_FEATURES; features |= NETIF_F_LLTX; @@ -3831,7 +3815,6 @@ if (macsec_is_offloaded(macsec)) { const struct macsec_ops *ops; struct macsec_context ctx; - int ret; ops = macsec_get_ops(netdev_priv(dev), &ctx); if (!ops) { diff -u linux-kvm-5.19.0/drivers/net/netdevsim/dev.c linux-kvm-5.19.0/drivers/net/netdevsim/dev.c --- linux-kvm-5.19.0/drivers/net/netdevsim/dev.c +++ linux-kvm-5.19.0/drivers/net/netdevsim/dev.c @@ -1682,6 +1682,7 @@ ARRAY_SIZE(nsim_devlink_params)); devlink_resources_unregister(devlink); kfree(nsim_dev->vfconfigs); + kfree(nsim_dev->fa_cookie); devlink_free(devlink); dev_set_drvdata(&nsim_bus_dev->dev, NULL); } diff -u linux-kvm-5.19.0/drivers/net/phy/dp83867.c linux-kvm-5.19.0/drivers/net/phy/dp83867.c --- linux-kvm-5.19.0/drivers/net/phy/dp83867.c +++ linux-kvm-5.19.0/drivers/net/phy/dp83867.c @@ -639,6 +639,13 @@ */ dp83867->io_impedance = DP83867_IO_MUX_CFG_IO_IMPEDANCE_MIN / 2; + /* For non-OF device, the RX and TX FIFO depths are taken from + * default value. So, we init RX & TX FIFO depths here + * so that it is configured correctly later in dp83867_config_init(); + */ + dp83867->tx_fifo_depth = DP83867_PHYCR_FIFO_DEPTH_4_B_NIB; + dp83867->rx_fifo_depth = DP83867_PHYCR_FIFO_DEPTH_4_B_NIB; + return 0; } #endif /* CONFIG_OF_MDIO */ diff -u linux-kvm-5.19.0/drivers/net/phy/marvell.c linux-kvm-5.19.0/drivers/net/phy/marvell.c --- linux-kvm-5.19.0/drivers/net/phy/marvell.c +++ linux-kvm-5.19.0/drivers/net/phy/marvell.c @@ -2035,14 +2035,16 @@ if (err < 0) return err; - /* FIXME: Based on trial and error test, it seem 1G need to have - * delay between soft reset and loopback enablement. - */ - if (phydev->speed == SPEED_1000) - msleep(1000); + err = phy_modify(phydev, MII_BMCR, BMCR_LOOPBACK, + BMCR_LOOPBACK); - return phy_modify(phydev, MII_BMCR, BMCR_LOOPBACK, - BMCR_LOOPBACK); + if (!err) { + /* It takes some time for PHY device to switch + * into/out-of loopback mode. + */ + msleep(1000); + } + return err; } else { err = phy_modify(phydev, MII_BMCR, BMCR_LOOPBACK, 0); if (err < 0) diff -u linux-kvm-5.19.0/drivers/net/phy/phy_device.c linux-kvm-5.19.0/drivers/net/phy/phy_device.c --- linux-kvm-5.19.0/drivers/net/phy/phy_device.c +++ linux-kvm-5.19.0/drivers/net/phy/phy_device.c @@ -216,6 +216,7 @@ static void phy_device_release(struct device *dev) { + fwnode_handle_put(dev->fwnode); kfree(to_phy_device(dev)); } @@ -1518,6 +1519,7 @@ error_module_put: module_put(d->driver->owner); + d->driver = NULL; error_put_device: put_device(d); if (ndev_owner != bus->owner) diff -u linux-kvm-5.19.0/drivers/net/thunderbolt.c linux-kvm-5.19.0/drivers/net/thunderbolt.c --- linux-kvm-5.19.0/drivers/net/thunderbolt.c +++ linux-kvm-5.19.0/drivers/net/thunderbolt.c @@ -1379,12 +1379,21 @@ TBNET_MATCH_FRAGS_ID | TBNET_64K_FRAMES); ret = tb_register_property_dir("network", tbnet_dir); - if (ret) { - tb_property_free_dir(tbnet_dir); - return ret; - } + if (ret) + goto err_free_dir; - return tb_register_service_driver(&tbnet_driver); + ret = tb_register_service_driver(&tbnet_driver); + if (ret) + goto err_unregister; + + return 0; + +err_unregister: + tb_unregister_property_dir("network", tbnet_dir); +err_free_dir: + tb_property_free_dir(tbnet_dir); + + return ret; } module_init(tbnet_init); diff -u linux-kvm-5.19.0/drivers/net/tun.c linux-kvm-5.19.0/drivers/net/tun.c --- linux-kvm-5.19.0/drivers/net/tun.c +++ linux-kvm-5.19.0/drivers/net/tun.c @@ -686,7 +686,6 @@ if (tun) xdp_rxq_info_unreg(&tfile->xdp_rxq); ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free); - sock_put(&tfile->sk); } } @@ -702,6 +701,9 @@ if (dev) netdev_state_change(dev); rtnl_unlock(); + + if (clean) + sock_put(&tfile->sk); } static void tun_detach_all(struct net_device *dev) @@ -1967,17 +1969,25 @@ skb_headlen(skb)); if (unlikely(headlen > skb_headlen(skb))) { + WARN_ON_ONCE(1); + err = -ENOMEM; dev_core_stats_rx_dropped_inc(tun->dev); +napi_busy: napi_free_frags(&tfile->napi); rcu_read_unlock(); mutex_unlock(&tfile->napi_mutex); - WARN_ON(1); - return -ENOMEM; + return err; } - local_bh_disable(); - napi_gro_frags(&tfile->napi); - local_bh_enable(); + if (likely(napi_schedule_prep(&tfile->napi))) { + local_bh_disable(); + napi_gro_frags(&tfile->napi); + napi_complete(&tfile->napi); + local_bh_enable(); + } else { + err = -EBUSY; + goto napi_busy; + } mutex_unlock(&tfile->napi_mutex); } else if (tfile->napi_enabled) { struct sk_buff_head *queue = &tfile->sk.sk_write_queue; diff -u linux-kvm-5.19.0/drivers/net/usb/qmi_wwan.c linux-kvm-5.19.0/drivers/net/usb/qmi_wwan.c --- linux-kvm-5.19.0/drivers/net/usb/qmi_wwan.c +++ linux-kvm-5.19.0/drivers/net/usb/qmi_wwan.c @@ -1356,6 +1356,7 @@ {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1057, 2)}, /* Telit FN980 */ diff -u linux-kvm-5.19.0/drivers/net/usb/smsc95xx.c linux-kvm-5.19.0/drivers/net/usb/smsc95xx.c --- linux-kvm-5.19.0/drivers/net/usb/smsc95xx.c +++ linux-kvm-5.19.0/drivers/net/usb/smsc95xx.c @@ -66,6 +66,7 @@ spinlock_t mac_cr_lock; u8 features; u8 suspend_flags; + bool is_internal_phy; struct irq_chip irqchip; struct irq_domain *irqdomain; struct fwnode_handle *irqfwnode; @@ -296,6 +297,43 @@ __smsc95xx_mdio_write(dev, pdata->phydev->mdio.addr, idx, regval, 1); } +static int smsc95xx_mdiobus_reset(struct mii_bus *bus) +{ + struct smsc95xx_priv *pdata; + struct usbnet *dev; + u32 val; + int ret; + + dev = bus->priv; + pdata = dev->driver_priv; + + if (pdata->is_internal_phy) + return 0; + + mutex_lock(&dev->phy_mutex); + + ret = smsc95xx_read_reg(dev, PM_CTRL, &val); + if (ret < 0) + goto reset_out; + + val |= PM_CTL_PHY_RST_; + + ret = smsc95xx_write_reg(dev, PM_CTRL, val); + if (ret < 0) + goto reset_out; + + /* Driver has no knowledge at this point about the external PHY. + * The 802.3 specifies that the reset process shall + * be completed within 0.5 s. + */ + fsleep(500000); + +reset_out: + mutex_unlock(&dev->phy_mutex); + + return 0; +} + static int smsc95xx_mdiobus_read(struct mii_bus *bus, int phy_id, int idx) { struct usbnet *dev = bus->priv; @@ -1096,7 +1134,6 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) { struct smsc95xx_priv *pdata; - bool is_internal_phy; char usb_path[64]; int ret, phy_irq; u32 val; @@ -1177,13 +1214,14 @@ if (ret < 0) goto free_mdio; - is_internal_phy = !(val & HW_CFG_PSEL_); - if (is_internal_phy) + pdata->is_internal_phy = !(val & HW_CFG_PSEL_); + if (pdata->is_internal_phy) pdata->mdiobus->phy_mask = ~(1u << SMSC95XX_INTERNAL_PHY_ID); pdata->mdiobus->priv = dev; pdata->mdiobus->read = smsc95xx_mdiobus_read; pdata->mdiobus->write = smsc95xx_mdiobus_write; + pdata->mdiobus->reset = smsc95xx_mdiobus_reset; pdata->mdiobus->name = "smsc95xx-mdiobus"; pdata->mdiobus->parent = &dev->udev->dev; @@ -1204,7 +1242,7 @@ } pdata->phydev->irq = phy_irq; - pdata->phydev->is_internal = is_internal_phy; + pdata->phydev->is_internal = pdata->is_internal_phy; /* detect device revision as different features may be available */ ret = smsc95xx_read_reg(dev, ID_REV, &val); diff -u linux-kvm-5.19.0/drivers/net/virtio_net.c linux-kvm-5.19.0/drivers/net/virtio_net.c --- linux-kvm-5.19.0/drivers/net/virtio_net.c +++ linux-kvm-5.19.0/drivers/net/virtio_net.c @@ -3720,12 +3720,11 @@ return 0; free_unregister_netdev: - virtio_reset_device(vdev); - unregister_netdev(dev); free_failover: net_failover_destroy(vi->failover); free_vqs: + virtio_reset_device(vdev); cancel_delayed_work_sync(&vi->refill); free_receive_page_frags(vi); virtnet_del_vqs(vi); diff -u linux-kvm-5.19.0/drivers/net/wireless/ath/ath11k/qmi.h linux-kvm-5.19.0/drivers/net/wireless/ath/ath11k/qmi.h --- linux-kvm-5.19.0/drivers/net/wireless/ath/ath11k/qmi.h +++ linux-kvm-5.19.0/drivers/net/wireless/ath/ath11k/qmi.h @@ -27,7 +27,7 @@ #define ATH11K_QMI_WLANFW_MAX_NUM_MEM_SEG_V01 52 #define ATH11K_QMI_CALDB_SIZE 0x480000 #define ATH11K_QMI_BDF_EXT_STR_LENGTH 0x20 -#define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT 3 +#define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT 5 #define QMI_WLFW_REQUEST_MEM_IND_V01 0x0035 #define QMI_WLFW_FW_MEM_READY_IND_V01 0x0037 diff -u linux-kvm-5.19.0/drivers/net/wireless/mac80211_hwsim.c linux-kvm-5.19.0/drivers/net/wireless/mac80211_hwsim.c --- linux-kvm-5.19.0/drivers/net/wireless/mac80211_hwsim.c +++ linux-kvm-5.19.0/drivers/net/wireless/mac80211_hwsim.c @@ -899,6 +899,7 @@ struct hwsim_vif_priv *vp = (void *)vif->drv_priv; struct sk_buff *skb; struct ieee80211_hdr *hdr; + struct ieee80211_tx_info *cb; if (!vp->assoc) return; @@ -920,6 +921,10 @@ memcpy(hdr->addr2, mac, ETH_ALEN); memcpy(hdr->addr3, vp->bssid, ETH_ALEN); + cb = IEEE80211_SKB_CB(skb); + cb->control.rates[0].count = 1; + cb->control.rates[1].idx = -1; + rcu_read_lock(); mac80211_hwsim_tx_frame(data->hw, skb, rcu_dereference(vif->bss_conf.chanctx_conf)->def.chan); diff -u linux-kvm-5.19.0/drivers/net/wireless/microchip/wilc1000/cfg80211.c linux-kvm-5.19.0/drivers/net/wireless/microchip/wilc1000/cfg80211.c --- linux-kvm-5.19.0/drivers/net/wireless/microchip/wilc1000/cfg80211.c +++ linux-kvm-5.19.0/drivers/net/wireless/microchip/wilc1000/cfg80211.c @@ -943,30 +943,52 @@ return; while (index + sizeof(*e) <= len) { + u16 attr_size; + e = (struct wilc_attr_entry *)&buf[index]; - if (e->attr_type == IEEE80211_P2P_ATTR_CHANNEL_LIST) + attr_size = le16_to_cpu(e->attr_len); + + if (index + sizeof(*e) + attr_size > len) + return; + + if (e->attr_type == IEEE80211_P2P_ATTR_CHANNEL_LIST && + attr_size >= (sizeof(struct wilc_attr_ch_list) - sizeof(*e))) ch_list_idx = index; - else if (e->attr_type == IEEE80211_P2P_ATTR_OPER_CHANNEL) + else if (e->attr_type == IEEE80211_P2P_ATTR_OPER_CHANNEL && + attr_size == (sizeof(struct wilc_attr_oper_ch) - sizeof(*e))) op_ch_idx = index; + if (ch_list_idx && op_ch_idx) break; - index += le16_to_cpu(e->attr_len) + sizeof(*e); + + index += sizeof(*e) + attr_size; } if (ch_list_idx) { - u16 attr_size; - struct wilc_ch_list_elem *e; - int i; + unsigned int i; + u16 elem_size; ch_list = (struct wilc_attr_ch_list *)&buf[ch_list_idx]; - attr_size = le16_to_cpu(ch_list->attr_len); - for (i = 0; i < attr_size;) { + /* the number of bytes following the final 'elem' member */ + elem_size = le16_to_cpu(ch_list->attr_len) - + (sizeof(*ch_list) - sizeof(struct wilc_attr_entry)); + for (i = 0; i < elem_size;) { + struct wilc_ch_list_elem *e; + e = (struct wilc_ch_list_elem *)(ch_list->elem + i); + + i += sizeof(*e); + if (i > elem_size) + break; + + i += e->no_of_channels; + if (i > elem_size) + break; + if (e->op_class == WILC_WLAN_OPERATING_CLASS_2_4GHZ) { memset(e->ch_list, sta_ch, e->no_of_channels); break; } - i += e->no_of_channels; } } diff -u linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_pcie.c linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_pcie.c --- linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_pcie.c +++ linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_pcie.c @@ -232,6 +232,7 @@ */ static enum ipc_pcie_sleep_state ipc_pcie_read_bios_cfg(struct device *dev) { + enum ipc_pcie_sleep_state sleep_state = IPC_PCIE_D0L12; union acpi_object *object; acpi_handle handle_acpi; @@ -242,12 +243,16 @@ } object = acpi_evaluate_dsm(handle_acpi, &wwan_acpi_guid, 0, 3, NULL); + if (!object) + goto default_ret; - if (object && object->integer.value == 3) - return IPC_PCIE_D3L2; + if (object->integer.value == 3) + sleep_state = IPC_PCIE_D3L2; + + ACPI_FREE(object); default_ret: - return IPC_PCIE_D0L12; + return sleep_state; } static int ipc_pcie_probe(struct pci_dev *pci, diff -u linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_wwan.c linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_wwan.c --- linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_wwan.c +++ linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_wwan.c @@ -168,6 +168,7 @@ iosm_dev->max_mtu = ETH_MAX_MTU; iosm_dev->flags = IFF_POINTOPOINT | IFF_NOARP; + iosm_dev->needs_free_netdev = true; iosm_dev->netdev_ops = &ipc_inm_ops; } diff -u linux-kvm-5.19.0/drivers/net/wwan/t7xx/t7xx_modem_ops.c linux-kvm-5.19.0/drivers/net/wwan/t7xx/t7xx_modem_ops.c --- linux-kvm-5.19.0/drivers/net/wwan/t7xx/t7xx_modem_ops.c +++ linux-kvm-5.19.0/drivers/net/wwan/t7xx/t7xx_modem_ops.c @@ -166,6 +166,8 @@ return -EFAULT; } + kfree(buffer.pointer); + #endif return 0; } diff -u linux-kvm-5.19.0/drivers/net/xen-netback/netback.c linux-kvm-5.19.0/drivers/net/xen-netback/netback.c --- linux-kvm-5.19.0/drivers/net/xen-netback/netback.c +++ linux-kvm-5.19.0/drivers/net/xen-netback/netback.c @@ -528,7 +528,7 @@ const bool sharedslot = nr_frags && frag_get_pending_idx(&shinfo->frags[0]) == copy_pending_idx(skb, copy_count(skb) - 1); - int i, err; + int i, err = 0; for (i = 0; i < copy_count(skb); i++) { int newerr; diff -u linux-kvm-5.19.0/drivers/nvme/host/core.c linux-kvm-5.19.0/drivers/nvme/host/core.c --- linux-kvm-5.19.0/drivers/nvme/host/core.c +++ linux-kvm-5.19.0/drivers/nvme/host/core.c @@ -651,6 +651,7 @@ if (req->mq_hctx->type == HCTX_TYPE_POLL) req->cmd_flags |= REQ_POLLED; nvme_clear_nvme_request(req); + req->rq_flags |= RQF_QUIET; memcpy(nvme_req(req)->cmd, cmd, sizeof(*cmd)); } EXPORT_SYMBOL_GPL(nvme_init_request); @@ -1015,7 +1016,6 @@ goto out; } - req->rq_flags |= RQF_QUIET; ret = nvme_execute_rq(req, at_head); if (result && ret >= 0) *result = nvme_req(req)->result; @@ -1203,7 +1203,6 @@ rq->timeout = ctrl->kato * HZ; rq->end_io = nvme_keep_alive_end_io; rq->end_io_data = ctrl; - rq->rq_flags |= RQF_QUIET; blk_execute_rq_nowait(rq, false); } @@ -4100,7 +4099,7 @@ mutex_unlock(&ns->ctrl->subsys->lock); /* guarantee not available in head->list */ - synchronize_rcu(); + synchronize_srcu(&ns->head->srcu); if (!nvme_ns_head_multipath(ns->head)) nvme_cdev_del(&ns->cdev, &ns->cdev_device); diff -u linux-kvm-5.19.0/drivers/nvme/host/ioctl.c linux-kvm-5.19.0/drivers/nvme/host/ioctl.c --- linux-kvm-5.19.0/drivers/nvme/host/ioctl.c +++ linux-kvm-5.19.0/drivers/nvme/host/ioctl.c @@ -764,11 +764,17 @@ case NVME_IOCTL_IO_CMD: return nvme_dev_user_cmd(ctrl, argp); case NVME_IOCTL_RESET: + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; dev_warn(ctrl->device, "resetting controller\n"); return nvme_reset_ctrl_sync(ctrl); case NVME_IOCTL_SUBSYS_RESET: + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; return nvme_reset_subsystem(ctrl); case NVME_IOCTL_RESCAN: + if (!capable(CAP_SYS_ADMIN)) + return -EACCES; nvme_queue_scan(ctrl); return 0; default: diff -u linux-kvm-5.19.0/drivers/nvme/host/multipath.c linux-kvm-5.19.0/drivers/nvme/host/multipath.c --- linux-kvm-5.19.0/drivers/nvme/host/multipath.c +++ linux-kvm-5.19.0/drivers/nvme/host/multipath.c @@ -174,11 +174,14 @@ struct nvme_ns_head *head = ns->head; sector_t capacity = get_capacity(head->disk); int node; + int srcu_idx; + srcu_idx = srcu_read_lock(&head->srcu); list_for_each_entry_rcu(ns, &head->list, siblings) { if (capacity != get_capacity(ns->disk)) clear_bit(NVME_NS_READY, &ns->flags); } + srcu_read_unlock(&head->srcu, srcu_idx); for_each_node(node) rcu_assign_pointer(head->current_path[node], NULL); diff -u linux-kvm-5.19.0/drivers/nvme/host/nvme.h linux-kvm-5.19.0/drivers/nvme/host/nvme.h --- linux-kvm-5.19.0/drivers/nvme/host/nvme.h +++ linux-kvm-5.19.0/drivers/nvme/host/nvme.h @@ -593,11 +593,23 @@ static inline void nvme_should_fail(struct request *req) {} #endif +bool nvme_wait_reset(struct nvme_ctrl *ctrl); +int nvme_try_sched_reset(struct nvme_ctrl *ctrl); + static inline int nvme_reset_subsystem(struct nvme_ctrl *ctrl) { + int ret; + if (!ctrl->subsystem) return -ENOTTY; - return ctrl->ops->reg_write32(ctrl, NVME_REG_NSSR, 0x4E564D65); + if (!nvme_wait_reset(ctrl)) + return -EBUSY; + + ret = ctrl->ops->reg_write32(ctrl, NVME_REG_NSSR, 0x4E564D65); + if (ret) + return ret; + + return nvme_try_sched_reset(ctrl); } /* @@ -703,7 +715,6 @@ void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl); bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl, enum nvme_ctrl_state new_state); -bool nvme_wait_reset(struct nvme_ctrl *ctrl); int nvme_disable_ctrl(struct nvme_ctrl *ctrl); int nvme_enable_ctrl(struct nvme_ctrl *ctrl); int nvme_shutdown_ctrl(struct nvme_ctrl *ctrl); @@ -793,7 +804,6 @@ void nvme_stop_keep_alive(struct nvme_ctrl *ctrl); int nvme_reset_ctrl(struct nvme_ctrl *ctrl); int nvme_reset_ctrl_sync(struct nvme_ctrl *ctrl); -int nvme_try_sched_reset(struct nvme_ctrl *ctrl); int nvme_delete_ctrl(struct nvme_ctrl *ctrl); void nvme_queue_scan(struct nvme_ctrl *ctrl); int nvme_get_log(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page, u8 lsp, u8 csi, diff -u linux-kvm-5.19.0/drivers/nvme/host/pci.c linux-kvm-5.19.0/drivers/nvme/host/pci.c --- linux-kvm-5.19.0/drivers/nvme/host/pci.c +++ linux-kvm-5.19.0/drivers/nvme/host/pci.c @@ -1448,7 +1448,6 @@ abort_req->end_io = abort_endio; abort_req->end_io_data = NULL; - abort_req->rq_flags |= RQF_QUIET; blk_execute_rq_nowait(abort_req, false); /* @@ -2501,7 +2500,6 @@ req->end_io_data = nvmeq; init_completion(&nvmeq->delete_done); - req->rq_flags |= RQF_QUIET; blk_execute_rq_nowait(req, false); return 0; } @@ -3486,6 +3484,8 @@ NVME_QUIRK_IGNORE_DEV_SUBNQN, }, { PCI_DEVICE(0x1344, 0x5407), /* Micron Technology Inc NVMe SSD */ .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN }, + { PCI_DEVICE(0x1344, 0x6001), /* Micron Nitro NVMe */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1c5c, 0x1504), /* SK Hynix PC400 */ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, { PCI_DEVICE(0x1c5c, 0x174a), /* SK Hynix P31 SSD */ @@ -3516,6 +3516,8 @@ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, { PCI_DEVICE(0x2646, 0x501E), /* KINGSTON OM3PGP4xxxxQ OS21011 NVMe SSD */ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, + { PCI_DEVICE(0x1f40, 0x5236), /* Netac Technologies Co. NV7000 NVMe SSD */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1e4B, 0x1001), /* MAXIO MAP1001 */ .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1e4B, 0x1002), /* MAXIO MAP1002 */ diff -u linux-kvm-5.19.0/drivers/phy/st/phy-stm32-usbphyc.c linux-kvm-5.19.0/drivers/phy/st/phy-stm32-usbphyc.c --- linux-kvm-5.19.0/drivers/phy/st/phy-stm32-usbphyc.c +++ linux-kvm-5.19.0/drivers/phy/st/phy-stm32-usbphyc.c @@ -710,6 +710,8 @@ ret = of_property_read_u32(child, "reg", &index); if (ret || index > usbphyc->nphys) { dev_err(&phy->dev, "invalid reg property: %d\n", ret); + if (!ret) + ret = -EINVAL; goto put_child; } diff -u linux-kvm-5.19.0/drivers/pinctrl/intel/pinctrl-intel.c linux-kvm-5.19.0/drivers/pinctrl/intel/pinctrl-intel.c --- linux-kvm-5.19.0/drivers/pinctrl/intel/pinctrl-intel.c +++ linux-kvm-5.19.0/drivers/pinctrl/intel/pinctrl-intel.c @@ -436,9 +436,14 @@ writel(value, padcfg0); } +static int __intel_gpio_get_gpio_mode(u32 value) +{ + return (value & PADCFG0_PMODE_MASK) >> PADCFG0_PMODE_SHIFT; +} + static int intel_gpio_get_gpio_mode(void __iomem *padcfg0) { - return (readl(padcfg0) & PADCFG0_PMODE_MASK) >> PADCFG0_PMODE_SHIFT; + return __intel_gpio_get_gpio_mode(readl(padcfg0)); } static void intel_gpio_set_gpio_mode(void __iomem *padcfg0) @@ -1674,6 +1679,7 @@ static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned int pin) { const struct pin_desc *pd = pin_desc_get(pctrl->pctldev, pin); + u32 value; if (!pd || !intel_pad_usable(pctrl, pin)) return false; @@ -1688,6 +1694,25 @@ gpiochip_line_is_irq(&pctrl->chip, intel_pin_to_gpio(pctrl, pin))) return true; + /* + * The firmware on some systems may configure GPIO pins to be + * an interrupt source in so called "direct IRQ" mode. In such + * cases the GPIO controller driver has no idea if those pins + * are being used or not. At the same time, there is a known bug + * in the firmwares that don't restore the pin settings correctly + * after suspend, i.e. by an unknown reason the Rx value becomes + * inverted. + * + * Hence, let's save and restore the pins that are configured + * as GPIOs in the input mode with GPIROUTIOXAPIC bit set. + * + * See https://bugzilla.kernel.org/show_bug.cgi?id=214749. + */ + value = readl(intel_get_padcfg(pctrl, pin, PADCFG0)); + if ((value & PADCFG0_GPIROUTIOXAPIC) && (value & PADCFG0_GPIOTXDIS) && + (__intel_gpio_get_gpio_mode(value) == PADCFG0_PMODE_GPIO)) + return true; + return false; } diff -u linux-kvm-5.19.0/drivers/pinctrl/pinctrl-rockchip.c linux-kvm-5.19.0/drivers/pinctrl/pinctrl-rockchip.c --- linux-kvm-5.19.0/drivers/pinctrl/pinctrl-rockchip.c +++ linux-kvm-5.19.0/drivers/pinctrl/pinctrl-rockchip.c @@ -632,14 +632,54 @@ } static struct rockchip_mux_route_data px30_mux_route_data[] = { + RK_MUXROUTE_SAME(2, RK_PB4, 1, 0x184, BIT(16 + 7)), /* cif-d0m0 */ + RK_MUXROUTE_SAME(3, RK_PA1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d0m1 */ + RK_MUXROUTE_SAME(2, RK_PB6, 1, 0x184, BIT(16 + 7)), /* cif-d1m0 */ + RK_MUXROUTE_SAME(3, RK_PA2, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d1m1 */ RK_MUXROUTE_SAME(2, RK_PA0, 1, 0x184, BIT(16 + 7)), /* cif-d2m0 */ RK_MUXROUTE_SAME(3, RK_PA3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d2m1 */ + RK_MUXROUTE_SAME(2, RK_PA1, 1, 0x184, BIT(16 + 7)), /* cif-d3m0 */ + RK_MUXROUTE_SAME(3, RK_PA5, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d3m1 */ + RK_MUXROUTE_SAME(2, RK_PA2, 1, 0x184, BIT(16 + 7)), /* cif-d4m0 */ + RK_MUXROUTE_SAME(3, RK_PA7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d4m1 */ + RK_MUXROUTE_SAME(2, RK_PA3, 1, 0x184, BIT(16 + 7)), /* cif-d5m0 */ + RK_MUXROUTE_SAME(3, RK_PB0, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d5m1 */ + RK_MUXROUTE_SAME(2, RK_PA4, 1, 0x184, BIT(16 + 7)), /* cif-d6m0 */ + RK_MUXROUTE_SAME(3, RK_PB1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d6m1 */ + RK_MUXROUTE_SAME(2, RK_PA5, 1, 0x184, BIT(16 + 7)), /* cif-d7m0 */ + RK_MUXROUTE_SAME(3, RK_PB4, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d7m1 */ + RK_MUXROUTE_SAME(2, RK_PA6, 1, 0x184, BIT(16 + 7)), /* cif-d8m0 */ + RK_MUXROUTE_SAME(3, RK_PB6, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d8m1 */ + RK_MUXROUTE_SAME(2, RK_PA7, 1, 0x184, BIT(16 + 7)), /* cif-d9m0 */ + RK_MUXROUTE_SAME(3, RK_PB7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d9m1 */ + RK_MUXROUTE_SAME(2, RK_PB7, 1, 0x184, BIT(16 + 7)), /* cif-d10m0 */ + RK_MUXROUTE_SAME(3, RK_PC6, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d10m1 */ + RK_MUXROUTE_SAME(2, RK_PC0, 1, 0x184, BIT(16 + 7)), /* cif-d11m0 */ + RK_MUXROUTE_SAME(3, RK_PC7, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-d11m1 */ + RK_MUXROUTE_SAME(2, RK_PB0, 1, 0x184, BIT(16 + 7)), /* cif-vsyncm0 */ + RK_MUXROUTE_SAME(3, RK_PD1, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-vsyncm1 */ + RK_MUXROUTE_SAME(2, RK_PB1, 1, 0x184, BIT(16 + 7)), /* cif-hrefm0 */ + RK_MUXROUTE_SAME(3, RK_PD2, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-hrefm1 */ + RK_MUXROUTE_SAME(2, RK_PB2, 1, 0x184, BIT(16 + 7)), /* cif-clkinm0 */ + RK_MUXROUTE_SAME(3, RK_PD3, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-clkinm1 */ + RK_MUXROUTE_SAME(2, RK_PB3, 1, 0x184, BIT(16 + 7)), /* cif-clkoutm0 */ + RK_MUXROUTE_SAME(3, RK_PD0, 3, 0x184, BIT(16 + 7) | BIT(7)), /* cif-clkoutm1 */ RK_MUXROUTE_SAME(3, RK_PC6, 2, 0x184, BIT(16 + 8)), /* pdm-m0 */ RK_MUXROUTE_SAME(2, RK_PC6, 1, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-m1 */ + RK_MUXROUTE_SAME(3, RK_PD3, 2, 0x184, BIT(16 + 8)), /* pdm-sdi0m0 */ + RK_MUXROUTE_SAME(2, RK_PC5, 2, 0x184, BIT(16 + 8) | BIT(8)), /* pdm-sdi0m1 */ RK_MUXROUTE_SAME(1, RK_PD3, 2, 0x184, BIT(16 + 10)), /* uart2-rxm0 */ RK_MUXROUTE_SAME(2, RK_PB6, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-rxm1 */ + RK_MUXROUTE_SAME(1, RK_PD2, 2, 0x184, BIT(16 + 10)), /* uart2-txm0 */ + RK_MUXROUTE_SAME(2, RK_PB4, 2, 0x184, BIT(16 + 10) | BIT(10)), /* uart2-txm1 */ RK_MUXROUTE_SAME(0, RK_PC1, 2, 0x184, BIT(16 + 9)), /* uart3-rxm0 */ RK_MUXROUTE_SAME(1, RK_PB7, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rxm1 */ + RK_MUXROUTE_SAME(0, RK_PC0, 2, 0x184, BIT(16 + 9)), /* uart3-txm0 */ + RK_MUXROUTE_SAME(1, RK_PB6, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-txm1 */ + RK_MUXROUTE_SAME(0, RK_PC2, 2, 0x184, BIT(16 + 9)), /* uart3-ctsm0 */ + RK_MUXROUTE_SAME(1, RK_PB4, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-ctsm1 */ + RK_MUXROUTE_SAME(0, RK_PC3, 2, 0x184, BIT(16 + 9)), /* uart3-rtsm0 */ + RK_MUXROUTE_SAME(1, RK_PB5, 2, 0x184, BIT(16 + 9) | BIT(9)), /* uart3-rtsm1 */ }; static struct rockchip_mux_route_data rk3128_mux_route_data[] = { diff -u linux-kvm-5.19.0/drivers/platform/x86/acer-wmi.c linux-kvm-5.19.0/drivers/platform/x86/acer-wmi.c --- linux-kvm-5.19.0/drivers/platform/x86/acer-wmi.c +++ linux-kvm-5.19.0/drivers/platform/x86/acer-wmi.c @@ -568,2 +568,11 @@ .callback = set_force_caps, + .ident = "Acer Aspire Switch V 10 SW5-017", + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SW5-017"), + }, + .driver_data = (void *)ACER_CAP_KBD_DOCK, + }, + { + .callback = set_force_caps, .ident = "Acer One 10 (S1003)", diff -u linux-kvm-5.19.0/drivers/platform/x86/asus-wmi.c linux-kvm-5.19.0/drivers/platform/x86/asus-wmi.c --- linux-kvm-5.19.0/drivers/platform/x86/asus-wmi.c +++ linux-kvm-5.19.0/drivers/platform/x86/asus-wmi.c @@ -1631,6 +1631,8 @@ pci_write_config_dword(xhci_pdev, USB_INTEL_XUSB2PR, cpu_to_le32(ports_available)); + pci_dev_put(xhci_pdev); + pr_info("set USB_INTEL_XUSB2PR old: 0x%04x, new: 0x%04x\n", orig_ports_available, ports_available); } diff -u linux-kvm-5.19.0/drivers/platform/x86/hp-wmi.c linux-kvm-5.19.0/drivers/platform/x86/hp-wmi.c --- linux-kvm-5.19.0/drivers/platform/x86/hp-wmi.c +++ linux-kvm-5.19.0/drivers/platform/x86/hp-wmi.c @@ -90,6 +90,7 @@ HPWMI_PEAKSHIFT_PERIOD = 0x0F, HPWMI_BATTERY_CHARGE_PERIOD = 0x10, HPWMI_SANITIZATION_MODE = 0x17, + HPWMI_SMART_EXPERIENCE_APP = 0x21, }; /* @@ -857,6 +858,8 @@ break; case HPWMI_SANITIZATION_MODE: break; + case HPWMI_SMART_EXPERIENCE_APP: + break; default: pr_info("Unknown event_id - %d - 0x%x\n", event_id, event_data); break; diff -u linux-kvm-5.19.0/drivers/powercap/intel_rapl_common.c linux-kvm-5.19.0/drivers/powercap/intel_rapl_common.c --- linux-kvm-5.19.0/drivers/powercap/intel_rapl_common.c +++ linux-kvm-5.19.0/drivers/powercap/intel_rapl_common.c @@ -1111,6 +1111,8 @@ X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, &rapl_defaults_core), X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N, &rapl_defaults_core), X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &rapl_defaults_core), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &rapl_defaults_core), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &rapl_defaults_core), X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &rapl_defaults_spr_server), X86_MATCH_INTEL_FAM6_MODEL(LAKEFIELD, &rapl_defaults_core), diff -u linux-kvm-5.19.0/drivers/regulator/core.c linux-kvm-5.19.0/drivers/regulator/core.c --- linux-kvm-5.19.0/drivers/regulator/core.c +++ linux-kvm-5.19.0/drivers/regulator/core.c @@ -5133,6 +5133,7 @@ { struct regulator_dev *rdev = dev_get_drvdata(dev); + debugfs_remove_recursive(rdev->debugfs); kfree(rdev->constraints); of_node_put(rdev->dev.of_node); kfree(rdev); @@ -5611,11 +5612,15 @@ mutex_lock(®ulator_list_mutex); regulator_ena_gpio_free(rdev); mutex_unlock(®ulator_list_mutex); + put_device(&rdev->dev); + rdev = NULL; clean: if (dangling_of_gpiod) gpiod_put(config->ena_gpiod); + if (rdev && rdev->dev.of_node) + of_node_put(rdev->dev.of_node); + kfree(rdev); kfree(config); - put_device(&rdev->dev); rinse: if (dangling_cfg_gpiod) gpiod_put(cfg->ena_gpiod); @@ -5644,7 +5649,6 @@ mutex_lock(®ulator_list_mutex); - debugfs_remove_recursive(rdev->debugfs); WARN_ON(rdev->open_count); regulator_remove_coupling(rdev); unset_regulator_supplies(rdev); diff -u linux-kvm-5.19.0/drivers/s390/crypto/ap_bus.c linux-kvm-5.19.0/drivers/s390/crypto/ap_bus.c --- linux-kvm-5.19.0/drivers/s390/crypto/ap_bus.c +++ linux-kvm-5.19.0/drivers/s390/crypto/ap_bus.c @@ -233,8 +233,11 @@ if (!ap_qci_info) return; ap_qci_info_old = kzalloc(sizeof(*ap_qci_info_old), GFP_KERNEL); - if (!ap_qci_info_old) + if (!ap_qci_info_old) { + kfree(ap_qci_info); + ap_qci_info = NULL; return; + } if (ap_fetch_qci_info(ap_qci_info) != 0) { kfree(ap_qci_info); kfree(ap_qci_info_old); diff -u linux-kvm-5.19.0/drivers/s390/scsi/zfcp_fsf.c linux-kvm-5.19.0/drivers/s390/scsi/zfcp_fsf.c --- linux-kvm-5.19.0/drivers/s390/scsi/zfcp_fsf.c +++ linux-kvm-5.19.0/drivers/s390/scsi/zfcp_fsf.c @@ -884,7 +884,7 @@ const bool is_srb = zfcp_fsf_req_is_status_read_buffer(req); struct zfcp_adapter *adapter = req->adapter; struct zfcp_qdio *qdio = adapter->qdio; - int req_id = req->req_id; + unsigned long req_id = req->req_id; zfcp_reqlist_add(adapter->req_list, req); diff -u linux-kvm-5.19.0/drivers/scsi/scsi_transport_iscsi.c linux-kvm-5.19.0/drivers/scsi/scsi_transport_iscsi.c --- linux-kvm-5.19.0/drivers/scsi/scsi_transport_iscsi.c +++ linux-kvm-5.19.0/drivers/scsi/scsi_transport_iscsi.c @@ -231,7 +231,7 @@ dev_set_name(&ep->dev, "ep-%d", id); err = device_register(&ep->dev); if (err) - goto free_id; + goto put_dev; err = sysfs_create_group(&ep->dev.kobj, &iscsi_endpoint_group); if (err) @@ -245,10 +245,12 @@ device_unregister(&ep->dev); return NULL; -free_id: +put_dev: mutex_lock(&iscsi_ep_idr_mutex); idr_remove(&iscsi_ep_idr, id); mutex_unlock(&iscsi_ep_idr_mutex); + put_device(&ep->dev); + return NULL; free_ep: kfree(ep); return NULL; @@ -766,7 +768,7 @@ err = device_register(&iface->dev); if (err) - goto free_iface; + goto put_dev; err = sysfs_create_group(&iface->dev.kobj, &iscsi_iface_group); if (err) @@ -780,9 +782,8 @@ device_unregister(&iface->dev); return NULL; -free_iface: - put_device(iface->dev.parent); - kfree(iface); +put_dev: + put_device(&iface->dev); return NULL; } EXPORT_SYMBOL_GPL(iscsi_create_iface); @@ -1251,15 +1252,15 @@ err = device_register(&fnode_sess->dev); if (err) - goto free_fnode_sess; + goto put_dev; if (dd_size) fnode_sess->dd_data = &fnode_sess[1]; return fnode_sess; -free_fnode_sess: - kfree(fnode_sess); +put_dev: + put_device(&fnode_sess->dev); return NULL; } EXPORT_SYMBOL_GPL(iscsi_create_flashnode_sess); @@ -1299,15 +1300,15 @@ err = device_register(&fnode_conn->dev); if (err) - goto free_fnode_conn; + goto put_dev; if (dd_size) fnode_conn->dd_data = &fnode_conn[1]; return fnode_conn; -free_fnode_conn: - kfree(fnode_conn); +put_dev: + put_device(&fnode_conn->dev); return NULL; } EXPORT_SYMBOL_GPL(iscsi_create_flashnode_conn); @@ -4815,7 +4816,7 @@ dev_set_name(&priv->dev, "%s", tt->name); err = device_register(&priv->dev); if (err) - goto free_priv; + goto put_dev; err = sysfs_create_group(&priv->dev.kobj, &iscsi_transport_group); if (err) @@ -4850,8 +4851,8 @@ unregister_dev: device_unregister(&priv->dev); return NULL; -free_priv: - kfree(priv); +put_dev: + put_device(&priv->dev); return NULL; } EXPORT_SYMBOL_GPL(iscsi_register_transport); diff -u linux-kvm-5.19.0/drivers/scsi/storvsc_drv.c linux-kvm-5.19.0/drivers/scsi/storvsc_drv.c --- linux-kvm-5.19.0/drivers/scsi/storvsc_drv.c +++ linux-kvm-5.19.0/drivers/scsi/storvsc_drv.c @@ -300,16 +300,21 @@ }; /* - * SRB status codes and masks; a subset of the codes used here. + * SRB status codes and masks. In the 8-bit field, the two high order bits + * are flags, while the remaining 6 bits are an integer status code. The + * definitions here include only the subset of the integer status codes that + * are tested for in this driver. */ - #define SRB_STATUS_AUTOSENSE_VALID 0x80 #define SRB_STATUS_QUEUE_FROZEN 0x40 -#define SRB_STATUS_INVALID_LUN 0x20 -#define SRB_STATUS_SUCCESS 0x01 -#define SRB_STATUS_ABORTED 0x02 -#define SRB_STATUS_ERROR 0x04 -#define SRB_STATUS_DATA_OVERRUN 0x12 + +/* SRB status integer codes */ +#define SRB_STATUS_SUCCESS 0x01 +#define SRB_STATUS_ABORTED 0x02 +#define SRB_STATUS_ERROR 0x04 +#define SRB_STATUS_INVALID_REQUEST 0x06 +#define SRB_STATUS_DATA_OVERRUN 0x12 +#define SRB_STATUS_INVALID_LUN 0x20 #define SRB_STATUS(status) \ (status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN)) @@ -966,38 +971,25 @@ void (*process_err_fn)(struct work_struct *work); struct hv_host_device *host_dev = shost_priv(host); - /* - * In some situations, Hyper-V sets multiple bits in the - * srb_status, such as ABORTED and ERROR. So process them - * individually, with the most specific bits first. - */ + switch (SRB_STATUS(vm_srb->srb_status)) { + case SRB_STATUS_ERROR: + case SRB_STATUS_ABORTED: + case SRB_STATUS_INVALID_REQUEST: + if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID) { + /* Check for capacity change */ + if ((asc == 0x2a) && (ascq == 0x9)) { + process_err_fn = storvsc_device_scan; + /* Retry the I/O that triggered this. */ + set_host_byte(scmnd, DID_REQUEUE); + goto do_work; + } - if (vm_srb->srb_status & SRB_STATUS_INVALID_LUN) { - set_host_byte(scmnd, DID_NO_CONNECT); - process_err_fn = storvsc_remove_lun; - goto do_work; - } - - if (vm_srb->srb_status & SRB_STATUS_ABORTED) { - if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID && - /* Capacity data has changed */ - (asc == 0x2a) && (ascq == 0x9)) { - process_err_fn = storvsc_device_scan; /* - * Retry the I/O that triggered this. + * Otherwise, let upper layer deal with the + * error when sense message is present */ - set_host_byte(scmnd, DID_REQUEUE); - goto do_work; - } - } - - if (vm_srb->srb_status & SRB_STATUS_ERROR) { - /* - * Let upper layer deal with error when - * sense message is present. - */ - if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID) return; + } /* * If there is an error; offline the device since all @@ -1020,6 +1012,13 @@ default: set_host_byte(scmnd, DID_ERROR); } + return; + + case SRB_STATUS_INVALID_LUN: + set_host_byte(scmnd, DID_NO_CONNECT); + process_err_fn = storvsc_remove_lun; + goto do_work; + } return; diff -u linux-kvm-5.19.0/drivers/slimbus/Kconfig linux-kvm-5.19.0/drivers/slimbus/Kconfig --- linux-kvm-5.19.0/drivers/slimbus/Kconfig +++ linux-kvm-5.19.0/drivers/slimbus/Kconfig @@ -23,7 +23,7 @@ config SLIM_QCOM_NGD_CTRL tristate "Qualcomm SLIMbus Satellite Non-Generic Device Component" depends on HAS_IOMEM && DMA_ENGINE && NET - depends on QCOM_RPROC_COMMON || COMPILE_TEST + depends on QCOM_RPROC_COMMON || (COMPILE_TEST && !QCOM_RPROC_COMMON) depends on ARCH_QCOM || COMPILE_TEST select QCOM_QMI_HELPERS select QCOM_PDR_HELPERS diff -u linux-kvm-5.19.0/drivers/soundwire/qcom.c linux-kvm-5.19.0/drivers/soundwire/qcom.c --- linux-kvm-5.19.0/drivers/soundwire/qcom.c +++ linux-kvm-5.19.0/drivers/soundwire/qcom.c @@ -335,6 +335,9 @@ if (swrm_wait_for_wr_fifo_avail(swrm)) return SDW_CMD_FAIL_OTHER; + if (cmd_id == SWR_BROADCAST_CMD_ID) + reinit_completion(&swrm->broadcast); + /* Its assumed that write is okay as we do not get any status back */ swrm->reg_write(swrm, SWRM_CMD_FIFO_WR_CMD, val); @@ -368,6 +371,12 @@ val = swrm_get_packed_reg_val(&swrm->rcmd_id, len, dev_addr, reg_addr); + /* + * Check for outstanding cmd wrt. write fifo depth to avoid + * overflow as read will also increase write fifo cnt. + */ + swrm_wait_for_wr_fifo_avail(swrm); + /* wait for FIFO RD to complete to avoid overflow */ usleep_range(100, 105); swrm->reg_write(swrm, SWRM_CMD_FIFO_RD_CMD, val); diff -u linux-kvm-5.19.0/drivers/tty/n_gsm.c linux-kvm-5.19.0/drivers/tty/n_gsm.c --- linux-kvm-5.19.0/drivers/tty/n_gsm.c +++ linux-kvm-5.19.0/drivers/tty/n_gsm.c @@ -248,7 +248,7 @@ bool constipated; /* Asked by remote to shut up */ bool has_devices; /* Devices were registered */ - struct mutex tx_mutex; + spinlock_t tx_lock; unsigned int tx_bytes; /* TX data outstanding */ #define TX_THRESH_HI 8192 #define TX_THRESH_LO 2048 @@ -256,7 +256,7 @@ struct list_head tx_data_list; /* Pending data packets */ /* Control messages */ - struct delayed_work kick_timeout; /* Kick TX queuing on timeout */ + struct timer_list kick_timer; /* Kick TX queuing on timeout */ struct timer_list t2_timer; /* Retransmit timer for commands */ int cretries; /* Command retry counter */ struct gsm_control *pending_cmd;/* Our current pending command */ @@ -680,6 +680,7 @@ struct gsm_msg *msg; u8 *dp; int ocr; + unsigned long flags; msg = gsm_data_alloc(gsm, addr, 0, control); if (!msg) @@ -701,10 +702,10 @@ gsm_print_packet("Q->", addr, cr, control, NULL, 0); - mutex_lock(&gsm->tx_mutex); + spin_lock_irqsave(&gsm->tx_lock, flags); list_add_tail(&msg->list, &gsm->tx_ctrl_list); gsm->tx_bytes += msg->len; - mutex_unlock(&gsm->tx_mutex); + spin_unlock_irqrestore(&gsm->tx_lock, flags); gsmld_write_trigger(gsm); return 0; @@ -729,7 +730,7 @@ spin_unlock_irqrestore(&dlci->lock, flags); /* Clear data packets in MUX write queue */ - mutex_lock(&gsm->tx_mutex); + spin_lock_irqsave(&gsm->tx_lock, flags); list_for_each_entry_safe(msg, nmsg, &gsm->tx_data_list, list) { if (msg->addr != addr) continue; @@ -737,7 +738,7 @@ list_del(&msg->list); kfree(msg); } - mutex_unlock(&gsm->tx_mutex); + spin_unlock_irqrestore(&gsm->tx_lock, flags); } /** @@ -1008,7 +1009,7 @@ gsm->tx_bytes += msg->len; gsmld_write_trigger(gsm); - schedule_delayed_work(&gsm->kick_timeout, 10 * gsm->t1 * HZ / 100); + mod_timer(&gsm->kick_timer, jiffies + 10 * gsm->t1 * HZ / 100); } /** @@ -1023,9 +1024,10 @@ static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) { - mutex_lock(&dlci->gsm->tx_mutex); + unsigned long flags; + spin_lock_irqsave(&dlci->gsm->tx_lock, flags); __gsm_data_queue(dlci, msg); - mutex_unlock(&dlci->gsm->tx_mutex); + spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags); } /** @@ -1037,7 +1039,7 @@ * is data. Keep to the MRU of the mux. This path handles the usual tty * interface which is a byte stream with optional modem data. * - * Caller must hold the tx_mutex of the mux. + * Caller must hold the tx_lock of the mux. */ static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci) @@ -1097,7 +1099,7 @@ * is data. Keep to the MRU of the mux. This path handles framed data * queued as skbuffs to the DLCI. * - * Caller must hold the tx_mutex of the mux. + * Caller must hold the tx_lock of the mux. */ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, @@ -1113,7 +1115,7 @@ if (dlci->adaption == 4) overhead = 1; - /* dlci->skb is locked by tx_mutex */ + /* dlci->skb is locked by tx_lock */ if (dlci->skb == NULL) { dlci->skb = skb_dequeue_tail(&dlci->skb_list); if (dlci->skb == NULL) @@ -1167,7 +1169,7 @@ * Push an empty frame in to the transmit queue to update the modem status * bits and to transmit an optional break. * - * Caller must hold the tx_mutex of the mux. + * Caller must hold the tx_lock of the mux. */ static int gsm_dlci_modem_output(struct gsm_mux *gsm, struct gsm_dlci *dlci, @@ -1281,12 +1283,13 @@ static void gsm_dlci_data_kick(struct gsm_dlci *dlci) { + unsigned long flags; int sweep; if (dlci->constipated) return; - mutex_lock(&dlci->gsm->tx_mutex); + spin_lock_irqsave(&dlci->gsm->tx_lock, flags); /* If we have nothing running then we need to fire up */ sweep = (dlci->gsm->tx_bytes < TX_THRESH_LO); if (dlci->gsm->tx_bytes == 0) { @@ -1297,7 +1300,7 @@ } if (sweep) gsm_dlci_data_sweep(dlci->gsm); - mutex_unlock(&dlci->gsm->tx_mutex); + spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags); } /* @@ -1670,7 +1673,7 @@ unsigned int command, u8 *data, int clen) { struct gsm_control *ctrl = kzalloc(sizeof(struct gsm_control), - GFP_KERNEL); + GFP_ATOMIC); unsigned long flags; if (ctrl == NULL) return NULL; @@ -1981,23 +1984,24 @@ } /** - * gsm_kick_timeout - transmit if possible - * @work: work contained in our gsm object + * gsm_kick_timer - transmit if possible + * @t: timer contained in our gsm object * * Transmit data from DLCIs if the queue is empty. We can't rely on * a tty wakeup except when we filled the pipe so we need to fire off * new data ourselves in other cases. */ -static void gsm_kick_timeout(struct work_struct *work) +static void gsm_kick_timer(struct timer_list *t) { - struct gsm_mux *gsm = container_of(work, struct gsm_mux, kick_timeout.work); + struct gsm_mux *gsm = from_timer(gsm, t, kick_timer); + unsigned long flags; int sent = 0; - mutex_lock(&gsm->tx_mutex); + spin_lock_irqsave(&gsm->tx_lock, flags); /* If we have nothing running then we need to fire up */ if (gsm->tx_bytes < TX_THRESH_LO) sent = gsm_dlci_data_sweep(gsm); - mutex_unlock(&gsm->tx_mutex); + spin_unlock_irqrestore(&gsm->tx_lock, flags); if (sent && debug & 4) pr_info("%s TX queue stalled\n", __func__); @@ -2454,7 +2458,7 @@ } /* Finish outstanding timers, making sure they are done */ - cancel_delayed_work_sync(&gsm->kick_timeout); + del_timer_sync(&gsm->kick_timer); del_timer_sync(&gsm->t2_timer); /* Finish writing to ldisc */ @@ -2527,7 +2531,6 @@ break; } } - mutex_destroy(&gsm->tx_mutex); mutex_destroy(&gsm->mutex); kfree(gsm->txframe); kfree(gsm->buf); @@ -2599,15 +2602,15 @@ } spin_lock_init(&gsm->lock); mutex_init(&gsm->mutex); - mutex_init(&gsm->tx_mutex); kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_ctrl_list); INIT_LIST_HEAD(&gsm->tx_data_list); - INIT_DELAYED_WORK(&gsm->kick_timeout, gsm_kick_timeout); + timer_setup(&gsm->kick_timer, gsm_kick_timer, 0); timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); INIT_WORK(&gsm->tx_work, gsmld_write_task); init_waitqueue_head(&gsm->event); spin_lock_init(&gsm->control_lock); + spin_lock_init(&gsm->tx_lock); gsm->t1 = T1; gsm->t2 = T2; @@ -2632,7 +2635,6 @@ } spin_unlock(&gsm_mux_lock); if (i == MAX_MUX) { - mutex_destroy(&gsm->tx_mutex); mutex_destroy(&gsm->mutex); kfree(gsm->txframe); kfree(gsm->buf); @@ -2788,16 +2790,17 @@ static void gsmld_write_task(struct work_struct *work) { struct gsm_mux *gsm = container_of(work, struct gsm_mux, tx_work); + unsigned long flags; int i, ret; /* All outstanding control channel and control messages and one data * frame is sent. */ ret = -ENODEV; - mutex_lock(&gsm->tx_mutex); + spin_lock_irqsave(&gsm->tx_lock, flags); if (gsm->tty) ret = gsm_data_kick(gsm); - mutex_unlock(&gsm->tx_mutex); + spin_unlock_irqrestore(&gsm->tx_lock, flags); if (ret >= 0) for (i = 0; i < NUM_DLCI; i++) @@ -3005,6 +3008,7 @@ const unsigned char *buf, size_t nr) { struct gsm_mux *gsm = tty->disc_data; + unsigned long flags; int space; int ret; @@ -3012,13 +3016,13 @@ return -ENODEV; ret = -ENOBUFS; - mutex_lock(&gsm->tx_mutex); + spin_lock_irqsave(&gsm->tx_lock, flags); space = tty_write_room(tty); if (space >= nr) ret = tty->ops->write(tty, buf, nr); else set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); - mutex_unlock(&gsm->tx_mutex); + spin_unlock_irqrestore(&gsm->tx_lock, flags); return ret; } @@ -3315,13 +3319,14 @@ static void gsm_modem_upd_via_data(struct gsm_dlci *dlci, u8 brk) { struct gsm_mux *gsm = dlci->gsm; + unsigned long flags; if (dlci->state != DLCI_OPEN || dlci->adaption != 2) return; - mutex_lock(&gsm->tx_mutex); + spin_lock_irqsave(&gsm->tx_lock, flags); gsm_dlci_modem_output(gsm, dlci, brk); - mutex_unlock(&gsm->tx_mutex); + spin_unlock_irqrestore(&gsm->tx_lock, flags); } /** diff -u linux-kvm-5.19.0/drivers/tty/serial/8250/8250_core.c linux-kvm-5.19.0/drivers/tty/serial/8250/8250_core.c --- linux-kvm-5.19.0/drivers/tty/serial/8250/8250_core.c +++ linux-kvm-5.19.0/drivers/tty/serial/8250/8250_core.c @@ -1013,6 +1013,7 @@ uart->port.throttle = up->port.throttle; uart->port.unthrottle = up->port.unthrottle; uart->port.rs485_config = up->port.rs485_config; + uart->port.rs485_supported = up->port.rs485_supported; uart->port.rs485 = up->port.rs485; uart->rs485_start_tx = up->rs485_start_tx; uart->rs485_stop_tx = up->rs485_stop_tx; diff -u linux-kvm-5.19.0/drivers/tty/serial/8250/8250_omap.c linux-kvm-5.19.0/drivers/tty/serial/8250/8250_omap.c --- linux-kvm-5.19.0/drivers/tty/serial/8250/8250_omap.c +++ linux-kvm-5.19.0/drivers/tty/serial/8250/8250_omap.c @@ -157,7 +157,11 @@ return readl(up->port.membase + (reg << up->port.regshift)); } -static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl) +/* + * Called on runtime PM resume path from omap8250_restore_regs(), and + * omap8250_set_mctrl(). + */ +static void __omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl) { struct uart_8250_port *up = up_to_u8250p(port); struct omap8250_priv *priv = up->port.private_data; @@ -181,6 +185,20 @@ } } +static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl) +{ + int err; + + err = pm_runtime_resume_and_get(port->dev); + if (err) + return; + + __omap8250_set_mctrl(port, mctrl); + + pm_runtime_mark_last_busy(port->dev); + pm_runtime_put_autosuspend(port->dev); +} + /* * Work Around for Errata i202 (2430, 3430, 3630, 4430 and 4460) * The access to uart register after MDR1 Access @@ -193,27 +211,10 @@ static void omap_8250_mdr1_errataset(struct uart_8250_port *up, struct omap8250_priv *priv) { - u8 timeout = 255; - serial_out(up, UART_OMAP_MDR1, priv->mdr1); udelay(2); serial_out(up, UART_FCR, up->fcr | UART_FCR_CLEAR_XMIT | UART_FCR_CLEAR_RCVR); - /* - * Wait for FIFO to empty: when empty, RX_FIFO_E bit is 0 and - * TX_FIFO_E bit is 1. - */ - while (UART_LSR_THRE != (serial_in(up, UART_LSR) & - (UART_LSR_THRE | UART_LSR_DR))) { - timeout--; - if (!timeout) { - /* Should *never* happen. we warn and carry on */ - dev_crit(up->port.dev, "Errata i202: timedout %x\n", - serial_in(up, UART_LSR)); - break; - } - udelay(1); - } } static void omap_8250_get_divisor(struct uart_port *port, unsigned int baud, @@ -292,6 +293,7 @@ { struct omap8250_priv *priv = up->port.private_data; struct uart_8250_dma *dma = up->dma; + u8 mcr = serial8250_in_MCR(up); if (dma && dma->tx_running) { /* @@ -308,7 +310,7 @@ serial_out(up, UART_EFR, UART_EFR_ECB); serial_out(up, UART_LCR, UART_LCR_CONF_MODE_A); - serial8250_out_MCR(up, UART_MCR_TCRTLR); + serial8250_out_MCR(up, mcr | UART_MCR_TCRTLR); serial_out(up, UART_FCR, up->fcr); omap8250_update_scr(up, priv); @@ -324,7 +326,8 @@ serial_out(up, UART_LCR, 0); /* drop TCR + TLR access, we setup XON/XOFF later */ - serial8250_out_MCR(up, up->mcr); + serial8250_out_MCR(up, mcr); + serial_out(up, UART_IER, up->ier); serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); @@ -341,7 +344,7 @@ omap8250_update_mdr1(up, priv); - up->port.ops->set_mctrl(&up->port, up->port.mctrl); + __omap8250_set_mctrl(&up->port, up->port.mctrl); if (up->port.rs485.flags & SER_RS485_ENABLED) serial8250_em485_stop_tx(up); @@ -669,7 +672,6 @@ pm_runtime_get_sync(port->dev); - up->mcr = 0; serial_out(up, UART_FCR, UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT); serial_out(up, UART_LCR, UART_LCR_WLEN8); @@ -1460,9 +1462,15 @@ static int omap8250_remove(struct platform_device *pdev) { struct omap8250_priv *priv = platform_get_drvdata(pdev); + int err; + + err = pm_runtime_resume_and_get(&pdev->dev); + if (err) + return err; pm_runtime_dont_use_autosuspend(&pdev->dev); pm_runtime_put_sync(&pdev->dev); + flush_work(&priv->qos_work); pm_runtime_disable(&pdev->dev); serial8250_unregister_port(priv->line); cpu_latency_qos_remove_request(&priv->pm_qos_request); diff -u linux-kvm-5.19.0/drivers/tty/serial/8250/8250_port.c linux-kvm-5.19.0/drivers/tty/serial/8250/8250_port.c --- linux-kvm-5.19.0/drivers/tty/serial/8250/8250_port.c +++ linux-kvm-5.19.0/drivers/tty/serial/8250/8250_port.c @@ -1901,10 +1901,13 @@ static bool handle_rx_dma(struct uart_8250_port *up, unsigned int iir) { switch (iir & 0x3f) { - case UART_IIR_RX_TIMEOUT: - serial8250_rx_dma_flush(up); + case UART_IIR_RDI: + if (!up->dma->rx_running) + break; fallthrough; case UART_IIR_RLSI: + case UART_IIR_RX_TIMEOUT: + serial8250_rx_dma_flush(up); return true; } return up->dma->rx_dma(up); diff -u linux-kvm-5.19.0/drivers/tty/serial/fsl_lpuart.c linux-kvm-5.19.0/drivers/tty/serial/fsl_lpuart.c --- linux-kvm-5.19.0/drivers/tty/serial/fsl_lpuart.c +++ linux-kvm-5.19.0/drivers/tty/serial/fsl_lpuart.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -402,33 +403,6 @@ #define lpuart_enable_clks(x) __lpuart_enable_clks(x, true) #define lpuart_disable_clks(x) __lpuart_enable_clks(x, false) -static int lpuart_global_reset(struct lpuart_port *sport) -{ - struct uart_port *port = &sport->port; - void __iomem *global_addr; - int ret; - - if (uart_console(port)) - return 0; - - ret = clk_prepare_enable(sport->ipg_clk); - if (ret) { - dev_err(sport->port.dev, "failed to enable uart ipg clk: %d\n", ret); - return ret; - } - - if (is_imx7ulp_lpuart(sport) || is_imx8qxp_lpuart(sport)) { - global_addr = port->membase + UART_GLOBAL - IMX_REG_OFF; - writel(UART_GLOBAL_RST, global_addr); - usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US); - writel(0, global_addr); - usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US); - } - - clk_disable_unprepare(sport->ipg_clk); - return 0; -} - static void lpuart_stop_tx(struct uart_port *port) { unsigned char temp; @@ -2624,6 +2598,59 @@ .cons = LPUART_CONSOLE, }; +static int lpuart_global_reset(struct lpuart_port *sport) +{ + struct uart_port *port = &sport->port; + void __iomem *global_addr; + unsigned long ctrl, bd; + unsigned int val = 0; + int ret; + + ret = clk_prepare_enable(sport->ipg_clk); + if (ret) { + dev_err(sport->port.dev, "failed to enable uart ipg clk: %d\n", ret); + return ret; + } + + if (is_imx7ulp_lpuart(sport) || is_imx8qxp_lpuart(sport)) { + /* + * If the transmitter is used by earlycon, wait for transmit engine to + * complete and then reset. + */ + ctrl = lpuart32_read(port, UARTCTRL); + if (ctrl & UARTCTRL_TE) { + bd = lpuart32_read(&sport->port, UARTBAUD); + if (read_poll_timeout(lpuart32_tx_empty, val, val, 1, 100000, false, + port)) { + dev_warn(sport->port.dev, + "timeout waiting for transmit engine to complete\n"); + clk_disable_unprepare(sport->ipg_clk); + return 0; + } + } + + global_addr = port->membase + UART_GLOBAL - IMX_REG_OFF; + writel(UART_GLOBAL_RST, global_addr); + usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US); + writel(0, global_addr); + usleep_range(GLOBAL_RST_MIN_US, GLOBAL_RST_MAX_US); + + /* Recover the transmitter for earlycon. */ + if (ctrl & UARTCTRL_TE) { + lpuart32_write(port, bd, UARTBAUD); + lpuart32_write(port, ctrl, UARTCTRL); + } + } + + clk_disable_unprepare(sport->ipg_clk); + return 0; +} + +static const struct serial_rs485 lpuart_rs485_supported = { + .flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND, + /* delay_rts_* and RX_DURING_TX are not supported */ +}; + static int lpuart_probe(struct platform_device *pdev) { const struct lpuart_soc_data *sdata = of_device_get_match_data(&pdev->dev); @@ -2663,6 +2690,7 @@ sport->port.rs485_config = lpuart32_config_rs485; else sport->port.rs485_config = lpuart_config_rs485; + sport->port.rs485_supported = &lpuart_rs485_supported; sport->ipg_clk = devm_clk_get(&pdev->dev, "ipg"); if (IS_ERR(sport->ipg_clk)) { diff -u linux-kvm-5.19.0/drivers/tty/serial/imx.c linux-kvm-5.19.0/drivers/tty/serial/imx.c --- linux-kvm-5.19.0/drivers/tty/serial/imx.c +++ linux-kvm-5.19.0/drivers/tty/serial/imx.c @@ -2585,6 +2585,7 @@ .suspend_noirq = imx_uart_suspend_noirq, .resume_noirq = imx_uart_resume_noirq, .freeze_noirq = imx_uart_suspend_noirq, + .thaw_noirq = imx_uart_resume_noirq, .restore_noirq = imx_uart_resume_noirq, .suspend = imx_uart_suspend, .resume = imx_uart_resume, diff -u linux-kvm-5.19.0/drivers/usb/core/quirks.c linux-kvm-5.19.0/drivers/usb/core/quirks.c --- linux-kvm-5.19.0/drivers/usb/core/quirks.c +++ linux-kvm-5.19.0/drivers/usb/core/quirks.c @@ -362,6 +362,9 @@ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM }, { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, + /* Realforce 87U Keyboard */ + { USB_DEVICE(0x0853, 0x011b), .driver_info = USB_QUIRK_NO_LPM }, + /* M-Systems Flash Disk Pioneers */ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, diff -u linux-kvm-5.19.0/drivers/usb/dwc3/core.c linux-kvm-5.19.0/drivers/usb/dwc3/core.c --- linux-kvm-5.19.0/drivers/usb/dwc3/core.c +++ linux-kvm-5.19.0/drivers/usb/dwc3/core.c @@ -1677,6 +1677,16 @@ return extcon_get_extcon_dev(name); /* + * Check explicitly if "usb-role-switch" is used since + * extcon_find_edev_by_node() can not be used to check the absence of + * an extcon device. In the absence of an device it will always return + * EPROBE_DEFER. + */ + if (IS_ENABLED(CONFIG_USB_ROLE_SWITCH) && + device_property_read_bool(dev, "usb-role-switch")) + return NULL; + + /* * Try to get an extcon device from the USB PHY controller's "port" * node. Check if it has the "port" node first, to avoid printing the * error message from underlying code, as it's a valid case: extcon diff -u linux-kvm-5.19.0/drivers/usb/dwc3/gadget.c linux-kvm-5.19.0/drivers/usb/dwc3/gadget.c --- linux-kvm-5.19.0/drivers/usb/dwc3/gadget.c +++ linux-kvm-5.19.0/drivers/usb/dwc3/gadget.c @@ -964,7 +964,7 @@ return 0; } -static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep) +static void dwc3_remove_requests(struct dwc3 *dwc, struct dwc3_ep *dep, int status) { struct dwc3_request *req; @@ -974,19 +974,19 @@ while (!list_empty(&dep->started_list)) { req = next_request(&dep->started_list); - dwc3_gadget_giveback(dep, req, -ESHUTDOWN); + dwc3_gadget_giveback(dep, req, status); } while (!list_empty(&dep->pending_list)) { req = next_request(&dep->pending_list); - dwc3_gadget_giveback(dep, req, -ESHUTDOWN); + dwc3_gadget_giveback(dep, req, status); } while (!list_empty(&dep->cancelled_list)) { req = next_request(&dep->cancelled_list); - dwc3_gadget_giveback(dep, req, -ESHUTDOWN); + dwc3_gadget_giveback(dep, req, status); } } @@ -1015,18 +1015,18 @@ reg &= ~DWC3_DALEPENA_EP(dep->number); dwc3_writel(dwc->regs, DWC3_DALEPENA, reg); + dwc3_remove_requests(dwc, dep, -ESHUTDOWN); + + dep->stream_capable = false; + dep->type = 0; + dep->flags &= DWC3_EP_TXFIFO_RESIZED; + /* Clear out the ep descriptors for non-ep0 */ if (dep->number > 1) { dep->endpoint.comp_desc = NULL; dep->endpoint.desc = NULL; } - dwc3_remove_requests(dwc, dep); - - dep->stream_capable = false; - dep->type = 0; - dep->flags &= DWC3_EP_TXFIFO_RESIZED; - return 0; } @@ -2339,7 +2339,7 @@ if (!dep) continue; - dwc3_remove_requests(dwc, dep); + dwc3_remove_requests(dwc, dep, -ESHUTDOWN); } } reverted: --- linux-kvm-5.19.0/drivers/usb/dwc3/host.c +++ linux-kvm-5.19.0.orig/drivers/usb/dwc3/host.c @@ -11,13 +11,8 @@ #include #include -#include "../host/xhci-plat.h" #include "core.h" -static const struct xhci_plat_priv dwc3_xhci_plat_priv = { - .quirks = XHCI_SKIP_PHY_INIT, -}; - static void dwc3_host_fill_xhci_irq_res(struct dwc3 *dwc, int irq, char *name) { @@ -97,11 +92,6 @@ goto err; } - ret = platform_device_add_data(xhci, &dwc3_xhci_plat_priv, - sizeof(dwc3_xhci_plat_priv)); - if (ret) - goto err; - memset(props, 0, sizeof(struct property_entry) * ARRAY_SIZE(props)); if (dwc->usb3_lpm_capable) diff -u linux-kvm-5.19.0/drivers/usb/serial/option.c linux-kvm-5.19.0/drivers/usb/serial/option.c --- linux-kvm-5.19.0/drivers/usb/serial/option.c +++ linux-kvm-5.19.0/drivers/usb/serial/option.c @@ -162,6 +162,8 @@ #define NOVATELWIRELESS_PRODUCT_G2 0xA010 #define NOVATELWIRELESS_PRODUCT_MC551 0xB001 +#define UBLOX_VENDOR_ID 0x1546 + /* AMOI PRODUCTS */ #define AMOI_VENDOR_ID 0x1614 #define AMOI_PRODUCT_H01 0x0800 @@ -240,7 +242,6 @@ #define QUECTEL_PRODUCT_UC15 0x9090 /* These u-blox products use Qualcomm's vendor ID */ #define UBLOX_PRODUCT_R410M 0x90b2 -#define UBLOX_PRODUCT_R6XX 0x90fa /* These Yuga products use Qualcomm's vendor ID */ #define YUGA_PRODUCT_CLM920_NC5 0x9625 @@ -581,6 +582,9 @@ #define OPPO_VENDOR_ID 0x22d9 #define OPPO_PRODUCT_R11 0x276c +/* Sierra Wireless products */ +#define SIERRA_VENDOR_ID 0x1199 +#define SIERRA_PRODUCT_EM9191 0x90d3 /* Device flags */ @@ -1124,8 +1128,16 @@ /* u-blox products using Qualcomm vendor ID */ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M), .driver_info = RSVD(1) | RSVD(3) }, - { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R6XX), + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x908b), /* u-blox LARA-R6 00B */ + .driver_info = RSVD(4) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa), .driver_info = RSVD(3) }, + /* u-blox products */ + { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */ + { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */ + .driver_info = RSVD(4) }, + { USB_DEVICE(UBLOX_VENDOR_ID, 0x1343), /* u-blox LARA-L6 (ECM) */ + .driver_info = RSVD(4) }, /* Quectel products using Quectel vendor ID */ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff), .driver_info = NUMEP2 }, @@ -2167,6 +2179,7 @@ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ @@ -2176,6 +2189,8 @@ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); diff -u linux-kvm-5.19.0/drivers/usb/typec/mux/intel_pmc_mux.c linux-kvm-5.19.0/drivers/usb/typec/mux/intel_pmc_mux.c --- linux-kvm-5.19.0/drivers/usb/typec/mux/intel_pmc_mux.c +++ linux-kvm-5.19.0/drivers/usb/typec/mux/intel_pmc_mux.c @@ -369,13 +369,24 @@ return pmc_usb_command(port, (void *)&req, sizeof(req)); } -static int pmc_usb_mux_safe_state(struct pmc_usb_port *port) +static int pmc_usb_mux_safe_state(struct pmc_usb_port *port, + struct typec_mux_state *state) { u8 msg; if (IOM_PORT_ACTIVITY_IS(port->iom_status, SAFE_MODE)) return 0; + if ((IOM_PORT_ACTIVITY_IS(port->iom_status, DP) || + IOM_PORT_ACTIVITY_IS(port->iom_status, DP_MFD)) && + state->alt && state->alt->svid == USB_TYPEC_DP_SID) + return 0; + + if ((IOM_PORT_ACTIVITY_IS(port->iom_status, TBT) || + IOM_PORT_ACTIVITY_IS(port->iom_status, ALT_MODE_TBT_USB)) && + state->alt && state->alt->svid == USB_TYPEC_TBT_SID) + return 0; + msg = PMC_USB_SAFE_MODE; msg |= port->usb3_port << PMC_USB_MSG_USB3_PORT_SHIFT; @@ -443,7 +454,7 @@ return 0; if (state->mode == TYPEC_STATE_SAFE) - return pmc_usb_mux_safe_state(port); + return pmc_usb_mux_safe_state(port, state); if (state->mode == TYPEC_STATE_USB) return pmc_usb_connect(port, port->role); diff -u linux-kvm-5.19.0/fs/btrfs/backref.c linux-kvm-5.19.0/fs/btrfs/backref.c --- linux-kvm-5.19.0/fs/btrfs/backref.c +++ linux-kvm-5.19.0/fs/btrfs/backref.c @@ -2058,10 +2058,29 @@ return ret; } +static int build_ino_list(u64 inum, u64 offset, u64 root, void *ctx) +{ + struct btrfs_data_container *inodes = ctx; + const size_t c = 3 * sizeof(u64); + + if (inodes->bytes_left >= c) { + inodes->bytes_left -= c; + inodes->val[inodes->elem_cnt] = inum; + inodes->val[inodes->elem_cnt + 1] = offset; + inodes->val[inodes->elem_cnt + 2] = root; + inodes->elem_cnt += 3; + } else { + inodes->bytes_missing += c - inodes->bytes_left; + inodes->bytes_left = 0; + inodes->elem_missed += 3; + } + + return 0; +} + int iterate_inodes_from_logical(u64 logical, struct btrfs_fs_info *fs_info, struct btrfs_path *path, - iterate_extent_inodes_t *iterate, void *ctx, - bool ignore_offset) + void *ctx, bool ignore_offset) { int ret; u64 extent_item_pos; @@ -2079,7 +2098,7 @@ extent_item_pos = logical - found_key.objectid; ret = iterate_extent_inodes(fs_info, found_key.objectid, extent_item_pos, search_commit_root, - iterate, ctx, ignore_offset); + build_ino_list, ctx, ignore_offset); return ret; } diff -u linux-kvm-5.19.0/fs/btrfs/disk-io.c linux-kvm-5.19.0/fs/btrfs/disk-io.c --- linux-kvm-5.19.0/fs/btrfs/disk-io.c +++ linux-kvm-5.19.0/fs/btrfs/disk-io.c @@ -2649,7 +2649,9 @@ fs_info->dev_root = root; } /* Initialize fs_info for all devices in any case */ - btrfs_init_devices_late(fs_info); + ret = btrfs_init_devices_late(fs_info); + if (ret) + goto out; /* * This tree can share blocks with some other fs tree during relocation diff -u linux-kvm-5.19.0/fs/btrfs/qgroup.c linux-kvm-5.19.0/fs/btrfs/qgroup.c --- linux-kvm-5.19.0/fs/btrfs/qgroup.c +++ linux-kvm-5.19.0/fs/btrfs/qgroup.c @@ -2920,14 +2920,7 @@ dstgroup->rsv_rfer = inherit->lim.rsv_rfer; dstgroup->rsv_excl = inherit->lim.rsv_excl; - ret = update_qgroup_limit_item(trans, dstgroup); - if (ret) { - fs_info->qgroup_flags |= BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT; - btrfs_info(fs_info, - "unable to update quota limit for %llu", - dstgroup->qgroupid); - goto unlock; - } + qgroup_dirty(fs_info, dstgroup); } if (srcid) { diff -u linux-kvm-5.19.0/fs/btrfs/raid56.c linux-kvm-5.19.0/fs/btrfs/raid56.c --- linux-kvm-5.19.0/fs/btrfs/raid56.c +++ linux-kvm-5.19.0/fs/btrfs/raid56.c @@ -2871,8 +2871,10 @@ rbio->faila = find_logical_bio_stripe(rbio, bio); if (rbio->faila == -1) { - BUG(); - kfree(rbio); + btrfs_warn_rl(fs_info, + "can not determine the failed stripe number for full stripe %llu", + bioc->raid_map[0]); + __free_raid_bio(rbio); return NULL; } diff -u linux-kvm-5.19.0/fs/btrfs/tests/qgroup-tests.c linux-kvm-5.19.0/fs/btrfs/tests/qgroup-tests.c --- linux-kvm-5.19.0/fs/btrfs/tests/qgroup-tests.c +++ linux-kvm-5.19.0/fs/btrfs/tests/qgroup-tests.c @@ -225,7 +225,6 @@ */ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots, false); if (ret) { - ulist_free(old_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -240,7 +239,6 @@ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots, false); if (ret) { ulist_free(old_roots); - ulist_free(new_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -252,17 +250,18 @@ return ret; } + /* btrfs_qgroup_account_extent() always frees the ulists passed to it. */ + old_roots = NULL; + new_roots = NULL; + if (btrfs_verify_qgroup_counts(fs_info, BTRFS_FS_TREE_OBJECTID, nodesize, nodesize)) { test_err("qgroup counts didn't match expected values"); return -EINVAL; } - old_roots = NULL; - new_roots = NULL; ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots, false); if (ret) { - ulist_free(old_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -276,7 +275,6 @@ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots, false); if (ret) { ulist_free(old_roots); - ulist_free(new_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -326,7 +324,6 @@ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots, false); if (ret) { - ulist_free(old_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -341,7 +338,6 @@ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots, false); if (ret) { ulist_free(old_roots); - ulist_free(new_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -361,7 +357,6 @@ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots, false); if (ret) { - ulist_free(old_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -376,7 +371,6 @@ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots, false); if (ret) { ulist_free(old_roots); - ulist_free(new_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -402,7 +396,6 @@ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &old_roots, false); if (ret) { - ulist_free(old_roots); test_err("couldn't find old roots: %d", ret); return ret; } @@ -417,7 +410,6 @@ ret = btrfs_find_all_roots(&trans, fs_info, nodesize, 0, &new_roots, false); if (ret) { ulist_free(old_roots); - ulist_free(new_roots); test_err("couldn't find old roots: %d", ret); return ret; } diff -u linux-kvm-5.19.0/fs/btrfs/tree-log.c linux-kvm-5.19.0/fs/btrfs/tree-log.c --- linux-kvm-5.19.0/fs/btrfs/tree-log.c +++ linux-kvm-5.19.0/fs/btrfs/tree-log.c @@ -3834,15 +3834,29 @@ u64 *last_old_dentry_offset) { struct btrfs_root *log = inode->root->log_root; - struct extent_buffer *src = path->nodes[0]; - const int nritems = btrfs_header_nritems(src); + struct extent_buffer *src; + const int nritems = btrfs_header_nritems(path->nodes[0]); const u64 ino = btrfs_ino(inode); bool last_found = false; int batch_start = 0; int batch_size = 0; int i; - for (i = path->slots[0]; i < nritems; i++) { + /* + * We need to clone the leaf, release the read lock on it, and use the + * clone before modifying the log tree. See the comment at copy_items() + * about why we need to do this. + */ + src = btrfs_clone_extent_buffer(path->nodes[0]); + if (!src) + return -ENOMEM; + + i = path->slots[0]; + btrfs_release_path(path); + path->nodes[0] = src; + path->slots[0] = i; + + for (; i < nritems; i++) { struct btrfs_dir_item *di; struct btrfs_key key; int ret; @@ -4414,7 +4428,7 @@ { struct btrfs_root *log = inode->root->log_root; struct btrfs_file_extent_item *extent; - struct extent_buffer *src = src_path->nodes[0]; + struct extent_buffer *src; int ret = 0; struct btrfs_key *ins_keys; u32 *ins_sizes; @@ -4425,6 +4439,43 @@ const bool skip_csum = (inode->flags & BTRFS_INODE_NODATASUM); const u64 i_size = i_size_read(&inode->vfs_inode); + /* + * To keep lockdep happy and avoid deadlocks, clone the source leaf and + * use the clone. This is because otherwise we would be changing the log + * tree, to insert items from the subvolume tree or insert csum items, + * while holding a read lock on a leaf from the subvolume tree, which + * creates a nasty lock dependency when COWing log tree nodes/leaves: + * + * 1) Modifying the log tree triggers an extent buffer allocation while + * holding a write lock on a parent extent buffer from the log tree. + * Allocating the pages for an extent buffer, or the extent buffer + * struct, can trigger inode eviction and finally the inode eviction + * will trigger a release/remove of a delayed node, which requires + * taking the delayed node's mutex; + * + * 2) Allocating a metadata extent for a log tree can trigger the async + * reclaim thread and make us wait for it to release enough space and + * unblock our reservation ticket. The reclaim thread can start + * flushing delayed items, and that in turn results in the need to + * lock delayed node mutexes and in the need to write lock extent + * buffers of a subvolume tree - all this while holding a write lock + * on the parent extent buffer in the log tree. + * + * So one task in scenario 1) running in parallel with another task in + * scenario 2) could lead to a deadlock, one wanting to lock a delayed + * node mutex while having a read lock on a leaf from the subvolume, + * while the other is holding the delayed node's mutex and wants to + * write lock the same subvolume leaf for flushing delayed items. + */ + src = btrfs_clone_extent_buffer(src_path->nodes[0]); + if (!src) + return -ENOMEM; + + i = src_path->slots[0]; + btrfs_release_path(src_path); + src_path->nodes[0] = src; + src_path->slots[0] = i; + ins_data = kmalloc(nr * sizeof(struct btrfs_key) + nr * sizeof(u32), GFP_NOFS); if (!ins_data) diff -u linux-kvm-5.19.0/fs/btrfs/volumes.c linux-kvm-5.19.0/fs/btrfs/volumes.c --- linux-kvm-5.19.0/fs/btrfs/volumes.c +++ linux-kvm-5.19.0/fs/btrfs/volumes.c @@ -1003,6 +1003,18 @@ rcu_assign_pointer(device->name, name); } + if (orig_dev->zone_info) { + struct btrfs_zoned_device_info *zone_info; + + zone_info = btrfs_clone_dev_zone_info(orig_dev); + if (!zone_info) { + btrfs_free_device(device); + ret = -ENOMEM; + goto error; + } + device->zone_info = zone_info; + } + list_add(&device->dev_list, &fs_devices->devices); device->fs_devices = fs_devices; fs_devices->num_devices++; @@ -6820,18 +6832,18 @@ static bool dev_args_match_device(const struct btrfs_dev_lookup_args *args, const struct btrfs_device *device) { - ASSERT((args->devid != (u64)-1) || args->missing); + if (args->missing) { + if (test_bit(BTRFS_DEV_STATE_IN_FS_METADATA, &device->dev_state) && + !device->bdev) + return true; + return false; + } - if ((args->devid != (u64)-1) && device->devid != args->devid) + if (device->devid != args->devid) return false; if (args->uuid && memcmp(device->uuid, args->uuid, BTRFS_UUID_SIZE) != 0) return false; - if (!args->missing) - return true; - if (test_bit(BTRFS_DEV_STATE_IN_FS_METADATA, &device->dev_state) && - !device->bdev) - return true; - return false; + return true; } /* @@ -7635,10 +7647,11 @@ return ret; } -void btrfs_init_devices_late(struct btrfs_fs_info *fs_info) +int btrfs_init_devices_late(struct btrfs_fs_info *fs_info) { struct btrfs_fs_devices *fs_devices = fs_info->fs_devices, *seed_devs; struct btrfs_device *device; + int ret = 0; fs_devices->fs_info = fs_info; @@ -7647,12 +7660,18 @@ device->fs_info = fs_info; list_for_each_entry(seed_devs, &fs_devices->seed_list, seed_list) { - list_for_each_entry(device, &seed_devs->devices, dev_list) + list_for_each_entry(device, &seed_devs->devices, dev_list) { device->fs_info = fs_info; + ret = btrfs_get_dev_zone_info(device, false); + if (ret) + break; + } seed_devs->fs_info = fs_info; } mutex_unlock(&fs_devices->device_list_mutex); + + return ret; } static u64 btrfs_dev_stats_value(const struct extent_buffer *eb, diff -u linux-kvm-5.19.0/fs/btrfs/zoned.c linux-kvm-5.19.0/fs/btrfs/zoned.c --- linux-kvm-5.19.0/fs/btrfs/zoned.c +++ linux-kvm-5.19.0/fs/btrfs/zoned.c @@ -134,7 +134,8 @@ super[i] = page_address(page[i]); } - if (super[0]->generation > super[1]->generation) + if (btrfs_super_generation(super[0]) > + btrfs_super_generation(super[1])) sector = zones[1].start; else sector = zones[0].start; @@ -466,7 +467,7 @@ goto out; } - zones = kcalloc(BTRFS_REPORT_NR_ZONES, sizeof(struct blk_zone), GFP_KERNEL); + zones = kvcalloc(BTRFS_REPORT_NR_ZONES, sizeof(struct blk_zone), GFP_KERNEL); if (!zones) { ret = -ENOMEM; goto out; @@ -585,7 +586,7 @@ } - kfree(zones); + kvfree(zones); switch (bdev_zoned_model(bdev)) { case BLK_ZONED_HM: @@ -617,7 +618,7 @@ return 0; out: - kfree(zones); + kvfree(zones); out_free_zone_info: btrfs_destroy_dev_zone_info(device); @@ -639,6 +640,46 @@ device->zone_info = NULL; } +struct btrfs_zoned_device_info *btrfs_clone_dev_zone_info(struct btrfs_device *orig_dev) +{ + struct btrfs_zoned_device_info *zone_info; + + zone_info = kmemdup(orig_dev->zone_info, sizeof(*zone_info), GFP_KERNEL); + if (!zone_info) + return NULL; + + zone_info->seq_zones = bitmap_zalloc(zone_info->nr_zones, GFP_KERNEL); + if (!zone_info->seq_zones) + goto out; + + bitmap_copy(zone_info->seq_zones, orig_dev->zone_info->seq_zones, + zone_info->nr_zones); + + zone_info->empty_zones = bitmap_zalloc(zone_info->nr_zones, GFP_KERNEL); + if (!zone_info->empty_zones) + goto out; + + bitmap_copy(zone_info->empty_zones, orig_dev->zone_info->empty_zones, + zone_info->nr_zones); + + zone_info->active_zones = bitmap_zalloc(zone_info->nr_zones, GFP_KERNEL); + if (!zone_info->active_zones) + goto out; + + bitmap_copy(zone_info->active_zones, orig_dev->zone_info->active_zones, + zone_info->nr_zones); + zone_info->zone_cache = NULL; + + return zone_info; + +out: + bitmap_free(zone_info->seq_zones); + bitmap_free(zone_info->empty_zones); + bitmap_free(zone_info->active_zones); + kfree(zone_info); + return NULL; +} + int btrfs_get_dev_zone(struct btrfs_device *device, u64 pos, struct blk_zone *zone) { diff -u linux-kvm-5.19.0/fs/btrfs/zoned.h linux-kvm-5.19.0/fs/btrfs/zoned.h --- linux-kvm-5.19.0/fs/btrfs/zoned.h +++ linux-kvm-5.19.0/fs/btrfs/zoned.h @@ -36,6 +36,7 @@ int btrfs_get_dev_zone_info_all_devices(struct btrfs_fs_info *fs_info); int btrfs_get_dev_zone_info(struct btrfs_device *device, bool populate_cache); void btrfs_destroy_dev_zone_info(struct btrfs_device *device); +struct btrfs_zoned_device_info *btrfs_clone_dev_zone_info(struct btrfs_device *orig_dev); int btrfs_check_zoned_mode(struct btrfs_fs_info *fs_info); int btrfs_check_mountopts_zoned(struct btrfs_fs_info *info); int btrfs_sb_log_location_bdev(struct block_device *bdev, int mirror, int rw, @@ -103,6 +104,16 @@ static inline void btrfs_destroy_dev_zone_info(struct btrfs_device *device) { } +/* + * In case the kernel is compiled without CONFIG_BLK_DEV_ZONED we'll never call + * into btrfs_clone_dev_zone_info() so it's safe to return NULL here. + */ +static inline struct btrfs_zoned_device_info *btrfs_clone_dev_zone_info( + struct btrfs_device *orig_dev) +{ + return NULL; +} + static inline int btrfs_check_zoned_mode(const struct btrfs_fs_info *fs_info) { if (!btrfs_is_zoned(fs_info)) diff -u linux-kvm-5.19.0/fs/ceph/caps.c linux-kvm-5.19.0/fs/ceph/caps.c --- linux-kvm-5.19.0/fs/ceph/caps.c +++ linux-kvm-5.19.0/fs/ceph/caps.c @@ -2246,7 +2246,6 @@ struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc; struct ceph_inode_info *ci = ceph_inode(inode); struct ceph_mds_request *req1 = NULL, *req2 = NULL; - unsigned int max_sessions; int ret, err = 0; spin_lock(&ci->i_unsafe_lock); @@ -2265,27 +2264,23 @@ spin_unlock(&ci->i_unsafe_lock); /* - * The mdsc->max_sessions is unlikely to be changed - * mostly, here we will retry it by reallocating the - * sessions array memory to get rid of the mdsc->mutex - * lock. - */ -retry: - max_sessions = mdsc->max_sessions; - - /* * Trigger to flush the journal logs in all the relevant MDSes * manually, or in the worst case we must wait at most 5 seconds * to wait the journal logs to be flushed by the MDSes periodically. */ - if ((req1 || req2) && likely(max_sessions)) { - struct ceph_mds_session **sessions = NULL; - struct ceph_mds_session *s; + if (req1 || req2) { struct ceph_mds_request *req; + struct ceph_mds_session **sessions; + struct ceph_mds_session *s; + unsigned int max_sessions; int i; - sessions = kzalloc(max_sessions * sizeof(s), GFP_KERNEL); + mutex_lock(&mdsc->mutex); + max_sessions = mdsc->max_sessions; + + sessions = kcalloc(max_sessions, sizeof(s), GFP_KERNEL); if (!sessions) { + mutex_unlock(&mdsc->mutex); err = -ENOMEM; goto out; } @@ -2297,16 +2292,6 @@ s = req->r_session; if (!s) continue; - if (unlikely(s->s_mds >= max_sessions)) { - spin_unlock(&ci->i_unsafe_lock); - for (i = 0; i < max_sessions; i++) { - s = sessions[i]; - if (s) - ceph_put_mds_session(s); - } - kfree(sessions); - goto retry; - } if (!sessions[s->s_mds]) { s = ceph_get_mds_session(s); sessions[s->s_mds] = s; @@ -2319,16 +2304,6 @@ s = req->r_session; if (!s) continue; - if (unlikely(s->s_mds >= max_sessions)) { - spin_unlock(&ci->i_unsafe_lock); - for (i = 0; i < max_sessions; i++) { - s = sessions[i]; - if (s) - ceph_put_mds_session(s); - } - kfree(sessions); - goto retry; - } if (!sessions[s->s_mds]) { s = ceph_get_mds_session(s); sessions[s->s_mds] = s; @@ -2340,11 +2315,12 @@ /* the auth MDS */ spin_lock(&ci->i_ceph_lock); if (ci->i_auth_cap) { - s = ci->i_auth_cap->session; - if (!sessions[s->s_mds]) - sessions[s->s_mds] = ceph_get_mds_session(s); + s = ci->i_auth_cap->session; + if (!sessions[s->s_mds]) + sessions[s->s_mds] = ceph_get_mds_session(s); } spin_unlock(&ci->i_ceph_lock); + mutex_unlock(&mdsc->mutex); /* send flush mdlog request to MDSes */ for (i = 0; i < max_sessions; i++) { diff -u linux-kvm-5.19.0/fs/cifs/cifsfs.c linux-kvm-5.19.0/fs/cifs/cifsfs.c --- linux-kvm-5.19.0/fs/cifs/cifsfs.c +++ linux-kvm-5.19.0/fs/cifs/cifsfs.c @@ -1236,7 +1236,7 @@ rc = filemap_write_and_wait_range(src_inode->i_mapping, off, off + len - 1); if (rc) - goto out; + goto unlock; /* should we flush first and last page first */ truncate_inode_pages(&target_inode->i_data, 0); @@ -1252,6 +1252,8 @@ * that target is updated on the server */ CIFS_I(target_inode)->time = 0; + +unlock: /* although unlocking in the reverse order from locking is not * strictly necessary here it is a little cleaner to be consistent */ diff -u linux-kvm-5.19.0/fs/cifs/connect.c linux-kvm-5.19.0/fs/cifs/connect.c --- linux-kvm-5.19.0/fs/cifs/connect.c +++ linux-kvm-5.19.0/fs/cifs/connect.c @@ -3771,9 +3771,13 @@ uuid_copy(&cifs_sb->dfs_mount_id, &mnt_ctx.mount_id); out: - free_xid(mnt_ctx.xid); cifs_try_adding_channels(cifs_sb, mnt_ctx.ses); - return mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon); + rc = mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon); + if (rc) + goto error; + + free_xid(mnt_ctx.xid); + return rc; error: dfs_cache_put_refsrv_sessions(&mnt_ctx.mount_id); @@ -3800,8 +3804,12 @@ goto error; } + rc = mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon); + if (rc) + goto error; + free_xid(mnt_ctx.xid); - return mount_setup_tlink(cifs_sb, mnt_ctx.ses, mnt_ctx.tcon); + return rc; error: mount_put_conns(&mnt_ctx); diff -u linux-kvm-5.19.0/fs/cifs/sess.c linux-kvm-5.19.0/fs/cifs/sess.c --- linux-kvm-5.19.0/fs/cifs/sess.c +++ linux-kvm-5.19.0/fs/cifs/sess.c @@ -302,14 +302,14 @@ /* now drop the ref to the current iface */ if (old_iface && iface) { - kref_put(&old_iface->refcount, release_iface); cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n", &old_iface->sockaddr, &iface->sockaddr); - } else if (old_iface) { kref_put(&old_iface->refcount, release_iface); + } else if (old_iface) { cifs_dbg(FYI, "releasing ref to iface: %pIS\n", &old_iface->sockaddr); + kref_put(&old_iface->refcount, release_iface); } else { WARN_ON(!iface); cifs_dbg(FYI, "adding new iface: %pIS\n", &iface->sockaddr); diff -u linux-kvm-5.19.0/fs/cifs/smb2ops.c linux-kvm-5.19.0/fs/cifs/smb2ops.c --- linux-kvm-5.19.0/fs/cifs/smb2ops.c +++ linux-kvm-5.19.0/fs/cifs/smb2ops.c @@ -1409,6 +1409,8 @@ COMPOUND_FID, current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 0, data, size); + if (rc) + goto sea_exit; smb2_set_next_command(tcon, &rqst[1]); smb2_set_related(&rqst[1]); @@ -1419,6 +1421,8 @@ rqst[2].rq_nvec = 1; rc = SMB2_close_init(tcon, server, &rqst[2], COMPOUND_FID, COMPOUND_FID, false); + if (rc) + goto sea_exit; smb2_set_related(&rqst[2]); rc = compound_send_recv(xid, ses, server, diff -u linux-kvm-5.19.0/fs/erofs/fscache.c linux-kvm-5.19.0/fs/erofs/fscache.c --- linux-kvm-5.19.0/fs/erofs/fscache.c +++ linux-kvm-5.19.0/fs/erofs/fscache.c @@ -69,11 +69,15 @@ rcu_read_lock(); xas_for_each(&xas, folio, last_page) { - unsigned int pgpos = - (folio_index(folio) - start_page) * PAGE_SIZE; - unsigned int pgend = pgpos + folio_size(folio); + unsigned int pgpos, pgend; bool pg_failed = false; + if (xas_retry(&xas, folio)) + continue; + + pgpos = (folio_index(folio) - start_page) * PAGE_SIZE; + pgend = pgpos + folio_size(folio); + for (;;) { if (!subreq) { pg_failed = true; @@ -234,113 +238,111 @@ return ret; } -static int erofs_fscache_read_folio_inline(struct folio *folio, - struct erofs_map_blocks *map) +/* + * Read into page cache in the range described by (@pos, @len). + * + * On return, the caller is responsible for page unlocking if the output @unlock + * is true, or the callee will take this responsibility through netfs_io_request + * interface. + * + * The return value is the number of bytes successfully handled, or negative + * error code on failure. The only exception is that, the length of the range + * instead of the error code is returned on failure after netfs_io_request is + * allocated, so that .readahead() could advance rac accordingly. + */ +static int erofs_fscache_data_read(struct address_space *mapping, + loff_t pos, size_t len, bool *unlock) { - struct super_block *sb = folio_mapping(folio)->host->i_sb; - struct erofs_buf buf = __EROFS_BUF_INITIALIZER; - erofs_blk_t blknr; - size_t offset, len; - void *src, *dst; - - /* For tail packing layout, the offset may be non-zero. */ - offset = erofs_blkoff(map->m_pa); - blknr = erofs_blknr(map->m_pa); - len = map->m_llen; - - src = erofs_read_metabuf(&buf, sb, blknr, EROFS_KMAP); - if (IS_ERR(src)) - return PTR_ERR(src); - - dst = kmap_local_folio(folio, 0); - memcpy(dst, src + offset, len); - memset(dst + len, 0, PAGE_SIZE - len); - kunmap_local(dst); - - erofs_put_metabuf(&buf); - return 0; -} - -static int erofs_fscache_read_folio(struct file *file, struct folio *folio) -{ - struct inode *inode = folio_mapping(folio)->host; + struct inode *inode = mapping->host; struct super_block *sb = inode->i_sb; + struct netfs_io_request *rreq; struct erofs_map_blocks map; struct erofs_map_dev mdev; - struct netfs_io_request *rreq; - erofs_off_t pos; - loff_t pstart; + struct iov_iter iter; + size_t count; int ret; - DBG_BUGON(folio_size(folio) != EROFS_BLKSIZ); + *unlock = true; - pos = folio_pos(folio); map.m_la = pos; - ret = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW); if (ret) - goto out_unlock; + return ret; - if (!(map.m_flags & EROFS_MAP_MAPPED)) { - folio_zero_range(folio, 0, folio_size(folio)); - goto out_uptodate; + if (map.m_flags & EROFS_MAP_META) { + struct erofs_buf buf = __EROFS_BUF_INITIALIZER; + erofs_blk_t blknr; + size_t offset, size; + void *src; + + /* For tail packing layout, the offset may be non-zero. */ + offset = erofs_blkoff(map.m_pa); + blknr = erofs_blknr(map.m_pa); + size = map.m_llen; + + src = erofs_read_metabuf(&buf, sb, blknr, EROFS_KMAP); + if (IS_ERR(src)) + return PTR_ERR(src); + + iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, PAGE_SIZE); + if (copy_to_iter(src + offset, size, &iter) != size) + return -EFAULT; + iov_iter_zero(PAGE_SIZE - size, &iter); + erofs_put_metabuf(&buf); + return PAGE_SIZE; } - if (map.m_flags & EROFS_MAP_META) { - ret = erofs_fscache_read_folio_inline(folio, &map); - goto out_uptodate; + count = min_t(size_t, map.m_llen - (pos - map.m_la), len); + DBG_BUGON(!count || count % PAGE_SIZE); + + if (!(map.m_flags & EROFS_MAP_MAPPED)) { + iov_iter_xarray(&iter, READ, &mapping->i_pages, pos, count); + iov_iter_zero(count, &iter); + return count; } mdev = (struct erofs_map_dev) { .m_deviceid = map.m_deviceid, .m_pa = map.m_pa, }; - ret = erofs_map_dev(sb, &mdev); if (ret) - goto out_unlock; - - - rreq = erofs_fscache_alloc_request(folio_mapping(folio), - folio_pos(folio), folio_size(folio)); - if (IS_ERR(rreq)) { - ret = PTR_ERR(rreq); - goto out_unlock; - } + return ret; - pstart = mdev.m_pa + (pos - map.m_la); - return erofs_fscache_read_folios_async(mdev.m_fscache->cookie, - rreq, pstart); - -out_uptodate: - if (!ret) - folio_mark_uptodate(folio); -out_unlock: - folio_unlock(folio); - return ret; + rreq = erofs_fscache_alloc_request(mapping, pos, count); + if (IS_ERR(rreq)) + return PTR_ERR(rreq); + + *unlock = false; + erofs_fscache_read_folios_async(mdev.m_fscache->cookie, + rreq, mdev.m_pa + (pos - map.m_la)); + return count; } -static void erofs_fscache_advance_folios(struct readahead_control *rac, - size_t len, bool unlock) +static int erofs_fscache_read_folio(struct file *file, struct folio *folio) { - while (len) { - struct folio *folio = readahead_folio(rac); - len -= folio_size(folio); - if (unlock) { + bool unlock; + int ret; + + DBG_BUGON(folio_size(folio) != EROFS_BLKSIZ); + + ret = erofs_fscache_data_read(folio_mapping(folio), folio_pos(folio), + folio_size(folio), &unlock); + if (unlock) { + if (ret > 0) folio_mark_uptodate(folio); - folio_unlock(folio); - } + folio_unlock(folio); } + return ret < 0 ? ret : 0; } static void erofs_fscache_readahead(struct readahead_control *rac) { - struct inode *inode = rac->mapping->host; - struct super_block *sb = inode->i_sb; - size_t len, count, done = 0; - erofs_off_t pos; - loff_t start, offset; - int ret; + struct folio *folio; + size_t len, done = 0; + loff_t start, pos; + bool unlock; + int ret, size; if (!readahead_count(rac)) return; @@ -349,67 +351,22 @@ len = readahead_length(rac); do { - struct erofs_map_blocks map; - struct erofs_map_dev mdev; - struct netfs_io_request *rreq; - pos = start + done; - map.m_la = pos; - - ret = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW); - if (ret) + ret = erofs_fscache_data_read(rac->mapping, pos, + len - done, &unlock); + if (ret <= 0) return; - offset = start + done; - count = min_t(size_t, map.m_llen - (pos - map.m_la), - len - done); - - if (!(map.m_flags & EROFS_MAP_MAPPED)) { - struct iov_iter iter; - - iov_iter_xarray(&iter, READ, &rac->mapping->i_pages, - offset, count); - iov_iter_zero(count, &iter); - - erofs_fscache_advance_folios(rac, count, true); - ret = count; - continue; - } - - if (map.m_flags & EROFS_MAP_META) { - struct folio *folio = readahead_folio(rac); - - ret = erofs_fscache_read_folio_inline(folio, &map); - if (!ret) { + size = ret; + while (size) { + folio = readahead_folio(rac); + size -= folio_size(folio); + if (unlock) { folio_mark_uptodate(folio); - ret = folio_size(folio); + folio_unlock(folio); } - - folio_unlock(folio); - continue; } - - mdev = (struct erofs_map_dev) { - .m_deviceid = map.m_deviceid, - .m_pa = map.m_pa, - }; - ret = erofs_map_dev(sb, &mdev); - if (ret) - return; - - rreq = erofs_fscache_alloc_request(rac->mapping, offset, count); - if (IS_ERR(rreq)) - return; - /* - * Drop the ref of folios here. Unlock them in - * rreq_unlock_folios() when rreq complete. - */ - erofs_fscache_advance_folios(rac, count, false); - ret = erofs_fscache_read_folios_async(mdev.m_fscache->cookie, - rreq, mdev.m_pa + (pos - map.m_la)); - if (!ret) - ret = count; - } while (ret > 0 && ((done += ret) < len)); + } while ((done += ret) < len); } static const struct address_space_operations erofs_fscache_meta_aops = { diff -u linux-kvm-5.19.0/fs/ext4/extents.c linux-kvm-5.19.0/fs/ext4/extents.c --- linux-kvm-5.19.0/fs/ext4/extents.c +++ linux-kvm-5.19.0/fs/ext4/extents.c @@ -5183,6 +5183,7 @@ * and it is decreased till we reach start. */ again: + ret = 0; if (SHIFT == SHIFT_LEFT) iterator = &start; else @@ -5226,14 +5227,21 @@ ext4_ext_get_actual_len(extent); } else { extent = EXT_FIRST_EXTENT(path[depth].p_hdr); - if (le32_to_cpu(extent->ee_block) > 0) + if (le32_to_cpu(extent->ee_block) > start) *iterator = le32_to_cpu(extent->ee_block) - 1; - else - /* Beginning is reached, end of the loop */ + else if (le32_to_cpu(extent->ee_block) == start) iterator = NULL; - /* Update path extent in case we need to stop */ - while (le32_to_cpu(extent->ee_block) < start) + else { + extent = EXT_LAST_EXTENT(path[depth].p_hdr); + while (le32_to_cpu(extent->ee_block) >= start) + extent--; + + if (extent == EXT_LAST_EXTENT(path[depth].p_hdr)) + break; + extent++; + iterator = NULL; + } path[depth].p_ext = extent; } ret = ext4_ext_shift_path_extents(path, shift, inode, diff -u linux-kvm-5.19.0/fs/fs-writeback.c linux-kvm-5.19.0/fs/fs-writeback.c --- linux-kvm-5.19.0/fs/fs-writeback.c +++ linux-kvm-5.19.0/fs/fs-writeback.c @@ -1712,18 +1712,26 @@ wb = inode_to_wb_and_lock_list(inode); spin_lock(&inode->i_lock); /* - * If the inode is now fully clean, then it can be safely removed from - * its writeback list (if any). Otherwise the flusher threads are - * responsible for the writeback lists. + * If the inode is freeing, its i_io_list shoudn't be updated + * as it can be finally deleted at this moment. */ - if (!(inode->i_state & I_DIRTY_ALL)) - inode_cgwb_move_to_attached(inode, wb); - else if (!(inode->i_state & I_SYNC_QUEUED)) { - if ((inode->i_state & I_DIRTY)) - redirty_tail_locked(inode, wb); - else if (inode->i_state & I_DIRTY_TIME) { - inode->dirtied_when = jiffies; - inode_io_list_move_locked(inode, wb, &wb->b_dirty_time); + if (!(inode->i_state & I_FREEING)) { + /* + * If the inode is now fully clean, then it can be safely + * removed from its writeback list (if any). Otherwise the + * flusher threads are responsible for the writeback lists. + */ + if (!(inode->i_state & I_DIRTY_ALL)) + inode_cgwb_move_to_attached(inode, wb); + else if (!(inode->i_state & I_SYNC_QUEUED)) { + if ((inode->i_state & I_DIRTY)) + redirty_tail_locked(inode, wb); + else if (inode->i_state & I_DIRTY_TIME) { + inode->dirtied_when = jiffies; + inode_io_list_move_locked(inode, + wb, + &wb->b_dirty_time); + } } } diff -u linux-kvm-5.19.0/fs/fuse/file.c linux-kvm-5.19.0/fs/fuse/file.c --- linux-kvm-5.19.0/fs/fuse/file.c +++ linux-kvm-5.19.0/fs/fuse/file.c @@ -2964,11 +2964,9 @@ .mode = mode }; int err; - bool lock_inode = !(mode & FALLOC_FL_KEEP_SIZE) || - (mode & (FALLOC_FL_PUNCH_HOLE | - FALLOC_FL_ZERO_RANGE)); - - bool block_faults = FUSE_IS_DAX(inode) && lock_inode; + bool block_faults = FUSE_IS_DAX(inode) && + (!(mode & FALLOC_FL_KEEP_SIZE) || + (mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE))); if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) @@ -2977,22 +2975,20 @@ if (fm->fc->no_fallocate) return -EOPNOTSUPP; - if (lock_inode) { - inode_lock(inode); - if (block_faults) { - filemap_invalidate_lock(inode->i_mapping); - err = fuse_dax_break_layouts(inode, 0, 0); - if (err) - goto out; - } - - if (mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) { - loff_t endbyte = offset + length - 1; - - err = fuse_writeback_range(inode, offset, endbyte); - if (err) - goto out; - } + inode_lock(inode); + if (block_faults) { + filemap_invalidate_lock(inode->i_mapping); + err = fuse_dax_break_layouts(inode, 0, 0); + if (err) + goto out; + } + + if (mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) { + loff_t endbyte = offset + length - 1; + + err = fuse_writeback_range(inode, offset, endbyte); + if (err) + goto out; } if (!(mode & FALLOC_FL_KEEP_SIZE) && @@ -3040,8 +3036,7 @@ if (block_faults) filemap_invalidate_unlock(inode->i_mapping); - if (lock_inode) - inode_unlock(inode); + inode_unlock(inode); fuse_flush_time_update(inode); diff -u linux-kvm-5.19.0/fs/ksmbd/vfs.c linux-kvm-5.19.0/fs/ksmbd/vfs.c --- linux-kvm-5.19.0/fs/ksmbd/vfs.c +++ linux-kvm-5.19.0/fs/ksmbd/vfs.c @@ -1785,9 +1785,9 @@ ret = vfs_copy_file_range(src_fp->filp, src_off, dst_fp->filp, dst_off, len, 0); if (ret == -EOPNOTSUPP || ret == -EXDEV) - ret = generic_copy_file_range(src_fp->filp, src_off, - dst_fp->filp, dst_off, - len, 0); + ret = vfs_copy_file_range(src_fp->filp, src_off, + dst_fp->filp, dst_off, len, + COPY_FILE_SPLICE); if (ret < 0) return ret; diff -u linux-kvm-5.19.0/fs/namei.c linux-kvm-5.19.0/fs/namei.c --- linux-kvm-5.19.0/fs/namei.c +++ linux-kvm-5.19.0/fs/namei.c @@ -5055,7 +5055,7 @@ const struct address_space_operations *aops = mapping->a_ops; bool nofs = !mapping_gfp_constraint(mapping, __GFP_FS); struct page *page; - void *fsdata; + void *fsdata = NULL; int err; unsigned int flags; diff -u linux-kvm-5.19.0/fs/nfs/dir.c linux-kvm-5.19.0/fs/nfs/dir.c --- linux-kvm-5.19.0/fs/nfs/dir.c +++ linux-kvm-5.19.0/fs/nfs/dir.c @@ -2906,9 +2906,30 @@ return NULL; } +static u64 nfs_access_login_time(const struct task_struct *task, + const struct cred *cred) +{ + const struct task_struct *parent; + const struct cred *pcred; + u64 ret; + + rcu_read_lock(); + for (;;) { + parent = rcu_dereference(task->real_parent); + pcred = rcu_dereference(parent->cred); + if (parent == task || cred_fscmp(pcred, cred) != 0) + break; + task = parent; + } + ret = task->start_time; + rcu_read_unlock(); + return ret; +} + static int nfs_access_get_cached_locked(struct inode *inode, const struct cred *cred, u32 *mask, bool may_block) { struct nfs_inode *nfsi = NFS_I(inode); + u64 login_time = nfs_access_login_time(current, cred); struct nfs_access_entry *cache; bool retry = true; int err; @@ -2936,6 +2957,9 @@ spin_lock(&inode->i_lock); retry = false; } + err = -ENOENT; + if ((s64)(login_time - cache->timestamp) > 0) + goto out; *mask = cache->mask; list_move_tail(&cache->lru, &nfsi->access_cache_entry_lru); err = 0; @@ -2954,6 +2978,7 @@ * but do it without locking. */ struct nfs_inode *nfsi = NFS_I(inode); + u64 login_time = nfs_access_login_time(current, cred); struct nfs_access_entry *cache; int err = -ECHILD; struct list_head *lh; @@ -2968,6 +2993,8 @@ cache = NULL; if (cache == NULL) goto out; + if ((s64)(login_time - cache->timestamp) > 0) + goto out; if (nfs_check_cache_invalid(inode, NFS_INO_INVALID_ACCESS)) goto out; *mask = cache->mask; @@ -3015,6 +3042,7 @@ else goto found; } + set->timestamp = ktime_get_ns(); rb_link_node(&set->rb_node, parent, p); rb_insert_color(&set->rb_node, root_node); list_add_tail(&set->lru, &nfsi->access_cache_entry_lru); diff -u linux-kvm-5.19.0/fs/nfs/nfs4proc.c linux-kvm-5.19.0/fs/nfs/nfs4proc.c --- linux-kvm-5.19.0/fs/nfs/nfs4proc.c +++ linux-kvm-5.19.0/fs/nfs/nfs4proc.c @@ -7137,6 +7137,7 @@ { struct nfs4_lockdata *data = calldata; struct nfs4_lock_state *lsp = data->lsp; + struct nfs_server *server = NFS_SERVER(d_inode(data->ctx->dentry)); if (!nfs4_sequence_done(task, &data->res.seq_res)) return; @@ -7144,8 +7145,7 @@ data->rpc_status = task->tk_status; switch (task->tk_status) { case 0: - renew_lease(NFS_SERVER(d_inode(data->ctx->dentry)), - data->timestamp); + renew_lease(server, data->timestamp); if (data->arg.new_lock && !data->cancelled) { data->fl.fl_flags &= ~(FL_SLEEP | FL_ACCESS); if (locks_lock_inode_wait(lsp->ls_state->inode, &data->fl) < 0) @@ -7166,6 +7166,8 @@ if (!nfs4_stateid_match(&data->arg.open_stateid, &lsp->ls_state->open_stateid)) goto out_restart; + else if (nfs4_async_handle_error(task, server, lsp->ls_state, NULL) == -EAGAIN) + goto out_restart; } else if (!nfs4_stateid_match(&data->arg.lock_stateid, &lsp->ls_stateid)) goto out_restart; diff -u linux-kvm-5.19.0/fs/nfsd/nfs4proc.c linux-kvm-5.19.0/fs/nfsd/nfs4proc.c --- linux-kvm-5.19.0/fs/nfsd/nfs4proc.c +++ linux-kvm-5.19.0/fs/nfsd/nfs4proc.c @@ -1517,13 +1517,6 @@ return status; } -static void -nfsd4_interssc_disconnect(struct vfsmount *ss_mnt) -{ - nfs_do_sb_deactive(ss_mnt->mnt_sb); - mntput(ss_mnt); -} - /* * Verify COPY destination stateid. * @@ -1626,11 +1619,6 @@ { } -static void -nfsd4_interssc_disconnect(struct vfsmount *ss_mnt) -{ -} - static struct file *nfs42_ssc_open(struct vfsmount *ss_mnt, struct nfs_fh *src_fh, nfs4_stateid *stateid) @@ -1788,14 +1776,14 @@ copy->nf_src = kzalloc(sizeof(struct nfsd_file), GFP_KERNEL); if (!copy->nf_src) { copy->nfserr = nfserr_serverfault; - nfsd4_interssc_disconnect(copy->ss_mnt); + /* ss_mnt will be unmounted by the laundromat */ goto do_callback; } copy->nf_src->nf_file = nfs42_ssc_open(copy->ss_mnt, ©->c_fh, ©->stateid); if (IS_ERR(copy->nf_src->nf_file)) { copy->nfserr = nfserr_offload_denied; - nfsd4_interssc_disconnect(copy->ss_mnt); + /* ss_mnt will be unmounted by the laundromat */ goto do_callback; } } @@ -1880,8 +1868,10 @@ if (async_copy) cleanup_async_copy(async_copy); status = nfserrno(-ENOMEM); - if (!copy->cp_intra) - nfsd4_interssc_disconnect(copy->ss_mnt); + /* + * source's vfsmount of inter-copy will be unmounted + * by the laundromat + */ goto out; } diff -u linux-kvm-5.19.0/fs/nilfs2/segment.c linux-kvm-5.19.0/fs/nilfs2/segment.c --- linux-kvm-5.19.0/fs/nilfs2/segment.c +++ linux-kvm-5.19.0/fs/nilfs2/segment.c @@ -317,7 +317,7 @@ struct the_nilfs *nilfs = sb->s_fs_info; struct nilfs_sc_info *sci = nilfs->ns_writer; - if (!sci || !sci->sc_flush_request) + if (sb_rdonly(sb) || unlikely(!sci) || !sci->sc_flush_request) return; set_bit(NILFS_SC_PRIOR_FLUSH, &sci->sc_flags); @@ -2243,7 +2243,7 @@ struct nilfs_transaction_info *ti; int err; - if (!sci) + if (sb_rdonly(sb) || unlikely(!sci)) return -EROFS; /* A call inside transactions causes a deadlock. */ @@ -2282,7 +2282,7 @@ struct nilfs_transaction_info ti; int err = 0; - if (!sci) + if (sb_rdonly(sb) || unlikely(!sci)) return -EROFS; nilfs_transaction_lock(sb, &ti, 0); @@ -2778,11 +2778,12 @@ if (nilfs->ns_writer) { /* - * This happens if the filesystem was remounted - * read/write after nilfs_error degenerated it into a - * read-only mount. + * This happens if the filesystem is made read-only by + * __nilfs_error or nilfs_remount and then remounted + * read/write. In these cases, reuse the existing + * writer. */ - nilfs_detach_log_writer(sb); + return 0; } nilfs->ns_writer = nilfs_segctor_new(sb, root); diff -u linux-kvm-5.19.0/fs/read_write.c linux-kvm-5.19.0/fs/read_write.c --- linux-kvm-5.19.0/fs/read_write.c +++ linux-kvm-5.19.0/fs/read_write.c @@ -1401,6 +1401,8 @@ struct file *file_out, loff_t pos_out, size_t len, unsigned int flags) { + lockdep_assert(sb_write_started(file_inode(file_out)->i_sb)); + return do_splice_direct(file_in, &pos_in, file_out, &pos_out, len > MAX_RW_COUNT ? MAX_RW_COUNT : len, 0); } @@ -1437,7 +1439,9 @@ * and several different sets of file_operations, but they all end up * using the same ->copy_file_range() function pointer. */ - if (file_out->f_op->copy_file_range) { + if (flags & COPY_FILE_SPLICE) { + /* cross sb splice is allowed */ + } else if (file_out->f_op->copy_file_range) { if (file_in->f_op->copy_file_range != file_out->f_op->copy_file_range) return -EXDEV; @@ -1487,8 +1491,9 @@ size_t len, unsigned int flags) { ssize_t ret; + bool splice = flags & COPY_FILE_SPLICE; - if (flags != 0) + if (flags & ~COPY_FILE_SPLICE) return -EINVAL; ret = generic_copy_file_checks(file_in, pos_in, file_out, pos_out, &len, @@ -1514,14 +1519,14 @@ * same sb using clone, but for filesystems where both clone and copy * are supported (e.g. nfs,cifs), we only call the copy method. */ - if (file_out->f_op->copy_file_range) { + if (!splice && file_out->f_op->copy_file_range) { ret = file_out->f_op->copy_file_range(file_in, pos_in, file_out, pos_out, len, flags); goto done; } - if (file_in->f_op->remap_file_range && + if (!splice && file_in->f_op->remap_file_range && file_inode(file_in)->i_sb == file_inode(file_out)->i_sb) { ret = file_in->f_op->remap_file_range(file_in, pos_in, file_out, pos_out, @@ -1541,6 +1546,8 @@ * consistent story about which filesystems support copy_file_range() * and which filesystems do not, that will allow userspace tools to * make consistent desicions w.r.t using copy_file_range(). + * + * We also get here if caller (e.g. nfsd) requested COPY_FILE_SPLICE. */ ret = generic_copy_file_range(file_in, pos_in, file_out, pos_out, len, flags); @@ -1595,6 +1602,10 @@ pos_out = f_out.file->f_pos; } + ret = -EINVAL; + if (flags != 0) + goto out; + ret = vfs_copy_file_range(f_in.file, pos_in, f_out.file, pos_out, len, flags); if (ret > 0) { diff -u linux-kvm-5.19.0/fs/shiftfs.c linux-kvm-5.19.0/fs/shiftfs.c --- linux-kvm-5.19.0/fs/shiftfs.c +++ linux-kvm-5.19.0/fs/shiftfs.c @@ -632,10 +632,10 @@ struct inode *loweri_dir_old = lowerd_dir_old->d_inode, *loweri_dir_new = lowerd_dir_new->d_inode; struct renamedata rd = { - .old_mnt_userns = ns, + .old_mnt_userns = &init_user_ns, .old_dir = loweri_dir_old, .old_dentry = lowerd_old, - .new_mnt_userns = ns, + .new_mnt_userns = &init_user_ns, .new_dir = loweri_dir_new, .new_dentry = lowerd_new, }; @@ -972,7 +972,7 @@ return -EOPNOTSUPP; if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) return value ? -EACCES : 0; - if (!inode_owner_or_capable(ns, inode)) + if (!inode_owner_or_capable(&init_user_ns, inode)) return -EPERM; if (value) { @@ -2016,6 +2016,16 @@ goto out_put_path; } + /* + * It makes no sense to handle idmapped layers from shiftfs. + * And we didn't support it properly anyway. + */ + if (is_idmapped_mnt(path.mnt)) { + err = -EINVAL; + pr_err("idmapped layers are currently not supported\n"); + goto out_put_path; + } + sb->s_flags |= SB_POSIXACL; if (sbinfo->mark) { diff -u linux-kvm-5.19.0/include/asm-generic/vmlinux.lds.h linux-kvm-5.19.0/include/asm-generic/vmlinux.lds.h --- linux-kvm-5.19.0/include/asm-generic/vmlinux.lds.h +++ linux-kvm-5.19.0/include/asm-generic/vmlinux.lds.h @@ -333,6 +333,7 @@ #define DATA_DATA \ *(.xiptext) \ *(DATA_MAIN) \ + *(.data..decrypted) \ *(.ref.data) \ *(.data..shared_aligned) /* percpu related */ \ MEM_KEEP(init.data*) \ @@ -975,7 +976,6 @@ #ifdef CONFIG_AMD_MEM_ENCRYPT #define PERCPU_DECRYPTED_SECTION \ . = ALIGN(PAGE_SIZE); \ - *(.data..decrypted) \ *(.data..percpu..decrypted) \ . = ALIGN(PAGE_SIZE); #else diff -u linux-kvm-5.19.0/include/linux/blkdev.h linux-kvm-5.19.0/include/linux/blkdev.h --- linux-kvm-5.19.0/include/linux/blkdev.h +++ linux-kvm-5.19.0/include/linux/blkdev.h @@ -979,7 +979,6 @@ extern void blk_limits_io_opt(struct queue_limits *limits, unsigned int opt); extern void blk_queue_io_opt(struct request_queue *q, unsigned int opt); extern void blk_set_queue_depth(struct request_queue *q, unsigned int depth); -extern void blk_set_default_limits(struct queue_limits *lim); extern void blk_set_stacking_limits(struct queue_limits *lim); extern int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, sector_t offset); diff -u linux-kvm-5.19.0/include/linux/bpf.h linux-kvm-5.19.0/include/linux/bpf.h --- linux-kvm-5.19.0/include/linux/bpf.h +++ linux-kvm-5.19.0/include/linux/bpf.h @@ -1838,6 +1838,7 @@ return !sysctl_unprivileged_bpf_disabled; } +void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog); #else /* !CONFIG_BPF_SYSCALL */ static inline struct bpf_prog *bpf_prog_get(u32 ufd) { @@ -2047,6 +2048,9 @@ return false; } +static inline void bpf_prog_inc_misses_counter(struct bpf_prog *prog) +{ +} #endif /* CONFIG_BPF_SYSCALL */ void __bpf_free_used_btfs(struct bpf_prog_aux *aux, @@ -2117,6 +2121,7 @@ union bpf_attr __user *uattr); void sock_map_unhash(struct sock *sk); +void sock_map_destroy(struct sock *sk); void sock_map_close(struct sock *sk, long timeout); #else static inline int bpf_prog_offload_init(struct bpf_prog *prog, diff -u linux-kvm-5.19.0/include/linux/bpf_verifier.h linux-kvm-5.19.0/include/linux/bpf_verifier.h --- linux-kvm-5.19.0/include/linux/bpf_verifier.h +++ linux-kvm-5.19.0/include/linux/bpf_verifier.h @@ -348,6 +348,27 @@ iter < frame->allocated_stack / BPF_REG_SIZE; \ iter++, reg = bpf_get_spilled_reg(iter, frame)) +/* Invoke __expr over regsiters in __vst, setting __state and __reg */ +#define bpf_for_each_reg_in_vstate(__vst, __state, __reg, __expr) \ + ({ \ + struct bpf_verifier_state *___vstate = __vst; \ + int ___i, ___j; \ + for (___i = 0; ___i <= ___vstate->curframe; ___i++) { \ + struct bpf_reg_state *___regs; \ + __state = ___vstate->frame[___i]; \ + ___regs = __state->regs; \ + for (___j = 0; ___j < MAX_BPF_REG; ___j++) { \ + __reg = &___regs[___j]; \ + (void)(__expr); \ + } \ + bpf_for_each_spilled_reg(___j, __state, __reg) { \ + if (!__reg) \ + continue; \ + (void)(__expr); \ + } \ + } \ + }) + /* linked list of verifier states used to prune search */ struct bpf_verifier_state_list { struct bpf_verifier_state state; diff -u linux-kvm-5.19.0/include/linux/fs.h linux-kvm-5.19.0/include/linux/fs.h --- linux-kvm-5.19.0/include/linux/fs.h +++ linux-kvm-5.19.0/include/linux/fs.h @@ -1958,6 +1958,14 @@ */ #define REMAP_FILE_ADVISORY (REMAP_FILE_CAN_SHORTEN) +/* + * These flags control the behavior of vfs_copy_file_range(). + * They are not available to the user via syscall. + * + * COPY_FILE_SPLICE: call splice direct instead of fs clone/copy ops + */ +#define COPY_FILE_SPLICE (1 << 0) + struct iov_iter; struct io_uring_cmd; diff -u linux-kvm-5.19.0/include/linux/mlx5/driver.h linux-kvm-5.19.0/include/linux/mlx5/driver.h --- linux-kvm-5.19.0/include/linux/mlx5/driver.h +++ linux-kvm-5.19.0/include/linux/mlx5/driver.h @@ -979,6 +979,7 @@ struct mlx5_async_ctx *ctx; mlx5_async_cbk_t user_callback; u16 opcode; /* cmd opcode */ + u16 op_mod; /* cmd op_mod */ void *out; /* pointer to the cmd output buffer */ }; diff -u linux-kvm-5.19.0/include/linux/nfs_fs.h linux-kvm-5.19.0/include/linux/nfs_fs.h --- linux-kvm-5.19.0/include/linux/nfs_fs.h +++ linux-kvm-5.19.0/include/linux/nfs_fs.h @@ -59,6 +59,7 @@ kuid_t fsuid; kgid_t fsgid; struct group_info *group_info; + u64 timestamp; __u32 mask; struct rcu_head rcu_head; }; diff -u linux-kvm-5.19.0/include/linux/ring_buffer.h linux-kvm-5.19.0/include/linux/ring_buffer.h --- linux-kvm-5.19.0/include/linux/ring_buffer.h +++ linux-kvm-5.19.0/include/linux/ring_buffer.h @@ -100,7 +100,7 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full); __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, - struct file *filp, poll_table *poll_table); + struct file *filp, poll_table *poll_table, int full); void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu); #define RING_BUFFER_ALL_CPUS -1 diff -u linux-kvm-5.19.0/include/linux/serial_core.h linux-kvm-5.19.0/include/linux/serial_core.h --- linux-kvm-5.19.0/include/linux/serial_core.h +++ linux-kvm-5.19.0/include/linux/serial_core.h @@ -256,6 +256,7 @@ struct attribute_group *attr_group; /* port specific attributes */ const struct attribute_group **tty_groups; /* all attributes (serial core use only) */ struct serial_rs485 rs485; + const struct serial_rs485 *rs485_supported; /* Supported mask for serial_rs485 */ struct gpio_desc *rs485_term_gpio; /* enable RS485 bus termination */ struct serial_iso7816 iso7816; void *private_data; /* generic platform data pointer */ diff -u linux-kvm-5.19.0/include/linux/skmsg.h linux-kvm-5.19.0/include/linux/skmsg.h --- linux-kvm-5.19.0/include/linux/skmsg.h +++ linux-kvm-5.19.0/include/linux/skmsg.h @@ -95,6 +95,7 @@ spinlock_t link_lock; refcount_t refcnt; void (*saved_unhash)(struct sock *sk); + void (*saved_destroy)(struct sock *sk); void (*saved_close)(struct sock *sk, long timeout); void (*saved_write_space)(struct sock *sk); void (*saved_data_ready)(struct sock *sk); @@ -375,7 +376,7 @@ } struct sk_psock *sk_psock_init(struct sock *sk, int node); -void sk_psock_stop(struct sk_psock *psock, bool wait); +void sk_psock_stop(struct sk_psock *psock); #if IS_ENABLED(CONFIG_BPF_STREAM_PARSER) int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock); diff -u linux-kvm-5.19.0/include/linux/trace.h linux-kvm-5.19.0/include/linux/trace.h --- linux-kvm-5.19.0/include/linux/trace.h +++ linux-kvm-5.19.0/include/linux/trace.h @@ -26,13 +26,13 @@ int flags; }; +struct trace_array; + #ifdef CONFIG_TRACING int register_ftrace_export(struct trace_export *export); int unregister_ftrace_export(struct trace_export *export); -struct trace_array; - void trace_printk_init_buffers(void); __printf(3, 4) int trace_array_printk(struct trace_array *tr, unsigned long ip, diff -u linux-kvm-5.19.0/include/soc/at91/sama7-ddr.h linux-kvm-5.19.0/include/soc/at91/sama7-ddr.h --- linux-kvm-5.19.0/include/soc/at91/sama7-ddr.h +++ linux-kvm-5.19.0/include/soc/at91/sama7-ddr.h @@ -26,7 +26,10 @@ #define DDR3PHY_PGSR (0x0C) /* DDR3PHY PHY General Status Register */ #define DDR3PHY_PGSR_IDONE (1 << 0) /* Initialization Done */ -#define DDR3PHY_ACIOCR (0x24) /* DDR3PHY AC I/O Configuration Register */ +#define DDR3PHY_ACDLLCR (0x14) /* DDR3PHY AC DLL Control Register */ +#define DDR3PHY_ACDLLCR_DLLSRST (1 << 30) /* DLL Soft Reset */ + +#define DDR3PHY_ACIOCR (0x24) /* DDR3PHY AC I/O Configuration Register */ #define DDR3PHY_ACIOCR_CSPDD_CS0 (1 << 18) /* CS#[0] Power Down Driver */ #define DDR3PHY_ACIOCR_CKPDD_CK0 (1 << 8) /* CK[0] Power Down Driver */ #define DDR3PHY_ACIORC_ACPDD (1 << 3) /* AC Power Down Driver */ diff -u linux-kvm-5.19.0/include/uapi/linux/audit.h linux-kvm-5.19.0/include/uapi/linux/audit.h --- linux-kvm-5.19.0/include/uapi/linux/audit.h +++ linux-kvm-5.19.0/include/uapi/linux/audit.h @@ -189,7 +189,7 @@ #define AUDIT_MAX_KEY_LEN 256 #define AUDIT_BITMASK_SIZE 64 #define AUDIT_WORD(nr) ((__u32)((nr)/32)) -#define AUDIT_BIT(nr) (1 << ((nr) - AUDIT_WORD(nr)*32)) +#define AUDIT_BIT(nr) (1U << ((nr) - AUDIT_WORD(nr)*32)) #define AUDIT_SYSCALL_CLASSES 16 #define AUDIT_CLASS_DIR_WRITE 0 diff -u linux-kvm-5.19.0/init/Kconfig linux-kvm-5.19.0/init/Kconfig --- linux-kvm-5.19.0/init/Kconfig +++ linux-kvm-5.19.0/init/Kconfig @@ -80,7 +80,7 @@ config CC_HAS_ASM_GOTO_TIED_OUTPUT depends on CC_HAS_ASM_GOTO_OUTPUT # Detect buggy gcc and clang, fixed in gcc-11 clang-14. - def_bool $(success,echo 'int foo(int *x) { asm goto (".long (%l[bar]) - .\n": "+m"(*x) ::: bar); return *x; bar: return 0; }' | $CC -x c - -c -o /dev/null) + def_bool $(success,echo 'int foo(int *x) { asm goto (".long (%l[bar]) - .": "+m"(*x) ::: bar); return *x; bar: return 0; }' | $CC -x c - -c -o /dev/null) config TOOLS_SUPPORT_RELR def_bool $(success,env "CC=$(CC)" "LD=$(LD)" "NM=$(NM)" "OBJCOPY=$(OBJCOPY)" $(srctree)/scripts/tools-support-relr.sh) diff -u linux-kvm-5.19.0/io_uring/io_uring.c linux-kvm-5.19.0/io_uring/io_uring.c --- linux-kvm-5.19.0/io_uring/io_uring.c +++ linux-kvm-5.19.0/io_uring/io_uring.c @@ -1574,6 +1574,11 @@ return false; } +static inline unsigned int __io_cqring_events_user(struct io_ring_ctx *ctx) +{ + return READ_ONCE(ctx->rings->cq.tail) - READ_ONCE(ctx->rings->cq.head); +} + static bool io_match_linked(struct io_kiocb *head) { struct io_kiocb *req; @@ -6709,7 +6714,8 @@ * Release all references, retry if someone tried to restart * task_work while we were executing it. */ - } while (atomic_sub_return(v & IO_POLL_REF_MASK, &req->poll_refs)); + } while (atomic_sub_return(v & IO_POLL_REF_MASK, &req->poll_refs) & + IO_POLL_REF_MASK); return 1; } @@ -6912,7 +6918,6 @@ struct io_poll_table *ipt, __poll_t mask) { struct io_ring_ctx *ctx = req->ctx; - int v; INIT_HLIST_NODE(&req->hash_node); req->work.cancel_seq = atomic_read(&ctx->cancel_seq); @@ -6961,11 +6966,10 @@ } /* - * Release ownership. If someone tried to queue a tw while it was - * locked, kick it off for them. + * Try to release ownership. If we see a change of state, e.g. + * poll was waken up, queue up a tw, it'll deal with it. */ - v = atomic_dec_return(&req->poll_refs); - if (unlikely(v & IO_POLL_REF_MASK)) + if (atomic_cmpxchg(&req->poll_refs, 1, 0) != 1) __io_poll_execute(req, 0, poll->events); return 0; } @@ -8866,7 +8870,7 @@ static inline bool io_should_wake(struct io_wait_queue *iowq) { struct io_ring_ctx *ctx = iowq->ctx; - int dist = ctx->cached_cq_tail - (int) iowq->cq_tail; + int dist = READ_ONCE(ctx->rings->cq.tail) - (int) iowq->cq_tail; /* * Wake up if we have enough events, or if a timeout occurred since we @@ -8941,7 +8945,8 @@ do { io_cqring_overflow_flush(ctx); - if (io_cqring_events(ctx) >= min_events) + /* if user messes with these they will just get an early return */ + if (__io_cqring_events_user(ctx) >= min_events) return 0; if (!io_run_task_work()) break; diff -u linux-kvm-5.19.0/kernel/bpf/bpf_local_storage.c linux-kvm-5.19.0/kernel/bpf/bpf_local_storage.c --- linux-kvm-5.19.0/kernel/bpf/bpf_local_storage.c +++ linux-kvm-5.19.0/kernel/bpf/bpf_local_storage.c @@ -74,7 +74,7 @@ gfp_flags | __GFP_NOWARN); if (selem) { if (value) - memcpy(SDATA(selem)->data, value, smap->map.value_size); + copy_map_value(&smap->map, SDATA(selem)->data, value); return selem; } diff -u linux-kvm-5.19.0/kernel/bpf/syscall.c linux-kvm-5.19.0/kernel/bpf/syscall.c --- linux-kvm-5.19.0/kernel/bpf/syscall.c +++ linux-kvm-5.19.0/kernel/bpf/syscall.c @@ -2074,6 +2074,17 @@ u64 misses; }; +void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog) +{ + struct bpf_prog_stats *stats; + unsigned int flags; + + stats = this_cpu_ptr(prog->stats); + flags = u64_stats_update_begin_irqsave(&stats->syncp); + u64_stats_inc(&stats->misses); + u64_stats_update_end_irqrestore(&stats->syncp, flags); +} + static void bpf_prog_get_stats(const struct bpf_prog *prog, struct bpf_prog_kstats *stats) { diff -u linux-kvm-5.19.0/kernel/bpf/trampoline.c linux-kvm-5.19.0/kernel/bpf/trampoline.c --- linux-kvm-5.19.0/kernel/bpf/trampoline.c +++ linux-kvm-5.19.0/kernel/bpf/trampoline.c @@ -553,17 +553,6 @@ return start; } -static void notrace inc_misses_counter(struct bpf_prog *prog) -{ - struct bpf_prog_stats *stats; - unsigned int flags; - - stats = this_cpu_ptr(prog->stats); - flags = u64_stats_update_begin_irqsave(&stats->syncp); - u64_stats_inc(&stats->misses); - u64_stats_update_end_irqrestore(&stats->syncp, flags); -} - /* The logic is similar to bpf_prog_run(), but with an explicit * rcu_read_lock() and migrate_disable() which are required * for the trampoline. The macro is split into @@ -586,7 +575,7 @@ run_ctx->saved_run_ctx = bpf_set_run_ctx(&run_ctx->run_ctx); if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) { - inc_misses_counter(prog); + bpf_prog_inc_misses_counter(prog); return 0; } return bpf_prog_start_time(); @@ -632,7 +621,7 @@ might_fault(); if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) { - inc_misses_counter(prog); + bpf_prog_inc_misses_counter(prog); return 0; } diff -u linux-kvm-5.19.0/kernel/bpf/verifier.c linux-kvm-5.19.0/kernel/bpf/verifier.c --- linux-kvm-5.19.0/kernel/bpf/verifier.c +++ linux-kvm-5.19.0/kernel/bpf/verifier.c @@ -1011,12 +1011,17 @@ */ static void *realloc_array(void *arr, size_t old_n, size_t new_n, size_t size) { + void *new_arr; + if (!new_n || old_n == new_n) goto out; - arr = krealloc_array(arr, new_n, size, GFP_KERNEL); - if (!arr) + new_arr = krealloc_array(arr, new_n, size, GFP_KERNEL); + if (!new_arr) { + kfree(arr); return NULL; + } + arr = new_arr; if (new_n > old_n) memset(arr + old_n * size, 0, (new_n - old_n) * size); @@ -6503,31 +6508,15 @@ /* Packet data might have moved, any old PTR_TO_PACKET[_META,_END] * are now invalid, so turn them into unknown SCALAR_VALUE. */ -static void __clear_all_pkt_pointers(struct bpf_verifier_env *env, - struct bpf_func_state *state) +static void clear_all_pkt_pointers(struct bpf_verifier_env *env) { - struct bpf_reg_state *regs = state->regs, *reg; - int i; - - for (i = 0; i < MAX_BPF_REG; i++) - if (reg_is_pkt_pointer_any(®s[i])) - mark_reg_unknown(env, regs, i); + struct bpf_func_state *state; + struct bpf_reg_state *reg; - bpf_for_each_spilled_reg(i, state, reg) { - if (!reg) - continue; + bpf_for_each_reg_in_vstate(env->cur_state, state, reg, ({ if (reg_is_pkt_pointer_any(reg)) __mark_reg_unknown(env, reg); - } -} - -static void clear_all_pkt_pointers(struct bpf_verifier_env *env) -{ - struct bpf_verifier_state *vstate = env->cur_state; - int i; - - for (i = 0; i <= vstate->curframe; i++) - __clear_all_pkt_pointers(env, vstate->frame[i]); + })); } enum { @@ -6556,41 +6545,28 @@ reg->range = AT_PKT_END; } -static void release_reg_references(struct bpf_verifier_env *env, - struct bpf_func_state *state, - int ref_obj_id) -{ - struct bpf_reg_state *regs = state->regs, *reg; - int i; - - for (i = 0; i < MAX_BPF_REG; i++) - if (regs[i].ref_obj_id == ref_obj_id) - mark_reg_unknown(env, regs, i); - - bpf_for_each_spilled_reg(i, state, reg) { - if (!reg) - continue; - if (reg->ref_obj_id == ref_obj_id) - __mark_reg_unknown(env, reg); - } -} - /* The pointer with the specified id has released its reference to kernel * resources. Identify all copies of the same pointer and clear the reference. */ static int release_reference(struct bpf_verifier_env *env, int ref_obj_id) { - struct bpf_verifier_state *vstate = env->cur_state; + struct bpf_func_state *state; + struct bpf_reg_state *reg; int err; - int i; err = release_reference_state(cur_func(env), ref_obj_id); if (err) return err; - for (i = 0; i <= vstate->curframe; i++) - release_reg_references(env, vstate->frame[i], ref_obj_id); + bpf_for_each_reg_in_vstate(env->cur_state, state, reg, ({ + if (reg->ref_obj_id == ref_obj_id) { + if (!env->allow_ptr_leaks) + __mark_reg_not_init(env, reg); + else + __mark_reg_unknown(env, reg); + } + })); return 0; } @@ -6706,11 +6682,11 @@ /* Transfer references to the callee */ err = copy_reference_state(callee, caller); if (err) - return err; + goto err_out; err = set_callee_state_cb(env, caller, callee, *insn_idx); if (err) - return err; + goto err_out; clear_caller_saved_regs(env, caller->regs); @@ -6727,6 +6703,11 @@ print_verifier_state(env, callee, true); } return 0; + +err_out: + free_func_state(callee); + state->frame[state->curframe + 1] = NULL; + return err; } int map_set_for_each_callback_args(struct bpf_verifier_env *env, @@ -6912,8 +6893,7 @@ return -EINVAL; } - state->curframe--; - caller = state->frame[state->curframe]; + caller = state->frame[state->curframe - 1]; if (callee->in_callback_fn) { /* enforce R0 return value range [0, 1]. */ struct tnum range = tnum_range(0, 1); @@ -6952,7 +6932,7 @@ } /* clear everything in the callee */ free_func_state(callee); - state->frame[state->curframe + 1] = NULL; + state->frame[state->curframe--] = NULL; return 0; } @@ -9241,34 +9221,14 @@ return 0; } -static void __find_good_pkt_pointers(struct bpf_func_state *state, - struct bpf_reg_state *dst_reg, - enum bpf_reg_type type, int new_range) -{ - struct bpf_reg_state *reg; - int i; - - for (i = 0; i < MAX_BPF_REG; i++) { - reg = &state->regs[i]; - if (reg->type == type && reg->id == dst_reg->id) - /* keep the maximum range already checked */ - reg->range = max(reg->range, new_range); - } - - bpf_for_each_spilled_reg(i, state, reg) { - if (!reg) - continue; - if (reg->type == type && reg->id == dst_reg->id) - reg->range = max(reg->range, new_range); - } -} - static void find_good_pkt_pointers(struct bpf_verifier_state *vstate, struct bpf_reg_state *dst_reg, enum bpf_reg_type type, bool range_right_open) { - int new_range, i; + struct bpf_func_state *state; + struct bpf_reg_state *reg; + int new_range; if (dst_reg->off < 0 || (dst_reg->off == 0 && range_right_open)) @@ -9333,9 +9293,11 @@ * the range won't allow anything. * dst_reg->off is known < MAX_PACKET_OFF, therefore it fits in a u16. */ - for (i = 0; i <= vstate->curframe; i++) - __find_good_pkt_pointers(vstate->frame[i], dst_reg, type, - new_range); + bpf_for_each_reg_in_vstate(vstate, state, reg, ({ + if (reg->type == type && reg->id == dst_reg->id) + /* keep the maximum range already checked */ + reg->range = max(reg->range, new_range); + })); } static int is_branch32_taken(struct bpf_reg_state *reg, u32 val, u8 opcode) @@ -9824,7 +9786,7 @@ if (!reg_may_point_to_spin_lock(reg)) { /* For not-NULL ptr, reg->ref_obj_id will be reset - * in release_reg_references(). + * in release_reference(). * * reg->id is still used by spin_lock ptr. Other * than spin_lock ptr type, reg->id can be reset. @@ -9834,22 +9796,6 @@ } } -static void __mark_ptr_or_null_regs(struct bpf_func_state *state, u32 id, - bool is_null) -{ - struct bpf_reg_state *reg; - int i; - - for (i = 0; i < MAX_BPF_REG; i++) - mark_ptr_or_null_reg(state, &state->regs[i], id, is_null); - - bpf_for_each_spilled_reg(i, state, reg) { - if (!reg) - continue; - mark_ptr_or_null_reg(state, reg, id, is_null); - } -} - /* The logic is similar to find_good_pkt_pointers(), both could eventually * be folded together at some point. */ @@ -9857,10 +9803,9 @@ bool is_null) { struct bpf_func_state *state = vstate->frame[vstate->curframe]; - struct bpf_reg_state *regs = state->regs; + struct bpf_reg_state *regs = state->regs, *reg; u32 ref_obj_id = regs[regno].ref_obj_id; u32 id = regs[regno].id; - int i; if (ref_obj_id && ref_obj_id == id && is_null) /* regs[regno] is in the " == NULL" branch. @@ -9869,8 +9814,9 @@ */ WARN_ON_ONCE(release_reference_state(state, id)); - for (i = 0; i <= vstate->curframe; i++) - __mark_ptr_or_null_regs(vstate->frame[i], id, is_null); + bpf_for_each_reg_in_vstate(vstate, state, reg, ({ + mark_ptr_or_null_reg(state, reg, id, is_null); + })); } static bool try_match_pkt_pointers(const struct bpf_insn *insn, @@ -9983,23 +9929,11 @@ { struct bpf_func_state *state; struct bpf_reg_state *reg; - int i, j; - for (i = 0; i <= vstate->curframe; i++) { - state = vstate->frame[i]; - for (j = 0; j < MAX_BPF_REG; j++) { - reg = &state->regs[j]; - if (reg->type == SCALAR_VALUE && reg->id == known_reg->id) - *reg = *known_reg; - } - - bpf_for_each_spilled_reg(j, state, reg) { - if (!reg) - continue; - if (reg->type == SCALAR_VALUE && reg->id == known_reg->id) - *reg = *known_reg; - } - } + bpf_for_each_reg_in_vstate(vstate, state, reg, ({ + if (reg->type == SCALAR_VALUE && reg->id == known_reg->id) + *reg = *known_reg; + })); } static int check_cond_jmp_op(struct bpf_verifier_env *env, diff -u linux-kvm-5.19.0/kernel/events/core.c linux-kvm-5.19.0/kernel/events/core.c --- linux-kvm-5.19.0/kernel/events/core.c +++ linux-kvm-5.19.0/kernel/events/core.c @@ -8987,7 +8987,7 @@ PERF_RECORD_KSYMBOL_TYPE_BPF, (u64)(unsigned long)subprog->bpf_func, subprog->jited_len, unregister, - prog->aux->ksym.name); + subprog->aux->ksym.name); } } } @@ -9263,14 +9263,27 @@ } if (event->attr.sigtrap) { - /* - * Should not be able to return to user space without processing - * pending_sigtrap (kernel events can overflow multiple times). - */ - WARN_ON_ONCE(event->pending_sigtrap && event->attr.exclude_kernel); + unsigned int pending_id = 1; + + if (regs) + pending_id = hash32_ptr((void *)instruction_pointer(regs)) ?: 1; if (!event->pending_sigtrap) { - event->pending_sigtrap = 1; + event->pending_sigtrap = pending_id; local_inc(&event->ctx->nr_pending); + } else if (event->attr.exclude_kernel) { + /* + * Should not be able to return to user space without + * consuming pending_sigtrap; with exceptions: + * + * 1. Where !exclude_kernel, events can overflow again + * in the kernel without returning to user space. + * + * 2. Events that can overflow again before the IRQ- + * work without user space progress (e.g. hrtimer). + * To approximate progress (with false negatives), + * check 32-bit hash of the current IP. + */ + WARN_ON_ONCE(event->pending_sigtrap != pending_id); } event->pending_addr = data->addr; irq_work_queue(&event->pending_irq); diff -u linux-kvm-5.19.0/kernel/kprobes.c linux-kvm-5.19.0/kernel/kprobes.c --- linux-kvm-5.19.0/kernel/kprobes.c +++ linux-kvm-5.19.0/kernel/kprobes.c @@ -1762,7 +1762,13 @@ if ((list_p != p) && (list_p->post_handler)) goto noclean; } - ap->post_handler = NULL; + /* + * For the kprobe-on-ftrace case, we keep the + * post_handler setting to identify this aggrprobe + * armed with kprobe_ipmodify_ops. + */ + if (!kprobe_ftrace(ap)) + ap->post_handler = NULL; } noclean: /* diff -u linux-kvm-5.19.0/kernel/trace/bpf_trace.c linux-kvm-5.19.0/kernel/trace/bpf_trace.c --- linux-kvm-5.19.0/kernel/trace/bpf_trace.c +++ linux-kvm-5.19.0/kernel/trace/bpf_trace.c @@ -2058,9 +2058,15 @@ void __bpf_trace_run(struct bpf_prog *prog, u64 *args) { cant_sleep(); + if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) { + bpf_prog_inc_misses_counter(prog); + goto out; + } rcu_read_lock(); (void) bpf_prog_run(prog, args); rcu_read_unlock(); +out: + this_cpu_dec(*(prog->active)); } #define UNPACK(...) __VA_ARGS__ diff -u linux-kvm-5.19.0/kernel/trace/ftrace.c linux-kvm-5.19.0/kernel/trace/ftrace.c --- linux-kvm-5.19.0/kernel/trace/ftrace.c +++ linux-kvm-5.19.0/kernel/trace/ftrace.c @@ -1289,6 +1289,7 @@ if (!ftrace_mod) return -ENOMEM; + INIT_LIST_HEAD(&ftrace_mod->list); ftrace_mod->func = kstrdup(func, GFP_KERNEL); ftrace_mod->module = kstrdup(module, GFP_KERNEL); ftrace_mod->enable = enable; @@ -3188,7 +3189,7 @@ /* if we can't allocate this size, try something smaller */ if (!order) return -ENOMEM; - order >>= 1; + order--; goto again; } @@ -7314,7 +7315,7 @@ } pr_info("ftrace: allocating %ld entries in %ld pages\n", - count, count / ENTRIES_PER_PAGE + 1); + count, DIV_ROUND_UP(count, ENTRIES_PER_PAGE)); ret = ftrace_process_locs(NULL, __start_mcount_loc, diff -u linux-kvm-5.19.0/kernel/trace/kprobe_event_gen_test.c linux-kvm-5.19.0/kernel/trace/kprobe_event_gen_test.c --- linux-kvm-5.19.0/kernel/trace/kprobe_event_gen_test.c +++ linux-kvm-5.19.0/kernel/trace/kprobe_event_gen_test.c @@ -73,6 +73,10 @@ #define KPROBE_GEN_TEST_ARG3 NULL #endif +static bool trace_event_file_is_valid(struct trace_event_file *input) +{ + return input && !IS_ERR(input); +} /* * Test to make sure we can create a kprobe event, then add more @@ -139,6 +143,8 @@ kfree(buf); return ret; delete: + if (trace_event_file_is_valid(gen_kprobe_test)) + gen_kprobe_test = NULL; /* We got an error after creating the event, delete it */ ret = kprobe_event_delete("gen_kprobe_test"); goto out; @@ -202,6 +208,8 @@ kfree(buf); return ret; delete: + if (trace_event_file_is_valid(gen_kretprobe_test)) + gen_kretprobe_test = NULL; /* We got an error after creating the event, delete it */ ret = kprobe_event_delete("gen_kretprobe_test"); goto out; @@ -217,10 +225,12 @@ ret = test_gen_kretprobe_cmd(); if (ret) { - WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, - "kprobes", - "gen_kretprobe_test", false)); - trace_put_event_file(gen_kretprobe_test); + if (trace_event_file_is_valid(gen_kretprobe_test)) { + WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, + "kprobes", + "gen_kretprobe_test", false)); + trace_put_event_file(gen_kretprobe_test); + } WARN_ON(kprobe_event_delete("gen_kretprobe_test")); } @@ -229,24 +239,30 @@ static void __exit kprobe_event_gen_test_exit(void) { - /* Disable the event or you can't remove it */ - WARN_ON(trace_array_set_clr_event(gen_kprobe_test->tr, - "kprobes", - "gen_kprobe_test", false)); + if (trace_event_file_is_valid(gen_kprobe_test)) { + /* Disable the event or you can't remove it */ + WARN_ON(trace_array_set_clr_event(gen_kprobe_test->tr, + "kprobes", + "gen_kprobe_test", false)); + + /* Now give the file and instance back */ + trace_put_event_file(gen_kprobe_test); + } - /* Now give the file and instance back */ - trace_put_event_file(gen_kprobe_test); /* Now unregister and free the event */ WARN_ON(kprobe_event_delete("gen_kprobe_test")); - /* Disable the event or you can't remove it */ - WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, - "kprobes", - "gen_kretprobe_test", false)); + if (trace_event_file_is_valid(gen_kretprobe_test)) { + /* Disable the event or you can't remove it */ + WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr, + "kprobes", + "gen_kretprobe_test", false)); + + /* Now give the file and instance back */ + trace_put_event_file(gen_kretprobe_test); + } - /* Now give the file and instance back */ - trace_put_event_file(gen_kretprobe_test); /* Now unregister and free the event */ WARN_ON(kprobe_event_delete("gen_kretprobe_test")); diff -u linux-kvm-5.19.0/kernel/trace/ring_buffer.c linux-kvm-5.19.0/kernel/trace/ring_buffer.c --- linux-kvm-5.19.0/kernel/trace/ring_buffer.c +++ linux-kvm-5.19.0/kernel/trace/ring_buffer.c @@ -519,6 +519,7 @@ local_t committing; local_t commits; local_t pages_touched; + local_t pages_lost; local_t pages_read; long last_pages_touch; size_t shortest_full; @@ -894,10 +895,18 @@ size_t ring_buffer_nr_dirty_pages(struct trace_buffer *buffer, int cpu) { size_t read; + size_t lost; size_t cnt; read = local_read(&buffer->buffers[cpu]->pages_read); + lost = local_read(&buffer->buffers[cpu]->pages_lost); cnt = local_read(&buffer->buffers[cpu]->pages_touched); + + if (WARN_ON_ONCE(cnt < lost)) + return 0; + + cnt -= lost; + /* The reader can read an empty page, but not more than that */ if (cnt < read) { WARN_ON_ONCE(read > cnt + 1); @@ -907,6 +916,21 @@ return cnt - read; } +static __always_inline bool full_hit(struct trace_buffer *buffer, int cpu, int full) +{ + struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu]; + size_t nr_pages; + size_t dirty; + + nr_pages = cpu_buffer->nr_pages; + if (!nr_pages || !full) + return true; + + dirty = ring_buffer_nr_dirty_pages(buffer, cpu); + + return (dirty * 100) > (full * nr_pages); +} + /* * rb_wake_up_waiters - wake up tasks waiting for ring buffer input * @@ -1046,22 +1070,20 @@ !ring_buffer_empty_cpu(buffer, cpu)) { unsigned long flags; bool pagebusy; - size_t nr_pages; - size_t dirty; + bool done; if (!full) break; raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; - nr_pages = cpu_buffer->nr_pages; - dirty = ring_buffer_nr_dirty_pages(buffer, cpu); + done = !pagebusy && full_hit(buffer, cpu, full); + if (!cpu_buffer->shortest_full || cpu_buffer->shortest_full > full) cpu_buffer->shortest_full = full; raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); - if (!pagebusy && - (!nr_pages || (dirty * 100) > full * nr_pages)) + if (done) break; } @@ -1087,6 +1109,7 @@ * @cpu: the cpu buffer to wait on * @filp: the file descriptor * @poll_table: The poll descriptor + * @full: wait until the percentage of pages are available, if @cpu != RING_BUFFER_ALL_CPUS * * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon * as data is added to any of the @buffer's cpu buffers. Otherwise @@ -1096,14 +1119,15 @@ * zero otherwise. */ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, - struct file *filp, poll_table *poll_table) + struct file *filp, poll_table *poll_table, int full) { struct ring_buffer_per_cpu *cpu_buffer; struct rb_irq_work *work; - if (cpu == RING_BUFFER_ALL_CPUS) + if (cpu == RING_BUFFER_ALL_CPUS) { work = &buffer->irq_work; - else { + full = 0; + } else { if (!cpumask_test_cpu(cpu, buffer->cpumask)) return -EINVAL; @@ -1111,8 +1135,14 @@ work = &cpu_buffer->irq_work; } - poll_wait(filp, &work->waiters, poll_table); - work->waiters_pending = true; + if (full) { + poll_wait(filp, &work->full_waiters, poll_table); + work->full_waiters_pending = true; + } else { + poll_wait(filp, &work->waiters, poll_table); + work->waiters_pending = true; + } + /* * There's a tight race between setting the waiters_pending and * checking if the ring buffer is empty. Once the waiters_pending bit @@ -1128,6 +1158,9 @@ */ smp_mb(); + if (full) + return full_hit(buffer, cpu, full) ? EPOLLIN | EPOLLRDNORM : 0; + if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) || (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu))) return EPOLLIN | EPOLLRDNORM; @@ -1769,9 +1802,9 @@ free_buffer_page(cpu_buffer->reader_page); - rb_head_page_deactivate(cpu_buffer); - if (head) { + rb_head_page_deactivate(cpu_buffer); + list_for_each_entry_safe(bpage, tmp, head, list) { list_del_init(&bpage->list); free_buffer_page(bpage); @@ -2007,6 +2040,7 @@ */ local_add(page_entries, &cpu_buffer->overrun); local_sub(BUF_PAGE_SIZE, &cpu_buffer->entries_bytes); + local_inc(&cpu_buffer->pages_lost); } /* @@ -2491,6 +2525,7 @@ */ local_add(entries, &cpu_buffer->overrun); local_sub(BUF_PAGE_SIZE, &cpu_buffer->entries_bytes); + local_inc(&cpu_buffer->pages_lost); /* * The entries will be zeroed out when we move the @@ -3155,10 +3190,6 @@ static __always_inline void rb_wakeups(struct trace_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer) { - size_t nr_pages; - size_t dirty; - size_t full; - if (buffer->irq_work.waiters_pending) { buffer->irq_work.waiters_pending = false; /* irq_work_queue() supplies it's own memory barriers */ @@ -3182,10 +3213,7 @@ cpu_buffer->last_pages_touch = local_read(&cpu_buffer->pages_touched); - full = cpu_buffer->shortest_full; - nr_pages = cpu_buffer->nr_pages; - dirty = ring_buffer_nr_dirty_pages(buffer, cpu_buffer->cpu); - if (full && nr_pages && (dirty * 100) <= full * nr_pages) + if (!full_hit(buffer, cpu_buffer->cpu, cpu_buffer->shortest_full)) return; cpu_buffer->irq_work.wakeup_full = true; @@ -5248,6 +5276,7 @@ local_set(&cpu_buffer->committing, 0); local_set(&cpu_buffer->commits, 0); local_set(&cpu_buffer->pages_touched, 0); + local_set(&cpu_buffer->pages_lost, 0); local_set(&cpu_buffer->pages_read, 0); cpu_buffer->last_pages_touch = 0; cpu_buffer->shortest_full = 0; diff -u linux-kvm-5.19.0/kernel/trace/trace.c linux-kvm-5.19.0/kernel/trace/trace.c --- linux-kvm-5.19.0/kernel/trace/trace.c +++ linux-kvm-5.19.0/kernel/trace/trace.c @@ -6657,6 +6657,7 @@ mutex_unlock(&trace_types_lock); free_cpumask_var(iter->started); + kfree(iter->fmt); mutex_destroy(&iter->mutex); kfree(iter); @@ -6681,7 +6682,7 @@ return EPOLLIN | EPOLLRDNORM; else return ring_buffer_poll_wait(iter->array_buffer->buffer, iter->cpu_file, - filp, poll_table); + filp, poll_table, iter->tr->buffer_percent); } static __poll_t @@ -7802,6 +7803,7 @@ int len) { struct tracing_log_err *err; + char *cmd; if (tr->n_err_log_entries < TRACING_LOG_ERRS_MAX) { err = alloc_tracing_log_err(len); @@ -7810,12 +7812,12 @@ return err; } - + cmd = kzalloc(len, GFP_KERNEL); + if (!cmd) + return ERR_PTR(-ENOMEM); err = list_first_entry(&tr->err_log, struct tracing_log_err, list); kfree(err->cmd); - err->cmd = kzalloc(len, GFP_KERNEL); - if (!err->cmd) - return ERR_PTR(-ENOMEM); + err->cmd = cmd; list_del(&err->list); return err; diff -u linux-kvm-5.19.0/kernel/trace/trace_eprobe.c linux-kvm-5.19.0/kernel/trace/trace_eprobe.c --- linux-kvm-5.19.0/kernel/trace/trace_eprobe.c +++ linux-kvm-5.19.0/kernel/trace/trace_eprobe.c @@ -559,6 +559,9 @@ { struct eprobe_data *edata = data->private_data; + if (unlikely(!rec)) + return; + __eprobe_trace_func(edata, rec); } diff -u linux-kvm-5.19.0/kernel/trace/trace_events.c linux-kvm-5.19.0/kernel/trace/trace_events.c --- linux-kvm-5.19.0/kernel/trace/trace_events.c +++ linux-kvm-5.19.0/kernel/trace/trace_events.c @@ -2880,7 +2880,10 @@ * TRACE_REG_UNREGISTER. */ if (file->flags & EVENT_FILE_FL_ENABLED) - return -EBUSY; + goto busy; + + if (file->flags & EVENT_FILE_FL_WAS_ENABLED) + tr->clear_trace = true; /* * The do_for_each_event_file_safe() is * a double loop. After finding the call for this @@ -2893,6 +2896,12 @@ __trace_remove_event_call(call); return 0; + busy: + /* No need to clear the trace now */ + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + tr->clear_trace = false; + } + return -EBUSY; } /* Remove an event_call */ diff -u linux-kvm-5.19.0/kernel/trace/trace_events_synth.c linux-kvm-5.19.0/kernel/trace/trace_events_synth.c --- linux-kvm-5.19.0/kernel/trace/trace_events_synth.c +++ linux-kvm-5.19.0/kernel/trace/trace_events_synth.c @@ -828,10 +828,9 @@ } ret = set_synth_event_print_fmt(call); - if (ret < 0) { + /* unregister_trace_event() will be called inside */ + if (ret < 0) trace_remove_event_call(call); - goto err; - } out: return ret; err: diff -u linux-kvm-5.19.0/kernel/trace/trace_osnoise.c linux-kvm-5.19.0/kernel/trace/trace_osnoise.c --- linux-kvm-5.19.0/kernel/trace/trace_osnoise.c +++ linux-kvm-5.19.0/kernel/trace/trace_osnoise.c @@ -917,7 +917,7 @@ void osnoise_trace_irq_exit(int id, const char *desc) { struct osnoise_variables *osn_var = this_cpu_osn_var(); - int duration; + s64 duration; if (!osn_var->sampling) return; @@ -1048,7 +1048,7 @@ static void trace_softirq_exit_callback(void *data, unsigned int vec_nr) { struct osnoise_variables *osn_var = this_cpu_osn_var(); - int duration; + s64 duration; if (!osn_var->sampling) return; @@ -1144,7 +1144,7 @@ static void thread_exit(struct osnoise_variables *osn_var, struct task_struct *t) { - int duration; + s64 duration; if (!osn_var->sampling) return; diff -u linux-kvm-5.19.0/lib/Kconfig.debug linux-kvm-5.19.0/lib/Kconfig.debug --- linux-kvm-5.19.0/lib/Kconfig.debug +++ linux-kvm-5.19.0/lib/Kconfig.debug @@ -398,6 +398,7 @@ default 2048 if GCC_PLUGIN_LATENT_ENTROPY default 2048 if PARISC default 1536 if (!64BIT && XTENSA) + default 1280 if KASAN && !64BIT default 1024 if !64BIT default 2048 if 64BIT help @@ -1854,8 +1855,14 @@ If unsure, say N. config FUNCTION_ERROR_INJECTION - def_bool y + bool "Fault-injections of functions" depends on HAVE_FUNCTION_ERROR_INJECTION && KPROBES + help + Add fault injections into various functions that are annotated with + ALLOW_ERROR_INJECTION() in the kernel. BPF may also modify the return + value of theses functions. This is useful to test error paths of code. + + If unsure, say N config FAULT_INJECTION bool "Fault-injection framework" @@ -2075,6 +2082,7 @@ depends on DEBUG_KERNEL depends on KPROBES depends on KUNIT + select STACKTRACE if ARCH_CORRECT_STACKTRACE_ON_KRETPROBE default KUNIT_ALL_TESTS help This option provides for testing basic kprobes functionality on diff -u linux-kvm-5.19.0/mm/damon/dbgfs.c linux-kvm-5.19.0/mm/damon/dbgfs.c --- linux-kvm-5.19.0/mm/damon/dbgfs.c +++ linux-kvm-5.19.0/mm/damon/dbgfs.c @@ -851,6 +851,7 @@ static int dbgfs_rm_context(char *name) { struct dentry *root, *dir, **new_dirs; + struct inode *inode; struct damon_ctx **new_ctxs; int i, j; int ret = 0; @@ -866,6 +867,12 @@ if (!dir) return -ENOENT; + inode = d_inode(dir); + if (!S_ISDIR(inode->i_mode)) { + ret = -EINVAL; + goto out_dput; + } + new_dirs = kmalloc_array(dbgfs_nr_ctxs - 1, sizeof(*dbgfs_dirs), GFP_KERNEL); if (!new_dirs) { diff -u linux-kvm-5.19.0/mm/damon/sysfs.c linux-kvm-5.19.0/mm/damon/sysfs.c --- linux-kvm-5.19.0/mm/damon/sysfs.c +++ linux-kvm-5.19.0/mm/damon/sysfs.c @@ -2286,12 +2286,54 @@ sysfs_scheme->action, "a, &wmarks); } +static void damon_sysfs_update_scheme(struct damos *scheme, + struct damon_sysfs_scheme *sysfs_scheme) +{ + struct damon_sysfs_access_pattern *access_pattern = + sysfs_scheme->access_pattern; + struct damon_sysfs_quotas *sysfs_quotas = sysfs_scheme->quotas; + struct damon_sysfs_weights *sysfs_weights = sysfs_quotas->weights; + struct damon_sysfs_watermarks *sysfs_wmarks = sysfs_scheme->watermarks; + + scheme->pattern.min_sz_region = access_pattern->sz->min; + scheme->pattern.max_sz_region = access_pattern->sz->max; + scheme->pattern.min_nr_accesses = access_pattern->nr_accesses->min; + scheme->pattern.max_nr_accesses = access_pattern->nr_accesses->max; + scheme->pattern.min_age_region = access_pattern->age->min; + scheme->pattern.max_age_region = access_pattern->age->max; + + scheme->action = sysfs_scheme->action; + + scheme->quota.ms = sysfs_quotas->ms; + scheme->quota.sz = sysfs_quotas->sz; + scheme->quota.reset_interval = sysfs_quotas->reset_interval_ms; + scheme->quota.weight_sz = sysfs_weights->sz; + scheme->quota.weight_nr_accesses = sysfs_weights->nr_accesses; + scheme->quota.weight_age = sysfs_weights->age; + + scheme->wmarks.metric = sysfs_wmarks->metric; + scheme->wmarks.interval = sysfs_wmarks->interval_us; + scheme->wmarks.high = sysfs_wmarks->high; + scheme->wmarks.mid = sysfs_wmarks->mid; + scheme->wmarks.low = sysfs_wmarks->low; +} + static int damon_sysfs_set_schemes(struct damon_ctx *ctx, struct damon_sysfs_schemes *sysfs_schemes) { - int i; + struct damos *scheme, *next; + int i = 0; - for (i = 0; i < sysfs_schemes->nr; i++) { + damon_for_each_scheme_safe(scheme, next, ctx) { + if (i < sysfs_schemes->nr) + damon_sysfs_update_scheme(scheme, + sysfs_schemes->schemes_arr[i]); + else + damon_destroy_scheme(scheme); + i++; + } + + for (; i < sysfs_schemes->nr; i++) { struct damos *scheme, *next; scheme = damon_sysfs_mk_scheme(sysfs_schemes->schemes_arr[i]); @@ -2342,6 +2384,10 @@ damon_for_each_scheme(scheme, ctx) { struct damon_sysfs_stats *sysfs_stats; + /* user could have removed the scheme sysfs dir */ + if (schemes_idx >= sysfs_schemes->nr) + break; + sysfs_stats = sysfs_schemes->schemes_arr[schemes_idx++]->stats; sysfs_stats->nr_tried = scheme->stat.nr_tried; sysfs_stats->sz_tried = scheme->stat.sz_tried; diff -u linux-kvm-5.19.0/mm/filemap.c linux-kvm-5.19.0/mm/filemap.c --- linux-kvm-5.19.0/mm/filemap.c +++ linux-kvm-5.19.0/mm/filemap.c @@ -3753,7 +3753,7 @@ unsigned long offset; /* Offset into pagecache page */ unsigned long bytes; /* Bytes to write to page */ size_t copied; /* Bytes copied from user */ - void *fsdata; + void *fsdata = NULL; offset = (pos & (PAGE_SIZE - 1)); bytes = min_t(unsigned long, PAGE_SIZE - offset, diff -u linux-kvm-5.19.0/mm/hugetlb.c linux-kvm-5.19.0/mm/hugetlb.c --- linux-kvm-5.19.0/mm/hugetlb.c +++ linux-kvm-5.19.0/mm/hugetlb.c @@ -6006,6 +6006,10 @@ ptl = huge_pte_lockptr(h, dst_mm, dst_pte); spin_lock(ptl); + ret = -EIO; + if (PageHWPoison(page)) + goto out_release_unlock; + /* * Recheck the i_size after holding PT lock to make sure not * to leave any page mapped (as page_mapped()) beyond the end diff -u linux-kvm-5.19.0/mm/memory-failure.c linux-kvm-5.19.0/mm/memory-failure.c --- linux-kvm-5.19.0/mm/memory-failure.c +++ linux-kvm-5.19.0/mm/memory-failure.c @@ -1034,6 +1034,7 @@ int res; struct page *hpage = compound_head(p); struct address_space *mapping; + bool extra_pins = false; if (!PageHuge(hpage)) return MF_DELAYED; @@ -1041,6 +1042,8 @@ mapping = page_mapping(hpage); if (mapping) { res = truncate_error_page(hpage, page_to_pfn(p), mapping); + /* The page is kept in page cache. */ + extra_pins = true; unlock_page(hpage); } else { res = MF_FAILED; @@ -1057,7 +1060,7 @@ } } - if (has_extra_refcount(ps, p, false)) + if (has_extra_refcount(ps, p, extra_pins)) res = MF_FAILED; return res; diff -u linux-kvm-5.19.0/mm/memremap.c linux-kvm-5.19.0/mm/memremap.c --- linux-kvm-5.19.0/mm/memremap.c +++ linux-kvm-5.19.0/mm/memremap.c @@ -320,6 +320,7 @@ WARN(1, "File system DAX not supported\n"); return ERR_PTR(-EINVAL); } + params.pgprot = pgprot_decrypted(params.pgprot); break; case MEMORY_DEVICE_GENERIC: break; diff -u linux-kvm-5.19.0/mm/page_alloc.c linux-kvm-5.19.0/mm/page_alloc.c --- linux-kvm-5.19.0/mm/page_alloc.c +++ linux-kvm-5.19.0/mm/page_alloc.c @@ -3797,6 +3797,8 @@ static bool __should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) { + int flags = 0; + if (order < fail_page_alloc.min_order) return false; if (gfp_mask & __GFP_NOFAIL) @@ -3807,10 +3809,11 @@ (gfp_mask & __GFP_DIRECT_RECLAIM)) return false; + /* See comment in __should_failslab() */ if (gfp_mask & __GFP_NOWARN) - fail_page_alloc.attr.no_warn = true; + flags |= FAULT_NOWARN; - return should_fail(&fail_page_alloc.attr, 1 << order); + return should_fail_ex(&fail_page_alloc.attr, 1 << order, flags); } #ifdef CONFIG_FAULT_INJECTION_DEBUG_FS diff -u linux-kvm-5.19.0/mm/userfaultfd.c linux-kvm-5.19.0/mm/userfaultfd.c --- linux-kvm-5.19.0/mm/userfaultfd.c +++ linux-kvm-5.19.0/mm/userfaultfd.c @@ -64,7 +64,7 @@ pte_t _dst_pte, *dst_pte; bool writable = dst_vma->vm_flags & VM_WRITE; bool vm_shared = dst_vma->vm_flags & VM_SHARED; - bool page_in_cache = page->mapping; + bool page_in_cache = page_mapping(page); spinlock_t *ptl; struct inode *inode; pgoff_t offset, max_off; diff -u linux-kvm-5.19.0/net/9p/trans_fd.c linux-kvm-5.19.0/net/9p/trans_fd.c --- linux-kvm-5.19.0/net/9p/trans_fd.c +++ linux-kvm-5.19.0/net/9p/trans_fd.c @@ -91,6 +91,7 @@ * @mux_list: list link for mux to manage multiple connections (?) * @client: reference to client instance for this connection * @err: error state + * @req_lock: lock protecting req_list and requests statuses * @req_list: accounting for requests which have been sent * @unsent_req_list: accounting for requests that haven't been sent * @rreq: read request @@ -114,6 +115,7 @@ struct list_head mux_list; struct p9_client *client; int err; + spinlock_t req_lock; struct list_head req_list; struct list_head unsent_req_list; struct p9_req_t *rreq; @@ -189,10 +191,10 @@ p9_debug(P9_DEBUG_ERROR, "mux %p err %d\n", m, err); - spin_lock(&m->client->lock); + spin_lock(&m->req_lock); if (m->err) { - spin_unlock(&m->client->lock); + spin_unlock(&m->req_lock); return; } @@ -200,11 +202,15 @@ list_for_each_entry_safe(req, rtmp, &m->req_list, req_list) { list_move(&req->req_list, &cancel_list); + req->status = REQ_STATUS_ERROR; } list_for_each_entry_safe(req, rtmp, &m->unsent_req_list, req_list) { list_move(&req->req_list, &cancel_list); + req->status = REQ_STATUS_ERROR; } + spin_unlock(&m->req_lock); + list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) { p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req); list_del(&req->req_list); @@ -212,7 +218,6 @@ req->t_err = err; p9_client_cb(m->client, req, REQ_STATUS_ERROR); } - spin_unlock(&m->client->lock); } static __poll_t @@ -359,7 +364,7 @@ if ((m->rreq) && (m->rc.offset == m->rc.capacity)) { p9_debug(P9_DEBUG_TRANS, "got new packet\n"); m->rreq->rc.size = m->rc.offset; - spin_lock(&m->client->lock); + spin_lock(&m->req_lock); if (m->rreq->status == REQ_STATUS_SENT) { list_del(&m->rreq->req_list); p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD); @@ -368,14 +373,14 @@ p9_debug(P9_DEBUG_TRANS, "Ignore replies associated with a cancelled request\n"); } else { - spin_unlock(&m->client->lock); + spin_unlock(&m->req_lock); p9_debug(P9_DEBUG_ERROR, "Request tag %d errored out while we were reading the reply\n", m->rc.tag); err = -EIO; goto error; } - spin_unlock(&m->client->lock); + spin_unlock(&m->req_lock); m->rc.sdata = NULL; m->rc.offset = 0; m->rc.capacity = 0; @@ -453,10 +458,10 @@ } if (!m->wsize) { - spin_lock(&m->client->lock); + spin_lock(&m->req_lock); if (list_empty(&m->unsent_req_list)) { clear_bit(Wworksched, &m->wsched); - spin_unlock(&m->client->lock); + spin_unlock(&m->req_lock); return; } @@ -471,7 +476,7 @@ m->wpos = 0; p9_req_get(req); m->wreq = req; - spin_unlock(&m->client->lock); + spin_unlock(&m->req_lock); } p9_debug(P9_DEBUG_TRANS, "mux %p pos %d size %d\n", @@ -588,6 +593,7 @@ INIT_LIST_HEAD(&m->mux_list); m->client = client; + spin_lock_init(&m->req_lock); INIT_LIST_HEAD(&m->req_list); INIT_LIST_HEAD(&m->unsent_req_list); INIT_WORK(&m->rq, p9_read_work); @@ -669,10 +675,10 @@ if (m->err < 0) return m->err; - spin_lock(&client->lock); + spin_lock(&m->req_lock); req->status = REQ_STATUS_UNSENT; list_add_tail(&req->req_list, &m->unsent_req_list); - spin_unlock(&client->lock); + spin_unlock(&m->req_lock); if (test_and_clear_bit(Wpending, &m->wsched)) n = EPOLLOUT; @@ -687,11 +693,13 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req) { + struct p9_trans_fd *ts = client->trans; + struct p9_conn *m = &ts->conn; int ret = 1; p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req); - spin_lock(&client->lock); + spin_lock(&m->req_lock); if (req->status == REQ_STATUS_UNSENT) { list_del(&req->req_list); @@ -699,21 +707,24 @@ p9_req_put(client, req); ret = 0; } - spin_unlock(&client->lock); + spin_unlock(&m->req_lock); return ret; } static int p9_fd_cancelled(struct p9_client *client, struct p9_req_t *req) { + struct p9_trans_fd *ts = client->trans; + struct p9_conn *m = &ts->conn; + p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req); - spin_lock(&client->lock); + spin_lock(&m->req_lock); /* Ignore cancelled request if message has been received * before lock. */ if (req->status == REQ_STATUS_RCVD) { - spin_unlock(&client->lock); + spin_unlock(&m->req_lock); return 0; } @@ -722,7 +733,8 @@ */ list_del(&req->req_list); req->status = REQ_STATUS_FLSHD; - spin_unlock(&client->lock); + spin_unlock(&m->req_lock); + p9_req_put(client, req); return 0; @@ -821,11 +833,14 @@ goto out_free_ts; if (!(ts->rd->f_mode & FMODE_READ)) goto out_put_rd; + /* prevent workers from hanging on IO when fd is a pipe */ + ts->rd->f_flags |= O_NONBLOCK; ts->wr = fget(wfd); if (!ts->wr) goto out_put_rd; if (!(ts->wr->f_mode & FMODE_WRITE)) goto out_put_wr; + ts->wr->f_flags |= O_NONBLOCK; client->trans = ts; client->status = Connected; @@ -847,8 +862,10 @@ struct file *file; p = kzalloc(sizeof(struct p9_trans_fd), GFP_KERNEL); - if (!p) + if (!p) { + sock_release(csocket); return -ENOMEM; + } csocket->sk->sk_allocation = GFP_NOIO; file = sock_alloc_file(csocket, 0, NULL); diff -u linux-kvm-5.19.0/net/bpf/test_run.c linux-kvm-5.19.0/net/bpf/test_run.c --- linux-kvm-5.19.0/net/bpf/test_run.c +++ linux-kvm-5.19.0/net/bpf/test_run.c @@ -750,6 +750,7 @@ if (user_size > size) return ERR_PTR(-EMSGSIZE); + size = SKB_DATA_ALIGN(size); data = kzalloc(size + headroom + tailroom, GFP_USER); if (!data) return ERR_PTR(-ENOMEM); diff -u linux-kvm-5.19.0/net/core/flow_dissector.c linux-kvm-5.19.0/net/core/flow_dissector.c --- linux-kvm-5.19.0/net/core/flow_dissector.c +++ linux-kvm-5.19.0/net/core/flow_dissector.c @@ -272,7 +272,7 @@ key->ct_zone = ct->zone.id; #endif #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) - key->ct_mark = ct->mark; + key->ct_mark = READ_ONCE(ct->mark); #endif cl = nf_ct_labels_find(ct); diff -u linux-kvm-5.19.0/net/core/skbuff.c linux-kvm-5.19.0/net/core/skbuff.c --- linux-kvm-5.19.0/net/core/skbuff.c +++ linux-kvm-5.19.0/net/core/skbuff.c @@ -4001,23 +4001,25 @@ int i = 0; int pos; - if (list_skb && !list_skb->head_frag && skb_headlen(list_skb) && - (skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY)) { - /* gso_size is untrusted, and we have a frag_list with a linear - * non head_frag head. - * - * (we assume checking the first list_skb member suffices; - * i.e if either of the list_skb members have non head_frag - * head, then the first one has too). - * - * If head_skb's headlen does not fit requested gso_size, it - * means that the frag_list members do NOT terminate on exact - * gso_size boundaries. Hence we cannot perform skb_frag_t page - * sharing. Therefore we must fallback to copying the frag_list - * skbs; we do so by disabling SG. - */ - if (mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb)) - features &= ~NETIF_F_SG; + if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) && + mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb)) { + struct sk_buff *check_skb; + + for (check_skb = list_skb; check_skb; check_skb = check_skb->next) { + if (skb_headlen(check_skb) && !check_skb->head_frag) { + /* gso_size is untrusted, and we have a frag_list with + * a linear non head_frag item. + * + * If head_skb's headlen does not fit requested gso_size, + * it means that the frag_list members do NOT terminate + * on exact gso_size boundaries. Hence we cannot perform + * skb_frag_t page sharing. Therefore we must fallback to + * copying the frag_list skbs; we do so by disabling SG. + */ + features &= ~NETIF_F_SG; + break; + } + } } __skb_push(head_skb, doffset); diff -u linux-kvm-5.19.0/net/core/skmsg.c linux-kvm-5.19.0/net/core/skmsg.c --- linux-kvm-5.19.0/net/core/skmsg.c +++ linux-kvm-5.19.0/net/core/skmsg.c @@ -724,6 +724,7 @@ psock->eval = __SK_NONE; psock->sk_proto = prot; psock->saved_unhash = prot->unhash; + psock->saved_destroy = prot->destroy; psock->saved_close = prot->close; psock->saved_write_space = sk->sk_write_space; @@ -800,16 +801,13 @@ } } -void sk_psock_stop(struct sk_psock *psock, bool wait) +void sk_psock_stop(struct sk_psock *psock) { spin_lock_bh(&psock->ingress_lock); sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED); sk_psock_cork_free(psock); __sk_psock_zap_ingress(psock); spin_unlock_bh(&psock->ingress_lock); - - if (wait) - cancel_work_sync(&psock->work); } static void sk_psock_done_strp(struct sk_psock *psock); @@ -847,7 +845,7 @@ sk_psock_stop_verdict(sk, psock); write_unlock_bh(&sk->sk_callback_lock); - sk_psock_stop(psock, false); + sk_psock_stop(psock); INIT_RCU_WORK(&psock->rwork, sk_psock_destroy); queue_rcu_work(system_wq, &psock->rwork); diff -u linux-kvm-5.19.0/net/core/sock_map.c linux-kvm-5.19.0/net/core/sock_map.c --- linux-kvm-5.19.0/net/core/sock_map.c +++ linux-kvm-5.19.0/net/core/sock_map.c @@ -1579,6 +1579,29 @@ } EXPORT_SYMBOL_GPL(sock_map_unhash); +void sock_map_destroy(struct sock *sk) +{ + void (*saved_destroy)(struct sock *sk); + struct sk_psock *psock; + + rcu_read_lock(); + psock = sk_psock_get(sk); + if (unlikely(!psock)) { + rcu_read_unlock(); + if (sk->sk_prot->destroy) + sk->sk_prot->destroy(sk); + return; + } + + saved_destroy = psock->saved_destroy; + sock_map_remove_links(sk, psock); + rcu_read_unlock(); + sk_psock_stop(psock); + sk_psock_put(sk, psock); + saved_destroy(sk); +} +EXPORT_SYMBOL_GPL(sock_map_destroy); + void sock_map_close(struct sock *sk, long timeout) { void (*saved_close)(struct sock *sk, long timeout); @@ -1596,9 +1619,10 @@ saved_close = psock->saved_close; sock_map_remove_links(sk, psock); rcu_read_unlock(); - sk_psock_stop(psock, true); - sk_psock_put(sk, psock); + sk_psock_stop(psock); release_sock(sk); + cancel_work_sync(&psock->work); + sk_psock_put(sk, psock); saved_close(sk, timeout); } EXPORT_SYMBOL_GPL(sock_map_close); diff -u linux-kvm-5.19.0/net/dsa/dsa2.c linux-kvm-5.19.0/net/dsa/dsa2.c --- linux-kvm-5.19.0/net/dsa/dsa2.c +++ linux-kvm-5.19.0/net/dsa/dsa2.c @@ -850,6 +850,14 @@ return err; } +static void dsa_switch_teardown_tag_protocol(struct dsa_switch *ds) +{ + const struct dsa_device_ops *tag_ops = ds->dst->tag_ops; + + if (tag_ops->disconnect) + tag_ops->disconnect(ds); +} + static int dsa_switch_setup(struct dsa_switch *ds) { struct dsa_devlink_priv *dl_priv; @@ -953,6 +961,8 @@ ds->slave_mii_bus = NULL; } + dsa_switch_teardown_tag_protocol(ds); + if (ds->ops->teardown) ds->ops->teardown(ds); diff -u linux-kvm-5.19.0/net/dsa/port.c linux-kvm-5.19.0/net/dsa/port.c --- linux-kvm-5.19.0/net/dsa/port.c +++ linux-kvm-5.19.0/net/dsa/port.c @@ -109,6 +109,22 @@ return !err; } +bool dsa_port_supports_hwtstamp(struct dsa_port *dp, struct ifreq *ifr) +{ + struct dsa_switch *ds = dp->ds; + int err; + + if (!ds->ops->port_hwtstamp_get || !ds->ops->port_hwtstamp_set) + return false; + + /* "See through" shim implementations of the "get" method. + * This will clobber the ifreq structure, but we will either return an + * error, or the master will overwrite it with proper values. + */ + err = ds->ops->port_hwtstamp_get(ds, dp->index, ifr); + return err != -EOPNOTSUPP; +} + int dsa_port_set_state(struct dsa_port *dp, u8 state, bool do_fast_age) { struct dsa_switch *ds = dp->ds; diff -u linux-kvm-5.19.0/net/hsr/hsr_forward.c linux-kvm-5.19.0/net/hsr/hsr_forward.c --- linux-kvm-5.19.0/net/hsr/hsr_forward.c +++ linux-kvm-5.19.0/net/hsr/hsr_forward.c @@ -351,17 +351,18 @@ struct hsr_node *node_src) { bool was_multicast_frame; - int res; + int res, recv_len; was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST); hsr_addr_subst_source(node_src, skb); skb_pull(skb, ETH_HLEN); + recv_len = skb->len; res = netif_rx(skb); if (res == NET_RX_DROP) { dev->stats.rx_dropped++; } else { dev->stats.rx_packets++; - dev->stats.rx_bytes += skb->len; + dev->stats.rx_bytes += recv_len; if (was_multicast_frame) dev->stats.multicast++; } diff -u linux-kvm-5.19.0/net/ipv4/esp4_offload.c linux-kvm-5.19.0/net/ipv4/esp4_offload.c --- linux-kvm-5.19.0/net/ipv4/esp4_offload.c +++ linux-kvm-5.19.0/net/ipv4/esp4_offload.c @@ -314,6 +314,9 @@ xo->seq.low += skb_shinfo(skb)->gso_segs; } + if (xo->seq.low < seq) + xo->seq.hi++; + esp.seqno = cpu_to_be64(seq + ((u64)xo->seq.hi << 32)); ip_hdr(skb)->tot_len = htons(skb->len); diff -u linux-kvm-5.19.0/net/ipv4/inet_hashtables.c linux-kvm-5.19.0/net/ipv4/inet_hashtables.c --- linux-kvm-5.19.0/net/ipv4/inet_hashtables.c +++ linux-kvm-5.19.0/net/ipv4/inet_hashtables.c @@ -679,13 +679,13 @@ * Note that we use 32bit integers (vs RFC 'short integers') * because 2^16 is not a multiple of num_ephemeral and this * property might be used by clever attacker. + * * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though - * attacks were since demonstrated, thus we use 65536 instead to really - * give more isolation and privacy, at the expense of 256kB of kernel - * memory. + * attacks were since demonstrated, thus we use 65536 by default instead + * to really give more isolation and privacy, at the expense of 256kB + * of kernel memory. */ -#define INET_TABLE_PERTURB_SHIFT 16 -#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT) +#define INET_TABLE_PERTURB_SIZE (1 << CONFIG_INET_TABLE_PERTURB_ORDER) static u32 *table_perturb; int __inet_hash_connect(struct inet_timewait_death_row *death_row, diff -u linux-kvm-5.19.0/net/ipv4/tcp.c linux-kvm-5.19.0/net/ipv4/tcp.c --- linux-kvm-5.19.0/net/ipv4/tcp.c +++ linux-kvm-5.19.0/net/ipv4/tcp.c @@ -3553,7 +3553,7 @@ case TCP_REPAIR_OPTIONS: if (!tp->repair) err = -EINVAL; - else if (sk->sk_state == TCP_ESTABLISHED) + else if (sk->sk_state == TCP_ESTABLISHED && !tp->bytes_sent) err = tcp_repair_options_est(sk, optval, optlen); else err = -EPERM; diff -u linux-kvm-5.19.0/net/ipv4/tcp_bpf.c linux-kvm-5.19.0/net/ipv4/tcp_bpf.c --- linux-kvm-5.19.0/net/ipv4/tcp_bpf.c +++ linux-kvm-5.19.0/net/ipv4/tcp_bpf.c @@ -278,7 +278,7 @@ { bool cork = false, enospc = sk_msg_full(msg); struct sock *sk_redir; - u32 tosend, delta = 0; + u32 tosend, origsize, sent, delta = 0; u32 eval = __SK_NONE; int ret; @@ -333,10 +333,12 @@ cork = true; psock->cork = NULL; } - sk_msg_return(sk, msg, msg->sg.size); + sk_msg_return(sk, msg, tosend); release_sock(sk); + origsize = msg->sg.size; ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); + sent = origsize - msg->sg.size; if (eval == __SK_REDIRECT) sock_put(sk_redir); @@ -375,7 +377,7 @@ msg->sg.data[msg->sg.start].page_link && msg->sg.data[msg->sg.start].length) { if (eval == __SK_REDIRECT) - sk_mem_charge(sk, msg->sg.size); + sk_mem_charge(sk, tosend - sent); goto more_data; } } @@ -540,6 +542,7 @@ struct proto *base) { prot[TCP_BPF_BASE] = *base; + prot[TCP_BPF_BASE].destroy = sock_map_destroy; prot[TCP_BPF_BASE].close = sock_map_close; prot[TCP_BPF_BASE].recvmsg = tcp_bpf_recvmsg; prot[TCP_BPF_BASE].sock_is_readable = sk_msg_is_readable; diff -u linux-kvm-5.19.0/net/ipv4/tcp_ipv4.c linux-kvm-5.19.0/net/ipv4/tcp_ipv4.c --- linux-kvm-5.19.0/net/ipv4/tcp_ipv4.c +++ linux-kvm-5.19.0/net/ipv4/tcp_ipv4.c @@ -323,6 +323,8 @@ * if necessary. */ tcp_set_state(sk, TCP_CLOSE); + if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK)) + inet_reset_saddr(sk); ip_rt_put(rt); sk->sk_route_caps = 0; inet->inet_dport = 0; diff -u linux-kvm-5.19.0/net/ipv4/tcp_ulp.c linux-kvm-5.19.0/net/ipv4/tcp_ulp.c --- linux-kvm-5.19.0/net/ipv4/tcp_ulp.c +++ linux-kvm-5.19.0/net/ipv4/tcp_ulp.c @@ -139,6 +139,10 @@ if (sk->sk_socket) clear_bit(SOCK_SUPPORT_ZC, &sk->sk_socket->flags); + err = -ENOTCONN; + if (!ulp_ops->clone && sk->sk_state == TCP_LISTEN) + goto out_err; + err = ulp_ops->init(sk); if (err) goto out_err; diff -u linux-kvm-5.19.0/net/ipv6/esp6_offload.c linux-kvm-5.19.0/net/ipv6/esp6_offload.c --- linux-kvm-5.19.0/net/ipv6/esp6_offload.c +++ linux-kvm-5.19.0/net/ipv6/esp6_offload.c @@ -346,6 +346,9 @@ xo->seq.low += skb_shinfo(skb)->gso_segs; } + if (xo->seq.low < seq) + xo->seq.hi++; + esp.seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32)); len = skb->len - sizeof(struct ipv6hdr); diff -u linux-kvm-5.19.0/net/ipv6/tcp_ipv6.c linux-kvm-5.19.0/net/ipv6/tcp_ipv6.c --- linux-kvm-5.19.0/net/ipv6/tcp_ipv6.c +++ linux-kvm-5.19.0/net/ipv6/tcp_ipv6.c @@ -342,6 +342,8 @@ late_failure: tcp_set_state(sk, TCP_CLOSE); + if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK)) + inet_reset_saddr(sk); failure: inet->inet_dport = 0; sk->sk_route_caps = 0; diff -u linux-kvm-5.19.0/net/kcm/kcmsock.c linux-kvm-5.19.0/net/kcm/kcmsock.c --- linux-kvm-5.19.0/net/kcm/kcmsock.c +++ linux-kvm-5.19.0/net/kcm/kcmsock.c @@ -222,7 +222,7 @@ struct sk_buff *skb; struct kcm_sock *kcm; - while ((skb = __skb_dequeue(head))) { + while ((skb = skb_dequeue(head))) { /* Reset destructor to avoid calling kcm_rcv_ready */ skb->destructor = sock_rfree; skb_orphan(skb); @@ -1085,53 +1085,17 @@ return err; } -static struct sk_buff *kcm_wait_data(struct sock *sk, int flags, - long timeo, int *err) -{ - struct sk_buff *skb; - - while (!(skb = skb_peek(&sk->sk_receive_queue))) { - if (sk->sk_err) { - *err = sock_error(sk); - return NULL; - } - - if (sock_flag(sk, SOCK_DONE)) - return NULL; - - if ((flags & MSG_DONTWAIT) || !timeo) { - *err = -EAGAIN; - return NULL; - } - - sk_wait_data(sk, &timeo, NULL); - - /* Handle signals */ - if (signal_pending(current)) { - *err = sock_intr_errno(timeo); - return NULL; - } - } - - return skb; -} - static int kcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, int flags) { struct sock *sk = sock->sk; struct kcm_sock *kcm = kcm_sk(sk); int err = 0; - long timeo; struct strp_msg *stm; int copied = 0; struct sk_buff *skb; - timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); - - lock_sock(sk); - - skb = kcm_wait_data(sk, flags, timeo, &err); + skb = skb_recv_datagram(sk, flags, &err); if (!skb) goto out; @@ -1162,14 +1126,11 @@ /* Finished with message */ msg->msg_flags |= MSG_EOR; KCM_STATS_INCR(kcm->stats.rx_msgs); - skb_unlink(skb, &sk->sk_receive_queue); - kfree_skb(skb); } } out: - release_sock(sk); - + skb_free_datagram(sk, skb); return copied ? : err; } @@ -1179,7 +1140,6 @@ { struct sock *sk = sock->sk; struct kcm_sock *kcm = kcm_sk(sk); - long timeo; struct strp_msg *stm; int err = 0; ssize_t copied; @@ -1187,11 +1147,7 @@ /* Only support splice for SOCKSEQPACKET */ - timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT); - - lock_sock(sk); - - skb = kcm_wait_data(sk, flags, timeo, &err); + skb = skb_recv_datagram(sk, flags, &err); if (!skb) goto err_out; @@ -1219,13 +1175,11 @@ * finish reading the message. */ - release_sock(sk); - + skb_free_datagram(sk, skb); return copied; err_out: - release_sock(sk); - + skb_free_datagram(sk, skb); return err; } @@ -1845,10 +1799,10 @@ kcm = kcm_sk(sk); mux = kcm->mux; + lock_sock(sk); sock_orphan(sk); kfree_skb(kcm->seq_skb); - lock_sock(sk); /* Purge queue under lock to avoid race condition with tx_work trying * to act when queue is nonempty. If tx_work runs after this point * it will just return. diff -u linux-kvm-5.19.0/net/key/af_key.c linux-kvm-5.19.0/net/key/af_key.c --- linux-kvm-5.19.0/net/key/af_key.c +++ linux-kvm-5.19.0/net/key/af_key.c @@ -2905,7 +2905,7 @@ break; if (!aalg->pfkey_supported) continue; - if (aalg_tmpl_set(t, aalg) && aalg->available) + if (aalg_tmpl_set(t, aalg)) sz += sizeof(struct sadb_comb); } return sz + sizeof(struct sadb_prop); @@ -2923,7 +2923,7 @@ if (!ealg->pfkey_supported) continue; - if (!(ealg_tmpl_set(t, ealg) && ealg->available)) + if (!(ealg_tmpl_set(t, ealg))) continue; for (k = 1; ; k++) { @@ -2934,16 +2934,17 @@ if (!aalg->pfkey_supported) continue; - if (aalg_tmpl_set(t, aalg) && aalg->available) + if (aalg_tmpl_set(t, aalg)) sz += sizeof(struct sadb_comb); } } return sz + sizeof(struct sadb_prop); } -static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) +static int dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) { struct sadb_prop *p; + int sz = 0; int i; p = skb_put(skb, sizeof(struct sadb_prop)); @@ -2971,13 +2972,17 @@ c->sadb_comb_soft_addtime = 20*60*60; c->sadb_comb_hard_usetime = 8*60*60; c->sadb_comb_soft_usetime = 7*60*60; + sz += sizeof(*c); } } + + return sz + sizeof(*p); } -static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) +static int dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) { struct sadb_prop *p; + int sz = 0; int i, k; p = skb_put(skb, sizeof(struct sadb_prop)); @@ -3019,8 +3024,11 @@ c->sadb_comb_soft_addtime = 20*60*60; c->sadb_comb_hard_usetime = 8*60*60; c->sadb_comb_soft_usetime = 7*60*60; + sz += sizeof(*c); } } + + return sz + sizeof(*p); } static int key_notify_policy_expire(struct xfrm_policy *xp, const struct km_event *c) @@ -3150,6 +3158,7 @@ struct sadb_x_sec_ctx *sec_ctx; struct xfrm_sec_ctx *xfrm_ctx; int ctx_size = 0; + int alg_size = 0; sockaddr_size = pfkey_sockaddr_size(x->props.family); if (!sockaddr_size) @@ -3161,16 +3170,16 @@ sizeof(struct sadb_x_policy); if (x->id.proto == IPPROTO_AH) - size += count_ah_combs(t); + alg_size = count_ah_combs(t); else if (x->id.proto == IPPROTO_ESP) - size += count_esp_combs(t); + alg_size = count_esp_combs(t); if ((xfrm_ctx = x->security)) { ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len); size += sizeof(struct sadb_x_sec_ctx) + ctx_size; } - skb = alloc_skb(size + 16, GFP_ATOMIC); + skb = alloc_skb(size + alg_size + 16, GFP_ATOMIC); if (skb == NULL) return -ENOMEM; @@ -3224,10 +3233,13 @@ pol->sadb_x_policy_priority = xp->priority; /* Set sadb_comb's. */ + alg_size = 0; if (x->id.proto == IPPROTO_AH) - dump_ah_combs(skb, t); + alg_size = dump_ah_combs(skb, t); else if (x->id.proto == IPPROTO_ESP) - dump_esp_combs(skb, t); + alg_size = dump_esp_combs(skb, t); + + hdr->sadb_msg_len += alg_size / 8; /* security context */ if (xfrm_ctx) { @@ -3382,7 +3394,7 @@ hdr->sadb_msg_len = size / sizeof(uint64_t); hdr->sadb_msg_errno = 0; hdr->sadb_msg_reserved = 0; - hdr->sadb_msg_seq = x->km.seq = get_acqseq(); + hdr->sadb_msg_seq = x->km.seq; hdr->sadb_msg_pid = 0; /* SA */ diff -u linux-kvm-5.19.0/net/mac80211/airtime.c linux-kvm-5.19.0/net/mac80211/airtime.c --- linux-kvm-5.19.0/net/mac80211/airtime.c +++ linux-kvm-5.19.0/net/mac80211/airtime.c @@ -452,6 +452,9 @@ (status->encoding == RX_ENC_HE && streams > 8))) return 0; + if (idx >= MCS_GROUP_RATES) + return 0; + duration = airtime_mcs_groups[group].duration[idx]; duration <<= airtime_mcs_groups[group].shift; *overhead = 36 + (streams << 2); diff -u linux-kvm-5.19.0/net/mac80211/main.c linux-kvm-5.19.0/net/mac80211/main.c --- linux-kvm-5.19.0/net/mac80211/main.c +++ linux-kvm-5.19.0/net/mac80211/main.c @@ -1369,8 +1369,10 @@ ieee80211_led_exit(local); destroy_workqueue(local->workqueue); fail_workqueue: - if (local->wiphy_ciphers_allocated) + if (local->wiphy_ciphers_allocated) { kfree(local->hw.wiphy->cipher_suites); + local->wiphy_ciphers_allocated = false; + } kfree(local->int_scan_req); return result; } @@ -1438,8 +1440,10 @@ mutex_destroy(&local->iflist_mtx); mutex_destroy(&local->mtx); - if (local->wiphy_ciphers_allocated) + if (local->wiphy_ciphers_allocated) { kfree(local->hw.wiphy->cipher_suites); + local->wiphy_ciphers_allocated = false; + } idr_for_each(&local->ack_status_frames, ieee80211_free_ack_frame, NULL); diff -u linux-kvm-5.19.0/net/mctp/af_mctp.c linux-kvm-5.19.0/net/mctp/af_mctp.c --- linux-kvm-5.19.0/net/mctp/af_mctp.c +++ linux-kvm-5.19.0/net/mctp/af_mctp.c @@ -665,12 +665,14 @@ rc = mctp_neigh_init(); if (rc) - goto err_unreg_proto; + goto err_unreg_routes; mctp_device_init(); return 0; +err_unreg_routes: + mctp_routes_exit(); err_unreg_proto: proto_unregister(&mctp_proto); err_unreg_sock: diff -u linux-kvm-5.19.0/net/mctp/route.c linux-kvm-5.19.0/net/mctp/route.c --- linux-kvm-5.19.0/net/mctp/route.c +++ linux-kvm-5.19.0/net/mctp/route.c @@ -1400,7 +1400,7 @@ return register_pernet_subsys(&mctp_net_ops); } -void __exit mctp_routes_exit(void) +void mctp_routes_exit(void) { unregister_pernet_subsys(&mctp_net_ops); rtnl_unregister(PF_MCTP, RTM_DELROUTE); diff -u linux-kvm-5.19.0/net/mptcp/protocol.c linux-kvm-5.19.0/net/mptcp/protocol.c --- linux-kvm-5.19.0/net/mptcp/protocol.c +++ linux-kvm-5.19.0/net/mptcp/protocol.c @@ -2327,12 +2327,7 @@ goto out; } - /* if we are invoked by the msk cleanup code, the subflow is - * already orphaned - */ - if (ssk->sk_socket) - sock_orphan(ssk); - + sock_orphan(ssk); subflow->disposable = 1; /* if ssk hit tcp_done(), tcp_cleanup_ulp() cleared the related ops @@ -2863,7 +2858,11 @@ if (ssk == msk->first) subflow->fail_tout = 0; - sock_orphan(ssk); + /* detach from the parent socket, but allow data_ready to + * push incoming data into the mptcp stack, to properly ack it + */ + ssk->sk_socket = NULL; + ssk->sk_wq = NULL; unlock_sock_fast(ssk, slow); } sock_orphan(sk); diff -u linux-kvm-5.19.0/net/mptcp/subflow.c linux-kvm-5.19.0/net/mptcp/subflow.c --- linux-kvm-5.19.0/net/mptcp/subflow.c +++ linux-kvm-5.19.0/net/mptcp/subflow.c @@ -1745,16 +1745,16 @@ for (msk = head; msk; msk = next) { struct sock *sk = (struct sock *)msk; - bool slow, do_cancel_work; + bool do_cancel_work; sock_hold(sk); - slow = lock_sock_fast_nested(sk); + lock_sock_nested(sk, SINGLE_DEPTH_NESTING); next = msk->dl_next; msk->first = NULL; msk->dl_next = NULL; do_cancel_work = __mptcp_close(sk, 0); - unlock_sock_fast(sk, slow); + release_sock(sk); if (do_cancel_work) mptcp_cancel_work(sk); sock_put(sk); diff -u linux-kvm-5.19.0/net/netfilter/ipset/ip_set_hash_gen.h linux-kvm-5.19.0/net/netfilter/ipset/ip_set_hash_gen.h --- linux-kvm-5.19.0/net/netfilter/ipset/ip_set_hash_gen.h +++ linux-kvm-5.19.0/net/netfilter/ipset/ip_set_hash_gen.h @@ -916,7 +916,7 @@ #ifdef IP_SET_HASH_WITH_MULTI if (h->bucketsize >= AHASH_MAX_TUNED) goto set_full; - else if (h->bucketsize < multi) + else if (h->bucketsize <= multi) h->bucketsize += AHASH_INIT_SIZE; #endif if (n->size >= AHASH_MAX(h)) { diff -u linux-kvm-5.19.0/net/netfilter/nf_conntrack_core.c linux-kvm-5.19.0/net/netfilter/nf_conntrack_core.c --- linux-kvm-5.19.0/net/netfilter/nf_conntrack_core.c +++ linux-kvm-5.19.0/net/netfilter/nf_conntrack_core.c @@ -1783,7 +1783,7 @@ } #ifdef CONFIG_NF_CONNTRACK_MARK - ct->mark = exp->master->mark; + ct->mark = READ_ONCE(exp->master->mark); #endif #ifdef CONFIG_NF_CONNTRACK_SECMARK ct->secmark = exp->master->secmark; diff -u linux-kvm-5.19.0/net/netfilter/nf_conntrack_netlink.c linux-kvm-5.19.0/net/netfilter/nf_conntrack_netlink.c --- linux-kvm-5.19.0/net/netfilter/nf_conntrack_netlink.c +++ linux-kvm-5.19.0/net/netfilter/nf_conntrack_netlink.c @@ -328,9 +328,9 @@ } #ifdef CONFIG_NF_CONNTRACK_MARK -static int ctnetlink_dump_mark(struct sk_buff *skb, const struct nf_conn *ct) +static int ctnetlink_dump_mark(struct sk_buff *skb, u32 mark) { - if (nla_put_be32(skb, CTA_MARK, htonl(ct->mark))) + if (nla_put_be32(skb, CTA_MARK, htonl(mark))) goto nla_put_failure; return 0; @@ -548,7 +548,7 @@ static int ctnetlink_dump_info(struct sk_buff *skb, struct nf_conn *ct) { if (ctnetlink_dump_status(skb, ct) < 0 || - ctnetlink_dump_mark(skb, ct) < 0 || + ctnetlink_dump_mark(skb, READ_ONCE(ct->mark)) < 0 || ctnetlink_dump_secctx(skb, ct) < 0 || ctnetlink_dump_id(skb, ct) < 0 || ctnetlink_dump_use(skb, ct) < 0 || @@ -728,6 +728,7 @@ struct sk_buff *skb; unsigned int type; unsigned int flags = 0, group; + u32 mark; int err; if (events & (1 << IPCT_DESTROY)) { @@ -832,8 +833,9 @@ } #ifdef CONFIG_NF_CONNTRACK_MARK - if ((events & (1 << IPCT_MARK) || ct->mark) - && ctnetlink_dump_mark(skb, ct) < 0) + mark = READ_ONCE(ct->mark); + if ((events & (1 << IPCT_MARK) || mark) && + ctnetlink_dump_mark(skb, mark) < 0) goto nla_put_failure; #endif nlmsg_end(skb, nlh); @@ -1160,7 +1162,7 @@ } #ifdef CONFIG_NF_CONNTRACK_MARK - if ((ct->mark & filter->mark.mask) != filter->mark.val) + if ((READ_ONCE(ct->mark) & filter->mark.mask) != filter->mark.val) goto ignore_entry; #endif status = (u32)READ_ONCE(ct->status); @@ -2052,9 +2054,9 @@ mask = ~ntohl(nla_get_be32(cda[CTA_MARK_MASK])); mark = ntohl(nla_get_be32(cda[CTA_MARK])); - newmark = (ct->mark & mask) ^ mark; - if (newmark != ct->mark) - ct->mark = newmark; + newmark = (READ_ONCE(ct->mark) & mask) ^ mark; + if (newmark != READ_ONCE(ct->mark)) + WRITE_ONCE(ct->mark, newmark); } #endif @@ -2726,6 +2728,7 @@ { const struct nf_conntrack_zone *zone; struct nlattr *nest_parms; + u32 mark; zone = nf_ct_zone(ct); @@ -2787,7 +2790,8 @@ goto nla_put_failure; #ifdef CONFIG_NF_CONNTRACK_MARK - if (ct->mark && ctnetlink_dump_mark(skb, ct) < 0) + mark = READ_ONCE(ct->mark); + if (mark && ctnetlink_dump_mark(skb, mark) < 0) goto nla_put_failure; #endif if (ctnetlink_dump_labels(skb, ct) < 0) diff -u linux-kvm-5.19.0/net/netfilter/nf_conntrack_standalone.c linux-kvm-5.19.0/net/netfilter/nf_conntrack_standalone.c --- linux-kvm-5.19.0/net/netfilter/nf_conntrack_standalone.c +++ linux-kvm-5.19.0/net/netfilter/nf_conntrack_standalone.c @@ -367,7 +367,7 @@ goto release; #if defined(CONFIG_NF_CONNTRACK_MARK) - seq_printf(s, "mark=%u ", ct->mark); + seq_printf(s, "mark=%u ", READ_ONCE(ct->mark)); #endif ct_show_secctx(s, ct); diff -u linux-kvm-5.19.0/net/netfilter/nf_flow_table_offload.c linux-kvm-5.19.0/net/netfilter/nf_flow_table_offload.c --- linux-kvm-5.19.0/net/netfilter/nf_flow_table_offload.c +++ linux-kvm-5.19.0/net/netfilter/nf_flow_table_offload.c @@ -1087,6 +1087,7 @@ struct flow_block_cb *block_cb, *next; int err = 0; + down_write(&flowtable->flow_block_lock); switch (cmd) { case FLOW_BLOCK_BIND: list_splice(&bo->cb_list, &flowtable->flow_block.cb_list); @@ -1101,6 +1102,7 @@ WARN_ON_ONCE(1); err = -EOPNOTSUPP; } + up_write(&flowtable->flow_block_lock); return err; } @@ -1157,7 +1159,9 @@ nf_flow_table_block_offload_init(bo, dev_net(dev), cmd, flowtable, extack); + down_write(&flowtable->flow_block_lock); err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, bo); + up_write(&flowtable->flow_block_lock); if (err < 0) return err; diff -u linux-kvm-5.19.0/net/netfilter/nf_tables_api.c linux-kvm-5.19.0/net/netfilter/nf_tables_api.c --- linux-kvm-5.19.0/net/netfilter/nf_tables_api.c +++ linux-kvm-5.19.0/net/netfilter/nf_tables_api.c @@ -5912,7 +5912,8 @@ &timeout); if (err) return err; - } else if (set->flags & NFT_SET_TIMEOUT) { + } else if (set->flags & NFT_SET_TIMEOUT && + !(flags & NFT_SET_ELEM_INTERVAL_END)) { timeout = set->timeout; } @@ -5978,7 +5979,8 @@ err = -EOPNOTSUPP; goto err_set_elem_expr; } - } else if (set->num_exprs > 0) { + } else if (set->num_exprs > 0 && + !(flags & NFT_SET_ELEM_INTERVAL_END)) { err = nft_set_elem_expr_clone(ctx, set, expr_array); if (err < 0) goto err_set_elem_expr_clone; @@ -10036,7 +10038,8 @@ struct nftables_pernet *nft_net = nft_pernet(net); mutex_lock(&nft_net->commit_mutex); - if (!list_empty(&nft_net->commit_list)) + if (!list_empty(&nft_net->commit_list) || + !list_empty(&nft_net->module_list)) __nf_tables_abort(net, NFNL_ABORT_NONE); __nft_release_tables(net); mutex_unlock(&nft_net->commit_mutex); diff -u linux-kvm-5.19.0/net/netfilter/nfnetlink.c linux-kvm-5.19.0/net/netfilter/nfnetlink.c --- linux-kvm-5.19.0/net/netfilter/nfnetlink.c +++ linux-kvm-5.19.0/net/netfilter/nfnetlink.c @@ -294,6 +294,7 @@ nfnl_lock(subsys_id); if (nfnl_dereference_protected(subsys_id) != ss || nfnetlink_find_client(type, ss) != nc) { + nfnl_unlock(subsys_id); err = -EAGAIN; break; } diff -u linux-kvm-5.19.0/net/netfilter/nft_payload.c linux-kvm-5.19.0/net/netfilter/nft_payload.c --- linux-kvm-5.19.0/net/netfilter/nft_payload.c +++ linux-kvm-5.19.0/net/netfilter/nft_payload.c @@ -62,7 +62,7 @@ return false; if (offset + len > VLAN_ETH_HLEN + vlan_hlen) - ethlen -= offset + len - VLAN_ETH_HLEN + vlan_hlen; + ethlen -= offset + len - VLAN_ETH_HLEN - vlan_hlen; memcpy(dst_u8, vlanh + offset - vlan_hlen, ethlen); diff -u linux-kvm-5.19.0/net/packet/af_packet.c linux-kvm-5.19.0/net/packet/af_packet.c --- linux-kvm-5.19.0/net/packet/af_packet.c +++ linux-kvm-5.19.0/net/packet/af_packet.c @@ -2293,8 +2293,7 @@ if (skb->ip_summed == CHECKSUM_PARTIAL) status |= TP_STATUS_CSUMNOTREADY; else if (skb->pkt_type != PACKET_OUTGOING && - (skb->ip_summed == CHECKSUM_COMPLETE || - skb_csum_unnecessary(skb))) + skb_csum_unnecessary(skb)) status |= TP_STATUS_CSUM_VALID; if (snaplen > res) @@ -3520,8 +3519,7 @@ if (skb->ip_summed == CHECKSUM_PARTIAL) aux.tp_status |= TP_STATUS_CSUMNOTREADY; else if (skb->pkt_type != PACKET_OUTGOING && - (skb->ip_summed == CHECKSUM_COMPLETE || - skb_csum_unnecessary(skb))) + skb_csum_unnecessary(skb)) aux.tp_status |= TP_STATUS_CSUM_VALID; aux.tp_len = origlen; diff -u linux-kvm-5.19.0/net/rxrpc/ar-internal.h linux-kvm-5.19.0/net/rxrpc/ar-internal.h --- linux-kvm-5.19.0/net/rxrpc/ar-internal.h +++ linux-kvm-5.19.0/net/rxrpc/ar-internal.h @@ -399,6 +399,7 @@ struct rxrpc_bundle { struct rxrpc_conn_parameters params; refcount_t ref; + atomic_t active; /* Number of active users */ unsigned int debug_id; bool try_upgrade; /* True if the bundle is attempting upgrade */ bool alloc_conn; /* True if someone's getting a conn */ diff -u linux-kvm-5.19.0/net/sched/act_ct.c linux-kvm-5.19.0/net/sched/act_ct.c --- linux-kvm-5.19.0/net/sched/act_ct.c +++ linux-kvm-5.19.0/net/sched/act_ct.c @@ -178,7 +178,7 @@ entry = tcf_ct_flow_table_flow_action_get_next(action); entry->id = FLOW_ACTION_CT_METADATA; #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) - entry->ct_metadata.mark = ct->mark; + entry->ct_metadata.mark = READ_ONCE(ct->mark); #endif ctinfo = dir == IP_CT_DIR_ORIGINAL ? IP_CT_ESTABLISHED : IP_CT_ESTABLISHED_REPLY; @@ -939,9 +939,9 @@ if (!mask) return; - new_mark = mark | (ct->mark & ~(mask)); - if (ct->mark != new_mark) { - ct->mark = new_mark; + new_mark = mark | (READ_ONCE(ct->mark) & ~(mask)); + if (READ_ONCE(ct->mark) != new_mark) { + WRITE_ONCE(ct->mark, new_mark); if (nf_ct_is_confirmed(ct)) nf_conntrack_event_cache(IPCT_MARK, ct); } diff -u linux-kvm-5.19.0/net/tipc/discover.c linux-kvm-5.19.0/net/tipc/discover.c --- linux-kvm-5.19.0/net/tipc/discover.c +++ linux-kvm-5.19.0/net/tipc/discover.c @@ -211,7 +211,10 @@ u32 self; int err; - skb_linearize(skb); + if (skb_linearize(skb)) { + kfree_skb(skb); + return; + } hdr = buf_msg(skb); if (caps & TIPC_NODE_ID128) diff -u linux-kvm-5.19.0/net/tipc/topsrv.c linux-kvm-5.19.0/net/tipc/topsrv.c --- linux-kvm-5.19.0/net/tipc/topsrv.c +++ linux-kvm-5.19.0/net/tipc/topsrv.c @@ -176,7 +176,7 @@ conn_put(con); } -static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s) +static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s, struct socket *sock) { struct tipc_conn *con; int ret; @@ -202,10 +202,12 @@ } con->conid = ret; s->idr_in_use++; - spin_unlock_bh(&s->idr_lock); set_bit(CF_CONNECTED, &con->flags); con->server = s; + con->sock = sock; + conn_get(con); + spin_unlock_bh(&s->idr_lock); return con; } @@ -467,7 +469,7 @@ ret = kernel_accept(lsock, &newsock, O_NONBLOCK); if (ret < 0) return; - con = tipc_conn_alloc(srv); + con = tipc_conn_alloc(srv, newsock); if (IS_ERR(con)) { ret = PTR_ERR(con); sock_release(newsock); @@ -479,11 +481,11 @@ newsk->sk_data_ready = tipc_conn_data_ready; newsk->sk_write_space = tipc_conn_write_space; newsk->sk_user_data = con; - con->sock = newsock; write_unlock_bh(&newsk->sk_callback_lock); /* Wake up receive process in case of 'SYN+' message */ newsk->sk_data_ready(newsk); + conn_put(con); } } @@ -577,17 +579,17 @@ sub.filter = filter; *(u64 *)&sub.usr_handle = (u64)port; - con = tipc_conn_alloc(tipc_topsrv(net)); + con = tipc_conn_alloc(tipc_topsrv(net), NULL); if (IS_ERR(con)) return false; *conid = con->conid; - con->sock = NULL; rc = tipc_conn_rcv_sub(tipc_topsrv(net), con, &sub); - if (rc >= 0) - return true; + if (rc) + conn_put(con); + conn_put(con); - return false; + return !rc; } void tipc_topsrv_kern_unsubscr(struct net *net, int conid) diff -u linux-kvm-5.19.0/net/wireless/reg.c linux-kvm-5.19.0/net/wireless/reg.c --- linux-kvm-5.19.0/net/wireless/reg.c +++ linux-kvm-5.19.0/net/wireless/reg.c @@ -1084,6 +1084,8 @@ static int query_regdb_file(const char *alpha2) { + int err; + ASSERT_RTNL(); if (regdb) @@ -1093,9 +1095,13 @@ if (!alpha2) return -ENOMEM; - return request_firmware_nowait(THIS_MODULE, true, "regulatory.db", - ®_pdev->dev, GFP_KERNEL, - (void *)alpha2, regdb_fw_cb); + err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db", + ®_pdev->dev, GFP_KERNEL, + (void *)alpha2, regdb_fw_cb); + if (err) + kfree(alpha2); + + return err; } int reg_reload_regdb(void) diff -u linux-kvm-5.19.0/net/wireless/scan.c linux-kvm-5.19.0/net/wireless/scan.c --- linux-kvm-5.19.0/net/wireless/scan.c +++ linux-kvm-5.19.0/net/wireless/scan.c @@ -330,7 +330,8 @@ * determine if they are the same ie. */ if (tmp_old[0] == WLAN_EID_VENDOR_SPECIFIC) { - if (!memcmp(tmp_old + 2, tmp + 2, 5)) { + if (tmp_old[1] >= 5 && tmp[1] >= 5 && + !memcmp(tmp_old + 2, tmp + 2, 5)) { /* same vendor ie, copy from * subelement */ @@ -1674,7 +1675,9 @@ if (old == rcu_access_pointer(known->pub.ies)) rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies); - cfg80211_update_hidden_bsses(known, new->pub.beacon_ies, old); + cfg80211_update_hidden_bsses(known, + rcu_access_pointer(new->pub.beacon_ies), + old); if (old) kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head); @@ -2524,10 +2527,15 @@ const struct cfg80211_bss_ies *ies1, *ies2; size_t ielen = len - offsetof(struct ieee80211_mgmt, u.probe_resp.variable); - struct cfg80211_non_tx_bss non_tx_data; + struct cfg80211_non_tx_bss non_tx_data = {}; res = cfg80211_inform_single_bss_frame_data(wiphy, data, mgmt, len, gfp); + + /* don't do any further MBSSID handling for S1G */ + if (ieee80211_is_s1g_beacon(mgmt->frame_control)) + return res; + if (!res || !wiphy->support_mbssid || !cfg80211_find_elem(WLAN_EID_MULTIPLE_BSSID, ie, ielen)) return res; diff -u linux-kvm-5.19.0/net/wireless/util.c linux-kvm-5.19.0/net/wireless/util.c --- linux-kvm-5.19.0/net/wireless/util.c +++ linux-kvm-5.19.0/net/wireless/util.c @@ -1555,10 +1555,12 @@ tmp = result; tmp *= SCALE; do_div(tmp, mcs_divisors[rate->mcs]); - result = tmp; /* and take NSS */ - result = (result * rate->nss) / 8; + tmp *= rate->nss; + do_div(tmp, 8); + + result = tmp; return result / 10000; } diff -u linux-kvm-5.19.0/scripts/faddr2line linux-kvm-5.19.0/scripts/faddr2line --- linux-kvm-5.19.0/scripts/faddr2line +++ linux-kvm-5.19.0/scripts/faddr2line @@ -73,7 +73,8 @@ find_dir_prefix() { local objfile=$1 - local start_kernel_addr=$(${READELF} --symbols --wide $objfile | ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}') + local start_kernel_addr=$(${READELF} --symbols --wide $objfile | sed 's/\[.*\]//' | + ${AWK} '$8 == "start_kernel" {printf "0x%s", $2}') [[ -z $start_kernel_addr ]] && return local file_line=$(${ADDR2LINE} -e $objfile $start_kernel_addr) @@ -177,7 +178,7 @@ found=2 break fi - done < <(${READELF} --symbols --wide $objfile | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2) + done < <(${READELF} --symbols --wide $objfile | sed 's/\[.*\]//' | ${AWK} -v sec=$sym_sec '$7 == sec' | sort --key=2) if [[ $found = 0 ]]; then warn "can't find symbol: sym_name: $sym_name sym_sec: $sym_sec sym_addr: $sym_addr sym_elf_size: $sym_elf_size" @@ -258,7 +259,7 @@ DONE=1 - done < <(${READELF} --symbols --wide $objfile | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn') + done < <(${READELF} --symbols --wide $objfile | sed 's/\[.*\]//' | ${AWK} -v fn=$sym_name '$4 == "FUNC" && $8 == fn') } [[ $# -lt 2 ]] && usage diff -u linux-kvm-5.19.0/sound/core/memalloc.c linux-kvm-5.19.0/sound/core/memalloc.c --- linux-kvm-5.19.0/sound/core/memalloc.c +++ linux-kvm-5.19.0/sound/core/memalloc.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -518,19 +519,20 @@ struct sg_table *sgt; void *p; - sgt = dma_alloc_noncontiguous(dmab->dev.dev, size, dmab->dev.dir, - DEFAULT_GFP, 0); - if (!sgt) { #ifdef CONFIG_SND_DMA_SGBUF + if (!get_dma_ops(dmab->dev.dev)) { if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_WC_SG) dmab->dev.type = SNDRV_DMA_TYPE_DEV_WC_SG_FALLBACK; else dmab->dev.type = SNDRV_DMA_TYPE_DEV_SG_FALLBACK; return snd_dma_sg_fallback_alloc(dmab, size); -#else - return NULL; -#endif } +#endif + + sgt = dma_alloc_noncontiguous(dmab->dev.dev, size, dmab->dev.dir, + DEFAULT_GFP, 0); + if (!sgt) + return NULL; dmab->dev.need_sync = dma_need_sync(dmab->dev.dev, sg_dma_address(sgt->sgl)); @@ -866,7 +868,7 @@ /* * Entry points */ -static const struct snd_malloc_ops *dma_ops[] = { +static const struct snd_malloc_ops *snd_dma_ops[] = { [SNDRV_DMA_TYPE_CONTINUOUS] = &snd_dma_continuous_ops, [SNDRV_DMA_TYPE_VMALLOC] = &snd_dma_vmalloc_ops, #ifdef CONFIG_HAS_DMA @@ -894,5 +896,5 @@ if (WARN_ON_ONCE(dmab->dev.type <= SNDRV_DMA_TYPE_UNKNOWN || - dmab->dev.type >= ARRAY_SIZE(dma_ops))) + dmab->dev.type >= ARRAY_SIZE(snd_dma_ops))) return NULL; - return dma_ops[dmab->dev.type]; + return snd_dma_ops[dmab->dev.type]; } diff -u linux-kvm-5.19.0/sound/hda/intel-dsp-config.c linux-kvm-5.19.0/sound/hda/intel-dsp-config.c --- linux-kvm-5.19.0/sound/hda/intel-dsp-config.c +++ linux-kvm-5.19.0/sound/hda/intel-dsp-config.c @@ -321,6 +321,11 @@ } }, { + .flags = FLAG_SOF, + .device = 0x34c8, + .codec_hid = &essx_83x6, + }, + { .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, .device = 0x34c8, }, diff -u linux-kvm-5.19.0/sound/pci/hda/hda_intel.c linux-kvm-5.19.0/sound/pci/hda/hda_intel.c --- linux-kvm-5.19.0/sound/pci/hda/hda_intel.c +++ linux-kvm-5.19.0/sound/pci/hda/hda_intel.c @@ -2718,6 +2718,9 @@ { PCI_DEVICE(0x1002, 0xab28), .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | AZX_DCAPS_PM_RUNTIME }, + { PCI_DEVICE(0x1002, 0xab30), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | + AZX_DCAPS_PM_RUNTIME }, { PCI_DEVICE(0x1002, 0xab38), .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS | AZX_DCAPS_PM_RUNTIME }, diff -u linux-kvm-5.19.0/sound/pci/hda/patch_realtek.c linux-kvm-5.19.0/sound/pci/hda/patch_realtek.c --- linux-kvm-5.19.0/sound/pci/hda/patch_realtek.c +++ linux-kvm-5.19.0/sound/pci/hda/patch_realtek.c @@ -9365,6 +9365,8 @@ SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8b5d, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), + SND_PCI_QUIRK(0x103c, 0x8b5e, "HP", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF), SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), @@ -9415,6 +9417,7 @@ SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401), SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2), SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401), SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), @@ -9446,6 +9449,8 @@ SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_AMP), SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_AMP), SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc1a3, "Samsung Galaxy Book Pro (NP935XDB-KC1SE)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc1a6, "Samsung Galaxy Book Pro 360 (NP930QBD)", ALC298_FIXUP_SAMSUNG_AMP), SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP), SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_AMP), @@ -9617,6 +9622,7 @@ SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), SND_PCI_QUIRK(0x1849, 0x1233, "ASRock NUC Box 1100", ALC233_FIXUP_NO_AUDIO_JACK), + SND_PCI_QUIRK(0x1849, 0xa233, "Positivo Master C6300", ALC269_FIXUP_HEADSET_MIC), SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS), SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1b35, 0x1235, "CZC B20", ALC269_FIXUP_CZC_B20), diff -u linux-kvm-5.19.0/sound/soc/amd/yc/acp6x-mach.c linux-kvm-5.19.0/sound/soc/amd/yc/acp6x-mach.c --- linux-kvm-5.19.0/sound/soc/amd/yc/acp6x-mach.c +++ linux-kvm-5.19.0/sound/soc/amd/yc/acp6x-mach.c @@ -49,6 +49,27 @@ .driver_data = &acp6x_card, .matches = { DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D0"), + } + }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D0"), + } + }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D1"), + } + }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), DMI_MATCH(DMI_PRODUCT_NAME, "21D2"), } }, @@ -159,2 +180,9 @@ }, + { + .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Alienware"), + DMI_MATCH(DMI_PRODUCT_NAME, "Alienware m17 R5 AMD"), + } + }, {} diff -u linux-kvm-5.19.0/sound/soc/codecs/mt6660.c linux-kvm-5.19.0/sound/soc/codecs/mt6660.c --- linux-kvm-5.19.0/sound/soc/codecs/mt6660.c +++ linux-kvm-5.19.0/sound/soc/codecs/mt6660.c @@ -503,14 +503,14 @@ dev_err(chip->dev, "read chip revision fail\n"); goto probe_fail; } + pm_runtime_set_active(chip->dev); + pm_runtime_enable(chip->dev); ret = devm_snd_soc_register_component(chip->dev, &mt6660_component_driver, &mt6660_codec_dai, 1); - if (!ret) { - pm_runtime_set_active(chip->dev); - pm_runtime_enable(chip->dev); - } + if (ret) + pm_runtime_disable(chip->dev); return ret; diff -u linux-kvm-5.19.0/sound/soc/codecs/tas2764.c linux-kvm-5.19.0/sound/soc/codecs/tas2764.c --- linux-kvm-5.19.0/sound/soc/codecs/tas2764.c +++ linux-kvm-5.19.0/sound/soc/codecs/tas2764.c @@ -386,20 +386,13 @@ if (tx_mask == 0 || rx_mask != 0) return -EINVAL; - if (slots == 1) { - if (tx_mask != 1) - return -EINVAL; - left_slot = 0; - right_slot = 0; + left_slot = __ffs(tx_mask); + tx_mask &= ~(1 << left_slot); + if (tx_mask == 0) { + right_slot = left_slot; } else { - left_slot = __ffs(tx_mask); - tx_mask &= ~(1 << left_slot); - if (tx_mask == 0) { - right_slot = left_slot; - } else { - right_slot = __ffs(tx_mask); - tx_mask &= ~(1 << right_slot); - } + right_slot = __ffs(tx_mask); + tx_mask &= ~(1 << right_slot); } if (tx_mask != 0 || left_slot >= slots || right_slot >= slots) diff -u linux-kvm-5.19.0/sound/soc/codecs/tas2770.c linux-kvm-5.19.0/sound/soc/codecs/tas2770.c --- linux-kvm-5.19.0/sound/soc/codecs/tas2770.c +++ linux-kvm-5.19.0/sound/soc/codecs/tas2770.c @@ -395,21 +395,13 @@ if (tx_mask == 0 || rx_mask != 0) return -EINVAL; - if (slots == 1) { - if (tx_mask != 1) - return -EINVAL; - - left_slot = 0; - right_slot = 0; + left_slot = __ffs(tx_mask); + tx_mask &= ~(1 << left_slot); + if (tx_mask == 0) { + right_slot = left_slot; } else { - left_slot = __ffs(tx_mask); - tx_mask &= ~(1 << left_slot); - if (tx_mask == 0) { - right_slot = left_slot; - } else { - right_slot = __ffs(tx_mask); - tx_mask &= ~(1 << right_slot); - } + right_slot = __ffs(tx_mask); + tx_mask &= ~(1 << right_slot); } if (tx_mask != 0 || left_slot >= slots || right_slot >= slots) diff -u linux-kvm-5.19.0/sound/soc/codecs/tlv320adc3xxx.c linux-kvm-5.19.0/sound/soc/codecs/tlv320adc3xxx.c --- linux-kvm-5.19.0/sound/soc/codecs/tlv320adc3xxx.c +++ linux-kvm-5.19.0/sound/soc/codecs/tlv320adc3xxx.c @@ -14,6 +14,7 @@ #include #include +#include #include #include #include @@ -1025,7 +1026,9 @@ static void adc3xxx_free_gpio(struct adc3xxx *adc3xxx) { +#ifdef CONFIG_GPIOLIB gpiochip_remove(&adc3xxx->gpio_chip); +#endif } static void adc3xxx_init_gpio(struct adc3xxx *adc3xxx) reverted: --- linux-kvm-5.19.0/sound/soc/codecs/wm5102.c +++ linux-kvm-5.19.0.orig/sound/soc/codecs/wm5102.c @@ -2100,6 +2100,9 @@ regmap_update_bits(arizona->regmap, wm5102_digital_vu[i], WM5102_DIG_VU, WM5102_DIG_VU); + pm_runtime_enable(&pdev->dev); + pm_runtime_idle(&pdev->dev); + ret = arizona_request_irq(arizona, ARIZONA_IRQ_DSP_IRQ1, "ADSP2 Compressed IRQ", wm5102_adsp2_irq, wm5102); @@ -2132,9 +2135,6 @@ goto err_spk_irqs; } - pm_runtime_enable(&pdev->dev); - pm_runtime_idle(&pdev->dev); - return ret; err_spk_irqs: reverted: --- linux-kvm-5.19.0/sound/soc/codecs/wm5110.c +++ linux-kvm-5.19.0.orig/sound/soc/codecs/wm5110.c @@ -2458,6 +2458,9 @@ regmap_update_bits(arizona->regmap, wm5110_digital_vu[i], WM5110_DIG_VU, WM5110_DIG_VU); + pm_runtime_enable(&pdev->dev); + pm_runtime_idle(&pdev->dev); + ret = arizona_request_irq(arizona, ARIZONA_IRQ_DSP_IRQ1, "ADSP2 Compressed IRQ", wm5110_adsp2_irq, wm5110); @@ -2490,9 +2493,6 @@ goto err_spk_irqs; } - pm_runtime_enable(&pdev->dev); - pm_runtime_idle(&pdev->dev); - return ret; err_spk_irqs: reverted: --- linux-kvm-5.19.0/sound/soc/codecs/wm8997.c +++ linux-kvm-5.19.0.orig/sound/soc/codecs/wm8997.c @@ -1162,6 +1162,9 @@ regmap_update_bits(arizona->regmap, wm8997_digital_vu[i], WM8997_DIG_VU, WM8997_DIG_VU); + pm_runtime_enable(&pdev->dev); + pm_runtime_idle(&pdev->dev); + arizona_init_common(arizona); ret = arizona_init_vol_limit(arizona); @@ -1180,9 +1183,6 @@ goto err_spk_irqs; } - pm_runtime_enable(&pdev->dev); - pm_runtime_idle(&pdev->dev); - return ret; err_spk_irqs: diff -u linux-kvm-5.19.0/sound/soc/fsl/fsl_asrc.c linux-kvm-5.19.0/sound/soc/fsl/fsl_asrc.c --- linux-kvm-5.19.0/sound/soc/fsl/fsl_asrc.c +++ linux-kvm-5.19.0/sound/soc/fsl/fsl_asrc.c @@ -1224,7 +1224,7 @@ } ret = pm_runtime_put_sync(&pdev->dev); - if (ret < 0) + if (ret < 0 && ret != -ENOSYS) goto err_pm_get_sync; ret = devm_snd_soc_register_component(&pdev->dev, &fsl_asrc_component, diff -u linux-kvm-5.19.0/sound/soc/intel/boards/sof_es8336.c linux-kvm-5.19.0/sound/soc/intel/boards/sof_es8336.c --- linux-kvm-5.19.0/sound/soc/intel/boards/sof_es8336.c +++ linux-kvm-5.19.0/sound/soc/intel/boards/sof_es8336.c @@ -45,6 +45,7 @@ struct snd_soc_jack jack; struct list_head hdmi_pcm_list; bool speaker_en; + struct delayed_work pcm_pop_work; }; struct sof_hdmi_pcm { @@ -93,6 +94,46 @@ dev_info(dev, "quirk headset at mic1 port enabled\n"); } +static void pcm_pop_work_events(struct work_struct *work) +{ + struct sof_es8336_private *priv = + container_of(work, struct sof_es8336_private, pcm_pop_work.work); + + gpiod_set_value_cansleep(priv->gpio_speakers, priv->speaker_en); + + if (quirk & SOF_ES8336_HEADPHONE_GPIO) + gpiod_set_value_cansleep(priv->gpio_headphone, priv->speaker_en); + +} + +static int sof_8336_trigger(struct snd_pcm_substream *substream, int cmd) +{ + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + struct snd_soc_card *card = rtd->card; + struct sof_es8336_private *priv = snd_soc_card_get_drvdata(card); + + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: + case SNDRV_PCM_TRIGGER_RESUME: + break; + + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_STOP: + if (priv->speaker_en == false) + if (substream->stream == 0) { + cancel_delayed_work(&priv->pcm_pop_work); + gpiod_set_value_cansleep(priv->gpio_speakers, true); + } + break; + default: + return -EINVAL; + } + + return 0; +} + static int sof_es8316_speaker_power_event(struct snd_soc_dapm_widget *w, struct snd_kcontrol *kcontrol, int event) { @@ -104,19 +145,7 @@ priv->speaker_en = !SND_SOC_DAPM_EVENT_ON(event); - if (SND_SOC_DAPM_EVENT_ON(event)) - msleep(70); - - gpiod_set_value_cansleep(priv->gpio_speakers, priv->speaker_en); - - if (!(quirk & SOF_ES8336_HEADPHONE_GPIO)) - return 0; - - if (SND_SOC_DAPM_EVENT_ON(event)) - msleep(70); - - gpiod_set_value_cansleep(priv->gpio_headphone, priv->speaker_en); - + queue_delayed_work(system_wq, &priv->pcm_pop_work, msecs_to_jiffies(70)); return 0; } @@ -326,6 +355,7 @@ /* machine stream operations */ static struct snd_soc_ops sof_es8336_ops = { .hw_params = sof_es8336_hw_params, + .trigger = sof_8336_trigger, }; static struct snd_soc_dai_link_component platform_component[] = { @@ -655,7 +685,8 @@ } INIT_LIST_HEAD(&priv->hdmi_pcm_list); - + INIT_DELAYED_WORK(&priv->pcm_pop_work, + pcm_pop_work_events); snd_soc_card_set_drvdata(card, priv); if (mach->mach_params.dmic_num > 0) { @@ -684,6 +715,7 @@ struct snd_soc_card *card = platform_get_drvdata(pdev); struct sof_es8336_private *priv = snd_soc_card_get_drvdata(card); + cancel_delayed_work(&priv->pcm_pop_work); gpiod_put(priv->gpio_speakers); device_remove_software_node(priv->codec_dev); put_device(priv->codec_dev); diff -u linux-kvm-5.19.0/sound/soc/intel/boards/sof_rt5682.c linux-kvm-5.19.0/sound/soc/intel/boards/sof_rt5682.c --- linux-kvm-5.19.0/sound/soc/intel/boards/sof_rt5682.c +++ linux-kvm-5.19.0/sound/soc/intel/boards/sof_rt5682.c @@ -225,6 +225,18 @@ SOF_RT5682_SSP_AMP(2) | SOF_RT5682_NUM_HDMIDEV(4)), }, + { + .callback = sof_rt5682_quirk_cb, + .matches = { + DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Rex"), + }, + .driver_data = (void *)(SOF_RT5682_MCLK_EN | + SOF_RT5682_SSP_CODEC(2) | + SOF_SPEAKER_AMP_PRESENT | + SOF_RT5682_SSP_AMP(0) | + SOF_RT5682_NUM_HDMIDEV(4) + ), + }, {} }; diff -u linux-kvm-5.19.0/sound/soc/intel/boards/sof_sdw.c linux-kvm-5.19.0/sound/soc/intel/boards/sof_sdw.c --- linux-kvm-5.19.0/sound/soc/intel/boards/sof_sdw.c +++ linux-kvm-5.19.0/sound/soc/intel/boards/sof_sdw.c @@ -202,6 +202,17 @@ SOF_SDW_PCH_DMIC | RT711_JD1), }, + { + /* NUC15 LAPBC710 skews */ + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"), + DMI_MATCH(DMI_BOARD_NAME, "LAPBC710"), + }, + .driver_data = (void *)(SOF_SDW_TGL_HDMI | + SOF_SDW_PCH_DMIC | + RT711_JD1), + }, /* TigerLake-SDCA devices */ { .callback = sof_sdw_quirk_cb, diff -u linux-kvm-5.19.0/sound/soc/soc-core.c linux-kvm-5.19.0/sound/soc/soc-core.c --- linux-kvm-5.19.0/sound/soc/soc-core.c +++ linux-kvm-5.19.0/sound/soc/soc-core.c @@ -3477,10 +3477,23 @@ static int __init snd_soc_init(void) { + int ret; + snd_soc_debugfs_init(); - snd_soc_util_init(); + ret = snd_soc_util_init(); + if (ret) + goto err_util_init; + + ret = platform_driver_register(&soc_driver); + if (ret) + goto err_register; + return 0; - return platform_driver_register(&soc_driver); +err_register: + snd_soc_util_exit(); +err_util_init: + snd_soc_debugfs_exit(); + return ret; } module_init(snd_soc_init); diff -u linux-kvm-5.19.0/sound/soc/soc-pcm.c linux-kvm-5.19.0/sound/soc/soc-pcm.c --- linux-kvm-5.19.0/sound/soc/soc-pcm.c +++ linux-kvm-5.19.0/sound/soc/soc-pcm.c @@ -800,11 +800,6 @@ ret = snd_soc_dai_startup(dai, substream); if (ret < 0) goto err; - - if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) - dai->tx_mask = 0; - else - dai->rx_mask = 0; } /* Dynamic PCM DAI links compat checks use dynamic capabilities */ diff -u linux-kvm-5.19.0/sound/soc/sof/intel/cnl.c linux-kvm-5.19.0/sound/soc/sof/intel/cnl.c --- linux-kvm-5.19.0/sound/soc/sof/intel/cnl.c +++ linux-kvm-5.19.0/sound/soc/sof/intel/cnl.c @@ -412,6 +412,7 @@ .sdw_alh_base = SDW_ALH_BASE, .check_sdw_irq = hda_common_check_sdw_irq, .check_ipc_irq = hda_dsp_check_ipc_irq, + .cl_init = cl_dsp_init, .hw_ip_version = SOF_INTEL_CAVS_1_8, }; EXPORT_SYMBOL_NS(cnl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); @@ -441,6 +442,7 @@ .sdw_alh_base = SDW_ALH_BASE, .check_sdw_irq = hda_common_check_sdw_irq, .check_ipc_irq = hda_dsp_check_ipc_irq, + .cl_init = cl_dsp_init, .hw_ip_version = SOF_INTEL_CAVS_2_0, }; EXPORT_SYMBOL_NS(jsl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); diff -u linux-kvm-5.19.0/sound/soc/sof/ipc3-topology.c linux-kvm-5.19.0/sound/soc/sof/ipc3-topology.c --- linux-kvm-5.19.0/sound/soc/sof/ipc3-topology.c +++ linux-kvm-5.19.0/sound/soc/sof/ipc3-topology.c @@ -2226,6 +2226,7 @@ struct sof_ipc_fw_version *v = &sdev->fw_ready.version; struct snd_sof_widget *swidget; struct snd_sof_route *sroute; + bool dyn_widgets = false; int ret; /* @@ -2235,12 +2236,14 @@ * topology loading the sound card unavailable to open PCMs. */ list_for_each_entry(swidget, &sdev->widget_list, list) { - if (swidget->dynamic_pipeline_widget) + if (swidget->dynamic_pipeline_widget) { + dyn_widgets = true; continue; + } - /* Do not free widgets for static pipelines with FW ABI older than 3.19 */ + /* Do not free widgets for static pipelines with FW older than SOF2.2 */ if (!verify && !swidget->dynamic_pipeline_widget && - v->abi_version < SOF_ABI_VER(3, 19, 0)) { + SOF_FW_VER(v->major, v->minor, v->micro) < SOF_FW_VER(2, 2, 0)) { swidget->use_count = 0; swidget->complete = 0; continue; @@ -2254,9 +2257,11 @@ /* * Tear down all pipelines associated with PCMs that did not get suspended * and unset the prepare flag so that they can be set up again during resume. - * Skip this step for older firmware. + * Skip this step for older firmware unless topology has any + * dynamic pipeline (in which case the step is mandatory). */ - if (!verify && v->abi_version >= SOF_ABI_VER(3, 19, 0)) { + if (!verify && (dyn_widgets || SOF_FW_VER(v->major, v->minor, v->micro) >= + SOF_FW_VER(2, 2, 0))) { ret = sof_tear_down_left_over_pipelines(sdev); if (ret < 0) { dev_err(sdev->dev, "failed to tear down paused pipelines\n"); diff -u linux-kvm-5.19.0/sound/soc/stm/stm32_adfsdm.c linux-kvm-5.19.0/sound/soc/stm/stm32_adfsdm.c --- linux-kvm-5.19.0/sound/soc/stm/stm32_adfsdm.c +++ linux-kvm-5.19.0/sound/soc/stm/stm32_adfsdm.c @@ -303,6 +303,11 @@ return 0; } +static void stm32_adfsdm_cleanup(void *data) +{ + iio_channel_release_all_cb(data); +} + static struct snd_soc_component_driver stm32_adfsdm_soc_platform = { .open = stm32_adfsdm_pcm_open, .close = stm32_adfsdm_pcm_close, @@ -349,6 +354,12 @@ if (IS_ERR(priv->iio_cb)) return PTR_ERR(priv->iio_cb); + ret = devm_add_action_or_reset(&pdev->dev, stm32_adfsdm_cleanup, priv->iio_cb); + if (ret < 0) { + dev_err(&pdev->dev, "Unable to add action\n"); + return ret; + } + component = devm_kzalloc(&pdev->dev, sizeof(*component), GFP_KERNEL); if (!component) return -ENOMEM; diff -u linux-kvm-5.19.0/sound/usb/card.c linux-kvm-5.19.0/sound/usb/card.c --- linux-kvm-5.19.0/sound/usb/card.c +++ linux-kvm-5.19.0/sound/usb/card.c @@ -742,6 +742,18 @@ return NULL; } +/* register card if we reach to the last interface or to the specified + * one given via option + */ +static int try_to_register_card(struct snd_usb_audio *chip, int ifnum) +{ + if (check_delayed_register_option(chip) == ifnum || + chip->last_iface == ifnum || + usb_interface_claimed(usb_ifnum_to_if(chip->dev, chip->last_iface))) + return snd_card_register(chip->card); + return 0; +} + /* * probe the active usb device * @@ -880,15 +892,9 @@ chip->need_delayed_register = false; /* clear again */ } - /* register card if we reach to the last interface or to the specified - * one given via option - */ - if (check_delayed_register_option(chip) == ifnum || - usb_interface_claimed(usb_ifnum_to_if(dev, chip->last_iface))) { - err = snd_card_register(chip->card); - if (err < 0) - goto __error; - } + err = try_to_register_card(chip, ifnum); + if (err < 0) + goto __error_no_register; if (chip->quirk_flags & QUIRK_FLAG_SHARE_MEDIA_DEVICE) { /* don't want to fail when snd_media_device_create() fails */ @@ -907,6 +913,11 @@ return 0; __error: + /* in the case of error in secondary interface, still try to register */ + if (chip) + try_to_register_card(chip, ifnum); + + __error_no_register: if (chip) { /* chip->active is inside the chip->card object, * decrement before memory is possibly returned. diff -u linux-kvm-5.19.0/sound/usb/endpoint.c linux-kvm-5.19.0/sound/usb/endpoint.c --- linux-kvm-5.19.0/sound/usb/endpoint.c +++ linux-kvm-5.19.0/sound/usb/endpoint.c @@ -923,7 +923,8 @@ usb_audio_dbg(chip, "Closing EP 0x%x (count %d)\n", ep->ep_num, ep->opened); - if (!--ep->iface_ref->opened) + if (!--ep->iface_ref->opened && + !(chip->quirk_flags & QUIRK_FLAG_IFACE_SKIP_CLOSE)) endpoint_set_interface(chip, ep, false); if (!--ep->opened) { diff -u linux-kvm-5.19.0/sound/usb/quirks-table.h linux-kvm-5.19.0/sound/usb/quirks-table.h --- linux-kvm-5.19.0/sound/usb/quirks-table.h +++ linux-kvm-5.19.0/sound/usb/quirks-table.h @@ -2050,6 +2050,10 @@ } }, { + /* M-Audio Micro */ + USB_DEVICE_VENDOR_SPEC(0x0763, 0x201a), +}, +{ USB_DEVICE_VENDOR_SPEC(0x0763, 0x2030), .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { /* .vendor_name = "M-Audio", */ diff -u linux-kvm-5.19.0/sound/usb/quirks.c linux-kvm-5.19.0/sound/usb/quirks.c --- linux-kvm-5.19.0/sound/usb/quirks.c +++ linux-kvm-5.19.0/sound/usb/quirks.c @@ -1913,6 +1913,7 @@ /* XMOS based USB DACs */ switch (chip->usb_id) { case USB_ID(0x1511, 0x0037): /* AURALiC VEGA */ + case USB_ID(0x21ed, 0xd75a): /* Accuphase DAC-60 option card */ case USB_ID(0x2522, 0x0012): /* LH Labs VI DAC Infinity */ case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */ if (fp->altsetting == 2) @@ -2185,6 +2186,8 @@ QUIRK_FLAG_GENERIC_IMPLICIT_FB), DEVICE_FLG(0x2b53, 0x0031, /* Fiero SC-01 (firmware v1.1.0) */ QUIRK_FLAG_GENERIC_IMPLICIT_FB), + DEVICE_FLG(0x0525, 0xa4ad, /* Hamedal C20 usb camero */ + QUIRK_FLAG_IFACE_SKIP_CLOSE), /* Vendor matches */ VENDOR_FLG(0x045e, /* MS Lifecam */ diff -u linux-kvm-5.19.0/sound/usb/usbaudio.h linux-kvm-5.19.0/sound/usb/usbaudio.h --- linux-kvm-5.19.0/sound/usb/usbaudio.h +++ linux-kvm-5.19.0/sound/usb/usbaudio.h @@ -170,6 +170,8 @@ * Apply the generic implicit feedback sync mode (same as implicit_fb=1 option) * QUIRK_FLAG_SKIP_IMPLICIT_FB * Don't apply implicit feedback sync mode + * QUIRK_FLAG_IFACE_SKIP_CLOSE + * Don't closed interface during setting sample rate */ #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0) @@ -192,4 +194,5 @@ #define QUIRK_FLAG_GENERIC_IMPLICIT_FB (1U << 17) #define QUIRK_FLAG_SKIP_IMPLICIT_FB (1U << 18) +#define QUIRK_FLAG_IFACE_SKIP_CLOSE (1U << 19) #endif /* __USBAUDIO_H */ diff -u linux-kvm-5.19.0/tools/arch/x86/include/asm/msr-index.h linux-kvm-5.19.0/tools/arch/x86/include/asm/msr-index.h --- linux-kvm-5.19.0/tools/arch/x86/include/asm/msr-index.h +++ linux-kvm-5.19.0/tools/arch/x86/include/asm/msr-index.h @@ -523,6 +523,11 @@ #define MSR_AMD64_CPUID_FN_1 0xc0011004 #define MSR_AMD64_LS_CFG 0xc0011020 #define MSR_AMD64_DC_CFG 0xc0011022 + +#define MSR_AMD64_DE_CFG 0xc0011029 +#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT 1 +#define MSR_AMD64_DE_CFG_LFENCE_SERIALIZE BIT_ULL(MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT) + #define MSR_AMD64_BU_CFG2 0xc001102a #define MSR_AMD64_IBSFETCHCTL 0xc0011030 #define MSR_AMD64_IBSFETCHLINAD 0xc0011031 @@ -625,9 +630,6 @@ #define FAM10H_MMIO_CONF_BASE_MASK 0xfffffffULL #define FAM10H_MMIO_CONF_BASE_SHIFT 20 #define MSR_FAM10H_NODE_ID 0xc001100c -#define MSR_F10H_DECFG 0xc0011029 -#define MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT 1 -#define MSR_F10H_DECFG_LFENCE_SERIALIZE BIT_ULL(MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT) /* K8 MSRs */ #define MSR_K8_TOP_MEM1 0xc001001a diff -u linux-kvm-5.19.0/tools/lib/bpf/libbpf.c linux-kvm-5.19.0/tools/lib/bpf/libbpf.c --- linux-kvm-5.19.0/tools/lib/bpf/libbpf.c +++ linux-kvm-5.19.0/tools/lib/bpf/libbpf.c @@ -11683,7 +11683,7 @@ } *link = bpf_program__attach_raw_tracepoint(prog, tp_name); - return libbpf_get_error(link); + return libbpf_get_error(*link); } /* Common logic for all BPF program types that attach to a btf_id */ diff -u linux-kvm-5.19.0/tools/testing/cxl/test/cxl.c linux-kvm-5.19.0/tools/testing/cxl/test/cxl.c --- linux-kvm-5.19.0/tools/testing/cxl/test/cxl.c +++ linux-kvm-5.19.0/tools/testing/cxl/test/cxl.c @@ -673,7 +673,7 @@ pdev = platform_device_alloc("cxl_switch_uport", i); if (!pdev) - goto err_port; + goto err_uport; pdev->dev.parent = &root_port->dev; rc = platform_device_add(pdev); @@ -691,7 +691,7 @@ pdev = platform_device_alloc("cxl_switch_dport", i); if (!pdev) - goto err_port; + goto err_dport; pdev->dev.parent = &uport->dev; rc = platform_device_add(pdev); diff -u linux-kvm-5.19.0/ubuntu/Makefile linux-kvm-5.19.0/ubuntu/Makefile --- linux-kvm-5.19.0/ubuntu/Makefile +++ linux-kvm-5.19.0/ubuntu/Makefile @@ -15,10 +15,6 @@ ## ## ## -obj-$(CONFIG_HIO) += hio/ -## -## -## obj-$(CONFIG_UBUNTU_HOST) += ubuntu-host/ ## ## diff -u linux-kvm-5.19.0/virt/kvm/kvm_main.c linux-kvm-5.19.0/virt/kvm/kvm_main.c --- linux-kvm-5.19.0/virt/kvm/kvm_main.c +++ linux-kvm-5.19.0/virt/kvm/kvm_main.c @@ -5306,6 +5306,7 @@ int (*get)(void *, u64 *), int (*set)(void *, u64), const char *fmt) { + int ret; struct kvm_stat_data *stat_data = (struct kvm_stat_data *) inode->i_private; @@ -5317,15 +5318,13 @@ if (!kvm_get_kvm_safe(stat_data->kvm)) return -ENOENT; - if (simple_attr_open(inode, file, get, - kvm_stats_debugfs_mode(stat_data->desc) & 0222 - ? set : NULL, - fmt)) { + ret = simple_attr_open(inode, file, get, + kvm_stats_debugfs_mode(stat_data->desc) & 0222 + ? set : NULL, fmt); + if (ret) kvm_put_kvm(stat_data->kvm); - return -ENOMEM; - } - return 0; + return ret; } static int kvm_debugfs_release(struct inode *inode, struct file *file) diff -u linux-kvm-5.19.0/virt/kvm/pfncache.c linux-kvm-5.19.0/virt/kvm/pfncache.c --- linux-kvm-5.19.0/virt/kvm/pfncache.c +++ linux-kvm-5.19.0/virt/kvm/pfncache.c @@ -292,7 +292,12 @@ if (!gpc->valid || old_uhva != gpc->uhva) { ret = hva_to_pfn_retry(kvm, gpc); } else { - /* If the HVA→PFN mapping was already valid, don't unmap it. */ + /* + * If the HVA→PFN mapping was already valid, don't unmap it. + * But do update gpc->khva because the offset within the page + * may have changed. + */ + gpc->khva = old_khva + page_offset; old_pfn = KVM_PFN_ERR_FAULT; old_khva = NULL; ret = 0; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/Documentation/devicetree/bindings/iio/adc/aspeed,ast2600-adc.yaml +++ linux-kvm-5.19.0/Documentation/devicetree/bindings/iio/adc/aspeed,ast2600-adc.yaml @@ -62,13 +62,6 @@ description: Inform the driver that last channel will be used to sensor battery. - aspeed,trim-data-valid: - type: boolean - description: | - The ADC reference voltage can be calibrated to obtain the trimming - data which will be stored in otp. This property informs the driver that - the data store in the otp is valid. - required: - compatible - reg only in patch2: unchanged: --- linux-kvm-5.19.0.orig/Documentation/devicetree/bindings/net/engleder,tsnep.yaml +++ linux-kvm-5.19.0/Documentation/devicetree/bindings/net/engleder,tsnep.yaml @@ -28,7 +28,7 @@ nvmem-cells: true - nvmem-cells-names: true + nvmem-cell-names: true phy-connection-type: enum: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/Documentation/virt/kvm/devices/vm.rst +++ linux-kvm-5.19.0/Documentation/virt/kvm/devices/vm.rst @@ -215,6 +215,7 @@ :Parameters: address of a buffer in user space to store the data (u8) to :Returns: -EFAULT if the given address is not accessible from kernel space; -EINVAL if setting the TOD clock extension to != 0 is not supported + -EOPNOTSUPP for a PV guest (TOD managed by the ultravisor) 3.2. ATTRIBUTE: KVM_S390_VM_TOD_LOW ----------------------------------- @@ -224,6 +225,7 @@ :Parameters: address of a buffer in user space to store the data (u64) to :Returns: -EFAULT if the given address is not accessible from kernel space + -EOPNOTSUPP for a PV guest (TOD managed by the ultravisor) 3.3. ATTRIBUTE: KVM_S390_VM_TOD_EXT ----------------------------------- @@ -237,6 +239,7 @@ (kvm_s390_vm_tod_clock) to :Returns: -EFAULT if the given address is not accessible from kernel space; -EINVAL if setting the TOD clock extension to != 0 is not supported + -EOPNOTSUPP for a PV guest (TOD managed by the ultravisor) 4. GROUP: KVM_S390_VM_CRYPTO ============================ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm/boot/dts/am335x-pcm-953.dtsi +++ linux-kvm-5.19.0/arch/arm/boot/dts/am335x-pcm-953.dtsi @@ -12,22 +12,20 @@ compatible = "phytec,am335x-pcm-953", "phytec,am335x-phycore-som", "ti,am33xx"; /* Power */ - regulators { - vcc3v3: fixedregulator@1 { - compatible = "regulator-fixed"; - regulator-name = "vcc3v3"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; - regulator-boot-on; - }; + vcc3v3: fixedregulator1 { + compatible = "regulator-fixed"; + regulator-name = "vcc3v3"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-boot-on; + }; - vcc1v8: fixedregulator@2 { - compatible = "regulator-fixed"; - regulator-name = "vcc1v8"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - regulator-boot-on; - }; + vcc1v8: fixedregulator2 { + compatible = "regulator-fixed"; + regulator-name = "vcc1v8"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-boot-on; }; /* User IO */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm/boot/dts/at91rm9200.dtsi +++ linux-kvm-5.19.0/arch/arm/boot/dts/at91rm9200.dtsi @@ -660,7 +660,7 @@ compatible = "atmel,at91rm9200-udc"; reg = <0xfffb0000 0x4000>; interrupts = <11 IRQ_TYPE_LEVEL_HIGH 2>; - clocks = <&pmc PMC_TYPE_PERIPHERAL 11>, <&pmc PMC_TYPE_SYSTEM 2>; + clocks = <&pmc PMC_TYPE_PERIPHERAL 11>, <&pmc PMC_TYPE_SYSTEM 1>; clock-names = "pclk", "hclk"; status = "disabled"; }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm/boot/dts/at91sam9g20ek_common.dtsi +++ linux-kvm-5.19.0/arch/arm/boot/dts/at91sam9g20ek_common.dtsi @@ -39,6 +39,13 @@ }; + usb1 { + pinctrl_usb1_vbus_gpio: usb1_vbus_gpio { + atmel,pins = + ; /* PC5 GPIO */ + }; + }; + mmc0_slot1 { pinctrl_board_mmc0_slot1: mmc0_slot1-board { atmel,pins = @@ -84,6 +91,8 @@ }; usb1: gadget@fffa4000 { + pinctrl-0 = <&pinctrl_usb1_vbus_gpio>; + pinctrl-names = "default"; atmel,vbus-gpio = <&pioC 5 GPIO_ACTIVE_HIGH>; status = "okay"; }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm/boot/dts/imx6q-prti6q.dts +++ linux-kvm-5.19.0/arch/arm/boot/dts/imx6q-prti6q.dts @@ -364,8 +364,8 @@ pinctrl-names = "default"; pinctrl-0 = <&pinctrl_wifi>; interrupts-extended = <&gpio1 30 IRQ_TYPE_LEVEL_HIGH>; - ref-clock-frequency = "38400000"; - tcxo-clock-frequency = "19200000"; + ref-clock-frequency = <38400000>; + tcxo-clock-frequency = <19200000>; }; }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm/boot/dts/sama7g5-pinfunc.h +++ linux-kvm-5.19.0/arch/arm/boot/dts/sama7g5-pinfunc.h @@ -261,7 +261,7 @@ #define PIN_PB2__FLEXCOM6_IO0 PINMUX_PIN(PIN_PB2, 2, 1) #define PIN_PB2__ADTRG PINMUX_PIN(PIN_PB2, 3, 1) #define PIN_PB2__A20 PINMUX_PIN(PIN_PB2, 4, 1) -#define PIN_PB2__FLEXCOM11_IO0 PINMUX_PIN(PIN_PB2, 6, 3) +#define PIN_PB2__FLEXCOM11_IO1 PINMUX_PIN(PIN_PB2, 6, 3) #define PIN_PB3 35 #define PIN_PB3__GPIO PINMUX_PIN(PIN_PB3, 0, 0) #define PIN_PB3__RF1 PINMUX_PIN(PIN_PB3, 1, 1) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm/mach-mxs/mach-mxs.c +++ linux-kvm-5.19.0/arch/arm/mach-mxs/mach-mxs.c @@ -393,8 +393,10 @@ root = of_find_node_by_path("/"); ret = of_property_read_string(root, "model", &soc_dev_attr->machine); - if (ret) + if (ret) { + kfree(soc_dev_attr); return; + } soc_dev_attr->family = "Freescale MXS Family"; soc_dev_attr->soc_id = mxs_get_soc_id(); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/boot/dts/qcom/sa8155p-adp.dts +++ linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sa8155p-adp.dts @@ -43,7 +43,6 @@ regulator-always-on; regulator-boot-on; - regulator-allow-set-load; vin-supply = <&vreg_3p3>; }; @@ -137,6 +136,9 @@ regulator-max-microvolt = <880000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l7a_1p8: ldo7 { @@ -152,6 +154,9 @@ regulator-max-microvolt = <2960000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l11a_0p8: ldo11 { @@ -258,6 +263,9 @@ regulator-max-microvolt = <1200000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l7c_1p8: ldo7 { @@ -273,6 +281,9 @@ regulator-max-microvolt = <1200000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l10c_3p3: ldo10 { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +++ linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi @@ -348,6 +348,9 @@ regulator-max-microvolt = <2960000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l7c_3p0: ldo7 { @@ -367,6 +370,9 @@ regulator-max-microvolt = <2960000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l10c_3p3: ldo10 { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +++ linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi @@ -317,6 +317,9 @@ regulator-max-microvolt = <2960000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l7c_2p85: ldo7 { @@ -339,6 +342,9 @@ regulator-max-microvolt = <2960000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l10c_3p3: ldo10 { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/boot/dts/qcom/sm8350-hdk.dts +++ linux-kvm-5.19.0/arch/arm64/boot/dts/qcom/sm8350-hdk.dts @@ -107,6 +107,9 @@ regulator-max-microvolt = <888000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l6b_1p2: ldo6 { @@ -115,6 +118,9 @@ regulator-max-microvolt = <1208000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l7b_2p96: ldo7 { @@ -123,6 +129,9 @@ regulator-max-microvolt = <2504000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; vreg_l9b_1p2: ldo9 { @@ -131,6 +140,9 @@ regulator-max-microvolt = <1200000>; regulator-initial-mode = ; regulator-allow-set-load; + regulator-allowed-modes = + ; }; }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts +++ linux-kvm-5.19.0/arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts @@ -207,7 +207,7 @@ cap-sd-highspeed; cd-gpios = <&gpio0 RK_PA7 GPIO_ACTIVE_LOW>; disable-wp; - max-frequency = <150000000>; + max-frequency = <40000000>; pinctrl-names = "default"; pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>; vmmc-supply = <&vcc3v3_baseboard>; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/include/asm/pgtable.h +++ linux-kvm-5.19.0/arch/arm64/include/asm/pgtable.h @@ -847,12 +847,12 @@ static inline bool pmd_user_accessible_page(pmd_t pmd) { - return pmd_present(pmd) && (pmd_user(pmd) || pmd_user_exec(pmd)); + return pmd_leaf(pmd) && (pmd_user(pmd) || pmd_user_exec(pmd)); } static inline bool pud_user_accessible_page(pud_t pud) { - return pud_present(pud) && pud_user(pud); + return pud_leaf(pud) && pud_user(pud); } #endif only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/include/asm/syscall_wrapper.h +++ linux-kvm-5.19.0/arch/arm64/include/asm/syscall_wrapper.h @@ -8,7 +8,7 @@ #ifndef __ASM_SYSCALL_WRAPPER_H #define __ASM_SYSCALL_WRAPPER_H -struct pt_regs; +#include #define SC_ARM64_REGS_TO_ARGS(x, ...) \ __MAP(x,__SC_ARGS \ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/kernel/efi.c +++ linux-kvm-5.19.0/arch/arm64/kernel/efi.c @@ -12,6 +12,14 @@ #include +static bool region_is_misaligned(const efi_memory_desc_t *md) +{ + if (PAGE_SIZE == EFI_PAGE_SIZE) + return false; + return !PAGE_ALIGNED(md->phys_addr) || + !PAGE_ALIGNED(md->num_pages << EFI_PAGE_SHIFT); +} + /* * Only regions of type EFI_RUNTIME_SERVICES_CODE need to be * executable, everything else can be mapped with the XN bits @@ -25,14 +33,22 @@ if (type == EFI_MEMORY_MAPPED_IO) return PROT_DEVICE_nGnRE; - if (WARN_ONCE(!PAGE_ALIGNED(md->phys_addr), - "UEFI Runtime regions are not aligned to 64 KB -- buggy firmware?")) + if (region_is_misaligned(md)) { + static bool __initdata code_is_misaligned; + /* - * If the region is not aligned to the page size of the OS, we - * can not use strict permissions, since that would also affect - * the mapping attributes of the adjacent regions. + * Regions that are not aligned to the OS page size cannot be + * mapped with strict permissions, as those might interfere + * with the permissions that are needed by the adjacent + * region's mapping. However, if we haven't encountered any + * misaligned runtime code regions so far, we can safely use + * non-executable permissions for non-code regions. */ - return pgprot_val(PAGE_KERNEL_EXEC); + code_is_misaligned |= (type == EFI_RUNTIME_SERVICES_CODE); + + return code_is_misaligned ? pgprot_val(PAGE_KERNEL_EXEC) + : pgprot_val(PAGE_KERNEL); + } /* R-- */ if ((attr & (EFI_MEMORY_XP | EFI_MEMORY_RO)) == @@ -63,19 +79,16 @@ bool page_mappings_only = (md->type == EFI_RUNTIME_SERVICES_CODE || md->type == EFI_RUNTIME_SERVICES_DATA); - if (!PAGE_ALIGNED(md->phys_addr) || - !PAGE_ALIGNED(md->num_pages << EFI_PAGE_SHIFT)) { - /* - * If the end address of this region is not aligned to page - * size, the mapping is rounded up, and may end up sharing a - * page frame with the next UEFI memory region. If we create - * a block entry now, we may need to split it again when mapping - * the next region, and support for that is going to be removed - * from the MMU routines. So avoid block mappings altogether in - * that case. - */ + /* + * If this region is not aligned to the page size used by the OS, the + * mapping will be rounded outwards, and may end up sharing a page + * frame with an adjacent runtime memory region. Given that the page + * table descriptor covering the shared page will be rewritten when the + * adjacent region gets mapped, we must avoid block mappings here so we + * don't have to worry about splitting them when that happens. + */ + if (region_is_misaligned(md)) page_mappings_only = true; - } create_pgd_mapping(mm, md->phys_addr, md->virt_addr, md->num_pages << EFI_PAGE_SHIFT, @@ -102,6 +115,9 @@ BUG_ON(md->type != EFI_RUNTIME_SERVICES_CODE && md->type != EFI_RUNTIME_SERVICES_DATA); + if (region_is_misaligned(md)) + return 0; + /* * Calling apply_to_page_range() is only safe on regions that are * guaranteed to be mapped down to pages. Since we are only called only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/arm64/mm/pageattr.c +++ linux-kvm-5.19.0/arch/arm64/mm/pageattr.c @@ -21,7 +21,13 @@ bool can_set_direct_map(void) { - return rodata_full || debug_pagealloc_enabled(); + /* + * rodata_full, DEBUG_PAGEALLOC and KFENCE require linear map to be + * mapped at page granularity, so that it is possible to + * protect/unprotect single pages. + */ + return (rodata_enabled && rodata_full) || debug_pagealloc_enabled() || + IS_ENABLED(CONFIG_KFENCE); } static int change_page_range(pte_t *ptep, unsigned long addr, void *data) @@ -96,7 +102,8 @@ * If we are manipulating read-only permissions, apply the same * change to the linear mapping of the pages that back this VM area. */ - if (rodata_full && (pgprot_val(set_mask) == PTE_RDONLY || + if (rodata_enabled && + rodata_full && (pgprot_val(set_mask) == PTE_RDONLY || pgprot_val(clear_mask) == PTE_RDONLY)) { for (i = 0; i < area->nr_pages; i++) { __change_memory_common((u64)page_address(area->pages[i]), only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/loongarch/include/asm/pgtable.h +++ linux-kvm-5.19.0/arch/loongarch/include/asm/pgtable.h @@ -355,7 +355,9 @@ static inline pte_t pte_mkdirty(pte_t pte) { - pte_val(pte) |= (_PAGE_DIRTY | _PAGE_MODIFIED); + pte_val(pte) |= _PAGE_MODIFIED; + if (pte_val(pte) & _PAGE_WRITE) + pte_val(pte) |= _PAGE_DIRTY; return pte; } @@ -481,7 +483,9 @@ static inline pmd_t pmd_mkdirty(pmd_t pmd) { - pmd_val(pmd) |= (_PAGE_DIRTY | _PAGE_MODIFIED); + pmd_val(pmd) |= _PAGE_MODIFIED; + if (pmd_val(pmd) & _PAGE_WRITE) + pmd_val(pmd) |= _PAGE_DIRTY; return pmd; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/loongarch/kernel/process.c +++ linux-kvm-5.19.0/arch/loongarch/kernel/process.c @@ -149,7 +149,7 @@ childregs->csr_crmd = p->thread.csr_crmd; childregs->csr_prmd = p->thread.csr_prmd; childregs->csr_ecfg = p->thread.csr_ecfg; - return 0; + goto out; } /* user thread */ @@ -167,14 +167,15 @@ */ childregs->csr_euen = 0; + if (clone_flags & CLONE_SETTLS) + childregs->regs[2] = tls; + +out: clear_tsk_thread_flag(p, TIF_USEDFPU); clear_tsk_thread_flag(p, TIF_USEDSIMD); clear_tsk_thread_flag(p, TIF_LSX_CTX_LIVE); clear_tsk_thread_flag(p, TIF_LASX_CTX_LIVE); - if (clone_flags & CLONE_SETTLS) - childregs->regs[2] = tls; - return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/mips/include/asm/fw/fw.h +++ linux-kvm-5.19.0/arch/mips/include/asm/fw/fw.h @@ -26,6 +26,6 @@ extern void fw_meminit(void); extern char *fw_getenv(char *name); extern unsigned long fw_getenvl(char *name); -extern void fw_init_early_console(char port); +extern void fw_init_early_console(void); #endif /* __ASM_FW_H_ */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/mips/kernel/jump_label.c +++ linux-kvm-5.19.0/arch/mips/kernel/jump_label.c @@ -56,7 +56,7 @@ * The branch offset must fit in the instruction's 26 * bit field. */ - WARN_ON((offset >= BIT(25)) || + WARN_ON((offset >= (long)BIT(25)) || (offset < -(long)BIT(25))); insn.j_format.opcode = bc6_op; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/mips/kernel/relocate_kernel.S +++ linux-kvm-5.19.0/arch/mips/kernel/relocate_kernel.S @@ -145,8 +145,7 @@ * kexec_args[0..3] are used to prepare register values. */ -kexec_args: - EXPORT(kexec_args) +EXPORT(kexec_args) arg0: PTR_WD 0x0 arg1: PTR_WD 0x0 arg2: PTR_WD 0x0 @@ -159,8 +158,7 @@ * their registers a0-a3. secondary_kexec_args[0..3] are used * to prepare register values. */ -secondary_kexec_args: - EXPORT(secondary_kexec_args) +EXPORT(secondary_kexec_args) s_arg0: PTR_WD 0x0 s_arg1: PTR_WD 0x0 s_arg2: PTR_WD 0x0 @@ -171,19 +169,16 @@ #endif -kexec_start_address: - EXPORT(kexec_start_address) +EXPORT(kexec_start_address) PTR_WD 0x0 .size kexec_start_address, PTRSIZE -kexec_indirection_page: - EXPORT(kexec_indirection_page) +EXPORT(kexec_indirection_page) PTR_WD 0 .size kexec_indirection_page, PTRSIZE relocate_new_kernel_end: -relocate_new_kernel_size: - EXPORT(relocate_new_kernel_size) +EXPORT(relocate_new_kernel_size) PTR_WD relocate_new_kernel_end - relocate_new_kernel .size relocate_new_kernel_size, PTRSIZE only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/mips/loongson64/reset.c +++ linux-kvm-5.19.0/arch/mips/loongson64/reset.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include @@ -159,8 +160,17 @@ #ifdef CONFIG_KEXEC kexec_argv = kmalloc(KEXEC_ARGV_SIZE, GFP_KERNEL); + if (WARN_ON(!kexec_argv)) + return -ENOMEM; + kdump_argv = kmalloc(KEXEC_ARGV_SIZE, GFP_KERNEL); + if (WARN_ON(!kdump_argv)) + return -ENOMEM; + kexec_envp = kmalloc(KEXEC_ENVP_SIZE, GFP_KERNEL); + if (WARN_ON(!kexec_envp)) + return -ENOMEM; + fw_arg1 = KEXEC_ARGV_ADDR; memcpy(kexec_envp, (void *)fw_arg2, KEXEC_ENVP_SIZE); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/mips/pic32/pic32mzda/early_console.c +++ linux-kvm-5.19.0/arch/mips/pic32/pic32mzda/early_console.c @@ -27,7 +27,7 @@ #define U_BRG(x) (UART_BASE(x) + 0x40) static void __iomem *uart_base; -static char console_port = -1; +static int console_port = -1; static int __init configure_uart_pins(int port) { @@ -47,7 +47,7 @@ return 0; } -static void __init configure_uart(char port, int baud) +static void __init configure_uart(int port, int baud) { u32 pbclk; @@ -60,7 +60,7 @@ uart_base + PIC32_SET(U_STA(port))); } -static void __init setup_early_console(char port, int baud) +static void __init setup_early_console(int port, int baud) { if (configure_uart_pins(port)) return; @@ -130,16 +130,15 @@ return baud; } -void __init fw_init_early_console(char port) +void __init fw_init_early_console(void) { char *arch_cmdline = pic32_getcmdline(); - int baud = -1; + int baud, port; uart_base = ioremap(PIC32_BASE_UART, 0xc00); baud = get_baud_from_cmdline(arch_cmdline); - if (port == -1) - port = get_port_from_cmdline(arch_cmdline); + port = get_port_from_cmdline(arch_cmdline); if (port == -1) port = EARLY_CONSOLE_PORT; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/mips/pic32/pic32mzda/init.c +++ linux-kvm-5.19.0/arch/mips/pic32/pic32mzda/init.c @@ -47,7 +47,7 @@ strlcpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE); #ifdef CONFIG_EARLY_PRINTK - fw_init_early_console(-1); + fw_init_early_console(); #endif pic32_config_init(); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/nios2/boot/Makefile +++ linux-kvm-5.19.0/arch/nios2/boot/Makefile @@ -20,7 +20,7 @@ $(obj)/vmlinux.gz: $(obj)/vmlinux.bin FORCE $(call if_changed,gzip) -$(obj)/vmImage: $(obj)/vmlinux.gz +$(obj)/vmImage: $(obj)/vmlinux.gz FORCE $(call if_changed,uimage) @$(kecho) 'Kernel: $@ is ready' only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/powerpc/net/bpf_jit_comp32.c +++ linux-kvm-5.19.0/arch/powerpc/net/bpf_jit_comp32.c @@ -113,23 +113,19 @@ { int i; - /* First arg comes in as a 32 bits pointer. */ - EMIT(PPC_RAW_MR(bpf_to_ppc(BPF_REG_1), _R3)); - EMIT(PPC_RAW_LI(bpf_to_ppc(BPF_REG_1) - 1, 0)); + /* Initialize tail_call_cnt, to be skipped if we do tail calls. */ + EMIT(PPC_RAW_LI(_R4, 0)); + +#define BPF_TAILCALL_PROLOGUE_SIZE 4 + EMIT(PPC_RAW_STWU(_R1, _R1, -BPF_PPC_STACKFRAME(ctx))); - /* - * Initialize tail_call_cnt in stack frame if we do tail calls. - * Otherwise, put in NOPs so that it can be skipped when we are - * invoked through a tail call. - */ if (ctx->seen & SEEN_TAILCALL) - EMIT(PPC_RAW_STW(bpf_to_ppc(BPF_REG_1) - 1, _R1, - bpf_jit_stack_offsetof(ctx, BPF_PPC_TC))); - else - EMIT(PPC_RAW_NOP()); + EMIT(PPC_RAW_STW(_R4, _R1, bpf_jit_stack_offsetof(ctx, BPF_PPC_TC))); -#define BPF_TAILCALL_PROLOGUE_SIZE 16 + /* First arg comes in as a 32 bits pointer. */ + EMIT(PPC_RAW_MR(bpf_to_ppc(BPF_REG_1), _R3)); + EMIT(PPC_RAW_LI(bpf_to_ppc(BPF_REG_1) - 1, 0)); /* * We need a stack frame, but we don't necessarily need to @@ -170,24 +166,24 @@ for (i = BPF_PPC_NVR_MIN; i <= 31; i++) if (bpf_is_seen_register(ctx, i)) EMIT(PPC_RAW_LWZ(i, _R1, bpf_jit_stack_offsetof(ctx, i))); -} - -void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx) -{ - EMIT(PPC_RAW_MR(_R3, bpf_to_ppc(BPF_REG_0))); - - bpf_jit_emit_common_epilogue(image, ctx); - - /* Tear down our stack frame */ if (ctx->seen & SEEN_FUNC) EMIT(PPC_RAW_LWZ(_R0, _R1, BPF_PPC_STACKFRAME(ctx) + PPC_LR_STKOFF)); + /* Tear down our stack frame */ EMIT(PPC_RAW_ADDI(_R1, _R1, BPF_PPC_STACKFRAME(ctx))); if (ctx->seen & SEEN_FUNC) EMIT(PPC_RAW_MTLR(_R0)); +} + +void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx) +{ + EMIT(PPC_RAW_MR(_R3, bpf_to_ppc(BPF_REG_0))); + + bpf_jit_emit_common_epilogue(image, ctx); + EMIT(PPC_RAW_BLR()); } @@ -244,7 +240,6 @@ EMIT(PPC_RAW_RLWINM(_R3, b2p_index, 2, 0, 29)); EMIT(PPC_RAW_ADD(_R3, _R3, b2p_bpf_array)); EMIT(PPC_RAW_LWZ(_R3, _R3, offsetof(struct bpf_array, ptrs))); - EMIT(PPC_RAW_STW(_R0, _R1, bpf_jit_stack_offsetof(ctx, BPF_PPC_TC))); /* * if (prog == NULL) @@ -255,19 +250,14 @@ /* goto *(prog->bpf_func + prologue_size); */ EMIT(PPC_RAW_LWZ(_R3, _R3, offsetof(struct bpf_prog, bpf_func))); - - if (ctx->seen & SEEN_FUNC) - EMIT(PPC_RAW_LWZ(_R0, _R1, BPF_PPC_STACKFRAME(ctx) + PPC_LR_STKOFF)); - EMIT(PPC_RAW_ADDIC(_R3, _R3, BPF_TAILCALL_PROLOGUE_SIZE)); - - if (ctx->seen & SEEN_FUNC) - EMIT(PPC_RAW_MTLR(_R0)); - EMIT(PPC_RAW_MTCTR(_R3)); EMIT(PPC_RAW_MR(_R3, bpf_to_ppc(BPF_REG_1))); + /* Put tail_call_cnt in r4 */ + EMIT(PPC_RAW_MR(_R4, _R0)); + /* tear restore NVRs, ... */ bpf_jit_emit_common_epilogue(image, ctx); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts +++ linux-kvm-5.19.0/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts @@ -3,6 +3,8 @@ #include "fu540-c000.dtsi" #include +#include +#include /* Clock frequency (in Hz) of the PCB crystal for rtcclk */ #define RTCCLK_FREQ 1000000 @@ -42,6 +44,42 @@ compatible = "gpio-restart"; gpios = <&gpio 10 GPIO_ACTIVE_LOW>; }; + + led-controller { + compatible = "pwm-leds"; + + led-d1 { + pwms = <&pwm0 0 7812500 PWM_POLARITY_INVERTED>; + active-low; + color = ; + max-brightness = <255>; + label = "d1"; + }; + + led-d2 { + pwms = <&pwm0 1 7812500 PWM_POLARITY_INVERTED>; + active-low; + color = ; + max-brightness = <255>; + label = "d2"; + }; + + led-d3 { + pwms = <&pwm0 2 7812500 PWM_POLARITY_INVERTED>; + active-low; + color = ; + max-brightness = <255>; + label = "d3"; + }; + + led-d4 { + pwms = <&pwm0 3 7812500 PWM_POLARITY_INVERTED>; + active-low; + color = ; + max-brightness = <255>; + label = "d4"; + }; + }; }; &uart0 { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/riscv/include/asm/asm.h +++ linux-kvm-5.19.0/arch/riscv/include/asm/asm.h @@ -23,6 +23,7 @@ #define REG_L __REG_SEL(ld, lw) #define REG_S __REG_SEL(sd, sw) #define REG_SC __REG_SEL(sc.d, sc.w) +#define REG_AMOSWAP_AQ __REG_SEL(amoswap.d.aq, amoswap.w.aq) #define REG_ASM __REG_SEL(.dword, .word) #define SZREG __REG_SEL(8, 4) #define LGREG __REG_SEL(3, 2) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/riscv/include/asm/efi.h +++ linux-kvm-5.19.0/arch/riscv/include/asm/efi.h @@ -10,6 +10,7 @@ #include #include #include +#include #ifdef CONFIG_EFI extern void efi_init(void); @@ -20,7 +21,10 @@ int efi_create_mapping(struct mm_struct *mm, efi_memory_desc_t *md); int efi_set_mapping_permissions(struct mm_struct *mm, efi_memory_desc_t *md); -#define arch_efi_call_virt_setup() efi_virtmap_load() +#define arch_efi_call_virt_setup() ({ \ + sync_kernel_mappings(efi_mm.pgd); \ + efi_virtmap_load(); \ + }) #define arch_efi_call_virt_teardown() efi_virtmap_unload() #define arch_efi_call_virt(p, f, args...) p->f(args) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/riscv/include/asm/pgalloc.h +++ linux-kvm-5.19.0/arch/riscv/include/asm/pgalloc.h @@ -127,6 +127,13 @@ #define __p4d_free_tlb(tlb, p4d, addr) p4d_free((tlb)->mm, p4d) #endif /* __PAGETABLE_PMD_FOLDED */ +static inline void sync_kernel_mappings(pgd_t *pgd) +{ + memcpy(pgd + USER_PTRS_PER_PGD, + init_mm.pgd + USER_PTRS_PER_PGD, + (PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t)); +} + static inline pgd_t *pgd_alloc(struct mm_struct *mm) { pgd_t *pgd; @@ -135,9 +142,7 @@ if (likely(pgd != NULL)) { memset(pgd, 0, USER_PTRS_PER_PGD * sizeof(pgd_t)); /* Copy kernel mappings */ - memcpy(pgd + USER_PTRS_PER_PGD, - init_mm.pgd + USER_PTRS_PER_PGD, - (PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t)); + sync_kernel_mappings(pgd); } return pgd; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/riscv/kernel/entry.S +++ linux-kvm-5.19.0/arch/riscv/kernel/entry.S @@ -404,6 +404,19 @@ #ifdef CONFIG_VMAP_STACK handle_kernel_stack_overflow: + /* + * Takes the psuedo-spinlock for the shadow stack, in case multiple + * harts are concurrently overflowing their kernel stacks. We could + * store any value here, but since we're overflowing the kernel stack + * already we only have SP to use as a scratch register. So we just + * swap in the address of the spinlock, as that's definately non-zero. + * + * Pairs with a store_release in handle_bad_stack(). + */ +1: la sp, spin_shadow_stack + REG_AMOSWAP_AQ sp, sp, (sp) + bnez sp, 1b + la sp, shadow_stack addi sp, sp, SHADOW_OVERFLOW_STACK_SIZE only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/riscv/kernel/process.c +++ linux-kvm-5.19.0/arch/riscv/kernel/process.c @@ -164,6 +164,8 @@ unsigned long tls = args->tls; struct pt_regs *childregs = task_pt_regs(p); + memset(&p->thread.s, 0, sizeof(p->thread.s)); + /* p->thread holds context to be restored by __switch_to() */ if (unlikely(args->fn)) { /* Kernel thread */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/riscv/kernel/vdso/Makefile +++ linux-kvm-5.19.0/arch/riscv/kernel/vdso/Makefile @@ -17,6 +17,7 @@ obj-vdso = $(patsubst %, %.o, $(vdso-syms)) note.o ccflags-y := -fno-stack-protector +ccflags-y += -DDISABLE_BRANCH_PROFILING ifneq ($(c-gettimeofday-y),) CFLAGS_vgettimeofday.o += -fPIC -include $(c-gettimeofday-y) @@ -28,9 +29,12 @@ obj-y += vdso.o CPPFLAGS_vdso.lds += -P -C -U$(ARCH) +ifneq ($(filter vgettimeofday, $(vdso-syms)),) +CPPFLAGS_vdso.lds += -DHAS_VGETTIMEOFDAY +endif # Disable -pg to prevent insert call site -CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) -Os +CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) # Disable profiling and instrumentation for VDSO code GCOV_PROFILE := n only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/riscv/kernel/vdso/vdso.lds.S +++ linux-kvm-5.19.0/arch/riscv/kernel/vdso/vdso.lds.S @@ -68,9 +68,11 @@ LINUX_4.15 { global: __vdso_rt_sigreturn; +#ifdef HAS_VGETTIMEOFDAY __vdso_gettimeofday; __vdso_clock_gettime; __vdso_clock_getres; +#endif __vdso_getcpu; __vdso_flush_icache; local: *; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/s390/Kconfig +++ linux-kvm-5.19.0/arch/s390/Kconfig @@ -583,8 +583,7 @@ endchoice config RELOCATABLE - bool "Build a relocatable kernel" - default y + def_bool y help This builds a kernel image that retains relocation information so it can be loaded at an arbitrary address. @@ -593,10 +592,11 @@ bootup process. The relocations make the kernel image about 15% larger (compressed 10%), but are discarded at runtime. + Note: this option exists only for documentation purposes, please do + not remove it. config RANDOMIZE_BASE bool "Randomize the address of the kernel image (KASLR)" - depends on RELOCATABLE default y help In support of Kernel Address Space Layout Randomization (KASLR), only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/s390/Makefile +++ linux-kvm-5.19.0/arch/s390/Makefile @@ -14,10 +14,8 @@ KBUILD_CFLAGS_MODULE += -fPIC KBUILD_AFLAGS += -m64 KBUILD_CFLAGS += -m64 -ifeq ($(CONFIG_RELOCATABLE),y) KBUILD_CFLAGS += -fPIE LDFLAGS_vmlinux := -pie -endif aflags_dwarf := -Wa,-gdwarf-2 KBUILD_AFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -D__ASSEMBLY__ ifndef CONFIG_AS_IS_LLVM only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/s390/boot/Makefile +++ linux-kvm-5.19.0/arch/s390/boot/Makefile @@ -37,9 +37,8 @@ obj-y := head.o als.o startup.o mem_detect.o ipl_parm.o ipl_report.o obj-y += string.o ebcdic.o sclp_early_core.o mem.o ipl_vmparm.o cmdline.o -obj-y += version.o pgm_check_info.o ctype.o ipl_data.o +obj-y += version.o pgm_check_info.o ctype.o ipl_data.o machine_kexec_reloc.o obj-$(findstring y, $(CONFIG_PROTECTED_VIRTUALIZATION_GUEST) $(CONFIG_PGSTE)) += uv.o -obj-$(CONFIG_RELOCATABLE) += machine_kexec_reloc.o obj-$(CONFIG_RANDOMIZE_BASE) += kaslr.o obj-y += $(if $(CONFIG_KERNEL_UNCOMPRESSED),,decompressor.o) info.o obj-$(CONFIG_KERNEL_ZSTD) += clz_ctz.o only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/s390/boot/startup.c +++ linux-kvm-5.19.0/arch/s390/boot/startup.c @@ -283,8 +283,7 @@ clear_bss_section(); copy_bootdata(); - if (IS_ENABLED(CONFIG_RELOCATABLE)) - handle_relocs(__kaslr_offset); + handle_relocs(__kaslr_offset); if (__kaslr_offset) { /* only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/s390/include/asm/processor.h +++ linux-kvm-5.19.0/arch/s390/include/asm/processor.h @@ -202,7 +202,16 @@ /* Has task runtime instrumentation enabled ? */ #define is_ri_task(tsk) (!!(tsk)->thread.ri_cb) -register unsigned long current_stack_pointer asm("r15"); +/* avoid using global register due to gcc bug in versions < 8.4 */ +#define current_stack_pointer (__current_stack_pointer()) + +static __always_inline unsigned long __current_stack_pointer(void) +{ + unsigned long sp; + + asm volatile("lgr %0,15" : "=d" (sp)); + return sp; +} static __always_inline unsigned short stap(void) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/events/amd/core.c +++ linux-kvm-5.19.0/arch/x86/events/amd/core.c @@ -896,8 +896,7 @@ pmu_enabled = cpuc->enabled; cpuc->enabled = 0; - /* stop everything (includes BRS) */ - amd_pmu_disable_all(); + amd_brs_disable_all(); /* Drain BRS is in use (could be inactive) */ if (cpuc->lbr_users) @@ -908,7 +907,7 @@ cpuc->enabled = pmu_enabled; if (pmu_enabled) - amd_pmu_enable_all(0); + amd_brs_enable_all(); return amd_pmu_adjust_nmi_window(handled); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/events/intel/pt.c +++ linux-kvm-5.19.0/arch/x86/events/intel/pt.c @@ -1263,6 +1263,15 @@ if (1 << order != nr_pages) goto out; + /* + * Some processors cannot always support single range for more than + * 4KB - refer errata TGL052, ADL037 and RPL017. Future processors might + * also be affected, so for now rather than trying to keep track of + * which ones, just disable it for all. + */ + if (nr_pages > 1) + goto out; + buf->single = true; buf->nr_pages = nr_pages; ret = 0; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kernel/asm-offsets.c +++ linux-kvm-5.19.0/arch/x86/kernel/asm-offsets.c @@ -19,7 +19,6 @@ #include #include #include -#include "../kvm/vmx/vmx.h" #ifdef CONFIG_XEN #include @@ -108,9 +107,4 @@ OFFSET(TSS_sp0, tss_struct, x86_tss.sp0); OFFSET(TSS_sp1, tss_struct, x86_tss.sp1); OFFSET(TSS_sp2, tss_struct, x86_tss.sp2); - - if (IS_ENABLED(CONFIG_KVM_INTEL)) { - BLANK(); - OFFSET(VMX_spec_ctrl, vcpu_vmx, spec_ctrl); - } } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kernel/cpu/amd.c +++ linux-kvm-5.19.0/arch/x86/kernel/cpu/amd.c @@ -770,8 +770,6 @@ set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH); } -#define MSR_AMD64_DE_CFG 0xC0011029 - static void init_amd_ln(struct cpuinfo_x86 *c) { /* @@ -965,8 +963,8 @@ * msr_set_bit() uses the safe accessors, too, even if the MSR * is not present. */ - msr_set_bit(MSR_F10H_DECFG, - MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT); + msr_set_bit(MSR_AMD64_DE_CFG, + MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT); /* A serializing LFENCE stops RDTSC speculation */ set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kernel/cpu/hygon.c +++ linux-kvm-5.19.0/arch/x86/kernel/cpu/hygon.c @@ -326,8 +326,8 @@ * msr_set_bit() uses the safe accessors, too, even if the MSR * is not present. */ - msr_set_bit(MSR_F10H_DECFG, - MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT); + msr_set_bit(MSR_AMD64_DE_CFG, + MSR_AMD64_DE_CFG_LFENCE_SERIALIZE_BIT); /* A serializing LFENCE stops RDTSC speculation */ set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kernel/cpu/sgx/ioctl.c +++ linux-kvm-5.19.0/arch/x86/kernel/cpu/sgx/ioctl.c @@ -372,6 +372,29 @@ return ret; } +/* + * Ensure user provided offset and length values are valid for + * an enclave. + */ +static int sgx_validate_offset_length(struct sgx_encl *encl, + unsigned long offset, + unsigned long length) +{ + if (!IS_ALIGNED(offset, PAGE_SIZE)) + return -EINVAL; + + if (!length || !IS_ALIGNED(length, PAGE_SIZE)) + return -EINVAL; + + if (offset + length < offset) + return -EINVAL; + + if (offset + length - PAGE_SIZE >= encl->size) + return -EINVAL; + + return 0; +} + /** * sgx_ioc_enclave_add_pages() - The handler for %SGX_IOC_ENCLAVE_ADD_PAGES * @encl: an enclave pointer @@ -425,14 +448,10 @@ if (copy_from_user(&add_arg, arg, sizeof(add_arg))) return -EFAULT; - if (!IS_ALIGNED(add_arg.offset, PAGE_SIZE) || - !IS_ALIGNED(add_arg.src, PAGE_SIZE)) - return -EINVAL; - - if (!add_arg.length || add_arg.length & (PAGE_SIZE - 1)) + if (!IS_ALIGNED(add_arg.src, PAGE_SIZE)) return -EINVAL; - if (add_arg.offset + add_arg.length - PAGE_SIZE >= encl->size) + if (sgx_validate_offset_length(encl, add_arg.offset, add_arg.length)) return -EINVAL; if (copy_from_user(&secinfo, (void __user *)add_arg.secinfo, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kernel/cpu/tsx.c +++ linux-kvm-5.19.0/arch/x86/kernel/cpu/tsx.c @@ -58,24 +58,6 @@ wrmsrl(MSR_IA32_TSX_CTRL, tsx); } -static bool tsx_ctrl_is_supported(void) -{ - u64 ia32_cap = x86_read_arch_cap_msr(); - - /* - * TSX is controlled via MSR_IA32_TSX_CTRL. However, support for this - * MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES. - * - * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a - * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES - * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get - * MSR_IA32_TSX_CTRL support even after a microcode update. Thus, - * tsx= cmdline requests will do nothing on CPUs without - * MSR_IA32_TSX_CTRL support. - */ - return !!(ia32_cap & ARCH_CAP_TSX_CTRL_MSR); -} - static enum tsx_ctrl_states x86_get_tsx_auto_mode(void) { if (boot_cpu_has_bug(X86_BUG_TAA)) @@ -135,7 +117,7 @@ rdmsrl(MSR_TSX_FORCE_ABORT, msr); msr |= MSR_TFA_TSX_CPUID_CLEAR; wrmsrl(MSR_TSX_FORCE_ABORT, msr); - } else if (tsx_ctrl_is_supported()) { + } else if (cpu_feature_enabled(X86_FEATURE_MSR_TSX_CTRL)) { rdmsrl(MSR_IA32_TSX_CTRL, msr); msr |= TSX_CTRL_CPUID_CLEAR; wrmsrl(MSR_IA32_TSX_CTRL, msr); @@ -158,7 +140,8 @@ u64 mcu_opt_ctrl; /* Check if RTM_ALLOW exists */ - if (!boot_cpu_has_bug(X86_BUG_TAA) || !tsx_ctrl_is_supported() || + if (!boot_cpu_has_bug(X86_BUG_TAA) || + !cpu_feature_enabled(X86_FEATURE_MSR_TSX_CTRL) || !cpu_feature_enabled(X86_FEATURE_SRBDS_CTRL)) return; @@ -191,7 +174,20 @@ return; } - if (!tsx_ctrl_is_supported()) { + /* + * TSX is controlled via MSR_IA32_TSX_CTRL. However, support for this + * MSR is enumerated by ARCH_CAP_TSX_MSR bit in MSR_IA32_ARCH_CAPABILITIES. + * + * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a + * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES + * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get + * MSR_IA32_TSX_CTRL support even after a microcode update. Thus, + * tsx= cmdline requests will do nothing on CPUs without + * MSR_IA32_TSX_CTRL support. + */ + if (x86_read_arch_cap_msr() & ARCH_CAP_TSX_CTRL_MSR) { + setup_force_cpu_cap(X86_FEATURE_MSR_TSX_CTRL); + } else { tsx_ctrl_state = TSX_CTRL_NOT_SUPPORTED; return; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kernel/fpu/core.c +++ linux-kvm-5.19.0/arch/x86/kernel/fpu/core.c @@ -605,9 +605,9 @@ if (test_thread_flag(TIF_NEED_FPU_LOAD)) fpregs_restore_userregs(); save_fpregs_to_fpstate(dst_fpu); + fpregs_unlock(); if (!(clone_flags & CLONE_THREAD)) fpu_inherit_perms(dst_fpu); - fpregs_unlock(); /* * Children never inherit PASID state. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kvm/Makefile +++ linux-kvm-5.19.0/arch/x86/kvm/Makefile @@ -34,3 +34,15 @@ obj-$(CONFIG_KVM) += kvm.o obj-$(CONFIG_KVM_INTEL) += kvm-intel.o obj-$(CONFIG_KVM_AMD) += kvm-amd.o + +AFLAGS_svm/vmenter.o := -iquote $(obj) +$(obj)/svm/vmenter.o: $(obj)/kvm-asm-offsets.h + +AFLAGS_vmx/vmenter.o := -iquote $(obj) +$(obj)/vmx/vmenter.o: $(obj)/kvm-asm-offsets.h + +$(obj)/kvm-asm-offsets.h: $(obj)/kvm-asm-offsets.s FORCE + $(call filechk,offsets,__KVM_ASM_OFFSETS_H__) + +targets += kvm-asm-offsets.s +clean-files += kvm-asm-offsets.h only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kvm/kvm-asm-offsets.c +++ linux-kvm-5.19.0/arch/x86/kvm/kvm-asm-offsets.c @@ -0,0 +1,29 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Generate definitions needed by assembly language modules. + * This code generates raw asm output which is post-processed to extract + * and format the required data. + */ +#define COMPILE_OFFSETS + +#include +#include "vmx/vmx.h" +#include "svm/svm.h" + +static void __used common(void) +{ + if (IS_ENABLED(CONFIG_KVM_AMD)) { + BLANK(); + OFFSET(SVM_vcpu_arch_regs, vcpu_svm, vcpu.arch.regs); + OFFSET(SVM_current_vmcb, vcpu_svm, current_vmcb); + OFFSET(SVM_spec_ctrl, vcpu_svm, spec_ctrl); + OFFSET(SVM_vmcb01, vcpu_svm, vmcb01); + OFFSET(KVM_VMCB_pa, kvm_vmcb_info, pa); + OFFSET(SD_save_area_pa, svm_cpu_data, save_area_pa); + } + + if (IS_ENABLED(CONFIG_KVM_INTEL)) { + BLANK(); + OFFSET(VMX_spec_ctrl, vcpu_vmx, spec_ctrl); + } +} only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kvm/svm/svm.h +++ linux-kvm-5.19.0/arch/x86/kvm/svm/svm.h @@ -267,8 +267,6 @@ }; struct svm_cpu_data { - int cpu; - u64 asid_generation; u32 max_asid; u32 next_asid; @@ -276,13 +274,15 @@ struct kvm_ldttss_desc *tss_desc; struct page *save_area; + unsigned long save_area_pa; + struct vmcb *current_vmcb; /* index = sev_asid, value = vmcb pointer */ struct vmcb **sev_vmcbs; }; -DECLARE_PER_CPU(struct svm_cpu_data *, svm_data); +DECLARE_PER_CPU(struct svm_cpu_data, svm_data); void recalc_intercepts(struct vcpu_svm *svm); @@ -660,7 +660,7 @@ /* vmenter.S */ -void __svm_sev_es_vcpu_run(unsigned long vmcb_pa); -void __svm_vcpu_run(unsigned long vmcb_pa, unsigned long *regs); +void __svm_sev_es_vcpu_run(struct vcpu_svm *svm, bool spec_ctrl_intercepted); +void __svm_vcpu_run(struct vcpu_svm *svm, bool spec_ctrl_intercepted); #endif only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kvm/svm/svm_ops.h +++ linux-kvm-5.19.0/arch/x86/kvm/svm/svm_ops.h @@ -61,9 +61,4 @@ svm_asm1(vmsave, "a" (pa), "memory"); } -static __always_inline void vmload(unsigned long pa) -{ - svm_asm1(vmload, "a" (pa), "memory"); -} - #endif /* __KVM_X86_SVM_OPS_H */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/kvm/svm/vmenter.S +++ linux-kvm-5.19.0/arch/x86/kvm/svm/vmenter.S @@ -4,35 +4,97 @@ #include #include #include +#include "kvm-asm-offsets.h" #define WORD_SIZE (BITS_PER_LONG / 8) /* Intentionally omit RAX as it's context switched by hardware */ -#define VCPU_RCX __VCPU_REGS_RCX * WORD_SIZE -#define VCPU_RDX __VCPU_REGS_RDX * WORD_SIZE -#define VCPU_RBX __VCPU_REGS_RBX * WORD_SIZE +#define VCPU_RCX (SVM_vcpu_arch_regs + __VCPU_REGS_RCX * WORD_SIZE) +#define VCPU_RDX (SVM_vcpu_arch_regs + __VCPU_REGS_RDX * WORD_SIZE) +#define VCPU_RBX (SVM_vcpu_arch_regs + __VCPU_REGS_RBX * WORD_SIZE) /* Intentionally omit RSP as it's context switched by hardware */ -#define VCPU_RBP __VCPU_REGS_RBP * WORD_SIZE -#define VCPU_RSI __VCPU_REGS_RSI * WORD_SIZE -#define VCPU_RDI __VCPU_REGS_RDI * WORD_SIZE +#define VCPU_RBP (SVM_vcpu_arch_regs + __VCPU_REGS_RBP * WORD_SIZE) +#define VCPU_RSI (SVM_vcpu_arch_regs + __VCPU_REGS_RSI * WORD_SIZE) +#define VCPU_RDI (SVM_vcpu_arch_regs + __VCPU_REGS_RDI * WORD_SIZE) #ifdef CONFIG_X86_64 -#define VCPU_R8 __VCPU_REGS_R8 * WORD_SIZE -#define VCPU_R9 __VCPU_REGS_R9 * WORD_SIZE -#define VCPU_R10 __VCPU_REGS_R10 * WORD_SIZE -#define VCPU_R11 __VCPU_REGS_R11 * WORD_SIZE -#define VCPU_R12 __VCPU_REGS_R12 * WORD_SIZE -#define VCPU_R13 __VCPU_REGS_R13 * WORD_SIZE -#define VCPU_R14 __VCPU_REGS_R14 * WORD_SIZE -#define VCPU_R15 __VCPU_REGS_R15 * WORD_SIZE +#define VCPU_R8 (SVM_vcpu_arch_regs + __VCPU_REGS_R8 * WORD_SIZE) +#define VCPU_R9 (SVM_vcpu_arch_regs + __VCPU_REGS_R9 * WORD_SIZE) +#define VCPU_R10 (SVM_vcpu_arch_regs + __VCPU_REGS_R10 * WORD_SIZE) +#define VCPU_R11 (SVM_vcpu_arch_regs + __VCPU_REGS_R11 * WORD_SIZE) +#define VCPU_R12 (SVM_vcpu_arch_regs + __VCPU_REGS_R12 * WORD_SIZE) +#define VCPU_R13 (SVM_vcpu_arch_regs + __VCPU_REGS_R13 * WORD_SIZE) +#define VCPU_R14 (SVM_vcpu_arch_regs + __VCPU_REGS_R14 * WORD_SIZE) +#define VCPU_R15 (SVM_vcpu_arch_regs + __VCPU_REGS_R15 * WORD_SIZE) #endif +#define SVM_vmcb01_pa (SVM_vmcb01 + KVM_VMCB_pa) + .section .noinstr.text, "ax" +.macro RESTORE_GUEST_SPEC_CTRL + /* No need to do anything if SPEC_CTRL is unset or V_SPEC_CTRL is set */ + ALTERNATIVE_2 "", \ + "jmp 800f", X86_FEATURE_MSR_SPEC_CTRL, \ + "", X86_FEATURE_V_SPEC_CTRL +801: +.endm +.macro RESTORE_GUEST_SPEC_CTRL_BODY +800: + /* + * SPEC_CTRL handling: if the guest's SPEC_CTRL value differs from the + * host's, write the MSR. This is kept out-of-line so that the common + * case does not have to jump. + * + * IMPORTANT: To avoid RSB underflow attacks and any other nastiness, + * there must not be any returns or indirect branches between this code + * and vmentry. + */ + movl SVM_spec_ctrl(%_ASM_DI), %eax + cmp PER_CPU_VAR(x86_spec_ctrl_current), %eax + je 801b + mov $MSR_IA32_SPEC_CTRL, %ecx + xor %edx, %edx + wrmsr + jmp 801b +.endm + +.macro RESTORE_HOST_SPEC_CTRL + /* No need to do anything if SPEC_CTRL is unset or V_SPEC_CTRL is set */ + ALTERNATIVE_2 "", \ + "jmp 900f", X86_FEATURE_MSR_SPEC_CTRL, \ + "", X86_FEATURE_V_SPEC_CTRL +901: +.endm +.macro RESTORE_HOST_SPEC_CTRL_BODY +900: + /* Same for after vmexit. */ + mov $MSR_IA32_SPEC_CTRL, %ecx + + /* + * Load the value that the guest had written into MSR_IA32_SPEC_CTRL, + * if it was not intercepted during guest execution. + */ + cmpb $0, (%_ASM_SP) + jnz 998f + rdmsr + movl %eax, SVM_spec_ctrl(%_ASM_DI) +998: + + /* Now restore the host value of the MSR if different from the guest's. */ + movl PER_CPU_VAR(x86_spec_ctrl_current), %eax + cmp SVM_spec_ctrl(%_ASM_DI), %eax + je 901b + xor %edx, %edx + wrmsr + jmp 901b +.endm + + /** * __svm_vcpu_run - Run a vCPU via a transition to SVM guest mode - * @vmcb_pa: unsigned long - * @regs: unsigned long * (to guest registers) + * @svm: struct vcpu_svm * + * @spec_ctrl_intercepted: bool */ SYM_FUNC_START(__svm_vcpu_run) push %_ASM_BP @@ -47,49 +109,71 @@ #endif push %_ASM_BX - /* Save @regs. */ + /* + * Save variables needed after vmexit on the stack, in inverse + * order compared to when they are needed. + */ + + /* Accessed directly from the stack in RESTORE_HOST_SPEC_CTRL. */ push %_ASM_ARG2 - /* Save @vmcb. */ + /* Needed to restore access to percpu variables. */ + __ASM_SIZE(push) PER_CPU_VAR(svm_data + SD_save_area_pa) + + /* Finally save @svm. */ push %_ASM_ARG1 - /* Move @regs to RAX. */ - mov %_ASM_ARG2, %_ASM_AX +.ifnc _ASM_ARG1, _ASM_DI + /* + * Stash @svm in RDI early. On 32-bit, arguments are in RAX, RCX + * and RDX which are clobbered by RESTORE_GUEST_SPEC_CTRL. + */ + mov %_ASM_ARG1, %_ASM_DI +.endif + + /* Clobbers RAX, RCX, RDX. */ + RESTORE_GUEST_SPEC_CTRL + + /* + * Use a single vmcb (vmcb01 because it's always valid) for + * context switching guest state via VMLOAD/VMSAVE, that way + * the state doesn't need to be copied between vmcb01 and + * vmcb02 when switching vmcbs for nested virtualization. + */ + mov SVM_vmcb01_pa(%_ASM_DI), %_ASM_AX +1: vmload %_ASM_AX +2: + + /* Get svm->current_vmcb->pa into RAX. */ + mov SVM_current_vmcb(%_ASM_DI), %_ASM_AX + mov KVM_VMCB_pa(%_ASM_AX), %_ASM_AX /* Load guest registers. */ - mov VCPU_RCX(%_ASM_AX), %_ASM_CX - mov VCPU_RDX(%_ASM_AX), %_ASM_DX - mov VCPU_RBX(%_ASM_AX), %_ASM_BX - mov VCPU_RBP(%_ASM_AX), %_ASM_BP - mov VCPU_RSI(%_ASM_AX), %_ASM_SI - mov VCPU_RDI(%_ASM_AX), %_ASM_DI -#ifdef CONFIG_X86_64 - mov VCPU_R8 (%_ASM_AX), %r8 - mov VCPU_R9 (%_ASM_AX), %r9 - mov VCPU_R10(%_ASM_AX), %r10 - mov VCPU_R11(%_ASM_AX), %r11 - mov VCPU_R12(%_ASM_AX), %r12 - mov VCPU_R13(%_ASM_AX), %r13 - mov VCPU_R14(%_ASM_AX), %r14 - mov VCPU_R15(%_ASM_AX), %r15 + mov VCPU_RCX(%_ASM_DI), %_ASM_CX + mov VCPU_RDX(%_ASM_DI), %_ASM_DX + mov VCPU_RBX(%_ASM_DI), %_ASM_BX + mov VCPU_RBP(%_ASM_DI), %_ASM_BP + mov VCPU_RSI(%_ASM_DI), %_ASM_SI +#ifdef CONFIG_X86_64 + mov VCPU_R8 (%_ASM_DI), %r8 + mov VCPU_R9 (%_ASM_DI), %r9 + mov VCPU_R10(%_ASM_DI), %r10 + mov VCPU_R11(%_ASM_DI), %r11 + mov VCPU_R12(%_ASM_DI), %r12 + mov VCPU_R13(%_ASM_DI), %r13 + mov VCPU_R14(%_ASM_DI), %r14 + mov VCPU_R15(%_ASM_DI), %r15 #endif - - /* "POP" @vmcb to RAX. */ - pop %_ASM_AX + mov VCPU_RDI(%_ASM_DI), %_ASM_DI /* Enter guest mode */ sti -1: vmrun %_ASM_AX - -2: cli - -#ifdef CONFIG_RETPOLINE - /* IMPORTANT: Stuff the RSB immediately after VM-Exit, before RET! */ - FILL_RETURN_BUFFER %_ASM_AX, RSB_CLEAR_LOOPS, X86_FEATURE_RETPOLINE -#endif +3: vmrun %_ASM_AX +4: + cli - /* "POP" @regs to RAX. */ + /* Pop @svm to RAX while it's the only available register. */ pop %_ASM_AX /* Save all guest registers. */ @@ -110,6 +194,26 @@ mov %r15, VCPU_R15(%_ASM_AX) #endif + /* @svm can stay in RDI from now on. */ + mov %_ASM_AX, %_ASM_DI + + mov SVM_vmcb01_pa(%_ASM_DI), %_ASM_AX +5: vmsave %_ASM_AX +6: + + /* Restores GSBASE among other things, allowing access to percpu data. */ + pop %_ASM_AX +7: vmload %_ASM_AX +8: + +#ifdef CONFIG_RETPOLINE + /* IMPORTANT: Stuff the RSB immediately after VM-Exit, before RET! */ + FILL_RETURN_BUFFER %_ASM_AX, RSB_CLEAR_LOOPS, X86_FEATURE_RETPOLINE +#endif + + /* Clobbers RAX, RCX, RDX. */ + RESTORE_HOST_SPEC_CTRL + /* * Mitigate RETBleed for AMD/Hygon Zen uarch. RET should be * untrained as soon as we exit the VM and are back to the @@ -145,6 +249,9 @@ xor %r15d, %r15d #endif + /* "Pop" @spec_ctrl_intercepted. */ + pop %_ASM_BX + pop %_ASM_BX #ifdef CONFIG_X86_64 @@ -159,17 +266,33 @@ pop %_ASM_BP RET -3: cmpb $0, kvm_rebooting + RESTORE_GUEST_SPEC_CTRL_BODY + RESTORE_HOST_SPEC_CTRL_BODY + +10: cmpb $0, kvm_rebooting jne 2b ud2 +30: cmpb $0, kvm_rebooting + jne 4b + ud2 +50: cmpb $0, kvm_rebooting + jne 6b + ud2 +70: cmpb $0, kvm_rebooting + jne 8b + ud2 - _ASM_EXTABLE(1b, 3b) + _ASM_EXTABLE(1b, 10b) + _ASM_EXTABLE(3b, 30b) + _ASM_EXTABLE(5b, 50b) + _ASM_EXTABLE(7b, 70b) SYM_FUNC_END(__svm_vcpu_run) /** * __svm_sev_es_vcpu_run - Run a SEV-ES vCPU via a transition to SVM guest mode - * @vmcb_pa: unsigned long + * @svm: struct vcpu_svm * + * @spec_ctrl_intercepted: bool */ SYM_FUNC_START(__svm_sev_es_vcpu_run) push %_ASM_BP @@ -184,8 +307,31 @@ #endif push %_ASM_BX - /* Move @vmcb to RAX. */ - mov %_ASM_ARG1, %_ASM_AX + /* + * Save variables needed after vmexit on the stack, in inverse + * order compared to when they are needed. + */ + + /* Accessed directly from the stack in RESTORE_HOST_SPEC_CTRL. */ + push %_ASM_ARG2 + + /* Save @svm. */ + push %_ASM_ARG1 + +.ifnc _ASM_ARG1, _ASM_DI + /* + * Stash @svm in RDI early. On 32-bit, arguments are in RAX, RCX + * and RDX which are clobbered by RESTORE_GUEST_SPEC_CTRL. + */ + mov %_ASM_ARG1, %_ASM_DI +.endif + + /* Clobbers RAX, RCX, RDX. */ + RESTORE_GUEST_SPEC_CTRL + + /* Get svm->current_vmcb->pa into RAX. */ + mov SVM_current_vmcb(%_ASM_DI), %_ASM_AX + mov KVM_VMCB_pa(%_ASM_AX), %_ASM_AX /* Enter guest mode */ sti @@ -194,11 +340,17 @@ 2: cli + /* Pop @svm to RDI, guest registers have been saved already. */ + pop %_ASM_DI + #ifdef CONFIG_RETPOLINE /* IMPORTANT: Stuff the RSB immediately after VM-Exit, before RET! */ FILL_RETURN_BUFFER %_ASM_AX, RSB_CLEAR_LOOPS, X86_FEATURE_RETPOLINE #endif + /* Clobbers RAX, RCX, RDX. */ + RESTORE_HOST_SPEC_CTRL + /* * Mitigate RETBleed for AMD/Hygon Zen uarch. RET should be * untrained as soon as we exit the VM and are back to the @@ -208,6 +360,9 @@ */ UNTRAIN_RET + /* "Pop" @spec_ctrl_intercepted. */ + pop %_ASM_BX + pop %_ASM_BX #ifdef CONFIG_X86_64 @@ -222,6 +377,9 @@ pop %_ASM_BP RET + RESTORE_GUEST_SPEC_CTRL_BODY + RESTORE_HOST_SPEC_CTRL_BODY + 3: cmpb $0, kvm_rebooting jne 2b ud2 only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/mm/ioremap.c +++ linux-kvm-5.19.0/arch/x86/mm/ioremap.c @@ -216,9 +216,15 @@ * Mappings have to be page-aligned */ offset = phys_addr & ~PAGE_MASK; - phys_addr &= PHYSICAL_PAGE_MASK; + phys_addr &= PAGE_MASK; size = PAGE_ALIGN(last_addr+1) - phys_addr; + /* + * Mask out any bits not part of the actual physical + * address, like memory encryption bits. + */ + phys_addr &= PHYSICAL_PAGE_MASK; + retval = memtype_reserve(phys_addr, (u64)phys_addr + size, pcm, &new_pcm); if (retval) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/arch/x86/power/cpu.c +++ linux-kvm-5.19.0/arch/x86/power/cpu.c @@ -513,15 +513,23 @@ static void pm_save_spec_msr(void) { - u32 spec_msr_id[] = { - MSR_IA32_SPEC_CTRL, - MSR_IA32_TSX_CTRL, - MSR_TSX_FORCE_ABORT, - MSR_IA32_MCU_OPT_CTRL, - MSR_AMD64_LS_CFG, + struct msr_enumeration { + u32 msr_no; + u32 feature; + } msr_enum[] = { + { MSR_IA32_SPEC_CTRL, X86_FEATURE_MSR_SPEC_CTRL }, + { MSR_IA32_TSX_CTRL, X86_FEATURE_MSR_TSX_CTRL }, + { MSR_TSX_FORCE_ABORT, X86_FEATURE_TSX_FORCE_ABORT }, + { MSR_IA32_MCU_OPT_CTRL, X86_FEATURE_SRBDS_CTRL }, + { MSR_AMD64_LS_CFG, X86_FEATURE_LS_CFG_SSBD }, + { MSR_AMD64_DE_CFG, X86_FEATURE_LFENCE_RDTSC }, }; + int i; - msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id)); + for (i = 0; i < ARRAY_SIZE(msr_enum); i++) { + if (boot_cpu_has(msr_enum[i].feature)) + msr_build_context(&msr_enum[i].msr_no, 1); + } } static int pm_check_save_msr(void) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/block/bfq-cgroup.c +++ linux-kvm-5.19.0/block/bfq-cgroup.c @@ -615,6 +615,10 @@ struct bfq_group *bfqg; while (blkg) { + if (!blkg->online) { + blkg = blkg->parent; + continue; + } bfqg = blkg_to_bfqg(blkg); if (bfqg->online) { bio_associate_blkg_from_css(bio, &blkg->blkcg->css); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/block/blk-cgroup.c +++ linux-kvm-5.19.0/block/blk-cgroup.c @@ -1248,7 +1248,7 @@ * parent so that offline always happens towards the root. */ if (parent) - blkcg_pin_online(css); + blkcg_pin_online(&parent->css); return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/block/blk-settings.c +++ linux-kvm-5.19.0/block/blk-settings.c @@ -58,7 +58,6 @@ lim->zoned = BLK_ZONED_NONE; lim->zone_write_granularity = 0; } -EXPORT_SYMBOL(blk_set_default_limits); /** * blk_set_stacking_limits - set default limits for stacking devices only in patch2: unchanged: --- linux-kvm-5.19.0.orig/block/sed-opal.c +++ linux-kvm-5.19.0/block/sed-opal.c @@ -88,8 +88,8 @@ u64 lowest_lba; size_t pos; - u8 cmd[IO_BUFFER_LENGTH]; - u8 resp[IO_BUFFER_LENGTH]; + u8 *cmd; + u8 *resp; struct parsed_resp parsed; size_t prev_d_len; @@ -2134,6 +2134,8 @@ return; clean_opal_dev(dev); + kfree(dev->resp); + kfree(dev->cmd); kfree(dev); } EXPORT_SYMBOL(free_opal_dev); @@ -2146,17 +2148,39 @@ if (!dev) return NULL; + /* + * Presumably DMA-able buffers must be cache-aligned. Kmalloc makes + * sure the allocated buffer is DMA-safe in that regard. + */ + dev->cmd = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL); + if (!dev->cmd) + goto err_free_dev; + + dev->resp = kmalloc(IO_BUFFER_LENGTH, GFP_KERNEL); + if (!dev->resp) + goto err_free_cmd; + INIT_LIST_HEAD(&dev->unlk_lst); mutex_init(&dev->dev_lock); dev->data = data; dev->send_recv = send_recv; if (check_opal_support(dev) != 0) { pr_debug("Opal is not supported on this device\n"); - kfree(dev); - return NULL; + goto err_free_resp; } return dev; + +err_free_resp: + kfree(dev->resp); + +err_free_cmd: + kfree(dev->cmd); + +err_free_dev: + kfree(dev); + + return NULL; } EXPORT_SYMBOL(init_opal_dev); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/accessibility/speakup/main.c +++ linux-kvm-5.19.0/drivers/accessibility/speakup/main.c @@ -1778,7 +1778,7 @@ { unsigned long flags; - if (!speakup_console[vc->vc_num] || spk_parked) + if (!speakup_console[vc->vc_num] || spk_parked || !synth) return; if (!spin_trylock_irqsave(&speakup_info.spinlock, flags)) /* Speakup output, discard */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/acpi/numa/hmat.c +++ linux-kvm-5.19.0/drivers/acpi/numa/hmat.c @@ -563,17 +563,26 @@ { struct memory_initiator *ia; struct memory_initiator *ib; - unsigned long *p_nodes = priv; ia = list_entry(a, struct memory_initiator, node); ib = list_entry(b, struct memory_initiator, node); - set_bit(ia->processor_pxm, p_nodes); - set_bit(ib->processor_pxm, p_nodes); - return ia->processor_pxm - ib->processor_pxm; } +static int initiators_to_nodemask(unsigned long *p_nodes) +{ + struct memory_initiator *initiator; + + if (list_empty(&initiators)) + return -ENXIO; + + list_for_each_entry(initiator, &initiators, node) + set_bit(initiator->processor_pxm, p_nodes); + + return 0; +} + static void hmat_register_target_initiators(struct memory_target *target) { static DECLARE_BITMAP(p_nodes, MAX_NUMNODES); @@ -610,7 +619,10 @@ * initiators. */ bitmap_zero(p_nodes, MAX_NUMNODES); - list_sort(p_nodes, &initiators, initiator_cmp); + list_sort(NULL, &initiators, initiator_cmp); + if (initiators_to_nodemask(p_nodes) < 0) + return; + if (!access0done) { for (i = WRITE_LATENCY; i <= READ_BANDWIDTH; i++) { loc = localities_types[i]; @@ -644,8 +656,9 @@ /* Access 1 ignores Generic Initiators */ bitmap_zero(p_nodes, MAX_NUMNODES); - list_sort(p_nodes, &initiators, initiator_cmp); - best = 0; + if (initiators_to_nodemask(p_nodes) < 0) + return; + for (i = WRITE_LATENCY; i <= READ_BANDWIDTH; i++) { loc = localities_types[i]; if (!loc) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/acpi/scan.c +++ linux-kvm-5.19.0/drivers/acpi/scan.c @@ -811,6 +811,7 @@ static const char * const acpi_ignore_dep_ids[] = { "PNP0D80", /* Windows-compatible System Power Management Controller */ "INT33BD", /* Intel Baytrail Mailbox Device */ + "LATT2021", /* Lattice FW Update Client Driver */ NULL }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/ata/libata-scsi.c +++ linux-kvm-5.19.0/drivers/ata/libata-scsi.c @@ -3267,6 +3267,7 @@ case REPORT_LUNS: case REQUEST_SENSE: case SYNCHRONIZE_CACHE: + case SYNCHRONIZE_CACHE_16: case REZERO_UNIT: case SEEK_6: case SEEK_10: @@ -3925,6 +3926,7 @@ return ata_scsi_write_same_xlat; case SYNCHRONIZE_CACHE: + case SYNCHRONIZE_CACHE_16: if (ata_try_flush_cache(dev)) return ata_scsi_flush_xlat; break; @@ -3965,9 +3967,19 @@ int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, struct ata_device *dev) { + struct ata_port *ap = dev->link->ap; u8 scsi_op = scmd->cmnd[0]; ata_xlat_func_t xlat_func; + /* + * scsi_queue_rq() will defer commands if scsi_host_in_recovery(). + * However, this check is done without holding the ap->lock (a libata + * specific lock), so we can have received an error irq since then, + * therefore we must check if EH is pending, while holding ap->lock. + */ + if (ap->pflags & (ATA_PFLAG_EH_PENDING | ATA_PFLAG_EH_IN_PROGRESS)) + return SCSI_MLQUEUE_DEVICE_BUSY; + if (unlikely(!scmd->cmd_len)) goto bad_cdb_len; @@ -4148,6 +4160,7 @@ * turning this into a no-op. */ case SYNCHRONIZE_CACHE: + case SYNCHRONIZE_CACHE_16: fallthrough; /* no-op's, complete with success */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/ata/libata-transport.c +++ linux-kvm-5.19.0/drivers/ata/libata-transport.c @@ -301,7 +301,9 @@ pm_runtime_enable(dev); pm_runtime_forbid(dev); - transport_add_device(dev); + error = transport_add_device(dev); + if (error) + goto tport_transport_add_err; transport_configure_device(dev); error = ata_tlink_add(&ap->link); @@ -312,12 +314,12 @@ tport_link_err: transport_remove_device(dev); + tport_transport_add_err: device_del(dev); tport_err: transport_destroy_device(dev); put_device(dev); - ata_host_put(ap->host); return error; } @@ -456,7 +458,9 @@ goto tlink_err; } - transport_add_device(dev); + error = transport_add_device(dev); + if (error) + goto tlink_transport_err; transport_configure_device(dev); ata_for_each_dev(ata_dev, link, ALL) { @@ -471,6 +475,7 @@ ata_tdev_delete(ata_dev); } transport_remove_device(dev); + tlink_transport_err: device_del(dev); tlink_err: transport_destroy_device(dev); @@ -708,7 +713,13 @@ return error; } - transport_add_device(dev); + error = transport_add_device(dev); + if (error) { + device_del(dev); + ata_tdev_free(ata_dev); + return error; + } + transport_configure_device(dev); return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/block/drbd/drbd_main.c +++ linux-kvm-5.19.0/drivers/block/drbd/drbd_main.c @@ -2672,7 +2672,7 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsigned int minor) { struct drbd_resource *resource = adm_ctx->resource; - struct drbd_connection *connection; + struct drbd_connection *connection, *n; struct drbd_device *device; struct drbd_peer_device *peer_device, *tmp_peer_device; struct gendisk *disk; @@ -2789,7 +2789,7 @@ return NO_ERROR; out_idr_remove_from_resource: - for_each_connection(connection, resource) { + for_each_connection_safe(connection, n, resource) { peer_device = idr_remove(&connection->peer_devices, vnr); if (peer_device) kref_put(&connection->kref, drbd_destroy_connection); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/bus/intel-ixp4xx-eb.c +++ linux-kvm-5.19.0/drivers/bus/intel-ixp4xx-eb.c @@ -49,7 +49,7 @@ #define IXP4XX_EXP_SIZE_SHIFT 10 #define IXP4XX_EXP_CNFG_0 BIT(9) /* Always zero */ #define IXP43X_EXP_SYNC_INTEL BIT(8) /* Only on IXP43x */ -#define IXP43X_EXP_EXP_CHIP BIT(7) /* Only on IXP43x */ +#define IXP43X_EXP_EXP_CHIP BIT(7) /* Only on IXP43x, dangerous to touch on IXP42x */ #define IXP4XX_EXP_BYTE_RD16 BIT(6) #define IXP4XX_EXP_HRDY_POL BIT(5) /* Only on IXP42x */ #define IXP4XX_EXP_MUX_EN BIT(4) @@ -57,8 +57,6 @@ #define IXP4XX_EXP_WORD BIT(2) /* Always zero */ #define IXP4XX_EXP_WR_EN BIT(1) #define IXP4XX_EXP_BYTE_EN BIT(0) -#define IXP42X_RESERVED (BIT(30)|IXP4XX_EXP_CNFG_0|BIT(8)|BIT(7)|IXP4XX_EXP_WORD) -#define IXP43X_RESERVED (BIT(30)|IXP4XX_EXP_CNFG_0|BIT(5)|IXP4XX_EXP_WORD) #define IXP4XX_EXP_CNFG0 0x20 #define IXP4XX_EXP_CNFG0_MEM_MAP BIT(31) @@ -252,10 +250,9 @@ cs_cfg |= val << IXP4XX_EXP_CYC_TYPE_SHIFT; } - if (eb->is_42x) - cs_cfg &= ~IXP42X_RESERVED; if (eb->is_43x) { - cs_cfg &= ~IXP43X_RESERVED; + /* Should always be zero */ + cs_cfg &= ~IXP4XX_EXP_WORD; /* * This bit for Intel strata flash is currently unused, but let's * report it if we find one. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/bus/sunxi-rsb.c +++ linux-kvm-5.19.0/drivers/bus/sunxi-rsb.c @@ -271,6 +271,9 @@ /* common code that starts a transfer */ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb) { + u32 int_mask, status; + bool timeout; + if (readl(rsb->regs + RSB_CTRL) & RSB_CTRL_START_TRANS) { dev_dbg(rsb->dev, "RSB transfer still in progress\n"); return -EBUSY; @@ -278,13 +281,23 @@ reinit_completion(&rsb->complete); - writel(RSB_INTS_LOAD_BSY | RSB_INTS_TRANS_ERR | RSB_INTS_TRANS_OVER, - rsb->regs + RSB_INTE); + int_mask = RSB_INTS_LOAD_BSY | RSB_INTS_TRANS_ERR | RSB_INTS_TRANS_OVER; + writel(int_mask, rsb->regs + RSB_INTE); writel(RSB_CTRL_START_TRANS | RSB_CTRL_GLOBAL_INT_ENB, rsb->regs + RSB_CTRL); - if (!wait_for_completion_io_timeout(&rsb->complete, - msecs_to_jiffies(100))) { + if (irqs_disabled()) { + timeout = readl_poll_timeout_atomic(rsb->regs + RSB_INTS, + status, (status & int_mask), + 10, 100000); + writel(status, rsb->regs + RSB_INTS); + } else { + timeout = !wait_for_completion_io_timeout(&rsb->complete, + msecs_to_jiffies(100)); + status = rsb->status; + } + + if (timeout) { dev_dbg(rsb->dev, "RSB timeout\n"); /* abort the transfer */ @@ -296,18 +309,18 @@ return -ETIMEDOUT; } - if (rsb->status & RSB_INTS_LOAD_BSY) { + if (status & RSB_INTS_LOAD_BSY) { dev_dbg(rsb->dev, "RSB busy\n"); return -EBUSY; } - if (rsb->status & RSB_INTS_TRANS_ERR) { - if (rsb->status & RSB_INTS_TRANS_ERR_ACK) { + if (status & RSB_INTS_TRANS_ERR) { + if (status & RSB_INTS_TRANS_ERR_ACK) { dev_dbg(rsb->dev, "RSB slave nack\n"); return -EINVAL; } - if (rsb->status & RSB_INTS_TRANS_ERR_DATA) { + if (status & RSB_INTS_TRANS_ERR_DATA) { dev_dbg(rsb->dev, "RSB transfer data error\n"); return -EIO; } @@ -816,14 +829,6 @@ return 0; } -static void sunxi_rsb_shutdown(struct platform_device *pdev) -{ - struct sunxi_rsb *rsb = platform_get_drvdata(pdev); - - pm_runtime_disable(&pdev->dev); - sunxi_rsb_hw_exit(rsb); -} - static const struct dev_pm_ops sunxi_rsb_dev_pm_ops = { SET_RUNTIME_PM_OPS(sunxi_rsb_runtime_suspend, sunxi_rsb_runtime_resume, NULL) @@ -839,7 +844,6 @@ static struct platform_driver sunxi_rsb_driver = { .probe = sunxi_rsb_probe, .remove = sunxi_rsb_remove, - .shutdown = sunxi_rsb_shutdown, .driver = { .name = RSB_CTRL_NAME, .of_match_table = sunxi_rsb_of_match_table, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/char/tpm/tpm-interface.c +++ linux-kvm-5.19.0/drivers/char/tpm/tpm-interface.c @@ -401,13 +401,14 @@ !pm_suspend_via_firmware()) goto suspended; - if (!tpm_chip_start(chip)) { + rc = tpm_try_get_ops(chip); + if (!rc) { if (chip->flags & TPM_CHIP_FLAG_TPM2) tpm2_shutdown(chip, TPM2_SU_STATE); else rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); - tpm_chip_stop(chip); + tpm_put_ops(chip); } suspended: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/clk/at91/at91rm9200.c +++ linux-kvm-5.19.0/drivers/clk/at91/at91rm9200.c @@ -40,7 +40,7 @@ }; static const struct sck at91rm9200_systemck[] = { - { .n = "udpck", .p = "usbck", .id = 2 }, + { .n = "udpck", .p = "usbck", .id = 1 }, { .n = "uhpck", .p = "usbck", .id = 4 }, { .n = "pck0", .p = "prog0", .id = 8 }, { .n = "pck1", .p = "prog1", .id = 9 }, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/clk/qcom/gcc-sc8280xp.c +++ linux-kvm-5.19.0/drivers/clk/qcom/gcc-sc8280xp.c @@ -5423,6 +5423,8 @@ .enable_mask = BIT(0), .hw.init = &(const struct clk_init_data) { .name = "gcc_ufs_1_card_clkref_clk", + .parent_data = &gcc_parent_data_tcxo, + .num_parents = 1, .ops = &clk_branch2_ops, }, }, @@ -5491,6 +5493,8 @@ .enable_mask = BIT(0), .hw.init = &(const struct clk_init_data) { .name = "gcc_ufs_card_clkref_clk", + .parent_data = &gcc_parent_data_tcxo, + .num_parents = 1, .ops = &clk_branch2_ops, }, }, @@ -5907,6 +5911,8 @@ .enable_mask = BIT(0), .hw.init = &(const struct clk_init_data) { .name = "gcc_ufs_ref_clkref_clk", + .parent_data = &gcc_parent_data_tcxo, + .num_parents = 1, .ops = &clk_branch2_ops, }, }, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/clk/samsung/clk-exynos7885.c +++ linux-kvm-5.19.0/drivers/clk/samsung/clk-exynos7885.c @@ -182,7 +182,7 @@ CLK_CON_DIV_PLL_SHARED0_DIV2, 0, 1), DIV(CLK_DOUT_SHARED0_DIV3, "dout_shared0_div3", "fout_shared0_pll", CLK_CON_DIV_PLL_SHARED0_DIV3, 0, 2), - DIV(CLK_DOUT_SHARED0_DIV4, "dout_shared0_div4", "fout_shared0_pll", + DIV(CLK_DOUT_SHARED0_DIV4, "dout_shared0_div4", "dout_shared0_div2", CLK_CON_DIV_PLL_SHARED0_DIV4, 0, 1), DIV(CLK_DOUT_SHARED0_DIV5, "dout_shared0_div5", "fout_shared0_pll", CLK_CON_DIV_PLL_SHARED0_DIV5, 0, 3), @@ -190,7 +190,7 @@ CLK_CON_DIV_PLL_SHARED1_DIV2, 0, 1), DIV(CLK_DOUT_SHARED1_DIV3, "dout_shared1_div3", "fout_shared1_pll", CLK_CON_DIV_PLL_SHARED1_DIV3, 0, 2), - DIV(CLK_DOUT_SHARED1_DIV4, "dout_shared1_div4", "fout_shared1_pll", + DIV(CLK_DOUT_SHARED1_DIV4, "dout_shared1_div4", "dout_shared1_div2", CLK_CON_DIV_PLL_SHARED1_DIV4, 0, 1), /* CORE */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/clocksource/timer-riscv.c +++ linux-kvm-5.19.0/drivers/clocksource/timer-riscv.c @@ -34,7 +34,7 @@ static unsigned int riscv_clock_event_irq; static DEFINE_PER_CPU(struct clock_event_device, riscv_clock_event) = { .name = "riscv_timer_clockevent", - .features = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_C3STOP, + .features = CLOCK_EVT_FEAT_ONESHOT, .rating = 100, .set_next_event = riscv_clock_next_event, }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/cxl/core/mbox.c +++ linux-kvm-5.19.0/drivers/cxl/core/mbox.c @@ -174,7 +174,7 @@ }; int rc; - if (out_size > cxlds->payload_size) + if (in_size > cxlds->payload_size || out_size > cxlds->payload_size) return -E2BIG; rc = cxlds->mbox_send(cxlds, &mbox_cmd); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/cxl/pmem.c +++ linux-kvm-5.19.0/drivers/cxl/pmem.c @@ -130,7 +130,7 @@ return -EINVAL; /* 4-byte status follows the input data in the payload */ - if (struct_size(cmd, in_buf, cmd->in_length) + 4 > buf_len) + if (size_add(struct_size(cmd, in_buf, cmd->in_length), 4) > buf_len) return -EINVAL; set_lsa = only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma-buf/dma-heap.c +++ linux-kvm-5.19.0/drivers/dma-buf/dma-heap.c @@ -233,18 +233,6 @@ return ERR_PTR(-EINVAL); } - /* check the name is unique */ - mutex_lock(&heap_list_lock); - list_for_each_entry(h, &heap_list, list) { - if (!strcmp(h->name, exp_info->name)) { - mutex_unlock(&heap_list_lock); - pr_err("dma_heap: Already registered heap named %s\n", - exp_info->name); - return ERR_PTR(-EINVAL); - } - } - mutex_unlock(&heap_list_lock); - heap = kzalloc(sizeof(*heap), GFP_KERNEL); if (!heap) return ERR_PTR(-ENOMEM); @@ -283,13 +271,27 @@ err_ret = ERR_CAST(dev_ret); goto err2; } - /* Add heap to the list */ + mutex_lock(&heap_list_lock); + /* check the name is unique */ + list_for_each_entry(h, &heap_list, list) { + if (!strcmp(h->name, exp_info->name)) { + mutex_unlock(&heap_list_lock); + pr_err("dma_heap: Already registered heap named %s\n", + exp_info->name); + err_ret = ERR_PTR(-EINVAL); + goto err3; + } + } + + /* Add heap to the list */ list_add(&heap->list, &heap_list); mutex_unlock(&heap_list_lock); return heap; +err3: + device_destroy(dma_heap_class, heap->heap_devt); err2: cdev_del(&heap->heap_cdev); err1: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/at_hdmac.c +++ linux-kvm-5.19.0/drivers/dma/at_hdmac.c @@ -256,6 +256,8 @@ ATC_SPIP_BOUNDARY(first->boundary)); channel_writel(atchan, DPIP, ATC_DPIP_HOLE(first->dst_hole) | ATC_DPIP_BOUNDARY(first->boundary)); + /* Don't allow CPU to reorder channel enable. */ + wmb(); dma_writel(atdma, CHER, atchan->mask); vdbg_dump_regs(atchan); @@ -316,7 +318,8 @@ struct at_desc *desc_first = atc_first_active(atchan); struct at_desc *desc; int ret; - u32 ctrla, dscr, trials; + u32 ctrla, dscr; + unsigned int i; /* * If the cookie doesn't match to the currently running transfer then @@ -386,7 +389,7 @@ dscr = channel_readl(atchan, DSCR); rmb(); /* ensure DSCR is read before CTRLA */ ctrla = channel_readl(atchan, CTRLA); - for (trials = 0; trials < ATC_MAX_DSCR_TRIALS; ++trials) { + for (i = 0; i < ATC_MAX_DSCR_TRIALS; ++i) { u32 new_dscr; rmb(); /* ensure DSCR is read after CTRLA */ @@ -412,7 +415,7 @@ rmb(); /* ensure DSCR is read before CTRLA */ ctrla = channel_readl(atchan, CTRLA); } - if (unlikely(trials >= ATC_MAX_DSCR_TRIALS)) + if (unlikely(i == ATC_MAX_DSCR_TRIALS)) return -ETIMEDOUT; /* for the first descriptor we can be more accurate */ @@ -462,18 +465,6 @@ if (!atc_chan_is_cyclic(atchan)) dma_cookie_complete(txd); - /* If the transfer was a memset, free our temporary buffer */ - if (desc->memset_buffer) { - dma_pool_free(atdma->memset_pool, desc->memset_vaddr, - desc->memset_paddr); - desc->memset_buffer = false; - } - - /* move children to free_list */ - list_splice_init(&desc->tx_list, &atchan->free_list); - /* move myself to free_list */ - list_move(&desc->desc_node, &atchan->free_list); - spin_unlock_irqrestore(&atchan->lock, flags); dma_descriptor_unmap(txd); @@ -483,42 +474,20 @@ dmaengine_desc_get_callback_invoke(txd, NULL); dma_run_dependencies(txd); -} - -/** - * atc_complete_all - finish work for all transactions - * @atchan: channel to complete transactions for - * - * Eventually submit queued descriptors if any - * - * Assume channel is idle while calling this function - * Called with atchan->lock held and bh disabled - */ -static void atc_complete_all(struct at_dma_chan *atchan) -{ - struct at_desc *desc, *_desc; - LIST_HEAD(list); - unsigned long flags; - - dev_vdbg(chan2dev(&atchan->chan_common), "complete all\n"); spin_lock_irqsave(&atchan->lock, flags); - - /* - * Submit queued descriptors ASAP, i.e. before we go through - * the completed ones. - */ - if (!list_empty(&atchan->queue)) - atc_dostart(atchan, atc_first_queued(atchan)); - /* empty active_list now it is completed */ - list_splice_init(&atchan->active_list, &list); - /* empty queue list by moving descriptors (if any) to active_list */ - list_splice_init(&atchan->queue, &atchan->active_list); - + /* move children to free_list */ + list_splice_init(&desc->tx_list, &atchan->free_list); + /* add myself to free_list */ + list_add(&desc->desc_node, &atchan->free_list); spin_unlock_irqrestore(&atchan->lock, flags); - list_for_each_entry_safe(desc, _desc, &list, desc_node) - atc_chain_complete(atchan, desc); + /* If the transfer was a memset, free our temporary buffer */ + if (desc->memset_buffer) { + dma_pool_free(atdma->memset_pool, desc->memset_vaddr, + desc->memset_paddr); + desc->memset_buffer = false; + } } /** @@ -527,26 +496,28 @@ */ static void atc_advance_work(struct at_dma_chan *atchan) { + struct at_desc *desc; unsigned long flags; - int ret; dev_vdbg(chan2dev(&atchan->chan_common), "advance_work\n"); spin_lock_irqsave(&atchan->lock, flags); - ret = atc_chan_is_enabled(atchan); - spin_unlock_irqrestore(&atchan->lock, flags); - if (ret) - return; - - if (list_empty(&atchan->active_list) || - list_is_singular(&atchan->active_list)) - return atc_complete_all(atchan); + if (atc_chan_is_enabled(atchan) || list_empty(&atchan->active_list)) + return spin_unlock_irqrestore(&atchan->lock, flags); - atc_chain_complete(atchan, atc_first_active(atchan)); + desc = atc_first_active(atchan); + /* Remove the transfer node from the active list. */ + list_del_init(&desc->desc_node); + spin_unlock_irqrestore(&atchan->lock, flags); + atc_chain_complete(atchan, desc); /* advance work */ spin_lock_irqsave(&atchan->lock, flags); - atc_dostart(atchan, atc_first_active(atchan)); + if (!list_empty(&atchan->active_list)) { + desc = atc_first_queued(atchan); + list_move_tail(&desc->desc_node, &atchan->active_list); + atc_dostart(atchan, desc); + } spin_unlock_irqrestore(&atchan->lock, flags); } @@ -558,6 +529,7 @@ static void atc_handle_error(struct at_dma_chan *atchan) { struct at_desc *bad_desc; + struct at_desc *desc; struct at_desc *child; unsigned long flags; @@ -570,13 +542,12 @@ bad_desc = atc_first_active(atchan); list_del_init(&bad_desc->desc_node); - /* As we are stopped, take advantage to push queued descriptors - * in active_list */ - list_splice_init(&atchan->queue, atchan->active_list.prev); - /* Try to restart the controller */ - if (!list_empty(&atchan->active_list)) - atc_dostart(atchan, atc_first_active(atchan)); + if (!list_empty(&atchan->active_list)) { + desc = atc_first_queued(atchan); + list_move_tail(&desc->desc_node, &atchan->active_list); + atc_dostart(atchan, desc); + } /* * KERN_CRITICAL may seem harsh, but since this only happens @@ -691,19 +662,11 @@ spin_lock_irqsave(&atchan->lock, flags); cookie = dma_cookie_assign(tx); - if (list_empty(&atchan->active_list)) { - dev_vdbg(chan2dev(tx->chan), "tx_submit: started %u\n", - desc->txd.cookie); - atc_dostart(atchan, desc); - list_add_tail(&desc->desc_node, &atchan->active_list); - } else { - dev_vdbg(chan2dev(tx->chan), "tx_submit: queued %u\n", - desc->txd.cookie); - list_add_tail(&desc->desc_node, &atchan->queue); - } - + list_add_tail(&desc->desc_node, &atchan->queue); spin_unlock_irqrestore(&atchan->lock, flags); + dev_vdbg(chan2dev(tx->chan), "tx_submit: queued %u\n", + desc->txd.cookie); return cookie; } @@ -1445,11 +1408,8 @@ struct at_dma_chan *atchan = to_at_dma_chan(chan); struct at_dma *atdma = to_at_dma(chan->device); int chan_id = atchan->chan_common.chan_id; - struct at_desc *desc, *_desc; unsigned long flags; - LIST_HEAD(list); - dev_vdbg(chan2dev(chan), "%s\n", __func__); /* @@ -1468,19 +1428,15 @@ cpu_relax(); /* active_list entries will end up before queued entries */ - list_splice_init(&atchan->queue, &list); - list_splice_init(&atchan->active_list, &list); - - spin_unlock_irqrestore(&atchan->lock, flags); - - /* Flush all pending and queued descriptors */ - list_for_each_entry_safe(desc, _desc, &list, desc_node) - atc_chain_complete(atchan, desc); + list_splice_tail_init(&atchan->queue, &atchan->free_list); + list_splice_tail_init(&atchan->active_list, &atchan->free_list); clear_bit(ATC_IS_PAUSED, &atchan->status); /* if channel dedicated to cyclic operations, free it */ clear_bit(ATC_IS_CYCLIC, &atchan->status); + spin_unlock_irqrestore(&atchan->lock, flags); + return 0; } @@ -1535,20 +1491,26 @@ } /** - * atc_issue_pending - try to finish work + * atc_issue_pending - takes the first transaction descriptor in the pending + * queue and starts the transfer. * @chan: target DMA channel */ static void atc_issue_pending(struct dma_chan *chan) { - struct at_dma_chan *atchan = to_at_dma_chan(chan); + struct at_dma_chan *atchan = to_at_dma_chan(chan); + struct at_desc *desc; + unsigned long flags; dev_vdbg(chan2dev(chan), "issue_pending\n"); - /* Not needed for cyclic transfers */ - if (atc_chan_is_cyclic(atchan)) - return; + spin_lock_irqsave(&atchan->lock, flags); + if (atc_chan_is_enabled(atchan) || list_empty(&atchan->queue)) + return spin_unlock_irqrestore(&atchan->lock, flags); - atc_advance_work(atchan); + desc = atc_first_queued(atchan); + list_move_tail(&desc->desc_node, &atchan->active_list); + atc_dostart(atchan, desc); + spin_unlock_irqrestore(&atchan->lock, flags); } /** @@ -1966,7 +1928,11 @@ dma_has_cap(DMA_SLAVE, atdma->dma_common.cap_mask) ? "slave " : "", plat_dat->nr_channels); - dma_async_device_register(&atdma->dma_common); + err = dma_async_device_register(&atdma->dma_common); + if (err) { + dev_err(&pdev->dev, "Unable to register: %d.\n", err); + goto err_dma_async_device_register; + } /* * Do not return an error if the dmac node is not present in order to @@ -1986,6 +1952,7 @@ err_of_dma_controller_register: dma_async_device_unregister(&atdma->dma_common); +err_dma_async_device_register: dma_pool_destroy(atdma->memset_pool); err_memset_pool_create: dma_pool_destroy(atdma->dma_desc_pool); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/at_hdmac_regs.h +++ linux-kvm-5.19.0/drivers/dma/at_hdmac_regs.h @@ -186,13 +186,13 @@ /* LLI == Linked List Item; aka DMA buffer descriptor */ struct at_lli { /* values that are not changed by hardware */ - dma_addr_t saddr; - dma_addr_t daddr; + u32 saddr; + u32 daddr; /* value that may get written back: */ - u32 ctrla; + u32 ctrla; /* more values that are not changed by hardware */ - u32 ctrlb; - dma_addr_t dscr; /* chain to next lli */ + u32 ctrlb; + u32 dscr; /* chain to next lli */ }; /** only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/idxd/cdev.c +++ linux-kvm-5.19.0/drivers/dma/idxd/cdev.c @@ -312,6 +312,24 @@ if (idxd->state != IDXD_DEV_ENABLED) return -ENXIO; + /* + * User type WQ is enabled only when SVA is enabled for two reasons: + * - If no IOMMU or IOMMU Passthrough without SVA, userspace + * can directly access physical address through the WQ. + * - The IDXD cdev driver does not provide any ways to pin + * user pages and translate the address from user VA to IOVA or + * PA without IOMMU SVA. Therefore the application has no way + * to instruct the device to perform DMA function. This makes + * the cdev not usable for normal application usage. + */ + if (!device_user_pasid_enabled(idxd)) { + idxd->cmd_status = IDXD_SCMD_WQ_USER_NO_IOMMU; + dev_dbg(&idxd->pdev->dev, + "User type WQ cannot be enabled without SVA.\n"); + + return -EOPNOTSUPP; + } + mutex_lock(&wq->wq_lock); wq->type = IDXD_WQT_USER; rc = drv_enable_wq(wq); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/idxd/device.c +++ linux-kvm-5.19.0/drivers/dma/idxd/device.c @@ -388,7 +388,7 @@ clear_bit(WQ_FLAG_BLOCK_ON_FAULT, &wq->flags); memset(wq->name, 0, WQ_NAME_SIZE); wq->max_xfer_bytes = WQ_DEFAULT_MAX_XFER; - wq->max_batch_size = WQ_DEFAULT_MAX_BATCH; + idxd_wq_set_max_batch_size(idxd->data->type, wq, WQ_DEFAULT_MAX_BATCH); } static void idxd_wq_device_reset_cleanup(struct idxd_wq *wq) @@ -724,13 +724,21 @@ void idxd_device_clear_state(struct idxd_device *idxd) { - if (!test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags)) - return; + /* IDXD is always disabled. Other states are cleared only when IDXD is configurable. */ + if (test_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags)) { + /* + * Clearing wq state is protected by wq lock. + * So no need to be protected by device lock. + */ + idxd_device_wqs_clear_state(idxd); + + spin_lock(&idxd->dev_lock); + idxd_groups_clear_state(idxd); + idxd_engines_clear_state(idxd); + } else { + spin_lock(&idxd->dev_lock); + } - idxd_device_wqs_clear_state(idxd); - spin_lock(&idxd->dev_lock); - idxd_groups_clear_state(idxd); - idxd_engines_clear_state(idxd); idxd->state = IDXD_DEV_DISABLED; spin_unlock(&idxd->dev_lock); } @@ -863,7 +871,7 @@ /* bytes 12-15 */ wq->wqcfg->max_xfer_shift = ilog2(wq->max_xfer_bytes); - wq->wqcfg->max_batch_shift = ilog2(wq->max_batch_size); + idxd_wqcfg_set_max_batch_shift(idxd->data->type, wq->wqcfg, ilog2(wq->max_batch_size)); dev_dbg(dev, "WQ %d CFGs\n", wq->id); for (i = 0; i < WQCFG_STRIDES(idxd); i++) { @@ -1031,7 +1039,7 @@ wq->priority = wq->wqcfg->priority; wq->max_xfer_bytes = 1ULL << wq->wqcfg->max_xfer_shift; - wq->max_batch_size = 1ULL << wq->wqcfg->max_batch_shift; + idxd_wq_set_max_batch_size(idxd->data->type, wq, 1U << wq->wqcfg->max_batch_shift); for (i = 0; i < WQCFG_STRIDES(idxd); i++) { wqcfg_offset = WQCFG_OFFSET(idxd, wq->id, i); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/idxd/idxd.h +++ linux-kvm-5.19.0/drivers/dma/idxd/idxd.h @@ -308,6 +308,8 @@ struct work_struct work; struct idxd_pmu *idxd_pmu; + + unsigned long *opcap_bmap; }; /* IDXD software descriptor */ @@ -540,6 +542,38 @@ return wq->client_count; }; +/* + * Intel IAA does not support batch processing. + * The max batch size of device, max batch size of wq and + * max batch shift of wqcfg should be always 0 on IAA. + */ +static inline void idxd_set_max_batch_size(int idxd_type, struct idxd_device *idxd, + u32 max_batch_size) +{ + if (idxd_type == IDXD_TYPE_IAX) + idxd->max_batch_size = 0; + else + idxd->max_batch_size = max_batch_size; +} + +static inline void idxd_wq_set_max_batch_size(int idxd_type, struct idxd_wq *wq, + u32 max_batch_size) +{ + if (idxd_type == IDXD_TYPE_IAX) + wq->max_batch_size = 0; + else + wq->max_batch_size = max_batch_size; +} + +static inline void idxd_wqcfg_set_max_batch_shift(int idxd_type, union wqcfg *wqcfg, + u32 max_batch_shift) +{ + if (idxd_type == IDXD_TYPE_IAX) + wqcfg->max_batch_shift = 0; + else + wqcfg->max_batch_shift = max_batch_shift; +} + int __must_check __idxd_driver_register(struct idxd_device_driver *idxd_drv, struct module *module, const char *mod_name); #define idxd_driver_register(driver) \ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/idxd/init.c +++ linux-kvm-5.19.0/drivers/dma/idxd/init.c @@ -177,7 +177,7 @@ init_completion(&wq->wq_dead); init_completion(&wq->wq_resurrect); wq->max_xfer_bytes = WQ_DEFAULT_MAX_XFER; - wq->max_batch_size = WQ_DEFAULT_MAX_BATCH; + idxd_wq_set_max_batch_size(idxd->data->type, wq, WQ_DEFAULT_MAX_BATCH); wq->enqcmds_retries = IDXD_ENQCMDS_RETRIES; wq->wqcfg = kzalloc_node(idxd->wqcfg_size, GFP_KERNEL, dev_to_node(dev)); if (!wq->wqcfg) { @@ -369,6 +369,19 @@ dev_dbg(dev, "IDXD Perfmon Offset: %#x\n", idxd->perfmon_offset); } +static void multi_u64_to_bmap(unsigned long *bmap, u64 *val, int count) +{ + int i, j, nr; + + for (i = 0, nr = 0; i < count; i++) { + for (j = 0; j < BITS_PER_LONG_LONG; j++) { + if (val[i] & BIT(j)) + set_bit(nr, bmap); + nr++; + } + } +} + static void idxd_read_caps(struct idxd_device *idxd) { struct device *dev = &idxd->pdev->dev; @@ -389,7 +402,7 @@ idxd->max_xfer_bytes = 1ULL << idxd->hw.gen_cap.max_xfer_shift; dev_dbg(dev, "max xfer size: %llu bytes\n", idxd->max_xfer_bytes); - idxd->max_batch_size = 1U << idxd->hw.gen_cap.max_batch_shift; + idxd_set_max_batch_size(idxd->data->type, idxd, 1U << idxd->hw.gen_cap.max_batch_shift); dev_dbg(dev, "max batch size: %u\n", idxd->max_batch_size); if (idxd->hw.gen_cap.config_en) set_bit(IDXD_FLAG_CONFIGURABLE, &idxd->flags); @@ -427,6 +440,7 @@ IDXD_OPCAP_OFFSET + i * sizeof(u64)); dev_dbg(dev, "opcap[%d]: %#llx\n", i, idxd->hw.opcap.bits[i]); } + multi_u64_to_bmap(idxd->opcap_bmap, &idxd->hw.opcap.bits[0], 4); } static struct idxd_device *idxd_alloc(struct pci_dev *pdev, struct idxd_driver_data *data) @@ -448,6 +462,12 @@ if (idxd->id < 0) return NULL; + idxd->opcap_bmap = bitmap_zalloc_node(IDXD_MAX_OPCAP_BITS, GFP_KERNEL, dev_to_node(dev)); + if (!idxd->opcap_bmap) { + ida_free(&idxd_ida, idxd->id); + return NULL; + } + device_initialize(conf_dev); conf_dev->parent = dev; conf_dev->bus = &dsa_bus_type; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/idxd/registers.h +++ linux-kvm-5.19.0/drivers/dma/idxd/registers.h @@ -90,6 +90,8 @@ u64 bits[4]; }; +#define IDXD_MAX_OPCAP_BITS 256U + #define IDXD_OPCAP_OFFSET 0x40 #define IDXD_TABLE_OFFSET 0x60 only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/idxd/sysfs.c +++ linux-kvm-5.19.0/drivers/dma/idxd/sysfs.c @@ -961,7 +961,7 @@ if (batch_size > idxd->max_batch_size) return -EINVAL; - wq->max_batch_size = (u32)batch_size; + idxd_wq_set_max_batch_size(idxd->data->type, wq, (u32)batch_size); return count; } @@ -1177,14 +1177,8 @@ struct device_attribute *attr, char *buf) { struct idxd_device *idxd = confdev_to_idxd(dev); - int i, rc = 0; - for (i = 0; i < 4; i++) - rc += sysfs_emit_at(buf, rc, "%#llx ", idxd->hw.opcap.bits[i]); - - rc--; - rc += sysfs_emit_at(buf, rc, "\n"); - return rc; + return sysfs_emit(buf, "%*pb\n", IDXD_MAX_OPCAP_BITS, idxd->opcap_bmap); } static DEVICE_ATTR_RO(op_cap); @@ -1408,6 +1402,7 @@ kfree(idxd->wqs); kfree(idxd->engines); ida_free(&idxd_ida, idxd->id); + bitmap_free(idxd->opcap_bmap); kfree(idxd); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/mv_xor_v2.c +++ linux-kvm-5.19.0/drivers/dma/mv_xor_v2.c @@ -893,6 +893,7 @@ tasklet_kill(&xor_dev->irq_tasklet); clk_disable_unprepare(xor_dev->clk); + clk_disable_unprepare(xor_dev->reg_clk); return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/pxa_dma.c +++ linux-kvm-5.19.0/drivers/dma/pxa_dma.c @@ -1247,14 +1247,14 @@ return -ENOMEM; for (i = 0; i < nb_phy_chans; i++) - if (platform_get_irq(op, i) > 0) + if (platform_get_irq_optional(op, i) > 0) nr_irq++; for (i = 0; i < nb_phy_chans; i++) { phy = &pdev->phys[i]; phy->base = pdev->base; phy->idx = i; - irq = platform_get_irq(op, i); + irq = platform_get_irq_optional(op, i); if ((nr_irq > 1) && (irq > 0)) ret = devm_request_irq(&op->dev, irq, pxad_chan_handler, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/stm32-dma.c +++ linux-kvm-5.19.0/drivers/dma/stm32-dma.c @@ -663,6 +663,8 @@ chan->chan_reg.dma_sndtr = stm32_dma_read(dmadev, STM32_DMA_SNDTR(chan->id)); + chan->status = DMA_PAUSED; + dev_dbg(chan2dev(chan), "vchan %pK: paused\n", &chan->vchan); } @@ -775,9 +777,7 @@ if (status & STM32_DMA_TCI) { stm32_dma_irq_clear(chan, STM32_DMA_TCI); if (scr & STM32_DMA_SCR_TCIE) { - if (chan->status == DMA_PAUSED && !(scr & STM32_DMA_SCR_EN)) - stm32_dma_handle_chan_paused(chan); - else + if (chan->status != DMA_PAUSED) stm32_dma_handle_chan_done(chan, scr); } status &= ~STM32_DMA_TCI; @@ -824,13 +824,11 @@ return -EPERM; spin_lock_irqsave(&chan->vchan.lock, flags); + ret = stm32_dma_disable_chan(chan); - /* - * A transfer complete flag is set to indicate the end of transfer due to the stream - * interruption, so wait for interrupt - */ if (!ret) - chan->status = DMA_PAUSED; + stm32_dma_handle_chan_paused(chan); + spin_unlock_irqrestore(&chan->vchan.lock, flags); return ret; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/dma/ti/k3-udma-glue.c +++ linux-kvm-5.19.0/drivers/dma/ti/k3-udma-glue.c @@ -299,6 +299,7 @@ ret = device_register(&tx_chn->common.chan_dev); if (ret) { dev_err(dev, "Channel Device registration failed %d\n", ret); + put_device(&tx_chn->common.chan_dev); tx_chn->common.chan_dev.parent = NULL; goto err; } @@ -917,6 +918,7 @@ ret = device_register(&rx_chn->common.chan_dev); if (ret) { dev_err(dev, "Channel Device registration failed %d\n", ret); + put_device(&rx_chn->common.chan_dev); rx_chn->common.chan_dev.parent = NULL; goto err; } @@ -1048,6 +1050,7 @@ ret = device_register(&rx_chn->common.chan_dev); if (ret) { dev_err(dev, "Channel Device registration failed %d\n", ret); + put_device(&rx_chn->common.chan_dev); rx_chn->common.chan_dev.parent = NULL; goto err; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/firmware/arm_scmi/bus.c +++ linux-kvm-5.19.0/drivers/firmware/arm_scmi/bus.c @@ -216,9 +216,20 @@ device_unregister(&scmi_dev->dev); } +void scmi_device_link_add(struct device *consumer, struct device *supplier) +{ + struct device_link *link; + + link = device_link_add(consumer, supplier, DL_FLAG_AUTOREMOVE_CONSUMER); + + WARN_ON(!link); +} + void scmi_set_handle(struct scmi_device *scmi_dev) { scmi_dev->handle = scmi_handle_get(&scmi_dev->dev); + if (scmi_dev->handle) + scmi_device_link_add(&scmi_dev->dev, scmi_dev->handle->dev); } int scmi_protocol_register(const struct scmi_protocol *proto) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/firmware/arm_scmi/common.h +++ linux-kvm-5.19.0/drivers/firmware/arm_scmi/common.h @@ -97,6 +97,7 @@ struct scmi_revision_info * scmi_revision_area_get(const struct scmi_protocol_handle *ph); int scmi_handle_put(const struct scmi_handle *handle); +void scmi_device_link_add(struct device *consumer, struct device *supplier); struct scmi_handle *scmi_handle_get(struct device *dev); void scmi_set_handle(struct scmi_device *scmi_dev); void scmi_setup_protocol_implemented(const struct scmi_protocol_handle *ph, @@ -117,6 +118,7 @@ * * @dev: Reference to device in the SCMI hierarchy corresponding to this * channel + * @rx_timeout_ms: The configured RX timeout in milliseconds. * @handle: Pointer to SCMI entity handle * @no_completion_irq: Flag to indicate that this channel has no completion * interrupt mechanism for synchronous commands. @@ -126,6 +128,7 @@ */ struct scmi_chan_info { struct device *dev; + unsigned int rx_timeout_ms; struct scmi_handle *handle; bool no_completion_irq; void *transport_info; @@ -232,7 +235,7 @@ struct scmi_shared_mem; void shmem_tx_prepare(struct scmi_shared_mem __iomem *shmem, - struct scmi_xfer *xfer); + struct scmi_xfer *xfer, struct scmi_chan_info *cinfo); u32 shmem_read_header(struct scmi_shared_mem __iomem *shmem); void shmem_fetch_response(struct scmi_shared_mem __iomem *shmem, struct scmi_xfer *xfer); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/firmware/arm_scmi/mailbox.c +++ linux-kvm-5.19.0/drivers/firmware/arm_scmi/mailbox.c @@ -36,7 +36,7 @@ { struct scmi_mailbox *smbox = client_to_scmi_mailbox(cl); - shmem_tx_prepare(smbox->shmem, m); + shmem_tx_prepare(smbox->shmem, m, smbox->cinfo); } static void rx_callback(struct mbox_client *cl, void *m) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/firmware/arm_scmi/optee.c +++ linux-kvm-5.19.0/drivers/firmware/arm_scmi/optee.c @@ -497,7 +497,7 @@ msg_tx_prepare(channel->req.msg, xfer); ret = invoke_process_msg_channel(channel, msg_command_size(xfer)); } else { - shmem_tx_prepare(channel->req.shmem, xfer); + shmem_tx_prepare(channel->req.shmem, xfer, cinfo); ret = invoke_process_smt_channel(channel); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/firmware/arm_scmi/shmem.c +++ linux-kvm-5.19.0/drivers/firmware/arm_scmi/shmem.c @@ -5,10 +5,13 @@ * Copyright (C) 2019 ARM Ltd. */ +#include #include #include #include +#include + #include "common.h" /* @@ -30,16 +33,36 @@ }; void shmem_tx_prepare(struct scmi_shared_mem __iomem *shmem, - struct scmi_xfer *xfer) + struct scmi_xfer *xfer, struct scmi_chan_info *cinfo) { + ktime_t stop; + /* * Ideally channel must be free by now unless OS timeout last * request and platform continued to process the same, wait * until it releases the shared memory, otherwise we may endup - * overwriting its response with new message payload or vice-versa + * overwriting its response with new message payload or vice-versa. + * Giving up anyway after twice the expected channel timeout so as + * not to bail-out on intermittent issues where the platform is + * occasionally a bit slower to answer. + * + * Note that after a timeout is detected we bail-out and carry on but + * the transport functionality is probably permanently compromised: + * this is just to ease debugging and avoid complete hangs on boot + * due to a misbehaving SCMI firmware. */ - spin_until_cond(ioread32(&shmem->channel_status) & - SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE); + stop = ktime_add_ms(ktime_get(), 2 * cinfo->rx_timeout_ms); + spin_until_cond((ioread32(&shmem->channel_status) & + SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE) || + ktime_after(ktime_get(), stop)); + if (!(ioread32(&shmem->channel_status) & + SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE)) { + WARN_ON_ONCE(1); + dev_err(cinfo->dev, + "Timeout waiting for a free TX channel !\n"); + return; + } + /* Mark channel busy + clear error */ iowrite32(0x0, &shmem->channel_status); iowrite32(xfer->hdr.poll_completion ? 0 : SCMI_SHMEM_FLAG_INTR_ENABLED, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/firmware/arm_scmi/smc.c +++ linux-kvm-5.19.0/drivers/firmware/arm_scmi/smc.c @@ -188,7 +188,7 @@ */ smc_channel_lock_acquire(scmi_info, xfer); - shmem_tx_prepare(scmi_info->shmem, xfer); + shmem_tx_prepare(scmi_info->shmem, xfer, cinfo); arm_smccc_1_1_invoke(scmi_info->func_id, 0, 0, 0, 0, 0, 0, 0, &res); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/firmware/google/coreboot_table.c +++ linux-kvm-5.19.0/drivers/firmware/google/coreboot_table.c @@ -149,12 +149,8 @@ if (!ptr) return -ENOMEM; - ret = bus_register(&coreboot_bus_type); - if (!ret) { - ret = coreboot_table_populate(dev, ptr); - if (ret) - bus_unregister(&coreboot_bus_type); - } + ret = coreboot_table_populate(dev, ptr); + memunmap(ptr); return ret; @@ -169,7 +165,6 @@ static int coreboot_table_remove(struct platform_device *pdev) { bus_for_each_dev(&coreboot_bus_type, NULL, NULL, __cb_dev_unregister); - bus_unregister(&coreboot_bus_type); return 0; } @@ -199,6 +194,32 @@ .of_match_table = of_match_ptr(coreboot_of_match), }, }; -module_platform_driver(coreboot_table_driver); + +static int __init coreboot_table_driver_init(void) +{ + int ret; + + ret = bus_register(&coreboot_bus_type); + if (ret) + return ret; + + ret = platform_driver_register(&coreboot_table_driver); + if (ret) { + bus_unregister(&coreboot_bus_type); + return ret; + } + + return 0; +} + +static void __exit coreboot_table_driver_exit(void) +{ + platform_driver_unregister(&coreboot_table_driver); + bus_unregister(&coreboot_bus_type); +} + +module_init(coreboot_table_driver_init); +module_exit(coreboot_table_driver_exit); + MODULE_AUTHOR("Google, Inc."); MODULE_LICENSE("GPL"); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_aldebaran.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_aldebaran.c @@ -41,5 +41,6 @@ .get_atc_vmid_pasid_mapping_info = kgd_gfx_v9_get_atc_vmid_pasid_mapping_info, .set_vm_context_page_table_base = kgd_gfx_v9_set_vm_context_page_table_base, + .get_cu_occupancy = kgd_gfx_v9_get_cu_occupancy, .program_trap_handler_settings = kgd_gfx_v9_program_trap_handler_settings }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c @@ -413,11 +413,9 @@ if (r) goto release_object; - if (args->flags & AMDGPU_GEM_USERPTR_REGISTER) { - r = amdgpu_mn_register(bo, args->addr); - if (r) - goto release_object; - } + r = amdgpu_mn_register(bo, args->addr); + if (r) + goto release_object; if (args->flags & AMDGPU_GEM_USERPTR_VALIDATE) { r = amdgpu_ttm_tt_get_user_pages(bo, bo->tbo.ttm->pages); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c @@ -479,6 +479,12 @@ unsigned i; unsigned vmhub, inv_eng; + if (adev->enable_mes) { + /* reserve engine 5 for firmware */ + for (vmhub = 0; vmhub < AMDGPU_MAX_VMHUBS; vmhub++) + vm_inv_engs[vmhub] &= ~(1 << 5); + } + for (i = 0; i < adev->num_rings; ++i) { ring = adev->rings[i]; vmhub = ring->funcs->vmhub; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c @@ -154,6 +154,9 @@ break; case IP_VERSION(3, 0, 2): fw_name = FIRMWARE_VANGOGH; + if ((adev->firmware.load_type == AMDGPU_FW_LOAD_PSP) && + (adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG)) + adev->vcn.indirect_sram = true; break; case IP_VERSION(3, 0, 16): fw_name = FIRMWARE_DIMGREY_CAVEFISH; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h @@ -485,7 +485,48 @@ */ static inline uint64_t amdgpu_vm_tlb_seq(struct amdgpu_vm *vm) { + unsigned long flags; + spinlock_t *lock; + + /* + * Workaround to stop racing between the fence signaling and handling + * the cb. The lock is static after initially setting it up, just make + * sure that the dma_fence structure isn't freed up. + */ + rcu_read_lock(); + lock = vm->last_tlb_flush->lock; + rcu_read_unlock(); + + spin_lock_irqsave(lock, flags); + spin_unlock_irqrestore(lock, flags); + return atomic64_read(&vm->tlb_seq); } +/* + * vm eviction_lock can be taken in MMU notifiers. Make sure no reclaim-FS + * happens while holding this lock anywhere to prevent deadlocks when + * an MMU notifier runs in reclaim-FS context. + */ +static inline void amdgpu_vm_eviction_lock(struct amdgpu_vm *vm) +{ + mutex_lock(&vm->eviction_lock); + vm->saved_flags = memalloc_noreclaim_save(); +} + +static inline bool amdgpu_vm_eviction_trylock(struct amdgpu_vm *vm) +{ + if (mutex_trylock(&vm->eviction_lock)) { + vm->saved_flags = memalloc_noreclaim_save(); + return true; + } + return false; +} + +static inline void amdgpu_vm_eviction_unlock(struct amdgpu_vm *vm) +{ + memalloc_noreclaim_restore(vm->saved_flags); + mutex_unlock(&vm->eviction_lock); +} + #endif only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c @@ -597,7 +597,9 @@ if (entry->bo) return 0; + amdgpu_vm_eviction_unlock(vm); r = amdgpu_vm_pt_create(adev, vm, cursor->level, immediate, &pt); + amdgpu_vm_eviction_lock(vm); if (r) return r; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c @@ -93,7 +93,14 @@ union MESAPI__ADD_QUEUE *x_pkt = pkt; struct amdgpu_device *adev = mes->adev; struct amdgpu_ring *ring = &mes->ring; + signed long timeout = adev->usec_timeout; + if (amdgpu_emu_mode) { + timeout *= 100; + } else if (amdgpu_sriov_vf(adev)) { + /* Worst case in sriov where all other 15 VF timeout, each VF needs about 600ms */ + timeout = 15 * 600 * 1000; + } BUG_ON(size % 4 != 0); if (amdgpu_ring_alloc(ring, ndw)) @@ -105,7 +112,7 @@ DRM_DEBUG("MES msg=%d was emitted\n", x_pkt->header.opcode); r = amdgpu_fence_wait_polling(ring, ring->fence_drv.sync_seq, - adev->usec_timeout * (amdgpu_emu_mode ? 100 : 1)); + timeout); if (r < 1) { DRM_ERROR("MES failed to response msg=%d\n", x_pkt->header.opcode); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c @@ -857,7 +857,7 @@ static vm_fault_t svm_migrate_to_ram(struct vm_fault *vmf) { unsigned long addr = vmf->address; - struct vm_area_struct *vma; + struct svm_range_bo *svm_bo; enum svm_work_list_ops op; struct svm_range *parent; struct svm_range *prange; @@ -865,29 +865,42 @@ struct mm_struct *mm; int r = 0; - vma = vmf->vma; - mm = vma->vm_mm; + svm_bo = vmf->page->zone_device_data; + if (!svm_bo) { + pr_debug("failed get device page at addr 0x%lx\n", addr); + return VM_FAULT_SIGBUS; + } + if (!mmget_not_zero(svm_bo->eviction_fence->mm)) { + pr_debug("addr 0x%lx of process mm is detroyed\n", addr); + return VM_FAULT_SIGBUS; + } - p = kfd_lookup_process_by_mm(vma->vm_mm); + mm = svm_bo->eviction_fence->mm; + if (mm != vmf->vma->vm_mm) + pr_debug("addr 0x%lx is COW mapping in child process\n", addr); + + p = kfd_lookup_process_by_mm(mm); if (!p) { pr_debug("failed find process at fault address 0x%lx\n", addr); - return VM_FAULT_SIGBUS; + r = VM_FAULT_SIGBUS; + goto out_mmput; } if (READ_ONCE(p->svms.faulting_task) == current) { pr_debug("skipping ram migration\n"); - kfd_unref_process(p); - return 0; + r = 0; + goto out_unref_process; } - addr >>= PAGE_SHIFT; + pr_debug("CPU page fault svms 0x%p address 0x%lx\n", &p->svms, addr); + addr >>= PAGE_SHIFT; mutex_lock(&p->svms.lock); prange = svm_range_from_addr(&p->svms, addr, &parent); if (!prange) { - pr_debug("cannot find svm range at 0x%lx\n", addr); + pr_debug("failed get range svms 0x%p addr 0x%lx\n", &p->svms, addr); r = -EFAULT; - goto out; + goto out_unlock_svms; } mutex_lock(&parent->migrate_mutex); @@ -909,10 +922,10 @@ goto out_unlock_prange; } - r = svm_migrate_vram_to_ram(prange, mm); + r = svm_migrate_vram_to_ram(prange, vmf->vma->vm_mm); if (r) - pr_debug("failed %d migrate 0x%p [0x%lx 0x%lx] to ram\n", r, - prange, prange->start, prange->last); + pr_debug("failed %d migrate svms 0x%p range 0x%p [0x%lx 0x%lx]\n", + r, prange->svms, prange, prange->start, prange->last); /* xnack on, update mapping on GPUs with ACCESS_IN_PLACE */ if (p->xnack_enabled && parent == prange) @@ -926,12 +939,13 @@ if (prange != parent) mutex_unlock(&prange->migrate_mutex); mutex_unlock(&parent->migrate_mutex); -out: +out_unlock_svms: mutex_unlock(&p->svms.lock); - kfd_unref_process(p); - +out_unref_process: pr_debug("CPU fault svms 0x%p address 0x%lx done\n", &p->svms, addr); - + kfd_unref_process(p); +out_mmput: + mmput(mm); return r ? VM_FAULT_SIGBUS : 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/display/Kconfig +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/display/Kconfig @@ -5,6 +5,7 @@ config DRM_AMD_DC bool "AMD DC - Enable new display engine" default y + depends on BROKEN || !CC_IS_CLANG || X86_64 || SPARC64 || ARM64 select SND_HDA_COMPONENT if SND_HDA_CORE select DRM_AMD_DC_DCN if (X86 || PPC_LONG_DOUBLE_128) && !(KCOV_INSTRUMENT_ALL && KCOV_ENABLE_COMPARISONS) help @@ -12,6 +13,12 @@ support for AMDGPU. This adds required support for Vega and Raven ASICs. + calculate_bandwidth() is presently broken on all !(X86_64 || SPARC64 || ARM64) + architectures built with Clang (all released versions), whereby the stack + frame gets blown up to well over 5k. This would cause an immediate kernel + panic on most architectures. We'll revert this when the following bug report + has been resolved: https://github.com/llvm/llvm-project/issues/41896. + config DRM_AMD_DC_DCN def_bool n help only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h @@ -51,12 +51,6 @@ #define AMDGPU_DMUB_NOTIFICATION_MAX 5 /* - * DMUB Async to Sync Mechanism Status - */ -#define DMUB_ASYNC_TO_SYNC_ACCESS_FAIL 1 -#define DMUB_ASYNC_TO_SYNC_ACCESS_TIMEOUT 2 -#define DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS 3 -/* #include "include/amdgpu_dal_power_if.h" #include "amdgpu_dm_irq.h" */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c @@ -1867,6 +1867,26 @@ return result; } +static enum bp_result get_vram_info_v30( + struct bios_parser *bp, + struct dc_vram_info *info) +{ + struct atom_vram_info_header_v3_0 *info_v30; + enum bp_result result = BP_RESULT_OK; + + info_v30 = GET_IMAGE(struct atom_vram_info_header_v3_0, + DATA_TABLES(vram_info)); + + if (info_v30 == NULL) + return BP_RESULT_BADBIOSTABLE; + + info->num_chans = info_v30->channel_num; + info->dram_channel_width_bytes = (1 << info_v30->channel_width) / 8; + + return result; +} + + /* * get_integrated_info_v11 * @@ -2465,6 +2485,16 @@ break; default: break; + } + break; + + case 3: + switch (revision.minor) { + case 0: + result = get_vram_info_v30(bp, info); + break; + default: + break; } break; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c @@ -361,7 +361,8 @@ audio_regs(2), audio_regs(3), audio_regs(4), - audio_regs(5) + audio_regs(5), + audio_regs(6), }; #define DCE120_AUD_COMMON_MASK_SH_LIST(mask_sh)\ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c @@ -87,6 +87,7 @@ .hubp_init = hubp3_init, .set_unbounded_requesting = hubp31_set_unbounded_requesting, .hubp_soft_reset = hubp31_soft_reset, + .hubp_set_flip_int = hubp1_set_flip_int, .hubp_in_blank = hubp1_in_blank, .program_extended_blank = hubp31_program_extended_blank, }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c @@ -67,22 +67,21 @@ int vega10_fan_ctrl_get_fan_speed_pwm(struct pp_hwmgr *hwmgr, uint32_t *speed) { - uint32_t current_rpm; - uint32_t percent = 0; + struct amdgpu_device *adev = hwmgr->adev; + uint32_t duty100, duty; + uint64_t tmp64; - if (hwmgr->thermal_controller.fanInfo.bNoFan) - return 0; + duty100 = REG_GET_FIELD(RREG32_SOC15(THM, 0, mmCG_FDO_CTRL1), + CG_FDO_CTRL1, FMAX_DUTY100); + duty = REG_GET_FIELD(RREG32_SOC15(THM, 0, mmCG_THERMAL_STATUS), + CG_THERMAL_STATUS, FDO_PWM_DUTY); - if (vega10_get_current_rpm(hwmgr, ¤t_rpm)) - return -1; + if (!duty100) + return -EINVAL; - if (hwmgr->thermal_controller. - advanceFanControlParameters.usMaxFanRPM != 0) - percent = current_rpm * 255 / - hwmgr->thermal_controller. - advanceFanControlParameters.usMaxFanRPM; - - *speed = MIN(percent, 255); + tmp64 = (uint64_t)duty * 255; + do_div(tmp64, duty100); + *speed = MIN((uint32_t)tmp64, 255); return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ linux-kvm-5.19.0/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -1122,22 +1122,21 @@ uint64_t features_supported; int ret = 0; - if (adev->in_suspend && smu_is_dpm_running(smu)) { - dev_info(adev->dev, "dpm has been enabled\n"); - /* this is needed specifically */ - switch (adev->ip_versions[MP1_HWIP][0]) { - case IP_VERSION(11, 0, 7): - case IP_VERSION(11, 0, 11): - case IP_VERSION(11, 5, 0): - case IP_VERSION(11, 0, 12): + switch (adev->ip_versions[MP1_HWIP][0]) { + case IP_VERSION(11, 0, 7): + case IP_VERSION(11, 0, 11): + case IP_VERSION(11, 5, 0): + case IP_VERSION(11, 0, 12): + if (adev->in_suspend && smu_is_dpm_running(smu)) { + dev_info(adev->dev, "dpm has been enabled\n"); ret = smu_system_features_control(smu, true); if (ret) dev_err(adev->dev, "Failed system features control!\n"); - break; - default: - break; + return ret; } - return ret; + break; + default: + break; } ret = smu_init_display_count(smu, 0); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c +++ linux-kvm-5.19.0/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c @@ -63,23 +63,45 @@ ssize_t drm_dp_dual_mode_read(struct i2c_adapter *adapter, u8 offset, void *buffer, size_t size) { + u8 zero = 0; + char *tmpbuf = NULL; + /* + * As sub-addressing is not supported by all adaptors, + * always explicitly read from the start and discard + * any bytes that come before the requested offset. + * This way, no matter whether the adaptor supports it + * or not, we'll end up reading the proper data. + */ struct i2c_msg msgs[] = { { .addr = DP_DUAL_MODE_SLAVE_ADDRESS, .flags = 0, .len = 1, - .buf = &offset, + .buf = &zero, }, { .addr = DP_DUAL_MODE_SLAVE_ADDRESS, .flags = I2C_M_RD, - .len = size, + .len = size + offset, .buf = buffer, }, }; int ret; + if (offset) { + tmpbuf = kmalloc(size + offset, GFP_KERNEL); + if (!tmpbuf) + return -ENOMEM; + + msgs[1].buf = tmpbuf; + } + ret = i2c_transfer(adapter, msgs, ARRAY_SIZE(msgs)); + if (tmpbuf) + memcpy(buffer, tmpbuf + offset, size); + + kfree(tmpbuf); + if (ret < 0) return ret; if (ret != ARRAY_SIZE(msgs)) @@ -208,18 +230,6 @@ if (ret) return DRM_DP_DUAL_MODE_UNKNOWN; - /* - * Sigh. Some (maybe all?) type 1 adaptors are broken and ack - * the offset but ignore it, and instead they just always return - * data from the start of the HDMI ID buffer. So for a broken - * type 1 HDMI adaptor a single byte read will always give us - * 0x44, and for a type 1 DVI adaptor it should give 0x00 - * (assuming it implements any registers). Fortunately neither - * of those values will match the type 2 signature of the - * DP_DUAL_MODE_ADAPTOR_ID register so we can proceed with - * the type 2 adaptor detection safely even in the presence - * of broken type 1 adaptors. - */ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_ADAPTOR_ID, &adaptor_id, sizeof(adaptor_id)); drm_dbg_kms(dev, "DP dual mode adaptor ID: %02x (err %zd)\n", adaptor_id, ret); @@ -233,11 +243,10 @@ return DRM_DP_DUAL_MODE_TYPE2_DVI; } /* - * If neither a proper type 1 ID nor a broken type 1 adaptor - * as described above, assume type 1, but let the user know - * that we may have misdetected the type. + * If not a proper type 1 ID, still assume type 1, but let + * the user know that we may have misdetected the type. */ - if (!is_type1_adaptor(adaptor_id) && adaptor_id != hdmi_id[0]) + if (!is_type1_adaptor(adaptor_id)) drm_err(dev, "Unexpected DP dual mode adaptor ID %02x\n", adaptor_id); } @@ -343,10 +352,8 @@ * @enable: enable (as opposed to disable) the TMDS output buffers * * Set the state of the TMDS output buffers in the adaptor. For - * type2 this is set via the DP_DUAL_MODE_TMDS_OEN register. As - * some type 1 adaptors have problems with registers (see comments - * in drm_dp_dual_mode_detect()) we avoid touching the register, - * making this function a no-op on type 1 adaptors. + * type2 this is set via the DP_DUAL_MODE_TMDS_OEN register. + * Type1 adaptors do not support any register writes. * * Returns: * 0 on success, negative error code on failure only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/drm_drv.c +++ linux-kvm-5.19.0/drivers/gpu/drm/drm_drv.c @@ -615,7 +615,7 @@ mutex_init(&dev->clientlist_mutex); mutex_init(&dev->master_mutex); - ret = drmm_add_action(dev, drm_dev_init_release, NULL); + ret = drmm_add_action_or_reset(dev, drm_dev_init_release, NULL); if (ret) return ret; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/i915/display/intel_display_power.c +++ linux-kvm-5.19.0/drivers/gpu/drm/i915/display/intel_display_power.c @@ -2425,7 +2425,7 @@ { const struct intel_ddi_port_domains *domains = intel_port_domains_for_port(i915, port); - if (drm_WARN_ON(&i915->drm, !domains) || domains->ddi_io == POWER_DOMAIN_INVALID) + if (drm_WARN_ON(&i915->drm, !domains || domains->ddi_io == POWER_DOMAIN_INVALID)) return POWER_DOMAIN_PORT_DDI_IO_A; return domains->ddi_io + (int)(port - domains->port_start); @@ -2436,7 +2436,7 @@ { const struct intel_ddi_port_domains *domains = intel_port_domains_for_port(i915, port); - if (drm_WARN_ON(&i915->drm, !domains) || domains->ddi_lanes == POWER_DOMAIN_INVALID) + if (drm_WARN_ON(&i915->drm, !domains || domains->ddi_lanes == POWER_DOMAIN_INVALID)) return POWER_DOMAIN_PORT_DDI_LANES_A; return domains->ddi_lanes + (int)(port - domains->port_start); @@ -2462,7 +2462,7 @@ { const struct intel_ddi_port_domains *domains = intel_port_domains_for_aux_ch(i915, aux_ch); - if (drm_WARN_ON(&i915->drm, !domains) || domains->aux_legacy_usbc == POWER_DOMAIN_INVALID) + if (drm_WARN_ON(&i915->drm, !domains || domains->aux_legacy_usbc == POWER_DOMAIN_INVALID)) return POWER_DOMAIN_AUX_A; return domains->aux_legacy_usbc + (int)(aux_ch - domains->aux_ch_start); @@ -2473,7 +2473,7 @@ { const struct intel_ddi_port_domains *domains = intel_port_domains_for_aux_ch(i915, aux_ch); - if (drm_WARN_ON(&i915->drm, !domains) || domains->aux_tbt == POWER_DOMAIN_INVALID) + if (drm_WARN_ON(&i915->drm, !domains || domains->aux_tbt == POWER_DOMAIN_INVALID)) return POWER_DOMAIN_AUX_TBT1; return domains->aux_tbt + (int)(aux_ch - domains->aux_ch_start); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/i915/display/intel_psr.c +++ linux-kvm-5.19.0/drivers/gpu/drm/i915/display/intel_psr.c @@ -2159,8 +2159,11 @@ if (intel_dp->psr.psr2_sel_fetch_enabled) { u32 val; - if (intel_dp->psr.psr2_sel_fetch_cff_enabled) + if (intel_dp->psr.psr2_sel_fetch_cff_enabled) { + /* Send one update otherwise lag is observed in screen */ + intel_de_write(dev_priv, CURSURFLIVE(intel_dp->psr.pipe), 0); return; + } val = man_trk_ctl_enable_bit_get(dev_priv) | man_trk_ctl_partial_frame_bit_get(dev_priv) | only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c +++ linux-kvm-5.19.0/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c @@ -40,13 +40,13 @@ goto err; } - ret = sg_alloc_table(st, obj->mm.pages->nents, GFP_KERNEL); + ret = sg_alloc_table(st, obj->mm.pages->orig_nents, GFP_KERNEL); if (ret) goto err_free; src = obj->mm.pages->sgl; dst = st->sgl; - for (i = 0; i < obj->mm.pages->nents; i++) { + for (i = 0; i < obj->mm.pages->orig_nents; i++) { sg_set_page(dst, sg_page(src), src->length, 0); dst = sg_next(dst); src = sg_next(src); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/i915/gt/intel_gt_requests.c +++ linux-kvm-5.19.0/drivers/gpu/drm/i915/gt/intel_gt_requests.c @@ -199,7 +199,7 @@ if (remaining_timeout) *remaining_timeout = timeout; - return active_count ? timeout : 0; + return active_count ? timeout ?: -ETIME : 0; } static void retire_work_handler(struct work_struct *work) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/i915/gvt/kvmgt.c +++ linux-kvm-5.19.0/drivers/gpu/drm/i915/gvt/kvmgt.c @@ -808,8 +808,6 @@ goto undo_iommu; } - kvm_get_kvm(vgpu->vfio_device.kvm); - ret = -EEXIST; if (__kvmgt_vgpu_exist(vgpu)) goto undo_iommu; @@ -821,6 +819,7 @@ vgpu->track_node.track_write = kvmgt_page_track_write; vgpu->track_node.track_flush_slot = kvmgt_page_track_flush_slot; + kvm_get_kvm(vgpu->vfio_device.kvm); kvm_page_track_register_notifier(vgpu->vfio_device.kvm, &vgpu->track_node); @@ -1651,6 +1650,9 @@ if (WARN_ON_ONCE(vgpu->attached)) return; + + vfio_unregister_group_dev(&vgpu->vfio_device); + vfio_uninit_group_dev(&vgpu->vfio_device); intel_gvt_destroy_vgpu(vgpu); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/imx/imx-tve.c +++ linux-kvm-5.19.0/drivers/gpu/drm/imx/imx-tve.c @@ -217,8 +217,9 @@ return ret; } -static int imx_tve_connector_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) +static enum drm_mode_status +imx_tve_connector_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) { struct imx_tve *tve = con_to_tve(connector); unsigned long rate; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/msm/adreno/adreno_device.c +++ linux-kvm-5.19.0/drivers/gpu/drm/msm/adreno/adreno_device.c @@ -656,6 +656,9 @@ struct msm_gpu *gpu = dev_to_gpu(dev); int remaining, ret; + if (!gpu) + return 0; + suspend_scheduler(gpu); remaining = wait_event_timeout(gpu->retire_event, @@ -677,7 +680,12 @@ static int adreno_system_resume(struct device *dev) { - resume_scheduler(dev_to_gpu(dev)); + struct msm_gpu *gpu = dev_to_gpu(dev); + + if (!gpu) + return 0; + + resume_scheduler(gpu); return pm_runtime_force_resume(dev); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/msm/msm_gpu.c +++ linux-kvm-5.19.0/drivers/gpu/drm/msm/msm_gpu.c @@ -992,4 +992,6 @@ } msm_devfreq_cleanup(gpu); + + platform_set_drvdata(gpu->pdev, NULL); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/scheduler/sched_entity.c +++ linux-kvm-5.19.0/drivers/gpu/drm/scheduler/sched_entity.c @@ -207,6 +207,7 @@ struct drm_sched_job *job = container_of(cb, struct drm_sched_job, finish_cb); + dma_fence_put(f); INIT_WORK(&job->work, drm_sched_entity_kill_jobs_work); schedule_work(&job->work); } @@ -234,8 +235,10 @@ struct drm_sched_fence *s_fence = job->s_fence; /* Wait for all dependencies to avoid data corruptions */ - while ((f = drm_sched_job_dependency(job, entity))) + while ((f = drm_sched_job_dependency(job, entity))) { dma_fence_wait(f, false); + dma_fence_put(f); + } drm_sched_fence_scheduled(s_fence); dma_fence_set_error(&s_fence->finished, -ESRCH); @@ -250,6 +253,7 @@ continue; } + dma_fence_get(entity->last_scheduled); r = dma_fence_add_callback(entity->last_scheduled, &job->finish_cb, drm_sched_entity_kill_jobs_cb); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/drm/tegra/drm.c +++ linux-kvm-5.19.0/drivers/gpu/drm/tegra/drm.c @@ -1092,6 +1092,10 @@ struct host1x *host1x = dev_get_drvdata(dev->dev.parent); struct iommu_domain *domain; + /* Our IOMMU usage policy doesn't currently play well with GART */ + if (of_machine_is_compatible("nvidia,tegra20")) + return false; + /* * If the Tegra DRM clients are backed by an IOMMU, push buffers are * likely to be allocated beyond the 32-bit boundary if sufficient only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/gpu/host1x/dev.c +++ linux-kvm-5.19.0/drivers/gpu/host1x/dev.c @@ -229,6 +229,10 @@ static bool host1x_wants_iommu(struct host1x *host1x) { + /* Our IOMMU usage policy doesn't currently play well with GART */ + if (of_machine_is_compatible("nvidia,tegra20")) + return false; + /* * If we support addressing a maximum of 32 bits of physical memory * and if the host1x firewall is enabled, there's no need to enable only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/hid/hid-hyperv.c +++ linux-kvm-5.19.0/drivers/hid/hid-hyperv.c @@ -499,7 +499,7 @@ ret = hid_add_device(hid_dev); if (ret) - goto probe_err1; + goto probe_err2; ret = hid_parse(hid_dev); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/hv/channel_mgmt.c +++ linux-kvm-5.19.0/drivers/hv/channel_mgmt.c @@ -533,13 +533,17 @@ * Add the new device to the bus. This will kick off device-driver * binding which eventually invokes the device driver's AddDevice() * method. + * + * If vmbus_device_register() fails, the 'device_obj' is freed in + * vmbus_device_release() as called by device_unregister() in the + * error path of vmbus_device_register(). In the outside error + * path, there's no need to free it. */ ret = vmbus_device_register(newchannel->device_obj); if (ret != 0) { pr_err("unable to add child device object (relid %d)\n", newchannel->offermsg.child_relid); - kfree(newchannel->device_obj); goto err_deq_chan; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/hwmon/i5500_temp.c +++ linux-kvm-5.19.0/drivers/hwmon/i5500_temp.c @@ -117,7 +117,7 @@ u32 tstimer; s8 tsfsc; - err = pci_enable_device(pdev); + err = pcim_enable_device(pdev); if (err) { dev_err(&pdev->dev, "Failed to enable device\n"); return err; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/hwmon/ibmpex.c +++ linux-kvm-5.19.0/drivers/hwmon/ibmpex.c @@ -502,6 +502,7 @@ return; out_register: + list_del(&data->list); hwmon_device_unregister(data->hwmon_dev); out_user: ipmi_destroy_user(data->user); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/hwmon/ina3221.c +++ linux-kvm-5.19.0/drivers/hwmon/ina3221.c @@ -228,7 +228,7 @@ * Shunt Voltage Sum register has 14-bit value with 1-bit shift * Other Shunt Voltage registers have 12 bits with 3-bit shift */ - if (reg == INA3221_SHUNT_SUM) + if (reg == INA3221_SHUNT_SUM || reg == INA3221_CRIT_SUM) *val = sign_extend32(regval >> 1, 14); else *val = sign_extend32(regval >> 3, 12); @@ -465,7 +465,7 @@ * SHUNT_SUM: (1 / 40uV) << 1 = 1 / 20uV * SHUNT[1-3]: (1 / 40uV) << 3 = 1 / 5uV */ - if (reg == INA3221_SHUNT_SUM) + if (reg == INA3221_SHUNT_SUM || reg == INA3221_CRIT_SUM) regval = DIV_ROUND_CLOSEST(voltage_uv, 20) & 0xfffe; else regval = DIV_ROUND_CLOSEST(voltage_uv, 5) & 0xfff8; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/hwmon/ltc2947-core.c +++ linux-kvm-5.19.0/drivers/hwmon/ltc2947-core.c @@ -396,7 +396,7 @@ return ret; /* in milidegrees celcius, temp is given by: */ - *val = (__val * 204) + 550; + *val = (__val * 204) + 5500; return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/hwspinlock/qcom_hwspinlock.c +++ linux-kvm-5.19.0/drivers/hwspinlock/qcom_hwspinlock.c @@ -105,7 +105,7 @@ .reg_bits = 32, .reg_stride = 4, .val_bits = 32, - .max_register = 0x40000, + .max_register = 0x20000, .fast_io = true, }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/i2c/busses/i2c-i801.c +++ linux-kvm-5.19.0/drivers/i2c/busses/i2c-i801.c @@ -1240,6 +1240,7 @@ */ { "Latitude 5480", 0x29 }, { "Vostro V131", 0x1d }, + { "Vostro 5568", 0x29 }, }; static void register_dell_lis3lv02d_i2c_device(struct i801_priv *priv) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/i2c/busses/i2c-tegra.c +++ linux-kvm-5.19.0/drivers/i2c/busses/i2c-tegra.c @@ -284,6 +284,7 @@ struct dma_chan *tx_dma_chan; struct dma_chan *rx_dma_chan; unsigned int dma_buf_size; + struct device *dma_dev; dma_addr_t dma_phys; void *dma_buf; @@ -420,7 +421,7 @@ static void tegra_i2c_release_dma(struct tegra_i2c_dev *i2c_dev) { if (i2c_dev->dma_buf) { - dma_free_coherent(i2c_dev->dev, i2c_dev->dma_buf_size, + dma_free_coherent(i2c_dev->dma_dev, i2c_dev->dma_buf_size, i2c_dev->dma_buf, i2c_dev->dma_phys); i2c_dev->dma_buf = NULL; } @@ -467,10 +468,13 @@ i2c_dev->tx_dma_chan = chan; + WARN_ON(i2c_dev->tx_dma_chan->device != i2c_dev->rx_dma_chan->device); + i2c_dev->dma_dev = chan->device->dev; + i2c_dev->dma_buf_size = i2c_dev->hw->quirks->max_write_len + I2C_PACKET_HEADER_SIZE; - dma_buf = dma_alloc_coherent(i2c_dev->dev, i2c_dev->dma_buf_size, + dma_buf = dma_alloc_coherent(i2c_dev->dma_dev, i2c_dev->dma_buf_size, &dma_phys, GFP_KERNEL | __GFP_NOWARN); if (!dma_buf) { dev_err(i2c_dev->dev, "failed to allocate DMA buffer\n"); @@ -1267,7 +1271,7 @@ if (i2c_dev->dma_mode) { if (i2c_dev->msg_read) { - dma_sync_single_for_device(i2c_dev->dev, + dma_sync_single_for_device(i2c_dev->dma_dev, i2c_dev->dma_phys, xfer_size, DMA_FROM_DEVICE); @@ -1275,7 +1279,7 @@ if (err) return err; } else { - dma_sync_single_for_cpu(i2c_dev->dev, + dma_sync_single_for_cpu(i2c_dev->dma_dev, i2c_dev->dma_phys, xfer_size, DMA_TO_DEVICE); } @@ -1288,7 +1292,7 @@ memcpy(i2c_dev->dma_buf + I2C_PACKET_HEADER_SIZE, msg->buf, msg->len); - dma_sync_single_for_device(i2c_dev->dev, + dma_sync_single_for_device(i2c_dev->dma_dev, i2c_dev->dma_phys, xfer_size, DMA_TO_DEVICE); @@ -1339,7 +1343,7 @@ } if (i2c_dev->msg_read && i2c_dev->msg_err == I2C_ERR_NONE) { - dma_sync_single_for_cpu(i2c_dev->dev, + dma_sync_single_for_cpu(i2c_dev->dma_dev, i2c_dev->dma_phys, xfer_size, DMA_FROM_DEVICE); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/adc/aspeed_adc.c +++ linux-kvm-5.19.0/drivers/iio/adc/aspeed_adc.c @@ -202,6 +202,8 @@ ((scu_otp) & (data->model_data->trim_locate->field)) >> __ffs(data->model_data->trim_locate->field); + if (!trimming_val) + trimming_val = 0x8; } dev_dbg(data->dev, "trimming val = %d, offset = %08x, fields = %08x\n", @@ -563,12 +565,9 @@ if (ret) return ret; - if (of_find_property(data->dev->of_node, "aspeed,trim-data-valid", - NULL)) { - ret = aspeed_adc_set_trim_data(indio_dev); - if (ret) - return ret; - } + ret = aspeed_adc_set_trim_data(indio_dev); + if (ret) + return ret; if (of_find_property(data->dev->of_node, "aspeed,battery-sensing", NULL)) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/adc/at91_adc.c +++ linux-kvm-5.19.0/drivers/iio/adc/at91_adc.c @@ -634,8 +634,10 @@ trig->ops = &at91_adc_trigger_ops; ret = iio_trigger_register(trig); - if (ret) + if (ret) { + iio_trigger_free(trig); return NULL; + } return trig; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/adc/mp2629_adc.c +++ linux-kvm-5.19.0/drivers/iio/adc/mp2629_adc.c @@ -56,7 +56,8 @@ MP2629_MAP(SYSTEM_VOLT, "system-volt"), MP2629_MAP(INPUT_VOLT, "input-volt"), MP2629_MAP(BATT_CURRENT, "batt-current"), - MP2629_MAP(INPUT_CURRENT, "input-current") + MP2629_MAP(INPUT_CURRENT, "input-current"), + { } }; static int mp2629_read_raw(struct iio_dev *indio_dev, @@ -73,7 +74,7 @@ if (ret) return ret; - if (chan->address == MP2629_INPUT_VOLT) + if (chan->channel == MP2629_INPUT_VOLT) rval &= GENMASK(6, 0); *val = rval; return IIO_VAL_INT; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/health/afe4403.c +++ linux-kvm-5.19.0/drivers/iio/health/afe4403.c @@ -245,14 +245,14 @@ int *val, int *val2, long mask) { struct afe4403_data *afe = iio_priv(indio_dev); - unsigned int reg = afe4403_channel_values[chan->address]; - unsigned int field = afe4403_channel_leds[chan->address]; + unsigned int reg, field; int ret; switch (chan->type) { case IIO_INTENSITY: switch (mask) { case IIO_CHAN_INFO_RAW: + reg = afe4403_channel_values[chan->address]; ret = afe4403_read(afe, reg, val); if (ret) return ret; @@ -262,6 +262,7 @@ case IIO_CURRENT: switch (mask) { case IIO_CHAN_INFO_RAW: + field = afe4403_channel_leds[chan->address]; ret = regmap_field_read(afe->fields[field], val); if (ret) return ret; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/health/afe4404.c +++ linux-kvm-5.19.0/drivers/iio/health/afe4404.c @@ -250,20 +250,20 @@ int *val, int *val2, long mask) { struct afe4404_data *afe = iio_priv(indio_dev); - unsigned int value_reg = afe4404_channel_values[chan->address]; - unsigned int led_field = afe4404_channel_leds[chan->address]; - unsigned int offdac_field = afe4404_channel_offdacs[chan->address]; + unsigned int value_reg, led_field, offdac_field; int ret; switch (chan->type) { case IIO_INTENSITY: switch (mask) { case IIO_CHAN_INFO_RAW: + value_reg = afe4404_channel_values[chan->address]; ret = regmap_read(afe->regmap, value_reg, val); if (ret) return ret; return IIO_VAL_INT; case IIO_CHAN_INFO_OFFSET: + offdac_field = afe4404_channel_offdacs[chan->address]; ret = regmap_field_read(afe->fields[offdac_field], val); if (ret) return ret; @@ -273,6 +273,7 @@ case IIO_CURRENT: switch (mask) { case IIO_CHAN_INFO_RAW: + led_field = afe4404_channel_leds[chan->address]; ret = regmap_field_read(afe->fields[led_field], val); if (ret) return ret; @@ -295,19 +296,20 @@ int val, int val2, long mask) { struct afe4404_data *afe = iio_priv(indio_dev); - unsigned int led_field = afe4404_channel_leds[chan->address]; - unsigned int offdac_field = afe4404_channel_offdacs[chan->address]; + unsigned int led_field, offdac_field; switch (chan->type) { case IIO_INTENSITY: switch (mask) { case IIO_CHAN_INFO_OFFSET: + offdac_field = afe4404_channel_offdacs[chan->address]; return regmap_field_write(afe->fields[offdac_field], val); } break; case IIO_CURRENT: switch (mask) { case IIO_CHAN_INFO_RAW: + led_field = afe4404_channel_leds[chan->address]; return regmap_field_write(afe->fields[led_field], val); } break; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/industrialio-sw-trigger.c +++ linux-kvm-5.19.0/drivers/iio/industrialio-sw-trigger.c @@ -58,8 +58,12 @@ t->group = configfs_register_default_group(iio_triggers_group, t->name, &iio_trigger_type_group_type); - if (IS_ERR(t->group)) + if (IS_ERR(t->group)) { + mutex_lock(&iio_trigger_types_lock); + list_del(&t->list); + mutex_unlock(&iio_trigger_types_lock); ret = PTR_ERR(t->group); + } return ret; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/light/Kconfig +++ linux-kvm-5.19.0/drivers/iio/light/Kconfig @@ -293,6 +293,8 @@ tristate "ROHM RPR0521 ALS and proximity sensor driver" depends on I2C select REGMAP_I2C + select IIO_BUFFER + select IIO_TRIGGERED_BUFFER help Say Y here if you want to build support for ROHM's RPR0521 ambient light and proximity sensor device. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/light/apds9960.c +++ linux-kvm-5.19.0/drivers/iio/light/apds9960.c @@ -54,9 +54,6 @@ #define APDS9960_REG_CONTROL_PGAIN_MASK_SHIFT 2 #define APDS9960_REG_CONFIG_2 0x90 -#define APDS9960_REG_CONFIG_2_GGAIN_MASK 0x60 -#define APDS9960_REG_CONFIG_2_GGAIN_MASK_SHIFT 5 - #define APDS9960_REG_ID 0x92 #define APDS9960_REG_STATUS 0x93 @@ -77,6 +74,9 @@ #define APDS9960_REG_GCONF_1_GFIFO_THRES_MASK_SHIFT 6 #define APDS9960_REG_GCONF_2 0xa3 +#define APDS9960_REG_GCONF_2_GGAIN_MASK 0x60 +#define APDS9960_REG_GCONF_2_GGAIN_MASK_SHIFT 5 + #define APDS9960_REG_GOFFSET_U 0xa4 #define APDS9960_REG_GOFFSET_D 0xa5 #define APDS9960_REG_GPULSE 0xa6 @@ -396,9 +396,9 @@ } ret = regmap_update_bits(data->regmap, - APDS9960_REG_CONFIG_2, - APDS9960_REG_CONFIG_2_GGAIN_MASK, - idx << APDS9960_REG_CONFIG_2_GGAIN_MASK_SHIFT); + APDS9960_REG_GCONF_2, + APDS9960_REG_GCONF_2_GGAIN_MASK, + idx << APDS9960_REG_GCONF_2_GGAIN_MASK_SHIFT); if (!ret) data->pxs_gain = idx; mutex_unlock(&data->lock); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/pressure/ms5611.h +++ linux-kvm-5.19.0/drivers/iio/pressure/ms5611.h @@ -25,13 +25,6 @@ MS5607, }; -struct ms5611_chip_info { - u16 prom[MS5611_PROM_WORDS_NB]; - - int (*temp_and_pressure_compensate)(struct ms5611_chip_info *chip_info, - s32 *temp, s32 *pressure); -}; - /* * OverSampling Rate descriptor. * Warning: cmd MUST be kept aligned on a word boundary (see @@ -50,12 +43,15 @@ const struct ms5611_osr *pressure_osr; const struct ms5611_osr *temp_osr; + u16 prom[MS5611_PROM_WORDS_NB]; + int (*reset)(struct ms5611_state *st); int (*read_prom_word)(struct ms5611_state *st, int index, u16 *word); int (*read_adc_temp_and_pressure)(struct ms5611_state *st, s32 *temp, s32 *pressure); - struct ms5611_chip_info *chip_info; + int (*compensate_temp_and_pressure)(struct ms5611_state *st, s32 *temp, + s32 *pressure); struct regulator *vdd; }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/pressure/ms5611_core.c +++ linux-kvm-5.19.0/drivers/iio/pressure/ms5611_core.c @@ -85,7 +85,7 @@ struct ms5611_state *st = iio_priv(indio_dev); for (i = 0; i < MS5611_PROM_WORDS_NB; i++) { - ret = st->read_prom_word(st, i, &st->chip_info->prom[i]); + ret = st->read_prom_word(st, i, &st->prom[i]); if (ret < 0) { dev_err(&indio_dev->dev, "failed to read prom at %d\n", i); @@ -93,7 +93,7 @@ } } - if (!ms5611_prom_is_valid(st->chip_info->prom, MS5611_PROM_WORDS_NB)) { + if (!ms5611_prom_is_valid(st->prom, MS5611_PROM_WORDS_NB)) { dev_err(&indio_dev->dev, "PROM integrity check failed\n"); return -ENODEV; } @@ -114,21 +114,20 @@ return ret; } - return st->chip_info->temp_and_pressure_compensate(st->chip_info, - temp, pressure); + return st->compensate_temp_and_pressure(st, temp, pressure); } -static int ms5611_temp_and_pressure_compensate(struct ms5611_chip_info *chip_info, +static int ms5611_temp_and_pressure_compensate(struct ms5611_state *st, s32 *temp, s32 *pressure) { s32 t = *temp, p = *pressure; s64 off, sens, dt; - dt = t - (chip_info->prom[5] << 8); - off = ((s64)chip_info->prom[2] << 16) + ((chip_info->prom[4] * dt) >> 7); - sens = ((s64)chip_info->prom[1] << 15) + ((chip_info->prom[3] * dt) >> 8); + dt = t - (st->prom[5] << 8); + off = ((s64)st->prom[2] << 16) + ((st->prom[4] * dt) >> 7); + sens = ((s64)st->prom[1] << 15) + ((st->prom[3] * dt) >> 8); - t = 2000 + ((chip_info->prom[6] * dt) >> 23); + t = 2000 + ((st->prom[6] * dt) >> 23); if (t < 2000) { s64 off2, sens2, t2; @@ -154,17 +153,17 @@ return 0; } -static int ms5607_temp_and_pressure_compensate(struct ms5611_chip_info *chip_info, +static int ms5607_temp_and_pressure_compensate(struct ms5611_state *st, s32 *temp, s32 *pressure) { s32 t = *temp, p = *pressure; s64 off, sens, dt; - dt = t - (chip_info->prom[5] << 8); - off = ((s64)chip_info->prom[2] << 17) + ((chip_info->prom[4] * dt) >> 6); - sens = ((s64)chip_info->prom[1] << 16) + ((chip_info->prom[3] * dt) >> 7); + dt = t - (st->prom[5] << 8); + off = ((s64)st->prom[2] << 17) + ((st->prom[4] * dt) >> 6); + sens = ((s64)st->prom[1] << 16) + ((st->prom[3] * dt) >> 7); - t = 2000 + ((chip_info->prom[6] * dt) >> 23); + t = 2000 + ((st->prom[6] * dt) >> 23); if (t < 2000) { s64 off2, sens2, t2, tmp; @@ -342,15 +341,6 @@ static const unsigned long ms5611_scan_masks[] = {0x3, 0}; -static struct ms5611_chip_info chip_info_tbl[] = { - [MS5611] = { - .temp_and_pressure_compensate = ms5611_temp_and_pressure_compensate, - }, - [MS5607] = { - .temp_and_pressure_compensate = ms5607_temp_and_pressure_compensate, - } -}; - static const struct iio_chan_spec ms5611_channels[] = { { .type = IIO_PRESSURE, @@ -433,7 +423,20 @@ struct ms5611_state *st = iio_priv(indio_dev); mutex_init(&st->lock); - st->chip_info = &chip_info_tbl[type]; + + switch (type) { + case MS5611: + st->compensate_temp_and_pressure = + ms5611_temp_and_pressure_compensate; + break; + case MS5607: + st->compensate_temp_and_pressure = + ms5607_temp_and_pressure_compensate; + break; + default: + return -EINVAL; + } + st->temp_osr = &ms5611_avail_temp_osr[ARRAY_SIZE(ms5611_avail_temp_osr) - 1]; st->pressure_osr = only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/pressure/ms5611_spi.c +++ linux-kvm-5.19.0/drivers/iio/pressure/ms5611_spi.c @@ -91,7 +91,7 @@ spi_set_drvdata(spi, indio_dev); spi->mode = SPI_MODE_0; - spi->max_speed_hz = 20000000; + spi->max_speed_hz = min(spi->max_speed_hz, 20000000U); spi->bits_per_word = 8; ret = spi_setup(spi); if (ret < 0) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iio/trigger/iio-trig-sysfs.c +++ linux-kvm-5.19.0/drivers/iio/trigger/iio-trig-sysfs.c @@ -203,9 +203,13 @@ static int __init iio_sysfs_trig_init(void) { + int ret; device_initialize(&iio_sysfs_trig_dev); dev_set_name(&iio_sysfs_trig_dev, "iio_sysfs_trigger"); - return device_add(&iio_sysfs_trig_dev); + ret = device_add(&iio_sysfs_trig_dev); + if (ret) + put_device(&iio_sysfs_trig_dev); + return ret; } module_init(iio_sysfs_trig_init); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/infiniband/hw/efa/efa_main.c +++ linux-kvm-5.19.0/drivers/infiniband/hw/efa/efa_main.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 OR BSD-2-Clause /* - * Copyright 2018-2021 Amazon.com, Inc. or its affiliates. All rights reserved. + * Copyright 2018-2022 Amazon.com, Inc. or its affiliates. All rights reserved. */ #include @@ -14,10 +14,12 @@ #define PCI_DEV_ID_EFA0_VF 0xefa0 #define PCI_DEV_ID_EFA1_VF 0xefa1 +#define PCI_DEV_ID_EFA2_VF 0xefa2 static const struct pci_device_id efa_pci_tbl[] = { { PCI_VDEVICE(AMAZON, PCI_DEV_ID_EFA0_VF) }, { PCI_VDEVICE(AMAZON, PCI_DEV_ID_EFA1_VF) }, + { PCI_VDEVICE(AMAZON, PCI_DEV_ID_EFA2_VF) }, { } }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/input/misc/soc_button_array.c +++ linux-kvm-5.19.0/drivers/input/misc/soc_button_array.c @@ -18,6 +18,10 @@ #include #include +static bool use_low_level_irq; +module_param(use_low_level_irq, bool, 0444); +MODULE_PARM_DESC(use_low_level_irq, "Use low-level triggered IRQ instead of edge triggered"); + struct soc_button_info { const char *name; int acpi_index; @@ -74,6 +78,13 @@ }, }, { + /* Acer Switch V 10 SW5-017, same issue as Acer Switch 10 SW5-012. */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_MATCH(DMI_PRODUCT_NAME, "SW5-017"), + }, + }, + { /* * Acer One S1003. _LID method messes with power-button GPIO * IRQ settings, leading to a non working power-button. @@ -164,7 +175,8 @@ } /* See dmi_use_low_level_irq[] comment */ - if (!autorepeat && dmi_check_system(dmi_use_low_level_irq)) { + if (!autorepeat && (use_low_level_irq || + dmi_check_system(dmi_use_low_level_irq))) { irq_set_irq_type(irq, IRQ_TYPE_LEVEL_LOW); gpio_keys[n_buttons].irq = irq; gpio_keys[n_buttons].gpio = -ENOENT; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/input/mouse/synaptics.c +++ linux-kvm-5.19.0/drivers/input/mouse/synaptics.c @@ -192,6 +192,7 @@ "SYN3221", /* HP 15-ay000 */ "SYN323d", /* HP Spectre X360 13-w013dx */ "SYN3257", /* HP Envy 13-ad105ng */ + "SYN3286", /* HP Laptop 15-da3001TU */ NULL }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/input/serio/i8042-x86ia64io.h +++ linux-kvm-5.19.0/drivers/input/serio/i8042-x86ia64io.h @@ -997,17 +997,17 @@ static const struct dmi_system_id i8042_dmi_probe_defer_table[] __initconst = { { - /* ASUS ZenBook UX425UA */ + /* ASUS ZenBook UX425UA/QA */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), - DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425UA"), + DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX425"), }, }, { - /* ASUS ZenBook UM325UA */ + /* ASUS ZenBook UM325UA/QA */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), - DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), + DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325"), }, }, { } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/input/touchscreen/raydium_i2c_ts.c +++ linux-kvm-5.19.0/drivers/input/touchscreen/raydium_i2c_ts.c @@ -211,12 +211,14 @@ error = raydium_i2c_xfer(client, addr, xfer, ARRAY_SIZE(xfer)); if (likely(!error)) - return 0; + goto out; msleep(RM_RETRY_DELAY_MS); } while (++tries < RM_MAX_RETRIES); dev_err(&client->dev, "%s failed: %d\n", __func__, error); +out: + kfree(tx_buf); return error; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/iommu/intel/pasid.c +++ linux-kvm-5.19.0/drivers/iommu/intel/pasid.c @@ -651,7 +651,7 @@ * Since it is a second level only translation setup, we should * set SRE bit as well (addresses are expected to be GPAs). */ - if (pasid != PASID_RID2PASID) + if (pasid != PASID_RID2PASID && ecap_srs(iommu->ecap)) pasid_set_sre(pte); pasid_set_present(pte); pasid_flush_caches(iommu, pte, pasid, did); @@ -690,7 +690,8 @@ * We should set SRE bit as well since the addresses are expected * to be GPAs. */ - pasid_set_sre(pte); + if (ecap_srs(iommu->ecap)) + pasid_set_sre(pte); pasid_set_present(pte); pasid_flush_caches(iommu, pte, pasid, did); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/isdn/mISDN/dsp_pipeline.c +++ linux-kvm-5.19.0/drivers/isdn/mISDN/dsp_pipeline.c @@ -77,6 +77,7 @@ if (!entry) return -ENOMEM; + INIT_LIST_HEAD(&entry->list); entry->elem = elem; entry->dev.class = elements_class; @@ -107,7 +108,7 @@ device_unregister(&entry->dev); return ret; err1: - kfree(entry); + put_device(&entry->dev); return ret; } EXPORT_SYMBOL(mISDN_dsp_element_register); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/md/dm-integrity.c +++ linux-kvm-5.19.0/drivers/md/dm-integrity.c @@ -263,6 +263,7 @@ struct completion crypto_backoff; + bool wrote_to_journal; bool journal_uptodate; bool just_formatted; bool recalculate_flag; @@ -2374,6 +2375,8 @@ if (!commit_sections) goto release_flush_bios; + ic->wrote_to_journal = true; + i = commit_start; for (n = 0; n < commit_sections; n++) { for (j = 0; j < ic->journal_section_entries; j++) { @@ -2590,10 +2593,6 @@ unsigned prev_free_sectors; - /* the following test is not needed, but it tests the replay code */ - if (unlikely(dm_post_suspending(ic->ti)) && !ic->meta_dev) - return; - spin_lock_irq(&ic->endio_wait.lock); write_start = ic->committed_section; write_sections = ic->n_committed_sections; @@ -3101,10 +3100,17 @@ drain_workqueue(ic->commit_wq); if (ic->mode == 'J') { - if (ic->meta_dev) - queue_work(ic->writer_wq, &ic->writer_work); + queue_work(ic->writer_wq, &ic->writer_work); drain_workqueue(ic->writer_wq); dm_integrity_flush_buffers(ic, true); + if (ic->wrote_to_journal) { + init_journal(ic, ic->free_section, + ic->journal_sections - ic->free_section, ic->commit_seq); + if (ic->free_section) { + init_journal(ic, 0, ic->free_section, + next_commit_seq(ic->commit_seq)); + } + } } if (ic->mode == 'B') { @@ -3132,6 +3138,8 @@ DEBUG_print("resume\n"); + ic->wrote_to_journal = false; + if (ic->provided_data_sectors != old_provided_data_sectors) { if (ic->provided_data_sectors > old_provided_data_sectors && ic->mode == 'B' && only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/md/dm-ioctl.c +++ linux-kvm-5.19.0/drivers/md/dm-ioctl.c @@ -655,7 +655,7 @@ size_t *needed = needed_param; *needed += sizeof(struct dm_target_versions); - *needed += strlen(tt->name); + *needed += strlen(tt->name) + 1; *needed += ALIGN_MASK; } @@ -720,7 +720,7 @@ iter_info.old_vers = NULL; iter_info.vers = vers; iter_info.flags = 0; - iter_info.end = (char *)vers+len; + iter_info.end = (char *)vers + needed; /* * Now loop through filling out the names & versions. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/media/common/videobuf2/frame_vector.c +++ linux-kvm-5.19.0/drivers/media/common/videobuf2/frame_vector.c @@ -35,11 +35,7 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames, struct frame_vector *vec) { - struct mm_struct *mm = current->mm; - struct vm_area_struct *vma; - int ret_pin_user_pages_fast = 0; - int ret = 0; - int err; + int ret; if (nr_frames == 0) return 0; @@ -52,57 +48,17 @@ ret = pin_user_pages_fast(start, nr_frames, FOLL_FORCE | FOLL_WRITE | FOLL_LONGTERM, (struct page **)(vec->ptrs)); - if (ret > 0) { - vec->got_ref = true; - vec->is_pfns = false; - goto out_unlocked; - } - ret_pin_user_pages_fast = ret; - - mmap_read_lock(mm); - vec->got_ref = false; - vec->is_pfns = true; - ret = 0; - do { - unsigned long *nums = frame_vector_pfns(vec); - - vma = vma_lookup(mm, start); - if (!vma) - break; - - while (ret < nr_frames && start + PAGE_SIZE <= vma->vm_end) { - err = follow_pfn(vma, start, &nums[ret]); - if (err) { - if (ret) - goto out; - // If follow_pfn() returns -EINVAL, then this - // is not an IO mapping or a raw PFN mapping. - // In that case, return the original error from - // pin_user_pages_fast(). Otherwise this - // function would return -EINVAL when - // pin_user_pages_fast() returned -ENOMEM, - // which makes debugging hard. - if (err == -EINVAL && ret_pin_user_pages_fast) - ret = ret_pin_user_pages_fast; - else - ret = err; - goto out; - } - start += PAGE_SIZE; - ret++; - } - /* Bail out if VMA doesn't completely cover the tail page. */ - if (start < vma->vm_end) - break; - } while (ret < nr_frames); -out: - mmap_read_unlock(mm); -out_unlocked: - if (!ret) - ret = -EFAULT; - if (ret > 0) - vec->nr_frames = ret; - return ret; + vec->got_ref = true; + vec->is_pfns = false; + vec->nr_frames = ret; + + if (likely(ret > 0)) + return ret; + + /* This used to (racily) return non-refcounted pfns. Let people know */ + WARN_ONCE(1, "get_vaddr_frames() cannot follow VM_IO mapping"); + vec->nr_frames = 0; + return ret ? ret : -EFAULT; } EXPORT_SYMBOL(get_vaddr_frames); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/misc/vmw_vmci/vmci_queue_pair.c +++ linux-kvm-5.19.0/drivers/misc/vmw_vmci/vmci_queue_pair.c @@ -854,6 +854,7 @@ u32 context_id = vmci_get_context_id(); struct vmci_event_qp ev; + memset(&ev, 0, sizeof(ev)); ev.msg.hdr.dst = vmci_make_handle(context_id, VMCI_EVENT_HANDLER); ev.msg.hdr.src = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID, VMCI_CONTEXT_RESOURCE_ID); @@ -1467,6 +1468,7 @@ * kernel. */ + memset(&ev, 0, sizeof(ev)); ev.msg.hdr.dst = vmci_make_handle(peer_id, VMCI_EVENT_HANDLER); ev.msg.hdr.src = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID, VMCI_CONTEXT_RESOURCE_ID); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/core/core.c +++ linux-kvm-5.19.0/drivers/mmc/core/core.c @@ -1132,7 +1132,13 @@ mmc_power_cycle(host, ocr); } else { bit = fls(ocr) - 1; - ocr &= 3 << bit; + /* + * The bit variable represents the highest voltage bit set in + * the OCR register. + * To keep a range of 2 values (e.g. 3.2V/3.3V and 3.3V/3.4V), + * we must shift the mask '3' with (bit - 1). + */ + ocr &= 3 << (bit - 1); if (bit != host->ios.vdd) dev_warn(mmc_dev(host), "exceeding card's volts\n"); } @@ -1476,6 +1482,11 @@ card->pref_erase = 0; } +static bool is_trim_arg(unsigned int arg) +{ + return (arg & MMC_TRIM_OR_DISCARD_ARGS) && arg != MMC_DISCARD_ARG; +} + static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card, unsigned int arg, unsigned int qty) { @@ -1758,7 +1769,7 @@ !(card->ext_csd.sec_feature_support & EXT_CSD_SEC_ER_EN)) return -EOPNOTSUPP; - if (mmc_card_mmc(card) && (arg & MMC_TRIM_ARGS) && + if (mmc_card_mmc(card) && is_trim_arg(arg) && !(card->ext_csd.sec_feature_support & EXT_CSD_SEC_GB_CL_EN)) return -EOPNOTSUPP; @@ -1788,7 +1799,7 @@ * identified by the card->eg_boundary flag. */ rem = card->erase_size - (from % card->erase_size); - if ((arg & MMC_TRIM_ARGS) && (card->eg_boundary) && (nr > rem)) { + if ((arg & MMC_TRIM_OR_DISCARD_ARGS) && card->eg_boundary && nr > rem) { err = mmc_do_erase(card, from, from + rem - 1, arg); from += rem; if ((err) || (to <= from)) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/core/mmc_test.c +++ linux-kvm-5.19.0/drivers/mmc/core/mmc_test.c @@ -3179,7 +3179,8 @@ struct mmc_test_dbgfs_file *df; if (card->debugfs_root) - debugfs_create_file(name, mode, card->debugfs_root, card, fops); + file = debugfs_create_file(name, mode, card->debugfs_root, + card, fops); df = kmalloc(sizeof(*df), GFP_KERNEL); if (!df) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/host/sdhci-brcmstb.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci-brcmstb.c @@ -12,6 +12,7 @@ #include #include +#include "sdhci-cqhci.h" #include "sdhci-pltfm.h" #include "cqhci.h" @@ -53,7 +54,7 @@ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); struct sdhci_brcmstb_priv *priv = sdhci_pltfm_priv(pltfm_host); - sdhci_reset(host, mask); + sdhci_and_cqhci_reset(host, mask); /* Reset will clear this, so re-enable it */ if (priv->flags & BRCMSTB_PRIV_FLAGS_GATE_CLOCK) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/host/sdhci-cqhci.h +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci-cqhci.h @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright 2022 The Chromium OS Authors + * + * Support that applies to the combination of SDHCI and CQHCI, while not + * expressing a dependency between the two modules. + */ + +#ifndef __MMC_HOST_SDHCI_CQHCI_H__ +#define __MMC_HOST_SDHCI_CQHCI_H__ + +#include "cqhci.h" +#include "sdhci.h" + +static inline void sdhci_and_cqhci_reset(struct sdhci_host *host, u8 mask) +{ + if ((host->mmc->caps2 & MMC_CAP2_CQE) && (mask & SDHCI_RESET_ALL) && + host->mmc->cqe_private) + cqhci_deactivate(host->mmc); + + sdhci_reset(host, mask); +} + +#endif /* __MMC_HOST_SDHCI_CQHCI_H__ */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/host/sdhci-of-arasan.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci-of-arasan.c @@ -25,6 +25,7 @@ #include #include "cqhci.h" +#include "sdhci-cqhci.h" #include "sdhci-pltfm.h" #define SDHCI_ARASAN_VENDOR_REGISTER 0x78 @@ -366,7 +367,7 @@ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); struct sdhci_arasan_data *sdhci_arasan = sdhci_pltfm_priv(pltfm_host); - sdhci_reset(host, mask); + sdhci_and_cqhci_reset(host, mask); if (sdhci_arasan->quirks & SDHCI_ARASAN_QUIRK_FORCE_CDTEST) { ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/host/sdhci-pci-o2micro.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci-pci-o2micro.c @@ -32,6 +32,7 @@ #define O2_SD_CAPS 0xE0 #define O2_SD_ADMA1 0xE2 #define O2_SD_ADMA2 0xE7 +#define O2_SD_MISC_CTRL2 0xF0 #define O2_SD_INF_MOD 0xF1 #define O2_SD_MISC_CTRL4 0xFC #define O2_SD_MISC_CTRL 0x1C0 @@ -874,6 +875,12 @@ /* Set Tuning Windows to 5 */ pci_write_config_byte(chip->pdev, O2_SD_TUNING_CTRL, 0x55); + //Adjust 1st and 2nd CD debounce time + pci_read_config_dword(chip->pdev, O2_SD_MISC_CTRL2, &scratch_32); + scratch_32 &= 0xFFE7FFFF; + scratch_32 |= 0x00180000; + pci_write_config_dword(chip->pdev, O2_SD_MISC_CTRL2, scratch_32); + pci_write_config_dword(chip->pdev, O2_SD_DETECT_SETTING, 1); /* Lock WP */ ret = pci_read_config_byte(chip->pdev, O2_SD_LOCK_WP, &scratch); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/host/sdhci.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci.c @@ -338,6 +338,7 @@ if (soft) { /* force clock reconfiguration */ host->clock = 0; + host->reinit_uhs = true; mmc->ops->set_ios(mmc, &mmc->ios); } } @@ -2254,11 +2255,46 @@ } EXPORT_SYMBOL_GPL(sdhci_set_uhs_signaling); +static bool sdhci_timing_has_preset(unsigned char timing) +{ + switch (timing) { + case MMC_TIMING_UHS_SDR12: + case MMC_TIMING_UHS_SDR25: + case MMC_TIMING_UHS_SDR50: + case MMC_TIMING_UHS_SDR104: + case MMC_TIMING_UHS_DDR50: + case MMC_TIMING_MMC_DDR52: + return true; + }; + return false; +} + +static bool sdhci_preset_needed(struct sdhci_host *host, unsigned char timing) +{ + return !(host->quirks2 & SDHCI_QUIRK2_PRESET_VALUE_BROKEN) && + sdhci_timing_has_preset(timing); +} + +static bool sdhci_presetable_values_change(struct sdhci_host *host, struct mmc_ios *ios) +{ + /* + * Preset Values are: Driver Strength, Clock Generator and SDCLK/RCLK + * Frequency. Check if preset values need to be enabled, or the Driver + * Strength needs updating. Note, clock changes are handled separately. + */ + return !host->preset_enabled && + (sdhci_preset_needed(host, ios->timing) || host->drv_type != ios->drv_type); +} + void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) { struct sdhci_host *host = mmc_priv(mmc); + bool reinit_uhs = host->reinit_uhs; + bool turning_on_clk = false; u8 ctrl; + host->reinit_uhs = false; + if (ios->power_mode == MMC_POWER_UNDEFINED) return; @@ -2284,6 +2320,8 @@ sdhci_enable_preset_value(host, false); if (!ios->clock || ios->clock != host->clock) { + turning_on_clk = ios->clock && !host->clock; + host->ops->set_clock(host, ios->clock); host->clock = ios->clock; @@ -2310,6 +2348,17 @@ host->ops->set_bus_width(host, ios->bus_width); + /* + * Special case to avoid multiple clock changes during voltage + * switching. + */ + if (!reinit_uhs && + turning_on_clk && + host->timing == ios->timing && + host->version >= SDHCI_SPEC_300 && + !sdhci_presetable_values_change(host, ios)) + return; + ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL); if (!(host->quirks & SDHCI_QUIRK_NO_HISPD_BIT)) { @@ -2353,6 +2402,7 @@ } sdhci_writew(host, ctrl_2, SDHCI_HOST_CONTROL2); + host->drv_type = ios->drv_type; } else { /* * According to SDHC Spec v3.00, if the Preset Value @@ -2380,19 +2430,14 @@ host->ops->set_uhs_signaling(host, ios->timing); host->timing = ios->timing; - if (!(host->quirks2 & SDHCI_QUIRK2_PRESET_VALUE_BROKEN) && - ((ios->timing == MMC_TIMING_UHS_SDR12) || - (ios->timing == MMC_TIMING_UHS_SDR25) || - (ios->timing == MMC_TIMING_UHS_SDR50) || - (ios->timing == MMC_TIMING_UHS_SDR104) || - (ios->timing == MMC_TIMING_UHS_DDR50) || - (ios->timing == MMC_TIMING_MMC_DDR52))) { + if (sdhci_preset_needed(host, ios->timing)) { u16 preset; sdhci_enable_preset_value(host, true); preset = sdhci_get_preset_value(host); ios->drv_type = FIELD_GET(SDHCI_PRESET_DRV_MASK, preset); + host->drv_type = ios->drv_type; } /* Re-enable SD Clock */ @@ -3727,6 +3772,7 @@ sdhci_init(host, 0); host->pwr = 0; host->clock = 0; + host->reinit_uhs = true; mmc->ops->set_ios(mmc, &mmc->ios); } else { sdhci_init(host, (mmc->pm_flags & MMC_PM_KEEP_POWER)); @@ -3789,6 +3835,7 @@ /* Force clock and power re-program */ host->pwr = 0; host->clock = 0; + host->reinit_uhs = true; mmc->ops->start_signal_voltage_switch(mmc, &mmc->ios); mmc->ops->set_ios(mmc, &mmc->ios); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/host/sdhci.h +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci.h @@ -523,6 +523,8 @@ unsigned int clock; /* Current clock (MHz) */ u8 pwr; /* Current voltage */ + u8 drv_type; /* Current UHS-I driver type */ + bool reinit_uhs; /* Force UHS-related re-initialization */ bool runtime_suspended; /* Host is runtime suspended */ bool bus_on; /* Bus power prevents runtime suspend */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mmc/host/sdhci_am654.c +++ linux-kvm-5.19.0/drivers/mmc/host/sdhci_am654.c @@ -15,6 +15,7 @@ #include #include "cqhci.h" +#include "sdhci-cqhci.h" #include "sdhci-pltfm.h" /* CTL_CFG Registers */ @@ -378,7 +379,7 @@ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); - sdhci_reset(host, mask); + sdhci_and_cqhci_reset(host, mask); if (sdhci_am654->quirks & SDHCI_AM654_QUIRK_FORCE_CDTEST) { ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL); @@ -464,7 +465,7 @@ .set_clock = sdhci_am654_set_clock, .write_b = sdhci_am654_write_b, .irq = sdhci_am654_cqhci_irq, - .reset = sdhci_reset, + .reset = sdhci_and_cqhci_reset, }; static const struct sdhci_pltfm_data sdhci_am654_pdata = { @@ -494,7 +495,7 @@ .set_clock = sdhci_am654_set_clock, .write_b = sdhci_am654_write_b, .irq = sdhci_am654_cqhci_irq, - .reset = sdhci_reset, + .reset = sdhci_and_cqhci_reset, }; static const struct sdhci_pltfm_data sdhci_j721e_8bit_pdata = { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/mtd/nand/onenand/Kconfig +++ linux-kvm-5.19.0/drivers/mtd/nand/onenand/Kconfig @@ -26,6 +26,7 @@ tristate "OneNAND on OMAP2/OMAP3 support" depends on ARCH_OMAP2 || ARCH_OMAP3 || (COMPILE_TEST && ARM) depends on OF || COMPILE_TEST + depends on OMAP_GPMC help Support for a OneNAND flash device connected to an OMAP2/OMAP3 SoC via the GPMC memory controller. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/arcnet/com20020_cs.c +++ linux-kvm-5.19.0/drivers/net/arcnet/com20020_cs.c @@ -113,6 +113,7 @@ struct com20020_dev *info; struct net_device *dev; struct arcnet_local *lp; + int ret = -ENOMEM; dev_dbg(&p_dev->dev, "com20020_attach()\n"); @@ -142,12 +143,18 @@ info->dev = dev; p_dev->priv = info; - return com20020_config(p_dev); + ret = com20020_config(p_dev); + if (ret) + goto fail_config; + return 0; + +fail_config: + free_arcdev(dev); fail_alloc_dev: kfree(info); fail_alloc_info: - return -ENOMEM; + return ret; } /* com20020_attach */ static void com20020_detach(struct pcmcia_device *link) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/can/cc770/cc770_isa.c +++ linux-kvm-5.19.0/drivers/net/can/cc770/cc770_isa.c @@ -264,22 +264,24 @@ if (err) { dev_err(&pdev->dev, "couldn't register device (err=%d)\n", err); - goto exit_unmap; + goto exit_free; } dev_info(&pdev->dev, "device registered (reg_base=0x%p, irq=%d)\n", priv->reg_base, dev->irq); return 0; - exit_unmap: +exit_free: + free_cc770dev(dev); +exit_unmap: if (mem[idx]) iounmap(base); - exit_release: +exit_release: if (mem[idx]) release_mem_region(mem[idx], iosize); else release_region(port[idx], iosize); - exit: +exit: return err; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/can/m_can/m_can.c +++ linux-kvm-5.19.0/drivers/net/can/m_can/m_can.c @@ -1904,7 +1904,7 @@ cdev->hclk = devm_clk_get(cdev->dev, "hclk"); cdev->cclk = devm_clk_get(cdev->dev, "cclk"); - if (IS_ERR(cdev->cclk)) { + if (IS_ERR(cdev->hclk) || IS_ERR(cdev->cclk)) { dev_err(cdev->dev, "no clock found\n"); ret = -ENODEV; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/can/m_can/m_can_pci.c +++ linux-kvm-5.19.0/drivers/net/can/m_can/m_can_pci.c @@ -120,7 +120,7 @@ ret = pci_alloc_irq_vectors(pci, 1, 1, PCI_IRQ_ALL_TYPES); if (ret < 0) - return ret; + goto err_free_dev; mcan_class->dev = &pci->dev; mcan_class->net->irq = pci_irq_vector(pci, 0); @@ -132,7 +132,7 @@ ret = m_can_class_register(mcan_class); if (ret) - goto err; + goto err_free_irq; /* Enable interrupt control at CAN wrapper IP */ writel(0x1, base + CTL_CSR_INT_CTL_OFFSET); @@ -144,8 +144,10 @@ return 0; -err: +err_free_irq: pci_free_irq_vectors(pci); +err_free_dev: + m_can_class_free_dev(mcan_class->net); return ret; } @@ -161,6 +163,7 @@ writel(0x0, priv->base + CTL_CSR_INT_CTL_OFFSET); m_can_class_unregister(mcan_class); + m_can_class_free_dev(mcan_class->net); pci_free_irq_vectors(pci); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/can/sja1000/sja1000_isa.c +++ linux-kvm-5.19.0/drivers/net/can/sja1000/sja1000_isa.c @@ -202,22 +202,24 @@ if (err) { dev_err(&pdev->dev, "registering %s failed (err=%d)\n", DRV_NAME, err); - goto exit_unmap; + goto exit_free; } dev_info(&pdev->dev, "%s device registered (reg_base=0x%p, irq=%d)\n", DRV_NAME, priv->reg_base, dev->irq); return 0; - exit_unmap: +exit_free: + free_sja1000dev(dev); +exit_unmap: if (mem[idx]) iounmap(base); - exit_release: +exit_release: if (mem[idx]) release_mem_region(mem[idx], iosize); else release_region(port[idx], iosize); - exit: +exit: return err; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/can/usb/etas_es58x/es58x_core.c +++ linux-kvm-5.19.0/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -2092,8 +2092,11 @@ netdev->dev_port = channel_idx; ret = register_candev(netdev); - if (ret) + if (ret) { + es58x_dev->netdev[channel_idx] = NULL; + free_candev(netdev); return ret; + } netdev_queue_set_dql_min_limit(netdev_get_tx_queue(netdev, 0), es58x_dev->param->dql_min_limit); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/dsa/lan9303-core.c +++ linux-kvm-5.19.0/drivers/net/dsa/lan9303-core.c @@ -959,7 +959,7 @@ { .offset = LAN9303_MAC_TX_BRDCST_CNT_0, .name = "TxBroad", }, { .offset = LAN9303_MAC_TX_PAUSE_CNT_0, .name = "TxPause", }, { .offset = LAN9303_MAC_TX_MULCST_CNT_0, .name = "TxMulti", }, - { .offset = LAN9303_MAC_RX_UNDSZE_CNT_0, .name = "TxUnderRun", }, + { .offset = LAN9303_MAC_RX_UNDSZE_CNT_0, .name = "RxShort", }, { .offset = LAN9303_MAC_TX_64_CNT_0, .name = "Tx64Byte", }, { .offset = LAN9303_MAC_TX_127_CNT_0, .name = "Tx128Byte", }, { .offset = LAN9303_MAC_TX_255_CNT_0, .name = "Tx256Byte", }, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/dsa/sja1105/sja1105_mdio.c +++ linux-kvm-5.19.0/drivers/net/dsa/sja1105/sja1105_mdio.c @@ -256,6 +256,9 @@ u32 tmp; int rc; + if (reg & MII_ADDR_C45) + return -EOPNOTSUPP; + rc = sja1105_xfer_u32(priv, SPI_READ, regs->mdio_100base_tx + reg, &tmp, NULL); if (rc < 0) @@ -272,6 +275,9 @@ const struct sja1105_regs *regs = priv->info->regs; u32 tmp = val; + if (reg & MII_ADDR_C45) + return -EOPNOTSUPP; + return sja1105_xfer_u32(priv, SPI_WRITE, regs->mdio_100base_tx + reg, &tmp, NULL); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ linux-kvm-5.19.0/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -4545,13 +4545,19 @@ static int __init ena_init(void) { + int ret; + ena_wq = create_singlethread_workqueue(DRV_MODULE_NAME); if (!ena_wq) { pr_err("Failed to create workqueue\n"); return -ENOMEM; } - return pci_register_driver(&ena_pci_driver); + ret = pci_register_driver(&ena_pci_driver); + if (ret) + destroy_workqueue(ena_wq); + + return ret; } static void __exit ena_cleanup(void) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/apm/xgene/xgene_enet_main.c @@ -1004,8 +1004,10 @@ xgene_enet_napi_enable(pdata); ret = xgene_enet_register_irq(ndev); - if (ret) + if (ret) { + xgene_enet_napi_disable(pdata); return ret; + } if (ndev->phydev) { phy_start(ndev->phydev); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c +++ linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_ethtool.c @@ -13,6 +13,7 @@ #include "aq_ptp.h" #include "aq_filters.h" #include "aq_macsec.h" +#include "aq_main.h" #include @@ -858,7 +859,7 @@ if (netif_running(ndev)) { ndev_running = true; - dev_close(ndev); + aq_ndev_close(ndev); } cfg->rxds = max(ring->rx_pending, hw_caps->rxds_min); @@ -874,7 +875,7 @@ goto err_exit; if (ndev_running) - err = dev_open(ndev, NULL); + err = aq_ndev_open(ndev); err_exit: return err; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/aquantia/atlantic/aq_main.h +++ linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/aq_main.h @@ -16,5 +16,7 @@ void aq_ndev_schedule_work(struct work_struct *work); struct net_device *aq_ndev_alloc(void); +int aq_ndev_open(struct net_device *ndev); +int aq_ndev_close(struct net_device *ndev); #endif /* AQ_MAIN_H */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/aquantia/atlantic/macsec/macsec_api.c +++ linux-kvm-5.19.0/drivers/net/ethernet/aquantia/atlantic/macsec/macsec_api.c @@ -757,6 +757,7 @@ u16 table_index) { u16 packed_record[18]; + int ret; if (table_index >= NUMROWS_INGRESSSAKEYRECORD) return -EINVAL; @@ -789,9 +790,12 @@ packed_record[16] = rec->key_len & 0x3; - return set_raw_ingress_record(hw, packed_record, 18, 2, - ROWOFFSET_INGRESSSAKEYRECORD + - table_index); + ret = set_raw_ingress_record(hw, packed_record, 18, 2, + ROWOFFSET_INGRESSSAKEYRECORD + + table_index); + + memzero_explicit(packed_record, sizeof(packed_record)); + return ret; } int aq_mss_set_ingress_sakey_record(struct aq_hw_s *hw, @@ -1739,14 +1743,14 @@ ret = set_raw_egress_record(hw, packed_record, 8, 2, ROWOFFSET_EGRESSSAKEYRECORD + table_index); if (unlikely(ret)) - return ret; + goto clear_key; ret = set_raw_egress_record(hw, packed_record + 8, 8, 2, ROWOFFSET_EGRESSSAKEYRECORD + table_index - 32); - if (unlikely(ret)) - return ret; - return 0; +clear_key: + memzero_explicit(packed_record, sizeof(packed_record)); + return ret; } int aq_mss_set_egress_sakey_record(struct aq_hw_s *hw, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/broadcom/Kconfig +++ linux-kvm-5.19.0/drivers/net/ethernet/broadcom/Kconfig @@ -77,7 +77,7 @@ select BCM7XXX_PHY select MDIO_BCM_UNIMAC select DIMLIB - select BROADCOM_PHY if ARCH_BCM2835 + select BROADCOM_PHY if (ARCH_BCM2835 && PTP_1588_CLOCK_OPTIONAL) help This driver supports the built-in Ethernet MACs found in the Broadcom BCM7xxx Set Top Box family chipset. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +++ linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c @@ -795,16 +795,20 @@ static u8 bnx2x_vf_is_pcie_pending(struct bnx2x *bp, u8 abs_vfid) { - struct pci_dev *dev; struct bnx2x_virtf *vf = bnx2x_vf_by_abs_fid(bp, abs_vfid); + struct pci_dev *dev; + bool pending; if (!vf) return false; dev = pci_get_domain_bus_and_slot(vf->domain, vf->bus, vf->devfn); - if (dev) - return bnx2x_is_pcie_pending(dev); - return false; + if (!dev) + return false; + pending = bnx2x_is_pcie_pending(dev); + pci_dev_put(dev); + + return pending; } int bnx2x_vf_flr_clnup_epilog(struct bnx2x *bp, u8 abs_vfid) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -162,7 +162,7 @@ } reset_coalesce: - if (netif_running(dev)) { + if (test_bit(BNXT_STATE_OPEN, &bp->state)) { if (update_stats) { rc = bnxt_close_nic(bp, true, false); if (!rc) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c +++ linux-kvm-5.19.0/drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c @@ -476,7 +476,8 @@ memset(ctx->resp, 0, PAGE_SIZE); req_type = le16_to_cpu(ctx->req->req_type); - if (BNXT_NO_FW_ACCESS(bp) && req_type != HWRM_FUNC_RESET) { + if (BNXT_NO_FW_ACCESS(bp) && + (req_type != HWRM_FUNC_RESET && req_type != HWRM_VER_GET)) { netdev_dbg(bp->dev, "hwrm req_type 0x%x skipped, FW channel down\n", req_type); goto exit; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/cavium/liquidio/lio_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/cavium/liquidio/lio_main.c @@ -1799,13 +1799,10 @@ ifstate_set(lio, LIO_IFSTATE_RUNNING); - if (OCTEON_CN23XX_PF(oct)) { - if (!oct->msix_on) - if (setup_tx_poll_fn(netdev)) - return -1; - } else { - if (setup_tx_poll_fn(netdev)) - return -1; + if (!OCTEON_CN23XX_PF(oct) || !oct->msix_on) { + ret = setup_tx_poll_fn(netdev); + if (ret) + goto err_poll; } netif_tx_start_all_queues(netdev); @@ -1818,7 +1815,7 @@ /* tell Octeon to start forwarding packets to host */ ret = send_rx_ctrl_cmd(lio, 1); if (ret) - return ret; + goto err_rx_ctrl; /* start periodical statistics fetch */ INIT_DELAYED_WORK(&lio->stats_wk.work, lio_fetch_stats); @@ -1829,6 +1826,27 @@ dev_info(&oct->pci_dev->dev, "%s interface is opened\n", netdev->name); + return 0; + +err_rx_ctrl: + if (!OCTEON_CN23XX_PF(oct) || !oct->msix_on) + cleanup_tx_poll_fn(netdev); +err_poll: + if (lio->ptp_clock) { + ptp_clock_unregister(lio->ptp_clock); + lio->ptp_clock = NULL; + } + + if (oct->props[lio->ifidx].napi_enabled == 1) { + list_for_each_entry_safe(napi, n, &netdev->napi_list, dev_list) + napi_disable(napi); + + oct->props[lio->ifidx].napi_enabled = 0; + + if (OCTEON_CN23XX_PF(oct)) + oct->droq[0]->ops.poll_mode = 0; + } + return ret; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/cavium/thunder/thunder_bgx.c +++ linux-kvm-5.19.0/drivers/net/ethernet/cavium/thunder/thunder_bgx.c @@ -1436,8 +1436,10 @@ return AE_OK; } - if (strncmp(string.pointer, bgx_sel, 4)) + if (strncmp(string.pointer, bgx_sel, 4)) { + kfree(string.pointer); return AE_OK; + } acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, 1, bgx_acpi_register_phy, NULL, bgx, NULL); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c @@ -1302,6 +1302,7 @@ if (ret < 0) { CH_ERR(adap, "failed to bind qsets, err %d\n", ret); t3_intr_disable(adap); + quiesce_rx(adap); free_irq_resources(adap); err = ret; goto out; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c @@ -858,7 +858,7 @@ */ err = t4vf_update_port_info(pi); if (err < 0) - return err; + goto err_unwind; /* * Note that this interface is up and start everything up ... only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/davicom/dm9051.c +++ linux-kvm-5.19.0/drivers/net/ethernet/davicom/dm9051.c @@ -798,8 +798,10 @@ } ret = dm9051_stop_mrcmd(db); - if (ret) + if (ret) { + dev_kfree_skb(skb); return ret; + } skb->protocol = eth_type_trans(skb, db->ndev); if (db->ndev->features & NETIF_F_RXCSUM) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/freescale/fman/mac.c +++ linux-kvm-5.19.0/drivers/net/ethernet/freescale/fman/mac.c @@ -882,12 +882,21 @@ return err; } +static int mac_remove(struct platform_device *pdev) +{ + struct mac_device *mac_dev = platform_get_drvdata(pdev); + + platform_device_unregister(mac_dev->priv->eth_dev); + return 0; +} + static struct platform_driver mac_driver = { .driver = { .name = KBUILD_MODNAME, .of_match_table = mac_match, }, .probe = mac_probe, + .remove = mac_remove, }; builtin_platform_driver(mac_driver); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ linux-kvm-5.19.0/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -790,7 +790,6 @@ const struct hnae3_dcb_ops *dcb_ops; u16 int_rl_setting; - enum pkt_hash_types rss_type; void __iomem *io_base; }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c +++ linux-kvm-5.19.0/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.c @@ -191,23 +191,6 @@ return HCLGE_COMM_RSS_KEY_SIZE; } -void hclge_comm_get_rss_type(struct hnae3_handle *nic, - struct hclge_comm_rss_tuple_cfg *rss_tuple_sets) -{ - if (rss_tuple_sets->ipv4_tcp_en || - rss_tuple_sets->ipv4_udp_en || - rss_tuple_sets->ipv4_sctp_en || - rss_tuple_sets->ipv6_tcp_en || - rss_tuple_sets->ipv6_udp_en || - rss_tuple_sets->ipv6_sctp_en) - nic->kinfo.rss_type = PKT_HASH_TYPE_L4; - else if (rss_tuple_sets->ipv4_fragment_en || - rss_tuple_sets->ipv6_fragment_en) - nic->kinfo.rss_type = PKT_HASH_TYPE_L3; - else - nic->kinfo.rss_type = PKT_HASH_TYPE_NONE; -} - int hclge_comm_parse_rss_hfunc(struct hclge_comm_rss_cfg *rss_cfg, const u8 hfunc, u8 *hash_algo) { @@ -344,9 +327,6 @@ req->ipv6_sctp_en = rss_cfg->rss_tuple_sets.ipv6_sctp_en; req->ipv6_fragment_en = rss_cfg->rss_tuple_sets.ipv6_fragment_en; - if (is_pf) - hclge_comm_get_rss_type(nic, &rss_cfg->rss_tuple_sets); - ret = hclge_comm_cmd_send(hw, &desc, 1); if (ret) dev_err(&hw->cmq.csq.pdev->dev, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h +++ linux-kvm-5.19.0/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_rss.h @@ -95,8 +95,6 @@ }; u32 hclge_comm_get_rss_key_size(struct hnae3_handle *handle); -void hclge_comm_get_rss_type(struct hnae3_handle *nic, - struct hclge_comm_rss_tuple_cfg *rss_tuple_sets); void hclge_comm_rss_indir_init_cfg(struct hnae3_ae_dev *ae_dev, struct hclge_comm_rss_cfg *rss_cfg); int hclge_comm_get_rss_tuple(struct hclge_comm_rss_cfg *rss_cfg, int flow_type, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ linux-kvm-5.19.0/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -105,26 +105,28 @@ }; MODULE_DEVICE_TABLE(pci, hns3_pci_tbl); -#define HNS3_RX_PTYPE_ENTRY(ptype, l, s, t) \ +#define HNS3_RX_PTYPE_ENTRY(ptype, l, s, t, h) \ { ptype, \ l, \ CHECKSUM_##s, \ HNS3_L3_TYPE_##t, \ - 1 } + 1, \ + h} #define HNS3_RX_PTYPE_UNUSED_ENTRY(ptype) \ - { ptype, 0, CHECKSUM_NONE, HNS3_L3_TYPE_PARSE_FAIL, 0 } + { ptype, 0, CHECKSUM_NONE, HNS3_L3_TYPE_PARSE_FAIL, 0, \ + PKT_HASH_TYPE_NONE } static const struct hns3_rx_ptype hns3_rx_ptype_tbl[] = { HNS3_RX_PTYPE_UNUSED_ENTRY(0), - HNS3_RX_PTYPE_ENTRY(1, 0, COMPLETE, ARP), - HNS3_RX_PTYPE_ENTRY(2, 0, COMPLETE, RARP), - HNS3_RX_PTYPE_ENTRY(3, 0, COMPLETE, LLDP), - HNS3_RX_PTYPE_ENTRY(4, 0, COMPLETE, PARSE_FAIL), - HNS3_RX_PTYPE_ENTRY(5, 0, COMPLETE, PARSE_FAIL), - HNS3_RX_PTYPE_ENTRY(6, 0, COMPLETE, PARSE_FAIL), - HNS3_RX_PTYPE_ENTRY(7, 0, COMPLETE, CNM), - HNS3_RX_PTYPE_ENTRY(8, 0, NONE, PARSE_FAIL), + HNS3_RX_PTYPE_ENTRY(1, 0, COMPLETE, ARP, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(2, 0, COMPLETE, RARP, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(3, 0, COMPLETE, LLDP, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(4, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(5, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(6, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(7, 0, COMPLETE, CNM, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(8, 0, NONE, PARSE_FAIL, PKT_HASH_TYPE_NONE), HNS3_RX_PTYPE_UNUSED_ENTRY(9), HNS3_RX_PTYPE_UNUSED_ENTRY(10), HNS3_RX_PTYPE_UNUSED_ENTRY(11), @@ -132,36 +134,36 @@ HNS3_RX_PTYPE_UNUSED_ENTRY(13), HNS3_RX_PTYPE_UNUSED_ENTRY(14), HNS3_RX_PTYPE_UNUSED_ENTRY(15), - HNS3_RX_PTYPE_ENTRY(16, 0, COMPLETE, PARSE_FAIL), - HNS3_RX_PTYPE_ENTRY(17, 0, COMPLETE, IPV4), - HNS3_RX_PTYPE_ENTRY(18, 0, COMPLETE, IPV4), - HNS3_RX_PTYPE_ENTRY(19, 0, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(20, 0, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(21, 0, NONE, IPV4), - HNS3_RX_PTYPE_ENTRY(22, 0, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(23, 0, NONE, IPV4), - HNS3_RX_PTYPE_ENTRY(24, 0, NONE, IPV4), - HNS3_RX_PTYPE_ENTRY(25, 0, UNNECESSARY, IPV4), + HNS3_RX_PTYPE_ENTRY(16, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(17, 0, COMPLETE, IPV4, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(18, 0, COMPLETE, IPV4, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(19, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(20, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(21, 0, NONE, IPV4, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(22, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(23, 0, NONE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(24, 0, NONE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(25, 0, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), HNS3_RX_PTYPE_UNUSED_ENTRY(26), HNS3_RX_PTYPE_UNUSED_ENTRY(27), HNS3_RX_PTYPE_UNUSED_ENTRY(28), - HNS3_RX_PTYPE_ENTRY(29, 0, COMPLETE, PARSE_FAIL), - HNS3_RX_PTYPE_ENTRY(30, 0, COMPLETE, PARSE_FAIL), - HNS3_RX_PTYPE_ENTRY(31, 0, COMPLETE, IPV4), - HNS3_RX_PTYPE_ENTRY(32, 0, COMPLETE, IPV4), - HNS3_RX_PTYPE_ENTRY(33, 1, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(34, 1, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(35, 1, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(36, 0, COMPLETE, IPV4), - HNS3_RX_PTYPE_ENTRY(37, 0, COMPLETE, IPV4), + HNS3_RX_PTYPE_ENTRY(29, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(30, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(31, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(32, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(33, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(34, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(35, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(36, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(37, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), HNS3_RX_PTYPE_UNUSED_ENTRY(38), - HNS3_RX_PTYPE_ENTRY(39, 0, COMPLETE, IPV6), - HNS3_RX_PTYPE_ENTRY(40, 0, COMPLETE, IPV6), - HNS3_RX_PTYPE_ENTRY(41, 1, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(42, 1, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(43, 1, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(44, 0, COMPLETE, IPV6), - HNS3_RX_PTYPE_ENTRY(45, 0, COMPLETE, IPV6), + HNS3_RX_PTYPE_ENTRY(39, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(40, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(41, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(42, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(43, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(44, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(45, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), HNS3_RX_PTYPE_UNUSED_ENTRY(46), HNS3_RX_PTYPE_UNUSED_ENTRY(47), HNS3_RX_PTYPE_UNUSED_ENTRY(48), @@ -227,35 +229,35 @@ HNS3_RX_PTYPE_UNUSED_ENTRY(108), HNS3_RX_PTYPE_UNUSED_ENTRY(109), HNS3_RX_PTYPE_UNUSED_ENTRY(110), - HNS3_RX_PTYPE_ENTRY(111, 0, COMPLETE, IPV6), - HNS3_RX_PTYPE_ENTRY(112, 0, COMPLETE, IPV6), - HNS3_RX_PTYPE_ENTRY(113, 0, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(114, 0, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(115, 0, NONE, IPV6), - HNS3_RX_PTYPE_ENTRY(116, 0, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(117, 0, NONE, IPV6), - HNS3_RX_PTYPE_ENTRY(118, 0, NONE, IPV6), - HNS3_RX_PTYPE_ENTRY(119, 0, UNNECESSARY, IPV6), + HNS3_RX_PTYPE_ENTRY(111, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(112, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(113, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(114, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(115, 0, NONE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(116, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(117, 0, NONE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(118, 0, NONE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(119, 0, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), HNS3_RX_PTYPE_UNUSED_ENTRY(120), HNS3_RX_PTYPE_UNUSED_ENTRY(121), HNS3_RX_PTYPE_UNUSED_ENTRY(122), - HNS3_RX_PTYPE_ENTRY(123, 0, COMPLETE, PARSE_FAIL), - HNS3_RX_PTYPE_ENTRY(124, 0, COMPLETE, PARSE_FAIL), - HNS3_RX_PTYPE_ENTRY(125, 0, COMPLETE, IPV4), - HNS3_RX_PTYPE_ENTRY(126, 0, COMPLETE, IPV4), - HNS3_RX_PTYPE_ENTRY(127, 1, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(128, 1, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(129, 1, UNNECESSARY, IPV4), - HNS3_RX_PTYPE_ENTRY(130, 0, COMPLETE, IPV4), - HNS3_RX_PTYPE_ENTRY(131, 0, COMPLETE, IPV4), + HNS3_RX_PTYPE_ENTRY(123, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(124, 0, COMPLETE, PARSE_FAIL, PKT_HASH_TYPE_NONE), + HNS3_RX_PTYPE_ENTRY(125, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(126, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(127, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(128, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(129, 1, UNNECESSARY, IPV4, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(130, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(131, 0, COMPLETE, IPV4, PKT_HASH_TYPE_L3), HNS3_RX_PTYPE_UNUSED_ENTRY(132), - HNS3_RX_PTYPE_ENTRY(133, 0, COMPLETE, IPV6), - HNS3_RX_PTYPE_ENTRY(134, 0, COMPLETE, IPV6), - HNS3_RX_PTYPE_ENTRY(135, 1, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(136, 1, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(137, 1, UNNECESSARY, IPV6), - HNS3_RX_PTYPE_ENTRY(138, 0, COMPLETE, IPV6), - HNS3_RX_PTYPE_ENTRY(139, 0, COMPLETE, IPV6), + HNS3_RX_PTYPE_ENTRY(133, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(134, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(135, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(136, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(137, 1, UNNECESSARY, IPV6, PKT_HASH_TYPE_L4), + HNS3_RX_PTYPE_ENTRY(138, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), + HNS3_RX_PTYPE_ENTRY(139, 0, COMPLETE, IPV6, PKT_HASH_TYPE_L3), HNS3_RX_PTYPE_UNUSED_ENTRY(140), HNS3_RX_PTYPE_UNUSED_ENTRY(141), HNS3_RX_PTYPE_UNUSED_ENTRY(142), @@ -3734,8 +3736,8 @@ desc_cb->reuse_flag = 1; } else if (frag_size <= ring->rx_copybreak) { ret = hns3_handle_rx_copybreak(skb, i, ring, pull_len, desc_cb); - if (ret) - goto out; + if (!ret) + return; } out: @@ -4129,15 +4131,35 @@ } static void hns3_set_rx_skb_rss_type(struct hns3_enet_ring *ring, - struct sk_buff *skb, u32 rss_hash) + struct sk_buff *skb, u32 rss_hash, + u32 l234info, u32 ol_info) { - struct hnae3_handle *handle = ring->tqp->handle; - enum pkt_hash_types rss_type; + enum pkt_hash_types rss_type = PKT_HASH_TYPE_NONE; + struct net_device *netdev = ring_to_netdev(ring); + struct hns3_nic_priv *priv = netdev_priv(netdev); - if (rss_hash) - rss_type = handle->kinfo.rss_type; - else - rss_type = PKT_HASH_TYPE_NONE; + if (test_bit(HNS3_NIC_STATE_RXD_ADV_LAYOUT_ENABLE, &priv->state)) { + u32 ptype = hnae3_get_field(ol_info, HNS3_RXD_PTYPE_M, + HNS3_RXD_PTYPE_S); + + rss_type = hns3_rx_ptype_tbl[ptype].hash_type; + } else { + int l3_type = hnae3_get_field(l234info, HNS3_RXD_L3ID_M, + HNS3_RXD_L3ID_S); + int l4_type = hnae3_get_field(l234info, HNS3_RXD_L4ID_M, + HNS3_RXD_L4ID_S); + + if (l3_type == HNS3_L3_TYPE_IPV4 || + l3_type == HNS3_L3_TYPE_IPV6) { + if (l4_type == HNS3_L4_TYPE_UDP || + l4_type == HNS3_L4_TYPE_TCP || + l4_type == HNS3_L4_TYPE_SCTP) + rss_type = PKT_HASH_TYPE_L4; + else if (l4_type == HNS3_L4_TYPE_IGMP || + l4_type == HNS3_L4_TYPE_ICMP) + rss_type = PKT_HASH_TYPE_L3; + } + } skb_set_hash(skb, rss_hash, rss_type); } @@ -4240,7 +4262,8 @@ ring->tqp_vector->rx_group.total_bytes += len; - hns3_set_rx_skb_rss_type(ring, skb, le32_to_cpu(desc->rx.rss_hash)); + hns3_set_rx_skb_rss_type(ring, skb, le32_to_cpu(desc->rx.rss_hash), + l234info, ol_info); return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +++ linux-kvm-5.19.0/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h @@ -404,6 +404,7 @@ u32 ip_summed : 2; u32 l3_type : 4; u32 valid : 1; + u32 hash_type: 3; }; struct ring_stats { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3246,6 +3246,7 @@ hdev->hw.mac.autoneg = cmd.base.autoneg; hdev->hw.mac.speed = cmd.base.speed; hdev->hw.mac.duplex = cmd.base.duplex; + linkmode_copy(hdev->hw.mac.advertising, cmd.link_modes.advertising); return 0; } @@ -4662,7 +4663,6 @@ return ret; } - hclge_comm_get_rss_type(&vport->nic, &hdev->rss_cfg.rss_tuple_sets); return 0; } @@ -11374,9 +11374,12 @@ if (ret) goto err_msi_irq_uninit; - if (hdev->hw.mac.media_type == HNAE3_MEDIA_TYPE_COPPER && - !hnae3_dev_phy_imp_supported(hdev)) { - ret = hclge_mac_mdio_config(hdev); + if (hdev->hw.mac.media_type == HNAE3_MEDIA_TYPE_COPPER) { + if (hnae3_dev_phy_imp_supported(hdev)) + ret = hclge_update_tp_port_info(hdev); + else + ret = hclge_mac_mdio_config(hdev); + if (ret) goto err_msi_irq_uninit; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/intel/e100.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/e100.c @@ -1742,11 +1742,8 @@ dma_addr = dma_map_single(&nic->pdev->dev, skb->data, skb->len, DMA_TO_DEVICE); /* If we can't map the skb, have the upper layer try later */ - if (dma_mapping_error(&nic->pdev->dev, dma_addr)) { - dev_kfree_skb_any(skb); - skb = NULL; + if (dma_mapping_error(&nic->pdev->dev, dma_addr)) return -ENOMEM; - } /* * Use the last 4 bytes of the SKB payload packet as the CRC, used for only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/intel/fm10k/fm10k_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/fm10k/fm10k_main.c @@ -32,6 +32,8 @@ **/ static int __init fm10k_init_module(void) { + int ret; + pr_info("%s\n", fm10k_driver_string); pr_info("%s\n", fm10k_copyright); @@ -43,7 +45,13 @@ fm10k_dbg_init(); - return fm10k_register_pci_driver(); + ret = fm10k_register_pci_driver(); + if (ret) { + fm10k_dbg_exit(); + destroy_workqueue(fm10k_workqueue); + } + + return ret; } module_init(fm10k_init_module); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/intel/ice/ice_lib.h +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/ice/ice_lib.h @@ -130,4 +130,5 @@ bool ice_is_feature_supported(struct ice_pf *pf, enum ice_feature f); void ice_clear_feature_support(struct ice_pf *pf, enum ice_feature f); void ice_init_feature_support(struct ice_pf *pf); +bool ice_vsi_is_rx_queue_active(struct ice_vsi *vsi); #endif /* !_ICE_LIB_H_ */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c @@ -4869,6 +4869,8 @@ **/ static int __init ixgbevf_init_module(void) { + int err; + pr_info("%s\n", ixgbevf_driver_string); pr_info("%s\n", ixgbevf_copyright); ixgbevf_wq = create_singlethread_workqueue(ixgbevf_driver_name); @@ -4877,7 +4879,13 @@ return -ENOMEM; } - return pci_register_driver(&ixgbevf_driver); + err = pci_register_driver(&ixgbevf_driver); + if (err) { + destroy_workqueue(ixgbevf_wq); + return err; + } + + return 0; } module_init(ixgbevf_init_module); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/mv643xx_eth.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/mv643xx_eth.c @@ -2481,6 +2481,7 @@ for (i = 0; i < mp->rxq_count; i++) rxq_deinit(mp->rxq + i); out: + napi_disable(&mp->napi); free_irq(dev->irq, dev); return err; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeon_ep/octep_main.c @@ -521,14 +521,12 @@ octep_oq_dbell_init(oct); ret = octep_get_link_status(oct); - if (ret) + if (ret > 0) octep_link_up(netdev); return 0; set_queues_err: - octep_napi_disable(oct); - octep_napi_delete(oct); octep_clean_irqs(oct); setup_irq_err: octep_free_oqs(oct); @@ -958,7 +956,7 @@ ret = octep_ctrl_mbox_init(ctrl_mbox); if (ret) { dev_err(&pdev->dev, "Failed to initialize control mbox\n"); - return -1; + goto unsupported_dev; } oct->ctrl_mbox_ifstats_offset = OCTEP_CTRL_MBOX_SZ(ctrl_mbox->h2fq.elem_sz, ctrl_mbox->h2fq.elem_cnt, @@ -968,6 +966,10 @@ return 0; unsupported_dev: + for (i = 0; i < OCTEP_MMIO_REGIONS; i++) + iounmap(oct->mmio[i].hw_addr); + + kfree(oct->conf); return -1; } @@ -1070,7 +1072,11 @@ netdev->max_mtu = OCTEP_MAX_MTU; netdev->mtu = OCTEP_DEFAULT_MTU; - octep_get_mac_addr(octep_dev, octep_dev->mac_addr); + err = octep_get_mac_addr(octep_dev, octep_dev->mac_addr); + if (err) { + dev_err(&pdev->dev, "Failed to get mac address\n"); + goto register_dev_err; + } eth_hw_addr_set(netdev, octep_dev->mac_addr); err = register_netdev(netdev); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c @@ -534,6 +534,8 @@ sprintf(lmac, "LMAC%d", lmac_id); seq_printf(filp, "%s\t0x%x\t\tNIX%d\t\t%s\t%s\n", dev_name(&pdev->dev), pcifunc, blkid, cgx, lmac); + + pci_dev_put(pdev); } return 0; } @@ -2220,6 +2222,7 @@ } } + pci_dev_put(pdev); return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c @@ -4954,6 +4954,8 @@ ipolicer->ref_count = devm_kcalloc(rvu->dev, ipolicer->band_prof.max, sizeof(u16), GFP_KERNEL); + if (!ipolicer->ref_count) + return -ENOMEM; } /* Set policer timeunit to 2us ie (19 + 1) * 100 nsec = 2us */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/octeontx2/af/rvu_sdp.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/af/rvu_sdp.c @@ -62,15 +62,18 @@ pfvf->sdp_info = devm_kzalloc(rvu->dev, sizeof(struct sdp_node_info), GFP_KERNEL); - if (!pfvf->sdp_info) + if (!pfvf->sdp_info) { + pci_dev_put(pdev); return -ENOMEM; + } dev_info(rvu->dev, "SDP PF number:%d\n", sdp_pf_num[i]); - put_device(&pdev->dev); i++; } + pci_dev_put(pdev); + return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c @@ -15,6 +15,7 @@ #include #include #include +#include #include "otx2_reg.h" #include "otx2_common.h" @@ -1161,6 +1162,59 @@ } EXPORT_SYMBOL(otx2_set_real_num_queues); +static char *nix_sqoperr_e_str[NIX_SQOPERR_MAX] = { + "NIX_SQOPERR_OOR", + "NIX_SQOPERR_CTX_FAULT", + "NIX_SQOPERR_CTX_POISON", + "NIX_SQOPERR_DISABLED", + "NIX_SQOPERR_SIZE_ERR", + "NIX_SQOPERR_OFLOW", + "NIX_SQOPERR_SQB_NULL", + "NIX_SQOPERR_SQB_FAULT", + "NIX_SQOPERR_SQE_SZ_ZERO", +}; + +static char *nix_mnqerr_e_str[NIX_MNQERR_MAX] = { + "NIX_MNQERR_SQ_CTX_FAULT", + "NIX_MNQERR_SQ_CTX_POISON", + "NIX_MNQERR_SQB_FAULT", + "NIX_MNQERR_SQB_POISON", + "NIX_MNQERR_TOTAL_ERR", + "NIX_MNQERR_LSO_ERR", + "NIX_MNQERR_CQ_QUERY_ERR", + "NIX_MNQERR_MAX_SQE_SIZE_ERR", + "NIX_MNQERR_MAXLEN_ERR", + "NIX_MNQERR_SQE_SIZEM1_ZERO", +}; + +static char *nix_snd_status_e_str[NIX_SND_STATUS_MAX] = { + "NIX_SND_STATUS_GOOD", + "NIX_SND_STATUS_SQ_CTX_FAULT", + "NIX_SND_STATUS_SQ_CTX_POISON", + "NIX_SND_STATUS_SQB_FAULT", + "NIX_SND_STATUS_SQB_POISON", + "NIX_SND_STATUS_HDR_ERR", + "NIX_SND_STATUS_EXT_ERR", + "NIX_SND_STATUS_JUMP_FAULT", + "NIX_SND_STATUS_JUMP_POISON", + "NIX_SND_STATUS_CRC_ERR", + "NIX_SND_STATUS_IMM_ERR", + "NIX_SND_STATUS_SG_ERR", + "NIX_SND_STATUS_MEM_ERR", + "NIX_SND_STATUS_INVALID_SUBDC", + "NIX_SND_STATUS_SUBDC_ORDER_ERR", + "NIX_SND_STATUS_DATA_FAULT", + "NIX_SND_STATUS_DATA_POISON", + "NIX_SND_STATUS_NPC_DROP_ACTION", + "NIX_SND_STATUS_LOCK_VIOL", + "NIX_SND_STATUS_NPC_UCAST_CHAN_ERR", + "NIX_SND_STATUS_NPC_MCAST_CHAN_ERR", + "NIX_SND_STATUS_NPC_MCAST_ABORT", + "NIX_SND_STATUS_NPC_VTAG_PTR_ERR", + "NIX_SND_STATUS_NPC_VTAG_SIZE_ERR", + "NIX_SND_STATUS_SEND_STATS_ERR", +}; + static irqreturn_t otx2_q_intr_handler(int irq, void *data) { struct otx2_nic *pf = data; @@ -1194,46 +1248,67 @@ /* SQ */ for (qidx = 0; qidx < pf->hw.tot_tx_queues; qidx++) { + u64 sq_op_err_dbg, mnq_err_dbg, snd_err_dbg; + u8 sq_op_err_code, mnq_err_code, snd_err_code; + + /* Below debug registers captures first errors corresponding to + * those registers. We don't have to check against SQ qid as + * these are fatal errors. + */ + ptr = otx2_get_regaddr(pf, NIX_LF_SQ_OP_INT); val = otx2_atomic64_add((qidx << 44), ptr); otx2_write64(pf, NIX_LF_SQ_OP_INT, (qidx << 44) | (val & NIX_SQINT_BITS)); - if (!(val & (NIX_SQINT_BITS | BIT_ULL(42)))) - continue; - if (val & BIT_ULL(42)) { netdev_err(pf->netdev, "SQ%lld: error reading NIX_LF_SQ_OP_INT, NIX_LF_ERR_INT 0x%llx\n", qidx, otx2_read64(pf, NIX_LF_ERR_INT)); - } else { - if (val & BIT_ULL(NIX_SQINT_LMT_ERR)) { - netdev_err(pf->netdev, "SQ%lld: LMT store error NIX_LF_SQ_OP_ERR_DBG:0x%llx", - qidx, - otx2_read64(pf, - NIX_LF_SQ_OP_ERR_DBG)); - otx2_write64(pf, NIX_LF_SQ_OP_ERR_DBG, - BIT_ULL(44)); - } - if (val & BIT_ULL(NIX_SQINT_MNQ_ERR)) { - netdev_err(pf->netdev, "SQ%lld: Meta-descriptor enqueue error NIX_LF_MNQ_ERR_DGB:0x%llx\n", - qidx, - otx2_read64(pf, NIX_LF_MNQ_ERR_DBG)); - otx2_write64(pf, NIX_LF_MNQ_ERR_DBG, - BIT_ULL(44)); - } - if (val & BIT_ULL(NIX_SQINT_SEND_ERR)) { - netdev_err(pf->netdev, "SQ%lld: Send error, NIX_LF_SEND_ERR_DBG 0x%llx", - qidx, - otx2_read64(pf, - NIX_LF_SEND_ERR_DBG)); - otx2_write64(pf, NIX_LF_SEND_ERR_DBG, - BIT_ULL(44)); - } - if (val & BIT_ULL(NIX_SQINT_SQB_ALLOC_FAIL)) - netdev_err(pf->netdev, "SQ%lld: SQB allocation failed", - qidx); + goto done; } + sq_op_err_dbg = otx2_read64(pf, NIX_LF_SQ_OP_ERR_DBG); + if (!(sq_op_err_dbg & BIT(44))) + goto chk_mnq_err_dbg; + + sq_op_err_code = FIELD_GET(GENMASK(7, 0), sq_op_err_dbg); + netdev_err(pf->netdev, "SQ%lld: NIX_LF_SQ_OP_ERR_DBG(%llx) err=%s\n", + qidx, sq_op_err_dbg, nix_sqoperr_e_str[sq_op_err_code]); + + otx2_write64(pf, NIX_LF_SQ_OP_ERR_DBG, BIT_ULL(44)); + + if (sq_op_err_code == NIX_SQOPERR_SQB_NULL) + goto chk_mnq_err_dbg; + + /* Err is not NIX_SQOPERR_SQB_NULL, call aq function to read SQ structure. + * TODO: But we are in irq context. How to call mbox functions which does sleep + */ + +chk_mnq_err_dbg: + mnq_err_dbg = otx2_read64(pf, NIX_LF_MNQ_ERR_DBG); + if (!(mnq_err_dbg & BIT(44))) + goto chk_snd_err_dbg; + + mnq_err_code = FIELD_GET(GENMASK(7, 0), mnq_err_dbg); + netdev_err(pf->netdev, "SQ%lld: NIX_LF_MNQ_ERR_DBG(%llx) err=%s\n", + qidx, mnq_err_dbg, nix_mnqerr_e_str[mnq_err_code]); + otx2_write64(pf, NIX_LF_MNQ_ERR_DBG, BIT_ULL(44)); + +chk_snd_err_dbg: + snd_err_dbg = otx2_read64(pf, NIX_LF_SEND_ERR_DBG); + if (snd_err_dbg & BIT(44)) { + snd_err_code = FIELD_GET(GENMASK(7, 0), snd_err_dbg); + netdev_err(pf->netdev, "SQ%lld: NIX_LF_SND_ERR_DBG:0x%llx err=%s\n", + qidx, snd_err_dbg, nix_snd_status_e_str[snd_err_code]); + otx2_write64(pf, NIX_LF_SEND_ERR_DBG, BIT_ULL(44)); + } + +done: + /* Print values and reset */ + if (val & BIT_ULL(NIX_SQINT_SQB_ALLOC_FAIL)) + netdev_err(pf->netdev, "SQ%lld: SQB allocation failed", + qidx); + schedule_work(&pf->reset_task); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_struct.h +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_struct.h @@ -274,4 +274,61 @@ BIT_ULL(NIX_SQINT_SEND_ERR) | \ BIT_ULL(NIX_SQINT_SQB_ALLOC_FAIL)) +enum nix_sqoperr_e { + NIX_SQOPERR_OOR = 0, + NIX_SQOPERR_CTX_FAULT = 1, + NIX_SQOPERR_CTX_POISON = 2, + NIX_SQOPERR_DISABLED = 3, + NIX_SQOPERR_SIZE_ERR = 4, + NIX_SQOPERR_OFLOW = 5, + NIX_SQOPERR_SQB_NULL = 6, + NIX_SQOPERR_SQB_FAULT = 7, + NIX_SQOPERR_SQE_SZ_ZERO = 8, + NIX_SQOPERR_MAX, +}; + +enum nix_mnqerr_e { + NIX_MNQERR_SQ_CTX_FAULT = 0, + NIX_MNQERR_SQ_CTX_POISON = 1, + NIX_MNQERR_SQB_FAULT = 2, + NIX_MNQERR_SQB_POISON = 3, + NIX_MNQERR_TOTAL_ERR = 4, + NIX_MNQERR_LSO_ERR = 5, + NIX_MNQERR_CQ_QUERY_ERR = 6, + NIX_MNQERR_MAX_SQE_SIZE_ERR = 7, + NIX_MNQERR_MAXLEN_ERR = 8, + NIX_MNQERR_SQE_SIZEM1_ZERO = 9, + NIX_MNQERR_MAX, +}; + +enum nix_snd_status_e { + NIX_SND_STATUS_GOOD = 0x0, + NIX_SND_STATUS_SQ_CTX_FAULT = 0x1, + NIX_SND_STATUS_SQ_CTX_POISON = 0x2, + NIX_SND_STATUS_SQB_FAULT = 0x3, + NIX_SND_STATUS_SQB_POISON = 0x4, + NIX_SND_STATUS_HDR_ERR = 0x5, + NIX_SND_STATUS_EXT_ERR = 0x6, + NIX_SND_STATUS_JUMP_FAULT = 0x7, + NIX_SND_STATUS_JUMP_POISON = 0x8, + NIX_SND_STATUS_CRC_ERR = 0x9, + NIX_SND_STATUS_IMM_ERR = 0x10, + NIX_SND_STATUS_SG_ERR = 0x11, + NIX_SND_STATUS_MEM_ERR = 0x12, + NIX_SND_STATUS_INVALID_SUBDC = 0x13, + NIX_SND_STATUS_SUBDC_ORDER_ERR = 0x14, + NIX_SND_STATUS_DATA_FAULT = 0x15, + NIX_SND_STATUS_DATA_POISON = 0x16, + NIX_SND_STATUS_NPC_DROP_ACTION = 0x17, + NIX_SND_STATUS_LOCK_VIOL = 0x18, + NIX_SND_STATUS_NPC_UCAST_CHAN_ERR = 0x19, + NIX_SND_STATUS_NPC_MCAST_CHAN_ERR = 0x20, + NIX_SND_STATUS_NPC_MCAST_ABORT = 0x21, + NIX_SND_STATUS_NPC_VTAG_PTR_ERR = 0x22, + NIX_SND_STATUS_NPC_VTAG_SIZE_ERR = 0x23, + NIX_SND_STATUS_SEND_MEM_FAULT = 0x24, + NIX_SND_STATUS_SEND_STATS_ERR = 0x25, + NIX_SND_STATUS_MAX, +}; + #endif /* OTX2_STRUCT_H */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c @@ -435,6 +435,7 @@ struct otx2_cq_queue *cq, int budget) { int tx_pkts = 0, tx_bytes = 0, qidx; + struct otx2_snd_queue *sq; struct nix_cqe_tx_s *cqe; int processed_cqe = 0; @@ -445,6 +446,9 @@ return 0; process_cqe: + qidx = cq->cq_idx - pfvf->hw.rx_queues; + sq = &pfvf->qset.sq[qidx]; + while (likely(processed_cqe < budget) && cq->pend_cqe) { cqe = (struct nix_cqe_tx_s *)otx2_get_next_cqe(cq); if (unlikely(!cqe)) { @@ -452,18 +456,20 @@ return 0; break; } + if (cq->cq_type == CQ_XDP) { - qidx = cq->cq_idx - pfvf->hw.rx_queues; - otx2_xdp_snd_pkt_handler(pfvf, &pfvf->qset.sq[qidx], - cqe); + otx2_xdp_snd_pkt_handler(pfvf, sq, cqe); } else { - otx2_snd_pkt_handler(pfvf, cq, - &pfvf->qset.sq[cq->cint_idx], - cqe, budget, &tx_pkts, &tx_bytes); + otx2_snd_pkt_handler(pfvf, cq, sq, cqe, budget, + &tx_pkts, &tx_bytes); } + cqe->hdr.cqe_type = NIX_XQE_TYPE_INVALID; processed_cqe++; cq->pend_cqe--; + + sq->cons_head++; + sq->cons_head &= (sq->sqe_cnt - 1); } /* Free CQEs to HW */ @@ -972,17 +978,17 @@ { struct netdev_queue *txq = netdev_get_tx_queue(netdev, qidx); struct otx2_nic *pfvf = netdev_priv(netdev); - int offset, num_segs, free_sqe; + int offset, num_segs, free_desc; struct nix_sqe_hdr_s *sqe_hdr; - /* Check if there is room for new SQE. - * 'Num of SQBs freed to SQ's pool - SQ's Aura count' - * will give free SQE count. + /* Check if there is enough room between producer + * and consumer index. */ - free_sqe = (sq->num_sqbs - *sq->aura_fc_addr) * sq->sqe_per_sqb; + free_desc = (sq->cons_head - sq->head - 1 + sq->sqe_cnt) & (sq->sqe_cnt - 1); + if (free_desc < sq->sqe_thresh) + return false; - if (free_sqe < sq->sqe_thresh || - free_sqe < otx2_get_sqe_count(pfvf, skb)) + if (free_desc < otx2_get_sqe_count(pfvf, skb)) return false; num_segs = skb_shinfo(skb)->nr_frags + 1; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.h +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.h @@ -79,6 +79,7 @@ struct otx2_snd_queue { u8 aura_id; u16 head; + u16 cons_head; u16 sqe_size; u32 sqe_cnt; u16 num_sqbs; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/marvell/prestera/prestera_rxtx.c +++ linux-kvm-5.19.0/drivers/net/ethernet/marvell/prestera/prestera_rxtx.c @@ -776,6 +776,7 @@ int prestera_rxtx_switch_init(struct prestera_switch *sw) { struct prestera_rxtx *rxtx; + int err; rxtx = kzalloc(sizeof(*rxtx), GFP_KERNEL); if (!rxtx) @@ -783,7 +784,11 @@ sw->rxtx = rxtx; - return prestera_sdma_switch_init(sw); + err = prestera_sdma_switch_init(sw); + if (err) + kfree(rxtx); + + return err; } void prestera_rxtx_switch_fini(struct prestera_switch *sw) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mediatek/mtk_star_emac.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mediatek/mtk_star_emac.c @@ -976,6 +976,8 @@ return 0; err_free_irq: + napi_disable(&priv->rx_napi); + napi_disable(&priv->tx_napi); free_irq(ndev->irq, ndev); err_free_skbs: mtk_star_free_rx_skbs(priv); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx4/qp.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx4/qp.c @@ -697,7 +697,8 @@ err = mlx4_bitmap_init(*bitmap + k, 1, MLX4_QP_TABLE_RAW_ETH_SIZE - 1, 0, 0); - mlx4_bitmap_alloc_range(*bitmap + k, 1, 1, 0); + if (!err) + mlx4_bitmap_alloc_range(*bitmap + k, 1, 1, 0); } if (err) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx5/core/diag/cmd_tracepoint.h +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/diag/cmd_tracepoint.h @@ -0,0 +1,45 @@ +/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ +/* Copyright (c) 2022, NVIDIA CORPORATION & AFFILIATES. All rights reserved. */ + +#undef TRACE_SYSTEM +#define TRACE_SYSTEM mlx5 + +#if !defined(_MLX5_CMD_TP_H_) || defined(TRACE_HEADER_MULTI_READ) +#define _MLX5_CMD_TP_H_ + +#include +#include + +TRACE_EVENT(mlx5_cmd, + TP_PROTO(const char *command_str, u16 opcode, u16 op_mod, + const char *status_str, u8 status, u32 syndrome, int err), + TP_ARGS(command_str, opcode, op_mod, status_str, status, syndrome, err), + TP_STRUCT__entry(__string(command_str, command_str) + __field(u16, opcode) + __field(u16, op_mod) + __string(status_str, status_str) + __field(u8, status) + __field(u32, syndrome) + __field(int, err) + ), + TP_fast_assign(__assign_str(command_str, command_str); + __entry->opcode = opcode; + __entry->op_mod = op_mod; + __assign_str(status_str, status_str); + __entry->status = status; + __entry->syndrome = syndrome; + __entry->err = err; + ), + TP_printk("%s(0x%x) op_mod(0x%x) failed, status %s(0x%x), syndrome (0x%x), err(%d)", + __get_str(command_str), __entry->opcode, __entry->op_mod, + __get_str(status_str), __entry->status, __entry->syndrome, + __entry->err) +); + +#endif /* _MLX5_CMD_TP_H_ */ + +#undef TRACE_INCLUDE_PATH +#define TRACE_INCLUDE_PATH ./diag +#undef TRACE_INCLUDE_FILE +#define TRACE_INCLUDE_FILE cmd_tracepoint +#include only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c @@ -638,7 +638,7 @@ trace_timestamp = (timestamp_event.timestamp & MASK_52_7) | (str_frmt->timestamp & MASK_6_0); else - trace_timestamp = ((timestamp_event.timestamp & MASK_52_7) - 1) | + trace_timestamp = ((timestamp_event.timestamp - 1) & MASK_52_7) | (str_frmt->timestamp & MASK_6_0); mlx5_tracer_print_trace(str_frmt, dev, trace_timestamp); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c @@ -164,6 +164,36 @@ return err; } +static int +mlx5_esw_bridge_changeupper_validate_netdev(void *ptr) +{ + struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct netdev_notifier_changeupper_info *info = ptr; + struct net_device *upper = info->upper_dev; + struct net_device *lower; + struct list_head *iter; + + if (!netif_is_bridge_master(upper) || !netif_is_lag_master(dev)) + return 0; + + netdev_for_each_lower_dev(dev, lower, iter) { + struct mlx5_core_dev *mdev; + struct mlx5e_priv *priv; + + if (!mlx5e_eswitch_rep(lower)) + continue; + + priv = netdev_priv(lower); + mdev = priv->mdev; + if (!mlx5_lag_is_active(mdev)) + return -EAGAIN; + if (!mlx5_lag_is_shared_fdb(mdev)) + return -EOPNOTSUPP; + } + + return 0; +} + static int mlx5_esw_bridge_switchdev_port_event(struct notifier_block *nb, unsigned long event, void *ptr) { @@ -171,6 +201,7 @@ switch (event) { case NETDEV_PRECHANGEUPPER: + err = mlx5_esw_bridge_changeupper_validate_netdev(ptr); break; case NETDEV_CHANGEUPPER: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c @@ -224,15 +224,16 @@ list_for_each_entry(flow, flow_list, tmp_list) { if (!mlx5e_is_offloaded_flow(flow) || flow_flag_test(flow, SLOW)) continue; - spec = &flow->attr->parse_attr->spec; - - /* update from encap rule to slow path rule */ - rule = mlx5e_tc_offload_to_slow_path(esw, flow, spec); attr = mlx5e_tc_get_encap_attr(flow); esw_attr = attr->esw_attr; /* mark the flow's encap dest as non-valid */ esw_attr->dests[flow->tmp_entry_index].flags &= ~MLX5_ESW_DEST_ENCAP_VALID; + esw_attr->dests[flow->tmp_entry_index].pkt_reformat = NULL; + + /* update from encap rule to slow path rule */ + spec = &flow->attr->parse_attr->spec; + rule = mlx5e_tc_offload_to_slow_path(esw, flow, spec); if (IS_ERR(rule)) { err = PTR_ERR(rule); @@ -251,6 +252,7 @@ /* we know that the encap is valid */ e->flags &= ~MLX5_ENCAP_ENTRY_VALID; mlx5_packet_reformat_dealloc(priv->mdev, e->pkt_reformat); + e->pkt_reformat = NULL; } static void mlx5e_take_tmp_flow(struct mlx5e_tc_flow *flow, @@ -762,8 +764,7 @@ struct net_device *mirred_dev, int out_index, struct netlink_ext_ack *extack, - struct net_device **encap_dev, - bool *encap_valid) + struct net_device **encap_dev) { struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; struct mlx5e_tc_flow_parse_attr *parse_attr; @@ -878,9 +879,8 @@ if (e->flags & MLX5_ENCAP_ENTRY_VALID) { attr->esw_attr->dests[out_index].pkt_reformat = e->pkt_reformat; attr->esw_attr->dests[out_index].flags |= MLX5_ESW_DEST_ENCAP_VALID; - *encap_valid = true; } else { - *encap_valid = false; + flow_flag_set(flow, SLOW); } mutex_unlock(&esw->offloads.encap_tbl_lock); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.h +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.h @@ -17,8 +17,7 @@ struct net_device *mirred_dev, int out_index, struct netlink_ext_ack *extack, - struct net_device **encap_dev, - bool *encap_valid); + struct net_device **encap_dev); int mlx5e_attach_decap(struct mlx5e_priv *priv, struct mlx5e_tc_flow *flow, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c @@ -30,9 +30,9 @@ sizeof(dest->vport.num), hash); hash = jhash((const void *)&dest->vport.vhca_id, sizeof(dest->vport.num), hash); - if (dest->vport.pkt_reformat) - hash = jhash(dest->vport.pkt_reformat, - sizeof(*dest->vport.pkt_reformat), + if (flow_act->pkt_reformat) + hash = jhash(flow_act->pkt_reformat, + sizeof(*flow_act->pkt_reformat), hash); return hash; } @@ -53,9 +53,11 @@ if (ret) return ret; - return dest1->vport.pkt_reformat && dest2->vport.pkt_reformat ? - memcmp(dest1->vport.pkt_reformat, dest2->vport.pkt_reformat, - sizeof(*dest1->vport.pkt_reformat)) : 0; + if (flow_act1->pkt_reformat && flow_act2->pkt_reformat) + return memcmp(flow_act1->pkt_reformat, flow_act2->pkt_reformat, + sizeof(*flow_act1->pkt_reformat)); + + return !(flow_act1->pkt_reformat == flow_act2->pkt_reformat); } static int @@ -310,6 +312,8 @@ for (curr_dest = 0; curr_dest < num_vport_dests; curr_dest++) { struct mlx5_termtbl_handle *tt = attr->dests[curr_dest].termtbl; + attr->dests[curr_dest].termtbl = NULL; + /* search for the destination associated with the * current term table */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c @@ -18,6 +18,10 @@ phys_addr_t base_address; u64 sf_bar_length; struct notifier_block nb; + struct mutex table_lock; /* Serializes sf life cycle and vhca state change handler */ + struct workqueue_struct *active_wq; + struct work_struct work; + u8 stop_active_wq:1; struct mlx5_core_dev *dev; }; @@ -168,6 +172,7 @@ return 0; sf_index = event->function_id - base_id; + mutex_lock(&table->table_lock); sf_dev = xa_load(&table->devices, sf_index); switch (event->new_vhca_state) { case MLX5_VHCA_STATE_INVALID: @@ -191,6 +196,7 @@ default: break; } + mutex_unlock(&table->table_lock); return 0; } @@ -215,6 +221,78 @@ return 0; } +static void mlx5_sf_dev_add_active_work(struct work_struct *work) +{ + struct mlx5_sf_dev_table *table = container_of(work, struct mlx5_sf_dev_table, work); + u32 out[MLX5_ST_SZ_DW(query_vhca_state_out)] = {}; + struct mlx5_core_dev *dev = table->dev; + u16 max_functions; + u16 function_id; + u16 sw_func_id; + int err = 0; + u8 state; + int i; + + max_functions = mlx5_sf_max_functions(dev); + function_id = MLX5_CAP_GEN(dev, sf_base_id); + for (i = 0; i < max_functions; i++, function_id++) { + if (table->stop_active_wq) + return; + err = mlx5_cmd_query_vhca_state(dev, function_id, out, sizeof(out)); + if (err) + /* A failure of specific vhca doesn't mean others will + * fail as well. + */ + continue; + state = MLX5_GET(query_vhca_state_out, out, vhca_state_context.vhca_state); + if (state != MLX5_VHCA_STATE_ACTIVE) + continue; + + sw_func_id = MLX5_GET(query_vhca_state_out, out, vhca_state_context.sw_function_id); + mutex_lock(&table->table_lock); + /* Don't probe device which is already probe */ + if (!xa_load(&table->devices, i)) + mlx5_sf_dev_add(dev, i, function_id, sw_func_id); + /* There is a race where SF got inactive after the query + * above. e.g.: the query returns that the state of the + * SF is active, and after that the eswitch manager set it to + * inactive. + * This case cannot be managed in SW, since the probing of the + * SF is on one system, and the inactivation is on a different + * system. + * If the inactive is done after the SF perform init_hca(), + * the SF will fully probe and then removed. If it was + * done before init_hca(), the SF probe will fail. + */ + mutex_unlock(&table->table_lock); + } +} + +/* In case SFs are generated externally, probe active SFs */ +static int mlx5_sf_dev_queue_active_work(struct mlx5_sf_dev_table *table) +{ + if (MLX5_CAP_GEN(table->dev, eswitch_manager)) + return 0; /* the table is local */ + + /* Use a workqueue to probe active SFs, which are in large + * quantity and may take up to minutes to probe. + */ + table->active_wq = create_singlethread_workqueue("mlx5_active_sf"); + if (!table->active_wq) + return -ENOMEM; + INIT_WORK(&table->work, &mlx5_sf_dev_add_active_work); + queue_work(table->active_wq, &table->work); + return 0; +} + +static void mlx5_sf_dev_destroy_active_work(struct mlx5_sf_dev_table *table) +{ + if (table->active_wq) { + table->stop_active_wq = true; + destroy_workqueue(table->active_wq); + } +} + void mlx5_sf_dev_table_create(struct mlx5_core_dev *dev) { struct mlx5_sf_dev_table *table; @@ -240,11 +318,17 @@ table->base_address = pci_resource_start(dev->pdev, 2); table->max_sfs = max_sfs; xa_init(&table->devices); + mutex_init(&table->table_lock); dev->priv.sf_dev_table = table; err = mlx5_vhca_event_notifier_register(dev, &table->nb); if (err) goto vhca_err; + + err = mlx5_sf_dev_queue_active_work(table); + if (err) + goto add_active_err; + err = mlx5_sf_dev_vhca_arm_all(table); if (err) goto arm_err; @@ -252,6 +336,8 @@ return; arm_err: + mlx5_sf_dev_destroy_active_work(table); +add_active_err: mlx5_vhca_event_notifier_unregister(dev, &table->nb); vhca_err: table->max_sfs = 0; @@ -279,7 +365,9 @@ if (!table) return; + mlx5_sf_dev_destroy_active_work(table); mlx5_vhca_event_notifier_unregister(dev, &table->nb); + mutex_destroy(&table->table_lock); /* Now that event handler is not running, it is safe to destroy * the sf device without race. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_table.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_table.c @@ -46,7 +46,7 @@ int mlx5dr_table_set_miss_action(struct mlx5dr_table *tbl, struct mlx5dr_action *action) { - int ret; + int ret = -EOPNOTSUPP; if (action && action->action_type != DR_ACTION_TYP_FT) return -EOPNOTSUPP; @@ -67,6 +67,9 @@ goto out; } + if (ret) + goto out; + /* Release old action */ if (tbl->miss_action) refcount_dec(&tbl->miss_action->refcount); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +++ linux-kvm-5.19.0/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c @@ -3198,6 +3198,8 @@ u16 vid; vxlan_fdb_info = &switchdev_work->vxlan_fdb_info; + if (!vxlan_fdb_info->offloaded) + return; bridge_device = mlxsw_sp_bridge_device_find(mlxsw_sp->bridge, br_dev); if (!bridge_device) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c +++ linux-kvm-5.19.0/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c @@ -1253,6 +1253,9 @@ snprintf(queue_name, sizeof(queue_name), "%s-stats", dev_name(sparx5->dev)); sparx5->stats_queue = create_singlethread_workqueue(queue_name); + if (!sparx5->stats_queue) + return -ENOMEM; + INIT_DELAYED_WORK(&sparx5->stats_work, sparx5_check_stats_work); queue_delayed_work(sparx5->stats_queue, &sparx5->stats_work, SPX5_STATS_CHECK_DELAY); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/microchip/sparx5/sparx5_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/microchip/sparx5/sparx5_main.c @@ -657,6 +657,9 @@ snprintf(queue_name, sizeof(queue_name), "%s-mact", dev_name(sparx5->dev)); sparx5->mact_queue = create_singlethread_workqueue(queue_name); + if (!sparx5->mact_queue) + return -ENOMEM; + INIT_DELAYED_WORK(&sparx5->mact_work, sparx5_mact_pull_work); queue_delayed_work(sparx5->mact_queue, &sparx5->mact_work, SPX5_MACT_PULL_DELAY); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c +++ linux-kvm-5.19.0/drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c @@ -103,7 +103,7 @@ err = phylink_of_phy_connect(port->phylink, port->of_node, 0); if (err) { netdev_err(ndev, "Could not attach to PHY\n"); - return err; + goto err_connect; } phylink_start(port->phylink); @@ -115,10 +115,20 @@ err = sparx5_serdes_set(port->sparx5, port, &port->conf); else err = phy_power_on(port->serdes); - if (err) + if (err) { netdev_err(ndev, "%s failed\n", __func__); + goto out_power; + } } + return 0; + +out_power: + phylink_stop(port->phylink); + phylink_disconnect_phy(port->phylink); +err_connect: + sparx5_port_enable(port, false); + return err; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/neterion/s2io.c +++ linux-kvm-5.19.0/drivers/net/ethernet/neterion/s2io.c @@ -7128,9 +7128,8 @@ if (ret) { DBG_PRINT(ERR_DBG, "%s: Out of memory in Open\n", dev->name); - s2io_reset(sp); - free_rx_buffers(sp); - return -ENOMEM; + ret = -ENOMEM; + goto err_fill_buff; } DBG_PRINT(INFO_DBG, "Buf in ring:%d is %d:\n", i, ring->rx_bufs_left); @@ -7168,18 +7167,16 @@ /* Enable Rx Traffic and interrupts on the NIC */ if (start_nic(sp)) { DBG_PRINT(ERR_DBG, "%s: Starting NIC failed\n", dev->name); - s2io_reset(sp); - free_rx_buffers(sp); - return -ENODEV; + ret = -ENODEV; + goto err_out; } /* Add interrupt service routine */ if (s2io_add_isr(sp) != 0) { if (sp->config.intr_type == MSI_X) s2io_rem_isr(sp); - s2io_reset(sp); - free_rx_buffers(sp); - return -ENODEV; + ret = -ENODEV; + goto err_out; } timer_setup(&sp->alarm_timer, s2io_alarm_handle, 0); @@ -7199,6 +7196,20 @@ } return 0; + +err_out: + if (config->napi) { + if (config->intr_type == MSI_X) { + for (i = 0; i < sp->config.rx_ring_num; i++) + napi_disable(&sp->mac_control.rings[i].napi); + } else { + napi_disable(&sp->napi); + } + } +err_fill_buff: + s2io_reset(sp); + free_rx_buffers(sp); + return ret; } /** only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/netronome/nfp/nfp_devlink.c +++ linux-kvm-5.19.0/drivers/net/ethernet/netronome/nfp/nfp_devlink.c @@ -341,7 +341,7 @@ return ret; attrs.split = eth_port.is_split; - attrs.splittable = !attrs.split; + attrs.splittable = eth_port.port_lanes > 1 && !attrs.split; attrs.lanes = eth_port.port_lanes; attrs.flavour = DEVLINK_PORT_FLAVOUR_PHYSICAL; attrs.phys.port_number = eth_port.label_port; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c +++ linux-kvm-5.19.0/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c @@ -874,7 +874,6 @@ } /* Adjust the start address to be cache size aligned */ - cache->id = id; cache->addr = addr & ~(u64)(cache->size - 1); /* Re-init to the new ID and address */ @@ -894,6 +893,8 @@ return NULL; } + cache->id = id; + exit: /* Adjust offset */ *offset = addr - cache->addr; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/ni/nixge.c +++ linux-kvm-5.19.0/drivers/net/ethernet/ni/nixge.c @@ -249,25 +249,26 @@ struct sk_buff *skb; int i; - for (i = 0; i < RX_BD_NUM; i++) { - phys_addr = nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], - phys); - - dma_unmap_single(ndev->dev.parent, phys_addr, - NIXGE_MAX_JUMBO_FRAME_SIZE, - DMA_FROM_DEVICE); - - skb = (struct sk_buff *)(uintptr_t) - nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], - sw_id_offset); - dev_kfree_skb(skb); - } + if (priv->rx_bd_v) { + for (i = 0; i < RX_BD_NUM; i++) { + phys_addr = nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], + phys); + + dma_unmap_single(ndev->dev.parent, phys_addr, + NIXGE_MAX_JUMBO_FRAME_SIZE, + DMA_FROM_DEVICE); + + skb = (struct sk_buff *)(uintptr_t) + nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], + sw_id_offset); + dev_kfree_skb(skb); + } - if (priv->rx_bd_v) dma_free_coherent(ndev->dev.parent, sizeof(*priv->rx_bd_v) * RX_BD_NUM, priv->rx_bd_v, priv->rx_bd_p); + } if (priv->tx_skb) devm_kfree(ndev->dev.parent, priv->tx_skb); @@ -900,6 +901,7 @@ err_rx_irq: free_irq(priv->tx_irq, ndev); err_tx_irq: + napi_disable(&priv->napi); phy_stop(phy); phy_disconnect(phy); tasklet_kill(&priv->dma_err_tasklet); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +++ linux-kvm-5.19.0/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c @@ -1143,6 +1143,7 @@ buffer_info->dma = 0; buffer_info->time_stamp = 0; tx_ring->next_to_use = ring_num; + dev_kfree_skb_any(skb); return; } buffer_info->mapped = true; @@ -2459,6 +2460,7 @@ unregister_netdev(netdev); pch_gbe_phy_hw_reset(&adapter->hw); + pci_dev_put(adapter->ptp_pdev); free_netdev(netdev); } @@ -2534,7 +2536,7 @@ /* setup the private structure */ ret = pch_gbe_sw_init(adapter); if (ret) - goto err_free_netdev; + goto err_put_dev; /* Initialize PHY */ ret = pch_gbe_init_phy(adapter); @@ -2592,6 +2594,8 @@ err_free_adapter: pch_gbe_phy_hw_reset(&adapter->hw); +err_put_dev: + pci_dev_put(adapter->ptp_pdev); err_free_netdev: free_netdev(netdev); return ret; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/qlogic/qla3xxx.c +++ linux-kvm-5.19.0/drivers/net/ethernet/qlogic/qla3xxx.c @@ -2471,6 +2471,7 @@ skb_shinfo(skb)->nr_frags); if (tx_cb->seg_count == -1) { netdev_err(ndev, "%s: invalid segment count!\n", __func__); + dev_kfree_skb_any(skb); return NETDEV_TX_OK; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +++ linux-kvm-5.19.0/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c @@ -2991,7 +2991,7 @@ QLCWRX(adapter->ahw, QLC_83XX_RECOVER_DRV_LOCK, val); dev_info(&adapter->pdev->dev, "%s: lock recovery initiated\n", __func__); - msleep(QLC_83XX_DRV_LOCK_RECOVERY_DELAY); + mdelay(QLC_83XX_DRV_LOCK_RECOVERY_DELAY); val = QLCRDX(adapter->ahw, QLC_83XX_RECOVER_DRV_LOCK); id = ((val >> 2) & 0xF); if (id == adapter->portnum) { @@ -3027,7 +3027,7 @@ if (status) break; - msleep(QLC_83XX_DRV_LOCK_WAIT_DELAY); + mdelay(QLC_83XX_DRV_LOCK_WAIT_DELAY); i++; if (i == 1) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/sfc/ef100_netdev.c +++ linux-kvm-5.19.0/drivers/net/ethernet/sfc/ef100_netdev.c @@ -200,6 +200,7 @@ skb->len, skb->data_len, channel->channel); if (!efx->n_channels || !efx->n_tx_channels || !channel) { netif_stop_queue(net_dev); + dev_kfree_skb_any(skb); goto err; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +++ linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c @@ -272,11 +272,9 @@ if (ret) return ret; - devm_add_action_or_reset(dwmac->dev, - (void(*)(void *))clk_disable_unprepare, - dwmac->rgmii_tx_clk); - - return 0; + return devm_add_action_or_reset(dwmac->dev, + (void(*)(void *))clk_disable_unprepare, + clk); } static int meson8b_init_rgmii_delays(struct meson8b_dwmac *dwmac) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +++ linux-kvm-5.19.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c @@ -749,6 +749,8 @@ if (fc & FLOW_RX) { pr_debug("\tReceive Flow-Control ON\n"); flow |= GMAC_RX_FLOW_CTRL_RFE; + } else { + pr_debug("\tReceive Flow-Control OFF\n"); } writel(flow, ioaddr + GMAC_RX_FLOW_CTRL); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/ti/am65-cpsw-nuss.c +++ linux-kvm-5.19.0/drivers/net/ethernet/ti/am65-cpsw-nuss.c @@ -2061,7 +2061,7 @@ for (i = 0; i < common->port_num; i++) { port = &common->ports[i]; - if (port->ndev) + if (port->ndev && port->ndev->reg_state == NETREG_REGISTERED) unregister_netdev(port->ndev); } } @@ -2791,7 +2791,6 @@ if (ret < 0) return ret; - am65_cpsw_nuss_phylink_cleanup(common); am65_cpsw_unregister_devlink(common); am65_cpsw_unregister_notifiers(common); @@ -2799,6 +2798,7 @@ * dma_deconfigure(dev) before devres_release_all(dev) */ am65_cpsw_nuss_cleanup_ndev(common); + am65_cpsw_nuss_phylink_cleanup(common); of_platform_device_destroy(common->mdio_dev, NULL); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/ti/cpsw.c +++ linux-kvm-5.19.0/drivers/net/ethernet/ti/cpsw.c @@ -854,6 +854,8 @@ err_cleanup: if (!cpsw->usage_count) { + napi_disable(&cpsw->napi_rx); + napi_disable(&cpsw->napi_tx); cpdma_ctlr_stop(cpsw->dma); cpsw_destroy_xdp_rxqs(cpsw); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ethernet/tundra/tsi108_eth.c +++ linux-kvm-5.19.0/drivers/net/ethernet/tundra/tsi108_eth.c @@ -1303,12 +1303,15 @@ data->rxring = dma_alloc_coherent(&data->pdev->dev, rxring_size, &data->rxdma, GFP_KERNEL); - if (!data->rxring) + if (!data->rxring) { + free_irq(data->irq_num, dev); return -ENOMEM; + } data->txring = dma_alloc_coherent(&data->pdev->dev, txring_size, &data->txdma, GFP_KERNEL); if (!data->txring) { + free_irq(data->irq_num, dev); dma_free_coherent(&data->pdev->dev, rxring_size, data->rxring, data->rxdma); return -ENOMEM; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/hamradio/bpqether.c +++ linux-kvm-5.19.0/drivers/net/hamradio/bpqether.c @@ -533,7 +533,7 @@ if (!net_eq(dev_net(dev), &init_net)) return NOTIFY_DONE; - if (!dev_is_ethdev(dev)) + if (!dev_is_ethdev(dev) && !bpq_get_ax25_dev(dev)) return NOTIFY_DONE; switch (event) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/macvlan.c +++ linux-kvm-5.19.0/drivers/net/macvlan.c @@ -141,7 +141,7 @@ u32 idx = macvlan_eth_hash(addr); struct hlist_head *h = &vlan->port->vlan_source_hash[idx]; - hlist_for_each_entry_rcu(entry, h, hlist) { + hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { if (ether_addr_equal_64bits(entry->addr, addr) && entry->vlan == vlan) return entry; @@ -1192,7 +1192,7 @@ { ether_setup(dev); - dev->min_mtu = 0; + /* ether_setup() has set dev->min_mtu to ETH_MIN_MTU. */ dev->max_mtu = ETH_MAX_MTU; dev->priv_flags &= ~IFF_TX_SKB_SHARING; netif_keep_dst(dev); @@ -1533,8 +1533,10 @@ /* the macvlan port may be freed by macvlan_uninit when fail to register. * so we destroy the macvlan port only when it's valid. */ - if (create && macvlan_port_get_rtnl(lowerdev)) + if (create && macvlan_port_get_rtnl(lowerdev)) { + macvlan_flush_sources(port, vlan); macvlan_port_destroy(port->dev); + } return err; } EXPORT_SYMBOL_GPL(macvlan_common_newlink); @@ -1645,7 +1647,7 @@ struct hlist_head *h = &vlan->port->vlan_source_hash[i]; struct macvlan_source_entry *entry; - hlist_for_each_entry_rcu(entry, h, hlist) { + hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { if (entry->vlan != vlan) continue; if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr)) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/mctp/mctp-i2c.c +++ linux-kvm-5.19.0/drivers/net/mctp/mctp-i2c.c @@ -43,6 +43,7 @@ enum { MCTP_I2C_FLOW_STATE_NEW = 0, MCTP_I2C_FLOW_STATE_ACTIVE, + MCTP_I2C_FLOW_STATE_INVALID, }; /* List of all struct mctp_i2c_client @@ -374,12 +375,18 @@ */ if (!key->valid) { state = MCTP_I2C_TX_FLOW_INVALID; - - } else if (key->dev_flow_state == MCTP_I2C_FLOW_STATE_NEW) { - key->dev_flow_state = MCTP_I2C_FLOW_STATE_ACTIVE; - state = MCTP_I2C_TX_FLOW_NEW; } else { - state = MCTP_I2C_TX_FLOW_EXISTING; + switch (key->dev_flow_state) { + case MCTP_I2C_FLOW_STATE_NEW: + key->dev_flow_state = MCTP_I2C_FLOW_STATE_ACTIVE; + state = MCTP_I2C_TX_FLOW_NEW; + break; + case MCTP_I2C_FLOW_STATE_ACTIVE: + state = MCTP_I2C_TX_FLOW_EXISTING; + break; + default: + state = MCTP_I2C_TX_FLOW_INVALID; + } } spin_unlock_irqrestore(&key->lock, flags); @@ -617,21 +624,31 @@ { struct mctp_i2c_dev *midev = netdev_priv(mdev->dev); + bool queue_release = false; unsigned long flags; spin_lock_irqsave(&midev->lock, flags); - midev->release_count++; - spin_unlock_irqrestore(&midev->lock, flags); - - /* Ensure we have a release operation queued, through the fake - * marker skb + /* if we have seen the flow/key previously, we need to pair the + * original lock with a release */ - spin_lock(&midev->tx_queue.lock); - if (!midev->unlock_marker.next) - __skb_queue_tail(&midev->tx_queue, &midev->unlock_marker); - spin_unlock(&midev->tx_queue.lock); + if (key->dev_flow_state == MCTP_I2C_FLOW_STATE_ACTIVE) { + midev->release_count++; + queue_release = true; + } + key->dev_flow_state = MCTP_I2C_FLOW_STATE_INVALID; + spin_unlock_irqrestore(&midev->lock, flags); - wake_up(&midev->tx_wq); + if (queue_release) { + /* Ensure we have a release operation queued, through the fake + * marker skb + */ + spin_lock(&midev->tx_queue.lock); + if (!midev->unlock_marker.next) + __skb_queue_tail(&midev->tx_queue, + &midev->unlock_marker); + spin_unlock(&midev->tx_queue.lock); + wake_up(&midev->tx_wq); + } } static const struct net_device_ops mctp_i2c_ops = { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/mdio/fwnode_mdio.c +++ linux-kvm-5.19.0/drivers/net/mdio/fwnode_mdio.c @@ -120,7 +120,7 @@ /* Associate the fwnode with the device structure so it * can be looked up later. */ - phy->mdio.dev.fwnode = child; + phy->mdio.dev.fwnode = fwnode_handle_get(child); /* All data is now stored in the phy struct, so register it */ rc = phy_device_register(phy); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/mhi_net.c +++ linux-kvm-5.19.0/drivers/net/mhi_net.c @@ -343,6 +343,8 @@ kfree_skb(mhi_netdev->skbagg_head); + free_netdev(ndev); + dev_set_drvdata(&mhi_dev->dev, NULL); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/ntb_netdev.c +++ linux-kvm-5.19.0/drivers/net/ntb_netdev.c @@ -484,7 +484,14 @@ rc = ntb_transport_register_client_dev(KBUILD_MODNAME); if (rc) return rc; - return ntb_transport_register_client(&ntb_netdev_client); + + rc = ntb_transport_register_client(&ntb_netdev_client); + if (rc) { + ntb_transport_unregister_client_dev(KBUILD_MODNAME); + return rc; + } + + return 0; } module_init(ntb_netdev_init_module); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/phy/at803x.c +++ linux-kvm-5.19.0/drivers/net/phy/at803x.c @@ -862,8 +862,10 @@ .wolopts = 0, }; - if (ccr < 0) + if (ccr < 0) { + ret = ccr; goto err; + } mode_cfg = ccr & AT803X_MODE_CFG_MASK; switch (mode_cfg) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/phy/mscc/mscc_macsec.c +++ linux-kvm-5.19.0/drivers/net/phy/mscc/mscc_macsec.c @@ -632,6 +632,7 @@ list_del(&flow->list); clear_bit(flow->index, bitmap); + memzero_explicit(flow->key, sizeof(flow->key)); kfree(flow); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wan/lapbether.c +++ linux-kvm-5.19.0/drivers/net/wan/lapbether.c @@ -325,6 +325,7 @@ err = lapb_register(dev, &lapbeth_callbacks); if (err != LAPB_OK) { + napi_disable(&lapbeth->napi); pr_err("lapb_register error: %d\n", err); return -ENODEV; } @@ -446,7 +447,7 @@ if (dev_net(dev) != &init_net) return NOTIFY_DONE; - if (!dev_is_ethdev(dev)) + if (!dev_is_ethdev(dev) && !lapbeth_get_x25_dev(dev)) return NOTIFY_DONE; switch (event) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wireless/cisco/airo.c +++ linux-kvm-5.19.0/drivers/net/wireless/cisco/airo.c @@ -5232,7 +5232,7 @@ return -1; } -static int set_wep_key(struct airo_info *ai, u16 index, const char *key, +static int set_wep_key(struct airo_info *ai, u16 index, const u8 *key, u16 keylen, int perm, int lock) { static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 }; @@ -5283,7 +5283,7 @@ struct net_device *dev = pde_data(inode); struct airo_info *ai = dev->ml_priv; int i, rc; - char key[16]; + u8 key[16]; u16 index = 0; int j = 0; @@ -5311,12 +5311,22 @@ } for (i = 0; i < 16*3 && data->wbuffer[i+j]; i++) { + int val; + + if (i % 3 == 2) + continue; + + val = hex_to_bin(data->wbuffer[i+j]); + if (val < 0) { + airo_print_err(ai->dev->name, "WebKey passed invalid key hex"); + return; + } switch(i%3) { case 0: - key[i/3] = hex_to_bin(data->wbuffer[i+j])<<4; + key[i/3] = (u8)val << 4; break; case 1: - key[i/3] |= hex_to_bin(data->wbuffer[i+j]); + key[i/3] |= (u8)val; break; } } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wireless/microchip/wilc1000/hif.c +++ linux-kvm-5.19.0/drivers/net/wireless/microchip/wilc1000/hif.c @@ -472,14 +472,25 @@ rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len); if (rsn_ie) { + int rsn_ie_len = sizeof(struct element) + rsn_ie[1]; int offset = 8; - param->mode_802_11i = 2; - param->rsn_found = true; /* extract RSN capabilities */ - offset += (rsn_ie[offset] * 4) + 2; - offset += (rsn_ie[offset] * 4) + 2; - memcpy(param->rsn_cap, &rsn_ie[offset], 2); + if (offset < rsn_ie_len) { + /* skip over pairwise suites */ + offset += (rsn_ie[offset] * 4) + 2; + + if (offset < rsn_ie_len) { + /* skip over authentication suites */ + offset += (rsn_ie[offset] * 4) + 2; + + if (offset + 1 < rsn_ie_len) { + param->mode_802_11i = 2; + param->rsn_found = true; + memcpy(param->rsn_cap, &rsn_ie[offset], 2); + } + } + } } if (param->rsn_found) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wwan/iosm/iosm_ipc_coredump.c +++ linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_coredump.c @@ -2,6 +2,7 @@ /* * Copyright (C) 2020-2021 Intel Corporation. */ +#include #include "iosm_ipc_coredump.h" only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wwan/iosm/iosm_ipc_devlink.c +++ linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_devlink.c @@ -2,6 +2,7 @@ /* * Copyright (C) 2020-2021 Intel Corporation. */ +#include #include "iosm_ipc_chnl_cfg.h" #include "iosm_ipc_coredump.h" only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wwan/iosm/iosm_ipc_imem_ops.c +++ linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_imem_ops.c @@ -91,6 +91,14 @@ } ipc_chnl_cfg_get(&chnl_cfg, ipc_imem->nr_of_channels); + + if (ipc_imem->mmio->mux_protocol == MUX_AGGREGATION && + ipc_imem->nr_of_channels == IPC_MEM_IP_CHL_ID_0) { + chnl_cfg.ul_nr_of_entries = IPC_MEM_MAX_TDS_MUX_AGGR_UL; + chnl_cfg.dl_nr_of_entries = IPC_MEM_MAX_TDS_MUX_AGGR_DL; + chnl_cfg.dl_buf_size = IPC_MEM_MAX_ADB_BUF_SIZE; + } + ipc_imem_channel_init(ipc_imem, IPC_CTYPE_WWAN, chnl_cfg, IRQ_MOD_OFF); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wwan/iosm/iosm_ipc_mux.h +++ linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_mux.h @@ -10,6 +10,7 @@ #define IPC_MEM_MAX_UL_DG_ENTRIES 100 #define IPC_MEM_MAX_TDS_MUX_AGGR_UL 60 +#define IPC_MEM_MAX_TDS_MUX_AGGR_DL 60 #define IPC_MEM_MAX_ADB_BUF_SIZE (16 * 1024) #define IPC_MEM_MAX_UL_ADB_BUF_SIZE IPC_MEM_MAX_ADB_BUF_SIZE only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c +++ linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_mux_codec.c @@ -365,7 +365,8 @@ /* Pass the DL packet to the netif layer. */ static int ipc_mux_net_receive(struct iosm_mux *ipc_mux, int if_id, struct iosm_wwan *wwan, u32 offset, - u8 service_class, struct sk_buff *skb) + u8 service_class, struct sk_buff *skb, + u32 pkt_len) { struct sk_buff *dest_skb = skb_clone(skb, GFP_ATOMIC); @@ -373,7 +374,7 @@ return -ENOMEM; skb_pull(dest_skb, offset); - skb_set_tail_pointer(dest_skb, dest_skb->len); + skb_trim(dest_skb, pkt_len); /* Pass the packet to the netif layer. */ dest_skb->priority = service_class; @@ -429,7 +430,7 @@ static void ipc_mux_dl_adgh_decode(struct iosm_mux *ipc_mux, struct sk_buff *skb) { - u32 pad_len, packet_offset; + u32 pad_len, packet_offset, adgh_len; struct iosm_wwan *wwan; struct mux_adgh *adgh; u8 *block = skb->data; @@ -470,10 +471,12 @@ packet_offset = sizeof(*adgh) + pad_len; if_id += ipc_mux->wwan_q_offset; + adgh_len = le16_to_cpu(adgh->length); /* Pass the packet to the netif layer */ rc = ipc_mux_net_receive(ipc_mux, if_id, wwan, packet_offset, - adgh->service_class, skb); + adgh->service_class, skb, + adgh_len - packet_offset); if (rc) { dev_err(ipc_mux->dev, "mux adgh decoding error"); return; @@ -547,7 +550,7 @@ int if_id, int nr_of_dg) { u32 dl_head_pad_len = ipc_mux->session[if_id].dl_head_pad_len; - u32 packet_offset, i, rc; + u32 packet_offset, i, rc, dg_len; for (i = 0; i < nr_of_dg; i++, dg++) { if (le32_to_cpu(dg->datagram_index) @@ -562,11 +565,12 @@ packet_offset = le32_to_cpu(dg->datagram_index) + dl_head_pad_len; + dg_len = le16_to_cpu(dg->datagram_length); /* Pass the packet to the netif layer. */ rc = ipc_mux_net_receive(ipc_mux, if_id, ipc_mux->wwan, packet_offset, - dg->service_class, - skb); + dg->service_class, skb, + dg_len - dl_head_pad_len); if (rc) goto dg_error; } @@ -1207,10 +1211,9 @@ qlth_n_ql_size, ul_list); ipc_mux_ul_adb_finish(ipc_mux); if (ipc_mux_ul_adb_allocate(ipc_mux, adb, &ipc_mux->size_needed, - IOSM_AGGR_MUX_SIG_ADBH)) { - dev_kfree_skb(src_skb); + IOSM_AGGR_MUX_SIG_ADBH)) return -ENOMEM; - } + ipc_mux->size_needed = le32_to_cpu(adb->adbh->block_length); ipc_mux->size_needed += offsetof(struct mux_adth, dg); @@ -1471,8 +1474,7 @@ ipc_mux->ul_data_pend_bytes); /* Reset the skb settings. */ - skb->tail = 0; - skb->len = 0; + skb_trim(skb, 0); /* Add the consumed ADB to the free list. */ skb_queue_tail((&ipc_mux->ul_adb.free_list), skb); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wwan/iosm/iosm_ipc_protocol.h +++ linux-kvm-5.19.0/drivers/net/wwan/iosm/iosm_ipc_protocol.h @@ -122,7 +122,7 @@ struct iosm_imem *imem; struct ipc_rsp *rsp_ring[IPC_MEM_MSG_ENTRIES]; struct device *dev; - phys_addr_t phy_ap_shm; + dma_addr_t phy_ap_shm; u32 old_msg_tail; }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/net/wwan/mhi_wwan_mbim.c +++ linux-kvm-5.19.0/drivers/net/wwan/mhi_wwan_mbim.c @@ -582,6 +582,7 @@ ndev->min_mtu = ETH_MIN_MTU; ndev->max_mtu = MHI_MAX_BUF_SZ - ndev->needed_headroom; ndev->tx_queue_len = 1000; + ndev->needs_free_netdev = true; } static const struct wwan_ops mhi_mbim_wwan_ops = { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/nfc/st-nci/se.c +++ linux-kvm-5.19.0/drivers/nfc/st-nci/se.c @@ -312,6 +312,8 @@ int r = 0; struct device *dev = &ndev->nfc_dev->dev; struct nfc_evt_transaction *transaction; + u32 aid_len; + u8 params_len; pr_debug("connectivity gate event: %x\n", event); @@ -325,26 +327,47 @@ * Description Tag Length * AID 81 5 to 16 * PARAMETERS 82 0 to 255 + * + * The key differences are aid storage length is variably sized + * in the packet, but fixed in nfc_evt_transaction, and that + * the aid_len is u8 in the packet, but u32 in the structure, + * and the tags in the packet are not included in + * nfc_evt_transaction. + * + * size(b): 1 1 5-16 1 1 0-255 + * offset: 0 1 2 aid_len + 2 aid_len + 3 aid_len + 4 + * mem name: aid_tag(M) aid_len aid params_tag(M) params_len params + * example: 0x81 5-16 X 0x82 0-255 X */ - if (skb->len < NFC_MIN_AID_LENGTH + 2 && - skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG) + if (skb->len < 2 || skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG) return -EPROTO; - transaction = devm_kzalloc(dev, skb->len - 2, GFP_KERNEL); - if (!transaction) - return -ENOMEM; + aid_len = skb->data[1]; - transaction->aid_len = skb->data[1]; - memcpy(transaction->aid, &skb->data[2], transaction->aid_len); + if (skb->len < aid_len + 4 || + aid_len > sizeof(transaction->aid)) + return -EPROTO; - /* Check next byte is PARAMETERS tag (82) */ - if (skb->data[transaction->aid_len + 2] != - NFC_EVT_TRANSACTION_PARAMS_TAG) + params_len = skb->data[aid_len + 3]; + + /* Verify PARAMETERS tag is (82), and final check that there is + * enough space in the packet to read everything. + */ + if (skb->data[aid_len + 2] != NFC_EVT_TRANSACTION_PARAMS_TAG || + skb->len < aid_len + 4 + params_len) return -EPROTO; - transaction->params_len = skb->data[transaction->aid_len + 3]; - memcpy(transaction->params, skb->data + - transaction->aid_len + 4, transaction->params_len); + transaction = devm_kzalloc(dev, sizeof(*transaction) + + params_len, GFP_KERNEL); + if (!transaction) + return -ENOMEM; + + transaction->aid_len = aid_len; + transaction->params_len = params_len; + + memcpy(transaction->aid, &skb->data[2], aid_len); + memcpy(transaction->params, &skb->data[aid_len + 4], + params_len); r = nfc_se_transaction(ndev->nfc_dev, host, transaction); break; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/nvme/target/configfs.c +++ linux-kvm-5.19.0/drivers/nvme/target/configfs.c @@ -1210,6 +1210,7 @@ const char *page, size_t count) { int pos = 0, len; + char *val; if (subsys->subsys_discovered) { pr_err("Can't set model number. %s is already assigned\n", @@ -1232,9 +1233,11 @@ return -EINVAL; } - subsys->model_number = kmemdup_nul(page, len, GFP_KERNEL); - if (!subsys->model_number) + val = kmemdup_nul(page, len, GFP_KERNEL); + if (!val) return -ENOMEM; + kfree(subsys->model_number); + subsys->model_number = val; return count; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/nvmem/rmem.c +++ linux-kvm-5.19.0/drivers/nvmem/rmem.c @@ -37,9 +37,9 @@ * but as of Dec 2020 this isn't possible on arm64. */ addr = memremap(priv->mem->base, available, MEMREMAP_WB); - if (IS_ERR(addr)) { + if (!addr) { dev_err(priv->dev, "Failed to remap memory region\n"); - return PTR_ERR(addr); + return -ENOMEM; } count = memory_read_from_buffer(val, bytes, &off, addr, available); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/of/property.c +++ linux-kvm-5.19.0/drivers/of/property.c @@ -993,8 +993,10 @@ nargs, index, &of_args); if (ret < 0) return ret; - if (!args) + if (!args) { + of_node_put(of_args.np); return 0; + } args->nargs = of_args.args_count; args->fwnode = of_fwnode_handle(of_args.np); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/parport/parport_pc.c +++ linux-kvm-5.19.0/drivers/parport/parport_pc.c @@ -468,7 +468,7 @@ const unsigned char *bufp = buf; size_t left = length; unsigned long expire = jiffies + port->physport->cad->timeout; - const int fifo = FIFO(port); + const unsigned long fifo = FIFO(port); int poll_for = 8; /* 80 usecs */ const struct parport_pc_private *priv = port->physport->private_data; const int fifo_depth = priv->fifo_depth; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/pci/controller/pci-hyperv.c +++ linux-kvm-5.19.0/drivers/pci/controller/pci-hyperv.c @@ -1614,7 +1614,7 @@ static u32 hv_compose_msi_req_v1( struct pci_create_interrupt *int_pkt, struct cpumask *affinity, - u32 slot, u8 vector, u8 vector_count) + u32 slot, u8 vector, u16 vector_count) { int_pkt->message_type.type = PCI_CREATE_INTERRUPT_MESSAGE; int_pkt->wslot.slot = slot; @@ -1642,7 +1642,7 @@ static u32 hv_compose_msi_req_v2( struct pci_create_interrupt2 *int_pkt, struct cpumask *affinity, - u32 slot, u8 vector, u8 vector_count) + u32 slot, u8 vector, u16 vector_count) { int cpu; @@ -1661,7 +1661,7 @@ static u32 hv_compose_msi_req_v3( struct pci_create_interrupt3 *int_pkt, struct cpumask *affinity, - u32 slot, u32 vector, u8 vector_count) + u32 slot, u32 vector, u16 vector_count) { int cpu; @@ -1701,7 +1701,12 @@ struct compose_comp_ctxt comp; struct tran_int_desc *int_desc; struct msi_desc *msi_desc; - u8 vector, vector_count; + /* + * vector_count should be u16: see hv_msi_desc, hv_msi_desc2 + * and hv_msi_desc3. vector must be u32: see hv_msi_desc3. + */ + u16 vector_count; + u32 vector; struct { struct pci_packet pci_pkt; union { @@ -1767,6 +1772,11 @@ vector_count = 1; } + /* + * hv_compose_msi_req_v1 and v2 are for x86 only, meaning 'vector' + * can't exceed u8. Cast 'vector' down to u8 for v1/v2 explicitly + * for better readability. + */ memset(&ctxt, 0, sizeof(ctxt)); init_completion(&comp.comp_pkt.host_event); ctxt.pci_pkt.completion_func = hv_pci_compose_compl; @@ -1777,7 +1787,7 @@ size = hv_compose_msi_req_v1(&ctxt.int_pkts.v1, dest, hpdev->desc.win_slot.slot, - vector, + (u8)vector, vector_count); break; @@ -1786,7 +1796,7 @@ size = hv_compose_msi_req_v2(&ctxt.int_pkts.v2, dest, hpdev->desc.win_slot.slot, - vector, + (u8)vector, vector_count); break; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/phy/ralink/phy-mt7621-pci.c +++ linux-kvm-5.19.0/drivers/phy/ralink/phy-mt7621-pci.c @@ -280,7 +280,8 @@ } static const struct soc_device_attribute mt7621_pci_quirks_match[] = { - { .soc_id = "mt7621", .revision = "E2" } + { .soc_id = "mt7621", .revision = "E2" }, + { /* sentinel */ } }; static const struct regmap_config mt7621_pci_phy_regmap_config = { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/pinctrl/devicetree.c +++ linux-kvm-5.19.0/drivers/pinctrl/devicetree.c @@ -220,6 +220,8 @@ for (state = 0; ; state++) { /* Retrieve the pinctrl-* property */ propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state); + if (!propname) + return -ENOMEM; prop = of_find_property(np, propname, &size); kfree(propname); if (!prop) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +++ linux-kvm-5.19.0/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c @@ -709,6 +709,9 @@ { int err, rsel_val; + if (!pullup && arg == MTK_DISABLE) + return 0; + if (hw->rsel_si_unit) { /* find pin rsel_index from pin_rsel array*/ err = mtk_hw_pin_rsel_lookup(hw, desc, pullup, arg, &rsel_val); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/pinctrl/pinctrl-single.c +++ linux-kvm-5.19.0/drivers/pinctrl/pinctrl-single.c @@ -727,7 +727,7 @@ mux_bytes = pcs->width / BITS_PER_BYTE; - if (pcs->bits_per_mux) { + if (pcs->bits_per_mux && pcs->fmask) { pcs->bits_per_pin = fls(pcs->fmask); nr_pins = (pcs->size * BITS_PER_BYTE) / pcs->bits_per_pin; } else { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/pinctrl/qcom/pinctrl-sc8280xp.c +++ linux-kvm-5.19.0/drivers/pinctrl/qcom/pinctrl-sc8280xp.c @@ -1873,8 +1873,8 @@ [225] = PINGROUP(225, hs3_mi2s, phase_flag, _, _, _, _, egpio), [226] = PINGROUP(226, hs3_mi2s, phase_flag, _, _, _, _, egpio), [227] = PINGROUP(227, hs3_mi2s, phase_flag, _, _, _, _, egpio), - [228] = UFS_RESET(ufs_reset, 0xf1004), - [229] = UFS_RESET(ufs1_reset, 0xf3004), + [228] = UFS_RESET(ufs_reset, 0xf1000), + [229] = UFS_RESET(ufs1_reset, 0xf3000), [230] = SDC_QDSD_PINGROUP(sdc2_clk, 0xe8000, 14, 6), [231] = SDC_QDSD_PINGROUP(sdc2_cmd, 0xe8000, 11, 3), [232] = SDC_QDSD_PINGROUP(sdc2_data, 0xe8000, 9, 0), only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/platform/surface/aggregator/ssh_packet_layer.c +++ linux-kvm-5.19.0/drivers/platform/surface/aggregator/ssh_packet_layer.c @@ -1596,16 +1596,32 @@ ssh_ptl_tx_wakeup_packet(ptl); } -static bool ssh_ptl_rx_retransmit_check(struct ssh_ptl *ptl, u8 seq) +static bool ssh_ptl_rx_retransmit_check(struct ssh_ptl *ptl, const struct ssh_frame *frame) { int i; /* + * Ignore unsequenced packets. On some devices (notably Surface Pro 9), + * unsequenced events will always be sent with SEQ=0x00. Attempting to + * detect retransmission would thus just block all events. + * + * While sequence numbers would also allow detection of retransmitted + * packets in unsequenced communication, they have only ever been used + * to cover edge-cases in sequenced transmission. In particular, the + * only instance of packets being retransmitted (that we are aware of) + * is due to an ACK timeout. As this does not happen in unsequenced + * communication, skip the retransmission check for those packets + * entirely. + */ + if (frame->type == SSH_FRAME_TYPE_DATA_NSQ) + return false; + + /* * Check if SEQ has been seen recently (i.e. packet was * re-transmitted and we should ignore it). */ for (i = 0; i < ARRAY_SIZE(ptl->rx.blocked.seqs); i++) { - if (likely(ptl->rx.blocked.seqs[i] != seq)) + if (likely(ptl->rx.blocked.seqs[i] != frame->seq)) continue; ptl_dbg(ptl, "ptl: ignoring repeated data packet\n"); @@ -1613,7 +1629,7 @@ } /* Update list of blocked sequence IDs. */ - ptl->rx.blocked.seqs[ptl->rx.blocked.offset] = seq; + ptl->rx.blocked.seqs[ptl->rx.blocked.offset] = frame->seq; ptl->rx.blocked.offset = (ptl->rx.blocked.offset + 1) % ARRAY_SIZE(ptl->rx.blocked.seqs); @@ -1624,7 +1640,7 @@ const struct ssh_frame *frame, const struct ssam_span *payload) { - if (ssh_ptl_rx_retransmit_check(ptl, frame->seq)) + if (ssh_ptl_rx_retransmit_check(ptl, frame)) return; ptl->ops.data_received(ptl, payload); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/platform/x86/ideapad-laptop.c +++ linux-kvm-5.19.0/drivers/platform/x86/ideapad-laptop.c @@ -136,6 +136,7 @@ bool dytc : 1; bool fan_mode : 1; bool fn_lock : 1; + bool set_fn_lock_led : 1; bool hw_rfkill_switch : 1; bool kbd_bl : 1; bool touchpad_ctrl_via_ec : 1; @@ -154,7 +155,21 @@ static bool allow_v4_dytc; module_param(allow_v4_dytc, bool, 0444); -MODULE_PARM_DESC(allow_v4_dytc, "Enable DYTC version 4 platform-profile support."); +MODULE_PARM_DESC(allow_v4_dytc, + "Enable DYTC version 4 platform-profile support. " + "If you need this please report this to: platform-driver-x86@vger.kernel.org"); + +static bool hw_rfkill_switch; +module_param(hw_rfkill_switch, bool, 0444); +MODULE_PARM_DESC(hw_rfkill_switch, + "Enable rfkill support for laptops with a hw on/off wifi switch/slider. " + "If you need this please report this to: platform-driver-x86@vger.kernel.org"); + +static bool set_fn_lock_led; +module_param(set_fn_lock_led, bool, 0444); +MODULE_PARM_DESC(set_fn_lock_led, + "Enable driver based updates of the fn-lock LED on fn-lock changes. " + "If you need this please report this to: platform-driver-x86@vger.kernel.org"); /* * ACPI Helpers @@ -1501,6 +1516,9 @@ ideapad_input_report(priv, value); break; case 208: + if (!priv->features.set_fn_lock_led) + break; + if (!eval_hals(priv->adev->handle, &result)) { bool state = test_bit(HALS_FNLOCK_STATE_BIT, &result); @@ -1514,6 +1532,18 @@ } #endif +/* On some models we need to call exec_sals(SALS_FNLOCK_ON/OFF) to set the LED */ +static const struct dmi_system_id set_fn_lock_led_list[] = { + { + /* https://bugzilla.kernel.org/show_bug.cgi?id=212671 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Legion R7000P2020H"), + } + }, + {} +}; + /* * Some ideapads have a hardware rfkill switch, but most do not have one. * Reading VPCCMD_R_RF always results in 0 on models without a hardware rfkill, @@ -1533,15 +1563,41 @@ {} }; +static const struct dmi_system_id no_touchpad_switch_list[] = { + { + .ident = "Lenovo Yoga 3 Pro 1370", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3"), + }, + }, + { + .ident = "ZhaoYang K4e-IML", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_VERSION, "ZhaoYang K4e-IML"), + }, + }, + {} +}; + static void ideapad_check_features(struct ideapad_private *priv) { acpi_handle handle = priv->adev->handle; unsigned long val; - priv->features.hw_rfkill_switch = dmi_check_system(hw_rfkill_list); + priv->features.set_fn_lock_led = + set_fn_lock_led || dmi_check_system(set_fn_lock_led_list); + priv->features.hw_rfkill_switch = + hw_rfkill_switch || dmi_check_system(hw_rfkill_list); /* Most ideapads with ELAN0634 touchpad don't use EC touchpad switch */ - priv->features.touchpad_ctrl_via_ec = !acpi_dev_present("ELAN0634", NULL, -1); + if (acpi_dev_present("ELAN0634", NULL, -1)) + priv->features.touchpad_ctrl_via_ec = 0; + else if (dmi_check_system(no_touchpad_switch_list)) + priv->features.touchpad_ctrl_via_ec = 0; + else + priv->features.touchpad_ctrl_via_ec = 1; if (!read_ec_data(handle, VPCCMD_R_FAN, &val)) priv->features.fan_mode = true; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/platform/x86/intel/pmc/pltdrv.c +++ linux-kvm-5.19.0/drivers/platform/x86/intel/pmc/pltdrv.c @@ -18,6 +18,8 @@ #include #include +#include + static void intel_pmc_core_release(struct device *dev) { kfree(dev); @@ -53,6 +55,13 @@ if (acpi_dev_present("INT33A1", NULL, -1)) return -ENODEV; + /* + * Skip forcefully attaching the device for VMs. Make an exception for + * Xen dom0, which does have full hardware access. + */ + if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR) && !xen_initial_domain()) + return -ENODEV; + if (!x86_match_cpu(intel_pmc_core_platform_ids)) return -ENODEV; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/platform/x86/intel/pmt/class.c +++ linux-kvm-5.19.0/drivers/platform/x86/intel/pmt/class.c @@ -9,6 +9,7 @@ */ #include +#include #include #include #include @@ -19,6 +20,7 @@ #define PMT_XA_START 0 #define PMT_XA_MAX INT_MAX #define PMT_XA_LIMIT XA_LIMIT(PMT_XA_START, PMT_XA_MAX) +#define GUID_SPR_PUNIT 0x9956f43f /* * Early implementations of PMT on client platforms have some @@ -42,6 +44,29 @@ } EXPORT_SYMBOL_GPL(intel_pmt_is_early_client_hw); +static inline int +pmt_memcpy64_fromio(void *to, const u64 __iomem *from, size_t count) +{ + int i, remain; + u64 *buf = to; + + if (!IS_ALIGNED((unsigned long)from, 8)) + return -EFAULT; + + for (i = 0; i < count/8; i++) + buf[i] = readq(&from[i]); + + /* Copy any remaining bytes */ + remain = count % 8; + if (remain) { + u64 tmp = readq(&from[i]); + + memcpy(&buf[i], &tmp, remain); + } + + return count; +} + /* * sysfs */ @@ -63,7 +88,11 @@ if (count > entry->size - off) count = entry->size - off; - memcpy_fromio(buf, entry->base + off, count); + if (entry->guid == GUID_SPR_PUNIT) + /* PUNIT on SPR only supports aligned 64-bit read */ + count = pmt_memcpy64_fromio(buf, entry->base + off, count); + else + memcpy_fromio(buf, entry->base + off, count); return count; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/platform/x86/thinkpad_acpi.c +++ linux-kvm-5.19.0/drivers/platform/x86/thinkpad_acpi.c @@ -257,6 +257,8 @@ #define TPACPI_DBG_BRGHT 0x0020 #define TPACPI_DBG_MIXER 0x0040 +#define FAN_NOT_PRESENT 65535 + #define onoff(status, bit) ((status) & (1 << (bit)) ? "on" : "off") #define enabled(status, bit) ((status) & (1 << (bit)) ? "enabled" : "disabled") #define strlencmp(a, b) (strncmp((a), (b), strlen(b))) @@ -4495,6 +4497,14 @@ DMI_MATCH(DMI_PRODUCT_NAME, "21A0"), } }, + { + .ident = "P14s Gen2 AMD", + .driver_data = &quirk_s2idle_bug, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21A1"), + } + }, {} }; @@ -8884,7 +8894,7 @@ /* Try and probe the 2nd fan */ tp_features.second_fan = 1; /* needed for get_speed to work */ res = fan2_get_speed(&speed); - if (res >= 0) { + if (res >= 0 && speed != FAN_NOT_PRESENT) { /* It responded - so let's assume it's there */ tp_features.second_fan = 1; tp_features.second_fan_ctl = 1; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/platform/x86/touchscreen_dmi.c +++ linux-kvm-5.19.0/drivers/platform/x86/touchscreen_dmi.c @@ -770,6 +770,22 @@ .properties = predia_basic_props, }; +static const struct property_entry rca_cambio_w101_v2_props[] = { + PROPERTY_ENTRY_U32("touchscreen-min-x", 4), + PROPERTY_ENTRY_U32("touchscreen-min-y", 20), + PROPERTY_ENTRY_U32("touchscreen-size-x", 1644), + PROPERTY_ENTRY_U32("touchscreen-size-y", 874), + PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"), + PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-rca-cambio-w101-v2.fw"), + PROPERTY_ENTRY_U32("silead,max-fingers", 10), + { } +}; + +static const struct ts_dmi_data rca_cambio_w101_v2_data = { + .acpi_name = "MSSL1680:00", + .properties = rca_cambio_w101_v2_props, +}; + static const struct property_entry rwc_nanote_p8_props[] = { PROPERTY_ENTRY_U32("touchscreen-min-y", 46), PROPERTY_ENTRY_U32("touchscreen-size-x", 1728), @@ -1410,6 +1426,15 @@ }, }, { + /* RCA Cambio W101 v2 */ + /* https://github.com/onitake/gsl-firmware/discussions/193 */ + .driver_data = (void *)&rca_cambio_w101_v2_data, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "RCA"), + DMI_MATCH(DMI_PRODUCT_NAME, "W101SA23T1"), + }, + }, + { /* RWC NANOTE P8 */ .driver_data = (void *)&rwc_nanote_p8_data, .matches = { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/power/supply/ab8500_btemp.c +++ linux-kvm-5.19.0/drivers/power/supply/ab8500_btemp.c @@ -726,7 +726,14 @@ /* Get thermal zone and ADC */ di->tz = thermal_zone_get_zone_by_name("battery-thermal"); if (IS_ERR(di->tz)) { - return dev_err_probe(dev, PTR_ERR(di->tz), + ret = PTR_ERR(di->tz); + /* + * This usually just means we are probing before the thermal + * zone, so just defer. + */ + if (ret == -ENODEV) + ret = -EPROBE_DEFER; + return dev_err_probe(dev, ret, "failed to get battery thermal zone\n"); } di->bat_ctrl = devm_iio_channel_get(dev, "bat_ctrl"); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/power/supply/ip5xxx_power.c +++ linux-kvm-5.19.0/drivers/power/supply/ip5xxx_power.c @@ -352,7 +352,7 @@ ret = ip5xxx_battery_read_adc(ip5xxx, IP5XXX_BATIADC_DAT0, IP5XXX_BATIADC_DAT1, &raw); - val->intval = DIV_ROUND_CLOSEST(raw * 745985, 1000); + val->intval = DIV_ROUND_CLOSEST(raw * 149197, 200); return 0; case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/regulator/rt5759-regulator.c +++ linux-kvm-5.19.0/drivers/regulator/rt5759-regulator.c @@ -243,6 +243,7 @@ if (priv->chip_type == CHIP_TYPE_RT5759A) reg_desc->uV_step = RT5759A_STEP_UV; + memset(®_cfg, 0, sizeof(reg_cfg)); reg_cfg.dev = priv->dev; reg_cfg.of_node = np; reg_cfg.init_data = of_get_regulator_init_data(priv->dev, np, reg_desc); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/regulator/twl6030-regulator.c +++ linux-kvm-5.19.0/drivers/regulator/twl6030-regulator.c @@ -530,6 +530,7 @@ #define TWL6032_ADJUSTABLE_LDO(label, offset) \ static const struct twlreg_info TWL6032_INFO_##label = { \ .base = offset, \ + .features = TWL6032_SUBCLASS, \ .desc = { \ .name = #label, \ .id = TWL6032_REG_##label, \ @@ -562,6 +563,7 @@ #define TWL6032_ADJUSTABLE_SMPS(label, offset) \ static const struct twlreg_info TWLSMPS_INFO_##label = { \ .base = offset, \ + .features = TWL6032_SUBCLASS, \ .desc = { \ .name = #label, \ .id = TWL6032_REG_##label, \ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/s390/block/dasd_eckd.c +++ linux-kvm-5.19.0/drivers/s390/block/dasd_eckd.c @@ -4681,7 +4681,6 @@ struct dasd_device *basedev; struct req_iterator iter; struct dasd_ccw_req *cqr; - unsigned int first_offs; unsigned int trkcount; unsigned long *idaws; unsigned int size; @@ -4715,7 +4714,6 @@ last_trk = (blk_rq_pos(req) + blk_rq_sectors(req) - 1) / DASD_RAW_SECTORS_PER_TRACK; trkcount = last_trk - first_trk + 1; - first_offs = 0; if (rq_data_dir(req) == READ) cmd = DASD_ECKD_CCW_READ_TRACK; @@ -4759,13 +4757,13 @@ if (use_prefix) { prefix_LRE(ccw++, data, first_trk, last_trk, cmd, basedev, - startdev, 1, first_offs + 1, trkcount, 0, 0); + startdev, 1, 0, trkcount, 0, 0); } else { define_extent(ccw++, data, first_trk, last_trk, cmd, basedev, 0); ccw[-1].flags |= CCW_FLAG_CC; data += sizeof(struct DE_eckd_data); - locate_record_ext(ccw++, data, first_trk, first_offs + 1, + locate_record_ext(ccw++, data, first_trk, 0, trkcount, cmd, basedev, 0, 0); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/s390/block/dcssblk.c +++ linux-kvm-5.19.0/drivers/s390/block/dcssblk.c @@ -636,6 +636,7 @@ dev_info->gd->minors = DCSSBLK_MINORS_PER_DISK; dev_info->gd->fops = &dcssblk_devops; dev_info->gd->private_data = dev_info; + dev_info->gd->flags |= GENHD_FL_NO_PART; blk_queue_logical_block_size(dev_info->gd->queue, 4096); blk_queue_flag_set(QUEUE_FLAG_DAX, dev_info->gd->queue); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/s390/crypto/zcrypt_msgtype6.c +++ linux-kvm-5.19.0/drivers/s390/crypto/zcrypt_msgtype6.c @@ -342,7 +342,10 @@ }; struct { struct type6_hdr hdr; - struct CPRBX cprbx; + union { + struct CPRBX cprbx; + DECLARE_FLEX_ARRAY(u8, userdata); + }; } __packed * msg = ap_msg->msg; int rcblen = CEIL4(xcrb->request_control_blk_length); @@ -403,7 +406,8 @@ msg->hdr.fromcardlen2 = xcrb->reply_data_length; /* prepare CPRB */ - if (z_copy_from_user(userspace, &msg->cprbx, xcrb->request_control_blk_addr, + if (z_copy_from_user(userspace, msg->userdata, + xcrb->request_control_blk_addr, xcrb->request_control_blk_length)) return -EFAULT; if (msg->cprbx.cprb_len + sizeof(msg->hdr.function_code) > @@ -469,9 +473,14 @@ struct { struct type6_hdr hdr; - struct ep11_cprb cprbx; - unsigned char pld_tag; /* fixed value 0x30 */ - unsigned char pld_lenfmt; /* payload length format */ + union { + struct { + struct ep11_cprb cprbx; + unsigned char pld_tag; /* fixed value 0x30 */ + unsigned char pld_lenfmt; /* length format */ + } __packed; + DECLARE_FLEX_ARRAY(u8, userdata); + }; } __packed * msg = ap_msg->msg; struct pld_hdr { @@ -500,7 +509,7 @@ msg->hdr.fromcardlen1 = xcrb->resp_len; /* Import CPRB data from the ioctl input parameter */ - if (z_copy_from_user(userspace, &msg->cprbx.cprb_len, + if (z_copy_from_user(userspace, msg->userdata, (char __force __user *)xcrb->req, xcrb->req_len)) { return -EFAULT; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/scsi/ibmvscsi/ibmvfc.c +++ linux-kvm-5.19.0/drivers/scsi/ibmvscsi/ibmvfc.c @@ -708,8 +708,13 @@ memset(vhost->async_crq.msgs.async, 0, PAGE_SIZE); vhost->async_crq.cur = 0; - list_for_each_entry(tgt, &vhost->targets, queue) - ibmvfc_del_tgt(tgt); + list_for_each_entry(tgt, &vhost->targets, queue) { + if (vhost->client_migrated) + tgt->need_login = 1; + else + ibmvfc_del_tgt(tgt); + } + scsi_block_requests(vhost->host); ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_INIT); vhost->job_step = ibmvfc_npiv_login; @@ -3235,9 +3240,12 @@ /* We need to re-setup the interpartition connection */ dev_info(vhost->dev, "Partition migrated, Re-enabling adapter\n"); vhost->client_migrated = 1; + + scsi_block_requests(vhost->host); ibmvfc_purge_requests(vhost, DID_REQUEUE); - ibmvfc_link_down(vhost, IBMVFC_LINK_DOWN); + ibmvfc_set_host_state(vhost, IBMVFC_LINK_DOWN); ibmvfc_set_host_action(vhost, IBMVFC_HOST_ACTION_REENABLE); + wake_up(&vhost->work_wait_q); } else if (crq->format == IBMVFC_PARTNER_FAILED || crq->format == IBMVFC_PARTNER_DEREGISTER) { dev_err(vhost->dev, "Host partner adapter deregistered or failed (rc=%d)\n", crq->format); ibmvfc_purge_requests(vhost, DID_ERROR); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/scsi/mpi3mr/mpi3mr_os.c +++ linux-kvm-5.19.0/drivers/scsi/mpi3mr/mpi3mr_os.c @@ -2710,7 +2710,8 @@ } if (scmd->result != (DID_OK << 16) && (scmd->cmnd[0] != ATA_12) && - (scmd->cmnd[0] != ATA_16)) { + (scmd->cmnd[0] != ATA_16) && + mrioc->logging_level & MPI3_DEBUG_SCSI_ERROR) { ioc_info(mrioc, "%s :scmd->result 0x%x\n", __func__, scmd->result); scsi_print_command(scmd); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/scsi/scsi_debug.c +++ linux-kvm-5.19.0/drivers/scsi/scsi_debug.c @@ -1899,6 +1899,13 @@ arr[14] |= 0x40; } + /* + * Since the scsi_debug READ CAPACITY implementation always reports the + * total disk capacity, set RC BASIS = 1 for host-managed ZBC devices. + */ + if (devip->zmodel == BLK_ZONED_HM) + arr[12] |= 1 << 4; + arr[15] = sdebug_lowest_aligned & 0xff; if (have_dif_prot) { @@ -7316,8 +7323,12 @@ dev_set_name(&sdbg_host->dev, "adapter%d", sdebug_num_hosts); error = device_register(&sdbg_host->dev); - if (error) + if (error) { + spin_lock(&sdebug_host_list_lock); + list_del(&sdbg_host->host_list); + spin_unlock(&sdebug_host_list_lock); goto clean; + } ++sdebug_num_hosts; return 0; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/scsi/scsi_transport_sas.c +++ linux-kvm-5.19.0/drivers/scsi/scsi_transport_sas.c @@ -716,12 +716,17 @@ int error; error = device_add(&phy->dev); - if (!error) { - transport_add_device(&phy->dev); - transport_configure_device(&phy->dev); + if (error) + return error; + + error = transport_add_device(&phy->dev); + if (error) { + device_del(&phy->dev); + return error; } + transport_configure_device(&phy->dev); - return error; + return 0; } EXPORT_SYMBOL(sas_phy_add); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/siox/siox-core.c +++ linux-kvm-5.19.0/drivers/siox/siox-core.c @@ -839,6 +839,8 @@ err_device_register: /* don't care to make the buffer smaller again */ + put_device(&sdevice->dev); + sdevice = NULL; err_buf_alloc: siox_master_unlock(smaster); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/slimbus/stream.c +++ linux-kvm-5.19.0/drivers/slimbus/stream.c @@ -67,10 +67,10 @@ 384000, 768000, 0, /* Reserved */ - 110250, - 220500, - 441000, - 882000, + 11025, + 22050, + 44100, + 88200, 176400, 352800, 705600, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/soc/imx/soc-imx8m.c +++ linux-kvm-5.19.0/drivers/soc/imx/soc-imx8m.c @@ -11,6 +11,7 @@ #include #include #include +#include #define REV_B1 0x21 @@ -56,6 +57,7 @@ void __iomem *ocotp_base; u32 magic; u32 rev; + struct clk *clk; np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); if (!np) @@ -63,6 +65,13 @@ ocotp_base = of_iomap(np, 0); WARN_ON(!ocotp_base); + clk = of_clk_get_by_name(np, NULL); + if (!clk) { + WARN_ON(!clk); + return 0; + } + + clk_prepare_enable(clk); /* * SOC revision on older imx8mq is not available in fuses so query @@ -79,6 +88,8 @@ soc_uid <<= 32; soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); + clk_disable_unprepare(clk); + clk_put(clk); iounmap(ocotp_base); of_node_put(np); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/spi/spi-dw-dma.c +++ linux-kvm-5.19.0/drivers/spi/spi-dw-dma.c @@ -128,12 +128,15 @@ dw_spi_dma_sg_burst_init(dws); + pci_dev_put(dma_dev); + return 0; free_rxchan: dma_release_channel(dws->rxchan); dws->rxchan = NULL; err_exit: + pci_dev_put(dma_dev); return -EBUSY; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/spi/spi-imx.c +++ linux-kvm-5.19.0/drivers/spi/spi-imx.c @@ -444,8 +444,7 @@ unsigned int pre, post; unsigned int fin = spi_imx->spi_clk; - if (unlikely(fspi > fin)) - return 0; + fspi = min(fspi, fin); post = fls(fin) - fls(fspi); if (fin > fspi << post) @@ -1608,6 +1607,13 @@ return spi_imx_pio_transfer_slave(spi, transfer); /* + * If we decided in spi_imx_can_dma() that we want to do a DMA + * transfer, the SPI transfer has already been mapped, so we + * have to do the DMA transfer here. + */ + if (spi_imx->usedma) + return spi_imx_dma_transfer(spi_imx, transfer); + /* * Calculate the estimated time in us the transfer runs. Find * the number of Hz per byte per polling limit. */ @@ -1618,9 +1624,6 @@ if (transfer->len < byte_limit) return spi_imx_poll_transfer(spi, transfer); - if (spi_imx->usedma) - return spi_imx_dma_transfer(spi_imx, transfer); - return spi_imx_pio_transfer(spi, transfer); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/spi/spi-intel.c +++ linux-kvm-5.19.0/drivers/spi/spi-intel.c @@ -52,17 +52,17 @@ #define FRACC 0x50 #define FREG(n) (0x54 + ((n) * 4)) -#define FREG_BASE_MASK 0x3fff +#define FREG_BASE_MASK GENMASK(14, 0) #define FREG_LIMIT_SHIFT 16 -#define FREG_LIMIT_MASK (0x03fff << FREG_LIMIT_SHIFT) +#define FREG_LIMIT_MASK GENMASK(30, 16) /* Offset is from @ispi->pregs */ #define PR(n) ((n) * 4) #define PR_WPE BIT(31) #define PR_LIMIT_SHIFT 16 -#define PR_LIMIT_MASK (0x3fff << PR_LIMIT_SHIFT) +#define PR_LIMIT_MASK GENMASK(30, 16) #define PR_RPE BIT(15) -#define PR_BASE_MASK 0x3fff +#define PR_BASE_MASK GENMASK(14, 0) /* Offsets are from @ispi->sregs */ #define SSFSTS_CTL 0x00 @@ -114,7 +114,7 @@ #define ERASE_OPCODE_SHIFT 8 #define ERASE_OPCODE_MASK (0xff << ERASE_OPCODE_SHIFT) #define ERASE_64K_OPCODE_SHIFT 16 -#define ERASE_64K_OPCODE_MASK (0xff << ERASE_OPCODE_SHIFT) +#define ERASE_64K_OPCODE_MASK (0xff << ERASE_64K_OPCODE_SHIFT) #define INTEL_SPI_TIMEOUT 5000 /* ms */ #define INTEL_SPI_FIFO_SZ 64 only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/spi/spi-mt65xx.c +++ linux-kvm-5.19.0/drivers/spi/spi-mt65xx.c @@ -551,14 +551,17 @@ writel(cmd, mdata->base + SPI_CMD_REG); } -static int mtk_spi_get_mult_delta(u32 xfer_len) +static int mtk_spi_get_mult_delta(struct mtk_spi *mdata, u32 xfer_len) { - u32 mult_delta; + u32 mult_delta = 0; - if (xfer_len > MTK_SPI_PACKET_SIZE) - mult_delta = xfer_len % MTK_SPI_PACKET_SIZE; - else - mult_delta = 0; + if (mdata->dev_comp->ipm_design) { + if (xfer_len > MTK_SPI_IPM_PACKET_SIZE) + mult_delta = xfer_len % MTK_SPI_IPM_PACKET_SIZE; + } else { + if (xfer_len > MTK_SPI_PACKET_SIZE) + mult_delta = xfer_len % MTK_SPI_PACKET_SIZE; + } return mult_delta; } @@ -570,22 +573,22 @@ if (mdata->tx_sgl_len && mdata->rx_sgl_len) { if (mdata->tx_sgl_len > mdata->rx_sgl_len) { - mult_delta = mtk_spi_get_mult_delta(mdata->rx_sgl_len); + mult_delta = mtk_spi_get_mult_delta(mdata, mdata->rx_sgl_len); mdata->xfer_len = mdata->rx_sgl_len - mult_delta; mdata->rx_sgl_len = mult_delta; mdata->tx_sgl_len -= mdata->xfer_len; } else { - mult_delta = mtk_spi_get_mult_delta(mdata->tx_sgl_len); + mult_delta = mtk_spi_get_mult_delta(mdata, mdata->tx_sgl_len); mdata->xfer_len = mdata->tx_sgl_len - mult_delta; mdata->tx_sgl_len = mult_delta; mdata->rx_sgl_len -= mdata->xfer_len; } } else if (mdata->tx_sgl_len) { - mult_delta = mtk_spi_get_mult_delta(mdata->tx_sgl_len); + mult_delta = mtk_spi_get_mult_delta(mdata, mdata->tx_sgl_len); mdata->xfer_len = mdata->tx_sgl_len - mult_delta; mdata->tx_sgl_len = mult_delta; } else if (mdata->rx_sgl_len) { - mult_delta = mtk_spi_get_mult_delta(mdata->rx_sgl_len); + mult_delta = mtk_spi_get_mult_delta(mdata, mdata->rx_sgl_len); mdata->xfer_len = mdata->rx_sgl_len - mult_delta; mdata->rx_sgl_len = mult_delta; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/spi/spi-stm32.c +++ linux-kvm-5.19.0/drivers/spi/spi-stm32.c @@ -434,7 +434,7 @@ u32 div, mbrdiv; /* Ensure spi->clk_rate is even */ - div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz); + div = DIV_ROUND_CLOSEST(spi->clk_rate & ~0x1, speed_hz); /* * SPI framework set xfer->speed_hz to master->max_speed_hz if @@ -886,6 +886,7 @@ static DEFINE_RATELIMIT_STATE(rs, DEFAULT_RATELIMIT_INTERVAL * 10, 1); + ratelimit_set_flags(&rs, RATELIMIT_MSG_ON_RELEASE); if (__ratelimit(&rs)) dev_dbg_ratelimited(spi->dev, "Communication suspended\n"); if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0))) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/spi/spi-tegra210-quad.c +++ linux-kvm-5.19.0/drivers/spi/spi-tegra210-quad.c @@ -709,6 +709,9 @@ static void tegra_qspi_deinit_dma(struct tegra_qspi *tqspi) { + if (!tqspi->soc_data->has_dma) + return; + if (tqspi->tx_dma_buf) { dma_free_coherent(tqspi->dev, tqspi->dma_buf_size, tqspi->tx_dma_buf, tqspi->tx_dma_phys); @@ -739,6 +742,9 @@ u32 *dma_buf; int err; + if (!tqspi->soc_data->has_dma) + return 0; + dma_chan = dma_request_chan(tqspi->dev, "rx"); if (IS_ERR(dma_chan)) { err = PTR_ERR(dma_chan); @@ -906,8 +912,9 @@ static struct tegra_qspi_client_data *tegra_qspi_parse_cdata_dt(struct spi_device *spi) { struct tegra_qspi_client_data *cdata; + struct tegra_qspi *tqspi = spi_master_get_devdata(spi->master); - cdata = devm_kzalloc(&spi->dev, sizeof(*cdata), GFP_KERNEL); + cdata = devm_kzalloc(tqspi->dev, sizeof(*cdata), GFP_KERNEL); if (!cdata) return NULL; @@ -1144,6 +1151,11 @@ msg->actual_length += xfer->len; transfer_phase++; } + if (!xfer->cs_change) { + tegra_qspi_transfer_end(spi); + spi_transfer_delay_exec(xfer); + } + ret = 0; exit: msg->status = ret; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/target/loopback/tcm_loop.c +++ linux-kvm-5.19.0/drivers/target/loopback/tcm_loop.c @@ -397,6 +397,7 @@ ret = device_register(&tl_hba->dev); if (ret) { pr_err("device_register() failed for tl_hba->dev: %d\n", ret); + put_device(&tl_hba->dev); return -ENODEV; } @@ -1073,7 +1074,7 @@ */ ret = tcm_loop_setup_hba_bus(tl_hba, tcm_loop_hba_no_cnt); if (ret) - goto out; + return ERR_PTR(ret); sh = tl_hba->sh; tcm_loop_hba_no_cnt++; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/tee/optee/device.c +++ linux-kvm-5.19.0/drivers/tee/optee/device.c @@ -80,7 +80,7 @@ rc = device_register(&optee_device->dev); if (rc) { pr_err("device registration failed, err: %d\n", rc); - kfree(optee_device); + put_device(&optee_device->dev); } return rc; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/thunderbolt/tb.c +++ linux-kvm-5.19.0/drivers/thunderbolt/tb.c @@ -105,6 +105,32 @@ } } +static void tb_discover_dp_resource(struct tb *tb, struct tb_port *port) +{ + struct tb_cm *tcm = tb_priv(tb); + struct tb_port *p; + + list_for_each_entry(p, &tcm->dp_resources, list) { + if (p == port) + return; + } + + tb_port_dbg(port, "DP %s resource available discovered\n", + tb_port_is_dpin(port) ? "IN" : "OUT"); + list_add_tail(&port->list, &tcm->dp_resources); +} + +static void tb_discover_dp_resources(struct tb *tb) +{ + struct tb_cm *tcm = tb_priv(tb); + struct tb_tunnel *tunnel; + + list_for_each_entry(tunnel, &tcm->tunnel_list, list) { + if (tb_tunnel_is_dp(tunnel)) + tb_discover_dp_resource(tb, tunnel->dst_port); + } +} + static void tb_switch_discover_tunnels(struct tb_switch *sw, struct list_head *list, bool alloc_hopids) @@ -1414,6 +1440,8 @@ tb_scan_switch(tb->root_switch); /* Find out tunnels created by the boot firmware */ tb_discover_tunnels(tb); + /* Add DP resources from the DP tunnels created by the boot firmware */ + tb_discover_dp_resources(tb); /* * If the boot firmware did not create USB 3.x tunnels create them * now for the whole topology. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/tty/serial/8250/8250_lpss.c +++ linux-kvm-5.19.0/drivers/tty/serial/8250/8250_lpss.c @@ -174,6 +174,8 @@ */ up->dma = dma; + lpss->dma_maxburst = 16; + port->set_termios = dw8250_do_set_termios; return 0; @@ -277,8 +279,13 @@ struct dw_dma_slave *rx_param, *tx_param; struct device *dev = port->port.dev; - if (!lpss->dma_param.dma_dev) + if (!lpss->dma_param.dma_dev) { + dma = port->dma; + if (dma) + goto out_configuration_only; + return 0; + } rx_param = devm_kzalloc(dev, sizeof(*rx_param), GFP_KERNEL); if (!rx_param) @@ -289,16 +296,18 @@ return -ENOMEM; *rx_param = lpss->dma_param; - dma->rxconf.src_maxburst = lpss->dma_maxburst; - *tx_param = lpss->dma_param; - dma->txconf.dst_maxburst = lpss->dma_maxburst; dma->fn = lpss8250_dma_filter; dma->rx_param = rx_param; dma->tx_param = tx_param; port->dma = dma; + +out_configuration_only: + dma->rxconf.src_maxburst = lpss->dma_maxburst; + dma->txconf.dst_maxburst = lpss->dma_maxburst; + return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/usb/cdns3/cdnsp-gadget.c +++ linux-kvm-5.19.0/drivers/usb/cdns3/cdnsp-gadget.c @@ -600,11 +600,11 @@ trace_cdnsp_ep_halt(value ? "Set" : "Clear"); - if (value) { - ret = cdnsp_cmd_stop_ep(pdev, pep); - if (ret) - return ret; + ret = cdnsp_cmd_stop_ep(pdev, pep); + if (ret) + return ret; + if (value) { if (GET_EP_CTX_STATE(pep->out_ctx) == EP_STATE_STOPPED) { cdnsp_queue_halt_endpoint(pdev, pep->idx); cdnsp_ring_cmd_db(pdev); @@ -613,10 +613,6 @@ pep->ep_state |= EP_HALTED; } else { - /* - * In device mode driver can call reset endpoint command - * from any endpoint state. - */ cdnsp_queue_reset_ep(pdev, pep->idx); cdnsp_ring_cmd_db(pdev); ret = cdnsp_wait_for_cmd_compl(pdev); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/usb/cdns3/cdnsp-ring.c +++ linux-kvm-5.19.0/drivers/usb/cdns3/cdnsp-ring.c @@ -1763,10 +1763,15 @@ int trb_buff_len, unsigned int td_total_len, struct cdnsp_request *preq, - bool more_trbs_coming) + bool more_trbs_coming, + bool zlp) { u32 maxp, total_packet_count; + /* Before ZLP driver needs set TD_SIZE = 1. */ + if (zlp) + return 1; + /* One TRB with a zero-length data packet. */ if (!more_trbs_coming || (transferred == 0 && trb_buff_len == 0) || trb_buff_len == td_total_len) @@ -1960,7 +1965,8 @@ /* Set the TRB length, TD size, and interrupter fields. */ remainder = cdnsp_td_remainder(pdev, enqd_len, trb_buff_len, full_len, preq, - more_trbs_coming); + more_trbs_coming, + zero_len_trb); length_field = TRB_LEN(trb_buff_len) | TRB_TD_SIZE(remainder) | TRB_INTR_TARGET(0); @@ -2025,7 +2031,7 @@ if (preq->request.length > 0) { remainder = cdnsp_td_remainder(pdev, 0, preq->request.length, - preq->request.length, preq, 1); + preq->request.length, preq, 1, 0); length_field = TRB_LEN(preq->request.length) | TRB_TD_SIZE(remainder) | TRB_INTR_TARGET(0); @@ -2076,7 +2082,8 @@ u32 ep_state = GET_EP_CTX_STATE(pep->out_ctx); int ret = 0; - if (ep_state == EP_STATE_STOPPED || ep_state == EP_STATE_DISABLED) { + if (ep_state == EP_STATE_STOPPED || ep_state == EP_STATE_DISABLED || + ep_state == EP_STATE_HALTED) { trace_cdnsp_ep_stopped_or_disabled(pep->out_ctx); goto ep_stopped; } @@ -2225,7 +2232,7 @@ /* Set the TRB length, TD size, & interrupter fields. */ remainder = cdnsp_td_remainder(pdev, running_total, trb_buff_len, td_len, preq, - more_trbs_coming); + more_trbs_coming, 0); length_field = TRB_LEN(trb_buff_len) | TRB_INTR_TARGET(0); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/usb/cdns3/host.c +++ linux-kvm-5.19.0/drivers/usb/cdns3/host.c @@ -24,11 +24,37 @@ #define CFG_RXDET_P3_EN BIT(15) #define LPM_2_STB_SWITCH_EN BIT(25) -static int xhci_cdns3_suspend_quirk(struct usb_hcd *hcd); +static void xhci_cdns3_plat_start(struct usb_hcd *hcd) +{ + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + u32 value; + + /* set usbcmd.EU3S */ + value = readl(&xhci->op_regs->command); + value |= CMD_PM_INDEX; + writel(value, &xhci->op_regs->command); + + if (hcd->regs) { + value = readl(hcd->regs + XECP_AUX_CTRL_REG1); + value |= CFG_RXDET_P3_EN; + writel(value, hcd->regs + XECP_AUX_CTRL_REG1); + + value = readl(hcd->regs + XECP_PORT_CAP_REG); + value |= LPM_2_STB_SWITCH_EN; + writel(value, hcd->regs + XECP_PORT_CAP_REG); + } +} + +static int xhci_cdns3_resume_quirk(struct usb_hcd *hcd) +{ + xhci_cdns3_plat_start(hcd); + return 0; +} static const struct xhci_plat_priv xhci_plat_cdns3_xhci = { .quirks = XHCI_SKIP_PHY_INIT | XHCI_AVOID_BEI, - .suspend_quirk = xhci_cdns3_suspend_quirk, + .plat_start = xhci_cdns3_plat_start, + .resume_quirk = xhci_cdns3_resume_quirk, }; static int __cdns_host_init(struct cdns *cdns) @@ -90,32 +116,6 @@ return ret; } -static int xhci_cdns3_suspend_quirk(struct usb_hcd *hcd) -{ - struct xhci_hcd *xhci = hcd_to_xhci(hcd); - u32 value; - - if (pm_runtime_status_suspended(hcd->self.controller)) - return 0; - - /* set usbcmd.EU3S */ - value = readl(&xhci->op_regs->command); - value |= CMD_PM_INDEX; - writel(value, &xhci->op_regs->command); - - if (hcd->regs) { - value = readl(hcd->regs + XECP_AUX_CTRL_REG1); - value |= CFG_RXDET_P3_EN; - writel(value, hcd->regs + XECP_AUX_CTRL_REG1); - - value = readl(hcd->regs + XECP_PORT_CAP_REG); - value |= LPM_2_STB_SWITCH_EN; - writel(value, hcd->regs + XECP_PORT_CAP_REG); - } - - return 0; -} - static void cdns_host_exit(struct cdns *cdns) { kfree(cdns->xhci_plat_data); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/usb/chipidea/otg_fsm.c +++ linux-kvm-5.19.0/drivers/usb/chipidea/otg_fsm.c @@ -256,8 +256,10 @@ ci->enabled_otg_timer_bits &= ~(1 << t); if (ci->next_otg_timer == t) { if (ci->enabled_otg_timer_bits == 0) { + spin_unlock_irqrestore(&ci->lock, flags); /* No enabled timers after delete it */ hrtimer_cancel(&ci->otg_fsm_hrtimer); + spin_lock_irqsave(&ci->lock, flags); ci->next_otg_timer = NUM_OTG_FSM_TIMERS; } else { /* Find the next timer */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/usb/dwc3/dwc3-exynos.c +++ linux-kvm-5.19.0/drivers/usb/dwc3/dwc3-exynos.c @@ -37,15 +37,6 @@ struct regulator *vdd10; }; -static int dwc3_exynos_remove_child(struct device *dev, void *unused) -{ - struct platform_device *pdev = to_platform_device(dev); - - platform_device_unregister(pdev); - - return 0; -} - static int dwc3_exynos_probe(struct platform_device *pdev) { struct dwc3_exynos *exynos; @@ -142,7 +133,7 @@ struct dwc3_exynos *exynos = platform_get_drvdata(pdev); int i; - device_for_each_child(&pdev->dev, NULL, dwc3_exynos_remove_child); + of_platform_depopulate(&pdev->dev); for (i = exynos->num_clks - 1; i >= 0; i--) clk_disable_unprepare(exynos->clks[i]); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/usb/host/bcma-hcd.c +++ linux-kvm-5.19.0/drivers/usb/host/bcma-hcd.c @@ -285,7 +285,7 @@ { struct bcma_hcd_device *usb_dev = bcma_get_drvdata(dev); - if (IS_ERR_OR_NULL(usb_dev->gpio_desc)) + if (!usb_dev->gpio_desc) return; gpiod_set_value(usb_dev->gpio_desc, val); @@ -406,9 +406,11 @@ return -ENOMEM; usb_dev->core = core; - if (core->dev.of_node) - usb_dev->gpio_desc = devm_gpiod_get(&core->dev, "vcc", - GPIOD_OUT_HIGH); + usb_dev->gpio_desc = devm_gpiod_get_optional(&core->dev, "vcc", + GPIOD_OUT_HIGH); + if (IS_ERR(usb_dev->gpio_desc)) + return dev_err_probe(&core->dev, PTR_ERR(usb_dev->gpio_desc), + "error obtaining VCC GPIO"); switch (core->id.id) { case BCMA_CORE_USB20_HOST: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/usb/typec/tipd/core.c +++ linux-kvm-5.19.0/drivers/usb/typec/tipd/core.c @@ -474,7 +474,7 @@ static irqreturn_t cd321x_interrupt(int irq, void *data) { struct tps6598x *tps = data; - u64 event; + u64 event = 0; u32 status; int ret; @@ -519,8 +519,8 @@ static irqreturn_t tps6598x_interrupt(int irq, void *data) { struct tps6598x *tps = data; - u64 event1; - u64 event2; + u64 event1 = 0; + u64 event2 = 0; u32 status; int ret; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/virt/coco/sev-guest/sev-guest.c +++ linux-kvm-5.19.0/drivers/virt/coco/sev-guest/sev-guest.c @@ -67,8 +67,27 @@ return true; } +/* + * If an error is received from the host or AMD Secure Processor (ASP) there + * are two options. Either retry the exact same encrypted request or discontinue + * using the VMPCK. + * + * This is because in the current encryption scheme GHCB v2 uses AES-GCM to + * encrypt the requests. The IV for this scheme is the sequence number. GCM + * cannot tolerate IV reuse. + * + * The ASP FW v1.51 only increments the sequence numbers on a successful + * guest<->ASP back and forth and only accepts messages at its exact sequence + * number. + * + * So if the sequence number were to be reused the encryption scheme is + * vulnerable. If the sequence number were incremented for a fresh IV the ASP + * will reject the request. + */ static void snp_disable_vmpck(struct snp_guest_dev *snp_dev) { + dev_alert(snp_dev->dev, "Disabling vmpck_id %d to prevent IV reuse.\n", + vmpck_id); memzero_explicit(snp_dev->vmpck, VMPCK_KEY_LEN); snp_dev->vmpck = NULL; } @@ -321,34 +340,71 @@ if (rc) return rc; - /* Call firmware to process the request */ + /* + * Call firmware to process the request. In this function the encrypted + * message enters shared memory with the host. So after this call the + * sequence number must be incremented or the VMPCK must be deleted to + * prevent reuse of the IV. + */ rc = snp_issue_guest_request(exit_code, &snp_dev->input, &err); + + /* + * If the extended guest request fails due to having too small of a + * certificate data buffer, retry the same guest request without the + * extended data request in order to increment the sequence number + * and thus avoid IV reuse. + */ + if (exit_code == SVM_VMGEXIT_EXT_GUEST_REQUEST && + err == SNP_GUEST_REQ_INVALID_LEN) { + const unsigned int certs_npages = snp_dev->input.data_npages; + + exit_code = SVM_VMGEXIT_GUEST_REQUEST; + + /* + * If this call to the firmware succeeds, the sequence number can + * be incremented allowing for continued use of the VMPCK. If + * there is an error reflected in the return value, this value + * is checked further down and the result will be the deletion + * of the VMPCK and the error code being propagated back to the + * user as an ioctl() return code. + */ + rc = snp_issue_guest_request(exit_code, &snp_dev->input, &err); + + /* + * Override the error to inform callers the given extended + * request buffer size was too small and give the caller the + * required buffer size. + */ + err = SNP_GUEST_REQ_INVALID_LEN; + snp_dev->input.data_npages = certs_npages; + } + if (fw_err) *fw_err = err; - if (rc) - return rc; + if (rc) { + dev_alert(snp_dev->dev, + "Detected error from ASP request. rc: %d, fw_err: %llu\n", + rc, *fw_err); + goto disable_vmpck; + } - /* - * The verify_and_dec_payload() will fail only if the hypervisor is - * actively modifying the message header or corrupting the encrypted payload. - * This hints that hypervisor is acting in a bad faith. Disable the VMPCK so that - * the key cannot be used for any communication. The key is disabled to ensure - * that AES-GCM does not use the same IV while encrypting the request payload. - */ rc = verify_and_dec_payload(snp_dev, resp_buf, resp_sz); if (rc) { dev_alert(snp_dev->dev, - "Detected unexpected decode failure, disabling the vmpck_id %d\n", - vmpck_id); - snp_disable_vmpck(snp_dev); - return rc; + "Detected unexpected decode failure from ASP. rc: %d\n", + rc); + goto disable_vmpck; } /* Increment to new message sequence after payload decryption was successful. */ snp_inc_msg_seqno(snp_dev); return 0; + +disable_vmpck: + snp_disable_vmpck(snp_dev); + return rc; } static int get_report(struct snp_guest_dev *snp_dev, struct snp_guest_request_ioctl *arg) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/xen/pcpu.c +++ linux-kvm-5.19.0/drivers/xen/pcpu.c @@ -228,7 +228,7 @@ err = device_register(dev); if (err) { - pcpu_release(dev); + put_device(dev); return err; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/xen/platform-pci.c +++ linux-kvm-5.19.0/drivers/xen/platform-pci.c @@ -144,7 +144,7 @@ if (ret) { dev_warn(&pdev->dev, "Unable to set the evtchn callback " "err=%d\n", ret); - goto out; + goto irq_out; } } @@ -152,13 +152,16 @@ grant_frames = alloc_xen_mmio(PAGE_SIZE * max_nr_gframes); ret = gnttab_setup_auto_xlat_frames(grant_frames); if (ret) - goto out; + goto irq_out; ret = gnttab_init(); if (ret) goto grant_out; return 0; grant_out: gnttab_free_auto_xlat_frames(); +irq_out: + if (!xen_have_vector_callback) + free_irq(pdev->irq, pdev); out: pci_release_region(pdev, 0); mem_out: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/drivers/xen/xen-pciback/conf_space_capability.c +++ linux-kvm-5.19.0/drivers/xen/xen-pciback/conf_space_capability.c @@ -190,13 +190,16 @@ }; static struct msi_msix_field_config { - u16 enable_bit; /* bit for enabling MSI/MSI-X */ - unsigned int int_type; /* interrupt type for exclusiveness check */ + u16 enable_bit; /* bit for enabling MSI/MSI-X */ + u16 allowed_bits; /* bits allowed to be changed */ + unsigned int int_type; /* interrupt type for exclusiveness check */ } msi_field_config = { .enable_bit = PCI_MSI_FLAGS_ENABLE, + .allowed_bits = PCI_MSI_FLAGS_ENABLE, .int_type = INTERRUPT_TYPE_MSI, }, msix_field_config = { .enable_bit = PCI_MSIX_FLAGS_ENABLE, + .allowed_bits = PCI_MSIX_FLAGS_ENABLE | PCI_MSIX_FLAGS_MASKALL, .int_type = INTERRUPT_TYPE_MSIX, }; @@ -229,7 +232,7 @@ return 0; if (!dev_data->allow_interrupt_control || - (new_value ^ old_value) & ~field_config->enable_bit) + (new_value ^ old_value) & ~field_config->allowed_bits) return PCIBIOS_SET_FAILED; if (new_value & field_config->enable_bit) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/afs/fs_probe.c +++ linux-kvm-5.19.0/fs/afs/fs_probe.c @@ -167,8 +167,8 @@ clear_bit(AFS_SERVER_FL_HAS_FS64, &server->flags); } - if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) && - rtt_us < server->probe.rtt) { + rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us); + if (rtt_us < server->probe.rtt) { server->probe.rtt = rtt_us; server->rtt = rtt_us; alist->preferred = index; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/btrfs/backref.h +++ linux-kvm-5.19.0/fs/btrfs/backref.h @@ -35,8 +35,7 @@ bool ignore_offset); int iterate_inodes_from_logical(u64 logical, struct btrfs_fs_info *fs_info, - struct btrfs_path *path, - iterate_extent_inodes_t *iterate, void *ctx, + struct btrfs_path *path, void *ctx, bool ignore_offset); int paths_from_inode(u64 inum, struct inode_fs_paths *ipath); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/btrfs/ioctl.c +++ linux-kvm-5.19.0/fs/btrfs/ioctl.c @@ -3102,6 +3102,8 @@ } } + btrfs_free_path(path); + path = NULL; if (copy_to_user(argp, subvol_info, sizeof(*subvol_info))) ret = -EFAULT; @@ -3191,6 +3193,8 @@ } out: + btrfs_free_path(path); + if (!ret || ret == -EOVERFLOW) { rootrefs->num_items = found; /* update min_treeid for next search */ @@ -3202,7 +3206,6 @@ } kfree(rootrefs); - btrfs_free_path(path); return ret; } @@ -4228,6 +4231,8 @@ ipath->fspath->val[i] = rel_ptr; } + btrfs_free_path(path); + path = NULL; ret = copy_to_user((void __user *)(unsigned long)ipa->fspath, ipath->fspath, size); if (ret) { @@ -4243,26 +4248,6 @@ return ret; } -static int build_ino_list(u64 inum, u64 offset, u64 root, void *ctx) -{ - struct btrfs_data_container *inodes = ctx; - const size_t c = 3 * sizeof(u64); - - if (inodes->bytes_left >= c) { - inodes->bytes_left -= c; - inodes->val[inodes->elem_cnt] = inum; - inodes->val[inodes->elem_cnt + 1] = offset; - inodes->val[inodes->elem_cnt + 2] = root; - inodes->elem_cnt += 3; - } else { - inodes->bytes_missing += c - inodes->bytes_left; - inodes->bytes_left = 0; - inodes->elem_missed += 3; - } - - return 0; -} - static long btrfs_ioctl_logical_to_ino(struct btrfs_fs_info *fs_info, void __user *arg, int version) { @@ -4298,21 +4283,20 @@ size = min_t(u32, loi->size, SZ_16M); } - path = btrfs_alloc_path(); - if (!path) { - ret = -ENOMEM; - goto out; - } - inodes = init_data_container(size); if (IS_ERR(inodes)) { ret = PTR_ERR(inodes); - inodes = NULL; - goto out; + goto out_loi; } + path = btrfs_alloc_path(); + if (!path) { + ret = -ENOMEM; + goto out; + } ret = iterate_inodes_from_logical(loi->logical, fs_info, path, - build_ino_list, inodes, ignore_offset); + inodes, ignore_offset); + btrfs_free_path(path); if (ret == -EINVAL) ret = -ENOENT; if (ret < 0) @@ -4324,7 +4308,6 @@ ret = -EFAULT; out: - btrfs_free_path(path); kvfree(inodes); out_loi: kfree(loi); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/btrfs/sysfs.c +++ linux-kvm-5.19.0/fs/btrfs/sysfs.c @@ -2082,8 +2082,11 @@ #ifdef CONFIG_BTRFS_DEBUG ret = sysfs_create_group(&btrfs_kset->kobj, &btrfs_debug_feature_attr_group); - if (ret) - goto out2; + if (ret) { + sysfs_unmerge_group(&btrfs_kset->kobj, + &btrfs_static_feature_attr_group); + goto out_remove_group; + } #endif return 0; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/btrfs/tests/btrfs-tests.c +++ linux-kvm-5.19.0/fs/btrfs/tests/btrfs-tests.c @@ -199,7 +199,7 @@ void btrfs_free_dummy_root(struct btrfs_root *root) { - if (!root) + if (IS_ERR_OR_NULL(root)) return; /* Will be freed by btrfs_free_fs_roots */ if (WARN_ON(test_bit(BTRFS_ROOT_IN_RADIX, &root->state))) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/btrfs/volumes.h +++ linux-kvm-5.19.0/fs/btrfs/volumes.h @@ -591,7 +591,7 @@ void btrfs_dev_stat_inc_and_print(struct btrfs_device *dev, int index); int btrfs_get_dev_stats(struct btrfs_fs_info *fs_info, struct btrfs_ioctl_get_dev_stats *stats); -void btrfs_init_devices_late(struct btrfs_fs_info *fs_info); +int btrfs_init_devices_late(struct btrfs_fs_info *fs_info); int btrfs_init_dev_stats(struct btrfs_fs_info *fs_info); int btrfs_run_dev_stats(struct btrfs_trans_handle *trans); void btrfs_rm_dev_replace_remove_srcdev(struct btrfs_device *srcdev); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/buffer.c +++ linux-kvm-5.19.0/fs/buffer.c @@ -2349,7 +2349,7 @@ struct address_space *mapping = inode->i_mapping; const struct address_space_operations *aops = mapping->a_ops; struct page *page; - void *fsdata; + void *fsdata = NULL; int err; err = inode_newsize_ok(inode, size); @@ -2375,7 +2375,7 @@ const struct address_space_operations *aops = mapping->a_ops; unsigned int blocksize = i_blocksize(inode); struct page *page; - void *fsdata; + void *fsdata = NULL; pgoff_t index, curidx; loff_t curpos; unsigned zerofrom, offset, len; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/ceph/snap.c +++ linux-kvm-5.19.0/fs/ceph/snap.c @@ -763,7 +763,7 @@ struct ceph_mds_snap_realm *ri; /* encoded */ __le64 *snaps; /* encoded */ __le64 *prior_parent_snaps; /* encoded */ - struct ceph_snap_realm *realm = NULL; + struct ceph_snap_realm *realm; struct ceph_snap_realm *first_realm = NULL; struct ceph_snap_realm *realm_to_rebuild = NULL; int rebuild_snapcs; @@ -774,6 +774,7 @@ dout("%s deletion=%d\n", __func__, deletion); more: + realm = NULL; rebuild_snapcs = 0; ceph_decode_need(&p, e, sizeof(*ri), bad); ri = p; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/cifs/ioctl.c +++ linux-kvm-5.19.0/fs/cifs/ioctl.c @@ -342,7 +342,7 @@ rc = put_user(ExtAttrBits & FS_FL_USER_VISIBLE, (int __user *)arg); - if (rc != EOPNOTSUPP) + if (rc != -EOPNOTSUPP) break; } #endif /* CONFIG_CIFS_POSIX */ @@ -371,7 +371,7 @@ * pSMBFile->fid.netfid, * extAttrBits, * &ExtAttrMask); - * if (rc != EOPNOTSUPP) + * if (rc != -EOPNOTSUPP) * break; */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/fscache/volume.c +++ linux-kvm-5.19.0/fs/fscache/volume.c @@ -203,7 +203,11 @@ struct fscache_volume *volume; struct fscache_cache *cache; size_t klen, hlen; - char *key; + u8 *key; + + klen = strlen(volume_key); + if (klen > NAME_MAX) + return NULL; if (!coherency_data) coherency_len = 0; @@ -229,7 +233,6 @@ /* Stick the length on the front of the key and pad it out to make * hashing easier. */ - klen = strlen(volume_key); hlen = round_up(1 + klen + 1, sizeof(__le32)); key = kzalloc(hlen, GFP_KERNEL); if (!key) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/gfs2/ops_fstype.c +++ linux-kvm-5.19.0/fs/gfs2/ops_fstype.c @@ -180,7 +180,10 @@ pr_warn("Invalid block size\n"); return -EINVAL; } - + if (sb->sb_bsize_shift != ffs(sb->sb_bsize) - 1) { + pr_warn("Invalid block size shift\n"); + return -EINVAL; + } return 0; } @@ -383,8 +386,10 @@ if (!table[0]) table = sdp->sd_vfs->s_id; - strlcpy(sdp->sd_proto_name, proto, GFS2_FSNAME_LEN); - strlcpy(sdp->sd_table_name, table, GFS2_FSNAME_LEN); + BUILD_BUG_ON(GFS2_LOCKNAME_LEN > GFS2_FSNAME_LEN); + + strscpy(sdp->sd_proto_name, proto, GFS2_LOCKNAME_LEN); + strscpy(sdp->sd_table_name, table, GFS2_LOCKNAME_LEN); table = sdp->sd_table_name; while ((table = strchr(table, '/'))) @@ -1441,13 +1446,13 @@ switch (o) { case Opt_lockproto: - strlcpy(args->ar_lockproto, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_lockproto, param->string, GFS2_LOCKNAME_LEN); break; case Opt_locktable: - strlcpy(args->ar_locktable, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_locktable, param->string, GFS2_LOCKNAME_LEN); break; case Opt_hostdata: - strlcpy(args->ar_hostdata, param->string, GFS2_LOCKNAME_LEN); + strscpy(args->ar_hostdata, param->string, GFS2_LOCKNAME_LEN); break; case Opt_spectator: args->ar_spectator = 1; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/hugetlbfs/inode.c +++ linux-kvm-5.19.0/fs/hugetlbfs/inode.c @@ -370,6 +370,12 @@ } else { unlock_page(page); + if (PageHWPoison(page)) { + put_page(page); + retval = -EIO; + break; + } + /* * We have the page, copy it to user space buffer. */ @@ -1034,13 +1040,6 @@ static int hugetlbfs_error_remove_page(struct address_space *mapping, struct page *page) { - struct inode *inode = mapping->host; - pgoff_t index = page->index; - - remove_huge_page(page); - if (unlikely(hugetlb_unreserve_pages(inode, index, index + 1, 1))) - hugetlb_fix_reserve_counts(inode); - return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/netfs/buffered_read.c +++ linux-kvm-5.19.0/fs/netfs/buffered_read.c @@ -17,9 +17,9 @@ { struct netfs_io_subrequest *subreq; struct folio *folio; - unsigned int iopos, account = 0; pgoff_t start_page = rreq->start / PAGE_SIZE; pgoff_t last_page = ((rreq->start + rreq->len) / PAGE_SIZE) - 1; + size_t account = 0; bool subreq_failed = false; XA_STATE(xas, &rreq->mapping->i_pages, start_page); @@ -39,18 +39,23 @@ */ subreq = list_first_entry(&rreq->subrequests, struct netfs_io_subrequest, rreq_link); - iopos = 0; subreq_failed = (subreq->error < 0); trace_netfs_rreq(rreq, netfs_rreq_trace_unlock); rcu_read_lock(); xas_for_each(&xas, folio, last_page) { - unsigned int pgpos = (folio_index(folio) - start_page) * PAGE_SIZE; - unsigned int pgend = pgpos + folio_size(folio); + loff_t pg_end; bool pg_failed = false; + if (xas_retry(&xas, folio)) + continue; + + pg_end = folio_pos(folio) + folio_size(folio) - 1; + for (;;) { + loff_t sreq_end; + if (!subreq) { pg_failed = true; break; @@ -58,11 +63,11 @@ if (test_bit(NETFS_SREQ_COPY_TO_CACHE, &subreq->flags)) folio_start_fscache(folio); pg_failed |= subreq_failed; - if (pgend < iopos + subreq->len) + sreq_end = subreq->start + subreq->len - 1; + if (pg_end < sreq_end) break; account += subreq->transferred; - iopos += subreq->len; if (!list_is_last(&subreq->rreq_link, &rreq->subrequests)) { subreq = list_next_entry(subreq, rreq_link); subreq_failed = (subreq->error < 0); @@ -70,7 +75,8 @@ subreq = NULL; subreq_failed = false; } - if (pgend == iopos) + + if (pg_end == sreq_end) break; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/netfs/io.c +++ linux-kvm-5.19.0/fs/netfs/io.c @@ -121,6 +121,9 @@ XA_STATE(xas, &rreq->mapping->i_pages, subreq->start / PAGE_SIZE); xas_for_each(&xas, folio, (subreq->start + subreq->len - 1) / PAGE_SIZE) { + if (xas_retry(&xas, folio)) + continue; + /* We might have multiple writes from the same huge * folio, but we mustn't unlock a folio more than once. */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/nfsd/vfs.c +++ linux-kvm-5.19.0/fs/nfsd/vfs.c @@ -591,8 +591,8 @@ ret = vfs_copy_file_range(src, src_pos, dst, dst_pos, count, 0); if (ret == -EOPNOTSUPP || ret == -EXDEV) - ret = generic_copy_file_range(src, src_pos, dst, dst_pos, - count, 0); + ret = vfs_copy_file_range(src, src_pos, dst, dst_pos, count, + COPY_FILE_SPLICE); return ret; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/nilfs2/dat.c +++ linux-kvm-5.19.0/fs/nilfs2/dat.c @@ -111,6 +111,13 @@ kunmap_atomic(kaddr); nilfs_dat_commit_entry(dat, req); + + if (unlikely(req->pr_desc_bh == NULL || req->pr_bitmap_bh == NULL)) { + nilfs_error(dat->i_sb, + "state inconsistency probably due to duplicate use of vblocknr = %llu", + (unsigned long long)req->pr_entry_nr); + return; + } nilfs_palloc_commit_free_entry(dat, req); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/nilfs2/sufile.c +++ linux-kvm-5.19.0/fs/nilfs2/sufile.c @@ -495,14 +495,22 @@ int nilfs_sufile_mark_dirty(struct inode *sufile, __u64 segnum) { struct buffer_head *bh; + void *kaddr; + struct nilfs_segment_usage *su; int ret; + down_write(&NILFS_MDT(sufile)->mi_sem); ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &bh); if (!ret) { mark_buffer_dirty(bh); nilfs_mdt_mark_dirty(sufile); + kaddr = kmap_atomic(bh->b_page); + su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, kaddr); + nilfs_segment_usage_set_dirty(su); + kunmap_atomic(kaddr); brelse(bh); } + up_write(&NILFS_MDT(sufile)->mi_sem); return ret; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/nilfs2/super.c +++ linux-kvm-5.19.0/fs/nilfs2/super.c @@ -1133,8 +1133,6 @@ if ((bool)(*flags & SB_RDONLY) == sb_rdonly(sb)) goto out; if (*flags & SB_RDONLY) { - /* Shutting down log writer */ - nilfs_detach_log_writer(sb); sb->s_flags |= SB_RDONLY; /* only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/nilfs2/the_nilfs.c +++ linux-kvm-5.19.0/fs/nilfs2/the_nilfs.c @@ -690,9 +690,7 @@ { unsigned long ncleansegs; - down_read(&NILFS_MDT(nilfs->ns_dat)->mi_sem); ncleansegs = nilfs_sufile_get_ncleansegs(nilfs->ns_sufile); - up_read(&NILFS_MDT(nilfs->ns_dat)->mi_sem); *nblocks = (sector_t)ncleansegs * nilfs->ns_blocks_per_segment; return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/ntfs/attrib.c +++ linux-kvm-5.19.0/fs/ntfs/attrib.c @@ -594,17 +594,37 @@ for (;; a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) { u8 *mrec_end = (u8 *)ctx->mrec + le32_to_cpu(ctx->mrec->bytes_allocated); - u8 *name_end = (u8 *)a + le16_to_cpu(a->name_offset) + - a->name_length * sizeof(ntfschar); - if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end || - name_end > mrec_end) + u8 *name_end; + + /* check whether ATTR_RECORD wrap */ + if ((u8 *)a < (u8 *)ctx->mrec) break; + + /* check whether Attribute Record Header is within bounds */ + if ((u8 *)a > mrec_end || + (u8 *)a + sizeof(ATTR_RECORD) > mrec_end) + break; + + /* check whether ATTR_RECORD's name is within bounds */ + name_end = (u8 *)a + le16_to_cpu(a->name_offset) + + a->name_length * sizeof(ntfschar); + if (name_end > mrec_end) + break; + ctx->attr = a; if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) || a->type == AT_END)) return -ENOENT; if (unlikely(!a->length)) break; + + /* check whether ATTR_RECORD's length wrap */ + if ((u8 *)a + le32_to_cpu(a->length) < (u8 *)a) + break; + /* check whether ATTR_RECORD's length is within bounds */ + if ((u8 *)a + le32_to_cpu(a->length) > mrec_end) + break; + if (a->type != type) continue; /* only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/ntfs/inode.c +++ linux-kvm-5.19.0/fs/ntfs/inode.c @@ -1829,6 +1829,13 @@ goto err_out; } + /* Sanity check offset to the first attribute */ + if (le16_to_cpu(m->attrs_offset) >= le32_to_cpu(m->bytes_allocated)) { + ntfs_error(sb, "Incorrect mft offset to the first attribute %u in superblock.", + le16_to_cpu(m->attrs_offset)); + goto err_out; + } + /* Need this to sanity check attribute list references to $MFT. */ vi->i_generation = ni->seq_no = le16_to_cpu(m->sequence_number); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/udf/namei.c +++ linux-kvm-5.19.0/fs/udf/namei.c @@ -240,7 +240,7 @@ poffset - lfi); else { if (!copy_name) { - copy_name = kmalloc(UDF_NAME_LEN, + copy_name = kmalloc(UDF_NAME_LEN_CS0, GFP_NOFS); if (!copy_name) { fi = ERR_PTR(-ENOMEM); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/zonefs/super.c +++ linux-kvm-5.19.0/fs/zonefs/super.c @@ -41,6 +41,13 @@ return; /* + * For zones that transitioned to the offline or readonly condition, + * we only need to clear the active state. + */ + if (zi->i_flags & (ZONEFS_ZONE_OFFLINE | ZONEFS_ZONE_READONLY)) + goto out; + + /* * If the zone is active, that is, if it is explicitly open or * partially written, check if it was already accounted as active. */ @@ -53,6 +60,7 @@ return; } +out: /* The zone is not active. If it was, update the active count */ if (zi->i_flags & ZONEFS_ZONE_ACTIVE) { zi->i_flags &= ~ZONEFS_ZONE_ACTIVE; @@ -333,6 +341,7 @@ inode->i_flags |= S_IMMUTABLE; inode->i_mode &= ~0777; zone->wp = zone->start; + zi->i_flags |= ZONEFS_ZONE_OFFLINE; return 0; case BLK_ZONE_COND_READONLY: /* @@ -351,8 +360,10 @@ zone->cond = BLK_ZONE_COND_OFFLINE; inode->i_mode &= ~0777; zone->wp = zone->start; + zi->i_flags |= ZONEFS_ZONE_OFFLINE; return 0; } + zi->i_flags |= ZONEFS_ZONE_READONLY; inode->i_mode &= ~0222; return i_size_read(inode); case BLK_ZONE_COND_FULL: @@ -487,8 +498,7 @@ struct super_block *sb = inode->i_sb; struct zonefs_sb_info *sbi = ZONEFS_SB(sb); unsigned int noio_flag; - unsigned int nr_zones = - zi->i_zone_size >> (sbi->s_zone_sectors_shift + SECTOR_SHIFT); + unsigned int nr_zones = 1; struct zonefs_ioerr_data err = { .inode = inode, .write = write, @@ -496,6 +506,15 @@ int ret; /* + * The only files that have more than one zone are conventional zone + * files with aggregated conventional zones, for which the inode zone + * size is always larger than the device zone size. + */ + if (zi->i_zone_size > bdev_zone_sectors(sb->s_bdev)) + nr_zones = zi->i_zone_size >> + (sbi->s_zone_sectors_shift + SECTOR_SHIFT); + + /* * Memory allocations in blkdev_report_zones() can trigger a memory * reclaim which may in turn cause a recursion into zonefs as well as * struct request allocations for the same device. The former case may @@ -1416,6 +1435,14 @@ zi->i_ztype = type; zi->i_zsector = zone->start; zi->i_zone_size = zone->len << SECTOR_SHIFT; + if (zi->i_zone_size > bdev_zone_sectors(sb->s_bdev) << SECTOR_SHIFT && + !(sbi->s_features & ZONEFS_F_AGGRCNV)) { + zonefs_err(sb, + "zone size %llu doesn't match device's zone sectors %llu\n", + zi->i_zone_size, + bdev_zone_sectors(sb->s_bdev) << SECTOR_SHIFT); + return -EINVAL; + } zi->i_max_size = min_t(loff_t, MAX_LFS_FILESIZE, zone->capacity << SECTOR_SHIFT); @@ -1465,11 +1492,11 @@ struct inode *dir = d_inode(parent); struct dentry *dentry; struct inode *inode; - int ret; + int ret = -ENOMEM; dentry = d_alloc_name(parent, name); if (!dentry) - return NULL; + return ERR_PTR(ret); inode = new_inode(parent->d_sb); if (!inode) @@ -1494,7 +1521,7 @@ dput: dput(dentry); - return NULL; + return ERR_PTR(ret); } struct zonefs_zone_data { @@ -1514,7 +1541,7 @@ struct blk_zone *zone, *next, *end; const char *zgroup_name; char *file_name; - struct dentry *dir; + struct dentry *dir, *dent; unsigned int n = 0; int ret; @@ -1532,8 +1559,8 @@ zgroup_name = "seq"; dir = zonefs_create_inode(sb->s_root, zgroup_name, NULL, type); - if (!dir) { - ret = -ENOMEM; + if (IS_ERR(dir)) { + ret = PTR_ERR(dir); goto free; } @@ -1579,8 +1606,9 @@ * Use the file number within its group as file name. */ snprintf(file_name, ZONEFS_NAME_MAX - 1, "%u", n); - if (!zonefs_create_inode(dir, file_name, zone, type)) { - ret = -ENOMEM; + dent = zonefs_create_inode(dir, file_name, zone, type); + if (IS_ERR(dent)) { + ret = PTR_ERR(dent); goto free; } @@ -1917,18 +1945,18 @@ if (ret) return ret; - ret = register_filesystem(&zonefs_type); + ret = zonefs_sysfs_init(); if (ret) goto destroy_inodecache; - ret = zonefs_sysfs_init(); + ret = register_filesystem(&zonefs_type); if (ret) - goto unregister_fs; + goto sysfs_exit; return 0; -unregister_fs: - unregister_filesystem(&zonefs_type); +sysfs_exit: + zonefs_sysfs_exit(); destroy_inodecache: zonefs_destroy_inodecache(); @@ -1937,9 +1965,9 @@ static void __exit zonefs_exit(void) { + unregister_filesystem(&zonefs_type); zonefs_sysfs_exit(); zonefs_destroy_inodecache(); - unregister_filesystem(&zonefs_type); } MODULE_AUTHOR("Damien Le Moal"); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/fs/zonefs/zonefs.h +++ linux-kvm-5.19.0/fs/zonefs/zonefs.h @@ -39,8 +39,10 @@ return ZONEFS_ZTYPE_SEQ; } -#define ZONEFS_ZONE_OPEN (1 << 0) -#define ZONEFS_ZONE_ACTIVE (1 << 1) +#define ZONEFS_ZONE_OPEN (1U << 0) +#define ZONEFS_ZONE_ACTIVE (1U << 1) +#define ZONEFS_ZONE_OFFLINE (1U << 2) +#define ZONEFS_ZONE_READONLY (1U << 3) /* * In-memory inode data. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/linux/fault-inject.h +++ linux-kvm-5.19.0/include/linux/fault-inject.h @@ -20,7 +20,6 @@ atomic_t space; unsigned long verbose; bool task_filter; - bool no_warn; unsigned long stacktrace_depth; unsigned long require_start; unsigned long require_end; @@ -32,6 +31,10 @@ struct dentry *dname; }; +enum fault_flags { + FAULT_NOWARN = 1 << 0, +}; + #define FAULT_ATTR_INITIALIZER { \ .interval = 1, \ .times = ATOMIC_INIT(1), \ @@ -40,11 +43,11 @@ .ratelimit_state = RATELIMIT_STATE_INIT_DISABLED, \ .verbose = 2, \ .dname = NULL, \ - .no_warn = false, \ } #define DECLARE_FAULT_ATTR(name) struct fault_attr name = FAULT_ATTR_INITIALIZER int setup_fault_attr(struct fault_attr *attr, char *str); +bool should_fail_ex(struct fault_attr *attr, ssize_t size, int flags); bool should_fail(struct fault_attr *attr, ssize_t size); #ifdef CONFIG_FAULT_INJECTION_DEBUG_FS only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/linux/fscache.h +++ linux-kvm-5.19.0/include/linux/fscache.h @@ -75,7 +75,7 @@ atomic_t n_accesses; /* Number of cache accesses in progress */ unsigned int debug_id; unsigned int key_hash; /* Hash of key string */ - char *key; /* Volume ID, eg. "afs@example.com@1234" */ + u8 *key; /* Volume ID, eg. "afs@example.com@1234" */ struct list_head proc_link; /* Link in /proc/fs/fscache/volumes */ struct hlist_bl_node hash_link; /* Link in hash table */ struct work_struct work; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/linux/mmc/mmc.h +++ linux-kvm-5.19.0/include/linux/mmc/mmc.h @@ -445,7 +445,7 @@ #define MMC_SECURE_TRIM1_ARG 0x80000001 #define MMC_SECURE_TRIM2_ARG 0x80008000 #define MMC_SECURE_ARGS 0x80000000 -#define MMC_TRIM_ARGS 0x00008001 +#define MMC_TRIM_OR_DISCARD_ARGS 0x00008003 #define mmc_driver_type_mask(n) (1 << (n)) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/linux/soundwire/sdw_intel.h +++ linux-kvm-5.19.0/include/linux/soundwire/sdw_intel.h @@ -9,6 +9,8 @@ #define SDW_SHIM_BASE 0x2C000 #define SDW_ALH_BASE 0x2C800 +#define SDW_SHIM_BASE_ACE 0x38000 +#define SDW_ALH_BASE_ACE 0x24000 #define SDW_LINK_BASE 0x30000 #define SDW_LINK_SIZE 0x10000 only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/linux/wireless.h +++ linux-kvm-5.19.0/include/linux/wireless.h @@ -26,7 +26,15 @@ struct __compat_iw_event { __u16 len; /* Real length of this stuff */ __u16 cmd; /* Wireless IOCTL */ - compat_caddr_t pointer; + + union { + compat_caddr_t pointer; + + /* we need ptr_bytes to make memcpy() run-time destination + * buffer bounds checking happy, nothing special + */ + DECLARE_FLEX_ARRAY(__u8, ptr_bytes); + }; }; #define IW_EV_COMPAT_LCP_LEN offsetof(struct __compat_iw_event, pointer) #define IW_EV_COMPAT_POINT_OFF offsetof(struct compat_iw_point, length) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/net/ip.h +++ linux-kvm-5.19.0/include/net/ip.h @@ -563,7 +563,7 @@ BUILD_BUG_ON(offsetof(typeof(flow->addrs), v4addrs.dst) != offsetof(typeof(flow->addrs), v4addrs.src) + sizeof(flow->addrs.v4addrs.src)); - memcpy(&flow->addrs.v4addrs, &iph->saddr, sizeof(flow->addrs.v4addrs)); + memcpy(&flow->addrs.v4addrs, &iph->addrs, sizeof(flow->addrs.v4addrs)); flow->control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/net/ipv6.h +++ linux-kvm-5.19.0/include/net/ipv6.h @@ -897,7 +897,7 @@ BUILD_BUG_ON(offsetof(typeof(flow->addrs), v6addrs.dst) != offsetof(typeof(flow->addrs), v6addrs.src) + sizeof(flow->addrs.v6addrs.src)); - memcpy(&flow->addrs.v6addrs, &iph->saddr, sizeof(flow->addrs.v6addrs)); + memcpy(&flow->addrs.v6addrs, &iph->addrs, sizeof(flow->addrs.v6addrs)); flow->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/net/sctp/stream_sched.h +++ linux-kvm-5.19.0/include/net/sctp/stream_sched.h @@ -26,6 +26,8 @@ int (*init)(struct sctp_stream *stream); /* Init a stream */ int (*init_sid)(struct sctp_stream *stream, __u16 sid, gfp_t gfp); + /* free a stream */ + void (*free_sid)(struct sctp_stream *stream, __u16 sid); /* Frees the entire thing */ void (*free)(struct sctp_stream *stream); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/sound/soc-acpi-intel-match.h +++ linux-kvm-5.19.0/include/sound/soc-acpi-intel-match.h @@ -30,6 +30,8 @@ extern struct snd_soc_acpi_mach snd_soc_acpi_intel_ehl_machines[]; extern struct snd_soc_acpi_mach snd_soc_acpi_intel_jsl_machines[]; extern struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_machines[]; extern struct snd_soc_acpi_mach snd_soc_acpi_intel_cnl_sdw_machines[]; extern struct snd_soc_acpi_mach snd_soc_acpi_intel_cfl_sdw_machines[]; @@ -37,6 +39,8 @@ extern struct snd_soc_acpi_mach snd_soc_acpi_intel_icl_sdw_machines[]; extern struct snd_soc_acpi_mach snd_soc_acpi_intel_tgl_sdw_machines[]; extern struct snd_soc_acpi_mach snd_soc_acpi_intel_adl_sdw_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_sdw_machines[]; +extern struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_sdw_machines[]; /* * generic table used for HDA codec-based platforms, possibly with only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/sound/sof/info.h +++ linux-kvm-5.19.0/include/sound/sof/info.h @@ -36,6 +36,10 @@ SOF_IPC_EXT_USER_ABI_INFO = 4, }; +/* Build u32 number in format MMmmmppp */ +#define SOF_FW_VER(MAJOR, MINOR, PATCH) ((uint32_t)( \ + ((MAJOR) << 24) | ((MINOR) << 12) | (PATCH))) + /* FW version - SOF_IPC_GLB_VERSION */ struct sof_ipc_fw_version { struct sof_ipc_hdr hdr; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/uapi/linux/capability.h +++ linux-kvm-5.19.0/include/uapi/linux/capability.h @@ -426,7 +426,7 @@ */ #define CAP_TO_INDEX(x) ((x) >> 5) /* 1 << 5 == bits in __u32 */ -#define CAP_TO_MASK(x) (1 << ((x) & 31)) /* mask for indexed __u32 */ +#define CAP_TO_MASK(x) (1U << ((x) & 31)) /* mask for indexed __u32 */ #endif /* _UAPI_LINUX_CAPABILITY_H */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/uapi/linux/idxd.h +++ linux-kvm-5.19.0/include/uapi/linux/idxd.h @@ -29,6 +29,7 @@ IDXD_SCMD_WQ_NO_SIZE = 0x800e0000, IDXD_SCMD_WQ_NO_PRIV = 0x800f0000, IDXD_SCMD_WQ_IRQ_ERR = 0x80100000, + IDXD_SCMD_WQ_USER_NO_IOMMU = 0x80110000, }; #define IDXD_SCMD_SOFTERR_MASK 0x80000000 only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/uapi/linux/ip.h +++ linux-kvm-5.19.0/include/uapi/linux/ip.h @@ -100,8 +100,10 @@ __u8 ttl; __u8 protocol; __sum16 check; - __be32 saddr; - __be32 daddr; + __struct_group(/* no tag */, addrs, /* no attrs */, + __be32 saddr; + __be32 daddr; + ); /*The options start here. */ }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/include/uapi/linux/ipv6.h +++ linux-kvm-5.19.0/include/uapi/linux/ipv6.h @@ -130,8 +130,10 @@ __u8 nexthdr; __u8 hop_limit; - struct in6_addr saddr; - struct in6_addr daddr; + __struct_group(/* no tag */, addrs, /* no attrs */, + struct in6_addr saddr; + struct in6_addr daddr; + ); }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/ipc/sem.c +++ linux-kvm-5.19.0/ipc/sem.c @@ -2179,14 +2179,15 @@ * scenarios where we were awakened externally, during the * window between wake_q_add() and wake_up_q(). */ + rcu_read_lock(); error = READ_ONCE(queue.status); if (error != -EINTR) { /* see SEM_BARRIER_2 for purpose/pairing */ smp_acquire__after_ctrl_dep(); + rcu_read_unlock(); goto out; } - rcu_read_lock(); locknum = sem_lock(sma, sops, nsops); if (!ipc_valid_object(&sma->sem_perm)) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/kernel/bpf/percpu_freelist.c +++ linux-kvm-5.19.0/kernel/bpf/percpu_freelist.c @@ -102,22 +102,21 @@ u32 nr_elems) { struct pcpu_freelist_head *head; - int i, cpu, pcpu_entries; + unsigned int cpu, cpu_idx, i, j, n, m; - pcpu_entries = nr_elems / num_possible_cpus() + 1; - i = 0; + n = nr_elems / num_possible_cpus(); + m = nr_elems % num_possible_cpus(); + cpu_idx = 0; for_each_possible_cpu(cpu) { -again: head = per_cpu_ptr(s->freelist, cpu); - /* No locking required as this is not visible yet. */ - pcpu_freelist_push_node(head, buf); - i++; - buf += elem_size; - if (i == nr_elems) - break; - if (i % pcpu_entries) - goto again; + j = n + (cpu_idx < m ? 1 : 0); + for (i = 0; i < j; i++) { + /* No locking required as this is not visible yet. */ + pcpu_freelist_push_node(head, buf); + buf += elem_size; + } + cpu_idx++; } } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/kernel/gcov/clang.c +++ linux-kvm-5.19.0/kernel/gcov/clang.c @@ -280,6 +280,8 @@ for (i = 0; i < sfn_ptr->num_counters; i++) dfn_ptr->counters[i] += sfn_ptr->counters[i]; + + sfn_ptr = list_next_entry(sfn_ptr, head); } } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/kernel/trace/rethook.c +++ linux-kvm-5.19.0/kernel/trace/rethook.c @@ -83,8 +83,10 @@ { struct rethook *rh = kzalloc(sizeof(struct rethook), GFP_KERNEL); - if (!rh || !handler) + if (!rh || !handler) { + kfree(rh); return NULL; + } rh->data = data; rh->handler = handler; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/kernel/trace/synth_event_gen_test.c +++ linux-kvm-5.19.0/kernel/trace/synth_event_gen_test.c @@ -120,15 +120,13 @@ /* Now generate a gen_synth_test event */ ret = synth_event_trace_array(gen_synth_test, vals, ARRAY_SIZE(vals)); - out: + free: + kfree(buf); return ret; delete: /* We got an error after creating the event, delete it */ synth_event_delete("gen_synth_test"); - free: - kfree(buf); - - goto out; + goto free; } /* @@ -227,15 +225,13 @@ /* Now trace an empty_synth_test event */ ret = synth_event_trace_array(empty_synth_test, vals, ARRAY_SIZE(vals)); - out: + free: + kfree(buf); return ret; delete: /* We got an error after creating the event, delete it */ synth_event_delete("empty_synth_test"); - free: - kfree(buf); - - goto out; + goto free; } static struct synth_field_desc create_synth_test_fields[] = { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/kernel/trace/trace_dynevent.c +++ linux-kvm-5.19.0/kernel/trace/trace_dynevent.c @@ -118,6 +118,7 @@ if (ret) break; } + tracing_reset_all_online_cpus(); mutex_unlock(&event_mutex); out: argv_free(argv); @@ -214,6 +215,7 @@ break; } out: + tracing_reset_all_online_cpus(); mutex_unlock(&event_mutex); return ret; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/kernel/trace/trace_events_hist.c +++ linux-kvm-5.19.0/kernel/trace/trace_events_hist.c @@ -5052,6 +5052,9 @@ void *key = NULL; unsigned int i; + if (unlikely(!rbe)) + return; + memset(compound_key, 0, hist_data->key_size); for_each_hist_key_field(i, hist_data) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/lib/fault-inject.c +++ linux-kvm-5.19.0/lib/fault-inject.c @@ -41,9 +41,6 @@ static void fail_dump(struct fault_attr *attr) { - if (attr->no_warn) - return; - if (attr->verbose > 0 && __ratelimit(&attr->ratelimit_state)) { printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n" "name %pd, interval %lu, probability %lu, " @@ -103,7 +100,7 @@ * http://www.nongnu.org/failmalloc/ */ -bool should_fail(struct fault_attr *attr, ssize_t size) +bool should_fail_ex(struct fault_attr *attr, ssize_t size, int flags) { if (in_task()) { unsigned int fail_nth = READ_ONCE(current->fail_nth); @@ -146,13 +143,19 @@ return false; fail: - fail_dump(attr); + if (!(flags & FAULT_NOWARN)) + fail_dump(attr); if (atomic_read(&attr->times) != -1) atomic_dec_not_zero(&attr->times); return true; } + +bool should_fail(struct fault_attr *attr, ssize_t size) +{ + return should_fail_ex(attr, size, 0); +} EXPORT_SYMBOL_GPL(should_fail); #ifdef CONFIG_FAULT_INJECTION_DEBUG_FS only in patch2: unchanged: --- linux-kvm-5.19.0.orig/lib/vdso/Makefile +++ linux-kvm-5.19.0/lib/vdso/Makefile @@ -17,6 +17,6 @@ endif quiet_cmd_vdso_check = VDSOCHK $@ - cmd_vdso_check = if $(OBJDUMP) -R $@ | egrep -h "$(ARCH_REL_TYPE_ABS)"; \ + cmd_vdso_check = if $(OBJDUMP) -R $@ | grep -E -h "$(ARCH_REL_TYPE_ABS)"; \ then (echo >&2 "$@: dynamic relocations are not supported"; \ rm -f $@; /bin/false); fi only in patch2: unchanged: --- linux-kvm-5.19.0.orig/mm/compaction.c +++ linux-kvm-5.19.0/mm/compaction.c @@ -989,28 +989,28 @@ } /* + * Be careful not to clear PageLRU until after we're + * sure the page is not being freed elsewhere -- the + * page release code relies on it. + */ + if (unlikely(!get_page_unless_zero(page))) + goto isolate_fail; + + /* * Migration will fail if an anonymous page is pinned in memory, * so avoid taking lru_lock and isolating it unnecessarily in an * admittedly racy check. */ mapping = page_mapping(page); - if (!mapping && page_count(page) > page_mapcount(page)) - goto isolate_fail; + if (!mapping && (page_count(page) - 1) > total_mapcount(page)) + goto isolate_fail_put; /* * Only allow to migrate anonymous pages in GFP_NOFS context * because those do not depend on fs locks. */ if (!(cc->gfp_mask & __GFP_FS) && mapping) - goto isolate_fail; - - /* - * Be careful not to clear PageLRU until after we're - * sure the page is not being freed elsewhere -- the - * page release code relies on it. - */ - if (unlikely(!get_page_unless_zero(page))) - goto isolate_fail; + goto isolate_fail_put; /* Only take pages on LRU: a check now makes later tests safe */ if (!PageLRU(page)) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/mm/failslab.c +++ linux-kvm-5.19.0/mm/failslab.c @@ -16,6 +16,8 @@ bool __should_failslab(struct kmem_cache *s, gfp_t gfpflags) { + int flags = 0; + /* No fault-injection for bootstrap cache */ if (unlikely(s == kmem_cache)) return false; @@ -30,10 +32,16 @@ if (failslab.cache_filter && !(s->flags & SLAB_FAILSLAB)) return false; + /* + * In some cases, it expects to specify __GFP_NOWARN + * to avoid printing any information(not just a warning), + * thus avoiding deadlocks. See commit 6b9dbedbe349 for + * details. + */ if (gfpflags & __GFP_NOWARN) - failslab.attr.no_warn = true; + flags |= FAULT_NOWARN; - return should_fail(&failslab.attr, s->object_size); + return should_fail_ex(&failslab.attr, s->object_size, flags); } static int __init setup_failslab(char *str) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/mm/maccess.c +++ linux-kvm-5.19.0/mm/maccess.c @@ -97,7 +97,7 @@ return src - unsafe_addr; Efault: pagefault_enable(); - dst[-1] = '\0'; + dst[0] = '\0'; return -EFAULT; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/mm/memcontrol.c +++ linux-kvm-5.19.0/mm/memcontrol.c @@ -2930,7 +2930,7 @@ { struct obj_cgroup *objcg; - if (!memcg_kmem_enabled() || memcg_kmem_bypass()) + if (!memcg_kmem_enabled()) return NULL; if (PageMemcgKmem(page)) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/mm/vmscan.c +++ linux-kvm-5.19.0/mm/vmscan.c @@ -2411,8 +2411,20 @@ * the flushers simply cannot keep up with the allocation * rate. Nudge the flusher threads in case they are asleep. */ - if (stat.nr_unqueued_dirty == nr_taken) + if (stat.nr_unqueued_dirty == nr_taken) { wakeup_flusher_threads(WB_REASON_VMSCAN); + /* + * For cgroupv1 dirty throttling is achieved by waking up + * the kernel flusher here and later waiting on folios + * which are in writeback to finish (see shrink_folio_list()). + * + * Flusher may not be able to issue writeback quickly + * enough for cgroupv1 writeback throttling to work + * on a large system. + */ + if (!writeback_throttling_sane(sc)) + reclaim_throttle(pgdat, VMSCAN_THROTTLE_WRITEBACK); + } sc->nr.dirty += stat.nr_dirty; sc->nr.congested += stat.nr_congested; @@ -2897,8 +2909,8 @@ enum lru_list lru; unsigned long nr_reclaimed = 0; unsigned long nr_to_reclaim = sc->nr_to_reclaim; + bool proportional_reclaim; struct blk_plug plug; - bool scan_adjusted; get_scan_count(lruvec, sc, nr); @@ -2916,8 +2928,8 @@ * abort proportional reclaim if either the file or anon lru has already * dropped to zero at the first pass. */ - scan_adjusted = (!cgroup_reclaim(sc) && !current_is_kswapd() && - sc->priority == DEF_PRIORITY); + proportional_reclaim = (!cgroup_reclaim(sc) && !current_is_kswapd() && + sc->priority == DEF_PRIORITY); blk_start_plug(&plug); while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] || @@ -2937,7 +2949,7 @@ cond_resched(); - if (nr_reclaimed < nr_to_reclaim || scan_adjusted) + if (nr_reclaimed < nr_to_reclaim || proportional_reclaim) continue; /* @@ -2988,8 +3000,6 @@ nr_scanned = targets[lru] - nr[lru]; nr[lru] = targets[lru] * (100 - percentage) / 100; nr[lru] -= min(nr[lru], nr_scanned); - - scan_adjusted = true; } blk_finish_plug(&plug); sc->nr_reclaimed += nr_reclaimed; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/bridge/br_vlan.c +++ linux-kvm-5.19.0/net/bridge/br_vlan.c @@ -959,6 +959,8 @@ list_for_each_entry(p, &br->port_list, list) { vg = nbp_vlan_group(p); list_for_each_entry(vlan, &vg->vlan_list, vlist) { + if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) + continue; err = vlan_vid_add(p->dev, proto, vlan->vid); if (err) goto err_filt; @@ -973,8 +975,11 @@ /* Delete VLANs for the old proto from the device filter. */ list_for_each_entry(p, &br->port_list, list) { vg = nbp_vlan_group(p); - list_for_each_entry(vlan, &vg->vlan_list, vlist) + list_for_each_entry(vlan, &vg->vlan_list, vlist) { + if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) + continue; vlan_vid_del(p->dev, oldproto, vlan->vid); + } } return 0; @@ -983,13 +988,19 @@ attr.u.vlan_protocol = ntohs(oldproto); switchdev_port_attr_set(br->dev, &attr, NULL); - list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist) + list_for_each_entry_continue_reverse(vlan, &vg->vlan_list, vlist) { + if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) + continue; vlan_vid_del(p->dev, proto, vlan->vid); + } list_for_each_entry_continue_reverse(p, &br->port_list, list) { vg = nbp_vlan_group(p); - list_for_each_entry(vlan, &vg->vlan_list, vlist) + list_for_each_entry(vlan, &vg->vlan_list, vlist) { + if (vlan->priv_flags & BR_VLFLAG_ADDED_BY_SWITCHDEV) + continue; vlan_vid_del(p->dev, proto, vlan->vid); + } } return err; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/caif/chnl_net.c +++ linux-kvm-5.19.0/net/caif/chnl_net.c @@ -310,9 +310,6 @@ if (result == 0) { pr_debug("connect timeout\n"); - caif_disconnect_client(dev_net(dev), &priv->chnl); - priv->state = CAIF_DISCONNECTED; - pr_debug("state disconnected\n"); result = -ETIMEDOUT; goto error; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/can/af_can.c +++ linux-kvm-5.19.0/net/can/af_can.c @@ -451,7 +451,7 @@ /* insert new receiver (dev,canid,mask) -> (func,data) */ - if (dev && dev->type != ARPHRD_CAN) + if (dev && (dev->type != ARPHRD_CAN || !can_get_ml_priv(dev))) return -ENODEV; if (dev && !net_eq(net, dev_net(dev))) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/can/isotp.c +++ linux-kvm-5.19.0/net/can/isotp.c @@ -111,6 +111,9 @@ #define ISOTP_FC_WT 1 /* wait */ #define ISOTP_FC_OVFLW 2 /* overflow */ +#define ISOTP_FC_TIMEOUT 1 /* 1 sec */ +#define ISOTP_ECHO_TIMEOUT 2 /* 2 secs */ + enum { ISOTP_IDLE = 0, ISOTP_WAIT_FIRST_FC, @@ -258,7 +261,8 @@ so->lastrxcf_tstamp = ktime_set(0, 0); /* start rx timeout watchdog */ - hrtimer_start(&so->rxtimer, ktime_set(1, 0), HRTIMER_MODE_REL_SOFT); + hrtimer_start(&so->rxtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), + HRTIMER_MODE_REL_SOFT); return 0; } @@ -344,6 +348,8 @@ return 0; } +static void isotp_send_cframe(struct isotp_sock *so); + static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae) { struct sock *sk = &so->sk; @@ -398,14 +404,15 @@ case ISOTP_FC_CTS: so->tx.bs = 0; so->tx.state = ISOTP_SENDING; - /* start cyclic timer for sending CF frame */ - hrtimer_start(&so->txtimer, so->tx_gap, + /* send CF frame and enable echo timeout handling */ + hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), HRTIMER_MODE_REL_SOFT); + isotp_send_cframe(so); break; case ISOTP_FC_WT: /* start timer to wait for next FC frame */ - hrtimer_start(&so->txtimer, ktime_set(1, 0), + hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), HRTIMER_MODE_REL_SOFT); break; @@ -600,7 +607,7 @@ /* perform blocksize handling, if enabled */ if (!so->rxfc.bs || ++so->rx.bs < so->rxfc.bs) { /* start rx timeout watchdog */ - hrtimer_start(&so->rxtimer, ktime_set(1, 0), + hrtimer_start(&so->rxtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), HRTIMER_MODE_REL_SOFT); return 0; } @@ -829,7 +836,7 @@ struct isotp_sock *so = isotp_sk(sk); struct canfd_frame *cf = (struct canfd_frame *)skb->data; - /* only handle my own local echo skb's */ + /* only handle my own local echo CF/SF skb's (no FF!) */ if (skb->sk != sk || so->cfecho != *(u32 *)cf->data) return; @@ -849,13 +856,16 @@ if (so->txfc.bs && so->tx.bs >= so->txfc.bs) { /* stop and wait for FC with timeout */ so->tx.state = ISOTP_WAIT_FC; - hrtimer_start(&so->txtimer, ktime_set(1, 0), + hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), HRTIMER_MODE_REL_SOFT); return; } /* no gap between data frames needed => use burst mode */ if (!so->tx_gap) { + /* enable echo timeout handling */ + hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), + HRTIMER_MODE_REL_SOFT); isotp_send_cframe(so); return; } @@ -879,7 +889,7 @@ /* start timeout for unlikely lost echo skb */ hrtimer_set_expires(&so->txtimer, ktime_add(ktime_get(), - ktime_set(2, 0))); + ktime_set(ISOTP_ECHO_TIMEOUT, 0))); restart = HRTIMER_RESTART; /* push out the next consecutive frame */ @@ -907,7 +917,8 @@ break; default: - WARN_ON_ONCE(1); + WARN_ONCE(1, "can-isotp: tx timer state %08X cfecho %08X\n", + so->tx.state, so->cfecho); } return restart; @@ -923,7 +934,7 @@ struct canfd_frame *cf; int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0; - s64 hrtimer_sec = 0; + s64 hrtimer_sec = ISOTP_ECHO_TIMEOUT; int off; int err; @@ -942,6 +953,8 @@ err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); if (err) goto err_out; + + so->tx.state = ISOTP_SENDING; } if (!size || size > MAX_MSG_LENGTH) { @@ -986,6 +999,10 @@ cf = (struct canfd_frame *)skb->data; skb_put_zero(skb, so->ll.mtu); + /* cfecho should have been zero'ed by init / former isotp_rcv_echo() */ + if (so->cfecho) + pr_notice_once("can-isotp: uninit cfecho %08X\n", so->cfecho); + /* check for single frame transmission depending on TX_DL */ if (size <= so->tx.ll_dl - SF_PCI_SZ4 - ae - off) { /* The message size generally fits into a SingleFrame - good. @@ -1011,11 +1028,8 @@ else cf->data[ae] |= size; - so->tx.state = ISOTP_IDLE; - wake_up_interruptible(&so->wait); - - /* don't enable wait queue for a single frame transmission */ - wait_tx_done = 0; + /* set CF echo tag for isotp_rcv_echo() (SF-mode) */ + so->cfecho = *(u32 *)cf->data; } else { /* send first frame */ @@ -1031,31 +1045,23 @@ /* disable wait for FCs due to activated block size */ so->txfc.bs = 0; - /* cfecho should have been zero'ed by init */ - if (so->cfecho) - pr_notice_once("can-isotp: no fc cfecho %08X\n", - so->cfecho); - - /* set consecutive frame echo tag */ + /* set CF echo tag for isotp_rcv_echo() (CF-mode) */ so->cfecho = *(u32 *)cf->data; - - /* switch directly to ISOTP_SENDING state */ - so->tx.state = ISOTP_SENDING; - - /* start timeout for unlikely lost echo skb */ - hrtimer_sec = 2; } else { /* standard flow control check */ so->tx.state = ISOTP_WAIT_FIRST_FC; /* start timeout for FC */ - hrtimer_sec = 1; - } + hrtimer_sec = ISOTP_FC_TIMEOUT; - hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0), - HRTIMER_MODE_REL_SOFT); + /* no CF echo tag for isotp_rcv_echo() (FF-mode) */ + so->cfecho = 0; + } } + hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0), + HRTIMER_MODE_REL_SOFT); + /* send the first or only CAN frame */ cf->flags = so->ll.tx_flags; @@ -1068,8 +1074,7 @@ __func__, ERR_PTR(err)); /* no transmission -> no timeout monitoring */ - if (hrtimer_sec) - hrtimer_cancel(&so->txtimer); + hrtimer_cancel(&so->txtimer); /* reset consecutive frame echo tag */ so->cfecho = 0; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/can/j1939/main.c +++ linux-kvm-5.19.0/net/can/j1939/main.c @@ -332,6 +332,9 @@ /* re-claim the CAN_HDR from the SKB */ cf = skb_push(skb, J1939_CAN_HDR); + /* initialize header structure */ + memset(cf, 0, J1939_CAN_HDR); + /* make it a full can frame again */ skb_put(skb, J1939_CAN_FTR + (8 - dlc)); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/dccp/ipv4.c +++ linux-kvm-5.19.0/net/dccp/ipv4.c @@ -136,6 +136,8 @@ * This unhashes the socket and releases the local port, if necessary. */ dccp_set_state(sk, DCCP_CLOSED); + if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK)) + inet_reset_saddr(sk); ip_rt_put(rt); sk->sk_route_caps = 0; inet->inet_dport = 0; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/dccp/ipv6.c +++ linux-kvm-5.19.0/net/dccp/ipv6.c @@ -967,6 +967,8 @@ late_failure: dccp_set_state(sk, DCCP_CLOSED); + if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK)) + inet_reset_saddr(sk); __sk_dst_reset(sk); failure: inet->inet_dport = 0; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/dsa/dsa_priv.h +++ linux-kvm-5.19.0/net/dsa/dsa_priv.h @@ -201,6 +201,7 @@ } /* port.c */ +bool dsa_port_supports_hwtstamp(struct dsa_port *dp, struct ifreq *ifr); void dsa_port_set_tag_protocol(struct dsa_port *cpu_dp, const struct dsa_device_ops *tag_ops); int dsa_port_set_state(struct dsa_port *dp, u8 state, bool do_fast_age); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/dsa/master.c +++ linux-kvm-5.19.0/net/dsa/master.c @@ -204,8 +204,7 @@ * switch in the tree that is PTP capable. */ list_for_each_entry(dp, &dst->ports, list) - if (dp->ds->ops->port_hwtstamp_get || - dp->ds->ops->port_hwtstamp_set) + if (dsa_port_supports_hwtstamp(dp, ifr)) return -EBUSY; break; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv4/Kconfig +++ linux-kvm-5.19.0/net/ipv4/Kconfig @@ -402,6 +402,16 @@ If unsure, say Y. +config INET_TABLE_PERTURB_ORDER + int "INET: Source port perturbation table size (as power of 2)" if EXPERT + default 16 + help + Source port perturbation table size (as power of 2) for + RFC 6056 3.3.4. Algorithm 4: Double-Hash Port Selection Algorithm. + + The default is almost always what you want. + Only change this if you know what you are doing. + config INET_XFRM_TUNNEL tristate select INET_TUNNEL only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv4/fib_semantics.c +++ linux-kvm-5.19.0/net/ipv4/fib_semantics.c @@ -888,13 +888,15 @@ return 1; } + if (fi->nh) { + if (cfg->fc_oif || cfg->fc_gw_family || cfg->fc_mp) + return 1; + return 0; + } + if (cfg->fc_oif || cfg->fc_gw_family) { struct fib_nh *nh; - /* cannot match on nexthop object attributes */ - if (fi->nh) - return 1; - nh = fib_info_nh(fi, 0); if (cfg->fc_encap) { if (fib_encap_match(net, cfg->fc_encap_type, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv4/fib_trie.c +++ linux-kvm-5.19.0/net/ipv4/fib_trie.c @@ -1381,8 +1381,10 @@ /* The alias was already inserted, so the node must exist. */ l = l ? l : fib_find_node(t, &tp, key); - if (WARN_ON_ONCE(!l)) + if (WARN_ON_ONCE(!l)) { + err = -ENOENT; goto out_free_new_fa; + } if (fib_find_alias(&l->leaf, new_fa->fa_slen, 0, 0, tb->tb_id, true) == new_fa) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv4/inet_connection_sock.c +++ linux-kvm-5.19.0/net/ipv4/inet_connection_sock.c @@ -1037,11 +1037,25 @@ } EXPORT_SYMBOL(inet_csk_prepare_forced_close); +static int inet_ulp_can_listen(const struct sock *sk) +{ + const struct inet_connection_sock *icsk = inet_csk(sk); + + if (icsk->icsk_ulp_ops && !icsk->icsk_ulp_ops->clone) + return -EINVAL; + + return 0; +} + int inet_csk_listen_start(struct sock *sk) { struct inet_connection_sock *icsk = inet_csk(sk); struct inet_sock *inet = inet_sk(sk); - int err = -EADDRINUSE; + int err; + + err = inet_ulp_can_listen(sk); + if (unlikely(err)) + return err; reqsk_queue_alloc(&icsk->icsk_accept_queue); @@ -1057,6 +1071,8 @@ * after validation is complete. */ inet_sk_state_store(sk, TCP_LISTEN); + /* get_port does not return an error code, yet */ + err = -EADDRINUSE; if (!sk->sk_prot->get_port(sk, inet->inet_num)) { inet->inet_sport = htons(inet->inet_num); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv4/ip_input.c +++ linux-kvm-5.19.0/net/ipv4/ip_input.c @@ -366,6 +366,11 @@ iph->tos, dev); if (unlikely(err)) goto drop_error; + } else { + struct in_device *in_dev = __in_dev_get_rcu(dev); + + if (in_dev && IN_DEV_ORCONF(in_dev, NOPOLICY)) + IPCB(skb)->flags |= IPSKB_NOPOLICY; } #ifdef CONFIG_IP_ROUTE_CLASSID only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv4/netfilter/ipt_CLUSTERIP.c +++ linux-kvm-5.19.0/net/ipv4/netfilter/ipt_CLUSTERIP.c @@ -435,7 +435,7 @@ switch (ctinfo) { case IP_CT_NEW: - ct->mark = hash; + WRITE_ONCE(ct->mark, hash); break; case IP_CT_RELATED: case IP_CT_RELATED_REPLY: @@ -452,7 +452,7 @@ #ifdef DEBUG nf_ct_dump_tuple_ip(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple); #endif - pr_debug("hash=%u ct_hash=%u ", hash, ct->mark); + pr_debug("hash=%u ct_hash=%u ", hash, READ_ONCE(ct->mark)); if (!clusterip_responsible(cipinfo->config, hash)) { pr_debug("not responsible\n"); return NF_DROP; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv4/tcp_cdg.c +++ linux-kvm-5.19.0/net/ipv4/tcp_cdg.c @@ -375,6 +375,7 @@ struct cdg *ca = inet_csk_ca(sk); struct tcp_sock *tp = tcp_sk(sk); + ca->gradients = NULL; /* We silently fall back to window = 1 if allocation fails. */ if (window > 1) ca->gradients = kcalloc(window, sizeof(ca->gradients[0]), @@ -388,6 +389,7 @@ struct cdg *ca = inet_csk_ca(sk); kfree(ca->gradients); + ca->gradients = NULL; } static struct tcp_congestion_ops tcp_cdg __read_mostly = { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv6/addrlabel.c +++ linux-kvm-5.19.0/net/ipv6/addrlabel.c @@ -437,6 +437,7 @@ { struct ifaddrlblmsg *ifal = nlmsg_data(nlh); ifal->ifal_family = AF_INET6; + ifal->__ifal_reserved = 0; ifal->ifal_prefixlen = prefixlen; ifal->ifal_flags = 0; ifal->ifal_index = ifindex; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/ipv6/xfrm6_policy.c +++ linux-kvm-5.19.0/net/ipv6/xfrm6_policy.c @@ -287,9 +287,13 @@ if (ret) goto out_state; - register_pernet_subsys(&xfrm6_net_ops); + ret = register_pernet_subsys(&xfrm6_net_ops); + if (ret) + goto out_protocol; out: return ret; +out_protocol: + xfrm6_protocol_fini(); out_state: xfrm6_state_fini(); out_policy: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/mac80211/mesh_pathtbl.c +++ linux-kvm-5.19.0/net/mac80211/mesh_pathtbl.c @@ -710,7 +710,7 @@ void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb) { - kfree_skb(skb); + ieee80211_free_txskb(&sdata->local->hw, skb); sdata->u.mesh.mshstats.dropped_frames_no_route++; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/mac80211/s1g.c +++ linux-kvm-5.19.0/net/mac80211/s1g.c @@ -112,6 +112,9 @@ goto out; } + /* TWT Information not supported yet */ + twt->control |= IEEE80211_TWT_CONTROL_RX_DISABLED; + drv_add_twt_setup(sdata->local, sdata, &sta->sta, twt); out: ieee80211_s1g_send_twt_setup(sdata, mgmt->sa, sdata->vif.addr, twt); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/netfilter/ipset/ip_set_core.c +++ linux-kvm-5.19.0/net/netfilter/ipset/ip_set_core.c @@ -1719,11 +1719,13 @@ skb2 = nlmsg_new(payload, GFP_KERNEL); if (!skb2) return -ENOMEM; - rep = __nlmsg_put(skb2, NETLINK_CB(skb).portid, - nlh->nlmsg_seq, NLMSG_ERROR, payload, 0); + rep = nlmsg_put(skb2, NETLINK_CB(skb).portid, + nlh->nlmsg_seq, NLMSG_ERROR, payload, 0); errmsg = nlmsg_data(rep); errmsg->error = ret; - memcpy(&errmsg->msg, nlh, nlh->nlmsg_len); + unsafe_memcpy(&errmsg->msg, nlh, nlh->nlmsg_len, + /* Bounds checked by the skb layer. */); + cmdattr = (void *)&errmsg->msg + min_len; ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/netfilter/ipset/ip_set_hash_ip.c +++ linux-kvm-5.19.0/net/netfilter/ipset/ip_set_hash_ip.c @@ -151,18 +151,16 @@ if (((u64)ip_to - ip + 1) >> (32 - h->netmask) > IPSET_MAX_RANGE) return -ERANGE; - if (retried) { + if (retried) ip = ntohl(h->next.ip); - e.ip = htonl(ip); - } for (; ip <= ip_to;) { + e.ip = htonl(ip); ret = adtfn(set, &e, &ext, &ext, flags); if (ret && !ip_set_eexist(ret, flags)) return ret; ip += hosts; - e.ip = htonl(ip); - if (e.ip == 0) + if (ip == 0) return 0; ret = 0; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/netfilter/nft_ct.c +++ linux-kvm-5.19.0/net/netfilter/nft_ct.c @@ -98,7 +98,7 @@ return; #ifdef CONFIG_NF_CONNTRACK_MARK case NFT_CT_MARK: - *dest = ct->mark; + *dest = READ_ONCE(ct->mark); return; #endif #ifdef CONFIG_NF_CONNTRACK_SECMARK @@ -297,8 +297,8 @@ switch (priv->key) { #ifdef CONFIG_NF_CONNTRACK_MARK case NFT_CT_MARK: - if (ct->mark != value) { - ct->mark = value; + if (READ_ONCE(ct->mark) != value) { + WRITE_ONCE(ct->mark, value); nf_conntrack_event_cache(IPCT_MARK, ct); } break; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/netfilter/xt_connmark.c +++ linux-kvm-5.19.0/net/netfilter/xt_connmark.c @@ -30,6 +30,7 @@ u_int32_t new_targetmark; struct nf_conn *ct; u_int32_t newmark; + u_int32_t oldmark; ct = nf_ct_get(skb, &ctinfo); if (ct == NULL) @@ -37,14 +38,15 @@ switch (info->mode) { case XT_CONNMARK_SET: - newmark = (ct->mark & ~info->ctmask) ^ info->ctmark; + oldmark = READ_ONCE(ct->mark); + newmark = (oldmark & ~info->ctmask) ^ info->ctmark; if (info->shift_dir == D_SHIFT_RIGHT) newmark >>= info->shift_bits; else newmark <<= info->shift_bits; - if (ct->mark != newmark) { - ct->mark = newmark; + if (READ_ONCE(ct->mark) != newmark) { + WRITE_ONCE(ct->mark, newmark); nf_conntrack_event_cache(IPCT_MARK, ct); } break; @@ -55,15 +57,15 @@ else new_targetmark <<= info->shift_bits; - newmark = (ct->mark & ~info->ctmask) ^ + newmark = (READ_ONCE(ct->mark) & ~info->ctmask) ^ new_targetmark; - if (ct->mark != newmark) { - ct->mark = newmark; + if (READ_ONCE(ct->mark) != newmark) { + WRITE_ONCE(ct->mark, newmark); nf_conntrack_event_cache(IPCT_MARK, ct); } break; case XT_CONNMARK_RESTORE: - new_targetmark = (ct->mark & info->ctmask); + new_targetmark = (READ_ONCE(ct->mark) & info->ctmask); if (info->shift_dir == D_SHIFT_RIGHT) new_targetmark >>= info->shift_bits; else @@ -126,7 +128,7 @@ if (ct == NULL) return false; - return ((ct->mark & info->mask) == info->mark) ^ info->invert; + return ((READ_ONCE(ct->mark) & info->mask) == info->mark) ^ info->invert; } static int connmark_mt_check(const struct xt_mtchk_param *par) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/netlink/af_netlink.c +++ linux-kvm-5.19.0/net/netlink/af_netlink.c @@ -2440,11 +2440,13 @@ return; } - rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, - NLMSG_ERROR, payload, flags); + rep = nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, + NLMSG_ERROR, payload, flags); errmsg = nlmsg_data(rep); errmsg->error = err; - memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh)); + unsafe_memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) + ? nlh->nlmsg_len : sizeof(*nlh), + /* Bounds checked by the skb layer. */); if (nlk_has_extack && extack) { if (extack->_msg) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/nfc/nci/core.c +++ linux-kvm-5.19.0/net/nfc/nci/core.c @@ -542,7 +542,7 @@ skb_queue_purge(&ndev->tx_q); ndev->ops->close(ndev); - ndev->flags = 0; + ndev->flags &= BIT(NCI_UNREG); } done: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/nfc/nci/data.c +++ linux-kvm-5.19.0/net/nfc/nci/data.c @@ -279,8 +279,10 @@ nci_plen(skb->data)); conn_info = nci_get_conn_info_by_conn_id(ndev, nci_conn_id(skb->data)); - if (!conn_info) + if (!conn_info) { + kfree_skb(skb); return; + } /* strip the nci data header */ skb_pull(skb, NCI_DATA_HDR_SIZE); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/openvswitch/conntrack.c +++ linux-kvm-5.19.0/net/openvswitch/conntrack.c @@ -152,7 +152,7 @@ static u32 ovs_ct_get_mark(const struct nf_conn *ct) { #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) - return ct ? ct->mark : 0; + return ct ? READ_ONCE(ct->mark) : 0; #else return 0; #endif @@ -340,9 +340,9 @@ #if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK) u32 new_mark; - new_mark = ct_mark | (ct->mark & ~(mask)); - if (ct->mark != new_mark) { - ct->mark = new_mark; + new_mark = ct_mark | (READ_ONCE(ct->mark) & ~(mask)); + if (READ_ONCE(ct->mark) != new_mark) { + WRITE_ONCE(ct->mark, new_mark); if (nf_ct_is_confirmed(ct)) nf_conntrack_event_cache(IPCT_MARK, ct); key->ct.mark = new_mark; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/rxrpc/conn_client.c +++ linux-kvm-5.19.0/net/rxrpc/conn_client.c @@ -40,6 +40,8 @@ DEFINE_IDR(rxrpc_client_conn_ids); static DEFINE_SPINLOCK(rxrpc_conn_id_lock); +static void rxrpc_deactivate_bundle(struct rxrpc_bundle *bundle); + /* * Get a connection ID and epoch for a client connection from the global pool. * The connection struct pointer is then recorded in the idr radix tree. The @@ -123,6 +125,7 @@ bundle->params = *cp; rxrpc_get_peer(bundle->params.peer); refcount_set(&bundle->ref, 1); + atomic_set(&bundle->active, 1); spin_lock_init(&bundle->channel_lock); INIT_LIST_HEAD(&bundle->waiting_calls); } @@ -149,7 +152,7 @@ dead = __refcount_dec_and_test(&bundle->ref, &r); - _debug("PUT B=%x %d", d, r); + _debug("PUT B=%x %d", d, r - 1); if (dead) rxrpc_free_bundle(bundle); } @@ -338,6 +341,7 @@ rxrpc_free_bundle(candidate); found_bundle: rxrpc_get_bundle(bundle); + atomic_inc(&bundle->active); spin_unlock(&local->client_bundles_lock); _leave(" = %u [found]", bundle->debug_id); return bundle; @@ -435,6 +439,7 @@ if (old) trace_rxrpc_client(old, -1, rxrpc_client_replace); candidate->bundle_shift = shift; + atomic_inc(&bundle->active); bundle->conns[i] = candidate; for (j = 0; j < RXRPC_MAXCALLS; j++) set_bit(shift + j, &bundle->avail_chans); @@ -725,6 +730,7 @@ smp_rmb(); out_put_bundle: + rxrpc_deactivate_bundle(bundle); rxrpc_put_bundle(bundle); out: _leave(" = %d", ret); @@ -900,9 +906,8 @@ static void rxrpc_unbundle_conn(struct rxrpc_connection *conn) { struct rxrpc_bundle *bundle = conn->bundle; - struct rxrpc_local *local = bundle->params.local; unsigned int bindex; - bool need_drop = false, need_put = false; + bool need_drop = false; int i; _enter("C=%x", conn->debug_id); @@ -921,15 +926,22 @@ } spin_unlock(&bundle->channel_lock); - /* If there are no more connections, remove the bundle */ - if (!bundle->avail_chans) { - _debug("maybe unbundle"); - spin_lock(&local->client_bundles_lock); - - for (i = 0; i < ARRAY_SIZE(bundle->conns); i++) - if (bundle->conns[i]) - break; - if (i == ARRAY_SIZE(bundle->conns) && !bundle->params.exclusive) { + if (need_drop) { + rxrpc_deactivate_bundle(bundle); + rxrpc_put_connection(conn); + } +} + +/* + * Drop the active count on a bundle. + */ +static void rxrpc_deactivate_bundle(struct rxrpc_bundle *bundle) +{ + struct rxrpc_local *local = bundle->params.local; + bool need_put = false; + + if (atomic_dec_and_lock(&bundle->active, &local->client_bundles_lock)) { + if (!bundle->params.exclusive) { _debug("erase bundle"); rb_erase(&bundle->local_node, &local->client_bundles); need_put = true; @@ -939,10 +951,6 @@ if (need_put) rxrpc_put_bundle(bundle); } - - if (need_drop) - rxrpc_put_connection(conn); - _leave(""); } /* only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sched/Kconfig +++ linux-kvm-5.19.0/net/sched/Kconfig @@ -976,7 +976,7 @@ config NET_ACT_CT tristate "connection tracking tc action" - depends on NET_CLS_ACT && NF_CONNTRACK && NF_NAT && NF_FLOW_TABLE + depends on NET_CLS_ACT && NF_CONNTRACK && (!NF_NAT || NF_NAT) && NF_FLOW_TABLE help Say Y here to allow sending the packets to conntrack module. only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sched/act_connmark.c +++ linux-kvm-5.19.0/net/sched/act_connmark.c @@ -62,7 +62,7 @@ c = nf_ct_get(skb, &ctinfo); if (c) { - skb->mark = c->mark; + skb->mark = READ_ONCE(c->mark); /* using overlimits stats to count how many packets marked */ ca->tcf_qstats.overlimits++; goto out; @@ -82,7 +82,7 @@ c = nf_ct_tuplehash_to_ctrack(thash); /* using overlimits stats to count how many packets marked */ ca->tcf_qstats.overlimits++; - skb->mark = c->mark; + skb->mark = READ_ONCE(c->mark); nf_ct_put(c); out: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sched/act_ctinfo.c +++ linux-kvm-5.19.0/net/sched/act_ctinfo.c @@ -33,7 +33,7 @@ { u8 dscp, newdscp; - newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) << 2) & + newdscp = (((READ_ONCE(ct->mark) & cp->dscpmask) >> cp->dscpmaskshift) << 2) & ~INET_ECN_MASK; switch (proto) { @@ -73,7 +73,7 @@ struct sk_buff *skb) { ca->stats_cpmark_set++; - skb->mark = ct->mark & cp->cpmarkmask; + skb->mark = READ_ONCE(ct->mark) & cp->cpmarkmask; } static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a, @@ -131,7 +131,7 @@ } if (cp->mode & CTINFO_MODE_DSCP) - if (!cp->dscpstatemask || (ct->mark & cp->dscpstatemask)) + if (!cp->dscpstatemask || (READ_ONCE(ct->mark) & cp->dscpstatemask)) tcf_ctinfo_dscp_set(ct, ca, cp, skb, wlen, proto); if (cp->mode & CTINFO_MODE_CPMARK) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sctp/outqueue.c +++ linux-kvm-5.19.0/net/sctp/outqueue.c @@ -384,6 +384,7 @@ { struct sctp_outq *q = &asoc->outqueue; struct sctp_chunk *chk, *temp; + struct sctp_stream_out *sout; q->sched->unsched_all(&asoc->stream); @@ -398,12 +399,14 @@ sctp_sched_dequeue_common(q, chk); asoc->sent_cnt_removable--; asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++; - if (chk->sinfo.sinfo_stream < asoc->stream.outcnt) { - struct sctp_stream_out *streamout = - SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream); - streamout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++; - } + sout = SCTP_SO(&asoc->stream, chk->sinfo.sinfo_stream); + sout->ext->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++; + + /* clear out_curr if all frag chunks are pruned */ + if (asoc->stream.out_curr == sout && + list_is_last(&chk->frag_list, &chk->msg->chunks)) + asoc->stream.out_curr = NULL; msg_len -= chk->skb->truesize + sizeof(struct sctp_chunk); sctp_chunk_free(chk); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sctp/stream.c +++ linux-kvm-5.19.0/net/sctp/stream.c @@ -52,6 +52,19 @@ } } +static void sctp_stream_free_ext(struct sctp_stream *stream, __u16 sid) +{ + struct sctp_sched_ops *sched; + + if (!SCTP_SO(stream, sid)->ext) + return; + + sched = sctp_sched_ops_from_stream(stream); + sched->free_sid(stream, sid); + kfree(SCTP_SO(stream, sid)->ext); + SCTP_SO(stream, sid)->ext = NULL; +} + /* Migrates chunks from stream queues to new stream queues if needed, * but not across associations. Also, removes those chunks to streams * higher than the new max. @@ -70,16 +83,14 @@ * sctp_stream_update will swap ->out pointers. */ for (i = 0; i < outcnt; i++) { - kfree(SCTP_SO(new, i)->ext); + sctp_stream_free_ext(new, i); SCTP_SO(new, i)->ext = SCTP_SO(stream, i)->ext; SCTP_SO(stream, i)->ext = NULL; } } - for (i = outcnt; i < stream->outcnt; i++) { - kfree(SCTP_SO(stream, i)->ext); - SCTP_SO(stream, i)->ext = NULL; - } + for (i = outcnt; i < stream->outcnt; i++) + sctp_stream_free_ext(stream, i); } static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, @@ -174,9 +185,9 @@ struct sctp_sched_ops *sched = sctp_sched_ops_from_stream(stream); int i; - sched->free(stream); + sched->unsched_all(stream); for (i = 0; i < stream->outcnt; i++) - kfree(SCTP_SO(stream, i)->ext); + sctp_stream_free_ext(stream, i); genradix_free(&stream->out); genradix_free(&stream->in); } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sctp/stream_sched.c +++ linux-kvm-5.19.0/net/sctp/stream_sched.c @@ -46,6 +46,10 @@ return 0; } +static void sctp_sched_fcfs_free_sid(struct sctp_stream *stream, __u16 sid) +{ +} + static void sctp_sched_fcfs_free(struct sctp_stream *stream) { } @@ -96,6 +100,7 @@ .get = sctp_sched_fcfs_get, .init = sctp_sched_fcfs_init, .init_sid = sctp_sched_fcfs_init_sid, + .free_sid = sctp_sched_fcfs_free_sid, .free = sctp_sched_fcfs_free, .enqueue = sctp_sched_fcfs_enqueue, .dequeue = sctp_sched_fcfs_dequeue, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sctp/stream_sched_prio.c +++ linux-kvm-5.19.0/net/sctp/stream_sched_prio.c @@ -204,6 +204,24 @@ return sctp_sched_prio_set(stream, sid, 0, gfp); } +static void sctp_sched_prio_free_sid(struct sctp_stream *stream, __u16 sid) +{ + struct sctp_stream_priorities *prio = SCTP_SO(stream, sid)->ext->prio_head; + int i; + + if (!prio) + return; + + SCTP_SO(stream, sid)->ext->prio_head = NULL; + for (i = 0; i < stream->outcnt; i++) { + if (SCTP_SO(stream, i)->ext && + SCTP_SO(stream, i)->ext->prio_head == prio) + return; + } + + kfree(prio); +} + static void sctp_sched_prio_free(struct sctp_stream *stream) { struct sctp_stream_priorities *prio, *n; @@ -323,6 +341,7 @@ .get = sctp_sched_prio_get, .init = sctp_sched_prio_init, .init_sid = sctp_sched_prio_init_sid, + .free_sid = sctp_sched_prio_free_sid, .free = sctp_sched_prio_free, .enqueue = sctp_sched_prio_enqueue, .dequeue = sctp_sched_prio_dequeue, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sctp/stream_sched_rr.c +++ linux-kvm-5.19.0/net/sctp/stream_sched_rr.c @@ -90,6 +90,10 @@ return 0; } +static void sctp_sched_rr_free_sid(struct sctp_stream *stream, __u16 sid) +{ +} + static void sctp_sched_rr_free(struct sctp_stream *stream) { sctp_sched_rr_unsched_all(stream); @@ -177,6 +181,7 @@ .get = sctp_sched_rr_get, .init = sctp_sched_rr_init, .init_sid = sctp_sched_rr_init_sid, + .free_sid = sctp_sched_rr_free_sid, .free = sctp_sched_rr_free, .enqueue = sctp_sched_rr_enqueue, .dequeue = sctp_sched_rr_dequeue, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/sunrpc/auth_gss/auth_gss.c +++ linux-kvm-5.19.0/net/sunrpc/auth_gss/auth_gss.c @@ -1992,7 +1992,7 @@ goto unwrap_failed; mic.len = len; mic.data = kmalloc(len, GFP_KERNEL); - if (!mic.data) + if (ZERO_OR_NULL_PTR(mic.data)) goto unwrap_failed; if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len)) goto unwrap_failed; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/tipc/crypto.c +++ linux-kvm-5.19.0/net/tipc/crypto.c @@ -1971,6 +1971,9 @@ /* Ok, everything's fine, try to synch own keys according to peers' */ tipc_crypto_key_synch(rx, *skb); + /* Re-fetch skb cb as skb might be changed in tipc_msg_validate */ + skb_cb = TIPC_SKB_CB(*skb); + /* Mark skb decrypted */ skb_cb->decrypted = 1; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/tipc/netlink_compat.c +++ linux-kvm-5.19.0/net/tipc/netlink_compat.c @@ -880,7 +880,7 @@ }; ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req); - if (TLV_GET_DATA_LEN(msg->req) < sizeof(struct tipc_name_table_query)) + if (TLV_GET_DATA_LEN(msg->req) < (int)sizeof(struct tipc_name_table_query)) return -EINVAL; depth = ntohl(ntq->depth); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/wireless/wext-core.c +++ linux-kvm-5.19.0/net/wireless/wext-core.c @@ -468,6 +468,7 @@ struct __compat_iw_event *compat_event; struct compat_iw_point compat_wrqu; struct sk_buff *compskb; + int ptr_len; #endif /* @@ -582,6 +583,9 @@ nlmsg_end(skb, nlh); #ifdef CONFIG_COMPAT hdr_len = compat_event_type_size[descr->header_type]; + + /* ptr_len is remaining size in event header apart from LCP */ + ptr_len = hdr_len - IW_EV_COMPAT_LCP_LEN; event_len = hdr_len + extra_len; compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); @@ -612,16 +616,15 @@ if (descr->header_type == IW_HEADER_TYPE_POINT) { compat_wrqu.length = wrqu->data.length; compat_wrqu.flags = wrqu->data.flags; - memcpy(&compat_event->pointer, - ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF, - hdr_len - IW_EV_COMPAT_LCP_LEN); + memcpy(compat_event->ptr_bytes, + ((char *)&compat_wrqu) + IW_EV_COMPAT_POINT_OFF, + ptr_len); if (extra_len) - memcpy(((char *) compat_event) + hdr_len, - extra, extra_len); + memcpy(&compat_event->ptr_bytes[ptr_len], + extra, extra_len); } else { /* extra_len must be zero, so no if (extra) needed */ - memcpy(&compat_event->pointer, wrqu, - hdr_len - IW_EV_COMPAT_LCP_LEN); + memcpy(compat_event->ptr_bytes, wrqu, ptr_len); } nlmsg_end(compskb, nlh); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/x25/x25_dev.c +++ linux-kvm-5.19.0/net/x25/x25_dev.c @@ -117,7 +117,7 @@ if (!pskb_may_pull(skb, 1)) { x25_neigh_put(nb); - return 0; + goto drop; } switch (skb->data[0]) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/xfrm/xfrm_device.c +++ linux-kvm-5.19.0/net/xfrm/xfrm_device.c @@ -97,6 +97,18 @@ } } +static inline bool xmit_xfrm_check_overflow(struct sk_buff *skb) +{ + struct xfrm_offload *xo = xfrm_offload(skb); + __u32 seq = xo->seq.low; + + seq += skb_shinfo(skb)->gso_segs; + if (unlikely(seq < xo->seq.low)) + return true; + + return false; +} + struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features, bool *again) { int err; @@ -134,7 +146,8 @@ return skb; } - if (skb_is_gso(skb) && unlikely(x->xso.dev != dev)) { + if (skb_is_gso(skb) && (unlikely(x->xso.dev != dev) || + unlikely(xmit_xfrm_check_overflow(skb)))) { struct sk_buff *segs; /* Packet got rerouted, fixup features and segment it. */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/net/xfrm/xfrm_replay.c +++ linux-kvm-5.19.0/net/xfrm/xfrm_replay.c @@ -714,7 +714,7 @@ oseq += skb_shinfo(skb)->gso_segs; } - if (unlikely(oseq < replay_esn->oseq)) { + if (unlikely(xo->seq.low < replay_esn->oseq)) { XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi; xo->seq.hi = oseq_hi; replay_esn->oseq_hi = oseq_hi; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/arm/pxa2xx-ac97-lib.c +++ linux-kvm-5.19.0/sound/arm/pxa2xx-ac97-lib.c @@ -402,8 +402,10 @@ goto err_clk2; irq = platform_get_irq(dev, 0); - if (!irq) + if (irq < 0) { + ret = irq; goto err_irq; + } ret = request_irq(irq, pxa2xx_ac97_irq, 0, "AC97", NULL); if (ret < 0) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/firewire/dice/dice-stream.c +++ linux-kvm-5.19.0/sound/firewire/dice/dice-stream.c @@ -59,7 +59,7 @@ static int select_clock(struct snd_dice *dice, unsigned int rate) { - __be32 reg; + __be32 reg, new; u32 data; int i; int err; @@ -83,15 +83,17 @@ if (completion_done(&dice->clock_accepted)) reinit_completion(&dice->clock_accepted); - reg = cpu_to_be32(data); + new = cpu_to_be32(data); err = snd_dice_transaction_write_global(dice, GLOBAL_CLOCK_SELECT, - ®, sizeof(reg)); + &new, sizeof(new)); if (err < 0) return err; if (wait_for_completion_timeout(&dice->clock_accepted, - msecs_to_jiffies(NOTIFICATION_TIMEOUT_MS)) == 0) - return -ETIMEDOUT; + msecs_to_jiffies(NOTIFICATION_TIMEOUT_MS)) == 0) { + if (reg != new) + return -ETIMEDOUT; + } return 0; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/hda/hdac_sysfs.c +++ linux-kvm-5.19.0/sound/hda/hdac_sysfs.c @@ -346,8 +346,10 @@ return -ENOMEM; kobject_init(kobj, &widget_ktype); err = kobject_add(kobj, parent, "%02x", nid); - if (err < 0) + if (err < 0) { + kobject_put(kobj); return err; + } err = sysfs_create_group(kobj, group); if (err < 0) { kobject_put(kobj); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/pci/hda/patch_ca0132.c +++ linux-kvm-5.19.0/sound/pci/hda/patch_ca0132.c @@ -1306,6 +1306,7 @@ SND_PCI_QUIRK(0x1458, 0xA026, "Gigabyte G1.Sniper Z97", QUIRK_R3DI), SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI), SND_PCI_QUIRK(0x3842, 0x1038, "EVGA X99 Classified", QUIRK_R3DI), + SND_PCI_QUIRK(0x3842, 0x1055, "EVGA Z390 DARK", QUIRK_R3DI), SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D), SND_PCI_QUIRK(0x1102, 0x0018, "Recon3D", QUIRK_R3D), SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5), only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/pci/hda/patch_cs8409.c +++ linux-kvm-5.19.0/sound/pci/hda/patch_cs8409.c @@ -888,7 +888,7 @@ /* Initialize CS42L42 companion codec */ cs8409_i2c_bulk_write(cs42l42, cs42l42->init_seq, cs42l42->init_seq_num); - usleep_range(20000, 25000); + usleep_range(30000, 35000); /* Clear interrupts, by reading interrupt status registers */ cs8409_i2c_bulk_read(cs42l42, irq_regs, ARRAY_SIZE(irq_regs)); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/hdac_hda.h +++ linux-kvm-5.19.0/sound/soc/codecs/hdac_hda.h @@ -14,7 +14,7 @@ HDAC_HDMI_1_DAI_ID, HDAC_HDMI_2_DAI_ID, HDAC_HDMI_3_DAI_ID, - HDAC_LAST_DAI_ID = HDAC_HDMI_3_DAI_ID, + HDAC_DAI_ID_NUM }; struct hdac_hda_pcm { @@ -24,7 +24,7 @@ struct hdac_hda_priv { struct hda_codec codec; - struct hdac_hda_pcm pcm[HDAC_LAST_DAI_ID]; + struct hdac_hda_pcm pcm[HDAC_DAI_ID_NUM]; bool need_display_power; }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/jz4725b.c +++ linux-kvm-5.19.0/sound/soc/codecs/jz4725b.c @@ -136,14 +136,17 @@ #define REG_CGR3_GO1L_OFFSET 0 #define REG_CGR3_GO1L_MASK (0x1f << REG_CGR3_GO1L_OFFSET) +#define REG_CGR10_GIL_OFFSET 0 +#define REG_CGR10_GIR_OFFSET 4 + struct jz_icdc { struct regmap *regmap; void __iomem *base; struct clk *clk; }; -static const SNDRV_CTL_TLVD_DECLARE_DB_LINEAR(jz4725b_dac_tlv, -2250, 0); -static const SNDRV_CTL_TLVD_DECLARE_DB_LINEAR(jz4725b_line_tlv, -1500, 600); +static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(jz4725b_adc_tlv, 0, 150, 0); +static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(jz4725b_dac_tlv, -2250, 150, 0); static const struct snd_kcontrol_new jz4725b_codec_controls[] = { SOC_DOUBLE_TLV("Master Playback Volume", @@ -151,11 +154,11 @@ REG_CGR1_GODL_OFFSET, REG_CGR1_GODR_OFFSET, 0xf, 1, jz4725b_dac_tlv), - SOC_DOUBLE_R_TLV("Master Capture Volume", - JZ4725B_CODEC_REG_CGR3, - JZ4725B_CODEC_REG_CGR2, - REG_CGR2_GO1R_OFFSET, - 0x1f, 1, jz4725b_line_tlv), + SOC_DOUBLE_TLV("Master Capture Volume", + JZ4725B_CODEC_REG_CGR10, + REG_CGR10_GIL_OFFSET, + REG_CGR10_GIR_OFFSET, + 0xf, 0, jz4725b_adc_tlv), SOC_SINGLE("Master Playback Switch", JZ4725B_CODEC_REG_CR1, REG_CR1_DAC_MUTE_OFFSET, 1, 1), @@ -180,7 +183,7 @@ jz4725b_codec_adc_src_texts, jz4725b_codec_adc_src_values); static const struct snd_kcontrol_new jz4725b_codec_adc_src_ctrl = - SOC_DAPM_ENUM("Route", jz4725b_codec_adc_src_enum); + SOC_DAPM_ENUM("ADC Source Capture Route", jz4725b_codec_adc_src_enum); static const struct snd_kcontrol_new jz4725b_codec_mixer_controls[] = { SOC_DAPM_SINGLE("Line In Bypass", JZ4725B_CODEC_REG_CR1, @@ -225,7 +228,7 @@ SND_SOC_DAPM_ADC("ADC", "Capture", JZ4725B_CODEC_REG_PMR1, REG_PMR1_SB_ADC_OFFSET, 1), - SND_SOC_DAPM_MUX("ADC Source", SND_SOC_NOPM, 0, 0, + SND_SOC_DAPM_MUX("ADC Source Capture Route", SND_SOC_NOPM, 0, 0, &jz4725b_codec_adc_src_ctrl), /* Mixer */ @@ -236,7 +239,8 @@ SND_SOC_DAPM_MIXER("DAC to Mixer", JZ4725B_CODEC_REG_CR1, REG_CR1_DACSEL_OFFSET, 0, NULL, 0), - SND_SOC_DAPM_MIXER("Line In", SND_SOC_NOPM, 0, 0, NULL, 0), + SND_SOC_DAPM_MIXER("Line In", JZ4725B_CODEC_REG_PMR1, + REG_PMR1_SB_LIN_OFFSET, 1, NULL, 0), SND_SOC_DAPM_MIXER("HP Out", JZ4725B_CODEC_REG_CR1, REG_CR1_HP_DIS_OFFSET, 1, NULL, 0), @@ -283,11 +287,11 @@ {"Mixer", NULL, "DAC to Mixer"}, {"Mixer to ADC", NULL, "Mixer"}, - {"ADC Source", "Mixer", "Mixer to ADC"}, - {"ADC Source", "Line In", "Line In"}, - {"ADC Source", "Mic 1", "Mic 1"}, - {"ADC Source", "Mic 2", "Mic 2"}, - {"ADC", NULL, "ADC Source"}, + {"ADC Source Capture Route", "Mixer", "Mixer to ADC"}, + {"ADC Source Capture Route", "Line In", "Line In"}, + {"ADC Source Capture Route", "Mic 1", "Mic 1"}, + {"ADC Source Capture Route", "Mic 2", "Mic 2"}, + {"ADC", NULL, "ADC Source Capture Route"}, {"Out Stage", NULL, "Mixer"}, {"HP Out", NULL, "Out Stage"}, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/max98373-i2c.c +++ linux-kvm-5.19.0/sound/soc/codecs/max98373-i2c.c @@ -550,6 +550,10 @@ max98373->cache = devm_kcalloc(&i2c->dev, max98373->cache_num, sizeof(*max98373->cache), GFP_KERNEL); + if (!max98373->cache) { + ret = -ENOMEM; + return ret; + } for (i = 0; i < max98373->cache_num; i++) max98373->cache[i].reg = max98373_i2c_cache_reg[i]; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/rt1019.c +++ linux-kvm-5.19.0/sound/soc/codecs/rt1019.c @@ -391,18 +391,18 @@ unsigned int rx_mask, int slots, int slot_width) { struct snd_soc_component *component = dai->component; - unsigned int val = 0, rx_slotnum; + unsigned int cn = 0, cl = 0, rx_slotnum; int ret = 0, first_bit; switch (slots) { case 4: - val |= RT1019_I2S_TX_4CH; + cn = RT1019_I2S_TX_4CH; break; case 6: - val |= RT1019_I2S_TX_6CH; + cn = RT1019_I2S_TX_6CH; break; case 8: - val |= RT1019_I2S_TX_8CH; + cn = RT1019_I2S_TX_8CH; break; case 2: break; @@ -412,16 +412,16 @@ switch (slot_width) { case 20: - val |= RT1019_I2S_DL_20; + cl = RT1019_TDM_CL_20; break; case 24: - val |= RT1019_I2S_DL_24; + cl = RT1019_TDM_CL_24; break; case 32: - val |= RT1019_I2S_DL_32; + cl = RT1019_TDM_CL_32; break; case 8: - val |= RT1019_I2S_DL_8; + cl = RT1019_TDM_CL_8; break; case 16: break; @@ -470,8 +470,10 @@ goto _set_tdm_err_; } + snd_soc_component_update_bits(component, RT1019_TDM_1, + RT1019_TDM_CL_MASK, cl); snd_soc_component_update_bits(component, RT1019_TDM_2, - RT1019_I2S_CH_TX_MASK | RT1019_I2S_DF_MASK, val); + RT1019_I2S_CH_TX_MASK, cn); _set_tdm_err_: return ret; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/rt1019.h +++ linux-kvm-5.19.0/sound/soc/codecs/rt1019.h @@ -95,6 +95,12 @@ #define RT1019_TDM_BCLK_MASK (0x1 << 6) #define RT1019_TDM_BCLK_NORM (0x0 << 6) #define RT1019_TDM_BCLK_INV (0x1 << 6) +#define RT1019_TDM_CL_MASK (0x7) +#define RT1019_TDM_CL_8 (0x4) +#define RT1019_TDM_CL_32 (0x3) +#define RT1019_TDM_CL_24 (0x2) +#define RT1019_TDM_CL_20 (0x1) +#define RT1019_TDM_CL_16 (0x0) /* 0x0401 TDM Control-2 */ #define RT1019_I2S_CH_TX_MASK (0x3 << 6) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/rt1308-sdw.h +++ linux-kvm-5.19.0/sound/soc/codecs/rt1308-sdw.h @@ -139,10 +139,12 @@ { 0x3005, 0x23 }, { 0x3008, 0x02 }, { 0x300a, 0x00 }, + { 0xc000 | (RT1308_DATA_PATH << 4), 0x00 }, { 0xc003 | (RT1308_DAC_SET << 4), 0x00 }, { 0xc000 | (RT1308_POWER << 4), 0x00 }, { 0xc001 | (RT1308_POWER << 4), 0x00 }, { 0xc002 | (RT1308_POWER << 4), 0x00 }, + { 0xc000 | (RT1308_POWER_STATUS << 4), 0x00 }, }; #define RT1308_SDW_OFFSET 0xc000 only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/rt5682s.c +++ linux-kvm-5.19.0/sound/soc/codecs/rt5682s.c @@ -1932,7 +1932,7 @@ unsigned int rx_mask, int slots, int slot_width) { struct snd_soc_component *component = dai->component; - unsigned int cl, val = 0; + unsigned int cl, val = 0, tx_slotnum; if (tx_mask || rx_mask) snd_soc_component_update_bits(component, @@ -1941,6 +1941,16 @@ snd_soc_component_update_bits(component, RT5682S_TDM_ADDA_CTRL_2, RT5682S_TDM_EN, 0); + /* Tx slot configuration */ + tx_slotnum = hweight_long(tx_mask); + if (tx_slotnum) { + if (tx_slotnum > slots) { + dev_err(component->dev, "Invalid or oversized Tx slots.\n"); + return -EINVAL; + } + val |= (tx_slotnum - 1) << RT5682S_TDM_ADC_DL_SFT; + } + switch (slots) { case 4: val |= RT5682S_TDM_TX_CH_4; @@ -1961,7 +1971,8 @@ } snd_soc_component_update_bits(component, RT5682S_TDM_CTRL, - RT5682S_TDM_TX_CH_MASK | RT5682S_TDM_RX_CH_MASK, val); + RT5682S_TDM_TX_CH_MASK | RT5682S_TDM_RX_CH_MASK | + RT5682S_TDM_ADC_DL_MASK, val); switch (slot_width) { case 8: only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/rt5682s.h +++ linux-kvm-5.19.0/sound/soc/codecs/rt5682s.h @@ -899,6 +899,7 @@ #define RT5682S_TDM_RX_CH_8 (0x3 << 8) #define RT5682S_TDM_ADC_LCA_MASK (0x7 << 4) #define RT5682S_TDM_ADC_LCA_SFT 4 +#define RT5682S_TDM_ADC_DL_MASK (0x3 << 0) #define RT5682S_TDM_ADC_DL_SFT 0 /* TDM control 2 (0x007a) */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/sgtl5000.c +++ linux-kvm-5.19.0/sound/soc/codecs/sgtl5000.c @@ -1795,6 +1795,7 @@ { struct sgtl5000_priv *sgtl5000 = i2c_get_clientdata(client); + regmap_write(sgtl5000->regmap, SGTL5000_CHIP_CLK_CTRL, SGTL5000_CHIP_CLK_CTRL_DEFAULT); regmap_write(sgtl5000->regmap, SGTL5000_CHIP_DIG_POWER, SGTL5000_DIG_POWER_DEFAULT); regmap_write(sgtl5000->regmap, SGTL5000_CHIP_ANA_POWER, SGTL5000_ANA_POWER_DEFAULT); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/codecs/wm8962.c +++ linux-kvm-5.19.0/sound/soc/codecs/wm8962.c @@ -1840,6 +1840,49 @@ 4, 1, 0, inmix_tlv), }; +static int tp_event(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) +{ + int ret, reg, val, mask; + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); + + ret = pm_runtime_resume_and_get(component->dev); + if (ret < 0) { + dev_err(component->dev, "Failed to resume device: %d\n", ret); + return ret; + } + + reg = WM8962_ADDITIONAL_CONTROL_4; + + if (!strcmp(w->name, "TEMP_HP")) { + mask = WM8962_TEMP_ENA_HP_MASK; + val = WM8962_TEMP_ENA_HP; + } else if (!strcmp(w->name, "TEMP_SPK")) { + mask = WM8962_TEMP_ENA_SPK_MASK; + val = WM8962_TEMP_ENA_SPK; + } else { + pm_runtime_put(component->dev); + return -EINVAL; + } + + switch (event) { + case SND_SOC_DAPM_POST_PMD: + val = 0; + fallthrough; + case SND_SOC_DAPM_POST_PMU: + ret = snd_soc_component_update_bits(component, reg, mask, val); + break; + default: + WARN(1, "Invalid event %d\n", event); + pm_runtime_put(component->dev); + return -EINVAL; + } + + pm_runtime_put(component->dev); + + return 0; +} + static int cp_event(struct snd_soc_dapm_widget *w, struct snd_kcontrol *kcontrol, int event) { @@ -2140,8 +2183,10 @@ SND_SOC_DAPM_SUPPLY_S("DSP2", 1, WM8962_DSP2_POWER_MANAGEMENT, WM8962_DSP2_ENA_SHIFT, 0, dsp2_event, SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD), -SND_SOC_DAPM_SUPPLY("TEMP_HP", WM8962_ADDITIONAL_CONTROL_4, 2, 0, NULL, 0), -SND_SOC_DAPM_SUPPLY("TEMP_SPK", WM8962_ADDITIONAL_CONTROL_4, 1, 0, NULL, 0), +SND_SOC_DAPM_SUPPLY("TEMP_HP", SND_SOC_NOPM, 0, 0, tp_event, + SND_SOC_DAPM_POST_PMU|SND_SOC_DAPM_POST_PMD), +SND_SOC_DAPM_SUPPLY("TEMP_SPK", SND_SOC_NOPM, 0, 0, tp_event, + SND_SOC_DAPM_POST_PMU|SND_SOC_DAPM_POST_PMD), SND_SOC_DAPM_MIXER("INPGAL", WM8962_LEFT_INPUT_PGA_CONTROL, 4, 0, inpgal, ARRAY_SIZE(inpgal)), @@ -3764,6 +3809,11 @@ if (ret < 0) goto err_pm_runtime; + regmap_update_bits(wm8962->regmap, WM8962_ADDITIONAL_CONTROL_4, + WM8962_TEMP_ENA_HP_MASK, 0); + regmap_update_bits(wm8962->regmap, WM8962_ADDITIONAL_CONTROL_4, + WM8962_TEMP_ENA_SPK_MASK, 0); + regcache_cache_only(wm8962->regmap, true); /* The drivers should power up as needed */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/fsl/fsl_esai.c +++ linux-kvm-5.19.0/sound/soc/fsl/fsl_esai.c @@ -1068,7 +1068,7 @@ regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0); ret = pm_runtime_put_sync(&pdev->dev); - if (ret < 0) + if (ret < 0 && ret != -ENOSYS) goto err_pm_get_sync; /* only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/fsl/fsl_sai.c +++ linux-kvm-5.19.0/sound/soc/fsl/fsl_sai.c @@ -1004,6 +1004,7 @@ static int fsl_sai_probe(struct platform_device *pdev) { struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; struct fsl_sai *sai; struct regmap *gpr; struct resource *res; @@ -1012,12 +1013,12 @@ int irq, ret, i; int index; - sai = devm_kzalloc(&pdev->dev, sizeof(*sai), GFP_KERNEL); + sai = devm_kzalloc(dev, sizeof(*sai), GFP_KERNEL); if (!sai) return -ENOMEM; sai->pdev = pdev; - sai->soc_data = of_device_get_match_data(&pdev->dev); + sai->soc_data = of_device_get_match_data(dev); sai->is_lsb_first = of_property_read_bool(np, "lsb-first"); @@ -1032,18 +1033,18 @@ ARRAY_SIZE(fsl_sai_reg_defaults_ofs8); } - sai->regmap = devm_regmap_init_mmio(&pdev->dev, base, &fsl_sai_regmap_config); + sai->regmap = devm_regmap_init_mmio(dev, base, &fsl_sai_regmap_config); if (IS_ERR(sai->regmap)) { - dev_err(&pdev->dev, "regmap init failed\n"); + dev_err(dev, "regmap init failed\n"); return PTR_ERR(sai->regmap); } - sai->bus_clk = devm_clk_get(&pdev->dev, "bus"); + sai->bus_clk = devm_clk_get(dev, "bus"); /* Compatible with old DTB cases */ if (IS_ERR(sai->bus_clk) && PTR_ERR(sai->bus_clk) != -EPROBE_DEFER) - sai->bus_clk = devm_clk_get(&pdev->dev, "sai"); + sai->bus_clk = devm_clk_get(dev, "sai"); if (IS_ERR(sai->bus_clk)) { - dev_err(&pdev->dev, "failed to get bus clock: %ld\n", + dev_err(dev, "failed to get bus clock: %ld\n", PTR_ERR(sai->bus_clk)); /* -EPROBE_DEFER */ return PTR_ERR(sai->bus_clk); @@ -1051,9 +1052,9 @@ for (i = 1; i < FSL_SAI_MCLK_MAX; i++) { sprintf(tmp, "mclk%d", i); - sai->mclk_clk[i] = devm_clk_get(&pdev->dev, tmp); + sai->mclk_clk[i] = devm_clk_get(dev, tmp); if (IS_ERR(sai->mclk_clk[i])) { - dev_err(&pdev->dev, "failed to get mclk%d clock: %ld\n", + dev_err(dev, "failed to get mclk%d clock: %ld\n", i + 1, PTR_ERR(sai->mclk_clk[i])); sai->mclk_clk[i] = NULL; } @@ -1068,10 +1069,10 @@ if (irq < 0) return irq; - ret = devm_request_irq(&pdev->dev, irq, fsl_sai_isr, IRQF_SHARED, + ret = devm_request_irq(dev, irq, fsl_sai_isr, IRQF_SHARED, np->name, sai); if (ret) { - dev_err(&pdev->dev, "failed to claim irq %u\n", irq); + dev_err(dev, "failed to claim irq %u\n", irq); return ret; } @@ -1088,7 +1089,7 @@ if (of_find_property(np, "fsl,sai-synchronous-rx", NULL) && of_find_property(np, "fsl,sai-asynchronous", NULL)) { /* error out if both synchronous and asynchronous are present */ - dev_err(&pdev->dev, "invalid binding for synchronous mode\n"); + dev_err(dev, "invalid binding for synchronous mode\n"); return -EINVAL; } @@ -1109,7 +1110,7 @@ of_device_is_compatible(np, "fsl,imx6ul-sai")) { gpr = syscon_regmap_lookup_by_compatible("fsl,imx6ul-iomuxc-gpr"); if (IS_ERR(gpr)) { - dev_err(&pdev->dev, "cannot find iomuxc registers\n"); + dev_err(dev, "cannot find iomuxc registers\n"); return PTR_ERR(gpr); } @@ -1127,23 +1128,23 @@ sai->dma_params_tx.maxburst = FSL_SAI_MAXBURST_TX; platform_set_drvdata(pdev, sai); - pm_runtime_enable(&pdev->dev); - if (!pm_runtime_enabled(&pdev->dev)) { - ret = fsl_sai_runtime_resume(&pdev->dev); + pm_runtime_enable(dev); + if (!pm_runtime_enabled(dev)) { + ret = fsl_sai_runtime_resume(dev); if (ret) goto err_pm_disable; } - ret = pm_runtime_get_sync(&pdev->dev); + ret = pm_runtime_get_sync(dev); if (ret < 0) { - pm_runtime_put_noidle(&pdev->dev); + pm_runtime_put_noidle(dev); goto err_pm_get_sync; } /* Get sai version */ - ret = fsl_sai_check_version(&pdev->dev); + ret = fsl_sai_check_version(dev); if (ret < 0) - dev_warn(&pdev->dev, "Error reading SAI version: %d\n", ret); + dev_warn(dev, "Error reading SAI version: %d\n", ret); /* Select MCLK direction */ if (of_find_property(np, "fsl,sai-mclk-direction-output", NULL) && @@ -1152,8 +1153,8 @@ FSL_SAI_MCTL_MCLK_EN, FSL_SAI_MCTL_MCLK_EN); } - ret = pm_runtime_put_sync(&pdev->dev); - if (ret < 0) + ret = pm_runtime_put_sync(dev); + if (ret < 0 && ret != -ENOSYS) goto err_pm_get_sync; /* @@ -1165,12 +1166,12 @@ if (ret) goto err_pm_get_sync; } else { - ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0); + ret = devm_snd_dmaengine_pcm_register(dev, NULL, 0); if (ret) goto err_pm_get_sync; } - ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component, + ret = devm_snd_soc_register_component(dev, &fsl_component, &sai->cpu_dai_drv, 1); if (ret) goto err_pm_get_sync; @@ -1178,10 +1179,10 @@ return ret; err_pm_get_sync: - if (!pm_runtime_status_suspended(&pdev->dev)) - fsl_sai_runtime_suspend(&pdev->dev); + if (!pm_runtime_status_suspended(dev)) + fsl_sai_runtime_suspend(dev); err_pm_disable: - pm_runtime_disable(&pdev->dev); + pm_runtime_disable(dev); return ret; } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/intel/boards/bytcht_es8316.c +++ linux-kvm-5.19.0/sound/soc/intel/boards/bytcht_es8316.c @@ -443,6 +443,13 @@ | BYT_CHT_ES8316_INTMIC_IN2_MAP | BYT_CHT_ES8316_JD_INVERTED), }, + { /* Nanote UMPC-01 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "RWC CO.,LTD"), + DMI_MATCH(DMI_PRODUCT_NAME, "UMPC-01"), + }, + .driver_data = (void *)BYT_CHT_ES8316_INTMIC_IN1_MAP, + }, { /* Teclast X98 Plus II */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "TECLAST"), only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/intel/common/Makefile +++ linux-kvm-5.19.0/sound/soc/intel/common/Makefile @@ -9,6 +9,7 @@ soc-acpi-intel-cml-match.o soc-acpi-intel-icl-match.o \ soc-acpi-intel-tgl-match.o soc-acpi-intel-ehl-match.o \ soc-acpi-intel-jsl-match.o soc-acpi-intel-adl-match.o \ + soc-acpi-intel-rpl-match.o soc-acpi-intel-mtl-match.o \ soc-acpi-intel-hda-match.o \ soc-acpi-intel-sdw-mockup-match.o only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/intel/common/soc-acpi-intel-icl-match.c +++ linux-kvm-5.19.0/sound/soc/intel/common/soc-acpi-intel-icl-match.c @@ -10,6 +10,11 @@ #include #include "../skylake/skl.h" +static const struct snd_soc_acpi_codecs essx_83x6 = { + .num_codecs = 3, + .codecs = { "ESSX8316", "ESSX8326", "ESSX8336"}, +}; + static struct skl_machine_pdata icl_pdata = { .use_tplg_pcm = true, }; @@ -27,6 +32,14 @@ .drv_name = "sof_rt5682", .sof_tplg_filename = "sof-icl-rt5682.tplg", }, + { + .comp_ids = &essx_83x6, + .drv_name = "sof-essx8336", + .sof_tplg_filename = "sof-icl-es8336", /* the tplg suffix is added at run time */ + .tplg_quirk_mask = SND_SOC_ACPI_TPLG_INTEL_SSP_NUMBER | + SND_SOC_ACPI_TPLG_INTEL_SSP_MSB | + SND_SOC_ACPI_TPLG_INTEL_DMIC_NUMBER, + }, {}, }; EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_icl_machines); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/intel/common/soc-acpi-intel-mtl-match.c +++ linux-kvm-5.19.0/sound/soc/intel/common/soc-acpi-intel-mtl-match.c @@ -0,0 +1,41 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * soc-acpi-intel-mtl-match.c - tables and support for MTL ACPI enumeration. + * + * Copyright (c) 2022, Intel Corporation. + * + */ + +#include +#include +#include "soc-acpi-intel-sdw-mockup-match.h" + +struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_machines[] = { + {}, +}; +EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_mtl_machines); + +/* this table is used when there is no I2S codec present */ +struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_sdw_machines[] = { + /* mockup tests need to be first */ + { + .link_mask = GENMASK(3, 0), + .links = sdw_mockup_headset_2amps_mic, + .drv_name = "sof_sdw", + .sof_tplg_filename = "sof-mtl-rt711-rt1308-rt715.tplg", + }, + { + .link_mask = BIT(0) | BIT(1) | BIT(3), + .links = sdw_mockup_headset_1amp_mic, + .drv_name = "sof_sdw", + .sof_tplg_filename = "sof-mtl-rt711-rt1308-mono-rt715.tplg", + }, + { + .link_mask = GENMASK(2, 0), + .links = sdw_mockup_mic_headset_1amp, + .drv_name = "sof_sdw", + .sof_tplg_filename = "sof-mtl-rt715-rt711-rt1308-mono.tplg", + }, + {}, +}; +EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_mtl_sdw_machines); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/intel/common/soc-acpi-intel-rpl-match.c +++ linux-kvm-5.19.0/sound/soc/intel/common/soc-acpi-intel-rpl-match.c @@ -0,0 +1,51 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * soc-apci-intel-rpl-match.c - tables and support for RPL ACPI enumeration. + * + * Copyright (c) 2022 Intel Corporation. + */ + +#include +#include + +static const struct snd_soc_acpi_endpoint single_endpoint = { + .num = 0, + .aggregated = 0, + .group_position = 0, + .group_id = 0, +}; + +static const struct snd_soc_acpi_adr_device rt711_0_adr[] = { + { + .adr = 0x000020025D071100ull, + .num_endpoints = 1, + .endpoints = &single_endpoint, + .name_prefix = "rt711" + } +}; + +static const struct snd_soc_acpi_link_adr rpl_rvp[] = { + { + .mask = BIT(0), + .num_adr = ARRAY_SIZE(rt711_0_adr), + .adr_d = rt711_0_adr, + }, + {} +}; + +struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_machines[] = { + {}, +}; +EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_rpl_machines); + +/* this table is used when there is no I2S codec present */ +struct snd_soc_acpi_mach snd_soc_acpi_intel_rpl_sdw_machines[] = { + { + .link_mask = 0x1, /* link0 required */ + .links = rpl_rvp, + .drv_name = "sof_sdw", + .sof_tplg_filename = "sof-rpl-rt711.tplg", + }, + {}, +}; +EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_rpl_sdw_machines); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/soc-ops.c +++ linux-kvm-5.19.0/sound/soc/soc-ops.c @@ -435,7 +435,7 @@ val = ucontrol->value.integer.value[0]; if (mc->platform_max && val > mc->platform_max) return -EINVAL; - if (val > max - min) + if (val > max) return -EINVAL; val_mask = mask << shift; val = (val + min) & mask; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/soc-utils.c +++ linux-kvm-5.19.0/sound/soc/soc-utils.c @@ -264,7 +264,7 @@ return ret; } -void __exit snd_soc_util_exit(void) +void snd_soc_util_exit(void) { platform_driver_unregister(&soc_dummy_driver); platform_device_unregister(soc_dummy_dev); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/Kconfig +++ linux-kvm-5.19.0/sound/soc/sof/intel/Kconfig @@ -210,6 +210,22 @@ Say Y if you have such a device. If unsure select "N". +config SND_SOC_SOF_INTEL_MTL + tristate + select SND_SOC_SOF_HDA_COMMON + select SND_SOC_SOF_INTEL_SOUNDWIRE_LINK_BASELINE + select SND_SOC_SOF_INTEL_IPC4 + +config SND_SOC_SOF_METEORLAKE + tristate "SOF support for Meteorlake" + default SND_SOC_SOF_PCI + select SND_SOC_SOF_INTEL_MTL + help + This adds support for Sound Open Firmware for Intel(R) platforms + using the Meteorlake processors. + Say Y if you have such a device. + If unsure select "N". + config SND_SOC_SOF_HDA_COMMON tristate select SND_SOC_SOF_INTEL_COMMON only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/Makefile +++ linux-kvm-5.19.0/sound/soc/sof/intel/Makefile @@ -6,7 +6,7 @@ snd-sof-intel-hda-common-objs := hda.o hda-loader.o hda-stream.o hda-trace.o \ hda-dsp.o hda-ipc.o hda-ctrl.o hda-pcm.o \ hda-dai.o hda-bus.o \ - apl.o cnl.o tgl.o icl.o hda-common-ops.o + apl.o cnl.o tgl.o icl.o mtl.o hda-common-ops.o snd-sof-intel-hda-common-$(CONFIG_SND_SOC_SOF_HDA_PROBES) += hda-probes.o snd-sof-intel-hda-objs := hda-codec.o @@ -24,9 +24,11 @@ snd-sof-pci-intel-cnl-objs := pci-cnl.o snd-sof-pci-intel-icl-objs := pci-icl.o snd-sof-pci-intel-tgl-objs := pci-tgl.o +snd-sof-pci-intel-mtl-objs := pci-mtl.o obj-$(CONFIG_SND_SOC_SOF_MERRIFIELD) += snd-sof-pci-intel-tng.o obj-$(CONFIG_SND_SOC_SOF_INTEL_APL) += snd-sof-pci-intel-apl.o obj-$(CONFIG_SND_SOC_SOF_INTEL_CNL) += snd-sof-pci-intel-cnl.o obj-$(CONFIG_SND_SOC_SOF_INTEL_ICL) += snd-sof-pci-intel-icl.o obj-$(CONFIG_SND_SOC_SOF_INTEL_TGL) += snd-sof-pci-intel-tgl.o +obj-$(CONFIG_SND_SOC_SOF_INTEL_MTL) += snd-sof-pci-intel-mtl.o only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/apl.c +++ linux-kvm-5.19.0/sound/soc/sof/intel/apl.c @@ -101,6 +101,7 @@ .ssp_base_offset = APL_SSP_BASE_OFFSET, .quirks = SOF_INTEL_PROCEN_FMT_QUIRK, .check_ipc_irq = hda_dsp_check_ipc_irq, + .cl_init = cl_dsp_init, .hw_ip_version = SOF_INTEL_CAVS_1_5_PLUS, }; EXPORT_SYMBOL_NS(apl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/hda-loader.c +++ linux-kvm-5.19.0/sound/soc/sof/intel/hda-loader.c @@ -99,7 +99,7 @@ * power on all host managed cores and only unstall/run the boot core to boot the * DSP then turn off all non boot cores (if any) is powered on. */ -static int cl_dsp_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot) +int cl_dsp_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot) { struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; const struct sof_intel_dsp_desc *chip = hda->desc; @@ -369,9 +369,15 @@ static int hda_dsp_boot_imr(struct snd_sof_dev *sdev) { + const struct sof_intel_dsp_desc *chip_info; int ret; - ret = cl_dsp_init(sdev, 0, true); + chip_info = get_chip_info(sdev->pdata); + if (chip_info->cl_init) + ret = chip_info->cl_init(sdev, 0, true); + else + ret = -EINVAL; + if (!ret) hda_sdw_process_wakeen(sdev); @@ -431,7 +437,10 @@ "Attempting iteration %d of Core En/ROM load...\n", i); hda->boot_iteration = i + 1; - ret = cl_dsp_init(sdev, hext_stream->hstream.stream_tag, false); + if (chip_info->cl_init) + ret = chip_info->cl_init(sdev, hext_stream->hstream.stream_tag, false); + else + ret = -EINVAL; /* don't retry anymore if successful */ if (!ret) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/hda.h +++ linux-kvm-5.19.0/sound/soc/sof/intel/hda.h @@ -605,6 +605,7 @@ int direction); int hda_cl_cleanup(struct snd_sof_dev *sdev, struct snd_dma_buffer *dmab, struct hdac_ext_stream *hext_stream); +int cl_dsp_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot); #define HDA_CL_STREAM_FORMAT 0x40 /* pre and post fw run ops */ @@ -716,6 +717,8 @@ int sof_tgl_ops_init(struct snd_sof_dev *sdev); extern struct snd_sof_dsp_ops sof_icl_ops; int sof_icl_ops_init(struct snd_sof_dev *sdev); +extern struct snd_sof_dsp_ops sof_mtl_ops; +int sof_mtl_ops_init(struct snd_sof_dev *sdev); extern const struct sof_intel_dsp_desc apl_chip_info; extern const struct sof_intel_dsp_desc cnl_chip_info; @@ -725,6 +728,7 @@ extern const struct sof_intel_dsp_desc ehl_chip_info; extern const struct sof_intel_dsp_desc jsl_chip_info; extern const struct sof_intel_dsp_desc adls_chip_info; +extern const struct sof_intel_dsp_desc mtl_chip_info; /* Probes support */ #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA_PROBES) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/icl.c +++ linux-kvm-5.19.0/sound/soc/sof/intel/icl.c @@ -152,6 +152,7 @@ .sdw_alh_base = SDW_ALH_BASE, .check_sdw_irq = hda_common_check_sdw_irq, .check_ipc_irq = hda_dsp_check_ipc_irq, + .cl_init = cl_dsp_init, .hw_ip_version = SOF_INTEL_CAVS_2_0, }; EXPORT_SYMBOL_NS(icl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/mtl.c +++ linux-kvm-5.19.0/sound/soc/sof/intel/mtl.c @@ -0,0 +1,800 @@ +// SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) +// +// Copyright(c) 2022 Intel Corporation. All rights reserved. +// +// Authors: Ranjani Sridharan +// + +/* + * Hardware interface for audio DSP on Meteorlake. + */ + +#include +#include +#include "../ipc4-priv.h" +#include "../ops.h" +#include "hda.h" +#include "hda-ipc.h" +#include "../sof-audio.h" +#include "mtl.h" + +static const struct snd_sof_debugfs_map mtl_dsp_debugfs[] = { + {"hda", HDA_DSP_HDA_BAR, 0, 0x4000, SOF_DEBUGFS_ACCESS_ALWAYS}, + {"pp", HDA_DSP_PP_BAR, 0, 0x1000, SOF_DEBUGFS_ACCESS_ALWAYS}, + {"dsp", HDA_DSP_BAR, 0, 0x10000, SOF_DEBUGFS_ACCESS_ALWAYS}, +}; + +static void mtl_ipc_host_done(struct snd_sof_dev *sdev) +{ + /* + * clear busy interrupt to tell dsp controller this interrupt has been accepted, + * not trigger it again + */ + snd_sof_dsp_update_bits_forced(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXTDR, + MTL_DSP_REG_HFIPCXTDR_BUSY, MTL_DSP_REG_HFIPCXTDR_BUSY); + /* + * clear busy bit to ack dsp the msg has been processed and send reply msg to dsp + */ + snd_sof_dsp_update_bits_forced(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXTDA, + MTL_DSP_REG_HFIPCXTDA_BUSY, 0); +} + +static void mtl_ipc_dsp_done(struct snd_sof_dev *sdev) +{ + /* + * set DONE bit - tell DSP we have received the reply msg from DSP, and processed it, + * don't send more reply to host + */ + snd_sof_dsp_update_bits_forced(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXIDA, + MTL_DSP_REG_HFIPCXIDA_DONE, MTL_DSP_REG_HFIPCXIDA_DONE); + + /* unmask Done interrupt */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXCTL, + MTL_DSP_REG_HFIPCXCTL_DONE, MTL_DSP_REG_HFIPCXCTL_DONE); +} + +/* Check if an IPC IRQ occurred */ +static bool mtl_dsp_check_ipc_irq(struct snd_sof_dev *sdev) +{ + u32 irq_status; + u32 hfintipptr; + + /* read Interrupt IP Pointer */ + hfintipptr = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_HFINTIPPTR) & MTL_HFINTIPPTR_PTR_MASK; + irq_status = snd_sof_dsp_read(sdev, HDA_DSP_BAR, hfintipptr + MTL_DSP_IRQSTS); + + dev_vdbg(sdev->dev, "irq handler: irq_status:0x%x\n", irq_status); + + if (irq_status != U32_MAX && (irq_status & MTL_DSP_IRQSTS_IPC)) + return true; + + return false; +} + +/* Check if an SDW IRQ occurred */ +static bool mtl_dsp_check_sdw_irq(struct snd_sof_dev *sdev) +{ + u32 irq_status; + u32 hfintipptr; + + /* read Interrupt IP Pointer */ + hfintipptr = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_HFINTIPPTR) & MTL_HFINTIPPTR_PTR_MASK; + irq_status = snd_sof_dsp_read(sdev, HDA_DSP_BAR, hfintipptr + MTL_DSP_IRQSTS); + + if (irq_status != U32_MAX && (irq_status & MTL_DSP_IRQSTS_SDW)) + return true; + + return false; +} + +static int mtl_ipc_send_msg(struct snd_sof_dev *sdev, struct snd_sof_ipc_msg *msg) +{ + struct sof_ipc4_msg *msg_data = msg->msg_data; + + /* send the message via mailbox */ + if (msg_data->data_size) + sof_mailbox_write(sdev, sdev->host_box.offset, msg_data->data_ptr, + msg_data->data_size); + + snd_sof_dsp_write(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXIDDY, + msg_data->extension); + snd_sof_dsp_write(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXIDR, + msg_data->primary | MTL_DSP_REG_HFIPCXIDR_BUSY); + + return 0; +} + +static void mtl_enable_ipc_interrupts(struct snd_sof_dev *sdev) +{ + struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; + const struct sof_intel_dsp_desc *chip = hda->desc; + + /* enable IPC DONE and BUSY interrupts */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, chip->ipc_ctl, + MTL_DSP_REG_HFIPCXCTL_BUSY | MTL_DSP_REG_HFIPCXCTL_DONE, + MTL_DSP_REG_HFIPCXCTL_BUSY | MTL_DSP_REG_HFIPCXCTL_DONE); +} + +static void mtl_disable_ipc_interrupts(struct snd_sof_dev *sdev) +{ + struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; + const struct sof_intel_dsp_desc *chip = hda->desc; + + /* disable IPC DONE and BUSY interrupts */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, chip->ipc_ctl, + MTL_DSP_REG_HFIPCXCTL_BUSY | MTL_DSP_REG_HFIPCXCTL_DONE, 0); +} + +static int mtl_enable_interrupts(struct snd_sof_dev *sdev) +{ + u32 hfintipptr; + u32 irqinten; + u32 host_ipc; + u32 hipcie; + int ret; + + /* read Interrupt IP Pointer */ + hfintipptr = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_HFINTIPPTR) & MTL_HFINTIPPTR_PTR_MASK; + + /* Enable Host IPC and SOUNDWIRE */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, hfintipptr, + MTL_IRQ_INTEN_L_HOST_IPC_MASK | MTL_IRQ_INTEN_L_SOUNDWIRE_MASK, + MTL_IRQ_INTEN_L_HOST_IPC_MASK | MTL_IRQ_INTEN_L_SOUNDWIRE_MASK); + + /* check if operation was successful */ + host_ipc = MTL_IRQ_INTEN_L_HOST_IPC_MASK | MTL_IRQ_INTEN_L_SOUNDWIRE_MASK; + irqinten = snd_sof_dsp_read(sdev, HDA_DSP_BAR, hfintipptr); + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, hfintipptr, irqinten, + (irqinten & host_ipc) == host_ipc, + HDA_DSP_REG_POLL_INTERVAL_US, HDA_DSP_RESET_TIMEOUT_US); + if (ret < 0) { + dev_err(sdev->dev, "failed to enable Host IPC and/or SOUNDWIRE\n"); + return ret; + } + + /* Set Host IPC interrupt enable */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfHIPCIE, + MTL_DSP_REG_HfHIPCIE_IE_MASK, MTL_DSP_REG_HfHIPCIE_IE_MASK); + + /* check if operation was successful */ + host_ipc = MTL_DSP_REG_HfHIPCIE_IE_MASK; + hipcie = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfHIPCIE); + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfHIPCIE, hipcie, + (hipcie & host_ipc) == host_ipc, + HDA_DSP_REG_POLL_INTERVAL_US, HDA_DSP_RESET_TIMEOUT_US); + if (ret < 0) { + dev_err(sdev->dev, "failed to set Host IPC interrupt enable\n"); + return ret; + } + + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfSNDWIE, + MTL_DSP_REG_HfSNDWIE_IE_MASK, MTL_DSP_REG_HfSNDWIE_IE_MASK); + host_ipc = MTL_DSP_REG_HfSNDWIE_IE_MASK; + hipcie = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfSNDWIE); + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfSNDWIE, hipcie, + (hipcie & host_ipc) == host_ipc, + HDA_DSP_REG_POLL_INTERVAL_US, HDA_DSP_RESET_TIMEOUT_US); + if (ret < 0) + dev_err(sdev->dev, "failed to set SoundWire IPC interrupt enable\n"); + + return ret; +} + +static int mtl_disable_interrupts(struct snd_sof_dev *sdev) +{ + u32 hfintipptr; + u32 irqinten; + u32 host_ipc; + u32 hipcie; + int ret1; + int ret; + + /* read Interrupt IP Pointer */ + hfintipptr = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_HFINTIPPTR) & MTL_HFINTIPPTR_PTR_MASK; + + /* Disable Host IPC and SOUNDWIRE */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, hfintipptr, + MTL_IRQ_INTEN_L_HOST_IPC_MASK | MTL_IRQ_INTEN_L_SOUNDWIRE_MASK, 0); + + /* check if operation was successful */ + host_ipc = MTL_IRQ_INTEN_L_HOST_IPC_MASK | MTL_IRQ_INTEN_L_SOUNDWIRE_MASK; + irqinten = snd_sof_dsp_read(sdev, HDA_DSP_BAR, hfintipptr); + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, hfintipptr, irqinten, + (irqinten & host_ipc) == 0, + HDA_DSP_REG_POLL_INTERVAL_US, HDA_DSP_RESET_TIMEOUT_US); + /* Continue to disable other interrupts when error happens */ + if (ret < 0) + dev_err(sdev->dev, "failed to disable Host IPC and SoundWire\n"); + + /* Set Host IPC interrupt disable */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfHIPCIE, + MTL_DSP_REG_HfHIPCIE_IE_MASK, 0); + + /* check if operation was successful */ + host_ipc = MTL_DSP_REG_HfHIPCIE_IE_MASK; + hipcie = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfHIPCIE); + ret1 = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfHIPCIE, hipcie, + (hipcie & host_ipc) == 0, + HDA_DSP_REG_POLL_INTERVAL_US, + HDA_DSP_RESET_TIMEOUT_US); + if (ret1 < 0) { + dev_err(sdev->dev, "failed to set Host IPC interrupt disable\n"); + if (!ret) + ret = ret1; + } + + /* Set SoundWire IPC interrupt disable */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfSNDWIE, + MTL_DSP_REG_HfSNDWIE_IE_MASK, 0); + host_ipc = MTL_DSP_REG_HfSNDWIE_IE_MASK; + hipcie = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfSNDWIE); + ret1 = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_DSP_REG_HfSNDWIE, hipcie, + (hipcie & host_ipc) == 0, + HDA_DSP_REG_POLL_INTERVAL_US, + HDA_DSP_RESET_TIMEOUT_US); + if (ret1 < 0) { + dev_err(sdev->dev, "failed to set SoundWire IPC interrupt disable\n"); + if (!ret) + ret = ret1; + } + + return ret; +} + +/* pre fw run operations */ +static int mtl_dsp_pre_fw_run(struct snd_sof_dev *sdev) +{ + u32 dsphfpwrsts; + u32 dsphfdsscs; + u32 cpa; + u32 pgs; + int ret; + + /* Set the DSP subsystem power on */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_HFDSSCS, + MTL_HFDSSCS_SPA_MASK, MTL_HFDSSCS_SPA_MASK); + + /* Wait for unstable CPA read (1 then 0 then 1) just after setting SPA bit */ + usleep_range(1000, 1010); + + /* poll with timeout to check if operation successful */ + cpa = MTL_HFDSSCS_CPA_MASK; + dsphfdsscs = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_HFDSSCS); + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_HFDSSCS, dsphfdsscs, + (dsphfdsscs & cpa) == cpa, HDA_DSP_REG_POLL_INTERVAL_US, + HDA_DSP_RESET_TIMEOUT_US); + if (ret < 0) { + dev_err(sdev->dev, "failed to enable DSP subsystem\n"); + return ret; + } + + /* Power up gated-DSP-0 domain in order to access the DSP shim register block. */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_HFPWRCTL, + MTL_HFPWRCTL_WPDSPHPXPG, MTL_HFPWRCTL_WPDSPHPXPG); + + usleep_range(1000, 1010); + + /* poll with timeout to check if operation successful */ + pgs = MTL_HFPWRSTS_DSPHPXPGS_MASK; + dsphfpwrsts = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_HFPWRSTS); + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_HFPWRSTS, dsphfpwrsts, + (dsphfpwrsts & pgs) == pgs, + HDA_DSP_REG_POLL_INTERVAL_US, + HDA_DSP_RESET_TIMEOUT_US); + if (ret < 0) + dev_err(sdev->dev, "failed to power up gated DSP domain\n"); + + /* make sure SoundWire is not power-gated */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_HDA_BAR, MTL_HFPWRCTL, + MTL_HfPWRCTL_WPIOXPG(1), MTL_HfPWRCTL_WPIOXPG(1)); + return ret; +} + +static int mtl_dsp_post_fw_run(struct snd_sof_dev *sdev) +{ + int ret; + + if (sdev->first_boot) { + struct sof_intel_hda_dev *hdev = sdev->pdata->hw_pdata; + + ret = hda_sdw_startup(sdev); + if (ret < 0) { + dev_err(sdev->dev, "could not startup SoundWire links\n"); + return ret; + } + + /* Check if IMR boot is usable */ + if (!sof_debug_check_flag(SOF_DBG_IGNORE_D3_PERSISTENT)) + hdev->imrboot_supported = true; + } + + hda_sdw_int_enable(sdev, true); + return 0; +} + +static void mtl_dsp_dump(struct snd_sof_dev *sdev, u32 flags) +{ + char *level = (flags & SOF_DBG_DUMP_OPTIONAL) ? KERN_DEBUG : KERN_ERR; + u32 romdbgsts; + u32 romdbgerr; + u32 fwsts; + u32 fwlec; + + fwsts = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_ROM_STS); + fwlec = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_ROM_ERROR); + romdbgsts = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFFLGPXQWY); + romdbgerr = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFFLGPXQWY_ERROR); + + dev_err(sdev->dev, "ROM status: %#x, ROM error: %#x\n", fwsts, fwlec); + dev_err(sdev->dev, "ROM debug status: %#x, ROM debug error: %#x\n", romdbgsts, + romdbgerr); + romdbgsts = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFFLGPXQWY + 0x8 * 3); + dev_printk(level, sdev->dev, "ROM feature bit%s enabled\n", + romdbgsts & BIT(24) ? "" : " not"); +} + +static bool mtl_dsp_primary_core_is_enabled(struct snd_sof_dev *sdev) +{ + int val; + + val = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP2CXCTL_PRIMARY_CORE); + if (val != U32_MAX && val & MTL_DSP2CXCTL_PRIMARY_CORE_CPA_MASK) + return true; + + return false; +} + +static int mtl_dsp_core_power_up(struct snd_sof_dev *sdev, int core) +{ + unsigned int cpa; + u32 dspcxctl; + int ret; + + /* Only the primary core can be powered up by the host */ + if (core != SOF_DSP_PRIMARY_CORE || mtl_dsp_primary_core_is_enabled(sdev)) + return 0; + + /* Program the owner of the IP & shim registers (10: Host CPU) */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP2CXCTL_PRIMARY_CORE, + MTL_DSP2CXCTL_PRIMARY_CORE_OSEL, + 0x2 << MTL_DSP2CXCTL_PRIMARY_CORE_OSEL_SHIFT); + + /* enable SPA bit */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP2CXCTL_PRIMARY_CORE, + MTL_DSP2CXCTL_PRIMARY_CORE_SPA_MASK, + MTL_DSP2CXCTL_PRIMARY_CORE_SPA_MASK); + + /* Wait for unstable CPA read (1 then 0 then 1) just after setting SPA bit */ + usleep_range(1000, 1010); + + /* poll with timeout to check if operation successful */ + cpa = MTL_DSP2CXCTL_PRIMARY_CORE_CPA_MASK; + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_DSP2CXCTL_PRIMARY_CORE, dspcxctl, + (dspcxctl & cpa) == cpa, HDA_DSP_REG_POLL_INTERVAL_US, + HDA_DSP_RESET_TIMEOUT_US); + if (ret < 0) { + dev_err(sdev->dev, "%s: timeout on MTL_DSP2CXCTL_PRIMARY_CORE read\n", + __func__); + return ret; + } + + /* did core power up ? */ + dspcxctl = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP2CXCTL_PRIMARY_CORE); + if ((dspcxctl & MTL_DSP2CXCTL_PRIMARY_CORE_CPA_MASK) + != MTL_DSP2CXCTL_PRIMARY_CORE_CPA_MASK) { + dev_err(sdev->dev, "power up core failed core %d adspcs %#x\n", + core, dspcxctl); + ret = -EIO; + } + + return ret; +} + +static int mtl_dsp_core_power_down(struct snd_sof_dev *sdev, int core) +{ + u32 dspcxctl; + int ret; + + /* Only the primary core can be powered down by the host */ + if (core != SOF_DSP_PRIMARY_CORE || !mtl_dsp_primary_core_is_enabled(sdev)) + return 0; + + /* disable SPA bit */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP2CXCTL_PRIMARY_CORE, + MTL_DSP2CXCTL_PRIMARY_CORE_SPA_MASK, 0); + + /* Wait for unstable CPA read (1 then 0 then 1) just after setting SPA bit */ + usleep_range(1000, 1010); + + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_DSP2CXCTL_PRIMARY_CORE, dspcxctl, + !(dspcxctl & MTL_DSP2CXCTL_PRIMARY_CORE_CPA_MASK), + HDA_DSP_REG_POLL_INTERVAL_US, + HDA_DSP_PD_TIMEOUT * USEC_PER_MSEC); + if (ret < 0) + dev_err(sdev->dev, "failed to power down primary core\n"); + + return ret; +} + +static int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot) +{ + struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; + const struct sof_intel_dsp_desc *chip = hda->desc; + unsigned int status; + u32 ipc_hdr; + int ret; + + /* step 1: purge FW request */ + ipc_hdr = chip->ipc_req_mask | HDA_DSP_ROM_IPC_CONTROL; + if (!imr_boot) + ipc_hdr |= HDA_DSP_ROM_IPC_PURGE_FW | ((stream_tag - 1) << 9); + + snd_sof_dsp_write(sdev, HDA_DSP_BAR, chip->ipc_req, ipc_hdr); + + /* step 2: power up primary core */ + ret = mtl_dsp_core_power_up(sdev, SOF_DSP_PRIMARY_CORE); + if (ret < 0) { + if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS) + dev_err(sdev->dev, "dsp core 0/1 power up failed\n"); + goto err; + } + + dev_dbg(sdev->dev, "Primary core power up successful\n"); + + /* step 3: wait for IPC DONE bit from ROM */ + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, chip->ipc_ack, status, + ((status & chip->ipc_ack_mask) == chip->ipc_ack_mask), + HDA_DSP_REG_POLL_INTERVAL_US, MTL_DSP_PURGE_TIMEOUT_US); + if (ret < 0) { + if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS) + dev_err(sdev->dev, "timeout waiting for purge IPC done\n"); + goto err; + } + + /* set DONE bit to clear the reply IPC message */ + snd_sof_dsp_update_bits_forced(sdev, HDA_DSP_BAR, chip->ipc_ack, chip->ipc_ack_mask, + chip->ipc_ack_mask); + + /* step 4: enable interrupts */ + ret = mtl_enable_interrupts(sdev); + if (ret < 0) { + if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS) + dev_err(sdev->dev, "%s: failed to enable interrupts\n", __func__); + goto err; + } + + mtl_enable_ipc_interrupts(sdev); + + /* + * ACE workaround: don't wait for ROM INIT. + * The platform cannot catch ROM_INIT_DONE because of a very short + * timing window. Follow the recommendations and skip this part. + */ + + return 0; + +err: + snd_sof_dsp_dbg_dump(sdev, "MTL DSP init fail", 0); + mtl_dsp_core_power_down(sdev, SOF_DSP_PRIMARY_CORE); + return ret; +} + +static irqreturn_t mtl_ipc_irq_thread(int irq, void *context) +{ + struct sof_ipc4_msg notification_data = {{ 0 }}; + struct snd_sof_dev *sdev = context; + bool ipc_irq = false; + u32 hipcida; + u32 hipctdr; + + hipcida = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXIDA); + + /* reply message from DSP */ + if (hipcida & MTL_DSP_REG_HFIPCXIDA_DONE) { + /* DSP received the message */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXCTL, + MTL_DSP_REG_HFIPCXCTL_DONE, 0); + + mtl_ipc_dsp_done(sdev); + + ipc_irq = true; + } + + hipctdr = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXTDR); + if (hipctdr & MTL_DSP_REG_HFIPCXTDR_BUSY) { + /* Message from DSP (reply or notification) */ + u32 extension = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXTDDY); + u32 primary = hipctdr & MTL_DSP_REG_HFIPCXTDR_MSG_MASK; + + /* + * ACE fw sends a new fw ipc message to host to + * notify the status of the last host ipc message + */ + if (primary & SOF_IPC4_MSG_DIR_MASK) { + /* Reply received */ + struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; + + data->primary = primary; + data->extension = extension; + + spin_lock_irq(&sdev->ipc_lock); + + snd_sof_ipc_get_reply(sdev); + snd_sof_ipc_reply(sdev, data->primary); + + spin_unlock_irq(&sdev->ipc_lock); + } else { + /* Notification received */ + notification_data.primary = primary; + notification_data.extension = extension; + + sdev->ipc->msg.rx_data = ¬ification_data; + snd_sof_ipc_msgs_rx(sdev); + sdev->ipc->msg.rx_data = NULL; + } + + mtl_ipc_host_done(sdev); + + ipc_irq = true; + } + + if (!ipc_irq) { + /* This interrupt is not shared so no need to return IRQ_NONE. */ + dev_dbg_ratelimited(sdev->dev, "%s nothing to do in IPC IRQ thread\n", + __func__); + } + + return IRQ_HANDLED; +} + +static int mtl_dsp_ipc_get_mailbox_offset(struct snd_sof_dev *sdev) +{ + return MTL_DSP_MBOX_UPLINK_OFFSET; +} + +static int mtl_dsp_ipc_get_window_offset(struct snd_sof_dev *sdev, u32 id) +{ + return MTL_SRAM_WINDOW_OFFSET(id); +} + +static int mtl_suspend(struct snd_sof_dev *sdev, bool runtime_suspend) +{ + struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; + const struct sof_intel_dsp_desc *chip = hda->desc; +#if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA) + struct hdac_bus *bus = sof_to_bus(sdev); +#endif + u32 dsphfdsscs; + u32 cpa; + int ret; + int i; + + mtl_disable_ipc_interrupts(sdev); + ret = mtl_disable_interrupts(sdev); + if (ret) + return ret; + +#if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA) + hda_codec_jack_wake_enable(sdev, runtime_suspend); + /* power down all hda link */ + snd_hdac_ext_bus_link_power_down_all(bus); +#endif + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_HFPWRCTL, + MTL_HFPWRCTL_WPDSPHPXPG, 0); + + /* Set the DSP subsystem power down */ + snd_sof_dsp_update_bits(sdev, HDA_DSP_BAR, MTL_HFDSSCS, + MTL_HFDSSCS_SPA_MASK, 0); + + /* Wait for unstable CPA read (1 then 0 then 1) just after setting SPA bit */ + usleep_range(1000, 1010); + + /* poll with timeout to check if operation successful */ + cpa = MTL_HFDSSCS_CPA_MASK; + dsphfdsscs = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_HFDSSCS); + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, MTL_HFDSSCS, dsphfdsscs, + (dsphfdsscs & cpa) == 0, HDA_DSP_REG_POLL_INTERVAL_US, + HDA_DSP_RESET_TIMEOUT_US); + if (ret < 0) + dev_err(sdev->dev, "failed to disable DSP subsystem\n"); + + /* reset ref counts for all cores */ + for (i = 0; i < chip->cores_num; i++) + sdev->dsp_core_ref_count[i] = 0; + + /* TODO: need to reset controller? */ + + /* display codec can be powered off after link reset */ + hda_codec_i915_display_power(sdev, false); + + return 0; +} + +static int mtl_dsp_suspend(struct snd_sof_dev *sdev, u32 target_state) +{ + const struct sof_dsp_power_state target_dsp_state = { + .state = target_state, + .substate = target_state == SOF_DSP_PM_D0 ? + SOF_HDA_DSP_PM_D0I3 : 0, + }; + int ret; + + ret = mtl_suspend(sdev, false); + if (ret < 0) + return ret; + + return snd_sof_dsp_set_power_state(sdev, &target_dsp_state); +} + +static int mtl_dsp_runtime_suspend(struct snd_sof_dev *sdev) +{ + const struct sof_dsp_power_state target_state = { + .state = SOF_DSP_PM_D3, + }; + int ret; + + ret = mtl_suspend(sdev, true); + if (ret < 0) + return ret; + + return snd_sof_dsp_set_power_state(sdev, &target_state); +} + +static int mtl_resume(struct snd_sof_dev *sdev, bool runtime_resume) +{ +#if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA) + struct hdac_bus *bus = sof_to_bus(sdev); + struct hdac_ext_link *hlink = NULL; +#endif + + /* display codec must be powered before link reset */ + hda_codec_i915_display_power(sdev, true); + +#if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA) + /* check jack status */ + if (runtime_resume) { + hda_codec_jack_wake_enable(sdev, false); + if (sdev->system_suspend_target == SOF_SUSPEND_NONE) + hda_codec_jack_check(sdev); + } + + /* turn off the links that were off before suspend */ + list_for_each_entry(hlink, &bus->hlink_list, list) { + if (!hlink->ref_count) + snd_hdac_ext_bus_link_power_down(hlink); + } + + /* check dma status and clean up CORB/RIRB buffers */ + if (!bus->cmd_dma_state) + snd_hdac_bus_stop_cmd_io(bus); +#endif + + return 0; +} + +static int mtl_dsp_resume(struct snd_sof_dev *sdev) +{ + const struct sof_dsp_power_state target_state = { + .state = SOF_DSP_PM_D0, + .substate = SOF_HDA_DSP_PM_D0I0, + }; + int ret; + + ret = mtl_resume(sdev, false); + if (ret < 0) + return ret; + + return snd_sof_dsp_set_power_state(sdev, &target_state); +} + +static int mtl_dsp_runtime_resume(struct snd_sof_dev *sdev) +{ + const struct sof_dsp_power_state target_state = { + .state = SOF_DSP_PM_D0, + }; + int ret; + + ret = mtl_resume(sdev, true); + if (ret < 0) + return ret; + + return snd_sof_dsp_set_power_state(sdev, &target_state); +} + +static void mtl_ipc_dump(struct snd_sof_dev *sdev) +{ + u32 hipcctl; + u32 hipcida; + u32 hipctdr; + + /* read IPC status */ + hipcida = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXIDA); + hipcctl = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXCTL); + hipctdr = snd_sof_dsp_read(sdev, HDA_DSP_BAR, MTL_DSP_REG_HFIPCXTDR); + + /* dump the IPC regs */ + /* TODO: parse the raw msg */ + dev_err(sdev->dev, + "error: host status 0x%8.8x dsp status 0x%8.8x mask 0x%8.8x\n", + hipcida, hipctdr, hipcctl); +} + +/* Meteorlake ops */ +struct snd_sof_dsp_ops sof_mtl_ops; +EXPORT_SYMBOL_NS(sof_mtl_ops, SND_SOC_SOF_INTEL_HDA_COMMON); + +int sof_mtl_ops_init(struct snd_sof_dev *sdev) +{ + struct sof_ipc4_fw_data *ipc4_data; + + /* common defaults */ + memcpy(&sof_mtl_ops, &sof_hda_common_ops, sizeof(struct snd_sof_dsp_ops)); + + /* shutdown */ + sof_mtl_ops.shutdown = hda_dsp_shutdown; + + /* doorbell */ + sof_mtl_ops.irq_thread = mtl_ipc_irq_thread; + + /* ipc */ + sof_mtl_ops.send_msg = mtl_ipc_send_msg; + sof_mtl_ops.get_mailbox_offset = mtl_dsp_ipc_get_mailbox_offset; + sof_mtl_ops.get_window_offset = mtl_dsp_ipc_get_window_offset; + + /* debug */ + sof_mtl_ops.debug_map = mtl_dsp_debugfs; + sof_mtl_ops.debug_map_count = ARRAY_SIZE(mtl_dsp_debugfs); + sof_mtl_ops.dbg_dump = mtl_dsp_dump; + sof_mtl_ops.ipc_dump = mtl_ipc_dump; + + /* pre/post fw run */ + sof_mtl_ops.pre_fw_run = mtl_dsp_pre_fw_run; + sof_mtl_ops.post_fw_run = mtl_dsp_post_fw_run; + + /* parse platform specific extended manifest */ + sof_mtl_ops.parse_platform_ext_manifest = NULL; + + /* dsp core get/put */ + /* TODO: add core_get and core_put */ + + /* PM */ + sof_mtl_ops.suspend = mtl_dsp_suspend; + sof_mtl_ops.resume = mtl_dsp_resume; + sof_mtl_ops.runtime_suspend = mtl_dsp_runtime_suspend; + sof_mtl_ops.runtime_resume = mtl_dsp_runtime_resume; + + sdev->private = devm_kzalloc(sdev->dev, sizeof(struct sof_ipc4_fw_data), GFP_KERNEL); + if (!sdev->private) + return -ENOMEM; + + ipc4_data = sdev->private; + ipc4_data->manifest_fw_hdr_offset = SOF_MAN4_FW_HDR_OFFSET; + + /* set DAI ops */ + hda_set_dai_drv_ops(sdev, &sof_mtl_ops); + + return 0; +}; +EXPORT_SYMBOL_NS(sof_mtl_ops_init, SND_SOC_SOF_INTEL_HDA_COMMON); + +const struct sof_intel_dsp_desc mtl_chip_info = { + .cores_num = 3, + .init_core_mask = BIT(0), + .host_managed_cores_mask = BIT(0), + .ipc_req = MTL_DSP_REG_HFIPCXIDR, + .ipc_req_mask = MTL_DSP_REG_HFIPCXIDR_BUSY, + .ipc_ack = MTL_DSP_REG_HFIPCXIDA, + .ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE, + .ipc_ctl = MTL_DSP_REG_HFIPCXCTL, + .rom_status_reg = MTL_DSP_ROM_STS, + .rom_init_timeout = 300, + .ssp_count = ICL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, + .sdw_shim_base = SDW_SHIM_BASE_ACE, + .sdw_alh_base = SDW_ALH_BASE_ACE, + .check_sdw_irq = mtl_dsp_check_sdw_irq, + .check_ipc_irq = mtl_dsp_check_ipc_irq, + .cl_init = mtl_dsp_cl_init, + .hw_ip_version = SOF_INTEL_ACE_1_0, +}; +EXPORT_SYMBOL_NS(mtl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/mtl.h +++ linux-kvm-5.19.0/sound/soc/sof/intel/mtl.h @@ -0,0 +1,76 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) */ +/* + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. + * + * Copyright(c) 2020-2022 Intel Corporation. All rights reserved. + */ + +/* DSP Registers */ +#define MTL_HFDSSCS 0x1000 +#define MTL_HFDSSCS_SPA_MASK BIT(16) +#define MTL_HFDSSCS_CPA_MASK BIT(24) +#define MTL_HFSNDWIE 0x114C +#define MTL_HFPWRCTL 0x1D18 +#define MTL_HfPWRCTL_WPIOXPG(x) BIT((x) + 8) +#define MTL_HFPWRCTL_WPDSPHPXPG BIT(0) +#define MTL_HFPWRSTS 0x1D1C +#define MTL_HFPWRSTS_DSPHPXPGS_MASK BIT(0) +#define MTL_HFINTIPPTR 0x1108 +#define MTL_IRQ_INTEN_L_HOST_IPC_MASK BIT(0) +#define MTL_IRQ_INTEN_L_SOUNDWIRE_MASK BIT(6) +#define MTL_HFINTIPPTR_PTR_MASK GENMASK(20, 0) + +#define MTL_DSP2CXCAP_PRIMARY_CORE 0x178D00 +#define MTL_DSP2CXCTL_PRIMARY_CORE 0x178D04 +#define MTL_DSP2CXCTL_PRIMARY_CORE_SPA_MASK BIT(0) +#define MTL_DSP2CXCTL_PRIMARY_CORE_CPA_MASK BIT(8) +#define MTL_DSP2CXCTL_PRIMARY_CORE_OSEL GENMASK(25, 24) +#define MTL_DSP2CXCTL_PRIMARY_CORE_OSEL_SHIFT 24 + +/* IPC Registers */ +#define MTL_DSP_REG_HFIPCXTDR 0x73200 +#define MTL_DSP_REG_HFIPCXTDR_BUSY BIT(31) +#define MTL_DSP_REG_HFIPCXTDR_MSG_MASK GENMASK(30, 0) +#define MTL_DSP_REG_HFIPCXTDA 0x73204 +#define MTL_DSP_REG_HFIPCXTDA_BUSY BIT(31) +#define MTL_DSP_REG_HFIPCXIDR 0x73210 +#define MTL_DSP_REG_HFIPCXIDR_BUSY BIT(31) +#define MTL_DSP_REG_HFIPCXIDR_MSG_MASK GENMASK(30, 0) +#define MTL_DSP_REG_HFIPCXIDA 0x73214 +#define MTL_DSP_REG_HFIPCXIDA_DONE BIT(31) +#define MTL_DSP_REG_HFIPCXIDA_MSG_MASK GENMASK(30, 0) +#define MTL_DSP_REG_HFIPCXCTL 0x73228 +#define MTL_DSP_REG_HFIPCXCTL_BUSY BIT(0) +#define MTL_DSP_REG_HFIPCXCTL_DONE BIT(1) +#define MTL_DSP_REG_HFIPCXTDDY 0x73300 +#define MTL_DSP_REG_HFIPCXIDDY 0x73380 +#define MTL_DSP_REG_HfHIPCIE 0x1140 +#define MTL_DSP_REG_HfHIPCIE_IE_MASK BIT(0) +#define MTL_DSP_REG_HfSNDWIE 0x114C +#define MTL_DSP_REG_HfSNDWIE_IE_MASK GENMASK(3, 0) + +#define MTL_DSP_IRQSTS 0x20 +#define MTL_DSP_IRQSTS_IPC BIT(0) +#define MTL_DSP_IRQSTS_SDW BIT(6) + +#define MTL_DSP_PURGE_TIMEOUT_US 20000000 /* 20s */ +#define MTL_DSP_REG_POLL_INTERVAL_US 10 /* 10 us */ + +/* Memory windows */ +#define MTL_SRAM_WINDOW_OFFSET(x) (0x180000 + 0x8000 * (x)) + +#define MTL_DSP_MBOX_UPLINK_OFFSET (MTL_SRAM_WINDOW_OFFSET(0) + 0x1000) +#define MTL_DSP_MBOX_UPLINK_SIZE 0x1000 +#define MTL_DSP_MBOX_DOWNLINK_OFFSET MTL_SRAM_WINDOW_OFFSET(1) +#define MTL_DSP_MBOX_DOWNLINK_SIZE 0x1000 + +/* FW registers */ +#define MTL_DSP_ROM_STS MTL_SRAM_WINDOW_OFFSET(0) /* ROM status */ +#define MTL_DSP_ROM_ERROR (MTL_SRAM_WINDOW_OFFSET(0) + 0x4) /* ROM error code */ + +#define MTL_DSP_REG_HFFLGPXQWY 0x163200 /* ROM debug status */ +#define MTL_DSP_REG_HFFLGPXQWY_ERROR 0x163204 /* ROM debug error code */ +#define MTL_DSP_REG_HfIMRIS1 0x162088 +#define MTL_DSP_REG_HfIMRIS1_IU_MASK BIT(0) + only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/pci-mtl.c +++ linux-kvm-5.19.0/sound/soc/sof/intel/pci-mtl.c @@ -0,0 +1,71 @@ +// SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause) +// +// This file is provided under a dual BSD/GPLv2 license. When using or +// redistributing this file, you may do so under either license. +// +// Copyright(c) 2018-2022 Intel Corporation. All rights reserved. +// +// Author: Ranjani Sridharan +// + +#include +#include +#include +#include +#include +#include "../ops.h" +#include "../sof-pci-dev.h" + +/* platform specific devices */ +#include "hda.h" +#include "mtl.h" + +static const struct sof_dev_desc mtl_desc = { + .use_acpi_target_states = true, + .machines = snd_soc_acpi_intel_mtl_machines, + .alt_machines = snd_soc_acpi_intel_mtl_sdw_machines, + .resindex_lpe_base = 0, + .resindex_pcicfg_base = -1, + .resindex_imr_base = -1, + .irqindex_host_ipc = -1, + .chip_info = &mtl_chip_info, + .ipc_supported_mask = BIT(SOF_INTEL_IPC4), + .ipc_default = SOF_INTEL_IPC4, + .default_fw_path = { + [SOF_INTEL_IPC4] = "intel/sof-ipc4/mtl", + }, + .default_tplg_path = { + [SOF_INTEL_IPC4] = "intel/sof-ace-tplg", + }, + .default_fw_filename = { + [SOF_INTEL_IPC4] = "dsp_basefw.bin", + }, + .nocodec_tplg_filename = "sof-mtl-nocodec.tplg", + .ops = &sof_mtl_ops, + .ops_init = sof_mtl_ops_init, +}; + +/* PCI IDs */ +static const struct pci_device_id sof_pci_ids[] = { + { PCI_DEVICE(0x8086, 0x7E28), /* MTL */ + .driver_data = (unsigned long)&mtl_desc}, + { 0, } +}; +MODULE_DEVICE_TABLE(pci, sof_pci_ids); + +/* pci_driver definition */ +static struct pci_driver snd_sof_pci_intel_mtl_driver = { + .name = "sof-audio-pci-intel-mtl", + .id_table = sof_pci_ids, + .probe = hda_pci_intel_probe, + .remove = sof_pci_remove, + .shutdown = sof_pci_shutdown, + .driver = { + .pm = &sof_pci_pm, + }, +}; +module_pci_driver(snd_sof_pci_intel_mtl_driver); + +MODULE_LICENSE("Dual BSD/GPL"); +MODULE_IMPORT_NS(SND_SOC_SOF_INTEL_HDA_COMMON); +MODULE_IMPORT_NS(SND_SOC_SOF_PCI_DEV); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/pci-tgl.c +++ linux-kvm-5.19.0/sound/soc/sof/intel/pci-tgl.c @@ -158,6 +158,62 @@ .ops_init = sof_tgl_ops_init, }; +static const struct sof_dev_desc rpls_desc = { + .machines = snd_soc_acpi_intel_rpl_machines, + .alt_machines = snd_soc_acpi_intel_rpl_sdw_machines, + .use_acpi_target_states = true, + .resindex_lpe_base = 0, + .resindex_pcicfg_base = -1, + .resindex_imr_base = -1, + .irqindex_host_ipc = -1, + .chip_info = &adls_chip_info, + .ipc_supported_mask = BIT(SOF_IPC) | BIT(SOF_INTEL_IPC4), + .ipc_default = SOF_IPC, + .default_fw_path = { + [SOF_IPC] = "intel/sof", + [SOF_INTEL_IPC4] = "intel/avs/rpl-s", + }, + .default_tplg_path = { + [SOF_IPC] = "intel/sof-tplg", + [SOF_INTEL_IPC4] = "intel/avs-tplg", + }, + .default_fw_filename = { + [SOF_IPC] = "sof-rpl-s.ri", + [SOF_INTEL_IPC4] = "dsp_basefw.bin", + }, + .nocodec_tplg_filename = "sof-rpl-nocodec.tplg", + .ops = &sof_tgl_ops, + .ops_init = sof_tgl_ops_init, +}; + +static const struct sof_dev_desc rpl_desc = { + .machines = snd_soc_acpi_intel_rpl_machines, + .alt_machines = snd_soc_acpi_intel_rpl_sdw_machines, + .use_acpi_target_states = true, + .resindex_lpe_base = 0, + .resindex_pcicfg_base = -1, + .resindex_imr_base = -1, + .irqindex_host_ipc = -1, + .chip_info = &tgl_chip_info, + .ipc_supported_mask = BIT(SOF_IPC) | BIT(SOF_INTEL_IPC4), + .ipc_default = SOF_IPC, + .default_fw_path = { + [SOF_IPC] = "intel/sof", + [SOF_INTEL_IPC4] = "intel/avs/rpl", + }, + .default_tplg_path = { + [SOF_IPC] = "intel/sof-tplg", + [SOF_INTEL_IPC4] = "intel/avs-tplg", + }, + .default_fw_filename = { + [SOF_IPC] = "sof-rpl.ri", + [SOF_INTEL_IPC4] = "dsp_basefw.bin", + }, + .nocodec_tplg_filename = "sof-rpl-nocodec.tplg", + .ops = &sof_tgl_ops, + .ops_init = sof_tgl_ops_init, +}; + /* PCI IDs */ static const struct pci_device_id sof_pci_ids[] = { { PCI_DEVICE(0x8086, 0xa0c8), /* TGL-LP */ @@ -171,7 +227,7 @@ { PCI_DEVICE(0x8086, 0x7ad0), /* ADL-S */ .driver_data = (unsigned long)&adls_desc}, { PCI_DEVICE(0x8086, 0x7a50), /* RPL-S */ - .driver_data = (unsigned long)&adls_desc}, + .driver_data = (unsigned long)&rpls_desc}, { PCI_DEVICE(0x8086, 0x51c8), /* ADL-P */ .driver_data = (unsigned long)&adl_desc}, { PCI_DEVICE(0x8086, 0x51cd), /* ADL-P */ @@ -179,9 +235,9 @@ { PCI_DEVICE(0x8086, 0x51c9), /* ADL-PS */ .driver_data = (unsigned long)&adl_desc}, { PCI_DEVICE(0x8086, 0x51ca), /* RPL-P */ - .driver_data = (unsigned long)&adl_desc}, + .driver_data = (unsigned long)&rpl_desc}, { PCI_DEVICE(0x8086, 0x51cb), /* RPL-P */ - .driver_data = (unsigned long)&adl_desc}, + .driver_data = (unsigned long)&rpl_desc}, { PCI_DEVICE(0x8086, 0x51cc), /* ADL-M */ .driver_data = (unsigned long)&adl_desc}, { PCI_DEVICE(0x8086, 0x54c8), /* ADL-N */ only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/shim.h +++ linux-kvm-5.19.0/sound/soc/sof/intel/shim.h @@ -20,6 +20,7 @@ SOF_INTEL_CAVS_1_8, /* CannonLake, CometLake, CoffeeLake */ SOF_INTEL_CAVS_2_0, /* IceLake, JasperLake */ SOF_INTEL_CAVS_2_5, /* TigerLake, AlderLake */ + SOF_INTEL_ACE_1_0, /* MeteorLake */ }; /* @@ -185,6 +186,7 @@ enum sof_intel_hw_ip_version hw_ip_version; bool (*check_sdw_irq)(struct snd_sof_dev *sdev); bool (*check_ipc_irq)(struct snd_sof_dev *sdev); + int (*cl_init)(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot); }; extern struct snd_sof_dsp_ops sof_tng_ops; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/intel/tgl.c +++ linux-kvm-5.19.0/sound/soc/sof/intel/tgl.c @@ -137,6 +137,7 @@ .sdw_alh_base = SDW_ALH_BASE, .check_sdw_irq = hda_common_check_sdw_irq, .check_ipc_irq = hda_dsp_check_ipc_irq, + .cl_init = cl_dsp_init, .hw_ip_version = SOF_INTEL_CAVS_2_5, }; EXPORT_SYMBOL_NS(tgl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); @@ -159,6 +160,7 @@ .sdw_alh_base = SDW_ALH_BASE, .check_sdw_irq = hda_common_check_sdw_irq, .check_ipc_irq = hda_dsp_check_ipc_irq, + .cl_init = cl_dsp_init, .hw_ip_version = SOF_INTEL_CAVS_2_5, }; EXPORT_SYMBOL_NS(tglh_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); @@ -181,6 +183,7 @@ .sdw_alh_base = SDW_ALH_BASE, .check_sdw_irq = hda_common_check_sdw_irq, .check_ipc_irq = hda_dsp_check_ipc_irq, + .cl_init = cl_dsp_init, .hw_ip_version = SOF_INTEL_CAVS_2_5, }; EXPORT_SYMBOL_NS(ehl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); @@ -203,6 +206,7 @@ .sdw_alh_base = SDW_ALH_BASE, .check_sdw_irq = hda_common_check_sdw_irq, .check_ipc_irq = hda_dsp_check_ipc_irq, + .cl_init = cl_dsp_init, .hw_ip_version = SOF_INTEL_CAVS_2_5, }; EXPORT_SYMBOL_NS(adls_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/soc/sof/topology.c +++ linux-kvm-5.19.0/sound/soc/sof/topology.c @@ -1316,16 +1316,6 @@ break; } - if (sof_debug_check_flag(SOF_DBG_DISABLE_MULTICORE)) { - swidget->core = SOF_DSP_PRIMARY_CORE; - } else { - int core = sof_get_token_value(SOF_TKN_COMP_CORE_ID, swidget->tuples, - swidget->num_tuples); - - if (core >= 0) - swidget->core = core; - } - /* check token parsing reply */ if (ret < 0) { dev_err(scomp->dev, @@ -1337,6 +1327,16 @@ return ret; } + if (sof_debug_check_flag(SOF_DBG_DISABLE_MULTICORE)) { + swidget->core = SOF_DSP_PRIMARY_CORE; + } else { + int core = sof_get_token_value(SOF_TKN_COMP_CORE_ID, swidget->tuples, + swidget->num_tuples); + + if (core >= 0) + swidget->core = core; + } + /* bind widget to external event */ if (tw->event_type) { if (widget_ops[w->id].bind_event) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/sound/usb/midi.c +++ linux-kvm-5.19.0/sound/usb/midi.c @@ -1133,10 +1133,8 @@ port = &umidi->endpoints[i].out->ports[j]; break; } - if (!port) { - snd_BUG(); + if (!port) return -ENXIO; - } substream->runtime->private_data = port; port->state = STATE_UNKNOWN; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/bpf/bpftool/common.c +++ linux-kvm-5.19.0/tools/bpf/bpftool/common.c @@ -273,6 +273,9 @@ int err; int fd; + if (!REQ_ARGS(3)) + return -EINVAL; + fd = get_fd(&argc, &argv); if (fd < 0) return fd; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/iio/iio_generic_buffer.c +++ linux-kvm-5.19.0/tools/iio/iio_generic_buffer.c @@ -715,12 +715,12 @@ continue; } - toread = buf_len; } else { usleep(timedelay); - toread = 64; } + toread = buf_len; + read_size = read(buf_fd, data, toread * scan_size); if (read_size < 0) { if (errno == EAGAIN) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/lib/bpf/ringbuf.c +++ linux-kvm-5.19.0/tools/lib/bpf/ringbuf.c @@ -59,6 +59,7 @@ __u32 len = sizeof(info); struct epoll_event *e; struct ring *r; + __u64 mmap_sz; void *tmp; int err; @@ -97,8 +98,7 @@ r->mask = info.max_entries - 1; /* Map writable consumer page */ - tmp = mmap(NULL, rb->page_size, PROT_READ | PROT_WRITE, MAP_SHARED, - map_fd, 0); + tmp = mmap(NULL, rb->page_size, PROT_READ | PROT_WRITE, MAP_SHARED, map_fd, 0); if (tmp == MAP_FAILED) { err = -errno; pr_warn("ringbuf: failed to mmap consumer page for map fd=%d: %d\n", @@ -111,8 +111,12 @@ * data size to allow simple reading of samples that wrap around the * end of a ring buffer. See kernel implementation for details. * */ - tmp = mmap(NULL, rb->page_size + 2 * info.max_entries, PROT_READ, - MAP_SHARED, map_fd, rb->page_size); + mmap_sz = rb->page_size + 2 * (__u64)info.max_entries; + if (mmap_sz != (__u64)(size_t)mmap_sz) { + pr_warn("ringbuf: ring buffer size (%u) is too big\n", info.max_entries); + return libbpf_err(-E2BIG); + } + tmp = mmap(NULL, (size_t)mmap_sz, PROT_READ, MAP_SHARED, map_fd, rb->page_size); if (tmp == MAP_FAILED) { err = -errno; ringbuf_unmap_ring(rb, r); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/perf/util/stat-display.c +++ linux-kvm-5.19.0/tools/perf/util/stat-display.c @@ -207,7 +207,7 @@ fputc('\n', os->fh); if (os->prefix) - fprintf(os->fh, "%s%s", os->prefix, config->csv_sep); + fprintf(os->fh, "%s", os->prefix); aggr_printout(config, os->evsel, os->id, os->nr); for (i = 0; i < os->nfields; i++) fputs(config->csv_sep, os->fh); @@ -436,6 +436,7 @@ [AGGR_SOCKET] = 2, [AGGR_DIE] = 2, [AGGR_CORE] = 2, + [AGGR_NODE] = 1, }; pm = print_metric_csv; @@ -983,6 +984,7 @@ [AGGR_SOCKET] = 12, [AGGR_NONE] = 6, [AGGR_THREAD] = 24, + [AGGR_NODE] = 6, [AGGR_GLOBAL] = 0, }; @@ -992,6 +994,7 @@ [AGGR_SOCKET] = "socket,cpus", [AGGR_NONE] = "cpu,", [AGGR_THREAD] = "comm-pid,", + [AGGR_NODE] = "node,", [AGGR_GLOBAL] = "" }; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/bpf/test_progs.c +++ linux-kvm-5.19.0/tools/testing/selftests/bpf/test_progs.c @@ -993,7 +993,7 @@ msg->subtest_done.have_log); break; case MSG_TEST_LOG: - sprintf(buf, "MSG_TEST_LOG (cnt: %ld, last: %d)", + sprintf(buf, "MSG_TEST_LOG (cnt: %zu, last: %d)", strlen(msg->test_log.log_buf), msg->test_log.is_last); break; only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/bpf/verifier/ref_tracking.c +++ linux-kvm-5.19.0/tools/testing/selftests/bpf/verifier/ref_tracking.c @@ -905,3 +905,39 @@ .result_unpriv = REJECT, .errstr_unpriv = "unknown func", }, +{ + "reference tracking: try to leak released ptr reg", + .insns = { + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -4), + BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4), + BPF_LD_MAP_FD(BPF_REG_1, 0), + BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem), + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), + BPF_EXIT_INSN(), + BPF_MOV64_REG(BPF_REG_9, BPF_REG_0), + + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_LD_MAP_FD(BPF_REG_1, 0), + BPF_MOV64_IMM(BPF_REG_2, 8), + BPF_MOV64_IMM(BPF_REG_3, 0), + BPF_EMIT_CALL(BPF_FUNC_ringbuf_reserve), + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), + BPF_EXIT_INSN(), + BPF_MOV64_REG(BPF_REG_8, BPF_REG_0), + + BPF_MOV64_REG(BPF_REG_1, BPF_REG_8), + BPF_MOV64_IMM(BPF_REG_2, 0), + BPF_EMIT_CALL(BPF_FUNC_ringbuf_discard), + BPF_MOV64_IMM(BPF_REG_0, 0), + + BPF_STX_MEM(BPF_DW, BPF_REG_9, BPF_REG_8, 0), + BPF_EXIT_INSN() + }, + .fixup_map_array_48b = { 4 }, + .fixup_map_ringbuf = { 11 }, + .result = ACCEPT, + .result_unpriv = REJECT, + .errstr_unpriv = "R8 !read_ok" +}, only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/futex/functional/Makefile +++ linux-kvm-5.19.0/tools/testing/selftests/futex/functional/Makefile @@ -3,11 +3,11 @@ CFLAGS := $(CFLAGS) -g -O2 -Wall -D_GNU_SOURCE -pthread $(INCLUDES) $(KHDR_INCLUDES) LDLIBS := -lpthread -lrt -HEADERS := \ +LOCAL_HDRS := \ ../include/futextest.h \ ../include/atomic.h \ ../include/logging.h -TEST_GEN_FILES := \ +TEST_GEN_PROGS := \ futex_wait_timeout \ futex_wait_wouldblock \ futex_requeue_pi \ @@ -25,5 +25,3 @@ KSFT_KHDR_INSTALL := 1 DEFAULT_INSTALL_HDR_PATH := 1 include ../../lib.mk - -$(TEST_GEN_FILES): $(HEADERS) only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/intel_pstate/Makefile +++ linux-kvm-5.19.0/tools/testing/selftests/intel_pstate/Makefile @@ -2,10 +2,10 @@ CFLAGS := $(CFLAGS) -Wall -D_GNU_SOURCE LDLIBS += -lm -uname_M := $(shell uname -m 2>/dev/null || echo not) -ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/) +ARCH ?= $(shell uname -m 2>/dev/null || echo not) +ARCH_PROCESSED := $(shell echo $(ARCH) | sed -e s/i.86/x86/ -e s/x86_64/x86/) -ifeq (x86,$(ARCH)) +ifeq (x86,$(ARCH_PROCESSED)) TEST_GEN_FILES := msr aperf endif only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/kexec/Makefile +++ linux-kvm-5.19.0/tools/testing/selftests/kexec/Makefile @@ -1,10 +1,10 @@ # SPDX-License-Identifier: GPL-2.0-only # Makefile for kexec tests -uname_M := $(shell uname -m 2>/dev/null || echo not) -ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/) +ARCH ?= $(shell uname -m 2>/dev/null || echo not) +ARCH_PROCESSED := $(shell echo $(ARCH) | sed -e s/i.86/x86/ -e s/x86_64/x86/) -ifeq ($(ARCH),$(filter $(ARCH),x86 ppc64le)) +ifeq ($(ARCH_PROCESSED),$(filter $(ARCH_PROCESSED),x86 ppc64le)) TEST_PROGS := test_kexec_load.sh test_kexec_file_load.sh TEST_FILES := kexec_common_lib.sh only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/net/cmsg_sender.c +++ linux-kvm-5.19.0/tools/testing/selftests/net/cmsg_sender.c @@ -110,7 +110,7 @@ static void cs_parse_args(int argc, char *argv[]) { - char o; + int o; while ((o = getopt(argc, argv, "46sS:p:m:M:d:tf:F:c:C:l:L:H:")) != -1) { switch (o) { only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/net/fib_nexthops.sh +++ linux-kvm-5.19.0/tools/testing/selftests/net/fib_nexthops.sh @@ -1223,6 +1223,22 @@ log_test $rc 0 "Delete nexthop route warning" run_cmd "$IP route delete 172.16.101.1/32 nhid 12" run_cmd "$IP nexthop del id 12" + + run_cmd "$IP nexthop add id 21 via 172.16.1.6 dev veth1" + run_cmd "$IP ro add 172.16.101.0/24 nhid 21" + run_cmd "$IP ro del 172.16.101.0/24 nexthop via 172.16.1.7 dev veth1 nexthop via 172.16.1.8 dev veth1" + log_test $? 2 "Delete multipath route with only nh id based entry" + + run_cmd "$IP nexthop add id 22 via 172.16.1.6 dev veth1" + run_cmd "$IP ro add 172.16.102.0/24 nhid 22" + run_cmd "$IP ro del 172.16.102.0/24 dev veth1" + log_test $? 2 "Delete route when specifying only nexthop device" + + run_cmd "$IP ro del 172.16.102.0/24 via 172.16.1.6" + log_test $? 2 "Delete route when specifying only gateway" + + run_cmd "$IP ro del 172.16.102.0/24" + log_test $? 0 "Delete route when not specifying nexthop attributes" } ipv4_grp_fcnal() only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ linux-kvm-5.19.0/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -2042,7 +2042,7 @@ pm_nl_set_limits $ns2 1 3 pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow - run_tests $ns1 $ns2 10.0.1.1 0 -1 -2 slow + run_tests $ns1 $ns2 10.0.1.1 0 -1 -2 speed_10 chk_join_nr 3 3 3 chk_add_nr 1 1 chk_rm_nr 2 2 @@ -2055,7 +2055,7 @@ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal pm_nl_add_endpoint $ns1 10.0.4.1 flags signal pm_nl_set_limits $ns2 3 3 - run_tests $ns1 $ns2 10.0.1.1 0 -3 0 slow + run_tests $ns1 $ns2 10.0.1.1 0 -3 0 speed_10 chk_join_nr 3 3 3 chk_add_nr 3 3 chk_rm_nr 3 3 invert @@ -2068,7 +2068,7 @@ pm_nl_add_endpoint $ns1 10.0.3.1 flags signal pm_nl_add_endpoint $ns1 10.0.14.1 flags signal pm_nl_set_limits $ns2 3 3 - run_tests $ns1 $ns2 10.0.1.1 0 -3 0 slow + run_tests $ns1 $ns2 10.0.1.1 0 -3 0 speed_10 chk_join_nr 1 1 1 chk_add_nr 3 3 chk_rm_nr 3 1 invert only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +++ linux-kvm-5.19.0/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh @@ -35,8 +35,9 @@ ns1="ns1-$rndh" ns2="ns2-$rndh" + ns_sbox="ns_sbox-$rndh" - for netns in "$ns1" "$ns2";do + for netns in "$ns1" "$ns2" "$ns_sbox";do ip netns add $netns || exit $ksft_skip ip -net $netns link set lo up ip netns exec $netns sysctl -q net.mptcp.enabled=1 @@ -73,7 +74,7 @@ cleanup() { - for netns in "$ns1" "$ns2"; do + for netns in "$ns1" "$ns2" "$ns_sbox"; do ip netns del $netns done rm -f "$cin" "$cout" @@ -243,7 +244,7 @@ { local lret=0 - ./mptcp_sockopt + ip netns exec "$ns_sbox" ./mptcp_sockopt lret=$? if [ $lret -ne 0 ]; then @@ -252,7 +253,7 @@ return fi - ./mptcp_sockopt -6 + ip netns exec "$ns_sbox" ./mptcp_sockopt -6 lret=$? if [ $lret -ne 0 ]; then only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/net/mptcp/simult_flows.sh +++ linux-kvm-5.19.0/tools/testing/selftests/net/mptcp/simult_flows.sh @@ -235,9 +235,10 @@ tc -n $ns2 qdisc add dev ns2eth1 root netem rate ${rate1}mbit $delay1 tc -n $ns2 qdisc add dev ns2eth2 root netem rate ${rate2}mbit $delay2 - # time is measured in ms, account for transfer size, affegated link speed + # time is measured in ms, account for transfer size, aggregated link speed # and header overhead (10%) - local time=$((size * 8 * 1000 * 10 / (( $rate1 + $rate2) * 1024 *1024 * 9) )) + # ms byte -> bit 10% mbit -> kbit -> bit 10% + local time=$((1000 * size * 8 * 10 / ((rate1 + rate2) * 1000 * 1000 * 9) )) # mptcp_connect will do some sleeps to allow the mp_join handshake # completion (see mptcp_connect): 200ms on each side, add some slack only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/net/udpgro.sh +++ linux-kvm-5.19.0/tools/testing/selftests/net/udpgro.sh @@ -50,7 +50,7 @@ echo "failed" & # Hack: let bg programs complete the startup - sleep 0.1 + sleep 0.2 ./udpgso_bench_tx ${tx_args} ret=$? wait $(jobs -p) @@ -117,7 +117,7 @@ echo "failed" & # Hack: let bg programs complete the startup - sleep 0.1 + sleep 0.2 ./udpgso_bench_tx ${tx_args} -p 12345 sleep 0.1 # first UDP GSO socket should be closed at this point only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/net/udpgro_bench.sh +++ linux-kvm-5.19.0/tools/testing/selftests/net/udpgro_bench.sh @@ -39,7 +39,7 @@ ip netns exec "${PEER_NS}" ./udpgso_bench_rx -t ${rx_args} -r & # Hack: let bg programs complete the startup - sleep 0.1 + sleep 0.2 ./udpgso_bench_tx ${tx_args} } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/net/udpgro_frglist.sh +++ linux-kvm-5.19.0/tools/testing/selftests/net/udpgro_frglist.sh @@ -44,7 +44,7 @@ ip netns exec "${PEER_NS}" ./udpgso_bench_rx ${rx_args} -r & # Hack: let bg programs complete the startup - sleep 0.1 + sleep 0.2 ./udpgso_bench_tx ${tx_args} } only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/pidfd/pidfd_wait.c +++ linux-kvm-5.19.0/tools/testing/selftests/pidfd/pidfd_wait.c @@ -95,20 +95,28 @@ .flags = CLONE_PIDFD | CLONE_PARENT_SETTID, .exit_signal = SIGCHLD, }; + int pfd[2]; pid_t pid; siginfo_t info = { .si_signo = 0, }; + ASSERT_EQ(pipe(pfd), 0); pid = sys_clone3(&args); ASSERT_GE(pid, 0); if (pid == 0) { + char buf[2]; + + close(pfd[1]); kill(getpid(), SIGSTOP); + ASSERT_EQ(read(pfd[0], buf, 1), 1); + close(pfd[0]); kill(getpid(), SIGSTOP); exit(EXIT_SUCCESS); } + close(pfd[0]); ASSERT_EQ(sys_waitid(P_PIDFD, pidfd, &info, WSTOPPED, NULL), 0); ASSERT_EQ(info.si_signo, SIGCHLD); ASSERT_EQ(info.si_code, CLD_STOPPED); @@ -117,6 +125,8 @@ ASSERT_EQ(sys_pidfd_send_signal(pidfd, SIGCONT, NULL, 0), 0); ASSERT_EQ(sys_waitid(P_PIDFD, pidfd, &info, WCONTINUED, NULL), 0); + ASSERT_EQ(write(pfd[1], "C", 1), 1); + close(pfd[1]); ASSERT_EQ(info.si_signo, SIGCHLD); ASSERT_EQ(info.si_code, CLD_CONTINUED); ASSERT_EQ(info.si_pid, parent_tid); only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c +++ linux-kvm-5.19.0/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c @@ -50,6 +50,7 @@ expected[1] = MMCR2_EXPECTED_2; i = 0; bad_mmcr2 = false; + actual = 0; /* Make sure we loop until we take at least one EBB */ while ((ebb_state.stats.ebb_count < 20 && !bad_mmcr2) || only in patch2: unchanged: --- linux-kvm-5.19.0.orig/tools/vm/slabinfo-gnuplot.sh +++ linux-kvm-5.19.0/tools/vm/slabinfo-gnuplot.sh @@ -150,7 +150,7 @@ let lines=3 out=`basename "$in"`"-slabs-by-loss" `cat "$in" | grep -A "$lines" 'Slabs sorted by loss' |\ - egrep -iv '\-\-|Name|Slabs'\ + grep -E -iv '\-\-|Name|Slabs'\ | awk '{print $1" "$4+$2*$3" "$4}' > "$out"` if [ $? -eq 0 ]; then do_slabs_plotting "$out" @@ -159,7 +159,7 @@ let lines=3 out=`basename "$in"`"-slabs-by-size" `cat "$in" | grep -A "$lines" 'Slabs sorted by size' |\ - egrep -iv '\-\-|Name|Slabs'\ + grep -E -iv '\-\-|Name|Slabs'\ | awk '{print $1" "$4" "$4-$2*$3}' > "$out"` if [ $? -eq 0 ]; then do_slabs_plotting "$out"