From: Sasha Levin Date: Thu, 17 Aug 2023 14:52:48 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v6.4.12~99 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6698468992ee2db5b1c527cf178cac2eacc8b2f0;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch b/queue-5.4/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch new file mode 100644 index 00000000000..e35d6b64a8e --- /dev/null +++ b/queue-5.4/alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch @@ -0,0 +1,153 @@ +From 784a5b86ae9fc4bbafda9a8b0789145738da4990 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 19:39:05 +0200 +Subject: ALSA: emu10k1: roll up loops in DSP setup code for Audigy + +From: Oswald Buddenhagen + +[ Upstream commit 8cabf83c7aa54530e699be56249fb44f9505c4f3 ] + +There is no apparent reason for the massive code duplication. + +Signed-off-by: Oswald Buddenhagen +Link: https://lore.kernel.org/r/20230510173917.3073107-3-oswald.buddenhagen@gmx.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/emu10k1/emufx.c | 112 +++----------------------------------- + 1 file changed, 9 insertions(+), 103 deletions(-) + +diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c +index e053f0d58bdd0..2f3cfcfcdb9a3 100644 +--- a/sound/pci/emu10k1/emufx.c ++++ b/sound/pci/emu10k1/emufx.c +@@ -1536,14 +1536,8 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input)) + gpr += 2; + + /* Master volume (will be renamed later) */ +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+0+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+0+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+1+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+1+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+2+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+2+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+3+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+3+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+4+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+4+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+5+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+5+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+6+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+6+SND_EMU10K1_PLAYBACK_CHANNELS)); +- A_OP(icode, &ptr, iMAC0, A_GPR(playback+7+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+7+SND_EMU10K1_PLAYBACK_CHANNELS)); ++ for (z = 0; z < 8; z++) ++ A_OP(icode, &ptr, iMAC0, A_GPR(playback+z+SND_EMU10K1_PLAYBACK_CHANNELS), A_C_00000000, A_GPR(gpr), A_GPR(playback+z+SND_EMU10K1_PLAYBACK_CHANNELS)); + snd_emu10k1_init_mono_control(&controls[nctl++], "Wave Master Playback Volume", gpr, 0); + gpr += 2; + +@@ -1627,102 +1621,14 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input)) + dev_dbg(emu->card->dev, "emufx.c: gpr=0x%x, tmp=0x%x\n", + gpr, tmp); + */ +- /* For the EMU1010: How to get 32bit values from the DSP. High 16bits into L, low 16bits into R. */ +- /* A_P16VIN(0) is delayed by one sample, +- * so all other A_P16VIN channels will need to also be delayed +- */ +- /* Left ADC in. 1 of 2 */ + snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_P16VIN(0x0), A_FXBUS2(0) ); +- /* Right ADC in 1 of 2 */ +- gpr_map[gpr++] = 0x00000000; +- /* Delaying by one sample: instead of copying the input +- * value A_P16VIN to output A_FXBUS2 as in the first channel, +- * we use an auxiliary register, delaying the value by one +- * sample +- */ +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(2) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x1), A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(4) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x2), A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(6) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x3), A_C_00000000, A_C_00000000); +- /* For 96kHz mode */ +- /* Left ADC in. 2 of 2 */ +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0x8) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x4), A_C_00000000, A_C_00000000); +- /* Right ADC in 2 of 2 */ +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xa) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x5), A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xc) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x6), A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr - 1), A_FXBUS2(0xe) ); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x7), A_C_00000000, A_C_00000000); +- /* Pavel Hofman - we still have voices, A_FXBUS2s, and +- * A_P16VINs available - +- * let's add 8 more capture channels - total of 16 +- */ +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x10)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x8), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x12)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0x9), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x14)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xa), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x16)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xb), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x18)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xc), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x1a)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xd), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x1c)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xe), +- A_C_00000000, A_C_00000000); +- gpr_map[gpr++] = 0x00000000; +- snd_emu10k1_audigy_dsp_convert_32_to_2x16(icode, &ptr, tmp, +- bit_shifter16, +- A_GPR(gpr - 1), +- A_FXBUS2(0x1e)); +- A_OP(icode, &ptr, iACC3, A_GPR(gpr - 1), A_P16VIN(0xf), +- A_C_00000000, A_C_00000000); ++ /* A_P16VIN(0) is delayed by one sample, so all other A_P16VIN channels ++ * will need to also be delayed; we use an auxiliary register for that. */ ++ for (z = 1; z < 0x10; z++) { ++ snd_emu10k1_audigy_dsp_convert_32_to_2x16( icode, &ptr, tmp, bit_shifter16, A_GPR(gpr), A_FXBUS2(z * 2) ); ++ A_OP(icode, &ptr, iACC3, A_GPR(gpr), A_P16VIN(z), A_C_00000000, A_C_00000000); ++ gpr_map[gpr++] = 0x00000000; ++ } + } + + #if 0 +-- +2.40.1 + diff --git a/queue-5.4/alsa-hda-fix-a-possible-null-pointer-dereference-due.patch b/queue-5.4/alsa-hda-fix-a-possible-null-pointer-dereference-due.patch new file mode 100644 index 00000000000..601c8efa3dd --- /dev/null +++ b/queue-5.4/alsa-hda-fix-a-possible-null-pointer-dereference-due.patch @@ -0,0 +1,62 @@ +From 6e503266bfd0a20a6c2125960776482bedb9b8f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 11:10:16 +0800 +Subject: ALSA: hda: fix a possible null-pointer dereference due to data race + in snd_hdac_regmap_sync() + +From: Tuo Li + +[ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] + +The variable codec->regmap is often protected by the lock +codec->regmap_lock when is accessed. However, it is accessed without +holding the lock when is accessed in snd_hdac_regmap_sync(): + + if (codec->regmap) + +In my opinion, this may be a harmful race, because if codec->regmap is +set to NULL right after the condition is checked, a null-pointer +dereference can occur in the called function regcache_sync(): + + map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c + +To fix this possible null-pointer dereference caused by data race, the +mutex_lock coverage is extended to protect the if statement as well as the +function call to regcache_sync(). + +[ Note: the lack of the regmap_lock itself is harmless for the current + codec driver implementations, as snd_hdac_regmap_sync() is only for + PM runtime resume that is prohibited during the codec probe. + But the change makes the whole code more consistent, so it's merged + as is -- tiwai ] + +Reported-by: BassCheck +Signed-off-by: Tuo Li +Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/hdac_regmap.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c +index 49780399c2849..a035a7d74ce09 100644 +--- a/sound/hda/hdac_regmap.c ++++ b/sound/hda/hdac_regmap.c +@@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); + */ + void snd_hdac_regmap_sync(struct hdac_device *codec) + { +- if (codec->regmap) { +- mutex_lock(&codec->regmap_lock); ++ mutex_lock(&codec->regmap_lock); ++ if (codec->regmap) + regcache_sync(codec->regmap); +- mutex_unlock(&codec->regmap_lock); +- } ++ mutex_unlock(&codec->regmap_lock); + } + EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); +-- +2.40.1 + diff --git a/queue-5.4/alsa-hda-fix-unhandled-register-update-during-auto-s.patch b/queue-5.4/alsa-hda-fix-unhandled-register-update-during-auto-s.patch new file mode 100644 index 00000000000..0b516620601 --- /dev/null +++ b/queue-5.4/alsa-hda-fix-unhandled-register-update-during-auto-s.patch @@ -0,0 +1,72 @@ +From 1de04a1e3da486e9b343ead527b40c84bd92d267 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 13:35:20 +0200 +Subject: ALSA: hda: Fix unhandled register update during auto-suspend period +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Takashi Iwai + +[ Upstream commit 81302b1c7c997e8a56c1c2fc63a296ebeb0cd2d0 ] + +It's reported that the recording started right after the driver probe +doesn't work properly, and it turned out that this is related with the +codec auto-suspend. Namely, after the probe phase, the usage count +goes zero, and the auto-suspend is programmed, but the codec is kept +still active until the auto-suspend expiration. When an application +(e.g. alsactl) updates the mixer values at this moment, the values are +cached but not actually written. Then, starting arecord thereafter +also results in the silence because of the missing unmute. + +The root cause is the handling of "lazy update" mode; when a mixer +value is updated *after* the suspend, it should update only the cache +and exits. At the resume, the cached value is written to the device, +in turn. The problem is that the current code misinterprets the state +of auto-suspend as if it were already suspended. + +Although we can add the check of the actual device state after +pm_runtime_get_if_in_use() for catching the missing state, this won't +suffice; the second call of regmap_update_bits_check() will skip +writing the register because the cache has been already updated by the +first call. So we'd need fixes in two different places. + +OTOH, a simpler fix is to replace pm_runtime_get_if_in_use() with +pm_runtime_get_if_active() (with ign_usage_count=true). This change +implies that the driver takes the pm refcount if the device is still +in ACTIVE state and continues the processing. A small caveat is that +this will leave the auto-suspend timer. But, since the timer callback +itself checks the device state and aborts gracefully when it's active, +this won't be any substantial problem. + +Long story short: we address the missing register-write problem just +by replacing the pm_runtime_*() call in snd_hda_keep_power_up(). + +Fixes: fc4f000bf8c0 ("ALSA: hda - Fix unexpected resume through regmap code path") +Reported-by: Amadeusz Sławiński +Closes: https://lore.kernel.org/r/a7478636-af11-92ab-731c-9b13c582a70d@linux.intel.com +Suggested-by: Cezary Rojewski +Cc: +Link: https://lore.kernel.org/r/20230518113520.15213-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/hdac_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c +index 489f996d86bcb..9df0158e89f44 100644 +--- a/sound/hda/hdac_device.c ++++ b/sound/hda/hdac_device.c +@@ -607,7 +607,7 @@ EXPORT_SYMBOL_GPL(snd_hdac_power_up_pm); + int snd_hdac_keep_power_up(struct hdac_device *codec) + { + if (!atomic_inc_not_zero(&codec->in_pm)) { +- int ret = pm_runtime_get_if_in_use(&codec->dev); ++ int ret = pm_runtime_get_if_active(&codec->dev, true); + if (!ret) + return -1; + if (ret < 0) +-- +2.40.1 + diff --git a/queue-5.4/alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch b/queue-5.4/alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch new file mode 100644 index 00000000000..6164eb82840 --- /dev/null +++ b/queue-5.4/alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch @@ -0,0 +1,59 @@ +From 42c8ba3f7c1e9a26ab92e61cf254f6e6108df55c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 10:17:51 +0800 +Subject: ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 + +From: dengxiang + +[ Upstream commit 73f1c75d5e6bd8ce2a887ef493a66ad1b16ed704 ] + +These models use NSIWAY amplifiers for internal speaker, but cannot put +sound outside from these amplifiers. So eapd verbs are needed to initialize +the amplifiers. They can be added during boot to get working sound out +of internal speaker. + +Signed-off-by: dengxiang +Link: https://lore.kernel.org/r/20230703021751.2945750-1-dengxiang@nfschina.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 6d8d9fc1da0b0..c0bcbab7b6560 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9877,6 +9877,7 @@ enum { + ALC897_FIXUP_HP_HSMIC_VERB, + ALC897_FIXUP_LENOVO_HEADSET_MODE, + ALC897_FIXUP_HEADSET_MIC_PIN2, ++ ALC897_FIXUP_UNIS_H3C_X500S, + }; + + static const struct hda_fixup alc662_fixups[] = { +@@ -10316,6 +10317,13 @@ static const struct hda_fixup alc662_fixups[] = { + .chained = true, + .chain_id = ALC897_FIXUP_LENOVO_HEADSET_MODE + }, ++ [ALC897_FIXUP_UNIS_H3C_X500S] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x14, AC_VERB_SET_EAPD_BTLENABLE, 0 }, ++ {} ++ }, ++ }, + }; + + static const struct snd_pci_quirk alc662_fixup_tbl[] = { +@@ -10477,6 +10485,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = { + {.id = ALC662_FIXUP_USI_HEADSET_MODE, .name = "usi-headset"}, + {.id = ALC662_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"}, + {.id = ALC669_FIXUP_ACER_ASPIRE_ETHOS, .name = "aspire-ethos"}, ++ {.id = ALC897_FIXUP_UNIS_H3C_X500S, .name = "unis-h3c-x500s"}, + {} + }; + +-- +2.40.1 + diff --git a/queue-5.4/bluetooth-l2cap-fix-use-after-free.patch b/queue-5.4/bluetooth-l2cap-fix-use-after-free.patch new file mode 100644 index 00000000000..91c61f27f9f --- /dev/null +++ b/queue-5.4/bluetooth-l2cap-fix-use-after-free.patch @@ -0,0 +1,41 @@ +From bcbc56ee21909c6d192839407001116410e738b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 17:04:15 -0700 +Subject: Bluetooth: L2CAP: Fix use-after-free + +From: Zhengping Jiang + +[ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ] + +Fix potential use-after-free in l2cap_le_command_rej. + +Signed-off-by: Zhengping Jiang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index e56863587ea2e..61bf489265505 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -5723,9 +5723,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, + if (!chan) + goto done; + ++ chan = l2cap_chan_hold_unless_zero(chan); ++ if (!chan) ++ goto done; ++ + l2cap_chan_lock(chan); + l2cap_chan_del(chan, ECONNREFUSED); + l2cap_chan_unlock(chan); ++ l2cap_chan_put(chan); + + done: + mutex_unlock(&conn->chan_lock); +-- +2.40.1 + diff --git a/queue-5.4/drm-amdgpu-fix-potential-fence-use-after-free-v2.patch b/queue-5.4/drm-amdgpu-fix-potential-fence-use-after-free-v2.patch new file mode 100644 index 00000000000..6a818e2e1e3 --- /dev/null +++ b/queue-5.4/drm-amdgpu-fix-potential-fence-use-after-free-v2.patch @@ -0,0 +1,52 @@ +From 947d708e6712f5c01e49b24c045e42053f159f87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 18:10:47 -0700 +Subject: drm/amdgpu: Fix potential fence use-after-free v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: shanzhulig + +[ Upstream commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 ] + +fence Decrements the reference count before exiting. +Avoid Race Vulnerabilities for fence use-after-free. + +v2 (chk): actually fix the use after free and not just move it. + +Signed-off-by: shanzhulig +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 7eeb98fe50ed7..0e478d4d830c9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1575,15 +1575,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev, + continue; + + r = dma_fence_wait_timeout(fence, true, timeout); ++ if (r > 0 && fence->error) ++ r = fence->error; ++ + dma_fence_put(fence); + if (r < 0) + return r; + + if (r == 0) + break; +- +- if (fence->error) +- return fence->error; + } + + memset(wait, 0, sizeof(*wait)); +-- +2.40.1 + diff --git a/queue-5.4/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch b/queue-5.4/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch new file mode 100644 index 00000000000..cbf34bdb027 --- /dev/null +++ b/queue-5.4/drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch @@ -0,0 +1,41 @@ +From 5c7860fa3fe84b68359df9e4ac0e04ecbb5e5cf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 20:20:58 +0800 +Subject: drm/radeon: Fix integer overflow in radeon_cs_parser_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: hackyzh002 + +[ Upstream commit f828b681d0cd566f86351c0b913e6cb6ed8c7b9c ] + +The type of size is unsigned, if size is 0x40000000, there will be an +integer overflow, size will be zero after size *= sizeof(uint32_t), +will cause uninitialized memory to be referenced later + +Reviewed-by: Christian König +Signed-off-by: hackyzh002 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_cs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c +index 7b54606783821..ba64dad1d7c9e 100644 +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -271,7 +271,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) + { + struct drm_radeon_cs *cs = data; + uint64_t *chunk_array_ptr; +- unsigned size, i; ++ u64 size; ++ unsigned i; + u32 ring = RADEON_CS_RING_GFX; + s32 priority = 0; + +-- +2.40.1 + diff --git a/queue-5.4/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch b/queue-5.4/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch new file mode 100644 index 00000000000..7190d4f66f3 --- /dev/null +++ b/queue-5.4/fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch @@ -0,0 +1,39 @@ +From bc22fdbbae03d7a4ecf10c426b62662ac8f747bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 19:17:08 +0530 +Subject: FS: JFS: Check for read-only mounted filesystem in txBegin + +From: Immad Mir + +[ Upstream commit 95e2b352c03b0a86c5717ba1d24ea20969abcacc ] + + This patch adds a check for read-only mounted filesystem + in txBegin before starting a transaction potentially saving + from NULL pointer deref. + +Signed-off-by: Immad Mir +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_txnmgr.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c +index c8ce7f1bc5942..6f6a5b9203d3f 100644 +--- a/fs/jfs/jfs_txnmgr.c ++++ b/fs/jfs/jfs_txnmgr.c +@@ -354,6 +354,11 @@ tid_t txBegin(struct super_block *sb, int flag) + jfs_info("txBegin: flag = 0x%x", flag); + log = JFS_SBI(sb)->log; + ++ if (!log) { ++ jfs_error(sb, "read-only filesystem\n"); ++ return 0; ++ } ++ + TXN_LOCK(); + + INCREMENT(TxStat.txBegin); +-- +2.40.1 + diff --git a/queue-5.4/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch b/queue-5.4/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch new file mode 100644 index 00000000000..b1b558620f0 --- /dev/null +++ b/queue-5.4/fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch @@ -0,0 +1,44 @@ +From 02f8a37fb131d3de0cc0ad23f3e85ac4f2366727 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 19:14:01 +0530 +Subject: FS: JFS: Fix null-ptr-deref Read in txBegin + +From: Immad Mir + +[ Upstream commit 47cfdc338d674d38f4b2f22b7612cc6a2763ba27 ] + + Syzkaller reported an issue where txBegin may be called + on a superblock in a read-only mounted filesystem which leads + to NULL pointer deref. This could be solved by checking if + the filesystem is read-only before calling txBegin, and returning + with appropiate error code. + +Reported-By: syzbot+f1faa20eec55e0c8644c@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=be7e52c50c5182cc09a09ea6fc456446b2039de3 + +Signed-off-by: Immad Mir +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/namei.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index 7a55d14cc1af0..f155ad6650bd4 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -798,6 +798,11 @@ static int jfs_link(struct dentry *old_dentry, + if (rc) + goto out; + ++ if (isReadOnly(ip)) { ++ jfs_error(ip->i_sb, "read-only filesystem\n"); ++ return -EROFS; ++ } ++ + tid = txBegin(ip->i_sb, 0); + + mutex_lock_nested(&JFS_IP(dir)->commit_mutex, COMMIT_MUTEX_PARENT); +-- +2.40.1 + diff --git a/queue-5.4/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch b/queue-5.4/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch new file mode 100644 index 00000000000..f033ac79b35 --- /dev/null +++ b/queue-5.4/fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch @@ -0,0 +1,86 @@ +From b5515a139e7b66e22c1013835f1dbf8bcf47efc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 00:07:03 +0530 +Subject: fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev + +From: Yogesh + +[ Upstream commit 4e302336d5ca1767a06beee7596a72d3bdc8d983 ] + +Syzkaller reported the following issue: + +UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1965:6 +index -84 is out of range for type 's8[341]' (aka 'signed char[341]') +CPU: 1 PID: 4995 Comm: syz-executor146 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 + ubsan_epilogue lib/ubsan.c:217 [inline] + __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 + dbAllocDmapLev+0x3e5/0x430 fs/jfs/jfs_dmap.c:1965 + dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1809 + dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1350 + dbAlloc+0x658/0xca0 fs/jfs/jfs_dmap.c:874 + dtSplitUp fs/jfs/jfs_dtree.c:974 [inline] + dtInsert+0xda7/0x6b00 fs/jfs/jfs_dtree.c:863 + jfs_create+0x7b6/0xbb0 fs/jfs/namei.c:137 + lookup_open fs/namei.c:3492 [inline] + open_last_lookups fs/namei.c:3560 [inline] + path_openat+0x13df/0x3170 fs/namei.c:3788 + do_filp_open+0x234/0x490 fs/namei.c:3818 + do_sys_openat2+0x13f/0x500 fs/open.c:1356 + do_sys_open fs/open.c:1372 [inline] + __do_sys_openat fs/open.c:1388 [inline] + __se_sys_openat fs/open.c:1383 [inline] + __x64_sys_openat+0x247/0x290 fs/open.c:1383 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f1f4e33f7e9 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffc21129578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f4e33f7e9 +RDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c +RBP: 00007f1f4e2ff080 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1f4e2ff110 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +The bug occurs when the dbAllocDmapLev()function attempts to access +dp->tree.stree[leafidx + LEAFIND] while the leafidx value is negative. + +To rectify this, the patch introduces a safeguard within the +dbAllocDmapLev() function. A check has been added to verify if leafidx is +negative. If it is, the function immediately returns an I/O error, preventing +any further execution that could potentially cause harm. + +Tested via syzbot. + +Reported-by: syzbot+853a6f4dfa3cf37d3aea@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=ae2f5a27a07ae44b0f17 +Signed-off-by: Yogesh +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index dac67ee1879be..8e8d53241386f 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -2027,6 +2027,9 @@ dbAllocDmapLev(struct bmap * bmp, + if (dbFindLeaf((dmtree_t *) & dp->tree, l2nb, &leafidx)) + return -ENOSPC; + ++ if (leafidx < 0) ++ return -EIO; ++ + /* determine the block number within the file system corresponding + * to the leaf at which free space was found. + */ +-- +2.40.1 + diff --git a/queue-5.4/gfs2-fix-possible-data-races-in-gfs2_show_options.patch b/queue-5.4/gfs2-fix-possible-data-races-in-gfs2_show_options.patch new file mode 100644 index 00000000000..b0cae85faf2 --- /dev/null +++ b/queue-5.4/gfs2-fix-possible-data-races-in-gfs2_show_options.patch @@ -0,0 +1,86 @@ +From aeec81f9b0941f5f368c7f4020a020574d50a5c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 11:06:37 +0800 +Subject: gfs2: Fix possible data races in gfs2_show_options() + +From: Tuo Li + +[ Upstream commit 6fa0a72cbbe45db4ed967a51f9e6f4e3afe61d20 ] + +Some fields such as gt_logd_secs of the struct gfs2_tune are accessed +without holding the lock gt_spin in gfs2_show_options(): + + val = sdp->sd_tune.gt_logd_secs; + if (val != 30) + seq_printf(s, ",commit=%d", val); + +And thus can cause data races when gfs2_show_options() and other functions +such as gfs2_reconfigure() are concurrently executed: + + spin_lock(>->gt_spin); + gt->gt_logd_secs = newargs->ar_commit; + +To fix these possible data races, the lock sdp->sd_tune.gt_spin is +acquired before accessing the fields of gfs2_tune and released after these +accesses. + +Further changes by Andreas: + +- Don't hold the spin lock over the seq_printf operations. + +Reported-by: BassCheck +Signed-off-by: Tuo Li +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/super.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index baf0a70460c03..15e757f763806 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -1046,7 +1046,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) + { + struct gfs2_sbd *sdp = root->d_sb->s_fs_info; + struct gfs2_args *args = &sdp->sd_args; +- int val; ++ unsigned int logd_secs, statfs_slow, statfs_quantum, quota_quantum; ++ ++ spin_lock(&sdp->sd_tune.gt_spin); ++ logd_secs = sdp->sd_tune.gt_logd_secs; ++ quota_quantum = sdp->sd_tune.gt_quota_quantum; ++ statfs_quantum = sdp->sd_tune.gt_statfs_quantum; ++ statfs_slow = sdp->sd_tune.gt_statfs_slow; ++ spin_unlock(&sdp->sd_tune.gt_spin); + + if (is_ancestor(root, sdp->sd_master_dir)) + seq_puts(s, ",meta"); +@@ -1101,17 +1108,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) + } + if (args->ar_discard) + seq_puts(s, ",discard"); +- val = sdp->sd_tune.gt_logd_secs; +- if (val != 30) +- seq_printf(s, ",commit=%d", val); +- val = sdp->sd_tune.gt_statfs_quantum; +- if (val != 30) +- seq_printf(s, ",statfs_quantum=%d", val); +- else if (sdp->sd_tune.gt_statfs_slow) ++ if (logd_secs != 30) ++ seq_printf(s, ",commit=%d", logd_secs); ++ if (statfs_quantum != 30) ++ seq_printf(s, ",statfs_quantum=%d", statfs_quantum); ++ else if (statfs_slow) + seq_puts(s, ",statfs_quantum=0"); +- val = sdp->sd_tune.gt_quota_quantum; +- if (val != 60) +- seq_printf(s, ",quota_quantum=%d", val); ++ if (quota_quantum != 60) ++ seq_printf(s, ",quota_quantum=%d", quota_quantum); + if (args->ar_statfs_percent) + seq_printf(s, ",statfs_percent=%d", args->ar_statfs_percent); + if (args->ar_errors != GFS2_ERRORS_DEFAULT) { +-- +2.40.1 + diff --git a/queue-5.4/hid-add-quirk-for-03f0-464a-hp-elite-presenter-mouse.patch b/queue-5.4/hid-add-quirk-for-03f0-464a-hp-elite-presenter-mouse.patch new file mode 100644 index 00000000000..983b53b7e06 --- /dev/null +++ b/queue-5.4/hid-add-quirk-for-03f0-464a-hp-elite-presenter-mouse.patch @@ -0,0 +1,54 @@ +From be53f522a0241856b9be809b29d3d44eff65065b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 15:40:08 +0200 +Subject: HID: add quirk for 03f0:464a HP Elite Presenter Mouse + +From: Marco Morandini + +[ Upstream commit 0db117359e47750d8bd310d19f13e1c4ef7fc26a ] + +HP Elite Presenter Mouse HID Record Descriptor shows +two mouses (Repord ID 0x1 and 0x2), one keypad (Report ID 0x5), +two Consumer Controls (Report IDs 0x6 and 0x3). +Previous to this commit it registers one mouse, one keypad +and one Consumer Control, and it was usable only as a +digitl laser pointer (one of the two mouses). This patch defines +the 464a USB device ID and enables the HID_QUIRK_MULTI_INPUT +quirk for it, allowing to use the device both as a mouse +and a digital laser pointer. + +Signed-off-by: Marco Morandini +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 479516bbb61bf..64842926aff64 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -581,6 +581,7 @@ + #define USB_DEVICE_ID_UGCI_FIGHTING 0x0030 + + #define USB_VENDOR_ID_HP 0x03f0 ++#define USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A 0x464a + #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a + #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index e5dcc47586ee4..83c3322fcf187 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -96,6 +96,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL }, +-- +2.40.1 + diff --git a/queue-5.4/iio-adc-stx104-implement-and-utilize-register-struct.patch b/queue-5.4/iio-adc-stx104-implement-and-utilize-register-struct.patch new file mode 100644 index 00000000000..fe1094aacef --- /dev/null +++ b/queue-5.4/iio-adc-stx104-implement-and-utilize-register-struct.patch @@ -0,0 +1,213 @@ +From a404f142be1eb9a0da9502d309fd3a05a8162b8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 13:21:24 -0400 +Subject: iio: adc: stx104: Implement and utilize register structures + +From: William Breathitt Gray + +[ Upstream commit 6cfd14c54b1f42f29097244c1b6208f8268d7d5b ] + +Reduce magic numbers and improve code readability by implementing and +utilizing named register data structures. + +Tested-by: Fred Eckert +Signed-off-by: William Breathitt Gray +Link: https://lore.kernel.org/r/8cb91d5b53e57b066120e42ea07000d6c7ef5543.1657213745.git.william.gray@linaro.org +Signed-off-by: Jonathan Cameron +Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital") +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/stx104.c | 74 +++++++++++++++++++++++++++------------- + 1 file changed, 50 insertions(+), 24 deletions(-) + +diff --git a/drivers/iio/adc/stx104.c b/drivers/iio/adc/stx104.c +index 112362f7d3943..6712da1b818c9 100644 +--- a/drivers/iio/adc/stx104.c ++++ b/drivers/iio/adc/stx104.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #define STX104_OUT_CHAN(chan) { \ + .type = IIO_VOLTAGE, \ +@@ -44,14 +45,36 @@ static unsigned int num_stx104; + module_param_hw_array(base, uint, ioport, &num_stx104, 0); + MODULE_PARM_DESC(base, "Apex Embedded Systems STX104 base addresses"); + ++/** ++ * struct stx104_reg - device register structure ++ * @ssr_ad: Software Strobe Register and ADC Data ++ * @achan: ADC Channel ++ * @dio: Digital I/O ++ * @dac: DAC Channels ++ * @cir_asr: Clear Interrupts and ADC Status ++ * @acr: ADC Control ++ * @pccr_fsh: Pacer Clock Control and FIFO Status MSB ++ * @acfg: ADC Configuration ++ */ ++struct stx104_reg { ++ u16 ssr_ad; ++ u8 achan; ++ u8 dio; ++ u16 dac[2]; ++ u8 cir_asr; ++ u8 acr; ++ u8 pccr_fsh; ++ u8 acfg; ++}; ++ + /** + * struct stx104_iio - IIO device private data structure + * @chan_out_states: channels' output states +- * @base: base port address of the IIO device ++ * @reg: I/O address offset for the device registers + */ + struct stx104_iio { + unsigned int chan_out_states[STX104_NUM_OUT_CHAN]; +- void __iomem *base; ++ struct stx104_reg __iomem *reg; + }; + + /** +@@ -64,7 +87,7 @@ struct stx104_iio { + struct stx104_gpio { + struct gpio_chip chip; + spinlock_t lock; +- void __iomem *base; ++ u8 __iomem *base; + unsigned int out_state; + }; + +@@ -72,6 +95,7 @@ static int stx104_read_raw(struct iio_dev *indio_dev, + struct iio_chan_spec const *chan, int *val, int *val2, long mask) + { + struct stx104_iio *const priv = iio_priv(indio_dev); ++ struct stx104_reg __iomem *const reg = priv->reg; + unsigned int adc_config; + int adbu; + int gain; +@@ -79,7 +103,7 @@ static int stx104_read_raw(struct iio_dev *indio_dev, + switch (mask) { + case IIO_CHAN_INFO_HARDWAREGAIN: + /* get gain configuration */ +- adc_config = ioread8(priv->base + 11); ++ adc_config = ioread8(®->acfg); + gain = adc_config & 0x3; + + *val = 1 << gain; +@@ -91,24 +115,26 @@ static int stx104_read_raw(struct iio_dev *indio_dev, + } + + /* select ADC channel */ +- iowrite8(chan->channel | (chan->channel << 4), priv->base + 2); ++ iowrite8(chan->channel | (chan->channel << 4), ®->achan); + +- /* trigger ADC sample capture and wait for completion */ +- iowrite8(0, priv->base); +- while (ioread8(priv->base + 8) & BIT(7)); ++ /* trigger ADC sample capture by writing to the 8-bit ++ * Software Strobe Register and wait for completion ++ */ ++ iowrite8(0, ®->ssr_ad); ++ while (ioread8(®->cir_asr) & BIT(7)); + +- *val = ioread16(priv->base); ++ *val = ioread16(®->ssr_ad); + return IIO_VAL_INT; + case IIO_CHAN_INFO_OFFSET: + /* get ADC bipolar/unipolar configuration */ +- adc_config = ioread8(priv->base + 11); ++ adc_config = ioread8(®->acfg); + adbu = !(adc_config & BIT(2)); + + *val = -32768 * adbu; + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: + /* get ADC bipolar/unipolar and gain configuration */ +- adc_config = ioread8(priv->base + 11); ++ adc_config = ioread8(®->acfg); + adbu = !(adc_config & BIT(2)); + gain = adc_config & 0x3; + +@@ -130,16 +156,16 @@ static int stx104_write_raw(struct iio_dev *indio_dev, + /* Only four gain states (x1, x2, x4, x8) */ + switch (val) { + case 1: +- iowrite8(0, priv->base + 11); ++ iowrite8(0, &priv->reg->acfg); + break; + case 2: +- iowrite8(1, priv->base + 11); ++ iowrite8(1, &priv->reg->acfg); + break; + case 4: +- iowrite8(2, priv->base + 11); ++ iowrite8(2, &priv->reg->acfg); + break; + case 8: +- iowrite8(3, priv->base + 11); ++ iowrite8(3, &priv->reg->acfg); + break; + default: + return -EINVAL; +@@ -153,7 +179,7 @@ static int stx104_write_raw(struct iio_dev *indio_dev, + return -EINVAL; + + priv->chan_out_states[chan->channel] = val; +- iowrite16(val, priv->base + 4 + 2 * chan->channel); ++ iowrite16(val, &priv->reg->dac[chan->channel]); + + return 0; + } +@@ -307,15 +333,15 @@ static int stx104_probe(struct device *dev, unsigned int id) + } + + priv = iio_priv(indio_dev); +- priv->base = devm_ioport_map(dev, base[id], STX104_EXTENT); +- if (!priv->base) ++ priv->reg = devm_ioport_map(dev, base[id], STX104_EXTENT); ++ if (!priv->reg) + return -ENOMEM; + + indio_dev->info = &stx104_info; + indio_dev->modes = INDIO_DIRECT_MODE; + + /* determine if differential inputs */ +- if (ioread8(priv->base + 8) & BIT(5)) { ++ if (ioread8(&priv->reg->cir_asr) & BIT(5)) { + indio_dev->num_channels = ARRAY_SIZE(stx104_channels_diff); + indio_dev->channels = stx104_channels_diff; + } else { +@@ -327,14 +353,14 @@ static int stx104_probe(struct device *dev, unsigned int id) + indio_dev->dev.parent = dev; + + /* configure device for software trigger operation */ +- iowrite8(0, priv->base + 9); ++ iowrite8(0, &priv->reg->acr); + + /* initialize gain setting to x1 */ +- iowrite8(0, priv->base + 11); ++ iowrite8(0, &priv->reg->acfg); + + /* initialize DAC output to 0V */ +- iowrite16(0, priv->base + 4); +- iowrite16(0, priv->base + 6); ++ iowrite16(0, &priv->reg->dac[0]); ++ iowrite16(0, &priv->reg->dac[1]); + + stx104gpio->chip.label = dev_name(dev); + stx104gpio->chip.parent = dev; +@@ -349,7 +375,7 @@ static int stx104_probe(struct device *dev, unsigned int id) + stx104gpio->chip.get_multiple = stx104_gpio_get_multiple; + stx104gpio->chip.set = stx104_gpio_set; + stx104gpio->chip.set_multiple = stx104_gpio_set_multiple; +- stx104gpio->base = priv->base + 3; ++ stx104gpio->base = &priv->reg->dio; + stx104gpio->out_state = 0x0; + + spin_lock_init(&stx104gpio->lock); +-- +2.40.1 + diff --git a/queue-5.4/iio-adc-stx104-utilize-iomap-interface.patch b/queue-5.4/iio-adc-stx104-utilize-iomap-interface.patch new file mode 100644 index 00000000000..1c3bbfaf53d --- /dev/null +++ b/queue-5.4/iio-adc-stx104-utilize-iomap-interface.patch @@ -0,0 +1,206 @@ +From 65b44d985b1d1dfae12c652da27e13138e451131 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 13:30:59 -0400 +Subject: iio: adc: stx104: Utilize iomap interface + +From: William Breathitt Gray + +[ Upstream commit 73b8390cc27e096ab157be261ccc4eaaa6db87af ] + +This driver doesn't need to access I/O ports directly via inb()/outb() +and friends. This patch abstracts such access by calling ioport_map() +to enable the use of more typical ioread8()/iowrite8() I/O memory +accessor calls. + +Suggested-by: David Laight +Signed-off-by: William Breathitt Gray +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/64673797df382c52fc32fce24348b25a0b05e73a.1652201921.git.william.gray@linaro.org +Signed-off-by: Jonathan Cameron +Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital") +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/stx104.c | 56 +++++++++++++++++++++------------------- + 1 file changed, 29 insertions(+), 27 deletions(-) + +diff --git a/drivers/iio/adc/stx104.c b/drivers/iio/adc/stx104.c +index f87bbc711ccc0..112362f7d3943 100644 +--- a/drivers/iio/adc/stx104.c ++++ b/drivers/iio/adc/stx104.c +@@ -51,7 +51,7 @@ MODULE_PARM_DESC(base, "Apex Embedded Systems STX104 base addresses"); + */ + struct stx104_iio { + unsigned int chan_out_states[STX104_NUM_OUT_CHAN]; +- unsigned int base; ++ void __iomem *base; + }; + + /** +@@ -64,7 +64,7 @@ struct stx104_iio { + struct stx104_gpio { + struct gpio_chip chip; + spinlock_t lock; +- unsigned int base; ++ void __iomem *base; + unsigned int out_state; + }; + +@@ -79,7 +79,7 @@ static int stx104_read_raw(struct iio_dev *indio_dev, + switch (mask) { + case IIO_CHAN_INFO_HARDWAREGAIN: + /* get gain configuration */ +- adc_config = inb(priv->base + 11); ++ adc_config = ioread8(priv->base + 11); + gain = adc_config & 0x3; + + *val = 1 << gain; +@@ -91,24 +91,24 @@ static int stx104_read_raw(struct iio_dev *indio_dev, + } + + /* select ADC channel */ +- outb(chan->channel | (chan->channel << 4), priv->base + 2); ++ iowrite8(chan->channel | (chan->channel << 4), priv->base + 2); + + /* trigger ADC sample capture and wait for completion */ +- outb(0, priv->base); +- while (inb(priv->base + 8) & BIT(7)); ++ iowrite8(0, priv->base); ++ while (ioread8(priv->base + 8) & BIT(7)); + +- *val = inw(priv->base); ++ *val = ioread16(priv->base); + return IIO_VAL_INT; + case IIO_CHAN_INFO_OFFSET: + /* get ADC bipolar/unipolar configuration */ +- adc_config = inb(priv->base + 11); ++ adc_config = ioread8(priv->base + 11); + adbu = !(adc_config & BIT(2)); + + *val = -32768 * adbu; + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: + /* get ADC bipolar/unipolar and gain configuration */ +- adc_config = inb(priv->base + 11); ++ adc_config = ioread8(priv->base + 11); + adbu = !(adc_config & BIT(2)); + gain = adc_config & 0x3; + +@@ -130,16 +130,16 @@ static int stx104_write_raw(struct iio_dev *indio_dev, + /* Only four gain states (x1, x2, x4, x8) */ + switch (val) { + case 1: +- outb(0, priv->base + 11); ++ iowrite8(0, priv->base + 11); + break; + case 2: +- outb(1, priv->base + 11); ++ iowrite8(1, priv->base + 11); + break; + case 4: +- outb(2, priv->base + 11); ++ iowrite8(2, priv->base + 11); + break; + case 8: +- outb(3, priv->base + 11); ++ iowrite8(3, priv->base + 11); + break; + default: + return -EINVAL; +@@ -153,7 +153,7 @@ static int stx104_write_raw(struct iio_dev *indio_dev, + return -EINVAL; + + priv->chan_out_states[chan->channel] = val; +- outw(val, priv->base + 4 + 2 * chan->channel); ++ iowrite16(val, priv->base + 4 + 2 * chan->channel); + + return 0; + } +@@ -222,7 +222,7 @@ static int stx104_gpio_get(struct gpio_chip *chip, unsigned int offset) + if (offset >= 4) + return -EINVAL; + +- return !!(inb(stx104gpio->base) & BIT(offset)); ++ return !!(ioread8(stx104gpio->base) & BIT(offset)); + } + + static int stx104_gpio_get_multiple(struct gpio_chip *chip, unsigned long *mask, +@@ -230,7 +230,7 @@ static int stx104_gpio_get_multiple(struct gpio_chip *chip, unsigned long *mask, + { + struct stx104_gpio *const stx104gpio = gpiochip_get_data(chip); + +- *bits = inb(stx104gpio->base); ++ *bits = ioread8(stx104gpio->base); + + return 0; + } +@@ -252,7 +252,7 @@ static void stx104_gpio_set(struct gpio_chip *chip, unsigned int offset, + else + stx104gpio->out_state &= ~mask; + +- outb(stx104gpio->out_state, stx104gpio->base); ++ iowrite8(stx104gpio->out_state, stx104gpio->base); + + spin_unlock_irqrestore(&stx104gpio->lock, flags); + } +@@ -279,7 +279,7 @@ static void stx104_gpio_set_multiple(struct gpio_chip *chip, + + stx104gpio->out_state &= ~*mask; + stx104gpio->out_state |= *mask & *bits; +- outb(stx104gpio->out_state, stx104gpio->base); ++ iowrite8(stx104gpio->out_state, stx104gpio->base); + + spin_unlock_irqrestore(&stx104gpio->lock, flags); + } +@@ -306,11 +306,16 @@ static int stx104_probe(struct device *dev, unsigned int id) + return -EBUSY; + } + ++ priv = iio_priv(indio_dev); ++ priv->base = devm_ioport_map(dev, base[id], STX104_EXTENT); ++ if (!priv->base) ++ return -ENOMEM; ++ + indio_dev->info = &stx104_info; + indio_dev->modes = INDIO_DIRECT_MODE; + + /* determine if differential inputs */ +- if (inb(base[id] + 8) & BIT(5)) { ++ if (ioread8(priv->base + 8) & BIT(5)) { + indio_dev->num_channels = ARRAY_SIZE(stx104_channels_diff); + indio_dev->channels = stx104_channels_diff; + } else { +@@ -321,18 +326,15 @@ static int stx104_probe(struct device *dev, unsigned int id) + indio_dev->name = dev_name(dev); + indio_dev->dev.parent = dev; + +- priv = iio_priv(indio_dev); +- priv->base = base[id]; +- + /* configure device for software trigger operation */ +- outb(0, base[id] + 9); ++ iowrite8(0, priv->base + 9); + + /* initialize gain setting to x1 */ +- outb(0, base[id] + 11); ++ iowrite8(0, priv->base + 11); + + /* initialize DAC output to 0V */ +- outw(0, base[id] + 4); +- outw(0, base[id] + 6); ++ iowrite16(0, priv->base + 4); ++ iowrite16(0, priv->base + 6); + + stx104gpio->chip.label = dev_name(dev); + stx104gpio->chip.parent = dev; +@@ -347,7 +349,7 @@ static int stx104_probe(struct device *dev, unsigned int id) + stx104gpio->chip.get_multiple = stx104_gpio_get_multiple; + stx104gpio->chip.set = stx104_gpio_set; + stx104gpio->chip.set_multiple = stx104_gpio_set_multiple; +- stx104gpio->base = base[id] + 3; ++ stx104gpio->base = priv->base + 3; + stx104gpio->out_state = 0x0; + + spin_lock_init(&stx104gpio->lock); +-- +2.40.1 + diff --git a/queue-5.4/iio-add-addac-subdirectory.patch b/queue-5.4/iio-add-addac-subdirectory.patch new file mode 100644 index 00000000000..cf7c332c1d5 --- /dev/null +++ b/queue-5.4/iio-add-addac-subdirectory.patch @@ -0,0 +1,78 @@ +From b51f43afde3bd356795e437e7c734c4b0c1846e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Dec 2021 13:40:43 +0200 +Subject: iio: add addac subdirectory + +From: Cosmin Tanislav + +[ Upstream commit b62e2e1763cda3a6c494ed754317f19be1249297 ] + +For IIO devices that expose both ADC and DAC functionality. + +Signed-off-by: Cosmin Tanislav +Link: https://lore.kernel.org/r/20211205114045.173612-2-cosmin.tanislav@analog.com +Signed-off-by: Jonathan Cameron +Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital") +Signed-off-by: Sasha Levin +--- + drivers/iio/Kconfig | 1 + + drivers/iio/Makefile | 1 + + drivers/iio/addac/Kconfig | 8 ++++++++ + drivers/iio/addac/Makefile | 6 ++++++ + 4 files changed, 16 insertions(+) + create mode 100644 drivers/iio/addac/Kconfig + create mode 100644 drivers/iio/addac/Makefile + +diff --git a/drivers/iio/Kconfig b/drivers/iio/Kconfig +index 5bd51853b15ec..3c0da322ece74 100644 +--- a/drivers/iio/Kconfig ++++ b/drivers/iio/Kconfig +@@ -70,6 +70,7 @@ config IIO_TRIGGERED_EVENT + + source "drivers/iio/accel/Kconfig" + source "drivers/iio/adc/Kconfig" ++source "drivers/iio/addac/Kconfig" + source "drivers/iio/afe/Kconfig" + source "drivers/iio/amplifiers/Kconfig" + source "drivers/iio/chemical/Kconfig" +diff --git a/drivers/iio/Makefile b/drivers/iio/Makefile +index bff682ad1cfbb..96fd43b2ef7c1 100644 +--- a/drivers/iio/Makefile ++++ b/drivers/iio/Makefile +@@ -15,6 +15,7 @@ obj-$(CONFIG_IIO_TRIGGERED_EVENT) += industrialio-triggered-event.o + + obj-y += accel/ + obj-y += adc/ ++obj-y += addac/ + obj-y += afe/ + obj-y += amplifiers/ + obj-y += buffer/ +diff --git a/drivers/iio/addac/Kconfig b/drivers/iio/addac/Kconfig +new file mode 100644 +index 0000000000000..2e64d7755d5ea +--- /dev/null ++++ b/drivers/iio/addac/Kconfig +@@ -0,0 +1,8 @@ ++# ++# ADC DAC drivers ++# ++# When adding new entries keep the list in alphabetical order ++ ++menu "Analog to digital and digital to analog converters" ++ ++endmenu +diff --git a/drivers/iio/addac/Makefile b/drivers/iio/addac/Makefile +new file mode 100644 +index 0000000000000..b888b9ee12da0 +--- /dev/null ++++ b/drivers/iio/addac/Makefile +@@ -0,0 +1,6 @@ ++# SPDX-License-Identifier: GPL-2.0 ++# ++# Makefile for industrial I/O ADDAC drivers ++# ++ ++# When adding new entries keep the list in alphabetical order +-- +2.40.1 + diff --git a/queue-5.4/iio-addac-stx104-fix-race-condition-for-stx104_write.patch b/queue-5.4/iio-addac-stx104-fix-race-condition-for-stx104_write.patch new file mode 100644 index 00000000000..567018c29fd --- /dev/null +++ b/queue-5.4/iio-addac-stx104-fix-race-condition-for-stx104_write.patch @@ -0,0 +1,74 @@ +From 9683956c9a32ccbb79eabc5800b501c37e26820e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 10:40:10 -0400 +Subject: iio: addac: stx104: Fix race condition for stx104_write_raw() + +From: William Breathitt Gray + +[ Upstream commit 9740827468cea80c42db29e7171a50e99acf7328 ] + +The priv->chan_out_states array and actual DAC value can become +mismatched if stx104_write_raw() is called concurrently. Prevent such a +race condition by utilizing a mutex. + +Fixes: 97a445dad37a ("iio: Add IIO support for the DAC on the Apex Embedded Systems STX104") +Signed-off-by: William Breathitt Gray +Link: https://lore.kernel.org/r/c95c9a77fcef36b2a052282146950f23bbc1ebdc.1680790580.git.william.gray@linaro.org +Cc: +Signed-off-by: Jonathan Cameron +Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital") +Signed-off-by: Sasha Levin +--- + drivers/iio/addac/stx104.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/iio/addac/stx104.c b/drivers/iio/addac/stx104.c +index 6712da1b818c9..29c47c33c7dcd 100644 +--- a/drivers/iio/addac/stx104.c ++++ b/drivers/iio/addac/stx104.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -69,10 +70,12 @@ struct stx104_reg { + + /** + * struct stx104_iio - IIO device private data structure ++ * @lock: synchronization lock to prevent I/O race conditions + * @chan_out_states: channels' output states + * @reg: I/O address offset for the device registers + */ + struct stx104_iio { ++ struct mutex lock; + unsigned int chan_out_states[STX104_NUM_OUT_CHAN]; + struct stx104_reg __iomem *reg; + }; +@@ -178,9 +181,12 @@ static int stx104_write_raw(struct iio_dev *indio_dev, + if ((unsigned int)val > 65535) + return -EINVAL; + ++ mutex_lock(&priv->lock); ++ + priv->chan_out_states[chan->channel] = val; + iowrite16(val, &priv->reg->dac[chan->channel]); + ++ mutex_unlock(&priv->lock); + return 0; + } + return -EINVAL; +@@ -352,6 +358,8 @@ static int stx104_probe(struct device *dev, unsigned int id) + indio_dev->name = dev_name(dev); + indio_dev->dev.parent = dev; + ++ mutex_init(&priv->lock); ++ + /* configure device for software trigger operation */ + iowrite8(0, &priv->reg->acr); + +-- +2.40.1 + diff --git a/queue-5.4/iio-addac-stx104-fix-race-condition-when-converting-.patch b/queue-5.4/iio-addac-stx104-fix-race-condition-when-converting-.patch new file mode 100644 index 00000000000..fb6b2a1ca14 --- /dev/null +++ b/queue-5.4/iio-addac-stx104-fix-race-condition-when-converting-.patch @@ -0,0 +1,50 @@ +From 9bb1f57c379e71e144237743bc34f42ad07e1ba9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 10:40:11 -0400 +Subject: iio: addac: stx104: Fix race condition when converting + analog-to-digital + +From: William Breathitt Gray + +[ Upstream commit 4f9b80aefb9e2f542a49d9ec087cf5919730e1dd ] + +The ADC conversion procedure requires several device I/O operations +performed in a particular sequence. If stx104_read_raw() is called +concurrently, the ADC conversion procedure could be clobbered. Prevent +such a race condition by utilizing a mutex. + +Fixes: 4075a283ae83 ("iio: stx104: Add IIO support for the ADC channels") +Signed-off-by: William Breathitt Gray +Link: https://lore.kernel.org/r/2ae5e40eed5006ca735e4c12181a9ff5ced65547.1680790580.git.william.gray@linaro.org +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/addac/stx104.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/iio/addac/stx104.c b/drivers/iio/addac/stx104.c +index 29c47c33c7dcd..8237ae4263cbe 100644 +--- a/drivers/iio/addac/stx104.c ++++ b/drivers/iio/addac/stx104.c +@@ -117,6 +117,8 @@ static int stx104_read_raw(struct iio_dev *indio_dev, + return IIO_VAL_INT; + } + ++ mutex_lock(&priv->lock); ++ + /* select ADC channel */ + iowrite8(chan->channel | (chan->channel << 4), ®->achan); + +@@ -127,6 +129,8 @@ static int stx104_read_raw(struct iio_dev *indio_dev, + while (ioread8(®->cir_asr) & BIT(7)); + + *val = ioread16(®->ssr_ad); ++ ++ mutex_unlock(&priv->lock); + return IIO_VAL_INT; + case IIO_CHAN_INFO_OFFSET: + /* get ADC bipolar/unipolar configuration */ +-- +2.40.1 + diff --git a/queue-5.4/iio-stx104-move-to-addac-subdirectory.patch b/queue-5.4/iio-stx104-move-to-addac-subdirectory.patch new file mode 100644 index 00000000000..350ea883d29 --- /dev/null +++ b/queue-5.4/iio-stx104-move-to-addac-subdirectory.patch @@ -0,0 +1,119 @@ +From df68e377c186fc8b743d3a24febb9d249ce380e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Aug 2022 18:29:21 -0400 +Subject: iio: stx104: Move to addac subdirectory + +From: William Breathitt Gray + +[ Upstream commit 955c2aa9cff2dd07ff798ca8c883398731687972 ] + +The stx104 driver supports both ADC and DAC functionality. + +Signed-off-by: William Breathitt Gray +Link: https://lore.kernel.org/r/20220815222921.138945-1-william.gray@linaro.org +Signed-off-by: Jonathan Cameron +Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital") +Signed-off-by: Sasha Levin +--- + MAINTAINERS | 2 +- + drivers/iio/adc/Kconfig | 16 ---------------- + drivers/iio/adc/Makefile | 1 - + drivers/iio/addac/Kconfig | 16 ++++++++++++++++ + drivers/iio/addac/Makefile | 1 + + drivers/iio/{adc => addac}/stx104.c | 0 + 6 files changed, 18 insertions(+), 18 deletions(-) + rename drivers/iio/{adc => addac}/stx104.c (100%) + +diff --git a/MAINTAINERS b/MAINTAINERS +index 34d3497f11772..2040c2f76dcf7 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -1101,7 +1101,7 @@ APEX EMBEDDED SYSTEMS STX104 IIO DRIVER + M: William Breathitt Gray + L: linux-iio@vger.kernel.org + S: Maintained +-F: drivers/iio/adc/stx104.c ++F: drivers/iio/addac/stx104.c + + APM DRIVER + M: Jiri Kosina +diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig +index cb57880842991..b39d5ad157449 100644 +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -840,22 +840,6 @@ config STMPE_ADC + Say yes here to build support for ST Microelectronics STMPE + built-in ADC block (stmpe811). + +-config STX104 +- tristate "Apex Embedded Systems STX104 driver" +- depends on PC104 && X86 +- select ISA_BUS_API +- select GPIOLIB +- help +- Say yes here to build support for the Apex Embedded Systems STX104 +- integrated analog PC/104 card. +- +- This driver supports the 16 channels of single-ended (8 channels of +- differential) analog inputs, 2 channels of analog output, 4 digital +- inputs, and 4 digital outputs provided by the STX104. +- +- The base port addresses for the devices may be configured via the base +- array module parameter. +- + config SUN4I_GPADC + tristate "Support for the Allwinner SoCs GPADC" + depends on IIO +diff --git a/drivers/iio/adc/Makefile b/drivers/iio/adc/Makefile +index ef9cc485fb674..d0b11502102ed 100644 +--- a/drivers/iio/adc/Makefile ++++ b/drivers/iio/adc/Makefile +@@ -72,7 +72,6 @@ obj-$(CONFIG_RCAR_GYRO_ADC) += rcar-gyroadc.o + obj-$(CONFIG_ROCKCHIP_SARADC) += rockchip_saradc.o + obj-$(CONFIG_SC27XX_ADC) += sc27xx_adc.o + obj-$(CONFIG_SPEAR_ADC) += spear_adc.o +-obj-$(CONFIG_STX104) += stx104.o + obj-$(CONFIG_SUN4I_GPADC) += sun4i-gpadc-iio.o + obj-$(CONFIG_STM32_ADC_CORE) += stm32-adc-core.o + obj-$(CONFIG_STM32_ADC) += stm32-adc.o +diff --git a/drivers/iio/addac/Kconfig b/drivers/iio/addac/Kconfig +index 2e64d7755d5ea..1f598670e84fb 100644 +--- a/drivers/iio/addac/Kconfig ++++ b/drivers/iio/addac/Kconfig +@@ -5,4 +5,20 @@ + + menu "Analog to digital and digital to analog converters" + ++config STX104 ++ tristate "Apex Embedded Systems STX104 driver" ++ depends on PC104 && X86 ++ select ISA_BUS_API ++ select GPIOLIB ++ help ++ Say yes here to build support for the Apex Embedded Systems STX104 ++ integrated analog PC/104 card. ++ ++ This driver supports the 16 channels of single-ended (8 channels of ++ differential) analog inputs, 2 channels of analog output, 4 digital ++ inputs, and 4 digital outputs provided by the STX104. ++ ++ The base port addresses for the devices may be configured via the base ++ array module parameter. ++ + endmenu +diff --git a/drivers/iio/addac/Makefile b/drivers/iio/addac/Makefile +index b888b9ee12da0..8629145233544 100644 +--- a/drivers/iio/addac/Makefile ++++ b/drivers/iio/addac/Makefile +@@ -4,3 +4,4 @@ + # + + # When adding new entries keep the list in alphabetical order ++obj-$(CONFIG_STX104) += stx104.o +diff --git a/drivers/iio/adc/stx104.c b/drivers/iio/addac/stx104.c +similarity index 100% +rename from drivers/iio/adc/stx104.c +rename to drivers/iio/addac/stx104.c +-- +2.40.1 + diff --git a/queue-5.4/ima-allow-fix-uml-builds.patch b/queue-5.4/ima-allow-fix-uml-builds.patch new file mode 100644 index 00000000000..0416dfc064b --- /dev/null +++ b/queue-5.4/ima-allow-fix-uml-builds.patch @@ -0,0 +1,56 @@ +From ab7e4fe5cea6ae0b7cb2237a1aeef1f2938ceda0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 19:27:03 -0800 +Subject: IMA: allow/fix UML builds + +From: Randy Dunlap + +[ Upstream commit 644f17412f5acf01a19af9d04a921937a2bc86c6 ] + +UML supports HAS_IOMEM since 0bbadafdc49d (um: allow disabling +NO_IOMEM). + +Current IMA build on UML fails on allmodconfig (with TCG_TPM=m): + +ld: security/integrity/ima/ima_queue.o: in function `ima_add_template_entry': +ima_queue.c:(.text+0x2d9): undefined reference to `tpm_pcr_extend' +ld: security/integrity/ima/ima_init.o: in function `ima_init': +ima_init.c:(.init.text+0x43f): undefined reference to `tpm_default_chip' +ld: security/integrity/ima/ima_crypto.o: in function `ima_calc_boot_aggregate_tfm': +ima_crypto.c:(.text+0x1044): undefined reference to `tpm_pcr_read' +ld: ima_crypto.c:(.text+0x10d8): undefined reference to `tpm_pcr_read' + +Modify the IMA Kconfig entry so that it selects TCG_TPM if HAS_IOMEM +is set, regardless of the UML Kconfig setting. +This updates TCG_TPM from =m to =y and fixes the linker errors. + +Fixes: f4a0391dfa91 ("ima: fix Kconfig dependencies") +Cc: Stable # v5.14+ +Signed-off-by: Randy Dunlap +Cc: Fabio Estevam +Cc: Richard Weinberger +Cc: Anton Ivanov +Cc: Johannes Berg +Cc: linux-um@lists.infradead.org +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig +index 44b3315f32352..d90ead61f0def 100644 +--- a/security/integrity/ima/Kconfig ++++ b/security/integrity/ima/Kconfig +@@ -8,7 +8,7 @@ config IMA + select CRYPTO_HMAC + select CRYPTO_SHA1 + select CRYPTO_HASH_INFO +- select TCG_TPM if HAS_IOMEM && !UML ++ select TCG_TPM if HAS_IOMEM + select TCG_TIS if TCG_TPM && X86 + select TCG_CRB if TCG_TPM && ACPI + select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES +-- +2.40.1 + diff --git a/queue-5.4/interconnect-add-helpers-for-enabling-disabling-a-pa.patch b/queue-5.4/interconnect-add-helpers-for-enabling-disabling-a-pa.patch new file mode 100644 index 00000000000..18a7f5af94a --- /dev/null +++ b/queue-5.4/interconnect-add-helpers-for-enabling-disabling-a-pa.patch @@ -0,0 +1,152 @@ +From d3314adfdf1ba56ea5bcaa3fa1382bfa8e556604 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 May 2020 18:30:37 +0300 +Subject: interconnect: Add helpers for enabling/disabling a path + +From: Georgi Djakov + +[ Upstream commit 7d374b20908338c9fbb03ea8022a11f3b3e0e55f ] + +There is a repeated pattern in multiple drivers where they want to switch +the bandwidth between zero and some other value. This is happening often +in the suspend/resume callbacks. Let's add helper functions to enable and +disable the path, so that callers don't have to take care of remembering +the bandwidth values and handle this in the framework instead. + +With this patch the users can call icc_disable() and icc_enable() to lower +their bandwidth request to zero and then restore it back to it's previous +value. + +Suggested-by: Evan Green +Suggested-by: Bjorn Andersson +Signed-off-by: Georgi Djakov +Reviewed-by: Matthias Kaehlcke +Link: https://lore.kernel.org/r/20200507120846.8354-1-georgi.djakov@linaro.org +Signed-off-by: Georgi Djakov +Stable-dep-of: d2d69354226d ("USB: dwc3: qcom: fix NULL-deref on suspend") +Signed-off-by: Sasha Levin +--- + drivers/interconnect/core.c | 39 ++++++++++++++++++++++++++++++++- + drivers/interconnect/internal.h | 2 ++ + include/linux/interconnect.h | 12 ++++++++++ + 3 files changed, 52 insertions(+), 1 deletion(-) + +diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c +index 25dd8a19139a7..112298100d370 100644 +--- a/drivers/interconnect/core.c ++++ b/drivers/interconnect/core.c +@@ -91,6 +91,7 @@ static struct icc_path *path_init(struct device *dev, struct icc_node *dst, + hlist_add_head(&path->reqs[i].req_node, &node->req_list); + path->reqs[i].node = node; + path->reqs[i].dev = dev; ++ path->reqs[i].enabled = true; + /* reference to previous node was saved during path traversal */ + node = node->reverse; + } +@@ -182,9 +183,12 @@ static int aggregate_requests(struct icc_node *node) + if (p->pre_aggregate) + p->pre_aggregate(node); + +- hlist_for_each_entry(r, &node->req_list, req_node) ++ hlist_for_each_entry(r, &node->req_list, req_node) { ++ if (!r->enabled) ++ continue; + p->aggregate(node, r->tag, r->avg_bw, r->peak_bw, + &node->avg_bw, &node->peak_bw); ++ } + + return 0; + } +@@ -449,6 +453,39 @@ int icc_set_bw(struct icc_path *path, u32 avg_bw, u32 peak_bw) + } + EXPORT_SYMBOL_GPL(icc_set_bw); + ++static int __icc_enable(struct icc_path *path, bool enable) ++{ ++ int i; ++ ++ if (!path) ++ return 0; ++ ++ if (WARN_ON(IS_ERR(path) || !path->num_nodes)) ++ return -EINVAL; ++ ++ mutex_lock(&icc_lock); ++ ++ for (i = 0; i < path->num_nodes; i++) ++ path->reqs[i].enabled = enable; ++ ++ mutex_unlock(&icc_lock); ++ ++ return icc_set_bw(path, path->reqs[0].avg_bw, ++ path->reqs[0].peak_bw); ++} ++ ++int icc_enable(struct icc_path *path) ++{ ++ return __icc_enable(path, true); ++} ++EXPORT_SYMBOL_GPL(icc_enable); ++ ++int icc_disable(struct icc_path *path) ++{ ++ return __icc_enable(path, false); ++} ++EXPORT_SYMBOL_GPL(icc_disable); ++ + /** + * icc_get() - return a handle for path between two endpoints + * @dev: the device requesting the path +diff --git a/drivers/interconnect/internal.h b/drivers/interconnect/internal.h +index 5853e8faf223a..5c923c444f444 100644 +--- a/drivers/interconnect/internal.h ++++ b/drivers/interconnect/internal.h +@@ -14,6 +14,7 @@ + * @req_node: entry in list of requests for the particular @node + * @node: the interconnect node to which this constraint applies + * @dev: reference to the device that sets the constraints ++ * @enabled: indicates whether the path with this request is enabled + * @tag: path tag (optional) + * @avg_bw: an integer describing the average bandwidth in kBps + * @peak_bw: an integer describing the peak bandwidth in kBps +@@ -22,6 +23,7 @@ struct icc_req { + struct hlist_node req_node; + struct icc_node *node; + struct device *dev; ++ bool enabled; + u32 tag; + u32 avg_bw; + u32 peak_bw; +diff --git a/include/linux/interconnect.h b/include/linux/interconnect.h +index d70a914cba118..1e0dd0541b1ed 100644 +--- a/include/linux/interconnect.h ++++ b/include/linux/interconnect.h +@@ -29,6 +29,8 @@ struct icc_path *icc_get(struct device *dev, const int src_id, + const int dst_id); + struct icc_path *of_icc_get(struct device *dev, const char *name); + void icc_put(struct icc_path *path); ++int icc_enable(struct icc_path *path); ++int icc_disable(struct icc_path *path); + int icc_set_bw(struct icc_path *path, u32 avg_bw, u32 peak_bw); + void icc_set_tag(struct icc_path *path, u32 tag); + +@@ -50,6 +52,16 @@ static inline void icc_put(struct icc_path *path) + { + } + ++static inline int icc_enable(struct icc_path *path) ++{ ++ return 0; ++} ++ ++static inline int icc_disable(struct icc_path *path) ++{ ++ return 0; ++} ++ + static inline int icc_set_bw(struct icc_path *path, u32 avg_bw, u32 peak_bw) + { + return 0; +-- +2.40.1 + diff --git a/queue-5.4/interconnect-move-internal-structs-into-a-separate-f.patch b/queue-5.4/interconnect-move-internal-structs-into-a-separate-f.patch new file mode 100644 index 00000000000..889501b7cac --- /dev/null +++ b/queue-5.4/interconnect-move-internal-structs-into-a-separate-f.patch @@ -0,0 +1,118 @@ +From 2d393a6027de90fcafa75bfc044cfef16f8c1a5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2019 16:18:16 +0200 +Subject: interconnect: Move internal structs into a separate file + +From: Georgi Djakov + +[ Upstream commit dd018a9cf9108f9c7d924f6fe09aed745e78a67e ] + +Move the interconnect framework internal structs into a separate file, +so that it can be included and used by ftrace code. This will allow us +to expose some more useful information in the traces. + +Reviewed-by: Bjorn Andersson +Signed-off-by: Georgi Djakov +Stable-dep-of: d2d69354226d ("USB: dwc3: qcom: fix NULL-deref on suspend") +Signed-off-by: Sasha Levin +--- + drivers/interconnect/core.c | 30 ++----------------------- + drivers/interconnect/internal.h | 40 +++++++++++++++++++++++++++++++++ + 2 files changed, 42 insertions(+), 28 deletions(-) + create mode 100644 drivers/interconnect/internal.h + +diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c +index e63c48a1602fd..25dd8a19139a7 100644 +--- a/drivers/interconnect/core.c ++++ b/drivers/interconnect/core.c +@@ -19,39 +19,13 @@ + #include + #include + ++#include "internal.h" ++ + static DEFINE_IDR(icc_idr); + static LIST_HEAD(icc_providers); + static DEFINE_MUTEX(icc_lock); + static struct dentry *icc_debugfs_dir; + +-/** +- * struct icc_req - constraints that are attached to each node +- * @req_node: entry in list of requests for the particular @node +- * @node: the interconnect node to which this constraint applies +- * @dev: reference to the device that sets the constraints +- * @tag: path tag (optional) +- * @avg_bw: an integer describing the average bandwidth in kBps +- * @peak_bw: an integer describing the peak bandwidth in kBps +- */ +-struct icc_req { +- struct hlist_node req_node; +- struct icc_node *node; +- struct device *dev; +- u32 tag; +- u32 avg_bw; +- u32 peak_bw; +-}; +- +-/** +- * struct icc_path - interconnect path structure +- * @num_nodes: number of hops (nodes) +- * @reqs: array of the requests applicable to this path of nodes +- */ +-struct icc_path { +- size_t num_nodes; +- struct icc_req reqs[]; +-}; +- + static void icc_summary_show_one(struct seq_file *s, struct icc_node *n) + { + if (!n) +diff --git a/drivers/interconnect/internal.h b/drivers/interconnect/internal.h +new file mode 100644 +index 0000000000000..5853e8faf223a +--- /dev/null ++++ b/drivers/interconnect/internal.h +@@ -0,0 +1,40 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++/* ++ * Interconnect framework internal structs ++ * ++ * Copyright (c) 2019, Linaro Ltd. ++ * Author: Georgi Djakov ++ */ ++ ++#ifndef __DRIVERS_INTERCONNECT_INTERNAL_H ++#define __DRIVERS_INTERCONNECT_INTERNAL_H ++ ++/** ++ * struct icc_req - constraints that are attached to each node ++ * @req_node: entry in list of requests for the particular @node ++ * @node: the interconnect node to which this constraint applies ++ * @dev: reference to the device that sets the constraints ++ * @tag: path tag (optional) ++ * @avg_bw: an integer describing the average bandwidth in kBps ++ * @peak_bw: an integer describing the peak bandwidth in kBps ++ */ ++struct icc_req { ++ struct hlist_node req_node; ++ struct icc_node *node; ++ struct device *dev; ++ u32 tag; ++ u32 avg_bw; ++ u32 peak_bw; ++}; ++ ++/** ++ * struct icc_path - interconnect path structure ++ * @num_nodes: number of hops (nodes) ++ * @reqs: array of the requests applicable to this path of nodes ++ */ ++struct icc_path { ++ size_t num_nodes; ++ struct icc_req reqs[]; ++}; ++ ++#endif +-- +2.40.1 + diff --git a/queue-5.4/iommu-amd-fix-guest-virtual-apic-table-root-pointer-.patch b/queue-5.4/iommu-amd-fix-guest-virtual-apic-table-root-pointer-.patch new file mode 100644 index 00000000000..bae0a71f4b8 --- /dev/null +++ b/queue-5.4/iommu-amd-fix-guest-virtual-apic-table-root-pointer-.patch @@ -0,0 +1,56 @@ +From 1a9772efcfcc7911fd0d949659d563673d6071ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 13:03:17 +0000 +Subject: iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration + in IRTE + +From: Kishon Vijay Abraham I + +[ Upstream commit ccc62b827775915a9b82db42a29813d04f92df7a ] + +commit b9c6ff94e43a ("iommu/amd: Re-factor guest virtual APIC +(de-)activation code") while refactoring guest virtual APIC +activation/de-activation code, stored information for activate/de-activate +in "struct amd_ir_data". It used 32-bit integer data type for storing the +"Guest Virtual APIC Table Root Pointer" (ga_root_ptr), though the +"ga_root_ptr" is actually a 40-bit field in IRTE (Interrupt Remapping +Table Entry). + +This causes interrupts from PCIe devices to not reach the guest in the case +of PCIe passthrough with SME (Secure Memory Encryption) enabled as _SME_ +bit in the "ga_root_ptr" is lost before writing it to the IRTE. + +Fix it by using 64-bit data type for storing the "ga_root_ptr". While at +that also change the data type of "ga_tag" to u32 in order to match +the IOMMU spec. + +Fixes: b9c6ff94e43a ("iommu/amd: Re-factor guest virtual APIC (de-)activation code") +Cc: stable@vger.kernel.org # v5.4+ +Reported-by: Alejandro Jimenez +Reviewed-by: Suravee Suthikulpanit +Signed-off-by: Kishon Vijay Abraham I +Link: https://lore.kernel.org/r/20230405130317.9351-1-kvijayab@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_types.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h +index 76e9d3e2f9f20..15eef44efd030 100644 +--- a/drivers/iommu/amd_iommu_types.h ++++ b/drivers/iommu/amd_iommu_types.h +@@ -886,8 +886,8 @@ struct amd_ir_data { + */ + struct irq_cfg *cfg; + int ga_vector; +- int ga_root_ptr; +- int ga_tag; ++ u64 ga_root_ptr; ++ u32 ga_tag; + }; + + struct amd_irte_ops { +-- +2.40.1 + diff --git a/queue-5.4/irqchip-mips-gic-get-rid-of-the-reliance-on-irq_cpu_.patch b/queue-5.4/irqchip-mips-gic-get-rid-of-the-reliance-on-irq_cpu_.patch new file mode 100644 index 00000000000..1f157ca9c81 --- /dev/null +++ b/queue-5.4/irqchip-mips-gic-get-rid-of-the-reliance-on-irq_cpu_.patch @@ -0,0 +1,102 @@ +From 73a0e52b087ffc98b8e1e9ff8d6a51157be7bf9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Oct 2021 18:04:13 +0100 +Subject: irqchip/mips-gic: Get rid of the reliance on irq_cpu_online() + +From: Marc Zyngier + +[ Upstream commit dd098a0e031928cf88c89f7577d31821e1f0e6de ] + +The MIPS GIC driver uses irq_cpu_online() to go and program the +per-CPU interrupts. However, this method iterates over all IRQs +in the system, despite only 3 per-CPU interrupts being of interest. + +Let's be terribly bold and do the iteration ourselves. To ensure +mutual exclusion, hold the gic_lock spinlock that is otherwise +taken while dealing with these interrupts. + +Signed-off-by: Marc Zyngier +Reviewed-by: Serge Semin +Reviewed-by: Florian Fainelli +Tested-by: Serge Semin +Link: https://lore.kernel.org/r/20211021170414.3341522-3-maz@kernel.org +Stable-dep-of: 3d6a0e4197c0 ("irqchip/mips-gic: Use raw spinlock for gic_lock") +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-mips-gic.c | 37 ++++++++++++++++++++++++---------- + 1 file changed, 26 insertions(+), 11 deletions(-) + +diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c +index f3985469c2211..6b8c3dd0f76f4 100644 +--- a/drivers/irqchip/irq-mips-gic.c ++++ b/drivers/irqchip/irq-mips-gic.c +@@ -380,24 +380,35 @@ static void gic_unmask_local_irq_all_vpes(struct irq_data *d) + spin_unlock_irqrestore(&gic_lock, flags); + } + +-static void gic_all_vpes_irq_cpu_online(struct irq_data *d) ++static void gic_all_vpes_irq_cpu_online(void) + { +- struct gic_all_vpes_chip_data *cd; +- unsigned int intr; ++ static const unsigned int local_intrs[] = { ++ GIC_LOCAL_INT_TIMER, ++ GIC_LOCAL_INT_PERFCTR, ++ GIC_LOCAL_INT_FDC, ++ }; ++ unsigned long flags; ++ int i; + +- intr = GIC_HWIRQ_TO_LOCAL(d->hwirq); +- cd = irq_data_get_irq_chip_data(d); ++ spin_lock_irqsave(&gic_lock, flags); + +- write_gic_vl_map(mips_gic_vx_map_reg(intr), cd->map); +- if (cd->mask) +- write_gic_vl_smask(BIT(intr)); ++ for (i = 0; i < ARRAY_SIZE(local_intrs); i++) { ++ unsigned int intr = local_intrs[i]; ++ struct gic_all_vpes_chip_data *cd; ++ ++ cd = &gic_all_vpes_chip_data[intr]; ++ write_gic_vl_map(mips_gic_vx_map_reg(intr), cd->map); ++ if (cd->mask) ++ write_gic_vl_smask(BIT(intr)); ++ } ++ ++ spin_unlock_irqrestore(&gic_lock, flags); + } + + static struct irq_chip gic_all_vpes_local_irq_controller = { + .name = "MIPS GIC Local", + .irq_mask = gic_mask_local_irq_all_vpes, + .irq_unmask = gic_unmask_local_irq_all_vpes, +- .irq_cpu_online = gic_all_vpes_irq_cpu_online, + }; + + static void __gic_irq_dispatch(void) +@@ -476,6 +487,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq, + intr = GIC_HWIRQ_TO_LOCAL(hwirq); + map = GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin; + ++ /* ++ * If adding support for more per-cpu interrupts, keep the the ++ * array in gic_all_vpes_irq_cpu_online() in sync. ++ */ + switch (intr) { + case GIC_LOCAL_INT_TIMER: + /* CONFIG_MIPS_CMP workaround (see __gic_init) */ +@@ -662,8 +677,8 @@ static int gic_cpu_startup(unsigned int cpu) + /* Clear all local IRQ masks (ie. disable all local interrupts) */ + write_gic_vl_rmask(~0); + +- /* Invoke irq_cpu_online callbacks to enable desired interrupts */ +- irq_cpu_online(); ++ /* Enable desired interrupts */ ++ gic_all_vpes_irq_cpu_online(); + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.4/irqchip-mips-gic-use-raw-spinlock-for-gic_lock.patch b/queue-5.4/irqchip-mips-gic-use-raw-spinlock-for-gic_lock.patch new file mode 100644 index 00000000000..034c888b974 --- /dev/null +++ b/queue-5.4/irqchip-mips-gic-use-raw-spinlock-for-gic_lock.patch @@ -0,0 +1,163 @@ +From 12350404604b947f21e5f57b305e07ce5bdccb91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 11:31:56 +0100 +Subject: irqchip/mips-gic: Use raw spinlock for gic_lock + +From: Jiaxun Yang + +[ Upstream commit 3d6a0e4197c04599d75d85a608c8bb16a630a38c ] + +Since we may hold gic_lock in hardirq context, use raw spinlock +makes more sense given that it is for low-level interrupt handling +routine and the critical section is small. + +Fixes BUG: + +[ 0.426106] ============================= +[ 0.426257] [ BUG: Invalid wait context ] +[ 0.426422] 6.3.0-rc7-next-20230421-dirty #54 Not tainted +[ 0.426638] ----------------------------- +[ 0.426766] swapper/0/1 is trying to lock: +[ 0.426954] ffffffff8104e7b8 (gic_lock){....}-{3:3}, at: gic_set_type+0x30/08 + +Fixes: 95150ae8b330 ("irqchip: mips-gic: Implement irq_set_type callback") +Cc: stable@vger.kernel.org +Signed-off-by: Jiaxun Yang +Reviewed-by: Serge Semin +Tested-by: Serge Semin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230424103156.66753-3-jiaxun.yang@flygoat.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-mips-gic.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c +index 6b8c3dd0f76f4..dd9b111038b06 100644 +--- a/drivers/irqchip/irq-mips-gic.c ++++ b/drivers/irqchip/irq-mips-gic.c +@@ -48,7 +48,7 @@ void __iomem *mips_gic_base; + + DEFINE_PER_CPU_READ_MOSTLY(unsigned long[GIC_MAX_LONGS], pcpu_masks); + +-static DEFINE_SPINLOCK(gic_lock); ++static DEFINE_RAW_SPINLOCK(gic_lock); + static struct irq_domain *gic_irq_domain; + static struct irq_domain *gic_ipi_domain; + static int gic_shared_intrs; +@@ -207,7 +207,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type) + + irq = GIC_HWIRQ_TO_SHARED(d->hwirq); + +- spin_lock_irqsave(&gic_lock, flags); ++ raw_spin_lock_irqsave(&gic_lock, flags); + switch (type & IRQ_TYPE_SENSE_MASK) { + case IRQ_TYPE_EDGE_FALLING: + pol = GIC_POL_FALLING_EDGE; +@@ -247,7 +247,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type) + else + irq_set_chip_handler_name_locked(d, &gic_level_irq_controller, + handle_level_irq, NULL); +- spin_unlock_irqrestore(&gic_lock, flags); ++ raw_spin_unlock_irqrestore(&gic_lock, flags); + + return 0; + } +@@ -265,7 +265,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask, + return -EINVAL; + + /* Assumption : cpumask refers to a single CPU */ +- spin_lock_irqsave(&gic_lock, flags); ++ raw_spin_lock_irqsave(&gic_lock, flags); + + /* Re-route this IRQ */ + write_gic_map_vp(irq, BIT(mips_cm_vp_id(cpu))); +@@ -276,7 +276,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask, + set_bit(irq, per_cpu_ptr(pcpu_masks, cpu)); + + irq_data_update_effective_affinity(d, cpumask_of(cpu)); +- spin_unlock_irqrestore(&gic_lock, flags); ++ raw_spin_unlock_irqrestore(&gic_lock, flags); + + return IRQ_SET_MASK_OK; + } +@@ -354,12 +354,12 @@ static void gic_mask_local_irq_all_vpes(struct irq_data *d) + cd = irq_data_get_irq_chip_data(d); + cd->mask = false; + +- spin_lock_irqsave(&gic_lock, flags); ++ raw_spin_lock_irqsave(&gic_lock, flags); + for_each_online_cpu(cpu) { + write_gic_vl_other(mips_cm_vp_id(cpu)); + write_gic_vo_rmask(BIT(intr)); + } +- spin_unlock_irqrestore(&gic_lock, flags); ++ raw_spin_unlock_irqrestore(&gic_lock, flags); + } + + static void gic_unmask_local_irq_all_vpes(struct irq_data *d) +@@ -372,12 +372,12 @@ static void gic_unmask_local_irq_all_vpes(struct irq_data *d) + cd = irq_data_get_irq_chip_data(d); + cd->mask = true; + +- spin_lock_irqsave(&gic_lock, flags); ++ raw_spin_lock_irqsave(&gic_lock, flags); + for_each_online_cpu(cpu) { + write_gic_vl_other(mips_cm_vp_id(cpu)); + write_gic_vo_smask(BIT(intr)); + } +- spin_unlock_irqrestore(&gic_lock, flags); ++ raw_spin_unlock_irqrestore(&gic_lock, flags); + } + + static void gic_all_vpes_irq_cpu_online(void) +@@ -390,7 +390,7 @@ static void gic_all_vpes_irq_cpu_online(void) + unsigned long flags; + int i; + +- spin_lock_irqsave(&gic_lock, flags); ++ raw_spin_lock_irqsave(&gic_lock, flags); + + for (i = 0; i < ARRAY_SIZE(local_intrs); i++) { + unsigned int intr = local_intrs[i]; +@@ -402,7 +402,7 @@ static void gic_all_vpes_irq_cpu_online(void) + write_gic_vl_smask(BIT(intr)); + } + +- spin_unlock_irqrestore(&gic_lock, flags); ++ raw_spin_unlock_irqrestore(&gic_lock, flags); + } + + static struct irq_chip gic_all_vpes_local_irq_controller = { +@@ -432,11 +432,11 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq, + + data = irq_get_irq_data(virq); + +- spin_lock_irqsave(&gic_lock, flags); ++ raw_spin_lock_irqsave(&gic_lock, flags); + write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin); + write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu))); + irq_data_update_effective_affinity(data, cpumask_of(cpu)); +- spin_unlock_irqrestore(&gic_lock, flags); ++ raw_spin_unlock_irqrestore(&gic_lock, flags); + + return 0; + } +@@ -529,12 +529,12 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq, + if (!gic_local_irq_is_routable(intr)) + return -EPERM; + +- spin_lock_irqsave(&gic_lock, flags); ++ raw_spin_lock_irqsave(&gic_lock, flags); + for_each_online_cpu(cpu) { + write_gic_vl_other(mips_cm_vp_id(cpu)); + write_gic_vo_map(mips_gic_vx_map_reg(intr), map); + } +- spin_unlock_irqrestore(&gic_lock, flags); ++ raw_spin_unlock_irqrestore(&gic_lock, flags); + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.4/leds-trigger-netdev-recheck-netdev_led_mode_linkup-o.patch b/queue-5.4/leds-trigger-netdev-recheck-netdev_led_mode_linkup-o.patch new file mode 100644 index 00000000000..5786179c314 --- /dev/null +++ b/queue-5.4/leds-trigger-netdev-recheck-netdev_led_mode_linkup-o.patch @@ -0,0 +1,44 @@ +From 51da6a19c73a5e484b709a73850d9ff55f694a52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 23:07:39 +0200 +Subject: leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename + +From: Christian Marangi + +[ Upstream commit cee4bd16c3195a701be683f7da9e88c6e11acb73 ] + +Dev can be renamed also while up for supported device. We currently +wrongly clear the NETDEV_LED_MODE_LINKUP flag on NETDEV_CHANGENAME +event. + +Fix this by rechecking if the carrier is ok on NETDEV_CHANGENAME and +correctly set the NETDEV_LED_MODE_LINKUP bit. + +Fixes: 5f820ed52371 ("leds: trigger: netdev: fix handling on interface rename") +Cc: stable@vger.kernel.org # v5.5+ +Signed-off-by: Christian Marangi +Reviewed-by: Andrew Lunn +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230419210743.3594-2-ansuelsmth@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/leds/trigger/ledtrig-netdev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/leds/trigger/ledtrig-netdev.c b/drivers/leds/trigger/ledtrig-netdev.c +index d5e774d830215..f4d670ec30bcb 100644 +--- a/drivers/leds/trigger/ledtrig-netdev.c ++++ b/drivers/leds/trigger/ledtrig-netdev.c +@@ -318,6 +318,9 @@ static int netdev_trig_notify(struct notifier_block *nb, + clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode); + switch (evt) { + case NETDEV_CHANGENAME: ++ if (netif_carrier_ok(dev)) ++ set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode); ++ fallthrough; + case NETDEV_REGISTER: + if (trigger_data->net_dev) + dev_put(trigger_data->net_dev); +-- +2.40.1 + diff --git a/queue-5.4/macsec-fix-traffic-counters-statistics.patch b/queue-5.4/macsec-fix-traffic-counters-statistics.patch new file mode 100644 index 00000000000..643100d2d09 --- /dev/null +++ b/queue-5.4/macsec-fix-traffic-counters-statistics.patch @@ -0,0 +1,250 @@ +From 0757f7b8a90a93cddade37e048a1311d9eb7498a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Aug 2022 15:38:23 -0700 +Subject: macsec: Fix traffic counters/statistics + +From: Clayton Yager + +[ Upstream commit 91ec9bd57f3524ff3d86bfb7c9ee5a315019733c ] + +OutOctetsProtected, OutOctetsEncrypted, InOctetsValidated, and +InOctetsDecrypted were incrementing by the total number of octets in frames +instead of by the number of octets of User Data in frames. + +The Controlled Port statistics ifOutOctets and ifInOctets were incrementing +by the total number of octets instead of the number of octets of the MSDUs +plus octets of the destination and source MAC addresses. + +The Controlled Port statistics ifInDiscards and ifInErrors were not +incrementing each time the counters they aggregate were. + +The Controlled Port statistic ifInErrors was not included in the output of +macsec_get_stats64 so the value was not present in ip commands output. + +The ReceiveSA counters InPktsNotValid, InPktsNotUsingSA, and InPktsUnusedSA +were not incrementing. + +Signed-off-by: Clayton Yager +Signed-off-by: David S. Miller +Stable-dep-of: 32d0a49d36a2 ("macsec: use DEV_STATS_INC()") +Signed-off-by: Sasha Levin +--- + drivers/net/macsec.c | 58 +++++++++++++++++++++++++++++++++++++------- + 1 file changed, 49 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index f729f55f6a174..dcabff57efa73 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -317,6 +317,19 @@ static struct macsec_rx_sa *macsec_rxsa_get(struct macsec_rx_sa __rcu *ptr) + return sa; + } + ++static struct macsec_rx_sa *macsec_active_rxsa_get(struct macsec_rx_sc *rx_sc) ++{ ++ struct macsec_rx_sa *sa = NULL; ++ int an; ++ ++ for (an = 0; an < MACSEC_NUM_AN; an++) { ++ sa = macsec_rxsa_get(rx_sc->sa[an]); ++ if (sa) ++ break; ++ } ++ return sa; ++} ++ + static void free_rx_sc_rcu(struct rcu_head *head) + { + struct macsec_rx_sc *rx_sc = container_of(head, struct macsec_rx_sc, rcu_head); +@@ -561,18 +574,28 @@ static void macsec_encrypt_finish(struct sk_buff *skb, struct net_device *dev) + skb->protocol = eth_hdr(skb)->h_proto; + } + ++static unsigned int macsec_msdu_len(struct sk_buff *skb) ++{ ++ struct macsec_dev *macsec = macsec_priv(skb->dev); ++ struct macsec_secy *secy = &macsec->secy; ++ bool sci_present = macsec_skb_cb(skb)->has_sci; ++ ++ return skb->len - macsec_hdr_len(sci_present) - secy->icv_len; ++} ++ + static void macsec_count_tx(struct sk_buff *skb, struct macsec_tx_sc *tx_sc, + struct macsec_tx_sa *tx_sa) + { ++ unsigned int msdu_len = macsec_msdu_len(skb); + struct pcpu_tx_sc_stats *txsc_stats = this_cpu_ptr(tx_sc->stats); + + u64_stats_update_begin(&txsc_stats->syncp); + if (tx_sc->encrypt) { +- txsc_stats->stats.OutOctetsEncrypted += skb->len; ++ txsc_stats->stats.OutOctetsEncrypted += msdu_len; + txsc_stats->stats.OutPktsEncrypted++; + this_cpu_inc(tx_sa->stats->OutPktsEncrypted); + } else { +- txsc_stats->stats.OutOctetsProtected += skb->len; ++ txsc_stats->stats.OutOctetsProtected += msdu_len; + txsc_stats->stats.OutPktsProtected++; + this_cpu_inc(tx_sa->stats->OutPktsProtected); + } +@@ -602,9 +625,10 @@ static void macsec_encrypt_done(struct crypto_async_request *base, int err) + aead_request_free(macsec_skb_cb(skb)->req); + + rcu_read_lock_bh(); +- macsec_encrypt_finish(skb, dev); + macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa); +- len = skb->len; ++ /* packet is encrypted/protected so tx_bytes must be calculated */ ++ len = macsec_msdu_len(skb) + 2 * ETH_ALEN; ++ macsec_encrypt_finish(skb, dev); + ret = dev_queue_xmit(skb); + count_tx(dev, ret, len); + rcu_read_unlock_bh(); +@@ -760,6 +784,7 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb, + + macsec_skb_cb(skb)->req = req; + macsec_skb_cb(skb)->tx_sa = tx_sa; ++ macsec_skb_cb(skb)->has_sci = sci_present; + aead_request_set_callback(req, 0, macsec_encrypt_done, skb); + + dev_hold(skb->dev); +@@ -800,15 +825,17 @@ static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsLate++; + u64_stats_update_end(&rxsc_stats->syncp); ++ secy->netdev->stats.rx_dropped++; + return false; + } + + if (secy->validate_frames != MACSEC_VALIDATE_DISABLED) { ++ unsigned int msdu_len = macsec_msdu_len(skb); + u64_stats_update_begin(&rxsc_stats->syncp); + if (hdr->tci_an & MACSEC_TCI_E) +- rxsc_stats->stats.InOctetsDecrypted += skb->len; ++ rxsc_stats->stats.InOctetsDecrypted += msdu_len; + else +- rxsc_stats->stats.InOctetsValidated += skb->len; ++ rxsc_stats->stats.InOctetsValidated += msdu_len; + u64_stats_update_end(&rxsc_stats->syncp); + } + +@@ -821,6 +848,8 @@ static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsNotValid++; + u64_stats_update_end(&rxsc_stats->syncp); ++ this_cpu_inc(rx_sa->stats->InPktsNotValid); ++ secy->netdev->stats.rx_errors++; + return false; + } + +@@ -906,9 +935,9 @@ static void macsec_decrypt_done(struct crypto_async_request *base, int err) + + macsec_finalize_skb(skb, macsec->secy.icv_len, + macsec_extra_len(macsec_skb_cb(skb)->has_sci)); ++ len = skb->len; + macsec_reset_skb(skb, macsec->secy.netdev); + +- len = skb->len; + if (gro_cells_receive(&macsec->gro_cells, skb) == NET_RX_SUCCESS) + count_rx(dev, len); + +@@ -1050,6 +1079,7 @@ static void handle_not_macsec(struct sk_buff *skb) + u64_stats_update_begin(&secy_stats->syncp); + secy_stats->stats.InPktsNoTag++; + u64_stats_update_end(&secy_stats->syncp); ++ macsec->secy.netdev->stats.rx_dropped++; + continue; + } + +@@ -1161,6 +1191,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&secy_stats->syncp); + secy_stats->stats.InPktsBadTag++; + u64_stats_update_end(&secy_stats->syncp); ++ secy->netdev->stats.rx_errors++; + goto drop_nosa; + } + +@@ -1171,11 +1202,15 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + /* If validateFrames is Strict or the C bit in the + * SecTAG is set, discard + */ ++ struct macsec_rx_sa *active_rx_sa = macsec_active_rxsa_get(rx_sc); + if (hdr->tci_an & MACSEC_TCI_C || + secy->validate_frames == MACSEC_VALIDATE_STRICT) { + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsNotUsingSA++; + u64_stats_update_end(&rxsc_stats->syncp); ++ secy->netdev->stats.rx_errors++; ++ if (active_rx_sa) ++ this_cpu_inc(active_rx_sa->stats->InPktsNotUsingSA); + goto drop_nosa; + } + +@@ -1185,6 +1220,8 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsUnusedSA++; + u64_stats_update_end(&rxsc_stats->syncp); ++ if (active_rx_sa) ++ this_cpu_inc(active_rx_sa->stats->InPktsUnusedSA); + goto deliver; + } + +@@ -1202,6 +1239,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsLate++; + u64_stats_update_end(&rxsc_stats->syncp); ++ macsec->secy.netdev->stats.rx_dropped++; + goto drop; + } + } +@@ -1230,6 +1268,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + deliver: + macsec_finalize_skb(skb, secy->icv_len, + macsec_extra_len(macsec_skb_cb(skb)->has_sci)); ++ len = skb->len; + macsec_reset_skb(skb, secy->netdev); + + if (rx_sa) +@@ -1237,7 +1276,6 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + macsec_rxsc_put(rx_sc); + + skb_orphan(skb); +- len = skb->len; + ret = gro_cells_receive(&macsec->gro_cells, skb); + if (ret == NET_RX_SUCCESS) + count_rx(dev, len); +@@ -1279,6 +1317,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&secy_stats->syncp); + secy_stats->stats.InPktsNoSCI++; + u64_stats_update_end(&secy_stats->syncp); ++ macsec->secy.netdev->stats.rx_errors++; + continue; + } + +@@ -2735,6 +2774,7 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb, + return NETDEV_TX_OK; + } + ++ len = skb->len; + skb = macsec_encrypt(skb, dev); + if (IS_ERR(skb)) { + if (PTR_ERR(skb) != -EINPROGRESS) +@@ -2745,7 +2785,6 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb, + macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa); + + macsec_encrypt_finish(skb, dev); +- len = skb->len; + ret = dev_queue_xmit(skb); + count_tx(dev, ret, len); + return ret; +@@ -2959,6 +2998,7 @@ static void macsec_get_stats64(struct net_device *dev, + + s->rx_dropped = dev->stats.rx_dropped; + s->tx_dropped = dev->stats.tx_dropped; ++ s->rx_errors = dev->stats.rx_errors; + } + + static int macsec_get_iflink(const struct net_device *dev) +-- +2.40.1 + diff --git a/queue-5.4/macsec-use-dev_stats_inc.patch b/queue-5.4/macsec-use-dev_stats_inc.patch new file mode 100644 index 00000000000..95201d4a23d --- /dev/null +++ b/queue-5.4/macsec-use-dev_stats_inc.patch @@ -0,0 +1,145 @@ +From 241b00e7bb84f9d1a9d11e06128176fc62816f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Aug 2023 17:26:52 +0000 +Subject: macsec: use DEV_STATS_INC() + +From: Eric Dumazet + +[ Upstream commit 32d0a49d36a2a306c2e47fe5659361e424f0ed3f ] + +syzbot/KCSAN reported data-races in macsec whenever dev->stats fields +are updated. + +It appears all of these updates can happen from multiple cpus. + +Adopt SMP safe DEV_STATS_INC() to update dev->stats fields. + +Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Sabrina Dubroca +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/macsec.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index dcabff57efa73..25fa3ef5b804f 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -825,7 +825,7 @@ static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsLate++; + u64_stats_update_end(&rxsc_stats->syncp); +- secy->netdev->stats.rx_dropped++; ++ DEV_STATS_INC(secy->netdev, rx_dropped); + return false; + } + +@@ -849,7 +849,7 @@ static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u + rxsc_stats->stats.InPktsNotValid++; + u64_stats_update_end(&rxsc_stats->syncp); + this_cpu_inc(rx_sa->stats->InPktsNotValid); +- secy->netdev->stats.rx_errors++; ++ DEV_STATS_INC(secy->netdev, rx_errors); + return false; + } + +@@ -1079,7 +1079,7 @@ static void handle_not_macsec(struct sk_buff *skb) + u64_stats_update_begin(&secy_stats->syncp); + secy_stats->stats.InPktsNoTag++; + u64_stats_update_end(&secy_stats->syncp); +- macsec->secy.netdev->stats.rx_dropped++; ++ DEV_STATS_INC(macsec->secy.netdev, rx_dropped); + continue; + } + +@@ -1191,7 +1191,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&secy_stats->syncp); + secy_stats->stats.InPktsBadTag++; + u64_stats_update_end(&secy_stats->syncp); +- secy->netdev->stats.rx_errors++; ++ DEV_STATS_INC(secy->netdev, rx_errors); + goto drop_nosa; + } + +@@ -1208,7 +1208,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsNotUsingSA++; + u64_stats_update_end(&rxsc_stats->syncp); +- secy->netdev->stats.rx_errors++; ++ DEV_STATS_INC(secy->netdev, rx_errors); + if (active_rx_sa) + this_cpu_inc(active_rx_sa->stats->InPktsNotUsingSA); + goto drop_nosa; +@@ -1239,7 +1239,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&rxsc_stats->syncp); + rxsc_stats->stats.InPktsLate++; + u64_stats_update_end(&rxsc_stats->syncp); +- macsec->secy.netdev->stats.rx_dropped++; ++ DEV_STATS_INC(macsec->secy.netdev, rx_dropped); + goto drop; + } + } +@@ -1280,7 +1280,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + if (ret == NET_RX_SUCCESS) + count_rx(dev, len); + else +- macsec->secy.netdev->stats.rx_dropped++; ++ DEV_STATS_INC(macsec->secy.netdev, rx_dropped); + + rcu_read_unlock(); + +@@ -1317,7 +1317,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + u64_stats_update_begin(&secy_stats->syncp); + secy_stats->stats.InPktsNoSCI++; + u64_stats_update_end(&secy_stats->syncp); +- macsec->secy.netdev->stats.rx_errors++; ++ DEV_STATS_INC(macsec->secy.netdev, rx_errors); + continue; + } + +@@ -1336,7 +1336,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb) + secy_stats->stats.InPktsUnknownSCI++; + u64_stats_update_end(&secy_stats->syncp); + } else { +- macsec->secy.netdev->stats.rx_dropped++; ++ DEV_STATS_INC(macsec->secy.netdev, rx_dropped); + } + } + +@@ -2770,7 +2770,7 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb, + + if (!secy->operational) { + kfree_skb(skb); +- dev->stats.tx_dropped++; ++ DEV_STATS_INC(dev, tx_dropped); + return NETDEV_TX_OK; + } + +@@ -2778,7 +2778,7 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb, + skb = macsec_encrypt(skb, dev); + if (IS_ERR(skb)) { + if (PTR_ERR(skb) != -EINPROGRESS) +- dev->stats.tx_dropped++; ++ DEV_STATS_INC(dev, tx_dropped); + return NETDEV_TX_OK; + } + +@@ -2996,9 +2996,9 @@ static void macsec_get_stats64(struct net_device *dev, + s->tx_bytes += tmp.tx_bytes; + } + +- s->rx_dropped = dev->stats.rx_dropped; +- s->tx_dropped = dev->stats.tx_dropped; +- s->rx_errors = dev->stats.rx_errors; ++ s->rx_dropped = atomic_long_read(&dev->stats.__rx_dropped); ++ s->tx_dropped = atomic_long_read(&dev->stats.__tx_dropped); ++ s->rx_errors = atomic_long_read(&dev->stats.__rx_errors); + } + + static int macsec_get_iflink(const struct net_device *dev) +-- +2.40.1 + diff --git a/queue-5.4/media-platform-mediatek-vpu-fix-null-ptr-dereference.patch b/queue-5.4/media-platform-mediatek-vpu-fix-null-ptr-dereference.patch new file mode 100644 index 00000000000..a132aa9a428 --- /dev/null +++ b/queue-5.4/media-platform-mediatek-vpu-fix-null-ptr-dereference.patch @@ -0,0 +1,50 @@ +From 83343b0340594a784b620f8cad56701d6c06feea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 13:11:47 +0100 +Subject: media: platform: mediatek: vpu: fix NULL ptr dereference + +From: Hans Verkuil + +[ Upstream commit 3df55cd773e8603b623425cc97b05e542854ad27 ] + +If pdev is NULL, then it is still dereferenced. + +This fixes this smatch warning: + +drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev' + +Signed-off-by: Hans Verkuil +Cc: Yunfei Dong +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vpu/mtk_vpu.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c +index acf64723f9381..650e198a270e4 100644 +--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c ++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c +@@ -529,15 +529,17 @@ static int load_requested_vpu(struct mtk_vpu *vpu, + int vpu_load_firmware(struct platform_device *pdev) + { + struct mtk_vpu *vpu; +- struct device *dev = &pdev->dev; ++ struct device *dev; + struct vpu_run *run; + int ret; + + if (!pdev) { +- dev_err(dev, "VPU platform device is invalid\n"); ++ pr_err("VPU platform device is invalid\n"); + return -EINVAL; + } + ++ dev = &pdev->dev; ++ + vpu = platform_get_drvdata(pdev); + run = &vpu->run; + +-- +2.40.1 + diff --git a/queue-5.4/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch b/queue-5.4/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch new file mode 100644 index 00000000000..1747dfb6685 --- /dev/null +++ b/queue-5.4/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch @@ -0,0 +1,69 @@ +From a82f7d1ab939674c87a8224b0af46079ba97fabf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 16:17:40 +0800 +Subject: media: v4l2-mem2mem: add lock to protect parameter num_rdy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yunfei Dong + +[ Upstream commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694 ] + +Getting below error when using KCSAN to check the driver. Adding lock to +protect parameter num_rdy when getting the value with function: +v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready. + +kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue +kworker/u16:3: [name:report&] + +kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7: +kworker/u16:3:  v4l2_m2m_buf_queue+0xd8/0x10c + +Signed-off-by: Pina Chen +Signed-off-by: Yunfei Dong +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/media/v4l2-mem2mem.h | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h +index 0b9c3a287061e..57b48c33f56cf 100644 +--- a/include/media/v4l2-mem2mem.h ++++ b/include/media/v4l2-mem2mem.h +@@ -401,7 +401,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx, + static inline + unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) + { +- return m2m_ctx->out_q_ctx.num_rdy; ++ unsigned int num_buf_rdy; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags); ++ num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy; ++ spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags); ++ ++ return num_buf_rdy; + } + + /** +@@ -413,7 +420,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) + static inline + unsigned int v4l2_m2m_num_dst_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) + { +- return m2m_ctx->cap_q_ctx.num_rdy; ++ unsigned int num_buf_rdy; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); ++ num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy; ++ spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); ++ ++ return num_buf_rdy; + } + + /** +-- +2.40.1 + diff --git a/queue-5.4/mips-dec-prom-address-warray-bounds-warning.patch b/queue-5.4/mips-dec-prom-address-warray-bounds-warning.patch new file mode 100644 index 00000000000..8ebe6d060d7 --- /dev/null +++ b/queue-5.4/mips-dec-prom-address-warray-bounds-warning.patch @@ -0,0 +1,54 @@ +From 8e7da8808c5681a5deb70ba7ded97ea2c9327e2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 17:43:57 -0600 +Subject: MIPS: dec: prom: Address -Warray-bounds warning + +From: Gustavo A. R. Silva + +[ Upstream commit 7b191b9b55df2a844bd32d1d380f47a7df1c2896 ] + +Zero-length arrays are deprecated, and we are replacing them with flexible +array members instead. So, replace zero-length array with flexible-array +member in struct memmap. + +Address the following warning found after building (with GCC-13) mips64 +with decstation_64_defconfig: +In function 'rex_setup_memory_region', + inlined from 'prom_meminit' at arch/mips/dec/prom/memory.c:91:3: +arch/mips/dec/prom/memory.c:72:31: error: array subscript i is outside array bounds of 'unsigned char[0]' [-Werror=array-bounds=] + 72 | if (bm->bitmap[i] == 0xff) + | ~~~~~~~~~~^~~ +In file included from arch/mips/dec/prom/memory.c:16: +./arch/mips/include/asm/dec/prom.h: In function 'prom_meminit': +./arch/mips/include/asm/dec/prom.h:73:23: note: while referencing 'bitmap' + 73 | unsigned char bitmap[0]; + +This helps with the ongoing efforts to globally enable -Warray-bounds. + +This results in no differences in binary output. + +Link: https://github.com/KSPP/linux/issues/79 +Link: https://github.com/KSPP/linux/issues/323 +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/dec/prom.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h +index 1e1247add1cf8..908e96e3a3117 100644 +--- a/arch/mips/include/asm/dec/prom.h ++++ b/arch/mips/include/asm/dec/prom.h +@@ -70,7 +70,7 @@ static inline bool prom_is_rex(u32 magic) + */ + typedef struct { + int pagesize; +- unsigned char bitmap[0]; ++ unsigned char bitmap[]; + } memmap; + + +-- +2.40.1 + diff --git a/queue-5.4/mmc-bcm2835-fix-deferred-probing.patch b/queue-5.4/mmc-bcm2835-fix-deferred-probing.patch new file mode 100644 index 00000000000..be164c6c3c0 --- /dev/null +++ b/queue-5.4/mmc-bcm2835-fix-deferred-probing.patch @@ -0,0 +1,44 @@ +From c7510672ee83cb7c89a731bea097735aeb423556 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 23:36:11 +0300 +Subject: mmc: bcm2835: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 71150ac12558bcd9d75e6e24cf7c872c2efd80f3 ] + +The driver overrides the error codes and IRQ0 returned by platform_get_irq() +to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe +permanently instead of the deferred probing. Switch to propagating the error +codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 +in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, +so we now can safely ignore it... + +Fixes: 660fc733bd74 ("mmc: bcm2835: Add new driver for the sdhost controller.") +Cc: stable@vger.kernel.org # v5.19+ +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/20230617203622.6812-2-s.shtylyov@omp.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/bcm2835.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c +index 148414d7f0c9d..d20943e433127 100644 +--- a/drivers/mmc/host/bcm2835.c ++++ b/drivers/mmc/host/bcm2835.c +@@ -1408,8 +1408,8 @@ static int bcm2835_probe(struct platform_device *pdev) + host->max_clk = clk_get_rate(clk); + + host->irq = platform_get_irq(pdev, 0); +- if (host->irq <= 0) { +- ret = -EINVAL; ++ if (host->irq < 0) { ++ ret = host->irq; + goto err; + } + +-- +2.40.1 + diff --git a/queue-5.4/mmc-sdhci-f-sdh30-replace-with-sdhci_pltfm.patch b/queue-5.4/mmc-sdhci-f-sdh30-replace-with-sdhci_pltfm.patch new file mode 100644 index 00000000000..6dc3ec0af0d --- /dev/null +++ b/queue-5.4/mmc-sdhci-f-sdh30-replace-with-sdhci_pltfm.patch @@ -0,0 +1,155 @@ +From af4bf447bbfffd20adf1420f260b999e474a2fee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 09:45:33 +0900 +Subject: mmc: sdhci-f-sdh30: Replace with sdhci_pltfm + +From: Kunihiko Hayashi + +[ Upstream commit 5def5c1c15bf22934ee227af85c1716762f3829f ] + +Even if sdhci_pltfm_pmops is specified for PM, this driver doesn't apply +sdhci_pltfm, so the structure is not correctly referenced in PM functions. +This applies sdhci_pltfm to this driver to fix this issue. + +- Call sdhci_pltfm_init() instead of sdhci_alloc_host() and + other functions that covered by sdhci_pltfm. +- Move ops and quirks to sdhci_pltfm_data +- Replace sdhci_priv() with own private function sdhci_f_sdh30_priv(). + +Fixes: 87a507459f49 ("mmc: sdhci: host: add new f_sdh30") +Signed-off-by: Kunihiko Hayashi +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230630004533.26644-1-hayashi.kunihiko@socionext.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_f_sdh30.c | 60 ++++++++++++++------------------ + 1 file changed, 27 insertions(+), 33 deletions(-) + +diff --git a/drivers/mmc/host/sdhci_f_sdh30.c b/drivers/mmc/host/sdhci_f_sdh30.c +index 74757809fc90d..bfaabd4130a43 100644 +--- a/drivers/mmc/host/sdhci_f_sdh30.c ++++ b/drivers/mmc/host/sdhci_f_sdh30.c +@@ -50,9 +50,16 @@ struct f_sdhost_priv { + bool enable_cmd_dat_delay; + }; + ++static void *sdhci_f_sdhost_priv(struct sdhci_host *host) ++{ ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ ++ return sdhci_pltfm_priv(pltfm_host); ++} ++ + static void sdhci_f_sdh30_soft_voltage_switch(struct sdhci_host *host) + { +- struct f_sdhost_priv *priv = sdhci_priv(host); ++ struct f_sdhost_priv *priv = sdhci_f_sdhost_priv(host); + u32 ctrl = 0; + + usleep_range(2500, 3000); +@@ -85,7 +92,7 @@ static unsigned int sdhci_f_sdh30_get_min_clock(struct sdhci_host *host) + + static void sdhci_f_sdh30_reset(struct sdhci_host *host, u8 mask) + { +- struct f_sdhost_priv *priv = sdhci_priv(host); ++ struct f_sdhost_priv *priv = sdhci_f_sdhost_priv(host); + u32 ctl; + + if (sdhci_readw(host, SDHCI_CLOCK_CONTROL) == 0) +@@ -109,30 +116,32 @@ static const struct sdhci_ops sdhci_f_sdh30_ops = { + .set_uhs_signaling = sdhci_set_uhs_signaling, + }; + ++static const struct sdhci_pltfm_data sdhci_f_sdh30_pltfm_data = { ++ .ops = &sdhci_f_sdh30_ops, ++ .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC ++ | SDHCI_QUIRK_INVERTED_WRITE_PROTECT, ++ .quirks2 = SDHCI_QUIRK2_SUPPORT_SINGLE ++ | SDHCI_QUIRK2_TUNING_WORK_AROUND, ++}; ++ + static int sdhci_f_sdh30_probe(struct platform_device *pdev) + { + struct sdhci_host *host; + struct device *dev = &pdev->dev; +- int irq, ctrl = 0, ret = 0; ++ int ctrl = 0, ret = 0; + struct f_sdhost_priv *priv; ++ struct sdhci_pltfm_host *pltfm_host; + u32 reg = 0; + +- irq = platform_get_irq(pdev, 0); +- if (irq < 0) +- return irq; +- +- host = sdhci_alloc_host(dev, sizeof(struct f_sdhost_priv)); ++ host = sdhci_pltfm_init(pdev, &sdhci_f_sdh30_pltfm_data, ++ sizeof(struct f_sdhost_priv)); + if (IS_ERR(host)) + return PTR_ERR(host); + +- priv = sdhci_priv(host); ++ pltfm_host = sdhci_priv(host); ++ priv = sdhci_pltfm_priv(pltfm_host); + priv->dev = dev; + +- host->quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC | +- SDHCI_QUIRK_INVERTED_WRITE_PROTECT; +- host->quirks2 = SDHCI_QUIRK2_SUPPORT_SINGLE | +- SDHCI_QUIRK2_TUNING_WORK_AROUND; +- + priv->enable_cmd_dat_delay = device_property_read_bool(dev, + "fujitsu,cmd-dat-delay-select"); + +@@ -140,18 +149,6 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev) + if (ret) + goto err; + +- platform_set_drvdata(pdev, host); +- +- host->hw_name = "f_sdh30"; +- host->ops = &sdhci_f_sdh30_ops; +- host->irq = irq; +- +- host->ioaddr = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(host->ioaddr)) { +- ret = PTR_ERR(host->ioaddr); +- goto err; +- } +- + if (dev_of_node(dev)) { + sdhci_get_of_property(pdev); + +@@ -206,23 +203,20 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev) + err_clk: + clk_disable_unprepare(priv->clk_iface); + err: +- sdhci_free_host(host); ++ sdhci_pltfm_free(pdev); ++ + return ret; + } + + static int sdhci_f_sdh30_remove(struct platform_device *pdev) + { + struct sdhci_host *host = platform_get_drvdata(pdev); +- struct f_sdhost_priv *priv = sdhci_priv(host); +- +- sdhci_remove_host(host, readl(host->ioaddr + SDHCI_INT_STATUS) == +- 0xffffffff); ++ struct f_sdhost_priv *priv = sdhci_f_sdhost_priv(host); + + clk_disable_unprepare(priv->clk_iface); + clk_disable_unprepare(priv->clk); + +- sdhci_free_host(host); +- platform_set_drvdata(pdev, NULL); ++ sdhci_pltfm_unregister(pdev); + + return 0; + } +-- +2.40.1 + diff --git a/queue-5.4/mmc-sdhci-spear-fix-deferred-probing.patch b/queue-5.4/mmc-sdhci-spear-fix-deferred-probing.patch new file mode 100644 index 00000000000..8deb1804a61 --- /dev/null +++ b/queue-5.4/mmc-sdhci-spear-fix-deferred-probing.patch @@ -0,0 +1,46 @@ +From f07d3f321e9bbfe86fc2fe73763fec06bc79487b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 23:36:19 +0300 +Subject: mmc: sdhci-spear: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 8d0caeedcd05a721f3cc2537b0ea212ec4027307 ] + +The driver overrides the error codes and IRQ0 returned by platform_get_irq() +to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe +permanently instead of the deferred probing. Switch to propagating the error +codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 +in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, +so we now can safely ignore it... + +Fixes: 682798a596a6 ("mmc: sdhci-spear: Handle return value of platform_get_irq") +Cc: stable@vger.kernel.org # v5.19+ +Signed-off-by: Sergey Shtylyov +Acked-by: Viresh Kumar +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20230617203622.6812-10-s.shtylyov@omp.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-spear.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-spear.c b/drivers/mmc/host/sdhci-spear.c +index 916b5b09c3d13..05daae3676f00 100644 +--- a/drivers/mmc/host/sdhci-spear.c ++++ b/drivers/mmc/host/sdhci-spear.c +@@ -67,8 +67,8 @@ static int sdhci_probe(struct platform_device *pdev) + host->hw_name = "sdhci"; + host->ops = &sdhci_pltfm_ops; + host->irq = platform_get_irq(pdev, 0); +- if (host->irq <= 0) { +- ret = -EINVAL; ++ if (host->irq < 0) { ++ ret = host->irq; + goto err_host; + } + host->quirks = SDHCI_QUIRK_BROKEN_ADMA; +-- +2.40.1 + diff --git a/queue-5.4/mmc-sdhci_f_sdh30-convert-to-devm_platform_ioremap_r.patch b/queue-5.4/mmc-sdhci_f_sdh30-convert-to-devm_platform_ioremap_r.patch new file mode 100644 index 00000000000..5b98cbbf341 --- /dev/null +++ b/queue-5.4/mmc-sdhci_f_sdh30-convert-to-devm_platform_ioremap_r.patch @@ -0,0 +1,45 @@ +From f1fb0d1ee2803a19f6aa9ef7bfa26683c632fb3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2019 17:51:14 +0000 +Subject: mmc: sdhci_f_sdh30: convert to devm_platform_ioremap_resource + +From: Yangtao Li + +[ Upstream commit dbf90a178cdcfe255f6e67ecfcf720d1592efb60 ] + +Use devm_platform_ioremap_resource() to simplify code. + +Signed-off-by: Yangtao Li +Link: https://lore.kernel.org/r/20191215175120.3290-7-tiny.windzz@gmail.com +Signed-off-by: Ulf Hansson +Stable-dep-of: 5def5c1c15bf ("mmc: sdhci-f-sdh30: Replace with sdhci_pltfm") +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_f_sdh30.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/mmc/host/sdhci_f_sdh30.c b/drivers/mmc/host/sdhci_f_sdh30.c +index 9548d022d52ba..74757809fc90d 100644 +--- a/drivers/mmc/host/sdhci_f_sdh30.c ++++ b/drivers/mmc/host/sdhci_f_sdh30.c +@@ -113,7 +113,6 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev) + { + struct sdhci_host *host; + struct device *dev = &pdev->dev; +- struct resource *res; + int irq, ctrl = 0, ret = 0; + struct f_sdhost_priv *priv; + u32 reg = 0; +@@ -147,8 +146,7 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev) + host->ops = &sdhci_f_sdh30_ops; + host->irq = irq; + +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- host->ioaddr = devm_ioremap_resource(&pdev->dev, res); ++ host->ioaddr = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(host->ioaddr)) { + ret = PTR_ERR(host->ioaddr); + goto err; +-- +2.40.1 + diff --git a/queue-5.4/mmc-sunxi-fix-deferred-probing.patch b/queue-5.4/mmc-sunxi-fix-deferred-probing.patch new file mode 100644 index 00000000000..358350ed92e --- /dev/null +++ b/queue-5.4/mmc-sunxi-fix-deferred-probing.patch @@ -0,0 +1,45 @@ +From cb63393416e9b4e3c5d4301aecc9e3238b2997de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 23:36:21 +0300 +Subject: mmc: sunxi: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit c2df53c5806cfd746dae08e07bc8c4ad247c3b70 ] + +The driver overrides the error codes and IRQ0 returned by platform_get_irq() +to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe +permanently instead of the deferred probing. Switch to propagating the error +codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 +in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, +so we now can safely ignore it... + +Fixes: 2408a08583d2 ("mmc: sunxi-mmc: Handle return value of platform_get_irq") +Cc: stable@vger.kernel.org # v5.19+ +Signed-off-by: Sergey Shtylyov +Reviewed-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20230617203622.6812-12-s.shtylyov@omp.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sunxi-mmc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/sunxi-mmc.c b/drivers/mmc/host/sunxi-mmc.c +index 519718bb246ce..0a67ad57e5c18 100644 +--- a/drivers/mmc/host/sunxi-mmc.c ++++ b/drivers/mmc/host/sunxi-mmc.c +@@ -1314,8 +1314,8 @@ static int sunxi_mmc_resource_request(struct sunxi_mmc_host *host, + return ret; + + host->irq = platform_get_irq(pdev, 0); +- if (host->irq <= 0) { +- ret = -EINVAL; ++ if (host->irq < 0) { ++ ret = host->irq; + goto error_disable_mmc; + } + +-- +2.40.1 + diff --git a/queue-5.4/net-ncsi-change-from-ndo_set_mac_address-to-dev_set_.patch b/queue-5.4/net-ncsi-change-from-ndo_set_mac_address-to-dev_set_.patch new file mode 100644 index 00000000000..fdcffa01ee2 --- /dev/null +++ b/queue-5.4/net-ncsi-change-from-ndo_set_mac_address-to-dev_set_.patch @@ -0,0 +1,55 @@ +From 070674fb523fb3c395917b95765137adfaf9e175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 18:17:42 +0300 +Subject: net/ncsi: change from ndo_set_mac_address to dev_set_mac_address + +From: Ivan Mikhaylov + +[ Upstream commit 790071347a0a1a89e618eedcd51c687ea783aeb3 ] + +Change ndo_set_mac_address to dev_set_mac_address because +dev_set_mac_address provides a way to notify network layer about MAC +change. In other case, services may not aware about MAC change and keep +using old one which set from network adapter driver. + +As example, DHCP client from systemd do not update MAC address without +notification from net subsystem which leads to the problem with acquiring +the right address from DHCP server. + +Fixes: cb10c7c0dfd9e ("net/ncsi: Add NCSI Broadcom OEM command") +Cc: stable@vger.kernel.org # v6.0+ 2f38e84 net/ncsi: make one oem_gma function for all mfr id +Signed-off-by: Paul Fertser +Signed-off-by: Ivan Mikhaylov +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ncsi/ncsi-rsp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c +index e1c6bb4ab98fd..b3484af801597 100644 +--- a/net/ncsi/ncsi-rsp.c ++++ b/net/ncsi/ncsi-rsp.c +@@ -616,7 +616,6 @@ static int ncsi_rsp_handler_oem_mlx_gma(struct ncsi_request *nr) + { + struct ncsi_dev_priv *ndp = nr->ndp; + struct net_device *ndev = ndp->ndev.dev; +- const struct net_device_ops *ops = ndev->netdev_ops; + struct ncsi_rsp_oem_pkt *rsp; + struct sockaddr saddr; + int ret = 0; +@@ -630,7 +629,9 @@ static int ncsi_rsp_handler_oem_mlx_gma(struct ncsi_request *nr) + /* Set the flag for GMA command which should only be called once */ + ndp->gma_flag = 1; + +- ret = ops->ndo_set_mac_address(ndev, &saddr); ++ rtnl_lock(); ++ ret = dev_set_mac_address(ndev, &saddr, NULL); ++ rtnl_unlock(); + if (ret < 0) + netdev_warn(ndev, "NCSI: 'Writing mac address to device failed\n"); + +-- +2.40.1 + diff --git a/queue-5.4/net-ncsi-fix-gma-flag-setting-after-response.patch b/queue-5.4/net-ncsi-fix-gma-flag-setting-after-response.patch new file mode 100644 index 00000000000..05e2fa3f981 --- /dev/null +++ b/queue-5.4/net-ncsi-fix-gma-flag-setting-after-response.patch @@ -0,0 +1,67 @@ +From f15f079e32fe4e473eb65f4bff38385b83a97b29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2019 14:43:49 -0800 +Subject: net/ncsi: Fix gma flag setting after response + +From: Vijay Khemka + +[ Upstream commit 9e860947d8d7a1504476ac49abfce90a4ce600f3 ] + +gma_flag was set at the time of GMA command request but it should +only be set after getting successful response. Movinng this flag +setting in GMA response handler. + +This flag is used mainly for not repeating GMA command once +received MAC address. + +Signed-off-by: Vijay Khemka +Reviewed-by: Samuel Mendoza-Jonas +Signed-off-by: David S. Miller +Stable-dep-of: 790071347a0a ("net/ncsi: change from ndo_set_mac_address to dev_set_mac_address") +Signed-off-by: Sasha Levin +--- + net/ncsi/ncsi-manage.c | 3 --- + net/ncsi/ncsi-rsp.c | 6 ++++++ + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c +index 9bd12f7517ed5..6710f6b8764be 100644 +--- a/net/ncsi/ncsi-manage.c ++++ b/net/ncsi/ncsi-manage.c +@@ -770,9 +770,6 @@ static int ncsi_gma_handler(struct ncsi_cmd_arg *nca, unsigned int mf_id) + return -1; + } + +- /* Set the flag for GMA command which should only be called once */ +- nca->ndp->gma_flag = 1; +- + /* Get Mac address from NCSI device */ + return nch->handler(nca); + } +diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c +index 7c893c3799202..e1c6bb4ab98fd 100644 +--- a/net/ncsi/ncsi-rsp.c ++++ b/net/ncsi/ncsi-rsp.c +@@ -627,6 +627,9 @@ static int ncsi_rsp_handler_oem_mlx_gma(struct ncsi_request *nr) + saddr.sa_family = ndev->type; + ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE; + memcpy(saddr.sa_data, &rsp->data[MLX_MAC_ADDR_OFFSET], ETH_ALEN); ++ /* Set the flag for GMA command which should only be called once */ ++ ndp->gma_flag = 1; ++ + ret = ops->ndo_set_mac_address(ndev, &saddr); + if (ret < 0) + netdev_warn(ndev, "NCSI: 'Writing mac address to device failed\n"); +@@ -671,6 +674,9 @@ static int ncsi_rsp_handler_oem_bcm_gma(struct ncsi_request *nr) + if (!is_valid_ether_addr((const u8 *)saddr.sa_data)) + return -ENXIO; + ++ /* Set the flag for GMA command which should only be called once */ ++ ndp->gma_flag = 1; ++ + ret = ops->ndo_set_mac_address(ndev, &saddr); + if (ret < 0) + netdev_warn(ndev, "NCSI: 'Writing mac address to device failed\n"); +-- +2.40.1 + diff --git a/queue-5.4/nfsd-remove-incorrect-check-in-nfsd4_validate_statei.patch b/queue-5.4/nfsd-remove-incorrect-check-in-nfsd4_validate_statei.patch new file mode 100644 index 00000000000..f14a23778a9 --- /dev/null +++ b/queue-5.4/nfsd-remove-incorrect-check-in-nfsd4_validate_statei.patch @@ -0,0 +1,43 @@ +From ce71b67b7ca2907f64cba5b98fdf3188301552a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jul 2023 08:38:37 -0400 +Subject: nfsd: Remove incorrect check in nfsd4_validate_stateid + +From: Trond Myklebust + +[ Upstream commit f75546f58a70da5cfdcec5a45ffc377885ccbee8 ] + +If the client is calling TEST_STATEID, then it is because some event +occurred that requires it to check all the stateids for validity and +call FREE_STATEID on the ones that have been revoked. In this case, +either the stateid exists in the list of stateids associated with that +nfs4_client, in which case it should be tested, or it does not. There +are no additional conditions to be considered. + +Reported-by: "Frank Ch. Eigler" +Fixes: 7df302f75ee2 ("NFSD: TEST_STATEID should not return NFS4ERR_STALE_STATEID") +Cc: stable@vger.kernel.org # v5.7+ +Signed-off-by: Trond Myklebust +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index ecdf83c723f42..e62b6e45dcff2 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -5513,8 +5513,6 @@ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) || + CLOSE_STATEID(stateid)) + return status; +- if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) +- return status; + spin_lock(&cl->cl_lock); + s = find_stateid_locked(cl, stateid); + if (!s) +-- +2.40.1 + diff --git a/queue-5.4/nfsd4-kill-warnings-on-testing-stateids-with-mismatc.patch b/queue-5.4/nfsd4-kill-warnings-on-testing-stateids-with-mismatc.patch new file mode 100644 index 00000000000..e7c388f5bd9 --- /dev/null +++ b/queue-5.4/nfsd4-kill-warnings-on-testing-stateids-with-mismatc.patch @@ -0,0 +1,45 @@ +From 1457df2d056bad673aeaa09b99fe93da98d43414 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Mar 2020 10:18:49 -0400 +Subject: nfsd4: kill warnings on testing stateids with mismatched clientids + +From: J. Bruce Fields + +[ Upstream commit 663e36f07666ff924012defa521f88875f6e5402 ] + +It's normal for a client to test a stateid from a previous instance, +e.g. after a network partition. + +Signed-off-by: J. Bruce Fields +Reviewed-by: Benjamin Coddington +Signed-off-by: Chuck Lever +Stable-dep-of: f75546f58a70 ("nfsd: Remove incorrect check in nfsd4_validate_stateid") +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 5922eceb01762..ecdf83c723f42 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -5513,15 +5513,8 @@ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) + if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) || + CLOSE_STATEID(stateid)) + return status; +- /* Client debugging aid. */ +- if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) { +- char addr_str[INET6_ADDRSTRLEN]; +- rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str, +- sizeof(addr_str)); +- pr_warn_ratelimited("NFSD: client %s testing state ID " +- "with incorrect client ID\n", addr_str); ++ if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) + return status; +- } + spin_lock(&cl->cl_lock); + s = find_stateid_locked(cl, stateid); + if (!s) +-- +2.40.1 + diff --git a/queue-5.4/ovl-check-type-and-offset-of-struct-vfsmount-in-ovl_.patch b/queue-5.4/ovl-check-type-and-offset-of-struct-vfsmount-in-ovl_.patch new file mode 100644 index 00000000000..6724be6fdc5 --- /dev/null +++ b/queue-5.4/ovl-check-type-and-offset-of-struct-vfsmount-in-ovl_.patch @@ -0,0 +1,61 @@ +From a1fc5b6a2c00616d2309e4e7514009c73042a719 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 10:13:37 +0200 +Subject: ovl: check type and offset of struct vfsmount in ovl_entry + +From: Christian Brauner + +[ Upstream commit f723edb8a532cd26e1ff0a2b271d73762d48f762 ] + +Porting overlayfs to the new amount api I started experiencing random +crashes that couldn't be explained easily. So after much debugging and +reasoning it became clear that struct ovl_entry requires the point to +struct vfsmount to be the first member and of type struct vfsmount. + +During the port I added a new member at the beginning of struct +ovl_entry which broke all over the place in the form of random crashes +and cache corruptions. While there's a comment in ovl_free_fs() to the +effect of "Hack! Reuse ofs->layers as a vfsmount array before freeing +it" there's no such comment on struct ovl_entry which makes this easy to +trip over. + +Add a comment and two static asserts for both the offset and the type of +pointer in struct ovl_entry. + +Signed-off-by: Christian Brauner +Signed-off-by: Amir Goldstein +Signed-off-by: Sasha Levin +--- + fs/overlayfs/ovl_entry.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h +index 28348c44ea5b2..8d81e88f1d1ef 100644 +--- a/fs/overlayfs/ovl_entry.h ++++ b/fs/overlayfs/ovl_entry.h +@@ -27,6 +27,7 @@ struct ovl_sb { + }; + + struct ovl_layer { ++ /* ovl_free_fs() relies on @mnt being the first member! */ + struct vfsmount *mnt; + /* Trap in ovl inode cache */ + struct inode *trap; +@@ -37,6 +38,14 @@ struct ovl_layer { + int fsid; + }; + ++/* ++ * ovl_free_fs() relies on @mnt being the first member when unmounting ++ * the private mounts created for each layer. Let's check both the ++ * offset and type. ++ */ ++static_assert(offsetof(struct ovl_layer, mnt) == 0); ++static_assert(__same_type(typeof_member(struct ovl_layer, mnt), struct vfsmount *)); ++ + struct ovl_path { + struct ovl_layer *layer; + struct dentry *dentry; +-- +2.40.1 + diff --git a/queue-5.4/pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch b/queue-5.4/pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch new file mode 100644 index 00000000000..6a4ae385a2e --- /dev/null +++ b/queue-5.4/pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch @@ -0,0 +1,66 @@ +From db25c5d4740a8b0c83b5fc52c703c51ab0b8b3a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 20:45:29 +0200 +Subject: pcmcia: rsrc_nonstatic: Fix memory leak in + nonstatic_release_resource_db() + +From: Armin Wolf + +[ Upstream commit c85fd9422fe0f5d667305efb27f56d09eab120b0 ] + +When nonstatic_release_resource_db() frees all resources associated +with an PCMCIA socket, it forgets to free socket_data too, causing +a memory leak observable with kmemleak: + +unreferenced object 0xc28d1000 (size 64): + comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................ + 00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................ + backtrace: + [] __kmem_cache_alloc_node+0x2d7/0x4a0 + [<7e51f0c8>] kmalloc_trace+0x31/0xa4 + [] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc] + [] pcmcia_register_socket+0x200/0x35c [pcmcia_core] + [] yenta_probe+0x4d8/0xa70 [yenta_socket] + [] pci_device_probe+0x99/0x194 + [<84b7c690>] really_probe+0x181/0x45c + [<8060fe6e>] __driver_probe_device+0x75/0x1f4 + [] driver_probe_device+0x28/0xac + [<648b766f>] __driver_attach+0xeb/0x1e4 + [<6e9659eb>] bus_for_each_dev+0x61/0xb4 + [<25a669f3>] driver_attach+0x1e/0x28 + [] bus_add_driver+0x102/0x20c + [] driver_register+0x5b/0x120 + [<942cd8a4>] __pci_register_driver+0x44/0x4c + [] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support] + +Fix this by freeing socket_data too. + +Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding +the yenta_cardbus driver (yenta_socket). + +Signed-off-by: Armin Wolf +Message-ID: <20230512184529.5094-1-W_Armin@gmx.de> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index 3a512513cb32f..6b311d6f8bf02 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -1053,6 +1053,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s) + q = p->next; + kfree(p); + } ++ ++ kfree(data); + } + + +-- +2.40.1 + diff --git a/queue-5.4/pm-runtime-add-pm_runtime_get_if_active.patch b/queue-5.4/pm-runtime-add-pm_runtime_get_if_active.patch new file mode 100644 index 00000000000..7a9ee2df476 --- /dev/null +++ b/queue-5.4/pm-runtime-add-pm_runtime_get_if_active.patch @@ -0,0 +1,153 @@ +From 64fcd0cb29c323a972e7bfbcd8b5048fd0dff29a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 11:31:02 +0200 +Subject: PM: runtime: Add pm_runtime_get_if_active() + +From: Sakari Ailus + +[ Upstream commit c111566bea7ccd8a05e2c56f1fb3cbb6f4b7b441 ] + +pm_runtime_get_if_in_use() bumps up the PM-runtime usage count if it +is not equal to zero and the device's PM-runtime status is 'active'. +This works for drivers that do not use autoidle, but for those that +do, the function returns zero even when the device is active. + +In order to maintain sane device state while the device is powered on +in the hope that it'll be needed, pm_runtime_get_if_active(dev, true) +returns a positive value if the device's PM-runtime status is 'active' +when it is called, in which case it also increments the device's usage +count. + +If the second argument of pm_runtime_get_if_active() is 'false', the +function behaves just like pm_runtime_get_if_in_use(), so redefine +the latter as a wrapper around the former. + +Signed-off-by: Sakari Ailus +[ rjw: Changelog ] +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 81302b1c7c99 ("ALSA: hda: Fix unhandled register update during auto-suspend period") +Signed-off-by: Sasha Levin +--- + Documentation/power/runtime_pm.rst | 6 +++++ + drivers/base/power/runtime.c | 36 ++++++++++++++++++++++-------- + include/linux/pm_runtime.h | 12 +++++++++- + 3 files changed, 44 insertions(+), 10 deletions(-) + +diff --git a/Documentation/power/runtime_pm.rst b/Documentation/power/runtime_pm.rst +index 2c2ec99b50886..78bef529464fa 100644 +--- a/Documentation/power/runtime_pm.rst ++++ b/Documentation/power/runtime_pm.rst +@@ -382,6 +382,12 @@ drivers/base/power/runtime.c and include/linux/pm_runtime.h: + nonzero, increment the counter and return 1; otherwise return 0 without + changing the counter + ++ `int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count);` ++ - return -EINVAL if 'power.disable_depth' is nonzero; otherwise, if the ++ runtime PM status is RPM_ACTIVE, and either ign_usage_count is true ++ or the device's usage_count is non-zero, increment the counter and ++ return 1; otherwise return 0 without changing the counter ++ + `void pm_runtime_put_noidle(struct device *dev);` + - decrement the device's usage counter + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index 6e110c80079d7..7f93ac63b5b64 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1129,29 +1129,47 @@ int __pm_runtime_resume(struct device *dev, int rpmflags) + EXPORT_SYMBOL_GPL(__pm_runtime_resume); + + /** +- * pm_runtime_get_if_in_use - Conditionally bump up the device's usage counter. ++ * pm_runtime_get_if_active - Conditionally bump up the device's usage counter. + * @dev: Device to handle. + * + * Return -EINVAL if runtime PM is disabled for the device. + * +- * If that's not the case and if the device's runtime PM status is RPM_ACTIVE +- * and the runtime PM usage counter is nonzero, increment the counter and +- * return 1. Otherwise return 0 without changing the counter. ++ * Otherwise, if the device's runtime PM status is RPM_ACTIVE and either ++ * ign_usage_count is true or the device's usage_count is non-zero, increment ++ * the counter and return 1. Otherwise return 0 without changing the counter. ++ * ++ * If ign_usage_count is true, the function can be used to prevent suspending ++ * the device when its runtime PM status is RPM_ACTIVE. ++ * ++ * If ign_usage_count is false, the function can be used to prevent suspending ++ * the device when both its runtime PM status is RPM_ACTIVE and its usage_count ++ * is non-zero. ++ * ++ * The caller is resposible for putting the device's usage count when ther ++ * return value is greater than zero. + */ +-int pm_runtime_get_if_in_use(struct device *dev) ++int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count) + { + unsigned long flags; + int retval; + + spin_lock_irqsave(&dev->power.lock, flags); +- retval = dev->power.disable_depth > 0 ? -EINVAL : +- dev->power.runtime_status == RPM_ACTIVE +- && atomic_inc_not_zero(&dev->power.usage_count); ++ if (dev->power.disable_depth > 0) { ++ retval = -EINVAL; ++ } else if (dev->power.runtime_status != RPM_ACTIVE) { ++ retval = 0; ++ } else if (ign_usage_count) { ++ retval = 1; ++ atomic_inc(&dev->power.usage_count); ++ } else { ++ retval = atomic_inc_not_zero(&dev->power.usage_count); ++ } + trace_rpm_usage_rcuidle(dev, 0); + spin_unlock_irqrestore(&dev->power.lock, flags); ++ + return retval; + } +-EXPORT_SYMBOL_GPL(pm_runtime_get_if_in_use); ++EXPORT_SYMBOL_GPL(pm_runtime_get_if_active); + + /** + * __pm_runtime_set_status - Set runtime PM status of a device. +diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h +index 7145795b4b9da..f615e217e575a 100644 +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -38,7 +38,7 @@ extern int pm_runtime_force_resume(struct device *dev); + extern int __pm_runtime_idle(struct device *dev, int rpmflags); + extern int __pm_runtime_suspend(struct device *dev, int rpmflags); + extern int __pm_runtime_resume(struct device *dev, int rpmflags); +-extern int pm_runtime_get_if_in_use(struct device *dev); ++extern int pm_runtime_get_if_active(struct device *dev, bool ign_usage_count); + extern int pm_schedule_suspend(struct device *dev, unsigned int delay); + extern int __pm_runtime_set_status(struct device *dev, unsigned int status); + extern int pm_runtime_barrier(struct device *dev); +@@ -59,6 +59,11 @@ extern void pm_runtime_put_suppliers(struct device *dev); + extern void pm_runtime_new_link(struct device *dev); + extern void pm_runtime_drop_link(struct device_link *link); + ++static inline int pm_runtime_get_if_in_use(struct device *dev) ++{ ++ return pm_runtime_get_if_active(dev, false); ++} ++ + static inline void pm_suspend_ignore_children(struct device *dev, bool enable) + { + dev->power.ignore_children = enable; +@@ -142,6 +147,11 @@ static inline int pm_runtime_get_if_in_use(struct device *dev) + { + return -EINVAL; + } ++static inline int pm_runtime_get_if_active(struct device *dev, ++ bool ign_usage_count) ++{ ++ return -EINVAL; ++} + static inline int __pm_runtime_set_status(struct device *dev, + unsigned int status) { return 0; } + static inline int pm_runtime_barrier(struct device *dev) { return 0; } +-- +2.40.1 + diff --git a/queue-5.4/pm-runtime-add-tracepoints-for-usage_count-changes.patch b/queue-5.4/pm-runtime-add-tracepoints-for-usage_count-changes.patch new file mode 100644 index 00000000000..2cacef1e42f --- /dev/null +++ b/queue-5.4/pm-runtime-add-tracepoints-for-usage_count-changes.patch @@ -0,0 +1,100 @@ +From 4b9413647fdbe1676e00223aaf66e2924ccbaa10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2020 17:27:57 +0100 +Subject: PM-runtime: add tracepoints for usage_count changes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +[ Upstream commit d229290689ae0f6eae068ef142de4fd61ab4ba50 ] + +Add tracepoints to remaining places where device's power.usage_count +is changed. + +This helps debugging where and why autosuspend is prevented. + +Signed-off-by: Michał Mirosław +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: 81302b1c7c99 ("ALSA: hda: Fix unhandled register update during auto-suspend period") +Signed-off-by: Sasha Levin +--- + drivers/base/power/runtime.c | 13 +++++++++++-- + include/trace/events/rpm.h | 6 ++++++ + 2 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index d5c2d86fbecd4..6e110c80079d7 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1048,8 +1048,10 @@ int __pm_runtime_idle(struct device *dev, int rpmflags) + int retval; + + if (rpmflags & RPM_GET_PUT) { +- if (!atomic_dec_and_test(&dev->power.usage_count)) ++ if (!atomic_dec_and_test(&dev->power.usage_count)) { ++ trace_rpm_usage_rcuidle(dev, rpmflags); + return 0; ++ } + } + + might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); +@@ -1080,8 +1082,10 @@ int __pm_runtime_suspend(struct device *dev, int rpmflags) + int retval; + + if (rpmflags & RPM_GET_PUT) { +- if (!atomic_dec_and_test(&dev->power.usage_count)) ++ if (!atomic_dec_and_test(&dev->power.usage_count)) { ++ trace_rpm_usage_rcuidle(dev, rpmflags); + return 0; ++ } + } + + might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); +@@ -1143,6 +1147,7 @@ int pm_runtime_get_if_in_use(struct device *dev) + retval = dev->power.disable_depth > 0 ? -EINVAL : + dev->power.runtime_status == RPM_ACTIVE + && atomic_inc_not_zero(&dev->power.usage_count); ++ trace_rpm_usage_rcuidle(dev, 0); + spin_unlock_irqrestore(&dev->power.lock, flags); + return retval; + } +@@ -1476,6 +1481,8 @@ void pm_runtime_allow(struct device *dev) + dev->power.runtime_auto = true; + if (atomic_dec_and_test(&dev->power.usage_count)) + rpm_idle(dev, RPM_AUTO | RPM_ASYNC); ++ else ++ trace_rpm_usage_rcuidle(dev, RPM_AUTO | RPM_ASYNC); + + out: + spin_unlock_irq(&dev->power.lock); +@@ -1543,6 +1550,8 @@ static void update_autosuspend(struct device *dev, int old_delay, int old_use) + if (!old_use || old_delay >= 0) { + atomic_inc(&dev->power.usage_count); + rpm_resume(dev, 0); ++ } else { ++ trace_rpm_usage_rcuidle(dev, 0); + } + } + +diff --git a/include/trace/events/rpm.h b/include/trace/events/rpm.h +index 26927a560eabc..3c716214dab1a 100644 +--- a/include/trace/events/rpm.h ++++ b/include/trace/events/rpm.h +@@ -74,6 +74,12 @@ DEFINE_EVENT(rpm_internal, rpm_idle, + + TP_ARGS(dev, flags) + ); ++DEFINE_EVENT(rpm_internal, rpm_usage, ++ ++ TP_PROTO(struct device *dev, int flags), ++ ++ TP_ARGS(dev, flags) ++); + + TRACE_EVENT(rpm_return_int, + TP_PROTO(struct device *dev, unsigned long ip, int ret), +-- +2.40.1 + diff --git a/queue-5.4/powerpc-kasan-disable-kcov-in-kasan-code.patch b/queue-5.4/powerpc-kasan-disable-kcov-in-kasan-code.patch new file mode 100644 index 00000000000..b7f14840780 --- /dev/null +++ b/queue-5.4/powerpc-kasan-disable-kcov-in-kasan-code.patch @@ -0,0 +1,39 @@ +From ff36b9182a2eff5be2adfe794e9414bd6c90e3f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jul 2023 14:41:43 +1000 +Subject: powerpc/kasan: Disable KCOV in KASAN code + +From: Benjamin Gray + +[ Upstream commit ccb381e1af1ace292153c88eb1fffa5683d16a20 ] + +As per the generic KASAN code in mm/kasan, disable KCOV with +KCOV_INSTRUMENT := n in the makefile. + +This fixes a ppc64 boot hang when KCOV and KASAN are enabled. +kasan_early_init() gets called before a PACA is initialised, but the +KCOV hook expects a valid PACA. + +Suggested-by: Christophe Leroy +Signed-off-by: Benjamin Gray +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230710044143.146840-1-bgray@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/kasan/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/mm/kasan/Makefile b/arch/powerpc/mm/kasan/Makefile +index 6577897673dda..22f1a7c3f4362 100644 +--- a/arch/powerpc/mm/kasan/Makefile ++++ b/arch/powerpc/mm/kasan/Makefile +@@ -1,5 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + + KASAN_SANITIZE := n ++KCOV_INSTRUMENT := n + + obj-$(CONFIG_PPC32) += kasan_init_32.o +-- +2.40.1 + diff --git a/queue-5.4/quota-fix-warning-in-dqgrab.patch b/queue-5.4/quota-fix-warning-in-dqgrab.patch new file mode 100644 index 00000000000..cf68aaedd2a --- /dev/null +++ b/queue-5.4/quota-fix-warning-in-dqgrab.patch @@ -0,0 +1,104 @@ +From 50268312de8551e813632c7767a7f19a4a35db5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 22:07:31 +0800 +Subject: quota: fix warning in dqgrab() + +From: Ye Bin + +[ Upstream commit d6a95db3c7ad160bc16b89e36449705309b52bcb ] + +There's issue as follows when do fault injection: +WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 +Modules linked in: +CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541 +RIP: 0010:dquot_disable+0x13b7/0x18c0 +RSP: 0018:ffffc9000acc79e0 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980 +RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002 +RBP: ffff888179f68000 R08: ffffffff82087ca7 R09: 0000000000000000 +R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130 +R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118 +FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + dquot_load_quota_sb+0xd53/0x1060 + dquot_resume+0x172/0x230 + ext4_reconfigure+0x1dc6/0x27b0 + reconfigure_super+0x515/0xa90 + __x64_sys_fsconfig+0xb19/0xd20 + do_syscall_64+0x39/0xb0 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Above issue may happens as follows: +ProcessA ProcessB ProcessC +sys_fsconfig + vfs_fsconfig_locked + reconfigure_super + ext4_remount + dquot_suspend -> suspend all type quota + + sys_fsconfig + vfs_fsconfig_locked + reconfigure_super + ext4_remount + dquot_resume + ret = dquot_load_quota_sb + add_dquot_ref + do_open -> open file O_RDWR + vfs_open + do_dentry_open + get_write_access + atomic_inc_unless_negative(&inode->i_writecount) + ext4_file_open + dquot_file_open + dquot_initialize + __dquot_initialize + dqget + atomic_inc(&dquot->dq_count); + + __dquot_initialize + __dquot_initialize + dqget + if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) + ext4_acquire_dquot + -> Return error DQ_ACTIVE_B flag isn't set + dquot_disable + invalidate_dquots + if (atomic_read(&dquot->dq_count)) + dqgrab + WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) + -> Trigger warning + +In the above scenario, 'dquot->dq_flags' has no DQ_ACTIVE_B is normal when +dqgrab(). +To solve above issue just replace the dqgrab() use in invalidate_dquots() with +atomic_inc(&dquot->dq_count). + +Signed-off-by: Ye Bin +Signed-off-by: Jan Kara +Message-Id: <20230605140731.2427629-3-yebin10@huawei.com> +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 44175f37bfeb5..3d1a71d2909bb 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -546,7 +546,7 @@ static void invalidate_dquots(struct super_block *sb, int type) + continue; + /* Wait for dquot users */ + if (atomic_read(&dquot->dq_count)) { +- dqgrab(dquot); ++ atomic_inc(&dquot->dq_count); + spin_unlock(&dq_list_lock); + /* + * Once dqput() wakes us up, we know it's time to free +-- +2.40.1 + diff --git a/queue-5.4/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch b/queue-5.4/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch new file mode 100644 index 00000000000..88a2f45cccd --- /dev/null +++ b/queue-5.4/quota-properly-disable-quotas-when-add_dquot_ref-fai.patch @@ -0,0 +1,43 @@ +From 39ba8c7aa3d9f723b546e8f604236ce6c9096e2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 22:07:30 +0800 +Subject: quota: Properly disable quotas when add_dquot_ref() fails + +From: Jan Kara + +[ Upstream commit 6a4e3363792e30177cc3965697e34ddcea8b900b ] + +When add_dquot_ref() fails (usually due to IO error or ENOMEM), we want +to disable quotas we are trying to enable. However dquot_disable() call +was passed just the flags we are enabling so in case flags == +DQUOT_USAGE_ENABLED dquot_disable() call will just fail with EINVAL +instead of properly disabling quotas. Fix the problem by always passing +DQUOT_LIMITS_ENABLED | DQUOT_USAGE_ENABLED to dquot_disable() in this +case. + +Reported-and-tested-by: Ye Bin +Reported-by: syzbot+e633c79ceaecbf479854@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Message-Id: <20230605140731.2427629-2-yebin10@huawei.com> +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 1d652af48f0b1..44175f37bfeb5 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -2415,7 +2415,8 @@ int dquot_load_quota_sb(struct super_block *sb, int type, int format_id, + + error = add_dquot_ref(sb, type); + if (error) +- dquot_disable(sb, type, flags); ++ dquot_disable(sb, type, ++ DQUOT_USAGE_ENABLED | DQUOT_LIMITS_ENABLED); + + return error; + out_fmt: +-- +2.40.1 + diff --git a/queue-5.4/riscv-mmio-fix-readx-to-delay-ordering.patch b/queue-5.4/riscv-mmio-fix-readx-to-delay-ordering.patch new file mode 100644 index 00000000000..181c857b23d --- /dev/null +++ b/queue-5.4/riscv-mmio-fix-readx-to-delay-ordering.patch @@ -0,0 +1,73 @@ +From 7ef32e3e7eea1d41b5a7b283a715e565114328a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Aug 2023 06:27:38 +0200 +Subject: riscv,mmio: Fix readX()-to-delay() ordering + +From: Andrea Parri + +[ Upstream commit 4eb2eb1b4c0eb07793c240744843498564a67b83 ] + +Section 2.1 of the Platform Specification [1] states: + + Unless otherwise specified by a given I/O device, I/O devices are on + ordering channel 0 (i.e., they are point-to-point strongly ordered). + +which is not sufficient to guarantee that a readX() by a hart completes +before a subsequent delay() on the same hart (cf. memory-barriers.txt, +"Kernel I/O barrier effects"). + +Set the I(nput) bit in __io_ar() to restore the ordering, align inline +comments. + +[1] https://github.com/riscv/riscv-platform-specs + +Signed-off-by: Andrea Parri +Link: https://lore.kernel.org/r/20230803042738.5937-1-parri.andrea@gmail.com +Fixes: fab957c11efe ("RISC-V: Atomic and Locking Code") +Cc: stable@vger.kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/mmio.h | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/riscv/include/asm/mmio.h b/arch/riscv/include/asm/mmio.h +index 308b98f857539..2c08dd4292b27 100644 +--- a/arch/riscv/include/asm/mmio.h ++++ b/arch/riscv/include/asm/mmio.h +@@ -114,9 +114,9 @@ static inline u64 __raw_readq(const volatile void __iomem *addr) + * Relaxed I/O memory access primitives. These follow the Device memory + * ordering rules but do not guarantee any ordering relative to Normal memory + * accesses. These are defined to order the indicated access (either a read or +- * write) with all other I/O memory accesses. Since the platform specification +- * defines that all I/O regions are strongly ordered on channel 2, no explicit +- * fences are required to enforce this ordering. ++ * write) with all other I/O memory accesses to the same peripheral. Since the ++ * platform specification defines that all I/O regions are strongly ordered on ++ * channel 0, no explicit fences are required to enforce this ordering. + */ + /* FIXME: These are now the same as asm-generic */ + #define __io_rbr() do {} while (0) +@@ -138,14 +138,14 @@ static inline u64 __raw_readq(const volatile void __iomem *addr) + #endif + + /* +- * I/O memory access primitives. Reads are ordered relative to any +- * following Normal memory access. Writes are ordered relative to any prior +- * Normal memory access. The memory barriers here are necessary as RISC-V ++ * I/O memory access primitives. Reads are ordered relative to any following ++ * Normal memory read and delay() loop. Writes are ordered relative to any ++ * prior Normal memory write. The memory barriers here are necessary as RISC-V + * doesn't define any ordering between the memory space and the I/O space. + */ + #define __io_br() do {} while (0) +-#define __io_ar(v) __asm__ __volatile__ ("fence i,r" : : : "memory") +-#define __io_bw() __asm__ __volatile__ ("fence w,o" : : : "memory") ++#define __io_ar(v) ({ __asm__ __volatile__ ("fence i,ir" : : : "memory"); }) ++#define __io_bw() ({ __asm__ __volatile__ ("fence w,o" : : : "memory"); }) + #define __io_aw() mmiowb_set_pending() + + #define readb(c) ({ u8 __v; __io_br(); __v = readb_cpu(c); __io_ar(__v); __v; }) +-- +2.40.1 + diff --git a/queue-5.4/riscv-separate-mmio-functions-into-their-own-header-.patch b/queue-5.4/riscv-separate-mmio-functions-into-their-own-header-.patch new file mode 100644 index 00000000000..fd191180c45 --- /dev/null +++ b/queue-5.4/riscv-separate-mmio-functions-into-their-own-header-.patch @@ -0,0 +1,365 @@ +From 07f9e54dc546bb925eb3e40e9bc32c75453c55f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 13:53:50 -0700 +Subject: riscv: separate MMIO functions into their own header file + +From: Paul Walmsley + +[ Upstream commit 0c3ac28931d578324e93afab6ee7b740dfdaff6f ] + +Separate the low-level MMIO static inline functions and macros, such +as {read,write}{b,w,l,q}(), into their own header file under +arch/riscv/include: asm/mmio.h. This is done to break a header +dependency chain that arises when both asm/pgtable.h and asm/io.h are +included by asm/timex.h. Since the problem is related to the legacy +I/O port support in asm/io.h, this allows files under arch/riscv that +encounter those issues to simply include asm/mmio.h instead, and +bypass the legacy I/O port functions. Existing users of asm/io.h +don't need to change anything, since asm/mmio.h is included by +asm/io.h. + +While here, clean up some checkpatch.pl-related issues with the +original code. + +Signed-off-by: Paul Walmsley +Stable-dep-of: 4eb2eb1b4c0e ("riscv,mmio: Fix readX()-to-delay() ordering") +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/io.h | 147 +----------------------------- + arch/riscv/include/asm/mmio.h | 164 ++++++++++++++++++++++++++++++++++ + 2 files changed, 167 insertions(+), 144 deletions(-) + create mode 100644 arch/riscv/include/asm/mmio.h + +diff --git a/arch/riscv/include/asm/io.h b/arch/riscv/include/asm/io.h +index 2dc5b01d62df8..f08527e62b114 100644 +--- a/arch/riscv/include/asm/io.h ++++ b/arch/riscv/include/asm/io.h +@@ -15,152 +15,11 @@ + #include + #include + +-extern void __iomem *ioremap(phys_addr_t offset, unsigned long size); +- +-/* +- * The RISC-V ISA doesn't yet specify how to query or modify PMAs, so we can't +- * change the properties of memory regions. This should be fixed by the +- * upcoming platform spec. +- */ +-#define ioremap_nocache(addr, size) ioremap((addr), (size)) +-#define ioremap_wc(addr, size) ioremap((addr), (size)) +-#define ioremap_wt(addr, size) ioremap((addr), (size)) +- +-extern void iounmap(volatile void __iomem *addr); +- +-/* Generic IO read/write. These perform native-endian accesses. */ +-#define __raw_writeb __raw_writeb +-static inline void __raw_writeb(u8 val, volatile void __iomem *addr) +-{ +- asm volatile("sb %0, 0(%1)" : : "r" (val), "r" (addr)); +-} +- +-#define __raw_writew __raw_writew +-static inline void __raw_writew(u16 val, volatile void __iomem *addr) +-{ +- asm volatile("sh %0, 0(%1)" : : "r" (val), "r" (addr)); +-} +- +-#define __raw_writel __raw_writel +-static inline void __raw_writel(u32 val, volatile void __iomem *addr) +-{ +- asm volatile("sw %0, 0(%1)" : : "r" (val), "r" (addr)); +-} +- +-#ifdef CONFIG_64BIT +-#define __raw_writeq __raw_writeq +-static inline void __raw_writeq(u64 val, volatile void __iomem *addr) +-{ +- asm volatile("sd %0, 0(%1)" : : "r" (val), "r" (addr)); +-} +-#endif +- +-#define __raw_readb __raw_readb +-static inline u8 __raw_readb(const volatile void __iomem *addr) +-{ +- u8 val; +- +- asm volatile("lb %0, 0(%1)" : "=r" (val) : "r" (addr)); +- return val; +-} +- +-#define __raw_readw __raw_readw +-static inline u16 __raw_readw(const volatile void __iomem *addr) +-{ +- u16 val; +- +- asm volatile("lh %0, 0(%1)" : "=r" (val) : "r" (addr)); +- return val; +-} +- +-#define __raw_readl __raw_readl +-static inline u32 __raw_readl(const volatile void __iomem *addr) +-{ +- u32 val; +- +- asm volatile("lw %0, 0(%1)" : "=r" (val) : "r" (addr)); +- return val; +-} +- +-#ifdef CONFIG_64BIT +-#define __raw_readq __raw_readq +-static inline u64 __raw_readq(const volatile void __iomem *addr) +-{ +- u64 val; +- +- asm volatile("ld %0, 0(%1)" : "=r" (val) : "r" (addr)); +- return val; +-} +-#endif +- + /* +- * Unordered I/O memory access primitives. These are even more relaxed than +- * the relaxed versions, as they don't even order accesses between successive +- * operations to the I/O regions. ++ * MMIO access functions are separated out to break dependency cycles ++ * when using {read,write}* fns in low-level headers + */ +-#define readb_cpu(c) ({ u8 __r = __raw_readb(c); __r; }) +-#define readw_cpu(c) ({ u16 __r = le16_to_cpu((__force __le16)__raw_readw(c)); __r; }) +-#define readl_cpu(c) ({ u32 __r = le32_to_cpu((__force __le32)__raw_readl(c)); __r; }) +- +-#define writeb_cpu(v,c) ((void)__raw_writeb((v),(c))) +-#define writew_cpu(v,c) ((void)__raw_writew((__force u16)cpu_to_le16(v),(c))) +-#define writel_cpu(v,c) ((void)__raw_writel((__force u32)cpu_to_le32(v),(c))) +- +-#ifdef CONFIG_64BIT +-#define readq_cpu(c) ({ u64 __r = le64_to_cpu((__force __le64)__raw_readq(c)); __r; }) +-#define writeq_cpu(v,c) ((void)__raw_writeq((__force u64)cpu_to_le64(v),(c))) +-#endif +- +-/* +- * Relaxed I/O memory access primitives. These follow the Device memory +- * ordering rules but do not guarantee any ordering relative to Normal memory +- * accesses. These are defined to order the indicated access (either a read or +- * write) with all other I/O memory accesses. Since the platform specification +- * defines that all I/O regions are strongly ordered on channel 2, no explicit +- * fences are required to enforce this ordering. +- */ +-/* FIXME: These are now the same as asm-generic */ +-#define __io_rbr() do {} while (0) +-#define __io_rar() do {} while (0) +-#define __io_rbw() do {} while (0) +-#define __io_raw() do {} while (0) +- +-#define readb_relaxed(c) ({ u8 __v; __io_rbr(); __v = readb_cpu(c); __io_rar(); __v; }) +-#define readw_relaxed(c) ({ u16 __v; __io_rbr(); __v = readw_cpu(c); __io_rar(); __v; }) +-#define readl_relaxed(c) ({ u32 __v; __io_rbr(); __v = readl_cpu(c); __io_rar(); __v; }) +- +-#define writeb_relaxed(v,c) ({ __io_rbw(); writeb_cpu((v),(c)); __io_raw(); }) +-#define writew_relaxed(v,c) ({ __io_rbw(); writew_cpu((v),(c)); __io_raw(); }) +-#define writel_relaxed(v,c) ({ __io_rbw(); writel_cpu((v),(c)); __io_raw(); }) +- +-#ifdef CONFIG_64BIT +-#define readq_relaxed(c) ({ u64 __v; __io_rbr(); __v = readq_cpu(c); __io_rar(); __v; }) +-#define writeq_relaxed(v,c) ({ __io_rbw(); writeq_cpu((v),(c)); __io_raw(); }) +-#endif +- +-/* +- * I/O memory access primitives. Reads are ordered relative to any +- * following Normal memory access. Writes are ordered relative to any prior +- * Normal memory access. The memory barriers here are necessary as RISC-V +- * doesn't define any ordering between the memory space and the I/O space. +- */ +-#define __io_br() do {} while (0) +-#define __io_ar(v) __asm__ __volatile__ ("fence i,r" : : : "memory"); +-#define __io_bw() __asm__ __volatile__ ("fence w,o" : : : "memory"); +-#define __io_aw() mmiowb_set_pending() +- +-#define readb(c) ({ u8 __v; __io_br(); __v = readb_cpu(c); __io_ar(__v); __v; }) +-#define readw(c) ({ u16 __v; __io_br(); __v = readw_cpu(c); __io_ar(__v); __v; }) +-#define readl(c) ({ u32 __v; __io_br(); __v = readl_cpu(c); __io_ar(__v); __v; }) +- +-#define writeb(v,c) ({ __io_bw(); writeb_cpu((v),(c)); __io_aw(); }) +-#define writew(v,c) ({ __io_bw(); writew_cpu((v),(c)); __io_aw(); }) +-#define writel(v,c) ({ __io_bw(); writel_cpu((v),(c)); __io_aw(); }) +- +-#ifdef CONFIG_64BIT +-#define readq(c) ({ u64 __v; __io_br(); __v = readq_cpu(c); __io_ar(__v); __v; }) +-#define writeq(v,c) ({ __io_bw(); writeq_cpu((v),(c)); __io_aw(); }) +-#endif ++#include + + /* + * I/O port access constants. +diff --git a/arch/riscv/include/asm/mmio.h b/arch/riscv/include/asm/mmio.h +new file mode 100644 +index 0000000000000..308b98f857539 +--- /dev/null ++++ b/arch/riscv/include/asm/mmio.h +@@ -0,0 +1,164 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++/* ++ * {read,write}{b,w,l,q} based on arch/arm64/include/asm/io.h ++ * which was based on arch/arm/include/io.h ++ * ++ * Copyright (C) 1996-2000 Russell King ++ * Copyright (C) 2012 ARM Ltd. ++ * Copyright (C) 2014 Regents of the University of California ++ */ ++ ++#ifndef _ASM_RISCV_MMIO_H ++#define _ASM_RISCV_MMIO_H ++ ++#include ++#include ++ ++void __iomem *ioremap(phys_addr_t offset, unsigned long size); ++ ++/* ++ * The RISC-V ISA doesn't yet specify how to query or modify PMAs, so we can't ++ * change the properties of memory regions. This should be fixed by the ++ * upcoming platform spec. ++ */ ++#define ioremap_nocache(addr, size) ioremap((addr), (size)) ++#define ioremap_wc(addr, size) ioremap((addr), (size)) ++#define ioremap_wt(addr, size) ioremap((addr), (size)) ++ ++void iounmap(volatile void __iomem *addr); ++ ++/* Generic IO read/write. These perform native-endian accesses. */ ++#define __raw_writeb __raw_writeb ++static inline void __raw_writeb(u8 val, volatile void __iomem *addr) ++{ ++ asm volatile("sb %0, 0(%1)" : : "r" (val), "r" (addr)); ++} ++ ++#define __raw_writew __raw_writew ++static inline void __raw_writew(u16 val, volatile void __iomem *addr) ++{ ++ asm volatile("sh %0, 0(%1)" : : "r" (val), "r" (addr)); ++} ++ ++#define __raw_writel __raw_writel ++static inline void __raw_writel(u32 val, volatile void __iomem *addr) ++{ ++ asm volatile("sw %0, 0(%1)" : : "r" (val), "r" (addr)); ++} ++ ++#ifdef CONFIG_64BIT ++#define __raw_writeq __raw_writeq ++static inline void __raw_writeq(u64 val, volatile void __iomem *addr) ++{ ++ asm volatile("sd %0, 0(%1)" : : "r" (val), "r" (addr)); ++} ++#endif ++ ++#define __raw_readb __raw_readb ++static inline u8 __raw_readb(const volatile void __iomem *addr) ++{ ++ u8 val; ++ ++ asm volatile("lb %0, 0(%1)" : "=r" (val) : "r" (addr)); ++ return val; ++} ++ ++#define __raw_readw __raw_readw ++static inline u16 __raw_readw(const volatile void __iomem *addr) ++{ ++ u16 val; ++ ++ asm volatile("lh %0, 0(%1)" : "=r" (val) : "r" (addr)); ++ return val; ++} ++ ++#define __raw_readl __raw_readl ++static inline u32 __raw_readl(const volatile void __iomem *addr) ++{ ++ u32 val; ++ ++ asm volatile("lw %0, 0(%1)" : "=r" (val) : "r" (addr)); ++ return val; ++} ++ ++#ifdef CONFIG_64BIT ++#define __raw_readq __raw_readq ++static inline u64 __raw_readq(const volatile void __iomem *addr) ++{ ++ u64 val; ++ ++ asm volatile("ld %0, 0(%1)" : "=r" (val) : "r" (addr)); ++ return val; ++} ++#endif ++ ++/* ++ * Unordered I/O memory access primitives. These are even more relaxed than ++ * the relaxed versions, as they don't even order accesses between successive ++ * operations to the I/O regions. ++ */ ++#define readb_cpu(c) ({ u8 __r = __raw_readb(c); __r; }) ++#define readw_cpu(c) ({ u16 __r = le16_to_cpu((__force __le16)__raw_readw(c)); __r; }) ++#define readl_cpu(c) ({ u32 __r = le32_to_cpu((__force __le32)__raw_readl(c)); __r; }) ++ ++#define writeb_cpu(v, c) ((void)__raw_writeb((v), (c))) ++#define writew_cpu(v, c) ((void)__raw_writew((__force u16)cpu_to_le16(v), (c))) ++#define writel_cpu(v, c) ((void)__raw_writel((__force u32)cpu_to_le32(v), (c))) ++ ++#ifdef CONFIG_64BIT ++#define readq_cpu(c) ({ u64 __r = le64_to_cpu((__force __le64)__raw_readq(c)); __r; }) ++#define writeq_cpu(v, c) ((void)__raw_writeq((__force u64)cpu_to_le64(v), (c))) ++#endif ++ ++/* ++ * Relaxed I/O memory access primitives. These follow the Device memory ++ * ordering rules but do not guarantee any ordering relative to Normal memory ++ * accesses. These are defined to order the indicated access (either a read or ++ * write) with all other I/O memory accesses. Since the platform specification ++ * defines that all I/O regions are strongly ordered on channel 2, no explicit ++ * fences are required to enforce this ordering. ++ */ ++/* FIXME: These are now the same as asm-generic */ ++#define __io_rbr() do {} while (0) ++#define __io_rar() do {} while (0) ++#define __io_rbw() do {} while (0) ++#define __io_raw() do {} while (0) ++ ++#define readb_relaxed(c) ({ u8 __v; __io_rbr(); __v = readb_cpu(c); __io_rar(); __v; }) ++#define readw_relaxed(c) ({ u16 __v; __io_rbr(); __v = readw_cpu(c); __io_rar(); __v; }) ++#define readl_relaxed(c) ({ u32 __v; __io_rbr(); __v = readl_cpu(c); __io_rar(); __v; }) ++ ++#define writeb_relaxed(v, c) ({ __io_rbw(); writeb_cpu((v), (c)); __io_raw(); }) ++#define writew_relaxed(v, c) ({ __io_rbw(); writew_cpu((v), (c)); __io_raw(); }) ++#define writel_relaxed(v, c) ({ __io_rbw(); writel_cpu((v), (c)); __io_raw(); }) ++ ++#ifdef CONFIG_64BIT ++#define readq_relaxed(c) ({ u64 __v; __io_rbr(); __v = readq_cpu(c); __io_rar(); __v; }) ++#define writeq_relaxed(v, c) ({ __io_rbw(); writeq_cpu((v), (c)); __io_raw(); }) ++#endif ++ ++/* ++ * I/O memory access primitives. Reads are ordered relative to any ++ * following Normal memory access. Writes are ordered relative to any prior ++ * Normal memory access. The memory barriers here are necessary as RISC-V ++ * doesn't define any ordering between the memory space and the I/O space. ++ */ ++#define __io_br() do {} while (0) ++#define __io_ar(v) __asm__ __volatile__ ("fence i,r" : : : "memory") ++#define __io_bw() __asm__ __volatile__ ("fence w,o" : : : "memory") ++#define __io_aw() mmiowb_set_pending() ++ ++#define readb(c) ({ u8 __v; __io_br(); __v = readb_cpu(c); __io_ar(__v); __v; }) ++#define readw(c) ({ u16 __v; __io_br(); __v = readw_cpu(c); __io_ar(__v); __v; }) ++#define readl(c) ({ u32 __v; __io_br(); __v = readl_cpu(c); __io_ar(__v); __v; }) ++ ++#define writeb(v, c) ({ __io_bw(); writeb_cpu((v), (c)); __io_aw(); }) ++#define writew(v, c) ({ __io_bw(); writew_cpu((v), (c)); __io_aw(); }) ++#define writel(v, c) ({ __io_bw(); writel_cpu((v), (c)); __io_aw(); }) ++ ++#ifdef CONFIG_64BIT ++#define readq(c) ({ u64 __v; __io_br(); __v = readq_cpu(c); __io_ar(__v); __v; }) ++#define writeq(v, c) ({ __io_bw(); writeq_cpu((v), (c)); __io_aw(); }) ++#endif ++ ++#endif /* _ASM_RISCV_MMIO_H */ +-- +2.40.1 + diff --git a/queue-5.4/selftests-forwarding-tc_flower-relax-success-criteri.patch b/queue-5.4/selftests-forwarding-tc_flower-relax-success-criteri.patch new file mode 100644 index 00000000000..4df162e21c9 --- /dev/null +++ b/queue-5.4/selftests-forwarding-tc_flower-relax-success-criteri.patch @@ -0,0 +1,61 @@ +From 2f33007c46b4ba6bde6b4bea456a3d44f815b181 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 17:14:58 +0300 +Subject: selftests: forwarding: tc_flower: Relax success criterion + +From: Ido Schimmel + +[ Upstream commit 9ee37e53e7687654b487fc94e82569377272a7a8 ] + +The test checks that filters that match on source or destination MAC +were only hit once. A host can send more than one packet with a given +source or destination MAC, resulting in failures. + +Fix by relaxing the success criterion and instead check that the filters +were not hit zero times. Using tc_check_at_least_x_packets() is also an +option, but it is not available in older kernels. + +Fixes: 07e5c75184a1 ("selftests: forwarding: Introduce tc flower matching tests") +Reported-by: Mirsad Todorovac +Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Tested-by: Mirsad Todorovac +Reviewed-by: Hangbin Liu +Acked-by: Nikolay Aleksandrov +Link: https://lore.kernel.org/r/20230808141503.4060661-13-idosch@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/tc_flower.sh | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/tc_flower.sh b/tools/testing/selftests/net/forwarding/tc_flower.sh +index b11d8e6b5bc14..b7cdf75efb5f9 100755 +--- a/tools/testing/selftests/net/forwarding/tc_flower.sh ++++ b/tools/testing/selftests/net/forwarding/tc_flower.sh +@@ -49,8 +49,8 @@ match_dst_mac_test() + tc_check_packets "dev $h2 ingress" 101 1 + check_fail $? "Matched on a wrong filter" + +- tc_check_packets "dev $h2 ingress" 102 1 +- check_err $? "Did not match on correct filter" ++ tc_check_packets "dev $h2 ingress" 102 0 ++ check_fail $? "Did not match on correct filter" + + tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower + tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower +@@ -75,8 +75,8 @@ match_src_mac_test() + tc_check_packets "dev $h2 ingress" 101 1 + check_fail $? "Matched on a wrong filter" + +- tc_check_packets "dev $h2 ingress" 102 1 +- check_err $? "Did not match on correct filter" ++ tc_check_packets "dev $h2 ingress" 102 0 ++ check_fail $? "Did not match on correct filter" + + tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower + tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower +-- +2.40.1 + diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..47c64a30c1e --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,55 @@ +mmc-sdhci_f_sdh30-convert-to-devm_platform_ioremap_r.patch +mmc-sdhci-f-sdh30-replace-with-sdhci_pltfm.patch +riscv-separate-mmio-functions-into-their-own-header-.patch +riscv-mmio-fix-readx-to-delay-ordering.patch +selftests-forwarding-tc_flower-relax-success-criteri.patch +macsec-fix-traffic-counters-statistics.patch +macsec-use-dev_stats_inc.patch +drm-radeon-fix-integer-overflow-in-radeon_cs_parser_.patch +alsa-emu10k1-roll-up-loops-in-dsp-setup-code-for-aud.patch +quota-properly-disable-quotas-when-add_dquot_ref-fai.patch +quota-fix-warning-in-dqgrab.patch +hid-add-quirk-for-03f0-464a-hp-elite-presenter-mouse.patch +ovl-check-type-and-offset-of-struct-vfsmount-in-ovl_.patch +udf-fix-uninitialized-array-access-for-some-pathname.patch +fs-jfs-fix-ubsan-array-index-out-of-bounds-in-dballo.patch +mips-dec-prom-address-warray-bounds-warning.patch +fs-jfs-fix-null-ptr-deref-read-in-txbegin.patch +fs-jfs-check-for-read-only-mounted-filesystem-in-txb.patch +media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch +media-platform-mediatek-vpu-fix-null-ptr-dereference.patch +usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch +gfs2-fix-possible-data-races-in-gfs2_show_options.patch +pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch +bluetooth-l2cap-fix-use-after-free.patch +drm-amdgpu-fix-potential-fence-use-after-free-v2.patch +alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch +alsa-hda-fix-a-possible-null-pointer-dereference-due.patch +powerpc-kasan-disable-kcov-in-kasan-code.patch +ima-allow-fix-uml-builds.patch +iio-add-addac-subdirectory.patch +iio-adc-stx104-utilize-iomap-interface.patch +iio-adc-stx104-implement-and-utilize-register-struct.patch +iio-stx104-move-to-addac-subdirectory.patch +iio-addac-stx104-fix-race-condition-for-stx104_write.patch +iio-addac-stx104-fix-race-condition-when-converting-.patch +iommu-amd-fix-guest-virtual-apic-table-root-pointer-.patch +pm-runtime-add-tracepoints-for-usage_count-changes.patch +pm-runtime-add-pm_runtime_get_if_active.patch +alsa-hda-fix-unhandled-register-update-during-auto-s.patch +irqchip-mips-gic-get-rid-of-the-reliance-on-irq_cpu_.patch +irqchip-mips-gic-use-raw-spinlock-for-gic_lock.patch +interconnect-move-internal-structs-into-a-separate-f.patch +interconnect-add-helpers-for-enabling-disabling-a-pa.patch +usb-dwc3-qcom-add-helper-functions-to-enable-disable.patch +usb-dwc3-qcom-fix-null-deref-on-suspend.patch +mmc-sdhci-spear-fix-deferred-probing.patch +mmc-bcm2835-fix-deferred-probing.patch +mmc-sunxi-fix-deferred-probing.patch +leds-trigger-netdev-recheck-netdev_led_mode_linkup-o.patch +tracing-probes-have-process_fetch_insn-take-a-void-i.patch +tracing-probes-fix-to-update-dynamic-data-counter-if.patch +net-ncsi-fix-gma-flag-setting-after-response.patch +net-ncsi-change-from-ndo_set_mac_address-to-dev_set_.patch +nfsd4-kill-warnings-on-testing-stateids-with-mismatc.patch +nfsd-remove-incorrect-check-in-nfsd4_validate_statei.patch diff --git a/queue-5.4/tracing-probes-fix-to-update-dynamic-data-counter-if.patch b/queue-5.4/tracing-probes-fix-to-update-dynamic-data-counter-if.patch new file mode 100644 index 00000000000..2f7222595fe --- /dev/null +++ b/queue-5.4/tracing-probes-fix-to-update-dynamic-data-counter-if.patch @@ -0,0 +1,54 @@ +From 6f963506bb12705e44cc0dd48b032b9d11117151 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 23:15:48 +0900 +Subject: tracing/probes: Fix to update dynamic data counter if fetcharg uses + it + +From: Masami Hiramatsu (Google) + +[ Upstream commit e38e2c6a9efc435f9de344b7c91f7697e01b47d5 ] + +Fix to update dynamic data counter ('dyndata') and max length ('maxlen') +only if the fetcharg uses the dynamic data. Also get out arg->dynamic +from unlikely(). This makes dynamic data address wrong if +process_fetch_insn() returns error on !arg->dynamic case. + +Link: https://lore.kernel.org/all/168908494781.123124.8160245359962103684.stgit@devnote2/ + +Suggested-by: Steven Rostedt +Link: https://lore.kernel.org/all/20230710233400.5aaf024e@gandalf.local.home/ +Fixes: 9178412ddf5a ("tracing: probeevent: Return consumed bytes of dynamic area") +Cc: stable@vger.kernel.org +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_probe_tmpl.h | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h +index bbb479b3ba8fd..cf14a37dff8c8 100644 +--- a/kernel/trace/trace_probe_tmpl.h ++++ b/kernel/trace/trace_probe_tmpl.h +@@ -206,11 +206,13 @@ store_trace_args(void *data, struct trace_probe *tp, void *rec, + if (unlikely(arg->dynamic)) + *dl = make_data_loc(maxlen, dyndata - base); + ret = process_fetch_insn(arg->code, rec, dl, base); +- if (unlikely(ret < 0 && arg->dynamic)) { +- *dl = make_data_loc(0, dyndata - base); +- } else { +- dyndata += ret; +- maxlen -= ret; ++ if (arg->dynamic) { ++ if (unlikely(ret < 0)) { ++ *dl = make_data_loc(0, dyndata - base); ++ } else { ++ dyndata += ret; ++ maxlen -= ret; ++ } + } + } + } +-- +2.40.1 + diff --git a/queue-5.4/tracing-probes-have-process_fetch_insn-take-a-void-i.patch b/queue-5.4/tracing-probes-have-process_fetch_insn-take-a-void-i.patch new file mode 100644 index 00000000000..104fc523b77 --- /dev/null +++ b/queue-5.4/tracing-probes-have-process_fetch_insn-take-a-void-i.patch @@ -0,0 +1,97 @@ +From 02b66993f177f15297691556d2a2f92641087369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 00:13:28 -0400 +Subject: tracing/probes: Have process_fetch_insn() take a void * instead of + pt_regs + +From: Steven Rostedt (VMware) + +[ Upstream commit 8565a45d0858078b63c7d84074a21a42ba9ebf01 ] + +In preparation to allow event probes to use the process_fetch_insn() +callback in trace_probe_tmpl.h, change the data passed to it from a +pointer to pt_regs, as the event probe will not be using regs, and make it +a void pointer instead. + +Update the process_fetch_insn() callers for kprobe and uprobe events to +have the regs defined in the function and just typecast the void pointer +parameter. + +Link: https://lkml.kernel.org/r/20210819041842.291622924@goodmis.org + +Acked-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Stable-dep-of: e38e2c6a9efc ("tracing/probes: Fix to update dynamic data counter if fetcharg uses it") +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_kprobe.c | 3 ++- + kernel/trace/trace_probe_tmpl.h | 6 +++--- + kernel/trace/trace_uprobe.c | 3 ++- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index a422cf6a0358b..0b95277396fcd 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -1134,9 +1134,10 @@ probe_mem_read_user(void *dest, void *src, size_t size) + + /* Note that we don't verify it, since the code does not come from user space */ + static int +-process_fetch_insn(struct fetch_insn *code, struct pt_regs *regs, void *dest, ++process_fetch_insn(struct fetch_insn *code, void *rec, void *dest, + void *base) + { ++ struct pt_regs *regs = rec; + unsigned long val; + + retry: +diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h +index 29348874ebde7..bbb479b3ba8fd 100644 +--- a/kernel/trace/trace_probe_tmpl.h ++++ b/kernel/trace/trace_probe_tmpl.h +@@ -54,7 +54,7 @@ fetch_apply_bitfield(struct fetch_insn *code, void *buf) + * If dest is NULL, don't store result and return required dynamic data size. + */ + static int +-process_fetch_insn(struct fetch_insn *code, struct pt_regs *regs, ++process_fetch_insn(struct fetch_insn *code, void *rec, + void *dest, void *base); + static nokprobe_inline int fetch_store_strlen(unsigned long addr); + static nokprobe_inline int +@@ -190,7 +190,7 @@ __get_data_size(struct trace_probe *tp, struct pt_regs *regs) + + /* Store the value of each argument */ + static nokprobe_inline void +-store_trace_args(void *data, struct trace_probe *tp, struct pt_regs *regs, ++store_trace_args(void *data, struct trace_probe *tp, void *rec, + int header_size, int maxlen) + { + struct probe_arg *arg; +@@ -205,7 +205,7 @@ store_trace_args(void *data, struct trace_probe *tp, struct pt_regs *regs, + /* Point the dynamic data area if needed */ + if (unlikely(arg->dynamic)) + *dl = make_data_loc(maxlen, dyndata - base); +- ret = process_fetch_insn(arg->code, regs, dl, base); ++ ret = process_fetch_insn(arg->code, rec, dl, base); + if (unlikely(ret < 0 && arg->dynamic)) { + *dl = make_data_loc(0, dyndata - base); + } else { +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index efb51a23a14f2..1a566bc675485 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -217,9 +217,10 @@ static unsigned long translate_user_vaddr(unsigned long file_offset) + + /* Note that we don't verify it, since the code does not come from user space */ + static int +-process_fetch_insn(struct fetch_insn *code, struct pt_regs *regs, void *dest, ++process_fetch_insn(struct fetch_insn *code, void *rec, void *dest, + void *base) + { ++ struct pt_regs *regs = rec; + unsigned long val; + + /* 1st stage: get value from context */ +-- +2.40.1 + diff --git a/queue-5.4/udf-fix-uninitialized-array-access-for-some-pathname.patch b/queue-5.4/udf-fix-uninitialized-array-access-for-some-pathname.patch new file mode 100644 index 00000000000..939c54ed5bb --- /dev/null +++ b/queue-5.4/udf-fix-uninitialized-array-access-for-some-pathname.patch @@ -0,0 +1,39 @@ +From 615c4d9e27c97713b1f7761725d0e4b9089dc76b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 11:32:35 +0200 +Subject: udf: Fix uninitialized array access for some pathnames + +From: Jan Kara + +[ Upstream commit 028f6055c912588e6f72722d89c30b401bbcf013 ] + +For filenames that begin with . and are between 2 and 5 characters long, +UDF charset conversion code would read uninitialized memory in the +output buffer. The only practical impact is that the name may be prepended a +"unification hash" when it is not actually needed but still it is good +to fix this. + +Reported-by: syzbot+cd311b1e43cc25f90d18@syzkaller.appspotmail.com +Link: https://lore.kernel.org/all/000000000000e2638a05fe9dc8f9@google.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/unicode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c +index 622569007b530..2142cbd1dde24 100644 +--- a/fs/udf/unicode.c ++++ b/fs/udf/unicode.c +@@ -247,7 +247,7 @@ static int udf_name_from_CS0(struct super_block *sb, + } + + if (translate) { +- if (str_o_len <= 2 && str_o[0] == '.' && ++ if (str_o_len > 0 && str_o_len <= 2 && str_o[0] == '.' && + (str_o_len == 1 || str_o[1] == '.')) + needsCRC = 1; + if (needsCRC) { +-- +2.40.1 + diff --git a/queue-5.4/usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch b/queue-5.4/usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch new file mode 100644 index 00000000000..ceba73808dd --- /dev/null +++ b/queue-5.4/usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch @@ -0,0 +1,49 @@ +From c0d8fa7cb3447844bdd41d02cc7958645590ec7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 18:40:07 +0800 +Subject: usb: chipidea: imx: don't request QoS for imx8ulp + +From: Xu Yang + +[ Upstream commit 9a070e8e208995a9d638b538ed7abf28bd6ea6f0 ] + +Use dedicated imx8ulp usb compatible to remove QoS request +since imx8ulp has no such limitation of imx7ulp: DMA will +not work if system enters idle. + +Signed-off-by: Xu Yang +Signed-off-by: Li Jun +Acked-by: Peter Chen +Message-ID: <20230530104007.1294702-2-xu.yang_2@nxp.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c +index 85561b3194a16..0fe545815c5ce 100644 +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -70,6 +70,10 @@ static const struct ci_hdrc_imx_platform_flag imx7ulp_usb_data = { + CI_HDRC_PMQOS, + }; + ++static const struct ci_hdrc_imx_platform_flag imx8ulp_usb_data = { ++ .flags = CI_HDRC_SUPPORTS_RUNTIME_PM, ++}; ++ + static const struct of_device_id ci_hdrc_imx_dt_ids[] = { + { .compatible = "fsl,imx23-usb", .data = &imx23_usb_data}, + { .compatible = "fsl,imx28-usb", .data = &imx28_usb_data}, +@@ -80,6 +84,7 @@ static const struct of_device_id ci_hdrc_imx_dt_ids[] = { + { .compatible = "fsl,imx6ul-usb", .data = &imx6ul_usb_data}, + { .compatible = "fsl,imx7d-usb", .data = &imx7d_usb_data}, + { .compatible = "fsl,imx7ulp-usb", .data = &imx7ulp_usb_data}, ++ { .compatible = "fsl,imx8ulp-usb", .data = &imx8ulp_usb_data}, + { /* sentinel */ } + }; + MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids); +-- +2.40.1 + diff --git a/queue-5.4/usb-dwc3-qcom-add-helper-functions-to-enable-disable.patch b/queue-5.4/usb-dwc3-qcom-add-helper-functions-to-enable-disable.patch new file mode 100644 index 00000000000..7fc959720d0 --- /dev/null +++ b/queue-5.4/usb-dwc3-qcom-add-helper-functions-to-enable-disable.patch @@ -0,0 +1,108 @@ +From 207fca8964e374f1daf4f535b4f38af75328a4e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 10:00:52 +0530 +Subject: usb: dwc3: qcom: Add helper functions to enable,disable wake irqs + +From: Sandeep Maheswaram + +[ Upstream commit 360e8230516de94d74d30c64f0cdcf228b8e8b67 ] + +Adding helper functions to enable,disable wake irqs to make +the code simple and readable. + +Reviewed-by: Matthias Kaehlcke +Reviewed-by: Pavankumar Kondeti +Signed-off-by: Sandeep Maheswaram +Signed-off-by: Krishna Kurapati +Link: https://lore.kernel.org/r/1655094654-24052-4-git-send-email-quic_kriskura@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: d2d69354226d ("USB: dwc3: qcom: fix NULL-deref on suspend") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 58 ++++++++++++++++-------------------- + 1 file changed, 26 insertions(+), 32 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 2d7cfa8825aa8..e872e8baf0662 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -198,50 +198,44 @@ static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom) + return dwc->xhci; + } + ++static void dwc3_qcom_enable_wakeup_irq(int irq) ++{ ++ if (!irq) ++ return; ++ ++ enable_irq(irq); ++ enable_irq_wake(irq); ++} ++ ++static void dwc3_qcom_disable_wakeup_irq(int irq) ++{ ++ if (!irq) ++ return; ++ ++ disable_irq_wake(irq); ++ disable_irq_nosync(irq); ++} ++ + static void dwc3_qcom_disable_interrupts(struct dwc3_qcom *qcom) + { +- if (qcom->hs_phy_irq) { +- disable_irq_wake(qcom->hs_phy_irq); +- disable_irq_nosync(qcom->hs_phy_irq); +- } ++ dwc3_qcom_disable_wakeup_irq(qcom->hs_phy_irq); + +- if (qcom->dp_hs_phy_irq) { +- disable_irq_wake(qcom->dp_hs_phy_irq); +- disable_irq_nosync(qcom->dp_hs_phy_irq); +- } ++ dwc3_qcom_disable_wakeup_irq(qcom->dp_hs_phy_irq); + +- if (qcom->dm_hs_phy_irq) { +- disable_irq_wake(qcom->dm_hs_phy_irq); +- disable_irq_nosync(qcom->dm_hs_phy_irq); +- } ++ dwc3_qcom_disable_wakeup_irq(qcom->dm_hs_phy_irq); + +- if (qcom->ss_phy_irq) { +- disable_irq_wake(qcom->ss_phy_irq); +- disable_irq_nosync(qcom->ss_phy_irq); +- } ++ dwc3_qcom_disable_wakeup_irq(qcom->ss_phy_irq); + } + + static void dwc3_qcom_enable_interrupts(struct dwc3_qcom *qcom) + { +- if (qcom->hs_phy_irq) { +- enable_irq(qcom->hs_phy_irq); +- enable_irq_wake(qcom->hs_phy_irq); +- } ++ dwc3_qcom_enable_wakeup_irq(qcom->hs_phy_irq); + +- if (qcom->dp_hs_phy_irq) { +- enable_irq(qcom->dp_hs_phy_irq); +- enable_irq_wake(qcom->dp_hs_phy_irq); +- } ++ dwc3_qcom_enable_wakeup_irq(qcom->dp_hs_phy_irq); + +- if (qcom->dm_hs_phy_irq) { +- enable_irq(qcom->dm_hs_phy_irq); +- enable_irq_wake(qcom->dm_hs_phy_irq); +- } ++ dwc3_qcom_enable_wakeup_irq(qcom->dm_hs_phy_irq); + +- if (qcom->ss_phy_irq) { +- enable_irq(qcom->ss_phy_irq); +- enable_irq_wake(qcom->ss_phy_irq); +- } ++ dwc3_qcom_enable_wakeup_irq(qcom->ss_phy_irq); + } + + static int dwc3_qcom_suspend(struct dwc3_qcom *qcom) +-- +2.40.1 + diff --git a/queue-5.4/usb-dwc3-qcom-fix-null-deref-on-suspend.patch b/queue-5.4/usb-dwc3-qcom-fix-null-deref-on-suspend.patch new file mode 100644 index 00000000000..4082fbf062a --- /dev/null +++ b/queue-5.4/usb-dwc3-qcom-fix-null-deref-on-suspend.patch @@ -0,0 +1,68 @@ +From 158ae93cd6ac2dc4ff5be66d492793e8bc7db1d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 12:05:39 +0200 +Subject: USB: dwc3: qcom: fix NULL-deref on suspend + +From: Johan Hovold + +[ Upstream commit d2d69354226de0b333d4405981f3d9c41ba8430a ] + +The Qualcomm dwc3 glue driver is currently accessing the driver data of +the child core device during suspend and on wakeup interrupts. This is +clearly a bad idea as the child may not have probed yet or could have +been unbound from its driver. + +The first such layering violation was part of the initial version of the +driver, but this was later made worse when the hack that accesses the +driver data of the grand child xhci device to configure the wakeup +interrupts was added. + +Fixing this properly is not that easily done, so add a sanity check to +make sure that the child driver data is non-NULL before dereferencing it +for now. + +Note that this relies on subtleties like the fact that driver core is +making sure that the parent is not suspended while the child is probing. + +Reported-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/all/20230325165217.31069-4-manivannan.sadhasivam@linaro.org/ +Fixes: d9152161b4bf ("usb: dwc3: Add Qualcomm DWC3 glue layer driver") +Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") +Cc: stable@vger.kernel.org # 3.18: a872ab303d5d: "usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup" +Cc: Sandeep Maheswaram +Cc: Krishna Kurapati +Signed-off-by: Johan Hovold +Acked-by: Thinh Nguyen +Reviewed-by: Manivannan Sadhasivam +Message-ID: <20230607100540.31045-2-johan+linaro@kernel.org> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index e872e8baf0662..8c3ab9bfbb9e6 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -193,7 +193,16 @@ static int dwc3_qcom_register_extcon(struct dwc3_qcom *qcom) + /* Only usable in contexts where the role can not change. */ + static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom) + { +- struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3); ++ struct dwc3 *dwc; ++ ++ /* ++ * FIXME: Fix this layering violation. ++ */ ++ dwc = platform_get_drvdata(qcom->dwc3); ++ ++ /* Core driver may not have probed yet. */ ++ if (!dwc) ++ return false; + + return dwc->xhci; + } +-- +2.40.1 +