From: Sasha Levin Date: Thu, 8 Dec 2022 13:53:34 +0000 (-0500) Subject: Fixes for 6.0 X-Git-Tag: v4.9.336~37 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=60aa2bc646f74a853ac21bcd7fedc2a6173bf3b7;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.0 Signed-off-by: Sasha Levin --- diff --git a/queue-6.0/9p-fd-use-p9_hdrsz-for-header-size.patch b/queue-6.0/9p-fd-use-p9_hdrsz-for-header-size.patch new file mode 100644 index 00000000000..c7ef6819df8 --- /dev/null +++ b/queue-6.0/9p-fd-use-p9_hdrsz-for-header-size.patch @@ -0,0 +1,56 @@ +From 0f34167e2873f19818d315638f92f977b93b5e04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 17:11:59 +0800 +Subject: 9p/fd: Use P9_HDRSZ for header size + +From: GUO Zihua + +[ Upstream commit 6854fadbeee10891ed74246bdc05031906b6c8cf ] + +Cleanup hardcoded header sizes to use P9_HDRSZ instead of '7' + +Link: https://lkml.kernel.org/r/20221117091159.31533-4-guozihua@huawei.com +Signed-off-by: GUO Zihua +Reviewed-by: Christian Schoenebeck +[Dominique: commit message adjusted to make sense after offset size +adjustment got removed] +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_fd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index 3e056fb043bb..080b5de3e1ed 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -120,7 +120,7 @@ struct p9_conn { + struct list_head unsent_req_list; + struct p9_req_t *rreq; + struct p9_req_t *wreq; +- char tmp_buf[7]; ++ char tmp_buf[P9_HDRSZ]; + struct p9_fcall rc; + int wpos; + int wsize; +@@ -293,7 +293,7 @@ static void p9_read_work(struct work_struct *work) + if (!m->rc.sdata) { + m->rc.sdata = m->tmp_buf; + m->rc.offset = 0; +- m->rc.capacity = 7; /* start by reading header */ ++ m->rc.capacity = P9_HDRSZ; /* start by reading header */ + } + + clear_bit(Rpending, &m->wsched); +@@ -316,7 +316,7 @@ static void p9_read_work(struct work_struct *work) + p9_debug(P9_DEBUG_TRANS, "got new header\n"); + + /* Header size */ +- m->rc.size = 7; ++ m->rc.size = P9_HDRSZ; + err = p9_parse_header(&m->rc, &m->rc.size, NULL, NULL, 0); + if (err) { + p9_debug(P9_DEBUG_ERROR, +-- +2.35.1 + diff --git a/queue-6.0/9p-xen-check-logical-size-for-buffer-size.patch b/queue-6.0/9p-xen-check-logical-size-for-buffer-size.patch new file mode 100644 index 00000000000..60d7c1cb008 --- /dev/null +++ b/queue-6.0/9p-xen-check-logical-size-for-buffer-size.patch @@ -0,0 +1,53 @@ +From 4b875faf4dbc160cdade3b01f5050b91a942a919 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 22:44:41 +0900 +Subject: 9p/xen: check logical size for buffer size + +From: Dominique Martinet + +[ Upstream commit 391c18cf776eb4569ecda1f7794f360fe0a45a26 ] + +trans_xen did not check the data fits into the buffer before copying +from the xen ring, but we probably should. +Add a check that just skips the request and return an error to +userspace if it did not fit + +Tested-by: Stefano Stabellini +Reviewed-by: Christian Schoenebeck +Link: https://lkml.kernel.org/r/20221118135542.63400-1-asmadeus@codewreck.org +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_xen.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c +index 227f89cc7237..0f862d5a5960 100644 +--- a/net/9p/trans_xen.c ++++ b/net/9p/trans_xen.c +@@ -208,6 +208,14 @@ static void p9_xen_response(struct work_struct *work) + continue; + } + ++ if (h.size > req->rc.capacity) { ++ dev_warn(&priv->dev->dev, ++ "requested packet size too big: %d for tag %d with capacity %zd\n", ++ h.size, h.tag, req->rc.capacity); ++ req->status = REQ_STATUS_ERROR; ++ goto recv_error; ++ } ++ + memcpy(&req->rc, &h, sizeof(h)); + req->rc.offset = 0; + +@@ -217,6 +225,7 @@ static void p9_xen_response(struct work_struct *work) + masked_prod, &masked_cons, + XEN_9PFS_RING_SIZE(ring)); + ++recv_error: + virt_mb(); + cons += h.size; + ring->intf->in_cons = cons; +-- +2.35.1 + diff --git a/queue-6.0/alsa-hda-realtek-more-robust-component-matching-for-.patch b/queue-6.0/alsa-hda-realtek-more-robust-component-matching-for-.patch new file mode 100644 index 00000000000..d54a3653681 --- /dev/null +++ b/queue-6.0/alsa-hda-realtek-more-robust-component-matching-for-.patch @@ -0,0 +1,155 @@ +From 066b7c7660d8b7e597b482f1156f3b170003daca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Sep 2022 10:48:10 +0200 +Subject: ALSA: hda/realtek: More robust component matching for CS35L41 + +From: Takashi Iwai + +[ Upstream commit 35a1744423743247026668e2323d1b932583fc2a ] + +As the previous commit implies, a system may have a different SPI bus +number that is embedded in the device string. And, assuming the fixed +bus number is rather fragile; it may be assigned differently depending +on the configuration or on the boot environment. Once when a bus +number change happens, the binding fails, resulting in the silence. + +This patch tries to make the matching a bit more relaxed, allowing to +bind with a different bus number (or without it). So the previous +fix, the introduction of ALC245_FIXUP_CS35L41_SPI1_2 fixup became +superfluous, and this is unified to ALC245_FIXUP_CS35L41_SPI_2. + +Fixes: 225f6e1bc151 ("ALSA: hda/realtek: Add quirk for HP Zbook Firefly 14 G9 model") +Link: https://lore.kernel.org/r/20220930084810.10435-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 62 +++++++++++++++++++++-------------- + 1 file changed, 37 insertions(+), 25 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index bf58e98c7a69..d8c6af9e43ad 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -6704,23 +6705,51 @@ static void comp_generic_playback_hook(struct hda_pcm_stream *hinfo, struct hda_ + } + } + ++struct cs35l41_dev_name { ++ const char *bus; ++ const char *hid; ++ int index; ++}; ++ ++/* match the device name in a slightly relaxed manner */ ++static int comp_match_cs35l41_dev_name(struct device *dev, void *data) ++{ ++ struct cs35l41_dev_name *p = data; ++ const char *d = dev_name(dev); ++ int n = strlen(p->bus); ++ char tmp[32]; ++ ++ /* check the bus name */ ++ if (strncmp(d, p->bus, n)) ++ return 0; ++ /* skip the bus number */ ++ if (isdigit(d[n])) ++ n++; ++ /* the rest must be exact matching */ ++ snprintf(tmp, sizeof(tmp), "-%s:00-cs35l41-hda.%d", p->hid, p->index); ++ return !strcmp(d + n, tmp); ++} ++ + static void cs35l41_generic_fixup(struct hda_codec *cdc, int action, const char *bus, + const char *hid, int count) + { + struct device *dev = hda_codec_dev(cdc); + struct alc_spec *spec = cdc->spec; +- char *name; ++ struct cs35l41_dev_name *rec; + int ret, i; + + switch (action) { + case HDA_FIXUP_ACT_PRE_PROBE: + for (i = 0; i < count; i++) { +- name = devm_kasprintf(dev, GFP_KERNEL, +- "%s-%s:00-cs35l41-hda.%d", bus, hid, i); +- if (!name) ++ rec = devm_kmalloc(dev, sizeof(*rec), GFP_KERNEL); ++ if (!rec) + return; ++ rec->bus = bus; ++ rec->hid = hid; ++ rec->index = i; + spec->comps[i].codec = cdc; +- component_match_add(dev, &spec->match, component_compare_dev_name, name); ++ component_match_add(dev, &spec->match, ++ comp_match_cs35l41_dev_name, rec); + } + ret = component_master_add_with_match(dev, &comp_master_ops, spec->match); + if (ret) +@@ -6738,17 +6767,12 @@ static void cs35l41_fixup_i2c_two(struct hda_codec *cdc, const struct hda_fixup + + static void cs35l41_fixup_spi_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) + { +- cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 2); +-} +- +-static void cs35l41_fixup_spi1_two(struct hda_codec *codec, const struct hda_fixup *fix, int action) +-{ +- cs35l41_generic_fixup(codec, action, "spi1", "CSC3551", 2); ++ cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 2); + } + + static void cs35l41_fixup_spi_four(struct hda_codec *codec, const struct hda_fixup *fix, int action) + { +- cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 4); ++ cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 4); + } + + static void alc287_fixup_legion_16achg6_speakers(struct hda_codec *cdc, const struct hda_fixup *fix, +@@ -7137,8 +7161,6 @@ enum { + ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED, + ALC245_FIXUP_CS35L41_SPI_2, + ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED, +- ALC245_FIXUP_CS35L41_SPI1_2, +- ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED, + ALC245_FIXUP_CS35L41_SPI_4, + ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED, + ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED, +@@ -8988,16 +9010,6 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC285_FIXUP_HP_GPIO_LED, + }, +- [ALC245_FIXUP_CS35L41_SPI1_2] = { +- .type = HDA_FIXUP_FUNC, +- .v.func = cs35l41_fixup_spi1_two, +- }, +- [ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED] = { +- .type = HDA_FIXUP_FUNC, +- .v.func = cs35l41_fixup_spi1_two, +- .chained = true, +- .chain_id = ALC285_FIXUP_HP_GPIO_LED, +- }, + [ALC245_FIXUP_CS35L41_SPI_4] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs35l41_fixup_spi_four, +@@ -9361,7 +9373,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED), +- SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), +-- +2.35.1 + diff --git a/queue-6.0/alsa-seq-fix-function-prototype-mismatch-in-snd_seq_.patch b/queue-6.0/alsa-seq-fix-function-prototype-mismatch-in-snd_seq_.patch new file mode 100644 index 00000000000..64d85fbd1e6 --- /dev/null +++ b/queue-6.0/alsa-seq-fix-function-prototype-mismatch-in-snd_seq_.patch @@ -0,0 +1,77 @@ +From e21d1be8fc43081c83e0a44699a6ef6696f9fd51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 15:23:50 -0800 +Subject: ALSA: seq: Fix function prototype mismatch in + snd_seq_expand_var_event + +From: Kees Cook + +[ Upstream commit 05530ef7cf7c7d700f6753f058999b1b5099a026 ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. + +seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes +matching snd_seq_dump_func_t. Adjust this and remove the casts. There +are not resulting binary output differences. + +This was found as a result of Clang's new -Wcast-function-type-strict +flag, which is more sensitive than the simpler -Wcast-function-type, +which only checks for type width mismatches. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/lkml/202211041527.HD8TLSE1-lkp@intel.com +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: "Gustavo A. R. Silva" +Cc: alsa-devel@alsa-project.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20221118232346.never.380-kees@kernel.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/seq_memory.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c +index b7aee23fc387..47ef6bc30c0e 100644 +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -113,15 +113,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event); + * expand the variable length event to linear buffer space. + */ + +-static int seq_copy_in_kernel(char **bufptr, const void *src, int size) ++static int seq_copy_in_kernel(void *ptr, void *src, int size) + { ++ char **bufptr = ptr; ++ + memcpy(*bufptr, src, size); + *bufptr += size; + return 0; + } + +-static int seq_copy_in_user(char __user **bufptr, const void *src, int size) ++static int seq_copy_in_user(void *ptr, void *src, int size) + { ++ char __user **bufptr = ptr; ++ + if (copy_to_user(*bufptr, src, size)) + return -EFAULT; + *bufptr += size; +@@ -151,8 +155,7 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char + return newlen; + } + err = snd_seq_dump_var_event(event, +- in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel : +- (snd_seq_dump_func_t)seq_copy_in_user, ++ in_kernel ? seq_copy_in_kernel : seq_copy_in_user, + &buf); + return err < 0 ? err : newlen; + } +-- +2.35.1 + diff --git a/queue-6.0/arm-9251-1-perf-fix-stacktraces-for-tracepoint-event.patch b/queue-6.0/arm-9251-1-perf-fix-stacktraces-for-tracepoint-event.patch new file mode 100644 index 00000000000..796ab74a825 --- /dev/null +++ b/queue-6.0/arm-9251-1-perf-fix-stacktraces-for-tracepoint-event.patch @@ -0,0 +1,70 @@ +From 88b5f18330ce607685278ef1caa88232a8966bec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Sep 2022 16:09:12 +0100 +Subject: ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 + kernels + +From: Tomislav Novak + +[ Upstream commit 612695bccfdbd52004551308a55bae410e7cd22f ] + +Store the frame address where arm_get_current_stackframe() looks for it +(ARM_r7 instead of ARM_fp if CONFIG_THUMB2_KERNEL=y). Otherwise frame->fp +gets set to 0, causing unwind_frame() to fail. + + # bpftrace -e 't:sched:sched_switch { @[kstack] = count(); exit(); }' + Attaching 1 probe... + @[ + __schedule+1059 + ]: 1 + +A typical first unwind instruction is 0x97 (SP = R7), so after executing +it SP ends up being 0 and -URC_FAILURE is returned. + + unwind_frame(pc = ac9da7d7 lr = 00000000 sp = c69bdda0 fp = 00000000) + unwind_find_idx(ac9da7d7) + unwind_exec_insn: insn = 00000097 + unwind_exec_insn: fp = 00000000 sp = 00000000 lr = 00000000 pc = 00000000 + +With this patch: + + # bpftrace -e 't:sched:sched_switch { @[kstack] = count(); exit(); }' + Attaching 1 probe... + @[ + __schedule+1059 + __schedule+1059 + schedule+79 + schedule_hrtimeout_range_clock+163 + schedule_hrtimeout_range+17 + ep_poll+471 + SyS_epoll_wait+111 + sys_epoll_pwait+231 + __ret_fast_syscall+1 + ]: 1 + +Link: https://lore.kernel.org/r/20220920230728.2617421-1-tnovak@fb.com/ + +Reviewed-by: Linus Walleij +Signed-off-by: Tomislav Novak +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/perf_event.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/include/asm/perf_event.h b/arch/arm/include/asm/perf_event.h +index fe87397c3d8c..bdbc1e590891 100644 +--- a/arch/arm/include/asm/perf_event.h ++++ b/arch/arm/include/asm/perf_event.h +@@ -17,7 +17,7 @@ extern unsigned long perf_misc_flags(struct pt_regs *regs); + + #define perf_arch_fetch_caller_regs(regs, __ip) { \ + (regs)->ARM_pc = (__ip); \ +- (regs)->ARM_fp = (unsigned long) __builtin_frame_address(0); \ ++ frame_pointer((regs)) = (unsigned long) __builtin_frame_address(0); \ + (regs)->ARM_sp = current_stack_pointer; \ + (regs)->ARM_cpsr = SVC_MODE; \ + } +-- +2.35.1 + diff --git a/queue-6.0/arm-9266-1-mm-fix-no-mmu-zero_page-implementation.patch b/queue-6.0/arm-9266-1-mm-fix-no-mmu-zero_page-implementation.patch new file mode 100644 index 00000000000..5aa0bba7cd7 --- /dev/null +++ b/queue-6.0/arm-9266-1-mm-fix-no-mmu-zero_page-implementation.patch @@ -0,0 +1,141 @@ +From 859cc79f36c6f2b8d7d867d67a785a28823b06f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 21:46:18 +0100 +Subject: ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation + +From: Giulio Benetti + +[ Upstream commit 340a982825f76f1cff0daa605970fe47321b5ee7 ] + +Actually in no-MMU SoCs(i.e. i.MXRT) ZERO_PAGE(vaddr) expands to +``` +virt_to_page(0) +``` +that in order expands to: +``` +pfn_to_page(virt_to_pfn(0)) +``` +and then virt_to_pfn(0) to: +``` + ((((unsigned long)(0) - PAGE_OFFSET) >> PAGE_SHIFT) + + PHYS_PFN_OFFSET) +``` +where PAGE_OFFSET and PHYS_PFN_OFFSET are the DRAM offset(0x80000000) and +PAGE_SHIFT is 12. This way we obtain 16MB(0x01000000) summed to the base of +DRAM(0x80000000). +When ZERO_PAGE(0) is then used, for example in bio_add_page(), the page +gets an address that is out of DRAM bounds. +So instead of using fake virtual page 0 let's allocate a dedicated +zero_page during paging_init() and assign it to a global 'struct page * +empty_zero_page' the same way mmu.c does and it's the same approach used +in m68k with commit dc068f462179 as discussed here[0]. Then let's move +ZERO_PAGE() definition to the top of pgtable.h to be in common between +mmu.c and nommu.c. + +[0]: https://lore.kernel.org/linux-m68k/2a462b23-5b8e-bbf4-ec7d-778434a3b9d7@google.com/T/#m1266ceb63 +ad140743174d6b3070364d3c9a5179b + +Signed-off-by: Giulio Benetti +Reviewed-by: Arnd Bergmann +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/pgtable-nommu.h | 6 ------ + arch/arm/include/asm/pgtable.h | 16 +++++++++------- + arch/arm/mm/nommu.c | 19 +++++++++++++++++++ + 3 files changed, 28 insertions(+), 13 deletions(-) + +diff --git a/arch/arm/include/asm/pgtable-nommu.h b/arch/arm/include/asm/pgtable-nommu.h +index d16aba48fa0a..090011394477 100644 +--- a/arch/arm/include/asm/pgtable-nommu.h ++++ b/arch/arm/include/asm/pgtable-nommu.h +@@ -44,12 +44,6 @@ + + typedef pte_t *pte_addr_t; + +-/* +- * ZERO_PAGE is a global shared page that is always zero: used +- * for zero-mapped memory areas etc.. +- */ +-#define ZERO_PAGE(vaddr) (virt_to_page(0)) +- + /* + * Mark the prot value as uncacheable and unbufferable. + */ +diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h +index 78a532068fec..ef48a55e9af8 100644 +--- a/arch/arm/include/asm/pgtable.h ++++ b/arch/arm/include/asm/pgtable.h +@@ -10,6 +10,15 @@ + #include + #include + ++#ifndef __ASSEMBLY__ ++/* ++ * ZERO_PAGE is a global shared page that is always zero: used ++ * for zero-mapped memory areas etc.. ++ */ ++extern struct page *empty_zero_page; ++#define ZERO_PAGE(vaddr) (empty_zero_page) ++#endif ++ + #ifndef CONFIG_MMU + + #include +@@ -139,13 +148,6 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn, + */ + + #ifndef __ASSEMBLY__ +-/* +- * ZERO_PAGE is a global shared page that is always zero: used +- * for zero-mapped memory areas etc.. +- */ +-extern struct page *empty_zero_page; +-#define ZERO_PAGE(vaddr) (empty_zero_page) +- + + extern pgd_t swapper_pg_dir[PTRS_PER_PGD]; + +diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c +index c42debaded95..c1494a4dee25 100644 +--- a/arch/arm/mm/nommu.c ++++ b/arch/arm/mm/nommu.c +@@ -26,6 +26,13 @@ + + unsigned long vectors_base; + ++/* ++ * empty_zero_page is a special page that is used for ++ * zero-initialized data and COW. ++ */ ++struct page *empty_zero_page; ++EXPORT_SYMBOL(empty_zero_page); ++ + #ifdef CONFIG_ARM_MPU + struct mpu_rgn_info mpu_rgn_info; + #endif +@@ -148,9 +155,21 @@ void __init adjust_lowmem_bounds(void) + */ + void __init paging_init(const struct machine_desc *mdesc) + { ++ void *zero_page; ++ + early_trap_init((void *)vectors_base); + mpu_setup(); ++ ++ /* allocate the zero page. */ ++ zero_page = memblock_alloc(PAGE_SIZE, PAGE_SIZE); ++ if (!zero_page) ++ panic("%s: Failed to allocate %lu bytes align=0x%lx\n", ++ __func__, PAGE_SIZE, PAGE_SIZE); ++ + bootmem_init(); ++ ++ empty_zero_page = virt_to_page(zero_page); ++ flush_dcache_page(empty_zero_page); + } + + /* +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-rockchip-disable-arm_global_timer-on-rk3066-.patch b/queue-6.0/arm-dts-rockchip-disable-arm_global_timer-on-rk3066-.patch new file mode 100644 index 00000000000..479e184815b --- /dev/null +++ b/queue-6.0/arm-dts-rockchip-disable-arm_global_timer-on-rk3066-.patch @@ -0,0 +1,64 @@ +From 26af365c554b51b922e108e7fc6970d8659e57f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Oct 2022 21:56:29 +0100 +Subject: ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188 + +From: Johan Jonker + +[ Upstream commit da74858a475782a3f16470907814c8cc5950ad68 ] + +The clock source and the sched_clock provided by the arm_global_timer +on Rockchip rk3066a/rk3188 are quite unstable because their rates +depend on the CPU frequency. + +Recent changes to the arm_global_timer driver makes it impossible to use. + +On the other side, the arm_global_timer has a higher rating than the +ROCKCHIP_TIMER, it will be selected by default by the time framework +while we want to use the stable Rockchip clock source. + +Keep the arm_global_timer disabled in order to have the +DW_APB_TIMER (rk3066a) or ROCKCHIP_TIMER (rk3188) selected by default. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/f275ca8d-fd0a-26e5-b978-b7f3df815e0a@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3188.dtsi | 1 - + arch/arm/boot/dts/rk3xxx.dtsi | 7 +++++++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi +index b8f34bef0efa..44b54af0bbf9 100644 +--- a/arch/arm/boot/dts/rk3188.dtsi ++++ b/arch/arm/boot/dts/rk3188.dtsi +@@ -607,7 +607,6 @@ + + &global_timer { + interrupts = ; +- status = "disabled"; + }; + + &local_timer { +diff --git a/arch/arm/boot/dts/rk3xxx.dtsi b/arch/arm/boot/dts/rk3xxx.dtsi +index 616a828e0c6e..17e89d30de78 100644 +--- a/arch/arm/boot/dts/rk3xxx.dtsi ++++ b/arch/arm/boot/dts/rk3xxx.dtsi +@@ -76,6 +76,13 @@ + reg = <0x1013c200 0x20>; + interrupts = ; + clocks = <&cru CORE_PERI>; ++ status = "disabled"; ++ /* The clock source and the sched_clock provided by the arm_global_timer ++ * on Rockchip rk3066a/rk3188 are quite unstable because their rates ++ * depend on the CPU frequency. ++ * Keep the arm_global_timer disabled in order to have the ++ * DW_APB_TIMER (rk3066a) or ROCKCHIP_TIMER (rk3188) selected by default. ++ */ + }; + + local_timer: local-timer@1013c600 { +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-rockchip-fix-adc-keys-sub-node-names.patch b/queue-6.0/arm-dts-rockchip-fix-adc-keys-sub-node-names.patch new file mode 100644 index 00000000000..1c3adc89f20 --- /dev/null +++ b/queue-6.0/arm-dts-rockchip-fix-adc-keys-sub-node-names.patch @@ -0,0 +1,64 @@ +From 0d1b0e73ea7c21372c1c97b453aabb739063a1a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 10:37:32 +0200 +Subject: ARM: dts: rockchip: fix adc-keys sub node names + +From: Johan Jonker + +[ Upstream commit 942b35de22efeb4f9ded83f1ea7747f3fe5a3bb2 ] + +Fix adc-keys sub node names on Rockchip boards, +so that they match with regex: '^button-' + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/7a0013b1-3a55-a344-e9ea-eacb4b49433c@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3066a-mk808.dts | 2 +- + arch/arm/boot/dts/rk3288-evb.dtsi | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/rk3066a-mk808.dts b/arch/arm/boot/dts/rk3066a-mk808.dts +index cfa318a506eb..2db5ba706208 100644 +--- a/arch/arm/boot/dts/rk3066a-mk808.dts ++++ b/arch/arm/boot/dts/rk3066a-mk808.dts +@@ -32,7 +32,7 @@ + keyup-threshold-microvolt = <2500000>; + poll-interval = <100>; + +- recovery { ++ button-recovery { + label = "recovery"; + linux,code = ; + press-threshold-microvolt = <0>; +diff --git a/arch/arm/boot/dts/rk3288-evb.dtsi b/arch/arm/boot/dts/rk3288-evb.dtsi +index 399d6b9c5fd4..382d2839cf47 100644 +--- a/arch/arm/boot/dts/rk3288-evb.dtsi ++++ b/arch/arm/boot/dts/rk3288-evb.dtsi +@@ -28,19 +28,19 @@ + press-threshold-microvolt = <300000>; + }; + +- menu { ++ button-menu { + label = "Menu"; + linux,code = ; + press-threshold-microvolt = <640000>; + }; + +- esc { ++ button-esc { + label = "Esc"; + linux,code = ; + press-threshold-microvolt = <1000000>; + }; + +- home { ++ button-home { + label = "Home"; + linux,code = ; + press-threshold-microvolt = <1300000>; +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-rockchip-fix-ir-receiver-node-names.patch b/queue-6.0/arm-dts-rockchip-fix-ir-receiver-node-names.patch new file mode 100644 index 00000000000..1071de013a1 --- /dev/null +++ b/queue-6.0/arm-dts-rockchip-fix-ir-receiver-node-names.patch @@ -0,0 +1,36 @@ +From 035e044db6316c4cc8d529de80695cee88c73b2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 10:58:22 +0200 +Subject: ARM: dts: rockchip: fix ir-receiver node names + +From: Johan Jonker + +[ Upstream commit dd847fe34cdf1e89afed1af24986359f13082bfb ] + +Fix ir-receiver node names on Rockchip boards, +so that they match with regex: '^ir(-receiver)?(@[a-f0-9]+)?$' + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/ea5af279-f44c-afea-023d-bb37f5a0d58d@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3188-radxarock.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3188-radxarock.dts b/arch/arm/boot/dts/rk3188-radxarock.dts +index a9ed3cd2c2da..239d2ec37fdc 100644 +--- a/arch/arm/boot/dts/rk3188-radxarock.dts ++++ b/arch/arm/boot/dts/rk3188-radxarock.dts +@@ -71,7 +71,7 @@ + #sound-dai-cells = <0>; + }; + +- ir_recv: gpio-ir-receiver { ++ ir_recv: ir-receiver { + compatible = "gpio-ir-receiver"; + gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>; + pinctrl-names = "default"; +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-rockchip-fix-node-name-for-hym8563-rtc.patch b/queue-6.0/arm-dts-rockchip-fix-node-name-for-hym8563-rtc.patch new file mode 100644 index 00000000000..629e231b357 --- /dev/null +++ b/queue-6.0/arm-dts-rockchip-fix-node-name-for-hym8563-rtc.patch @@ -0,0 +1,91 @@ +From e781e2b017c187d72dd639ecbda305d39ffd2b93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 18:55:46 +0200 +Subject: arm: dts: rockchip: fix node name for hym8563 rtc + +From: Sebastian Reichel + +[ Upstream commit 17b57beafccb4569accbfc8c11390744cf59c021 ] + +Fix the node name for hym8563 in all arm rockchip devicetrees. + +Signed-off-by: Sebastian Reichel +Link: https://lore.kernel.org/r/20221024165549.74574-4-sebastian.reichel@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3036-evb.dts | 2 +- + arch/arm/boot/dts/rk3288-evb-act8846.dts | 2 +- + arch/arm/boot/dts/rk3288-firefly.dtsi | 2 +- + arch/arm/boot/dts/rk3288-miqi.dts | 2 +- + arch/arm/boot/dts/rk3288-rock2-square.dts | 2 +- + 5 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/rk3036-evb.dts b/arch/arm/boot/dts/rk3036-evb.dts +index 2a7e6624efb9..ea23ba98625e 100644 +--- a/arch/arm/boot/dts/rk3036-evb.dts ++++ b/arch/arm/boot/dts/rk3036-evb.dts +@@ -31,7 +31,7 @@ + &i2c1 { + status = "okay"; + +- hym8563: hym8563@51 { ++ hym8563: rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +diff --git a/arch/arm/boot/dts/rk3288-evb-act8846.dts b/arch/arm/boot/dts/rk3288-evb-act8846.dts +index be695b8c1f67..8a635c243127 100644 +--- a/arch/arm/boot/dts/rk3288-evb-act8846.dts ++++ b/arch/arm/boot/dts/rk3288-evb-act8846.dts +@@ -54,7 +54,7 @@ + vin-supply = <&vcc_sys>; + }; + +- hym8563@51 { ++ rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + +diff --git a/arch/arm/boot/dts/rk3288-firefly.dtsi b/arch/arm/boot/dts/rk3288-firefly.dtsi +index 052afe5543e2..9267857beccb 100644 +--- a/arch/arm/boot/dts/rk3288-firefly.dtsi ++++ b/arch/arm/boot/dts/rk3288-firefly.dtsi +@@ -233,7 +233,7 @@ + vin-supply = <&vcc_sys>; + }; + +- hym8563: hym8563@51 { ++ hym8563: rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +diff --git a/arch/arm/boot/dts/rk3288-miqi.dts b/arch/arm/boot/dts/rk3288-miqi.dts +index 713f55e143c6..e3d5644f2915 100644 +--- a/arch/arm/boot/dts/rk3288-miqi.dts ++++ b/arch/arm/boot/dts/rk3288-miqi.dts +@@ -162,7 +162,7 @@ + vin-supply = <&vcc_sys>; + }; + +- hym8563: hym8563@51 { ++ hym8563: rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +diff --git a/arch/arm/boot/dts/rk3288-rock2-square.dts b/arch/arm/boot/dts/rk3288-rock2-square.dts +index 80e0f07c8e87..07a3a52753d2 100644 +--- a/arch/arm/boot/dts/rk3288-rock2-square.dts ++++ b/arch/arm/boot/dts/rk3288-rock2-square.dts +@@ -165,7 +165,7 @@ + }; + + &i2c0 { +- hym8563: hym8563@51 { ++ hym8563: rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-rockchip-remove-clock-frequency-from-rtc.patch b/queue-6.0/arm-dts-rockchip-remove-clock-frequency-from-rtc.patch new file mode 100644 index 00000000000..ba689a6e221 --- /dev/null +++ b/queue-6.0/arm-dts-rockchip-remove-clock-frequency-from-rtc.patch @@ -0,0 +1,87 @@ +From 7b169b6db2766b026157792613f91a3709723818 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 18:55:47 +0200 +Subject: arm: dts: rockchip: remove clock-frequency from rtc + +From: Sebastian Reichel + +[ Upstream commit 6122f3be70d90a1b2a1188d8910256fc218376a9 ] + +'clock-frequency' is not part of the DT binding and not supported by the +Linux driver. + +Signed-off-by: Sebastian Reichel +Link: https://lore.kernel.org/r/20221024165549.74574-5-sebastian.reichel@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3036-evb.dts | 1 - + arch/arm/boot/dts/rk3288-firefly.dtsi | 1 - + arch/arm/boot/dts/rk3288-miqi.dts | 1 - + arch/arm/boot/dts/rk3288-rock2-square.dts | 1 - + arch/arm/boot/dts/rk3288-vmarc-som.dtsi | 1 - + 5 files changed, 5 deletions(-) + +diff --git a/arch/arm/boot/dts/rk3036-evb.dts b/arch/arm/boot/dts/rk3036-evb.dts +index ea23ba98625e..94216f870b57 100644 +--- a/arch/arm/boot/dts/rk3036-evb.dts ++++ b/arch/arm/boot/dts/rk3036-evb.dts +@@ -35,7 +35,6 @@ + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +- clock-frequency = <32768>; + clock-output-names = "xin32k"; + }; + }; +diff --git a/arch/arm/boot/dts/rk3288-firefly.dtsi b/arch/arm/boot/dts/rk3288-firefly.dtsi +index 9267857beccb..3836c61cfb76 100644 +--- a/arch/arm/boot/dts/rk3288-firefly.dtsi ++++ b/arch/arm/boot/dts/rk3288-firefly.dtsi +@@ -237,7 +237,6 @@ + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +- clock-frequency = <32768>; + clock-output-names = "xin32k"; + interrupt-parent = <&gpio7>; + interrupts = ; +diff --git a/arch/arm/boot/dts/rk3288-miqi.dts b/arch/arm/boot/dts/rk3288-miqi.dts +index e3d5644f2915..db1eb648e0e1 100644 +--- a/arch/arm/boot/dts/rk3288-miqi.dts ++++ b/arch/arm/boot/dts/rk3288-miqi.dts +@@ -166,7 +166,6 @@ + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +- clock-frequency = <32768>; + clock-output-names = "xin32k"; + }; + +diff --git a/arch/arm/boot/dts/rk3288-rock2-square.dts b/arch/arm/boot/dts/rk3288-rock2-square.dts +index 07a3a52753d2..13cfdaa95cc7 100644 +--- a/arch/arm/boot/dts/rk3288-rock2-square.dts ++++ b/arch/arm/boot/dts/rk3288-rock2-square.dts +@@ -169,7 +169,6 @@ + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +- clock-frequency = <32768>; + clock-output-names = "xin32k"; + interrupt-parent = <&gpio0>; + interrupts = ; +diff --git a/arch/arm/boot/dts/rk3288-vmarc-som.dtsi b/arch/arm/boot/dts/rk3288-vmarc-som.dtsi +index 0ae2bd150e37..793951655b73 100644 +--- a/arch/arm/boot/dts/rk3288-vmarc-som.dtsi ++++ b/arch/arm/boot/dts/rk3288-vmarc-som.dtsi +@@ -241,7 +241,6 @@ + interrupt-parent = <&gpio5>; + interrupts = ; + #clock-cells = <0>; +- clock-frequency = <32768>; + clock-output-names = "hym8563"; + pinctrl-names = "default"; + pinctrl-0 = <&hym8563_int>; +-- +2.35.1 + diff --git a/queue-6.0/arm-dts-rockchip-rk3188-fix-lcdc1-rgb24-node-name.patch b/queue-6.0/arm-dts-rockchip-rk3188-fix-lcdc1-rgb24-node-name.patch new file mode 100644 index 00000000000..22074d54319 --- /dev/null +++ b/queue-6.0/arm-dts-rockchip-rk3188-fix-lcdc1-rgb24-node-name.patch @@ -0,0 +1,36 @@ +From 55e1533292bd0b2fa2fec8a68193b676bec2cae6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 01:31:37 +0200 +Subject: ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name + +From: Johan Jonker + +[ Upstream commit 11871e20bcb23c00966e785a124fb72bc8340af4 ] + +The lcdc1-rgb24 node name is out of line with the rest +of the rk3188 lcdc1 node, so fix it. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/7b9c0a6f-626b-07e8-ae74-7e0f08b8d241@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3188.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi +index cdd4a0bd5133..b8f34bef0efa 100644 +--- a/arch/arm/boot/dts/rk3188.dtsi ++++ b/arch/arm/boot/dts/rk3188.dtsi +@@ -379,7 +379,7 @@ + rockchip,pins = <2 RK_PD3 1 &pcfg_pull_none>; + }; + +- lcdc1_rgb24: ldcd1-rgb24 { ++ lcdc1_rgb24: lcdc1-rgb24 { + rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>, + <2 RK_PA1 1 &pcfg_pull_none>, + <2 RK_PA2 1 &pcfg_pull_none>, +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-rockchip-fix-adc-keys-sub-node-names.patch b/queue-6.0/arm64-dts-rockchip-fix-adc-keys-sub-node-names.patch new file mode 100644 index 00000000000..e7a191b8806 --- /dev/null +++ b/queue-6.0/arm64-dts-rockchip-fix-adc-keys-sub-node-names.patch @@ -0,0 +1,241 @@ +From a87240c4f2317fd841852453092d21190b0c7149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 10:38:35 +0200 +Subject: arm64: dts: rockchip: fix adc-keys sub node names + +From: Johan Jonker + +[ Upstream commit f2bd2e76d6ea13e12849975adae46145375532a4 ] + +Fix adc-keys sub node names on Rockchip boards, +so that they match with regex: '^button-' + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/6a6a3603-5540-cacc-2672-c015af1ec684@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/px30-evb.dts | 10 +++++----- + arch/arm64/boot/dts/rockchip/rk3308-evb.dts | 12 ++++++------ + arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts | 2 +- + arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi | 2 +- + arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts | 2 +- + arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts | 2 +- + arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts | 4 ++-- + arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi | 2 +- + .../boot/dts/rockchip/rk3399-sapphire-excavator.dts | 4 ++-- + arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 2 +- + 10 files changed, 21 insertions(+), 21 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/px30-evb.dts b/arch/arm64/boot/dts/rockchip/px30-evb.dts +index 848bc39cf86a..4249b42843da 100644 +--- a/arch/arm64/boot/dts/rockchip/px30-evb.dts ++++ b/arch/arm64/boot/dts/rockchip/px30-evb.dts +@@ -30,31 +30,31 @@ + keyup-threshold-microvolt = <1800000>; + poll-interval = <100>; + +- esc-key { ++ button-esc { + label = "esc"; + linux,code = ; + press-threshold-microvolt = <1310000>; + }; + +- home-key { ++ button-home { + label = "home"; + linux,code = ; + press-threshold-microvolt = <624000>; + }; + +- menu-key { ++ button-menu { + label = "menu"; + linux,code = ; + press-threshold-microvolt = <987000>; + }; + +- vol-down-key { ++ button-down { + label = "volume down"; + linux,code = ; + press-threshold-microvolt = <300000>; + }; + +- vol-up-key { ++ button-up { + label = "volume up"; + linux,code = ; + press-threshold-microvolt = <17000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-evb.dts b/arch/arm64/boot/dts/rockchip/rk3308-evb.dts +index 9fe9b0d11003..184b84fdde07 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-evb.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-evb.dts +@@ -23,7 +23,7 @@ + poll-interval = <100>; + keyup-threshold-microvolt = <1800000>; + +- func-key { ++ button-func { + linux,code = ; + label = "function"; + press-threshold-microvolt = <18000>; +@@ -37,31 +37,31 @@ + poll-interval = <100>; + keyup-threshold-microvolt = <1800000>; + +- esc-key { ++ button-esc { + linux,code = ; + label = "micmute"; + press-threshold-microvolt = <1130000>; + }; + +- home-key { ++ button-home { + linux,code = ; + label = "mode"; + press-threshold-microvolt = <901000>; + }; + +- menu-key { ++ button-menu { + linux,code = ; + label = "play"; + press-threshold-microvolt = <624000>; + }; + +- vol-down-key { ++ button-down { + linux,code = ; + label = "volume down"; + press-threshold-microvolt = <300000>; + }; + +- vol-up-key { ++ button-up { + linux,code = ; + label = "volume up"; + press-threshold-microvolt = <18000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts b/arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts +index 43c928ac98f0..1deef53a4c94 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts +@@ -25,7 +25,7 @@ + keyup-threshold-microvolt = <1800000>; + poll-interval = <100>; + +- recovery { ++ button-recovery { + label = "recovery"; + linux,code = ; + press-threshold-microvolt = <17000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi +index 2a332763c35c..9d9297bc5f04 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi +@@ -123,7 +123,7 @@ + keyup-threshold-microvolt = <1800000>; + poll-interval = <100>; + +- recovery { ++ button-recovery { + label = "Recovery"; + linux,code = ; + press-threshold-microvolt = <18000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts b/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts +index 452728b82e42..3bf8f959e42c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts +@@ -39,7 +39,7 @@ + keyup-threshold-microvolt = <1800000>; + poll-interval = <100>; + +- recovery { ++ button-recovery { + label = "Recovery"; + linux,code = ; + press-threshold-microvolt = <18000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts +index 72182c58cc46..65cb21837b0c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts +@@ -19,7 +19,7 @@ + keyup-threshold-microvolt = <1500000>; + poll-interval = <100>; + +- recovery { ++ button-recovery { + label = "Recovery"; + linux,code = ; + press-threshold-microvolt = <18000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts b/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts +index 9e2e246e0bab..dba4d03bfc2b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts +@@ -52,13 +52,13 @@ + press-threshold-microvolt = <300000>; + }; + +- back { ++ button-back { + label = "Back"; + linux,code = ; + press-threshold-microvolt = <985000>; + }; + +- menu { ++ button-menu { + label = "Menu"; + linux,code = ; + press-threshold-microvolt = <1314000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi +index acb174d3a8c5..4f3dd107e83e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi +@@ -41,7 +41,7 @@ + keyup-threshold-microvolt = <1500000>; + poll-interval = <100>; + +- recovery { ++ button-recovery { + label = "Recovery"; + linux,code = ; + press-threshold-microvolt = <18000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +index 13927e7d0724..dbec2b7173a0 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts +@@ -33,13 +33,13 @@ + press-threshold-microvolt = <300000>; + }; + +- back { ++ button-back { + label = "Back"; + linux,code = ; + press-threshold-microvolt = <985000>; + }; + +- menu { ++ button-menu { + label = "Menu"; + linux,code = ; + press-threshold-microvolt = <1314000>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +index 0d45868132b9..8d61f824c12d 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi +@@ -23,7 +23,7 @@ + io-channel-names = "buttons"; + keyup-threshold-microvolt = <1750000>; + +- recovery { ++ button-recovery { + label = "recovery"; + linux,code = ; + press-threshold-microvolt = <0>; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-rockchip-fix-gmac-failure-of-rgmii-id-from.patch b/queue-6.0/arm64-dts-rockchip-fix-gmac-failure-of-rgmii-id-from.patch new file mode 100644 index 00000000000..04e82ffbbbd --- /dev/null +++ b/queue-6.0/arm64-dts-rockchip-fix-gmac-failure-of-rgmii-id-from.patch @@ -0,0 +1,36 @@ +From a4c479583032d5fea7c929a5da2c9fc15f5b150b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 22:01:40 +0300 +Subject: arm64: dts: rockchip: Fix gmac failure of rgmii-id from rk3566-roc-pc + +From: Furkan Kardame + +[ Upstream commit adbab347ec8861aa80d850693df3cd005ec65a99 ] + +Lan does not work on rgmii-id, most rk356x devices lan +is being switched to rgmii. + +Signed-off-by: Furkan Kardame +Link: https://lore.kernel.org/r/20221010190142.18340-2-f.kardame@manjaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts +index 57759b66d44d..8db83088ae4e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts +@@ -130,7 +130,7 @@ + assigned-clocks = <&cru SCLK_GMAC1_RX_TX>, <&cru SCLK_GMAC1_RGMII_SPEED>, <&cru SCLK_GMAC1>; + assigned-clock-parents = <&cru SCLK_GMAC1_RGMII_SPEED>, <&cru SCLK_GMAC1>, <&gmac1_clkin>; + clock_in_out = "input"; +- phy-mode = "rgmii-id"; ++ phy-mode = "rgmii"; + phy-supply = <&vcc_3v3>; + pinctrl-names = "default"; + pinctrl-0 = <&gmac1m0_miim +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-rockchip-fix-i2c3-pinctrl-on-rk3566-roc-pc.patch b/queue-6.0/arm64-dts-rockchip-fix-i2c3-pinctrl-on-rk3566-roc-pc.patch new file mode 100644 index 00000000000..e05ee94c30a --- /dev/null +++ b/queue-6.0/arm64-dts-rockchip-fix-i2c3-pinctrl-on-rk3566-roc-pc.patch @@ -0,0 +1,35 @@ +From a198dad7814a6a6671673dff5daeb7a32f888958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 22:01:41 +0300 +Subject: arm64: dts: rockchip: Fix i2c3 pinctrl on rk3566-roc-pc + +From: Furkan Kardame + +[ Upstream commit 2440ad0d851e404adcd1b9ad758f28bd59365bae ] + +As per device schematic i2c3 pinctrl is connected to m0 instead of m1 + +Signed-off-by: Furkan Kardame +Link: https://lore.kernel.org/r/20221010190142.18340-3-f.kardame@manjaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts +index 8db83088ae4e..b8ed215ab8fb 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts +@@ -397,7 +397,7 @@ + + &i2c3 { + pinctrl-names = "default"; +- pinctrl-0 = <&i2c3m1_xfer>; ++ pinctrl-0 = <&i2c3m0_xfer>; + status = "okay"; + }; + +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-rockchip-fix-ir-receiver-node-names.patch b/queue-6.0/arm64-dts-rockchip-fix-ir-receiver-node-names.patch new file mode 100644 index 00000000000..c1bebcd60a1 --- /dev/null +++ b/queue-6.0/arm64-dts-rockchip-fix-ir-receiver-node-names.patch @@ -0,0 +1,36 @@ +From 056d9cb9cd1d6c1b25af1c29296e8061d262236d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 10:59:10 +0200 +Subject: arm64: dts: rockchip: fix ir-receiver node names + +From: Johan Jonker + +[ Upstream commit de0d04b9780a23eb928aedfb6f981285f78d58e5 ] + +Fix ir-receiver node names on Rockchip boards, +so that they match with regex: '^ir(-receiver)?(@[a-f0-9]+)?$' + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/e9764253-8ce8-150b-4820-41f03f845469@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts +index ea6820902ede..7ea48167747c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts +@@ -19,7 +19,7 @@ + stdout-path = "serial2:1500000n8"; + }; + +- ir_rx { ++ ir-receiver { + compatible = "gpio-ir-receiver"; + gpios = <&gpio0 RK_PC0 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-rockchip-fix-node-name-for-hym8563-rtc.patch b/queue-6.0/arm64-dts-rockchip-fix-node-name-for-hym8563-rtc.patch new file mode 100644 index 00000000000..05cc36d121a --- /dev/null +++ b/queue-6.0/arm64-dts-rockchip-fix-node-name-for-hym8563-rtc.patch @@ -0,0 +1,77 @@ +From 800a002aef4e37d49c7c392659f7b2057ea1f282 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 18:55:44 +0200 +Subject: arm64: dts: rockchip: fix node name for hym8563 rtc + +From: Sebastian Reichel + +[ Upstream commit 67a9aeef44e42b1ac2becf5e61eae0880f48d9db ] + +Fix the node name for hym8563 in all arm64 rockchip devicetrees. + +Signed-off-by: Sebastian Reichel +Link: https://lore.kernel.org/r/20221024165549.74574-2-sebastian.reichel@collabora.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts | 2 +- + arch/arm64/boot/dts/rockchip/rk3368-r88.dts | 2 +- + arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 2 +- + arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts b/arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts +index 7f5bba0c6001..0e88e9592c1c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts +@@ -208,7 +208,7 @@ + vin-supply = <&vcc_sys>; + }; + +- hym8563: hym8563@51 { ++ hym8563: rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3368-r88.dts b/arch/arm64/boot/dts/rockchip/rk3368-r88.dts +index 38d757c00548..e147d6f8b43e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368-r88.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3368-r88.dts +@@ -192,7 +192,7 @@ + vin-supply = <&vcc_sys>; + }; + +- hym8563: hym8563@51 { ++ hym8563: rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts +index 5a2661ae0131..18b5050c6cd3 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts +@@ -98,7 +98,7 @@ + }; + + &i2c0 { +- hym8563: hym8563@51 { ++ hym8563: rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + interrupt-parent = <&gpio0>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi b/arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi +index 935b8c68a71d..6c168566321b 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi +@@ -297,7 +297,7 @@ + clock-frequency = <400000>; + status = "okay"; + +- hym8563: hym8563@51 { ++ hym8563: rtc@51 { + compatible = "haoyu,hym8563"; + reg = <0x51>; + #clock-cells = <0>; +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-rockchip-keep-i2s1-disabled-for-gpio-funct.patch b/queue-6.0/arm64-dts-rockchip-keep-i2s1-disabled-for-gpio-funct.patch new file mode 100644 index 00000000000..26b52d937ec --- /dev/null +++ b/queue-6.0/arm64-dts-rockchip-keep-i2s1-disabled-for-gpio-funct.patch @@ -0,0 +1,36 @@ +From bc2c798b344ac7698731087004b7521ee282dec1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Sep 2022 11:28:12 +0000 +Subject: arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi + 4 series + +From: FUKAUMI Naoki + +[ Upstream commit 849c19d14940b87332d5d59c7fc581d73f2099fd ] + +I2S1 pins are exposed on 40-pin header on Radxa ROCK Pi 4 series. +their default function is GPIO, so I2S1 need to be disabled. + +Signed-off-by: FUKAUMI Naoki +Link: https://lore.kernel.org/r/20220924112812.1219-1-naoki@radxa.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi +index 401e1ae9d944..b045f74071e4 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi +@@ -491,7 +491,6 @@ + &i2s1 { + rockchip,playback-channels = <2>; + rockchip,capture-channels = <2>; +- status = "okay"; + }; + + &i2s2 { +-- +2.35.1 + diff --git a/queue-6.0/arm64-dts-rockchip-remove-i2c5-from-rk3566-roc-pc.patch b/queue-6.0/arm64-dts-rockchip-remove-i2c5-from-rk3566-roc-pc.patch new file mode 100644 index 00000000000..973649aed31 --- /dev/null +++ b/queue-6.0/arm64-dts-rockchip-remove-i2c5-from-rk3566-roc-pc.patch @@ -0,0 +1,37 @@ +From 03df4a3b8f241f71dd985efa3b78768953d1c050 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 22:01:42 +0300 +Subject: arm64: dts: rockchip: remove i2c5 from rk3566-roc-pc + +From: Furkan Kardame + +[ Upstream commit b44bc59d0d279fa4f3dc11b895f2c8f77719885d ] + +i2c5 is owned by hdmi port + +Signed-off-by: Furkan Kardame +Link: https://lore.kernel.org/r/20221010190142.18340-4-f.kardame@manjaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts +index b8ed215ab8fb..ab1abf0bb749 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts +@@ -401,10 +401,6 @@ + status = "okay"; + }; + +-&i2c5 { +- status = "okay"; +-}; +- + &mdio1 { + rgmii_phy1: ethernet-phy@0 { + compatible = "ethernet-phy-ieee802.3-c22"; +-- +2.35.1 + diff --git a/queue-6.0/asoc-rt711-sdca-fix-the-latency-time-of-clock-stop-p.patch b/queue-6.0/asoc-rt711-sdca-fix-the-latency-time-of-clock-stop-p.patch new file mode 100644 index 00000000000..fbf3dcbe2ad --- /dev/null +++ b/queue-6.0/asoc-rt711-sdca-fix-the-latency-time-of-clock-stop-p.patch @@ -0,0 +1,39 @@ +From f7d1a3b5c6654217f5f93578d4fceb4d62073964 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Nov 2022 17:03:18 +0800 +Subject: ASoC: rt711-sdca: fix the latency time of clock stop prepare state + machine transitions + +From: Shuming Fan + +[ Upstream commit c7d7d4e7bb1290cc473610b0bb96d9fa606d00e7 ] + +Due to the hardware behavior, it takes some time for CBJ detection/impedance sensing/de-bounce. +The ClockStop_NotFinished flag will be raised until these functions are completed. +In ClockStopMode0 mode case, the SdW controller might check this flag from D3 to D0 when the +jack detection interrupt happened. + +Signed-off-by: Shuming Fan +Link: https://lore.kernel.org/r/20221116090318.5017-1-shumingf@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdca-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt711-sdca-sdw.c b/sound/soc/codecs/rt711-sdca-sdw.c +index a085b2f530aa..31e77d462ef3 100644 +--- a/sound/soc/codecs/rt711-sdca-sdw.c ++++ b/sound/soc/codecs/rt711-sdca-sdw.c +@@ -230,7 +230,7 @@ static int rt711_sdca_read_prop(struct sdw_slave *slave) + } + + /* set the timeout values */ +- prop->clk_stop_timeout = 20; ++ prop->clk_stop_timeout = 700; + + /* wake-up event */ + prop->wake_capable = 1; +-- +2.35.1 + diff --git a/queue-6.0/asoc-soc-pcm-add-null-check-in-be-reparenting.patch b/queue-6.0/asoc-soc-pcm-add-null-check-in-be-reparenting.patch new file mode 100644 index 00000000000..0b861a07a4b --- /dev/null +++ b/queue-6.0/asoc-soc-pcm-add-null-check-in-be-reparenting.patch @@ -0,0 +1,37 @@ +From 48404b3e9309975c8c86026c1af2d428caeb4689 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 12:01:13 +0530 +Subject: ASoC: soc-pcm: Add NULL check in BE reparenting + +From: Srinivasa Rao Mandadapu + +[ Upstream commit db8f91d424fe0ea6db337aca8bc05908bbce1498 ] + +Add NULL check in dpcm_be_reparent API, to handle +kernel NULL pointer dereference error. +The issue occurred in fuzzing test. + +Signed-off-by: Srinivasa Rao Mandadapu +Link: https://lore.kernel.org/r/1669098673-29703-1-git-send-email-quic_srivasam@quicinc.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index f6a996f0f9c7..f000a7168afc 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1242,6 +1242,8 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe, + return; + + be_substream = snd_soc_dpcm_get_substream(be, stream); ++ if (!be_substream) ++ return; + + for_each_dpcm_fe(be, stream, dpcm) { + if (dpcm->fe == fe) +-- +2.35.1 + diff --git a/queue-6.0/asoc-wm8962-wait-for-updated-value-of-wm8962_clockin.patch b/queue-6.0/asoc-wm8962-wait-for-updated-value-of-wm8962_clockin.patch new file mode 100644 index 00000000000..959bf91e37d --- /dev/null +++ b/queue-6.0/asoc-wm8962-wait-for-updated-value-of-wm8962_clockin.patch @@ -0,0 +1,47 @@ +From 3f009a610fc78016ced546918f88c47d6733be11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 20:13:54 +0800 +Subject: ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register + +From: Chancel Liu + +[ Upstream commit 3ca507bf99611c82dafced73e921c1b10ee12869 ] + +DSPCLK_DIV field in WM8962_CLOCKING1 register is used to generate +correct frequency of LRCLK and BCLK. Sometimes the read-only value +can't be updated timely after enabling SYSCLK. This results in wrong +calculation values. Delay is introduced here to wait for newest value +from register. The time of the delay should be at least 500~1000us +according to test. + +Signed-off-by: Chancel Liu +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20221109121354.123958-1-chancel.liu@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 6df06fba4377..ee1cad5af535 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2503,6 +2503,14 @@ static void wm8962_configure_bclk(struct snd_soc_component *component) + snd_soc_component_update_bits(component, WM8962_CLOCKING2, + WM8962_SYSCLK_ENA_MASK, WM8962_SYSCLK_ENA); + ++ /* DSPCLK_DIV field in WM8962_CLOCKING1 register is used to generate ++ * correct frequency of LRCLK and BCLK. Sometimes the read-only value ++ * can't be updated timely after enabling SYSCLK. This results in wrong ++ * calculation values. Delay is introduced here to wait for newest ++ * value from register. The time of the delay should be at least ++ * 500~1000us according to test. ++ */ ++ usleep_range(500, 1000); + dspclk = snd_soc_component_read(component, WM8962_CLOCKING1); + + if (snd_soc_component_get_bias_level(component) != SND_SOC_BIAS_ON) +-- +2.35.1 + diff --git a/queue-6.0/btrfs-send-avoid-unaligned-encoded-writes-when-attem.patch b/queue-6.0/btrfs-send-avoid-unaligned-encoded-writes-when-attem.patch new file mode 100644 index 00000000000..68f05cb2279 --- /dev/null +++ b/queue-6.0/btrfs-send-avoid-unaligned-encoded-writes-when-attem.patch @@ -0,0 +1,161 @@ +From b85137aa42a24d287986bc2b7bf4b416d00549d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 16:29:44 +0000 +Subject: btrfs: send: avoid unaligned encoded writes when attempting to clone + range + +From: Filipe Manana + +[ Upstream commit a11452a3709e217492798cf3686ac2cc8eb3fb51 ] + +When trying to see if we can clone a file range, there are cases where we +end up sending two write operations in case the inode from the source root +has an i_size that is not sector size aligned and the length from the +current offset to its i_size is less than the remaining length we are +trying to clone. + +Issuing two write operations when we could instead issue a single write +operation is not incorrect. However it is not optimal, specially if the +extents are compressed and the flag BTRFS_SEND_FLAG_COMPRESSED was passed +to the send ioctl. In that case we can end up sending an encoded write +with an offset that is not sector size aligned, which makes the receiver +fallback to decompressing the data and writing it using regular buffered +IO (so re-compressing the data in case the fs is mounted with compression +enabled), because encoded writes fail with -EINVAL when an offset is not +sector size aligned. + +The following example, which triggered a bug in the receiver code for the +fallback logic of decompressing + regular buffer IO and is fixed by the +patchset referred in a Link at the bottom of this changelog, is an example +where we have the non-optimal behaviour due to an unaligned encoded write: + + $ cat test.sh + #!/bin/bash + + DEV=/dev/sdj + MNT=/mnt/sdj + + mkfs.btrfs -f $DEV > /dev/null + mount -o compress $DEV $MNT + + # File foo has a size of 33K, not aligned to the sector size. + xfs_io -f -c "pwrite -S 0xab 0 33K" $MNT/foo + + xfs_io -f -c "pwrite -S 0xcd 0 64K" $MNT/bar + + # Now clone the first 32K of file bar into foo at offset 0. + xfs_io -c "reflink $MNT/bar 0 0 32K" $MNT/foo + + # Snapshot the default subvolume and create a full send stream (v2). + btrfs subvolume snapshot -r $MNT $MNT/snap + + btrfs send --compressed-data -f /tmp/test.send $MNT/snap + + echo -e "\nFile bar in the original filesystem:" + od -A d -t x1 $MNT/snap/bar + + umount $MNT + mkfs.btrfs -f $DEV > /dev/null + mount $DEV $MNT + + echo -e "\nReceiving stream in a new filesystem..." + btrfs receive -f /tmp/test.send $MNT + + echo -e "\nFile bar in the new filesystem:" + od -A d -t x1 $MNT/snap/bar + + umount $MNT + +Before this patch, the send stream included one regular write and one +encoded write for file 'bar', with the later being not sector size aligned +and causing the receiver to fallback to decompression + buffered writes. +The output of the btrfs receive command in verbose mode (-vvv): + + (...) + mkfile o258-7-0 + rename o258-7-0 -> bar + utimes + clone bar - source=foo source offset=0 offset=0 length=32768 + write bar - offset=32768 length=1024 + encoded_write bar - offset=33792, len=4096, unencoded_offset=33792, unencoded_file_len=31744, unencoded_len=65536, compression=1, encryption=0 + encoded_write bar - falling back to decompress and write due to errno 22 ("Invalid argument") + (...) + +This patch avoids the regular write followed by an unaligned encoded write +so that we end up sending a single encoded write that is aligned. So after +this patch the stream content is (output of btrfs receive -vvv): + + (...) + mkfile o258-7-0 + rename o258-7-0 -> bar + utimes + clone bar - source=foo source offset=0 offset=0 length=32768 + encoded_write bar - offset=32768, len=4096, unencoded_offset=32768, unencoded_file_len=32768, unencoded_len=65536, compression=1, encryption=0 + (...) + +So we get more optimal behaviour and avoid the silent data loss bug in +versions of btrfs-progs affected by the bug referred by the Link tag +below (btrfs-progs v5.19, v5.19.1, v6.0 and v6.0.1). + +Link: https://lore.kernel.org/linux-btrfs/cover.1668529099.git.fdmanana@suse.com/ +Reviewed-by: Boris Burkov +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/send.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index e7671afcee4f..8cc038460bed 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -5615,6 +5615,7 @@ static int clone_range(struct send_ctx *sctx, struct btrfs_path *dst_path, + u64 ext_len; + u64 clone_len; + u64 clone_data_offset; ++ bool crossed_src_i_size = false; + + if (slot >= btrfs_header_nritems(leaf)) { + ret = btrfs_next_leaf(clone_root->root, path); +@@ -5672,8 +5673,10 @@ static int clone_range(struct send_ctx *sctx, struct btrfs_path *dst_path, + if (key.offset >= clone_src_i_size) + break; + +- if (key.offset + ext_len > clone_src_i_size) ++ if (key.offset + ext_len > clone_src_i_size) { + ext_len = clone_src_i_size - key.offset; ++ crossed_src_i_size = true; ++ } + + clone_data_offset = btrfs_file_extent_offset(leaf, ei); + if (btrfs_file_extent_disk_bytenr(leaf, ei) == disk_byte) { +@@ -5734,6 +5737,25 @@ static int clone_range(struct send_ctx *sctx, struct btrfs_path *dst_path, + ret = send_clone(sctx, offset, clone_len, + clone_root); + } ++ } else if (crossed_src_i_size && clone_len < len) { ++ /* ++ * If we are at i_size of the clone source inode and we ++ * can not clone from it, terminate the loop. This is ++ * to avoid sending two write operations, one with a ++ * length matching clone_len and the final one after ++ * this loop with a length of len - clone_len. ++ * ++ * When using encoded writes (BTRFS_SEND_FLAG_COMPRESSED ++ * was passed to the send ioctl), this helps avoid ++ * sending an encoded write for an offset that is not ++ * sector size aligned, in case the i_size of the source ++ * inode is not sector size aligned. That will make the ++ * receiver fallback to decompression of the data and ++ * writing it using regular buffered IO, therefore while ++ * not incorrect, it's not optimal due decompression and ++ * possible re-compression at the receiver. ++ */ ++ break; + } else { + ret = send_extent_data(sctx, dst_path, offset, + clone_len); +-- +2.35.1 + diff --git a/queue-6.0/crypto-ccp-add-a-quirk-to-firmware-update.patch b/queue-6.0/crypto-ccp-add-a-quirk-to-firmware-update.patch new file mode 100644 index 00000000000..d8a2b2f87bf --- /dev/null +++ b/queue-6.0/crypto-ccp-add-a-quirk-to-firmware-update.patch @@ -0,0 +1,78 @@ +From 0db59ee0bef2dee52c0186a98758a522e0f1d820 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Aug 2022 01:49:15 +0300 +Subject: crypto: ccp - Add a quirk to firmware update + +From: Jarkko Sakkinen + +[ Upstream commit b3b9fdf1a9be4266b01a2063b1f37cdc20806e3b ] + +A quirk for fixing the committed TCB version, when upgrading from a +firmware version earlier than 1.50. This is a known issue, and the +documented workaround is to load the firmware twice. + +Currently, this issue requires the following workaround: + +sudo modprobe -r kvm_amd +sudo modprobe -r ccp +sudo modprobe ccp +sudo modprobe kvm_amd + +Implement this workaround inside kernel by checking whether the API +version is less than 1.50, and if so, download the firmware twice. +This addresses the TCB version issue. + +Link: https://lore.kernel.org/all/de02389f-249d-f565-1136-4af3655fab2a@profian.com/ +Reported-by: Harald Hoyer +Signed-off-by: Jarkko Sakkinen +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sev-dev.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 6c49e6d06114..034a74196a82 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -748,6 +748,11 @@ static int sev_update_firmware(struct device *dev) + struct page *p; + u64 data_size; + ++ if (!sev_version_greater_or_equal(0, 15)) { ++ dev_dbg(dev, "DOWNLOAD_FIRMWARE not supported\n"); ++ return -1; ++ } ++ + if (sev_get_firmware(dev, &firmware) == -ENOENT) { + dev_dbg(dev, "No SEV firmware file present\n"); + return -1; +@@ -780,6 +785,14 @@ static int sev_update_firmware(struct device *dev) + data->len = firmware->size; + + ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error); ++ ++ /* ++ * A quirk for fixing the committed TCB version, when upgrading from ++ * earlier firmware version than 1.50. ++ */ ++ if (!ret && !sev_version_greater_or_equal(1, 50)) ++ ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error); ++ + if (ret) + dev_dbg(dev, "Failed to update SEV firmware: %#x\n", error); + else +@@ -1289,8 +1302,7 @@ void sev_pci_init(void) + if (sev_get_api_version()) + goto err; + +- if (sev_version_greater_or_equal(0, 15) && +- sev_update_firmware(sev->dev) == 0) ++ if (sev_update_firmware(sev->dev) == 0) + sev_get_api_version(); + + /* If an init_ex_path is provided rely on INIT_EX for PSP initialization +-- +2.35.1 + diff --git a/queue-6.0/drm-amd-display-avoid-setting-pixel-rate-divider-to-.patch b/queue-6.0/drm-amd-display-avoid-setting-pixel-rate-divider-to-.patch new file mode 100644 index 00000000000..d0c7570263f --- /dev/null +++ b/queue-6.0/drm-amd-display-avoid-setting-pixel-rate-divider-to-.patch @@ -0,0 +1,99 @@ +From 728d666aed0dc53488c1f1f73a0e223b54e710d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 14:11:00 -0500 +Subject: drm/amd/display: Avoid setting pixel rate divider to N/A + +From: Taimur Hassan + +[ Upstream commit 2a5dd86a69ea5435f1a837bdb7fafcda609a7c91 ] + +[Why] +Pixel rate divider values should never be set to N/A (0xF) as the K1/K2 +field is only 1/2 bits wide. + +[How] +Set valid divider values for virtual and FRL/DP2 cases. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Brian Chang +Signed-off-by: Taimur Hassan +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 7 +++++++ + drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c | 3 ++- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c | 4 +++- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 1 + + 4 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c +index fb729674953b..de9fa534b77a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c +@@ -96,6 +96,13 @@ static void dccg314_set_pixel_rate_div( + struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg); + enum pixel_rate_div cur_k1 = PIXEL_RATE_DIV_NA, cur_k2 = PIXEL_RATE_DIV_NA; + ++ // Don't program 0xF into the register field. Not valid since ++ // K1 / K2 field is only 1 / 2 bits wide ++ if (k1 == PIXEL_RATE_DIV_NA || k2 == PIXEL_RATE_DIV_NA) { ++ BREAK_TO_DEBUGGER(); ++ return; ++ } ++ + dccg314_get_pixel_rate_div(dccg, otg_inst, &cur_k1, &cur_k2); + if (k1 == PIXEL_RATE_DIV_NA || k2 == PIXEL_RATE_DIV_NA || (k1 == cur_k1 && k2 == cur_k2)) + return; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c +index f4d1b83979fe..a0741794db62 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c +@@ -349,6 +349,7 @@ unsigned int dcn314_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsig + odm_combine_factor = get_odm_config(pipe_ctx, NULL); + + if (is_dp_128b_132b_signal(pipe_ctx)) { ++ *k1_div = PIXEL_RATE_DIV_BY_1; + *k2_div = PIXEL_RATE_DIV_BY_1; + } else if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal) || dc_is_dvi_signal(pipe_ctx->stream->signal)) { + *k1_div = PIXEL_RATE_DIV_BY_1; +@@ -356,7 +357,7 @@ unsigned int dcn314_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsig + *k2_div = PIXEL_RATE_DIV_BY_2; + else + *k2_div = PIXEL_RATE_DIV_BY_4; +- } else if (dc_is_dp_signal(pipe_ctx->stream->signal)) { ++ } else if (dc_is_dp_signal(pipe_ctx->stream->signal) || dc_is_virtual_signal(pipe_ctx->stream->signal)) { + if (two_pix_per_container) { + *k1_div = PIXEL_RATE_DIV_BY_1; + *k2_div = PIXEL_RATE_DIV_BY_2; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c +index 6640d0ac4304..6dd8dadd68a5 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c +@@ -96,8 +96,10 @@ static void dccg32_set_pixel_rate_div( + + // Don't program 0xF into the register field. Not valid since + // K1 / K2 field is only 1 / 2 bits wide +- if (k1 == PIXEL_RATE_DIV_NA || k2 == PIXEL_RATE_DIV_NA) ++ if (k1 == PIXEL_RATE_DIV_NA || k2 == PIXEL_RATE_DIV_NA) { ++ BREAK_TO_DEBUGGER(); + return; ++ } + + dccg32_get_pixel_rate_div(dccg, otg_inst, &cur_k1, &cur_k2); + if (k1 == cur_k1 && k2 == cur_k2) +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +index bbc0bfbec6c4..3128c111c619 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +@@ -1171,6 +1171,7 @@ unsigned int dcn32_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsign + odm_combine_factor = get_odm_config(pipe_ctx, NULL); + + if (is_dp_128b_132b_signal(pipe_ctx)) { ++ *k1_div = PIXEL_RATE_DIV_BY_1; + *k2_div = PIXEL_RATE_DIV_BY_1; + } else if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal) || dc_is_dvi_signal(pipe_ctx->stream->signal)) { + *k1_div = PIXEL_RATE_DIV_BY_1; +-- +2.35.1 + diff --git a/queue-6.0/drm-amd-display-use-new-num-clk-levels-struct-for-ma.patch b/queue-6.0/drm-amd-display-use-new-num-clk-levels-struct-for-ma.patch new file mode 100644 index 00000000000..9da8e37f376 --- /dev/null +++ b/queue-6.0/drm-amd-display-use-new-num-clk-levels-struct-for-ma.patch @@ -0,0 +1,44 @@ +From c2bce682e2150a23eb0eb877b87c56b827299339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 14:06:58 -0500 +Subject: drm/amd/display: Use new num clk levels struct for max mclk index + +From: Dillon Varone + +[ Upstream commit e667ee3b0c049bf0c69426879586a2572bb28d26 ] + +[WHY?] +When calculating watermark and dlg values, the max mclk level index and +associated speed are needed to find the correlated dummy latency value. +Currently the incorrect index is given due to a clock manager refactor. + +[HOW?] +Use num_memclk_level from num_entries_per_clk struct for getting the correct max +mem speed. + +Reviewed-by: Jun Lei +Acked-by: Brian Chang +Signed-off-by: Dillon Varone +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +index 2f996fdaa70d..07c56e231b04 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +@@ -1803,7 +1803,7 @@ void dcn32_calculate_wm_and_dlg_fpu(struct dc *dc, struct dc_state *context, + + if (context->bw_ctx.dml.vba.DRAMClockChangeSupport[vlevel][maxMpcComb] == + dm_dram_clock_change_unsupported) { +- int min_dram_speed_mts_offset = dc->clk_mgr->bw_params->clk_table.num_entries - 1; ++ int min_dram_speed_mts_offset = dc->clk_mgr->bw_params->clk_table.num_entries_per_clk.num_memclk_levels - 1; + + min_dram_speed_mts = + dc->clk_mgr->bw_params->clk_table.entries[min_dram_speed_mts_offset].memclk_mhz * 16; +-- +2.35.1 + diff --git a/queue-6.0/drm-amd-display-use-viewport-height-for-subvp-mall-a.patch b/queue-6.0/drm-amd-display-use-viewport-height-for-subvp-mall-a.patch new file mode 100644 index 00000000000..90850d7b619 --- /dev/null +++ b/queue-6.0/drm-amd-display-use-viewport-height-for-subvp-mall-a.patch @@ -0,0 +1,43 @@ +From 690e344ff9c5fcba60442f65e4ab11ae89c49be0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 12:13:47 -0500 +Subject: drm/amd/display: Use viewport height for subvp mall allocation size + +From: Dillon Varone + +[ Upstream commit dd2c028c1395d622df7ddd6837f8ab2dc94008ee ] + +[WHY?] +MALL allocation size depends on the viewport height, not the addressable +vertical lines, which will not match when scaling. + +[HOW?] +Base MALL allocation size calculations off viewport height. + +Reviewed-by: Alvin Lee +Reviewed-by: Martin Leung +Acked-by: Brian Chang +Signed-off-by: Dillon Varone +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c +index 7c37575d69c7..0ef11fb338e9 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c +@@ -103,7 +103,7 @@ uint32_t dcn32_helper_calculate_num_ways_for_subvp(struct dc *dc, struct dc_stat + mall_alloc_width_blk_aligned = full_vp_width_blk_aligned; + + /* mall_alloc_height_blk_aligned_l/c = CEILING(sub_vp_height_l/c - 1, blk_height_l/c) + blk_height_l/c */ +- mall_alloc_height_blk_aligned = (pipe->stream->timing.v_addressable - 1 + mblk_height - 1) / ++ mall_alloc_height_blk_aligned = (pipe->plane_res.scl_data.viewport.height - 1 + mblk_height - 1) / + mblk_height * mblk_height + mblk_height; + + /* full_mblk_width_ub_l/c = mall_alloc_width_blk_aligned_l/c; +-- +2.35.1 + diff --git a/queue-6.0/drm-amdgpu-fix-use-after-free-during-gpu-recovery.patch b/queue-6.0/drm-amdgpu-fix-use-after-free-during-gpu-recovery.patch new file mode 100644 index 00000000000..44e7c2b102b --- /dev/null +++ b/queue-6.0/drm-amdgpu-fix-use-after-free-during-gpu-recovery.patch @@ -0,0 +1,48 @@ +From ece2880603406e6fbd2531ad6a823db6517e2d08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Nov 2022 17:08:22 +0800 +Subject: drm/amdgpu: fix use-after-free during gpu recovery + +From: Stanley.Yang + +[ Upstream commit 3cb93f390453cde4d6afda1587aaa00e75e09617 ] + +[Why] + [ 754.862560] refcount_t: underflow; use-after-free. + [ 754.862898] Call Trace: + [ 754.862903] + [ 754.862913] amdgpu_job_free_cb+0xc2/0xe1 [amdgpu] + [ 754.863543] drm_sched_main.cold+0x34/0x39 [amd_sched] + +[How] + The fw_fence may be not init, check whether dma_fence_init + is performed before job free + +Signed-off-by: Stanley.Yang +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +index 3b025aace283..eb4c0523e42d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +@@ -167,7 +167,11 @@ static void amdgpu_job_free_cb(struct drm_sched_job *s_job) + amdgpu_sync_free(&job->sync); + amdgpu_sync_free(&job->sched_sync); + +- dma_fence_put(&job->hw_fence); ++ /* only put the hw fence if has embedded fence */ ++ if (!job->hw_fence.ops) ++ kfree(job); ++ else ++ dma_fence_put(&job->hw_fence); + } + + void amdgpu_job_free(struct amdgpu_job *job) +-- +2.35.1 + diff --git a/queue-6.0/drm-i915-remove-non-existent-pipes-from-bigjoiner-pi.patch b/queue-6.0/drm-i915-remove-non-existent-pipes-from-bigjoiner-pi.patch new file mode 100644 index 00000000000..3f2f20fdb06 --- /dev/null +++ b/queue-6.0/drm-i915-remove-non-existent-pipes-from-bigjoiner-pi.patch @@ -0,0 +1,69 @@ +From 2963ac9ab0c729c482e21f7e41abed6bfbe3bc2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 20:52:01 +0200 +Subject: drm/i915: Remove non-existent pipes from bigjoiner pipe mask +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit 3c1ea6a5f4f55d4e376675dda16945eb5d9bb4de ] + +bigjoiner_pipes() doesn't consider that: +- RKL only has three pipes +- some pipes may be fused off + +This means that intel_atomic_check_bigjoiner() won't reject +all configurations that would need a non-existent pipe. +Instead we just keep on rolling witout actually having +reserved the slave pipe we need. + +It's possible that we don't outright explode anywhere due to +this since eg. for_each_intel_crtc_in_pipe_mask() will only +walk the crtcs we've registered even though the passed in +pipe_mask asks for more of them. But clearly the thing won't +do what is expected of it when the required pipes are not +present. + +Fix the problem by consulting the device info pipe_mask already +in bigjoiner_pipes(). + +Cc: stable@vger.kernel.org +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221118185201.10469-1-ville.syrjala@linux.intel.com +Reviewed-by: Arun R Murthy +(cherry picked from commit f1c87a94a1087a26f41007ee83264033007421b5) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_display.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index fc5d94862ef3..d0f20bd0e51a 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -3717,12 +3717,16 @@ static bool ilk_get_pipe_config(struct intel_crtc *crtc, + + static u8 bigjoiner_pipes(struct drm_i915_private *i915) + { ++ u8 pipes; ++ + if (DISPLAY_VER(i915) >= 12) +- return BIT(PIPE_A) | BIT(PIPE_B) | BIT(PIPE_C) | BIT(PIPE_D); ++ pipes = BIT(PIPE_A) | BIT(PIPE_B) | BIT(PIPE_C) | BIT(PIPE_D); + else if (DISPLAY_VER(i915) >= 11) +- return BIT(PIPE_B) | BIT(PIPE_C); ++ pipes = BIT(PIPE_B) | BIT(PIPE_C); + else +- return 0; ++ pipes = 0; ++ ++ return pipes & INTEL_INFO(i915)->display.pipe_mask; + } + + static bool transcoder_ddi_func_is_enabled(struct drm_i915_private *dev_priv, +-- +2.35.1 + diff --git a/queue-6.0/fbcon-use-kzalloc-in-fbcon_prepare_logo.patch b/queue-6.0/fbcon-use-kzalloc-in-fbcon_prepare_logo.patch new file mode 100644 index 00000000000..9b74675235e --- /dev/null +++ b/queue-6.0/fbcon-use-kzalloc-in-fbcon_prepare_logo.patch @@ -0,0 +1,93 @@ +From d8c8532ca9ab9c86b3971a1bc65f63b7d8d3f5c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 00:27:58 +0900 +Subject: fbcon: Use kzalloc() in fbcon_prepare_logo() + +From: Tetsuo Handa + +[ Upstream commit a6a00d7e8ffd78d1cdb7a43f1278f081038c638f ] + +A kernel built with syzbot's config file reported that + + scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2)) + +causes uninitialized "save" to be copied. + + ---------- + [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0 + [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1 + Console: switching to colour frame buffer device 128x48 + ===================================================== + BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0 + do_update_region+0x4b8/0xba0 + update_region+0x40d/0x840 + fbcon_switch+0x3364/0x35e0 + redraw_screen+0xae3/0x18a0 + do_bind_con_driver+0x1cb3/0x1df0 + do_take_over_console+0x11cb/0x13f0 + fbcon_fb_registered+0xacc/0xfd0 + register_framebuffer+0x1179/0x1320 + __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 + drm_fbdev_client_hotplug+0xbea/0xda0 + drm_fbdev_generic_setup+0x65e/0x9d0 + vkms_init+0x9f3/0xc76 + (...snipped...) + + Uninit was stored to memory at: + fbcon_prepare_logo+0x143b/0x1940 + fbcon_init+0x2c1b/0x31c0 + visual_init+0x3e7/0x820 + do_bind_con_driver+0x14a4/0x1df0 + do_take_over_console+0x11cb/0x13f0 + fbcon_fb_registered+0xacc/0xfd0 + register_framebuffer+0x1179/0x1320 + __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 + drm_fbdev_client_hotplug+0xbea/0xda0 + drm_fbdev_generic_setup+0x65e/0x9d0 + vkms_init+0x9f3/0xc76 + (...snipped...) + + Uninit was created at: + __kmem_cache_alloc_node+0xb69/0x1020 + __kmalloc+0x379/0x680 + fbcon_prepare_logo+0x704/0x1940 + fbcon_init+0x2c1b/0x31c0 + visual_init+0x3e7/0x820 + do_bind_con_driver+0x14a4/0x1df0 + do_take_over_console+0x11cb/0x13f0 + fbcon_fb_registered+0xacc/0xfd0 + register_framebuffer+0x1179/0x1320 + __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40 + drm_fbdev_client_hotplug+0xbea/0xda0 + drm_fbdev_generic_setup+0x65e/0x9d0 + vkms_init+0x9f3/0xc76 + (...snipped...) + + CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924 + Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 + ---------- + +Signed-off-by: Tetsuo Handa +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/cad03d25-0ea0-32c4-8173-fd1895314bce@I-love.SAKURA.ne.jp +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbcon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 098b62f7b701..c0143d38df83 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -577,7 +577,7 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, + if (scr_readw(r) != vc->vc_video_erase_char) + break; + if (r != q && new_rows >= rows + logo_lines) { +- save = kmalloc(array3_size(logo_lines, new_cols, 2), ++ save = kzalloc(array3_size(logo_lines, new_cols, 2), + GFP_KERNEL); + if (save) { + int i = min(cols, new_cols); +-- +2.35.1 + diff --git a/queue-6.0/fs-use-acquire-ordering-in-__fget_light.patch b/queue-6.0/fs-use-acquire-ordering-in-__fget_light.patch new file mode 100644 index 00000000000..ff9b1946954 --- /dev/null +++ b/queue-6.0/fs-use-acquire-ordering-in-__fget_light.patch @@ -0,0 +1,55 @@ +From a8487750046d4db36d58938e1b2a4fc805761be9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Oct 2022 18:52:56 +0100 +Subject: fs: use acquire ordering in __fget_light() + +From: Jann Horn + +[ Upstream commit 7ee47dcfff1835ff75a794d1075b6b5f5462cfed ] + +We must prevent the CPU from reordering the files->count read with the +FD table access like this, on architectures where read-read reordering is +possible: + + files_lookup_fd_raw() + close_fd() + put_files_struct() + atomic_read(&files->count) + +I would like to mark this for stable, but the stable rules explicitly say +"no theoretical races", and given that the FD table pointer and +files->count are explicitly stored in the same cacheline, this sort of +reordering seems quite unlikely in practice... + +Signed-off-by: Jann Horn +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/file.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/file.c b/fs/file.c +index 3bcc1ecc314a..57af5f8375fd 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -1002,7 +1002,16 @@ static unsigned long __fget_light(unsigned int fd, fmode_t mask) + struct files_struct *files = current->files; + struct file *file; + +- if (atomic_read(&files->count) == 1) { ++ /* ++ * If another thread is concurrently calling close_fd() followed ++ * by put_files_struct(), we must not observe the old table ++ * entry combined with the new refcount - otherwise we could ++ * return a file that is concurrently being freed. ++ * ++ * atomic_read_acquire() pairs with atomic_dec_and_test() in ++ * put_files_struct(). ++ */ ++ if (atomic_read_acquire(&files->count) == 1) { + file = files_lookup_fd_raw(files, fd); + if (!file || unlikely(file->f_mode & mask)) + return 0; +-- +2.35.1 + diff --git a/queue-6.0/fscache-fix-oops-due-to-race-with-cookie_lru-and-use.patch b/queue-6.0/fscache-fix-oops-due-to-race-with-cookie_lru-and-use.patch new file mode 100644 index 00000000000..1986d0f9c0d --- /dev/null +++ b/queue-6.0/fscache-fix-oops-due-to-race-with-cookie_lru-and-use.patch @@ -0,0 +1,91 @@ +From b6532b09c657f35948fa0f2bb82e15c9bf6e1596 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 13:49:15 +0000 +Subject: fscache: Fix oops due to race with cookie_lru and use_cookie + +From: Dave Wysochanski + +[ Upstream commit b5b52de3214a29911f949459a79f6640969b5487 ] + +If a cookie expires from the LRU and the LRU_DISCARD flag is set, but +the state machine has not run yet, it's possible another thread can call +fscache_use_cookie and begin to use it. + +When the cookie_worker finally runs, it will see the LRU_DISCARD flag +set, transition the cookie->state to LRU_DISCARDING, which will then +withdraw the cookie. Once the cookie is withdrawn the object is removed +the below oops will occur because the object associated with the cookie +is now NULL. + +Fix the oops by clearing the LRU_DISCARD bit if another thread uses the +cookie before the cookie_worker runs. + + BUG: kernel NULL pointer dereference, address: 0000000000000008 + ... + CPU: 31 PID: 44773 Comm: kworker/u130:1 Tainted: G E 6.0.0-5.dneg.x86_64 #1 + Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 + Workqueue: events_unbound netfs_rreq_write_to_cache_work [netfs] + RIP: 0010:cachefiles_prepare_write+0x28/0x90 [cachefiles] + ... + Call Trace: + netfs_rreq_write_to_cache_work+0x11c/0x320 [netfs] + process_one_work+0x217/0x3e0 + worker_thread+0x4a/0x3b0 + kthread+0xd6/0x100 + +Fixes: 12bb21a29c19 ("fscache: Implement cookie user counting and resource pinning") +Reported-by: Daire Byrne +Signed-off-by: Dave Wysochanski +Signed-off-by: David Howells +Tested-by: Daire Byrne +Link: https://lore.kernel.org/r/20221117115023.1350181-1-dwysocha@redhat.com/ # v1 +Link: https://lore.kernel.org/r/20221117142915.1366990-1-dwysocha@redhat.com/ # v2 +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/fscache/cookie.c | 8 ++++++++ + include/trace/events/fscache.h | 2 ++ + 2 files changed, 10 insertions(+) + +diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c +index 451d8a077e12..bce2492186d0 100644 +--- a/fs/fscache/cookie.c ++++ b/fs/fscache/cookie.c +@@ -605,6 +605,14 @@ void __fscache_use_cookie(struct fscache_cookie *cookie, bool will_modify) + set_bit(FSCACHE_COOKIE_DO_PREP_TO_WRITE, &cookie->flags); + queue = true; + } ++ /* ++ * We could race with cookie_lru which may set LRU_DISCARD bit ++ * but has yet to run the cookie state machine. If this happens ++ * and another thread tries to use the cookie, clear LRU_DISCARD ++ * so we don't end up withdrawing the cookie while in use. ++ */ ++ if (test_and_clear_bit(FSCACHE_COOKIE_DO_LRU_DISCARD, &cookie->flags)) ++ fscache_see_cookie(cookie, fscache_cookie_see_lru_discard_clear); + break; + + case FSCACHE_COOKIE_STATE_FAILED: +diff --git a/include/trace/events/fscache.h b/include/trace/events/fscache.h +index c078c48a8e6d..a6190aa1b406 100644 +--- a/include/trace/events/fscache.h ++++ b/include/trace/events/fscache.h +@@ -66,6 +66,7 @@ enum fscache_cookie_trace { + fscache_cookie_put_work, + fscache_cookie_see_active, + fscache_cookie_see_lru_discard, ++ fscache_cookie_see_lru_discard_clear, + fscache_cookie_see_lru_do_one, + fscache_cookie_see_relinquish, + fscache_cookie_see_withdraw, +@@ -149,6 +150,7 @@ enum fscache_access_trace { + EM(fscache_cookie_put_work, "PQ work ") \ + EM(fscache_cookie_see_active, "- activ") \ + EM(fscache_cookie_see_lru_discard, "- x-lru") \ ++ EM(fscache_cookie_see_lru_discard_clear,"- lrudc") \ + EM(fscache_cookie_see_lru_do_one, "- lrudo") \ + EM(fscache_cookie_see_relinquish, "- x-rlq") \ + EM(fscache_cookie_see_withdraw, "- x-wth") \ +-- +2.35.1 + diff --git a/queue-6.0/hugetlb-don-t-delete-vma_lock-in-hugetlb-madv_dontne.patch b/queue-6.0/hugetlb-don-t-delete-vma_lock-in-hugetlb-madv_dontne.patch new file mode 100644 index 00000000000..5490f6e18bb --- /dev/null +++ b/queue-6.0/hugetlb-don-t-delete-vma_lock-in-hugetlb-madv_dontne.patch @@ -0,0 +1,125 @@ +From 24b34a0da7b139f9154b57866cffe564f498e24d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 15:55:06 -0800 +Subject: hugetlb: don't delete vma_lock in hugetlb MADV_DONTNEED processing + +From: Mike Kravetz + +commit 04ada095dcfc4ae359418053c0be94453bdf1e84 upstream. + +madvise(MADV_DONTNEED) ends up calling zap_page_range() to clear page +tables associated with the address range. For hugetlb vmas, +zap_page_range will call __unmap_hugepage_range_final. However, +__unmap_hugepage_range_final assumes the passed vma is about to be removed +and deletes the vma_lock to prevent pmd sharing as the vma is on the way +out. In the case of madvise(MADV_DONTNEED) the vma remains, but the +missing vma_lock prevents pmd sharing and could potentially lead to issues +with truncation/fault races. + +This issue was originally reported here [1] as a BUG triggered in +page_try_dup_anon_rmap. Prior to the introduction of the hugetlb +vma_lock, __unmap_hugepage_range_final cleared the VM_MAYSHARE flag to +prevent pmd sharing. Subsequent faults on this vma were confused as +VM_MAYSHARE indicates a sharable vma, but was not set so page_mapping was +not set in new pages added to the page table. This resulted in pages that +appeared anonymous in a VM_SHARED vma and triggered the BUG. + +Address issue by adding a new zap flag ZAP_FLAG_UNMAP to indicate an unmap +call from unmap_vmas(). This is used to indicate the 'final' unmapping of +a hugetlb vma. When called via MADV_DONTNEED, this flag is not set and +the vm_lock is not deleted. + +NOTE - Prior to the introduction of the huegtlb vma_lock in v6.1, this + issue is addressed by not clearing the VM_MAYSHARE flag when + __unmap_hugepage_range_final is called in the MADV_DONTNEED case. + +[1] https://lore.kernel.org/lkml/CAO4mrfdLMXsao9RF4fUE8-Wfde8xmjsKrTNMNC9wjUb6JudD0g@mail.gmail.com/ + +Link: https://lkml.kernel.org/r/20221114235507.294320-3-mike.kravetz@oracle.com +Fixes: 90e7e7f5ef3f ("mm: enable MADV_DONTNEED for hugetlb mappings") +Signed-off-by: Mike Kravetz +Reported-by: Wei Chen +Cc: Axel Rasmussen +Cc: David Hildenbrand +Cc: Matthew Wilcox +Cc: Mina Almasry +Cc: Nadav Amit +Cc: Naoya Horiguchi +Cc: Peter Xu +Cc: Rik van Riel +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Mike Kravetz +Signed-off-by: Sasha Levin +--- + include/linux/mm.h | 2 ++ + mm/hugetlb.c | 25 ++++++++++++++----------- + mm/memory.c | 2 +- + 3 files changed, 17 insertions(+), 12 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index df804bf5f4a5..4ff52127a6b8 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1794,6 +1794,8 @@ struct zap_details { + * default, the flag is not set. + */ + #define ZAP_FLAG_DROP_MARKER ((__force zap_flags_t) BIT(0)) ++/* Set in unmap_vmas() to indicate a final unmap call. Only used by hugetlb */ ++#define ZAP_FLAG_UNMAP ((__force zap_flags_t) BIT(1)) + + #ifdef CONFIG_MMU + extern bool can_do_mlock(void); +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index dbb558e71e9e..022a3bfafec4 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -5145,17 +5145,20 @@ void __unmap_hugepage_range_final(struct mmu_gather *tlb, + { + __unmap_hugepage_range(tlb, vma, start, end, ref_page, zap_flags); + +- /* +- * Clear this flag so that x86's huge_pmd_share page_table_shareable +- * test will fail on a vma being torn down, and not grab a page table +- * on its way out. We're lucky that the flag has such an appropriate +- * name, and can in fact be safely cleared here. We could clear it +- * before the __unmap_hugepage_range above, but all that's necessary +- * is to clear it before releasing the i_mmap_rwsem. This works +- * because in the context this is called, the VMA is about to be +- * destroyed and the i_mmap_rwsem is held. +- */ +- vma->vm_flags &= ~VM_MAYSHARE; ++ if (zap_flags & ZAP_FLAG_UNMAP) { /* final unmap */ ++ /* ++ * Clear this flag so that x86's huge_pmd_share ++ * page_table_shareable test will fail on a vma being torn ++ * down, and not grab a page table on its way out. We're lucky ++ * that the flag has such an appropriate name, and can in fact ++ * be safely cleared here. We could clear it before the ++ * __unmap_hugepage_range above, but all that's necessary ++ * is to clear it before releasing the i_mmap_rwsem. This works ++ * because in the context this is called, the VMA is about to ++ * be destroyed and the i_mmap_rwsem is held. ++ */ ++ vma->vm_flags &= ~VM_MAYSHARE; ++ } + } + + void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, +diff --git a/mm/memory.c b/mm/memory.c +index 68d5b3dcec2e..a0fdaa74091f 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1712,7 +1712,7 @@ void unmap_vmas(struct mmu_gather *tlb, + { + struct mmu_notifier_range range; + struct zap_details details = { +- .zap_flags = ZAP_FLAG_DROP_MARKER, ++ .zap_flags = ZAP_FLAG_DROP_MARKER | ZAP_FLAG_UNMAP, + /* Careful - we need to zap private pages too! */ + .even_cows = true, + }; +-- +2.35.1 + diff --git a/queue-6.0/loongarch-combine-acpi_boot_table_init-and-acpi_boot.patch b/queue-6.0/loongarch-combine-acpi_boot_table_init-and-acpi_boot.patch new file mode 100644 index 00000000000..371a15c582b --- /dev/null +++ b/queue-6.0/loongarch-combine-acpi_boot_table_init-and-acpi_boot.patch @@ -0,0 +1,95 @@ +From 0b9814f7fafa63c6c5d99e6b7d3ce16dbbf112cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 19:02:57 +0800 +Subject: LoongArch: Combine acpi_boot_table_init() and acpi_boot_init() + +From: Huacai Chen + +[ Upstream commit 538eafc6deae12fbac5f277b89aa139b812bca49 ] + +Combine acpi_boot_table_init() and acpi_boot_init() since they are very +simple, and we don't need to check the return value of acpi_boot_init(). + +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/acpi.c | 31 ++++++++++--------------------- + arch/loongarch/kernel/setup.c | 1 - + 2 files changed, 10 insertions(+), 22 deletions(-) + +diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c +index 335398482038..8319cc409009 100644 +--- a/arch/loongarch/kernel/acpi.c ++++ b/arch/loongarch/kernel/acpi.c +@@ -56,23 +56,6 @@ void __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size) + return ioremap_cache(phys, size); + } + +-void __init acpi_boot_table_init(void) +-{ +- /* +- * If acpi_disabled, bail out +- */ +- if (acpi_disabled) +- return; +- +- /* +- * Initialize the ACPI boot-time table parser. +- */ +- if (acpi_table_init()) { +- disable_acpi(); +- return; +- } +-} +- + #ifdef CONFIG_SMP + static int set_processor_mask(u32 id, u32 flags) + { +@@ -156,13 +139,21 @@ static void __init acpi_process_madt(void) + loongson_sysconf.nr_cpus = num_processors; + } + +-int __init acpi_boot_init(void) ++void __init acpi_boot_table_init(void) + { + /* + * If acpi_disabled, bail out + */ + if (acpi_disabled) +- return -1; ++ return; ++ ++ /* ++ * Initialize the ACPI boot-time table parser. ++ */ ++ if (acpi_table_init()) { ++ disable_acpi(); ++ return; ++ } + + loongson_sysconf.boot_cpu_id = read_csr_cpuid(); + +@@ -173,8 +164,6 @@ int __init acpi_boot_init(void) + + /* Do not enable ACPI SPCR console by default */ + acpi_parse_spcr(earlycon_acpi_spcr_enable, false); +- +- return 0; + } + + #ifdef CONFIG_ACPI_NUMA +diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c +index 8f5c2f9a1a83..574647e3483d 100644 +--- a/arch/loongarch/kernel/setup.c ++++ b/arch/loongarch/kernel/setup.c +@@ -203,7 +203,6 @@ void __init platform_init(void) + #ifdef CONFIG_ACPI + acpi_gbl_use_default_register_widths = false; + acpi_boot_table_init(); +- acpi_boot_init(); + #endif + + #ifdef CONFIG_NUMA +-- +2.35.1 + diff --git a/queue-6.0/loongarch-fix-unsigned-comparison-with-less-than-zer.patch b/queue-6.0/loongarch-fix-unsigned-comparison-with-less-than-zer.patch new file mode 100644 index 00000000000..9346b4be888 --- /dev/null +++ b/queue-6.0/loongarch-fix-unsigned-comparison-with-less-than-zer.patch @@ -0,0 +1,38 @@ +From 68f01d8a76368ef99415560bdc238c3d8fae6860 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 19:02:57 +0800 +Subject: LoongArch: Fix unsigned comparison with less than zero + +From: KaiLong Wang + +[ Upstream commit b96e74bb439f096168c78ba3ba1599e0b85cfd73 ] + +Eliminate the following coccicheck warning: + +./arch/loongarch/kernel/unwind_prologue.c:84:5-13: WARNING: Unsigned +expression compared with zero: frame_ra < 0 + +Signed-off-by: KaiLong Wang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/kernel/unwind_prologue.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/loongarch/kernel/unwind_prologue.c b/arch/loongarch/kernel/unwind_prologue.c +index b206d9159205..4571c3c87cd4 100644 +--- a/arch/loongarch/kernel/unwind_prologue.c ++++ b/arch/loongarch/kernel/unwind_prologue.c +@@ -43,7 +43,8 @@ static bool unwind_by_prologue(struct unwind_state *state) + { + struct stack_info *info = &state->stack_info; + union loongarch_instruction *ip, *ip_end; +- unsigned long frame_size = 0, frame_ra = -1; ++ long frame_ra = -1; ++ unsigned long frame_size = 0; + unsigned long size, offset, pc = state->pc; + + if (state->sp >= info->end || state->sp < info->begin) +-- +2.35.1 + diff --git a/queue-6.0/loongarch-makefile-use-grep-e-instead-of-egrep.patch b/queue-6.0/loongarch-makefile-use-grep-e-instead-of-egrep.patch new file mode 100644 index 00000000000..40194d75d17 --- /dev/null +++ b/queue-6.0/loongarch-makefile-use-grep-e-instead-of-egrep.patch @@ -0,0 +1,38 @@ +From d532bed988fcd5d3316add83e55a1f78cfbb4acc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 19:02:57 +0800 +Subject: LoongArch: Makefile: Use "grep -E" instead of "egrep" + +From: Tiezhu Yang + +[ Upstream commit 83f638bca0ccd94942bc3c4eb9bcec24dd8a1cf9 ] + +The latest version of grep claims the egrep is now obsolete so the build +now contains warnings that look like: + egrep: warning: egrep is obsolescent; using grep -E + +Fix this up by changing the LoongArch Makefile to use "grep -E" instead. + +Signed-off-by: Tiezhu Yang +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile +index ec3de6191276..9123feb69854 100644 +--- a/arch/loongarch/Makefile ++++ b/arch/loongarch/Makefile +@@ -68,7 +68,7 @@ KBUILD_LDFLAGS += -m $(ld-emul) + + ifdef CONFIG_LOONGARCH + CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \ +- egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \ ++ grep -E -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \ + sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g') + endif + +-- +2.35.1 + diff --git a/queue-6.0/loongarch-set-_page_dirty-only-if-_page_modified-is-.patch b/queue-6.0/loongarch-set-_page_dirty-only-if-_page_modified-is-.patch new file mode 100644 index 00000000000..f3420c78321 --- /dev/null +++ b/queue-6.0/loongarch-set-_page_dirty-only-if-_page_modified-is-.patch @@ -0,0 +1,50 @@ +From 6f121e53ea506a1a369c7c472f03ac37fa3b1d8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 19:02:57 +0800 +Subject: LoongArch: Set _PAGE_DIRTY only if _PAGE_MODIFIED is set in + {pmd,pte}_mkwrite() + +From: Huacai Chen + +[ Upstream commit 54e6cd42a183b602e3627ad3aaeeed44f7443e67 ] + +Set _PAGE_DIRTY only if _PAGE_MODIFIED is set in {pmd,pte}_mkwrite(). +Otherwise, _PAGE_DIRTY silences the TLB modify exception and make us +have no chance to mark a pmd/pte dirty (_PAGE_MODIFIED) for software. + +Reviewed-by: Guo Ren +Signed-off-by: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/loongarch/include/asm/pgtable.h | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/loongarch/include/asm/pgtable.h b/arch/loongarch/include/asm/pgtable.h +index cc0674d1b8f0..645e24ebec68 100644 +--- a/arch/loongarch/include/asm/pgtable.h ++++ b/arch/loongarch/include/asm/pgtable.h +@@ -357,7 +357,9 @@ static inline pte_t pte_mkdirty(pte_t pte) + + static inline pte_t pte_mkwrite(pte_t pte) + { +- pte_val(pte) |= (_PAGE_WRITE | _PAGE_DIRTY); ++ pte_val(pte) |= _PAGE_WRITE; ++ if (pte_val(pte) & _PAGE_MODIFIED) ++ pte_val(pte) |= _PAGE_DIRTY; + return pte; + } + +@@ -454,7 +456,9 @@ static inline int pmd_write(pmd_t pmd) + + static inline pmd_t pmd_mkwrite(pmd_t pmd) + { +- pmd_val(pmd) |= (_PAGE_WRITE | _PAGE_DIRTY); ++ pmd_val(pmd) |= _PAGE_WRITE; ++ if (pmd_val(pmd) & _PAGE_MODIFIED) ++ pmd_val(pmd) |= _PAGE_DIRTY; + return pmd; + } + +-- +2.35.1 + diff --git a/queue-6.0/madvise-use-zap_page_range_single-for-madvise-dontne.patch b/queue-6.0/madvise-use-zap_page_range_single-for-madvise-dontne.patch new file mode 100644 index 00000000000..cab15784f88 --- /dev/null +++ b/queue-6.0/madvise-use-zap_page_range_single-for-madvise-dontne.patch @@ -0,0 +1,185 @@ +From 1a001e4b6c105fac9bf920d1021d78f821097cb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 15:55:05 -0800 +Subject: madvise: use zap_page_range_single for madvise dontneed + +From: Mike Kravetz + +[ Upstream commit 21b85b09527c28e242db55c1b751f7f7549b830c ] + +This series addresses the issue first reported in [1], and fully described +in patch 2. Patches 1 and 2 address the user visible issue and are tagged +for stable backports. + +While exploring solutions to this issue, related problems with mmu +notification calls were discovered. This is addressed in the patch +"hugetlb: remove duplicate mmu notifications:". Since there are no user +visible effects, this third is not tagged for stable backports. + +Previous discussions suggested further cleanup by removing the +routine zap_page_range. This is possible because zap_page_range_single +is now exported, and all callers of zap_page_range pass ranges entirely +within a single vma. This work will be done in a later patch so as not +to distract from this bug fix. + +[1] https://lore.kernel.org/lkml/CAO4mrfdLMXsao9RF4fUE8-Wfde8xmjsKrTNMNC9wjUb6JudD0g@mail.gmail.com/ + +This patch (of 2): + +Expose the routine zap_page_range_single to zap a range within a single +vma. The madvise routine madvise_dontneed_single_vma can use this routine +as it explicitly operates on a single vma. Also, update the mmu +notification range in zap_page_range_single to take hugetlb pmd sharing +into account. This is required as MADV_DONTNEED supports hugetlb vmas. + +Link: https://lkml.kernel.org/r/20221114235507.294320-1-mike.kravetz@oracle.com +Link: https://lkml.kernel.org/r/20221114235507.294320-2-mike.kravetz@oracle.com +Fixes: 90e7e7f5ef3f ("mm: enable MADV_DONTNEED for hugetlb mappings") +Signed-off-by: Mike Kravetz +Reported-by: Wei Chen +Cc: Axel Rasmussen +Cc: David Hildenbrand +Cc: Matthew Wilcox +Cc: Mina Almasry +Cc: Nadav Amit +Cc: Naoya Horiguchi +Cc: Peter Xu +Cc: Rik van Riel +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/mm.h | 27 +++++++++++++++++++-------- + mm/madvise.c | 6 +++--- + mm/memory.c | 23 +++++++++++------------ + 3 files changed, 33 insertions(+), 23 deletions(-) + +diff --git a/include/linux/mm.h b/include/linux/mm.h +index 21f8b27bd9fd..df804bf5f4a5 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -1778,6 +1778,23 @@ extern void pagefault_out_of_memory(void); + + extern void show_free_areas(unsigned int flags, nodemask_t *nodemask); + ++/* ++ * Parameter block passed down to zap_pte_range in exceptional cases. ++ */ ++struct zap_details { ++ struct folio *single_folio; /* Locked folio to be unmapped */ ++ bool even_cows; /* Zap COWed private pages too? */ ++ zap_flags_t zap_flags; /* Extra flags for zapping */ ++}; ++ ++/* ++ * Whether to drop the pte markers, for example, the uffd-wp information for ++ * file-backed memory. This should only be specified when we will completely ++ * drop the page in the mm, either by truncation or unmapping of the vma. By ++ * default, the flag is not set. ++ */ ++#define ZAP_FLAG_DROP_MARKER ((__force zap_flags_t) BIT(0)) ++ + #ifdef CONFIG_MMU + extern bool can_do_mlock(void); + #else +@@ -1797,6 +1814,8 @@ void zap_page_range(struct vm_area_struct *vma, unsigned long address, + unsigned long size); + void unmap_vmas(struct mmu_gather *tlb, struct vm_area_struct *start_vma, + unsigned long start, unsigned long end); ++void zap_page_range_single(struct vm_area_struct *vma, unsigned long address, ++ unsigned long size, struct zap_details *details); + + struct mmu_notifier_range; + +@@ -3386,12 +3405,4 @@ madvise_set_anon_name(struct mm_struct *mm, unsigned long start, + } + #endif + +-/* +- * Whether to drop the pte markers, for example, the uffd-wp information for +- * file-backed memory. This should only be specified when we will completely +- * drop the page in the mm, either by truncation or unmapping of the vma. By +- * default, the flag is not set. +- */ +-#define ZAP_FLAG_DROP_MARKER ((__force zap_flags_t) BIT(0)) +- + #endif /* _LINUX_MM_H */ +diff --git a/mm/madvise.c b/mm/madvise.c +index 98ed17a4471a..b2831b57aef8 100644 +--- a/mm/madvise.c ++++ b/mm/madvise.c +@@ -770,8 +770,8 @@ static int madvise_free_single_vma(struct vm_area_struct *vma, + * Application no longer needs these pages. If the pages are dirty, + * it's OK to just throw them away. The app will be more careful about + * data it wants to keep. Be sure to free swap resources too. The +- * zap_page_range call sets things up for shrink_active_list to actually free +- * these pages later if no one else has touched them in the meantime, ++ * zap_page_range_single call sets things up for shrink_active_list to actually ++ * free these pages later if no one else has touched them in the meantime, + * although we could add these pages to a global reuse list for + * shrink_active_list to pick up before reclaiming other pages. + * +@@ -788,7 +788,7 @@ static int madvise_free_single_vma(struct vm_area_struct *vma, + static long madvise_dontneed_single_vma(struct vm_area_struct *vma, + unsigned long start, unsigned long end) + { +- zap_page_range(vma, start, end - start); ++ zap_page_range_single(vma, start, end - start, NULL); + return 0; + } + +diff --git a/mm/memory.c b/mm/memory.c +index de0dbe09b013..68d5b3dcec2e 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1341,15 +1341,6 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma) + return ret; + } + +-/* +- * Parameter block passed down to zap_pte_range in exceptional cases. +- */ +-struct zap_details { +- struct folio *single_folio; /* Locked folio to be unmapped */ +- bool even_cows; /* Zap COWed private pages too? */ +- zap_flags_t zap_flags; /* Extra flags for zapping */ +-}; +- + /* Whether we should zap all COWed (private) pages too */ + static inline bool should_zap_cows(struct zap_details *details) + { +@@ -1769,19 +1760,27 @@ void zap_page_range(struct vm_area_struct *vma, unsigned long start, + * + * The range must fit into one VMA. + */ +-static void zap_page_range_single(struct vm_area_struct *vma, unsigned long address, ++void zap_page_range_single(struct vm_area_struct *vma, unsigned long address, + unsigned long size, struct zap_details *details) + { ++ const unsigned long end = address + size; + struct mmu_notifier_range range; + struct mmu_gather tlb; + + lru_add_drain(); + mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma, vma->vm_mm, +- address, address + size); ++ address, end); ++ if (is_vm_hugetlb_page(vma)) ++ adjust_range_if_pmd_sharing_possible(vma, &range.start, ++ &range.end); + tlb_gather_mmu(&tlb, vma->vm_mm); + update_hiwater_rss(vma->vm_mm); + mmu_notifier_invalidate_range_start(&range); +- unmap_single_vma(&tlb, vma, address, range.end, details); ++ /* ++ * unmap 'address-end' not 'range.start-range.end' as range ++ * could have been expanded for hugetlb pmd sharing. ++ */ ++ unmap_single_vma(&tlb, vma, address, end, details); + mmu_notifier_invalidate_range_end(&range); + tlb_finish_mmu(&tlb); + } +-- +2.35.1 + diff --git a/queue-6.0/media-videobuf2-core-take-mmap_lock-in-vb2_get_unmap.patch b/queue-6.0/media-videobuf2-core-take-mmap_lock-in-vb2_get_unmap.patch new file mode 100644 index 00000000000..c0fc2ce414e --- /dev/null +++ b/queue-6.0/media-videobuf2-core-take-mmap_lock-in-vb2_get_unmap.patch @@ -0,0 +1,265 @@ +From 90e5db7dc1a06d74415a37bf8a9e15d5ea59ff75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 13:04:34 +0000 +Subject: media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() + +From: Hans Verkuil + +[ Upstream commit 098e5edc5d048a8df8691fd9fde895af100be42b ] + +While vb2_mmap took the mmap_lock mutex, vb2_get_unmapped_area didn't. +Add this. + +Also take this opportunity to move the 'q->memory != VB2_MEMORY_MMAP' +check and vb2_fileio_is_active() check into __find_plane_by_offset() so +both vb2_mmap and vb2_get_unmapped_area do the same checks. + +Since q->memory is checked while mmap_lock is held, also take that lock +in reqbufs and create_bufs when it is set, and set it back to +MEMORY_UNKNOWN on error. + +Fixes: f035eb4e976e ("[media] videobuf2: fix lockdep warning") +Signed-off-by: Hans Verkuil +Acked-by: Tomasz Figa +Reviewed-by: Ricardo Ribalda +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + .../media/common/videobuf2/videobuf2-core.c | 102 +++++++++++++----- + 1 file changed, 73 insertions(+), 29 deletions(-) + +diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c +index b203c1e26353..4eac35c4ea3b 100644 +--- a/drivers/media/common/videobuf2/videobuf2-core.c ++++ b/drivers/media/common/videobuf2/videobuf2-core.c +@@ -813,7 +813,13 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, + num_buffers = max_t(unsigned int, *count, q->min_buffers_needed); + num_buffers = min_t(unsigned int, num_buffers, VB2_MAX_FRAME); + memset(q->alloc_devs, 0, sizeof(q->alloc_devs)); ++ /* ++ * Set this now to ensure that drivers see the correct q->memory value ++ * in the queue_setup op. ++ */ ++ mutex_lock(&q->mmap_lock); + q->memory = memory; ++ mutex_unlock(&q->mmap_lock); + set_queue_coherency(q, non_coherent_mem); + + /* +@@ -823,22 +829,27 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, + ret = call_qop(q, queue_setup, q, &num_buffers, &num_planes, + plane_sizes, q->alloc_devs); + if (ret) +- return ret; ++ goto error; + + /* Check that driver has set sane values */ +- if (WARN_ON(!num_planes)) +- return -EINVAL; ++ if (WARN_ON(!num_planes)) { ++ ret = -EINVAL; ++ goto error; ++ } + + for (i = 0; i < num_planes; i++) +- if (WARN_ON(!plane_sizes[i])) +- return -EINVAL; ++ if (WARN_ON(!plane_sizes[i])) { ++ ret = -EINVAL; ++ goto error; ++ } + + /* Finally, allocate buffers and video memory */ + allocated_buffers = + __vb2_queue_alloc(q, memory, num_buffers, num_planes, plane_sizes); + if (allocated_buffers == 0) { + dprintk(q, 1, "memory allocation failed\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto error; + } + + /* +@@ -879,7 +890,8 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, + if (ret < 0) { + /* + * Note: __vb2_queue_free() will subtract 'allocated_buffers' +- * from q->num_buffers. ++ * from q->num_buffers and it will reset q->memory to ++ * VB2_MEMORY_UNKNOWN. + */ + __vb2_queue_free(q, allocated_buffers); + mutex_unlock(&q->mmap_lock); +@@ -895,6 +907,12 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory, + q->waiting_for_buffers = !q->is_output; + + return 0; ++ ++error: ++ mutex_lock(&q->mmap_lock); ++ q->memory = VB2_MEMORY_UNKNOWN; ++ mutex_unlock(&q->mmap_lock); ++ return ret; + } + EXPORT_SYMBOL_GPL(vb2_core_reqbufs); + +@@ -906,6 +924,7 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory, + unsigned int num_planes = 0, num_buffers, allocated_buffers; + unsigned plane_sizes[VB2_MAX_PLANES] = { }; + bool non_coherent_mem = flags & V4L2_MEMORY_FLAG_NON_COHERENT; ++ bool no_previous_buffers = !q->num_buffers; + int ret; + + if (q->num_buffers == VB2_MAX_FRAME) { +@@ -913,13 +932,19 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory, + return -ENOBUFS; + } + +- if (!q->num_buffers) { ++ if (no_previous_buffers) { + if (q->waiting_in_dqbuf && *count) { + dprintk(q, 1, "another dup()ped fd is waiting for a buffer\n"); + return -EBUSY; + } + memset(q->alloc_devs, 0, sizeof(q->alloc_devs)); ++ /* ++ * Set this now to ensure that drivers see the correct q->memory ++ * value in the queue_setup op. ++ */ ++ mutex_lock(&q->mmap_lock); + q->memory = memory; ++ mutex_unlock(&q->mmap_lock); + q->waiting_for_buffers = !q->is_output; + set_queue_coherency(q, non_coherent_mem); + } else { +@@ -945,14 +970,15 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory, + ret = call_qop(q, queue_setup, q, &num_buffers, + &num_planes, plane_sizes, q->alloc_devs); + if (ret) +- return ret; ++ goto error; + + /* Finally, allocate buffers and video memory */ + allocated_buffers = __vb2_queue_alloc(q, memory, num_buffers, + num_planes, plane_sizes); + if (allocated_buffers == 0) { + dprintk(q, 1, "memory allocation failed\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto error; + } + + /* +@@ -983,7 +1009,8 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory, + if (ret < 0) { + /* + * Note: __vb2_queue_free() will subtract 'allocated_buffers' +- * from q->num_buffers. ++ * from q->num_buffers and it will reset q->memory to ++ * VB2_MEMORY_UNKNOWN. + */ + __vb2_queue_free(q, allocated_buffers); + mutex_unlock(&q->mmap_lock); +@@ -998,6 +1025,14 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory, + *count = allocated_buffers; + + return 0; ++ ++error: ++ if (no_previous_buffers) { ++ mutex_lock(&q->mmap_lock); ++ q->memory = VB2_MEMORY_UNKNOWN; ++ mutex_unlock(&q->mmap_lock); ++ } ++ return ret; + } + EXPORT_SYMBOL_GPL(vb2_core_create_bufs); + +@@ -2164,6 +2199,22 @@ static int __find_plane_by_offset(struct vb2_queue *q, unsigned long off, + struct vb2_buffer *vb; + unsigned int buffer, plane; + ++ /* ++ * Sanity checks to ensure the lock is held, MEMORY_MMAP is ++ * used and fileio isn't active. ++ */ ++ lockdep_assert_held(&q->mmap_lock); ++ ++ if (q->memory != VB2_MEMORY_MMAP) { ++ dprintk(q, 1, "queue is not currently set up for mmap\n"); ++ return -EINVAL; ++ } ++ ++ if (vb2_fileio_is_active(q)) { ++ dprintk(q, 1, "file io in progress\n"); ++ return -EBUSY; ++ } ++ + /* + * Go over all buffers and their planes, comparing the given offset + * with an offset assigned to each plane. If a match is found, +@@ -2265,11 +2316,6 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) + int ret; + unsigned long length; + +- if (q->memory != VB2_MEMORY_MMAP) { +- dprintk(q, 1, "queue is not currently set up for mmap\n"); +- return -EINVAL; +- } +- + /* + * Check memory area access mode. + */ +@@ -2291,14 +2337,9 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) + + mutex_lock(&q->mmap_lock); + +- if (vb2_fileio_is_active(q)) { +- dprintk(q, 1, "mmap: file io in progress\n"); +- ret = -EBUSY; +- goto unlock; +- } +- + /* +- * Find the plane corresponding to the offset passed by userspace. ++ * Find the plane corresponding to the offset passed by userspace. This ++ * will return an error if not MEMORY_MMAP or file I/O is in progress. + */ + ret = __find_plane_by_offset(q, off, &buffer, &plane); + if (ret) +@@ -2351,22 +2392,25 @@ unsigned long vb2_get_unmapped_area(struct vb2_queue *q, + void *vaddr; + int ret; + +- if (q->memory != VB2_MEMORY_MMAP) { +- dprintk(q, 1, "queue is not currently set up for mmap\n"); +- return -EINVAL; +- } ++ mutex_lock(&q->mmap_lock); + + /* +- * Find the plane corresponding to the offset passed by userspace. ++ * Find the plane corresponding to the offset passed by userspace. This ++ * will return an error if not MEMORY_MMAP or file I/O is in progress. + */ + ret = __find_plane_by_offset(q, off, &buffer, &plane); + if (ret) +- return ret; ++ goto unlock; + + vb = q->bufs[buffer]; + + vaddr = vb2_plane_vaddr(vb, plane); ++ mutex_unlock(&q->mmap_lock); + return vaddr ? (unsigned long)vaddr : -EINVAL; ++ ++unlock: ++ mutex_unlock(&q->mmap_lock); ++ return ret; + } + EXPORT_SYMBOL_GPL(vb2_get_unmapped_area); + #endif +-- +2.35.1 + diff --git a/queue-6.0/mm-khugepaged-fix-gup-fast-interaction-by-sending-ip.patch b/queue-6.0/mm-khugepaged-fix-gup-fast-interaction-by-sending-ip.patch new file mode 100644 index 00000000000..690caadc38f --- /dev/null +++ b/queue-6.0/mm-khugepaged-fix-gup-fast-interaction-by-sending-ip.patch @@ -0,0 +1,103 @@ +From 31b4616788a392b94f0d7b3d6daeff020542e805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 18:16:12 +0100 +Subject: mm/khugepaged: fix GUP-fast interaction by sending IPI + +From: Jann Horn + +commit 2ba99c5e08812494bc57f319fb562f527d9bacd8 upstream. + +Since commit 70cbc3cc78a99 ("mm: gup: fix the fast GUP race against THP +collapse"), the lockless_pages_from_mm() fastpath rechecks the pmd_t to +ensure that the page table was not removed by khugepaged in between. + +However, lockless_pages_from_mm() still requires that the page table is +not concurrently freed. Fix it by sending IPIs (if the architecture uses +semi-RCU-style page table freeing) before freeing/reusing page tables. + +Link: https://lkml.kernel.org/r/20221129154730.2274278-2-jannh@google.com +Link: https://lkml.kernel.org/r/20221128180252.1684965-2-jannh@google.com +Link: https://lkml.kernel.org/r/20221125213714.4115729-2-jannh@google.com +Fixes: ba76149f47d8 ("thp: khugepaged") +Signed-off-by: Jann Horn +Reviewed-by: Yang Shi +Acked-by: David Hildenbrand +Cc: John Hubbard +Cc: Peter Xu +Cc: +Signed-off-by: Andrew Morton +[backported, no changes necessary] +Signed-off-by: Jann Horn +Signed-off-by: Sasha Levin +--- + include/asm-generic/tlb.h | 4 ++++ + mm/khugepaged.c | 2 ++ + mm/mmu_gather.c | 4 +--- + 3 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h +index 492dce43236e..cab7cfebf40b 100644 +--- a/include/asm-generic/tlb.h ++++ b/include/asm-generic/tlb.h +@@ -222,12 +222,16 @@ extern void tlb_remove_table(struct mmu_gather *tlb, void *table); + #define tlb_needs_table_invalidate() (true) + #endif + ++void tlb_remove_table_sync_one(void); ++ + #else + + #ifdef tlb_needs_table_invalidate + #error tlb_needs_table_invalidate() requires MMU_GATHER_RCU_TABLE_FREE + #endif + ++static inline void tlb_remove_table_sync_one(void) { } ++ + #endif /* CONFIG_MMU_GATHER_RCU_TABLE_FREE */ + + +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 28d8459d7aae..1155d356d3ac 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1093,6 +1093,7 @@ static void collapse_huge_page(struct mm_struct *mm, + _pmd = pmdp_collapse_flush(vma, address, pmd); + spin_unlock(pmd_ptl); + mmu_notifier_invalidate_range_end(&range); ++ tlb_remove_table_sync_one(); + + spin_lock(pte_ptl); + isolated = __collapse_huge_page_isolate(vma, address, pte, +@@ -1391,6 +1392,7 @@ static void collapse_and_free_pmd(struct mm_struct *mm, struct vm_area_struct *v + lockdep_assert_held_write(&vma->anon_vma->root->rwsem); + + pmd = pmdp_collapse_flush(vma, addr, pmdp); ++ tlb_remove_table_sync_one(); + mm_dec_nr_ptes(mm); + page_table_check_pte_clear_range(mm, addr, pmd); + pte_free(mm, pmd_pgtable(pmd)); +diff --git a/mm/mmu_gather.c b/mm/mmu_gather.c +index a71924bd38c0..ba7d26a291dd 100644 +--- a/mm/mmu_gather.c ++++ b/mm/mmu_gather.c +@@ -152,7 +152,7 @@ static void tlb_remove_table_smp_sync(void *arg) + /* Simply deliver the interrupt */ + } + +-static void tlb_remove_table_sync_one(void) ++void tlb_remove_table_sync_one(void) + { + /* + * This isn't an RCU grace period and hence the page-tables cannot be +@@ -176,8 +176,6 @@ static void tlb_remove_table_free(struct mmu_table_batch *batch) + + #else /* !CONFIG_MMU_GATHER_RCU_TABLE_FREE */ + +-static void tlb_remove_table_sync_one(void) { } +- + static void tlb_remove_table_free(struct mmu_table_batch *batch) + { + __tlb_remove_table_free(batch); +-- +2.35.1 + diff --git a/queue-6.0/mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-col.patch b/queue-6.0/mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-col.patch new file mode 100644 index 00000000000..daf685090a0 --- /dev/null +++ b/queue-6.0/mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-col.patch @@ -0,0 +1,68 @@ +From fce04dd1f4ad5a5844d5256e1202c3ed45369940 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 18:16:13 +0100 +Subject: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths + +From: Jann Horn + +commit f268f6cf875f3220afc77bdd0bf1bb136eb54db9 upstream. + +Any codepath that zaps page table entries must invoke MMU notifiers to +ensure that secondary MMUs (like KVM) don't keep accessing pages which +aren't mapped anymore. Secondary MMUs don't hold their own references to +pages that are mirrored over, so failing to notify them can lead to page +use-after-free. + +I'm marking this as addressing an issue introduced in commit f3f0e1d2150b +("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of +the security impact of this only came in commit 27e1f8273113 ("khugepaged: +enable collapse pmd for pte-mapped THP"), which actually omitted flushes +for the removal of present PTEs, not just for the removal of empty page +tables. + +Link: https://lkml.kernel.org/r/20221129154730.2274278-3-jannh@google.com +Link: https://lkml.kernel.org/r/20221128180252.1684965-3-jannh@google.com +Link: https://lkml.kernel.org/r/20221125213714.4115729-3-jannh@google.com +Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages") +Signed-off-by: Jann Horn +Acked-by: David Hildenbrand +Reviewed-by: Yang Shi +Cc: John Hubbard +Cc: Peter Xu +Cc: +Signed-off-by: Andrew Morton +[backported, no changes necessary] +Signed-off-by: Jann Horn +Signed-off-by: Sasha Levin +--- + mm/khugepaged.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 1155d356d3ac..5935765bcb33 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1380,6 +1380,7 @@ static void collapse_and_free_pmd(struct mm_struct *mm, struct vm_area_struct *v + unsigned long addr, pmd_t *pmdp) + { + pmd_t pmd; ++ struct mmu_notifier_range range; + + mmap_assert_write_locked(mm); + if (vma->vm_file) +@@ -1391,8 +1392,12 @@ static void collapse_and_free_pmd(struct mm_struct *mm, struct vm_area_struct *v + if (vma->anon_vma) + lockdep_assert_held_write(&vma->anon_vma->root->rwsem); + ++ mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm, addr, ++ addr + HPAGE_PMD_SIZE); ++ mmu_notifier_invalidate_range_start(&range); + pmd = pmdp_collapse_flush(vma, addr, pmdp); + tlb_remove_table_sync_one(); ++ mmu_notifier_invalidate_range_end(&range); + mm_dec_nr_ptes(mm); + page_table_check_pte_clear_range(mm, addr, pmd); + pte_free(mm, pmd_pgtable(pmd)); +-- +2.35.1 + diff --git a/queue-6.0/mm-khugepaged-take-the-right-locks-for-page-table-re.patch b/queue-6.0/mm-khugepaged-take-the-right-locks-for-page-table-re.patch new file mode 100644 index 00000000000..50033ca6e97 --- /dev/null +++ b/queue-6.0/mm-khugepaged-take-the-right-locks-for-page-table-re.patch @@ -0,0 +1,167 @@ +From a668aaf8bedd71660f6ea91b4783e9ed593f802a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 18:16:14 +0100 +Subject: mm/khugepaged: take the right locks for page table retraction + +From: Jann Horn + +commit 8d3c106e19e8d251da31ff4cc7462e4565d65084 upstream. + +pagetable walks on address ranges mapped by VMAs can be done under the +mmap lock, the lock of an anon_vma attached to the VMA, or the lock of the +VMA's address_space. Only one of these needs to be held, and it does not +need to be held in exclusive mode. + +Under those circumstances, the rules for concurrent access to page table +entries are: + + - Terminal page table entries (entries that don't point to another page + table) can be arbitrarily changed under the page table lock, with the + exception that they always need to be consistent for + hardware page table walks and lockless_pages_from_mm(). + This includes that they can be changed into non-terminal entries. + - Non-terminal page table entries (which point to another page table) + can not be modified; readers are allowed to READ_ONCE() an entry, verify + that it is non-terminal, and then assume that its value will stay as-is. + +Retracting a page table involves modifying a non-terminal entry, so +page-table-level locks are insufficient to protect against concurrent page +table traversal; it requires taking all the higher-level locks under which +it is possible to start a page walk in the relevant range in exclusive +mode. + +The collapse_huge_page() path for anonymous THP already follows this rule, +but the shmem/file THP path was getting it wrong, making it possible for +concurrent rmap-based operations to cause corruption. + +Link: https://lkml.kernel.org/r/20221129154730.2274278-1-jannh@google.com +Link: https://lkml.kernel.org/r/20221128180252.1684965-1-jannh@google.com +Link: https://lkml.kernel.org/r/20221125213714.4115729-1-jannh@google.com +Fixes: 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP") +Signed-off-by: Jann Horn +Reviewed-by: Yang Shi +Acked-by: David Hildenbrand +Cc: John Hubbard +Cc: Peter Xu +Cc: +Signed-off-by: Andrew Morton +[backport fixed up manually: collapse_pte_mapped_thp returns different +type] +Signed-off-by: Jann Horn +Signed-off-by: Sasha Levin +--- + mm/khugepaged.c | 56 +++++++++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 52 insertions(+), 4 deletions(-) + +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 70b7ac66411c..28d8459d7aae 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1360,16 +1360,37 @@ static void khugepaged_add_pte_mapped_thp(struct mm_struct *mm, + spin_unlock(&khugepaged_mm_lock); + } + ++/* ++ * A note about locking: ++ * Trying to take the page table spinlocks would be useless here because those ++ * are only used to synchronize: ++ * ++ * - modifying terminal entries (ones that point to a data page, not to another ++ * page table) ++ * - installing *new* non-terminal entries ++ * ++ * Instead, we need roughly the same kind of protection as free_pgtables() or ++ * mm_take_all_locks() (but only for a single VMA): ++ * The mmap lock together with this VMA's rmap locks covers all paths towards ++ * the page table entries we're messing with here, except for hardware page ++ * table walks and lockless_pages_from_mm(). ++ */ + static void collapse_and_free_pmd(struct mm_struct *mm, struct vm_area_struct *vma, + unsigned long addr, pmd_t *pmdp) + { +- spinlock_t *ptl; + pmd_t pmd; + + mmap_assert_write_locked(mm); +- ptl = pmd_lock(vma->vm_mm, pmdp); ++ if (vma->vm_file) ++ lockdep_assert_held_write(&vma->vm_file->f_mapping->i_mmap_rwsem); ++ /* ++ * All anon_vmas attached to the VMA have the same root and are ++ * therefore locked by the same lock. ++ */ ++ if (vma->anon_vma) ++ lockdep_assert_held_write(&vma->anon_vma->root->rwsem); ++ + pmd = pmdp_collapse_flush(vma, addr, pmdp); +- spin_unlock(ptl); + mm_dec_nr_ptes(mm); + page_table_check_pte_clear_range(mm, addr, pmd); + pte_free(mm, pmd_pgtable(pmd)); +@@ -1410,6 +1431,14 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) + if (!hugepage_vma_check(vma, vma->vm_flags | VM_HUGEPAGE, false, false)) + return; + ++ /* ++ * Symmetry with retract_page_tables(): Exclude MAP_PRIVATE mappings ++ * that got written to. Without this, we'd have to also lock the ++ * anon_vma if one exists. ++ */ ++ if (vma->anon_vma) ++ return; ++ + /* Keep pmd pgtable for uffd-wp; see comment in retract_page_tables() */ + if (userfaultfd_wp(vma)) + return; +@@ -1426,6 +1455,20 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) + if (!pmd) + goto drop_hpage; + ++ /* ++ * We need to lock the mapping so that from here on, only GUP-fast and ++ * hardware page walks can access the parts of the page tables that ++ * we're operating on. ++ * See collapse_and_free_pmd(). ++ */ ++ i_mmap_lock_write(vma->vm_file->f_mapping); ++ ++ /* ++ * This spinlock should be unnecessary: Nobody else should be accessing ++ * the page tables under spinlock protection here, only ++ * lockless_pages_from_mm() and the hardware page walker can access page ++ * tables while all the high-level locks are held in write mode. ++ */ + start_pte = pte_offset_map_lock(mm, pmd, haddr, &ptl); + + /* step 1: check all mapped PTEs are to the right huge page */ +@@ -1476,6 +1519,9 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) + + /* step 4: collapse pmd */ + collapse_and_free_pmd(mm, vma, haddr, pmd); ++ ++ i_mmap_unlock_write(vma->vm_file->f_mapping); ++ + drop_hpage: + unlock_page(hpage); + put_page(hpage); +@@ -1483,6 +1529,7 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) + + abort: + pte_unmap_unlock(start_pte, ptl); ++ i_mmap_unlock_write(vma->vm_file->f_mapping); + goto drop_hpage; + } + +@@ -1531,7 +1578,8 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) + * An alternative would be drop the check, but check that page + * table is clear before calling pmdp_collapse_flush() under + * ptl. It has higher chance to recover THP for the VMA, but +- * has higher cost too. ++ * has higher cost too. It would also probably require locking ++ * the anon_vma. + */ + if (vma->anon_vma) + continue; +-- +2.35.1 + diff --git a/queue-6.0/net-mlx5-lag-avoid-lockdep-warnings.patch b/queue-6.0/net-mlx5-lag-avoid-lockdep-warnings.patch new file mode 100644 index 00000000000..8cb64e3c5a6 --- /dev/null +++ b/queue-6.0/net-mlx5-lag-avoid-lockdep-warnings.patch @@ -0,0 +1,409 @@ +From 79fa2706673cb69ca91e02ec0618c1deb7d4bed2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Aug 2022 11:25:26 +0300 +Subject: net/mlx5: Lag, avoid lockdep warnings + +From: Eli Cohen + +[ Upstream commit 0d4e8ed139d871fcb2844dd71075997753baeec8 ] + +ldev->lock is used to serialize lag change operations. Since multiport +eswtich functionality was added, we now change the mode dynamically. +However, acquiring ldev->lock is not allowed as it could possibly lead +to a deadlock as reported by the lockdep mechanism. + +[ 836.154963] WARNING: possible circular locking dependency detected +[ 836.155850] 5.19.0-rc5_net_56b7df2 #1 Not tainted +[ 836.156549] ------------------------------------------------------ +[ 836.157418] handler1/12198 is trying to acquire lock: +[ 836.158178] ffff888187d52b58 (&ldev->lock){+.+.}-{3:3}, at: mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core] +[ 836.159575] +[ 836.159575] but task is already holding lock: +[ 836.160474] ffff8881d4de2930 (&block->cb_lock){++++}-{3:3}, at: tc_setup_cb_add+0x5b/0x200 +[ 836.161669] which lock already depends on the new lock. +[ 836.162905] +[ 836.162905] the existing dependency chain (in reverse order) is: +[ 836.164008] -> #3 (&block->cb_lock){++++}-{3:3}: +[ 836.164946] down_write+0x25/0x60 +[ 836.165548] tcf_block_get_ext+0x1c6/0x5d0 +[ 836.166253] ingress_init+0x74/0xa0 [sch_ingress] +[ 836.167028] qdisc_create.constprop.0+0x130/0x5e0 +[ 836.167805] tc_modify_qdisc+0x481/0x9f0 +[ 836.168490] rtnetlink_rcv_msg+0x16e/0x5a0 +[ 836.169189] netlink_rcv_skb+0x4e/0xf0 +[ 836.169861] netlink_unicast+0x190/0x250 +[ 836.170543] netlink_sendmsg+0x243/0x4b0 +[ 836.171226] sock_sendmsg+0x33/0x40 +[ 836.171860] ____sys_sendmsg+0x1d1/0x1f0 +[ 836.172535] ___sys_sendmsg+0xab/0xf0 +[ 836.173183] __sys_sendmsg+0x51/0x90 +[ 836.173836] do_syscall_64+0x3d/0x90 +[ 836.174471] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 836.175282] + +[ 836.175282] -> #2 (rtnl_mutex){+.+.}-{3:3}: +[ 836.176190] __mutex_lock+0x6b/0xf80 +[ 836.176830] register_netdevice_notifier+0x21/0x120 +[ 836.177631] rtnetlink_init+0x2d/0x1e9 +[ 836.178289] netlink_proto_init+0x163/0x179 +[ 836.178994] do_one_initcall+0x63/0x300 +[ 836.179672] kernel_init_freeable+0x2cb/0x31b +[ 836.180403] kernel_init+0x17/0x140 +[ 836.181035] ret_from_fork+0x1f/0x30 + + [ 836.181687] -> #1 (pernet_ops_rwsem){+.+.}-{3:3}: +[ 836.182628] down_write+0x25/0x60 +[ 836.183235] unregister_netdevice_notifier+0x1c/0xb0 +[ 836.184029] mlx5_ib_roce_cleanup+0x94/0x120 [mlx5_ib] +[ 836.184855] __mlx5_ib_remove+0x35/0x60 [mlx5_ib] +[ 836.185637] mlx5_eswitch_unregister_vport_reps+0x22f/0x440 [mlx5_core] +[ 836.186698] auxiliary_bus_remove+0x18/0x30 +[ 836.187409] device_release_driver_internal+0x1f6/0x270 +[ 836.188253] bus_remove_device+0xef/0x160 +[ 836.188939] device_del+0x18b/0x3f0 +[ 836.189562] mlx5_rescan_drivers_locked+0xd6/0x2d0 [mlx5_core] +[ 836.190516] mlx5_lag_remove_devices+0x69/0xe0 [mlx5_core] +[ 836.191414] mlx5_do_bond_work+0x441/0x620 [mlx5_core] +[ 836.192278] process_one_work+0x25c/0x590 +[ 836.192963] worker_thread+0x4f/0x3d0 +[ 836.193609] kthread+0xcb/0xf0 +[ 836.194189] ret_from_fork+0x1f/0x30 + +[ 836.194826] -> #0 (&ldev->lock){+.+.}-{3:3}: +[ 836.195734] __lock_acquire+0x15b8/0x2a10 +[ 836.196426] lock_acquire+0xce/0x2d0 +[ 836.197057] __mutex_lock+0x6b/0xf80 +[ 836.197708] mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core] +[ 836.198575] tc_act_parse_mirred+0x25b/0x800 [mlx5_core] +[ 836.199467] parse_tc_actions+0x168/0x5a0 [mlx5_core] +[ 836.200340] __mlx5e_add_fdb_flow+0x263/0x480 [mlx5_core] +[ 836.201241] mlx5e_configure_flower+0x8a0/0x1820 [mlx5_core] +[ 836.202187] tc_setup_cb_add+0xd7/0x200 +[ 836.202856] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower] +[ 836.203739] fl_change+0xbbe/0x1730 [cls_flower] +[ 836.204501] tc_new_tfilter+0x407/0xd90 +[ 836.205168] rtnetlink_rcv_msg+0x406/0x5a0 +[ 836.205877] netlink_rcv_skb+0x4e/0xf0 +[ 836.206535] netlink_unicast+0x190/0x250 +[ 836.207217] netlink_sendmsg+0x243/0x4b0 +[ 836.207915] sock_sendmsg+0x33/0x40 +[ 836.208538] ____sys_sendmsg+0x1d1/0x1f0 +[ 836.209219] ___sys_sendmsg+0xab/0xf0 +[ 836.209878] __sys_sendmsg+0x51/0x90 +[ 836.210510] do_syscall_64+0x3d/0x90 +[ 836.211137] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +[ 836.211954] other info that might help us debug this: +[ 836.213174] Chain exists of: +[ 836.213174] &ldev->lock --> rtnl_mutex --> &block->cb_lock + 836.214650] Possible unsafe locking scenario: +[ 836.214650] +[ 836.215574] CPU0 CPU1 +[ 836.216255] ---- ---- +[ 836.216943] lock(&block->cb_lock); +[ 836.217518] lock(rtnl_mutex); +[ 836.218348] lock(&block->cb_lock); +[ 836.219212] lock(&ldev->lock); +[ 836.219758] +[ 836.219758] *** DEADLOCK *** +[ 836.219758] + [ 836.220747] 2 locks held by handler1/12198: +[ 836.221390] #0: ffff8881d4de2930 (&block->cb_lock){++++}-{3:3}, at: tc_setup_cb_add+0x5b/0x200 +[ 836.222646] #1: ffff88810c9a92c0 (&esw->mode_lock){++++}-{3:3}, at: mlx5_esw_hold+0x39/0x50 [mlx5_core] + +[ 836.224063] stack backtrace: +[ 836.224799] CPU: 6 PID: 12198 Comm: handler1 Not tainted 5.19.0-rc5_net_56b7df2 #1 +[ 836.225923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +[ 836.227476] Call Trace: +[ 836.227929] +[ 836.228332] dump_stack_lvl+0x57/0x7d +[ 836.228924] check_noncircular+0x104/0x120 +[ 836.229562] __lock_acquire+0x15b8/0x2a10 +[ 836.230201] lock_acquire+0xce/0x2d0 +[ 836.230776] ? mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core] +[ 836.231614] ? find_held_lock+0x2b/0x80 +[ 836.232221] __mutex_lock+0x6b/0xf80 +[ 836.232799] ? mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core] +[ 836.233636] ? mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core] +[ 836.234451] ? xa_load+0xc3/0x190 +[ 836.234995] mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core] +[ 836.235803] tc_act_parse_mirred+0x25b/0x800 [mlx5_core] +[ 836.236636] ? tc_act_can_offload_mirred+0x135/0x210 [mlx5_core] +[ 836.237550] parse_tc_actions+0x168/0x5a0 [mlx5_core] +[ 836.238364] __mlx5e_add_fdb_flow+0x263/0x480 [mlx5_core] +[ 836.239202] mlx5e_configure_flower+0x8a0/0x1820 [mlx5_core] +[ 836.240076] ? lock_acquire+0xce/0x2d0 +[ 836.240668] ? tc_setup_cb_add+0x5b/0x200 +[ 836.241294] tc_setup_cb_add+0xd7/0x200 +[ 836.241917] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower] +[ 836.242709] fl_change+0xbbe/0x1730 [cls_flower] +[ 836.243408] tc_new_tfilter+0x407/0xd90 +[ 836.244043] ? tc_del_tfilter+0x880/0x880 +[ 836.244672] rtnetlink_rcv_msg+0x406/0x5a0 +[ 836.245310] ? netlink_deliver_tap+0x7a/0x4b0 +[ 836.245991] ? if_nlmsg_stats_size+0x2b0/0x2b0 +[ 836.246675] netlink_rcv_skb+0x4e/0xf0 +[ 836.258046] netlink_unicast+0x190/0x250 +[ 836.258669] netlink_sendmsg+0x243/0x4b0 +[ 836.259288] sock_sendmsg+0x33/0x40 +[ 836.259857] ____sys_sendmsg+0x1d1/0x1f0 +[ 836.260473] ___sys_sendmsg+0xab/0xf0 +[ 836.261064] ? lock_acquire+0xce/0x2d0 +[ 836.261669] ? find_held_lock+0x2b/0x80 +[ 836.262272] ? __fget_files+0xb9/0x190 +[ 836.262871] ? __fget_files+0xd3/0x190 +[ 836.263462] __sys_sendmsg+0x51/0x90 +[ 836.264064] do_syscall_64+0x3d/0x90 +[ 836.264652] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[ 836.265425] RIP: 0033:0x7fdbe5e2677d + +[ 836.266012] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ba ee +ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f +05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ee ee ff ff 48 +[ 836.268485] RSP: 002b:00007fdbe48a75a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e +[ 836.269598] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fdbe5e2677d +[ 836.270576] RDX: 0000000000000000 RSI: 00007fdbe48a7640 RDI: 000000000000003c +[ 836.271565] RBP: 00007fdbe48a8368 R08: 0000000000000000 R09: 0000000000000000 +[ 836.272546] R10: 00007fdbe48a84b0 R11: 0000000000000293 R12: 0000557bd17dc860 +[ 836.273527] R13: 0000000000000000 R14: 0000557bd17dc860 R15: 00007fdbe48a7640 + +[ 836.274521] + +To avoid using mode holding ldev->lock in the configure flow, we queue a +work to the lag workqueue and cease wait on a completion object. + +In addition, we remove the lock from mlx5_lag_do_mirred() since it is +not really protecting anything. + +It should be noted that an actual deadlock has not been observed. + +Signed-off-by: Eli Cohen +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/lag/lag.c | 3 +- + .../net/ethernet/mellanox/mlx5/core/lag/lag.h | 14 ++- + .../ethernet/mellanox/mlx5/core/lag/mpesw.c | 100 +++++++++++------- + .../ethernet/mellanox/mlx5/core/lag/mpesw.h | 1 - + 4 files changed, 78 insertions(+), 40 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +index 48f86e12f5c0..bbe810f3b373 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +@@ -201,9 +201,8 @@ static void mlx5_ldev_free(struct kref *ref) + if (ldev->nb.notifier_call) + unregister_netdevice_notifier_net(&init_net, &ldev->nb); + mlx5_lag_mp_cleanup(ldev); +- mlx5_lag_mpesw_cleanup(ldev); +- cancel_work_sync(&ldev->mpesw_work); + destroy_workqueue(ldev->wq); ++ mlx5_lag_mpesw_cleanup(ldev); + mutex_destroy(&ldev->lock); + kfree(ldev); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h +index ce2ce8ccbd70..f30ac2de639f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h +@@ -50,6 +50,19 @@ struct lag_tracker { + enum netdev_lag_hash hash_type; + }; + ++enum mpesw_op { ++ MLX5_MPESW_OP_ENABLE, ++ MLX5_MPESW_OP_DISABLE, ++}; ++ ++struct mlx5_mpesw_work_st { ++ struct work_struct work; ++ struct mlx5_lag *lag; ++ enum mpesw_op op; ++ struct completion comp; ++ int result; ++}; ++ + /* LAG data of a ConnectX card. + * It serves both its phys functions. + */ +@@ -66,7 +79,6 @@ struct mlx5_lag { + struct lag_tracker tracker; + struct workqueue_struct *wq; + struct delayed_work bond_work; +- struct work_struct mpesw_work; + struct notifier_block nb; + struct lag_mp lag_mp; + struct mlx5_lag_port_sel port_sel; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c +index f643202b29c6..c17e8f1ec914 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c +@@ -7,63 +7,95 @@ + #include "eswitch.h" + #include "lib/mlx5.h" + +-void mlx5_mpesw_work(struct work_struct *work) ++static int add_mpesw_rule(struct mlx5_lag *ldev) + { +- struct mlx5_lag *ldev = container_of(work, struct mlx5_lag, mpesw_work); ++ struct mlx5_core_dev *dev = ldev->pf[MLX5_LAG_P1].dev; ++ int err; + +- mutex_lock(&ldev->lock); +- mlx5_disable_lag(ldev); +- mutex_unlock(&ldev->lock); +-} ++ if (atomic_add_return(1, &ldev->lag_mpesw.mpesw_rule_count) != 1) ++ return 0; + +-static void mlx5_lag_disable_mpesw(struct mlx5_core_dev *dev) +-{ +- struct mlx5_lag *ldev = dev->priv.lag; ++ if (ldev->mode != MLX5_LAG_MODE_NONE) { ++ err = -EINVAL; ++ goto out_err; ++ } + +- if (!queue_work(ldev->wq, &ldev->mpesw_work)) +- mlx5_core_warn(dev, "failed to queue work\n"); ++ err = mlx5_activate_lag(ldev, NULL, MLX5_LAG_MODE_MPESW, false); ++ if (err) { ++ mlx5_core_warn(dev, "Failed to create LAG in MPESW mode (%d)\n", err); ++ goto out_err; ++ } ++ ++ return 0; ++ ++out_err: ++ atomic_dec(&ldev->lag_mpesw.mpesw_rule_count); ++ return err; + } + +-void mlx5_lag_del_mpesw_rule(struct mlx5_core_dev *dev) ++static void del_mpesw_rule(struct mlx5_lag *ldev) + { +- struct mlx5_lag *ldev = dev->priv.lag; ++ if (!atomic_dec_return(&ldev->lag_mpesw.mpesw_rule_count) && ++ ldev->mode == MLX5_LAG_MODE_MPESW) ++ mlx5_disable_lag(ldev); ++} + +- if (!ldev) +- return; ++static void mlx5_mpesw_work(struct work_struct *work) ++{ ++ struct mlx5_mpesw_work_st *mpesww = container_of(work, struct mlx5_mpesw_work_st, work); ++ struct mlx5_lag *ldev = mpesww->lag; + + mutex_lock(&ldev->lock); +- if (!atomic_dec_return(&ldev->lag_mpesw.mpesw_rule_count) && +- ldev->mode == MLX5_LAG_MODE_MPESW) +- mlx5_lag_disable_mpesw(dev); ++ if (mpesww->op == MLX5_MPESW_OP_ENABLE) ++ mpesww->result = add_mpesw_rule(ldev); ++ else if (mpesww->op == MLX5_MPESW_OP_DISABLE) ++ del_mpesw_rule(ldev); + mutex_unlock(&ldev->lock); ++ ++ complete(&mpesww->comp); + } + +-int mlx5_lag_add_mpesw_rule(struct mlx5_core_dev *dev) ++static int mlx5_lag_mpesw_queue_work(struct mlx5_core_dev *dev, ++ enum mpesw_op op) + { + struct mlx5_lag *ldev = dev->priv.lag; ++ struct mlx5_mpesw_work_st *work; + int err = 0; + + if (!ldev) + return 0; + +- mutex_lock(&ldev->lock); +- if (atomic_add_return(1, &ldev->lag_mpesw.mpesw_rule_count) != 1) +- goto out; ++ work = kzalloc(sizeof(*work), GFP_KERNEL); ++ if (!work) ++ return -ENOMEM; + +- if (ldev->mode != MLX5_LAG_MODE_NONE) { ++ INIT_WORK(&work->work, mlx5_mpesw_work); ++ init_completion(&work->comp); ++ work->op = op; ++ work->lag = ldev; ++ ++ if (!queue_work(ldev->wq, &work->work)) { ++ mlx5_core_warn(dev, "failed to queue mpesw work\n"); + err = -EINVAL; + goto out; + } +- +- err = mlx5_activate_lag(ldev, NULL, MLX5_LAG_MODE_MPESW, false); +- if (err) +- mlx5_core_warn(dev, "Failed to create LAG in MPESW mode (%d)\n", err); +- ++ wait_for_completion(&work->comp); ++ err = work->result; + out: +- mutex_unlock(&ldev->lock); ++ kfree(work); + return err; + } + ++void mlx5_lag_del_mpesw_rule(struct mlx5_core_dev *dev) ++{ ++ mlx5_lag_mpesw_queue_work(dev, MLX5_MPESW_OP_DISABLE); ++} ++ ++int mlx5_lag_add_mpesw_rule(struct mlx5_core_dev *dev) ++{ ++ return mlx5_lag_mpesw_queue_work(dev, MLX5_MPESW_OP_ENABLE); ++} ++ + int mlx5_lag_do_mirred(struct mlx5_core_dev *mdev, struct net_device *out_dev) + { + struct mlx5_lag *ldev = mdev->priv.lag; +@@ -71,12 +103,9 @@ int mlx5_lag_do_mirred(struct mlx5_core_dev *mdev, struct net_device *out_dev) + if (!netif_is_bond_master(out_dev) || !ldev) + return 0; + +- mutex_lock(&ldev->lock); +- if (ldev->mode == MLX5_LAG_MODE_MPESW) { +- mutex_unlock(&ldev->lock); ++ if (ldev->mode == MLX5_LAG_MODE_MPESW) + return -EOPNOTSUPP; +- } +- mutex_unlock(&ldev->lock); ++ + return 0; + } + +@@ -90,11 +119,10 @@ bool mlx5_lag_mpesw_is_activated(struct mlx5_core_dev *dev) + + void mlx5_lag_mpesw_init(struct mlx5_lag *ldev) + { +- INIT_WORK(&ldev->mpesw_work, mlx5_mpesw_work); + atomic_set(&ldev->lag_mpesw.mpesw_rule_count, 0); + } + + void mlx5_lag_mpesw_cleanup(struct mlx5_lag *ldev) + { +- cancel_delayed_work_sync(&ldev->bond_work); ++ WARN_ON(atomic_read(&ldev->lag_mpesw.mpesw_rule_count)); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h +index be4abcb8fcd5..88e8daffcf92 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h +@@ -12,7 +12,6 @@ struct lag_mpesw { + atomic_t mpesw_rule_count; + }; + +-void mlx5_mpesw_work(struct work_struct *work); + int mlx5_lag_do_mirred(struct mlx5_core_dev *mdev, struct net_device *out_dev); + bool mlx5_lag_mpesw_is_activated(struct mlx5_core_dev *dev); + #if IS_ENABLED(CONFIG_MLX5_ESWITCH) +-- +2.35.1 + diff --git a/queue-6.0/net-usb-qmi_wwan-add-u-blox-0x1342-composition.patch b/queue-6.0/net-usb-qmi_wwan-add-u-blox-0x1342-composition.patch new file mode 100644 index 00000000000..f7c25910c47 --- /dev/null +++ b/queue-6.0/net-usb-qmi_wwan-add-u-blox-0x1342-composition.patch @@ -0,0 +1,53 @@ +From a48c0b2e5a296e24be87e73cf20f2b4803a4c209 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 13:54:55 +0100 +Subject: net: usb: qmi_wwan: add u-blox 0x1342 composition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Davide Tronchin + +[ Upstream commit a487069e11b6527373f7c6f435d8998051d0b5d9 ] + +Add RmNet support for LARA-L6. + +LARA-L6 module can be configured (by AT interface) in three different +USB modes: +* Default mode (Vendor ID: 0x1546 Product ID: 0x1341) with 4 serial +interfaces +* RmNet mode (Vendor ID: 0x1546 Product ID: 0x1342) with 4 serial +interfaces and 1 RmNet virtual network interface +* CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1343) with 4 serial +interface and 1 CDC-ECM virtual network interface + +In RmNet mode LARA-L6 exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parset/alternative functions +If 4: RMNET interface + +Signed-off-by: Davide Tronchin +Acked-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index afd6faa4c2ec..554d4e2a84a4 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1423,6 +1423,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ + {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ + {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */ ++ {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */ + + /* 4. Gobi 1000 devices */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ +-- +2.35.1 + diff --git a/queue-6.0/platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch b/queue-6.0/platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch new file mode 100644 index 00000000000..1ba745feeff --- /dev/null +++ b/queue-6.0/platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch @@ -0,0 +1,174 @@ +From 8a7f61a0712c766462df741423569dafcf0e8b6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 21:27:53 +1200 +Subject: platform/x86: asus-wmi: Add support for ROG X13 tablet mode + +From: Luke D. Jones + +[ Upstream commit e397c3c460bf3849384f2f55516d1887617cfca9 ] + +Add quirk for ASUS ROG X13 Flow 2-in-1 to enable tablet mode with +lid flip (all screen rotations). + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20220813092753.6635-2-luke@ljones.dev +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 15 +++++++++ + drivers/platform/x86/asus-wmi.c | 37 ++++++++++++++++++++++ + drivers/platform/x86/asus-wmi.h | 1 + + include/linux/platform_data/x86/asus-wmi.h | 1 + + 4 files changed, 54 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 4672a2b8322e..d9e7cf6e4a0e 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -123,6 +123,11 @@ static struct quirk_entry quirk_asus_use_lid_flip_devid = { + .tablet_switch_mode = asus_wmi_lid_flip_devid, + }; + ++static struct quirk_entry quirk_asus_tablet_mode = { ++ .wmi_backlight_set_devstate = true, ++ .tablet_switch_mode = asus_wmi_lid_flip_rog_devid, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + pr_info("Identified laptop model '%s'\n", dmi->ident); +@@ -471,6 +476,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_use_lid_flip_devid, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUS ROG FLOW X13", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GV301Q"), ++ }, ++ .driver_data = &quirk_asus_tablet_mode, ++ }, + {}, + }; + +@@ -578,6 +592,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ + { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ ++ { KE_KEY, 0xBD, { KEY_PROG2 } }, /* Lid flip action on ROG xflow laptops */ + { KE_END, 0}, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 26f75c984448..dce93187e11f 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -68,6 +68,7 @@ module_param(fnlock_default, bool, 0444); + #define NOTIFY_KBD_FBM 0x99 + #define NOTIFY_KBD_TTP 0xae + #define NOTIFY_LID_FLIP 0xfa ++#define NOTIFY_LID_FLIP_ROG 0xbd + + #define ASUS_WMI_FNLOCK_BIOS_DISABLED BIT(0) + +@@ -533,6 +534,19 @@ static int asus_wmi_input_init(struct asus_wmi *asus) + dev_err(dev, "Error checking for lid-flip: %d\n", result); + } + break; ++ case asus_wmi_lid_flip_rog_devid: ++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG); ++ if (result < 0) ++ asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; ++ if (result >= 0) { ++ input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); ++ input_report_switch(asus->inputdev, SW_TABLET_MODE, result); ++ } else if (result == -ENODEV) { ++ dev_err(dev, "This device has lid-flip-rog quirk but got ENODEV checking it. This is a bug."); ++ } else { ++ dev_err(dev, "Error checking for lid-flip: %d\n", result); ++ } ++ break; + } + + err = input_register_device(asus->inputdev); +@@ -567,6 +581,17 @@ static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus) + } + } + ++static void lid_flip_rog_tablet_mode_get_state(struct asus_wmi *asus) ++{ ++ int result; ++ ++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG); ++ if (result >= 0) { ++ input_report_switch(asus->inputdev, SW_TABLET_MODE, result); ++ input_sync(asus->inputdev); ++ } ++} ++ + /* dGPU ********************************************************************/ + static int dgpu_disable_check_present(struct asus_wmi *asus) + { +@@ -3134,6 +3159,12 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus) + return; + } + ++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_rog_devid && ++ code == NOTIFY_LID_FLIP_ROG) { ++ lid_flip_rog_tablet_mode_get_state(asus); ++ return; ++ } ++ + if (asus->fan_boost_mode_available && code == NOTIFY_KBD_FBM) { + fan_boost_mode_switch_next(asus); + return; +@@ -3773,6 +3804,9 @@ static int asus_hotk_resume(struct device *device) + case asus_wmi_lid_flip_devid: + lid_flip_tablet_mode_get_state(asus); + break; ++ case asus_wmi_lid_flip_rog_devid: ++ lid_flip_rog_tablet_mode_get_state(asus); ++ break; + } + + return 0; +@@ -3821,6 +3855,9 @@ static int asus_hotk_restore(struct device *device) + case asus_wmi_lid_flip_devid: + lid_flip_tablet_mode_get_state(asus); + break; ++ case asus_wmi_lid_flip_rog_devid: ++ lid_flip_rog_tablet_mode_get_state(asus); ++ break; + } + + return 0; +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 413920bad0c6..0187f13d2414 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -29,6 +29,7 @@ enum asus_wmi_tablet_switch_mode { + asus_wmi_no_tablet_switch, + asus_wmi_kbd_dock_devid, + asus_wmi_lid_flip_devid, ++ asus_wmi_lid_flip_rog_devid, + }; + + struct quirk_entry { +diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h +index 98f2b2f20f3e..7c96db7f3060 100644 +--- a/include/linux/platform_data/x86/asus-wmi.h ++++ b/include/linux/platform_data/x86/asus-wmi.h +@@ -65,6 +65,7 @@ + #define ASUS_WMI_DEVID_PANEL_OD 0x00050019 + #define ASUS_WMI_DEVID_CAMERA 0x00060013 + #define ASUS_WMI_DEVID_LID_FLIP 0x00060062 ++#define ASUS_WMI_DEVID_LID_FLIP_ROG 0x00060077 + + /* Storage */ + #define ASUS_WMI_DEVID_CARDREADER 0x00080013 +-- +2.35.1 + diff --git a/queue-6.0/platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch b/queue-6.0/platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch new file mode 100644 index 00000000000..0776315f290 --- /dev/null +++ b/queue-6.0/platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch @@ -0,0 +1,220 @@ +From 95cfe2982e75b8301b6406e38f76775a5ea6456d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Aug 2022 21:27:52 +1200 +Subject: platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum + +From: Luke D. Jones + +[ Upstream commit 00aa846955fbfb04f7bc0c26c49febfe5395eca1 ] + +Due to multiple types of tablet/lidflip, the existing code for +handling these events is refactored to use an enum for each type. + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20220813092753.6635-1-luke@ljones.dev +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Stable-dep-of: e397c3c460bf ("platform/x86: asus-wmi: Add support for ROG X13 tablet mode") +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +++----- + drivers/platform/x86/asus-wmi.c | 49 +++++++++++++++++++++--------- + drivers/platform/x86/asus-wmi.h | 9 ++++-- + 3 files changed, 47 insertions(+), 24 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 478dd300b9c9..4672a2b8322e 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -115,12 +115,12 @@ static struct quirk_entry quirk_asus_forceals = { + }; + + static struct quirk_entry quirk_asus_use_kbd_dock_devid = { +- .use_kbd_dock_devid = true, ++ .tablet_switch_mode = asus_wmi_kbd_dock_devid, + }; + + static struct quirk_entry quirk_asus_use_lid_flip_devid = { + .wmi_backlight_set_devstate = true, +- .use_lid_flip_devid = true, ++ .tablet_switch_mode = asus_wmi_lid_flip_devid, + }; + + static int dmi_matched(const struct dmi_system_id *dmi) +@@ -492,16 +492,13 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + + switch (tablet_mode_sw) { + case 0: +- quirks->use_kbd_dock_devid = false; +- quirks->use_lid_flip_devid = false; ++ quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; + break; + case 1: +- quirks->use_kbd_dock_devid = true; +- quirks->use_lid_flip_devid = false; ++ quirks->tablet_switch_mode = asus_wmi_kbd_dock_devid; + break; + case 2: +- quirks->use_kbd_dock_devid = false; +- quirks->use_lid_flip_devid = true; ++ quirks->tablet_switch_mode = asus_wmi_lid_flip_devid; + break; + } + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 8e1979b477a7..26f75c984448 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -489,8 +489,11 @@ static bool asus_wmi_dev_is_present(struct asus_wmi *asus, u32 dev_id) + + static int asus_wmi_input_init(struct asus_wmi *asus) + { ++ struct device *dev; + int err, result; + ++ dev = &asus->platform_device->dev; ++ + asus->inputdev = input_allocate_device(); + if (!asus->inputdev) + return -ENOMEM; +@@ -498,35 +501,38 @@ static int asus_wmi_input_init(struct asus_wmi *asus) + asus->inputdev->name = asus->driver->input_name; + asus->inputdev->phys = asus->driver->input_phys; + asus->inputdev->id.bustype = BUS_HOST; +- asus->inputdev->dev.parent = &asus->platform_device->dev; ++ asus->inputdev->dev.parent = dev; + set_bit(EV_REP, asus->inputdev->evbit); + + err = sparse_keymap_setup(asus->inputdev, asus->driver->keymap, NULL); + if (err) + goto err_free_dev; + +- if (asus->driver->quirks->use_kbd_dock_devid) { ++ switch (asus->driver->quirks->tablet_switch_mode) { ++ case asus_wmi_no_tablet_switch: ++ break; ++ case asus_wmi_kbd_dock_devid: + result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_KBD_DOCK); + if (result >= 0) { + input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); + input_report_switch(asus->inputdev, SW_TABLET_MODE, !result); + } else if (result != -ENODEV) { +- pr_err("Error checking for keyboard-dock: %d\n", result); ++ dev_err(dev, "Error checking for keyboard-dock: %d\n", result); + } +- } +- +- if (asus->driver->quirks->use_lid_flip_devid) { ++ break; ++ case asus_wmi_lid_flip_devid: + result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP); + if (result < 0) +- asus->driver->quirks->use_lid_flip_devid = 0; ++ asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch; + if (result >= 0) { + input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE); + input_report_switch(asus->inputdev, SW_TABLET_MODE, result); + } else if (result == -ENODEV) { +- pr_err("This device has lid_flip quirk but got ENODEV checking it. This is a bug."); ++ dev_err(dev, "This device has lid_flip quirk but got ENODEV checking it. This is a bug."); + } else { +- pr_err("Error checking for lid-flip: %d\n", result); ++ dev_err(dev, "Error checking for lid-flip: %d\n", result); + } ++ break; + } + + err = input_register_device(asus->inputdev); +@@ -552,8 +558,9 @@ static void asus_wmi_input_exit(struct asus_wmi *asus) + + static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus) + { +- int result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP); ++ int result; + ++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP); + if (result >= 0) { + input_report_switch(asus->inputdev, SW_TABLET_MODE, result); + input_sync(asus->inputdev); +@@ -3109,7 +3116,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus) + return; + } + +- if (asus->driver->quirks->use_kbd_dock_devid && code == NOTIFY_KBD_DOCK_CHANGE) { ++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_kbd_dock_devid && ++ code == NOTIFY_KBD_DOCK_CHANGE) { + result = asus_wmi_get_devstate_simple(asus, + ASUS_WMI_DEVID_KBD_DOCK); + if (result >= 0) { +@@ -3120,7 +3128,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus) + return; + } + +- if (asus->driver->quirks->use_lid_flip_devid && code == NOTIFY_LID_FLIP) { ++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_devid && ++ code == NOTIFY_LID_FLIP) { + lid_flip_tablet_mode_get_state(asus); + return; + } +@@ -3757,8 +3766,14 @@ static int asus_hotk_resume(struct device *device) + if (asus_wmi_has_fnlock_key(asus)) + asus_wmi_fnlock_update(asus); + +- if (asus->driver->quirks->use_lid_flip_devid) ++ switch (asus->driver->quirks->tablet_switch_mode) { ++ case asus_wmi_no_tablet_switch: ++ case asus_wmi_kbd_dock_devid: ++ break; ++ case asus_wmi_lid_flip_devid: + lid_flip_tablet_mode_get_state(asus); ++ break; ++ } + + return 0; + } +@@ -3799,8 +3814,14 @@ static int asus_hotk_restore(struct device *device) + if (asus_wmi_has_fnlock_key(asus)) + asus_wmi_fnlock_update(asus); + +- if (asus->driver->quirks->use_lid_flip_devid) ++ switch (asus->driver->quirks->tablet_switch_mode) { ++ case asus_wmi_no_tablet_switch: ++ case asus_wmi_kbd_dock_devid: ++ break; ++ case asus_wmi_lid_flip_devid: + lid_flip_tablet_mode_get_state(asus); ++ break; ++ } + + return 0; + } +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index b302415bf1d9..413920bad0c6 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -25,6 +25,12 @@ struct module; + struct key_entry; + struct asus_wmi; + ++enum asus_wmi_tablet_switch_mode { ++ asus_wmi_no_tablet_switch, ++ asus_wmi_kbd_dock_devid, ++ asus_wmi_lid_flip_devid, ++}; ++ + struct quirk_entry { + bool hotplug_wireless; + bool scalar_panel_brightness; +@@ -33,8 +39,7 @@ struct quirk_entry { + bool wmi_backlight_native; + bool wmi_backlight_set_devstate; + bool wmi_force_als_set; +- bool use_kbd_dock_devid; +- bool use_lid_flip_devid; ++ enum asus_wmi_tablet_switch_mode tablet_switch_mode; + int wapf; + /* + * For machines with AMD graphic chips, it will send out WMI event +-- +2.35.1 + diff --git a/queue-6.0/regulator-slg51000-wait-after-asserting-cs-pin.patch b/queue-6.0/regulator-slg51000-wait-after-asserting-cs-pin.patch new file mode 100644 index 00000000000..51eaea8ebac --- /dev/null +++ b/queue-6.0/regulator-slg51000-wait-after-asserting-cs-pin.patch @@ -0,0 +1,44 @@ +From 7c9bb18a4a4b2f5082660c8a16089f9cef4206bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 14:10:35 +0100 +Subject: regulator: slg51000: Wait after asserting CS pin + +From: Konrad Dybcio + +[ Upstream commit 0b24dfa587c6cc7484cfb170da5c7dd73451f670 ] + +Sony's downstream driver [1], among some other changes, adds a +seemingly random 10ms usleep_range, which turned out to be necessary +for the hardware to function properly on at least Sony Xperia 1 IV. +Without this, I2C transactions with the SLG51000 straight up fail. + +Relax (10-10ms -> 10-11ms) and add the aforementioned sleep to make +sure the hardware has some time to wake up. + +(nagara-2.0.0-mlc/vendor/semc/hardware/camera-kernel-module/) +[1] https://developer.sony.com/file/download/open-source-archive-for-64-0-m-4-29/ + +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20221118131035.54874-1-konrad.dybcio@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/slg51000-regulator.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/regulator/slg51000-regulator.c b/drivers/regulator/slg51000-regulator.c +index 75a941fb3c2b..1b2eee95ad3f 100644 +--- a/drivers/regulator/slg51000-regulator.c ++++ b/drivers/regulator/slg51000-regulator.c +@@ -457,6 +457,8 @@ static int slg51000_i2c_probe(struct i2c_client *client) + chip->cs_gpiod = cs_gpiod; + } + ++ usleep_range(10000, 11000); ++ + i2c_set_clientdata(client, chip); + chip->chip_irq = client->irq; + chip->dev = dev; +-- +2.35.1 + diff --git a/queue-6.0/regulator-twl6030-fix-get-status-of-twl6032-regulato.patch b/queue-6.0/regulator-twl6030-fix-get-status-of-twl6032-regulato.patch new file mode 100644 index 00000000000..526530d6079 --- /dev/null +++ b/queue-6.0/regulator-twl6030-fix-get-status-of-twl6032-regulato.patch @@ -0,0 +1,69 @@ +From cb7f0ca578a68e9b17cfd602b30a90f215d7d7dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Nov 2022 23:12:08 +0100 +Subject: regulator: twl6030: fix get status of twl6032 regulators + +From: Andreas Kemnade + +[ Upstream commit 31a6297b89aabc81b274c093a308a7f5b55081a7 ] + +Status is reported as always off in the 6032 case. Status +reporting now matches the logic in the setters. Once of +the differences to the 6030 is that there are no groups, +therefore the state needs to be read out in the lower bits. + +Signed-off-by: Andreas Kemnade +Link: https://lore.kernel.org/r/20221120221208.3093727-3-andreas@kemnade.info +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/twl6030-regulator.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/twl6030-regulator.c b/drivers/regulator/twl6030-regulator.c +index 7c7e3648ea4b..f3856750944f 100644 +--- a/drivers/regulator/twl6030-regulator.c ++++ b/drivers/regulator/twl6030-regulator.c +@@ -67,6 +67,7 @@ struct twlreg_info { + #define TWL6030_CFG_STATE_SLEEP 0x03 + #define TWL6030_CFG_STATE_GRP_SHIFT 5 + #define TWL6030_CFG_STATE_APP_SHIFT 2 ++#define TWL6030_CFG_STATE_MASK 0x03 + #define TWL6030_CFG_STATE_APP_MASK (0x03 << TWL6030_CFG_STATE_APP_SHIFT) + #define TWL6030_CFG_STATE_APP(v) (((v) & TWL6030_CFG_STATE_APP_MASK) >>\ + TWL6030_CFG_STATE_APP_SHIFT) +@@ -128,13 +129,14 @@ static int twl6030reg_is_enabled(struct regulator_dev *rdev) + if (grp < 0) + return grp; + grp &= P1_GRP_6030; ++ val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE); ++ val = TWL6030_CFG_STATE_APP(val); + } else { ++ val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE); ++ val &= TWL6030_CFG_STATE_MASK; + grp = 1; + } + +- val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE); +- val = TWL6030_CFG_STATE_APP(val); +- + return grp && (val == TWL6030_CFG_STATE_ON); + } + +@@ -187,7 +189,12 @@ static int twl6030reg_get_status(struct regulator_dev *rdev) + + val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE); + +- switch (TWL6030_CFG_STATE_APP(val)) { ++ if (info->features & TWL6032_SUBCLASS) ++ val &= TWL6030_CFG_STATE_MASK; ++ else ++ val = TWL6030_CFG_STATE_APP(val); ++ ++ switch (val) { + case TWL6030_CFG_STATE_ON: + return REGULATOR_STATUS_NORMAL; + +-- +2.35.1 + diff --git a/queue-6.0/revert-coresight-cti-fix-hang-in-cti_disable_hw.patch b/queue-6.0/revert-coresight-cti-fix-hang-in-cti_disable_hw.patch new file mode 100644 index 00000000000..aa19e19000b --- /dev/null +++ b/queue-6.0/revert-coresight-cti-fix-hang-in-cti_disable_hw.patch @@ -0,0 +1,70 @@ +From 3a2f7fc63430e869b49c05738eb23e7b95f6bfff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 08:32:39 +0200 +Subject: Revert "coresight: cti: Fix hang in cti_disable_hw()" + +From: Greg Kroah-Hartman + +[ Upstream commit d76308f03ee1574b0deffde45604252a51c77f6d ] + +This reverts commit 665c157e0204176023860b51a46528ba0ba62c33. + +It causes reported build warnings: + +drivers/hwtracing/coresight/coresight-cti-core.c: In functio +n 'cti_enable_hw': +drivers/hwtracing/coresight/coresight-cti-core.c:93:24: warning: unused variable 'dev' [-Wunused-variable] + 93 | struct device *dev = &drvdata->csdev->dev; + | ^~~ +drivers/hwtracing/coresight/coresight-cti-core.c: In function 'cti_disable_hw': +drivers/hwtracing/coresight/coresight-cti-core.c:154:24: warning: unused variable 'dev' [-Wunused-variable] + 154 | struct device *dev = &drvdata->csdev->dev; + | ^~~ + +Reported-by: Stephen Rothwell +Cc: Aishwarya TCV +Cc: Cristian Marussi +Cc: Suzuki Poulose +Cc: James Clark +Cc: Mike Leach +Cc: Mike Leach +Cc: Suzuki K Poulose +Fixes: 665c157e0204 ("coresight: cti: Fix hang in cti_disable_hw()") +Link: https://lore.kernel.org/r/20221024135752.2b83af97@canb.auug.org.au +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cti-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c +index dcd607a0c41a..5c2ebb5323a5 100644 +--- a/drivers/hwtracing/coresight/coresight-cti-core.c ++++ b/drivers/hwtracing/coresight/coresight-cti-core.c +@@ -93,6 +93,7 @@ static int cti_enable_hw(struct cti_drvdata *drvdata) + unsigned long flags; + int rc = 0; + ++ pm_runtime_get_sync(dev->parent); + spin_lock_irqsave(&drvdata->spinlock, flags); + + /* no need to do anything if enabled or unpowered*/ +@@ -117,6 +118,7 @@ static int cti_enable_hw(struct cti_drvdata *drvdata) + /* cannot enable due to error */ + cti_err_not_enabled: + spin_unlock_irqrestore(&drvdata->spinlock, flags); ++ pm_runtime_put(dev->parent); + return rc; + } + +@@ -171,6 +173,7 @@ static int cti_disable_hw(struct cti_drvdata *drvdata) + coresight_disclaim_device_unlocked(csdev); + CS_LOCK(drvdata->base); + spin_unlock(&drvdata->spinlock); ++ pm_runtime_put(dev->parent); + return 0; + + /* not disabled this call */ +-- +2.35.1 + diff --git a/queue-6.0/selftests-net-find-nettest-in-current-directory.patch b/queue-6.0/selftests-net-find-nettest-in-current-directory.patch new file mode 100644 index 00000000000..c16a90a5644 --- /dev/null +++ b/queue-6.0/selftests-net-find-nettest-in-current-directory.patch @@ -0,0 +1,93 @@ +From 7323df77893c5cd5a5400b5dfca8512b9487b960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 21:44:21 -0600 +Subject: selftests/net: Find nettest in current directory +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Díaz + +[ Upstream commit bd5e1e42826f18147afb0ba07e6a815f52cf8bcb ] + +The `nettest` binary, built from `selftests/net/nettest.c`, +was expected to be found in the path during test execution of +`fcnal-test.sh` and `pmtu.sh`, leading to tests getting +skipped when the binary is not installed in the system, as can +be seen in these logs found in the wild [1]: + + # TEST: vti4: PMTU exceptions [SKIP] + [ 350.600250] IPv6: ADDRCONF(NETDEV_CHANGE): veth_b: link becomes ready + [ 350.607421] IPv6: ADDRCONF(NETDEV_CHANGE): veth_a: link becomes ready + # 'nettest' command not found; skipping tests + # xfrm6udp not supported + # TEST: vti6: PMTU exceptions (ESP-in-UDP) [SKIP] + [ 351.605102] IPv6: ADDRCONF(NETDEV_CHANGE): veth_b: link becomes ready + [ 351.612243] IPv6: ADDRCONF(NETDEV_CHANGE): veth_a: link becomes ready + # 'nettest' command not found; skipping tests + # xfrm4udp not supported + +The `unicast_extensions.sh` tests also rely on `nettest`, but +it runs fine there because it looks for the binary in the +current working directory [2]: + +The same mechanism that works for the Unicast extensions tests +is here copied over to the PMTU and functional tests. + +[1] https://lkft.validation.linaro.org/scheduler/job/5839508#L6221 +[2] https://lkft.validation.linaro.org/scheduler/job/5839508#L7958 + +Signed-off-by: Daniel Díaz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/fcnal-test.sh | 11 +++++++---- + tools/testing/selftests/net/pmtu.sh | 10 ++++++---- + 2 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh +index 31c3b6ebd388..21ca91473c09 100755 +--- a/tools/testing/selftests/net/fcnal-test.sh ++++ b/tools/testing/selftests/net/fcnal-test.sh +@@ -4196,10 +4196,13 @@ elif [ "$TESTS" = "ipv6" ]; then + TESTS="$TESTS_IPV6" + fi + +-which nettest >/dev/null +-if [ $? -ne 0 ]; then +- echo "'nettest' command not found; skipping tests" +- exit $ksft_skip ++# nettest can be run from PATH or from same directory as this selftest ++if ! which nettest >/dev/null; then ++ PATH=$PWD:$PATH ++ if ! which nettest >/dev/null; then ++ echo "'nettest' command not found; skipping tests" ++ exit $ksft_skip ++ fi + fi + + declare -i nfail=0 +diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh +index 736e358dc549..dfe3d287f01d 100755 +--- a/tools/testing/selftests/net/pmtu.sh ++++ b/tools/testing/selftests/net/pmtu.sh +@@ -686,10 +686,12 @@ setup_xfrm() { + } + + setup_nettest_xfrm() { +- which nettest >/dev/null +- if [ $? -ne 0 ]; then +- echo "'nettest' command not found; skipping tests" +- return 1 ++ if ! which nettest >/dev/null; then ++ PATH=$PWD:$PATH ++ if ! which nettest >/dev/null; then ++ echo "'nettest' command not found; skipping tests" ++ return 1 ++ fi + fi + + [ ${1} -eq 6 ] && proto="-6" || proto="" +-- +2.35.1 + diff --git a/queue-6.0/series b/queue-6.0/series new file mode 100644 index 00000000000..1a96daff0ff --- /dev/null +++ b/queue-6.0/series @@ -0,0 +1,55 @@ +madvise-use-zap_page_range_single-for-madvise-dontne.patch +drm-i915-remove-non-existent-pipes-from-bigjoiner-pi.patch +arm64-dts-rockchip-fix-gmac-failure-of-rgmii-id-from.patch +arm64-dts-rockchip-fix-i2c3-pinctrl-on-rk3566-roc-pc.patch +arm64-dts-rockchip-remove-i2c5-from-rk3566-roc-pc.patch +arm64-dts-rockchip-keep-i2s1-disabled-for-gpio-funct.patch +arm64-dts-rockchip-fix-node-name-for-hym8563-rtc.patch +arm-dts-rockchip-fix-node-name-for-hym8563-rtc.patch +arm-dts-rockchip-remove-clock-frequency-from-rtc.patch +arm-dts-rockchip-fix-adc-keys-sub-node-names.patch +arm64-dts-rockchip-fix-adc-keys-sub-node-names.patch +arm-dts-rockchip-fix-ir-receiver-node-names.patch +arm64-dts-rockchip-fix-ir-receiver-node-names.patch +arm-dts-rockchip-rk3188-fix-lcdc1-rgb24-node-name.patch +fs-use-acquire-ordering-in-__fget_light.patch +arm-9251-1-perf-fix-stacktraces-for-tracepoint-event.patch +arm-9266-1-mm-fix-no-mmu-zero_page-implementation.patch +asoc-wm8962-wait-for-updated-value-of-wm8962_clockin.patch +spi-mediatek-fix-devapc-violation-at-ko-remove.patch +arm-dts-rockchip-disable-arm_global_timer-on-rk3066-.patch +asoc-rt711-sdca-fix-the-latency-time-of-clock-stop-p.patch +9p-fd-use-p9_hdrsz-for-header-size.patch +regulator-slg51000-wait-after-asserting-cs-pin.patch +alsa-seq-fix-function-prototype-mismatch-in-snd_seq_.patch +loongarch-makefile-use-grep-e-instead-of-egrep.patch +loongarch-combine-acpi_boot_table_init-and-acpi_boot.patch +loongarch-set-_page_dirty-only-if-_page_modified-is-.patch +loongarch-fix-unsigned-comparison-with-less-than-zer.patch +selftests-net-find-nettest-in-current-directory.patch +btrfs-send-avoid-unaligned-encoded-writes-when-attem.patch +net-mlx5-lag-avoid-lockdep-warnings.patch +asoc-soc-pcm-add-null-check-in-be-reparenting.patch +regulator-twl6030-fix-get-status-of-twl6032-regulato.patch +fbcon-use-kzalloc-in-fbcon_prepare_logo.patch +usb-dwc3-gadget-disable-gusb2phycfg.susphy-for-end-t.patch +9p-xen-check-logical-size-for-buffer-size.patch +net-usb-qmi_wwan-add-u-blox-0x1342-composition.patch +drm-amd-display-use-viewport-height-for-subvp-mall-a.patch +drm-amd-display-avoid-setting-pixel-rate-divider-to-.patch +drm-amd-display-use-new-num-clk-levels-struct-for-ma.patch +drm-amdgpu-fix-use-after-free-during-gpu-recovery.patch +mm-khugepaged-take-the-right-locks-for-page-table-re.patch +mm-khugepaged-fix-gup-fast-interaction-by-sending-ip.patch +mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-col.patch +hugetlb-don-t-delete-vma_lock-in-hugetlb-madv_dontne.patch +alsa-hda-realtek-more-robust-component-matching-for-.patch +crypto-ccp-add-a-quirk-to-firmware-update.patch +soundwire-dmi-quirks-add-remapping-for-hp-omen-16-k0.patch +platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch +platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch +revert-coresight-cti-fix-hang-in-cti_disable_hw.patch +xen-netback-ensure-protocol-headers-don-t-fall-in-th.patch +xen-netback-don-t-call-kfree_skb-with-interrupts-dis.patch +media-videobuf2-core-take-mmap_lock-in-vb2_get_unmap.patch +fscache-fix-oops-due-to-race-with-cookie_lru-and-use.patch diff --git a/queue-6.0/soundwire-dmi-quirks-add-remapping-for-hp-omen-16-k0.patch b/queue-6.0/soundwire-dmi-quirks-add-remapping-for-hp-omen-16-k0.patch new file mode 100644 index 00000000000..6def1195f6f --- /dev/null +++ b/queue-6.0/soundwire-dmi-quirks-add-remapping-for-hp-omen-16-k0.patch @@ -0,0 +1,76 @@ +From be2c08999c7fa70afd1db67abde8f75237bbaeb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 11:09:19 +0800 +Subject: soundwire: dmi-quirks: add remapping for HP Omen 16-k0005TX + +From: Pierre-Louis Bossart + +[ Upstream commit df55100551a34bddab02dff48d0296bda0659c02 ] + +The DSDT for this device has a number of problems: +a) it lists rt711 on link0 and link1, but link1 is disabled +b) the rt711 entry on link0 uses the wrong v2 instead of v3 (SDCA) +c) the rt1316 amplifier on link3 is not listed. + +Add a remapping table to work-around these BIOS shenanigans. + +BugLink: https://github.com/thesofproject/sof/issues/5955 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20220823030919.2346629-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/dmi-quirks.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c +index 747983743a14..f81cdd83ec26 100644 +--- a/drivers/soundwire/dmi-quirks.c ++++ b/drivers/soundwire/dmi-quirks.c +@@ -55,7 +55,26 @@ static const struct adr_remap dell_sku_0A3E[] = { + {} + }; + ++/* ++ * The HP Omen 16-k0005TX does not expose the correct version of RT711 on link0 ++ * and does not expose a RT1316 on link3 ++ */ ++static const struct adr_remap hp_omen_16[] = { ++ /* rt711-sdca on link0 */ ++ { ++ 0x000020025d071100ull, ++ 0x000030025d071101ull ++ }, ++ /* rt1316-sdca on link3 */ ++ { ++ 0x000120025d071100ull, ++ 0x000330025d131601ull ++ }, ++ {} ++}; ++ + static const struct dmi_system_id adr_remap_quirk_table[] = { ++ /* TGL devices */ + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "HP"), +@@ -78,6 +97,14 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { + }, + .driver_data = (void *)dell_sku_0A3E, + }, ++ /* ADL devices */ ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16-k0xxx"), ++ }, ++ .driver_data = (void *)hp_omen_16, ++ }, + {} + }; + +-- +2.35.1 + diff --git a/queue-6.0/spi-mediatek-fix-devapc-violation-at-ko-remove.patch b/queue-6.0/spi-mediatek-fix-devapc-violation-at-ko-remove.patch new file mode 100644 index 00000000000..eea5b7deed8 --- /dev/null +++ b/queue-6.0/spi-mediatek-fix-devapc-violation-at-ko-remove.patch @@ -0,0 +1,57 @@ +From be30cae9f7c1b24f49d3b77d563e4c677710bec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 15:28:39 +0800 +Subject: spi: mediatek: Fix DEVAPC Violation at KO Remove + +From: Zhichao Liu + +[ Upstream commit 0d10e90cee9eb57882b0f7e19fd699033722e226 ] + +A DEVAPC violation occurs when removing the module +due to accessing HW registers without base clock. +To fix this bug, the correct method is: +1. Call the runtime resume function to enable the + clock; +2. Operate the registers to reset the HW; +3. Turn off the clocks and disable the device + RPM mechanism. + +Signed-off-by: Zhichao Liu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221110072839.30961-1-zhichao.liu@mediatek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mt65xx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c +index cd9dc358d396..a7cc96aeb590 100644 +--- a/drivers/spi/spi-mt65xx.c ++++ b/drivers/spi/spi-mt65xx.c +@@ -1268,8 +1268,11 @@ static int mtk_spi_remove(struct platform_device *pdev) + { + struct spi_master *master = platform_get_drvdata(pdev); + struct mtk_spi *mdata = spi_master_get_devdata(master); ++ int ret; + +- pm_runtime_disable(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); ++ if (ret < 0) ++ return ret; + + mtk_spi_reset(mdata); + +@@ -1278,6 +1281,9 @@ static int mtk_spi_remove(struct platform_device *pdev) + clk_unprepare(mdata->spi_hclk); + } + ++ pm_runtime_put_noidle(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-6.0/usb-dwc3-gadget-disable-gusb2phycfg.susphy-for-end-t.patch b/queue-6.0/usb-dwc3-gadget-disable-gusb2phycfg.susphy-for-end-t.patch new file mode 100644 index 00000000000..d5cd4cc1762 --- /dev/null +++ b/queue-6.0/usb-dwc3-gadget-disable-gusb2phycfg.susphy-for-end-t.patch @@ -0,0 +1,47 @@ +From ed149c970acc9676b5e42d4d832be036d284d223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 17:58:50 -0800 +Subject: usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer + +From: Thinh Nguyen + +[ Upstream commit 3aa07f72894d209fcf922ad686cbb28cf005aaad ] + +If there's a disconnection while operating in eSS, there may be a delay +in VBUS drop response from the connector. In that case, the internal +link state may drop to operate in usb2 speed while the controller thinks +the VBUS is still high. The driver must make sure to disable +GUSB2PHYCFG.SUSPHY when sending endpoint command while in usb2 speed. +The End Transfer command may be called, and only that command needs to +go through at this point. Let's keep it simple and unconditionally +disable GUSB2PHYCFG.SUSPHY whenever we issue the command. + +This scenario is not seen in real hardware. In a rare case, our +prototype type-c controller/interface may have a slow response +triggerring this issue. + +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/5651117207803c26e2f22ddf4e5ce9e865dcf7c7.1668045468.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 6f61a288073b..c2075b90f3df 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -291,7 +291,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd, + * + * DWC_usb3 3.30a and DWC_usb31 1.90a programming guide section 3.2.2 + */ +- if (dwc->gadget->speed <= USB_SPEED_HIGH) { ++ if (dwc->gadget->speed <= USB_SPEED_HIGH || ++ DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER) { + reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)); + if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) { + saved_config |= DWC3_GUSB2PHYCFG_SUSPHY; +-- +2.35.1 + diff --git a/queue-6.0/xen-netback-don-t-call-kfree_skb-with-interrupts-dis.patch b/queue-6.0/xen-netback-don-t-call-kfree_skb-with-interrupts-dis.patch new file mode 100644 index 00000000000..c92b97e3e61 --- /dev/null +++ b/queue-6.0/xen-netback-don-t-call-kfree_skb-with-interrupts-dis.patch @@ -0,0 +1,105 @@ +From ce6e015e332e2e1531d86807ca128a7d18eea852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 08:54:24 +0100 +Subject: xen/netback: don't call kfree_skb() with interrupts disabled + +From: Juergen Gross + +[ Upstream commit 74e7e1efdad45580cc3839f2a155174cf158f9b5 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So remove kfree_skb() +from the spin_lock_irqsave() section and use the already existing +"drop" label in xenvif_start_xmit() for dropping the SKB. At the +same time replace the dev_kfree_skb() call there with a call of +dev_kfree_skb_any(), as xenvif_start_xmit() can be called with +disabled interrupts. + +This is XSA-424 / CVE-2022-42328 / CVE-2022-42329. + +Fixes: be81992f9086 ("xen/netback: don't queue unlimited number of packages") +Reported-by: Yang Yingliang +Signed-off-by: Juergen Gross +Reviewed-by: Jan Beulich +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/common.h | 2 +- + drivers/net/xen-netback/interface.c | 6 ++++-- + drivers/net/xen-netback/rx.c | 8 +++++--- + 3 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h +index 8174d7b2966c..adfd21aa5b6a 100644 +--- a/drivers/net/xen-netback/common.h ++++ b/drivers/net/xen-netback/common.h +@@ -386,7 +386,7 @@ int xenvif_dealloc_kthread(void *data); + irqreturn_t xenvif_ctrl_irq_fn(int irq, void *data); + + bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread); +-void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb); ++bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb); + + void xenvif_carrier_on(struct xenvif *vif); + +diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c +index fb32ae82d9b0..d048a5cc918b 100644 +--- a/drivers/net/xen-netback/interface.c ++++ b/drivers/net/xen-netback/interface.c +@@ -254,14 +254,16 @@ xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev) + if (vif->hash.alg == XEN_NETIF_CTRL_HASH_ALGORITHM_NONE) + skb_clear_hash(skb); + +- xenvif_rx_queue_tail(queue, skb); ++ if (!xenvif_rx_queue_tail(queue, skb)) ++ goto drop; ++ + xenvif_kick_thread(queue); + + return NETDEV_TX_OK; + + drop: + vif->dev->stats.tx_dropped++; +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + +diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c +index 932762177110..0ba754ebc5ba 100644 +--- a/drivers/net/xen-netback/rx.c ++++ b/drivers/net/xen-netback/rx.c +@@ -82,9 +82,10 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) + return false; + } + +-void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) ++bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) + { + unsigned long flags; ++ bool ret = true; + + spin_lock_irqsave(&queue->rx_queue.lock, flags); + +@@ -92,8 +93,7 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) + struct net_device *dev = queue->vif->dev; + + netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id)); +- kfree_skb(skb); +- queue->vif->dev->stats.rx_dropped++; ++ ret = false; + } else { + if (skb_queue_empty(&queue->rx_queue)) + xenvif_update_needed_slots(queue, skb); +@@ -104,6 +104,8 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) + } + + spin_unlock_irqrestore(&queue->rx_queue.lock, flags); ++ ++ return ret; + } + + static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue) +-- +2.35.1 + diff --git a/queue-6.0/xen-netback-ensure-protocol-headers-don-t-fall-in-th.patch b/queue-6.0/xen-netback-ensure-protocol-headers-don-t-fall-in-th.patch new file mode 100644 index 00000000000..2dfa35d4555 --- /dev/null +++ b/queue-6.0/xen-netback-ensure-protocol-headers-don-t-fall-in-th.patch @@ -0,0 +1,390 @@ +From bb3442ef329aac4f76aba7acd27a13ce3bde81f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 09:16:59 +0000 +Subject: xen/netback: Ensure protocol headers don't fall in the non-linear + area + +From: Ross Lagerwall + +[ Upstream commit ad7f402ae4f466647c3a669b8a6f3e5d4271c84a ] + +In some cases, the frontend may send a packet where the protocol headers +are spread across multiple slots. This would result in netback creating +an skb where the protocol headers spill over into the non-linear area. +Some drivers and NICs don't handle this properly resulting in an +interface reset or worse. + +This issue was introduced by the removal of an unconditional skb pull in +the tx path to improve performance. Fix this without reintroducing the +pull by setting up grant copy ops for as many slots as needed to reach +the XEN_NETBACK_TX_COPY_LEN size. Adjust the rest of the code to handle +multiple copy operations per skb. + +This is XSA-423 / CVE-2022-3643. + +Fixes: 7e5d7753956b ("xen-netback: remove unconditional __pskb_pull_tail() in guest Tx path") +Signed-off-by: Ross Lagerwall +Reviewed-by: Paul Durrant +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/netback.c | 223 ++++++++++++++++-------------- + 1 file changed, 123 insertions(+), 100 deletions(-) + +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index a256695fc89e..4962ff8b1534 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -332,10 +332,13 @@ static int xenvif_count_requests(struct xenvif_queue *queue, + + + struct xenvif_tx_cb { +- u16 pending_idx; ++ u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1]; ++ u8 copy_count; + }; + + #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb) ++#define copy_pending_idx(skb, i) (XENVIF_TX_CB(skb)->copy_pending_idx[i]) ++#define copy_count(skb) (XENVIF_TX_CB(skb)->copy_count) + + static inline void xenvif_tx_create_map_op(struct xenvif_queue *queue, + u16 pending_idx, +@@ -370,31 +373,93 @@ static inline struct sk_buff *xenvif_alloc_skb(unsigned int size) + return skb; + } + +-static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *queue, +- struct sk_buff *skb, +- struct xen_netif_tx_request *txp, +- struct gnttab_map_grant_ref *gop, +- unsigned int frag_overflow, +- struct sk_buff *nskb) ++static void xenvif_get_requests(struct xenvif_queue *queue, ++ struct sk_buff *skb, ++ struct xen_netif_tx_request *first, ++ struct xen_netif_tx_request *txfrags, ++ unsigned *copy_ops, ++ unsigned *map_ops, ++ unsigned int frag_overflow, ++ struct sk_buff *nskb, ++ unsigned int extra_count, ++ unsigned int data_len) + { + struct skb_shared_info *shinfo = skb_shinfo(skb); + skb_frag_t *frags = shinfo->frags; +- u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx; +- int start; ++ u16 pending_idx; + pending_ring_idx_t index; + unsigned int nr_slots; ++ struct gnttab_copy *cop = queue->tx_copy_ops + *copy_ops; ++ struct gnttab_map_grant_ref *gop = queue->tx_map_ops + *map_ops; ++ struct xen_netif_tx_request *txp = first; ++ ++ nr_slots = shinfo->nr_frags + 1; ++ ++ copy_count(skb) = 0; ++ ++ /* Create copy ops for exactly data_len bytes into the skb head. */ ++ __skb_put(skb, data_len); ++ while (data_len > 0) { ++ int amount = data_len > txp->size ? txp->size : data_len; ++ ++ cop->source.u.ref = txp->gref; ++ cop->source.domid = queue->vif->domid; ++ cop->source.offset = txp->offset; ++ ++ cop->dest.domid = DOMID_SELF; ++ cop->dest.offset = (offset_in_page(skb->data + ++ skb_headlen(skb) - ++ data_len)) & ~XEN_PAGE_MASK; ++ cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb) ++ - data_len); ++ ++ cop->len = amount; ++ cop->flags = GNTCOPY_source_gref; + +- nr_slots = shinfo->nr_frags; ++ index = pending_index(queue->pending_cons); ++ pending_idx = queue->pending_ring[index]; ++ callback_param(queue, pending_idx).ctx = NULL; ++ copy_pending_idx(skb, copy_count(skb)) = pending_idx; ++ copy_count(skb)++; ++ ++ cop++; ++ data_len -= amount; + +- /* Skip first skb fragment if it is on same page as header fragment. */ +- start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx); ++ if (amount == txp->size) { ++ /* The copy op covered the full tx_request */ ++ ++ memcpy(&queue->pending_tx_info[pending_idx].req, ++ txp, sizeof(*txp)); ++ queue->pending_tx_info[pending_idx].extra_count = ++ (txp == first) ? extra_count : 0; ++ ++ if (txp == first) ++ txp = txfrags; ++ else ++ txp++; ++ queue->pending_cons++; ++ nr_slots--; ++ } else { ++ /* The copy op partially covered the tx_request. ++ * The remainder will be mapped. ++ */ ++ txp->offset += amount; ++ txp->size -= amount; ++ } ++ } + +- for (shinfo->nr_frags = start; shinfo->nr_frags < nr_slots; +- shinfo->nr_frags++, txp++, gop++) { ++ for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; ++ shinfo->nr_frags++, gop++) { + index = pending_index(queue->pending_cons++); + pending_idx = queue->pending_ring[index]; +- xenvif_tx_create_map_op(queue, pending_idx, txp, 0, gop); ++ xenvif_tx_create_map_op(queue, pending_idx, txp, ++ txp == first ? extra_count : 0, gop); + frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx); ++ ++ if (txp == first) ++ txp = txfrags; ++ else ++ txp++; + } + + if (frag_overflow) { +@@ -415,7 +480,8 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *que + skb_shinfo(skb)->frag_list = nskb; + } + +- return gop; ++ (*copy_ops) = cop - queue->tx_copy_ops; ++ (*map_ops) = gop - queue->tx_map_ops; + } + + static inline void xenvif_grant_handle_set(struct xenvif_queue *queue, +@@ -451,7 +517,7 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue, + struct gnttab_copy **gopp_copy) + { + struct gnttab_map_grant_ref *gop_map = *gopp_map; +- u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx; ++ u16 pending_idx; + /* This always points to the shinfo of the skb being checked, which + * could be either the first or the one on the frag_list + */ +@@ -462,24 +528,37 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue, + struct skb_shared_info *first_shinfo = NULL; + int nr_frags = shinfo->nr_frags; + const bool sharedslot = nr_frags && +- frag_get_pending_idx(&shinfo->frags[0]) == pending_idx; ++ frag_get_pending_idx(&shinfo->frags[0]) == ++ copy_pending_idx(skb, copy_count(skb) - 1); + int i, err; + +- /* Check status of header. */ +- err = (*gopp_copy)->status; +- if (unlikely(err)) { +- if (net_ratelimit()) +- netdev_dbg(queue->vif->dev, +- "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n", +- (*gopp_copy)->status, +- pending_idx, +- (*gopp_copy)->source.u.ref); +- /* The first frag might still have this slot mapped */ +- if (!sharedslot) +- xenvif_idx_release(queue, pending_idx, +- XEN_NETIF_RSP_ERROR); ++ for (i = 0; i < copy_count(skb); i++) { ++ int newerr; ++ ++ /* Check status of header. */ ++ pending_idx = copy_pending_idx(skb, i); ++ ++ newerr = (*gopp_copy)->status; ++ if (likely(!newerr)) { ++ /* The first frag might still have this slot mapped */ ++ if (i < copy_count(skb) - 1 || !sharedslot) ++ xenvif_idx_release(queue, pending_idx, ++ XEN_NETIF_RSP_OKAY); ++ } else { ++ err = newerr; ++ if (net_ratelimit()) ++ netdev_dbg(queue->vif->dev, ++ "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n", ++ (*gopp_copy)->status, ++ pending_idx, ++ (*gopp_copy)->source.u.ref); ++ /* The first frag might still have this slot mapped */ ++ if (i < copy_count(skb) - 1 || !sharedslot) ++ xenvif_idx_release(queue, pending_idx, ++ XEN_NETIF_RSP_ERROR); ++ } ++ (*gopp_copy)++; + } +- (*gopp_copy)++; + + check_frags: + for (i = 0; i < nr_frags; i++, gop_map++) { +@@ -526,14 +605,6 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue, + if (err) + continue; + +- /* First error: if the header haven't shared a slot with the +- * first frag, release it as well. +- */ +- if (!sharedslot) +- xenvif_idx_release(queue, +- XENVIF_TX_CB(skb)->pending_idx, +- XEN_NETIF_RSP_OKAY); +- + /* Invalidate preceding fragments of this skb. */ + for (j = 0; j < i; j++) { + pending_idx = frag_get_pending_idx(&shinfo->frags[j]); +@@ -803,7 +874,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, + unsigned *copy_ops, + unsigned *map_ops) + { +- struct gnttab_map_grant_ref *gop = queue->tx_map_ops; + struct sk_buff *skb, *nskb; + int ret; + unsigned int frag_overflow; +@@ -885,8 +955,12 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, + continue; + } + ++ data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN) ? ++ XEN_NETBACK_TX_COPY_LEN : txreq.size; ++ + ret = xenvif_count_requests(queue, &txreq, extra_count, + txfrags, work_to_do); ++ + if (unlikely(ret < 0)) + break; + +@@ -912,9 +986,8 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, + index = pending_index(queue->pending_cons); + pending_idx = queue->pending_ring[index]; + +- data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN && +- ret < XEN_NETBK_LEGACY_SLOTS_MAX) ? +- XEN_NETBACK_TX_COPY_LEN : txreq.size; ++ if (ret >= XEN_NETBK_LEGACY_SLOTS_MAX - 1 && data_len < txreq.size) ++ data_len = txreq.size; + + skb = xenvif_alloc_skb(data_len); + if (unlikely(skb == NULL)) { +@@ -925,8 +998,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, + } + + skb_shinfo(skb)->nr_frags = ret; +- if (data_len < txreq.size) +- skb_shinfo(skb)->nr_frags++; + /* At this point shinfo->nr_frags is in fact the number of + * slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX. + */ +@@ -988,54 +1059,19 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue, + type); + } + +- XENVIF_TX_CB(skb)->pending_idx = pending_idx; +- +- __skb_put(skb, data_len); +- queue->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref; +- queue->tx_copy_ops[*copy_ops].source.domid = queue->vif->domid; +- queue->tx_copy_ops[*copy_ops].source.offset = txreq.offset; +- +- queue->tx_copy_ops[*copy_ops].dest.u.gmfn = +- virt_to_gfn(skb->data); +- queue->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF; +- queue->tx_copy_ops[*copy_ops].dest.offset = +- offset_in_page(skb->data) & ~XEN_PAGE_MASK; +- +- queue->tx_copy_ops[*copy_ops].len = data_len; +- queue->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref; +- +- (*copy_ops)++; +- +- if (data_len < txreq.size) { +- frag_set_pending_idx(&skb_shinfo(skb)->frags[0], +- pending_idx); +- xenvif_tx_create_map_op(queue, pending_idx, &txreq, +- extra_count, gop); +- gop++; +- } else { +- frag_set_pending_idx(&skb_shinfo(skb)->frags[0], +- INVALID_PENDING_IDX); +- memcpy(&queue->pending_tx_info[pending_idx].req, +- &txreq, sizeof(txreq)); +- queue->pending_tx_info[pending_idx].extra_count = +- extra_count; +- } +- +- queue->pending_cons++; +- +- gop = xenvif_get_requests(queue, skb, txfrags, gop, +- frag_overflow, nskb); ++ xenvif_get_requests(queue, skb, &txreq, txfrags, copy_ops, ++ map_ops, frag_overflow, nskb, extra_count, ++ data_len); + + __skb_queue_tail(&queue->tx_queue, skb); + + queue->tx.req_cons = idx; + +- if (((gop-queue->tx_map_ops) >= ARRAY_SIZE(queue->tx_map_ops)) || ++ if ((*map_ops >= ARRAY_SIZE(queue->tx_map_ops)) || + (*copy_ops >= ARRAY_SIZE(queue->tx_copy_ops))) + break; + } + +- (*map_ops) = gop - queue->tx_map_ops; + return; + } + +@@ -1114,9 +1150,8 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) + while ((skb = __skb_dequeue(&queue->tx_queue)) != NULL) { + struct xen_netif_tx_request *txp; + u16 pending_idx; +- unsigned data_len; + +- pending_idx = XENVIF_TX_CB(skb)->pending_idx; ++ pending_idx = copy_pending_idx(skb, 0); + txp = &queue->pending_tx_info[pending_idx].req; + + /* Check the remap error code. */ +@@ -1135,18 +1170,6 @@ static int xenvif_tx_submit(struct xenvif_queue *queue) + continue; + } + +- data_len = skb->len; +- callback_param(queue, pending_idx).ctx = NULL; +- if (data_len < txp->size) { +- /* Append the packet payload as a fragment. */ +- txp->offset += data_len; +- txp->size -= data_len; +- } else { +- /* Schedule a response immediately. */ +- xenvif_idx_release(queue, pending_idx, +- XEN_NETIF_RSP_OKAY); +- } +- + if (txp->flags & XEN_NETTXF_csum_blank) + skb->ip_summed = CHECKSUM_PARTIAL; + else if (txp->flags & XEN_NETTXF_data_validated) +@@ -1331,7 +1354,7 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue) + /* Called after netfront has transmitted */ + int xenvif_tx_action(struct xenvif_queue *queue, int budget) + { +- unsigned nr_mops, nr_cops = 0; ++ unsigned nr_mops = 0, nr_cops = 0; + int work_done, ret; + + if (unlikely(!tx_work_todo(queue))) +-- +2.35.1 +