From: Sasha Levin Date: Mon, 22 Aug 2022 13:27:02 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v4.9.326~29^2~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=34c50d1d41239a4118d6395ecc5dbcd269713d22;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/alsa-control-use-deferred-fasync-helper.patch b/queue-5.15/alsa-control-use-deferred-fasync-helper.patch new file mode 100644 index 00000000000..d1dcac94cb6 --- /dev/null +++ b/queue-5.15/alsa-control-use-deferred-fasync-helper.patch @@ -0,0 +1,81 @@ +From f1457a9c8708ca1bfa8415910cd9f9ce6f6a579e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:45 +0200 +Subject: ALSA: control: Use deferred fasync helper + +From: Takashi Iwai + +[ Upstream commit 4a971e84a7ae10a38d875cd2d4e487c8d1682ca3 ] + +For avoiding the potential deadlock via kill_fasync() call, use the +new fasync helpers to defer the invocation from the control API. Note +that it's merely a workaround. + +Another note: although we haven't received reports about the deadlock +with the control API, the deadlock is still potentially possible, and +it's better to align the behavior with other core APIs (PCM and +timer); so let's move altogether. + +Link: https://lore.kernel.org/r/20220728125945.29533-5-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/control.h | 2 +- + sound/core/control.c | 7 ++++--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/sound/control.h b/include/sound/control.h +index 985c51a8fb74..a1fc7e0a47d9 100644 +--- a/include/sound/control.h ++++ b/include/sound/control.h +@@ -109,7 +109,7 @@ struct snd_ctl_file { + int preferred_subdevice[SND_CTL_SUBDEV_ITEMS]; + wait_queue_head_t change_sleep; + spinlock_t read_lock; +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + int subscribed; /* read interface is activated */ + struct list_head events; /* waiting events for read */ + }; +diff --git a/sound/core/control.c b/sound/core/control.c +index a25c0d64d104..f66fe4be30d3 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -127,6 +127,7 @@ static int snd_ctl_release(struct inode *inode, struct file *file) + if (control->vd[idx].owner == ctl) + control->vd[idx].owner = NULL; + up_write(&card->controls_rwsem); ++ snd_fasync_free(ctl->fasync); + snd_ctl_empty_read_queue(ctl); + put_pid(ctl->pid); + kfree(ctl); +@@ -181,7 +182,7 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask, + _found: + wake_up(&ctl->change_sleep); + spin_unlock(&ctl->read_lock); +- kill_fasync(&ctl->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN); + } + read_unlock_irqrestore(&card->ctl_files_rwlock, flags); + } +@@ -2002,7 +2003,7 @@ static int snd_ctl_fasync(int fd, struct file * file, int on) + struct snd_ctl_file *ctl; + + ctl = file->private_data; +- return fasync_helper(fd, file, on, &ctl->fasync); ++ return snd_fasync_helper(fd, file, on, &ctl->fasync); + } + + /* return the preferred subdevice number if already assigned; +@@ -2170,7 +2171,7 @@ static int snd_ctl_dev_disconnect(struct snd_device *device) + read_lock_irqsave(&card->ctl_files_rwlock, flags); + list_for_each_entry(ctl, &card->ctl_files, list) { + wake_up(&ctl->change_sleep); +- kill_fasync(&ctl->fasync, SIGIO, POLL_ERR); ++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR); + } + read_unlock_irqrestore(&card->ctl_files_rwlock, flags); + +-- +2.35.1 + diff --git a/queue-5.15/alsa-core-add-async-signal-helpers.patch b/queue-5.15/alsa-core-add-async-signal-helpers.patch new file mode 100644 index 00000000000..055a84ff43f --- /dev/null +++ b/queue-5.15/alsa-core-add-async-signal-helpers.patch @@ -0,0 +1,158 @@ +From f7c6bf4902dc07d3a900a4057603afcc2baeb5ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:42 +0200 +Subject: ALSA: core: Add async signal helpers + +From: Takashi Iwai + +[ Upstream commit ef34a0ae7a2654bc9e58675e36898217fb2799d8 ] + +Currently the call of kill_fasync() from an interrupt handler might +lead to potential spin deadlocks, as spotted by syzkaller. +Unfortunately, it's not so trivial to fix this lock chain as it's +involved with the tasklist_lock that is touched in allover places. + +As a temporary workaround, this patch provides the way to defer the +async signal notification in a work. The new helper functions, +snd_fasync_helper() and snd_kill_faync() are replacements for +fasync_helper() and kill_fasync(), respectively. In addition, +snd_fasync_free() needs to be called at the destructor of the relevant +file object. + +Link: https://lore.kernel.org/r/20220728125945.29533-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/core.h | 8 ++++ + sound/core/misc.c | 94 ++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 102 insertions(+) + +diff --git a/include/sound/core.h b/include/sound/core.h +index 6d4cc49584c6..39cee40ac22e 100644 +--- a/include/sound/core.h ++++ b/include/sound/core.h +@@ -501,4 +501,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device, + } + #endif + ++/* async signal helpers */ ++struct snd_fasync; ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp); ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll); ++void snd_fasync_free(struct snd_fasync *fasync); ++ + #endif /* __SOUND_CORE_H */ +diff --git a/sound/core/misc.c b/sound/core/misc.c +index 50e4aaa6270d..d32a19976a2b 100644 +--- a/sound/core/misc.c ++++ b/sound/core/misc.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + + #ifdef CONFIG_SND_DEBUG +@@ -145,3 +146,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list) + } + EXPORT_SYMBOL(snd_pci_quirk_lookup); + #endif ++ ++/* ++ * Deferred async signal helpers ++ * ++ * Below are a few helper functions to wrap the async signal handling ++ * in the deferred work. The main purpose is to avoid the messy deadlock ++ * around tasklist_lock and co at the kill_fasync() invocation. ++ * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper() ++ * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has ++ * to be called at releasing the relevant file object. ++ */ ++struct snd_fasync { ++ struct fasync_struct *fasync; ++ int signal; ++ int poll; ++ int on; ++ struct list_head list; ++}; ++ ++static DEFINE_SPINLOCK(snd_fasync_lock); ++static LIST_HEAD(snd_fasync_list); ++ ++static void snd_fasync_work_fn(struct work_struct *work) ++{ ++ struct snd_fasync *fasync; ++ ++ spin_lock_irq(&snd_fasync_lock); ++ while (!list_empty(&snd_fasync_list)) { ++ fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list); ++ list_del_init(&fasync->list); ++ spin_unlock_irq(&snd_fasync_lock); ++ if (fasync->on) ++ kill_fasync(&fasync->fasync, fasync->signal, fasync->poll); ++ spin_lock_irq(&snd_fasync_lock); ++ } ++ spin_unlock_irq(&snd_fasync_lock); ++} ++ ++static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn); ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp) ++{ ++ struct snd_fasync *fasync = NULL; ++ ++ if (on) { ++ fasync = kzalloc(sizeof(*fasync), GFP_KERNEL); ++ if (!fasync) ++ return -ENOMEM; ++ INIT_LIST_HEAD(&fasync->list); ++ } ++ ++ spin_lock_irq(&snd_fasync_lock); ++ if (*fasyncp) { ++ kfree(fasync); ++ fasync = *fasyncp; ++ } else { ++ if (!fasync) { ++ spin_unlock_irq(&snd_fasync_lock); ++ return 0; ++ } ++ *fasyncp = fasync; ++ } ++ fasync->on = on; ++ spin_unlock_irq(&snd_fasync_lock); ++ return fasync_helper(fd, file, on, &fasync->fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_helper); ++ ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll) ++{ ++ unsigned long flags; ++ ++ if (!fasync || !fasync->on) ++ return; ++ spin_lock_irqsave(&snd_fasync_lock, flags); ++ fasync->signal = signal; ++ fasync->poll = poll; ++ list_move(&fasync->list, &snd_fasync_list); ++ schedule_work(&snd_fasync_work); ++ spin_unlock_irqrestore(&snd_fasync_lock, flags); ++} ++EXPORT_SYMBOL_GPL(snd_kill_fasync); ++ ++void snd_fasync_free(struct snd_fasync *fasync) ++{ ++ if (!fasync) ++ return; ++ fasync->on = 0; ++ flush_work(&snd_fasync_work); ++ kfree(fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_free); +-- +2.35.1 + diff --git a/queue-5.15/alsa-timer-use-deferred-fasync-helper.patch b/queue-5.15/alsa-timer-use-deferred-fasync-helper.patch new file mode 100644 index 00000000000..72f32e2d69a --- /dev/null +++ b/queue-5.15/alsa-timer-use-deferred-fasync-helper.patch @@ -0,0 +1,83 @@ +From 3a26e9f5caa236349612f09492e348744ac389da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:43 +0200 +Subject: ALSA: timer: Use deferred fasync helper + +From: Takashi Iwai + +[ Upstream commit 95cc637c1afd83fb7dd3d7c8a53710488f4caf9c ] + +For avoiding the potential deadlock via kill_fasync() call, use the +new fasync helpers to defer the invocation from PCI API. Note that +it's merely a workaround. + +Reported-by: syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com +Reported-by: syzbot+49b10793b867871ee26f@syzkaller.appspotmail.com +Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20220728125945.29533-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/timer.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index b3214baa8919..e08a37c23add 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -83,7 +83,7 @@ struct snd_timer_user { + unsigned int filter; + struct timespec64 tstamp; /* trigger tstamp */ + wait_queue_head_t qchange_sleep; +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + struct mutex ioctl_lock; + }; + +@@ -1345,7 +1345,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri, + } + __wake: + spin_unlock(&tu->qlock); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1383,7 +1383,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri, + spin_lock_irqsave(&tu->qlock, flags); + snd_timer_user_append_to_tqueue(tu, &r1); + spin_unlock_irqrestore(&tu->qlock, flags); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1453,7 +1453,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri, + spin_unlock(&tu->qlock); + if (append == 0) + return; +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1521,6 +1521,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file) + snd_timer_instance_free(tu->timeri); + } + mutex_unlock(&tu->ioctl_lock); ++ snd_fasync_free(tu->fasync); + kfree(tu->queue); + kfree(tu->tqueue); + kfree(tu); +@@ -2135,7 +2136,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on) + struct snd_timer_user *tu; + + tu = file->private_data; +- return fasync_helper(fd, file, on, &tu->fasync); ++ return snd_fasync_helper(fd, file, on, &tu->fasync); + } + + static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, +-- +2.35.1 + diff --git a/queue-5.15/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch b/queue-5.15/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch new file mode 100644 index 00000000000..510ad25d3a2 --- /dev/null +++ b/queue-5.15/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch @@ -0,0 +1,42 @@ +From 32af554b65dea75b98e4cf48178c6640fb98854a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 06:28:15 +0000 +Subject: ASoC: rsnd: care default case on rsnd_ssiu_busif_err_irq_ctrl() + +From: Kuninori Morimoto + +[ Upstream commit ef30911d3c39fd57884c348c29b9cbff88def155 ] + +Before, ssiu.c didn't care SSI5-8, thus, +commit b1384d4c95088d0 ("ASoC: rsnd: care default case on +rsnd_ssiu_busif_err_status_clear()") cares it for status clear. + +But we should care it for error irq handling, too. +This patch cares it. + +Reported-by: Nguyen Bao Nguyen +Reported-by: Nishiyama Kunihiko +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/871quocio1.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/ssiu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 4b8a63e336c7..d7f4646ee029 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -67,6 +67,8 @@ static void rsnd_ssiu_busif_err_irq_ctrl(struct rsnd_mod *mod, int enable) + shift = 1; + offset = 1; + break; ++ default: ++ return; + } + + for (i = 0; i < 4; i++) { +-- +2.35.1 + diff --git a/queue-5.15/asoc-sof-intel-hda-define-rom_status_reg-in-sof_inte.patch b/queue-5.15/asoc-sof-intel-hda-define-rom_status_reg-in-sof_inte.patch new file mode 100644 index 00000000000..f03c8b275b4 --- /dev/null +++ b/queue-5.15/asoc-sof-intel-hda-define-rom_status_reg-in-sof_inte.patch @@ -0,0 +1,216 @@ +From cf51316ea666d51f55cc0bd722842608fddd080a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 13:48:15 -0500 +Subject: ASoC: SOF: Intel: hda: Define rom_status_reg in sof_intel_dsp_desc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ranjani Sridharan + +[ Upstream commit 71778f7940f0b496aa1ca1134f3b70b425a59bab ] + +Add the rom_status_reg field to struct sof_intel_dsp_desc and define +it for HDA platforms. This will be used to check the ROM status during +FW boot. + +Signed-off-by: Ranjani Sridharan +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20220414184817.362215-14-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/apl.c | 1 + + sound/soc/sof/intel/cnl.c | 2 ++ + sound/soc/sof/intel/hda-loader.c | 14 ++++++++------ + sound/soc/sof/intel/hda.c | 8 ++++++-- + sound/soc/sof/intel/icl.c | 1 + + sound/soc/sof/intel/shim.h | 1 + + sound/soc/sof/intel/tgl.c | 4 ++++ + 7 files changed, 23 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/sof/intel/apl.c b/sound/soc/sof/intel/apl.c +index c7ed2b3d6abc..0a42034c4655 100644 +--- a/sound/soc/sof/intel/apl.c ++++ b/sound/soc/sof/intel/apl.c +@@ -139,6 +139,7 @@ const struct sof_intel_dsp_desc apl_chip_info = { + .ipc_ack = HDA_DSP_REG_HIPCIE, + .ipc_ack_mask = HDA_DSP_REG_HIPCIE_DONE, + .ipc_ctl = HDA_DSP_REG_HIPCCTL, ++ .rom_status_reg = HDA_DSP_SRAM_REG_ROM_STATUS, + .rom_init_timeout = 150, + .ssp_count = APL_SSP_COUNT, + .ssp_base_offset = APL_SSP_BASE_OFFSET, +diff --git a/sound/soc/sof/intel/cnl.c b/sound/soc/sof/intel/cnl.c +index e115e12a856f..a63b235763ed 100644 +--- a/sound/soc/sof/intel/cnl.c ++++ b/sound/soc/sof/intel/cnl.c +@@ -344,6 +344,7 @@ const struct sof_intel_dsp_desc cnl_chip_info = { + .ipc_ack = CNL_DSP_REG_HIPCIDA, + .ipc_ack_mask = CNL_DSP_REG_HIPCIDA_DONE, + .ipc_ctl = CNL_DSP_REG_HIPCCTL, ++ .rom_status_reg = HDA_DSP_SRAM_REG_ROM_STATUS, + .rom_init_timeout = 300, + .ssp_count = CNL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +@@ -363,6 +364,7 @@ const struct sof_intel_dsp_desc jsl_chip_info = { + .ipc_ack = CNL_DSP_REG_HIPCIDA, + .ipc_ack_mask = CNL_DSP_REG_HIPCIDA_DONE, + .ipc_ctl = CNL_DSP_REG_HIPCCTL, ++ .rom_status_reg = HDA_DSP_SRAM_REG_ROM_STATUS, + .rom_init_timeout = 300, + .ssp_count = ICL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +diff --git a/sound/soc/sof/intel/hda-loader.c b/sound/soc/sof/intel/hda-loader.c +index ee09393d42cb..439cb33d2a71 100644 +--- a/sound/soc/sof/intel/hda-loader.c ++++ b/sound/soc/sof/intel/hda-loader.c +@@ -163,7 +163,7 @@ static int cl_dsp_init(struct snd_sof_dev *sdev, int stream_tag) + + /* step 7: wait for ROM init */ + ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, +- HDA_DSP_SRAM_REG_ROM_STATUS, status, ++ chip->rom_status_reg, status, + ((status & HDA_DSP_ROM_STS_MASK) + == HDA_DSP_ROM_INIT), + HDA_DSP_REG_POLL_INTERVAL_US, +@@ -174,8 +174,8 @@ static int cl_dsp_init(struct snd_sof_dev *sdev, int stream_tag) + + if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS) + dev_err(sdev->dev, +- "error: %s: timeout HDA_DSP_SRAM_REG_ROM_STATUS read\n", +- __func__); ++ "%s: timeout with rom_status_reg (%#x) read\n", ++ __func__, chip->rom_status_reg); + + err: + flags = SOF_DBG_DUMP_REGS | SOF_DBG_DUMP_PCI | SOF_DBG_DUMP_MBOX; +@@ -251,6 +251,8 @@ static int cl_cleanup(struct snd_sof_dev *sdev, struct snd_dma_buffer *dmab, + + static int cl_copy_fw(struct snd_sof_dev *sdev, struct hdac_ext_stream *stream) + { ++ struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata; ++ const struct sof_intel_dsp_desc *chip = hda->desc; + unsigned int reg; + int ret, status; + +@@ -261,7 +263,7 @@ static int cl_copy_fw(struct snd_sof_dev *sdev, struct hdac_ext_stream *stream) + } + + status = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, +- HDA_DSP_SRAM_REG_ROM_STATUS, reg, ++ chip->rom_status_reg, reg, + ((reg & HDA_DSP_ROM_STS_MASK) + == HDA_DSP_ROM_FW_ENTERED), + HDA_DSP_REG_POLL_INTERVAL_US, +@@ -274,8 +276,8 @@ static int cl_copy_fw(struct snd_sof_dev *sdev, struct hdac_ext_stream *stream) + + if (status < 0) { + dev_err(sdev->dev, +- "error: %s: timeout HDA_DSP_SRAM_REG_ROM_STATUS read\n", +- __func__); ++ "%s: timeout with rom_status_reg (%#x) read\n", ++ __func__, chip->rom_status_reg); + } + + ret = cl_trigger(sdev, stream, SNDRV_PCM_TRIGGER_STOP); +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index ddf70902e53c..e733c401562f 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -353,11 +353,13 @@ static const struct hda_dsp_msg_code hda_dsp_rom_msg[] = { + + static void hda_dsp_get_status(struct snd_sof_dev *sdev) + { ++ const struct sof_intel_dsp_desc *chip; + u32 status; + int i; + ++ chip = get_chip_info(sdev->pdata); + status = snd_sof_dsp_read(sdev, HDA_DSP_BAR, +- HDA_DSP_SRAM_REG_ROM_STATUS); ++ chip->rom_status_reg); + + for (i = 0; i < ARRAY_SIZE(hda_dsp_rom_msg); i++) { + if (status == hda_dsp_rom_msg[i].code) { +@@ -402,13 +404,15 @@ static void hda_dsp_get_registers(struct snd_sof_dev *sdev, + /* dump the first 8 dwords representing the extended ROM status */ + static void hda_dsp_dump_ext_rom_status(struct snd_sof_dev *sdev, u32 flags) + { ++ const struct sof_intel_dsp_desc *chip; + char msg[128]; + int len = 0; + u32 value; + int i; + ++ chip = get_chip_info(sdev->pdata); + for (i = 0; i < HDA_EXT_ROM_STATUS_SIZE; i++) { +- value = snd_sof_dsp_read(sdev, HDA_DSP_BAR, HDA_DSP_SRAM_REG_ROM_STATUS + i * 0x4); ++ value = snd_sof_dsp_read(sdev, HDA_DSP_BAR, chip->rom_status_reg + i * 0x4); + len += snprintf(msg + len, sizeof(msg) - len, " 0x%x", value); + } + +diff --git a/sound/soc/sof/intel/icl.c b/sound/soc/sof/intel/icl.c +index ee095b8f2d01..4065c4d3912a 100644 +--- a/sound/soc/sof/intel/icl.c ++++ b/sound/soc/sof/intel/icl.c +@@ -139,6 +139,7 @@ const struct sof_intel_dsp_desc icl_chip_info = { + .ipc_ack = CNL_DSP_REG_HIPCIDA, + .ipc_ack_mask = CNL_DSP_REG_HIPCIDA_DONE, + .ipc_ctl = CNL_DSP_REG_HIPCCTL, ++ .rom_status_reg = HDA_DSP_SRAM_REG_ROM_STATUS, + .rom_init_timeout = 300, + .ssp_count = ICL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +diff --git a/sound/soc/sof/intel/shim.h b/sound/soc/sof/intel/shim.h +index e9f7d4d7fcce..96707758ebc5 100644 +--- a/sound/soc/sof/intel/shim.h ++++ b/sound/soc/sof/intel/shim.h +@@ -161,6 +161,7 @@ struct sof_intel_dsp_desc { + int ipc_ack; + int ipc_ack_mask; + int ipc_ctl; ++ int rom_status_reg; + int rom_init_timeout; + int ssp_count; /* ssp count of the platform */ + int ssp_base_offset; /* base address of the SSPs */ +diff --git a/sound/soc/sof/intel/tgl.c b/sound/soc/sof/intel/tgl.c +index 199d41a7dc9b..aba52d8628aa 100644 +--- a/sound/soc/sof/intel/tgl.c ++++ b/sound/soc/sof/intel/tgl.c +@@ -134,6 +134,7 @@ const struct sof_intel_dsp_desc tgl_chip_info = { + .ipc_ack = CNL_DSP_REG_HIPCIDA, + .ipc_ack_mask = CNL_DSP_REG_HIPCIDA_DONE, + .ipc_ctl = CNL_DSP_REG_HIPCCTL, ++ .rom_status_reg = HDA_DSP_SRAM_REG_ROM_STATUS, + .rom_init_timeout = 300, + .ssp_count = ICL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +@@ -153,6 +154,7 @@ const struct sof_intel_dsp_desc tglh_chip_info = { + .ipc_ack = CNL_DSP_REG_HIPCIDA, + .ipc_ack_mask = CNL_DSP_REG_HIPCIDA_DONE, + .ipc_ctl = CNL_DSP_REG_HIPCCTL, ++ .rom_status_reg = HDA_DSP_SRAM_REG_ROM_STATUS, + .rom_init_timeout = 300, + .ssp_count = ICL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +@@ -172,6 +174,7 @@ const struct sof_intel_dsp_desc ehl_chip_info = { + .ipc_ack = CNL_DSP_REG_HIPCIDA, + .ipc_ack_mask = CNL_DSP_REG_HIPCIDA_DONE, + .ipc_ctl = CNL_DSP_REG_HIPCCTL, ++ .rom_status_reg = HDA_DSP_SRAM_REG_ROM_STATUS, + .rom_init_timeout = 300, + .ssp_count = ICL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +@@ -191,6 +194,7 @@ const struct sof_intel_dsp_desc adls_chip_info = { + .ipc_ack = CNL_DSP_REG_HIPCIDA, + .ipc_ack_mask = CNL_DSP_REG_HIPCIDA_DONE, + .ipc_ctl = CNL_DSP_REG_HIPCCTL, ++ .rom_status_reg = HDA_DSP_SRAM_REG_ROM_STATUS, + .rom_init_timeout = 300, + .ssp_count = ICL_SSP_COUNT, + .ssp_base_offset = CNL_SSP_BASE_OFFSET, +-- +2.35.1 + diff --git a/queue-5.15/asoc-sof-intel-hda-fix-potential-buffer-overflow-by-.patch b/queue-5.15/asoc-sof-intel-hda-fix-potential-buffer-overflow-by-.patch new file mode 100644 index 00000000000..6beaa4991fb --- /dev/null +++ b/queue-5.15/asoc-sof-intel-hda-fix-potential-buffer-overflow-by-.patch @@ -0,0 +1,41 @@ +From 6d22729981d69089d4476ceae9263996fb2894f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 18:54:20 +0200 +Subject: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() + +From: Takashi Iwai + +[ Upstream commit 94c1ceb043c1a002de9649bb630c8e8347645982 ] + +snprintf() returns the would-be-filled size when the string overflows +the given buffer size, hence using this value may result in the buffer +overflow (although it's unrealistic). + +This patch replaces with a safer version, scnprintf() for papering +over such a potential issue. + +Fixes: 29c8e4398f02 ("ASoC: SOF: Intel: hda: add extended rom status dump to error log") +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20220801165420.25978-4-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index e733c401562f..35cbef171f4a 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -413,7 +413,7 @@ static void hda_dsp_dump_ext_rom_status(struct snd_sof_dev *sdev, u32 flags) + chip = get_chip_info(sdev->pdata); + for (i = 0; i < HDA_EXT_ROM_STATUS_SIZE; i++) { + value = snd_sof_dsp_read(sdev, HDA_DSP_BAR, chip->rom_status_reg + i * 0x4); +- len += snprintf(msg + len, sizeof(msg) - len, " 0x%x", value); ++ len += scnprintf(msg + len, sizeof(msg) - len, " 0x%x", value); + } + + sof_dev_dbg_or_err(sdev->dev, flags & SOF_DBG_DUMP_FORCE_ERR_LEVEL, +-- +2.35.1 + diff --git a/queue-5.15/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch b/queue-5.15/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch new file mode 100644 index 00000000000..db567c808ed --- /dev/null +++ b/queue-5.15/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch @@ -0,0 +1,40 @@ +From 600de205056c1f0ad891dda288322280007ed69d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 09:27:11 +0300 +Subject: clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description + +From: Vladimir Zapolskiy + +[ Upstream commit 94bed9bb05c7850ff5d80b87cc29004901f37956 ] + +After merging lucid and trion pll functions in commit 0b01489475c6 +("clk: qcom: clk-alpha-pll: same regs and ops for trion and lucid") +the function clk_trion_pll_configure() is left with an old description +header, which results in a W=2 compile time warning, fix it. + +Acked-by: Stephen Boyd +Reviewed-by: Vinod Koul +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220701062711.2757855-1-vladimir.zapolskiy@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-alpha-pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c +index 8f65b9bdafce..5e44ceb730ad 100644 +--- a/drivers/clk/qcom/clk-alpha-pll.c ++++ b/drivers/clk/qcom/clk-alpha-pll.c +@@ -1420,7 +1420,7 @@ const struct clk_ops clk_alpha_pll_postdiv_fabia_ops = { + EXPORT_SYMBOL_GPL(clk_alpha_pll_postdiv_fabia_ops); + + /** +- * clk_lucid_pll_configure - configure the lucid pll ++ * clk_trion_pll_configure - configure the trion pll + * + * @pll: clk alpha pll + * @regmap: register map +-- +2.35.1 + diff --git a/queue-5.15/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch b/queue-5.15/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch new file mode 100644 index 00000000000..50241cd1e22 --- /dev/null +++ b/queue-5.15/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch @@ -0,0 +1,85 @@ +From b841459f63074eb2e66afbd4c3a259407a28bb93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 May 2022 23:00:47 +0200 +Subject: clk: qcom: ipq8074: dont disable gcc_sleep_clk_src + +From: Robert Marko + +[ Upstream commit 1bf7305e79aab095196131bdc87a97796e0e3fac ] + +Once the usb sleep clocks are disabled, clock framework is trying to +disable the sleep clock source also. + +However, it seems that it cannot be disabled and trying to do so produces: +[ 245.436390] ------------[ cut here ]------------ +[ 245.441233] gcc_sleep_clk_src status stuck at 'on' +[ 245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140 +[ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio +[ 245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215 +[ 245.463889] Hardware name: Xiaomi AX9000 (DT) +[ 245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 245.474307] pc : clk_branch_wait+0x130/0x140 +[ 245.481073] lr : clk_branch_wait+0x130/0x140 +[ 245.485588] sp : ffffffc009f2bad0 +[ 245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000 +[ 245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20 +[ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0 +[ 245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7 +[ 245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777 +[ 245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129 +[ 245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001 +[ 245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001 +[ 245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027 +[ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026 +[ 245.557122] Call trace: +[ 245.564229] clk_branch_wait+0x130/0x140 +[ 245.566490] clk_branch2_disable+0x2c/0x40 +[ 245.570656] clk_core_disable+0x60/0xb0 +[ 245.574561] clk_core_disable+0x68/0xb0 +[ 245.578293] clk_disable+0x30/0x50 +[ 245.582113] dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom] +[ 245.585588] platform_remove+0x28/0x60 +[ 245.590361] device_remove+0x4c/0x80 +[ 245.594179] device_release_driver_internal+0x1dc/0x230 +[ 245.597914] device_driver_detach+0x18/0x30 +[ 245.602861] unbind_store+0xec/0x110 +[ 245.607027] drv_attr_store+0x24/0x40 +[ 245.610847] sysfs_kf_write+0x44/0x60 +[ 245.614405] kernfs_fop_write_iter+0x128/0x1c0 +[ 245.618052] new_sync_write+0xc0/0x130 +[ 245.622391] vfs_write+0x1d4/0x2a0 +[ 245.626123] ksys_write+0x58/0xe0 +[ 245.629508] __arm64_sys_write+0x1c/0x30 +[ 245.632895] invoke_syscall.constprop.0+0x5c/0x110 +[ 245.636890] do_el0_svc+0xa0/0x150 +[ 245.641488] el0_svc+0x18/0x60 +[ 245.644872] el0t_64_sync_handler+0xa4/0x130 +[ 245.647914] el0t_64_sync+0x174/0x178 +[ 245.652340] ---[ end trace 0000000000000000 ]--- + +So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try +to disable the sleep clock. + +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220515210048.483898-10-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index 2c2ecfc5e61f..d6d5defb82c9 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -662,6 +662,7 @@ static struct clk_branch gcc_sleep_clk_src = { + }, + .num_parents = 1, + .ops = &clk_branch2_ops, ++ .flags = CLK_IS_CRITICAL, + }, + }, + }; +-- +2.35.1 + diff --git a/queue-5.15/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch b/queue-5.15/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch new file mode 100644 index 00000000000..67e1e4f9501 --- /dev/null +++ b/queue-5.15/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch @@ -0,0 +1,682 @@ +From 9768342a7bfc690ed0a35b20067671c1f2a2ac62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 09:43:06 +0300 +Subject: clk: ti: Stop using legacy clkctrl names for omap4 and 5 + +From: Tony Lindgren + +[ Upstream commit 255584b138343d4a28c6d25bd82d04b09460d672 ] + +With the addition of clock-output-names, we can now unify the internal +clock naming for omap4 and 5 to follow the other TI SoCs. + +We are still using legacy clkctrl names for omap4 and 5 based on the clock +manager name which is wrong. Instead, we want to use the clkctrl clock +based naming. + +We must now also drop the legacy TI_CLK_CLKCTRL_COMPAT quirk for the +clkctrl clock. + +This change will allow further devicetree warning cleanup as already +done for am3/4 and dra7. + +Cc: linux-clk@vger.kernel.org +Cc: Stephen Boyd +Cc: Tero Kristo +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20220615064306.22254-1-tony@atomide.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-44xx.c | 210 +++++++++++++++++++------------------- + drivers/clk/ti/clk-54xx.c | 160 ++++++++++++++--------------- + drivers/clk/ti/clkctrl.c | 4 - + 3 files changed, 185 insertions(+), 189 deletions(-) + +diff --git a/drivers/clk/ti/clk-44xx.c b/drivers/clk/ti/clk-44xx.c +index d078e5d73ed9..868bc7af21b0 100644 +--- a/drivers/clk/ti/clk-44xx.c ++++ b/drivers/clk/ti/clk-44xx.c +@@ -56,7 +56,7 @@ static const struct omap_clkctrl_bit_data omap4_aess_bit_data[] __initconst = { + }; + + static const char * const omap4_func_dmic_abe_gfclk_parents[] __initconst = { +- "abe_cm:clk:0018:26", ++ "abe-clkctrl:0018:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -76,7 +76,7 @@ static const struct omap_clkctrl_bit_data omap4_dmic_bit_data[] __initconst = { + }; + + static const char * const omap4_func_mcasp_abe_gfclk_parents[] __initconst = { +- "abe_cm:clk:0020:26", ++ "abe-clkctrl:0020:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -89,7 +89,7 @@ static const struct omap_clkctrl_bit_data omap4_mcasp_bit_data[] __initconst = { + }; + + static const char * const omap4_func_mcbsp1_gfclk_parents[] __initconst = { +- "abe_cm:clk:0028:26", ++ "abe-clkctrl:0028:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -102,7 +102,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp1_bit_data[] __initconst = + }; + + static const char * const omap4_func_mcbsp2_gfclk_parents[] __initconst = { +- "abe_cm:clk:0030:26", ++ "abe-clkctrl:0030:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -115,7 +115,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp2_bit_data[] __initconst = + }; + + static const char * const omap4_func_mcbsp3_gfclk_parents[] __initconst = { +- "abe_cm:clk:0038:26", ++ "abe-clkctrl:0038:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -183,18 +183,18 @@ static const struct omap_clkctrl_bit_data omap4_timer8_bit_data[] __initconst = + + static const struct omap_clkctrl_reg_data omap4_abe_clkctrl_regs[] __initconst = { + { OMAP4_L4_ABE_CLKCTRL, NULL, 0, "ocp_abe_iclk" }, +- { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" }, ++ { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" }, + { OMAP4_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" }, +- { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" }, +- { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe_cm:clk:0020:24" }, +- { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" }, +- { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" }, +- { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" }, +- { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0040:8" }, +- { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" }, +- { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" }, +- { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" }, +- { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" }, ++ { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" }, ++ { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe-clkctrl:0020:24" }, ++ { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" }, ++ { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" }, ++ { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" }, ++ { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0040:8" }, ++ { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" }, ++ { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" }, ++ { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" }, ++ { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" }, + { OMAP4_WD_TIMER3_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, + }; +@@ -287,7 +287,7 @@ static const struct omap_clkctrl_bit_data omap4_fdif_bit_data[] __initconst = { + + static const struct omap_clkctrl_reg_data omap4_iss_clkctrl_regs[] __initconst = { + { OMAP4_ISS_CLKCTRL, omap4_iss_bit_data, CLKF_SW_SUP, "ducati_clk_mux_ck" }, +- { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss_cm:clk:0008:24" }, ++ { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss-clkctrl:0008:24" }, + { 0 }, + }; + +@@ -320,7 +320,7 @@ static const struct omap_clkctrl_bit_data omap4_dss_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap4_l3_dss_clkctrl_regs[] __initconst = { +- { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3_dss_cm:clk:0000:8" }, ++ { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3-dss-clkctrl:0000:8" }, + { 0 }, + }; + +@@ -336,7 +336,7 @@ static const struct omap_clkctrl_bit_data omap4_gpu_bit_data[] __initconst = { + }; + + static const struct omap_clkctrl_reg_data omap4_l3_gfx_clkctrl_regs[] __initconst = { +- { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3_gfx_cm:clk:0000:24" }, ++ { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3-gfx-clkctrl:0000:24" }, + { 0 }, + }; + +@@ -372,12 +372,12 @@ static const struct omap_clkctrl_bit_data omap4_hsi_bit_data[] __initconst = { + }; + + static const char * const omap4_usb_host_hs_utmi_p1_clk_parents[] __initconst = { +- "l3_init_cm:clk:0038:24", ++ "l3-init-clkctrl:0038:24", + NULL, + }; + + static const char * const omap4_usb_host_hs_utmi_p2_clk_parents[] __initconst = { +- "l3_init_cm:clk:0038:25", ++ "l3-init-clkctrl:0038:25", + NULL, + }; + +@@ -418,7 +418,7 @@ static const struct omap_clkctrl_bit_data omap4_usb_host_hs_bit_data[] __initcon + }; + + static const char * const omap4_usb_otg_hs_xclk_parents[] __initconst = { +- "l3_init_cm:clk:0040:24", ++ "l3-init-clkctrl:0040:24", + NULL, + }; + +@@ -452,14 +452,14 @@ static const struct omap_clkctrl_bit_data omap4_ocp2scp_usb_phy_bit_data[] __ini + }; + + static const struct omap_clkctrl_reg_data omap4_l3_init_clkctrl_regs[] __initconst = { +- { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0008:24" }, +- { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0010:24" }, +- { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:0018:24" }, ++ { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0008:24" }, ++ { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0010:24" }, ++ { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:0018:24" }, + { OMAP4_USB_HOST_HS_CLKCTRL, omap4_usb_host_hs_bit_data, CLKF_SW_SUP, "init_60m_fclk" }, + { OMAP4_USB_OTG_HS_CLKCTRL, omap4_usb_otg_hs_bit_data, CLKF_HW_SUP, "l3_div_ck" }, + { OMAP4_USB_TLL_HS_CLKCTRL, omap4_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_div_ck" }, + { OMAP4_USB_HOST_FS_CLKCTRL, NULL, CLKF_SW_SUP, "func_48mc_fclk" }, +- { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:00c0:8" }, ++ { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:00c0:8" }, + { 0 }, + }; + +@@ -530,7 +530,7 @@ static const struct omap_clkctrl_bit_data omap4_gpio6_bit_data[] __initconst = { + }; + + static const char * const omap4_per_mcbsp4_gfclk_parents[] __initconst = { +- "l4_per_cm:clk:00c0:26", ++ "l4-per-clkctrl:00c0:26", + "pad_clks_ck", + NULL, + }; +@@ -570,12 +570,12 @@ static const struct omap_clkctrl_bit_data omap4_slimbus2_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initconst = { +- { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0008:24" }, +- { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0010:24" }, +- { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0018:24" }, +- { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0020:24" }, +- { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0028:24" }, +- { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0030:24" }, ++ { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0008:24" }, ++ { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0010:24" }, ++ { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0018:24" }, ++ { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0020:24" }, ++ { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0028:24" }, ++ { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0030:24" }, + { OMAP4_ELM_CLKCTRL, NULL, 0, "l4_div_ck" }, + { OMAP4_GPIO2_CLKCTRL, omap4_gpio2_bit_data, CLKF_HW_SUP, "l4_div_ck" }, + { OMAP4_GPIO3_CLKCTRL, omap4_gpio3_bit_data, CLKF_HW_SUP, "l4_div_ck" }, +@@ -588,14 +588,14 @@ static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initcons + { OMAP4_I2C3_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" }, + { OMAP4_I2C4_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" }, + { OMAP4_L4_PER_CLKCTRL, NULL, 0, "l4_div_ck" }, +- { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:00c0:24" }, ++ { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:00c0:24" }, + { OMAP4_MCSPI1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MMC3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MMC4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, +- { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0118:8" }, ++ { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0118:8" }, + { OMAP4_UART1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_UART2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_UART3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, +@@ -630,7 +630,7 @@ static const struct omap_clkctrl_reg_data omap4_l4_wkup_clkctrl_regs[] __initcon + { OMAP4_L4_WKUP_CLKCTRL, NULL, 0, "l4_wkup_clk_mux_ck" }, + { OMAP4_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { OMAP4_GPIO1_CLKCTRL, omap4_gpio1_bit_data, CLKF_HW_SUP, "l4_wkup_clk_mux_ck" }, +- { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4_wkup_cm:clk:0020:24" }, ++ { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4-wkup-clkctrl:0020:24" }, + { OMAP4_COUNTER_32K_CLKCTRL, NULL, 0, "sys_32k_ck" }, + { OMAP4_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, +@@ -644,7 +644,7 @@ static const char * const omap4_pmd_stm_clock_mux_ck_parents[] __initconst = { + }; + + static const char * const omap4_trace_clk_div_div_ck_parents[] __initconst = { +- "emu_sys_cm:clk:0000:22", ++ "emu-sys-clkctrl:0000:22", + NULL, + }; + +@@ -662,7 +662,7 @@ static const struct omap_clkctrl_div_data omap4_trace_clk_div_div_ck_data __init + }; + + static const char * const omap4_stm_clk_div_ck_parents[] __initconst = { +- "emu_sys_cm:clk:0000:20", ++ "emu-sys-clkctrl:0000:20", + NULL, + }; + +@@ -716,73 +716,73 @@ static struct ti_dt_clk omap44xx_clks[] = { + * hwmod support. Once hwmod is removed, these can be removed + * also. + */ +- DT_CLK(NULL, "aess_fclk", "abe_cm:0008:24"), +- DT_CLK(NULL, "cm2_dm10_mux", "l4_per_cm:0008:24"), +- DT_CLK(NULL, "cm2_dm11_mux", "l4_per_cm:0010:24"), +- DT_CLK(NULL, "cm2_dm2_mux", "l4_per_cm:0018:24"), +- DT_CLK(NULL, "cm2_dm3_mux", "l4_per_cm:0020:24"), +- DT_CLK(NULL, "cm2_dm4_mux", "l4_per_cm:0028:24"), +- DT_CLK(NULL, "cm2_dm9_mux", "l4_per_cm:0030:24"), +- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"), +- DT_CLK(NULL, "dmt1_clk_mux", "l4_wkup_cm:0020:24"), +- DT_CLK(NULL, "dss_48mhz_clk", "l3_dss_cm:0000:9"), +- DT_CLK(NULL, "dss_dss_clk", "l3_dss_cm:0000:8"), +- DT_CLK(NULL, "dss_sys_clk", "l3_dss_cm:0000:10"), +- DT_CLK(NULL, "dss_tv_clk", "l3_dss_cm:0000:11"), +- DT_CLK(NULL, "fdif_fck", "iss_cm:0008:24"), +- DT_CLK(NULL, "func_dmic_abe_gfclk", "abe_cm:0018:24"), +- DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe_cm:0020:24"), +- DT_CLK(NULL, "func_mcbsp1_gfclk", "abe_cm:0028:24"), +- DT_CLK(NULL, "func_mcbsp2_gfclk", "abe_cm:0030:24"), +- DT_CLK(NULL, "func_mcbsp3_gfclk", "abe_cm:0038:24"), +- DT_CLK(NULL, "gpio1_dbclk", "l4_wkup_cm:0018:8"), +- DT_CLK(NULL, "gpio2_dbclk", "l4_per_cm:0040:8"), +- DT_CLK(NULL, "gpio3_dbclk", "l4_per_cm:0048:8"), +- DT_CLK(NULL, "gpio4_dbclk", "l4_per_cm:0050:8"), +- DT_CLK(NULL, "gpio5_dbclk", "l4_per_cm:0058:8"), +- DT_CLK(NULL, "gpio6_dbclk", "l4_per_cm:0060:8"), +- DT_CLK(NULL, "hsi_fck", "l3_init_cm:0018:24"), +- DT_CLK(NULL, "hsmmc1_fclk", "l3_init_cm:0008:24"), +- DT_CLK(NULL, "hsmmc2_fclk", "l3_init_cm:0010:24"), +- DT_CLK(NULL, "iss_ctrlclk", "iss_cm:0000:8"), +- DT_CLK(NULL, "mcasp_sync_mux_ck", "abe_cm:0020:26"), +- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"), +- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"), +- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"), +- DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4_per_cm:00c0:26"), +- DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3_init_cm:00c0:8"), +- DT_CLK(NULL, "otg_60m_gfclk", "l3_init_cm:0040:24"), +- DT_CLK(NULL, "per_mcbsp4_gfclk", "l4_per_cm:00c0:24"), +- DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu_sys_cm:0000:20"), +- DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu_sys_cm:0000:22"), +- DT_CLK(NULL, "sgx_clk_mux", "l3_gfx_cm:0000:24"), +- DT_CLK(NULL, "slimbus1_fclk_0", "abe_cm:0040:8"), +- DT_CLK(NULL, "slimbus1_fclk_1", "abe_cm:0040:9"), +- DT_CLK(NULL, "slimbus1_fclk_2", "abe_cm:0040:10"), +- DT_CLK(NULL, "slimbus1_slimbus_clk", "abe_cm:0040:11"), +- DT_CLK(NULL, "slimbus2_fclk_0", "l4_per_cm:0118:8"), +- DT_CLK(NULL, "slimbus2_fclk_1", "l4_per_cm:0118:9"), +- DT_CLK(NULL, "slimbus2_slimbus_clk", "l4_per_cm:0118:10"), +- DT_CLK(NULL, "stm_clk_div_ck", "emu_sys_cm:0000:27"), +- DT_CLK(NULL, "timer5_sync_mux", "abe_cm:0048:24"), +- DT_CLK(NULL, "timer6_sync_mux", "abe_cm:0050:24"), +- DT_CLK(NULL, "timer7_sync_mux", "abe_cm:0058:24"), +- DT_CLK(NULL, "timer8_sync_mux", "abe_cm:0060:24"), +- DT_CLK(NULL, "trace_clk_div_div_ck", "emu_sys_cm:0000:24"), +- DT_CLK(NULL, "usb_host_hs_func48mclk", "l3_init_cm:0038:15"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3_init_cm:0038:13"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3_init_cm:0038:14"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3_init_cm:0038:11"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3_init_cm:0038:12"), +- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3_init_cm:0038:8"), +- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3_init_cm:0038:9"), +- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init_cm:0038:10"), +- DT_CLK(NULL, "usb_otg_hs_xclk", "l3_init_cm:0040:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3_init_cm:0048:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3_init_cm:0048:9"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3_init_cm:0048:10"), +- DT_CLK(NULL, "utmi_p1_gfclk", "l3_init_cm:0038:24"), +- DT_CLK(NULL, "utmi_p2_gfclk", "l3_init_cm:0038:25"), ++ DT_CLK(NULL, "aess_fclk", "abe-clkctrl:0008:24"), ++ DT_CLK(NULL, "cm2_dm10_mux", "l4-per-clkctrl:0008:24"), ++ DT_CLK(NULL, "cm2_dm11_mux", "l4-per-clkctrl:0010:24"), ++ DT_CLK(NULL, "cm2_dm2_mux", "l4-per-clkctrl:0018:24"), ++ DT_CLK(NULL, "cm2_dm3_mux", "l4-per-clkctrl:0020:24"), ++ DT_CLK(NULL, "cm2_dm4_mux", "l4-per-clkctrl:0028:24"), ++ DT_CLK(NULL, "cm2_dm9_mux", "l4-per-clkctrl:0030:24"), ++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"), ++ DT_CLK(NULL, "dmt1_clk_mux", "l4-wkup-clkctrl:0020:24"), ++ DT_CLK(NULL, "dss_48mhz_clk", "l3-dss-clkctrl:0000:9"), ++ DT_CLK(NULL, "dss_dss_clk", "l3-dss-clkctrl:0000:8"), ++ DT_CLK(NULL, "dss_sys_clk", "l3-dss-clkctrl:0000:10"), ++ DT_CLK(NULL, "dss_tv_clk", "l3-dss-clkctrl:0000:11"), ++ DT_CLK(NULL, "fdif_fck", "iss-clkctrl:0008:24"), ++ DT_CLK(NULL, "func_dmic_abe_gfclk", "abe-clkctrl:0018:24"), ++ DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe-clkctrl:0020:24"), ++ DT_CLK(NULL, "func_mcbsp1_gfclk", "abe-clkctrl:0028:24"), ++ DT_CLK(NULL, "func_mcbsp2_gfclk", "abe-clkctrl:0030:24"), ++ DT_CLK(NULL, "func_mcbsp3_gfclk", "abe-clkctrl:0038:24"), ++ DT_CLK(NULL, "gpio1_dbclk", "l4-wkup-clkctrl:0018:8"), ++ DT_CLK(NULL, "gpio2_dbclk", "l4-per-clkctrl:0040:8"), ++ DT_CLK(NULL, "gpio3_dbclk", "l4-per-clkctrl:0048:8"), ++ DT_CLK(NULL, "gpio4_dbclk", "l4-per-clkctrl:0050:8"), ++ DT_CLK(NULL, "gpio5_dbclk", "l4-per-clkctrl:0058:8"), ++ DT_CLK(NULL, "gpio6_dbclk", "l4-per-clkctrl:0060:8"), ++ DT_CLK(NULL, "hsi_fck", "l3-init-clkctrl:0018:24"), ++ DT_CLK(NULL, "hsmmc1_fclk", "l3-init-clkctrl:0008:24"), ++ DT_CLK(NULL, "hsmmc2_fclk", "l3-init-clkctrl:0010:24"), ++ DT_CLK(NULL, "iss_ctrlclk", "iss-clkctrl:0000:8"), ++ DT_CLK(NULL, "mcasp_sync_mux_ck", "abe-clkctrl:0020:26"), ++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"), ++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"), ++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"), ++ DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4-per-clkctrl:00c0:26"), ++ DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3-init-clkctrl:00c0:8"), ++ DT_CLK(NULL, "otg_60m_gfclk", "l3-init-clkctrl:0040:24"), ++ DT_CLK(NULL, "per_mcbsp4_gfclk", "l4-per-clkctrl:00c0:24"), ++ DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu-sys-clkctrl:0000:20"), ++ DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu-sys-clkctrl:0000:22"), ++ DT_CLK(NULL, "sgx_clk_mux", "l3-gfx-clkctrl:0000:24"), ++ DT_CLK(NULL, "slimbus1_fclk_0", "abe-clkctrl:0040:8"), ++ DT_CLK(NULL, "slimbus1_fclk_1", "abe-clkctrl:0040:9"), ++ DT_CLK(NULL, "slimbus1_fclk_2", "abe-clkctrl:0040:10"), ++ DT_CLK(NULL, "slimbus1_slimbus_clk", "abe-clkctrl:0040:11"), ++ DT_CLK(NULL, "slimbus2_fclk_0", "l4-per-clkctrl:0118:8"), ++ DT_CLK(NULL, "slimbus2_fclk_1", "l4-per-clkctrl:0118:9"), ++ DT_CLK(NULL, "slimbus2_slimbus_clk", "l4-per-clkctrl:0118:10"), ++ DT_CLK(NULL, "stm_clk_div_ck", "emu-sys-clkctrl:0000:27"), ++ DT_CLK(NULL, "timer5_sync_mux", "abe-clkctrl:0048:24"), ++ DT_CLK(NULL, "timer6_sync_mux", "abe-clkctrl:0050:24"), ++ DT_CLK(NULL, "timer7_sync_mux", "abe-clkctrl:0058:24"), ++ DT_CLK(NULL, "timer8_sync_mux", "abe-clkctrl:0060:24"), ++ DT_CLK(NULL, "trace_clk_div_div_ck", "emu-sys-clkctrl:0000:24"), ++ DT_CLK(NULL, "usb_host_hs_func48mclk", "l3-init-clkctrl:0038:15"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3-init-clkctrl:0038:13"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3-init-clkctrl:0038:14"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3-init-clkctrl:0038:11"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3-init-clkctrl:0038:12"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3-init-clkctrl:0038:8"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3-init-clkctrl:0038:9"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init-clkctrl:0038:10"), ++ DT_CLK(NULL, "usb_otg_hs_xclk", "l3-init-clkctrl:0040:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3-init-clkctrl:0048:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3-init-clkctrl:0048:9"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3-init-clkctrl:0048:10"), ++ DT_CLK(NULL, "utmi_p1_gfclk", "l3-init-clkctrl:0038:24"), ++ DT_CLK(NULL, "utmi_p2_gfclk", "l3-init-clkctrl:0038:25"), + { .node_name = NULL }, + }; + +diff --git a/drivers/clk/ti/clk-54xx.c b/drivers/clk/ti/clk-54xx.c +index 90e0a9ea6351..b4aff76eb373 100644 +--- a/drivers/clk/ti/clk-54xx.c ++++ b/drivers/clk/ti/clk-54xx.c +@@ -50,7 +50,7 @@ static const struct omap_clkctrl_bit_data omap5_aess_bit_data[] __initconst = { + }; + + static const char * const omap5_dmic_gfclk_parents[] __initconst = { +- "abe_cm:clk:0018:26", ++ "abe-clkctrl:0018:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -70,7 +70,7 @@ static const struct omap_clkctrl_bit_data omap5_dmic_bit_data[] __initconst = { + }; + + static const char * const omap5_mcbsp1_gfclk_parents[] __initconst = { +- "abe_cm:clk:0028:26", ++ "abe-clkctrl:0028:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -83,7 +83,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp1_bit_data[] __initconst = + }; + + static const char * const omap5_mcbsp2_gfclk_parents[] __initconst = { +- "abe_cm:clk:0030:26", ++ "abe-clkctrl:0030:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -96,7 +96,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp2_bit_data[] __initconst = + }; + + static const char * const omap5_mcbsp3_gfclk_parents[] __initconst = { +- "abe_cm:clk:0038:26", ++ "abe-clkctrl:0038:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -136,16 +136,16 @@ static const struct omap_clkctrl_bit_data omap5_timer8_bit_data[] __initconst = + + static const struct omap_clkctrl_reg_data omap5_abe_clkctrl_regs[] __initconst = { + { OMAP5_L4_ABE_CLKCTRL, NULL, 0, "abe_iclk" }, +- { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" }, ++ { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" }, + { OMAP5_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" }, +- { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" }, +- { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" }, +- { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" }, +- { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" }, +- { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" }, +- { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" }, +- { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" }, +- { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" }, ++ { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" }, ++ { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" }, ++ { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" }, ++ { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" }, ++ { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" }, ++ { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" }, ++ { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" }, ++ { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" }, + { 0 }, + }; + +@@ -268,12 +268,12 @@ static const struct omap_clkctrl_bit_data omap5_gpio8_bit_data[] __initconst = { + }; + + static const struct omap_clkctrl_reg_data omap5_l4per_clkctrl_regs[] __initconst = { +- { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0008:24" }, +- { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0010:24" }, +- { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0018:24" }, +- { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0020:24" }, +- { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0028:24" }, +- { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0030:24" }, ++ { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0008:24" }, ++ { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0010:24" }, ++ { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0018:24" }, ++ { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0020:24" }, ++ { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0028:24" }, ++ { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0030:24" }, + { OMAP5_GPIO2_CLKCTRL, omap5_gpio2_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_GPIO3_CLKCTRL, omap5_gpio3_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_GPIO4_CLKCTRL, omap5_gpio4_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, +@@ -345,7 +345,7 @@ static const struct omap_clkctrl_bit_data omap5_dss_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap5_dss_clkctrl_regs[] __initconst = { +- { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss_cm:clk:0000:8" }, ++ { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss-clkctrl:0000:8" }, + { 0 }, + }; + +@@ -378,7 +378,7 @@ static const struct omap_clkctrl_bit_data omap5_gpu_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap5_gpu_clkctrl_regs[] __initconst = { +- { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu_cm:clk:0000:24" }, ++ { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu-clkctrl:0000:24" }, + { 0 }, + }; + +@@ -389,7 +389,7 @@ static const char * const omap5_mmc1_fclk_mux_parents[] __initconst = { + }; + + static const char * const omap5_mmc1_fclk_parents[] __initconst = { +- "l3init_cm:clk:0008:24", ++ "l3init-clkctrl:0008:24", + NULL, + }; + +@@ -405,7 +405,7 @@ static const struct omap_clkctrl_bit_data omap5_mmc1_bit_data[] __initconst = { + }; + + static const char * const omap5_mmc2_fclk_parents[] __initconst = { +- "l3init_cm:clk:0010:24", ++ "l3init-clkctrl:0010:24", + NULL, + }; + +@@ -430,12 +430,12 @@ static const char * const omap5_usb_host_hs_hsic480m_p3_clk_parents[] __initcons + }; + + static const char * const omap5_usb_host_hs_utmi_p1_clk_parents[] __initconst = { +- "l3init_cm:clk:0038:24", ++ "l3init-clkctrl:0038:24", + NULL, + }; + + static const char * const omap5_usb_host_hs_utmi_p2_clk_parents[] __initconst = { +- "l3init_cm:clk:0038:25", ++ "l3init-clkctrl:0038:25", + NULL, + }; + +@@ -494,8 +494,8 @@ static const struct omap_clkctrl_bit_data omap5_usb_otg_ss_bit_data[] __initcons + }; + + static const struct omap_clkctrl_reg_data omap5_l3init_clkctrl_regs[] __initconst = { +- { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0008:25" }, +- { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0010:25" }, ++ { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0008:25" }, ++ { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0010:25" }, + { OMAP5_USB_HOST_HS_CLKCTRL, omap5_usb_host_hs_bit_data, CLKF_SW_SUP, "l3init_60m_fclk" }, + { OMAP5_USB_TLL_HS_CLKCTRL, omap5_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_SATA_CLKCTRL, omap5_sata_bit_data, CLKF_SW_SUP, "func_48m_fclk" }, +@@ -519,7 +519,7 @@ static const struct omap_clkctrl_reg_data omap5_wkupaon_clkctrl_regs[] __initcon + { OMAP5_L4_WKUP_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" }, + { OMAP5_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { OMAP5_GPIO1_CLKCTRL, omap5_gpio1_bit_data, CLKF_HW_SUP, "wkupaon_iclk_mux" }, +- { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon_cm:clk:0020:24" }, ++ { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon-clkctrl:0020:24" }, + { OMAP5_COUNTER_32K_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" }, + { OMAP5_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, +@@ -549,58 +549,58 @@ const struct omap_clkctrl_data omap5_clkctrl_data[] __initconst = { + static struct ti_dt_clk omap54xx_clks[] = { + DT_CLK(NULL, "timer_32k_ck", "sys_32k_ck"), + DT_CLK(NULL, "sys_clkin_ck", "sys_clkin"), +- DT_CLK(NULL, "dmic_gfclk", "abe_cm:0018:24"), +- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"), +- DT_CLK(NULL, "dss_32khz_clk", "dss_cm:0000:11"), +- DT_CLK(NULL, "dss_48mhz_clk", "dss_cm:0000:9"), +- DT_CLK(NULL, "dss_dss_clk", "dss_cm:0000:8"), +- DT_CLK(NULL, "dss_sys_clk", "dss_cm:0000:10"), +- DT_CLK(NULL, "gpio1_dbclk", "wkupaon_cm:0018:8"), +- DT_CLK(NULL, "gpio2_dbclk", "l4per_cm:0040:8"), +- DT_CLK(NULL, "gpio3_dbclk", "l4per_cm:0048:8"), +- DT_CLK(NULL, "gpio4_dbclk", "l4per_cm:0050:8"), +- DT_CLK(NULL, "gpio5_dbclk", "l4per_cm:0058:8"), +- DT_CLK(NULL, "gpio6_dbclk", "l4per_cm:0060:8"), +- DT_CLK(NULL, "gpio7_dbclk", "l4per_cm:00f0:8"), +- DT_CLK(NULL, "gpio8_dbclk", "l4per_cm:00f8:8"), +- DT_CLK(NULL, "mcbsp1_gfclk", "abe_cm:0028:24"), +- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"), +- DT_CLK(NULL, "mcbsp2_gfclk", "abe_cm:0030:24"), +- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"), +- DT_CLK(NULL, "mcbsp3_gfclk", "abe_cm:0038:24"), +- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"), +- DT_CLK(NULL, "mmc1_32khz_clk", "l3init_cm:0008:8"), +- DT_CLK(NULL, "mmc1_fclk", "l3init_cm:0008:25"), +- DT_CLK(NULL, "mmc1_fclk_mux", "l3init_cm:0008:24"), +- DT_CLK(NULL, "mmc2_fclk", "l3init_cm:0010:25"), +- DT_CLK(NULL, "mmc2_fclk_mux", "l3init_cm:0010:24"), +- DT_CLK(NULL, "sata_ref_clk", "l3init_cm:0068:8"), +- DT_CLK(NULL, "timer10_gfclk_mux", "l4per_cm:0008:24"), +- DT_CLK(NULL, "timer11_gfclk_mux", "l4per_cm:0010:24"), +- DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon_cm:0020:24"), +- DT_CLK(NULL, "timer2_gfclk_mux", "l4per_cm:0018:24"), +- DT_CLK(NULL, "timer3_gfclk_mux", "l4per_cm:0020:24"), +- DT_CLK(NULL, "timer4_gfclk_mux", "l4per_cm:0028:24"), +- DT_CLK(NULL, "timer5_gfclk_mux", "abe_cm:0048:24"), +- DT_CLK(NULL, "timer6_gfclk_mux", "abe_cm:0050:24"), +- DT_CLK(NULL, "timer7_gfclk_mux", "abe_cm:0058:24"), +- DT_CLK(NULL, "timer8_gfclk_mux", "abe_cm:0060:24"), +- DT_CLK(NULL, "timer9_gfclk_mux", "l4per_cm:0030:24"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init_cm:0038:13"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init_cm:0038:14"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init_cm:0038:7"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init_cm:0038:11"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init_cm:0038:12"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init_cm:0038:6"), +- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init_cm:0038:8"), +- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init_cm:0038:9"), +- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init_cm:0038:10"), +- DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init_cm:00d0:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init_cm:0048:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init_cm:0048:9"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init_cm:0048:10"), +- DT_CLK(NULL, "utmi_p1_gfclk", "l3init_cm:0038:24"), +- DT_CLK(NULL, "utmi_p2_gfclk", "l3init_cm:0038:25"), ++ DT_CLK(NULL, "dmic_gfclk", "abe-clkctrl:0018:24"), ++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"), ++ DT_CLK(NULL, "dss_32khz_clk", "dss-clkctrl:0000:11"), ++ DT_CLK(NULL, "dss_48mhz_clk", "dss-clkctrl:0000:9"), ++ DT_CLK(NULL, "dss_dss_clk", "dss-clkctrl:0000:8"), ++ DT_CLK(NULL, "dss_sys_clk", "dss-clkctrl:0000:10"), ++ DT_CLK(NULL, "gpio1_dbclk", "wkupaon-clkctrl:0018:8"), ++ DT_CLK(NULL, "gpio2_dbclk", "l4per-clkctrl:0040:8"), ++ DT_CLK(NULL, "gpio3_dbclk", "l4per-clkctrl:0048:8"), ++ DT_CLK(NULL, "gpio4_dbclk", "l4per-clkctrl:0050:8"), ++ DT_CLK(NULL, "gpio5_dbclk", "l4per-clkctrl:0058:8"), ++ DT_CLK(NULL, "gpio6_dbclk", "l4per-clkctrl:0060:8"), ++ DT_CLK(NULL, "gpio7_dbclk", "l4per-clkctrl:00f0:8"), ++ DT_CLK(NULL, "gpio8_dbclk", "l4per-clkctrl:00f8:8"), ++ DT_CLK(NULL, "mcbsp1_gfclk", "abe-clkctrl:0028:24"), ++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"), ++ DT_CLK(NULL, "mcbsp2_gfclk", "abe-clkctrl:0030:24"), ++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"), ++ DT_CLK(NULL, "mcbsp3_gfclk", "abe-clkctrl:0038:24"), ++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"), ++ DT_CLK(NULL, "mmc1_32khz_clk", "l3init-clkctrl:0008:8"), ++ DT_CLK(NULL, "mmc1_fclk", "l3init-clkctrl:0008:25"), ++ DT_CLK(NULL, "mmc1_fclk_mux", "l3init-clkctrl:0008:24"), ++ DT_CLK(NULL, "mmc2_fclk", "l3init-clkctrl:0010:25"), ++ DT_CLK(NULL, "mmc2_fclk_mux", "l3init-clkctrl:0010:24"), ++ DT_CLK(NULL, "sata_ref_clk", "l3init-clkctrl:0068:8"), ++ DT_CLK(NULL, "timer10_gfclk_mux", "l4per-clkctrl:0008:24"), ++ DT_CLK(NULL, "timer11_gfclk_mux", "l4per-clkctrl:0010:24"), ++ DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon-clkctrl:0020:24"), ++ DT_CLK(NULL, "timer2_gfclk_mux", "l4per-clkctrl:0018:24"), ++ DT_CLK(NULL, "timer3_gfclk_mux", "l4per-clkctrl:0020:24"), ++ DT_CLK(NULL, "timer4_gfclk_mux", "l4per-clkctrl:0028:24"), ++ DT_CLK(NULL, "timer5_gfclk_mux", "abe-clkctrl:0048:24"), ++ DT_CLK(NULL, "timer6_gfclk_mux", "abe-clkctrl:0050:24"), ++ DT_CLK(NULL, "timer7_gfclk_mux", "abe-clkctrl:0058:24"), ++ DT_CLK(NULL, "timer8_gfclk_mux", "abe-clkctrl:0060:24"), ++ DT_CLK(NULL, "timer9_gfclk_mux", "l4per-clkctrl:0030:24"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init-clkctrl:0038:13"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init-clkctrl:0038:14"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init-clkctrl:0038:7"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init-clkctrl:0038:11"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init-clkctrl:0038:12"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init-clkctrl:0038:6"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init-clkctrl:0038:8"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init-clkctrl:0038:9"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init-clkctrl:0038:10"), ++ DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init-clkctrl:00d0:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init-clkctrl:0048:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init-clkctrl:0048:9"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init-clkctrl:0048:10"), ++ DT_CLK(NULL, "utmi_p1_gfclk", "l3init-clkctrl:0038:24"), ++ DT_CLK(NULL, "utmi_p2_gfclk", "l3init-clkctrl:0038:25"), + { .node_name = NULL }, + }; + +diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c +index 864c484bde1b..08a85c559f79 100644 +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -511,10 +511,6 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node) + char *c; + u16 soc_mask = 0; + +- if (!(ti_clk_get_features()->flags & TI_CLK_CLKCTRL_COMPAT) && +- of_node_name_eq(node, "clk")) +- ti_clk_features.flags |= TI_CLK_CLKCTRL_COMPAT; +- + addrp = of_get_address(node, 0, NULL, NULL); + addr = (u32)of_translate_address(node, addrp); + +-- +2.35.1 + diff --git a/queue-5.15/coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch b/queue-5.15/coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch new file mode 100644 index 00000000000..2229b79d557 --- /dev/null +++ b/queue-5.15/coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch @@ -0,0 +1,116 @@ +From abdc8803d78ea168294d07309f5bab98edbfe466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 16:15:20 -0700 +Subject: coresight: etm4x: avoid build failure with unrolled loops + +From: Nick Desaulniers + +[ Upstream commit 4d45bc82df667ad9e9cb8361830e54fc1264e993 ] + +When the following configs are enabled: +* CORESIGHT +* CORESIGHT_SOURCE_ETM4X +* UBSAN +* UBSAN_TRAP + +Clang fails assemble the kernel with the error: +:1:7: error: expected constant expression in '.inst' directive +.inst (0xd5200000|((((2) << 19) | ((1) << 16) | (((((((((((0x160 + (i * 4))))) >> 2))) >> 7) & 0x7)) << 12) | ((((((((((0x160 + (i * 4))))) >> 2))) & 0xf)) << 8) | (((((((((((0x160 + (i * 4))))) >> 2))) >> 4) & 0x7)) << 5)))|(.L__reg_num_x8)) + ^ +drivers/hwtracing/coresight/coresight-etm4x-core.c:702:4: note: while in +macro instantiation +etm4x_relaxed_read32(csa, TRCCNTVRn(i)); +^ +drivers/hwtracing/coresight/coresight-etm4x.h:403:4: note: expanded from +macro 'etm4x_relaxed_read32' +read_etm4x_sysreg_offset((offset), false))) +^ +drivers/hwtracing/coresight/coresight-etm4x.h:383:12: note: expanded +from macro 'read_etm4x_sysreg_offset' +__val = read_etm4x_sysreg_const_offset((offset)); \ + ^ +drivers/hwtracing/coresight/coresight-etm4x.h:149:2: note: expanded from +macro 'read_etm4x_sysreg_const_offset' +READ_ETM4x_REG(ETM4x_OFFSET_TO_REG(offset)) +^ +drivers/hwtracing/coresight/coresight-etm4x.h:144:2: note: expanded from +macro 'READ_ETM4x_REG' +read_sysreg_s(ETM4x_REG_NUM_TO_SYSREG((reg))) +^ +arch/arm64/include/asm/sysreg.h:1108:15: note: expanded from macro +'read_sysreg_s' +asm volatile(__mrs_s("%0", r) : "=r" (__val)); \ + ^ +arch/arm64/include/asm/sysreg.h:1074:2: note: expanded from macro '__mrs_s' +" mrs_s " v ", " __stringify(r) "\n" \ + ^ + +Consider the definitions of TRCSSCSRn and TRCCNTVRn: +drivers/hwtracing/coresight/coresight-etm4x.h:56 + #define TRCCNTVRn(n) (0x160 + (n * 4)) +drivers/hwtracing/coresight/coresight-etm4x.h:81 + #define TRCSSCSRn(n) (0x2A0 + (n * 4)) + +Where the macro parameter is expanded to i; a loop induction variable +from etm4_disable_hw. + +When any compiler can determine that loops may be unrolled, then the +__builtin_constant_p check in read_etm4x_sysreg_offset() defined in +drivers/hwtracing/coresight/coresight-etm4x.h may evaluate to true. This +can lead to the expression `(0x160 + (i * 4))` being passed to +read_etm4x_sysreg_const_offset. Via the trace above, this is passed +through READ_ETM4x_REG, read_sysreg_s, and finally to __mrs_s where it +is string-ified and used directly in inline asm. + +Regardless of which compiler or compiler options determine whether a +loop can or can't be unrolled, which determines whether +__builtin_constant_p evaluates to true when passed an expression using a +loop induction variable, it is NEVER safe to allow the preprocessor to +construct inline asm like: + asm volatile (".inst (0x160 + (i * 4))" : "=r"(__val)); + ^ expected constant expression + +Instead of read_etm4x_sysreg_offset() using __builtin_constant_p(), use +__is_constexpr from include/linux/const.h instead to ensure only +expressions that are valid integer constant expressions get passed +through to read_sysreg_s(). + +This is not a bug in clang; it's a potentially unsafe use of the macro +arguments in read_etm4x_sysreg_offset dependent on __builtin_constant_p. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1310 +Reported-by: Arnd Bergmann +Reported-by: Tao Zhang +Signed-off-by: Nick Desaulniers +Acked-by: Arnd Bergmann +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20220708231520.3958391-1-ndesaulniers@google.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index e5b79bdb9851..794b29639035 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -7,6 +7,7 @@ + #define _CORESIGHT_CORESIGHT_ETM_H + + #include ++#include + #include + #include + #include "coresight-priv.h" +@@ -417,7 +418,7 @@ + ({ \ + u64 __val; \ + \ +- if (__builtin_constant_p((offset))) \ ++ if (__is_constexpr((offset))) \ + __val = read_etm4x_sysreg_const_offset((offset)); \ + else \ + __val = etm4x_sysreg_read((offset), true, (_64bit)); \ +-- +2.35.1 + diff --git a/queue-5.15/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch b/queue-5.15/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch new file mode 100644 index 00000000000..748d4a66597 --- /dev/null +++ b/queue-5.15/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch @@ -0,0 +1,40 @@ +From 9ff7a58b2cb06c54cc2fbbb762ffeceb26781375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 16:02:41 +0800 +Subject: csky/kprobe: reclaim insn_slot on kprobe unregistration + +From: Liao Chang + +[ Upstream commit a2310c74d418deca0f1d749c45f1f43162510f51 ] + +On kprobe registration kernel allocate one insn_slot for new kprobe, +but it forget to reclaim the insn_slot on unregistration, leading to a +potential leakage. + +Reported-by: Chen Guokai +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Liao Chang +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/kernel/probes/kprobes.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/csky/kernel/probes/kprobes.c b/arch/csky/kernel/probes/kprobes.c +index 4045894d9280..584ed9f36290 100644 +--- a/arch/csky/kernel/probes/kprobes.c ++++ b/arch/csky/kernel/probes/kprobes.c +@@ -124,6 +124,10 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p) + + void __kprobes arch_remove_kprobe(struct kprobe *p) + { ++ if (p->ainsn.api.insn) { ++ free_insn_slot(p->ainsn.api.insn, 0); ++ p->ainsn.api.insn = NULL; ++ } + } + + static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb) +-- +2.35.1 + diff --git a/queue-5.15/cxl-fix-a-memory-leak-in-an-error-handling-path.patch b/queue-5.15/cxl-fix-a-memory-leak-in-an-error-handling-path.patch new file mode 100644 index 00000000000..06d50314ab7 --- /dev/null +++ b/queue-5.15/cxl-fix-a-memory-leak-in-an-error-handling-path.patch @@ -0,0 +1,36 @@ +From 9b6b19bac8958263b79c5633cec9687c61589003 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 21:14:48 +0200 +Subject: cxl: Fix a memory leak in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 3a15b45b5454da862376b5d69a4967f5c6fa1368 ] + +A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the +error handling path of afu_allocate_irqs(). + +Acked-by: Andrew Donnellan +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/ce5869418f5838187946eb6b11a52715a93ece3d.1657566849.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cxl/irq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c +index 4cb829d5d873..2e4dcfebf19a 100644 +--- a/drivers/misc/cxl/irq.c ++++ b/drivers/misc/cxl/irq.c +@@ -349,6 +349,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count) + + out: + cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter); ++ bitmap_free(ctx->irq_bitmap); + afu_irq_name_free(ctx); + return -ENOMEM; + } +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch b/queue-5.15/dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch new file mode 100644 index 00000000000..2a67d6b057e --- /dev/null +++ b/queue-5.15/dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch @@ -0,0 +1,41 @@ +From 5068db3d04cb2743f7b10c71dd1b7e5ebd4b1a40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 18:01:52 +0100 +Subject: dmaengine: dw-axi-dmac: do not print NULL LLI during error + +From: Ben Dooks + +[ Upstream commit 86cb0defe0e275453bc39e856bb523eb425a6537 ] + +During debugging we have seen an issue where axi_chan_dump_lli() +is passed a NULL LLI pointer which ends up causing an OOPS due +to trying to get fields from it. Simply print NULL LLI and exit +to avoid this. + +Signed-off-by: Ben Dooks +Link: https://lore.kernel.org/r/20220708170153.269991-3-ben.dooks@sifive.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +index 35993ab92154..8f765e2d7c72 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +@@ -944,6 +944,11 @@ static int dw_axi_dma_chan_slave_config(struct dma_chan *dchan, + static void axi_chan_dump_lli(struct axi_dma_chan *chan, + struct axi_dma_hw_desc *desc) + { ++ if (!desc->lli) { ++ dev_err(dchan2dev(&chan->vc.chan), "NULL LLI\n"); ++ return; ++ } ++ + dev_err(dchan2dev(&chan->vc.chan), + "SAR: 0x%llx DAR: 0x%llx LLP: 0x%llx BTS 0x%x CTL: 0x%x:%08x", + le64_to_cpu(desc->lli->sar), +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch b/queue-5.15/dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch new file mode 100644 index 00000000000..a9dcb5dbdc4 --- /dev/null +++ b/queue-5.15/dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch @@ -0,0 +1,48 @@ +From 59523ae7c405be993d5e5a1576bbfe51178d5953 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 18:01:53 +0100 +Subject: dmaengine: dw-axi-dmac: ignore interrupt if no descriptor + +From: Ben Dooks + +[ Upstream commit 820f5ce999d2f99961e88c16d65cd26764df0590 ] + +If the channel has no descriptor and the interrupt is raised then the +kernel will OOPS. Check the result of vchan_next_desc() in the handler +axi_chan_block_xfer_complete() to avoid the error happening. + +Signed-off-by: Ben Dooks +Link: https://lore.kernel.org/r/20220708170153.269991-4-ben.dooks@sifive.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +index 8f765e2d7c72..48de8d2b32f2 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +@@ -1016,6 +1016,11 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan) + + /* The completed descriptor currently is in the head of vc list */ + vd = vchan_next_desc(&chan->vc); ++ if (!vd) { ++ dev_err(chan2dev(chan), "BUG: %s, IRQ with no descriptors\n", ++ axi_chan_name(chan)); ++ goto out; ++ } + + if (chan->cyclic) { + desc = vd_to_axi_desc(vd); +@@ -1045,6 +1050,7 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan) + axi_chan_start_first_queued(chan); + } + ++out: + spin_unlock_irqrestore(&chan->vc.lock, flags); + } + +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch b/queue-5.15/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch new file mode 100644 index 00000000000..86faae9cd6a --- /dev/null +++ b/queue-5.15/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch @@ -0,0 +1,51 @@ +From c940372dbb49a18266b0d33346b0b222f4d2a4cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 22:40:54 +0200 +Subject: dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() + failed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 1e42f82cbec7b2cc4873751e7791e6611901c5fc ] + +It's not allowed to quit remove early without cleaning up completely. +Otherwise this results in resource leaks that probably yield graver +problems later. Here for example some tasklets might survive the lifetime +of the sprd-dma device and access sdev which is freed after .remove() +returns. + +As none of the device freeing requires an active device, just ignore the +return value of pm_runtime_get_sync(). + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Baolin Wang +Link: https://lore.kernel.org/r/20220721204054.323602-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sprd-dma.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c +index 4357d2395e6b..60115d8d4083 100644 +--- a/drivers/dma/sprd-dma.c ++++ b/drivers/dma/sprd-dma.c +@@ -1236,11 +1236,8 @@ static int sprd_dma_remove(struct platform_device *pdev) + { + struct sprd_dma_dev *sdev = platform_get_drvdata(pdev); + struct sprd_dma_chn *c, *cn; +- int ret; + +- ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) +- return ret; ++ pm_runtime_get_sync(&pdev->dev); + + /* explicitly free the irq */ + if (sdev->irq > 0) +-- +2.35.1 + diff --git a/queue-5.15/drivers-md-fix-a-potential-use-after-free-bug.patch b/queue-5.15/drivers-md-fix-a-potential-use-after-free-bug.patch new file mode 100644 index 00000000000..ca2027d3d53 --- /dev/null +++ b/queue-5.15/drivers-md-fix-a-potential-use-after-free-bug.patch @@ -0,0 +1,44 @@ +From 97f2061d06ed573bc41623b2e976b723c2832fcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 19:39:19 +0800 +Subject: drivers:md:fix a potential use-after-free bug + +From: Wentao_Liang + +[ Upstream commit 104212471b1c1817b311771d817fb692af983173 ] + +In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and +may cause sh to be released. However, sh is subsequently used in lines +2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an +use-after-free bug. + +It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of +the function. + +Signed-off-by: Wentao_Liang +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/raid5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index b58984ddca13..19e497a7e747 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2864,10 +2864,10 @@ static void raid5_end_write_request(struct bio *bi) + if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags)) + clear_bit(R5_LOCKED, &sh->dev[i].flags); + set_bit(STRIPE_HANDLE, &sh->state); +- raid5_release_stripe(sh); + + if (sh->batch_head && sh != sh->batch_head) + raid5_release_stripe(sh->batch_head); ++ raid5_release_stripe(sh); + } + + static void raid5_error(struct mddev *mddev, struct md_rdev *rdev) +-- +2.35.1 + diff --git a/queue-5.15/drm-imx-dcss-get-rid-of-hpd-warning-message.patch b/queue-5.15/drm-imx-dcss-get-rid-of-hpd-warning-message.patch new file mode 100644 index 00000000000..9a64a7c5904 --- /dev/null +++ b/queue-5.15/drm-imx-dcss-get-rid-of-hpd-warning-message.patch @@ -0,0 +1,43 @@ +From bd18e5edb8a82164a6ead37bd74f75ff6c3a732b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 15:09:12 +0300 +Subject: drm/imx/dcss: get rid of HPD warning message + +From: Laurentiu Palcu + +[ Upstream commit 30bdc36b8c776cd4fce5de2a96ff28b37f96942f ] + +When DCSS + MIPI_DSI is used, and the last bridge in the chain supports +HPD, we can see a "Hot plug detection already enabled" warning stack +trace dump that's thrown when DCSS is initialized. + +The problem appeared when HPD was enabled by default in the +bridge_connector initialization, which made the +drm_bridge_connector_enable_hpd() call, in DCSS init path, redundant. +So, let's remove that call. + +Fixes: 09077bc311658 ("drm/bridge_connector: enable HPD by default if supported") +Signed-off-by: Laurentiu Palcu +Reviewed-by: Laurent Pinchart +Link: https://patchwork.freedesktop.org/patch/msgid/20220721120912.6639-1-laurentiu.palcu@oss.nxp.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/dcss/dcss-kms.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/imx/dcss/dcss-kms.c b/drivers/gpu/drm/imx/dcss/dcss-kms.c +index 9b84df34a6a1..8cf3352d8858 100644 +--- a/drivers/gpu/drm/imx/dcss/dcss-kms.c ++++ b/drivers/gpu/drm/imx/dcss/dcss-kms.c +@@ -142,8 +142,6 @@ struct dcss_kms_dev *dcss_kms_attach(struct dcss_dev *dcss) + + drm_kms_helper_poll_init(drm); + +- drm_bridge_connector_enable_hpd(kms->connector); +- + ret = drm_dev_register(drm, 0); + if (ret) + goto cleanup_crtc; +-- +2.35.1 + diff --git a/queue-5.15/drm-meson-fix-overflow-implicit-truncation-warnings.patch b/queue-5.15/drm-meson-fix-overflow-implicit-truncation-warnings.patch new file mode 100644 index 00000000000..54749576c38 --- /dev/null +++ b/queue-5.15/drm-meson-fix-overflow-implicit-truncation-warnings.patch @@ -0,0 +1,72 @@ +From 01c4371b0621ca895184184107f1667a41bddda6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 22:14:13 +0530 +Subject: drm/meson: Fix overflow implicit truncation warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sai Prakash Ranjan + +[ Upstream commit 98692f52c588225034cbff458622c2c06dfcb544 ] + +Fix -Woverflow warnings for drm/meson driver which is a result +of moving arm64 custom MMIO accessor macros to asm-generic function +implementations giving a bonus type-checking now and uncovering these +overflow warnings. + +drivers/gpu/drm/meson/meson_viu.c: In function ‘meson_viu_init’: +drivers/gpu/drm/meson/meson_registers.h:1826:48: error: large integer implicitly truncated to unsigned type [-Werror=overflow] + #define VIU_OSD_BLEND_REORDER(dest, src) ((src) << (dest * 4)) + ^ +drivers/gpu/drm/meson/meson_viu.c:472:18: note: in expansion of macro ‘VIU_OSD_BLEND_REORDER’ + writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) | + ^~~~~~~~~~~~~~~~~~~~~ + +Reported-by: kernel test robot +Signed-off-by: Sai Prakash Ranjan +Reviewed-by: Arnd Bergmann +Cc: Arnd Bergmann +Cc: Neil Armstrong +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_viu.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c +index 259f3e6bec90..bb7e109534de 100644 +--- a/drivers/gpu/drm/meson/meson_viu.c ++++ b/drivers/gpu/drm/meson/meson_viu.c +@@ -469,17 +469,17 @@ void meson_viu_init(struct meson_drm *priv) + priv->io_base + _REG(VD2_IF0_LUMA_FIFO_SIZE)); + + if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { +- writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) | +- VIU_OSD_BLEND_REORDER(1, 0) | +- VIU_OSD_BLEND_REORDER(2, 0) | +- VIU_OSD_BLEND_REORDER(3, 0) | +- VIU_OSD_BLEND_DIN_EN(1) | +- VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 | +- VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 | +- VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 | +- VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) | +- VIU_OSD_BLEND_HOLD_LINES(4), +- priv->io_base + _REG(VIU_OSD_BLEND_CTRL)); ++ u32 val = (u32)VIU_OSD_BLEND_REORDER(0, 1) | ++ (u32)VIU_OSD_BLEND_REORDER(1, 0) | ++ (u32)VIU_OSD_BLEND_REORDER(2, 0) | ++ (u32)VIU_OSD_BLEND_REORDER(3, 0) | ++ (u32)VIU_OSD_BLEND_DIN_EN(1) | ++ (u32)VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 | ++ (u32)VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 | ++ (u32)VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 | ++ (u32)VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) | ++ (u32)VIU_OSD_BLEND_HOLD_LINES(4); ++ writel_relaxed(val, priv->io_base + _REG(VIU_OSD_BLEND_CTRL)); + + writel_relaxed(OSD_BLEND_PATH_SEL_ENABLE, + priv->io_base + _REG(OSD1_BLEND_SRC_CTRL)); +-- +2.35.1 + diff --git a/queue-5.15/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch b/queue-5.15/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch new file mode 100644 index 00000000000..12f5b01cdbb --- /dev/null +++ b/queue-5.15/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch @@ -0,0 +1,46 @@ +From ac86e7cdcaed3d6a23a702010c80fa2584e8b43d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 09:07:22 +0800 +Subject: drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() + +From: Liang He + +[ Upstream commit 91b3c8dbe898df158fd2a84675f3a284ff6666f7 ] + +In this function, there are two refcount leak bugs: +(1) when breaking out of for_each_endpoint_of_node(), we need call +the of_node_put() for the 'ep'; +(2) we should call of_node_put() for the reference returned by +of_graph_get_remote_port() when it is not used anymore. + +Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") +Signed-off-by: Liang He +Acked-by: Martin Blumenstingl +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20220726010722.1319416-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index c98525d60df5..a56607501d36 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -114,8 +114,11 @@ static bool meson_vpu_has_available_connectors(struct device *dev) + for_each_endpoint_of_node(dev->of_node, ep) { + /* If the endpoint node exists, consider it enabled */ + remote = of_graph_get_remote_port(ep); +- if (remote) ++ if (remote) { ++ of_node_put(remote); ++ of_node_put(ep); + return true; ++ } + } + + return false; +-- +2.35.1 + diff --git a/queue-5.15/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch b/queue-5.15/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch new file mode 100644 index 00000000000..eeb866724b1 --- /dev/null +++ b/queue-5.15/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch @@ -0,0 +1,79 @@ +From e5ef27bfb4baa3b9427087e78fb99066044ec091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 22:16:23 -0500 +Subject: drm/sun4i: dsi: Prevent underflow when computing packet sizes + +From: Samuel Holland + +[ Upstream commit 82a1356a933d8443139f8886f11b63c974a09a67 ] + +Currently, the packet overhead is subtracted using unsigned arithmetic. +With a short sync pulse, this could underflow and wrap around to near +the maximal u16 value. Fix this by using signed subtraction. The call to +max() will correctly handle any negative numbers that are produced. + +Apply the same fix to the other timings, even though those subtractions +are less likely to underflow. + +Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support") +Signed-off-by: Samuel Holland +Reviewed-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20220812031623.34057-1-samuel@sholland.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +index 4f5efcace68e..51edb4244af7 100644 +--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c ++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +@@ -531,7 +531,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + struct drm_display_mode *mode) + { + struct mipi_dsi_device *device = dsi->device; +- unsigned int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8; ++ int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8; + u16 hbp = 0, hfp = 0, hsa = 0, hblk = 0, vblk = 0; + u32 basic_ctl = 0; + size_t bytes; +@@ -555,7 +555,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * (4 bytes). Its minimal size is therefore 10 bytes + */ + #define HSA_PACKET_OVERHEAD 10 +- hsa = max((unsigned int)HSA_PACKET_OVERHEAD, ++ hsa = max(HSA_PACKET_OVERHEAD, + (mode->hsync_end - mode->hsync_start) * Bpp - HSA_PACKET_OVERHEAD); + + /* +@@ -564,7 +564,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * therefore 6 bytes + */ + #define HBP_PACKET_OVERHEAD 6 +- hbp = max((unsigned int)HBP_PACKET_OVERHEAD, ++ hbp = max(HBP_PACKET_OVERHEAD, + (mode->htotal - mode->hsync_end) * Bpp - HBP_PACKET_OVERHEAD); + + /* +@@ -574,7 +574,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * 16 bytes + */ + #define HFP_PACKET_OVERHEAD 16 +- hfp = max((unsigned int)HFP_PACKET_OVERHEAD, ++ hfp = max(HFP_PACKET_OVERHEAD, + (mode->hsync_start - mode->hdisplay) * Bpp - HFP_PACKET_OVERHEAD); + + /* +@@ -583,7 +583,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * bytes). Its minimal size is therefore 10 bytes. + */ + #define HBLK_PACKET_OVERHEAD 10 +- hblk = max((unsigned int)HBLK_PACKET_OVERHEAD, ++ hblk = max(HBLK_PACKET_OVERHEAD, + (mode->htotal - (mode->hsync_end - mode->hsync_start)) * Bpp - + HBLK_PACKET_OVERHEAD); + +-- +2.35.1 + diff --git a/queue-5.15/ext4-avoid-remove-directory-when-directory-is-corrup.patch b/queue-5.15/ext4-avoid-remove-directory-when-directory-is-corrup.patch new file mode 100644 index 00000000000..f1d2243db03 --- /dev/null +++ b/queue-5.15/ext4-avoid-remove-directory-when-directory-is-corrup.patch @@ -0,0 +1,43 @@ +From 9c7eedafd078c6102380130f92af83d04c90120f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 17:02:23 +0800 +Subject: ext4: avoid remove directory when directory is corrupted + +From: Ye Bin + +[ Upstream commit b24e77ef1c6d4dbf42749ad4903c97539cc9755a ] + +Now if check directoy entry is corrupted, ext4_empty_dir may return true +then directory will be removed when file system mounted with "errors=continue". +In order not to make things worse just return false when directory is corrupted. + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20220622090223.682234-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/namei.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 5821638cb893..7d3ec39121f7 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3090,11 +3090,8 @@ bool ext4_empty_dir(struct inode *inode) + de = (struct ext4_dir_entry_2 *) (bh->b_data + + (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, +- bh->b_data, bh->b_size, offset)) { +- offset = (offset | (sb->s_blocksize - 1)) + 1; +- continue; +- } +- if (le32_to_cpu(de->inode)) { ++ bh->b_data, bh->b_size, offset) || ++ le32_to_cpu(de->inode)) { + brelse(bh); + return false; + } +-- +2.35.1 + diff --git a/queue-5.15/ext4-avoid-resizing-to-a-partial-cluster-size.patch b/queue-5.15/ext4-avoid-resizing-to-a-partial-cluster-size.patch new file mode 100644 index 00000000000..150d07b2a88 --- /dev/null +++ b/queue-5.15/ext4-avoid-resizing-to-a-partial-cluster-size.patch @@ -0,0 +1,47 @@ +From b45f6c7966bd42669afa2c1ee326074d13f345be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 04:27:48 +0000 +Subject: ext4: avoid resizing to a partial cluster size + +From: Kiselev, Oleg + +[ Upstream commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd ] + +This patch avoids an attempt to resize the filesystem to an +unaligned cluster boundary. An online resize to a size that is not +integral to cluster size results in the last iteration attempting to +grow the fs by a negative amount, which trips a BUG_ON and leaves the fs +with a corrupted in-memory superblock. + +Signed-off-by: Oleg Kiselev +Link: https://lore.kernel.org/r/0E92A0AB-4F16-4F1A-94B7-702CC6504FDE@amazon.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/resize.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index fa3c854125bb..862cbbc01d6e 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1977,6 +1977,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) + } + brelse(bh); + ++ /* ++ * For bigalloc, trim the requested size to the nearest cluster ++ * boundary to avoid creating an unusable filesystem. We do this ++ * silently, instead of returning an error, to avoid breaking ++ * callers that blindly resize the filesystem to the full size of ++ * the underlying block device. ++ */ ++ if (ext4_has_feature_bigalloc(sb)) ++ n_blocks_count &= ~((1 << EXT4_CLUSTER_BITS(sb)) - 1); ++ + retry: + o_blocks_count = ext4_blocks_count(es); + +-- +2.35.1 + diff --git a/queue-5.15/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch b/queue-5.15/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch new file mode 100644 index 00000000000..acd1517db65 --- /dev/null +++ b/queue-5.15/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch @@ -0,0 +1,63 @@ +From 76773d50dfe34c3298144d4b506594941c5c8e51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 00:03:23 +0800 +Subject: f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() + +From: Chao Yu + +[ Upstream commit 141170b759e03958f296033bb7001be62d1d363b ] + +As Dipanjan Das reported, syzkaller +found a f2fs bug as below: + +RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295 +Call Trace: + write_all_xattrs fs/f2fs/xattr.c:487 [inline] + __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 + f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790 + f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86 + __vfs_setxattr+0x115/0x180 fs/xattr.c:182 + __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216 + __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 + vfs_setxattr+0x13f/0x330 fs/xattr.c:303 + setxattr+0x146/0x160 fs/xattr.c:611 + path_setxattr+0x1a7/0x1d0 fs/xattr.c:630 + __do_sys_lsetxattr fs/xattr.c:653 [inline] + __se_sys_lsetxattr fs/xattr.c:649 [inline] + __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +NAT entry and nat bitmap can be inconsistent, e.g. one nid is free +in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it +may trigger BUG_ON() in f2fs_new_node_page(), fix it. + +Reported-by: Dipanjan Das +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 69c6bcaf5aae..0e6e73bc42d4 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1291,7 +1291,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) + dec_valid_node_count(sbi, dn->inode, !ofs); + goto fail; + } +- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR); ++ if (unlikely(new_ni.blk_addr != NULL_ADDR)) { ++ err = -EFSCORRUPTED; ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ goto fail; ++ } + #endif + new_ni.nid = dn->nid; + new_ni.ino = dn->inode->i_ino; +-- +2.35.1 + diff --git a/queue-5.15/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch b/queue-5.15/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch new file mode 100644 index 00000000000..8fb9d76ce01 --- /dev/null +++ b/queue-5.15/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch @@ -0,0 +1,78 @@ +From 6b5f67c9cc16aa40216ef80a71a7411f7173309f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 22:51:05 +0800 +Subject: f2fs: fix to do sanity check on segment type in build_sit_entries() + +From: Chao Yu + +[ Upstream commit 09beadf289d6e300553e60d6e76f13c0427ecab3 ] + +As Wenqing Liu reported in bugzilla: + +https://bugzilla.kernel.org/show_bug.cgi?id=216285 + +RIP: 0010:memcpy_erms+0x6/0x10 + f2fs_update_meta_page+0x84/0x570 [f2fs] + change_curseg.constprop.0+0x159/0xbd0 [f2fs] + f2fs_do_replace_block+0x5c7/0x18a0 [f2fs] + f2fs_replace_block+0xeb/0x180 [f2fs] + recover_data+0x1abd/0x6f50 [f2fs] + f2fs_recover_fsync_data+0x12ce/0x3250 [f2fs] + f2fs_fill_super+0x4459/0x6190 [f2fs] + mount_bdev+0x2cf/0x3b0 + legacy_get_tree+0xed/0x1d0 + vfs_get_tree+0x81/0x2b0 + path_mount+0x47e/0x19d0 + do_mount+0xce/0xf0 + __x64_sys_mount+0x12c/0x1a0 + do_syscall_64+0x38/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The root cause is segment type is invalid, so in f2fs_do_replace_block(), +f2fs accesses f2fs_sm_info::curseg_array with out-of-range segment type, +result in accessing invalid curseg->sum_blk during memcpy in +f2fs_update_meta_page(). Fix this by adding sanity check on segment type +in build_sit_entries(). + +Reported-by: Wenqing Liu +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 841a978da083..e98c90bd8ef6 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -4537,6 +4537,12 @@ static int build_sit_entries(struct f2fs_sb_info *sbi) + return err; + seg_info_from_raw_sit(se, &sit); + ++ if (se->type >= NR_PERSISTENT_LOG) { ++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u", ++ se->type, start); ++ return -EFSCORRUPTED; ++ } ++ + sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks; + + if (f2fs_block_unit_discard(sbi)) { +@@ -4585,6 +4591,13 @@ static int build_sit_entries(struct f2fs_sb_info *sbi) + break; + seg_info_from_raw_sit(se, &sit); + ++ if (se->type >= NR_PERSISTENT_LOG) { ++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u", ++ se->type, start); ++ err = -EFSCORRUPTED; ++ break; ++ } ++ + sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks; + + if (f2fs_block_unit_discard(sbi)) { +-- +2.35.1 + diff --git a/queue-5.15/gadgetfs-ep_io-wait-until-irq-finishes.patch b/queue-5.15/gadgetfs-ep_io-wait-until-irq-finishes.patch new file mode 100644 index 00000000000..5f879ebb927 --- /dev/null +++ b/queue-5.15/gadgetfs-ep_io-wait-until-irq-finishes.patch @@ -0,0 +1,37 @@ +From d749f818d14155aa88f7c3301922b329050a6bce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 09:06:44 +0200 +Subject: gadgetfs: ep_io - wait until IRQ finishes + +From: Jozef Martiniak + +[ Upstream commit 04cb742d4d8f30dc2e83b46ac317eec09191c68e ] + +after usb_ep_queue() if wait_for_completion_interruptible() is +interrupted we need to wait until IRQ gets finished. + +Otherwise complete() from epio_complete() can corrupt stack. + +Signed-off-by: Jozef Martiniak +Link: https://lore.kernel.org/r/20220708070645.6130-1-jomajm@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/legacy/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 3279b4767424..9e8b678f0548 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -362,6 +362,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len) + spin_unlock_irq (&epdata->dev->lock); + + DBG (epdata->dev, "endpoint gone\n"); ++ wait_for_completion(&done); + epdata->status = -ENODEV; + } + } +-- +2.35.1 + diff --git a/queue-5.15/habanalabs-gaudi-fix-shift-out-of-bounds.patch b/queue-5.15/habanalabs-gaudi-fix-shift-out-of-bounds.patch new file mode 100644 index 00000000000..ea13af40a2c --- /dev/null +++ b/queue-5.15/habanalabs-gaudi-fix-shift-out-of-bounds.patch @@ -0,0 +1,52 @@ +From 175d786395f364378a713df12a8cfcf5a4d7e302 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 16:11:31 +0300 +Subject: habanalabs/gaudi: fix shift out of bounds + +From: Ofir Bitton + +[ Upstream commit 01622098aeb05a5efbb727199bbc2a4653393255 ] + +When validating NIC queues, queue offset calculation must be +performed only for NIC queues. + +Signed-off-by: Ofir Bitton +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/gaudi/gaudi.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c +index 14da87b38e83..801acab048eb 100644 +--- a/drivers/misc/habanalabs/gaudi/gaudi.c ++++ b/drivers/misc/habanalabs/gaudi/gaudi.c +@@ -5744,15 +5744,17 @@ static int gaudi_parse_cb_no_ext_queue(struct hl_device *hdev, + { + struct asic_fixed_properties *asic_prop = &hdev->asic_prop; + struct gaudi_device *gaudi = hdev->asic_specific; +- u32 nic_mask_q_id = 1 << (HW_CAP_NIC_SHIFT + +- ((parser->hw_queue_id - GAUDI_QUEUE_ID_NIC_0_0) >> 2)); ++ u32 nic_queue_offset, nic_mask_q_id; + + if ((parser->hw_queue_id >= GAUDI_QUEUE_ID_NIC_0_0) && +- (parser->hw_queue_id <= GAUDI_QUEUE_ID_NIC_9_3) && +- (!(gaudi->hw_cap_initialized & nic_mask_q_id))) { +- dev_err(hdev->dev, "h/w queue %d is disabled\n", +- parser->hw_queue_id); +- return -EINVAL; ++ (parser->hw_queue_id <= GAUDI_QUEUE_ID_NIC_9_3)) { ++ nic_queue_offset = parser->hw_queue_id - GAUDI_QUEUE_ID_NIC_0_0; ++ nic_mask_q_id = 1 << (HW_CAP_NIC_SHIFT + (nic_queue_offset >> 2)); ++ ++ if (!(gaudi->hw_cap_initialized & nic_mask_q_id)) { ++ dev_err(hdev->dev, "h/w queue %d is disabled\n", parser->hw_queue_id); ++ return -EINVAL; ++ } + } + + /* For internal queue jobs just check if CB address is valid */ +-- +2.35.1 + diff --git a/queue-5.15/habanalabs-gaudi-mask-constant-value-before-cast.patch b/queue-5.15/habanalabs-gaudi-mask-constant-value-before-cast.patch new file mode 100644 index 00000000000..37545cffde4 --- /dev/null +++ b/queue-5.15/habanalabs-gaudi-mask-constant-value-before-cast.patch @@ -0,0 +1,49 @@ +From aa2d4d95c97fe94c634f31852f8b7549e281cf14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 16:45:02 +0300 +Subject: habanalabs/gaudi: mask constant value before cast + +From: Oded Gabbay + +[ Upstream commit e3f49437a2e0221a387ecd192d742ae1434e1e3a ] + +This fixes a sparse warning of +"cast truncates bits from constant value" + +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/gaudi/gaudi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c +index 801acab048eb..8132200dca67 100644 +--- a/drivers/misc/habanalabs/gaudi/gaudi.c ++++ b/drivers/misc/habanalabs/gaudi/gaudi.c +@@ -3318,19 +3318,19 @@ static void gaudi_init_nic_qman(struct hl_device *hdev, u32 nic_offset, + u32 nic_qm_err_cfg, irq_handler_offset; + u32 q_off; + +- mtr_base_en_lo = lower_32_bits(CFG_BASE + ++ mtr_base_en_lo = lower_32_bits((CFG_BASE & U32_MAX) + + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); + mtr_base_en_hi = upper_32_bits(CFG_BASE + + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); +- so_base_en_lo = lower_32_bits(CFG_BASE + ++ so_base_en_lo = lower_32_bits((CFG_BASE & U32_MAX) + + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_SOB_OBJ_0); + so_base_en_hi = upper_32_bits(CFG_BASE + + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_SOB_OBJ_0); +- mtr_base_ws_lo = lower_32_bits(CFG_BASE + ++ mtr_base_ws_lo = lower_32_bits((CFG_BASE & U32_MAX) + + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); + mtr_base_ws_hi = upper_32_bits(CFG_BASE + + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); +- so_base_ws_lo = lower_32_bits(CFG_BASE + ++ so_base_ws_lo = lower_32_bits((CFG_BASE & U32_MAX) + + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_SOB_OBJ_0); + so_base_ws_hi = upper_32_bits(CFG_BASE + + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_SOB_OBJ_0); +-- +2.35.1 + diff --git a/queue-5.15/hid-multitouch-new-device-class-fix-lenovo-x12-track.patch b/queue-5.15/hid-multitouch-new-device-class-fix-lenovo-x12-track.patch new file mode 100644 index 00000000000..8afb9cba4a6 --- /dev/null +++ b/queue-5.15/hid-multitouch-new-device-class-fix-lenovo-x12-track.patch @@ -0,0 +1,82 @@ +From 12b8c813ff15fa416a47d0e17b70bbb06ed846e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 23:51:32 -0400 +Subject: HID: multitouch: new device class fix Lenovo X12 trackpad sticky + +From: Tao Jin + +[ Upstream commit 54eed5c7b938dc4ef6b14d4ee048bbdafdbce352 ] + +The trackpad of the given device sends continuous report of pointers +status as per wxn8 spec. However, the spec did not clarify when the +fingers are lifted so fast that between the interval of two report +frames fingers on pad reduced from >=2 to 0. The second last report +contains >=2 fingers with tip state 1 and the last report contains only +1 finger with tip state 0. Although this can happen unfrequently, a + quick fix will be improve the consistency to 100%. A quick fix is to +disable MT_QUIRK_ALWAYS_VALID and enable MT_QUIRK_NOT_SEEN_MEANS_UP. + +Test for hid-tools is added in [1] + +In addition to this, I2C device 04CA:00B1 may also need similar class +but with MT_QUIRK_FORCE_MULTI_INPUT disabled (but it does not harm to + enable it on non-multi-input device either). The respective owner has +been notified and a patch may coming soon after test. + +[1]: https://gitlab.freedesktop.org/libevdev/hid-tools/-/merge_requests/130 + +Signed-off-by: Tao Jin +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index f382444dc2db..a14c48de4446 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -194,6 +194,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app); + #define MT_CLS_WIN_8_FORCE_MULTI_INPUT 0x0015 + #define MT_CLS_WIN_8_DISABLE_WAKEUP 0x0016 + #define MT_CLS_WIN_8_NO_STICKY_FINGERS 0x0017 ++#define MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU 0x0018 + + /* vendor specific classes */ + #define MT_CLS_3M 0x0101 +@@ -286,6 +287,15 @@ static const struct mt_class mt_classes[] = { + MT_QUIRK_WIN8_PTP_BUTTONS | + MT_QUIRK_FORCE_MULTI_INPUT, + .export_all_inputs = true }, ++ { .name = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, ++ .quirks = MT_QUIRK_IGNORE_DUPLICATES | ++ MT_QUIRK_HOVERING | ++ MT_QUIRK_CONTACT_CNT_ACCURATE | ++ MT_QUIRK_STICKY_FINGERS | ++ MT_QUIRK_WIN8_PTP_BUTTONS | ++ MT_QUIRK_FORCE_MULTI_INPUT | ++ MT_QUIRK_NOT_SEEN_MEANS_UP, ++ .export_all_inputs = true }, + { .name = MT_CLS_WIN_8_DISABLE_WAKEUP, + .quirks = MT_QUIRK_ALWAYS_VALID | + MT_QUIRK_IGNORE_DUPLICATES | +@@ -783,6 +793,7 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, + case HID_DG_CONFIDENCE: + if ((cls->name == MT_CLS_WIN_8 || + cls->name == MT_CLS_WIN_8_FORCE_MULTI_INPUT || ++ cls->name == MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU || + cls->name == MT_CLS_WIN_8_DISABLE_WAKEUP) && + (field->application == HID_DG_TOUCHPAD || + field->application == HID_DG_TOUCHSCREEN)) +@@ -2033,7 +2044,7 @@ static const struct hid_device_id mt_devices[] = { + USB_DEVICE_ID_LENOVO_X1_TAB3) }, + + /* Lenovo X12 TAB Gen 1 */ +- { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, + HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_LENOVO, + USB_DEVICE_ID_LENOVO_X12_TAB) }, +-- +2.35.1 + diff --git a/queue-5.15/iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch b/queue-5.15/iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch new file mode 100644 index 00000000000..7d348369dba --- /dev/null +++ b/queue-5.15/iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch @@ -0,0 +1,217 @@ +From b841d549f6fc5104827da86fd03f6cc2b52b0291 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 17:29:25 +0800 +Subject: iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit + +From: Yunfei Wang + +[ Upstream commit bfdd231374181254742c5e2faef0bef2d30c0ee4 ] + +Single memory zone feature will remove ZONE_DMA32 and ZONE_DMA and +cause pgtable PA size larger than 32bit. + +Since Mediatek IOMMU hardware support at most 35bit PA in pgtable, +so add a quirk to allow the PA of pgtables support up to bit35. + +Signed-off-by: Ning Li +Signed-off-by: Yunfei Wang +Reviewed-by: Robin Murphy +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20220630092927.24925-2-yf.wang@mediatek.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/io-pgtable-arm-v7s.c | 75 ++++++++++++++++++++++-------- + include/linux/io-pgtable.h | 15 ++++-- + 2 files changed, 66 insertions(+), 24 deletions(-) + +diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c +index be066c1503d3..ba3115fd0f86 100644 +--- a/drivers/iommu/io-pgtable-arm-v7s.c ++++ b/drivers/iommu/io-pgtable-arm-v7s.c +@@ -182,14 +182,8 @@ static bool arm_v7s_is_mtk_enabled(struct io_pgtable_cfg *cfg) + (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_EXT); + } + +-static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl, +- struct io_pgtable_cfg *cfg) ++static arm_v7s_iopte to_mtk_iopte(phys_addr_t paddr, arm_v7s_iopte pte) + { +- arm_v7s_iopte pte = paddr & ARM_V7S_LVL_MASK(lvl); +- +- if (!arm_v7s_is_mtk_enabled(cfg)) +- return pte; +- + if (paddr & BIT_ULL(32)) + pte |= ARM_V7S_ATTR_MTK_PA_BIT32; + if (paddr & BIT_ULL(33)) +@@ -199,6 +193,17 @@ static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl, + return pte; + } + ++static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl, ++ struct io_pgtable_cfg *cfg) ++{ ++ arm_v7s_iopte pte = paddr & ARM_V7S_LVL_MASK(lvl); ++ ++ if (arm_v7s_is_mtk_enabled(cfg)) ++ return to_mtk_iopte(paddr, pte); ++ ++ return pte; ++} ++ + static phys_addr_t iopte_to_paddr(arm_v7s_iopte pte, int lvl, + struct io_pgtable_cfg *cfg) + { +@@ -240,10 +245,17 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + dma_addr_t dma; + size_t size = ARM_V7S_TABLE_SIZE(lvl, cfg); + void *table = NULL; ++ gfp_t gfp_l1; ++ ++ /* ++ * ARM_MTK_TTBR_EXT extend the translation table base support larger ++ * memory address. ++ */ ++ gfp_l1 = cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? ++ GFP_KERNEL : ARM_V7S_TABLE_GFP_DMA; + + if (lvl == 1) +- table = (void *)__get_free_pages( +- __GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size)); ++ table = (void *)__get_free_pages(gfp_l1 | __GFP_ZERO, get_order(size)); + else if (lvl == 2) + table = kmem_cache_zalloc(data->l2_tables, gfp); + +@@ -251,7 +263,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + return NULL; + + phys = virt_to_phys(table); +- if (phys != (arm_v7s_iopte)phys) { ++ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? ++ phys >= (1ULL << cfg->oas) : phys != (arm_v7s_iopte)phys) { + /* Doesn't fit in PTE */ + dev_err(dev, "Page table does not fit in PTE: %pa", &phys); + goto out_free; +@@ -457,9 +470,14 @@ static arm_v7s_iopte arm_v7s_install_table(arm_v7s_iopte *table, + arm_v7s_iopte curr, + struct io_pgtable_cfg *cfg) + { ++ phys_addr_t phys = virt_to_phys(table); + arm_v7s_iopte old, new; + +- new = virt_to_phys(table) | ARM_V7S_PTE_TYPE_TABLE; ++ new = phys | ARM_V7S_PTE_TYPE_TABLE; ++ ++ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT) ++ new = to_mtk_iopte(phys, new); ++ + if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS) + new |= ARM_V7S_ATTR_NS_TABLE; + +@@ -779,6 +797,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + void *cookie) + { + struct arm_v7s_io_pgtable *data; ++ slab_flags_t slab_flag; ++ phys_addr_t paddr; + + if (cfg->ias > (arm_v7s_is_mtk_enabled(cfg) ? 34 : ARM_V7S_ADDR_BITS)) + return NULL; +@@ -788,7 +808,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + + if (cfg->quirks & ~(IO_PGTABLE_QUIRK_ARM_NS | + IO_PGTABLE_QUIRK_NO_PERMS | +- IO_PGTABLE_QUIRK_ARM_MTK_EXT)) ++ IO_PGTABLE_QUIRK_ARM_MTK_EXT | ++ IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT)) + return NULL; + + /* If ARM_MTK_4GB is enabled, the NO_PERMS is also expected. */ +@@ -796,15 +817,27 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + !(cfg->quirks & IO_PGTABLE_QUIRK_NO_PERMS)) + return NULL; + ++ if ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT) && ++ !arm_v7s_is_mtk_enabled(cfg)) ++ return NULL; ++ + data = kmalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return NULL; + + spin_lock_init(&data->split_lock); ++ ++ /* ++ * ARM_MTK_TTBR_EXT extend the translation table base support larger ++ * memory address. ++ */ ++ slab_flag = cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? ++ 0 : ARM_V7S_TABLE_SLAB_FLAGS; ++ + data->l2_tables = kmem_cache_create("io-pgtable_armv7s_l2", + ARM_V7S_TABLE_SIZE(2, cfg), + ARM_V7S_TABLE_SIZE(2, cfg), +- ARM_V7S_TABLE_SLAB_FLAGS, NULL); ++ slab_flag, NULL); + if (!data->l2_tables) + goto out_free_data; + +@@ -850,12 +883,16 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + wmb(); + + /* TTBR */ +- cfg->arm_v7s_cfg.ttbr = virt_to_phys(data->pgd) | ARM_V7S_TTBR_S | +- (cfg->coherent_walk ? (ARM_V7S_TTBR_NOS | +- ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_WBWA) | +- ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_WBWA)) : +- (ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_NC) | +- ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_NC))); ++ paddr = virt_to_phys(data->pgd); ++ if (arm_v7s_is_mtk_enabled(cfg)) ++ cfg->arm_v7s_cfg.ttbr = paddr | upper_32_bits(paddr); ++ else ++ cfg->arm_v7s_cfg.ttbr = paddr | ARM_V7S_TTBR_S | ++ (cfg->coherent_walk ? (ARM_V7S_TTBR_NOS | ++ ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_WBWA) | ++ ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_WBWA)) : ++ (ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_NC) | ++ ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_NC))); + return &data->iop; + + out_free_data: +diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h +index 86af6f0a00a2..ca98aeadcc80 100644 +--- a/include/linux/io-pgtable.h ++++ b/include/linux/io-pgtable.h +@@ -74,17 +74,22 @@ struct io_pgtable_cfg { + * to support up to 35 bits PA where the bit32, bit33 and bit34 are + * encoded in the bit9, bit4 and bit5 of the PTE respectively. + * ++ * IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT: (ARM v7s format) MediaTek IOMMUs ++ * extend the translation table base support up to 35 bits PA, the ++ * encoding format is same with IO_PGTABLE_QUIRK_ARM_MTK_EXT. ++ * + * IO_PGTABLE_QUIRK_ARM_TTBR1: (ARM LPAE format) Configure the table + * for use in the upper half of a split address space. + * + * IO_PGTABLE_QUIRK_ARM_OUTER_WBWA: Override the outer-cacheability + * attributes set in the TCR for a non-coherent page-table walker. + */ +- #define IO_PGTABLE_QUIRK_ARM_NS BIT(0) +- #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) +- #define IO_PGTABLE_QUIRK_ARM_MTK_EXT BIT(3) +- #define IO_PGTABLE_QUIRK_ARM_TTBR1 BIT(5) +- #define IO_PGTABLE_QUIRK_ARM_OUTER_WBWA BIT(6) ++ #define IO_PGTABLE_QUIRK_ARM_NS BIT(0) ++ #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) ++ #define IO_PGTABLE_QUIRK_ARM_MTK_EXT BIT(3) ++ #define IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT BIT(4) ++ #define IO_PGTABLE_QUIRK_ARM_TTBR1 BIT(5) ++ #define IO_PGTABLE_QUIRK_ARM_OUTER_WBWA BIT(6) + unsigned long quirks; + unsigned long pgsize_bitmap; + unsigned int ias; +-- +2.35.1 + diff --git a/queue-5.15/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch b/queue-5.15/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch new file mode 100644 index 00000000000..fdc300e939c --- /dev/null +++ b/queue-5.15/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch @@ -0,0 +1,76 @@ +From c2aff0f9d61bb1c01e568b64f17e3c23ec2d52e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 22:14:12 +0530 +Subject: irqchip/tegra: Fix overflow implicit truncation warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sai Prakash Ranjan + +[ Upstream commit 443685992bda9bb4f8b17fc02c9f6c60e62b1461 ] + +Fix -Woverflow warnings for tegra irqchip driver which is a result +of moving arm64 custom MMIO accessor macros to asm-generic function +implementations giving a bonus type-checking now and uncovering these +overflow warnings. + +drivers/irqchip/irq-tegra.c: In function ‘tegra_ictlr_suspend’: +drivers/irqchip/irq-tegra.c:151:18: warning: large integer implicitly truncated to unsigned type [-Woverflow] + writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); + ^ + +Suggested-by: Marc Zyngier +Signed-off-by: Sai Prakash Ranjan +Reviewed-by: Arnd Bergmann +Cc: Marc Zyngier +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-tegra.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c +index e1f771c72fc4..ad3e2c1b3c87 100644 +--- a/drivers/irqchip/irq-tegra.c ++++ b/drivers/irqchip/irq-tegra.c +@@ -148,10 +148,10 @@ static int tegra_ictlr_suspend(void) + lic->cop_iep[i] = readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS); + + /* Disable COP interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + + /* Disable CPU interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + + /* Enable the wakeup sources of ictlr */ + writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET); +@@ -172,12 +172,12 @@ static void tegra_ictlr_resume(void) + + writel_relaxed(lic->cpu_iep[i], + ictlr + ICTLR_CPU_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + writel_relaxed(lic->cpu_ier[i], + ictlr + ICTLR_CPU_IER_SET); + writel_relaxed(lic->cop_iep[i], + ictlr + ICTLR_COP_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + writel_relaxed(lic->cop_ier[i], + ictlr + ICTLR_COP_IER_SET); + } +@@ -312,7 +312,7 @@ static int __init tegra_ictlr_init(struct device_node *node, + lic->base[i] = base; + + /* Disable all interrupts */ +- writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR); + /* All interrupts target IRQ */ + writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS); + +-- +2.35.1 + diff --git a/queue-5.15/kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch b/queue-5.15/kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch new file mode 100644 index 00000000000..c18443aa3dc --- /dev/null +++ b/queue-5.15/kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch @@ -0,0 +1,43 @@ +From 353ffa66cbbf2ec903d08020399472d74aa4f8c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 19:25:54 +0000 +Subject: KVM: arm64: Reject 32bit user PSTATE on asymmetric systems + +From: Oliver Upton + +[ Upstream commit b10d86fb8e46cc812171728bcd326df2f34e9ed5 ] + +KVM does not support AArch32 EL0 on asymmetric systems. To that end, +prevent userspace from configuring a vCPU in such a state through +setting PSTATE. + +It is already ABI that KVM rejects such a write on a system where +AArch32 EL0 is unsupported. Though the kernel's definition of a 32bit +system changed in commit 2122a833316f ("arm64: Allow mismatched +32-bit EL0 support"), KVM's did not. + +Fixes: 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support") +Signed-off-by: Oliver Upton +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220816192554.1455559-3-oliver.upton@linux.dev +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/guest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c +index 5ce26bedf23c..94108e2e0917 100644 +--- a/arch/arm64/kvm/guest.c ++++ b/arch/arm64/kvm/guest.c +@@ -242,7 +242,7 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + u64 mode = (*(u64 *)valp) & PSR_AA32_MODE_MASK; + switch (mode) { + case PSR_AA32_MODE_USR: +- if (!system_supports_32bit_el0()) ++ if (!kvm_supports_32bit_el0()) + return -EINVAL; + break; + case PSR_AA32_MODE_FIQ: +-- +2.35.1 + diff --git a/queue-5.15/kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch b/queue-5.15/kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch new file mode 100644 index 00000000000..87d280844ec --- /dev/null +++ b/queue-5.15/kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch @@ -0,0 +1,77 @@ +From 11a3ef3977384be73df30ceb764916e63ead7bd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 19:25:53 +0000 +Subject: KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems + +From: Oliver Upton + +[ Upstream commit f3c6efc72f3b20ec23566e768979802f0a398f04 ] + +KVM does not support AArch32 on asymmetric systems. To that end, enforce +AArch64-only behavior on PMCR_EL1.LC when on an asymmetric system. + +Fixes: 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support") +Signed-off-by: Oliver Upton +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220816192554.1455559-2-oliver.upton@linux.dev +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/kvm_host.h | 4 ++++ + arch/arm64/kvm/arm.c | 3 +-- + arch/arm64/kvm/sys_regs.c | 4 ++-- + 3 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index fc6ee6c5972d..1713630bf8f5 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -795,6 +795,10 @@ bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu); + #define kvm_vcpu_has_pmu(vcpu) \ + (test_bit(KVM_ARM_VCPU_PMU_V3, (vcpu)->arch.features)) + ++#define kvm_supports_32bit_el0() \ ++ (system_supports_32bit_el0() && \ ++ !static_branch_unlikely(&arm64_mismatched_32bit_el0)) ++ + int kvm_trng_call(struct kvm_vcpu *vcpu); + #ifdef CONFIG_KVM + extern phys_addr_t hyp_mem_base; +diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c +index f181527f9d43..4cb265e15361 100644 +--- a/arch/arm64/kvm/arm.c ++++ b/arch/arm64/kvm/arm.c +@@ -712,8 +712,7 @@ static bool vcpu_mode_is_bad_32bit(struct kvm_vcpu *vcpu) + if (likely(!vcpu_mode_is_32bit(vcpu))) + return false; + +- return !system_supports_32bit_el0() || +- static_branch_unlikely(&arm64_mismatched_32bit_el0); ++ return !kvm_supports_32bit_el0(); + } + + /** +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index 7c18e429b449..c11612db4a37 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -649,7 +649,7 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r) + */ + val = ((pmcr & ~ARMV8_PMU_PMCR_MASK) + | (ARMV8_PMU_PMCR_MASK & 0xdecafbad)) & (~ARMV8_PMU_PMCR_E); +- if (!system_supports_32bit_el0()) ++ if (!kvm_supports_32bit_el0()) + val |= ARMV8_PMU_PMCR_LC; + __vcpu_sys_reg(vcpu, r->reg) = val; + } +@@ -698,7 +698,7 @@ static bool access_pmcr(struct kvm_vcpu *vcpu, struct sys_reg_params *p, + val = __vcpu_sys_reg(vcpu, PMCR_EL0); + val &= ~ARMV8_PMU_PMCR_MASK; + val |= p->regval & ARMV8_PMU_PMCR_MASK; +- if (!system_supports_32bit_el0()) ++ if (!kvm_supports_32bit_el0()) + val |= ARMV8_PMU_PMCR_LC; + __vcpu_sys_reg(vcpu, PMCR_EL0) = val; + kvm_pmu_handle_pmcr(vcpu, val); +-- +2.35.1 + diff --git a/queue-5.15/kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch b/queue-5.15/kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch new file mode 100644 index 00000000000..781b598e273 --- /dev/null +++ b/queue-5.15/kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch @@ -0,0 +1,69 @@ +From 5762d9fec011a5d00249c0e46f579fb01f8cc5b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 10:05:50 -0300 +Subject: KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings + +From: Fabiano Rosas + +[ Upstream commit 9981bace85d816ed8724ac46e49285e8488d29e6 ] + +At debugfs/kvm//vcpu0/timings we show how long each part of the +code takes to run: + +$ cat /sys/kernel/debug/kvm/*-*/vcpu0/timings +rm_entry: 123785 49398892 118 4898 +rm_intr: 123780 6075890 22 390 +rm_exit: 0 0 0 0 <-- NOK +guest: 123780 46732919988 402 9997638 +cede: 0 0 0 0 <-- OK, no cede napping in P9 + +The "rm_exit" is always showing zero because it is the last one and +end_timing does not increment the counter of the previous entry. + +We can fix it by calling accumulate_time again instead of +end_timing. That way the counter gets incremented. The rest of the +arithmetic can be ignored because there are no timing points after +this and the accumulators are reset before the next round. + +Signed-off-by: Fabiano Rosas +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220525130554.2614394-2-farosas@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv_p9_entry.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/arch/powerpc/kvm/book3s_hv_p9_entry.c b/arch/powerpc/kvm/book3s_hv_p9_entry.c +index 961b3d70483c..a0e0c28408c0 100644 +--- a/arch/powerpc/kvm/book3s_hv_p9_entry.c ++++ b/arch/powerpc/kvm/book3s_hv_p9_entry.c +@@ -7,15 +7,6 @@ + #include + + #ifdef CONFIG_KVM_BOOK3S_HV_EXIT_TIMING +-static void __start_timing(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator *next) +-{ +- struct kvmppc_vcore *vc = vcpu->arch.vcore; +- u64 tb = mftb() - vc->tb_offset_applied; +- +- vcpu->arch.cur_activity = next; +- vcpu->arch.cur_tb_start = tb; +-} +- + static void __accumulate_time(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator *next) + { + struct kvmppc_vcore *vc = vcpu->arch.vcore; +@@ -47,8 +38,8 @@ static void __accumulate_time(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator + curr->seqcount = seq + 2; + } + +-#define start_timing(vcpu, next) __start_timing(vcpu, next) +-#define end_timing(vcpu) __start_timing(vcpu, NULL) ++#define start_timing(vcpu, next) __accumulate_time(vcpu, next) ++#define end_timing(vcpu) __accumulate_time(vcpu, NULL) + #define accumulate_time(vcpu, next) __accumulate_time(vcpu, next) + #else + #define start_timing(vcpu, next) do {} while (0) +-- +2.35.1 + diff --git a/queue-5.15/lib-list_debug.c-detect-uninitialized-lists.patch b/queue-5.15/lib-list_debug.c-detect-uninitialized-lists.patch new file mode 100644 index 00000000000..69ebb897b8f --- /dev/null +++ b/queue-5.15/lib-list_debug.c-detect-uninitialized-lists.patch @@ -0,0 +1,80 @@ +From 730db78dededc9e208dea1ddecc996219e51cd0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 15:29:51 -0700 +Subject: lib/list_debug.c: Detect uninitialized lists + +From: Guenter Roeck + +[ Upstream commit 0cc011c576aaa4de505046f7a6c90933d7c749a9 ] + +In some circumstances, attempts are made to add entries to or to remove +entries from an uninitialized list. A prime example is +amdgpu_bo_vm_destroy(): It is indirectly called from +ttm_bo_init_reserved() if that function fails, and tries to remove an +entry from a list. However, that list is only initialized in +amdgpu_bo_create_vm() after the call to ttm_bo_init_reserved() returned +success. This results in crashes such as + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 1479 Comm: chrome Not tainted 5.10.110-15768-g29a72e65dae5 + Hardware name: Google Grunt/Grunt, BIOS Google_Grunt.11031.149.0 07/15/2020 + RIP: 0010:__list_del_entry_valid+0x26/0x7d + ... + Call Trace: + amdgpu_bo_vm_destroy+0x48/0x8b + ttm_bo_init_reserved+0x1d7/0x1e0 + amdgpu_bo_create+0x212/0x476 + ? amdgpu_bo_user_destroy+0x23/0x23 + ? kmem_cache_alloc+0x60/0x271 + amdgpu_bo_create_vm+0x40/0x7d + amdgpu_vm_pt_create+0xe8/0x24b + ... + +Check if the list's prev and next pointers are NULL to catch such problems. + +Link: https://lkml.kernel.org/r/20220531222951.92073-1-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Cc: Steven Rostedt +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/list_debug.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/list_debug.c b/lib/list_debug.c +index 5d5424b51b74..413daa72a3d8 100644 +--- a/lib/list_debug.c ++++ b/lib/list_debug.c +@@ -20,7 +20,11 @@ + bool __list_add_valid(struct list_head *new, struct list_head *prev, + struct list_head *next) + { +- if (CHECK_DATA_CORRUPTION(next->prev != prev, ++ if (CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_add corruption. prev is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next == NULL, ++ "list_add corruption. next is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next->prev != prev, + "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n", + prev, next->prev, next) || + CHECK_DATA_CORRUPTION(prev->next != next, +@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry) + prev = entry->prev; + next = entry->next; + +- if (CHECK_DATA_CORRUPTION(next == LIST_POISON1, ++ if (CHECK_DATA_CORRUPTION(next == NULL, ++ "list_del corruption, %px->next is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_del corruption, %px->prev is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(next == LIST_POISON1, + "list_del corruption, %px->next is LIST_POISON1 (%px)\n", + entry, LIST_POISON1) || + CHECK_DATA_CORRUPTION(prev == LIST_POISON2, +-- +2.35.1 + diff --git a/queue-5.15/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch b/queue-5.15/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch new file mode 100644 index 00000000000..e47d3bc2428 --- /dev/null +++ b/queue-5.15/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch @@ -0,0 +1,50 @@ +From 7bfed3ab7d09fc8c5399b776271928a1b10491d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 10:27:56 -0600 +Subject: md: Notify sysfs sync_completed in md_reap_sync_thread() + +From: Logan Gunthorpe + +[ Upstream commit 9973f0fa7d20269fe6fefe6333997fb5914449c1 ] + +The mdadm test 07layouts randomly produces a kernel hung task deadlock. +The deadlock is caused by the suspend_lo/suspend_hi files being set by +the mdadm background process during reshape and not being cleared +because the process hangs. (Leaving aside the issue of the fragility of +freezing kernel tasks by buggy userspace processes...) + +When the background mdadm process hangs it, is waiting (without a +timeout) on a change to the sync_completed file signalling that the +reshape has completed. The process is woken up a couple times when +the reshape finishes but it is woken up before MD_RECOVERY_RUNNING +is cleared so sync_completed_show() reports 0 instead of "none". + +To fix this, notify the sysfs file in md_reap_sync_thread() after +MD_RECOVERY_RUNNING has been cleared. This wakes up mdadm and causes +it to continue and write to suspend_lo/suspend_hi to allow IO to +continue. + +Signed-off-by: Logan Gunthorpe +Reviewed-by: Christoph Hellwig +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 4bfaf7d4977d..33946adb0d6f 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -9467,6 +9467,7 @@ void md_reap_sync_thread(struct mddev *mddev) + wake_up(&resync_wait); + /* flag recovery needed just to double check */ + set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); ++ sysfs_notify_dirent_safe(mddev->sysfs_completed); + sysfs_notify_dirent_safe(mddev->sysfs_action); + md_new_event(mddev); + if (mddev->event_work.func) +-- +2.35.1 + diff --git a/queue-5.15/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch b/queue-5.15/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch new file mode 100644 index 00000000000..8da1b41b350 --- /dev/null +++ b/queue-5.15/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch @@ -0,0 +1,42 @@ +From f0b9474907c18c41d412fd84566236eae3165440 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 20:41:12 +0800 +Subject: mips: cavium-octeon: Fix missing of_node_put() in + octeon2_usb_clocks_start + +From: Liang He + +[ Upstream commit 7a9f743ceead60ed454c46fbc3085ee9a79cbebb ] + +We should call of_node_put() for the reference 'uctl_node' returned by +of_get_parent() which will increase the refcount. Otherwise, there will +be a refcount leak bug. + +Signed-off-by: Liang He +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/cavium-octeon/octeon-platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index a994022e32c9..ce05c0dd3acd 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev) + "refclk-frequency", &clock_rate); + if (i) { + dev_err(dev, "No UCTL \"refclk-frequency\"\n"); ++ of_node_put(uctl_node); + goto exit; + } + i = of_property_read_string(uctl_node, + "refclk-type", &clock_type); +- ++ of_node_put(uctl_node); + if (!i && strcmp("crystal", clock_type) == 0) + is_crystal_clock = true; + } +-- +2.35.1 + diff --git a/queue-5.15/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch b/queue-5.15/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch new file mode 100644 index 00000000000..ce2e4d7d7dc --- /dev/null +++ b/queue-5.15/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch @@ -0,0 +1,70 @@ +From c1d481f0e7918145ae761caa69be79eb1c0f5c65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 10:59:36 -0700 +Subject: MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 + +From: Nathan Chancellor + +[ Upstream commit 74de14fe05dd6b151d73cb0c73c8ec874cbdcde6 ] + +When CONFIG_XPA is enabled, Clang warns: + + arch/mips/mm/tlbex.c:629:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context] + if (cpu_has_rixi && !!_PAGE_NO_EXEC) { + ^ + arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC' + # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) + ^ + arch/mips/mm/tlbex.c:2568:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context] + if (!cpu_has_rixi || !_PAGE_NO_EXEC) { + ^ + arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC' + # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) + ^ + 2 errors generated. + +_PAGE_NO_EXEC can be '0' or '1 << _PAGE_NO_EXEC_SHIFT' depending on the +build and runtime configuration, which is what the negation operators +are trying to convey. To silence the warning, explicitly compare against +0 so the result of the '<<' operator is not implicitly converted to a +boolean. + +According to its documentation, GCC enables -Wint-in-bool-context with +-Wall but this warning is not visible when building the same +configuration with GCC. It appears GCC only warns when compiling C++, +not C, although the documentation makes no note of this: +https://godbolt.org/z/x39q3brxf + +Reported-by: Sudip Mukherjee (Codethink) +Signed-off-by: Nathan Chancellor +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/tlbex.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c +index 046d51a454af..3471a089bc05 100644 +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -634,7 +634,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p, + return; + } + +- if (cpu_has_rixi && !!_PAGE_NO_EXEC) { ++ if (cpu_has_rixi && _PAGE_NO_EXEC != 0) { + if (fill_includes_sw_bits) { + UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL)); + } else { +@@ -2573,7 +2573,7 @@ static void check_pabits(void) + unsigned long entry; + unsigned pabits, fillbits; + +- if (!cpu_has_rixi || !_PAGE_NO_EXEC) { ++ if (!cpu_has_rixi || _PAGE_NO_EXEC == 0) { + /* + * We'll only be making use of the fact that we can rotate bits + * into the fill if the CPU supports RIXI, so don't bother +-- +2.35.1 + diff --git a/queue-5.15/mmc-tmio-avoid-glitches-when-resetting.patch b/queue-5.15/mmc-tmio-avoid-glitches-when-resetting.patch new file mode 100644 index 00000000000..ea96350d832 --- /dev/null +++ b/queue-5.15/mmc-tmio-avoid-glitches-when-resetting.patch @@ -0,0 +1,210 @@ +From e3196e713e8f9cc54c3bc2cc75b33ea2056a0b50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jun 2022 15:17:22 +0200 +Subject: mmc: tmio: avoid glitches when resetting + +From: Wolfram Sang + +[ Upstream commit 2e586f8a5b0ed4a525014a692923ac96f6647816 ] + +If we reset because of an error, we need to preserve values for the +clock frequency. Otherwise, glitches may be seen on the bus. + +To achieve that, we introduce a 'preserve' parameter to the reset +function and the IP core specific reset callbacks to handle everything +accordingly. + +Reported-by: Yoshihiro Shimoda +Signed-off-by: Wolfram Sang +Tested-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20220625131722.1397-1-wsa@kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/renesas_sdhi_core.c | 29 ++++++++++++++-------------- + drivers/mmc/host/tmio_mmc.c | 2 +- + drivers/mmc/host/tmio_mmc.h | 6 +++++- + drivers/mmc/host/tmio_mmc_core.c | 28 +++++++++++++++++++++------ + 4 files changed, 42 insertions(+), 23 deletions(-) + +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 791e180a0617..387f2a4f693a 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -51,9 +51,6 @@ + #define HOST_MODE_GEN3_32BIT (HOST_MODE_GEN3_WMODE | HOST_MODE_GEN3_BUSWIDTH) + #define HOST_MODE_GEN3_64BIT 0 + +-#define CTL_SDIF_MODE 0xe6 +-#define SDIF_MODE_HS400 BIT(0) +- + #define SDHI_VER_GEN2_SDR50 0x490c + #define SDHI_VER_RZ_A1 0x820b + /* very old datasheets said 0x490c for SDR104, too. They are wrong! */ +@@ -550,23 +547,25 @@ static void renesas_sdhi_scc_reset(struct tmio_mmc_host *host, struct renesas_sd + } + + /* only populated for TMIO_MMC_MIN_RCAR2 */ +-static void renesas_sdhi_reset(struct tmio_mmc_host *host) ++static void renesas_sdhi_reset(struct tmio_mmc_host *host, bool preserve) + { + struct renesas_sdhi *priv = host_to_priv(host); + int ret; + u16 val; + +- if (priv->rstc) { +- reset_control_reset(priv->rstc); +- /* Unknown why but without polling reset status, it will hang */ +- read_poll_timeout(reset_control_status, ret, ret == 0, 1, 100, +- false, priv->rstc); +- /* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */ +- sd_ctrl_write16(host, CTL_RESET_SD, 0x0001); +- priv->needs_adjust_hs400 = false; +- renesas_sdhi_set_clock(host, host->clk_cache); +- } else if (priv->scc_ctl) { +- renesas_sdhi_scc_reset(host, priv); ++ if (!preserve) { ++ if (priv->rstc) { ++ reset_control_reset(priv->rstc); ++ /* Unknown why but without polling reset status, it will hang */ ++ read_poll_timeout(reset_control_status, ret, ret == 0, 1, 100, ++ false, priv->rstc); ++ /* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */ ++ sd_ctrl_write16(host, CTL_RESET_SD, 0x0001); ++ priv->needs_adjust_hs400 = false; ++ renesas_sdhi_set_clock(host, host->clk_cache); ++ } else if (priv->scc_ctl) { ++ renesas_sdhi_scc_reset(host, priv); ++ } + } + + if (sd_ctrl_read16(host, CTL_VERSION) >= SDHI_VER_GEN3_SD) { +diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c +index b55a29c53d9c..53a2ad9a24b8 100644 +--- a/drivers/mmc/host/tmio_mmc.c ++++ b/drivers/mmc/host/tmio_mmc.c +@@ -75,7 +75,7 @@ static void tmio_mmc_set_clock(struct tmio_mmc_host *host, + tmio_mmc_clk_start(host); + } + +-static void tmio_mmc_reset(struct tmio_mmc_host *host) ++static void tmio_mmc_reset(struct tmio_mmc_host *host, bool preserve) + { + sd_ctrl_write16(host, CTL_RESET_SDIO, 0x0000); + usleep_range(10000, 11000); +diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h +index f936aad945ce..da63193dd45b 100644 +--- a/drivers/mmc/host/tmio_mmc.h ++++ b/drivers/mmc/host/tmio_mmc.h +@@ -42,6 +42,7 @@ + #define CTL_DMA_ENABLE 0xd8 + #define CTL_RESET_SD 0xe0 + #define CTL_VERSION 0xe2 ++#define CTL_SDIF_MODE 0xe6 /* only known on R-Car 2+ */ + + /* Definitions for values the CTL_STOP_INTERNAL_ACTION register can take */ + #define TMIO_STOP_STP BIT(0) +@@ -98,6 +99,9 @@ + /* Definitions for values the CTL_DMA_ENABLE register can take */ + #define DMA_ENABLE_DMASDRW BIT(1) + ++/* Definitions for values the CTL_SDIF_MODE register can take */ ++#define SDIF_MODE_HS400 BIT(0) /* only known on R-Car 2+ */ ++ + /* Define some IRQ masks */ + /* This is the mask used at reset by the chip */ + #define TMIO_MASK_ALL 0x837f031d +@@ -181,7 +185,7 @@ struct tmio_mmc_host { + int (*multi_io_quirk)(struct mmc_card *card, + unsigned int direction, int blk_size); + int (*write16_hook)(struct tmio_mmc_host *host, int addr); +- void (*reset)(struct tmio_mmc_host *host); ++ void (*reset)(struct tmio_mmc_host *host, bool preserve); + bool (*check_retune)(struct tmio_mmc_host *host, struct mmc_request *mrq); + void (*fixup_request)(struct tmio_mmc_host *host, struct mmc_request *mrq); + unsigned int (*get_timeout_cycles)(struct tmio_mmc_host *host); +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index a5850d83908b..437048bb8027 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -179,8 +179,17 @@ static void tmio_mmc_set_bus_width(struct tmio_mmc_host *host, + sd_ctrl_write16(host, CTL_SD_MEM_CARD_OPT, reg); + } + +-static void tmio_mmc_reset(struct tmio_mmc_host *host) ++static void tmio_mmc_reset(struct tmio_mmc_host *host, bool preserve) + { ++ u16 card_opt, clk_ctrl, sdif_mode; ++ ++ if (preserve) { ++ card_opt = sd_ctrl_read16(host, CTL_SD_MEM_CARD_OPT); ++ clk_ctrl = sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL); ++ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) ++ sdif_mode = sd_ctrl_read16(host, CTL_SDIF_MODE); ++ } ++ + /* FIXME - should we set stop clock reg here */ + sd_ctrl_write16(host, CTL_RESET_SD, 0x0000); + usleep_range(10000, 11000); +@@ -190,7 +199,7 @@ static void tmio_mmc_reset(struct tmio_mmc_host *host) + tmio_mmc_abort_dma(host); + + if (host->reset) +- host->reset(host); ++ host->reset(host, preserve); + + sd_ctrl_write32_as_16_and_16(host, CTL_IRQ_MASK, host->sdcard_irq_mask_all); + host->sdcard_irq_mask = host->sdcard_irq_mask_all; +@@ -206,6 +215,13 @@ static void tmio_mmc_reset(struct tmio_mmc_host *host) + sd_ctrl_write16(host, CTL_TRANSACTION_CTL, 0x0001); + } + ++ if (preserve) { ++ sd_ctrl_write16(host, CTL_SD_MEM_CARD_OPT, card_opt); ++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk_ctrl); ++ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) ++ sd_ctrl_write16(host, CTL_SDIF_MODE, sdif_mode); ++ } ++ + if (host->mmc->card) + mmc_retune_needed(host->mmc); + } +@@ -248,7 +264,7 @@ static void tmio_mmc_reset_work(struct work_struct *work) + + spin_unlock_irqrestore(&host->lock, flags); + +- tmio_mmc_reset(host); ++ tmio_mmc_reset(host, true); + + /* Ready for new calls */ + host->mrq = NULL; +@@ -961,7 +977,7 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + tmio_mmc_power_off(host); + /* For R-Car Gen2+, we need to reset SDHI specific SCC */ + if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) +- tmio_mmc_reset(host); ++ tmio_mmc_reset(host, false); + + host->set_clock(host, 0); + break; +@@ -1189,7 +1205,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host) + _host->sdcard_irq_mask_all = TMIO_MASK_ALL; + + _host->set_clock(_host, 0); +- tmio_mmc_reset(_host); ++ tmio_mmc_reset(_host, false); + + spin_lock_init(&_host->lock); + mutex_init(&_host->ios_lock); +@@ -1285,7 +1301,7 @@ int tmio_mmc_host_runtime_resume(struct device *dev) + struct tmio_mmc_host *host = dev_get_drvdata(dev); + + tmio_mmc_clk_enable(host); +- tmio_mmc_reset(host); ++ tmio_mmc_reset(host, false); + + if (host->clk_cache) + host->set_clock(host, host->clk_cache); +-- +2.35.1 + diff --git a/queue-5.15/modules-ensure-natural-alignment-for-.altinstruction.patch b/queue-5.15/modules-ensure-natural-alignment-for-.altinstruction.patch new file mode 100644 index 00000000000..c80dfc30858 --- /dev/null +++ b/queue-5.15/modules-ensure-natural-alignment-for-.altinstruction.patch @@ -0,0 +1,57 @@ +From f4dc2097c1e4beb572614094a33be2ffa19b115a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:44:54 +0200 +Subject: modules: Ensure natural alignment for .altinstructions and + __bug_table sections + +From: Helge Deller + +[ Upstream commit 87c482bdfa79f378297d92af49cdf265be199df5 ] + +In the kernel image vmlinux.lds.S linker scripts the .altinstructions +and __bug_table sections are 4- or 8-byte aligned because they hold 32- +and/or 64-bit values. + +Most architectures use altinstructions and BUG() or WARN() in modules as +well, but in the module linker script (module.lds.S) those sections are +currently missing. As consequence the linker will store their content +byte-aligned by default, which then can lead to unnecessary unaligned +memory accesses by the CPU when those tables are processed at runtime. + +Usually unaligned memory accesses are unnoticed, because either the +hardware (as on x86 CPUs) or in-kernel exception handlers (e.g. on +parisc or sparc) emulate and fix them up at runtime. Nevertheless, such +unaligned accesses introduce a performance penalty and can even crash +the kernel if there is a bug in the unalignment exception handlers +(which happened once to me on the parisc architecture and which is why I +noticed that issue at all). + +This patch fixes a non-critical issue and might be backported at any time. +It's trivial and shouldn't introduce any regression because it simply +tells the linker to use a different (8-byte alignment) for those +sections by default. + +Signed-off-by: Helge Deller +Link: https://lore.kernel.org/all/Yr8%2Fgr8e8I7tVX4d@p100/ +Signed-off-by: Luis Chamberlain +Signed-off-by: Sasha Levin +--- + scripts/module.lds.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/module.lds.S b/scripts/module.lds.S +index 1d0e1e4dc3d2..3a3aa2354ed8 100644 +--- a/scripts/module.lds.S ++++ b/scripts/module.lds.S +@@ -27,6 +27,8 @@ SECTIONS { + .ctors 0 : ALIGN(8) { *(SORT(.ctors.*)) *(.ctors) } + .init_array 0 : ALIGN(8) { *(SORT(.init_array.*)) *(.init_array) } + ++ .altinstructions 0 : ALIGN(8) { KEEP(*(.altinstructions)) } ++ __bug_table 0 : ALIGN(8) { KEEP(*(__bug_table)) } + __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) } + + __patchable_function_entries : { *(__patchable_function_entries) } +-- +2.35.1 + diff --git a/queue-5.15/net-qrtr-start-mhi-channel-after-endpoit-creation.patch b/queue-5.15/net-qrtr-start-mhi-channel-after-endpoit-creation.patch new file mode 100644 index 00000000000..66e44fcbd6d --- /dev/null +++ b/queue-5.15/net-qrtr-start-mhi-channel-after-endpoit-creation.patch @@ -0,0 +1,80 @@ +From 01e1981769e4374e4d752ed4e5fa016764f0f17c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 12:48:40 +0300 +Subject: net: qrtr: start MHI channel after endpoit creation + +From: Maxim Kochetkov + +[ Upstream commit 68a838b84effb7b57ba7d50b1863fc6ae35a54ce ] + +MHI channel may generates event/interrupt right after enabling. +It may leads to 2 race conditions issues. + +1) +Such event may be dropped by qcom_mhi_qrtr_dl_callback() at check: + + if (!qdev || mhi_res->transaction_status) + return; + +Because dev_set_drvdata(&mhi_dev->dev, qdev) may be not performed at +this moment. In this situation qrtr-ns will be unable to enumerate +services in device. +--------------------------------------------------------------- + +2) +Such event may come at the moment after dev_set_drvdata() and +before qrtr_endpoint_register(). In this case kernel will panic with +accessing wrong pointer at qcom_mhi_qrtr_dl_callback(): + + rc = qrtr_endpoint_post(&qdev->ep, mhi_res->buf_addr, + mhi_res->bytes_xferd); + +Because endpoint is not created yet. +-------------------------------------------------------------- +So move mhi_prepare_for_transfer_autoqueue after endpoint creation +to fix it. + +Fixes: a2e2cc0dbb11 ("net: qrtr: Start MHI channels during init") +Signed-off-by: Maxim Kochetkov +Reviewed-by: Hemant Kumar +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Loic Poulain +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/mhi.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/qrtr/mhi.c b/net/qrtr/mhi.c +index fa611678af05..49e7cab43d24 100644 +--- a/net/qrtr/mhi.c ++++ b/net/qrtr/mhi.c +@@ -78,11 +78,6 @@ static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev, + struct qrtr_mhi_dev *qdev; + int rc; + +- /* start channels */ +- rc = mhi_prepare_for_transfer(mhi_dev); +- if (rc) +- return rc; +- + qdev = devm_kzalloc(&mhi_dev->dev, sizeof(*qdev), GFP_KERNEL); + if (!qdev) + return -ENOMEM; +@@ -96,6 +91,13 @@ static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev, + if (rc) + return rc; + ++ /* start channels */ ++ rc = mhi_prepare_for_transfer(mhi_dev); ++ if (rc) { ++ qrtr_endpoint_unregister(&qdev->ep); ++ return rc; ++ } ++ + dev_dbg(qdev->dev, "Qualcomm MHI QRTR driver probed\n"); + + return 0; +-- +2.35.1 + diff --git a/queue-5.15/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch b/queue-5.15/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch new file mode 100644 index 00000000000..4f3379142df --- /dev/null +++ b/queue-5.15/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch @@ -0,0 +1,46 @@ +From c301bb151e57dd7988690f870bba4c75fca4359e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Jul 2022 11:58:43 +0300 +Subject: nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue + teardown + +From: Sagi Grimberg + +[ Upstream commit 533d2e8b4d5e4c89772a0adce913525fb86cbbee ] + +We probably need nvmet_tcp_wq to have MEM_RECLAIM as we are +sending/receiving for the socket from works on this workqueue. +Also this eliminates lockdep complaints: +-- +[ 6174.010200] workqueue: WQ_MEM_RECLAIM +nvmet-wq:nvmet_tcp_release_queue_work [nvmet_tcp] is flushing +!WQ_MEM_RECLAIM nvmet_tcp_wq:nvmet_tcp_io_work [nvmet_tcp] +[ 6174.010216] WARNING: CPU: 20 PID: 14456 at kernel/workqueue.c:2628 +check_flush_dependency+0x110/0x14c + +Reported-by: Yi Zhang +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index f592e5f7f5f3..889c5433c94d 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1834,7 +1834,8 @@ static int __init nvmet_tcp_init(void) + { + int ret; + +- nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", WQ_HIGHPRI, 0); ++ nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", ++ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0); + if (!nvmet_tcp_wq) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-5.15/openrisc-io-define-iounmap-argument-as-volatile.patch b/queue-5.15/openrisc-io-define-iounmap-argument-as-volatile.patch new file mode 100644 index 00000000000..875ee5196ad --- /dev/null +++ b/queue-5.15/openrisc-io-define-iounmap-argument-as-volatile.patch @@ -0,0 +1,67 @@ +From 89566056c09f4f4ccb5f6ebe2aaf1f305bac1497 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jul 2022 19:54:08 +0900 +Subject: openrisc: io: Define iounmap argument as volatile + +From: Stafford Horne + +[ Upstream commit 52e0ea900202d23843daee8f7089817e81dd3dd7 ] + +When OpenRISC enables PCI it allows for more drivers to be compiled +resulting in exposing the following with -Werror. + + drivers/video/fbdev/riva/fbdev.c: In function 'rivafb_probe': + drivers/video/fbdev/riva/fbdev.c:2062:42: error: + passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type + + drivers/video/fbdev/nvidia/nvidia.c: In function 'nvidiafb_probe': + drivers/video/fbdev/nvidia/nvidia.c:1414:20: error: + passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type + + drivers/scsi/aic7xxx/aic7xxx_osm.c: In function 'ahc_platform_free': + drivers/scsi/aic7xxx/aic7xxx_osm.c:1231:41: error: + passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type + +Most architectures define the iounmap argument to be volatile. To fix this +issue we do the same for OpenRISC. This patch must go before PCI is enabled on +OpenRISC to avoid any compile failures. + +Link: https://lore.kernel.org/lkml/20220729033728.GA2195022@roeck-us.net/ +Reported-by: Guenter Roeck +Tested-by: Guenter Roeck +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/io.h | 2 +- + arch/openrisc/mm/ioremap.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/openrisc/include/asm/io.h b/arch/openrisc/include/asm/io.h +index c298061c70a7..8aa3e78181e9 100644 +--- a/arch/openrisc/include/asm/io.h ++++ b/arch/openrisc/include/asm/io.h +@@ -31,7 +31,7 @@ + void __iomem *ioremap(phys_addr_t offset, unsigned long size); + + #define iounmap iounmap +-extern void iounmap(void __iomem *addr); ++extern void iounmap(volatile void __iomem *addr); + + #include + +diff --git a/arch/openrisc/mm/ioremap.c b/arch/openrisc/mm/ioremap.c +index daae13a76743..8ec0dafecf25 100644 +--- a/arch/openrisc/mm/ioremap.c ++++ b/arch/openrisc/mm/ioremap.c +@@ -77,7 +77,7 @@ void __iomem *__ref ioremap(phys_addr_t addr, unsigned long size) + } + EXPORT_SYMBOL(ioremap); + +-void iounmap(void __iomem *addr) ++void iounmap(volatile void __iomem *addr) + { + /* If the page is from the fixmap pool then we just clear out + * the fixmap mapping. +-- +2.35.1 + diff --git a/queue-5.15/ovl-warn-if-trusted-xattr-creation-fails.patch b/queue-5.15/ovl-warn-if-trusted-xattr-creation-fails.patch new file mode 100644 index 00000000000..ef73b9597cd --- /dev/null +++ b/queue-5.15/ovl-warn-if-trusted-xattr-creation-fails.patch @@ -0,0 +1,68 @@ +From 8d89b56a75a591a640d24264fa8353814fed7f07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 16:31:30 +0200 +Subject: ovl: warn if trusted xattr creation fails + +From: Miklos Szeredi + +[ Upstream commit b10b85fe5149ee8b39fbbf86095b303632dde2cd ] + +When mounting overlayfs in an unprivileged user namespace, trusted xattr +creation will fail. This will lead to failures in some file operations, +e.g. in the following situation: + + mkdir lower upper work merged + mkdir lower/directory + mount -toverlay -olowerdir=lower,upperdir=upper,workdir=work none merged + rmdir merged/directory + mkdir merged/directory + +The last mkdir will fail: + + mkdir: cannot create directory 'merged/directory': Input/output error + +The cause for these failures is currently extremely non-obvious and hard to +debug. Hence, warn the user and suggest using the userxattr mount option, +if it is not already supplied and xattr creation fails during the +self-check. + +Reported-by: Alois Wohlschlager +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/overlayfs/super.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 7bb0a47cb615..9837aaf9caf1 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -1413,11 +1413,12 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs, + */ + err = ovl_do_setxattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE, "0", 1); + if (err) { ++ pr_warn("failed to set xattr on upper\n"); + ofs->noxattr = true; + if (ofs->config.index || ofs->config.metacopy) { + ofs->config.index = false; + ofs->config.metacopy = false; +- pr_warn("upper fs does not support xattr, falling back to index=off,metacopy=off.\n"); ++ pr_warn("...falling back to index=off,metacopy=off.\n"); + } + /* + * xattr support is required for persistent st_ino. +@@ -1425,8 +1426,10 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs, + */ + if (ofs->config.xino == OVL_XINO_AUTO) { + ofs->config.xino = OVL_XINO_OFF; +- pr_warn("upper fs does not support xattr, falling back to xino=off.\n"); ++ pr_warn("...falling back to xino=off.\n"); + } ++ if (err == -EPERM && !ofs->config.userxattr) ++ pr_info("try mounting with 'userxattr' option\n"); + err = 0; + } else { + ovl_do_removexattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE); +-- +2.35.1 + diff --git a/queue-5.15/pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch b/queue-5.15/pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch new file mode 100644 index 00000000000..6e4e2b82257 --- /dev/null +++ b/queue-5.15/pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch @@ -0,0 +1,102 @@ +From eec294adc6bc11a755d0b9f084775c8e5b323fd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 15:28:27 +0200 +Subject: PCI: aardvark: Fix reporting Slot capabilities on emulated bridge +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit bcdb6fd4f3e9ac1097698c8d8f56b70853b49873 ] + +Slot capabilities are currently not reported because emulated bridge does +not report the PCI_EXP_FLAGS_SLOT flag. + +Set PCI_EXP_FLAGS_SLOT to let the kernel know that PCI_EXP_SLT* registers +are supported. + +Move setting of PCI_EXP_SLTCTL register from "dynamic" pcie_conf_read +function to static buffer as it is only statically filled the +PCI_EXP_SLTSTA_PDS flag and dynamic read callback is not needed for this +register. + +Set Presence State Bit to 1 since there is no support for unplugging the +card and there is currently no platform able to detect presence of a card - +in such a case the bit needs to be set to 1. + +Finally correctly set Physical Slot Number to 1 since there is only one +port and zero value is reserved for ports within the same silicon as Root +Port which is not our case for Aardvark HW. + +Link: https://lore.kernel.org/r/20220524132827.8837-3-kabel@kernel.org +Signed-off-by: Pali Rohár +Signed-off-by: Marek Behún +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-aardvark.c | 33 +++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index 7cc2c54daad0..215f7510de9a 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -8,6 +8,7 @@ + * Author: Hezi Shahmoon + */ + ++#include + #include + #include + #include +@@ -857,14 +858,11 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, + + + switch (reg) { +- case PCI_EXP_SLTCTL: +- *value = PCI_EXP_SLTSTA_PDS << 16; +- return PCI_BRIDGE_EMUL_HANDLED; +- + /* +- * PCI_EXP_RTCTL and PCI_EXP_RTSTA are also supported, but do not need +- * to be handled here, because their values are stored in emulated +- * config space buffer, and we read them from there when needed. ++ * PCI_EXP_SLTCAP, PCI_EXP_SLTCTL, PCI_EXP_RTCTL and PCI_EXP_RTSTA are ++ * also supported, but do not need to be handled here, because their ++ * values are stored in emulated config space buffer, and we read them ++ * from there when needed. + */ + + case PCI_EXP_LNKCAP: { +@@ -977,8 +975,25 @@ static int advk_sw_pci_bridge_init(struct advk_pcie *pcie) + /* Support interrupt A for MSI feature */ + bridge->conf.intpin = PCI_INTERRUPT_INTA; + +- /* Aardvark HW provides PCIe Capability structure in version 2 */ +- bridge->pcie_conf.cap = cpu_to_le16(2); ++ /* ++ * Aardvark HW provides PCIe Capability structure in version 2 and ++ * indicate slot support, which is emulated. ++ */ ++ bridge->pcie_conf.cap = cpu_to_le16(2 | PCI_EXP_FLAGS_SLOT); ++ ++ /* ++ * Set Presence Detect State bit permanently since there is no support ++ * for unplugging the card nor detecting whether it is plugged. (If a ++ * platform exists in the future that supports it, via a GPIO for ++ * example, it should be implemented via this bit.) ++ * ++ * Set physical slot number to 1 since there is only one port and zero ++ * value is reserved for ports within the same silicon as Root Port ++ * which is not our case. ++ */ ++ bridge->pcie_conf.slotcap = cpu_to_le32(FIELD_PREP(PCI_EXP_SLTCAP_PSN, ++ 1)); ++ bridge->pcie_conf.slotsta = cpu_to_le16(PCI_EXP_SLTSTA_PDS); + + /* Indicates supports for Completion Retry Status */ + bridge->pcie_conf.rootcap = cpu_to_le16(PCI_EXP_RTCAP_CRSVIS); +-- +2.35.1 + diff --git a/queue-5.15/pci-acpi-guard-arm64-specific-mcfg_quirks.patch b/queue-5.15/pci-acpi-guard-arm64-specific-mcfg_quirks.patch new file mode 100644 index 00000000000..7c6f7af465f --- /dev/null +++ b/queue-5.15/pci-acpi-guard-arm64-specific-mcfg_quirks.patch @@ -0,0 +1,44 @@ +From 2c87f3ca03daa55ec5fc10ecc49d009b7fd14909 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 20:42:10 +0800 +Subject: PCI/ACPI: Guard ARM64-specific mcfg_quirks + +From: Huacai Chen + +[ Upstream commit 40a6cc141b4b9580de140bcb3e893445708acc5d ] + +Guard ARM64-specific quirks with CONFIG_ARM64 to avoid build errors, +since mcfg_quirks will be shared by more than one architectures. + +Link: https://lore.kernel.org/r/20220714124216.1489304-2-chenhuacai@loongson.cn +Signed-off-by: Huacai Chen +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/acpi/pci_mcfg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c +index 53cab975f612..63b98eae5e75 100644 +--- a/drivers/acpi/pci_mcfg.c ++++ b/drivers/acpi/pci_mcfg.c +@@ -41,6 +41,8 @@ struct mcfg_fixup { + static struct mcfg_fixup mcfg_quirks[] = { + /* { OEM_ID, OEM_TABLE_ID, REV, SEGMENT, BUS_RANGE, ops, cfgres }, */ + ++#ifdef CONFIG_ARM64 ++ + #define AL_ECAM(table_id, rev, seg, ops) \ + { "AMAZON", table_id, rev, seg, MCFG_BUS_ANY, ops } + +@@ -169,6 +171,7 @@ static struct mcfg_fixup mcfg_quirks[] = { + ALTRA_ECAM_QUIRK(1, 13), + ALTRA_ECAM_QUIRK(1, 14), + ALTRA_ECAM_QUIRK(1, 15), ++#endif /* ARM64 */ + }; + + static char mcfg_oem_id[ACPI_OEM_ID_SIZE]; +-- +2.35.1 + diff --git a/queue-5.15/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch b/queue-5.15/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch new file mode 100644 index 00000000000..20d363d526b --- /dev/null +++ b/queue-5.15/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch @@ -0,0 +1,44 @@ +From 6e43659eb5fc2e9b28776842c3e163726a15dccf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 13:41:47 -0400 +Subject: PCI: Add ACS quirk for Broadcom BCM5750x NICs + +From: Pavan Chebbi + +[ Upstream commit afd306a65cedb9589564bdb23a0c368abc4215fd ] + +The Broadcom BCM5750x NICs may be multi-function devices. They do not +advertise ACS capability. Peer-to-peer transactions are not possible +between the individual functions, so it is safe to treat them as fully +isolated. + +Add an ACS quirk for these devices so the functions can be in independent +IOMMU groups and attached individually to userspace applications using +VFIO. + +Link: https://lore.kernel.org/r/1654796507-28610-1-git-send-email-michael.chan@broadcom.com +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 4893b1e82403..a531064233f9 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4923,6 +4923,9 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, + /* Broadcom multi-function device */ + { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, + /* Amazon Annapurna Labs */ + { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs }, +-- +2.35.1 + diff --git a/queue-5.15/phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch b/queue-5.15/phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch new file mode 100644 index 00000000000..857f348f33c --- /dev/null +++ b/queue-5.15/phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch @@ -0,0 +1,87 @@ +From 22ee9089bd3668b65d8d586826db17ea4c546ead Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jun 2022 00:04:08 +0200 +Subject: phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks + +From: Marek Szyprowski + +[ Upstream commit f2812227bb07e2eaee74253f11cea1576945df31 ] + +The exynos-pcie driver called phy_power_on() before phy_init() for some +historical reasons. However the generic PHY framework assumes that the +proper sequence is to call phy_init() first, then phy_power_on(). The +operations done by both functions should be considered as one action and as +such they are called by the exynos-pcie driver (without doing anything +between them). The initialization is just a sequence of register writes, +which cannot be altered without breaking the hardware operation. + +To match the generic PHY framework requirement, simply move all register +writes to the phy_init()/phy_exit() and drop power_on()/power_off() +callbacks. This way the driver will also work with the old (incorrect) +PHY initialization call sequence. + +Link: https://lore.kernel.org/r/20220628220409.26545-1-m.szyprowski@samsung.com +Reported-by: Bjorn Helgaas +Signed-off-by: Marek Szyprowski +Signed-off-by: Bjorn Helgaas +Reviewed-by: Chanho Park +Acked-by: Krzysztof Kozlowski +Acked-By: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/samsung/phy-exynos-pcie.c | 25 +++++++++---------------- + 1 file changed, 9 insertions(+), 16 deletions(-) + +diff --git a/drivers/phy/samsung/phy-exynos-pcie.c b/drivers/phy/samsung/phy-exynos-pcie.c +index 578cfe07d07a..53c9230c2907 100644 +--- a/drivers/phy/samsung/phy-exynos-pcie.c ++++ b/drivers/phy/samsung/phy-exynos-pcie.c +@@ -51,6 +51,13 @@ static int exynos5433_pcie_phy_init(struct phy *phy) + { + struct exynos_pcie_phy *ep = phy_get_drvdata(phy); + ++ regmap_update_bits(ep->pmureg, EXYNOS5433_PMU_PCIE_PHY_OFFSET, ++ BIT(0), 1); ++ regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_GLOBAL_RESET, ++ PCIE_APP_REQ_EXIT_L1_MODE, 0); ++ regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_L1SUB_CM_CON, ++ PCIE_REFCLK_GATING_EN, 0); ++ + regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_COMMON_RESET, + PCIE_PHY_RESET, 1); + regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_MAC_RESET, +@@ -109,20 +116,7 @@ static int exynos5433_pcie_phy_init(struct phy *phy) + return 0; + } + +-static int exynos5433_pcie_phy_power_on(struct phy *phy) +-{ +- struct exynos_pcie_phy *ep = phy_get_drvdata(phy); +- +- regmap_update_bits(ep->pmureg, EXYNOS5433_PMU_PCIE_PHY_OFFSET, +- BIT(0), 1); +- regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_GLOBAL_RESET, +- PCIE_APP_REQ_EXIT_L1_MODE, 0); +- regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_L1SUB_CM_CON, +- PCIE_REFCLK_GATING_EN, 0); +- return 0; +-} +- +-static int exynos5433_pcie_phy_power_off(struct phy *phy) ++static int exynos5433_pcie_phy_exit(struct phy *phy) + { + struct exynos_pcie_phy *ep = phy_get_drvdata(phy); + +@@ -135,8 +129,7 @@ static int exynos5433_pcie_phy_power_off(struct phy *phy) + + static const struct phy_ops exynos5433_phy_ops = { + .init = exynos5433_pcie_phy_init, +- .power_on = exynos5433_pcie_phy_power_on, +- .power_off = exynos5433_pcie_phy_power_off, ++ .exit = exynos5433_pcie_phy_exit, + .owner = THIS_MODULE, + }; + +-- +2.35.1 + diff --git a/queue-5.15/pinctrl-intel-check-against-matching-data-instead-of.patch b/queue-5.15/pinctrl-intel-check-against-matching-data-instead-of.patch new file mode 100644 index 00000000000..c724a3c5392 --- /dev/null +++ b/queue-5.15/pinctrl-intel-check-against-matching-data-instead-of.patch @@ -0,0 +1,67 @@ +From 1a84f12bebaa1b9320a1c793a661e552d0017524 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 19:41:28 +0300 +Subject: pinctrl: intel: Check against matching data instead of ACPI companion + +From: Andy Shevchenko + +[ Upstream commit c551bd81d198bf1dcd4398d5454acdc0309dbe77 ] + +In some cases we may get a platform device that has ACPI companion +which is different to the pin control described in the ACPI tables. +This is primarily happens when device is instantiated by board file. + +In order to allow this device being enumerated, refactor +intel_pinctrl_get_soc_data() to check the matching data instead of +ACPI companion. + +Reported-by: Henning Schild +Signed-off-by: Andy Shevchenko +Tested-by: Henning Schild +Acked-by: Hans de Goede +Acked-by: Mika Westerberg +Acked-by: Linus Walleij +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-intel.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c +index 826d494f3cc6..48f55991ae8c 100644 +--- a/drivers/pinctrl/intel/pinctrl-intel.c ++++ b/drivers/pinctrl/intel/pinctrl-intel.c +@@ -1626,16 +1626,14 @@ EXPORT_SYMBOL_GPL(intel_pinctrl_probe_by_uid); + + const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_device *pdev) + { ++ const struct intel_pinctrl_soc_data * const *table; + const struct intel_pinctrl_soc_data *data = NULL; +- const struct intel_pinctrl_soc_data **table; +- struct acpi_device *adev; +- unsigned int i; + +- adev = ACPI_COMPANION(&pdev->dev); +- if (adev) { +- const void *match = device_get_match_data(&pdev->dev); ++ table = device_get_match_data(&pdev->dev); ++ if (table) { ++ struct acpi_device *adev = ACPI_COMPANION(&pdev->dev); ++ unsigned int i; + +- table = (const struct intel_pinctrl_soc_data **)match; + for (i = 0; table[i]; i++) { + if (!strcmp(adev->pnp.unique_id, table[i]->uid)) { + data = table[i]; +@@ -1649,7 +1647,7 @@ const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_ + if (!id) + return ERR_PTR(-ENODEV); + +- table = (const struct intel_pinctrl_soc_data **)id->driver_data; ++ table = (const struct intel_pinctrl_soc_data * const *)id->driver_data; + data = table[pdev->id]; + } + +-- +2.35.1 + diff --git a/queue-5.15/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch b/queue-5.15/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch new file mode 100644 index 00000000000..f38ddac21bc --- /dev/null +++ b/queue-5.15/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch @@ -0,0 +1,48 @@ +From cae5b9b236b599cdc8fad8294f1ab6680620889a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 08:49:49 +0000 +Subject: platform/chrome: cros_ec_proto: don't show MKBP version if + unsupported + +From: Tzung-Bi Shih + +[ Upstream commit b36f0643ff14a2fb281b105418e4e73c9d7c11d0 ] + +It wrongly showed the following message when it doesn't support MKBP: +"MKBP support version 4294967295". + +Fix it. + +Reviewed-by: Guenter Roeck +Signed-off-by: Tzung-Bi Shih +Link: https://lore.kernel.org/r/20220609084957.3684698-14-tzungbi@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_proto.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index ed2b4807328d..1575d603d3ff 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -507,13 +507,13 @@ int cros_ec_query_all(struct cros_ec_device *ec_dev) + ret = cros_ec_get_host_command_version_mask(ec_dev, + EC_CMD_GET_NEXT_EVENT, + &ver_mask); +- if (ret < 0 || ver_mask == 0) ++ if (ret < 0 || ver_mask == 0) { + ec_dev->mkbp_event_supported = 0; +- else ++ } else { + ec_dev->mkbp_event_supported = fls(ver_mask); + +- dev_dbg(ec_dev->dev, "MKBP support version %u\n", +- ec_dev->mkbp_event_supported - 1); ++ dev_dbg(ec_dev->dev, "MKBP support version %u\n", ec_dev->mkbp_event_supported - 1); ++ } + + /* Probe if host sleep v1 is supported for S0ix failure detection. */ + ret = cros_ec_get_host_command_version_mask(ec_dev, +-- +2.35.1 + diff --git a/queue-5.15/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch b/queue-5.15/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch new file mode 100644 index 00000000000..88dae5f1b9d --- /dev/null +++ b/queue-5.15/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch @@ -0,0 +1,151 @@ +From 4bb9c7426f76469e60681dff51d675b5e9452274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 16:19:30 +0200 +Subject: powerpc/32: Don't always pass -mcpu=powerpc to the compiler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christophe Leroy + +[ Upstream commit 446cda1b21d9a6b3697fe399c6a3a00ff4a285f5 ] + +Since commit 4bf4f42a2feb ("powerpc/kbuild: Set default generic +machine type for 32-bit compile"), when building a 32 bits kernel +with a bi-arch version of GCC, or when building a book3s/32 kernel, +the option -mcpu=powerpc is passed to GCC at all time, relying on it +being eventually overriden by a subsequent -mcpu=xxxx. + +But when building the same kernel with a 32 bits only version of GCC, +that is not done, relying on gcc being built with the expected default +CPU. + +This logic has two problems. First, it is a bit fragile to rely on +whether the GCC version is bi-arch or not, because today we can have +bi-arch versions of GCC configured with a 32 bits default. Second, +there are some versions of GCC which don't support -mcpu=powerpc, +for instance for e500 SPE-only versions. + +So, stop relying on this approximative logic and allow the user to +decide whether he/she wants to use the toolchain's default CPU or if +he/she wants to set one, and allow only possible CPUs based on the +selected target. + +Reported-by: Pali Rohár +Signed-off-by: Christophe Leroy +Tested-by: Pali Rohár +Reviewed-by: Arnd Bergmann +Reviewed-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/d4df724691351531bf46d685d654689e5dfa0d74.1657549153.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 26 +------------------------- + arch/powerpc/platforms/Kconfig.cputype | 21 ++++++++++++++++++--- + 2 files changed, 19 insertions(+), 28 deletions(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 72610e2d6176..2bb0fe9b2058 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -17,23 +17,6 @@ HAS_BIARCH := $(call cc-option-yn, -m32) + # Set default 32 bits cross compilers for vdso and boot wrapper + CROSS32_COMPILE ?= + +-ifeq ($(HAS_BIARCH),y) +-ifeq ($(CROSS32_COMPILE),) +-ifdef CONFIG_PPC32 +-# These options will be overridden by any -mcpu option that the CPU +-# or platform code sets later on the command line, but they are needed +-# to set a sane 32-bit cpu target for the 64-bit cross compiler which +-# may default to the wrong ISA. +-KBUILD_CFLAGS += -mcpu=powerpc +-KBUILD_AFLAGS += -mcpu=powerpc +-endif +-endif +-endif +- +-ifdef CONFIG_PPC_BOOK3S_32 +-KBUILD_CFLAGS += -mcpu=powerpc +-endif +- + # If we're on a ppc/ppc64/ppc64le machine use that defconfig, otherwise just use + # ppc64_defconfig because we have nothing better to go on. + uname := $(shell uname -m) +@@ -185,6 +168,7 @@ endif + endif + + CFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) ++AFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) + + # Altivec option not allowed with e500mc64 in GCC. + ifdef CONFIG_ALTIVEC +@@ -195,14 +179,6 @@ endif + CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU) + CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU)) + +-ifdef CONFIG_PPC32 +-ifdef CONFIG_PPC_E500MC +-CFLAGS-y += $(call cc-option,-mcpu=e500mc,-mcpu=powerpc) +-else +-CFLAGS-$(CONFIG_E500) += $(call cc-option,-mcpu=8540 -msoft-float,-mcpu=powerpc) +-endif +-endif +- + asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1) + + KBUILD_CPPFLAGS += -I $(srctree)/arch/$(ARCH) $(asinstr) +diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype +index 81f8c9634832..1b1e67ff9d21 100644 +--- a/arch/powerpc/platforms/Kconfig.cputype ++++ b/arch/powerpc/platforms/Kconfig.cputype +@@ -137,9 +137,9 @@ config GENERIC_CPU + depends on PPC64 && CPU_LITTLE_ENDIAN + select ARCH_HAS_FAST_MULTIPLIER + +-config GENERIC_CPU ++config POWERPC_CPU + bool "Generic 32 bits powerpc" +- depends on PPC32 && !PPC_8xx ++ depends on PPC32 && !PPC_8xx && !PPC_85xx + + config CELL_CPU + bool "Cell Broadband Engine" +@@ -193,11 +193,23 @@ config G4_CPU + depends on PPC_BOOK3S_32 + select ALTIVEC + ++config E500_CPU ++ bool "e500 (8540)" ++ depends on PPC_85xx && !PPC_E500MC ++ ++config E500MC_CPU ++ bool "e500mc" ++ depends on PPC_85xx && PPC_E500MC ++ ++config TOOLCHAIN_DEFAULT_CPU ++ bool "Rely on the toolchain's implicit default CPU" ++ depends on PPC32 ++ + endchoice + + config TARGET_CPU_BOOL + bool +- default !GENERIC_CPU ++ default !GENERIC_CPU && !TOOLCHAIN_DEFAULT_CPU + + config TARGET_CPU + string +@@ -212,6 +224,9 @@ config TARGET_CPU + default "e300c2" if E300C2_CPU + default "e300c3" if E300C3_CPU + default "G4" if G4_CPU ++ default "8540" if E500_CPU ++ default "e500mc" if E500MC_CPU ++ default "powerpc" if POWERPC_CPU + + config PPC_BOOK3S + def_bool y +-- +2.35.1 + diff --git a/queue-5.15/powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch b/queue-5.15/powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch new file mode 100644 index 00000000000..96e3412f76a --- /dev/null +++ b/queue-5.15/powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch @@ -0,0 +1,91 @@ +From e63abab9b56375bb7e0b84a20d00f433b58330de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 12:34:09 +0200 +Subject: powerpc/32: Set an IBAT covering up to _einittext during init + +From: Christophe Leroy + +[ Upstream commit 2a0fb3c155c97c75176e557d61f8e66c1bd9b735 ] + +Always set an IBAT covering up to _einittext during init because when +CONFIG_MODULES is not selected there is no reason to have an exception +handler for kernel instruction TLB misses. + +It implies DBAT and IBAT are now totaly independent, IBATs are set +by setibat() and DBAT by setbat(). + +This allows to revert commit 9bb162fa26ed ("powerpc/603: Fix +boot failure with DEBUG_PAGEALLOC and KFENCE") + +Reported-by: Maxime Bizon +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/ce7f04a39593934d9b1ee68c69144ccd3d4da4a1.1655202804.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_book3s_32.S | 4 ++-- + arch/powerpc/mm/book3s32/mmu.c | 10 ++++------ + 2 files changed, 6 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/kernel/head_book3s_32.S b/arch/powerpc/kernel/head_book3s_32.S +index 2e2a8211b17b..68e5c0a7e99d 100644 +--- a/arch/powerpc/kernel/head_book3s_32.S ++++ b/arch/powerpc/kernel/head_book3s_32.S +@@ -421,14 +421,14 @@ InstructionTLBMiss: + */ + /* Get PTE (linux-style) and check access */ + mfspr r3,SPRN_IMISS +-#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE) ++#ifdef CONFIG_MODULES + lis r1, TASK_SIZE@h /* check if kernel address */ + cmplw 0,r1,r3 + #endif + mfspr r2, SPRN_SDR1 + li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC | _PAGE_USER + rlwinm r2, r2, 28, 0xfffff000 +-#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE) ++#ifdef CONFIG_MODULES + bgt- 112f + lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ + li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC +diff --git a/arch/powerpc/mm/book3s32/mmu.c b/arch/powerpc/mm/book3s32/mmu.c +index 203735caf691..bfca0afe9112 100644 +--- a/arch/powerpc/mm/book3s32/mmu.c ++++ b/arch/powerpc/mm/book3s32/mmu.c +@@ -160,7 +160,10 @@ unsigned long __init mmu_mapin_ram(unsigned long base, unsigned long top) + { + unsigned long done; + unsigned long border = (unsigned long)__init_begin - PAGE_OFFSET; ++ unsigned long size; + ++ size = roundup_pow_of_two((unsigned long)_einittext - PAGE_OFFSET); ++ setibat(0, PAGE_OFFSET, 0, size, PAGE_KERNEL_X); + + if (debug_pagealloc_enabled_or_kfence() || __map_without_bats) { + pr_debug_once("Read-Write memory mapped without BATs\n"); +@@ -246,10 +249,9 @@ void mmu_mark_rodata_ro(void) + } + + /* +- * Set up one of the I/D BAT (block address translation) register pairs. ++ * Set up one of the D BAT (block address translation) register pairs. + * The parameters are not checked; in particular size must be a power + * of 2 between 128k and 256M. +- * On 603+, only set IBAT when _PAGE_EXEC is set + */ + void __init setbat(int index, unsigned long virt, phys_addr_t phys, + unsigned int size, pgprot_t prot) +@@ -285,10 +287,6 @@ void __init setbat(int index, unsigned long virt, phys_addr_t phys, + /* G bit must be zero in IBATs */ + flags &= ~_PAGE_EXEC; + } +- if (flags & _PAGE_EXEC) +- bat[0] = bat[1]; +- else +- bat[0].batu = bat[0].batl = 0; + + bat_addrs[index].start = virt; + bat_addrs[index].limit = virt + ((bl + 1) << 17) - 1; +-- +2.35.1 + diff --git a/queue-5.15/powerpc-64-init-jump-labels-before-parse_early_param.patch b/queue-5.15/powerpc-64-init-jump-labels-before-parse_early_param.patch new file mode 100644 index 00000000000..9d93c187ab4 --- /dev/null +++ b/queue-5.15/powerpc-64-init-jump-labels-before-parse_early_param.patch @@ -0,0 +1,65 @@ +From 67777d5850802cb2635c00152a9c45a80819a732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 09:57:47 +0800 +Subject: powerpc/64: Init jump labels before parse_early_param() + +From: Zhouyi Zhou + +[ Upstream commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3 ] + +On 64-bit, calling jump_label_init() in setup_feature_keys() is too +late because static keys may be used in subroutines of +parse_early_param() which is again subroutine of early_init_devtree(). + +For example booting with "threadirqs": + + static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init() + WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120 + ... + NIP static_key_enable_cpuslocked+0xfc/0x120 + LR static_key_enable_cpuslocked+0xf8/0x120 + Call Trace: + static_key_enable_cpuslocked+0xf8/0x120 (unreliable) + static_key_enable+0x30/0x50 + setup_forced_irqthreads+0x28/0x40 + do_early_param+0xa0/0x108 + parse_args+0x290/0x4e0 + parse_early_options+0x48/0x5c + parse_early_param+0x58/0x84 + early_init_devtree+0xd4/0x518 + early_setup+0xb4/0x214 + +So call jump_label_init() just before parse_early_param() in +early_init_devtree(). + +Suggested-by: Michael Ellerman +Signed-off-by: Zhouyi Zhou +[mpe: Add call trace to change log and minor wording edits.] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220726015747.11754-1-zhouzhouyi@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 2e67588f6f6e..86ffbabd26c6 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -751,6 +751,13 @@ void __init early_init_devtree(void *params) + of_scan_flat_dt(early_init_dt_scan_root, NULL); + of_scan_flat_dt(early_init_dt_scan_memory_ppc, NULL); + ++ /* ++ * As generic code authors expect to be able to use static keys ++ * in early_param() handlers, we initialize the static keys just ++ * before parsing early params (it's fine to call jump_label_init() ++ * more than once). ++ */ ++ jump_label_init(); + parse_early_param(); + + /* make sure we've parsed cmdline for mem= before this */ +-- +2.35.1 + diff --git a/queue-5.15/powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch b/queue-5.15/powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch new file mode 100644 index 00000000000..fbf226e959a --- /dev/null +++ b/queue-5.15/powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch @@ -0,0 +1,48 @@ +From 27dfa6cee2195819d7cd03e12032e5b887aa9bde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 18:08:00 +1000 +Subject: powerpc/ioda/iommu/debugfs: Generate unique debugfs entries + +From: Alexey Kardashevskiy + +[ Upstream commit d73b46c3c1449bf27f793b9d9ee86ed70c7a7163 ] + +The iommu_table::it_index is a LIOBN which is not initialized on PowerNV +as it is not used except IOMMU debugfs where it is used for a node name. + +This initializes it_index witn a unique number to avoid warnings and +have a node for every iommu_table. + +This should not cause any behavioral change without CONFIG_IOMMU_DEBUGFS. + +Signed-off-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220714080800.3712998-1-aik@ozlabs.ru +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/pci-ioda.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index 3dd35c327d1c..624822a81019 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -1618,6 +1618,7 @@ static void pnv_pci_ioda1_setup_dma_pe(struct pnv_phb *phb, + tbl->it_ops = &pnv_ioda1_iommu_ops; + pe->table_group.tce32_start = tbl->it_offset << tbl->it_page_shift; + pe->table_group.tce32_size = tbl->it_size << tbl->it_page_shift; ++ tbl->it_index = (phb->hose->global_number << 16) | pe->pe_number; + if (!iommu_init_table(tbl, phb->hose->node, 0, 0)) + panic("Failed to initialize iommu table"); + +@@ -1788,6 +1789,7 @@ static long pnv_pci_ioda2_setup_default_config(struct pnv_ioda_pe *pe) + res_end = min(window_size, SZ_4G) >> tbl->it_page_shift; + } + ++ tbl->it_index = (pe->phb->hose->global_number << 16) | pe->pe_number; + if (iommu_init_table(tbl, pe->phb->hose->node, res_start, res_end)) + rc = pnv_pci_ioda2_set_window(&pe->table_group, 0, tbl); + else +-- +2.35.1 + diff --git a/queue-5.15/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch b/queue-5.15/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch new file mode 100644 index 00000000000..edb3580813c --- /dev/null +++ b/queue-5.15/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch @@ -0,0 +1,88 @@ +From 8d028940dd3bd84d71b36e0c79c38c24441c5bad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 14:04:25 -0500 +Subject: RDMA/rxe: Limit the number of calls to each tasklet + +From: Bob Pearson + +[ Upstream commit eff6d998ca297cb0b2e53b032a56cf8e04dd8b17 ] + +Limit the maximum number of calls to each tasklet from rxe_do_task() +before yielding the cpu. When the limit is reached reschedule the tasklet +and exit the calling loop. This patch prevents one tasklet from consuming +100% of a cpu core and causing a deadlock or soft lockup. + +Link: https://lore.kernel.org/r/20220630190425.2251-9-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_param.h | 6 ++++++ + drivers/infiniband/sw/rxe/rxe_task.c | 16 ++++++++++++---- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index b5a70cbe94aa..872389870106 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -103,6 +103,12 @@ enum rxe_device_param { + RXE_INFLIGHT_SKBS_PER_QP_HIGH = 64, + RXE_INFLIGHT_SKBS_PER_QP_LOW = 16, + ++ /* Max number of interations of each tasklet ++ * before yielding the cpu to let other ++ * work make progress ++ */ ++ RXE_MAX_ITERATIONS = 1024, ++ + /* Delay before calling arbiter timer */ + RXE_NSEC_ARB_TIMER_DELAY = 200, + +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 6951fdcb31bf..568cf56c236b 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -8,7 +8,7 @@ + #include + #include + +-#include "rxe_task.h" ++#include "rxe.h" + + int __rxe_do_task(struct rxe_task *task) + +@@ -34,6 +34,7 @@ void rxe_do_task(struct tasklet_struct *t) + int ret; + unsigned long flags; + struct rxe_task *task = from_tasklet(task, t, tasklet); ++ unsigned int iterations = RXE_MAX_ITERATIONS; + + spin_lock_irqsave(&task->state_lock, flags); + switch (task->state) { +@@ -62,13 +63,20 @@ void rxe_do_task(struct tasklet_struct *t) + spin_lock_irqsave(&task->state_lock, flags); + switch (task->state) { + case TASK_STATE_BUSY: +- if (ret) ++ if (ret) { + task->state = TASK_STATE_START; +- else ++ } else if (iterations--) { + cont = 1; ++ } else { ++ /* reschedule the tasklet and exit ++ * the loop to give up the cpu ++ */ ++ tasklet_schedule(&task->tasklet); ++ task->state = TASK_STATE_START; ++ } + break; + +- /* soneone tried to run the task since the last time we called ++ /* someone tried to run the task since the last time we called + * func, so we will call one more time regardless of the + * return value + */ +-- +2.35.1 + diff --git a/queue-5.15/risc-v-add-fast-call-path-of-crash_kexec.patch b/queue-5.15/risc-v-add-fast-call-path-of-crash_kexec.patch new file mode 100644 index 00000000000..adfaaf1f978 --- /dev/null +++ b/queue-5.15/risc-v-add-fast-call-path-of-crash_kexec.patch @@ -0,0 +1,73 @@ +From f156120a39831e8a2f75c598750833abab16de98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 16:23:08 +0800 +Subject: RISC-V: Add fast call path of crash_kexec() + +From: Xianting Tian + +[ Upstream commit 3f1901110a89b0e2e13adb2ac8d1a7102879ea98 ] + +Currently, almost all archs (x86, arm64, mips...) support fast call +of crash_kexec() when "regs && kexec_should_crash()" is true. But +RISC-V not, it can only enter crash system via panic(). However panic() +doesn't pass the regs of the real accident scene to crash_kexec(), +it caused we can't get accurate backtrace via gdb, + $ riscv64-linux-gnu-gdb vmlinux vmcore + Reading symbols from vmlinux... + [New LWP 95] + #0 console_unlock () at kernel/printk/printk.c:2557 + 2557 if (do_cond_resched) + (gdb) bt + #0 console_unlock () at kernel/printk/printk.c:2557 + #1 0x0000000000000000 in ?? () + +With the patch we can get the accurate backtrace, + $ riscv64-linux-gnu-gdb vmlinux vmcore + Reading symbols from vmlinux... + [New LWP 95] + #0 0xffffffe00063a4e0 in test_thread (data=) at drivers/test_crash.c:81 + 81 *(int *)p = 0xdead; + (gdb) + (gdb) bt + #0 0xffffffe00064d5c0 in test_thread (data=) at drivers/test_crash.c:81 + #1 0x0000000000000000 in ?? () + +Test code to produce NULL address dereference in test_crash.c, + void *p = NULL; + *(int *)p = 0xdead; + +Reviewed-by: Guo Ren +Tested-by: Xianting Tian +Signed-off-by: Xianting Tian +Link: https://lore.kernel.org/r/20220606082308.2883458-1-xianting.tian@linux.alibaba.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/traps.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index 0daaa3e4630d..b938ffe129d6 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -44,6 +45,9 @@ void die(struct pt_regs *regs, const char *str) + + ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV); + ++ if (regs && kexec_should_crash(current)) ++ crash_kexec(regs); ++ + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); + spin_unlock_irq(&die_lock); +-- +2.35.1 + diff --git a/queue-5.15/riscv-dts-canaan-add-k210-topology-information.patch b/queue-5.15/riscv-dts-canaan-add-k210-topology-information.patch new file mode 100644 index 00000000000..9ffddb2b0b2 --- /dev/null +++ b/queue-5.15/riscv-dts-canaan-add-k210-topology-information.patch @@ -0,0 +1,49 @@ +From 4d3bd157bfd557d2b1d79b82674031f1890a58da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 20:04:36 +0100 +Subject: riscv: dts: canaan: Add k210 topology information + +From: Conor Dooley + +[ Upstream commit d9d193dea8666bbf69fc21c5bdcdabaa34a466e3 ] + +The k210 has no cpu-map node, so tools like hwloc cannot correctly +parse the topology. Add the node using the existing node labels. + +Reported-by: Brice Goglin +Link: https://github.com/open-mpi/hwloc/issues/536 +Signed-off-by: Conor Dooley +Reviewed-by: Damien Le Moal +Link: https://lore.kernel.org/r/20220705190435.1790466-6-mail@conchuod.ie +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/canaan/k210.dtsi | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/riscv/boot/dts/canaan/k210.dtsi b/arch/riscv/boot/dts/canaan/k210.dtsi +index 780416d489aa..fa9162e3afa3 100644 +--- a/arch/riscv/boot/dts/canaan/k210.dtsi ++++ b/arch/riscv/boot/dts/canaan/k210.dtsi +@@ -65,6 +65,18 @@ + compatible = "riscv,cpu-intc"; + }; + }; ++ ++ cpu-map { ++ cluster0 { ++ core0 { ++ cpu = <&cpu0>; ++ }; ++ ++ core1 { ++ cpu = <&cpu1>; ++ }; ++ }; ++ }; + }; + + sram: memory@80000000 { +-- +2.35.1 + diff --git a/queue-5.15/riscv-dts-sifive-add-fu540-topology-information.patch b/queue-5.15/riscv-dts-sifive-add-fu540-topology-information.patch new file mode 100644 index 00000000000..73b5e0d7384 --- /dev/null +++ b/queue-5.15/riscv-dts-sifive-add-fu540-topology-information.patch @@ -0,0 +1,60 @@ +From bc3ac9aa4f4bf1679f6d8dbdf9290d63c281e86e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 20:04:33 +0100 +Subject: riscv: dts: sifive: Add fu540 topology information + +From: Conor Dooley + +[ Upstream commit af8f260abc608c06e4466a282b53f1e2dc09f042 ] + +The fu540 has no cpu-map node, so tools like hwloc cannot correctly +parse the topology. Add the node using the existing node labels. + +Reported-by: Brice Goglin +Link: https://github.com/open-mpi/hwloc/issues/536 +Signed-off-by: Conor Dooley +Link: https://lore.kernel.org/r/20220705190435.1790466-3-mail@conchuod.ie +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 24 ++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi +index 64c06c9b41dc..87d6e5a4253f 100644 +--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi ++++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi +@@ -133,6 +133,30 @@ + interrupt-controller; + }; + }; ++ ++ cpu-map { ++ cluster0 { ++ core0 { ++ cpu = <&cpu0>; ++ }; ++ ++ core1 { ++ cpu = <&cpu1>; ++ }; ++ ++ core2 { ++ cpu = <&cpu2>; ++ }; ++ ++ core3 { ++ cpu = <&cpu3>; ++ }; ++ ++ core4 { ++ cpu = <&cpu4>; ++ }; ++ }; ++ }; + }; + soc { + #address-cells = <2>; +-- +2.35.1 + diff --git a/queue-5.15/riscv-dts-sifive-add-fu740-topology-information.patch b/queue-5.15/riscv-dts-sifive-add-fu740-topology-information.patch new file mode 100644 index 00000000000..32c80bd67a8 --- /dev/null +++ b/queue-5.15/riscv-dts-sifive-add-fu740-topology-information.patch @@ -0,0 +1,60 @@ +From 62a927425cb911f40f3327c522fb676bcc7e0f38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 20:04:34 +0100 +Subject: riscv: dts: sifive: Add fu740 topology information + +From: Conor Dooley + +[ Upstream commit bf6cd1c01c959a31002dfa6784c0d8caffed4cf1 ] + +The fu740 has no cpu-map node, so tools like hwloc cannot correctly +parse the topology. Add the node using the existing node labels. + +Reported-by: Brice Goglin +Link: https://github.com/open-mpi/hwloc/issues/536 +Signed-off-by: Conor Dooley +Link: https://lore.kernel.org/r/20220705190435.1790466-4-mail@conchuod.ie +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 24 ++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/arch/riscv/boot/dts/sifive/fu740-c000.dtsi b/arch/riscv/boot/dts/sifive/fu740-c000.dtsi +index abbb960f90a0..454079a69ab4 100644 +--- a/arch/riscv/boot/dts/sifive/fu740-c000.dtsi ++++ b/arch/riscv/boot/dts/sifive/fu740-c000.dtsi +@@ -134,6 +134,30 @@ + interrupt-controller; + }; + }; ++ ++ cpu-map { ++ cluster0 { ++ core0 { ++ cpu = <&cpu0>; ++ }; ++ ++ core1 { ++ cpu = <&cpu1>; ++ }; ++ ++ core2 { ++ cpu = <&cpu2>; ++ }; ++ ++ core3 { ++ cpu = <&cpu3>; ++ }; ++ ++ core4 { ++ cpu = <&cpu4>; ++ }; ++ }; ++ }; + }; + soc { + #address-cells = <2>; +-- +2.35.1 + diff --git a/queue-5.15/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch b/queue-5.15/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch new file mode 100644 index 00000000000..fb245b9c148 --- /dev/null +++ b/queue-5.15/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch @@ -0,0 +1,47 @@ +From a986d752ddb25a968b5940e65d550443ec1cc792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 15:56:52 +0800 +Subject: riscv: mmap with PROT_WRITE but no PROT_READ is invalid + +From: Celeste Liu + +[ Upstream commit 2139619bcad7ac44cc8f6f749089120594056613 ] + +As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3, write +but not read is "Reserved for future use.". For now, they are not valid. +In the current code, -wx is marked as invalid, but -w- is not marked +as invalid. +This patch refines that judgment. + +Reported-by: xctan +Co-developed-by: dram +Signed-off-by: dram +Co-developed-by: Ruizhe Pan +Signed-off-by: Ruizhe Pan +Signed-off-by: Celeste Liu +Link: https://lore.kernel.org/r/PH7PR14MB559464DBDD310E755F5B21E8CEDC9@PH7PR14MB5594.namprd14.prod.outlook.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/sys_riscv.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c +index 12f8a7fce78b..8a7880b9c433 100644 +--- a/arch/riscv/kernel/sys_riscv.c ++++ b/arch/riscv/kernel/sys_riscv.c +@@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, + if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) + return -EINVAL; + +- if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) +- if (unlikely(!(prot & PROT_READ))) +- return -EINVAL; ++ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) ++ return -EINVAL; + + return ksys_mmap_pgoff(addr, len, prot, flags, fd, + offset >> (PAGE_SHIFT - page_shift_offset)); +-- +2.35.1 + diff --git a/queue-5.15/scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch b/queue-5.15/scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch new file mode 100644 index 00000000000..d32efc0554a --- /dev/null +++ b/queue-5.15/scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch @@ -0,0 +1,45 @@ +From ed87286f3e79611695c36803d67afc5dfb052be4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 14:14:18 -0700 +Subject: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE + +From: James Smart + +[ Upstream commit 2f67dc7970bce3529edce93a0a14234d88b3fcd5 ] + +There is no corresponding free routine if lpfc_sli4_issue_wqe fails to +issue the CMF WQE in lpfc_issue_cmf_sync_wqe. + +If ret_val is non-zero, then free the iocbq request structure. + +Link: https://lore.kernel.org/r/20220701211425.2708-6-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index fb69416c9623..f594a006d04c 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -2012,10 +2012,12 @@ lpfc_issue_cmf_sync_wqe(struct lpfc_hba *phba, u32 ms, u64 total) + + sync_buf->cmd_flag |= LPFC_IO_CMF; + ret_val = lpfc_sli4_issue_wqe(phba, &phba->sli4_hba.hdwq[0], sync_buf); +- if (ret_val) ++ if (ret_val) { + lpfc_printf_log(phba, KERN_INFO, LOG_CGN_MGMT, + "6214 Cannot issue CMF_SYNC_WQE: x%x\n", + ret_val); ++ __lpfc_sli_release_iocbq(phba, sync_buf); ++ } + out_unlock: + spin_unlock_irqrestore(&phba->hbalock, iflags); + return ret_val; +-- +2.35.1 + diff --git a/queue-5.15/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch b/queue-5.15/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch new file mode 100644 index 00000000000..e5e48682451 --- /dev/null +++ b/queue-5.15/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch @@ -0,0 +1,86 @@ +From 6ee1aead01dfb903818a9e9549e1c23c9f999079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 14:14:15 -0700 +Subject: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed + user input + +From: James Smart + +[ Upstream commit f8191d40aa612981ce897e66cda6a88db8df17bb ] + +Malformed user input to debugfs results in buffer overflow crashes. Adapt +input string lengths to fit within internal buffers, leaving space for NULL +terminators. + +Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_debugfs.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index 08b2e85dcd7d..79bc86ba59b3 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -2607,8 +2607,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf, + struct lpfc_sli4_hdw_queue *qp; + struct lpfc_multixri_pool *multixri_pool; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2688,8 +2688,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf, + if (!phba->targetport) + return -ENXIO; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2826,8 +2826,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 63) +- nbytes = 63; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -3060,8 +3060,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf, + char *pbuf; + int i; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +-- +2.35.1 + diff --git a/queue-5.15/scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch b/queue-5.15/scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch new file mode 100644 index 00000000000..bf639a086b9 --- /dev/null +++ b/queue-5.15/scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch @@ -0,0 +1,116 @@ +From 39af288d5d56eeb441416aec59148f6ace97517a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jun 2022 13:37:18 +0800 +Subject: scsi: ufs: ufs-mediatek: Fix the timing of configuring device + regulators + +From: Po-Wen Kao + +[ Upstream commit 3fd23b8dfb54d9b74eba6dfdd3225db3ac116785 ] + +Currently the LPM configurations of device regulators may not work since +VCC is not disabled yet while ufs_mtk_vreg_set_lpm() is executed. + +Fix this by changing the timing of invoking ufs_mtk_vreg_set_lpm(). + +Link: https://lore.kernel.org/r/20220616053725.5681-5-stanley.chu@mediatek.com +Reviewed-by: Stanley Chu +Signed-off-by: Po-Wen Kao +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-mediatek.c | 58 ++++++++++++++++++++++++++++++--- + 1 file changed, 53 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/ufs/ufs-mediatek.c b/drivers/scsi/ufs/ufs-mediatek.c +index 4e53857605de..9f1d69d33149 100644 +--- a/drivers/scsi/ufs/ufs-mediatek.c ++++ b/drivers/scsi/ufs/ufs-mediatek.c +@@ -949,7 +949,6 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op) + * ufshcd_suspend() re-enabling regulators while vreg is still + * in low-power mode. + */ +- ufs_mtk_vreg_set_lpm(hba, true); + err = ufs_mtk_mphy_power_on(hba, false); + if (err) + goto fail; +@@ -973,12 +972,13 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) + { + int err; + ++ if (hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL) ++ ufs_mtk_vreg_set_lpm(hba, false); ++ + err = ufs_mtk_mphy_power_on(hba, true); + if (err) + goto fail; + +- ufs_mtk_vreg_set_lpm(hba, false); +- + if (ufshcd_is_link_hibern8(hba)) { + err = ufs_mtk_link_set_hpm(hba); + if (err) +@@ -1139,9 +1139,57 @@ static int ufs_mtk_remove(struct platform_device *pdev) + return 0; + } + ++int ufs_mtk_system_suspend(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = ufshcd_system_suspend(dev); ++ if (ret) ++ return ret; ++ ++ ufs_mtk_vreg_set_lpm(hba, true); ++ ++ return 0; ++} ++ ++int ufs_mtk_system_resume(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ ++ ufs_mtk_vreg_set_lpm(hba, false); ++ ++ return ufshcd_system_resume(dev); ++} ++ ++int ufs_mtk_runtime_suspend(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ int ret = 0; ++ ++ ret = ufshcd_runtime_suspend(dev); ++ if (ret) ++ return ret; ++ ++ ufs_mtk_vreg_set_lpm(hba, true); ++ ++ return 0; ++} ++ ++int ufs_mtk_runtime_resume(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ ++ ufs_mtk_vreg_set_lpm(hba, false); ++ ++ return ufshcd_runtime_resume(dev); ++} ++ + static const struct dev_pm_ops ufs_mtk_pm_ops = { +- SET_SYSTEM_SLEEP_PM_OPS(ufshcd_system_suspend, ufshcd_system_resume) +- SET_RUNTIME_PM_OPS(ufshcd_runtime_suspend, ufshcd_runtime_resume, NULL) ++ SET_SYSTEM_SLEEP_PM_OPS(ufs_mtk_system_suspend, ++ ufs_mtk_system_resume) ++ SET_RUNTIME_PM_OPS(ufs_mtk_runtime_suspend, ++ ufs_mtk_runtime_resume, NULL) + .prepare = ufshcd_suspend_prepare, + .complete = ufshcd_resume_complete, + }; +-- +2.35.1 + diff --git a/queue-5.15/selftests-kprobe-do-not-test-for-grp-without-event-f.patch b/queue-5.15/selftests-kprobe-do-not-test-for-grp-without-event-f.patch new file mode 100644 index 00000000000..ffbba6e7ac8 --- /dev/null +++ b/queue-5.15/selftests-kprobe-do-not-test-for-grp-without-event-f.patch @@ -0,0 +1,50 @@ +From 4d63641bbcc6798b3396042b5122eb7635c9bec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 16:17:07 -0400 +Subject: selftests/kprobe: Do not test for GRP/ without event failures + +From: Steven Rostedt (Google) + +[ Upstream commit f5eab65ff2b76449286d18efc7fee3e0b72f7d9b ] + +A new feature is added where kprobes (and other probes) do not need to +explicitly state the event name when creating a probe. The event name will +come from what is being attached. + +That is: + + # echo 'p:foo/ vfs_read' > kprobe_events + +Will no longer error, but instead create an event: + + # cat kprobe_events + p:foo/p_vfs_read_0 vfs_read + +This should not be tested as an error case anymore. Remove it from the +selftest as now this feature "breaks" the selftest as it no longer fails +as expected. + +Link: https://lore.kernel.org/all/1656296348-16111-1-git-send-email-quic_linyyuan@quicinc.com/ +Link: https://lkml.kernel.org/r/20220712161707.6dc08a14@gandalf.local.home + +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + .../selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +index fa928b431555..7c02509c71d0 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +@@ -21,7 +21,6 @@ check_error 'p:^/bar vfs_read' # NO_GROUP_NAME + check_error 'p:^12345678901234567890123456789012345678901234567890123456789012345/bar vfs_read' # GROUP_TOO_LONG + + check_error 'p:^foo.1/bar vfs_read' # BAD_GROUP_NAME +-check_error 'p:foo/^ vfs_read' # NO_EVENT_NAME + check_error 'p:foo/^12345678901234567890123456789012345678901234567890123456789012345 vfs_read' # EVENT_TOO_LONG + check_error 'p:foo/^bar.1 vfs_read' # BAD_EVENT_NAME + +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 55b74bec3c5..3440ca26e65 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -150,3 +150,83 @@ stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.pa igb-add-lock-to-avoid-data-race.patch kbuild-fix-the-modules-order-between-drivers-and-libs.patch gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch +drm-imx-dcss-get-rid-of-hpd-warning-message.patch +asoc-sof-intel-hda-define-rom_status_reg-in-sof_inte.patch +asoc-sof-intel-hda-fix-potential-buffer-overflow-by-.patch +drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch +drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch +net-qrtr-start-mhi-channel-after-endpoit-creation.patch +kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch +kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch +hid-multitouch-new-device-class-fix-lenovo-x12-track.patch +pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch +platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch +usb-cdns3-fix-use-after-free-at-workaround-2.patch +usb-cdns3-fix-random-warning-message-when-driver-loa.patch +usb-gadget-uvc-calculate-the-number-of-request-depen.patch +usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch +pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch +irqchip-tegra-fix-overflow-implicit-truncation-warni.patch +drm-meson-fix-overflow-implicit-truncation-warnings.patch +clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch +scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch +usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch +usb-renesas-fix-refcount-leak-bug.patch +usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch +vboxguest-do-not-use-devm-for-irq.patch +clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch +uacce-handle-parent-device-removal-or-parent-driver-.patch +zram-do-not-lookup-algorithm-in-backends-table.patch +clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch +scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch +scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch +gadgetfs-ep_io-wait-until-irq-finishes.patch +coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch +habanalabs-gaudi-fix-shift-out-of-bounds.patch +habanalabs-gaudi-mask-constant-value-before-cast.patch +mmc-tmio-avoid-glitches-when-resetting.patch +pinctrl-intel-check-against-matching-data-instead-of.patch +cxl-fix-a-memory-leak-in-an-error-handling-path.patch +pci-acpi-guard-arm64-specific-mcfg_quirks.patch +um-add-noreboot-command-line-option-for-panic_timeou.patch +dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch +dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch +rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch +csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch +selftests-kprobe-do-not-test-for-grp-without-event-f.patch +dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch +openrisc-io-define-iounmap-argument-as-volatile.patch +phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch +md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch +nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch +drivers-md-fix-a-potential-use-after-free-bug.patch +ext4-avoid-remove-directory-when-directory-is-corrup.patch +ext4-avoid-resizing-to-a-partial-cluster-size.patch +lib-list_debug.c-detect-uninitialized-lists.patch +tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch +kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch +vfio-clear-the-caps-buf-to-null-after-free.patch +mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch +iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch +modules-ensure-natural-alignment-for-.altinstruction.patch +asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch +riscv-dts-sifive-add-fu540-topology-information.patch +riscv-dts-sifive-add-fu740-topology-information.patch +riscv-dts-canaan-add-k210-topology-information.patch +riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch +risc-v-add-fast-call-path-of-crash_kexec.patch +watchdog-export-lockup_detector_reconfigure.patch +powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch +powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch +ovl-warn-if-trusted-xattr-creation-fails.patch +powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch +alsa-core-add-async-signal-helpers.patch +alsa-timer-use-deferred-fasync-helper.patch +alsa-control-use-deferred-fasync-helper.patch +f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch +f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch +smb3-check-xattr-value-length-earlier.patch +powerpc-64-init-jump-labels-before-parse_early_param.patch +venus-pm_helpers-fix-warning-in-opp-during-probe.patch +video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch +mips-tlbex-explicitly-compare-_page_no_exec-against-.patch diff --git a/queue-5.15/smb3-check-xattr-value-length-earlier.patch b/queue-5.15/smb3-check-xattr-value-length-earlier.patch new file mode 100644 index 00000000000..2eab314fb9b --- /dev/null +++ b/queue-5.15/smb3-check-xattr-value-length-earlier.patch @@ -0,0 +1,51 @@ +From 393098ce287499421e60b3fbfac2876d1a0f0f15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 11:43:44 -0500 +Subject: smb3: check xattr value length earlier + +From: Steve French + +[ Upstream commit 5fa2cffba0b82336a2244d941322eb1627ff787b ] + +Coverity complains about assigning a pointer based on +value length before checking that value length goes +beyond the end of the SMB. Although this is even more +unlikely as value length is a single byte, and the +pointer is not dereferenced until laterm, it is clearer +to check the lengths first. + +Addresses-Coverity: 1467704 ("Speculative execution data leak") +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 735aafee63be..07895e9d537c 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1105,9 +1105,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + size_t name_len, value_len, user_name_len; + + while (src_size > 0) { +- name = &src->ea_data[0]; + name_len = (size_t)src->ea_name_length; +- value = &src->ea_data[src->ea_name_length + 1]; + value_len = (size_t)le16_to_cpu(src->ea_value_length); + + if (name_len == 0) +@@ -1119,6 +1117,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + goto out; + } + ++ name = &src->ea_data[0]; ++ value = &src->ea_data[src->ea_name_length + 1]; ++ + if (ea_name) { + if (ea_name_len == name_len && + memcmp(ea_name, name, name_len) == 0) { +-- +2.35.1 + diff --git a/queue-5.15/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch b/queue-5.15/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch new file mode 100644 index 00000000000..1132bef8207 --- /dev/null +++ b/queue-5.15/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch @@ -0,0 +1,38 @@ +From 0b17ad823623093932dac22af20f0918017fd40a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 14:08:50 +0800 +Subject: tty: serial: Fix refcount leak bug in ucc_uart.c + +From: Liang He + +[ Upstream commit d24d7bb2cd947676f9b71fb944d045e09b8b282f ] + +In soc_info(), of_find_node_by_type() will return a node pointer +with refcount incremented. We should use of_node_put() when it is +not used anymore. + +Acked-by: Timur Tabi +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220618060850.4058525-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/ucc_uart.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c +index 6000853973c1..3cc9ef08455c 100644 +--- a/drivers/tty/serial/ucc_uart.c ++++ b/drivers/tty/serial/ucc_uart.c +@@ -1137,6 +1137,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l) + /* No compatible property, so try the name. */ + soc_string = np->name; + ++ of_node_put(np); ++ + /* Extract the SOC number from the "PowerPC," string */ + if ((sscanf(soc_string, "PowerPC,%u", &soc) != 1) || !soc) + return 0; +-- +2.35.1 + diff --git a/queue-5.15/uacce-handle-parent-device-removal-or-parent-driver-.patch b/queue-5.15/uacce-handle-parent-device-removal-or-parent-driver-.patch new file mode 100644 index 00000000000..8696da653a1 --- /dev/null +++ b/queue-5.15/uacce-handle-parent-device-removal-or-parent-driver-.patch @@ -0,0 +1,351 @@ +From a9499f17df67c10d58edecd4daf8ab3a545f6741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 11:48:43 +0800 +Subject: uacce: Handle parent device removal or parent driver module rmmod + +From: Jean-Philippe Brucker + +[ Upstream commit 80fc671bcc0173836e9032b0c698ea74c13b9d7c ] + +The uacce driver must deal with a possible removal of the parent device +or parent driver module rmmod at any time. + +Although uacce_remove(), called on device removal and on driver unbind, +prevents future use of the uacce fops by removing the cdev, fops that +were called before that point may still be running. + +Serialize uacce_fops_open() and uacce_remove() with uacce->mutex. +Serialize other fops against uacce_remove() with q->mutex. +Since we need to protect uacce_fops_poll() which gets called on the fast +path, replace uacce->queues_lock with q->mutex to improve scalability. +The other fops are only used during setup. + +uacce_queue_is_valid(), checked under q->mutex or uacce->mutex, denotes +whether uacce_remove() has disabled all queues. If that is the case, +don't go any further since the parent device is being removed and +uacce->ops should not be called anymore. + +Reported-by: Yang Shen +Signed-off-by: Zhangfei Gao +Signed-off-by: Jean-Philippe Brucker +Link: https://lore.kernel.org/r/20220701034843.7502-1-zhangfei.gao@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/uacce/uacce.c | 133 ++++++++++++++++++++++++------------- + include/linux/uacce.h | 6 +- + 2 files changed, 91 insertions(+), 48 deletions(-) + +diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c +index 488eeb2811ae..976d051071dc 100644 +--- a/drivers/misc/uacce/uacce.c ++++ b/drivers/misc/uacce/uacce.c +@@ -9,43 +9,38 @@ + + static struct class *uacce_class; + static dev_t uacce_devt; +-static DEFINE_MUTEX(uacce_mutex); + static DEFINE_XARRAY_ALLOC(uacce_xa); + +-static int uacce_start_queue(struct uacce_queue *q) ++/* ++ * If the parent driver or the device disappears, the queue state is invalid and ++ * ops are not usable anymore. ++ */ ++static bool uacce_queue_is_valid(struct uacce_queue *q) + { +- int ret = 0; ++ return q->state == UACCE_Q_INIT || q->state == UACCE_Q_STARTED; ++} + +- mutex_lock(&uacce_mutex); ++static int uacce_start_queue(struct uacce_queue *q) ++{ ++ int ret; + +- if (q->state != UACCE_Q_INIT) { +- ret = -EINVAL; +- goto out_with_lock; +- } ++ if (q->state != UACCE_Q_INIT) ++ return -EINVAL; + + if (q->uacce->ops->start_queue) { + ret = q->uacce->ops->start_queue(q); + if (ret < 0) +- goto out_with_lock; ++ return ret; + } + + q->state = UACCE_Q_STARTED; +- +-out_with_lock: +- mutex_unlock(&uacce_mutex); +- +- return ret; ++ return 0; + } + + static int uacce_put_queue(struct uacce_queue *q) + { + struct uacce_device *uacce = q->uacce; + +- mutex_lock(&uacce_mutex); +- +- if (q->state == UACCE_Q_ZOMBIE) +- goto out; +- + if ((q->state == UACCE_Q_STARTED) && uacce->ops->stop_queue) + uacce->ops->stop_queue(q); + +@@ -54,8 +49,6 @@ static int uacce_put_queue(struct uacce_queue *q) + uacce->ops->put_queue(q); + + q->state = UACCE_Q_ZOMBIE; +-out: +- mutex_unlock(&uacce_mutex); + + return 0; + } +@@ -65,20 +58,36 @@ static long uacce_fops_unl_ioctl(struct file *filep, + { + struct uacce_queue *q = filep->private_data; + struct uacce_device *uacce = q->uacce; ++ long ret = -ENXIO; ++ ++ /* ++ * uacce->ops->ioctl() may take the mmap_lock when copying arg to/from ++ * user. Avoid a circular lock dependency with uacce_fops_mmap(), which ++ * gets called with mmap_lock held, by taking uacce->mutex instead of ++ * q->mutex. Doing this in uacce_fops_mmap() is not possible because ++ * uacce_fops_open() calls iommu_sva_bind_device(), which takes ++ * mmap_lock, while holding uacce->mutex. ++ */ ++ mutex_lock(&uacce->mutex); ++ if (!uacce_queue_is_valid(q)) ++ goto out_unlock; + + switch (cmd) { + case UACCE_CMD_START_Q: +- return uacce_start_queue(q); +- ++ ret = uacce_start_queue(q); ++ break; + case UACCE_CMD_PUT_Q: +- return uacce_put_queue(q); +- ++ ret = uacce_put_queue(q); ++ break; + default: +- if (!uacce->ops->ioctl) +- return -EINVAL; +- +- return uacce->ops->ioctl(q, cmd, arg); ++ if (uacce->ops->ioctl) ++ ret = uacce->ops->ioctl(q, cmd, arg); ++ else ++ ret = -EINVAL; + } ++out_unlock: ++ mutex_unlock(&uacce->mutex); ++ return ret; + } + + #ifdef CONFIG_COMPAT +@@ -136,6 +145,13 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + if (!q) + return -ENOMEM; + ++ mutex_lock(&uacce->mutex); ++ ++ if (!uacce->parent) { ++ ret = -EINVAL; ++ goto out_with_mem; ++ } ++ + ret = uacce_bind_queue(uacce, q); + if (ret) + goto out_with_mem; +@@ -152,10 +168,9 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + filep->private_data = q; + uacce->inode = inode; + q->state = UACCE_Q_INIT; +- +- mutex_lock(&uacce->queues_lock); ++ mutex_init(&q->mutex); + list_add(&q->list, &uacce->queues); +- mutex_unlock(&uacce->queues_lock); ++ mutex_unlock(&uacce->mutex); + + return 0; + +@@ -163,18 +178,20 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + uacce_unbind_queue(q); + out_with_mem: + kfree(q); ++ mutex_unlock(&uacce->mutex); + return ret; + } + + static int uacce_fops_release(struct inode *inode, struct file *filep) + { + struct uacce_queue *q = filep->private_data; ++ struct uacce_device *uacce = q->uacce; + +- mutex_lock(&q->uacce->queues_lock); +- list_del(&q->list); +- mutex_unlock(&q->uacce->queues_lock); ++ mutex_lock(&uacce->mutex); + uacce_put_queue(q); + uacce_unbind_queue(q); ++ list_del(&q->list); ++ mutex_unlock(&uacce->mutex); + kfree(q); + + return 0; +@@ -217,10 +234,9 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) + vma->vm_private_data = q; + qfr->type = type; + +- mutex_lock(&uacce_mutex); +- +- if (q->state != UACCE_Q_INIT && q->state != UACCE_Q_STARTED) { +- ret = -EINVAL; ++ mutex_lock(&q->mutex); ++ if (!uacce_queue_is_valid(q)) { ++ ret = -ENXIO; + goto out_with_lock; + } + +@@ -248,12 +264,12 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) + } + + q->qfrs[type] = qfr; +- mutex_unlock(&uacce_mutex); ++ mutex_unlock(&q->mutex); + + return ret; + + out_with_lock: +- mutex_unlock(&uacce_mutex); ++ mutex_unlock(&q->mutex); + kfree(qfr); + return ret; + } +@@ -262,12 +278,20 @@ static __poll_t uacce_fops_poll(struct file *file, poll_table *wait) + { + struct uacce_queue *q = file->private_data; + struct uacce_device *uacce = q->uacce; ++ __poll_t ret = 0; ++ ++ mutex_lock(&q->mutex); ++ if (!uacce_queue_is_valid(q)) ++ goto out_unlock; + + poll_wait(file, &q->wait, wait); ++ + if (uacce->ops->is_q_updated && uacce->ops->is_q_updated(q)) +- return EPOLLIN | EPOLLRDNORM; ++ ret = EPOLLIN | EPOLLRDNORM; + +- return 0; ++out_unlock: ++ mutex_unlock(&q->mutex); ++ return ret; + } + + static const struct file_operations uacce_fops = { +@@ -450,7 +474,7 @@ struct uacce_device *uacce_alloc(struct device *parent, + goto err_with_uacce; + + INIT_LIST_HEAD(&uacce->queues); +- mutex_init(&uacce->queues_lock); ++ mutex_init(&uacce->mutex); + device_initialize(&uacce->dev); + uacce->dev.devt = MKDEV(MAJOR(uacce_devt), uacce->dev_id); + uacce->dev.class = uacce_class; +@@ -507,13 +531,23 @@ void uacce_remove(struct uacce_device *uacce) + if (uacce->inode) + unmap_mapping_range(uacce->inode->i_mapping, 0, 0, 1); + ++ /* ++ * uacce_fops_open() may be running concurrently, even after we remove ++ * the cdev. Holding uacce->mutex ensures that open() does not obtain a ++ * removed uacce device. ++ */ ++ mutex_lock(&uacce->mutex); + /* ensure no open queue remains */ +- mutex_lock(&uacce->queues_lock); + list_for_each_entry_safe(q, next_q, &uacce->queues, list) { ++ /* ++ * Taking q->mutex ensures that fops do not use the defunct ++ * uacce->ops after the queue is disabled. ++ */ ++ mutex_lock(&q->mutex); + uacce_put_queue(q); ++ mutex_unlock(&q->mutex); + uacce_unbind_queue(q); + } +- mutex_unlock(&uacce->queues_lock); + + /* disable sva now since no opened queues */ + uacce_disable_sva(uacce); +@@ -521,6 +555,13 @@ void uacce_remove(struct uacce_device *uacce) + if (uacce->cdev) + cdev_device_del(uacce->cdev, &uacce->dev); + xa_erase(&uacce_xa, uacce->dev_id); ++ /* ++ * uacce exists as long as there are open fds, but ops will be freed ++ * now. Ensure that bugs cause NULL deref rather than use-after-free. ++ */ ++ uacce->ops = NULL; ++ uacce->parent = NULL; ++ mutex_unlock(&uacce->mutex); + put_device(&uacce->dev); + } + EXPORT_SYMBOL_GPL(uacce_remove); +diff --git a/include/linux/uacce.h b/include/linux/uacce.h +index 48e319f40275..9ce88c28b0a8 100644 +--- a/include/linux/uacce.h ++++ b/include/linux/uacce.h +@@ -70,6 +70,7 @@ enum uacce_q_state { + * @wait: wait queue head + * @list: index into uacce queues list + * @qfrs: pointer of qfr regions ++ * @mutex: protects queue state + * @state: queue state machine + * @pasid: pasid associated to the mm + * @handle: iommu_sva handle returned by iommu_sva_bind_device() +@@ -80,6 +81,7 @@ struct uacce_queue { + wait_queue_head_t wait; + struct list_head list; + struct uacce_qfile_region *qfrs[UACCE_MAX_REGION]; ++ struct mutex mutex; + enum uacce_q_state state; + u32 pasid; + struct iommu_sva *handle; +@@ -97,9 +99,9 @@ struct uacce_queue { + * @dev_id: id of the uacce device + * @cdev: cdev of the uacce + * @dev: dev of the uacce ++ * @mutex: protects uacce operation + * @priv: private pointer of the uacce + * @queues: list of queues +- * @queues_lock: lock for queues list + * @inode: core vfs + */ + struct uacce_device { +@@ -113,9 +115,9 @@ struct uacce_device { + u32 dev_id; + struct cdev *cdev; + struct device dev; ++ struct mutex mutex; + void *priv; + struct list_head queues; +- struct mutex queues_lock; + struct inode *inode; + }; + +-- +2.35.1 + diff --git a/queue-5.15/um-add-noreboot-command-line-option-for-panic_timeou.patch b/queue-5.15/um-add-noreboot-command-line-option-for-panic_timeou.patch new file mode 100644 index 00000000000..d14644fa51b --- /dev/null +++ b/queue-5.15/um-add-noreboot-command-line-option-for-panic_timeou.patch @@ -0,0 +1,63 @@ +From d6d69fd616b33327a5b6db5cbf4fad3b0ccf9004 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:56:17 +0200 +Subject: um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups + +From: Jason A. Donenfeld + +[ Upstream commit dda520d07b95072a0b63f6c52a8eb566d08ea897 ] + +QEMU has a -no-reboot option, which halts instead of reboots when the +guest asks to reboot. This is invaluable when used with +CONFIG_PANIC_TIMEOUT=-1 (and panic_on_warn), because it allows panics +and warnings to be caught immediately in CI. Implement this in UML too, +by way of a basic setup param. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/skas/process.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c +index 87d3129e7362..0df2ebcc97c0 100644 +--- a/arch/um/os-Linux/skas/process.c ++++ b/arch/um/os-Linux/skas/process.c +@@ -5,6 +5,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -707,10 +708,24 @@ void halt_skas(void) + UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT); + } + ++static bool noreboot; ++ ++static int __init noreboot_cmd_param(char *str, int *add) ++{ ++ noreboot = true; ++ return 0; ++} ++ ++__uml_setup("noreboot", noreboot_cmd_param, ++"noreboot\n" ++" Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n" ++" This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n" ++" crashes in CI\n"); ++ + void reboot_skas(void) + { + block_signals_trace(); +- UML_LONGJMP(&initial_jmpbuf, INIT_JMP_REBOOT); ++ UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT); + } + + void __switch_mm(struct mm_id *mm_idp) +-- +2.35.1 + diff --git a/queue-5.15/usb-cdns3-fix-random-warning-message-when-driver-loa.patch b/queue-5.15/usb-cdns3-fix-random-warning-message-when-driver-loa.patch new file mode 100644 index 00000000000..b1feb26692b --- /dev/null +++ b/queue-5.15/usb-cdns3-fix-random-warning-message-when-driver-loa.patch @@ -0,0 +1,67 @@ +From 5b85e6ba9c82f4f15fafd417c3cfcfd812ee05e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 10:44:56 -0500 +Subject: usb: cdns3: fix random warning message when driver load + +From: Frank Li + +[ Upstream commit 8659ab3d936fcf0084676f98b75b317017aa8f82 ] + +Warning log: +[ 4.141392] Unexpected gfp: 0x4 (GFP_DMA32). Fixing up to gfp: 0xa20 (GFP_ATOMIC). Fix your code! +[ 4.150340] CPU: 1 PID: 175 Comm: 1-0050 Not tainted 5.15.5-00039-g2fd9ae1b568c #20 +[ 4.158010] Hardware name: Freescale i.MX8QXP MEK (DT) +[ 4.163155] Call trace: +[ 4.165600] dump_backtrace+0x0/0x1b0 +[ 4.169286] show_stack+0x18/0x68 +[ 4.172611] dump_stack_lvl+0x68/0x84 +[ 4.176286] dump_stack+0x18/0x34 +[ 4.179613] kmalloc_fix_flags+0x60/0x88 +[ 4.183550] new_slab+0x334/0x370 +[ 4.186878] ___slab_alloc.part.108+0x4d4/0x748 +[ 4.191419] __slab_alloc.isra.109+0x30/0x78 +[ 4.195702] kmem_cache_alloc+0x40c/0x420 +[ 4.199725] dma_pool_alloc+0xac/0x1f8 +[ 4.203486] cdns3_allocate_trb_pool+0xb4/0xd0 + +pool_alloc_page(struct dma_pool *pool, gfp_t mem_flags) +{ + ... + page = kmalloc(sizeof(*page), mem_flags); + page->vaddr = dma_alloc_coherent(pool->dev, pool->allocation, + &page->dma, mem_flags); + ... +} + +kmalloc was called with mem_flags, which is passed down in +cdns3_allocate_trb_pool() and have GFP_DMA32 flags. +kmall_fix_flags() report warning. + +GFP_DMA32 is not useful at all. dma_alloc_coherent() will handle +DMA memory region correctly by pool->dev. GFP_DMA32 can be removed +safely. + +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20220609154456.2871672-1-Frank.Li@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/cdns3-gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c +index 4bcaed787c0f..3f1ce8911077 100644 +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -220,7 +220,7 @@ int cdns3_allocate_trb_pool(struct cdns3_endpoint *priv_ep) + + if (!priv_ep->trb_pool) { + priv_ep->trb_pool = dma_pool_alloc(priv_dev->eps_dma_pool, +- GFP_DMA32 | GFP_ATOMIC, ++ GFP_ATOMIC, + &priv_ep->trb_pool_dma); + + if (!priv_ep->trb_pool) +-- +2.35.1 + diff --git a/queue-5.15/usb-cdns3-fix-use-after-free-at-workaround-2.patch b/queue-5.15/usb-cdns3-fix-use-after-free-at-workaround-2.patch new file mode 100644 index 00000000000..4ab6696d7e0 --- /dev/null +++ b/queue-5.15/usb-cdns3-fix-use-after-free-at-workaround-2.patch @@ -0,0 +1,53 @@ +From 3aa0dac719fcac31f290e0d480057b4befae0e98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 14:04:30 -0500 +Subject: usb: cdns3 fix use-after-free at workaround 2 + +From: Frank Li + +[ Upstream commit 7d602f30149a117eea260208b1661bc404c21dfd ] + +BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac + +cdns3_wa2_remove_old_request() +{ + ... + kfree(priv_req->request.buf); + cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); + list_del_init(&priv_req->list); + ^^^ use after free + ... +} + +cdns3_gadget_ep_free_request() free the space pointed by priv_req, +but priv_req is used in the following list_del_init(). + +This patch move list_del_init() before cdns3_gadget_ep_free_request(). + +Signed-off-by: Frank Li +Signed-off-by: Faqiang Zhu +Link: https://lore.kernel.org/r/20220608190430.2814358-1-Frank.Li@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/cdns3-gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c +index ae049eb28b93..4bcaed787c0f 100644 +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -625,9 +625,9 @@ static void cdns3_wa2_remove_old_request(struct cdns3_endpoint *priv_ep) + trace_cdns3_wa2(priv_ep, "removes eldest request"); + + kfree(priv_req->request.buf); ++ list_del_init(&priv_req->list); + cdns3_gadget_ep_free_request(&priv_ep->endpoint, + &priv_req->request); +- list_del_init(&priv_req->list); + --priv_ep->wa2_counter; + + if (!chain) +-- +2.35.1 + diff --git a/queue-5.15/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch b/queue-5.15/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch new file mode 100644 index 00000000000..481733906c5 --- /dev/null +++ b/queue-5.15/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch @@ -0,0 +1,45 @@ +From 5a1576c49ee09fa7c9a1dcc7d8c7d306ed59aa8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 18:07:17 +0200 +Subject: usb: dwc2: gadget: remove D+ pull-up while no vbus with + usb-role-switch + +From: Amelie Delaunay + +[ Upstream commit db638c6500abaffb8f7770b2a69c40d003d54ae1 ] + +When using usb-role-switch, D+ pull-up is set as soon as DTCL_SFTDISCON is +cleared, whatever the vbus valid signal state is. The pull-up should not +be set when vbus isn't present (this is determined by the drd controller). + +This patch ensures that B-Session (so Peripheral role + vbus valid signal) +is valid before clearing the DCTL_SFTDISCON bit when role switch is used. +Keep original behavior when usb-role-switch isn't used. + +Acked-by: Minas Harutyunyan +Signed-off-by: Amelie Delaunay +Signed-off-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/20220622160717.314580-1-fabrice.gasnier@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/gadget.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index e1cebf581a4a..519bb82b00e8 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -3594,7 +3594,8 @@ void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg) + void dwc2_hsotg_core_connect(struct dwc2_hsotg *hsotg) + { + /* remove the soft-disconnect and let's go */ +- dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON); ++ if (!hsotg->role_sw || (dwc2_readl(hsotg, GOTGCTL) & GOTGCTL_BSESVLD)) ++ dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON); + } + + /** +-- +2.35.1 + diff --git a/queue-5.15/usb-gadget-uvc-calculate-the-number-of-request-depen.patch b/queue-5.15/usb-gadget-uvc-calculate-the-number-of-request-depen.patch new file mode 100644 index 00000000000..a53844760bd --- /dev/null +++ b/queue-5.15/usb-gadget-uvc-calculate-the-number-of-request-depen.patch @@ -0,0 +1,71 @@ +From 0631ac3eaae8f8a9bde76d2e4cc73fedaa966a16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 00:38:46 +0200 +Subject: usb: gadget: uvc: calculate the number of request depending on + framesize + +From: Michael Grzeschik + +[ Upstream commit 87d76b5f1d8eeb49efa16e2018e188864cbb9401 ] + +The current limitation of possible number of requests being handled is +dependent on the gadget speed. It makes more sense to depend on the +typical frame size when calculating the number of requests. This patch +is changing this and is using the previous limits as boundaries for +reasonable minimum and maximum number of requests. + +For a 1080p jpeg encoded video stream with a maximum imagesize of +e.g. 800kB with a maxburst of 8 and an multiplier of 1 the resulting +number of requests is calculated to 49. + + 800768 1 +nreqs = ------ * -------------- ~= 49 + 2 (1024 * 8 * 1) + +Tested-by: Dan Vacura +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20220529223848.105914-2-m.grzeschik@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_queue.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c +index 99dc9adf56ef..a64b842665b9 100644 +--- a/drivers/usb/gadget/function/uvc_queue.c ++++ b/drivers/usb/gadget/function/uvc_queue.c +@@ -44,7 +44,8 @@ static int uvc_queue_setup(struct vb2_queue *vq, + { + struct uvc_video_queue *queue = vb2_get_drv_priv(vq); + struct uvc_video *video = container_of(queue, struct uvc_video, queue); +- struct usb_composite_dev *cdev = video->uvc->func.config->cdev; ++ unsigned int req_size; ++ unsigned int nreq; + + if (*nbuffers > UVC_MAX_VIDEO_BUFFERS) + *nbuffers = UVC_MAX_VIDEO_BUFFERS; +@@ -53,10 +54,16 @@ static int uvc_queue_setup(struct vb2_queue *vq, + + sizes[0] = video->imagesize; + +- if (cdev->gadget->speed < USB_SPEED_SUPER) +- video->uvc_num_requests = 4; +- else +- video->uvc_num_requests = 64; ++ req_size = video->ep->maxpacket ++ * max_t(unsigned int, video->ep->maxburst, 1) ++ * (video->ep->mult); ++ ++ /* We divide by two, to increase the chance to run ++ * into fewer requests for smaller framesizes. ++ */ ++ nreq = DIV_ROUND_UP(DIV_ROUND_UP(sizes[0], 2), req_size); ++ nreq = clamp(nreq, 4U, 64U); ++ video->uvc_num_requests = nreq; + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.15/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch b/queue-5.15/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch new file mode 100644 index 00000000000..8a0fead007f --- /dev/null +++ b/queue-5.15/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch @@ -0,0 +1,39 @@ +From db713c06f8dbcbe23483f0c08b9b3e2d71900d41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 00:38:48 +0200 +Subject: usb: gadget: uvc: call uvc uvcg_warn on completed status instead of + uvcg_info + +From: Michael Grzeschik + +[ Upstream commit a725d0f6dfc5d3739d6499f30ec865305ba3544d ] + +Likewise to the uvcvideo hostside driver, this patch is changing the +usb_request message of an non zero completion handler call from dev_info +to dev_warn. + +Reviewed-by: Laurent Pinchart +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20220529223848.105914-4-m.grzeschik@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index b4a763e5f70e..e170e88abf3a 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -225,7 +225,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) + break; + + default: +- uvcg_info(&video->uvc->func, ++ uvcg_warn(&video->uvc->func, + "VS request completed with status %d.\n", + req->status); + uvcg_queue_cancel(queue, 0); +-- +2.35.1 + diff --git a/queue-5.15/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch b/queue-5.15/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch new file mode 100644 index 00000000000..b0139118329 --- /dev/null +++ b/queue-5.15/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch @@ -0,0 +1,37 @@ +From 826bd95576bcaa2cc7330f5ab36223418c8e2eda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 11:46:37 +0800 +Subject: usb: host: ohci-ppc-of: Fix refcount leak bug + +From: Liang He + +[ Upstream commit 40a959d7042bb7711e404ad2318b30e9f92c6b9b ] + +In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return +a node pointer with refcount incremented. We should use of_node_put() +when it is not used anymore. + +Acked-by: Alan Stern +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220617034637.4003115-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-ppc-of.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c +index 45f7cceb6df3..98e46725999e 100644 +--- a/drivers/usb/host/ohci-ppc-of.c ++++ b/drivers/usb/host/ohci-ppc-of.c +@@ -169,6 +169,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op) + release_mem_region(res.start, 0x4); + } else + pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__); ++ of_node_put(np); + } + + irq_dispose_mapping(irq); +-- +2.35.1 + diff --git a/queue-5.15/usb-renesas-fix-refcount-leak-bug.patch b/queue-5.15/usb-renesas-fix-refcount-leak-bug.patch new file mode 100644 index 00000000000..81a3c7b1283 --- /dev/null +++ b/queue-5.15/usb-renesas-fix-refcount-leak-bug.patch @@ -0,0 +1,39 @@ +From 30bc41859f835e0fb7f8c0c91b82ace0846ba2ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 10:32:05 +0800 +Subject: usb: renesas: Fix refcount leak bug + +From: Liang He + +[ Upstream commit 9d6d5303c39b8bc182475b22f45504106a07f086 ] + +In usbhs_rza1_hardware_init(), of_find_node_by_name() will return +a node pointer with refcount incremented. We should use of_node_put() +when it is not used anymore. + +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220618023205.4056548-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/renesas_usbhs/rza.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/renesas_usbhs/rza.c b/drivers/usb/renesas_usbhs/rza.c +index 24de64edb674..2d77edefb4b3 100644 +--- a/drivers/usb/renesas_usbhs/rza.c ++++ b/drivers/usb/renesas_usbhs/rza.c +@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev) + extal_clk = of_find_node_by_name(NULL, "extal"); + of_property_read_u32(usb_x1_clk, "clock-frequency", &freq_usb); + of_property_read_u32(extal_clk, "clock-frequency", &freq_extal); ++ ++ of_node_put(usb_x1_clk); ++ of_node_put(extal_clk); ++ + if (freq_usb == 0) { + if (freq_extal == 12000000) { + /* Select 12MHz XTAL */ +-- +2.35.1 + diff --git a/queue-5.15/vboxguest-do-not-use-devm-for-irq.patch b/queue-5.15/vboxguest-do-not-use-devm-for-irq.patch new file mode 100644 index 00000000000..b710f3bbce0 --- /dev/null +++ b/queue-5.15/vboxguest-do-not-use-devm-for-irq.patch @@ -0,0 +1,81 @@ +From 959e5ee4bb73da341f14e5baee0edf22dc2706b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jun 2022 14:37:44 +0100 +Subject: vboxguest: Do not use devm for irq + +From: Pascal Terjan + +[ Upstream commit 6169525b76764acb81918aa387ac168fb9a55575 ] + +When relying on devm it doesn't get freed early enough which causes the +following warning when unloading the module: + +[249348.837181] remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'vboxguest' +[249348.837219] WARNING: CPU: 0 PID: 6708 at fs/proc/generic.c:715 remove_proc_entry+0x119/0x140 + +[249348.837379] Call Trace: +[249348.837385] unregister_irq_proc+0xbd/0xe0 +[249348.837392] free_desc+0x23/0x60 +[249348.837396] irq_free_descs+0x4a/0x70 +[249348.837401] irq_domain_free_irqs+0x160/0x1a0 +[249348.837452] mp_unmap_irq+0x5c/0x60 +[249348.837458] acpi_unregister_gsi_ioapic+0x29/0x40 +[249348.837463] acpi_unregister_gsi+0x17/0x30 +[249348.837467] acpi_pci_irq_disable+0xbf/0xe0 +[249348.837473] pcibios_disable_device+0x20/0x30 +[249348.837478] pci_disable_device+0xef/0x120 +[249348.837482] vbg_pci_remove+0x6c/0x70 [vboxguest] + +Reviewed-by: Hans de Goede +Signed-off-by: Pascal Terjan +Link: https://lore.kernel.org/r/20220612133744.4030602-1-pterjan@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/virt/vboxguest/vboxguest_linux.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c +index 73eb34849eab..4ccfd30c2a30 100644 +--- a/drivers/virt/vboxguest/vboxguest_linux.c ++++ b/drivers/virt/vboxguest/vboxguest_linux.c +@@ -356,8 +356,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + goto err_vbg_core_exit; + } + +- ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED, +- DEVICE_NAME, gdev); ++ ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME, ++ gdev); + if (ret) { + vbg_err("vboxguest: Error requesting irq: %d\n", ret); + goto err_vbg_core_exit; +@@ -367,7 +367,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + if (ret) { + vbg_err("vboxguest: Error misc_register %s failed: %d\n", + DEVICE_NAME, ret); +- goto err_vbg_core_exit; ++ goto err_free_irq; + } + + ret = misc_register(&gdev->misc_device_user); +@@ -403,6 +403,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + misc_deregister(&gdev->misc_device_user); + err_unregister_misc_device: + misc_deregister(&gdev->misc_device); ++err_free_irq: ++ free_irq(pci->irq, gdev); + err_vbg_core_exit: + vbg_core_exit(gdev); + err_disable_pcidev: +@@ -419,6 +421,7 @@ static void vbg_pci_remove(struct pci_dev *pci) + vbg_gdev = NULL; + mutex_unlock(&vbg_gdev_mutex); + ++ free_irq(pci->irq, gdev); + device_remove_file(gdev->dev, &dev_attr_host_features); + device_remove_file(gdev->dev, &dev_attr_host_version); + misc_deregister(&gdev->misc_device_user); +-- +2.35.1 + diff --git a/queue-5.15/venus-pm_helpers-fix-warning-in-opp-during-probe.patch b/queue-5.15/venus-pm_helpers-fix-warning-in-opp-during-probe.patch new file mode 100644 index 00000000000..01808b6e68b --- /dev/null +++ b/queue-5.15/venus-pm_helpers-fix-warning-in-opp-during-probe.patch @@ -0,0 +1,119 @@ +From 928de022d9a75dacb581fc624d7b3430f78bd424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 18:16:41 +0300 +Subject: venus: pm_helpers: Fix warning in OPP during probe + +From: Stanimir Varbanov + +[ Upstream commit 1d95af02f23031c2e1cca7607c514b86ce85bc6e ] + +Fix the following WARN triggered during Venus driver probe on +5.19.0-rc8-next-20220728: + + WARNING: CPU: 7 PID: 339 at drivers/opp/core.c:2471 dev_pm_opp_set_config+0x49c/0x610 + Modules linked in: qcom_spmi_adc5 rtc_pm8xxx qcom_spmi_adc_tm5 leds_qcom_lpg led_class_multicolor + qcom_pon qcom_vadc_common venus_core(+) qcom_spmi_temp_alarm v4l2_mem2mem videobuf2_v4l2 msm(+) + videobuf2_common crct10dif_ce spi_geni_qcom snd_soc_sm8250 i2c_qcom_geni gpu_sched + snd_soc_qcom_common videodev qcom_q6v5_pas soundwire_qcom drm_dp_aux_bus qcom_stats + drm_display_helper qcom_pil_info soundwire_bus snd_soc_lpass_va_macro mc qcom_q6v5 + phy_qcom_snps_femto_v2 qcom_rng snd_soc_lpass_macro_common snd_soc_lpass_wsa_macro + lpass_gfm_sm8250 slimbus qcom_sysmon qcom_common qcom_glink_smem qmi_helpers + qcom_wdt mdt_loader socinfo icc_osm_l3 display_connector + drm_kms_helper qnoc_sm8250 drm fuse ip_tables x_tables ipv6 + CPU: 7 PID: 339 Comm: systemd-udevd Not tainted 5.19.0-rc8-next-20220728 #4 + Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) + pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : dev_pm_opp_set_config+0x49c/0x610 + lr : dev_pm_opp_set_config+0x58/0x610 + sp : ffff8000093c3710 + x29: ffff8000093c3710 x28: ffffbca3959d82b8 x27: ffff8000093c3d00 + x26: ffffbca3959d8e08 x25: ffff4396cac98118 x24: ffff4396c0e24810 + x23: ffff4396c4272c40 x22: ffff4396c0e24810 x21: ffff8000093c3810 + x20: ffff4396cac36800 x19: ffff4396cac96800 x18: 0000000000000000 + x17: 0000000000000003 x16: ffffbca3f4edf198 x15: 0000001cba64a858 + x14: 0000000000000180 x13: 000000000000017e x12: 0000000000000000 + x11: 0000000000000002 x10: 0000000000000a60 x9 : ffff8000093c35c0 + x8 : ffff4396c4273700 x7 : ffff43983efca6c0 x6 : ffff43983efca640 + x5 : 00000000410fd0d0 x4 : ffff4396c4272c40 x3 : ffffbca3f5d1e008 + x2 : 0000000000000000 x1 : ffff4396c2421600 x0 : ffff4396cac96860 + Call trace: + dev_pm_opp_set_config+0x49c/0x610 + devm_pm_opp_set_config+0x18/0x70 + vcodec_domains_get+0xb8/0x1638 [venus_core] + core_get_v4+0x1d8/0x218 [venus_core] + venus_probe+0xf4/0x468 [venus_core] + platform_probe+0x68/0xd8 + really_probe+0xbc/0x2a8 + __driver_probe_device+0x78/0xe0 + driver_probe_device+0x3c/0xf0 + __driver_attach+0x70/0x120 + bus_for_each_dev+0x70/0xc0 + driver_attach+0x24/0x30 + bus_add_driver+0x150/0x200 + driver_register+0x64/0x120 + __platform_driver_register+0x28/0x38 + qcom_venus_driver_init+0x24/0x1000 [venus_core] + do_one_initcall+0x54/0x1c8 + do_init_module+0x44/0x1d0 + load_module+0x16c8/0x1aa0 + __do_sys_finit_module+0xbc/0x110 + __arm64_sys_finit_module+0x20/0x30 + invoke_syscall+0x44/0x108 + el0_svc_common.constprop.0+0xcc/0xf0 + do_el0_svc+0x2c/0xb8 + el0_svc+0x2c/0x88 + el0t_64_sync_handler+0xb8/0xc0 + el0t_64_sync+0x18c/0x190 + qcom-venus: probe of aa00000.video-codec failed with error -16 + +The fix is re-ordering the code related to OPP core. The OPP core +expects all configuration options to be provided before the OPP +table is added. + +Reported-by: Linux Kernel Functional Testing +Suggested-by: Viresh Kumar +Signed-off-by: Stanimir Varbanov +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/pm_helpers.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c +index a591dd315ebc..03fc82cb3fea 100644 +--- a/drivers/media/platform/qcom/venus/pm_helpers.c ++++ b/drivers/media/platform/qcom/venus/pm_helpers.c +@@ -875,7 +875,7 @@ static int vcodec_domains_get(struct venus_core *core) + } + + skip_pmdomains: +- if (!core->has_opp_table) ++ if (!core->res->opp_pmdomain) + return 0; + + /* Attach the power domain for setting performance state */ +@@ -1007,6 +1007,10 @@ static int core_get_v4(struct venus_core *core) + if (ret) + return ret; + ++ ret = vcodec_domains_get(core); ++ if (ret) ++ return ret; ++ + if (core->res->opp_pmdomain) { + ret = devm_pm_opp_of_add_table(dev); + if (!ret) { +@@ -1017,10 +1021,6 @@ static int core_get_v4(struct venus_core *core) + } + } + +- ret = vcodec_domains_get(core); +- if (ret) +- return ret; +- + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.15/vfio-clear-the-caps-buf-to-null-after-free.patch b/queue-5.15/vfio-clear-the-caps-buf-to-null-after-free.patch new file mode 100644 index 00000000000..d9b8d51350f --- /dev/null +++ b/queue-5.15/vfio-clear-the-caps-buf-to-null-after-free.patch @@ -0,0 +1,38 @@ +From 03cc34adf37473770488cec326c4fa03349177c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jun 2022 10:29:48 +0800 +Subject: vfio: Clear the caps->buf to NULL after free + +From: Schspa Shi + +[ Upstream commit 6641085e8d7b3f061911517f79a2a15a0a21b97b ] + +On buffer resize failure, vfio_info_cap_add() will free the buffer, +report zero for the size, and return -ENOMEM. As additional +hardening, also clear the buffer pointer to prevent any chance of a +double free. + +Signed-off-by: Schspa Shi +Reviewed-by: Cornelia Huck +Link: https://lore.kernel.org/r/20220629022948.55608-1-schspa@gmail.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c +index 3c034fe14ccb..818e47fc0896 100644 +--- a/drivers/vfio/vfio.c ++++ b/drivers/vfio/vfio.c +@@ -1850,6 +1850,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps, + buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL); + if (!buf) { + kfree(caps->buf); ++ caps->buf = NULL; + caps->size = 0; + return ERR_PTR(-ENOMEM); + } +-- +2.35.1 + diff --git a/queue-5.15/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch b/queue-5.15/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch new file mode 100644 index 00000000000..08333897c21 --- /dev/null +++ b/queue-5.15/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch @@ -0,0 +1,67 @@ +From 32db354471b2dcd65baf3710d83c2323ba2aa43a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Aug 2022 17:24:19 +0800 +Subject: video: fbdev: i740fb: Check the argument of i740_calc_vclk() + +From: Zheyu Ma + +[ Upstream commit 40bf722f8064f50200b8c4f8946cd625b441dda9 ] + +Since the user can control the arguments of the ioctl() from the user +space, under special arguments that may result in a divide-by-zero bug. + +If the user provides an improper 'pixclock' value that makes the argumet +of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a +divide-by-zero bug in: + drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX))); + +The following log can reveal it: + +divide error: 0000 [#1] PREEMPT SMP KASAN PTI +RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline] +RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline] +RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742 +Call Trace: + fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 + do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 + fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 + +Fix this by checking the argument of i740_calc_vclk() first. + +Signed-off-by: Zheyu Ma +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/i740fb.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c +index 52cce0db8bd3..ad5ced4ef972 100644 +--- a/drivers/video/fbdev/i740fb.c ++++ b/drivers/video/fbdev/i740fb.c +@@ -400,7 +400,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + u32 xres, right, hslen, left, xtotal; + u32 yres, lower, vslen, upper, ytotal; + u32 vxres, xoffset, vyres, yoffset; +- u32 bpp, base, dacspeed24, mem; ++ u32 bpp, base, dacspeed24, mem, freq; + u8 r7; + int i; + +@@ -643,7 +643,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + par->atc[VGA_ATC_OVERSCAN] = 0; + + /* Calculate VCLK that most closely matches the requested dot clock */ +- i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par); ++ freq = (((u32)1e9) / var->pixclock) * (u32)(1e3); ++ if (freq < I740_RFREQ_FIX) { ++ fb_dbg(info, "invalid pixclock\n"); ++ freq = I740_RFREQ_FIX; ++ } ++ i740_calc_vclk(freq, par); + + /* Since we program the clocks ourselves, always use VCLK2. */ + par->misc |= 0x0C; +-- +2.35.1 + diff --git a/queue-5.15/watchdog-export-lockup_detector_reconfigure.patch b/queue-5.15/watchdog-export-lockup_detector_reconfigure.patch new file mode 100644 index 00000000000..e43c8ab448b --- /dev/null +++ b/queue-5.15/watchdog-export-lockup_detector_reconfigure.patch @@ -0,0 +1,115 @@ +From 5b8243054f6f5e26c13a2c0666e0d6fa646e37bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 17:47:27 +0200 +Subject: watchdog: export lockup_detector_reconfigure + +From: Laurent Dufour + +[ Upstream commit 7c56a8733d0a2a4be2438a7512566e5ce552fccf ] + +In some circumstances it may be interesting to reconfigure the watchdog +from inside the kernel. + +On PowerPC, this may helpful before and after a LPAR migration (LPM) is +initiated, because it implies some latencies, watchdog, and especially NMI +watchdog is expected to be triggered during this operation. Reconfiguring +the watchdog with a factor, would prevent it to happen too frequently +during LPM. + +Rename lockup_detector_reconfigure() as __lockup_detector_reconfigure() and +create a new function lockup_detector_reconfigure() calling +__lockup_detector_reconfigure() under the protection of watchdog_mutex. + +Signed-off-by: Laurent Dufour +[mpe: Squash in build fix from Laurent, reported by Sachin] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220713154729.80789-3-ldufour@linux.ibm.com +Signed-off-by: Sasha Levin +--- + include/linux/nmi.h | 2 ++ + kernel/watchdog.c | 21 ++++++++++++++++----- + 2 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index 750c7f395ca9..f700ff2df074 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void); + int watchdog_nmi_enable(unsigned int cpu); + void watchdog_nmi_disable(unsigned int cpu); + ++void lockup_detector_reconfigure(void); ++ + /** + * touch_nmi_watchdog - restart NMI watchdog timeout. + * +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index ad912511a0c0..1cfa269bd448 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -537,7 +537,7 @@ int lockup_detector_offline_cpu(unsigned int cpu) + return 0; + } + +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -557,6 +557,13 @@ static void lockup_detector_reconfigure(void) + __lockup_detector_cleanup(); + } + ++void lockup_detector_reconfigure(void) ++{ ++ mutex_lock(&watchdog_mutex); ++ __lockup_detector_reconfigure(); ++ mutex_unlock(&watchdog_mutex); ++} ++ + /* + * Create the watchdog infrastructure and configure the detector(s). + */ +@@ -573,13 +580,13 @@ static __init void lockup_detector_setup(void) + return; + + mutex_lock(&watchdog_mutex); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + softlockup_initialized = true; + mutex_unlock(&watchdog_mutex); + } + + #else /* CONFIG_SOFTLOCKUP_DETECTOR */ +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -587,9 +594,13 @@ static void lockup_detector_reconfigure(void) + watchdog_nmi_start(); + cpus_read_unlock(); + } ++void lockup_detector_reconfigure(void) ++{ ++ __lockup_detector_reconfigure(); ++} + static inline void lockup_detector_setup(void) + { +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */ + +@@ -629,7 +640,7 @@ static void proc_watchdog_update(void) + { + /* Remove impossible cpus to keep sysctl output clean. */ + cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + + /* +-- +2.35.1 + diff --git a/queue-5.15/zram-do-not-lookup-algorithm-in-backends-table.patch b/queue-5.15/zram-do-not-lookup-algorithm-in-backends-table.patch new file mode 100644 index 00000000000..a6a229d0d44 --- /dev/null +++ b/queue-5.15/zram-do-not-lookup-algorithm-in-backends-table.patch @@ -0,0 +1,100 @@ +From 25ab746b5c233bf7fa7527ca5cd511e1aae3775a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 11:35:01 +0900 +Subject: zram: do not lookup algorithm in backends table + +From: Sergey Senozhatsky + +[ Upstream commit dc89997264de565999a1cb55db3f295d3a8e457b ] + +Always use crypto_has_comp() so that crypto can lookup module, call +usermodhelper to load the modules, wait for usermodhelper to finish and so +on. Otherwise crypto will do all of these steps under CPU hot-plug lock +and this looks like too much stuff to handle under the CPU hot-plug lock. +Besides this can end up in a deadlock when usermodhelper triggers a code +path that attempts to lock the CPU hot-plug lock, that zram already holds. + +An example of such deadlock: + +- path A. zram grabs CPU hot-plug lock, execs /sbin/modprobe from crypto + and waits for modprobe to finish + +disksize_store + zcomp_create + __cpuhp_state_add_instance + __cpuhp_state_add_instance_cpuslocked + zcomp_cpu_up_prepare + crypto_alloc_base + crypto_alg_mod_lookup + call_usermodehelper_exec + wait_for_completion_killable + do_wait_for_common + schedule + +- path B. async work kthread that brings in scsi device. It wants to + register CPUHP states at some point, and it needs the CPU hot-plug + lock for that, which is owned by zram. + +async_run_entry_fn + scsi_probe_and_add_lun + scsi_mq_alloc_queue + blk_mq_init_queue + blk_mq_init_allocated_queue + blk_mq_realloc_hw_ctxs + __cpuhp_state_add_instance + __cpuhp_state_add_instance_cpuslocked + mutex_lock + schedule + +- path C. modprobe sleeps, waiting for all aync works to finish. + +load_module + do_init_module + async_synchronize_full + async_synchronize_cookie_domain + schedule + +[senozhatsky@chromium.org: add comment] + Link: https://lkml.kernel.org/r/20220624060606.1014474-1-senozhatsky@chromium.org +Link: https://lkml.kernel.org/r/20220622023501.517125-1-senozhatsky@chromium.org +Signed-off-by: Sergey Senozhatsky +Cc: Minchan Kim +Cc: Nitin Gupta +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/block/zram/zcomp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c +index 052aa3f65514..0916de952e09 100644 +--- a/drivers/block/zram/zcomp.c ++++ b/drivers/block/zram/zcomp.c +@@ -63,12 +63,6 @@ static int zcomp_strm_init(struct zcomp_strm *zstrm, struct zcomp *comp) + + bool zcomp_available_algorithm(const char *comp) + { +- int i; +- +- i = sysfs_match_string(backends, comp); +- if (i >= 0) +- return true; +- + /* + * Crypto does not ignore a trailing new line symbol, + * so make sure you don't supply a string containing +@@ -217,6 +211,11 @@ struct zcomp *zcomp_create(const char *compress) + struct zcomp *comp; + int error; + ++ /* ++ * Crypto API will execute /sbin/modprobe if the compression module ++ * is not loaded yet. We must do it here, otherwise we are about to ++ * call /sbin/modprobe under CPU hot-plug lock. ++ */ + if (!zcomp_available_algorithm(compress)) + return ERR_PTR(-EINVAL); + +-- +2.35.1 +