From: Sasha Levin Date: Thu, 23 Feb 2023 02:42:39 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v6.2.1~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4b3ce1ae960cb357c9da714c86b75d4b34626d39;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/can-kvaser_usb-hydra-help-gcc-13-to-figure-out-cmd_l.patch b/queue-5.15/can-kvaser_usb-hydra-help-gcc-13-to-figure-out-cmd_l.patch new file mode 100644 index 00000000000..62038e3c940 --- /dev/null +++ b/queue-5.15/can-kvaser_usb-hydra-help-gcc-13-to-figure-out-cmd_l.patch @@ -0,0 +1,248 @@ +From 6858193e85799717883fff1bbfcef866e32b40b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 11:39:27 +0100 +Subject: can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marc Kleine-Budde + +[ Upstream commit f006229135b7debf4037adb1eb93e358559593db ] + +Debian's gcc-13 [1] throws the following error in +kvaser_usb_hydra_cmd_size(): + +[1] gcc version 13.0.0 20221214 (experimental) [master r13-4693-g512098a3316] (Debian 13-20221214-1) + +| drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c:502:65: error: +| array subscript ‘struct kvaser_cmd_ext[0]’ is partly outside array +| bounds of ‘unsigned char[32]’ [-Werror=array-bounds=] +| 502 | ret = le16_to_cpu(((struct kvaser_cmd_ext *)cmd)->len); + +kvaser_usb_hydra_cmd_size() returns the size of given command. It +depends on the command number (cmd->header.cmd_no). For extended +commands (cmd->header.cmd_no == CMD_EXTENDED) the above shown code is +executed. + +Help gcc to recognize that this code path is not taken in all cases, +by calling kvaser_usb_hydra_cmd_size() directly after assigning the +command number. + +Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") +Cc: Jimmy Assarsson +Cc: Anssi Hannula +Link: https://lore.kernel.org/all/20221219110104.1073881-1-mkl@pengutronix.de +Tested-by: Jimmy Assarsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 33 ++++++++++++++----- + 1 file changed, 24 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 6cc65bf28d03e..562105b8a6327 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -545,6 +545,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev, + u8 cmd_no, int channel) + { + struct kvaser_cmd *cmd; ++ size_t cmd_len; + int err; + + cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL); +@@ -552,6 +553,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev, + return -ENOMEM; + + cmd->header.cmd_no = cmd_no; ++ cmd_len = kvaser_usb_hydra_cmd_size(cmd); + if (channel < 0) { + kvaser_usb_hydra_set_cmd_dest_he + (cmd, KVASER_USB_HYDRA_HE_ADDRESS_ILLEGAL); +@@ -568,7 +570,7 @@ static int kvaser_usb_hydra_send_simple_cmd(struct kvaser_usb *dev, + kvaser_usb_hydra_set_cmd_transid + (cmd, kvaser_usb_hydra_get_next_transid(dev)); + +- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd)); ++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len); + if (err) + goto end; + +@@ -584,6 +586,7 @@ kvaser_usb_hydra_send_simple_cmd_async(struct kvaser_usb_net_priv *priv, + { + struct kvaser_cmd *cmd; + struct kvaser_usb *dev = priv->dev; ++ size_t cmd_len; + int err; + + cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_ATOMIC); +@@ -591,14 +594,14 @@ kvaser_usb_hydra_send_simple_cmd_async(struct kvaser_usb_net_priv *priv, + return -ENOMEM; + + cmd->header.cmd_no = cmd_no; ++ cmd_len = kvaser_usb_hydra_cmd_size(cmd); + + kvaser_usb_hydra_set_cmd_dest_he + (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); + kvaser_usb_hydra_set_cmd_transid + (cmd, kvaser_usb_hydra_get_next_transid(dev)); + +- err = kvaser_usb_send_cmd_async(priv, cmd, +- kvaser_usb_hydra_cmd_size(cmd)); ++ err = kvaser_usb_send_cmd_async(priv, cmd, cmd_len); + if (err) + kfree(cmd); + +@@ -742,6 +745,7 @@ static int kvaser_usb_hydra_get_single_capability(struct kvaser_usb *dev, + { + struct kvaser_usb_dev_card_data *card_data = &dev->card_data; + struct kvaser_cmd *cmd; ++ size_t cmd_len; + u32 value = 0; + u32 mask = 0; + u16 cap_cmd_res; +@@ -753,13 +757,14 @@ static int kvaser_usb_hydra_get_single_capability(struct kvaser_usb *dev, + return -ENOMEM; + + cmd->header.cmd_no = CMD_GET_CAPABILITIES_REQ; ++ cmd_len = kvaser_usb_hydra_cmd_size(cmd); + cmd->cap_req.cap_cmd = cpu_to_le16(cap_cmd_req); + + kvaser_usb_hydra_set_cmd_dest_he(cmd, card_data->hydra.sysdbg_he); + kvaser_usb_hydra_set_cmd_transid + (cmd, kvaser_usb_hydra_get_next_transid(dev)); + +- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd)); ++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len); + if (err) + goto end; + +@@ -1582,6 +1587,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv, + struct kvaser_usb *dev = priv->dev; + struct kvaser_usb_net_hydra_priv *hydra = priv->sub_priv; + struct kvaser_cmd *cmd; ++ size_t cmd_len; + int err; + + if (!hydra) +@@ -1592,6 +1598,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv, + return -ENOMEM; + + cmd->header.cmd_no = CMD_GET_BUSPARAMS_REQ; ++ cmd_len = kvaser_usb_hydra_cmd_size(cmd); + kvaser_usb_hydra_set_cmd_dest_he + (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); + kvaser_usb_hydra_set_cmd_transid +@@ -1601,7 +1608,7 @@ static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv, + + reinit_completion(&priv->get_busparams_comp); + +- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd)); ++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len); + if (err) + return err; + +@@ -1628,6 +1635,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev, + struct kvaser_cmd *cmd; + struct kvaser_usb_net_priv *priv = netdev_priv(netdev); + struct kvaser_usb *dev = priv->dev; ++ size_t cmd_len; + int err; + + cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL); +@@ -1635,6 +1643,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev, + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_BUSPARAMS_REQ; ++ cmd_len = kvaser_usb_hydra_cmd_size(cmd); + memcpy(&cmd->set_busparams_req.busparams_nominal, busparams, + sizeof(cmd->set_busparams_req.busparams_nominal)); + +@@ -1643,7 +1652,7 @@ static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev, + kvaser_usb_hydra_set_cmd_transid + (cmd, kvaser_usb_hydra_get_next_transid(dev)); + +- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd)); ++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len); + + kfree(cmd); + +@@ -1656,6 +1665,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev, + struct kvaser_cmd *cmd; + struct kvaser_usb_net_priv *priv = netdev_priv(netdev); + struct kvaser_usb *dev = priv->dev; ++ size_t cmd_len; + int err; + + cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL); +@@ -1663,6 +1673,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev, + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_BUSPARAMS_FD_REQ; ++ cmd_len = kvaser_usb_hydra_cmd_size(cmd); + memcpy(&cmd->set_busparams_req.busparams_data, busparams, + sizeof(cmd->set_busparams_req.busparams_data)); + +@@ -1680,7 +1691,7 @@ static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev, + kvaser_usb_hydra_set_cmd_transid + (cmd, kvaser_usb_hydra_get_next_transid(dev)); + +- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd)); ++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len); + + kfree(cmd); + +@@ -1808,6 +1819,7 @@ static int kvaser_usb_hydra_get_software_info(struct kvaser_usb *dev) + static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev) + { + struct kvaser_cmd *cmd; ++ size_t cmd_len; + int err; + u32 flags; + struct kvaser_usb_dev_card_data *card_data = &dev->card_data; +@@ -1817,6 +1829,7 @@ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev) + return -ENOMEM; + + cmd->header.cmd_no = CMD_GET_SOFTWARE_DETAILS_REQ; ++ cmd_len = kvaser_usb_hydra_cmd_size(cmd); + cmd->sw_detail_req.use_ext_cmd = 1; + kvaser_usb_hydra_set_cmd_dest_he + (cmd, KVASER_USB_HYDRA_HE_ADDRESS_ILLEGAL); +@@ -1824,7 +1837,7 @@ static int kvaser_usb_hydra_get_software_details(struct kvaser_usb *dev) + kvaser_usb_hydra_set_cmd_transid + (cmd, kvaser_usb_hydra_get_next_transid(dev)); + +- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd)); ++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len); + if (err) + goto end; + +@@ -1942,6 +1955,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv) + { + struct kvaser_usb *dev = priv->dev; + struct kvaser_cmd *cmd; ++ size_t cmd_len; + int err; + + if ((priv->can.ctrlmode & +@@ -1957,6 +1971,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv) + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_DRIVERMODE_REQ; ++ cmd_len = kvaser_usb_hydra_cmd_size(cmd); + kvaser_usb_hydra_set_cmd_dest_he + (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); + kvaser_usb_hydra_set_cmd_transid +@@ -1966,7 +1981,7 @@ static int kvaser_usb_hydra_set_opt_mode(const struct kvaser_usb_net_priv *priv) + else + cmd->set_ctrlmode.mode = KVASER_USB_HYDRA_CTRLMODE_NORMAL; + +- err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd)); ++ err = kvaser_usb_send_cmd(dev, cmd, cmd_len); + kfree(cmd); + + return err; +-- +2.39.0 + diff --git a/queue-5.15/clk-mxl-add-option-to-override-gate-clks.patch b/queue-5.15/clk-mxl-add-option-to-override-gate-clks.patch new file mode 100644 index 00000000000..85432db4ea3 --- /dev/null +++ b/queue-5.15/clk-mxl-add-option-to-override-gate-clks.patch @@ -0,0 +1,73 @@ +From bcc4e3ab4353c8abc53c7e771e68694ff03ec2d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 14:48:32 +0800 +Subject: clk: mxl: Add option to override gate clks + +From: Rahul Tanwar + +[ Upstream commit a5d49bd369b8588c0ee9d4d0a2c0160558a3ab69 ] + +In MxL's LGM SoC, gate clocks can be controlled either from CGU clk driver +i.e. this driver or directly from power management driver/daemon. It is +dependent on the power policy/profile requirements of the end product. + +To support such use cases, provide option to override gate clks enable/disable +by adding a flag GATE_CLK_HW which controls if these gate clks are controlled +by HW i.e. this driver or overridden in order to allow it to be controlled +by power profiles instead. + +Reviewed-by: Yi xin Zhu +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/bdc9c89317b5d338a6c4f1d49386b696e947a672.1665642720.git.rtanwar@maxlinear.com +[sboyd@kernel.org: Add braces on many line if-else] +Signed-off-by: Stephen Boyd +Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags") +Signed-off-by: Sasha Levin +--- + drivers/clk/x86/clk-cgu.c | 16 +++++++++++++++- + drivers/clk/x86/clk-cgu.h | 1 + + 2 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/x86/clk-cgu.c b/drivers/clk/x86/clk-cgu.c +index 1f7e93de67bc0..4278a687076c9 100644 +--- a/drivers/clk/x86/clk-cgu.c ++++ b/drivers/clk/x86/clk-cgu.c +@@ -354,8 +354,22 @@ int lgm_clk_register_branches(struct lgm_clk_provider *ctx, + hw = lgm_clk_register_fixed_factor(ctx, list); + break; + case CLK_TYPE_GATE: +- hw = lgm_clk_register_gate(ctx, list); ++ if (list->gate_flags & GATE_CLK_HW) { ++ hw = lgm_clk_register_gate(ctx, list); ++ } else { ++ /* ++ * GATE_CLKs can be controlled either from ++ * CGU clk driver i.e. this driver or directly ++ * from power management driver/daemon. It is ++ * dependent on the power policy/profile requirements ++ * of the end product. To override control of gate ++ * clks from this driver, provide NULL for this index ++ * of gate clk provider. ++ */ ++ hw = NULL; ++ } + break; ++ + default: + dev_err(ctx->dev, "invalid clk type\n"); + return -EINVAL; +diff --git a/drivers/clk/x86/clk-cgu.h b/drivers/clk/x86/clk-cgu.h +index 0aa0f35d63a0b..73ce84345f81e 100644 +--- a/drivers/clk/x86/clk-cgu.h ++++ b/drivers/clk/x86/clk-cgu.h +@@ -197,6 +197,7 @@ struct lgm_clk_branch { + /* clock flags definition */ + #define CLOCK_FLAG_VAL_INIT BIT(16) + #define MUX_CLK_SW BIT(17) ++#define GATE_CLK_HW BIT(18) + + #define LGM_MUX(_id, _name, _pdata, _f, _reg, \ + _shift, _width, _cf, _v) \ +-- +2.39.0 + diff --git a/queue-5.15/clk-mxl-fix-a-clk-entry-by-adding-relevant-flags.patch b/queue-5.15/clk-mxl-fix-a-clk-entry-by-adding-relevant-flags.patch new file mode 100644 index 00000000000..bb11a9efe22 --- /dev/null +++ b/queue-5.15/clk-mxl-fix-a-clk-entry-by-adding-relevant-flags.patch @@ -0,0 +1,75 @@ +From 84e6b2de804e8bc09d52477d3ddb34f0ee1d2fd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 14:48:33 +0800 +Subject: clk: mxl: Fix a clk entry by adding relevant flags + +From: Rahul Tanwar + +[ Upstream commit 106ef3bda21006fe37b62c85931230a6355d78d3 ] + +One of the clock entry "dcl" clk has some HW limitations. One is that +its rate can only by changed by changing its parent clk's rate & two is +that HW does not support enable/disable for this clk. + +Handle above two limitations by adding relevant flags. Add standard flag +CLK_SET_RATE_PARENT to handle rate change and add driver internal flag +DIV_CLK_NO_MASK to handle enable/disable. + +Fixes: d058fd9e8984 ("clk: intel: Add CGU clock driver for a new SoC") +Reviewed-by: Yi xin Zhu +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/a4770e7225f8a0c03c8ab2ba80434a4e8e9afb17.1665642720.git.rtanwar@maxlinear.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/x86/clk-cgu.c | 5 +++-- + drivers/clk/x86/clk-cgu.h | 1 + + drivers/clk/x86/clk-lgm.c | 4 ++-- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/x86/clk-cgu.c b/drivers/clk/x86/clk-cgu.c +index 4278a687076c9..89b53f280aee0 100644 +--- a/drivers/clk/x86/clk-cgu.c ++++ b/drivers/clk/x86/clk-cgu.c +@@ -164,8 +164,9 @@ static int lgm_clk_divider_enable_disable(struct clk_hw *hw, int enable) + { + struct lgm_clk_divider *div = to_lgm_clk_divider(hw); + +- lgm_set_clk_val(div->membase, div->reg, div->shift_gate, +- div->width_gate, enable); ++ if (div->flags != DIV_CLK_NO_MASK) ++ lgm_set_clk_val(div->membase, div->reg, div->shift_gate, ++ div->width_gate, enable); + return 0; + } + +diff --git a/drivers/clk/x86/clk-cgu.h b/drivers/clk/x86/clk-cgu.h +index 73ce84345f81e..bcaf8aec94e5d 100644 +--- a/drivers/clk/x86/clk-cgu.h ++++ b/drivers/clk/x86/clk-cgu.h +@@ -198,6 +198,7 @@ struct lgm_clk_branch { + #define CLOCK_FLAG_VAL_INIT BIT(16) + #define MUX_CLK_SW BIT(17) + #define GATE_CLK_HW BIT(18) ++#define DIV_CLK_NO_MASK BIT(19) + + #define LGM_MUX(_id, _name, _pdata, _f, _reg, \ + _shift, _width, _cf, _v) \ +diff --git a/drivers/clk/x86/clk-lgm.c b/drivers/clk/x86/clk-lgm.c +index e312af42e97ae..4de77b2c750d3 100644 +--- a/drivers/clk/x86/clk-lgm.c ++++ b/drivers/clk/x86/clk-lgm.c +@@ -255,8 +255,8 @@ static const struct lgm_clk_branch lgm_branch_clks[] = { + LGM_FIXED(LGM_CLK_SLIC, "slic", NULL, 0, CGU_IF_CLK1, + 8, 2, CLOCK_FLAG_VAL_INIT, 8192000, 2), + LGM_FIXED(LGM_CLK_DOCSIS, "v_docsis", NULL, 0, 0, 0, 0, 0, 16000000, 0), +- LGM_DIV(LGM_CLK_DCL, "dcl", "v_ifclk", 0, CGU_PCMCR, +- 25, 3, 0, 0, 0, 0, dcl_div), ++ LGM_DIV(LGM_CLK_DCL, "dcl", "v_ifclk", CLK_SET_RATE_PARENT, CGU_PCMCR, ++ 25, 3, 0, 0, DIV_CLK_NO_MASK, 0, dcl_div), + LGM_MUX(LGM_CLK_PCM, "pcm", pcm_p, 0, CGU_C55_PCMCR, + 0, 1, CLK_MUX_ROUND_CLOSEST, 0), + LGM_FIXED_FACTOR(LGM_CLK_DDR_PHY, "ddr_phy", "ddr", +-- +2.39.0 + diff --git a/queue-5.15/clk-mxl-remove-redundant-spinlocks.patch b/queue-5.15/clk-mxl-remove-redundant-spinlocks.patch new file mode 100644 index 00000000000..299cd8e05a8 --- /dev/null +++ b/queue-5.15/clk-mxl-remove-redundant-spinlocks.patch @@ -0,0 +1,515 @@ +From 3c5d1365ce8b6e64d3d9df4c215bebb59727a538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 14:48:31 +0800 +Subject: clk: mxl: Remove redundant spinlocks + +From: Rahul Tanwar + +[ Upstream commit eaabee88a88a26b108be8d120fc072dfaf462cef ] + +Patch 1/4 of this patch series switches from direct readl/writel +based register access to regmap based register access. Instead +of using direct readl/writel, regmap API's are used to read, write +& read-modify-write clk registers. Regmap API's already use their +own spinlocks to serialize the register accesses across multiple +cores in which case additional driver spinlocks becomes redundant. + +Hence, remove redundant spinlocks from driver in this patch 2/4. + +Reviewed-by: Yi xin Zhu +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/a8a02c8773b88924503a9fdaacd37dd2e6488bf3.1665642720.git.rtanwar@maxlinear.com +Signed-off-by: Stephen Boyd +Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags") +Signed-off-by: Sasha Levin +--- + drivers/clk/x86/clk-cgu-pll.c | 13 ------ + drivers/clk/x86/clk-cgu.c | 80 ++++------------------------------- + drivers/clk/x86/clk-cgu.h | 6 --- + drivers/clk/x86/clk-lgm.c | 1 - + 4 files changed, 9 insertions(+), 91 deletions(-) + +diff --git a/drivers/clk/x86/clk-cgu-pll.c b/drivers/clk/x86/clk-cgu-pll.c +index c83083affe88e..409dbf55f4cae 100644 +--- a/drivers/clk/x86/clk-cgu-pll.c ++++ b/drivers/clk/x86/clk-cgu-pll.c +@@ -41,13 +41,10 @@ static unsigned long lgm_pll_recalc_rate(struct clk_hw *hw, unsigned long prate) + { + struct lgm_clk_pll *pll = to_lgm_clk_pll(hw); + unsigned int div, mult, frac; +- unsigned long flags; + +- spin_lock_irqsave(&pll->lock, flags); + mult = lgm_get_clk_val(pll->membase, PLL_REF_DIV(pll->reg), 0, 12); + div = lgm_get_clk_val(pll->membase, PLL_REF_DIV(pll->reg), 18, 6); + frac = lgm_get_clk_val(pll->membase, pll->reg, 2, 24); +- spin_unlock_irqrestore(&pll->lock, flags); + + if (pll->type == TYPE_LJPLL) + div *= 4; +@@ -58,12 +55,9 @@ static unsigned long lgm_pll_recalc_rate(struct clk_hw *hw, unsigned long prate) + static int lgm_pll_is_enabled(struct clk_hw *hw) + { + struct lgm_clk_pll *pll = to_lgm_clk_pll(hw); +- unsigned long flags; + unsigned int ret; + +- spin_lock_irqsave(&pll->lock, flags); + ret = lgm_get_clk_val(pll->membase, pll->reg, 0, 1); +- spin_unlock_irqrestore(&pll->lock, flags); + + return ret; + } +@@ -71,16 +65,13 @@ static int lgm_pll_is_enabled(struct clk_hw *hw) + static int lgm_pll_enable(struct clk_hw *hw) + { + struct lgm_clk_pll *pll = to_lgm_clk_pll(hw); +- unsigned long flags; + u32 val; + int ret; + +- spin_lock_irqsave(&pll->lock, flags); + lgm_set_clk_val(pll->membase, pll->reg, 0, 1, 1); + ret = regmap_read_poll_timeout_atomic(pll->membase, pll->reg, + val, (val & 0x1), 1, 100); + +- spin_unlock_irqrestore(&pll->lock, flags); + + return ret; + } +@@ -88,11 +79,8 @@ static int lgm_pll_enable(struct clk_hw *hw) + static void lgm_pll_disable(struct clk_hw *hw) + { + struct lgm_clk_pll *pll = to_lgm_clk_pll(hw); +- unsigned long flags; + +- spin_lock_irqsave(&pll->lock, flags); + lgm_set_clk_val(pll->membase, pll->reg, 0, 1, 0); +- spin_unlock_irqrestore(&pll->lock, flags); + } + + static const struct clk_ops lgm_pll_ops = { +@@ -123,7 +111,6 @@ lgm_clk_register_pll(struct lgm_clk_provider *ctx, + return ERR_PTR(-ENOMEM); + + pll->membase = ctx->membase; +- pll->lock = ctx->lock; + pll->reg = list->reg; + pll->flags = list->flags; + pll->type = list->type; +diff --git a/drivers/clk/x86/clk-cgu.c b/drivers/clk/x86/clk-cgu.c +index f5f30a18f4869..1f7e93de67bc0 100644 +--- a/drivers/clk/x86/clk-cgu.c ++++ b/drivers/clk/x86/clk-cgu.c +@@ -25,14 +25,10 @@ + static struct clk_hw *lgm_clk_register_fixed(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags; + +- if (list->div_flags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&ctx->lock, flags); ++ if (list->div_flags & CLOCK_FLAG_VAL_INIT) + lgm_set_clk_val(ctx->membase, list->div_off, list->div_shift, + list->div_width, list->div_val); +- spin_unlock_irqrestore(&ctx->lock, flags); +- } + + return clk_hw_register_fixed_rate(NULL, list->name, + list->parent_data[0].name, +@@ -42,33 +38,27 @@ static struct clk_hw *lgm_clk_register_fixed(struct lgm_clk_provider *ctx, + static u8 lgm_clk_mux_get_parent(struct clk_hw *hw) + { + struct lgm_clk_mux *mux = to_lgm_clk_mux(hw); +- unsigned long flags; + u32 val; + +- spin_lock_irqsave(&mux->lock, flags); + if (mux->flags & MUX_CLK_SW) + val = mux->reg; + else + val = lgm_get_clk_val(mux->membase, mux->reg, mux->shift, + mux->width); +- spin_unlock_irqrestore(&mux->lock, flags); + return clk_mux_val_to_index(hw, NULL, mux->flags, val); + } + + static int lgm_clk_mux_set_parent(struct clk_hw *hw, u8 index) + { + struct lgm_clk_mux *mux = to_lgm_clk_mux(hw); +- unsigned long flags; + u32 val; + + val = clk_mux_index_to_val(NULL, mux->flags, index); +- spin_lock_irqsave(&mux->lock, flags); + if (mux->flags & MUX_CLK_SW) + mux->reg = val; + else + lgm_set_clk_val(mux->membase, mux->reg, mux->shift, + mux->width, val); +- spin_unlock_irqrestore(&mux->lock, flags); + + return 0; + } +@@ -91,7 +81,7 @@ static struct clk_hw * + lgm_clk_register_mux(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags, cflags = list->mux_flags; ++ unsigned long cflags = list->mux_flags; + struct device *dev = ctx->dev; + u8 shift = list->mux_shift; + u8 width = list->mux_width; +@@ -112,7 +102,6 @@ lgm_clk_register_mux(struct lgm_clk_provider *ctx, + init.num_parents = list->num_parents; + + mux->membase = ctx->membase; +- mux->lock = ctx->lock; + mux->reg = reg; + mux->shift = shift; + mux->width = width; +@@ -124,11 +113,8 @@ lgm_clk_register_mux(struct lgm_clk_provider *ctx, + if (ret) + return ERR_PTR(ret); + +- if (cflags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&mux->lock, flags); ++ if (cflags & CLOCK_FLAG_VAL_INIT) + lgm_set_clk_val(mux->membase, reg, shift, width, list->mux_val); +- spin_unlock_irqrestore(&mux->lock, flags); +- } + + return hw; + } +@@ -137,13 +123,10 @@ static unsigned long + lgm_clk_divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) + { + struct lgm_clk_divider *divider = to_lgm_clk_divider(hw); +- unsigned long flags; + unsigned int val; + +- spin_lock_irqsave(÷r->lock, flags); + val = lgm_get_clk_val(divider->membase, divider->reg, + divider->shift, divider->width); +- spin_unlock_irqrestore(÷r->lock, flags); + + return divider_recalc_rate(hw, parent_rate, val, divider->table, + divider->flags, divider->width); +@@ -164,7 +147,6 @@ lgm_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate, + unsigned long prate) + { + struct lgm_clk_divider *divider = to_lgm_clk_divider(hw); +- unsigned long flags; + int value; + + value = divider_get_val(rate, prate, divider->table, +@@ -172,10 +154,8 @@ lgm_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate, + if (value < 0) + return value; + +- spin_lock_irqsave(÷r->lock, flags); + lgm_set_clk_val(divider->membase, divider->reg, + divider->shift, divider->width, value); +- spin_unlock_irqrestore(÷r->lock, flags); + + return 0; + } +@@ -183,12 +163,9 @@ lgm_clk_divider_set_rate(struct clk_hw *hw, unsigned long rate, + static int lgm_clk_divider_enable_disable(struct clk_hw *hw, int enable) + { + struct lgm_clk_divider *div = to_lgm_clk_divider(hw); +- unsigned long flags; + +- spin_lock_irqsave(&div->lock, flags); + lgm_set_clk_val(div->membase, div->reg, div->shift_gate, + div->width_gate, enable); +- spin_unlock_irqrestore(&div->lock, flags); + return 0; + } + +@@ -214,7 +191,7 @@ static struct clk_hw * + lgm_clk_register_divider(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags, cflags = list->div_flags; ++ unsigned long cflags = list->div_flags; + struct device *dev = ctx->dev; + struct lgm_clk_divider *div; + struct clk_init_data init = {}; +@@ -237,7 +214,6 @@ lgm_clk_register_divider(struct lgm_clk_provider *ctx, + init.num_parents = 1; + + div->membase = ctx->membase; +- div->lock = ctx->lock; + div->reg = reg; + div->shift = shift; + div->width = width; +@@ -252,11 +228,8 @@ lgm_clk_register_divider(struct lgm_clk_provider *ctx, + if (ret) + return ERR_PTR(ret); + +- if (cflags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&div->lock, flags); ++ if (cflags & CLOCK_FLAG_VAL_INIT) + lgm_set_clk_val(div->membase, reg, shift, width, list->div_val); +- spin_unlock_irqrestore(&div->lock, flags); +- } + + return hw; + } +@@ -265,7 +238,6 @@ static struct clk_hw * + lgm_clk_register_fixed_factor(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags; + struct clk_hw *hw; + + hw = clk_hw_register_fixed_factor(ctx->dev, list->name, +@@ -274,12 +246,9 @@ lgm_clk_register_fixed_factor(struct lgm_clk_provider *ctx, + if (IS_ERR(hw)) + return ERR_CAST(hw); + +- if (list->div_flags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&ctx->lock, flags); ++ if (list->div_flags & CLOCK_FLAG_VAL_INIT) + lgm_set_clk_val(ctx->membase, list->div_off, list->div_shift, + list->div_width, list->div_val); +- spin_unlock_irqrestore(&ctx->lock, flags); +- } + + return hw; + } +@@ -287,13 +256,10 @@ lgm_clk_register_fixed_factor(struct lgm_clk_provider *ctx, + static int lgm_clk_gate_enable(struct clk_hw *hw) + { + struct lgm_clk_gate *gate = to_lgm_clk_gate(hw); +- unsigned long flags; + unsigned int reg; + +- spin_lock_irqsave(&gate->lock, flags); + reg = GATE_HW_REG_EN(gate->reg); + lgm_set_clk_val(gate->membase, reg, gate->shift, 1, 1); +- spin_unlock_irqrestore(&gate->lock, flags); + + return 0; + } +@@ -301,25 +267,19 @@ static int lgm_clk_gate_enable(struct clk_hw *hw) + static void lgm_clk_gate_disable(struct clk_hw *hw) + { + struct lgm_clk_gate *gate = to_lgm_clk_gate(hw); +- unsigned long flags; + unsigned int reg; + +- spin_lock_irqsave(&gate->lock, flags); + reg = GATE_HW_REG_DIS(gate->reg); + lgm_set_clk_val(gate->membase, reg, gate->shift, 1, 1); +- spin_unlock_irqrestore(&gate->lock, flags); + } + + static int lgm_clk_gate_is_enabled(struct clk_hw *hw) + { + struct lgm_clk_gate *gate = to_lgm_clk_gate(hw); + unsigned int reg, ret; +- unsigned long flags; + +- spin_lock_irqsave(&gate->lock, flags); + reg = GATE_HW_REG_STAT(gate->reg); + ret = lgm_get_clk_val(gate->membase, reg, gate->shift, 1); +- spin_unlock_irqrestore(&gate->lock, flags); + + return ret; + } +@@ -334,7 +294,7 @@ static struct clk_hw * + lgm_clk_register_gate(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list) + { +- unsigned long flags, cflags = list->gate_flags; ++ unsigned long cflags = list->gate_flags; + const char *pname = list->parent_data[0].name; + struct device *dev = ctx->dev; + u8 shift = list->gate_shift; +@@ -355,7 +315,6 @@ lgm_clk_register_gate(struct lgm_clk_provider *ctx, + init.num_parents = pname ? 1 : 0; + + gate->membase = ctx->membase; +- gate->lock = ctx->lock; + gate->reg = reg; + gate->shift = shift; + gate->flags = cflags; +@@ -367,9 +326,7 @@ lgm_clk_register_gate(struct lgm_clk_provider *ctx, + return ERR_PTR(ret); + + if (cflags & CLOCK_FLAG_VAL_INIT) { +- spin_lock_irqsave(&gate->lock, flags); + lgm_set_clk_val(gate->membase, reg, shift, 1, list->gate_val); +- spin_unlock_irqrestore(&gate->lock, flags); + } + + return hw; +@@ -444,24 +401,18 @@ lgm_clk_ddiv_recalc_rate(struct clk_hw *hw, unsigned long parent_rate) + static int lgm_clk_ddiv_enable(struct clk_hw *hw) + { + struct lgm_clk_ddiv *ddiv = to_lgm_clk_ddiv(hw); +- unsigned long flags; + +- spin_lock_irqsave(&ddiv->lock, flags); + lgm_set_clk_val(ddiv->membase, ddiv->reg, ddiv->shift_gate, + ddiv->width_gate, 1); +- spin_unlock_irqrestore(&ddiv->lock, flags); + return 0; + } + + static void lgm_clk_ddiv_disable(struct clk_hw *hw) + { + struct lgm_clk_ddiv *ddiv = to_lgm_clk_ddiv(hw); +- unsigned long flags; + +- spin_lock_irqsave(&ddiv->lock, flags); + lgm_set_clk_val(ddiv->membase, ddiv->reg, ddiv->shift_gate, + ddiv->width_gate, 0); +- spin_unlock_irqrestore(&ddiv->lock, flags); + } + + static int +@@ -498,32 +449,25 @@ lgm_clk_ddiv_set_rate(struct clk_hw *hw, unsigned long rate, + { + struct lgm_clk_ddiv *ddiv = to_lgm_clk_ddiv(hw); + u32 div, ddiv1, ddiv2; +- unsigned long flags; + + div = DIV_ROUND_CLOSEST_ULL((u64)prate, rate); + +- spin_lock_irqsave(&ddiv->lock, flags); + if (lgm_get_clk_val(ddiv->membase, ddiv->reg, ddiv->shift2, 1)) { + div = DIV_ROUND_CLOSEST_ULL((u64)div, 5); + div = div * 2; + } + +- if (div <= 0) { +- spin_unlock_irqrestore(&ddiv->lock, flags); ++ if (div <= 0) + return -EINVAL; +- } + +- if (lgm_clk_get_ddiv_val(div, &ddiv1, &ddiv2)) { +- spin_unlock_irqrestore(&ddiv->lock, flags); ++ if (lgm_clk_get_ddiv_val(div, &ddiv1, &ddiv2)) + return -EINVAL; +- } + + lgm_set_clk_val(ddiv->membase, ddiv->reg, ddiv->shift0, ddiv->width0, + ddiv1 - 1); + + lgm_set_clk_val(ddiv->membase, ddiv->reg, ddiv->shift1, ddiv->width1, + ddiv2 - 1); +- spin_unlock_irqrestore(&ddiv->lock, flags); + + return 0; + } +@@ -534,18 +478,15 @@ lgm_clk_ddiv_round_rate(struct clk_hw *hw, unsigned long rate, + { + struct lgm_clk_ddiv *ddiv = to_lgm_clk_ddiv(hw); + u32 div, ddiv1, ddiv2; +- unsigned long flags; + u64 rate64; + + div = DIV_ROUND_CLOSEST_ULL((u64)*prate, rate); + + /* if predivide bit is enabled, modify div by factor of 2.5 */ +- spin_lock_irqsave(&ddiv->lock, flags); + if (lgm_get_clk_val(ddiv->membase, ddiv->reg, ddiv->shift2, 1)) { + div = div * 2; + div = DIV_ROUND_CLOSEST_ULL((u64)div, 5); + } +- spin_unlock_irqrestore(&ddiv->lock, flags); + + if (div <= 0) + return *prate; +@@ -559,12 +500,10 @@ lgm_clk_ddiv_round_rate(struct clk_hw *hw, unsigned long rate, + do_div(rate64, ddiv2); + + /* if predivide bit is enabled, modify rounded rate by factor of 2.5 */ +- spin_lock_irqsave(&ddiv->lock, flags); + if (lgm_get_clk_val(ddiv->membase, ddiv->reg, ddiv->shift2, 1)) { + rate64 = rate64 * 2; + rate64 = DIV_ROUND_CLOSEST_ULL(rate64, 5); + } +- spin_unlock_irqrestore(&ddiv->lock, flags); + + return rate64; + } +@@ -601,7 +540,6 @@ int lgm_clk_register_ddiv(struct lgm_clk_provider *ctx, + init.num_parents = 1; + + ddiv->membase = ctx->membase; +- ddiv->lock = ctx->lock; + ddiv->reg = list->reg; + ddiv->shift0 = list->shift0; + ddiv->width0 = list->width0; +diff --git a/drivers/clk/x86/clk-cgu.h b/drivers/clk/x86/clk-cgu.h +index dbcb664687975..0aa0f35d63a0b 100644 +--- a/drivers/clk/x86/clk-cgu.h ++++ b/drivers/clk/x86/clk-cgu.h +@@ -18,7 +18,6 @@ struct lgm_clk_mux { + u8 shift; + u8 width; + unsigned long flags; +- spinlock_t lock; + }; + + struct lgm_clk_divider { +@@ -31,7 +30,6 @@ struct lgm_clk_divider { + u8 width_gate; + unsigned long flags; + const struct clk_div_table *table; +- spinlock_t lock; + }; + + struct lgm_clk_ddiv { +@@ -49,7 +47,6 @@ struct lgm_clk_ddiv { + unsigned int mult; + unsigned int div; + unsigned long flags; +- spinlock_t lock; + }; + + struct lgm_clk_gate { +@@ -58,7 +55,6 @@ struct lgm_clk_gate { + unsigned int reg; + u8 shift; + unsigned long flags; +- spinlock_t lock; + }; + + enum lgm_clk_type { +@@ -82,7 +78,6 @@ struct lgm_clk_provider { + struct device_node *np; + struct device *dev; + struct clk_hw_onecell_data clk_data; +- spinlock_t lock; + }; + + enum pll_type { +@@ -97,7 +92,6 @@ struct lgm_clk_pll { + unsigned int reg; + unsigned long flags; + enum pll_type type; +- spinlock_t lock; + }; + + /** +diff --git a/drivers/clk/x86/clk-lgm.c b/drivers/clk/x86/clk-lgm.c +index 4fa2bcaf71c89..e312af42e97ae 100644 +--- a/drivers/clk/x86/clk-lgm.c ++++ b/drivers/clk/x86/clk-lgm.c +@@ -444,7 +444,6 @@ static int lgm_cgu_probe(struct platform_device *pdev) + + ctx->np = np; + ctx->dev = dev; +- spin_lock_init(&ctx->lock); + + ret = lgm_clk_register_plls(ctx, lgm_pll_clks, + ARRAY_SIZE(lgm_pll_clks)); +-- +2.39.0 + diff --git a/queue-5.15/clk-mxl-switch-from-direct-readl-writel-based-io-to-.patch b/queue-5.15/clk-mxl-switch-from-direct-readl-writel-based-io-to-.patch new file mode 100644 index 00000000000..179691f9c2d --- /dev/null +++ b/queue-5.15/clk-mxl-switch-from-direct-readl-writel-based-io-to-.patch @@ -0,0 +1,245 @@ +From ba1d3527e3108d7445cd1edf6514e9a22dd24e81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 14:48:30 +0800 +Subject: clk: mxl: Switch from direct readl/writel based IO to regmap based IO + +From: Rahul Tanwar + +[ Upstream commit 036177310bac5534de44ff6a7b60a4d2c0b6567c ] + +Earlier version of driver used direct io remapped register read +writes using readl/writel. But we need secure boot access which +is only possible when registers are read & written using regmap. +This is because the security bus/hook is written & coupled only +with regmap layer. + +Switch the driver from direct readl/writel based register accesses +to regmap based register accesses. + +Additionally, update the license headers to latest status. + +Reviewed-by: Yi xin Zhu +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/2610331918206e0e3bd18babb39393a558fb34f9.1665642720.git.rtanwar@maxlinear.com +Signed-off-by: Stephen Boyd +Stable-dep-of: 106ef3bda210 ("clk: mxl: Fix a clk entry by adding relevant flags") +Signed-off-by: Sasha Levin +--- + drivers/clk/x86/Kconfig | 5 +++-- + drivers/clk/x86/clk-cgu-pll.c | 10 +++++---- + drivers/clk/x86/clk-cgu.c | 5 +++-- + drivers/clk/x86/clk-cgu.h | 38 +++++++++++++++++++---------------- + drivers/clk/x86/clk-lgm.c | 13 ++++++++---- + 5 files changed, 42 insertions(+), 29 deletions(-) + +diff --git a/drivers/clk/x86/Kconfig b/drivers/clk/x86/Kconfig +index 69642e15fcc1f..ced99e082e3dd 100644 +--- a/drivers/clk/x86/Kconfig ++++ b/drivers/clk/x86/Kconfig +@@ -1,8 +1,9 @@ + # SPDX-License-Identifier: GPL-2.0-only + config CLK_LGM_CGU + depends on OF && HAS_IOMEM && (X86 || COMPILE_TEST) ++ select MFD_SYSCON + select OF_EARLY_FLATTREE + bool "Clock driver for Lightning Mountain(LGM) platform" + help +- Clock Generation Unit(CGU) driver for Intel Lightning Mountain(LGM) +- network processor SoC. ++ Clock Generation Unit(CGU) driver for MaxLinear's x86 based ++ Lightning Mountain(LGM) network processor SoC. +diff --git a/drivers/clk/x86/clk-cgu-pll.c b/drivers/clk/x86/clk-cgu-pll.c +index 3179557b5f784..c83083affe88e 100644 +--- a/drivers/clk/x86/clk-cgu-pll.c ++++ b/drivers/clk/x86/clk-cgu-pll.c +@@ -1,8 +1,9 @@ + // SPDX-License-Identifier: GPL-2.0 + /* ++ * Copyright (C) 2020-2022 MaxLinear, Inc. + * Copyright (C) 2020 Intel Corporation. +- * Zhu YiXin +- * Rahul Tanwar ++ * Zhu Yixin ++ * Rahul Tanwar + */ + + #include +@@ -76,8 +77,9 @@ static int lgm_pll_enable(struct clk_hw *hw) + + spin_lock_irqsave(&pll->lock, flags); + lgm_set_clk_val(pll->membase, pll->reg, 0, 1, 1); +- ret = readl_poll_timeout_atomic(pll->membase + pll->reg, +- val, (val & 0x1), 1, 100); ++ ret = regmap_read_poll_timeout_atomic(pll->membase, pll->reg, ++ val, (val & 0x1), 1, 100); ++ + spin_unlock_irqrestore(&pll->lock, flags); + + return ret; +diff --git a/drivers/clk/x86/clk-cgu.c b/drivers/clk/x86/clk-cgu.c +index 33de600e0c38e..f5f30a18f4869 100644 +--- a/drivers/clk/x86/clk-cgu.c ++++ b/drivers/clk/x86/clk-cgu.c +@@ -1,8 +1,9 @@ + // SPDX-License-Identifier: GPL-2.0 + /* ++ * Copyright (C) 2020-2022 MaxLinear, Inc. + * Copyright (C) 2020 Intel Corporation. +- * Zhu YiXin +- * Rahul Tanwar ++ * Zhu Yixin ++ * Rahul Tanwar + */ + #include + #include +diff --git a/drivers/clk/x86/clk-cgu.h b/drivers/clk/x86/clk-cgu.h +index 4e22bfb223128..dbcb664687975 100644 +--- a/drivers/clk/x86/clk-cgu.h ++++ b/drivers/clk/x86/clk-cgu.h +@@ -1,18 +1,19 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + /* +- * Copyright(c) 2020 Intel Corporation. +- * Zhu YiXin +- * Rahul Tanwar ++ * Copyright (C) 2020-2022 MaxLinear, Inc. ++ * Copyright (C) 2020 Intel Corporation. ++ * Zhu Yixin ++ * Rahul Tanwar + */ + + #ifndef __CLK_CGU_H + #define __CLK_CGU_H + +-#include ++#include + + struct lgm_clk_mux { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + u8 shift; + u8 width; +@@ -22,7 +23,7 @@ struct lgm_clk_mux { + + struct lgm_clk_divider { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + u8 shift; + u8 width; +@@ -35,7 +36,7 @@ struct lgm_clk_divider { + + struct lgm_clk_ddiv { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + u8 shift0; + u8 width0; +@@ -53,7 +54,7 @@ struct lgm_clk_ddiv { + + struct lgm_clk_gate { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + u8 shift; + unsigned long flags; +@@ -77,7 +78,7 @@ enum lgm_clk_type { + * @clk_data: array of hw clocks and clk number. + */ + struct lgm_clk_provider { +- void __iomem *membase; ++ struct regmap *membase; + struct device_node *np; + struct device *dev; + struct clk_hw_onecell_data clk_data; +@@ -92,7 +93,7 @@ enum pll_type { + + struct lgm_clk_pll { + struct clk_hw hw; +- void __iomem *membase; ++ struct regmap *membase; + unsigned int reg; + unsigned long flags; + enum pll_type type; +@@ -300,29 +301,32 @@ struct lgm_clk_branch { + .div = _d, \ + } + +-static inline void lgm_set_clk_val(void __iomem *membase, u32 reg, ++static inline void lgm_set_clk_val(struct regmap *membase, u32 reg, + u8 shift, u8 width, u32 set_val) + { + u32 mask = (GENMASK(width - 1, 0) << shift); +- u32 regval; + +- regval = readl(membase + reg); +- regval = (regval & ~mask) | ((set_val << shift) & mask); +- writel(regval, membase + reg); ++ regmap_update_bits(membase, reg, mask, set_val << shift); + } + +-static inline u32 lgm_get_clk_val(void __iomem *membase, u32 reg, ++static inline u32 lgm_get_clk_val(struct regmap *membase, u32 reg, + u8 shift, u8 width) + { + u32 mask = (GENMASK(width - 1, 0) << shift); + u32 val; + +- val = readl(membase + reg); ++ if (regmap_read(membase, reg, &val)) { ++ WARN_ONCE(1, "Failed to read clk reg: 0x%x\n", reg); ++ return 0; ++ } ++ + val = (val & mask) >> shift; + + return val; + } + ++ ++ + int lgm_clk_register_branches(struct lgm_clk_provider *ctx, + const struct lgm_clk_branch *list, + unsigned int nr_clk); +diff --git a/drivers/clk/x86/clk-lgm.c b/drivers/clk/x86/clk-lgm.c +index 020f4e83a5ccb..4fa2bcaf71c89 100644 +--- a/drivers/clk/x86/clk-lgm.c ++++ b/drivers/clk/x86/clk-lgm.c +@@ -1,10 +1,12 @@ + // SPDX-License-Identifier: GPL-2.0 + /* ++ * Copyright (C) 2020-2022 MaxLinear, Inc. + * Copyright (C) 2020 Intel Corporation. +- * Zhu YiXin +- * Rahul Tanwar ++ * Zhu Yixin ++ * Rahul Tanwar + */ + #include ++#include + #include + #include + #include +@@ -433,9 +435,12 @@ static int lgm_cgu_probe(struct platform_device *pdev) + + ctx->clk_data.num = CLK_NR_CLKS; + +- ctx->membase = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(ctx->membase)) ++ ctx->membase = syscon_node_to_regmap(np); ++ if (IS_ERR_OR_NULL(ctx->membase)) { ++ dev_err(dev, "Failed to get clk CGU iomem\n"); + return PTR_ERR(ctx->membase); ++ } ++ + + ctx->np = np; + ctx->dev = dev; +-- +2.39.0 + diff --git a/queue-5.15/clk-mxl-syscon_node_to_regmap-returns-error-pointers.patch b/queue-5.15/clk-mxl-syscon_node_to_regmap-returns-error-pointers.patch new file mode 100644 index 00000000000..6de4913de95 --- /dev/null +++ b/queue-5.15/clk-mxl-syscon_node_to_regmap-returns-error-pointers.patch @@ -0,0 +1,43 @@ +From fb29c4ff2589f1186d102d1a7b2a588bfbad3492 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 19:03:57 +0800 +Subject: clk: mxl: syscon_node_to_regmap() returns error pointers + +From: Rahul Tanwar + +[ Upstream commit 7256d1f4618b40792d1e9b9b6cb1406a13cad2dd ] + +Commit 036177310bac ("clk: mxl: Switch from direct readl/writel based IO +to regmap based IO") introduced code resulting in below warning issued +by the smatch static checker. + + drivers/clk/x86/clk-lgm.c:441 lgm_cgu_probe() warn: passing zero to 'PTR_ERR' + +Fix the warning by replacing incorrect IS_ERR_OR_NULL() with IS_ERR(). + +Fixes: 036177310bac ("clk: mxl: Switch from direct readl/writel based IO to regmap based IO") +Reported-by: Dan Carpenter +Signed-off-by: Rahul Tanwar +Link: https://lore.kernel.org/r/49e339d4739e4ae4c92b00c1b2918af0755d4122.1666695221.git.rtanwar@maxlinear.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/x86/clk-lgm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/x86/clk-lgm.c b/drivers/clk/x86/clk-lgm.c +index 4de77b2c750d3..f69455dd1c980 100644 +--- a/drivers/clk/x86/clk-lgm.c ++++ b/drivers/clk/x86/clk-lgm.c +@@ -436,7 +436,7 @@ static int lgm_cgu_probe(struct platform_device *pdev) + ctx->clk_data.num = CLK_NR_CLKS; + + ctx->membase = syscon_node_to_regmap(np); +- if (IS_ERR_OR_NULL(ctx->membase)) { ++ if (IS_ERR(ctx->membase)) { + dev_err(dev, "Failed to get clk CGU iomem\n"); + return PTR_ERR(ctx->membase); + } +-- +2.39.0 + diff --git a/queue-5.15/drm-edid-fix-minimum-bpc-supported-with-dsc1.2-for-h.patch b/queue-5.15/drm-edid-fix-minimum-bpc-supported-with-dsc1.2-for-h.patch new file mode 100644 index 00000000000..fcb5c5562f1 --- /dev/null +++ b/queue-5.15/drm-edid-fix-minimum-bpc-supported-with-dsc1.2-for-h.patch @@ -0,0 +1,48 @@ +From e8d1e5663625172a9fba7f9e7d7c4d4875ea65ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 15:35:48 +0530 +Subject: drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink + +From: Ankit Nautiyal + +[ Upstream commit 18feaf6d0784dcba888859109676adf1e0260dfd ] + +HF-VSDB/SCDB has bits to advertise support for 16, 12 and 10 bpc. +If none of the bits are set, the minimum bpc supported with DSC is 8. + +This patch corrects the min bpc supported to be 8, instead of 0. + +Fixes: 76ee7b905678 ("drm/edid: Parse DSC1.2 cap fields from HFVSDB block") +Cc: Ankit Nautiyal +Cc: Uma Shankar +Cc: Jani Nikula +Cc: Maarten Lankhorst + +v2: s/DSC1.2/DSC 1.2 + +Signed-off-by: Ankit Nautiyal +Reviewed-by: Jani Nikula +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20220916100551.2531750-2-ankit.k.nautiyal@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_edid.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 6ab048ba8021c..d940c76419c5a 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -4942,7 +4942,8 @@ static void drm_parse_hdmi_forum_vsdb(struct drm_connector *connector, + else if (hf_vsdb[11] & DRM_EDID_DSC_10BPC) + hdmi_dsc->bpc_supported = 10; + else +- hdmi_dsc->bpc_supported = 0; ++ /* Supports min 8 BPC if DSC 1.2 is supported*/ ++ hdmi_dsc->bpc_supported = 8; + + dsc_max_frl_rate = (hf_vsdb[12] & DRM_EDID_DSC_MAX_FRL_RATE_MASK) >> 4; + drm_get_max_frl_rate(dsc_max_frl_rate, &hdmi_dsc->max_lanes, +-- +2.39.0 + diff --git a/queue-5.15/drm-etnaviv-don-t-truncate-physical-page-address.patch b/queue-5.15/drm-etnaviv-don-t-truncate-physical-page-address.patch new file mode 100644 index 00000000000..295f5c56aa6 --- /dev/null +++ b/queue-5.15/drm-etnaviv-don-t-truncate-physical-page-address.patch @@ -0,0 +1,42 @@ +From c28a26faef8d86caa8053388537701da52d9066a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 12:40:31 +0200 +Subject: drm/etnaviv: don't truncate physical page address + +From: Lucas Stach + +[ Upstream commit d37c120b73128690434cc093952439eef9d56af1 ] + +While the interface for the MMU mapping takes phys_addr_t to hold a +full 64bit address when necessary and MMUv2 is able to map physical +addresses with up to 40bit, etnaviv_iommu_map() truncates the address +to 32bits. Fix this by using the correct type. + +Fixes: 931e97f3afd8 ("drm/etnaviv: mmuv2: support 40 bit phys address") +Signed-off-by: Lucas Stach +Reviewed-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +index aabb997a74eb4..2de806173b3aa 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c +@@ -80,10 +80,10 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova, + return -EINVAL; + + for_each_sgtable_dma_sg(sgt, sg, i) { +- u32 pa = sg_dma_address(sg) - sg->offset; ++ phys_addr_t pa = sg_dma_address(sg) - sg->offset; + size_t bytes = sg_dma_len(sg) + sg->offset; + +- VERB("map[%d]: %08x %08x(%zx)", i, iova, pa, bytes); ++ VERB("map[%d]: %08x %pap(%zx)", i, iova, &pa, bytes); + + ret = etnaviv_context_map(context, da, pa, bytes, prot); + if (ret) +-- +2.39.0 + diff --git a/queue-5.15/kvm-svm-skip-wrmsr-fastpath-on-vm-exit-if-next-rip-i.patch b/queue-5.15/kvm-svm-skip-wrmsr-fastpath-on-vm-exit-if-next-rip-i.patch new file mode 100644 index 00000000000..b57649c62de --- /dev/null +++ b/queue-5.15/kvm-svm-skip-wrmsr-fastpath-on-vm-exit-if-next-rip-i.patch @@ -0,0 +1,94 @@ +From fdddfee99c0b8b71897c0825d67ff1c78216ad50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Sep 2022 23:40:31 +0000 +Subject: KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid + +From: Sean Christopherson + +[ Upstream commit 5c30e8101e8d5d020b1d7119117889756a6ed713 ] + +Skip the WRMSR fastpath in SVM's VM-Exit handler if the next RIP isn't +valid, e.g. because KVM is running with nrips=false. SVM must decode and +emulate to skip the WRMSR if the CPU doesn't provide the next RIP. +Getting the instruction bytes to decode the WRMSR requires reading guest +memory, which in turn means dereferencing memslots, and that isn't safe +because KVM doesn't hold SRCU when the fastpath runs. + +Don't bother trying to enable the fastpath for this case, e.g. by doing +only the WRMSR and leaving the "skip" until later. NRIPS is supported on +all modern CPUs (KVM has considered making it mandatory), and the next +RIP will be valid the vast, vast majority of the time. + + ============================= + WARNING: suspicious RCU usage + 6.0.0-smp--4e557fcd3d80-skip #13 Tainted: G O + ----------------------------- + include/linux/kvm_host.h:954 suspicious rcu_dereference_check() usage! + + other info that might help us debug this: + + rcu_scheduler_active = 2, debug_locks = 1 + 1 lock held by stable/206475: + #0: ffff9d9dfebcc0f0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x8b/0x620 [kvm] + + stack backtrace: + CPU: 152 PID: 206475 Comm: stable Tainted: G O 6.0.0-smp--4e557fcd3d80-skip #13 + Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 + Call Trace: + + dump_stack_lvl+0x69/0xaa + dump_stack+0x10/0x12 + lockdep_rcu_suspicious+0x11e/0x130 + kvm_vcpu_gfn_to_memslot+0x155/0x190 [kvm] + kvm_vcpu_gfn_to_hva_prot+0x18/0x80 [kvm] + paging64_walk_addr_generic+0x183/0x450 [kvm] + paging64_gva_to_gpa+0x63/0xd0 [kvm] + kvm_fetch_guest_virt+0x53/0xc0 [kvm] + __do_insn_fetch_bytes+0x18b/0x1c0 [kvm] + x86_decode_insn+0xf0/0xef0 [kvm] + x86_emulate_instruction+0xba/0x790 [kvm] + kvm_emulate_instruction+0x17/0x20 [kvm] + __svm_skip_emulated_instruction+0x85/0x100 [kvm_amd] + svm_skip_emulated_instruction+0x13/0x20 [kvm_amd] + handle_fastpath_set_msr_irqoff+0xae/0x180 [kvm] + svm_vcpu_run+0x4b8/0x5a0 [kvm_amd] + vcpu_enter_guest+0x16ca/0x22f0 [kvm] + kvm_arch_vcpu_ioctl_run+0x39d/0x900 [kvm] + kvm_vcpu_ioctl+0x538/0x620 [kvm] + __se_sys_ioctl+0x77/0xc0 + __x64_sys_ioctl+0x1d/0x20 + do_syscall_64+0x3d/0x80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: 404d5d7bff0d ("KVM: X86: Introduce more exit_fastpath_completion enum values") +Signed-off-by: Sean Christopherson +Link: https://lore.kernel.org/r/20220930234031.1732249-1-seanjc@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/svm/svm.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c +index c1a7580388924..0611dac70c25c 100644 +--- a/arch/x86/kvm/svm/svm.c ++++ b/arch/x86/kvm/svm/svm.c +@@ -3740,8 +3740,14 @@ static void svm_cancel_injection(struct kvm_vcpu *vcpu) + + static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu) + { +- if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_MSR && +- to_svm(vcpu)->vmcb->control.exit_info_1) ++ struct vmcb_control_area *control = &to_svm(vcpu)->vmcb->control; ++ ++ /* ++ * Note, the next RIP must be provided as SRCU isn't held, i.e. KVM ++ * can't read guest memory (dereference memslots) to decode the WRMSR. ++ */ ++ if (control->exit_code == SVM_EXIT_MSR && control->exit_info_1 && ++ nrips && control->next_rip) + return handle_fastpath_set_msr_irqoff(vcpu); + + return EXIT_FASTPATH_NONE; +-- +2.39.0 + diff --git a/queue-5.15/kvm-vmx-execute-ibpb-on-emulated-vm-exit-when-guest-.patch b/queue-5.15/kvm-vmx-execute-ibpb-on-emulated-vm-exit-when-guest-.patch new file mode 100644 index 00000000000..74057d2a6bc --- /dev/null +++ b/queue-5.15/kvm-vmx-execute-ibpb-on-emulated-vm-exit-when-guest-.patch @@ -0,0 +1,90 @@ +From dff38d94d71c8a1931b3b3b059b9da911e9bd503 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 14:36:20 -0700 +Subject: KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS + +From: Jim Mattson + +[ Upstream commit 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 ] + +According to Intel's document on Indirect Branch Restricted +Speculation, "Enabling IBRS does not prevent software from controlling +the predicted targets of indirect branches of unrelated software +executed later at the same predictor mode (for example, between two +different user applications, or two different virtual machines). Such +isolation can be ensured through use of the Indirect Branch Predictor +Barrier (IBPB) command." This applies to both basic and enhanced IBRS. + +Since L1 and L2 VMs share hardware predictor modes (guest-user and +guest-kernel), hardware IBRS is not sufficient to virtualize +IBRS. (The way that basic IBRS is implemented on pre-eIBRS parts, +hardware IBRS is actually sufficient in practice, even though it isn't +sufficient architecturally.) + +For virtual CPUs that support IBRS, add an indirect branch prediction +barrier on emulated VM-exit, to ensure that the predicted targets of +indirect branches executed in L1 cannot be controlled by software that +was executed in L2. + +Since we typically don't intercept guest writes to IA32_SPEC_CTRL, +perform the IBPB at emulated VM-exit regardless of the current +IA32_SPEC_CTRL.IBRS value, even though the IBPB could technically be +deferred until L1 sets IA32_SPEC_CTRL.IBRS, if IA32_SPEC_CTRL.IBRS is +clear at emulated VM-exit. + +This is CVE-2022-2196. + +Fixes: 5c911beff20a ("KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02") +Cc: Sean Christopherson +Signed-off-by: Jim Mattson +Reviewed-by: Sean Christopherson +Link: https://lore.kernel.org/r/20221019213620.1953281-3-jmattson@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/vmx/nested.c | 11 +++++++++++ + arch/x86/kvm/vmx/vmx.c | 6 ++++-- + 2 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index cdebeceedbd06..f3c136548af69 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -4617,6 +4617,17 @@ void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 vm_exit_reason, + + vmx_switch_vmcs(vcpu, &vmx->vmcs01); + ++ /* ++ * If IBRS is advertised to the vCPU, KVM must flush the indirect ++ * branch predictors when transitioning from L2 to L1, as L1 expects ++ * hardware (KVM in this case) to provide separate predictor modes. ++ * Bare metal isolates VMX root (host) from VMX non-root (guest), but ++ * doesn't isolate different VMCSs, i.e. in this case, doesn't provide ++ * separate modes for L2 vs L1. ++ */ ++ if (guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) ++ indirect_branch_prediction_barrier(); ++ + /* Update any VMCS fields that might have changed while L2 ran */ + vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr); + vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr); +diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c +index 0718658268fef..c849173b60c27 100644 +--- a/arch/x86/kvm/vmx/vmx.c ++++ b/arch/x86/kvm/vmx/vmx.c +@@ -1332,8 +1332,10 @@ void vmx_vcpu_load_vmcs(struct kvm_vcpu *vcpu, int cpu, + + /* + * No indirect branch prediction barrier needed when switching +- * the active VMCS within a guest, e.g. on nested VM-Enter. +- * The L1 VMM can protect itself with retpolines, IBPB or IBRS. ++ * the active VMCS within a vCPU, unless IBRS is advertised to ++ * the vCPU. To minimize the number of IBPBs executed, KVM ++ * performs IBPB on nested VM-Exit (a single nested transition ++ * may switch the active VMCS multiple times). + */ + if (!buddy || WARN_ON_ONCE(buddy->vmcs != prev)) + indirect_branch_prediction_barrier(); +-- +2.39.0 + diff --git a/queue-5.15/kvm-x86-fail-emulation-during-emultype_skip-on-any-e.patch b/queue-5.15/kvm-x86-fail-emulation-during-emultype_skip-on-any-e.patch new file mode 100644 index 00000000000..3b987379583 --- /dev/null +++ b/queue-5.15/kvm-x86-fail-emulation-during-emultype_skip-on-any-e.patch @@ -0,0 +1,73 @@ +From 5ce577235cbc87bc49679153a9c8390651417704 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Sep 2022 23:36:32 +0000 +Subject: KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception + +From: Sean Christopherson + +[ Upstream commit 17122c06b86c9f77f45b86b8e62c3ed440847a59 ] + +Treat any exception during instruction decode for EMULTYPE_SKIP as a +"full" emulation failure, i.e. signal failure instead of queuing the +exception. When decoding purely to skip an instruction, KVM and/or the +CPU has already done some amount of emulation that cannot be unwound, +e.g. on an EPT misconfig VM-Exit KVM has already processeed the emulated +MMIO. KVM already does this if a #UD is encountered, but not for other +exceptions, e.g. if a #PF is encountered during fetch. + +In SVM's soft-injection use case, queueing the exception is particularly +problematic as queueing exceptions while injecting events can put KVM +into an infinite loop due to bailing from VM-Enter to service the newly +pending exception. E.g. multiple warnings to detect such behavior fire: + + ------------[ cut here ]------------ + WARNING: CPU: 3 PID: 1017 at arch/x86/kvm/x86.c:9873 kvm_arch_vcpu_ioctl_run+0x1de5/0x20a0 [kvm] + Modules linked in: kvm_amd ccp kvm irqbypass + CPU: 3 PID: 1017 Comm: svm_nested_soft Not tainted 6.0.0-rc1+ #220 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + RIP: 0010:kvm_arch_vcpu_ioctl_run+0x1de5/0x20a0 [kvm] + Call Trace: + kvm_vcpu_ioctl+0x223/0x6d0 [kvm] + __x64_sys_ioctl+0x85/0xc0 + do_syscall_64+0x2b/0x50 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + ---[ end trace 0000000000000000 ]--- + ------------[ cut here ]------------ + WARNING: CPU: 3 PID: 1017 at arch/x86/kvm/x86.c:9987 kvm_arch_vcpu_ioctl_run+0x12a3/0x20a0 [kvm] + Modules linked in: kvm_amd ccp kvm irqbypass + CPU: 3 PID: 1017 Comm: svm_nested_soft Tainted: G W 6.0.0-rc1+ #220 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + RIP: 0010:kvm_arch_vcpu_ioctl_run+0x12a3/0x20a0 [kvm] + Call Trace: + kvm_vcpu_ioctl+0x223/0x6d0 [kvm] + __x64_sys_ioctl+0x85/0xc0 + do_syscall_64+0x2b/0x50 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + ---[ end trace 0000000000000000 ]--- + +Fixes: 6ea6e84309ca ("KVM: x86: inject exceptions produced by x86_decode_insn") +Signed-off-by: Sean Christopherson +Link: https://lore.kernel.org/r/20220930233632.1725475-1-seanjc@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/x86.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 75c8f66cce4f6..0622256cd768f 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -8116,7 +8116,9 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, + write_fault_to_spt, + emulation_type)) + return 1; +- if (ctxt->have_exception) { ++ ++ if (ctxt->have_exception && ++ !(emulation_type & EMULTYPE_SKIP)) { + /* + * #UD should result in just EMULATION_FAILED, and trap-like + * exception should not be encountered during decode. +-- +2.39.0 + diff --git a/queue-5.15/netfilter-conntrack-fix-bug-in-for_each_sctp_chunk.patch b/queue-5.15/netfilter-conntrack-fix-bug-in-for_each_sctp_chunk.patch new file mode 100644 index 00000000000..5ba835f241a --- /dev/null +++ b/queue-5.15/netfilter-conntrack-fix-bug-in-for_each_sctp_chunk.patch @@ -0,0 +1,42 @@ +From a55ccf8f2aa2952cd462a6cf61709221f32636e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 02:47:19 +0100 +Subject: netfilter: conntrack: fix bug in for_each_sctp_chunk + +From: Sriram Yagnaraman + +[ Upstream commit 98ee0077452527f971567db01386de3c3d97ce13 ] + +skb_header_pointer() will return NULL if offset + sizeof(_sch) exceeds +skb->len, so this offset < skb->len test is redundant. + +if sch->length == 0, this will end up in an infinite loop, add a check +for sch->length > 0 + +Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") +Suggested-by: Florian Westphal +Signed-off-by: Sriram Yagnaraman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_sctp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c +index 895e0ca542994..444f02271b36a 100644 +--- a/net/netfilter/nf_conntrack_proto_sctp.c ++++ b/net/netfilter/nf_conntrack_proto_sctp.c +@@ -144,8 +144,8 @@ static void sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct) + + #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) \ + for ((offset) = (dataoff) + sizeof(struct sctphdr), (count) = 0; \ +- (offset) < (skb)->len && \ +- ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))); \ ++ ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))) && \ ++ (sch)->length; \ + (offset) += (ntohs((sch)->length) + 3) & ~3, (count)++) + + /* Some validity checks to make sure the chunks are fine */ +-- +2.39.0 + diff --git a/queue-5.15/powerpc-64s-radix-fix-crash-with-unaligned-relocated.patch b/queue-5.15/powerpc-64s-radix-fix-crash-with-unaligned-relocated.patch new file mode 100644 index 00000000000..4d73c1fd6e4 --- /dev/null +++ b/queue-5.15/powerpc-64s-radix-fix-crash-with-unaligned-relocated.patch @@ -0,0 +1,112 @@ +From c4e68eb9d98d9c8136d5254daae2749186717da1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 23:47:52 +1100 +Subject: powerpc/64s/radix: Fix crash with unaligned relocated kernel + +From: Michael Ellerman + +[ Upstream commit 98d0219e043e09013e883eacde3b93e0b2bf944d ] + +If a relocatable kernel is loaded at an address that is not 2MB aligned +and told not to relocate to zero, the kernel can crash due to +mark_rodata_ro() incorrectly changing some read-write data to read-only. + +Scenarios where the misalignment can occur are when the kernel is +loaded by kdump or using the RELOCATABLE_TEST config option. + +Example crash with the kernel loaded at 5MB: + + Run /sbin/init as init process + BUG: Unable to handle kernel data access on write at 0xc000000000452000 + Faulting instruction address: 0xc0000000005b6730 + Oops: Kernel access of bad area, sig: 11 [#1] + LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries + CPU: 1 PID: 1 Comm: init Not tainted 6.2.0-rc1-00011-g349188be4841 #166 + Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,git-5b4c5a hv:linux,kvm pSeries + NIP: c0000000005b6730 LR: c000000000ae9ab8 CTR: 0000000000000380 + REGS: c000000004503250 TRAP: 0300 Not tainted (6.2.0-rc1-00011-g349188be4841) + MSR: 8000000000009033 CR: 44288480 XER: 00000000 + CFAR: c0000000005b66ec DAR: c000000000452000 DSISR: 0a000000 IRQMASK: 0 + ... + NIP memset+0x68/0x104 + LR zero_user_segments.constprop.0+0xa8/0xf0 + Call Trace: + ext4_mpage_readpages+0x7f8/0x830 + ext4_readahead+0x48/0x60 + read_pages+0xb8/0x380 + page_cache_ra_unbounded+0x19c/0x250 + filemap_fault+0x58c/0xae0 + __do_fault+0x60/0x100 + __handle_mm_fault+0x1230/0x1a40 + handle_mm_fault+0x120/0x300 + ___do_page_fault+0x20c/0xa80 + do_page_fault+0x30/0xc0 + data_access_common_virt+0x210/0x220 + +This happens because mark_rodata_ro() tries to change permissions on the +range _stext..__end_rodata, but _stext sits in the middle of the 2MB +page from 4MB to 6MB: + + radix-mmu: Mapped 0x0000000000000000-0x0000000000200000 with 2.00 MiB pages (exec) + radix-mmu: Mapped 0x0000000000200000-0x0000000000400000 with 2.00 MiB pages + radix-mmu: Mapped 0x0000000000400000-0x0000000002400000 with 2.00 MiB pages (exec) + +The logic that changes the permissions assumes the linear mapping was +split correctly at boot, so it marks the entire 2MB page read-only. That +leads to the write fault above. + +To fix it, the boot time mapping logic needs to consider that if the +kernel is running at a non-zero address then _stext is a boundary where +it must split the mapping. + +That leads to the mapping being split correctly, allowing the rodata +permission change to take happen correctly, with no spillover: + + radix-mmu: Mapped 0x0000000000000000-0x0000000000200000 with 2.00 MiB pages (exec) + radix-mmu: Mapped 0x0000000000200000-0x0000000000400000 with 2.00 MiB pages + radix-mmu: Mapped 0x0000000000400000-0x0000000000500000 with 64.0 KiB pages + radix-mmu: Mapped 0x0000000000500000-0x0000000000600000 with 64.0 KiB pages (exec) + radix-mmu: Mapped 0x0000000000600000-0x0000000002400000 with 2.00 MiB pages (exec) + +If the kernel is loaded at a 2MB aligned address, the mapping continues +to use 2MB pages as before: + + radix-mmu: Mapped 0x0000000000000000-0x0000000000200000 with 2.00 MiB pages (exec) + radix-mmu: Mapped 0x0000000000200000-0x0000000000400000 with 2.00 MiB pages + radix-mmu: Mapped 0x0000000000400000-0x0000000002c00000 with 2.00 MiB pages (exec) + radix-mmu: Mapped 0x0000000002c00000-0x0000000100000000 with 2.00 MiB pages + +Fixes: c55d7b5e6426 ("powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE") +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20230110124753.1325426-1-mpe@ellerman.id.au +Stable-dep-of: 111bcb373853 ("powerpc/64s/radix: Fix RWX mapping with relocated kernel") +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/book3s64/radix_pgtable.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c +index 52e27fd995da7..b848f9e9f6335 100644 +--- a/arch/powerpc/mm/book3s64/radix_pgtable.c ++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c +@@ -260,6 +260,17 @@ print_mapping(unsigned long start, unsigned long end, unsigned long size, bool e + static unsigned long next_boundary(unsigned long addr, unsigned long end) + { + #ifdef CONFIG_STRICT_KERNEL_RWX ++ unsigned long stext_phys; ++ ++ stext_phys = __pa_symbol(_stext); ++ ++ // Relocatable kernel running at non-zero real address ++ if (stext_phys != 0) { ++ // Start of relocated kernel text is a rodata boundary ++ if (addr < stext_phys) ++ return stext_phys; ++ } ++ + if (addr < __pa_symbol(__srwx_boundary)) + return __pa_symbol(__srwx_boundary); + #endif +-- +2.39.0 + diff --git a/queue-5.15/powerpc-64s-radix-fix-rwx-mapping-with-relocated-ker.patch b/queue-5.15/powerpc-64s-radix-fix-rwx-mapping-with-relocated-ker.patch new file mode 100644 index 00000000000..84096a774d4 --- /dev/null +++ b/queue-5.15/powerpc-64s-radix-fix-rwx-mapping-with-relocated-ker.patch @@ -0,0 +1,89 @@ +From 13185fb826103932ea171e13278df67b419bbaa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 23:47:53 +1100 +Subject: powerpc/64s/radix: Fix RWX mapping with relocated kernel + +From: Michael Ellerman + +[ Upstream commit 111bcb37385353f0510e5847d5abcd1c613dba23 ] + +If a relocatable kernel is loaded at a non-zero address and told not to +relocate to zero (kdump or RELOCATABLE_TEST), the mapping of the +interrupt code at zero is left with RWX permissions. + +That is a security weakness, and leads to a warning at boot if +CONFIG_DEBUG_WX is enabled: + + powerpc/mm: Found insecure W+X mapping at address 00000000056435bc/0xc000000000000000 + WARNING: CPU: 1 PID: 1 at arch/powerpc/mm/ptdump/ptdump.c:193 note_page+0x484/0x4c0 + CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.2.0-rc1-00001-g8ae8e98aea82-dirty #175 + Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,git-dd0dca hv:linux,kvm pSeries + NIP: c0000000004a1c34 LR: c0000000004a1c30 CTR: 0000000000000000 + REGS: c000000003503770 TRAP: 0700 Not tainted (6.2.0-rc1-00001-g8ae8e98aea82-dirty) + MSR: 8000000002029033 CR: 24000220 XER: 00000000 + CFAR: c000000000545a58 IRQMASK: 0 + ... + NIP note_page+0x484/0x4c0 + LR note_page+0x480/0x4c0 + Call Trace: + note_page+0x480/0x4c0 (unreliable) + ptdump_pmd_entry+0xc8/0x100 + walk_pgd_range+0x618/0xab0 + walk_page_range_novma+0x74/0xc0 + ptdump_walk_pgd+0x98/0x170 + ptdump_check_wx+0x94/0x100 + mark_rodata_ro+0x30/0x70 + kernel_init+0x78/0x1a0 + ret_from_kernel_thread+0x5c/0x64 + +The fix has two parts. Firstly the pages from zero up to the end of +interrupts need to be marked read-only, so that they are left with R-X +permissions. Secondly the mapping logic needs to be taught to ensure +there is a page boundary at the end of the interrupt region, so that the +permission change only applies to the interrupt text, and not the region +following it. + +Fixes: c55d7b5e6426 ("powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE") +Reported-by: Sachin Sant +Tested-by: Sachin Sant +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20230110124753.1325426-2-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/book3s64/radix_pgtable.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c +index b848f9e9f6335..feb24313e2e3c 100644 +--- a/arch/powerpc/mm/book3s64/radix_pgtable.c ++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c +@@ -232,6 +232,14 @@ void radix__mark_rodata_ro(void) + end = (unsigned long)__init_begin; + + radix__change_memory_range(start, end, _PAGE_WRITE); ++ ++ for (start = PAGE_OFFSET; start < (unsigned long)_stext; start += PAGE_SIZE) { ++ end = start + PAGE_SIZE; ++ if (overlaps_interrupt_vector_text(start, end)) ++ radix__change_memory_range(start, end, _PAGE_WRITE); ++ else ++ break; ++ } + } + + void radix__mark_initmem_nx(void) +@@ -266,6 +274,11 @@ static unsigned long next_boundary(unsigned long addr, unsigned long end) + + // Relocatable kernel running at non-zero real address + if (stext_phys != 0) { ++ // The end of interrupts code at zero is a rodata boundary ++ unsigned long end_intr = __pa_symbol(__end_interrupts) - stext_phys; ++ if (addr < end_intr) ++ return end_intr; ++ + // Start of relocated kernel text is a rodata boundary + if (addr < stext_phys) + return stext_phys; +-- +2.39.0 + diff --git a/queue-5.15/powerpc-dts-t208x-disable-10g-on-mac1-and-mac2.patch b/queue-5.15/powerpc-dts-t208x-disable-10g-on-mac1-and-mac2.patch new file mode 100644 index 00000000000..1a6bfbaecdf --- /dev/null +++ b/queue-5.15/powerpc-dts-t208x-disable-10g-on-mac1-and-mac2.patch @@ -0,0 +1,51 @@ +From 12d86ff65cf0ddf21cf8139a4b6cf8032a03888e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 12:29:37 -0500 +Subject: powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 + +From: Sean Anderson + +[ Upstream commit 8d8bee13ae9e316443c6666286360126a19c8d94 ] + +There aren't enough resources to run these ports at 10G speeds. Disable +10G for these ports, reverting to the previous speed. + +Fixes: 36926a7d70c2 ("powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G") +Reported-by: Camelia Alexandra Groza +Signed-off-by: Sean Anderson +Reviewed-by: Camelia Groza +Tested-by: Camelia Groza +Link: https://lore.kernel.org/r/20221216172937.2960054-1-sean.anderson@seco.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +index 74e17e134387d..27714dc2f04a5 100644 +--- a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +@@ -659,3 +659,19 @@ + interrupts = <16 2 1 9>; + }; + }; ++ ++&fman0_rx_0x08 { ++ /delete-property/ fsl,fman-10g-port; ++}; ++ ++&fman0_tx_0x28 { ++ /delete-property/ fsl,fman-10g-port; ++}; ++ ++&fman0_rx_0x09 { ++ /delete-property/ fsl,fman-10g-port; ++}; ++ ++&fman0_tx_0x29 { ++ /delete-property/ fsl,fman-10g-port; ++}; +-- +2.39.0 + diff --git a/queue-5.15/powerpc-dts-t208x-mark-mac1-and-mac2-as-10g.patch b/queue-5.15/powerpc-dts-t208x-mark-mac1-and-mac2-as-10g.patch new file mode 100644 index 00000000000..94532043b5b --- /dev/null +++ b/queue-5.15/powerpc-dts-t208x-mark-mac1-and-mac2-as-10g.patch @@ -0,0 +1,142 @@ +From e91c80aff9d3ec1a0539cdca03c2c2d1130204fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 16:22:39 -0400 +Subject: powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G + +From: Sean Anderson + +[ Upstream commit 36926a7d70c2d462fca1ed85bfee000d17fd8662 ] + +On the T208X SoCs, MAC1 and MAC2 support XGMII. Add some new MAC dtsi +fragments, and mark the QMAN ports as 10G. + +Fixes: da414bb923d9 ("powerpc/mpc85xx: Add FSL QorIQ DPAA FMan support to the SoC device tree(s)") +Signed-off-by: Sean Anderson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi | 44 +++++++++++++++++++ + .../boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi | 44 +++++++++++++++++++ + arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 4 +- + 3 files changed, 90 insertions(+), 2 deletions(-) + create mode 100644 arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi + create mode 100644 arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi + +diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi +new file mode 100644 +index 0000000000000..437dab3fc0176 +--- /dev/null ++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi +@@ -0,0 +1,44 @@ ++// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0-or-later ++/* ++ * QorIQ FMan v3 10g port #2 device tree stub [ controller @ offset 0x400000 ] ++ * ++ * Copyright 2022 Sean Anderson ++ * Copyright 2012 - 2015 Freescale Semiconductor Inc. ++ */ ++ ++fman@400000 { ++ fman0_rx_0x08: port@88000 { ++ cell-index = <0x8>; ++ compatible = "fsl,fman-v3-port-rx"; ++ reg = <0x88000 0x1000>; ++ fsl,fman-10g-port; ++ }; ++ ++ fman0_tx_0x28: port@a8000 { ++ cell-index = <0x28>; ++ compatible = "fsl,fman-v3-port-tx"; ++ reg = <0xa8000 0x1000>; ++ fsl,fman-10g-port; ++ }; ++ ++ ethernet@e0000 { ++ cell-index = <0>; ++ compatible = "fsl,fman-memac"; ++ reg = <0xe0000 0x1000>; ++ fsl,fman-ports = <&fman0_rx_0x08 &fman0_tx_0x28>; ++ ptp-timer = <&ptp_timer0>; ++ pcsphy-handle = <&pcsphy0>; ++ }; ++ ++ mdio@e1000 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; ++ reg = <0xe1000 0x1000>; ++ fsl,erratum-a011043; /* must ignore read errors */ ++ ++ pcsphy0: ethernet-phy@0 { ++ reg = <0x0>; ++ }; ++ }; ++}; +diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi +new file mode 100644 +index 0000000000000..ad116b17850a8 +--- /dev/null ++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi +@@ -0,0 +1,44 @@ ++// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0-or-later ++/* ++ * QorIQ FMan v3 10g port #3 device tree stub [ controller @ offset 0x400000 ] ++ * ++ * Copyright 2022 Sean Anderson ++ * Copyright 2012 - 2015 Freescale Semiconductor Inc. ++ */ ++ ++fman@400000 { ++ fman0_rx_0x09: port@89000 { ++ cell-index = <0x9>; ++ compatible = "fsl,fman-v3-port-rx"; ++ reg = <0x89000 0x1000>; ++ fsl,fman-10g-port; ++ }; ++ ++ fman0_tx_0x29: port@a9000 { ++ cell-index = <0x29>; ++ compatible = "fsl,fman-v3-port-tx"; ++ reg = <0xa9000 0x1000>; ++ fsl,fman-10g-port; ++ }; ++ ++ ethernet@e2000 { ++ cell-index = <1>; ++ compatible = "fsl,fman-memac"; ++ reg = <0xe2000 0x1000>; ++ fsl,fman-ports = <&fman0_rx_0x09 &fman0_tx_0x29>; ++ ptp-timer = <&ptp_timer0>; ++ pcsphy-handle = <&pcsphy1>; ++ }; ++ ++ mdio@e3000 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; ++ reg = <0xe3000 0x1000>; ++ fsl,erratum-a011043; /* must ignore read errors */ ++ ++ pcsphy1: ethernet-phy@0 { ++ reg = <0x0>; ++ }; ++ }; ++}; +diff --git a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +index ecbb447920bc6..74e17e134387d 100644 +--- a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +@@ -609,8 +609,8 @@ + /include/ "qoriq-bman1.dtsi" + + /include/ "qoriq-fman3-0.dtsi" +-/include/ "qoriq-fman3-0-1g-0.dtsi" +-/include/ "qoriq-fman3-0-1g-1.dtsi" ++/include/ "qoriq-fman3-0-10g-2.dtsi" ++/include/ "qoriq-fman3-0-10g-3.dtsi" + /include/ "qoriq-fman3-0-1g-2.dtsi" + /include/ "qoriq-fman3-0-1g-3.dtsi" + /include/ "qoriq-fman3-0-1g-4.dtsi" +-- +2.39.0 + diff --git a/queue-5.15/powerpc-use-generic-version-of-arch_is_kernel_initme.patch b/queue-5.15/powerpc-use-generic-version-of-arch_is_kernel_initme.patch new file mode 100644 index 00000000000..d813b213c2c --- /dev/null +++ b/queue-5.15/powerpc-use-generic-version-of-arch_is_kernel_initme.patch @@ -0,0 +1,58 @@ +From de900445d6c15149b8b8e5f39f56bbd6b2b376f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 13:40:46 -0700 +Subject: powerpc: use generic version of arch_is_kernel_initmem_freed() + +From: Christophe Leroy + +[ Upstream commit e012a25d81a12fb332e862b51bfb59321acf96e4 ] + +The generic version of arch_is_kernel_initmem_freed() now does the same +as powerpc version. + +Remove the powerpc version. + +Link: https://lkml.kernel.org/r/c53764eb45d41491e2b21da2e7812239897dbebb.1633001016.git.christophe.leroy@csgroup.eu +Signed-off-by: Christophe Leroy +Cc: Kefeng Wang +Cc: Benjamin Herrenschmidt +Cc: Gerald Schaefer +Cc: Heiko Carstens +Cc: Paul Mackerras +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: 111bcb373853 ("powerpc/64s/radix: Fix RWX mapping with relocated kernel") +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/sections.h | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h +index 6e4af4492a144..79cb7a25a5fb6 100644 +--- a/arch/powerpc/include/asm/sections.h ++++ b/arch/powerpc/include/asm/sections.h +@@ -6,21 +6,8 @@ + #include + #include + +-#define arch_is_kernel_initmem_freed arch_is_kernel_initmem_freed +- + #include + +-extern bool init_mem_is_free; +- +-static inline int arch_is_kernel_initmem_freed(unsigned long addr) +-{ +- if (!init_mem_is_free) +- return 0; +- +- return addr >= (unsigned long)__init_begin && +- addr < (unsigned long)__init_end; +-} +- + extern char __head_end[]; + + #ifdef __powerpc64__ +-- +2.39.0 + diff --git a/queue-5.15/powerpc-vmlinux.lds-add-an-explicit-symbol-for-the-s.patch b/queue-5.15/powerpc-vmlinux.lds-add-an-explicit-symbol-for-the-s.patch new file mode 100644 index 00000000000..705608be236 --- /dev/null +++ b/queue-5.15/powerpc-vmlinux.lds-add-an-explicit-symbol-for-the-s.patch @@ -0,0 +1,94 @@ +From f7674516e7c87e7435f4f4a4f9178c8bbb84f0d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 14:41:24 +1000 +Subject: powerpc/vmlinux.lds: Add an explicit symbol for the SRWX boundary + +From: Michael Ellerman + +[ Upstream commit b150a4d12b919baf956b807aa305cf78df03d0fe ] + +Currently __init_begin is used as the boundary for strict RWX between +executable/read-only text and data, and non-executable (after boot) code +and data. + +But that's a little subtle, so add an explicit symbol to document that +the SRWX boundary lies there, and add a comment making it clear that +__init_begin must also begin there. + +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220916131422.318752-2-mpe@ellerman.id.au +Stable-dep-of: 111bcb373853 ("powerpc/64s/radix: Fix RWX mapping with relocated kernel") +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/sections.h | 1 + + arch/powerpc/kernel/vmlinux.lds.S | 9 +++++++-- + arch/powerpc/mm/book3s32/mmu.c | 2 +- + arch/powerpc/mm/book3s64/radix_pgtable.c | 4 ++-- + 4 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h +index 79cb7a25a5fb6..e92d39c0cd1d9 100644 +--- a/arch/powerpc/include/asm/sections.h ++++ b/arch/powerpc/include/asm/sections.h +@@ -9,6 +9,7 @@ + #include + + extern char __head_end[]; ++extern char __srwx_boundary[]; + + #ifdef __powerpc64__ + +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index bcbe41c6998ca..a664d0c4344a9 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -208,11 +208,16 @@ SECTIONS + } + #endif + ++ /* ++ * Various code relies on __init_begin being at the strict RWX boundary. ++ */ ++ . = ALIGN(STRICT_ALIGN_SIZE); ++ __srwx_boundary = .; ++ __init_begin = .; ++ + /* + * Init sections discarded at runtime + */ +- . = ALIGN(STRICT_ALIGN_SIZE); +- __init_begin = .; + .init.text : AT(ADDR(.init.text) - LOAD_OFFSET) { + _sinittext = .; + INIT_TEXT +diff --git a/arch/powerpc/mm/book3s32/mmu.c b/arch/powerpc/mm/book3s32/mmu.c +index bfca0afe91126..692c336e4f55b 100644 +--- a/arch/powerpc/mm/book3s32/mmu.c ++++ b/arch/powerpc/mm/book3s32/mmu.c +@@ -159,7 +159,7 @@ static unsigned long __init __mmu_mapin_ram(unsigned long base, unsigned long to + unsigned long __init mmu_mapin_ram(unsigned long base, unsigned long top) + { + unsigned long done; +- unsigned long border = (unsigned long)__init_begin - PAGE_OFFSET; ++ unsigned long border = (unsigned long)__srwx_boundary - PAGE_OFFSET; + unsigned long size; + + size = roundup_pow_of_two((unsigned long)_einittext - PAGE_OFFSET); +diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c +index a339cb5de5dd1..52e27fd995da7 100644 +--- a/arch/powerpc/mm/book3s64/radix_pgtable.c ++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c +@@ -260,8 +260,8 @@ print_mapping(unsigned long start, unsigned long end, unsigned long size, bool e + static unsigned long next_boundary(unsigned long addr, unsigned long end) + { + #ifdef CONFIG_STRICT_KERNEL_RWX +- if (addr < __pa_symbol(__init_begin)) +- return __pa_symbol(__init_begin); ++ if (addr < __pa_symbol(__srwx_boundary)) ++ return __pa_symbol(__srwx_boundary); + #endif + return end; + } +-- +2.39.0 + diff --git a/queue-5.15/powerpc-vmlinux.lds-ensure-strict_align_size-is-at-l.patch b/queue-5.15/powerpc-vmlinux.lds-ensure-strict_align_size-is-at-l.patch new file mode 100644 index 00000000000..a8711c42a5d --- /dev/null +++ b/queue-5.15/powerpc-vmlinux.lds-ensure-strict_align_size-is-at-l.patch @@ -0,0 +1,49 @@ +From df165b0f69a04c36a4cd4cc6061e587d7f0708d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 14:40:57 +1000 +Subject: powerpc/vmlinux.lds: Ensure STRICT_ALIGN_SIZE is at least page + aligned + +From: Michael Ellerman + +[ Upstream commit 331771e836e6a32c8632d8cf5e2cdd94471258ad ] + +Add a check that STRICT_ALIGN_SIZE is aligned to at least PAGE_SIZE. + +That then makes the alignment to PAGE_SIZE immediately after the +alignment to STRICT_ALIGN_SIZE redundant, so remove it. + +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220916131422.318752-1-mpe@ellerman.id.au +Stable-dep-of: 111bcb373853 ("powerpc/64s/radix: Fix RWX mapping with relocated kernel") +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/vmlinux.lds.S | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 1a63e37f336ab..bcbe41c6998ca 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -32,6 +32,10 @@ + + #define STRICT_ALIGN_SIZE (1 << CONFIG_DATA_SHIFT) + ++#if STRICT_ALIGN_SIZE < PAGE_SIZE ++#error "CONFIG_DATA_SHIFT must be >= PAGE_SHIFT" ++#endif ++ + ENTRY(_stext) + + PHDRS { +@@ -209,7 +213,6 @@ SECTIONS + */ + . = ALIGN(STRICT_ALIGN_SIZE); + __init_begin = .; +- . = ALIGN(PAGE_SIZE); + .init.text : AT(ADDR(.init.text) - LOAD_OFFSET) { + _sinittext = .; + INIT_TEXT +-- +2.39.0 + diff --git a/queue-5.15/random-always-mix-cycle-counter-in-add_latent_entrop.patch b/queue-5.15/random-always-mix-cycle-counter-in-add_latent_entrop.patch new file mode 100644 index 00000000000..5eacd218b23 --- /dev/null +++ b/queue-5.15/random-always-mix-cycle-counter-in-add_latent_entrop.patch @@ -0,0 +1,61 @@ +From 05215768333434e1ebb98c65f0148b96de7f70c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 22:45:33 +0200 +Subject: random: always mix cycle counter in add_latent_entropy() + +From: Jason A. Donenfeld + +[ Upstream commit d7bf7f3b813e3755226bcb5114ad2ac477514ebf ] + +add_latent_entropy() is called every time a process forks, in +kernel_clone(). This in turn calls add_device_randomness() using the +latent entropy global state. add_device_randomness() does two things: + + 2) Mixes into the input pool the latent entropy argument passed; and + 1) Mixes in a cycle counter, a sort of measurement of when the event + took place, the high precision bits of which are presumably + difficult to predict. + +(2) is impossible without CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y. But (1) is +always possible. However, currently CONFIG_GCC_PLUGIN_LATENT_ENTROPY=n +disables both (1) and (2), instead of just (2). + +This commit causes the CONFIG_GCC_PLUGIN_LATENT_ENTROPY=n case to still +do (1) by passing NULL (len 0) to add_device_randomness() when add_latent_ +entropy() is called. + +Cc: Dominik Brodowski +Cc: PaX Team +Cc: Emese Revfy +Fixes: 38addce8b600 ("gcc-plugins: Add latent_entropy plugin") +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Sasha Levin +--- + include/linux/random.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/random.h b/include/linux/random.h +index 3feafab498ad9..ed75fb2b0ca94 100644 +--- a/include/linux/random.h ++++ b/include/linux/random.h +@@ -19,14 +19,14 @@ void add_input_randomness(unsigned int type, unsigned int code, + void add_interrupt_randomness(int irq) __latent_entropy; + void add_hwgenerator_randomness(const void *buf, size_t len, size_t entropy); + +-#if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__) + static inline void add_latent_entropy(void) + { ++#if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__) + add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy)); +-} + #else +-static inline void add_latent_entropy(void) { } ++ add_device_randomness(NULL, 0); + #endif ++} + + void get_random_bytes(void *buf, size_t len); + size_t __must_check get_random_bytes_arch(void *buf, size_t len); +-- +2.39.0 + diff --git a/queue-5.15/revert-netfilter-conntrack-fix-bug-in-for_each_sctp_.patch b/queue-5.15/revert-netfilter-conntrack-fix-bug-in-for_each_sctp_.patch new file mode 100644 index 00000000000..576c7530ba0 --- /dev/null +++ b/queue-5.15/revert-netfilter-conntrack-fix-bug-in-for_each_sctp_.patch @@ -0,0 +1,44 @@ +From 4150cc92b62d2b9c9b8fd3adcc751f6c91a11741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 02:35:21 +0100 +Subject: Revert "netfilter: conntrack: fix bug in for_each_sctp_chunk" + +From: Florian Westphal + +[ Upstream commit bd0e06f0def75ba26572a94e5350324474a55562 ] + +There is no bug. If sch->length == 0, this would result in an infinite +loop, but first caller, do_basic_checks(), errors out in this case. + +After this change, packets with bogus zero-length chunks are no longer +detected as invalid, so revert & add comment wrt. 0 length check. + +Fixes: 98ee00774525 ("netfilter: conntrack: fix bug in for_each_sctp_chunk") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_sctp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c +index 444f02271b36a..490b11192e8aa 100644 +--- a/net/netfilter/nf_conntrack_proto_sctp.c ++++ b/net/netfilter/nf_conntrack_proto_sctp.c +@@ -142,10 +142,11 @@ static void sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct) + } + #endif + ++/* do_basic_checks ensures sch->length > 0, do not use before */ + #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count) \ + for ((offset) = (dataoff) + sizeof(struct sctphdr), (count) = 0; \ +- ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))) && \ +- (sch)->length; \ ++ (offset) < (skb)->len && \ ++ ((sch) = skb_header_pointer((skb), (offset), sizeof(_sch), &(_sch))); \ + (offset) += (ntohs((sch)->length) + 3) & ~3, (count)++) + + /* Some validity checks to make sure the chunks are fine */ +-- +2.39.0 + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..75e8c98ae27 --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,22 @@ +drm-etnaviv-don-t-truncate-physical-page-address.patch +wifi-rtl8xxxu-gen2-turn-on-the-rate-control.patch +drm-edid-fix-minimum-bpc-supported-with-dsc1.2-for-h.patch +clk-mxl-switch-from-direct-readl-writel-based-io-to-.patch +clk-mxl-remove-redundant-spinlocks.patch +clk-mxl-add-option-to-override-gate-clks.patch +clk-mxl-fix-a-clk-entry-by-adding-relevant-flags.patch +powerpc-dts-t208x-mark-mac1-and-mac2-as-10g.patch +clk-mxl-syscon_node_to_regmap-returns-error-pointers.patch +random-always-mix-cycle-counter-in-add_latent_entrop.patch +kvm-x86-fail-emulation-during-emultype_skip-on-any-e.patch +kvm-svm-skip-wrmsr-fastpath-on-vm-exit-if-next-rip-i.patch +kvm-vmx-execute-ibpb-on-emulated-vm-exit-when-guest-.patch +can-kvaser_usb-hydra-help-gcc-13-to-figure-out-cmd_l.patch +powerpc-dts-t208x-disable-10g-on-mac1-and-mac2.patch +netfilter-conntrack-fix-bug-in-for_each_sctp_chunk.patch +powerpc-use-generic-version-of-arch_is_kernel_initme.patch +powerpc-vmlinux.lds-ensure-strict_align_size-is-at-l.patch +powerpc-vmlinux.lds-add-an-explicit-symbol-for-the-s.patch +powerpc-64s-radix-fix-crash-with-unaligned-relocated.patch +powerpc-64s-radix-fix-rwx-mapping-with-relocated-ker.patch +revert-netfilter-conntrack-fix-bug-in-for_each_sctp_.patch diff --git a/queue-5.15/wifi-rtl8xxxu-gen2-turn-on-the-rate-control.patch b/queue-5.15/wifi-rtl8xxxu-gen2-turn-on-the-rate-control.patch new file mode 100644 index 00000000000..e31358d127d --- /dev/null +++ b/queue-5.15/wifi-rtl8xxxu-gen2-turn-on-the-rate-control.patch @@ -0,0 +1,69 @@ +From b18124a70567513867f40868546c86be91bd59fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Sep 2022 23:36:51 +0300 +Subject: wifi: rtl8xxxu: gen2: Turn on the rate control + +From: Bitterblue Smith + +[ Upstream commit 791082ec0ab843e0be07c8ce3678e4c2afd2e33d ] + +Re-enable the function rtl8xxxu_gen2_report_connect. + +It informs the firmware when connecting to a network. This makes the +firmware enable the rate control, which makes the upload faster. + +It also informs the firmware when disconnecting from a network. In the +past this made reconnecting impossible because it was sending the +auth on queue 0x7 (TXDESC_QUEUE_VO) instead of queue 0x12 +(TXDESC_QUEUE_MGNT): + +wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 1/3) +wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 2/3) +wlp0s20f0u3: send auth to 90:55:de:__:__:__ (try 3/3) +wlp0s20f0u3: authentication with 90:55:de:__:__:__ timed out + +Probably the firmware disables the unnecessary TX queues when it +knows it's disconnected. + +However, this was fixed in commit edd5747aa12e ("wifi: rtl8xxxu: Fix +skb misuse in TX queue selection"). + +Fixes: c59f13bbead4 ("rtl8xxxu: Work around issue with 8192eu and 8723bu devices not reconnecting") +Signed-off-by: Bitterblue Smith +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/43200afc-0c65-ee72-48f8-231edd1df493@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 7370d92a3bdad..3d3fa2b616a86 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -4369,12 +4369,9 @@ void rtl8xxxu_gen1_report_connect(struct rtl8xxxu_priv *priv, + void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv, + u8 macid, bool connect) + { +-#ifdef RTL8XXXU_GEN2_REPORT_CONNECT + /* +- * Barry Day reports this causes issues with 8192eu and 8723bu +- * devices reconnecting. The reason for this is unclear, but +- * until it is better understood, leave the code in place but +- * disabled, so it is not lost. ++ * The firmware turns on the rate control when it knows it's ++ * connected to a network. + */ + struct h2c_cmd h2c; + +@@ -4387,7 +4384,6 @@ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv, + h2c.media_status_rpt.parm &= ~BIT(0); + + rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.media_status_rpt)); +-#endif + } + + void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv) +-- +2.39.0 +