From: Sasha Levin Date: Mon, 6 Jun 2022 10:34:07 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v5.10.121~139 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2f776bab83a3f4c638272c2e395d036a6d8509d2;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch b/queue-5.15/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch new file mode 100644 index 00000000000..5c5928e568f --- /dev/null +++ b/queue-5.15/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch @@ -0,0 +1,96 @@ +From 32e8bb7368d2b9c98bb3cba18702321e22ef2b50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 11:08:59 +0200 +Subject: ACPI: CPPC: Assume no transition latency if no PCCT + +From: Pierre Gondois + +[ Upstream commit 6380b7b2b29da9d9c5ab2d4a265901cd93ba3696 ] + +The transition_delay_us (struct cpufreq_policy) is currently defined +as: + Preferred average time interval between consecutive invocations of + the driver to set the frequency for this policy. To be set by the + scaling driver (0, which is the default, means no preference). +The transition_latency represents the amount of time necessary for a +CPU to change its frequency. + +A PCCT table advertises mutliple values: +- pcc_nominal: Expected latency to process a command, in microseconds +- pcc_mpar: The maximum number of periodic requests that the subspace + channel can support, reported in commands per minute. 0 indicates no + limitation. +- pcc_mrtt: The minimum amount of time that OSPM must wait after the + completion of a command before issuing the next command, + in microseconds. +cppc_get_transition_latency() allows to get the max of them. + +commit d4f3388afd48 ("cpufreq / CPPC: Set platform specific +transition_delay_us") allows to select transition_delay_us based on +the platform, and fallbacks to cppc_get_transition_latency() +otherwise. + +If _CPC objects are not using PCC channels (no PPCT table), the +transition_delay_us is set to CPUFREQ_ETERNAL, leading to really long +periods between frequency updates (~4s). + +If the desired_reg, where performance requests are written, is in +SystemMemory or SystemIo ACPI address space, there is no delay +in requests. So return 0 instead of CPUFREQ_ETERNAL, leading to +transition_delay_us being set to LATENCY_MULTIPLIER us (1000 us). + +This patch also adds two macros to check the address spaces. + +Signed-off-by: Pierre Gondois +Reviewed-by: Sudeep Holla +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/cppc_acpi.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 71b87c16f92d..ed1341030684 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -100,6 +100,16 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr); + (cpc)->cpc_entry.reg.space_id == \ + ACPI_ADR_SPACE_PLATFORM_COMM) + ++/* Check if a CPC register is in SystemMemory */ ++#define CPC_IN_SYSTEM_MEMORY(cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ ++ (cpc)->cpc_entry.reg.space_id == \ ++ ACPI_ADR_SPACE_SYSTEM_MEMORY) ++ ++/* Check if a CPC register is in SystemIo */ ++#define CPC_IN_SYSTEM_IO(cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ ++ (cpc)->cpc_entry.reg.space_id == \ ++ ACPI_ADR_SPACE_SYSTEM_IO) ++ + /* Evaluates to True if reg is a NULL register descriptor */ + #define IS_NULL_REG(reg) ((reg)->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY && \ + (reg)->address == 0 && \ +@@ -1378,6 +1388,9 @@ EXPORT_SYMBOL_GPL(cppc_set_perf); + * transition latency for performance change requests. The closest we have + * is the timing information from the PCCT tables which provides the info + * on the number and frequency of PCC commands the platform can handle. ++ * ++ * If desired_reg is in the SystemMemory or SystemIo ACPI address space, ++ * then assume there is no latency. + */ + unsigned int cppc_get_transition_latency(int cpu_num) + { +@@ -1403,7 +1416,9 @@ unsigned int cppc_get_transition_latency(int cpu_num) + return CPUFREQ_ETERNAL; + + desired_reg = &cpc_desc->cpc_regs[DESIRED_PERF]; +- if (!CPC_IN_PCC(desired_reg)) ++ if (CPC_IN_SYSTEM_MEMORY(desired_reg) || CPC_IN_SYSTEM_IO(desired_reg)) ++ return 0; ++ else if (!CPC_IN_PCC(desired_reg)) + return CPUFREQ_ETERNAL; + + if (pcc_ss_id < 0) +-- +2.35.1 + diff --git a/queue-5.15/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch b/queue-5.15/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch new file mode 100644 index 00000000000..e8694609f9c --- /dev/null +++ b/queue-5.15/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch @@ -0,0 +1,57 @@ +From 2f3c8d45a2d0651d5b30184af85b52158cd383b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 08:11:36 -0500 +Subject: ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default + +From: Mario Limonciello + +[ Upstream commit d52848620de00cde4a3a5df908e231b8c8868250 ] + +ASUS B1400CEAE fails to resume from suspend to idle by default. This was +bisected back to commit df4f9bc4fb9c ("nvme-pci: add support for ACPI +StorageD3Enable property") but this is a red herring to the problem. + +Before this commit the system wasn't getting into deepest sleep state. +Presumably this commit is allowing entry into deepest sleep state as +advertised by firmware, but there are some other problems related to +the wakeup. + +As it is confirmed the system works properly with S3, set the default for +this system to S3. + +Reported-by: Jian-Hong Pan +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215742 +Signed-off-by: Mario Limonciello +Tested-by: Jian-Hong Pan +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/sleep.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 7ae09e4b4592..07515139141e 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -374,6 +374,18 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), + }, + }, ++ /* ++ * ASUS B1400CEAE hangs on resume from suspend (see ++ * https://bugzilla.kernel.org/show_bug.cgi?id=215742). ++ */ ++ { ++ .callback = init_default_s3, ++ .ident = "ASUS B1400CEAE", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK B1400CEAE"), ++ }, ++ }, + {}, + }; + +-- +2.35.1 + diff --git a/queue-5.15/acpica-avoid-cache-flush-inside-virtual-machines.patch b/queue-5.15/acpica-avoid-cache-flush-inside-virtual-machines.patch new file mode 100644 index 00000000000..54d5bad3842 --- /dev/null +++ b/queue-5.15/acpica-avoid-cache-flush-inside-virtual-machines.patch @@ -0,0 +1,71 @@ +From c4506c8ee94be200ac23c1e3397029e1279a2f37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 02:29:38 +0300 +Subject: ACPICA: Avoid cache flush inside virtual machines + +From: Kirill A. Shutemov + +[ Upstream commit e2efb6359e620521d1e13f69b2257de8ceaa9475 ] + +While running inside virtual machine, the kernel can bypass cache +flushing. Changing sleep state in a virtual machine doesn't affect the +host system sleep state and cannot lead to data loss. + +Before entering sleep states, the ACPI code flushes caches to prevent +data loss using the WBINVD instruction. This mechanism is required on +bare metal. + +But, any use WBINVD inside of a guest is worthless. Changing sleep +state in a virtual machine doesn't affect the host system sleep state +and cannot lead to data loss, so most hypervisors simply ignore it. +Despite this, the ACPI code calls WBINVD unconditionally anyway. +It's useless, but also normally harmless. + +In TDX guests, though, WBINVD stops being harmless; it triggers a +virtualization exception (#VE). If the ACPI cache-flushing WBINVD +were left in place, TDX guests would need handling to recover from +the exception. + +Avoid using WBINVD whenever running under a hypervisor. This both +removes the useless WBINVDs and saves TDX from implementing WBINVD +handling. + +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Dave Hansen +Reviewed-by: Dave Hansen +Reviewed-by: Dan Williams +Reviewed-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/20220405232939.73860-30-kirill.shutemov@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/acenv.h | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/acenv.h b/arch/x86/include/asm/acenv.h +index 9aff97f0de7f..d937c55e717e 100644 +--- a/arch/x86/include/asm/acenv.h ++++ b/arch/x86/include/asm/acenv.h +@@ -13,7 +13,19 @@ + + /* Asm macros */ + +-#define ACPI_FLUSH_CPU_CACHE() wbinvd() ++/* ++ * ACPI_FLUSH_CPU_CACHE() flushes caches on entering sleep states. ++ * It is required to prevent data loss. ++ * ++ * While running inside virtual machine, the kernel can bypass cache flushing. ++ * Changing sleep state in a virtual machine doesn't affect the host system ++ * sleep state and cannot lead to data loss. ++ */ ++#define ACPI_FLUSH_CPU_CACHE() \ ++do { \ ++ if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) \ ++ wbinvd(); \ ++} while (0) + + int __acpi_acquire_global_lock(unsigned int *lock); + int __acpi_release_global_lock(unsigned int *lock); +-- +2.35.1 + diff --git a/queue-5.15/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch b/queue-5.15/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch new file mode 100644 index 00000000000..d129ca50ed8 --- /dev/null +++ b/queue-5.15/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch @@ -0,0 +1,155 @@ +From ec13406c199a6fc50761321027b4e0e0733bf60b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 May 2022 08:45:55 +0100 +Subject: afs: Adjust ACK interpretation to try and cope with NAT + +From: David Howells + +[ Upstream commit adc9613ff66c26ebaff9814973181ac178beb90b ] + +If a client's address changes, say if it is NAT'd, this can disrupt an in +progress operation. For most operations, this is not much of a problem, +but StoreData can be different as some servers modify the target file as +the data comes in, so if a store request is disrupted, the file can get +corrupted on the server. + +The problem is that the server doesn't recognise packets that come after +the change of address as belonging to the original client and will bounce +them, either by sending an OUT_OF_SEQUENCE ACK to the apparent new call if +the packet number falls within the initial sequence number window of a call +or by sending an EXCEEDS_WINDOW ACK if it falls outside and then aborting +it. In both cases, firstPacket will be 1 and previousPacket will be 0 in +the ACK information. + +Fix this by the following means: + + (1) If a client call receives an EXCEEDS_WINDOW ACK with firstPacket as 1 + and previousPacket as 0, assume this indicates that the server saw the + incoming packets from a different peer and thus as a different call. + Fail the call with error -ENETRESET. + + (2) Also fail the call if a similar OUT_OF_SEQUENCE ACK occurs if the + first packet has been hard-ACK'd. If it hasn't been hard-ACK'd, the + ACK packet will cause it to get retransmitted, so the call will just + be repeated. + + (3) Make afs_select_fileserver() treat -ENETRESET as a straight fail of + the operation. + + (4) Prioritise the error code over things like -ECONNRESET as the server + did actually respond. + + (5) Make writeback treat -ENETRESET as a retryable error and make it + redirty all the pages involved in a write so that the VM will retry. + +Note that there is still a circumstance that I can't easily deal with: if +the operation is fully received and processed by the server, but the reply +is lost due to address change. There's no way to know if the op happened. +We can examine the server, but a conflicting change could have been made by +a third party - and we can't tell the difference. In such a case, a +message like: + + kAFS: vnode modified {100058:146266} b7->b8 YFS.StoreData64 (op=2646a) + +will be logged to dmesg on the next op to touch the file and the client +will reset the inode state, including invalidating clean parts of the +pagecache. + +Reported-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Link: http://lists.infradead.org/pipermail/linux-afs/2021-December/004811.html # v1 +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + fs/afs/misc.c | 5 ++++- + fs/afs/rotate.c | 4 ++++ + fs/afs/write.c | 1 + + net/rxrpc/input.c | 27 +++++++++++++++++++++++++++ + 4 files changed, 36 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/misc.c b/fs/afs/misc.c +index 1d1a8debe472..933e67fcdab1 100644 +--- a/fs/afs/misc.c ++++ b/fs/afs/misc.c +@@ -163,8 +163,11 @@ void afs_prioritise_error(struct afs_error *e, int error, u32 abort_code) + return; + + case -ECONNABORTED: ++ error = afs_abort_to_error(abort_code); ++ fallthrough; ++ case -ENETRESET: /* Responded, but we seem to have changed address */ + e->responded = true; +- e->error = afs_abort_to_error(abort_code); ++ e->error = error; + return; + } + } +diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c +index 79e1a5f6701b..a840c3588ebb 100644 +--- a/fs/afs/rotate.c ++++ b/fs/afs/rotate.c +@@ -292,6 +292,10 @@ bool afs_select_fileserver(struct afs_operation *op) + op->error = error; + goto iterate_address; + ++ case -ENETRESET: ++ pr_warn("kAFS: Peer reset %s (op=%x)\n", ++ op->type ? op->type->name : "???", op->debug_id); ++ fallthrough; + case -ECONNRESET: + _debug("call reset"); + op->error = error; +diff --git a/fs/afs/write.c b/fs/afs/write.c +index f24370f5c774..a75c4742062a 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -626,6 +626,7 @@ static ssize_t afs_write_back_from_locked_page(struct address_space *mapping, + case -EKEYEXPIRED: + case -EKEYREJECTED: + case -EKEYREVOKED: ++ case -ENETRESET: + afs_redirty_pages(wbc, mapping, start, len); + mapping_set_error(mapping, ret); + break; +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index dc201363f2c4..67d3eba60dc7 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -903,6 +903,33 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + rxrpc_propose_ack_respond_to_ack); + } + ++ /* If we get an EXCEEDS_WINDOW ACK from the server, it probably ++ * indicates that the client address changed due to NAT. The server ++ * lost the call because it switched to a different peer. ++ */ ++ if (unlikely(buf.ack.reason == RXRPC_ACK_EXCEEDS_WINDOW) && ++ first_soft_ack == 1 && ++ prev_pkt == 0 && ++ rxrpc_is_client_call(call)) { ++ rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED, ++ 0, -ENETRESET); ++ return; ++ } ++ ++ /* If we get an OUT_OF_SEQUENCE ACK from the server, that can also ++ * indicate a change of address. However, we can retransmit the call ++ * if we still have it buffered to the beginning. ++ */ ++ if (unlikely(buf.ack.reason == RXRPC_ACK_OUT_OF_SEQUENCE) && ++ first_soft_ack == 1 && ++ prev_pkt == 0 && ++ call->tx_hard_ack == 0 && ++ rxrpc_is_client_call(call)) { ++ rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED, ++ 0, -ENETRESET); ++ return; ++ } ++ + /* Discard any out-of-order or duplicate ACKs (outside lock). */ + if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) { + trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial, +-- +2.35.1 + diff --git a/queue-5.15/alpha-fix-alloc_zeroed_user_highpage_movable.patch b/queue-5.15/alpha-fix-alloc_zeroed_user_highpage_movable.patch new file mode 100644 index 00000000000..d312f2baa3d --- /dev/null +++ b/queue-5.15/alpha-fix-alloc_zeroed_user_highpage_movable.patch @@ -0,0 +1,39 @@ +From 9b85140ea50c48d5dc5080a6764c09507e709d25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 20:23:01 -0700 +Subject: alpha: fix alloc_zeroed_user_highpage_movable() + +From: Matthew Wilcox (Oracle) + +[ Upstream commit f9c668d281aa20e38c9bda3b7b0adeb8891aa15e ] + +Due to a typo, the final argument to alloc_page_vma() didn't refer to a +real variable. This only affected CONFIG_NUMA, which was marked BROKEN in +2006 and removed from alpha in 2021. Found due to a refactoring patch. + +Link: https://lkml.kernel.org/r/20220504182857.4013401-4-willy@infradead.org +Signed-off-by: Matthew Wilcox (Oracle) +Reported-by: kernel test robot +Reviewed-by: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/alpha/include/asm/page.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/alpha/include/asm/page.h b/arch/alpha/include/asm/page.h +index 18f48a6f2ff6..8f3f5eecba28 100644 +--- a/arch/alpha/include/asm/page.h ++++ b/arch/alpha/include/asm/page.h +@@ -18,7 +18,7 @@ extern void clear_page(void *page); + #define clear_user_page(page, vaddr, pg) clear_page(page) + + #define alloc_zeroed_user_highpage_movable(vma, vaddr) \ +- alloc_page_vma(GFP_HIGHUSER_MOVABLE | __GFP_ZERO, vma, vmaddr) ++ alloc_page_vma(GFP_HIGHUSER_MOVABLE | __GFP_ZERO, vma, vaddr) + #define __HAVE_ARCH_ALLOC_ZEROED_USER_HIGHPAGE_MOVABLE + + extern void copy_page(void * _to, void * _from); +-- +2.35.1 + diff --git a/queue-5.15/alsa-jack-access-input_dev-under-mutex.patch b/queue-5.15/alsa-jack-access-input_dev-under-mutex.patch new file mode 100644 index 00000000000..386f7962649 --- /dev/null +++ b/queue-5.15/alsa-jack-access-input_dev-under-mutex.patch @@ -0,0 +1,157 @@ +From 70cdc82ac7fd028e1345c1493d8a048264ddb5f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 11:16:28 +0200 +Subject: ALSA: jack: Access input_dev under mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 1b6a6fc5280e97559287b61eade2d4b363e836f2 ] + +It is possible when using ASoC that input_dev is unregistered while +calling snd_jack_report, which causes NULL pointer dereference. +In order to prevent this serialize access to input_dev using mutex lock. + +Signed-off-by: Amadeusz Sławiński +Reviewed-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220412091628.3056922-1-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/jack.h | 1 + + sound/core/jack.c | 34 +++++++++++++++++++++++++++------- + 2 files changed, 28 insertions(+), 7 deletions(-) + +diff --git a/include/sound/jack.h b/include/sound/jack.h +index 1181f536557e..1ed90e2109e9 100644 +--- a/include/sound/jack.h ++++ b/include/sound/jack.h +@@ -62,6 +62,7 @@ struct snd_jack { + const char *id; + #ifdef CONFIG_SND_JACK_INPUT_DEV + struct input_dev *input_dev; ++ struct mutex input_dev_lock; + int registered; + int type; + char name[100]; +diff --git a/sound/core/jack.c b/sound/core/jack.c +index d1e3055f2b6a..88493cc31914 100644 +--- a/sound/core/jack.c ++++ b/sound/core/jack.c +@@ -42,8 +42,11 @@ static int snd_jack_dev_disconnect(struct snd_device *device) + #ifdef CONFIG_SND_JACK_INPUT_DEV + struct snd_jack *jack = device->device_data; + +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return 0; ++ } + + /* If the input device is registered with the input subsystem + * then we need to use a different deallocator. */ +@@ -52,6 +55,7 @@ static int snd_jack_dev_disconnect(struct snd_device *device) + else + input_free_device(jack->input_dev); + jack->input_dev = NULL; ++ mutex_unlock(&jack->input_dev_lock); + #endif /* CONFIG_SND_JACK_INPUT_DEV */ + return 0; + } +@@ -90,8 +94,11 @@ static int snd_jack_dev_register(struct snd_device *device) + snprintf(jack->name, sizeof(jack->name), "%s %s", + card->shortname, jack->id); + +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return 0; ++ } + + jack->input_dev->name = jack->name; + +@@ -116,6 +123,7 @@ static int snd_jack_dev_register(struct snd_device *device) + if (err == 0) + jack->registered = 1; + ++ mutex_unlock(&jack->input_dev_lock); + return err; + } + #endif /* CONFIG_SND_JACK_INPUT_DEV */ +@@ -517,9 +525,11 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, + return -ENOMEM; + } + +- /* don't creat input device for phantom jack */ +- if (!phantom_jack) { + #ifdef CONFIG_SND_JACK_INPUT_DEV ++ mutex_init(&jack->input_dev_lock); ++ ++ /* don't create input device for phantom jack */ ++ if (!phantom_jack) { + int i; + + jack->input_dev = input_allocate_device(); +@@ -537,8 +547,8 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, + input_set_capability(jack->input_dev, EV_SW, + jack_switch_types[i]); + +-#endif /* CONFIG_SND_JACK_INPUT_DEV */ + } ++#endif /* CONFIG_SND_JACK_INPUT_DEV */ + + err = snd_device_new(card, SNDRV_DEV_JACK, jack, &ops); + if (err < 0) +@@ -578,10 +588,14 @@ EXPORT_SYMBOL(snd_jack_new); + void snd_jack_set_parent(struct snd_jack *jack, struct device *parent) + { + WARN_ON(jack->registered); +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return; ++ } + + jack->input_dev->dev.parent = parent; ++ mutex_unlock(&jack->input_dev_lock); + } + EXPORT_SYMBOL(snd_jack_set_parent); + +@@ -629,6 +643,8 @@ EXPORT_SYMBOL(snd_jack_set_key); + + /** + * snd_jack_report - Report the current status of a jack ++ * Note: This function uses mutexes and should be called from a ++ * context which can sleep (such as a workqueue). + * + * @jack: The jack to report status for + * @status: The current status of the jack +@@ -654,8 +670,11 @@ void snd_jack_report(struct snd_jack *jack, int status) + status & jack_kctl->mask_bits); + + #ifdef CONFIG_SND_JACK_INPUT_DEV +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return; ++ } + + for (i = 0; i < ARRAY_SIZE(jack->key); i++) { + int testbit = ((SND_JACK_BTN_0 >> i) & ~mask_bits); +@@ -675,6 +694,7 @@ void snd_jack_report(struct snd_jack *jack, int status) + } + + input_sync(jack->input_dev); ++ mutex_unlock(&jack->input_dev_lock); + #endif /* CONFIG_SND_JACK_INPUT_DEV */ + } + EXPORT_SYMBOL(snd_jack_report); +-- +2.35.1 + diff --git a/queue-5.15/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch b/queue-5.15/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch new file mode 100644 index 00000000000..c0b8e73734f --- /dev/null +++ b/queue-5.15/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch @@ -0,0 +1,48 @@ +From 7278d05e016f1cf46d73780ccd76f0784723aa42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 21:59:45 +0100 +Subject: ALSA: pcm: Check for null pointer of pointer substream before + dereferencing it + +From: Colin Ian King + +[ Upstream commit 011b559be832194f992f73d6c0d5485f5925a10b ] + +Pointer substream is being dereferenced on the assignment of pointer card +before substream is being null checked with the macro PCM_RUNTIME_CHECK. +Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the +the pointer check before card is assigned. + +Fixes: d4cfb30fce03 ("ALSA: pcm: Set per-card upper limit of PCM buffer allocations") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20220424205945.1372247-1-colin.i.king@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_memory.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/core/pcm_memory.c b/sound/core/pcm_memory.c +index f1fb856ff4ac..f1470590239e 100644 +--- a/sound/core/pcm_memory.c ++++ b/sound/core/pcm_memory.c +@@ -446,7 +446,6 @@ EXPORT_SYMBOL(snd_pcm_lib_malloc_pages); + */ + int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream) + { +- struct snd_card *card = substream->pcm->card; + struct snd_pcm_runtime *runtime; + + if (PCM_RUNTIME_CHECK(substream)) +@@ -455,6 +454,8 @@ int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream) + if (runtime->dma_area == NULL) + return 0; + if (runtime->dma_buffer_p != &substream->dma_buffer) { ++ struct snd_card *card = substream->pcm->card; ++ + /* it's a newly allocated buffer. release it now. */ + do_free_pages(card, runtime->dma_buffer_p); + kfree(runtime->dma_buffer_p); +-- +2.35.1 + diff --git a/queue-5.15/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch b/queue-5.15/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch new file mode 100644 index 00000000000..e336859f398 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch @@ -0,0 +1,96 @@ +From 37b8ec3c478ece52fe9ee44abb1043728db2214c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:41:00 +0200 +Subject: ALSA: usb-audio: Add quirk bits for enabling/disabling generic + implicit fb + +From: Takashi Iwai + +[ Upstream commit 0f1f7a6661394fe4a53db254c346d6aa2dd64397 ] + +For making easier to test, add the new quirk_flags bits 17 and 18 to +enable and disable the generic implicit feedback mode. The bit 17 is +equivalent with implicit_fb=1 option, applying the generic implicit +feedback sync mode. OTOH, the bit 18 disables the implicit fb mode +forcibly. + +Link: https://lore.kernel.org/r/20220421064101.12456-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + Documentation/sound/alsa-configuration.rst | 4 +++- + sound/usb/implicit.c | 5 ++++- + sound/usb/usbaudio.h | 6 ++++++ + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/Documentation/sound/alsa-configuration.rst b/Documentation/sound/alsa-configuration.rst +index 65f61695f561..5d093fb4896b 100644 +--- a/Documentation/sound/alsa-configuration.rst ++++ b/Documentation/sound/alsa-configuration.rst +@@ -2237,7 +2237,7 @@ implicit_fb + Apply the generic implicit feedback sync mode. When this is set + and the playback stream sync mode is ASYNC, the driver tries to + tie an adjacent ASYNC capture stream as the implicit feedback +- source. ++ source. This is equivalent with quirk_flags bit 17. + use_vmalloc + Use vmalloc() for allocations of the PCM buffers (default: yes). + For architectures with non-coherent memory like ARM or MIPS, the +@@ -2279,6 +2279,8 @@ quirk_flags + * bit 14: Ignore errors for mixer access + * bit 15: Support generic DSD raw U32_BE format + * bit 16: Set up the interface at first like UAC1 ++ * bit 17: Apply the generic implicit feedback sync mode ++ * bit 18: Don't apply implicit feedback sync mode + + This module supports multiple devices, autoprobe and hotplugging. + +diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c +index 2d444ec74202..1fd087128538 100644 +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -350,7 +350,8 @@ static int audioformat_implicit_fb_quirk(struct snd_usb_audio *chip, + } + + /* Try the generic implicit fb if available */ +- if (chip->generic_implicit_fb) ++ if (chip->generic_implicit_fb || ++ (chip->quirk_flags & QUIRK_FLAG_GENERIC_IMPLICIT_FB)) + return add_generic_implicit_fb(chip, fmt, alts); + + /* No quirk */ +@@ -387,6 +388,8 @@ int snd_usb_parse_implicit_fb_quirk(struct snd_usb_audio *chip, + struct audioformat *fmt, + struct usb_host_interface *alts) + { ++ if (chip->quirk_flags & QUIRK_FLAG_SKIP_IMPLICIT_FB) ++ return 0; + if (fmt->endpoint & USB_DIR_IN) + return audioformat_capture_quirk(chip, fmt, alts); + else +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index b8359a0aa008..044cd7ab27cb 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -164,6 +164,10 @@ extern bool snd_usb_skip_validation; + * Support generic DSD raw U32_BE format + * QUIRK_FLAG_SET_IFACE_FIRST: + * Set up the interface at first like UAC1 ++ * QUIRK_FLAG_GENERIC_IMPLICIT_FB ++ * Apply the generic implicit feedback sync mode (same as implicit_fb=1 option) ++ * QUIRK_FLAG_SKIP_IMPLICIT_FB ++ * Don't apply implicit feedback sync mode + */ + + #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0) +@@ -183,5 +187,7 @@ extern bool snd_usb_skip_validation; + #define QUIRK_FLAG_IGNORE_CTL_ERROR (1U << 14) + #define QUIRK_FLAG_DSD_RAW (1U << 15) + #define QUIRK_FLAG_SET_IFACE_FIRST (1U << 16) ++#define QUIRK_FLAG_GENERIC_IMPLICIT_FB (1U << 17) ++#define QUIRK_FLAG_SKIP_IMPLICIT_FB (1U << 18) + + #endif /* __USBAUDIO_H */ +-- +2.35.1 + diff --git a/queue-5.15/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch b/queue-5.15/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch new file mode 100644 index 00000000000..aa68f6eda78 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch @@ -0,0 +1,63 @@ +From 40b73603d86887a4128a6c62c830a823078d901b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:41:01 +0200 +Subject: ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c + +From: Takashi Iwai + +[ Upstream commit 67d64069bc0867e52e73a1e255b17462005ca9b4 ] + +Use the new quirk bits to manage the generic implicit fb quirk +entries. This makes easier to compare with other devices. + +Link: https://lore.kernel.org/r/20220421064101.12456-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/implicit.c | 5 ----- + sound/usb/quirks.c | 6 ++++++ + 2 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c +index 1fd087128538..e1bf1b5da423 100644 +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -45,11 +45,6 @@ struct snd_usb_implicit_fb_match { + + /* Implicit feedback quirk table for playback */ + static const struct snd_usb_implicit_fb_match playback_implicit_fb_quirks[] = { +- /* Generic matching */ +- IMPLICIT_FB_GENERIC_DEV(0x0499, 0x1509), /* Steinberg UR22 */ +- IMPLICIT_FB_GENERIC_DEV(0x0763, 0x2030), /* M-Audio Fast Track C400 */ +- IMPLICIT_FB_GENERIC_DEV(0x0763, 0x2031), /* M-Audio Fast Track C600 */ +- + /* Fixed EP */ + /* FIXME: check the availability of generic matching */ + IMPLICIT_FB_FIXED_DEV(0x0763, 0x2080, 0x81, 2), /* M-Audio FastTrack Ultra */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index fbbe59054c3f..e8468f9b007d 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1793,6 +1793,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x046d, 0x09a4, /* Logitech QuickCam E 3500 */ + QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR), ++ DEVICE_FLG(0x0499, 0x1509, /* Steinberg UR22 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), + DEVICE_FLG(0x04d8, 0xfeea, /* Benchmark DAC1 Pre */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x04e8, 0xa051, /* Samsung USBC Headset (AKG) */ +@@ -1826,6 +1828,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x074d, 0x3553, /* Outlaw RR2150 (Micronas UAC3553B) */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x0763, 0x2030, /* M-Audio Fast Track C400 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), ++ DEVICE_FLG(0x0763, 0x2031, /* M-Audio Fast Track C600 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), + DEVICE_FLG(0x08bb, 0x2702, /* LineX FM Transmitter */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x0951, 0x16ad, /* Kingston HyperX */ +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch b/queue-5.15/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch new file mode 100644 index 00000000000..9460ace4c0f --- /dev/null +++ b/queue-5.15/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch @@ -0,0 +1,43 @@ +From e53e8c543606fe08a6f5330f70320344de01f53e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 May 2022 16:31:27 +0300 +Subject: ARM: dts: at91: sama7g5: remove interrupt-parent from gic node + +From: Eugen Hristev + +[ Upstream commit b7e86ef7afd128577ff7bb0db0ae82d27d7ed7ad ] + +interrupt-parent is not to be used as a boolean property. +It is already present in the DT in the proper way it's supposed to be used: +interrupt-parent = <&gic>; + +This is also reported by dtbs_check: +arch/arm/boot/dts/at91-sama7g5ek.dtb: interrupt-controller@e8c11000: interrupt-parent: True is not of type 'array' + From schema: /.local/lib/python3.8/site-packages/dtschema/schemas/interrupts.yaml + +Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") +Signed-off-by: Eugen Hristev +Reviewed-by: Claudiu Beznea +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220503133127.64320-1-eugen.hristev@microchip.com +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama7g5.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sama7g5.dtsi b/arch/arm/boot/dts/sama7g5.dtsi +index ac84d2e37f9b..a63a8e768654 100644 +--- a/arch/arm/boot/dts/sama7g5.dtsi ++++ b/arch/arm/boot/dts/sama7g5.dtsi +@@ -553,7 +553,6 @@ + #interrupt-cells = <3>; + #address-cells = <0>; + interrupt-controller; +- interrupt-parent; + reg = <0xe8c11000 0x1000>, + <0xe8c12000 0x2000>; + }; +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch b/queue-5.15/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch new file mode 100644 index 00000000000..a62ae307050 --- /dev/null +++ b/queue-5.15/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch @@ -0,0 +1,52 @@ +From ea2d533ff5cf1aef66a37015f7032c61835e9571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:41 +0200 +Subject: ARM: dts: bcm2835-rpi-b: Fix GPIO line names + +From: Stefan Wahren + +[ Upstream commit 97bd8659c1c46c23e4daea7e040befca30939950 ] + +Recently this has been fixed in the vendor tree, so upstream this. + +Fixes: 731b26a6ac17 ("ARM: bcm2835: Add names for the Raspberry Pi GPIO lines") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2835-rpi-b.dts b/arch/arm/boot/dts/bcm2835-rpi-b.dts +index 1b63d6b19750..25d87212cefd 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-b.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-b.dts +@@ -53,18 +53,17 @@ + "GPIO18", + "NC", /* GPIO19 */ + "NC", /* GPIO20 */ +- "GPIO21", ++ "CAM_GPIO0", + "GPIO22", + "GPIO23", + "GPIO24", + "GPIO25", + "NC", /* GPIO26 */ +- "CAM_GPIO0", +- /* Binary number representing build/revision */ +- "CONFIG0", +- "CONFIG1", +- "CONFIG2", +- "CONFIG3", ++ "GPIO27", ++ "GPIO28", ++ "GPIO29", ++ "GPIO30", ++ "GPIO31", + "NC", /* GPIO32 */ + "NC", /* GPIO33 */ + "NC", /* GPIO34 */ +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch b/queue-5.15/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch new file mode 100644 index 00000000000..3bb9284f26a --- /dev/null +++ b/queue-5.15/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch @@ -0,0 +1,57 @@ +From 289f9b104eee2d0668795a7fecb853c26f389d36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:38 +0200 +Subject: ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT + +From: Phil Elwell + +[ Upstream commit 2c663e5e5bbf2a5b85e0f76ccb69663f583c3e33 ] + +The GPIOs 30 to 39 are connected to the Cypress CYW43438 (Wifi/BT). +So fix the GPIO line names accordingly. + +Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +index 33b2b77aa47d..00582eb2c12e 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +@@ -74,16 +74,18 @@ + "GPIO27", + "SDA0", + "SCL0", +- "NC", /* GPIO30 */ +- "NC", /* GPIO31 */ +- "NC", /* GPIO32 */ +- "NC", /* GPIO33 */ +- "NC", /* GPIO34 */ +- "NC", /* GPIO35 */ +- "NC", /* GPIO36 */ +- "NC", /* GPIO37 */ +- "NC", /* GPIO38 */ +- "NC", /* GPIO39 */ ++ /* Used by BT module */ ++ "CTS0", ++ "RTS0", ++ "TXD0", ++ "RXD0", ++ /* Used by Wifi */ ++ "SD1_CLK", ++ "SD1_CMD", ++ "SD1_DATA0", ++ "SD1_DATA1", ++ "SD1_DATA2", ++ "SD1_DATA3", + "CAM_GPIO1", /* GPIO40 */ + "WL_ON", /* GPIO41 */ + "NC", /* GPIO42 */ +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch b/queue-5.15/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch new file mode 100644 index 00000000000..9a0fc897449 --- /dev/null +++ b/queue-5.15/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch @@ -0,0 +1,37 @@ +From 287b195f5d5bfa23482137d87185cd8dedef0b5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:40 +0200 +Subject: ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED + +From: Phil Elwell + +[ Upstream commit 57f718aa4b93392fb1a8c0a874ab882b9e18136a ] + +The red LED on the Raspberry Pi 3 B Plus is the power LED. +So fix the GPIO line name accordingly. + +Fixes: 71c0cd2283f2 ("ARM: dts: bcm2837: Add Raspberry Pi 3 B+") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +index 61010266ca9a..90472e76a313 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +@@ -45,7 +45,7 @@ + #gpio-cells = <2>; + gpio-line-names = "BT_ON", + "WL_ON", +- "STATUS_LED_R", ++ "PWR_LED_R", + "LAN_RUN", + "", + "CAM_GPIO0", +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch b/queue-5.15/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch new file mode 100644 index 00000000000..d065511a243 --- /dev/null +++ b/queue-5.15/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch @@ -0,0 +1,39 @@ +From f50bb7a5757ea01d81db19457abd62aadc3c5fef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:39 +0200 +Subject: ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C + +From: Phil Elwell + +[ Upstream commit 9fd26fd02749ec964eb0d588a3bab9e09bf77927 ] + +The GPIOs 46 & 47 are already used for a I2C interface to a SMPS. +So fix the GPIO line names accordingly. + +Fixes: a54fe8a6cf66 ("ARM: dts: add Raspberry Pi Compute Module 3 and IO board") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +index 588d9411ceb6..3dfce4312dfc 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +@@ -63,8 +63,8 @@ + "GPIO43", + "GPIO44", + "GPIO45", +- "GPIO46", +- "GPIO47", ++ "SMPS_SCL", ++ "SMPS_SDA", + /* Used by eMMC */ + "SD_CLK_R", + "SD_CMD_R", +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-bcm5301x-update-cru-block-description.patch b/queue-5.15/arm-dts-bcm5301x-update-cru-block-description.patch new file mode 100644 index 00000000000..1782750124c --- /dev/null +++ b/queue-5.15/arm-dts-bcm5301x-update-cru-block-description.patch @@ -0,0 +1,70 @@ +From 934a3168f3cb791c2a1e3ae68d8e593999f0ff66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 18:05:23 +0200 +Subject: ARM: dts: BCM5301X: update CRU block description +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 31fd9b79dc580301c53a001482755ba7e88c2809 ] + +This describes CRU in a way matching documentation and fixes: + +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dt.yaml: cru@100: $nodename:0: 'cru@100' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$' + From schema: /lib/python3.6/site-packages/dtschema/schemas/simple-bus.yaml + +Signed-off-by: Rafał Miłecki +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index f69d2af3c1fa..db8c3f684786 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -423,14 +423,14 @@ + #address-cells = <1>; + #size-cells = <1>; + +- cru@100 { +- compatible = "simple-bus"; ++ cru-bus@100 { ++ compatible = "brcm,ns-cru", "simple-mfd"; + reg = <0x100 0x1a4>; + ranges; + #address-cells = <1>; + #size-cells = <1>; + +- lcpll0: lcpll0@100 { ++ lcpll0: clock-controller@100 { + #clock-cells = <1>; + compatible = "brcm,nsp-lcpll0"; + reg = <0x100 0x14>; +@@ -439,7 +439,7 @@ + "sdio", "ddr_phy"; + }; + +- genpll: genpll@140 { ++ genpll: clock-controller@140 { + #clock-cells = <1>; + compatible = "brcm,nsp-genpll"; + reg = <0x140 0x24>; +@@ -450,6 +450,11 @@ + "sata1", "sata2"; + }; + ++ syscon@180 { ++ compatible = "brcm,cru-clkset", "syscon"; ++ reg = <0x180 0x4>; ++ }; ++ + pinctrl: pin-controller@1c0 { + compatible = "brcm,bcm4708-pinmux"; + reg = <0x1c0 0x24>; +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-bcm5301x-update-pin-controller-node-name.patch b/queue-5.15/arm-dts-bcm5301x-update-pin-controller-node-name.patch new file mode 100644 index 00000000000..80703ff6e04 --- /dev/null +++ b/queue-5.15/arm-dts-bcm5301x-update-pin-controller-node-name.patch @@ -0,0 +1,42 @@ +From b3b2d5eb3a79d0026f3552305fb9dad1d2b664ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 14:05:27 +0200 +Subject: ARM: dts: BCM5301X: Update pin controller node name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 130b5e32ba9d2d2313e39cf3f6d0729bff02b76a ] + +This fixes: +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: cru-bus@100: 'pin-controller@1c0' does not match any of the regexes: '^clock-controller@[a-f0-9]+$', '^phy@[a-f0-9]+$', '^pinctrl@[a-f0-9]+$', '^syscon@[a-f0-9]+$', '^thermal@[a-f0-9]+$' + From schema: Documentation/devicetree/bindings/mfd/brcm,cru.yaml +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: pin-controller@1c0: $nodename:0: 'pin-controller@1c0' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$' + From schema: Documentation/devicetree/bindings/pinctrl/brcm,ns-pinmux.yaml + +Ref: e7391b021e3f ("dt-bindings: mfd: brcm,cru: Rename pinctrl node") +Signed-off-by: Rafał Miłecki +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index db8c3f684786..30217948ef82 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -455,7 +455,7 @@ + reg = <0x180 0x4>; + }; + +- pinctrl: pin-controller@1c0 { ++ pinctrl: pinctrl@1c0 { + compatible = "brcm,bcm4708-pinmux"; + reg = <0x1c0 0x24>; + reg-names = "cru_gpio_control"; +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch b/queue-5.15/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch new file mode 100644 index 00000000000..ca694a9ec80 --- /dev/null +++ b/queue-5.15/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch @@ -0,0 +1,53 @@ +From f29696df59ceda8af05c9081f8f60b795742b6b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 06:39:45 +0200 +Subject: ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec + clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Scherer + +[ Upstream commit 3d397a1277853498e8b7b305f2610881357c033f ] + +Commit f3e7dae323ab ("ARM: dts: imx6qdl: add enet_out clk +support") added another item to the list of clocks for the fec +device. As imx6dl-eckelmann-ci4x10.dts only overwrites clocks, +but not clock-names this resulted in an inconsistency with +clocks having one item more than clock-names. + +Also overwrite clock-names with the same value as in +imx6qdl.dtsi. This is a no-op today, but prevents similar +inconsistencies if the soc file will be changed in a similar way +in the future. + +Signed-off-by: Thorsten Scherer +Reviewed-by: Uwe Kleine-König +Fixes: f3e7dae323ab ("ARM: dts: imx6qdl: add enet_out clk support") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts b/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts +index b4a9523e325b..864dc5018451 100644 +--- a/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts ++++ b/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts +@@ -297,7 +297,11 @@ + phy-mode = "rmii"; + phy-reset-gpios = <&gpio1 18 GPIO_ACTIVE_LOW>; + phy-handle = <&phy>; +- clocks = <&clks IMX6QDL_CLK_ENET>, <&clks IMX6QDL_CLK_ENET>, <&rmii_clk>; ++ clocks = <&clks IMX6QDL_CLK_ENET>, ++ <&clks IMX6QDL_CLK_ENET>, ++ <&rmii_clk>, ++ <&clks IMX6QDL_CLK_ENET_REF>; ++ clock-names = "ipg", "ahb", "ptp", "enet_out"; + status = "okay"; + + mdio { +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch b/queue-5.15/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch new file mode 100644 index 00000000000..c4204c7b4d8 --- /dev/null +++ b/queue-5.15/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch @@ -0,0 +1,45 @@ +From 664db585985f81f782f4d42725fc8e198a9757af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 20:34:43 +0200 +Subject: ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM + +From: Krzysztof Kozlowski + +[ Upstream commit f038e8186fbc5723d7d38c6fa1d342945107347e ] + +The Samsung s524ad0xd1 EEPROM should use atmel,24c128 fallback, +according to the AT24 EEPROM bindings. + +Reported-by: Rob Herring +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220426183443.243113-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index f042954bdfa5..e4861415a0fe 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -129,7 +129,7 @@ + samsung,i2c-max-bus-freq = <20000>; + + eeprom@50 { +- compatible = "samsung,s524ad0xd1"; ++ compatible = "samsung,s524ad0xd1", "atmel,24c128"; + reg = <0x50>; + }; + +@@ -289,7 +289,7 @@ + samsung,i2c-max-bus-freq = <20000>; + + eeprom@51 { +- compatible = "samsung,s524ad0xd1"; ++ compatible = "samsung,s524ad0xd1", "atmel,24c128"; + reg = <0x51>; + }; + +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch b/queue-5.15/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch new file mode 100644 index 00000000000..a0d58e06cd8 --- /dev/null +++ b/queue-5.15/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch @@ -0,0 +1,53 @@ +From 23933a207ff68e2ec7386a7fa404efdf038054c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 17:22:24 +0200 +Subject: ARM: dts: imx6dl-colibri: Fix I2C pinmuxing + +From: Max Krummenacher + +[ Upstream commit 5f5c579a34a87117c20b411df583ae816c1ec84f ] + +Fix names of extra pingroup node and property for gpio bus recovery. +Without the change i2c2 is not functional. + +Fixes: 56f0df6b6b58 ("ARM: dts: imx*(colibri|apalis): add missing recovery modes to i2c") +Signed-off-by: Max Krummenacher +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-colibri.dtsi b/arch/arm/boot/dts/imx6qdl-colibri.dtsi +index 4e2a309c93fa..1e86b3814708 100644 +--- a/arch/arm/boot/dts/imx6qdl-colibri.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-colibri.dtsi +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0+ OR MIT + /* +- * Copyright 2014-2020 Toradex ++ * Copyright 2014-2022 Toradex + * Copyright 2012 Freescale Semiconductor, Inc. + * Copyright 2011 Linaro Ltd. + */ +@@ -132,7 +132,7 @@ + clock-frequency = <100000>; + pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c2>; +- pinctrl-0 = <&pinctrl_i2c2_gpio>; ++ pinctrl-1 = <&pinctrl_i2c2_gpio>; + scl-gpios = <&gpio2 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio3 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; +@@ -488,7 +488,7 @@ + >; + }; + +- pinctrl_i2c2_gpio: i2c2grp { ++ pinctrl_i2c2_gpio: i2c2gpiogrp { + fsl,pins = < + MX6QDL_PAD_EIM_EB2__GPIO2_IO30 0x4001b8b1 + MX6QDL_PAD_EIM_D16__GPIO3_IO16 0x4001b8b1 +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-ox820-align-interrupt-controller-node-name-w.patch b/queue-5.15/arm-dts-ox820-align-interrupt-controller-node-name-w.patch new file mode 100644 index 00000000000..67fa9c7e8f0 --- /dev/null +++ b/queue-5.15/arm-dts-ox820-align-interrupt-controller-node-name-w.patch @@ -0,0 +1,37 @@ +From 51204650f1730a131a904501e2d643d6f3754eea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:29:59 +0200 +Subject: ARM: dts: ox820: align interrupt controller node name with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit fbcd5ad7a419ad40644a0bb8b4152bc660172d8a ] + +Fixes dtbs_check warnings like: + + gic@1000: $nodename:0: 'gic@1000' does not match '^interrupt-controller(@[0-9a-f,]+)*$' + +Signed-off-by: Krzysztof Kozlowski +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220317115705.450427-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ox820.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ox820.dtsi b/arch/arm/boot/dts/ox820.dtsi +index 90846a7655b4..dde4364892bf 100644 +--- a/arch/arm/boot/dts/ox820.dtsi ++++ b/arch/arm/boot/dts/ox820.dtsi +@@ -287,7 +287,7 @@ + clocks = <&armclk>; + }; + +- gic: gic@1000 { ++ gic: interrupt-controller@1000 { + compatible = "arm,arm11mp-gic"; + interrupt-controller; + #interrupt-cells = <3>; +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch b/queue-5.15/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch new file mode 100644 index 00000000000..2a490c6c13e --- /dev/null +++ b/queue-5.15/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch @@ -0,0 +1,79 @@ +From b4912df1468d3d45b8728f512affa690fc58606b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Mar 2022 11:08:54 -0700 +Subject: ARM: dts: s5pv210: align DMA channels with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit 9e916fb9bc3d16066286f19fc9c51d26a6aec6bd ] + +dtschema expects DMA channels in specific order (tx, rx and tx-sec). +The order actually should not matter because dma-names is used however +let's make it aligned with dtschema to suppress warnings like: + + i2s@eee30000: dma-names: ['rx', 'tx', 'tx-sec'] is not valid under any of the given schemas + +Signed-off-by: Krzysztof Kozlowski +Co-developed-by: Jonathan Bakker +Signed-off-by: Jonathan Bakker +Link: https://lore.kernel.org/r/CY4PR04MB056779A9C50DC95987C5272ACB1C9@CY4PR04MB0567.namprd04.prod.outlook.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-aries.dtsi | 2 +- + arch/arm/boot/dts/s5pv210.dtsi | 12 ++++++------ + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/s5pv210-aries.dtsi b/arch/arm/boot/dts/s5pv210-aries.dtsi +index 2f57100a011a..9b7da2bc3a06 100644 +--- a/arch/arm/boot/dts/s5pv210-aries.dtsi ++++ b/arch/arm/boot/dts/s5pv210-aries.dtsi +@@ -636,7 +636,7 @@ + }; + + &i2s0 { +- dmas = <&pdma0 9>, <&pdma0 10>, <&pdma0 11>; ++ dmas = <&pdma0 10>, <&pdma0 9>, <&pdma0 11>; + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi +index 353ba7b09a0c..c5265f3ae31d 100644 +--- a/arch/arm/boot/dts/s5pv210.dtsi ++++ b/arch/arm/boot/dts/s5pv210.dtsi +@@ -239,8 +239,8 @@ + reg = <0xeee30000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <16>; +- dma-names = "rx", "tx", "tx-sec"; +- dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>; ++ dma-names = "tx", "rx", "tx-sec"; ++ dmas = <&pdma1 10>, <&pdma1 9>, <&pdma1 11>; + clock-names = "iis", + "i2s_opclk0", + "i2s_opclk1"; +@@ -259,8 +259,8 @@ + reg = <0xe2100000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <17>; +- dma-names = "rx", "tx"; +- dmas = <&pdma1 12>, <&pdma1 13>; ++ dma-names = "tx", "rx"; ++ dmas = <&pdma1 13>, <&pdma1 12>; + clock-names = "iis", "i2s_opclk0"; + clocks = <&clocks CLK_I2S1>, <&clocks SCLK_AUDIO1>; + pinctrl-names = "default"; +@@ -274,8 +274,8 @@ + reg = <0xe2a00000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <18>; +- dma-names = "rx", "tx"; +- dmas = <&pdma1 14>, <&pdma1 15>; ++ dma-names = "tx", "rx"; ++ dmas = <&pdma1 15>, <&pdma1 14>; + clock-names = "iis", "i2s_opclk0"; + clocks = <&clocks CLK_I2S2>, <&clocks SCLK_AUDIO2>; + pinctrl-names = "default"; +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-socfpga-align-interrupt-controller-node-name.patch b/queue-5.15/arm-dts-socfpga-align-interrupt-controller-node-name.patch new file mode 100644 index 00000000000..268942736ad --- /dev/null +++ b/queue-5.15/arm-dts-socfpga-align-interrupt-controller-node-name.patch @@ -0,0 +1,51 @@ +From 9da122828e320041dd562fa65a2247d6c614ab31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:30:22 +0200 +Subject: ARM: dts: socfpga: align interrupt controller node name with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit c9bdd50d2019f78bf4c1f6a79254c27771901023 ] + +Fixes dtbs_check warnings like: + + $nodename:0: 'intc@fffed000' does not match '^interrupt-controller(@[0-9a-f,]+)*$' + +Signed-off-by: Krzysztof Kozlowski +Acked-by: Dinh Nguyen +Link: https://lore.kernel.org/r/20220317115705.450427-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/socfpga.dtsi | 2 +- + arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi +index 7c1d6423d7f8..b8c5dd7860cb 100644 +--- a/arch/arm/boot/dts/socfpga.dtsi ++++ b/arch/arm/boot/dts/socfpga.dtsi +@@ -46,7 +46,7 @@ + <0xff113000 0x1000>; + }; + +- intc: intc@fffed000 { ++ intc: interrupt-controller@fffed000 { + compatible = "arm,cortex-a9-gic"; + #interrupt-cells = <3>; + interrupt-controller; +diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi +index 3ba431dfa8c9..f1e50d2e623a 100644 +--- a/arch/arm/boot/dts/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi +@@ -38,7 +38,7 @@ + <0xff113000 0x1000>; + }; + +- intc: intc@ffffd000 { ++ intc: interrupt-controller@ffffd000 { + compatible = "arm,cortex-a9-gic"; + #interrupt-cells = <3>; + interrupt-controller; +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch b/queue-5.15/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch new file mode 100644 index 00000000000..b03f882a48a --- /dev/null +++ b/queue-5.15/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch @@ -0,0 +1,46 @@ +From bde494a79b3c062c16f5dec69f43f042bcec241c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:58:51 +0100 +Subject: ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit ef2d90708883f4025a801feb0ba8411a7a4387e1 ] + +Per KSZ9031RNX PHY datasheet FIGURE 7-5: POWER-UP/POWER-DOWN/RESET TIMING +Note 2: After the de-assertion of reset, wait a minimum of 100 μs before +starting programming on the MIIM (MDC/MDIO) interface. + +Add 1ms post-reset delay to guarantee this figure. + +Fixes: 010ca9fe500bf ("ARM: dts: stm32: Add missing ethernet PHY reset on AV96") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index 6885948f3024..8eb51d84b698 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -141,6 +141,7 @@ + compatible = "snps,dwmac-mdio"; + reset-gpios = <&gpioz 2 GPIO_ACTIVE_LOW>; + reset-delay-us = <1000>; ++ reset-post-delay-us = <1000>; + + phy0: ethernet-phy@7 { + reg = <7>; +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch b/queue-5.15/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch new file mode 100644 index 00000000000..2ae6e80ac47 --- /dev/null +++ b/queue-5.15/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch @@ -0,0 +1,52 @@ +From ab20c4df07eed1b064f79786eaca94cb9e6a3202 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 16:23:40 +0000 +Subject: ARM: dts: suniv: F1C100: fix watchdog compatible + +From: Andre Przywara + +[ Upstream commit 01a850ee61cbf0ab77dcbf26bb133fec2dd640d6 ] + +The F1C100 series of SoCs actually have their watchdog IP being +compatible with the newer Allwinner generation, not the older one. + +The currently described sun4i-a10-wdt actually does not work, neither +the watchdog functionality (just never fires), nor the reset part +(reboot hangs). + +Replace the compatible string with the one used by the newer generation. +Verified to work with both the watchdog and reboot functionality on a +LicheePi Nano. + +Also add the missing interrupt line and clock source, to make it binding +compliant. + +Fixes: 4ba16d17efdd ("ARM: dts: suniv: add initial DTSI file for F1C100s") +Signed-off-by: Andre Przywara +Acked-by: Guenter Roeck +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20220317162349.739636-4-andre.przywara@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/suniv-f1c100s.dtsi b/arch/arm/boot/dts/suniv-f1c100s.dtsi +index 6100d3b75f61..def830101448 100644 +--- a/arch/arm/boot/dts/suniv-f1c100s.dtsi ++++ b/arch/arm/boot/dts/suniv-f1c100s.dtsi +@@ -104,8 +104,10 @@ + + wdt: watchdog@1c20ca0 { + compatible = "allwinner,suniv-f1c100s-wdt", +- "allwinner,sun4i-a10-wdt"; ++ "allwinner,sun6i-a31-wdt"; + reg = <0x01c20ca0 0x20>; ++ interrupts = <16>; ++ clocks = <&osc32k>; + }; + + uart0: serial@1c25000 { +-- +2.35.1 + diff --git a/queue-5.15/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch b/queue-5.15/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch new file mode 100644 index 00000000000..8b19b4feaa7 --- /dev/null +++ b/queue-5.15/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch @@ -0,0 +1,52 @@ +From 5f7446c54013ef79ee53932a6adaa7cc43d02b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 10:43:06 +0000 +Subject: ARM: hisi: Add missing of_node_put after of_find_compatible_node + +From: Peng Wu + +[ Upstream commit 9bc72e47d4630d58a840a66a869c56b29554cfe4 ] + +of_find_compatible_node will increment the refcount of the returned +device_node. Calling of_node_put() to avoid the refcount leak + +Signed-off-by: Peng Wu +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +--- + arch/arm/mach-hisi/platsmp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/mach-hisi/platsmp.c b/arch/arm/mach-hisi/platsmp.c +index a56cc64deeb8..9ce93e0b6cdc 100644 +--- a/arch/arm/mach-hisi/platsmp.c ++++ b/arch/arm/mach-hisi/platsmp.c +@@ -67,14 +67,17 @@ static void __init hi3xxx_smp_prepare_cpus(unsigned int max_cpus) + } + ctrl_base = of_iomap(np, 0); + if (!ctrl_base) { ++ of_node_put(np); + pr_err("failed to map address\n"); + return; + } + if (of_property_read_u32(np, "smp-offset", &offset) < 0) { ++ of_node_put(np); + pr_err("failed to find smp-offset property\n"); + return; + } + ctrl_base += offset; ++ of_node_put(np); + } + } + +@@ -160,6 +163,7 @@ static int hip01_boot_secondary(unsigned int cpu, struct task_struct *idle) + if (WARN_ON(!node)) + return -1; + ctrl_base = of_iomap(node, 0); ++ of_node_put(node); + + /* set the secondary core boot from DDR */ + remap_reg_value = readl_relaxed(ctrl_base + REG_SC_CTRL); +-- +2.35.1 + diff --git a/queue-5.15/arm-mediatek-select-arch-timer-for-mt7629.patch b/queue-5.15/arm-mediatek-select-arch-timer-for-mt7629.patch new file mode 100644 index 00000000000..01a2dcf96ab --- /dev/null +++ b/queue-5.15/arm-mediatek-select-arch-timer-for-mt7629.patch @@ -0,0 +1,38 @@ +From e95e3578fcfa149bd1005b51d9a03a35c5ef9d0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Apr 2022 17:13:47 +0800 +Subject: arm: mediatek: select arch timer for mt7629 + +From: Chuanhong Guo + +[ Upstream commit d66aea197d534e23d4989eb72fca9c0c114b97c9 ] + +This chip has an armv7 arch timer according to the dts. Select it in +Kconfig to enforce the support for it. +Otherwise the system time is just completely wrong if user forget to +enable ARM_ARCH_TIMER in kernel config. + +Fixes: a43379dddf1b ("arm: mediatek: add MT7629 smp bring up code") +Signed-off-by: Chuanhong Guo +Link: https://lore.kernel.org/r/20220409091347.2473449-1-gch981213@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm/mach-mediatek/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-mediatek/Kconfig b/arch/arm/mach-mediatek/Kconfig +index 9e0f592d87d8..35a3430c7942 100644 +--- a/arch/arm/mach-mediatek/Kconfig ++++ b/arch/arm/mach-mediatek/Kconfig +@@ -30,6 +30,7 @@ config MACH_MT7623 + config MACH_MT7629 + bool "MediaTek MT7629 SoCs support" + default ARCH_MEDIATEK ++ select HAVE_ARM_ARCH_TIMER + + config MACH_MT8127 + bool "MediaTek MT8127 SoCs support" +-- +2.35.1 + diff --git a/queue-5.15/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch b/queue-5.15/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch new file mode 100644 index 00000000000..6a9042e60b2 --- /dev/null +++ b/queue-5.15/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch @@ -0,0 +1,37 @@ +From f6632242d2e1b592d5a47c6ed37a225d66f92f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Apr 2022 15:07:54 +0200 +Subject: ARM: OMAP1: clock: Fix UART rate reporting algorithm + +From: Janusz Krzysztofik + +[ Upstream commit 338d5d476cde853dfd97378d20496baabc2ce3c0 ] + +Since its introduction to the mainline kernel, omap1_uart_recalc() helper +makes incorrect use of clk->enable_bit as a ready to use bitmap mask while +it only provides the bit number. Fix it. + +Signed-off-by: Janusz Krzysztofik +Acked-by: Tony Lindgren +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/clock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c +index 9d4a0ab50a46..d63d5eb8d8fd 100644 +--- a/arch/arm/mach-omap1/clock.c ++++ b/arch/arm/mach-omap1/clock.c +@@ -41,7 +41,7 @@ static DEFINE_SPINLOCK(clockfw_lock); + unsigned long omap1_uart_recalc(struct clk *clk) + { + unsigned int val = __raw_readl(clk->enable_reg); +- return val & clk->enable_bit ? 48000000 : 12000000; ++ return val & 1 << clk->enable_bit ? 48000000 : 12000000; + } + + unsigned long omap1_sossi_recalc(struct clk *clk) +-- +2.35.1 + diff --git a/queue-5.15/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch b/queue-5.15/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch new file mode 100644 index 00000000000..1078fb5f140 --- /dev/null +++ b/queue-5.15/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch @@ -0,0 +1,37 @@ +From 568aa3a0b1d42e49536be2cdc51163495549c229 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 01:03:56 +0200 +Subject: ARM: versatile: Add missing of_node_put in dcscb_init + +From: Peng Wu + +[ Upstream commit 23b44f9c649bbef10b45fa33080cd8b4166800ae ] + +The device_node pointer is returned by of_find_compatible_node +with refcount incremented. We should use of_node_put() to avoid +the refcount leak. + +Signed-off-by: Peng Wu +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20220428230356.69418-1-linus.walleij@linaro.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-vexpress/dcscb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c +index a0554d7d04f7..e1adc098f89a 100644 +--- a/arch/arm/mach-vexpress/dcscb.c ++++ b/arch/arm/mach-vexpress/dcscb.c +@@ -144,6 +144,7 @@ static int __init dcscb_init(void) + if (!node) + return -ENODEV; + dcscb_base = of_iomap(node, 0); ++ of_node_put(node); + if (!dcscb_base) + return -EADDRNOTAVAIL; + cfg = readl_relaxed(dcscb_base + DCS_CFG_R); +-- +2.35.1 + diff --git a/queue-5.15/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch b/queue-5.15/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch new file mode 100644 index 00000000000..21ea4ad3fde --- /dev/null +++ b/queue-5.15/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch @@ -0,0 +1,77 @@ +From 8eaa0429285edbbc2d0cd3254ca355c5b4751b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 12:44:41 +0100 +Subject: arm64: compat: Do not treat syscall number as ESR_ELx for a bad + syscall + +From: Alexandru Elisei + +[ Upstream commit 3fed9e551417b84038b15117732ea4505eee386b ] + +If a compat process tries to execute an unknown system call above the +__ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the +offending process. Information about the error is printed to dmesg in +compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() -> +arm64_show_signal(). + +arm64_show_signal() interprets a non-zero value for +current->thread.fault_code as an exception syndrome and displays the +message associated with the ESR_ELx.EC field (bits 31:26). +current->thread.fault_code is set in compat_arm_syscall() -> +arm64_notify_die() with the bad syscall number instead of a valid ESR_ELx +value. This means that the ESR_ELx.EC field has the value that the user set +for the syscall number and the kernel can end up printing bogus exception +messages*. For example, for the syscall number 0x68000000, which evaluates +to ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error: + +[ 18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000] +[ 18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79 +[ 18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT) +[..] + +which is misleading, as the bad compat syscall has nothing to do with +pointer authentication. + +Stop arm64_show_signal() from printing exception syndrome information by +having compat_arm_syscall() set the ESR_ELx value to 0, as it has no +meaning for an invalid system call number. The example above now becomes: + +[ 19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000] +[ 19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80 +[ 19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT) +[..] + +which although shows less information because the syscall number, +wrongfully advertised as the ESR value, is missing, it is better than +showing plainly wrong information. The syscall number can be easily +obtained with strace. + +*A 32-bit value above or equal to 0x8000_0000 is interpreted as a negative +integer in compat_arm_syscal() and the condition scno < __ARM_NR_COMPAT_END +evaluates to true; the syscall will exit to userspace in this case with the +ENOSYS error code instead of arm64_notify_die() being called. + +Signed-off-by: Alexandru Elisei +Reviewed-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220425114444.368693-3-alexandru.elisei@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/sys_compat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c +index db5159a3055f..b88a52f7188f 100644 +--- a/arch/arm64/kernel/sys_compat.c ++++ b/arch/arm64/kernel/sys_compat.c +@@ -114,6 +114,6 @@ long compat_arm_syscall(struct pt_regs *regs, int scno) + addr = instruction_pointer(regs) - (compat_thumb_mode(regs) ? 2 : 4); + + arm64_notify_die("Oops - bad compat syscall(2)", regs, +- SIGILL, ILL_ILLTRP, addr, scno); ++ SIGILL, ILL_ILLTRP, addr, 0); + return 0; + } +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch b/queue-5.15/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch new file mode 100644 index 00000000000..2729e832b5c --- /dev/null +++ b/queue-5.15/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch @@ -0,0 +1,36 @@ +From 4959ccc72516c46f89bba32d8f70ec97087110a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 19:09:19 +0200 +Subject: arm64: dts: marvell: espressobin-ultra: enable front USB3 port + +From: Robert Marko + +[ Upstream commit eacec7ebc16cf5d2f6a6c7cf5d57156da2c3e98f ] + +Espressobin Ultra has a front panel USB3.0 Type-A port which works +just fine so enable it. +I dont see a reason why it was disabled in the first place anyway. + +Fixes: 3404fe15a60f ("arm64: dts: marvell: add DT for ESPRESSObin-Ultra") +Signed-off-by: Robert Marko +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +index 610ff6f385c7..119db6b541b7 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +@@ -108,7 +108,6 @@ + + &usb3 { + usb-phy = <&usb3_phy>; +- status = "disabled"; + }; + + &mdio { +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch b/queue-5.15/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch new file mode 100644 index 00000000000..ab775a74657 --- /dev/null +++ b/queue-5.15/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch @@ -0,0 +1,43 @@ +From 2f5ce659fb8942849b1a8e4bf9dfb79c48396100 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 19:09:17 +0200 +Subject: arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config + +From: Robert Marko + +[ Upstream commit 5202f4c3816b42e989f9cad49a73c7e88fba89f4 ] + +SPI config for the SPI-NOR is incorrect and completely breaking +reading/writing to the onboard SPI-NOR. + +SPI-NOR is connected in the single(x1) IO mode and not in the quad +(x4) mode. +Also, there is no need to override the max frequency from the DTSI +as the mx25u3235f that is used supports 104Mhz. + +Fixes: 3404fe15a60f ("arm64: dts: marvell: add DT for ESPRESSObin-Ultra") +Signed-off-by: Robert Marko +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +index c5eb3604dd5b..610ff6f385c7 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +@@ -71,10 +71,6 @@ + + &spi0 { + flash@0 { +- spi-max-frequency = <108000000>; +- spi-rx-bus-width = <4>; +- spi-tx-bus-width = <4>; +- + partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch b/queue-5.15/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch new file mode 100644 index 00000000000..a1d01428150 --- /dev/null +++ b/queue-5.15/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch @@ -0,0 +1,43 @@ +From 125037c9997c717b53ee7b70c648df5504cde6cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 22:45:22 +0800 +Subject: arm64: dts: mt8192: Fix nor_flash status disable typo +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Allen-KH Cheng + +[ Upstream commit 27f0eb16b0d417c155e96b5d3b89074699944e09 ] + +Correct nor_flash status disable typo of mt8192 SoC. + +Fixes: d0a197a0d064a ("arm64: dts: mt8192: add nor_flash device node") + +Signed-off-by: Allen-KH Cheng +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Miles Chen +Reviewed-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20220318144534.17996-11-allen-kh.cheng@mediatek.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 9757138a8bbd..cb1e46d2c1ba 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -433,7 +433,7 @@ + clock-names = "spi", "sf", "axi"; + #address-cells = <1>; + #size-cells = <0>; +- status = "disable"; ++ status = "disabled"; + }; + + i2c3: i2c3@11cb0000 { +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch b/queue-5.15/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch new file mode 100644 index 00000000000..3f7c5e60a51 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch @@ -0,0 +1,45 @@ +From 62504349456bb93e6cbcee384c96d6560c844cd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 18:46:43 +0100 +Subject: arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count + +From: Konrad Dybcio + +[ Upstream commit 1ae438d26b620979ed004d559c304d31c42173ae ] + +MSM8994 actually features 24 DMA channels for each BLSP, +fix it! + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220319174645.340379-14-konrad.dybcio@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index 1165269f059e..3c27671c8b5c 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -498,7 +498,7 @@ + #dma-cells = <1>; + qcom,ee = <0>; + qcom,controlled-remotely; +- num-channels = <18>; ++ num-channels = <24>; + qcom,num-ees = <4>; + }; + +@@ -634,7 +634,7 @@ + #dma-cells = <1>; + qcom,ee = <0>; + qcom,controlled-remotely; +- num-channels = <18>; ++ num-channels = <24>; + qcom,num-ees = <4>; + }; + +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch b/queue-5.15/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch new file mode 100644 index 00000000000..388f867a2b6 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch @@ -0,0 +1,38 @@ +From f535f5a1c3bc550a44de211579a26d914d1c4e3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 18:46:38 +0100 +Subject: arm64: dts: qcom: msm8994: Fix the cont_splash_mem address + +From: Konrad Dybcio + +[ Upstream commit 049c46f31a726bf8d202ff1681661513447fac84 ] + +The default memory map places cont_splash_mem at 3401000, which was +overlooked.. Fix it! + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220319174645.340379-9-konrad.dybcio@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index 5a9a5ed0565f..1165269f059e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -183,8 +183,8 @@ + no-map; + }; + +- cont_splash_mem: memory@3800000 { +- reg = <0 0x03800000 0 0x2400000>; ++ cont_splash_mem: memory@3401000 { ++ reg = <0 0x03401000 0 0x2200000>; + no-map; + }; + +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch b/queue-5.15/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch new file mode 100644 index 00000000000..be529d1ed93 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch @@ -0,0 +1,38 @@ +From ffcabee3494e8052738ac7f304244bcd9d6f1893 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 13:05:02 +0530 +Subject: arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name + +From: Vinod Koul + +[ Upstream commit 1eae95fb1d696968ca72be3ac8e0d62bb4d8da42 ] + +Per DT spec node names should not have underscores (_) in them, so +change can_clock to can-clock. + +Fixes: 5c44c564e449 ("arm64: dts: qcom: qrb5165-rb5: Add support for MCP2518FD") +Signed-off-by: Vinod Koul +Acked-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220421073502.1824089-1-vkoul@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +index 28d5b5528516..0ce2d36ab257 100644 +--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts ++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +@@ -27,7 +27,7 @@ + }; + + /* Fixed crystal oscillator dedicated to MCP2518FD */ +- clk40M: can_clock { ++ clk40M: can-clock { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <40000000>; +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch b/queue-5.15/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch new file mode 100644 index 00000000000..3bb6c2f4c75 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch @@ -0,0 +1,37 @@ +From df763823610928dde441ebde3c823cab75374fcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 12:15:04 +0530 +Subject: arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's + vddio-supply property + +From: Joel Selvaraj + +[ Upstream commit 1f1c494082a1f10d03ce4ee1485ee96d212e22ff ] + +vddio is misspelled with a "0" instead of "o". Fix it. + +Signed-off-by: Joel Selvaraj +Reviewed-by: Caleb Connolly +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/BY5PR02MB7009901651E6A8D5ACB0425ED91F9@BY5PR02MB7009.namprd02.prod.outlook.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts +index c60c8c640e17..736951fabb7a 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts +@@ -221,7 +221,7 @@ + panel@0 { + compatible = "tianma,fhd-video"; + reg = <0>; +- vddi0-supply = <&vreg_l14a_1p8>; ++ vddio-supply = <&vreg_l14a_1p8>; + vddpos-supply = <&lab>; + vddneg-supply = <&ibb>; + +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch b/queue-5.15/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch new file mode 100644 index 00000000000..f3a40e92dd1 --- /dev/null +++ b/queue-5.15/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch @@ -0,0 +1,43 @@ +From 4a8172d6a5d66e4c78cd3089c57be646b913c92f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Mar 2022 17:27:06 +0800 +Subject: arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 + +From: Shawn Lin + +[ Upstream commit 4246d0bab2a8685e3d4aec2cb0ef8c526689ce96 ] + +drive-impedance-ohm is introduced for emmc phy instead of pcie phy. + +Fixes: fb8b7460c995 ("arm64: dts: rockchip: Define drive-impedance-ohm for RK3399's emmc-phy.") +Signed-off-by: Shawn Lin +Link: https://lore.kernel.org/r/1647336426-154797-1-git-send-email-shawn.lin@rock-chips.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index 00f1d036dfe0..4255e2d7a72f 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1477,6 +1477,7 @@ + reg = <0xf780 0x24>; + clocks = <&sdhci>; + clock-names = "emmcclk"; ++ drive-impedance-ohm = <50>; + #phy-cells = <0>; + status = "disabled"; + }; +@@ -1487,7 +1488,6 @@ + clock-names = "refclk"; + #phy-cells = <1>; + resets = <&cru SRST_PCIEPHY>; +- drive-impedance-ohm = <50>; + reset-names = "phy"; + status = "disabled"; + }; +-- +2.35.1 + diff --git a/queue-5.15/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch b/queue-5.15/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch new file mode 100644 index 00000000000..58465ca8cf2 --- /dev/null +++ b/queue-5.15/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch @@ -0,0 +1,50 @@ +From c6a29da786079ae063ce7439b90b4cbc3790eea7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 09:51:57 +0200 +Subject: arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates + +From: Matthias Schiffer + +[ Upstream commit 439677d416b17dd39964d5f7d64b742a2e51da5b ] + +We found that (at least some versions of) the sci-fw set the base clock +rate for UARTs in the MCU domain to 96 MHz instead of the expected 48 MHz, +leading to incorrect baud rates when used from Linux. + +As the 8250_omap driver will query the actual clock rate from the clk +driver when clock-frequency is unset, removing the incorrect property is +sufficient to fix the baud rate. + +Fixes: 8abae9389bdb ("arm64: dts: ti: Add support for AM642 SoC") +Signed-off-by: Matthias Schiffer +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20220419075157.189347-1-matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi b/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi +index 59cc58f7d0c8..93e684bbd66c 100644 +--- a/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi +@@ -10,7 +10,6 @@ + compatible = "ti,am64-uart", "ti,am654-uart"; + reg = <0x00 0x04a00000 0x00 0x100>; + interrupts = ; +- clock-frequency = <48000000>; + current-speed = <115200>; + power-domains = <&k3_pds 149 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 149 0>; +@@ -21,7 +20,6 @@ + compatible = "ti,am64-uart", "ti,am654-uart"; + reg = <0x00 0x04a10000 0x00 0x100>; + interrupts = ; +- clock-frequency = <48000000>; + current-speed = <115200>; + power-domains = <&k3_pds 160 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 160 0>; +-- +2.35.1 + diff --git a/queue-5.15/arm64-fix-types-in-copy_highpage.patch b/queue-5.15/arm64-fix-types-in-copy_highpage.patch new file mode 100644 index 00000000000..9190bf8c66a --- /dev/null +++ b/queue-5.15/arm64-fix-types-in-copy_highpage.patch @@ -0,0 +1,50 @@ +From 9849e7d6f25c9877b78ecfbfd350ae9682d16e57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 03:04:13 +0000 +Subject: arm64: fix types in copy_highpage() + +From: Tong Tiangen + +[ Upstream commit 921d161f15d6b090599f6a8c23f131969edbd1fa ] + +In copy_highpage() the `kto` and `kfrom` local variables are pointers to +struct page, but these are used to hold arbitrary pointers to kernel memory +. Each call to page_address() returns a void pointer to memory associated +with the relevant page, and copy_page() expects void pointers to this +memory. + +This inconsistency was introduced in commit 2563776b41c3 ("arm64: mte: +Tags-aware copy_{user_,}highpage() implementations") and while this +doesn't appear to be harmful in practice it is clearly wrong. + +Correct this by making `kto` and `kfrom` void pointers. + +Fixes: 2563776b41c3 ("arm64: mte: Tags-aware copy_{user_,}highpage() implementations") +Signed-off-by: Tong Tiangen +Acked-by: Mark Rutland +Reviewed-by: Kefeng Wang +Link: https://lore.kernel.org/r/20220420030418.3189040-3-tongtiangen@huawei.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/copypage.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c +index b5447e53cd73..0dea80bf6de4 100644 +--- a/arch/arm64/mm/copypage.c ++++ b/arch/arm64/mm/copypage.c +@@ -16,8 +16,8 @@ + + void copy_highpage(struct page *to, struct page *from) + { +- struct page *kto = page_address(to); +- struct page *kfrom = page_address(from); ++ void *kto = page_address(to); ++ void *kfrom = page_address(from); + + copy_page(kto, kfrom); + +-- +2.35.1 + diff --git a/queue-5.15/arm64-stackleak-fix-current_top_of_stack.patch b/queue-5.15/arm64-stackleak-fix-current_top_of_stack.patch new file mode 100644 index 00000000000..bd25e829576 --- /dev/null +++ b/queue-5.15/arm64-stackleak-fix-current_top_of_stack.patch @@ -0,0 +1,106 @@ +From 315476024755566c3df96cb9ede4d6cf06eaa462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 18:31:16 +0100 +Subject: arm64: stackleak: fix current_top_of_stack() + +From: Mark Rutland + +[ Upstream commit e85094c31ddb794ac41c299a5a7a68243148f829 ] + +Due to some historical confusion, arm64's current_top_of_stack() isn't +what the stackleak code expects. This could in theory result in a number +of problems, and practically results in an unnecessary performance hit. +We can avoid this by aligning the arm64 implementation with the x86 +implementation. + +The arm64 implementation of current_top_of_stack() was added +specifically for stackleak in commit: + + 0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin") + +This was intended to be equivalent to the x86 implementation, but the +implementation, semantics, and performance characteristics differ +wildly: + +* On x86, current_top_of_stack() returns the top of the current task's + task stack, regardless of which stack is in active use. + + The implementation accesses a percpu variable which the x86 entry code + maintains, and returns the location immediately above the pt_regs on + the task stack (above which x86 has some padding). + +* On arm64 current_top_of_stack() returns the top of the stack in active + use (i.e. the one which is currently being used). + + The implementation checks the SP against a number of + potentially-accessible stacks, and will BUG() if no stack is found. + +The core stackleak_erase() code determines the upper bound of stack to +erase with: + +| if (on_thread_stack()) +| boundary = current_stack_pointer; +| else +| boundary = current_top_of_stack(); + +On arm64 stackleak_erase() is always called on a task stack, and +on_thread_stack() should always be true. On x86, stackleak_erase() is +mostly called on a trampoline stack, and is sometimes called on a task +stack. + +Currently, this results in a lot of unnecessary code being generated for +arm64 for the impossible !on_thread_stack() case. Some of this is +inlined, bloating stackleak_erase(), while portions of this are left +out-of-line and permitted to be instrumented (which would be a +functional problem if that code were reachable). + +As a first step towards improving this, this patch aligns arm64's +implementation of current_top_of_stack() with x86's, always returning +the top of the current task's stack. With GCC 11.1.0 this results in the +bulk of the unnecessary code being removed, including all of the +out-of-line instrumentable code. + +While I don't believe there's a functional problem in practice I've +marked this as a fix since the semantic was clearly wrong, the fix +itself is simple, and other code might rely upon this in future. + +Fixes: 0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin") +Signed-off-by: Mark Rutland +Cc: Alexander Popov +Cc: Andrew Morton +Cc: Andy Lutomirski +Cc: Catalin Marinas +Cc: Kees Cook +Cc: Will Deacon +Acked-by: Catalin Marinas +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220427173128.2603085-2-mark.rutland@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/processor.h | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h +index ee2bdc1b9f5b..5e73d7f7d1e7 100644 +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -335,12 +335,10 @@ long get_tagged_addr_ctrl(struct task_struct *task); + * of header definitions for the use of task_stack_page. + */ + +-#define current_top_of_stack() \ +-({ \ +- struct stack_info _info; \ +- BUG_ON(!on_accessible_stack(current, current_stack_pointer, 1, &_info)); \ +- _info.high; \ +-}) ++/* ++ * The top of the current task's task stack ++ */ ++#define current_top_of_stack() ((unsigned long)current->stack + THREAD_SIZE) + #define on_thread_stack() (on_task_stack(current, current_stack_pointer, 1, NULL)) + + #endif /* __ASSEMBLY__ */ +-- +2.35.1 + diff --git a/queue-5.15/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch b/queue-5.15/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch new file mode 100644 index 00000000000..919c92d8ee1 --- /dev/null +++ b/queue-5.15/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch @@ -0,0 +1,44 @@ +From 33256a7fe9049edf170eb0240e50507d46d07e37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:30 +0100 +Subject: ASoC: atmel-classd: Remove endianness flag on class d component + +From: Charles Keepax + +[ Upstream commit 0104d52a6a69b06b0e8167f7c1247e8c76aca070 ] + +The endianness flag should have been removed when the driver was +ported across from having both a CODEC and CPU side component, to +just having a CPU component and using the dummy for the CODEC. The +endianness flag is used to indicate that the device is completely +ambivalent to the endianness of the data, typically due to the +endianness being lost over the hardware link (ie. the link defines +bit ordering). It's usage didn't have any effect when the driver +had both a CPU and CODEC component, since the union of those equals +the CPU side settings, but now causes the driver to falsely report +it supports big endian. Correct this by removing the flag. + +Fixes: 1dfdbe73ccf9 ("ASoC: atmel-classd: remove codec component") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-classd.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c +index a9f9f449c48c..74b7b2611aa7 100644 +--- a/sound/soc/atmel/atmel-classd.c ++++ b/sound/soc/atmel/atmel-classd.c +@@ -458,7 +458,6 @@ static const struct snd_soc_component_driver atmel_classd_cpu_dai_component = { + .num_controls = ARRAY_SIZE(atmel_classd_snd_controls), + .idle_bias_on = 1, + .use_pmdown_time = 1, +- .endianness = 1, + }; + + /* ASoC sound card */ +-- +2.35.1 + diff --git a/queue-5.15/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch b/queue-5.15/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch new file mode 100644 index 00000000000..199e9aa50f3 --- /dev/null +++ b/queue-5.15/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch @@ -0,0 +1,44 @@ +From 8285a13e64470a24ba2090284bdfe08370550de7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:29 +0100 +Subject: ASoC: atmel-pdmic: Remove endianness flag on pdmic component + +From: Charles Keepax + +[ Upstream commit 52857c3baa0e5ddeba7b2c84e56bb71c9674e048 ] + +The endianness flag should have been removed when the driver was +ported across from having both a CODEC and CPU side component, to +just having a CPU component and using the dummy for the CODEC. The +endianness flag is used to indicate that the device is completely +ambivalent to the endianness of the data, typically due to the +endianness being lost over the hardware link (ie. the link defines +bit ordering). It's usage didn't have any effect when the driver +had both a CPU and CODEC component, since the union of those equals +the CPU side settings, but now causes the driver to falsely report +it supports big endian. Correct this by removing the flag. + +Fixes: f3c668074a04 ("ASoC: atmel-pdmic: remove codec component") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-pdmic.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel-pdmic.c b/sound/soc/atmel/atmel-pdmic.c +index 42117de299e7..ea34efac2fff 100644 +--- a/sound/soc/atmel/atmel-pdmic.c ++++ b/sound/soc/atmel/atmel-pdmic.c +@@ -481,7 +481,6 @@ static const struct snd_soc_component_driver atmel_pdmic_cpu_dai_component = { + .num_controls = ARRAY_SIZE(atmel_pdmic_snd_controls), + .idle_bias_on = 1, + .use_pmdown_time = 1, +- .endianness = 1, + }; + + /* ASoC sound card */ +-- +2.35.1 + diff --git a/queue-5.15/asoc-dapm-don-t-fold-register-value-changes-into-not.patch b/queue-5.15/asoc-dapm-don-t-fold-register-value-changes-into-not.patch new file mode 100644 index 00000000000..38db2566f7c --- /dev/null +++ b/queue-5.15/asoc-dapm-don-t-fold-register-value-changes-into-not.patch @@ -0,0 +1,51 @@ +From cfe062206b6ed55d6691ac456480e15a75d58304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 17:18:32 +0100 +Subject: ASoC: dapm: Don't fold register value changes into notifications + +From: Mark Brown + +[ Upstream commit ad685980469b9f9b99d4d6ea05f4cb8f57cb2234 ] + +DAPM tracks and reports the value presented to the user from DAPM controls +separately to the register value, these may diverge during initialisation +or when an autodisable control is in use. + +When writing DAPM controls we currently report that a change has occurred +if either the DAPM value or the value stored in the register has changed, +meaning that if the two are out of sync we may appear to report a spurious +event to userspace. Since we use this folded in value for nothing other +than the value reported to userspace simply drop the folding in of the +register change. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220428161833.3690050-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 0b166e074457..47b85ba5b7d6 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3428,7 +3428,6 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol, + update.val = val; + card->update = &update; + } +- change |= reg_change; + + ret = soc_dapm_mixer_update_power(card, kcontrol, connect, + rconnect); +@@ -3530,7 +3529,6 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol, + update.val = val; + card->update = &update; + } +- change |= reg_change; + + ret = soc_dapm_mux_update_power(card, kcontrol, item[0], e); + +-- +2.35.1 + diff --git a/queue-5.15/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch b/queue-5.15/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch new file mode 100644 index 00000000000..7817e88b18b --- /dev/null +++ b/queue-5.15/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch @@ -0,0 +1,84 @@ +From 8d9f95c13b17e7a9a2f04328e7d3574bcb4859d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 10:58:03 +0400 +Subject: ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe + +From: Miaoqian Lin + +[ Upstream commit 41cd312dfe980af869c3503b4d38e62ed20dd3b7 ] + +of_find_i2c_device_by_node() takes a reference, +In error paths, we should call put_device() to drop +the reference to aviod refount leak. + +Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000") +Signed-off-by: Miaoqian Lin +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20220511065803.3957-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-sgtl5000.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c +index 52bb1844f548..c4e3699ad305 100644 +--- a/sound/soc/fsl/imx-sgtl5000.c ++++ b/sound/soc/fsl/imx-sgtl5000.c +@@ -120,19 +120,19 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; +- goto fail; ++ goto put_device; + } + + comp = devm_kzalloc(&pdev->dev, 3 * sizeof(*comp), GFP_KERNEL); + if (!comp) { + ret = -ENOMEM; +- goto fail; ++ goto put_device; + } + + data->codec_clk = clk_get(&codec_dev->dev, NULL); + if (IS_ERR(data->codec_clk)) { + ret = PTR_ERR(data->codec_clk); +- goto fail; ++ goto put_device; + } + + data->clk_frequency = clk_get_rate(data->codec_clk); +@@ -158,10 +158,10 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + data->card.dev = &pdev->dev; + ret = snd_soc_of_parse_card_name(&data->card, "model"); + if (ret) +- goto fail; ++ goto put_device; + ret = snd_soc_of_parse_audio_routing(&data->card, "audio-routing"); + if (ret) +- goto fail; ++ goto put_device; + data->card.num_links = 1; + data->card.owner = THIS_MODULE; + data->card.dai_link = &data->dai; +@@ -174,7 +174,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + ret = devm_snd_soc_register_card(&pdev->dev, &data->card); + if (ret) { + dev_err_probe(&pdev->dev, ret, "snd_soc_register_card failed\n"); +- goto fail; ++ goto put_device; + } + + of_node_put(ssi_np); +@@ -182,6 +182,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + + return 0; + ++put_device: ++ put_device(&codec_dev->dev); + fail: + if (data && !IS_ERR(data->codec_clk)) + clk_put(data->codec_clk); +-- +2.35.1 + diff --git a/queue-5.15/asoc-fsl-use-dev_err_probe-helper.patch b/queue-5.15/asoc-fsl-use-dev_err_probe-helper.patch new file mode 100644 index 00000000000..c0b4f5099ca --- /dev/null +++ b/queue-5.15/asoc-fsl-use-dev_err_probe-helper.patch @@ -0,0 +1,112 @@ +From 2fff0f3b36ae65d14a2cd5f2a4f55735a5d6d7df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Dec 2021 11:08:34 +0900 +Subject: ASoC: fsl: Use dev_err_probe() helper + +From: Kuninori Morimoto + +[ Upstream commit 2e6f557ca35aa330dbf31c5e1cc8119eff1526fa ] + +Use the dev_err_probe() helper, instead of open-coding the same +operation. + +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/20211214020843.2225831-14-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl-asoc-card.c | 3 +-- + sound/soc/fsl/imx-card.c | 17 ++++++----------- + sound/soc/fsl/imx-sgtl5000.c | 4 +--- + sound/soc/fsl/imx-spdif.c | 4 ++-- + 4 files changed, 10 insertions(+), 18 deletions(-) + +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index 06107ae46e20..95286c839b57 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -842,8 +842,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev) + + ret = devm_snd_soc_register_card(&pdev->dev, &priv->card); + if (ret) { +- if (ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret); ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card failed\n"); + goto asrc_fail; + } + +diff --git a/sound/soc/fsl/imx-card.c b/sound/soc/fsl/imx-card.c +index db947180617a..55bc1bb0dbbd 100644 +--- a/sound/soc/fsl/imx-card.c ++++ b/sound/soc/fsl/imx-card.c +@@ -579,9 +579,8 @@ static int imx_card_parse_of(struct imx_card_data *data) + + ret = snd_soc_of_get_dai_name(cpu, &link->cpus->dai_name); + if (ret) { +- if (ret != -EPROBE_DEFER) +- dev_err(card->dev, "%s: error getting cpu dai name: %d\n", +- link->name, ret); ++ dev_err_probe(card->dev, ret, ++ "%s: error getting cpu dai name\n", link->name); + goto err; + } + +@@ -589,9 +588,8 @@ static int imx_card_parse_of(struct imx_card_data *data) + if (codec) { + ret = snd_soc_of_get_dai_link_codecs(dev, codec, link); + if (ret < 0) { +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "%s: codec dai not found: %d\n", +- link->name, ret); ++ dev_err_probe(dev, ret, "%s: codec dai not found\n", ++ link->name); + goto err; + } + +@@ -830,11 +828,8 @@ static int imx_card_probe(struct platform_device *pdev) + } + + ret = devm_snd_soc_register_card(&pdev->dev, &data->card); +- if (ret) { +- if (ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", ret); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(&pdev->dev, ret, "snd_soc_register_card failed\n"); + + return 0; + } +diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c +index f45cb4bbb6c4..52bb1844f548 100644 +--- a/sound/soc/fsl/imx-sgtl5000.c ++++ b/sound/soc/fsl/imx-sgtl5000.c +@@ -173,9 +173,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + + ret = devm_snd_soc_register_card(&pdev->dev, &data->card); + if (ret) { +- if (ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n", +- ret); ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card failed\n"); + goto fail; + } + +diff --git a/sound/soc/fsl/imx-spdif.c b/sound/soc/fsl/imx-spdif.c +index 6c4dadf60355..4446fba755b9 100644 +--- a/sound/soc/fsl/imx-spdif.c ++++ b/sound/soc/fsl/imx-spdif.c +@@ -70,8 +70,8 @@ static int imx_spdif_audio_probe(struct platform_device *pdev) + goto end; + + ret = devm_snd_soc_register_card(&pdev->dev, &data->card); +- if (ret && ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card failed: %d\n", ret); ++ if (ret) ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card failed\n"); + + end: + of_node_put(spdif_np); +-- +2.35.1 + diff --git a/queue-5.15/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch b/queue-5.15/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch new file mode 100644 index 00000000000..47f29dbf63a --- /dev/null +++ b/queue-5.15/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch @@ -0,0 +1,39 @@ +From 388df200fe65ccacd2752186b963e82c98b8db41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 09:27:40 +0400 +Subject: ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe + +From: Miaoqian Lin + +[ Upstream commit ed46731d8e86c8d65f5fc717671e1f1f6c3146d2 ] + +of_find_device_by_node() takes reference, we should use put_device() +to release it. when devm_kzalloc() fails, it doesn't have a +put_device(), it will cause refcount leak. +Add missing put_device() to fix this. + +Fixes: 6a5f850aa83a ("ASoC: fsl: Add imx-hdmi machine driver") +Fixes: f670b274f7f6 ("ASoC: imx-hdmi: add put_device() after of_find_device_by_node()") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220511052740.46903-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/fsl/imx-hdmi.c b/sound/soc/fsl/imx-hdmi.c +index ef8d7a65ebc6..d61e3c841e26 100644 +--- a/sound/soc/fsl/imx-hdmi.c ++++ b/sound/soc/fsl/imx-hdmi.c +@@ -126,6 +126,7 @@ static int imx_hdmi_probe(struct platform_device *pdev) + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; ++ put_device(&cpu_pdev->dev); + goto fail; + } + +-- +2.35.1 + diff --git a/queue-5.15/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch b/queue-5.15/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch new file mode 100644 index 00000000000..c77be383b0c --- /dev/null +++ b/queue-5.15/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch @@ -0,0 +1,52 @@ +From a248940f08d4fbcd7de621b34cd2f9acaa2eb0cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 15:49:18 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 + +From: Hans de Goede + +[ Upstream commit ce216cfa84a4e1c23b105e652c550bdeaac9e922 ] + +Add a quirk for the HP Pro Tablet 408, this BYTCR tablet has no CHAN +package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which +is the default for BYTCR devices. + +It also uses DMIC1 for the internal mic rather then the default IN3 +and it uses JD2 rather then the default JD1 for jack-detect. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211485 +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220427134918.527381-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index a6e837290c7d..f9c82ebc552c 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -759,6 +759,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_OVCD_SF_0P75 | + BYT_RT5640_MCLK_EN), + }, ++ { /* HP Pro Tablet 408 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pro Tablet 408"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_1500UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* HP Stream 7 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +-- +2.35.1 + diff --git a/queue-5.15/asoc-max98090-move-check-for-invalid-values-before-c.patch b/queue-5.15/asoc-max98090-move-check-for-invalid-values-before-c.patch new file mode 100644 index 00000000000..13f29ca2cf0 --- /dev/null +++ b/queue-5.15/asoc-max98090-move-check-for-invalid-values-before-c.patch @@ -0,0 +1,52 @@ +From dee6805d5bce39c73900039ba283343783e3f24d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 01:31:26 +0300 +Subject: ASoC: max98090: Move check for invalid values before casting in + max98090_put_enab_tlv() + +From: Alexey Khoroshilov + +[ Upstream commit f7a344468105ef8c54086dfdc800e6f5a8417d3e ] + +Validation of signed input should be done before casting to unsigned int. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Alexey Khoroshilov +Suggested-by: Mark Brown +Fixes: 2fbe467bcbfc ("ASoC: max98090: Reject invalid values in custom control put()") +Link: https://lore.kernel.org/r/1652999486-29653-1-git-send-email-khoroshilov@ispras.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 62b41ca050a2..5513acd360b8 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -393,7 +393,8 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, + struct soc_mixer_control *mc = + (struct soc_mixer_control *)kcontrol->private_value; + unsigned int mask = (1 << fls(mc->max)) - 1; +- unsigned int sel = ucontrol->value.integer.value[0]; ++ int sel_unchecked = ucontrol->value.integer.value[0]; ++ unsigned int sel; + unsigned int val = snd_soc_component_read(component, mc->reg); + unsigned int *select; + +@@ -413,8 +414,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, + + val = (val >> mc->shift) & mask; + +- if (sel < 0 || sel > mc->max) ++ if (sel_unchecked < 0 || sel_unchecked > mc->max) + return -EINVAL; ++ sel = sel_unchecked; + + *select = sel; + +-- +2.35.1 + diff --git a/queue-5.15/asoc-max98357a-remove-dependency-on-gpiolib.patch b/queue-5.15/asoc-max98357a-remove-dependency-on-gpiolib.patch new file mode 100644 index 00000000000..f91b9c1832e --- /dev/null +++ b/queue-5.15/asoc-max98357a-remove-dependency-on-gpiolib.patch @@ -0,0 +1,54 @@ +From 8c1349d790837dc5a059921d76f97f8f3f489ebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 12:26:46 -0500 +Subject: ASoC: max98357a: remove dependency on GPIOLIB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit 21ca3274333f5c1cbbf9d91e5b33f4f2463859b2 ] + +commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a +series of unnecessary dependencies on GPIOLIB when the gpio was +optional. + +A similar simplification seems valid for max98357a, so remove the +dependency as well. This will avoid the following warning + + WARNING: unmet direct dependencies detected for SND_SOC_MAX98357A + Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && GPIOLIB [=n] + Selected by [y]: + - SND_SOC_INTEL_SOF_CS42L42_MACH [=y] && SOUND [=y] && !UML && + SND [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && + (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C + [=y] && ACPI [=y] && SND_HDA_CODEC_HDMI [=y] && + SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || + COMPILE_TEST [=n]) + +Reported-by: kernel test robot +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20220517172647.468244-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 47e675e8bd00..2cbf4fc0f675 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -900,7 +900,6 @@ config SND_SOC_MAX98095 + + config SND_SOC_MAX98357A + tristate "Maxim MAX98357A CODEC" +- depends on GPIOLIB + + config SND_SOC_MAX98371 + tristate +-- +2.35.1 + diff --git a/queue-5.15/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch b/queue-5.15/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch new file mode 100644 index 00000000000..1c9ace3d5b5 --- /dev/null +++ b/queue-5.15/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch @@ -0,0 +1,49 @@ +From 34895e0421a4378d0585b2861580800d574492a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 09:29:01 +0000 +Subject: ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe + +From: Miaoqian Lin + +[ Upstream commit 4f4e0454e226de3bf4efd7e7924d1edc571c52d5 ] + +Call of_node_put(platform_node) to avoid refcount leak in +the error path. + +Fixes: 94319ba10eca ("ASoC: mediatek: Use platform_of_node for machine drivers") +Fixes: 493433785df0 ("ASoC: mediatek: mt8173: fix device_node leak") +Signed-off-by: Miaoqian Lin +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220404092903.26725-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c +index 3bdd4931316c..5f39e810e27a 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-max98090.c ++++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c +@@ -167,7 +167,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for_each_card_prelinks(card, i, dai_link) { + if (dai_link->codecs->name) +@@ -182,6 +183,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) + __func__, ret); + + of_node_put(codec_node); ++ ++put_platform_node: + of_node_put(platform_node); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.15/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch b/queue-5.15/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch new file mode 100644 index 00000000000..8ac660edcd8 --- /dev/null +++ b/queue-5.15/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch @@ -0,0 +1,60 @@ +From 30dc2e85789c60e786597927b1c079cfbadc19a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 09:35:25 +0000 +Subject: ASoC: mediatek: Fix missing of_node_put in + mt2701_wm8960_machine_probe + +From: Miaoqian Lin + +[ Upstream commit 05654431a18fe24e5e46a375d98904134628a102 ] + +This node pointer is returned by of_parse_phandle() with +refcount incremented in this function. +Calling of_node_put() to avoid the refcount leak. + +Fixes: 8625c1dbd876 ("ASoC: mediatek: Add mt2701-wm8960 machine driver") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220404093526.30004-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c +index 414e422c0eba..70e494fb3da8 100644 +--- a/sound/soc/mediatek/mt2701/mt2701-wm8960.c ++++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c +@@ -129,7 +129,8 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for_each_card_prelinks(card, i, dai_link) { + if (dai_link->codecs->name) +@@ -140,7 +141,7 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + ret = snd_soc_of_parse_audio_routing(card, "audio-routing"); + if (ret) { + dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret); +- return ret; ++ goto put_codec_node; + } + + ret = devm_snd_soc_register_card(&pdev->dev, card); +@@ -148,6 +149,10 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_codec_node: ++ of_node_put(codec_node); ++put_platform_node: ++ of_node_put(platform_node); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.15/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch b/queue-5.15/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch new file mode 100644 index 00000000000..2abe3fc348a --- /dev/null +++ b/queue-5.15/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch @@ -0,0 +1,36 @@ +From 864a55455a34d48a479494aa9f082022d7aed2fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 17:37:22 +0400 +Subject: ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe + +From: Miaoqian Lin + +[ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. + +Fixes: 08641c7c74dd ("ASoC: mxs: add device tree support for mxs-saif") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220511133725.39039-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mxs/mxs-saif.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c +index 879c1221a809..7afe1a1acc56 100644 +--- a/sound/soc/mxs/mxs-saif.c ++++ b/sound/soc/mxs/mxs-saif.c +@@ -754,6 +754,7 @@ static int mxs_saif_probe(struct platform_device *pdev) + saif->master_id = saif->id; + } else { + ret = of_alias_get_id(master, "saif"); ++ of_node_put(master); + if (ret < 0) + return ret; + else +-- +2.35.1 + diff --git a/queue-5.15/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch b/queue-5.15/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch new file mode 100644 index 00000000000..ee0a6c99e67 --- /dev/null +++ b/queue-5.15/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch @@ -0,0 +1,39 @@ +From f456d88557d37e99049e3e5b905c5ce0cfdf7dac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 19:23:11 +0200 +Subject: ASoC: rk3328: fix disabling mclk on pclk probe failure + +From: Nicolas Frattaroli + +[ Upstream commit dd508e324cdde1c06ace08a8143fa50333a90703 ] + +If preparing/enabling the pclk fails, the probe function should +unprepare and disable the previously prepared and enabled mclk, +which it doesn't do. This commit rectifies this. + +Fixes: c32759035ad2 ("ASoC: rockchip: support ACODEC for rk3328") +Signed-off-by: Nicolas Frattaroli +Reviewed-by: Katsuhiro Suzuki +Link: https://lore.kernel.org/r/20220427172310.138638-1-frattaroli.nicolas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rk3328_codec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rk3328_codec.c b/sound/soc/codecs/rk3328_codec.c +index 758d439e8c7a..86b679cf7aef 100644 +--- a/sound/soc/codecs/rk3328_codec.c ++++ b/sound/soc/codecs/rk3328_codec.c +@@ -481,7 +481,7 @@ static int rk3328_platform_probe(struct platform_device *pdev) + ret = clk_prepare_enable(rk3328->pclk); + if (ret < 0) { + dev_err(&pdev->dev, "failed to enable acodec pclk\n"); +- return ret; ++ goto err_unprepare_mclk; + } + + base = devm_platform_ioremap_resource(pdev, 0); +-- +2.35.1 + diff --git a/queue-5.15/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch b/queue-5.15/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch new file mode 100644 index 00000000000..6556924cdc0 --- /dev/null +++ b/queue-5.15/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch @@ -0,0 +1,56 @@ +From 944115dca80eb0cf2801a8dc69ddd564af726fcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 02:55:27 +0000 +Subject: ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear() + +From: Kuninori Morimoto + +[ Upstream commit b1384d4c95088d01f4266237faabf165d3d605fc ] + +commit cfb7b8bf1e2d66 ("ASoC: rsnd: tidyup +rsnd_ssiu_busif_err_status_clear()") merged duplicate code, but it didn't +care about default case, and causes smatch warnings. + +smatch warnings: +sound/soc/sh/rcar/ssiu.c:112 rsnd_ssiu_busif_err_status_clear() \ + error: uninitialized symbol 'offset'. +sound/soc/sh/rcar/ssiu.c:114 rsnd_ssiu_busif_err_status_clear() \ + error: uninitialized symbol 'shift'. + +This patch cares it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87r15rgn6p.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/ssiu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 0d8f97633dd2..138f95dd9f4a 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -102,6 +102,8 @@ bool rsnd_ssiu_busif_err_status_clear(struct rsnd_mod *mod) + shift = 1; + offset = 1; + break; ++ default: ++ goto out; + } + + for (i = 0; i < 4; i++) { +@@ -120,7 +122,7 @@ bool rsnd_ssiu_busif_err_status_clear(struct rsnd_mod *mod) + } + rsnd_mod_write(mod, reg, val); + } +- ++out: + return error; + } + +-- +2.35.1 + diff --git a/queue-5.15/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch b/queue-5.15/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch new file mode 100644 index 00000000000..7a0d3b42818 --- /dev/null +++ b/queue-5.15/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch @@ -0,0 +1,211 @@ +From 3ce838e16e71d0c5bdace1ade657db0466781c1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 02:55:58 +0000 +Subject: ASoC: rsnd: care return value from rsnd_node_fixed_index() + +From: Kuninori Morimoto + +[ Upstream commit d09a7db431c65aaa8303eb456439d1831ca2e6b4 ] + +Renesas Sound is very complex, and thus it needs to use +rsnd_node_fixed_index() to know enabled pin index. + +It returns error if strange pin was selected, +but some codes didn't check it. + +This patch 1) indicates error message, 2) check return +value. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87pmlbgn5t.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/core.c | 15 ++++++++++----- + sound/soc/sh/rcar/dma.c | 9 ++++++++- + sound/soc/sh/rcar/rsnd.h | 2 +- + sound/soc/sh/rcar/src.c | 7 ++++++- + sound/soc/sh/rcar/ssi.c | 14 ++++++++++++-- + sound/soc/sh/rcar/ssiu.c | 7 ++++++- + 6 files changed, 43 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index 6a8fe0da7670..af8ef2a27d34 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -1159,6 +1159,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *np; + int i; + +@@ -1169,7 +1170,11 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = mod_get(priv, i); + +@@ -1183,7 +1188,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + of_node_put(node); + } + +-int rsnd_node_fixed_index(struct device_node *node, char *name, int idx) ++int rsnd_node_fixed_index(struct device *dev, struct device_node *node, char *name, int idx) + { + char node_name[16]; + +@@ -1210,6 +1215,8 @@ int rsnd_node_fixed_index(struct device_node *node, char *name, int idx) + return idx; + } + ++ dev_err(dev, "strange node numbering (%s)", ++ of_node_full_name(node)); + return -EINVAL; + } + +@@ -1221,10 +1228,8 @@ int rsnd_node_count(struct rsnd_priv *priv, struct device_node *node, char *name + + i = 0; + for_each_child_of_node(node, np) { +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); + if (i < 0) { +- dev_err(dev, "strange node numbering (%s)", +- of_node_full_name(node)); + of_node_put(np); + return 0; + } +diff --git a/sound/soc/sh/rcar/dma.c b/sound/soc/sh/rcar/dma.c +index 03e0d4eca781..463ab237d7bd 100644 +--- a/sound/soc/sh/rcar/dma.c ++++ b/sound/soc/sh/rcar/dma.c +@@ -240,12 +240,19 @@ static int rsnd_dmaen_start(struct rsnd_mod *mod, + struct dma_chan *rsnd_dma_request_channel(struct device_node *of_node, char *name, + struct rsnd_mod *mod, char *x) + { ++ struct rsnd_priv *priv = rsnd_mod_to_priv(mod); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct dma_chan *chan = NULL; + struct device_node *np; + int i = 0; + + for_each_child_of_node(of_node, np) { +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); ++ if (i < 0) { ++ chan = NULL; ++ of_node_put(np); ++ break; ++ } + + if (i == rsnd_mod_id_raw(mod) && (!chan)) + chan = of_dma_request_slave_channel(np, x); +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index 6580bab0e229..d9cd190d7e19 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -460,7 +460,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + struct device_node *playback, + struct device_node *capture); + int rsnd_node_count(struct rsnd_priv *priv, struct device_node *node, char *name); +-int rsnd_node_fixed_index(struct device_node *node, char *name, int idx); ++int rsnd_node_fixed_index(struct device *dev, struct device_node *node, char *name, int idx); + + int rsnd_channel_normalization(int chan); + #define rsnd_runtime_channel_original(io) \ +diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c +index 42a100c6303d..0ea84ae57c6a 100644 +--- a/sound/soc/sh/rcar/src.c ++++ b/sound/soc/sh/rcar/src.c +@@ -676,7 +676,12 @@ int rsnd_src_probe(struct rsnd_priv *priv) + if (!of_device_is_available(np)) + goto skip; + +- i = rsnd_node_fixed_index(np, SRC_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SRC_NAME, i); ++ if (i < 0) { ++ ret = -EINVAL; ++ of_node_put(np); ++ goto rsnd_src_probe_done; ++ } + + src = rsnd_src_get(priv, i); + +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index 87e606f688d3..43c5e27dc5c8 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -1105,6 +1105,7 @@ void rsnd_parse_connect_ssi(struct rsnd_dai *rdai, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *node; + struct device_node *np; + int i; +@@ -1117,7 +1118,11 @@ void rsnd_parse_connect_ssi(struct rsnd_dai *rdai, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, SSI_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSI_NAME, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = rsnd_ssi_mod_get(priv, i); + +@@ -1182,7 +1187,12 @@ int rsnd_ssi_probe(struct rsnd_priv *priv) + if (!of_device_is_available(np)) + goto skip; + +- i = rsnd_node_fixed_index(np, SSI_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSI_NAME, i); ++ if (i < 0) { ++ ret = -EINVAL; ++ of_node_put(np); ++ goto rsnd_ssi_probe_done; ++ } + + ssi = rsnd_ssi_get(priv, i); + +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 138f95dd9f4a..4b8a63e336c7 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -462,6 +462,7 @@ void rsnd_parse_connect_ssiu(struct rsnd_dai *rdai, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *node = rsnd_ssiu_of_node(priv); + struct rsnd_dai_stream *io_p = &rdai->playback; + struct rsnd_dai_stream *io_c = &rdai->capture; +@@ -474,7 +475,11 @@ void rsnd_parse_connect_ssiu(struct rsnd_dai *rdai, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, SSIU_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSIU_NAME, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = rsnd_ssiu_mod_get(priv, i); + +-- +2.35.1 + diff --git a/queue-5.15/asoc-rt1015p-remove-dependency-on-gpiolib.patch b/queue-5.15/asoc-rt1015p-remove-dependency-on-gpiolib.patch new file mode 100644 index 00000000000..b3fa570e2d1 --- /dev/null +++ b/queue-5.15/asoc-rt1015p-remove-dependency-on-gpiolib.patch @@ -0,0 +1,59 @@ +From 7734c80e147a09b780d8f611ee4aed58a6cdf0dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 12:26:47 -0500 +Subject: ASoC: rt1015p: remove dependency on GPIOLIB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit b390c25c6757b9d56cecdfbf6d55f15fc89a6386 ] + +commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a +series of unnecessary dependencies on GPIOLIB when the gpio was +optional. + +A similar simplification seems valid for rt1015p, so remove the +dependency as well. This will avoid the following warning + + WARNING: unmet direct dependencies detected for SND_SOC_RT1015P + + Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && + GPIOLIB [=n] + + Selected by [y]: + + - SND_SOC_INTEL_SOF_RT5682_MACH [=y] && SOUND [=y] && !UML && SND + [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && + (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C + [=y] && ACPI [=y] && (SND_HDA_CODEC_HDMI [=y] && + SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || + COMPILE_TEST [=y]) || SND_SOC_SOF_BAYTRAIL [=n] && + (X86_INTEL_LPSS [=n] || COMPILE_TEST [=y])) + +Reported-by: kernel test robot +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20220517172647.468244-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 2cbf4fc0f675..d59a7e99ce42 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -1148,7 +1148,6 @@ config SND_SOC_RT1015 + + config SND_SOC_RT1015P + tristate +- depends on GPIOLIB + + config SND_SOC_RT1019 + tristate +-- +2.35.1 + diff --git a/queue-5.15/asoc-rt5645-fix-errorenous-cleanup-order.patch b/queue-5.15/asoc-rt5645-fix-errorenous-cleanup-order.patch new file mode 100644 index 00000000000..50e6424cc9f --- /dev/null +++ b/queue-5.15/asoc-rt5645-fix-errorenous-cleanup-order.patch @@ -0,0 +1,53 @@ +From bce445f179341bf8371908f10675b1aacf1e3f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 May 2022 17:20:35 +0800 +Subject: ASoC: rt5645: Fix errorenous cleanup order + +From: Lin Ma + +[ Upstream commit 2def44d3aec59e38d2701c568d65540783f90f2f ] + +There is a logic error when removing rt5645 device as the function +rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and +delete the &rt5645->btn_check_timer latter. However, since the timer +handler rt5645_btn_check_callback() will re-queue the jack_detect_work, +this cleanup order is buggy. + +That is, once the del_timer_sync in rt5645_i2c_remove is concurrently +run with the rt5645_btn_check_callback, the canceled jack_detect_work +will be rescheduled again, leading to possible use-after-free. + +This patch fix the issue by placing the del_timer_sync function before +the cancel_delayed_work_sync. + +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20220516092035.28283-1-linma@zju.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 9408ee63cb26..8ea6d4333562 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -4154,9 +4154,14 @@ static int rt5645_i2c_remove(struct i2c_client *i2c) + if (i2c->irq) + free_irq(i2c->irq, rt5645); + ++ /* ++ * Since the rt5645_btn_check_callback() can queue jack_detect_work, ++ * the timer need to be delted first ++ */ ++ del_timer_sync(&rt5645->btn_check_timer); ++ + cancel_delayed_work_sync(&rt5645->jack_detect_work); + cancel_delayed_work_sync(&rt5645->rcclock_work); +- del_timer_sync(&rt5645->btn_check_timer); + + regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies); + +-- +2.35.1 + diff --git a/queue-5.15/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch b/queue-5.15/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch new file mode 100644 index 00000000000..c09e9c470db --- /dev/null +++ b/queue-5.15/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch @@ -0,0 +1,43 @@ +From 001807c2291258cc954e6e4579a980e97325cb70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 08:38:28 +0400 +Subject: ASoC: samsung: Fix refcount leak in aries_audio_probe + +From: Miaoqian Lin + +[ Upstream commit bf4a9b2467b775717d0e9034ad916888e19713a3 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +If extcon_find_edev_by_node() fails, it doesn't call of_node_put() +Calling of_node_put() after extcon_find_edev_by_node() to fix this. + +Fixes: 7a3a7671fa6c ("ASoC: samsung: Add driver for Aries boards") +Signed-off-by: Miaoqian Lin +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220512043828.496-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/samsung/aries_wm8994.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/samsung/aries_wm8994.c b/sound/soc/samsung/aries_wm8994.c +index 5265e546b124..83acbe57b248 100644 +--- a/sound/soc/samsung/aries_wm8994.c ++++ b/sound/soc/samsung/aries_wm8994.c +@@ -585,10 +585,10 @@ static int aries_audio_probe(struct platform_device *pdev) + + extcon_np = of_parse_phandle(np, "extcon", 0); + priv->usb_extcon = extcon_find_edev_by_node(extcon_np); ++ of_node_put(extcon_np); + if (IS_ERR(priv->usb_extcon)) + return dev_err_probe(dev, PTR_ERR(priv->usb_extcon), + "Failed to get extcon device"); +- of_node_put(extcon_np); + + priv->adc = devm_iio_channel_get(dev, "headset-detect"); + if (IS_ERR(priv->adc)) +-- +2.35.1 + diff --git a/queue-5.15/asoc-samsung-use-dev_err_probe-helper.patch b/queue-5.15/asoc-samsung-use-dev_err_probe-helper.patch new file mode 100644 index 00000000000..de2f63d0f25 --- /dev/null +++ b/queue-5.15/asoc-samsung-use-dev_err_probe-helper.patch @@ -0,0 +1,223 @@ +From 806063c42a9c5520b760954fd93b66135ea13f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Dec 2021 11:08:41 +0900 +Subject: ASoC: samsung: Use dev_err_probe() helper + +From: Kuninori Morimoto + +[ Upstream commit 27c6eaebcf75e4fac145d17c7fa76bc64b60d24c ] + +Use the dev_err_probe() helper, instead of open-coding the same +operation. + +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/20211214020843.2225831-21-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/samsung/aries_wm8994.c | 17 +++++++---------- + sound/soc/samsung/arndale.c | 5 ++--- + sound/soc/samsung/littlemill.c | 5 ++--- + sound/soc/samsung/lowland.c | 5 ++--- + sound/soc/samsung/odroid.c | 4 +--- + sound/soc/samsung/smdk_wm8994.c | 4 ++-- + sound/soc/samsung/smdk_wm8994pcm.c | 4 ++-- + sound/soc/samsung/snow.c | 9 +++------ + sound/soc/samsung/speyside.c | 5 ++--- + sound/soc/samsung/tm2_wm5110.c | 3 +-- + sound/soc/samsung/tobermory.c | 5 ++--- + 11 files changed, 26 insertions(+), 40 deletions(-) + +diff --git a/sound/soc/samsung/aries_wm8994.c b/sound/soc/samsung/aries_wm8994.c +index 313ab650f8d9..5265e546b124 100644 +--- a/sound/soc/samsung/aries_wm8994.c ++++ b/sound/soc/samsung/aries_wm8994.c +@@ -585,19 +585,16 @@ static int aries_audio_probe(struct platform_device *pdev) + + extcon_np = of_parse_phandle(np, "extcon", 0); + priv->usb_extcon = extcon_find_edev_by_node(extcon_np); +- if (IS_ERR(priv->usb_extcon)) { +- if (PTR_ERR(priv->usb_extcon) != -EPROBE_DEFER) +- dev_err(dev, "Failed to get extcon device"); +- return PTR_ERR(priv->usb_extcon); +- } ++ if (IS_ERR(priv->usb_extcon)) ++ return dev_err_probe(dev, PTR_ERR(priv->usb_extcon), ++ "Failed to get extcon device"); + of_node_put(extcon_np); + + priv->adc = devm_iio_channel_get(dev, "headset-detect"); +- if (IS_ERR(priv->adc)) { +- if (PTR_ERR(priv->adc) != -EPROBE_DEFER) +- dev_err(dev, "Failed to get ADC channel"); +- return PTR_ERR(priv->adc); +- } ++ if (IS_ERR(priv->adc)) ++ return dev_err_probe(dev, PTR_ERR(priv->adc), ++ "Failed to get ADC channel"); ++ + if (priv->adc->channel->type != IIO_VOLTAGE) + return -EINVAL; + +diff --git a/sound/soc/samsung/arndale.c b/sound/soc/samsung/arndale.c +index 606ac5e33a8e..a5dc640d0d76 100644 +--- a/sound/soc/samsung/arndale.c ++++ b/sound/soc/samsung/arndale.c +@@ -174,9 +174,8 @@ static int arndale_audio_probe(struct platform_device *pdev) + + ret = devm_snd_soc_register_card(card->dev, card); + if (ret) { +- if (ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, +- "snd_soc_register_card() failed: %d\n", ret); ++ dev_err_probe(&pdev->dev, ret, ++ "snd_soc_register_card() failed\n"); + goto err_put_of_nodes; + } + return 0; +diff --git a/sound/soc/samsung/littlemill.c b/sound/soc/samsung/littlemill.c +index 390f2dd735ad..34067cc314ff 100644 +--- a/sound/soc/samsung/littlemill.c ++++ b/sound/soc/samsung/littlemill.c +@@ -325,9 +325,8 @@ static int littlemill_probe(struct platform_device *pdev) + card->dev = &pdev->dev; + + ret = devm_snd_soc_register_card(&pdev->dev, card); +- if (ret && ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", +- ret); ++ if (ret) ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card() failed\n"); + + return ret; + } +diff --git a/sound/soc/samsung/lowland.c b/sound/soc/samsung/lowland.c +index 998d10cf8c94..7b12ccd2a9b2 100644 +--- a/sound/soc/samsung/lowland.c ++++ b/sound/soc/samsung/lowland.c +@@ -183,9 +183,8 @@ static int lowland_probe(struct platform_device *pdev) + card->dev = &pdev->dev; + + ret = devm_snd_soc_register_card(&pdev->dev, card); +- if (ret && ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", +- ret); ++ if (ret) ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card() failed\n"); + + return ret; + } +diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c +index ca643a488c3c..4ff12e2e704f 100644 +--- a/sound/soc/samsung/odroid.c ++++ b/sound/soc/samsung/odroid.c +@@ -311,9 +311,7 @@ static int odroid_audio_probe(struct platform_device *pdev) + + ret = devm_snd_soc_register_card(dev, card); + if (ret < 0) { +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "snd_soc_register_card() failed: %d\n", +- ret); ++ dev_err_probe(dev, ret, "snd_soc_register_card() failed\n"); + goto err_put_clk_i2s; + } + +diff --git a/sound/soc/samsung/smdk_wm8994.c b/sound/soc/samsung/smdk_wm8994.c +index 7661b637946d..821ad1eb1b79 100644 +--- a/sound/soc/samsung/smdk_wm8994.c ++++ b/sound/soc/samsung/smdk_wm8994.c +@@ -179,8 +179,8 @@ static int smdk_audio_probe(struct platform_device *pdev) + + ret = devm_snd_soc_register_card(&pdev->dev, card); + +- if (ret && ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card() failed:%d\n", ret); ++ if (ret) ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card() failed\n"); + + return ret; + } +diff --git a/sound/soc/samsung/smdk_wm8994pcm.c b/sound/soc/samsung/smdk_wm8994pcm.c +index 029448f5bedb..d77dc54cae9c 100644 +--- a/sound/soc/samsung/smdk_wm8994pcm.c ++++ b/sound/soc/samsung/smdk_wm8994pcm.c +@@ -118,8 +118,8 @@ static int snd_smdk_probe(struct platform_device *pdev) + + smdk_pcm.dev = &pdev->dev; + ret = devm_snd_soc_register_card(&pdev->dev, &smdk_pcm); +- if (ret && ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card failed %d\n", ret); ++ if (ret) ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card failed\n"); + + return ret; + } +diff --git a/sound/soc/samsung/snow.c b/sound/soc/samsung/snow.c +index 6da674e901ca..02372109c251 100644 +--- a/sound/soc/samsung/snow.c ++++ b/sound/soc/samsung/snow.c +@@ -212,12 +212,9 @@ static int snow_probe(struct platform_device *pdev) + snd_soc_card_set_drvdata(card, priv); + + ret = devm_snd_soc_register_card(dev, card); +- if (ret) { +- if (ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, +- "snd_soc_register_card failed (%d)\n", ret); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(&pdev->dev, ret, ++ "snd_soc_register_card failed\n"); + + return ret; + } +diff --git a/sound/soc/samsung/speyside.c b/sound/soc/samsung/speyside.c +index f5f6ba00d073..37b1f4f60b21 100644 +--- a/sound/soc/samsung/speyside.c ++++ b/sound/soc/samsung/speyside.c +@@ -330,9 +330,8 @@ static int speyside_probe(struct platform_device *pdev) + card->dev = &pdev->dev; + + ret = devm_snd_soc_register_card(&pdev->dev, card); +- if (ret && ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", +- ret); ++ if (ret) ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card() failed\n"); + + return ret; + } +diff --git a/sound/soc/samsung/tm2_wm5110.c b/sound/soc/samsung/tm2_wm5110.c +index a2c77e6defec..d611ec9e5325 100644 +--- a/sound/soc/samsung/tm2_wm5110.c ++++ b/sound/soc/samsung/tm2_wm5110.c +@@ -612,8 +612,7 @@ static int tm2_probe(struct platform_device *pdev) + + ret = devm_snd_soc_register_card(dev, card); + if (ret < 0) { +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "Failed to register card: %d\n", ret); ++ dev_err_probe(dev, ret, "Failed to register card\n"); + goto dai_node_put; + } + +diff --git a/sound/soc/samsung/tobermory.c b/sound/soc/samsung/tobermory.c +index 15223d860cb7..8d3149a47a4c 100644 +--- a/sound/soc/samsung/tobermory.c ++++ b/sound/soc/samsung/tobermory.c +@@ -229,9 +229,8 @@ static int tobermory_probe(struct platform_device *pdev) + card->dev = &pdev->dev; + + ret = devm_snd_soc_register_card(&pdev->dev, card); +- if (ret && ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n", +- ret); ++ if (ret) ++ dev_err_probe(&pdev->dev, ret, "snd_soc_register_card() failed\n"); + + return ret; + } +-- +2.35.1 + diff --git a/queue-5.15/asoc-sh-rz-ssi-check-return-value-of-pm_runtime_resu.patch b/queue-5.15/asoc-sh-rz-ssi-check-return-value-of-pm_runtime_resu.patch new file mode 100644 index 00000000000..cd0bacf2060 --- /dev/null +++ b/queue-5.15/asoc-sh-rz-ssi-check-return-value-of-pm_runtime_resu.patch @@ -0,0 +1,44 @@ +From a1a8d8f50e0233f946dbc56ce97a0533486c1aff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Dec 2021 10:22:31 +0100 +Subject: ASoC: sh: rz-ssi: Check return value of pm_runtime_resume_and_get() + +From: Heiner Kallweit + +[ Upstream commit f04b4fb47d83b110a5b007fb2eddea862cfeb151 ] + +The return value of pm_runtime_resume_and_get() needs to be checked to +avoid a usage count imbalance in the error case. This fix is basically +the same as 92c959bae2e5 ("reset: renesas: Fix Runtime PM usage"), +and the last step before pm_runtime_resume_and_get() can be annotated +as __must_check. + +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/9fed506d-b780-55cd-45a4-9bd2407c910f@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 16de2633a873..7379b1489e35 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -1025,7 +1025,12 @@ static int rz_ssi_probe(struct platform_device *pdev) + + reset_control_deassert(ssi->rstc); + pm_runtime_enable(&pdev->dev); +- pm_runtime_resume_and_get(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); ++ if (ret < 0) { ++ pm_runtime_disable(ssi->dev); ++ reset_control_assert(ssi->rstc); ++ return dev_err_probe(ssi->dev, ret, "pm_runtime_resume_and_get failed\n"); ++ } + + ret = devm_snd_soc_register_component(&pdev->dev, &rz_ssi_soc_component, + rz_ssi_soc_dai, +-- +2.35.1 + diff --git a/queue-5.15/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch b/queue-5.15/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch new file mode 100644 index 00000000000..734194ca473 --- /dev/null +++ b/queue-5.15/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch @@ -0,0 +1,62 @@ +From 1e9f2357aa4a5589fb46a294f1923c8ef5277d3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 08:49:21 +0100 +Subject: ASoC: sh: rz-ssi: Propagate error codes returned from + platform_get_irq_byname() + +From: Lad Prabhakar + +[ Upstream commit 91686a3984f34df0ab844cdbaa7e4d9621129f5d ] + +Propagate error codes returned from platform_get_irq_byname() instead of +returning -ENODEV. platform_get_irq_byname() may return -EPROBE_DEFER, to +handle such cases propagate the error codes. + +While at it drop the dev_err_probe() messages as platform_get_irq_byname() +already does this for us in case of error. + +Signed-off-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20220426074922.13319-3-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 7379b1489e35..3b55444a1b58 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -983,8 +983,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + /* Error Interrupt */ + ssi->irq_int = platform_get_irq_byname(pdev, "int_req"); + if (ssi->irq_int < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI int_req IRQ\n"); ++ return ssi->irq_int; + + ret = devm_request_irq(&pdev->dev, ssi->irq_int, &rz_ssi_interrupt, + 0, dev_name(&pdev->dev), ssi); +@@ -996,8 +995,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + /* Tx and Rx interrupts (pio only) */ + ssi->irq_tx = platform_get_irq_byname(pdev, "dma_tx"); + if (ssi->irq_tx < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI dma_tx IRQ\n"); ++ return ssi->irq_tx; + + ret = devm_request_irq(&pdev->dev, ssi->irq_tx, + &rz_ssi_interrupt, 0, +@@ -1008,8 +1006,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + + ssi->irq_rx = platform_get_irq_byname(pdev, "dma_rx"); + if (ssi->irq_rx < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI dma_rx IRQ\n"); ++ return ssi->irq_rx; + + ret = devm_request_irq(&pdev->dev, ssi->irq_rx, + &rz_ssi_interrupt, 0, +-- +2.35.1 + diff --git a/queue-5.15/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch b/queue-5.15/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch new file mode 100644 index 00000000000..2086d0a35ca --- /dev/null +++ b/queue-5.15/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch @@ -0,0 +1,70 @@ +From be022aad1c5c94d49f7c1deae3cf618d484b0704 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 08:49:22 +0100 +Subject: ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error + path + +From: Lad Prabhakar + +[ Upstream commit 767e6f26204d3f5406630e86b720d01818b8616d ] + +DMA channels requested by rz_ssi_dma_request() in rz_ssi_probe() were +never released in the error path apart from one place. This patch fixes +this issue by calling rz_ssi_release_dma_channels() in the error path. + +Fixes: 26ac471c5354 ("ASoC: sh: rz-ssi: Add SSI DMAC support") +Reported-by: Pavel Machek +Signed-off-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20220426074922.13319-4-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 3b55444a1b58..6d794eaaf4c3 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -982,14 +982,18 @@ static int rz_ssi_probe(struct platform_device *pdev) + + /* Error Interrupt */ + ssi->irq_int = platform_get_irq_byname(pdev, "int_req"); +- if (ssi->irq_int < 0) ++ if (ssi->irq_int < 0) { ++ rz_ssi_release_dma_channels(ssi); + return ssi->irq_int; ++ } + + ret = devm_request_irq(&pdev->dev, ssi->irq_int, &rz_ssi_interrupt, + 0, dev_name(&pdev->dev), ssi); +- if (ret < 0) ++ if (ret < 0) { ++ rz_ssi_release_dma_channels(ssi); + return dev_err_probe(&pdev->dev, ret, + "irq request error (int_req)\n"); ++ } + + if (!rz_ssi_is_dma_enabled(ssi)) { + /* Tx and Rx interrupts (pio only) */ +@@ -1017,13 +1021,16 @@ static int rz_ssi_probe(struct platform_device *pdev) + } + + ssi->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); +- if (IS_ERR(ssi->rstc)) ++ if (IS_ERR(ssi->rstc)) { ++ rz_ssi_release_dma_channels(ssi); + return PTR_ERR(ssi->rstc); ++ } + + reset_control_deassert(ssi->rstc); + pm_runtime_enable(&pdev->dev); + ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) { ++ rz_ssi_release_dma_channels(ssi); + pm_runtime_disable(ssi->dev); + reset_control_assert(ssi->rstc); + return dev_err_probe(ssi->dev, ret, "pm_runtime_resume_and_get failed\n"); +-- +2.35.1 + diff --git a/queue-5.15/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch b/queue-5.15/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch new file mode 100644 index 00000000000..0520836f8f1 --- /dev/null +++ b/queue-5.15/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch @@ -0,0 +1,136 @@ +From fff31e8a7ee885a94315868f24b49b7732f5e146 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 15:13:30 +0400 +Subject: ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* + +From: Miaoqian Lin + +[ Upstream commit a34840c4eb3278a7c29c9c57a65ce7541c66f9f2 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 6748d0559059 ("ASoC: ti: Add custom machine driver for j721e EVM (CPB and IVI)") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220512111331.44774-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/j721e-evm.c | 44 ++++++++++++++++++++++++++++++---------- + 1 file changed, 33 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c +index 9347f982c3e1..149f4e2ce999 100644 +--- a/sound/soc/ti/j721e-evm.c ++++ b/sound/soc/ti/j721e-evm.c +@@ -634,17 +634,18 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + codec_node = of_parse_phandle(node, "ti,cpb-codec", 0); + if (!codec_node) { + dev_err(priv->dev, "CPB codec node is not provided\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_dai_node; + } + + domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_CPB]; + ret = j721e_get_clocks(priv->dev, &domain->codec, "cpb-codec-scki"); + if (ret) +- return ret; ++ goto put_codec_node; + + ret = j721e_get_clocks(priv->dev, &domain->mcasp, "cpb-mcasp-auxclk"); + if (ret) +- return ret; ++ goto put_codec_node; + + /* + * Common Processor Board, two links +@@ -654,8 +655,10 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + comp_count = 6; + compnent = devm_kzalloc(priv->dev, comp_count * sizeof(*compnent), + GFP_KERNEL); +- if (!compnent) +- return -ENOMEM; ++ if (!compnent) { ++ ret = -ENOMEM; ++ goto put_codec_node; ++ } + + comp_idx = 0; + priv->dai_links[*link_idx].cpus = &compnent[comp_idx++]; +@@ -706,6 +709,12 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + (*conf_idx)++; + + return 0; ++ ++put_codec_node: ++ of_node_put(codec_node); ++put_dai_node: ++ of_node_put(dai_node); ++ return ret; + } + + static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, +@@ -730,23 +739,25 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + codeca_node = of_parse_phandle(node, "ti,ivi-codec-a", 0); + if (!codeca_node) { + dev_err(priv->dev, "IVI codec-a node is not provided\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_dai_node; + } + + codecb_node = of_parse_phandle(node, "ti,ivi-codec-b", 0); + if (!codecb_node) { + dev_warn(priv->dev, "IVI codec-b node is not provided\n"); +- return 0; ++ ret = 0; ++ goto put_codeca_node; + } + + domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_IVI]; + ret = j721e_get_clocks(priv->dev, &domain->codec, "ivi-codec-scki"); + if (ret) +- return ret; ++ goto put_codecb_node; + + ret = j721e_get_clocks(priv->dev, &domain->mcasp, "ivi-mcasp-auxclk"); + if (ret) +- return ret; ++ goto put_codecb_node; + + /* + * IVI extension, two links +@@ -758,8 +769,10 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + comp_count = 8; + compnent = devm_kzalloc(priv->dev, comp_count * sizeof(*compnent), + GFP_KERNEL); +- if (!compnent) +- return -ENOMEM; ++ if (!compnent) { ++ ret = -ENOMEM; ++ goto put_codecb_node; ++ } + + comp_idx = 0; + priv->dai_links[*link_idx].cpus = &compnent[comp_idx++]; +@@ -820,6 +833,15 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + (*conf_idx)++; + + return 0; ++ ++ ++put_codecb_node: ++ of_node_put(codecb_node); ++put_codeca_node: ++ of_node_put(codeca_node); ++put_dai_node: ++ of_node_put(dai_node); ++ return ret; + } + + static int j721e_soc_probe(struct platform_device *pdev) +-- +2.35.1 + diff --git a/queue-5.15/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch b/queue-5.15/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch new file mode 100644 index 00000000000..c51b31c5e6d --- /dev/null +++ b/queue-5.15/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch @@ -0,0 +1,68 @@ +From 1b86cd1f3f62754bd89bb599e6c5ef4399daba1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:52 +0100 +Subject: ASoC: tscs454: Add endianness flag in snd_soc_component_driver + +From: Charles Keepax + +[ Upstream commit ff69ec96b87dccb3a29edef8cec5d4fefbbc2055 ] + +The endianness flag is used on the CODEC side to specify an +ambivalence to endian, typically because it is lost over the hardware +link. This device receives audio over an I2S DAI and as such should +have endianness applied. + +A fixup is also required to use the width directly rather than relying +on the format in hw_params, now both little and big endian would be +supported. It is worth noting this changes the behaviour of S24_LE to +use a word length of 24 rather than 32. This would appear to be a +correction since the fact S24_LE is stored as 32 bits should not be +presented over the bus. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-26-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tscs454.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/tscs454.c b/sound/soc/codecs/tscs454.c +index 43220bb36701..c27ca9a273e1 100644 +--- a/sound/soc/codecs/tscs454.c ++++ b/sound/soc/codecs/tscs454.c +@@ -3120,18 +3120,17 @@ static int set_aif_sample_format(struct snd_soc_component *component, + unsigned int width; + int ret; + +- switch (format) { +- case SNDRV_PCM_FORMAT_S16_LE: ++ switch (snd_pcm_format_width(format)) { ++ case 16: + width = FV_WL_16; + break; +- case SNDRV_PCM_FORMAT_S20_3LE: ++ case 20: + width = FV_WL_20; + break; +- case SNDRV_PCM_FORMAT_S24_3LE: ++ case 24: + width = FV_WL_24; + break; +- case SNDRV_PCM_FORMAT_S24_LE: +- case SNDRV_PCM_FORMAT_S32_LE: ++ case 32: + width = FV_WL_32; + break; + default: +@@ -3326,6 +3325,7 @@ static const struct snd_soc_component_driver soc_component_dev_tscs454 = { + .num_dapm_routes = ARRAY_SIZE(tscs454_intercon), + .controls = tscs454_snd_controls, + .num_controls = ARRAY_SIZE(tscs454_snd_controls), ++ .endianness = 1, + }; + + #define TSCS454_RATES SNDRV_PCM_RATE_8000_96000 +-- +2.35.1 + diff --git a/queue-5.15/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch b/queue-5.15/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch new file mode 100644 index 00000000000..803eb9851b2 --- /dev/null +++ b/queue-5.15/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch @@ -0,0 +1,55 @@ +From 948d5ca9fd5b2e5f3a2c4f58a7107f1dedff938f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 May 2022 17:10:53 +0800 +Subject: ASoC: wm2000: fix missing clk_disable_unprepare() on error in + wm2000_anc_transition() + +From: Yang Yingliang + +[ Upstream commit be2af740e2a9c7134f2d8ab4f104006e110b13de ] + +Fix the missing clk_disable_unprepare() before return +from wm2000_anc_transition() in the error handling case. + +Fixes: 514cfd6dd725 ("ASoC: wm2000: Integrate with clock API") +Signed-off-by: Yang Yingliang +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20220514091053.686416-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm2000.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c +index 72e165cc6443..97ece3114b3d 100644 +--- a/sound/soc/codecs/wm2000.c ++++ b/sound/soc/codecs/wm2000.c +@@ -536,7 +536,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, + { + struct i2c_client *i2c = wm2000->i2c; + int i, j; +- int ret; ++ int ret = 0; + + if (wm2000->anc_mode == mode) + return 0; +@@ -566,13 +566,13 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, + ret = anc_transitions[i].step[j](i2c, + anc_transitions[i].analogue); + if (ret != 0) +- return ret; ++ break; + } + + if (anc_transitions[i].dest == ANC_OFF) + clk_disable_unprepare(wm2000->mclk); + +- return 0; ++ return ret; + } + + static int wm2000_anc_set_mode(struct wm2000_priv *wm2000) +-- +2.35.1 + diff --git a/queue-5.15/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch b/queue-5.15/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch new file mode 100644 index 00000000000..347e48c649d --- /dev/null +++ b/queue-5.15/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch @@ -0,0 +1,114 @@ +From a2955ee70a577e77ae267cac3a6485b546ff6fe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 10:37:33 +0300 +Subject: ath10k: skip ath10k_halt during suspend for driver state RESTARTING + +From: Abhishek Kumar + +[ Upstream commit b72a4aff947ba807177bdabb43debaf2c66bee05 ] + +Double free crash is observed when FW recovery(caused by wmi +timeout/crash) is followed by immediate suspend event. The FW recovery +is triggered by ath10k_core_restart() which calls driver clean up via +ath10k_halt(). When the suspend event occurs between the FW recovery, +the restart worker thread is put into frozen state until suspend completes. +The suspend event triggers ath10k_stop() which again triggers ath10k_halt() +The double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be +called twice(Note: ath10k_htt_rx_alloc was not called by restart worker +thread because of its frozen state), causing the crash. + +To fix this, during the suspend flow, skip call to ath10k_halt() in +ath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING. +Also, for driver state ATH10K_STATE_RESTARTING, call +ath10k_wait_for_suspend() in ath10k_stop(). This is because call to +ath10k_wait_for_suspend() is skipped later in +[ath10k_halt() > ath10k_core_stop()] for the driver state +ATH10K_STATE_RESTARTING. + +The frozen restart worker thread will be cancelled during resume when the +device comes out of suspend. + +Below is the crash stack for reference: + +[ 428.469167] ------------[ cut here ]------------ +[ 428.469180] kernel BUG at mm/slub.c:4150! +[ 428.469193] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI +[ 428.469219] Workqueue: events_unbound async_run_entry_fn +[ 428.469230] RIP: 0010:kfree+0x319/0x31b +[ 428.469241] RSP: 0018:ffffa1fac015fc30 EFLAGS: 00010246 +[ 428.469247] RAX: ffffedb10419d108 RBX: ffff8c05262b0000 +[ 428.469252] RDX: ffff8c04a8c07000 RSI: 0000000000000000 +[ 428.469256] RBP: ffffa1fac015fc78 R08: 0000000000000000 +[ 428.469276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 428.469285] Call Trace: +[ 428.469295] ? dma_free_attrs+0x5f/0x7d +[ 428.469320] ath10k_core_stop+0x5b/0x6f +[ 428.469336] ath10k_halt+0x126/0x177 +[ 428.469352] ath10k_stop+0x41/0x7e +[ 428.469387] drv_stop+0x88/0x10e +[ 428.469410] __ieee80211_suspend+0x297/0x411 +[ 428.469441] rdev_suspend+0x6e/0xd0 +[ 428.469462] wiphy_suspend+0xb1/0x105 +[ 428.469483] ? name_show+0x2d/0x2d +[ 428.469490] dpm_run_callback+0x8c/0x126 +[ 428.469511] ? name_show+0x2d/0x2d +[ 428.469517] __device_suspend+0x2e7/0x41b +[ 428.469523] async_suspend+0x1f/0x93 +[ 428.469529] async_run_entry_fn+0x3d/0xd1 +[ 428.469535] process_one_work+0x1b1/0x329 +[ 428.469541] worker_thread+0x213/0x372 +[ 428.469547] kthread+0x150/0x15f +[ 428.469552] ? pr_cont_work+0x58/0x58 +[ 428.469558] ? kthread_blkcg+0x31/0x31 + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1 +Co-developed-by: Wen Gong +Signed-off-by: Wen Gong +Signed-off-by: Abhishek Kumar +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220426221859.v2.1.I650b809482e1af8d0156ed88b5dc2677a0711d46@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 1f73fbfee0c0..8a80919b627f 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5339,13 +5339,29 @@ static int ath10k_start(struct ieee80211_hw *hw) + static void ath10k_stop(struct ieee80211_hw *hw) + { + struct ath10k *ar = hw->priv; ++ u32 opt; + + ath10k_drain_tx(ar); + + mutex_lock(&ar->conf_mutex); + if (ar->state != ATH10K_STATE_OFF) { +- if (!ar->hw_rfkill_on) +- ath10k_halt(ar); ++ if (!ar->hw_rfkill_on) { ++ /* If the current driver state is RESTARTING but not yet ++ * fully RESTARTED because of incoming suspend event, ++ * then ath10k_halt() is already called via ++ * ath10k_core_restart() and should not be called here. ++ */ ++ if (ar->state != ATH10K_STATE_RESTARTING) { ++ ath10k_halt(ar); ++ } else { ++ /* Suspending here, because when in RESTARTING ++ * state, ath10k_core_stop() skips ++ * ath10k_wait_for_suspend(). ++ */ ++ opt = WMI_PDEV_SUSPEND_AND_DISABLE_INTR; ++ ath10k_wait_for_suspend(ar, opt); ++ } ++ } + ar->state = ATH10K_STATE_OFF; + } + mutex_unlock(&ar->conf_mutex); +-- +2.35.1 + diff --git a/queue-5.15/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch b/queue-5.15/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch new file mode 100644 index 00000000000..131f7c879c0 --- /dev/null +++ b/queue-5.15/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch @@ -0,0 +1,64 @@ +From 268e052ffd0def74917f44b330cf013281a3f736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 12:58:23 +0200 +Subject: ath11k: acquire ab->base_lock in unassign when finding the peer by + addr + +From: Niels Dossche + +[ Upstream commit 2db80f93869d491be57cbc2b36f30d0d3a0e5bde ] + +ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be +held when calling that function in order to protect the list. All +callers except ath11k_mac_op_unassign_vif_chanctx have that lock +acquired when calling ath11k_peer_find_by_addr. That lock is also not +transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. +The solution is to acquire the lock when calling +ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. + +I am currently working on a static analyser to detect missing locks and +this was a reported case. I manually verified the report by looking at +the code, but I do not have real hardware so this is compile tested +only. + +Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") +Signed-off-by: Niels Dossche +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220314215253.92658-1-dossche.niels@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 07004564a3ec..bf64ab6e8484 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -5592,6 +5592,7 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, + struct ath11k *ar = hw->priv; + struct ath11k_base *ab = ar->ab; + struct ath11k_vif *arvif = (void *)vif->drv_priv; ++ struct ath11k_peer *peer; + int ret; + + mutex_lock(&ar->conf_mutex); +@@ -5603,9 +5604,13 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, + WARN_ON(!arvif->is_started); + + if (ab->hw_params.vdev_start_delay && +- arvif->vdev_type == WMI_VDEV_TYPE_MONITOR && +- ath11k_peer_find_by_addr(ab, ar->mac_addr)) +- ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); ++ arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { ++ spin_lock_bh(&ab->base_lock); ++ peer = ath11k_peer_find_by_addr(ab, ar->mac_addr); ++ spin_unlock_bh(&ab->base_lock); ++ if (peer) ++ ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); ++ } + + ret = ath11k_mac_vdev_stop(arvif); + if (ret) +-- +2.35.1 + diff --git a/queue-5.15/ath11k-disable-spectral-scan-during-spectral-deinit.patch b/queue-5.15/ath11k-disable-spectral-scan-during-spectral-deinit.patch new file mode 100644 index 00000000000..63175166b69 --- /dev/null +++ b/queue-5.15/ath11k-disable-spectral-scan-during-spectral-deinit.patch @@ -0,0 +1,104 @@ +From 230035bd823ad9b03a86aa50240909550e77f369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 12:36:47 +0300 +Subject: ath11k: disable spectral scan during spectral deinit + +From: Hari Chandrakanthan + +[ Upstream commit 161c64de239c7018e0295e7e0520a19f00aa32dc ] + +When ath11k modules are removed using rmmod with spectral scan enabled, +crash is observed. Different crash trace is observed for each crash. + +Send spectral scan disable WMI command to firmware before cleaning +the spectral dbring in the spectral_deinit API to avoid this crash. + +call trace from one of the crash observed: +[ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008 +[ 1252.882722] pgd = 0f42e886 +[ 1252.890955] [00000008] *pgd=00000000 +[ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM +[ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0 +[ 1253.115261] Hardware name: Generic DT based system +[ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k] +[ 1253.125940] LR is at 0x88e31017 +[ 1253.132448] pc : [<7f9387b8>] lr : [<88e31017>] psr: a0000193 +[ 1253.135488] sp : 80d01bc8 ip : 00000001 fp : 970e0000 +[ 1253.141737] r10: 88e31000 r9 : 970ec000 r8 : 00000080 +[ 1253.146946] r7 : 94734040 r6 : a0000113 r5 : 00000057 r4 : 00000000 +[ 1253.152159] r3 : e18cb694 r2 : 00000217 r1 : 1df1f000 r0 : 00000001 +[ 1253.158755] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user +[ 1253.165266] Control: 10c0383d Table: 5e71006a DAC: 00000055 +[ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141) +[ 1253.458055] [<7f9387b8>] (ath11k_spectral_process_data [ath11k]) from [<7f917fdc>] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k]) +[ 1253.466139] [<7f917fdc>] (ath11k_dbring_buffer_release_event [ath11k]) from [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k]) +[ 1253.478807] [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx [ath11k]) from [<7f8fe868>] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k]) +[ 1253.490699] [<7f8fe868>] (ath11k_htc_rx_completion_handler [ath11k]) from [<7f91308c>] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k]) +[ 1253.502386] [<7f91308c>] (ath11k_ce_per_engine_service [ath11k]) from [<7f9a4198>] (ath11k_pci_ce_tasklet+0x28/0x80 [ath11k_pci]) +[ 1253.514811] [<7f9a4198>] (ath11k_pci_ce_tasklet [ath11k_pci]) from [<8032227c>] (tasklet_action_common.constprop.2+0x64/0xe8) +[ 1253.526476] [<8032227c>] (tasklet_action_common.constprop.2) from [<803021e8>] (__do_softirq+0x130/0x2d0) +[ 1253.537756] [<803021e8>] (__do_softirq) from [<80322610>] (irq_exit+0xcc/0xe8) +[ 1253.547304] [<80322610>] (irq_exit) from [<8036a4a4>] (__handle_domain_irq+0x60/0xb4) +[ 1253.554428] [<8036a4a4>] (__handle_domain_irq) from [<805eb348>] (gic_handle_irq+0x4c/0x90) +[ 1253.562321] [<805eb348>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) + +Tested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Hari Chandrakanthan +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1649396345-349-1-git-send-email-quic_haric@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/spectral.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/spectral.c b/drivers/net/wireless/ath/ath11k/spectral.c +index 1afe67759659..e5af9358e610 100644 +--- a/drivers/net/wireless/ath/ath11k/spectral.c ++++ b/drivers/net/wireless/ath/ath11k/spectral.c +@@ -214,7 +214,10 @@ static int ath11k_spectral_scan_config(struct ath11k *ar, + return -ENODEV; + + arvif->spectral_enabled = (mode != ATH11K_SPECTRAL_DISABLED); ++ ++ spin_lock_bh(&ar->spectral.lock); + ar->spectral.mode = mode; ++ spin_unlock_bh(&ar->spectral.lock); + + ret = ath11k_wmi_vdev_spectral_enable(ar, arvif->vdev_id, + ATH11K_WMI_SPECTRAL_TRIGGER_CMD_CLEAR, +@@ -829,9 +832,6 @@ static inline void ath11k_spectral_ring_free(struct ath11k *ar) + { + struct ath11k_spectral *sp = &ar->spectral; + +- if (!sp->enabled) +- return; +- + ath11k_dbring_srng_cleanup(ar, &sp->rx_ring); + ath11k_dbring_buf_cleanup(ar, &sp->rx_ring); + } +@@ -883,15 +883,16 @@ void ath11k_spectral_deinit(struct ath11k_base *ab) + if (!sp->enabled) + continue; + +- ath11k_spectral_debug_unregister(ar); +- ath11k_spectral_ring_free(ar); ++ mutex_lock(&ar->conf_mutex); ++ ath11k_spectral_scan_config(ar, ATH11K_SPECTRAL_DISABLED); ++ mutex_unlock(&ar->conf_mutex); + + spin_lock_bh(&sp->lock); +- +- sp->mode = ATH11K_SPECTRAL_DISABLED; + sp->enabled = false; +- + spin_unlock_bh(&sp->lock); ++ ++ ath11k_spectral_debug_unregister(ar); ++ ath11k_spectral_ring_free(ar); + } + } + +-- +2.35.1 + diff --git a/queue-5.15/ath11k-don-t-check-arvif-is_started-before-sending-m.patch b/queue-5.15/ath11k-don-t-check-arvif-is_started-before-sending-m.patch new file mode 100644 index 00000000000..35bdecd1670 --- /dev/null +++ b/queue-5.15/ath11k-don-t-check-arvif-is_started-before-sending-m.patch @@ -0,0 +1,64 @@ +From bdc095b162f40898669dcc815478176cd9d2c663 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 14:57:31 +0300 +Subject: ath11k: Don't check arvif->is_started before sending management + frames + +From: Baochen Qiang + +[ Upstream commit 355333a217541916576351446b5832fec7930566 ] + +Commit 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for +deleted vdev") wants both of below two conditions are true before +sending management frames: + +1: ar->allocated_vdev_map & (1LL << arvif->vdev_id) +2: arvif->is_started + +Actually the second one is not necessary because with the first one +we can make sure the vdev is present. + +Also use ar->conf_mutex to synchronize vdev delete and mgmt. TX. + +This issue is found in case of Passpoint scenario where ath11k +needs to send action frames before vdev is started. + +Fix it by removing the second condition. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 + +Fixes: 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for deleted vdev") +Signed-off-by: Baochen Qiang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220506013614.1580274-3-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index bf64ab6e8484..f85fd341557e 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -4266,8 +4266,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) + } + + arvif = ath11k_vif_to_arvif(skb_cb->vif); +- if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) && +- arvif->is_started) { ++ mutex_lock(&ar->conf_mutex); ++ if (ar->allocated_vdev_map & (1LL << arvif->vdev_id)) { + ret = ath11k_mac_mgmt_tx_wmi(ar, arvif, skb); + if (ret) { + ath11k_warn(ar->ab, "failed to tx mgmt frame, vdev_id %d :%d\n", +@@ -4283,6 +4283,7 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) + arvif->is_started); + ieee80211_free_txskb(ar->hw, skb); + } ++ mutex_unlock(&ar->conf_mutex); + } + } + +-- +2.35.1 + diff --git a/queue-5.15/ath9k-fix-ar9003_get_eepmisc.patch b/queue-5.15/ath9k-fix-ar9003_get_eepmisc.patch new file mode 100644 index 00000000000..8b8aaa4d269 --- /dev/null +++ b/queue-5.15/ath9k-fix-ar9003_get_eepmisc.patch @@ -0,0 +1,40 @@ +From 2af73ba47b780f921d7efc22823c51816902a2f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Mar 2022 17:30:08 -0600 +Subject: ath9k: fix ar9003_get_eepmisc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wenli Looi + +[ Upstream commit 9aaff3864b603408c02c629957ae8d8ff5d5a4f2 ] + +The current implementation is reading the wrong eeprom type. + +Fixes: d8ec2e2a63e8 ("ath9k: Add an eeprom_ops callback for retrieving the eepmisc value") +Signed-off-by: Wenli Looi +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220320233010.123106-5-wlooi@ucalgary.ca +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +index b0a4ca3559fd..abed1effd95c 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -5615,7 +5615,7 @@ unsigned int ar9003_get_paprd_scale_factor(struct ath_hw *ah, + + static u8 ar9003_get_eepmisc(struct ath_hw *ah) + { +- return ah->eeprom.map4k.baseEepHeader.eepMisc; ++ return ah->eeprom.ar9300_eep.baseEepHeader.opCapFlags.eepMisc; + } + + const struct eeprom_ops eep_ar9300_ops = { +-- +2.35.1 + diff --git a/queue-5.15/ath9k-fix-qca9561-pa-bias-level.patch b/queue-5.15/ath9k-fix-qca9561-pa-bias-level.patch new file mode 100644 index 00000000000..4dce40df869 --- /dev/null +++ b/queue-5.15/ath9k-fix-qca9561-pa-bias-level.patch @@ -0,0 +1,54 @@ +From 29c365f476b6473744a17e7a956197e654d25888 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Apr 2022 16:51:45 +0200 +Subject: ath9k: fix QCA9561 PA bias level +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thibaut VARÈNE + +[ Upstream commit e999a5da28a0e0f7de242d841ef7d5e48f4646ae ] + +This patch fixes an invalid TX PA DC bias level on QCA9561, which +results in a very low output power and very low throughput as devices +are further away from the AP (compared to other 2.4GHz APs). + +This patch was suggested by Felix Fietkau, who noted[1]: +"The value written to that register is wrong, because while the mask +definition AR_CH0_TOP2_XPABIASLVL uses a different value for 9561, the +shift definition AR_CH0_TOP2_XPABIASLVL_S is hardcoded to 12, which is +wrong for 9561." + +In real life testing, without this patch the 2.4GHz throughput on +Yuncore XD3200 is around 10Mbps sitting next to the AP, and closer to +practical maximum with the patch applied. + +[1] https://lore.kernel.org/all/91c58969-c60e-2f41-00ac-737786d435ae@nbd.name + +Signed-off-by: Thibaut VARÈNE +Acked-by: Felix Fietkau +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220417145145.1847-1-hacks+kernel@slashdirt.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h +index a171dbb29fbb..ad949eb02f3d 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h ++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h +@@ -720,7 +720,7 @@ + #define AR_CH0_TOP2 (AR_SREV_9300(ah) ? 0x1628c : \ + (AR_SREV_9462(ah) ? 0x16290 : 0x16284)) + #define AR_CH0_TOP2_XPABIASLVL (AR_SREV_9561(ah) ? 0x1e00 : 0xf000) +-#define AR_CH0_TOP2_XPABIASLVL_S 12 ++#define AR_CH0_TOP2_XPABIASLVL_S (AR_SREV_9561(ah) ? 9 : 12) + + #define AR_CH0_XTAL (AR_SREV_9300(ah) ? 0x16294 : \ + ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \ +-- +2.35.1 + diff --git a/queue-5.15/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch b/queue-5.15/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch new file mode 100644 index 00000000000..eee3f4030df --- /dev/null +++ b/queue-5.15/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch @@ -0,0 +1,51 @@ +From 203654aad6a849acc8ba0f828c4656b1dcad9f7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Apr 2022 09:12:25 +0300 +Subject: ath9k_htc: fix potential out of bounds access with invalid + rxstatus->rs_keyix +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ] + +The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to +ensure that it is within the bitmap. + +drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() +error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' + +Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept") +Signed-off-by: Dan Carpenter +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220409061225.GA5447@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index 6a850a0bfa8a..a23eaca0326d 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -1016,6 +1016,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + goto rx_next; + } + ++ if (rxstatus->rs_keyix >= ATH_KEYMAX && ++ rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) { ++ ath_dbg(common, ANY, ++ "Invalid keyix, dropping (keyix: %d)\n", ++ rxstatus->rs_keyix); ++ goto rx_next; ++ } ++ + /* Get the RX status information */ + + memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); +-- +2.35.1 + diff --git a/queue-5.15/b43-fix-assigning-negative-value-to-unsigned-variabl.patch b/queue-5.15/b43-fix-assigning-negative-value-to-unsigned-variabl.patch new file mode 100644 index 00000000000..beed81a9a94 --- /dev/null +++ b/queue-5.15/b43-fix-assigning-negative-value-to-unsigned-variabl.patch @@ -0,0 +1,37 @@ +From b24d1772918974af40ea824ec5c3385c04b7baaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:15:15 +0800 +Subject: b43: Fix assigning negative value to unsigned variable + +From: Haowen Bai + +[ Upstream commit 11800d893b38e0e12d636c170c1abc19c43c730c ] + +fix warning reported by smatch: +drivers/net/wireless/broadcom/b43/phy_n.c:585 b43_nphy_adjust_lna_gain_table() +warn: assigning (-2) to unsigned variable '*(lna_gain[0])' + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648203315-28093-1-git-send-email-baihaowen@meizu.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c +index cf3ccf4ddfe7..aa5c99465674 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_n.c ++++ b/drivers/net/wireless/broadcom/b43/phy_n.c +@@ -582,7 +582,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev) + u16 data[4]; + s16 gain[2]; + u16 minmax[2]; +- static const u16 lna_gain[4] = { -2, 10, 19, 25 }; ++ static const s16 lna_gain[4] = { -2, 10, 19, 25 }; + + if (nphy->hang_avoid) + b43_nphy_stay_in_carrier_search(dev, 1); +-- +2.35.1 + diff --git a/queue-5.15/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch b/queue-5.15/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch new file mode 100644 index 00000000000..bdccd883f17 --- /dev/null +++ b/queue-5.15/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch @@ -0,0 +1,37 @@ +From c21adbc39f8c0c505625e9441c922f9fd05715be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:17:13 +0800 +Subject: b43legacy: Fix assigning negative value to unsigned variable + +From: Haowen Bai + +[ Upstream commit 3f6b867559b3d43a7ce1b4799b755e812fc0d503 ] + +fix warning reported by smatch: +drivers/net/wireless/broadcom/b43legacy/phy.c:1181 b43legacy_phy_lo_b_measure() +warn: assigning (-772) to unsigned variable 'fval' + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648203433-8736-1-git-send-email-baihaowen@meizu.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43legacy/phy.c b/drivers/net/wireless/broadcom/b43legacy/phy.c +index 05404fbd1e70..c1395e622759 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/phy.c ++++ b/drivers/net/wireless/broadcom/b43legacy/phy.c +@@ -1123,7 +1123,7 @@ void b43legacy_phy_lo_b_measure(struct b43legacy_wldev *dev) + struct b43legacy_phy *phy = &dev->phy; + u16 regstack[12] = { 0 }; + u16 mls; +- u16 fval; ++ s16 fval; + int i; + int j; + +-- +2.35.1 + diff --git a/queue-5.15/bfq-allow-current-waker-to-defend-against-a-tentativ.patch b/queue-5.15/bfq-allow-current-waker-to-defend-against-a-tentativ.patch new file mode 100644 index 00000000000..17d9f17cef1 --- /dev/null +++ b/queue-5.15/bfq-allow-current-waker-to-defend-against-a-tentativ.patch @@ -0,0 +1,41 @@ +From 4c4a736e706e0634bc06cafba5725dda513cfa24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 12:52:30 +0200 +Subject: bfq: Allow current waker to defend against a tentative one + +From: Jan Kara + +[ Upstream commit c5ac56bb6110e42e79d3106866658376b2e48ab9 ] + +The code in bfq_check_waker() ignores wake up events from the current +waker. This makes it more likely we select a new tentative waker +although the current one is generating more wake up events. Treat +current waker the same way as any other process and allow it to reset +the waker detection logic. + +Fixes: 71217df39dc6 ("block, bfq: make waker-queue detection more robust") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220519105235.31397-2-jack@suse.cz +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index a2aefb4a1e2e..343ca559ab8a 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2022,8 +2022,7 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (!bfqd->last_completed_rq_bfqq || + bfqd->last_completed_rq_bfqq == bfqq || + bfq_bfqq_has_short_ttime(bfqq) || +- now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC || +- bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq) ++ now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC) + return; + + if (bfqd->last_completed_rq_bfqq != +-- +2.35.1 + diff --git a/queue-5.15/bfq-relax-waker-detection-for-shared-queues.patch b/queue-5.15/bfq-relax-waker-detection-for-shared-queues.patch new file mode 100644 index 00000000000..b8ce75990c6 --- /dev/null +++ b/queue-5.15/bfq-relax-waker-detection-for-shared-queues.patch @@ -0,0 +1,93 @@ +From 0595ce4775669519c2797618a8526b46b0a44803 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 12:52:29 +0200 +Subject: bfq: Relax waker detection for shared queues + +From: Jan Kara + +[ Upstream commit f950667356ce90a41b446b726d4595a10cb65415 ] + +Currently we look for waker only if current queue has no requests. This +makes sense for bfq queues with a single process however for shared +queues when there is a larger number of processes the condition that +queue has no requests is difficult to meet because often at least one +process has some request in flight although all the others are waiting +for the waker to do the work and this harms throughput. Relax the "no +queued request for bfq queue" condition to "the current task has no +queued requests yet". For this, we also need to start tracking number of +requests in flight for each task. + +This patch (together with the following one) restores the performance +for dbench with 128 clients that regressed with commit c65e6fd460b4 +("bfq: Do not let waker requests skip proper accounting") because +this commit makes requests of wakers properly enter BFQ queues and thus +these queues become ineligible for the old waker detection logic. +Dbench results: + + Vanilla 5.18-rc3 5.18-rc3 + revert 5.18-rc3 patched +Mean 1237.36 ( 0.00%) 950.16 * 23.21%* 988.35 * 20.12%* + +Numbers are time to complete workload so lower is better. + +Fixes: c65e6fd460b4 ("bfq: Do not let waker requests skip proper accounting") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220519105235.31397-1-jack@suse.cz +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 5 +++-- + block/bfq-iosched.h | 1 + + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 63d2d66dece5..a2aefb4a1e2e 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2022,7 +2022,6 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (!bfqd->last_completed_rq_bfqq || + bfqd->last_completed_rq_bfqq == bfqq || + bfq_bfqq_has_short_ttime(bfqq) || +- bfqq->dispatched > 0 || + now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC || + bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq) + return; +@@ -2084,7 +2083,7 @@ static void bfq_add_request(struct request *rq) + bfqq->queued[rq_is_sync(rq)]++; + bfqd->queued++; + +- if (RB_EMPTY_ROOT(&bfqq->sort_list) && bfq_bfqq_sync(bfqq)) { ++ if (bfq_bfqq_sync(bfqq) && RQ_BIC(rq)->requests <= 1) { + bfq_check_waker(bfqd, bfqq, now_ns); + + /* +@@ -6422,6 +6421,7 @@ static void bfq_finish_requeue_request(struct request *rq) + bfq_completed_request(bfqq, bfqd); + } + bfq_finish_requeue_request_body(bfqq); ++ RQ_BIC(rq)->requests--; + spin_unlock_irqrestore(&bfqd->lock, flags); + + /* +@@ -6643,6 +6643,7 @@ static struct bfq_queue *bfq_init_rq(struct request *rq) + + bfqq->allocated++; + bfqq->ref++; ++ bic->requests++; + bfq_log_bfqq(bfqd, bfqq, "get_request %p: bfqq %p, %d", + rq, bfqq, bfqq->ref); + +diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h +index a73488eec8a4..9dc87d3c40c3 100644 +--- a/block/bfq-iosched.h ++++ b/block/bfq-iosched.h +@@ -466,6 +466,7 @@ struct bfq_io_cq { + struct bfq_queue *stable_merge_bfqq; + + bool stably_merged; /* non splittable if true */ ++ unsigned int requests; /* Number of requests this process has in flight */ + }; + + /** +-- +2.35.1 + diff --git a/queue-5.15/block-fix-the-bio.bi_opf-comment.patch b/queue-5.15/block-fix-the-bio.bi_opf-comment.patch new file mode 100644 index 00000000000..704dc8c96d7 --- /dev/null +++ b/queue-5.15/block-fix-the-bio.bi_opf-comment.patch @@ -0,0 +1,48 @@ +From f74c45f0aac4c73fcea497511e9159904eac938f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:51:52 -0700 +Subject: block: Fix the bio.bi_opf comment + +From: Bart Van Assche + +[ Upstream commit 5d2ae14276e698c76fa0c8ce870103f343b38263 ] + +Commit ef295ecf090d modified the Linux kernel such that the bottom bits +of the bi_opf member contain the operation instead of the topmost bits. +That commit did not update the comment next to bi_opf. Hence this patch. + +From commit ef295ecf090d: +-#define bio_op(bio) ((bio)->bi_opf >> BIO_OP_SHIFT) ++#define bio_op(bio) ((bio)->bi_opf & REQ_OP_MASK) + +Cc: Christoph Hellwig +Cc: Ming Lei +Fixes: ef295ecf090d ("block: better op and flags encoding") +Signed-off-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220511235152.1082246-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/blk_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h +index be622b5a21ed..17c92c0f15b2 100644 +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -215,9 +215,8 @@ static inline void bio_issue_init(struct bio_issue *issue, + struct bio { + struct bio *bi_next; /* request queue link */ + struct block_device *bi_bdev; +- unsigned int bi_opf; /* bottom bits req flags, +- * top bits REQ_OP. Use +- * accessors. ++ unsigned int bi_opf; /* bottom bits REQ_OP, top bits ++ * req_flags. + */ + unsigned short bi_flags; /* BIO_* below */ + unsigned short bi_ioprio; +-- +2.35.1 + diff --git a/queue-5.15/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch b/queue-5.15/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch new file mode 100644 index 00000000000..05cf5312cb1 --- /dev/null +++ b/queue-5.15/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch @@ -0,0 +1,88 @@ +From d4f744d39335f5984e87b6b995b4c9129e57ced1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 07:09:28 +0000 +Subject: Bluetooth: fix dangling sco_conn and use-after-free in + sco_sock_timeout + +From: Ying Hsu + +[ Upstream commit 7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2 ] + +Connecting the same socket twice consecutively in sco_sock_connect() +could lead to a race condition where two sco_conn objects are created +but only one is associated with the socket. If the socket is closed +before the SCO connection is established, the timer associated with the +dangling sco_conn object won't be canceled. As the sock object is being +freed, the use-after-free problem happens when the timer callback +function sco_sock_timeout() accesses the socket. Here's the call trace: + +dump_stack+0x107/0x163 +? refcount_inc+0x1c/ +print_address_description.constprop.0+0x1c/0x47e +? refcount_inc+0x1c/0x7b +kasan_report+0x13a/0x173 +? refcount_inc+0x1c/0x7b +check_memory_region+0x132/0x139 +refcount_inc+0x1c/0x7b +sco_sock_timeout+0xb2/0x1ba +process_one_work+0x739/0xbd1 +? cancel_delayed_work+0x13f/0x13f +? __raw_spin_lock_init+0xf0/0xf0 +? to_kthread+0x59/0x85 +worker_thread+0x593/0x70e +kthread+0x346/0x35a +? drain_workqueue+0x31a/0x31a +? kthread_bind+0x4b/0x4b +ret_from_fork+0x1f/0x30 + +Link: https://syzkaller.appspot.com/bug?extid=2bef95d3ab4daa10155b +Reported-by: syzbot+2bef95d3ab4daa10155b@syzkaller.appspotmail.com +Fixes: e1dee2c1de2b ("Bluetooth: fix repeated calls to sco_sock_kill") +Signed-off-by: Ying Hsu +Reviewed-by: Joseph Hwang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/sco.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 6e047e178c0a..c7b43c75677f 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -575,19 +575,24 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen + addr->sa_family != AF_BLUETOOTH) + return -EINVAL; + +- if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) +- return -EBADFD; ++ lock_sock(sk); ++ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { ++ err = -EBADFD; ++ goto done; ++ } + +- if (sk->sk_type != SOCK_SEQPACKET) +- return -EINVAL; ++ if (sk->sk_type != SOCK_SEQPACKET) { ++ err = -EINVAL; ++ goto done; ++ } + + hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR); +- if (!hdev) +- return -EHOSTUNREACH; ++ if (!hdev) { ++ err = -EHOSTUNREACH; ++ goto done; ++ } + hci_dev_lock(hdev); + +- lock_sock(sk); +- + /* Set destination address and psm */ + bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); + +-- +2.35.1 + diff --git a/queue-5.15/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch b/queue-5.15/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch new file mode 100644 index 00000000000..e7096215186 --- /dev/null +++ b/queue-5.15/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch @@ -0,0 +1,83 @@ +From 799be57c44b03c6feab99be90270a3795a27b2e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Apr 2022 19:37:52 +0200 +Subject: Bluetooth: use hdev lock for accept_list and reject_list in conn req + +From: Niels Dossche + +[ Upstream commit fb048cae51bacdfbbda2954af3c213fdb1d484f4 ] + +All accesses (both reads and modifications) to +hdev->{accept,reject}_list are protected by hdev lock, +except the ones in hci_conn_request_evt. This can cause a race +condition in the form of a list corruption. +The solution is to protect these lists in hci_conn_request_evt as well. + +I was unable to find the exact commit that introduced the issue for the +reject list, I was only able to find it for the accept list. + +Fixes: a55bd29d5227 ("Bluetooth: Add white list lookup for incoming connection requests") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index e984a8b4b914..5ac3aca6deeb 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -2790,10 +2790,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) + return; + } + ++ hci_dev_lock(hdev); ++ + if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr, + BDADDR_BREDR)) { + hci_reject_conn(hdev, &ev->bdaddr); +- return; ++ goto unlock; + } + + /* Require HCI_CONNECTABLE or an accept list entry to accept the +@@ -2805,13 +2807,11 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) + !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr, + BDADDR_BREDR)) { + hci_reject_conn(hdev, &ev->bdaddr); +- return; ++ goto unlock; + } + + /* Connection accepted */ + +- hci_dev_lock(hdev); +- + ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr); + if (ie) + memcpy(ie->data.dev_class, ev->dev_class, 3); +@@ -2823,8 +2823,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) + HCI_ROLE_SLAVE); + if (!conn) { + bt_dev_err(hdev, "no memory for new connection"); +- hci_dev_unlock(hdev); +- return; ++ goto unlock; + } + } + +@@ -2864,6 +2863,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) + conn->state = BT_CONNECT2; + hci_connect_cfm(conn, 0); + } ++ ++ return; ++unlock: ++ hci_dev_unlock(hdev); + } + + static u8 hci_to_mgmt_reason(u8 err) +-- +2.35.1 + diff --git a/queue-5.15/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch b/queue-5.15/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch new file mode 100644 index 00000000000..0c6596e35ac --- /dev/null +++ b/queue-5.15/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch @@ -0,0 +1,48 @@ +From 38fb9261a95c17b8b8e6fe5bdffe39fbde9efeb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 20:06:52 +0200 +Subject: Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring + +From: Niels Dossche + +[ Upstream commit 50a3633ae5e98cf1b80ef5b73c9e341aee9ad896 ] + +hci_is_adv_monitoring's function documentation states that it must be +called under the hdev lock. Paths that leads to an unlocked call are: +discov_update => start_discovery => interleaved_discov => active_scan +and: discov_update => start_discovery => active_scan + +The solution is to take the lock in active_scan during the duration of +the call to hci_is_adv_monitoring. + +Fixes: c32d624640fd ("Bluetooth: disable filter dup when scan for adv monitor") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_request.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 1d34d330afd3..c2db60ad0f1d 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -3174,6 +3174,7 @@ static int active_scan(struct hci_request *req, unsigned long opt) + if (err < 0) + own_addr_type = ADDR_LE_DEV_PUBLIC; + ++ hci_dev_lock(hdev); + if (hci_is_adv_monitoring(hdev)) { + /* Duplicate filter should be disabled when some advertisement + * monitor is activated, otherwise AdvMon can only receive one +@@ -3190,6 +3191,7 @@ static int active_scan(struct hci_request *req, unsigned long opt) + */ + filter_dup = LE_SCAN_FILTER_DUP_DISABLE; + } ++ hci_dev_unlock(hdev); + + hci_req_start_scan(req, LE_SCAN_ACTIVE, interval, + hdev->le_scan_window_discovery, own_addr_type, +-- +2.35.1 + diff --git a/queue-5.15/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch b/queue-5.15/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch new file mode 100644 index 00000000000..53bdc74c036 --- /dev/null +++ b/queue-5.15/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch @@ -0,0 +1,64 @@ +From 2ed4ae28addf96cac6f97e8e8992ee292d19e892 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 20:43:57 +0900 +Subject: can: mcp251xfd: silence clang's -Wunaligned-access warning + +From: Vincent Mailhol + +[ Upstream commit 1a6dd9996699889313327be03981716a8337656b ] + +clang emits a -Wunaligned-access warning on union +mcp251xfd_tx_ojb_load_buf. + +The reason is that field hw_tx_obj (not declared as packed) is being +packed right after a 16 bits field inside a packed struct: + +| union mcp251xfd_tx_obj_load_buf { +| struct __packed { +| struct mcp251xfd_buf_cmd cmd; +| /* ^ 16 bits fields */ +| struct mcp251xfd_hw_tx_obj_raw hw_tx_obj; +| /* ^ not declared as packed */ +| } nocrc; +| struct __packed { +| struct mcp251xfd_buf_cmd_crc cmd; +| struct mcp251xfd_hw_tx_obj_raw hw_tx_obj; +| __be16 crc; +| } crc; +| } ____cacheline_aligned; + +Starting from LLVM 14, having an unpacked struct nested in a packed +struct triggers a warning. c.f. [1]. + +This is a false positive because the field is always being accessed +with the relevant put_unaligned_*() function. Adding __packed to the +structure declaration silences the warning. + +[1] https://github.com/llvm/llvm-project/issues/55520 + +Link: https://lore.kernel.org/all/20220518114357.55452-1-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Reported-by: kernel test robot +Tested-by: Nathan Chancellor # build +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +index 0f322dabaf65..281856eea2ef 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +@@ -433,7 +433,7 @@ struct mcp251xfd_hw_tef_obj { + /* The tx_obj_raw version is used in spi async, i.e. without + * regmap. We have to take care of endianness ourselves. + */ +-struct mcp251xfd_hw_tx_obj_raw { ++struct __packed mcp251xfd_hw_tx_obj_raw { + __le32 id; + __le32 flags; + u8 data[sizeof_field(struct canfd_frame, data)]; +-- +2.35.1 + diff --git a/queue-5.15/can-xilinx_can-mark-bit-timing-constants-as-const.patch b/queue-5.15/can-xilinx_can-mark-bit-timing-constants-as-const.patch new file mode 100644 index 00000000000..3e70f9852a9 --- /dev/null +++ b/queue-5.15/can-xilinx_can-mark-bit-timing-constants-as-const.patch @@ -0,0 +1,46 @@ +From d233c4917aec088ff2ec0026fe15f39a34ff5806 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 21:29:07 +0100 +Subject: can: xilinx_can: mark bit timing constants as const + +From: Marc Kleine-Budde + +[ Upstream commit ae38fda02996d43d9fb09f16e81e0008704dd524 ] + +This patch marks the bit timing constants as const. + +Fixes: c223da689324 ("can: xilinx_can: Add support for CANFD FD frames") +Link: https://lore.kernel.org/all/20220317203119.792552-1-mkl@pengutronix.de +Cc: Appana Durga Kedareswara rao +Cc: Naga Sureshkumar Relli +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/xilinx_can.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index a579b9b791ed..262b783d1df8 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -239,7 +239,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd = { + }; + + /* AXI CANFD Data Bittiming constants as per AXI CANFD 1.0 specs */ +-static struct can_bittiming_const xcan_data_bittiming_const_canfd = { ++static const struct can_bittiming_const xcan_data_bittiming_const_canfd = { + .name = DRIVER_NAME, + .tseg1_min = 1, + .tseg1_max = 16, +@@ -265,7 +265,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd2 = { + }; + + /* AXI CANFD 2.0 Data Bittiming constants as per AXI CANFD 2.0 spec */ +-static struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { ++static const struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { + .name = DRIVER_NAME, + .tseg1_min = 1, + .tseg1_max = 32, +-- +2.35.1 + diff --git a/queue-5.15/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch b/queue-5.15/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch new file mode 100644 index 00000000000..8f8178e965a --- /dev/null +++ b/queue-5.15/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch @@ -0,0 +1,56 @@ +From 4242d64984cfdf863ee04af27fde0af3b19bd3ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 10:06:02 +0200 +Subject: char: tpm: cr50_i2c: Suppress duplicated error message in .remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit e0687fe958f763f1790f22ed5483025b7624e744 ] + +Returning an error value in an i2c remove callback results in an error +message being emitted by the i2c core, but otherwise it doesn't make a +difference. The device goes away anyhow and the devm cleanups are +called. + +As tpm_cr50_i2c_remove() emits an error message already and the +additional error message by the i2c core doesn't add any useful +information, change the return value to zero to suppress this error +message. + +Note that if i2c_clientdata is NULL, there is something really fishy. +Assuming no memory corruption happened (then all bets are lost anyhow), +tpm_cr50_i2c_remove() is only called after tpm_cr50_i2c_probe() returned +successfully. So there was a tpm chip registered before and after +tpm_cr50_i2c_remove() its privdata is freed but the associated character +device isn't removed. If after that happened userspace accesses the +character device it's likely that the freed memory is accessed. For that +reason the warning message is made a bit more frightening. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index c89278103703..e2ab6a329732 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -754,8 +754,8 @@ static int tpm_cr50_i2c_remove(struct i2c_client *client) + struct device *dev = &client->dev; + + if (!chip) { +- dev_err(dev, "Could not get client data at remove\n"); +- return -ENODEV; ++ dev_crit(dev, "Could not get client data at remove, memory corruption ahead\n"); ++ return 0; + } + + tpm_chip_unregister(chip); +-- +2.35.1 + diff --git a/queue-5.15/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch b/queue-5.15/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch new file mode 100644 index 00000000000..82df445b0c1 --- /dev/null +++ b/queue-5.15/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch @@ -0,0 +1,62 @@ +From 92d9ce1b52bee320f41bfd34d7418df4d71e39a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 13:51:35 +0530 +Subject: cpufreq: Avoid unnecessary frequency updates due to mismatch + +From: Viresh Kumar + +[ Upstream commit f55ae08c89873e140c7cac2a7fa161d31a0d60cf ] + +For some platforms, the frequency returned by hardware may be slightly +different from what is provided in the frequency table. For example, +hardware may return 499 MHz instead of 500 MHz. In such cases it is +better to avoid getting into unnecessary frequency updates, as we may +end up switching policy->cur between the two and sending unnecessary +pre/post update notifications, etc. + +This patch has chosen allows the hardware frequency and table frequency +to deviate by 1 MHz for now, we may want to increase it a bit later on +if someone still complains. + +Reported-by: Rex-BC Chen +Signed-off-by: Viresh Kumar +Tested-by: Jia-wei Chang +Reviewed-by: Matthias Brugger +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index eeac6d809229..cddf7e13c232 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + + static LIST_HEAD(cpufreq_policy_list); +@@ -1701,6 +1702,16 @@ static unsigned int cpufreq_verify_current_freq(struct cpufreq_policy *policy, b + return new_freq; + + if (policy->cur != new_freq) { ++ /* ++ * For some platforms, the frequency returned by hardware may be ++ * slightly different from what is provided in the frequency ++ * table, for example hardware may return 499 MHz instead of 500 ++ * MHz. In such cases it is better to avoid getting into ++ * unnecessary frequency updates. ++ */ ++ if (abs(policy->cur - new_freq) < HZ_PER_MHZ) ++ return policy->cur; ++ + cpufreq_out_of_sync(policy, new_freq); + if (update) + schedule_work(&policy->update); +-- +2.35.1 + diff --git a/queue-5.15/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch b/queue-5.15/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch new file mode 100644 index 00000000000..662bcfb7865 --- /dev/null +++ b/queue-5.15/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch @@ -0,0 +1,91 @@ +From 79a54c63565a99823553200ed814ad797f826fe1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 03:15:41 +0800 +Subject: cpufreq: Fix possible race in cpufreq online error path + +From: Schspa Shi + +[ Upstream commit f346e96267cd76175d6c201b40f770c0116a8a04 ] + +When cpufreq online fails, the policy->cpus mask is not cleared and +policy->rwsem is released too early, so the driver can be invoked +via the cpuinfo_cur_freq sysfs attribute while its ->offline() or +->exit() callbacks are being run. + +Take policy->clk as an example: + +static int cpufreq_online(unsigned int cpu) +{ + ... + // policy->cpus != 0 at this time + down_write(&policy->rwsem); + ret = cpufreq_add_dev_interface(policy); + up_write(&policy->rwsem); + + return 0; + +out_destroy_policy: + for_each_cpu(j, policy->real_cpus) + remove_cpu_dev_symlink(policy, get_cpu_device(j)); + up_write(&policy->rwsem); +... +out_exit_policy: + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + clk_put(policy->clk); + // policy->clk is a wild pointer +... + ^ + | + Another process access + __cpufreq_get + cpufreq_verify_current_freq + cpufreq_generic_get + // acces wild pointer of policy->clk; + | + | +out_offline_policy: | + cpufreq_policy_free(policy); | + // deleted here, and will wait for no body reference + cpufreq_policy_put_kobj(policy); +} + +Address this by modifying cpufreq_online() to release policy->rwsem +in the error path after the driver callbacks have run and to clear +policy->cpus before releasing the semaphore. + +Fixes: 7106e02baed4 ("cpufreq: release policy->rwsem on error") +Signed-off-by: Schspa Shi +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index cddf7e13c232..502245710ee0 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1528,8 +1528,6 @@ static int cpufreq_online(unsigned int cpu) + for_each_cpu(j, policy->real_cpus) + remove_cpu_dev_symlink(policy, get_cpu_device(j)); + +- up_write(&policy->rwsem); +- + out_offline_policy: + if (cpufreq_driver->offline) + cpufreq_driver->offline(policy); +@@ -1538,6 +1536,9 @@ static int cpufreq_online(unsigned int cpu) + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + ++ cpumask_clear(policy->cpus); ++ up_write(&policy->rwsem); ++ + out_free_policy: + cpufreq_policy_free(policy); + return ret; +-- +2.35.1 + diff --git a/queue-5.15/cpufreq-mediatek-unregister-platform-device-on-exit.patch b/queue-5.15/cpufreq-mediatek-unregister-platform-device-on-exit.patch new file mode 100644 index 00000000000..c8c41ebaab7 --- /dev/null +++ b/queue-5.15/cpufreq-mediatek-unregister-platform-device-on-exit.patch @@ -0,0 +1,72 @@ +From 54dfd98045bf145120a9e1c493a938bb631d4aa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 May 2022 19:52:18 +0800 +Subject: cpufreq: mediatek: Unregister platform device on exit + +From: Rex-BC Chen + +[ Upstream commit f126fbadce92b92c3a7be41e4abc1fbae93ae2ef ] + +We register the platform device when driver inits. However, we do not +unregister it when driver exits. + +To resolve this, we declare the platform data to be a global static +variable and rename it to be "cpufreq_pdev". With this global variable, +we can do platform_device_unregister() when driver exits. + +Fixes: 501c574f4e3a ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC") +Signed-off-by: Rex-BC Chen +[ Viresh: Commit log and Subject ] +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 9d7d9c8dc184..bfe240c726e3 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -44,6 +44,8 @@ struct mtk_cpu_dvfs_info { + bool need_voltage_tracking; + }; + ++static struct platform_device *cpufreq_pdev; ++ + static LIST_HEAD(dvfs_info_list); + + static struct mtk_cpu_dvfs_info *mtk_cpu_dvfs_info_lookup(int cpu) +@@ -547,7 +549,6 @@ static int __init mtk_cpufreq_driver_init(void) + { + struct device_node *np; + const struct of_device_id *match; +- struct platform_device *pdev; + int err; + + np = of_find_node_by_path("/"); +@@ -571,11 +572,11 @@ static int __init mtk_cpufreq_driver_init(void) + * and the device registration codes are put here to handle defer + * probing. + */ +- pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0); +- if (IS_ERR(pdev)) { ++ cpufreq_pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0); ++ if (IS_ERR(cpufreq_pdev)) { + pr_err("failed to register mtk-cpufreq platform device\n"); + platform_driver_unregister(&mtk_cpufreq_platdrv); +- return PTR_ERR(pdev); ++ return PTR_ERR(cpufreq_pdev); + } + + return 0; +@@ -584,6 +585,7 @@ module_init(mtk_cpufreq_driver_init) + + static void __exit mtk_cpufreq_driver_exit(void) + { ++ platform_device_unregister(cpufreq_pdev); + platform_driver_unregister(&mtk_cpufreq_platdrv); + } + module_exit(mtk_cpufreq_driver_exit) +-- +2.35.1 + diff --git a/queue-5.15/cpufreq-mediatek-use-module_init-and-add-module_exit.patch b/queue-5.15/cpufreq-mediatek-use-module_init-and-add-module_exit.patch new file mode 100644 index 00000000000..bb57a497505 --- /dev/null +++ b/queue-5.15/cpufreq-mediatek-use-module_init-and-add-module_exit.patch @@ -0,0 +1,42 @@ +From 1436c1155c793a7333d5c36e6d956b9893692de5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 12:58:55 +0800 +Subject: cpufreq: mediatek: Use module_init and add module_exit + +From: Jia-Wei Chang + +[ Upstream commit b7070187c81cb90549d7561c0e750d7c7eb751f4 ] + +- Use module_init instead of device_initcall. +- Add a function for module_exit to unregister driver. + +Signed-off-by: Jia-Wei Chang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 866163883b48..9d7d9c8dc184 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -580,7 +580,13 @@ static int __init mtk_cpufreq_driver_init(void) + + return 0; + } +-device_initcall(mtk_cpufreq_driver_init); ++module_init(mtk_cpufreq_driver_init) ++ ++static void __exit mtk_cpufreq_driver_exit(void) ++{ ++ platform_driver_unregister(&mtk_cpufreq_platdrv); ++} ++module_exit(mtk_cpufreq_driver_exit) + + MODULE_DESCRIPTION("MediaTek CPUFreq driver"); + MODULE_AUTHOR("Pi-Cheng Chen "); +-- +2.35.1 + diff --git a/queue-5.15/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch b/queue-5.15/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch new file mode 100644 index 00000000000..06aed515c23 --- /dev/null +++ b/queue-5.15/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch @@ -0,0 +1,110 @@ +From d09520eec9518c3f4191a6c301ed7f82e6f43f30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 16:11:24 +0200 +Subject: cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode + +From: Ulf Hansson + +[ Upstream commit 171b66e2e2e9d80b93c8cff799e6175074b22297 ] + +When PSCI OSI mode is supported the syscore flag is set for the CPU devices +that becomes attached to their PM domains (genpds). In the suspend-to-idle +case, we call dev_pm_genpd_suspend|resume() to allow genpd to properly +manage the power-off/on operations (pick an idlestate and manage the on/off +notifications). + +For suspend-to-ram, dev_pm_genpd_suspend|resume() is currently not being +called, which causes a problem that the genpd on/off notifiers do not get +sent as expected. This prevents the platform-specific operations from being +executed, typically needed just before/after the boot CPU is being turned +off/on. + +To deal with this problem, let's register a syscore ops for cpuidle-psci +when PSCI OSI mode is being used and call dev_pm_genpd_suspend|resume() +from them. In this way, genpd regains control of the PM domain topology and +then sends the on/off notifications when it's appropriate. + +Reported-by: Maulik Shah +Suggested-by: Maulik Shah +Signed-off-by: Ulf Hansson +Tested-by: Maulik Shah +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-psci.c | 46 ++++++++++++++++++++++++++++++++++ + 1 file changed, 46 insertions(+) + +diff --git a/drivers/cpuidle/cpuidle-psci.c b/drivers/cpuidle/cpuidle-psci.c +index b51b5df08450..540105ca0781 100644 +--- a/drivers/cpuidle/cpuidle-psci.c ++++ b/drivers/cpuidle/cpuidle-psci.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + +@@ -131,6 +132,49 @@ static int psci_idle_cpuhp_down(unsigned int cpu) + return 0; + } + ++static void psci_idle_syscore_switch(bool suspend) ++{ ++ bool cleared = false; ++ struct device *dev; ++ int cpu; ++ ++ for_each_possible_cpu(cpu) { ++ dev = per_cpu_ptr(&psci_cpuidle_data, cpu)->dev; ++ ++ if (dev && suspend) { ++ dev_pm_genpd_suspend(dev); ++ } else if (dev) { ++ dev_pm_genpd_resume(dev); ++ ++ /* Account for userspace having offlined a CPU. */ ++ if (pm_runtime_status_suspended(dev)) ++ pm_runtime_set_active(dev); ++ ++ /* Clear domain state to re-start fresh. */ ++ if (!cleared) { ++ psci_set_domain_state(0); ++ cleared = true; ++ } ++ } ++ } ++} ++ ++static int psci_idle_syscore_suspend(void) ++{ ++ psci_idle_syscore_switch(true); ++ return 0; ++} ++ ++static void psci_idle_syscore_resume(void) ++{ ++ psci_idle_syscore_switch(false); ++} ++ ++static struct syscore_ops psci_idle_syscore_ops = { ++ .suspend = psci_idle_syscore_suspend, ++ .resume = psci_idle_syscore_resume, ++}; ++ + static void psci_idle_init_cpuhp(void) + { + int err; +@@ -138,6 +182,8 @@ static void psci_idle_init_cpuhp(void) + if (!psci_cpuidle_use_cpuhp) + return; + ++ register_syscore_ops(&psci_idle_syscore_ops); ++ + err = cpuhp_setup_state_nocalls(CPUHP_AP_CPU_PM_STARTING, + "cpuidle/psci:online", + psci_idle_cpuhp_up, +-- +2.35.1 + diff --git a/queue-5.15/crypto-ccree-use-fine-grained-dma-mapping-dir.patch b/queue-5.15/crypto-ccree-use-fine-grained-dma-mapping-dir.patch new file mode 100644 index 00000000000..4fb0e450150 --- /dev/null +++ b/queue-5.15/crypto-ccree-use-fine-grained-dma-mapping-dir.patch @@ -0,0 +1,117 @@ +From 859d236891054d944ab5866b5692fbcf96065faf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 11:11:39 +0300 +Subject: crypto: ccree - use fine grained DMA mapping dir + +From: Gilad Ben-Yossef + +[ Upstream commit a260436c98171cd825955a84a7f6e62bc8f4f00d ] + +Use a fine grained specification of DMA mapping directions +in certain cases, allowing both a more optimized operation +as well as shushing out a harmless, though persky +dma-debug warning. + +Signed-off-by: Gilad Ben-Yossef +Reported-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccree/cc_buffer_mgr.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c +index 11e0278c8631..6140e4927322 100644 +--- a/drivers/crypto/ccree/cc_buffer_mgr.c ++++ b/drivers/crypto/ccree/cc_buffer_mgr.c +@@ -356,12 +356,14 @@ void cc_unmap_cipher_request(struct device *dev, void *ctx, + req_ctx->mlli_params.mlli_dma_addr); + } + +- dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_BIDIRECTIONAL); +- dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); +- + if (src != dst) { +- dma_unmap_sg(dev, dst, req_ctx->out_nents, DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_TO_DEVICE); ++ dma_unmap_sg(dev, dst, req_ctx->out_nents, DMA_FROM_DEVICE); + dev_dbg(dev, "Unmapped req->dst=%pK\n", sg_virt(dst)); ++ dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); ++ } else { ++ dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_BIDIRECTIONAL); ++ dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); + } + } + +@@ -377,6 +379,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + u32 dummy = 0; + int rc = 0; + u32 mapped_nents = 0; ++ int src_direction = (src != dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL); + + req_ctx->dma_buf_type = CC_DMA_BUF_DLLI; + mlli_params->curr_pool = NULL; +@@ -399,7 +402,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + } + + /* Map the src SGL */ +- rc = cc_map_sg(dev, src, nbytes, DMA_BIDIRECTIONAL, &req_ctx->in_nents, ++ rc = cc_map_sg(dev, src, nbytes, src_direction, &req_ctx->in_nents, + LLI_MAX_NUM_OF_DATA_ENTRIES, &dummy, &mapped_nents); + if (rc) + goto cipher_exit; +@@ -416,7 +419,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + } + } else { + /* Map the dst sg */ +- rc = cc_map_sg(dev, dst, nbytes, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, dst, nbytes, DMA_FROM_DEVICE, + &req_ctx->out_nents, LLI_MAX_NUM_OF_DATA_ENTRIES, + &dummy, &mapped_nents); + if (rc) +@@ -456,6 +459,7 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req) + struct aead_req_ctx *areq_ctx = aead_request_ctx(req); + unsigned int hw_iv_size = areq_ctx->hw_iv_size; + struct cc_drvdata *drvdata = dev_get_drvdata(dev); ++ int src_direction = (req->src != req->dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL); + + if (areq_ctx->mac_buf_dma_addr) { + dma_unmap_single(dev, areq_ctx->mac_buf_dma_addr, +@@ -514,13 +518,11 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req) + sg_virt(req->src), areq_ctx->src.nents, areq_ctx->assoc.nents, + areq_ctx->assoclen, req->cryptlen); + +- dma_unmap_sg(dev, req->src, areq_ctx->src.mapped_nents, +- DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, req->src, areq_ctx->src.mapped_nents, src_direction); + if (req->src != req->dst) { + dev_dbg(dev, "Unmapping dst sgl: req->dst=%pK\n", + sg_virt(req->dst)); +- dma_unmap_sg(dev, req->dst, areq_ctx->dst.mapped_nents, +- DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, req->dst, areq_ctx->dst.mapped_nents, DMA_FROM_DEVICE); + } + if (drvdata->coherent && + areq_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_DECRYPT && +@@ -843,7 +845,7 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata, + else + size_for_map -= authsize; + +- rc = cc_map_sg(dev, req->dst, size_for_map, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, req->dst, size_for_map, DMA_FROM_DEVICE, + &areq_ctx->dst.mapped_nents, + LLI_MAX_NUM_OF_DATA_ENTRIES, &dst_last_bytes, + &dst_mapped_nents); +@@ -1056,7 +1058,8 @@ int cc_map_aead_request(struct cc_drvdata *drvdata, struct aead_request *req) + size_to_map += authsize; + } + +- rc = cc_map_sg(dev, req->src, size_to_map, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, req->src, size_to_map, ++ (req->src != req->dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL), + &areq_ctx->src.mapped_nents, + (LLI_MAX_NUM_OF_ASSOC_DATA_ENTRIES + + LLI_MAX_NUM_OF_DATA_ENTRIES), +-- +2.35.1 + diff --git a/queue-5.15/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch b/queue-5.15/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch new file mode 100644 index 00000000000..6bc30704b1f --- /dev/null +++ b/queue-5.15/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch @@ -0,0 +1,101 @@ +From ab879ec672e76403fce8795de154e42ddf75da3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:07:36 +0200 +Subject: crypto: cryptd - Protect per-CPU resource by disabling BH. + +From: Sebastian Andrzej Siewior + +[ Upstream commit 91e8bcd7b4da182e09ea19a2c73167345fe14c98 ] + +The access to cryptd_queue::cpu_queue is synchronized by disabling +preemption in cryptd_enqueue_request() and disabling BH in +cryptd_queue_worker(). This implies that access is allowed from BH. + +If cryptd_enqueue_request() is invoked from preemptible context _and_ +soft interrupt then this can lead to list corruption since +cryptd_enqueue_request() is not protected against access from +soft interrupt. + +Replace get_cpu() in cryptd_enqueue_request() with local_bh_disable() +to ensure BH is always disabled. +Remove preempt_disable() from cryptd_queue_worker() since it is not +needed because local_bh_disable() ensures synchronisation. + +Fixes: 254eff771441 ("crypto: cryptd - Per-CPU thread implementation...") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/cryptd.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/crypto/cryptd.c b/crypto/cryptd.c +index a1bea0f4baa8..668095eca0fa 100644 +--- a/crypto/cryptd.c ++++ b/crypto/cryptd.c +@@ -39,6 +39,10 @@ struct cryptd_cpu_queue { + }; + + struct cryptd_queue { ++ /* ++ * Protected by disabling BH to allow enqueueing from softinterrupt and ++ * dequeuing from kworker (cryptd_queue_worker()). ++ */ + struct cryptd_cpu_queue __percpu *cpu_queue; + }; + +@@ -125,28 +129,28 @@ static void cryptd_fini_queue(struct cryptd_queue *queue) + static int cryptd_enqueue_request(struct cryptd_queue *queue, + struct crypto_async_request *request) + { +- int cpu, err; ++ int err; + struct cryptd_cpu_queue *cpu_queue; + refcount_t *refcnt; + +- cpu = get_cpu(); ++ local_bh_disable(); + cpu_queue = this_cpu_ptr(queue->cpu_queue); + err = crypto_enqueue_request(&cpu_queue->queue, request); + + refcnt = crypto_tfm_ctx(request->tfm); + + if (err == -ENOSPC) +- goto out_put_cpu; ++ goto out; + +- queue_work_on(cpu, cryptd_wq, &cpu_queue->work); ++ queue_work_on(smp_processor_id(), cryptd_wq, &cpu_queue->work); + + if (!refcount_read(refcnt)) +- goto out_put_cpu; ++ goto out; + + refcount_inc(refcnt); + +-out_put_cpu: +- put_cpu(); ++out: ++ local_bh_enable(); + + return err; + } +@@ -162,15 +166,10 @@ static void cryptd_queue_worker(struct work_struct *work) + cpu_queue = container_of(work, struct cryptd_cpu_queue, work); + /* + * Only handle one request at a time to avoid hogging crypto workqueue. +- * preempt_disable/enable is used to prevent being preempted by +- * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent +- * cryptd_enqueue_request() being accessed from software interrupts. + */ + local_bh_disable(); +- preempt_disable(); + backlog = crypto_get_backlog(&cpu_queue->queue); + req = crypto_dequeue_request(&cpu_queue->queue); +- preempt_enable(); + local_bh_enable(); + + if (!req) +-- +2.35.1 + diff --git a/queue-5.15/crypto-marvell-cesa-ecb-does-not-iv.patch b/queue-5.15/crypto-marvell-cesa-ecb-does-not-iv.patch new file mode 100644 index 00000000000..6a6b62bf6f8 --- /dev/null +++ b/queue-5.15/crypto-marvell-cesa-ecb-does-not-iv.patch @@ -0,0 +1,34 @@ +From 1dd1c39baa9c5f711d9997c50a0a35efcf304ab8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 19:11:54 +0000 +Subject: crypto: marvell/cesa - ECB does not IV + +From: Corentin Labbe + +[ Upstream commit 4ffa1763622ae5752961499588f3f8874315f974 ] + +The DES3 ECB has an IV size set but ECB does not need one. + +Fixes: 4ada483978237 ("crypto: marvell/cesa - add Triple-DES support") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/cesa/cipher.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c +index b739d3b873dc..c6f2fa753b7c 100644 +--- a/drivers/crypto/marvell/cesa/cipher.c ++++ b/drivers/crypto/marvell/cesa/cipher.c +@@ -624,7 +624,6 @@ struct skcipher_alg mv_cesa_ecb_des3_ede_alg = { + .decrypt = mv_cesa_ecb_des3_ede_decrypt, + .min_keysize = DES3_EDE_KEY_SIZE, + .max_keysize = DES3_EDE_KEY_SIZE, +- .ivsize = DES3_EDE_BLOCK_SIZE, + .base = { + .cra_name = "ecb(des3_ede)", + .cra_driver_name = "mv-ecb-des3-ede", +-- +2.35.1 + diff --git a/queue-5.15/crypto-qat-set-cipher-capability-for-dh895xcc.patch b/queue-5.15/crypto-qat-set-cipher-capability-for-dh895xcc.patch new file mode 100644 index 00000000000..140974207ad --- /dev/null +++ b/queue-5.15/crypto-qat-set-cipher-capability-for-dh895xcc.patch @@ -0,0 +1,57 @@ +From 069b1ff7c1f6a85e43463291ed93dab2d8c2ee86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 17:54:40 +0100 +Subject: crypto: qat - set CIPHER capability for DH895XCC + +From: Giovanni Cabiddu + +[ Upstream commit 6a23804cb8bcb85c6998bf193d94d4036db26f51 ] + +Set the CIPHER capability for QAT DH895XCC devices if the hardware supports +it. This is done if both the CIPHER and the AUTHENTICATION engines are +available on the device. + +Fixes: ad1332aa67ec ("crypto: qat - add support for capability detection") +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Marco Chiappero +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + .../crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +index a61ad6c93632..6499b9a2f38f 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +@@ -86,17 +86,23 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) + + capabilities = ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | + ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | +- ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ ICP_ACCEL_CAPABILITIES_AUTHENTICATION | ++ ICP_ACCEL_CAPABILITIES_CIPHER; + + /* Read accelerator capabilities mask */ + pci_read_config_dword(pdev, ADF_DEVICE_LEGFUSE_OFFSET, &legfuses); + +- if (legfuses & ICP_ACCEL_MASK_CIPHER_SLICE) ++ /* A set bit in legfuses means the feature is OFF in this SKU */ ++ if (legfuses & ICP_ACCEL_MASK_CIPHER_SLICE) { + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC; ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; ++ } + if (legfuses & ICP_ACCEL_MASK_PKE_SLICE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC; +- if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) ++ if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) { + capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; ++ } + if (legfuses & ICP_ACCEL_MASK_COMPRESS_SLICE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION; + +-- +2.35.1 + diff --git a/queue-5.15/crypto-qat-set-cipher-capability-for-qat-gen2.patch b/queue-5.15/crypto-qat-set-cipher-capability-for-qat-gen2.patch new file mode 100644 index 00000000000..016f4fc16b4 --- /dev/null +++ b/queue-5.15/crypto-qat-set-cipher-capability-for-qat-gen2.patch @@ -0,0 +1,57 @@ +From 4cea2d1dee8f56f3a0841326c4d59124adb8775c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Dec 2021 09:13:12 +0000 +Subject: crypto: qat - set CIPHER capability for QAT GEN2 + +From: Giovanni Cabiddu + +[ Upstream commit 547bde7bd4ecd78f36f98744e6c9a0999e52da5a ] + +Set the CIPHER capability for QAT GEN2 devices if the hardware supports +it. This is done if both the CIPHER and the AUTHENTICATION engines are +available on the device. + +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Marco Chiappero +Reviewed-by: Fiona Trahe +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_gen2_hw_data.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_gen2_hw_data.c b/drivers/crypto/qat/qat_common/adf_gen2_hw_data.c +index 9e560c7d4163..9c5871e1752a 100644 +--- a/drivers/crypto/qat/qat_common/adf_gen2_hw_data.c ++++ b/drivers/crypto/qat/qat_common/adf_gen2_hw_data.c +@@ -161,17 +161,23 @@ u32 adf_gen2_get_accel_cap(struct adf_accel_dev *accel_dev) + u32 legfuses; + u32 capabilities = ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | + ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | +- ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ ICP_ACCEL_CAPABILITIES_AUTHENTICATION | ++ ICP_ACCEL_CAPABILITIES_CIPHER; + + /* Read accelerator capabilities mask */ + pci_read_config_dword(pdev, ADF_DEVICE_LEGFUSE_OFFSET, &legfuses); + +- if (legfuses & ICP_ACCEL_MASK_CIPHER_SLICE) ++ /* A set bit in legfuses means the feature is OFF in this SKU */ ++ if (legfuses & ICP_ACCEL_MASK_CIPHER_SLICE) { + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC; ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; ++ } + if (legfuses & ICP_ACCEL_MASK_PKE_SLICE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC; +- if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) ++ if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) { + capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; ++ } + + if ((straps | fuses) & ADF_POWERGATE_PKE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC; +-- +2.35.1 + diff --git a/queue-5.15/crypto-qat-set-compression-capability-for-dh895xcc.patch b/queue-5.15/crypto-qat-set-compression-capability-for-dh895xcc.patch new file mode 100644 index 00000000000..9fd0a461d02 --- /dev/null +++ b/queue-5.15/crypto-qat-set-compression-capability-for-dh895xcc.patch @@ -0,0 +1,43 @@ +From dcce8d68e5c0c38d82cc0481c704f19e55144f83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 17:54:41 +0100 +Subject: crypto: qat - set COMPRESSION capability for DH895XCC + +From: Giovanni Cabiddu + +[ Upstream commit 0eaa51543273fd0f4ba9bea83638f7033436e5eb ] + +The capability detection logic clears bits for the features that are +disabled in a certain SKU. For example, if the bit associate to +compression is not present in the LEGFUSE register, the correspondent +bit is cleared in the capability mask. +This change adds the compression capability to the mask as this was +missing in the commit that enhanced the capability detection logic. + +Fixes: cfe4894eccdc ("crypto: qat - set COMPRESSION capability for QAT GEN2") +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Marco Chiappero +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +index 6499b9a2f38f..c2c73ee279b2 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +@@ -87,7 +87,8 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) + capabilities = ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | + ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | + ICP_ACCEL_CAPABILITIES_AUTHENTICATION | +- ICP_ACCEL_CAPABILITIES_CIPHER; ++ ICP_ACCEL_CAPABILITIES_CIPHER | ++ ICP_ACCEL_CAPABILITIES_COMPRESSION; + + /* Read accelerator capabilities mask */ + pci_read_config_dword(pdev, ADF_DEVICE_LEGFUSE_OFFSET, &legfuses); +-- +2.35.1 + diff --git a/queue-5.15/crypto-qat-set-compression-capability-for-qat-gen2.patch b/queue-5.15/crypto-qat-set-compression-capability-for-qat-gen2.patch new file mode 100644 index 00000000000..ec7b116d66b --- /dev/null +++ b/queue-5.15/crypto-qat-set-compression-capability-for-qat-gen2.patch @@ -0,0 +1,85 @@ +From 8da696f2a1f32b4acfc172c292690499c04261c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Dec 2021 09:13:13 +0000 +Subject: crypto: qat - set COMPRESSION capability for QAT GEN2 + +From: Giovanni Cabiddu + +[ Upstream commit cfe4894eccdc7fa5cd35bf34e918614d06ecce38 ] + +Enhance the device capability detection for QAT GEN2 devices to detect if +a device supports the compression service. + +This is done by checking both the fuse and the strap registers for c62x +and c3xxx and only the fuse register for dh895xcc. + +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Marco Chiappero +Reviewed-by: Fiona Trahe +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_gen2_hw_data.c | 8 +++++++- + drivers/crypto/qat/qat_common/adf_gen2_hw_data.h | 1 + + drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 2 ++ + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_gen2_hw_data.c b/drivers/crypto/qat/qat_common/adf_gen2_hw_data.c +index 9c5871e1752a..0ba62b286a85 100644 +--- a/drivers/crypto/qat/qat_common/adf_gen2_hw_data.c ++++ b/drivers/crypto/qat/qat_common/adf_gen2_hw_data.c +@@ -162,7 +162,8 @@ u32 adf_gen2_get_accel_cap(struct adf_accel_dev *accel_dev) + u32 capabilities = ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | + ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | + ICP_ACCEL_CAPABILITIES_AUTHENTICATION | +- ICP_ACCEL_CAPABILITIES_CIPHER; ++ ICP_ACCEL_CAPABILITIES_CIPHER | ++ ICP_ACCEL_CAPABILITIES_COMPRESSION; + + /* Read accelerator capabilities mask */ + pci_read_config_dword(pdev, ADF_DEVICE_LEGFUSE_OFFSET, &legfuses); +@@ -178,10 +179,15 @@ u32 adf_gen2_get_accel_cap(struct adf_accel_dev *accel_dev) + capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION; + capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; + } ++ if (legfuses & ICP_ACCEL_MASK_COMPRESS_SLICE) ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION; + + if ((straps | fuses) & ADF_POWERGATE_PKE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC; + ++ if ((straps | fuses) & ADF_POWERGATE_DC) ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION; ++ + return capabilities; + } + EXPORT_SYMBOL_GPL(adf_gen2_get_accel_cap); +diff --git a/drivers/crypto/qat/qat_common/adf_gen2_hw_data.h b/drivers/crypto/qat/qat_common/adf_gen2_hw_data.h +index 756b0ddfac5e..2aaf02ccbb3a 100644 +--- a/drivers/crypto/qat/qat_common/adf_gen2_hw_data.h ++++ b/drivers/crypto/qat/qat_common/adf_gen2_hw_data.h +@@ -111,6 +111,7 @@ do { \ + (ADF_ARB_REG_SLOT * (index)), value) + + /* Power gating */ ++#define ADF_POWERGATE_DC BIT(23) + #define ADF_POWERGATE_PKE BIT(24) + + /* WDT timers +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +index 0a9ce365a544..a61ad6c93632 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +@@ -97,6 +97,8 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC; + if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ if (legfuses & ICP_ACCEL_MASK_COMPRESS_SLICE) ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION; + + return capabilities; + } +-- +2.35.1 + diff --git a/queue-5.15/crypto-sun8i-ss-handle-zero-sized-sg.patch b/queue-5.15/crypto-sun8i-ss-handle-zero-sized-sg.patch new file mode 100644 index 00000000000..4bfd60a1b1e --- /dev/null +++ b/queue-5.15/crypto-sun8i-ss-handle-zero-sized-sg.patch @@ -0,0 +1,49 @@ +From 3060c9ea8d3e05b61402a56c9509302df6c55324 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 20:19:15 +0000 +Subject: crypto: sun8i-ss - handle zero sized sg + +From: Corentin Labbe + +[ Upstream commit c149e4763d28bb4c0e5daae8a59f2c74e889f407 ] + +sun8i-ss does not handle well the possible zero sized sg. + +Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +index 1a71ed49d233..ca4f280af35d 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +@@ -380,13 +380,21 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq) + } + + len = areq->nbytes; +- for_each_sg(areq->src, sg, nr_sgs, i) { ++ sg = areq->src; ++ i = 0; ++ while (len > 0 && sg) { ++ if (sg_dma_len(sg) == 0) { ++ sg = sg_next(sg); ++ continue; ++ } + rctx->t_src[i].addr = sg_dma_address(sg); + todo = min(len, sg_dma_len(sg)); + rctx->t_src[i].len = todo / 4; + len -= todo; + rctx->t_dst[i].addr = addr_res; + rctx->t_dst[i].len = digestsize / 4; ++ sg = sg_next(sg); ++ i++; + } + if (len > 0) { + dev_err(ss->dev, "remaining len %d\n", len); +-- +2.35.1 + diff --git a/queue-5.15/crypto-sun8i-ss-rework-handling-of-iv.patch b/queue-5.15/crypto-sun8i-ss-rework-handling-of-iv.patch new file mode 100644 index 00000000000..297a86c2c08 --- /dev/null +++ b/queue-5.15/crypto-sun8i-ss-rework-handling-of-iv.patch @@ -0,0 +1,296 @@ +From 15ea97f29175d99d822c52d51a95196a4dd77572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 20:19:14 +0000 +Subject: crypto: sun8i-ss - rework handling of IV + +From: Corentin Labbe + +[ Upstream commit 359e893e8af456be2fefabe851716237df289cbf ] + +sun8i-ss fail handling IVs when doing decryption of multiple SGs in-place. +It should backup the last block of each SG source for using it later as +IVs. +In the same time remove allocation on requests path for storing all +IVs. + +Fixes: f08fcced6d00 ("crypto: allwinner - Add sun8i-ss cryptographic offloader") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 115 ++++++++++++------ + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 30 +++-- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 14 ++- + 3 files changed, 107 insertions(+), 52 deletions(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +index 554e400d41ca..70e2e6e37389 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +@@ -93,6 +93,68 @@ static int sun8i_ss_cipher_fallback(struct skcipher_request *areq) + return err; + } + ++static int sun8i_ss_setup_ivs(struct skcipher_request *areq) ++{ ++ struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(areq); ++ struct sun8i_cipher_tfm_ctx *op = crypto_skcipher_ctx(tfm); ++ struct sun8i_ss_dev *ss = op->ss; ++ struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(areq); ++ struct scatterlist *sg = areq->src; ++ unsigned int todo, offset; ++ unsigned int len = areq->cryptlen; ++ unsigned int ivsize = crypto_skcipher_ivsize(tfm); ++ struct sun8i_ss_flow *sf = &ss->flows[rctx->flow]; ++ int i = 0; ++ u32 a; ++ int err; ++ ++ rctx->ivlen = ivsize; ++ if (rctx->op_dir & SS_DECRYPTION) { ++ offset = areq->cryptlen - ivsize; ++ scatterwalk_map_and_copy(sf->biv, areq->src, offset, ++ ivsize, 0); ++ } ++ ++ /* we need to copy all IVs from source in case DMA is bi-directionnal */ ++ while (sg && len) { ++ if (sg_dma_len(sg) == 0) { ++ sg = sg_next(sg); ++ continue; ++ } ++ if (i == 0) ++ memcpy(sf->iv[0], areq->iv, ivsize); ++ a = dma_map_single(ss->dev, sf->iv[i], ivsize, DMA_TO_DEVICE); ++ if (dma_mapping_error(ss->dev, a)) { ++ memzero_explicit(sf->iv[i], ivsize); ++ dev_err(ss->dev, "Cannot DMA MAP IV\n"); ++ err = -EFAULT; ++ goto dma_iv_error; ++ } ++ rctx->p_iv[i] = a; ++ /* we need to setup all others IVs only in the decrypt way */ ++ if (rctx->op_dir & SS_ENCRYPTION) ++ return 0; ++ todo = min(len, sg_dma_len(sg)); ++ len -= todo; ++ i++; ++ if (i < MAX_SG) { ++ offset = sg->length - ivsize; ++ scatterwalk_map_and_copy(sf->iv[i], sg, offset, ivsize, 0); ++ } ++ rctx->niv = i; ++ sg = sg_next(sg); ++ } ++ ++ return 0; ++dma_iv_error: ++ i--; ++ while (i >= 0) { ++ dma_unmap_single(ss->dev, rctx->p_iv[i], ivsize, DMA_TO_DEVICE); ++ memzero_explicit(sf->iv[i], ivsize); ++ } ++ return err; ++} ++ + static int sun8i_ss_cipher(struct skcipher_request *areq) + { + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(areq); +@@ -101,9 +163,9 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(areq); + struct skcipher_alg *alg = crypto_skcipher_alg(tfm); + struct sun8i_ss_alg_template *algt; ++ struct sun8i_ss_flow *sf = &ss->flows[rctx->flow]; + struct scatterlist *sg; + unsigned int todo, len, offset, ivsize; +- void *backup_iv = NULL; + int nr_sgs = 0; + int nr_sgd = 0; + int err = 0; +@@ -134,30 +196,9 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + + ivsize = crypto_skcipher_ivsize(tfm); + if (areq->iv && crypto_skcipher_ivsize(tfm) > 0) { +- rctx->ivlen = ivsize; +- rctx->biv = kzalloc(ivsize, GFP_KERNEL | GFP_DMA); +- if (!rctx->biv) { +- err = -ENOMEM; ++ err = sun8i_ss_setup_ivs(areq); ++ if (err) + goto theend_key; +- } +- if (rctx->op_dir & SS_DECRYPTION) { +- backup_iv = kzalloc(ivsize, GFP_KERNEL); +- if (!backup_iv) { +- err = -ENOMEM; +- goto theend_key; +- } +- offset = areq->cryptlen - ivsize; +- scatterwalk_map_and_copy(backup_iv, areq->src, offset, +- ivsize, 0); +- } +- memcpy(rctx->biv, areq->iv, ivsize); +- rctx->p_iv = dma_map_single(ss->dev, rctx->biv, rctx->ivlen, +- DMA_TO_DEVICE); +- if (dma_mapping_error(ss->dev, rctx->p_iv)) { +- dev_err(ss->dev, "Cannot DMA MAP IV\n"); +- err = -ENOMEM; +- goto theend_iv; +- } + } + if (areq->src == areq->dst) { + nr_sgs = dma_map_sg(ss->dev, areq->src, sg_nents(areq->src), +@@ -243,21 +284,19 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + } + + theend_iv: +- if (rctx->p_iv) +- dma_unmap_single(ss->dev, rctx->p_iv, rctx->ivlen, +- DMA_TO_DEVICE); +- + if (areq->iv && ivsize > 0) { +- if (rctx->biv) { +- offset = areq->cryptlen - ivsize; +- if (rctx->op_dir & SS_DECRYPTION) { +- memcpy(areq->iv, backup_iv, ivsize); +- kfree_sensitive(backup_iv); +- } else { +- scatterwalk_map_and_copy(areq->iv, areq->dst, offset, +- ivsize, 0); +- } +- kfree(rctx->biv); ++ for (i = 0; i < rctx->niv; i++) { ++ dma_unmap_single(ss->dev, rctx->p_iv[i], ivsize, DMA_TO_DEVICE); ++ memzero_explicit(sf->iv[i], ivsize); ++ } ++ ++ offset = areq->cryptlen - ivsize; ++ if (rctx->op_dir & SS_DECRYPTION) { ++ memcpy(areq->iv, sf->biv, ivsize); ++ memzero_explicit(sf->biv, ivsize); ++ } else { ++ scatterwalk_map_and_copy(areq->iv, areq->dst, offset, ++ ivsize, 0); + } + } + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +index 319fe3279a71..657530578643 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +@@ -66,6 +66,7 @@ int sun8i_ss_run_task(struct sun8i_ss_dev *ss, struct sun8i_cipher_req_ctx *rctx + const char *name) + { + int flow = rctx->flow; ++ unsigned int ivlen = rctx->ivlen; + u32 v = SS_START; + int i; + +@@ -104,15 +105,14 @@ int sun8i_ss_run_task(struct sun8i_ss_dev *ss, struct sun8i_cipher_req_ctx *rctx + mutex_lock(&ss->mlock); + writel(rctx->p_key, ss->base + SS_KEY_ADR_REG); + +- if (i == 0) { +- if (rctx->p_iv) +- writel(rctx->p_iv, ss->base + SS_IV_ADR_REG); +- } else { +- if (rctx->biv) { +- if (rctx->op_dir == SS_ENCRYPTION) +- writel(rctx->t_dst[i - 1].addr + rctx->t_dst[i - 1].len * 4 - rctx->ivlen, ss->base + SS_IV_ADR_REG); ++ if (ivlen) { ++ if (rctx->op_dir == SS_ENCRYPTION) { ++ if (i == 0) ++ writel(rctx->p_iv[0], ss->base + SS_IV_ADR_REG); + else +- writel(rctx->t_src[i - 1].addr + rctx->t_src[i - 1].len * 4 - rctx->ivlen, ss->base + SS_IV_ADR_REG); ++ writel(rctx->t_dst[i - 1].addr + rctx->t_dst[i - 1].len * 4 - ivlen, ss->base + SS_IV_ADR_REG); ++ } else { ++ writel(rctx->p_iv[i], ss->base + SS_IV_ADR_REG); + } + } + +@@ -464,7 +464,7 @@ static void sun8i_ss_free_flows(struct sun8i_ss_dev *ss, int i) + */ + static int allocate_flows(struct sun8i_ss_dev *ss) + { +- int i, err; ++ int i, j, err; + + ss->flows = devm_kcalloc(ss->dev, MAXFLOW, sizeof(struct sun8i_ss_flow), + GFP_KERNEL); +@@ -474,6 +474,18 @@ static int allocate_flows(struct sun8i_ss_dev *ss) + for (i = 0; i < MAXFLOW; i++) { + init_completion(&ss->flows[i].complete); + ++ ss->flows[i].biv = devm_kmalloc(ss->dev, AES_BLOCK_SIZE, ++ GFP_KERNEL | GFP_DMA); ++ if (!ss->flows[i].biv) ++ goto error_engine; ++ ++ for (j = 0; j < MAX_SG; j++) { ++ ss->flows[i].iv[j] = devm_kmalloc(ss->dev, AES_BLOCK_SIZE, ++ GFP_KERNEL | GFP_DMA); ++ if (!ss->flows[i].iv[j]) ++ goto error_engine; ++ } ++ + ss->flows[i].engine = crypto_engine_alloc_init(ss->dev, true); + if (!ss->flows[i].engine) { + dev_err(ss->dev, "Cannot allocate engine\n"); +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h +index 28188685b910..57ada8653855 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h +@@ -121,11 +121,15 @@ struct sginfo { + * @complete: completion for the current task on this flow + * @status: set to 1 by interrupt if task is done + * @stat_req: number of request done by this flow ++ * @iv: list of IV to use for each step ++ * @biv: buffer which contain the backuped IV + */ + struct sun8i_ss_flow { + struct crypto_engine *engine; + struct completion complete; + int status; ++ u8 *iv[MAX_SG]; ++ u8 *biv; + #ifdef CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG + unsigned long stat_req; + #endif +@@ -164,28 +168,28 @@ struct sun8i_ss_dev { + * @t_src: list of mapped SGs with their size + * @t_dst: list of mapped SGs with their size + * @p_key: DMA address of the key +- * @p_iv: DMA address of the IV ++ * @p_iv: DMA address of the IVs ++ * @niv: Number of IVs DMA mapped + * @method: current algorithm for this request + * @op_mode: op_mode for this request + * @op_dir: direction (encrypt vs decrypt) for this request + * @flow: the flow to use for this request +- * @ivlen: size of biv ++ * @ivlen: size of IVs + * @keylen: keylen for this request +- * @biv: buffer which contain the IV + * @fallback_req: request struct for invoking the fallback skcipher TFM + */ + struct sun8i_cipher_req_ctx { + struct sginfo t_src[MAX_SG]; + struct sginfo t_dst[MAX_SG]; + u32 p_key; +- u32 p_iv; ++ u32 p_iv[MAX_SG]; ++ int niv; + u32 method; + u32 op_mode; + u32 op_dir; + int flow; + unsigned int ivlen; + unsigned int keylen; +- void *biv; + struct skcipher_request fallback_req; // keep at the end + }; + +-- +2.35.1 + diff --git a/queue-5.15/dax-fix-cache-flush-on-pmd-mapped-pages.patch b/queue-5.15/dax-fix-cache-flush-on-pmd-mapped-pages.patch new file mode 100644 index 00000000000..72e194c49d7 --- /dev/null +++ b/queue-5.15/dax-fix-cache-flush-on-pmd-mapped-pages.patch @@ -0,0 +1,58 @@ +From ffc411faa88603ca6845f20bbc6fe68422c105e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:09 -0700 +Subject: dax: fix cache flush on PMD-mapped pages + +From: Muchun Song + +[ Upstream commit e583b5c472bd23d450e06f148dc1f37be74f7666 ] + +The flush_cache_page() only remove a PAGE_SIZE sized range from the cache. +However, it does not cover the full pages in a THP except a head page. +Replace it with flush_cache_range() to fix this issue. This is just a +documentation issue with the respect to properly documenting the expected +usage of cache flushing before modifying the pmd. However, in practice +this is not a problem due to the fact that DAX is not available on +architectures with virtually indexed caches per: + + commit d92576f1167c ("dax: does not work correctly with virtual aliasing caches") + +Link: https://lkml.kernel.org/r/20220403053957.10770-3-songmuchun@bytedance.com +Fixes: f729c8c9b24f ("dax: wrprotect pmd_t in dax_mapping_entry_mkclean") +Signed-off-by: Muchun Song +Reviewed-by: Dan Williams +Reviewed-by: Christoph Hellwig +Cc: Alistair Popple +Cc: Al Viro +Cc: Hugh Dickins +Cc: Jan Kara +Cc: "Kirill A. Shutemov" +Cc: Matthew Wilcox +Cc: Ralph Campbell +Cc: Ross Zwisler +Cc: Xiongchun Duan +Cc: Xiyu Yang +Cc: Yang Shi +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/dax.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 4e3e5a283a91..1d0658cf9dcf 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -846,7 +846,8 @@ static void dax_entry_mkclean(struct address_space *mapping, pgoff_t index, + if (!pmd_dirty(*pmdp) && !pmd_write(*pmdp)) + goto unlock_pmd; + +- flush_cache_page(vma, address, pfn); ++ flush_cache_range(vma, address, ++ address + HPAGE_PMD_SIZE); + pmd = pmdp_invalidate(vma, address, pmdp); + pmd = pmd_wrprotect(pmd); + pmd = pmd_mkclean(pmd); +-- +2.35.1 + diff --git a/queue-5.15/device-property-allow-error-pointer-to-be-passed-to-.patch b/queue-5.15/device-property-allow-error-pointer-to-be-passed-to-.patch new file mode 100644 index 00000000000..0a5fc0b9edc --- /dev/null +++ b/queue-5.15/device-property-allow-error-pointer-to-be-passed-to-.patch @@ -0,0 +1,261 @@ +From c319dfb6bd5689e096253c1e4656981b43a31e80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 21:48:40 +0300 +Subject: device property: Allow error pointer to be passed to fwnode APIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 002752af7b89b74c64fe6bec8c5fde3d3a7810d8 ] + +Some of the fwnode APIs might return an error pointer instead of NULL +or valid fwnode handle. The result of such API call may be considered +optional and hence the test for it is usually done in a form of + + fwnode = fwnode_find_reference(...); + if (IS_ERR(fwnode)) + ...error handling... + +Nevertheless the resulting fwnode may have bumped the reference count +and hence caller of the above API is obliged to call fwnode_handle_put(). +Since fwnode may be not valid either as NULL or error pointer the check +has to be performed there. This approach uglifies the code and adds +a point of making a mistake, i.e. forgetting about error point case. + +To prevent this, allow an error pointer to be passed to the fwnode APIs. + +Fixes: 83b34afb6b79 ("device property: Introduce fwnode_find_reference()") +Reported-by: Nuno Sá +Tested-by: Nuno Sá +Acked-by: Nuno Sá +Reviewed-by: Sakari Ailus +Reviewed-by: Heikki Krogerus +Signed-off-by: Andy Shevchenko +Tested-by: Michael Walle +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 89 +++++++++++++++++++++++------------------ + include/linux/fwnode.h | 10 ++--- + 2 files changed, 56 insertions(+), 43 deletions(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index c29fa92be1fd..735a23db1b5e 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -48,12 +48,14 @@ bool fwnode_property_present(const struct fwnode_handle *fwnode, + { + bool ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return false; ++ + ret = fwnode_call_bool_op(fwnode, property_present, propname); +- if (ret == false && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_bool_op(fwnode->secondary, property_present, +- propname); +- return ret; ++ if (ret) ++ return ret; ++ ++ return fwnode_call_bool_op(fwnode->secondary, property_present, propname); + } + EXPORT_SYMBOL_GPL(fwnode_property_present); + +@@ -233,15 +235,16 @@ static int fwnode_property_read_int_array(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -EINVAL; ++ + ret = fwnode_call_int_op(fwnode, property_read_int_array, propname, + elem_size, val, nval); +- if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op( +- fwnode->secondary, property_read_int_array, propname, +- elem_size, val, nval); ++ if (ret != -EINVAL) ++ return ret; + +- return ret; ++ return fwnode_call_int_op(fwnode->secondary, property_read_int_array, propname, ++ elem_size, val, nval); + } + + /** +@@ -372,14 +375,16 @@ int fwnode_property_read_string_array(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -EINVAL; ++ + ret = fwnode_call_int_op(fwnode, property_read_string_array, propname, + val, nval); +- if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op(fwnode->secondary, +- property_read_string_array, propname, +- val, nval); +- return ret; ++ if (ret != -EINVAL) ++ return ret; ++ ++ return fwnode_call_int_op(fwnode->secondary, property_read_string_array, propname, ++ val, nval); + } + EXPORT_SYMBOL_GPL(fwnode_property_read_string_array); + +@@ -481,15 +486,19 @@ int fwnode_property_get_reference_args(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -ENOENT; ++ + ret = fwnode_call_int_op(fwnode, get_reference_args, prop, nargs_prop, + nargs, index, args); ++ if (ret == 0) ++ return ret; + +- if (ret < 0 && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op(fwnode->secondary, get_reference_args, +- prop, nargs_prop, nargs, index, args); ++ if (IS_ERR_OR_NULL(fwnode->secondary)) ++ return ret; + +- return ret; ++ return fwnode_call_int_op(fwnode->secondary, get_reference_args, prop, nargs_prop, ++ nargs, index, args); + } + EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args); + +@@ -684,12 +693,13 @@ EXPORT_SYMBOL_GPL(fwnode_count_parents); + struct fwnode_handle *fwnode_get_nth_parent(struct fwnode_handle *fwnode, + unsigned int depth) + { +- unsigned int i; +- + fwnode_handle_get(fwnode); + +- for (i = 0; i < depth && fwnode; i++) ++ do { ++ if (depth-- == 0) ++ break; + fwnode = fwnode_get_next_parent(fwnode); ++ } while (fwnode); + + return fwnode; + } +@@ -708,17 +718,17 @@ EXPORT_SYMBOL_GPL(fwnode_get_nth_parent); + bool fwnode_is_ancestor_of(struct fwnode_handle *test_ancestor, + struct fwnode_handle *test_child) + { +- if (!test_ancestor) ++ if (IS_ERR_OR_NULL(test_ancestor)) + return false; + + fwnode_handle_get(test_child); +- while (test_child) { ++ do { + if (test_child == test_ancestor) { + fwnode_handle_put(test_child); + return true; + } + test_child = fwnode_get_next_parent(test_child); +- } ++ } while (test_child); + return false; + } + +@@ -747,7 +757,7 @@ fwnode_get_next_available_child_node(const struct fwnode_handle *fwnode, + { + struct fwnode_handle *next_child = child; + +- if (!fwnode) ++ if (IS_ERR_OR_NULL(fwnode)) + return NULL; + + do { +@@ -771,16 +781,16 @@ struct fwnode_handle *device_get_next_child_node(struct device *dev, + const struct fwnode_handle *fwnode = dev_fwnode(dev); + struct fwnode_handle *next; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return NULL; ++ + /* Try to find a child in primary fwnode */ + next = fwnode_get_next_child_node(fwnode, child); + if (next) + return next; + + /* When no more children in primary, continue with secondary */ +- if (fwnode && !IS_ERR_OR_NULL(fwnode->secondary)) +- next = fwnode_get_next_child_node(fwnode->secondary, child); +- +- return next; ++ return fwnode_get_next_child_node(fwnode->secondary, child); + } + EXPORT_SYMBOL_GPL(device_get_next_child_node); + +@@ -847,6 +857,9 @@ EXPORT_SYMBOL_GPL(fwnode_handle_put); + */ + bool fwnode_device_is_available(const struct fwnode_handle *fwnode) + { ++ if (IS_ERR_OR_NULL(fwnode)) ++ return false; ++ + if (!fwnode_has_op(fwnode, device_is_available)) + return true; + +@@ -1054,14 +1067,14 @@ fwnode_graph_get_next_endpoint(const struct fwnode_handle *fwnode, + parent = fwnode_graph_get_port_parent(prev); + else + parent = fwnode; ++ if (IS_ERR_OR_NULL(parent)) ++ return NULL; + + ep = fwnode_call_ptr_op(parent, graph_get_next_endpoint, prev); ++ if (ep) ++ return ep; + +- if (IS_ERR_OR_NULL(ep) && +- !IS_ERR_OR_NULL(parent) && !IS_ERR_OR_NULL(parent->secondary)) +- ep = fwnode_graph_get_next_endpoint(parent->secondary, NULL); +- +- return ep; ++ return fwnode_graph_get_next_endpoint(parent->secondary, NULL); + } + EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint); + +diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h +index 9f4ad719bfe3..2d68606fb725 100644 +--- a/include/linux/fwnode.h ++++ b/include/linux/fwnode.h +@@ -147,12 +147,12 @@ struct fwnode_operations { + int (*add_links)(struct fwnode_handle *fwnode); + }; + +-#define fwnode_has_op(fwnode, op) \ +- ((fwnode) && (fwnode)->ops && (fwnode)->ops->op) ++#define fwnode_has_op(fwnode, op) \ ++ (!IS_ERR_OR_NULL(fwnode) && (fwnode)->ops && (fwnode)->ops->op) ++ + #define fwnode_call_int_op(fwnode, op, ...) \ +- (fwnode ? (fwnode_has_op(fwnode, op) ? \ +- (fwnode)->ops->op(fwnode, ## __VA_ARGS__) : -ENXIO) : \ +- -EINVAL) ++ (fwnode_has_op(fwnode, op) ? \ ++ (fwnode)->ops->op(fwnode, ## __VA_ARGS__) : (IS_ERR_OR_NULL(fwnode) ? -EINVAL : -ENXIO)) + + #define fwnode_call_bool_op(fwnode, op, ...) \ + (fwnode_has_op(fwnode, op) ? \ +-- +2.35.1 + diff --git a/queue-5.15/device-property-check-fwnode-secondary-when-finding-.patch b/queue-5.15/device-property-check-fwnode-secondary-when-finding-.patch new file mode 100644 index 00000000000..c7b22cb6944 --- /dev/null +++ b/queue-5.15/device-property-check-fwnode-secondary-when-finding-.patch @@ -0,0 +1,51 @@ +From 2bf1c321b43d74576804ce13825e926f3f67c6e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Nov 2021 23:24:55 +0000 +Subject: device property: Check fwnode->secondary when finding properties + +From: Daniel Scally + +[ Upstream commit c097af1d0a8483b44fa30e86b311991d76b6ae67 ] + +fwnode_property_get_reference_args() searches for named properties +against a fwnode_handle, but these could instead be against the fwnode's +secondary. If the property isn't found against the primary, check the +secondary to see if it's there instead. + +Reviewed-by: Andy Shevchenko +Reviewed-by: Hans de Goede +Signed-off-by: Daniel Scally +Link: https://lore.kernel.org/r/20211128232455.39332-1-djrscally@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index 4c77837769c6..c29fa92be1fd 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -479,8 +479,17 @@ int fwnode_property_get_reference_args(const struct fwnode_handle *fwnode, + unsigned int nargs, unsigned int index, + struct fwnode_reference_args *args) + { +- return fwnode_call_int_op(fwnode, get_reference_args, prop, nargs_prop, +- nargs, index, args); ++ int ret; ++ ++ ret = fwnode_call_int_op(fwnode, get_reference_args, prop, nargs_prop, ++ nargs, index, args); ++ ++ if (ret < 0 && !IS_ERR_OR_NULL(fwnode) && ++ !IS_ERR_OR_NULL(fwnode->secondary)) ++ ret = fwnode_call_int_op(fwnode->secondary, get_reference_args, ++ prop, nargs_prop, nargs, index, args); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args); + +-- +2.35.1 + diff --git a/queue-5.15/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch b/queue-5.15/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch new file mode 100644 index 00000000000..0b7c7bfa539 --- /dev/null +++ b/queue-5.15/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch @@ -0,0 +1,41 @@ +From 82cf6f7e2eb232518ac065e7ceff00f06100a608 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 13:17:32 -0400 +Subject: dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC + +From: Mikulas Patocka + +[ Upstream commit 84bc4f1dbbbb5f8aa68706a96711dccb28b518e5 ] + +We observed the error "cacheline tracking ENOMEM, dma-debug disabled" +during a light system load (copying some files). The reason for this error +is that the dma_active_cacheline radix tree uses GFP_NOWAIT allocation - +so it can't access the emergency memory reserves and it fails as soon as +anybody reaches the watermark. + +This patch changes GFP_NOWAIT to GFP_ATOMIC, so that it can access the +emergency memory reserves. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index f8ff598596b8..ac740630c79c 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -448,7 +448,7 @@ void debug_dma_dump_mappings(struct device *dev) + * other hand, consumes a single dma_debug_entry, but inserts 'nents' + * entries into the tree. + */ +-static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT); ++static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC); + static DEFINE_SPINLOCK(radix_lock); + #define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1) + #define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT) +-- +2.35.1 + diff --git a/queue-5.15/dma-direct-always-leak-memory-that-can-t-be-re-encry.patch b/queue-5.15/dma-direct-always-leak-memory-that-can-t-be-re-encry.patch new file mode 100644 index 00000000000..84aedd1d00a --- /dev/null +++ b/queue-5.15/dma-direct-always-leak-memory-that-can-t-be-re-encry.patch @@ -0,0 +1,71 @@ +From 20570eff45076825f37bdd187cbc71750a4f5676 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Nov 2021 15:41:01 +0100 +Subject: dma-direct: always leak memory that can't be re-encrypted + +From: Christoph Hellwig + +[ Upstream commit a90cf30437489343b8386ae87b4827b6d6c3ed50 ] + +We must never let unencrypted memory go back into the general page pool. +So if we fail to set it back to encrypted when freeing DMA memory, leak +the memory instead and warn the user. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Robin Murphy +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 473964620773..8e24455dd236 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -84,9 +84,14 @@ static int dma_set_decrypted(struct device *dev, void *vaddr, size_t size) + + static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size) + { ++ int ret; ++ + if (!force_dma_unencrypted(dev)) + return 0; +- return set_memory_encrypted((unsigned long)vaddr, 1 << get_order(size)); ++ ret = set_memory_encrypted((unsigned long)vaddr, 1 << get_order(size)); ++ if (ret) ++ pr_warn_ratelimited("leaking DMA memory that can't be re-encrypted\n"); ++ return ret; + } + + static void __dma_direct_free_pages(struct device *dev, struct page *page, +@@ -273,7 +278,6 @@ void *dma_direct_alloc(struct device *dev, size_t size, + return ret; + + out_encrypt_pages: +- /* If memory cannot be re-encrypted, it must be leaked */ + if (dma_set_encrypted(dev, page_address(page), size)) + return NULL; + out_free_pages: +@@ -319,7 +323,8 @@ void dma_direct_free(struct device *dev, size_t size, + } else { + if (IS_ENABLED(CONFIG_ARCH_HAS_DMA_CLEAR_UNCACHED)) + arch_dma_clear_uncached(cpu_addr, size); +- dma_set_encrypted(dev, cpu_addr, 1 << page_order); ++ if (dma_set_encrypted(dev, cpu_addr, 1 << page_order)) ++ return; + } + + __dma_direct_free_pages(dev, dma_direct_to_page(dev, dma_addr), size); +@@ -363,7 +368,8 @@ void dma_direct_free_pages(struct device *dev, size_t size, + dma_free_from_pool(dev, vaddr, size)) + return; + +- dma_set_encrypted(dev, vaddr, 1 << page_order); ++ if (dma_set_encrypted(dev, vaddr, 1 << page_order)) ++ return; + __dma_direct_free_pages(dev, page, size); + } + +-- +2.35.1 + diff --git a/queue-5.15/dma-direct-don-t-call-dma_set_decrypted-for-remapped.patch b/queue-5.15/dma-direct-don-t-call-dma_set_decrypted-for-remapped.patch new file mode 100644 index 00000000000..11ab9aad9ea --- /dev/null +++ b/queue-5.15/dma-direct-don-t-call-dma_set_decrypted-for-remapped.patch @@ -0,0 +1,55 @@ +From 753c322cfdf6904a64af70e5b1e5fcf187a74023 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Oct 2021 09:20:39 +0200 +Subject: dma-direct: don't call dma_set_decrypted for remapped allocations + +From: Christoph Hellwig + +[ Upstream commit 5570449b6876f215d49ac4db9ccce6ff7aa1e20a ] + +Remapped allocations handle the encrypted bit through the pgprot passed +to vmap, so there is no call dma_set_decrypted. Note that this case is +currently entirely theoretical as no valid kernel configuration supports +remapped allocations and memory encryption currently. + +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index b9513fd68239..473964620773 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -241,8 +241,6 @@ void *dma_direct_alloc(struct device *dev, size_t size, + __builtin_return_address(0)); + if (!ret) + goto out_free_pages; +- if (dma_set_decrypted(dev, ret, size)) +- goto out_free_pages; + memset(ret, 0, size); + goto done; + } +@@ -316,12 +314,13 @@ void dma_direct_free(struct device *dev, size_t size, + dma_free_from_pool(dev, cpu_addr, PAGE_ALIGN(size))) + return; + +- dma_set_encrypted(dev, cpu_addr, 1 << page_order); +- +- if (IS_ENABLED(CONFIG_DMA_REMAP) && is_vmalloc_addr(cpu_addr)) ++ if (IS_ENABLED(CONFIG_DMA_REMAP) && is_vmalloc_addr(cpu_addr)) { + vunmap(cpu_addr); +- else if (IS_ENABLED(CONFIG_ARCH_HAS_DMA_CLEAR_UNCACHED)) +- arch_dma_clear_uncached(cpu_addr, size); ++ } else { ++ if (IS_ENABLED(CONFIG_ARCH_HAS_DMA_CLEAR_UNCACHED)) ++ arch_dma_clear_uncached(cpu_addr, size); ++ dma_set_encrypted(dev, cpu_addr, 1 << page_order); ++ } + + __dma_direct_free_pages(dev, dma_direct_to_page(dev, dma_addr), size); + } +-- +2.35.1 + diff --git a/queue-5.15/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch b/queue-5.15/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch new file mode 100644 index 00000000000..8c141e3ec10 --- /dev/null +++ b/queue-5.15/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch @@ -0,0 +1,93 @@ +From c4ef1bbb5af8d1cb9b02fd856218ae17eae9dfeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 19:20:24 +0200 +Subject: dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages + +From: Christoph Hellwig + +[ Upstream commit 92826e967535db2eb117db227b1191aaf98e4bb3 ] + +When dma_direct_alloc_pages encounters a highmem page it just gives up +currently. But what we really should do is to try memory using the +page allocator instead - without this platforms with a global highmem +CMA pool will fail all dma_alloc_pages allocations. + +Fixes: efa70f2fdc84 ("dma-mapping: add a new dma_alloc_pages API") +Reported-by: Mark O'Neill +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 27 ++++++++++----------------- + 1 file changed, 10 insertions(+), 17 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index ddaac01f2cba..a1573ed2ea18 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -85,7 +85,7 @@ static void __dma_direct_free_pages(struct device *dev, struct page *page, + } + + static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, +- gfp_t gfp) ++ gfp_t gfp, bool allow_highmem) + { + int node = dev_to_node(dev); + struct page *page = NULL; +@@ -106,9 +106,12 @@ static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, + } + + page = dma_alloc_contiguous(dev, size, gfp); +- if (page && !dma_coherent_ok(dev, page_to_phys(page), size)) { +- dma_free_contiguous(dev, page, size); +- page = NULL; ++ if (page) { ++ if (!dma_coherent_ok(dev, page_to_phys(page), size) || ++ (!allow_highmem && PageHighMem(page))) { ++ dma_free_contiguous(dev, page, size); ++ page = NULL; ++ } + } + again: + if (!page) +@@ -154,7 +157,7 @@ static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size, + { + struct page *page; + +- page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO); ++ page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true); + if (!page) + return NULL; + +@@ -209,7 +212,7 @@ void *dma_direct_alloc(struct device *dev, size_t size, + return dma_direct_alloc_from_pool(dev, size, dma_handle, gfp); + + /* we always manually zero the memory once we are done */ +- page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO); ++ page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true); + if (!page) + return NULL; + +@@ -335,19 +338,9 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, + !is_swiotlb_for_alloc(dev)) + return dma_direct_alloc_from_pool(dev, size, dma_handle, gfp); + +- page = __dma_direct_alloc_pages(dev, size, gfp); ++ page = __dma_direct_alloc_pages(dev, size, gfp, false); + if (!page) + return NULL; +- if (PageHighMem(page)) { +- /* +- * Depending on the cma= arguments and per-arch setup +- * dma_alloc_contiguous could return highmem pages. +- * Without remapping there is no way to return them here, +- * so log an error and fail. +- */ +- dev_info(dev, "Rejecting highmem page from CMA.\n"); +- goto out_free_pages; +- } + + ret = page_address(page); + if (force_dma_unencrypted(dev)) { +-- +2.35.1 + diff --git a/queue-5.15/dma-direct-don-t-over-decrypt-memory.patch b/queue-5.15/dma-direct-don-t-over-decrypt-memory.patch new file mode 100644 index 00000000000..6a82265124d --- /dev/null +++ b/queue-5.15/dma-direct-don-t-over-decrypt-memory.patch @@ -0,0 +1,56 @@ +From 709f3ed9c92dd88a74c8868a3c312fa34dc1f180 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 18:10:13 +0100 +Subject: dma-direct: don't over-decrypt memory + +From: Robin Murphy + +[ Upstream commit 4a37f3dd9a83186cb88d44808ab35b78375082c9 ] + +The original x86 sev_alloc() only called set_memory_decrypted() on +memory returned by alloc_pages_node(), so the page order calculation +fell out of that logic. However, the common dma-direct code has several +potential allocators, not all of which are guaranteed to round up the +underlying allocation to a power-of-two size, so carrying over that +calculation for the encryption/decryption size was a mistake. Fix it by +rounding to a *number* of pages, rather than an order. + +Until recently there was an even worse interaction with DMA_DIRECT_REMAP +where we could have ended up decrypting part of the next adjacent +vmalloc area, only averted by no architecture actually supporting both +configs at once. Don't ask how I found that one out... + +Fixes: c10f07aa27da ("dma/direct: Handle force decryption for DMA coherent buffers in common code") +Signed-off-by: Robin Murphy +Signed-off-by: Christoph Hellwig +Acked-by: David Rientjes +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 8e24455dd236..854d6df969de 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -79,7 +79,7 @@ static int dma_set_decrypted(struct device *dev, void *vaddr, size_t size) + { + if (!force_dma_unencrypted(dev)) + return 0; +- return set_memory_decrypted((unsigned long)vaddr, 1 << get_order(size)); ++ return set_memory_decrypted((unsigned long)vaddr, PFN_UP(size)); + } + + static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size) +@@ -88,7 +88,7 @@ static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size) + + if (!force_dma_unencrypted(dev)) + return 0; +- ret = set_memory_encrypted((unsigned long)vaddr, 1 << get_order(size)); ++ ret = set_memory_encrypted((unsigned long)vaddr, PFN_UP(size)); + if (ret) + pr_warn_ratelimited("leaking DMA memory that can't be re-encrypted\n"); + return ret; +-- +2.35.1 + diff --git a/queue-5.15/dma-direct-factor-out-a-helper-for-dma_attr_no_kerne.patch b/queue-5.15/dma-direct-factor-out-a-helper-for-dma_attr_no_kerne.patch new file mode 100644 index 00000000000..2575859ebf8 --- /dev/null +++ b/queue-5.15/dma-direct-factor-out-a-helper-for-dma_attr_no_kerne.patch @@ -0,0 +1,73 @@ +From a33341a714f4b75ba87f69d48cc95e691cc484a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 13:08:07 +0200 +Subject: dma-direct: factor out a helper for DMA_ATTR_NO_KERNEL_MAPPING + allocations + +From: Christoph Hellwig + +[ Upstream commit d541ae55d538265861ef729a64d2d816d34ef1e2 ] + +Split the code for DMA_ATTR_NO_KERNEL_MAPPING allocations into a separate +helper to make dma_direct_alloc a little more readable. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Robin Murphy +Acked-by: David Rientjes +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 4c6c5e0635e3..ddaac01f2cba 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -149,6 +149,24 @@ static void *dma_direct_alloc_from_pool(struct device *dev, size_t size, + return ret; + } + ++static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size, ++ dma_addr_t *dma_handle, gfp_t gfp) ++{ ++ struct page *page; ++ ++ page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO); ++ if (!page) ++ return NULL; ++ ++ /* remove any dirty cache lines on the kernel alias */ ++ if (!PageHighMem(page)) ++ arch_dma_prep_coherent(page, size); ++ ++ /* return the page pointer as the opaque cookie */ ++ *dma_handle = phys_to_dma_direct(dev, page_to_phys(page)); ++ return page; ++} ++ + void *dma_direct_alloc(struct device *dev, size_t size, + dma_addr_t *dma_handle, gfp_t gfp, unsigned long attrs) + { +@@ -161,17 +179,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, + gfp |= __GFP_NOWARN; + + if ((attrs & DMA_ATTR_NO_KERNEL_MAPPING) && +- !force_dma_unencrypted(dev) && !is_swiotlb_for_alloc(dev)) { +- page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO); +- if (!page) +- return NULL; +- /* remove any dirty cache lines on the kernel alias */ +- if (!PageHighMem(page)) +- arch_dma_prep_coherent(page, size); +- *dma_handle = phys_to_dma_direct(dev, page_to_phys(page)); +- /* return the page pointer as the opaque cookie */ +- return page; +- } ++ !force_dma_unencrypted(dev) && !is_swiotlb_for_alloc(dev)) ++ return dma_direct_alloc_no_mapping(dev, size, dma_handle, gfp); + + if (!IS_ENABLED(CONFIG_ARCH_HAS_DMA_SET_UNCACHED) && + !IS_ENABLED(CONFIG_DMA_DIRECT_REMAP) && +-- +2.35.1 + diff --git a/queue-5.15/dma-direct-factor-out-dma_set_-de-en-crypted-helpers.patch b/queue-5.15/dma-direct-factor-out-dma_set_-de-en-crypted-helpers.patch new file mode 100644 index 00000000000..dab294b3857 --- /dev/null +++ b/queue-5.15/dma-direct-factor-out-dma_set_-de-en-crypted-helpers.patch @@ -0,0 +1,138 @@ +From 78bfefd705b76a49ea4f5917d87f8735bb0175e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 13:18:34 +0200 +Subject: dma-direct: factor out dma_set_{de,en}crypted helpers + +From: Christoph Hellwig + +[ Upstream commit 4d0564785bb03841e4b5c5b31aa4ecd1eb0d01bb ] + +Factor out helpers the make dealing with memory encryption a little less +cumbersome. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Robin Murphy +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 56 ++++++++++++++++++++------------------------- + 1 file changed, 25 insertions(+), 31 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index a1573ed2ea18..b9513fd68239 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -75,6 +75,20 @@ static bool dma_coherent_ok(struct device *dev, phys_addr_t phys, size_t size) + min_not_zero(dev->coherent_dma_mask, dev->bus_dma_limit); + } + ++static int dma_set_decrypted(struct device *dev, void *vaddr, size_t size) ++{ ++ if (!force_dma_unencrypted(dev)) ++ return 0; ++ return set_memory_decrypted((unsigned long)vaddr, 1 << get_order(size)); ++} ++ ++static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size) ++{ ++ if (!force_dma_unencrypted(dev)) ++ return 0; ++ return set_memory_encrypted((unsigned long)vaddr, 1 << get_order(size)); ++} ++ + static void __dma_direct_free_pages(struct device *dev, struct page *page, + size_t size) + { +@@ -175,7 +189,6 @@ void *dma_direct_alloc(struct device *dev, size_t size, + { + struct page *page; + void *ret; +- int err; + + size = PAGE_ALIGN(size); + if (attrs & DMA_ATTR_NO_WARN) +@@ -228,12 +241,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, + __builtin_return_address(0)); + if (!ret) + goto out_free_pages; +- if (force_dma_unencrypted(dev)) { +- err = set_memory_decrypted((unsigned long)ret, +- 1 << get_order(size)); +- if (err) +- goto out_free_pages; +- } ++ if (dma_set_decrypted(dev, ret, size)) ++ goto out_free_pages; + memset(ret, 0, size); + goto done; + } +@@ -250,13 +259,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, + } + + ret = page_address(page); +- if (force_dma_unencrypted(dev)) { +- err = set_memory_decrypted((unsigned long)ret, +- 1 << get_order(size)); +- if (err) +- goto out_free_pages; +- } +- ++ if (dma_set_decrypted(dev, ret, size)) ++ goto out_free_pages; + memset(ret, 0, size); + + if (IS_ENABLED(CONFIG_ARCH_HAS_DMA_SET_UNCACHED) && +@@ -271,13 +275,9 @@ void *dma_direct_alloc(struct device *dev, size_t size, + return ret; + + out_encrypt_pages: +- if (force_dma_unencrypted(dev)) { +- err = set_memory_encrypted((unsigned long)page_address(page), +- 1 << get_order(size)); +- /* If memory cannot be re-encrypted, it must be leaked */ +- if (err) +- return NULL; +- } ++ /* If memory cannot be re-encrypted, it must be leaked */ ++ if (dma_set_encrypted(dev, page_address(page), size)) ++ return NULL; + out_free_pages: + __dma_direct_free_pages(dev, page, size); + return NULL; +@@ -316,8 +316,7 @@ void dma_direct_free(struct device *dev, size_t size, + dma_free_from_pool(dev, cpu_addr, PAGE_ALIGN(size))) + return; + +- if (force_dma_unencrypted(dev)) +- set_memory_encrypted((unsigned long)cpu_addr, 1 << page_order); ++ dma_set_encrypted(dev, cpu_addr, 1 << page_order); + + if (IS_ENABLED(CONFIG_DMA_REMAP) && is_vmalloc_addr(cpu_addr)) + vunmap(cpu_addr); +@@ -343,11 +342,8 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, + return NULL; + + ret = page_address(page); +- if (force_dma_unencrypted(dev)) { +- if (set_memory_decrypted((unsigned long)ret, +- 1 << get_order(size))) +- goto out_free_pages; +- } ++ if (dma_set_decrypted(dev, ret, size)) ++ goto out_free_pages; + memset(ret, 0, size); + *dma_handle = phys_to_dma_direct(dev, page_to_phys(page)); + return page; +@@ -368,9 +364,7 @@ void dma_direct_free_pages(struct device *dev, size_t size, + dma_free_from_pool(dev, vaddr, size)) + return; + +- if (force_dma_unencrypted(dev)) +- set_memory_encrypted((unsigned long)vaddr, 1 << page_order); +- ++ dma_set_encrypted(dev, vaddr, 1 << page_order); + __dma_direct_free_pages(dev, page, size); + } + +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch b/queue-5.15/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch new file mode 100644 index 00000000000..55589b56e3b --- /dev/null +++ b/queue-5.15/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch @@ -0,0 +1,49 @@ +From 2f4ba04769bb21f33ac3cdaa6de4522390d20fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:13:38 +0200 +Subject: dmaengine: idxd: Fix the error handling path in idxd_cdev_register() + +From: Christophe JAILLET + +[ Upstream commit aab08c1aac01097815fbcf10fce7021d2396a31f ] + +If a call to alloc_chrdev_region() fails, the already allocated resources +are leaking. + +Add the needed error handling path to fix the leak. + +Fixes: 42d279f9137a ("dmaengine: idxd: add char driver to expose submission portal to userland") +Signed-off-by: Christophe JAILLET +Acked-by: Dave Jiang +Link: https://lore.kernel.org/r/1b5033dcc87b5f2a953c413f0306e883e6114542.1650521591.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/cdev.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c +index b9b2b4a4124e..033df43db0ce 100644 +--- a/drivers/dma/idxd/cdev.c ++++ b/drivers/dma/idxd/cdev.c +@@ -369,10 +369,16 @@ int idxd_cdev_register(void) + rc = alloc_chrdev_region(&ictx[i].devt, 0, MINORMASK, + ictx[i].name); + if (rc) +- return rc; ++ goto err_free_chrdev_region; + } + + return 0; ++ ++err_free_chrdev_region: ++ for (i--; i >= 0; i--) ++ unregister_chrdev_region(ictx[i].devt, MINORMASK); ++ ++ return rc; + } + + void idxd_cdev_remove(void) +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch b/queue-5.15/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch new file mode 100644 index 00000000000..4a66ec00452 --- /dev/null +++ b/queue-5.15/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch @@ -0,0 +1,41 @@ +From 821948d3d30785ac5a4c281e7c32b96d7dd99203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:53:21 +0200 +Subject: dmaengine: stm32-mdma: fix chan initialization in + stm32_mdma_irq_handler() + +From: Amelie Delaunay + +[ Upstream commit da3b8ddb464bd49b6248d00ca888ad751c9e44fd ] + +The parameter to pass back to the handler function when irq has been +requested is a struct stm32_mdma_device pointer, not a struct +stm32_mdma_chan pointer. +Even if chan is reinit later in the function, remove this wrong +initialization. + +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20220504155322.121431-3-amelie.delaunay@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index 343afb9722ea..21a7bdc88970 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -1344,7 +1344,7 @@ static void stm32_mdma_xfer_end(struct stm32_mdma_chan *chan) + static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid) + { + struct stm32_mdma_device *dmadev = devid; +- struct stm32_mdma_chan *chan = devid; ++ struct stm32_mdma_chan *chan; + u32 reg, id, ccr, ien, status; + + /* Find out which channel generates the interrupt */ +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-stm32-mdma-remove-gisr1-register.patch b/queue-5.15/dmaengine-stm32-mdma-remove-gisr1-register.patch new file mode 100644 index 00000000000..6ecae3caca8 --- /dev/null +++ b/queue-5.15/dmaengine-stm32-mdma-remove-gisr1-register.patch @@ -0,0 +1,73 @@ +From 950c0ba8ab5ffd9f05e9ac054c420070a32548e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:53:20 +0200 +Subject: dmaengine: stm32-mdma: remove GISR1 register + +From: Amelie Delaunay + +[ Upstream commit 9d6a2d92e450926c483e45eaf426080a19219f4e ] + +GISR1 was described in a not up-to-date documentation when the stm32-mdma +driver has been developed. This register has not been added in reference +manual of STM32 SoC with MDMA, which have only 32 MDMA channels. +So remove it from stm32-mdma driver. + +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20220504155322.121431-2-amelie.delaunay@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 21 +++++---------------- + 1 file changed, 5 insertions(+), 16 deletions(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index f17a9ffcd00d..343afb9722ea 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -40,7 +40,6 @@ + STM32_MDMA_SHIFT(mask)) + + #define STM32_MDMA_GISR0 0x0000 /* MDMA Int Status Reg 1 */ +-#define STM32_MDMA_GISR1 0x0004 /* MDMA Int Status Reg 2 */ + + /* MDMA Channel x interrupt/status register */ + #define STM32_MDMA_CISR(x) (0x40 + 0x40 * (x)) /* x = 0..62 */ +@@ -196,7 +195,7 @@ + + #define STM32_MDMA_MAX_BUF_LEN 128 + #define STM32_MDMA_MAX_BLOCK_LEN 65536 +-#define STM32_MDMA_MAX_CHANNELS 63 ++#define STM32_MDMA_MAX_CHANNELS 32 + #define STM32_MDMA_MAX_REQUESTS 256 + #define STM32_MDMA_MAX_BURST 128 + #define STM32_MDMA_VERY_HIGH_PRIORITY 0x3 +@@ -1350,21 +1349,11 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid) + + /* Find out which channel generates the interrupt */ + status = readl_relaxed(dmadev->base + STM32_MDMA_GISR0); +- if (status) { +- id = __ffs(status); +- } else { +- status = readl_relaxed(dmadev->base + STM32_MDMA_GISR1); +- if (!status) { +- dev_dbg(mdma2dev(dmadev), "spurious it\n"); +- return IRQ_NONE; +- } +- id = __ffs(status); +- /* +- * As GISR0 provides status for channel id from 0 to 31, +- * so GISR1 provides status for channel id from 32 to 62 +- */ +- id += 32; ++ if (!status) { ++ dev_dbg(mdma2dev(dmadev), "spurious it\n"); ++ return IRQ_NONE; + } ++ id = __ffs(status); + + chan = &dmadev->chan[id]; + if (!chan) { +-- +2.35.1 + diff --git a/queue-5.15/drbd-fix-duplicate-array-initializer.patch b/queue-5.15/drbd-fix-duplicate-array-initializer.patch new file mode 100644 index 00000000000..932915b82f5 --- /dev/null +++ b/queue-5.15/drbd-fix-duplicate-array-initializer.patch @@ -0,0 +1,93 @@ +From c01a914fbd83aded0276d66a94b50a35a406180a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 21:07:09 +0200 +Subject: drbd: fix duplicate array initializer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 33cb0917bbe241dd17a2b87ead63514c1b7e5615 ] + +There are two initializers for P_RETRY_WRITE: + +drivers/block/drbd/drbd_main.c:3676:22: warning: initialized field overwritten [-Woverride-init] + +Remove the first one since it was already ignored by the compiler +and reorder the list to match the enum definition. As P_ZEROES had +no entry, add that one instead. + +Fixes: 036b17eaab93 ("drbd: Receiving part for the PROTOCOL_UPDATE packet") +Fixes: f31e583aa2c2 ("drbd: introduce P_ZEROES (REQ_OP_WRITE_ZEROES on the "wire")") +Signed-off-by: Arnd Bergmann +Reviewed-by: Christoph Böhmwalder +Link: https://lore.kernel.org/r/20220406190715.1938174-2-christoph.boehmwalder@linbit.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 6db0333b5b7a..8ba2fe356f01 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -3607,9 +3607,8 @@ const char *cmdname(enum drbd_packet cmd) + * when we want to support more than + * one PRO_VERSION */ + static const char *cmdnames[] = { ++ + [P_DATA] = "Data", +- [P_WSAME] = "WriteSame", +- [P_TRIM] = "Trim", + [P_DATA_REPLY] = "DataReply", + [P_RS_DATA_REPLY] = "RSDataReply", + [P_BARRIER] = "Barrier", +@@ -3620,7 +3619,6 @@ const char *cmdname(enum drbd_packet cmd) + [P_DATA_REQUEST] = "DataRequest", + [P_RS_DATA_REQUEST] = "RSDataRequest", + [P_SYNC_PARAM] = "SyncParam", +- [P_SYNC_PARAM89] = "SyncParam89", + [P_PROTOCOL] = "ReportProtocol", + [P_UUIDS] = "ReportUUIDs", + [P_SIZES] = "ReportSizes", +@@ -3628,6 +3626,7 @@ const char *cmdname(enum drbd_packet cmd) + [P_SYNC_UUID] = "ReportSyncUUID", + [P_AUTH_CHALLENGE] = "AuthChallenge", + [P_AUTH_RESPONSE] = "AuthResponse", ++ [P_STATE_CHG_REQ] = "StateChgRequest", + [P_PING] = "Ping", + [P_PING_ACK] = "PingAck", + [P_RECV_ACK] = "RecvAck", +@@ -3638,23 +3637,25 @@ const char *cmdname(enum drbd_packet cmd) + [P_NEG_DREPLY] = "NegDReply", + [P_NEG_RS_DREPLY] = "NegRSDReply", + [P_BARRIER_ACK] = "BarrierAck", +- [P_STATE_CHG_REQ] = "StateChgRequest", + [P_STATE_CHG_REPLY] = "StateChgReply", + [P_OV_REQUEST] = "OVRequest", + [P_OV_REPLY] = "OVReply", + [P_OV_RESULT] = "OVResult", + [P_CSUM_RS_REQUEST] = "CsumRSRequest", + [P_RS_IS_IN_SYNC] = "CsumRSIsInSync", ++ [P_SYNC_PARAM89] = "SyncParam89", + [P_COMPRESSED_BITMAP] = "CBitmap", + [P_DELAY_PROBE] = "DelayProbe", + [P_OUT_OF_SYNC] = "OutOfSync", +- [P_RETRY_WRITE] = "RetryWrite", + [P_RS_CANCEL] = "RSCancel", + [P_CONN_ST_CHG_REQ] = "conn_st_chg_req", + [P_CONN_ST_CHG_REPLY] = "conn_st_chg_reply", + [P_PROTOCOL_UPDATE] = "protocol_update", ++ [P_TRIM] = "Trim", + [P_RS_THIN_REQ] = "rs_thin_req", + [P_RS_DEALLOCATED] = "rs_deallocated", ++ [P_WSAME] = "WriteSame", ++ [P_ZEROES] = "Zeroes", + + /* enum drbd_packet, but not commands - obsoleted flags: + * P_MAY_IGNORE +-- +2.35.1 + diff --git a/queue-5.15/drivers-base-memory-fix-an-unlikely-reference-counti.patch b/queue-5.15/drivers-base-memory-fix-an-unlikely-reference-counti.patch new file mode 100644 index 00000000000..1226d8a8f2a --- /dev/null +++ b/queue-5.15/drivers-base-memory-fix-an-unlikely-reference-counti.patch @@ -0,0 +1,53 @@ +From 6f0de89644089bf053e6b0a57359fa8bd18cb32b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:19 -0700 +Subject: drivers/base/memory: fix an unlikely reference counting issue in + __add_memory_block() + +From: Christophe JAILLET + +[ Upstream commit f47f758cff59c68015d6b9b9c077110df7c2c828 ] + +__add_memory_block() calls both put_device() and device_unregister() when +storing the memory block into the xarray. This is incorrect because +xarray doesn't take an additional reference and device_unregister() +already calls put_device(). + +Triggering the issue looks really unlikely and its only effect should be +to log a spurious warning about a ref counted issue. + +Link: https://lkml.kernel.org/r/d44c63d78affe844f020dc02ad6af29abc448fc4.1650611702.git.christophe.jaillet@wanadoo.fr +Fixes: 4fb6eabf1037 ("drivers/base/memory.c: cache memory blocks in xarray to accelerate lookup") +Signed-off-by: Christophe JAILLET +Acked-by: Michal Hocko +Reviewed-by: David Hildenbrand +Cc: Greg Kroah-Hartman +Cc: "Rafael J. Wysocki" +Cc: Scott Cheloha +Cc: Nathan Lynch +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/memory.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/memory.c b/drivers/base/memory.c +index 60c38f9cf1a7..c0d501a3a714 100644 +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -634,10 +634,9 @@ int register_memory(struct memory_block *memory) + } + ret = xa_err(xa_store(&memory_blocks, memory->dev.id, memory, + GFP_KERNEL)); +- if (ret) { +- put_device(&memory->dev); ++ if (ret) + device_unregister(&memory->dev); +- } ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.15/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch b/queue-5.15/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch new file mode 100644 index 00000000000..a7ae07425eb --- /dev/null +++ b/queue-5.15/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch @@ -0,0 +1,44 @@ +From db6a92e7a36e5c10caa112f10775bfa3397e7b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:06 -0700 +Subject: drivers/base/node.c: fix compaction sysfs file leak + +From: Miaohe Lin + +[ Upstream commit da63dc84befaa9e6079a0bc363ff0eaa975f9073 ] + +Compaction sysfs file is created via compaction_register_node in +register_node. But we forgot to remove it in unregister_node. Thus +compaction sysfs file is leaked. Using compaction_unregister_node to fix +this issue. + +Link: https://lkml.kernel.org/r/20220401070905.43679-1-linmiaohe@huawei.com +Fixes: ed4a6d7f0676 ("mm: compaction: add /sys trigger for per-node memory compaction") +Signed-off-by: Miaohe Lin +Cc: Greg Kroah-Hartman +Cc: Rafael J. Wysocki +Cc: Mel Gorman +Cc: Minchan Kim +Cc: KAMEZAWA Hiroyuki +Cc: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index c56d34f8158f..0f5319b79fad 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -679,6 +679,7 @@ static int register_node(struct node *node, int num) + */ + void unregister_node(struct node *node) + { ++ compaction_unregister_node(node); + hugetlb_unregister_node(node); /* no-op, if memoryless node */ + node_remove_accesses(node); + node_remove_caches(node); +-- +2.35.1 + diff --git a/queue-5.15/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch b/queue-5.15/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch new file mode 100644 index 00000000000..05bc1aba28f --- /dev/null +++ b/queue-5.15/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch @@ -0,0 +1,71 @@ +From 66a83ea4d9731d4fbbd0d6fd02a33ff0481c7607 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 14:23:20 +0200 +Subject: Drivers: hv: vmbus: Fix handling of messages with transaction ID of + zero + +From: Andrea Parri (Microsoft) + +[ Upstream commit 82cd4bacff88a11e36f143e2cb950174b09c86c3 ] + +vmbus_request_addr() returns 0 (zero) if the transaction ID passed +to as argument is 0. This is unfortunate for two reasons: first, +netvsc_send_completion() does not check for a NULL cmd_rqst (before +dereferencing the corresponding NVSP message); second, 0 is a *valid* +value of cmd_rqst in netvsc_send_tx_complete(), cf. the call of +vmbus_sendpacket() in netvsc_send_pkt(). + +vmbus_request_addr() has included the code in question since its +introduction with commit e8b7db38449ac ("Drivers: hv: vmbus: Add +vmbus_requestor data structure for VMBus hardening"); such code was +motivated by the early use of vmbus_requestor by hv_storvsc. Since +hv_storvsc moved to a tag-based mechanism to generate and retrieve +transaction IDs with commit bf5fd8cae3c8f ("scsi: storvsc: Use +blk_mq_unique_tag() to generate requestIDs"), vmbus_request_addr() +can be modified to return VMBUS_RQST_ERROR if the ID is 0. This +change solves the issues in hv_netvsc (and makes the handling of +messages with transaction ID of 0 consistent with the semantics +"the ID is not contained in the requestor/invalid ID"). + +vmbus_next_request_id(), vmbus_request_addr() should still reserve +the ID of 0 for Hyper-V, because Hyper-V will "ignore" (not respond +to) VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED packets/requests with +transaction ID of 0 from the guest. + +Fixes: bf5fd8cae3c8f ("scsi: storvsc: Use blk_mq_unique_tag() to generate requestIDs") +Signed-off-by: Andrea Parri (Microsoft) +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20220419122325.10078-2-parri.andrea@gmail.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index f3761c73b074..6b967bb38690 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -1221,7 +1221,9 @@ u64 vmbus_next_request_id(struct vmbus_channel *channel, u64 rqst_addr) + + /* + * Cannot return an ID of 0, which is reserved for an unsolicited +- * message from Hyper-V. ++ * message from Hyper-V; Hyper-V does not acknowledge (respond to) ++ * VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED requests with ID of ++ * 0 sent by the guest. + */ + return current_id + 1; + } +@@ -1246,7 +1248,7 @@ u64 vmbus_request_addr(struct vmbus_channel *channel, u64 trans_id) + + /* Hyper-V can send an unsolicited message with ID of 0 */ + if (!trans_id) +- return trans_id; ++ return VMBUS_RQST_ERROR; + + spin_lock_irqsave(&rqstor->req_lock, flags); + +-- +2.35.1 + diff --git a/queue-5.15/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch b/queue-5.15/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch new file mode 100644 index 00000000000..a23d5851561 --- /dev/null +++ b/queue-5.15/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch @@ -0,0 +1,85 @@ +From 08be560283f08c9ebfa87739f9ddf4b246478858 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 12:01:20 +0530 +Subject: drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit + +From: Vignesh Raghavendra + +[ Upstream commit c7666240ec76422cb7546bd07cc8ae80dc0ccdd2 ] + +The ARASAN MMC controller on Keystone 3 class of devices need the SDCD +line to be connected for proper functioning. Similar to the issue pointed +out in sdhci-of-arasan.c driver, commit 3794c542641f ("mmc: +sdhci-of-arasan: Set controller to test mode when no CD bit"). + +In cases where this can't be connected, add a quirk to force the +controller into test mode and set the TESTCD bit. Use the flag +"ti,fails-without-test-cd", to implement this above quirk when required. + +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Aswath Govindraju +Link: https://lore.kernel.org/r/20220425063120.10135-3-a-govindraju@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_am654.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c +index b4891bb26648..a3e62e212631 100644 +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -147,6 +147,9 @@ struct sdhci_am654_data { + int drv_strength; + int strb_sel; + u32 flags; ++ u32 quirks; ++ ++#define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0) + }; + + struct sdhci_am654_driver_data { +@@ -369,6 +372,21 @@ static void sdhci_am654_write_b(struct sdhci_host *host, u8 val, int reg) + } + } + ++static void sdhci_am654_reset(struct sdhci_host *host, u8 mask) ++{ ++ u8 ctrl; ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); ++ ++ sdhci_reset(host, mask); ++ ++ if (sdhci_am654->quirks & SDHCI_AM654_QUIRK_FORCE_CDTEST) { ++ ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL); ++ ctrl |= SDHCI_CTRL_CDTEST_INS | SDHCI_CTRL_CDTEST_EN; ++ sdhci_writeb(host, ctrl, SDHCI_HOST_CONTROL); ++ } ++} ++ + static int sdhci_am654_execute_tuning(struct mmc_host *mmc, u32 opcode) + { + struct sdhci_host *host = mmc_priv(mmc); +@@ -500,7 +518,7 @@ static struct sdhci_ops sdhci_j721e_4bit_ops = { + .set_clock = sdhci_j721e_4bit_set_clock, + .write_b = sdhci_am654_write_b, + .irq = sdhci_am654_cqhci_irq, +- .reset = sdhci_reset, ++ .reset = sdhci_am654_reset, + }; + + static const struct sdhci_pltfm_data sdhci_j721e_4bit_pdata = { +@@ -719,6 +737,9 @@ static int sdhci_am654_get_of_property(struct platform_device *pdev, + device_property_read_u32(dev, "ti,clkbuf-sel", + &sdhci_am654->clkbuf_sel); + ++ if (device_property_read_bool(dev, "ti,fails-without-test-cd")) ++ sdhci_am654->quirks |= SDHCI_AM654_QUIRK_FORCE_CDTEST; ++ + sdhci_get_of_property(pdev); + + return 0; +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-disabling-z10-on-dcn31.patch b/queue-5.15/drm-amd-display-disabling-z10-on-dcn31.patch new file mode 100644 index 00000000000..d54bbdc24d2 --- /dev/null +++ b/queue-5.15/drm-amd-display-disabling-z10-on-dcn31.patch @@ -0,0 +1,39 @@ +From edbeb6e859e5bd71448c5254a2221284f36e48d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 14:25:16 -0400 +Subject: drm/amd/display: Disabling Z10 on DCN31 + +From: Saaem Rizvi + +[ Upstream commit 5d5af34072c8b11f60960c3bea57ff9de5877791 ] + +[WHY] +Z10 is should not be enabled by default on DCN31. + +[HOW] +Using DC debug flags to disable Z10 by default on DCN31. + +Reviewed-by: Eric Yang +Acked-by: Pavle Kotarac +Signed-off-by: Saaem Rizvi +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +index a5ef9d5e7685..310ced5058c4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +@@ -957,6 +957,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .optc = false, + } + }, ++ .disable_z10 = true, + .optimize_edp_link_rate = true, + .enable_sw_cntl_psr = true, + }; +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch b/queue-5.15/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch new file mode 100644 index 00000000000..8a48b06fe94 --- /dev/null +++ b/queue-5.15/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch @@ -0,0 +1,70 @@ +From 974683596f79e3df6d009a1a3e4d356feb4ac7aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 10:37:19 +0000 +Subject: drm/amd/pm: fix double free in si_parse_power_table() + +From: Keita Suzuki + +[ Upstream commit f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd ] + +In function si_parse_power_table(), array adev->pm.dpm.ps and its member +is allocated. If the allocation of each member fails, the array itself +is freed and returned with an error code. However, the array is later +freed again in si_dpm_fini() function which is called when the function +returns an error. + +This leads to potential double free of the array adev->pm.dpm.ps, as +well as leak of its array members, since the members are not freed in +the allocation function and the array is not nulled when freed. +In addition adev->pm.dpm.num_ps, which keeps track of the allocated +array member, is not updated until the member allocation is +successfully finished, this could also lead to either use after free, +or uninitialized variable access in si_dpm_fini(). + +Fix this by postponing the free of the array until si_dpm_fini() and +increment adev->pm.dpm.num_ps everytime the array member is allocated. + +Signed-off-by: Keita Suzuki +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +index 81f82aa05ec2..66fc63f1f1c1 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +@@ -7247,17 +7247,15 @@ static int si_parse_power_table(struct amdgpu_device *adev) + if (!adev->pm.dpm.ps) + return -ENOMEM; + power_state_offset = (u8 *)state_array->states; +- for (i = 0; i < state_array->ucNumEntries; i++) { ++ for (adev->pm.dpm.num_ps = 0, i = 0; i < state_array->ucNumEntries; i++) { + u8 *idx; + power_state = (union pplib_power_state *)power_state_offset; + non_clock_array_index = power_state->v2.nonClockInfoIndex; + non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) + &non_clock_info_array->nonClockInfo[non_clock_array_index]; + ps = kzalloc(sizeof(struct si_ps), GFP_KERNEL); +- if (ps == NULL) { +- kfree(adev->pm.dpm.ps); ++ if (ps == NULL) + return -ENOMEM; +- } + adev->pm.dpm.ps[i].ps_priv = ps; + si_parse_pplib_non_clock_info(adev, &adev->pm.dpm.ps[i], + non_clock_info, +@@ -7279,8 +7277,8 @@ static int si_parse_power_table(struct amdgpu_device *adev) + k++; + } + power_state_offset += 2 + power_state->v2.ucNumDPMLevels; ++ adev->pm.dpm.num_ps++; + } +- adev->pm.dpm.num_ps = state_array->ucNumEntries; + + /* fill in the vce power states */ + for (i = 0; i < adev->pm.dpm.num_of_vce_states; i++) { +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-pm-fix-the-compile-warning.patch b/queue-5.15/drm-amd-pm-fix-the-compile-warning.patch new file mode 100644 index 00000000000..4cff26890ee --- /dev/null +++ b/queue-5.15/drm-amd-pm-fix-the-compile-warning.patch @@ -0,0 +1,51 @@ +From 937981174027d9a1f1aef52c721f58c02c3d28ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 10:16:46 +0800 +Subject: drm/amd/pm: fix the compile warning + +From: Evan Quan + +[ Upstream commit 555238d92ac32dbad2d77ad2bafc48d17391990c ] + +Fix the compile warning below: +drivers/gpu/drm/amd/amdgpu/../pm/legacy-dpm/kv_dpm.c:1641 +kv_get_acp_boot_level() warn: always true condition '(table->entries[i]->clk >= 0) => (0-u32max >= 0)' + +Reported-by: kernel test robot +CC: Alex Deucher +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c +index bcae42cef374..6ba4c2ae69a6 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c +@@ -1609,19 +1609,7 @@ static int kv_update_samu_dpm(struct amdgpu_device *adev, bool gate) + + static u8 kv_get_acp_boot_level(struct amdgpu_device *adev) + { +- u8 i; +- struct amdgpu_clock_voltage_dependency_table *table = +- &adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table; +- +- for (i = 0; i < table->count; i++) { +- if (table->entries[i].clk >= 0) /* XXX */ +- break; +- } +- +- if (i >= table->count) +- i = table->count - 1; +- +- return i; ++ return 0; + } + + static void kv_update_acp_boot_level(struct amdgpu_device *adev) +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch b/queue-5.15/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch new file mode 100644 index 00000000000..9ab0833e977 --- /dev/null +++ b/queue-5.15/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch @@ -0,0 +1,113 @@ +From 2b2314db00ba0ae1289b1d1677c870cc01470d97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:06:12 +0530 +Subject: drm/amd/pm: update smartshift powerboost calc for smu12 + +From: Sathishkumar S + +[ Upstream commit 138292f1dc00e7e0724f44769f9da39cf2f3bf0b ] + +smartshift apu and dgpu power boost are reported as percentage with +respect to their power limits. This value[0-100] reflects the boost +for the respective device. + +Signed-off-by: Sathishkumar S +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 60 ++++++++++++++----- + 1 file changed, 44 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +index 145f13b8c977..138466081875 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +@@ -1127,6 +1127,39 @@ static int renoir_get_power_profile_mode(struct smu_context *smu, + return size; + } + ++static void renoir_get_ss_power_percent(SmuMetrics_t *metrics, ++ uint32_t *apu_percent, uint32_t *dgpu_percent) ++{ ++ uint32_t apu_boost = 0; ++ uint32_t dgpu_boost = 0; ++ uint16_t apu_limit = 0; ++ uint16_t dgpu_limit = 0; ++ uint16_t apu_power = 0; ++ uint16_t dgpu_power = 0; ++ ++ apu_power = metrics->ApuPower; ++ apu_limit = metrics->StapmOriginalLimit; ++ if (apu_power > apu_limit && apu_limit != 0) ++ apu_boost = ((apu_power - apu_limit) * 100) / apu_limit; ++ apu_boost = (apu_boost > 100) ? 100 : apu_boost; ++ ++ dgpu_power = metrics->dGpuPower; ++ if (metrics->StapmCurrentLimit > metrics->StapmOriginalLimit) ++ dgpu_limit = metrics->StapmCurrentLimit - metrics->StapmOriginalLimit; ++ if (dgpu_power > dgpu_limit && dgpu_limit != 0) ++ dgpu_boost = ((dgpu_power - dgpu_limit) * 100) / dgpu_limit; ++ dgpu_boost = (dgpu_boost > 100) ? 100 : dgpu_boost; ++ ++ if (dgpu_boost >= apu_boost) ++ apu_boost = 0; ++ else ++ dgpu_boost = 0; ++ ++ *apu_percent = apu_boost; ++ *dgpu_percent = dgpu_boost; ++} ++ ++ + static int renoir_get_smu_metrics_data(struct smu_context *smu, + MetricsMember_t member, + uint32_t *value) +@@ -1135,6 +1168,9 @@ static int renoir_get_smu_metrics_data(struct smu_context *smu, + + SmuMetrics_t *metrics = (SmuMetrics_t *)smu_table->metrics_table; + int ret = 0; ++ uint32_t apu_percent = 0; ++ uint32_t dgpu_percent = 0; ++ + + mutex_lock(&smu->metrics_lock); + +@@ -1183,26 +1219,18 @@ static int renoir_get_smu_metrics_data(struct smu_context *smu, + *value = metrics->Voltage[1]; + break; + case METRICS_SS_APU_SHARE: +- /* return the percentage of APU power with respect to APU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of APU power boost ++ * with respect to APU's power limit. + */ +- if (metrics->StapmOriginalLimit > 0) +- *value = (metrics->ApuPower * 100) / metrics->StapmOriginalLimit; +- else +- *value = 0; ++ renoir_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = apu_percent; + break; + case METRICS_SS_DGPU_SHARE: +- /* return the percentage of dGPU power with respect to dGPU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of dGPU power boost ++ * with respect to dGPU's power limit. + */ +- if ((metrics->dGpuPower > 0) && +- (metrics->StapmCurrentLimit > metrics->StapmOriginalLimit)) +- *value = (metrics->dGpuPower * 100) / +- (metrics->StapmCurrentLimit - metrics->StapmOriginalLimit); +- else +- *value = 0; ++ renoir_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = dgpu_percent; + break; + default: + *value = UINT_MAX; +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-32492 b/queue-5.15/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-32492 new file mode 100644 index 00000000000..e071396d9f1 --- /dev/null +++ b/queue-5.15/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-32492 @@ -0,0 +1,115 @@ +From 28215a49f68926e2865a9c50efeafccc489ce1fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:35:59 +0530 +Subject: drm/amd/pm: update smartshift powerboost calc for smu13 + +From: Sathishkumar S + +[ Upstream commit cdf4c8ec39872a61a58d62f19b4db80f0f7bc586 ] + +smartshift apu and dgpu power boost are reported as percentage +with respect to their power limits. adjust the units of power before +calculating the percentage of boost. + +Signed-off-by: Sathishkumar S +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 62 ++++++++++++++----- + 1 file changed, 46 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +index 0e1a843608e4..33bd5430c6de 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +@@ -305,6 +305,42 @@ static int yellow_carp_mode2_reset(struct smu_context *smu) + return yellow_carp_mode_reset(smu, SMU_RESET_MODE_2); + } + ++ ++static void yellow_carp_get_ss_power_percent(SmuMetrics_t *metrics, ++ uint32_t *apu_percent, uint32_t *dgpu_percent) ++{ ++ uint32_t apu_boost = 0; ++ uint32_t dgpu_boost = 0; ++ uint16_t apu_limit = 0; ++ uint16_t dgpu_limit = 0; ++ uint16_t apu_power = 0; ++ uint16_t dgpu_power = 0; ++ ++ /* APU and dGPU power values are reported in milli Watts ++ * and STAPM power limits are in Watts */ ++ apu_power = metrics->ApuPower/1000; ++ apu_limit = metrics->StapmOpnLimit; ++ if (apu_power > apu_limit && apu_limit != 0) ++ apu_boost = ((apu_power - apu_limit) * 100) / apu_limit; ++ apu_boost = (apu_boost > 100) ? 100 : apu_boost; ++ ++ dgpu_power = metrics->dGpuPower/1000; ++ if (metrics->StapmCurrentLimit > metrics->StapmOpnLimit) ++ dgpu_limit = metrics->StapmCurrentLimit - metrics->StapmOpnLimit; ++ if (dgpu_power > dgpu_limit && dgpu_limit != 0) ++ dgpu_boost = ((dgpu_power - dgpu_limit) * 100) / dgpu_limit; ++ dgpu_boost = (dgpu_boost > 100) ? 100 : dgpu_boost; ++ ++ if (dgpu_boost >= apu_boost) ++ apu_boost = 0; ++ else ++ dgpu_boost = 0; ++ ++ *apu_percent = apu_boost; ++ *dgpu_percent = dgpu_boost; ++ ++} ++ + static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + MetricsMember_t member, + uint32_t *value) +@@ -313,6 +349,8 @@ static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + + SmuMetrics_t *metrics = (SmuMetrics_t *)smu_table->metrics_table; + int ret = 0; ++ uint32_t apu_percent = 0; ++ uint32_t dgpu_percent = 0; + + mutex_lock(&smu->metrics_lock); + +@@ -365,26 +403,18 @@ static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + *value = metrics->Voltage[1]; + break; + case METRICS_SS_APU_SHARE: +- /* return the percentage of APU power with respect to APU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of APU power boost ++ * with respect to APU's power limit. + */ +- if (metrics->StapmOpnLimit > 0) +- *value = (metrics->ApuPower * 100) / metrics->StapmOpnLimit; +- else +- *value = 0; ++ yellow_carp_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = apu_percent; + break; + case METRICS_SS_DGPU_SHARE: +- /* return the percentage of dGPU power with respect to dGPU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of dGPU power boost ++ * with respect to dGPU's power limit. + */ +- if ((metrics->dGpuPower > 0) && +- (metrics->StapmCurrentLimit > metrics->StapmOpnLimit)) +- *value = (metrics->dGpuPower * 100) / +- (metrics->StapmCurrentLimit - metrics->StapmOpnLimit); +- else +- *value = 0; ++ yellow_carp_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = dgpu_percent; + break; + default: + *value = UINT_MAX; +-- +2.35.1 + diff --git a/queue-5.15/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch b/queue-5.15/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch new file mode 100644 index 00000000000..8040e125d74 --- /dev/null +++ b/queue-5.15/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch @@ -0,0 +1,158 @@ +From 27fc59ae29f8aa642ac9da54be344fbe81b1bc5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 01:21:52 -0400 +Subject: drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init + +From: Alex Deucher + +[ Upstream commit b95b5391684b39695887afb4a13cccee7820f5d6 ] + +Memory allocations should be done in sw_init. hw_init should +just be hardware programming needed to initialize the IP block. +This is how most other IP blocks work. Move the GPU memory +allocations from psp hw_init to psp sw_init and move the memory +free to sw_fini. This also fixes a potential GPU memory leak +if psp hw_init fails. + +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 95 ++++++++++++------------- + 1 file changed, 47 insertions(+), 48 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index 86e2090bbd6e..57e9932d8a04 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -314,7 +314,39 @@ static int psp_sw_init(void *handle) + } + } + ++ ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, ++ amdgpu_sriov_vf(adev) ? ++ AMDGPU_GEM_DOMAIN_VRAM : AMDGPU_GEM_DOMAIN_GTT, ++ &psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, ++ &psp->fw_pri_buf); ++ if (ret) ++ return ret; ++ ++ ret = amdgpu_bo_create_kernel(adev, PSP_FENCE_BUFFER_SIZE, PAGE_SIZE, ++ AMDGPU_GEM_DOMAIN_VRAM, ++ &psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, ++ &psp->fence_buf); ++ if (ret) ++ goto failed1; ++ ++ ret = amdgpu_bo_create_kernel(adev, PSP_CMD_BUFFER_SIZE, PAGE_SIZE, ++ AMDGPU_GEM_DOMAIN_VRAM, ++ &psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, ++ (void **)&psp->cmd_buf_mem); ++ if (ret) ++ goto failed2; ++ + return 0; ++ ++failed2: ++ amdgpu_bo_free_kernel(&psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, &psp->fw_pri_buf); ++failed1: ++ amdgpu_bo_free_kernel(&psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, &psp->fence_buf); ++ return ret; + } + + static int psp_sw_fini(void *handle) +@@ -344,6 +376,13 @@ static int psp_sw_fini(void *handle) + kfree(cmd); + cmd = NULL; + ++ amdgpu_bo_free_kernel(&psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, &psp->fw_pri_buf); ++ amdgpu_bo_free_kernel(&psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, &psp->fence_buf); ++ amdgpu_bo_free_kernel(&psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, ++ (void **)&psp->cmd_buf_mem); ++ + return 0; + } + +@@ -2580,51 +2619,18 @@ static int psp_load_fw(struct amdgpu_device *adev) + struct psp_context *psp = &adev->psp; + + if (amdgpu_sriov_vf(adev) && amdgpu_in_reset(adev)) { +- psp_ring_stop(psp, PSP_RING_TYPE__KM); /* should not destroy ring, only stop */ +- goto skip_memalloc; +- } +- +- if (amdgpu_sriov_vf(adev)) { +- ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, +- &psp->fw_pri_buf); ++ /* should not destroy ring, only stop */ ++ psp_ring_stop(psp, PSP_RING_TYPE__KM); + } else { +- ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, +- AMDGPU_GEM_DOMAIN_GTT, +- &psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, +- &psp->fw_pri_buf); +- } +- +- if (ret) +- goto failed; +- +- ret = amdgpu_bo_create_kernel(adev, PSP_FENCE_BUFFER_SIZE, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->fence_buf_bo, +- &psp->fence_buf_mc_addr, +- &psp->fence_buf); +- if (ret) +- goto failed; +- +- ret = amdgpu_bo_create_kernel(adev, PSP_CMD_BUFFER_SIZE, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, +- (void **)&psp->cmd_buf_mem); +- if (ret) +- goto failed; ++ memset(psp->fence_buf, 0, PSP_FENCE_BUFFER_SIZE); + +- memset(psp->fence_buf, 0, PSP_FENCE_BUFFER_SIZE); +- +- ret = psp_ring_init(psp, PSP_RING_TYPE__KM); +- if (ret) { +- DRM_ERROR("PSP ring init failed!\n"); +- goto failed; ++ ret = psp_ring_init(psp, PSP_RING_TYPE__KM); ++ if (ret) { ++ DRM_ERROR("PSP ring init failed!\n"); ++ goto failed; ++ } + } + +-skip_memalloc: + ret = psp_hw_start(psp); + if (ret) + goto failed; +@@ -2730,13 +2736,6 @@ static int psp_hw_fini(void *handle) + psp_tmr_terminate(psp); + psp_ring_destroy(psp, PSP_RING_TYPE__KM); + +- amdgpu_bo_free_kernel(&psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, &psp->fw_pri_buf); +- amdgpu_bo_free_kernel(&psp->fence_buf_bo, +- &psp->fence_buf_mc_addr, &psp->fence_buf); +- amdgpu_bo_free_kernel(&psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, +- (void **)&psp->cmd_buf_mem); +- + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.15/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch b/queue-5.15/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch new file mode 100644 index 00000000000..225aece082a --- /dev/null +++ b/queue-5.15/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch @@ -0,0 +1,103 @@ +From f03aaff0b6d252694af571e93e1c01f640235d48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 20:41:38 +0800 +Subject: drm/amdgpu/sdma: Fix incorrect calculations of the wptr of the + doorbells +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Haohui Mai + +[ Upstream commit 7dba6e838e741caadcf27ef717b6dcb561e77f89 ] + +This patch fixes the issue where the driver miscomputes the 64-bit +values of the wptr of the SDMA doorbell when initializing the +hardware. SDMA engines v4 and later on have full 64-bit registers for +wptr thus they should be set properly. + +Older generation hardwares like CIK / SI have only 16 / 20 / 24bits +for the WPTR, where the calls of lower_32_bits() will be removed in a +following patch. + +Reviewed-by: Christian König +Signed-off-by: Haohui Mai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 ++-- + drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 8 ++++---- + drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 8 ++++---- + 3 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +index e37948c15769..9014f71d52dd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -770,8 +770,8 @@ static void sdma_v4_0_ring_set_wptr(struct amdgpu_ring *ring) + + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +index 50bf3b71bc93..0f75864365d6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +@@ -400,8 +400,8 @@ static void sdma_v5_0_ring_set_wptr(struct amdgpu_ring *ring) + if (ring->use_doorbell) { + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +@@ -782,9 +782,9 @@ static int sdma_v5_0_gfx_resume(struct amdgpu_device *adev) + + if (!amdgpu_sriov_vf(adev)) { /* only bare-metal use register write for wptr */ + WREG32(sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), +- lower_32_bits(ring->wptr) << 2); ++ lower_32_bits(ring->wptr << 2)); + WREG32(sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), +- upper_32_bits(ring->wptr) << 2); ++ upper_32_bits(ring->wptr << 2)); + } + + doorbell = RREG32_SOC15_IP(GC, sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_DOORBELL)); +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +index e32efcfb0c8b..f643b977b5f4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +@@ -287,8 +287,8 @@ static void sdma_v5_2_ring_set_wptr(struct amdgpu_ring *ring) + if (ring->use_doorbell) { + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +@@ -660,8 +660,8 @@ static int sdma_v5_2_gfx_resume(struct amdgpu_device *adev) + WREG32_SOC15_IP(GC, sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_MINOR_PTR_UPDATE), 1); + + if (!amdgpu_sriov_vf(adev)) { /* only bare-metal use register write for wptr */ +- WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), lower_32_bits(ring->wptr) << 2); +- WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), upper_32_bits(ring->wptr) << 2); ++ WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), lower_32_bits(ring->wptr << 2)); ++ WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), upper_32_bits(ring->wptr << 2)); + } + + doorbell = RREG32_SOC15_IP(GC, sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_DOORBELL)); +-- +2.35.1 + diff --git a/queue-5.15/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch b/queue-5.15/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch new file mode 100644 index 00000000000..8e2870f3724 --- /dev/null +++ b/queue-5.15/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch @@ -0,0 +1,40 @@ +From 48f452233ad51c02dd92456b9ec8274c50e7275f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 11:40:18 -0400 +Subject: drm/amdgpu/ucode: Remove firmware load type check in + amdgpu_ucode_free_bo + +From: Alice Wong + +[ Upstream commit ab0cd4a9ae5b4679b714d8dbfedc0901fecdce9f ] + +When psp_hw_init failed, it will set the load_type to AMDGPU_FW_LOAD_DIRECT. +During amdgpu_device_ip_fini, amdgpu_ucode_free_bo checks that load_type is +AMDGPU_FW_LOAD_DIRECT and skips deallocating fw_buf causing memory leak. +Remove load_type check in amdgpu_ucode_free_bo. + +Signed-off-by: Alice Wong +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +index abd8469380e5..0ed0736d515a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -723,8 +723,7 @@ int amdgpu_ucode_create_bo(struct amdgpu_device *adev) + + void amdgpu_ucode_free_bo(struct amdgpu_device *adev) + { +- if (adev->firmware.load_type != AMDGPU_FW_LOAD_DIRECT) +- amdgpu_bo_free_kernel(&adev->firmware.fw_buf, ++ amdgpu_bo_free_kernel(&adev->firmware.fw_buf, + &adev->firmware.fw_buf_mc, + &adev->firmware.fw_buf_ptr); + } +-- +2.35.1 + diff --git a/queue-5.15/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch b/queue-5.15/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch new file mode 100644 index 00000000000..37d7c3eda99 --- /dev/null +++ b/queue-5.15/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch @@ -0,0 +1,37 @@ +From 2cca258be88d79f6c306b852d878ea9cbdfa63dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 11:47:05 +0100 +Subject: drm/bridge: adv7511: clean up CEC adapter when probe fails + +From: Lucas Stach + +[ Upstream commit 7ed2b0dabf7a22874cb30f8878df239ef638eb53 ] + +When the probe routine fails we also need to clean up the +CEC adapter registered in adv7511_cec_init(). + +Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support") +Signed-off-by: Lucas Stach +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220321104705.2804423-1-l.stach@pengutronix.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index c02f3ec60b04..8c2025584f1b 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1306,6 +1306,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + return 0; + + err_unregister_cec: ++ cec_unregister_adapter(adv7511->cec_adap); + i2c_unregister_device(adv7511->i2c_cec); + clk_disable_unprepare(adv7511->cec_clk); + err_i2c_unregister_packet: +-- +2.35.1 + diff --git a/queue-5.15/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch b/queue-5.15/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch new file mode 100644 index 00000000000..2c480b33045 --- /dev/null +++ b/queue-5.15/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch @@ -0,0 +1,80 @@ +From 81da30270b291c691b5c7e55d7e9e24baae16c2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 01:16:40 +0000 +Subject: drm/bridge: Fix error handling in analogix_dp_probe + +From: Miaoqian Lin + +[ Upstream commit 9f15930bb2ef9f031d62ffc49629cbae89137733 ] + +In the error handling path, the clk_prepare_enable() function +call should be balanced by a corresponding 'clk_disable_unprepare()' +call, as already done in the remove function. + +Fixes: 3424e3a4f844 ("drm: bridge: analogix/dp: split exynos dp driver to bridge directory") +Signed-off-by: Miaoqian Lin +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220420011644.25730-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + .../gpu/drm/bridge/analogix/analogix_dp_core.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +index b7d2e4449cfa..7fe19c56f792 100644 +--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c ++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +@@ -1698,8 +1698,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + + dp->reg_base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(dp->reg_base)) +- return ERR_CAST(dp->reg_base); ++ if (IS_ERR(dp->reg_base)) { ++ ret = PTR_ERR(dp->reg_base); ++ goto err_disable_clk; ++ } + + dp->force_hpd = of_property_read_bool(dev->of_node, "force-hpd"); + +@@ -1711,7 +1713,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + if (IS_ERR(dp->hpd_gpiod)) { + dev_err(dev, "error getting HDP GPIO: %ld\n", + PTR_ERR(dp->hpd_gpiod)); +- return ERR_CAST(dp->hpd_gpiod); ++ ret = PTR_ERR(dp->hpd_gpiod); ++ goto err_disable_clk; + } + + if (dp->hpd_gpiod) { +@@ -1731,7 +1734,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + + if (dp->irq == -ENXIO) { + dev_err(&pdev->dev, "failed to get irq\n"); +- return ERR_PTR(-ENODEV); ++ ret = -ENODEV; ++ goto err_disable_clk; + } + + ret = devm_request_threaded_irq(&pdev->dev, dp->irq, +@@ -1740,11 +1744,15 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + irq_flags, "analogix-dp", dp); + if (ret) { + dev_err(&pdev->dev, "failed to request irq\n"); +- return ERR_PTR(ret); ++ goto err_disable_clk; + } + disable_irq(dp->irq); + + return dp; ++ ++err_disable_clk: ++ clk_disable_unprepare(dp->clock); ++ return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(analogix_dp_probe); + +-- +2.35.1 + diff --git a/queue-5.15/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch b/queue-5.15/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch new file mode 100644 index 00000000000..2cf2316c3f4 --- /dev/null +++ b/queue-5.15/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch @@ -0,0 +1,94 @@ +From e0ac67cc7fe921b6d2a88c61e092b9445edfe968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 17:05:00 +0200 +Subject: drm: bridge: icn6211: Fix HFP_HSW_HBP_HI and HFP_MIN handling + +From: Marek Vasut + +[ Upstream commit c0ff7a649d62105a9308cc3ac36e52a4669d9cb4 ] + +The HFP_HSW_HBP_HI register must be programmed with 2 LSbits of each +Horizontal Front Porch/Sync/Back Porch. Currently the driver programs +this register to 0, which breaks displays with either value above 255. + +The HFP_MIN register must be set to the same value as HFP_LI, otherwise +there is visible image distortion, usually in the form of missing lines +at the bottom of the panel. + +Fix this by correctly programming the HFP_HSW_HBP_HI and HFP_MIN registers. + +Acked-by: Maxime Ripard +Fixes: ce517f18944e3 ("drm: bridge: Add Chipone ICN6211 MIPI-DSI to RGB bridge") +Signed-off-by: Marek Vasut +Cc: Jagan Teki +Cc: Maxime Ripard +Cc: Robert Foss +Cc: Sam Ravnborg +Cc: Thomas Zimmermann +To: dri-devel@lists.freedesktop.org +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220331150509.9838-3-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/chipone-icn6211.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/chipone-icn6211.c b/drivers/gpu/drm/bridge/chipone-icn6211.c +index eb26615b2993..d7eedf35e841 100644 +--- a/drivers/gpu/drm/bridge/chipone-icn6211.c ++++ b/drivers/gpu/drm/bridge/chipone-icn6211.c +@@ -34,6 +34,9 @@ + #define HSYNC_LI 0x24 + #define HBP_LI 0x25 + #define HFP_HSW_HBP_HI 0x26 ++#define HFP_HSW_HBP_HI_HFP(n) (((n) & 0x300) >> 4) ++#define HFP_HSW_HBP_HI_HS(n) (((n) & 0x300) >> 6) ++#define HFP_HSW_HBP_HI_HBP(n) (((n) & 0x300) >> 8) + #define VFP 0x27 + #define VSYNC 0x28 + #define VBP 0x29 +@@ -165,6 +168,7 @@ static void chipone_enable(struct drm_bridge *bridge) + { + struct chipone *icn = bridge_to_chipone(bridge); + struct drm_display_mode *mode = bridge_to_mode(bridge); ++ u16 hfp, hbp, hsync; + + ICN6211_DSI(icn, MIPI_CFG_PW, MIPI_CFG_PW_CONFIG_DSI); + +@@ -180,13 +184,18 @@ static void chipone_enable(struct drm_bridge *bridge) + ((mode->hdisplay >> 8) & 0xf) | + (((mode->vdisplay >> 8) & 0xf) << 4)); + +- ICN6211_DSI(icn, HFP_LI, mode->hsync_start - mode->hdisplay); ++ hfp = mode->hsync_start - mode->hdisplay; ++ hsync = mode->hsync_end - mode->hsync_start; ++ hbp = mode->htotal - mode->hsync_end; + +- ICN6211_DSI(icn, HSYNC_LI, mode->hsync_end - mode->hsync_start); +- +- ICN6211_DSI(icn, HBP_LI, mode->htotal - mode->hsync_end); +- +- ICN6211_DSI(icn, HFP_HSW_HBP_HI, 0x00); ++ ICN6211_DSI(icn, HFP_LI, hfp & 0xff); ++ ICN6211_DSI(icn, HSYNC_LI, hsync & 0xff); ++ ICN6211_DSI(icn, HBP_LI, hbp & 0xff); ++ /* Top two bits of Horizontal Front porch/Sync/Back porch */ ++ ICN6211_DSI(icn, HFP_HSW_HBP_HI, ++ HFP_HSW_HBP_HI_HFP(hfp) | ++ HFP_HSW_HBP_HI_HS(hsync) | ++ HFP_HSW_HBP_HI_HBP(hbp)); + + ICN6211_DSI(icn, VFP, mode->vsync_start - mode->vdisplay); + +@@ -196,7 +205,7 @@ static void chipone_enable(struct drm_bridge *bridge) + + /* dsi specific sequence */ + ICN6211_DSI(icn, SYNC_EVENT_DLY, 0x80); +- ICN6211_DSI(icn, HFP_MIN, 0x28); ++ ICN6211_DSI(icn, HFP_MIN, hfp & 0xff); + ICN6211_DSI(icn, MIPI_PD_CK_LANE, 0xa0); + ICN6211_DSI(icn, PLL_CTRL(12), 0xff); + ICN6211_DSI(icn, BIST_POL, BIST_POL_DE_POL); +-- +2.35.1 + diff --git a/queue-5.15/drm-bridge-icn6211-fix-register-layout.patch b/queue-5.15/drm-bridge-icn6211-fix-register-layout.patch new file mode 100644 index 00000000000..a6aafb0d4a6 --- /dev/null +++ b/queue-5.15/drm-bridge-icn6211-fix-register-layout.patch @@ -0,0 +1,212 @@ +From fbad6ccf8226e609a29bab7a62a0a731c22ebd03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 17:04:59 +0200 +Subject: drm: bridge: icn6211: Fix register layout + +From: Marek Vasut + +[ Upstream commit 2dcec57b3734029cc1adc5cb872f61e21609eed4 ] + +The chip register layout has nothing to do with MIPI DCS, the registers +incorrectly marked as MIPI DCS in the driver are regular chip registers +often with completely different function. + +Fill in the actual register names and bits from [1] and [2] and add the +entire register layout, since the documentation for this chip is hard to +come by. + +[1] https://github.com/rockchip-linux/kernel/blob/develop-4.19/drivers/gpu/drm/bridge/icn6211.c +[2] https://github.com/tdjastrzebski/ICN6211-Configurator + +Acked-by: Maxime Ripard +Fixes: ce517f18944e3 ("drm: bridge: Add Chipone ICN6211 MIPI-DSI to RGB bridge") +Signed-off-by: Marek Vasut +Cc: Jagan Teki +Cc: Maxime Ripard +Cc: Robert Foss +Cc: Sam Ravnborg +Cc: Thomas Zimmermann +To: dri-devel@lists.freedesktop.org +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220331150509.9838-2-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/chipone-icn6211.c | 134 ++++++++++++++++++++--- + 1 file changed, 117 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/chipone-icn6211.c b/drivers/gpu/drm/bridge/chipone-icn6211.c +index a6151db95586..eb26615b2993 100644 +--- a/drivers/gpu/drm/bridge/chipone-icn6211.c ++++ b/drivers/gpu/drm/bridge/chipone-icn6211.c +@@ -14,8 +14,19 @@ + #include + #include + +-#include