]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 5.15
authorSasha Levin <sashal@kernel.org>
Sun, 26 Feb 2023 15:46:02 +0000 (10:46 -0500)
committerSasha Levin <sashal@kernel.org>
Sun, 26 Feb 2023 15:46:02 +0000 (10:46 -0500)
Signed-off-by: Sasha Levin <sashal@kernel.org>
13 files changed:
queue-5.15/acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch [new file with mode: 0644]
queue-5.15/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch [new file with mode: 0644]
queue-5.15/arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch [new file with mode: 0644]
queue-5.15/asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch [new file with mode: 0644]
queue-5.15/btrfs-send-limit-number-of-clones-and-allocated-memo.patch [new file with mode: 0644]
queue-5.15/fix-xfrm-i-support-for-nested-esp-tunnels.patch [new file with mode: 0644]
queue-5.15/hid-core-fix-deadloop-in-hid_apply_multiplier.patch [new file with mode: 0644]
queue-5.15/hid-elecom-add-support-for-trackball-056e-011c.patch [new file with mode: 0644]
queue-5.15/ib-hfi1-assign-npages-earlier.patch [new file with mode: 0644]
queue-5.15/ionic-refactor-use-of-ionic_rx_fill.patch [new file with mode: 0644]
queue-5.15/neigh-make-sure-used-and-confirmed-times-are-valid.patch [new file with mode: 0644]
queue-5.15/series [new file with mode: 0644]
queue-5.15/x86-cpu-add-lunar-lake-m.patch [new file with mode: 0644]

diff --git a/queue-5.15/acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch b/queue-5.15/acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch
new file mode 100644 (file)
index 0000000..3a3cdf2
--- /dev/null
@@ -0,0 +1,75 @@
+From c1c18fcff3ea738260900d2299829e0596933f68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 11:34:18 -0700
+Subject: ACPI: NFIT: fix a potential deadlock during NFIT teardown
+
+From: Vishal Verma <vishal.l.verma@intel.com>
+
+[ Upstream commit fb6df4366f86dd252bfa3049edffa52d17e7b895 ]
+
+Lockdep reports that acpi_nfit_shutdown() may deadlock against an
+opportune acpi_nfit_scrub(). acpi_nfit_scrub () is run from inside a
+'work' and therefore has already acquired workqueue-internal locks. It
+also acquiires acpi_desc->init_mutex. acpi_nfit_shutdown() first
+acquires init_mutex, and was subsequently attempting to cancel any
+pending workqueue items. This reversed locking order causes a potential
+deadlock:
+
+    ======================================================
+    WARNING: possible circular locking dependency detected
+    6.2.0-rc3 #116 Tainted: G           O     N
+    ------------------------------------------------------
+    libndctl/1958 is trying to acquire lock:
+    ffff888129b461c0 ((work_completion)(&(&acpi_desc->dwork)->work)){+.+.}-{0:0}, at: __flush_work+0x43/0x450
+
+    but task is already holding lock:
+    ffff888129b460e8 (&acpi_desc->init_mutex){+.+.}-{3:3}, at: acpi_nfit_shutdown+0x87/0xd0 [nfit]
+
+    which lock already depends on the new lock.
+
+    ...
+
+    Possible unsafe locking scenario:
+
+          CPU0                    CPU1
+          ----                    ----
+     lock(&acpi_desc->init_mutex);
+                                  lock((work_completion)(&(&acpi_desc->dwork)->work));
+                                  lock(&acpi_desc->init_mutex);
+     lock((work_completion)(&(&acpi_desc->dwork)->work));
+
+    *** DEADLOCK ***
+
+Since the workqueue manipulation is protected by its own internal locking,
+the cancellation of pending work doesn't need to be done under
+acpi_desc->init_mutex. Move cancel_delayed_work_sync() outside the
+init_mutex to fix the deadlock. Any work that starts after
+acpi_nfit_shutdown() drops the lock will see ARS_CANCEL, and the
+cancel_delayed_work_sync() will safely flush it out.
+
+Reported-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Link: https://lore.kernel.org/r/20230112-acpi_nfit_lockdep-v1-1-660be4dd10be@intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 7dd80acf92c78..2575d6c51f898 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3676,8 +3676,8 @@ void acpi_nfit_shutdown(void *data)
+       mutex_lock(&acpi_desc->init_mutex);
+       set_bit(ARS_CANCEL, &acpi_desc->scrub_flags);
+-      cancel_delayed_work_sync(&acpi_desc->dwork);
+       mutex_unlock(&acpi_desc->init_mutex);
++      cancel_delayed_work_sync(&acpi_desc->dwork);
+       /*
+        * Bounce the nvdimm bus lock to make sure any in-flight
+-- 
+2.39.0
+
diff --git a/queue-5.15/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch b/queue-5.15/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch
new file mode 100644 (file)
index 0000000..25213ff
--- /dev/null
@@ -0,0 +1,36 @@
+From 515687498204e61900581f8f2ab24f503dae3646 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 21:17:32 +0100
+Subject: ARM: dts: rockchip: add power-domains property to dp node on rk3288
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 80422339a75088322b4d3884bd12fa0fe5d11050 ]
+
+The clocks in the Rockchip rk3288 DisplayPort node are
+included in the power-domain@RK3288_PD_VIO logic, but the
+power-domains property in the dp node is missing, so fix it.
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3288.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index 66ff5db53c5a9..8670c948ca8da 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -1180,6 +1180,7 @@ edp: dp@ff970000 {
+               clock-names = "dp", "pclk";
+               phys = <&edp_phy>;
+               phy-names = "dp";
++              power-domains = <&power RK3288_PD_VIO>;
+               resets = <&cru SRST_EDP>;
+               reset-names = "dp";
+               rockchip,grf = <&grf>;
+-- 
+2.39.0
+
diff --git a/queue-5.15/arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch b/queue-5.15/arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch
new file mode 100644 (file)
index 0000000..184819f
--- /dev/null
@@ -0,0 +1,45 @@
+From bf4ca10cd9b4ff09920429726c762e2885bce657 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 15:41:34 +0100
+Subject: arm64: dts: rockchip: drop unused LED mode property from
+ rk3328-roc-cc
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 1692bffec674551163a7a4be32f59fdde04ecd27 ]
+
+GPIO LEDs do not have a 'mode' property:
+
+  rockchip/rk3328-roc-pc.dtb: leds: led-0: Unevaluated properties are not allowed ('mode' was unexpected)
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20221125144135.477144-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+index aa22a0c222655..5d5d9574088ca 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -96,7 +96,6 @@ power_led: led-0 {
+                       linux,default-trigger = "heartbeat";
+                       gpios = <&rk805 1 GPIO_ACTIVE_LOW>;
+                       default-state = "on";
+-                      mode = <0x23>;
+               };
+               user_led: led-1 {
+@@ -104,7 +103,6 @@ user_led: led-1 {
+                       linux,default-trigger = "mmc1";
+                       gpios = <&rk805 0 GPIO_ACTIVE_LOW>;
+                       default-state = "off";
+-                      mode = <0x05>;
+               };
+       };
+ };
+-- 
+2.39.0
+
diff --git a/queue-5.15/asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch b/queue-5.15/asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch
new file mode 100644 (file)
index 0000000..8e6204c
--- /dev/null
@@ -0,0 +1,36 @@
+From 5ae92506a6e01631d3aee026f2fd1a8d11c1d817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 02:43:25 +0000
+Subject: ASoC: rt715-sdca: fix clock stop prepare timeout issue
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 2036890282d56bcbf7f915ba9e04bf77967ab231 ]
+
+Modify clock_stop_timeout value for rt715-sdca according to
+the requirement of internal clock trimming.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://lore.kernel.org/r/574b6586267a458cac78c5ac4d5b10bd@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt715-sdca-sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt715-sdca-sdw.c b/sound/soc/codecs/rt715-sdca-sdw.c
+index 0f4354eafef25..85abf8073c278 100644
+--- a/sound/soc/codecs/rt715-sdca-sdw.c
++++ b/sound/soc/codecs/rt715-sdca-sdw.c
+@@ -167,7 +167,7 @@ static int rt715_sdca_read_prop(struct sdw_slave *slave)
+       }
+       /* set the timeout values */
+-      prop->clk_stop_timeout = 20;
++      prop->clk_stop_timeout = 200;
+       return 0;
+ }
+-- 
+2.39.0
+
diff --git a/queue-5.15/btrfs-send-limit-number-of-clones-and-allocated-memo.patch b/queue-5.15/btrfs-send-limit-number-of-clones-and-allocated-memo.patch
new file mode 100644 (file)
index 0000000..105c163
--- /dev/null
@@ -0,0 +1,44 @@
+From 58f8e8a803cda8d29806a52ebc14a7fe8c08925a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 20:32:10 +0100
+Subject: btrfs: send: limit number of clones and allocated memory size
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 33e17b3f5ab74af12aca58c515bc8424ff69a343 ]
+
+The arg->clone_sources_count is u64 and can trigger a warning when a
+huge value is passed from user space and a huge array is allocated.
+Limit the allocated memory to 8MiB (can be increased if needed), which
+in turn limits the number of clone sources to 8M / sizeof(struct
+clone_root) = 8M / 40 = 209715.  Real world number of clones is from
+tens to hundreds, so this is future proof.
+
+Reported-by: syzbot+4376a9a073770c173269@syzkaller.appspotmail.com
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/send.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 9250a17731bdb..692ae2e2f8cc5 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -7549,10 +7549,10 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg)
+       /*
+        * Check that we don't overflow at later allocations, we request
+        * clone_sources_count + 1 items, and compare to unsigned long inside
+-       * access_ok.
++       * access_ok. Also set an upper limit for allocation size so this can't
++       * easily exhaust memory. Max number of clone sources is about 200K.
+        */
+-      if (arg->clone_sources_count >
+-          ULONG_MAX / sizeof(struct clone_root) - 1) {
++      if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) {
+               ret = -EINVAL;
+               goto out;
+       }
+-- 
+2.39.0
+
diff --git a/queue-5.15/fix-xfrm-i-support-for-nested-esp-tunnels.patch b/queue-5.15/fix-xfrm-i-support-for-nested-esp-tunnels.patch
new file mode 100644 (file)
index 0000000..979c5e9
--- /dev/null
@@ -0,0 +1,131 @@
+From f814b8267ba5c8ada8976b12ce0af0336e9887df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 21:28:12 +0000
+Subject: Fix XFRM-I support for nested ESP tunnels
+
+From: Benedict Wong <benedictwong@google.com>
+
+[ Upstream commit b0355dbbf13c0052931dd14c38c789efed64d3de ]
+
+This change adds support for nested IPsec tunnels by ensuring that
+XFRM-I verifies existing policies before decapsulating a subsequent
+policies. Addtionally, this clears the secpath entries after policies
+are verified, ensuring that previous tunnels with no-longer-valid
+do not pollute subsequent policy checks.
+
+This is necessary especially for nested tunnels, as the IP addresses,
+protocol and ports may all change, thus not matching the previous
+policies. In order to ensure that packets match the relevant inbound
+templates, the xfrm_policy_check should be done before handing off to
+the inner XFRM protocol to decrypt and decapsulate.
+
+Notably, raw ESP/AH packets did not perform policy checks inherently,
+whereas all other encapsulated packets (UDP, TCP encapsulated) do policy
+checks after calling xfrm_input handling in the respective encapsulation
+layer.
+
+Test: Verified with additional Android Kernel Unit tests
+Signed-off-by: Benedict Wong <benedictwong@google.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_interface.c | 54 ++++++++++++++++++++++++++++++++++++---
+ net/xfrm/xfrm_policy.c    |  3 +++
+ 2 files changed, 53 insertions(+), 4 deletions(-)
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 1e8b26eecb3f8..694eec6ca147e 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -207,6 +207,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet)
+       skb->mark = 0;
+ }
++static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi,
++                     int encap_type, unsigned short family)
++{
++      struct sec_path *sp;
++
++      sp = skb_sec_path(skb);
++      if (sp && (sp->len || sp->olen) &&
++          !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
++              goto discard;
++
++      XFRM_SPI_SKB_CB(skb)->family = family;
++      if (family == AF_INET) {
++              XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
++              XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
++      } else {
++              XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
++              XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
++      }
++
++      return xfrm_input(skb, nexthdr, spi, encap_type);
++discard:
++      kfree_skb(skb);
++      return 0;
++}
++
++static int xfrmi4_rcv(struct sk_buff *skb)
++{
++      return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET);
++}
++
++static int xfrmi6_rcv(struct sk_buff *skb)
++{
++      return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
++                         0, 0, AF_INET6);
++}
++
++static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
++{
++      return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET);
++}
++
++static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
++{
++      return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6);
++}
++
+ static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
+ {
+       const struct xfrm_mode *inner_mode;
+@@ -774,8 +820,8 @@ static struct pernet_operations xfrmi_net_ops = {
+ };
+ static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = {
+-      .handler        =       xfrm6_rcv,
+-      .input_handler  =       xfrm_input,
++      .handler        =       xfrmi6_rcv,
++      .input_handler  =       xfrmi6_input,
+       .cb_handler     =       xfrmi_rcv_cb,
+       .err_handler    =       xfrmi6_err,
+       .priority       =       10,
+@@ -825,8 +871,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = {
+ #endif
+ static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = {
+-      .handler        =       xfrm4_rcv,
+-      .input_handler  =       xfrm_input,
++      .handler        =       xfrmi4_rcv,
++      .input_handler  =       xfrmi4_input,
+       .cb_handler     =       xfrmi_rcv_cb,
+       .err_handler    =       xfrmi4_err,
+       .priority       =       10,
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index ba58b963f4827..0540e9f72b2fe 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -3669,6 +3669,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+                       goto reject;
+               }
++              if (if_id)
++                      secpath_reset(skb);
++
+               xfrm_pols_put(pols, npols);
+               return 1;
+       }
+-- 
+2.39.0
+
diff --git a/queue-5.15/hid-core-fix-deadloop-in-hid_apply_multiplier.patch b/queue-5.15/hid-core-fix-deadloop-in-hid_apply_multiplier.patch
new file mode 100644 (file)
index 0000000..bb98179
--- /dev/null
@@ -0,0 +1,63 @@
+From 488c360ccf8d0a4ce86b7434b3d40ec25b2ea1ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 21:29:47 +0000
+Subject: HID: core: Fix deadloop in hid_apply_multiplier.
+
+From: Xin Zhao <xnzhao@google.com>
+
+[ Upstream commit ea427a222d8bdf2bc1a8a6da3ebe247f7dced70c ]
+
+The initial value of hid->collection[].parent_idx if 0. When
+Report descriptor doesn't contain "HID Collection", the value
+remains as 0.
+
+In the meanwhile, when the Report descriptor fullfill
+all following conditions, it will trigger hid_apply_multiplier
+function call.
+1. Usage page is Generic Desktop Ctrls (0x01)
+2. Usage is RESOLUTION_MULTIPLIER (0x48)
+3. Contain any FEATURE items
+
+The while loop in hid_apply_multiplier will search the top-most
+collection by searching parent_idx == -1. Because all parent_idx
+is 0. The loop will run forever.
+
+There is a Report Descriptor triggerring the deadloop
+0x05, 0x01,        // Usage Page (Generic Desktop Ctrls)
+0x09, 0x48,        // Usage (0x48)
+0x95, 0x01,        // Report Count (1)
+0x75, 0x08,        // Report Size (8)
+0xB1, 0x01,        // Feature
+
+Signed-off-by: Xin Zhao <xnzhao@google.com>
+Link: https://lore.kernel.org/r/20230130212947.1315941-1-xnzhao@google.com
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 2e475bd426b84..f1ea883db5de1 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1197,6 +1197,7 @@ int hid_open_report(struct hid_device *device)
+       __u8 *end;
+       __u8 *next;
+       int ret;
++      int i;
+       static int (*dispatch_type[])(struct hid_parser *parser,
+                                     struct hid_item *item) = {
+               hid_parser_main,
+@@ -1247,6 +1248,8 @@ int hid_open_report(struct hid_device *device)
+               goto err;
+       }
+       device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
++      for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++)
++              device->collection[i].parent_idx = -1;
+       ret = -EINVAL;
+       while ((next = fetch_item(start, end, &item)) != NULL) {
+-- 
+2.39.0
+
diff --git a/queue-5.15/hid-elecom-add-support-for-trackball-056e-011c.patch b/queue-5.15/hid-elecom-add-support-for-trackball-056e-011c.patch
new file mode 100644 (file)
index 0000000..293644d
--- /dev/null
@@ -0,0 +1,106 @@
+From 5cd207ffed4017e19e957618b8b841ff1ee64c9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 03:30:02 +0900
+Subject: HID: elecom: add support for TrackBall 056E:011C
+
+From: Takahiro Fujii <fujii@xaxxi.net>
+
+[ Upstream commit 29f316a1d7e0a570be9a47fa283ece53a67cebb7 ]
+
+Make function buttons on ELECOM M-HT1DRBK trackball mouse work. This model
+has two devices with different device IDs (010D and 011C). Both of
+them misreports the number of buttons as 5 in the report descriptor, even
+though they have 8 buttons. hid-elecom overwrites the report to fix them,
+but supports only on 010D and does not work on 011C. This patch fixes
+011C in the similar way but with specialized position parameters.
+In fact, it is sufficient to rewrite only 17th byte (05 -> 08). However I
+followed the existing way.
+
+Signed-off-by: Takahiro Fujii <fujii@xaxxi.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elecom.c | 16 ++++++++++++++--
+ drivers/hid/hid-ids.h    |  3 ++-
+ drivers/hid/hid-quirks.c |  3 ++-
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index e59e9911fc370..4fa45ee77503b 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -12,6 +12,7 @@
+  *  Copyright (c) 2017 Alex Manoussakis <amanou@gnu.org>
+  *  Copyright (c) 2017 Tomasz Kramkowski <tk@the-tk.com>
+  *  Copyright (c) 2020 YOSHIOKA Takuma <lo48576@hard-wi.red>
++ *  Copyright (c) 2022 Takahiro Fujii <fujii@xaxxi.net>
+  */
+ /*
+@@ -89,7 +90,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+       case USB_DEVICE_ID_ELECOM_M_DT1URBK:
+       case USB_DEVICE_ID_ELECOM_M_DT1DRBK:
+       case USB_DEVICE_ID_ELECOM_M_HT1URBK:
+-      case USB_DEVICE_ID_ELECOM_M_HT1DRBK:
++      case USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D:
+               /*
+                * Report descriptor format:
+                * 12: button bit count
+@@ -99,6 +100,16 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+                */
+               mouse_button_fixup(hdev, rdesc, *rsize, 12, 30, 14, 20, 8);
+               break;
++      case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C:
++              /*
++               * Report descriptor format:
++               * 22: button bit count
++               * 30: padding bit count
++               * 24: button report size
++               * 16: button usage maximum
++               */
++              mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
++              break;
+       }
+       return rdesc;
+ }
+@@ -112,7 +123,8 @@ static const struct hid_device_id elecom_devices[] = {
+       { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+       { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
+       { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+-      { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) },
++      { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
++      { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
+       { }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index fa1aa22547ea7..b153ddc3319e8 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -410,7 +410,8 @@
+ #define USB_DEVICE_ID_ELECOM_M_DT1URBK        0x00fe
+ #define USB_DEVICE_ID_ELECOM_M_DT1DRBK        0x00ff
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK        0x010c
+-#define USB_DEVICE_ID_ELECOM_M_HT1DRBK        0x010d
++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D   0x010d
++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C   0x011c
+ #define USB_VENDOR_ID_DREAM_CHEEKY    0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 184029cad014f..4a8c32148e58f 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -381,7 +381,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+       { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+       { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
+       { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+-      { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) },
++      { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
++      { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+       { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+-- 
+2.39.0
+
diff --git a/queue-5.15/ib-hfi1-assign-npages-earlier.patch b/queue-5.15/ib-hfi1-assign-npages-earlier.patch
new file mode 100644 (file)
index 0000000..abc58d7
--- /dev/null
@@ -0,0 +1,64 @@
+From b8b1cd22a2fd4fad8e93d862ac39abdc63755486 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 14:04:08 -0500
+Subject: IB/hfi1: Assign npages earlier
+
+From: Dean Luick <dean.luick@cornelisnetworks.com>
+
+[ Upstream commit f9c47b2caa7ffc903ec950b454b59c209afe3182 ]
+
+Improve code clarity and enable earlier use of
+tidbuf->npages by moving its assignment to
+structure creation time.
+
+Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/167329104884.1472990.4639750192433251493.stgit@awfm-02.cornelisnetworks.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index ba930112c1624..1d2020c30ef3b 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -160,16 +160,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd,
+ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ {
+       int pinned;
+-      unsigned int npages;
++      unsigned int npages = tidbuf->npages;
+       unsigned long vaddr = tidbuf->vaddr;
+       struct page **pages = NULL;
+       struct hfi1_devdata *dd = fd->uctxt->dd;
+-      /* Get the number of pages the user buffer spans */
+-      npages = num_user_pages(vaddr, tidbuf->length);
+-      if (!npages)
+-              return -EINVAL;
+-
+       if (npages > fd->uctxt->expected_count) {
+               dd_dev_err(dd, "Expected buffer too big\n");
+               return -EINVAL;
+@@ -196,7 +191,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+               return pinned;
+       }
+       tidbuf->pages = pages;
+-      tidbuf->npages = npages;
+       fd->tid_n_pinned += pinned;
+       return pinned;
+ }
+@@ -274,6 +268,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+       mutex_init(&tidbuf->cover_mutex);
+       tidbuf->vaddr = tinfo->vaddr;
+       tidbuf->length = tinfo->length;
++      tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length);
+       tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets),
+                               GFP_KERNEL);
+       if (!tidbuf->psets) {
+-- 
+2.39.0
+
diff --git a/queue-5.15/ionic-refactor-use-of-ionic_rx_fill.patch b/queue-5.15/ionic-refactor-use-of-ionic_rx_fill.patch
new file mode 100644 (file)
index 0000000..b4fba9c
--- /dev/null
@@ -0,0 +1,95 @@
+From e0d74c3f2a5dc03ee4623f83d0dd65e4967e7a1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Oct 2022 07:37:44 -0700
+Subject: ionic: refactor use of ionic_rx_fill()
+
+From: Neel Patel <neel@pensando.io>
+
+[ Upstream commit e55f0f5befc26e2ba6bb8c1f945ea8e37ee0e334 ]
+
+The same pre-work code is used before each call to
+ionic_rx_fill(), so bring it in and make it a part of
+the routine.
+
+Signed-off-by: Neel Patel <neel@pensando.io>
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_txrx.c  | 23 ++++++++++---------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+index 37c39581b6599..376f97b4008bb 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c
+@@ -353,16 +353,25 @@ void ionic_rx_fill(struct ionic_queue *q)
+       struct ionic_rxq_sg_desc *sg_desc;
+       struct ionic_rxq_sg_elem *sg_elem;
+       struct ionic_buf_info *buf_info;
++      unsigned int fill_threshold;
+       struct ionic_rxq_desc *desc;
+       unsigned int remain_len;
+       unsigned int frag_len;
+       unsigned int nfrags;
++      unsigned int n_fill;
+       unsigned int i, j;
+       unsigned int len;
++      n_fill = ionic_q_space_avail(q);
++
++      fill_threshold = min_t(unsigned int, IONIC_RX_FILL_THRESHOLD,
++                             q->num_descs / IONIC_RX_FILL_DIV);
++      if (n_fill < fill_threshold)
++              return;
++
+       len = netdev->mtu + ETH_HLEN + VLAN_HLEN;
+-      for (i = ionic_q_space_avail(q); i; i--) {
++      for (i = n_fill; i; i--) {
+               nfrags = 0;
+               remain_len = len;
+               desc_info = &q->info[q->head_idx];
+@@ -518,7 +527,6 @@ int ionic_rx_napi(struct napi_struct *napi, int budget)
+       struct ionic_cq *cq = napi_to_cq(napi);
+       struct ionic_dev *idev;
+       struct ionic_lif *lif;
+-      u16 rx_fill_threshold;
+       u32 work_done = 0;
+       u32 flags = 0;
+@@ -528,10 +536,7 @@ int ionic_rx_napi(struct napi_struct *napi, int budget)
+       work_done = ionic_cq_service(cq, budget,
+                                    ionic_rx_service, NULL, NULL);
+-      rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD,
+-                                cq->num_descs / IONIC_RX_FILL_DIV);
+-      if (work_done && ionic_q_space_avail(cq->bound_q) >= rx_fill_threshold)
+-              ionic_rx_fill(cq->bound_q);
++      ionic_rx_fill(cq->bound_q);
+       if (work_done < budget && napi_complete_done(napi, work_done)) {
+               ionic_dim_update(qcq, IONIC_LIF_F_RX_DIM_INTR);
+@@ -559,7 +564,6 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget)
+       struct ionic_dev *idev;
+       struct ionic_lif *lif;
+       struct ionic_cq *txcq;
+-      u16 rx_fill_threshold;
+       u32 rx_work_done = 0;
+       u32 tx_work_done = 0;
+       u32 flags = 0;
+@@ -574,10 +578,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget)
+       rx_work_done = ionic_cq_service(rxcq, budget,
+                                       ionic_rx_service, NULL, NULL);
+-      rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD,
+-                                rxcq->num_descs / IONIC_RX_FILL_DIV);
+-      if (rx_work_done && ionic_q_space_avail(rxcq->bound_q) >= rx_fill_threshold)
+-              ionic_rx_fill(rxcq->bound_q);
++      ionic_rx_fill(rxcq->bound_q);
+       if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) {
+               ionic_dim_update(qcq, 0);
+-- 
+2.39.0
+
diff --git a/queue-5.15/neigh-make-sure-used-and-confirmed-times-are-valid.patch b/queue-5.15/neigh-make-sure-used-and-confirmed-times-are-valid.patch
new file mode 100644 (file)
index 0000000..f87dbf4
--- /dev/null
@@ -0,0 +1,96 @@
+From 85b972b5e7457e8115af3c61af3b888b92271fd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:25:51 +0200
+Subject: neigh: make sure used and confirmed times are valid
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit c1d2ecdf5e38e3489ce8328238b558b3b2866fe1 ]
+
+Entries can linger in cache without timer for days, thanks to
+the gc_thresh1 limit. As result, without traffic, the confirmed
+time can be outdated and to appear to be in the future. Later,
+on traffic, NUD_STALE entries can switch to NUD_DELAY and start
+the timer which can see the invalid confirmed time and wrongly
+switch to NUD_REACHABLE state instead of NUD_PROBE. As result,
+timer is set many days in the future. This is more visible on
+32-bit platforms, with higher HZ value.
+
+Why this is a problem? While we expect unused entries to expire,
+such entries stay in REACHABLE state for too long, locked in
+cache. They are not expired normally, only when cache is full.
+
+Problem and the wrong state change reported by Zhang Changzhong:
+
+172.16.1.18 dev bond0 lladdr 0a:0e:0f:01:12:01 ref 1 used 350521/15994171/350520 probes 4 REACHABLE
+
+350520 seconds have elapsed since this entry was last updated, but it is
+still in the REACHABLE state (base_reachable_time_ms is 30000),
+preventing lladdr from being updated through probe.
+
+Fix it by ensuring timer is started with valid used/confirmed
+times. Considering the valid time range is LONG_MAX jiffies,
+we try not to go too much in the past while we are in
+DELAY/PROBE state. There are also places that need
+used/updated times to be validated while timer is not running.
+
+Reported-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Tested-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 0e22ecb469771..95f588b2fd159 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -241,7 +241,7 @@ static int neigh_forced_gc(struct neigh_table *tbl)
+                           (n->nud_state == NUD_NOARP) ||
+                           (tbl->is_multicast &&
+                            tbl->is_multicast(n->primary_key)) ||
+-                          time_after(tref, n->updated))
++                          !time_in_range(n->updated, tref, jiffies))
+                               remove = true;
+                       write_unlock(&n->lock);
+@@ -261,7 +261,17 @@ static int neigh_forced_gc(struct neigh_table *tbl)
+ static void neigh_add_timer(struct neighbour *n, unsigned long when)
+ {
++      /* Use safe distance from the jiffies - LONG_MAX point while timer
++       * is running in DELAY/PROBE state but still show to user space
++       * large times in the past.
++       */
++      unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ);
++
+       neigh_hold(n);
++      if (!time_in_range(n->confirmed, mint, jiffies))
++              n->confirmed = mint;
++      if (time_before(n->used, n->confirmed))
++              n->used = n->confirmed;
+       if (unlikely(mod_timer(&n->timer, when))) {
+               printk("NEIGH: BUG, double timer add, state is %x\n",
+                      n->nud_state);
+@@ -943,12 +953,14 @@ static void neigh_periodic_work(struct work_struct *work)
+                               goto next_elt;
+                       }
+-                      if (time_before(n->used, n->confirmed))
++                      if (time_before(n->used, n->confirmed) &&
++                          time_is_before_eq_jiffies(n->confirmed))
+                               n->used = n->confirmed;
+                       if (refcount_read(&n->refcnt) == 1 &&
+                           (state == NUD_FAILED ||
+-                           time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
++                           !time_in_range_open(jiffies, n->used,
++                                               n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
+                               *np = n->next;
+                               neigh_mark_dead(n);
+                               write_unlock(&n->lock);
+-- 
+2.39.0
+
diff --git a/queue-5.15/series b/queue-5.15/series
new file mode 100644 (file)
index 0000000..f0dcbdb
--- /dev/null
@@ -0,0 +1,12 @@
+ionic-refactor-use-of-ionic_rx_fill.patch
+fix-xfrm-i-support-for-nested-esp-tunnels.patch
+arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch
+arm-dts-rockchip-add-power-domains-property-to-dp-no.patch
+hid-elecom-add-support-for-trackball-056e-011c.patch
+acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch
+btrfs-send-limit-number-of-clones-and-allocated-memo.patch
+asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch
+ib-hfi1-assign-npages-earlier.patch
+neigh-make-sure-used-and-confirmed-times-are-valid.patch
+hid-core-fix-deadloop-in-hid_apply_multiplier.patch
+x86-cpu-add-lunar-lake-m.patch
diff --git a/queue-5.15/x86-cpu-add-lunar-lake-m.patch b/queue-5.15/x86-cpu-add-lunar-lake-m.patch
new file mode 100644 (file)
index 0000000..e9b1f3f
--- /dev/null
@@ -0,0 +1,42 @@
+From cc16c715ae769e4ff7f2691bd6ef023f1b5952ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 09:23:40 -0800
+Subject: x86/cpu: Add Lunar Lake M
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit f545e8831e70065e127f903fc7aca09aa50422c7 ]
+
+Intel confirmed the existence of this CPU in Q4'2022
+earnings presentation.
+
+Add the CPU model number.
+
+[ dhansen: Merging these as soon as possible makes it easier
+          on all the folks developing model-specific features. ]
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lore.kernel.org/all/20230208172340.158548-1-tony.luck%40intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/intel-family.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 13922963431a0..b8e7ea9e71e20 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -113,6 +113,8 @@
+ #define INTEL_FAM6_ALDERLAKE          0x97    /* Golden Cove / Gracemont */
+ #define INTEL_FAM6_ALDERLAKE_L                0x9A    /* Golden Cove / Gracemont */
++#define INTEL_FAM6_LUNARLAKE_M                0xBD
++
+ /* "Small Core" Processors (Atom/E-Core) */
+ #define INTEL_FAM6_ATOM_BONNELL               0x1C /* Diamondville, Pineview */
+-- 
+2.39.0
+