From: Sasha Levin Date: Tue, 24 Jan 2023 11:21:58 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v5.10.166~99 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4b77bc538a6e70eb3ffcf4c7e6c48727780c9b45;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/acpi-resource-skip-irq-override-on-asus-expertbook-b.patch b/queue-6.1/acpi-resource-skip-irq-override-on-asus-expertbook-b.patch new file mode 100644 index 00000000000..0ad1112cbc7 --- /dev/null +++ b/queue-6.1/acpi-resource-skip-irq-override-on-asus-expertbook-b.patch @@ -0,0 +1,45 @@ +From 5ed33f6cd5ec2910a3f60a172a7962e762485ec4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Dec 2022 00:58:39 -0500 +Subject: ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA + +From: Tamim Khan + +[ Upstream commit 77c7248882385397cd7dffe9e1437f59f32ce2de ] + +Like the Asus Expertbook B2502CBA and various Asus Vivobook laptops, +the Asus Expertbook B2402CBA has an ACPI DSDT table that describes IRQ 1 +as ActiveLow while the kernel overrides it to Edge_High. This prevents the +keyboard from working. To fix this issue, add this laptop to the +skip_override_table so that the kernel does not override IRQ 1. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216864 +Tested-by: zelenat +Signed-off-by: Tamim Khan +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 16dcd31d124f..192d1784e409 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -432,6 +432,13 @@ static const struct dmi_system_id asus_laptop[] = { + DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"), + }, + }, ++ { ++ .ident = "Asus ExpertBook B2402CBA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "B2402CBA"), ++ }, ++ }, + { + .ident = "Asus ExpertBook B2502", + .matches = { +-- +2.39.0 + diff --git a/queue-6.1/affs-initialize-fsdata-in-affs_truncate.patch b/queue-6.1/affs-initialize-fsdata-in-affs_truncate.patch new file mode 100644 index 00000000000..6ff43f99199 --- /dev/null +++ b/queue-6.1/affs-initialize-fsdata-in-affs_truncate.patch @@ -0,0 +1,40 @@ +From b60e8040ac7ceb2c78271552429dcf9ecbef8953 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 13:49:30 +0100 +Subject: affs: initialize fsdata in affs_truncate() + +From: Alexander Potapenko + +[ Upstream commit eef034ac6690118c88f357b00e2b3239c9d8575d ] + +When aops->write_begin() does not initialize fsdata, KMSAN may report +an error passing the latter to aops->write_end(). + +Fix this by unconditionally initializing fsdata. + +Fixes: f2b6a16eb8f5 ("fs: affs convert to new aops") +Suggested-by: Eric Biggers +Signed-off-by: Alexander Potapenko +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/affs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/affs/file.c b/fs/affs/file.c +index cefa222f7881..8daeed31e1af 100644 +--- a/fs/affs/file.c ++++ b/fs/affs/file.c +@@ -880,7 +880,7 @@ affs_truncate(struct inode *inode) + if (inode->i_size > AFFS_I(inode)->mmu_private) { + struct address_space *mapping = inode->i_mapping; + struct page *page; +- void *fsdata; ++ void *fsdata = NULL; + loff_t isize = inode->i_size; + int res; + +-- +2.39.0 + diff --git a/queue-6.1/amd-xgbe-delay-an-timeout-during-kr-training.patch b/queue-6.1/amd-xgbe-delay-an-timeout-during-kr-training.patch new file mode 100644 index 00000000000..48a7a7aec61 --- /dev/null +++ b/queue-6.1/amd-xgbe-delay-an-timeout-during-kr-training.patch @@ -0,0 +1,100 @@ +From 3c53b5394578cb0e0c859363366558ee4c4dc7b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:58:52 +0530 +Subject: amd-xgbe: Delay AN timeout during KR training + +From: Raju Rangoju + +[ Upstream commit 926446ae24c03311a480fb96eb78f0ce7ea6d091 ] + +AN restart triggered during KR training not only aborts the KR training +process but also move the HW to unstable state. Driver has to wait upto +500ms or until the KR training is completed before restarting AN cycle. + +Fixes: 7c12aa08779c ("amd-xgbe: Move the PHY support into amd-xgbe") +Co-developed-by: Sudheesh Mavila +Signed-off-by: Sudheesh Mavila +Signed-off-by: Raju Rangoju +Acked-by: Shyam Sundar S K +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 24 +++++++++++++++++++++++ + drivers/net/ethernet/amd/xgbe/xgbe.h | 2 ++ + 2 files changed, 26 insertions(+) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 0c5c1b155683..43fdd111235a 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -496,6 +496,7 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata, + reg |= XGBE_KR_TRAINING_ENABLE; + reg |= XGBE_KR_TRAINING_START; + XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL, reg); ++ pdata->kr_start_time = jiffies; + + netif_dbg(pdata, link, pdata->netdev, + "KR training initiated\n"); +@@ -632,6 +633,8 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata) + + xgbe_switch_mode(pdata); + ++ pdata->an_result = XGBE_AN_READY; ++ + xgbe_an_restart(pdata); + + return XGBE_AN_INCOMPAT_LINK; +@@ -1275,9 +1278,30 @@ static bool xgbe_phy_aneg_done(struct xgbe_prv_data *pdata) + static void xgbe_check_link_timeout(struct xgbe_prv_data *pdata) + { + unsigned long link_timeout; ++ unsigned long kr_time; ++ int wait; + + link_timeout = pdata->link_check + (XGBE_LINK_TIMEOUT * HZ); + if (time_after(jiffies, link_timeout)) { ++ if ((xgbe_cur_mode(pdata) == XGBE_MODE_KR) && ++ pdata->phy.autoneg == AUTONEG_ENABLE) { ++ /* AN restart should not happen while KR training is in progress. ++ * The while loop ensures no AN restart during KR training, ++ * waits up to 500ms and AN restart is triggered only if KR ++ * training is failed. ++ */ ++ wait = XGBE_KR_TRAINING_WAIT_ITER; ++ while (wait--) { ++ kr_time = pdata->kr_start_time + ++ msecs_to_jiffies(XGBE_AN_MS_TIMEOUT); ++ if (time_after(jiffies, kr_time)) ++ break; ++ /* AN restart is not required, if AN result is COMPLETE */ ++ if (pdata->an_result == XGBE_AN_COMPLETE) ++ return; ++ usleep_range(10000, 11000); ++ } ++ } + netif_dbg(pdata, link, pdata->netdev, "AN link timeout\n"); + xgbe_phy_config_aneg(pdata); + } +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h +index 71f24cb47935..7a41367c437d 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h +@@ -290,6 +290,7 @@ + /* Auto-negotiation */ + #define XGBE_AN_MS_TIMEOUT 500 + #define XGBE_LINK_TIMEOUT 5 ++#define XGBE_KR_TRAINING_WAIT_ITER 50 + + #define XGBE_SGMII_AN_LINK_STATUS BIT(1) + #define XGBE_SGMII_AN_LINK_SPEED (BIT(2) | BIT(3)) +@@ -1280,6 +1281,7 @@ struct xgbe_prv_data { + unsigned int parallel_detect; + unsigned int fec_ability; + unsigned long an_start; ++ unsigned long kr_start_time; + enum xgbe_an_mode an_mode; + + /* I2C support */ +-- +2.39.0 + diff --git a/queue-6.1/amd-xgbe-tx-flow-ctrl-registers-are-h-w-ver-dependen.patch b/queue-6.1/amd-xgbe-tx-flow-ctrl-registers-are-h-w-ver-dependen.patch new file mode 100644 index 00000000000..fa8c8e62625 --- /dev/null +++ b/queue-6.1/amd-xgbe-tx-flow-ctrl-registers-are-h-w-ver-dependen.patch @@ -0,0 +1,89 @@ +From ebe4b6326f304abfc7cb31f0d6ccdc8b87d014da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:58:51 +0530 +Subject: amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent + +From: Raju Rangoju + +[ Upstream commit 579923d84b04abb6cd4cd1fd9974096a2dd1832b ] + +There is difference in the TX Flow Control registers (TFCR) between the +revisions of the hardware. The older revisions of hardware used to have +single register per queue. Whereas, the newer revision of hardware (from +ver 30H onwards) have one register per priority. + +Update the driver to use the TFCR based on the reported version of the +hardware. + +Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") +Co-developed-by: Ajith Nayak +Signed-off-by: Ajith Nayak +Signed-off-by: Raju Rangoju +Acked-by: Shyam Sundar S K +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c +index 3936543a74d8..4030d619e84f 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c +@@ -524,19 +524,28 @@ static void xgbe_disable_vxlan(struct xgbe_prv_data *pdata) + netif_dbg(pdata, drv, pdata->netdev, "VXLAN acceleration disabled\n"); + } + ++static unsigned int xgbe_get_fc_queue_count(struct xgbe_prv_data *pdata) ++{ ++ unsigned int max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES; ++ ++ /* From MAC ver 30H the TFCR is per priority, instead of per queue */ ++ if (XGMAC_GET_BITS(pdata->hw_feat.version, MAC_VR, SNPSVER) >= 0x30) ++ return max_q_count; ++ else ++ return min_t(unsigned int, pdata->tx_q_count, max_q_count); ++} ++ + static int xgbe_disable_tx_flow_control(struct xgbe_prv_data *pdata) + { +- unsigned int max_q_count, q_count; + unsigned int reg, reg_val; +- unsigned int i; ++ unsigned int i, q_count; + + /* Clear MTL flow control */ + for (i = 0; i < pdata->rx_q_count; i++) + XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, EHFC, 0); + + /* Clear MAC flow control */ +- max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES; +- q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count); ++ q_count = xgbe_get_fc_queue_count(pdata); + reg = MAC_Q0TFCR; + for (i = 0; i < q_count; i++) { + reg_val = XGMAC_IOREAD(pdata, reg); +@@ -553,9 +562,8 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata) + { + struct ieee_pfc *pfc = pdata->pfc; + struct ieee_ets *ets = pdata->ets; +- unsigned int max_q_count, q_count; + unsigned int reg, reg_val; +- unsigned int i; ++ unsigned int i, q_count; + + /* Set MTL flow control */ + for (i = 0; i < pdata->rx_q_count; i++) { +@@ -579,8 +587,7 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata) + } + + /* Set MAC flow control */ +- max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES; +- q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count); ++ q_count = xgbe_get_fc_queue_count(pdata); + reg = MAC_Q0TFCR; + for (i = 0; i < q_count; i++) { + reg_val = XGMAC_IOREAD(pdata, reg); +-- +2.39.0 + diff --git a/queue-6.1/arm-dts-at91-sam9x60-fix-the-ddr-clock-for-sam9x60.patch b/queue-6.1/arm-dts-at91-sam9x60-fix-the-ddr-clock-for-sam9x60.patch new file mode 100644 index 00000000000..1afb036ed0c --- /dev/null +++ b/queue-6.1/arm-dts-at91-sam9x60-fix-the-ddr-clock-for-sam9x60.patch @@ -0,0 +1,36 @@ +From 34249885740787bd24e2609e120c1f7f534fe0c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 13:52:41 +0200 +Subject: ARM: dts: at91: sam9x60: fix the ddr clock for sam9x60 + +From: Claudiu Beznea + +[ Upstream commit 9bfa2544dbd1133f0b0af4e967de3bb9c1e3a497 ] + +The 2nd DDR clock for sam9x60 DDR controller is peripheral clock with +id 49. + +Fixes: 1e5f532c2737 ("ARM: dts: at91: sam9x60: add device tree for soc and board") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20221208115241.36312-1-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sam9x60.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sam9x60.dtsi b/arch/arm/boot/dts/sam9x60.dtsi +index 8f5477e307dd..37a5d96aaf64 100644 +--- a/arch/arm/boot/dts/sam9x60.dtsi ++++ b/arch/arm/boot/dts/sam9x60.dtsi +@@ -564,7 +564,7 @@ pmecc: ecc-engine@ffffe000 { + mpddrc: mpddrc@ffffe800 { + compatible = "microchip,sam9x60-ddramc", "atmel,sama5d3-ddramc"; + reg = <0xffffe800 0x200>; +- clocks = <&pmc PMC_TYPE_SYSTEM 2>, <&pmc PMC_TYPE_CORE PMC_MCK>; ++ clocks = <&pmc PMC_TYPE_SYSTEM 2>, <&pmc PMC_TYPE_PERIPHERAL 49>; + clock-names = "ddrck", "mpddr"; + }; + +-- +2.39.0 + diff --git a/queue-6.1/arm-dts-imx6qdl-gw560x-remove-incorrect-uart-has-rts.patch b/queue-6.1/arm-dts-imx6qdl-gw560x-remove-incorrect-uart-has-rts.patch new file mode 100644 index 00000000000..c228490db27 --- /dev/null +++ b/queue-6.1/arm-dts-imx6qdl-gw560x-remove-incorrect-uart-has-rts.patch @@ -0,0 +1,48 @@ +From 66753778e9ac111ef43c51f4359b29e1de6e0fa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 17:22:59 -0300 +Subject: ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' + +From: Fabio Estevam + +[ Upstream commit 9dfbc72256b5de608ad10989bcbafdbbd1ac8d4e ] + +The following build warning is seen when running: + +make dtbs_check DT_SCHEMA_FILES=fsl-imx-uart.yaml + +arch/arm/boot/dts/imx6dl-gw560x.dtb: serial@2020000: rts-gpios: False schema does not allow [[20, 1, 0]] + From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml + +The imx6qdl-gw560x board does not expose the UART RTS and CTS +as native UART pins, so 'uart-has-rtscts' should not be used. + +Using 'uart-has-rtscts' with 'rts-gpios' is an invalid combination +detected by serial.yaml. + +Fix the problem by removing the incorrect 'uart-has-rtscts' property. + +Fixes: b8a559feffb2 ("ARM: dts: imx: add Gateworks Ventana GW5600 support") +Signed-off-by: Fabio Estevam +Acked-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi +index 4bc4371e6bae..4b81a975c979 100644 +--- a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi +@@ -632,7 +632,6 @@ &ssi1 { + &uart1 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_uart1>; +- uart-has-rtscts; + rts-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>; + status = "okay"; + }; +-- +2.39.0 + diff --git a/queue-6.1/arm-dts-imx6ul-pico-dwarf-use-clock-frequency.patch b/queue-6.1/arm-dts-imx6ul-pico-dwarf-use-clock-frequency.patch new file mode 100644 index 00000000000..af0b4e7e5a9 --- /dev/null +++ b/queue-6.1/arm-dts-imx6ul-pico-dwarf-use-clock-frequency.patch @@ -0,0 +1,37 @@ +From a55339a471381c9785f711f3555e3a1e2d2f1cc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 13:31:23 -0300 +Subject: ARM: dts: imx6ul-pico-dwarf: Use 'clock-frequency' + +From: Fabio Estevam + +[ Upstream commit 94e2cf1e0db5b06c7a6ae0878c5cbec925819a8a ] + +'clock_frequency' is not a valid property. + +Use the correct 'clock-frequency' instead. + +Fixes: 47246fafef84 ("ARM: dts: imx6ul-pico: Add support for the dwarf baseboard") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ul-pico-dwarf.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6ul-pico-dwarf.dts b/arch/arm/boot/dts/imx6ul-pico-dwarf.dts +index 162dc259edc8..5a74c7f68eb6 100644 +--- a/arch/arm/boot/dts/imx6ul-pico-dwarf.dts ++++ b/arch/arm/boot/dts/imx6ul-pico-dwarf.dts +@@ -32,7 +32,7 @@ sys_mclk: clock-sys-mclk { + }; + + &i2c2 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c2>; + status = "okay"; +-- +2.39.0 + diff --git a/queue-6.1/arm-dts-imx7d-pico-use-clock-frequency.patch b/queue-6.1/arm-dts-imx7d-pico-use-clock-frequency.patch new file mode 100644 index 00000000000..5c2c86b3fce --- /dev/null +++ b/queue-6.1/arm-dts-imx7d-pico-use-clock-frequency.patch @@ -0,0 +1,70 @@ +From 69a122f098d9db45a3efcd67e57e1aec78516f31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 13:31:24 -0300 +Subject: ARM: dts: imx7d-pico: Use 'clock-frequency' + +From: Fabio Estevam + +[ Upstream commit f4dd0845c4f1f5371f1e06fef0e4a1734a2db964 ] + +'clock_frequency' is not a valid property. + +Use the correct 'clock-frequency' instead. + +Fixes: 8b646cfb84c3 ("ARM: dts: imx7d-pico: Add support for the dwarf baseboard") +Fixes: 6418fd92417f ("ARM: dts: imx7d-pico: Add support for the nymph baseboard") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7d-pico-dwarf.dts | 4 ++-- + arch/arm/boot/dts/imx7d-pico-nymph.dts | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/imx7d-pico-dwarf.dts b/arch/arm/boot/dts/imx7d-pico-dwarf.dts +index 5162fe227d1e..fdc10563f147 100644 +--- a/arch/arm/boot/dts/imx7d-pico-dwarf.dts ++++ b/arch/arm/boot/dts/imx7d-pico-dwarf.dts +@@ -32,7 +32,7 @@ sys_mclk: clock-sys-mclk { + }; + + &i2c1 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c1>; + status = "okay"; +@@ -52,7 +52,7 @@ pressure-sensor@60 { + }; + + &i2c4 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c1>; + status = "okay"; +diff --git a/arch/arm/boot/dts/imx7d-pico-nymph.dts b/arch/arm/boot/dts/imx7d-pico-nymph.dts +index 104a85254adb..5afb1674e012 100644 +--- a/arch/arm/boot/dts/imx7d-pico-nymph.dts ++++ b/arch/arm/boot/dts/imx7d-pico-nymph.dts +@@ -43,7 +43,7 @@ sys_mclk: clock-sys-mclk { + }; + + &i2c1 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c1>; + status = "okay"; +@@ -64,7 +64,7 @@ adc@52 { + }; + + &i2c2 { +- clock_frequency = <100000>; ++ clock-frequency = <100000>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_i2c2>; + status = "okay"; +-- +2.39.0 + diff --git a/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch b/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch new file mode 100644 index 00000000000..9e47bde1990 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch @@ -0,0 +1,47 @@ +From adb7222c3cd7169df7740dc2ab4cf65464674add Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 09:51:39 +0100 +Subject: ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcor-som + +From: Patrice Chotard + +[ Upstream commit 7ffd2266bd32d9f31a4e918443c733906cff0d19 ] + +Chip select pinctrl phandle was missing in several stm32mp15x based boards. + +Fixes: ea99a5a02ebc ("ARM: dts: stm32: Create separate pinmux for qspi cs pin in stm32mp15-pinctrl.dtsi") + +Signed-off-by: Patrice Chotard +Cc: Marek Vasut +Cc: Alexandre Torgue +Cc: linux-stm32@st-md-mailman.stormreply.com +Cc: linux-arm-kernel@lists.infradead.org +Reviewed-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi +index 134a798ad3f2..bb40fb46da81 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi +@@ -247,8 +247,12 @@ &pwr_regulators { + + &qspi { + pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&qspi_clk_pins_a &qspi_bk1_pins_a>; +- pinctrl-1 = <&qspi_clk_sleep_pins_a &qspi_bk1_sleep_pins_a>; ++ pinctrl-0 = <&qspi_clk_pins_a ++ &qspi_bk1_pins_a ++ &qspi_cs1_pins_a>; ++ pinctrl-1 = <&qspi_clk_sleep_pins_a ++ &qspi_bk1_sleep_pins_a ++ &qspi_cs1_sleep_pins_a>; + reg = <0x58003000 0x1000>, <0x70000000 0x200000>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.39.0 + diff --git a/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-10870 b/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-10870 new file mode 100644 index 00000000000..a0567573c7d --- /dev/null +++ b/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-10870 @@ -0,0 +1,47 @@ +From c6cd8141a10f07ddf8fa241a1af84b3b8618f0dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 09:51:41 +0100 +Subject: ARM: dts: stm32: Fix qspi pinctrl phandle for + stm32mp157c-emstamp-argon + +From: Patrice Chotard + +[ Upstream commit 732dbcf52f74b254a7ddd4226e0b9638e1e7aeff ] + +Chip select pinctrl phandle was missing in several stm32mp15x based boards. + +Fixes: ea99a5a02ebc ("ARM: dts: stm32: Create separate pinmux for qspi cs pin in stm32mp15-pinctrl.dtsi") + +Signed-off-by: Patrice Chotard +Cc: Reinhold Mueller +Cc: Alexandre Torgue +Cc: linux-stm32@st-md-mailman.stormreply.com +Cc: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +index 30156b7546ed..d540550f7da2 100644 +--- a/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi ++++ b/arch/arm/boot/dts/stm32mp157c-emstamp-argon.dtsi +@@ -391,8 +391,12 @@ &pwr_regulators { + + &qspi { + pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&qspi_clk_pins_a &qspi_bk1_pins_a>; +- pinctrl-1 = <&qspi_clk_sleep_pins_a &qspi_bk1_sleep_pins_a>; ++ pinctrl-0 = <&qspi_clk_pins_a ++ &qspi_bk1_pins_a ++ &qspi_cs1_pins_a>; ++ pinctrl-1 = <&qspi_clk_sleep_pins_a ++ &qspi_bk1_sleep_pins_a ++ &qspi_cs1_sleep_pins_a>; + reg = <0x58003000 0x1000>, <0x70000000 0x4000000>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.39.0 + diff --git a/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-13242 b/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-13242 new file mode 100644 index 00000000000..b13bc72c1b0 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-13242 @@ -0,0 +1,47 @@ +From 5e5b1b7c3cda36e2c1e2e737d676374aafc1c2b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 09:51:40 +0100 +Subject: ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp15xx-dhcom-som + +From: Patrice Chotard + +[ Upstream commit 21d83512bf2bd25ebed467151fd2bcd0cca7dc9a ] + +Chip select pinctrl phandle was missing in several stm32mp15x based boards. + +Fixes: ea99a5a02ebc ("ARM: dts: stm32: Create separate pinmux for qspi cs pin in stm32mp15-pinctrl.dtsi") + +Signed-off-by: Patrice Chotard +Cc: Marek Vasut +Cc: Alexandre Torgue +Cc: linux-stm32@st-md-mailman.stormreply.com +Cc: linux-arm-kernel@lists.infradead.org +Reviewed-by: Marek Vasut +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index 238a611192e7..d3b85a8764d7 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -428,8 +428,12 @@ &pwr_regulators { + + &qspi { + pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&qspi_clk_pins_a &qspi_bk1_pins_a>; +- pinctrl-1 = <&qspi_clk_sleep_pins_a &qspi_bk1_sleep_pins_a>; ++ pinctrl-0 = <&qspi_clk_pins_a ++ &qspi_bk1_pins_a ++ &qspi_cs1_pins_a>; ++ pinctrl-1 = <&qspi_clk_sleep_pins_a ++ &qspi_bk1_sleep_pins_a ++ &qspi_cs1_sleep_pins_a>; + reg = <0x58003000 0x1000>, <0x70000000 0x4000000>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.39.0 + diff --git a/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-20963 b/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-20963 new file mode 100644 index 00000000000..1dcb78ab2d3 --- /dev/null +++ b/queue-6.1/arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-20963 @@ -0,0 +1,46 @@ +From 47597c14a7d47c8736e3e13b16445b050ae0dff4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 09:51:42 +0100 +Subject: ARM: dts: stm32: Fix qspi pinctrl phandle for stm32mp151a-prtt1l + +From: Patrice Chotard + +[ Upstream commit 175281f80695569c7f9cf062e5d0ddc4addc109f ] + +Chip select pinctrl phandle was missing in several stm32mp15x based boards. + +Fixes: ea99a5a02ebc ("ARM: dts: stm32: Create separate pinmux for qspi cs pin in stm32mp15-pinctrl.dtsi") + +Signed-off-by: Patrice Chotard +Cc: Oleksij Rempel +Cc: Alexandre Torgue +Cc: linux-stm32@st-md-mailman.stormreply.com +Cc: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp151a-prtt1l.dtsi | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp151a-prtt1l.dtsi b/arch/arm/boot/dts/stm32mp151a-prtt1l.dtsi +index d865ab5d866b..dd23de85100c 100644 +--- a/arch/arm/boot/dts/stm32mp151a-prtt1l.dtsi ++++ b/arch/arm/boot/dts/stm32mp151a-prtt1l.dtsi +@@ -101,8 +101,12 @@ &iwdg2 { + + &qspi { + pinctrl-names = "default", "sleep"; +- pinctrl-0 = <&qspi_clk_pins_a &qspi_bk1_pins_a>; +- pinctrl-1 = <&qspi_clk_sleep_pins_a &qspi_bk1_sleep_pins_a>; ++ pinctrl-0 = <&qspi_clk_pins_a ++ &qspi_bk1_pins_a ++ &qspi_cs1_pins_a>; ++ pinctrl-1 = <&qspi_clk_sleep_pins_a ++ &qspi_bk1_sleep_pins_a ++ &qspi_cs1_sleep_pins_a>; + reg = <0x58003000 0x1000>, <0x70000000 0x4000000>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.39.0 + diff --git a/queue-6.1/arm-imx-add-missing-of_node_put.patch b/queue-6.1/arm-imx-add-missing-of_node_put.patch new file mode 100644 index 00000000000..30178644d1d --- /dev/null +++ b/queue-6.1/arm-imx-add-missing-of_node_put.patch @@ -0,0 +1,94 @@ +From 37f6dd206fd8ca009c996b245bcb4f8ef2520181 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 17:54:03 +0100 +Subject: ARM: imx: add missing of_node_put() + +From: Dario Binacchi + +[ Upstream commit 87b30c4b0efb6a194a7b8eac2568a3da520d905f ] + +Calling of_find_compatible_node() returns a node pointer with refcount +incremented. Use of_node_put() on it when done. +The patch fixes the same problem on different i.MX platforms. + +Fixes: 8b88f7ef31dde ("ARM: mx25: Retrieve IIM base from dt") +Fixes: 94b2bec1b0e05 ("ARM: imx27: Retrieve the SYSCTRL base address from devicetree") +Fixes: 3172225d45bd9 ("ARM: imx31: Retrieve the IIM base address from devicetree") +Fixes: f68ea682d1da7 ("ARM: imx35: Retrieve the IIM base address from devicetree") +Fixes: ee18a7154ee08 ("ARM: imx5: retrieve iim base from device tree") +Signed-off-by: Dario Binacchi +Reviewed-by: Fabio Estevam +Reviewed-by: Martin Kaiser +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/cpu-imx25.c | 1 + + arch/arm/mach-imx/cpu-imx27.c | 1 + + arch/arm/mach-imx/cpu-imx31.c | 1 + + arch/arm/mach-imx/cpu-imx35.c | 1 + + arch/arm/mach-imx/cpu-imx5.c | 1 + + 5 files changed, 5 insertions(+) + +diff --git a/arch/arm/mach-imx/cpu-imx25.c b/arch/arm/mach-imx/cpu-imx25.c +index 3e63445cde06..cc86977d0a34 100644 +--- a/arch/arm/mach-imx/cpu-imx25.c ++++ b/arch/arm/mach-imx/cpu-imx25.c +@@ -23,6 +23,7 @@ static int mx25_read_cpu_rev(void) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx25-iim"); + iim_base = of_iomap(np, 0); ++ of_node_put(np); + BUG_ON(!iim_base); + rev = readl(iim_base + MXC_IIMSREV); + iounmap(iim_base); +diff --git a/arch/arm/mach-imx/cpu-imx27.c b/arch/arm/mach-imx/cpu-imx27.c +index bf70e13bbe9e..1d2893908368 100644 +--- a/arch/arm/mach-imx/cpu-imx27.c ++++ b/arch/arm/mach-imx/cpu-imx27.c +@@ -28,6 +28,7 @@ static int mx27_read_cpu_rev(void) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx27-ccm"); + ccm_base = of_iomap(np, 0); ++ of_node_put(np); + BUG_ON(!ccm_base); + /* + * now we have access to the IO registers. As we need +diff --git a/arch/arm/mach-imx/cpu-imx31.c b/arch/arm/mach-imx/cpu-imx31.c +index b9c24b851d1a..35c544924e50 100644 +--- a/arch/arm/mach-imx/cpu-imx31.c ++++ b/arch/arm/mach-imx/cpu-imx31.c +@@ -39,6 +39,7 @@ static int mx31_read_cpu_rev(void) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx31-iim"); + iim_base = of_iomap(np, 0); ++ of_node_put(np); + BUG_ON(!iim_base); + + /* read SREV register from IIM module */ +diff --git a/arch/arm/mach-imx/cpu-imx35.c b/arch/arm/mach-imx/cpu-imx35.c +index 80e7d8ab9f1b..1fe75b39c2d9 100644 +--- a/arch/arm/mach-imx/cpu-imx35.c ++++ b/arch/arm/mach-imx/cpu-imx35.c +@@ -21,6 +21,7 @@ static int mx35_read_cpu_rev(void) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx35-iim"); + iim_base = of_iomap(np, 0); ++ of_node_put(np); + BUG_ON(!iim_base); + + rev = imx_readl(iim_base + MXC_IIMSREV); +diff --git a/arch/arm/mach-imx/cpu-imx5.c b/arch/arm/mach-imx/cpu-imx5.c +index ad56263778f9..a67c89bf155d 100644 +--- a/arch/arm/mach-imx/cpu-imx5.c ++++ b/arch/arm/mach-imx/cpu-imx5.c +@@ -28,6 +28,7 @@ static u32 imx5_read_srev_reg(const char *compat) + + np = of_find_compatible_node(NULL, NULL, compat); + iim_base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!iim_base); + + srev = readl(iim_base + IIM_SREV) & 0xff; +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8mm-beacon-fix-ecspi2-pinmux.patch b/queue-6.1/arm64-dts-imx8mm-beacon-fix-ecspi2-pinmux.patch new file mode 100644 index 00000000000..06c33edda24 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mm-beacon-fix-ecspi2-pinmux.patch @@ -0,0 +1,48 @@ +From 242c1832b033967810de125c0b123265e811928e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 13:10:37 -0600 +Subject: arm64: dts: imx8mm-beacon: Fix ecspi2 pinmux + +From: Adam Ford + +[ Upstream commit 5225ba9db112ec4ed67da5e4d8b72e618573955e ] + +Early hardware did not support hardware handshaking on the UART, but +final production hardware did. When the hardware was updated the chip +select was changed to facilitate hardware handshaking on UART3. Fix the +ecspi2 pin mux to eliminate a pin conflict with UART3 and allow the +EEPROM to operate again. + +Fixes: 4ce01ce36d77 ("arm64: dts: imx8mm-beacon: Enable RTS-CTS on UART3") +Signed-off-by: Adam Ford +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi +index 03266bd90a06..169f047fbca5 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-beacon-baseboard.dtsi +@@ -120,7 +120,7 @@ &csi { + &ecspi2 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_espi2>; +- cs-gpios = <&gpio5 9 GPIO_ACTIVE_LOW>; ++ cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>; + status = "okay"; + + eeprom@0 { +@@ -316,7 +316,7 @@ pinctrl_espi2: espi2grp { + MX8MM_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK 0x82 + MX8MM_IOMUXC_ECSPI2_MOSI_ECSPI2_MOSI 0x82 + MX8MM_IOMUXC_ECSPI2_MISO_ECSPI2_MISO 0x82 +- MX8MM_IOMUXC_ECSPI1_SS0_GPIO5_IO9 0x41 ++ MX8MM_IOMUXC_ECSPI2_SS0_GPIO5_IO13 0x41 + >; + }; + +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8mm-venice-gw7901-fix-usb2-controller-o.patch b/queue-6.1/arm64-dts-imx8mm-venice-gw7901-fix-usb2-controller-o.patch new file mode 100644 index 00000000000..c4bc3816f23 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mm-venice-gw7901-fix-usb2-controller-o.patch @@ -0,0 +1,35 @@ +From 1212137610c878a27ad4b63295108460bdf7799e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 12:26:06 -0800 +Subject: arm64: dts: imx8mm-venice-gw7901: fix USB2 controller OC polarity + +From: Tim Harvey + +[ Upstream commit ae066f374687d7dd06bb8c732f66d6ab3c3fd480 ] + +The GW7901 has USB2 routed to a USB VBUS supply with over-current +protection via an active-low pin. Define the OC pin polarity properly. + +Fixes: 2b1649a83afc ("arm64: dts: imx: Add i.mx8mm Gateworks gw7901 dts support") +Signed-off-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts +index d3ee6fc4baab..72311b55f06d 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts +@@ -759,6 +759,7 @@ &usbotg1 { + &usbotg2 { + dr_mode = "host"; + vbus-supply = <®_usb2_vbus>; ++ over-current-active-low; + status = "okay"; + }; + +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8mp-evk-pcie0-refclk-cosmetic-cleanup.patch b/queue-6.1/arm64-dts-imx8mp-evk-pcie0-refclk-cosmetic-cleanup.patch new file mode 100644 index 00000000000..858ddcb40c9 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mp-evk-pcie0-refclk-cosmetic-cleanup.patch @@ -0,0 +1,37 @@ +From 021453803bfd759c3f7b2db8e892f56b90dd9b45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Jan 2023 12:50:42 +0800 +Subject: arm64: dts: imx8mp-evk: pcie0-refclk cosmetic cleanup + +From: Marco Felsch + +[ Upstream commit 9a65c759e4666476a6642ad87b4db8a67cb957d0 ] + +Use the correct indention. + +Fixes: d50650500064 ("arm64: dts: imx8mp-evk: Add PCIe support") +Signed-off-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-evk.dts b/arch/arm64/boot/dts/freescale/imx8mp-evk.dts +index b4c1ef2559f2..126c839b45f2 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mp-evk.dts +@@ -36,8 +36,8 @@ memory@40000000 { + + pcie0_refclk: pcie0-refclk { + compatible = "fixed-clock"; +- #clock-cells = <0>; +- clock-frequency = <100000000>; ++ #clock-cells = <0>; ++ clock-frequency = <100000000>; + }; + + reg_can1_stby: regulator-can1-stby { +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8mp-fix-missing-gpc-interrupt.patch b/queue-6.1/arm64-dts-imx8mp-fix-missing-gpc-interrupt.patch new file mode 100644 index 00000000000..3db4c87c567 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mp-fix-missing-gpc-interrupt.patch @@ -0,0 +1,37 @@ +From 1d2cbf892b40f28b72e3fd254c7b2df43c16f59a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Dec 2022 12:08:48 -0600 +Subject: arm64: dts: imx8mp: Fix missing GPC Interrupt + +From: Adam Ford + +[ Upstream commit b3b75ace2085aca623c57e04ea7218ae690090fb ] + +The GPC node references an interrupt parent, but it doesn't +state the interrupt itself. According to the TRM, this IRQ +is 87. This also eliminate an error detected from dt_binding_check + +Fixes: fc0f05124621 ("arm64: dts: imx8mp: add GPC node with GPU power domains") +Signed-off-by: Adam Ford +Reviewed-by: Laurent Pinchart +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index d944ecca1b3c..4d06bb707a02 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -523,6 +523,7 @@ gpc: gpc@303a0000 { + compatible = "fsl,imx8mp-gpc"; + reg = <0x303a0000 0x1000>; + interrupt-parent = <&gic>; ++ interrupts = ; + interrupt-controller; + #interrupt-cells = <3>; + +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8mp-fix-power-domain-typo.patch b/queue-6.1/arm64-dts-imx8mp-fix-power-domain-typo.patch new file mode 100644 index 00000000000..94bd7c7deb4 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mp-fix-power-domain-typo.patch @@ -0,0 +1,40 @@ +From a3b59c1cbbecb443bd3cdb64d8e53a1874dff797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Dec 2022 12:08:49 -0600 +Subject: arm64: dts: imx8mp: Fix power-domain typo + +From: Adam Ford + +[ Upstream commit 10e2f328bd900787fd2db24e474f87e1d525ccc4 ] + +dt_binding_check detects an issue with the pgc_hsiomix power +domain: + pgc: 'power-domains@17' does not match any of the regexes + +This is because 'power-domains' should be 'power-domain' + +Fixes: 2ae42e0c0b67 ("arm64: dts: imx8mp: add HSIO power-domains") +Signed-off-by: Adam Ford +Reviewed-by: Laurent Pinchart +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 4d06bb707a02..47fd6a0ba05a 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -590,7 +590,7 @@ pgc_mipi_phy2: power-domain@16 { + reg = ; + }; + +- pgc_hsiomix: power-domains@17 { ++ pgc_hsiomix: power-domain@17 { + #power-domain-cells = <0>; + reg = ; + clocks = <&clk IMX8MP_CLK_HSIO_AXI>, +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx8mp-phycore-som-remove-invalid-pmic-pro.patch b/queue-6.1/arm64-dts-imx8mp-phycore-som-remove-invalid-pmic-pro.patch new file mode 100644 index 00000000000..0120d7ec0cc --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mp-phycore-som-remove-invalid-pmic-pro.patch @@ -0,0 +1,113 @@ +From e8faa7bc1cfa3af1ee158b745798ac7c07ff0cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 13:29:11 -0300 +Subject: arm64: dts: imx8mp-phycore-som: Remove invalid PMIC property + +From: Fabio Estevam + +[ Upstream commit cfd04dd1c4b6c33afc2a934b957d71cf8ddd1539 ] + +'regulator-compatible' is not a valid property according to +nxp,pca9450-regulator.yaml and causes the following warning: + + DTC_CHK arch/arm64/boot/dts/freescale/imx8mp-dhcom-pdk2.dtb +... +pmic@25: regulators:LDO1: Unevaluated properties are not allowed ('regulator-compatible' was unexpected) + +Remove the invalid 'regulator-compatible' property. + +Cc: Teresa Remmet +Fixes: 88f7f6bcca37 ("arm64: dts: freescale: Add support for phyBOARD-Pollux-i.MX8MP") +Signed-off-by: Fabio Estevam +Reviewed-by: Teresa Remmet +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi +index 79b290a002c1..ecc4bce6db97 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi +@@ -99,7 +99,6 @@ pmic: pmic@25 { + + regulators { + buck1: BUCK1 { +- regulator-compatible = "BUCK1"; + regulator-min-microvolt = <600000>; + regulator-max-microvolt = <2187500>; + regulator-boot-on; +@@ -108,7 +107,6 @@ buck1: BUCK1 { + }; + + buck2: BUCK2 { +- regulator-compatible = "BUCK2"; + regulator-min-microvolt = <600000>; + regulator-max-microvolt = <2187500>; + regulator-boot-on; +@@ -119,7 +117,6 @@ buck2: BUCK2 { + }; + + buck4: BUCK4 { +- regulator-compatible = "BUCK4"; + regulator-min-microvolt = <600000>; + regulator-max-microvolt = <3400000>; + regulator-boot-on; +@@ -127,7 +124,6 @@ buck4: BUCK4 { + }; + + buck5: BUCK5 { +- regulator-compatible = "BUCK5"; + regulator-min-microvolt = <600000>; + regulator-max-microvolt = <3400000>; + regulator-boot-on; +@@ -135,7 +131,6 @@ buck5: BUCK5 { + }; + + buck6: BUCK6 { +- regulator-compatible = "BUCK6"; + regulator-min-microvolt = <600000>; + regulator-max-microvolt = <3400000>; + regulator-boot-on; +@@ -143,7 +138,6 @@ buck6: BUCK6 { + }; + + ldo1: LDO1 { +- regulator-compatible = "LDO1"; + regulator-min-microvolt = <1600000>; + regulator-max-microvolt = <3300000>; + regulator-boot-on; +@@ -151,7 +145,6 @@ ldo1: LDO1 { + }; + + ldo2: LDO2 { +- regulator-compatible = "LDO2"; + regulator-min-microvolt = <800000>; + regulator-max-microvolt = <1150000>; + regulator-boot-on; +@@ -159,7 +152,6 @@ ldo2: LDO2 { + }; + + ldo3: LDO3 { +- regulator-compatible = "LDO3"; + regulator-min-microvolt = <800000>; + regulator-max-microvolt = <3300000>; + regulator-boot-on; +@@ -167,13 +159,11 @@ ldo3: LDO3 { + }; + + ldo4: LDO4 { +- regulator-compatible = "LDO4"; + regulator-min-microvolt = <800000>; + regulator-max-microvolt = <3300000>; + }; + + ldo5: LDO5 { +- regulator-compatible = "LDO5"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + regulator-boot-on; +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-imx93-11x11-evk-correct-clock-and-strobe-p.patch b/queue-6.1/arm64-dts-imx93-11x11-evk-correct-clock-and-strobe-p.patch new file mode 100644 index 00000000000..9c7e33a5b73 --- /dev/null +++ b/queue-6.1/arm64-dts-imx93-11x11-evk-correct-clock-and-strobe-p.patch @@ -0,0 +1,58 @@ +From 718e64e1799def2f4a53878f59dfdeae0095c42c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 17:06:58 +0800 +Subject: arm64: dts: imx93-11x11-evk: correct clock and strobe pad setting + +From: Haibo Chen + +[ Upstream commit 62f0147fd4d86620853bee027800f988d3013656 ] + +For clock and strobe pad of usdhc, need to config as pull down. +Current pad config set these pad as both pull up and pull down, +this is wrong, so fix it here. +Find this issue when enable HS400ES mode on one Micron eMMC chip, +CMD8 always meet CRC error in HS400ES/HS400 mode. + +Fixes: e37907bd8294 ("arm64: dts: freescale: add i.MX93 11x11 EVK basic support") +Signed-off-by: Haibo Chen +Reviewed-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts b/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts +index 69786c326db0..27f9a9f33134 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts +@@ -74,7 +74,7 @@ MX93_PAD_UART1_TXD__LPUART1_TX 0x31e + + pinctrl_usdhc1: usdhc1grp { + fsl,pins = < +- MX93_PAD_SD1_CLK__USDHC1_CLK 0x17fe ++ MX93_PAD_SD1_CLK__USDHC1_CLK 0x15fe + MX93_PAD_SD1_CMD__USDHC1_CMD 0x13fe + MX93_PAD_SD1_DATA0__USDHC1_DATA0 0x13fe + MX93_PAD_SD1_DATA1__USDHC1_DATA1 0x13fe +@@ -84,7 +84,7 @@ MX93_PAD_SD1_DATA4__USDHC1_DATA4 0x13fe + MX93_PAD_SD1_DATA5__USDHC1_DATA5 0x13fe + MX93_PAD_SD1_DATA6__USDHC1_DATA6 0x13fe + MX93_PAD_SD1_DATA7__USDHC1_DATA7 0x13fe +- MX93_PAD_SD1_STROBE__USDHC1_STROBE 0x17fe ++ MX93_PAD_SD1_STROBE__USDHC1_STROBE 0x15fe + >; + }; + +@@ -102,7 +102,7 @@ MX93_PAD_SD2_CD_B__GPIO3_IO00 0x31e + + pinctrl_usdhc2: usdhc2grp { + fsl,pins = < +- MX93_PAD_SD2_CLK__USDHC2_CLK 0x17fe ++ MX93_PAD_SD2_CLK__USDHC2_CLK 0x15fe + MX93_PAD_SD2_CMD__USDHC2_CMD 0x13fe + MX93_PAD_SD2_DATA0__USDHC2_DATA0 0x13fe + MX93_PAD_SD2_DATA1__USDHC2_DATA1 0x13fe +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-marvell-ac5-ac5x-fix-address-for-uart1.patch b/queue-6.1/arm64-dts-marvell-ac5-ac5x-fix-address-for-uart1.patch new file mode 100644 index 00000000000..07b36e605fe --- /dev/null +++ b/queue-6.1/arm64-dts-marvell-ac5-ac5x-fix-address-for-uart1.patch @@ -0,0 +1,35 @@ +From 565867aa71aef8f99506b798586839e0fd294934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 15:54:02 +1300 +Subject: arm64: dts: marvell: AC5/AC5X: Fix address for UART1 + +From: Chris Packham + +[ Upstream commit 80502ffab2fa92ba9777e381efea2efddc348d13 ] + +The correct address offset is 0x12100. + +Fixes: 31be791e26cf ("arm64: dts: marvell: Add UART1-3 for AC5/AC5X") +Signed-off-by: Chris Packham +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/ac5-98dx25xx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/marvell/ac5-98dx25xx.dtsi b/arch/arm64/boot/dts/marvell/ac5-98dx25xx.dtsi +index 44ed6f963b75..8e2ac687a410 100644 +--- a/arch/arm64/boot/dts/marvell/ac5-98dx25xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/ac5-98dx25xx.dtsi +@@ -97,7 +97,7 @@ uart0: serial@12000 { + + uart1: serial@12100 { + compatible = "snps,dw-apb-uart"; +- reg = <0x11000 0x100>; ++ reg = <0x12100 0x100>; + reg-shift = <2>; + interrupts = ; + reg-io-width = <1>; +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-qcom-msm8992-don-t-use-sfpb-mutex.patch b/queue-6.1/arm64-dts-qcom-msm8992-don-t-use-sfpb-mutex.patch new file mode 100644 index 00000000000..810752f2888 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8992-don-t-use-sfpb-mutex.patch @@ -0,0 +1,41 @@ +From 48376028b480ad1af46ba08bac122fde756dec77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 14:19:17 +0100 +Subject: arm64: dts: qcom: msm8992: Don't use sfpb mutex + +From: Konrad Dybcio + +[ Upstream commit 2bd5ab93335bf2c4d22c8db427822ae637ed8dc3 ] + +MSM8992 uses the same mutex hardware as MSM8994. This was wrong +from the start, but never presented as an issue until the sfpb +compatible was given different driver data. + +Fixes: 6a6d1978f9c0 ("arm64: dts: msm8992 SoC and LG Bullhead (Nexus 5X) support") +Reported-by: Eugene Lepshy +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221219131918.446587-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992.dtsi | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992.dtsi b/arch/arm64/boot/dts/qcom/msm8992.dtsi +index 750643763a76..f4be09fc1b15 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8992.dtsi +@@ -36,10 +36,6 @@ &rpmcc { + compatible = "qcom,rpmcc-msm8992", "qcom,rpmcc"; + }; + +-&tcsr_mutex { +- compatible = "qcom,sfpb-mutex"; +-}; +- + &timer { + interrupts = , + , +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-qcom-msm8992-libra-fix-the-memory-map.patch b/queue-6.1/arm64-dts-qcom-msm8992-libra-fix-the-memory-map.patch new file mode 100644 index 00000000000..ef77f624ecf --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-msm8992-libra-fix-the-memory-map.patch @@ -0,0 +1,133 @@ +From feff5846fcb212eb466a95286cb9f6ccfff446d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 14:19:18 +0100 +Subject: arm64: dts: qcom: msm8992-libra: Fix the memory map + +From: Konrad Dybcio + +[ Upstream commit 69876bc6fd4de3ad2dc7826fe269e91fa2c1807f ] + +The memory map was wrong. Fix it to prevent the device from randomly +rebooting. + +Fixes: 0f5cdb31e850 ("arm64: dts: qcom: Add Xiaomi Libra (Mi 4C) device tree") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221219131918.446587-2-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + .../boot/dts/qcom/msm8992-xiaomi-libra.dts | 77 +++++++++++++++---- + 1 file changed, 60 insertions(+), 17 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts b/arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts +index c4e87d0aec42..3ab0ad14e870 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts ++++ b/arch/arm64/boot/dts/qcom/msm8992-xiaomi-libra.dts +@@ -11,6 +11,12 @@ + #include + #include + ++/delete-node/ &adsp_mem; ++/delete-node/ &audio_mem; ++/delete-node/ &mpss_mem; ++/delete-node/ &peripheral_region; ++/delete-node/ &rmtfs_mem; ++ + / { + model = "Xiaomi Mi 4C"; + compatible = "xiaomi,libra", "qcom,msm8992"; +@@ -70,25 +76,67 @@ reserved-memory { + #size-cells = <2>; + ranges; + +- /* This is for getting crash logs using Android downstream kernels */ +- ramoops@dfc00000 { +- compatible = "ramoops"; +- reg = <0x0 0xdfc00000 0x0 0x40000>; +- console-size = <0x10000>; +- record-size = <0x10000>; +- ftrace-size = <0x10000>; +- pmsg-size = <0x20000>; ++ memory_hole: hole@6400000 { ++ reg = <0 0x06400000 0 0x600000>; ++ no-map; ++ }; ++ ++ memory_hole2: hole2@6c00000 { ++ reg = <0 0x06c00000 0 0x2400000>; ++ no-map; ++ }; ++ ++ mpss_mem: mpss@9000000 { ++ reg = <0 0x09000000 0 0x5a00000>; ++ no-map; ++ }; ++ ++ tzapp: tzapp@ea00000 { ++ reg = <0 0x0ea00000 0 0x1900000>; ++ no-map; ++ }; ++ ++ mdm_rfsa_mem: mdm-rfsa@ca0b0000 { ++ reg = <0 0xca0b0000 0 0x10000>; ++ no-map; ++ }; ++ ++ rmtfs_mem: rmtfs@ca100000 { ++ compatible = "qcom,rmtfs-mem"; ++ reg = <0 0xca100000 0 0x180000>; ++ no-map; ++ ++ qcom,client-id = <1>; + }; + +- modem_region: modem_region@9000000 { +- reg = <0x0 0x9000000 0x0 0x5a00000>; ++ audio_mem: audio@cb400000 { ++ reg = <0 0xcb000000 0 0x400000>; ++ no-mem; ++ }; ++ ++ qseecom_mem: qseecom@cb400000 { ++ reg = <0 0xcb400000 0 0x1c00000>; ++ no-mem; ++ }; ++ ++ adsp_rfsa_mem: adsp-rfsa@cd000000 { ++ reg = <0 0xcd000000 0 0x10000>; + no-map; + }; + +- tzapp: modem_region@ea00000 { +- reg = <0x0 0xea00000 0x0 0x1900000>; ++ sensor_rfsa_mem: sensor-rfsa@cd010000 { ++ reg = <0 0xcd010000 0 0x10000>; + no-map; + }; ++ ++ ramoops@dfc00000 { ++ compatible = "ramoops"; ++ reg = <0 0xdfc00000 0 0x40000>; ++ console-size = <0x10000>; ++ record-size = <0x10000>; ++ ftrace-size = <0x10000>; ++ pmsg-size = <0x20000>; ++ }; + }; + }; + +@@ -130,11 +178,6 @@ &blsp2_uart2 { + status = "okay"; + }; + +-&peripheral_region { +- reg = <0x0 0x7400000 0x0 0x1c00000>; +- no-map; +-}; +- + &pm8994_spmi_regulators { + VDD_APC0: s8 { + regulator-min-microvolt = <680000>; +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-qcom-sc8280xp-fix-primary-usb-dp-phy-reset.patch b/queue-6.1/arm64-dts-qcom-sc8280xp-fix-primary-usb-dp-phy-reset.patch new file mode 100644 index 00000000000..379ab12027c --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sc8280xp-fix-primary-usb-dp-phy-reset.patch @@ -0,0 +1,39 @@ +From a65ad6de2a52d151d8594859ebeb62f6c8ae4023 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 09:50:57 +0100 +Subject: arm64: dts: qcom: sc8280xp: fix primary USB-DP PHY reset + +From: Johan Hovold + +[ Upstream commit ee4e530bdde29a69c58656a919545251a782674e ] + +The vendor kernel is using the GCC_USB4_DP_PHY_PRIM_BCR and +GCC_USB4_1_DP_PHY_PRIM_BCR resets for the USB4-USB3-DP QMP PHYs. + +Update the primary USB-DP PHY node to match. + +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221121085058.31213-15-johan+linaro@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 9f2a136d5cbc..146a4285c395 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -1173,7 +1173,7 @@ usb_0_qmpphy: phy-wrapper@88ec000 { + clock-names = "aux", "ref_clk_src", "ref", "com_aux"; + + resets = <&gcc GCC_USB3_PHY_PRIM_BCR>, +- <&gcc GCC_USB3_DP_PHY_PRIM_BCR>; ++ <&gcc GCC_USB4_DP_PHY_PRIM_BCR>; + reset-names = "phy", "common"; + + power-domains = <&gcc USB30_PRIM_GDSC>; +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-verdin-imx8mm-fix-dahlia-audio-playback.patch b/queue-6.1/arm64-dts-verdin-imx8mm-fix-dahlia-audio-playback.patch new file mode 100644 index 00000000000..87e6984fb73 --- /dev/null +++ b/queue-6.1/arm64-dts-verdin-imx8mm-fix-dahlia-audio-playback.patch @@ -0,0 +1,38 @@ +From 79b3747c367e8f3d41bf51c1e3aa6464287a5606 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 13:55:48 +0100 +Subject: arm64: dts: verdin-imx8mm: fix dahlia audio playback + +From: Emanuele Ghidoli + +[ Upstream commit 0d1d030f00f3f3eea04017cbd50ffe44a2842ebc ] + +Set optional `simple-audio-card,mclk-fs` parameter to ensure a proper +clock to the wm8904 audio codec. Without this change with an audio +stream rate of 44.1 kHz the playback is completely distorted. + +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Emanuele Ghidoli +Signed-off-by: Francesco Dolcini +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi +index c2a5c2f7b204..7c3f5c54f040 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi +@@ -9,6 +9,7 @@ sound_card: sound-card { + simple-audio-card,bitclock-master = <&dailink_master>; + simple-audio-card,format = "i2s"; + simple-audio-card,frame-master = <&dailink_master>; ++ simple-audio-card,mclk-fs = <256>; + simple-audio-card,name = "imx8mm-wm8904"; + simple-audio-card,routing = + "Headphone Jack", "HPOUTL", +-- +2.39.0 + diff --git a/queue-6.1/arm64-dts-verdin-imx8mm-fix-dev-board-audio-playback.patch b/queue-6.1/arm64-dts-verdin-imx8mm-fix-dev-board-audio-playback.patch new file mode 100644 index 00000000000..9f2a866aa7b --- /dev/null +++ b/queue-6.1/arm64-dts-verdin-imx8mm-fix-dev-board-audio-playback.patch @@ -0,0 +1,40 @@ +From 75fc02a60151ad23b26350969ddb22a114f0453d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 11:27:49 +0100 +Subject: arm64: dts: verdin-imx8mm: fix dev board audio playback + +From: Emanuele Ghidoli + +[ Upstream commit 6c620a30515c494b5eeb3dc0e40d3220ea04c53b ] + +Set optional `simple-audio-card,mclk-fs` parameter to ensure a proper +clock to the nau8822 audio codec. Without this change with an audio +stream rate of 44.1 kHz the playback is faster. +Set the MCLK at the right frequency, codec can properly use it to +generate 44.1 kHz I2S-FS. + +Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") +Signed-off-by: Emanuele Ghidoli +Signed-off-by: Francesco Dolcini +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin-dev.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin-dev.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin-dev.dtsi +index 73cc3fafa018..b2bcd2282170 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin-dev.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin-dev.dtsi +@@ -11,6 +11,7 @@ sound_card: sound-card { + simple-audio-card,bitclock-master = <&dailink_master>; + simple-audio-card,format = "i2s"; + simple-audio-card,frame-master = <&dailink_master>; ++ simple-audio-card,mclk-fs = <256>; + simple-audio-card,name = "imx8mm-nau8822"; + simple-audio-card,routing = + "Headphones", "LHP", +-- +2.39.0 + diff --git a/queue-6.1/asoc-amd-yc-add-asus-m5402ra-into-dmi-table.patch b/queue-6.1/asoc-amd-yc-add-asus-m5402ra-into-dmi-table.patch new file mode 100644 index 00000000000..7423d898f31 --- /dev/null +++ b/queue-6.1/asoc-amd-yc-add-asus-m5402ra-into-dmi-table.patch @@ -0,0 +1,43 @@ +From 927b4f11f24151566f16717d2209be0bb522cfb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Dec 2022 23:49:32 +0100 +Subject: ASoC: amd: yc: Add ASUS M5402RA into DMI table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Aniol Martí + +[ Upstream commit a0dd7fcab5cd221fa960f594c586e1f9f16c02c0 ] + +ASUS VivoBook 13 OLED (M5402RA) needs this quirk to get the built-in microphone working properly. + +Signed-off-by: Aniol Martí +Link: https://lore.kernel.org/r/20221227224932.9771-1-aniol@aniolmarti.cat +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 469c5e79e0ea..0d283e41f66d 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -206,6 +206,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "UM5302TA"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "M5402RA"), ++ } ++ }, + { + .driver_data = &acp6x_card, + .matches = { +-- +2.39.0 + diff --git a/queue-6.1/asoc-amd-yc-add-razer-blade-14-2022-into-dmi-table.patch b/queue-6.1/asoc-amd-yc-add-razer-blade-14-2022-into-dmi-table.patch new file mode 100644 index 00000000000..aac9c837f27 --- /dev/null +++ b/queue-6.1/asoc-amd-yc-add-razer-blade-14-2022-into-dmi-table.patch @@ -0,0 +1,41 @@ +From a462fdabb471cbb48cad71f67da298e36a77b201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 09:18:27 +0100 +Subject: ASoC: amd: yc: Add Razer Blade 14 2022 into DMI table + +From: Wim Van Boven + +[ Upstream commit 68506a173dd700c2bd794dcc3489edcdb8ee35c6 ] + +Razer Blade 14 (2022) - RZ09-0427 needs the quirk to enable the built in microphone + +Signed-off-by: Wim Van Boven +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20221216081828.12382-1-wimvanboven@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 1f0b5527c594..469c5e79e0ea 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -220,6 +220,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Redmi Book Pro 14 2022"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "Razer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Blade 14 (2022) - RZ09-0427"), ++ } ++ }, + {} + }; + +-- +2.39.0 + diff --git a/queue-6.1/asoc-fsl-asoc-card-fix-naming-of-ac-97-codec-widgets.patch b/queue-6.1/asoc-fsl-asoc-card-fix-naming-of-ac-97-codec-widgets.patch new file mode 100644 index 00000000000..57fe802348f --- /dev/null +++ b/queue-6.1/asoc-fsl-asoc-card-fix-naming-of-ac-97-codec-widgets.patch @@ -0,0 +1,42 @@ +From da9fa44c1d77aaa6d95a0242385c9e9f85a084fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 23:15:07 +0000 +Subject: ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets + +From: Mark Brown + +[ Upstream commit 242fc66ae6e1e2b8519daacc7590a73cd0e8a6e4 ] + +The fsl-asoc-card AC'97 support currently tries to route to Playback and +Capture widgets provided by the AC'97 CODEC. This doesn't work since the +generic AC'97 driver registers with an "AC97" at the front of the stream +and hence widget names, update to reflect reality. It's not clear to me +if or how this ever worked. + +Acked-by: Shengjiu Wang +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20230106-asoc-udoo-probe-v1-2-a5d7469d4f67@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl-asoc-card.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index 1dfd0341e487..8d14b5593658 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -121,8 +121,8 @@ static const struct snd_soc_dapm_route audio_map[] = { + + static const struct snd_soc_dapm_route audio_map_ac97[] = { + /* 1st half -- Normal DAPM routes */ +- {"Playback", NULL, "CPU AC97 Playback"}, +- {"CPU AC97 Capture", NULL, "Capture"}, ++ {"AC97 Playback", NULL, "CPU AC97 Playback"}, ++ {"CPU AC97 Capture", NULL, "AC97 Capture"}, + /* 2nd half -- ASRC DAPM routes */ + {"CPU AC97 Playback", NULL, "ASRC-Playback"}, + {"ASRC-Capture", NULL, "CPU AC97 Capture"}, +-- +2.39.0 + diff --git a/queue-6.1/asoc-fsl_micfil-correct-the-number-of-steps-on-sx-co.patch b/queue-6.1/asoc-fsl_micfil-correct-the-number-of-steps-on-sx-co.patch new file mode 100644 index 00000000000..0e2d2e4dafc --- /dev/null +++ b/queue-6.1/asoc-fsl_micfil-correct-the-number-of-steps-on-sx-co.patch @@ -0,0 +1,59 @@ +From 2c20e9c22235c4626b0f761a177c9a45547f775e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 10:57:54 +0800 +Subject: ASoC: fsl_micfil: Correct the number of steps on SX controls + +From: Chancel Liu + +[ Upstream commit cdfa92eb90f5770b26a79824ef213ebdbbd988b1 ] + +The parameter "max" of SOC_SINGLE_SX_TLV() means the number of steps +rather than maximum value. This patch corrects the minimum value to -8 +and the number of steps to 15. + +Signed-off-by: Chancel Liu +Acked-by: Shengjiu Wang +Link: https://lore.kernel.org/r/20230104025754.3019235-1-chancel.liu@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_micfil.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c +index 4b86ef82fd93..4b8fe9b8be40 100644 +--- a/sound/soc/fsl/fsl_micfil.c ++++ b/sound/soc/fsl/fsl_micfil.c +@@ -154,21 +154,21 @@ static int micfil_quality_set(struct snd_kcontrol *kcontrol, + + static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = { + SOC_SINGLE_SX_TLV("CH0 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(0), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(0), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH1 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(1), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(1), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH2 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(2), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(2), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH3 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(3), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(3), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH4 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(4), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(4), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH5 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(5), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(5), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH6 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(6), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(6), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH7 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(7), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(7), 0x8, 0xF, gain_tlv), + SOC_ENUM_EXT("MICFIL Quality Select", + fsl_micfil_quality_enum, + micfil_quality_get, micfil_quality_set), +-- +2.39.0 + diff --git a/queue-6.1/asoc-fsl_ssi-rename-ac-97-streams-to-avoid-collision.patch b/queue-6.1/asoc-fsl_ssi-rename-ac-97-streams-to-avoid-collision.patch new file mode 100644 index 00000000000..89fdbb894ed --- /dev/null +++ b/queue-6.1/asoc-fsl_ssi-rename-ac-97-streams-to-avoid-collision.patch @@ -0,0 +1,70 @@ +From 38b40256a4ab6a0da081807c0aeb8d03ed0fcbca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 23:15:06 +0000 +Subject: ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 + CODEC + +From: Mark Brown + +[ Upstream commit 8c6a42b5b0ed6f96624f56954e93eeae107440a6 ] + +The SSI driver calls the AC'97 playback and transmit streams "AC97 Playback" +and "AC97 Capture" respectively. This is the same name used by the generic +AC'97 CODEC driver in ASoC, creating confusion for the Freescale ASoC card +when it attempts to use these widgets in routing. Add a "CPU" in the name +like the regular DAIs registered by the driver to disambiguate. + +Acked-by: Shengjiu Wang +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20230106-asoc-udoo-probe-v1-1-a5d7469d4f67@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl-asoc-card.c | 8 ++++---- + sound/soc/fsl/fsl_ssi.c | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index c836848ef0a6..1dfd0341e487 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -121,11 +121,11 @@ static const struct snd_soc_dapm_route audio_map[] = { + + static const struct snd_soc_dapm_route audio_map_ac97[] = { + /* 1st half -- Normal DAPM routes */ +- {"Playback", NULL, "AC97 Playback"}, +- {"AC97 Capture", NULL, "Capture"}, ++ {"Playback", NULL, "CPU AC97 Playback"}, ++ {"CPU AC97 Capture", NULL, "Capture"}, + /* 2nd half -- ASRC DAPM routes */ +- {"AC97 Playback", NULL, "ASRC-Playback"}, +- {"ASRC-Capture", NULL, "AC97 Capture"}, ++ {"CPU AC97 Playback", NULL, "ASRC-Playback"}, ++ {"ASRC-Capture", NULL, "CPU AC97 Capture"}, + }; + + static const struct snd_soc_dapm_route audio_map_tx[] = { +diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c +index c9e0e31d5b34..46a53551b955 100644 +--- a/sound/soc/fsl/fsl_ssi.c ++++ b/sound/soc/fsl/fsl_ssi.c +@@ -1189,14 +1189,14 @@ static struct snd_soc_dai_driver fsl_ssi_ac97_dai = { + .symmetric_channels = 1, + .probe = fsl_ssi_dai_probe, + .playback = { +- .stream_name = "AC97 Playback", ++ .stream_name = "CPU AC97 Playback", + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_48000, + .formats = SNDRV_PCM_FMTBIT_S16 | SNDRV_PCM_FMTBIT_S20, + }, + .capture = { +- .stream_name = "AC97 Capture", ++ .stream_name = "CPU AC97 Capture", + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_48000, +-- +2.39.0 + diff --git a/queue-6.1/asoc-mediatek-mt8186-add-machine-support-for-max9835.patch b/queue-6.1/asoc-mediatek-mt8186-add-machine-support-for-max9835.patch new file mode 100644 index 00000000000..1f84d90cadb --- /dev/null +++ b/queue-6.1/asoc-mediatek-mt8186-add-machine-support-for-max9835.patch @@ -0,0 +1,38 @@ +From 986e5b08d33b4e2ec2a636edfd1d869672d5b9be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 19:57:56 +0800 +Subject: ASoC: mediatek: mt8186: Add machine support for max98357a + +From: Allen-KH Cheng + +[ Upstream commit 8a54f666db581bbf07494cca44a0124acbced581 ] + +Add support for mt8186 with mt6366 and max98357a. + +Signed-off-by: Allen-KH Cheng +Link: https://lore.kernel.org/r/20221228115756.28014-1-allen-kh.cheng@mediatek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/mediatek/Kconfig b/sound/soc/mediatek/Kconfig +index 363fa4d47680..7bdb0ded831c 100644 +--- a/sound/soc/mediatek/Kconfig ++++ b/sound/soc/mediatek/Kconfig +@@ -182,9 +182,10 @@ config SND_SOC_MT8186_MT6366_DA7219_MAX98357 + If unsure select "N". + + config SND_SOC_MT8186_MT6366_RT1019_RT5682S +- tristate "ASoC Audio driver for MT8186 with RT1019 RT5682S codec" ++ tristate "ASoC Audio driver for MT8186 with RT1019 RT5682S MAX98357A/MAX98360 codec" + depends on I2C && GPIOLIB + depends on SND_SOC_MT8186 && MTK_PMIC_WRAP ++ select SND_SOC_MAX98357A + select SND_SOC_MT6358 + select SND_SOC_RT1015P + select SND_SOC_RT5682S +-- +2.39.0 + diff --git a/queue-6.1/asoc-mediatek-mt8186-support-rt5682s_max98360.patch b/queue-6.1/asoc-mediatek-mt8186-support-rt5682s_max98360.patch new file mode 100644 index 00000000000..ae82858601b --- /dev/null +++ b/queue-6.1/asoc-mediatek-mt8186-support-rt5682s_max98360.patch @@ -0,0 +1,65 @@ +From b1e5bf75218b963de6c8382d474f73a272fc8adf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 20:22:29 +0800 +Subject: ASoC: mediatek: mt8186: support rt5682s_max98360 + +From: tongjian + +[ Upstream commit 6e1dbf694d7cd1737ee14866e9e05016ccc9ac40 ] + +Add support for using the rt5682s codec together with max98360a on +MT8186-MT6366-RT1019-RT5682S machines. + +Signed-off-by: tongjian +Link: https://lore.kernel.org/r/20221228122230.3818533-2-tongjian@huaqin.corp-partner.google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../mt8186/mt8186-mt6366-rt1019-rt5682s.c | 22 ++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c b/sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c +index 60fa55d0c91f..6babadb2e6fe 100644 +--- a/sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c ++++ b/sound/soc/mediatek/mt8186/mt8186-mt6366-rt1019-rt5682s.c +@@ -991,6 +991,21 @@ static struct snd_soc_card mt8186_mt6366_rt1019_rt5682s_soc_card = { + .num_configs = ARRAY_SIZE(mt8186_mt6366_rt1019_rt5682s_codec_conf), + }; + ++static struct snd_soc_card mt8186_mt6366_rt5682s_max98360_soc_card = { ++ .name = "mt8186_rt5682s_max98360", ++ .owner = THIS_MODULE, ++ .dai_link = mt8186_mt6366_rt1019_rt5682s_dai_links, ++ .num_links = ARRAY_SIZE(mt8186_mt6366_rt1019_rt5682s_dai_links), ++ .controls = mt8186_mt6366_rt1019_rt5682s_controls, ++ .num_controls = ARRAY_SIZE(mt8186_mt6366_rt1019_rt5682s_controls), ++ .dapm_widgets = mt8186_mt6366_rt1019_rt5682s_widgets, ++ .num_dapm_widgets = ARRAY_SIZE(mt8186_mt6366_rt1019_rt5682s_widgets), ++ .dapm_routes = mt8186_mt6366_rt1019_rt5682s_routes, ++ .num_dapm_routes = ARRAY_SIZE(mt8186_mt6366_rt1019_rt5682s_routes), ++ .codec_conf = mt8186_mt6366_rt1019_rt5682s_codec_conf, ++ .num_configs = ARRAY_SIZE(mt8186_mt6366_rt1019_rt5682s_codec_conf), ++}; ++ + static int mt8186_mt6366_rt1019_rt5682s_dev_probe(struct platform_device *pdev) + { + struct snd_soc_card *card; +@@ -1132,9 +1147,14 @@ static int mt8186_mt6366_rt1019_rt5682s_dev_probe(struct platform_device *pdev) + + #if IS_ENABLED(CONFIG_OF) + static const struct of_device_id mt8186_mt6366_rt1019_rt5682s_dt_match[] = { +- { .compatible = "mediatek,mt8186-mt6366-rt1019-rt5682s-sound", ++ { ++ .compatible = "mediatek,mt8186-mt6366-rt1019-rt5682s-sound", + .data = &mt8186_mt6366_rt1019_rt5682s_soc_card, + }, ++ { ++ .compatible = "mediatek,mt8186-mt6366-rt5682s-max98360-sound", ++ .data = &mt8186_mt6366_rt5682s_max98360_soc_card, ++ }, + {} + }; + #endif +-- +2.39.0 + diff --git a/queue-6.1/asoc-sof-add-fw-state-to-debugfs.patch b/queue-6.1/asoc-sof-add-fw-state-to-debugfs.patch new file mode 100644 index 00000000000..046b12d977c --- /dev/null +++ b/queue-6.1/asoc-sof-add-fw-state-to-debugfs.patch @@ -0,0 +1,46 @@ +From 4b7d709c6df7b440ef5f7948739fb505a88b0409 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 14:56:29 +0200 +Subject: ASoC: SOF: Add FW state to debugfs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Curtis Malainey + +[ Upstream commit 9a9134fd56f6ba614ff7b2b3b0bac0bf1d0dc0c9 ] + +Allow system health detection mechanisms to check the FW state, this +will allow them to check if the FW is in its "crashed" state going +forward to help automatically diagnose driver state. + +Signed-off-by: Curtis Malainey +Reviewed-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20221220125629.8469-4-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/debug.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c +index d9a3ce7b69e1..ade0507328af 100644 +--- a/sound/soc/sof/debug.c ++++ b/sound/soc/sof/debug.c +@@ -353,7 +353,9 @@ int snd_sof_dbg_init(struct snd_sof_dev *sdev) + return err; + } + +- return 0; ++ return snd_sof_debugfs_buf_item(sdev, &sdev->fw_state, ++ sizeof(sdev->fw_state), ++ "fw_state", 0444); + } + EXPORT_SYMBOL_GPL(snd_sof_dbg_init); + +-- +2.39.0 + diff --git a/queue-6.1/asoc-sof-pm-always-tear-down-pipelines-before-dsp-su.patch b/queue-6.1/asoc-sof-pm-always-tear-down-pipelines-before-dsp-su.patch new file mode 100644 index 00000000000..058c77bfaad --- /dev/null +++ b/queue-6.1/asoc-sof-pm-always-tear-down-pipelines-before-dsp-su.patch @@ -0,0 +1,58 @@ +From a78db031d7ebf62615484eb0f0b50ec39b6cc0e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 14:56:28 +0200 +Subject: ASoC: SOF: pm: Always tear down pipelines before DSP suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ranjani Sridharan + +[ Upstream commit d185e0689abc98ef55fb7a7d75aa0c48a0ed5838 ] + +When the DSP is suspended while the firmware is in the crashed state, we +skip tearing down the pipelines. This means that the widget reference +counts will not get to reset to 0 before suspend. This will lead to +errors with resuming audio after system resume. To fix this, invoke the +tear_down_all_pipelines op before skipping to DSP suspend. + +Signed-off-by: Ranjani Sridharan +Reviewed-by: Curtis Malainey +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20221220125629.8469-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/pm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sof/pm.c b/sound/soc/sof/pm.c +index 5f88c4a01fa3..8722bbd7fd3d 100644 +--- a/sound/soc/sof/pm.c ++++ b/sound/soc/sof/pm.c +@@ -192,6 +192,9 @@ static int sof_suspend(struct device *dev, bool runtime_suspend) + if (runtime_suspend && !sof_ops(sdev)->runtime_suspend) + return 0; + ++ if (tplg_ops && tplg_ops->tear_down_all_pipelines) ++ tplg_ops->tear_down_all_pipelines(sdev, false); ++ + if (sdev->fw_state != SOF_FW_BOOT_COMPLETE) + goto suspend; + +@@ -216,9 +219,6 @@ static int sof_suspend(struct device *dev, bool runtime_suspend) + goto suspend; + } + +- if (tplg_ops->tear_down_all_pipelines) +- tplg_ops->tear_down_all_pipelines(sdev, false); +- + /* suspend DMA trace */ + sof_fw_trace_suspend(sdev, pm_state); + +-- +2.39.0 + diff --git a/queue-6.1/asoc-sof-pm-set-target-state-earlier.patch b/queue-6.1/asoc-sof-pm-set-target-state-earlier.patch new file mode 100644 index 00000000000..5c6057441ef --- /dev/null +++ b/queue-6.1/asoc-sof-pm-set-target-state-earlier.patch @@ -0,0 +1,56 @@ +From 2f7e37ac7d74fff89704860621457e432db36644 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 14:56:27 +0200 +Subject: ASoC: SOF: pm: Set target state earlier +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ranjani Sridharan + +[ Upstream commit 6f95eec6fb89e195dbdf30de65553c7fc57d9372 ] + +If the DSP crashes before the system suspends, the setting of target state +will be skipped because the firmware state will no longer be +SOF_FW_BOOT_COMPLETE. This leads to the incorrect assumption that the +DSP should suspend to D0I3 instead of suspending to D3. To fix this, +set the target_state before we skip to DSP suspend even when the DSP has +crashed. + +Signed-off-by: Ranjani Sridharan +Reviewed-by: Curtis Malainey +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20221220125629.8469-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/pm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/soc/sof/pm.c b/sound/soc/sof/pm.c +index df740be645e8..5f88c4a01fa3 100644 +--- a/sound/soc/sof/pm.c ++++ b/sound/soc/sof/pm.c +@@ -182,7 +182,7 @@ static int sof_suspend(struct device *dev, bool runtime_suspend) + const struct sof_ipc_pm_ops *pm_ops = sdev->ipc->ops->pm; + const struct sof_ipc_tplg_ops *tplg_ops = sdev->ipc->ops->tplg; + pm_message_t pm_state; +- u32 target_state = 0; ++ u32 target_state = snd_sof_dsp_power_target(sdev); + int ret; + + /* do nothing if dsp suspend callback is not set */ +@@ -206,7 +206,6 @@ static int sof_suspend(struct device *dev, bool runtime_suspend) + } + } + +- target_state = snd_sof_dsp_power_target(sdev); + pm_state.event = target_state; + + /* Skip to platform-specific suspend if DSP is entering D0 */ +-- +2.39.0 + diff --git a/queue-6.1/asoc-support-machine-driver-with-max98360.patch b/queue-6.1/asoc-support-machine-driver-with-max98360.patch new file mode 100644 index 00000000000..911022caa20 --- /dev/null +++ b/queue-6.1/asoc-support-machine-driver-with-max98360.patch @@ -0,0 +1,32 @@ +From 0374352b3e85746a2483ddab963b680a62b6fe85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 18:38:12 +0800 +Subject: ASoC: support machine driver with max98360 + +From: Mars Chen + +[ Upstream commit 810948f45d99c46b60852ef2a5a2777c12d6bb3e ] + +Signed-off-by: Mars Chen +Link: https://lore.kernel.org/r/20221228103812.450956-1-chenxiangrui@huaqin.corp-partner.google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/mediatek/Kconfig b/sound/soc/mediatek/Kconfig +index 7bdb0ded831c..b027fba8233d 100644 +--- a/sound/soc/mediatek/Kconfig ++++ b/sound/soc/mediatek/Kconfig +@@ -187,6 +187,7 @@ config SND_SOC_MT8186_MT6366_RT1019_RT5682S + depends on SND_SOC_MT8186 && MTK_PMIC_WRAP + select SND_SOC_MAX98357A + select SND_SOC_MT6358 ++ select SND_SOC_MAX98357A + select SND_SOC_RT1015P + select SND_SOC_RT5682S + select SND_SOC_BT_SCO +-- +2.39.0 + diff --git a/queue-6.1/ata-pata_cs5535-don-t-build-on-uml.patch b/queue-6.1/ata-pata_cs5535-don-t-build-on-uml.patch new file mode 100644 index 00000000000..c7a556d3763 --- /dev/null +++ b/queue-6.1/ata-pata_cs5535-don-t-build-on-uml.patch @@ -0,0 +1,44 @@ +From 7b6c8cac64bc7cd35368f8fe46f743a59c73338f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 23:37:06 -0500 +Subject: ata: pata_cs5535: Don't build on UML + +From: Peter Foley + +[ Upstream commit 22eebaa631c40f3dac169ba781e0de471b83bf45 ] + +This driver uses MSR functions that aren't implemented under UML. +Avoid building it to prevent tripping up allyesconfig. + +e.g. +/usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x3a3): undefined reference to `__tracepoint_read_msr' +/usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x3d2): undefined reference to `__tracepoint_write_msr' +/usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x457): undefined reference to `__tracepoint_write_msr' +/usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x481): undefined reference to `do_trace_write_msr' +/usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x4d5): undefined reference to `do_trace_write_msr' +/usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x4f5): undefined reference to `do_trace_read_msr' +/usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: pata_cs5535.c:(.text+0x51c): undefined reference to `do_trace_write_msr' + +Signed-off-by: Peter Foley +Reviewed-by: Randy Dunlap +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig +index 36833a862998..d9b305a3427f 100644 +--- a/drivers/ata/Kconfig ++++ b/drivers/ata/Kconfig +@@ -650,6 +650,7 @@ config PATA_CS5530 + config PATA_CS5535 + tristate "CS5535 PATA support (Experimental)" + depends on PCI && (X86_32 || (X86_64 && COMPILE_TEST)) ++ depends on !UML + help + This option enables support for the NatSemi/AMD CS5535 + companion chip used with the Geode processor family. +-- +2.39.0 + diff --git a/queue-6.1/blk-crypto-pass-a-gendisk-to-blk_crypto_sysfs_-un-re.patch b/queue-6.1/blk-crypto-pass-a-gendisk-to-blk_crypto_sysfs_-un-re.patch new file mode 100644 index 00000000000..f1a992df126 --- /dev/null +++ b/queue-6.1/blk-crypto-pass-a-gendisk-to-blk_crypto_sysfs_-un-re.patch @@ -0,0 +1,109 @@ +From 8e5573c40b2d75dcf27ffa8ec3ffda9543f948df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 05:26:33 +0100 +Subject: blk-crypto: pass a gendisk to blk_crypto_sysfs_{,un}register + +From: Christoph Hellwig + +[ Upstream commit 450deb93df7d457cdd93594a1987f9650c749b96 ] + +Prepare for changes to the block layer sysfs handling by passing the +readily available gendisk to blk_crypto_sysfs_{,un}register. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Eric Biggers +Link: https://lore.kernel.org/r/20221114042637.1009333-2-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()") +Signed-off-by: Sasha Levin +--- + block/blk-crypto-internal.h | 10 ++++++---- + block/blk-crypto-sysfs.c | 7 ++++--- + block/blk-sysfs.c | 4 ++-- + 3 files changed, 12 insertions(+), 9 deletions(-) + +diff --git a/block/blk-crypto-internal.h b/block/blk-crypto-internal.h +index e6818ffaddbf..b8a00847171f 100644 +--- a/block/blk-crypto-internal.h ++++ b/block/blk-crypto-internal.h +@@ -21,9 +21,9 @@ extern const struct blk_crypto_mode blk_crypto_modes[]; + + #ifdef CONFIG_BLK_INLINE_ENCRYPTION + +-int blk_crypto_sysfs_register(struct request_queue *q); ++int blk_crypto_sysfs_register(struct gendisk *disk); + +-void blk_crypto_sysfs_unregister(struct request_queue *q); ++void blk_crypto_sysfs_unregister(struct gendisk *disk); + + void bio_crypt_dun_increment(u64 dun[BLK_CRYPTO_DUN_ARRAY_SIZE], + unsigned int inc); +@@ -67,12 +67,14 @@ static inline bool blk_crypto_rq_is_encrypted(struct request *rq) + + #else /* CONFIG_BLK_INLINE_ENCRYPTION */ + +-static inline int blk_crypto_sysfs_register(struct request_queue *q) ++static inline int blk_crypto_sysfs_register(struct gendisk *disk) + { + return 0; + } + +-static inline void blk_crypto_sysfs_unregister(struct request_queue *q) { } ++static inline void blk_crypto_sysfs_unregister(struct gendisk *disk) ++{ ++} + + static inline bool bio_crypt_rq_ctx_compatible(struct request *rq, + struct bio *bio) +diff --git a/block/blk-crypto-sysfs.c b/block/blk-crypto-sysfs.c +index fd93bd2f33b7..e05f145cd797 100644 +--- a/block/blk-crypto-sysfs.c ++++ b/block/blk-crypto-sysfs.c +@@ -126,8 +126,9 @@ static struct kobj_type blk_crypto_ktype = { + * If the request_queue has a blk_crypto_profile, create the "crypto" + * subdirectory in sysfs (/sys/block/$disk/queue/crypto/). + */ +-int blk_crypto_sysfs_register(struct request_queue *q) ++int blk_crypto_sysfs_register(struct gendisk *disk) + { ++ struct request_queue *q = disk->queue; + struct blk_crypto_kobj *obj; + int err; + +@@ -149,9 +150,9 @@ int blk_crypto_sysfs_register(struct request_queue *q) + return 0; + } + +-void blk_crypto_sysfs_unregister(struct request_queue *q) ++void blk_crypto_sysfs_unregister(struct gendisk *disk) + { +- kobject_put(q->crypto_kobject); ++ kobject_put(disk->queue->crypto_kobject); + } + + static int __init blk_crypto_sysfs_init(void) +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index e7871665825a..2b1cf0b2a5c7 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -833,7 +833,7 @@ int blk_register_queue(struct gendisk *disk) + goto put_dev; + } + +- ret = blk_crypto_sysfs_register(q); ++ ret = blk_crypto_sysfs_register(disk); + if (ret) + goto put_dev; + +@@ -910,7 +910,7 @@ void blk_unregister_queue(struct gendisk *disk) + */ + if (queue_is_mq(q)) + blk_mq_sysfs_unregister(disk); +- blk_crypto_sysfs_unregister(q); ++ blk_crypto_sysfs_unregister(disk); + + mutex_lock(&q->sysfs_lock); + elv_unregister_queue(q); +-- +2.39.0 + diff --git a/queue-6.1/blk-mq-move-the-srcu_struct-used-for-quiescing-to-th.patch b/queue-6.1/blk-mq-move-the-srcu_struct-used-for-quiescing-to-th.patch new file mode 100644 index 00000000000..b81af479b25 --- /dev/null +++ b/queue-6.1/blk-mq-move-the-srcu_struct-used-for-quiescing-to-th.patch @@ -0,0 +1,358 @@ +From 5652ba6946df40af95d99e88d2c85700905e41a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 16:00:47 +0100 +Subject: blk-mq: move the srcu_struct used for quiescing to the tagset + +From: Christoph Hellwig + +[ Upstream commit 80bd4a7aab4c9ce59bf5e35fdf52aa23d8a3c9f5 ] + +All I/O submissions have fairly similar latencies, and a tagset-wide +quiesce is a fairly common operation. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Ming Lei +Reviewed-by: Chao Leng +Reviewed-by: Sagi Grimberg +Reviewed-by: Hannes Reinecke +Reviewed-by: Chaitanya Kulkarni +Link: https://lore.kernel.org/r/20221101150050.3510-12-hch@lst.de +[axboe: fix whitespace] +Signed-off-by: Jens Axboe +Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()") +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 27 +++++---------------------- + block/blk-mq.c | 33 +++++++++++++++++++++++++-------- + block/blk-mq.h | 14 +++++++------- + block/blk-sysfs.c | 9 ++------- + block/blk.h | 9 +-------- + block/genhd.c | 2 +- + include/linux/blk-mq.h | 4 ++++ + include/linux/blkdev.h | 9 --------- + 8 files changed, 45 insertions(+), 62 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 5487912befe8..9d6a947024ea 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -65,7 +65,6 @@ DEFINE_IDA(blk_queue_ida); + * For queue allocation + */ + struct kmem_cache *blk_requestq_cachep; +-struct kmem_cache *blk_requestq_srcu_cachep; + + /* + * Controlling structure to kblockd +@@ -373,26 +372,20 @@ static void blk_timeout_work(struct work_struct *work) + { + } + +-struct request_queue *blk_alloc_queue(int node_id, bool alloc_srcu) ++struct request_queue *blk_alloc_queue(int node_id) + { + struct request_queue *q; + +- q = kmem_cache_alloc_node(blk_get_queue_kmem_cache(alloc_srcu), +- GFP_KERNEL | __GFP_ZERO, node_id); ++ q = kmem_cache_alloc_node(blk_requestq_cachep, GFP_KERNEL | __GFP_ZERO, ++ node_id); + if (!q) + return NULL; + +- if (alloc_srcu) { +- blk_queue_flag_set(QUEUE_FLAG_HAS_SRCU, q); +- if (init_srcu_struct(q->srcu) != 0) +- goto fail_q; +- } +- + q->last_merge = NULL; + + q->id = ida_alloc(&blk_queue_ida, GFP_KERNEL); + if (q->id < 0) +- goto fail_srcu; ++ goto fail_q; + + q->stats = blk_alloc_queue_stats(); + if (!q->stats) +@@ -434,11 +427,8 @@ struct request_queue *blk_alloc_queue(int node_id, bool alloc_srcu) + blk_free_queue_stats(q->stats); + fail_id: + ida_free(&blk_queue_ida, q->id); +-fail_srcu: +- if (alloc_srcu) +- cleanup_srcu_struct(q->srcu); + fail_q: +- kmem_cache_free(blk_get_queue_kmem_cache(alloc_srcu), q); ++ kmem_cache_free(blk_requestq_cachep, q); + return NULL; + } + +@@ -1183,9 +1173,6 @@ int __init blk_dev_init(void) + sizeof_field(struct request, cmd_flags)); + BUILD_BUG_ON(REQ_OP_BITS + REQ_FLAG_BITS > 8 * + sizeof_field(struct bio, bi_opf)); +- BUILD_BUG_ON(ALIGN(offsetof(struct request_queue, srcu), +- __alignof__(struct request_queue)) != +- sizeof(struct request_queue)); + + /* used for unplugging and affects IO latency/throughput - HIGHPRI */ + kblockd_workqueue = alloc_workqueue("kblockd", +@@ -1196,10 +1183,6 @@ int __init blk_dev_init(void) + blk_requestq_cachep = kmem_cache_create("request_queue", + sizeof(struct request_queue), 0, SLAB_PANIC, NULL); + +- blk_requestq_srcu_cachep = kmem_cache_create("request_queue_srcu", +- sizeof(struct request_queue) + +- sizeof(struct srcu_struct), 0, SLAB_PANIC, NULL); +- + blk_debugfs_root = debugfs_create_dir("block", NULL); + + return 0; +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 63abbe342b28..bbf500537f75 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -261,8 +261,8 @@ EXPORT_SYMBOL_GPL(blk_mq_quiesce_queue_nowait); + */ + void blk_mq_wait_quiesce_done(struct request_queue *q) + { +- if (blk_queue_has_srcu(q)) +- synchronize_srcu(q->srcu); ++ if (q->tag_set->flags & BLK_MQ_F_BLOCKING) ++ synchronize_srcu(q->tag_set->srcu); + else + synchronize_rcu(); + } +@@ -4010,7 +4010,7 @@ static struct request_queue *blk_mq_init_queue_data(struct blk_mq_tag_set *set, + struct request_queue *q; + int ret; + +- q = blk_alloc_queue(set->numa_node, set->flags & BLK_MQ_F_BLOCKING); ++ q = blk_alloc_queue(set->numa_node); + if (!q) + return ERR_PTR(-ENOMEM); + q->queuedata = queuedata; +@@ -4182,9 +4182,6 @@ static void blk_mq_update_poll_flag(struct request_queue *q) + int blk_mq_init_allocated_queue(struct blk_mq_tag_set *set, + struct request_queue *q) + { +- WARN_ON_ONCE(blk_queue_has_srcu(q) != +- !!(set->flags & BLK_MQ_F_BLOCKING)); +- + /* mark the queue as mq asap */ + q->mq_ops = set->ops; + +@@ -4441,8 +4438,18 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set) + if (set->nr_maps == 1 && set->nr_hw_queues > nr_cpu_ids) + set->nr_hw_queues = nr_cpu_ids; + +- if (blk_mq_alloc_tag_set_tags(set, set->nr_hw_queues) < 0) +- return -ENOMEM; ++ if (set->flags & BLK_MQ_F_BLOCKING) { ++ set->srcu = kmalloc(sizeof(*set->srcu), GFP_KERNEL); ++ if (!set->srcu) ++ return -ENOMEM; ++ ret = init_srcu_struct(set->srcu); ++ if (ret) ++ goto out_free_srcu; ++ } ++ ++ ret = blk_mq_alloc_tag_set_tags(set, set->nr_hw_queues); ++ if (ret) ++ goto out_cleanup_srcu; + + ret = -ENOMEM; + for (i = 0; i < set->nr_maps; i++) { +@@ -4472,6 +4479,12 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set) + } + kfree(set->tags); + set->tags = NULL; ++out_cleanup_srcu: ++ if (set->flags & BLK_MQ_F_BLOCKING) ++ cleanup_srcu_struct(set->srcu); ++out_free_srcu: ++ if (set->flags & BLK_MQ_F_BLOCKING) ++ kfree(set->srcu); + return ret; + } + EXPORT_SYMBOL(blk_mq_alloc_tag_set); +@@ -4511,6 +4524,10 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set) + + kfree(set->tags); + set->tags = NULL; ++ if (set->flags & BLK_MQ_F_BLOCKING) { ++ cleanup_srcu_struct(set->srcu); ++ kfree(set->srcu); ++ } + } + EXPORT_SYMBOL(blk_mq_free_tag_set); + +diff --git a/block/blk-mq.h b/block/blk-mq.h +index 0b2870839cdd..ef59fee62780 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -377,17 +377,17 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx, + /* run the code block in @dispatch_ops with rcu/srcu read lock held */ + #define __blk_mq_run_dispatch_ops(q, check_sleep, dispatch_ops) \ + do { \ +- if (!blk_queue_has_srcu(q)) { \ +- rcu_read_lock(); \ +- (dispatch_ops); \ +- rcu_read_unlock(); \ +- } else { \ ++ if ((q)->tag_set->flags & BLK_MQ_F_BLOCKING) { \ + int srcu_idx; \ + \ + might_sleep_if(check_sleep); \ +- srcu_idx = srcu_read_lock((q)->srcu); \ ++ srcu_idx = srcu_read_lock((q)->tag_set->srcu); \ + (dispatch_ops); \ +- srcu_read_unlock((q)->srcu, srcu_idx); \ ++ srcu_read_unlock((q)->tag_set->srcu, srcu_idx); \ ++ } else { \ ++ rcu_read_lock(); \ ++ (dispatch_ops); \ ++ rcu_read_unlock(); \ + } \ + } while (0) + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index e71b3b43927c..e7871665825a 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -739,10 +739,8 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, + + static void blk_free_queue_rcu(struct rcu_head *rcu_head) + { +- struct request_queue *q = container_of(rcu_head, struct request_queue, +- rcu_head); +- +- kmem_cache_free(blk_get_queue_kmem_cache(blk_queue_has_srcu(q)), q); ++ kmem_cache_free(blk_requestq_cachep, ++ container_of(rcu_head, struct request_queue, rcu_head)); + } + + /** +@@ -779,9 +777,6 @@ static void blk_release_queue(struct kobject *kobj) + if (queue_is_mq(q)) + blk_mq_release(q); + +- if (blk_queue_has_srcu(q)) +- cleanup_srcu_struct(q->srcu); +- + ida_free(&blk_queue_ida, q->id); + call_rcu(&q->rcu_head, blk_free_queue_rcu); + } +diff --git a/block/blk.h b/block/blk.h +index 8b75a95b28d6..0661fa4b3a4d 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -27,7 +27,6 @@ struct blk_flush_queue { + }; + + extern struct kmem_cache *blk_requestq_cachep; +-extern struct kmem_cache *blk_requestq_srcu_cachep; + extern struct kobj_type blk_queue_ktype; + extern struct ida blk_queue_ida; + +@@ -428,13 +427,7 @@ int bio_add_hw_page(struct request_queue *q, struct bio *bio, + struct page *page, unsigned int len, unsigned int offset, + unsigned int max_sectors, bool *same_page); + +-static inline struct kmem_cache *blk_get_queue_kmem_cache(bool srcu) +-{ +- if (srcu) +- return blk_requestq_srcu_cachep; +- return blk_requestq_cachep; +-} +-struct request_queue *blk_alloc_queue(int node_id, bool alloc_srcu); ++struct request_queue *blk_alloc_queue(int node_id); + + int disk_scan_partitions(struct gendisk *disk, fmode_t mode, void *owner); + +diff --git a/block/genhd.c b/block/genhd.c +index c4765681a8b4..f4f3f3b55634 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -1417,7 +1417,7 @@ struct gendisk *__blk_alloc_disk(int node, struct lock_class_key *lkclass) + struct request_queue *q; + struct gendisk *disk; + +- q = blk_alloc_queue(node, false); ++ q = blk_alloc_queue(node); + if (!q) + return NULL; + +diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h +index d6119c5d1069..2952c28410e3 100644 +--- a/include/linux/blk-mq.h ++++ b/include/linux/blk-mq.h +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + struct blk_mq_tags; + struct blk_flush_queue; +@@ -501,6 +502,8 @@ enum hctx_type { + * @tag_list_lock: Serializes tag_list accesses. + * @tag_list: List of the request queues that use this tag set. See also + * request_queue.tag_set_list. ++ * @srcu: Use as lock when type of the request queue is blocking ++ * (BLK_MQ_F_BLOCKING). + */ + struct blk_mq_tag_set { + struct blk_mq_queue_map map[HCTX_MAX_TYPES]; +@@ -521,6 +524,7 @@ struct blk_mq_tag_set { + + struct mutex tag_list_lock; + struct list_head tag_list; ++ struct srcu_struct *srcu; + }; + + /** +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 891f8cbcd043..36c286d22fb2 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -22,7 +22,6 @@ + #include + #include + #include +-#include + #include + #include + +@@ -544,18 +543,11 @@ struct request_queue { + struct mutex debugfs_mutex; + + bool mq_sysfs_init_done; +- +- /** +- * @srcu: Sleepable RCU. Use as lock when type of the request queue +- * is blocking (BLK_MQ_F_BLOCKING). Must be the last member +- */ +- struct srcu_struct srcu[]; + }; + + /* Keep blk_queue_flag_name[] in sync with the definitions below */ + #define QUEUE_FLAG_STOPPED 0 /* queue is stopped */ + #define QUEUE_FLAG_DYING 1 /* queue being torn down */ +-#define QUEUE_FLAG_HAS_SRCU 2 /* SRCU is allocated */ + #define QUEUE_FLAG_NOMERGES 3 /* disable merge attempts */ + #define QUEUE_FLAG_SAME_COMP 4 /* complete on same CPU-group */ + #define QUEUE_FLAG_FAIL_IO 5 /* fake timeout */ +@@ -591,7 +583,6 @@ bool blk_queue_flag_test_and_set(unsigned int flag, struct request_queue *q); + + #define blk_queue_stopped(q) test_bit(QUEUE_FLAG_STOPPED, &(q)->queue_flags) + #define blk_queue_dying(q) test_bit(QUEUE_FLAG_DYING, &(q)->queue_flags) +-#define blk_queue_has_srcu(q) test_bit(QUEUE_FLAG_HAS_SRCU, &(q)->queue_flags) + #define blk_queue_init_done(q) test_bit(QUEUE_FLAG_INIT_DONE, &(q)->queue_flags) + #define blk_queue_nomerges(q) test_bit(QUEUE_FLAG_NOMERGES, &(q)->queue_flags) + #define blk_queue_noxmerges(q) \ +-- +2.39.0 + diff --git a/queue-6.1/block-drop-spurious-might_sleep-from-blk_put_queue.patch b/queue-6.1/block-drop-spurious-might_sleep-from-blk_put_queue.patch new file mode 100644 index 00000000000..6b2390aa835 --- /dev/null +++ b/queue-6.1/block-drop-spurious-might_sleep-from-blk_put_queue.patch @@ -0,0 +1,62 @@ +From 9ac03e3fd8e1bdbf1bca0fa281849d2257ee8329 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 10:34:10 -1000 +Subject: block: Drop spurious might_sleep() from blk_put_queue() + +From: Tejun Heo + +[ Upstream commit 49e4d04f0486117ac57a97890eb1db6d52bf82b3 ] + +Dan reports the following smatch detected the following: + + block/blk-cgroup.c:1863 blkcg_schedule_throttle() warn: sleeping in atomic context + +caused by blkcg_schedule_throttle() calling blk_put_queue() in an +non-sleepable context. + +blk_put_queue() acquired might_sleep() in 63f93fd6fa57 ("block: mark +blk_put_queue as potentially blocking") which transferred the might_sleep() +from blk_free_queue(). + +blk_free_queue() acquired might_sleep() in e8c7d14ac6c3 ("block: revert back +to synchronous request_queue removal") while turning request_queue removal +synchronous. However, this isn't necessary as nothing in the free path +actually requires sleeping. + +It's pretty unusual to require a sleeping context in a put operation and +it's not needed in the first place. Let's drop it. + +Signed-off-by: Tejun Heo +Reported-by: Dan Carpenter +Link: https://lkml.kernel.org/r/Y7g3L6fntnTtOm63@kili +Cc: Christoph Hellwig +Cc: Luis Chamberlain +Fixes: e8c7d14ac6c3 ("block: revert back to synchronous request_queue removal") # v5.9+ +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/Y7iFwjN+XzWvLv3y@slm.duckdns.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 815ffce6b988..f5ae527fb0c3 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -282,12 +282,9 @@ static void blk_free_queue(struct request_queue *q) + * + * Decrements the refcount of the request_queue and free it when the refcount + * reaches 0. +- * +- * Context: Can sleep. + */ + void blk_put_queue(struct request_queue *q) + { +- might_sleep(); + if (refcount_dec_and_test(&q->refs)) + blk_free_queue(q); + } +-- +2.39.0 + diff --git a/queue-6.1/block-factor-out-a-blk_debugfs_remove-helper.patch b/queue-6.1/block-factor-out-a-blk_debugfs_remove-helper.patch new file mode 100644 index 00000000000..679ef9f228e --- /dev/null +++ b/queue-6.1/block-factor-out-a-blk_debugfs_remove-helper.patch @@ -0,0 +1,61 @@ +From 9683dfad8af965906565c987bf3d6edc3ed2f24a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 05:26:34 +0100 +Subject: block: factor out a blk_debugfs_remove helper + +From: Christoph Hellwig + +[ Upstream commit 6fc75f309d291d328b4ea2f91bef0ff56e4bc7c2 ] + +Split the debugfs removal from blk_unregister_queue into a helper so that +the it can be reused for blk_register_queue error handling. + +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221114042637.1009333-3-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()") +Signed-off-by: Sasha Levin +--- + block/blk-sysfs.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 2b1cf0b2a5c7..3d6951a0b4e7 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -797,6 +797,19 @@ struct kobj_type blk_queue_ktype = { + .release = blk_release_queue, + }; + ++static void blk_debugfs_remove(struct gendisk *disk) ++{ ++ struct request_queue *q = disk->queue; ++ ++ mutex_lock(&q->debugfs_mutex); ++ blk_trace_shutdown(q); ++ debugfs_remove_recursive(q->debugfs_dir); ++ q->debugfs_dir = NULL; ++ q->sched_debugfs_dir = NULL; ++ q->rqos_debugfs_dir = NULL; ++ mutex_unlock(&q->debugfs_mutex); ++} ++ + /** + * blk_register_queue - register a block layer queue with sysfs + * @disk: Disk of which the request queue should be registered with sysfs. +@@ -922,11 +935,5 @@ void blk_unregister_queue(struct gendisk *disk) + kobject_del(&q->kobj); + mutex_unlock(&q->sysfs_dir_lock); + +- mutex_lock(&q->debugfs_mutex); +- blk_trace_shutdown(q); +- debugfs_remove_recursive(q->debugfs_dir); +- q->debugfs_dir = NULL; +- q->sched_debugfs_dir = NULL; +- q->rqos_debugfs_dir = NULL; +- mutex_unlock(&q->debugfs_mutex); ++ blk_debugfs_remove(disk); + } +-- +2.39.0 + diff --git a/queue-6.1/block-fix-error-unwinding-in-blk_register_queue.patch b/queue-6.1/block-fix-error-unwinding-in-blk_register_queue.patch new file mode 100644 index 00000000000..b18d6b9877e --- /dev/null +++ b/queue-6.1/block-fix-error-unwinding-in-blk_register_queue.patch @@ -0,0 +1,101 @@ +From 520fc407ac237ecc98786169fb75fa8e35ea7d53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 05:26:35 +0100 +Subject: block: fix error unwinding in blk_register_queue + +From: Christoph Hellwig + +[ Upstream commit 40602997be26887bdfa3d58659c3acb4579099e9 ] + +blk_register_queue fails to handle errors from blk_mq_sysfs_register, +leaks various resources on errors and accidentally sets queue refs percpu +refcount to percpu mode on kobject_add failure. Fix all that by +properly unwinding on errors. + +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221114042637.1009333-4-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()") +Signed-off-by: Sasha Levin +--- + block/blk-sysfs.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 3d6951a0b4e7..1631ba2f7259 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -820,13 +820,15 @@ int blk_register_queue(struct gendisk *disk) + int ret; + + mutex_lock(&q->sysfs_dir_lock); +- + ret = kobject_add(&q->kobj, &disk_to_dev(disk)->kobj, "queue"); + if (ret < 0) +- goto unlock; ++ goto out_unlock_dir; + +- if (queue_is_mq(q)) +- blk_mq_sysfs_register(disk); ++ if (queue_is_mq(q)) { ++ ret = blk_mq_sysfs_register(disk); ++ if (ret) ++ goto out_del_queue_kobj; ++ } + mutex_lock(&q->sysfs_lock); + + mutex_lock(&q->debugfs_mutex); +@@ -838,17 +840,17 @@ int blk_register_queue(struct gendisk *disk) + + ret = disk_register_independent_access_ranges(disk); + if (ret) +- goto put_dev; ++ goto out_debugfs_remove; + + if (q->elevator) { + ret = elv_register_queue(q, false); + if (ret) +- goto put_dev; ++ goto out_unregister_ia_ranges; + } + + ret = blk_crypto_sysfs_register(disk); + if (ret) +- goto put_dev; ++ goto out_elv_unregister; + + blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q); + wbt_enable_default(q); +@@ -859,8 +861,6 @@ int blk_register_queue(struct gendisk *disk) + if (q->elevator) + kobject_uevent(&q->elevator->kobj, KOBJ_ADD); + mutex_unlock(&q->sysfs_lock); +- +-unlock: + mutex_unlock(&q->sysfs_dir_lock); + + /* +@@ -879,13 +879,17 @@ int blk_register_queue(struct gendisk *disk) + + return ret; + +-put_dev: ++out_elv_unregister: + elv_unregister_queue(q); ++out_unregister_ia_ranges: + disk_unregister_independent_access_ranges(disk); ++out_debugfs_remove: ++ blk_debugfs_remove(disk); + mutex_unlock(&q->sysfs_lock); +- mutex_unlock(&q->sysfs_dir_lock); ++out_del_queue_kobj: + kobject_del(&q->kobj); +- ++out_unlock_dir: ++ mutex_unlock(&q->sysfs_dir_lock); + return ret; + } + +-- +2.39.0 + diff --git a/queue-6.1/block-mark-blk_put_queue-as-potentially-blocking.patch b/queue-6.1/block-mark-blk_put_queue-as-potentially-blocking.patch new file mode 100644 index 00000000000..78d178c9134 --- /dev/null +++ b/queue-6.1/block-mark-blk_put_queue-as-potentially-blocking.patch @@ -0,0 +1,52 @@ +From 6a52e5b9fb29a5ffd3d5bfc87155b10789be85c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 05:26:37 +0100 +Subject: block: mark blk_put_queue as potentially blocking + +From: Christoph Hellwig + +[ Upstream commit 63f93fd6fa5717769a78d6d7bea6f7f9a1ccca8e ] + +We can't just say that the last reference release may block, as any +reference dropped could be the last one. So move the might_sleep() from +blk_free_queue to blk_put_queue and update the documentation. + +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221114042637.1009333-6-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()") +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 7de1bb16e9a7..815ffce6b988 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -260,8 +260,6 @@ static void blk_free_queue_rcu(struct rcu_head *rcu_head) + + static void blk_free_queue(struct request_queue *q) + { +- might_sleep(); +- + percpu_ref_exit(&q->q_usage_counter); + + if (q->poll_stat) +@@ -285,11 +283,11 @@ static void blk_free_queue(struct request_queue *q) + * Decrements the refcount of the request_queue and free it when the refcount + * reaches 0. + * +- * Context: Any context, but the last reference must not be dropped from +- * atomic context. ++ * Context: Can sleep. + */ + void blk_put_queue(struct request_queue *q) + { ++ might_sleep(); + if (refcount_dec_and_test(&q->refs)) + blk_free_queue(q); + } +-- +2.39.0 + diff --git a/queue-6.1/block-rnbd-clt-fix-wrong-max-id-in-ida_alloc_max.patch b/queue-6.1/block-rnbd-clt-fix-wrong-max-id-in-ida_alloc_max.patch new file mode 100644 index 00000000000..c91f082659d --- /dev/null +++ b/queue-6.1/block-rnbd-clt-fix-wrong-max-id-in-ida_alloc_max.patch @@ -0,0 +1,44 @@ +From b077ec67c5fa0d4f59f9e4929a07d7b28aade35c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Dec 2022 09:09:26 +0800 +Subject: block/rnbd-clt: fix wrong max ID in ida_alloc_max + +From: Guoqing Jiang + +[ Upstream commit 9d6033e350694a67885605674244d43c9559dc36 ] + +We need to pass 'end - 1' to ida_alloc_max after switch from +ida_simple_get to ida_alloc_max. + +Otherwise smatch warns. + +drivers/block/rnbd/rnbd-clt.c:1460 init_dev() error: Calling ida_alloc_max() with a 'max' argument which is a power of 2. -1 missing? + +Fixes: 24afc15dbe21 ("block/rnbd: Remove a useless mutex") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Guoqing Jiang +Acked-by: Jack Wang +Link: https://lore.kernel.org/r/20221230010926.32243-1-guoqing.jiang@linux.dev +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rnbd/rnbd-clt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/rnbd/rnbd-clt.c b/drivers/block/rnbd/rnbd-clt.c +index 78334da74d8b..5eb8c7855970 100644 +--- a/drivers/block/rnbd/rnbd-clt.c ++++ b/drivers/block/rnbd/rnbd-clt.c +@@ -1440,7 +1440,7 @@ static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess, + goto out_alloc; + } + +- ret = ida_alloc_max(&index_ida, 1 << (MINORBITS - RNBD_PART_BITS), ++ ret = ida_alloc_max(&index_ida, (1 << (MINORBITS - RNBD_PART_BITS)) - 1, + GFP_KERNEL); + if (ret < 0) { + pr_err("Failed to initialize device '%s' from session %s, allocating idr failed, err: %d\n", +-- +2.39.0 + diff --git a/queue-6.1/block-untangle-request_queue-refcounting-from-sysfs.patch b/queue-6.1/block-untangle-request_queue-refcounting-from-sysfs.patch new file mode 100644 index 00000000000..75cc54f93d8 --- /dev/null +++ b/queue-6.1/block-untangle-request_queue-refcounting-from-sysfs.patch @@ -0,0 +1,400 @@ +From 474aee255bb1335ccd2f17e880d2e25b49db4a5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 05:26:36 +0100 +Subject: block: untangle request_queue refcounting from sysfs + +From: Christoph Hellwig + +[ Upstream commit 2bd85221a625b316114bafaab527770b607095d3 ] + +The kobject embedded into the request_queue is used for the queue +directory in sysfs, but that is a child of the gendisks directory and is +intimately tied to it. Move this kobject to the gendisk and use a +refcount_t in the request_queue for the actual request_queue refcounting +that is completely unrelated to the device model. + +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221114042637.1009333-5-hch@lst.de +Signed-off-by: Jens Axboe +Stable-dep-of: 49e4d04f0486 ("block: Drop spurious might_sleep() from blk_put_queue()") +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 42 ++++++++++++++++---- + block/blk-crypto-sysfs.c | 4 +- + block/blk-ia-ranges.c | 3 +- + block/blk-sysfs.c | 86 +++++++++++----------------------------- + block/blk.h | 4 -- + block/bsg.c | 11 +++-- + block/elevator.c | 2 +- + include/linux/blkdev.h | 6 +-- + 8 files changed, 71 insertions(+), 87 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 9d6a947024ea..7de1bb16e9a7 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -59,12 +59,12 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(block_split); + EXPORT_TRACEPOINT_SYMBOL_GPL(block_unplug); + EXPORT_TRACEPOINT_SYMBOL_GPL(block_rq_insert); + +-DEFINE_IDA(blk_queue_ida); ++static DEFINE_IDA(blk_queue_ida); + + /* + * For queue allocation + */ +-struct kmem_cache *blk_requestq_cachep; ++static struct kmem_cache *blk_requestq_cachep; + + /* + * Controlling structure to kblockd +@@ -252,19 +252,46 @@ void blk_clear_pm_only(struct request_queue *q) + } + EXPORT_SYMBOL_GPL(blk_clear_pm_only); + ++static void blk_free_queue_rcu(struct rcu_head *rcu_head) ++{ ++ kmem_cache_free(blk_requestq_cachep, ++ container_of(rcu_head, struct request_queue, rcu_head)); ++} ++ ++static void blk_free_queue(struct request_queue *q) ++{ ++ might_sleep(); ++ ++ percpu_ref_exit(&q->q_usage_counter); ++ ++ if (q->poll_stat) ++ blk_stat_remove_callback(q, q->poll_cb); ++ blk_stat_free_callback(q->poll_cb); ++ ++ blk_free_queue_stats(q->stats); ++ kfree(q->poll_stat); ++ ++ if (queue_is_mq(q)) ++ blk_mq_release(q); ++ ++ ida_free(&blk_queue_ida, q->id); ++ call_rcu(&q->rcu_head, blk_free_queue_rcu); ++} ++ + /** + * blk_put_queue - decrement the request_queue refcount + * @q: the request_queue structure to decrement the refcount for + * +- * Decrements the refcount of the request_queue kobject. When this reaches 0 +- * we'll have blk_release_queue() called. ++ * Decrements the refcount of the request_queue and free it when the refcount ++ * reaches 0. + * + * Context: Any context, but the last reference must not be dropped from + * atomic context. + */ + void blk_put_queue(struct request_queue *q) + { +- kobject_put(&q->kobj); ++ if (refcount_dec_and_test(&q->refs)) ++ blk_free_queue(q); + } + EXPORT_SYMBOL(blk_put_queue); + +@@ -399,8 +426,7 @@ struct request_queue *blk_alloc_queue(int node_id) + INIT_WORK(&q->timeout_work, blk_timeout_work); + INIT_LIST_HEAD(&q->icq_list); + +- kobject_init(&q->kobj, &blk_queue_ktype); +- ++ refcount_set(&q->refs, 1); + mutex_init(&q->debugfs_mutex); + mutex_init(&q->sysfs_lock); + mutex_init(&q->sysfs_dir_lock); +@@ -444,7 +470,7 @@ bool blk_get_queue(struct request_queue *q) + { + if (unlikely(blk_queue_dying(q))) + return false; +- kobject_get(&q->kobj); ++ refcount_inc(&q->refs); + return true; + } + EXPORT_SYMBOL(blk_get_queue); +diff --git a/block/blk-crypto-sysfs.c b/block/blk-crypto-sysfs.c +index e05f145cd797..55268edc0625 100644 +--- a/block/blk-crypto-sysfs.c ++++ b/block/blk-crypto-sysfs.c +@@ -140,8 +140,8 @@ int blk_crypto_sysfs_register(struct gendisk *disk) + return -ENOMEM; + obj->profile = q->crypto_profile; + +- err = kobject_init_and_add(&obj->kobj, &blk_crypto_ktype, &q->kobj, +- "crypto"); ++ err = kobject_init_and_add(&obj->kobj, &blk_crypto_ktype, ++ &disk->queue_kobj, "crypto"); + if (err) { + kobject_put(&obj->kobj); + return err; +diff --git a/block/blk-ia-ranges.c b/block/blk-ia-ranges.c +index 2bd1d311033b..2141931ddd37 100644 +--- a/block/blk-ia-ranges.c ++++ b/block/blk-ia-ranges.c +@@ -123,7 +123,8 @@ int disk_register_independent_access_ranges(struct gendisk *disk) + */ + WARN_ON(iars->sysfs_registered); + ret = kobject_init_and_add(&iars->kobj, &blk_ia_ranges_ktype, +- &q->kobj, "%s", "independent_access_ranges"); ++ &disk->queue_kobj, "%s", ++ "independent_access_ranges"); + if (ret) { + disk->ia_ranges = NULL; + kobject_put(&iars->kobj); +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 1631ba2f7259..35e854bb6e0c 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -680,8 +680,8 @@ static struct attribute *queue_attrs[] = { + static umode_t queue_attr_visible(struct kobject *kobj, struct attribute *attr, + int n) + { +- struct request_queue *q = +- container_of(kobj, struct request_queue, kobj); ++ struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj); ++ struct request_queue *q = disk->queue; + + if (attr == &queue_io_timeout_entry.attr && + (!q->mq_ops || !q->mq_ops->timeout)) +@@ -707,8 +707,8 @@ static ssize_t + queue_attr_show(struct kobject *kobj, struct attribute *attr, char *page) + { + struct queue_sysfs_entry *entry = to_queue(attr); +- struct request_queue *q = +- container_of(kobj, struct request_queue, kobj); ++ struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj); ++ struct request_queue *q = disk->queue; + ssize_t res; + + if (!entry->show) +@@ -724,63 +724,19 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, + const char *page, size_t length) + { + struct queue_sysfs_entry *entry = to_queue(attr); +- struct request_queue *q; ++ struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj); ++ struct request_queue *q = disk->queue; + ssize_t res; + + if (!entry->store) + return -EIO; + +- q = container_of(kobj, struct request_queue, kobj); + mutex_lock(&q->sysfs_lock); + res = entry->store(q, page, length); + mutex_unlock(&q->sysfs_lock); + return res; + } + +-static void blk_free_queue_rcu(struct rcu_head *rcu_head) +-{ +- kmem_cache_free(blk_requestq_cachep, +- container_of(rcu_head, struct request_queue, rcu_head)); +-} +- +-/** +- * blk_release_queue - releases all allocated resources of the request_queue +- * @kobj: pointer to a kobject, whose container is a request_queue +- * +- * This function releases all allocated resources of the request queue. +- * +- * The struct request_queue refcount is incremented with blk_get_queue() and +- * decremented with blk_put_queue(). Once the refcount reaches 0 this function +- * is called. +- * +- * Drivers exist which depend on the release of the request_queue to be +- * synchronous, it should not be deferred. +- * +- * Context: can sleep +- */ +-static void blk_release_queue(struct kobject *kobj) +-{ +- struct request_queue *q = +- container_of(kobj, struct request_queue, kobj); +- +- might_sleep(); +- +- percpu_ref_exit(&q->q_usage_counter); +- +- if (q->poll_stat) +- blk_stat_remove_callback(q, q->poll_cb); +- blk_stat_free_callback(q->poll_cb); +- +- blk_free_queue_stats(q->stats); +- kfree(q->poll_stat); +- +- if (queue_is_mq(q)) +- blk_mq_release(q); +- +- ida_free(&blk_queue_ida, q->id); +- call_rcu(&q->rcu_head, blk_free_queue_rcu); +-} +- + static const struct sysfs_ops queue_sysfs_ops = { + .show = queue_attr_show, + .store = queue_attr_store, +@@ -791,10 +747,15 @@ static const struct attribute_group *blk_queue_attr_groups[] = { + NULL + }; + +-struct kobj_type blk_queue_ktype = { ++static void blk_queue_release(struct kobject *kobj) ++{ ++ /* nothing to do here, all data is associated with the parent gendisk */ ++} ++ ++static struct kobj_type blk_queue_ktype = { + .default_groups = blk_queue_attr_groups, + .sysfs_ops = &queue_sysfs_ops, +- .release = blk_release_queue, ++ .release = blk_queue_release, + }; + + static void blk_debugfs_remove(struct gendisk *disk) +@@ -820,20 +781,20 @@ int blk_register_queue(struct gendisk *disk) + int ret; + + mutex_lock(&q->sysfs_dir_lock); +- ret = kobject_add(&q->kobj, &disk_to_dev(disk)->kobj, "queue"); ++ kobject_init(&disk->queue_kobj, &blk_queue_ktype); ++ ret = kobject_add(&disk->queue_kobj, &disk_to_dev(disk)->kobj, "queue"); + if (ret < 0) +- goto out_unlock_dir; ++ goto out_put_queue_kobj; + + if (queue_is_mq(q)) { + ret = blk_mq_sysfs_register(disk); + if (ret) +- goto out_del_queue_kobj; ++ goto out_put_queue_kobj; + } + mutex_lock(&q->sysfs_lock); + + mutex_lock(&q->debugfs_mutex); +- q->debugfs_dir = debugfs_create_dir(kobject_name(q->kobj.parent), +- blk_debugfs_root); ++ q->debugfs_dir = debugfs_create_dir(disk->disk_name, blk_debugfs_root); + if (queue_is_mq(q)) + blk_mq_debugfs_register(q); + mutex_unlock(&q->debugfs_mutex); +@@ -857,7 +818,7 @@ int blk_register_queue(struct gendisk *disk) + blk_throtl_register(disk); + + /* Now everything is ready and send out KOBJ_ADD uevent */ +- kobject_uevent(&q->kobj, KOBJ_ADD); ++ kobject_uevent(&disk->queue_kobj, KOBJ_ADD); + if (q->elevator) + kobject_uevent(&q->elevator->kobj, KOBJ_ADD); + mutex_unlock(&q->sysfs_lock); +@@ -886,9 +847,8 @@ int blk_register_queue(struct gendisk *disk) + out_debugfs_remove: + blk_debugfs_remove(disk); + mutex_unlock(&q->sysfs_lock); +-out_del_queue_kobj: +- kobject_del(&q->kobj); +-out_unlock_dir: ++out_put_queue_kobj: ++ kobject_put(&disk->queue_kobj); + mutex_unlock(&q->sysfs_dir_lock); + return ret; + } +@@ -935,8 +895,8 @@ void blk_unregister_queue(struct gendisk *disk) + mutex_unlock(&q->sysfs_lock); + + /* Now that we've deleted all child objects, we can delete the queue. */ +- kobject_uevent(&q->kobj, KOBJ_REMOVE); +- kobject_del(&q->kobj); ++ kobject_uevent(&disk->queue_kobj, KOBJ_REMOVE); ++ kobject_del(&disk->queue_kobj); + mutex_unlock(&q->sysfs_dir_lock); + + blk_debugfs_remove(disk); +diff --git a/block/blk.h b/block/blk.h +index 0661fa4b3a4d..6fe583dd6e3b 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -26,10 +26,6 @@ struct blk_flush_queue { + spinlock_t mq_flush_lock; + }; + +-extern struct kmem_cache *blk_requestq_cachep; +-extern struct kobj_type blk_queue_ktype; +-extern struct ida blk_queue_ida; +- + bool is_flush_rq(struct request *req); + + struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size, +diff --git a/block/bsg.c b/block/bsg.c +index 2ab1351eb082..8eba57b9bb46 100644 +--- a/block/bsg.c ++++ b/block/bsg.c +@@ -175,8 +175,10 @@ static void bsg_device_release(struct device *dev) + + void bsg_unregister_queue(struct bsg_device *bd) + { +- if (bd->queue->kobj.sd) +- sysfs_remove_link(&bd->queue->kobj, "bsg"); ++ struct gendisk *disk = bd->queue->disk; ++ ++ if (disk && disk->queue_kobj.sd) ++ sysfs_remove_link(&disk->queue_kobj, "bsg"); + cdev_device_del(&bd->cdev, &bd->device); + put_device(&bd->device); + } +@@ -216,8 +218,9 @@ struct bsg_device *bsg_register_queue(struct request_queue *q, + if (ret) + goto out_put_device; + +- if (q->kobj.sd) { +- ret = sysfs_create_link(&q->kobj, &bd->device.kobj, "bsg"); ++ if (q->disk && q->disk->queue_kobj.sd) { ++ ret = sysfs_create_link(&q->disk->queue_kobj, &bd->device.kobj, ++ "bsg"); + if (ret) + goto out_device_del; + } +diff --git a/block/elevator.c b/block/elevator.c +index bd71f0fc4e4b..ac096f494911 100644 +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -499,7 +499,7 @@ int elv_register_queue(struct request_queue *q, bool uevent) + + lockdep_assert_held(&q->sysfs_lock); + +- error = kobject_add(&e->kobj, &q->kobj, "%s", "iosched"); ++ error = kobject_add(&e->kobj, &q->disk->queue_kobj, "iosched"); + if (!error) { + struct elv_fs_entry *attr = e->type->elevator_attrs; + if (attr) { +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 36c286d22fb2..17dc59c5aa90 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -155,6 +155,7 @@ struct gendisk { + unsigned open_partitions; /* number of open partitions */ + + struct backing_dev_info *bdi; ++ struct kobject queue_kobj; /* the queue/ directory */ + struct kobject *slave_dir; + #ifdef CONFIG_BLOCK_HOLDER_DEPRECATED + struct list_head slave_bdevs; +@@ -437,10 +438,7 @@ struct request_queue { + + struct gendisk *disk; + +- /* +- * queue kobject +- */ +- struct kobject kobj; ++ refcount_t refs; + + /* + * mq queue kobject +-- +2.39.0 + diff --git a/queue-6.1/bluetooth-fix-a-buffer-overflow-in-mgmt_mesh_add.patch b/queue-6.1/bluetooth-fix-a-buffer-overflow-in-mgmt_mesh_add.patch new file mode 100644 index 00000000000..aebb4ce734a --- /dev/null +++ b/queue-6.1/bluetooth-fix-a-buffer-overflow-in-mgmt_mesh_add.patch @@ -0,0 +1,46 @@ +From ff10bdb2102f5ca1393e515b7cb47046d8f1b309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 05:08:28 -0800 +Subject: Bluetooth: Fix a buffer overflow in mgmt_mesh_add() + +From: Harshit Mogalapalli + +[ Upstream commit 2185e0fdbb2137f22a9dd9fcbf6481400d56299b ] + +Smatch Warning: +net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy() +'mesh_tx->param' too small (48 vs 50) + +Analysis: + +'mesh_tx->param' is array of size 48. This is the destination. +u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; // 19 + 29 = 48. + +But in the caller 'mesh_send' we reject only when len > 50. +len > (MGMT_MESH_SEND_SIZE + 31) // 19 + 31 = 50. + +Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Brian Gix +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt_util.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt_util.h b/net/bluetooth/mgmt_util.h +index 6a8b7e84293d..bdf978605d5a 100644 +--- a/net/bluetooth/mgmt_util.h ++++ b/net/bluetooth/mgmt_util.h +@@ -27,7 +27,7 @@ struct mgmt_mesh_tx { + struct sock *sk; + u8 handle; + u8 instance; +- u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; ++ u8 param[sizeof(struct mgmt_cp_mesh_send) + 31]; + }; + + struct mgmt_pending_cmd { +-- +2.39.0 + diff --git a/queue-6.1/bluetooth-fix-possible-deadlock-in-rfcomm_sk_state_c.patch b/queue-6.1/bluetooth-fix-possible-deadlock-in-rfcomm_sk_state_c.patch new file mode 100644 index 00000000000..ffdc51868e3 --- /dev/null +++ b/queue-6.1/bluetooth-fix-possible-deadlock-in-rfcomm_sk_state_c.patch @@ -0,0 +1,77 @@ +From ca948a54eae6eba8c5272d3bf323b64f1b2a114a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 03:16:14 +0000 +Subject: Bluetooth: Fix possible deadlock in rfcomm_sk_state_change + +From: Ying Hsu + +[ Upstream commit 1d80d57ffcb55488f0ec0b77928d4f82d16b6a90 ] + +syzbot reports a possible deadlock in rfcomm_sk_state_change [1]. +While rfcomm_sock_connect acquires the sk lock and waits for +the rfcomm lock, rfcomm_sock_release could have the rfcomm +lock and hit a deadlock for acquiring the sk lock. +Here's a simplified flow: + +rfcomm_sock_connect: + lock_sock(sk) + rfcomm_dlc_open: + rfcomm_lock() + +rfcomm_sock_release: + rfcomm_sock_shutdown: + rfcomm_lock() + __rfcomm_dlc_close: + rfcomm_k_state_change: + lock_sock(sk) + +This patch drops the sk lock before calling rfcomm_dlc_open to +avoid the possible deadlock and holds sk's reference count to +prevent use-after-free after rfcomm_dlc_open completes. + +Reported-by: syzbot+d7ce59...@syzkaller.appspotmail.com +Fixes: 1804fdf6e494 ("Bluetooth: btintel: Combine setting up MSFT extension") +Link: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218 [1] + +Signed-off-by: Ying Hsu +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/rfcomm/sock.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c +index 21e24da4847f..4397e14ff560 100644 +--- a/net/bluetooth/rfcomm/sock.c ++++ b/net/bluetooth/rfcomm/sock.c +@@ -391,6 +391,7 @@ static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int a + addr->sa_family != AF_BLUETOOTH) + return -EINVAL; + ++ sock_hold(sk); + lock_sock(sk); + + if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { +@@ -410,14 +411,18 @@ static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int a + d->sec_level = rfcomm_pi(sk)->sec_level; + d->role_switch = rfcomm_pi(sk)->role_switch; + ++ /* Drop sock lock to avoid potential deadlock with the RFCOMM lock */ ++ release_sock(sk); + err = rfcomm_dlc_open(d, &rfcomm_pi(sk)->src, &sa->rc_bdaddr, + sa->rc_channel); +- if (!err) ++ lock_sock(sk); ++ if (!err && !sock_flag(sk, SOCK_ZAPPED)) + err = bt_sock_wait_state(sk, BT_CONNECTED, + sock_sndtimeo(sk, flags & O_NONBLOCK)); + + done: + release_sock(sk); ++ sock_put(sk); + return err; + } + +-- +2.39.0 + diff --git a/queue-6.1/bluetooth-hci_conn-fix-memory-leaks.patch b/queue-6.1/bluetooth-hci_conn-fix-memory-leaks.patch new file mode 100644 index 00000000000..7ddaedffe4f --- /dev/null +++ b/queue-6.1/bluetooth-hci_conn-fix-memory-leaks.patch @@ -0,0 +1,74 @@ +From be5e8378922ad4cbb77726bef6e11b0c0041d4a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 14:46:23 +0800 +Subject: Bluetooth: hci_conn: Fix memory leaks + +From: Zhengchao Shao + +[ Upstream commit 3aa21311f36d8a2730c7ccef37235e951f23927b ] + +When hci_cmd_sync_queue() failed in hci_le_terminate_big() or +hci_le_big_terminate(), the memory pointed by variable d is not freed, +which will cause memory leak. Add release process to error path. + +Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") +Signed-off-by: Zhengchao Shao +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 8aab2e882958..3c3b79f2e4c0 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -821,6 +821,7 @@ static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err) + static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis) + { + struct iso_list_data *d; ++ int ret; + + bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", big, bis); + +@@ -832,8 +833,12 @@ static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis) + d->big = big; + d->bis = bis; + +- return hci_cmd_sync_queue(hdev, terminate_big_sync, d, +- terminate_big_destroy); ++ ret = hci_cmd_sync_queue(hdev, terminate_big_sync, d, ++ terminate_big_destroy); ++ if (ret) ++ kfree(d); ++ ++ return ret; + } + + static int big_terminate_sync(struct hci_dev *hdev, void *data) +@@ -858,6 +863,7 @@ static int big_terminate_sync(struct hci_dev *hdev, void *data) + static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle) + { + struct iso_list_data *d; ++ int ret; + + bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle); + +@@ -869,8 +875,12 @@ static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle) + d->big = big; + d->sync_handle = sync_handle; + +- return hci_cmd_sync_queue(hdev, big_terminate_sync, d, +- terminate_big_destroy); ++ ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d, ++ terminate_big_destroy); ++ if (ret) ++ kfree(d); ++ ++ return ret; + } + + /* Cleanup BIS connection +-- +2.39.0 + diff --git a/queue-6.1/bluetooth-hci_event-fix-invalid-wait-context.patch b/queue-6.1/bluetooth-hci_event-fix-invalid-wait-context.patch new file mode 100644 index 00000000000..f37769e1232 --- /dev/null +++ b/queue-6.1/bluetooth-hci_event-fix-invalid-wait-context.patch @@ -0,0 +1,54 @@ +From ba2eb342a49a70474464bfb182acbc5533ebdd13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 17:04:46 -0800 +Subject: Bluetooth: hci_event: Fix Invalid wait context + +From: Luiz Augusto von Dentz + +[ Upstream commit e9d50f76fe1f7f6f251114919247445fb5cb3734 ] + +This fixes the following trace caused by attempting to lock +cmd_sync_work_lock while holding the rcu_read_lock: + +kworker/u3:2/212 is trying to lock: +ffff888002600910 (&hdev->cmd_sync_work_lock){+.+.}-{3:3}, at: +hci_cmd_sync_queue+0xad/0x140 +other info that might help us debug this: +context-{4:4} +4 locks held by kworker/u3:2/212: + #0: ffff8880028c6530 ((wq_completion)hci0#2){+.+.}-{0:0}, at: + process_one_work+0x4dc/0x9a0 + #1: ffff888001aafde0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, + at: process_one_work+0x4dc/0x9a0 + #2: ffff888002600070 (&hdev->lock){+.+.}-{3:3}, at: + hci_cc_le_set_cig_params+0x64/0x4f0 + #3: ffffffffa5994b00 (rcu_read_lock){....}-{1:2}, at: + hci_cc_le_set_cig_params+0x2f9/0x4f0 + +Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index faca701bce2a..0e2425eb6aa7 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3838,8 +3838,11 @@ static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data, + conn->handle, conn->link); + + /* Create CIS if LE is already connected */ +- if (conn->link && conn->link->state == BT_CONNECTED) ++ if (conn->link && conn->link->state == BT_CONNECTED) { ++ rcu_read_unlock(); + hci_le_create_cis(conn->link); ++ rcu_read_lock(); ++ } + + if (i == rp->num_handles) + break; +-- +2.39.0 + diff --git a/queue-6.1/bluetooth-hci_sync-fix-memory-leak-in-hci_update_adv.patch b/queue-6.1/bluetooth-hci_sync-fix-memory-leak-in-hci_update_adv.patch new file mode 100644 index 00000000000..386cda8b807 --- /dev/null +++ b/queue-6.1/bluetooth-hci_sync-fix-memory-leak-in-hci_update_adv.patch @@ -0,0 +1,52 @@ +From 036ea5ad130807c7c7a7ecd59e3644b10db67041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 09:26:51 +0800 +Subject: Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() + +From: Zhengchao Shao + +[ Upstream commit 1ed8b37cbaf14574c779064ef1372af62e8ba6aa ] + +When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is +not freed, which will cause memory leak, convert to use ERR_PTR/PTR_ERR +to pass the instance to callback so no memory needs to be allocated. + +Fixes: 651cd3d65b0f ("Bluetooth: convert hci_update_adv_data to hci_sync") +Signed-off-by: Zhengchao Shao +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 8d6c8cbfe1de..67dd4c9fa4a5 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -6168,20 +6168,13 @@ int hci_get_random_address(struct hci_dev *hdev, bool require_privacy, + + static int _update_adv_data_sync(struct hci_dev *hdev, void *data) + { +- u8 instance = *(u8 *)data; +- +- kfree(data); ++ u8 instance = PTR_ERR(data); + + return hci_update_adv_data_sync(hdev, instance); + } + + int hci_update_adv_data(struct hci_dev *hdev, u8 instance) + { +- u8 *inst_ptr = kmalloc(1, GFP_KERNEL); +- +- if (!inst_ptr) +- return -ENOMEM; +- +- *inst_ptr = instance; +- return hci_cmd_sync_queue(hdev, _update_adv_data_sync, inst_ptr, NULL); ++ return hci_cmd_sync_queue(hdev, _update_adv_data_sync, ++ ERR_PTR(instance), NULL); + } +-- +2.39.0 + diff --git a/queue-6.1/bluetooth-iso-avoid-circular-locking-dependency.patch b/queue-6.1/bluetooth-iso-avoid-circular-locking-dependency.patch new file mode 100644 index 00000000000..e9a24330e0c --- /dev/null +++ b/queue-6.1/bluetooth-iso-avoid-circular-locking-dependency.patch @@ -0,0 +1,275 @@ +From d0c04ef9c94b4d71bd3aa8313e9c54a5ee19c79d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 16:34:42 -0800 +Subject: Bluetooth: ISO: Avoid circular locking dependency + +From: Luiz Augusto von Dentz + +[ Upstream commit 241f51931c35085449502c10f64fb3ecd6e02171 ] + +This attempts to avoid circular locking dependency between sock_lock +and hdev_lock: + +WARNING: possible circular locking dependency detected +6.0.0-rc7-03728-g18dd8ab0a783 #3 Not tainted +------------------------------------------------------ +kworker/u3:2/53 is trying to acquire lock: +ffff888000254130 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}, at: +iso_conn_del+0xbd/0x1d0 +but task is already holding lock: +ffffffff9f39a080 (hci_cb_list_lock){+.+.}-{3:3}, at: +hci_le_cis_estabilished_evt+0x1b5/0x500 +which lock already depends on the new lock. +the existing dependency chain (in reverse order) is: +-> #2 (hci_cb_list_lock){+.+.}-{3:3}: + __mutex_lock+0x10e/0xfe0 + hci_le_remote_feat_complete_evt+0x17f/0x320 + hci_event_packet+0x39c/0x7d0 + hci_rx_work+0x2bf/0x950 + process_one_work+0x569/0x980 + worker_thread+0x2a3/0x6f0 + kthread+0x153/0x180 + ret_from_fork+0x22/0x30 +-> #1 (&hdev->lock){+.+.}-{3:3}: + __mutex_lock+0x10e/0xfe0 + iso_connect_cis+0x6f/0x5a0 + iso_sock_connect+0x1af/0x710 + __sys_connect+0x17e/0x1b0 + __x64_sys_connect+0x37/0x50 + do_syscall_64+0x43/0x90 + entry_SYSCALL_64_after_hwframe+0x62/0xcc +-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}: + __lock_acquire+0x1b51/0x33d0 + lock_acquire+0x16f/0x3b0 + lock_sock_nested+0x32/0x80 + iso_conn_del+0xbd/0x1d0 + iso_connect_cfm+0x226/0x680 + hci_le_cis_estabilished_evt+0x1ed/0x500 + hci_event_packet+0x39c/0x7d0 + hci_rx_work+0x2bf/0x950 + process_one_work+0x569/0x980 + worker_thread+0x2a3/0x6f0 + kthread+0x153/0x180 + ret_from_fork+0x22/0x30 +other info that might help us debug this: +Chain exists of: + sk_lock-AF_BLUETOOTH-BTPROTO_ISO --> &hdev->lock --> hci_cb_list_lock + Possible unsafe locking scenario: + CPU0 CPU1 + ---- ---- + lock(hci_cb_list_lock); + lock(&hdev->lock); + lock(hci_cb_list_lock); + lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); + *** DEADLOCK *** +4 locks held by kworker/u3:2/53: + #0: ffff8880021d9130 ((wq_completion)hci0#2){+.+.}-{0:0}, at: + process_one_work+0x4ad/0x980 + #1: ffff888002387de0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, + at: process_one_work+0x4ad/0x980 + #2: ffff888001ac0070 (&hdev->lock){+.+.}-{3:3}, at: + hci_le_cis_estabilished_evt+0xc3/0x500 + #3: ffffffff9f39a080 (hci_cb_list_lock){+.+.}-{3:3}, at: + hci_le_cis_estabilished_evt+0x1b5/0x500 + +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 6a5ad251b7cd ("Bluetooth: ISO: Fix possible circular locking dependency") +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 61 ++++++++++++++++++++++++++++----------------- + 1 file changed, 38 insertions(+), 23 deletions(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index 26db929b97c4..df57cbe27b3d 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -261,13 +261,13 @@ static int iso_connect_bis(struct sock *sk) + + if (!bis_capable(hdev)) { + err = -EOPNOTSUPP; +- goto done; ++ goto unlock; + } + + /* Fail if out PHYs are marked as disabled */ + if (!iso_pi(sk)->qos.out.phy) { + err = -EINVAL; +- goto done; ++ goto unlock; + } + + hcon = hci_connect_bis(hdev, &iso_pi(sk)->dst, iso_pi(sk)->dst_type, +@@ -275,22 +275,27 @@ static int iso_connect_bis(struct sock *sk) + iso_pi(sk)->base); + if (IS_ERR(hcon)) { + err = PTR_ERR(hcon); +- goto done; ++ goto unlock; + } + + conn = iso_conn_add(hcon); + if (!conn) { + hci_conn_drop(hcon); + err = -ENOMEM; +- goto done; ++ goto unlock; + } + ++ hci_dev_unlock(hdev); ++ hci_dev_put(hdev); ++ ++ lock_sock(sk); ++ + /* Update source addr of the socket */ + bacpy(&iso_pi(sk)->src, &hcon->src); + + err = iso_chan_add(conn, sk, NULL); + if (err) +- goto done; ++ goto release; + + if (hcon->state == BT_CONNECTED) { + iso_sock_clear_timer(sk); +@@ -300,7 +305,11 @@ static int iso_connect_bis(struct sock *sk) + iso_sock_set_timer(sk, sk->sk_sndtimeo); + } + +-done: ++release: ++ release_sock(sk); ++ return err; ++ ++unlock: + hci_dev_unlock(hdev); + hci_dev_put(hdev); + return err; +@@ -324,13 +333,13 @@ static int iso_connect_cis(struct sock *sk) + + if (!cis_central_capable(hdev)) { + err = -EOPNOTSUPP; +- goto done; ++ goto unlock; + } + + /* Fail if either PHYs are marked as disabled */ + if (!iso_pi(sk)->qos.in.phy && !iso_pi(sk)->qos.out.phy) { + err = -EINVAL; +- goto done; ++ goto unlock; + } + + /* Just bind if DEFER_SETUP has been set */ +@@ -340,7 +349,7 @@ static int iso_connect_cis(struct sock *sk) + &iso_pi(sk)->qos); + if (IS_ERR(hcon)) { + err = PTR_ERR(hcon); +- goto done; ++ goto unlock; + } + } else { + hcon = hci_connect_cis(hdev, &iso_pi(sk)->dst, +@@ -348,7 +357,7 @@ static int iso_connect_cis(struct sock *sk) + &iso_pi(sk)->qos); + if (IS_ERR(hcon)) { + err = PTR_ERR(hcon); +- goto done; ++ goto unlock; + } + } + +@@ -356,15 +365,20 @@ static int iso_connect_cis(struct sock *sk) + if (!conn) { + hci_conn_drop(hcon); + err = -ENOMEM; +- goto done; ++ goto unlock; + } + ++ hci_dev_unlock(hdev); ++ hci_dev_put(hdev); ++ ++ lock_sock(sk); ++ + /* Update source addr of the socket */ + bacpy(&iso_pi(sk)->src, &hcon->src); + + err = iso_chan_add(conn, sk, NULL); + if (err) +- goto done; ++ goto release; + + if (hcon->state == BT_CONNECTED) { + iso_sock_clear_timer(sk); +@@ -377,7 +391,11 @@ static int iso_connect_cis(struct sock *sk) + iso_sock_set_timer(sk, sk->sk_sndtimeo); + } + +-done: ++release: ++ release_sock(sk); ++ return err; ++ ++unlock: + hci_dev_unlock(hdev); + hci_dev_put(hdev); + return err; +@@ -831,20 +849,23 @@ static int iso_sock_connect(struct socket *sock, struct sockaddr *addr, + bacpy(&iso_pi(sk)->dst, &sa->iso_bdaddr); + iso_pi(sk)->dst_type = sa->iso_bdaddr_type; + ++ release_sock(sk); ++ + if (bacmp(&iso_pi(sk)->dst, BDADDR_ANY)) + err = iso_connect_cis(sk); + else + err = iso_connect_bis(sk); + + if (err) +- goto done; ++ return err; ++ ++ lock_sock(sk); + + if (!test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { + err = bt_sock_wait_state(sk, BT_CONNECTED, + sock_sndtimeo(sk, flags & O_NONBLOCK)); + } + +-done: + release_sock(sk); + return err; + } +@@ -1099,28 +1120,22 @@ static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg, + { + struct sock *sk = sock->sk; + struct iso_pinfo *pi = iso_pi(sk); +- int err; + + BT_DBG("sk %p", sk); + +- lock_sock(sk); +- + if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { + switch (sk->sk_state) { + case BT_CONNECT2: ++ lock_sock(sk); + iso_conn_defer_accept(pi->conn->hcon); + sk->sk_state = BT_CONFIG; + release_sock(sk); + return 0; + case BT_CONNECT: +- err = iso_connect_cis(sk); +- release_sock(sk); +- return err; ++ return iso_connect_cis(sk); + } + } + +- release_sock(sk); +- + return bt_sock_recvmsg(sock, msg, len, flags); + } + +-- +2.39.0 + diff --git a/queue-6.1/bluetooth-iso-fix-possible-circular-locking-dependen.patch b/queue-6.1/bluetooth-iso-fix-possible-circular-locking-dependen.patch new file mode 100644 index 00000000000..d68c4f236b3 --- /dev/null +++ b/queue-6.1/bluetooth-iso-fix-possible-circular-locking-dependen.patch @@ -0,0 +1,227 @@ +From f54bf62197128b90041b27db3bc1b1b2d11b5555 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 13:24:51 -0800 +Subject: Bluetooth: ISO: Fix possible circular locking dependency + +From: Luiz Augusto von Dentz + +[ Upstream commit 6a5ad251b7cdb990a3705428aef408433f05614a ] + +This attempts to fix the following trace: + +kworker/u3:1/184 is trying to acquire lock: +ffff888001888130 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}, at: +iso_connect_cfm+0x2de/0x690 + +but task is already holding lock: +ffff8880028d1c20 (&conn->lock){+.+.}-{2:2}, at: +iso_connect_cfm+0x265/0x690 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (&conn->lock){+.+.}-{2:2}: + lock_acquire+0x176/0x3d0 + _raw_spin_lock+0x2a/0x40 + __iso_sock_close+0x1dd/0x4f0 + iso_sock_release+0xa0/0x1b0 + sock_close+0x5e/0x120 + __fput+0x102/0x410 + task_work_run+0xf1/0x160 + exit_to_user_mode_prepare+0x170/0x180 + syscall_exit_to_user_mode+0x19/0x50 + do_syscall_64+0x4e/0x90 + entry_SYSCALL_64_after_hwframe+0x62/0xcc + +-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}: + check_prev_add+0xfc/0x1190 + __lock_acquire+0x1e27/0x2750 + lock_acquire+0x176/0x3d0 + lock_sock_nested+0x32/0x80 + iso_connect_cfm+0x2de/0x690 + hci_cc_le_setup_iso_path+0x195/0x340 + hci_cmd_complete_evt+0x1ae/0x500 + hci_event_packet+0x38e/0x7c0 + hci_rx_work+0x34c/0x980 + process_one_work+0x5a5/0x9a0 + worker_thread+0x89/0x6f0 + kthread+0x14e/0x180 + ret_from_fork+0x22/0x30 + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&conn->lock); + lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); + lock(&conn->lock); + lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); + + *** DEADLOCK *** + +Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") +Fixes: f764a6c2c1e4 ("Bluetooth: ISO: Add broadcast support") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/iso.c | 61 +++++++++++++++++++-------------------------- + 1 file changed, 26 insertions(+), 35 deletions(-) + +diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c +index df57cbe27b3d..2dabef488eaa 100644 +--- a/net/bluetooth/iso.c ++++ b/net/bluetooth/iso.c +@@ -288,15 +288,15 @@ static int iso_connect_bis(struct sock *sk) + hci_dev_unlock(hdev); + hci_dev_put(hdev); + ++ err = iso_chan_add(conn, sk, NULL); ++ if (err) ++ return err; ++ + lock_sock(sk); + + /* Update source addr of the socket */ + bacpy(&iso_pi(sk)->src, &hcon->src); + +- err = iso_chan_add(conn, sk, NULL); +- if (err) +- goto release; +- + if (hcon->state == BT_CONNECTED) { + iso_sock_clear_timer(sk); + sk->sk_state = BT_CONNECTED; +@@ -305,7 +305,6 @@ static int iso_connect_bis(struct sock *sk) + iso_sock_set_timer(sk, sk->sk_sndtimeo); + } + +-release: + release_sock(sk); + return err; + +@@ -371,15 +370,15 @@ static int iso_connect_cis(struct sock *sk) + hci_dev_unlock(hdev); + hci_dev_put(hdev); + ++ err = iso_chan_add(conn, sk, NULL); ++ if (err) ++ return err; ++ + lock_sock(sk); + + /* Update source addr of the socket */ + bacpy(&iso_pi(sk)->src, &hcon->src); + +- err = iso_chan_add(conn, sk, NULL); +- if (err) +- goto release; +- + if (hcon->state == BT_CONNECTED) { + iso_sock_clear_timer(sk); + sk->sk_state = BT_CONNECTED; +@@ -391,7 +390,6 @@ static int iso_connect_cis(struct sock *sk) + iso_sock_set_timer(sk, sk->sk_sndtimeo); + } + +-release: + release_sock(sk); + return err; + +@@ -1430,33 +1428,29 @@ static void iso_conn_ready(struct iso_conn *conn) + struct sock *parent; + struct sock *sk = conn->sk; + struct hci_ev_le_big_sync_estabilished *ev; ++ struct hci_conn *hcon; + + BT_DBG("conn %p", conn); + + if (sk) { + iso_sock_ready(conn->sk); + } else { +- iso_conn_lock(conn); +- +- if (!conn->hcon) { +- iso_conn_unlock(conn); ++ hcon = conn->hcon; ++ if (!hcon) + return; +- } + +- ev = hci_recv_event_data(conn->hcon->hdev, ++ ev = hci_recv_event_data(hcon->hdev, + HCI_EVT_LE_BIG_SYNC_ESTABILISHED); + if (ev) +- parent = iso_get_sock_listen(&conn->hcon->src, +- &conn->hcon->dst, ++ parent = iso_get_sock_listen(&hcon->src, ++ &hcon->dst, + iso_match_big, ev); + else +- parent = iso_get_sock_listen(&conn->hcon->src, ++ parent = iso_get_sock_listen(&hcon->src, + BDADDR_ANY, NULL, NULL); + +- if (!parent) { +- iso_conn_unlock(conn); ++ if (!parent) + return; +- } + + lock_sock(parent); + +@@ -1464,30 +1458,29 @@ static void iso_conn_ready(struct iso_conn *conn) + BTPROTO_ISO, GFP_ATOMIC, 0); + if (!sk) { + release_sock(parent); +- iso_conn_unlock(conn); + return; + } + + iso_sock_init(sk, parent); + +- bacpy(&iso_pi(sk)->src, &conn->hcon->src); +- iso_pi(sk)->src_type = conn->hcon->src_type; ++ bacpy(&iso_pi(sk)->src, &hcon->src); ++ iso_pi(sk)->src_type = hcon->src_type; + + /* If hcon has no destination address (BDADDR_ANY) it means it + * was created by HCI_EV_LE_BIG_SYNC_ESTABILISHED so we need to + * initialize using the parent socket destination address. + */ +- if (!bacmp(&conn->hcon->dst, BDADDR_ANY)) { +- bacpy(&conn->hcon->dst, &iso_pi(parent)->dst); +- conn->hcon->dst_type = iso_pi(parent)->dst_type; +- conn->hcon->sync_handle = iso_pi(parent)->sync_handle; ++ if (!bacmp(&hcon->dst, BDADDR_ANY)) { ++ bacpy(&hcon->dst, &iso_pi(parent)->dst); ++ hcon->dst_type = iso_pi(parent)->dst_type; ++ hcon->sync_handle = iso_pi(parent)->sync_handle; + } + +- bacpy(&iso_pi(sk)->dst, &conn->hcon->dst); +- iso_pi(sk)->dst_type = conn->hcon->dst_type; ++ bacpy(&iso_pi(sk)->dst, &hcon->dst); ++ iso_pi(sk)->dst_type = hcon->dst_type; + +- hci_conn_hold(conn->hcon); +- __iso_chan_add(conn, sk, parent); ++ hci_conn_hold(hcon); ++ iso_chan_add(conn, sk, parent); + + if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) + sk->sk_state = BT_CONNECT2; +@@ -1498,8 +1491,6 @@ static void iso_conn_ready(struct iso_conn *conn) + parent->sk_data_ready(parent); + + release_sock(parent); +- +- iso_conn_unlock(conn); + } + } + +-- +2.39.0 + diff --git a/queue-6.1/bnxt-do-not-read-past-the-end-of-test-names.patch b/queue-6.1/bnxt-do-not-read-past-the-end-of-test-names.patch new file mode 100644 index 00000000000..19388825e6d --- /dev/null +++ b/queue-6.1/bnxt-do-not-read-past-the-end-of-test-names.patch @@ -0,0 +1,95 @@ +From 1bcde7f6382a43e929ca460958411473d2b6a18f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 12:35:01 -0800 +Subject: bnxt: Do not read past the end of test names + +From: Kees Cook + +[ Upstream commit d3e599c090fc6977331150c5f0a69ab8ce87da21 ] + +Test names were being concatenated based on a offset beyond the end of +the first name, which tripped the buffer overflow detection logic: + + detected buffer overflow in strnlen + [...] + Call Trace: + bnxt_ethtool_init.cold+0x18/0x18 + +Refactor struct hwrm_selftest_qlist_output to use an actual array, +and adjust the concatenation to use snprintf() rather than a series of +strncat() calls. + +Reported-by: Niklas Cassel +Link: https://lore.kernel.org/lkml/Y8F%2F1w1AZTvLglFX@x1-carbon/ +Tested-by: Niklas Cassel +Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.") +Cc: Michael Chan +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: netdev@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Michael Chan +Reviewed-by: Niklas Cassel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 13 ++++--------- + drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 9 +-------- + 2 files changed, 5 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 8cad15c458b3..703fc163235f 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -3865,7 +3865,7 @@ void bnxt_ethtool_init(struct bnxt *bp) + test_info->timeout = HWRM_CMD_TIMEOUT; + for (i = 0; i < bp->num_tests; i++) { + char *str = test_info->string[i]; +- char *fw_str = resp->test0_name + i * 32; ++ char *fw_str = resp->test_name[i]; + + if (i == BNXT_MACLPBK_TEST_IDX) { + strcpy(str, "Mac loopback test (offline)"); +@@ -3876,14 +3876,9 @@ void bnxt_ethtool_init(struct bnxt *bp) + } else if (i == BNXT_IRQ_TEST_IDX) { + strcpy(str, "Interrupt_test (offline)"); + } else { +- strscpy(str, fw_str, ETH_GSTRING_LEN); +- strncat(str, " test", ETH_GSTRING_LEN - strlen(str)); +- if (test_info->offline_mask & (1 << i)) +- strncat(str, " (offline)", +- ETH_GSTRING_LEN - strlen(str)); +- else +- strncat(str, " (online)", +- ETH_GSTRING_LEN - strlen(str)); ++ snprintf(str, ETH_GSTRING_LEN, "%s test (%s)", ++ fw_str, test_info->offline_mask & (1 << i) ? ++ "offline" : "online"); + } + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h +index b753032a1047..fb78fc38530d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h +@@ -10099,14 +10099,7 @@ struct hwrm_selftest_qlist_output { + u8 unused_0; + __le16 test_timeout; + u8 unused_1[2]; +- char test0_name[32]; +- char test1_name[32]; +- char test2_name[32]; +- char test3_name[32]; +- char test4_name[32]; +- char test5_name[32]; +- char test6_name[32]; +- char test7_name[32]; ++ char test_name[8][32]; + u8 eyescope_target_BER_support; + #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E8_SUPPORTED 0x0UL + #define SELFTEST_QLIST_RESP_EYESCOPE_TARGET_BER_SUPPORT_BER_1E9_SUPPORTED 0x1UL +-- +2.39.0 + diff --git a/queue-6.1/bpf-fix-pointer-leak-due-to-insufficient-speculative.patch b/queue-6.1/bpf-fix-pointer-leak-due-to-insufficient-speculative.patch new file mode 100644 index 00000000000..077d33d31d1 --- /dev/null +++ b/queue-6.1/bpf-fix-pointer-leak-due-to-insufficient-speculative.patch @@ -0,0 +1,109 @@ +From 58486f656c5e198560022a363d569957a9c790e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 16:05:46 +0100 +Subject: bpf: Fix pointer-leak due to insufficient speculative store bypass + mitigation + +From: Luis Gerhorst + +[ Upstream commit e4f4db47794c9f474b184ee1418f42e6a07412b6 ] + +To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to +insufficient speculative store bypass mitigation") inserts lfence +instructions after 1) initializing a stack slot and 2) spilling a +pointer to the stack. + +However, this does not cover cases where a stack slot is first +initialized with a pointer (subject to sanitization) but then +overwritten with a scalar (not subject to sanitization because +the slot was already initialized). In this case, the second write +may be subject to speculative store bypass (SSB) creating a +speculative pointer-as-scalar type confusion. This allows the +program to subsequently leak the numerical pointer value using, +for example, a branch-based cache side channel. + +To fix this, also sanitize scalars if they write a stack slot +that previously contained a pointer. Assuming that pointer-spills +are only generated by LLVM on register-pressure, the performance +impact on most real-world BPF programs should be small. + +The following unprivileged BPF bytecode drafts a minimal exploit +and the mitigation: + + [...] + // r6 = 0 or 1 (skalar, unknown user input) + // r7 = accessible ptr for side channel + // r10 = frame pointer (fp), to be leaked + // + r9 = r10 # fp alias to encourage ssb + *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked + // lfence added here because of pointer spill to stack. + // + // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor + // for no r9-r10 dependency. + // + *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr + // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, + // store may be subject to SSB + // + // fix: also add an lfence when the slot contained a ptr + // + r8 = *(u64 *)(r9 - 8) + // r8 = architecturally a scalar, speculatively a ptr + // + // leak ptr using branch-based cache side channel: + r8 &= 1 // choose bit to leak + if r8 == 0 goto SLOW // no mispredict + // architecturally dead code if input r6 is 0, + // only executes speculatively iff ptr bit is 1 + r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast) +SLOW: + [...] + +After running this, the program can time the access to *(r7 + 0) to +determine whether the chosen pointer bit was 0 or 1. Repeat this 64 +times to recover the whole address on amd64. + +In summary, sanitization can only be skipped if one scalar is +overwritten with another scalar. Scalar-confusion due to speculative +store bypass can not lead to invalid accesses because the pointer +bounds deducted during verification are enforced using branchless +logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on +pointer arithmetic") for details. + +Do not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks} +because speculative leaks are likely unexpected if these were enabled. +For example, leaking the address to a protected log file may be acceptable +while disabling the mitigation might unintentionally leak the address +into the cached-state of a map that is accessible to unprivileged +processes. + +Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") +Signed-off-by: Luis Gerhorst +Signed-off-by: Daniel Borkmann +Acked-by: Henriette Hofmeier +Link: https://lore.kernel.org/bpf/edc95bad-aada-9cfc-ffe2-fa9bb206583c@cs.fau.de +Link: https://lore.kernel.org/bpf/20230109150544.41465-1-gerhorst@cs.fau.de +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index b4d5b343c191..398a0008aff7 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3063,7 +3063,9 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, + bool sanitize = reg && is_spillable_regtype(reg->type); + + for (i = 0; i < size; i++) { +- if (state->stack[spi].slot_type[i] == STACK_INVALID) { ++ u8 type = state->stack[spi].slot_type[i]; ++ ++ if (type != STACK_MISC && type != STACK_ZERO) { + sanitize = true; + break; + } +-- +2.39.0 + diff --git a/queue-6.1/bpf-hash-map-avoid-deadlock-with-suitable-hash-mask.patch b/queue-6.1/bpf-hash-map-avoid-deadlock-with-suitable-hash-mask.patch new file mode 100644 index 00000000000..269fbd89614 --- /dev/null +++ b/queue-6.1/bpf-hash-map-avoid-deadlock-with-suitable-hash-mask.patch @@ -0,0 +1,68 @@ +From b16e5e220c4ece0e0493bbd658dec104a2b26d87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 17:29:01 +0800 +Subject: bpf: hash map, avoid deadlock with suitable hash mask + +From: Tonghao Zhang + +[ Upstream commit 9f907439dc80e4a2fcfb949927b36c036468dbb3 ] + +The deadlock still may occur while accessed in NMI and non-NMI +context. Because in NMI, we still may access the same bucket but with +different map_locked index. + +For example, on the same CPU, .max_entries = 2, we update the hash map, +with key = 4, while running bpf prog in NMI nmi_handle(), to update +hash map with key = 20, so it will have the same bucket index but have +different map_locked index. + +To fix this issue, using min mask to hash again. + +Fixes: 20b6cc34ea74 ("bpf: Avoid hashtab deadlock with map_locked") +Signed-off-by: Tonghao Zhang +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Cc: Andrii Nakryiko +Cc: Martin KaFai Lau +Cc: Song Liu +Cc: Yonghong Song +Cc: John Fastabend +Cc: KP Singh +Cc: Stanislav Fomichev +Cc: Hao Luo +Cc: Jiri Olsa +Cc: Hou Tao +Acked-by: Yonghong Song +Acked-by: Hou Tao +Link: https://lore.kernel.org/r/20230111092903.92389-1-tong@infragraf.org +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + kernel/bpf/hashtab.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index f39ee3e05589..c4811984fafa 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -152,7 +152,7 @@ static inline int htab_lock_bucket(const struct bpf_htab *htab, + { + unsigned long flags; + +- hash = hash & HASHTAB_MAP_LOCK_MASK; ++ hash = hash & min_t(u32, HASHTAB_MAP_LOCK_MASK, htab->n_buckets - 1); + + preempt_disable(); + if (unlikely(__this_cpu_inc_return(*(htab->map_locked[hash])) != 1)) { +@@ -171,7 +171,7 @@ static inline void htab_unlock_bucket(const struct bpf_htab *htab, + struct bucket *b, u32 hash, + unsigned long flags) + { +- hash = hash & HASHTAB_MAP_LOCK_MASK; ++ hash = hash & min_t(u32, HASHTAB_MAP_LOCK_MASK, htab->n_buckets - 1); + raw_spin_unlock_irqrestore(&b->raw_lock, flags); + __this_cpu_dec(*(htab->map_locked[hash])); + preempt_enable(); +-- +2.39.0 + diff --git a/queue-6.1/btrfs-zoned-enable-metadata-over-commit-for-non-zns-.patch b/queue-6.1/btrfs-zoned-enable-metadata-over-commit-for-non-zns-.patch new file mode 100644 index 00000000000..c45ce3705fb --- /dev/null +++ b/queue-6.1/btrfs-zoned-enable-metadata-over-commit-for-non-zns-.patch @@ -0,0 +1,84 @@ +From 564f20d957d613b9eaea34e95032d743df21cc01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 15:04:32 +0900 +Subject: btrfs: zoned: enable metadata over-commit for non-ZNS setup + +From: Naohiro Aota + +[ Upstream commit 85e79ec7b78f863178ca488fd8cb5b3de6347756 ] + +The commit 79417d040f4f ("btrfs: zoned: disable metadata overcommit for +zoned") disabled the metadata over-commit to track active zones properly. + +However, it also introduced a heavy overhead by allocating new metadata +block groups and/or flushing dirty buffers to release the space +reservations. Specifically, a workload (write only without any sync +operations) worsen its performance from 343.77 MB/sec (v5.19) to 182.89 +MB/sec (v6.0). + +The performance is still bad on current misc-next which is 187.95 MB/sec. +And, with this patch applied, it improves back to 326.70 MB/sec (+73.82%). + +This patch introduces a new fs_info->flag BTRFS_FS_NO_OVERCOMMIT to +indicate it needs to disable the metadata over-commit. The flag is enabled +when a device with max active zones limit is loaded into a file-system. + +Fixes: 79417d040f4f ("btrfs: zoned: disable metadata overcommit for zoned") +CC: stable@vger.kernel.org # 6.0+ +Reviewed-by: Johannes Thumshirn +Signed-off-by: Naohiro Aota +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ctree.h | 6 ++++++ + fs/btrfs/space-info.c | 3 ++- + fs/btrfs/zoned.c | 2 ++ + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 9e6d48ff4597..a3febabacec0 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -590,6 +590,12 @@ enum { + /* Indicate we have to finish a zone to do next allocation. */ + BTRFS_FS_NEED_ZONE_FINISH, + ++ /* ++ * Indicate metadata over-commit is disabled. This is set when active ++ * zone tracking is needed. ++ */ ++ BTRFS_FS_NO_OVERCOMMIT, ++ + #if BITS_PER_LONG == 32 + /* Indicate if we have error/warn message printed on 32bit systems */ + BTRFS_FS_32BIT_ERROR, +diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c +index f171bf875633..65c010159fb5 100644 +--- a/fs/btrfs/space-info.c ++++ b/fs/btrfs/space-info.c +@@ -404,7 +404,8 @@ int btrfs_can_overcommit(struct btrfs_fs_info *fs_info, + return 0; + + used = btrfs_space_info_used(space_info, true); +- if (btrfs_is_zoned(fs_info) && (space_info->flags & BTRFS_BLOCK_GROUP_METADATA)) ++ if (test_bit(BTRFS_FS_NO_OVERCOMMIT, &fs_info->flags) && ++ (space_info->flags & BTRFS_BLOCK_GROUP_METADATA)) + avail = 0; + else + avail = calc_available_free_space(fs_info, space_info, flush); +diff --git a/fs/btrfs/zoned.c b/fs/btrfs/zoned.c +index c9e2b0c85309..056f002263db 100644 +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -538,6 +538,8 @@ int btrfs_get_dev_zone_info(struct btrfs_device *device, bool populate_cache) + } + atomic_set(&zone_info->active_zones_left, + max_active_zones - nactive); ++ /* Overcommit does not work well with active zone tacking. */ ++ set_bit(BTRFS_FS_NO_OVERCOMMIT, &fs_info->flags); + } + + /* Validate superblock log */ +-- +2.39.0 + diff --git a/queue-6.1/cifs-fix-potential-deadlock-in-cache_refresh_path.patch b/queue-6.1/cifs-fix-potential-deadlock-in-cache_refresh_path.patch new file mode 100644 index 00000000000..bfe915ff6cd --- /dev/null +++ b/queue-6.1/cifs-fix-potential-deadlock-in-cache_refresh_path.patch @@ -0,0 +1,119 @@ +From 8b3f1d19ede28467ab68f4df2d7a18de17e2f2b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 19:00:37 -0300 +Subject: cifs: fix potential deadlock in cache_refresh_path() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paulo Alcantara + +[ Upstream commit 9fb0db40513e27537fde63287aea920b60557a69 ] + +Avoid getting DFS referral from an exclusive lock in +cache_refresh_path() because the tcon IPC used for getting the +referral could be disconnected and thus causing a deadlock as shown +below: + +task A task B +====== ====== +cifs_demultiplex_thread() dfs_cache_find() + cifs_handle_standard() cache_refresh_path() + reconnect_dfs_server() down_write() + dfs_cache_noreq_find() get_dfs_referral() + down_read() <- deadlock smb2_get_dfs_refer() + SMB2_ioctl() + cifs_send_recv() + compound_send_recv() + wait_for_response() + +where task A cannot wake up task B because it is blocked on +down_read() due to the exclusive lock held in cache_refresh_path() and +therefore not being able to make progress. + +Fixes: c9f711039905 ("cifs: keep referral server sessions alive") +Reviewed-by: Aurélien Aptel +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/dfs_cache.c | 42 +++++++++++++++++++++++------------------- + 1 file changed, 23 insertions(+), 19 deletions(-) + +diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c +index e70915ad7541..4302dc75843c 100644 +--- a/fs/cifs/dfs_cache.c ++++ b/fs/cifs/dfs_cache.c +@@ -792,26 +792,27 @@ static int get_dfs_referral(const unsigned int xid, struct cifs_ses *ses, const + */ + static int cache_refresh_path(const unsigned int xid, struct cifs_ses *ses, const char *path) + { +- int rc; +- struct cache_entry *ce; + struct dfs_info3_param *refs = NULL; ++ struct cache_entry *ce; + int numrefs = 0; +- bool newent = false; ++ int rc; + + cifs_dbg(FYI, "%s: search path: %s\n", __func__, path); + +- down_write(&htable_rw_lock); ++ down_read(&htable_rw_lock); + + ce = lookup_cache_entry(path); +- if (!IS_ERR(ce)) { +- if (!cache_entry_expired(ce)) { +- dump_ce(ce); +- up_write(&htable_rw_lock); +- return 0; +- } +- } else { +- newent = true; ++ if (!IS_ERR(ce) && !cache_entry_expired(ce)) { ++ up_read(&htable_rw_lock); ++ return 0; + } ++ /* ++ * Unlock shared access as we don't want to hold any locks while getting ++ * a new referral. The @ses used for performing the I/O could be ++ * reconnecting and it acquires @htable_rw_lock to look up the dfs cache ++ * in order to failover -- if necessary. ++ */ ++ up_read(&htable_rw_lock); + + /* + * Either the entry was not found, or it is expired. +@@ -819,19 +820,22 @@ static int cache_refresh_path(const unsigned int xid, struct cifs_ses *ses, cons + */ + rc = get_dfs_referral(xid, ses, path, &refs, &numrefs); + if (rc) +- goto out_unlock; ++ goto out; + + dump_refs(refs, numrefs); + +- if (!newent) { +- rc = update_cache_entry_locked(ce, refs, numrefs); +- goto out_unlock; ++ down_write(&htable_rw_lock); ++ /* Re-check as another task might have it added or refreshed already */ ++ ce = lookup_cache_entry(path); ++ if (!IS_ERR(ce)) { ++ if (cache_entry_expired(ce)) ++ rc = update_cache_entry_locked(ce, refs, numrefs); ++ } else { ++ rc = add_cache_entry_locked(refs, numrefs); + } + +- rc = add_cache_entry_locked(refs, numrefs); +- +-out_unlock: + up_write(&htable_rw_lock); ++out: + free_dfs_info_array(refs, numrefs); + return rc; + } +-- +2.39.0 + diff --git a/queue-6.1/cifs-fix-potential-memory-leaks-in-session-setup.patch b/queue-6.1/cifs-fix-potential-memory-leaks-in-session-setup.patch new file mode 100644 index 00000000000..d7341db8a5a --- /dev/null +++ b/queue-6.1/cifs-fix-potential-memory-leaks-in-session-setup.patch @@ -0,0 +1,68 @@ +From 7d70b90dcb6b5218d67484c749887ddc7d275b59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 20:35:46 -0300 +Subject: cifs: fix potential memory leaks in session setup + +From: Paulo Alcantara + +[ Upstream commit 2fe58d977ee05da5bb89ef5dc4f5bf2dc15db46f ] + +Make sure to free cifs_ses::auth_key.response before allocating it as +we might end up leaking memory in reconnect or mounting. + +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsencrypt.c | 1 + + fs/cifs/sess.c | 2 ++ + fs/cifs/smb2pdu.c | 1 + + 3 files changed, 4 insertions(+) + +diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c +index 5db73c0f792a..cbc18b4a9cb2 100644 +--- a/fs/cifs/cifsencrypt.c ++++ b/fs/cifs/cifsencrypt.c +@@ -278,6 +278,7 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp) + * ( for NTLMSSP_AV_NB_DOMAIN_NAME followed by NTLMSSP_AV_EOL ) + + * unicode length of a netbios domain name + */ ++ kfree_sensitive(ses->auth_key.response); + ses->auth_key.len = size + 2 * dlen; + ses->auth_key.response = kzalloc(ses->auth_key.len, GFP_KERNEL); + if (!ses->auth_key.response) { +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index 0b842a07e157..c47b254f0d1e 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -815,6 +815,7 @@ int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len, + return -EINVAL; + } + if (tilen) { ++ kfree_sensitive(ses->auth_key.response); + ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen, + GFP_KERNEL); + if (!ses->auth_key.response) { +@@ -1428,6 +1429,7 @@ sess_auth_kerberos(struct sess_data *sess_data) + goto out_put_spnego_key; + } + ++ kfree_sensitive(ses->auth_key.response); + ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, + GFP_KERNEL); + if (!ses->auth_key.response) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 92f39052d311..2c9ffa921e6f 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1453,6 +1453,7 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) + + /* keep session key if binding */ + if (!is_binding) { ++ kfree_sensitive(ses->auth_key.response); + ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len, + GFP_KERNEL); + if (!ses->auth_key.response) { +-- +2.39.0 + diff --git a/queue-6.1/cpufreq-add-sm6375-to-cpufreq-dt-platdev-blocklist.patch b/queue-6.1/cpufreq-add-sm6375-to-cpufreq-dt-platdev-blocklist.patch new file mode 100644 index 00000000000..609b56299dd --- /dev/null +++ b/queue-6.1/cpufreq-add-sm6375-to-cpufreq-dt-platdev-blocklist.patch @@ -0,0 +1,34 @@ +From 127dced3e3c4edfb768f73a206ba788dc5a00287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 18:11:29 +0100 +Subject: cpufreq: Add SM6375 to cpufreq-dt-platdev blocklist + +From: Konrad Dybcio + +[ Upstream commit faf28e240dd118d9521c68aeb9388b9b8f02d9d0 ] + +The Qualcomm SM6375 platform uses the qcom-cpufreq-hw driver, so add +it to the cpufreq-dt-platdev driver's blocklist. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index 54ae8118d528..69a8742c0a7a 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -149,6 +149,7 @@ static const struct of_device_id blocklist[] __initconst = { + { .compatible = "qcom,sdm845", }, + { .compatible = "qcom,sm6115", }, + { .compatible = "qcom,sm6350", }, ++ { .compatible = "qcom,sm6375", }, + { .compatible = "qcom,sm8150", }, + { .compatible = "qcom,sm8250", }, + { .compatible = "qcom,sm8350", }, +-- +2.39.0 + diff --git a/queue-6.1/cpufreq-add-tegra234-to-cpufreq-dt-platdev-blocklist.patch b/queue-6.1/cpufreq-add-tegra234-to-cpufreq-dt-platdev-blocklist.patch new file mode 100644 index 00000000000..d1196abae8f --- /dev/null +++ b/queue-6.1/cpufreq-add-tegra234-to-cpufreq-dt-platdev-blocklist.patch @@ -0,0 +1,35 @@ +From 73e2258c20a3f5cafd296d3bbe3397ae0bedcb4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 21:32:37 +0530 +Subject: cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist + +From: Sumit Gupta + +[ Upstream commit 01c5bb0cc2a39fbc56ff9a5ef28b79447f0c2351 ] + +Tegra234 platform uses the tegra194-cpufreq driver, so add it +to the blocklist in cpufreq-dt-platdev driver to avoid the cpufreq +driver registration from there. + +Signed-off-by: Sumit Gupta +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index 6ac3800db450..54ae8118d528 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -135,6 +135,7 @@ static const struct of_device_id blocklist[] __initconst = { + { .compatible = "nvidia,tegra30", }, + { .compatible = "nvidia,tegra124", }, + { .compatible = "nvidia,tegra210", }, ++ { .compatible = "nvidia,tegra234", }, + + { .compatible = "qcom,apq8096", }, + { .compatible = "qcom,msm8996", }, +-- +2.39.0 + diff --git a/queue-6.1/cpufreq-armada-37xx-stop-using-0-as-null-pointer.patch b/queue-6.1/cpufreq-armada-37xx-stop-using-0-as-null-pointer.patch new file mode 100644 index 00000000000..6cb0eeb9691 --- /dev/null +++ b/queue-6.1/cpufreq-armada-37xx-stop-using-0-as-null-pointer.patch @@ -0,0 +1,35 @@ +From 7f6229288137cd3c6f6f127e638bb9855f7b469c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 11:12:52 +0800 +Subject: cpufreq: armada-37xx: stop using 0 as NULL pointer + +From: Miles Chen + +[ Upstream commit 08f0adb193c008de640fde34a2e00a666c01d77c ] + +Use NULL for NULL pointer to fix the following sparse warning: +drivers/cpufreq/armada-37xx-cpufreq.c:448:32: sparse: warning: Using plain integer as NULL pointer + +Signed-off-by: Miles Chen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index c10fc33b29b1..b74289a95a17 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -445,7 +445,7 @@ static int __init armada37xx_cpufreq_driver_init(void) + return -ENODEV; + } + +- clk = clk_get(cpu_dev, 0); ++ clk = clk_get(cpu_dev, NULL); + if (IS_ERR(clk)) { + dev_err(cpu_dev, "Cannot get clock for CPU0\n"); + return PTR_ERR(clk); +-- +2.39.0 + diff --git a/queue-6.1/cpufreq-cppc-add-u64-casts-to-avoid-overflowing.patch b/queue-6.1/cpufreq-cppc-add-u64-casts-to-avoid-overflowing.patch new file mode 100644 index 00000000000..434e41a0ba5 --- /dev/null +++ b/queue-6.1/cpufreq-cppc-add-u64-casts-to-avoid-overflowing.patch @@ -0,0 +1,51 @@ +From 2f6cc1f4c3b9f6e3de24086dcfe5ce5b5e20af7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 11:12:25 +0100 +Subject: cpufreq: CPPC: Add u64 casts to avoid overflowing + +From: Pierre Gondois + +[ Upstream commit f5f94b9c8b805d87ff185caf9779c3a4d07819e3 ] + +The fields of the _CPC object are unsigned 32-bits values. +To avoid overflows while using _CPC's values, add 'u64' casts. + +Signed-off-by: Pierre Gondois +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cppc_cpufreq.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c +index 432dfb4e8027..022e3555407c 100644 +--- a/drivers/cpufreq/cppc_cpufreq.c ++++ b/drivers/cpufreq/cppc_cpufreq.c +@@ -487,7 +487,8 @@ static unsigned int get_perf_level_count(struct cpufreq_policy *policy) + cpu_data = policy->driver_data; + perf_caps = &cpu_data->perf_caps; + max_cap = arch_scale_cpu_capacity(cpu); +- min_cap = div_u64(max_cap * perf_caps->lowest_perf, perf_caps->highest_perf); ++ min_cap = div_u64((u64)max_cap * perf_caps->lowest_perf, ++ perf_caps->highest_perf); + if ((min_cap == 0) || (max_cap < min_cap)) + return 0; + return 1 + max_cap / CPPC_EM_CAP_STEP - min_cap / CPPC_EM_CAP_STEP; +@@ -519,10 +520,10 @@ static int cppc_get_cpu_power(struct device *cpu_dev, + cpu_data = policy->driver_data; + perf_caps = &cpu_data->perf_caps; + max_cap = arch_scale_cpu_capacity(cpu_dev->id); +- min_cap = div_u64(max_cap * perf_caps->lowest_perf, +- perf_caps->highest_perf); +- +- perf_step = CPPC_EM_CAP_STEP * perf_caps->highest_perf / max_cap; ++ min_cap = div_u64((u64)max_cap * perf_caps->lowest_perf, ++ perf_caps->highest_perf); ++ perf_step = div_u64((u64)CPPC_EM_CAP_STEP * perf_caps->highest_perf, ++ max_cap); + min_step = min_cap / CPPC_EM_CAP_STEP; + max_step = max_cap / CPPC_EM_CAP_STEP; + +-- +2.39.0 + diff --git a/queue-6.1/device-property-fix-of-node-refcount-leak-in-fwnode_.patch b/queue-6.1/device-property-fix-of-node-refcount-leak-in-fwnode_.patch new file mode 100644 index 00000000000..24321194258 --- /dev/null +++ b/queue-6.1/device-property-fix-of-node-refcount-leak-in-fwnode_.patch @@ -0,0 +1,76 @@ +From ac2bc03160945e4928aa1874189ca2994ddc9ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 10:25:42 +0800 +Subject: device property: fix of node refcount leak in + fwnode_graph_get_next_endpoint() + +From: Yang Yingliang + +[ Upstream commit 39af728649b05e88a2b40e714feeee6451c3f18e ] + +The 'parent' returned by fwnode_graph_get_port_parent() +with refcount incremented when 'prev' is not NULL, it +needs be put when finish using it. + +Because the parent is const, introduce a new variable to +store the returned fwnode, then put it before returning +from fwnode_graph_get_next_endpoint(). + +Fixes: b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()") +Signed-off-by: Yang Yingliang +Reviewed-by: Sakari Ailus +Reviewed-by: Andy Shevchenko +Reviewed-and-tested-by: Daniel Scally +Link: https://lore.kernel.org/r/20221123022542.2999510-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index 2a5a37fcd998..7f338cb4fb7b 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -989,26 +989,32 @@ struct fwnode_handle * + fwnode_graph_get_next_endpoint(const struct fwnode_handle *fwnode, + struct fwnode_handle *prev) + { ++ struct fwnode_handle *ep, *port_parent = NULL; + const struct fwnode_handle *parent; +- struct fwnode_handle *ep; + + /* + * If this function is in a loop and the previous iteration returned + * an endpoint from fwnode->secondary, then we need to use the secondary + * as parent rather than @fwnode. + */ +- if (prev) +- parent = fwnode_graph_get_port_parent(prev); +- else ++ if (prev) { ++ port_parent = fwnode_graph_get_port_parent(prev); ++ parent = port_parent; ++ } else { + parent = fwnode; ++ } + if (IS_ERR_OR_NULL(parent)) + return NULL; + + ep = fwnode_call_ptr_op(parent, graph_get_next_endpoint, prev); + if (ep) +- return ep; ++ goto out_put_port_parent; ++ ++ ep = fwnode_graph_get_next_endpoint(parent->secondary, NULL); + +- return fwnode_graph_get_next_endpoint(parent->secondary, NULL); ++out_put_port_parent: ++ fwnode_handle_put(port_parent); ++ return ep; + } + EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint); + +-- +2.39.0 + diff --git a/queue-6.1/dmaengine-fix-double-increment-of-client_count-in-dm.patch b/queue-6.1/dmaengine-fix-double-increment-of-client_count-in-dm.patch new file mode 100644 index 00000000000..54011acd042 --- /dev/null +++ b/queue-6.1/dmaengine-fix-double-increment-of-client_count-in-dm.patch @@ -0,0 +1,126 @@ +From f364a8b163a083fd7feaee58c7f98b210827b815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 11:00:50 +0800 +Subject: dmaengine: Fix double increment of client_count in dma_chan_get() + +From: Koba Ko + +[ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] + +The first time dma_chan_get() is called for a channel the channel +client_count is incorrectly incremented twice for public channels, +first in balance_ref_count(), and again prior to returning. This +results in an incorrect client count which will lead to the +channel resources not being freed when they should be. A simple + test of repeated module load and unload of async_tx on a Dell + Power Edge R7425 also shows this resulting in a kref underflow + warning. + +[ 124.329662] async_tx: api initialized (async) +[ 129.000627] async_tx: api initialized (async) +[ 130.047839] ------------[ cut here ]------------ +[ 130.052472] refcount_t: underflow; use-after-free. +[ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 +refcount_warn_saturate+0xba/0x110 +[ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr +intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm +mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si +syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops +k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat +fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul +libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas +i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash +dm_log dm_mod [last unloaded: async_tx] +[ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not +tainted 5.14.0-185.el9.x86_64 #1 +[ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS +1.18.0 01/17/2022 +[ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 +[ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d +26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a +bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff +48 c7 +[ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 +[ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 +[ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 +[ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff +[ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 +[ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +[ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) +knlGS:0000000000000000 +[ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 +[ 130.219729] Call Trace: +[ 130.222192] +[ 130.224305] dma_chan_put+0x10d/0x110 +[ 130.227988] dmaengine_put+0x7a/0xa0 +[ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 +[ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 +[ 130.242652] do_syscall_64+0x5c/0x90 +[ 130.246240] ? exc_page_fault+0x62/0x150 +[ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd +[ 130.255243] RIP: 0033:0x7f6463a3f5ab +[ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 +83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 +00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 +01 48 +[ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: +00000000000000b0 +[ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab +[ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 +[ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 +[ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 +[ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 +[ 130.320875] +[ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- + +cat /sys/class/dma/dma0chan*/in_use would get the wrong result. +2 +2 +2 + +Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") +Signed-off-by: Koba Ko +Reviewed-by: Jie Hai +Test-by: Jie Hai +Reviewed-by: Jerry Snitselaar +Reviewed-by: Dave Jiang +Tested-by: Joel Savitz +Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dmaengine.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c +index c741b6431958..8a6e6b60d66f 100644 +--- a/drivers/dma/dmaengine.c ++++ b/drivers/dma/dmaengine.c +@@ -451,7 +451,8 @@ static int dma_chan_get(struct dma_chan *chan) + /* The channel is already in use, update client count */ + if (chan->client_count) { + __module_get(owner); +- goto out; ++ chan->client_count++; ++ return 0; + } + + if (!try_module_get(owner)) +@@ -470,11 +471,11 @@ static int dma_chan_get(struct dma_chan *chan) + goto err_out; + } + ++ chan->client_count++; ++ + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) + balance_ref_count(chan); + +-out: +- chan->client_count++; + return 0; + + err_out: +-- +2.39.0 + diff --git a/queue-6.1/dmaengine-qcom-gpi-set-link_rx-bit-on-go-tre-for-rx-.patch b/queue-6.1/dmaengine-qcom-gpi-set-link_rx-bit-on-go-tre-for-rx-.patch new file mode 100644 index 00000000000..127747556a5 --- /dev/null +++ b/queue-6.1/dmaengine-qcom-gpi-set-link_rx-bit-on-go-tre-for-rx-.patch @@ -0,0 +1,42 @@ +From 373ea6409d4c4f1e38d3cbacf49181d8146a753b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 23:08:13 +0530 +Subject: dmaengine: qcom: gpi: Set link_rx bit on GO TRE for rx operation + +From: Vijaya Krishna Nivarthi + +[ Upstream commit 25e8ac233d24051e2c4ff64c34f60609b0988568 ] + +Rx operation on SPI GSI DMA is currently not working. +As per GSI spec, link_rx bit is to be set on GO TRE on tx +channel whenever there is going to be a DMA TRE on rx +channel. This is currently set for duplex operation only. + +Set the bit for rx operation as well. +This is part of changes required to bring up Rx. + +Fixes: 94b8f0e58fa1 ("dmaengine: qcom: gpi: set chain and link flag for duplex") +Signed-off-by: Vijaya Krishna Nivarthi +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/1671212293-14767-1-git-send-email-quic_vnivarth@quicinc.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/qcom/gpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c +index 3f56514bbef8..98d45ee4b4e3 100644 +--- a/drivers/dma/qcom/gpi.c ++++ b/drivers/dma/qcom/gpi.c +@@ -1756,6 +1756,7 @@ static int gpi_create_spi_tre(struct gchan *chan, struct gpi_desc *desc, + tre->dword[3] = u32_encode_bits(TRE_TYPE_GO, TRE_FLAGS_TYPE); + if (spi->cmd == SPI_RX) { + tre->dword[3] |= u32_encode_bits(1, TRE_FLAGS_IEOB); ++ tre->dword[3] |= u32_encode_bits(1, TRE_FLAGS_LINK); + } else if (spi->cmd == SPI_TX) { + tre->dword[3] |= u32_encode_bits(1, TRE_FLAGS_CHAIN); + } else { /* SPI_DUPLEX */ +-- +2.39.0 + diff --git a/queue-6.1/dmaengine-tegra-fix-memory-leak-in-terminate_all.patch b/queue-6.1/dmaengine-tegra-fix-memory-leak-in-terminate_all.patch new file mode 100644 index 00000000000..b79504a9b42 --- /dev/null +++ b/queue-6.1/dmaengine-tegra-fix-memory-leak-in-terminate_all.patch @@ -0,0 +1,40 @@ +From 4c18a860a7611473b13046513fddef9c0238c4f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 17:28:01 +0530 +Subject: dmaengine: tegra: Fix memory leak in terminate_all() + +From: Akhil R + +[ Upstream commit a7a7ee6f5a019ad72852c001abbce50d35e992f2 ] + +Terminate vdesc when terminating an ongoing transfer. +This will ensure that the vdesc is present in the desc_terminated list +The descriptor will be freed later in desc_free_list(). + +This fixes the memory leaks which can happen when terminating an +ongoing transfer. + +Fixes: ee17028009d4 ("dmaengine: tegra: Add tegra gpcdma driver") +Signed-off-by: Akhil R +Link: https://lore.kernel.org/r/20230118115801.15210-1-akhilrajeev@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/tegra186-gpc-dma.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/tegra186-gpc-dma.c b/drivers/dma/tegra186-gpc-dma.c +index fa9bda4a2bc6..75af3488a3ba 100644 +--- a/drivers/dma/tegra186-gpc-dma.c ++++ b/drivers/dma/tegra186-gpc-dma.c +@@ -707,6 +707,7 @@ static int tegra_dma_terminate_all(struct dma_chan *dc) + return err; + } + ++ vchan_terminate_vdesc(&tdc->dma_desc->vd); + tegra_dma_disable(tdc); + tdc->dma_desc = NULL; + } +-- +2.39.0 + diff --git a/queue-6.1/dmaengine-ti-k3-udma-do-conditional-decrement-of-udm.patch b/queue-6.1/dmaengine-ti-k3-udma-do-conditional-decrement-of-udm.patch new file mode 100644 index 00000000000..0058a11eb6a --- /dev/null +++ b/queue-6.1/dmaengine-ti-k3-udma-do-conditional-decrement-of-udm.patch @@ -0,0 +1,48 @@ +From 2a5f92dd2ce3ed3e5bc88c57c6566d30b934d5e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 14:20:05 +0530 +Subject: dmaengine: ti: k3-udma: Do conditional decrement of + UDMA_CHAN_RT_PEER_BCNT_REG + +From: Jayesh Choudhary + +[ Upstream commit efab25894a41a920d9581183741e7fadba00719c ] + +PSIL_EP_NATIVE endpoints may not have PEER registers for BCNT and thus +udma_decrement_byte_counters() should not try to decrement these counters. +This fixes the issue of crypto IPERF testing where the client side (EVM) +hangs without transfer of packets to the server side, seen since this +function was added. + +Fixes: 7c94dcfa8fcf ("dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow") +Signed-off-by: Jayesh Choudhary +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20221128085005.489964-1-j-choudhary@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c +index 7b5081989b3d..b86b809eb1f7 100644 +--- a/drivers/dma/ti/k3-udma.c ++++ b/drivers/dma/ti/k3-udma.c +@@ -761,11 +761,12 @@ static void udma_decrement_byte_counters(struct udma_chan *uc, u32 val) + if (uc->desc->dir == DMA_DEV_TO_MEM) { + udma_rchanrt_write(uc, UDMA_CHAN_RT_BCNT_REG, val); + udma_rchanrt_write(uc, UDMA_CHAN_RT_SBCNT_REG, val); +- udma_rchanrt_write(uc, UDMA_CHAN_RT_PEER_BCNT_REG, val); ++ if (uc->config.ep_type != PSIL_EP_NATIVE) ++ udma_rchanrt_write(uc, UDMA_CHAN_RT_PEER_BCNT_REG, val); + } else { + udma_tchanrt_write(uc, UDMA_CHAN_RT_BCNT_REG, val); + udma_tchanrt_write(uc, UDMA_CHAN_RT_SBCNT_REG, val); +- if (!uc->bchan) ++ if (!uc->bchan && uc->config.ep_type != PSIL_EP_NATIVE) + udma_tchanrt_write(uc, UDMA_CHAN_RT_PEER_BCNT_REG, val); + } + } +-- +2.39.0 + diff --git a/queue-6.1/dmaengine-xilinx_dma-call-of_node_put-when-breaking-.patch b/queue-6.1/dmaengine-xilinx_dma-call-of_node_put-when-breaking-.patch new file mode 100644 index 00000000000..5fcb5db7944 --- /dev/null +++ b/queue-6.1/dmaengine-xilinx_dma-call-of_node_put-when-breaking-.patch @@ -0,0 +1,42 @@ +From 8e8a4f8c14c91919d390a7c78a01a7e8e440e266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 10:16:12 +0800 +Subject: dmaengine: xilinx_dma: call of_node_put() when breaking out of + for_each_child_of_node() + +From: Liu Shixin + +[ Upstream commit 596b53ccc36a546ab28e8897315c5b4d1d5a0200 ] + +Since for_each_child_of_node() will increase the refcount of node, we need +to call of_node_put() manually when breaking out of the iteration. + +Fixes: 9cd4360de609 ("dma: Add Xilinx AXI Video Direct Memory Access Engine driver support") +Signed-off-by: Liu Shixin +Acked-by: Peter Korsgaard +Link: https://lore.kernel.org/r/20221122021612.1908866-1-liushixin2@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 8cd4e69dc7b4..766017570488 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -3141,8 +3141,10 @@ static int xilinx_dma_probe(struct platform_device *pdev) + /* Initialize the channels */ + for_each_child_of_node(node, child) { + err = xilinx_dma_child_probe(xdev, child); +- if (err < 0) ++ if (err < 0) { ++ of_node_put(child); + goto error; ++ } + } + + if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) { +-- +2.39.0 + diff --git a/queue-6.1/driver-core-fix-test_async_probe_init-saves-device-i.patch b/queue-6.1/driver-core-fix-test_async_probe_init-saves-device-i.patch new file mode 100644 index 00000000000..79671251a83 --- /dev/null +++ b/queue-6.1/driver-core-fix-test_async_probe_init-saves-device-i.patch @@ -0,0 +1,46 @@ +From 12c4360439e3188c444944536064d7387c8b6274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 14:35:41 +0800 +Subject: driver core: Fix test_async_probe_init saves device in wrong array + +From: Chen Zhongjin + +[ Upstream commit 9be182da0a7526f1b9a3777a336f83baa2e64d23 ] + +In test_async_probe_init, second set of asynchronous devices are saved +in sync_dev[sync_id], which should be async_dev[async_id]. +This makes these devices not unregistered when exit. + +> modprobe test_async_driver_probe && \ +> modprobe -r test_async_driver_probe && \ +> modprobe test_async_driver_probe + ... +> sysfs: cannot create duplicate filename '/devices/platform/test_async_driver.4' +> kobject_add_internal failed for test_async_driver.4 with -EEXIST, + don't try to register things with the same name in the same directory. + +Fixes: 57ea974fb871 ("driver core: Rewrite test_async_driver_probe to cover serialization and NUMA affinity") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221125063541.241328-1-chenzhongjin@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/test/test_async_driver_probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/test/test_async_driver_probe.c b/drivers/base/test/test_async_driver_probe.c +index 4d1976ca5072..929410d0dd6f 100644 +--- a/drivers/base/test/test_async_driver_probe.c ++++ b/drivers/base/test/test_async_driver_probe.c +@@ -145,7 +145,7 @@ static int __init test_async_probe_init(void) + calltime = ktime_get(); + for_each_online_cpu(cpu) { + nid = cpu_to_node(cpu); +- pdev = &sync_dev[sync_id]; ++ pdev = &async_dev[async_id]; + + *pdev = test_platform_device_register_node("test_async_driver", + async_id, +-- +2.39.0 + diff --git a/queue-6.1/drm-add-orientation-quirk-for-lenovo-ideapad-d330-10.patch b/queue-6.1/drm-add-orientation-quirk-for-lenovo-ideapad-d330-10.patch new file mode 100644 index 00000000000..89c63b6f56e --- /dev/null +++ b/queue-6.1/drm-add-orientation-quirk-for-lenovo-ideapad-d330-10.patch @@ -0,0 +1,39 @@ +From 52849bc724272dc0d05ab184f87e019c76c7c19f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 15:58:26 -0500 +Subject: drm: Add orientation quirk for Lenovo ideapad D330-10IGL + +From: Patrick Thompson + +[ Upstream commit 0688773f0710528e1ab302c3d6317e269f2e2e6e ] + +Panel is 800x1280 but mounted on a detachable form factor sideways. + +Signed-off-by: Patrick Thompson +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20221220205826.178008-1-ptf@google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 52d8800a8ab8..3659f0465a72 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -304,6 +304,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, ++ }, { /* Lenovo Ideapad D330-10IGL (HD) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGL"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Lenovo Yoga Book X90F / X91F / X91L */ + .matches = { + /* Non exact match to match all versions */ +-- +2.39.0 + diff --git a/queue-6.1/drm-amd-display-fix-issues-with-driver-unload.patch b/queue-6.1/drm-amd-display-fix-issues-with-driver-unload.patch new file mode 100644 index 00000000000..1789ee76f92 --- /dev/null +++ b/queue-6.1/drm-amd-display-fix-issues-with-driver-unload.patch @@ -0,0 +1,57 @@ +From bf80c6bfa4ee2d7dd34870afac7d9955bf1067eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 15:12:49 -0500 +Subject: drm/amd/display: fix issues with driver unload + +From: Hamza Mahfooz + +[ Upstream commit e433adc60f7f847e734c56246b09291532f29b6d ] + +Currently, we run into a number of WARN()s when attempting to unload the +amdgpu driver (e.g. using "modprobe -r amdgpu"). These all stem from +calling drm_encoder_cleanup() too early. So, to fix this we can stop +calling drm_encoder_cleanup() from amdgpu_dm_fini() and instead have it +be called from amdgpu_dm_encoder_destroy(). Also, we don't need to free +in amdgpu_dm_encoder_destroy() since mst_encoders[] isn't explicitly +allocated by the slab allocator. + +Fixes: f74367e492ba ("drm/amdgpu/display: create fake mst encoders ahead of time (v4)") +Reviewed-by: Alex Deucher +Signed-off-by: Hamza Mahfooz +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ---- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 - + 2 files changed, 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index e10f1f15c9c4..7b222fe9716a 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1737,10 +1737,6 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev) + adev->dm.vblank_control_workqueue = NULL; + } + +- for (i = 0; i < adev->dm.display_indexes_num; i++) { +- drm_encoder_cleanup(&adev->dm.mst_encoders[i].base); +- } +- + amdgpu_dm_destroy_drm_device(&adev->dm); + + #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY) +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 6483ba266893..b7369c7b71e4 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -468,7 +468,6 @@ static const struct drm_connector_helper_funcs dm_dp_mst_connector_helper_funcs + static void amdgpu_dm_encoder_destroy(struct drm_encoder *encoder) + { + drm_encoder_cleanup(encoder); +- kfree(encoder); + } + + static const struct drm_encoder_funcs amdgpu_dm_encoder_funcs = { +-- +2.39.0 + diff --git a/queue-6.1/drm-amdkfd-add-sync-after-creating-vram-bo.patch b/queue-6.1/drm-amdkfd-add-sync-after-creating-vram-bo.patch new file mode 100644 index 00000000000..df0fc5303d5 --- /dev/null +++ b/queue-6.1/drm-amdkfd-add-sync-after-creating-vram-bo.patch @@ -0,0 +1,45 @@ +From 0af51866648fe2636080bc569897b22cf294f392 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 14:16:42 -0500 +Subject: drm/amdkfd: Add sync after creating vram bo + +From: Eric Huang + +[ Upstream commit ba029e9991d9be90a28b6a0ceb25e9a6fb348829 ] + +There will be data corruption on vram allocated by svm +if the initialization is not complete and application is +writting on the memory. Adding sync to wait for the +initialization completion is to resolve this issue. + +Signed-off-by: Eric Huang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 64fdf63093a0..63feea08904c 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -570,6 +570,15 @@ svm_range_vram_node_new(struct amdgpu_device *adev, struct svm_range *prange, + goto reserve_bo_failed; + } + ++ if (clear) { ++ r = amdgpu_bo_sync_wait(bo, AMDGPU_FENCE_OWNER_KFD, false); ++ if (r) { ++ pr_debug("failed %d to sync bo\n", r); ++ amdgpu_bo_unreserve(bo); ++ goto reserve_bo_failed; ++ } ++ } ++ + r = dma_resv_reserve_fences(bo->tbo.base.resv, 1); + if (r) { + pr_debug("failed %d to reserve bo\n", r); +-- +2.39.0 + diff --git a/queue-6.1/drm-amdkfd-fix-null-pointer-error-for-gc-11.0.1-on-m.patch b/queue-6.1/drm-amdkfd-fix-null-pointer-error-for-gc-11.0.1-on-m.patch new file mode 100644 index 00000000000..ee84eca59c5 --- /dev/null +++ b/queue-6.1/drm-amdkfd-fix-null-pointer-error-for-gc-11.0.1-on-m.patch @@ -0,0 +1,51 @@ +From 87afa1b144800fddd03f9f018da42750e4b45081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 14:01:18 -0500 +Subject: drm/amdkfd: Fix NULL pointer error for GC 11.0.1 on mGPU + +From: Eric Huang + +[ Upstream commit a6941f89d7c6a6ba49316bbd7da2fb2f719119a7 ] + +The point bo->kfd_bo is NULL for queue's write pointer BO +when creating queue on mGPU. To avoid using the pointer +fixes the error. + +Signed-off-by: Eric Huang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 2 +- + drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index 29f045079a3e..404c839683b1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -2130,7 +2130,7 @@ int amdgpu_amdkfd_map_gtt_bo_to_gart(struct amdgpu_device *adev, struct amdgpu_b + } + + amdgpu_amdkfd_remove_eviction_fence( +- bo, bo->kfd_bo->process_info->eviction_fence); ++ bo, bo->vm_bo->vm->process_info->eviction_fence); + + amdgpu_bo_unreserve(bo); + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +index ecb4c3abc629..c06ada0844ba 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -200,7 +200,7 @@ static int add_queue_mes(struct device_queue_manager *dqm, struct queue *q, + queue_input.wptr_addr = (uint64_t)q->properties.write_ptr; + + if (q->wptr_bo) { +- wptr_addr_off = (uint64_t)q->properties.write_ptr - (uint64_t)q->wptr_bo->kfd_bo->va; ++ wptr_addr_off = (uint64_t)q->properties.write_ptr & (PAGE_SIZE - 1); + queue_input.wptr_mc_addr = ((uint64_t)q->wptr_bo->tbo.resource->start << PAGE_SHIFT) + wptr_addr_off; + } + +-- +2.39.0 + diff --git a/queue-6.1/drm-i915-selftests-unwind-hugepages-to-drop-wakeref-.patch b/queue-6.1/drm-i915-selftests-unwind-hugepages-to-drop-wakeref-.patch new file mode 100644 index 00000000000..822f52b79be --- /dev/null +++ b/queue-6.1/drm-i915-selftests-unwind-hugepages-to-drop-wakeref-.patch @@ -0,0 +1,70 @@ +From 2733cd3534ee30015c62f60f342f9a77ef4d0227 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 13:32:34 +0100 +Subject: drm/i915/selftests: Unwind hugepages to drop wakeref on error + +From: Chris Wilson + +[ Upstream commit 93eea624526fc7d070cdae463408665824075f54 ] + +Make sure that upon error after we have acquired the wakeref we do +release it again. + +v2: add another missing "goto out_wf"(Andi). + +Fixes: 027c38b4121e ("drm/i915/selftests: Grab the runtime pm in shrink_thp") +Cc: Andi Shyti +Reviewed-by: Matthew Auld +Reviewed-by: Andrzej Hajda +Signed-off-by: Chris Wilson +Signed-off-by: Nirmoy Das +Reviewed-by: Andi Shyti +Reviewed-by: Nirmoy Das +Signed-off-by: Andi Shyti +Link: https://patchwork.freedesktop.org/patch/msgid/20230117123234.26487-1-nirmoy.das@intel.com +(cherry picked from commit 14ec40a88210151296fff3e981c1a7196ad9bf55) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gem/selftests/huge_pages.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c +index c570cf780079..436598f19522 100644 +--- a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c ++++ b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c +@@ -1697,7 +1697,7 @@ static int igt_shrink_thp(void *arg) + I915_SHRINK_ACTIVE); + i915_vma_unpin(vma); + if (err) +- goto out_put; ++ goto out_wf; + + /* + * Now that the pages are *unpinned* shrinking should invoke +@@ -1713,19 +1713,19 @@ static int igt_shrink_thp(void *arg) + pr_err("unexpected pages mismatch, should_swap=%s\n", + str_yes_no(should_swap)); + err = -EINVAL; +- goto out_put; ++ goto out_wf; + } + + if (should_swap == (obj->mm.page_sizes.sg || obj->mm.page_sizes.phys)) { + pr_err("unexpected residual page-size bits, should_swap=%s\n", + str_yes_no(should_swap)); + err = -EINVAL; +- goto out_put; ++ goto out_wf; + } + + err = i915_vma_pin(vma, 0, 0, flags); + if (err) +- goto out_put; ++ goto out_wf; + + while (n--) { + err = cpu_check(obj, n, 0xdeadbeaf); +-- +2.39.0 + diff --git a/queue-6.1/drm-msm-a6xx-avoid-gx-gbit-halt-during-rpm-suspend.patch b/queue-6.1/drm-msm-a6xx-avoid-gx-gbit-halt-during-rpm-suspend.patch new file mode 100644 index 00000000000..543a578fed9 --- /dev/null +++ b/queue-6.1/drm-msm-a6xx-avoid-gx-gbit-halt-during-rpm-suspend.patch @@ -0,0 +1,110 @@ +From c235ff3cad918614347558fe593ede268b0cefb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 22:33:14 +0530 +Subject: drm/msm/a6xx: Avoid gx gbit halt during rpm suspend + +From: Akhil P Oommen + +[ Upstream commit f4a75b5933c998e60fd812a7680e0971eb1c7cee ] + +As per the downstream driver, gx gbif halt is required only during +recovery sequence. So lets avoid it during regular rpm suspend. + +Signed-off-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/515279/ +Link: https://lore.kernel.org/r/20221216223253.1.Ice9c47bfeb1fddb8dc377a3491a043a3ee7fca7d@changeid +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 15 +++++++++------ + drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 7 +++++++ + drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 1 + + 3 files changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +index e033d6a67a20..870252bef23f 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -876,7 +876,8 @@ static void a6xx_gmu_rpmh_off(struct a6xx_gmu *gmu) + #define GBIF_CLIENT_HALT_MASK BIT(0) + #define GBIF_ARB_HALT_MASK BIT(1) + +-static void a6xx_bus_clear_pending_transactions(struct adreno_gpu *adreno_gpu) ++static void a6xx_bus_clear_pending_transactions(struct adreno_gpu *adreno_gpu, ++ bool gx_off) + { + struct msm_gpu *gpu = &adreno_gpu->base; + +@@ -889,9 +890,11 @@ static void a6xx_bus_clear_pending_transactions(struct adreno_gpu *adreno_gpu) + return; + } + +- /* Halt the gx side of GBIF */ +- gpu_write(gpu, REG_A6XX_RBBM_GBIF_HALT, 1); +- spin_until(gpu_read(gpu, REG_A6XX_RBBM_GBIF_HALT_ACK) & 1); ++ if (gx_off) { ++ /* Halt the gx side of GBIF */ ++ gpu_write(gpu, REG_A6XX_RBBM_GBIF_HALT, 1); ++ spin_until(gpu_read(gpu, REG_A6XX_RBBM_GBIF_HALT_ACK) & 1); ++ } + + /* Halt new client requests on GBIF */ + gpu_write(gpu, REG_A6XX_GBIF_HALT, GBIF_CLIENT_HALT_MASK); +@@ -929,7 +932,7 @@ static void a6xx_gmu_force_off(struct a6xx_gmu *gmu) + /* Halt the gmu cm3 core */ + gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 1); + +- a6xx_bus_clear_pending_transactions(adreno_gpu); ++ a6xx_bus_clear_pending_transactions(adreno_gpu, true); + + /* Reset GPU core blocks */ + gpu_write(gpu, REG_A6XX_RBBM_SW_RESET_CMD, 1); +@@ -1083,7 +1086,7 @@ static void a6xx_gmu_shutdown(struct a6xx_gmu *gmu) + return; + } + +- a6xx_bus_clear_pending_transactions(adreno_gpu); ++ a6xx_bus_clear_pending_transactions(adreno_gpu, a6xx_gpu->hung); + + /* tell the GMU we want to slumber */ + ret = a6xx_gmu_notify_slumber(gmu); +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +index e846e629c00d..9d7fc44c1e2a 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +@@ -1277,6 +1277,12 @@ static void a6xx_recover(struct msm_gpu *gpu) + if (hang_debug) + a6xx_dump(gpu); + ++ /* ++ * To handle recovery specific sequences during the rpm suspend we are ++ * about to trigger ++ */ ++ a6xx_gpu->hung = true; ++ + /* Halt SQE first */ + gpu_write(gpu, REG_A6XX_CP_SQE_CNTL, 3); + +@@ -1319,6 +1325,7 @@ static void a6xx_recover(struct msm_gpu *gpu) + mutex_unlock(&gpu->active_lock); + + msm_gpu_hw_init(gpu); ++ a6xx_gpu->hung = false; + } + + static const char *a6xx_uche_fault_block(struct msm_gpu *gpu, u32 mid) +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h +index ab853f61db63..eea2e60ce3b7 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h +@@ -32,6 +32,7 @@ struct a6xx_gpu { + void *llc_slice; + void *htw_llc_slice; + bool have_mmu500; ++ bool hung; + }; + + #define to_a6xx_gpu(x) container_of(x, struct a6xx_gpu, base) +-- +2.39.0 + diff --git a/queue-6.1/drm-msm-gpu-fix-potential-double-free.patch b/queue-6.1/drm-msm-gpu-fix-potential-double-free.patch new file mode 100644 index 00000000000..0057cad094b --- /dev/null +++ b/queue-6.1/drm-msm-gpu-fix-potential-double-free.patch @@ -0,0 +1,88 @@ +From f4b7352857b7dbb86c6a13611c38044dabeaf866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 13:28:59 -0800 +Subject: drm/msm/gpu: Fix potential double-free + +From: Rob Clark + +[ Upstream commit a66f1efcf748febea7758c4c3c8b5bc5294949ef ] + +If userspace was calling the MSM_SET_PARAM ioctl on multiple threads to +set the COMM or CMDLINE param, it could trigger a race causing the +previous value to be kfree'd multiple times. Fix this by serializing on +the gpu lock. + +Signed-off-by: Rob Clark +Fixes: d4726d770068 ("drm/msm: Add a way to override processes comm/cmdline") +Patchwork: https://patchwork.freedesktop.org/patch/517778/ +Link: https://lore.kernel.org/r/20230110212903.1925878-1-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 ++++ + drivers/gpu/drm/msm/msm_gpu.c | 2 ++ + drivers/gpu/drm/msm/msm_gpu.h | 12 ++++++++++-- + 3 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 5a0e8491cd3a..2e7531d2a5d6 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -351,6 +351,8 @@ int adreno_set_param(struct msm_gpu *gpu, struct msm_file_private *ctx, + /* Ensure string is null terminated: */ + str[len] = '\0'; + ++ mutex_lock(&gpu->lock); ++ + if (param == MSM_PARAM_COMM) { + paramp = &ctx->comm; + } else { +@@ -360,6 +362,8 @@ int adreno_set_param(struct msm_gpu *gpu, struct msm_file_private *ctx, + kfree(*paramp); + *paramp = str; + ++ mutex_unlock(&gpu->lock); ++ + return 0; + } + case MSM_PARAM_SYSPROF: +diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c +index 021f4e29b613..4f495eecc34b 100644 +--- a/drivers/gpu/drm/msm/msm_gpu.c ++++ b/drivers/gpu/drm/msm/msm_gpu.c +@@ -335,6 +335,8 @@ static void get_comm_cmdline(struct msm_gem_submit *submit, char **comm, char ** + struct msm_file_private *ctx = submit->queue->ctx; + struct task_struct *task; + ++ WARN_ON(!mutex_is_locked(&submit->gpu->lock)); ++ + /* Note that kstrdup will return NULL if argument is NULL: */ + *comm = kstrdup(ctx->comm, GFP_KERNEL); + *cmd = kstrdup(ctx->cmdline, GFP_KERNEL); +diff --git a/drivers/gpu/drm/msm/msm_gpu.h b/drivers/gpu/drm/msm/msm_gpu.h +index 58a72e6b1400..a89bfdc3d7f9 100644 +--- a/drivers/gpu/drm/msm/msm_gpu.h ++++ b/drivers/gpu/drm/msm/msm_gpu.h +@@ -366,10 +366,18 @@ struct msm_file_private { + */ + int sysprof; + +- /** comm: Overridden task comm, see MSM_PARAM_COMM */ ++ /** ++ * comm: Overridden task comm, see MSM_PARAM_COMM ++ * ++ * Accessed under msm_gpu::lock ++ */ + char *comm; + +- /** cmdline: Overridden task cmdline, see MSM_PARAM_CMDLINE */ ++ /** ++ * cmdline: Overridden task cmdline, see MSM_PARAM_CMDLINE ++ * ++ * Accessed under msm_gpu::lock ++ */ + char *cmdline; + + /** +-- +2.39.0 + diff --git a/queue-6.1/drm-panfrost-fix-generic_atomic64-dependency.patch b/queue-6.1/drm-panfrost-fix-generic_atomic64-dependency.patch new file mode 100644 index 00000000000..21238f70584 --- /dev/null +++ b/queue-6.1/drm-panfrost-fix-generic_atomic64-dependency.patch @@ -0,0 +1,45 @@ +From 08d06021001402e0a62992ff60256bc243554fc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 17:44:43 +0100 +Subject: drm/panfrost: fix GENERIC_ATOMIC64 dependency + +From: Arnd Bergmann + +[ Upstream commit 6437a549ae178a3f5a5c03e983f291ebcdc2bbc7 ] + +On ARMv5 and earlier, a randconfig build can still run into + +WARNING: unmet direct dependencies detected for IOMMU_IO_PGTABLE_LPAE + Depends on [n]: IOMMU_SUPPORT [=y] && (ARM [=y] || ARM64 || COMPILE_TEST [=y]) && !GENERIC_ATOMIC64 [=y] + Selected by [y]: + - DRM_PANFROST [=y] && HAS_IOMEM [=y] && DRM [=y] && (ARM [=y] || ARM64 || COMPILE_TEST [=y] && !GENERIC_ATOMIC64 [=y]) && MMU [=y] + +Rework the dependencies to always require a working cmpxchg64. + +Fixes: db594ba3fcf9 ("drm/panfrost: depend on !GENERIC_ATOMIC64 when using COMPILE_TEST") +Signed-off-by: Arnd Bergmann +Reviewed-by: Steven Price +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20230117164456.1591901-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panfrost/Kconfig b/drivers/gpu/drm/panfrost/Kconfig +index 079600328be1..e6403a9d66ad 100644 +--- a/drivers/gpu/drm/panfrost/Kconfig ++++ b/drivers/gpu/drm/panfrost/Kconfig +@@ -3,7 +3,8 @@ + config DRM_PANFROST + tristate "Panfrost (DRM support for ARM Mali Midgard/Bifrost GPUs)" + depends on DRM +- depends on ARM || ARM64 || (COMPILE_TEST && !GENERIC_ATOMIC64) ++ depends on ARM || ARM64 || COMPILE_TEST ++ depends on !GENERIC_ATOMIC64 # for IOMMU_IO_PGTABLE_LPAE + depends on MMU + select DRM_SCHED + select IOMMU_SUPPORT +-- +2.39.0 + diff --git a/queue-6.1/drm-vc4-bo-fix-drmm_mutex_init-memory-hog.patch b/queue-6.1/drm-vc4-bo-fix-drmm_mutex_init-memory-hog.patch new file mode 100644 index 00000000000..9329eda5161 --- /dev/null +++ b/queue-6.1/drm-vc4-bo-fix-drmm_mutex_init-memory-hog.patch @@ -0,0 +1,57 @@ +From 295de5c27d7bec7c2dd3853d63eace90d132809f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 10:12:43 +0100 +Subject: drm/vc4: bo: Fix drmm_mutex_init memory hog + +From: Maxime Ripard + +[ Upstream commit 07a2975c65f2be2e22591d795a9c39b00f95fd11 ] + +Commit 374146cad469 ("drm/vc4: Switch to drmm_mutex_init") converted, +among other functions, vc4_create_object() to use drmm_mutex_init(). + +However, that function is used to allocate a BO, and therefore the +mutex needs to be freed much sooner than when the DRM device is removed +from the system. + +For each buffer allocation we thus end up allocating a small structure +as part of the DRM-managed mechanism that is never freed, eventually +leading us to no longer having any free memory anymore. + +Let's switch back to mutex_init/mutex_destroy to deal with it properly. + +Fixes: 374146cad469 ("drm/vc4: Switch to drmm_mutex_init") +Reviewed-by: Daniel Vetter +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230112091243.490799-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_bo.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index 231add8b8e12..ab2573525d77 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -179,6 +179,7 @@ static void vc4_bo_destroy(struct vc4_bo *bo) + bo->validated_shader = NULL; + } + ++ mutex_destroy(&bo->madv_lock); + drm_gem_dma_free(&bo->base); + } + +@@ -406,9 +407,7 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size) + bo->madv = VC4_MADV_WILLNEED; + refcount_set(&bo->usecnt, 0); + +- ret = drmm_mutex_init(dev, &bo->madv_lock); +- if (ret) +- return ERR_PTR(ret); ++ mutex_init(&bo->madv_lock); + + mutex_lock(&vc4->bo_lock); + bo->label = VC4_BO_TYPE_KERNEL; +-- +2.39.0 + diff --git a/queue-6.1/drm-vc4-bo-fix-unused-variable-warning.patch b/queue-6.1/drm-vc4-bo-fix-unused-variable-warning.patch new file mode 100644 index 00000000000..13d3848c142 --- /dev/null +++ b/queue-6.1/drm-vc4-bo-fix-unused-variable-warning.patch @@ -0,0 +1,43 @@ +From d01a0107dcf08c1519bd3ce9e97a42bf82ae073f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 16:46:37 +0100 +Subject: drm/vc4: bo: Fix unused variable warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxime Ripard + +[ Upstream commit 83a7f8e4899fb4cd77c787a3373f3e82b49a080f ] + +Commit 07a2975c65f2 ("drm/vc4: bo: Fix drmm_mutex_init memory hog") +removed the only use of the ret variable, but didn't remove the +variable itself leading to a unused variable warning. + +Remove that variable. + +Reported-by: Stephen Rothwell +Fixes: 07a2975c65f2 ("drm/vc4: bo: Fix drmm_mutex_init memory hog") +Reviewed-by: Maíra Canal +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230113154637.1704116-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_bo.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index ab2573525d77..ce0ea446bd70 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -395,7 +395,6 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size) + { + struct vc4_dev *vc4 = to_vc4_dev(dev); + struct vc4_bo *bo; +- int ret; + + if (WARN_ON_ONCE(vc4->is_vc5)) + return ERR_PTR(-ENODEV); +-- +2.39.0 + diff --git a/queue-6.1/edac-highbank-fix-memory-leak-in-highbank_mc_probe.patch b/queue-6.1/edac-highbank-fix-memory-leak-in-highbank_mc_probe.patch new file mode 100644 index 00000000000..4bb1d4306cb --- /dev/null +++ b/queue-6.1/edac-highbank-fix-memory-leak-in-highbank_mc_probe.patch @@ -0,0 +1,54 @@ +From 7871fb8854a7e4d22250ff4cf525e80d93be981c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Dec 2022 09:48:24 +0400 +Subject: EDAC/highbank: Fix memory leak in highbank_mc_probe() + +From: Miaoqian Lin + +[ Upstream commit e7a293658c20a7945014570e1921bf7d25d68a36 ] + +When devres_open_group() fails, it returns -ENOMEM without freeing memory +allocated by edac_mc_alloc(). + +Call edac_mc_free() on the error handling path to avoid a memory leak. + + [ bp: Massage commit message. ] + +Fixes: a1b01edb2745 ("edac: add support for Calxeda highbank memory controller") +Signed-off-by: Miaoqian Lin +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Andre Przywara +Link: https://lore.kernel.org/r/20221229054825.1361993-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/edac/highbank_mc_edac.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/highbank_mc_edac.c b/drivers/edac/highbank_mc_edac.c +index 61b76ec226af..19fba258ae10 100644 +--- a/drivers/edac/highbank_mc_edac.c ++++ b/drivers/edac/highbank_mc_edac.c +@@ -174,8 +174,10 @@ static int highbank_mc_probe(struct platform_device *pdev) + drvdata = mci->pvt_info; + platform_set_drvdata(pdev, mci); + +- if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) +- return -ENOMEM; ++ if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) { ++ res = -ENOMEM; ++ goto free; ++ } + + r = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!r) { +@@ -243,6 +245,7 @@ static int highbank_mc_probe(struct platform_device *pdev) + edac_mc_del_mc(&pdev->dev); + err: + devres_release_group(&pdev->dev, NULL); ++free: + edac_mc_free(mci); + return res; + } +-- +2.39.0 + diff --git a/queue-6.1/erofs-fix-kvcalloc-misuse-with-__gfp_nofail.patch b/queue-6.1/erofs-fix-kvcalloc-misuse-with-__gfp_nofail.patch new file mode 100644 index 00000000000..28f39030845 --- /dev/null +++ b/queue-6.1/erofs-fix-kvcalloc-misuse-with-__gfp_nofail.patch @@ -0,0 +1,67 @@ +From f7bb977d25583ebdbe297d9c88ef902ff6ddca97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 15:49:27 +0800 +Subject: erofs: fix kvcalloc() misuse with __GFP_NOFAIL + +From: Gao Xiang + +[ Upstream commit 12724ba38992bd045e92a9a88a868a530f89d13e ] + +As reported by syzbot [1], kvcalloc() cannot work with __GFP_NOFAIL. +Let's use kcalloc() instead. + +[1] https://lore.kernel.org/r/0000000000007796bd05f1852ec2@google.com + +Reported-by: syzbot+c3729cda01706a04fb98@syzkaller.appspotmail.com +Fixes: fe3e5914e6dc ("erofs: try to leave (de)compressed_pages on stack if possible") +Fixes: 4f05687fd703 ("erofs: introduce struct z_erofs_decompress_backend") +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20230110074927.41651-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index cf4871834ebb..ee7c88c9b5af 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -1047,12 +1047,12 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be, + + if (!be->decompressed_pages) + be->decompressed_pages = +- kvcalloc(be->nr_pages, sizeof(struct page *), +- GFP_KERNEL | __GFP_NOFAIL); ++ kcalloc(be->nr_pages, sizeof(struct page *), ++ GFP_KERNEL | __GFP_NOFAIL); + if (!be->compressed_pages) + be->compressed_pages = +- kvcalloc(pclusterpages, sizeof(struct page *), +- GFP_KERNEL | __GFP_NOFAIL); ++ kcalloc(pclusterpages, sizeof(struct page *), ++ GFP_KERNEL | __GFP_NOFAIL); + + z_erofs_parse_out_bvecs(be); + err2 = z_erofs_parse_in_bvecs(be, &overlapped); +@@ -1100,7 +1100,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be, + } + if (be->compressed_pages < be->onstack_pages || + be->compressed_pages >= be->onstack_pages + Z_EROFS_ONSTACK_PAGES) +- kvfree(be->compressed_pages); ++ kfree(be->compressed_pages); + z_erofs_fill_other_copies(be, err); + + for (i = 0; i < be->nr_pages; ++i) { +@@ -1119,7 +1119,7 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be, + } + + if (be->decompressed_pages != be->onstack_pages) +- kvfree(be->decompressed_pages); ++ kfree(be->decompressed_pages); + + pcl->length = 0; + pcl->partial = true; +-- +2.39.0 + diff --git a/queue-6.1/firmware-arm_scmi-fix-virtio-channels-cleanup-on-shu.patch b/queue-6.1/firmware-arm_scmi-fix-virtio-channels-cleanup-on-shu.patch new file mode 100644 index 00000000000..77963a8da81 --- /dev/null +++ b/queue-6.1/firmware-arm_scmi-fix-virtio-channels-cleanup-on-shu.patch @@ -0,0 +1,142 @@ +From c6e6b0bf4dd2dad285887136b78486aead87ecd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 18:38:23 +0000 +Subject: firmware: arm_scmi: Fix virtio channels cleanup on shutdown + +From: Cristian Marussi + +[ Upstream commit e325285de2cd82fbdcc4df8898e4c6a597674816 ] + +When unloading the SCMI core stack module, configured to use the virtio +SCMI transport, LOCKDEP reports the splat down below about unsafe locks +dependencies. + +In order to avoid this possible unsafe locking scenario call upfront +virtio_break_device() before getting hold of vioch->lock. + +===================================================== + WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected + 6.1.0-00067-g6b934395ba07-dirty #4 Not tainted + ----------------------------------------------------- + rmmod/307 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: + ffff000080c510e0 (&dev->vqs_list_lock){+.+.}-{3:3}, at: virtio_break_device+0x28/0x68 + + and this task is already holding: + ffff00008288ada0 (&channels[i].lock){-.-.}-{3:3}, at: virtio_chan_free+0x60/0x168 [scmi_module] + + which would create a new lock dependency: + (&channels[i].lock){-.-.}-{3:3} -> (&dev->vqs_list_lock){+.+.}-{3:3} + + but this new dependency connects a HARDIRQ-irq-safe lock: + (&channels[i].lock){-.-.}-{3:3} + + ... which became HARDIRQ-irq-safe at: + lock_acquire+0x128/0x398 + _raw_spin_lock_irqsave+0x78/0x140 + scmi_vio_complete_cb+0xb4/0x3b8 [scmi_module] + vring_interrupt+0x84/0x120 + vm_interrupt+0x94/0xe8 + __handle_irq_event_percpu+0xb4/0x3d8 + handle_irq_event_percpu+0x20/0x68 + handle_irq_event+0x50/0xb0 + handle_fasteoi_irq+0xac/0x138 + generic_handle_domain_irq+0x34/0x50 + gic_handle_irq+0xa0/0xd8 + call_on_irq_stack+0x2c/0x54 + do_interrupt_handler+0x8c/0x90 + el1_interrupt+0x40/0x78 + el1h_64_irq_handler+0x18/0x28 + el1h_64_irq+0x64/0x68 + _raw_write_unlock_irq+0x48/0x80 + ep_start_scan+0xf0/0x128 + do_epoll_wait+0x390/0x858 + do_compat_epoll_pwait.part.34+0x1c/0xb8 + __arm64_sys_epoll_pwait+0x80/0xd0 + invoke_syscall+0x4c/0x110 + el0_svc_common.constprop.3+0x98/0x120 + do_el0_svc+0x34/0xd0 + el0_svc+0x40/0x98 + el0t_64_sync_handler+0x98/0xc0 + el0t_64_sync+0x170/0x174 + + to a HARDIRQ-irq-unsafe lock: + (&dev->vqs_list_lock){+.+.}-{3:3} + + ... which became HARDIRQ-irq-unsafe at: + ... + lock_acquire+0x128/0x398 + _raw_spin_lock+0x58/0x70 + __vring_new_virtqueue+0x130/0x1c0 + vring_create_virtqueue+0xc4/0x2b8 + vm_find_vqs+0x20c/0x430 + init_vq+0x308/0x390 + virtblk_probe+0x114/0x9b0 + virtio_dev_probe+0x1a4/0x248 + really_probe+0xc8/0x3a8 + __driver_probe_device+0x84/0x190 + driver_probe_device+0x44/0x110 + __driver_attach+0x104/0x1e8 + bus_for_each_dev+0x7c/0xd0 + driver_attach+0x2c/0x38 + bus_add_driver+0x1e4/0x258 + driver_register+0x6c/0x128 + register_virtio_driver+0x2c/0x48 + virtio_blk_init+0x70/0xac + do_one_initcall+0x84/0x420 + kernel_init_freeable+0x2d0/0x340 + kernel_init+0x2c/0x138 + ret_from_fork+0x10/0x20 + + other info that might help us debug this: + + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&dev->vqs_list_lock); + local_irq_disable(); + lock(&channels[i].lock); + lock(&dev->vqs_list_lock); + + lock(&channels[i].lock); + + *** DEADLOCK *** +================ + +Fixes: 42e90eb53bf3f ("firmware: arm_scmi: Add a virtio channel refcount") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221222183823.518856-6-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/virtio.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/arm_scmi/virtio.c b/drivers/firmware/arm_scmi/virtio.c +index 33c9b81a55cd..1db975c08896 100644 +--- a/drivers/firmware/arm_scmi/virtio.c ++++ b/drivers/firmware/arm_scmi/virtio.c +@@ -160,7 +160,6 @@ static void scmi_vio_channel_cleanup_sync(struct scmi_vio_channel *vioch) + } + + vioch->shutdown_done = &vioch_shutdown_done; +- virtio_break_device(vioch->vqueue->vdev); + if (!vioch->is_rx && vioch->deferred_tx_wq) + /* Cannot be kicked anymore after this...*/ + vioch->deferred_tx_wq = NULL; +@@ -482,6 +481,12 @@ static int virtio_chan_free(int id, void *p, void *data) + struct scmi_chan_info *cinfo = p; + struct scmi_vio_channel *vioch = cinfo->transport_info; + ++ /* ++ * Break device to inhibit further traffic flowing while shutting down ++ * the channels: doing it later holding vioch->lock creates unsafe ++ * locking dependency chains as reported by LOCKDEP. ++ */ ++ virtio_break_device(vioch->vqueue->vdev); + scmi_vio_channel_cleanup_sync(vioch); + + scmi_free_channel(cinfo, data, id); +-- +2.39.0 + diff --git a/queue-6.1/firmware-arm_scmi-harden-shared-memory-access-in-fet.patch b/queue-6.1/firmware-arm_scmi-harden-shared-memory-access-in-fet.patch new file mode 100644 index 00000000000..f34cbe46da4 --- /dev/null +++ b/queue-6.1/firmware-arm_scmi-harden-shared-memory-access-in-fet.patch @@ -0,0 +1,44 @@ +From a923ef0faad91ae716c124a1cf27aed6e8553ad5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 18:38:20 +0000 +Subject: firmware: arm_scmi: Harden shared memory access in fetch_response + +From: Cristian Marussi + +[ Upstream commit ad78b81a1077f7d956952cd8bdfe1e61504e3eb8 ] + +A misbheaving SCMI platform firmware could reply with out-of-spec messages, +shorter than the mimimum size comprising a header and a status field. + +Harden shmem_fetch_response to properly truncate such a bad messages. + +Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221222183823.518856-3-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/shmem.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/shmem.c b/drivers/firmware/arm_scmi/shmem.c +index 1dfe534b8518..135f8718000f 100644 +--- a/drivers/firmware/arm_scmi/shmem.c ++++ b/drivers/firmware/arm_scmi/shmem.c +@@ -81,10 +81,11 @@ u32 shmem_read_header(struct scmi_shared_mem __iomem *shmem) + void shmem_fetch_response(struct scmi_shared_mem __iomem *shmem, + struct scmi_xfer *xfer) + { ++ size_t len = ioread32(&shmem->length); ++ + xfer->hdr.status = ioread32(shmem->msg_payload); + /* Skip the length of header and status in shmem area i.e 8 bytes */ +- xfer->rx.len = min_t(size_t, xfer->rx.len, +- ioread32(&shmem->length) - 8); ++ xfer->rx.len = min_t(size_t, xfer->rx.len, len > 8 ? len - 8 : 0); + + /* Take a copy to the rx buffer.. */ + memcpy_fromio(xfer->rx.buf, shmem->msg_payload + 4, xfer->rx.len); +-- +2.39.0 + diff --git a/queue-6.1/firmware-arm_scmi-harden-shared-memory-access-in-fet.patch-25512 b/queue-6.1/firmware-arm_scmi-harden-shared-memory-access-in-fet.patch-25512 new file mode 100644 index 00000000000..2da4e1d3a9c --- /dev/null +++ b/queue-6.1/firmware-arm_scmi-harden-shared-memory-access-in-fet.patch-25512 @@ -0,0 +1,40 @@ +From 840ffc72e2fa25ae862ca8e86ab9d8705f32acf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 18:38:21 +0000 +Subject: firmware: arm_scmi: Harden shared memory access in fetch_notification + +From: Cristian Marussi + +[ Upstream commit 9bae076cd4e3e3c3dc185cae829d80b2dddec86e ] + +A misbheaving SCMI platform firmware could reply with out-of-spec +notifications, shorter than the mimimum size comprising a header. + +Fixes: d5141f37c42e ("firmware: arm_scmi: Add notifications support in transport layer") +Signed-off-by: Cristian Marussi +Link: https://lore.kernel.org/r/20221222183823.518856-4-cristian.marussi@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/shmem.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/arm_scmi/shmem.c b/drivers/firmware/arm_scmi/shmem.c +index 135f8718000f..87b4f4d35f06 100644 +--- a/drivers/firmware/arm_scmi/shmem.c ++++ b/drivers/firmware/arm_scmi/shmem.c +@@ -94,8 +94,10 @@ void shmem_fetch_response(struct scmi_shared_mem __iomem *shmem, + void shmem_fetch_notification(struct scmi_shared_mem __iomem *shmem, + size_t max_len, struct scmi_xfer *xfer) + { ++ size_t len = ioread32(&shmem->length); ++ + /* Skip only the length of header in shmem area i.e 4 bytes */ +- xfer->rx.len = min_t(size_t, max_len, ioread32(&shmem->length) - 4); ++ xfer->rx.len = min_t(size_t, max_len, len > 4 ? len - 4 : 0); + + /* Take a copy to the rx buffer.. */ + memcpy_fromio(xfer->rx.buf, shmem->msg_payload, xfer->rx.len); +-- +2.39.0 + diff --git a/queue-6.1/firmware-coreboot-check-size-of-table-entry-and-use-.patch b/queue-6.1/firmware-coreboot-check-size-of-table-entry-and-use-.patch new file mode 100644 index 00000000000..cd93e27eaf7 --- /dev/null +++ b/queue-6.1/firmware-coreboot-check-size-of-table-entry-and-use-.patch @@ -0,0 +1,81 @@ +From ba07ff22b5b98b13711843ec7e0024557b9be347 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 15:03:16 -0800 +Subject: firmware: coreboot: Check size of table entry and use flex-array + +From: Kees Cook + +[ Upstream commit 3b293487b8752cc42c1cbf8a0447bc6076c075fa ] + +The memcpy() of the data following a coreboot_table_entry couldn't +be evaluated by the compiler under CONFIG_FORTIFY_SOURCE. To make it +easier to reason about, add an explicit flexible array member to struct +coreboot_device so the entire entry can be copied at once. Additionally, +validate the sizes before copying. Avoids this run-time false positive +warning: + + memcpy: detected field-spanning write (size 168) of single field "&device->entry" at drivers/firmware/google/coreboot_table.c:103 (size 8) + +Reported-by: Paul Menzel +Link: https://lore.kernel.org/all/03ae2704-8c30-f9f0-215b-7cdf4ad35a9a@molgen.mpg.de/ +Cc: Jack Rosenthal +Cc: Guenter Roeck +Cc: Julius Werner +Cc: Brian Norris +Cc: Stephen Boyd +Cc: Greg Kroah-Hartman +Signed-off-by: Kees Cook +Reviewed-by: Julius Werner +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20230107031406.gonna.761-kees@kernel.org +Reviewed-by: Stephen Boyd +Reviewed-by: Jack Rosenthal +Link: https://lore.kernel.org/r/20230112230312.give.446-kees@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/firmware/google/coreboot_table.c | 9 +++++++-- + drivers/firmware/google/coreboot_table.h | 1 + + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c +index 9ca21feb9d45..f3694d347801 100644 +--- a/drivers/firmware/google/coreboot_table.c ++++ b/drivers/firmware/google/coreboot_table.c +@@ -93,7 +93,12 @@ static int coreboot_table_populate(struct device *dev, void *ptr) + for (i = 0; i < header->table_entries; i++) { + entry = ptr_entry; + +- device = kzalloc(sizeof(struct device) + entry->size, GFP_KERNEL); ++ if (entry->size < sizeof(*entry)) { ++ dev_warn(dev, "coreboot table entry too small!\n"); ++ return -EINVAL; ++ } ++ ++ device = kzalloc(sizeof(device->dev) + entry->size, GFP_KERNEL); + if (!device) + return -ENOMEM; + +@@ -101,7 +106,7 @@ static int coreboot_table_populate(struct device *dev, void *ptr) + device->dev.parent = dev; + device->dev.bus = &coreboot_bus_type; + device->dev.release = coreboot_device_release; +- memcpy(&device->entry, ptr_entry, entry->size); ++ memcpy(device->raw, ptr_entry, entry->size); + + ret = device_register(&device->dev); + if (ret) { +diff --git a/drivers/firmware/google/coreboot_table.h b/drivers/firmware/google/coreboot_table.h +index beb778674acd..4a89277b99a3 100644 +--- a/drivers/firmware/google/coreboot_table.h ++++ b/drivers/firmware/google/coreboot_table.h +@@ -66,6 +66,7 @@ struct coreboot_device { + struct coreboot_table_entry entry; + struct lb_cbmem_ref cbmem_ref; + struct lb_framebuffer framebuffer; ++ DECLARE_FLEX_ARRAY(u8, raw); + }; + }; + +-- +2.39.0 + diff --git a/queue-6.1/gpio-mxc-always-set-gpios-used-as-interrupt-source-t.patch b/queue-6.1/gpio-mxc-always-set-gpios-used-as-interrupt-source-t.patch new file mode 100644 index 00000000000..b7e548e0fcd --- /dev/null +++ b/queue-6.1/gpio-mxc-always-set-gpios-used-as-interrupt-source-t.patch @@ -0,0 +1,41 @@ +From 74c79d3cdf64855815deb54a967e41e2a1fc1af0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 10:49:57 +0100 +Subject: gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode + +From: Marek Vasut + +[ Upstream commit 8e88a0feebb241cab0253698b2f7358b6ebec802 ] + +Always configure GPIO pins which are used as interrupt source as INPUTs. +In case the default pin configuration is OUTPUT, or the prior stage does +configure the pins as OUTPUT, then Linux will not reconfigure the pin as +INPUT and no interrupts are received. + +Always configure the interrupt source GPIO pin as input to fix the above case. + +Reviewed-by: Linus Walleij +Fixes: 07bd1a6cc7cbb ("MXC arch: Add gpio support for the whole platform") +Signed-off-by: Marek Vasut +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mxc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c +index 6cc98a5684ae..dd91908c72f1 100644 +--- a/drivers/gpio/gpio-mxc.c ++++ b/drivers/gpio/gpio-mxc.c +@@ -210,7 +210,7 @@ static int gpio_set_irq_type(struct irq_data *d, u32 type) + + raw_spin_unlock_irqrestore(&port->gc.bgpio_lock, flags); + +- return 0; ++ return port->gc.direction_input(&port->gc, gpio_idx); + } + + static void mxc_flip_edge(struct mxc_gpio_port *port, u32 gpio) +-- +2.39.0 + diff --git a/queue-6.1/gpio-mxc-protect-gpio-irqchip-rmw-with-bgpio-spinloc.patch b/queue-6.1/gpio-mxc-protect-gpio-irqchip-rmw-with-bgpio-spinloc.patch new file mode 100644 index 00000000000..9ade49a3802 --- /dev/null +++ b/queue-6.1/gpio-mxc-protect-gpio-irqchip-rmw-with-bgpio-spinloc.patch @@ -0,0 +1,86 @@ +From 36b6ec7fe3497ec8c2f2bc86cf0c94a552bb0e57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 10:49:56 +0100 +Subject: gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock + +From: Marek Vasut + +[ Upstream commit e5464277625c1aca5c002e0f470377cdd6816dcf ] + +The driver currently performs register read-modify-write without locking +in its irqchip part, this could lead to a race condition when configuring +interrupt mode setting. Add the missing bgpio spinlock lock/unlock around +the register read-modify-write. + +Reviewed-by: Linus Walleij +Reviewed-by: Marc Zyngier +Fixes: 07bd1a6cc7cbb ("MXC arch: Add gpio support for the whole platform") +Signed-off-by: Marek Vasut +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mxc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c +index c871602fc5ba..6cc98a5684ae 100644 +--- a/drivers/gpio/gpio-mxc.c ++++ b/drivers/gpio/gpio-mxc.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -147,6 +148,7 @@ static int gpio_set_irq_type(struct irq_data *d, u32 type) + { + struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d); + struct mxc_gpio_port *port = gc->private; ++ unsigned long flags; + u32 bit, val; + u32 gpio_idx = d->hwirq; + int edge; +@@ -185,6 +187,8 @@ static int gpio_set_irq_type(struct irq_data *d, u32 type) + return -EINVAL; + } + ++ raw_spin_lock_irqsave(&port->gc.bgpio_lock, flags); ++ + if (GPIO_EDGE_SEL >= 0) { + val = readl(port->base + GPIO_EDGE_SEL); + if (edge == GPIO_INT_BOTH_EDGES) +@@ -204,15 +208,20 @@ static int gpio_set_irq_type(struct irq_data *d, u32 type) + + writel(1 << gpio_idx, port->base + GPIO_ISR); + ++ raw_spin_unlock_irqrestore(&port->gc.bgpio_lock, flags); ++ + return 0; + } + + static void mxc_flip_edge(struct mxc_gpio_port *port, u32 gpio) + { + void __iomem *reg = port->base; ++ unsigned long flags; + u32 bit, val; + int edge; + ++ raw_spin_lock_irqsave(&port->gc.bgpio_lock, flags); ++ + reg += GPIO_ICR1 + ((gpio & 0x10) >> 2); /* lower or upper register */ + bit = gpio & 0xf; + val = readl(reg); +@@ -230,6 +239,8 @@ static void mxc_flip_edge(struct mxc_gpio_port *port, u32 gpio) + return; + } + writel(val | (edge << (bit << 1)), reg); ++ ++ raw_spin_unlock_irqrestore(&port->gc.bgpio_lock, flags); + } + + /* handle 32 interrupts in one status register */ +-- +2.39.0 + diff --git a/queue-6.1/hid-amd_sfh-fix-warning-unwind-goto.patch b/queue-6.1/hid-amd_sfh-fix-warning-unwind-goto.patch new file mode 100644 index 00000000000..2b51e01044e --- /dev/null +++ b/queue-6.1/hid-amd_sfh-fix-warning-unwind-goto.patch @@ -0,0 +1,54 @@ +From 652451ebf2e742a9debe1413570ba9bcb84fc6e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 22:00:42 +0530 +Subject: HID: amd_sfh: Fix warning unwind goto + +From: Basavaraj Natikar + +[ Upstream commit 2a33ad4a0ba5a527b92aeef9a313aefec197fe28 ] + +Return directly instead of using existing goto will not cleanup +previously allocated resources. Hence replace return with goto +to fix warning unwind goto which cleanups previously allocated +resources. + +Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/amd-sfh-hid/amd_sfh_client.c | 2 +- + drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_client.c b/drivers/hid/amd-sfh-hid/amd_sfh_client.c +index ab125f79408f..1fb0f7105fb2 100644 +--- a/drivers/hid/amd-sfh-hid/amd_sfh_client.c ++++ b/drivers/hid/amd-sfh-hid/amd_sfh_client.c +@@ -282,7 +282,7 @@ int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata) + } + rc = mp2_ops->get_rep_desc(cl_idx, cl_data->report_descr[i]); + if (rc) +- return rc; ++ goto cleanup; + mp2_ops->start(privdata, info); + status = amd_sfh_wait_for_response + (privdata, cl_data->sensor_idx[i], SENSOR_ENABLED); +diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c +index 4da2f9f62aba..a1d6e08fab7d 100644 +--- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c ++++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c +@@ -160,7 +160,7 @@ static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata) + } + rc = mp2_ops->get_rep_desc(cl_idx, cl_data->report_descr[i]); + if (rc) +- return rc; ++ goto cleanup; + + writel(0, privdata->mmio + AMD_P2C_MSG(0)); + mp2_ops->start(privdata, info); +-- +2.39.0 + diff --git a/queue-6.1/hid-betop-check-shape-of-output-reports.patch b/queue-6.1/hid-betop-check-shape-of-output-reports.patch new file mode 100644 index 00000000000..d2b499ab5d6 --- /dev/null +++ b/queue-6.1/hid-betop-check-shape-of-output-reports.patch @@ -0,0 +1,68 @@ +From 3c1006635d823584982eb00c30d831b00aef0c4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 18:12:16 +0000 +Subject: HID: betop: check shape of output reports + +From: Pietro Borrello + +[ Upstream commit 3782c0d6edf658b71354a64d60aa7a296188fc90 ] + +betopff_init() only checks the total sum of the report counts for each +report field to be at least 4, but hid_betopff_play() expects 4 report +fields. +A device advertising an output report with one field and 4 report counts +would pass the check but crash the kernel with a NULL pointer dereference +in hid_betopff_play(). + +Fixes: 52cd7785f3cd ("HID: betop: add drivers/hid/hid-betopff.c") +Signed-off-by: Pietro Borrello +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-betopff.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c +index 467d789f9bc2..25ed7b9a917e 100644 +--- a/drivers/hid/hid-betopff.c ++++ b/drivers/hid/hid-betopff.c +@@ -60,7 +60,6 @@ static int betopff_init(struct hid_device *hid) + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; + struct input_dev *dev; +- int field_count = 0; + int error; + int i, j; + +@@ -86,19 +85,21 @@ static int betopff_init(struct hid_device *hid) + * ----------------------------------------- + * Do init them with default value. + */ ++ if (report->maxfield < 4) { ++ hid_err(hid, "not enough fields in the report: %d\n", ++ report->maxfield); ++ return -ENODEV; ++ } + for (i = 0; i < report->maxfield; i++) { ++ if (report->field[i]->report_count < 1) { ++ hid_err(hid, "no values in the field\n"); ++ return -ENODEV; ++ } + for (j = 0; j < report->field[i]->report_count; j++) { + report->field[i]->value[j] = 0x00; +- field_count++; + } + } + +- if (field_count < 4) { +- hid_err(hid, "not enough fields in the report: %d\n", +- field_count); +- return -ENODEV; +- } +- + betopff = kzalloc(sizeof(*betopff), GFP_KERNEL); + if (!betopff) + return -ENOMEM; +-- +2.39.0 + diff --git a/queue-6.1/hid-check-empty-report_list-in-bigben_probe.patch b/queue-6.1/hid-check-empty-report_list-in-bigben_probe.patch new file mode 100644 index 00000000000..4efaf854c10 --- /dev/null +++ b/queue-6.1/hid-check-empty-report_list-in-bigben_probe.patch @@ -0,0 +1,43 @@ +From 57da5d1e13960bf6476cc92c39a3c50bf2da0b0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 11:11:25 +0000 +Subject: HID: check empty report_list in bigben_probe() + +From: Pietro Borrello + +[ Upstream commit c7bf714f875531f227f2ef1fdcc8f4d44e7c7d9d ] + +Add a check for empty report_list in bigben_probe(). +The missing check causes a type confusion when issuing a list_entry() +on an empty report_list. +The problem is caused by the assumption that the device must +have valid report_list. While this will be true for all normal HID +devices, a suitably malicious device can violate the assumption. + +Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") +Signed-off-by: Pietro Borrello +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-bigbenff.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index e8c5e3ac9fff..e8b16665860d 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -344,6 +344,11 @@ static int bigben_probe(struct hid_device *hid, + } + + report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; ++ if (list_empty(report_list)) { ++ hid_err(hid, "no output report found\n"); ++ error = -ENODEV; ++ goto error_hw_stop; ++ } + bigben->report = list_entry(report_list->next, + struct hid_report, list); + +-- +2.39.0 + diff --git a/queue-6.1/hid-check-empty-report_list-in-hid_validate_values.patch b/queue-6.1/hid-check-empty-report_list-in-hid_validate_values.patch new file mode 100644 index 00000000000..759ca407590 --- /dev/null +++ b/queue-6.1/hid-check-empty-report_list-in-hid_validate_values.patch @@ -0,0 +1,42 @@ +From 5b12ceefa3914f645eeab3abd53a6c327e55119c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 11:11:24 +0000 +Subject: HID: check empty report_list in hid_validate_values() + +From: Pietro Borrello + +[ Upstream commit b12fece4c64857e5fab4290bf01b2e0317a88456 ] + +Add a check for empty report_list in hid_validate_values(). +The missing check causes a type confusion when issuing a list_entry() +on an empty report_list. +The problem is caused by the assumption that the device must +have valid report_list. While this will be true for all normal HID +devices, a suitably malicious device can violate the assumption. + +Fixes: 1b15d2e5b807 ("HID: core: fix validation of report id 0") +Signed-off-by: Pietro Borrello +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index bd47628da6be..3e1803592bd4 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -993,8 +993,8 @@ struct hid_report *hid_validate_values(struct hid_device *hid, + * Validating on id 0 means we should examine the first + * report in the list. + */ +- report = list_entry( +- hid->report_enum[type].report_list.next, ++ report = list_first_entry_or_null( ++ &hid->report_enum[type].report_list, + struct hid_report, list); + } else { + report = hid->report_enum[type].report_id_hash[id]; +-- +2.39.0 + diff --git a/queue-6.1/hid-intel_ish-hid-add-check-for-ishtp_dma_tx_map.patch b/queue-6.1/hid-intel_ish-hid-add-check-for-ishtp_dma_tx_map.patch new file mode 100644 index 00000000000..f25c1c2d4b9 --- /dev/null +++ b/queue-6.1/hid-intel_ish-hid-add-check-for-ishtp_dma_tx_map.patch @@ -0,0 +1,53 @@ +From e6e2d88f53a82b99e64b2128ead785a69dc5af78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 21:48:23 +0800 +Subject: HID: intel_ish-hid: Add check for ishtp_dma_tx_map + +From: Jiasheng Jiang + +[ Upstream commit b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8 ] + +As the kcalloc may return NULL pointer, +it should be better to check the ishtp_dma_tx_map +before use in order to avoid NULL pointer dereference. + +Fixes: 3703f53b99e4 ("HID: intel_ish-hid: ISH Transport layer") +Signed-off-by: Jiasheng Jiang +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ishtp/dma-if.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/hid/intel-ish-hid/ishtp/dma-if.c b/drivers/hid/intel-ish-hid/ishtp/dma-if.c +index 40554c8daca0..00046cbfd4ed 100644 +--- a/drivers/hid/intel-ish-hid/ishtp/dma-if.c ++++ b/drivers/hid/intel-ish-hid/ishtp/dma-if.c +@@ -104,6 +104,11 @@ void *ishtp_cl_get_dma_send_buf(struct ishtp_device *dev, + int required_slots = (size / DMA_SLOT_SIZE) + + 1 * (size % DMA_SLOT_SIZE != 0); + ++ if (!dev->ishtp_dma_tx_map) { ++ dev_err(dev->devc, "Fail to allocate Tx map\n"); ++ return NULL; ++ } ++ + spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags); + for (i = 0; i <= (dev->ishtp_dma_num_slots - required_slots); i++) { + free = 1; +@@ -150,6 +155,11 @@ void ishtp_cl_release_dma_acked_mem(struct ishtp_device *dev, + return; + } + ++ if (!dev->ishtp_dma_tx_map) { ++ dev_err(dev->devc, "Fail to allocate Tx map\n"); ++ return; ++ } ++ + i = (msg_addr - dev->ishtp_host_dma_tx_buf) / DMA_SLOT_SIZE; + spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags); + for (j = 0; j < acked_slots; j++) { +-- +2.39.0 + diff --git a/queue-6.1/hid-revert-cherry_mouse_000c-quirk.patch b/queue-6.1/hid-revert-cherry_mouse_000c-quirk.patch new file mode 100644 index 00000000000..5222f845610 --- /dev/null +++ b/queue-6.1/hid-revert-cherry_mouse_000c-quirk.patch @@ -0,0 +1,49 @@ +From 0cd4c29f709bd3f563dcc87829d09c142eda2469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 15:41:40 +0100 +Subject: HID: revert CHERRY_MOUSE_000C quirk + +From: Jiri Kosina + +[ Upstream commit cbf44580ce6b310272a73e3e794233fd064330bd ] + +This partially reverts commit f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk +for some mice"), as it turns out to break reboot on some platforms for reason +yet to be understood. + +Fixes: f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk for some mice") +Reported-by: Christian Zigotzky +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 - + drivers/hid/hid-quirks.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 82713ef3aaa6..c3735848ed5d 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -274,7 +274,6 @@ + #define USB_DEVICE_ID_CH_AXIS_295 0x001c + + #define USB_VENDOR_ID_CHERRY 0x046a +-#define USB_DEVICE_ID_CHERRY_MOUSE_000C 0x000c + #define USB_DEVICE_ID_CHERRY_CYMOTION 0x0023 + #define USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR 0x0027 + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 0e9702c7f7d6..be3ad02573de 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -54,7 +54,6 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, +- { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_MOUSE_000C), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.39.0 + diff --git a/queue-6.1/ib-hfi1-fix-expected-receive-setup-error-exit-issues.patch b/queue-6.1/ib-hfi1-fix-expected-receive-setup-error-exit-issues.patch new file mode 100644 index 00000000000..2e7a5e17f74 --- /dev/null +++ b/queue-6.1/ib-hfi1-fix-expected-receive-setup-error-exit-issues.patch @@ -0,0 +1,170 @@ +From 82916a699001fe542a0633dfb31afd766fb16757 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 12:31:21 -0500 +Subject: IB/hfi1: Fix expected receive setup error exit issues + +From: Dean Luick + +[ Upstream commit e0c4a422f5246abefbf7c178ef99a1f2dc3c5f62 ] + +Fix three error exit issues in expected receive setup. +Re-arrange error exits to increase readability. + +Issues and fixes: +1. Possible missed page unpin if tidlist copyout fails and + not all pinned pages where made part of a TID. + Fix: Unpin the unused pages. + +2. Return success with unset return values tidcnt and length + when no pages were pinned. + Fix: Return -ENOSPC if no pages were pinned. + +3. Return success with unset return values tidcnt and length when + no rcvarray entries available. + Fix: Return -ENOSPC if no rcvarray entries are available. + +Fixes: 7e7a436ecb6e ("staging/hfi1: Add TID entry program function body") +Fixes: 97736f36dbeb ("IB/hfi1: Validate page aligned for a given virtual addres") +Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167328548150.1472310.1492305874804187634.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 83 ++++++++++++++--------- + 1 file changed, 50 insertions(+), 33 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index d7487555d109..88df8ca4bb57 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -268,15 +268,14 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets), + GFP_KERNEL); + if (!tidbuf->psets) { +- kfree(tidbuf); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto fail_release_mem; + } + + pinned = pin_rcv_pages(fd, tidbuf); + if (pinned <= 0) { +- kfree(tidbuf->psets); +- kfree(tidbuf); +- return pinned; ++ ret = (pinned < 0) ? pinned : -ENOSPC; ++ goto fail_unpin; + } + + /* Find sets of physically contiguous pages */ +@@ -291,14 +290,16 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + fd->tid_used += pageset_count; + spin_unlock(&fd->tid_lock); + +- if (!pageset_count) +- goto bail; ++ if (!pageset_count) { ++ ret = -ENOSPC; ++ goto fail_unreserve; ++ } + + ngroups = pageset_count / dd->rcv_entries.group_size; + tidlist = kcalloc(pageset_count, sizeof(*tidlist), GFP_KERNEL); + if (!tidlist) { + ret = -ENOMEM; +- goto nomem; ++ goto fail_unreserve; + } + + tididx = 0; +@@ -394,44 +395,60 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + } + unlock: + mutex_unlock(&uctxt->exp_mutex); +-nomem: + hfi1_cdbg(TID, "total mapped: tidpairs:%u pages:%u (%d)", tididx, + mapped_pages, ret); ++ ++ /* fail if nothing was programmed, set error if none provided */ ++ if (tididx == 0) { ++ if (ret >= 0) ++ ret = -ENOSPC; ++ goto fail_unreserve; ++ } ++ + /* adjust reserved tid_used to actual count */ + spin_lock(&fd->tid_lock); + fd->tid_used -= pageset_count - tididx; + spin_unlock(&fd->tid_lock); +- if (tididx) { +- tinfo->tidcnt = tididx; +- tinfo->length = mapped_pages * PAGE_SIZE; + +- if (copy_to_user(u64_to_user_ptr(tinfo->tidlist), +- tidlist, sizeof(tidlist[0]) * tididx)) { +- /* +- * On failure to copy to the user level, we need to undo +- * everything done so far so we don't leak resources. +- */ +- tinfo->tidlist = (unsigned long)&tidlist; +- hfi1_user_exp_rcv_clear(fd, tinfo); +- tinfo->tidlist = 0; +- ret = -EFAULT; +- goto bail; +- } ++ /* unpin all pages not covered by a TID */ ++ unpin_rcv_pages(fd, tidbuf, NULL, mapped_pages, pinned - mapped_pages, ++ false); ++ ++ tinfo->tidcnt = tididx; ++ tinfo->length = mapped_pages * PAGE_SIZE; ++ ++ if (copy_to_user(u64_to_user_ptr(tinfo->tidlist), ++ tidlist, sizeof(tidlist[0]) * tididx)) { ++ ret = -EFAULT; ++ goto fail_unprogram; + } + +- /* +- * If not everything was mapped (due to insufficient RcvArray entries, +- * for example), unpin all unmapped pages so we can pin them nex time. +- */ +- if (mapped_pages != pinned) +- unpin_rcv_pages(fd, tidbuf, NULL, mapped_pages, +- (pinned - mapped_pages), false); +-bail: ++ kfree(tidbuf->pages); + kfree(tidbuf->psets); ++ kfree(tidbuf); + kfree(tidlist); ++ return 0; ++ ++fail_unprogram: ++ /* unprogram, unmap, and unpin all allocated TIDs */ ++ tinfo->tidlist = (unsigned long)tidlist; ++ hfi1_user_exp_rcv_clear(fd, tinfo); ++ tinfo->tidlist = 0; ++ pinned = 0; /* nothing left to unpin */ ++ pageset_count = 0; /* nothing left reserved */ ++fail_unreserve: ++ spin_lock(&fd->tid_lock); ++ fd->tid_used -= pageset_count; ++ spin_unlock(&fd->tid_lock); ++fail_unpin: ++ if (pinned > 0) ++ unpin_rcv_pages(fd, tidbuf, NULL, 0, pinned, false); ++fail_release_mem: + kfree(tidbuf->pages); ++ kfree(tidbuf->psets); + kfree(tidbuf); +- return ret > 0 ? 0 : ret; ++ kfree(tidlist); ++ return ret; + } + + int hfi1_user_exp_rcv_clear(struct hfi1_filedata *fd, +-- +2.39.0 + diff --git a/queue-6.1/ib-hfi1-immediately-remove-invalid-memory-from-hardw.patch b/queue-6.1/ib-hfi1-immediately-remove-invalid-memory-from-hardw.patch new file mode 100644 index 00000000000..7187bfb07ed --- /dev/null +++ b/queue-6.1/ib-hfi1-immediately-remove-invalid-memory-from-hardw.patch @@ -0,0 +1,150 @@ +From fba982feef0ea74774ae523cfc015e5c466ddc9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 12:31:26 -0500 +Subject: IB/hfi1: Immediately remove invalid memory from hardware + +From: Dean Luick + +[ Upstream commit 1c7edde1b5720ddb0aff5ca8c7f605a0f92526eb ] + +When a user expected receive page is unmapped, it should be +immediately removed from hardware rather than depend on a +reaction from user space. + +Fixes: 2677a7680e77 ("IB/hfi1: Fix memory leak during unexpected shutdown") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167328548663.1472310.7871808081861622659.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 43 +++++++++++++++-------- + drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 + + 2 files changed, 30 insertions(+), 14 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index 88df8ca4bb57..f402af1e2903 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -28,8 +28,9 @@ static int program_rcvarray(struct hfi1_filedata *fd, struct tid_user_buf *, + unsigned int start, u16 count, + u32 *tidlist, unsigned int *tididx, + unsigned int *pmapped); +-static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo, +- struct tid_group **grp); ++static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo); ++static void __clear_tid_node(struct hfi1_filedata *fd, ++ struct tid_rb_node *node); + static void clear_tid_node(struct hfi1_filedata *fd, struct tid_rb_node *node); + + static const struct mmu_interval_notifier_ops tid_mn_ops = { +@@ -469,7 +470,7 @@ int hfi1_user_exp_rcv_clear(struct hfi1_filedata *fd, + + mutex_lock(&uctxt->exp_mutex); + for (tididx = 0; tididx < tinfo->tidcnt; tididx++) { +- ret = unprogram_rcvarray(fd, tidinfo[tididx], NULL); ++ ret = unprogram_rcvarray(fd, tidinfo[tididx]); + if (ret) { + hfi1_cdbg(TID, "Failed to unprogram rcv array %d", + ret); +@@ -723,6 +724,7 @@ static int set_rcvarray_entry(struct hfi1_filedata *fd, + } + + node->fdata = fd; ++ mutex_init(&node->invalidate_mutex); + node->phys = page_to_phys(pages[0]); + node->npages = npages; + node->rcventry = rcventry; +@@ -762,8 +764,7 @@ static int set_rcvarray_entry(struct hfi1_filedata *fd, + return -EFAULT; + } + +-static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo, +- struct tid_group **grp) ++static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo) + { + struct hfi1_ctxtdata *uctxt = fd->uctxt; + struct hfi1_devdata *dd = uctxt->dd; +@@ -786,9 +787,6 @@ static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo, + if (!node || node->rcventry != (uctxt->expected_base + rcventry)) + return -EBADF; + +- if (grp) +- *grp = node->grp; +- + if (fd->use_mn) + mmu_interval_notifier_remove(&node->notifier); + cacheless_tid_rb_remove(fd, node); +@@ -796,23 +794,34 @@ static int unprogram_rcvarray(struct hfi1_filedata *fd, u32 tidinfo, + return 0; + } + +-static void clear_tid_node(struct hfi1_filedata *fd, struct tid_rb_node *node) ++static void __clear_tid_node(struct hfi1_filedata *fd, struct tid_rb_node *node) + { + struct hfi1_ctxtdata *uctxt = fd->uctxt; + struct hfi1_devdata *dd = uctxt->dd; + ++ mutex_lock(&node->invalidate_mutex); ++ if (node->freed) ++ goto done; ++ node->freed = true; ++ + trace_hfi1_exp_tid_unreg(uctxt->ctxt, fd->subctxt, node->rcventry, + node->npages, + node->notifier.interval_tree.start, node->phys, + node->dma_addr); + +- /* +- * Make sure device has seen the write before we unpin the +- * pages. +- */ ++ /* Make sure device has seen the write before pages are unpinned */ + hfi1_put_tid(dd, node->rcventry, PT_INVALID_FLUSH, 0, 0); + + unpin_rcv_pages(fd, NULL, node, 0, node->npages, true); ++done: ++ mutex_unlock(&node->invalidate_mutex); ++} ++ ++static void clear_tid_node(struct hfi1_filedata *fd, struct tid_rb_node *node) ++{ ++ struct hfi1_ctxtdata *uctxt = fd->uctxt; ++ ++ __clear_tid_node(fd, node); + + node->grp->used--; + node->grp->map &= ~(1 << (node->rcventry - node->grp->base)); +@@ -871,10 +880,16 @@ static bool tid_rb_invalidate(struct mmu_interval_notifier *mni, + if (node->freed) + return true; + ++ /* take action only if unmapping */ ++ if (range->event != MMU_NOTIFY_UNMAP) ++ return true; ++ + trace_hfi1_exp_tid_inval(uctxt->ctxt, fdata->subctxt, + node->notifier.interval_tree.start, + node->rcventry, node->npages, node->dma_addr); +- node->freed = true; ++ ++ /* clear the hardware rcvarray entry */ ++ __clear_tid_node(fdata, node); + + spin_lock(&fdata->invalid_lock); + if (fdata->invalid_tid_idx < uctxt->expected_count) { +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.h b/drivers/infiniband/hw/hfi1/user_exp_rcv.h +index 8c53e416bf84..2ddb3dac7d91 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.h ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.h +@@ -27,6 +27,7 @@ struct tid_user_buf { + struct tid_rb_node { + struct mmu_interval_notifier notifier; + struct hfi1_filedata *fdata; ++ struct mutex invalidate_mutex; /* covers hw removal */ + unsigned long phys; + struct tid_group *grp; + u32 rcventry; +-- +2.39.0 + diff --git a/queue-6.1/ib-hfi1-reject-a-zero-length-user-expected-buffer.patch b/queue-6.1/ib-hfi1-reject-a-zero-length-user-expected-buffer.patch new file mode 100644 index 00000000000..cf363436eac --- /dev/null +++ b/queue-6.1/ib-hfi1-reject-a-zero-length-user-expected-buffer.patch @@ -0,0 +1,39 @@ +From 96521fe6ac5a69f9dfb22cfed7a2b72bab9a4161 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 12:31:11 -0500 +Subject: IB/hfi1: Reject a zero-length user expected buffer + +From: Dean Luick + +[ Upstream commit 0a0a6e80472c98947d73c3d13bcd7d101895f55d ] + +A zero length user buffer makes no sense and the code +does not handle it correctly. Instead, reject a +zero length as invalid. + +Fixes: 97736f36dbeb ("IB/hfi1: Validate page aligned for a given virtual addres") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167328547120.1472310.6362802432127399257.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index 186d30291260..3c609b11e71c 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -256,6 +256,8 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + + if (!PAGE_ALIGNED(tinfo->vaddr)) + return -EINVAL; ++ if (tinfo->length == 0) ++ return -EINVAL; + + tidbuf = kzalloc(sizeof(*tidbuf), GFP_KERNEL); + if (!tidbuf) +-- +2.39.0 + diff --git a/queue-6.1/ib-hfi1-remove-user-expected-buffer-invalidate-race.patch b/queue-6.1/ib-hfi1-remove-user-expected-buffer-invalidate-race.patch new file mode 100644 index 00000000000..c2fd172b2bb --- /dev/null +++ b/queue-6.1/ib-hfi1-remove-user-expected-buffer-invalidate-race.patch @@ -0,0 +1,174 @@ +From 5a21e58196810f09efc529e382d9c7097190706c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 12:31:31 -0500 +Subject: IB/hfi1: Remove user expected buffer invalidate race + +From: Dean Luick + +[ Upstream commit b3deec25847bda34e34d5d7be02f633caf000bd8 ] + +During setup, there is a possible race between a page invalidate +and hardware programming. Add a covering invalidate over the user +target range during setup. If anything within that range is +invalidated during setup, fail the setup. Once set up, each +TID will have its own invalidate callback and invalidate. + +Fixes: 3889551db212 ("RDMA/hfi1: Use mmu_interval_notifier_insert for user_exp_rcv") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167328549178.1472310.9867497376936699488.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 58 +++++++++++++++++++++-- + drivers/infiniband/hw/hfi1/user_exp_rcv.h | 2 + + 2 files changed, 55 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index f402af1e2903..b02f2f0809c8 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -23,6 +23,9 @@ static void cacheless_tid_rb_remove(struct hfi1_filedata *fdata, + static bool tid_rb_invalidate(struct mmu_interval_notifier *mni, + const struct mmu_notifier_range *range, + unsigned long cur_seq); ++static bool tid_cover_invalidate(struct mmu_interval_notifier *mni, ++ const struct mmu_notifier_range *range, ++ unsigned long cur_seq); + static int program_rcvarray(struct hfi1_filedata *fd, struct tid_user_buf *, + struct tid_group *grp, + unsigned int start, u16 count, +@@ -36,6 +39,9 @@ static void clear_tid_node(struct hfi1_filedata *fd, struct tid_rb_node *node); + static const struct mmu_interval_notifier_ops tid_mn_ops = { + .invalidate = tid_rb_invalidate, + }; ++static const struct mmu_interval_notifier_ops tid_cover_ops = { ++ .invalidate = tid_cover_invalidate, ++}; + + /* + * Initialize context and file private data needed for Expected +@@ -254,6 +260,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + tididx = 0, mapped, mapped_pages = 0; + u32 *tidlist = NULL; + struct tid_user_buf *tidbuf; ++ unsigned long mmu_seq = 0; + + if (!PAGE_ALIGNED(tinfo->vaddr)) + return -EINVAL; +@@ -264,6 +271,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + if (!tidbuf) + return -ENOMEM; + ++ mutex_init(&tidbuf->cover_mutex); + tidbuf->vaddr = tinfo->vaddr; + tidbuf->length = tinfo->length; + tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets), +@@ -273,6 +281,16 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + goto fail_release_mem; + } + ++ if (fd->use_mn) { ++ ret = mmu_interval_notifier_insert( ++ &tidbuf->notifier, current->mm, ++ tidbuf->vaddr, tidbuf->npages * PAGE_SIZE, ++ &tid_cover_ops); ++ if (ret) ++ goto fail_release_mem; ++ mmu_seq = mmu_interval_read_begin(&tidbuf->notifier); ++ } ++ + pinned = pin_rcv_pages(fd, tidbuf); + if (pinned <= 0) { + ret = (pinned < 0) ? pinned : -ENOSPC; +@@ -415,6 +433,20 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + unpin_rcv_pages(fd, tidbuf, NULL, mapped_pages, pinned - mapped_pages, + false); + ++ if (fd->use_mn) { ++ /* check for an invalidate during setup */ ++ bool fail = false; ++ ++ mutex_lock(&tidbuf->cover_mutex); ++ fail = mmu_interval_read_retry(&tidbuf->notifier, mmu_seq); ++ mutex_unlock(&tidbuf->cover_mutex); ++ ++ if (fail) { ++ ret = -EBUSY; ++ goto fail_unprogram; ++ } ++ } ++ + tinfo->tidcnt = tididx; + tinfo->length = mapped_pages * PAGE_SIZE; + +@@ -424,6 +456,8 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + goto fail_unprogram; + } + ++ if (fd->use_mn) ++ mmu_interval_notifier_remove(&tidbuf->notifier); + kfree(tidbuf->pages); + kfree(tidbuf->psets); + kfree(tidbuf); +@@ -442,6 +476,8 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + fd->tid_used -= pageset_count; + spin_unlock(&fd->tid_lock); + fail_unpin: ++ if (fd->use_mn) ++ mmu_interval_notifier_remove(&tidbuf->notifier); + if (pinned > 0) + unpin_rcv_pages(fd, tidbuf, NULL, 0, pinned, false); + fail_release_mem: +@@ -740,11 +776,6 @@ static int set_rcvarray_entry(struct hfi1_filedata *fd, + &tid_mn_ops); + if (ret) + goto out_unmap; +- /* +- * FIXME: This is in the wrong order, the notifier should be +- * established before the pages are pinned by pin_rcv_pages. +- */ +- mmu_interval_read_begin(&node->notifier); + } + fd->entry_to_rb[node->rcventry - uctxt->expected_base] = node; + +@@ -919,6 +950,23 @@ static bool tid_rb_invalidate(struct mmu_interval_notifier *mni, + return true; + } + ++static bool tid_cover_invalidate(struct mmu_interval_notifier *mni, ++ const struct mmu_notifier_range *range, ++ unsigned long cur_seq) ++{ ++ struct tid_user_buf *tidbuf = ++ container_of(mni, struct tid_user_buf, notifier); ++ ++ /* take action only if unmapping */ ++ if (range->event == MMU_NOTIFY_UNMAP) { ++ mutex_lock(&tidbuf->cover_mutex); ++ mmu_interval_set_seq(mni, cur_seq); ++ mutex_unlock(&tidbuf->cover_mutex); ++ } ++ ++ return true; ++} ++ + static void cacheless_tid_rb_remove(struct hfi1_filedata *fdata, + struct tid_rb_node *tnode) + { +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.h b/drivers/infiniband/hw/hfi1/user_exp_rcv.h +index 2ddb3dac7d91..f8ee997d0050 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.h ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.h +@@ -16,6 +16,8 @@ struct tid_pageset { + }; + + struct tid_user_buf { ++ struct mmu_interval_notifier notifier; ++ struct mutex cover_mutex; + unsigned long vaddr; + unsigned long length; + unsigned int npages; +-- +2.39.0 + diff --git a/queue-6.1/ib-hfi1-reserve-user-expected-tids.patch b/queue-6.1/ib-hfi1-reserve-user-expected-tids.patch new file mode 100644 index 00000000000..c612f2c9395 --- /dev/null +++ b/queue-6.1/ib-hfi1-reserve-user-expected-tids.patch @@ -0,0 +1,63 @@ +From 731e846e5a46c8f3441546e96dfccf617ce2e365 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 12:31:16 -0500 +Subject: IB/hfi1: Reserve user expected TIDs + +From: Dean Luick + +[ Upstream commit ecf91551cdd2925ed6d9a9d99074fa5f67b90596 ] + +To avoid a race, reserve the number of user expected +TIDs before setup. + +Fixes: 7e7a436ecb6e ("staging/hfi1: Add TID entry program function body") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167328547636.1472310.7419712824785353905.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index 3c609b11e71c..d7487555d109 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -282,16 +282,13 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + /* Find sets of physically contiguous pages */ + tidbuf->n_psets = find_phys_blocks(tidbuf, pinned); + +- /* +- * We don't need to access this under a lock since tid_used is per +- * process and the same process cannot be in hfi1_user_exp_rcv_clear() +- * and hfi1_user_exp_rcv_setup() at the same time. +- */ ++ /* Reserve the number of expected tids to be used. */ + spin_lock(&fd->tid_lock); + if (fd->tid_used + tidbuf->n_psets > fd->tid_limit) + pageset_count = fd->tid_limit - fd->tid_used; + else + pageset_count = tidbuf->n_psets; ++ fd->tid_used += pageset_count; + spin_unlock(&fd->tid_lock); + + if (!pageset_count) +@@ -400,10 +397,11 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + nomem: + hfi1_cdbg(TID, "total mapped: tidpairs:%u pages:%u (%d)", tididx, + mapped_pages, ret); ++ /* adjust reserved tid_used to actual count */ ++ spin_lock(&fd->tid_lock); ++ fd->tid_used -= pageset_count - tididx; ++ spin_unlock(&fd->tid_lock); + if (tididx) { +- spin_lock(&fd->tid_lock); +- fd->tid_used += tididx; +- spin_unlock(&fd->tid_lock); + tinfo->tidcnt = tididx; + tinfo->length = mapped_pages * PAGE_SIZE; + +-- +2.39.0 + diff --git a/queue-6.1/interconnect-qcom-msm8996-fix-regmap-max_register-va.patch b/queue-6.1/interconnect-qcom-msm8996-fix-regmap-max_register-va.patch new file mode 100644 index 00000000000..a99bb2c2de2 --- /dev/null +++ b/queue-6.1/interconnect-qcom-msm8996-fix-regmap-max_register-va.patch @@ -0,0 +1,78 @@ +From a9a11bd4de2d0a9056b5adf34ef855da09fd8263 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Dec 2022 21:03:51 +0100 +Subject: interconnect: qcom: msm8996: Fix regmap max_register values + +From: Konrad Dybcio + +[ Upstream commit 4be39d5d86c690c60e2afe55787fc5ec4409d0f0 ] + +The device tree reg starts at BUS_BASE + QoS_OFFSET, but the regmap +configs in the ICC driver had values suggesting the reg started at +BUS_BASE. Shrink them down (where they haven't been already, so for +providers where QoS_OFFSET = 0) to make sure they stay within their +window. + +Fixes: 7add937f5222 ("interconnect: qcom: Add MSM8996 interconnect provider driver") +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Tested-by: Dmitry Baryshkov #db820c +Link: https://lore.kernel.org/r/20221210200353.418391-4-konrad.dybcio@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/msm8996.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/interconnect/qcom/msm8996.c b/drivers/interconnect/qcom/msm8996.c +index 7ddb1f23fb2a..25a1a32bc611 100644 +--- a/drivers/interconnect/qcom/msm8996.c ++++ b/drivers/interconnect/qcom/msm8996.c +@@ -1813,7 +1813,7 @@ static const struct regmap_config msm8996_a0noc_regmap_config = { + .reg_bits = 32, + .reg_stride = 4, + .val_bits = 32, +- .max_register = 0x9000, ++ .max_register = 0x6000, + .fast_io = true + }; + +@@ -1837,7 +1837,7 @@ static const struct regmap_config msm8996_a1noc_regmap_config = { + .reg_bits = 32, + .reg_stride = 4, + .val_bits = 32, +- .max_register = 0x7000, ++ .max_register = 0x5000, + .fast_io = true + }; + +@@ -1858,7 +1858,7 @@ static const struct regmap_config msm8996_a2noc_regmap_config = { + .reg_bits = 32, + .reg_stride = 4, + .val_bits = 32, +- .max_register = 0xa000, ++ .max_register = 0x7000, + .fast_io = true + }; + +@@ -1886,7 +1886,7 @@ static const struct regmap_config msm8996_bimc_regmap_config = { + .reg_bits = 32, + .reg_stride = 4, + .val_bits = 32, +- .max_register = 0x62000, ++ .max_register = 0x5a000, + .fast_io = true + }; + +@@ -1997,7 +1997,7 @@ static const struct regmap_config msm8996_mnoc_regmap_config = { + .reg_bits = 32, + .reg_stride = 4, + .val_bits = 32, +- .max_register = 0x20000, ++ .max_register = 0x1c000, + .fast_io = true + }; + +-- +2.39.0 + diff --git a/queue-6.1/interconnect-qcom-msm8996-provide-ufs-clocks-to-a2no.patch b/queue-6.1/interconnect-qcom-msm8996-provide-ufs-clocks-to-a2no.patch new file mode 100644 index 00000000000..074dbf3a16d --- /dev/null +++ b/queue-6.1/interconnect-qcom-msm8996-provide-ufs-clocks-to-a2no.patch @@ -0,0 +1,56 @@ +From e9a1181a51b33d9cc64cbbe3737a4ebe6a112db5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Dec 2022 21:03:50 +0100 +Subject: interconnect: qcom: msm8996: Provide UFS clocks to A2NoC + +From: Konrad Dybcio + +[ Upstream commit 60426ff08af6a21275d9c879c0dfb09406469868 ] + +On eMMC devices the bootloader has no business enabling UFS clocks. +That results in a platform hang and hard reboot when trying to vote +on paths including MASTER_UFS and since sync_state guarantees that +it's done at boot time, this effectively prevents such devices from +booting. Fix that. + +Fixes: 7add937f5222 ("interconnect: qcom: Add MSM8996 interconnect provider driver") +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Tested-by: Dmitry Baryshkov #db820c +Link: https://lore.kernel.org/r/20221210200353.418391-3-konrad.dybcio@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/msm8996.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/interconnect/qcom/msm8996.c b/drivers/interconnect/qcom/msm8996.c +index c2903ae3b3bc..7ddb1f23fb2a 100644 +--- a/drivers/interconnect/qcom/msm8996.c ++++ b/drivers/interconnect/qcom/msm8996.c +@@ -33,6 +33,13 @@ static const char * const bus_a0noc_clocks[] = { + "aggre0_noc_mpu_cfg" + }; + ++static const char * const bus_a2noc_clocks[] = { ++ "bus", ++ "bus_a", ++ "aggre2_ufs_axi", ++ "ufs_axi" ++}; ++ + static const u16 mas_a0noc_common_links[] = { + MSM8996_SLAVE_A0NOC_SNOC + }; +@@ -1859,6 +1866,8 @@ static const struct qcom_icc_desc msm8996_a2noc = { + .type = QCOM_ICC_NOC, + .nodes = a2noc_nodes, + .num_nodes = ARRAY_SIZE(a2noc_nodes), ++ .clocks = bus_a2noc_clocks, ++ .num_clocks = ARRAY_SIZE(bus_a2noc_clocks), + .regmap_cfg = &msm8996_a2noc_regmap_config + }; + +-- +2.39.0 + diff --git a/queue-6.1/kbuild-export-top-level-ldflags_vmlinux-only-to-scri.patch b/queue-6.1/kbuild-export-top-level-ldflags_vmlinux-only-to-scri.patch new file mode 100644 index 00000000000..d4f6ca983d8 --- /dev/null +++ b/queue-6.1/kbuild-export-top-level-ldflags_vmlinux-only-to-scri.patch @@ -0,0 +1,145 @@ +From 42e54901df43fb15affd1fcc977655b76fa87a3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 04:23:17 +0900 +Subject: kbuild: export top-level LDFLAGS_vmlinux only to + scripts/Makefile.vmlinux + +From: Masahiro Yamada + +[ Upstream commit 8debed3efe3a731451ad9a91a7a74eeb18a7f7eb ] + +Nathan Chancellor reports that $(NM) emits an error message when +GNU Make 4.4 is used to build the ARM zImage. + + $ make-4.4 ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- O=build defconfig zImage + [snip] + LD vmlinux + NM System.map + SORTTAB vmlinux + OBJCOPY arch/arm/boot/Image + Kernel: arch/arm/boot/Image is ready + arm-linux-gnueabi-nm: 'arch/arm/boot/compressed/../../../../vmlinux': No such file + /bin/sh: 1: arithmetic expression: expecting primary: " " + LDS arch/arm/boot/compressed/vmlinux.lds + AS arch/arm/boot/compressed/head.o + GZIP arch/arm/boot/compressed/piggy_data + AS arch/arm/boot/compressed/piggy.o + CC arch/arm/boot/compressed/misc.o + +This occurs since GNU Make commit 98da874c4303 ("[SV 10593] Export +variables to $(shell ...) commands"), and the O= option is needed to +reproduce it. The generated zImage is correct despite the error message. + +As the commit description of 98da874c4303 [1] says, exported variables +are passed down to $(shell ) functions, which means exported recursive +variables might be expanded earlier than before, in the parse stage. + +The following test code demonstrates the change for GNU Make 4.4. + +[Test Makefile] + + $(shell echo hello > foo) + export foo = $(shell cat bar/../foo) + $(shell mkdir bar) + + all: + @echo $(foo) + +[GNU Make 4.3] + + $ rm -rf bar; make-4.3 + hello + +[GNU Make 4.4] + + $ rm -rf bar; make-4.4 + cat: bar/../foo: No such file or directory + hello + +The 'foo' is a resursively expanded (i.e. lazily expanded) variable. + +GNU Make 4.3 expands 'foo' just before running the recipe '@echo $(foo)', +at this point, the directory 'bar' exists. + +GNU Make 4.4 expands 'foo' to evaluate $(shell mkdir bar) because it is +exported. At this point, the directory 'bar' does not exit yet. The cat +command cannot resolve the bar/../foo path, hence the error message. + +Let's get back to the kernel Makefile. + +In arch/arm/boot/compressed/Makefile, KBSS_SZ is referenced by +LDFLAGS_vmlinux, which is recursive and also exported by the top +Makefile. + +GNU Make 4.3 expands KBSS_SZ just before running the recipes, so no +error message. + +GNU Make 4.4 expands KBSS_SZ in the parse stage, where the directory +arm/arm/boot/compressed does not exit yet. When compiled with O=, +the output directory is created by $(shell mkdir -p $(obj-dirs)) +in scripts/Makefile.build. + +There are two ways to fix this particular issue: + + - change "$(obj)/../../../../vmlinux" in KBSS_SZ to "vmlinux" + - unexport LDFLAGS_vmlinux + +This commit takes the latter course because it is what I originally +intended. + +Commit 3ec8a5b33dea ("kbuild: do not export LDFLAGS_vmlinux") +unexported LDFLAGS_vmlinux. + +Commit 5d4aeffbf709 ("kbuild: rebuild .vmlinux.export.o when its +prerequisite is updated") accidentally exported it again. + +We can clean up arch/arm/boot/compressed/Makefile later. + +[1]: https://git.savannah.gnu.org/cgit/make.git/commit/?id=98da874c43035a490cdca81331724f233a3d0c9a + +Link: https://lore.kernel.org/all/Y7i8+EjwdnhHtlrr@dev-arch.thelio-3990X/ +Fixes: 5d4aeffbf709 ("kbuild: rebuild .vmlinux.export.o when its prerequisite is updated") +Reported-by: Nathan Chancellor +Signed-off-by: Masahiro Yamada +Reviewed-by: Nicolas Schier +Tested-by: Nathan Chancellor +Signed-off-by: Sasha Levin +--- + Makefile | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 49261450039a..770e509d4da4 100644 +--- a/Makefile ++++ b/Makefile +@@ -538,7 +538,7 @@ LDFLAGS_MODULE = + CFLAGS_KERNEL = + RUSTFLAGS_KERNEL = + AFLAGS_KERNEL = +-export LDFLAGS_vmlinux = ++LDFLAGS_vmlinux = + + # Use USERINCLUDE when you must reference the UAPI directories only. + USERINCLUDE := \ +@@ -1232,6 +1232,18 @@ vmlinux.o modules.builtin.modinfo modules.builtin: vmlinux_o + @: + + PHONY += vmlinux ++# LDFLAGS_vmlinux in the top Makefile defines linker flags for the top vmlinux, ++# not for decompressors. LDFLAGS_vmlinux in arch/*/boot/compressed/Makefile is ++# unrelated; the decompressors just happen to have the same base name, ++# arch/*/boot/compressed/vmlinux. ++# Export LDFLAGS_vmlinux only to scripts/Makefile.vmlinux. ++# ++# _LDFLAGS_vmlinux is a workaround for the 'private export' bug: ++# https://savannah.gnu.org/bugs/?61463 ++# For Make > 4.4, the following simple code will work: ++# vmlinux: private export LDFLAGS_vmlinux := $(LDFLAGS_vmlinux) ++vmlinux: private _LDFLAGS_vmlinux := $(LDFLAGS_vmlinux) ++vmlinux: export LDFLAGS_vmlinux = $(_LDFLAGS_vmlinux) + vmlinux: vmlinux.o $(KBUILD_LDS) modpost + $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.vmlinux + +-- +2.39.0 + diff --git a/queue-6.1/kbuild-fix-make-modules-error-when-config_debug_info.patch b/queue-6.1/kbuild-fix-make-modules-error-when-config_debug_info.patch new file mode 100644 index 00000000000..17cf3c183f8 --- /dev/null +++ b/queue-6.1/kbuild-fix-make-modules-error-when-config_debug_info.patch @@ -0,0 +1,47 @@ +From f9cd5fd158e64b1dacc778be813a7ee85938f622 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 14:48:00 +0900 +Subject: kbuild: fix 'make modules' error when CONFIG_DEBUG_INFO_BTF_MODULES=y + +From: Masahiro Yamada + +[ Upstream commit 74d3320f6f7cf72de88a7e8df573821f6db90239 ] + +When CONFIG_DEBUG_INFO_BTF_MODULES=y, running 'make modules' +in the clean kernel tree will get the following error. + + $ grep CONFIG_DEBUG_INFO_BTF_MODULES .config + CONFIG_DEBUG_INFO_BTF_MODULES=y + $ make -s clean + $ make modules + [snip] + AR vmlinux.a + ar: ./built-in.a: No such file or directory + make: *** [Makefile:1241: vmlinux.a] Error 1 + +'modules' depends on 'vmlinux', but builtin objects are not built. + +Define KBUILD_BUILTIN. + +Fixes: f73edc8951b2 ("kbuild: unify two modpost invocations") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Makefile b/Makefile +index 770e509d4da4..0904b82905d9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1529,6 +1529,7 @@ endif + # *.ko are usually independent of vmlinux, but CONFIG_DEBUG_INFOBTF_MODULES + # is an exception. + ifdef CONFIG_DEBUG_INFO_BTF_MODULES ++KBUILD_BUILTIN := 1 + modules: vmlinux + endif + +-- +2.39.0 + diff --git a/queue-6.1/kcsan-test-don-t-put-the-expect-array-on-the-stack.patch b/queue-6.1/kcsan-test-don-t-put-the-expect-array-on-the-stack.patch new file mode 100644 index 00000000000..c66156c96cb --- /dev/null +++ b/queue-6.1/kcsan-test-don-t-put-the-expect-array-on-the-stack.patch @@ -0,0 +1,64 @@ +From a994cdf76333e70f7fd7bb1000f3ae9ca52d317d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 23:28:21 -0800 +Subject: kcsan: test: don't put the expect array on the stack + +From: Max Filippov + +[ Upstream commit 5b24ac2dfd3eb3e36f794af3aa7f2828b19035bd ] + +Size of the 'expect' array in the __report_matches is 1536 bytes, which +is exactly the default frame size warning limit of the xtensa +architecture. +As a result allmodconfig xtensa kernel builds with the gcc that does not +support the compiler plugins (which otherwise would push the said +warning limit to 2K) fail with the following message: + + kernel/kcsan/kcsan_test.c:257:1: error: the frame size of 1680 bytes + is larger than 1536 bytes + +Fix it by dynamically allocating the 'expect' array. + +Signed-off-by: Max Filippov +Reviewed-by: Marco Elver +Tested-by: Marco Elver +Signed-off-by: Sasha Levin +--- + kernel/kcsan/kcsan_test.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/kernel/kcsan/kcsan_test.c b/kernel/kcsan/kcsan_test.c +index dcec1b743c69..a60c561724be 100644 +--- a/kernel/kcsan/kcsan_test.c ++++ b/kernel/kcsan/kcsan_test.c +@@ -159,7 +159,7 @@ static bool __report_matches(const struct expect_report *r) + const bool is_assert = (r->access[0].type | r->access[1].type) & KCSAN_ACCESS_ASSERT; + bool ret = false; + unsigned long flags; +- typeof(observed.lines) expect; ++ typeof(*observed.lines) *expect; + const char *end; + char *cur; + int i; +@@ -168,6 +168,10 @@ static bool __report_matches(const struct expect_report *r) + if (!report_available()) + return false; + ++ expect = kmalloc(sizeof(observed.lines), GFP_KERNEL); ++ if (WARN_ON(!expect)) ++ return false; ++ + /* Generate expected report contents. */ + + /* Title */ +@@ -253,6 +257,7 @@ static bool __report_matches(const struct expect_report *r) + strstr(observed.lines[2], expect[1]))); + out: + spin_unlock_irqrestore(&observed.lock, flags); ++ kfree(expect); + return ret; + } + +-- +2.39.0 + diff --git a/queue-6.1/kvm-s390-interrupt-use-read_once-before-cmpxchg.patch b/queue-6.1/kvm-s390-interrupt-use-read_once-before-cmpxchg.patch new file mode 100644 index 00000000000..658b66c81f1 --- /dev/null +++ b/queue-6.1/kvm-s390-interrupt-use-read_once-before-cmpxchg.patch @@ -0,0 +1,72 @@ +From f43a9ae5c432953bd102a28b06d3f073d2fbd53b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 15:54:56 +0100 +Subject: KVM: s390: interrupt: use READ_ONCE() before cmpxchg() + +From: Heiko Carstens + +[ Upstream commit 42400d99e9f0728c17240edb9645637ead40f6b9 ] + +Use READ_ONCE() before cmpxchg() to prevent that the compiler generates +code that fetches the to be compared old value several times from memory. + +Reviewed-by: Christian Borntraeger +Acked-by: Christian Borntraeger +Reviewed-by: Claudio Imbrenda +Link: https://lore.kernel.org/r/20230109145456.2895385-1-hca@linux.ibm.com +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/interrupt.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c +index ab569faf0df2..6d74acea5e85 100644 +--- a/arch/s390/kvm/interrupt.c ++++ b/arch/s390/kvm/interrupt.c +@@ -83,8 +83,9 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id) + struct esca_block *sca = vcpu->kvm->arch.sca; + union esca_sigp_ctrl *sigp_ctrl = + &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); +- union esca_sigp_ctrl new_val = {0}, old_val = *sigp_ctrl; ++ union esca_sigp_ctrl new_val = {0}, old_val; + ++ old_val = READ_ONCE(*sigp_ctrl); + new_val.scn = src_id; + new_val.c = 1; + old_val.c = 0; +@@ -95,8 +96,9 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id) + struct bsca_block *sca = vcpu->kvm->arch.sca; + union bsca_sigp_ctrl *sigp_ctrl = + &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); +- union bsca_sigp_ctrl new_val = {0}, old_val = *sigp_ctrl; ++ union bsca_sigp_ctrl new_val = {0}, old_val; + ++ old_val = READ_ONCE(*sigp_ctrl); + new_val.scn = src_id; + new_val.c = 1; + old_val.c = 0; +@@ -126,16 +128,18 @@ static void sca_clear_ext_call(struct kvm_vcpu *vcpu) + struct esca_block *sca = vcpu->kvm->arch.sca; + union esca_sigp_ctrl *sigp_ctrl = + &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); +- union esca_sigp_ctrl old = *sigp_ctrl; ++ union esca_sigp_ctrl old; + ++ old = READ_ONCE(*sigp_ctrl); + expect = old.value; + rc = cmpxchg(&sigp_ctrl->value, old.value, 0); + } else { + struct bsca_block *sca = vcpu->kvm->arch.sca; + union bsca_sigp_ctrl *sigp_ctrl = + &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); +- union bsca_sigp_ctrl old = *sigp_ctrl; ++ union bsca_sigp_ctrl old; + ++ old = READ_ONCE(*sigp_ctrl); + expect = old.value; + rc = cmpxchg(&sigp_ctrl->value, old.value, 0); + } +-- +2.39.0 + diff --git a/queue-6.1/l2tp-close-all-race-conditions-in-l2tp_tunnel_regist.patch b/queue-6.1/l2tp-close-all-race-conditions-in-l2tp_tunnel_regist.patch new file mode 100644 index 00000000000..b2d21a24ff0 --- /dev/null +++ b/queue-6.1/l2tp-close-all-race-conditions-in-l2tp_tunnel_regist.patch @@ -0,0 +1,111 @@ +From d64f99fcc82876495c668deb2f01fcaea36e63a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 19:01:37 -0800 +Subject: l2tp: close all race conditions in l2tp_tunnel_register() + +From: Cong Wang + +[ Upstream commit 0b2c59720e65885a394a017d0cf9cab118914682 ] + +The code in l2tp_tunnel_register() is racy in several ways: + +1. It modifies the tunnel socket _after_ publishing it. + +2. It calls setup_udp_tunnel_sock() on an existing socket without + locking. + +3. It changes sock lock class on fly, which triggers many syzbot + reports. + +This patch amends all of them by moving socket initialization code +before publishing and under sock lock. As suggested by Jakub, the +l2tp lockdep class is not necessary as we can just switch to +bh_lock_sock_nested(). + +Fixes: 37159ef2c1ae ("l2tp: fix a lockdep splat") +Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation") +Reported-by: syzbot+52866e24647f9a23403f@syzkaller.appspotmail.com +Reported-by: syzbot+94cc2a66fc228b23f360@syzkaller.appspotmail.com +Reported-by: Tetsuo Handa +Cc: Guillaume Nault +Cc: Jakub Sitnicki +Cc: Eric Dumazet +Cc: Tom Parkin +Signed-off-by: Cong Wang +Reviewed-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_core.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index e9c0ce0b7972..b6554e32bb12 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1041,7 +1041,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, uns + IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED | IPSKB_REROUTED); + nf_reset_ct(skb); + +- bh_lock_sock(sk); ++ bh_lock_sock_nested(sk); + if (sock_owned_by_user(sk)) { + kfree_skb(skb); + ret = NET_XMIT_DROP; +@@ -1385,8 +1385,6 @@ static int l2tp_tunnel_sock_create(struct net *net, + return err; + } + +-static struct lock_class_key l2tp_socket_class; +- + int l2tp_tunnel_create(int fd, int version, u32 tunnel_id, u32 peer_tunnel_id, + struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp) + { +@@ -1482,21 +1480,16 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + } + + sk = sock->sk; ++ lock_sock(sk); + write_lock_bh(&sk->sk_callback_lock); + ret = l2tp_validate_socket(sk, net, tunnel->encap); +- if (ret < 0) ++ if (ret < 0) { ++ release_sock(sk); + goto err_inval_sock; ++ } + rcu_assign_sk_user_data(sk, tunnel); + write_unlock_bh(&sk->sk_callback_lock); + +- sock_hold(sk); +- tunnel->sock = sk; +- tunnel->l2tp_net = net; +- +- spin_lock_bh(&pn->l2tp_tunnel_idr_lock); +- idr_replace(&pn->l2tp_tunnel_idr, tunnel, tunnel->tunnel_id); +- spin_unlock_bh(&pn->l2tp_tunnel_idr_lock); +- + if (tunnel->encap == L2TP_ENCAPTYPE_UDP) { + struct udp_tunnel_sock_cfg udp_cfg = { + .sk_user_data = tunnel, +@@ -1510,9 +1503,16 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + + tunnel->old_sk_destruct = sk->sk_destruct; + sk->sk_destruct = &l2tp_tunnel_destruct; +- lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, +- "l2tp_sock"); + sk->sk_allocation = GFP_ATOMIC; ++ release_sock(sk); ++ ++ sock_hold(sk); ++ tunnel->sock = sk; ++ tunnel->l2tp_net = net; ++ ++ spin_lock_bh(&pn->l2tp_tunnel_idr_lock); ++ idr_replace(&pn->l2tp_tunnel_idr, tunnel, tunnel->tunnel_id); ++ spin_unlock_bh(&pn->l2tp_tunnel_idr_lock); + + trace_register_tunnel(tunnel); + +-- +2.39.0 + diff --git a/queue-6.1/l2tp-convert-l2tp_tunnel_list-to-idr.patch b/queue-6.1/l2tp-convert-l2tp_tunnel_list-to-idr.patch new file mode 100644 index 00000000000..f3498d9b2cc --- /dev/null +++ b/queue-6.1/l2tp-convert-l2tp_tunnel_list-to-idr.patch @@ -0,0 +1,229 @@ +From 1594b6e30cff2127fc5d8e48c21280450cbca47c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 19:01:36 -0800 +Subject: l2tp: convert l2tp_tunnel_list to idr + +From: Cong Wang + +[ Upstream commit c4d48a58f32c5972174a1d01c33b296fe378cce0 ] + +l2tp uses l2tp_tunnel_list to track all registered tunnels and +to allocate tunnel ID's. IDR can do the same job. + +More importantly, with IDR we can hold the ID before a successful +registration so that we don't need to worry about late error +handling, it is not easy to rollback socket changes. + +This is a preparation for the following fix. + +Cc: Tetsuo Handa +Cc: Guillaume Nault +Cc: Jakub Sitnicki +Cc: Eric Dumazet +Cc: Tom Parkin +Signed-off-by: Cong Wang +Reviewed-by: Guillaume Nault +Signed-off-by: David S. Miller +Stable-dep-of: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_core.c | 85 ++++++++++++++++++++++---------------------- + 1 file changed, 42 insertions(+), 43 deletions(-) + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 9a1415fe3fa7..e9c0ce0b7972 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -104,9 +104,9 @@ static struct workqueue_struct *l2tp_wq; + /* per-net private data for this module */ + static unsigned int l2tp_net_id; + struct l2tp_net { +- struct list_head l2tp_tunnel_list; +- /* Lock for write access to l2tp_tunnel_list */ +- spinlock_t l2tp_tunnel_list_lock; ++ /* Lock for write access to l2tp_tunnel_idr */ ++ spinlock_t l2tp_tunnel_idr_lock; ++ struct idr l2tp_tunnel_idr; + struct hlist_head l2tp_session_hlist[L2TP_HASH_SIZE_2]; + /* Lock for write access to l2tp_session_hlist */ + spinlock_t l2tp_session_hlist_lock; +@@ -208,13 +208,10 @@ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id) + struct l2tp_tunnel *tunnel; + + rcu_read_lock_bh(); +- list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { +- if (tunnel->tunnel_id == tunnel_id && +- refcount_inc_not_zero(&tunnel->ref_count)) { +- rcu_read_unlock_bh(); +- +- return tunnel; +- } ++ tunnel = idr_find(&pn->l2tp_tunnel_idr, tunnel_id); ++ if (tunnel && refcount_inc_not_zero(&tunnel->ref_count)) { ++ rcu_read_unlock_bh(); ++ return tunnel; + } + rcu_read_unlock_bh(); + +@@ -224,13 +221,14 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_get); + + struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth) + { +- const struct l2tp_net *pn = l2tp_pernet(net); ++ struct l2tp_net *pn = l2tp_pernet(net); ++ unsigned long tunnel_id, tmp; + struct l2tp_tunnel *tunnel; + int count = 0; + + rcu_read_lock_bh(); +- list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { +- if (++count > nth && ++ idr_for_each_entry_ul(&pn->l2tp_tunnel_idr, tunnel, tmp, tunnel_id) { ++ if (tunnel && ++count > nth && + refcount_inc_not_zero(&tunnel->ref_count)) { + rcu_read_unlock_bh(); + return tunnel; +@@ -1227,6 +1225,15 @@ static void l2tp_udp_encap_destroy(struct sock *sk) + l2tp_tunnel_delete(tunnel); + } + ++static void l2tp_tunnel_remove(struct net *net, struct l2tp_tunnel *tunnel) ++{ ++ struct l2tp_net *pn = l2tp_pernet(net); ++ ++ spin_lock_bh(&pn->l2tp_tunnel_idr_lock); ++ idr_remove(&pn->l2tp_tunnel_idr, tunnel->tunnel_id); ++ spin_unlock_bh(&pn->l2tp_tunnel_idr_lock); ++} ++ + /* Workqueue tunnel deletion function */ + static void l2tp_tunnel_del_work(struct work_struct *work) + { +@@ -1234,7 +1241,6 @@ static void l2tp_tunnel_del_work(struct work_struct *work) + del_work); + struct sock *sk = tunnel->sock; + struct socket *sock = sk->sk_socket; +- struct l2tp_net *pn; + + l2tp_tunnel_closeall(tunnel); + +@@ -1248,12 +1254,7 @@ static void l2tp_tunnel_del_work(struct work_struct *work) + } + } + +- /* Remove the tunnel struct from the tunnel list */ +- pn = l2tp_pernet(tunnel->l2tp_net); +- spin_lock_bh(&pn->l2tp_tunnel_list_lock); +- list_del_rcu(&tunnel->list); +- spin_unlock_bh(&pn->l2tp_tunnel_list_lock); +- ++ l2tp_tunnel_remove(tunnel->l2tp_net, tunnel); + /* drop initial ref */ + l2tp_tunnel_dec_refcount(tunnel); + +@@ -1455,12 +1456,19 @@ static int l2tp_validate_socket(const struct sock *sk, const struct net *net, + int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + struct l2tp_tunnel_cfg *cfg) + { +- struct l2tp_tunnel *tunnel_walk; +- struct l2tp_net *pn; ++ struct l2tp_net *pn = l2tp_pernet(net); ++ u32 tunnel_id = tunnel->tunnel_id; + struct socket *sock; + struct sock *sk; + int ret; + ++ spin_lock_bh(&pn->l2tp_tunnel_idr_lock); ++ ret = idr_alloc_u32(&pn->l2tp_tunnel_idr, NULL, &tunnel_id, tunnel_id, ++ GFP_ATOMIC); ++ spin_unlock_bh(&pn->l2tp_tunnel_idr_lock); ++ if (ret) ++ return ret == -ENOSPC ? -EEXIST : ret; ++ + if (tunnel->fd < 0) { + ret = l2tp_tunnel_sock_create(net, tunnel->tunnel_id, + tunnel->peer_tunnel_id, cfg, +@@ -1481,23 +1489,13 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + rcu_assign_sk_user_data(sk, tunnel); + write_unlock_bh(&sk->sk_callback_lock); + +- tunnel->l2tp_net = net; +- pn = l2tp_pernet(net); +- + sock_hold(sk); + tunnel->sock = sk; ++ tunnel->l2tp_net = net; + +- spin_lock_bh(&pn->l2tp_tunnel_list_lock); +- list_for_each_entry(tunnel_walk, &pn->l2tp_tunnel_list, list) { +- if (tunnel_walk->tunnel_id == tunnel->tunnel_id) { +- spin_unlock_bh(&pn->l2tp_tunnel_list_lock); +- sock_put(sk); +- ret = -EEXIST; +- goto err_sock; +- } +- } +- list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); +- spin_unlock_bh(&pn->l2tp_tunnel_list_lock); ++ spin_lock_bh(&pn->l2tp_tunnel_idr_lock); ++ idr_replace(&pn->l2tp_tunnel_idr, tunnel, tunnel->tunnel_id); ++ spin_unlock_bh(&pn->l2tp_tunnel_idr_lock); + + if (tunnel->encap == L2TP_ENCAPTYPE_UDP) { + struct udp_tunnel_sock_cfg udp_cfg = { +@@ -1523,9 +1521,6 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + + return 0; + +-err_sock: +- write_lock_bh(&sk->sk_callback_lock); +- rcu_assign_sk_user_data(sk, NULL); + err_inval_sock: + write_unlock_bh(&sk->sk_callback_lock); + +@@ -1534,6 +1529,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + else + sockfd_put(sock); + err: ++ l2tp_tunnel_remove(net, tunnel); + return ret; + } + EXPORT_SYMBOL_GPL(l2tp_tunnel_register); +@@ -1647,8 +1643,8 @@ static __net_init int l2tp_init_net(struct net *net) + struct l2tp_net *pn = net_generic(net, l2tp_net_id); + int hash; + +- INIT_LIST_HEAD(&pn->l2tp_tunnel_list); +- spin_lock_init(&pn->l2tp_tunnel_list_lock); ++ idr_init(&pn->l2tp_tunnel_idr); ++ spin_lock_init(&pn->l2tp_tunnel_idr_lock); + + for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) + INIT_HLIST_HEAD(&pn->l2tp_session_hlist[hash]); +@@ -1662,11 +1658,13 @@ static __net_exit void l2tp_exit_net(struct net *net) + { + struct l2tp_net *pn = l2tp_pernet(net); + struct l2tp_tunnel *tunnel = NULL; ++ unsigned long tunnel_id, tmp; + int hash; + + rcu_read_lock_bh(); +- list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { +- l2tp_tunnel_delete(tunnel); ++ idr_for_each_entry_ul(&pn->l2tp_tunnel_idr, tunnel, tmp, tunnel_id) { ++ if (tunnel) ++ l2tp_tunnel_delete(tunnel); + } + rcu_read_unlock_bh(); + +@@ -1676,6 +1674,7 @@ static __net_exit void l2tp_exit_net(struct net *net) + + for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++) + WARN_ON_ONCE(!hlist_empty(&pn->l2tp_session_hlist[hash])); ++ idr_destroy(&pn->l2tp_tunnel_idr); + } + + static struct pernet_operations l2tp_net_ops = { +-- +2.39.0 + diff --git a/queue-6.1/l2tp-prevent-lockdep-issue-in-l2tp_tunnel_register.patch b/queue-6.1/l2tp-prevent-lockdep-issue-in-l2tp_tunnel_register.patch new file mode 100644 index 00000000000..22b73ab8198 --- /dev/null +++ b/queue-6.1/l2tp-prevent-lockdep-issue-in-l2tp_tunnel_register.patch @@ -0,0 +1,58 @@ +From cb016687cc57f9c8bd78c04293dd8029accf8706 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 11:01:31 +0000 +Subject: l2tp: prevent lockdep issue in l2tp_tunnel_register() + +From: Eric Dumazet + +[ Upstream commit b9fb10d131b8c84af9bb14e2078d5c63600c7dea ] + +lockdep complains with the following lock/unlock sequence: + + lock_sock(sk); + write_lock_bh(&sk->sk_callback_lock); +[1] release_sock(sk); +[2] write_unlock_bh(&sk->sk_callback_lock); + +We need to swap [1] and [2] to fix this issue. + +Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") +Reported-by: syzbot+bbd35b345c7cab0d9a08@syzkaller.appspotmail.com +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/netdev/20230114030137.672706-1-xiyou.wangcong@gmail.com/T/#m1164ff20628671b0f326a24cb106ab3239c70ce3 +Cc: Cong Wang +Cc: Guillaume Nault +Reviewed-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index b6554e32bb12..03608d3ded4b 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1483,10 +1483,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + lock_sock(sk); + write_lock_bh(&sk->sk_callback_lock); + ret = l2tp_validate_socket(sk, net, tunnel->encap); +- if (ret < 0) { +- release_sock(sk); ++ if (ret < 0) + goto err_inval_sock; +- } + rcu_assign_sk_user_data(sk, tunnel); + write_unlock_bh(&sk->sk_callback_lock); + +@@ -1523,6 +1521,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + + err_inval_sock: + write_unlock_bh(&sk->sk_callback_lock); ++ release_sock(sk); + + if (tunnel->fd < 0) + sock_release(sock); +-- +2.39.0 + diff --git a/queue-6.1/lockref-stop-doing-cpu_relax-in-the-cmpxchg-loop.patch b/queue-6.1/lockref-stop-doing-cpu_relax-in-the-cmpxchg-loop.patch new file mode 100644 index 00000000000..c539cab3d53 --- /dev/null +++ b/queue-6.1/lockref-stop-doing-cpu_relax-in-the-cmpxchg-loop.patch @@ -0,0 +1,107 @@ +From ea217b6a5f482a9741a5da933ce51ab3ea56400e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 19:44:47 +0100 +Subject: lockref: stop doing cpu_relax in the cmpxchg loop + +From: Mateusz Guzik + +[ Upstream commit f5fe24ef17b5fbe6db49534163e77499fb10ae8c ] + +On the x86-64 architecture even a failing cmpxchg grants exclusive +access to the cacheline, making it preferable to retry the failed op +immediately instead of stalling with the pause instruction. + +To illustrate the impact, below are benchmark results obtained by +running various will-it-scale tests on top of the 6.2-rc3 kernel and +Cascade Lake (2 sockets * 24 cores * 2 threads) CPU. + +All results in ops/s. Note there is some variance in re-runs, but the +code is consistently faster when contention is present. + + open3 ("Same file open/close"): + proc stock no-pause + 1 805603 814942 (+%1) + 2 1054980 1054781 (-0%) + 8 1544802 1822858 (+18%) + 24 1191064 2199665 (+84%) + 48 851582 1469860 (+72%) + 96 609481 1427170 (+134%) + + fstat2 ("Same file fstat"): + proc stock no-pause + 1 3013872 3047636 (+1%) + 2 4284687 4400421 (+2%) + 8 3257721 5530156 (+69%) + 24 2239819 5466127 (+144%) + 48 1701072 5256609 (+209%) + 96 1269157 6649326 (+423%) + +Additionally, a kernel with a private patch to help access() scalability: +access2 ("Same file access"): + + proc stock patched patched + +nopause + 24 2378041 2005501 5370335 (-15% / +125%) + +That is, fixing the problems in access itself *reduces* scalability +after the cacheline ping-pong only happens in lockref with the pause +instruction. + +Note that fstat and access benchmarks are not currently integrated into +will-it-scale, but interested parties can find them in pull requests to +said project. + +Code at hand has a rather tortured history. First modification showed +up in commit d472d9d98b46 ("lockref: Relax in cmpxchg loop"), written +with Itanium in mind. Later it got patched up to use an arch-dependent +macro to stop doing it on s390 where it caused a significant regression. +Said macro had undergone revisions and was ultimately eliminated later, +going back to cpu_relax. + +While I intended to only remove cpu_relax for x86-64, I got the +following comment from Linus: + + I would actually prefer just removing it entirely and see if + somebody else hollers. You have the numbers to prove it hurts on + real hardware, and I don't think we have any numbers to the + contrary. + + So I think it's better to trust the numbers and remove it as a + failure, than say "let's just remove it on x86-64 and leave + everybody else with the potentially broken code" + +Additionally, Will Deacon (maintainer of the arm64 port, one of the +architectures previously benchmarked): + + So, from the arm64 side of the fence, I'm perfectly happy just + removing the cpu_relax() calls from lockref. + +As such, come back full circle in history and whack it altogether. + +Signed-off-by: Mateusz Guzik +Link: https://lore.kernel.org/all/CAGudoHHx0Nqg6DE70zAVA75eV-HXfWyhVMWZ-aSeOofkA_=WdA@mail.gmail.com/ +Acked-by: Tony Luck # ia64 +Acked-by: Nicholas Piggin # powerpc +Acked-by: Will Deacon # arm64 +Acked-by: Peter Zijlstra +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/lockref.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/lib/lockref.c b/lib/lockref.c +index 45e93ece8ba0..2afe4c5d8919 100644 +--- a/lib/lockref.c ++++ b/lib/lockref.c +@@ -23,7 +23,6 @@ + } \ + if (!--retry) \ + break; \ +- cpu_relax(); \ + } \ + } while (0) + +-- +2.39.0 + diff --git a/queue-6.1/memory-atmel-sdramc-fix-missing-clk_disable_unprepar.patch b/queue-6.1/memory-atmel-sdramc-fix-missing-clk_disable_unprepar.patch new file mode 100644 index 00000000000..7b094e9ed84 --- /dev/null +++ b/queue-6.1/memory-atmel-sdramc-fix-missing-clk_disable_unprepar.patch @@ -0,0 +1,52 @@ +From ec7e7d1c74634a3c965c8f3bc87520751847e538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 15:37:57 +0800 +Subject: memory: atmel-sdramc: Fix missing clk_disable_unprepare in + atmel_ramc_probe() + +From: Gaosheng Cui + +[ Upstream commit 340cb392a038cf70540a4cdf2e98a247c66b6df4 ] + +The clk_disable_unprepare() should be called in the error handling +of caps->has_mpddr_clk, fix it by replacing devm_clk_get and +clk_prepare_enable by devm_clk_get_enabled. + +Fixes: e81b6abebc87 ("memory: add a driver for atmel ram controllers") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221125073757.3535219-1-cuigaosheng1@huawei.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/atmel-sdramc.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/memory/atmel-sdramc.c b/drivers/memory/atmel-sdramc.c +index 9c49d00c2a96..ea6e9e1eaf04 100644 +--- a/drivers/memory/atmel-sdramc.c ++++ b/drivers/memory/atmel-sdramc.c +@@ -47,19 +47,17 @@ static int atmel_ramc_probe(struct platform_device *pdev) + caps = of_device_get_match_data(&pdev->dev); + + if (caps->has_ddrck) { +- clk = devm_clk_get(&pdev->dev, "ddrck"); ++ clk = devm_clk_get_enabled(&pdev->dev, "ddrck"); + if (IS_ERR(clk)) + return PTR_ERR(clk); +- clk_prepare_enable(clk); + } + + if (caps->has_mpddr_clk) { +- clk = devm_clk_get(&pdev->dev, "mpddr"); ++ clk = devm_clk_get_enabled(&pdev->dev, "mpddr"); + if (IS_ERR(clk)) { + pr_err("AT91 RAMC: couldn't get mpddr clock\n"); + return PTR_ERR(clk); + } +- clk_prepare_enable(clk); + } + + return 0; +-- +2.39.0 + diff --git a/queue-6.1/memory-mvebu-devbus-fix-missing-clk_disable_unprepar.patch b/queue-6.1/memory-mvebu-devbus-fix-missing-clk_disable_unprepar.patch new file mode 100644 index 00000000000..8ea638696c7 --- /dev/null +++ b/queue-6.1/memory-mvebu-devbus-fix-missing-clk_disable_unprepar.patch @@ -0,0 +1,42 @@ +From d89cf32a742537fb9c38b1d7d7c7c93366eb95e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Nov 2022 12:49:11 +0800 +Subject: memory: mvebu-devbus: Fix missing clk_disable_unprepare in + mvebu_devbus_probe() + +From: Gaosheng Cui + +[ Upstream commit cb8fd6f75775165390ededea8799b60d93d9fe3e ] + +The clk_disable_unprepare() should be called in the error handling +of devbus_get_timing_params() and of_platform_populate(), fix it by +replacing devm_clk_get and clk_prepare_enable by devm_clk_get_enabled. + +Fixes: e81b6abebc87 ("memory: add a driver for atmel ram controllers") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221126044911.7226-1-cuigaosheng1@huawei.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/mvebu-devbus.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/memory/mvebu-devbus.c b/drivers/memory/mvebu-devbus.c +index 8450638e8670..efc6c08db2b7 100644 +--- a/drivers/memory/mvebu-devbus.c ++++ b/drivers/memory/mvebu-devbus.c +@@ -280,10 +280,9 @@ static int mvebu_devbus_probe(struct platform_device *pdev) + if (IS_ERR(devbus->base)) + return PTR_ERR(devbus->base); + +- clk = devm_clk_get(&pdev->dev, NULL); ++ clk = devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(clk)) + return PTR_ERR(clk); +- clk_prepare_enable(clk); + + /* + * Obtain clock period in picoseconds, +-- +2.39.0 + diff --git a/queue-6.1/memory-tegra-remove-clients-sid-override-programming.patch b/queue-6.1/memory-tegra-remove-clients-sid-override-programming.patch new file mode 100644 index 00000000000..d456a9fb009 --- /dev/null +++ b/queue-6.1/memory-tegra-remove-clients-sid-override-programming.patch @@ -0,0 +1,103 @@ +From 48618433a3336c845897d5ec8f9f0704bf80938a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 09:37:52 +0530 +Subject: memory: tegra: Remove clients SID override programming + +From: Ashish Mhetre + +[ Upstream commit ef86b2c2807f41c045e5534d8513a8b83f63bc39 ] + +On newer Tegra releases, early boot SID override programming and SID +override programming during resume is handled by bootloader. +In the function tegra186_mc_program_sid() which is getting removed, SID +override register of all clients is written without checking if secure +firmware has allowed write on it or not. If write is disabled by secure +firmware then it can lead to errors coming from secure firmware and hang +in kernel boot. +Also, SID override is programmed on-demand during probe_finalize() call +of IOMMU which is done in tegra186_mc_client_sid_override() in this same +file. This function does it correctly by checking if write is permitted +on SID override register. It also checks if SID override register is +already written with correct value and skips re-writing it in that case. + +Fixes: 393d66fd2cac ("memory: tegra: Implement SID override programming") +Signed-off-by: Ashish Mhetre +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20221125040752.12627-1-amhetre@nvidia.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/tegra/tegra186.c | 36 --------------------------------- + 1 file changed, 36 deletions(-) + +diff --git a/drivers/memory/tegra/tegra186.c b/drivers/memory/tegra/tegra186.c +index 62477e592bf5..7bb73f06fad3 100644 +--- a/drivers/memory/tegra/tegra186.c ++++ b/drivers/memory/tegra/tegra186.c +@@ -22,32 +22,6 @@ + #define MC_SID_STREAMID_SECURITY_WRITE_ACCESS_DISABLED BIT(16) + #define MC_SID_STREAMID_SECURITY_OVERRIDE BIT(8) + +-static void tegra186_mc_program_sid(struct tegra_mc *mc) +-{ +- unsigned int i; +- +- for (i = 0; i < mc->soc->num_clients; i++) { +- const struct tegra_mc_client *client = &mc->soc->clients[i]; +- u32 override, security; +- +- override = readl(mc->regs + client->regs.sid.override); +- security = readl(mc->regs + client->regs.sid.security); +- +- dev_dbg(mc->dev, "client %s: override: %x security: %x\n", +- client->name, override, security); +- +- dev_dbg(mc->dev, "setting SID %u for %s\n", client->sid, +- client->name); +- writel(client->sid, mc->regs + client->regs.sid.override); +- +- override = readl(mc->regs + client->regs.sid.override); +- security = readl(mc->regs + client->regs.sid.security); +- +- dev_dbg(mc->dev, "client %s: override: %x security: %x\n", +- client->name, override, security); +- } +-} +- + static int tegra186_mc_probe(struct tegra_mc *mc) + { + struct platform_device *pdev = to_platform_device(mc->dev); +@@ -85,8 +59,6 @@ static int tegra186_mc_probe(struct tegra_mc *mc) + if (err < 0) + return err; + +- tegra186_mc_program_sid(mc); +- + return 0; + } + +@@ -95,13 +67,6 @@ static void tegra186_mc_remove(struct tegra_mc *mc) + of_platform_depopulate(mc->dev); + } + +-static int tegra186_mc_resume(struct tegra_mc *mc) +-{ +- tegra186_mc_program_sid(mc); +- +- return 0; +-} +- + #if IS_ENABLED(CONFIG_IOMMU_API) + static void tegra186_mc_client_sid_override(struct tegra_mc *mc, + const struct tegra_mc_client *client, +@@ -173,7 +138,6 @@ static int tegra186_mc_probe_device(struct tegra_mc *mc, struct device *dev) + const struct tegra_mc_ops tegra186_mc_ops = { + .probe = tegra186_mc_probe, + .remove = tegra186_mc_remove, +- .resume = tegra186_mc_resume, + .probe_device = tegra186_mc_probe_device, + .handle_irq = tegra30_mc_handle_irq, + }; +-- +2.39.0 + diff --git a/queue-6.1/net-dsa-microchip-ksz9477-port-map-correction-in-alu.patch b/queue-6.1/net-dsa-microchip-ksz9477-port-map-correction-in-alu.patch new file mode 100644 index 00000000000..75e05926b86 --- /dev/null +++ b/queue-6.1/net-dsa-microchip-ksz9477-port-map-correction-in-alu.patch @@ -0,0 +1,56 @@ +From 46754e6284d35839816f111ab96e573f55c3e472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 23:17:35 +0530 +Subject: net: dsa: microchip: ksz9477: port map correction in ALU table entry + register + +From: Rakesh Sankaranarayanan + +[ Upstream commit 6c977c5c2e4c5d8ad1b604724cc344e38f96fe9b ] + +ALU table entry 2 register in KSZ9477 have bit positions reserved for +forwarding port map. This field is referred in ksz9477_fdb_del() for +clearing forward port map and alu table. + +But current fdb_del refer ALU table entry 3 register for accessing forward +port map. Update ksz9477_fdb_del() to get forward port map from correct +alu table entry register. + +With this bug, issue can be observed while deleting static MAC entries. +Delete any specific MAC entry using "bridge fdb del" command. This should +clear all the specified MAC entries. But it is observed that entries with +self static alone are retained. + +Tested on LAN9370 EVB since ksz9477_fdb_del() is used common across +LAN937x and KSZ series. + +Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477") +Signed-off-by: Rakesh Sankaranarayanan +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230118174735.702377-1-rakesh.sankaranarayanan@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz9477.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index a6a0321a8931..a73697147053 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -548,10 +548,10 @@ int ksz9477_fdb_del(struct ksz_device *dev, int port, + ksz_read32(dev, REG_SW_ALU_VAL_D, &alu_table[3]); + + /* clear forwarding port */ +- alu_table[2] &= ~BIT(port); ++ alu_table[1] &= ~BIT(port); + + /* if there is no port to forward, clear table */ +- if ((alu_table[2] & ALU_V_PORT_MAP) == 0) { ++ if ((alu_table[1] & ALU_V_PORT_MAP) == 0) { + alu_table[0] = 0; + alu_table[1] = 0; + alu_table[2] = 0; +-- +2.39.0 + diff --git a/queue-6.1/net-enetc-avoid-deadlock-in-enetc_tx_onestep_tstamp.patch b/queue-6.1/net-enetc-avoid-deadlock-in-enetc_tx_onestep_tstamp.patch new file mode 100644 index 00000000000..fe1367e8793 --- /dev/null +++ b/queue-6.1/net-enetc-avoid-deadlock-in-enetc_tx_onestep_tstamp.patch @@ -0,0 +1,118 @@ +From ceff3aa1409f30233f976b1fd4b9c788b0b68b76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 12:54:40 +0200 +Subject: net: enetc: avoid deadlock in enetc_tx_onestep_tstamp() + +From: Vladimir Oltean + +[ Upstream commit 3c463721a73bdb57a913e0d3124677a3758886fc ] + +This lockdep splat says it better than I could: + +================================ +WARNING: inconsistent lock state +6.2.0-rc2-07010-ga9b9500ffaac-dirty #967 Not tainted +-------------------------------- +inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. +kworker/1:3/179 [HC0[0]:SC0[0]:HE1:SE1] takes: +ffff3ec4036ce098 (_xmit_ETHER#2){+.?.}-{3:3}, at: netif_freeze_queues+0x5c/0xc0 +{IN-SOFTIRQ-W} state was registered at: + _raw_spin_lock+0x5c/0xc0 + sch_direct_xmit+0x148/0x37c + __dev_queue_xmit+0x528/0x111c + ip6_finish_output2+0x5ec/0xb7c + ip6_finish_output+0x240/0x3f0 + ip6_output+0x78/0x360 + ndisc_send_skb+0x33c/0x85c + ndisc_send_rs+0x54/0x12c + addrconf_rs_timer+0x154/0x260 + call_timer_fn+0xb8/0x3a0 + __run_timers.part.0+0x214/0x26c + run_timer_softirq+0x3c/0x74 + __do_softirq+0x14c/0x5d8 + ____do_softirq+0x10/0x20 + call_on_irq_stack+0x2c/0x5c + do_softirq_own_stack+0x1c/0x30 + __irq_exit_rcu+0x168/0x1a0 + irq_exit_rcu+0x10/0x40 + el1_interrupt+0x38/0x64 +irq event stamp: 7825 +hardirqs last enabled at (7825): [] exit_to_kernel_mode+0x34/0x130 +hardirqs last disabled at (7823): [] __do_softirq+0x550/0x5d8 +softirqs last enabled at (7824): [] __do_softirq+0x46c/0x5d8 +softirqs last disabled at (7811): [] ____do_softirq+0x10/0x20 + +other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(_xmit_ETHER#2); + + lock(_xmit_ETHER#2); + + *** DEADLOCK *** + +3 locks held by kworker/1:3/179: + #0: ffff3ec400004748 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1f4/0x6c0 + #1: ffff80000a0bbdc8 ((work_completion)(&priv->tx_onestep_tstamp)){+.+.}-{0:0}, at: process_one_work+0x1f4/0x6c0 + #2: ffff3ec4036cd438 (&dev->tx_global_lock){+.+.}-{3:3}, at: netif_tx_lock+0x1c/0x34 + +Workqueue: events enetc_tx_onestep_tstamp +Call trace: + print_usage_bug.part.0+0x208/0x22c + mark_lock+0x7f0/0x8b0 + __lock_acquire+0x7c4/0x1ce0 + lock_acquire.part.0+0xe0/0x220 + lock_acquire+0x68/0x84 + _raw_spin_lock+0x5c/0xc0 + netif_freeze_queues+0x5c/0xc0 + netif_tx_lock+0x24/0x34 + enetc_tx_onestep_tstamp+0x20/0x100 + process_one_work+0x28c/0x6c0 + worker_thread+0x74/0x450 + kthread+0x118/0x11c + +but I'll say it anyway: the enetc_tx_onestep_tstamp() work item runs in +process context, therefore with softirqs enabled (i.o.w., it can be +interrupted by a softirq). If we hold the netif_tx_lock() when there is +an interrupt, and the NET_TX softirq then gets scheduled, this will take +the netif_tx_lock() a second time and deadlock the kernel. + +To solve this, use netif_tx_lock_bh(), which blocks softirqs from +running. + +Fixes: 7294380c5211 ("enetc: support PTP Sync packet one-step timestamping") +Signed-off-by: Vladimir Oltean +Reviewed-by: Alexander Duyck +Link: https://lore.kernel.org/r/20230112105440.1786799-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c +index 3a79ead5219a..e96449eedfb5 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc.c +@@ -2290,14 +2290,14 @@ static void enetc_tx_onestep_tstamp(struct work_struct *work) + + priv = container_of(work, struct enetc_ndev_priv, tx_onestep_tstamp); + +- netif_tx_lock(priv->ndev); ++ netif_tx_lock_bh(priv->ndev); + + clear_bit_unlock(ENETC_TX_ONESTEP_TSTAMP_IN_PROGRESS, &priv->flags); + skb = skb_dequeue(&priv->tx_skbs); + if (skb) + enetc_start_xmit(skb, priv->ndev); + +- netif_tx_unlock(priv->ndev); ++ netif_tx_unlock_bh(priv->ndev); + } + + static void enetc_tx_onestep_tstamp_init(struct enetc_ndev_priv *priv) +-- +2.39.0 + diff --git a/queue-6.1/net-ipa-disable-ipa-interrupt-during-suspend.patch b/queue-6.1/net-ipa-disable-ipa-interrupt-during-suspend.patch new file mode 100644 index 00000000000..c9042c23970 --- /dev/null +++ b/queue-6.1/net-ipa-disable-ipa-interrupt-during-suspend.patch @@ -0,0 +1,119 @@ +From 3651a81871dc56fdce760e88c424e88ff6d0e232 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Jan 2023 17:59:24 +0000 +Subject: net: ipa: disable ipa interrupt during suspend + +From: Caleb Connolly + +[ Upstream commit 9ec9b2a30853ba843b70ea16f196e5fe3327be5f ] + +The IPA interrupt can fire when pm_runtime is disabled due to it racing +with the PM suspend/resume code. This causes a splat in the interrupt +handler when it tries to call pm_runtime_get(). + +Explicitly disable the interrupt in our ->suspend callback, and +re-enable it in ->resume to avoid this. If there is an interrupt pending +it will be handled after resuming. The interrupt is a wake_irq, as a +result even when disabled if it fires it will cause the system to wake +from suspend as well as cancel any suspend transition that may be in +progress. If there is an interrupt pending, the ipa_isr_thread handler +will be called after resuming. + +Fixes: 1aac309d3207 ("net: ipa: use autosuspend") +Signed-off-by: Caleb Connolly +Reviewed-by: Alex Elder +Link: https://lore.kernel.org/r/20230115175925.465918-1-caleb.connolly@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/ipa_interrupt.c | 10 ++++++++++ + drivers/net/ipa/ipa_interrupt.h | 16 ++++++++++++++++ + drivers/net/ipa/ipa_power.c | 17 +++++++++++++++++ + 3 files changed, 43 insertions(+) + +diff --git a/drivers/net/ipa/ipa_interrupt.c b/drivers/net/ipa/ipa_interrupt.c +index c269432f9c2e..a89a3e3ff81c 100644 +--- a/drivers/net/ipa/ipa_interrupt.c ++++ b/drivers/net/ipa/ipa_interrupt.c +@@ -127,6 +127,16 @@ static irqreturn_t ipa_isr_thread(int irq, void *dev_id) + return IRQ_HANDLED; + } + ++void ipa_interrupt_irq_disable(struct ipa *ipa) ++{ ++ disable_irq(ipa->interrupt->irq); ++} ++ ++void ipa_interrupt_irq_enable(struct ipa *ipa) ++{ ++ enable_irq(ipa->interrupt->irq); ++} ++ + /* Common function used to enable/disable TX_SUSPEND for an endpoint */ + static void ipa_interrupt_suspend_control(struct ipa_interrupt *interrupt, + u32 endpoint_id, bool enable) +diff --git a/drivers/net/ipa/ipa_interrupt.h b/drivers/net/ipa/ipa_interrupt.h +index f31fd9965fdc..8a1bd5b89393 100644 +--- a/drivers/net/ipa/ipa_interrupt.h ++++ b/drivers/net/ipa/ipa_interrupt.h +@@ -85,6 +85,22 @@ void ipa_interrupt_suspend_clear_all(struct ipa_interrupt *interrupt); + */ + void ipa_interrupt_simulate_suspend(struct ipa_interrupt *interrupt); + ++/** ++ * ipa_interrupt_irq_enable() - Enable IPA interrupts ++ * @ipa: IPA pointer ++ * ++ * This enables the IPA interrupt line ++ */ ++void ipa_interrupt_irq_enable(struct ipa *ipa); ++ ++/** ++ * ipa_interrupt_irq_disable() - Disable IPA interrupts ++ * @ipa: IPA pointer ++ * ++ * This disables the IPA interrupt line ++ */ ++void ipa_interrupt_irq_disable(struct ipa *ipa); ++ + /** + * ipa_interrupt_config() - Configure the IPA interrupt framework + * @ipa: IPA pointer +diff --git a/drivers/net/ipa/ipa_power.c b/drivers/net/ipa/ipa_power.c +index 8420f93128a2..8057be8cda80 100644 +--- a/drivers/net/ipa/ipa_power.c ++++ b/drivers/net/ipa/ipa_power.c +@@ -181,6 +181,17 @@ static int ipa_suspend(struct device *dev) + + __set_bit(IPA_POWER_FLAG_SYSTEM, ipa->power->flags); + ++ /* Increment the disable depth to ensure that the IRQ won't ++ * be re-enabled until the matching _enable call in ++ * ipa_resume(). We do this to ensure that the interrupt ++ * handler won't run whilst PM runtime is disabled. ++ * ++ * Note that disabling the IRQ is NOT the same as disabling ++ * irq wake. If wakeup is enabled for the IPA then the IRQ ++ * will still cause the system to wake up, see irq_set_irq_wake(). ++ */ ++ ipa_interrupt_irq_disable(ipa); ++ + return pm_runtime_force_suspend(dev); + } + +@@ -193,6 +204,12 @@ static int ipa_resume(struct device *dev) + + __clear_bit(IPA_POWER_FLAG_SYSTEM, ipa->power->flags); + ++ /* Now that PM runtime is enabled again it's safe ++ * to turn the IRQ back on and process any data ++ * that was received during suspend. ++ */ ++ ipa_interrupt_irq_enable(ipa); ++ + return ret; + } + +-- +2.39.0 + diff --git a/queue-6.1/net-lan966x-add-missing-fwnode_handle_put-for-ports-.patch b/queue-6.1/net-lan966x-add-missing-fwnode_handle_put-for-ports-.patch new file mode 100644 index 00000000000..ad740d929a8 --- /dev/null +++ b/queue-6.1/net-lan966x-add-missing-fwnode_handle_put-for-ports-.patch @@ -0,0 +1,75 @@ +From d69b01d2b682efef113d9fc4096921da3fb973cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 17:13:11 +0100 +Subject: net: lan966x: add missing fwnode_handle_put() for ports node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 925f3deb45df73173a33e1e81db77575f4ffde39 ] + +Since the "ethernet-ports" node is retrieved using +device_get_named_child_node(), it should be release after using it. Add +missing fwnode_handle_put() and move the code that retrieved the node +from device-tree to avoid complicated handling in case of error. + +Fixes: db8bcaad5393 ("net: lan966x: add the basic lan966x driver") +Signed-off-by: Clément Léger +Reviewed-by: Alexander Duyck +Link: https://lore.kernel.org/r/20230112161311.495124-1-clement.leger@bootlin.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/microchip/lan966x/lan966x_main.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c +index 20ee5b28f70a..569108c49cbc 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c +@@ -1022,11 +1022,6 @@ static int lan966x_probe(struct platform_device *pdev) + lan966x->base_mac[5] &= 0xf0; + } + +- ports = device_get_named_child_node(&pdev->dev, "ethernet-ports"); +- if (!ports) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "no ethernet-ports child found\n"); +- + err = lan966x_create_targets(pdev, lan966x); + if (err) + return dev_err_probe(&pdev->dev, err, +@@ -1104,6 +1099,11 @@ static int lan966x_probe(struct platform_device *pdev) + } + } + ++ ports = device_get_named_child_node(&pdev->dev, "ethernet-ports"); ++ if (!ports) ++ return dev_err_probe(&pdev->dev, -ENODEV, ++ "no ethernet-ports child found\n"); ++ + /* init switch */ + lan966x_init(lan966x); + lan966x_stats_init(lan966x); +@@ -1138,6 +1138,8 @@ static int lan966x_probe(struct platform_device *pdev) + lan966x_port_init(lan966x->ports[p]); + } + ++ fwnode_handle_put(ports); ++ + lan966x_mdb_init(lan966x); + err = lan966x_fdb_init(lan966x); + if (err) +@@ -1160,6 +1162,7 @@ static int lan966x_probe(struct platform_device *pdev) + lan966x_fdb_deinit(lan966x); + + cleanup_ports: ++ fwnode_handle_put(ports); + fwnode_handle_put(portnp); + + lan966x_cleanup_ports(lan966x); +-- +2.39.0 + diff --git a/queue-6.1/net-macb-fix-ptp-tx-timestamp-failure-due-to-packet-.patch b/queue-6.1/net-macb-fix-ptp-tx-timestamp-failure-due-to-packet-.patch new file mode 100644 index 00000000000..50d4ce9fd51 --- /dev/null +++ b/queue-6.1/net-macb-fix-ptp-tx-timestamp-failure-due-to-packet-.patch @@ -0,0 +1,77 @@ +From db6c9d7f2018820cc2ce087df1710f971b94ca30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 15:41:33 -0600 +Subject: net: macb: fix PTP TX timestamp failure due to packet padding + +From: Robert Hancock + +[ Upstream commit 7b90f5a665acd46efbbfa677a3a3a18d01ad6487 ] + +PTP TX timestamp handling was observed to be broken with this driver +when using the raw Layer 2 PTP encapsulation. ptp4l was not receiving +the expected TX timestamp after transmitting a packet, causing it to +enter a failure state. + +The problem appears to be due to the way that the driver pads packets +which are smaller than the Ethernet minimum of 60 bytes. If headroom +space was available in the SKB, this caused the driver to move the data +back to utilize it. However, this appears to cause other data references +in the SKB to become inconsistent. In particular, this caused the +ptp_one_step_sync function to later (in the TX completion path) falsely +detect the packet as a one-step SYNC packet, even when it was not, which +caused the TX timestamp to not be processed when it should be. + +Using the headroom for this purpose seems like an unnecessary complexity +as this is not a hot path in the driver, and in most cases it appears +that there is sufficient tailroom to not require using the headroom +anyway. Remove this usage of headroom to prevent this inconsistency from +occurring and causing other problems. + +Fixes: 653e92a9175e ("net: macb: add support for padding and fcs computation") +Signed-off-by: Robert Hancock +Reviewed-by: Jacob Keller +Tested-by: Claudiu Beznea # on SAMA7G5 +Reviewed-by: Claudiu Beznea +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 4f63f1ba3161..300f47ca42e3 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -2188,7 +2188,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) + bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb) || + skb_is_nonlinear(*skb); + int padlen = ETH_ZLEN - (*skb)->len; +- int headroom = skb_headroom(*skb); + int tailroom = skb_tailroom(*skb); + struct sk_buff *nskb; + u32 fcs; +@@ -2202,9 +2201,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) + /* FCS could be appeded to tailroom. */ + if (tailroom >= ETH_FCS_LEN) + goto add_fcs; +- /* FCS could be appeded by moving data to headroom. */ +- else if (!cloned && headroom + tailroom >= ETH_FCS_LEN) +- padlen = 0; + /* No room for FCS, need to reallocate skb. */ + else + padlen = ETH_FCS_LEN; +@@ -2213,10 +2209,7 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) + padlen += ETH_FCS_LEN; + } + +- if (!cloned && headroom + tailroom >= padlen) { +- (*skb)->data = memmove((*skb)->head, (*skb)->data, (*skb)->len); +- skb_set_tail_pointer(*skb, (*skb)->len); +- } else { ++ if (cloned || tailroom < padlen) { + nskb = skb_copy_expand(*skb, 0, padlen, GFP_ATOMIC); + if (!nskb) + return -ENOMEM; +-- +2.39.0 + diff --git a/queue-6.1/net-mdio-validate-parameter-addr-in-mdiobus_get_phy.patch b/queue-6.1/net-mdio-validate-parameter-addr-in-mdiobus_get_phy.patch new file mode 100644 index 00000000000..b1d82e889d0 --- /dev/null +++ b/queue-6.1/net-mdio-validate-parameter-addr-in-mdiobus_get_phy.patch @@ -0,0 +1,44 @@ +From 1486757ddb6711718289a6e2e00f7d5b544d850f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Jan 2023 11:54:06 +0100 +Subject: net: mdio: validate parameter addr in mdiobus_get_phy() + +From: Heiner Kallweit + +[ Upstream commit 867dbe784c5010a466f00a7d1467c1c5ea569c75 ] + +The caller may pass any value as addr, what may result in an out-of-bounds +access to array mdio_map. One existing case is stmmac_init_phy() that +may pass -1 as addr. Therefore validate addr before using it. + +Fixes: 7f854420fbfe ("phy: Add API for {un}registering an mdio device to a bus.") +Signed-off-by: Heiner Kallweit +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/cdf664ea-3312-e915-73f8-021678d08887@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_bus.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index 1cd604cd1fa1..16e021b477f0 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -108,7 +108,12 @@ EXPORT_SYMBOL(mdiobus_unregister_device); + + struct phy_device *mdiobus_get_phy(struct mii_bus *bus, int addr) + { +- struct mdio_device *mdiodev = bus->mdio_map[addr]; ++ struct mdio_device *mdiodev; ++ ++ if (addr < 0 || addr >= ARRAY_SIZE(bus->mdio_map)) ++ return NULL; ++ ++ mdiodev = bus->mdio_map[addr]; + + if (!mdiodev) + return NULL; +-- +2.39.0 + diff --git a/queue-6.1/net-mlx5-e-switch-fix-setting-of-reserved-fields-on-.patch b/queue-6.1/net-mlx5-e-switch-fix-setting-of-reserved-fields-on-.patch new file mode 100644 index 00000000000..c46caa0ac81 --- /dev/null +++ b/queue-6.1/net-mlx5-e-switch-fix-setting-of-reserved-fields-on-.patch @@ -0,0 +1,82 @@ +From 462e447fa8b8418cbcfc239e2bc1903508f03521 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Dec 2022 10:22:41 +0200 +Subject: net/mlx5: E-switch, Fix setting of reserved fields on + MODIFY_SCHEDULING_ELEMENT + +From: Maor Dickman + +[ Upstream commit f51471d1935ce1f504fce6c115ce3bfbc32032b0 ] + +According to HW spec element_type, element_attributes and parent_element_id fields +should be reserved (0x0) when calling MODIFY_SCHEDULING_ELEMENT command. + +This patch remove initialization of these fields when calling the command. + +Fixes: bd77bf1cb595 ("net/mlx5: Add SRIOV VF max rate configuration support") +Signed-off-by: Maor Dickman +Reviewed-by: Eli Cohen +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/esw/qos.c | 18 +++--------------- + 1 file changed, 3 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c +index 4f8a24d84a86..75015d370922 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c +@@ -22,15 +22,13 @@ struct mlx5_esw_rate_group { + }; + + static int esw_qos_tsar_config(struct mlx5_core_dev *dev, u32 *sched_ctx, +- u32 parent_ix, u32 tsar_ix, +- u32 max_rate, u32 bw_share) ++ u32 tsar_ix, u32 max_rate, u32 bw_share) + { + u32 bitmask = 0; + + if (!MLX5_CAP_GEN(dev, qos) || !MLX5_CAP_QOS(dev, esw_scheduling)) + return -EOPNOTSUPP; + +- MLX5_SET(scheduling_context, sched_ctx, parent_element_id, parent_ix); + MLX5_SET(scheduling_context, sched_ctx, max_average_bw, max_rate); + MLX5_SET(scheduling_context, sched_ctx, bw_share, bw_share); + bitmask |= MODIFY_SCHEDULING_ELEMENT_IN_MODIFY_BITMASK_MAX_AVERAGE_BW; +@@ -51,7 +49,7 @@ static int esw_qos_group_config(struct mlx5_eswitch *esw, struct mlx5_esw_rate_g + int err; + + err = esw_qos_tsar_config(dev, sched_ctx, +- esw->qos.root_tsar_ix, group->tsar_ix, ++ group->tsar_ix, + max_rate, bw_share); + if (err) + NL_SET_ERR_MSG_MOD(extack, "E-Switch modify group TSAR element failed"); +@@ -67,23 +65,13 @@ static int esw_qos_vport_config(struct mlx5_eswitch *esw, + struct netlink_ext_ack *extack) + { + u32 sched_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {}; +- struct mlx5_esw_rate_group *group = vport->qos.group; + struct mlx5_core_dev *dev = esw->dev; +- u32 parent_tsar_ix; +- void *vport_elem; + int err; + + if (!vport->qos.enabled) + return -EIO; + +- parent_tsar_ix = group ? group->tsar_ix : esw->qos.root_tsar_ix; +- MLX5_SET(scheduling_context, sched_ctx, element_type, +- SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT); +- vport_elem = MLX5_ADDR_OF(scheduling_context, sched_ctx, +- element_attributes); +- MLX5_SET(vport_element, vport_elem, vport_number, vport->vport); +- +- err = esw_qos_tsar_config(dev, sched_ctx, parent_tsar_ix, vport->qos.esw_tsar_ix, ++ err = esw_qos_tsar_config(dev, sched_ctx, vport->qos.esw_tsar_ix, + max_rate, bw_share); + if (err) { + esw_warn(esw->dev, +-- +2.39.0 + diff --git a/queue-6.1/net-mlx5-e-switch-fix-switchdev-mode-after-devlink-r.patch b/queue-6.1/net-mlx5-e-switch-fix-switchdev-mode-after-devlink-r.patch new file mode 100644 index 00000000000..08ff6a9d613 --- /dev/null +++ b/queue-6.1/net-mlx5-e-switch-fix-switchdev-mode-after-devlink-r.patch @@ -0,0 +1,40 @@ +From f8e5f2f665ac691e791ada02a2a65596d20d605d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Dec 2022 11:14:37 +0200 +Subject: net/mlx5: E-switch, Fix switchdev mode after devlink reload + +From: Chris Mi + +[ Upstream commit 7c83d1f4c5adae9583e7fca1e3e830d6b061522d ] + +The cited commit removes eswitch mode none. So after devlink reload +in switchdev mode, eswitch mode is not changed. But actually eswitch +is disabled during devlink reload. + +Fix it by setting eswitch mode to legacy when disabling eswitch +which is called by reload_down. + +Fixes: f019679ea5f2 ("net/mlx5: E-switch, Remove dependency between sriov and eswitch mode") +Signed-off-by: Chris Mi +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 788a6ab5c463..43ba00d5e36e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1421,6 +1421,7 @@ void mlx5_eswitch_disable(struct mlx5_eswitch *esw) + mlx5_lag_disable_change(esw->dev); + down_write(&esw->mode_lock); + mlx5_eswitch_disable_locked(esw); ++ esw->mode = MLX5_ESWITCH_LEGACY; + up_write(&esw->mode_lock); + mlx5_lag_enable_change(esw->dev); + } +-- +2.39.0 + diff --git a/queue-6.1/net-mlx5-eliminate-anonymous-module_init-module_exit.patch b/queue-6.1/net-mlx5-eliminate-anonymous-module_init-module_exit.patch new file mode 100644 index 00000000000..05954423c97 --- /dev/null +++ b/queue-6.1/net-mlx5-eliminate-anonymous-module_init-module_exit.patch @@ -0,0 +1,76 @@ +From 658267fea6d383075412ac5848044c73e83d79cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 20:12:29 -0700 +Subject: net: mlx5: eliminate anonymous module_init & module_exit + +From: Randy Dunlap + +[ Upstream commit 2c1e1b949024989e20907b84e11a731a50778416 ] + +Eliminate anonymous module_init() and module_exit(), which can lead to +confusion or ambiguity when reading System.map, crashes/oops/bugs, +or an initcall_debug log. + +Give each of these init and exit functions unique driver-specific +names to eliminate the anonymous names. + +Example 1: (System.map) + ffffffff832fc78c t init + ffffffff832fc79e t init + ffffffff832fc8f8 t init + +Example 2: (initcall_debug log) + calling init+0x0/0x12 @ 1 + initcall init+0x0/0x12 returned 0 after 15 usecs + calling init+0x0/0x60 @ 1 + initcall init+0x0/0x60 returned 0 after 2 usecs + calling init+0x0/0x9a @ 1 + initcall init+0x0/0x9a returned 0 after 74 usecs + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Signed-off-by: Randy Dunlap +Cc: Eli Cohen +Cc: Saeed Mahameed +Cc: Leon Romanovsky +Cc: linux-rdma@vger.kernel.org +Reviewed-by: Ira Weiny +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 00758312df06..d4db1adae3e3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -2082,7 +2082,7 @@ static void mlx5_core_verify_params(void) + } + } + +-static int __init init(void) ++static int __init mlx5_init(void) + { + int err; + +@@ -2117,7 +2117,7 @@ static int __init init(void) + return err; + } + +-static void __exit cleanup(void) ++static void __exit mlx5_cleanup(void) + { + mlx5e_cleanup(); + mlx5_sf_driver_unregister(); +@@ -2125,5 +2125,5 @@ static void __exit cleanup(void) + mlx5_unregister_debugfs(); + } + +-module_init(init); +-module_exit(cleanup); ++module_init(mlx5_init); ++module_exit(mlx5_cleanup); +-- +2.39.0 + diff --git a/queue-6.1/net-mlx5e-avoid-false-lock-dependency-warning-on-tc_.patch b/queue-6.1/net-mlx5e-avoid-false-lock-dependency-warning-on-tc_.patch new file mode 100644 index 00000000000..13f0a61ca58 --- /dev/null +++ b/queue-6.1/net-mlx5e-avoid-false-lock-dependency-warning-on-tc_.patch @@ -0,0 +1,244 @@ +From 8ab13374686e32b17840efe3bc6a27d18f493431 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 16:44:33 +0100 +Subject: net/mlx5e: Avoid false lock dependency warning on tc_ht even more + +From: Vlad Buslov + +[ Upstream commit 5aa56105930374928d567744595fd7ac525d0688 ] + +The cited commit changed class of tc_ht internal mutex in order to avoid +false lock dependency with fs_core node and flow_table hash table +structures. However, hash table implementation internally also includes a +workqueue task with its own lockdep map which causes similar bogus lockdep +splat[0]. Fix it by also adding dedicated class for hash table workqueue +work structure of tc_ht. + +[0]: + +[ 1139.672465] ====================================================== +[ 1139.673552] WARNING: possible circular locking dependency detected +[ 1139.674635] 6.1.0_for_upstream_debug_2022_12_12_17_02 #1 Not tainted +[ 1139.675734] ------------------------------------------------------ +[ 1139.676801] modprobe/5998 is trying to acquire lock: +[ 1139.677726] ffff88811e7b93b8 (&node->lock){++++}-{3:3}, at: down_write_ref_node+0x7c/0xe0 [mlx5_core] +[ 1139.679662] + but task is already holding lock: +[ 1139.680703] ffff88813c1f96a0 (&tc_ht_lock_key){+.+.}-{3:3}, at: rhashtable_free_and_destroy+0x38/0x6f0 +[ 1139.682223] + which lock already depends on the new lock. + +[ 1139.683640] + the existing dependency chain (in reverse order) is: +[ 1139.684887] + -> #2 (&tc_ht_lock_key){+.+.}-{3:3}: +[ 1139.685975] __mutex_lock+0x12c/0x14b0 +[ 1139.686659] rht_deferred_worker+0x35/0x1540 +[ 1139.687405] process_one_work+0x7c2/0x1310 +[ 1139.688134] worker_thread+0x59d/0xec0 +[ 1139.688820] kthread+0x28f/0x330 +[ 1139.689444] ret_from_fork+0x1f/0x30 +[ 1139.690106] + -> #1 ((work_completion)(&ht->run_work)){+.+.}-{0:0}: +[ 1139.691250] __flush_work+0xe8/0x900 +[ 1139.691915] __cancel_work_timer+0x2ca/0x3f0 +[ 1139.692655] rhashtable_free_and_destroy+0x22/0x6f0 +[ 1139.693472] del_sw_flow_table+0x22/0xb0 [mlx5_core] +[ 1139.694592] tree_put_node+0x24c/0x450 [mlx5_core] +[ 1139.695686] tree_remove_node+0x6e/0x100 [mlx5_core] +[ 1139.696803] mlx5_destroy_flow_table+0x187/0x690 [mlx5_core] +[ 1139.698017] mlx5e_tc_nic_cleanup+0x2f8/0x400 [mlx5_core] +[ 1139.699217] mlx5e_cleanup_nic_rx+0x2b/0x210 [mlx5_core] +[ 1139.700397] mlx5e_detach_netdev+0x19d/0x2b0 [mlx5_core] +[ 1139.701571] mlx5e_suspend+0xdb/0x140 [mlx5_core] +[ 1139.702665] mlx5e_remove+0x89/0x190 [mlx5_core] +[ 1139.703756] auxiliary_bus_remove+0x52/0x70 +[ 1139.704492] device_release_driver_internal+0x3c1/0x600 +[ 1139.705360] bus_remove_device+0x2a5/0x560 +[ 1139.706080] device_del+0x492/0xb80 +[ 1139.706724] mlx5_rescan_drivers_locked+0x194/0x6a0 [mlx5_core] +[ 1139.707961] mlx5_unregister_device+0x7a/0xa0 [mlx5_core] +[ 1139.709138] mlx5_uninit_one+0x5f/0x160 [mlx5_core] +[ 1139.710252] remove_one+0xd1/0x160 [mlx5_core] +[ 1139.711297] pci_device_remove+0x96/0x1c0 +[ 1139.722721] device_release_driver_internal+0x3c1/0x600 +[ 1139.723590] unbind_store+0x1b1/0x200 +[ 1139.724259] kernfs_fop_write_iter+0x348/0x520 +[ 1139.725019] vfs_write+0x7b2/0xbf0 +[ 1139.725658] ksys_write+0xf3/0x1d0 +[ 1139.726292] do_syscall_64+0x3d/0x90 +[ 1139.726942] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 1139.727769] + -> #0 (&node->lock){++++}-{3:3}: +[ 1139.728698] __lock_acquire+0x2cf5/0x62f0 +[ 1139.729415] lock_acquire+0x1c1/0x540 +[ 1139.730076] down_write+0x8e/0x1f0 +[ 1139.730709] down_write_ref_node+0x7c/0xe0 [mlx5_core] +[ 1139.731841] mlx5_del_flow_rules+0x6f/0x610 [mlx5_core] +[ 1139.732982] __mlx5_eswitch_del_rule+0xdd/0x560 [mlx5_core] +[ 1139.734207] mlx5_eswitch_del_offloaded_rule+0x14/0x20 [mlx5_core] +[ 1139.735491] mlx5e_tc_rule_unoffload+0x104/0x2b0 [mlx5_core] +[ 1139.736716] mlx5e_tc_unoffload_fdb_rules+0x10c/0x1f0 [mlx5_core] +[ 1139.738007] mlx5e_tc_del_fdb_flow+0xc3c/0xfa0 [mlx5_core] +[ 1139.739213] mlx5e_tc_del_flow+0x146/0xa20 [mlx5_core] +[ 1139.740377] _mlx5e_tc_del_flow+0x38/0x60 [mlx5_core] +[ 1139.741534] rhashtable_free_and_destroy+0x3be/0x6f0 +[ 1139.742351] mlx5e_tc_ht_cleanup+0x1b/0x30 [mlx5_core] +[ 1139.743512] mlx5e_cleanup_rep_tx+0x4a/0xe0 [mlx5_core] +[ 1139.744683] mlx5e_detach_netdev+0x1ca/0x2b0 [mlx5_core] +[ 1139.745860] mlx5e_netdev_change_profile+0xd9/0x1c0 [mlx5_core] +[ 1139.747098] mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core] +[ 1139.748372] mlx5e_vport_rep_unload+0x16a/0x1b0 [mlx5_core] +[ 1139.749590] __esw_offloads_unload_rep+0xb1/0xd0 [mlx5_core] +[ 1139.750813] mlx5_eswitch_unregister_vport_reps+0x409/0x5f0 [mlx5_core] +[ 1139.752147] mlx5e_rep_remove+0x62/0x80 [mlx5_core] +[ 1139.753293] auxiliary_bus_remove+0x52/0x70 +[ 1139.754028] device_release_driver_internal+0x3c1/0x600 +[ 1139.754885] driver_detach+0xc1/0x180 +[ 1139.755553] bus_remove_driver+0xef/0x2e0 +[ 1139.756260] auxiliary_driver_unregister+0x16/0x50 +[ 1139.757059] mlx5e_rep_cleanup+0x19/0x30 [mlx5_core] +[ 1139.758207] mlx5e_cleanup+0x12/0x30 [mlx5_core] +[ 1139.759295] mlx5_cleanup+0xc/0x49 [mlx5_core] +[ 1139.760384] __x64_sys_delete_module+0x2b5/0x450 +[ 1139.761166] do_syscall_64+0x3d/0x90 +[ 1139.761827] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 1139.762663] + other info that might help us debug this: + +[ 1139.763925] Chain exists of: + &node->lock --> (work_completion)(&ht->run_work) --> &tc_ht_lock_key + +[ 1139.765743] Possible unsafe locking scenario: + +[ 1139.766688] CPU0 CPU1 +[ 1139.767399] ---- ---- +[ 1139.768111] lock(&tc_ht_lock_key); +[ 1139.768704] lock((work_completion)(&ht->run_work)); +[ 1139.769869] lock(&tc_ht_lock_key); +[ 1139.770770] lock(&node->lock); +[ 1139.771326] + *** DEADLOCK *** + +[ 1139.772345] 2 locks held by modprobe/5998: +[ 1139.772994] #0: ffff88813c1ff0e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x8d/0x600 +[ 1139.774399] #1: ffff88813c1f96a0 (&tc_ht_lock_key){+.+.}-{3:3}, at: rhashtable_free_and_destroy+0x38/0x6f0 +[ 1139.775822] + stack backtrace: +[ 1139.776579] CPU: 3 PID: 5998 Comm: modprobe Not tainted 6.1.0_for_upstream_debug_2022_12_12_17_02 #1 +[ 1139.777935] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +[ 1139.779529] Call Trace: +[ 1139.779992] +[ 1139.780409] dump_stack_lvl+0x57/0x7d +[ 1139.781015] check_noncircular+0x278/0x300 +[ 1139.781687] ? print_circular_bug+0x460/0x460 +[ 1139.782381] ? rcu_read_lock_sched_held+0x3f/0x70 +[ 1139.783121] ? lock_release+0x487/0x7c0 +[ 1139.783759] ? orc_find.part.0+0x1f1/0x330 +[ 1139.784423] ? mark_lock.part.0+0xef/0x2fc0 +[ 1139.785091] __lock_acquire+0x2cf5/0x62f0 +[ 1139.785754] ? register_lock_class+0x18e0/0x18e0 +[ 1139.786483] lock_acquire+0x1c1/0x540 +[ 1139.787093] ? down_write_ref_node+0x7c/0xe0 [mlx5_core] +[ 1139.788195] ? lockdep_hardirqs_on_prepare+0x3f0/0x3f0 +[ 1139.788978] ? register_lock_class+0x18e0/0x18e0 +[ 1139.789715] down_write+0x8e/0x1f0 +[ 1139.790292] ? down_write_ref_node+0x7c/0xe0 [mlx5_core] +[ 1139.791380] ? down_write_killable+0x220/0x220 +[ 1139.792080] ? find_held_lock+0x2d/0x110 +[ 1139.792713] down_write_ref_node+0x7c/0xe0 [mlx5_core] +[ 1139.793795] mlx5_del_flow_rules+0x6f/0x610 [mlx5_core] +[ 1139.794879] __mlx5_eswitch_del_rule+0xdd/0x560 [mlx5_core] +[ 1139.796032] ? __esw_offloads_unload_rep+0xd0/0xd0 [mlx5_core] +[ 1139.797227] ? xa_load+0x11a/0x200 +[ 1139.797800] ? __xa_clear_mark+0xf0/0xf0 +[ 1139.798438] mlx5_eswitch_del_offloaded_rule+0x14/0x20 [mlx5_core] +[ 1139.799660] mlx5e_tc_rule_unoffload+0x104/0x2b0 [mlx5_core] +[ 1139.800821] mlx5e_tc_unoffload_fdb_rules+0x10c/0x1f0 [mlx5_core] +[ 1139.802049] ? mlx5_eswitch_get_uplink_priv+0x25/0x80 [mlx5_core] +[ 1139.803260] mlx5e_tc_del_fdb_flow+0xc3c/0xfa0 [mlx5_core] +[ 1139.804398] ? __cancel_work_timer+0x1c2/0x3f0 +[ 1139.805099] ? mlx5e_tc_unoffload_from_slow_path+0x460/0x460 [mlx5_core] +[ 1139.806387] mlx5e_tc_del_flow+0x146/0xa20 [mlx5_core] +[ 1139.807481] _mlx5e_tc_del_flow+0x38/0x60 [mlx5_core] +[ 1139.808564] rhashtable_free_and_destroy+0x3be/0x6f0 +[ 1139.809336] ? mlx5e_tc_del_flow+0xa20/0xa20 [mlx5_core] +[ 1139.809336] ? mlx5e_tc_del_flow+0xa20/0xa20 [mlx5_core] +[ 1139.810455] mlx5e_tc_ht_cleanup+0x1b/0x30 [mlx5_core] +[ 1139.811552] mlx5e_cleanup_rep_tx+0x4a/0xe0 [mlx5_core] +[ 1139.812655] mlx5e_detach_netdev+0x1ca/0x2b0 [mlx5_core] +[ 1139.813768] mlx5e_netdev_change_profile+0xd9/0x1c0 [mlx5_core] +[ 1139.814952] mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core] +[ 1139.816166] mlx5e_vport_rep_unload+0x16a/0x1b0 [mlx5_core] +[ 1139.817336] __esw_offloads_unload_rep+0xb1/0xd0 [mlx5_core] +[ 1139.818507] mlx5_eswitch_unregister_vport_reps+0x409/0x5f0 [mlx5_core] +[ 1139.819788] ? mlx5_eswitch_uplink_get_proto_dev+0x30/0x30 [mlx5_core] +[ 1139.821051] ? kernfs_find_ns+0x137/0x310 +[ 1139.821705] mlx5e_rep_remove+0x62/0x80 [mlx5_core] +[ 1139.822778] auxiliary_bus_remove+0x52/0x70 +[ 1139.823449] device_release_driver_internal+0x3c1/0x600 +[ 1139.824240] driver_detach+0xc1/0x180 +[ 1139.824842] bus_remove_driver+0xef/0x2e0 +[ 1139.825504] auxiliary_driver_unregister+0x16/0x50 +[ 1139.826245] mlx5e_rep_cleanup+0x19/0x30 [mlx5_core] +[ 1139.827322] mlx5e_cleanup+0x12/0x30 [mlx5_core] +[ 1139.828345] mlx5_cleanup+0xc/0x49 [mlx5_core] +[ 1139.829382] __x64_sys_delete_module+0x2b5/0x450 +[ 1139.830119] ? module_flags+0x300/0x300 +[ 1139.830750] ? task_work_func_match+0x50/0x50 +[ 1139.831440] ? task_work_cancel+0x20/0x20 +[ 1139.832088] ? lockdep_hardirqs_on_prepare+0x273/0x3f0 +[ 1139.832873] ? syscall_enter_from_user_mode+0x1d/0x50 +[ 1139.833661] ? trace_hardirqs_on+0x2d/0x100 +[ 1139.834328] do_syscall_64+0x3d/0x90 +[ 1139.834922] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 1139.835700] RIP: 0033:0x7f153e71288b +[ 1139.836302] Code: 73 01 c3 48 8b 0d 9d 75 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 6d 75 0e 00 f7 d8 64 89 01 48 +[ 1139.838866] RSP: 002b:00007ffe0a3ed938 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 +[ 1139.840020] RAX: ffffffffffffffda RBX: 0000564c2cbf8220 RCX: 00007f153e71288b +[ 1139.841043] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000564c2cbf8288 +[ 1139.842072] RBP: 0000564c2cbf8220 R08: 0000000000000000 R09: 0000000000000000 +[ 1139.843094] R10: 00007f153e7a3ac0 R11: 0000000000000206 R12: 0000564c2cbf8288 +[ 1139.844118] R13: 0000000000000000 R14: 0000564c2cbf7ae8 R15: 00007ffe0a3efcb8 + +Fixes: 9ba33339c043 ("net/mlx5e: Avoid false lock depenency warning on tc_ht") +Signed-off-by: Vlad Buslov +Reviewed-by: Eli Cohen +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 4c313b7424bf..c1cf3917baa4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -157,6 +157,7 @@ struct mlx5_fs_chains *mlx5e_nic_chains(struct mlx5e_tc_table *tc) + * it's different than the ht->mutex here. + */ + static struct lock_class_key tc_ht_lock_key; ++static struct lock_class_key tc_ht_wq_key; + + static void mlx5e_put_flow_tunnel_id(struct mlx5e_tc_flow *flow); + static void free_flow_post_acts(struct mlx5e_tc_flow *flow); +@@ -4971,6 +4972,7 @@ int mlx5e_tc_nic_init(struct mlx5e_priv *priv) + return err; + + lockdep_set_class(&tc->ht.mutex, &tc_ht_lock_key); ++ lockdep_init_map(&tc->ht.run_work.lockdep_map, "tc_ht_wq_key", &tc_ht_wq_key, 0); + + mapping_id = mlx5_query_nic_system_image_guid(dev); + +@@ -5077,6 +5079,7 @@ int mlx5e_tc_ht_init(struct rhashtable *tc_ht) + return err; + + lockdep_set_class(&tc_ht->mutex, &tc_ht_lock_key); ++ lockdep_init_map(&tc_ht->run_work.lockdep_map, "tc_ht_wq_key", &tc_ht_wq_key, 0); + + return 0; + } +-- +2.39.0 + diff --git a/queue-6.1/net-mlx5e-qos-fix-wrongfully-setting-parent_element_.patch b/queue-6.1/net-mlx5e-qos-fix-wrongfully-setting-parent_element_.patch new file mode 100644 index 00000000000..bbb3bc34f53 --- /dev/null +++ b/queue-6.1/net-mlx5e-qos-fix-wrongfully-setting-parent_element_.patch @@ -0,0 +1,84 @@ +From 9c3b829aaeec7c10a0e4cf60189931433e345cfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Dec 2022 10:51:38 +0200 +Subject: net/mlx5e: QoS, Fix wrongfully setting parent_element_id on + MODIFY_SCHEDULING_ELEMENT + +From: Maor Dickman + +[ Upstream commit 4ddf77f9bc76092d268bd3af447d60d9cc62b652 ] + +According to HW spec parent_element_id field should be reserved (0x0) when calling +MODIFY_SCHEDULING_ELEMENT command. + +This patch remove the wrong initialization of reserved field, parent_element_id, on +mlx5_qos_update_node. + +Fixes: 214baf22870c ("net/mlx5e: Support HTB offload") +Signed-off-by: Maor Dickman +Reviewed-by: Eli Cohen +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/htb.c | 4 ++-- + drivers/net/ethernet/mellanox/mlx5/core/qos.c | 3 +-- + drivers/net/ethernet/mellanox/mlx5/core/qos.h | 2 +- + 3 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/htb.c b/drivers/net/ethernet/mellanox/mlx5/core/en/htb.c +index 6dac76fa58a3..09d441ecb9f6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/htb.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/htb.c +@@ -637,7 +637,7 @@ mlx5e_htb_update_children(struct mlx5e_htb *htb, struct mlx5e_qos_node *node, + if (child->bw_share == old_bw_share) + continue; + +- err_one = mlx5_qos_update_node(htb->mdev, child->hw_id, child->bw_share, ++ err_one = mlx5_qos_update_node(htb->mdev, child->bw_share, + child->max_average_bw, child->hw_id); + if (!err && err_one) { + err = err_one; +@@ -671,7 +671,7 @@ mlx5e_htb_node_modify(struct mlx5e_htb *htb, u16 classid, u64 rate, u64 ceil, + mlx5e_htb_convert_rate(htb, rate, node->parent, &bw_share); + mlx5e_htb_convert_ceil(htb, ceil, &max_average_bw); + +- err = mlx5_qos_update_node(htb->mdev, node->parent->hw_id, bw_share, ++ err = mlx5_qos_update_node(htb->mdev, bw_share, + max_average_bw, node->hw_id); + if (err) { + NL_SET_ERR_MSG_MOD(extack, "Firmware error when modifying a node."); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/qos.c +index 0777be24a307..8bce730b5c5b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/qos.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qos.c +@@ -62,13 +62,12 @@ int mlx5_qos_create_root_node(struct mlx5_core_dev *mdev, u32 *id) + return mlx5_qos_create_inner_node(mdev, MLX5_QOS_DEFAULT_DWRR_UID, 0, 0, id); + } + +-int mlx5_qos_update_node(struct mlx5_core_dev *mdev, u32 parent_id, ++int mlx5_qos_update_node(struct mlx5_core_dev *mdev, + u32 bw_share, u32 max_avg_bw, u32 id) + { + u32 sched_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {0}; + u32 bitmask = 0; + +- MLX5_SET(scheduling_context, sched_ctx, parent_element_id, parent_id); + MLX5_SET(scheduling_context, sched_ctx, bw_share, bw_share); + MLX5_SET(scheduling_context, sched_ctx, max_average_bw, max_avg_bw); + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qos.h b/drivers/net/ethernet/mellanox/mlx5/core/qos.h +index 125e4e47e6f7..624ce822b7f5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/qos.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qos.h +@@ -23,7 +23,7 @@ int mlx5_qos_create_leaf_node(struct mlx5_core_dev *mdev, u32 parent_id, + int mlx5_qos_create_inner_node(struct mlx5_core_dev *mdev, u32 parent_id, + u32 bw_share, u32 max_avg_bw, u32 *id); + int mlx5_qos_create_root_node(struct mlx5_core_dev *mdev, u32 *id); +-int mlx5_qos_update_node(struct mlx5_core_dev *mdev, u32 parent_id, u32 bw_share, ++int mlx5_qos_update_node(struct mlx5_core_dev *mdev, u32 bw_share, + u32 max_avg_bw, u32 id); + int mlx5_qos_destroy_node(struct mlx5_core_dev *mdev, u32 id); + +-- +2.39.0 + diff --git a/queue-6.1/net-mlx5e-set-decap-action-based-on-attr-for-sample.patch b/queue-6.1/net-mlx5e-set-decap-action-based-on-attr-for-sample.patch new file mode 100644 index 00000000000..f54448ff9bb --- /dev/null +++ b/queue-6.1/net-mlx5e-set-decap-action-based-on-attr-for-sample.patch @@ -0,0 +1,58 @@ +From ad763d641748b4ba100494998bb82fa094ebcdcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 04:30:27 +0200 +Subject: net/mlx5e: Set decap action based on attr for sample + +From: Chris Mi + +[ Upstream commit ffa99b534732f90077f346c62094cab3d1ccddce ] + +Currently decap action is set based on tunnel_id. That means it is +set unconditionally. But for decap, ct and sample actions, decap is +done before ct. No need to decap again in sample. + +And the actions are set correctly when parsing. So set decap action +based on attr instead of tunnel_id. + +Fixes: 2741f2230905 ("net/mlx5e: TC, Support sample offload action for tunneled traffic") +Signed-off-by: Chris Mi +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c +index 1cbd2eb9d04f..f2c2c752bd1c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/sample.c +@@ -477,7 +477,6 @@ mlx5e_tc_sample_offload(struct mlx5e_tc_psample *tc_psample, + struct mlx5e_sample_flow *sample_flow; + struct mlx5e_sample_attr *sample_attr; + struct mlx5_flow_attr *pre_attr; +- u32 tunnel_id = attr->tunnel_id; + struct mlx5_eswitch *esw; + u32 default_tbl_id; + u32 obj_id; +@@ -522,7 +521,7 @@ mlx5e_tc_sample_offload(struct mlx5e_tc_psample *tc_psample, + restore_obj.sample.group_id = sample_attr->group_num; + restore_obj.sample.rate = sample_attr->rate; + restore_obj.sample.trunc_size = sample_attr->trunc_size; +- restore_obj.sample.tunnel_id = tunnel_id; ++ restore_obj.sample.tunnel_id = attr->tunnel_id; + err = mapping_add(esw->offloads.reg_c0_obj_pool, &restore_obj, &obj_id); + if (err) + goto err_obj_id; +@@ -548,7 +547,7 @@ mlx5e_tc_sample_offload(struct mlx5e_tc_psample *tc_psample, + /* For decap action, do decap in the original flow table instead of the + * default flow table. + */ +- if (tunnel_id) ++ if (attr->action & MLX5_FLOW_CONTEXT_ACTION_DECAP) + pre_attr->action |= MLX5_FLOW_CONTEXT_ACTION_DECAP; + pre_attr->modify_hdr = sample_flow->restore->modify_hdr; + pre_attr->flags = MLX5_ATTR_FLAG_SAMPLE; +-- +2.39.0 + diff --git a/queue-6.1/net-nfc-fix-use-after-free-in-local_cleanup.patch b/queue-6.1/net-nfc-fix-use-after-free-in-local_cleanup.patch new file mode 100644 index 00000000000..1911b05af77 --- /dev/null +++ b/queue-6.1/net-nfc-fix-use-after-free-in-local_cleanup.patch @@ -0,0 +1,112 @@ +From f6e5effc9f55933361d2f2859036fafa0ddf249d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:19:14 +0900 +Subject: net: nfc: Fix use-after-free in local_cleanup() + +From: Jisoo Jang + +[ Upstream commit 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6 ] + +Fix a use-after-free that occurs in kfree_skb() called from +local_cleanup(). This could happen when killing nfc daemon (e.g. neard) +after detaching an nfc device. +When detaching an nfc device, local_cleanup() called from +nfc_llcp_unregister_device() frees local->rx_pending and decreases +local->ref by kref_put() in nfc_llcp_local_put(). +In the terminating process, nfc daemon releases all sockets and it leads +to decreasing local->ref. After the last release of local->ref, +local_cleanup() called from local_release() frees local->rx_pending +again, which leads to the bug. + +Setting local->rx_pending to NULL in local_cleanup() could prevent +use-after-free when local_cleanup() is called twice. + +Found by a modified version of syzkaller. + +BUG: KASAN: use-after-free in kfree_skb() + +Call Trace: +dump_stack_lvl (lib/dump_stack.c:106) +print_address_description.constprop.0.cold (mm/kasan/report.c:306) +kasan_check_range (mm/kasan/generic.c:189) +kfree_skb (net/core/skbuff.c:955) +local_cleanup (net/nfc/llcp_core.c:159) +nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172) +nfc_llcp_local_put (net/nfc/llcp_core.c:181) +llcp_sock_destruct (net/nfc/llcp_sock.c:959) +__sk_destruct (net/core/sock.c:2133) +sk_destruct (net/core/sock.c:2181) +__sk_free (net/core/sock.c:2192) +sk_free (net/core/sock.c:2203) +llcp_sock_release (net/nfc/llcp_sock.c:646) +__sock_release (net/socket.c:650) +sock_close (net/socket.c:1365) +__fput (fs/file_table.c:306) +task_work_run (kernel/task_work.c:179) +ptrace_notify (kernel/signal.c:2354) +syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278) +syscall_exit_to_user_mode (kernel/entry/common.c:296) +do_syscall_64 (arch/x86/entry/common.c:86) +entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106) + +Allocated by task 4719: +kasan_save_stack (mm/kasan/common.c:45) +__kasan_slab_alloc (mm/kasan/common.c:325) +slab_post_alloc_hook (mm/slab.h:766) +kmem_cache_alloc_node (mm/slub.c:3497) +__alloc_skb (net/core/skbuff.c:552) +pn533_recv_response (drivers/nfc/pn533/usb.c:65) +__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671) +usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704) +tasklet_action_common.isra.0 (kernel/softirq.c:797) +__do_softirq (kernel/softirq.c:571) + +Freed by task 1901: +kasan_save_stack (mm/kasan/common.c:45) +kasan_set_track (mm/kasan/common.c:52) +kasan_save_free_info (mm/kasan/genericdd.c:518) +__kasan_slab_free (mm/kasan/common.c:236) +kmem_cache_free (mm/slub.c:3809) +kfree_skbmem (net/core/skbuff.c:874) +kfree_skb (net/core/skbuff.c:931) +local_cleanup (net/nfc/llcp_core.c:159) +nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617) +nfc_unregister_device (net/nfc/core.c:1179) +pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846) +pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579) +usb_unbind_interface (drivers/usb/core/driver.c:458) +device_release_driver_internal (drivers/base/dd.c:1279) +bus_remove_device (drivers/base/bus.c:529) +device_del (drivers/base/core.c:3665) +usb_disable_device (drivers/usb/core/message.c:1420) +usb_disconnect (drivers/usb/core.c:2261) +hub_event (drivers/usb/core/hub.c:5833) +process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281) +worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423) +kthread (kernel/kthread.c:319) +ret_from_fork (arch/x86/entry/entry_64.S:301) + +Fixes: 3536da06db0b ("NFC: llcp: Clean local timers and works when removing a device") +Signed-off-by: Jisoo Jang +Link: https://lore.kernel.org/r/20230111131914.3338838-1-jisoo.jang@yonsei.ac.kr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/llcp_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c +index 3364caabef8b..a27e1842b2a0 100644 +--- a/net/nfc/llcp_core.c ++++ b/net/nfc/llcp_core.c +@@ -157,6 +157,7 @@ static void local_cleanup(struct nfc_llcp_local *local) + cancel_work_sync(&local->rx_work); + cancel_work_sync(&local->timeout_work); + kfree_skb(local->rx_pending); ++ local->rx_pending = NULL; + del_timer_sync(&local->sdreq_timer); + cancel_work_sync(&local->sdreq_timeout_work); + nfc_llcp_free_sdp_tlv_list(&local->pending_sdreqs); +-- +2.39.0 + diff --git a/queue-6.1/net-sched-gred-prevent-races-when-adding-offloads-to.patch b/queue-6.1/net-sched-gred-prevent-races-when-adding-offloads-to.patch new file mode 100644 index 00000000000..09e7d824c93 --- /dev/null +++ b/queue-6.1/net-sched-gred-prevent-races-when-adding-offloads-to.patch @@ -0,0 +1,49 @@ +From b17a32315f46340590d0c4533a07b79e31ff5cf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 20:41:37 -0800 +Subject: net: sched: gred: prevent races when adding offloads to stats + +From: Jakub Kicinski + +[ Upstream commit 339346d49ae0859fe19b860998867861d37f1a76 ] + +Naresh reports seeing a warning that gred is calling +u64_stats_update_begin() with preemption enabled. +Arnd points out it's coming from _bstats_update(). + +We should be holding the qdisc lock when writing +to stats, they are also updated from the datapath. + +Reported-by: Linux Kernel Functional Testing +Link: https://lore.kernel.org/all/CA+G9fYsTr9_r893+62u6UGD3dVaCE-kN9C-Apmb2m=hxjc1Cqg@mail.gmail.com/ +Fixes: e49efd5288bd ("net: sched: gred: support reporting stats from offloads") +Link: https://lore.kernel.org/r/20230113044137.1383067-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_gred.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c +index a661b062cca8..872d127c9db4 100644 +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -377,6 +377,7 @@ static int gred_offload_dump_stats(struct Qdisc *sch) + /* Even if driver returns failure adjust the stats - in case offload + * ended but driver still wants to adjust the values. + */ ++ sch_tree_lock(sch); + for (i = 0; i < MAX_DPs; i++) { + if (!table->tab[i]) + continue; +@@ -393,6 +394,7 @@ static int gred_offload_dump_stats(struct Qdisc *sch) + sch->qstats.overlimits += hw_stats->stats.qstats[i].overlimits; + } + _bstats_update(&sch->bstats, bytes, packets); ++ sch_tree_unlock(sch); + + kfree(hw_stats); + return ret; +-- +2.39.0 + diff --git a/queue-6.1/net-sched-sch_taprio-fix-possible-use-after-free.patch b/queue-6.1/net-sched-sch_taprio-fix-possible-use-after-free.patch new file mode 100644 index 00000000000..32bfe1836a0 --- /dev/null +++ b/queue-6.1/net-sched-sch_taprio-fix-possible-use-after-free.patch @@ -0,0 +1,128 @@ +From 3dca40ad6eb4018dce6af0180a85fb7416f6edd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 16:48:49 +0000 +Subject: net/sched: sch_taprio: fix possible use-after-free + +From: Eric Dumazet + +[ Upstream commit 3a415d59c1dbec9d772dbfab2d2520d98360caae ] + +syzbot reported a nasty crash [1] in net_tx_action() which +made little sense until we got a repro. + +This repro installs a taprio qdisc, but providing an +invalid TCA_RATE attribute. + +qdisc_create() has to destroy the just initialized +taprio qdisc, and taprio_destroy() is called. + +However, the hrtimer used by taprio had already fired, +therefore advance_sched() called __netif_schedule(). + +Then net_tx_action was trying to use a destroyed qdisc. + +We can not undo the __netif_schedule(), so we must wait +until one cpu serviced the qdisc before we can proceed. + +Many thanks to Alexander Potapenko for his help. + +[1] +BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] +BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline] +BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] +BUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 + queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] + do_raw_spin_trylock include/linux/spinlock.h:191 [inline] + __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] + _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 + spin_trylock include/linux/spinlock.h:359 [inline] + qdisc_run_begin include/net/sch_generic.h:187 [inline] + qdisc_run+0xee/0x540 include/net/pkt_sched.h:125 + net_tx_action+0x77c/0x9a0 net/core/dev.c:5086 + __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 + run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934 + smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164 + kthread+0x31b/0x430 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:732 [inline] + slab_alloc_node mm/slub.c:3258 [inline] + __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970 + kmalloc_reserve net/core/skbuff.c:358 [inline] + __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430 + alloc_skb include/linux/skbuff.h:1257 [inline] + nlmsg_new include/net/netlink.h:953 [inline] + netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436 + netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507 + rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:6108 + netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] + netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 + netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg net/socket.c:734 [inline] + ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 + ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536 + __sys_sendmsg net/socket.c:2565 [inline] + __do_sys_sendmsg net/socket.c:2574 [inline] + __se_sys_sendmsg net/socket.c:2572 [inline] + __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 + +Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Alexander Potapenko +Cc: Vinicius Costa Gomes +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sch_generic.h | 7 +++++++ + net/sched/sch_taprio.c | 3 +++ + 2 files changed, 10 insertions(+) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index d5517719af4e..af4aa66aaa4e 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -1288,4 +1288,11 @@ void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx); + + int sch_frag_xmit_hook(struct sk_buff *skb, int (*xmit)(struct sk_buff *skb)); + ++/* Make sure qdisc is no longer in SCHED state. */ ++static inline void qdisc_synchronize(const struct Qdisc *q) ++{ ++ while (test_bit(__QDISC_STATE_SCHED, &q->state)) ++ msleep(1); ++} ++ + #endif +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 570389f6cdd7..9a11a499ea2d 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1700,6 +1700,8 @@ static void taprio_reset(struct Qdisc *sch) + int i; + + hrtimer_cancel(&q->advance_timer); ++ qdisc_synchronize(sch); ++ + if (q->qdiscs) { + for (i = 0; i < dev->num_tx_queues; i++) + if (q->qdiscs[i]) +@@ -1720,6 +1722,7 @@ static void taprio_destroy(struct Qdisc *sch) + * happens in qdisc_create(), after taprio_init() has been called. + */ + hrtimer_cancel(&q->advance_timer); ++ qdisc_synchronize(sch); + + taprio_disable_offload(dev, q, NULL); + +-- +2.39.0 + diff --git a/queue-6.1/net-stmmac-enable-all-safety-features-by-default.patch b/queue-6.1/net-stmmac-enable-all-safety-features-by-default.patch new file mode 100644 index 00000000000..63b06d1daeb --- /dev/null +++ b/queue-6.1/net-stmmac-enable-all-safety-features-by-default.patch @@ -0,0 +1,98 @@ +From dad3192009ab9a8c9d31a0b911edc812331be764 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:56:38 -0600 +Subject: net: stmmac: enable all safety features by default + +From: Andrew Halaney + +[ Upstream commit fdfc76a116b5e9d3e98e6c96fe83b42d011d21d4 ] + +In the original implementation of dwmac5 +commit 8bf993a5877e ("net: stmmac: Add support for DWMAC5 and implement Safety Features") +all safety features were enabled by default. + +Later it seems some implementations didn't have support for all the +features, so in +commit 5ac712dcdfef ("net: stmmac: enable platform specific safety features") +the safety_feat_cfg structure was added to the callback and defined for +some platforms to selectively enable these safety features. + +The problem is that only certain platforms were given that software +support. If the automotive safety package bit is set in the hardware +features register the safety feature callback is called for the platform, +and for platforms that didn't get a safety_feat_cfg defined this results +in the following NULL pointer dereference: + +[ 7.933303] Call trace: +[ 7.935812] dwmac5_safety_feat_config+0x20/0x170 [stmmac] +[ 7.941455] __stmmac_open+0x16c/0x474 [stmmac] +[ 7.946117] stmmac_open+0x38/0x70 [stmmac] +[ 7.950414] __dev_open+0x100/0x1dc +[ 7.954006] __dev_change_flags+0x18c/0x204 +[ 7.958297] dev_change_flags+0x24/0x6c +[ 7.962237] do_setlink+0x2b8/0xfa4 +[ 7.965827] __rtnl_newlink+0x4ec/0x840 +[ 7.969766] rtnl_newlink+0x50/0x80 +[ 7.973353] rtnetlink_rcv_msg+0x12c/0x374 +[ 7.977557] netlink_rcv_skb+0x5c/0x130 +[ 7.981500] rtnetlink_rcv+0x18/0x2c +[ 7.985172] netlink_unicast+0x2e8/0x340 +[ 7.989197] netlink_sendmsg+0x1a8/0x420 +[ 7.993222] ____sys_sendmsg+0x218/0x280 +[ 7.997249] ___sys_sendmsg+0xac/0x100 +[ 8.001103] __sys_sendmsg+0x84/0xe0 +[ 8.004776] __arm64_sys_sendmsg+0x24/0x30 +[ 8.008983] invoke_syscall+0x48/0x114 +[ 8.012840] el0_svc_common.constprop.0+0xcc/0xec +[ 8.017665] do_el0_svc+0x38/0xb0 +[ 8.021071] el0_svc+0x2c/0x84 +[ 8.024212] el0t_64_sync_handler+0xf4/0x120 +[ 8.028598] el0t_64_sync+0x190/0x194 + +Go back to the original behavior, if the automotive safety package +is found to be supported in hardware enable all the features unless +safety_feat_cfg is passed in saying this particular platform only +supports a subset of the features. + +Fixes: 5ac712dcdfef ("net: stmmac: enable platform specific safety features") +Reported-by: Ning Cai +Signed-off-by: Andrew Halaney +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +index 9c2d40f853ed..413f66017219 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c +@@ -186,11 +186,25 @@ static void dwmac5_handle_dma_err(struct net_device *ndev, + int dwmac5_safety_feat_config(void __iomem *ioaddr, unsigned int asp, + struct stmmac_safety_feature_cfg *safety_feat_cfg) + { ++ struct stmmac_safety_feature_cfg all_safety_feats = { ++ .tsoee = 1, ++ .mrxpee = 1, ++ .mestee = 1, ++ .mrxee = 1, ++ .mtxee = 1, ++ .epsi = 1, ++ .edpp = 1, ++ .prtyen = 1, ++ .tmouten = 1, ++ }; + u32 value; + + if (!asp) + return -EINVAL; + ++ if (!safety_feat_cfg) ++ safety_feat_cfg = &all_safety_feats; ++ + /* 1. Enable Safety Features */ + value = readl(ioaddr + MTL_ECC_CONTROL); + value |= MEEAO; /* MTL ECC Error Addr Status Override */ +-- +2.39.0 + diff --git a/queue-6.1/net-stmmac-fix-invalid-call-to-mdiobus_get_phy.patch b/queue-6.1/net-stmmac-fix-invalid-call-to-mdiobus_get_phy.patch new file mode 100644 index 00000000000..ed2f224dc03 --- /dev/null +++ b/queue-6.1/net-stmmac-fix-invalid-call-to-mdiobus_get_phy.patch @@ -0,0 +1,42 @@ +From c3d0d318ec4caae5a7ae7d2338d450ea1892ae44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Jan 2023 18:24:08 +0100 +Subject: net: stmmac: fix invalid call to mdiobus_get_phy() + +From: Heiner Kallweit + +[ Upstream commit 1f3bd64ad921f051254591fbed04fd30b306cde6 ] + +In a number of cases the driver assigns a default value of -1 to +priv->plat->phy_addr. This may result in calling mdiobus_get_phy() +with addr parameter being -1. Therefore check for this scenario and +bail out before calling mdiobus_get_phy(). + +Fixes: 42e87024f727 ("net: stmmac: Fix case when PHY handle is not present") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/669f9671-ecd1-a41b-2727-7b73e3003985@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index feb209d4b991..4bba0444c764 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1148,6 +1148,11 @@ static int stmmac_init_phy(struct net_device *dev) + int addr = priv->plat->phy_addr; + struct phy_device *phydev; + ++ if (addr < 0) { ++ netdev_err(priv->dev, "no phy found\n"); ++ return -ENODEV; ++ } ++ + phydev = mdiobus_get_phy(priv->mii, addr); + if (!phydev) { + netdev_err(priv->dev, "no phy at addr %d\n", addr); +-- +2.39.0 + diff --git a/queue-6.1/net-stmmac-fix-queue-statistics-reading.patch b/queue-6.1/net-stmmac-fix-queue-statistics-reading.patch new file mode 100644 index 00000000000..7b0b4940b22 --- /dev/null +++ b/queue-6.1/net-stmmac-fix-queue-statistics-reading.patch @@ -0,0 +1,70 @@ +From 3144fa5e22f2cc0fb775e4843ad3a3c745e6f623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 13:04:37 +0100 +Subject: net: stmmac: Fix queue statistics reading + +From: Kurt Kanzenbach + +[ Upstream commit c296c77efb66994d94d9f706446a115581226550 ] + +Correct queue statistics reading. All queue statistics are stored as unsigned +long values. The retrieval for ethtool fetches these values as u64. However, on +some systems the size of the counters are 32 bit. That yields wrong queue +statistic counters e.g., on arm32 systems such as the stm32mp157. Fix it by +using the correct data type. + +Tested on Olimex STMP157-OLinuXino-LIME2 by simple running linuxptp for a short +period of time: + +Non-patched kernel: +|root@st1:~# ethtool -S eth0 | grep q0 +| q0_tx_pkt_n: 3775276254951 # ??? +| q0_tx_irq_n: 879 +| q0_rx_pkt_n: 1194000908909 # ??? +| q0_rx_irq_n: 278 + +Patched kernel: +|root@st1:~# ethtool -S eth0 | grep q0 +| q0_tx_pkt_n: 2434 +| q0_tx_irq_n: 1274 +| q0_rx_pkt_n: 1604 +| q0_rx_irq_n: 846 + +Fixes: 68e9c5dee1cf ("net: stmmac: add ethtool per-queue statistic framework") +Signed-off-by: Kurt Kanzenbach +Cc: Vijayakannan Ayyathurai +Cc: Wong Vee Khee +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +index f453b0d09366..35c8dd92d369 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +@@ -551,16 +551,16 @@ static void stmmac_get_per_qstats(struct stmmac_priv *priv, u64 *data) + p = (char *)priv + offsetof(struct stmmac_priv, + xstats.txq_stats[q].tx_pkt_n); + for (stat = 0; stat < STMMAC_TXQ_STATS; stat++) { +- *data++ = (*(u64 *)p); +- p += sizeof(u64 *); ++ *data++ = (*(unsigned long *)p); ++ p += sizeof(unsigned long); + } + } + for (q = 0; q < rx_cnt; q++) { + p = (char *)priv + offsetof(struct stmmac_priv, + xstats.rxq_stats[q].rx_pkt_n); + for (stat = 0; stat < STMMAC_RXQ_STATS; stat++) { +- *data++ = (*(u64 *)p); +- p += sizeof(u64 *); ++ *data++ = (*(unsigned long *)p); ++ p += sizeof(unsigned long); + } + } + } +-- +2.39.0 + diff --git a/queue-6.1/net-usb-cdc_ether-add-support-for-thales-cinterion-p.patch b/queue-6.1/net-usb-cdc_ether-add-support-for-thales-cinterion-p.patch new file mode 100644 index 00000000000..cae3cdbbdf8 --- /dev/null +++ b/queue-6.1/net-usb-cdc_ether-add-support-for-thales-cinterion-p.patch @@ -0,0 +1,55 @@ +From bae64c8360bf4be6372b1c59a5bc2c91f6428f1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 11:42:49 +0800 +Subject: net: usb: cdc_ether: add support for Thales Cinterion PLS62-W modem + +From: Hui Wang + +[ Upstream commit eea8ce81fbb544e3caad1a1c876ba1af467b3d3c ] + +This modem has 7 interfaces, 5 of them are serial interfaces and are +driven by cdc_acm, while 2 of them are wwan interfaces and are driven +by cdc_ether: +If 0: Abstract (modem) +If 1: Abstract (modem) +If 2: Abstract (modem) +If 3: Abstract (modem) +If 4: Abstract (modem) +If 5: Ethernet Networking +If 6: Ethernet Networking + +Without this change, the 2 network interfaces will be named to usb0 +and usb1, our QA think the names are confusing and filed a bug on it. + +After applying this change, the name will be wwan0 and wwan1, and +they could work well with modem manager. + +Signed-off-by: Hui Wang +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20230105034249.10433-1-hui.wang@canonical.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/cdc_ether.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c +index e11f70911acc..fb5f59d0d55d 100644 +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -1001,6 +1001,12 @@ static const struct usb_device_id products[] = { + USB_CDC_SUBCLASS_ETHERNET, + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&wwan_info, ++}, { ++ /* Cinterion PLS62-W modem by GEMALTO/THALES */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x1e2d, 0x005b, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_ETHERNET, ++ USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&wwan_info, + }, { + /* Cinterion PLS83/PLS63 modem by GEMALTO/THALES */ + USB_DEVICE_AND_INTERFACE_INFO(0x1e2d, 0x0069, USB_CLASS_COMM, +-- +2.39.0 + diff --git a/queue-6.1/net-usb-sr9700-handle-negative-len.patch b/queue-6.1/net-usb-sr9700-handle-negative-len.patch new file mode 100644 index 00000000000..7b7a7ca012a --- /dev/null +++ b/queue-6.1/net-usb-sr9700-handle-negative-len.patch @@ -0,0 +1,41 @@ +From d104ea3bc2beaed697c2635d9273f009065a8be5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 19:23:26 +0100 +Subject: net: usb: sr9700: Handle negative len + +From: Szymon Heidrich + +[ Upstream commit ecf7cf8efb59789e2b21d2f9ab926142579092b2 ] + +Packet len computed as difference of length word extracted from +skb data and four may result in a negative value. In such case +processing of the buffer should be interrupted rather than +setting sr_skb->len to an unexpectedly large value (due to cast +from signed to unsigned integer) and passing sr_skb to +usbnet_skb_return. + +Fixes: e9da0b56fe27 ("sr9700: sanity check for packet length") +Signed-off-by: Szymon Heidrich +Link: https://lore.kernel.org/r/20230114182326.30479-1-szymon.heidrich@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/sr9700.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index 5a53e63d33a6..3164451e1010 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -413,7 +413,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + /* ignore the CRC length */ + len = (skb->data[1] | (skb->data[2] << 8)) - 4; + +- if (len > ETH_FRAME_LEN || len > skb->len) ++ if (len > ETH_FRAME_LEN || len > skb->len || len < 0) + return 0; + + /* the last packet of current skb */ +-- +2.39.0 + diff --git a/queue-6.1/net-wan-add-checks-for-null-for-utdm-in-undo_uhdlc_i.patch b/queue-6.1/net-wan-add-checks-for-null-for-utdm-in-undo_uhdlc_i.patch new file mode 100644 index 00000000000..d4fd624df37 --- /dev/null +++ b/queue-6.1/net-wan-add-checks-for-null-for-utdm-in-undo_uhdlc_i.patch @@ -0,0 +1,47 @@ +From 85835de8f26594d621051ba55a0985aa120055b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 10:47:03 +0300 +Subject: net: wan: Add checks for NULL for utdm in undo_uhdlc_init and + unmap_si_regs + +From: Esina Ekaterina + +[ Upstream commit 488e0bf7f34af3d42d1d5e56f7a5a7beaff188a3 ] + +If uhdlc_priv_tsa != 1 then utdm is not initialized. +And if ret != NULL then goto undo_uhdlc_init, where +utdm is dereferenced. Same if dev == NULL. + +Found by Astra Linux on behalf of Linux Verification Center +(linuxtesting.org) with SVACE. + +Fixes: 8d68100ab4ad ("soc/fsl/qe: fix err handling of ucc_of_parse_tdm") +Signed-off-by: Esina Ekaterina +Link: https://lore.kernel.org/r/20230112074703.13558-1-eesina@astralinux.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wan/fsl_ucc_hdlc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c +index 22edea6ca4b8..1c53b5546927 100644 +--- a/drivers/net/wan/fsl_ucc_hdlc.c ++++ b/drivers/net/wan/fsl_ucc_hdlc.c +@@ -1243,9 +1243,11 @@ static int ucc_hdlc_probe(struct platform_device *pdev) + free_dev: + free_netdev(dev); + undo_uhdlc_init: +- iounmap(utdm->siram); ++ if (utdm) ++ iounmap(utdm->siram); + unmap_si_regs: +- iounmap(utdm->si_regs); ++ if (utdm) ++ iounmap(utdm->si_regs); + free_utdm: + if (uhdlc_priv->tsa) + kfree(utdm); +-- +2.39.0 + diff --git a/queue-6.1/netfilter-conntrack-handle-tcp-challenge-acks-during.patch b/queue-6.1/netfilter-conntrack-handle-tcp-challenge-acks-during.patch new file mode 100644 index 00000000000..69054431f7a --- /dev/null +++ b/queue-6.1/netfilter-conntrack-handle-tcp-challenge-acks-during.patch @@ -0,0 +1,77 @@ +From f74f6fc209cbcd83b8709682d892727b9f26287b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 14:42:32 +0100 +Subject: netfilter: conntrack: handle tcp challenge acks during connection + reuse + +From: Florian Westphal + +[ Upstream commit c410cb974f2ba562920ecb8492ee66945dcf88af ] + +When a connection is re-used, following can happen: +[ connection starts to close, fin sent in either direction ] + > syn # initator quickly reuses connection + < ack # peer sends a challenge ack + > rst # rst, sequence number == ack_seq of previous challenge ack + > syn # this syn is expected to pass + +Problem is that the rst will fail window validation, so it gets +tagged as invalid. + +If ruleset drops such packets, we get repeated syn-retransmits until +initator gives up or peer starts responding with syn/ack. + +Before the commit indicated in the "Fixes" tag below this used to work: + +The challenge-ack made conntrack re-init state based on the challenge +ack itself, so the following rst would pass window validation. + +Add challenge-ack support: If we get ack for syn, record the ack_seq, +and then check if the rst sequence number matches the last ack number +seen in reverse direction. + +Fixes: c7aab4f17021 ("netfilter: nf_conntrack_tcp: re-init for syn packets only") +Reported-by: Michal Tesar +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_tcp.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 656631083177..3ac1af6f59fc 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -1068,6 +1068,13 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + ct->proto.tcp.last_flags |= + IP_CT_EXP_CHALLENGE_ACK; + } ++ ++ /* possible challenge ack reply to syn */ ++ if (old_state == TCP_CONNTRACK_SYN_SENT && ++ index == TCP_ACK_SET && ++ dir == IP_CT_DIR_REPLY) ++ ct->proto.tcp.last_ack = ntohl(th->ack_seq); ++ + spin_unlock_bh(&ct->lock); + nf_ct_l4proto_log_invalid(skb, ct, state, + "packet (index %d) in dir %d ignored, state %s", +@@ -1193,6 +1200,14 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + * segments we ignored. */ + goto in_window; + } ++ ++ /* Reset in response to a challenge-ack we let through earlier */ ++ if (old_state == TCP_CONNTRACK_SYN_SENT && ++ ct->proto.tcp.last_index == TCP_ACK_SET && ++ ct->proto.tcp.last_dir == IP_CT_DIR_REPLY && ++ ntohl(th->seq) == ct->proto.tcp.last_ack) ++ goto in_window; ++ + break; + default: + /* Keep compilers happy. */ +-- +2.39.0 + diff --git a/queue-6.1/nfsd-fix-use-after-free-in-nfsd4_ssc_setup_dul.patch b/queue-6.1/nfsd-fix-use-after-free-in-nfsd4_ssc_setup_dul.patch new file mode 100644 index 00000000000..4b1e6fe1f4c --- /dev/null +++ b/queue-6.1/nfsd-fix-use-after-free-in-nfsd4_ssc_setup_dul.patch @@ -0,0 +1,38 @@ +From 1488c5b24238d4eff246d34ad82770bd618eff95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 00:24:53 +0800 +Subject: NFSD: fix use-after-free in nfsd4_ssc_setup_dul() + +From: Xingyuan Mo + +[ Upstream commit e6cf91b7b47ff82b624bdfe2fdcde32bb52e71dd ] + +If signal_pending() returns true, schedule_timeout() will not be executed, +causing the waiting task to remain in the wait queue. +Fixed by adding a call to finish_wait(), which ensures that the waiting +task will always be removed from the wait queue. + +Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.") +Signed-off-by: Xingyuan Mo +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4proc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 30a08ec31a70..ba04ce9b9fa5 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1331,6 +1331,7 @@ static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr, + /* allow 20secs for mount/unmount for now - revisit */ + if (signal_pending(current) || + (schedule_timeout(20*HZ) == 0)) { ++ finish_wait(&nn->nfsd_ssc_waitq, &wait); + kfree(work); + return nfserr_eagain; + } +-- +2.39.0 + diff --git a/queue-6.1/nolibc-fix-fd_set-type.patch b/queue-6.1/nolibc-fix-fd_set-type.patch new file mode 100644 index 00000000000..918249fd1ab --- /dev/null +++ b/queue-6.1/nolibc-fix-fd_set-type.patch @@ -0,0 +1,99 @@ +From 07422e1fb57fd22b223bd02eb05cbb84665d4745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 08:54:37 +0100 +Subject: nolibc: fix fd_set type + +From: Sven Schnelle + +[ Upstream commit feaf75658783a919410f8c2039dbc24b6a29603d ] + +The kernel uses unsigned long for the fd_set bitmap, +but nolibc use u32. This works fine on little endian +machines, but fails on big endian. Convert to unsigned +long to fix this. + +Signed-off-by: Sven Schnelle +Signed-off-by: Willy Tarreau +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/types.h | 53 ++++++++++++++++++++---------------- + 1 file changed, 30 insertions(+), 23 deletions(-) + +diff --git a/tools/include/nolibc/types.h b/tools/include/nolibc/types.h +index 959997034e55..300e0ff1cd58 100644 +--- a/tools/include/nolibc/types.h ++++ b/tools/include/nolibc/types.h +@@ -89,39 +89,46 @@ + #define EXIT_SUCCESS 0 + #define EXIT_FAILURE 1 + ++#define FD_SETIDXMASK (8 * sizeof(unsigned long)) ++#define FD_SETBITMASK (8 * sizeof(unsigned long)-1) ++ + /* for select() */ + typedef struct { +- uint32_t fd32[(FD_SETSIZE + 31) / 32]; ++ unsigned long fds[(FD_SETSIZE + FD_SETBITMASK) / FD_SETIDXMASK]; + } fd_set; + +-#define FD_CLR(fd, set) do { \ +- fd_set *__set = (set); \ +- int __fd = (fd); \ +- if (__fd >= 0) \ +- __set->fd32[__fd / 32] &= ~(1U << (__fd & 31)); \ ++#define FD_CLR(fd, set) do { \ ++ fd_set *__set = (set); \ ++ int __fd = (fd); \ ++ if (__fd >= 0) \ ++ __set->fds[__fd / FD_SETIDXMASK] &= \ ++ ~(1U << (__fd & FX_SETBITMASK)); \ + } while (0) + +-#define FD_SET(fd, set) do { \ +- fd_set *__set = (set); \ +- int __fd = (fd); \ +- if (__fd >= 0) \ +- __set->fd32[__fd / 32] |= 1U << (__fd & 31); \ ++#define FD_SET(fd, set) do { \ ++ fd_set *__set = (set); \ ++ int __fd = (fd); \ ++ if (__fd >= 0) \ ++ __set->fds[__fd / FD_SETIDXMASK] |= \ ++ 1 << (__fd & FD_SETBITMASK); \ + } while (0) + +-#define FD_ISSET(fd, set) ({ \ +- fd_set *__set = (set); \ +- int __fd = (fd); \ +- int __r = 0; \ +- if (__fd >= 0) \ +- __r = !!(__set->fd32[__fd / 32] & 1U << (__fd & 31)); \ +- __r; \ ++#define FD_ISSET(fd, set) ({ \ ++ fd_set *__set = (set); \ ++ int __fd = (fd); \ ++ int __r = 0; \ ++ if (__fd >= 0) \ ++ __r = !!(__set->fds[__fd / FD_SETIDXMASK] & \ ++1U << (__fd & FD_SET_BITMASK)); \ ++ __r; \ + }) + +-#define FD_ZERO(set) do { \ +- fd_set *__set = (set); \ +- int __idx; \ +- for (__idx = 0; __idx < (FD_SETSIZE+31) / 32; __idx ++) \ +- __set->fd32[__idx] = 0; \ ++#define FD_ZERO(set) do { \ ++ fd_set *__set = (set); \ ++ int __idx; \ ++ int __size = (FD_SETSIZE+FD_SETBITMASK) / FD_SETIDXMASK;\ ++ for (__idx = 0; __idx < __size; __idx++) \ ++ __set->fds[__idx] = 0; \ + } while (0) + + /* for poll() */ +-- +2.39.0 + diff --git a/queue-6.1/nvme-pci-fix-timeout-request-state-check.patch b/queue-6.1/nvme-pci-fix-timeout-request-state-check.patch new file mode 100644 index 00000000000..d2e2e99d396 --- /dev/null +++ b/queue-6.1/nvme-pci-fix-timeout-request-state-check.patch @@ -0,0 +1,42 @@ +From c2438c043ec31d3c47b08eb73f8de15af272552b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 08:44:16 -0800 +Subject: nvme-pci: fix timeout request state check + +From: Keith Busch + +[ Upstream commit 1c5842085851f786eba24a39ecd02650ad892064 ] + +Polling the completion can progress the request state to IDLE, either +inline with the completion, or through softirq. Either way, the state +may not be COMPLETED, so don't check for that. We only care if the state +isn't IN_FLIGHT. + +This is fixing an issue where the driver aborts an IO that we just +completed. Seeing the "aborting" message instead of "polled" is very +misleading as to where the timeout problem resides. + +Fixes: bf392a5dc02a9b ("nvme-pci: Remove tag from process cq") +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 115d81def567..e2de5d0de5d9 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1367,7 +1367,7 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req) + else + nvme_poll_irqdisable(nvmeq); + +- if (blk_mq_request_completed(req)) { ++ if (blk_mq_rq_state(req) != MQ_RQ_IN_FLIGHT) { + dev_warn(dev->ctrl.device, + "I/O %d QID %d timeout, completion polled\n", + req->tag, nvmeq->qid); +-- +2.39.0 + diff --git a/queue-6.1/octeontx2-pf-avoid-use-of-gfp_kernel-in-atomic-conte.patch b/queue-6.1/octeontx2-pf-avoid-use-of-gfp_kernel-in-atomic-conte.patch new file mode 100644 index 00000000000..8d2fb55d67f --- /dev/null +++ b/queue-6.1/octeontx2-pf-avoid-use-of-gfp_kernel-in-atomic-conte.patch @@ -0,0 +1,60 @@ +From d366cbc9a334230069f6d86432f10546a6b7bf12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 11:49:02 +0530 +Subject: octeontx2-pf: Avoid use of GFP_KERNEL in atomic context + +From: Geetha sowjanya + +[ Upstream commit 87b93b678e95c7d93fe6a55b0e0fbda26d8c7760 ] + +Using GFP_KERNEL in preemption disable context, causing below warning +when CONFIG_DEBUG_ATOMIC_SLEEP is enabled. + +[ 32.542271] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 +[ 32.550883] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 +[ 32.558707] preempt_count: 1, expected: 0 +[ 32.562710] RCU nest depth: 0, expected: 0 +[ 32.566800] CPU: 3 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc2-00269-gae9dcb91c606 #7 +[ 32.576188] Hardware name: Marvell CN106XX board (DT) +[ 32.581232] Call trace: +[ 32.583670] dump_backtrace.part.0+0xe0/0xf0 +[ 32.587937] show_stack+0x18/0x30 +[ 32.591245] dump_stack_lvl+0x68/0x84 +[ 32.594900] dump_stack+0x18/0x34 +[ 32.598206] __might_resched+0x12c/0x160 +[ 32.602122] __might_sleep+0x48/0xa0 +[ 32.605689] __kmem_cache_alloc_node+0x2b8/0x2e0 +[ 32.610301] __kmalloc+0x58/0x190 +[ 32.613610] otx2_sq_aura_pool_init+0x1a8/0x314 +[ 32.618134] otx2_open+0x1d4/0x9d0 + +To avoid use of GFP_ATOMIC for memory allocation, disable preemption +after all memory allocation is done. + +Fixes: 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free") +Signed-off-by: Geetha sowjanya +Signed-off-by: Sunil Kovvuri Goutham +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index 8a41ad8ca04f..48924e153bb8 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -1385,7 +1385,9 @@ int otx2_sq_aura_pool_init(struct otx2_nic *pfvf) + err = otx2_alloc_rbuf(pfvf, pool, &bufptr); + if (err) + goto err_mem; ++ get_cpu(); + pfvf->hw_ops->aura_freeptr(pfvf, pool_id, bufptr); ++ put_cpu(); + sq->sqb_ptrs[sq->sqb_count++] = (u64)bufptr; + } + } +-- +2.39.0 + diff --git a/queue-6.1/octeontx2-pf-fix-the-use-of-gfp_kernel-in-atomic-con.patch b/queue-6.1/octeontx2-pf-fix-the-use-of-gfp_kernel-in-atomic-con.patch new file mode 100644 index 00000000000..5088e6a2839 --- /dev/null +++ b/queue-6.1/octeontx2-pf-fix-the-use-of-gfp_kernel-in-atomic-con.patch @@ -0,0 +1,91 @@ +From 0443b3fbb7fe97333659ae137d42f9794ab10ca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 15:13:00 +0800 +Subject: octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt + +From: Kevin Hao + +[ Upstream commit 55ba18dc62deff5910c0fa64486dea1ff20832ff ] + +The commit 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura +free") uses the get/put_cpu() to protect the usage of percpu pointer +in ->aura_freeptr() callback, but it also unnecessarily disable the +preemption for the blockable memory allocation. The commit 87b93b678e95 +("octeontx2-pf: Avoid use of GFP_KERNEL in atomic context") tried to +fix these sleep inside atomic warnings. But it only fix the one for +the non-rt kernel. For the rt kernel, we still get the similar warnings +like below. + BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 + preempt_count: 1, expected: 0 + RCU nest depth: 0, expected: 0 + 3 locks held by swapper/0/1: + #0: ffff800009fc5fe8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x24/0x30 + #1: ffff000100c276c0 (&mbox->lock){+.+.}-{3:3}, at: otx2_init_hw_resources+0x8c/0x3a4 + #2: ffffffbfef6537e0 (&cpu_rcache->lock){+.+.}-{2:2}, at: alloc_iova_fast+0x1ac/0x2ac + Preemption disabled at: + [] otx2_rq_aura_pool_init+0x14c/0x284 + CPU: 20 PID: 1 Comm: swapper/0 Tainted: G W 6.2.0-rc3-rt1-yocto-preempt-rt #1 + Hardware name: Marvell OcteonTX CN96XX board (DT) + Call trace: + dump_backtrace.part.0+0xe8/0xf4 + show_stack+0x20/0x30 + dump_stack_lvl+0x9c/0xd8 + dump_stack+0x18/0x34 + __might_resched+0x188/0x224 + rt_spin_lock+0x64/0x110 + alloc_iova_fast+0x1ac/0x2ac + iommu_dma_alloc_iova+0xd4/0x110 + __iommu_dma_map+0x80/0x144 + iommu_dma_map_page+0xe8/0x260 + dma_map_page_attrs+0xb4/0xc0 + __otx2_alloc_rbuf+0x90/0x150 + otx2_rq_aura_pool_init+0x1c8/0x284 + otx2_init_hw_resources+0xe4/0x3a4 + otx2_open+0xf0/0x610 + __dev_open+0x104/0x224 + __dev_change_flags+0x1e4/0x274 + dev_change_flags+0x2c/0x7c + ic_open_devs+0x124/0x2f8 + ip_auto_config+0x180/0x42c + do_one_initcall+0x90/0x4dc + do_basic_setup+0x10c/0x14c + kernel_init_freeable+0x10c/0x13c + kernel_init+0x2c/0x140 + ret_from_fork+0x10/0x20 + +Of course, we can shuffle the get/put_cpu() to only wrap the invocation +of ->aura_freeptr() as what commit 87b93b678e95 does. But there are only +two ->aura_freeptr() callbacks, otx2_aura_freeptr() and +cn10k_aura_freeptr(). There is no usage of perpcu variable in the +otx2_aura_freeptr() at all, so the get/put_cpu() seems redundant to it. +We can move the get/put_cpu() into the corresponding callback which +really has the percpu variable usage and avoid the sprinkling of +get/put_cpu() in several places. + +Fixes: 4af1b64f80fb ("octeontx2-pf: Fix lmtst ID used in aura free") +Signed-off-by: Kevin Hao +Link: https://lore.kernel.org/r/20230118071300.3271125-1-haokexin@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +index 48924e153bb8..8a41ad8ca04f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c +@@ -1385,9 +1385,7 @@ int otx2_sq_aura_pool_init(struct otx2_nic *pfvf) + err = otx2_alloc_rbuf(pfvf, pool, &bufptr); + if (err) + goto err_mem; +- get_cpu(); + pfvf->hw_ops->aura_freeptr(pfvf, pool_id, bufptr); +- put_cpu(); + sq->sqb_ptrs[sq->sqb_count++] = (u64)bufptr; + } + } +-- +2.39.0 + diff --git a/queue-6.1/perf-x86-cstate-add-meteor-lake-support.patch b/queue-6.1/perf-x86-cstate-add-meteor-lake-support.patch new file mode 100644 index 00000000000..04b0add3143 --- /dev/null +++ b/queue-6.1/perf-x86-cstate-add-meteor-lake-support.patch @@ -0,0 +1,109 @@ +From 260d70ab6592151373d6022297445445ea6e9211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 12:13:46 -0800 +Subject: perf/x86/cstate: Add Meteor Lake support + +From: Kan Liang + +[ Upstream commit 01f2ea5bcf89dbd7a6530dbce7f2fb4e327e7006 ] + +Meteor Lake is Intel's successor to Raptor lake. From the perspective of +Intel cstate residency counters, there is nothing changed compared with +Raptor lake. + +Share adl_cstates with Raptor lake. +Update the comments for Meteor Lake. + +Signed-off-by: Kan Liang +Signed-off-by: Ingo Molnar +Reviewed-by: Andi Kleen +Link: https://lore.kernel.org/r/20230104201349.1451191-6-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/cstate.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index a2834bc93149..3019fb1926e3 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -41,6 +41,7 @@ + * MSR_CORE_C1_RES: CORE C1 Residency Counter + * perf code: 0x00 + * Available model: SLM,AMT,GLM,CNL,ICX,TNT,ADL,RPL ++ * MTL + * Scope: Core (each processor core has a MSR) + * MSR_CORE_C3_RESIDENCY: CORE C3 Residency Counter + * perf code: 0x01 +@@ -51,50 +52,50 @@ + * perf code: 0x02 + * Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW, + * SKL,KNL,GLM,CNL,KBL,CML,ICL,ICX, +- * TGL,TNT,RKL,ADL,RPL,SPR ++ * TGL,TNT,RKL,ADL,RPL,SPR,MTL + * Scope: Core + * MSR_CORE_C7_RESIDENCY: CORE C7 Residency Counter + * perf code: 0x03 + * Available model: SNB,IVB,HSW,BDW,SKL,CNL,KBL,CML, +- * ICL,TGL,RKL,ADL,RPL ++ * ICL,TGL,RKL,ADL,RPL,MTL + * Scope: Core + * MSR_PKG_C2_RESIDENCY: Package C2 Residency Counter. + * perf code: 0x00 + * Available model: SNB,IVB,HSW,BDW,SKL,KNL,GLM,CNL, + * KBL,CML,ICL,ICX,TGL,TNT,RKL,ADL, +- * RPL,SPR ++ * RPL,SPR,MTL + * Scope: Package (physical package) + * MSR_PKG_C3_RESIDENCY: Package C3 Residency Counter. + * perf code: 0x01 + * Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,KNL, + * GLM,CNL,KBL,CML,ICL,TGL,TNT,RKL, +- * ADL,RPL ++ * ADL,RPL,MTL + * Scope: Package (physical package) + * MSR_PKG_C6_RESIDENCY: Package C6 Residency Counter. + * perf code: 0x02 + * Available model: SLM,AMT,NHM,WSM,SNB,IVB,HSW,BDW, + * SKL,KNL,GLM,CNL,KBL,CML,ICL,ICX, +- * TGL,TNT,RKL,ADL,RPL,SPR ++ * TGL,TNT,RKL,ADL,RPL,SPR,MTL + * Scope: Package (physical package) + * MSR_PKG_C7_RESIDENCY: Package C7 Residency Counter. + * perf code: 0x03 + * Available model: NHM,WSM,SNB,IVB,HSW,BDW,SKL,CNL, +- * KBL,CML,ICL,TGL,RKL,ADL,RPL ++ * KBL,CML,ICL,TGL,RKL,ADL,RPL,MTL + * Scope: Package (physical package) + * MSR_PKG_C8_RESIDENCY: Package C8 Residency Counter. + * perf code: 0x04 + * Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL, +- * ADL,RPL ++ * ADL,RPL,MTL + * Scope: Package (physical package) + * MSR_PKG_C9_RESIDENCY: Package C9 Residency Counter. + * perf code: 0x05 + * Available model: HSW ULT,KBL,CNL,CML,ICL,TGL,RKL, +- * ADL,RPL ++ * ADL,RPL,MTL + * Scope: Package (physical package) + * MSR_PKG_C10_RESIDENCY: Package C10 Residency Counter. + * perf code: 0x06 + * Available model: HSW ULT,KBL,GLM,CNL,CML,ICL,TGL, +- * TNT,RKL,ADL,RPL ++ * TNT,RKL,ADL,RPL,MTL + * Scope: Package (physical package) + * + */ +@@ -686,6 +687,8 @@ static const struct x86_cpu_id intel_cstates_match[] __initconst = { + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE, &adl_cstates), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &adl_cstates), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &adl_cstates), ++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE, &adl_cstates), ++ X86_MATCH_INTEL_FAM6_MODEL(METEORLAKE_L, &adl_cstates), + { }, + }; + MODULE_DEVICE_TABLE(x86cpu, intel_cstates_match); +-- +2.39.0 + diff --git a/queue-6.1/perf-x86-intel-uncore-add-emerald-rapids.patch b/queue-6.1/perf-x86-intel-uncore-add-emerald-rapids.patch new file mode 100644 index 00000000000..bbea8124d5f --- /dev/null +++ b/queue-6.1/perf-x86-intel-uncore-add-emerald-rapids.patch @@ -0,0 +1,36 @@ +From aa7a33ac86125ac648c0645b66e1c0a00b119370 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 08:04:49 -0800 +Subject: perf/x86/intel/uncore: Add Emerald Rapids + +From: Kan Liang + +[ Upstream commit 5268a2842066c227e6ccd94bac562f1e1000244f ] + +From the perspective of the uncore PMU, the new Emerald Rapids is the +same as the Sapphire Rapids. The only difference is the event list, +which will be supported in the perf tool later. + +Signed-off-by: Kan Liang +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230106160449.3566477-4-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/uncore.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c +index 6f1ccc57a692..459b1aafd4d4 100644 +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -1833,6 +1833,7 @@ static const struct x86_cpu_id intel_uncore_match[] __initconst = { + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &adl_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &adl_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(SAPPHIRERAPIDS_X, &spr_uncore_init), ++ X86_MATCH_INTEL_FAM6_MODEL(EMERALDRAPIDS_X, &spr_uncore_init), + X86_MATCH_INTEL_FAM6_MODEL(ATOM_TREMONT_D, &snr_uncore_init), + {}, + }; +-- +2.39.0 + diff --git a/queue-6.1/perf-x86-msr-add-emerald-rapids.patch b/queue-6.1/perf-x86-msr-add-emerald-rapids.patch new file mode 100644 index 00000000000..292ed956e4a --- /dev/null +++ b/queue-6.1/perf-x86-msr-add-emerald-rapids.patch @@ -0,0 +1,35 @@ +From a9c6c662d0835e9e998ca484187be789d45f2bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 08:04:48 -0800 +Subject: perf/x86/msr: Add Emerald Rapids + +From: Kan Liang + +[ Upstream commit 69ced4160969025821f2999ff92163ed26568f1c ] + +The same as Sapphire Rapids, the SMI_COUNT MSR is also supported on +Emerald Rapids. Add Emerald Rapids model. + +Signed-off-by: Kan Liang +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230106160449.3566477-3-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/msr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c +index 074150d28fa8..c65d8906cbcf 100644 +--- a/arch/x86/events/msr.c ++++ b/arch/x86/events/msr.c +@@ -69,6 +69,7 @@ static bool test_intel(int idx, void *data) + case INTEL_FAM6_BROADWELL_G: + case INTEL_FAM6_BROADWELL_X: + case INTEL_FAM6_SAPPHIRERAPIDS_X: ++ case INTEL_FAM6_EMERALDRAPIDS_X: + + case INTEL_FAM6_ATOM_SILVERMONT: + case INTEL_FAM6_ATOM_SILVERMONT_D: +-- +2.39.0 + diff --git a/queue-6.1/perf-x86-msr-add-meteor-lake-support.patch b/queue-6.1/perf-x86-msr-add-meteor-lake-support.patch new file mode 100644 index 00000000000..5974ab03cc2 --- /dev/null +++ b/queue-6.1/perf-x86-msr-add-meteor-lake-support.patch @@ -0,0 +1,37 @@ +From fb9afabfe242e7924a1eb2c280246eff8e76b497 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 12:13:47 -0800 +Subject: perf/x86/msr: Add Meteor Lake support + +From: Kan Liang + +[ Upstream commit 6887a4d3aede084bf08b70fbc9736c69fce05d7f ] + +Meteor Lake is Intel's successor to Raptor lake. PPERF and SMI_COUNT MSRs +are also supported. + +Signed-off-by: Kan Liang +Signed-off-by: Ingo Molnar +Reviewed-by: Andi Kleen +Link: https://lore.kernel.org/r/20230104201349.1451191-7-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/msr.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c +index ecced3a52668..074150d28fa8 100644 +--- a/arch/x86/events/msr.c ++++ b/arch/x86/events/msr.c +@@ -107,6 +107,8 @@ static bool test_intel(int idx, void *data) + case INTEL_FAM6_RAPTORLAKE: + case INTEL_FAM6_RAPTORLAKE_P: + case INTEL_FAM6_RAPTORLAKE_S: ++ case INTEL_FAM6_METEORLAKE: ++ case INTEL_FAM6_METEORLAKE_L: + if (idx == PERF_MSR_SMI || idx == PERF_MSR_PPERF) + return true; + break; +-- +2.39.0 + diff --git a/queue-6.1/phy-phy-can-transceiver-skip-warning-if-no-max-bitra.patch b/queue-6.1/phy-phy-can-transceiver-skip-warning-if-no-max-bitra.patch new file mode 100644 index 00000000000..c3f4913d41a --- /dev/null +++ b/queue-6.1/phy-phy-can-transceiver-skip-warning-if-no-max-bitra.patch @@ -0,0 +1,48 @@ +From a29bc834a7322ee350467fca5b8d91f697a590e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 11:29:58 +0100 +Subject: phy: phy-can-transceiver: Skip warning if no "max-bitrate" + +From: Geert Uytterhoeven + +[ Upstream commit bc30c15f275484f9b9fe27c2fa0895f3022d9943 ] + +According to the DT bindings, the "max-bitrate" property is optional. +However, when it is not present, a warning is printed. +Fix this by adding a missing check for -EINVAL. + +Fixes: a4a86d273ff1b6f7 ("phy: phy-can-transceiver: Add support for generic CAN transceiver driver") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/88e158f97dd52ebaa7126cd9631f34764b9c0795.1674037334.git.geert+renesas@glider.be +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/phy-can-transceiver.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/phy-can-transceiver.c b/drivers/phy/phy-can-transceiver.c +index 95c6dbb52da7..ce511ad5d369 100644 +--- a/drivers/phy/phy-can-transceiver.c ++++ b/drivers/phy/phy-can-transceiver.c +@@ -99,6 +99,7 @@ static int can_transceiver_phy_probe(struct platform_device *pdev) + struct gpio_desc *standby_gpio; + struct gpio_desc *enable_gpio; + u32 max_bitrate = 0; ++ int err; + + can_transceiver_phy = devm_kzalloc(dev, sizeof(struct can_transceiver_phy), GFP_KERNEL); + if (!can_transceiver_phy) +@@ -124,8 +125,8 @@ static int can_transceiver_phy_probe(struct platform_device *pdev) + return PTR_ERR(phy); + } + +- device_property_read_u32(dev, "max-bitrate", &max_bitrate); +- if (!max_bitrate) ++ err = device_property_read_u32(dev, "max-bitrate", &max_bitrate); ++ if ((err != -EINVAL) && !max_bitrate) + dev_warn(dev, "Invalid value for transceiver max bitrate. Ignoring bitrate limit\n"); + phy->attrs.max_link_rate = max_bitrate; + +-- +2.39.0 + diff --git a/queue-6.1/phy-rockchip-inno-usb2-fix-missing-clk_disable_unpre.patch b/queue-6.1/phy-rockchip-inno-usb2-fix-missing-clk_disable_unpre.patch new file mode 100644 index 00000000000..a83f1a7467d --- /dev/null +++ b/queue-6.1/phy-rockchip-inno-usb2-fix-missing-clk_disable_unpre.patch @@ -0,0 +1,41 @@ +From 324d7ebdbf2530d9525a2aeb5a54eec0cf19e1e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 19:58:23 +0800 +Subject: phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in + rockchip_usb2phy_power_on() + +From: Shang XiaoJing + +[ Upstream commit 5daba914da0e48950e9407ea4d75fa57029c9adc ] + +The clk_disable_unprepare() should be called in the error handling of +rockchip_usb2phy_power_on(). + +Fixes: 0e08d2a727e6 ("phy: rockchip-inno-usb2: add a new driver for Rockchip usb2phy") +Signed-off-by: Shang XiaoJing +Link: https://lore.kernel.org/r/20221205115823.16957-1-shangxiaojing@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c +index e6ededc51523..a0bc10aa7961 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c +@@ -485,8 +485,10 @@ static int rockchip_usb2phy_power_on(struct phy *phy) + return ret; + + ret = property_enable(base, &rport->port_cfg->phy_sus, false); +- if (ret) ++ if (ret) { ++ clk_disable_unprepare(rphy->clk480m); + return ret; ++ } + + /* waiting for the utmi_clk to become stable */ + usleep_range(1500, 2000); +-- +2.39.0 + diff --git a/queue-6.1/phy-ti-fix-kconfig-warning-and-operator-precedence.patch b/queue-6.1/phy-ti-fix-kconfig-warning-and-operator-precedence.patch new file mode 100644 index 00000000000..dd00f362614 --- /dev/null +++ b/queue-6.1/phy-ti-fix-kconfig-warning-and-operator-precedence.patch @@ -0,0 +1,55 @@ +From 07bd41747c6598812a527fe27ff1c05ba1a068f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 22:25:29 -0800 +Subject: phy: ti: fix Kconfig warning and operator precedence + +From: Randy Dunlap + +[ Upstream commit 7124c93887cc4e6c5b48920f83115e4a5892e870 ] + +Fix Kconfig depends operator precedence to prevent a Kconfig warning: + +WARNING: unmet direct dependencies detected for MUX_MMIO + Depends on [n]: MULTIPLEXER [=m] && OF [=n] + Selected by [m]: + - PHY_AM654_SERDES [=m] && (OF [=n] && ARCH_K3 || COMPILE_TEST [=y]) && COMMON_CLK [=y] + +Fixes: 71e2f5c5c224 ("phy: ti: Add a new SERDES driver for TI's AM654x SoC") +Fixes: 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E SoC") +Signed-off-by: Randy Dunlap +Cc: Vinod Koul +Cc: Kishon Vijay Abraham I +Cc: linux-phy@lists.infradead.org +Cc: Arnd Bergmann +Link: https://lore.kernel.org/r/20230110062529.22668-1-rdunlap@infradead.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/Kconfig b/drivers/phy/ti/Kconfig +index 15a3bcf32308..b905902d5750 100644 +--- a/drivers/phy/ti/Kconfig ++++ b/drivers/phy/ti/Kconfig +@@ -23,7 +23,7 @@ config PHY_DM816X_USB + + config PHY_AM654_SERDES + tristate "TI AM654 SERDES support" +- depends on OF && ARCH_K3 || COMPILE_TEST ++ depends on OF && (ARCH_K3 || COMPILE_TEST) + depends on COMMON_CLK + select GENERIC_PHY + select MULTIPLEXER +@@ -35,7 +35,7 @@ config PHY_AM654_SERDES + + config PHY_J721E_WIZ + tristate "TI J721E WIZ (SERDES Wrapper) support" +- depends on OF && ARCH_K3 || COMPILE_TEST ++ depends on OF && (ARCH_K3 || COMPILE_TEST) + depends on HAS_IOMEM && OF_ADDRESS + depends on COMMON_CLK + select GENERIC_PHY +-- +2.39.0 + diff --git a/queue-6.1/phy-usb-sunplus-fix-potential-null-ptr-deref-in-sp_u.patch b/queue-6.1/phy-usb-sunplus-fix-potential-null-ptr-deref-in-sp_u.patch new file mode 100644 index 00000000000..b85c067208f --- /dev/null +++ b/queue-6.1/phy-usb-sunplus-fix-potential-null-ptr-deref-in-sp_u.patch @@ -0,0 +1,40 @@ +From 29cb7c2bd64ec4a58e32b0c8b034e97cafbbc824 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 10:12:22 +0800 +Subject: phy: usb: sunplus: Fix potential null-ptr-deref in sp_usb_phy_probe() + +From: Shang XiaoJing + +[ Upstream commit 17eee264ef386ef30a69dd70e36f29893b85c170 ] + +sp_usb_phy_probe() will call platform_get_resource_byname() that may fail +and return NULL. devm_ioremap() will use usbphy->moon4_res_mem->start as +input, which may causes null-ptr-deref. Check the ret value of +platform_get_resource_byname() to avoid the null-ptr-deref. + +Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021") +Signed-off-by: Shang XiaoJing +Link: https://lore.kernel.org/r/20221125021222.25687-1-shangxiaojing@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/sunplus/phy-sunplus-usb2.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/phy/sunplus/phy-sunplus-usb2.c b/drivers/phy/sunplus/phy-sunplus-usb2.c +index e827b79f6d49..56de41091d63 100644 +--- a/drivers/phy/sunplus/phy-sunplus-usb2.c ++++ b/drivers/phy/sunplus/phy-sunplus-usb2.c +@@ -254,6 +254,9 @@ static int sp_usb_phy_probe(struct platform_device *pdev) + return PTR_ERR(usbphy->phy_regs); + + usbphy->moon4_res_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM, "moon4"); ++ if (!usbphy->moon4_res_mem) ++ return -EINVAL; ++ + usbphy->moon4_regs = devm_ioremap(&pdev->dev, usbphy->moon4_res_mem->start, + resource_size(usbphy->moon4_res_mem)); + if (!usbphy->moon4_regs) +-- +2.39.0 + diff --git a/queue-6.1/pinctrl-rockchip-fix-mux-route-data-for-rk3568.patch b/queue-6.1/pinctrl-rockchip-fix-mux-route-data-for-rk3568.patch new file mode 100644 index 00000000000..9cb5cd422f2 --- /dev/null +++ b/queue-6.1/pinctrl-rockchip-fix-mux-route-data-for-rk3568.patch @@ -0,0 +1,98 @@ +From c7786017fe659829a758412fa0e8cc669126c6ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 08:46:53 +0000 +Subject: pinctrl: rockchip: fix mux route data for rk3568 + +From: Jonas Karlman + +[ Upstream commit 431d1531466033909d2e8c754a7dc3704b70843f ] + +IO mux selection is configured in PMU_GRF_SOC_CON4 and GRF_IOFUNC_SEL0-5 +regs on RK3568. pwm0-2 is configured in PMU_GRF reg and the rest is +configured in GRF_IOFUNC regs according to TRM [1]. + +Update mux route data to reflect this and use proper detection pin for +UART1 IO mux M1. + +This fixes HDMITX IO mux M1 selection and makes it possible to enable +HDMI CEC on my Radxa ROCK 3 Model A v1.31 board. + +[1] http://opensource.rock-chips.com/images/2/26/Rockchip_RK3568_TRM_Part1_V1.3-20220930P.PDF + +Fixes: c0dadc0e47a8 ("pinctrl: rockchip: add support for rk3568") +Signed-off-by: Jonas Karlman +Link: https://lore.kernel.org/r/20230110084636.1141740-1-jonas@kwiboo.se +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index c3b9313e5be1..5eeac92f610a 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -926,19 +926,19 @@ static struct rockchip_mux_route_data rk3568_mux_route_data[] = { + RK_MUXROUTE_PMU(0, RK_PB5, 4, 0x0110, WRITE_MASK_VAL(3, 2, 1)), /* PWM1 IO mux M1 */ + RK_MUXROUTE_PMU(0, RK_PC1, 1, 0x0110, WRITE_MASK_VAL(5, 4, 0)), /* PWM2 IO mux M0 */ + RK_MUXROUTE_PMU(0, RK_PB6, 4, 0x0110, WRITE_MASK_VAL(5, 4, 1)), /* PWM2 IO mux M1 */ +- RK_MUXROUTE_PMU(0, RK_PB3, 2, 0x0300, WRITE_MASK_VAL(0, 0, 0)), /* CAN0 IO mux M0 */ ++ RK_MUXROUTE_GRF(0, RK_PB3, 2, 0x0300, WRITE_MASK_VAL(0, 0, 0)), /* CAN0 IO mux M0 */ + RK_MUXROUTE_GRF(2, RK_PA1, 4, 0x0300, WRITE_MASK_VAL(0, 0, 1)), /* CAN0 IO mux M1 */ + RK_MUXROUTE_GRF(1, RK_PA1, 3, 0x0300, WRITE_MASK_VAL(2, 2, 0)), /* CAN1 IO mux M0 */ + RK_MUXROUTE_GRF(4, RK_PC3, 3, 0x0300, WRITE_MASK_VAL(2, 2, 1)), /* CAN1 IO mux M1 */ + RK_MUXROUTE_GRF(4, RK_PB5, 3, 0x0300, WRITE_MASK_VAL(4, 4, 0)), /* CAN2 IO mux M0 */ + RK_MUXROUTE_GRF(2, RK_PB2, 4, 0x0300, WRITE_MASK_VAL(4, 4, 1)), /* CAN2 IO mux M1 */ + RK_MUXROUTE_GRF(4, RK_PC4, 1, 0x0300, WRITE_MASK_VAL(6, 6, 0)), /* HPDIN IO mux M0 */ +- RK_MUXROUTE_PMU(0, RK_PC2, 2, 0x0300, WRITE_MASK_VAL(6, 6, 1)), /* HPDIN IO mux M1 */ ++ RK_MUXROUTE_GRF(0, RK_PC2, 2, 0x0300, WRITE_MASK_VAL(6, 6, 1)), /* HPDIN IO mux M1 */ + RK_MUXROUTE_GRF(3, RK_PB1, 3, 0x0300, WRITE_MASK_VAL(8, 8, 0)), /* GMAC1 IO mux M0 */ + RK_MUXROUTE_GRF(4, RK_PA7, 3, 0x0300, WRITE_MASK_VAL(8, 8, 1)), /* GMAC1 IO mux M1 */ + RK_MUXROUTE_GRF(4, RK_PD1, 1, 0x0300, WRITE_MASK_VAL(10, 10, 0)), /* HDMITX IO mux M0 */ +- RK_MUXROUTE_PMU(0, RK_PC7, 1, 0x0300, WRITE_MASK_VAL(10, 10, 1)), /* HDMITX IO mux M1 */ +- RK_MUXROUTE_PMU(0, RK_PB6, 1, 0x0300, WRITE_MASK_VAL(14, 14, 0)), /* I2C2 IO mux M0 */ ++ RK_MUXROUTE_GRF(0, RK_PC7, 1, 0x0300, WRITE_MASK_VAL(10, 10, 1)), /* HDMITX IO mux M1 */ ++ RK_MUXROUTE_GRF(0, RK_PB6, 1, 0x0300, WRITE_MASK_VAL(14, 14, 0)), /* I2C2 IO mux M0 */ + RK_MUXROUTE_GRF(4, RK_PB4, 1, 0x0300, WRITE_MASK_VAL(14, 14, 1)), /* I2C2 IO mux M1 */ + RK_MUXROUTE_GRF(1, RK_PA0, 1, 0x0304, WRITE_MASK_VAL(0, 0, 0)), /* I2C3 IO mux M0 */ + RK_MUXROUTE_GRF(3, RK_PB6, 4, 0x0304, WRITE_MASK_VAL(0, 0, 1)), /* I2C3 IO mux M1 */ +@@ -964,7 +964,7 @@ static struct rockchip_mux_route_data rk3568_mux_route_data[] = { + RK_MUXROUTE_GRF(4, RK_PC3, 1, 0x0308, WRITE_MASK_VAL(12, 12, 1)), /* PWM15 IO mux M1 */ + RK_MUXROUTE_GRF(3, RK_PD2, 3, 0x0308, WRITE_MASK_VAL(14, 14, 0)), /* SDMMC2 IO mux M0 */ + RK_MUXROUTE_GRF(3, RK_PA5, 5, 0x0308, WRITE_MASK_VAL(14, 14, 1)), /* SDMMC2 IO mux M1 */ +- RK_MUXROUTE_PMU(0, RK_PB5, 2, 0x030c, WRITE_MASK_VAL(0, 0, 0)), /* SPI0 IO mux M0 */ ++ RK_MUXROUTE_GRF(0, RK_PB5, 2, 0x030c, WRITE_MASK_VAL(0, 0, 0)), /* SPI0 IO mux M0 */ + RK_MUXROUTE_GRF(2, RK_PD3, 3, 0x030c, WRITE_MASK_VAL(0, 0, 1)), /* SPI0 IO mux M1 */ + RK_MUXROUTE_GRF(2, RK_PB5, 3, 0x030c, WRITE_MASK_VAL(2, 2, 0)), /* SPI1 IO mux M0 */ + RK_MUXROUTE_GRF(3, RK_PC3, 3, 0x030c, WRITE_MASK_VAL(2, 2, 1)), /* SPI1 IO mux M1 */ +@@ -973,8 +973,8 @@ static struct rockchip_mux_route_data rk3568_mux_route_data[] = { + RK_MUXROUTE_GRF(4, RK_PB3, 4, 0x030c, WRITE_MASK_VAL(6, 6, 0)), /* SPI3 IO mux M0 */ + RK_MUXROUTE_GRF(4, RK_PC2, 2, 0x030c, WRITE_MASK_VAL(6, 6, 1)), /* SPI3 IO mux M1 */ + RK_MUXROUTE_GRF(2, RK_PB4, 2, 0x030c, WRITE_MASK_VAL(8, 8, 0)), /* UART1 IO mux M0 */ +- RK_MUXROUTE_PMU(0, RK_PD1, 1, 0x030c, WRITE_MASK_VAL(8, 8, 1)), /* UART1 IO mux M1 */ +- RK_MUXROUTE_PMU(0, RK_PD1, 1, 0x030c, WRITE_MASK_VAL(10, 10, 0)), /* UART2 IO mux M0 */ ++ RK_MUXROUTE_GRF(3, RK_PD6, 4, 0x030c, WRITE_MASK_VAL(8, 8, 1)), /* UART1 IO mux M1 */ ++ RK_MUXROUTE_GRF(0, RK_PD1, 1, 0x030c, WRITE_MASK_VAL(10, 10, 0)), /* UART2 IO mux M0 */ + RK_MUXROUTE_GRF(1, RK_PD5, 2, 0x030c, WRITE_MASK_VAL(10, 10, 1)), /* UART2 IO mux M1 */ + RK_MUXROUTE_GRF(1, RK_PA1, 2, 0x030c, WRITE_MASK_VAL(12, 12, 0)), /* UART3 IO mux M0 */ + RK_MUXROUTE_GRF(3, RK_PB7, 4, 0x030c, WRITE_MASK_VAL(12, 12, 1)), /* UART3 IO mux M1 */ +@@ -1004,13 +1004,13 @@ static struct rockchip_mux_route_data rk3568_mux_route_data[] = { + RK_MUXROUTE_GRF(3, RK_PD6, 5, 0x0314, WRITE_MASK_VAL(1, 0, 1)), /* PDM IO mux M1 */ + RK_MUXROUTE_GRF(4, RK_PA0, 4, 0x0314, WRITE_MASK_VAL(1, 0, 1)), /* PDM IO mux M1 */ + RK_MUXROUTE_GRF(3, RK_PC4, 5, 0x0314, WRITE_MASK_VAL(1, 0, 2)), /* PDM IO mux M2 */ +- RK_MUXROUTE_PMU(0, RK_PA5, 3, 0x0314, WRITE_MASK_VAL(3, 2, 0)), /* PCIE20 IO mux M0 */ ++ RK_MUXROUTE_GRF(0, RK_PA5, 3, 0x0314, WRITE_MASK_VAL(3, 2, 0)), /* PCIE20 IO mux M0 */ + RK_MUXROUTE_GRF(2, RK_PD0, 4, 0x0314, WRITE_MASK_VAL(3, 2, 1)), /* PCIE20 IO mux M1 */ + RK_MUXROUTE_GRF(1, RK_PB0, 4, 0x0314, WRITE_MASK_VAL(3, 2, 2)), /* PCIE20 IO mux M2 */ +- RK_MUXROUTE_PMU(0, RK_PA4, 3, 0x0314, WRITE_MASK_VAL(5, 4, 0)), /* PCIE30X1 IO mux M0 */ ++ RK_MUXROUTE_GRF(0, RK_PA4, 3, 0x0314, WRITE_MASK_VAL(5, 4, 0)), /* PCIE30X1 IO mux M0 */ + RK_MUXROUTE_GRF(2, RK_PD2, 4, 0x0314, WRITE_MASK_VAL(5, 4, 1)), /* PCIE30X1 IO mux M1 */ + RK_MUXROUTE_GRF(1, RK_PA5, 4, 0x0314, WRITE_MASK_VAL(5, 4, 2)), /* PCIE30X1 IO mux M2 */ +- RK_MUXROUTE_PMU(0, RK_PA6, 2, 0x0314, WRITE_MASK_VAL(7, 6, 0)), /* PCIE30X2 IO mux M0 */ ++ RK_MUXROUTE_GRF(0, RK_PA6, 2, 0x0314, WRITE_MASK_VAL(7, 6, 0)), /* PCIE30X2 IO mux M0 */ + RK_MUXROUTE_GRF(2, RK_PD4, 4, 0x0314, WRITE_MASK_VAL(7, 6, 1)), /* PCIE30X2 IO mux M1 */ + RK_MUXROUTE_GRF(4, RK_PC2, 4, 0x0314, WRITE_MASK_VAL(7, 6, 2)), /* PCIE30X2 IO mux M2 */ + }; +-- +2.39.0 + diff --git a/queue-6.1/pinctrl-rockchip-fix-reading-pull-type-on-rk3568.patch b/queue-6.1/pinctrl-rockchip-fix-reading-pull-type-on-rk3568.patch new file mode 100644 index 00000000000..2d3c04651d2 --- /dev/null +++ b/queue-6.1/pinctrl-rockchip-fix-reading-pull-type-on-rk3568.patch @@ -0,0 +1,64 @@ +From 5daf1c5bdc5861b068cd9f600a4739c0458d68ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 17:29:58 +0000 +Subject: pinctrl: rockchip: fix reading pull type on rk3568 + +From: Jonas Karlman + +[ Upstream commit 31b62a98de42cf65d76e4dcfb571af067d27d83a ] + +When reading pinconf-pins from debugfs it fails to get the configured pull +type on RK3568, "unsupported pinctrl type" error messages is also reported. + +Fix this by adding support for RK3568 in rockchip_get_pull, including a +reverse of the pull-up value swap applied in rockchip_set_pull so that +pull-up is correctly reported in pinconf-pins. +Also update the workaround comment to reflect affected pins, GPIO0_D3-D6. + +Fixes: c0dadc0e47a8 ("pinctrl: rockchip: add support for rk3568") +Signed-off-by: Jonas Karlman +Reviewed-by: Heiko Stuebner +Reviewed-by: Jianqun Xu +Link: https://lore.kernel.org/r/20230110172955.1258840-1-jonas@kwiboo.se +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index da974ff2d75d..c3b9313e5be1 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -2436,10 +2436,19 @@ static int rockchip_get_pull(struct rockchip_pin_bank *bank, int pin_num) + case RK3308: + case RK3368: + case RK3399: ++ case RK3568: + case RK3588: + pull_type = bank->pull_type[pin_num / 8]; + data >>= bit; + data &= (1 << RK3188_PULL_BITS_PER_PIN) - 1; ++ /* ++ * In the TRM, pull-up being 1 for everything except the GPIO0_D3-D6, ++ * where that pull up value becomes 3. ++ */ ++ if (ctrl->type == RK3568 && bank->bank_num == 0 && pin_num >= 27 && pin_num <= 30) { ++ if (data == 3) ++ data = 1; ++ } + + return rockchip_pull_list[pull_type][data]; + default: +@@ -2497,7 +2506,7 @@ static int rockchip_set_pull(struct rockchip_pin_bank *bank, + } + } + /* +- * In the TRM, pull-up being 1 for everything except the GPIO0_D0-D6, ++ * In the TRM, pull-up being 1 for everything except the GPIO0_D3-D6, + * where that pull up value becomes 3. + */ + if (ctrl->type == RK3568 && bank->bank_num == 0 && pin_num >= 27 && pin_num <= 30) { +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch b/queue-6.1/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch new file mode 100644 index 00000000000..7b0b2e582db --- /dev/null +++ b/queue-6.1/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch @@ -0,0 +1,41 @@ +From 8f1bd38caa2ac6ebcc26045aa6c9fa4e2107c28e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Dec 2022 03:49:59 +0000 +Subject: platform/x86: asus-nb-wmi: Add alternate mapping for KEY_CAMERA +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c78a4e191839edc1e8c3e51565cf2e71d40e8883 ] + +This keycode is emitted on a Asus VivoBook E410MAB with firmware +E410MAB.304. + +The physical key has a strikken-through camera printed on it. + +Signed-off-by: Thomas Weißschuh +Link: https://lore.kernel.org/r/20221216-asus-key-v1-1-45da124119a3@weissschuh.net +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index c685a705b73d..8ee5d108e9e0 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -544,6 +544,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0x7D, { KEY_BLUETOOTH } }, /* Bluetooth Enable */ + { KE_KEY, 0x7E, { KEY_BLUETOOTH } }, /* Bluetooth Disable */ + { KE_KEY, 0x82, { KEY_CAMERA } }, ++ { KE_KEY, 0x85, { KEY_CAMERA } }, + { KE_KEY, 0x86, { KEY_PROG1 } }, /* MyASUS Key */ + { KE_KEY, 0x88, { KEY_RFKILL } }, /* Radio Toggle Key */ + { KE_KEY, 0x8A, { KEY_PROG1 } }, /* Color enhancement mode */ +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch-26863 b/queue-6.1/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch-26863 new file mode 100644 index 00000000000..541d76d963e --- /dev/null +++ b/queue-6.1/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch-26863 @@ -0,0 +1,34 @@ +From e7d0722ea990a48e6dcbb26ed5ab39b7ef6db72a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 19:18:41 +0100 +Subject: platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK + +From: Hans de Goede + +[ Upstream commit db9494895b405bf318dc7e563dee6daa51b3b6ed ] + +The 0x33 keycode is emitted by Fn + F6 on a ASUS FX705GE laptop. + +Reported-by: Nemcev Aleksey +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230112181841.84652-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 8ee5d108e9e0..b34bddda0a9b 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -511,6 +511,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0x30, { KEY_VOLUMEUP } }, + { KE_KEY, 0x31, { KEY_VOLUMEDOWN } }, + { KE_KEY, 0x32, { KEY_MUTE } }, ++ { KE_KEY, 0x33, { KEY_SCREENLOCK } }, + { KE_KEY, 0x35, { KEY_SCREENLOCK } }, + { KE_KEY, 0x38, { KEY_PROG3 } }, /* Armoury Crate */ + { KE_KEY, 0x40, { KEY_PREVIOUSSONG } }, +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-asus-wmi-add-quirk-wmi_ignore_fan.patch b/queue-6.1/platform-x86-asus-wmi-add-quirk-wmi_ignore_fan.patch new file mode 100644 index 00000000000..cd42dd837ef --- /dev/null +++ b/queue-6.1/platform-x86-asus-wmi-add-quirk-wmi_ignore_fan.patch @@ -0,0 +1,59 @@ +From 12dcba42934a3e032e7096d3529d4f6050ceab66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Dec 2022 17:59:49 +0000 +Subject: platform/x86: asus-wmi: Add quirk wmi_ignore_fan +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit c874b6de4cdfa2822a07b479887cd5f87fb5d078 ] + +Some laptops have a fan device listed in their ACPI tables but do not +actually contain a fan. +Introduce a quirk that can be used to override the fan detection logic. + +This was observed with a ASUS VivoBook E410MA running firmware +E410MAB.304. + +Signed-off-by: Thomas Weißschuh +Link: https://lore.kernel.org/r/20221221-asus-fan-v1-1-e07f3949725b@weissschuh.net +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 4 +++- + drivers/platform/x86/asus-wmi.h | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index f051b21653d6..8e317d57ecc3 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -2243,7 +2243,9 @@ static int asus_wmi_fan_init(struct asus_wmi *asus) + asus->fan_type = FAN_TYPE_NONE; + asus->agfn_pwm = -1; + +- if (asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_CPU_FAN_CTRL)) ++ if (asus->driver->quirks->wmi_ignore_fan) ++ asus->fan_type = FAN_TYPE_NONE; ++ else if (asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_CPU_FAN_CTRL)) + asus->fan_type = FAN_TYPE_SPEC83; + else if (asus_wmi_has_agfn_fan(asus)) + asus->fan_type = FAN_TYPE_AGFN; +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 65316998b898..a478ebfd34df 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -38,6 +38,7 @@ struct quirk_entry { + bool store_backlight_power; + bool wmi_backlight_set_devstate; + bool wmi_force_als_set; ++ bool wmi_ignore_fan; + enum asus_wmi_tablet_switch_mode tablet_switch_mode; + int wapf; + /* +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-asus-wmi-ignore-fan-on-e410ma.patch b/queue-6.1/platform-x86-asus-wmi-ignore-fan-on-e410ma.patch new file mode 100644 index 00000000000..ed4190bc697 --- /dev/null +++ b/queue-6.1/platform-x86-asus-wmi-ignore-fan-on-e410ma.patch @@ -0,0 +1,59 @@ +From e0ba21a502b224d0bee872284b848885e29ab80a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Dec 2022 17:59:50 +0000 +Subject: platform/x86: asus-wmi: Ignore fan on E410MA +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 82cc5c6c624c63f7b57214e325e2ea685d924e89 ] + +The ASUS VivoBook has a fan device described in its ACPI tables but does +not actually contain any physical fan. +Use the quirk to inhibit fan handling. + +Signed-off-by: Thomas Weißschuh +Link: https://lore.kernel.org/r/20221221-asus-fan-v1-2-e07f3949725b@weissschuh.net +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index b34bddda0a9b..cb15acdf14a3 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -121,6 +121,10 @@ static struct quirk_entry quirk_asus_tablet_mode = { + .tablet_switch_mode = asus_wmi_lid_flip_rog_devid, + }; + ++static struct quirk_entry quirk_asus_ignore_fan = { ++ .wmi_ignore_fan = true, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + pr_info("Identified laptop model '%s'\n", dmi->ident); +@@ -473,6 +477,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_tablet_mode, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUS VivoBook E410MA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "E410MA"), ++ }, ++ .driver_data = &quirk_asus_ignore_fan, ++ }, + {}, + }; + +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-simatic-ipc-add-another-model.patch b/queue-6.1/platform-x86-simatic-ipc-add-another-model.patch new file mode 100644 index 00000000000..d41d551c4bb --- /dev/null +++ b/queue-6.1/platform-x86-simatic-ipc-add-another-model.patch @@ -0,0 +1,48 @@ +From e39a600de96d3b2cb4faa900294d19df182c57fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 11:37:20 +0100 +Subject: platform/x86: simatic-ipc: add another model + +From: Henning Schild + +[ Upstream commit d348b1d761e358a4ba03fb34aa7e3dbd278db236 ] + +Add IPC PX-39A support. + +Signed-off-by: Henning Schild +Link: https://lore.kernel.org/r/20221222103720.8546-3-henning.schild@siemens.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/simatic-ipc.c | 1 + + include/linux/platform_data/x86/simatic-ipc.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/simatic-ipc.c b/drivers/platform/x86/simatic-ipc.c +index 2ab1f8da32b0..b3622419cd1a 100644 +--- a/drivers/platform/x86/simatic-ipc.c ++++ b/drivers/platform/x86/simatic-ipc.c +@@ -47,6 +47,7 @@ static struct { + {SIMATIC_IPC_IPC427E, SIMATIC_IPC_DEVICE_427E, SIMATIC_IPC_DEVICE_427E}, + {SIMATIC_IPC_IPC477E, SIMATIC_IPC_DEVICE_NONE, SIMATIC_IPC_DEVICE_427E}, + {SIMATIC_IPC_IPCBX_39A, SIMATIC_IPC_DEVICE_227G, SIMATIC_IPC_DEVICE_227G}, ++ {SIMATIC_IPC_IPCPX_39A, SIMATIC_IPC_DEVICE_NONE, SIMATIC_IPC_DEVICE_227G}, + }; + + static int register_platform_devices(u32 station_id) +diff --git a/include/linux/platform_data/x86/simatic-ipc.h b/include/linux/platform_data/x86/simatic-ipc.h +index a4a6cba412cb..a48bb5240977 100644 +--- a/include/linux/platform_data/x86/simatic-ipc.h ++++ b/include/linux/platform_data/x86/simatic-ipc.h +@@ -33,6 +33,7 @@ enum simatic_ipc_station_ids { + SIMATIC_IPC_IPC127E = 0x00000D01, + SIMATIC_IPC_IPC227G = 0x00000F01, + SIMATIC_IPC_IPCBX_39A = 0x00001001, ++ SIMATIC_IPC_IPCPX_39A = 0x00001002, + }; + + static inline u32 simatic_ipc_get_station_id(u8 *data, int max_len) +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-simatic-ipc-correct-name-of-a-model.patch b/queue-6.1/platform-x86-simatic-ipc-correct-name-of-a-model.patch new file mode 100644 index 00000000000..057f5221100 --- /dev/null +++ b/queue-6.1/platform-x86-simatic-ipc-correct-name-of-a-model.patch @@ -0,0 +1,51 @@ +From e363b2b874c09a77a4a07fb5fb90a2c5f3e8e265 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 11:37:19 +0100 +Subject: platform/x86: simatic-ipc: correct name of a model + +From: Henning Schild + +[ Upstream commit ed058eab22d64c00663563e8e1e112989c65c59f ] + +What we called IPC427G should be renamed to BX-39A to be more in line +with the actual product name. + +Signed-off-by: Henning Schild +Link: https://lore.kernel.org/r/20221222103720.8546-2-henning.schild@siemens.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/simatic-ipc.c | 2 +- + include/linux/platform_data/x86/simatic-ipc.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/simatic-ipc.c b/drivers/platform/x86/simatic-ipc.c +index ca76076fc706..2ab1f8da32b0 100644 +--- a/drivers/platform/x86/simatic-ipc.c ++++ b/drivers/platform/x86/simatic-ipc.c +@@ -46,7 +46,7 @@ static struct { + {SIMATIC_IPC_IPC427D, SIMATIC_IPC_DEVICE_427E, SIMATIC_IPC_DEVICE_NONE}, + {SIMATIC_IPC_IPC427E, SIMATIC_IPC_DEVICE_427E, SIMATIC_IPC_DEVICE_427E}, + {SIMATIC_IPC_IPC477E, SIMATIC_IPC_DEVICE_NONE, SIMATIC_IPC_DEVICE_427E}, +- {SIMATIC_IPC_IPC427G, SIMATIC_IPC_DEVICE_227G, SIMATIC_IPC_DEVICE_227G}, ++ {SIMATIC_IPC_IPCBX_39A, SIMATIC_IPC_DEVICE_227G, SIMATIC_IPC_DEVICE_227G}, + }; + + static int register_platform_devices(u32 station_id) +diff --git a/include/linux/platform_data/x86/simatic-ipc.h b/include/linux/platform_data/x86/simatic-ipc.h +index 632320ec8f08..a4a6cba412cb 100644 +--- a/include/linux/platform_data/x86/simatic-ipc.h ++++ b/include/linux/platform_data/x86/simatic-ipc.h +@@ -32,7 +32,7 @@ enum simatic_ipc_station_ids { + SIMATIC_IPC_IPC477E = 0x00000A02, + SIMATIC_IPC_IPC127E = 0x00000D01, + SIMATIC_IPC_IPC227G = 0x00000F01, +- SIMATIC_IPC_IPC427G = 0x00001001, ++ SIMATIC_IPC_IPCBX_39A = 0x00001001, + }; + + static inline u32 simatic_ipc_get_station_id(u8 *data, int max_len) +-- +2.39.0 + diff --git a/queue-6.1/platform-x86-touchscreen_dmi-add-info-for-the-csl-pa.patch b/queue-6.1/platform-x86-touchscreen_dmi-add-info-for-the-csl-pa.patch new file mode 100644 index 00000000000..24d161158ea --- /dev/null +++ b/queue-6.1/platform-x86-touchscreen_dmi-add-info-for-the-csl-pa.patch @@ -0,0 +1,66 @@ +From cf7431d6630bf884d7ed67df461746ee32c23d8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 13:11:03 +0100 +Subject: platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD + +From: Michael Klein + +[ Upstream commit 36c2b9d6710427f802494ba070621cb415198293 ] + +Add touchscreen info for the CSL Panther Tab HD. + +Signed-off-by: Michael Klein +Link: https://lore.kernel.org/r/20221220121103.uiwn5l7fii2iggct@LLGMVZLB-0037 +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index baae3120efd0..f00995390fdf 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -264,6 +264,23 @@ static const struct ts_dmi_data connect_tablet9_data = { + .properties = connect_tablet9_props, + }; + ++static const struct property_entry csl_panther_tab_hd_props[] = { ++ PROPERTY_ENTRY_U32("touchscreen-min-x", 1), ++ PROPERTY_ENTRY_U32("touchscreen-min-y", 20), ++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1980), ++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1526), ++ PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"), ++ PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"), ++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-csl-panther-tab-hd.fw"), ++ PROPERTY_ENTRY_U32("silead,max-fingers", 10), ++ { } ++}; ++ ++static const struct ts_dmi_data csl_panther_tab_hd_data = { ++ .acpi_name = "MSSL1680:00", ++ .properties = csl_panther_tab_hd_props, ++}; ++ + static const struct property_entry cube_iwork8_air_props[] = { + PROPERTY_ENTRY_U32("touchscreen-min-x", 1), + PROPERTY_ENTRY_U32("touchscreen-min-y", 3), +@@ -1124,6 +1141,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Tablet 9"), + }, + }, ++ { ++ /* CSL Panther Tab HD */ ++ .driver_data = (void *)&csl_panther_tab_hd_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "CSL Computer GmbH & Co. KG"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CSL Panther Tab HD"), ++ }, ++ }, + { + /* CUBE iwork8 Air */ + .driver_data = (void *)&cube_iwork8_air_data, +-- +2.39.0 + diff --git a/queue-6.1/pm-avs-qcom-cpr-fix-an-error-handling-path-in-cpr_pr.patch b/queue-6.1/pm-avs-qcom-cpr-fix-an-error-handling-path-in-cpr_pr.patch new file mode 100644 index 00000000000..526a2075543 --- /dev/null +++ b/queue-6.1/pm-avs-qcom-cpr-fix-an-error-handling-path-in-cpr_pr.patch @@ -0,0 +1,50 @@ +From ab675327e3c925dc219b5932a8805a60beec8620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Dec 2022 17:05:41 +0100 +Subject: PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() + +From: Christophe JAILLET + +[ Upstream commit 6049aae52392539e505bfb8ccbcff3c26f1d2f0b ] + +If an error occurs after a successful pm_genpd_init() call, it should be +undone by a corresponding pm_genpd_remove(). + +Add the missing call in the error handling path, as already done in the +remove function. + +Fixes: bf6910abf548 ("power: avs: Add support for CPR (Core Power Reduction)") +Signed-off-by: Christophe JAILLET +Reviewed-by: Ulf Hansson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/0f520597dbad89ab99c217c8986912fa53eaf5f9.1671293108.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/cpr.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/cpr.c b/drivers/soc/qcom/cpr.c +index e9b854ed1bdf..144ea68e0920 100644 +--- a/drivers/soc/qcom/cpr.c ++++ b/drivers/soc/qcom/cpr.c +@@ -1708,12 +1708,16 @@ static int cpr_probe(struct platform_device *pdev) + + ret = of_genpd_add_provider_simple(dev->of_node, &drv->pd); + if (ret) +- return ret; ++ goto err_remove_genpd; + + platform_set_drvdata(pdev, drv); + cpr_debugfs_init(drv); + + return 0; ++ ++err_remove_genpd: ++ pm_genpd_remove(&drv->pd); ++ return ret; + } + + static int cpr_remove(struct platform_device *pdev) +-- +2.39.0 + diff --git a/queue-6.1/ptdma-pt_core_execute_cmd-should-use-spinlock.patch b/queue-6.1/ptdma-pt_core_execute_cmd-should-use-spinlock.patch new file mode 100644 index 00000000000..d5c1c81dfe1 --- /dev/null +++ b/queue-6.1/ptdma-pt_core_execute_cmd-should-use-spinlock.patch @@ -0,0 +1,80 @@ +From 5592f6b0e4031999c5e802945fb31b50bc489ae6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 19:39:08 -0800 +Subject: ptdma: pt_core_execute_cmd() should use spinlock + +From: Eric Pilmore + +[ Upstream commit 95e5fda3b5f9ed8239b145da3fa01e641cf5d53c ] + +The interrupt handler (pt_core_irq_handler()) of the ptdma +driver can be called from interrupt context. The code flow +in this function can lead down to pt_core_execute_cmd() which +will attempt to grab a mutex, which is not appropriate in +interrupt context and ultimately leads to a kernel panic. +The fix here changes this mutex to a spinlock, which has +been verified to resolve the issue. + +Fixes: fa5d823b16a9 ("dmaengine: ptdma: Initial driver for the AMD PTDMA") +Signed-off-by: Eric Pilmore +Link: https://lore.kernel.org/r/20230119033907.35071-1-epilmore@gigaio.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ptdma/ptdma-dev.c | 7 ++++--- + drivers/dma/ptdma/ptdma.h | 2 +- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/ptdma/ptdma-dev.c b/drivers/dma/ptdma/ptdma-dev.c +index 377da23012ac..a2bf13ff18b6 100644 +--- a/drivers/dma/ptdma/ptdma-dev.c ++++ b/drivers/dma/ptdma/ptdma-dev.c +@@ -71,12 +71,13 @@ static int pt_core_execute_cmd(struct ptdma_desc *desc, struct pt_cmd_queue *cmd + bool soc = FIELD_GET(DWORD0_SOC, desc->dw0); + u8 *q_desc = (u8 *)&cmd_q->qbase[cmd_q->qidx]; + u32 tail; ++ unsigned long flags; + + if (soc) { + desc->dw0 |= FIELD_PREP(DWORD0_IOC, desc->dw0); + desc->dw0 &= ~DWORD0_SOC; + } +- mutex_lock(&cmd_q->q_mutex); ++ spin_lock_irqsave(&cmd_q->q_lock, flags); + + /* Copy 32-byte command descriptor to hw queue. */ + memcpy(q_desc, desc, 32); +@@ -91,7 +92,7 @@ static int pt_core_execute_cmd(struct ptdma_desc *desc, struct pt_cmd_queue *cmd + + /* Turn the queue back on using our cached control register */ + pt_start_queue(cmd_q); +- mutex_unlock(&cmd_q->q_mutex); ++ spin_unlock_irqrestore(&cmd_q->q_lock, flags); + + return 0; + } +@@ -199,7 +200,7 @@ int pt_core_init(struct pt_device *pt) + + cmd_q->pt = pt; + cmd_q->dma_pool = dma_pool; +- mutex_init(&cmd_q->q_mutex); ++ spin_lock_init(&cmd_q->q_lock); + + /* Page alignment satisfies our needs for N <= 128 */ + cmd_q->qsize = Q_SIZE(Q_DESC_SIZE); +diff --git a/drivers/dma/ptdma/ptdma.h b/drivers/dma/ptdma/ptdma.h +index d093c43b7d13..21b4bf895200 100644 +--- a/drivers/dma/ptdma/ptdma.h ++++ b/drivers/dma/ptdma/ptdma.h +@@ -196,7 +196,7 @@ struct pt_cmd_queue { + struct ptdma_desc *qbase; + + /* Aligned queue start address (per requirement) */ +- struct mutex q_mutex ____cacheline_aligned; ++ spinlock_t q_lock ____cacheline_aligned; + unsigned int qidx; + + unsigned int qsize; +-- +2.39.0 + diff --git a/queue-6.1/r8152-add-vendor-device-id-pair-for-microsoft-devkit.patch b/queue-6.1/r8152-add-vendor-device-id-pair-for-microsoft-devkit.patch new file mode 100644 index 00000000000..fe67b39f996 --- /dev/null +++ b/queue-6.1/r8152-add-vendor-device-id-pair-for-microsoft-devkit.patch @@ -0,0 +1,40 @@ +From 3c00fe28fd35edfacf4ad5cfee1eeb98bfce1296 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 13:32:28 +0000 +Subject: r8152: add vendor/device ID pair for Microsoft Devkit + +From: Andre Przywara + +[ Upstream commit be53771c87f4e322a9835d3faa9cd73a4ecdec5b ] + +The Microsoft Devkit 2023 is a an ARM64 based machine featuring a +Realtek 8153 USB3.0-to-GBit Ethernet adapter. As in their other +machines, Microsoft uses a custom USB device ID. + +Add the respective ID values to the driver. This makes Ethernet work on +the MS Devkit device. The chip has been visually confirmed to be a +RTL8153. + +Signed-off-by: Andre Przywara +Link: https://lore.kernel.org/r/20230111133228.190801-1-andre.przywara@arm.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index a481a1d831e2..23da1d9dafd1 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -9836,6 +9836,7 @@ static const struct usb_device_id rtl8152_table[] = { + REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07ab), + REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x07c6), + REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0927), ++ REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0c5e), + REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101), + REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x304f), + REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3054), +-- +2.39.0 + diff --git a/queue-6.1/rdma-core-fix-ib-block-iterator-counter-overflow.patch b/queue-6.1/rdma-core-fix-ib-block-iterator-counter-overflow.patch new file mode 100644 index 00000000000..b43e2864cef --- /dev/null +++ b/queue-6.1/rdma-core-fix-ib-block-iterator-counter-overflow.patch @@ -0,0 +1,79 @@ +From f88797fad89eb2e494ddea953f3c2193fd4def21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 13:37:11 +0000 +Subject: RDMA/core: Fix ib block iterator counter overflow + +From: Yonatan Nachum + +[ Upstream commit 0afec5e9cea732cb47014655685a2a47fb180c31 ] + +When registering a new DMA MR after selecting the best aligned page size +for it, we iterate over the given sglist to split each entry to smaller, +aligned to the selected page size, DMA blocks. + +In given circumstances where the sg entry and page size fit certain +sizes and the sg entry is not aligned to the selected page size, the +total size of the aligned pages we need to cover the sg entry is >= 4GB. +Under this circumstances, while iterating page aligned blocks, the +counter responsible for counting how much we advanced from the start of +the sg entry is overflowed because its type is u32 and we pass 4GB in +size. This can lead to an infinite loop inside the iterator function +because the overflow prevents the counter to be larger +than the size of the sg entry. + +Fix the presented problem by changing the advancement condition to +eliminate overflow. + +Backtrace: +[ 192.374329] efa_reg_user_mr_dmabuf +[ 192.376783] efa_register_mr +[ 192.382579] pgsz_bitmap 0xfffff000 rounddown 0x80000000 +[ 192.386423] pg_sz [0x80000000] umem_length[0xc0000000] +[ 192.392657] start 0x0 length 0xc0000000 params.page_shift 31 params.page_num 3 +[ 192.399559] hp_cnt[3], pages_in_hp[524288] +[ 192.403690] umem->sgt_append.sgt.nents[1] +[ 192.407905] number entries: [1], pg_bit: [31] +[ 192.411397] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] +[ 192.415601] biter->__sg_advance [665837568] sg_dma_len[3221225472] +[ 192.419823] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] +[ 192.423976] biter->__sg_advance [2813321216] sg_dma_len[3221225472] +[ 192.428243] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] +[ 192.432397] biter->__sg_advance [665837568] sg_dma_len[3221225472] + +Fixes: a808273a495c ("RDMA/verbs: Add a DMA iterator to return aligned contiguous memory blocks") +Signed-off-by: Yonatan Nachum +Link: https://lore.kernel.org/r/20230109133711.13678-1-ynachum@amazon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/verbs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 26b021f43ba4..11b1c1603aeb 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -2957,15 +2957,18 @@ EXPORT_SYMBOL(__rdma_block_iter_start); + bool __rdma_block_iter_next(struct ib_block_iter *biter) + { + unsigned int block_offset; ++ unsigned int sg_delta; + + if (!biter->__sg_nents || !biter->__sg) + return false; + + biter->__dma_addr = sg_dma_address(biter->__sg) + biter->__sg_advance; + block_offset = biter->__dma_addr & (BIT_ULL(biter->__pg_bit) - 1); +- biter->__sg_advance += BIT_ULL(biter->__pg_bit) - block_offset; ++ sg_delta = BIT_ULL(biter->__pg_bit) - block_offset; + +- if (biter->__sg_advance >= sg_dma_len(biter->__sg)) { ++ if (sg_dma_len(biter->__sg) - biter->__sg_advance > sg_delta) { ++ biter->__sg_advance += sg_delta; ++ } else { + biter->__sg_advance = 0; + biter->__sg = sg_next(biter->__sg); + biter->__sg_nents--; +-- +2.39.0 + diff --git a/queue-6.1/rdma-rxe-fix-inaccurate-constants-in-rxe_type_info.patch b/queue-6.1/rdma-rxe-fix-inaccurate-constants-in-rxe_type_info.patch new file mode 100644 index 00000000000..56b89f84201 --- /dev/null +++ b/queue-6.1/rdma-rxe-fix-inaccurate-constants-in-rxe_type_info.patch @@ -0,0 +1,108 @@ +From 52362e6645cf45c2a48629e9f7b5f698b5b69c3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 17:08:47 +0900 +Subject: RDMA/rxe: Fix inaccurate constants in rxe_type_info + +From: Daisuke Matsuda + +[ Upstream commit 3a73746b267e5c6a87c9ad26f8c6a48e44da609c ] + +ibv_query_device() has reported incorrect device attributes, which are +actually not used by the device. Make the constants correspond with the +attributes shown to users. + +Fixes: 3ccffe8abf2f ("RDMA/rxe: Move max_elem into rxe_type_info") +Fixes: 3225717f6dfa ("RDMA/rxe: Replace red-black trees by xarrays") +Link: https://lore.kernel.org/r/20221220080848.253785-1-matsuda-daisuke@fujitsu.com +Signed-off-by: Daisuke Matsuda +Reviewed-by: Li Zhijian +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_pool.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c +index f50620f5a0a1..1151c0b5ccea 100644 +--- a/drivers/infiniband/sw/rxe/rxe_pool.c ++++ b/drivers/infiniband/sw/rxe/rxe_pool.c +@@ -23,16 +23,16 @@ static const struct rxe_type_info { + .size = sizeof(struct rxe_ucontext), + .elem_offset = offsetof(struct rxe_ucontext, elem), + .min_index = 1, +- .max_index = UINT_MAX, +- .max_elem = UINT_MAX, ++ .max_index = RXE_MAX_UCONTEXT, ++ .max_elem = RXE_MAX_UCONTEXT, + }, + [RXE_TYPE_PD] = { + .name = "pd", + .size = sizeof(struct rxe_pd), + .elem_offset = offsetof(struct rxe_pd, elem), + .min_index = 1, +- .max_index = UINT_MAX, +- .max_elem = UINT_MAX, ++ .max_index = RXE_MAX_PD, ++ .max_elem = RXE_MAX_PD, + }, + [RXE_TYPE_AH] = { + .name = "ah", +@@ -40,7 +40,7 @@ static const struct rxe_type_info { + .elem_offset = offsetof(struct rxe_ah, elem), + .min_index = RXE_MIN_AH_INDEX, + .max_index = RXE_MAX_AH_INDEX, +- .max_elem = RXE_MAX_AH_INDEX - RXE_MIN_AH_INDEX + 1, ++ .max_elem = RXE_MAX_AH, + }, + [RXE_TYPE_SRQ] = { + .name = "srq", +@@ -49,7 +49,7 @@ static const struct rxe_type_info { + .cleanup = rxe_srq_cleanup, + .min_index = RXE_MIN_SRQ_INDEX, + .max_index = RXE_MAX_SRQ_INDEX, +- .max_elem = RXE_MAX_SRQ_INDEX - RXE_MIN_SRQ_INDEX + 1, ++ .max_elem = RXE_MAX_SRQ, + }, + [RXE_TYPE_QP] = { + .name = "qp", +@@ -58,7 +58,7 @@ static const struct rxe_type_info { + .cleanup = rxe_qp_cleanup, + .min_index = RXE_MIN_QP_INDEX, + .max_index = RXE_MAX_QP_INDEX, +- .max_elem = RXE_MAX_QP_INDEX - RXE_MIN_QP_INDEX + 1, ++ .max_elem = RXE_MAX_QP, + }, + [RXE_TYPE_CQ] = { + .name = "cq", +@@ -66,8 +66,8 @@ static const struct rxe_type_info { + .elem_offset = offsetof(struct rxe_cq, elem), + .cleanup = rxe_cq_cleanup, + .min_index = 1, +- .max_index = UINT_MAX, +- .max_elem = UINT_MAX, ++ .max_index = RXE_MAX_CQ, ++ .max_elem = RXE_MAX_CQ, + }, + [RXE_TYPE_MR] = { + .name = "mr", +@@ -76,7 +76,7 @@ static const struct rxe_type_info { + .cleanup = rxe_mr_cleanup, + .min_index = RXE_MIN_MR_INDEX, + .max_index = RXE_MAX_MR_INDEX, +- .max_elem = RXE_MAX_MR_INDEX - RXE_MIN_MR_INDEX + 1, ++ .max_elem = RXE_MAX_MR, + }, + [RXE_TYPE_MW] = { + .name = "mw", +@@ -85,7 +85,7 @@ static const struct rxe_type_info { + .cleanup = rxe_mw_cleanup, + .min_index = RXE_MIN_MW_INDEX, + .max_index = RXE_MAX_MW_INDEX, +- .max_elem = RXE_MAX_MW_INDEX - RXE_MIN_MW_INDEX + 1, ++ .max_elem = RXE_MAX_MW, + }, + }; + +-- +2.39.0 + diff --git a/queue-6.1/rdma-rxe-prevent-faulty-rkey-generation.patch b/queue-6.1/rdma-rxe-prevent-faulty-rkey-generation.patch new file mode 100644 index 00000000000..2029819b1a5 --- /dev/null +++ b/queue-6.1/rdma-rxe-prevent-faulty-rkey-generation.patch @@ -0,0 +1,53 @@ +From b01d582e09c8c1556733349b72835682ae7529b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 17:08:48 +0900 +Subject: RDMA/rxe: Prevent faulty rkey generation + +From: Daisuke Matsuda + +[ Upstream commit 1aefe5c177c1922119afb4ee443ddd6ac3140b37 ] + +If you create MRs more than 0x10000 times after loading the module, +responder starts to reply NAKs for RDMA/Atomic operations because of rkey +violation detected in check_rkey(). The root cause is that rkeys are +incremented each time a new MR is created and the value overflows into the +range reserved for MWs. + +This commit also increases the value of RXE_MAX_MW that has been limited +unlike other parameters. + +Fixes: 0994a1bcd5f7 ("RDMA/rxe: Bump up default maximum values used via uverbs") +Link: https://lore.kernel.org/r/20221220080848.253785-2-matsuda-daisuke@fujitsu.com +Signed-off-by: Daisuke Matsuda +Tested-by: Li Zhijian +Reviewed-by: Li Zhijian +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_param.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index 86c7a8bf3cbb..fa41009ce8a9 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -91,11 +91,11 @@ enum rxe_device_param { + RXE_MAX_SRQ = DEFAULT_MAX_VALUE - RXE_MIN_SRQ_INDEX, + + RXE_MIN_MR_INDEX = 0x00000001, +- RXE_MAX_MR_INDEX = DEFAULT_MAX_VALUE, +- RXE_MAX_MR = DEFAULT_MAX_VALUE - RXE_MIN_MR_INDEX, +- RXE_MIN_MW_INDEX = 0x00010001, +- RXE_MAX_MW_INDEX = 0x00020000, +- RXE_MAX_MW = 0x00001000, ++ RXE_MAX_MR_INDEX = DEFAULT_MAX_VALUE >> 1, ++ RXE_MAX_MR = RXE_MAX_MR_INDEX - RXE_MIN_MR_INDEX, ++ RXE_MIN_MW_INDEX = RXE_MAX_MR_INDEX + 1, ++ RXE_MAX_MW_INDEX = DEFAULT_MAX_VALUE, ++ RXE_MAX_MW = RXE_MAX_MW_INDEX - RXE_MIN_MW_INDEX, + + RXE_MAX_PKT_PER_ACK = 64, + +-- +2.39.0 + diff --git a/queue-6.1/reset-ti-sci-honor-ti_sci_protocol-setting-when-not-.patch b/queue-6.1/reset-ti-sci-honor-ti_sci_protocol-setting-when-not-.patch new file mode 100644 index 00000000000..150c9176284 --- /dev/null +++ b/queue-6.1/reset-ti-sci-honor-ti_sci_protocol-setting-when-not-.patch @@ -0,0 +1,51 @@ +From a44f49ef2f70f4bd67de222f28e1f94c8c7c2776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Oct 2022 22:56:36 -0700 +Subject: reset: ti-sci: honor TI_SCI_PROTOCOL setting when not COMPILE_TEST + +From: Randy Dunlap + +[ Upstream commit 13678f3feb3009b23aab424864fd0dac0765c83e ] + +There is a build error when COMPILE_TEST=y, TI_SCI_PROTOCOL=m, +and RESET_TI_SCI=y: + +drivers/reset/reset-ti-sci.o: in function `ti_sci_reset_probe': +reset-ti-sci.c:(.text+0x22c): undefined reference to `devm_ti_sci_get_handle' + +Fix this by making RESET_TI_SCI honor the Kconfig setting of +TI_SCI_PROTOCOL when COMPILE_TEST is not set. When COMPILE_TEST is set, +TI_SCI_PROTOCOL must be disabled (=n). + +Fixes: a6af504184c9 ("reset: ti-sci: Allow building under COMPILE_TEST") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Nishanth Menon +Cc: Tero Kristo +Cc: Santosh Shilimkar +Cc: linux-arm-kernel@lists.infradead.org +Cc: Philipp Zabel +Reviewed-by: Nishanth Menon +Link: https://lore.kernel.org/r/20221030055636.3139-1-rdunlap@infradead.org +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig +index de176c2fbad9..2a52c990d4fe 100644 +--- a/drivers/reset/Kconfig ++++ b/drivers/reset/Kconfig +@@ -257,7 +257,7 @@ config RESET_SUNXI + + config RESET_TI_SCI + tristate "TI System Control Interface (TI-SCI) reset driver" +- depends on TI_SCI_PROTOCOL || COMPILE_TEST ++ depends on TI_SCI_PROTOCOL || (COMPILE_TEST && TI_SCI_PROTOCOL=n) + help + This enables the reset driver support over TI System Control Interface + available on some new TI's SoCs. If you wish to use reset resources +-- +2.39.0 + diff --git a/queue-6.1/reset-uniphier-glue-fix-possible-null-ptr-deref.patch b/queue-6.1/reset-uniphier-glue-fix-possible-null-ptr-deref.patch new file mode 100644 index 00000000000..45535c3c992 --- /dev/null +++ b/queue-6.1/reset-uniphier-glue-fix-possible-null-ptr-deref.patch @@ -0,0 +1,54 @@ +From a9933552ca4353cd0ddf2cf8e64d9c3f30cc1468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 08:49:58 +0800 +Subject: reset: uniphier-glue: Fix possible null-ptr-deref + +From: Hui Tang + +[ Upstream commit 3a2390c6777e3f6662980c6cfc25cafe9e4fef98 ] + +It will cause null-ptr-deref when resource_size(res) invoked, +if platform_get_resource() returns NULL. + +Fixes: 499fef09a323 ("reset: uniphier: add USB3 core reset control") +Signed-off-by: Hui Tang +Reviewed-by: Kunihiko Hayashi +Link: https://lore.kernel.org/r/20221114004958.258513-1-tanghui20@huawei.com +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/reset-uniphier-glue.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/reset/reset-uniphier-glue.c b/drivers/reset/reset-uniphier-glue.c +index 146fd5d45e99..15abac9fc72c 100644 +--- a/drivers/reset/reset-uniphier-glue.c ++++ b/drivers/reset/reset-uniphier-glue.c +@@ -47,7 +47,6 @@ static int uniphier_glue_reset_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct uniphier_glue_reset_priv *priv; + struct resource *res; +- resource_size_t size; + int i, ret; + + priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); +@@ -60,7 +59,6 @@ static int uniphier_glue_reset_probe(struct platform_device *pdev) + return -EINVAL; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- size = resource_size(res); + priv->rdata.membase = devm_ioremap_resource(dev, res); + if (IS_ERR(priv->rdata.membase)) + return PTR_ERR(priv->rdata.membase); +@@ -96,7 +94,7 @@ static int uniphier_glue_reset_probe(struct platform_device *pdev) + + spin_lock_init(&priv->rdata.lock); + priv->rdata.rcdev.owner = THIS_MODULE; +- priv->rdata.rcdev.nr_resets = size * BITS_PER_BYTE; ++ priv->rdata.rcdev.nr_resets = resource_size(res) * BITS_PER_BYTE; + priv->rdata.rcdev.ops = &reset_simple_ops; + priv->rdata.rcdev.of_node = dev->of_node; + priv->rdata.active_low = true; +-- +2.39.0 + diff --git a/queue-6.1/s390-debug-add-_asm_s390_-prefix-to-header-guard.patch b/queue-6.1/s390-debug-add-_asm_s390_-prefix-to-header-guard.patch new file mode 100644 index 00000000000..e697b702eb3 --- /dev/null +++ b/queue-6.1/s390-debug-add-_asm_s390_-prefix-to-header-guard.patch @@ -0,0 +1,46 @@ +From 3b7d4312d469238e641a8d4bf62368277120870a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 15:11:07 +0100 +Subject: s390/debug: add _ASM_S390_ prefix to header guard + +From: Niklas Schnelle + +[ Upstream commit 0d4d52361b6c29bf771acd4fa461f06d78fb2fac ] + +Using DEBUG_H without a prefix is very generic and inconsistent with +other header guards in arch/s390/include/asm. In fact it collides with +the same name in the ath9k wireless driver though that depends on !S390 +via disabled wireless support. Let's just use a consistent header guard +name and prevent possible future trouble. + +Signed-off-by: Niklas Schnelle +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/debug.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/include/asm/debug.h b/arch/s390/include/asm/debug.h +index 77f24262c25c..ac665b9670c5 100644 +--- a/arch/s390/include/asm/debug.h ++++ b/arch/s390/include/asm/debug.h +@@ -4,8 +4,8 @@ + * + * Copyright IBM Corp. 1999, 2020 + */ +-#ifndef DEBUG_H +-#define DEBUG_H ++#ifndef _ASM_S390_DEBUG_H ++#define _ASM_S390_DEBUG_H + + #include + #include +@@ -487,4 +487,4 @@ void debug_register_static(debug_info_t *id, int pages_per_area, int nr_areas); + + #endif /* MODULE */ + +-#endif /* DEBUG_H */ ++#endif /* _ASM_S390_DEBUG_H */ +-- +2.39.0 + diff --git a/queue-6.1/s390-expicitly-align-_edata-and-_end-symbols-on-page.patch b/queue-6.1/s390-expicitly-align-_edata-and-_end-symbols-on-page.patch new file mode 100644 index 00000000000..c395d002279 --- /dev/null +++ b/queue-6.1/s390-expicitly-align-_edata-and-_end-symbols-on-page.patch @@ -0,0 +1,56 @@ +From 2eb38cf374a748d56453d461355b07de4b45f4c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 17:15:19 +0100 +Subject: s390: expicitly align _edata and _end symbols on page boundary + +From: Alexander Gordeev + +[ Upstream commit 45d619bdaf799196d702a9ae464b07066d6db2f9 ] + +Symbols _edata and _end in the linker script are the +only unaligned expicitly on page boundary. Although +_end is aligned implicitly by BSS_SECTION macro that +is still inconsistent and could lead to a bug if a tool +or function would assume that _edata is as aligned as +others. + +For example, vmem_map_init() function does not align +symbols _etext, _einittext etc. Should these symbols +be unaligned as well, the size of ranges to update +were short on one page. + +Instead of fixing every occurrence of this kind in the +code and external tools just force the alignment on +these two symbols. + +Reviewed-by: Heiko Carstens +Signed-off-by: Alexander Gordeev +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vmlinux.lds.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index 5ea3830af0cc..f81d96710595 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -79,6 +79,7 @@ SECTIONS + _end_amode31_refs = .; + } + ++ . = ALIGN(PAGE_SIZE); + _edata = .; /* End of data section */ + + /* will be freed after init */ +@@ -193,6 +194,7 @@ SECTIONS + + BSS_SECTION(PAGE_SIZE, 4 * PAGE_SIZE, PAGE_SIZE) + ++ . = ALIGN(PAGE_SIZE); + _end = . ; + + /* +-- +2.39.0 + diff --git a/queue-6.1/sch_htb-avoid-grafting-on-htb_destroy_class_offload-.patch b/queue-6.1/sch_htb-avoid-grafting-on-htb_destroy_class_offload-.patch new file mode 100644 index 00000000000..8c1c1e37b86 --- /dev/null +++ b/queue-6.1/sch_htb-avoid-grafting-on-htb_destroy_class_offload-.patch @@ -0,0 +1,94 @@ +From 76d7374bbb049a3d32f6f3f65c2807f44c1caa1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 16:55:29 -0800 +Subject: sch_htb: Avoid grafting on htb_destroy_class_offload when destroying + htb + +From: Rahul Rameshbabu + +[ Upstream commit a22b7388d658ecfcd226600c8c34ce4481e88655 ] + +Peek at old qdisc and graft only when deleting a leaf class in the htb, +rather than when deleting the htb itself. Do not peek at the qdisc of the +netdev queue when destroying the htb. The caller may already have grafted a +new qdisc that is not part of the htb structure being destroyed. + +This fix resolves two use cases. + + 1. Using tc to destroy the htb. + - Netdev was being prematurely activated before the htb was fully + destroyed. + 2. Using tc to replace the htb with another qdisc (which also leads to + the htb being destroyed). + - Premature netdev activation like previous case. Newly grafted qdisc + was also getting accidentally overwritten when destroying the htb. + +Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload") +Signed-off-by: Rahul Rameshbabu +Reviewed-by: Saeed Mahameed +Reviewed-by: Maxim Mikityanskiy +Reviewed-by: Jiri Pirko +Link: https://lore.kernel.org/r/20230113005528.302625-1-rrameshbabu@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_htb.c | 27 ++++++++++++++++----------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c +index e5b4bbf3ce3d..3afac9c21a76 100644 +--- a/net/sched/sch_htb.c ++++ b/net/sched/sch_htb.c +@@ -1545,7 +1545,7 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl, + struct tc_htb_qopt_offload offload_opt; + struct netdev_queue *dev_queue; + struct Qdisc *q = cl->leaf.q; +- struct Qdisc *old = NULL; ++ struct Qdisc *old; + int err; + + if (cl->level) +@@ -1553,14 +1553,17 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl, + + WARN_ON(!q); + dev_queue = htb_offload_get_queue(cl); +- old = htb_graft_helper(dev_queue, NULL); +- if (destroying) +- /* Before HTB is destroyed, the kernel grafts noop_qdisc to +- * all queues. ++ /* When destroying, caller qdisc_graft grafts the new qdisc and invokes ++ * qdisc_put for the qdisc being destroyed. htb_destroy_class_offload ++ * does not need to graft or qdisc_put the qdisc being destroyed. ++ */ ++ if (!destroying) { ++ old = htb_graft_helper(dev_queue, NULL); ++ /* Last qdisc grafted should be the same as cl->leaf.q when ++ * calling htb_delete. + */ +- WARN_ON(!(old->flags & TCQ_F_BUILTIN)); +- else + WARN_ON(old != q); ++ } + + if (cl->parent) { + _bstats_update(&cl->parent->bstats_bias, +@@ -1577,10 +1580,12 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl, + }; + err = htb_offload(qdisc_dev(sch), &offload_opt); + +- if (!err || destroying) +- qdisc_put(old); +- else +- htb_graft_helper(dev_queue, old); ++ if (!destroying) { ++ if (!err) ++ qdisc_put(old); ++ else ++ htb_graft_helper(dev_queue, old); ++ } + + if (last_child) + return err; +-- +2.39.0 + diff --git a/queue-6.1/scsi-hisi_sas-set-a-port-invalid-only-if-there-are-n.patch b/queue-6.1/scsi-hisi_sas-set-a-port-invalid-only-if-there-are-n.patch new file mode 100644 index 00000000000..35c2318b514 --- /dev/null +++ b/queue-6.1/scsi-hisi_sas-set-a-port-invalid-only-if-there-are-n.patch @@ -0,0 +1,43 @@ +From 1f470c3332a61a4282f6a3733389256cf39dd0f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 12:03:20 +0800 +Subject: scsi: hisi_sas: Set a port invalid only if there are no devices + attached when refreshing port id + +From: Yihang Li + +[ Upstream commit f58c89700630da6554b24fd3df293a24874c10c1 ] + +Currently the driver sets the port invalid if one phy in the port is not +enabled, which may cause issues in expander situation. In directly attached +situation, if phy up doesn't occur in time when refreshing port id, the +port is incorrectly set to invalid which will also cause disk lost. + +Therefore set a port invalid only if there are no devices attached to the +port. + +Signed-off-by: Yihang Li +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1672805000-141102-3-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 34870b3286ab..02fa3c00dccc 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -1334,7 +1334,7 @@ static void hisi_sas_refresh_port_id(struct hisi_hba *hisi_hba) + device->linkrate = phy->sas_phy.linkrate; + + hisi_hba->hw->setup_itct(hisi_hba, sas_dev); +- } else ++ } else if (!port->port_attached) + port->id = 0xff; + } + } +-- +2.39.0 + diff --git a/queue-6.1/scsi-hisi_sas-use-abort-task-set-to-reset-sas-disks-.patch b/queue-6.1/scsi-hisi_sas-use-abort-task-set-to-reset-sas-disks-.patch new file mode 100644 index 00000000000..031d39cf2c9 --- /dev/null +++ b/queue-6.1/scsi-hisi_sas-use-abort-task-set-to-reset-sas-disks-.patch @@ -0,0 +1,39 @@ +From 712b853fea9626537ea9e2f230d0dcaf118534c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 12:03:19 +0800 +Subject: scsi: hisi_sas: Use abort task set to reset SAS disks when discovered + +From: Xingui Yang + +[ Upstream commit 037b48057e8b485a8d72f808122796aeadbbee32 ] + +Currently clear task set is used to abort all commands remaining in the +disk when the SAS disk is discovered, and if the disk is discovered by two +initiators, other I_T nexuses are also affected. So use abort task set +instead and take effect only on the specified I_T nexus. + +Signed-off-by: Xingui Yang +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1672805000-141102-2-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 699b07abb6b0..34870b3286ab 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -714,7 +714,7 @@ static int hisi_sas_init_device(struct domain_device *device) + int_to_scsilun(0, &lun); + + while (retry-- > 0) { +- rc = sas_clear_task_set(device, lun.scsi_lun); ++ rc = sas_abort_task_set(device, lun.scsi_lun); + if (rc == TMF_RESP_FUNC_COMPLETE) { + hisi_sas_release_task(hisi_hba, device); + break; +-- +2.39.0 + diff --git a/queue-6.1/scsi-iscsi-fix-multiple-iscsi-session-unbind-events-.patch b/queue-6.1/scsi-iscsi-fix-multiple-iscsi-session-unbind-events-.patch new file mode 100644 index 00000000000..efe8a83aac6 --- /dev/null +++ b/queue-6.1/scsi-iscsi-fix-multiple-iscsi-session-unbind-events-.patch @@ -0,0 +1,195 @@ +From 99423c8b0332039b42ba3eb98e1c02961423ed75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Nov 2022 09:07:52 +0800 +Subject: scsi: iscsi: Fix multiple iSCSI session unbind events sent to + userspace + +From: Wenchao Hao + +[ Upstream commit a3be19b91ea7121d388084e8c07f5b1b982eb40c ] + +It was observed that the kernel would potentially send +ISCSI_KEVENT_UNBIND_SESSION multiple times. Introduce 'target_state' in +iscsi_cls_session() to make sure session will send only one unbind session +event. + +This introduces a regression wrt. the issue fixed in commit 13e60d3ba287 +("scsi: iscsi: Report unbind session event when the target has been +removed"). If iscsid dies for any reason after sending an unbind session to +kernel, once iscsid is restarted, the kernel's ISCSI_KEVENT_UNBIND_SESSION +event is lost and userspace is then unable to logout. However, the session +is actually in invalid state (its target_id is INVALID) so iscsid should +not sync this session during restart. + +Consequently we need to check the session's target state during iscsid +restart. If session is in unbound state, do not sync this session and +perform session teardown. This is OK because once a session is unbound, we +can not recover it any more (mainly because its target id is INVALID). + +Signed-off-by: Wenchao Hao +Link: https://lore.kernel.org/r/20221126010752.231917-1-haowenchao@huawei.com +Reviewed-by: Mike Christie +Reviewed-by: Wu Bo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 50 ++++++++++++++++++++++++++--- + include/scsi/scsi_transport_iscsi.h | 9 ++++++ + 2 files changed, 54 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index f473c002fa4d..bf834e72595a 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -1677,6 +1677,13 @@ static const char *iscsi_session_state_name(int state) + return name; + } + ++static char *iscsi_session_target_state_name[] = { ++ [ISCSI_SESSION_TARGET_UNBOUND] = "UNBOUND", ++ [ISCSI_SESSION_TARGET_ALLOCATED] = "ALLOCATED", ++ [ISCSI_SESSION_TARGET_SCANNED] = "SCANNED", ++ [ISCSI_SESSION_TARGET_UNBINDING] = "UNBINDING", ++}; ++ + int iscsi_session_chkready(struct iscsi_cls_session *session) + { + int err; +@@ -1786,9 +1793,13 @@ static int iscsi_user_scan_session(struct device *dev, void *data) + if ((scan_data->channel == SCAN_WILD_CARD || + scan_data->channel == 0) && + (scan_data->id == SCAN_WILD_CARD || +- scan_data->id == id)) ++ scan_data->id == id)) { + scsi_scan_target(&session->dev, 0, id, + scan_data->lun, scan_data->rescan); ++ spin_lock_irqsave(&session->lock, flags); ++ session->target_state = ISCSI_SESSION_TARGET_SCANNED; ++ spin_unlock_irqrestore(&session->lock, flags); ++ } + } + + user_scan_exit: +@@ -1961,31 +1972,41 @@ static void __iscsi_unbind_session(struct work_struct *work) + struct iscsi_cls_host *ihost = shost->shost_data; + unsigned long flags; + unsigned int target_id; ++ bool remove_target = true; + + ISCSI_DBG_TRANS_SESSION(session, "Unbinding session\n"); + + /* Prevent new scans and make sure scanning is not in progress */ + mutex_lock(&ihost->mutex); + spin_lock_irqsave(&session->lock, flags); +- if (session->target_id == ISCSI_MAX_TARGET) { ++ if (session->target_state == ISCSI_SESSION_TARGET_ALLOCATED) { ++ remove_target = false; ++ } else if (session->target_state != ISCSI_SESSION_TARGET_SCANNED) { + spin_unlock_irqrestore(&session->lock, flags); + mutex_unlock(&ihost->mutex); +- goto unbind_session_exit; ++ ISCSI_DBG_TRANS_SESSION(session, ++ "Skipping target unbinding: Session is unbound/unbinding.\n"); ++ return; + } + ++ session->target_state = ISCSI_SESSION_TARGET_UNBINDING; + target_id = session->target_id; + session->target_id = ISCSI_MAX_TARGET; + spin_unlock_irqrestore(&session->lock, flags); + mutex_unlock(&ihost->mutex); + +- scsi_remove_target(&session->dev); ++ if (remove_target) ++ scsi_remove_target(&session->dev); + + if (session->ida_used) + ida_free(&iscsi_sess_ida, target_id); + +-unbind_session_exit: + iscsi_session_event(session, ISCSI_KEVENT_UNBIND_SESSION); + ISCSI_DBG_TRANS_SESSION(session, "Completed target removal\n"); ++ ++ spin_lock_irqsave(&session->lock, flags); ++ session->target_state = ISCSI_SESSION_TARGET_UNBOUND; ++ spin_unlock_irqrestore(&session->lock, flags); + } + + static void __iscsi_destroy_session(struct work_struct *work) +@@ -2062,6 +2083,9 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id) + session->ida_used = true; + } else + session->target_id = target_id; ++ spin_lock_irqsave(&session->lock, flags); ++ session->target_state = ISCSI_SESSION_TARGET_ALLOCATED; ++ spin_unlock_irqrestore(&session->lock, flags); + + dev_set_name(&session->dev, "session%u", session->sid); + err = device_add(&session->dev); +@@ -4369,6 +4393,19 @@ iscsi_session_attr(def_taskmgmt_tmo, ISCSI_PARAM_DEF_TASKMGMT_TMO, 0); + iscsi_session_attr(discovery_parent_idx, ISCSI_PARAM_DISCOVERY_PARENT_IDX, 0); + iscsi_session_attr(discovery_parent_type, ISCSI_PARAM_DISCOVERY_PARENT_TYPE, 0); + ++static ssize_t ++show_priv_session_target_state(struct device *dev, struct device_attribute *attr, ++ char *buf) ++{ ++ struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent); ++ ++ return sysfs_emit(buf, "%s\n", ++ iscsi_session_target_state_name[session->target_state]); ++} ++ ++static ISCSI_CLASS_ATTR(priv_sess, target_state, S_IRUGO, ++ show_priv_session_target_state, NULL); ++ + static ssize_t + show_priv_session_state(struct device *dev, struct device_attribute *attr, + char *buf) +@@ -4471,6 +4508,7 @@ static struct attribute *iscsi_session_attrs[] = { + &dev_attr_sess_boot_target.attr, + &dev_attr_priv_sess_recovery_tmo.attr, + &dev_attr_priv_sess_state.attr, ++ &dev_attr_priv_sess_target_state.attr, + &dev_attr_priv_sess_creator.attr, + &dev_attr_sess_chap_out_idx.attr, + &dev_attr_sess_chap_in_idx.attr, +@@ -4584,6 +4622,8 @@ static umode_t iscsi_session_attr_is_visible(struct kobject *kobj, + return S_IRUGO | S_IWUSR; + else if (attr == &dev_attr_priv_sess_state.attr) + return S_IRUGO; ++ else if (attr == &dev_attr_priv_sess_target_state.attr) ++ return S_IRUGO; + else if (attr == &dev_attr_priv_sess_creator.attr) + return S_IRUGO; + else if (attr == &dev_attr_priv_sess_target_id.attr) +diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h +index cab52b0f11d0..34c03707fb6e 100644 +--- a/include/scsi/scsi_transport_iscsi.h ++++ b/include/scsi/scsi_transport_iscsi.h +@@ -236,6 +236,14 @@ enum { + ISCSI_SESSION_FREE, + }; + ++enum { ++ ISCSI_SESSION_TARGET_UNBOUND, ++ ISCSI_SESSION_TARGET_ALLOCATED, ++ ISCSI_SESSION_TARGET_SCANNED, ++ ISCSI_SESSION_TARGET_UNBINDING, ++ ISCSI_SESSION_TARGET_MAX, ++}; ++ + #define ISCSI_MAX_TARGET -1 + + struct iscsi_cls_session { +@@ -264,6 +272,7 @@ struct iscsi_cls_session { + */ + pid_t creator; + int state; ++ int target_state; /* session target bind state */ + int sid; /* session id */ + void *dd_data; /* LLD private data */ + struct device dev; /* sysfs transport/container device */ +-- +2.39.0 + diff --git a/queue-6.1/selftests-net-toeplitz-fix-race-on-tpacket_v3-block-.patch b/queue-6.1/selftests-net-toeplitz-fix-race-on-tpacket_v3-block-.patch new file mode 100644 index 00000000000..8f970a9a27c --- /dev/null +++ b/queue-6.1/selftests-net-toeplitz-fix-race-on-tpacket_v3-block-.patch @@ -0,0 +1,88 @@ +From 1d9c83de400c3637dc06bcb4f00245a861f35085 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:18:47 -0500 +Subject: selftests/net: toeplitz: fix race on tpacket_v3 block close + +From: Willem de Bruijn + +[ Upstream commit 903848249a781d76d59561d51676c95b3a4d7162 ] + +Avoid race between process wakeup and tpacket_v3 block timeout. + +The test waits for cfg_timeout_msec for packets to arrive. Packets +arrive in tpacket_v3 rings, which pass packets ("frames") to the +process in batches ("blocks"). The sk waits for req3.tp_retire_blk_tov +msec to release a block. + +Set the block timeout lower than the process waiting time, else +the process may find that no block has been released by the time it +scans the socket list. Convert to a ring of more than one, smaller, +blocks with shorter timeouts. Blocks must be page aligned, so >= 64KB. + +Fixes: 5ebfb4cc3048 ("selftests/net: toeplitz test") +Signed-off-by: Willem de Bruijn +Link: https://lore.kernel.org/r/20230118151847.4124260-1-willemdebruijn.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/toeplitz.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/net/toeplitz.c b/tools/testing/selftests/net/toeplitz.c +index 90026a27eac0..9ba03164d73a 100644 +--- a/tools/testing/selftests/net/toeplitz.c ++++ b/tools/testing/selftests/net/toeplitz.c +@@ -215,7 +215,7 @@ static char *recv_frame(const struct ring_state *ring, char *frame) + } + + /* A single TPACKET_V3 block can hold multiple frames */ +-static void recv_block(struct ring_state *ring) ++static bool recv_block(struct ring_state *ring) + { + struct tpacket_block_desc *block; + char *frame; +@@ -223,7 +223,7 @@ static void recv_block(struct ring_state *ring) + + block = (void *)(ring->mmap + ring->idx * ring_block_sz); + if (!(block->hdr.bh1.block_status & TP_STATUS_USER)) +- return; ++ return false; + + frame = (char *)block; + frame += block->hdr.bh1.offset_to_first_pkt; +@@ -235,6 +235,8 @@ static void recv_block(struct ring_state *ring) + + block->hdr.bh1.block_status = TP_STATUS_KERNEL; + ring->idx = (ring->idx + 1) % ring_block_nr; ++ ++ return true; + } + + /* simple test: sleep once unconditionally and then process all rings */ +@@ -245,7 +247,7 @@ static void process_rings(void) + usleep(1000 * cfg_timeout_msec); + + for (i = 0; i < num_cpus; i++) +- recv_block(&rings[i]); ++ do {} while (recv_block(&rings[i])); + + fprintf(stderr, "count: pass=%u nohash=%u fail=%u\n", + frames_received - frames_nohash - frames_error, +@@ -257,12 +259,12 @@ static char *setup_ring(int fd) + struct tpacket_req3 req3 = {0}; + void *ring; + +- req3.tp_retire_blk_tov = cfg_timeout_msec; ++ req3.tp_retire_blk_tov = cfg_timeout_msec / 8; + req3.tp_feature_req_word = TP_FT_REQ_FILL_RXHASH; + + req3.tp_frame_size = 2048; + req3.tp_frame_nr = 1 << 10; +- req3.tp_block_nr = 2; ++ req3.tp_block_nr = 16; + + req3.tp_block_size = req3.tp_frame_size * req3.tp_frame_nr; + req3.tp_block_size /= req3.tp_block_nr; +-- +2.39.0 + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..e7879d9230b --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,194 @@ +memory-tegra-remove-clients-sid-override-programming.patch +memory-atmel-sdramc-fix-missing-clk_disable_unprepar.patch +memory-mvebu-devbus-fix-missing-clk_disable_unprepar.patch +arm64-dts-qcom-sc8280xp-fix-primary-usb-dp-phy-reset.patch +dmaengine-qcom-gpi-set-link_rx-bit-on-go-tre-for-rx-.patch +dmaengine-ti-k3-udma-do-conditional-decrement-of-udm.patch +soc-imx-imx8mp-blk-ctrl-enable-global-pixclk-with-hd.patch +arm64-dts-imx8mp-phycore-som-remove-invalid-pmic-pro.patch +arm-dts-imx6ul-pico-dwarf-use-clock-frequency.patch +arm-dts-imx7d-pico-use-clock-frequency.patch +arm-dts-imx6qdl-gw560x-remove-incorrect-uart-has-rts.patch +arm64-dts-verdin-imx8mm-fix-dahlia-audio-playback.patch +arm64-dts-imx8mm-beacon-fix-ecspi2-pinmux.patch +arm64-dts-verdin-imx8mm-fix-dev-board-audio-playback.patch +arm64-dts-imx93-11x11-evk-correct-clock-and-strobe-p.patch +arm-imx-add-missing-of_node_put.patch +soc-imx-imx8mp-blk-ctrl-don-t-set-power-device-name.patch +arm64-dts-imx8mp-fix-missing-gpc-interrupt.patch +arm64-dts-imx8mp-fix-power-domain-typo.patch +arm64-dts-imx8mp-evk-pcie0-refclk-cosmetic-cleanup.patch +hid-intel_ish-hid-add-check-for-ishtp_dma_tx_map.patch +arm64-dts-imx8mm-venice-gw7901-fix-usb2-controller-o.patch +soc-imx8m-fix-incorrect-check-for-of_clk_get_by_name.patch +reset-ti-sci-honor-ti_sci_protocol-setting-when-not-.patch +reset-uniphier-glue-fix-possible-null-ptr-deref.patch +edac-highbank-fix-memory-leak-in-highbank_mc_probe.patch +firmware-arm_scmi-harden-shared-memory-access-in-fet.patch +firmware-arm_scmi-harden-shared-memory-access-in-fet.patch-25512 +firmware-arm_scmi-fix-virtio-channels-cleanup-on-shu.patch +interconnect-qcom-msm8996-provide-ufs-clocks-to-a2no.patch +interconnect-qcom-msm8996-fix-regmap-max_register-va.patch +hid-amd_sfh-fix-warning-unwind-goto.patch +tomoyo-fix-broken-dependency-on-.conf.default.patch +blk-mq-move-the-srcu_struct-used-for-quiescing-to-th.patch +blk-crypto-pass-a-gendisk-to-blk_crypto_sysfs_-un-re.patch +block-factor-out-a-blk_debugfs_remove-helper.patch +block-fix-error-unwinding-in-blk_register_queue.patch +block-untangle-request_queue-refcounting-from-sysfs.patch +block-mark-blk_put_queue-as-potentially-blocking.patch +block-drop-spurious-might_sleep-from-blk_put_queue.patch +rdma-rxe-fix-inaccurate-constants-in-rxe_type_info.patch +rdma-rxe-prevent-faulty-rkey-generation.patch +erofs-fix-kvcalloc-misuse-with-__gfp_nofail.patch +arm64-dts-marvell-ac5-ac5x-fix-address-for-uart1.patch +rdma-core-fix-ib-block-iterator-counter-overflow.patch +ib-hfi1-reject-a-zero-length-user-expected-buffer.patch +ib-hfi1-reserve-user-expected-tids.patch +ib-hfi1-fix-expected-receive-setup-error-exit-issues.patch +ib-hfi1-immediately-remove-invalid-memory-from-hardw.patch +ib-hfi1-remove-user-expected-buffer-invalidate-race.patch +affs-initialize-fsdata-in-affs_truncate.patch +pm-avs-qcom-cpr-fix-an-error-handling-path-in-cpr_pr.patch +arm64-dts-qcom-msm8992-don-t-use-sfpb-mutex.patch +arm64-dts-qcom-msm8992-libra-fix-the-memory-map.patch +kbuild-export-top-level-ldflags_vmlinux-only-to-scri.patch +kbuild-fix-make-modules-error-when-config_debug_info.patch +phy-ti-fix-kconfig-warning-and-operator-precedence.patch +drm-msm-gpu-fix-potential-double-free.patch +nfsd-fix-use-after-free-in-nfsd4_ssc_setup_dul.patch +arm-dts-at91-sam9x60-fix-the-ddr-clock-for-sam9x60.patch +drm-vc4-bo-fix-drmm_mutex_init-memory-hog.patch +phy-usb-sunplus-fix-potential-null-ptr-deref-in-sp_u.patch +bpf-hash-map-avoid-deadlock-with-suitable-hash-mask.patch +amd-xgbe-tx-flow-ctrl-registers-are-h-w-ver-dependen.patch +amd-xgbe-delay-an-timeout-during-kr-training.patch +bpf-fix-pointer-leak-due-to-insufficient-speculative.patch +drm-vc4-bo-fix-unused-variable-warning.patch +phy-rockchip-inno-usb2-fix-missing-clk_disable_unpre.patch +net-nfc-fix-use-after-free-in-local_cleanup.patch +net-wan-add-checks-for-null-for-utdm-in-undo_uhdlc_i.patch +net-enetc-avoid-deadlock-in-enetc_tx_onestep_tstamp.patch +net-lan966x-add-missing-fwnode_handle_put-for-ports-.patch +sch_htb-avoid-grafting-on-htb_destroy_class_offload-.patch +gpio-mxc-protect-gpio-irqchip-rmw-with-bgpio-spinloc.patch +gpio-mxc-always-set-gpios-used-as-interrupt-source-t.patch +wifi-rndis_wlan-prevent-buffer-overflow-in-rndis_que.patch +pinctrl-rockchip-fix-reading-pull-type-on-rk3568.patch +net-stmmac-fix-queue-statistics-reading.patch +net-sched-sch_taprio-fix-possible-use-after-free.patch +l2tp-convert-l2tp_tunnel_list-to-idr.patch +l2tp-close-all-race-conditions-in-l2tp_tunnel_regist.patch +octeontx2-pf-avoid-use-of-gfp_kernel-in-atomic-conte.patch +net-usb-sr9700-handle-negative-len.patch +net-mdio-validate-parameter-addr-in-mdiobus_get_phy.patch +hid-check-empty-report_list-in-hid_validate_values.patch +hid-check-empty-report_list-in-bigben_probe.patch +net-stmmac-fix-invalid-call-to-mdiobus_get_phy.patch +pinctrl-rockchip-fix-mux-route-data-for-rk3568.patch +arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch +arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-13242 +arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-10870 +arm-dts-stm32-fix-qspi-pinctrl-phandle-for-stm32mp15.patch-20963 +hid-revert-cherry_mouse_000c-quirk.patch +block-rnbd-clt-fix-wrong-max-id-in-ida_alloc_max.patch +usb-ucsi-ensure-connector-delayed-work-items-are-flu.patch +usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch +usb-gadget-f_fs-ensure-ep0req-is-dequeued-before-fre.patch +netfilter-conntrack-handle-tcp-challenge-acks-during.patch +bluetooth-fix-a-buffer-overflow-in-mgmt_mesh_add.patch +bluetooth-hci_conn-fix-memory-leaks.patch +bluetooth-hci_sync-fix-memory-leak-in-hci_update_adv.patch +bluetooth-iso-avoid-circular-locking-dependency.patch +bluetooth-iso-fix-possible-circular-locking-dependen.patch +bluetooth-hci_event-fix-invalid-wait-context.patch +bluetooth-fix-possible-deadlock-in-rfcomm_sk_state_c.patch +net-ipa-disable-ipa-interrupt-during-suspend.patch +net-mlx5e-avoid-false-lock-dependency-warning-on-tc_.patch +net-mlx5-e-switch-fix-setting-of-reserved-fields-on-.patch +net-mlx5e-qos-fix-wrongfully-setting-parent_element_.patch +net-mlx5e-set-decap-action-based-on-attr-for-sample.patch +net-mlx5-e-switch-fix-switchdev-mode-after-devlink-r.patch +net-mlx5-eliminate-anonymous-module_init-module_exit.patch +drm-panfrost-fix-generic_atomic64-dependency.patch +dmaengine-fix-double-increment-of-client_count-in-dm.patch +net-macb-fix-ptp-tx-timestamp-failure-due-to-packet-.patch +virtio-net-correctly-enable-callback-during-start_xm.patch +l2tp-prevent-lockdep-issue-in-l2tp_tunnel_register.patch +hid-betop-check-shape-of-output-reports.patch +drm-i915-selftests-unwind-hugepages-to-drop-wakeref-.patch +cifs-fix-potential-deadlock-in-cache_refresh_path.patch +dmaengine-xilinx_dma-call-of_node_put-when-breaking-.patch +dmaengine-tegra-fix-memory-leak-in-terminate_all.patch +phy-phy-can-transceiver-skip-warning-if-no-max-bitra.patch +drm-amd-display-fix-issues-with-driver-unload.patch +net-sched-gred-prevent-races-when-adding-offloads-to.patch +nvme-pci-fix-timeout-request-state-check.patch +tcp-avoid-the-lookup-process-failing-to-get-sk-in-eh.patch +octeontx2-pf-fix-the-use-of-gfp_kernel-in-atomic-con.patch +usb-dwc3-fix-extcon-dependency.patch +ptdma-pt_core_execute_cmd-should-use-spinlock.patch +device-property-fix-of-node-refcount-leak-in-fwnode_.patch +w1-fix-deadloop-in-__w1_remove_master_device.patch +w1-fix-warning-after-calling-w1_process.patch +driver-core-fix-test_async_probe_init-saves-device-i.patch +selftests-net-toeplitz-fix-race-on-tpacket_v3-block-.patch +net-dsa-microchip-ksz9477-port-map-correction-in-alu.patch +thermal-validate-new-state-in-cur_state_store.patch +thermal-core-fix-error-code-in-__thermal_cooling_dev.patch +thermal-core-call-put_device-only-after-device_regis.patch +net-stmmac-enable-all-safety-features-by-default.patch +bnxt-do-not-read-past-the-end-of-test-names.patch +tcp-fix-rate_app_limited-to-default-to-1.patch +scsi-iscsi-fix-multiple-iscsi-session-unbind-events-.patch +asoc-sof-pm-set-target-state-earlier.patch +asoc-sof-pm-always-tear-down-pipelines-before-dsp-su.patch +asoc-sof-add-fw-state-to-debugfs.patch +asoc-amd-yc-add-razer-blade-14-2022-into-dmi-table.patch +spi-cadence-fix-busy-cycles-calculation.patch +cpufreq-cppc-add-u64-casts-to-avoid-overflowing.patch +cpufreq-add-tegra234-to-cpufreq-dt-platdev-blocklist.patch +asoc-mediatek-mt8186-support-rt5682s_max98360.patch +asoc-mediatek-mt8186-add-machine-support-for-max9835.patch +asoc-amd-yc-add-asus-m5402ra-into-dmi-table.patch +asoc-support-machine-driver-with-max98360.patch +kcsan-test-don-t-put-the-expect-array-on-the-stack.patch +cpufreq-add-sm6375-to-cpufreq-dt-platdev-blocklist.patch +asoc-fsl_micfil-correct-the-number-of-steps-on-sx-co.patch +drm-msm-a6xx-avoid-gx-gbit-halt-during-rpm-suspend.patch +net-usb-cdc_ether-add-support-for-thales-cinterion-p.patch +drm-add-orientation-quirk-for-lenovo-ideapad-d330-10.patch +s390-debug-add-_asm_s390_-prefix-to-header-guard.patch +s390-expicitly-align-_edata-and-_end-symbols-on-page.patch +xen-pvcalls-free-active-map-buffer-on-pvcalls_front_.patch +perf-x86-cstate-add-meteor-lake-support.patch +perf-x86-msr-add-meteor-lake-support.patch +perf-x86-msr-add-emerald-rapids.patch +perf-x86-intel-uncore-add-emerald-rapids.patch +nolibc-fix-fd_set-type.patch +tools-nolibc-fix-s_isxxx-macros.patch +tools-nolibc-fix-missing-includes-causing-build-issu.patch +tools-nolibc-prevent-gcc-from-making-memset-loop-ove.patch +cpufreq-armada-37xx-stop-using-0-as-null-pointer.patch +asoc-fsl_ssi-rename-ac-97-streams-to-avoid-collision.patch +asoc-fsl-asoc-card-fix-naming-of-ac-97-codec-widgets.patch +acpi-resource-skip-irq-override-on-asus-expertbook-b.patch +drm-amdkfd-add-sync-after-creating-vram-bo.patch +drm-amdkfd-fix-null-pointer-error-for-gc-11.0.1-on-m.patch +cifs-fix-potential-memory-leaks-in-session-setup.patch +spi-spidev-remove-debug-messages-that-access-spidev-.patch +kvm-s390-interrupt-use-read_once-before-cmpxchg.patch +scsi-hisi_sas-use-abort-task-set-to-reset-sas-disks-.patch +scsi-hisi_sas-set-a-port-invalid-only-if-there-are-n.patch +r8152-add-vendor-device-id-pair-for-microsoft-devkit.patch +platform-x86-touchscreen_dmi-add-info-for-the-csl-pa.patch +platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch +platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch-26863 +platform-x86-asus-wmi-add-quirk-wmi_ignore_fan.patch +platform-x86-asus-wmi-ignore-fan-on-e410ma.patch +platform-x86-simatic-ipc-correct-name-of-a-model.patch +platform-x86-simatic-ipc-add-another-model.patch +lockref-stop-doing-cpu_relax-in-the-cmpxchg-loop.patch +ata-pata_cs5535-don-t-build-on-uml.patch +firmware-coreboot-check-size-of-table-entry-and-use-.patch +btrfs-zoned-enable-metadata-over-commit-for-non-zns-.patch diff --git a/queue-6.1/soc-imx-imx8mp-blk-ctrl-don-t-set-power-device-name.patch b/queue-6.1/soc-imx-imx8mp-blk-ctrl-don-t-set-power-device-name.patch new file mode 100644 index 00000000000..c95aed34d62 --- /dev/null +++ b/queue-6.1/soc-imx-imx8mp-blk-ctrl-don-t-set-power-device-name.patch @@ -0,0 +1,38 @@ +From 8211bd6d2a4325475c53c466f8c6312aee9511a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 21:13:03 +0200 +Subject: soc: imx: imx8mp-blk-ctrl: don't set power device name + +From: Lucas Stach + +[ Upstream commit 21b84ebeee79d91e405f87f051e9489ef30ecad6 ] + +Setting the device name after it has been registered confuses the sysfs +cleanup paths. This has already been fixed for the imx8m-blk-ctrl driver in +b64b46fbaa1d ("Revert "soc: imx: imx8m-blk-ctrl: set power device name""), +but the same problem exists in imx8mp-blk-ctrl. + +Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") +Signed-off-by: Lucas Stach +Reviewed-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/imx8mp-blk-ctrl.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/soc/imx/imx8mp-blk-ctrl.c b/drivers/soc/imx/imx8mp-blk-ctrl.c +index 9852714eb2a4..0f13853901df 100644 +--- a/drivers/soc/imx/imx8mp-blk-ctrl.c ++++ b/drivers/soc/imx/imx8mp-blk-ctrl.c +@@ -592,7 +592,6 @@ static int imx8mp_blk_ctrl_probe(struct platform_device *pdev) + ret = PTR_ERR(domain->power_dev); + goto cleanup_pds; + } +- dev_set_name(domain->power_dev, "%s", data->name); + + domain->genpd.name = data->name; + domain->genpd.power_on = imx8mp_blk_ctrl_power_on; +-- +2.39.0 + diff --git a/queue-6.1/soc-imx-imx8mp-blk-ctrl-enable-global-pixclk-with-hd.patch b/queue-6.1/soc-imx-imx8mp-blk-ctrl-enable-global-pixclk-with-hd.patch new file mode 100644 index 00000000000..583ac58d22a --- /dev/null +++ b/queue-6.1/soc-imx-imx8mp-blk-ctrl-enable-global-pixclk-with-hd.patch @@ -0,0 +1,63 @@ +From e1efb6d98d0a9a772151cf9e63c3fbae113e7292 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Dec 2022 13:40:25 +0800 +Subject: soc: imx: imx8mp-blk-ctrl: enable global pixclk with HDMI_TX_PHY PD + +From: Lucas Stach + +[ Upstream commit b814eda949c324791580003303aa608761cfde3f ] + +NXP internal information shows that the PHY refclk is gated by the +GLOBAL_TX_PIX_CLK_EN bit, so to allow the PHY PLL to lock without the +LCDIF being already active, tie this bit to the HDMI_TX_PHY power +domain. + +Fixes: e3442022f543 ("soc: imx: add i.MX8MP HDMI blk-ctrl") +Signed-off-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/imx8mp-blk-ctrl.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/imx/imx8mp-blk-ctrl.c b/drivers/soc/imx/imx8mp-blk-ctrl.c +index 0e3b6ba22f94..9852714eb2a4 100644 +--- a/drivers/soc/imx/imx8mp-blk-ctrl.c ++++ b/drivers/soc/imx/imx8mp-blk-ctrl.c +@@ -212,7 +212,7 @@ static void imx8mp_hdmi_blk_ctrl_power_on(struct imx8mp_blk_ctrl *bc, + break; + case IMX8MP_HDMIBLK_PD_LCDIF: + regmap_set_bits(bc->regmap, HDMI_RTX_CLK_CTL0, +- BIT(7) | BIT(16) | BIT(17) | BIT(18) | ++ BIT(16) | BIT(17) | BIT(18) | + BIT(19) | BIT(20)); + regmap_set_bits(bc->regmap, HDMI_RTX_CLK_CTL1, BIT(11)); + regmap_set_bits(bc->regmap, HDMI_RTX_RESET_CTL0, +@@ -241,6 +241,7 @@ static void imx8mp_hdmi_blk_ctrl_power_on(struct imx8mp_blk_ctrl *bc, + regmap_set_bits(bc->regmap, HDMI_TX_CONTROL0, BIT(1)); + break; + case IMX8MP_HDMIBLK_PD_HDMI_TX_PHY: ++ regmap_set_bits(bc->regmap, HDMI_RTX_CLK_CTL0, BIT(7)); + regmap_set_bits(bc->regmap, HDMI_RTX_CLK_CTL1, BIT(22) | BIT(24)); + regmap_set_bits(bc->regmap, HDMI_RTX_RESET_CTL0, BIT(12)); + regmap_clear_bits(bc->regmap, HDMI_TX_CONTROL0, BIT(3)); +@@ -270,7 +271,7 @@ static void imx8mp_hdmi_blk_ctrl_power_off(struct imx8mp_blk_ctrl *bc, + BIT(4) | BIT(5) | BIT(6)); + regmap_clear_bits(bc->regmap, HDMI_RTX_CLK_CTL1, BIT(11)); + regmap_clear_bits(bc->regmap, HDMI_RTX_CLK_CTL0, +- BIT(7) | BIT(16) | BIT(17) | BIT(18) | ++ BIT(16) | BIT(17) | BIT(18) | + BIT(19) | BIT(20)); + break; + case IMX8MP_HDMIBLK_PD_PAI: +@@ -298,6 +299,7 @@ static void imx8mp_hdmi_blk_ctrl_power_off(struct imx8mp_blk_ctrl *bc, + case IMX8MP_HDMIBLK_PD_HDMI_TX_PHY: + regmap_set_bits(bc->regmap, HDMI_TX_CONTROL0, BIT(3)); + regmap_clear_bits(bc->regmap, HDMI_RTX_RESET_CTL0, BIT(12)); ++ regmap_clear_bits(bc->regmap, HDMI_RTX_CLK_CTL0, BIT(7)); + regmap_clear_bits(bc->regmap, HDMI_RTX_CLK_CTL1, BIT(22) | BIT(24)); + break; + case IMX8MP_HDMIBLK_PD_HDCP: +-- +2.39.0 + diff --git a/queue-6.1/soc-imx8m-fix-incorrect-check-for-of_clk_get_by_name.patch b/queue-6.1/soc-imx8m-fix-incorrect-check-for-of_clk_get_by_name.patch new file mode 100644 index 00000000000..451a7b22e32 --- /dev/null +++ b/queue-6.1/soc-imx8m-fix-incorrect-check-for-of_clk_get_by_name.patch @@ -0,0 +1,38 @@ +From 5046833a17423d64789bbe0d9670b0e61b7e08a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Dec 2022 13:58:48 +0400 +Subject: soc: imx8m: Fix incorrect check for of_clk_get_by_name() + +From: Miaoqian Lin + +[ Upstream commit 490748874ebf1875420fc29b335bba2075dd1b5e ] + +of_clk_get_by_name() returns error pointers instead of NULL. +Use IS_ERR() checks the return value to catch errors. + +Fixes: 836fb30949d9 ("soc: imx8m: Enable OCOTP clock before reading the register") +Signed-off-by: Miaoqian Lin +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index 28144c699b0c..32ed9dc88e45 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -66,8 +66,8 @@ static u32 __init imx8mq_soc_revision(void) + ocotp_base = of_iomap(np, 0); + WARN_ON(!ocotp_base); + clk = of_clk_get_by_name(np, NULL); +- if (!clk) { +- WARN_ON(!clk); ++ if (IS_ERR(clk)) { ++ WARN_ON(IS_ERR(clk)); + return 0; + } + +-- +2.39.0 + diff --git a/queue-6.1/spi-cadence-fix-busy-cycles-calculation.patch b/queue-6.1/spi-cadence-fix-busy-cycles-calculation.patch new file mode 100644 index 00000000000..3d233f7e6fb --- /dev/null +++ b/queue-6.1/spi-cadence-fix-busy-cycles-calculation.patch @@ -0,0 +1,44 @@ +From 9c4dbef3ee41f1187a9dbfbe8660509b9a2433f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 06:42:48 -0800 +Subject: spi: cadence: Fix busy cycles calculation + +From: Witold Sadowski + +[ Upstream commit e8bb8f19e73a1e855e54788f8673b9b49e46b5cd ] + +If xSPI is in x2/x4/x8 mode to calculate busy +cycles, busy bits count must be divided by the number +of lanes. +If opcommand is using 8 busy bits, but SPI is +in x4 mode, there will be only 2 busy cycles. + +Signed-off-by: Witold Sadowski +Reviewed-by: Chandrakala Chavva +Reviewed-by: Sunil Kovvuri Goutham +Link: https://lore.kernel.org/r/20221219144254.20883-2-wsadowski@marvell.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence-xspi.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-cadence-xspi.c b/drivers/spi/spi-cadence-xspi.c +index 9e187f9c6c95..d28b8bd5b70b 100644 +--- a/drivers/spi/spi-cadence-xspi.c ++++ b/drivers/spi/spi-cadence-xspi.c +@@ -177,7 +177,10 @@ + #define CDNS_XSPI_CMD_FLD_DSEQ_CMD_3(op) ( \ + FIELD_PREP(CDNS_XSPI_CMD_DSEQ_R3_DCNT_H, \ + ((op)->data.nbytes >> 16) & 0xffff) | \ +- FIELD_PREP(CDNS_XSPI_CMD_DSEQ_R3_NUM_OF_DUMMY, (op)->dummy.nbytes * 8)) ++ FIELD_PREP(CDNS_XSPI_CMD_DSEQ_R3_NUM_OF_DUMMY, \ ++ (op)->dummy.buswidth != 0 ? \ ++ (((op)->dummy.nbytes * 8) / (op)->dummy.buswidth) : \ ++ 0)) + + #define CDNS_XSPI_CMD_FLD_DSEQ_CMD_4(op, chipsel) ( \ + FIELD_PREP(CDNS_XSPI_CMD_DSEQ_R4_BANK, chipsel) | \ +-- +2.39.0 + diff --git a/queue-6.1/spi-spidev-remove-debug-messages-that-access-spidev-.patch b/queue-6.1/spi-spidev-remove-debug-messages-that-access-spidev-.patch new file mode 100644 index 00000000000..1580494ba30 --- /dev/null +++ b/queue-6.1/spi-spidev-remove-debug-messages-that-access-spidev-.patch @@ -0,0 +1,46 @@ +From 1990a280a0eeaabb2e4070c88185e85e0baa57f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 11:07:19 +0100 +Subject: spi: spidev: remove debug messages that access spidev->spi without + locking + +From: Bartosz Golaszewski + +[ Upstream commit 6b35b173dbc1711f8d272e3f322d2ad697015919 ] + +The two debug messages in spidev_open() dereference spidev->spi without +taking the lock and without checking if it's not null. This can lead to +a crash. Drop the messages as they're not needed - the user-space will +get informed about ENOMEM with the syscall return value. + +Signed-off-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20230106100719.196243-2-brgl@bgdev.pl +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 6313e7d0cdf8..71c3db60e968 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -601,7 +601,6 @@ static int spidev_open(struct inode *inode, struct file *filp) + if (!spidev->tx_buffer) { + spidev->tx_buffer = kmalloc(bufsiz, GFP_KERNEL); + if (!spidev->tx_buffer) { +- dev_dbg(&spidev->spi->dev, "open/ENOMEM\n"); + status = -ENOMEM; + goto err_find_dev; + } +@@ -610,7 +609,6 @@ static int spidev_open(struct inode *inode, struct file *filp) + if (!spidev->rx_buffer) { + spidev->rx_buffer = kmalloc(bufsiz, GFP_KERNEL); + if (!spidev->rx_buffer) { +- dev_dbg(&spidev->spi->dev, "open/ENOMEM\n"); + status = -ENOMEM; + goto err_alloc_rx_buf; + } +-- +2.39.0 + diff --git a/queue-6.1/tcp-avoid-the-lookup-process-failing-to-get-sk-in-eh.patch b/queue-6.1/tcp-avoid-the-lookup-process-failing-to-get-sk-in-eh.patch new file mode 100644 index 00000000000..8fcb3509dc0 --- /dev/null +++ b/queue-6.1/tcp-avoid-the-lookup-process-failing-to-get-sk-in-eh.patch @@ -0,0 +1,121 @@ +From e9c3f71baba9a3919d87c79354f3bc41b273f030 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 09:59:41 +0800 +Subject: tcp: avoid the lookup process failing to get sk in ehash table + +From: Jason Xing + +[ Upstream commit 3f4ca5fafc08881d7a57daa20449d171f2887043 ] + +While one cpu is working on looking up the right socket from ehash +table, another cpu is done deleting the request socket and is about +to add (or is adding) the big socket from the table. It means that +we could miss both of them, even though it has little chance. + +Let me draw a call trace map of the server side. + CPU 0 CPU 1 + ----- ----- +tcp_v4_rcv() syn_recv_sock() + inet_ehash_insert() + -> sk_nulls_del_node_init_rcu(osk) +__inet_lookup_established() + -> __sk_nulls_add_node_rcu(sk, list) + +Notice that the CPU 0 is receiving the data after the final ack +during 3-way shakehands and CPU 1 is still handling the final ack. + +Why could this be a real problem? +This case is happening only when the final ack and the first data +receiving by different CPUs. Then the server receiving data with +ACK flag tries to search one proper established socket from ehash +table, but apparently it fails as my map shows above. After that, +the server fetches a listener socket and then sends a RST because +it finds a ACK flag in the skb (data), which obeys RST definition +in RFC 793. + +Besides, Eric pointed out there's one more race condition where it +handles tw socket hashdance. Only by adding to the tail of the list +before deleting the old one can we avoid the race if the reader has +already begun the bucket traversal and it would possibly miss the head. + +Many thanks to Eric for great help from beginning to end. + +Fixes: 5e0724d027f0 ("tcp/dccp: fix hashdance race for passive sessions") +Suggested-by: Eric Dumazet +Signed-off-by: Jason Xing +Reviewed-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/lkml/20230112065336.41034-1-kerneljasonxing@gmail.com/ +Link: https://lore.kernel.org/r/20230118015941.1313-1-kerneljasonxing@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 17 +++++++++++++++-- + net/ipv4/inet_timewait_sock.c | 8 ++++---- + 2 files changed, 19 insertions(+), 6 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 67f5e5440802..a5711b8f4cb1 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -650,8 +650,20 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) + spin_lock(lock); + if (osk) { + WARN_ON_ONCE(sk->sk_hash != osk->sk_hash); +- ret = sk_nulls_del_node_init_rcu(osk); +- } else if (found_dup_sk) { ++ ret = sk_hashed(osk); ++ if (ret) { ++ /* Before deleting the node, we insert a new one to make ++ * sure that the look-up-sk process would not miss either ++ * of them and that at least one node would exist in ehash ++ * table all the time. Otherwise there's a tiny chance ++ * that lookup process could find nothing in ehash table. ++ */ ++ __sk_nulls_add_node_tail_rcu(sk, list); ++ sk_nulls_del_node_init_rcu(osk); ++ } ++ goto unlock; ++ } ++ if (found_dup_sk) { + *found_dup_sk = inet_ehash_lookup_by_sk(sk, list); + if (*found_dup_sk) + ret = false; +@@ -660,6 +672,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) + if (ret) + __sk_nulls_add_node_rcu(sk, list); + ++unlock: + spin_unlock(lock); + + return ret; +diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c +index 1d77d992e6e7..beed32fff484 100644 +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -91,10 +91,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw) + } + EXPORT_SYMBOL_GPL(inet_twsk_put); + +-static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw, +- struct hlist_nulls_head *list) ++static void inet_twsk_add_node_tail_rcu(struct inet_timewait_sock *tw, ++ struct hlist_nulls_head *list) + { +- hlist_nulls_add_head_rcu(&tw->tw_node, list); ++ hlist_nulls_add_tail_rcu(&tw->tw_node, list); + } + + static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw, +@@ -147,7 +147,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, + + spin_lock(lock); + +- inet_twsk_add_node_rcu(tw, &ehead->chain); ++ inet_twsk_add_node_tail_rcu(tw, &ehead->chain); + + /* Step 3: Remove SK from hash chain */ + if (__sk_nulls_del_node_init_rcu(sk)) +-- +2.39.0 + diff --git a/queue-6.1/tcp-fix-rate_app_limited-to-default-to-1.patch b/queue-6.1/tcp-fix-rate_app_limited-to-default-to-1.patch new file mode 100644 index 00000000000..f8cca511770 --- /dev/null +++ b/queue-6.1/tcp-fix-rate_app_limited-to-default-to-1.patch @@ -0,0 +1,51 @@ +From 30b5bd315315ee881c30312c7dac518d2484a42f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 19:00:28 +0000 +Subject: tcp: fix rate_app_limited to default to 1 + +From: David Morley + +[ Upstream commit 300b655db1b5152d6101bcb6801d50899b20c2d6 ] + +The initial default value of 0 for tp->rate_app_limited was incorrect, +since a flow is indeed application-limited until it first sends +data. Fixing the default to be 1 is generally correct but also +specifically will help user-space applications avoid using the initial +tcpi_delivery_rate value of 0 that persists until the connection has +some non-zero bandwidth sample. + +Fixes: eb8329e0a04d ("tcp: export data delivery rate") +Suggested-by: Yuchung Cheng +Signed-off-by: David Morley +Signed-off-by: Neal Cardwell +Tested-by: David Morley +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 4f2205756cfe..ec19ed722453 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -435,6 +435,7 @@ void tcp_init_sock(struct sock *sk) + + /* There's a bubble in the pipe until at least the first ACK. */ + tp->app_limited = ~0U; ++ tp->rate_app_limited = 1; + + /* See draft-stevens-tcpca-spec-01 for discussion of the + * initialization of these values. +@@ -3177,6 +3178,7 @@ int tcp_disconnect(struct sock *sk, int flags) + tp->last_oow_ack_time = 0; + /* There's a bubble in the pipe until at least the first ACK. */ + tp->app_limited = ~0U; ++ tp->rate_app_limited = 1; + tp->rack.mstamp = 0; + tp->rack.advanced = 0; + tp->rack.reo_wnd_steps = 1; +-- +2.39.0 + diff --git a/queue-6.1/thermal-core-call-put_device-only-after-device_regis.patch b/queue-6.1/thermal-core-call-put_device-only-after-device_regis.patch new file mode 100644 index 00000000000..a2ff6036278 --- /dev/null +++ b/queue-6.1/thermal-core-call-put_device-only-after-device_regis.patch @@ -0,0 +1,72 @@ +From 4b1e5da7771593af4028d8e251464b82c97393df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 14:08:24 +0530 +Subject: thermal: core: call put_device() only after device_register() fails + +From: Viresh Kumar + +[ Upstream commit 6c54b7bc8a31ce0f7cc7f8deef05067df414f1d8 ] + +put_device() shouldn't be called before a prior call to +device_register(). __thermal_cooling_device_register() doesn't follow +that properly and needs fixing. Also +thermal_cooling_device_destroy_sysfs() is getting called unnecessarily +on few error paths. + +Fix all this by placing the calls at the right place. + +Based on initial work done by Caleb Connolly. + +Fixes: 4748f9687caa ("thermal: core: fix some possible name leaks in error paths") +Fixes: c408b3d1d9bb ("thermal: Validate new state in cur_state_store()") +Reported-by: Caleb Connolly +Signed-off-by: Viresh Kumar +Tested-by: Frank Rowand +Reviewed-by: Yang Yingliang +Tested-by: Caleb Connolly +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_core.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 449e60c4a1b6..1eae4ec719a8 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -893,15 +893,20 @@ __thermal_cooling_device_register(struct device_node *np, + cdev->devdata = devdata; + + ret = cdev->ops->get_max_state(cdev, &cdev->max_state); +- if (ret) +- goto out_kfree_type; ++ if (ret) { ++ kfree(cdev->type); ++ goto out_ida_remove; ++ } + + thermal_cooling_device_setup_sysfs(cdev); ++ + ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id); + if (ret) { ++ kfree(cdev->type); + thermal_cooling_device_destroy_sysfs(cdev); +- goto out_kfree_type; ++ goto out_ida_remove; + } ++ + ret = device_register(&cdev->device); + if (ret) + goto out_kfree_type; +@@ -927,6 +932,8 @@ __thermal_cooling_device_register(struct device_node *np, + thermal_cooling_device_destroy_sysfs(cdev); + kfree(cdev->type); + put_device(&cdev->device); ++ ++ /* thermal_release() takes care of the rest */ + cdev = NULL; + out_ida_remove: + ida_free(&thermal_cdev_ida, id); +-- +2.39.0 + diff --git a/queue-6.1/thermal-core-fix-error-code-in-__thermal_cooling_dev.patch b/queue-6.1/thermal-core-fix-error-code-in-__thermal_cooling_dev.patch new file mode 100644 index 00000000000..a8e42c43ff6 --- /dev/null +++ b/queue-6.1/thermal-core-fix-error-code-in-__thermal_cooling_dev.patch @@ -0,0 +1,38 @@ +From 100030a97b6a9a95a4ddd8d9a0ab8f96fdd5a552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Oct 2022 18:02:34 +0300 +Subject: thermal/core: fix error code in __thermal_cooling_device_register() + +From: Dan Carpenter + +[ Upstream commit e49a1e1ee078aee21006192076a8d93335e0daa9 ] + +Return an error pointer if ->get_max_state() fails. The current code +returns NULL which will cause an oops in the callers. + +Fixes: c408b3d1d9bb ("thermal: Validate new state in cur_state_store()") +Signed-off-by: Dan Carpenter +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 6c54b7bc8a31 ("thermal: core: call put_device() only after device_register() fails") +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 328da2f1d339..449e60c4a1b6 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -892,7 +892,8 @@ __thermal_cooling_device_register(struct device_node *np, + cdev->device.class = &thermal_class; + cdev->devdata = devdata; + +- if (cdev->ops->get_max_state(cdev, &cdev->max_state)) ++ ret = cdev->ops->get_max_state(cdev, &cdev->max_state); ++ if (ret) + goto out_kfree_type; + + thermal_cooling_device_setup_sysfs(cdev); +-- +2.39.0 + diff --git a/queue-6.1/thermal-validate-new-state-in-cur_state_store.patch b/queue-6.1/thermal-validate-new-state-in-cur_state_store.patch new file mode 100644 index 00000000000..5e1ceefe2df --- /dev/null +++ b/queue-6.1/thermal-validate-new-state-in-cur_state_store.patch @@ -0,0 +1,136 @@ +From 23ddfcc91e1bfcfe721f59883181604004af390a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 15:33:01 +0530 +Subject: thermal: Validate new state in cur_state_store() + +From: Viresh Kumar + +[ Upstream commit c408b3d1d9bbc7de5fb0304fea424ef2539da616 ] + +In cur_state_store(), the new state of the cooling device is received +from user-space and is not validated by the thermal core but the same is +left for the individual drivers to take care of. Apart from duplicating +the code it leaves possibility for introducing bugs where a driver may +not do it right. + +Lets make the thermal core check the new state itself and store the max +value in the cooling device structure. + +Link: https://lore.kernel.org/all/Y0ltRJRjO7AkawvE@kili/ +Reported-by: Dan Carpenter +Signed-off-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 6c54b7bc8a31 ("thermal: core: call put_device() only after device_register() fails") +Signed-off-by: Sasha Levin +--- + drivers/thermal/gov_fair_share.c | 6 +----- + drivers/thermal/thermal_core.c | 15 +++++++-------- + drivers/thermal/thermal_sysfs.c | 11 +++++------ + include/linux/thermal.h | 1 + + 4 files changed, 14 insertions(+), 19 deletions(-) + +diff --git a/drivers/thermal/gov_fair_share.c b/drivers/thermal/gov_fair_share.c +index a4ee4661e9cc..1cfeac16e7ac 100644 +--- a/drivers/thermal/gov_fair_share.c ++++ b/drivers/thermal/gov_fair_share.c +@@ -49,11 +49,7 @@ static int get_trip_level(struct thermal_zone_device *tz) + static long get_target_state(struct thermal_zone_device *tz, + struct thermal_cooling_device *cdev, int percentage, int level) + { +- unsigned long max_state; +- +- cdev->ops->get_max_state(cdev, &max_state); +- +- return (long)(percentage * level * max_state) / (100 * tz->num_trips); ++ return (long)(percentage * level * cdev->max_state) / (100 * tz->num_trips); + } + + /** +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index 615fdda3a5de..328da2f1d339 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -603,8 +603,7 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz, + struct thermal_instance *pos; + struct thermal_zone_device *pos1; + struct thermal_cooling_device *pos2; +- unsigned long max_state; +- int result, ret; ++ int result; + + if (trip >= tz->num_trips || trip < 0) + return -EINVAL; +@@ -621,15 +620,11 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz, + if (tz != pos1 || cdev != pos2) + return -EINVAL; + +- ret = cdev->ops->get_max_state(cdev, &max_state); +- if (ret) +- return ret; +- + /* lower default 0, upper default max_state */ + lower = lower == THERMAL_NO_LIMIT ? 0 : lower; +- upper = upper == THERMAL_NO_LIMIT ? max_state : upper; ++ upper = upper == THERMAL_NO_LIMIT ? cdev->max_state : upper; + +- if (lower > upper || upper > max_state) ++ if (lower > upper || upper > cdev->max_state) + return -EINVAL; + + dev = kzalloc(sizeof(*dev), GFP_KERNEL); +@@ -896,6 +891,10 @@ __thermal_cooling_device_register(struct device_node *np, + cdev->updated = false; + cdev->device.class = &thermal_class; + cdev->devdata = devdata; ++ ++ if (cdev->ops->get_max_state(cdev, &cdev->max_state)) ++ goto out_kfree_type; ++ + thermal_cooling_device_setup_sysfs(cdev); + ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id); + if (ret) { +diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c +index ec495c7dff03..bd7596125461 100644 +--- a/drivers/thermal/thermal_sysfs.c ++++ b/drivers/thermal/thermal_sysfs.c +@@ -589,13 +589,8 @@ static ssize_t max_state_show(struct device *dev, struct device_attribute *attr, + char *buf) + { + struct thermal_cooling_device *cdev = to_cooling_device(dev); +- unsigned long state; +- int ret; + +- ret = cdev->ops->get_max_state(cdev, &state); +- if (ret) +- return ret; +- return sprintf(buf, "%ld\n", state); ++ return sprintf(buf, "%ld\n", cdev->max_state); + } + + static ssize_t cur_state_show(struct device *dev, struct device_attribute *attr, +@@ -625,6 +620,10 @@ cur_state_store(struct device *dev, struct device_attribute *attr, + if ((long)state < 0) + return -EINVAL; + ++ /* Requested state should be less than max_state + 1 */ ++ if (state > cdev->max_state) ++ return -EINVAL; ++ + mutex_lock(&cdev->lock); + + result = cdev->ops->set_cur_state(cdev, state); +diff --git a/include/linux/thermal.h b/include/linux/thermal.h +index 9ecc128944a1..5e093602e8fc 100644 +--- a/include/linux/thermal.h ++++ b/include/linux/thermal.h +@@ -100,6 +100,7 @@ struct thermal_cooling_device_ops { + struct thermal_cooling_device { + int id; + char *type; ++ unsigned long max_state; + struct device device; + struct device_node *np; + void *devdata; +-- +2.39.0 + diff --git a/queue-6.1/tomoyo-fix-broken-dependency-on-.conf.default.patch b/queue-6.1/tomoyo-fix-broken-dependency-on-.conf.default.patch new file mode 100644 index 00000000000..0a03a90575f --- /dev/null +++ b/queue-6.1/tomoyo-fix-broken-dependency-on-.conf.default.patch @@ -0,0 +1,61 @@ +From bd7671b9d661c1c21fdc3991da75909846cd47e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jan 2023 16:47:41 +0900 +Subject: tomoyo: fix broken dependency on *.conf.default + +From: Masahiro Yamada + +[ Upstream commit eaf2213ba563b2d74a1f2c13a6b258273f689802 ] + +If *.conf.default is updated, builtin-policy.h should be rebuilt, +but this does not work when compiled with O= option. + +[Without this commit] + + $ touch security/tomoyo/policy/exception_policy.conf.default + $ make O=/tmp security/tomoyo/ + make[1]: Entering directory '/tmp' + GEN Makefile + CALL /home/masahiro/ref/linux/scripts/checksyscalls.sh + DESCEND objtool + make[1]: Leaving directory '/tmp' + +[With this commit] + + $ touch security/tomoyo/policy/exception_policy.conf.default + $ make O=/tmp security/tomoyo/ + make[1]: Entering directory '/tmp' + GEN Makefile + CALL /home/masahiro/ref/linux/scripts/checksyscalls.sh + DESCEND objtool + POLICY security/tomoyo/builtin-policy.h + CC security/tomoyo/common.o + AR security/tomoyo/built-in.a + make[1]: Leaving directory '/tmp' + +$(srctree)/ is essential because $(wildcard ) does not follow VPATH. + +Fixes: f02dee2d148b ("tomoyo: Do not generate empty policy files") +Signed-off-by: Masahiro Yamada +Signed-off-by: Tetsuo Handa +Signed-off-by: Sasha Levin +--- + security/tomoyo/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/tomoyo/Makefile b/security/tomoyo/Makefile +index cca5a3012fee..221eaadffb09 100644 +--- a/security/tomoyo/Makefile ++++ b/security/tomoyo/Makefile +@@ -10,7 +10,7 @@ endef + quiet_cmd_policy = POLICY $@ + cmd_policy = ($(call do_policy,profile); $(call do_policy,exception_policy); $(call do_policy,domain_policy); $(call do_policy,manager); $(call do_policy,stat)) >$@ + +-$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(src)/policy/*.conf.default) FORCE ++$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(srctree)/$(src)/policy/*.conf.default) FORCE + $(call if_changed,policy) + + $(obj)/common.o: $(obj)/builtin-policy.h +-- +2.39.0 + diff --git a/queue-6.1/tools-nolibc-fix-missing-includes-causing-build-issu.patch b/queue-6.1/tools-nolibc-fix-missing-includes-causing-build-issu.patch new file mode 100644 index 00000000000..5cc9ede215c --- /dev/null +++ b/queue-6.1/tools-nolibc-fix-missing-includes-causing-build-issu.patch @@ -0,0 +1,164 @@ +From 1d14e5f8eb87d452b660f9d3d74de5055f36f207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 08:54:40 +0100 +Subject: tools/nolibc: fix missing includes causing build issues at -O0 + +From: Willy Tarreau + +[ Upstream commit 55abdd1f5e1e07418bf4a46c233a92f83cb5ae97 ] + +After the nolibc includes were split to facilitate portability from +standard libcs, programs that include only what they need may miss +some symbols which are needed by libgcc. This is the case for raise() +which is needed by the divide by zero code in some architectures for +example. + +Regardless, being able to include only the apparently needed files is +convenient. + +Instead of trying to move all exported definitions to a single file, +since this can change over time, this patch takes another approach +consisting in including the nolibc header at the end of all standard +include files. This way their types and functions are already known +at the moment of inclusion, and including any single one of them is +sufficient to bring all the required ones. + +Signed-off-by: Willy Tarreau +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/ctype.h | 3 +++ + tools/include/nolibc/errno.h | 3 +++ + tools/include/nolibc/signal.h | 3 +++ + tools/include/nolibc/stdio.h | 3 +++ + tools/include/nolibc/stdlib.h | 3 +++ + tools/include/nolibc/string.h | 3 +++ + tools/include/nolibc/sys.h | 2 ++ + tools/include/nolibc/time.h | 3 +++ + tools/include/nolibc/types.h | 3 +++ + tools/include/nolibc/unistd.h | 3 +++ + 10 files changed, 29 insertions(+) + +diff --git a/tools/include/nolibc/ctype.h b/tools/include/nolibc/ctype.h +index e3000b2992d7..6f90706d0644 100644 +--- a/tools/include/nolibc/ctype.h ++++ b/tools/include/nolibc/ctype.h +@@ -96,4 +96,7 @@ int ispunct(int c) + return isgraph(c) && !isalnum(c); + } + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_CTYPE_H */ +diff --git a/tools/include/nolibc/errno.h b/tools/include/nolibc/errno.h +index 06893d6dfb7a..9dc4919c769b 100644 +--- a/tools/include/nolibc/errno.h ++++ b/tools/include/nolibc/errno.h +@@ -24,4 +24,7 @@ static int errno; + */ + #define MAX_ERRNO 4095 + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_ERRNO_H */ +diff --git a/tools/include/nolibc/signal.h b/tools/include/nolibc/signal.h +index ef47e71e2be3..137552216e46 100644 +--- a/tools/include/nolibc/signal.h ++++ b/tools/include/nolibc/signal.h +@@ -19,4 +19,7 @@ int raise(int signal) + return sys_kill(sys_getpid(), signal); + } + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_SIGNAL_H */ +diff --git a/tools/include/nolibc/stdio.h b/tools/include/nolibc/stdio.h +index a3cebc4bc3ac..96ac8afc5aee 100644 +--- a/tools/include/nolibc/stdio.h ++++ b/tools/include/nolibc/stdio.h +@@ -303,4 +303,7 @@ void perror(const char *msg) + fprintf(stderr, "%s%serrno=%d\n", (msg && *msg) ? msg : "", (msg && *msg) ? ": " : "", errno); + } + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_STDIO_H */ +diff --git a/tools/include/nolibc/stdlib.h b/tools/include/nolibc/stdlib.h +index 92378c4b9660..a24000d1e822 100644 +--- a/tools/include/nolibc/stdlib.h ++++ b/tools/include/nolibc/stdlib.h +@@ -419,4 +419,7 @@ char *u64toa(uint64_t in) + return itoa_buffer; + } + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_STDLIB_H */ +diff --git a/tools/include/nolibc/string.h b/tools/include/nolibc/string.h +index ad97c0d522b8..0932db3817d2 100644 +--- a/tools/include/nolibc/string.h ++++ b/tools/include/nolibc/string.h +@@ -285,4 +285,7 @@ char *strrchr(const char *s, int c) + return (char *)ret; + } + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_STRING_H */ +diff --git a/tools/include/nolibc/sys.h b/tools/include/nolibc/sys.h +index ce3ee03aa679..78473d34e27c 100644 +--- a/tools/include/nolibc/sys.h ++++ b/tools/include/nolibc/sys.h +@@ -1243,5 +1243,7 @@ ssize_t write(int fd, const void *buf, size_t count) + return ret; + } + ++/* make sure to include all global symbols */ ++#include "nolibc.h" + + #endif /* _NOLIBC_SYS_H */ +diff --git a/tools/include/nolibc/time.h b/tools/include/nolibc/time.h +index d18b7661fdd7..84655361b9ad 100644 +--- a/tools/include/nolibc/time.h ++++ b/tools/include/nolibc/time.h +@@ -25,4 +25,7 @@ time_t time(time_t *tptr) + return tv.tv_sec; + } + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_TIME_H */ +diff --git a/tools/include/nolibc/types.h b/tools/include/nolibc/types.h +index f1d64fca7cf0..fbbc0e68c001 100644 +--- a/tools/include/nolibc/types.h ++++ b/tools/include/nolibc/types.h +@@ -209,4 +209,7 @@ struct stat { + }) + #endif + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_TYPES_H */ +diff --git a/tools/include/nolibc/unistd.h b/tools/include/nolibc/unistd.h +index 1c25e20ee360..1cfcd52106a4 100644 +--- a/tools/include/nolibc/unistd.h ++++ b/tools/include/nolibc/unistd.h +@@ -51,4 +51,7 @@ int tcsetpgrp(int fd, pid_t pid) + return ioctl(fd, TIOCSPGRP, &pid); + } + ++/* make sure to include all global symbols */ ++#include "nolibc.h" ++ + #endif /* _NOLIBC_UNISTD_H */ +-- +2.39.0 + diff --git a/queue-6.1/tools-nolibc-fix-s_isxxx-macros.patch b/queue-6.1/tools-nolibc-fix-s_isxxx-macros.patch new file mode 100644 index 00000000000..3719d42ebb5 --- /dev/null +++ b/queue-6.1/tools-nolibc-fix-s_isxxx-macros.patch @@ -0,0 +1,52 @@ +From 762d354a2735fcdfb4657905d2d0c90d5cc8b6e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 08:54:38 +0100 +Subject: tools/nolibc: Fix S_ISxxx macros + +From: Warner Losh + +[ Upstream commit 16f5cea74179b5795af7ce359971f5128d10f80e ] + +The mode field has the type encoded as an value in a field, not as a bit +mask. Mask the mode with S_IFMT instead of each type to test. Otherwise, +false positives are possible: eg S_ISDIR will return true for block +devices because S_IFDIR = 0040000 and S_IFBLK = 0060000 since mode is +masked with S_IFDIR instead of S_IFMT. These macros now match the +similar definitions in tools/include/uapi/linux/stat.h. + +Signed-off-by: Warner Losh +Signed-off-by: Willy Tarreau +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/types.h | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/tools/include/nolibc/types.h b/tools/include/nolibc/types.h +index 300e0ff1cd58..f1d64fca7cf0 100644 +--- a/tools/include/nolibc/types.h ++++ b/tools/include/nolibc/types.h +@@ -26,13 +26,13 @@ + #define S_IFSOCK 0140000 + #define S_IFMT 0170000 + +-#define S_ISDIR(mode) (((mode) & S_IFDIR) == S_IFDIR) +-#define S_ISCHR(mode) (((mode) & S_IFCHR) == S_IFCHR) +-#define S_ISBLK(mode) (((mode) & S_IFBLK) == S_IFBLK) +-#define S_ISREG(mode) (((mode) & S_IFREG) == S_IFREG) +-#define S_ISFIFO(mode) (((mode) & S_IFIFO) == S_IFIFO) +-#define S_ISLNK(mode) (((mode) & S_IFLNK) == S_IFLNK) +-#define S_ISSOCK(mode) (((mode) & S_IFSOCK) == S_IFSOCK) ++#define S_ISDIR(mode) (((mode) & S_IFMT) == S_IFDIR) ++#define S_ISCHR(mode) (((mode) & S_IFMT) == S_IFCHR) ++#define S_ISBLK(mode) (((mode) & S_IFMT) == S_IFBLK) ++#define S_ISREG(mode) (((mode) & S_IFMT) == S_IFREG) ++#define S_ISFIFO(mode) (((mode) & S_IFMT) == S_IFIFO) ++#define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK) ++#define S_ISSOCK(mode) (((mode) & S_IFMT) == S_IFSOCK) + + /* dirent types */ + #define DT_UNKNOWN 0x0 +-- +2.39.0 + diff --git a/queue-6.1/tools-nolibc-prevent-gcc-from-making-memset-loop-ove.patch b/queue-6.1/tools-nolibc-prevent-gcc-from-making-memset-loop-ove.patch new file mode 100644 index 00000000000..0ee2f407642 --- /dev/null +++ b/queue-6.1/tools-nolibc-prevent-gcc-from-making-memset-loop-ove.patch @@ -0,0 +1,56 @@ +From 6122db99ddb99e799d342f6958a24cded9a21907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 08:54:41 +0100 +Subject: tools/nolibc: prevent gcc from making memset() loop over itself + +From: Willy Tarreau + +[ Upstream commit 1bfbe1f3e96720daf185f03d101f072d69753f88 ] + +When building on ARM in thumb mode with gcc-11.3 at -O2 or -O3, +nolibc-test segfaults during the select() tests. It turns out that at +this level, gcc recognizes an opportunity for using memset() to zero +the fd_set, but it miscompiles it because it also recognizes a memset +pattern as well, and decides to call memset() from the memset() code: + + 000122bc : + 122bc: b510 push {r4, lr} + 122be: 0004 movs r4, r0 + 122c0: 2a00 cmp r2, #0 + 122c2: d003 beq.n 122cc + 122c4: 23ff movs r3, #255 ; 0xff + 122c6: 4019 ands r1, r3 + 122c8: f7ff fff8 bl 122bc + 122cc: 0020 movs r0, r4 + 122ce: bd10 pop {r4, pc} + +Simply placing an empty asm() statement inside the loop suffices to +avoid this. + +Signed-off-by: Willy Tarreau +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + tools/include/nolibc/string.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/include/nolibc/string.h b/tools/include/nolibc/string.h +index 0932db3817d2..fffdaf6ff467 100644 +--- a/tools/include/nolibc/string.h ++++ b/tools/include/nolibc/string.h +@@ -88,8 +88,11 @@ void *memset(void *dst, int b, size_t len) + { + char *p = dst; + +- while (len--) ++ while (len--) { ++ /* prevent gcc from recognizing memset() here */ ++ asm volatile(""); + *(p++) = b; ++ } + return dst; + } + +-- +2.39.0 + diff --git a/queue-6.1/usb-dwc3-fix-extcon-dependency.patch b/queue-6.1/usb-dwc3-fix-extcon-dependency.patch new file mode 100644 index 00000000000..4d93aecabcf --- /dev/null +++ b/queue-6.1/usb-dwc3-fix-extcon-dependency.patch @@ -0,0 +1,58 @@ +From d155fb5bdc244fbe6f76a1172892aca1b3f5f2d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:01:41 +0100 +Subject: usb: dwc3: fix extcon dependency + +From: Arnd Bergmann + +[ Upstream commit 7d80dbd708c18c683dd34f79b600a05307707ce8 ] + +The dwc3 core support now links against the extcon subsystem, +so it cannot be built-in when extcon is a loadable module: + +arm-linux-gnueabi-ld: drivers/usb/dwc3/core.o: in function `dwc3_get_extcon': +core.c:(.text+0x572): undefined reference to `extcon_get_edev_by_phandle' +arm-linux-gnueabi-ld: core.c:(.text+0x596): undefined reference to `extcon_get_extcon_dev' +arm-linux-gnueabi-ld: core.c:(.text+0x5ea): undefined reference to `extcon_find_edev_by_node' + +There was already a Kconfig dependency in the dual-role support, +but this is now needed for the entire dwc3 driver. + +It is still possible to build dwc3 without extcon, but this +prevents it from being set to built-in when extcon is a loadable +module. + +Fixes: d182c2e1bc92 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present") +Signed-off-by: Arnd Bergmann +Reviewed-by: Andy Shevchenko +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20230118090147.2126563-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig +index 03ededa86da1..864fef540a39 100644 +--- a/drivers/usb/dwc3/Kconfig ++++ b/drivers/usb/dwc3/Kconfig +@@ -3,6 +3,7 @@ + config USB_DWC3 + tristate "DesignWare USB3 DRD Core Support" + depends on (USB || USB_GADGET) && HAS_DMA ++ depends on (EXTCON || EXTCON=n) + select USB_XHCI_PLATFORM if USB_XHCI_HCD + select USB_ROLE_SWITCH if USB_DWC3_DUAL_ROLE + help +@@ -44,7 +45,6 @@ config USB_DWC3_GADGET + config USB_DWC3_DUAL_ROLE + bool "Dual Role mode" + depends on ((USB=y || USB=USB_DWC3) && (USB_GADGET=y || USB_GADGET=USB_DWC3)) +- depends on (EXTCON=y || EXTCON=USB_DWC3) + help + This is the default mode of working of DWC3 controller where + both host and gadget features are enabled. +-- +2.39.0 + diff --git a/queue-6.1/usb-gadget-f_fs-ensure-ep0req-is-dequeued-before-fre.patch b/queue-6.1/usb-gadget-f_fs-ensure-ep0req-is-dequeued-before-fre.patch new file mode 100644 index 00000000000..9510cb97ca3 --- /dev/null +++ b/queue-6.1/usb-gadget-f_fs-ensure-ep0req-is-dequeued-before-fre.patch @@ -0,0 +1,43 @@ +From 8bfc5d7c93671689f895aea3281ae204f6bdde35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 10:59:06 +0530 +Subject: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request + +From: Udipto Goswami + +[ Upstream commit ce405d561b020e5a46340eb5146805a625dcacee ] + +As per the documentation, function usb_ep_free_request guarantees +the request will not be queued or no longer be re-queued (or +otherwise used). However, with the current implementation it +doesn't make sure that the request in ep0 isn't reused. + +Fix this by dequeuing the ep0req on functionfs_unbind before +freeing the request to align with the definition. + +Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver") +Signed-off-by: Udipto Goswami +Tested-by: Krishna Kurapati +Link: https://lore.kernel.org/r/20221215052906.8993-3-quic_ugoswami@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index bb6fe1f3a29d..523a961b910b 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1895,6 +1895,8 @@ static void functionfs_unbind(struct ffs_data *ffs) + ENTER(); + + if (!WARN_ON(!ffs->gadget)) { ++ /* dequeue before freeing ep0req */ ++ usb_ep_dequeue(ffs->gadget->ep0, ffs->ep0req); + mutex_lock(&ffs->mutex); + usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req); + ffs->ep0req = NULL; +-- +2.39.0 + diff --git a/queue-6.1/usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch b/queue-6.1/usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch new file mode 100644 index 00000000000..3e2acc01fe9 --- /dev/null +++ b/queue-6.1/usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch @@ -0,0 +1,61 @@ +From d9507287217098549536bd1666e8e0e2652c8856 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 10:59:05 +0530 +Subject: usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait + +From: Udipto Goswami + +[ Upstream commit 6a19da111057f69214b97c62fb0ac59023970850 ] + +While performing fast composition switch, there is a possibility that the +process of ffs_ep0_write/ffs_ep0_read get into a race condition +due to ep0req being freed up from functionfs_unbind. + +Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait +by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't +bounded so it can go ahead and mark the ep0req to NULL, and since there +is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free. + +Fix this by making a serialized execution between the two functions using +a mutex_lock(ffs->mutex). + +Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver") +Signed-off-by: Udipto Goswami +Tested-by: Krishna Kurapati +Link: https://lore.kernel.org/r/20221215052906.8993-2-quic_ugoswami@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 73dc10a77cde..bb6fe1f3a29d 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -279,6 +279,9 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len) + struct usb_request *req = ffs->ep0req; + int ret; + ++ if (!req) ++ return -EINVAL; ++ + req->zero = len < le16_to_cpu(ffs->ev.setup.wLength); + + spin_unlock_irq(&ffs->ev.waitq.lock); +@@ -1892,10 +1895,12 @@ static void functionfs_unbind(struct ffs_data *ffs) + ENTER(); + + if (!WARN_ON(!ffs->gadget)) { ++ mutex_lock(&ffs->mutex); + usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req); + ffs->ep0req = NULL; + ffs->gadget = NULL; + clear_bit(FFS_FL_BOUND, &ffs->flags); ++ mutex_unlock(&ffs->mutex); + ffs_data_put(ffs); + } + } +-- +2.39.0 + diff --git a/queue-6.1/usb-ucsi-ensure-connector-delayed-work-items-are-flu.patch b/queue-6.1/usb-ucsi-ensure-connector-delayed-work-items-are-flu.patch new file mode 100644 index 00000000000..7af6c35afe2 --- /dev/null +++ b/queue-6.1/usb-ucsi-ensure-connector-delayed-work-items-are-flu.patch @@ -0,0 +1,125 @@ +From 1430808e0a83b0b60c0d88e1f9080913871d4c43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 23:12:18 -0800 +Subject: usb: ucsi: Ensure connector delayed work items are flushed + +From: Jack Pham + +[ Upstream commit fac4b8633fd682ecc8e9cff61cb3e33374a1c7e5 ] + +During ucsi_unregister() when destroying a connector's workqueue, there +may still be pending delayed work items that haven't been scheduled yet. +Because queue_delayed_work() uses a separate timer to schedule a work +item, the destroy_workqueue() call is not aware of any pending items. +Hence when a pending item's timer expires it would then try to queue on +a dangling workqueue pointer. + +Fix this by keeping track of all work items in a list, so that prior to +destroying the workqueue any pending items can be flushed. Do this by +calling mod_delayed_work() as that will cause pending items to get +queued immediately, which then allows the ensuing destroy_workqueue() to +implicitly drain all currently queued items to completion and free +themselves. + +Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking") +Suggested-by: Heikki Krogerus +Co-developed-by: Linyu Yuan +Signed-off-by: Linyu Yuan +Signed-off-by: Jack Pham +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230110071218.26261-1-quic_jackp@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.c | 24 +++++++++++++++++++++--- + drivers/usb/typec/ucsi/ucsi.h | 1 + + 2 files changed, 22 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index eabe519013e7..1292241d581a 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -187,6 +187,7 @@ EXPORT_SYMBOL_GPL(ucsi_send_command); + + struct ucsi_work { + struct delayed_work work; ++ struct list_head node; + unsigned long delay; + unsigned int count; + struct ucsi_connector *con; +@@ -202,6 +203,7 @@ static void ucsi_poll_worker(struct work_struct *work) + mutex_lock(&con->lock); + + if (!con->partner) { ++ list_del(&uwork->node); + mutex_unlock(&con->lock); + kfree(uwork); + return; +@@ -209,10 +211,12 @@ static void ucsi_poll_worker(struct work_struct *work) + + ret = uwork->cb(con); + +- if (uwork->count-- && (ret == -EBUSY || ret == -ETIMEDOUT)) ++ if (uwork->count-- && (ret == -EBUSY || ret == -ETIMEDOUT)) { + queue_delayed_work(con->wq, &uwork->work, uwork->delay); +- else ++ } else { ++ list_del(&uwork->node); + kfree(uwork); ++ } + + mutex_unlock(&con->lock); + } +@@ -236,6 +240,7 @@ static int ucsi_partner_task(struct ucsi_connector *con, + uwork->con = con; + uwork->cb = cb; + ++ list_add_tail(&uwork->node, &con->partner_tasks); + queue_delayed_work(con->wq, &uwork->work, delay); + + return 0; +@@ -1056,6 +1061,7 @@ static int ucsi_register_port(struct ucsi *ucsi, int index) + INIT_WORK(&con->work, ucsi_handle_connector_change); + init_completion(&con->complete); + mutex_init(&con->lock); ++ INIT_LIST_HEAD(&con->partner_tasks); + con->num = index + 1; + con->ucsi = ucsi; + +@@ -1420,8 +1426,20 @@ void ucsi_unregister(struct ucsi *ucsi) + ucsi_unregister_altmodes(&ucsi->connector[i], + UCSI_RECIPIENT_CON); + ucsi_unregister_port_psy(&ucsi->connector[i]); +- if (ucsi->connector[i].wq) ++ ++ if (ucsi->connector[i].wq) { ++ struct ucsi_work *uwork; ++ ++ mutex_lock(&ucsi->connector[i].lock); ++ /* ++ * queue delayed items immediately so they can execute ++ * and free themselves before the wq is destroyed ++ */ ++ list_for_each_entry(uwork, &ucsi->connector[i].partner_tasks, node) ++ mod_delayed_work(ucsi->connector[i].wq, &uwork->work, 0); ++ mutex_unlock(&ucsi->connector[i].lock); + destroy_workqueue(ucsi->connector[i].wq); ++ } + typec_unregister_port(ucsi->connector[i].port); + } + +diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h +index c968474ee547..60ce9fb6e745 100644 +--- a/drivers/usb/typec/ucsi/ucsi.h ++++ b/drivers/usb/typec/ucsi/ucsi.h +@@ -322,6 +322,7 @@ struct ucsi_connector { + struct work_struct work; + struct completion complete; + struct workqueue_struct *wq; ++ struct list_head partner_tasks; + + struct typec_port *port; + struct typec_partner *partner; +-- +2.39.0 + diff --git a/queue-6.1/virtio-net-correctly-enable-callback-during-start_xm.patch b/queue-6.1/virtio-net-correctly-enable-callback-during-start_xm.patch new file mode 100644 index 00000000000..2e4d2fa1a5d --- /dev/null +++ b/queue-6.1/virtio-net-correctly-enable-callback-during-start_xm.patch @@ -0,0 +1,59 @@ +From 233f62d2248e5a7cad2dc1b581513783e7ac495c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 11:47:07 +0800 +Subject: virtio-net: correctly enable callback during start_xmit + +From: Jason Wang + +[ Upstream commit d71ebe8114b4bf622804b810f5e274069060a174 ] + +Commit a7766ef18b33("virtio_net: disable cb aggressively") enables +virtqueue callback via the following statement: + + do { + if (use_napi) + virtqueue_disable_cb(sq->vq); + + free_old_xmit_skbs(sq, false); + + } while (use_napi && kick && + unlikely(!virtqueue_enable_cb_delayed(sq->vq))); + +When NAPI is used and kick is false, the callback won't be enabled +here. And when the virtqueue is about to be full, the tx will be +disabled, but we still don't enable tx interrupt which will cause a TX +hang. This could be observed when using pktgen with burst enabled. + +TO be consistent with the logic that tries to disable cb only for +NAPI, fixing this by trying to enable delayed callback only when NAPI +is enabled when the queue is about to be full. + +Fixes: a7766ef18b33 ("virtio_net: disable cb aggressively") +Signed-off-by: Jason Wang +Tested-by: Laurent Vivier +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 86e52454b5b5..3cd15f16090f 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1873,8 +1873,10 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev) + */ + if (sq->vq->num_free < 2+MAX_SKB_FRAGS) { + netif_stop_subqueue(dev, qnum); +- if (!use_napi && +- unlikely(!virtqueue_enable_cb_delayed(sq->vq))) { ++ if (use_napi) { ++ if (unlikely(!virtqueue_enable_cb_delayed(sq->vq))) ++ virtqueue_napi_schedule(&sq->napi, sq->vq); ++ } else if (unlikely(!virtqueue_enable_cb_delayed(sq->vq))) { + /* More just got used, free them then recheck. */ + free_old_xmit_skbs(sq, false); + if (sq->vq->num_free >= 2+MAX_SKB_FRAGS) { +-- +2.39.0 + diff --git a/queue-6.1/w1-fix-deadloop-in-__w1_remove_master_device.patch b/queue-6.1/w1-fix-deadloop-in-__w1_remove_master_device.patch new file mode 100644 index 00000000000..918d9cc6f22 --- /dev/null +++ b/queue-6.1/w1-fix-deadloop-in-__w1_remove_master_device.patch @@ -0,0 +1,83 @@ +From 95d21a3726c460e5ef7489f80f7e58d8742f2eac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 16:04:34 +0800 +Subject: w1: fix deadloop in __w1_remove_master_device() + +From: Yang Yingliang + +[ Upstream commit 25d5648802f12ae486076ceca5d7ddf1fef792b2 ] + +I got a deadloop report while doing device(ds2482) add/remove test: + + [ 162.241881] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. + [ 163.272251] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. + [ 164.296157] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. + ... + +__w1_remove_master_device() can't return, because the dev->refcnt is not zero. + +w1_add_master_device() | + w1_alloc_dev() | + atomic_set(&dev->refcnt, 2) | + kthread_run() | + |__w1_remove_master_device() + | kthread_stop() + // KTHREAD_SHOULD_STOP is set, | + // threadfn(w1_process) won't be | + // called. | + kthread() | + | // refcnt will never be 0, it's deadloop. + | while (atomic_read(&dev->refcnt)) {...} + +After calling w1_add_master_device(), w1_process() is not really +invoked, before w1_process() starting, if kthread_stop() is called +in __w1_remove_master_device(), w1_process() will never be called, +the refcnt can not be decreased, then it causes deadloop in remove +function because of non-zero refcnt. + +We need to make sure w1_process() is really started, so move the +set refcnt into w1_process() to fix this problem. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221205080434.3149205-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/w1/w1.c | 2 ++ + drivers/w1/w1_int.c | 5 ++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index f2ae2e563dc5..8b35fae4cd61 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1166,6 +1166,8 @@ int w1_process(void *data) + /* remainder if it woke up early */ + unsigned long jremain = 0; + ++ atomic_inc(&dev->refcnt); ++ + for (;;) { + + if (!jremain && dev->search_count) { +diff --git a/drivers/w1/w1_int.c b/drivers/w1/w1_int.c +index b3e1792d9c49..3a71c5eb2f83 100644 +--- a/drivers/w1/w1_int.c ++++ b/drivers/w1/w1_int.c +@@ -51,10 +51,9 @@ static struct w1_master *w1_alloc_dev(u32 id, int slave_count, int slave_ttl, + dev->search_count = w1_search_count; + dev->enable_pullup = w1_enable_pullup; + +- /* 1 for w1_process to decrement +- * 1 for __w1_remove_master_device to decrement ++ /* For __w1_remove_master_device to decrement + */ +- atomic_set(&dev->refcnt, 2); ++ atomic_set(&dev->refcnt, 1); + + INIT_LIST_HEAD(&dev->slist); + INIT_LIST_HEAD(&dev->async_list); +-- +2.39.0 + diff --git a/queue-6.1/w1-fix-warning-after-calling-w1_process.patch b/queue-6.1/w1-fix-warning-after-calling-w1_process.patch new file mode 100644 index 00000000000..e945d119a4e --- /dev/null +++ b/queue-6.1/w1-fix-warning-after-calling-w1_process.patch @@ -0,0 +1,55 @@ +From 57296b2adc69a7c19a9074f43f0979e92b490dec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 18:15:58 +0800 +Subject: w1: fix WARNING after calling w1_process() + +From: Yang Yingliang + +[ Upstream commit 36225a7c72e9e3e1ce4001b6ce72849f5c9a2d3b ] + +I got the following WARNING message while removing driver(ds2482): + +------------[ cut here ]------------ +do not call blocking ops when !TASK_RUNNING; state=1 set at [<000000002d50bfb6>] w1_process+0x9e/0x1d0 [wire] +WARNING: CPU: 0 PID: 262 at kernel/sched/core.c:9817 __might_sleep+0x98/0xa0 +CPU: 0 PID: 262 Comm: w1_bus_master1 Tainted: G N 6.1.0-rc3+ #307 +RIP: 0010:__might_sleep+0x98/0xa0 +Call Trace: + exit_signals+0x6c/0x550 + do_exit+0x2b4/0x17e0 + kthread_exit+0x52/0x60 + kthread+0x16d/0x1e0 + ret_from_fork+0x1f/0x30 + +The state of task is set to TASK_INTERRUPTIBLE in loop in w1_process(), +set it to TASK_RUNNING when it breaks out of the loop to avoid the +warning. + +Fixes: 3c52e4e62789 ("W1: w1_process, block or sleep") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221205101558.3599162-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/w1/w1.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index 8b35fae4cd61..4a2ddf730a3a 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1195,8 +1195,10 @@ int w1_process(void *data) + */ + mutex_unlock(&dev->list_mutex); + +- if (kthread_should_stop()) ++ if (kthread_should_stop()) { ++ __set_current_state(TASK_RUNNING); + break; ++ } + + /* Only sleep when the search is active. */ + if (dev->search_count) { +-- +2.39.0 + diff --git a/queue-6.1/wifi-rndis_wlan-prevent-buffer-overflow-in-rndis_que.patch b/queue-6.1/wifi-rndis_wlan-prevent-buffer-overflow-in-rndis_que.patch new file mode 100644 index 00000000000..e38e41ad79f --- /dev/null +++ b/queue-6.1/wifi-rndis_wlan-prevent-buffer-overflow-in-rndis_que.patch @@ -0,0 +1,75 @@ +From 1b32928f46d0014460c42ef1e10905c2dd3eadca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 18:50:31 +0100 +Subject: wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid + +From: Szymon Heidrich + +[ Upstream commit b870e73a56c4cccbec33224233eaf295839f228c ] + +Since resplen and respoffs are signed integers sufficiently +large values of unsigned int len and offset members of RNDIS +response will result in negative values of prior variables. +This may be utilized to bypass implemented security checks +to either extract memory contents by manipulating offset or +overflow the data buffer via memcpy by manipulating both +offset and len. + +Additionally assure that sum of resplen and respoffs does not +overflow so buffer boundaries are kept. + +Fixes: 80f8c5b434f9 ("rndis_wlan: copy only useful data from rndis_command respond") +Signed-off-by: Szymon Heidrich +Reviewed-by: Alexander Duyck +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230111175031.7049-1-szymon.heidrich@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rndis_wlan.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c +index 82a7458e01ae..bf72e5fd39cf 100644 +--- a/drivers/net/wireless/rndis_wlan.c ++++ b/drivers/net/wireless/rndis_wlan.c +@@ -696,8 +696,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) + struct rndis_query *get; + struct rndis_query_c *get_c; + } u; +- int ret, buflen; +- int resplen, respoffs, copylen; ++ int ret; ++ size_t buflen, resplen, respoffs, copylen; + + buflen = *len + sizeof(*u.get); + if (buflen < CONTROL_BUFFER_SIZE) +@@ -732,22 +732,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) + + if (respoffs > buflen) { + /* Device returned data offset outside buffer, error. */ +- netdev_dbg(dev->net, "%s(%s): received invalid " +- "data offset: %d > %d\n", __func__, +- oid_to_string(oid), respoffs, buflen); ++ netdev_dbg(dev->net, ++ "%s(%s): received invalid data offset: %zu > %zu\n", ++ __func__, oid_to_string(oid), respoffs, buflen); + + ret = -EINVAL; + goto exit_unlock; + } + +- if ((resplen + respoffs) > buflen) { +- /* Device would have returned more data if buffer would +- * have been big enough. Copy just the bits that we got. +- */ +- copylen = buflen - respoffs; +- } else { +- copylen = resplen; +- } ++ copylen = min(resplen, buflen - respoffs); + + if (copylen > *len) + copylen = *len; +-- +2.39.0 + diff --git a/queue-6.1/xen-pvcalls-free-active-map-buffer-on-pvcalls_front_.patch b/queue-6.1/xen-pvcalls-free-active-map-buffer-on-pvcalls_front_.patch new file mode 100644 index 00000000000..27f4ee62edf --- /dev/null +++ b/queue-6.1/xen-pvcalls-free-active-map-buffer-on-pvcalls_front_.patch @@ -0,0 +1,49 @@ +From edfac1642950942d2329b4a282e9fdc72c3b6051 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 14:50:13 +0000 +Subject: xen/pvcalls: free active map buffer on pvcalls_front_free_map + +From: Oleksii Moisieiev + +[ Upstream commit f57034cedeb6e00256313a2a6ee67f974d709b0b ] + +Data buffer for active map is allocated in alloc_active_ring and freed +in free_active_ring function, which is used only for the error +cleanup. pvcalls_front_release is calling pvcalls_front_free_map which +ends foreign access for this buffer, but doesn't free allocated pages. +Call free_active_ring to clean all allocated resources. + +Signed-off-by: Oleksii Moisieiev +Reviewed-by: Stefano Stabellini +Link: https://lore.kernel.org/r/6a762ee32dd655cbb09a4aa0e2307e8919761311.1671531297.git.oleksii_moisieiev@epam.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-front.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c +index 1826e8e67125..9b569278788a 100644 +--- a/drivers/xen/pvcalls-front.c ++++ b/drivers/xen/pvcalls-front.c +@@ -225,6 +225,8 @@ static irqreturn_t pvcalls_front_event_handler(int irq, void *dev_id) + return IRQ_HANDLED; + } + ++static void free_active_ring(struct sock_mapping *map); ++ + static void pvcalls_front_free_map(struct pvcalls_bedata *bedata, + struct sock_mapping *map) + { +@@ -240,7 +242,7 @@ static void pvcalls_front_free_map(struct pvcalls_bedata *bedata, + for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++) + gnttab_end_foreign_access(map->active.ring->ref[i], NULL); + gnttab_end_foreign_access(map->active.ref, NULL); +- free_page((unsigned long)map->active.ring); ++ free_active_ring(map); + + kfree(map); + } +-- +2.39.0 +