gpu: drm: img: Replace system work flush with img dedicated workqueue

Remove deprecated flush_scheduled_work() and use already
added flush_workqueue() without considering kernel version.

Change-Id: I226e2a7bb845497aa38c020d5c178624b8768e18
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

riscv: configs: tizen-bpif3: enable missing f2fs fs security support

All filesystems used by Tizen need to support filesystem security features,
so enable missing F2FS_FS_SECURITY. This fixes strange crashes of the
Tizen applications.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I1ebd5641d9cb8565b7eefaa98fba4cc8d57a6120

gpu: drm: img: fix potential NULL pointer dereference

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I40d03860acef21452fa83b00215868bbd1391caa

riscv: Don't use PGD entries for the linear mapping

Propagating changes at this level is cumbersome as we need to go through
all the page tables when that happens (either when changing the
permissions or when splitting the mapping).

Note that this prevents the use of 4MB mapping for sv32 and 1GB mapping for
sv39 in the linear mapping.

Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Link: https://lore.kernel.org/r/20231108075930.7157-2-alexghiti@rivosinc.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
[backport of the commit 629db01c64ff6cea08fc61b52426362689ef8618 from mainline]
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I4b122a6d6e66d5454be7596746957942b3df01e8

Revert "arch: riscv: Copy arch specific adaptations from vendor kernel"

Only a small subset of those changes are really needed to make BPI-F3
stable and will be applied as a proper backport of the mainline commit.

This reverts commit f51496dc62a81d333007e8ddb498629efaaf6424.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I397b66af14aa3bfef8ad921c13e6ee1597a8e859

riscv: configs: tizen-bpif3: enable USB gadget support

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I6cd38a4df7944d19a5db094c1f6333e63e23b8d5

riscv: dts: spacemit: add USB gadget (UDC) and related PHY nodes

Add device tree nodes needed for the USB gadget (UDC) port related
drivers. Ported from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I957d8b518c86e585660a5fd6f06d669009f099d7

USB: port SpacemiT K1x USB Gadget (UDC) and related PHY vendor drivers

These drivers are required for the USB-C port in device mode to work
correctly. Port them from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I42b62fb1218ee3ad9ea4906d04feef21ad7ce437

riscv: configs: tizen-bpif3: enable host USB3.0 ports support

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I8ff7daba7997acdd4a2b7ced765239fdf8fe0df5

riscv: dts: spacemit: add DWC3/USB3 and related PHY nodes

Add device tree nodes needed for the DWC3/USB3 host ports related
drivers. Ported from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I0fe6fede371aaa7e4d8c2de79ac6d4d18bbc2721

usb: port SpacemiT DWC3/USB3 and related PHY vendor drivers

These drivers are required for the host USB ports to work correctly. Port
them from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I8a4f1bccf0eb7eced7ea87d1ac9c881947ed34ab

drivers: soc: spacemit: v2d: Don't build v2d by default

At this point v2d is not required for anything. Disable building it by
default.

Change-Id: I42b6dfc0891e1d17d2620e56463ec1af6835a071
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: configs: tizen-bpif3: Enable DRM and GPU drivers

DRM and GPU drivers require custom options enabled in order to work.
Enable them.

Change-Id: I41c08438226a89fbbe57968b45346c4196df6969
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

arch: riscv: Copy arch specific adaptations from vendor kernel

The vendor kernel port for 6.6 contains a number of board specific
adaptations in the arch/riscv. Copy them as is from the vendor port [1].
Omit dts, and Makefile changes as they are not relevant. Without this
commit the DRM and GPU drivers work, but intermittently there are memory
management oops.

[  825.938962] Unable to handle kernel paging request at virtual address ffffffd864f823d0
[ snip ]
[  826.059411] status: 0000000200000100 badaddr: ffffffd864f823d0 cause: 000000000000000d
[  826.067402] [<ffffffff801d7166>] __kmem_cache_alloc_node+0xd4/0x482
[  826.073741] [<ffffffff8018e32a>] __kmalloc+0x38/0x1de
[  826.078849] [<ffffffff80280738>] ext4_find_extent+0x2fc/0x360
[  826.084656] [<ffffffff80283b60>] ext4_ext_map_blocks+0x72/0x15d2
[  826.090728] [<ffffffff80296114>] ext4_map_blocks+0x14e/0x50c
[  826.096457] [<ffffffff80285fa8>] ext4_convert_unwritten_extents+0xe0/0x1a2
[  826.103391] [<ffffffff802860ba>] ext4_convert_unwritten_io_end_vec+0x50/0xb2
[  826.110511] [<ffffffff802b36ca>] ext4_end_io_rsv_work+0xc8/0x15e
[  826.116580] [<ffffffff8002d7e0>] process_one_work+0x110/0x2d2
[  826.122385] [<ffffffff8002dc48>] worker_thread+0x2a6/0x37c
[  826.127941] [<ffffffff800343d2>] kthread+0xd0/0xec
[  826.132774] [<ffffffff810635ae>] ret_from_fork+0xe/0x1c

[1] - https://github.com/BPI-SINOVOIP/pi-linux/tree/linux-6.6.36-k1

Change-Id: Iecee643e417c850ebca0c07e1d2da9c44903e470
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dts: spacemit: Add hdmi and gpu nodes

In order for the gpu and hdmi to work the device tree nodes need to be
added and enabled. Port them from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ib6ec18e7781543446d1d8e3c3d6d1bfaf07eae25
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dts: spacemit: Add reserved memory for dpu

The hdmi nodes are dependent on memory ranges for the dpu. Port them
from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I8e1e80c1ef3490f08aa56a5522de6d73d9560091
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dts: spacemit: Add separate dram ranges for ethernet nodes

It's better to use separate dram ranges for DMA, for different types of
nodes. Copy this changes as is from [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux/tree/linux-6.6.36-k1

Change-Id: I35aa038273aefc1b30408fbf978694ef8d1c9a42
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dt: Add constants for display DPU

Device tree nodes require those constants. Port them from the vendor
kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I0058ffa1cc2ec9d466e46b0d71f6394d9945af97
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dts: spacemit: Add separate dtsi with hdmi configuration

In the vendor kernel there is a separate file with hdmi
configurations. Port it [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Idb4e768b943cd7103ef3768589c7a5269d990cc6
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

drm: spacemit: Add spacemit DRM drivers

Copy the drivers as is from the vendor kernel [1], since the vendor
already ported them to the kernel 6.6.

[1] - https://github.com/BPI-SINOVOIP/pi-linux/tree/linux-6.6.36-k1

Change-Id: I1329be3f40f6fabc5240cb42c61ee5a060d8d3da
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

dmaengine: adma-spacemit: Add Add SpacemiT K1-X adma driver

This driver is required for the HDMI to work correctly. Port it from the
vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Id0959b4ed4faca2b580d6f58bca61faa7cd06826
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

gpu: drm: img: Enable img-rogue driver for Spacemit

Copy the drivers as is from the vendor kernel [1], since the vendor
already ported them to the kernel 6.6.

[1] - https://github.com/BPI-SINOVOIP/pi-linux/tree/linux-6.6.36-k1

Change-Id: Ibf966f2e48f9b3ab7c19f650160bfb4459f2742a
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

packaging: Add the linux-bpif3.spec file

Add the linux-bpif3.spec file to build on gbs system.

Change-Id: I26a9fae18ecd449d47be9e82b9466a986c868235
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>

riscv: configs: tizen-bpif3: use mainline-style uart0 driver

Use standard 8250-style device-tree based driver for UART0.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I351f1332d150701850a8d812d367ed68a282a80b

Revert "serial: pxa: Add SpacemiT K1-X serial driver"

This reverts commit 98877ed5fe34e65878cdbc716f602e4bcef47336.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: I9fdbe87533ad0baa2c3e597111d76f27d6edf87d

Revert "riscv: dts: spacemit: Fix uart0 problem with bash shell"

This reverts commit 0c0f3ee331d84839de828feb2793c4f3adcf70f4.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Change-Id: Iea6ee4131f46ec57d5891a11c8d5187da597fbf8

riscv: configs: tizen-bpif3: Enable ethernet

Enable option required for ethernet to work.

Change-Id: I2c70b017cdf94df6e4d3553f6ccf48b2fc9b0f0b
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dts: spacemit: Add eth nodes and their dependents

For the ethernet to work, the ethX device tree nodes need to be present
and working, along with their dependent nodes. Port them from the vendor
kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I4bb2ef84258acdd0c6dcac7119a2e60e7d8ca5b2
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

eth: spacemit: Add SpacemiT K1-X ethernet driver

The SpacemiT SoC requires custom ethernet driver. Port it from the
vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I61b78924e893cd2103445e0ea876f5cbfdff42bb
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: configs: tizen-bpif3: Enable basic options for bpif3 support

The BananaPi-F3 requires a number of custom options to work. Enable
them.

Change-Id: I965fdf44108cb5682060926265750e9d36de0811
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: Add SpacemiT SoC family support option for K1-X chip

Some of the driver code is only meant for the spacemit family SoC with
K1-X chip. Add an option for it in Kconfig.

Change-Id: Ia7b228cbd0b2a6f1c7b547324abc2c39c204c8c6
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dts: spacemit: Fix uart0 problem with bash shell

Using the uart0 node from the proposed upstream commit doesn't work
well. The bash shell never appears with this approach. Use the vendor
kernel driver ported from [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Fixes: 8de5738c1378 ("riscv: dts: add initial SpacemiT K1 SoC device tree")
Change-Id: Ic55dbd3387179fd5e623a6cc267917b74b2dabb4
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dts: spacemit: Add sdhci nodes and their dependents

To correctly load the rootfs during the boot phase the sdhci nodes need
to be present. Add them and all their dependents. Ported from the vendor
kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I36b9237643f40c7240ddf09795a0771da76c36b8
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dts: spacemit: Add separate dtsi with pinctrl configuration

In the vendor kernel there is a separate file with pinctrl
configurations. Port it [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I83fadfb582a2fb47f24c91469ca857b6408a42ae
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: dt: Add constants for DMA channel map table

Device tree nodes require those constants. Port them from the vendor
kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I93249b442d82e5227dfb5b7af398f020b1c3fc25
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

serial: pxa: Add SpacemiT K1-X serial driver

This driver seems to be required for the bash shell to appear, without
it the shell never works. Port it from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ic12731d4ccb4a72daeaee582476ab04962556452
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

mmc: Add vendor hacks to core mmc files

It seems that the mmc devices don't work correctly without some changes
to mmc core code. Port the hacks from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Id4ef2af64f2706d0f195e825be19574c40b23cf4
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

mmc: Add SpacemiT K1-X mmc driver

mmc driver enables the ability to load the rootfs from the specified
storage, be it eMMC, SD card, or SDIO. Port it from the vendor kernel
[1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ia58f1a574fa25749b58163b70f2818b1f54d6d08
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

mfd: Add SpacemiT K1-X mfd driver

Mfd driver is a dependecy for the eMMC devices. Port it from the vendor
kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: If1e09972d79504fc886268cba0c42f5209993a8b
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

soc: Add SpacemiT K1-X SoC drivers

SoC drivers are important dependents for the other hardware on the SoC.
Port them from the vendor kernel [1]. Some of those drivers will not be
used just yet, but the important ones are in pom_domain and
k1x-dma-range. Port the reset nonetheless as they may be useful in the
future.

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: If80669df0bb3f613593358bc5e99533f20a66c5f
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

pinctrl: single: Add hack to prevent gpio driver failure

The pinctrl driver must finish before the gpio probe starts. This is
because as for now, the k1-x gpio driver doesn't handle deferred probe
correctly. It can be fixed by registering pinctrl-single in
postcore_initcall. This way the pinctrl will always finish before gpio
starts.

Ported from [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ib748db78932829c0eaaf074e51a9603b7708c1d5
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

pinctrl: Add SpacemiT K1-X pinctrl drivers

Add custom SpacemiT K1-X pinctrl drivers. Ported from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ie7537d93bca98ce0ffcf366d49b1dc4fee490cd1
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

clk: Add SpacemiT K1-X clock drivers

Clock drivers are critical for correct operation of the other hardware on
the SoC. Port them from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ib72ab69e6634166b37fe513f11a5fb89666ee5db
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

regulator: Add SpacemiT K1-X regulator driver

Regulator is an important dependecy for other hardware. Port it from the
vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I8537925fbc9b31a4dab8d70f107e80bc16033f6f
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

reset: Add SpacemiT K1-X reset driver

Reset driver is important dependency for other hardware. Port it from
the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: I0c2c6e4d24cf20c69e870e869808cc4d3c531dab
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

i2c: Add SpacemiT K1-X i2c driver

The i2c is a dependence for SD card among other important hardware.
Port it from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ieb3aec002103b000bec5531a4c1cb898842dd975
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

dmaengine: Enable SpacemiT K1-X mmp_pdma driver

The pdma driver is a dependency for important hardware like i2c8
adapter. Port it from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ia16dcbce82fa4b25ed7bf480f500bd2c5bd63e96
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

gpio: Add SpacemiT K1-X gpio driver

GPIO driver is a dependence for many devices like SD card, ethernet.
Port it from the vendor kernel [1].

[1] - https://github.com/BPI-SINOVOIP/pi-linux.git

Change-Id: Ibc7d674aeaf2e725bf34e5a6928532bcfe18e9a0
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>

riscv: defconfig: enable SpacemiT SoC

Enable SpacemiT SoC config in defconfig to allow the default upstream
kernel booting on Banana Pi BPI-F3 board.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Tested-by: Jesse Taube <jesse@rivosinc.com>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: Ie9412d13461e8a611b41e2f63a67b17eb5921ba0

riscv: dts: spacemit: add Banana Pi BPI-F3 board device tree

Banana Pi BPI-F3 [1] is a industrial grade RISC-V development board, it
design with SpacemiT K1 8 core RISC-V chip [2].

Currently only support booting into console with only uart enabled,
other features will be added soon later.

Link: https://docs.banana-pi.org/en/BPI-F3/BananaPi_BPI-F3
Link: https://www.spacemit.com/en/spacemit-key-stone-2/
Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Acked-by: Jesse Taube <jesse@rivosinc.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: Iadaba634bbd5f0fa80e0816f11cc112e484eb13f

riscv: dts: add initial SpacemiT K1 SoC device tree

Banana Pi BPI-F3 motherboard is powered by SpacemiT K1[1].

Key features:
- 4 cores per cluster, 2 clusters on chip
- UART IP is Intel XScale UART

Some key considerations:
- ISA string is inferred from vendor documentation[2]
- Cluster topology is inferred from datasheet[1] and L2 in vendor dts[3]
- No coherent DMA on this board
    Inferred by taking vendor ethernet and MMC drivers to the mainline
    kernel. Without dma-noncoherent in soc node, the driver fails.
- Add cache nodes
    K1 SoC has 128 sets of 32KiB L1 I/D Cache for each hart, and 512 sets
    of 512KiB L2 Cache for each cluster.

Currently only support booting into console with only uart, other
features will be added soon later.

Link: https://docs.banana-pi.org/en/BPI-F3/SpacemiT_K1_datasheet
Link: https://developer.spacemit.com/#/documentation?token=BWbGwbx7liGW21kq9lucSA6Vnpb
Link: https://gitee.com/bianbu-linux/linux-6.1/blob/bl-v1.0.y/arch/riscv/boot/dts/spacemit/k1-x.dtsi
Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Acked-by: Jesse Taube <jesse@rivosinc.com>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: Iad32a3a865c65a61b00260339f1817ecf553c503

riscv: add SpacemiT SoC family Kconfig support

The first SoC in the SpacemiT series is K1, which contains 8 RISC-V
cores with RISC-V Vector v1.0 support.

Link: https://www.spacemit.com/en/spacemit-key-stone-2/
Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: I1c5bfca97a10b65dd2ee32839108db4e7948321c

dt-bindings: serial: 8250: Add SpacemiT K1 uart compatible

Found SpacemiT's K1 uart controller is compatible with
Intel's Xscale uart, but it's still worth to introduce a new compatible.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: Ib9619de6d55773c281cb1649b1f5e27c208f20d5

dt-bindings: interrupt-controller: Add SpacemiT K1 PLIC

Add compatible string for SpacemiT K1 PLIC.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: I3f5ccbbce7d5247b26c0b814aca5a4f27f603675

dt-bindings: timer: Add SpacemiT K1 CLINT

Add compatible string for SpacemiT K1 CLINT.

Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: Ie7775c0a1e53552bd0815375bd13ed20cebed867

dt-bindings: riscv: add SpacemiT K1 bindings

Add DT binding documentation for the SpacemiT K1 SoC[1] and the Banana
Pi BPi-F3 board[2] which used it.

Link: https://www.spacemit.com/en/spacemit-key-stone-2/
Link: https://docs.banana-pi.org/en/BPI-F3/BananaPi_BPI-F3
Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: I984c5ee705031cb05e8d83c20485b772c8c5c600

dt-bindings: riscv: Add SpacemiT X60 compatibles

The X60 is RISC-V CPU cores from SpacemiT and currently used in their K1
SoC.

Link: https://www.spacemit.com/en/spacemit-x60-core/
Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: I1c61cf1f65e5f34b0be2639669ec11f33991610c

dt-bindings: vendor-prefixes: add spacemit

Add new vendor strings to dt bindings for SpacemiT K1 SoC.

Link: https://www.spacemit.com/en/spacemit-key-stone-2/
Signed-off-by: Yangyu Chen <cyy@cyyself.name>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Yixun Lan <dlan@gentoo.org>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Matthias Brugger <matthias.bgg@kernel.org>
[ m.wilczynski: ported from
https://lore.kernel.org/all/20240730-k1-01-basic-dt-v5-0-98263aae83be@gentoo.org/
]
Signed-off-by: Michal Wilczynski <m.wilczynski@samsung.com>
Change-Id: Ifb42aed6c89b8a54d26971cdd7b251806b6bd67e

Linux 6.6.32

Link: https://lore.kernel.org/r/20240523130342.462912131@linuxfoundation.org
Tested-by: SeongJae Park <sj@kernel.org>
Tested-by: Mark Brown <broonie@kernel.org>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Kelsey Steele <kelseysteele@linux.microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

block: add a partscan sysfs attribute for disks

commit a4217c6740dc64a3eb6815868a9260825e8c68c6 upstream.

Userspace had been unknowingly relying on a non-stable interface of
kernel internals to determine if partition scanning is enabled for a
given disk. Provide a stable interface for this purpose instead.

Cc: stable@vger.kernel.org # 6.3+
Depends-on: 140ce28dd3be ("block: add a disk_has_partscan helper")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/linux-block/ZhQJf8mzq_wipkBH@gardel-login/
Link: https://lore.kernel.org/r/20240502130033.1958492-3-hch@lst.de
[axboe: add links and commit message from Keith]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

block: add a disk_has_partscan helper

commit 140ce28dd3bee8e53acc27f123ae474d69ef66f0 upstream.

Add a helper to check if partition scanning is enabled instead of
open coding the check in a few places.  This now always checks for
the hidden flag even if all but one of the callers are never reachable
for hidden gendisks.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20240502130033.1958492-2-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching sysfs file

commit da2a061888883e067e8e649d086df35c92c760a7 upstream.

The example usage of DAMOS filter sysfs files, specifically the part of
'matching' file writing for memcg type filter, is wrong.  The intention is
to exclude pages of a memcg that already getting enough care from a given
scheme, but the example is setting the filter to apply the scheme to only
the pages of the memcg.  Fix it.

Link: https://lkml.kernel.org/r/20240503180318.72798-7-sj@kernel.org
Fixes: 9b7f9322a530 ("Docs/admin-guide/mm/damon/usage: document DAMOS filters of sysfs")
Closes: https://lore.kernel.org/r/20240317191358.97578-1-sj@kernel.org
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> [6.3.x]
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Shuah Khan <shuah@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

docs: kernel_include.py: Cope with docutils 0.21

commit d43ddd5c91802a46354fa4c4381416ef760676e2 upstream.

Running "make htmldocs" on a newly installed Sphinx 7.3.7 ends up in
a build error:

    Sphinx parallel build error:
    AttributeError: module 'docutils.nodes' has no attribute 'reprunicode'

docutils 0.21 has removed nodes.reprunicode, quote from release note [1]:

  * Removed objects:

    docutils.nodes.reprunicode, docutils.nodes.ensure_str()
        Python 2 compatibility hacks

Sphinx 7.3.0 supports docutils 0.21 [2]:

kernel_include.py, whose origin is misc.py of docutils, uses reprunicode.

Upstream docutils removed the offending line from the corresponding file
(docutils/docutils/parsers/rst/directives/misc.py) in January 2022.
Quoting the changelog [3]:

    Deprecate `nodes.reprunicode` and `nodes.ensure_str()`.

    Drop uses of the deprecated constructs (not required with Python 3).

Do the same for kernel_include.py.

Tested against:
  - Sphinx 2.4.5 (docutils 0.17.1)
  - Sphinx 3.4.3 (docutils 0.17.1)
  - Sphinx 5.3.0 (docutils 0.18.1)
  - Sphinx 6.2.1 (docutils 0.19)
  - Sphinx 7.2.6 (docutils 0.20.1)
  - Sphinx 7.3.7 (docutils 0.21.2)

Link: http://www.docutils.org/RELEASE-NOTES.html#release-0-21-2024-04-09
Link: https://www.sphinx-doc.org/en/master/changes.html#release-7-3-0-released-apr-16-2024
Link: https://github.com/docutils/docutils/commit/c8471ce47a24
Signed-off-by: Akira Yokosawa <akiyks@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Link: https://lore.kernel.org/r/faf5fa45-2a9d-4573-9d2e-3930bdc1ed65@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET

commit 8af2d1ab78f2342f8c4c3740ca02d86f0ebfac5a upstream.

sched_core_share_pid() copies the cookie to userspace with
put_user(id, (u64 __user *)uaddr), expecting 64 bits of space.
The "unsigned long" datatype that is documented in core-scheduling.rst
however is only 32 bits large on 32 bit architectures.

Document "unsigned long long" as the correct data type that is always
64bits large.

This matches what the selftest cs_prctl_test.c has been doing all along.

Fixes: 0159bb020ca9 ("Documentation: Add usecases, design and interface for core scheduling")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/util-linux/df7a25a0-7923-4f8b-a527-5e6f0064074d@t-8ch.de/
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Reviewed-by: Chris Hyser <chris.hyser@oracle.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Link: https://lore.kernel.org/r/20240423-core-scheduling-cookie-v1-1-5753a35f8dfc@weissschuh.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

KEYS: trusted: Do not use WARN when encode fails

commit 050bf3c793a07f96bd1e2fd62e1447f731ed733b upstream.

When asn1_encode_sequence() fails, WARN is not the correct solution.

1. asn1_encode_sequence() is not an internal function (located
   in lib/asn1_encode.c).
2. Location is known, which makes the stack trace useless.
3. Results a crash if panic_on_warn is set.

It is also noteworthy that the use of WARN is undocumented, and it
should be avoided unless there is a carefully considered rationale to
use it.

Replace WARN with pr_err, and print the return value instead, which is
only useful piece of information.

Cc: stable@vger.kernel.org # v5.13+
Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

remoteproc: mediatek: Make sure IPI buffer fits in L2TCM

commit 331f91d86f71d0bb89a44217cc0b2a22810bbd42 upstream.

The IPI buffer location is read from the firmware that we load to the
System Companion Processor, and it's not granted that both the SRAM
(L2TCM) size that is defined in the devicetree node is large enough
for that, and while this is especially true for multi-core SCP, it's
still useful to check on single-core variants as well.

Failing to perform this check may make this driver perform R/W
operations out of the L2TCM boundary, resulting (at best) in a
kernel panic.

To fix that, check that the IPI buffer fits, otherwise return a
failure and refuse to boot the relevant SCP core (or the SCP at
all, if this is single core).

Fixes: 3efa0ea743b7 ("remoteproc/mediatek: read IPI buffer offset from FW")
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240321084614.45253-2-angelogioacchino.delregno@collabora.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

serial: kgdboc: Fix NMI-safety problems from keyboard reset code

commit b2aba15ad6f908d1a620fd97f6af5620c3639742 upstream.

Currently, when kdb is compiled with keyboard support, then we will use
schedule_work() to provoke reset of the keyboard status.  Unfortunately
schedule_work() gets called from the kgdboc post-debug-exception
handler.  That risks deadlock since schedule_work() is not NMI-safe and,
even on platforms where the NMI is not directly used for debugging, the
debug trap can have NMI-like behaviour depending on where breakpoints
are placed.

Fix this by using the irq work system, which is NMI-safe, to defer the
call to schedule_work() to a point when it is safe to call.

Reported-by: Liuye <liu.yeC@h3c.com>
Closes: https://lore.kernel.org/all/20240228025602.3087748-1-liu.yeC@h3c.com/
Cc: stable@vger.kernel.org
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20240424-kgdboc_fix_schedule_work-v2-1-50f5a490aec5@linaro.org
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: typec: tipd: fix event checking for tps6598x

commit 409c1cfb5a803f3cf2d17aeaf75c25c4be951b07 upstream.

The current interrupt service routine of the tps6598x only reads the
first 64 bits of the INT_EVENT1 and INT_EVENT2 registers, which means
that any event above that range will be ignored, leaving interrupts
unattended. Moreover, those events will not be cleared, and the device
will keep the interrupt enabled.

This issue has been observed while attempting to load patches, and the
'ReadyForPatch' field (bit 81) of INT_EVENT1 was set.

Given that older versions of the tps6598x (1, 2 and 6) provide 8-byte
registers, a mechanism based on the upper byte of the version register
(0x0F) has been included. The manufacturer has confirmed [1] that this
byte is always 0 for older versions, and either 0xF7 (DH parts) or 0xF9
(DK parts) is returned in newer versions (7 and 8).

Read the complete INT_EVENT registers to handle all interrupts generated
by the device and account for the hardware version to select the
register size.

Link: https://e2e.ti.com/support/power-management-group/power-management/f/power-management-forum/1346521/tps65987d-register-command-to-distinguish-between-tps6591-2-6-and-tps65987-8
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
Cc: stable@vger.kernel.org
Signed-off-by: Javier Carrasco <javier.carrasco@wolfvision.net>
Link: https://lore.kernel.org/r/20240429-tps6598x_fix_event_handling-v3-2-4e8e58dce489@wolfvision.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: typec: ucsi: displayport: Fix potential deadlock

commit b791a67f68121d69108640d4a3e591d210ffe850 upstream.

The function ucsi_displayport_work() does not access the
connector, so it also must not acquire the connector lock.

This fixes a potential deadlock scenario:

ucsi_displayport_work() -> lock(&con->lock)
typec_altmode_vdm()
dp_altmode_vdm()
dp_altmode_work()
typec_altmode_enter()
ucsi_displayport_enter() -> lock(&con->lock)

Reported-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc: stable@vger.kernel.org
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240507134316.161999-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: usb: ax88179_178a: fix link status when link is set to down/up

commit ecf848eb934b03959918f5269f64c0e52bc23998 upstream.

The idea was to keep only one reset at initialization stage in order to
reduce the total delay, or the reset from usbnet_probe or the reset from
usbnet_open.

I have seen that restarting from usbnet_probe is necessary to avoid doing
too complex things. But when the link is set to down/up (for example to
configure a different mac address) the link is not correctly recovered
unless a reset is commanded from usbnet_open.

So, detect the initialization stage (first call) to not reset from
usbnet_open after the reset from usbnet_probe and after this stage, always
reset from usbnet_open too (when the link needs to be rechecked).

Apply to all the possible devices, the behavior now is going to be the same.

cc: stable@vger.kernel.org # 6.6+
Fixes: 56f78615bcb1 ("net: usb: ax88179_178a: avoid writing the mac address before first reading")
Reported-by: Isaac Ganoung <inventor500@vivaldi.net>
Reported-by: Yongqin Liu <yongqin.liu@linaro.org>
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240510090846.328201-1-jtornosm@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: dwc3: Wait unconditionally after issuing EndXfer command

commit 1d26ba0944d398f88aaf997bda3544646cf21945 upstream.

Currently all controller IP/revisions except DWC3_usb3 >= 310a
wait 1ms unconditionally for ENDXFER completion when IOC is not
set. This is because DWC_usb3 controller revisions >= 3.10a
supports GUCTL2[14: Rst_actbitlater] bit which allows polling
CMDACT bit to know whether ENDXFER command is completed.

Consider a case where an IN request was queued, and parallelly
soft_disconnect was called (due to ffs_epfile_release). This
eventually calls stop_active_transfer with IOC cleared, hence
send_gadget_ep_cmd() skips waiting for CMDACT cleared during
EndXfer. For DWC3 controllers with revisions >= 310a, we don't
forcefully wait for 1ms either, and we proceed by unmapping the
requests. If ENDXFER didn't complete by this time, it leads to
SMMU faults since the controller would still be accessing those
requests.

Fix this by ensuring ENDXFER completion by adding 1ms delay in
__dwc3_stop_active_transfer() unconditionally.

Cc: stable@vger.kernel.org
Fixes: b353eb6dc285 ("usb: dwc3: gadget: Skip waiting for CMDACT cleared during endxfer")
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/20240502044103.1066350-1-quic_prashk@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

binder: fix max_thread type inconsistency

commit 42316941335644a98335f209daafa4c122f28983 upstream.

The type defined for the BINDER_SET_MAX_THREADS ioctl was changed from
size_t to __u32 in order to avoid incompatibility issues between 32 and
64-bit kernels. However, the internal types used to copy from user and
store the value were never updated. Use u32 to fix the inconsistency.

Fixes: a9350fc859ae ("staging: android: binder: fix BINDER_SET_MAX_THREADS declaration")
Reported-by: Arve Hjønnevåg <arve@android.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240421173750.3117808-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()

commit b8d55a90fd55b767c25687747e2b24abd1ef8680 upstream.

Return invalid error code -EINVAL for invalid block id.

Fixes the below:

drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line 1176)

Suggested-by: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: Tao Zhou <tao.zhou1@amd.com>
Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[Ajay: applied AMDGPU_RAS_BLOCK_COUNT condition to amdgpu_ras_query_error_status()
       as amdgpu_ras_query_error_status_helper() not present in v6.6, v6.1
       amdgpu_ras_query_error_status_helper() was introduced in 8cc0f5669eb6]
Signed-off-by: Ajay Kaher <ajay.kaher@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

erofs: reliably distinguish block based and fscache mode

commit 7af2ae1b1531feab5d38ec9c8f472dc6cceb4606 upstream.

When erofs_kill_sb() is called in block dev based mode, s_bdev may not
have been initialised yet, and if CONFIG_EROFS_FS_ONDEMAND is enabled,
it will be mistaken for fscache mode, and then attempt to free an anon_dev
that has never been allocated, triggering the following warning:

============================================
ida_free called for id=0 which is not allocated.
WARNING: CPU: 14 PID: 926 at lib/idr.c:525 ida_free+0x134/0x140
Modules linked in:
CPU: 14 PID: 926 Comm: mount Not tainted 6.9.0-rc3-dirty #630
RIP: 0010:ida_free+0x134/0x140
Call Trace:
 <TASK>
 erofs_kill_sb+0x81/0x90
 deactivate_locked_super+0x35/0x80
 get_tree_bdev+0x136/0x1e0
 vfs_get_tree+0x2c/0xf0
 do_new_mount+0x190/0x2f0
 [...]
============================================

Now when erofs_kill_sb() is called, erofs_sb_info must have been
initialised, so use sbi->fsid to distinguish between the two modes.

Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Link: https://lore.kernel.org/r/20240419123611.947084-3-libaokun1@huawei.com
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

erofs: get rid of erofs_fs_context

commit 07abe43a28b2c660f726d66f5470f7f114f9643a upstream.

Instead of allocating the erofs_sb_info in fill_super() allocate it during
erofs_init_fs_context() and ensure that erofs can always have the info
available during erofs_kill_sb(). After this erofs_fs_context is no longer
needed, replace ctx with sbi, no functional changes.

Suggested-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jingbo Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Link: https://lore.kernel.org/r/20240419123611.947084-2-libaokun1@huawei.com
[ Gao Xiang: trivial conflict due to a warning message. ]
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

bpf: Add missing BPF_LINK_TYPE invocations

commit 117211aa739a926e6555cfea883be84bee6f1695 upstream.

Pengfei Xu reported [1] Syzkaller/KASAN issue found in bpf_link_show_fdinfo.

The reason is missing BPF_LINK_TYPE invocation for uprobe multi
link and for several other links, adding that.

[1] https://lore.kernel.org/bpf/ZXptoKRSLspnk2ie@xpf.sh.intel.com/

Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link")
Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support")
Fixes: 84601d6ee68a ("bpf: add bpf_link support for BPF_NETFILTER programs")
Fixes: 35dfaad7188c ("netkit, bpf: Add bpf programmable net device")
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Acked-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/bpf/20231215230502.2769743-1-jolsa@kernel.org
Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

kselftest: Add a ksft_perror() helper

commit 907f33028871fa7c9a3db1efd467b78ef82cce20 upstream.

The standard library perror() function provides a convenient way to print
an error message based on the current errno but this doesn't play nicely
with KTAP output. Provide a helper which does an equivalent thing in a KTAP
compatible format.

nolibc doesn't have a strerror() and adding the table of strings required
doesn't seem like a good fit for what it's trying to do so when we're using
that only print the errno.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Stable-dep-of: 071af0c9e582 ("selftests: timers: Convert posix_timers test to generate KTAP output")
Signed-off-by: Edward Liaw <edliaw@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mmc: core: Add HS400 tuning in HS400es initialization

commit 77e01b49e35f24ebd1659096d5fc5c3b75975545 upstream.

During the initialization to HS400es stage, add a HS400 tuning flow as an
optional process. For Mediatek IP, the HS400es mode requires a specific
tuning to ensure the correct HS400 timing setting.

Signed-off-by: Mengqi Zhang <mengqi.zhang@mediatek.com>
Link: https://lore.kernel.org/r/20231225093839.22931-2-mengqi.zhang@mediatek.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Cc: "Lin Gui (桂林)" <Lin.Gui@mediatek.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

KEYS: trusted: Fix memory leak in tpm2_key_encode()

commit ffcaa2172cc1a85ddb8b783de96d38ca8855e248 upstream.

'scratch' is never freed. Fix this by calling kfree() in the success, and
in the error case.

Cc: stable@vger.kernel.org # +v5.13
Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()

commit a5b862c6a221459d54e494e88965b48dcfa6cc44 upstream.

l2cap_le_flowctl_init() can cause both div-by-zero and an integer
overflow since hdev->le_mtu may not fall in the valid range.

Move MTU from hci_dev to hci_conn to validate MTU and stop the connection
process earlier if MTU is invalid.
Also, add a missing validation in read_buffer_size() and make it return
an error value if the validation fails.
Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a
kzalloc failure and invalid MTU value.

divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G        W          6.9.0-rc5+ #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci0 hci_rx_work
RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547
Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c
89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d
b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42
RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246
RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f
RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa
R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084
R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000
FS:  0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <TASK>
 l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline]
 l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline]
 l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline]
 l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809
 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506
 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline]
 hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335
 worker_thread+0x926/0xe70 kernel/workqueue.c:3416
 kthread+0x2e3/0x380 kernel/kthread.c:388
 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---

Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic")
Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()

commit 4d7b41c0e43995b0e992b9f8903109275744b658 upstream.

Extend a critical section to prevent chan from early freeing.
Also make the l2cap_connect() return type void. Nothing is using the
returned value but it is ugly to return a potentially freed pointer.
Making it void will help with backports because earlier kernels did use
the return value. Now the compile will break for kernels where this
patch is not a complete fix.

Call stack summary:

[use]
l2cap_bredr_sig_cmd
  l2cap_connect
  ┌ mutex_lock(&conn->chan_lock);
  │ chan = pchan->ops->new_connection(pchan); <- alloc chan
  │ __l2cap_chan_add(conn, chan);
  │   l2cap_chan_hold(chan);
  │   list_add(&chan->list, &conn->chan_l);   ... (1)
  └ mutex_unlock(&conn->chan_lock);
    chan->conf_state              ... (4) <- use after free

[free]
l2cap_conn_del
┌ mutex_lock(&conn->chan_lock);
│ foreach chan in conn->chan_l:            ... (2)
│   l2cap_chan_put(chan);
│     l2cap_chan_destroy
│       kfree(chan)               ... (3) <- chan freed
└ mutex_unlock(&conn->chan_lock);

==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read
include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in _test_bit
include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0
net/bluetooth/l2cap_core.c:4260
Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311

Fixes: 73ffa904b782 ("Bluetooth: Move conf_{req,rsp} stuff to struct l2cap_chan")
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ice: remove unnecessary duplicate checks for VF VSI ID

commit 363f689600dd010703ce6391bcfc729a97d21840 upstream.

The ice_vc_fdir_param_check() function validates that the VSI ID of the
virtchnl flow director command matches the VSI number of the VF. This is
already checked by the call to ice_vc_isvalid_vsi_id() immediately
following this.

This check is unnecessary since ice_vc_isvalid_vsi_id() already confirms
this by checking that the VSI ID can locate the VSI associated with the VF
structure.

Furthermore, a following change is going to refactor the ice driver to
report VSI IDs using a relative index for each VF instead of reporting the
PF VSI number. This additional check would break that logic since it
enforces that the VSI ID matches the VSI number.

Since this check duplicates  the logic in ice_vc_isvalid_vsi_id() and gets
in the way of refactoring that logic, remove it.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ice: pass VSI pointer into ice_vc_isvalid_q_id

commit a21605993dd5dfd15edfa7f06705ede17b519026 upstream.

The ice_vc_isvalid_q_id() function takes a VSI index and a queue ID. It
looks up the VSI from its index, and then validates that the queue number
is valid for that VSI.

The VSI ID passed is typically a VSI index from the VF. This VSI number is
validated by the PF to ensure that it matches the VSI associated with the
VF already.

In every flow where ice_vc_isvalid_q_id() is called, the PF driver already
has a pointer to the VSI associated with the VF. This pointer is obtained
using ice_get_vf_vsi(), rather than looking up the VSI using the index sent
by the VF.

Since we already know which VSI to operate on, we can modify
ice_vc_isvalid_q_id() to take a VSI pointer instead of a VSI index. Pass
the VSI we found from ice_get_vf_vsi() instead of re-doing the lookup. This
removes some unnecessary computation and scanning of the VSI list.

It also removes the last place where the driver directly used the VSI
number from the VF. This will pave the way for refactoring to communicate
relative VSI numbers to the VF instead of absolute numbers from the PF
space.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ks8851: Fix another TX stall caused by wrong ISR flag handling

commit 317a215d493230da361028ea8a4675de334bfa1a upstream.

Under some circumstances it may happen that the ks8851 Ethernet driver
stops sending data.

Currently the interrupt handler resets the interrupt status flags in the
hardware after handling TX. With this approach we may lose interrupts in
the time window between handling the TX interrupt and resetting the TX
interrupt status bit.

When all of the three following conditions are true then transmitting
data stops:

  - TX queue is stopped to wait for room in the hardware TX buffer
  - no queued SKBs in the driver (txq) that wait for being written to hw
  - hardware TX buffer is empty and the last TX interrupt was lost

This is because reenabling the TX queue happens when handling the TX
interrupt status but if the TX status bit has already been cleared then
this interrupt will never come.

With this commit the interrupt status flags will be cleared before they
are handled. That way we stop losing interrupts.

The wrong handling of the ISR flags was there from the beginning but
with commit 3dc5d4454545 ("net: ks8851: Fix TX stall caused by TX
buffer overrun") the issue becomes apparent.

Fixes: 3dc5d4454545 ("net: ks8851: Fix TX stall caused by TX buffer overrun")
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Simon Horman <horms@kernel.org>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/amd/display: Fix division by zero in setup_dsc_config

commit 130afc8a886183a94cf6eab7d24f300014ff87ba upstream.

When slice_height is 0, the division by slice_height in the calculation
of the number of slices will cause a division by zero driver crash. This
leaves the kernel in a state that requires a reboot. This patch adds a
check to avoid the division by zero.

The stack trace below is for the 6.8.4 Kernel. I reproduced the issue on
a Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor
connected via Thunderbolt. The amdgpu driver crashed with this exception
when I rebooted the system with the monitor connected.

kernel: ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447)
kernel: ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154)
kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu
kernel: ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175)
kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu
kernel: ? exc_divide_error (arch/x86/kernel/traps.c:194 (discriminator 2))
kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu
kernel: ? asm_exc_divide_error (./arch/x86/include/asm/idtentry.h:548)
kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu
kernel: dc_dsc_compute_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1109) amdgpu

After applying this patch, the driver no longer crashes when the monitor
is connected and the system is rebooted. I believe this is the same
issue reported for 3113.

Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Jose Fernandez <josef@netflix.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3113
Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: "Limonciello, Mario" <mario.limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

smb: smb2pdu.h: Avoid -Wflex-array-member-not-at-end warnings

-Wflex-array-member-not-at-end is coming in GCC-14, and we are getting
ready to enable it globally.

So, in order to avoid ending up with a flexible-array member in the
middle of multiple other structs, we use the `__struct_group()` helper
to separate the flexible array from the rest of the members in the
flexible structure, and use the tagged `struct create_context_hdr`
instead of `struct create_context`.

So, with these changes, fix 51 of the following warnings[1]:

fs/smb/client/../common/smb2pdu.h:1225:31: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

Link: https://gist.github.com/GustavoARSilva/772526a39be3dd4db39e71497f0a9893
Link: https://github.com/KSPP/linux/issues/202
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

ksmbd: add continuous availability share parameter

[ Upstream commit e9d8c2f95ab8acaf3f4d4a53682a4afa3c263692 ]

If capabilities of the share is not SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY,
ksmbd should not grant a persistent handle to the client.
This patch add continuous availability share parameter to control it.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

cifs: Add tracing for the cifs_tcon struct refcounting

[ Upstream commit afc23febd51c7e24361e3a9c09f3e892eb0a41ea ]

Add tracing for the refcounting/lifecycle of the cifs_tcon struct, marking
different events with different labels and giving each tcon its own debug
ID so that the tracelines corresponding to individual tcons can be
distinguished.  This can be enabled with:

echo 1 >/sys/kernel/debug/tracing/events/cifs/smb3_tcon_ref/enable

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
cc: Shyam Prasad N <nspmangalore@gmail.com>
cc: linux-cifs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

smb: client: instantiate when creating SFU files

[ Upstream commit c6ff459037b2e35450af2351037eac4c8aca1d6b ]

In cifs_sfu_make_node(), on success, instantiate rather than leave it
with dentry unhashed negative to support callers that expect mknod(2)
to always instantiate.

This fixes the following test case:

  mount.cifs //srv/share /mnt -o ...,sfu
  mkfifo /mnt/fifo
  ./xfstests/ltp/growfiles -b -W test -e 1 -u -i 0 -L 30 /mnt/fifo
  ...
  BUG: unable to handle page fault for address: 000000034cec4e58
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 1 PREEMPT SMP PTI
  CPU: 0 PID: 138098 Comm: growfiles Kdump: loaded Not tainted
  5.14.0-436.3987_1240945149.el9.x86_64 #1
  Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
  RIP: 0010:_raw_callee_save__kvm_vcpu_is_preempted+0x0/0x20
  Code: e8 15 d9 61 00 e9 63 ff ff ff 41 bd ea ff ff ff e9 58 ff ff ff e8
  d0 71 c0 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <48> 8b 04
  fd 60 2b c1 99 80 b8 90 50 03 00 00 0f 95 c0 c3 cc cc cc
  RSP: 0018:ffffb6a143cf7cf8 EFLAGS: 00010206
  RAX: ffff8a9bc30fb038 RBX: ffff8a9bc666a200 RCX: ffff8a9cc0260000
  RDX: 00000000736f622e RSI: ffff8a9bc30fb038 RDI: 000000007665645f
  RBP: ffffb6a143cf7d70 R08: 0000000000001000 R09: 0000000000000001
  R10: 0000000000000001 R11: 0000000000000000 R12: ffff8a9bc666a200
  R13: 0000559a302a12b0 R14: 0000000000001000 R15: 0000000000000000
  FS: 00007fbed1dbb740(0000) GS:ffff8a9cf0000000(0000)
  knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000000034cec4e58 CR3: 0000000128ec6006 CR4: 0000000000770ef0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? show_trace_log_lvl+0x1c4/0x2df
   ? show_trace_log_lvl+0x1c4/0x2df
   ? __mutex_lock.constprop.0+0x5f7/0x6a0
   ? __die_body.cold+0x8/0xd
   ? page_fault_oops+0x134/0x170
   ? exc_page_fault+0x62/0x150
   ? asm_exc_page_fault+0x22/0x30
   ? _pfx_raw_callee_save__kvm_vcpu_is_preempted+0x10/0x10
   __mutex_lock.constprop.0+0x5f7/0x6a0
   ? __mod_memcg_lruvec_state+0x84/0xd0
   pipe_write+0x47/0x650
   ? do_anonymous_page+0x258/0x410
   ? inode_security+0x22/0x60
   ? selinux_file_permission+0x108/0x150
   vfs_write+0x2cb/0x410
   ksys_write+0x5f/0xe0
   do_syscall_64+0x5c/0xf0
   ? syscall_exit_to_user_mode+0x22/0x40
   ? do_syscall_64+0x6b/0xf0
   ? sched_clock_cpu+0x9/0xc0
   ? exc_page_fault+0x62/0x150
   entry_SYSCALL_64_after_hwframe+0x6e/0x76

Cc: stable@vger.kernel.org
Fixes: 72bc63f5e23a ("smb3: fix creating FIFOs when mounting with "sfu" mount option")
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

smb: client: fix NULL ptr deref in cifs_mark_open_handles_for_deleted_file()

[ Upstream commit ec4535b2a1d709d3a1fbec26739c672f13c98a7b ]

cifs_get_fattr() may be called with a NULL inode, so check for a
non-NULL inode before calling
cifs_mark_open_handles_for_deleted_file().

This fixes the following oops:

  mount.cifs //srv/share /mnt -o ...,vers=3.1.1
  cd /mnt
  touch foo; tail -f foo &
  rm foo
  cat foo

  BUG: kernel NULL pointer dereference, address: 00000000000005c0
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 2 PID: 696 Comm: cat Not tainted 6.9.0-rc2 #1
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  1.16.3-1.fc39 04/01/2014
  RIP: 0010:__lock_acquire+0x5d/0x1c70
  Code: 00 00 44 8b a4 24 a0 00 00 00 45 85 f6 0f 84 bb 06 00 00 8b 2d
  48 e2 95 01 45 89 c3 41 89 d2 45 89 c8 85 ed 0 0 <48> 81 3f 40 7a 76
  83 44 0f 44 d8 83 fe 01 0f 86 1b 03 00 00 31 d2
  RSP: 0018:ffffc90000b37490 EFLAGS: 00010002
  RAX: 0000000000000000 RBX: ffff888110021ec0 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000005c0
  RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
  R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000200
  FS: 00007f2a1fa08740(0000) GS:ffff888157a00000(0000)
  knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
  0000000080050033
  CR2: 00000000000005c0 CR3: 000000011ac7c000 CR4: 0000000000750ef0
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? __die+0x23/0x70
   ? page_fault_oops+0x180/0x490
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? exc_page_fault+0x70/0x230
   ? asm_exc_page_fault+0x26/0x30
   ? __lock_acquire+0x5d/0x1c70
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? srso_alias_return_thunk+0x5/0xfbef5
   lock_acquire+0xc0/0x2d0
   ? cifs_mark_open_handles_for_deleted_file+0x3a/0x100 [cifs]
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? kmem_cache_alloc+0x2d9/0x370
   _raw_spin_lock+0x34/0x80
   ? cifs_mark_open_handles_for_deleted_file+0x3a/0x100 [cifs]
   cifs_mark_open_handles_for_deleted_file+0x3a/0x100 [cifs]
   cifs_get_fattr+0x24c/0x940 [cifs]
   ? srso_alias_return_thunk+0x5/0xfbef5
   cifs_get_inode_info+0x96/0x120 [cifs]
   cifs_lookup+0x16e/0x800 [cifs]
   cifs_atomic_open+0xc7/0x5d0 [cifs]
   ? lookup_open.isra.0+0x3ce/0x5f0
   ? __pfx_cifs_atomic_open+0x10/0x10 [cifs]
   lookup_open.isra.0+0x3ce/0x5f0
   path_openat+0x42b/0xc30
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? srso_alias_return_thunk+0x5/0xfbef5
   do_filp_open+0xc4/0x170
   do_sys_openat2+0xab/0xe0
   __x64_sys_openat+0x57/0xa0
   do_syscall_64+0xc1/0x1e0
   entry_SYSCALL_64_after_hwframe+0x72/0x7a

Fixes: ffceb7640cbf ("smb: client: do not defer close open handles to deleted files")
Reviewed-by: Meetakshi Setiya <msetiya@microsoft.com>
Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

smb3: add trace event for mknod

[ Upstream commit e9e9fbeb83f65d3d487e0a0838c0867292c99fb2 ]

Add trace points to help debug mknod and mkfifo:

   smb3_mknod_done
   smb3_mknod_enter
   smb3_mknod_err

Example output:

      TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
         | |         |   |||||     |         |
    mkfifo-6163    [003] .....   960.425558: smb3_mknod_enter: xid=12 sid=0xb55130f6 tid=0x46e6241c path=\fifo1
    mkfifo-6163    [003] .....   960.432719: smb3_mknod_done: xid=12 sid=0xb55130f6 tid=0x46e6241c

Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Reviewed-by: Meetakshi Setiya <msetiya@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

smb311: additional compression flag defined in updated protocol spec

[ Upstream commit e56bc745fa1de77abc2ad8debc4b1b83e0426c49 ]

Added new compression flag that was recently documented, in
addition fix some typos and clarify the sid_attr_data struct
definition.

Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

smb311: correct incorrect offset field in compression header

[ Upstream commit 68c5818a27afcb5cdddab041b82e9d47c996cb6a ]

The offset field in the compression header is 32 bits not 16.

Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Reported-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

cifs: Move some extern decls from .c files to .h

[ Upstream commit 5b142b37c70b1fa6936fa2d0babb0b8c16767d3a ]

Move the following:

        extern mempool_t *cifs_sm_req_poolp;
        extern mempool_t *cifs_req_poolp;
        extern mempool_t *cifs_mid_poolp;
        extern bool disable_legacy_dialects;

from various .c files to cifsglob.h.

Signed-off-by: David Howells <dhowells@redhat.com>
cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

ksmbd: fix potencial out-of-bounds when buffer offset is invalid

[ Upstream commit c6cd2e8d2d9aa7ee35b1fa6a668e32a22a9753da ]

I found potencial out-of-bounds when buffer offset fields of a few requests
is invalid. This patch set the minimum value of buffer offset field to
->Buffer offset to validate buffer length.

Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

[ Upstream commit d10c77873ba1e9e6b91905018e29e196fd5f863d ]

If ->NameOffset/Length is bigger than ->CreateContextsOffset/Length,
ksmbd_check_message doesn't validate request buffer it correctly.
So slab-out-of-bounds warning from calling smb_strndup_from_utf16()
in smb2_open() could happen. If ->NameLength is non-zero, Set the larger
of the two sums (Name and CreateContext size) as the offset and length of
the data area.

Reported-by: Yang Chaoming <lometsj@live.com>
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

ksmbd: Fix spelling mistake "connction" -> "connection"

[ Upstream commit e758fa6956cbc873e4819ec3dd97cfd05a4c147e ]

There is a spelling mistake in a ksmbd_debug debug message. Fix it.

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close

[ Upstream commit 5fb282ba4fef8985a5acf2b32681f2ec07732561 ]

rcu_dereference can return NULL, so make sure we check against that.

Signed-off-by: Marios Makassikis <mmakassikis@freebox.fr>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

cifs: remove redundant variable assignment

[ Upstream commit 2760161d149f8d60c3f767fc62a823a1ead9d367 ]

This removes an unnecessary variable assignment. The assigned
value will be overwritten by cifs_fattr_to_inode before it
is accessed, making the line redundant.

Signed-off-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

cifs: fixes for get_inode_info

[ Upstream commit fc20c523211a38b87fc850a959cb2149e4fd64b0 ]

Fix potential memory leaks, add error checking, remove unnecessary
initialisation of status_file_deleted and do not use cifs_iget() to get
inode in reparse_info_to_fattr since fattrs may not be fully set.

Fixes: ffceb7640cbf ("smb: client: do not defer close open handles to deleted files")
Reported-by: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Meetakshi Setiya <msetiya@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>