diff --git a/COPYING-5.14.0-570.19.1.el9_6 b/COPYING-5.14.0-570.22.1.el9_6 similarity index 100% rename from COPYING-5.14.0-570.19.1.el9_6 rename to COPYING-5.14.0-570.22.1.el9_6 diff --git a/Makefile.rhelver b/Makefile.rhelver index c6f197fb8ad1f..52ba9cd67e168 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 6 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 570.19.1 +RHEL_RELEASE = 570.22.1 # # ZSTREAM diff --git a/ciq/ciq_backports/kernel-5.14.0-570.21.1.el9_6/rebuild.details.txt b/ciq/ciq_backports/kernel-5.14.0-570.21.1.el9_6/rebuild.details.txt new file mode 100644 index 0000000000000..fc88a6a631b09 --- /dev/null +++ b/ciq/ciq_backports/kernel-5.14.0-570.21.1.el9_6/rebuild.details.txt @@ -0,0 +1,18 @@ +Rebuild_History BUILDABLE +Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50% +Number of commits in upstream range v5.14~1..kernel-mainline: 309912 +Number of commits in rpm: 8 +Number of commits matched with upstream: 6 (75.00%) +Number of commits in upstream but not in rpm: 309906 +Number of commits NOT found in upstream: 2 (25.00%) + +Rebuilding Kernel on Branch rocky9_6_rebuild_kernel-5.14.0-570.21.1.el9_6 for kernel-5.14.0-570.21.1.el9_6 +Clean Cherry Picks: 6 (100.00%) +Empty Cherry Picks: 0 (0.00%) +_______________________________ + +__EMPTY COMMITS__________________________ + +__CHANGES NOT IN UPSTREAM________________ +Porting to Rocky Linux 9, debranding and Rocky branding' +Ensure aarch64 kernel is not compressed' diff --git a/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/5a6ac3f4.failed b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/5a6ac3f4.failed new file mode 100644 index 0000000000000..649edd0de675d --- /dev/null +++ b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/5a6ac3f4.failed @@ -0,0 +1,110 @@ +media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags + +jira LE-3262 +Rebuild_History Non-Buildable kernel-5.14.0-570.22.1.el9_6 +commit-author Laurent Pinchart +commit 5a6ac3f4b46fd86d13e1d8ab4a55e4d89f3ab400 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/5a6ac3f4.failed + +The V4L2_MBUS_CSI2_CHANNEL_* flags are a legacy API. Only +V4L2_MBUS_CSI2_CHANNEL_0 is used, set in a single driver, and never +read. Drop those flags. Virtual channel information should be conveyed +through frame descriptors instead. + + Signed-off-by: Laurent Pinchart + Signed-off-by: Sakari Ailus + Signed-off-by: Mauro Carvalho Chehab +(cherry picked from commit 5a6ac3f4b46fd86d13e1d8ab4a55e4d89f3ab400) + Signed-off-by: Jonathan Maple + +# Conflicts: +# drivers/media/i2c/adv7180.c +# include/media/v4l2-mediabus.h +diff --cc drivers/media/i2c/adv7180.c +index 811619651329,3ff37a550810..000000000000 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@@ -768,8 -784,8 +768,13 @@@ static int adv7180_get_mbus_config(stru + + if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2) { + cfg->type = V4L2_MBUS_CSI2_DPHY; +++<<<<<<< HEAD + + cfg->flags = V4L2_MBUS_CSI2_1_LANE | + + V4L2_MBUS_CSI2_CHANNEL_0 | +++======= ++ cfg->bus.mipi_csi2.num_data_lanes = 1; ++ cfg->bus.mipi_csi2.flags = +++>>>>>>> 5a6ac3f4b46f (media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags) + V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; + } else { + /* +diff --cc include/media/v4l2-mediabus.h +index b77871485306,c6626a22b394..000000000000 +--- a/include/media/v4l2-mediabus.h ++++ b/include/media/v4l2-mediabus.h +@@@ -76,10 -71,54 +71,61 @@@ + #define V4L2_MBUS_CSI2_CONTINUOUS_CLOCK BIT(8) + #define V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK BIT(9) + +++<<<<<<< HEAD + +#define V4L2_MBUS_CSI2_CHANNELS (V4L2_MBUS_CSI2_CHANNEL_0 | \ + + V4L2_MBUS_CSI2_CHANNEL_1 | \ + + V4L2_MBUS_CSI2_CHANNEL_2 | \ + + V4L2_MBUS_CSI2_CHANNEL_3) +++======= ++ #define V4L2_MBUS_CSI2_MAX_DATA_LANES 8 ++ ++ /** ++ * struct v4l2_mbus_config_mipi_csi2 - MIPI CSI-2 data bus configuration ++ * @flags: media bus (V4L2_MBUS_*) flags ++ * @data_lanes: an array of physical data lane indexes ++ * @clock_lane: physical lane index of the clock lane ++ * @num_data_lanes: number of data lanes ++ * @lane_polarities: polarity of the lanes. The order is the same of ++ * the physical lanes. ++ */ ++ struct v4l2_mbus_config_mipi_csi2 { ++ unsigned int flags; ++ unsigned char data_lanes[V4L2_MBUS_CSI2_MAX_DATA_LANES]; ++ unsigned char clock_lane; ++ unsigned char num_data_lanes; ++ bool lane_polarities[1 + V4L2_MBUS_CSI2_MAX_DATA_LANES]; ++ }; ++ ++ /** ++ * struct v4l2_mbus_config_parallel - parallel data bus configuration ++ * @flags: media bus (V4L2_MBUS_*) flags ++ * @bus_width: bus width in bits ++ * @data_shift: data shift in bits ++ */ ++ struct v4l2_mbus_config_parallel { ++ unsigned int flags; ++ unsigned char bus_width; ++ unsigned char data_shift; ++ }; ++ ++ /** ++ * struct v4l2_mbus_config_mipi_csi1 - CSI-1/CCP2 data bus configuration ++ * @clock_inv: polarity of clock/strobe signal ++ * false - not inverted, true - inverted ++ * @strobe: false - data/clock, true - data/strobe ++ * @lane_polarity: the polarities of the clock (index 0) and data lanes ++ * index (1) ++ * @data_lane: the number of the data lane ++ * @clock_lane: the number of the clock lane ++ */ ++ struct v4l2_mbus_config_mipi_csi1 { ++ unsigned char clock_inv:1; ++ unsigned char strobe:1; ++ bool lane_polarity[2]; ++ unsigned char data_lane; ++ unsigned char clock_lane; ++ }; +++>>>>>>> 5a6ac3f4b46f (media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags) + + /** + * enum v4l2_mbus_type - media bus type +* Unmerged path drivers/media/i2c/adv7180.c +* Unmerged path include/media/v4l2-mediabus.h diff --git a/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/654b33ad.failed b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/654b33ad.failed new file mode 100644 index 0000000000000..0402e4f2d9055 --- /dev/null +++ b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/654b33ad.failed @@ -0,0 +1,193 @@ +proc: fix UAF in proc_get_inode() + +jira LE-3262 +cve CVE-2025-21999 +Rebuild_History Non-Buildable kernel-5.14.0-570.22.1.el9_6 +commit-author Ye Bin +commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/654b33ad.failed + +Fix race between rmmod and /proc/XXX's inode instantiation. + +The bug is that pde->proc_ops don't belong to /proc, it belongs to a +module, therefore dereferencing it after /proc entry has been registered +is a bug unless use_pde/unuse_pde() pair has been used. + +use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops +never changes so information necessary for inode instantiation can be +saved _before_ proc_register() in PDE itself and used later, avoiding +pde->proc_ops->... dereference. + + rmmod lookup +sys_delete_module + proc_lookup_de + pde_get(de); + proc_get_inode(dir->i_sb, de); + mod->exit() + proc_remove + remove_proc_subtree + proc_entry_rundown(de); + free_module(mod); + + if (S_ISREG(inode->i_mode)) + if (de->proc_ops->proc_read_iter) + --> As module is already freed, will trigger UAF + +BUG: unable to handle page fault for address: fffffbfff80a702b +PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 +Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI +CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) +RIP: 0010:proc_get_inode+0x302/0x6e0 +RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 +RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 +RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 +RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 +R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 +R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 +FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + proc_lookup_de+0x11f/0x2e0 + __lookup_slow+0x188/0x350 + walk_component+0x2ab/0x4f0 + path_lookupat+0x120/0x660 + filename_lookup+0x1ce/0x560 + vfs_statx+0xac/0x150 + __do_sys_newstat+0x96/0x110 + do_syscall_64+0x5f/0x170 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +[adobriyan@gmail.com: don't do 2 atomic ops on the common path] +Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183 +Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression") + Signed-off-by: Ye Bin + Signed-off-by: Alexey Dobriyan + Cc: Al Viro + Cc: David S. Miller + Cc: + Signed-off-by: Andrew Morton +(cherry picked from commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df) + Signed-off-by: Jonathan Maple + +# Conflicts: +# fs/proc/internal.h +diff --cc fs/proc/internal.h +index 92bb5d4ce5a3,77a517f91821..000000000000 +--- a/fs/proc/internal.h ++++ b/fs/proc/internal.h +@@@ -79,6 -80,25 +79,28 @@@ static inline bool pde_is_permanent(con + return pde->flags & PROC_ENTRY_PERMANENT; + } + +++<<<<<<< HEAD +++======= ++ static inline void pde_make_permanent(struct proc_dir_entry *pde) ++ { ++ pde->flags |= PROC_ENTRY_PERMANENT; ++ } ++ ++ static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde) ++ { ++ return pde->flags & PROC_ENTRY_proc_read_iter; ++ } ++ ++ static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) ++ { ++ #ifdef CONFIG_COMPAT ++ return pde->flags & PROC_ENTRY_proc_compat_ioctl; ++ #else ++ return false; ++ #endif ++ } ++ +++>>>>>>> 654b33ada4ab (proc: fix UAF in proc_get_inode()) + extern struct kmem_cache *proc_dir_entry_cache; + void pde_free(struct proc_dir_entry *pde); + +diff --git a/fs/proc/generic.c b/fs/proc/generic.c +index 8379593fa4bb..1edf53be9bdb 100644 +--- a/fs/proc/generic.c ++++ b/fs/proc/generic.c +@@ -558,10 +558,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, + return p; + } + +-static inline void pde_set_flags(struct proc_dir_entry *pde) ++static void pde_set_flags(struct proc_dir_entry *pde) + { + if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) + pde->flags |= PROC_ENTRY_PERMANENT; ++ if (pde->proc_ops->proc_read_iter) ++ pde->flags |= PROC_ENTRY_proc_read_iter; ++#ifdef CONFIG_COMPAT ++ if (pde->proc_ops->proc_compat_ioctl) ++ pde->flags |= PROC_ENTRY_proc_compat_ioctl; ++#endif + } + + struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, +@@ -625,6 +631,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, + p->proc_ops = &proc_seq_ops; + p->seq_ops = ops; + p->state_size = state_size; ++ pde_set_flags(p); + return proc_register(parent, p); + } + EXPORT_SYMBOL(proc_create_seq_private); +@@ -655,6 +662,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, + return NULL; + p->proc_ops = &proc_single_ops; + p->single_show = show; ++ pde_set_flags(p); + return proc_register(parent, p); + } + EXPORT_SYMBOL(proc_create_single_data); +diff --git a/fs/proc/inode.c b/fs/proc/inode.c +index e2174a8bf617..68d99cea93b2 100644 +--- a/fs/proc/inode.c ++++ b/fs/proc/inode.c +@@ -674,13 +674,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) + + if (S_ISREG(inode->i_mode)) { + inode->i_op = de->proc_iops; +- if (de->proc_ops->proc_read_iter) ++ if (pde_has_proc_read_iter(de)) + inode->i_fop = &proc_iter_file_ops; + else + inode->i_fop = &proc_reg_file_ops; + #ifdef CONFIG_COMPAT +- if (de->proc_ops->proc_compat_ioctl) { +- if (de->proc_ops->proc_read_iter) ++ if (pde_has_proc_compat_ioctl(de)) { ++ if (pde_has_proc_read_iter(de)) + inode->i_fop = &proc_iter_file_ops_compat; + else + inode->i_fop = &proc_reg_file_ops_compat; +* Unmerged path fs/proc/internal.h +diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h +index 12bf96916c8b..6f7b89b520d6 100644 +--- a/include/linux/proc_fs.h ++++ b/include/linux/proc_fs.h +@@ -20,10 +20,13 @@ enum { + * If in doubt, ignore this flag. + */ + #ifdef MODULE +- PROC_ENTRY_PERMANENT = 0U, ++ PROC_ENTRY_PERMANENT = 0U, + #else +- PROC_ENTRY_PERMANENT = 1U << 0, ++ PROC_ENTRY_PERMANENT = 1U << 0, + #endif ++ ++ PROC_ENTRY_proc_read_iter = 1U << 1, ++ PROC_ENTRY_proc_compat_ioctl = 1U << 2, + }; + + struct proc_ops { diff --git a/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/6a7bdd89.failed b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/6a7bdd89.failed new file mode 100644 index 0000000000000..3e027dc17a25a --- /dev/null +++ b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/6a7bdd89.failed @@ -0,0 +1,436 @@ +media: v4l2-mediabus: Use structures to describe bus configuration + +jira LE-3262 +Rebuild_History Non-Buildable kernel-5.14.0-570.22.1.el9_6 +commit-author Laurent Pinchart +commit 6a7bdd89f50d399dd02847e6f398d408b086df50 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/6a7bdd89.failed + +The media bus configuration is specified through a set of flags, some of +which being mutually exclusive. This doesn't scale to express more +complex configurations. Improve the API by replacing the single flags +field in v4l2_mbus_config by a union of v4l2_mbus_config_* structures. +The flags themselves are still used in those structures, so they are +kept here. Drivers are however updated to use structure fields instead +of flags when already possible. + + Signed-off-by: Laurent Pinchart + Signed-off-by: Sakari Ailus + Signed-off-by: Mauro Carvalho Chehab +(cherry picked from commit 6a7bdd89f50d399dd02847e6f398d408b086df50) + Signed-off-by: Jonathan Maple + +# Conflicts: +# drivers/media/platform/atmel/microchip-csi2dc.c +* Unmerged path drivers/media/platform/atmel/microchip-csi2dc.c +diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c +index 8ae301eef643..4a0d82830a15 100644 +--- a/drivers/gpu/ipu-v3/ipu-csi.c ++++ b/drivers/gpu/ipu-v3/ipu-csi.c +@@ -343,11 +343,11 @@ static int fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg, + switch (mbus_cfg->type) { + case V4L2_MBUS_PARALLEL: + csicfg->ext_vsync = 1; +- csicfg->vsync_pol = (mbus_cfg->flags & ++ csicfg->vsync_pol = (mbus_cfg->bus.parallel.flags & + V4L2_MBUS_VSYNC_ACTIVE_LOW) ? 1 : 0; +- csicfg->hsync_pol = (mbus_cfg->flags & ++ csicfg->hsync_pol = (mbus_cfg->bus.parallel.flags & + V4L2_MBUS_HSYNC_ACTIVE_LOW) ? 1 : 0; +- csicfg->pixclk_pol = (mbus_cfg->flags & ++ csicfg->pixclk_pol = (mbus_cfg->bus.parallel.flags & + V4L2_MBUS_PCLK_SAMPLE_FALLING) ? 1 : 0; + csicfg->clk_mode = IPU_CSI_CLK_MODE_GATED_CLK; + break; +diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c +index 811619651329..d7005e846620 100644 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@ -768,7 +768,8 @@ static int adv7180_get_mbus_config(struct v4l2_subdev *sd, + + if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2) { + cfg->type = V4L2_MBUS_CSI2_DPHY; +- cfg->flags = V4L2_MBUS_CSI2_1_LANE | ++ cfg->bus.mipi_csi2.num_data_lanes = 1; ++ cfg->bus.mipi_csi2.flags = + V4L2_MBUS_CSI2_CHANNEL_0 | + V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; + } else { +@@ -776,8 +777,9 @@ static int adv7180_get_mbus_config(struct v4l2_subdev *sd, + * The ADV7180 sensor supports BT.601/656 output modes. + * The BT.656 is default and not yet configurable by s/w. + */ +- cfg->flags = V4L2_MBUS_MASTER | V4L2_MBUS_PCLK_SAMPLE_RISING | +- V4L2_MBUS_DATA_ACTIVE_HIGH; ++ cfg->bus.parallel.flags = V4L2_MBUS_MASTER | ++ V4L2_MBUS_PCLK_SAMPLE_RISING | ++ V4L2_MBUS_DATA_ACTIVE_HIGH; + cfg->type = V4L2_MBUS_BT656; + } + +diff --git a/drivers/media/i2c/adv748x/adv748x-csi2.c b/drivers/media/i2c/adv748x/adv748x-csi2.c +index 589e9644fcdc..bd4f3fe0e309 100644 +--- a/drivers/media/i2c/adv748x/adv748x-csi2.c ++++ b/drivers/media/i2c/adv748x/adv748x-csi2.c +@@ -222,23 +222,7 @@ static int adv748x_csi2_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad + return -EINVAL; + + config->type = V4L2_MBUS_CSI2_DPHY; +- switch (tx->active_lanes) { +- case 1: +- config->flags = V4L2_MBUS_CSI2_1_LANE; +- break; +- +- case 2: +- config->flags = V4L2_MBUS_CSI2_2_LANE; +- break; +- +- case 3: +- config->flags = V4L2_MBUS_CSI2_3_LANE; +- break; +- +- case 4: +- config->flags = V4L2_MBUS_CSI2_4_LANE; +- break; +- } ++ config->bus.mipi_csi2.num_data_lanes = tx->active_lanes; + + return 0; + } +diff --git a/drivers/media/i2c/ml86v7667.c b/drivers/media/i2c/ml86v7667.c +index 4a1410ebb4c8..48cc0b0922f4 100644 +--- a/drivers/media/i2c/ml86v7667.c ++++ b/drivers/media/i2c/ml86v7667.c +@@ -223,9 +223,10 @@ static int ml86v7667_get_mbus_config(struct v4l2_subdev *sd, + unsigned int pad, + struct v4l2_mbus_config *cfg) + { +- cfg->flags = V4L2_MBUS_MASTER | V4L2_MBUS_PCLK_SAMPLE_RISING | +- V4L2_MBUS_DATA_ACTIVE_HIGH; + cfg->type = V4L2_MBUS_BT656; ++ cfg->bus.parallel.flags = V4L2_MBUS_MASTER | ++ V4L2_MBUS_PCLK_SAMPLE_RISING | ++ V4L2_MBUS_DATA_ACTIVE_HIGH; + + return 0; + } +diff --git a/drivers/media/i2c/mt9m001.c b/drivers/media/i2c/mt9m001.c +index 3e7814cc86e4..9dc87e42a6e6 100644 +--- a/drivers/media/i2c/mt9m001.c ++++ b/drivers/media/i2c/mt9m001.c +@@ -695,10 +695,12 @@ static int mt9m001_get_mbus_config(struct v4l2_subdev *sd, + struct v4l2_mbus_config *cfg) + { + /* MT9M001 has all capture_format parameters fixed */ +- cfg->flags = V4L2_MBUS_PCLK_SAMPLE_FALLING | +- V4L2_MBUS_HSYNC_ACTIVE_HIGH | V4L2_MBUS_VSYNC_ACTIVE_HIGH | +- V4L2_MBUS_DATA_ACTIVE_HIGH | V4L2_MBUS_MASTER; + cfg->type = V4L2_MBUS_PARALLEL; ++ cfg->bus.parallel.flags = V4L2_MBUS_PCLK_SAMPLE_FALLING | ++ V4L2_MBUS_HSYNC_ACTIVE_HIGH | ++ V4L2_MBUS_VSYNC_ACTIVE_HIGH | ++ V4L2_MBUS_DATA_ACTIVE_HIGH | ++ V4L2_MBUS_MASTER; + + return 0; + } +diff --git a/drivers/media/i2c/mt9m111.c b/drivers/media/i2c/mt9m111.c +index 78dc896ca116..9df005746bc4 100644 +--- a/drivers/media/i2c/mt9m111.c ++++ b/drivers/media/i2c/mt9m111.c +@@ -1143,14 +1143,16 @@ static int mt9m111_get_mbus_config(struct v4l2_subdev *sd, + { + struct mt9m111 *mt9m111 = container_of(sd, struct mt9m111, subdev); + +- cfg->flags = V4L2_MBUS_MASTER | +- V4L2_MBUS_HSYNC_ACTIVE_HIGH | V4L2_MBUS_VSYNC_ACTIVE_HIGH | +- V4L2_MBUS_DATA_ACTIVE_HIGH; ++ cfg->type = V4L2_MBUS_PARALLEL; + +- cfg->flags |= mt9m111->pclk_sample ? V4L2_MBUS_PCLK_SAMPLE_RISING : +- V4L2_MBUS_PCLK_SAMPLE_FALLING; ++ cfg->bus.parallel.flags = V4L2_MBUS_MASTER | ++ V4L2_MBUS_HSYNC_ACTIVE_HIGH | ++ V4L2_MBUS_VSYNC_ACTIVE_HIGH | ++ V4L2_MBUS_DATA_ACTIVE_HIGH; + +- cfg->type = V4L2_MBUS_PARALLEL; ++ cfg->bus.parallel.flags |= mt9m111->pclk_sample ? ++ V4L2_MBUS_PCLK_SAMPLE_RISING : ++ V4L2_MBUS_PCLK_SAMPLE_FALLING; + + return 0; + } +diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c +index f67412150b16..b224b033cea1 100644 +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -932,15 +932,15 @@ static int ov6650_get_mbus_config(struct v4l2_subdev *sd, + if (ret) + return ret; + +- cfg->flags = V4L2_MBUS_MASTER | V4L2_MBUS_DATA_ACTIVE_HIGH +- | ((comj & COMJ_VSYNC_HIGH) ? V4L2_MBUS_VSYNC_ACTIVE_HIGH +- : V4L2_MBUS_VSYNC_ACTIVE_LOW) +- | ((comf & COMF_HREF_LOW) ? V4L2_MBUS_HSYNC_ACTIVE_LOW +- : V4L2_MBUS_HSYNC_ACTIVE_HIGH) +- | ((comj & COMJ_PCLK_RISING) ? V4L2_MBUS_PCLK_SAMPLE_RISING +- : V4L2_MBUS_PCLK_SAMPLE_FALLING); + cfg->type = V4L2_MBUS_PARALLEL; + ++ cfg->bus.parallel.flags = V4L2_MBUS_MASTER | V4L2_MBUS_DATA_ACTIVE_HIGH ++ | ((comj & COMJ_VSYNC_HIGH) ? V4L2_MBUS_VSYNC_ACTIVE_HIGH ++ : V4L2_MBUS_VSYNC_ACTIVE_LOW) ++ | ((comf & COMF_HREF_LOW) ? V4L2_MBUS_HSYNC_ACTIVE_LOW ++ : V4L2_MBUS_HSYNC_ACTIVE_HIGH) ++ | ((comj & COMJ_PCLK_RISING) ? V4L2_MBUS_PCLK_SAMPLE_RISING ++ : V4L2_MBUS_PCLK_SAMPLE_FALLING); + return 0; + } + +diff --git a/drivers/media/i2c/ov9640.c b/drivers/media/i2c/ov9640.c +index 0bab8c2cf160..9f44ed52d164 100644 +--- a/drivers/media/i2c/ov9640.c ++++ b/drivers/media/i2c/ov9640.c +@@ -652,10 +652,12 @@ static int ov9640_get_mbus_config(struct v4l2_subdev *sd, + unsigned int pad, + struct v4l2_mbus_config *cfg) + { +- cfg->flags = V4L2_MBUS_PCLK_SAMPLE_RISING | V4L2_MBUS_MASTER | +- V4L2_MBUS_VSYNC_ACTIVE_HIGH | V4L2_MBUS_HSYNC_ACTIVE_HIGH | +- V4L2_MBUS_DATA_ACTIVE_HIGH; + cfg->type = V4L2_MBUS_PARALLEL; ++ cfg->bus.parallel.flags = V4L2_MBUS_PCLK_SAMPLE_RISING | ++ V4L2_MBUS_MASTER | ++ V4L2_MBUS_VSYNC_ACTIVE_HIGH | ++ V4L2_MBUS_HSYNC_ACTIVE_HIGH | ++ V4L2_MBUS_DATA_ACTIVE_HIGH; + + return 0; + } +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 3205cd8298dd..6ac92ea65fb0 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -1613,24 +1613,8 @@ static int tc358743_get_mbus_config(struct v4l2_subdev *sd, + cfg->type = V4L2_MBUS_CSI2_DPHY; + + /* Support for non-continuous CSI-2 clock is missing in the driver */ +- cfg->flags = V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; +- +- switch (state->csi_lanes_in_use) { +- case 1: +- cfg->flags |= V4L2_MBUS_CSI2_1_LANE; +- break; +- case 2: +- cfg->flags |= V4L2_MBUS_CSI2_2_LANE; +- break; +- case 3: +- cfg->flags |= V4L2_MBUS_CSI2_3_LANE; +- break; +- case 4: +- cfg->flags |= V4L2_MBUS_CSI2_4_LANE; +- break; +- default: +- return -EINVAL; +- } ++ cfg->bus.mipi_csi2.flags = V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; ++ cfg->bus.mipi_csi2.num_data_lanes = state->csi_lanes_in_use; + + return 0; + } +diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c +index 995d0c7bc591..65e901aab267 100644 +--- a/drivers/media/i2c/tvp5150.c ++++ b/drivers/media/i2c/tvp5150.c +@@ -1198,8 +1198,10 @@ static int tvp5150_get_mbus_config(struct v4l2_subdev *sd, + struct tvp5150 *decoder = to_tvp5150(sd); + + cfg->type = decoder->mbus_type; +- cfg->flags = V4L2_MBUS_MASTER | V4L2_MBUS_PCLK_SAMPLE_RISING +- | V4L2_MBUS_FIELD_EVEN_LOW | V4L2_MBUS_DATA_ACTIVE_HIGH; ++ cfg->bus.parallel.flags = V4L2_MBUS_MASTER ++ | V4L2_MBUS_PCLK_SAMPLE_RISING ++ | V4L2_MBUS_FIELD_EVEN_LOW ++ | V4L2_MBUS_DATA_ACTIVE_HIGH; + + return 0; + } +* Unmerged path drivers/media/platform/atmel/microchip-csi2dc.c +diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c +index 89f6a0bd1d2e..3387920ce645 100644 +--- a/drivers/media/platform/pxa_camera.c ++++ b/drivers/media/platform/pxa_camera.c +@@ -1589,24 +1589,26 @@ static int pxa_camera_set_bus_param(struct pxa_camera_dev *pcdev) + * PXA does not support V4L2_MBUS_DATA_ACTIVE_LOW and the bus mastering + * roles should match. + */ +- if (cfg.flags != mbus_config) { ++ if (cfg.bus.parallel.flags != mbus_config) { + unsigned int pxa_mbus_role = mbus_config & (V4L2_MBUS_MASTER | + V4L2_MBUS_SLAVE); +- if (pxa_mbus_role != (cfg.flags & (V4L2_MBUS_MASTER | +- V4L2_MBUS_SLAVE))) { ++ unsigned int flags = cfg.bus.parallel.flags; ++ ++ if (pxa_mbus_role != (flags & (V4L2_MBUS_MASTER | ++ V4L2_MBUS_SLAVE))) { + dev_err(pcdev_to_dev(pcdev), + "Unsupported mbus configuration: bus mastering\n"); + return -EINVAL; + } + +- if (cfg.flags & V4L2_MBUS_DATA_ACTIVE_LOW) { ++ if (flags & V4L2_MBUS_DATA_ACTIVE_LOW) { + dev_err(pcdev_to_dev(pcdev), + "Unsupported mbus configuration: DATA_ACTIVE_LOW\n"); + return -EINVAL; + } + } + +- pxa_camera_setup_cicr(pcdev, cfg.flags, pixfmt); ++ pxa_camera_setup_cicr(pcdev, cfg.bus.parallel.flags, pixfmt); + + return 0; + } +diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c +index e593c97bf527..0aa9063a8962 100644 +--- a/drivers/media/platform/rcar-vin/rcar-csi2.c ++++ b/drivers/media/platform/rcar-vin/rcar-csi2.c +@@ -495,7 +495,6 @@ static int rcsi2_get_active_lanes(struct rcar_csi2 *priv, + unsigned int *lanes) + { + struct v4l2_mbus_config mbus_config = { 0 }; +- unsigned int num_lanes = UINT_MAX; + int ret; + + *lanes = priv->lanes; +@@ -518,23 +517,14 @@ static int rcsi2_get_active_lanes(struct rcar_csi2 *priv, + return -EINVAL; + } + +- if (mbus_config.flags & V4L2_MBUS_CSI2_1_LANE) +- num_lanes = 1; +- else if (mbus_config.flags & V4L2_MBUS_CSI2_2_LANE) +- num_lanes = 2; +- else if (mbus_config.flags & V4L2_MBUS_CSI2_3_LANE) +- num_lanes = 3; +- else if (mbus_config.flags & V4L2_MBUS_CSI2_4_LANE) +- num_lanes = 4; +- +- if (num_lanes > priv->lanes) { ++ if (mbus_config.bus.mipi_csi2.num_data_lanes > priv->lanes) { + dev_err(priv->dev, + "Unsupported mbus config: too many data lanes %u\n", +- num_lanes); ++ mbus_config.bus.mipi_csi2.num_data_lanes); + return -EINVAL; + } + +- *lanes = num_lanes; ++ *lanes = mbus_config.bus.mipi_csi2.num_data_lanes; + + return 0; + } +diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c +index 4e0d5a500c53..bf0f5ea33a17 100644 +--- a/drivers/staging/media/imx/imx-media-csi.c ++++ b/drivers/staging/media/imx/imx-media-csi.c +@@ -713,9 +713,10 @@ static int csi_setup(struct csi_priv *priv) + + /* compose mbus_config from the upstream endpoint */ + mbus_cfg.type = priv->upstream_ep.bus_type; +- mbus_cfg.flags = is_parallel_bus(&priv->upstream_ep) ? +- priv->upstream_ep.bus.parallel.flags : +- priv->upstream_ep.bus.mipi_csi2.flags; ++ if (is_parallel_bus(&priv->upstream_ep)) ++ mbus_cfg.bus.parallel = priv->upstream_ep.bus.parallel; ++ else ++ mbus_cfg.bus.mipi_csi2 = priv->upstream_ep.bus.mipi_csi2; + + if_fmt = *infmt; + crop = priv->crop; +diff --git a/drivers/staging/media/imx/imx6-mipi-csi2.c b/drivers/staging/media/imx/imx6-mipi-csi2.c +index 391886851df2..deaf8de2256a 100644 +--- a/drivers/staging/media/imx/imx6-mipi-csi2.c ++++ b/drivers/staging/media/imx/imx6-mipi-csi2.c +@@ -303,7 +303,6 @@ static void csi2ipu_gasket_init(struct csi2_dev *csi2) + static int csi2_get_active_lanes(struct csi2_dev *csi2, unsigned int *lanes) + { + struct v4l2_mbus_config mbus_config = { 0 }; +- unsigned int num_lanes = UINT_MAX; + int ret; + + *lanes = csi2->data_lanes; +@@ -326,32 +325,14 @@ static int csi2_get_active_lanes(struct csi2_dev *csi2, unsigned int *lanes) + return -EINVAL; + } + +- switch (mbus_config.flags & V4L2_MBUS_CSI2_LANES) { +- case V4L2_MBUS_CSI2_1_LANE: +- num_lanes = 1; +- break; +- case V4L2_MBUS_CSI2_2_LANE: +- num_lanes = 2; +- break; +- case V4L2_MBUS_CSI2_3_LANE: +- num_lanes = 3; +- break; +- case V4L2_MBUS_CSI2_4_LANE: +- num_lanes = 4; +- break; +- default: +- num_lanes = csi2->data_lanes; +- break; +- } +- +- if (num_lanes > csi2->data_lanes) { ++ if (mbus_config.bus.mipi_csi2.num_data_lanes > csi2->data_lanes) { + dev_err(csi2->dev, + "Unsupported mbus config: too many data lanes %u\n", +- num_lanes); ++ mbus_config.bus.mipi_csi2.num_data_lanes); + return -EINVAL; + } + +- *lanes = num_lanes; ++ *lanes = mbus_config.bus.mipi_csi2.num_data_lanes; + + return 0; + } +diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h +index b77871485306..b501ec97814a 100644 +--- a/include/media/v4l2-mediabus.h ++++ b/include/media/v4l2-mediabus.h +@@ -106,12 +106,26 @@ enum v4l2_mbus_type { + + /** + * struct v4l2_mbus_config - media bus configuration +- * @type: in: interface type +- * @flags: in / out: configuration flags, depending on @type ++ * @type: interface type ++ * @bus: bus configuration data structure ++ * @bus.parallel: embedded &struct v4l2_mbus_config_parallel. ++ * Used if the bus is parallel or BT.656. ++ * @bus.mipi_csi1: embedded &struct v4l2_mbus_config_mipi_csi1. ++ * Used if the bus is MIPI Alliance's Camera Serial ++ * Interface version 1 (MIPI CSI1) or Standard ++ * Mobile Imaging Architecture's Compact Camera Port 2 ++ * (SMIA CCP2). ++ * @bus.mipi_csi2: embedded &struct v4l2_mbus_config_mipi_csi2. ++ * Used if the bus is MIPI Alliance's Camera Serial ++ * Interface version 2 (MIPI CSI2). + */ + struct v4l2_mbus_config { + enum v4l2_mbus_type type; +- unsigned int flags; ++ union { ++ struct v4l2_mbus_config_parallel parallel; ++ struct v4l2_mbus_config_mipi_csi1 mipi_csi1; ++ struct v4l2_mbus_config_mipi_csi2 mipi_csi2; ++ } bus; + }; + + /** diff --git a/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/94d964e5.failed b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/94d964e5.failed new file mode 100644 index 0000000000000..f1fa6d640a552 --- /dev/null +++ b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/94d964e5.failed @@ -0,0 +1,417 @@ +media: v4l2-fwnode: Move bus config structure to v4l2_mediabus.h + +jira LE-3262 +Rebuild_History Non-Buildable kernel-5.14.0-570.22.1.el9_6 +commit-author Laurent Pinchart +commit 94d964e58ad6ba907c4169be99267ef517796614 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/94d964e5.failed + +To prepare for usage of the v4l2_fwnode_bus_* data structures to +describe bus configuration in the subdev .get_mbus_config() operation, +rename the structures with a v4l2_mbus_config_ prefix instead of +v4l2_fwnode_bus_, and move them to v4l2_mediabus.h. + + Signed-off-by: Laurent Pinchart + Signed-off-by: Sakari Ailus + Signed-off-by: Mauro Carvalho Chehab +(cherry picked from commit 94d964e58ad6ba907c4169be99267ef517796614) + Signed-off-by: Jonathan Maple + +# Conflicts: +# drivers/media/platform/ti-vpe/cal-camerarx.c +# drivers/staging/media/imx/imx8mq-mipi-csi2.c +# drivers/staging/media/max96712/max96712.c +diff --cc drivers/media/platform/ti-vpe/cal-camerarx.c +index 48514f0f4ce8,6b43a1525b45..000000000000 +--- a/drivers/media/platform/ti-vpe/cal-camerarx.c ++++ b/drivers/media/platform/ti-vpe/cal-camerarx.c +@@@ -45,22 -45,30 +45,30 @@@ static inline void camerarx_write(struc + * ------------------------------------------------------------------ + */ + + -static s64 cal_camerarx_get_ext_link_freq(struct cal_camerarx *phy) + +static s64 cal_camerarx_get_external_rate(struct cal_camerarx *phy) + { +++<<<<<<< HEAD + + struct v4l2_ctrl *ctrl; + + s64 rate; +++======= ++ struct v4l2_mbus_config_mipi_csi2 *mipi_csi2 = &phy->endpoint.bus.mipi_csi2; ++ u32 num_lanes = mipi_csi2->num_data_lanes; ++ const struct cal_format_info *fmtinfo; ++ u32 bpp; ++ s64 freq; +++>>>>>>> 94d964e58ad6 (media: v4l2-fwnode: Move bus config structure to v4l2_mediabus.h) + + - fmtinfo = cal_format_by_code(phy->formats[CAL_CAMERARX_PAD_SINK].code); + - if (!fmtinfo) + - return -EINVAL; + - + - bpp = fmtinfo->bpp; + - + - freq = v4l2_get_link_freq(phy->source->ctrl_handler, bpp, 2 * num_lanes); + - if (freq < 0) { + - phy_err(phy, "failed to get link freq for subdev '%s'\n", + - phy->source->name); + - return freq; + + ctrl = v4l2_ctrl_find(phy->sensor->ctrl_handler, V4L2_CID_PIXEL_RATE); + + if (!ctrl) { + + phy_err(phy, "no pixel rate control in subdev: %s\n", + + phy->sensor->name); + + return -EPIPE; + } + + - phy_dbg(3, phy, "Source Link Freq: %llu\n", freq); + + rate = v4l2_ctrl_g_ctrl_int64(ctrl); + + phy_dbg(3, phy, "sensor Pixel Rate: %llu\n", rate); + + - return freq; + + return rate; + } + + static void cal_camerarx_lane_config(struct cal_camerarx *phy) +* Unmerged path drivers/staging/media/imx/imx8mq-mipi-csi2.c +* Unmerged path drivers/staging/media/max96712/max96712.c +diff --git a/drivers/media/i2c/ov5648.c b/drivers/media/i2c/ov5648.c +index 947d437ed0ef..87f9b724cd7f 100644 +--- a/drivers/media/i2c/ov5648.c ++++ b/drivers/media/i2c/ov5648.c +@@ -1112,7 +1112,7 @@ static int ov5648_pad_configure(struct ov5648_sensor *sensor) + + static int ov5648_mipi_configure(struct ov5648_sensor *sensor) + { +- struct v4l2_fwnode_bus_mipi_csi2 *bus_mipi_csi2 = ++ struct v4l2_mbus_config_mipi_csi2 *bus_mipi_csi2 = + &sensor->endpoint.bus.mipi_csi2; + unsigned int lanes_count = bus_mipi_csi2->num_data_lanes; + int ret; +@@ -1692,7 +1692,7 @@ static int ov5648_state_mipi_configure(struct ov5648_sensor *sensor, + u32 mbus_code) + { + struct ov5648_ctrls *ctrls = &sensor->ctrls; +- struct v4l2_fwnode_bus_mipi_csi2 *bus_mipi_csi2 = ++ struct v4l2_mbus_config_mipi_csi2 *bus_mipi_csi2 = + &sensor->endpoint.bus.mipi_csi2; + unsigned long mipi_clk_rate; + unsigned int bits_per_sample; +diff --git a/drivers/media/i2c/ov8865.c b/drivers/media/i2c/ov8865.c +index ce50f3ea87b8..eccfeb407391 100644 +--- a/drivers/media/i2c/ov8865.c ++++ b/drivers/media/i2c/ov8865.c +@@ -1417,7 +1417,7 @@ static int ov8865_charge_pump_configure(struct ov8865_sensor *sensor) + + static int ov8865_mipi_configure(struct ov8865_sensor *sensor) + { +- struct v4l2_fwnode_bus_mipi_csi2 *bus_mipi_csi2 = ++ struct v4l2_mbus_config_mipi_csi2 *bus_mipi_csi2 = + &sensor->endpoint.bus.mipi_csi2; + unsigned int lanes_count = bus_mipi_csi2->num_data_lanes; + int ret; +@@ -2164,7 +2164,7 @@ static int ov8865_state_mipi_configure(struct ov8865_sensor *sensor, + u32 mbus_code) + { + struct ov8865_ctrls *ctrls = &sensor->ctrls; +- struct v4l2_fwnode_bus_mipi_csi2 *bus_mipi_csi2 = ++ struct v4l2_mbus_config_mipi_csi2 *bus_mipi_csi2 = + &sensor->endpoint.bus.mipi_csi2; + unsigned long mipi_clk_rate; + unsigned int bits_per_sample; +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 3205cd8298dd..40512004afba 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -69,7 +69,7 @@ static const struct v4l2_dv_timings_cap tc358743_timings_cap = { + + struct tc358743_state { + struct tc358743_platform_data pdata; +- struct v4l2_fwnode_bus_mipi_csi2 bus; ++ struct v4l2_mbus_config_mipi_csi2 bus; + struct v4l2_subdev sd; + struct media_pad pad; + struct v4l2_ctrl_handler hdl; +diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c +index 1444264433e1..da856bee3b61 100644 +--- a/drivers/media/platform/qcom/camss/camss.c ++++ b/drivers/media/platform/qcom/camss/camss.c +@@ -832,7 +832,7 @@ static int camss_of_parse_endpoint_node(struct device *dev, + struct camss_async_subdev *csd) + { + struct csiphy_lanes_cfg *lncfg = &csd->interface.csi2.lane_cfg; +- struct v4l2_fwnode_bus_mipi_csi2 *mipi_csi2; ++ struct v4l2_mbus_config_mipi_csi2 *mipi_csi2; + struct v4l2_fwnode_endpoint vep = { { 0 } }; + unsigned int i; + +diff --git a/drivers/media/platform/rcar-vin/rcar-vin.h b/drivers/media/platform/rcar-vin/rcar-vin.h +index b263ead4db2b..b88d9890d954 100644 +--- a/drivers/media/platform/rcar-vin/rcar-vin.h ++++ b/drivers/media/platform/rcar-vin/rcar-vin.h +@@ -106,7 +106,7 @@ struct rvin_parallel_entity { + struct v4l2_subdev *subdev; + + enum v4l2_mbus_type mbus_type; +- struct v4l2_fwnode_bus_parallel bus; ++ struct v4l2_mbus_config_parallel bus; + + unsigned int source_pad; + unsigned int sink_pad; +diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c +index e5d41bfd1a82..5717e743e7ac 100644 +--- a/drivers/media/platform/stm32/stm32-dcmi.c ++++ b/drivers/media/platform/stm32/stm32-dcmi.c +@@ -149,7 +149,7 @@ struct stm32_dcmi { + struct mutex lock; + struct vb2_queue queue; + +- struct v4l2_fwnode_bus_parallel bus; ++ struct v4l2_mbus_config_parallel bus; + enum v4l2_mbus_type bus_type; + struct completion complete; + struct clk *mclk; +diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h +index c64e0be90087..4e0c2df45d4d 100644 +--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h ++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h +@@ -125,7 +125,7 @@ struct sun4i_csi { + dma_addr_t paddr; + } scratch; + +- struct v4l2_fwnode_bus_parallel bus; ++ struct v4l2_mbus_config_parallel bus; + + /* Main Device */ + struct v4l2_device v4l; +diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c +index b9c8acd3332e..6620f1039bac 100644 +--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c ++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c +@@ -226,7 +226,7 @@ static void return_all_buffers(struct sun4i_csi *csi, + static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count) + { + struct sun4i_csi *csi = vb2_get_drv_priv(vq); +- struct v4l2_fwnode_bus_parallel *bus = &csi->bus; ++ struct v4l2_mbus_config_parallel *bus = &csi->bus; + const struct sun4i_csi_format *csi_fmt; + unsigned long href_pol, pclk_pol, vref_pol; + unsigned long flags; +* Unmerged path drivers/media/platform/ti-vpe/cal-camerarx.c +diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c +index 843259c304bb..391585e1ad6b 100644 +--- a/drivers/media/v4l2-core/v4l2-fwnode.c ++++ b/drivers/media/v4l2-core/v4l2-fwnode.c +@@ -119,11 +119,11 @@ static int v4l2_fwnode_endpoint_parse_csi2_bus(struct fwnode_handle *fwnode, + struct v4l2_fwnode_endpoint *vep, + enum v4l2_mbus_type bus_type) + { +- struct v4l2_fwnode_bus_mipi_csi2 *bus = &vep->bus.mipi_csi2; ++ struct v4l2_mbus_config_mipi_csi2 *bus = &vep->bus.mipi_csi2; + bool have_clk_lane = false, have_data_lanes = false, + have_lane_polarities = false; + unsigned int flags = 0, lanes_used = 0; +- u32 array[1 + V4L2_FWNODE_CSI2_MAX_DATA_LANES]; ++ u32 array[1 + V4L2_MBUS_CSI2_MAX_DATA_LANES]; + u32 clock_lane = 0; + unsigned int num_data_lanes = 0; + bool use_default_lane_mapping = false; +@@ -136,7 +136,7 @@ static int v4l2_fwnode_endpoint_parse_csi2_bus(struct fwnode_handle *fwnode, + use_default_lane_mapping = true; + + num_data_lanes = min_t(u32, bus->num_data_lanes, +- V4L2_FWNODE_CSI2_MAX_DATA_LANES); ++ V4L2_MBUS_CSI2_MAX_DATA_LANES); + + clock_lane = bus->clock_lane; + if (clock_lane) +@@ -155,7 +155,7 @@ static int v4l2_fwnode_endpoint_parse_csi2_bus(struct fwnode_handle *fwnode, + rval = fwnode_property_count_u32(fwnode, "data-lanes"); + if (rval > 0) { + num_data_lanes = +- min_t(int, V4L2_FWNODE_CSI2_MAX_DATA_LANES, rval); ++ min_t(int, V4L2_MBUS_CSI2_MAX_DATA_LANES, rval); + + fwnode_property_read_u32_array(fwnode, "data-lanes", array, + num_data_lanes); +@@ -263,7 +263,7 @@ v4l2_fwnode_endpoint_parse_parallel_bus(struct fwnode_handle *fwnode, + struct v4l2_fwnode_endpoint *vep, + enum v4l2_mbus_type bus_type) + { +- struct v4l2_fwnode_bus_parallel *bus = &vep->bus.parallel; ++ struct v4l2_mbus_config_parallel *bus = &vep->bus.parallel; + unsigned int flags = 0; + u32 v; + +@@ -369,7 +369,7 @@ v4l2_fwnode_endpoint_parse_csi1_bus(struct fwnode_handle *fwnode, + struct v4l2_fwnode_endpoint *vep, + enum v4l2_mbus_type bus_type) + { +- struct v4l2_fwnode_bus_mipi_csi1 *bus = &vep->bus.mipi_csi1; ++ struct v4l2_mbus_config_mipi_csi1 *bus = &vep->bus.mipi_csi1; + u32 v; + + if (!fwnode_property_read_u32(fwnode, "clock-inv", &v)) { +diff --git a/drivers/staging/media/imx/imx7-mipi-csis.c b/drivers/staging/media/imx/imx7-mipi-csis.c +index bbd0efb2f015..2aa05c41e33a 100644 +--- a/drivers/staging/media/imx/imx7-mipi-csis.c ++++ b/drivers/staging/media/imx/imx7-mipi-csis.c +@@ -318,7 +318,7 @@ struct csi_state { + struct v4l2_async_notifier notifier; + struct v4l2_subdev *src_sd; + +- struct v4l2_fwnode_bus_mipi_csi2 bus; ++ struct v4l2_mbus_config_mipi_csi2 bus; + u32 clk_frequency; + u32 hs_settle; + u32 clk_settle; +* Unmerged path drivers/staging/media/imx/imx8mq-mipi-csi2.c +* Unmerged path drivers/staging/media/max96712/max96712.c +diff --git a/include/media/v4l2-fwnode.h b/include/media/v4l2-fwnode.h +index eadae31ff257..88bda4d86edc 100644 +--- a/include/media/v4l2-fwnode.h ++++ b/include/media/v4l2-fwnode.h +@@ -25,68 +25,19 @@ struct fwnode_handle; + struct v4l2_async_notifier; + struct v4l2_async_subdev; + +-#define V4L2_FWNODE_CSI2_MAX_DATA_LANES 8 +- +-/** +- * struct v4l2_fwnode_bus_mipi_csi2 - MIPI CSI-2 bus data structure +- * @flags: media bus (V4L2_MBUS_*) flags +- * @data_lanes: an array of physical data lane indexes +- * @clock_lane: physical lane index of the clock lane +- * @num_data_lanes: number of data lanes +- * @lane_polarities: polarity of the lanes. The order is the same of +- * the physical lanes. +- */ +-struct v4l2_fwnode_bus_mipi_csi2 { +- unsigned int flags; +- unsigned char data_lanes[V4L2_FWNODE_CSI2_MAX_DATA_LANES]; +- unsigned char clock_lane; +- unsigned char num_data_lanes; +- bool lane_polarities[1 + V4L2_FWNODE_CSI2_MAX_DATA_LANES]; +-}; +- +-/** +- * struct v4l2_fwnode_bus_parallel - parallel data bus data structure +- * @flags: media bus (V4L2_MBUS_*) flags +- * @bus_width: bus width in bits +- * @data_shift: data shift in bits +- */ +-struct v4l2_fwnode_bus_parallel { +- unsigned int flags; +- unsigned char bus_width; +- unsigned char data_shift; +-}; +- +-/** +- * struct v4l2_fwnode_bus_mipi_csi1 - CSI-1/CCP2 data bus structure +- * @clock_inv: polarity of clock/strobe signal +- * false - not inverted, true - inverted +- * @strobe: false - data/clock, true - data/strobe +- * @lane_polarity: the polarities of the clock (index 0) and data lanes +- * index (1) +- * @data_lane: the number of the data lane +- * @clock_lane: the number of the clock lane +- */ +-struct v4l2_fwnode_bus_mipi_csi1 { +- unsigned char clock_inv:1; +- unsigned char strobe:1; +- bool lane_polarity[2]; +- unsigned char data_lane; +- unsigned char clock_lane; +-}; +- + /** + * struct v4l2_fwnode_endpoint - the endpoint data structure + * @base: fwnode endpoint of the v4l2_fwnode + * @bus_type: bus type + * @bus: bus configuration data structure +- * @bus.parallel: embedded &struct v4l2_fwnode_bus_parallel. ++ * @bus.parallel: embedded &struct v4l2_mbus_config_parallel. + * Used if the bus is parallel. +- * @bus.mipi_csi1: embedded &struct v4l2_fwnode_bus_mipi_csi1. ++ * @bus.mipi_csi1: embedded &struct v4l2_mbus_config_mipi_csi1. + * Used if the bus is MIPI Alliance's Camera Serial + * Interface version 1 (MIPI CSI1) or Standard + * Mobile Imaging Architecture's Compact Camera Port 2 + * (SMIA CCP2). +- * @bus.mipi_csi2: embedded &struct v4l2_fwnode_bus_mipi_csi2. ++ * @bus.mipi_csi2: embedded &struct v4l2_mbus_config_mipi_csi2. + * Used if the bus is MIPI Alliance's Camera Serial + * Interface version 2 (MIPI CSI2). + * @link_frequencies: array of supported link frequencies +@@ -96,9 +47,9 @@ struct v4l2_fwnode_endpoint { + struct fwnode_endpoint base; + enum v4l2_mbus_type bus_type; + struct { +- struct v4l2_fwnode_bus_parallel parallel; +- struct v4l2_fwnode_bus_mipi_csi1 mipi_csi1; +- struct v4l2_fwnode_bus_mipi_csi2 mipi_csi2; ++ struct v4l2_mbus_config_parallel parallel; ++ struct v4l2_mbus_config_mipi_csi1 mipi_csi1; ++ struct v4l2_mbus_config_mipi_csi2 mipi_csi2; + } bus; + u64 *link_frequencies; + unsigned int nr_of_link_frequencies; +diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h +index b77871485306..03dd2a21056c 100644 +--- a/include/media/v4l2-mediabus.h ++++ b/include/media/v4l2-mediabus.h +@@ -81,6 +81,55 @@ + V4L2_MBUS_CSI2_CHANNEL_2 | \ + V4L2_MBUS_CSI2_CHANNEL_3) + ++#define V4L2_MBUS_CSI2_MAX_DATA_LANES 8 ++ ++/** ++ * struct v4l2_mbus_config_mipi_csi2 - MIPI CSI-2 data bus configuration ++ * @flags: media bus (V4L2_MBUS_*) flags ++ * @data_lanes: an array of physical data lane indexes ++ * @clock_lane: physical lane index of the clock lane ++ * @num_data_lanes: number of data lanes ++ * @lane_polarities: polarity of the lanes. The order is the same of ++ * the physical lanes. ++ */ ++struct v4l2_mbus_config_mipi_csi2 { ++ unsigned int flags; ++ unsigned char data_lanes[V4L2_MBUS_CSI2_MAX_DATA_LANES]; ++ unsigned char clock_lane; ++ unsigned char num_data_lanes; ++ bool lane_polarities[1 + V4L2_MBUS_CSI2_MAX_DATA_LANES]; ++}; ++ ++/** ++ * struct v4l2_mbus_config_parallel - parallel data bus configuration ++ * @flags: media bus (V4L2_MBUS_*) flags ++ * @bus_width: bus width in bits ++ * @data_shift: data shift in bits ++ */ ++struct v4l2_mbus_config_parallel { ++ unsigned int flags; ++ unsigned char bus_width; ++ unsigned char data_shift; ++}; ++ ++/** ++ * struct v4l2_mbus_config_mipi_csi1 - CSI-1/CCP2 data bus configuration ++ * @clock_inv: polarity of clock/strobe signal ++ * false - not inverted, true - inverted ++ * @strobe: false - data/clock, true - data/strobe ++ * @lane_polarity: the polarities of the clock (index 0) and data lanes ++ * index (1) ++ * @data_lane: the number of the data lane ++ * @clock_lane: the number of the clock lane ++ */ ++struct v4l2_mbus_config_mipi_csi1 { ++ unsigned char clock_inv:1; ++ unsigned char strobe:1; ++ bool lane_polarity[2]; ++ unsigned char data_lane; ++ unsigned char clock_lane; ++}; ++ + /** + * enum v4l2_mbus_type - media bus type + * @V4L2_MBUS_UNKNOWN: unknown bus type, no V4L2 mediabus configuration diff --git a/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/b9f7caa7.failed b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/b9f7caa7.failed new file mode 100644 index 0000000000000..591e6b2ec746d --- /dev/null +++ b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/b9f7caa7.failed @@ -0,0 +1,112 @@ +media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag + +jira LE-3262 +Rebuild_History Non-Buildable kernel-5.14.0-570.22.1.el9_6 +commit-author Laurent Pinchart +commit b9f7caa7753ad185e0dc7afb3ae4bd423d11f5c0 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/b9f7caa7.failed + +MIPI CSI-2 continuous and non-continuous clock modes are mutually +exclusive. Drop the V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag and use +V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK only. + + Signed-off-by: Laurent Pinchart + Signed-off-by: Sakari Ailus + Signed-off-by: Mauro Carvalho Chehab +(cherry picked from commit b9f7caa7753ad185e0dc7afb3ae4bd423d11f5c0) + Signed-off-by: Jonathan Maple + +# Conflicts: +# drivers/media/i2c/adv7180.c +# drivers/media/i2c/tc358743.c +diff --cc drivers/media/i2c/adv7180.c +index 811619651329,4f5db195e66d..000000000000 +--- a/drivers/media/i2c/adv7180.c ++++ b/drivers/media/i2c/adv7180.c +@@@ -768,9 -784,8 +768,14 @@@ static int adv7180_get_mbus_config(stru + + if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2) { + cfg->type = V4L2_MBUS_CSI2_DPHY; +++<<<<<<< HEAD + + cfg->flags = V4L2_MBUS_CSI2_1_LANE | + + V4L2_MBUS_CSI2_CHANNEL_0 | + + V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; +++======= ++ cfg->bus.mipi_csi2.num_data_lanes = 1; ++ cfg->bus.mipi_csi2.flags = 0; +++>>>>>>> b9f7caa7753a (media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag) + } else { + /* + * The ADV7180 sensor supports BT.601/656 output modes. +diff --cc drivers/media/i2c/tc358743.c +index 3205cd8298dd,e18b8947ad7e..000000000000 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@@ -1613,24 -1613,8 +1613,29 @@@ static int tc358743_get_mbus_config(str + cfg->type = V4L2_MBUS_CSI2_DPHY; + + /* Support for non-continuous CSI-2 clock is missing in the driver */ +++<<<<<<< HEAD + + cfg->flags = V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; + + + + switch (state->csi_lanes_in_use) { + + case 1: + + cfg->flags |= V4L2_MBUS_CSI2_1_LANE; + + break; + + case 2: + + cfg->flags |= V4L2_MBUS_CSI2_2_LANE; + + break; + + case 3: + + cfg->flags |= V4L2_MBUS_CSI2_3_LANE; + + break; + + case 4: + + cfg->flags |= V4L2_MBUS_CSI2_4_LANE; + + break; + + default: + + return -EINVAL; + + } +++======= ++ cfg->bus.mipi_csi2.flags = 0; ++ cfg->bus.mipi_csi2.num_data_lanes = state->csi_lanes_in_use; +++>>>>>>> b9f7caa7753a (media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag) + + return 0; + } +* Unmerged path drivers/media/i2c/adv7180.c +* Unmerged path drivers/media/i2c/tc358743.c +diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c +index 843259c304bb..d531d8053c76 100644 +--- a/drivers/media/v4l2-core/v4l2-fwnode.c ++++ b/drivers/media/v4l2-core/v4l2-fwnode.c +@@ -207,13 +207,11 @@ static int v4l2_fwnode_endpoint_parse_csi2_bus(struct fwnode_handle *fwnode, + if (fwnode_property_present(fwnode, "clock-noncontinuous")) { + flags |= V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK; + pr_debug("non-continuous clock\n"); +- } else { +- flags |= V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; + } + + if (bus_type == V4L2_MBUS_CSI2_DPHY || +- bus_type == V4L2_MBUS_CSI2_CPHY || lanes_used || +- have_clk_lane || (flags & ~V4L2_MBUS_CSI2_CONTINUOUS_CLOCK)) { ++ bus_type == V4L2_MBUS_CSI2_CPHY || ++ lanes_used || have_clk_lane || flags) { + /* Only D-PHY has a clock lane. */ + unsigned int dfl_data_lane_index = + bus_type == V4L2_MBUS_CSI2_DPHY; +diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h +index b77871485306..fc30e0a9ca1f 100644 +--- a/include/media/v4l2-mediabus.h ++++ b/include/media/v4l2-mediabus.h +@@ -73,8 +73,7 @@ + #define V4L2_MBUS_CSI2_CHANNEL_2 BIT(6) + #define V4L2_MBUS_CSI2_CHANNEL_3 BIT(7) + /* Clock non-continuous mode support. */ +-#define V4L2_MBUS_CSI2_CONTINUOUS_CLOCK BIT(8) +-#define V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK BIT(9) ++#define V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK BIT(0) + + #define V4L2_MBUS_CSI2_CHANNELS (V4L2_MBUS_CSI2_CHANNEL_0 | \ + V4L2_MBUS_CSI2_CHANNEL_1 | \ diff --git a/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/rebuild.details.txt b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/rebuild.details.txt new file mode 100644 index 0000000000000..3297fecf5ceb2 --- /dev/null +++ b/ciq/ciq_backports/kernel-5.14.0-570.22.1.el9_6/rebuild.details.txt @@ -0,0 +1,25 @@ +Rebuild_History BUILDABLE +Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50% +Number of commits in upstream range v5.14~1..kernel-mainline: 309912 +Number of commits in rpm: 23 +Number of commits matched with upstream: 19 (82.61%) +Number of commits in upstream but not in rpm: 309893 +Number of commits NOT found in upstream: 4 (17.39%) + +Rebuilding Kernel on Branch rocky9_6_rebuild_kernel-5.14.0-570.22.1.el9_6 for kernel-5.14.0-570.22.1.el9_6 +Clean Cherry Picks: 13 (68.42%) +Empty Cherry Picks: 5 (26.32%) +_______________________________ + +__EMPTY COMMITS__________________________ +94d964e58ad6ba907c4169be99267ef517796614 media: v4l2-fwnode: Move bus config structure to v4l2_mediabus.h +6a7bdd89f50d399dd02847e6f398d408b086df50 media: v4l2-mediabus: Use structures to describe bus configuration +5a6ac3f4b46fd86d13e1d8ab4a55e4d89f3ab400 media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags +b9f7caa7753ad185e0dc7afb3ae4bd423d11f5c0 media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag +654b33ada4ab5e926cd9c570196fefa7bec7c1df proc: fix UAF in proc_get_inode() + +__CHANGES NOT IN UPSTREAM________________ +Porting to Rocky Linux 9, debranding and Rocky branding' +Ensure aarch64 kernel is not compressed' +Revert "SUNRPC: Revert e0a912e8ddba" +nvme: print firmware bug note for non-unique identifiers diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c index 8ae301eef6436..4a0d82830a154 100644 --- a/drivers/gpu/ipu-v3/ipu-csi.c +++ b/drivers/gpu/ipu-v3/ipu-csi.c @@ -343,11 +343,11 @@ static int fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg, switch (mbus_cfg->type) { case V4L2_MBUS_PARALLEL: csicfg->ext_vsync = 1; - csicfg->vsync_pol = (mbus_cfg->flags & + csicfg->vsync_pol = (mbus_cfg->bus.parallel.flags & V4L2_MBUS_VSYNC_ACTIVE_LOW) ? 1 : 0; - csicfg->hsync_pol = (mbus_cfg->flags & + csicfg->hsync_pol = (mbus_cfg->bus.parallel.flags & V4L2_MBUS_HSYNC_ACTIVE_LOW) ? 1 : 0; - csicfg->pixclk_pol = (mbus_cfg->flags & + csicfg->pixclk_pol = (mbus_cfg->bus.parallel.flags & V4L2_MBUS_PCLK_SAMPLE_FALLING) ? 1 : 0; csicfg->clk_mode = IPU_CSI_CLK_MODE_GATED_CLK; break; diff --git a/drivers/md/md.c b/drivers/md/md.c index e34a057f5044e..3109e0b87b65b 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -608,6 +608,12 @@ static void __mddev_put(struct mddev *mddev) queue_work(md_misc_wq, &mddev->del_work); } +static void mddev_put_locked(struct mddev *mddev) +{ + if (atomic_dec_and_test(&mddev->active)) + __mddev_put(mddev); +} + void mddev_put(struct mddev *mddev) { if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)) @@ -8460,9 +8466,7 @@ static int md_seq_show(struct seq_file *seq, void *v) if (mddev == list_last_entry(&all_mddevs, struct mddev, all_mddevs)) status_unused(seq); - if (atomic_dec_and_test(&mddev->active)) - __mddev_put(mddev); - + mddev_put_locked(mddev); return 0; } @@ -9856,11 +9860,11 @@ EXPORT_SYMBOL_GPL(rdev_clear_badblocks); static int md_notify_reboot(struct notifier_block *this, unsigned long code, void *x) { - struct mddev *mddev, *n; + struct mddev *mddev; int need_delay = 0; spin_lock(&all_mddevs_lock); - list_for_each_entry_safe(mddev, n, &all_mddevs, all_mddevs) { + list_for_each_entry(mddev, &all_mddevs, all_mddevs) { if (!mddev_get(mddev)) continue; spin_unlock(&all_mddevs_lock); @@ -9872,8 +9876,8 @@ static int md_notify_reboot(struct notifier_block *this, mddev_unlock(mddev); } need_delay = 1; - mddev_put(mddev); spin_lock(&all_mddevs_lock); + mddev_put_locked(mddev); } spin_unlock(&all_mddevs_lock); @@ -10206,7 +10210,7 @@ void md_autostart_arrays(int part) static __exit void md_exit(void) { - struct mddev *mddev, *n; + struct mddev *mddev; int delay = 1; unregister_blkdev(MD_MAJOR,"md"); @@ -10227,7 +10231,7 @@ static __exit void md_exit(void) remove_proc_entry("mdstat", NULL); spin_lock(&all_mddevs_lock); - list_for_each_entry_safe(mddev, n, &all_mddevs, all_mddevs) { + list_for_each_entry(mddev, &all_mddevs, all_mddevs) { if (!mddev_get(mddev)) continue; spin_unlock(&all_mddevs_lock); @@ -10239,8 +10243,8 @@ static __exit void md_exit(void) * the mddev for destruction by a workqueue, and the * destroy_workqueue() below will wait for that to complete. */ - mddev_put(mddev); spin_lock(&all_mddevs_lock); + mddev_put_locked(mddev); } spin_unlock(&all_mddevs_lock); diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c index 811619651329e..a7a068137db4a 100644 --- a/drivers/media/i2c/adv7180.c +++ b/drivers/media/i2c/adv7180.c @@ -768,16 +768,16 @@ static int adv7180_get_mbus_config(struct v4l2_subdev *sd, if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2) { cfg->type = V4L2_MBUS_CSI2_DPHY; - cfg->flags = V4L2_MBUS_CSI2_1_LANE | - V4L2_MBUS_CSI2_CHANNEL_0 | - V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; + cfg->bus.mipi_csi2.num_data_lanes = 1; + cfg->bus.mipi_csi2.flags = 0; } else { /* * The ADV7180 sensor supports BT.601/656 output modes. * The BT.656 is default and not yet configurable by s/w. */ - cfg->flags = V4L2_MBUS_MASTER | V4L2_MBUS_PCLK_SAMPLE_RISING | - V4L2_MBUS_DATA_ACTIVE_HIGH; + cfg->bus.parallel.flags = V4L2_MBUS_MASTER | + V4L2_MBUS_PCLK_SAMPLE_RISING | + V4L2_MBUS_DATA_ACTIVE_HIGH; cfg->type = V4L2_MBUS_BT656; } diff --git a/drivers/media/i2c/adv748x/adv748x-csi2.c b/drivers/media/i2c/adv748x/adv748x-csi2.c index 589e9644fcdcd..bd4f3fe0e3096 100644 --- a/drivers/media/i2c/adv748x/adv748x-csi2.c +++ b/drivers/media/i2c/adv748x/adv748x-csi2.c @@ -222,23 +222,7 @@ static int adv748x_csi2_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad return -EINVAL; config->type = V4L2_MBUS_CSI2_DPHY; - switch (tx->active_lanes) { - case 1: - config->flags = V4L2_MBUS_CSI2_1_LANE; - break; - - case 2: - config->flags = V4L2_MBUS_CSI2_2_LANE; - break; - - case 3: - config->flags = V4L2_MBUS_CSI2_3_LANE; - break; - - case 4: - config->flags = V4L2_MBUS_CSI2_4_LANE; - break; - } + config->bus.mipi_csi2.num_data_lanes = tx->active_lanes; return 0; } diff --git a/drivers/media/i2c/ml86v7667.c b/drivers/media/i2c/ml86v7667.c index 4a1410ebb4c85..48cc0b0922f4f 100644 --- a/drivers/media/i2c/ml86v7667.c +++ b/drivers/media/i2c/ml86v7667.c @@ -223,9 +223,10 @@ static int ml86v7667_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad, struct v4l2_mbus_config *cfg) { - cfg->flags = V4L2_MBUS_MASTER | V4L2_MBUS_PCLK_SAMPLE_RISING | - V4L2_MBUS_DATA_ACTIVE_HIGH; cfg->type = V4L2_MBUS_BT656; + cfg->bus.parallel.flags = V4L2_MBUS_MASTER | + V4L2_MBUS_PCLK_SAMPLE_RISING | + V4L2_MBUS_DATA_ACTIVE_HIGH; return 0; } diff --git a/drivers/media/i2c/mt9m001.c b/drivers/media/i2c/mt9m001.c index 3e7814cc86e46..9dc87e42a6e67 100644 --- a/drivers/media/i2c/mt9m001.c +++ b/drivers/media/i2c/mt9m001.c @@ -695,10 +695,12 @@ static int mt9m001_get_mbus_config(struct v4l2_subdev *sd, struct v4l2_mbus_config *cfg) { /* MT9M001 has all capture_format parameters fixed */ - cfg->flags = V4L2_MBUS_PCLK_SAMPLE_FALLING | - V4L2_MBUS_HSYNC_ACTIVE_HIGH | V4L2_MBUS_VSYNC_ACTIVE_HIGH | - V4L2_MBUS_DATA_ACTIVE_HIGH | V4L2_MBUS_MASTER; cfg->type = V4L2_MBUS_PARALLEL; + cfg->bus.parallel.flags = V4L2_MBUS_PCLK_SAMPLE_FALLING | + V4L2_MBUS_HSYNC_ACTIVE_HIGH | + V4L2_MBUS_VSYNC_ACTIVE_HIGH | + V4L2_MBUS_DATA_ACTIVE_HIGH | + V4L2_MBUS_MASTER; return 0; } diff --git a/drivers/media/i2c/mt9m111.c b/drivers/media/i2c/mt9m111.c index 78dc896ca116b..9df005746bc47 100644 --- a/drivers/media/i2c/mt9m111.c +++ b/drivers/media/i2c/mt9m111.c @@ -1143,14 +1143,16 @@ static int mt9m111_get_mbus_config(struct v4l2_subdev *sd, { struct mt9m111 *mt9m111 = container_of(sd, struct mt9m111, subdev); - cfg->flags = V4L2_MBUS_MASTER | - V4L2_MBUS_HSYNC_ACTIVE_HIGH | V4L2_MBUS_VSYNC_ACTIVE_HIGH | - V4L2_MBUS_DATA_ACTIVE_HIGH; + cfg->type = V4L2_MBUS_PARALLEL; - cfg->flags |= mt9m111->pclk_sample ? V4L2_MBUS_PCLK_SAMPLE_RISING : - V4L2_MBUS_PCLK_SAMPLE_FALLING; + cfg->bus.parallel.flags = V4L2_MBUS_MASTER | + V4L2_MBUS_HSYNC_ACTIVE_HIGH | + V4L2_MBUS_VSYNC_ACTIVE_HIGH | + V4L2_MBUS_DATA_ACTIVE_HIGH; - cfg->type = V4L2_MBUS_PARALLEL; + cfg->bus.parallel.flags |= mt9m111->pclk_sample ? + V4L2_MBUS_PCLK_SAMPLE_RISING : + V4L2_MBUS_PCLK_SAMPLE_FALLING; return 0; } diff --git a/drivers/media/i2c/ov5648.c b/drivers/media/i2c/ov5648.c index 947d437ed0efe..87f9b724cd7fb 100644 --- a/drivers/media/i2c/ov5648.c +++ b/drivers/media/i2c/ov5648.c @@ -1112,7 +1112,7 @@ static int ov5648_pad_configure(struct ov5648_sensor *sensor) static int ov5648_mipi_configure(struct ov5648_sensor *sensor) { - struct v4l2_fwnode_bus_mipi_csi2 *bus_mipi_csi2 = + struct v4l2_mbus_config_mipi_csi2 *bus_mipi_csi2 = &sensor->endpoint.bus.mipi_csi2; unsigned int lanes_count = bus_mipi_csi2->num_data_lanes; int ret; @@ -1692,7 +1692,7 @@ static int ov5648_state_mipi_configure(struct ov5648_sensor *sensor, u32 mbus_code) { struct ov5648_ctrls *ctrls = &sensor->ctrls; - struct v4l2_fwnode_bus_mipi_csi2 *bus_mipi_csi2 = + struct v4l2_mbus_config_mipi_csi2 *bus_mipi_csi2 = &sensor->endpoint.bus.mipi_csi2; unsigned long mipi_clk_rate; unsigned int bits_per_sample; diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c index f67412150b16b..b224b033cea19 100644 --- a/drivers/media/i2c/ov6650.c +++ b/drivers/media/i2c/ov6650.c @@ -932,15 +932,15 @@ static int ov6650_get_mbus_config(struct v4l2_subdev *sd, if (ret) return ret; - cfg->flags = V4L2_MBUS_MASTER | V4L2_MBUS_DATA_ACTIVE_HIGH - | ((comj & COMJ_VSYNC_HIGH) ? V4L2_MBUS_VSYNC_ACTIVE_HIGH - : V4L2_MBUS_VSYNC_ACTIVE_LOW) - | ((comf & COMF_HREF_LOW) ? V4L2_MBUS_HSYNC_ACTIVE_LOW - : V4L2_MBUS_HSYNC_ACTIVE_HIGH) - | ((comj & COMJ_PCLK_RISING) ? V4L2_MBUS_PCLK_SAMPLE_RISING - : V4L2_MBUS_PCLK_SAMPLE_FALLING); cfg->type = V4L2_MBUS_PARALLEL; + cfg->bus.parallel.flags = V4L2_MBUS_MASTER | V4L2_MBUS_DATA_ACTIVE_HIGH + | ((comj & COMJ_VSYNC_HIGH) ? V4L2_MBUS_VSYNC_ACTIVE_HIGH + : V4L2_MBUS_VSYNC_ACTIVE_LOW) + | ((comf & COMF_HREF_LOW) ? V4L2_MBUS_HSYNC_ACTIVE_LOW + : V4L2_MBUS_HSYNC_ACTIVE_HIGH) + | ((comj & COMJ_PCLK_RISING) ? V4L2_MBUS_PCLK_SAMPLE_RISING + : V4L2_MBUS_PCLK_SAMPLE_FALLING); return 0; } diff --git a/drivers/media/i2c/ov8865.c b/drivers/media/i2c/ov8865.c index ce50f3ea87b8e..eccfeb4073918 100644 --- a/drivers/media/i2c/ov8865.c +++ b/drivers/media/i2c/ov8865.c @@ -1417,7 +1417,7 @@ static int ov8865_charge_pump_configure(struct ov8865_sensor *sensor) static int ov8865_mipi_configure(struct ov8865_sensor *sensor) { - struct v4l2_fwnode_bus_mipi_csi2 *bus_mipi_csi2 = + struct v4l2_mbus_config_mipi_csi2 *bus_mipi_csi2 = &sensor->endpoint.bus.mipi_csi2; unsigned int lanes_count = bus_mipi_csi2->num_data_lanes; int ret; @@ -2164,7 +2164,7 @@ static int ov8865_state_mipi_configure(struct ov8865_sensor *sensor, u32 mbus_code) { struct ov8865_ctrls *ctrls = &sensor->ctrls; - struct v4l2_fwnode_bus_mipi_csi2 *bus_mipi_csi2 = + struct v4l2_mbus_config_mipi_csi2 *bus_mipi_csi2 = &sensor->endpoint.bus.mipi_csi2; unsigned long mipi_clk_rate; unsigned int bits_per_sample; diff --git a/drivers/media/i2c/ov9640.c b/drivers/media/i2c/ov9640.c index 0bab8c2cf1602..9f44ed52d1643 100644 --- a/drivers/media/i2c/ov9640.c +++ b/drivers/media/i2c/ov9640.c @@ -652,10 +652,12 @@ static int ov9640_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad, struct v4l2_mbus_config *cfg) { - cfg->flags = V4L2_MBUS_PCLK_SAMPLE_RISING | V4L2_MBUS_MASTER | - V4L2_MBUS_VSYNC_ACTIVE_HIGH | V4L2_MBUS_HSYNC_ACTIVE_HIGH | - V4L2_MBUS_DATA_ACTIVE_HIGH; cfg->type = V4L2_MBUS_PARALLEL; + cfg->bus.parallel.flags = V4L2_MBUS_PCLK_SAMPLE_RISING | + V4L2_MBUS_MASTER | + V4L2_MBUS_VSYNC_ACTIVE_HIGH | + V4L2_MBUS_HSYNC_ACTIVE_HIGH | + V4L2_MBUS_DATA_ACTIVE_HIGH; return 0; } diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c index 3205cd8298dd8..e18b8947ad7e5 100644 --- a/drivers/media/i2c/tc358743.c +++ b/drivers/media/i2c/tc358743.c @@ -69,7 +69,7 @@ static const struct v4l2_dv_timings_cap tc358743_timings_cap = { struct tc358743_state { struct tc358743_platform_data pdata; - struct v4l2_fwnode_bus_mipi_csi2 bus; + struct v4l2_mbus_config_mipi_csi2 bus; struct v4l2_subdev sd; struct media_pad pad; struct v4l2_ctrl_handler hdl; @@ -717,7 +717,7 @@ static void tc358743_set_csi(struct v4l2_subdev *sd) ((lanes > 3) ? MASK_D3M_HSTXVREGEN : 0x0)); i2c_wr32(sd, TXOPTIONCNTRL, (state->bus.flags & - V4L2_MBUS_CSI2_CONTINUOUS_CLOCK) ? MASK_CONTCLKMODE : 0); + V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK) ? 0 : MASK_CONTCLKMODE); i2c_wr32(sd, STARTCNTRL, MASK_START); i2c_wr32(sd, CSI_START, MASK_STRT); @@ -1613,24 +1613,8 @@ static int tc358743_get_mbus_config(struct v4l2_subdev *sd, cfg->type = V4L2_MBUS_CSI2_DPHY; /* Support for non-continuous CSI-2 clock is missing in the driver */ - cfg->flags = V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; - - switch (state->csi_lanes_in_use) { - case 1: - cfg->flags |= V4L2_MBUS_CSI2_1_LANE; - break; - case 2: - cfg->flags |= V4L2_MBUS_CSI2_2_LANE; - break; - case 3: - cfg->flags |= V4L2_MBUS_CSI2_3_LANE; - break; - case 4: - cfg->flags |= V4L2_MBUS_CSI2_4_LANE; - break; - default: - return -EINVAL; - } + cfg->bus.mipi_csi2.flags = 0; + cfg->bus.mipi_csi2.num_data_lanes = state->csi_lanes_in_use; return 0; } @@ -2055,7 +2039,7 @@ static int tc358743_probe(struct i2c_client *client) /* platform data */ if (pdata) { state->pdata = *pdata; - state->bus.flags = V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; + state->bus.flags = 0; } else { err = tc358743_probe_of(state); if (err == -ENODEV) diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c index 995d0c7bc5911..65e901aab267d 100644 --- a/drivers/media/i2c/tvp5150.c +++ b/drivers/media/i2c/tvp5150.c @@ -1198,8 +1198,10 @@ static int tvp5150_get_mbus_config(struct v4l2_subdev *sd, struct tvp5150 *decoder = to_tvp5150(sd); cfg->type = decoder->mbus_type; - cfg->flags = V4L2_MBUS_MASTER | V4L2_MBUS_PCLK_SAMPLE_RISING - | V4L2_MBUS_FIELD_EVEN_LOW | V4L2_MBUS_DATA_ACTIVE_HIGH; + cfg->bus.parallel.flags = V4L2_MBUS_MASTER + | V4L2_MBUS_PCLK_SAMPLE_RISING + | V4L2_MBUS_FIELD_EVEN_LOW + | V4L2_MBUS_DATA_ACTIVE_HIGH; return 0; } diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c index 89f6a0bd1d2e2..3387920ce645a 100644 --- a/drivers/media/platform/pxa_camera.c +++ b/drivers/media/platform/pxa_camera.c @@ -1589,24 +1589,26 @@ static int pxa_camera_set_bus_param(struct pxa_camera_dev *pcdev) * PXA does not support V4L2_MBUS_DATA_ACTIVE_LOW and the bus mastering * roles should match. */ - if (cfg.flags != mbus_config) { + if (cfg.bus.parallel.flags != mbus_config) { unsigned int pxa_mbus_role = mbus_config & (V4L2_MBUS_MASTER | V4L2_MBUS_SLAVE); - if (pxa_mbus_role != (cfg.flags & (V4L2_MBUS_MASTER | - V4L2_MBUS_SLAVE))) { + unsigned int flags = cfg.bus.parallel.flags; + + if (pxa_mbus_role != (flags & (V4L2_MBUS_MASTER | + V4L2_MBUS_SLAVE))) { dev_err(pcdev_to_dev(pcdev), "Unsupported mbus configuration: bus mastering\n"); return -EINVAL; } - if (cfg.flags & V4L2_MBUS_DATA_ACTIVE_LOW) { + if (flags & V4L2_MBUS_DATA_ACTIVE_LOW) { dev_err(pcdev_to_dev(pcdev), "Unsupported mbus configuration: DATA_ACTIVE_LOW\n"); return -EINVAL; } } - pxa_camera_setup_cicr(pcdev, cfg.flags, pixfmt); + pxa_camera_setup_cicr(pcdev, cfg.bus.parallel.flags, pixfmt); return 0; } diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c index 1444264433e11..da856bee3b616 100644 --- a/drivers/media/platform/qcom/camss/camss.c +++ b/drivers/media/platform/qcom/camss/camss.c @@ -832,7 +832,7 @@ static int camss_of_parse_endpoint_node(struct device *dev, struct camss_async_subdev *csd) { struct csiphy_lanes_cfg *lncfg = &csd->interface.csi2.lane_cfg; - struct v4l2_fwnode_bus_mipi_csi2 *mipi_csi2; + struct v4l2_mbus_config_mipi_csi2 *mipi_csi2; struct v4l2_fwnode_endpoint vep = { { 0 } }; unsigned int i; diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c index e593c97bf5272..0aa9063a89628 100644 --- a/drivers/media/platform/rcar-vin/rcar-csi2.c +++ b/drivers/media/platform/rcar-vin/rcar-csi2.c @@ -495,7 +495,6 @@ static int rcsi2_get_active_lanes(struct rcar_csi2 *priv, unsigned int *lanes) { struct v4l2_mbus_config mbus_config = { 0 }; - unsigned int num_lanes = UINT_MAX; int ret; *lanes = priv->lanes; @@ -518,23 +517,14 @@ static int rcsi2_get_active_lanes(struct rcar_csi2 *priv, return -EINVAL; } - if (mbus_config.flags & V4L2_MBUS_CSI2_1_LANE) - num_lanes = 1; - else if (mbus_config.flags & V4L2_MBUS_CSI2_2_LANE) - num_lanes = 2; - else if (mbus_config.flags & V4L2_MBUS_CSI2_3_LANE) - num_lanes = 3; - else if (mbus_config.flags & V4L2_MBUS_CSI2_4_LANE) - num_lanes = 4; - - if (num_lanes > priv->lanes) { + if (mbus_config.bus.mipi_csi2.num_data_lanes > priv->lanes) { dev_err(priv->dev, "Unsupported mbus config: too many data lanes %u\n", - num_lanes); + mbus_config.bus.mipi_csi2.num_data_lanes); return -EINVAL; } - *lanes = num_lanes; + *lanes = mbus_config.bus.mipi_csi2.num_data_lanes; return 0; } diff --git a/drivers/media/platform/rcar-vin/rcar-vin.h b/drivers/media/platform/rcar-vin/rcar-vin.h index b263ead4db2bf..b88d9890d9545 100644 --- a/drivers/media/platform/rcar-vin/rcar-vin.h +++ b/drivers/media/platform/rcar-vin/rcar-vin.h @@ -106,7 +106,7 @@ struct rvin_parallel_entity { struct v4l2_subdev *subdev; enum v4l2_mbus_type mbus_type; - struct v4l2_fwnode_bus_parallel bus; + struct v4l2_mbus_config_parallel bus; unsigned int source_pad; unsigned int sink_pad; diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c index e5d41bfd1a82a..5717e743e7ace 100644 --- a/drivers/media/platform/stm32/stm32-dcmi.c +++ b/drivers/media/platform/stm32/stm32-dcmi.c @@ -149,7 +149,7 @@ struct stm32_dcmi { struct mutex lock; struct vb2_queue queue; - struct v4l2_fwnode_bus_parallel bus; + struct v4l2_mbus_config_parallel bus; enum v4l2_mbus_type bus_type; struct completion complete; struct clk *mclk; diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h index c64e0be900875..4e0c2df45d4d2 100644 --- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h +++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h @@ -125,7 +125,7 @@ struct sun4i_csi { dma_addr_t paddr; } scratch; - struct v4l2_fwnode_bus_parallel bus; + struct v4l2_mbus_config_parallel bus; /* Main Device */ struct v4l2_device v4l; diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c index b9c8acd3332e1..6620f1039bac1 100644 --- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c +++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c @@ -226,7 +226,7 @@ static void return_all_buffers(struct sun4i_csi *csi, static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count) { struct sun4i_csi *csi = vb2_get_drv_priv(vq); - struct v4l2_fwnode_bus_parallel *bus = &csi->bus; + struct v4l2_mbus_config_parallel *bus = &csi->bus; const struct sun4i_csi_format *csi_fmt; unsigned long href_pol, pclk_pol, vref_pol; unsigned long flags; diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c index 843259c304bb5..6dd8791bf870d 100644 --- a/drivers/media/v4l2-core/v4l2-fwnode.c +++ b/drivers/media/v4l2-core/v4l2-fwnode.c @@ -119,11 +119,11 @@ static int v4l2_fwnode_endpoint_parse_csi2_bus(struct fwnode_handle *fwnode, struct v4l2_fwnode_endpoint *vep, enum v4l2_mbus_type bus_type) { - struct v4l2_fwnode_bus_mipi_csi2 *bus = &vep->bus.mipi_csi2; + struct v4l2_mbus_config_mipi_csi2 *bus = &vep->bus.mipi_csi2; bool have_clk_lane = false, have_data_lanes = false, have_lane_polarities = false; unsigned int flags = 0, lanes_used = 0; - u32 array[1 + V4L2_FWNODE_CSI2_MAX_DATA_LANES]; + u32 array[1 + V4L2_MBUS_CSI2_MAX_DATA_LANES]; u32 clock_lane = 0; unsigned int num_data_lanes = 0; bool use_default_lane_mapping = false; @@ -136,7 +136,7 @@ static int v4l2_fwnode_endpoint_parse_csi2_bus(struct fwnode_handle *fwnode, use_default_lane_mapping = true; num_data_lanes = min_t(u32, bus->num_data_lanes, - V4L2_FWNODE_CSI2_MAX_DATA_LANES); + V4L2_MBUS_CSI2_MAX_DATA_LANES); clock_lane = bus->clock_lane; if (clock_lane) @@ -155,7 +155,7 @@ static int v4l2_fwnode_endpoint_parse_csi2_bus(struct fwnode_handle *fwnode, rval = fwnode_property_count_u32(fwnode, "data-lanes"); if (rval > 0) { num_data_lanes = - min_t(int, V4L2_FWNODE_CSI2_MAX_DATA_LANES, rval); + min_t(int, V4L2_MBUS_CSI2_MAX_DATA_LANES, rval); fwnode_property_read_u32_array(fwnode, "data-lanes", array, num_data_lanes); @@ -207,13 +207,11 @@ static int v4l2_fwnode_endpoint_parse_csi2_bus(struct fwnode_handle *fwnode, if (fwnode_property_present(fwnode, "clock-noncontinuous")) { flags |= V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK; pr_debug("non-continuous clock\n"); - } else { - flags |= V4L2_MBUS_CSI2_CONTINUOUS_CLOCK; } if (bus_type == V4L2_MBUS_CSI2_DPHY || - bus_type == V4L2_MBUS_CSI2_CPHY || lanes_used || - have_clk_lane || (flags & ~V4L2_MBUS_CSI2_CONTINUOUS_CLOCK)) { + bus_type == V4L2_MBUS_CSI2_CPHY || + lanes_used || have_clk_lane || flags) { /* Only D-PHY has a clock lane. */ unsigned int dfl_data_lane_index = bus_type == V4L2_MBUS_CSI2_DPHY; @@ -263,7 +261,7 @@ v4l2_fwnode_endpoint_parse_parallel_bus(struct fwnode_handle *fwnode, struct v4l2_fwnode_endpoint *vep, enum v4l2_mbus_type bus_type) { - struct v4l2_fwnode_bus_parallel *bus = &vep->bus.parallel; + struct v4l2_mbus_config_parallel *bus = &vep->bus.parallel; unsigned int flags = 0; u32 v; @@ -369,7 +367,7 @@ v4l2_fwnode_endpoint_parse_csi1_bus(struct fwnode_handle *fwnode, struct v4l2_fwnode_endpoint *vep, enum v4l2_mbus_type bus_type) { - struct v4l2_fwnode_bus_mipi_csi1 *bus = &vep->bus.mipi_csi1; + struct v4l2_mbus_config_mipi_csi1 *bus = &vep->bus.mipi_csi1; u32 v; if (!fwnode_property_read_u32(fwnode, "clock-inv", &v)) { diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 2c4645945e369..13012f099751a 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -2025,6 +2025,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, struct rx_cmp_ext *rxcmp1; u32 tmp_raw_cons = *raw_cons; u16 cons, prod, cp_cons = RING_CMP(tmp_raw_cons); + struct skb_shared_info *sinfo; struct bnxt_sw_rx_bd *rx_buf; unsigned int len; u8 *data_ptr, agg_bufs, cmp_type; @@ -2151,6 +2152,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, false); if (!frag_len) goto oom_next_rx; + } xdp_active = true; } @@ -2160,6 +2162,12 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, rc = 1; goto next_rx; } + if (xdp_buff_has_frags(&xdp)) { + sinfo = xdp_get_shared_info_from_buff(&xdp); + agg_bufs = sinfo->nr_frags; + } else { + agg_bufs = 0; + } } if (len <= bp->rx_copy_thresh) { diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c index f88b641533fcc..086189b853e1f 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c @@ -479,7 +479,7 @@ bnxt_xdp_build_skb(struct bnxt *bp, struct sk_buff *skb, u8 num_frags, } xdp_update_skb_shared_info(skb, num_frags, sinfo->xdp_frags_size, - BNXT_RX_PAGE_SIZE * sinfo->nr_frags, + BNXT_RX_PAGE_SIZE * num_frags, xdp_buff_is_frag_pfmemalloc(xdp)); return skb; } diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c index 65fdc07e777f4..efd33cca97108 100644 --- a/drivers/net/vmxnet3/vmxnet3_drv.c +++ b/drivers/net/vmxnet3/vmxnet3_drv.c @@ -2033,6 +2033,11 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq, rq->comp_ring.gen = VMXNET3_INIT_GEN; rq->comp_ring.next2proc = 0; + + if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) + xdp_rxq_info_unreg(&rq->xdp_rxq); + page_pool_destroy(rq->page_pool); + rq->page_pool = NULL; } @@ -2073,11 +2078,6 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq, } } - if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) - xdp_rxq_info_unreg(&rq->xdp_rxq); - page_pool_destroy(rq->page_pool); - rq->page_pool = NULL; - if (rq->data_ring.base) { dma_free_coherent(&adapter->pdev->dev, rq->rx_ring[0].size * rq->data_ring.desc_size, diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c index 91e3393f7b5f4..4cbba96121a11 100644 --- a/drivers/net/wireless/ath/ath12k/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c @@ -2470,6 +2470,29 @@ static void ath12k_dp_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *nap ieee80211_rx_napi(ath12k_ar_to_hw(ar), pubsta, msdu, napi); } +static bool ath12k_dp_rx_check_nwifi_hdr_len_valid(struct ath12k_base *ab, + struct hal_rx_desc *rx_desc, + struct sk_buff *msdu) +{ + struct ieee80211_hdr *hdr; + u8 decap_type; + u32 hdr_len; + + decap_type = ath12k_dp_rx_h_decap_type(ab, rx_desc); + if (decap_type != DP_RX_DECAP_TYPE_NATIVE_WIFI) + return true; + + hdr = (struct ieee80211_hdr *)msdu->data; + hdr_len = ieee80211_hdrlen(hdr->frame_control); + + if ((likely(hdr_len <= DP_MAX_NWIFI_HDR_LEN))) + return true; + + ab->soc_stats.invalid_rbm++; + WARN_ON_ONCE(1); + return false; +} + static int ath12k_dp_rx_process_msdu(struct ath12k *ar, struct sk_buff *msdu, struct sk_buff_head *msdu_list, @@ -2528,6 +2551,11 @@ static int ath12k_dp_rx_process_msdu(struct ath12k *ar, } } + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) { + ret = -EINVAL; + goto free_out; + } + ath12k_dp_rx_h_ppdu(ar, rx_desc, rx_status); ath12k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status); @@ -2880,6 +2908,9 @@ static int ath12k_dp_rx_h_verify_tkip_mic(struct ath12k *ar, struct ath12k_peer RX_FLAG_IV_STRIPPED | RX_FLAG_DECRYPTED; skb_pull(msdu, hal_rx_desc_sz); + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) + return -EINVAL; + ath12k_dp_rx_h_ppdu(ar, rx_desc, rxs); ath12k_dp_rx_h_undecap(ar, msdu, rx_desc, HAL_ENCRYPT_TYPE_TKIP_MIC, rxs, true); @@ -3600,6 +3631,9 @@ static int ath12k_dp_rx_h_null_q_desc(struct ath12k *ar, struct sk_buff *msdu, skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); } + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu))) + return -EINVAL; + ath12k_dp_rx_h_ppdu(ar, desc, status); ath12k_dp_rx_h_mpdu(ar, msdu, desc, status); @@ -3644,7 +3678,7 @@ static bool ath12k_dp_rx_h_reo_err(struct ath12k *ar, struct sk_buff *msdu, return drop; } -static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, +static bool ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, struct ieee80211_rx_status *status) { struct ath12k_base *ab = ar->ab; @@ -3662,6 +3696,9 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu))) + return true; + ath12k_dp_rx_h_ppdu(ar, desc, status); status->flag |= (RX_FLAG_MMIC_STRIPPED | RX_FLAG_MMIC_ERROR | @@ -3669,6 +3706,7 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, ath12k_dp_rx_h_undecap(ar, msdu, desc, HAL_ENCRYPT_TYPE_TKIP_MIC, status, false); + return false; } static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu, @@ -3687,7 +3725,7 @@ static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu, case HAL_REO_ENTR_RING_RXDMA_ECODE_TKIP_MIC_ERR: err_bitmap = ath12k_dp_rx_h_mpdu_err(ab, rx_desc); if (err_bitmap & HAL_RX_MPDU_ERR_TKIP_MIC) { - ath12k_dp_rx_h_tkip_mic_err(ar, msdu, status); + drop = ath12k_dp_rx_h_tkip_mic_err(ar, msdu, status); break; } fallthrough; diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 29873dab9a51a..0686c69099bf2 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3522,14 +3522,26 @@ static int nvme_subsys_check_duplicate_ids(struct nvme_subsystem *subsys, lockdep_assert_held(&subsys->lock); list_for_each_entry(h, &subsys->nsheads, entry) { - if (has_uuid && uuid_equal(&ids->uuid, &h->ids.uuid)) + if (has_uuid && uuid_equal(&ids->uuid, &h->ids.uuid)) { + dev_warn(&subsys->dev, + "%s: firmware bug: non-unique uuid found\n", + __func__); return -EINVAL; + } if (has_nguid && - memcmp(&ids->nguid, &h->ids.nguid, sizeof(ids->nguid)) == 0) + memcmp(&ids->nguid, &h->ids.nguid, sizeof(ids->nguid)) == 0) { + dev_warn(&subsys->dev, + "%s: firmware bug: non-unique nguid found\n", + __func__); return -EINVAL; + } if (has_eui64 && - memcmp(&ids->eui64, &h->ids.eui64, sizeof(ids->eui64)) == 0) + memcmp(&ids->eui64, &h->ids.eui64, sizeof(ids->eui64)) == 0) { + dev_warn(&subsys->dev, + "%s: firmware bug: non-unique eui64 found\n", + __func__); return -EINVAL; + } } return 0; diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 6a4c17601eb0f..60c7a92ab3469 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -3472,6 +3472,8 @@ static const struct pci_device_id nvme_id_table[] = { .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY | NVME_QUIRK_DISABLE_WRITE_ZEROES| NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(0x144d, 0xa824), /* Samsung PM1733 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x15b7, 0x5008), /* Sandisk SN530 */ .driver_data = NVME_QUIRK_BROKEN_MSI }, { PCI_DEVICE(0x1987, 0x5012), /* Phison E12 */ diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c index 4e0d5a500c53d..bf0f5ea33a172 100644 --- a/drivers/staging/media/imx/imx-media-csi.c +++ b/drivers/staging/media/imx/imx-media-csi.c @@ -713,9 +713,10 @@ static int csi_setup(struct csi_priv *priv) /* compose mbus_config from the upstream endpoint */ mbus_cfg.type = priv->upstream_ep.bus_type; - mbus_cfg.flags = is_parallel_bus(&priv->upstream_ep) ? - priv->upstream_ep.bus.parallel.flags : - priv->upstream_ep.bus.mipi_csi2.flags; + if (is_parallel_bus(&priv->upstream_ep)) + mbus_cfg.bus.parallel = priv->upstream_ep.bus.parallel; + else + mbus_cfg.bus.mipi_csi2 = priv->upstream_ep.bus.mipi_csi2; if_fmt = *infmt; crop = priv->crop; diff --git a/drivers/staging/media/imx/imx6-mipi-csi2.c b/drivers/staging/media/imx/imx6-mipi-csi2.c index 391886851df25..deaf8de2256a8 100644 --- a/drivers/staging/media/imx/imx6-mipi-csi2.c +++ b/drivers/staging/media/imx/imx6-mipi-csi2.c @@ -303,7 +303,6 @@ static void csi2ipu_gasket_init(struct csi2_dev *csi2) static int csi2_get_active_lanes(struct csi2_dev *csi2, unsigned int *lanes) { struct v4l2_mbus_config mbus_config = { 0 }; - unsigned int num_lanes = UINT_MAX; int ret; *lanes = csi2->data_lanes; @@ -326,32 +325,14 @@ static int csi2_get_active_lanes(struct csi2_dev *csi2, unsigned int *lanes) return -EINVAL; } - switch (mbus_config.flags & V4L2_MBUS_CSI2_LANES) { - case V4L2_MBUS_CSI2_1_LANE: - num_lanes = 1; - break; - case V4L2_MBUS_CSI2_2_LANE: - num_lanes = 2; - break; - case V4L2_MBUS_CSI2_3_LANE: - num_lanes = 3; - break; - case V4L2_MBUS_CSI2_4_LANE: - num_lanes = 4; - break; - default: - num_lanes = csi2->data_lanes; - break; - } - - if (num_lanes > csi2->data_lanes) { + if (mbus_config.bus.mipi_csi2.num_data_lanes > csi2->data_lanes) { dev_err(csi2->dev, "Unsupported mbus config: too many data lanes %u\n", - num_lanes); + mbus_config.bus.mipi_csi2.num_data_lanes); return -EINVAL; } - *lanes = num_lanes; + *lanes = mbus_config.bus.mipi_csi2.num_data_lanes; return 0; } diff --git a/drivers/staging/media/imx/imx7-mipi-csis.c b/drivers/staging/media/imx/imx7-mipi-csis.c index bbd0efb2f0151..2aa05c41e33a7 100644 --- a/drivers/staging/media/imx/imx7-mipi-csis.c +++ b/drivers/staging/media/imx/imx7-mipi-csis.c @@ -318,7 +318,7 @@ struct csi_state { struct v4l2_async_notifier notifier; struct v4l2_subdev *src_sd; - struct v4l2_fwnode_bus_mipi_csi2 bus; + struct v4l2_mbus_config_mipi_csi2 bus; u32 clk_frequency; u32 hs_settle; u32 clk_settle; diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index 3985f8c33f955..11c713d63753b 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -104,6 +104,9 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, else if (unlikely(le32_to_cpu(de->inode) > le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) error_msg = "inode out of bounds"; + else if (unlikely(next_offset == size && de->name_len == 1 && + de->name[0] == '.')) + error_msg = "'.' directory cannot be the last in data block"; else return 0; diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 8379593fa4bbe..1edf53be9bdb5 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -558,10 +558,16 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, return p; } -static inline void pde_set_flags(struct proc_dir_entry *pde) +static void pde_set_flags(struct proc_dir_entry *pde) { if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) pde->flags |= PROC_ENTRY_PERMANENT; + if (pde->proc_ops->proc_read_iter) + pde->flags |= PROC_ENTRY_proc_read_iter; +#ifdef CONFIG_COMPAT + if (pde->proc_ops->proc_compat_ioctl) + pde->flags |= PROC_ENTRY_proc_compat_ioctl; +#endif } struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, @@ -625,6 +631,7 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, p->proc_ops = &proc_seq_ops; p->seq_ops = ops; p->state_size = state_size; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL(proc_create_seq_private); @@ -655,6 +662,7 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, return NULL; p->proc_ops = &proc_single_ops; p->single_show = show; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL(proc_create_single_data); diff --git a/fs/proc/inode.c b/fs/proc/inode.c index e2174a8bf6179..68d99cea93b29 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -674,13 +674,13 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de) if (S_ISREG(inode->i_mode)) { inode->i_op = de->proc_iops; - if (de->proc_ops->proc_read_iter) + if (pde_has_proc_read_iter(de)) inode->i_fop = &proc_iter_file_ops; else inode->i_fop = &proc_reg_file_ops; #ifdef CONFIG_COMPAT - if (de->proc_ops->proc_compat_ioctl) { - if (de->proc_ops->proc_read_iter) + if (pde_has_proc_compat_ioctl(de)) { + if (pde_has_proc_read_iter(de)) inode->i_fop = &proc_iter_file_ops_compat; else inode->i_fop = &proc_reg_file_ops_compat; diff --git a/fs/proc/internal.h b/fs/proc/internal.h index 92bb5d4ce5a31..8b88c7a79707e 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -79,6 +79,20 @@ static inline bool pde_is_permanent(const struct proc_dir_entry *pde) return pde->flags & PROC_ENTRY_PERMANENT; } +static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde) +{ + return pde->flags & PROC_ENTRY_proc_read_iter; +} + +static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) +{ +#ifdef CONFIG_COMPAT + return pde->flags & PROC_ENTRY_proc_compat_ioctl; +#else + return false; +#endif +} + extern struct kmem_cache *proc_dir_entry_cache; void pde_free(struct proc_dir_entry *pde); diff --git a/fs/smb/client/cifsencrypt.c b/fs/smb/client/cifsencrypt.c index f5ea74bb90688..99755b607b856 100644 --- a/fs/smb/client/cifsencrypt.c +++ b/fs/smb/client/cifsencrypt.c @@ -690,18 +690,12 @@ cifs_crypto_secmech_release(struct TCP_Server_Info *server) cifs_free_hash(&server->secmech.md5); cifs_free_hash(&server->secmech.sha512); - if (!SERVER_IS_CHAN(server)) { - if (server->secmech.enc) { - crypto_free_aead(server->secmech.enc); - server->secmech.enc = NULL; - } - - if (server->secmech.dec) { - crypto_free_aead(server->secmech.dec); - server->secmech.dec = NULL; - } - } else { + if (server->secmech.enc) { + crypto_free_aead(server->secmech.enc); server->secmech.enc = NULL; + } + if (server->secmech.dec) { + crypto_free_aead(server->secmech.dec); server->secmech.dec = NULL; } } diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c index eca0cc2c2277c..9b9d942cd39a1 100644 --- a/fs/smb/client/fs_context.c +++ b/fs/smb/client/fs_context.c @@ -1366,11 +1366,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, ctx->acregmax = HZ * result.uint_32; break; case Opt_acdirmax: - ctx->acdirmax = HZ * result.uint_32; - if (ctx->acdirmax > CIFS_MAX_ACTIMEO) { + if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) { cifs_errorf(fc, "acdirmax too large\n"); goto cifs_parse_mount_err; } + ctx->acdirmax = HZ * result.uint_32; break; case Opt_actimeo: if (HZ * result.uint_32 > CIFS_MAX_ACTIMEO) { diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 465a76c53ca1f..ecd0b5c79c22d 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4448,9 +4448,9 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, return rc; } } else { - if (unlikely(!server->secmech.dec)) - return -EIO; - + rc = smb3_crypto_aead_allocate(server); + if (unlikely(rc)) + return rc; tfm = server->secmech.dec; } diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index acecd6c286876..d07e618b0f471 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -1249,15 +1249,8 @@ SMB2_negotiate(const unsigned int xid, cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); } - if (server->cipher_type && !rc) { - if (!SERVER_IS_CHAN(server)) { - rc = smb3_crypto_aead_allocate(server); - } else { - /* For channels, just reuse the primary server crypto secmech. */ - server->secmech.enc = server->primary_server->secmech.enc; - server->secmech.dec = server->primary_server->secmech.dec; - } - } + if (server->cipher_type && !rc) + rc = smb3_crypto_aead_allocate(server); neg_exit: free_rsp_buf(resp_buftype, rsp); return rc; diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h index 2b3d8429ab1c6..bc626061b2da6 100644 --- a/include/linux/page-flags.h +++ b/include/linux/page-flags.h @@ -861,7 +861,7 @@ static inline void ClearPageCompound(struct page *page) } PAGEFLAG(LargeRmappable, large_rmappable, PF_SECOND) #else -TESTPAGEFLAG_FALSE(LargeRmappable, large_rmappable) +PAGEFLAG_FALSE(LargeRmappable, large_rmappable) #endif #define PG_head_mask ((1UL << PG_head)) diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 12bf96916c8bf..6f7b89b520d6c 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -20,10 +20,13 @@ enum { * If in doubt, ignore this flag. */ #ifdef MODULE - PROC_ENTRY_PERMANENT = 0U, + PROC_ENTRY_PERMANENT = 0U, #else - PROC_ENTRY_PERMANENT = 1U << 0, + PROC_ENTRY_PERMANENT = 1U << 0, #endif + + PROC_ENTRY_proc_read_iter = 1U << 1, + PROC_ENTRY_proc_compat_ioctl = 1U << 2, }; struct proc_ops { diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h index aafc3373e2fbb..ec784f0a6ddd1 100644 --- a/include/linux/sunrpc/svcsock.h +++ b/include/linux/sunrpc/svcsock.h @@ -35,6 +35,8 @@ struct svc_sock { /* Total length of the data (not including fragment headers) * received so far in the fragments making up this rpc: */ u32 sk_datalen; + /* Number of queued send requests */ + atomic_t sk_sendqlen; struct completion sk_handshake_done; diff --git a/include/media/v4l2-fwnode.h b/include/media/v4l2-fwnode.h index eadae31ff2570..88bda4d86edc0 100644 --- a/include/media/v4l2-fwnode.h +++ b/include/media/v4l2-fwnode.h @@ -25,68 +25,19 @@ struct fwnode_handle; struct v4l2_async_notifier; struct v4l2_async_subdev; -#define V4L2_FWNODE_CSI2_MAX_DATA_LANES 8 - -/** - * struct v4l2_fwnode_bus_mipi_csi2 - MIPI CSI-2 bus data structure - * @flags: media bus (V4L2_MBUS_*) flags - * @data_lanes: an array of physical data lane indexes - * @clock_lane: physical lane index of the clock lane - * @num_data_lanes: number of data lanes - * @lane_polarities: polarity of the lanes. The order is the same of - * the physical lanes. - */ -struct v4l2_fwnode_bus_mipi_csi2 { - unsigned int flags; - unsigned char data_lanes[V4L2_FWNODE_CSI2_MAX_DATA_LANES]; - unsigned char clock_lane; - unsigned char num_data_lanes; - bool lane_polarities[1 + V4L2_FWNODE_CSI2_MAX_DATA_LANES]; -}; - -/** - * struct v4l2_fwnode_bus_parallel - parallel data bus data structure - * @flags: media bus (V4L2_MBUS_*) flags - * @bus_width: bus width in bits - * @data_shift: data shift in bits - */ -struct v4l2_fwnode_bus_parallel { - unsigned int flags; - unsigned char bus_width; - unsigned char data_shift; -}; - -/** - * struct v4l2_fwnode_bus_mipi_csi1 - CSI-1/CCP2 data bus structure - * @clock_inv: polarity of clock/strobe signal - * false - not inverted, true - inverted - * @strobe: false - data/clock, true - data/strobe - * @lane_polarity: the polarities of the clock (index 0) and data lanes - * index (1) - * @data_lane: the number of the data lane - * @clock_lane: the number of the clock lane - */ -struct v4l2_fwnode_bus_mipi_csi1 { - unsigned char clock_inv:1; - unsigned char strobe:1; - bool lane_polarity[2]; - unsigned char data_lane; - unsigned char clock_lane; -}; - /** * struct v4l2_fwnode_endpoint - the endpoint data structure * @base: fwnode endpoint of the v4l2_fwnode * @bus_type: bus type * @bus: bus configuration data structure - * @bus.parallel: embedded &struct v4l2_fwnode_bus_parallel. + * @bus.parallel: embedded &struct v4l2_mbus_config_parallel. * Used if the bus is parallel. - * @bus.mipi_csi1: embedded &struct v4l2_fwnode_bus_mipi_csi1. + * @bus.mipi_csi1: embedded &struct v4l2_mbus_config_mipi_csi1. * Used if the bus is MIPI Alliance's Camera Serial * Interface version 1 (MIPI CSI1) or Standard * Mobile Imaging Architecture's Compact Camera Port 2 * (SMIA CCP2). - * @bus.mipi_csi2: embedded &struct v4l2_fwnode_bus_mipi_csi2. + * @bus.mipi_csi2: embedded &struct v4l2_mbus_config_mipi_csi2. * Used if the bus is MIPI Alliance's Camera Serial * Interface version 2 (MIPI CSI2). * @link_frequencies: array of supported link frequencies @@ -96,9 +47,9 @@ struct v4l2_fwnode_endpoint { struct fwnode_endpoint base; enum v4l2_mbus_type bus_type; struct { - struct v4l2_fwnode_bus_parallel parallel; - struct v4l2_fwnode_bus_mipi_csi1 mipi_csi1; - struct v4l2_fwnode_bus_mipi_csi2 mipi_csi2; + struct v4l2_mbus_config_parallel parallel; + struct v4l2_mbus_config_mipi_csi1 mipi_csi1; + struct v4l2_mbus_config_mipi_csi2 mipi_csi2; } bus; u64 *link_frequencies; unsigned int nr_of_link_frequencies; diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h index b77871485306e..e0db3bcff9edd 100644 --- a/include/media/v4l2-mediabus.h +++ b/include/media/v4l2-mediabus.h @@ -67,19 +67,57 @@ #define V4L2_MBUS_DATA_ENABLE_LOW BIT(15) /* Serial flags */ -/* CSI-2 Virtual Channel identifiers. */ -#define V4L2_MBUS_CSI2_CHANNEL_0 BIT(4) -#define V4L2_MBUS_CSI2_CHANNEL_1 BIT(5) -#define V4L2_MBUS_CSI2_CHANNEL_2 BIT(6) -#define V4L2_MBUS_CSI2_CHANNEL_3 BIT(7) /* Clock non-continuous mode support. */ -#define V4L2_MBUS_CSI2_CONTINUOUS_CLOCK BIT(8) -#define V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK BIT(9) +#define V4L2_MBUS_CSI2_NONCONTINUOUS_CLOCK BIT(0) -#define V4L2_MBUS_CSI2_CHANNELS (V4L2_MBUS_CSI2_CHANNEL_0 | \ - V4L2_MBUS_CSI2_CHANNEL_1 | \ - V4L2_MBUS_CSI2_CHANNEL_2 | \ - V4L2_MBUS_CSI2_CHANNEL_3) +#define V4L2_MBUS_CSI2_MAX_DATA_LANES 8 + +/** + * struct v4l2_mbus_config_mipi_csi2 - MIPI CSI-2 data bus configuration + * @flags: media bus (V4L2_MBUS_*) flags + * @data_lanes: an array of physical data lane indexes + * @clock_lane: physical lane index of the clock lane + * @num_data_lanes: number of data lanes + * @lane_polarities: polarity of the lanes. The order is the same of + * the physical lanes. + */ +struct v4l2_mbus_config_mipi_csi2 { + unsigned int flags; + unsigned char data_lanes[V4L2_MBUS_CSI2_MAX_DATA_LANES]; + unsigned char clock_lane; + unsigned char num_data_lanes; + bool lane_polarities[1 + V4L2_MBUS_CSI2_MAX_DATA_LANES]; +}; + +/** + * struct v4l2_mbus_config_parallel - parallel data bus configuration + * @flags: media bus (V4L2_MBUS_*) flags + * @bus_width: bus width in bits + * @data_shift: data shift in bits + */ +struct v4l2_mbus_config_parallel { + unsigned int flags; + unsigned char bus_width; + unsigned char data_shift; +}; + +/** + * struct v4l2_mbus_config_mipi_csi1 - CSI-1/CCP2 data bus configuration + * @clock_inv: polarity of clock/strobe signal + * false - not inverted, true - inverted + * @strobe: false - data/clock, true - data/strobe + * @lane_polarity: the polarities of the clock (index 0) and data lanes + * index (1) + * @data_lane: the number of the data lane + * @clock_lane: the number of the clock lane + */ +struct v4l2_mbus_config_mipi_csi1 { + unsigned char clock_inv:1; + unsigned char strobe:1; + bool lane_polarity[2]; + unsigned char data_lane; + unsigned char clock_lane; +}; /** * enum v4l2_mbus_type - media bus type @@ -106,12 +144,26 @@ enum v4l2_mbus_type { /** * struct v4l2_mbus_config - media bus configuration - * @type: in: interface type - * @flags: in / out: configuration flags, depending on @type + * @type: interface type + * @bus: bus configuration data structure + * @bus.parallel: embedded &struct v4l2_mbus_config_parallel. + * Used if the bus is parallel or BT.656. + * @bus.mipi_csi1: embedded &struct v4l2_mbus_config_mipi_csi1. + * Used if the bus is MIPI Alliance's Camera Serial + * Interface version 1 (MIPI CSI1) or Standard + * Mobile Imaging Architecture's Compact Camera Port 2 + * (SMIA CCP2). + * @bus.mipi_csi2: embedded &struct v4l2_mbus_config_mipi_csi2. + * Used if the bus is MIPI Alliance's Camera Serial + * Interface version 2 (MIPI CSI2). */ struct v4l2_mbus_config { enum v4l2_mbus_type type; - unsigned int flags; + union { + struct v4l2_mbus_config_parallel parallel; + struct v4l2_mbus_config_mipi_csi1 mipi_csi1; + struct v4l2_mbus_config_mipi_csi2 mipi_csi2; + } bus; }; /** diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h index 313d0b972e064..f2f8816340757 100644 --- a/include/net/bluetooth/l2cap.h +++ b/include/net/bluetooth/l2cap.h @@ -668,7 +668,7 @@ struct l2cap_conn { struct l2cap_chan *smp; struct list_head chan_l; - struct mutex chan_lock; + struct mutex lock; struct kref ref; struct list_head users; }; @@ -970,6 +970,7 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err); void l2cap_send_conn_req(struct l2cap_chan *chan); struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn); +struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *conn); void l2cap_conn_put(struct l2cap_conn *conn); int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user); diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index cfc658c582925..b1c7124696449 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6304,6 +6304,10 @@ static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq) lockdep_assert_rq_held(rq); + // Do not unthrottle for an active CPU + if (cpumask_test_cpu(cpu_of(rq), cpu_active_mask)) + return; + /* * The rq clock has already been updated in the * set_rq_offline(), so we should skip updating @@ -6318,19 +6322,21 @@ static void __maybe_unused unthrottle_offline_cfs_rqs(struct rq *rq) if (!cfs_rq->runtime_enabled) continue; - /* - * clock_task is not advancing so we just need to make sure - * there's some valid quota amount - */ - cfs_rq->runtime_remaining = 1; /* * Offline rq is schedulable till CPU is completely disabled * in take_cpu_down(), so we prevent new cfs throttling here. */ cfs_rq->runtime_enabled = 0; - if (cfs_rq_throttled(cfs_rq)) - unthrottle_cfs_rq(cfs_rq); + if (!cfs_rq_throttled(cfs_rq)) + continue; + + /* + * clock_task is not advancing so we just need to make sure + * there's some valid quota amount + */ + cfs_rq->runtime_remaining = 1; + unthrottle_cfs_rq(cfs_rq); } rcu_read_unlock(); diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 430105eb3f612..20d9b3971dc88 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2784,7 +2784,7 @@ void __folio_undo_large_rmappable(struct folio *folio) spin_lock_irqsave(&ds_queue->split_queue_lock, flags); if (!list_empty(&folio->_deferred_list)) { ds_queue->split_queue_len--; - list_del(&folio->_deferred_list); + list_del_init(&folio->_deferred_list); } spin_unlock_irqrestore(&ds_queue->split_queue_lock, flags); } diff --git a/mm/hugetlb.c b/mm/hugetlb.c index afb1df30dbd29..9bd3d9ecf80c4 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2118,6 +2118,9 @@ static struct folio *alloc_buddy_hugetlb_folio(struct hstate *h, nid = numa_mem_id(); retry: folio = __folio_alloc(gfp_mask, order, nid, nmask); + /* Ensure hugetlb folio won't have large_rmappable flag set. */ + if (folio) + folio_clear_large_rmappable(folio); if (folio && !folio_ref_freeze(folio, 1)) { folio_put(folio); diff --git a/mm/migrate.c b/mm/migrate.c index 969e0727a93ff..a11866618ce99 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -412,6 +412,15 @@ int folio_migrate_mapping(struct address_space *mapping, if (folio_ref_count(folio) != expected_count) return -EAGAIN; + /* Take off deferred split queue while frozen and memcg set */ + if (folio_test_large(folio) && + folio_test_large_rmappable(folio)) { + if (!folio_ref_freeze(folio, expected_count)) + return -EAGAIN; + folio_undo_large_rmappable(folio); + folio_ref_unfreeze(folio, expected_count); + } + /* No turning back from here */ newfolio->index = folio->index; newfolio->mapping = folio->mapping; @@ -430,6 +439,10 @@ int folio_migrate_mapping(struct address_space *mapping, return -EAGAIN; } + /* Take off deferred split queue while frozen and memcg set */ + if (folio_test_large(folio) && folio_test_large_rmappable(folio)) + folio_undo_large_rmappable(folio); + /* * Now we know that no one else is looking at the folio: * no turning back from here. diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index c5f484771d456..f501f37cfe07d 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c @@ -131,7 +131,8 @@ int vlan_check_real_dev(struct net_device *real_dev, { const char *name = real_dev->name; - if (real_dev->features & NETIF_F_VLAN_CHALLENGED) { + if (real_dev->features & NETIF_F_VLAN_CHALLENGED || + real_dev->type != ARPHRD_ETHER) { pr_info("VLANs not supported on %s\n", name); NL_SET_ERR_MSG_MOD(extack, "VLANs not supported on device"); return -EOPNOTSUPP; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 27b4c4a2ba1fd..fec11e576f310 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -119,7 +119,6 @@ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, { struct l2cap_chan *c; - mutex_lock(&conn->chan_lock); c = __l2cap_get_chan_by_scid(conn, cid); if (c) { /* Only lock if chan reference is not 0 */ @@ -127,7 +126,6 @@ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, if (c) l2cap_chan_lock(c); } - mutex_unlock(&conn->chan_lock); return c; } @@ -140,7 +138,6 @@ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, { struct l2cap_chan *c; - mutex_lock(&conn->chan_lock); c = __l2cap_get_chan_by_dcid(conn, cid); if (c) { /* Only lock if chan reference is not 0 */ @@ -148,7 +145,6 @@ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, if (c) l2cap_chan_lock(c); } - mutex_unlock(&conn->chan_lock); return c; } @@ -418,7 +414,7 @@ static void l2cap_chan_timeout(struct work_struct *work) if (!conn) return; - mutex_lock(&conn->chan_lock); + mutex_lock(&conn->lock); /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling * this work. No need to call l2cap_chan_hold(chan) here again. */ @@ -439,7 +435,7 @@ static void l2cap_chan_timeout(struct work_struct *work) l2cap_chan_unlock(chan); l2cap_chan_put(chan); - mutex_unlock(&conn->chan_lock); + mutex_unlock(&conn->lock); } struct l2cap_chan *l2cap_chan_create(void) @@ -641,9 +637,9 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) { - mutex_lock(&conn->chan_lock); + mutex_lock(&conn->lock); __l2cap_chan_add(conn, chan); - mutex_unlock(&conn->chan_lock); + mutex_unlock(&conn->lock); } void l2cap_chan_del(struct l2cap_chan *chan, int err) @@ -731,9 +727,9 @@ void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, if (!conn) return; - mutex_lock(&conn->chan_lock); + mutex_lock(&conn->lock); __l2cap_chan_list(conn, func, data); - mutex_unlock(&conn->chan_lock); + mutex_unlock(&conn->lock); } EXPORT_SYMBOL_GPL(l2cap_chan_list); @@ -745,7 +741,7 @@ static void l2cap_conn_update_id_addr(struct work_struct *work) struct hci_conn *hcon = conn->hcon; struct l2cap_chan *chan; - mutex_lock(&conn->chan_lock); + mutex_lock(&conn->lock); list_for_each_entry(chan, &conn->chan_l, list) { l2cap_chan_lock(chan); @@ -754,7 +750,7 @@ static void l2cap_conn_update_id_addr(struct work_struct *work) l2cap_chan_unlock(chan); } - mutex_unlock(&conn->chan_lock); + mutex_unlock(&conn->lock); } static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) @@ -948,6 +944,16 @@ static u8 l2cap_get_ident(struct l2cap_conn *conn) return id; } +static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb, + u8 flags) +{ + /* Check if the hcon still valid before attempting to send */ + if (hci_conn_valid(conn->hcon->hdev, conn->hcon)) + hci_send_acl(conn->hchan, skb, flags); + else + kfree_skb(skb); +} + static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data) { @@ -970,7 +976,7 @@ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; skb->priority = HCI_PRIO_MAX; - hci_send_acl(conn->hchan, skb, flags); + l2cap_send_acl(conn, skb, flags); } static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) @@ -1497,8 +1503,6 @@ static void l2cap_conn_start(struct l2cap_conn *conn) BT_DBG("conn %p", conn); - mutex_lock(&conn->chan_lock); - list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { l2cap_chan_lock(chan); @@ -1567,8 +1571,6 @@ static void l2cap_conn_start(struct l2cap_conn *conn) l2cap_chan_unlock(chan); } - - mutex_unlock(&conn->chan_lock); } static void l2cap_le_conn_ready(struct l2cap_conn *conn) @@ -1614,7 +1616,7 @@ static void l2cap_conn_ready(struct l2cap_conn *conn) if (hcon->type == ACL_LINK) l2cap_request_info(conn); - mutex_lock(&conn->chan_lock); + mutex_lock(&conn->lock); list_for_each_entry(chan, &conn->chan_l, list) { @@ -1632,7 +1634,7 @@ static void l2cap_conn_ready(struct l2cap_conn *conn) l2cap_chan_unlock(chan); } - mutex_unlock(&conn->chan_lock); + mutex_unlock(&conn->lock); if (hcon->type == LE_LINK) l2cap_le_conn_ready(conn); @@ -1647,14 +1649,10 @@ static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) BT_DBG("conn %p", conn); - mutex_lock(&conn->chan_lock); - list_for_each_entry(chan, &conn->chan_l, list) { if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) l2cap_chan_set_err(chan, err); } - - mutex_unlock(&conn->chan_lock); } static void l2cap_info_timeout(struct work_struct *work) @@ -1665,7 +1663,9 @@ static void l2cap_info_timeout(struct work_struct *work) conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; conn->info_ident = 0; + mutex_lock(&conn->lock); l2cap_conn_start(conn); + mutex_unlock(&conn->lock); } /* @@ -1757,6 +1757,8 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); + mutex_lock(&conn->lock); + kfree_skb(conn->rx_skb); skb_queue_purge(&conn->pending_rx); @@ -1775,8 +1777,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) /* Force the connection to be immediately dropped */ hcon->disc_timeout = 0; - mutex_lock(&conn->chan_lock); - /* Kill channels */ list_for_each_entry_safe(chan, l, &conn->chan_l, list) { l2cap_chan_hold(chan); @@ -1790,15 +1790,14 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) l2cap_chan_put(chan); } - mutex_unlock(&conn->chan_lock); - - hci_chan_del(conn->hchan); - if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) cancel_delayed_work_sync(&conn->info_timer); - hcon->l2cap_data = NULL; + hci_chan_del(conn->hchan); conn->hchan = NULL; + + hcon->l2cap_data = NULL; + mutex_unlock(&conn->lock); l2cap_conn_put(conn); } @@ -2916,8 +2915,6 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) BT_DBG("conn %p", conn); - mutex_lock(&conn->chan_lock); - list_for_each_entry(chan, &conn->chan_l, list) { if (chan->chan_type != L2CAP_CHAN_RAW) continue; @@ -2932,8 +2929,6 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) if (chan->ops->recv(chan, nskb)) kfree_skb(nskb); } - - mutex_unlock(&conn->chan_lock); } /* ---- L2CAP signalling commands ---- */ @@ -3952,7 +3947,6 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, goto response; } - mutex_lock(&conn->chan_lock); l2cap_chan_lock(pchan); /* Check if the ACL is secure enough (if not SDP) */ @@ -4059,7 +4053,6 @@ static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, } l2cap_chan_unlock(pchan); - mutex_unlock(&conn->chan_lock); l2cap_chan_put(pchan); } @@ -4098,27 +4091,19 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status); - mutex_lock(&conn->chan_lock); - if (scid) { chan = __l2cap_get_chan_by_scid(conn, scid); - if (!chan) { - err = -EBADSLT; - goto unlock; - } + if (!chan) + return -EBADSLT; } else { chan = __l2cap_get_chan_by_ident(conn, cmd->ident); - if (!chan) { - err = -EBADSLT; - goto unlock; - } + if (!chan) + return -EBADSLT; } chan = l2cap_chan_hold_unless_zero(chan); - if (!chan) { - err = -EBADSLT; - goto unlock; - } + if (!chan) + return -EBADSLT; err = 0; @@ -4156,9 +4141,6 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, l2cap_chan_unlock(chan); l2cap_chan_put(chan); -unlock: - mutex_unlock(&conn->chan_lock); - return err; } @@ -4446,11 +4428,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, chan->ops->set_shutdown(chan); - l2cap_chan_unlock(chan); - mutex_lock(&conn->chan_lock); - l2cap_chan_lock(chan); l2cap_chan_del(chan, ECONNRESET); - mutex_unlock(&conn->chan_lock); chan->ops->close(chan); @@ -4487,11 +4465,7 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, return 0; } - l2cap_chan_unlock(chan); - mutex_lock(&conn->chan_lock); - l2cap_chan_lock(chan); l2cap_chan_del(chan, 0); - mutex_unlock(&conn->chan_lock); chan->ops->close(chan); @@ -4689,13 +4663,9 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn, BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x", dcid, mtu, mps, credits, result); - mutex_lock(&conn->chan_lock); - chan = __l2cap_get_chan_by_ident(conn, cmd->ident); - if (!chan) { - err = -EBADSLT; - goto unlock; - } + if (!chan) + return -EBADSLT; err = 0; @@ -4743,9 +4713,6 @@ static int l2cap_le_connect_rsp(struct l2cap_conn *conn, l2cap_chan_unlock(chan); -unlock: - mutex_unlock(&conn->chan_lock); - return err; } @@ -4857,7 +4824,6 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, goto response; } - mutex_lock(&conn->chan_lock); l2cap_chan_lock(pchan); if (!smp_sufficient_security(conn->hcon, pchan->sec_level, @@ -4923,7 +4889,6 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, response_unlock: l2cap_chan_unlock(pchan); - mutex_unlock(&conn->chan_lock); l2cap_chan_put(pchan); if (result == L2CAP_CR_PEND) @@ -5057,7 +5022,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, goto response; } - mutex_lock(&conn->chan_lock); l2cap_chan_lock(pchan); if (!smp_sufficient_security(conn->hcon, pchan->sec_level, @@ -5132,7 +5096,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, unlock: l2cap_chan_unlock(pchan); - mutex_unlock(&conn->chan_lock); l2cap_chan_put(pchan); response: @@ -5169,8 +5132,6 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits, result); - mutex_lock(&conn->chan_lock); - cmd_len -= sizeof(*rsp); list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { @@ -5256,8 +5217,6 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, l2cap_chan_unlock(chan); } - mutex_unlock(&conn->chan_lock); - return err; } @@ -5370,8 +5329,6 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, if (cmd_len < sizeof(*rej)) return -EPROTO; - mutex_lock(&conn->chan_lock); - chan = __l2cap_get_chan_by_ident(conn, cmd->ident); if (!chan) goto done; @@ -5386,7 +5343,6 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, l2cap_chan_put(chan); done: - mutex_unlock(&conn->chan_lock); return 0; } @@ -6841,8 +6797,12 @@ static void process_pending_rx(struct work_struct *work) BT_DBG(""); + mutex_lock(&conn->lock); + while ((skb = skb_dequeue(&conn->pending_rx))) l2cap_recv_frame(conn, skb); + + mutex_unlock(&conn->lock); } static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) @@ -6881,7 +6841,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR; mutex_init(&conn->ident_lock); - mutex_init(&conn->chan_lock); + mutex_init(&conn->lock); INIT_LIST_HEAD(&conn->chan_l); INIT_LIST_HEAD(&conn->users); @@ -7072,7 +7032,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, } } - mutex_lock(&conn->chan_lock); + mutex_lock(&conn->lock); l2cap_chan_lock(chan); if (cid && __l2cap_get_chan_by_dcid(conn, cid)) { @@ -7113,7 +7073,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, chan_unlock: l2cap_chan_unlock(chan); - mutex_unlock(&conn->chan_lock); + mutex_unlock(&conn->lock); done: hci_dev_unlock(hdev); hci_dev_put(hdev); @@ -7325,7 +7285,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt); - mutex_lock(&conn->chan_lock); + mutex_lock(&conn->lock); list_for_each_entry(chan, &conn->chan_l, list) { l2cap_chan_lock(chan); @@ -7399,7 +7359,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) l2cap_chan_unlock(chan); } - mutex_unlock(&conn->chan_lock); + mutex_unlock(&conn->lock); } /* Append fragment into frame respecting the maximum len of rx_skb */ @@ -7466,19 +7426,45 @@ static void l2cap_recv_reset(struct l2cap_conn *conn) conn->rx_len = 0; } +struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c) +{ + if (!c) + return NULL; + + BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref)); + + if (!kref_get_unless_zero(&c->ref)) + return NULL; + + return c; +} + void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) { - struct l2cap_conn *conn = hcon->l2cap_data; + struct l2cap_conn *conn; int len; + /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */ + hci_dev_lock(hcon->hdev); + + conn = hcon->l2cap_data; + if (!conn) conn = l2cap_conn_add(hcon); - if (!conn) - goto drop; + conn = l2cap_conn_hold_unless_zero(conn); + + hci_dev_unlock(hcon->hdev); + + if (!conn) { + kfree_skb(skb); + return; + } BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); + mutex_lock(&conn->lock); + switch (flags) { case ACL_START: case ACL_START_NO_FLUSH: @@ -7503,7 +7489,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) if (len == skb->len) { /* Complete frame received */ l2cap_recv_frame(conn, skb); - return; + goto unlock; } BT_DBG("Start: total len %d, frag len %u", len, skb->len); @@ -7567,6 +7553,9 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) drop: kfree_skb(skb); +unlock: + mutex_unlock(&conn->lock); + l2cap_conn_put(conn); } static struct hci_cb l2cap_cb = { diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index f6ad785a8aaa2..d893682d89aee 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1324,9 +1324,10 @@ static int l2cap_sock_shutdown(struct socket *sock, int how) /* prevent sk structure from being freed whilst unlocked */ sock_hold(sk); - chan = l2cap_pi(sk)->chan; /* prevent chan structure from being freed whilst unlocked */ - l2cap_chan_hold(chan); + chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); + if (!chan) + goto shutdown_already; BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); @@ -1356,22 +1357,20 @@ static int l2cap_sock_shutdown(struct socket *sock, int how) release_sock(sk); l2cap_chan_lock(chan); - conn = chan->conn; - if (conn) - /* prevent conn structure from being freed */ - l2cap_conn_get(conn); + /* prevent conn structure from being freed */ + conn = l2cap_conn_hold_unless_zero(chan->conn); l2cap_chan_unlock(chan); if (conn) /* mutex lock must be taken before l2cap_chan_lock() */ - mutex_lock(&conn->chan_lock); + mutex_lock(&conn->lock); l2cap_chan_lock(chan); l2cap_chan_close(chan, 0); l2cap_chan_unlock(chan); if (conn) { - mutex_unlock(&conn->chan_lock); + mutex_unlock(&conn->lock); l2cap_conn_put(conn); } diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c index a3676155be78b..b6b1bff6f24a6 100644 --- a/net/ipv4/ip_tunnel_core.c +++ b/net/ipv4/ip_tunnel_core.c @@ -451,7 +451,7 @@ static const struct nla_policy geneve_opt_policy[LWTUNNEL_IP_OPT_GENEVE_MAX + 1] = { [LWTUNNEL_IP_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, [LWTUNNEL_IP_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, - [LWTUNNEL_IP_OPT_GENEVE_DATA] = { .type = NLA_BINARY, .len = 128 }, + [LWTUNNEL_IP_OPT_GENEVE_DATA] = { .type = NLA_BINARY, .len = 127 }, }; static const struct nla_policy diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index 252c1ced3106b..980c2033a8f28 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -315,13 +315,17 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, /* clear destructor to avoid skb_segment assigning it to tail */ copy_dtor = gso_skb->destructor == sock_wfree; - if (copy_dtor) + if (copy_dtor) { gso_skb->destructor = NULL; + gso_skb->sk = NULL; + } segs = skb_segment(gso_skb, features); if (IS_ERR_OR_NULL(segs)) { - if (copy_dtor) + if (copy_dtor) { gso_skb->destructor = sock_wfree; + gso_skb->sk = sk; + } return segs; } diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c index 27c10a3f1ce00..2366a6336ce4b 100644 --- a/net/netfilter/nft_tunnel.c +++ b/net/netfilter/nft_tunnel.c @@ -307,7 +307,7 @@ static int nft_tunnel_obj_erspan_init(const struct nlattr *attr, static const struct nla_policy nft_tunnel_opts_geneve_policy[NFTA_TUNNEL_KEY_GENEVE_MAX + 1] = { [NFTA_TUNNEL_KEY_GENEVE_CLASS] = { .type = NLA_U16 }, [NFTA_TUNNEL_KEY_GENEVE_TYPE] = { .type = NLA_U8 }, - [NFTA_TUNNEL_KEY_GENEVE_DATA] = { .type = NLA_BINARY, .len = 128 }, + [NFTA_TUNNEL_KEY_GENEVE_DATA] = { .type = NLA_BINARY, .len = 127 }, }; static int nft_tunnel_obj_geneve_init(const struct nlattr *attr, diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c index af7c998459488..e296714803dc0 100644 --- a/net/sched/act_tunnel_key.c +++ b/net/sched/act_tunnel_key.c @@ -68,7 +68,7 @@ geneve_opt_policy[TCA_TUNNEL_KEY_ENC_OPT_GENEVE_MAX + 1] = { [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, [TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, - .len = 128 }, + .len = 127 }, }; static const struct nla_policy diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index dbf0450e6dc53..e7b9cb71a9569 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -764,7 +764,7 @@ geneve_opt_policy[TCA_FLOWER_KEY_ENC_OPT_GENEVE_MAX + 1] = { [TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS] = { .type = NLA_U16 }, [TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE] = { .type = NLA_U8 }, [TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA] = { .type = NLA_BINARY, - .len = 128 }, + .len = 127 }, }; static const struct nla_policy diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index 171f7a98d7ecb..4619340cd6e57 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -1296,18 +1296,23 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp) svc_tcp_release_ctxt(xprt, rqstp->rq_xprt_ctxt); rqstp->rq_xprt_ctxt = NULL; + atomic_inc(&svsk->sk_sendqlen); mutex_lock(&xprt->xpt_mutex); if (svc_xprt_is_dead(xprt)) goto out_notconn; + tcp_sock_set_cork(svsk->sk_sk, true); err = svc_tcp_sendmsg(svsk->sk_sock, xdr, marker, &sent); xdr_free_bvec(xdr); trace_svcsock_tcp_send(xprt, err < 0 ? (long)err : sent); if (err < 0 || sent != (xdr->len + sizeof(marker))) goto out_close; + if (atomic_dec_and_test(&svsk->sk_sendqlen)) + tcp_sock_set_cork(svsk->sk_sk, false); mutex_unlock(&xprt->xpt_mutex); return sent; out_notconn: + atomic_dec(&svsk->sk_sendqlen); mutex_unlock(&xprt->xpt_mutex); return -ENOTCONN; out_close: @@ -1316,6 +1321,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp) (err < 0) ? "got error" : "sent", (err < 0) ? err : sent, xdr->len); svc_xprt_deferred_close(xprt); + atomic_dec(&svsk->sk_sendqlen); mutex_unlock(&xprt->xpt_mutex); return -EAGAIN; } diff --git a/net/wireless/core.c b/net/wireless/core.c index 7d313fb66d76b..586e50678ed80 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -553,6 +553,9 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, INIT_WORK(&rdev->mgmt_registrations_update_wk, cfg80211_mgmt_registrations_update_wk); spin_lock_init(&rdev->mgmt_registrations_lock); + INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work); + INIT_LIST_HEAD(&rdev->wiphy_work_list); + spin_lock_init(&rdev->wiphy_work_lock); #ifdef CONFIG_CFG80211_DEFAULT_PS rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT; @@ -570,9 +573,6 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv, return NULL; } - INIT_WORK(&rdev->wiphy_work, cfg80211_wiphy_work); - INIT_LIST_HEAD(&rdev->wiphy_work_list); - spin_lock_init(&rdev->wiphy_work_lock); INIT_WORK(&rdev->rfkill_block, cfg80211_rfkill_block_work); INIT_WORK(&rdev->conn_work, cfg80211_conn_work); INIT_WORK(&rdev->event_work, cfg80211_event_work); @@ -1198,6 +1198,13 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev) { struct cfg80211_internal_bss *scan, *tmp; struct cfg80211_beacon_registration *reg, *treg; + unsigned long flags; + + spin_lock_irqsave(&rdev->wiphy_work_lock, flags); + WARN_ON(!list_empty(&rdev->wiphy_work_list)); + spin_unlock_irqrestore(&rdev->wiphy_work_lock, flags); + cancel_work_sync(&rdev->wiphy_work); + rfkill_destroy(rdev->wiphy.rfkill); list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) { list_del(®->list); diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c index ef2d856287463..999efb78e29a8 100644 --- a/net/xdp/xsk_buff_pool.c +++ b/net/xdp/xsk_buff_pool.c @@ -106,7 +106,7 @@ struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs, if (pool->unaligned) pool->free_heads[i] = xskb; else - xp_init_xskb_addr(xskb, pool, i * pool->chunk_size); + xp_init_xskb_addr(xskb, pool, (u64)i * pool->chunk_size); } return pool; diff --git a/redhat/kernel.changelog-9.6 b/redhat/kernel.changelog-9.6 index faa5bc57ee848..fc0b951f95d1a 100644 --- a/redhat/kernel.changelog-9.6 +++ b/redhat/kernel.changelog-9.6 @@ -1,3 +1,39 @@ +* Sat Jun 07 2025 CKI KWF Bot [5.14.0-570.22.1.el9_6] +- Bluetooth: L2CAP: Fix corrupted list in hci_chan_del (David Marlin) [RHEL-87890] {CVE-2025-21969} +- Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (David Marlin) [RHEL-87890] {CVE-2025-21969} +- Revert "SUNRPC: Revert e0a912e8ddba" (Benjamin Coddington) [RHEL-94811] +- mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio (Jay Shin) [RHEL-92291] +- mm: fix crashes from deferred split racing folio migration (Jay Shin) [RHEL-92291] {CVE-2024-42234} +- mm: memcg: fix split queue list crash when large folio migration (Jay Shin) [RHEL-92291] +- proc: fix UAF in proc_get_inode() (Ian Kent) [RHEL-86808] {CVE-2025-21999} +- cifs: Fix integer overflow while processing acdirmax mount option (Paulo Alcantara) [RHEL-87941] {CVE-2025-21963} +- wifi: cfg80211: init wiphy_work before allocating rfkill fails (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979} +- wifi: cfg80211: cancel wiphy_work before freeing wiphy (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979} +- eth: bnxt: fix truesize for mb-xdp-pass case (CKI Backport Bot) [RHEL-88328] {CVE-2025-21961} +- vmxnet3: unregister xdp rxq info in the reset path (CKI Backport Bot) [RHEL-92471] +- md: fix mddev uaf while iterating all_mddevs list (CKI Backport Bot) [RHEL-89062] {CVE-2025-22126} +- nvme: print firmware bug note for non-unique identifiers (Bryan Gurney) [RHEL-91163] +- nvme-pci: add BOGUS_NID quirk for Samsung PM1733 (Bryan Gurney) [RHEL-91163] +- media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag (Kate Hsuan) [RHEL-90323] +- media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags (Kate Hsuan) [RHEL-90323] +- media: v4l2-mediabus: Use structures to describe bus configuration (Kate Hsuan) [RHEL-90323] +- media: v4l2-fwnode: Move bus config structure to v4l2_mediabus.h (Kate Hsuan) [RHEL-90323] +- sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-86302] +- smb: client: fix UAF in decryption with multichannel (CKI Backport Bot) [RHEL-94460] {CVE-2025-37750} +Resolves: RHEL-86302, RHEL-86808, RHEL-87890, RHEL-87931, RHEL-87941, RHEL-88328, RHEL-89062, RHEL-90323, RHEL-91163, RHEL-92291, RHEL-92471, RHEL-94460, RHEL-94811 + +* Tue Jun 03 2025 CKI KWF Bot [5.14.0-570.21.1.el9_6] +- xsk: fix an integer overflow in xp_create_and_assign_umem() (CKI Backport Bot) [RHEL-87911] {CVE-2025-21997} +- vlan: enforce underlying device type (Guillaume Nault) [RHEL-87884] {CVE-2025-21920} +- net: fix geneve_opt length integer overflow (Guillaume Nault) [RHEL-87974] {CVE-2025-22055} +- net: gso: fix ownership in __udp_gso_segment (CKI Backport Bot) [RHEL-88333] {CVE-2025-21926} +Resolves: RHEL-87884, RHEL-87911, RHEL-87974, RHEL-88333 + +* Sun Jun 01 2025 CKI KWF Bot [5.14.0-570.20.1.el9_6] +- wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (CKI Backport Bot) [RHEL-93253] {CVE-2025-37943} +- ext4: fix OOB read when checking dotdot dir (CKI Backport Bot) [RHEL-87985] {CVE-2025-37785} +Resolves: RHEL-87985, RHEL-93253 + * Sat May 24 2025 CKI KWF Bot [5.14.0-570.19.1.el9_6] - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (David Arcari) [RHEL-87254] {CVE-2022-3424} - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89546] {CVE-2025-21764}