From: Greg Kroah-Hartman Date: Sun, 22 Jan 2023 13:40:09 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v4.14.304~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=06cc6219f9a26becdd6bced693ec0910e8651f7e;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: arm-dts-qcom-apq8084-ifc6540-fix-overriding-sdhci.patch arm-omap1-fix-arch_omap1_any-link-failures.patch arm64-dts-imx8mp-correct-usb-clocks.patch dmaengine-idxd-do-not-call-dmx-tx-callbacks-during-workqueue-disable.patch dmaengine-idxd-let-probe-fail-when-workqueue-cannot-be-enabled.patch dmaengine-idxd-prevent-use-after-free-on-completion-memory.patch dmaengine-lgm-move-dt-parsing-after-initialization.patch dmaengine-tegra210-adma-fix-global-intr-clear.patch drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch drm-amd-display-disable-s-g-display-on-dcn-3.1.4.patch drm-amd-display-disable-s-g-display-on-dcn-3.1.5.patch drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch drm-amd-display-fix-set-scaling-doesn-s-work.patch drm-amdgpu-allow-multipipe-policy-on-asics-with-one-mec.patch drm-amdgpu-correct-the-power-calcultion-for-renior-cezanne.patch drm-amdgpu-fix-amdgpu_job_free_resources-v2.patch drm-i915-allow-switching-away-via-vga-switcheroo-if-uninitialized.patch drm-i915-display-check-source-height-is-0.patch drm-i915-re-disable-rc6p-on-sandy-bridge.patch dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch gsmi-fix-null-deref-in-gsmi_get_variable.patch io_uring-poll-don-t-reissue-in-case-of-poll-race-on-multishot-request.patch mei-bus-fix-unlink-on-bus-in-error-path.patch mei-me-add-meteor-lake-point-m-did.patch mptcp-explicitly-specify-sock-family-at-subflow-creation-time.patch mptcp-netlink-respect-v4-v6-only-sockets.patch pktcdvd-check-for-null-returna-fter-calling-bio_split_to_limits.patch selftests-mptcp-userspace-validate-v4-v6-subflows-mix.patch serial-amba-pl011-fix-high-priority-character-transmission-in-rs486-mode.patch serial-atmel-fix-incorrect-baudrate-setup.patch serial-exar-add-support-for-sealevel-7xxxc-serial-cards.patch serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch usb-cdns3-remove-fetched-trb-from-cache-before-dequeuing.patch usb-gadget-add-id-numbers-to-configfs-gadget-driver-names.patch usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch usb-host-ehci-fsl-fix-module-alias.patch usb-musb-fix-error-return-code-in-omap2430_probe.patch usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch usb-typec-altmodes-displayport-add-pin-assignment-helper.patch usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch usb-typec-tcpm-fix-altmode-re-registration-causes-sysfs-create-fail.patch vmci-use-threaded-irqs-instead-of-tasklets.patch --- diff --git a/queue-6.1/arm-dts-qcom-apq8084-ifc6540-fix-overriding-sdhci.patch b/queue-6.1/arm-dts-qcom-apq8084-ifc6540-fix-overriding-sdhci.patch new file mode 100644 index 00000000000..7a22d5a37fe --- /dev/null +++ b/queue-6.1/arm-dts-qcom-apq8084-ifc6540-fix-overriding-sdhci.patch @@ -0,0 +1,73 @@ +From 0154252a3b87f77db1e44516d1ed2e82e2d29c30 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Sun, 4 Dec 2022 09:46:14 +0100 +Subject: ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI + +From: Krzysztof Kozlowski + +commit 0154252a3b87f77db1e44516d1ed2e82e2d29c30 upstream. + +While changing node names of APQ8084 SDHCI, the ones in IFC6540 board +were not updated leading to disabled and misconfigured SDHCI. + +Cc: +Fixes: 2477d81901a2 ("ARM: dts: qcom: Fix sdhci node names - use 'mmc@'") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221204084614.12193-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/qcom-apq8084-ifc6540.dts | 20 ++++++++++---------- + arch/arm/boot/dts/qcom-apq8084.dtsi | 4 ++-- + 2 files changed, 12 insertions(+), 12 deletions(-) + +--- a/arch/arm/boot/dts/qcom-apq8084-ifc6540.dts ++++ b/arch/arm/boot/dts/qcom-apq8084-ifc6540.dts +@@ -19,16 +19,16 @@ + serial@f995e000 { + status = "okay"; + }; ++ }; ++}; + +- sdhci@f9824900 { +- bus-width = <8>; +- non-removable; +- status = "okay"; +- }; ++&sdhc_1 { ++ bus-width = <8>; ++ non-removable; ++ status = "okay"; ++}; + +- sdhci@f98a4900 { +- cd-gpios = <&tlmm 122 GPIO_ACTIVE_LOW>; +- bus-width = <4>; +- }; +- }; ++&sdhc_2 { ++ cd-gpios = <&tlmm 122 GPIO_ACTIVE_LOW>; ++ bus-width = <4>; + }; +--- a/arch/arm/boot/dts/qcom-apq8084.dtsi ++++ b/arch/arm/boot/dts/qcom-apq8084.dtsi +@@ -419,7 +419,7 @@ + status = "disabled"; + }; + +- mmc@f9824900 { ++ sdhc_1: mmc@f9824900 { + compatible = "qcom,apq8084-sdhci", "qcom,sdhci-msm-v4"; + reg = <0xf9824900 0x11c>, <0xf9824000 0x800>; + reg-names = "hc", "core"; +@@ -432,7 +432,7 @@ + status = "disabled"; + }; + +- mmc@f98a4900 { ++ sdhc_2: mmc@f98a4900 { + compatible = "qcom,apq8084-sdhci", "qcom,sdhci-msm-v4"; + reg = <0xf98a4900 0x11c>, <0xf98a4000 0x800>; + reg-names = "hc", "core"; diff --git a/queue-6.1/arm-omap1-fix-arch_omap1_any-link-failures.patch b/queue-6.1/arm-omap1-fix-arch_omap1_any-link-failures.patch new file mode 100644 index 00000000000..8f888f5b46d --- /dev/null +++ b/queue-6.1/arm-omap1-fix-arch_omap1_any-link-failures.patch @@ -0,0 +1,261 @@ +From 980a637d11fe8dfc734f508a422185c2de55e669 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 4 Jan 2023 09:35:09 +0100 +Subject: ARM: omap1: fix !ARCH_OMAP1_ANY link failures + +From: Arnd Bergmann + +commit 980a637d11fe8dfc734f508a422185c2de55e669 upstream. + +While compile-testing randconfig builds for the upcoming boardfile +removal, I noticed that an earlier patch of mine was completely +broken, and the introduction of CONFIG_ARCH_OMAP1_ANY only replaced +one set of build failures with another one, now resulting in +link failures like + +ld: drivers/video/fbdev/omap/omapfb_main.o: in function `omapfb_do_probe': +drivers/video/fbdev/omap/omapfb_main.c:1703: undefined reference to `omap_set_dma_priority' +ld: drivers/dma/ti/omap-dma.o: in function `omap_dma_free_chan_resources': +drivers/dma/ti/omap-dma.c:777: undefined reference to `omap_free_dma' +drivers/dma/ti/omap-dma.c:1685: undefined reference to `omap_get_plat_info' +ld: drivers/usb/gadget/udc/omap_udc.o: in function `next_in_dma': +drivers/usb/gadget/udc/omap_udc.c:820: undefined reference to `omap_get_dma_active_status' + +I tried reworking it, but the resulting patch ended up much bigger than +simply avoiding the original problem of unused-function warnings like + +arch/arm/mach-omap1/mcbsp.c:76:30: error: unused variable 'omap1_mcbsp_ops' [-Werror,-Wunused-variable] + +As a result, revert the previous fix, and rearrange the code that +produces warnings to hide them. For mcbsp, the #ifdef check can +simply be removed as the cpu_is_omapxxx() checks already achieve +the same result, while in the io.c the easiest solution appears to +be to merge the common map bits into each soc specific portion. +This gets cleaned in a nicer way after omap7xx support gets dropped, +as the remaining SoCs all have the exact same I/O map. + +Fixes: 615dce5bf736 ("ARM: omap1: fix build with no SoC selected") +Cc: stable@vger.kernel.org +Acked-by: Aaro Koskinen +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap1/Kconfig | 5 +---- + arch/arm/mach-omap1/Makefile | 4 ---- + arch/arm/mach-omap1/io.c | 32 +++++++++++++++----------------- + arch/arm/mach-omap1/mcbsp.c | 21 --------------------- + arch/arm/mach-omap1/pm.h | 7 ------- + include/linux/soc/ti/omap1-io.h | 4 ++-- + 6 files changed, 18 insertions(+), 55 deletions(-) + +--- a/arch/arm/mach-omap1/Kconfig ++++ b/arch/arm/mach-omap1/Kconfig +@@ -4,6 +4,7 @@ menuconfig ARCH_OMAP1 + depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 + depends on CPU_LITTLE_ENDIAN + depends on ATAGS ++ select ARCH_OMAP + select ARCH_HAS_HOLES_MEMORYMODEL + select ARCH_OMAP + select CLKSRC_MMIO +@@ -45,10 +46,6 @@ config ARCH_OMAP16XX + select CPU_ARM926T + select OMAP_DM_TIMER + +-config ARCH_OMAP1_ANY +- select ARCH_OMAP +- def_bool ARCH_OMAP730 || ARCH_OMAP850 || ARCH_OMAP15XX || ARCH_OMAP16XX +- + config ARCH_OMAP + bool + +--- a/arch/arm/mach-omap1/Makefile ++++ b/arch/arm/mach-omap1/Makefile +@@ -3,8 +3,6 @@ + # Makefile for the linux kernel. + # + +-ifdef CONFIG_ARCH_OMAP1_ANY +- + # Common support + obj-y := io.o id.o sram-init.o sram.o time.o irq.o mux.o flash.o \ + serial.o devices.o dma.o omap-dma.o fb.o +@@ -59,5 +57,3 @@ obj-$(CONFIG_ARCH_OMAP730) += gpio7xx.o + obj-$(CONFIG_ARCH_OMAP850) += gpio7xx.o + obj-$(CONFIG_ARCH_OMAP15XX) += gpio15xx.o + obj-$(CONFIG_ARCH_OMAP16XX) += gpio16xx.o +- +-endif +--- a/arch/arm/mach-omap1/io.c ++++ b/arch/arm/mach-omap1/io.c +@@ -22,17 +22,14 @@ + * The machine specific code may provide the extra mapping besides the + * default mapping provided here. + */ +-static struct map_desc omap_io_desc[] __initdata = { ++#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850) ++static struct map_desc omap7xx_io_desc[] __initdata = { + { + .virtual = OMAP1_IO_VIRT, + .pfn = __phys_to_pfn(OMAP1_IO_PHYS), + .length = OMAP1_IO_SIZE, + .type = MT_DEVICE +- } +-}; +- +-#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850) +-static struct map_desc omap7xx_io_desc[] __initdata = { ++ }, + { + .virtual = OMAP7XX_DSP_BASE, + .pfn = __phys_to_pfn(OMAP7XX_DSP_START), +@@ -50,6 +47,12 @@ static struct map_desc omap7xx_io_desc[] + #ifdef CONFIG_ARCH_OMAP15XX + static struct map_desc omap1510_io_desc[] __initdata = { + { ++ .virtual = OMAP1_IO_VIRT, ++ .pfn = __phys_to_pfn(OMAP1_IO_PHYS), ++ .length = OMAP1_IO_SIZE, ++ .type = MT_DEVICE ++ }, ++ { + .virtual = OMAP1510_DSP_BASE, + .pfn = __phys_to_pfn(OMAP1510_DSP_START), + .length = OMAP1510_DSP_SIZE, +@@ -66,6 +69,12 @@ static struct map_desc omap1510_io_desc[ + #if defined(CONFIG_ARCH_OMAP16XX) + static struct map_desc omap16xx_io_desc[] __initdata = { + { ++ .virtual = OMAP1_IO_VIRT, ++ .pfn = __phys_to_pfn(OMAP1_IO_PHYS), ++ .length = OMAP1_IO_SIZE, ++ .type = MT_DEVICE ++ }, ++ { + .virtual = OMAP16XX_DSP_BASE, + .pfn = __phys_to_pfn(OMAP16XX_DSP_START), + .length = OMAP16XX_DSP_SIZE, +@@ -79,18 +88,9 @@ static struct map_desc omap16xx_io_desc[ + }; + #endif + +-/* +- * Maps common IO regions for omap1 +- */ +-static void __init omap1_map_common_io(void) +-{ +- iotable_init(omap_io_desc, ARRAY_SIZE(omap_io_desc)); +-} +- + #if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850) + void __init omap7xx_map_io(void) + { +- omap1_map_common_io(); + iotable_init(omap7xx_io_desc, ARRAY_SIZE(omap7xx_io_desc)); + } + #endif +@@ -98,7 +98,6 @@ void __init omap7xx_map_io(void) + #ifdef CONFIG_ARCH_OMAP15XX + void __init omap15xx_map_io(void) + { +- omap1_map_common_io(); + iotable_init(omap1510_io_desc, ARRAY_SIZE(omap1510_io_desc)); + } + #endif +@@ -106,7 +105,6 @@ void __init omap15xx_map_io(void) + #if defined(CONFIG_ARCH_OMAP16XX) + void __init omap16xx_map_io(void) + { +- omap1_map_common_io(); + iotable_init(omap16xx_io_desc, ARRAY_SIZE(omap16xx_io_desc)); + } + #endif +--- a/arch/arm/mach-omap1/mcbsp.c ++++ b/arch/arm/mach-omap1/mcbsp.c +@@ -89,7 +89,6 @@ static struct omap_mcbsp_ops omap1_mcbsp + #define OMAP1610_MCBSP2_BASE 0xfffb1000 + #define OMAP1610_MCBSP3_BASE 0xe1017000 + +-#if defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP850) + struct resource omap7xx_mcbsp_res[][6] = { + { + { +@@ -159,14 +158,7 @@ static struct omap_mcbsp_platform_data o + }; + #define OMAP7XX_MCBSP_RES_SZ ARRAY_SIZE(omap7xx_mcbsp_res[1]) + #define OMAP7XX_MCBSP_COUNT ARRAY_SIZE(omap7xx_mcbsp_res) +-#else +-#define omap7xx_mcbsp_res_0 NULL +-#define omap7xx_mcbsp_pdata NULL +-#define OMAP7XX_MCBSP_RES_SZ 0 +-#define OMAP7XX_MCBSP_COUNT 0 +-#endif + +-#ifdef CONFIG_ARCH_OMAP15XX + struct resource omap15xx_mcbsp_res[][6] = { + { + { +@@ -266,14 +258,7 @@ static struct omap_mcbsp_platform_data o + }; + #define OMAP15XX_MCBSP_RES_SZ ARRAY_SIZE(omap15xx_mcbsp_res[1]) + #define OMAP15XX_MCBSP_COUNT ARRAY_SIZE(omap15xx_mcbsp_res) +-#else +-#define omap15xx_mcbsp_res_0 NULL +-#define omap15xx_mcbsp_pdata NULL +-#define OMAP15XX_MCBSP_RES_SZ 0 +-#define OMAP15XX_MCBSP_COUNT 0 +-#endif + +-#ifdef CONFIG_ARCH_OMAP16XX + struct resource omap16xx_mcbsp_res[][6] = { + { + { +@@ -373,12 +358,6 @@ static struct omap_mcbsp_platform_data o + }; + #define OMAP16XX_MCBSP_RES_SZ ARRAY_SIZE(omap16xx_mcbsp_res[1]) + #define OMAP16XX_MCBSP_COUNT ARRAY_SIZE(omap16xx_mcbsp_res) +-#else +-#define omap16xx_mcbsp_res_0 NULL +-#define omap16xx_mcbsp_pdata NULL +-#define OMAP16XX_MCBSP_RES_SZ 0 +-#define OMAP16XX_MCBSP_COUNT 0 +-#endif + + static void omap_mcbsp_register_board_cfg(struct resource *res, int res_count, + struct omap_mcbsp_platform_data *config, int size) +--- a/arch/arm/mach-omap1/pm.h ++++ b/arch/arm/mach-omap1/pm.h +@@ -106,13 +106,6 @@ + #define OMAP7XX_IDLECT3 0xfffece24 + #define OMAP7XX_IDLE_LOOP_REQUEST 0x0C00 + +-#if !defined(CONFIG_ARCH_OMAP730) && \ +- !defined(CONFIG_ARCH_OMAP850) && \ +- !defined(CONFIG_ARCH_OMAP15XX) && \ +- !defined(CONFIG_ARCH_OMAP16XX) +-#warning "Power management for this processor not implemented yet" +-#endif +- + #ifndef __ASSEMBLER__ + + #include +--- a/include/linux/soc/ti/omap1-io.h ++++ b/include/linux/soc/ti/omap1-io.h +@@ -5,7 +5,7 @@ + #ifndef __ASSEMBLER__ + #include + +-#ifdef CONFIG_ARCH_OMAP1_ANY ++#ifdef CONFIG_ARCH_OMAP1 + /* + * NOTE: Please use ioremap + __raw_read/write where possible instead of these + */ +@@ -15,7 +15,7 @@ extern u32 omap_readl(u32 pa); + extern void omap_writeb(u8 v, u32 pa); + extern void omap_writew(u16 v, u32 pa); + extern void omap_writel(u32 v, u32 pa); +-#else ++#elif defined(CONFIG_COMPILE_TEST) + static inline u8 omap_readb(u32 pa) { return 0; } + static inline u16 omap_readw(u32 pa) { return 0; } + static inline u32 omap_readl(u32 pa) { return 0; } diff --git a/queue-6.1/arm64-dts-imx8mp-correct-usb-clocks.patch b/queue-6.1/arm64-dts-imx8mp-correct-usb-clocks.patch new file mode 100644 index 00000000000..e8cfc63bdfc --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mp-correct-usb-clocks.patch @@ -0,0 +1,69 @@ +From 8a1ed98fe0f2e7669f0409de0f46f317b275f8be Mon Sep 17 00:00:00 2001 +From: Li Jun +Date: Fri, 30 Sep 2022 22:54:23 +0800 +Subject: arm64: dts: imx8mp: correct usb clocks + +From: Li Jun + +commit 8a1ed98fe0f2e7669f0409de0f46f317b275f8be upstream. + +After commit cf7f3f4fa9e5 ("clk: imx8mp: fix usb_root_clk parent"), +usb_root_clk is no longer for suspend clock so update dts accordingly +to use right bus clock and suspend clock. + +Fixes: fb8587a2c165 ("arm64: dtsi: imx8mp: add usb nodes") +Cc: stable@vger.kernel.org # ed1f4ccfe947: clk: imx: imx8mp: add shared clk gate for usb suspend clk +Cc: stable@vger.kernel.org # v5.19+ +Reviewed-by: Peng Fan +Tested-by: Alexander Stein +Signed-off-by: Li Jun +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -1279,7 +1279,7 @@ + reg = <0x32f10100 0x8>, + <0x381f0000 0x20>; + clocks = <&clk IMX8MP_CLK_HSIO_ROOT>, +- <&clk IMX8MP_CLK_USB_ROOT>; ++ <&clk IMX8MP_CLK_USB_SUSP>; + clock-names = "hsio", "suspend"; + interrupts = ; + power-domains = <&hsio_blk_ctrl IMX8MP_HSIOBLK_PD_USB>; +@@ -1292,9 +1292,9 @@ + usb_dwc3_0: usb@38100000 { + compatible = "snps,dwc3"; + reg = <0x38100000 0x10000>; +- clocks = <&clk IMX8MP_CLK_HSIO_AXI>, ++ clocks = <&clk IMX8MP_CLK_USB_ROOT>, + <&clk IMX8MP_CLK_USB_CORE_REF>, +- <&clk IMX8MP_CLK_USB_ROOT>; ++ <&clk IMX8MP_CLK_USB_SUSP>; + clock-names = "bus_early", "ref", "suspend"; + interrupts = ; + phys = <&usb3_phy0>, <&usb3_phy0>; +@@ -1321,7 +1321,7 @@ + reg = <0x32f10108 0x8>, + <0x382f0000 0x20>; + clocks = <&clk IMX8MP_CLK_HSIO_ROOT>, +- <&clk IMX8MP_CLK_USB_ROOT>; ++ <&clk IMX8MP_CLK_USB_SUSP>; + clock-names = "hsio", "suspend"; + interrupts = ; + power-domains = <&hsio_blk_ctrl IMX8MP_HSIOBLK_PD_USB>; +@@ -1334,9 +1334,9 @@ + usb_dwc3_1: usb@38200000 { + compatible = "snps,dwc3"; + reg = <0x38200000 0x10000>; +- clocks = <&clk IMX8MP_CLK_HSIO_AXI>, ++ clocks = <&clk IMX8MP_CLK_USB_ROOT>, + <&clk IMX8MP_CLK_USB_CORE_REF>, +- <&clk IMX8MP_CLK_USB_ROOT>; ++ <&clk IMX8MP_CLK_USB_SUSP>; + clock-names = "bus_early", "ref", "suspend"; + interrupts = ; + phys = <&usb3_phy1>, <&usb3_phy1>; diff --git a/queue-6.1/dmaengine-idxd-do-not-call-dmx-tx-callbacks-during-workqueue-disable.patch b/queue-6.1/dmaengine-idxd-do-not-call-dmx-tx-callbacks-during-workqueue-disable.patch new file mode 100644 index 00000000000..eb0d50fd789 --- /dev/null +++ b/queue-6.1/dmaengine-idxd-do-not-call-dmx-tx-callbacks-during-workqueue-disable.patch @@ -0,0 +1,66 @@ +From 6744a030d81e456883bfbb627ac1f30465c1a989 Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Wed, 7 Dec 2022 14:52:22 -0800 +Subject: dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable + +From: Reinette Chatre + +commit 6744a030d81e456883bfbb627ac1f30465c1a989 upstream. + +On driver unload any pending descriptors are flushed and pending +DMA descriptors are explicitly completed: +idxd_dmaengine_drv_remove() -> + drv_disable_wq() -> + idxd_wq_free_irq() -> + idxd_flush_pending_descs() -> + idxd_dma_complete_txd() + +With this done during driver unload any remaining descriptor is +likely stuck and can be dropped. Even so, the descriptor may still +have a callback set that could no longer be accessible. An +example of such a problem is when the dmatest fails and the dmatest +module is unloaded. The failure of dmatest leaves descriptors with +dma_async_tx_descriptor::callback pointing to code that no longer +exist. This causes a page fault as below at the time the IDXD driver +is unloaded when it attempts to run the callback: + BUG: unable to handle page fault for address: ffffffffc0665190 + #PF: supervisor instruction fetch in kernel mode + #PF: error_code(0x0010) - not-present page + +Fix this by clearing the callback pointers on the transmit +descriptors only when workqueue is disabled. + +Fixes: 403a2e236538 ("dmaengine: idxd: change MSIX allocation based on per wq activation") +Signed-off-by: Reinette Chatre +Reviewed-by: Dave Jiang +Reviewed-by: Fenghua Yu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/37d06b772aa7f8863ca50f90930ea2fd80b38fc3.1670452419.git.reinette.chatre@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/idxd/device.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -1173,8 +1173,19 @@ static void idxd_flush_pending_descs(str + spin_unlock(&ie->list_lock); + + list_for_each_entry_safe(desc, itr, &flist, list) { ++ struct dma_async_tx_descriptor *tx; ++ + list_del(&desc->list); + ctype = desc->completion->status ? IDXD_COMPLETE_NORMAL : IDXD_COMPLETE_ABORT; ++ /* ++ * wq is being disabled. Any remaining descriptors are ++ * likely to be stuck and can be dropped. callback could ++ * point to code that is no longer accessible, for example ++ * if dmatest module has been unloaded. ++ */ ++ tx = &desc->txd; ++ tx->callback = NULL; ++ tx->callback_result = NULL; + idxd_dma_complete_txd(desc, ctype, true); + } + } diff --git a/queue-6.1/dmaengine-idxd-let-probe-fail-when-workqueue-cannot-be-enabled.patch b/queue-6.1/dmaengine-idxd-let-probe-fail-when-workqueue-cannot-be-enabled.patch new file mode 100644 index 00000000000..c6d6ee33116 --- /dev/null +++ b/queue-6.1/dmaengine-idxd-let-probe-fail-when-workqueue-cannot-be-enabled.patch @@ -0,0 +1,78 @@ +From b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Wed, 7 Dec 2022 14:52:20 -0800 +Subject: dmaengine: idxd: Let probe fail when workqueue cannot be enabled + +From: Reinette Chatre + +commit b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f upstream. + +The workqueue is enabled when the appropriate driver is loaded and +disabled when the driver is removed. When the driver is removed it +assumes that the workqueue was enabled successfully and proceeds to +free allocations made during workqueue enabling. + +Failure during workqueue enabling does not prevent the driver from +being loaded. This is because the error path within drv_enable_wq() +returns success unless a second failure is encountered +during the error path. By returning success it is possible to load +the driver even if the workqueue cannot be enabled and +allocations that do not exist are attempted to be freed during +driver remove. + +Some examples of problematic flows: +(a) + + idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): + In above flow, if idxd_wq_request_irq() fails then + idxd_wq_unmap_portal() is called on error exit path, but + drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The + driver is thus loaded successfully. + + idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal() + Above flow on driver unload triggers the WARN in devm_iounmap() because + the device resource has already been removed during error path of + drv_enable_wq(). + +(b) + + idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq(): + In above flow, if idxd_wq_request_irq() fails then + idxd_wq_init_percpu_ref() is never called to initialize the percpu + counter, yet the driver loads successfully because drv_enable_wq() + returns 0. + + idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill(): + Above flow on driver unload triggers a BUG when attempting to drop the + initial ref of the uninitialized percpu ref: + BUG: kernel NULL pointer dereference, address: 0000000000000010 + +Fix the drv_enable_wq() error path by returning the original error that +indicates failure of workqueue enabling. This ensures that the probe +fails when an error is encountered and the driver remove paths are only +attempted when the workqueue was enabled successfully. + +Fixes: 1f2bb40337f0 ("dmaengine: idxd: move wq_enable() to device.c") +Signed-off-by: Reinette Chatre +Reviewed-by: Dave Jiang +Reviewed-by: Fenghua Yu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/e8d8116e5efa0fd14fadc5adae6ffd319f0e5ff1.1670452419.git.reinette.chatre@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/idxd/device.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -1391,8 +1391,7 @@ err_res_alloc: + err_irq: + idxd_wq_unmap_portal(wq); + err_map_portal: +- rc = idxd_wq_disable(wq, false); +- if (rc < 0) ++ if (idxd_wq_disable(wq, false)) + dev_dbg(dev, "wq %s disable failed\n", dev_name(wq_confdev(wq))); + err: + return rc; diff --git a/queue-6.1/dmaengine-idxd-prevent-use-after-free-on-completion-memory.patch b/queue-6.1/dmaengine-idxd-prevent-use-after-free-on-completion-memory.patch new file mode 100644 index 00000000000..bf381c6b299 --- /dev/null +++ b/queue-6.1/dmaengine-idxd-prevent-use-after-free-on-completion-memory.patch @@ -0,0 +1,59 @@ +From 1beeec45f9ac31eba52478379f70a5fa9c2ad005 Mon Sep 17 00:00:00 2001 +From: Reinette Chatre +Date: Wed, 7 Dec 2022 14:52:21 -0800 +Subject: dmaengine: idxd: Prevent use after free on completion memory + +From: Reinette Chatre + +commit 1beeec45f9ac31eba52478379f70a5fa9c2ad005 upstream. + +On driver unload any pending descriptors are flushed at the +time the interrupt is freed: +idxd_dmaengine_drv_remove() -> + drv_disable_wq() -> + idxd_wq_free_irq() -> + idxd_flush_pending_descs(). + +If there are any descriptors present that need to be flushed this +flow triggers a "not present" page fault as below: + + BUG: unable to handle page fault for address: ff391c97c70c9040 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + +The address that triggers the fault is the address of the +descriptor that was freed moments earlier via: +drv_disable_wq()->idxd_wq_free_resources() + +Fix the use after free by freeing the descriptors after any possible +usage. This is done after idxd_wq_reset() to ensure that the memory +remains accessible during possible completion writes by the device. + +Fixes: 63c14ae6c161 ("dmaengine: idxd: refactor wq driver enable/disable operations") +Suggested-by: Dave Jiang +Signed-off-by: Reinette Chatre +Reviewed-by: Dave Jiang +Reviewed-by: Fenghua Yu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/6c4657d9cff0a0a00501a7b928297ac966e9ec9d.1670452419.git.reinette.chatre@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/idxd/device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -1408,11 +1408,11 @@ void drv_disable_wq(struct idxd_wq *wq) + dev_warn(dev, "Clients has claim on wq %d: %d\n", + wq->id, idxd_wq_refcount(wq)); + +- idxd_wq_free_resources(wq); + idxd_wq_unmap_portal(wq); + idxd_wq_drain(wq); + idxd_wq_free_irq(wq); + idxd_wq_reset(wq); ++ idxd_wq_free_resources(wq); + percpu_ref_exit(&wq->wq_active); + wq->type = IDXD_WQT_NONE; + wq->client_count = 0; diff --git a/queue-6.1/dmaengine-lgm-move-dt-parsing-after-initialization.patch b/queue-6.1/dmaengine-lgm-move-dt-parsing-after-initialization.patch new file mode 100644 index 00000000000..35ff3f01383 --- /dev/null +++ b/queue-6.1/dmaengine-lgm-move-dt-parsing-after-initialization.patch @@ -0,0 +1,61 @@ +From 96b3bb18f6cbe259ef4e0bed3135911b7e8d2af5 Mon Sep 17 00:00:00 2001 +From: Peter Harliman Liem +Date: Thu, 5 Jan 2023 11:05:51 +0800 +Subject: dmaengine: lgm: Move DT parsing after initialization + +From: Peter Harliman Liem + +commit 96b3bb18f6cbe259ef4e0bed3135911b7e8d2af5 upstream. + +ldma_cfg_init() will parse DT to retrieve certain configs. +However, that is called before ldma_dma_init_vXX(), which +will make some initialization to channel configs. It will +thus incorrectly overwrite certain configs that are declared +in DT. + +To fix that, we move DT parsing after initialization. +Function name is renamed to better represent what it does. + +Fixes: 32d31c79a1a4 ("dmaengine: Add Intel LGM SoC DMA support.") +Signed-off-by: Peter Harliman Liem +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/afef6fc1ed20098b684e0d53737d69faf63c125f.1672887183.git.pliem@maxlinear.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/lgm/lgm-dma.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/dma/lgm/lgm-dma.c ++++ b/drivers/dma/lgm/lgm-dma.c +@@ -914,7 +914,7 @@ static void ldma_dev_init(struct ldma_de + } + } + +-static int ldma_cfg_init(struct ldma_dev *d) ++static int ldma_parse_dt(struct ldma_dev *d) + { + struct fwnode_handle *fwnode = dev_fwnode(d->dev); + struct ldma_port *p; +@@ -1661,10 +1661,6 @@ static int intel_ldma_probe(struct platf + p->ldev = d; + } + +- ret = ldma_cfg_init(d); +- if (ret) +- return ret; +- + dma_dev->dev = &pdev->dev; + + ch_mask = (unsigned long)d->channels_mask; +@@ -1675,6 +1671,10 @@ static int intel_ldma_probe(struct platf + ldma_dma_init_v3X(j, d); + } + ++ ret = ldma_parse_dt(d); ++ if (ret) ++ return ret; ++ + dma_dev->device_alloc_chan_resources = ldma_alloc_chan_resources; + dma_dev->device_free_chan_resources = ldma_free_chan_resources; + dma_dev->device_terminate_all = ldma_terminate_all; diff --git a/queue-6.1/dmaengine-tegra210-adma-fix-global-intr-clear.patch b/queue-6.1/dmaengine-tegra210-adma-fix-global-intr-clear.patch new file mode 100644 index 00000000000..7dc56cb737b --- /dev/null +++ b/queue-6.1/dmaengine-tegra210-adma-fix-global-intr-clear.patch @@ -0,0 +1,33 @@ +From 9c7e355ccbb33d239360c876dbe49ad5ade65b47 Mon Sep 17 00:00:00 2001 +From: Mohan Kumar +Date: Mon, 2 Jan 2023 12:18:44 +0530 +Subject: dmaengine: tegra210-adma: fix global intr clear + +From: Mohan Kumar + +commit 9c7e355ccbb33d239360c876dbe49ad5ade65b47 upstream. + +The current global interrupt clear programming register offset +was not correct. Fix the programming with right offset + +Fixes: ded1f3db4cd6 ("dmaengine: tegra210-adma: prepare for supporting newer Tegra chips") +Cc: stable@vger.kernel.org +Signed-off-by: Mohan Kumar +Link: https://lore.kernel.org/r/20230102064844.31306-1-mkumard@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/tegra210-adma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -221,7 +221,7 @@ static int tegra_adma_init(struct tegra_ + int ret; + + /* Clear any interrupts */ +- tdma_write(tdma, tdma->cdata->global_int_clear, 0x1); ++ tdma_write(tdma, tdma->cdata->ch_base_offset + tdma->cdata->global_int_clear, 0x1); + + /* Assert soft reset */ + tdma_write(tdma, ADMA_GLOBAL_SOFT_RESET, 0x1); diff --git a/queue-6.1/drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch b/queue-6.1/drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch new file mode 100644 index 00000000000..2ee4a5b6ee9 --- /dev/null +++ b/queue-6.1/drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch @@ -0,0 +1,45 @@ +From 79601b894849cb6f6d6122e6590f1887ac4a66b3 Mon Sep 17 00:00:00 2001 +From: Joshua Ashton +Date: Tue, 10 Jan 2023 20:12:21 +0000 +Subject: drm/amd/display: Calculate output_color_space after pixel encoding adjustment + +From: Joshua Ashton + +commit 79601b894849cb6f6d6122e6590f1887ac4a66b3 upstream. + +Code in get_output_color_space depends on knowing the pixel encoding to +determine whether to pick between eg. COLOR_SPACE_SRGB or +COLOR_SPACE_YCBCR709 for transparent RGB -> YCbCr 4:4:4 in the driver. + +v2: Fixed patch being accidentally based on a personal feature branch, oops! + +Fixes: ea117312ea9f ("drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded") +Reviewed-by: Melissa Wen +Signed-off-by: Joshua Ashton +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5283,8 +5283,6 @@ static void fill_stream_properties_from_ + + timing_out->aspect_ratio = get_aspect_ratio(mode_in); + +- stream->output_color_space = get_output_color_space(timing_out); +- + stream->out_transfer_func->type = TF_TYPE_PREDEFINED; + stream->out_transfer_func->tf = TRANSFER_FUNCTION_SRGB; + if (stream->signal == SIGNAL_TYPE_HDMI_TYPE_A) { +@@ -5295,6 +5293,8 @@ static void fill_stream_properties_from_ + adjust_colour_depth_from_display_info(timing_out, info); + } + } ++ ++ stream->output_color_space = get_output_color_space(timing_out); + } + + static void fill_audio_info(struct audio_info *audio_info, diff --git a/queue-6.1/drm-amd-display-disable-s-g-display-on-dcn-3.1.4.patch b/queue-6.1/drm-amd-display-disable-s-g-display-on-dcn-3.1.4.patch new file mode 100644 index 00000000000..d6f47b32586 --- /dev/null +++ b/queue-6.1/drm-amd-display-disable-s-g-display-on-dcn-3.1.4.patch @@ -0,0 +1,37 @@ +From a52287d66dfa1cca32e6273623b63ba39d87f126 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 18 Jan 2023 09:21:22 -0500 +Subject: drm/amd/display: disable S/G display on DCN 3.1.4 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit a52287d66dfa1cca32e6273623b63ba39d87f126 upstream. + +Causes flickering or white screens in some configurations. +Disable it for now until we can fix the issue. + +Cc: roman.li@amd.com +Cc: yifan1.zhang@amd.com +Acked-by: Christian König +Reviewed-by: Roman Li +Reviewed-by: Yifan Zhang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1512,7 +1512,6 @@ static int amdgpu_dm_init(struct amdgpu_ + case IP_VERSION(3, 0, 1): + case IP_VERSION(3, 1, 2): + case IP_VERSION(3, 1, 3): +- case IP_VERSION(3, 1, 4): + case IP_VERSION(3, 1, 6): + init_data.flags.gpu_vm_support = true; + break; diff --git a/queue-6.1/drm-amd-display-disable-s-g-display-on-dcn-3.1.5.patch b/queue-6.1/drm-amd-display-disable-s-g-display-on-dcn-3.1.5.patch new file mode 100644 index 00000000000..b5001e3b700 --- /dev/null +++ b/queue-6.1/drm-amd-display-disable-s-g-display-on-dcn-3.1.5.patch @@ -0,0 +1,37 @@ +From e78cc6a4c7486f50c2786d91dd7d9649a87d1dcb Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 18 Jan 2023 09:19:21 -0500 +Subject: drm/amd/display: disable S/G display on DCN 3.1.5 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit e78cc6a4c7486f50c2786d91dd7d9649a87d1dcb upstream. + +Causes flickering or white screens in some configurations. +Disable it for now until we can fix the issue. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2354 +Cc: roman.li@amd.com +Cc: yifan1.zhang@amd.com +Acked-by: Christian König +Reviewed-by: Yifan Zhang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1513,7 +1513,6 @@ static int amdgpu_dm_init(struct amdgpu_ + case IP_VERSION(3, 1, 2): + case IP_VERSION(3, 1, 3): + case IP_VERSION(3, 1, 4): +- case IP_VERSION(3, 1, 5): + case IP_VERSION(3, 1, 6): + init_data.flags.gpu_vm_support = true; + break; diff --git a/queue-6.1/drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch b/queue-6.1/drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch new file mode 100644 index 00000000000..2d84881474d --- /dev/null +++ b/queue-6.1/drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch @@ -0,0 +1,43 @@ +From 973a9c810c785ac270a6d50d8cf862b0c1643a10 Mon Sep 17 00:00:00 2001 +From: Joshua Ashton +Date: Tue, 10 Jan 2023 22:50:42 +0000 +Subject: drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix + +From: Joshua Ashton + +commit 973a9c810c785ac270a6d50d8cf862b0c1643a10 upstream. + +The YCC conversion matrix for RGB -> COLOR_SPACE_YCBCR2020_TYPE is +missing the values for the fourth column of the matrix. + +The fourth column of the matrix is essentially just a value that is +added given that the color is 3 components in size. +These values are needed to bias the chroma from the [-1, 1] -> [0, 1] +range. + +This fixes color being very green when using Gamescope HDR on HDMI +output which prefers YCC 4:4:4. + +Fixes: 40df2f809e8f ("drm/amd/display: color space ycbcr709 support") +Reviewed-by: Melissa Wen +Signed-off-by: Joshua Ashton +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c +@@ -90,8 +90,8 @@ static const struct out_csc_color_matrix + { 0xE00, 0xF349, 0xFEB7, 0x1000, 0x6CE, 0x16E3, + 0x24F, 0x200, 0xFCCB, 0xF535, 0xE00, 0x1000} }, + { COLOR_SPACE_YCBCR2020_TYPE, +- { 0x1000, 0xF149, 0xFEB7, 0x0000, 0x0868, 0x15B2, +- 0x01E6, 0x0000, 0xFB88, 0xF478, 0x1000, 0x0000} }, ++ { 0x1000, 0xF149, 0xFEB7, 0x1004, 0x0868, 0x15B2, ++ 0x01E6, 0x201, 0xFB88, 0xF478, 0x1000, 0x1004} }, + { COLOR_SPACE_YCBCR709_BLACK_TYPE, + { 0x0000, 0x0000, 0x0000, 0x1000, 0x0000, 0x0000, + 0x0000, 0x0200, 0x0000, 0x0000, 0x0000, 0x1000} }, diff --git a/queue-6.1/drm-amd-display-fix-set-scaling-doesn-s-work.patch b/queue-6.1/drm-amd-display-fix-set-scaling-doesn-s-work.patch new file mode 100644 index 00000000000..55f7c434bca --- /dev/null +++ b/queue-6.1/drm-amd-display-fix-set-scaling-doesn-s-work.patch @@ -0,0 +1,41 @@ +From 040625ab82ce6dca7772cb3867fe5c9eb279a344 Mon Sep 17 00:00:00 2001 +From: hongao +Date: Tue, 22 Nov 2022 19:20:34 +0800 +Subject: drm/amd/display: Fix set scaling doesn's work + +From: hongao + +commit 040625ab82ce6dca7772cb3867fe5c9eb279a344 upstream. + +[Why] +Setting scaling does not correctly update CRTC state. As a result +dc stream state's src (composition area) && dest (addressable area) +was not calculated as expected. This causes set scaling doesn's work. + +[How] +Correctly update CRTC state when setting scaling property. + +Reviewed-by: Harry Wentland +Tested-by: Rodrigo Siqueira +Signed-off-by: hongao +Signed-off-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -9433,8 +9433,8 @@ static int amdgpu_dm_atomic_check(struct + goto fail; + } + +- if (dm_old_con_state->abm_level != +- dm_new_con_state->abm_level) ++ if (dm_old_con_state->abm_level != dm_new_con_state->abm_level || ++ dm_old_con_state->scaling != dm_new_con_state->scaling) + new_crtc_state->connectors_changed = true; + } + diff --git a/queue-6.1/drm-amdgpu-allow-multipipe-policy-on-asics-with-one-mec.patch b/queue-6.1/drm-amdgpu-allow-multipipe-policy-on-asics-with-one-mec.patch new file mode 100644 index 00000000000..f959e31a326 --- /dev/null +++ b/queue-6.1/drm-amdgpu-allow-multipipe-policy-on-asics-with-one-mec.patch @@ -0,0 +1,37 @@ +From dc88063b87775971be564d79dc1b05f7b8b5c135 Mon Sep 17 00:00:00 2001 +From: Lang Yu +Date: Wed, 11 Jan 2023 09:32:15 +0800 +Subject: drm/amdgpu: allow multipipe policy on ASICs with one MEC + +From: Lang Yu + +commit dc88063b87775971be564d79dc1b05f7b8b5c135 upstream. + +Always enable multipipe policy on ASICs with GC VERSION > 9.0.0 +instead of MEC number > 1. + +This will allow multipipe policy on ASICs with one MEC, +e.g., gfx11 APUs. + +Signed-off-by: Lang Yu +Reviewed-by: Aaron Liu +Reviewed-by: Yifan Zhang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -156,6 +156,9 @@ static bool amdgpu_gfx_is_compute_multip + return amdgpu_compute_multipipe == 1; + } + ++ if (adev->ip_versions[GC_HWIP][0] > IP_VERSION(9, 0, 0)) ++ return true; ++ + /* FIXME: spreading the queues across pipes causes perf regressions + * on POLARIS11 compute workloads */ + if (adev->asic_type == CHIP_POLARIS11) diff --git a/queue-6.1/drm-amdgpu-correct-the-power-calcultion-for-renior-cezanne.patch b/queue-6.1/drm-amdgpu-correct-the-power-calcultion-for-renior-cezanne.patch new file mode 100644 index 00000000000..c477630d54d --- /dev/null +++ b/queue-6.1/drm-amdgpu-correct-the-power-calcultion-for-renior-cezanne.patch @@ -0,0 +1,46 @@ +From c7bae4aaa5609c1fa9761c35dbcc5fcc92915222 Mon Sep 17 00:00:00 2001 +From: jie1zhan +Date: Fri, 13 Jan 2023 10:39:13 +0800 +Subject: drm/amdgpu: Correct the power calcultion for Renior/Cezanne. + +From: jie1zhan + +commit c7bae4aaa5609c1fa9761c35dbcc5fcc92915222 upstream. + +From smu firmware,the value of power is transferred in units of watts. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2321 +Fixes: 137aac26a2ed ("drm/amdgpu/smu12: fix power reporting on renoir") +Acked-by: Alex Deucher +Signed-off-by: Jesse Zhang +Reviewed-by: Aaron Liu +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +@@ -1171,6 +1171,7 @@ static int renoir_get_smu_metrics_data(s + int ret = 0; + uint32_t apu_percent = 0; + uint32_t dgpu_percent = 0; ++ struct amdgpu_device *adev = smu->adev; + + + ret = smu_cmn_get_metrics_table(smu, +@@ -1196,7 +1197,11 @@ static int renoir_get_smu_metrics_data(s + *value = metrics->AverageUvdActivity / 100; + break; + case METRICS_AVERAGE_SOCKETPOWER: +- *value = (metrics->CurrentSocketPower << 8) / 1000; ++ if (((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(12, 0, 1)) && (adev->pm.fw_version >= 0x40000f)) || ++ ((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(12, 0, 0)) && (adev->pm.fw_version >= 0x373200))) ++ *value = metrics->CurrentSocketPower << 8; ++ else ++ *value = (metrics->CurrentSocketPower << 8) / 1000; + break; + case METRICS_TEMPERATURE_EDGE: + *value = (metrics->GfxTemperature / 100) * diff --git a/queue-6.1/drm-amdgpu-fix-amdgpu_job_free_resources-v2.patch b/queue-6.1/drm-amdgpu-fix-amdgpu_job_free_resources-v2.patch new file mode 100644 index 00000000000..d49dfca0e92 --- /dev/null +++ b/queue-6.1/drm-amdgpu-fix-amdgpu_job_free_resources-v2.patch @@ -0,0 +1,46 @@ +From 74ea8e78ab349514c9f4df0be1189d91267d750d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Thu, 12 Jan 2023 14:46:00 +0100 +Subject: drm/amdgpu: fix amdgpu_job_free_resources v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +commit 74ea8e78ab349514c9f4df0be1189d91267d750d upstream. + +It can be that neither fence were initialized when we run out of UVD +streams for example. + +v2: fix typo breaking compile + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2324 +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.1.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -154,8 +154,14 @@ void amdgpu_job_free_resources(struct am + struct dma_fence *f; + unsigned i; + +- /* use sched fence if available */ +- f = job->base.s_fence ? &job->base.s_fence->finished : &job->hw_fence; ++ /* Check if any fences where initialized */ ++ if (job->base.s_fence && job->base.s_fence->finished.ops) ++ f = &job->base.s_fence->finished; ++ else if (job->hw_fence.ops) ++ f = &job->hw_fence; ++ else ++ f = NULL; ++ + for (i = 0; i < job->num_ibs; ++i) + amdgpu_ib_free(ring->adev, &job->ibs[i], f); + } diff --git a/queue-6.1/drm-i915-allow-switching-away-via-vga-switcheroo-if-uninitialized.patch b/queue-6.1/drm-i915-allow-switching-away-via-vga-switcheroo-if-uninitialized.patch new file mode 100644 index 00000000000..e54d54f374f --- /dev/null +++ b/queue-6.1/drm-i915-allow-switching-away-via-vga-switcheroo-if-uninitialized.patch @@ -0,0 +1,97 @@ +From a273e95721e96885971a05f1b34cb6d093904d9d Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Mon, 16 Jan 2023 12:54:23 +0100 +Subject: drm/i915: Allow switching away via vga-switcheroo if uninitialized +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Zimmermann + +commit a273e95721e96885971a05f1b34cb6d093904d9d upstream. + +Always allow switching away via vga-switcheroo if the display is +uninitalized. Instead prevent switching to i915 if the device has +not been initialized. + +This issue was introduced by commit 5df7bd130818 ("drm/i915: skip +display initialization when there is no display") protected, which +protects code paths from being executed on uninitialized devices. +In the case of vga-switcheroo, we want to allow a switch away from +i915's device. So run vga_switcheroo_process_delayed_switch() and +test in the switcheroo callbacks if the i915 device is available. + +Fixes: 5df7bd130818 ("drm/i915: skip display initialization when there is no display") +Signed-off-by: Thomas Zimmermann +Reviewed-by: Alex Deucher +Cc: Radhakrishna Sripada +Cc: Lucas De Marchi +Cc: José Roberto de Souza +Cc: Jani Nikula +Cc: Ville Syrjälä +Cc: Jani Nikula +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: Tvrtko Ursulin +Cc: "Ville Syrjälä" +Cc: Manasi Navare +Cc: Stanislav Lisovskiy +Cc: Imre Deak +Cc: "Jouni Högander" +Cc: Uma Shankar +Cc: Ankit Nautiyal +Cc: "Jason A. Donenfeld" +Cc: Matt Roper +Cc: Ramalingam C +Cc: Thomas Zimmermann +Cc: Andi Shyti +Cc: Andrzej Hajda +Cc: "José Roberto de Souza" +Cc: Julia Lawall +Cc: intel-gfx@lists.freedesktop.org +Cc: # v5.14+ +Link: https://patchwork.freedesktop.org/patch/msgid/20230116115425.13484-2-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_driver.c | 5 +---- + drivers/gpu/drm/i915/i915_switcheroo.c | 6 +++++- + 2 files changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_driver.c ++++ b/drivers/gpu/drm/i915/i915_driver.c +@@ -1070,12 +1070,9 @@ static int i915_driver_open(struct drm_d + */ + static void i915_driver_lastclose(struct drm_device *dev) + { +- struct drm_i915_private *i915 = to_i915(dev); +- + intel_fbdev_restore_mode(dev); + +- if (HAS_DISPLAY(i915)) +- vga_switcheroo_process_delayed_switch(); ++ vga_switcheroo_process_delayed_switch(); + } + + static void i915_driver_postclose(struct drm_device *dev, struct drm_file *file) +--- a/drivers/gpu/drm/i915/i915_switcheroo.c ++++ b/drivers/gpu/drm/i915/i915_switcheroo.c +@@ -19,6 +19,10 @@ static void i915_switcheroo_set_state(st + dev_err(&pdev->dev, "DRM not initialized, aborting switch.\n"); + return; + } ++ if (!HAS_DISPLAY(i915)) { ++ dev_err(&pdev->dev, "Device state not initialized, aborting switch.\n"); ++ return; ++ } + + if (state == VGA_SWITCHEROO_ON) { + drm_info(&i915->drm, "switched on\n"); +@@ -44,7 +48,7 @@ static bool i915_switcheroo_can_switch(s + * locking inversion with the driver load path. And the access here is + * completely racy anyway. So don't bother with locking for now. + */ +- return i915 && atomic_read(&i915->drm.open_count) == 0; ++ return i915 && HAS_DISPLAY(i915) && atomic_read(&i915->drm.open_count) == 0; + } + + static const struct vga_switcheroo_client_ops i915_switcheroo_ops = { diff --git a/queue-6.1/drm-i915-display-check-source-height-is-0.patch b/queue-6.1/drm-i915-display-check-source-height-is-0.patch new file mode 100644 index 00000000000..08feb005700 --- /dev/null +++ b/queue-6.1/drm-i915-display-check-source-height-is-0.patch @@ -0,0 +1,37 @@ +From 8565c502e7c156d190d8e6d36e443f51b257f165 Mon Sep 17 00:00:00 2001 +From: Drew Davenport +Date: Mon, 26 Dec 2022 22:53:24 -0700 +Subject: drm/i915/display: Check source height is > 0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Drew Davenport + +commit 8565c502e7c156d190d8e6d36e443f51b257f165 upstream. + +The error message suggests that the height of the src rect must be at +least 1. Reject source with height of 0. + +Cc: stable@vger.kernel.org +Signed-off-by: Drew Davenport +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221226225246.1.I15dff7bb5a0e485c862eae61a69096caf12ef29f@changeid +(cherry picked from commit 0fe76b198d482b41771a8d17b45fb726d13083cf) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c ++++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c +@@ -1620,7 +1620,7 @@ static int skl_check_main_surface(struct + u32 offset; + int ret; + +- if (w > max_width || w < min_width || h > max_height) { ++ if (w > max_width || w < min_width || h > max_height || h < 1) { + drm_dbg_kms(&dev_priv->drm, + "requested Y/RGB source size %dx%d outside limits (min: %dx1 max: %dx%d)\n", + w, h, min_width, max_width, max_height); diff --git a/queue-6.1/drm-i915-re-disable-rc6p-on-sandy-bridge.patch b/queue-6.1/drm-i915-re-disable-rc6p-on-sandy-bridge.patch new file mode 100644 index 00000000000..e7c78107fdd --- /dev/null +++ b/queue-6.1/drm-i915-re-disable-rc6p-on-sandy-bridge.patch @@ -0,0 +1,44 @@ +From 67b0b4ed259e425b7eed09da75b42c80682ca003 Mon Sep 17 00:00:00 2001 +From: Sasa Dragic +Date: Mon, 19 Dec 2022 18:29:27 +0100 +Subject: drm/i915: re-disable RC6p on Sandy Bridge +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sasa Dragic + +commit 67b0b4ed259e425b7eed09da75b42c80682ca003 upstream. + +RC6p on Sandy Bridge got re-enabled over time, causing visual glitches +and GPU hangs. + +Disabled originally in commit 1c8ecf80fdee ("drm/i915: do not enable +RC6p on Sandy Bridge"). + +Signed-off-by: Sasa Dragic +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221219172927.9603-2-sasa.dragic@gmail.com +Fixes: fb6db0f5bf1d ("drm/i915: Remove unsafe i915.enable_rc6") +Fixes: 13c5a577b342 ("drm/i915/gt: Select the deepest available parking mode for rc6") +Cc: stable@vger.kernel.org +Reviewed-by: Rodrigo Vivi +(cherry picked from commit 0c8a6e9ea232c221976a0670256bd861408d9917) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_pci.c ++++ b/drivers/gpu/drm/i915/i915_pci.c +@@ -423,7 +423,8 @@ static const struct intel_device_info il + .has_coherent_ggtt = true, \ + .has_llc = 1, \ + .has_rc6 = 1, \ +- .has_rc6p = 1, \ ++ /* snb does support rc6p, but enabling it causes various issues */ \ ++ .has_rc6p = 0, \ + .has_rps = true, \ + .dma_mask_size = 40, \ + .__runtime.ppgtt_type = INTEL_PPGTT_ALIASING, \ diff --git a/queue-6.1/dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch b/queue-6.1/dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch new file mode 100644 index 00000000000..8ce830dd341 --- /dev/null +++ b/queue-6.1/dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch @@ -0,0 +1,188 @@ +From c63835bf1c750c9b3aec1d5c23d811d6375fc23d Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Mon, 16 Jan 2023 21:17:39 +0100 +Subject: dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation + +From: Heiner Kallweit + +commit c63835bf1c750c9b3aec1d5c23d811d6375fc23d upstream. + +The compatible strings in the driver don't have the meson prefix. +Fix this in the documentation and rename the file accordingly. + +Fixes: da86d286cce8 ("dt-bindings: phy: meson-g12a-usb2-phy: convert to yaml") +Cc: stable@vger.kernel.org +Signed-off-by: Heiner Kallweit +Reviewed-by: Martin Blumenstingl +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/8d960029-e94d-224b-911f-03e5deb47ebc@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml | 78 ++++++++++ + Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml | 78 ---------- + 2 files changed, 78 insertions(+), 78 deletions(-) + rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb2-phy.yaml => amlogic,g12a-usb2-phy.yaml} (85%) + +--- /dev/null ++++ b/Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml +@@ -0,0 +1,78 @@ ++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) ++# Copyright 2019 BayLibre, SAS ++%YAML 1.2 ++--- ++$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb2-phy.yaml#" ++$schema: "http://devicetree.org/meta-schemas/core.yaml#" ++ ++title: Amlogic G12A USB2 PHY ++ ++maintainers: ++ - Neil Armstrong ++ ++properties: ++ compatible: ++ enum: ++ - amlogic,g12a-usb2-phy ++ - amlogic,a1-usb2-phy ++ ++ reg: ++ maxItems: 1 ++ ++ clocks: ++ maxItems: 1 ++ ++ clock-names: ++ items: ++ - const: xtal ++ ++ resets: ++ maxItems: 1 ++ ++ reset-names: ++ items: ++ - const: phy ++ ++ "#phy-cells": ++ const: 0 ++ ++ phy-supply: ++ description: ++ Phandle to a regulator that provides power to the PHY. This ++ regulator will be managed during the PHY power on/off sequence. ++ ++required: ++ - compatible ++ - reg ++ - clocks ++ - clock-names ++ - resets ++ - reset-names ++ - "#phy-cells" ++ ++if: ++ properties: ++ compatible: ++ enum: ++ - amlogic,meson-a1-usb-ctrl ++ ++then: ++ properties: ++ power-domains: ++ maxItems: 1 ++ required: ++ - power-domains ++ ++additionalProperties: false ++ ++examples: ++ - | ++ phy@36000 { ++ compatible = "amlogic,g12a-usb2-phy"; ++ reg = <0x36000 0x2000>; ++ clocks = <&xtal>; ++ clock-names = "xtal"; ++ resets = <&phy_reset>; ++ reset-names = "phy"; ++ #phy-cells = <0>; ++ }; +--- a/Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml ++++ /dev/null +@@ -1,78 +0,0 @@ +-# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) +-# Copyright 2019 BayLibre, SAS +-%YAML 1.2 +---- +-$id: "http://devicetree.org/schemas/phy/amlogic,meson-g12a-usb2-phy.yaml#" +-$schema: "http://devicetree.org/meta-schemas/core.yaml#" +- +-title: Amlogic G12A USB2 PHY +- +-maintainers: +- - Neil Armstrong +- +-properties: +- compatible: +- enum: +- - amlogic,meson-g12a-usb2-phy +- - amlogic,meson-a1-usb2-phy +- +- reg: +- maxItems: 1 +- +- clocks: +- maxItems: 1 +- +- clock-names: +- items: +- - const: xtal +- +- resets: +- maxItems: 1 +- +- reset-names: +- items: +- - const: phy +- +- "#phy-cells": +- const: 0 +- +- phy-supply: +- description: +- Phandle to a regulator that provides power to the PHY. This +- regulator will be managed during the PHY power on/off sequence. +- +-required: +- - compatible +- - reg +- - clocks +- - clock-names +- - resets +- - reset-names +- - "#phy-cells" +- +-if: +- properties: +- compatible: +- enum: +- - amlogic,meson-a1-usb-ctrl +- +-then: +- properties: +- power-domains: +- maxItems: 1 +- required: +- - power-domains +- +-additionalProperties: false +- +-examples: +- - | +- phy@36000 { +- compatible = "amlogic,meson-g12a-usb2-phy"; +- reg = <0x36000 0x2000>; +- clocks = <&xtal>; +- clock-names = "xtal"; +- resets = <&phy_reset>; +- reset-names = "phy"; +- #phy-cells = <0>; +- }; diff --git a/queue-6.1/dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch b/queue-6.1/dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch new file mode 100644 index 00000000000..a82691bf556 --- /dev/null +++ b/queue-6.1/dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch @@ -0,0 +1,150 @@ +From e181119046a0ec16126b682163040e8e33f310c1 Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Mon, 16 Jan 2023 21:19:03 +0100 +Subject: dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation + +From: Heiner Kallweit + +commit e181119046a0ec16126b682163040e8e33f310c1 upstream. + +The compatible string in the driver doesn't have the meson prefix. +Fix this in the documentation and rename the file accordingly. + +Fixes: 87a55485f2fc ("dt-bindings: phy: meson-g12a-usb3-pcie-phy: convert to yaml") +Cc: stable@vger.kernel.org +Signed-off-by: Heiner Kallweit +Reviewed-by: Martin Blumenstingl +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/0a82be92-ce85-da34-9d6f-4b33034473e5@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml | 59 ++++++++++ + Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml | 59 ---------- + 2 files changed, 59 insertions(+), 59 deletions(-) + rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb3-pcie-phy.yaml => amlogic,g12a-usb3-pcie-phy.yaml} (82%) + +--- /dev/null ++++ b/Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml +@@ -0,0 +1,59 @@ ++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) ++# Copyright 2019 BayLibre, SAS ++%YAML 1.2 ++--- ++$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb3-pcie-phy.yaml#" ++$schema: "http://devicetree.org/meta-schemas/core.yaml#" ++ ++title: Amlogic G12A USB3 + PCIE Combo PHY ++ ++maintainers: ++ - Neil Armstrong ++ ++properties: ++ compatible: ++ enum: ++ - amlogic,g12a-usb3-pcie-phy ++ ++ reg: ++ maxItems: 1 ++ ++ clocks: ++ maxItems: 1 ++ ++ clock-names: ++ items: ++ - const: ref_clk ++ ++ resets: ++ maxItems: 1 ++ ++ reset-names: ++ items: ++ - const: phy ++ ++ "#phy-cells": ++ const: 1 ++ ++required: ++ - compatible ++ - reg ++ - clocks ++ - clock-names ++ - resets ++ - reset-names ++ - "#phy-cells" ++ ++additionalProperties: false ++ ++examples: ++ - | ++ phy@46000 { ++ compatible = "amlogic,g12a-usb3-pcie-phy"; ++ reg = <0x46000 0x2000>; ++ clocks = <&ref_clk>; ++ clock-names = "ref_clk"; ++ resets = <&phy_reset>; ++ reset-names = "phy"; ++ #phy-cells = <1>; ++ }; +--- a/Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml ++++ /dev/null +@@ -1,59 +0,0 @@ +-# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) +-# Copyright 2019 BayLibre, SAS +-%YAML 1.2 +---- +-$id: "http://devicetree.org/schemas/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml#" +-$schema: "http://devicetree.org/meta-schemas/core.yaml#" +- +-title: Amlogic G12A USB3 + PCIE Combo PHY +- +-maintainers: +- - Neil Armstrong +- +-properties: +- compatible: +- enum: +- - amlogic,meson-g12a-usb3-pcie-phy +- +- reg: +- maxItems: 1 +- +- clocks: +- maxItems: 1 +- +- clock-names: +- items: +- - const: ref_clk +- +- resets: +- maxItems: 1 +- +- reset-names: +- items: +- - const: phy +- +- "#phy-cells": +- const: 1 +- +-required: +- - compatible +- - reg +- - clocks +- - clock-names +- - resets +- - reset-names +- - "#phy-cells" +- +-additionalProperties: false +- +-examples: +- - | +- phy@46000 { +- compatible = "amlogic,meson-g12a-usb3-pcie-phy"; +- reg = <0x46000 0x2000>; +- clocks = <&ref_clk>; +- clock-names = "ref_clk"; +- resets = <&phy_reset>; +- reset-names = "phy"; +- #phy-cells = <1>; +- }; diff --git a/queue-6.1/gsmi-fix-null-deref-in-gsmi_get_variable.patch b/queue-6.1/gsmi-fix-null-deref-in-gsmi_get_variable.patch new file mode 100644 index 00000000000..e215f5b6ad8 --- /dev/null +++ b/queue-6.1/gsmi-fix-null-deref-in-gsmi_get_variable.patch @@ -0,0 +1,41 @@ +From a769b05eeed7accc4019a1ed9799dd72067f1ce8 Mon Sep 17 00:00:00 2001 +From: Khazhismel Kumykov +Date: Tue, 17 Jan 2023 17:02:12 -0800 +Subject: gsmi: fix null-deref in gsmi_get_variable + +From: Khazhismel Kumykov + +commit a769b05eeed7accc4019a1ed9799dd72067f1ce8 upstream. + +We can get EFI variables without fetching the attribute, so we must +allow for that in gsmi. + +commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore +access layer") added a new get_variable call with attr=NULL, which +triggers panic in gsmi. + +Fixes: 74c5b31c6618 ("driver: Google EFI SMI") +Cc: stable +Signed-off-by: Khazhismel Kumykov +Link: https://lore.kernel.org/r/20230118010212.1268474-1-khazhy@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/google/gsmi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/firmware/google/gsmi.c ++++ b/drivers/firmware/google/gsmi.c +@@ -361,9 +361,10 @@ static efi_status_t gsmi_get_variable(ef + memcpy(data, gsmi_dev.data_buf->start, *data_size); + + /* All variables are have the following attributes */ +- *attr = EFI_VARIABLE_NON_VOLATILE | +- EFI_VARIABLE_BOOTSERVICE_ACCESS | +- EFI_VARIABLE_RUNTIME_ACCESS; ++ if (attr) ++ *attr = EFI_VARIABLE_NON_VOLATILE | ++ EFI_VARIABLE_BOOTSERVICE_ACCESS | ++ EFI_VARIABLE_RUNTIME_ACCESS; + } + + spin_unlock_irqrestore(&gsmi_dev.lock, flags); diff --git a/queue-6.1/io_uring-poll-don-t-reissue-in-case-of-poll-race-on-multishot-request.patch b/queue-6.1/io_uring-poll-don-t-reissue-in-case-of-poll-race-on-multishot-request.patch new file mode 100644 index 00000000000..bd1a5c09a27 --- /dev/null +++ b/queue-6.1/io_uring-poll-don-t-reissue-in-case-of-poll-race-on-multishot-request.patch @@ -0,0 +1,45 @@ +From 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Fri, 20 Jan 2023 15:08:21 -0700 +Subject: io_uring/poll: don't reissue in case of poll race on multishot request + +From: Jens Axboe + +commit 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 upstream. + +A previous commit fixed a poll race that can occur, but it's only +applicable for multishot requests. For a multishot request, we can safely +ignore a spurious wakeup, as we never leave the waitqueue to begin with. + +A blunt reissue of a multishot armed request can cause us to leak a +buffer, if they are ring provided. While this seems like a bug in itself, +it's not really defined behavior to reissue a multishot request directly. +It's less efficient to do so as well, and not required to rearm anything +like it is for singleshot poll requests. + +Cc: stable@vger.kernel.org +Fixes: 6e5aedb9324a ("io_uring/poll: attempt request issue after racy poll wakeup") +Reported-and-tested-by: Olivier Langlois +Link: https://github.com/axboe/liburing/issues/778 +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/poll.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/io_uring/poll.c ++++ b/io_uring/poll.c +@@ -281,8 +281,12 @@ static int io_poll_check_events(struct i + * to the waitqueue, so if we get nothing back, we + * should be safe and attempt a reissue. + */ +- if (unlikely(!req->cqe.res)) ++ if (unlikely(!req->cqe.res)) { ++ /* Multishot armed need not reissue */ ++ if (!(req->apoll_events & EPOLLONESHOT)) ++ continue; + return IOU_POLL_REISSUE; ++ } + } + if (req->apoll_events & EPOLLONESHOT) + return IOU_POLL_DONE; diff --git a/queue-6.1/mei-bus-fix-unlink-on-bus-in-error-path.patch b/queue-6.1/mei-bus-fix-unlink-on-bus-in-error-path.patch new file mode 100644 index 00000000000..fd22a5390bd --- /dev/null +++ b/queue-6.1/mei-bus-fix-unlink-on-bus-in-error-path.patch @@ -0,0 +1,75 @@ +From a43866856125c3c432e2fbb6cc63cee1539ec4a7 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Tue, 13 Dec 2022 00:02:46 +0200 +Subject: mei: bus: fix unlink on bus in error path + +From: Alexander Usyskin + +commit a43866856125c3c432e2fbb6cc63cee1539ec4a7 upstream. + +Unconditional call to mei_cl_unlink in mei_cl_bus_dev_release leads +to call of the mei_cl_unlink without corresponding mei_cl_link. +This leads to miscalculation of open_handle_count (decrease without +increase). + +Call unlink in mei_cldev_enable fail path and remove blanket unlink +from mei_cl_bus_dev_release. + +Fixes: 34f1166afd67 ("mei: bus: need to unlink client before freeing") +Cc: +Signed-off-by: Alexander Usyskin +Reviewed-by: Tomas Winkler +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20221212220247.286019-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/bus.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -665,13 +665,15 @@ void *mei_cldev_dma_map(struct mei_cl_de + if (cl->state == MEI_FILE_UNINITIALIZED) { + ret = mei_cl_link(cl); + if (ret) +- goto out; ++ goto notlinked; + /* update pointers */ + cl->cldev = cldev; + } + + ret = mei_cl_dma_alloc_and_map(cl, NULL, buffer_id, size); +-out: ++ if (ret) ++ mei_cl_unlink(cl); ++notlinked: + mutex_unlock(&bus->device_lock); + if (ret) + return ERR_PTR(ret); +@@ -721,7 +723,7 @@ int mei_cldev_enable(struct mei_cl_devic + if (cl->state == MEI_FILE_UNINITIALIZED) { + ret = mei_cl_link(cl); + if (ret) +- goto out; ++ goto notlinked; + /* update pointers */ + cl->cldev = cldev; + } +@@ -748,6 +750,9 @@ int mei_cldev_enable(struct mei_cl_devic + } + + out: ++ if (ret) ++ mei_cl_unlink(cl); ++notlinked: + mutex_unlock(&bus->device_lock); + + return ret; +@@ -1115,7 +1120,6 @@ static void mei_cl_bus_dev_release(struc + mei_cl_flush_queues(cldev->cl, NULL); + mei_me_cl_put(cldev->me_cl); + mei_dev_bus_put(cldev->bus); +- mei_cl_unlink(cldev->cl); + kfree(cldev->cl); + kfree(cldev); + } diff --git a/queue-6.1/mei-me-add-meteor-lake-point-m-did.patch b/queue-6.1/mei-me-add-meteor-lake-point-m-did.patch new file mode 100644 index 00000000000..6172b1fa5ac --- /dev/null +++ b/queue-6.1/mei-me-add-meteor-lake-point-m-did.patch @@ -0,0 +1,43 @@ +From 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Tue, 13 Dec 2022 00:02:47 +0200 +Subject: mei: me: add meteor lake point M DID + +From: Alexander Usyskin + +commit 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 upstream. + +Add Meteor Lake Point M device id. + +Cc: +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20221212220247.286019-2-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/hw-me-regs.h | 2 ++ + drivers/misc/mei/pci-me.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -111,6 +111,8 @@ + + #define MEI_DEV_ID_RPL_S 0x7A68 /* Raptor Lake Point S */ + ++#define MEI_DEV_ID_MTL_M 0x7E70 /* Meteor Lake Point M */ ++ + /* + * MEI HW Section + */ +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -118,6 +118,8 @@ static const struct pci_device_id mei_me + + {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)}, + ++ {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, ++ + /* required last entry */ + {0, } + }; diff --git a/queue-6.1/mptcp-explicitly-specify-sock-family-at-subflow-creation-time.patch b/queue-6.1/mptcp-explicitly-specify-sock-family-at-subflow-creation-time.patch new file mode 100644 index 00000000000..340949d137c --- /dev/null +++ b/queue-6.1/mptcp-explicitly-specify-sock-family-at-subflow-creation-time.patch @@ -0,0 +1,98 @@ +From 6bc1fe7dd748ba5e76e7917d110837cafe7b931c Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Thu, 12 Jan 2023 18:42:51 +0100 +Subject: mptcp: explicitly specify sock family at subflow creation time + +From: Paolo Abeni + +commit 6bc1fe7dd748ba5e76e7917d110837cafe7b931c upstream. + +Let the caller specify the to-be-created subflow family. + +For a given MPTCP socket created with the AF_INET6 family, the current +userspace PM can already ask the kernel to create subflows in v4 and v6. +If "plain" IPv4 addresses are passed to the kernel, they are +automatically mapped in v6 addresses "by accident". This can be +problematic because the userspace will need to pass different addresses, +now the v4-mapped-v6 addresses to destroy this new subflow. + +On the other hand, if the MPTCP socket has been created with the AF_INET +family, the command to create a subflow in v6 will be accepted but the +result will not be the one as expected as new subflow will be created in +IPv4 using part of the v6 addresses passed to the kernel: not creating +the expected subflow then. + +No functional change intended for the in-kernel PM where an explicit +enforcement is currently in place. This arbitrary enforcement will be +leveraged by other patches in a future version. + +Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") +Cc: stable@vger.kernel.org +Co-developed-by: Matthieu Baerts +Signed-off-by: Matthieu Baerts +Signed-off-by: Paolo Abeni +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 2 +- + net/mptcp/protocol.h | 3 ++- + net/mptcp/subflow.c | 9 +++++---- + 3 files changed, 8 insertions(+), 6 deletions(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -107,7 +107,7 @@ static int __mptcp_socket_create(struct + struct socket *ssock; + int err; + +- err = mptcp_subflow_create_socket(sk, &ssock); ++ err = mptcp_subflow_create_socket(sk, sk->sk_family, &ssock); + if (err) + return err; + +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -626,7 +626,8 @@ bool mptcp_addresses_equal(const struct + /* called with sk socket lock held */ + int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc, + const struct mptcp_addr_info *remote); +-int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock); ++int mptcp_subflow_create_socket(struct sock *sk, unsigned short family, ++ struct socket **new_sock); + void mptcp_info2sockaddr(const struct mptcp_addr_info *info, + struct sockaddr_storage *addr, + unsigned short family); +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -1492,7 +1492,7 @@ int __mptcp_subflow_connect(struct sock + if (!mptcp_is_fully_established(sk)) + goto err_out; + +- err = mptcp_subflow_create_socket(sk, &sf); ++ err = mptcp_subflow_create_socket(sk, loc->family, &sf); + if (err) + goto err_out; + +@@ -1604,7 +1604,9 @@ static void mptcp_subflow_ops_undo_overr + #endif + ssk->sk_prot = &tcp_prot; + } +-int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock) ++ ++int mptcp_subflow_create_socket(struct sock *sk, unsigned short family, ++ struct socket **new_sock) + { + struct mptcp_subflow_context *subflow; + struct net *net = sock_net(sk); +@@ -1617,8 +1619,7 @@ int mptcp_subflow_create_socket(struct s + if (unlikely(!sk->sk_socket)) + return -EINVAL; + +- err = sock_create_kern(net, sk->sk_family, SOCK_STREAM, IPPROTO_TCP, +- &sf); ++ err = sock_create_kern(net, family, SOCK_STREAM, IPPROTO_TCP, &sf); + if (err) + return err; + diff --git a/queue-6.1/mptcp-netlink-respect-v4-v6-only-sockets.patch b/queue-6.1/mptcp-netlink-respect-v4-v6-only-sockets.patch new file mode 100644 index 00000000000..320e4f56809 --- /dev/null +++ b/queue-6.1/mptcp-netlink-respect-v4-v6-only-sockets.patch @@ -0,0 +1,105 @@ +From fb00ee4f3343acb2b9222ca9b73b47dd1e1a8efc Mon Sep 17 00:00:00 2001 +From: Matthieu Baerts +Date: Thu, 12 Jan 2023 18:42:52 +0100 +Subject: mptcp: netlink: respect v4/v6-only sockets + +From: Matthieu Baerts + +commit fb00ee4f3343acb2b9222ca9b73b47dd1e1a8efc upstream. + +If an MPTCP socket has been created with AF_INET6 and the IPV6_V6ONLY +option has been set, the userspace PM would allow creating subflows +using IPv4 addresses, e.g. mapped in v6. + +The kernel side of userspace PM will also accept creating subflows with +local and remote addresses having different families. Depending on the +subflow socket's family, different behaviours are expected: + - If AF_INET is forced with a v6 address, the kernel will take the last + byte of the IP and try to connect to that: a new subflow is created + but to a non expected address. + - If AF_INET6 is forced with a v4 address, the kernel will try to + connect to a v4 address (v4-mapped-v6). A -EBADF error from the + connect() part is then expected. + +It is then required to check the given families can be accepted. This is +done by using a new helper for addresses family matching, taking care of +IPv4 vs IPv4-mapped-IPv6 addresses. This helper will be re-used later by +the in-kernel path-manager to use mixed IPv4 and IPv6 addresses. + +While at it, a clear error message is now reported if there are some +conflicts with the families that have been passed by the userspace. + +Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/pm.c | 25 +++++++++++++++++++++++++ + net/mptcp/pm_userspace.c | 7 +++++++ + net/mptcp/protocol.h | 3 +++ + 3 files changed, 35 insertions(+) + +--- a/net/mptcp/pm.c ++++ b/net/mptcp/pm.c +@@ -420,6 +420,31 @@ void mptcp_pm_subflow_chk_stale(const st + } + } + ++/* if sk is ipv4 or ipv6_only allows only same-family local and remote addresses, ++ * otherwise allow any matching local/remote pair ++ */ ++bool mptcp_pm_addr_families_match(const struct sock *sk, ++ const struct mptcp_addr_info *loc, ++ const struct mptcp_addr_info *rem) ++{ ++ bool mptcp_is_v4 = sk->sk_family == AF_INET; ++ ++#if IS_ENABLED(CONFIG_MPTCP_IPV6) ++ bool loc_is_v4 = loc->family == AF_INET || ipv6_addr_v4mapped(&loc->addr6); ++ bool rem_is_v4 = rem->family == AF_INET || ipv6_addr_v4mapped(&rem->addr6); ++ ++ if (mptcp_is_v4) ++ return loc_is_v4 && rem_is_v4; ++ ++ if (ipv6_only_sock(sk)) ++ return !loc_is_v4 && !rem_is_v4; ++ ++ return loc_is_v4 == rem_is_v4; ++#else ++ return mptcp_is_v4 && loc->family == AF_INET && rem->family == AF_INET; ++#endif ++} ++ + void mptcp_pm_data_reset(struct mptcp_sock *msk) + { + u8 pm_type = mptcp_get_pm_type(sock_net((struct sock *)msk)); +--- a/net/mptcp/pm_userspace.c ++++ b/net/mptcp/pm_userspace.c +@@ -294,6 +294,13 @@ int mptcp_nl_cmd_sf_create(struct sk_buf + } + + sk = &msk->sk.icsk_inet.sk; ++ ++ if (!mptcp_pm_addr_families_match(sk, &addr_l, &addr_r)) { ++ GENL_SET_ERR_MSG(info, "families mismatch"); ++ err = -EINVAL; ++ goto create_err; ++ } ++ + lock_sock(sk); + + err = __mptcp_subflow_connect(sk, &addr_l, &addr_r); +--- a/net/mptcp/protocol.h ++++ b/net/mptcp/protocol.h +@@ -762,6 +762,9 @@ int mptcp_pm_parse_addr(struct nlattr *a + int mptcp_pm_parse_entry(struct nlattr *attr, struct genl_info *info, + bool require_family, + struct mptcp_pm_addr_entry *entry); ++bool mptcp_pm_addr_families_match(const struct sock *sk, ++ const struct mptcp_addr_info *loc, ++ const struct mptcp_addr_info *rem); + void mptcp_pm_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk); + void mptcp_pm_nl_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk); + void mptcp_pm_new_connection(struct mptcp_sock *msk, const struct sock *ssk, int server_side); diff --git a/queue-6.1/pktcdvd-check-for-null-returna-fter-calling-bio_split_to_limits.patch b/queue-6.1/pktcdvd-check-for-null-returna-fter-calling-bio_split_to_limits.patch new file mode 100644 index 00000000000..7c218556f01 --- /dev/null +++ b/queue-6.1/pktcdvd-check-for-null-returna-fter-calling-bio_split_to_limits.patch @@ -0,0 +1,36 @@ +From 3e9900f3bd7ba30d60f82b162b70a1dffe4e8e24 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Mon, 16 Jan 2023 08:51:05 -0700 +Subject: pktcdvd: check for NULL returna fter calling bio_split_to_limits() + +From: Jens Axboe + +commit 3e9900f3bd7ba30d60f82b162b70a1dffe4e8e24 upstream. + +The revert of the removal of this driver happened after we fixed up +the split limits for NOWAIT issue, hence it got missed. Ensure that +we check for a NULL bio after splitting, in case it should be retried. + +Marking this as fixing both commits, so that stable backport will do +this correctly. + +Cc: stable@vger.kernel.org +Fixes: 9cea62b2cbab ("block: don't allow splitting of a REQ_NOWAIT bio") +Fixes: 4b83e99ee709 ("Revert "pktcdvd: remove driver."") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/pktcdvd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/block/pktcdvd.c ++++ b/drivers/block/pktcdvd.c +@@ -2400,6 +2400,8 @@ static void pkt_submit_bio(struct bio *b + struct bio *split; + + bio = bio_split_to_limits(bio); ++ if (!bio) ++ return; + + pkt_dbg(2, pd, "start = %6llx stop = %6llx\n", + (unsigned long long)bio->bi_iter.bi_sector, diff --git a/queue-6.1/selftests-mptcp-userspace-validate-v4-v6-subflows-mix.patch b/queue-6.1/selftests-mptcp-userspace-validate-v4-v6-subflows-mix.patch new file mode 100644 index 00000000000..00cb5086ded --- /dev/null +++ b/queue-6.1/selftests-mptcp-userspace-validate-v4-v6-subflows-mix.patch @@ -0,0 +1,88 @@ +From 4656d72c1efa495a58ad6d8b073a60907073e4e6 Mon Sep 17 00:00:00 2001 +From: Matthieu Baerts +Date: Thu, 12 Jan 2023 18:42:53 +0100 +Subject: selftests: mptcp: userspace: validate v4-v6 subflows mix + +From: Matthieu Baerts + +commit 4656d72c1efa495a58ad6d8b073a60907073e4e6 upstream. + +MPTCP protocol supports having subflows in both IPv4 and IPv6. In Linux, +it is possible to have that if the MPTCP socket has been created with +AF_INET6 family without the IPV6_V6ONLY option. + +Here, a new IPv4 subflow is being added to the initial IPv6 connection, +then being removed using Netlink commands. + +Cc: stable@vger.kernel.org # v5.19+ +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/userspace_pm.sh | 47 ++++++++++++++++++++++ + 1 file changed, 47 insertions(+) + +--- a/tools/testing/selftests/net/mptcp/userspace_pm.sh ++++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh +@@ -776,6 +776,52 @@ test_subflows() + rm -f "$evts" + } + ++test_subflows_v4_v6_mix() ++{ ++ # Attempt to add a listener at 10.0.2.1: ++ ip netns exec "$ns1" ./pm_nl_ctl listen 10.0.2.1\ ++ $app6_port > /dev/null 2>&1 & ++ local listener_pid=$! ++ ++ # ADD_ADDR4 from server to client machine reusing the subflow port on ++ # the established v6 connection ++ :>"$client_evts" ++ ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server6_token" id\ ++ $server_addr_id dev ns1eth2 > /dev/null 2>&1 ++ stdbuf -o0 -e0 printf "ADD_ADDR4 id:%d 10.0.2.1 (ns1) => ns2, reuse port\t\t" $server_addr_id ++ sleep 0.5 ++ verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "10.0.2.1"\ ++ "$server_addr_id" "$app6_port" ++ ++ # CREATE_SUBFLOW from client to server machine ++ :>"$client_evts" ++ ip netns exec "$ns2" ./pm_nl_ctl csf lip 10.0.2.2 lid 23 rip 10.0.2.1 rport\ ++ $app6_port token "$client6_token" > /dev/null 2>&1 ++ sleep 0.5 ++ verify_subflow_events "$client_evts" "$SUB_ESTABLISHED" "$client6_token"\ ++ "$AF_INET" "10.0.2.2" "10.0.2.1" "$app6_port" "23"\ ++ "$server_addr_id" "ns2" "ns1" ++ ++ # Delete the listener from the server ns, if one was created ++ kill_wait $listener_pid ++ ++ sport=$(sed --unbuffered -n 's/.*\(sport:\)\([[:digit:]]*\).*$/\2/p;q' "$client_evts") ++ ++ # DESTROY_SUBFLOW from client to server machine ++ :>"$client_evts" ++ ip netns exec "$ns2" ./pm_nl_ctl dsf lip 10.0.2.2 lport "$sport" rip 10.0.2.1 rport\ ++ $app6_port token "$client6_token" > /dev/null 2>&1 ++ sleep 0.5 ++ verify_subflow_events "$client_evts" "$SUB_CLOSED" "$client6_token" \ ++ "$AF_INET" "10.0.2.2" "10.0.2.1" "$app6_port" "23"\ ++ "$server_addr_id" "ns2" "ns1" ++ ++ # RM_ADDR from server to client machine ++ ip netns exec "$ns1" ./pm_nl_ctl rem id $server_addr_id token\ ++ "$server6_token" > /dev/null 2>&1 ++ sleep 0.5 ++} ++ + test_prio() + { + local count +@@ -812,6 +858,7 @@ make_connection "v6" + test_announce + test_remove + test_subflows ++test_subflows_v4_v6_mix + test_prio + + exit 0 diff --git a/queue-6.1/serial-amba-pl011-fix-high-priority-character-transmission-in-rs486-mode.patch b/queue-6.1/serial-amba-pl011-fix-high-priority-character-transmission-in-rs486-mode.patch new file mode 100644 index 00000000000..c6fb252fdb8 --- /dev/null +++ b/queue-6.1/serial-amba-pl011-fix-high-priority-character-transmission-in-rs486-mode.patch @@ -0,0 +1,47 @@ +From 4f39aca2360c82dccd2f5179d77e94aab665bea6 Mon Sep 17 00:00:00 2001 +From: Lino Sanfilippo +Date: Sun, 8 Jan 2023 19:17:35 +0100 +Subject: serial: amba-pl011: fix high priority character transmission in rs486 mode + +From: Lino Sanfilippo + +commit 4f39aca2360c82dccd2f5179d77e94aab665bea6 upstream. + +In RS485 mode the transmission of a high priority character fails since it +is written to the data register before the transmitter is enabled. Fix this +in pl011_tx_chars() by enabling RS485 transmission before writing the +character. + +Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support") +Cc: stable@vger.kernel.org +Signed-off-by: Lino Sanfilippo +Link: https://lore.kernel.org/r/20230108181735.10937-1-LinoSanfilippo@gmx.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/amba-pl011.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -1467,6 +1467,10 @@ static bool pl011_tx_chars(struct uart_a + struct circ_buf *xmit = &uap->port.state->xmit; + int count = uap->fifosize >> 1; + ++ if ((uap->port.rs485.flags & SER_RS485_ENABLED) && ++ !uap->rs485_tx_started) ++ pl011_rs485_tx_start(uap); ++ + if (uap->port.x_char) { + if (!pl011_tx_char(uap, uap->port.x_char, from_irq)) + return true; +@@ -1478,10 +1482,6 @@ static bool pl011_tx_chars(struct uart_a + return false; + } + +- if ((uap->port.rs485.flags & SER_RS485_ENABLED) && +- !uap->rs485_tx_started) +- pl011_rs485_tx_start(uap); +- + /* If we are using DMA mode, try to send some characters. */ + if (pl011_dma_tx_irq(uap)) + return true; diff --git a/queue-6.1/serial-atmel-fix-incorrect-baudrate-setup.patch b/queue-6.1/serial-atmel-fix-incorrect-baudrate-setup.patch new file mode 100644 index 00000000000..8307b198c7f --- /dev/null +++ b/queue-6.1/serial-atmel-fix-incorrect-baudrate-setup.patch @@ -0,0 +1,53 @@ +From 5bfdd3c654bd879bff50c2e85e42f85ae698b42f Mon Sep 17 00:00:00 2001 +From: Tobias Schramm +Date: Mon, 9 Jan 2023 08:29:40 +0100 +Subject: serial: atmel: fix incorrect baudrate setup + +From: Tobias Schramm + +commit 5bfdd3c654bd879bff50c2e85e42f85ae698b42f upstream. + +Commit ba47f97a18f2 ("serial: core: remove baud_rates when serial console +setup") changed uart_set_options to select the correct baudrate +configuration based on the absolute error between requested baudrate and +available standard baudrate settings. +Prior to that commit the baudrate was selected based on which predefined +standard baudrate did not exceed the requested baudrate. +This change of selection logic was never reflected in the atmel serial +driver. Thus the comment left in the atmel serial driver is no longer +accurate. +Additionally the manual rounding up described in that comment and applied +via (quot - 1) requests an incorrect baudrate. Since uart_set_options uses +tty_termios_encode_baud_rate to determine the appropriate baudrate flags +this can cause baudrate selection to fail entirely because +tty_termios_encode_baud_rate will only select a baudrate if relative error +between requested and selected baudrate does not exceed +/-2%. +Fix that by requesting actual, exact baudrate used by the serial. + +Fixes: ba47f97a18f2 ("serial: core: remove baud_rates when serial console setup") +Cc: stable +Signed-off-by: Tobias Schramm +Acked-by: Richard Genoud +Link: https://lore.kernel.org/r/20230109072940.202936-1-t.schramm@manjaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/atmel_serial.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -2673,13 +2673,7 @@ static void __init atmel_console_get_opt + else if (mr == ATMEL_US_PAR_ODD) + *parity = 'o'; + +- /* +- * The serial core only rounds down when matching this to a +- * supported baud rate. Make sure we don't end up slightly +- * lower than one of those, as it would make us fall through +- * to a much lower baud rate than we really want. +- */ +- *baud = port->uartclk / (16 * (quot - 1)); ++ *baud = port->uartclk / (16 * quot); + } + + static int __init atmel_console_setup(struct console *co, char *options) diff --git a/queue-6.1/serial-exar-add-support-for-sealevel-7xxxc-serial-cards.patch b/queue-6.1/serial-exar-add-support-for-sealevel-7xxxc-serial-cards.patch new file mode 100644 index 00000000000..3ea9bc429de --- /dev/null +++ b/queue-6.1/serial-exar-add-support-for-sealevel-7xxxc-serial-cards.patch @@ -0,0 +1,61 @@ +From 14ee78d5932afeb710c8305196a676a715bfdea8 Mon Sep 17 00:00:00 2001 +From: Matthew Howell +Date: Thu, 19 Jan 2023 14:40:29 -0500 +Subject: serial: exar: Add support for Sealevel 7xxxC serial cards + +From: Matthew Howell + +commit 14ee78d5932afeb710c8305196a676a715bfdea8 upstream. + +Add support for Sealevel 7xxxC serial cards. + +This patch: +* Adds IDs to recognize 7xxxC cards from Sealevel Systems. +* Updates exar_pci_probe() to set nr_ports to last two bytes of primary + dev ID for these cards. + +Signed-off-by: Matthew Howell +Cc: stable +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2301191440010.22558@tstest-VirtualBox +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_exar.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -43,6 +43,12 @@ + #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 + #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 + ++#define PCI_DEVICE_ID_SEALEVEL_710xC 0x1001 ++#define PCI_DEVICE_ID_SEALEVEL_720xC 0x1002 ++#define PCI_DEVICE_ID_SEALEVEL_740xC 0x1004 ++#define PCI_DEVICE_ID_SEALEVEL_780xC 0x1008 ++#define PCI_DEVICE_ID_SEALEVEL_716xC 0x1010 ++ + #define UART_EXAR_INT0 0x80 + #define UART_EXAR_8XMODE 0x88 /* 8X sampling rate select */ + #define UART_EXAR_SLEEP 0x8b /* Sleep mode */ +@@ -638,6 +644,8 @@ exar_pci_probe(struct pci_dev *pcidev, c + nr_ports = BIT(((pcidev->device & 0x38) >> 3) - 1); + else if (board->num_ports) + nr_ports = board->num_ports; ++ else if (pcidev->vendor == PCI_VENDOR_ID_SEALEVEL) ++ nr_ports = pcidev->device & 0xff; + else + nr_ports = pcidev->device & 0x0f; + +@@ -864,6 +872,12 @@ static const struct pci_device_id exar_p + EXAR_DEVICE(COMMTECH, 4224PCI335, pbn_fastcom335_4), + EXAR_DEVICE(COMMTECH, 2324PCI335, pbn_fastcom335_4), + EXAR_DEVICE(COMMTECH, 2328PCI335, pbn_fastcom335_8), ++ ++ EXAR_DEVICE(SEALEVEL, 710xC, pbn_exar_XR17V35x), ++ EXAR_DEVICE(SEALEVEL, 720xC, pbn_exar_XR17V35x), ++ EXAR_DEVICE(SEALEVEL, 740xC, pbn_exar_XR17V35x), ++ EXAR_DEVICE(SEALEVEL, 780xC, pbn_exar_XR17V35x), ++ EXAR_DEVICE(SEALEVEL, 716xC, pbn_exar_XR17V35x), + { 0, } + }; + MODULE_DEVICE_TABLE(pci, exar_pci_tbl); diff --git a/queue-6.1/serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch b/queue-6.1/serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch new file mode 100644 index 00000000000..56687c6c6d4 --- /dev/null +++ b/queue-6.1/serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch @@ -0,0 +1,41 @@ +From e8914b52e5b024e4af3d810a935fe0805eee8a36 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Tue, 3 Jan 2023 11:34:35 +0200 +Subject: serial: pch_uart: Pass correct sg to dma_unmap_sg() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit e8914b52e5b024e4af3d810a935fe0805eee8a36 upstream. + +A local variable sg is used to store scatterlist pointer in +pch_dma_tx_complete(). The for loop doing Tx byte accounting before +dma_unmap_sg() alters sg in its increment statement. Therefore, the +pointer passed into dma_unmap_sg() won't match to the one given to +dma_map_sg(). + +To fix the problem, use priv->sg_tx_p directly in dma_unmap_sg() +instead of the local variable. + +Fixes: da3564ee027e ("pch_uart: add multi-scatter processing") +Cc: stable@vger.kernel.org +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20230103093435.4396-1-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/pch_uart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -752,7 +752,7 @@ static void pch_dma_tx_complete(void *ar + } + xmit->tail &= UART_XMIT_SIZE - 1; + async_tx_ack(priv->desc_tx); +- dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE); ++ dma_unmap_sg(port->dev, priv->sg_tx_p, priv->orig_nent, DMA_TO_DEVICE); + priv->tx_dma_use = 0; + priv->nent = 0; + priv->orig_nent = 0; diff --git a/queue-6.1/series b/queue-6.1/series index 771e71c8459..af02e9e404b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -94,3 +94,51 @@ thunderbolt-do-not-report-errors-if-on-board-retimers-are-found.patch thunderbolt-do-not-call-pm-runtime-functions-in-tb_retimer_scan.patch riscv-dts-sifive-fu740-fix-size-of-pcie-32bit-memory.patch bpf-restore-the-ebpf-program-id-for-bpf_audit_unload-and-perf_bpf_event_prog_unload.patch +tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch +tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch +pktcdvd-check-for-null-returna-fter-calling-bio_split_to_limits.patch +io_uring-poll-don-t-reissue-in-case-of-poll-race-on-multishot-request.patch +mptcp-explicitly-specify-sock-family-at-subflow-creation-time.patch +mptcp-netlink-respect-v4-v6-only-sockets.patch +selftests-mptcp-userspace-validate-v4-v6-subflows-mix.patch +usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch +usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch +usb-cdns3-remove-fetched-trb-from-cache-before-dequeuing.patch +usb-host-ehci-fsl-fix-module-alias.patch +usb-musb-fix-error-return-code-in-omap2430_probe.patch +usb-typec-tcpm-fix-altmode-re-registration-causes-sysfs-create-fail.patch +usb-typec-altmodes-displayport-add-pin-assignment-helper.patch +usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch +usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch +usb-gadget-add-id-numbers-to-configfs-gadget-driver-names.patch +usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch +usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch +arm64-dts-imx8mp-correct-usb-clocks.patch +dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch +dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch +serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch +dmaengine-lgm-move-dt-parsing-after-initialization.patch +dmaengine-tegra210-adma-fix-global-intr-clear.patch +dmaengine-idxd-let-probe-fail-when-workqueue-cannot-be-enabled.patch +dmaengine-idxd-prevent-use-after-free-on-completion-memory.patch +dmaengine-idxd-do-not-call-dmx-tx-callbacks-during-workqueue-disable.patch +serial-amba-pl011-fix-high-priority-character-transmission-in-rs486-mode.patch +serial-atmel-fix-incorrect-baudrate-setup.patch +serial-exar-add-support-for-sealevel-7xxxc-serial-cards.patch +gsmi-fix-null-deref-in-gsmi_get_variable.patch +mei-bus-fix-unlink-on-bus-in-error-path.patch +mei-me-add-meteor-lake-point-m-did.patch +vmci-use-threaded-irqs-instead-of-tasklets.patch +arm-dts-qcom-apq8084-ifc6540-fix-overriding-sdhci.patch +arm-omap1-fix-arch_omap1_any-link-failures.patch +drm-amdgpu-fix-amdgpu_job_free_resources-v2.patch +drm-amdgpu-allow-multipipe-policy-on-asics-with-one-mec.patch +drm-amdgpu-correct-the-power-calcultion-for-renior-cezanne.patch +drm-i915-re-disable-rc6p-on-sandy-bridge.patch +drm-i915-display-check-source-height-is-0.patch +drm-i915-allow-switching-away-via-vga-switcheroo-if-uninitialized.patch +drm-amd-display-fix-set-scaling-doesn-s-work.patch +drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch +drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch +drm-amd-display-disable-s-g-display-on-dcn-3.1.5.patch +drm-amd-display-disable-s-g-display-on-dcn-3.1.4.patch diff --git a/queue-6.1/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch b/queue-6.1/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch new file mode 100644 index 00000000000..7dd32db417c --- /dev/null +++ b/queue-6.1/tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch @@ -0,0 +1,69 @@ +From 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5 Mon Sep 17 00:00:00 2001 +From: Gaosheng Cui +Date: Fri, 2 Dec 2022 14:06:33 +0800 +Subject: tty: fix possible null-ptr-defer in spk_ttyio_release + +From: Gaosheng Cui + +commit 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5 upstream. + +Run the following tests on the qemu platform: + +syzkaller:~# modprobe speakup_audptr + input: Speakup as /devices/virtual/input/input4 + initialized device: /dev/synth, node (MAJOR 10, MINOR 125) + speakup 3.1.6: initialized + synth name on entry is: (null) + synth probe + +spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned +failed (errno -16), then remove the module, we will get a null-ptr-defer +problem, as follow: + +syzkaller:~# modprobe -r speakup_audptr + releasing synth audptr + BUG: kernel NULL pointer dereference, address: 0000000000000080 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD 0 P4D 0 + Oops: 0002 [#1] PREEMPT SMP PTI + CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1 + RIP: 0010:mutex_lock+0x14/0x30 + Call Trace: + + spk_ttyio_release+0x19/0x70 [speakup] + synth_release.part.6+0xac/0xc0 [speakup] + synth_remove+0x56/0x60 [speakup] + __x64_sys_delete_module+0x156/0x250 + ? fpregs_assert_state_consistent+0x1d/0x50 + do_syscall_64+0x37/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + + Modules linked in: speakup_audptr(-) speakup + Dumping ftrace buffer: + +in_synth->dev was not initialized during modprobe, so we add check +for in_synth->dev to fix this bug. + +Fixes: 4f2a81f3a882 ("speakup: Reference synth from tty and tty from synth") +Cc: stable +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221202060633.217364-1-cuigaosheng1@huawei.com +Reviewed-by: Samuel Thibault +Signed-off-by: Greg Kroah-Hartman +--- + drivers/accessibility/speakup/spk_ttyio.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/accessibility/speakup/spk_ttyio.c ++++ b/drivers/accessibility/speakup/spk_ttyio.c +@@ -354,6 +354,9 @@ void spk_ttyio_release(struct spk_synth + { + struct tty_struct *tty = in_synth->dev; + ++ if (tty == NULL) ++ return; ++ + tty_lock(tty); + + if (tty->ops->close) diff --git a/queue-6.1/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch b/queue-6.1/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch new file mode 100644 index 00000000000..4f7d0cf73b0 --- /dev/null +++ b/queue-6.1/tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch @@ -0,0 +1,111 @@ +From b8caf69a6946e18ffebad49847e258f5b6d52ac2 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 21 Dec 2022 17:40:22 +0100 +Subject: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer + +From: Krzysztof Kozlowski + +commit b8caf69a6946e18ffebad49847e258f5b6d52ac2 upstream. + +Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on +default RX FIFO depth, e.g. 16. Later during serial startup the +qcom_geni_serial_port_setup() updates the RX FIFO depth +(port->rx_fifo_depth) to match real device capabilities, e.g. to 32. + +The RX UART handle code will read "port->rx_fifo_depth" number of words +into "port->rx_fifo" buffer, thus exceeding the bounds. This can be +observed in certain configurations with Qualcomm Bluetooth HCI UART +device and KASAN: + + Bluetooth: hci0: QCA Product ID :0x00000010 + Bluetooth: hci0: QCA SOC Version :0x400a0200 + Bluetooth: hci0: QCA ROM Version :0x00000200 + Bluetooth: hci0: QCA Patch Version:0x00000d2b + Bluetooth: hci0: QCA controller version 0x02000200 + Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv + bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 + Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) + Bluetooth: hci0: QCA Failed to download patch (-2) + ================================================================== + BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c + Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 + + CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 + Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) + Call trace: + dump_backtrace.part.0+0xe0/0xf0 + show_stack+0x18/0x40 + dump_stack_lvl+0x8c/0xb8 + print_report+0x188/0x488 + kasan_report+0xb4/0x100 + __asan_store4+0x80/0xa4 + handle_rx_uart+0xa8/0x18c + qcom_geni_serial_handle_rx+0x84/0x9c + qcom_geni_serial_isr+0x24c/0x760 + __handle_irq_event_percpu+0x108/0x500 + handle_irq_event+0x6c/0x110 + handle_fasteoi_irq+0x138/0x2cc + generic_handle_domain_irq+0x48/0x64 + +If the RX FIFO depth changes after probe, be sure to resize the buffer. + +Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe") +Cc: +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20221221164022.1087814-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -864,9 +864,10 @@ out_unlock: + return IRQ_HANDLED; + } + +-static void get_tx_fifo_size(struct qcom_geni_serial_port *port) ++static int setup_fifos(struct qcom_geni_serial_port *port) + { + struct uart_port *uport; ++ u32 old_rx_fifo_depth = port->rx_fifo_depth; + + uport = &port->uport; + port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se); +@@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom + port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se); + uport->fifosize = + (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE; ++ ++ if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) { ++ port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo, ++ port->rx_fifo_depth * sizeof(u32), ++ GFP_KERNEL); ++ if (!port->rx_fifo) ++ return -ENOMEM; ++ } ++ ++ return 0; + } + + +@@ -888,6 +899,7 @@ static int qcom_geni_serial_port_setup(s + u32 rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT; + u32 proto; + u32 pin_swap; ++ int ret; + + proto = geni_se_read_proto(&port->se); + if (proto != GENI_SE_UART) { +@@ -897,7 +909,9 @@ static int qcom_geni_serial_port_setup(s + + qcom_geni_serial_stop_rx(uport); + +- get_tx_fifo_size(port); ++ ret = setup_fifos(port); ++ if (ret) ++ return ret; + + writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT); + diff --git a/queue-6.1/usb-cdns3-remove-fetched-trb-from-cache-before-dequeuing.patch b/queue-6.1/usb-cdns3-remove-fetched-trb-from-cache-before-dequeuing.patch new file mode 100644 index 00000000000..2bd421fef7e --- /dev/null +++ b/queue-6.1/usb-cdns3-remove-fetched-trb-from-cache-before-dequeuing.patch @@ -0,0 +1,69 @@ +From 1301c7b9f7efad2f11ef924e317c18ebd714fc9a Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Tue, 15 Nov 2022 05:00:39 -0500 +Subject: usb: cdns3: remove fetched trb from cache before dequeuing + +From: Pawel Laszczak + +commit 1301c7b9f7efad2f11ef924e317c18ebd714fc9a upstream. + +After doorbell DMA fetches the TRB. If during dequeuing request +driver changes NORMAL TRB to LINK TRB but doesn't delete it from +controller cache then controller will handle cached TRB and packet +can be lost. + +The example scenario for this issue looks like: +1. queue request - set doorbell +2. dequeue request +3. send OUT data packet from host +4. Device will accept this packet which is unexpected +5. queue new request - set doorbell +6. Device lost the expected packet. + +By setting DFLUSH controller clears DRDY bit and stop DMA transfer. + +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +cc: +Signed-off-by: Pawel Laszczak +Acked-by: Peter Chen +Link: https://lore.kernel.org/r/20221115100039.441295-1-pawell@cadence.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -2614,6 +2614,7 @@ int cdns3_gadget_ep_dequeue(struct usb_e + u8 req_on_hw_ring = 0; + unsigned long flags; + int ret = 0; ++ int val; + + if (!ep || !request || !ep->desc) + return -EINVAL; +@@ -2649,6 +2650,13 @@ found: + + /* Update ring only if removed request is on pending_req_list list */ + if (req_on_hw_ring && link_trb) { ++ /* Stop DMA */ ++ writel(EP_CMD_DFLUSH, &priv_dev->regs->ep_cmd); ++ ++ /* wait for DFLUSH cleared */ ++ readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val, ++ !(val & EP_CMD_DFLUSH), 1, 1000); ++ + link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma + + ((priv_req->end_trb + 1) * TRB_SIZE))); + link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) | +@@ -2660,6 +2668,10 @@ found: + + cdns3_gadget_giveback(priv_ep, priv_req, -ECONNRESET); + ++ req = cdns3_next_request(&priv_ep->pending_req_list); ++ if (req) ++ cdns3_rearm_transfer(priv_ep, 1); ++ + not_found: + spin_unlock_irqrestore(&priv_dev->lock, flags); + return ret; diff --git a/queue-6.1/usb-gadget-add-id-numbers-to-configfs-gadget-driver-names.patch b/queue-6.1/usb-gadget-add-id-numbers-to-configfs-gadget-driver-names.patch new file mode 100644 index 00000000000..8399953de7a --- /dev/null +++ b/queue-6.1/usb-gadget-add-id-numbers-to-configfs-gadget-driver-names.patch @@ -0,0 +1,73 @@ +From 7c07553807c5125c89de242d35c10c206fd8e6bb Mon Sep 17 00:00:00 2001 +From: Chanh Nguyen +Date: Wed, 11 Jan 2023 13:51:05 +0700 +Subject: USB: gadget: Add ID numbers to configfs-gadget driver names + +From: Chanh Nguyen + +commit 7c07553807c5125c89de242d35c10c206fd8e6bb upstream. + +It is unable to use configfs to attach more than one gadget. When +attaching the second gadget, it always fails and the kernel message +prints out: + +Error: Driver 'configfs-gadget' is already registered, aborting... +UDC core: g1: driver registration failed: -16 + +This commit fixes the problem by using the gadget name as a suffix +to each configfs_gadget's driver name, thus making the names +distinct. + +Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets") +Cc: stable +Signed-off-by: Chanh Nguyen +Reviewed-by: Andrzej Pietrasiewicz +Tested-by: Heikki Krogerus +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20230111065105.29205-1-chanh@os.amperecomputing.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/configfs.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -392,6 +392,7 @@ static void gadget_info_attr_release(str + WARN_ON(!list_empty(&gi->string_list)); + WARN_ON(!list_empty(&gi->available_func)); + kfree(gi->composite.gadget_driver.function); ++ kfree(gi->composite.gadget_driver.driver.name); + kfree(gi); + } + +@@ -1571,7 +1572,6 @@ static const struct usb_gadget_driver co + .max_speed = USB_SPEED_SUPER_PLUS, + .driver = { + .owner = THIS_MODULE, +- .name = "configfs-gadget", + }, + .match_existing_only = 1, + }; +@@ -1622,13 +1622,21 @@ static struct config_group *gadgets_make + + gi->composite.gadget_driver = configfs_driver_template; + ++ gi->composite.gadget_driver.driver.name = kasprintf(GFP_KERNEL, ++ "configfs-gadget.%s", name); ++ if (!gi->composite.gadget_driver.driver.name) ++ goto err; ++ + gi->composite.gadget_driver.function = kstrdup(name, GFP_KERNEL); + gi->composite.name = gi->composite.gadget_driver.function; + + if (!gi->composite.gadget_driver.function) +- goto err; ++ goto out_free_driver_name; + + return &gi->group; ++ ++out_free_driver_name: ++ kfree(gi->composite.gadget_driver.driver.name); + err: + kfree(gi); + return ERR_PTR(-ENOMEM); diff --git a/queue-6.1/usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch b/queue-6.1/usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch new file mode 100644 index 00000000000..71d4b4ff49a --- /dev/null +++ b/queue-6.1/usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch @@ -0,0 +1,95 @@ +From c6ec929595c7443250b2a4faea988c62019d5cd2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= +Date: Tue, 17 Jan 2023 05:18:39 -0800 +Subject: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Żenczykowski + +commit c6ec929595c7443250b2a4faea988c62019d5cd2 upstream. + +In Google internal bug 265639009 we've received an (as yet) unreproducible +crash report from an aarch64 GKI 5.10.149-android13 running device. + +AFAICT the source code is at: + https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10 + +The call stack is: + ncm_close() -> ncm_notify() -> ncm_do_notify() +with the crash at: + ncm_do_notify+0x98/0x270 +Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b) + +Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...): + + // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification) + 0B 0D 00 79 strh w11, [x8, #6] + + // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request) + 6C 0A 00 B9 str w12, [x19, #8] + + // x10 (NULL) was read here from offset 0 of valid pointer x9 + // IMHO we're reading 'cdev->gadget' and getting NULL + // gadget is indeed at offset 0 of struct usb_composite_dev + 2A 01 40 F9 ldr x10, [x9] + + // loading req->buf pointer, which is at offset 0 of struct usb_request + 69 02 40 F9 ldr x9, [x19] + + // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed + 4B 5D 40 B9 ldr w11, [x10, #0x5c] + +which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment: + + event->wLength = cpu_to_le16(8); + req->length = NCM_STATUS_BYTECOUNT; + + /* SPEED_CHANGE data is up/down speeds in bits/sec */ + data = req->buf + sizeof *event; + data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); + +My analysis of registers and NULL ptr deref crash offset + (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c) +heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing: + data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); +which calls: + ncm_bitrate(NULL) +which then calls: + gadget_is_superspeed(NULL) +which reads + ((struct usb_gadget *)NULL)->max_speed +and hits a panic. + +AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C. +(remember there's a GKI KABI reservation of 16 bytes in struct work_struct) + +It's not at all clear to me how this is all supposed to work... +but returning 0 seems much better than panic-ing... + +Cc: Felipe Balbi +Cc: Lorenzo Colitti +Cc: Carlos Llamas +Cc: stable@vger.kernel.org +Signed-off-by: Maciej Żenczykowski +Cc: stable +Link: https://lore.kernel.org/r/20230117131839.1138208-1-maze@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_ncm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -83,7 +83,9 @@ static inline struct f_ncm *func_to_ncm( + /* peak (theoretical) bulk transfer rate in bits-per-second */ + static inline unsigned ncm_bitrate(struct usb_gadget *g) + { +- if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) ++ if (!g) ++ return 0; ++ else if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) + return 4250000000U; + else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) + return 3750000000U; diff --git a/queue-6.1/usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch b/queue-6.1/usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch new file mode 100644 index 00000000000..713f8b30f7c --- /dev/null +++ b/queue-6.1/usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch @@ -0,0 +1,59 @@ +From e95765e97d9cb93258a4840440d410fa6ff7e819 Mon Sep 17 00:00:00 2001 +From: Daniel Scally +Date: Fri, 16 Dec 2022 16:05:28 +0000 +Subject: usb: gadget: g_webcam: Send color matching descriptor per frame + +From: Daniel Scally + +commit e95765e97d9cb93258a4840440d410fa6ff7e819 upstream. + +Currently the color matching descriptor is only sent across the wire +a single time, following the descriptors for each format and frame. +According to the UVC 1.5 Specification 3.9.2.6 ("Color Matching +Descriptors"): + +"Only one instance is allowed for a given format and if present, +the Color Matching descriptor shall be placed following the Video +and Still Image Frame descriptors for that format". + +Add another reference to the color matching descriptor after the +yuyv frames so that it's correctly transmitted for that format +too. + +Fixes: a9914127e834 ("USB gadget: Webcam device") +Cc: stable +Signed-off-by: Daniel Scally +Reviewed-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Link: https://lore.kernel.org/r/20221216160528.479094-1-dan.scally@ideasonboard.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/legacy/webcam.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/gadget/legacy/webcam.c ++++ b/drivers/usb/gadget/legacy/webcam.c +@@ -293,6 +293,7 @@ static const struct uvc_descriptor_heade + (const struct uvc_descriptor_header *) &uvc_format_yuv, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, ++ (const struct uvc_descriptor_header *) &uvc_color_matching, + (const struct uvc_descriptor_header *) &uvc_format_mjpg, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p, +@@ -305,6 +306,7 @@ static const struct uvc_descriptor_heade + (const struct uvc_descriptor_header *) &uvc_format_yuv, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, ++ (const struct uvc_descriptor_header *) &uvc_color_matching, + (const struct uvc_descriptor_header *) &uvc_format_mjpg, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p, +@@ -317,6 +319,7 @@ static const struct uvc_descriptor_heade + (const struct uvc_descriptor_header *) &uvc_format_yuv, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, + (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, ++ (const struct uvc_descriptor_header *) &uvc_color_matching, + (const struct uvc_descriptor_header *) &uvc_format_mjpg, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, + (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p, diff --git a/queue-6.1/usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch b/queue-6.1/usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch new file mode 100644 index 00000000000..0e918990d37 --- /dev/null +++ b/queue-6.1/usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch @@ -0,0 +1,130 @@ +From d18dcfe9860e842f394e37ba01ca9440ab2178f4 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 23 Dec 2022 09:59:09 -0500 +Subject: USB: gadgetfs: Fix race between mounting and unmounting + +From: Alan Stern + +commit d18dcfe9860e842f394e37ba01ca9440ab2178f4 upstream. + +The syzbot fuzzer and Gerald Lee have identified a use-after-free bug +in the gadgetfs driver, involving processes concurrently mounting and +unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() +can race with gadgetfs_kill_sb(), causing the latter to deallocate +the_device while the former is using it. The output from KASAN says, +in part: + +BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] +BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] +BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline] +BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline] +BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline] +BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] +BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 +Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689 + +CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 +Call Trace: + +... + atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] + __refcount_sub_and_test include/linux/refcount.h:272 [inline] + __refcount_dec_and_test include/linux/refcount.h:315 [inline] + refcount_dec_and_test include/linux/refcount.h:333 [inline] + put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] + gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 + deactivate_locked_super+0xa7/0xf0 fs/super.c:332 + vfs_get_super fs/super.c:1190 [inline] + get_tree_single+0xd0/0x160 fs/super.c:1207 + vfs_get_tree+0x88/0x270 fs/super.c:1531 + vfs_fsconfig_locked fs/fsopen.c:232 [inline] + +The simplest solution is to ensure that gadgetfs_fill_super() and +gadgetfs_kill_sb() are serialized by making them both acquire a new +mutex. + +Signed-off-by: Alan Stern +Reported-and-tested-by: syzbot+33d7ad66d65044b93f16@syzkaller.appspotmail.com +Reported-and-tested-by: Gerald Lee +Link: https://lore.kernel.org/linux-usb/CAO3qeMVzXDP-JU6v1u5Ags6Q-bb35kg3=C6d04DjzA9ffa5x1g@mail.gmail.com/ +Fixes: e5d82a7360d1 ("vfs: Convert gadgetfs to use the new mount API") +CC: +Link: https://lore.kernel.org/r/Y6XCPXBpn3tmjdCC@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/legacy/inode.c | 28 +++++++++++++++++++++------- + 1 file changed, 21 insertions(+), 7 deletions(-) + +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -229,6 +229,7 @@ static void put_ep (struct ep_data *data + */ + + static const char *CHIP; ++static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */ + + /*----------------------------------------------------------------------*/ + +@@ -2010,13 +2011,20 @@ gadgetfs_fill_super (struct super_block + { + struct inode *inode; + struct dev_data *dev; ++ int rc; + +- if (the_device) +- return -ESRCH; ++ mutex_lock(&sb_mutex); ++ ++ if (the_device) { ++ rc = -ESRCH; ++ goto Done; ++ } + + CHIP = usb_get_gadget_udc_name(); +- if (!CHIP) +- return -ENODEV; ++ if (!CHIP) { ++ rc = -ENODEV; ++ goto Done; ++ } + + /* superblock */ + sb->s_blocksize = PAGE_SIZE; +@@ -2053,13 +2061,17 @@ gadgetfs_fill_super (struct super_block + * from binding to a controller. + */ + the_device = dev; +- return 0; ++ rc = 0; ++ goto Done; + +-Enomem: ++ Enomem: + kfree(CHIP); + CHIP = NULL; ++ rc = -ENOMEM; + +- return -ENOMEM; ++ Done: ++ mutex_unlock(&sb_mutex); ++ return rc; + } + + /* "mount -t gadgetfs path /dev/gadget" ends up here */ +@@ -2081,6 +2093,7 @@ static int gadgetfs_init_fs_context(stru + static void + gadgetfs_kill_sb (struct super_block *sb) + { ++ mutex_lock(&sb_mutex); + kill_litter_super (sb); + if (the_device) { + put_dev (the_device); +@@ -2088,6 +2101,7 @@ gadgetfs_kill_sb (struct super_block *sb + } + kfree(CHIP); + CHIP = NULL; ++ mutex_unlock(&sb_mutex); + } + + /*----------------------------------------------------------------------*/ diff --git a/queue-6.1/usb-host-ehci-fsl-fix-module-alias.patch b/queue-6.1/usb-host-ehci-fsl-fix-module-alias.patch new file mode 100644 index 00000000000..07aa139133d --- /dev/null +++ b/queue-6.1/usb-host-ehci-fsl-fix-module-alias.patch @@ -0,0 +1,36 @@ +From 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Fri, 20 Jan 2023 13:27:14 +0100 +Subject: usb: host: ehci-fsl: Fix module alias + +From: Alexander Stein + +commit 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c upstream. + +Commit ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent +driver module") changed DRV_NAME which was used for MODULE_ALIAS as well. +Starting from this the module alias didn't match the platform device +name created in fsl-mph-dr-of.c +Change DRV_NAME to match the driver name for host mode in fsl-mph-dr-of. +This is needed for module autoloading on ls1021a. + +Fixes: ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent driver module") +Cc: stable +Signed-off-by: Alexander Stein +Link: https://lore.kernel.org/r/20230120122714.3848784-1-alexander.stein@ew.tq-group.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ehci-fsl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/ehci-fsl.c ++++ b/drivers/usb/host/ehci-fsl.c +@@ -29,7 +29,7 @@ + #include "ehci-fsl.h" + + #define DRIVER_DESC "Freescale EHCI Host controller driver" +-#define DRV_NAME "ehci-fsl" ++#define DRV_NAME "fsl-ehci" + + static struct hc_driver __read_mostly fsl_ehci_hc_driver; + diff --git a/queue-6.1/usb-musb-fix-error-return-code-in-omap2430_probe.patch b/queue-6.1/usb-musb-fix-error-return-code-in-omap2430_probe.patch new file mode 100644 index 00000000000..ddab65da4d0 --- /dev/null +++ b/queue-6.1/usb-musb-fix-error-return-code-in-omap2430_probe.patch @@ -0,0 +1,41 @@ +From bd449ad8cee9d4b523abbdfa73e1a2a08333f331 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Fri, 30 Dec 2022 16:17:30 +0800 +Subject: usb: musb: fix error return code in omap2430_probe() + +From: Yang Yingliang + +commit bd449ad8cee9d4b523abbdfa73e1a2a08333f331 upstream. + +Before calling platform_get_resource() in omap2430_probe(), the 'ret' is +re-assgined to 0, it can't return an error code, if platform_get_resource +fails. Set the error code to -EINVAL to fix this. + +Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources") +Cc: stable +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221230081730.1655616-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/omap2430.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c +index 476f55d1fec3..44a21ec865fb 100644 +--- a/drivers/usb/musb/omap2430.c ++++ b/drivers/usb/musb/omap2430.c +@@ -411,8 +411,10 @@ static int omap2430_probe(struct platform_device *pdev) + memset(musb_res, 0, sizeof(*musb_res) * ARRAY_SIZE(musb_res)); + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- if (!res) ++ if (!res) { ++ ret = -EINVAL; + goto err2; ++ } + + musb_res[i].start = res->start; + musb_res[i].end = res->end; +-- +2.39.1 + diff --git a/queue-6.1/usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch b/queue-6.1/usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch new file mode 100644 index 00000000000..636ca118cca --- /dev/null +++ b/queue-6.1/usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch @@ -0,0 +1,30 @@ +From 3f9e76e31704a325170e5aec2243c8d084d74854 Mon Sep 17 00:00:00 2001 +From: Michael Adler +Date: Tue, 3 Jan 2023 14:48:50 +0100 +Subject: USB: serial: cp210x: add SCALANCE LPE-9000 device id + +From: Michael Adler + +commit 3f9e76e31704a325170e5aec2243c8d084d74854 upstream. + +Add the USB serial console device ID for Siemens SCALANCE LPE-9000 +which have a USB port for their serial console. + +Signed-off-by: Michael Adler +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -60,6 +60,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ + { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ + { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ ++ { USB_DEVICE(0x0908, 0x0070) }, /* Siemens SCALANCE LPE-9000 USB Serial Console */ + { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ + { USB_DEVICE(0x0988, 0x0578) }, /* Teraoka AD2000 */ + { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */ diff --git a/queue-6.1/usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch b/queue-6.1/usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch new file mode 100644 index 00000000000..26c6e3ef6e1 --- /dev/null +++ b/queue-6.1/usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch @@ -0,0 +1,77 @@ +From dbd24ec17b85b45f4e823d1aa5607721920f2b05 Mon Sep 17 00:00:00 2001 +From: Juhyung Park +Date: Tue, 17 Jan 2023 17:51:54 +0900 +Subject: usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210 + +From: Juhyung Park + +commit dbd24ec17b85b45f4e823d1aa5607721920f2b05 upstream. + +The commit e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS") +blacklists UAS for all of RTL9210 enclosures. + +The RTL9210 controller was advertised with UAS since its release back in +2019 and was shipped with a lot of enclosure products with different +firmware combinations. + +Blacklist UAS only for HIKSEMI MD202. + +This should hopefully be replaced with more robust method than just +comparing strings. But with limited information [1] provided thus far +(dmesg when the device is plugged in, which includes manufacturer and +product, but no lsusb -v to compare against), this is the best we can do +for now. + +[1] https://lore.kernel.org/all/20230109115550.71688-1-qkrwngud825@gmail.com + +Fixes: e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS") +Cc: Alan Stern +Cc: Hongling Zeng +Cc: stable@vger.kernel.org +Signed-off-by: Juhyung Park +Acked-by: Oliver Neukum +Link: https://lore.kernel.org/r/20230117085154.123301-1-qkrwngud825@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/uas-detect.h | 13 +++++++++++++ + drivers/usb/storage/unusual_uas.h | 7 ------- + 2 files changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/usb/storage/uas-detect.h ++++ b/drivers/usb/storage/uas-detect.h +@@ -116,6 +116,19 @@ static int uas_use_uas_driver(struct usb + if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2) + flags |= US_FL_NO_ATA_1X; + ++ /* ++ * RTL9210-based enclosure from HIKSEMI, MD202 reportedly have issues ++ * with UAS. This isn't distinguishable with just idVendor and ++ * idProduct, use manufacturer and product too. ++ * ++ * Reported-by: Hongling Zeng ++ */ ++ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bda && ++ le16_to_cpu(udev->descriptor.idProduct) == 0x9210 && ++ (udev->manufacturer && !strcmp(udev->manufacturer, "HIKSEMI")) && ++ (udev->product && !strcmp(udev->product, "MD202"))) ++ flags |= US_FL_IGNORE_UAS; ++ + usb_stor_adjust_quirks(udev, &flags); + + if (flags & US_FL_IGNORE_UAS) { +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -83,13 +83,6 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x99 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_REPORT_LUNS), + +-/* Reported-by: Hongling Zeng */ +-UNUSUAL_DEV(0x0bda, 0x9210, 0x0000, 0x9999, +- "Hiksemi", +- "External HDD", +- USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_IGNORE_UAS), +- + /* Reported-by: Benjamin Tissoires */ + UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, + "Initio Corporation", diff --git a/queue-6.1/usb-typec-altmodes-displayport-add-pin-assignment-helper.patch b/queue-6.1/usb-typec-altmodes-displayport-add-pin-assignment-helper.patch new file mode 100644 index 00000000000..3c0824ccab5 --- /dev/null +++ b/queue-6.1/usb-typec-altmodes-displayport-add-pin-assignment-helper.patch @@ -0,0 +1,73 @@ +From 582836e3cfab4faafbdc93bbec96fce036a08ee1 Mon Sep 17 00:00:00 2001 +From: Prashant Malani +Date: Wed, 11 Jan 2023 02:05:41 +0000 +Subject: usb: typec: altmodes/displayport: Add pin assignment helper + +From: Prashant Malani + +commit 582836e3cfab4faafbdc93bbec96fce036a08ee1 upstream. + +The code to extract a peripheral's currently supported Pin Assignments +is repeated in a couple of locations. Factor it out into a separate +function. + +This will also make it easier to add fixes (we only need to update 1 +location instead of 2). + +Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") +Cc: stable@vger.kernel.org +Cc: Heikki Krogerus +Signed-off-by: Prashant Malani +Reviewed-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230111020546.3384569-1-pmalani@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -419,6 +419,18 @@ static const char * const pin_assignment + [DP_PIN_ASSIGN_F] = "F", + }; + ++/* ++ * Helper function to extract a peripheral's currently supported ++ * Pin Assignments from its DisplayPort alternate mode state. ++ */ ++static u8 get_current_pin_assignments(struct dp_altmode *dp) ++{ ++ if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D) ++ return DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo); ++ else ++ return DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo); ++} ++ + static ssize_t + pin_assignment_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t size) +@@ -445,10 +457,7 @@ pin_assignment_store(struct device *dev, + goto out_unlock; + } + +- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D) +- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo); +- else +- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo); ++ assignments = get_current_pin_assignments(dp); + + if (!(DP_CONF_GET_PIN_ASSIGN(conf) & assignments)) { + ret = -EINVAL; +@@ -485,10 +494,7 @@ static ssize_t pin_assignment_show(struc + + cur = get_count_order(DP_CONF_GET_PIN_ASSIGN(dp->data.conf)); + +- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D) +- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo); +- else +- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo); ++ assignments = get_current_pin_assignments(dp); + + for (i = 0; assignments; assignments >>= 1, i++) { + if (assignments & 1) { diff --git a/queue-6.1/usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch b/queue-6.1/usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch new file mode 100644 index 00000000000..93582e75877 --- /dev/null +++ b/queue-6.1/usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch @@ -0,0 +1,43 @@ +From 9682b41e52cc9f42f5c33caf410464392adaef04 Mon Sep 17 00:00:00 2001 +From: Prashant Malani +Date: Wed, 11 Jan 2023 02:05:42 +0000 +Subject: usb: typec: altmodes/displayport: Fix pin assignment calculation + +From: Prashant Malani + +commit 9682b41e52cc9f42f5c33caf410464392adaef04 upstream. + +Commit c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin +assignment for UFP receptacles") fixed the pin assignment calculation +to take into account whether the peripheral was a plug or a receptacle. + +But the "pin_assignments" sysfs logic was not updated. Address this by +using the macros introduced in the aforementioned commit in the sysfs +logic too. + +Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") +Cc: stable@vger.kernel.org +Cc: Heikki Krogerus +Signed-off-by: Prashant Malani +Reviewed-by: Benson Leung +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230111020546.3384569-2-pmalani@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -426,9 +426,9 @@ static const char * const pin_assignment + static u8 get_current_pin_assignments(struct dp_altmode *dp) + { + if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D) +- return DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo); ++ return DP_CAP_PIN_ASSIGN_DFP_D(dp->alt->vdo); + else +- return DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo); ++ return DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo); + } + + static ssize_t diff --git a/queue-6.1/usb-typec-tcpm-fix-altmode-re-registration-causes-sysfs-create-fail.patch b/queue-6.1/usb-typec-tcpm-fix-altmode-re-registration-causes-sysfs-create-fail.patch new file mode 100644 index 00000000000..c0f97a3d453 --- /dev/null +++ b/queue-6.1/usb-typec-tcpm-fix-altmode-re-registration-causes-sysfs-create-fail.patch @@ -0,0 +1,60 @@ +From 36f78477ac2c89e9a2eed4a31404a291a3450b5d Mon Sep 17 00:00:00 2001 +From: ChiYuan Huang +Date: Mon, 9 Jan 2023 15:19:50 +0800 +Subject: usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail + +From: ChiYuan Huang + +commit 36f78477ac2c89e9a2eed4a31404a291a3450b5d upstream. + +There's the altmode re-registeration issue after data role +swap (DR_SWAP). + +Comparing to USBPD 2.0, in USBPD 3.0, it loose the limit that only DFP +can initiate the VDM command to get partner identity information. + +For a USBPD 3.0 UFP device, it may already get the identity information +from its port partner before DR_SWAP. If DR_SWAP send or receive at the +mean time, 'send_discover' flag will be raised again. It causes discover +identify action restart while entering ready state. And after all +discover actions are done, the 'tcpm_register_altmodes' will be called. +If old altmode is not unregistered, this sysfs create fail can be found. + +In 'DR_SWAP_CHANGE_DR' state case, only DFP will unregister altmodes. +For UFP, the original altmodes keep registered. + +This patch fix the logic that after DR_SWAP, 'tcpm_unregister_altmodes' +must be called whatever the current data role is. + +Reviewed-by: Macpaul Lin +Fixes: ae8a2ca8a221 ("usb: typec: Group all TCPCI/TCPM code together") +Reported-by: TommyYl Chen +Cc: stable@vger.kernel.org +Signed-off-by: ChiYuan Huang +Acked-by: Heikki Krogerus +Link: https://lore.kernel.org/r/1673248790-15794-1-git-send-email-cy_huang@richtek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4594,14 +4594,13 @@ static void run_state_machine(struct tcp + tcpm_set_state(port, ready_state(port), 0); + break; + case DR_SWAP_CHANGE_DR: +- if (port->data_role == TYPEC_HOST) { +- tcpm_unregister_altmodes(port); ++ tcpm_unregister_altmodes(port); ++ if (port->data_role == TYPEC_HOST) + tcpm_set_roles(port, true, port->pwr_role, + TYPEC_DEVICE); +- } else { ++ else + tcpm_set_roles(port, true, port->pwr_role, + TYPEC_HOST); +- } + tcpm_ams_finish(port); + tcpm_set_state(port, ready_state(port), 0); + break; diff --git a/queue-6.1/vmci-use-threaded-irqs-instead-of-tasklets.patch b/queue-6.1/vmci-use-threaded-irqs-instead-of-tasklets.patch new file mode 100644 index 00000000000..3a07c30b041 --- /dev/null +++ b/queue-6.1/vmci-use-threaded-irqs-instead-of-tasklets.patch @@ -0,0 +1,229 @@ +From 3daed6345d5880464f46adab871d208e1baa2f3a Mon Sep 17 00:00:00 2001 +From: Vishnu Dasa +Date: Tue, 29 Nov 2022 23:05:11 -0800 +Subject: VMCI: Use threaded irqs instead of tasklets + +From: Vishnu Dasa + +commit 3daed6345d5880464f46adab871d208e1baa2f3a upstream. + +The vmci_dispatch_dgs() tasklet function calls vmci_read_data() +which uses wait_event() resulting in invalid sleep in an atomic +context (and therefore potentially in a deadlock). + +Use threaded irqs to fix this issue and completely remove usage +of tasklets. + +[ 20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145 +[ 20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd +[ 20.264645] preempt_count: 101, expected: 0 +[ 20.264646] RCU nest depth: 0, expected: 0 +[ 20.264647] 1 lock held by vmtoolsd/762: +[ 20.264648] #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock] +[ 20.264658] Preemption disabled at: +[ 20.264659] [] vmci_send_datagram+0x44/0xa0 [vmw_vmci] +[ 20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1 +[ 20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020 +[ 20.264668] Call trace: +[ 20.264669] dump_backtrace+0xc4/0x130 +[ 20.264672] show_stack+0x24/0x80 +[ 20.264673] dump_stack_lvl+0x88/0xb4 +[ 20.264676] dump_stack+0x18/0x34 +[ 20.264677] __might_resched+0x1a0/0x280 +[ 20.264679] __might_sleep+0x58/0x90 +[ 20.264681] vmci_read_data+0x74/0x120 [vmw_vmci] +[ 20.264683] vmci_dispatch_dgs+0x64/0x204 [vmw_vmci] +[ 20.264686] tasklet_action_common.constprop.0+0x13c/0x150 +[ 20.264688] tasklet_action+0x40/0x50 +[ 20.264689] __do_softirq+0x23c/0x6b4 +[ 20.264690] __irq_exit_rcu+0x104/0x214 +[ 20.264691] irq_exit_rcu+0x1c/0x50 +[ 20.264693] el1_interrupt+0x38/0x6c +[ 20.264695] el1h_64_irq_handler+0x18/0x24 +[ 20.264696] el1h_64_irq+0x68/0x6c +[ 20.264697] preempt_count_sub+0xa4/0xe0 +[ 20.264698] _raw_spin_unlock_irqrestore+0x64/0xb0 +[ 20.264701] vmci_send_datagram+0x7c/0xa0 [vmw_vmci] +[ 20.264703] vmci_datagram_dispatch+0x84/0x100 [vmw_vmci] +[ 20.264706] vmci_datagram_send+0x2c/0x40 [vmw_vmci] +[ 20.264709] vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport] +[ 20.264711] vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport] +[ 20.264713] vsock_connect+0x278/0x330 [vsock] +[ 20.264715] __sys_connect_file+0x8c/0xc0 +[ 20.264718] __sys_connect+0x84/0xb4 +[ 20.264720] __arm64_sys_connect+0x2c/0x3c +[ 20.264721] invoke_syscall+0x78/0x100 +[ 20.264723] el0_svc_common.constprop.0+0x68/0x124 +[ 20.264724] do_el0_svc+0x38/0x4c +[ 20.264725] el0_svc+0x60/0x180 +[ 20.264726] el0t_64_sync_handler+0x11c/0x150 +[ 20.264728] el0t_64_sync+0x190/0x194 + +Signed-off-by: Vishnu Dasa +Suggested-by: Zack Rusin +Reported-by: Nadav Amit +Reported-by: Nathan Chancellor +Tested-by: Nathan Chancellor +Fixes: 463713eb6164 ("VMCI: dma dg: add support for DMA datagrams receive") +Cc: # v5.18+ +Cc: VMware PV-Drivers Reviewers +Cc: Greg Kroah-Hartman +Cc: Bryan Tan +Reviewed-by: Bryan Tan +Reviewed-by: Zack Rusin +Link: https://lore.kernel.org/r/20221130070511.46558-1-vdasa@vmware.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/vmw_vmci/vmci_guest.c | 49 ++++++++++++------------------ + 1 file changed, 19 insertions(+), 30 deletions(-) + +diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c +index aa7b05de97dd..4f8d962bb5b2 100644 +--- a/drivers/misc/vmw_vmci/vmci_guest.c ++++ b/drivers/misc/vmw_vmci/vmci_guest.c +@@ -56,8 +56,6 @@ struct vmci_guest_device { + + bool exclusive_vectors; + +- struct tasklet_struct datagram_tasklet; +- struct tasklet_struct bm_tasklet; + struct wait_queue_head inout_wq; + + void *data_buffer; +@@ -304,9 +302,8 @@ static int vmci_check_host_caps(struct pci_dev *pdev) + * This function assumes that it has exclusive access to the data + * in register(s) for the duration of the call. + */ +-static void vmci_dispatch_dgs(unsigned long data) ++static void vmci_dispatch_dgs(struct vmci_guest_device *vmci_dev) + { +- struct vmci_guest_device *vmci_dev = (struct vmci_guest_device *)data; + u8 *dg_in_buffer = vmci_dev->data_buffer; + struct vmci_datagram *dg; + size_t dg_in_buffer_size = VMCI_MAX_DG_SIZE; +@@ -465,10 +462,8 @@ static void vmci_dispatch_dgs(unsigned long data) + * Scans the notification bitmap for raised flags, clears them + * and handles the notifications. + */ +-static void vmci_process_bitmap(unsigned long data) ++static void vmci_process_bitmap(struct vmci_guest_device *dev) + { +- struct vmci_guest_device *dev = (struct vmci_guest_device *)data; +- + if (!dev->notification_bitmap) { + dev_dbg(dev->dev, "No bitmap present in %s\n", __func__); + return; +@@ -486,13 +481,13 @@ static irqreturn_t vmci_interrupt(int irq, void *_dev) + struct vmci_guest_device *dev = _dev; + + /* +- * If we are using MSI-X with exclusive vectors then we simply schedule +- * the datagram tasklet, since we know the interrupt was meant for us. ++ * If we are using MSI-X with exclusive vectors then we simply call ++ * vmci_dispatch_dgs(), since we know the interrupt was meant for us. + * Otherwise we must read the ICR to determine what to do. + */ + + if (dev->exclusive_vectors) { +- tasklet_schedule(&dev->datagram_tasklet); ++ vmci_dispatch_dgs(dev); + } else { + unsigned int icr; + +@@ -502,12 +497,12 @@ static irqreturn_t vmci_interrupt(int irq, void *_dev) + return IRQ_NONE; + + if (icr & VMCI_ICR_DATAGRAM) { +- tasklet_schedule(&dev->datagram_tasklet); ++ vmci_dispatch_dgs(dev); + icr &= ~VMCI_ICR_DATAGRAM; + } + + if (icr & VMCI_ICR_NOTIFICATION) { +- tasklet_schedule(&dev->bm_tasklet); ++ vmci_process_bitmap(dev); + icr &= ~VMCI_ICR_NOTIFICATION; + } + +@@ -536,7 +531,7 @@ static irqreturn_t vmci_interrupt_bm(int irq, void *_dev) + struct vmci_guest_device *dev = _dev; + + /* For MSI-X we can just assume it was meant for us. */ +- tasklet_schedule(&dev->bm_tasklet); ++ vmci_process_bitmap(dev); + + return IRQ_HANDLED; + } +@@ -638,10 +633,6 @@ static int vmci_guest_probe_device(struct pci_dev *pdev, + vmci_dev->iobase = iobase; + vmci_dev->mmio_base = mmio_base; + +- tasklet_init(&vmci_dev->datagram_tasklet, +- vmci_dispatch_dgs, (unsigned long)vmci_dev); +- tasklet_init(&vmci_dev->bm_tasklet, +- vmci_process_bitmap, (unsigned long)vmci_dev); + init_waitqueue_head(&vmci_dev->inout_wq); + + if (mmio_base != NULL) { +@@ -808,8 +799,9 @@ static int vmci_guest_probe_device(struct pci_dev *pdev, + * Request IRQ for legacy or MSI interrupts, or for first + * MSI-X vector. + */ +- error = request_irq(pci_irq_vector(pdev, 0), vmci_interrupt, +- IRQF_SHARED, KBUILD_MODNAME, vmci_dev); ++ error = request_threaded_irq(pci_irq_vector(pdev, 0), NULL, ++ vmci_interrupt, IRQF_SHARED, ++ KBUILD_MODNAME, vmci_dev); + if (error) { + dev_err(&pdev->dev, "Irq %u in use: %d\n", + pci_irq_vector(pdev, 0), error); +@@ -823,9 +815,9 @@ static int vmci_guest_probe_device(struct pci_dev *pdev, + * between the vectors. + */ + if (vmci_dev->exclusive_vectors) { +- error = request_irq(pci_irq_vector(pdev, 1), +- vmci_interrupt_bm, 0, KBUILD_MODNAME, +- vmci_dev); ++ error = request_threaded_irq(pci_irq_vector(pdev, 1), NULL, ++ vmci_interrupt_bm, 0, ++ KBUILD_MODNAME, vmci_dev); + if (error) { + dev_err(&pdev->dev, + "Failed to allocate irq %u: %d\n", +@@ -833,9 +825,11 @@ static int vmci_guest_probe_device(struct pci_dev *pdev, + goto err_free_irq; + } + if (caps_in_use & VMCI_CAPS_DMA_DATAGRAM) { +- error = request_irq(pci_irq_vector(pdev, 2), +- vmci_interrupt_dma_datagram, +- 0, KBUILD_MODNAME, vmci_dev); ++ error = request_threaded_irq(pci_irq_vector(pdev, 2), ++ NULL, ++ vmci_interrupt_dma_datagram, ++ 0, KBUILD_MODNAME, ++ vmci_dev); + if (error) { + dev_err(&pdev->dev, + "Failed to allocate irq %u: %d\n", +@@ -871,8 +865,6 @@ static int vmci_guest_probe_device(struct pci_dev *pdev, + + err_free_irq: + free_irq(pci_irq_vector(pdev, 0), vmci_dev); +- tasklet_kill(&vmci_dev->datagram_tasklet); +- tasklet_kill(&vmci_dev->bm_tasklet); + + err_disable_msi: + pci_free_irq_vectors(pdev); +@@ -943,9 +935,6 @@ static void vmci_guest_remove_device(struct pci_dev *pdev) + free_irq(pci_irq_vector(pdev, 0), vmci_dev); + pci_free_irq_vectors(pdev); + +- tasklet_kill(&vmci_dev->datagram_tasklet); +- tasklet_kill(&vmci_dev->bm_tasklet); +- + if (vmci_dev->notification_bitmap) { + /* + * The device reset above cleared the bitmap state of the +-- +2.39.1 +