]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.15-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 5 Jun 2023 19:55:09 +0000 (21:55 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 5 Jun 2023 19:55:09 +0000 (21:55 +0200)
added patches:
block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch
btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch
iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch
mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch
mmc-vub300-fix-invalid-response-handling.patch
powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch
tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch

queue-5.15/block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch [new file with mode: 0644]
queue-5.15/btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch [new file with mode: 0644]
queue-5.15/iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch [new file with mode: 0644]
queue-5.15/mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch [new file with mode: 0644]
queue-5.15/mmc-vub300-fix-invalid-response-handling.patch [new file with mode: 0644]
queue-5.15/powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch [new file with mode: 0644]
queue-5.15/series
queue-5.15/tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch [new file with mode: 0644]

diff --git a/queue-5.15/block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch b/queue-5.15/block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch
new file mode 100644 (file)
index 0000000..8bdfae4
--- /dev/null
@@ -0,0 +1,55 @@
+From ff1cc97b1f4c10db224f276d9615b22835b8c424 Mon Sep 17 00:00:00 2001
+From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
+Date: Tue, 13 Dec 2022 13:08:26 +0100
+Subject: block/blk-iocost (gcc13): keep large values in a new enum
+
+From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+
+commit ff1cc97b1f4c10db224f276d9615b22835b8c424 upstream.
+
+Since gcc13, each member of an enum has the same type as the enum [1]. And
+that is inherited from its members. Provided:
+  VTIME_PER_SEC_SHIFT     = 37,
+  VTIME_PER_SEC           = 1LLU << VTIME_PER_SEC_SHIFT,
+  ...
+  AUTOP_CYCLE_NSEC        = 10LLU * NSEC_PER_SEC,
+the named type is unsigned long.
+
+This generates warnings with gcc-13:
+  block/blk-iocost.c: In function 'ioc_weight_prfill':
+  block/blk-iocost.c:3037:37: error: format '%u' expects argument of type 'unsigned int', but argument 4 has type 'long unsigned int'
+
+  block/blk-iocost.c: In function 'ioc_weight_show':
+  block/blk-iocost.c:3047:34: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'long unsigned int'
+
+So split the anonymous enum with large values to a separate enum, so
+that they don't affect other members.
+
+[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113
+
+Cc: Martin Liska <mliska@suse.cz>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Josef Bacik <josef@toxicpanda.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: cgroups@vger.kernel.org
+Cc: linux-block@vger.kernel.org
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20221213120826.17446-1-jirislaby@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-iocost.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/block/blk-iocost.c
++++ b/block/blk-iocost.c
+@@ -232,7 +232,9 @@ enum {
+       /* 1/64k is granular enough and can easily be handled w/ u32 */
+       WEIGHT_ONE              = 1 << 16,
++};
++enum {
+       /*
+        * As vtime is used to calculate the cost of each IO, it needs to
+        * be fairly high precision.  For example, it should be able to
diff --git a/queue-5.15/btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch b/queue-5.15/btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch
new file mode 100644 (file)
index 0000000..c72ef40
--- /dev/null
@@ -0,0 +1,60 @@
+From 5ad9b4719fc9bc4715c7e19875a962095b0577e7 Mon Sep 17 00:00:00 2001
+From: pengfuyuan <pengfuyuan@kylinos.cn>
+Date: Tue, 23 May 2023 15:09:55 +0800
+Subject: btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: pengfuyuan <pengfuyuan@kylinos.cn>
+
+commit 5ad9b4719fc9bc4715c7e19875a962095b0577e7 upstream.
+
+When compiling on a MIPS 64-bit machine we get these warnings:
+
+    In file included from ./arch/mips/include/asm/cacheflush.h:13,
+                    from ./include/linux/cacheflush.h:5,
+                    from ./include/linux/highmem.h:8,
+                    from ./include/linux/bvec.h:10,
+                    from ./include/linux/blk_types.h:10,
+                     from ./include/linux/blkdev.h:9,
+                    from fs/btrfs/disk-io.c:7:
+    fs/btrfs/disk-io.c: In function ‘csum_tree_block’:
+    fs/btrfs/disk-io.c:100:34: error: array subscript 1 is above array bounds of ‘struct page *[1]’ [-Werror=array-bounds]
+      100 |   kaddr = page_address(buf->pages[i]);
+          |                        ~~~~~~~~~~^~~
+    ./include/linux/mm.h:2135:48: note: in definition of macro ‘page_address’
+     2135 | #define page_address(page) lowmem_page_address(page)
+          |                                                ^~~~
+    cc1: all warnings being treated as errors
+
+We can check if i overflows to solve the problem. However, this doesn't make
+much sense, since i == 1 and num_pages == 1 doesn't execute the body of the loop.
+In addition, i < num_pages can also ensure that buf->pages[i] will not cross
+the boundary. Unfortunately, this doesn't help with the problem observed here:
+gcc still complains.
+
+To fix this add a compile-time condition for the extent buffer page
+array size limit, which would eventually lead to eliminating the whole
+for loop.
+
+CC: stable@vger.kernel.org # 5.10+
+Signed-off-by: pengfuyuan <pengfuyuan@kylinos.cn>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/disk-io.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -139,7 +139,7 @@ static void csum_tree_block(struct exten
+       crypto_shash_update(shash, kaddr + BTRFS_CSUM_SIZE,
+                           first_page_part - BTRFS_CSUM_SIZE);
+-      for (i = 1; i < num_pages; i++) {
++      for (i = 1; i < num_pages && INLINE_EXTENT_BUFFER_PAGES > 1; i++) {
+               kaddr = page_address(buf->pages[i]);
+               crypto_shash_update(shash, kaddr, PAGE_SIZE);
+       }
diff --git a/queue-5.15/iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch b/queue-5.15/iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch
new file mode 100644 (file)
index 0000000..c56cb92
--- /dev/null
@@ -0,0 +1,44 @@
+From 2212fc2acf3f6ee690ea36506fb882a19d1bfcab Mon Sep 17 00:00:00 2001
+From: Jon Pan-Doh <pandoh@google.com>
+Date: Wed, 26 Apr 2023 13:32:56 -0700
+Subject: iommu/amd: Fix domain flush size when syncing iotlb
+
+From: Jon Pan-Doh <pandoh@google.com>
+
+commit 2212fc2acf3f6ee690ea36506fb882a19d1bfcab upstream.
+
+When running on an AMD vIOMMU, we observed multiple invalidations (of
+decreasing power of 2 aligned sizes) when unmapping a single page.
+
+Domain flush takes gather bounds (end-start) as size param. However,
+gather->end is defined as the last inclusive address (start + size - 1).
+This leads to an off by 1 error.
+
+With this patch, verified that 1 invalidation occurs when unmapping a
+single page.
+
+Fixes: a270be1b3fdf ("iommu/amd: Use only natural aligned flushes in a VM")
+Cc: stable@vger.kernel.org # >= 5.15
+Signed-off-by: Jon Pan-Doh <pandoh@google.com>
+Tested-by: Sudheer Dantuluri <dantuluris@google.com>
+Suggested-by: Gary Zibrat <gzibrat@google.com>
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Acked-by: Nadav Amit <namit@vmware.com>
+Link: https://lore.kernel.org/r/20230426203256.237116-1-pandoh@google.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/amd/iommu.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -2222,7 +2222,7 @@ static void amd_iommu_iotlb_sync(struct
+       unsigned long flags;
+       spin_lock_irqsave(&dom->lock, flags);
+-      domain_flush_pages(dom, gather->start, gather->end - gather->start, 1);
++      domain_flush_pages(dom, gather->start, gather->end - gather->start + 1, 1);
+       amd_iommu_domain_flush_complete(dom);
+       spin_unlock_irqrestore(&dom->lock, flags);
+ }
diff --git a/queue-5.15/mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch b/queue-5.15/mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch
new file mode 100644 (file)
index 0000000..84392d2
--- /dev/null
@@ -0,0 +1,113 @@
+From 0b5d5c436a5c572a45f976cfd34a6741e143e5d9 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Sat, 13 May 2023 21:23:52 +0200
+Subject: mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order
+
+From: Marek Vasut <marex@denx.de>
+
+commit 0b5d5c436a5c572a45f976cfd34a6741e143e5d9 upstream.
+
+Chapter "5.3 Power-Up/Down Sequence" of WILC1000 [1] and WILC3000 [2]
+states that CHIP_EN must be pulled HIGH first, RESETN second. Fix the
+order of these signals in the driver.
+
+Use the mmc_pwrseq_ops as driver data as the delay between signals is
+specific to SDIO card type anyway.
+
+[1] https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/DataSheets/ATWILC1000-MR110XB-IEEE-802.11-b-g-n-Link-Controller-Module-DS70005326E.pdf
+[2] https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/IEEE-802.11-b-g-n-Link-Controller-Module-with-Integrated-Bluetooth-5.0-DS70005327B.pdf
+
+Fixes: b2832b96fcf5 ("mmc: pwrseq: sd8787: add support for wilc1000")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230513192352.479627-1-marex@denx.de
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/pwrseq_sd8787.c | 34 ++++++++++++++++++++++++--------
+ 1 file changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mmc/core/pwrseq_sd8787.c b/drivers/mmc/core/pwrseq_sd8787.c
+index 2e120ad83020..0c5f5e371e1f 100644
+--- a/drivers/mmc/core/pwrseq_sd8787.c
++++ b/drivers/mmc/core/pwrseq_sd8787.c
+@@ -28,7 +28,6 @@ struct mmc_pwrseq_sd8787 {
+       struct mmc_pwrseq pwrseq;
+       struct gpio_desc *reset_gpio;
+       struct gpio_desc *pwrdn_gpio;
+-      u32 reset_pwrdwn_delay_ms;
+ };
+ #define to_pwrseq_sd8787(p) container_of(p, struct mmc_pwrseq_sd8787, pwrseq)
+@@ -39,7 +38,7 @@ static void mmc_pwrseq_sd8787_pre_power_on(struct mmc_host *host)
+       gpiod_set_value_cansleep(pwrseq->reset_gpio, 1);
+-      msleep(pwrseq->reset_pwrdwn_delay_ms);
++      msleep(300);
+       gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 1);
+ }
+@@ -51,17 +50,37 @@ static void mmc_pwrseq_sd8787_power_off(struct mmc_host *host)
+       gpiod_set_value_cansleep(pwrseq->reset_gpio, 0);
+ }
++static void mmc_pwrseq_wilc1000_pre_power_on(struct mmc_host *host)
++{
++      struct mmc_pwrseq_sd8787 *pwrseq = to_pwrseq_sd8787(host->pwrseq);
++
++      /* The pwrdn_gpio is really CHIP_EN, reset_gpio is RESETN */
++      gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 1);
++      msleep(5);
++      gpiod_set_value_cansleep(pwrseq->reset_gpio, 1);
++}
++
++static void mmc_pwrseq_wilc1000_power_off(struct mmc_host *host)
++{
++      struct mmc_pwrseq_sd8787 *pwrseq = to_pwrseq_sd8787(host->pwrseq);
++
++      gpiod_set_value_cansleep(pwrseq->reset_gpio, 0);
++      gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 0);
++}
++
+ static const struct mmc_pwrseq_ops mmc_pwrseq_sd8787_ops = {
+       .pre_power_on = mmc_pwrseq_sd8787_pre_power_on,
+       .power_off = mmc_pwrseq_sd8787_power_off,
+ };
+-static const u32 sd8787_delay_ms = 300;
+-static const u32 wilc1000_delay_ms = 5;
++static const struct mmc_pwrseq_ops mmc_pwrseq_wilc1000_ops = {
++      .pre_power_on = mmc_pwrseq_wilc1000_pre_power_on,
++      .power_off = mmc_pwrseq_wilc1000_power_off,
++};
+ static const struct of_device_id mmc_pwrseq_sd8787_of_match[] = {
+-      { .compatible = "mmc-pwrseq-sd8787", .data = &sd8787_delay_ms },
+-      { .compatible = "mmc-pwrseq-wilc1000", .data = &wilc1000_delay_ms },
++      { .compatible = "mmc-pwrseq-sd8787", .data = &mmc_pwrseq_sd8787_ops },
++      { .compatible = "mmc-pwrseq-wilc1000", .data = &mmc_pwrseq_wilc1000_ops },
+       {/* sentinel */},
+ };
+ MODULE_DEVICE_TABLE(of, mmc_pwrseq_sd8787_of_match);
+@@ -77,7 +96,6 @@ static int mmc_pwrseq_sd8787_probe(struct platform_device *pdev)
+               return -ENOMEM;
+       match = of_match_node(mmc_pwrseq_sd8787_of_match, pdev->dev.of_node);
+-      pwrseq->reset_pwrdwn_delay_ms = *(u32 *)match->data;
+       pwrseq->pwrdn_gpio = devm_gpiod_get(dev, "powerdown", GPIOD_OUT_LOW);
+       if (IS_ERR(pwrseq->pwrdn_gpio))
+@@ -88,7 +106,7 @@ static int mmc_pwrseq_sd8787_probe(struct platform_device *pdev)
+               return PTR_ERR(pwrseq->reset_gpio);
+       pwrseq->pwrseq.dev = dev;
+-      pwrseq->pwrseq.ops = &mmc_pwrseq_sd8787_ops;
++      pwrseq->pwrseq.ops = match->data;
+       pwrseq->pwrseq.owner = THIS_MODULE;
+       platform_set_drvdata(pdev, pwrseq);
+-- 
+2.41.0
+
diff --git a/queue-5.15/mmc-vub300-fix-invalid-response-handling.patch b/queue-5.15/mmc-vub300-fix-invalid-response-handling.patch
new file mode 100644 (file)
index 0000000..9687d05
--- /dev/null
@@ -0,0 +1,64 @@
+From a99d21cefd351c8aaa20b83a3c942340e5789d45 Mon Sep 17 00:00:00 2001
+From: Deren Wu <deren.wu@mediatek.com>
+Date: Sat, 13 May 2023 22:48:15 +0800
+Subject: mmc: vub300: fix invalid response handling
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+commit a99d21cefd351c8aaa20b83a3c942340e5789d45 upstream.
+
+We may get an empty response with zero length at the beginning of
+the driver start and get following UBSAN error. Since there is no
+content(SDRT_NONE) for the response, just return and skip the response
+handling to avoid this problem.
+
+Test pass : SDIO wifi throughput test with this patch
+
+[  126.980684] UBSAN: array-index-out-of-bounds in drivers/mmc/host/vub300.c:1719:12
+[  126.980709] index -1 is out of range for type 'u32 [4]'
+[  126.980729] CPU: 4 PID: 9 Comm: kworker/u16:0 Tainted: G            E      6.3.0-rc4-mtk-local-202304272142 #1
+[  126.980754] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020
+[  126.980770] Workqueue: kvub300c vub300_cmndwork_thread [vub300]
+[  126.980833] Call Trace:
+[  126.980845]  <TASK>
+[  126.980860]  dump_stack_lvl+0x48/0x70
+[  126.980895]  dump_stack+0x10/0x20
+[  126.980916]  ubsan_epilogue+0x9/0x40
+[  126.980944]  __ubsan_handle_out_of_bounds+0x70/0x90
+[  126.980979]  vub300_cmndwork_thread+0x58e7/0x5e10 [vub300]
+[  126.981018]  ? _raw_spin_unlock+0x18/0x40
+[  126.981042]  ? finish_task_switch+0x175/0x6f0
+[  126.981070]  ? __switch_to+0x42e/0xda0
+[  126.981089]  ? __switch_to_asm+0x3a/0x80
+[  126.981129]  ? __pfx_vub300_cmndwork_thread+0x10/0x10 [vub300]
+[  126.981174]  ? __kasan_check_read+0x11/0x20
+[  126.981204]  process_one_work+0x7ee/0x13d0
+[  126.981246]  worker_thread+0x53c/0x1240
+[  126.981291]  kthread+0x2b8/0x370
+[  126.981312]  ? __pfx_worker_thread+0x10/0x10
+[  126.981336]  ? __pfx_kthread+0x10/0x10
+[  126.981359]  ret_from_fork+0x29/0x50
+[  126.981400]  </TASK>
+
+Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/048cd6972c50c33c2e8f81d5228fed928519918b.1683987673.git.deren.wu@mediatek.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/vub300.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mmc/host/vub300.c
++++ b/drivers/mmc/host/vub300.c
+@@ -1715,6 +1715,9 @@ static void construct_request_response(s
+       int bytes = 3 & less_cmd;
+       int words = less_cmd >> 2;
+       u8 *r = vub300->resp.response.command_response;
++
++      if (!resp_len)
++              return;
+       if (bytes == 3) {
+               cmd->resp[words] = (r[1 + (words << 2)] << 24)
+                       | (r[2 + (words << 2)] << 16)
diff --git a/queue-5.15/powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch b/queue-5.15/powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch
new file mode 100644 (file)
index 0000000..26d8048
--- /dev/null
@@ -0,0 +1,59 @@
+From 9d2ccf00bddc268045e3d65a8108d61ada0e4b4e Mon Sep 17 00:00:00 2001
+From: Gaurav Batra <gbatra@linux.vnet.ibm.com>
+Date: Thu, 25 May 2023 09:34:54 -0500
+Subject: powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gaurav Batra <gbatra@linux.vnet.ibm.com>
+
+commit 9d2ccf00bddc268045e3d65a8108d61ada0e4b4e upstream.
+
+Currently in tce_freemulti_pSeriesLP() there is no limit on how many
+TCEs are passed to the H_STUFF_TCE hcall. This has not caused an issue
+until now, but newer firmware releases have started enforcing a limit of
+512 TCEs per call.
+
+The limit is correct per the specification (PAPR v2.12 § 14.5.4.2.3).
+
+The code has been in it's current form since it was initially merged.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gaurav Batra <gbatra@linux.vnet.ibm.com>
+Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
+[mpe: Tweak change log wording & add PAPR reference]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230525143454.56878-1-gbatra@linux.vnet.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/pseries/iommu.c |   13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/platforms/pseries/iommu.c
++++ b/arch/powerpc/platforms/pseries/iommu.c
+@@ -311,13 +311,22 @@ static void tce_free_pSeriesLP(unsigned
+ static void tce_freemulti_pSeriesLP(struct iommu_table *tbl, long tcenum, long npages)
+ {
+       u64 rc;
++      long rpages = npages;
++      unsigned long limit;
+       if (!firmware_has_feature(FW_FEATURE_STUFF_TCE))
+               return tce_free_pSeriesLP(tbl->it_index, tcenum,
+                                         tbl->it_page_shift, npages);
+-      rc = plpar_tce_stuff((u64)tbl->it_index,
+-                           (u64)tcenum << tbl->it_page_shift, 0, npages);
++      do {
++              limit = min_t(unsigned long, rpages, 512);
++
++              rc = plpar_tce_stuff((u64)tbl->it_index,
++                                   (u64)tcenum << tbl->it_page_shift, 0, limit);
++
++              rpages -= limit;
++              tcenum += limit;
++      } while (rpages > 0 && !rc);
+       if (rc && printk_ratelimit()) {
+               printk("tce_freemulti_pSeriesLP: plpar_tce_stuff failed\n");
index 5c9994a6f09c9f9bb1b006b5c7ce704734b57209..03f25e833ef62c9a8e9c60b05340b0797f1b20e4 100644 (file)
@@ -120,3 +120,10 @@ drm-amd-pm-reverse-mclk-and-fclk-clocks-levels-for-yellow-carp.patch
 drm-amd-pm-reverse-mclk-and-fclk-clocks-levels-for-renoir.patch
 x86-boot-wrap-literal-addresses-in-absolute_pointer.patch
 ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch
+block-blk-iocost-gcc13-keep-large-values-in-a-new-enum.patch
+mmc-vub300-fix-invalid-response-handling.patch
+mmc-pwrseq-sd8787-fix-wilc-chip_en-and-resetn-toggling-order.patch
+tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch
+btrfs-fix-csum_tree_block-page-iteration-to-avoid-tripping-on-werror-array-bounds.patch
+powerpc-iommu-limit-number-of-tces-to-512-for-h_stuff_tce-hcall.patch
+iommu-amd-fix-domain-flush-size-when-syncing-iotlb.patch
diff --git a/queue-5.15/tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch b/queue-5.15/tty-serial-fsl_lpuart-use-uartctrl_txinv-to-send-break-instead-of-uartctrl_sbk.patch
new file mode 100644 (file)
index 0000000..8d5e10b
--- /dev/null
@@ -0,0 +1,102 @@
+From 2474e05467c00f7d51af3039b664de6886325257 Mon Sep 17 00:00:00 2001
+From: Sherry Sun <sherry.sun@nxp.com>
+Date: Fri, 19 May 2023 17:47:51 +0800
+Subject: tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+commit 2474e05467c00f7d51af3039b664de6886325257 upstream.
+
+LPUART IP now has two known bugs, one is that CTS has higher priority
+than the break signal, which causes the break signal sending through
+UARTCTRL_SBK may impacted by the CTS input if the HW flow control is
+enabled. It exists on all platforms we support in this driver.
+So we add a workaround patch for this issue: commit c4c81db5cf8b
+("tty: serial: fsl_lpuart: disable the CTS when send break signal").
+
+Another IP bug is i.MX8QM LPUART may have an additional break character
+being sent after SBK was cleared. It may need to add some delay between
+clearing SBK and re-enabling CTS to ensure that the SBK latch are
+completely cleared.
+
+But we found that during the delay period before CTS is enabled, there
+is still a risk that Bluetooth data in TX FIFO may be sent out during
+this period because of break off and CTS disabled(even if BT sets CTS
+line deasserted, data is still sent to BT).
+
+Due to this risk, we have to drop the CTS-disabling workaround for SBK
+bugs, use TXINV seems to be a better way to replace SBK feature and
+avoid above risk. Also need to disable the transmitter to prevent any
+data from being sent out during break, then invert the TX line to send
+break. Then disable the TXINV when turn off break and re-enable
+transmitter.
+
+Fixes: c4c81db5cf8b ("tty: serial: fsl_lpuart: disable the CTS when send break signal")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Link: https://lore.kernel.org/r/20230519094751.28948-1-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/fsl_lpuart.c |   44 ++++++++++++++++++++--------------------
+ 1 file changed, 23 insertions(+), 21 deletions(-)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1491,34 +1491,36 @@ static void lpuart_break_ctl(struct uart
+ static void lpuart32_break_ctl(struct uart_port *port, int break_state)
+ {
+-      unsigned long temp, modem;
+-      struct tty_struct *tty;
+-      unsigned int cflag = 0;
++      unsigned long temp;
+-      tty = tty_port_tty_get(&port->state->port);
+-      if (tty) {
+-              cflag = tty->termios.c_cflag;
+-              tty_kref_put(tty);
+-      }
+-
+-      temp = lpuart32_read(port, UARTCTRL) & ~UARTCTRL_SBK;
+-      modem = lpuart32_read(port, UARTMODIR);
++      temp = lpuart32_read(port, UARTCTRL);
++      /*
++       * LPUART IP now has two known bugs, one is CTS has higher priority than the
++       * break signal, which causes the break signal sending through UARTCTRL_SBK
++       * may impacted by the CTS input if the HW flow control is enabled. It
++       * exists on all platforms we support in this driver.
++       * Another bug is i.MX8QM LPUART may have an additional break character
++       * being sent after SBK was cleared.
++       * To avoid above two bugs, we use Transmit Data Inversion function to send
++       * the break signal instead of UARTCTRL_SBK.
++       */
+       if (break_state != 0) {
+-              temp |= UARTCTRL_SBK;
+               /*
+-               * LPUART CTS has higher priority than SBK, need to disable CTS before
+-               * asserting SBK to avoid any interference if flow control is enabled.
++               * Disable the transmitter to prevent any data from being sent out
++               * during break, then invert the TX line to send break.
+                */
+-              if (cflag & CRTSCTS && modem & UARTMODIR_TXCTSE)
+-                      lpuart32_write(port, modem & ~UARTMODIR_TXCTSE, UARTMODIR);
++              temp &= ~UARTCTRL_TE;
++              lpuart32_write(port, temp, UARTCTRL);
++              temp |= UARTCTRL_TXINV;
++              lpuart32_write(port, temp, UARTCTRL);
+       } else {
+-              /* Re-enable the CTS when break off. */
+-              if (cflag & CRTSCTS && !(modem & UARTMODIR_TXCTSE))
+-                      lpuart32_write(port, modem | UARTMODIR_TXCTSE, UARTMODIR);
++              /* Disable the TXINV to turn off break and re-enable transmitter. */
++              temp &= ~UARTCTRL_TXINV;
++              lpuart32_write(port, temp, UARTCTRL);
++              temp |= UARTCTRL_TE;
++              lpuart32_write(port, temp, UARTCTRL);
+       }
+-
+-      lpuart32_write(port, temp, UARTCTRL);
+ }
+ static void lpuart_setup_watermark(struct lpuart_port *sport)