From: Sasha Levin Date: Mon, 6 Jun 2022 10:34:06 +0000 (-0400) Subject: Fixes for 5.17 X-Git-Tag: v5.10.121~140 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6a7f5d81b22d848816d418a2135d850767430c37;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.17 Signed-off-by: Sasha Levin --- diff --git a/queue-5.17/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch b/queue-5.17/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch new file mode 100644 index 00000000000..b3c056a2504 --- /dev/null +++ b/queue-5.17/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch @@ -0,0 +1,96 @@ +From 3d4ac479b7719e7d6aea18db22e363f62c4f6928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 11:08:59 +0200 +Subject: ACPI: CPPC: Assume no transition latency if no PCCT + +From: Pierre Gondois + +[ Upstream commit 6380b7b2b29da9d9c5ab2d4a265901cd93ba3696 ] + +The transition_delay_us (struct cpufreq_policy) is currently defined +as: + Preferred average time interval between consecutive invocations of + the driver to set the frequency for this policy. To be set by the + scaling driver (0, which is the default, means no preference). +The transition_latency represents the amount of time necessary for a +CPU to change its frequency. + +A PCCT table advertises mutliple values: +- pcc_nominal: Expected latency to process a command, in microseconds +- pcc_mpar: The maximum number of periodic requests that the subspace + channel can support, reported in commands per minute. 0 indicates no + limitation. +- pcc_mrtt: The minimum amount of time that OSPM must wait after the + completion of a command before issuing the next command, + in microseconds. +cppc_get_transition_latency() allows to get the max of them. + +commit d4f3388afd48 ("cpufreq / CPPC: Set platform specific +transition_delay_us") allows to select transition_delay_us based on +the platform, and fallbacks to cppc_get_transition_latency() +otherwise. + +If _CPC objects are not using PCC channels (no PPCT table), the +transition_delay_us is set to CPUFREQ_ETERNAL, leading to really long +periods between frequency updates (~4s). + +If the desired_reg, where performance requests are written, is in +SystemMemory or SystemIo ACPI address space, there is no delay +in requests. So return 0 instead of CPUFREQ_ETERNAL, leading to +transition_delay_us being set to LATENCY_MULTIPLIER us (1000 us). + +This patch also adds two macros to check the address spaces. + +Signed-off-by: Pierre Gondois +Reviewed-by: Sudeep Holla +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/cppc_acpi.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 123e98a765de..a7facd4b4ca8 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -100,6 +100,16 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr); + (cpc)->cpc_entry.reg.space_id == \ + ACPI_ADR_SPACE_PLATFORM_COMM) + ++/* Check if a CPC register is in SystemMemory */ ++#define CPC_IN_SYSTEM_MEMORY(cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ ++ (cpc)->cpc_entry.reg.space_id == \ ++ ACPI_ADR_SPACE_SYSTEM_MEMORY) ++ ++/* Check if a CPC register is in SystemIo */ ++#define CPC_IN_SYSTEM_IO(cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ ++ (cpc)->cpc_entry.reg.space_id == \ ++ ACPI_ADR_SPACE_SYSTEM_IO) ++ + /* Evaluates to True if reg is a NULL register descriptor */ + #define IS_NULL_REG(reg) ((reg)->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY && \ + (reg)->address == 0 && \ +@@ -1441,6 +1451,9 @@ EXPORT_SYMBOL_GPL(cppc_set_perf); + * transition latency for performance change requests. The closest we have + * is the timing information from the PCCT tables which provides the info + * on the number and frequency of PCC commands the platform can handle. ++ * ++ * If desired_reg is in the SystemMemory or SystemIo ACPI address space, ++ * then assume there is no latency. + */ + unsigned int cppc_get_transition_latency(int cpu_num) + { +@@ -1466,7 +1479,9 @@ unsigned int cppc_get_transition_latency(int cpu_num) + return CPUFREQ_ETERNAL; + + desired_reg = &cpc_desc->cpc_regs[DESIRED_PERF]; +- if (!CPC_IN_PCC(desired_reg)) ++ if (CPC_IN_SYSTEM_MEMORY(desired_reg) || CPC_IN_SYSTEM_IO(desired_reg)) ++ return 0; ++ else if (!CPC_IN_PCC(desired_reg)) + return CPUFREQ_ETERNAL; + + if (pcc_ss_id < 0) +-- +2.35.1 + diff --git a/queue-5.17/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch b/queue-5.17/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch new file mode 100644 index 00000000000..7e23ab64fc3 --- /dev/null +++ b/queue-5.17/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch @@ -0,0 +1,57 @@ +From 97e7a65b26a9bc042fd174387511a74c33e88738 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 08:11:36 -0500 +Subject: ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default + +From: Mario Limonciello + +[ Upstream commit d52848620de00cde4a3a5df908e231b8c8868250 ] + +ASUS B1400CEAE fails to resume from suspend to idle by default. This was +bisected back to commit df4f9bc4fb9c ("nvme-pci: add support for ACPI +StorageD3Enable property") but this is a red herring to the problem. + +Before this commit the system wasn't getting into deepest sleep state. +Presumably this commit is allowing entry into deepest sleep state as +advertised by firmware, but there are some other problems related to +the wakeup. + +As it is confirmed the system works properly with S3, set the default for +this system to S3. + +Reported-by: Jian-Hong Pan +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215742 +Signed-off-by: Mario Limonciello +Tested-by: Jian-Hong Pan +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/sleep.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index d4fbea91ab6b..8a5cb115fea8 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -373,6 +373,18 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), + }, + }, ++ /* ++ * ASUS B1400CEAE hangs on resume from suspend (see ++ * https://bugzilla.kernel.org/show_bug.cgi?id=215742). ++ */ ++ { ++ .callback = init_default_s3, ++ .ident = "ASUS B1400CEAE", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK B1400CEAE"), ++ }, ++ }, + {}, + }; + +-- +2.35.1 + diff --git a/queue-5.17/acpica-avoid-cache-flush-inside-virtual-machines.patch b/queue-5.17/acpica-avoid-cache-flush-inside-virtual-machines.patch new file mode 100644 index 00000000000..c7fe6da1bc8 --- /dev/null +++ b/queue-5.17/acpica-avoid-cache-flush-inside-virtual-machines.patch @@ -0,0 +1,71 @@ +From 56f9d843b12eb5399e76b15376675f2e3a4523c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 02:29:38 +0300 +Subject: ACPICA: Avoid cache flush inside virtual machines + +From: Kirill A. Shutemov + +[ Upstream commit e2efb6359e620521d1e13f69b2257de8ceaa9475 ] + +While running inside virtual machine, the kernel can bypass cache +flushing. Changing sleep state in a virtual machine doesn't affect the +host system sleep state and cannot lead to data loss. + +Before entering sleep states, the ACPI code flushes caches to prevent +data loss using the WBINVD instruction. This mechanism is required on +bare metal. + +But, any use WBINVD inside of a guest is worthless. Changing sleep +state in a virtual machine doesn't affect the host system sleep state +and cannot lead to data loss, so most hypervisors simply ignore it. +Despite this, the ACPI code calls WBINVD unconditionally anyway. +It's useless, but also normally harmless. + +In TDX guests, though, WBINVD stops being harmless; it triggers a +virtualization exception (#VE). If the ACPI cache-flushing WBINVD +were left in place, TDX guests would need handling to recover from +the exception. + +Avoid using WBINVD whenever running under a hypervisor. This both +removes the useless WBINVDs and saves TDX from implementing WBINVD +handling. + +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Dave Hansen +Reviewed-by: Dave Hansen +Reviewed-by: Dan Williams +Reviewed-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/20220405232939.73860-30-kirill.shutemov@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/acenv.h | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/acenv.h b/arch/x86/include/asm/acenv.h +index 9aff97f0de7f..d937c55e717e 100644 +--- a/arch/x86/include/asm/acenv.h ++++ b/arch/x86/include/asm/acenv.h +@@ -13,7 +13,19 @@ + + /* Asm macros */ + +-#define ACPI_FLUSH_CPU_CACHE() wbinvd() ++/* ++ * ACPI_FLUSH_CPU_CACHE() flushes caches on entering sleep states. ++ * It is required to prevent data loss. ++ * ++ * While running inside virtual machine, the kernel can bypass cache flushing. ++ * Changing sleep state in a virtual machine doesn't affect the host system ++ * sleep state and cannot lead to data loss. ++ */ ++#define ACPI_FLUSH_CPU_CACHE() \ ++do { \ ++ if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) \ ++ wbinvd(); \ ++} while (0) + + int __acpi_acquire_global_lock(unsigned int *lock); + int __acpi_release_global_lock(unsigned int *lock); +-- +2.35.1 + diff --git a/queue-5.17/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch b/queue-5.17/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch new file mode 100644 index 00000000000..5e3caa31d96 --- /dev/null +++ b/queue-5.17/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch @@ -0,0 +1,155 @@ +From 82b84e37e2cdb96e803693a68307f812f2b46cde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 May 2022 08:45:55 +0100 +Subject: afs: Adjust ACK interpretation to try and cope with NAT + +From: David Howells + +[ Upstream commit adc9613ff66c26ebaff9814973181ac178beb90b ] + +If a client's address changes, say if it is NAT'd, this can disrupt an in +progress operation. For most operations, this is not much of a problem, +but StoreData can be different as some servers modify the target file as +the data comes in, so if a store request is disrupted, the file can get +corrupted on the server. + +The problem is that the server doesn't recognise packets that come after +the change of address as belonging to the original client and will bounce +them, either by sending an OUT_OF_SEQUENCE ACK to the apparent new call if +the packet number falls within the initial sequence number window of a call +or by sending an EXCEEDS_WINDOW ACK if it falls outside and then aborting +it. In both cases, firstPacket will be 1 and previousPacket will be 0 in +the ACK information. + +Fix this by the following means: + + (1) If a client call receives an EXCEEDS_WINDOW ACK with firstPacket as 1 + and previousPacket as 0, assume this indicates that the server saw the + incoming packets from a different peer and thus as a different call. + Fail the call with error -ENETRESET. + + (2) Also fail the call if a similar OUT_OF_SEQUENCE ACK occurs if the + first packet has been hard-ACK'd. If it hasn't been hard-ACK'd, the + ACK packet will cause it to get retransmitted, so the call will just + be repeated. + + (3) Make afs_select_fileserver() treat -ENETRESET as a straight fail of + the operation. + + (4) Prioritise the error code over things like -ECONNRESET as the server + did actually respond. + + (5) Make writeback treat -ENETRESET as a retryable error and make it + redirty all the pages involved in a write so that the VM will retry. + +Note that there is still a circumstance that I can't easily deal with: if +the operation is fully received and processed by the server, but the reply +is lost due to address change. There's no way to know if the op happened. +We can examine the server, but a conflicting change could have been made by +a third party - and we can't tell the difference. In such a case, a +message like: + + kAFS: vnode modified {100058:146266} b7->b8 YFS.StoreData64 (op=2646a) + +will be logged to dmesg on the next op to touch the file and the client +will reset the inode state, including invalidating clean parts of the +pagecache. + +Reported-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Link: http://lists.infradead.org/pipermail/linux-afs/2021-December/004811.html # v1 +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + fs/afs/misc.c | 5 ++++- + fs/afs/rotate.c | 4 ++++ + fs/afs/write.c | 1 + + net/rxrpc/input.c | 27 +++++++++++++++++++++++++++ + 4 files changed, 36 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/misc.c b/fs/afs/misc.c +index 1d1a8debe472..933e67fcdab1 100644 +--- a/fs/afs/misc.c ++++ b/fs/afs/misc.c +@@ -163,8 +163,11 @@ void afs_prioritise_error(struct afs_error *e, int error, u32 abort_code) + return; + + case -ECONNABORTED: ++ error = afs_abort_to_error(abort_code); ++ fallthrough; ++ case -ENETRESET: /* Responded, but we seem to have changed address */ + e->responded = true; +- e->error = afs_abort_to_error(abort_code); ++ e->error = error; + return; + } + } +diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c +index 79e1a5f6701b..a840c3588ebb 100644 +--- a/fs/afs/rotate.c ++++ b/fs/afs/rotate.c +@@ -292,6 +292,10 @@ bool afs_select_fileserver(struct afs_operation *op) + op->error = error; + goto iterate_address; + ++ case -ENETRESET: ++ pr_warn("kAFS: Peer reset %s (op=%x)\n", ++ op->type ? op->type->name : "???", op->debug_id); ++ fallthrough; + case -ECONNRESET: + _debug("call reset"); + op->error = error; +diff --git a/fs/afs/write.c b/fs/afs/write.c +index f447c902318d..07454b1ed240 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -638,6 +638,7 @@ static ssize_t afs_write_back_from_locked_folio(struct address_space *mapping, + case -EKEYEXPIRED: + case -EKEYREJECTED: + case -EKEYREVOKED: ++ case -ENETRESET: + afs_redirty_pages(wbc, mapping, start, len); + mapping_set_error(mapping, ret); + break; +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index dc201363f2c4..67d3eba60dc7 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -903,6 +903,33 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + rxrpc_propose_ack_respond_to_ack); + } + ++ /* If we get an EXCEEDS_WINDOW ACK from the server, it probably ++ * indicates that the client address changed due to NAT. The server ++ * lost the call because it switched to a different peer. ++ */ ++ if (unlikely(buf.ack.reason == RXRPC_ACK_EXCEEDS_WINDOW) && ++ first_soft_ack == 1 && ++ prev_pkt == 0 && ++ rxrpc_is_client_call(call)) { ++ rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED, ++ 0, -ENETRESET); ++ return; ++ } ++ ++ /* If we get an OUT_OF_SEQUENCE ACK from the server, that can also ++ * indicate a change of address. However, we can retransmit the call ++ * if we still have it buffered to the beginning. ++ */ ++ if (unlikely(buf.ack.reason == RXRPC_ACK_OUT_OF_SEQUENCE) && ++ first_soft_ack == 1 && ++ prev_pkt == 0 && ++ call->tx_hard_ack == 0 && ++ rxrpc_is_client_call(call)) { ++ rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED, ++ 0, -ENETRESET); ++ return; ++ } ++ + /* Discard any out-of-order or duplicate ACKs (outside lock). */ + if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) { + trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial, +-- +2.35.1 + diff --git a/queue-5.17/alpha-fix-alloc_zeroed_user_highpage_movable.patch b/queue-5.17/alpha-fix-alloc_zeroed_user_highpage_movable.patch new file mode 100644 index 00000000000..a2e5733b8fa --- /dev/null +++ b/queue-5.17/alpha-fix-alloc_zeroed_user_highpage_movable.patch @@ -0,0 +1,39 @@ +From 70e05b511240a859d1af1f6b688f2d0904e54fa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 20:23:01 -0700 +Subject: alpha: fix alloc_zeroed_user_highpage_movable() + +From: Matthew Wilcox (Oracle) + +[ Upstream commit f9c668d281aa20e38c9bda3b7b0adeb8891aa15e ] + +Due to a typo, the final argument to alloc_page_vma() didn't refer to a +real variable. This only affected CONFIG_NUMA, which was marked BROKEN in +2006 and removed from alpha in 2021. Found due to a refactoring patch. + +Link: https://lkml.kernel.org/r/20220504182857.4013401-4-willy@infradead.org +Signed-off-by: Matthew Wilcox (Oracle) +Reported-by: kernel test robot +Reviewed-by: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/alpha/include/asm/page.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/alpha/include/asm/page.h b/arch/alpha/include/asm/page.h +index 18f48a6f2ff6..8f3f5eecba28 100644 +--- a/arch/alpha/include/asm/page.h ++++ b/arch/alpha/include/asm/page.h +@@ -18,7 +18,7 @@ extern void clear_page(void *page); + #define clear_user_page(page, vaddr, pg) clear_page(page) + + #define alloc_zeroed_user_highpage_movable(vma, vaddr) \ +- alloc_page_vma(GFP_HIGHUSER_MOVABLE | __GFP_ZERO, vma, vmaddr) ++ alloc_page_vma(GFP_HIGHUSER_MOVABLE | __GFP_ZERO, vma, vaddr) + #define __HAVE_ARCH_ALLOC_ZEROED_USER_HIGHPAGE_MOVABLE + + extern void copy_page(void * _to, void * _from); +-- +2.35.1 + diff --git a/queue-5.17/alsa-jack-access-input_dev-under-mutex.patch b/queue-5.17/alsa-jack-access-input_dev-under-mutex.patch new file mode 100644 index 00000000000..f159fe22c49 --- /dev/null +++ b/queue-5.17/alsa-jack-access-input_dev-under-mutex.patch @@ -0,0 +1,157 @@ +From 72d7a6e6c2874dbe76410c62d4d214be1745c01d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 11:16:28 +0200 +Subject: ALSA: jack: Access input_dev under mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 1b6a6fc5280e97559287b61eade2d4b363e836f2 ] + +It is possible when using ASoC that input_dev is unregistered while +calling snd_jack_report, which causes NULL pointer dereference. +In order to prevent this serialize access to input_dev using mutex lock. + +Signed-off-by: Amadeusz Sławiński +Reviewed-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220412091628.3056922-1-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/jack.h | 1 + + sound/core/jack.c | 34 +++++++++++++++++++++++++++------- + 2 files changed, 28 insertions(+), 7 deletions(-) + +diff --git a/include/sound/jack.h b/include/sound/jack.h +index 1181f536557e..1ed90e2109e9 100644 +--- a/include/sound/jack.h ++++ b/include/sound/jack.h +@@ -62,6 +62,7 @@ struct snd_jack { + const char *id; + #ifdef CONFIG_SND_JACK_INPUT_DEV + struct input_dev *input_dev; ++ struct mutex input_dev_lock; + int registered; + int type; + char name[100]; +diff --git a/sound/core/jack.c b/sound/core/jack.c +index d1e3055f2b6a..88493cc31914 100644 +--- a/sound/core/jack.c ++++ b/sound/core/jack.c +@@ -42,8 +42,11 @@ static int snd_jack_dev_disconnect(struct snd_device *device) + #ifdef CONFIG_SND_JACK_INPUT_DEV + struct snd_jack *jack = device->device_data; + +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return 0; ++ } + + /* If the input device is registered with the input subsystem + * then we need to use a different deallocator. */ +@@ -52,6 +55,7 @@ static int snd_jack_dev_disconnect(struct snd_device *device) + else + input_free_device(jack->input_dev); + jack->input_dev = NULL; ++ mutex_unlock(&jack->input_dev_lock); + #endif /* CONFIG_SND_JACK_INPUT_DEV */ + return 0; + } +@@ -90,8 +94,11 @@ static int snd_jack_dev_register(struct snd_device *device) + snprintf(jack->name, sizeof(jack->name), "%s %s", + card->shortname, jack->id); + +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return 0; ++ } + + jack->input_dev->name = jack->name; + +@@ -116,6 +123,7 @@ static int snd_jack_dev_register(struct snd_device *device) + if (err == 0) + jack->registered = 1; + ++ mutex_unlock(&jack->input_dev_lock); + return err; + } + #endif /* CONFIG_SND_JACK_INPUT_DEV */ +@@ -517,9 +525,11 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, + return -ENOMEM; + } + +- /* don't creat input device for phantom jack */ +- if (!phantom_jack) { + #ifdef CONFIG_SND_JACK_INPUT_DEV ++ mutex_init(&jack->input_dev_lock); ++ ++ /* don't create input device for phantom jack */ ++ if (!phantom_jack) { + int i; + + jack->input_dev = input_allocate_device(); +@@ -537,8 +547,8 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, + input_set_capability(jack->input_dev, EV_SW, + jack_switch_types[i]); + +-#endif /* CONFIG_SND_JACK_INPUT_DEV */ + } ++#endif /* CONFIG_SND_JACK_INPUT_DEV */ + + err = snd_device_new(card, SNDRV_DEV_JACK, jack, &ops); + if (err < 0) +@@ -578,10 +588,14 @@ EXPORT_SYMBOL(snd_jack_new); + void snd_jack_set_parent(struct snd_jack *jack, struct device *parent) + { + WARN_ON(jack->registered); +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return; ++ } + + jack->input_dev->dev.parent = parent; ++ mutex_unlock(&jack->input_dev_lock); + } + EXPORT_SYMBOL(snd_jack_set_parent); + +@@ -629,6 +643,8 @@ EXPORT_SYMBOL(snd_jack_set_key); + + /** + * snd_jack_report - Report the current status of a jack ++ * Note: This function uses mutexes and should be called from a ++ * context which can sleep (such as a workqueue). + * + * @jack: The jack to report status for + * @status: The current status of the jack +@@ -654,8 +670,11 @@ void snd_jack_report(struct snd_jack *jack, int status) + status & jack_kctl->mask_bits); + + #ifdef CONFIG_SND_JACK_INPUT_DEV +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return; ++ } + + for (i = 0; i < ARRAY_SIZE(jack->key); i++) { + int testbit = ((SND_JACK_BTN_0 >> i) & ~mask_bits); +@@ -675,6 +694,7 @@ void snd_jack_report(struct snd_jack *jack, int status) + } + + input_sync(jack->input_dev); ++ mutex_unlock(&jack->input_dev_lock); + #endif /* CONFIG_SND_JACK_INPUT_DEV */ + } + EXPORT_SYMBOL(snd_jack_report); +-- +2.35.1 + diff --git a/queue-5.17/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch b/queue-5.17/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch new file mode 100644 index 00000000000..5ab5ff976b5 --- /dev/null +++ b/queue-5.17/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch @@ -0,0 +1,48 @@ +From a0351ec83520cbffe569bd8417654dd5c53866d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 21:59:45 +0100 +Subject: ALSA: pcm: Check for null pointer of pointer substream before + dereferencing it + +From: Colin Ian King + +[ Upstream commit 011b559be832194f992f73d6c0d5485f5925a10b ] + +Pointer substream is being dereferenced on the assignment of pointer card +before substream is being null checked with the macro PCM_RUNTIME_CHECK. +Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the +the pointer check before card is assigned. + +Fixes: d4cfb30fce03 ("ALSA: pcm: Set per-card upper limit of PCM buffer allocations") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20220424205945.1372247-1-colin.i.king@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_memory.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/core/pcm_memory.c b/sound/core/pcm_memory.c +index 8848d2f3160d..b8296b6eb2c1 100644 +--- a/sound/core/pcm_memory.c ++++ b/sound/core/pcm_memory.c +@@ -453,7 +453,6 @@ EXPORT_SYMBOL(snd_pcm_lib_malloc_pages); + */ + int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream) + { +- struct snd_card *card = substream->pcm->card; + struct snd_pcm_runtime *runtime; + + if (PCM_RUNTIME_CHECK(substream)) +@@ -462,6 +461,8 @@ int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream) + if (runtime->dma_area == NULL) + return 0; + if (runtime->dma_buffer_p != &substream->dma_buffer) { ++ struct snd_card *card = substream->pcm->card; ++ + /* it's a newly allocated buffer. release it now. */ + do_free_pages(card, runtime->dma_buffer_p); + kfree(runtime->dma_buffer_p); +-- +2.35.1 + diff --git a/queue-5.17/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch b/queue-5.17/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch new file mode 100644 index 00000000000..c6f3f11e0c7 --- /dev/null +++ b/queue-5.17/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch @@ -0,0 +1,96 @@ +From 2841d7a02da075e19c741f93de7b950109188342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:41:00 +0200 +Subject: ALSA: usb-audio: Add quirk bits for enabling/disabling generic + implicit fb + +From: Takashi Iwai + +[ Upstream commit 0f1f7a6661394fe4a53db254c346d6aa2dd64397 ] + +For making easier to test, add the new quirk_flags bits 17 and 18 to +enable and disable the generic implicit feedback mode. The bit 17 is +equivalent with implicit_fb=1 option, applying the generic implicit +feedback sync mode. OTOH, the bit 18 disables the implicit fb mode +forcibly. + +Link: https://lore.kernel.org/r/20220421064101.12456-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + Documentation/sound/alsa-configuration.rst | 4 +++- + sound/usb/implicit.c | 5 ++++- + sound/usb/usbaudio.h | 6 ++++++ + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/Documentation/sound/alsa-configuration.rst b/Documentation/sound/alsa-configuration.rst +index 34888d4fc4a8..21ab5e6f7062 100644 +--- a/Documentation/sound/alsa-configuration.rst ++++ b/Documentation/sound/alsa-configuration.rst +@@ -2246,7 +2246,7 @@ implicit_fb + Apply the generic implicit feedback sync mode. When this is set + and the playback stream sync mode is ASYNC, the driver tries to + tie an adjacent ASYNC capture stream as the implicit feedback +- source. ++ source. This is equivalent with quirk_flags bit 17. + use_vmalloc + Use vmalloc() for allocations of the PCM buffers (default: yes). + For architectures with non-coherent memory like ARM or MIPS, the +@@ -2288,6 +2288,8 @@ quirk_flags + * bit 14: Ignore errors for mixer access + * bit 15: Support generic DSD raw U32_BE format + * bit 16: Set up the interface at first like UAC1 ++ * bit 17: Apply the generic implicit feedback sync mode ++ * bit 18: Don't apply implicit feedback sync mode + + This module supports multiple devices, autoprobe and hotplugging. + +diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c +index 2d444ec74202..1fd087128538 100644 +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -350,7 +350,8 @@ static int audioformat_implicit_fb_quirk(struct snd_usb_audio *chip, + } + + /* Try the generic implicit fb if available */ +- if (chip->generic_implicit_fb) ++ if (chip->generic_implicit_fb || ++ (chip->quirk_flags & QUIRK_FLAG_GENERIC_IMPLICIT_FB)) + return add_generic_implicit_fb(chip, fmt, alts); + + /* No quirk */ +@@ -387,6 +388,8 @@ int snd_usb_parse_implicit_fb_quirk(struct snd_usb_audio *chip, + struct audioformat *fmt, + struct usb_host_interface *alts) + { ++ if (chip->quirk_flags & QUIRK_FLAG_SKIP_IMPLICIT_FB) ++ return 0; + if (fmt->endpoint & USB_DIR_IN) + return audioformat_capture_quirk(chip, fmt, alts); + else +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index b8359a0aa008..044cd7ab27cb 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -164,6 +164,10 @@ extern bool snd_usb_skip_validation; + * Support generic DSD raw U32_BE format + * QUIRK_FLAG_SET_IFACE_FIRST: + * Set up the interface at first like UAC1 ++ * QUIRK_FLAG_GENERIC_IMPLICIT_FB ++ * Apply the generic implicit feedback sync mode (same as implicit_fb=1 option) ++ * QUIRK_FLAG_SKIP_IMPLICIT_FB ++ * Don't apply implicit feedback sync mode + */ + + #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0) +@@ -183,5 +187,7 @@ extern bool snd_usb_skip_validation; + #define QUIRK_FLAG_IGNORE_CTL_ERROR (1U << 14) + #define QUIRK_FLAG_DSD_RAW (1U << 15) + #define QUIRK_FLAG_SET_IFACE_FIRST (1U << 16) ++#define QUIRK_FLAG_GENERIC_IMPLICIT_FB (1U << 17) ++#define QUIRK_FLAG_SKIP_IMPLICIT_FB (1U << 18) + + #endif /* __USBAUDIO_H */ +-- +2.35.1 + diff --git a/queue-5.17/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch b/queue-5.17/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch new file mode 100644 index 00000000000..e41ef190915 --- /dev/null +++ b/queue-5.17/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch @@ -0,0 +1,63 @@ +From faa104f1ca69c057cbb4482124da5a9b66ea84db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:41:01 +0200 +Subject: ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c + +From: Takashi Iwai + +[ Upstream commit 67d64069bc0867e52e73a1e255b17462005ca9b4 ] + +Use the new quirk bits to manage the generic implicit fb quirk +entries. This makes easier to compare with other devices. + +Link: https://lore.kernel.org/r/20220421064101.12456-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/implicit.c | 5 ----- + sound/usb/quirks.c | 6 ++++++ + 2 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c +index 1fd087128538..e1bf1b5da423 100644 +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -45,11 +45,6 @@ struct snd_usb_implicit_fb_match { + + /* Implicit feedback quirk table for playback */ + static const struct snd_usb_implicit_fb_match playback_implicit_fb_quirks[] = { +- /* Generic matching */ +- IMPLICIT_FB_GENERIC_DEV(0x0499, 0x1509), /* Steinberg UR22 */ +- IMPLICIT_FB_GENERIC_DEV(0x0763, 0x2030), /* M-Audio Fast Track C400 */ +- IMPLICIT_FB_GENERIC_DEV(0x0763, 0x2031), /* M-Audio Fast Track C600 */ +- + /* Fixed EP */ + /* FIXME: check the availability of generic matching */ + IMPLICIT_FB_FIXED_DEV(0x0763, 0x2080, 0x81, 2), /* M-Audio FastTrack Ultra */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index fbbe59054c3f..e8468f9b007d 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1793,6 +1793,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x046d, 0x09a4, /* Logitech QuickCam E 3500 */ + QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR), ++ DEVICE_FLG(0x0499, 0x1509, /* Steinberg UR22 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), + DEVICE_FLG(0x04d8, 0xfeea, /* Benchmark DAC1 Pre */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x04e8, 0xa051, /* Samsung USBC Headset (AKG) */ +@@ -1826,6 +1828,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x074d, 0x3553, /* Outlaw RR2150 (Micronas UAC3553B) */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x0763, 0x2030, /* M-Audio Fast Track C400 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), ++ DEVICE_FLG(0x0763, 0x2031, /* M-Audio Fast Track C600 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), + DEVICE_FLG(0x08bb, 0x2702, /* LineX FM Transmitter */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x0951, 0x16ad, /* Kingston HyperX */ +-- +2.35.1 + diff --git a/queue-5.17/amt-fix-gateway-mode-stuck.patch b/queue-5.17/amt-fix-gateway-mode-stuck.patch new file mode 100644 index 00000000000..cb9bafb4f0d --- /dev/null +++ b/queue-5.17/amt-fix-gateway-mode-stuck.patch @@ -0,0 +1,60 @@ +From 4cca2ef5bf86d7be8f99c1d4176c91c05216c308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 03:15:54 +0000 +Subject: amt: fix gateway mode stuck + +From: Taehee Yoo + +[ Upstream commit 937956ba404e70a765ca5aa39d3d7564d86a8872 ] + +If a gateway can not receive any response to requests from a relay, +gateway resets status from SENT_REQUEST to INIT and variable about a +relay as well. And then it should start the full establish step +from sending a discovery message and receiving advertisement message. +But, after failure in amt_req_work() it continues sending a request +message step with flushed(invalid) relay information and sets SENT_REQUEST. +So, a gateway can't be established with a relay. +In order to avoid this situation, it stops sending the request message +step if it fails. + +Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") +Signed-off-by: Taehee Yoo +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/amt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/amt.c b/drivers/net/amt.c +index f1a36d7e2151..96a2f6a505c3 100644 +--- a/drivers/net/amt.c ++++ b/drivers/net/amt.c +@@ -943,7 +943,7 @@ static void amt_req_work(struct work_struct *work) + if (amt->status < AMT_STATUS_RECEIVED_ADVERTISEMENT) + goto out; + +- if (amt->req_cnt++ > AMT_MAX_REQ_COUNT) { ++ if (amt->req_cnt > AMT_MAX_REQ_COUNT) { + netdev_dbg(amt->dev, "Gateway is not ready"); + amt->qi = AMT_INIT_REQ_TIMEOUT; + amt->ready4 = false; +@@ -951,13 +951,15 @@ static void amt_req_work(struct work_struct *work) + amt->remote_ip = 0; + __amt_update_gw_status(amt, AMT_STATUS_INIT, false); + amt->req_cnt = 0; ++ goto out; + } + spin_unlock_bh(&amt->lock); + + amt_send_request(amt, false); + amt_send_request(amt, true); +- amt_update_gw_status(amt, AMT_STATUS_SENT_REQUEST, true); + spin_lock_bh(&amt->lock); ++ __amt_update_gw_status(amt, AMT_STATUS_SENT_REQUEST, true); ++ amt->req_cnt++; + out: + exp = min_t(u32, (1 * (1 << amt->req_cnt)), AMT_MAX_REQ_TIMEOUT); + mod_delayed_work(amt_wq, &amt->req_wq, msecs_to_jiffies(exp * 1000)); +-- +2.35.1 + diff --git a/queue-5.17/amt-fix-memory-leak-for-advertisement-message.patch b/queue-5.17/amt-fix-memory-leak-for-advertisement-message.patch new file mode 100644 index 00000000000..771ea91b557 --- /dev/null +++ b/queue-5.17/amt-fix-memory-leak-for-advertisement-message.patch @@ -0,0 +1,41 @@ +From 91f0d8efcd0bf7ab7a5f4d810f9b5f525b162254 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 03:15:55 +0000 +Subject: amt: fix memory leak for advertisement message + +From: Taehee Yoo + +[ Upstream commit fe29794c3585d039fefebaa2b5a4932a627ad4fd ] + +When a gateway receives an advertisement message, it extracts relay +information and then it should be freed. +But the advertisement handler doesn't free it. +So, memory leak would occur. + +Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") +Signed-off-by: Taehee Yoo +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/amt.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/amt.c b/drivers/net/amt.c +index 96a2f6a505c3..fb774d568baa 100644 +--- a/drivers/net/amt.c ++++ b/drivers/net/amt.c +@@ -2698,9 +2698,8 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb) + err = true; + goto drop; + } +- if (amt_advertisement_handler(amt, skb)) +- amt->dev->stats.rx_dropped++; +- goto out; ++ err = amt_advertisement_handler(amt, skb); ++ break; + case AMT_MSG_MULTICAST_DATA: + if (iph->saddr != amt->remote_ip) { + netdev_dbg(amt->dev, "Invalid Relay IP\n"); +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch b/queue-5.17/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch new file mode 100644 index 00000000000..566c38b6b9b --- /dev/null +++ b/queue-5.17/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch @@ -0,0 +1,43 @@ +From 84e592cffce4e33906849630ac0ee73a1618527c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 May 2022 16:31:27 +0300 +Subject: ARM: dts: at91: sama7g5: remove interrupt-parent from gic node + +From: Eugen Hristev + +[ Upstream commit b7e86ef7afd128577ff7bb0db0ae82d27d7ed7ad ] + +interrupt-parent is not to be used as a boolean property. +It is already present in the DT in the proper way it's supposed to be used: +interrupt-parent = <&gic>; + +This is also reported by dtbs_check: +arch/arm/boot/dts/at91-sama7g5ek.dtb: interrupt-controller@e8c11000: interrupt-parent: True is not of type 'array' + From schema: /.local/lib/python3.8/site-packages/dtschema/schemas/interrupts.yaml + +Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") +Signed-off-by: Eugen Hristev +Reviewed-by: Claudiu Beznea +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220503133127.64320-1-eugen.hristev@microchip.com +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama7g5.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sama7g5.dtsi b/arch/arm/boot/dts/sama7g5.dtsi +index 22520cdd37fc..46c96a3d7992 100644 +--- a/arch/arm/boot/dts/sama7g5.dtsi ++++ b/arch/arm/boot/dts/sama7g5.dtsi +@@ -626,7 +626,6 @@ + #interrupt-cells = <3>; + #address-cells = <0>; + interrupt-controller; +- interrupt-parent; + reg = <0xe8c11000 0x1000>, + <0xe8c12000 0x2000>; + }; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch b/queue-5.17/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch new file mode 100644 index 00000000000..f3dd7498149 --- /dev/null +++ b/queue-5.17/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch @@ -0,0 +1,52 @@ +From 8c310cb330ce86831d21fb62b180ce45dafc860a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:41 +0200 +Subject: ARM: dts: bcm2835-rpi-b: Fix GPIO line names + +From: Stefan Wahren + +[ Upstream commit 97bd8659c1c46c23e4daea7e040befca30939950 ] + +Recently this has been fixed in the vendor tree, so upstream this. + +Fixes: 731b26a6ac17 ("ARM: bcm2835: Add names for the Raspberry Pi GPIO lines") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2835-rpi-b.dts b/arch/arm/boot/dts/bcm2835-rpi-b.dts +index 1b63d6b19750..25d87212cefd 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-b.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-b.dts +@@ -53,18 +53,17 @@ + "GPIO18", + "NC", /* GPIO19 */ + "NC", /* GPIO20 */ +- "GPIO21", ++ "CAM_GPIO0", + "GPIO22", + "GPIO23", + "GPIO24", + "GPIO25", + "NC", /* GPIO26 */ +- "CAM_GPIO0", +- /* Binary number representing build/revision */ +- "CONFIG0", +- "CONFIG1", +- "CONFIG2", +- "CONFIG3", ++ "GPIO27", ++ "GPIO28", ++ "GPIO29", ++ "GPIO30", ++ "GPIO31", + "NC", /* GPIO32 */ + "NC", /* GPIO33 */ + "NC", /* GPIO34 */ +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch b/queue-5.17/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch new file mode 100644 index 00000000000..8b73bdc9ac2 --- /dev/null +++ b/queue-5.17/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch @@ -0,0 +1,57 @@ +From c754e3d75788b460b0a2e084c87bfee486eede5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:38 +0200 +Subject: ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT + +From: Phil Elwell + +[ Upstream commit 2c663e5e5bbf2a5b85e0f76ccb69663f583c3e33 ] + +The GPIOs 30 to 39 are connected to the Cypress CYW43438 (Wifi/BT). +So fix the GPIO line names accordingly. + +Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +index 243236bc1e00..8b043ab62dc8 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +@@ -74,16 +74,18 @@ + "GPIO27", + "SDA0", + "SCL0", +- "NC", /* GPIO30 */ +- "NC", /* GPIO31 */ +- "NC", /* GPIO32 */ +- "NC", /* GPIO33 */ +- "NC", /* GPIO34 */ +- "NC", /* GPIO35 */ +- "NC", /* GPIO36 */ +- "NC", /* GPIO37 */ +- "NC", /* GPIO38 */ +- "NC", /* GPIO39 */ ++ /* Used by BT module */ ++ "CTS0", ++ "RTS0", ++ "TXD0", ++ "RXD0", ++ /* Used by Wifi */ ++ "SD1_CLK", ++ "SD1_CMD", ++ "SD1_DATA0", ++ "SD1_DATA1", ++ "SD1_DATA2", ++ "SD1_DATA3", + "CAM_GPIO1", /* GPIO40 */ + "WL_ON", /* GPIO41 */ + "NC", /* GPIO42 */ +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch b/queue-5.17/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch new file mode 100644 index 00000000000..2198eb93938 --- /dev/null +++ b/queue-5.17/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch @@ -0,0 +1,37 @@ +From 3c283183674b1a3f90f84caacac6cf897e44fa8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:40 +0200 +Subject: ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED + +From: Phil Elwell + +[ Upstream commit 57f718aa4b93392fb1a8c0a874ab882b9e18136a ] + +The red LED on the Raspberry Pi 3 B Plus is the power LED. +So fix the GPIO line name accordingly. + +Fixes: 71c0cd2283f2 ("ARM: dts: bcm2837: Add Raspberry Pi 3 B+") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +index e12938baaf12..c263f5b48b96 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +@@ -45,7 +45,7 @@ + #gpio-cells = <2>; + gpio-line-names = "BT_ON", + "WL_ON", +- "STATUS_LED_R", ++ "PWR_LED_R", + "LAN_RUN", + "", + "CAM_GPIO0", +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch b/queue-5.17/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch new file mode 100644 index 00000000000..fe90eea59ab --- /dev/null +++ b/queue-5.17/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch @@ -0,0 +1,39 @@ +From 54dc275b14ecf2a989d8ad55ed854e976c4299fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:39 +0200 +Subject: ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C + +From: Phil Elwell + +[ Upstream commit 9fd26fd02749ec964eb0d588a3bab9e09bf77927 ] + +The GPIOs 46 & 47 are already used for a I2C interface to a SMPS. +So fix the GPIO line names accordingly. + +Fixes: a54fe8a6cf66 ("ARM: dts: add Raspberry Pi Compute Module 3 and IO board") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +index 588d9411ceb6..3dfce4312dfc 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +@@ -63,8 +63,8 @@ + "GPIO43", + "GPIO44", + "GPIO45", +- "GPIO46", +- "GPIO47", ++ "SMPS_SCL", ++ "SMPS_SDA", + /* Used by eMMC */ + "SD_CLK_R", + "SD_CMD_R", +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-bcm5301x-update-pin-controller-node-name.patch b/queue-5.17/arm-dts-bcm5301x-update-pin-controller-node-name.patch new file mode 100644 index 00000000000..8df5725c46e --- /dev/null +++ b/queue-5.17/arm-dts-bcm5301x-update-pin-controller-node-name.patch @@ -0,0 +1,42 @@ +From b86d9791b8f61bbdbef96301fd2344aca87dd708 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 14:05:27 +0200 +Subject: ARM: dts: BCM5301X: Update pin controller node name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 130b5e32ba9d2d2313e39cf3f6d0729bff02b76a ] + +This fixes: +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: cru-bus@100: 'pin-controller@1c0' does not match any of the regexes: '^clock-controller@[a-f0-9]+$', '^phy@[a-f0-9]+$', '^pinctrl@[a-f0-9]+$', '^syscon@[a-f0-9]+$', '^thermal@[a-f0-9]+$' + From schema: Documentation/devicetree/bindings/mfd/brcm,cru.yaml +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: pin-controller@1c0: $nodename:0: 'pin-controller@1c0' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$' + From schema: Documentation/devicetree/bindings/pinctrl/brcm,ns-pinmux.yaml + +Ref: e7391b021e3f ("dt-bindings: mfd: brcm,cru: Rename pinctrl node") +Signed-off-by: Rafał Miłecki +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 603c700c706f..65f8a759f1e3 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -455,7 +455,7 @@ + reg = <0x180 0x4>; + }; + +- pinctrl: pin-controller@1c0 { ++ pinctrl: pinctrl@1c0 { + compatible = "brcm,bcm4708-pinmux"; + reg = <0x1c0 0x24>; + reg-names = "cru_gpio_control"; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch b/queue-5.17/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch new file mode 100644 index 00000000000..848ec26fdef --- /dev/null +++ b/queue-5.17/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch @@ -0,0 +1,53 @@ +From 7a925e57a6de0e3eed5533a4356a0bfbbff5da18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 06:39:45 +0200 +Subject: ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec + clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Scherer + +[ Upstream commit 3d397a1277853498e8b7b305f2610881357c033f ] + +Commit f3e7dae323ab ("ARM: dts: imx6qdl: add enet_out clk +support") added another item to the list of clocks for the fec +device. As imx6dl-eckelmann-ci4x10.dts only overwrites clocks, +but not clock-names this resulted in an inconsistency with +clocks having one item more than clock-names. + +Also overwrite clock-names with the same value as in +imx6qdl.dtsi. This is a no-op today, but prevents similar +inconsistencies if the soc file will be changed in a similar way +in the future. + +Signed-off-by: Thorsten Scherer +Reviewed-by: Uwe Kleine-König +Fixes: f3e7dae323ab ("ARM: dts: imx6qdl: add enet_out clk support") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts b/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts +index b4a9523e325b..864dc5018451 100644 +--- a/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts ++++ b/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts +@@ -297,7 +297,11 @@ + phy-mode = "rmii"; + phy-reset-gpios = <&gpio1 18 GPIO_ACTIVE_LOW>; + phy-handle = <&phy>; +- clocks = <&clks IMX6QDL_CLK_ENET>, <&clks IMX6QDL_CLK_ENET>, <&rmii_clk>; ++ clocks = <&clks IMX6QDL_CLK_ENET>, ++ <&clks IMX6QDL_CLK_ENET>, ++ <&rmii_clk>, ++ <&clks IMX6QDL_CLK_ENET_REF>; ++ clock-names = "ipg", "ahb", "ptp", "enet_out"; + status = "okay"; + + mdio { +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch b/queue-5.17/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch new file mode 100644 index 00000000000..8c107d7155b --- /dev/null +++ b/queue-5.17/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch @@ -0,0 +1,45 @@ +From 813b8fd036e6dea170954b2c22b27bffc8923a9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 20:34:43 +0200 +Subject: ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM + +From: Krzysztof Kozlowski + +[ Upstream commit f038e8186fbc5723d7d38c6fa1d342945107347e ] + +The Samsung s524ad0xd1 EEPROM should use atmel,24c128 fallback, +according to the AT24 EEPROM bindings. + +Reported-by: Rob Herring +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220426183443.243113-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index f042954bdfa5..e4861415a0fe 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -129,7 +129,7 @@ + samsung,i2c-max-bus-freq = <20000>; + + eeprom@50 { +- compatible = "samsung,s524ad0xd1"; ++ compatible = "samsung,s524ad0xd1", "atmel,24c128"; + reg = <0x50>; + }; + +@@ -289,7 +289,7 @@ + samsung,i2c-max-bus-freq = <20000>; + + eeprom@51 { +- compatible = "samsung,s524ad0xd1"; ++ compatible = "samsung,s524ad0xd1", "atmel,24c128"; + reg = <0x51>; + }; + +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch b/queue-5.17/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch new file mode 100644 index 00000000000..a0dcbf00601 --- /dev/null +++ b/queue-5.17/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch @@ -0,0 +1,53 @@ +From 7b287f3e8ef7c58163de8bb1429cf439b881bf59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 17:22:24 +0200 +Subject: ARM: dts: imx6dl-colibri: Fix I2C pinmuxing + +From: Max Krummenacher + +[ Upstream commit 5f5c579a34a87117c20b411df583ae816c1ec84f ] + +Fix names of extra pingroup node and property for gpio bus recovery. +Without the change i2c2 is not functional. + +Fixes: 56f0df6b6b58 ("ARM: dts: imx*(colibri|apalis): add missing recovery modes to i2c") +Signed-off-by: Max Krummenacher +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-colibri.dtsi b/arch/arm/boot/dts/imx6qdl-colibri.dtsi +index 4e2a309c93fa..1e86b3814708 100644 +--- a/arch/arm/boot/dts/imx6qdl-colibri.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-colibri.dtsi +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0+ OR MIT + /* +- * Copyright 2014-2020 Toradex ++ * Copyright 2014-2022 Toradex + * Copyright 2012 Freescale Semiconductor, Inc. + * Copyright 2011 Linaro Ltd. + */ +@@ -132,7 +132,7 @@ + clock-frequency = <100000>; + pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c2>; +- pinctrl-0 = <&pinctrl_i2c2_gpio>; ++ pinctrl-1 = <&pinctrl_i2c2_gpio>; + scl-gpios = <&gpio2 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio3 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; +@@ -488,7 +488,7 @@ + >; + }; + +- pinctrl_i2c2_gpio: i2c2grp { ++ pinctrl_i2c2_gpio: i2c2gpiogrp { + fsl,pins = < + MX6QDL_PAD_EIM_EB2__GPIO2_IO30 0x4001b8b1 + MX6QDL_PAD_EIM_D16__GPIO3_IO16 0x4001b8b1 +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-ox820-align-interrupt-controller-node-name-w.patch b/queue-5.17/arm-dts-ox820-align-interrupt-controller-node-name-w.patch new file mode 100644 index 00000000000..c37a8cf855c --- /dev/null +++ b/queue-5.17/arm-dts-ox820-align-interrupt-controller-node-name-w.patch @@ -0,0 +1,37 @@ +From c47ae7af2bf2578280deaafc2075d4781bd528f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:29:59 +0200 +Subject: ARM: dts: ox820: align interrupt controller node name with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit fbcd5ad7a419ad40644a0bb8b4152bc660172d8a ] + +Fixes dtbs_check warnings like: + + gic@1000: $nodename:0: 'gic@1000' does not match '^interrupt-controller(@[0-9a-f,]+)*$' + +Signed-off-by: Krzysztof Kozlowski +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220317115705.450427-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ox820.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ox820.dtsi b/arch/arm/boot/dts/ox820.dtsi +index 90846a7655b4..dde4364892bf 100644 +--- a/arch/arm/boot/dts/ox820.dtsi ++++ b/arch/arm/boot/dts/ox820.dtsi +@@ -287,7 +287,7 @@ + clocks = <&armclk>; + }; + +- gic: gic@1000 { ++ gic: interrupt-controller@1000 { + compatible = "arm,arm11mp-gic"; + interrupt-controller; + #interrupt-cells = <3>; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-qcom-sdx55-remove-wrong-unit-address-from-rp.patch b/queue-5.17/arm-dts-qcom-sdx55-remove-wrong-unit-address-from-rp.patch new file mode 100644 index 00000000000..04187cb1291 --- /dev/null +++ b/queue-5.17/arm-dts-qcom-sdx55-remove-wrong-unit-address-from-rp.patch @@ -0,0 +1,37 @@ +From c223b5d07de665f468b8fb1d2e86deec0a0ceb37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 10:59:33 +0200 +Subject: ARM: dts: qcom: sdx55: remove wrong unit address from RPMH RSC clocks + +From: Krzysztof Kozlowski + +[ Upstream commit 97c246c825f73a018169834e56ffa9a89dea37a9 ] + +The clock controller of RPMH RSC does not have 'reg' property, so should +not have unit address. + +Fixes: bae2f5979c6e ("ARM: dts: qcom: Add SDX65 platform and MTP board support") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220411085935.130072-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-sdx65.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-sdx65.dtsi b/arch/arm/boot/dts/qcom-sdx65.dtsi +index 796641d30e06..0c3f93603adc 100644 +--- a/arch/arm/boot/dts/qcom-sdx65.dtsi ++++ b/arch/arm/boot/dts/qcom-sdx65.dtsi +@@ -202,7 +202,7 @@ + , + ; + +- rpmhcc: clock-controller@1 { ++ rpmhcc: clock-controller { + compatible = "qcom,sdx65-rpmh-clk"; + #clock-cells = <1>; + clock-names = "xo"; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch b/queue-5.17/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch new file mode 100644 index 00000000000..c068744d7e6 --- /dev/null +++ b/queue-5.17/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch @@ -0,0 +1,79 @@ +From 15c0a64e1271bf0d45035f9802ae7a2082fe0e7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Mar 2022 11:08:54 -0700 +Subject: ARM: dts: s5pv210: align DMA channels with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit 9e916fb9bc3d16066286f19fc9c51d26a6aec6bd ] + +dtschema expects DMA channels in specific order (tx, rx and tx-sec). +The order actually should not matter because dma-names is used however +let's make it aligned with dtschema to suppress warnings like: + + i2s@eee30000: dma-names: ['rx', 'tx', 'tx-sec'] is not valid under any of the given schemas + +Signed-off-by: Krzysztof Kozlowski +Co-developed-by: Jonathan Bakker +Signed-off-by: Jonathan Bakker +Link: https://lore.kernel.org/r/CY4PR04MB056779A9C50DC95987C5272ACB1C9@CY4PR04MB0567.namprd04.prod.outlook.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-aries.dtsi | 2 +- + arch/arm/boot/dts/s5pv210.dtsi | 12 ++++++------ + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/s5pv210-aries.dtsi b/arch/arm/boot/dts/s5pv210-aries.dtsi +index 2f57100a011a..9b7da2bc3a06 100644 +--- a/arch/arm/boot/dts/s5pv210-aries.dtsi ++++ b/arch/arm/boot/dts/s5pv210-aries.dtsi +@@ -636,7 +636,7 @@ + }; + + &i2s0 { +- dmas = <&pdma0 9>, <&pdma0 10>, <&pdma0 11>; ++ dmas = <&pdma0 10>, <&pdma0 9>, <&pdma0 11>; + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi +index 353ba7b09a0c..c5265f3ae31d 100644 +--- a/arch/arm/boot/dts/s5pv210.dtsi ++++ b/arch/arm/boot/dts/s5pv210.dtsi +@@ -239,8 +239,8 @@ + reg = <0xeee30000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <16>; +- dma-names = "rx", "tx", "tx-sec"; +- dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>; ++ dma-names = "tx", "rx", "tx-sec"; ++ dmas = <&pdma1 10>, <&pdma1 9>, <&pdma1 11>; + clock-names = "iis", + "i2s_opclk0", + "i2s_opclk1"; +@@ -259,8 +259,8 @@ + reg = <0xe2100000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <17>; +- dma-names = "rx", "tx"; +- dmas = <&pdma1 12>, <&pdma1 13>; ++ dma-names = "tx", "rx"; ++ dmas = <&pdma1 13>, <&pdma1 12>; + clock-names = "iis", "i2s_opclk0"; + clocks = <&clocks CLK_I2S1>, <&clocks SCLK_AUDIO1>; + pinctrl-names = "default"; +@@ -274,8 +274,8 @@ + reg = <0xe2a00000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <18>; +- dma-names = "rx", "tx"; +- dmas = <&pdma1 14>, <&pdma1 15>; ++ dma-names = "tx", "rx"; ++ dmas = <&pdma1 15>, <&pdma1 14>; + clock-names = "iis", "i2s_opclk0"; + clocks = <&clocks CLK_I2S2>, <&clocks SCLK_AUDIO2>; + pinctrl-names = "default"; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-socfpga-align-interrupt-controller-node-name.patch b/queue-5.17/arm-dts-socfpga-align-interrupt-controller-node-name.patch new file mode 100644 index 00000000000..e9431cdb5bc --- /dev/null +++ b/queue-5.17/arm-dts-socfpga-align-interrupt-controller-node-name.patch @@ -0,0 +1,51 @@ +From 1c5c9c335e66c8b4fb954378662f69a6a8d92a33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:30:22 +0200 +Subject: ARM: dts: socfpga: align interrupt controller node name with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit c9bdd50d2019f78bf4c1f6a79254c27771901023 ] + +Fixes dtbs_check warnings like: + + $nodename:0: 'intc@fffed000' does not match '^interrupt-controller(@[0-9a-f,]+)*$' + +Signed-off-by: Krzysztof Kozlowski +Acked-by: Dinh Nguyen +Link: https://lore.kernel.org/r/20220317115705.450427-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/socfpga.dtsi | 2 +- + arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi +index 7c1d6423d7f8..b8c5dd7860cb 100644 +--- a/arch/arm/boot/dts/socfpga.dtsi ++++ b/arch/arm/boot/dts/socfpga.dtsi +@@ -46,7 +46,7 @@ + <0xff113000 0x1000>; + }; + +- intc: intc@fffed000 { ++ intc: interrupt-controller@fffed000 { + compatible = "arm,cortex-a9-gic"; + #interrupt-cells = <3>; + interrupt-controller; +diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi +index 3ba431dfa8c9..f1e50d2e623a 100644 +--- a/arch/arm/boot/dts/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi +@@ -38,7 +38,7 @@ + <0xff113000 0x1000>; + }; + +- intc: intc@ffffd000 { ++ intc: interrupt-controller@ffffd000 { + compatible = "arm,cortex-a9-gic"; + #interrupt-cells = <3>; + interrupt-controller; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch b/queue-5.17/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch new file mode 100644 index 00000000000..d582f93a27d --- /dev/null +++ b/queue-5.17/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch @@ -0,0 +1,46 @@ +From 01ced98f1d5509f959d1eea0b52afab64431aa67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:58:51 +0100 +Subject: ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit ef2d90708883f4025a801feb0ba8411a7a4387e1 ] + +Per KSZ9031RNX PHY datasheet FIGURE 7-5: POWER-UP/POWER-DOWN/RESET TIMING +Note 2: After the de-assertion of reset, wait a minimum of 100 μs before +starting programming on the MIIM (MDC/MDIO) interface. + +Add 1ms post-reset delay to guarantee this figure. + +Fixes: 010ca9fe500bf ("ARM: dts: stm32: Add missing ethernet PHY reset on AV96") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index 6885948f3024..8eb51d84b698 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -141,6 +141,7 @@ + compatible = "snps,dwmac-mdio"; + reset-gpios = <&gpioz 2 GPIO_ACTIVE_LOW>; + reset-delay-us = <1000>; ++ reset-post-delay-us = <1000>; + + phy0: ethernet-phy@7 { + reg = <7>; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch b/queue-5.17/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch new file mode 100644 index 00000000000..b9a85e423a3 --- /dev/null +++ b/queue-5.17/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch @@ -0,0 +1,52 @@ +From 9bc157b7283497b7023b067de702c885929d5c5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 16:23:40 +0000 +Subject: ARM: dts: suniv: F1C100: fix watchdog compatible + +From: Andre Przywara + +[ Upstream commit 01a850ee61cbf0ab77dcbf26bb133fec2dd640d6 ] + +The F1C100 series of SoCs actually have their watchdog IP being +compatible with the newer Allwinner generation, not the older one. + +The currently described sun4i-a10-wdt actually does not work, neither +the watchdog functionality (just never fires), nor the reset part +(reboot hangs). + +Replace the compatible string with the one used by the newer generation. +Verified to work with both the watchdog and reboot functionality on a +LicheePi Nano. + +Also add the missing interrupt line and clock source, to make it binding +compliant. + +Fixes: 4ba16d17efdd ("ARM: dts: suniv: add initial DTSI file for F1C100s") +Signed-off-by: Andre Przywara +Acked-by: Guenter Roeck +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20220317162349.739636-4-andre.przywara@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/suniv-f1c100s.dtsi b/arch/arm/boot/dts/suniv-f1c100s.dtsi +index 6100d3b75f61..def830101448 100644 +--- a/arch/arm/boot/dts/suniv-f1c100s.dtsi ++++ b/arch/arm/boot/dts/suniv-f1c100s.dtsi +@@ -104,8 +104,10 @@ + + wdt: watchdog@1c20ca0 { + compatible = "allwinner,suniv-f1c100s-wdt", +- "allwinner,sun4i-a10-wdt"; ++ "allwinner,sun6i-a31-wdt"; + reg = <0x01c20ca0 0x20>; ++ interrupts = <16>; ++ clocks = <&osc32k>; + }; + + uart0: serial@1c25000 { +-- +2.35.1 + diff --git a/queue-5.17/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch b/queue-5.17/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch new file mode 100644 index 00000000000..b8755ea7c61 --- /dev/null +++ b/queue-5.17/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch @@ -0,0 +1,52 @@ +From 7cd5cccb7864cd8f432bef267355a4f0878c4ef9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 10:43:06 +0000 +Subject: ARM: hisi: Add missing of_node_put after of_find_compatible_node + +From: Peng Wu + +[ Upstream commit 9bc72e47d4630d58a840a66a869c56b29554cfe4 ] + +of_find_compatible_node will increment the refcount of the returned +device_node. Calling of_node_put() to avoid the refcount leak + +Signed-off-by: Peng Wu +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +--- + arch/arm/mach-hisi/platsmp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/mach-hisi/platsmp.c b/arch/arm/mach-hisi/platsmp.c +index a56cc64deeb8..9ce93e0b6cdc 100644 +--- a/arch/arm/mach-hisi/platsmp.c ++++ b/arch/arm/mach-hisi/platsmp.c +@@ -67,14 +67,17 @@ static void __init hi3xxx_smp_prepare_cpus(unsigned int max_cpus) + } + ctrl_base = of_iomap(np, 0); + if (!ctrl_base) { ++ of_node_put(np); + pr_err("failed to map address\n"); + return; + } + if (of_property_read_u32(np, "smp-offset", &offset) < 0) { ++ of_node_put(np); + pr_err("failed to find smp-offset property\n"); + return; + } + ctrl_base += offset; ++ of_node_put(np); + } + } + +@@ -160,6 +163,7 @@ static int hip01_boot_secondary(unsigned int cpu, struct task_struct *idle) + if (WARN_ON(!node)) + return -1; + ctrl_base = of_iomap(node, 0); ++ of_node_put(node); + + /* set the secondary core boot from DDR */ + remap_reg_value = readl_relaxed(ctrl_base + REG_SC_CTRL); +-- +2.35.1 + diff --git a/queue-5.17/arm-mediatek-select-arch-timer-for-mt7629.patch b/queue-5.17/arm-mediatek-select-arch-timer-for-mt7629.patch new file mode 100644 index 00000000000..0d56464c650 --- /dev/null +++ b/queue-5.17/arm-mediatek-select-arch-timer-for-mt7629.patch @@ -0,0 +1,38 @@ +From 40e7258d1d9da1e8878eca0c50b8cf0dd29ee7cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Apr 2022 17:13:47 +0800 +Subject: arm: mediatek: select arch timer for mt7629 + +From: Chuanhong Guo + +[ Upstream commit d66aea197d534e23d4989eb72fca9c0c114b97c9 ] + +This chip has an armv7 arch timer according to the dts. Select it in +Kconfig to enforce the support for it. +Otherwise the system time is just completely wrong if user forget to +enable ARM_ARCH_TIMER in kernel config. + +Fixes: a43379dddf1b ("arm: mediatek: add MT7629 smp bring up code") +Signed-off-by: Chuanhong Guo +Link: https://lore.kernel.org/r/20220409091347.2473449-1-gch981213@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm/mach-mediatek/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-mediatek/Kconfig b/arch/arm/mach-mediatek/Kconfig +index 9e0f592d87d8..35a3430c7942 100644 +--- a/arch/arm/mach-mediatek/Kconfig ++++ b/arch/arm/mach-mediatek/Kconfig +@@ -30,6 +30,7 @@ config MACH_MT7623 + config MACH_MT7629 + bool "MediaTek MT7629 SoCs support" + default ARCH_MEDIATEK ++ select HAVE_ARM_ARCH_TIMER + + config MACH_MT8127 + bool "MediaTek MT8127 SoCs support" +-- +2.35.1 + diff --git a/queue-5.17/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch b/queue-5.17/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch new file mode 100644 index 00000000000..a8e57cf1cba --- /dev/null +++ b/queue-5.17/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch @@ -0,0 +1,37 @@ +From f119b21c487f18cb787d1afdbd54c79777d5fc8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Apr 2022 15:07:54 +0200 +Subject: ARM: OMAP1: clock: Fix UART rate reporting algorithm + +From: Janusz Krzysztofik + +[ Upstream commit 338d5d476cde853dfd97378d20496baabc2ce3c0 ] + +Since its introduction to the mainline kernel, omap1_uart_recalc() helper +makes incorrect use of clk->enable_bit as a ready to use bitmap mask while +it only provides the bit number. Fix it. + +Signed-off-by: Janusz Krzysztofik +Acked-by: Tony Lindgren +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/clock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c +index 9d4a0ab50a46..d63d5eb8d8fd 100644 +--- a/arch/arm/mach-omap1/clock.c ++++ b/arch/arm/mach-omap1/clock.c +@@ -41,7 +41,7 @@ static DEFINE_SPINLOCK(clockfw_lock); + unsigned long omap1_uart_recalc(struct clk *clk) + { + unsigned int val = __raw_readl(clk->enable_reg); +- return val & clk->enable_bit ? 48000000 : 12000000; ++ return val & 1 << clk->enable_bit ? 48000000 : 12000000; + } + + unsigned long omap1_sossi_recalc(struct clk *clk) +-- +2.35.1 + diff --git a/queue-5.17/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch b/queue-5.17/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch new file mode 100644 index 00000000000..830e2c2c1c9 --- /dev/null +++ b/queue-5.17/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch @@ -0,0 +1,37 @@ +From 0d1b9769a7d6754d4ca66ac88ef1f8b52912a048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 01:03:56 +0200 +Subject: ARM: versatile: Add missing of_node_put in dcscb_init + +From: Peng Wu + +[ Upstream commit 23b44f9c649bbef10b45fa33080cd8b4166800ae ] + +The device_node pointer is returned by of_find_compatible_node +with refcount incremented. We should use of_node_put() to avoid +the refcount leak. + +Signed-off-by: Peng Wu +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20220428230356.69418-1-linus.walleij@linaro.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-vexpress/dcscb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c +index a0554d7d04f7..e1adc098f89a 100644 +--- a/arch/arm/mach-vexpress/dcscb.c ++++ b/arch/arm/mach-vexpress/dcscb.c +@@ -144,6 +144,7 @@ static int __init dcscb_init(void) + if (!node) + return -ENODEV; + dcscb_base = of_iomap(node, 0); ++ of_node_put(node); + if (!dcscb_base) + return -EADDRNOTAVAIL; + cfg = readl_relaxed(dcscb_base + DCS_CFG_R); +-- +2.35.1 + diff --git a/queue-5.17/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch b/queue-5.17/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch new file mode 100644 index 00000000000..cf89479c81a --- /dev/null +++ b/queue-5.17/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch @@ -0,0 +1,77 @@ +From cf826836a114226773c13b042ee7c662dfa52a3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 12:44:41 +0100 +Subject: arm64: compat: Do not treat syscall number as ESR_ELx for a bad + syscall + +From: Alexandru Elisei + +[ Upstream commit 3fed9e551417b84038b15117732ea4505eee386b ] + +If a compat process tries to execute an unknown system call above the +__ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the +offending process. Information about the error is printed to dmesg in +compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() -> +arm64_show_signal(). + +arm64_show_signal() interprets a non-zero value for +current->thread.fault_code as an exception syndrome and displays the +message associated with the ESR_ELx.EC field (bits 31:26). +current->thread.fault_code is set in compat_arm_syscall() -> +arm64_notify_die() with the bad syscall number instead of a valid ESR_ELx +value. This means that the ESR_ELx.EC field has the value that the user set +for the syscall number and the kernel can end up printing bogus exception +messages*. For example, for the syscall number 0x68000000, which evaluates +to ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error: + +[ 18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000] +[ 18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79 +[ 18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT) +[..] + +which is misleading, as the bad compat syscall has nothing to do with +pointer authentication. + +Stop arm64_show_signal() from printing exception syndrome information by +having compat_arm_syscall() set the ESR_ELx value to 0, as it has no +meaning for an invalid system call number. The example above now becomes: + +[ 19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000] +[ 19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80 +[ 19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT) +[..] + +which although shows less information because the syscall number, +wrongfully advertised as the ESR value, is missing, it is better than +showing plainly wrong information. The syscall number can be easily +obtained with strace. + +*A 32-bit value above or equal to 0x8000_0000 is interpreted as a negative +integer in compat_arm_syscal() and the condition scno < __ARM_NR_COMPAT_END +evaluates to true; the syscall will exit to userspace in this case with the +ENOSYS error code instead of arm64_notify_die() being called. + +Signed-off-by: Alexandru Elisei +Reviewed-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220425114444.368693-3-alexandru.elisei@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/sys_compat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c +index db5159a3055f..b88a52f7188f 100644 +--- a/arch/arm64/kernel/sys_compat.c ++++ b/arch/arm64/kernel/sys_compat.c +@@ -114,6 +114,6 @@ long compat_arm_syscall(struct pt_regs *regs, int scno) + addr = instruction_pointer(regs) - (compat_thumb_mode(regs) ? 2 : 4); + + arm64_notify_die("Oops - bad compat syscall(2)", regs, +- SIGILL, ILL_ILLTRP, addr, scno); ++ SIGILL, ILL_ILLTRP, addr, 0); + return 0; + } +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch b/queue-5.17/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch new file mode 100644 index 00000000000..5e5710ad89a --- /dev/null +++ b/queue-5.17/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch @@ -0,0 +1,36 @@ +From b0fbc42b29ce94d6f480879218967e52e3fbeced Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 19:09:19 +0200 +Subject: arm64: dts: marvell: espressobin-ultra: enable front USB3 port + +From: Robert Marko + +[ Upstream commit eacec7ebc16cf5d2f6a6c7cf5d57156da2c3e98f ] + +Espressobin Ultra has a front panel USB3.0 Type-A port which works +just fine so enable it. +I dont see a reason why it was disabled in the first place anyway. + +Fixes: 3404fe15a60f ("arm64: dts: marvell: add DT for ESPRESSObin-Ultra") +Signed-off-by: Robert Marko +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +index 610ff6f385c7..119db6b541b7 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +@@ -108,7 +108,6 @@ + + &usb3 { + usb-phy = <&usb3_phy>; +- status = "disabled"; + }; + + &mdio { +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch b/queue-5.17/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch new file mode 100644 index 00000000000..e7202fa383d --- /dev/null +++ b/queue-5.17/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch @@ -0,0 +1,43 @@ +From e4f1290d6c24fa045763ec862b391dbd90a8f2fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 19:09:17 +0200 +Subject: arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config + +From: Robert Marko + +[ Upstream commit 5202f4c3816b42e989f9cad49a73c7e88fba89f4 ] + +SPI config for the SPI-NOR is incorrect and completely breaking +reading/writing to the onboard SPI-NOR. + +SPI-NOR is connected in the single(x1) IO mode and not in the quad +(x4) mode. +Also, there is no need to override the max frequency from the DTSI +as the mx25u3235f that is used supports 104Mhz. + +Fixes: 3404fe15a60f ("arm64: dts: marvell: add DT for ESPRESSObin-Ultra") +Signed-off-by: Robert Marko +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +index c5eb3604dd5b..610ff6f385c7 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +@@ -71,10 +71,6 @@ + + &spi0 { + flash@0 { +- spi-max-frequency = <108000000>; +- spi-rx-bus-width = <4>; +- spi-tx-bus-width = <4>; +- + partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch b/queue-5.17/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch new file mode 100644 index 00000000000..f35e687022b --- /dev/null +++ b/queue-5.17/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch @@ -0,0 +1,43 @@ +From b2d1d84a927438858b2369473d464678c75500d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 22:45:22 +0800 +Subject: arm64: dts: mt8192: Fix nor_flash status disable typo +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Allen-KH Cheng + +[ Upstream commit 27f0eb16b0d417c155e96b5d3b89074699944e09 ] + +Correct nor_flash status disable typo of mt8192 SoC. + +Fixes: d0a197a0d064a ("arm64: dts: mt8192: add nor_flash device node") + +Signed-off-by: Allen-KH Cheng +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Miles Chen +Reviewed-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20220318144534.17996-11-allen-kh.cheng@mediatek.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 53d790c335f9..cd010185753e 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -470,7 +470,7 @@ + clock-names = "spi", "sf", "axi"; + #address-cells = <1>; + #size-cells = <0>; +- status = "disable"; ++ status = "disabled"; + }; + + audsys: clock-controller@11210000 { +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch b/queue-5.17/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch new file mode 100644 index 00000000000..537cf0a3cba --- /dev/null +++ b/queue-5.17/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch @@ -0,0 +1,45 @@ +From 1b060c94576a3e4fd2f57442ded98aaa8205163b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 18:46:43 +0100 +Subject: arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count + +From: Konrad Dybcio + +[ Upstream commit 1ae438d26b620979ed004d559c304d31c42173ae ] + +MSM8994 actually features 24 DMA channels for each BLSP, +fix it! + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220319174645.340379-14-konrad.dybcio@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index 480bc686e8e8..d76e93cff478 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -498,7 +498,7 @@ + #dma-cells = <1>; + qcom,ee = <0>; + qcom,controlled-remotely; +- num-channels = <18>; ++ num-channels = <24>; + qcom,num-ees = <4>; + }; + +@@ -634,7 +634,7 @@ + #dma-cells = <1>; + qcom,ee = <0>; + qcom,controlled-remotely; +- num-channels = <18>; ++ num-channels = <24>; + qcom,num-ees = <4>; + }; + +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch b/queue-5.17/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch new file mode 100644 index 00000000000..87226a5a945 --- /dev/null +++ b/queue-5.17/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch @@ -0,0 +1,38 @@ +From 29aacf86e3fcf3ce08ddcb5e67056f9abdf91ff7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 18:46:38 +0100 +Subject: arm64: dts: qcom: msm8994: Fix the cont_splash_mem address + +From: Konrad Dybcio + +[ Upstream commit 049c46f31a726bf8d202ff1681661513447fac84 ] + +The default memory map places cont_splash_mem at 3401000, which was +overlooked.. Fix it! + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220319174645.340379-9-konrad.dybcio@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index 215f56daa26c..480bc686e8e8 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -183,8 +183,8 @@ + no-map; + }; + +- cont_splash_mem: memory@3800000 { +- reg = <0 0x03800000 0 0x2400000>; ++ cont_splash_mem: memory@3401000 { ++ reg = <0 0x03401000 0 0x2200000>; + no-map; + }; + +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch b/queue-5.17/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch new file mode 100644 index 00000000000..5b87d39105b --- /dev/null +++ b/queue-5.17/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch @@ -0,0 +1,38 @@ +From cae3dd6d7fccbbfcd198281dcd1d158addfc73aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 13:05:02 +0530 +Subject: arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name + +From: Vinod Koul + +[ Upstream commit 1eae95fb1d696968ca72be3ac8e0d62bb4d8da42 ] + +Per DT spec node names should not have underscores (_) in them, so +change can_clock to can-clock. + +Fixes: 5c44c564e449 ("arm64: dts: qcom: qrb5165-rb5: Add support for MCP2518FD") +Signed-off-by: Vinod Koul +Acked-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220421073502.1824089-1-vkoul@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +index 845eb7a6bf92..0e63f707b911 100644 +--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts ++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +@@ -29,7 +29,7 @@ + }; + + /* Fixed crystal oscillator dedicated to MCP2518FD */ +- clk40M: can_clock { ++ clk40M: can-clock { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <40000000>; +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-qcom-sc7280-idp-configure-cts-pin-to-bias-.patch b/queue-5.17/arm64-dts-qcom-sc7280-idp-configure-cts-pin-to-bias-.patch new file mode 100644 index 00000000000..af53f004b98 --- /dev/null +++ b/queue-5.17/arm64-dts-qcom-sc7280-idp-configure-cts-pin-to-bias-.patch @@ -0,0 +1,63 @@ +From e0b086cbed45314142de4a32b651edd30f668028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 21:26:06 +0530 +Subject: arm64: dts: qcom: sc7280-idp: Configure CTS pin to bias-bus-hold for + bluetooth + +From: Vijaya Krishna Nivarthi + +[ Upstream commit 497b272759986af1aa5a25b5e903d082c67bd8f6 ] + +WLAN rail was leaking power during RBSC/sleep even after turning BT off. +Change active and sleep pinctrl configurations to handle same. + +Signed-off-by: Vijaya Krishna Nivarthi +Reviewed-by: Douglas Anderson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1650556567-4995-2-git-send-email-quic_vnivarth@quicinc.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280-idp.dtsi | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi b/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi +index d623d71d8bd4..dd6dac0e1784 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi +@@ -462,10 +462,13 @@ + + &qup_uart7_cts { + /* +- * Configure a pull-down on CTS to match the pull of +- * the Bluetooth module. ++ * Configure a bias-bus-hold on CTS to lower power ++ * usage when Bluetooth is turned off. Bus hold will ++ * maintain a low power state regardless of whether ++ * the Bluetooth module drives the pin in either ++ * direction or leaves the pin fully unpowered. + */ +- bias-pull-down; ++ bias-bus-hold; + }; + + &qup_uart7_rts { +@@ -516,10 +519,13 @@ + pins = "gpio28"; + function = "gpio"; + /* +- * Configure a pull-down on CTS to match the pull of +- * the Bluetooth module. ++ * Configure a bias-bus-hold on CTS to lower power ++ * usage when Bluetooth is turned off. Bus hold will ++ * maintain a low power state regardless of whether ++ * the Bluetooth module drives the pin in either ++ * direction or leaves the pin fully unpowered. + */ +- bias-pull-down; ++ bias-bus-hold; + }; + + qup_uart7_sleep_rts: qup-uart7-sleep-rts { +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch b/queue-5.17/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch new file mode 100644 index 00000000000..449e9736b83 --- /dev/null +++ b/queue-5.17/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch @@ -0,0 +1,37 @@ +From 06e8eedd548946de9f7e630ec4287c61a83aa0c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 12:15:04 +0530 +Subject: arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's + vddio-supply property + +From: Joel Selvaraj + +[ Upstream commit 1f1c494082a1f10d03ce4ee1485ee96d212e22ff ] + +vddio is misspelled with a "0" instead of "o". Fix it. + +Signed-off-by: Joel Selvaraj +Reviewed-by: Caleb Connolly +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/BY5PR02MB7009901651E6A8D5ACB0425ED91F9@BY5PR02MB7009.namprd02.prod.outlook.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts +index 367389526b41..a97f5e89e1d0 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts +@@ -218,7 +218,7 @@ + panel@0 { + compatible = "tianma,fhd-video"; + reg = <0>; +- vddi0-supply = <&vreg_l14a_1p8>; ++ vddio-supply = <&vreg_l14a_1p8>; + vddpos-supply = <&lab>; + vddneg-supply = <&ibb>; + +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch b/queue-5.17/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch new file mode 100644 index 00000000000..5a4242415f3 --- /dev/null +++ b/queue-5.17/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch @@ -0,0 +1,43 @@ +From edcf8f8d69d14f4b86c0df97a8d2d8e8c54b2cfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Mar 2022 17:27:06 +0800 +Subject: arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 + +From: Shawn Lin + +[ Upstream commit 4246d0bab2a8685e3d4aec2cb0ef8c526689ce96 ] + +drive-impedance-ohm is introduced for emmc phy instead of pcie phy. + +Fixes: fb8b7460c995 ("arm64: dts: rockchip: Define drive-impedance-ohm for RK3399's emmc-phy.") +Signed-off-by: Shawn Lin +Link: https://lore.kernel.org/r/1647336426-154797-1-git-send-email-shawn.lin@rock-chips.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index 080457a68e3c..88f26d89eea1 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1534,6 +1534,7 @@ + reg = <0xf780 0x24>; + clocks = <&sdhci>; + clock-names = "emmcclk"; ++ drive-impedance-ohm = <50>; + #phy-cells = <0>; + status = "disabled"; + }; +@@ -1544,7 +1545,6 @@ + clock-names = "refclk"; + #phy-cells = <1>; + resets = <&cru SRST_PCIEPHY>; +- drive-impedance-ohm = <50>; + reset-names = "phy"; + status = "disabled"; + }; +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch b/queue-5.17/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch new file mode 100644 index 00000000000..fffcba4cf72 --- /dev/null +++ b/queue-5.17/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch @@ -0,0 +1,50 @@ +From fdfcd27eb8503174a173fb5a93ec0defc8a48b57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 09:51:57 +0200 +Subject: arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates + +From: Matthias Schiffer + +[ Upstream commit 439677d416b17dd39964d5f7d64b742a2e51da5b ] + +We found that (at least some versions of) the sci-fw set the base clock +rate for UARTs in the MCU domain to 96 MHz instead of the expected 48 MHz, +leading to incorrect baud rates when used from Linux. + +As the 8250_omap driver will query the actual clock rate from the clk +driver when clock-frequency is unset, removing the incorrect property is +sufficient to fix the baud rate. + +Fixes: 8abae9389bdb ("arm64: dts: ti: Add support for AM642 SoC") +Signed-off-by: Matthias Schiffer +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20220419075157.189347-1-matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi b/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi +index 2bb5c9ff172c..02d4285acbb8 100644 +--- a/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi +@@ -10,7 +10,6 @@ + compatible = "ti,am64-uart", "ti,am654-uart"; + reg = <0x00 0x04a00000 0x00 0x100>; + interrupts = ; +- clock-frequency = <48000000>; + current-speed = <115200>; + power-domains = <&k3_pds 149 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 149 0>; +@@ -21,7 +20,6 @@ + compatible = "ti,am64-uart", "ti,am654-uart"; + reg = <0x00 0x04a10000 0x00 0x100>; + interrupts = ; +- clock-frequency = <48000000>; + current-speed = <115200>; + power-domains = <&k3_pds 160 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 160 0>; +-- +2.35.1 + diff --git a/queue-5.17/arm64-fix-types-in-copy_highpage.patch b/queue-5.17/arm64-fix-types-in-copy_highpage.patch new file mode 100644 index 00000000000..6d05cdfd19d --- /dev/null +++ b/queue-5.17/arm64-fix-types-in-copy_highpage.patch @@ -0,0 +1,50 @@ +From 8a235a26d16c1345670c3187467f850dddb549ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 03:04:13 +0000 +Subject: arm64: fix types in copy_highpage() + +From: Tong Tiangen + +[ Upstream commit 921d161f15d6b090599f6a8c23f131969edbd1fa ] + +In copy_highpage() the `kto` and `kfrom` local variables are pointers to +struct page, but these are used to hold arbitrary pointers to kernel memory +. Each call to page_address() returns a void pointer to memory associated +with the relevant page, and copy_page() expects void pointers to this +memory. + +This inconsistency was introduced in commit 2563776b41c3 ("arm64: mte: +Tags-aware copy_{user_,}highpage() implementations") and while this +doesn't appear to be harmful in practice it is clearly wrong. + +Correct this by making `kto` and `kfrom` void pointers. + +Fixes: 2563776b41c3 ("arm64: mte: Tags-aware copy_{user_,}highpage() implementations") +Signed-off-by: Tong Tiangen +Acked-by: Mark Rutland +Reviewed-by: Kefeng Wang +Link: https://lore.kernel.org/r/20220420030418.3189040-3-tongtiangen@huawei.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/copypage.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c +index b5447e53cd73..0dea80bf6de4 100644 +--- a/arch/arm64/mm/copypage.c ++++ b/arch/arm64/mm/copypage.c +@@ -16,8 +16,8 @@ + + void copy_highpage(struct page *to, struct page *from) + { +- struct page *kto = page_address(to); +- struct page *kfrom = page_address(from); ++ void *kto = page_address(to); ++ void *kfrom = page_address(from); + + copy_page(kto, kfrom); + +-- +2.35.1 + diff --git a/queue-5.17/arm64-stackleak-fix-current_top_of_stack.patch b/queue-5.17/arm64-stackleak-fix-current_top_of_stack.patch new file mode 100644 index 00000000000..df5eec84051 --- /dev/null +++ b/queue-5.17/arm64-stackleak-fix-current_top_of_stack.patch @@ -0,0 +1,106 @@ +From 497e2cdee8faecfdceb34fe62e1348d7f52a4a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 18:31:16 +0100 +Subject: arm64: stackleak: fix current_top_of_stack() + +From: Mark Rutland + +[ Upstream commit e85094c31ddb794ac41c299a5a7a68243148f829 ] + +Due to some historical confusion, arm64's current_top_of_stack() isn't +what the stackleak code expects. This could in theory result in a number +of problems, and practically results in an unnecessary performance hit. +We can avoid this by aligning the arm64 implementation with the x86 +implementation. + +The arm64 implementation of current_top_of_stack() was added +specifically for stackleak in commit: + + 0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin") + +This was intended to be equivalent to the x86 implementation, but the +implementation, semantics, and performance characteristics differ +wildly: + +* On x86, current_top_of_stack() returns the top of the current task's + task stack, regardless of which stack is in active use. + + The implementation accesses a percpu variable which the x86 entry code + maintains, and returns the location immediately above the pt_regs on + the task stack (above which x86 has some padding). + +* On arm64 current_top_of_stack() returns the top of the stack in active + use (i.e. the one which is currently being used). + + The implementation checks the SP against a number of + potentially-accessible stacks, and will BUG() if no stack is found. + +The core stackleak_erase() code determines the upper bound of stack to +erase with: + +| if (on_thread_stack()) +| boundary = current_stack_pointer; +| else +| boundary = current_top_of_stack(); + +On arm64 stackleak_erase() is always called on a task stack, and +on_thread_stack() should always be true. On x86, stackleak_erase() is +mostly called on a trampoline stack, and is sometimes called on a task +stack. + +Currently, this results in a lot of unnecessary code being generated for +arm64 for the impossible !on_thread_stack() case. Some of this is +inlined, bloating stackleak_erase(), while portions of this are left +out-of-line and permitted to be instrumented (which would be a +functional problem if that code were reachable). + +As a first step towards improving this, this patch aligns arm64's +implementation of current_top_of_stack() with x86's, always returning +the top of the current task's stack. With GCC 11.1.0 this results in the +bulk of the unnecessary code being removed, including all of the +out-of-line instrumentable code. + +While I don't believe there's a functional problem in practice I've +marked this as a fix since the semantic was clearly wrong, the fix +itself is simple, and other code might rely upon this in future. + +Fixes: 0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin") +Signed-off-by: Mark Rutland +Cc: Alexander Popov +Cc: Andrew Morton +Cc: Andy Lutomirski +Cc: Catalin Marinas +Cc: Kees Cook +Cc: Will Deacon +Acked-by: Catalin Marinas +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220427173128.2603085-2-mark.rutland@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/processor.h | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h +index 6f41b65f9962..25c0bb5b8faa 100644 +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -380,12 +380,10 @@ long get_tagged_addr_ctrl(struct task_struct *task); + * of header definitions for the use of task_stack_page. + */ + +-#define current_top_of_stack() \ +-({ \ +- struct stack_info _info; \ +- BUG_ON(!on_accessible_stack(current, current_stack_pointer, 1, &_info)); \ +- _info.high; \ +-}) ++/* ++ * The top of the current task's task stack ++ */ ++#define current_top_of_stack() ((unsigned long)current->stack + THREAD_SIZE) + #define on_thread_stack() (on_task_stack(current, current_stack_pointer, 1, NULL)) + + #endif /* __ASSEMBLY__ */ +-- +2.35.1 + diff --git a/queue-5.17/asoc-amd-add-driver-data-to-acp6x-machine-driver.patch b/queue-5.17/asoc-amd-add-driver-data-to-acp6x-machine-driver.patch new file mode 100644 index 00000000000..748da722020 --- /dev/null +++ b/queue-5.17/asoc-amd-add-driver-data-to-acp6x-machine-driver.patch @@ -0,0 +1,184 @@ +From 2fc0de9ca9616af259934650d3d713102d91147f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 08:45:31 -0500 +Subject: ASoC: amd: Add driver data to acp6x machine driver + +From: Mario Limonciello + +[ Upstream commit e521f087780d07731e8c950f2f34d08358c86bc9 ] + +Currently all of the quirked systems use the same card and so the +DMI quirk list doesn't contain driver data. + +Add driver data to these quirks and then check the data was present +or not. This will allow potentially setting quirks for systems with +faulty firmware that claims to have a DMIC but doesn't really. + +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20220411134532.13538-2-mario.limonciello@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 29 +++++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 9a767f47b89f..959b70e8baf2 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -45,108 +45,126 @@ static struct snd_soc_card acp6x_card = { + + static const struct dmi_system_id yc_acp_quirk_table[] = { + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D2"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D3"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D4"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D5"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CF"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CG"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CQ"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CR"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21AW"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21AX"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21BN"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21BQ"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CH"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CJ"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CK"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CL"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D8"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D9"), +@@ -157,18 +175,21 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + + static int acp6x_probe(struct platform_device *pdev) + { ++ const struct dmi_system_id *dmi_id; + struct acp6x_pdm *machine = NULL; + struct snd_soc_card *card; + int ret; +- const struct dmi_system_id *dmi_id; + ++ /* check for any DMI overrides */ + dmi_id = dmi_first_match(yc_acp_quirk_table); +- if (!dmi_id) ++ if (dmi_id) ++ platform_set_drvdata(pdev, dmi_id->driver_data); ++ ++ card = platform_get_drvdata(pdev); ++ if (!card) + return -ENODEV; +- card = &acp6x_card; + acp6x_card.dev = &pdev->dev; + +- platform_set_drvdata(pdev, card); + snd_soc_card_set_drvdata(card, machine); + ret = devm_snd_soc_register_card(&pdev->dev, card); + if (ret) { +-- +2.35.1 + diff --git a/queue-5.17/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch b/queue-5.17/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch new file mode 100644 index 00000000000..e1735c8c710 --- /dev/null +++ b/queue-5.17/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch @@ -0,0 +1,44 @@ +From d1527437a7aa808bd559cd6dba09057c47545629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:30 +0100 +Subject: ASoC: atmel-classd: Remove endianness flag on class d component + +From: Charles Keepax + +[ Upstream commit 0104d52a6a69b06b0e8167f7c1247e8c76aca070 ] + +The endianness flag should have been removed when the driver was +ported across from having both a CODEC and CPU side component, to +just having a CPU component and using the dummy for the CODEC. The +endianness flag is used to indicate that the device is completely +ambivalent to the endianness of the data, typically due to the +endianness being lost over the hardware link (ie. the link defines +bit ordering). It's usage didn't have any effect when the driver +had both a CPU and CODEC component, since the union of those equals +the CPU side settings, but now causes the driver to falsely report +it supports big endian. Correct this by removing the flag. + +Fixes: 1dfdbe73ccf9 ("ASoC: atmel-classd: remove codec component") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-classd.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c +index a9f9f449c48c..74b7b2611aa7 100644 +--- a/sound/soc/atmel/atmel-classd.c ++++ b/sound/soc/atmel/atmel-classd.c +@@ -458,7 +458,6 @@ static const struct snd_soc_component_driver atmel_classd_cpu_dai_component = { + .num_controls = ARRAY_SIZE(atmel_classd_snd_controls), + .idle_bias_on = 1, + .use_pmdown_time = 1, +- .endianness = 1, + }; + + /* ASoC sound card */ +-- +2.35.1 + diff --git a/queue-5.17/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch b/queue-5.17/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch new file mode 100644 index 00000000000..ff5e505603d --- /dev/null +++ b/queue-5.17/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch @@ -0,0 +1,44 @@ +From c936f6411ea1e1144ddbc6375451c8283af759cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:29 +0100 +Subject: ASoC: atmel-pdmic: Remove endianness flag on pdmic component + +From: Charles Keepax + +[ Upstream commit 52857c3baa0e5ddeba7b2c84e56bb71c9674e048 ] + +The endianness flag should have been removed when the driver was +ported across from having both a CODEC and CPU side component, to +just having a CPU component and using the dummy for the CODEC. The +endianness flag is used to indicate that the device is completely +ambivalent to the endianness of the data, typically due to the +endianness being lost over the hardware link (ie. the link defines +bit ordering). It's usage didn't have any effect when the driver +had both a CPU and CODEC component, since the union of those equals +the CPU side settings, but now causes the driver to falsely report +it supports big endian. Correct this by removing the flag. + +Fixes: f3c668074a04 ("ASoC: atmel-pdmic: remove codec component") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-pdmic.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel-pdmic.c b/sound/soc/atmel/atmel-pdmic.c +index 42117de299e7..ea34efac2fff 100644 +--- a/sound/soc/atmel/atmel-pdmic.c ++++ b/sound/soc/atmel/atmel-pdmic.c +@@ -481,7 +481,6 @@ static const struct snd_soc_component_driver atmel_pdmic_cpu_dai_component = { + .num_controls = ARRAY_SIZE(atmel_pdmic_snd_controls), + .idle_bias_on = 1, + .use_pmdown_time = 1, +- .endianness = 1, + }; + + /* ASoC sound card */ +-- +2.35.1 + diff --git a/queue-5.17/asoc-cs35l41-fix-an-out-of-bounds-access-in-otp_pack.patch b/queue-5.17/asoc-cs35l41-fix-an-out-of-bounds-access-in-otp_pack.patch new file mode 100644 index 00000000000..e7577e64333 --- /dev/null +++ b/queue-5.17/asoc-cs35l41-fix-an-out-of-bounds-access-in-otp_pack.patch @@ -0,0 +1,123 @@ +From fed00201768b40051c8df52dba3f900c4462faae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 20:35:35 +0800 +Subject: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t + +From: Hui Wang + +[ Upstream commit 9f342904216f378e88008bb0ce1ae200a4b99fe8 ] + +The CS35L41_NUM_OTP_ELEM is 100, but only 99 entries are defined in +the array otp_map_1/2[CS35L41_NUM_OTP_ELEM], this will trigger UBSAN +to report a shift-out-of-bounds warning in the cs35l41_otp_unpack() +since the last entry in the array will result in GENMASK(-1, 0). + +UBSAN reports this problem: + UBSAN: shift-out-of-bounds in /home/hwang4/build/jammy/jammy/sound/soc/codecs/cs35l41-lib.c:836:8 + shift exponent 64 is too large for 64-bit type 'long unsigned int' + CPU: 10 PID: 595 Comm: systemd-udevd Not tainted 5.15.0-23-generic #23 + Hardware name: LENOVO \x02MFG_IN_GO/\x02MFG_IN_GO, BIOS N3GET19W (1.00 ) 03/11/2022 + Call Trace: + + show_stack+0x52/0x58 + dump_stack_lvl+0x4a/0x5f + dump_stack+0x10/0x12 + ubsan_epilogue+0x9/0x45 + __ubsan_handle_shift_out_of_bounds.cold+0x61/0xef + ? regmap_unlock_mutex+0xe/0x10 + cs35l41_otp_unpack.cold+0x1c6/0x2b2 [snd_soc_cs35l41_lib] + cs35l41_hda_probe+0x24f/0x33a [snd_hda_scodec_cs35l41] + cs35l41_hda_i2c_probe+0x65/0x90 [snd_hda_scodec_cs35l41_i2c] + ? cs35l41_hda_i2c_remove+0x20/0x20 [snd_hda_scodec_cs35l41_i2c] + i2c_device_probe+0x252/0x2b0 + +Fixes: 6450ef559056 ("ASoC: cs35l41: CS35L41 Boosted Smart Amplifier") +Reviewed-by: Lucas Tanure +Acked-by: Charles Keepax +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20220328123535.50000-2-hui.wang@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/cs35l41.h | 1 - + sound/soc/codecs/cs35l41-lib.c | 14 +++++++------- + 2 files changed, 7 insertions(+), 8 deletions(-) + +diff --git a/include/sound/cs35l41.h b/include/sound/cs35l41.h +index bf7f9a9aeba0..9341130257ea 100644 +--- a/include/sound/cs35l41.h ++++ b/include/sound/cs35l41.h +@@ -536,7 +536,6 @@ + + #define CS35L41_MAX_CACHE_REG 36 + #define CS35L41_OTP_SIZE_WORDS 32 +-#define CS35L41_NUM_OTP_ELEM 100 + + #define CS35L41_VALID_PDATA 0x80000000 + #define CS35L41_NUM_SUPPLIES 2 +diff --git a/sound/soc/codecs/cs35l41-lib.c b/sound/soc/codecs/cs35l41-lib.c +index 281a710a4123..8de5038ee9b3 100644 +--- a/sound/soc/codecs/cs35l41-lib.c ++++ b/sound/soc/codecs/cs35l41-lib.c +@@ -422,7 +422,7 @@ static bool cs35l41_volatile_reg(struct device *dev, unsigned int reg) + } + } + +-static const struct cs35l41_otp_packed_element_t otp_map_1[CS35L41_NUM_OTP_ELEM] = { ++static const struct cs35l41_otp_packed_element_t otp_map_1[] = { + /* addr shift size */ + { 0x00002030, 0, 4 }, /*TRIM_OSC_FREQ_TRIM*/ + { 0x00002030, 7, 1 }, /*TRIM_OSC_TRIM_DONE*/ +@@ -525,7 +525,7 @@ static const struct cs35l41_otp_packed_element_t otp_map_1[CS35L41_NUM_OTP_ELEM] + { 0x00017044, 0, 24 }, /*LOT_NUMBER*/ + }; + +-static const struct cs35l41_otp_packed_element_t otp_map_2[CS35L41_NUM_OTP_ELEM] = { ++static const struct cs35l41_otp_packed_element_t otp_map_2[] = { + /* addr shift size */ + { 0x00002030, 0, 4 }, /*TRIM_OSC_FREQ_TRIM*/ + { 0x00002030, 7, 1 }, /*TRIM_OSC_TRIM_DONE*/ +@@ -671,35 +671,35 @@ static const struct cs35l41_otp_map_element_t cs35l41_otp_map_map[] = { + { + .id = 0x01, + .map = otp_map_1, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_1), + .bit_offset = 16, + .word_offset = 2, + }, + { + .id = 0x02, + .map = otp_map_2, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_2), + .bit_offset = 16, + .word_offset = 2, + }, + { + .id = 0x03, + .map = otp_map_2, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_2), + .bit_offset = 16, + .word_offset = 2, + }, + { + .id = 0x06, + .map = otp_map_2, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_2), + .bit_offset = 16, + .word_offset = 2, + }, + { + .id = 0x08, + .map = otp_map_1, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_1), + .bit_offset = 16, + .word_offset = 2, + }, +-- +2.35.1 + diff --git a/queue-5.17/asoc-dapm-don-t-fold-register-value-changes-into-not.patch b/queue-5.17/asoc-dapm-don-t-fold-register-value-changes-into-not.patch new file mode 100644 index 00000000000..222f8fe1f29 --- /dev/null +++ b/queue-5.17/asoc-dapm-don-t-fold-register-value-changes-into-not.patch @@ -0,0 +1,51 @@ +From cb757706eb8f1027086074be2429a4e48527ca9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 17:18:32 +0100 +Subject: ASoC: dapm: Don't fold register value changes into notifications + +From: Mark Brown + +[ Upstream commit ad685980469b9f9b99d4d6ea05f4cb8f57cb2234 ] + +DAPM tracks and reports the value presented to the user from DAPM controls +separately to the register value, these may diverge during initialisation +or when an autodisable control is in use. + +When writing DAPM controls we currently report that a change has occurred +if either the DAPM value or the value stored in the register has changed, +meaning that if the two are out of sync we may appear to report a spurious +event to userspace. Since we use this folded in value for nothing other +than the value reported to userspace simply drop the folding in of the +register change. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220428161833.3690050-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index fb43b331a36e..f62dd119639d 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3430,7 +3430,6 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol, + update.val = val; + card->update = &update; + } +- change |= reg_change; + + ret = soc_dapm_mixer_update_power(card, kcontrol, connect, + rconnect); +@@ -3532,7 +3531,6 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol, + update.val = val; + card->update = &update; + } +- change |= reg_change; + + ret = soc_dapm_mux_update_power(card, kcontrol, item[0], e); + +-- +2.35.1 + diff --git a/queue-5.17/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch b/queue-5.17/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch new file mode 100644 index 00000000000..62a10d40ef2 --- /dev/null +++ b/queue-5.17/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch @@ -0,0 +1,84 @@ +From 561389ccfe87bce2f5ba0606e9aaa8a13666419b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 10:58:03 +0400 +Subject: ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe + +From: Miaoqian Lin + +[ Upstream commit 41cd312dfe980af869c3503b4d38e62ed20dd3b7 ] + +of_find_i2c_device_by_node() takes a reference, +In error paths, we should call put_device() to drop +the reference to aviod refount leak. + +Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000") +Signed-off-by: Miaoqian Lin +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20220511065803.3957-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-sgtl5000.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c +index 8daced42d55e..580a0d963f0e 100644 +--- a/sound/soc/fsl/imx-sgtl5000.c ++++ b/sound/soc/fsl/imx-sgtl5000.c +@@ -120,19 +120,19 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; +- goto fail; ++ goto put_device; + } + + comp = devm_kzalloc(&pdev->dev, 3 * sizeof(*comp), GFP_KERNEL); + if (!comp) { + ret = -ENOMEM; +- goto fail; ++ goto put_device; + } + + data->codec_clk = clk_get(&codec_dev->dev, NULL); + if (IS_ERR(data->codec_clk)) { + ret = PTR_ERR(data->codec_clk); +- goto fail; ++ goto put_device; + } + + data->clk_frequency = clk_get_rate(data->codec_clk); +@@ -158,10 +158,10 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + data->card.dev = &pdev->dev; + ret = snd_soc_of_parse_card_name(&data->card, "model"); + if (ret) +- goto fail; ++ goto put_device; + ret = snd_soc_of_parse_audio_routing(&data->card, "audio-routing"); + if (ret) +- goto fail; ++ goto put_device; + data->card.num_links = 1; + data->card.owner = THIS_MODULE; + data->card.dai_link = &data->dai; +@@ -174,7 +174,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + ret = devm_snd_soc_register_card(&pdev->dev, &data->card); + if (ret) { + dev_err_probe(&pdev->dev, ret, "snd_soc_register_card failed\n"); +- goto fail; ++ goto put_device; + } + + of_node_put(ssi_np); +@@ -182,6 +182,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + + return 0; + ++put_device: ++ put_device(&codec_dev->dev); + fail: + if (data && !IS_ERR(data->codec_clk)) + clk_put(data->codec_clk); +-- +2.35.1 + diff --git a/queue-5.17/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch b/queue-5.17/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch new file mode 100644 index 00000000000..32d328e75ef --- /dev/null +++ b/queue-5.17/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch @@ -0,0 +1,39 @@ +From 7ecd25075f660b45670c80f0920b0e7061041e20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 09:27:40 +0400 +Subject: ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe + +From: Miaoqian Lin + +[ Upstream commit ed46731d8e86c8d65f5fc717671e1f1f6c3146d2 ] + +of_find_device_by_node() takes reference, we should use put_device() +to release it. when devm_kzalloc() fails, it doesn't have a +put_device(), it will cause refcount leak. +Add missing put_device() to fix this. + +Fixes: 6a5f850aa83a ("ASoC: fsl: Add imx-hdmi machine driver") +Fixes: f670b274f7f6 ("ASoC: imx-hdmi: add put_device() after of_find_device_by_node()") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220511052740.46903-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/fsl/imx-hdmi.c b/sound/soc/fsl/imx-hdmi.c +index 929f69b758af..ec149dc73938 100644 +--- a/sound/soc/fsl/imx-hdmi.c ++++ b/sound/soc/fsl/imx-hdmi.c +@@ -126,6 +126,7 @@ static int imx_hdmi_probe(struct platform_device *pdev) + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; ++ put_device(&cpu_pdev->dev); + goto fail; + } + +-- +2.35.1 + diff --git a/queue-5.17/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch b/queue-5.17/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch new file mode 100644 index 00000000000..e7d5de4ff3c --- /dev/null +++ b/queue-5.17/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch @@ -0,0 +1,52 @@ +From 47848bb18bf414e85531b4dc76567a99b6a0a03c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 15:49:18 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 + +From: Hans de Goede + +[ Upstream commit ce216cfa84a4e1c23b105e652c550bdeaac9e922 ] + +Add a quirk for the HP Pro Tablet 408, this BYTCR tablet has no CHAN +package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which +is the default for BYTCR devices. + +It also uses DMIC1 for the internal mic rather then the default IN3 +and it uses JD2 rather then the default JD1 for jack-detect. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211485 +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220427134918.527381-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 2ace32c03ec9..b5ac226c59e1 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -773,6 +773,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_OVCD_SF_0P75 | + BYT_RT5640_MCLK_EN), + }, ++ { /* HP Pro Tablet 408 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pro Tablet 408"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_1500UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* HP Stream 7 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +-- +2.35.1 + diff --git a/queue-5.17/asoc-max98090-move-check-for-invalid-values-before-c.patch b/queue-5.17/asoc-max98090-move-check-for-invalid-values-before-c.patch new file mode 100644 index 00000000000..7c0fe2be807 --- /dev/null +++ b/queue-5.17/asoc-max98090-move-check-for-invalid-values-before-c.patch @@ -0,0 +1,52 @@ +From a645b8dca8077168df7cb98a7af18057ddd505b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 01:31:26 +0300 +Subject: ASoC: max98090: Move check for invalid values before casting in + max98090_put_enab_tlv() + +From: Alexey Khoroshilov + +[ Upstream commit f7a344468105ef8c54086dfdc800e6f5a8417d3e ] + +Validation of signed input should be done before casting to unsigned int. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Alexey Khoroshilov +Suggested-by: Mark Brown +Fixes: 2fbe467bcbfc ("ASoC: max98090: Reject invalid values in custom control put()") +Link: https://lore.kernel.org/r/1652999486-29653-1-git-send-email-khoroshilov@ispras.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 62b41ca050a2..5513acd360b8 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -393,7 +393,8 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, + struct soc_mixer_control *mc = + (struct soc_mixer_control *)kcontrol->private_value; + unsigned int mask = (1 << fls(mc->max)) - 1; +- unsigned int sel = ucontrol->value.integer.value[0]; ++ int sel_unchecked = ucontrol->value.integer.value[0]; ++ unsigned int sel; + unsigned int val = snd_soc_component_read(component, mc->reg); + unsigned int *select; + +@@ -413,8 +414,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, + + val = (val >> mc->shift) & mask; + +- if (sel < 0 || sel > mc->max) ++ if (sel_unchecked < 0 || sel_unchecked > mc->max) + return -EINVAL; ++ sel = sel_unchecked; + + *select = sel; + +-- +2.35.1 + diff --git a/queue-5.17/asoc-max98357a-remove-dependency-on-gpiolib.patch b/queue-5.17/asoc-max98357a-remove-dependency-on-gpiolib.patch new file mode 100644 index 00000000000..90b380df304 --- /dev/null +++ b/queue-5.17/asoc-max98357a-remove-dependency-on-gpiolib.patch @@ -0,0 +1,54 @@ +From b6bdce6bf8cc4f12b8bf68e119dae52eb9ab7136 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 12:26:46 -0500 +Subject: ASoC: max98357a: remove dependency on GPIOLIB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit 21ca3274333f5c1cbbf9d91e5b33f4f2463859b2 ] + +commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a +series of unnecessary dependencies on GPIOLIB when the gpio was +optional. + +A similar simplification seems valid for max98357a, so remove the +dependency as well. This will avoid the following warning + + WARNING: unmet direct dependencies detected for SND_SOC_MAX98357A + Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && GPIOLIB [=n] + Selected by [y]: + - SND_SOC_INTEL_SOF_CS42L42_MACH [=y] && SOUND [=y] && !UML && + SND [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && + (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C + [=y] && ACPI [=y] && SND_HDA_CODEC_HDMI [=y] && + SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || + COMPILE_TEST [=n]) + +Reported-by: kernel test robot +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20220517172647.468244-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 30c00380499c..a8c6c2bfd5a7 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -943,7 +943,6 @@ config SND_SOC_MAX98095 + + config SND_SOC_MAX98357A + tristate "Maxim MAX98357A CODEC" +- depends on GPIOLIB + + config SND_SOC_MAX98371 + tristate +-- +2.35.1 + diff --git a/queue-5.17/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch b/queue-5.17/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch new file mode 100644 index 00000000000..49f6cc46f1c --- /dev/null +++ b/queue-5.17/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch @@ -0,0 +1,49 @@ +From 16aa1e0444185f07e6428b8090c79234f1ad2ae5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 09:29:01 +0000 +Subject: ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe + +From: Miaoqian Lin + +[ Upstream commit 4f4e0454e226de3bf4efd7e7924d1edc571c52d5 ] + +Call of_node_put(platform_node) to avoid refcount leak in +the error path. + +Fixes: 94319ba10eca ("ASoC: mediatek: Use platform_of_node for machine drivers") +Fixes: 493433785df0 ("ASoC: mediatek: mt8173: fix device_node leak") +Signed-off-by: Miaoqian Lin +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220404092903.26725-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c +index 4cb90da89262..58778cd2e61b 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-max98090.c ++++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c +@@ -167,7 +167,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for_each_card_prelinks(card, i, dai_link) { + if (dai_link->codecs->name) +@@ -179,6 +180,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) + ret = devm_snd_soc_register_card(&pdev->dev, card); + + of_node_put(codec_node); ++ ++put_platform_node: + of_node_put(platform_node); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.17/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch b/queue-5.17/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch new file mode 100644 index 00000000000..cf709652129 --- /dev/null +++ b/queue-5.17/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch @@ -0,0 +1,60 @@ +From 5b2c9af2513470342b966d8ab52d4aff47315b39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 09:35:25 +0000 +Subject: ASoC: mediatek: Fix missing of_node_put in + mt2701_wm8960_machine_probe + +From: Miaoqian Lin + +[ Upstream commit 05654431a18fe24e5e46a375d98904134628a102 ] + +This node pointer is returned by of_parse_phandle() with +refcount incremented in this function. +Calling of_node_put() to avoid the refcount leak. + +Fixes: 8625c1dbd876 ("ASoC: mediatek: Add mt2701-wm8960 machine driver") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220404093526.30004-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c +index f56de1b918bf..0cdf2ae36243 100644 +--- a/sound/soc/mediatek/mt2701/mt2701-wm8960.c ++++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c +@@ -129,7 +129,8 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for_each_card_prelinks(card, i, dai_link) { + if (dai_link->codecs->name) +@@ -140,7 +141,7 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + ret = snd_soc_of_parse_audio_routing(card, "audio-routing"); + if (ret) { + dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret); +- return ret; ++ goto put_codec_node; + } + + ret = devm_snd_soc_register_card(&pdev->dev, card); +@@ -148,6 +149,10 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_codec_node: ++ of_node_put(codec_node); ++put_platform_node: ++ of_node_put(platform_node); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.17/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch b/queue-5.17/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch new file mode 100644 index 00000000000..06612c18933 --- /dev/null +++ b/queue-5.17/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch @@ -0,0 +1,36 @@ +From a8129dd5f0e210bede0ce9a9a6a64b0d196cacb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 17:37:22 +0400 +Subject: ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe + +From: Miaoqian Lin + +[ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. + +Fixes: 08641c7c74dd ("ASoC: mxs: add device tree support for mxs-saif") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220511133725.39039-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mxs/mxs-saif.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c +index 879c1221a809..7afe1a1acc56 100644 +--- a/sound/soc/mxs/mxs-saif.c ++++ b/sound/soc/mxs/mxs-saif.c +@@ -754,6 +754,7 @@ static int mxs_saif_probe(struct platform_device *pdev) + saif->master_id = saif->id; + } else { + ret = of_alias_get_id(master, "saif"); ++ of_node_put(master); + if (ret < 0) + return ret; + else +-- +2.35.1 + diff --git a/queue-5.17/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch b/queue-5.17/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch new file mode 100644 index 00000000000..4ae082f30a7 --- /dev/null +++ b/queue-5.17/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch @@ -0,0 +1,39 @@ +From 1b3d8987928c7add5a789ddbf411c0d3a6056158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 19:23:11 +0200 +Subject: ASoC: rk3328: fix disabling mclk on pclk probe failure + +From: Nicolas Frattaroli + +[ Upstream commit dd508e324cdde1c06ace08a8143fa50333a90703 ] + +If preparing/enabling the pclk fails, the probe function should +unprepare and disable the previously prepared and enabled mclk, +which it doesn't do. This commit rectifies this. + +Fixes: c32759035ad2 ("ASoC: rockchip: support ACODEC for rk3328") +Signed-off-by: Nicolas Frattaroli +Reviewed-by: Katsuhiro Suzuki +Link: https://lore.kernel.org/r/20220427172310.138638-1-frattaroli.nicolas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rk3328_codec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rk3328_codec.c b/sound/soc/codecs/rk3328_codec.c +index 758d439e8c7a..86b679cf7aef 100644 +--- a/sound/soc/codecs/rk3328_codec.c ++++ b/sound/soc/codecs/rk3328_codec.c +@@ -481,7 +481,7 @@ static int rk3328_platform_probe(struct platform_device *pdev) + ret = clk_prepare_enable(rk3328->pclk); + if (ret < 0) { + dev_err(&pdev->dev, "failed to enable acodec pclk\n"); +- return ret; ++ goto err_unprepare_mclk; + } + + base = devm_platform_ioremap_resource(pdev, 0); +-- +2.35.1 + diff --git a/queue-5.17/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch b/queue-5.17/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch new file mode 100644 index 00000000000..0541c75f454 --- /dev/null +++ b/queue-5.17/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch @@ -0,0 +1,56 @@ +From 52edd96e26fcdd0b84bd3d72c73854a5e1866827 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 02:55:27 +0000 +Subject: ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear() + +From: Kuninori Morimoto + +[ Upstream commit b1384d4c95088d01f4266237faabf165d3d605fc ] + +commit cfb7b8bf1e2d66 ("ASoC: rsnd: tidyup +rsnd_ssiu_busif_err_status_clear()") merged duplicate code, but it didn't +care about default case, and causes smatch warnings. + +smatch warnings: +sound/soc/sh/rcar/ssiu.c:112 rsnd_ssiu_busif_err_status_clear() \ + error: uninitialized symbol 'offset'. +sound/soc/sh/rcar/ssiu.c:114 rsnd_ssiu_busif_err_status_clear() \ + error: uninitialized symbol 'shift'. + +This patch cares it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87r15rgn6p.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/ssiu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 0d8f97633dd2..138f95dd9f4a 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -102,6 +102,8 @@ bool rsnd_ssiu_busif_err_status_clear(struct rsnd_mod *mod) + shift = 1; + offset = 1; + break; ++ default: ++ goto out; + } + + for (i = 0; i < 4; i++) { +@@ -120,7 +122,7 @@ bool rsnd_ssiu_busif_err_status_clear(struct rsnd_mod *mod) + } + rsnd_mod_write(mod, reg, val); + } +- ++out: + return error; + } + +-- +2.35.1 + diff --git a/queue-5.17/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch b/queue-5.17/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch new file mode 100644 index 00000000000..da9f08c4b94 --- /dev/null +++ b/queue-5.17/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch @@ -0,0 +1,211 @@ +From ee62a6ac6f84538ac733918328d0432951713eee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 02:55:58 +0000 +Subject: ASoC: rsnd: care return value from rsnd_node_fixed_index() + +From: Kuninori Morimoto + +[ Upstream commit d09a7db431c65aaa8303eb456439d1831ca2e6b4 ] + +Renesas Sound is very complex, and thus it needs to use +rsnd_node_fixed_index() to know enabled pin index. + +It returns error if strange pin was selected, +but some codes didn't check it. + +This patch 1) indicates error message, 2) check return +value. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87pmlbgn5t.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/core.c | 15 ++++++++++----- + sound/soc/sh/rcar/dma.c | 9 ++++++++- + sound/soc/sh/rcar/rsnd.h | 2 +- + sound/soc/sh/rcar/src.c | 7 ++++++- + sound/soc/sh/rcar/ssi.c | 14 ++++++++++++-- + sound/soc/sh/rcar/ssiu.c | 7 ++++++- + 6 files changed, 43 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index 6a8fe0da7670..af8ef2a27d34 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -1159,6 +1159,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *np; + int i; + +@@ -1169,7 +1170,11 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = mod_get(priv, i); + +@@ -1183,7 +1188,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + of_node_put(node); + } + +-int rsnd_node_fixed_index(struct device_node *node, char *name, int idx) ++int rsnd_node_fixed_index(struct device *dev, struct device_node *node, char *name, int idx) + { + char node_name[16]; + +@@ -1210,6 +1215,8 @@ int rsnd_node_fixed_index(struct device_node *node, char *name, int idx) + return idx; + } + ++ dev_err(dev, "strange node numbering (%s)", ++ of_node_full_name(node)); + return -EINVAL; + } + +@@ -1221,10 +1228,8 @@ int rsnd_node_count(struct rsnd_priv *priv, struct device_node *node, char *name + + i = 0; + for_each_child_of_node(node, np) { +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); + if (i < 0) { +- dev_err(dev, "strange node numbering (%s)", +- of_node_full_name(node)); + of_node_put(np); + return 0; + } +diff --git a/sound/soc/sh/rcar/dma.c b/sound/soc/sh/rcar/dma.c +index 03e0d4eca781..463ab237d7bd 100644 +--- a/sound/soc/sh/rcar/dma.c ++++ b/sound/soc/sh/rcar/dma.c +@@ -240,12 +240,19 @@ static int rsnd_dmaen_start(struct rsnd_mod *mod, + struct dma_chan *rsnd_dma_request_channel(struct device_node *of_node, char *name, + struct rsnd_mod *mod, char *x) + { ++ struct rsnd_priv *priv = rsnd_mod_to_priv(mod); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct dma_chan *chan = NULL; + struct device_node *np; + int i = 0; + + for_each_child_of_node(of_node, np) { +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); ++ if (i < 0) { ++ chan = NULL; ++ of_node_put(np); ++ break; ++ } + + if (i == rsnd_mod_id_raw(mod) && (!chan)) + chan = of_dma_request_slave_channel(np, x); +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index 6580bab0e229..d9cd190d7e19 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -460,7 +460,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + struct device_node *playback, + struct device_node *capture); + int rsnd_node_count(struct rsnd_priv *priv, struct device_node *node, char *name); +-int rsnd_node_fixed_index(struct device_node *node, char *name, int idx); ++int rsnd_node_fixed_index(struct device *dev, struct device_node *node, char *name, int idx); + + int rsnd_channel_normalization(int chan); + #define rsnd_runtime_channel_original(io) \ +diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c +index 42a100c6303d..0ea84ae57c6a 100644 +--- a/sound/soc/sh/rcar/src.c ++++ b/sound/soc/sh/rcar/src.c +@@ -676,7 +676,12 @@ int rsnd_src_probe(struct rsnd_priv *priv) + if (!of_device_is_available(np)) + goto skip; + +- i = rsnd_node_fixed_index(np, SRC_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SRC_NAME, i); ++ if (i < 0) { ++ ret = -EINVAL; ++ of_node_put(np); ++ goto rsnd_src_probe_done; ++ } + + src = rsnd_src_get(priv, i); + +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index 87e606f688d3..43c5e27dc5c8 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -1105,6 +1105,7 @@ void rsnd_parse_connect_ssi(struct rsnd_dai *rdai, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *node; + struct device_node *np; + int i; +@@ -1117,7 +1118,11 @@ void rsnd_parse_connect_ssi(struct rsnd_dai *rdai, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, SSI_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSI_NAME, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = rsnd_ssi_mod_get(priv, i); + +@@ -1182,7 +1187,12 @@ int rsnd_ssi_probe(struct rsnd_priv *priv) + if (!of_device_is_available(np)) + goto skip; + +- i = rsnd_node_fixed_index(np, SSI_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSI_NAME, i); ++ if (i < 0) { ++ ret = -EINVAL; ++ of_node_put(np); ++ goto rsnd_ssi_probe_done; ++ } + + ssi = rsnd_ssi_get(priv, i); + +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 138f95dd9f4a..4b8a63e336c7 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -462,6 +462,7 @@ void rsnd_parse_connect_ssiu(struct rsnd_dai *rdai, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *node = rsnd_ssiu_of_node(priv); + struct rsnd_dai_stream *io_p = &rdai->playback; + struct rsnd_dai_stream *io_c = &rdai->capture; +@@ -474,7 +475,11 @@ void rsnd_parse_connect_ssiu(struct rsnd_dai *rdai, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, SSIU_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSIU_NAME, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = rsnd_ssiu_mod_get(priv, i); + +-- +2.35.1 + diff --git a/queue-5.17/asoc-rt1015p-remove-dependency-on-gpiolib.patch b/queue-5.17/asoc-rt1015p-remove-dependency-on-gpiolib.patch new file mode 100644 index 00000000000..e4f1d3997d5 --- /dev/null +++ b/queue-5.17/asoc-rt1015p-remove-dependency-on-gpiolib.patch @@ -0,0 +1,59 @@ +From b254b14e04a4ee09568f95e423bc163c5a038b9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 12:26:47 -0500 +Subject: ASoC: rt1015p: remove dependency on GPIOLIB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit b390c25c6757b9d56cecdfbf6d55f15fc89a6386 ] + +commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a +series of unnecessary dependencies on GPIOLIB when the gpio was +optional. + +A similar simplification seems valid for rt1015p, so remove the +dependency as well. This will avoid the following warning + + WARNING: unmet direct dependencies detected for SND_SOC_RT1015P + + Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && + GPIOLIB [=n] + + Selected by [y]: + + - SND_SOC_INTEL_SOF_RT5682_MACH [=y] && SOUND [=y] && !UML && SND + [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && + (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C + [=y] && ACPI [=y] && (SND_HDA_CODEC_HDMI [=y] && + SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || + COMPILE_TEST [=y]) || SND_SOC_SOF_BAYTRAIL [=n] && + (X86_INTEL_LPSS [=n] || COMPILE_TEST [=y])) + +Reported-by: kernel test robot +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20220517172647.468244-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index a8c6c2bfd5a7..3496403004ac 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -1202,7 +1202,6 @@ config SND_SOC_RT1015 + + config SND_SOC_RT1015P + tristate +- depends on GPIOLIB + + config SND_SOC_RT1019 + tristate +-- +2.35.1 + diff --git a/queue-5.17/asoc-rt5645-fix-errorenous-cleanup-order.patch b/queue-5.17/asoc-rt5645-fix-errorenous-cleanup-order.patch new file mode 100644 index 00000000000..7473ed8f8a8 --- /dev/null +++ b/queue-5.17/asoc-rt5645-fix-errorenous-cleanup-order.patch @@ -0,0 +1,53 @@ +From f1ea7c68d1ba2057d1ba560cc5370a911c4431c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 May 2022 17:20:35 +0800 +Subject: ASoC: rt5645: Fix errorenous cleanup order + +From: Lin Ma + +[ Upstream commit 2def44d3aec59e38d2701c568d65540783f90f2f ] + +There is a logic error when removing rt5645 device as the function +rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and +delete the &rt5645->btn_check_timer latter. However, since the timer +handler rt5645_btn_check_callback() will re-queue the jack_detect_work, +this cleanup order is buggy. + +That is, once the del_timer_sync in rt5645_i2c_remove is concurrently +run with the rt5645_btn_check_callback, the canceled jack_detect_work +will be rescheduled again, leading to possible use-after-free. + +This patch fix the issue by placing the del_timer_sync function before +the cancel_delayed_work_sync. + +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20220516092035.28283-1-linma@zju.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 197c56047947..4b2e027c1033 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -4154,9 +4154,14 @@ static int rt5645_i2c_remove(struct i2c_client *i2c) + if (i2c->irq) + free_irq(i2c->irq, rt5645); + ++ /* ++ * Since the rt5645_btn_check_callback() can queue jack_detect_work, ++ * the timer need to be delted first ++ */ ++ del_timer_sync(&rt5645->btn_check_timer); ++ + cancel_delayed_work_sync(&rt5645->jack_detect_work); + cancel_delayed_work_sync(&rt5645->rcclock_work); +- del_timer_sync(&rt5645->btn_check_timer); + + regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies); + +-- +2.35.1 + diff --git a/queue-5.17/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch b/queue-5.17/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch new file mode 100644 index 00000000000..b069dfc6bd7 --- /dev/null +++ b/queue-5.17/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch @@ -0,0 +1,43 @@ +From d44569dce454a7c915b66dc0da5e690a9785aaca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 08:38:28 +0400 +Subject: ASoC: samsung: Fix refcount leak in aries_audio_probe + +From: Miaoqian Lin + +[ Upstream commit bf4a9b2467b775717d0e9034ad916888e19713a3 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +If extcon_find_edev_by_node() fails, it doesn't call of_node_put() +Calling of_node_put() after extcon_find_edev_by_node() to fix this. + +Fixes: 7a3a7671fa6c ("ASoC: samsung: Add driver for Aries boards") +Signed-off-by: Miaoqian Lin +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220512043828.496-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/samsung/aries_wm8994.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/samsung/aries_wm8994.c b/sound/soc/samsung/aries_wm8994.c +index 5265e546b124..83acbe57b248 100644 +--- a/sound/soc/samsung/aries_wm8994.c ++++ b/sound/soc/samsung/aries_wm8994.c +@@ -585,10 +585,10 @@ static int aries_audio_probe(struct platform_device *pdev) + + extcon_np = of_parse_phandle(np, "extcon", 0); + priv->usb_extcon = extcon_find_edev_by_node(extcon_np); ++ of_node_put(extcon_np); + if (IS_ERR(priv->usb_extcon)) + return dev_err_probe(dev, PTR_ERR(priv->usb_extcon), + "Failed to get extcon device"); +- of_node_put(extcon_np); + + priv->adc = devm_iio_channel_get(dev, "headset-detect"); + if (IS_ERR(priv->adc)) +-- +2.35.1 + diff --git a/queue-5.17/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch b/queue-5.17/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch new file mode 100644 index 00000000000..6460199333b --- /dev/null +++ b/queue-5.17/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch @@ -0,0 +1,62 @@ +From 1c611d100dd4fad88cdfcbb57efec54623b1eff4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 08:49:21 +0100 +Subject: ASoC: sh: rz-ssi: Propagate error codes returned from + platform_get_irq_byname() + +From: Lad Prabhakar + +[ Upstream commit 91686a3984f34df0ab844cdbaa7e4d9621129f5d ] + +Propagate error codes returned from platform_get_irq_byname() instead of +returning -ENODEV. platform_get_irq_byname() may return -EPROBE_DEFER, to +handle such cases propagate the error codes. + +While at it drop the dev_err_probe() messages as platform_get_irq_byname() +already does this for us in case of error. + +Signed-off-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20220426074922.13319-3-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 7379b1489e35..3b55444a1b58 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -983,8 +983,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + /* Error Interrupt */ + ssi->irq_int = platform_get_irq_byname(pdev, "int_req"); + if (ssi->irq_int < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI int_req IRQ\n"); ++ return ssi->irq_int; + + ret = devm_request_irq(&pdev->dev, ssi->irq_int, &rz_ssi_interrupt, + 0, dev_name(&pdev->dev), ssi); +@@ -996,8 +995,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + /* Tx and Rx interrupts (pio only) */ + ssi->irq_tx = platform_get_irq_byname(pdev, "dma_tx"); + if (ssi->irq_tx < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI dma_tx IRQ\n"); ++ return ssi->irq_tx; + + ret = devm_request_irq(&pdev->dev, ssi->irq_tx, + &rz_ssi_interrupt, 0, +@@ -1008,8 +1006,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + + ssi->irq_rx = platform_get_irq_byname(pdev, "dma_rx"); + if (ssi->irq_rx < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI dma_rx IRQ\n"); ++ return ssi->irq_rx; + + ret = devm_request_irq(&pdev->dev, ssi->irq_rx, + &rz_ssi_interrupt, 0, +-- +2.35.1 + diff --git a/queue-5.17/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch b/queue-5.17/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch new file mode 100644 index 00000000000..8d15f565300 --- /dev/null +++ b/queue-5.17/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch @@ -0,0 +1,70 @@ +From 427078484851d206e460220ccf12c1f4397a97e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 08:49:22 +0100 +Subject: ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error + path + +From: Lad Prabhakar + +[ Upstream commit 767e6f26204d3f5406630e86b720d01818b8616d ] + +DMA channels requested by rz_ssi_dma_request() in rz_ssi_probe() were +never released in the error path apart from one place. This patch fixes +this issue by calling rz_ssi_release_dma_channels() in the error path. + +Fixes: 26ac471c5354 ("ASoC: sh: rz-ssi: Add SSI DMAC support") +Reported-by: Pavel Machek +Signed-off-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20220426074922.13319-4-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 3b55444a1b58..6d794eaaf4c3 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -982,14 +982,18 @@ static int rz_ssi_probe(struct platform_device *pdev) + + /* Error Interrupt */ + ssi->irq_int = platform_get_irq_byname(pdev, "int_req"); +- if (ssi->irq_int < 0) ++ if (ssi->irq_int < 0) { ++ rz_ssi_release_dma_channels(ssi); + return ssi->irq_int; ++ } + + ret = devm_request_irq(&pdev->dev, ssi->irq_int, &rz_ssi_interrupt, + 0, dev_name(&pdev->dev), ssi); +- if (ret < 0) ++ if (ret < 0) { ++ rz_ssi_release_dma_channels(ssi); + return dev_err_probe(&pdev->dev, ret, + "irq request error (int_req)\n"); ++ } + + if (!rz_ssi_is_dma_enabled(ssi)) { + /* Tx and Rx interrupts (pio only) */ +@@ -1017,13 +1021,16 @@ static int rz_ssi_probe(struct platform_device *pdev) + } + + ssi->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); +- if (IS_ERR(ssi->rstc)) ++ if (IS_ERR(ssi->rstc)) { ++ rz_ssi_release_dma_channels(ssi); + return PTR_ERR(ssi->rstc); ++ } + + reset_control_deassert(ssi->rstc); + pm_runtime_enable(&pdev->dev); + ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) { ++ rz_ssi_release_dma_channels(ssi); + pm_runtime_disable(ssi->dev); + reset_control_assert(ssi->rstc); + return dev_err_probe(ssi->dev, ret, "pm_runtime_resume_and_get failed\n"); +-- +2.35.1 + diff --git a/queue-5.17/asoc-sof-amd-add-missing-platform_device_unregister-.patch b/queue-5.17/asoc-sof-amd-add-missing-platform_device_unregister-.patch new file mode 100644 index 00000000000..1dd116c46fb --- /dev/null +++ b/queue-5.17/asoc-sof-amd-add-missing-platform_device_unregister-.patch @@ -0,0 +1,36 @@ +From 22b94cd7e4e88c2653fb413f4c9eb62200a87633 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 09:37:28 +0800 +Subject: ASoC: SOF: amd: add missing platform_device_unregister in + acp_pci_rn_probe + +From: Zheng Bin + +[ Upstream commit cbcab8cd737c74c20195c31d647e19f7cb49c9b8 ] + +acp_pci_rn_probe misses a call platform_device_unregister in error path, +this patch fixes that. + +Signed-off-by: Zheng Bin +Link: https://lore.kernel.org/r/20220512013728.4128903-1-zhengbin13@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/pci-rn.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/sof/amd/pci-rn.c b/sound/soc/sof/amd/pci-rn.c +index 392ffbdf6417..d809d151a38c 100644 +--- a/sound/soc/sof/amd/pci-rn.c ++++ b/sound/soc/sof/amd/pci-rn.c +@@ -93,6 +93,7 @@ static int acp_pci_rn_probe(struct pci_dev *pci, const struct pci_device_id *pci + res = devm_kzalloc(&pci->dev, sizeof(struct resource) * ARRAY_SIZE(renoir_res), GFP_KERNEL); + if (!res) { + sof_pci_remove(pci); ++ platform_device_unregister(dmic_dev); + return -ENOMEM; + } + +-- +2.35.1 + diff --git a/queue-5.17/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch b/queue-5.17/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch new file mode 100644 index 00000000000..c5bb8722cb2 --- /dev/null +++ b/queue-5.17/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch @@ -0,0 +1,136 @@ +From 82657b978369811f67a1c3d39e817677ec9c7f47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 15:13:30 +0400 +Subject: ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* + +From: Miaoqian Lin + +[ Upstream commit a34840c4eb3278a7c29c9c57a65ce7541c66f9f2 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 6748d0559059 ("ASoC: ti: Add custom machine driver for j721e EVM (CPB and IVI)") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220512111331.44774-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/j721e-evm.c | 44 ++++++++++++++++++++++++++++++---------- + 1 file changed, 33 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c +index 4077e15ec48b..6a969874c927 100644 +--- a/sound/soc/ti/j721e-evm.c ++++ b/sound/soc/ti/j721e-evm.c +@@ -630,17 +630,18 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + codec_node = of_parse_phandle(node, "ti,cpb-codec", 0); + if (!codec_node) { + dev_err(priv->dev, "CPB codec node is not provided\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_dai_node; + } + + domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_CPB]; + ret = j721e_get_clocks(priv->dev, &domain->codec, "cpb-codec-scki"); + if (ret) +- return ret; ++ goto put_codec_node; + + ret = j721e_get_clocks(priv->dev, &domain->mcasp, "cpb-mcasp-auxclk"); + if (ret) +- return ret; ++ goto put_codec_node; + + /* + * Common Processor Board, two links +@@ -650,8 +651,10 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + comp_count = 6; + compnent = devm_kzalloc(priv->dev, comp_count * sizeof(*compnent), + GFP_KERNEL); +- if (!compnent) +- return -ENOMEM; ++ if (!compnent) { ++ ret = -ENOMEM; ++ goto put_codec_node; ++ } + + comp_idx = 0; + priv->dai_links[*link_idx].cpus = &compnent[comp_idx++]; +@@ -702,6 +705,12 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + (*conf_idx)++; + + return 0; ++ ++put_codec_node: ++ of_node_put(codec_node); ++put_dai_node: ++ of_node_put(dai_node); ++ return ret; + } + + static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, +@@ -726,23 +735,25 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + codeca_node = of_parse_phandle(node, "ti,ivi-codec-a", 0); + if (!codeca_node) { + dev_err(priv->dev, "IVI codec-a node is not provided\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_dai_node; + } + + codecb_node = of_parse_phandle(node, "ti,ivi-codec-b", 0); + if (!codecb_node) { + dev_warn(priv->dev, "IVI codec-b node is not provided\n"); +- return 0; ++ ret = 0; ++ goto put_codeca_node; + } + + domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_IVI]; + ret = j721e_get_clocks(priv->dev, &domain->codec, "ivi-codec-scki"); + if (ret) +- return ret; ++ goto put_codecb_node; + + ret = j721e_get_clocks(priv->dev, &domain->mcasp, "ivi-mcasp-auxclk"); + if (ret) +- return ret; ++ goto put_codecb_node; + + /* + * IVI extension, two links +@@ -754,8 +765,10 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + comp_count = 8; + compnent = devm_kzalloc(priv->dev, comp_count * sizeof(*compnent), + GFP_KERNEL); +- if (!compnent) +- return -ENOMEM; ++ if (!compnent) { ++ ret = -ENOMEM; ++ goto put_codecb_node; ++ } + + comp_idx = 0; + priv->dai_links[*link_idx].cpus = &compnent[comp_idx++]; +@@ -816,6 +829,15 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + (*conf_idx)++; + + return 0; ++ ++ ++put_codecb_node: ++ of_node_put(codecb_node); ++put_codeca_node: ++ of_node_put(codeca_node); ++put_dai_node: ++ of_node_put(dai_node); ++ return ret; + } + + static int j721e_soc_probe(struct platform_device *pdev) +-- +2.35.1 + diff --git a/queue-5.17/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch b/queue-5.17/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch new file mode 100644 index 00000000000..b9a7652b24c --- /dev/null +++ b/queue-5.17/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch @@ -0,0 +1,68 @@ +From ed640ba614b4e9a9407b1e6b828d8b19cedbc76a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:52 +0100 +Subject: ASoC: tscs454: Add endianness flag in snd_soc_component_driver + +From: Charles Keepax + +[ Upstream commit ff69ec96b87dccb3a29edef8cec5d4fefbbc2055 ] + +The endianness flag is used on the CODEC side to specify an +ambivalence to endian, typically because it is lost over the hardware +link. This device receives audio over an I2S DAI and as such should +have endianness applied. + +A fixup is also required to use the width directly rather than relying +on the format in hw_params, now both little and big endian would be +supported. It is worth noting this changes the behaviour of S24_LE to +use a word length of 24 rather than 32. This would appear to be a +correction since the fact S24_LE is stored as 32 bits should not be +presented over the bus. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-26-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tscs454.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/tscs454.c b/sound/soc/codecs/tscs454.c +index 43220bb36701..c27ca9a273e1 100644 +--- a/sound/soc/codecs/tscs454.c ++++ b/sound/soc/codecs/tscs454.c +@@ -3120,18 +3120,17 @@ static int set_aif_sample_format(struct snd_soc_component *component, + unsigned int width; + int ret; + +- switch (format) { +- case SNDRV_PCM_FORMAT_S16_LE: ++ switch (snd_pcm_format_width(format)) { ++ case 16: + width = FV_WL_16; + break; +- case SNDRV_PCM_FORMAT_S20_3LE: ++ case 20: + width = FV_WL_20; + break; +- case SNDRV_PCM_FORMAT_S24_3LE: ++ case 24: + width = FV_WL_24; + break; +- case SNDRV_PCM_FORMAT_S24_LE: +- case SNDRV_PCM_FORMAT_S32_LE: ++ case 32: + width = FV_WL_32; + break; + default: +@@ -3326,6 +3325,7 @@ static const struct snd_soc_component_driver soc_component_dev_tscs454 = { + .num_dapm_routes = ARRAY_SIZE(tscs454_intercon), + .controls = tscs454_snd_controls, + .num_controls = ARRAY_SIZE(tscs454_snd_controls), ++ .endianness = 1, + }; + + #define TSCS454_RATES SNDRV_PCM_RATE_8000_96000 +-- +2.35.1 + diff --git a/queue-5.17/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch b/queue-5.17/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch new file mode 100644 index 00000000000..83c4e48e4ee --- /dev/null +++ b/queue-5.17/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch @@ -0,0 +1,55 @@ +From 2221576a72398cebac3e53a0e16e3eb9e89e51ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 May 2022 17:10:53 +0800 +Subject: ASoC: wm2000: fix missing clk_disable_unprepare() on error in + wm2000_anc_transition() + +From: Yang Yingliang + +[ Upstream commit be2af740e2a9c7134f2d8ab4f104006e110b13de ] + +Fix the missing clk_disable_unprepare() before return +from wm2000_anc_transition() in the error handling case. + +Fixes: 514cfd6dd725 ("ASoC: wm2000: Integrate with clock API") +Signed-off-by: Yang Yingliang +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20220514091053.686416-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm2000.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c +index 72e165cc6443..97ece3114b3d 100644 +--- a/sound/soc/codecs/wm2000.c ++++ b/sound/soc/codecs/wm2000.c +@@ -536,7 +536,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, + { + struct i2c_client *i2c = wm2000->i2c; + int i, j; +- int ret; ++ int ret = 0; + + if (wm2000->anc_mode == mode) + return 0; +@@ -566,13 +566,13 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, + ret = anc_transitions[i].step[j](i2c, + anc_transitions[i].analogue); + if (ret != 0) +- return ret; ++ break; + } + + if (anc_transitions[i].dest == ANC_OFF) + clk_disable_unprepare(wm2000->mclk); + +- return 0; ++ return ret; + } + + static int wm2000_anc_set_mode(struct wm2000_priv *wm2000) +-- +2.35.1 + diff --git a/queue-5.17/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch b/queue-5.17/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch new file mode 100644 index 00000000000..202cfd184c7 --- /dev/null +++ b/queue-5.17/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch @@ -0,0 +1,114 @@ +From 4f41a2c88e54b6fb62809b4cbeb6c388007ee7e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 10:37:33 +0300 +Subject: ath10k: skip ath10k_halt during suspend for driver state RESTARTING + +From: Abhishek Kumar + +[ Upstream commit b72a4aff947ba807177bdabb43debaf2c66bee05 ] + +Double free crash is observed when FW recovery(caused by wmi +timeout/crash) is followed by immediate suspend event. The FW recovery +is triggered by ath10k_core_restart() which calls driver clean up via +ath10k_halt(). When the suspend event occurs between the FW recovery, +the restart worker thread is put into frozen state until suspend completes. +The suspend event triggers ath10k_stop() which again triggers ath10k_halt() +The double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be +called twice(Note: ath10k_htt_rx_alloc was not called by restart worker +thread because of its frozen state), causing the crash. + +To fix this, during the suspend flow, skip call to ath10k_halt() in +ath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING. +Also, for driver state ATH10K_STATE_RESTARTING, call +ath10k_wait_for_suspend() in ath10k_stop(). This is because call to +ath10k_wait_for_suspend() is skipped later in +[ath10k_halt() > ath10k_core_stop()] for the driver state +ATH10K_STATE_RESTARTING. + +The frozen restart worker thread will be cancelled during resume when the +device comes out of suspend. + +Below is the crash stack for reference: + +[ 428.469167] ------------[ cut here ]------------ +[ 428.469180] kernel BUG at mm/slub.c:4150! +[ 428.469193] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI +[ 428.469219] Workqueue: events_unbound async_run_entry_fn +[ 428.469230] RIP: 0010:kfree+0x319/0x31b +[ 428.469241] RSP: 0018:ffffa1fac015fc30 EFLAGS: 00010246 +[ 428.469247] RAX: ffffedb10419d108 RBX: ffff8c05262b0000 +[ 428.469252] RDX: ffff8c04a8c07000 RSI: 0000000000000000 +[ 428.469256] RBP: ffffa1fac015fc78 R08: 0000000000000000 +[ 428.469276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 428.469285] Call Trace: +[ 428.469295] ? dma_free_attrs+0x5f/0x7d +[ 428.469320] ath10k_core_stop+0x5b/0x6f +[ 428.469336] ath10k_halt+0x126/0x177 +[ 428.469352] ath10k_stop+0x41/0x7e +[ 428.469387] drv_stop+0x88/0x10e +[ 428.469410] __ieee80211_suspend+0x297/0x411 +[ 428.469441] rdev_suspend+0x6e/0xd0 +[ 428.469462] wiphy_suspend+0xb1/0x105 +[ 428.469483] ? name_show+0x2d/0x2d +[ 428.469490] dpm_run_callback+0x8c/0x126 +[ 428.469511] ? name_show+0x2d/0x2d +[ 428.469517] __device_suspend+0x2e7/0x41b +[ 428.469523] async_suspend+0x1f/0x93 +[ 428.469529] async_run_entry_fn+0x3d/0xd1 +[ 428.469535] process_one_work+0x1b1/0x329 +[ 428.469541] worker_thread+0x213/0x372 +[ 428.469547] kthread+0x150/0x15f +[ 428.469552] ? pr_cont_work+0x58/0x58 +[ 428.469558] ? kthread_blkcg+0x31/0x31 + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1 +Co-developed-by: Wen Gong +Signed-off-by: Wen Gong +Signed-off-by: Abhishek Kumar +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220426221859.v2.1.I650b809482e1af8d0156ed88b5dc2677a0711d46@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index b11aaee8b8c0..a11b31191d5a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5339,13 +5339,29 @@ static int ath10k_start(struct ieee80211_hw *hw) + static void ath10k_stop(struct ieee80211_hw *hw) + { + struct ath10k *ar = hw->priv; ++ u32 opt; + + ath10k_drain_tx(ar); + + mutex_lock(&ar->conf_mutex); + if (ar->state != ATH10K_STATE_OFF) { +- if (!ar->hw_rfkill_on) +- ath10k_halt(ar); ++ if (!ar->hw_rfkill_on) { ++ /* If the current driver state is RESTARTING but not yet ++ * fully RESTARTED because of incoming suspend event, ++ * then ath10k_halt() is already called via ++ * ath10k_core_restart() and should not be called here. ++ */ ++ if (ar->state != ATH10K_STATE_RESTARTING) { ++ ath10k_halt(ar); ++ } else { ++ /* Suspending here, because when in RESTARTING ++ * state, ath10k_core_stop() skips ++ * ath10k_wait_for_suspend(). ++ */ ++ opt = WMI_PDEV_SUSPEND_AND_DISABLE_INTR; ++ ath10k_wait_for_suspend(ar, opt); ++ } ++ } + ar->state = ATH10K_STATE_OFF; + } + mutex_unlock(&ar->conf_mutex); +-- +2.35.1 + diff --git a/queue-5.17/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch b/queue-5.17/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch new file mode 100644 index 00000000000..0753d5efa67 --- /dev/null +++ b/queue-5.17/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch @@ -0,0 +1,64 @@ +From 67390202a967fc5a8f19fcc84528fa9d5732bbc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 12:58:23 +0200 +Subject: ath11k: acquire ab->base_lock in unassign when finding the peer by + addr + +From: Niels Dossche + +[ Upstream commit 2db80f93869d491be57cbc2b36f30d0d3a0e5bde ] + +ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be +held when calling that function in order to protect the list. All +callers except ath11k_mac_op_unassign_vif_chanctx have that lock +acquired when calling ath11k_peer_find_by_addr. That lock is also not +transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. +The solution is to acquire the lock when calling +ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. + +I am currently working on a static analyser to detect missing locks and +this was a reported case. I manually verified the report by looking at +the code, but I do not have real hardware so this is compile tested +only. + +Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") +Signed-off-by: Niels Dossche +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220314215253.92658-1-dossche.niels@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index b2dac859dfe1..16b45b742f9d 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -7068,6 +7068,7 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, + struct ath11k *ar = hw->priv; + struct ath11k_base *ab = ar->ab; + struct ath11k_vif *arvif = (void *)vif->drv_priv; ++ struct ath11k_peer *peer; + int ret; + + mutex_lock(&ar->conf_mutex); +@@ -7079,9 +7080,13 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, + WARN_ON(!arvif->is_started); + + if (ab->hw_params.vdev_start_delay && +- arvif->vdev_type == WMI_VDEV_TYPE_MONITOR && +- ath11k_peer_find_by_addr(ab, ar->mac_addr)) +- ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); ++ arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { ++ spin_lock_bh(&ab->base_lock); ++ peer = ath11k_peer_find_by_addr(ab, ar->mac_addr); ++ spin_unlock_bh(&ab->base_lock); ++ if (peer) ++ ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); ++ } + + if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { + ret = ath11k_mac_monitor_stop(ar); +-- +2.35.1 + diff --git a/queue-5.17/ath11k-change-max-no-of-active-probe-ssid-and-bssid-.patch b/queue-5.17/ath11k-change-max-no-of-active-probe-ssid-and-bssid-.patch new file mode 100644 index 00000000000..b423d095969 --- /dev/null +++ b/queue-5.17/ath11k-change-max-no-of-active-probe-ssid-and-bssid-.patch @@ -0,0 +1,79 @@ +From d9686b3896be40c14be1018be36403c405469663 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 14:53:09 +0300 +Subject: ath11k: Change max no of active probe SSID and BSSID to fw capability + +From: Karthikeyan Kathirvel + +[ Upstream commit 50dc9ce9f80554a88e33b73c30851acf2be36ed3 ] + +The maximum number of SSIDs in a for active probe requests is currently +reported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver. +The scan_req_params structure only has the capacity to hold 10 SSIDs. +This leads to a buffer overflow which can be triggered from +wpa_supplicant in userspace. When copying the SSIDs into the +scan_req_params structure in the ath11k_mac_op_hw_scan route, it can +overwrite the extraie pointer. + +Firmware supports 16 ssid * 4 bssid, for each ssid 4 bssid combo probe +request will be sent, so totally 64 probe requests supported. So +set both max ssid and bssid to 16 and 4 respectively. Remove the +redundant macros of ssid and bssid. + +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01300-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Karthikeyan Kathirvel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220329150221.21907-1-quic_kathirve@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/wmi.h | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h +index 2f26ec1a8aa3..8173570975e4 100644 +--- a/drivers/net/wireless/ath/ath11k/wmi.h ++++ b/drivers/net/wireless/ath/ath11k/wmi.h +@@ -3087,9 +3087,6 @@ enum scan_dwelltime_adaptive_mode { + SCAN_DWELL_MODE_STATIC = 4 + }; + +-#define WLAN_SCAN_MAX_NUM_SSID 10 +-#define WLAN_SCAN_MAX_NUM_BSSID 10 +- + #define WLAN_SSID_MAX_LEN 32 + + struct element_info { +@@ -3104,7 +3101,6 @@ struct wlan_ssid { + + #define WMI_IE_BITMAP_SIZE 8 + +-#define WMI_SCAN_MAX_NUM_SSID 0x0A + /* prefix used by scan requestor ids on the host */ + #define WMI_HOST_SCAN_REQUESTOR_ID_PREFIX 0xA000 + +@@ -3112,10 +3108,6 @@ struct wlan_ssid { + /* host cycles through the lower 12 bits to generate ids */ + #define WMI_HOST_SCAN_REQ_ID_PREFIX 0xA000 + +-#define WLAN_SCAN_PARAMS_MAX_SSID 16 +-#define WLAN_SCAN_PARAMS_MAX_BSSID 4 +-#define WLAN_SCAN_PARAMS_MAX_IE_LEN 256 +- + /* Values lower than this may be refused by some firmware revisions with a scan + * completion with a timedout reason. + */ +@@ -3311,8 +3303,8 @@ struct scan_req_params { + u32 n_probes; + u32 *chan_list; + u32 notify_scan_events; +- struct wlan_ssid ssid[WLAN_SCAN_MAX_NUM_SSID]; +- struct wmi_mac_addr bssid_list[WLAN_SCAN_MAX_NUM_BSSID]; ++ struct wlan_ssid ssid[WLAN_SCAN_PARAMS_MAX_SSID]; ++ struct wmi_mac_addr bssid_list[WLAN_SCAN_PARAMS_MAX_BSSID]; + struct element_info extraie; + struct element_info htcap; + struct element_info vhtcap; +-- +2.35.1 + diff --git a/queue-5.17/ath11k-disable-spectral-scan-during-spectral-deinit.patch b/queue-5.17/ath11k-disable-spectral-scan-during-spectral-deinit.patch new file mode 100644 index 00000000000..03c0ad6798f --- /dev/null +++ b/queue-5.17/ath11k-disable-spectral-scan-during-spectral-deinit.patch @@ -0,0 +1,104 @@ +From d671fce234ac5e252ca5594d476b0c48b1966667 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 12:36:47 +0300 +Subject: ath11k: disable spectral scan during spectral deinit + +From: Hari Chandrakanthan + +[ Upstream commit 161c64de239c7018e0295e7e0520a19f00aa32dc ] + +When ath11k modules are removed using rmmod with spectral scan enabled, +crash is observed. Different crash trace is observed for each crash. + +Send spectral scan disable WMI command to firmware before cleaning +the spectral dbring in the spectral_deinit API to avoid this crash. + +call trace from one of the crash observed: +[ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008 +[ 1252.882722] pgd = 0f42e886 +[ 1252.890955] [00000008] *pgd=00000000 +[ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM +[ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0 +[ 1253.115261] Hardware name: Generic DT based system +[ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k] +[ 1253.125940] LR is at 0x88e31017 +[ 1253.132448] pc : [<7f9387b8>] lr : [<88e31017>] psr: a0000193 +[ 1253.135488] sp : 80d01bc8 ip : 00000001 fp : 970e0000 +[ 1253.141737] r10: 88e31000 r9 : 970ec000 r8 : 00000080 +[ 1253.146946] r7 : 94734040 r6 : a0000113 r5 : 00000057 r4 : 00000000 +[ 1253.152159] r3 : e18cb694 r2 : 00000217 r1 : 1df1f000 r0 : 00000001 +[ 1253.158755] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user +[ 1253.165266] Control: 10c0383d Table: 5e71006a DAC: 00000055 +[ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141) +[ 1253.458055] [<7f9387b8>] (ath11k_spectral_process_data [ath11k]) from [<7f917fdc>] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k]) +[ 1253.466139] [<7f917fdc>] (ath11k_dbring_buffer_release_event [ath11k]) from [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k]) +[ 1253.478807] [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx [ath11k]) from [<7f8fe868>] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k]) +[ 1253.490699] [<7f8fe868>] (ath11k_htc_rx_completion_handler [ath11k]) from [<7f91308c>] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k]) +[ 1253.502386] [<7f91308c>] (ath11k_ce_per_engine_service [ath11k]) from [<7f9a4198>] (ath11k_pci_ce_tasklet+0x28/0x80 [ath11k_pci]) +[ 1253.514811] [<7f9a4198>] (ath11k_pci_ce_tasklet [ath11k_pci]) from [<8032227c>] (tasklet_action_common.constprop.2+0x64/0xe8) +[ 1253.526476] [<8032227c>] (tasklet_action_common.constprop.2) from [<803021e8>] (__do_softirq+0x130/0x2d0) +[ 1253.537756] [<803021e8>] (__do_softirq) from [<80322610>] (irq_exit+0xcc/0xe8) +[ 1253.547304] [<80322610>] (irq_exit) from [<8036a4a4>] (__handle_domain_irq+0x60/0xb4) +[ 1253.554428] [<8036a4a4>] (__handle_domain_irq) from [<805eb348>] (gic_handle_irq+0x4c/0x90) +[ 1253.562321] [<805eb348>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) + +Tested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Hari Chandrakanthan +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1649396345-349-1-git-send-email-quic_haric@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/spectral.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/spectral.c b/drivers/net/wireless/ath/ath11k/spectral.c +index 4100cc1449a2..e997426a1b4b 100644 +--- a/drivers/net/wireless/ath/ath11k/spectral.c ++++ b/drivers/net/wireless/ath/ath11k/spectral.c +@@ -212,7 +212,10 @@ static int ath11k_spectral_scan_config(struct ath11k *ar, + return -ENODEV; + + arvif->spectral_enabled = (mode != ATH11K_SPECTRAL_DISABLED); ++ ++ spin_lock_bh(&ar->spectral.lock); + ar->spectral.mode = mode; ++ spin_unlock_bh(&ar->spectral.lock); + + ret = ath11k_wmi_vdev_spectral_enable(ar, arvif->vdev_id, + ATH11K_WMI_SPECTRAL_TRIGGER_CMD_CLEAR, +@@ -843,9 +846,6 @@ static inline void ath11k_spectral_ring_free(struct ath11k *ar) + { + struct ath11k_spectral *sp = &ar->spectral; + +- if (!sp->enabled) +- return; +- + ath11k_dbring_srng_cleanup(ar, &sp->rx_ring); + ath11k_dbring_buf_cleanup(ar, &sp->rx_ring); + } +@@ -897,15 +897,16 @@ void ath11k_spectral_deinit(struct ath11k_base *ab) + if (!sp->enabled) + continue; + +- ath11k_spectral_debug_unregister(ar); +- ath11k_spectral_ring_free(ar); ++ mutex_lock(&ar->conf_mutex); ++ ath11k_spectral_scan_config(ar, ATH11K_SPECTRAL_DISABLED); ++ mutex_unlock(&ar->conf_mutex); + + spin_lock_bh(&sp->lock); +- +- sp->mode = ATH11K_SPECTRAL_DISABLED; + sp->enabled = false; +- + spin_unlock_bh(&sp->lock); ++ ++ ath11k_spectral_debug_unregister(ar); ++ ath11k_spectral_ring_free(ar); + } + } + +-- +2.35.1 + diff --git a/queue-5.17/ath11k-don-t-check-arvif-is_started-before-sending-m.patch b/queue-5.17/ath11k-don-t-check-arvif-is_started-before-sending-m.patch new file mode 100644 index 00000000000..83c9a7f6354 --- /dev/null +++ b/queue-5.17/ath11k-don-t-check-arvif-is_started-before-sending-m.patch @@ -0,0 +1,64 @@ +From 8cad45a8fbc52752552bbef9639c5e95d93444f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 14:57:31 +0300 +Subject: ath11k: Don't check arvif->is_started before sending management + frames + +From: Baochen Qiang + +[ Upstream commit 355333a217541916576351446b5832fec7930566 ] + +Commit 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for +deleted vdev") wants both of below two conditions are true before +sending management frames: + +1: ar->allocated_vdev_map & (1LL << arvif->vdev_id) +2: arvif->is_started + +Actually the second one is not necessary because with the first one +we can make sure the vdev is present. + +Also use ar->conf_mutex to synchronize vdev delete and mgmt. TX. + +This issue is found in case of Passpoint scenario where ath11k +needs to send action frames before vdev is started. + +Fix it by removing the second condition. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 + +Fixes: 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for deleted vdev") +Signed-off-by: Baochen Qiang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220506013614.1580274-3-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 16b45b742f9d..d46f53061d61 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -5515,8 +5515,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) + } + + arvif = ath11k_vif_to_arvif(skb_cb->vif); +- if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) && +- arvif->is_started) { ++ mutex_lock(&ar->conf_mutex); ++ if (ar->allocated_vdev_map & (1LL << arvif->vdev_id)) { + ret = ath11k_mac_mgmt_tx_wmi(ar, arvif, skb); + if (ret) { + ath11k_warn(ar->ab, "failed to tx mgmt frame, vdev_id %d :%d\n", +@@ -5534,6 +5534,7 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) + arvif->is_started); + ath11k_mgmt_over_wmi_tx_drop(ar, skb); + } ++ mutex_unlock(&ar->conf_mutex); + } + } + +-- +2.35.1 + diff --git a/queue-5.17/ath11k-fix-the-warning-of-dev_wake-in-mhi_pm_disable.patch b/queue-5.17/ath11k-fix-the-warning-of-dev_wake-in-mhi_pm_disable.patch new file mode 100644 index 00000000000..d457b9bdb7b --- /dev/null +++ b/queue-5.17/ath11k-fix-the-warning-of-dev_wake-in-mhi_pm_disable.patch @@ -0,0 +1,133 @@ +From be8045a6ee2d082ca45a1524acaf981394386bf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 13:17:08 +0200 +Subject: ath11k: fix the warning of dev_wake in mhi_pm_disable_transition() + +From: Wen Gong + +[ Upstream commit 0d7a8a6204ea9271f1d0a8c66a9fd2f54d2e3cbc ] + +When test device recovery with below command, it has warning in message +as below. +echo assert > /sys/kernel/debug/ath11k/wcn6855\ hw2.0/simulate_fw_crash +echo assert > /sys/kernel/debug/ath11k/qca6390\ hw2.0/simulate_fw_crash + +warning message: +[ 1965.642121] ath11k_pci 0000:06:00.0: simulating firmware assert crash +[ 1968.471364] ieee80211 phy0: Hardware restart was requested +[ 1968.511305] ------------[ cut here ]------------ +[ 1968.511368] WARNING: CPU: 3 PID: 1546 at drivers/bus/mhi/core/pm.c:505 mhi_pm_disable_transition+0xb37/0xda0 [mhi] +[ 1968.511443] Modules linked in: ath11k_pci ath11k mac80211 libarc4 cfg80211 qmi_helpers qrtr_mhi mhi qrtr nvme nvme_core +[ 1968.511563] CPU: 3 PID: 1546 Comm: kworker/u17:0 Kdump: loaded Tainted: G W 5.17.0-rc3-wt-ath+ #579 +[ 1968.511629] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 +[ 1968.511704] Workqueue: mhi_hiprio_wq mhi_pm_st_worker [mhi] +[ 1968.511787] RIP: 0010:mhi_pm_disable_transition+0xb37/0xda0 [mhi] +[ 1968.511870] Code: a9 fe ff ff 4c 89 ff 44 89 04 24 e8 03 46 f6 e5 44 8b 04 24 41 83 f8 01 0f 84 21 fe ff ff e9 4c fd ff ff 0f 0b e9 af f8 ff ff <0f> 0b e9 5c f8 ff ff 48 89 df e8 da 9e ee e3 e9 12 fd ff ff 4c 89 +[ 1968.511923] RSP: 0018:ffffc900024efbf0 EFLAGS: 00010286 +[ 1968.511969] RAX: 00000000ffffffff RBX: ffff88811d241250 RCX: ffffffffc0176922 +[ 1968.512014] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888118a90a24 +[ 1968.512059] RBP: ffff888118a90800 R08: 0000000000000000 R09: ffff888118a90a27 +[ 1968.512102] R10: ffffed1023152144 R11: 0000000000000001 R12: ffff888118a908ac +[ 1968.512229] R13: ffff888118a90928 R14: dffffc0000000000 R15: ffff888118a90a24 +[ 1968.512310] FS: 0000000000000000(0000) GS:ffff888234200000(0000) knlGS:0000000000000000 +[ 1968.512405] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 1968.512493] CR2: 00007f5538f443a8 CR3: 000000016dc28001 CR4: 00000000003706e0 +[ 1968.512587] Call Trace: +[ 1968.512672] +[ 1968.512751] ? _raw_spin_unlock_irq+0x1f/0x40 +[ 1968.512859] mhi_pm_st_worker+0x3ac/0x790 [mhi] +[ 1968.512959] ? mhi_pm_mission_mode_transition.isra.0+0x7d0/0x7d0 [mhi] +[ 1968.513063] process_one_work+0x86a/0x1400 +[ 1968.513184] ? pwq_dec_nr_in_flight+0x230/0x230 +[ 1968.513312] ? move_linked_works+0x125/0x290 +[ 1968.513416] worker_thread+0x6db/0xf60 +[ 1968.513536] ? process_one_work+0x1400/0x1400 +[ 1968.513627] kthread+0x241/0x2d0 +[ 1968.513733] ? kthread_complete_and_exit+0x20/0x20 +[ 1968.513821] ret_from_fork+0x22/0x30 +[ 1968.513924] + +Reason is mhi_deassert_dev_wake() from mhi_device_put() is called +but mhi_assert_dev_wake() from __mhi_device_get_sync() is not called +in progress of recovery. Commit 8e0559921f9a ("bus: mhi: core: +Skip device wake in error or shutdown state") add check for the +pm_state of mhi in __mhi_device_get_sync(), and the pm_state is not +the normal state untill recovery is completed, so it leads the +dev_wake is not 0 and above warning print in mhi_pm_disable_transition() +while checking mhi_cntrl->dev_wake. + +Add check in ath11k_pci_write32()/ath11k_pci_read32() to skip call +mhi_device_put() if mhi_device_get_sync() does not really do wake, +then the warning gone. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 + +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220228064606.8981-5-quic_wgong@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/pci.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c +index 903758751c99..8a3ff12057e8 100644 +--- a/drivers/net/wireless/ath/ath11k/pci.c ++++ b/drivers/net/wireless/ath/ath11k/pci.c +@@ -191,6 +191,7 @@ void ath11k_pci_write32(struct ath11k_base *ab, u32 offset, u32 value) + { + struct ath11k_pci *ab_pci = ath11k_pci_priv(ab); + u32 window_start; ++ int ret = 0; + + /* for offset beyond BAR + 4K - 32, may + * need to wakeup MHI to access. +@@ -198,7 +199,7 @@ void ath11k_pci_write32(struct ath11k_base *ab, u32 offset, u32 value) + if (ab->hw_params.wakeup_mhi && + test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) && + offset >= ACCESS_ALWAYS_OFF) +- mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev); ++ ret = mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev); + + if (offset < WINDOW_START) { + iowrite32(value, ab->mem + offset); +@@ -222,7 +223,8 @@ void ath11k_pci_write32(struct ath11k_base *ab, u32 offset, u32 value) + + if (ab->hw_params.wakeup_mhi && + test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) && +- offset >= ACCESS_ALWAYS_OFF) ++ offset >= ACCESS_ALWAYS_OFF && ++ !ret) + mhi_device_put(ab_pci->mhi_ctrl->mhi_dev); + } + +@@ -230,6 +232,7 @@ u32 ath11k_pci_read32(struct ath11k_base *ab, u32 offset) + { + struct ath11k_pci *ab_pci = ath11k_pci_priv(ab); + u32 val, window_start; ++ int ret = 0; + + /* for offset beyond BAR + 4K - 32, may + * need to wakeup MHI to access. +@@ -237,7 +240,7 @@ u32 ath11k_pci_read32(struct ath11k_base *ab, u32 offset) + if (ab->hw_params.wakeup_mhi && + test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) && + offset >= ACCESS_ALWAYS_OFF) +- mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev); ++ ret = mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev); + + if (offset < WINDOW_START) { + val = ioread32(ab->mem + offset); +@@ -261,7 +264,8 @@ u32 ath11k_pci_read32(struct ath11k_base *ab, u32 offset) + + if (ab->hw_params.wakeup_mhi && + test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) && +- offset >= ACCESS_ALWAYS_OFF) ++ offset >= ACCESS_ALWAYS_OFF && ++ !ret) + mhi_device_put(ab_pci->mhi_ctrl->mhi_dev); + + return val; +-- +2.35.1 + diff --git a/queue-5.17/ath11k-fix-warning-of-not-found-station-for-bssid-in.patch b/queue-5.17/ath11k-fix-warning-of-not-found-station-for-bssid-in.patch new file mode 100644 index 00000000000..c8453331eae --- /dev/null +++ b/queue-5.17/ath11k-fix-warning-of-not-found-station-for-bssid-in.patch @@ -0,0 +1,100 @@ +From 7e4c4bea1c85f5e6f1cdf78520197dbf0afc0287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 16:15:02 +0300 +Subject: ath11k: fix warning of not found station for bssid in message + +From: Wen Gong + +[ Upstream commit 7330e1ec9748948177830c6e1a13379835d577f9 ] + +When test connect/disconnect to an AP frequently with WCN6855, sometimes +it show below log. + +[ 277.040121] wls1: deauthenticating from 8c:21:0a:b3:5a:64 by local choice (Reason: 3=DEAUTH_LEAVING) +[ 277.050906] ath11k_pci 0000:05:00.0: wmi stats vdev id 0 mac 00:03:7f:29:61:11 +[ 277.050944] ath11k_pci 0000:05:00.0: wmi stats bssid 8c:21:0a:b3:5a:64 vif pK-error +[ 277.050954] ath11k_pci 0000:05:00.0: not found station for bssid 8c:21:0a:b3:5a:64 +[ 277.050961] ath11k_pci 0000:05:00.0: failed to parse rssi chain -71 +[ 277.050967] ath11k_pci 0000:05:00.0: failed to pull fw stats: -71 +[ 277.050976] ath11k_pci 0000:05:00.0: wmi stats vdev id 0 mac 00:03:7f:29:61:11 +[ 277.050983] ath11k_pci 0000:05:00.0: wmi stats bssid 8c:21:0a:b3:5a:64 vif pK-error +[ 277.050989] ath11k_pci 0000:05:00.0: not found station for bssid 8c:21:0a:b3:5a:64 +[ 277.050995] ath11k_pci 0000:05:00.0: failed to parse rssi chain -71 +[ 277.051000] ath11k_pci 0000:05:00.0: failed to pull fw stats: -71 +[ 278.064050] ath11k_pci 0000:05:00.0: failed to request fw stats: -110 + +Reason is: +When running disconnect operation, sta_info removed from local->sta_hash +by __sta_info_destroy_part1() from __sta_info_flush(), after this, +ieee80211_find_sta_by_ifaddr() which called by +ath11k_wmi_tlv_fw_stats_data_parse() and ath11k_wmi_tlv_rssi_chain_parse() +cannot find this station, then failed log printed. + +steps are like this: +1. when disconnect from AP, __sta_info_destroy() called __sta_info_destroy_part1() +and __sta_info_destroy_part2(). + +2. in __sta_info_destroy_part1(), it has "sta_info_hash_del(local, sta)" +and "list_del_rcu(&sta->list)", it will remove the ieee80211_sta from the +list of ieee80211_hw. + +3. in __sta_info_destroy_part2(), it called drv_sta_state()->ath11k_mac_op_sta_state(), +then peer->sta is clear at this moment. + +4. in __sta_info_destroy_part2(), it then called sta_set_sinfo()->drv_sta_statistics() +->ath11k_mac_op_sta_statistics(), then WMI_REQUEST_STATS_CMDID sent to firmware. + +5. WMI_UPDATE_STATS_EVENTID reported from firmware, at this moment, the +ieee80211_sta can not be found again because it has remove from list in +step2 and also peer->sta is clear in step3. + +6. in __sta_info_destroy_part2(), it then called cleanup_single_sta()-> +sta_info_free()->kfree(sta), at this moment, the ieee80211_sta is freed +in memory, then the failed log will not happen because function +ath11k_mac_op_sta_state() will not be called. + +Actually this print log is not a real error, it is only to skip parse the +info, so change to skip print by default debug setting. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 + +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220428022426.2927-1-quic_wgong@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/wmi.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c +index 22921673e956..4ad3fe7d7d1f 100644 +--- a/drivers/net/wireless/ath/ath11k/wmi.c ++++ b/drivers/net/wireless/ath/ath11k/wmi.c +@@ -5616,9 +5616,9 @@ static int ath11k_wmi_tlv_rssi_chain_parse(struct ath11k_base *ab, + arvif->bssid, + NULL); + if (!sta) { +- ath11k_warn(ab, "not found station for bssid %pM\n", +- arvif->bssid); +- ret = -EPROTO; ++ ath11k_dbg(ab, ATH11K_DBG_WMI, ++ "not found station of bssid %pM for rssi chain\n", ++ arvif->bssid); + goto exit; + } + +@@ -5716,8 +5716,9 @@ static int ath11k_wmi_tlv_fw_stats_data_parse(struct ath11k_base *ab, + "wmi stats vdev id %d snr %d\n", + src->vdev_id, src->beacon_snr); + } else { +- ath11k_warn(ab, "not found station for bssid %pM\n", +- arvif->bssid); ++ ath11k_dbg(ab, ATH11K_DBG_WMI, ++ "not found station of bssid %pM for vdev stat\n", ++ arvif->bssid); + } + } + +-- +2.35.1 + diff --git a/queue-5.17/ath9k-fix-ar9003_get_eepmisc.patch b/queue-5.17/ath9k-fix-ar9003_get_eepmisc.patch new file mode 100644 index 00000000000..ebd59bb363f --- /dev/null +++ b/queue-5.17/ath9k-fix-ar9003_get_eepmisc.patch @@ -0,0 +1,40 @@ +From e94b9faeb8cb8f97ddeea359c2f7ff432d2c9533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Mar 2022 17:30:08 -0600 +Subject: ath9k: fix ar9003_get_eepmisc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wenli Looi + +[ Upstream commit 9aaff3864b603408c02c629957ae8d8ff5d5a4f2 ] + +The current implementation is reading the wrong eeprom type. + +Fixes: d8ec2e2a63e8 ("ath9k: Add an eeprom_ops callback for retrieving the eepmisc value") +Signed-off-by: Wenli Looi +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220320233010.123106-5-wlooi@ucalgary.ca +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +index b0a4ca3559fd..abed1effd95c 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -5615,7 +5615,7 @@ unsigned int ar9003_get_paprd_scale_factor(struct ath_hw *ah, + + static u8 ar9003_get_eepmisc(struct ath_hw *ah) + { +- return ah->eeprom.map4k.baseEepHeader.eepMisc; ++ return ah->eeprom.ar9300_eep.baseEepHeader.opCapFlags.eepMisc; + } + + const struct eeprom_ops eep_ar9300_ops = { +-- +2.35.1 + diff --git a/queue-5.17/ath9k-fix-qca9561-pa-bias-level.patch b/queue-5.17/ath9k-fix-qca9561-pa-bias-level.patch new file mode 100644 index 00000000000..bb6ec4b359f --- /dev/null +++ b/queue-5.17/ath9k-fix-qca9561-pa-bias-level.patch @@ -0,0 +1,54 @@ +From eb3ee9d7b33de974c95159b1b9b1e41f82ebc34a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Apr 2022 16:51:45 +0200 +Subject: ath9k: fix QCA9561 PA bias level +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thibaut VARÈNE + +[ Upstream commit e999a5da28a0e0f7de242d841ef7d5e48f4646ae ] + +This patch fixes an invalid TX PA DC bias level on QCA9561, which +results in a very low output power and very low throughput as devices +are further away from the AP (compared to other 2.4GHz APs). + +This patch was suggested by Felix Fietkau, who noted[1]: +"The value written to that register is wrong, because while the mask +definition AR_CH0_TOP2_XPABIASLVL uses a different value for 9561, the +shift definition AR_CH0_TOP2_XPABIASLVL_S is hardcoded to 12, which is +wrong for 9561." + +In real life testing, without this patch the 2.4GHz throughput on +Yuncore XD3200 is around 10Mbps sitting next to the AP, and closer to +practical maximum with the patch applied. + +[1] https://lore.kernel.org/all/91c58969-c60e-2f41-00ac-737786d435ae@nbd.name + +Signed-off-by: Thibaut VARÈNE +Acked-by: Felix Fietkau +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220417145145.1847-1-hacks+kernel@slashdirt.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h +index a171dbb29fbb..ad949eb02f3d 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h ++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h +@@ -720,7 +720,7 @@ + #define AR_CH0_TOP2 (AR_SREV_9300(ah) ? 0x1628c : \ + (AR_SREV_9462(ah) ? 0x16290 : 0x16284)) + #define AR_CH0_TOP2_XPABIASLVL (AR_SREV_9561(ah) ? 0x1e00 : 0xf000) +-#define AR_CH0_TOP2_XPABIASLVL_S 12 ++#define AR_CH0_TOP2_XPABIASLVL_S (AR_SREV_9561(ah) ? 9 : 12) + + #define AR_CH0_XTAL (AR_SREV_9300(ah) ? 0x16294 : \ + ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \ +-- +2.35.1 + diff --git a/queue-5.17/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch b/queue-5.17/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch new file mode 100644 index 00000000000..5b0723d3136 --- /dev/null +++ b/queue-5.17/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch @@ -0,0 +1,51 @@ +From 668379baf3a106769df709c2557c8c5f1f1ebcca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Apr 2022 09:12:25 +0300 +Subject: ath9k_htc: fix potential out of bounds access with invalid + rxstatus->rs_keyix +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ] + +The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to +ensure that it is within the bitmap. + +drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() +error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' + +Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept") +Signed-off-by: Dan Carpenter +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220409061225.GA5447@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index 6a850a0bfa8a..a23eaca0326d 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -1016,6 +1016,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + goto rx_next; + } + ++ if (rxstatus->rs_keyix >= ATH_KEYMAX && ++ rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) { ++ ath_dbg(common, ANY, ++ "Invalid keyix, dropping (keyix: %d)\n", ++ rxstatus->rs_keyix); ++ goto rx_next; ++ } ++ + /* Get the RX status information */ + + memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); +-- +2.35.1 + diff --git a/queue-5.17/b43-fix-assigning-negative-value-to-unsigned-variabl.patch b/queue-5.17/b43-fix-assigning-negative-value-to-unsigned-variabl.patch new file mode 100644 index 00000000000..b515e0d325e --- /dev/null +++ b/queue-5.17/b43-fix-assigning-negative-value-to-unsigned-variabl.patch @@ -0,0 +1,37 @@ +From df84b6da8ca3a8a4bdde41b982ab38558852c0b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:15:15 +0800 +Subject: b43: Fix assigning negative value to unsigned variable + +From: Haowen Bai + +[ Upstream commit 11800d893b38e0e12d636c170c1abc19c43c730c ] + +fix warning reported by smatch: +drivers/net/wireless/broadcom/b43/phy_n.c:585 b43_nphy_adjust_lna_gain_table() +warn: assigning (-2) to unsigned variable '*(lna_gain[0])' + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648203315-28093-1-git-send-email-baihaowen@meizu.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c +index cf3ccf4ddfe7..aa5c99465674 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_n.c ++++ b/drivers/net/wireless/broadcom/b43/phy_n.c +@@ -582,7 +582,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev) + u16 data[4]; + s16 gain[2]; + u16 minmax[2]; +- static const u16 lna_gain[4] = { -2, 10, 19, 25 }; ++ static const s16 lna_gain[4] = { -2, 10, 19, 25 }; + + if (nphy->hang_avoid) + b43_nphy_stay_in_carrier_search(dev, 1); +-- +2.35.1 + diff --git a/queue-5.17/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch b/queue-5.17/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch new file mode 100644 index 00000000000..861ca7df08f --- /dev/null +++ b/queue-5.17/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch @@ -0,0 +1,37 @@ +From d02dd73ffbf97931243324bb41fb012aaf2c9ce3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:17:13 +0800 +Subject: b43legacy: Fix assigning negative value to unsigned variable + +From: Haowen Bai + +[ Upstream commit 3f6b867559b3d43a7ce1b4799b755e812fc0d503 ] + +fix warning reported by smatch: +drivers/net/wireless/broadcom/b43legacy/phy.c:1181 b43legacy_phy_lo_b_measure() +warn: assigning (-772) to unsigned variable 'fval' + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648203433-8736-1-git-send-email-baihaowen@meizu.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43legacy/phy.c b/drivers/net/wireless/broadcom/b43legacy/phy.c +index 05404fbd1e70..c1395e622759 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/phy.c ++++ b/drivers/net/wireless/broadcom/b43legacy/phy.c +@@ -1123,7 +1123,7 @@ void b43legacy_phy_lo_b_measure(struct b43legacy_wldev *dev) + struct b43legacy_phy *phy = &dev->phy; + u16 regstack[12] = { 0 }; + u16 mls; +- u16 fval; ++ s16 fval; + int i; + int j; + +-- +2.35.1 + diff --git a/queue-5.17/bfq-allow-current-waker-to-defend-against-a-tentativ.patch b/queue-5.17/bfq-allow-current-waker-to-defend-against-a-tentativ.patch new file mode 100644 index 00000000000..c894524c6a9 --- /dev/null +++ b/queue-5.17/bfq-allow-current-waker-to-defend-against-a-tentativ.patch @@ -0,0 +1,41 @@ +From 875ab2a05a83de55e0164c038cfd34bbc2754a5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 12:52:30 +0200 +Subject: bfq: Allow current waker to defend against a tentative one + +From: Jan Kara + +[ Upstream commit c5ac56bb6110e42e79d3106866658376b2e48ab9 ] + +The code in bfq_check_waker() ignores wake up events from the current +waker. This makes it more likely we select a new tentative waker +although the current one is generating more wake up events. Treat +current waker the same way as any other process and allow it to reset +the waker detection logic. + +Fixes: 71217df39dc6 ("block, bfq: make waker-queue detection more robust") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220519105235.31397-2-jack@suse.cz +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 047368c23984..31f430d9023d 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2133,8 +2133,7 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (!bfqd->last_completed_rq_bfqq || + bfqd->last_completed_rq_bfqq == bfqq || + bfq_bfqq_has_short_ttime(bfqq) || +- now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC || +- bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq) ++ now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC) + return; + + /* +-- +2.35.1 + diff --git a/queue-5.17/bfq-relax-waker-detection-for-shared-queues.patch b/queue-5.17/bfq-relax-waker-detection-for-shared-queues.patch new file mode 100644 index 00000000000..49cbf0b9636 --- /dev/null +++ b/queue-5.17/bfq-relax-waker-detection-for-shared-queues.patch @@ -0,0 +1,93 @@ +From 93d665be7c72e0fc9a619f3e3684e46b689cf185 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 12:52:29 +0200 +Subject: bfq: Relax waker detection for shared queues + +From: Jan Kara + +[ Upstream commit f950667356ce90a41b446b726d4595a10cb65415 ] + +Currently we look for waker only if current queue has no requests. This +makes sense for bfq queues with a single process however for shared +queues when there is a larger number of processes the condition that +queue has no requests is difficult to meet because often at least one +process has some request in flight although all the others are waiting +for the waker to do the work and this harms throughput. Relax the "no +queued request for bfq queue" condition to "the current task has no +queued requests yet". For this, we also need to start tracking number of +requests in flight for each task. + +This patch (together with the following one) restores the performance +for dbench with 128 clients that regressed with commit c65e6fd460b4 +("bfq: Do not let waker requests skip proper accounting") because +this commit makes requests of wakers properly enter BFQ queues and thus +these queues become ineligible for the old waker detection logic. +Dbench results: + + Vanilla 5.18-rc3 5.18-rc3 + revert 5.18-rc3 patched +Mean 1237.36 ( 0.00%) 950.16 * 23.21%* 988.35 * 20.12%* + +Numbers are time to complete workload so lower is better. + +Fixes: c65e6fd460b4 ("bfq: Do not let waker requests skip proper accounting") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220519105235.31397-1-jack@suse.cz +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 5 +++-- + block/bfq-iosched.h | 1 + + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 963f9f549232..047368c23984 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2133,7 +2133,6 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (!bfqd->last_completed_rq_bfqq || + bfqd->last_completed_rq_bfqq == bfqq || + bfq_bfqq_has_short_ttime(bfqq) || +- bfqq->dispatched > 0 || + now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC || + bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq) + return; +@@ -2210,7 +2209,7 @@ static void bfq_add_request(struct request *rq) + bfqq->queued[rq_is_sync(rq)]++; + bfqd->queued++; + +- if (RB_EMPTY_ROOT(&bfqq->sort_list) && bfq_bfqq_sync(bfqq)) { ++ if (bfq_bfqq_sync(bfqq) && RQ_BIC(rq)->requests <= 1) { + bfq_check_waker(bfqd, bfqq, now_ns); + + /* +@@ -6563,6 +6562,7 @@ static void bfq_finish_requeue_request(struct request *rq) + bfq_completed_request(bfqq, bfqd); + } + bfq_finish_requeue_request_body(bfqq); ++ RQ_BIC(rq)->requests--; + spin_unlock_irqrestore(&bfqd->lock, flags); + + /* +@@ -6796,6 +6796,7 @@ static struct bfq_queue *bfq_init_rq(struct request *rq) + + bfqq_request_allocated(bfqq); + bfqq->ref++; ++ bic->requests++; + bfq_log_bfqq(bfqd, bfqq, "get_request %p: bfqq %p, %d", + rq, bfqq, bfqq->ref); + +diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h +index 07288b9da389..a1ec70af64c8 100644 +--- a/block/bfq-iosched.h ++++ b/block/bfq-iosched.h +@@ -469,6 +469,7 @@ struct bfq_io_cq { + struct bfq_queue *stable_merge_bfqq; + + bool stably_merged; /* non splittable if true */ ++ unsigned int requests; /* Number of requests this process has in flight */ + }; + + /** +-- +2.35.1 + diff --git a/queue-5.17/blk-throttle-set-bio_throttled-when-bio-has-been-thr.patch b/queue-5.17/blk-throttle-set-bio_throttled-when-bio-has-been-thr.patch new file mode 100644 index 00000000000..bd98b994feb --- /dev/null +++ b/queue-5.17/blk-throttle-set-bio_throttled-when-bio-has-been-thr.patch @@ -0,0 +1,126 @@ +From ac3ed644c2882b2a16d7361108ffcef7c7298bf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 20:39:19 +0800 +Subject: blk-throttle: Set BIO_THROTTLED when bio has been throttled + +From: Laibin Qiu + +[ Upstream commit 5a011f889b4832aa80c2a872a5aade5c48d2756f ] + +1.In current process, all bio will set the BIO_THROTTLED flag +after __blk_throtl_bio(). + +2.If bio needs to be throttled, it will start the timer and +stop submit bio directly. Bio will submit in +blk_throtl_dispatch_work_fn() when the timer expires.But in +the current process, if bio is throttled. The BIO_THROTTLED +will be set to bio after timer start. If the bio has been +completed, it may cause use-after-free blow. + +BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 +Read of size 2 at addr ffff88801b8902d4 by task fio/26380 + + dump_stack+0x9b/0xce + print_address_description.constprop.6+0x3e/0x60 + kasan_report.cold.9+0x22/0x3a + blk_throtl_bio+0x12f0/0x2c70 + submit_bio_checks+0x701/0x1550 + submit_bio_noacct+0x83/0xc80 + submit_bio+0xa7/0x330 + mpage_readahead+0x380/0x500 + read_pages+0x1c1/0xbf0 + page_cache_ra_unbounded+0x471/0x6f0 + do_page_cache_ra+0xda/0x110 + ondemand_readahead+0x442/0xae0 + page_cache_async_ra+0x210/0x300 + generic_file_buffered_read+0x4d9/0x2130 + generic_file_read_iter+0x315/0x490 + blkdev_read_iter+0x113/0x1b0 + aio_read+0x2ad/0x450 + io_submit_one+0xc8e/0x1d60 + __se_sys_io_submit+0x125/0x350 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Allocated by task 26380: + kasan_save_stack+0x19/0x40 + __kasan_kmalloc.constprop.2+0xc1/0xd0 + kmem_cache_alloc+0x146/0x440 + mempool_alloc+0x125/0x2f0 + bio_alloc_bioset+0x353/0x590 + mpage_alloc+0x3b/0x240 + do_mpage_readpage+0xddf/0x1ef0 + mpage_readahead+0x264/0x500 + read_pages+0x1c1/0xbf0 + page_cache_ra_unbounded+0x471/0x6f0 + do_page_cache_ra+0xda/0x110 + ondemand_readahead+0x442/0xae0 + page_cache_async_ra+0x210/0x300 + generic_file_buffered_read+0x4d9/0x2130 + generic_file_read_iter+0x315/0x490 + blkdev_read_iter+0x113/0x1b0 + aio_read+0x2ad/0x450 + io_submit_one+0xc8e/0x1d60 + __se_sys_io_submit+0x125/0x350 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Freed by task 0: + kasan_save_stack+0x19/0x40 + kasan_set_track+0x1c/0x30 + kasan_set_free_info+0x1b/0x30 + __kasan_slab_free+0x111/0x160 + kmem_cache_free+0x94/0x460 + mempool_free+0xd6/0x320 + bio_free+0xe0/0x130 + bio_put+0xab/0xe0 + bio_endio+0x3a6/0x5d0 + blk_update_request+0x590/0x1370 + scsi_end_request+0x7d/0x400 + scsi_io_completion+0x1aa/0xe50 + scsi_softirq_done+0x11b/0x240 + blk_mq_complete_request+0xd4/0x120 + scsi_mq_done+0xf0/0x200 + virtscsi_vq_done+0xbc/0x150 + vring_interrupt+0x179/0x390 + __handle_irq_event_percpu+0xf7/0x490 + handle_irq_event_percpu+0x7b/0x160 + handle_irq_event+0xcc/0x170 + handle_edge_irq+0x215/0xb20 + common_interrupt+0x60/0x120 + asm_common_interrupt+0x1e/0x40 + +Fix this by move BIO_THROTTLED set into the queue_lock. + +Signed-off-by: Laibin Qiu +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20220301123919.2381579-1-qiulaibin@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-throttle.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 87769b337fc5..e1b253775a56 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -2167,13 +2167,14 @@ bool __blk_throtl_bio(struct bio *bio) + } + + out_unlock: +- spin_unlock_irq(&q->queue_lock); + bio_set_flag(bio, BIO_THROTTLED); + + #ifdef CONFIG_BLK_DEV_THROTTLING_LOW + if (throttled || !td->track_bio_latency) + bio->bi_issue.value |= BIO_ISSUE_THROTL_SKIP_LATENCY; + #endif ++ spin_unlock_irq(&q->queue_lock); ++ + rcu_read_unlock(); + return throttled; + } +-- +2.35.1 + diff --git a/queue-5.17/block-fix-the-bio.bi_opf-comment.patch b/queue-5.17/block-fix-the-bio.bi_opf-comment.patch new file mode 100644 index 00000000000..8c3c4f9f718 --- /dev/null +++ b/queue-5.17/block-fix-the-bio.bi_opf-comment.patch @@ -0,0 +1,48 @@ +From 7d8be0104d3fb6a3b7ef2d3f060a134130fda1bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:51:52 -0700 +Subject: block: Fix the bio.bi_opf comment + +From: Bart Van Assche + +[ Upstream commit 5d2ae14276e698c76fa0c8ce870103f343b38263 ] + +Commit ef295ecf090d modified the Linux kernel such that the bottom bits +of the bi_opf member contain the operation instead of the topmost bits. +That commit did not update the comment next to bi_opf. Hence this patch. + +From commit ef295ecf090d: +-#define bio_op(bio) ((bio)->bi_opf >> BIO_OP_SHIFT) ++#define bio_op(bio) ((bio)->bi_opf & REQ_OP_MASK) + +Cc: Christoph Hellwig +Cc: Ming Lei +Fixes: ef295ecf090d ("block: better op and flags encoding") +Signed-off-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220511235152.1082246-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/blk_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h +index 86c0f85df8bb..fa6e14b2763f 100644 +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -237,9 +237,8 @@ typedef unsigned int blk_qc_t; + struct bio { + struct bio *bi_next; /* request queue link */ + struct block_device *bi_bdev; +- unsigned int bi_opf; /* bottom bits req flags, +- * top bits REQ_OP. Use +- * accessors. ++ unsigned int bi_opf; /* bottom bits REQ_OP, top bits ++ * req_flags. + */ + unsigned short bi_flags; /* BIO_* below */ + unsigned short bi_ioprio; +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-btmtksdio-fix-use-after-free-at-btmtksdio_.patch b/queue-5.17/bluetooth-btmtksdio-fix-use-after-free-at-btmtksdio_.patch new file mode 100644 index 00000000000..fd9864628ea --- /dev/null +++ b/queue-5.17/bluetooth-btmtksdio-fix-use-after-free-at-btmtksdio_.patch @@ -0,0 +1,86 @@ +From 4c0550f633e4dc80225021851e9d009fd4a87a3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 06:22:15 +0800 +Subject: Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event + +From: Sean Wang + +[ Upstream commit 0fab6361c4ba17d1b43a991bef4238a3c1754d35 ] + +We should not access skb buffer data anymore after hci_recv_frame was +called. + +[ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0 +[ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker +[ 39.634962] Call trace: +[ 39.634974] dump_backtrace+0x0/0x3b8 +[ 39.634999] show_stack+0x20/0x2c +[ 39.635016] dump_stack_lvl+0x60/0x78 +[ 39.635040] print_address_description+0x70/0x2f0 +[ 39.635062] kasan_report+0x154/0x194 +[ 39.635079] __asan_report_load1_noabort+0x44/0x50 +[ 39.635099] btmtksdio_recv_event+0x1b0/0x1c4 +[ 39.635129] btmtksdio_txrx_work+0x6cc/0xac4 +[ 39.635157] process_one_work+0x560/0xc5c +[ 39.635177] worker_thread+0x7ec/0xcc0 +[ 39.635195] kthread+0x2d0/0x3d0 +[ 39.635215] ret_from_fork+0x10/0x20 +[ 39.635247] Allocated by task 0: +[ 39.635260] (stack is not available) +[ 39.635281] Freed by task 2392: +[ 39.635295] kasan_save_stack+0x38/0x68 +[ 39.635319] kasan_set_track+0x28/0x3c +[ 39.635338] kasan_set_free_info+0x28/0x4c +[ 39.635357] ____kasan_slab_free+0x104/0x150 +[ 39.635374] __kasan_slab_free+0x18/0x28 +[ 39.635391] slab_free_freelist_hook+0x114/0x248 +[ 39.635410] kfree+0xf8/0x2b4 +[ 39.635427] skb_free_head+0x58/0x98 +[ 39.635447] skb_release_data+0x2f4/0x410 +[ 39.635464] skb_release_all+0x50/0x60 +[ 39.635481] kfree_skb+0xc8/0x25c +[ 39.635498] hci_event_packet+0x894/0xca4 [bluetooth] +[ 39.635721] hci_rx_work+0x1c8/0x68c [bluetooth] +[ 39.635925] process_one_work+0x560/0xc5c +[ 39.635951] worker_thread+0x7ec/0xcc0 +[ 39.635970] kthread+0x2d0/0x3d0 +[ 39.635990] ret_from_fork+0x10/0x20 +[ 39.636021] The buggy address belongs to the object at ffffff80cf28a600 + which belongs to the cache kmalloc-512 of size 512 +[ 39.636039] The buggy address is located 13 bytes inside of + 512-byte region [ffffff80cf28a600, ffffff80cf28a800) + +Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices") +Co-developed-by: Yake Yang +Signed-off-by: Yake Yang +Signed-off-by: Sean Wang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index ecf29cfa7d79..411676ad0c6b 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -368,6 +368,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) + { + struct btmtksdio_dev *bdev = hci_get_drvdata(hdev); + struct hci_event_hdr *hdr = (void *)skb->data; ++ u8 evt = hdr->evt; + int err; + + /* When someone waits for the WMT event, the skb is being cloned +@@ -385,7 +386,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) + if (err < 0) + goto err_free_skb; + +- if (hdr->evt == HCI_EV_WMT) { ++ if (evt == HCI_EV_WMT) { + if (test_and_clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, + &bdev->tx_state)) { + /* Barrier to sync with other CPUs */ +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-btusb-set-hci_quirk_broken_enhanced_setup_.patch b/queue-5.17/bluetooth-btusb-set-hci_quirk_broken_enhanced_setup_.patch new file mode 100644 index 00000000000..b8e42391596 --- /dev/null +++ b/queue-5.17/bluetooth-btusb-set-hci_quirk_broken_enhanced_setup_.patch @@ -0,0 +1,40 @@ +From 1e09c625be9d568ce5ac1e409a093deb1564622b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 16:38:25 -0700 +Subject: Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN for + QCA + +From: Luiz Augusto von Dentz + +[ Upstream commit d44e1dbda36fff5d7c2586683c4adc0963aef908 ] + +This sets HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN for QCA controllers +since SCO appear to not work when using HCI_OP_ENHANCED_SETUP_SYNC_CONN. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215576 +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 42234d5f602d..34215dc5e684 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3317,6 +3317,11 @@ static int btusb_setup_qca(struct hci_dev *hdev) + return err; + } + ++ /* Mark HCI_OP_ENHANCED_SETUP_SYNC_CONN as broken as it doesn't seem to ++ * work with the likes of HSP/HFP mSBC. ++ */ ++ set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks); ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-btusb-set-hci_quirk_broken_err_data_report.patch b/queue-5.17/bluetooth-btusb-set-hci_quirk_broken_err_data_report.patch new file mode 100644 index 00000000000..1994d18b682 --- /dev/null +++ b/queue-5.17/bluetooth-btusb-set-hci_quirk_broken_err_data_report.patch @@ -0,0 +1,49 @@ +From 0b7eeccab4d596b836c440d13bf158a275d9ae28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 10:16:51 +0800 +Subject: Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ERR_DATA_REPORTING for QCA + +From: Zijun Hu + +[ Upstream commit 247f226adadfb7be09dd537f177429f4415aef8e ] + +Set HCI_QUIRK_BROKEN_ERR_DATA_REPORTING for QCA controllers since +they answer HCI_OP_READ_DEF_ERR_DATA_REPORTING with error code +"UNKNOWN HCI COMMAND" as shown below: + +[ 580.517552] Bluetooth: hci0: unexpected cc 0x0c5a length: 1 < 2 +[ 580.517660] Bluetooth: hci0: Opcode 0x c5a failed: -38 + +hcitool -i hci0 cmd 0x03 0x5a +< HCI Command: ogf 0x03, ocf 0x005a, plen 0 +> HCI Event: 0x0e plen 4 + 01 5A 0C 01 + +btmon log: +< HCI Command: Read Default Erroneous Data Reporting (0x03|0x005a) plen 0 +> HCI Event: Command Complete (0x0e) plen 4 + Read Default Erroneous Data Reporting (0x03|0x005a) ncmd 1 + Status: Unknown HCI Command (0x01) + +Signed-off-by: Zijun Hu +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 34215dc5e684..304351d2cfdf 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3321,6 +3321,7 @@ static int btusb_setup_qca(struct hci_dev *hdev) + * work with the likes of HSP/HFP mSBC. + */ + set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks); ++ set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks); + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch b/queue-5.17/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch new file mode 100644 index 00000000000..5dd4c390918 --- /dev/null +++ b/queue-5.17/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch @@ -0,0 +1,88 @@ +From beed259a99b274cb4eb45e1fedcff8465a1f3374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 07:09:28 +0000 +Subject: Bluetooth: fix dangling sco_conn and use-after-free in + sco_sock_timeout + +From: Ying Hsu + +[ Upstream commit 7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2 ] + +Connecting the same socket twice consecutively in sco_sock_connect() +could lead to a race condition where two sco_conn objects are created +but only one is associated with the socket. If the socket is closed +before the SCO connection is established, the timer associated with the +dangling sco_conn object won't be canceled. As the sock object is being +freed, the use-after-free problem happens when the timer callback +function sco_sock_timeout() accesses the socket. Here's the call trace: + +dump_stack+0x107/0x163 +? refcount_inc+0x1c/ +print_address_description.constprop.0+0x1c/0x47e +? refcount_inc+0x1c/0x7b +kasan_report+0x13a/0x173 +? refcount_inc+0x1c/0x7b +check_memory_region+0x132/0x139 +refcount_inc+0x1c/0x7b +sco_sock_timeout+0xb2/0x1ba +process_one_work+0x739/0xbd1 +? cancel_delayed_work+0x13f/0x13f +? __raw_spin_lock_init+0xf0/0xf0 +? to_kthread+0x59/0x85 +worker_thread+0x593/0x70e +kthread+0x346/0x35a +? drain_workqueue+0x31a/0x31a +? kthread_bind+0x4b/0x4b +ret_from_fork+0x1f/0x30 + +Link: https://syzkaller.appspot.com/bug?extid=2bef95d3ab4daa10155b +Reported-by: syzbot+2bef95d3ab4daa10155b@syzkaller.appspotmail.com +Fixes: e1dee2c1de2b ("Bluetooth: fix repeated calls to sco_sock_kill") +Signed-off-by: Ying Hsu +Reviewed-by: Joseph Hwang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/sco.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 2a58c7d88433..1111da4e2f2b 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -574,19 +574,24 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen + addr->sa_family != AF_BLUETOOTH) + return -EINVAL; + +- if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) +- return -EBADFD; ++ lock_sock(sk); ++ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { ++ err = -EBADFD; ++ goto done; ++ } + +- if (sk->sk_type != SOCK_SEQPACKET) +- return -EINVAL; ++ if (sk->sk_type != SOCK_SEQPACKET) { ++ err = -EINVAL; ++ goto done; ++ } + + hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR); +- if (!hdev) +- return -EHOSTUNREACH; ++ if (!hdev) { ++ err = -EHOSTUNREACH; ++ goto done; ++ } + hci_dev_lock(hdev); + +- lock_sock(sk); +- + /* Set destination address and psm */ + bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); + +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-hci-add-hci_quirk_broken_enhanced_setup_sy.patch b/queue-5.17/bluetooth-hci-add-hci_quirk_broken_enhanced_setup_sy.patch new file mode 100644 index 00000000000..61116944ae1 --- /dev/null +++ b/queue-5.17/bluetooth-hci-add-hci_quirk_broken_enhanced_setup_sy.patch @@ -0,0 +1,93 @@ +From ea4c83bc22938bfe9fcb53a3a85bce9993795e2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 16:38:23 -0700 +Subject: Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk + +From: Luiz Augusto von Dentz + +[ Upstream commit 05abad857277dda198063017b00ba5b9fed2c0cb ] + +This adds HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk which can be +used to mark HCI_Enhanced_Setup_Synchronous_Connection as broken even +if its support command bit are set since some controller report it as +supported but the command don't work properly with some configurations +(e.g. BT_VOICE_TRANSPARENT/mSBC). + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 9 +++++++++ + include/net/bluetooth/hci_core.h | 8 ++++++-- + net/bluetooth/hci_conn.c | 2 +- + net/bluetooth/sco.c | 2 +- + 4 files changed, 17 insertions(+), 4 deletions(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 69ef31cea582..62a9bb022aed 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -265,6 +265,15 @@ enum { + * runtime suspend, because event filtering takes place there. + */ + HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, ++ ++ /* ++ * When this quirk is set, disables the use of ++ * HCI_OP_ENHANCED_SETUP_SYNC_CONN command to setup SCO connections. ++ * ++ * This quirk can be set before hci_register_dev is called or ++ * during the hdev->setup vendor callback. ++ */ ++ HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, + }; + + /* HCI device flags */ +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 131514913430..49a88b2f4678 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1483,8 +1483,12 @@ void hci_conn_del_sysfs(struct hci_conn *conn); + #define privacy_mode_capable(dev) (use_ll_privacy(dev) && \ + (hdev->commands[39] & 0x04)) + +-/* Use enhanced synchronous connection if command is supported */ +-#define enhanced_sco_capable(dev) ((dev)->commands[29] & 0x08) ++/* Use enhanced synchronous connection if command is supported and its quirk ++ * has not been set. ++ */ ++#define enhanced_sync_conn_capable(dev) \ ++ (((dev)->commands[29] & 0x08) && \ ++ !test_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &(dev)->quirks)) + + /* Use ext scanning if set ext scan param and ext scan enable is supported */ + #define use_ext_scan(dev) (((dev)->commands[37] & 0x20) && \ +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 84312c836549..cd51bf2a709b 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -481,7 +481,7 @@ static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle) + + bool hci_setup_sync(struct hci_conn *conn, __u16 handle) + { +- if (enhanced_sco_capable(conn->hdev)) ++ if (enhanced_sync_conn_capable(conn->hdev)) + return hci_enhanced_setup_sync_conn(conn, handle); + + return hci_setup_sync_conn(conn, handle); +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 8eabf41b2993..2a58c7d88433 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -885,7 +885,7 @@ static int sco_sock_setsockopt(struct socket *sock, int level, int optname, + err = -EBADFD; + break; + } +- if (enhanced_sco_capable(hdev) && ++ if (enhanced_sync_conn_capable(hdev) && + voice.setting == BT_VOICE_TRANSPARENT) + sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT; + hci_dev_put(hdev); +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-hci_conn-fix-hci_connect_le_sync.patch b/queue-5.17/bluetooth-hci_conn-fix-hci_connect_le_sync.patch new file mode 100644 index 00000000000..02f511b311c --- /dev/null +++ b/queue-5.17/bluetooth-hci_conn-fix-hci_connect_le_sync.patch @@ -0,0 +1,65 @@ +From 6128b74b9425af448038b6426227857b335b35f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 11:37:13 -0700 +Subject: Bluetooth: hci_conn: Fix hci_connect_le_sync + +From: Luiz Augusto von Dentz + +[ Upstream commit c9f73a2178c12fb24d2807634209559d6a836e08 ] + +The handling of connection failures shall be handled by the request +completion callback as already done by hci_cs_le_create_conn, also make +sure to use hci_conn_failed instead of hci_le_conn_failed as the later +don't actually call hci_conn_del to cleanup. + +Link: https://github.com/bluez/bluez/issues/340 +Fixes: 8e8b92ee60de5 ("Bluetooth: hci_sync: Add hci_le_create_conn_sync") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 5 +++-- + net/bluetooth/hci_event.c | 8 +++++--- + 2 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 882a7df13005..ac06c9724c7f 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -943,10 +943,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) + + bt_dev_err(hdev, "request failed to create LE connection: err %d", err); + +- if (!conn) ++ /* Check if connection is still pending */ ++ if (conn != hci_lookup_le_connect(hdev)) + goto done; + +- hci_le_conn_failed(conn, err); ++ hci_conn_failed(conn, err); + + done: + hci_dev_unlock(hdev); +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 1be745b228c1..df5a484d2b2a 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5620,10 +5620,12 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + status = HCI_ERROR_INVALID_PARAMETERS; + } + +- if (status) { +- hci_conn_failed(conn, status); ++ /* All connection failure handling is taken care of by the ++ * hci_conn_failed function which is triggered by the HCI ++ * request completion callbacks used for connecting. ++ */ ++ if (status) + goto unlock; +- } + + if (conn->dst_type == ADDR_LE_DEV_PUBLIC) + addr_type = BDADDR_LE_PUBLIC; +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-hci_sync-cleanup-hci_conn-if-it-cannot-be-.patch b/queue-5.17/bluetooth-hci_sync-cleanup-hci_conn-if-it-cannot-be-.patch new file mode 100644 index 00000000000..671c2e4c4b3 --- /dev/null +++ b/queue-5.17/bluetooth-hci_sync-cleanup-hci_conn-if-it-cannot-be-.patch @@ -0,0 +1,182 @@ +From 2885ccf599963a9b2a715a19d816faacd3e93071 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 12:58:18 -0700 +Subject: Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted + +From: Luiz Augusto von Dentz + +[ Upstream commit 9b3628d79b46f06157affc56fdb218fdd4988321 ] + +This attempts to cleanup the hci_conn if it cannot be aborted as +otherwise it would likely result in having the controller and host +stack out of sync with respect to connection handle. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 2 +- + net/bluetooth/hci_conn.c | 32 ++++++++++++++++++++++++-------- + net/bluetooth/hci_event.c | 13 ++++--------- + net/bluetooth/hci_sync.c | 11 ++++++++++- + 4 files changed, 39 insertions(+), 19 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 49a88b2f4678..4524920e4895 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1147,7 +1147,7 @@ int hci_conn_switch_role(struct hci_conn *conn, __u8 role); + + void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active); + +-void hci_le_conn_failed(struct hci_conn *conn, u8 status); ++void hci_conn_failed(struct hci_conn *conn, u8 status); + + /* + * hci_conn_get() and hci_conn_put() are used to control the life-time of an +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index cd51bf2a709b..882a7df13005 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -670,7 +670,7 @@ static void le_conn_timeout(struct work_struct *work) + /* Disable LE Advertising */ + le_disable_advertising(hdev); + hci_dev_lock(hdev); +- hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); ++ hci_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); + hci_dev_unlock(hdev); + return; + } +@@ -873,7 +873,7 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type) + EXPORT_SYMBOL(hci_get_route); + + /* This function requires the caller holds hdev->lock */ +-void hci_le_conn_failed(struct hci_conn *conn, u8 status) ++static void hci_le_conn_failed(struct hci_conn *conn, u8 status) + { + struct hci_dev *hdev = conn->hdev; + struct hci_conn_params *params; +@@ -886,8 +886,6 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status) + params->conn = NULL; + } + +- conn->state = BT_CLOSED; +- + /* If the status indicates successful cancellation of + * the attempt (i.e. Unknown Connection Id) there's no point of + * notifying failure since we'll go back to keep trying to +@@ -899,10 +897,6 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status) + mgmt_connect_failed(hdev, &conn->dst, conn->type, + conn->dst_type, status); + +- hci_connect_cfm(conn, status); +- +- hci_conn_del(conn); +- + /* Since we may have temporarily stopped the background scanning in + * favor of connection establishment, we should restart it. + */ +@@ -914,6 +908,28 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status) + hci_enable_advertising(hdev); + } + ++/* This function requires the caller holds hdev->lock */ ++void hci_conn_failed(struct hci_conn *conn, u8 status) ++{ ++ struct hci_dev *hdev = conn->hdev; ++ ++ bt_dev_dbg(hdev, "status 0x%2.2x", status); ++ ++ switch (conn->type) { ++ case LE_LINK: ++ hci_le_conn_failed(conn, status); ++ break; ++ case ACL_LINK: ++ mgmt_connect_failed(hdev, &conn->dst, conn->type, ++ conn->dst_type, status); ++ break; ++ } ++ ++ conn->state = BT_CLOSED; ++ hci_connect_cfm(conn, status); ++ hci_conn_del(conn); ++} ++ + static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) + { + struct hci_conn *conn = data; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 4002a47832bc..1be745b228c1 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -2846,7 +2846,7 @@ static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status) + bt_dev_dbg(hdev, "status 0x%2.2x", status); + + /* All connection failure handling is taken care of by the +- * hci_le_conn_failed function which is triggered by the HCI ++ * hci_conn_failed function which is triggered by the HCI + * request completion callbacks used for connecting. + */ + if (status) +@@ -2871,7 +2871,7 @@ static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status) + bt_dev_dbg(hdev, "status 0x%2.2x", status); + + /* All connection failure handling is taken care of by the +- * hci_le_conn_failed function which is triggered by the HCI ++ * hci_conn_failed function which is triggered by the HCI + * request completion callbacks used for connecting. + */ + if (status) +@@ -3185,12 +3185,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + + done: + if (status) { +- conn->state = BT_CLOSED; +- if (conn->type == ACL_LINK) +- mgmt_connect_failed(hdev, &conn->dst, conn->type, +- conn->dst_type, status); +- hci_connect_cfm(conn, status); +- hci_conn_del(conn); ++ hci_conn_failed(conn, status); + } else if (ev->link_type == SCO_LINK) { + switch (conn->setting & SCO_AIRMODE_MASK) { + case SCO_AIRMODE_CVSD: +@@ -5626,7 +5621,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + } + + if (status) { +- hci_le_conn_failed(conn, status); ++ hci_conn_failed(conn, status); + goto unlock; + } + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 8f4c5698913d..13600bf120b0 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -4408,12 +4408,21 @@ static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, + static int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, + u8 reason) + { ++ int err; ++ + switch (conn->state) { + case BT_CONNECTED: + case BT_CONFIG: + return hci_disconnect_sync(hdev, conn, reason); + case BT_CONNECT: +- return hci_connect_cancel_sync(hdev, conn); ++ err = hci_connect_cancel_sync(hdev, conn); ++ /* Cleanup hci_conn object if it cannot be cancelled as it ++ * likelly means the controller and host stack are out of sync. ++ */ ++ if (err) ++ hci_conn_failed(conn, err); ++ ++ return err; + case BT_CONNECT2: + return hci_reject_conn_sync(hdev, conn, reason); + default: +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-protect-le-accept-and-resolv-lists-with-hd.patch b/queue-5.17/bluetooth-protect-le-accept-and-resolv-lists-with-hd.patch new file mode 100644 index 00000000000..19b1814d77f --- /dev/null +++ b/queue-5.17/bluetooth-protect-le-accept-and-resolv-lists-with-hd.patch @@ -0,0 +1,96 @@ +From c05ffba58b1793dda84653fc5d7f88fc68329f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 00:31:17 +0200 +Subject: Bluetooth: protect le accept and resolv lists with hdev->lock + +From: Niels Dossche + +[ Upstream commit 5e2b6064cbc5fd582396768c5f9583f65085e368 ] + +Concurrent operations from events on le_{accept,resolv}_list are +currently unprotected by hdev->lock. +Most existing code do already protect the lists with that lock. +This can be observed in hci_debugfs and hci_sync. +Add the protection for these events too. + +Fixes: b950aa88638c ("Bluetooth: Add definitions and track LE resolve list modification") +Fixes: 0f36b589e4ee ("Bluetooth: Track LE white list modification via HCI commands") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 75bad1781983..4002a47832bc 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -1835,7 +1835,9 @@ static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data, + if (rp->status) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_clear(&hdev->le_accept_list); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1855,8 +1857,10 @@ static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data, + if (!sent) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr, + sent->bdaddr_type); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1876,8 +1880,10 @@ static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data, + if (!sent) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr, + sent->bdaddr_type); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1949,9 +1955,11 @@ static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data, + if (!sent) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr, + sent->bdaddr_type, sent->peer_irk, + sent->local_irk); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1971,8 +1979,10 @@ static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data, + if (!sent) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr, + sent->bdaddr_type); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1987,7 +1997,9 @@ static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data, + if (rp->status) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_clear(&hdev->le_resolv_list); ++ hci_dev_unlock(hdev); + + return rp->status; + } +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch b/queue-5.17/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch new file mode 100644 index 00000000000..fdbb5ad8d51 --- /dev/null +++ b/queue-5.17/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch @@ -0,0 +1,83 @@ +From d230008aab0503b03d946645ace2a1c14c7e521d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Apr 2022 19:37:52 +0200 +Subject: Bluetooth: use hdev lock for accept_list and reject_list in conn req + +From: Niels Dossche + +[ Upstream commit fb048cae51bacdfbbda2954af3c213fdb1d484f4 ] + +All accesses (both reads and modifications) to +hdev->{accept,reject}_list are protected by hdev lock, +except the ones in hci_conn_request_evt. This can cause a race +condition in the form of a list corruption. +The solution is to protect these lists in hci_conn_request_evt as well. + +I was unable to find the exact commit that introduced the issue for the +reject list, I was only able to find it for the accept list. + +Fixes: a55bd29d5227 ("Bluetooth: Add white list lookup for incoming connection requests") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 33a1b4115194..75bad1781983 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3224,10 +3224,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + return; + } + ++ hci_dev_lock(hdev); ++ + if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr, + BDADDR_BREDR)) { + hci_reject_conn(hdev, &ev->bdaddr); +- return; ++ goto unlock; + } + + /* Require HCI_CONNECTABLE or an accept list entry to accept the +@@ -3239,13 +3241,11 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr, + BDADDR_BREDR)) { + hci_reject_conn(hdev, &ev->bdaddr); +- return; ++ goto unlock; + } + + /* Connection accepted */ + +- hci_dev_lock(hdev); +- + ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr); + if (ie) + memcpy(ie->data.dev_class, ev->dev_class, 3); +@@ -3257,8 +3257,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + HCI_ROLE_SLAVE); + if (!conn) { + bt_dev_err(hdev, "no memory for new connection"); +- hci_dev_unlock(hdev); +- return; ++ goto unlock; + } + } + +@@ -3298,6 +3297,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + conn->state = BT_CONNECT2; + hci_connect_cfm(conn, 0); + } ++ ++ return; ++unlock: ++ hci_dev_unlock(hdev); + } + + static u8 hci_to_mgmt_reason(u8 err) +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch b/queue-5.17/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch new file mode 100644 index 00000000000..633530bf205 --- /dev/null +++ b/queue-5.17/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch @@ -0,0 +1,48 @@ +From 6e27762b776521d6d35a2f5f6e0bb083140d89f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 20:06:52 +0200 +Subject: Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring + +From: Niels Dossche + +[ Upstream commit 50a3633ae5e98cf1b80ef5b73c9e341aee9ad896 ] + +hci_is_adv_monitoring's function documentation states that it must be +called under the hdev lock. Paths that leads to an unlocked call are: +discov_update => start_discovery => interleaved_discov => active_scan +and: discov_update => start_discovery => active_scan + +The solution is to take the lock in active_scan during the duration of +the call to hci_is_adv_monitoring. + +Fixes: c32d624640fd ("Bluetooth: disable filter dup when scan for adv monitor") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_request.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 42c8047a9897..f4afe482e300 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -2260,6 +2260,7 @@ static int active_scan(struct hci_request *req, unsigned long opt) + if (err < 0) + own_addr_type = ADDR_LE_DEV_PUBLIC; + ++ hci_dev_lock(hdev); + if (hci_is_adv_monitoring(hdev)) { + /* Duplicate filter should be disabled when some advertisement + * monitor is activated, otherwise AdvMon can only receive one +@@ -2276,6 +2277,7 @@ static int active_scan(struct hci_request *req, unsigned long opt) + */ + filter_dup = LE_SCAN_FILTER_DUP_DISABLE; + } ++ hci_dev_unlock(hdev); + + hci_req_start_scan(req, LE_SCAN_ACTIVE, interval, + hdev->le_scan_window_discovery, own_addr_type, +-- +2.35.1 + diff --git a/queue-5.17/bonding-fix-missed-rcu-protection.patch b/queue-5.17/bonding-fix-missed-rcu-protection.patch new file mode 100644 index 00000000000..2a216ca1e32 --- /dev/null +++ b/queue-5.17/bonding-fix-missed-rcu-protection.patch @@ -0,0 +1,99 @@ +From 3136a898a39f361b4ed3805de021ca2a165a95b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 10:01:48 +0800 +Subject: bonding: fix missed rcu protection + +From: Hangbin Liu + +[ Upstream commit 9b80ccda233fa6c59de411bf889cc4d0e028f2c7 ] + +When removing the rcu_read_lock in bond_ethtool_get_ts_info() as +discussed [1], I didn't notice it could be called via setsockopt, +which doesn't hold rcu lock, as syzbot pointed: + + stack backtrace: + CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline] + bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595 + __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554 + ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568 + sock_timestamping_bind_phc net/core/sock.c:869 [inline] + sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916 + sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221 + __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 + __do_sys_setsockopt net/socket.c:2238 [inline] + __se_sys_setsockopt net/socket.c:2235 [inline] + __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f8902c8eb39 + +Fix it by adding rcu_read_lock and take a ref on the real_dev. +Since dev_hold() and dev_put() can take NULL these days, we can +skip checking if real_dev exist. + +[1] https://lore.kernel.org/netdev/27565.1642742439@famine/ + +Reported-by: syzbot+92beb3d46aab498710fa@syzkaller.appspotmail.com +Fixes: aa6034678e87 ("bonding: use rcu_dereference_rtnl when get bonding active slave") +Suggested-by: Vladimir Oltean +Suggested-by: Jakub Kicinski +Signed-off-by: Hangbin Liu +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220519020148.1058344-1-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index c9107a8b4b90..1e1b420f7f86 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -5383,16 +5383,23 @@ static int bond_ethtool_get_ts_info(struct net_device *bond_dev, + const struct ethtool_ops *ops; + struct net_device *real_dev; + struct phy_device *phydev; ++ int ret = 0; + ++ rcu_read_lock(); + real_dev = bond_option_active_slave_get_rcu(bond); ++ dev_hold(real_dev); ++ rcu_read_unlock(); ++ + if (real_dev) { + ops = real_dev->ethtool_ops; + phydev = real_dev->phydev; + + if (phy_has_tsinfo(phydev)) { +- return phy_ts_info(phydev, info); ++ ret = phy_ts_info(phydev, info); ++ goto out; + } else if (ops->get_ts_info) { +- return ops->get_ts_info(real_dev, info); ++ ret = ops->get_ts_info(real_dev, info); ++ goto out; + } + } + +@@ -5400,7 +5407,9 @@ static int bond_ethtool_get_ts_info(struct net_device *bond_dev, + SOF_TIMESTAMPING_SOFTWARE; + info->phc_index = -1; + +- return 0; ++out: ++ dev_put(real_dev); ++ return ret; + } + + static const struct ethtool_ops bond_ethtool_ops = { +-- +2.35.1 + diff --git a/queue-5.17/btrfs-fix-anon_dev-leak-in-create_subvol.patch b/queue-5.17/btrfs-fix-anon_dev-leak-in-create_subvol.patch new file mode 100644 index 00000000000..99498b0febf --- /dev/null +++ b/queue-5.17/btrfs-fix-anon_dev-leak-in-create_subvol.patch @@ -0,0 +1,195 @@ +From 5a21dc764269eb5c70d0cfd4a4a059b4549c6326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 17:31:33 -0800 +Subject: btrfs: fix anon_dev leak in create_subvol() + +From: Omar Sandoval + +[ Upstream commit 2256e901f5bddc56e24089c96f27b77da932dfcc ] + +When btrfs_qgroup_inherit(), btrfs_alloc_tree_block, or +btrfs_insert_root() fail in create_subvol(), we return without freeing +anon_dev. Reorganize the error handling in create_subvol() to fix this. + +Reviewed-by: Sweet Tea Dorminy +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ioctl.c | 49 +++++++++++++++++++++++------------------------- + 1 file changed, 23 insertions(+), 26 deletions(-) + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 8fe9d55d6862..072cdcab3061 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -544,7 +544,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + struct timespec64 cur_time = current_time(dir); + struct inode *inode; + int ret; +- dev_t anon_dev = 0; ++ dev_t anon_dev; + u64 objectid; + u64 index = 0; + +@@ -554,11 +554,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + + ret = btrfs_get_free_objectid(fs_info->tree_root, &objectid); + if (ret) +- goto fail_free; +- +- ret = get_anon_bdev(&anon_dev); +- if (ret < 0) +- goto fail_free; ++ goto out_root_item; + + /* + * Don't create subvolume whose level is not zero. Or qgroup will be +@@ -566,9 +562,13 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + */ + if (btrfs_qgroup_level(objectid)) { + ret = -ENOSPC; +- goto fail_free; ++ goto out_root_item; + } + ++ ret = get_anon_bdev(&anon_dev); ++ if (ret < 0) ++ goto out_root_item; ++ + btrfs_init_block_rsv(&block_rsv, BTRFS_BLOCK_RSV_TEMP); + /* + * The same as the snapshot creation, please see the comment +@@ -576,26 +576,26 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + */ + ret = btrfs_subvolume_reserve_metadata(root, &block_rsv, 8, false); + if (ret) +- goto fail_free; ++ goto out_anon_dev; + + trans = btrfs_start_transaction(root, 0); + if (IS_ERR(trans)) { + ret = PTR_ERR(trans); + btrfs_subvolume_release_metadata(root, &block_rsv); +- goto fail_free; ++ goto out_anon_dev; + } + trans->block_rsv = &block_rsv; + trans->bytes_reserved = block_rsv.size; + + ret = btrfs_qgroup_inherit(trans, 0, objectid, inherit); + if (ret) +- goto fail; ++ goto out; + + leaf = btrfs_alloc_tree_block(trans, root, 0, objectid, NULL, 0, 0, 0, + BTRFS_NESTING_NORMAL); + if (IS_ERR(leaf)) { + ret = PTR_ERR(leaf); +- goto fail; ++ goto out; + } + + btrfs_mark_buffer_dirty(leaf); +@@ -650,7 +650,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + btrfs_tree_unlock(leaf); + btrfs_free_tree_block(trans, objectid, leaf, 0, 1); + free_extent_buffer(leaf); +- goto fail; ++ goto out; + } + + free_extent_buffer(leaf); +@@ -659,19 +659,18 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + key.offset = (u64)-1; + new_root = btrfs_get_new_fs_root(fs_info, objectid, anon_dev); + if (IS_ERR(new_root)) { +- free_anon_bdev(anon_dev); + ret = PTR_ERR(new_root); + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } +- /* Freeing will be done in btrfs_put_root() of new_root */ ++ /* anon_dev is owned by new_root now. */ + anon_dev = 0; + + ret = btrfs_record_root_in_trans(trans, new_root); + if (ret) { + btrfs_put_root(new_root); + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + ret = btrfs_create_subvol_root(trans, new_root, root, mnt_userns); +@@ -679,7 +678,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + if (ret) { + /* We potentially lose an unused inode item here */ + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + /* +@@ -688,28 +687,28 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + ret = btrfs_set_inode_index(BTRFS_I(dir), &index); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + ret = btrfs_insert_dir_item(trans, name, namelen, BTRFS_I(dir), &key, + BTRFS_FT_DIR, index); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + btrfs_i_size_write(BTRFS_I(dir), dir->i_size + namelen * 2); + ret = btrfs_update_inode(trans, root, BTRFS_I(dir)); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + ret = btrfs_add_root_ref(trans, objectid, root->root_key.objectid, + btrfs_ino(BTRFS_I(dir)), index, name, namelen); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + ret = btrfs_uuid_tree_add(trans, root_item->uuid, +@@ -717,8 +716,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + if (ret) + btrfs_abort_transaction(trans, ret); + +-fail: +- kfree(root_item); ++out: + trans->block_rsv = NULL; + trans->bytes_reserved = 0; + btrfs_subvolume_release_metadata(root, &block_rsv); +@@ -734,11 +732,10 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + return PTR_ERR(inode); + d_instantiate(dentry, inode); + } +- return ret; +- +-fail_free: ++out_anon_dev: + if (anon_dev) + free_anon_bdev(anon_dev); ++out_root_item: + kfree(root_item); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.17/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch b/queue-5.17/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch new file mode 100644 index 00000000000..b35388a5de3 --- /dev/null +++ b/queue-5.17/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch @@ -0,0 +1,64 @@ +From d96013ae744c256595c9b0caf3c02f5cb1a0c3bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 20:43:57 +0900 +Subject: can: mcp251xfd: silence clang's -Wunaligned-access warning + +From: Vincent Mailhol + +[ Upstream commit 1a6dd9996699889313327be03981716a8337656b ] + +clang emits a -Wunaligned-access warning on union +mcp251xfd_tx_ojb_load_buf. + +The reason is that field hw_tx_obj (not declared as packed) is being +packed right after a 16 bits field inside a packed struct: + +| union mcp251xfd_tx_obj_load_buf { +| struct __packed { +| struct mcp251xfd_buf_cmd cmd; +| /* ^ 16 bits fields */ +| struct mcp251xfd_hw_tx_obj_raw hw_tx_obj; +| /* ^ not declared as packed */ +| } nocrc; +| struct __packed { +| struct mcp251xfd_buf_cmd_crc cmd; +| struct mcp251xfd_hw_tx_obj_raw hw_tx_obj; +| __be16 crc; +| } crc; +| } ____cacheline_aligned; + +Starting from LLVM 14, having an unpacked struct nested in a packed +struct triggers a warning. c.f. [1]. + +This is a false positive because the field is always being accessed +with the relevant put_unaligned_*() function. Adding __packed to the +structure declaration silences the warning. + +[1] https://github.com/llvm/llvm-project/issues/55520 + +Link: https://lore.kernel.org/all/20220518114357.55452-1-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Reported-by: kernel test robot +Tested-by: Nathan Chancellor # build +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +index f551c900803e..aed6e9d47517 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +@@ -434,7 +434,7 @@ struct mcp251xfd_hw_tef_obj { + /* The tx_obj_raw version is used in spi async, i.e. without + * regmap. We have to take care of endianness ourselves. + */ +-struct mcp251xfd_hw_tx_obj_raw { ++struct __packed mcp251xfd_hw_tx_obj_raw { + __le32 id; + __le32 flags; + u8 data[sizeof_field(struct canfd_frame, data)]; +-- +2.35.1 + diff --git a/queue-5.17/can-xilinx_can-mark-bit-timing-constants-as-const.patch b/queue-5.17/can-xilinx_can-mark-bit-timing-constants-as-const.patch new file mode 100644 index 00000000000..066bfa124df --- /dev/null +++ b/queue-5.17/can-xilinx_can-mark-bit-timing-constants-as-const.patch @@ -0,0 +1,46 @@ +From fbeeb82cfe4d899dc4ec28bede1cd758df5e2162 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 21:29:07 +0100 +Subject: can: xilinx_can: mark bit timing constants as const + +From: Marc Kleine-Budde + +[ Upstream commit ae38fda02996d43d9fb09f16e81e0008704dd524 ] + +This patch marks the bit timing constants as const. + +Fixes: c223da689324 ("can: xilinx_can: Add support for CANFD FD frames") +Link: https://lore.kernel.org/all/20220317203119.792552-1-mkl@pengutronix.de +Cc: Appana Durga Kedareswara rao +Cc: Naga Sureshkumar Relli +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/xilinx_can.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index 1674b561c9a2..f3b149b60465 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -239,7 +239,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd = { + }; + + /* AXI CANFD Data Bittiming constants as per AXI CANFD 1.0 specs */ +-static struct can_bittiming_const xcan_data_bittiming_const_canfd = { ++static const struct can_bittiming_const xcan_data_bittiming_const_canfd = { + .name = DRIVER_NAME, + .tseg1_min = 1, + .tseg1_max = 16, +@@ -265,7 +265,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd2 = { + }; + + /* AXI CANFD 2.0 Data Bittiming constants as per AXI CANFD 2.0 spec */ +-static struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { ++static const struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { + .name = DRIVER_NAME, + .tseg1_min = 1, + .tseg1_max = 32, +-- +2.35.1 + diff --git a/queue-5.17/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch b/queue-5.17/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch new file mode 100644 index 00000000000..8fdb07c3e2d --- /dev/null +++ b/queue-5.17/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch @@ -0,0 +1,56 @@ +From 50c307102659e9aa46aacdac8fff8dd522f6c4b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 10:06:02 +0200 +Subject: char: tpm: cr50_i2c: Suppress duplicated error message in .remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit e0687fe958f763f1790f22ed5483025b7624e744 ] + +Returning an error value in an i2c remove callback results in an error +message being emitted by the i2c core, but otherwise it doesn't make a +difference. The device goes away anyhow and the devm cleanups are +called. + +As tpm_cr50_i2c_remove() emits an error message already and the +additional error message by the i2c core doesn't add any useful +information, change the return value to zero to suppress this error +message. + +Note that if i2c_clientdata is NULL, there is something really fishy. +Assuming no memory corruption happened (then all bets are lost anyhow), +tpm_cr50_i2c_remove() is only called after tpm_cr50_i2c_probe() returned +successfully. So there was a tpm chip registered before and after +tpm_cr50_i2c_remove() its privdata is freed but the associated character +device isn't removed. If after that happened userspace accesses the +character device it's likely that the freed memory is accessed. For that +reason the warning message is made a bit more frightening. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index f6c0affbb456..bf608b6af339 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -768,8 +768,8 @@ static int tpm_cr50_i2c_remove(struct i2c_client *client) + struct device *dev = &client->dev; + + if (!chip) { +- dev_err(dev, "Could not get client data at remove\n"); +- return -ENODEV; ++ dev_crit(dev, "Could not get client data at remove, memory corruption ahead\n"); ++ return 0; + } + + tpm_chip_unregister(chip); +-- +2.35.1 + diff --git a/queue-5.17/cifs-do-not-use-tcpstatus-after-negotiate-completes.patch b/queue-5.17/cifs-do-not-use-tcpstatus-after-negotiate-completes.patch new file mode 100644 index 00000000000..0686122e4bf --- /dev/null +++ b/queue-5.17/cifs-do-not-use-tcpstatus-after-negotiate-completes.patch @@ -0,0 +1,116 @@ +From 12c8f6da5411fb4d7da8ea7cf0902c39b309924e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 09:22:20 +0000 +Subject: cifs: do not use tcpStatus after negotiate completes + +From: Shyam Prasad N + +[ Upstream commit 1a6a41d4cedd9b302e2200e6f0e3c44dbbe13689 ] + +Recent changes to multichannel to allow channel reconnects to +work in parallel and independent of each other did so by +making use of tcpStatus for the connection, and status for the +session. However, this did not take into account the multiuser +scenario, where same connection is used by multiple connections. + +However, tcpStatus should be tracked only till the end of +negotiate exchange, and not used for session setup. This change +fixes this. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 23 +++++++++++------------ + fs/cifs/smb2pdu.c | 3 ++- + fs/cifs/smb2transport.c | 3 ++- + 3 files changed, 15 insertions(+), 14 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 82ae3b84caf6..faf4587804d9 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3956,7 +3956,7 @@ cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, + if (rc == 0) { + spin_lock(&cifs_tcp_ses_lock); + if (server->tcpStatus == CifsInNegotiate) +- server->tcpStatus = CifsNeedSessSetup; ++ server->tcpStatus = CifsGood; + else + rc = -EHOSTDOWN; + spin_unlock(&cifs_tcp_ses_lock); +@@ -3979,19 +3979,18 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + bool is_binding = false; + + /* only send once per connect */ ++ spin_lock(&ses->chan_lock); ++ is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); ++ spin_unlock(&ses->chan_lock); ++ + spin_lock(&cifs_tcp_ses_lock); +- if ((server->tcpStatus != CifsNeedSessSetup) && +- (ses->status == CifsGood)) { ++ if (ses->status == CifsExiting) { + spin_unlock(&cifs_tcp_ses_lock); + return 0; + } +- server->tcpStatus = CifsInSessSetup; ++ ses->status = CifsInSessSetup; + spin_unlock(&cifs_tcp_ses_lock); + +- spin_lock(&ses->chan_lock); +- is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); +- spin_unlock(&ses->chan_lock); +- + if (!is_binding) { + ses->capabilities = server->capabilities; + if (!linuxExtEnabled) +@@ -4015,13 +4014,13 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + if (rc) { + cifs_server_dbg(VFS, "Send error in SessSetup = %d\n", rc); + spin_lock(&cifs_tcp_ses_lock); +- if (server->tcpStatus == CifsInSessSetup) +- server->tcpStatus = CifsNeedSessSetup; ++ if (ses->status == CifsInSessSetup) ++ ses->status = CifsNeedSessSetup; + spin_unlock(&cifs_tcp_ses_lock); + } else { + spin_lock(&cifs_tcp_ses_lock); +- if (server->tcpStatus == CifsInSessSetup) +- server->tcpStatus = CifsGood; ++ if (ses->status == CifsInSessSetup) ++ ses->status = CifsGood; + /* Even if one channel is active, session is in good state */ + ses->status = CifsGood; + spin_unlock(&cifs_tcp_ses_lock); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 1704fd358b85..55e6879ef18b 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3904,7 +3904,8 @@ SMB2_echo(struct TCP_Server_Info *server) + cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); + + spin_lock(&cifs_tcp_ses_lock); +- if (server->tcpStatus == CifsNeedNegotiate) { ++ if (server->ops->need_neg && ++ server->ops->need_neg(server)) { + spin_unlock(&cifs_tcp_ses_lock); + /* No need to send echo on newly established connections */ + mod_delayed_work(cifsiod_wq, &server->reconnect, 0); +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index 2af79093b78b..01b732641edb 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -641,7 +641,8 @@ smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server) + if (!is_signed) + return 0; + spin_lock(&cifs_tcp_ses_lock); +- if (server->tcpStatus == CifsNeedNegotiate) { ++ if (server->ops->need_neg && ++ server->ops->need_neg(server)) { + spin_unlock(&cifs_tcp_ses_lock); + return 0; + } +-- +2.35.1 + diff --git a/queue-5.17/cifs-return-enoent-for-dfs-lookup_cache_entry.patch b/queue-5.17/cifs-return-enoent-for-dfs-lookup_cache_entry.patch new file mode 100644 index 00000000000..270c2646cb4 --- /dev/null +++ b/queue-5.17/cifs-return-enoent-for-dfs-lookup_cache_entry.patch @@ -0,0 +1,107 @@ +From d8506feaa4997dceb1b19e0eccc28ec4ae163f57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 11:41:05 -0300 +Subject: cifs: return ENOENT for DFS lookup_cache_entry() + +From: Enzo Matsumiya + +[ Upstream commit 337b8b0e4343567221ef8d88aac5e418208d4ac1 ] + +EEXIST didn't make sense to use when dfs_cache_find() couldn't find a +cache entry nor retrieve a referral target. + +It also doesn't make sense cifs_dfs_query_info_nonascii_quirk() to +emulate ENOENT anymore. + +Signed-off-by: Enzo Matsumiya +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 6 ++++-- + fs/cifs/dfs_cache.c | 6 +++--- + fs/cifs/misc.c | 6 +----- + 3 files changed, 8 insertions(+), 10 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 8f60be10aa43..82ae3b84caf6 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3406,8 +3406,9 @@ cifs_are_all_path_components_accessible(struct TCP_Server_Info *server, + } + + /* +- * Check if path is remote (e.g. a DFS share). Return -EREMOTE if it is, +- * otherwise 0. ++ * Check if path is remote (i.e. a DFS share). ++ * ++ * Return -EREMOTE if it is, otherwise 0 or -errno. + */ + static int is_path_remote(struct mount_ctx *mnt_ctx) + { +@@ -3697,6 +3698,7 @@ int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx) + if (!isdfs) + goto out; + ++ /* proceed as DFS mount */ + uuid_gen(&mnt_ctx.mount_id); + rc = connect_dfs_root(&mnt_ctx, &tl); + dfs_cache_free_tgts(&tl); +diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c +index 956f8e5cf3e7..c5dd6f7305bd 100644 +--- a/fs/cifs/dfs_cache.c ++++ b/fs/cifs/dfs_cache.c +@@ -654,7 +654,7 @@ static struct cache_entry *__lookup_cache_entry(const char *path, unsigned int h + return ce; + } + } +- return ERR_PTR(-EEXIST); ++ return ERR_PTR(-ENOENT); + } + + /* +@@ -662,7 +662,7 @@ static struct cache_entry *__lookup_cache_entry(const char *path, unsigned int h + * + * Use whole path components in the match. Must be called with htable_rw_lock held. + * +- * Return ERR_PTR(-EEXIST) if the entry is not found. ++ * Return ERR_PTR(-ENOENT) if the entry is not found. + */ + static struct cache_entry *lookup_cache_entry(const char *path) + { +@@ -710,7 +710,7 @@ static struct cache_entry *lookup_cache_entry(const char *path) + while (e > s && *e != sep) + e--; + } +- return ERR_PTR(-EEXIST); ++ return ERR_PTR(-ENOENT); + } + + /** +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 114810e563a9..5a803d686146 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -1308,7 +1308,7 @@ int cifs_update_super_prepath(struct cifs_sb_info *cifs_sb, char *prefix) + * for "\\\" DFS reference, + * where contains non-ASCII unicode symbols. + * +- * Check such DFS reference and emulate -ENOENT if it is actual. ++ * Check such DFS reference. + */ + int cifs_dfs_query_info_nonascii_quirk(const unsigned int xid, + struct cifs_tcon *tcon, +@@ -1340,10 +1340,6 @@ int cifs_dfs_query_info_nonascii_quirk(const unsigned int xid, + cifs_dbg(FYI, "DFS ref '%s' is found, emulate -EREMOTE\n", + dfspath); + rc = -EREMOTE; +- } else if (rc == -EEXIST) { +- cifs_dbg(FYI, "DFS ref '%s' is not found, emulate -ENOENT\n", +- dfspath); +- rc = -ENOENT; + } else { + cifs_dbg(FYI, "%s: dfs_cache_find returned %d\n", __func__, rc); + } +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch b/queue-5.17/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch new file mode 100644 index 00000000000..7091a820266 --- /dev/null +++ b/queue-5.17/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch @@ -0,0 +1,62 @@ +From d14b1e6a0789be1bbc2875ba44f2d0e1945d0624 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 13:51:35 +0530 +Subject: cpufreq: Avoid unnecessary frequency updates due to mismatch + +From: Viresh Kumar + +[ Upstream commit f55ae08c89873e140c7cac2a7fa161d31a0d60cf ] + +For some platforms, the frequency returned by hardware may be slightly +different from what is provided in the frequency table. For example, +hardware may return 499 MHz instead of 500 MHz. In such cases it is +better to avoid getting into unnecessary frequency updates, as we may +end up switching policy->cur between the two and sending unnecessary +pre/post update notifications, etc. + +This patch has chosen allows the hardware frequency and table frequency +to deviate by 1 MHz for now, we may want to increase it a bit later on +if someone still complains. + +Reported-by: Rex-BC Chen +Signed-off-by: Viresh Kumar +Tested-by: Jia-wei Chang +Reviewed-by: Matthias Brugger +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 80f535cc8a75..fbaa8e6c7d23 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + + static LIST_HEAD(cpufreq_policy_list); +@@ -1707,6 +1708,16 @@ static unsigned int cpufreq_verify_current_freq(struct cpufreq_policy *policy, b + return new_freq; + + if (policy->cur != new_freq) { ++ /* ++ * For some platforms, the frequency returned by hardware may be ++ * slightly different from what is provided in the frequency ++ * table, for example hardware may return 499 MHz instead of 500 ++ * MHz. In such cases it is better to avoid getting into ++ * unnecessary frequency updates. ++ */ ++ if (abs(policy->cur - new_freq) < HZ_PER_MHZ) ++ return policy->cur; ++ + cpufreq_out_of_sync(policy, new_freq); + if (update) + schedule_work(&policy->update); +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch b/queue-5.17/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch new file mode 100644 index 00000000000..a39f8bcebb4 --- /dev/null +++ b/queue-5.17/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch @@ -0,0 +1,91 @@ +From e3a7dfafb5e1b7ca2b8f537baed7a0eaf25eacff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 03:15:41 +0800 +Subject: cpufreq: Fix possible race in cpufreq online error path + +From: Schspa Shi + +[ Upstream commit f346e96267cd76175d6c201b40f770c0116a8a04 ] + +When cpufreq online fails, the policy->cpus mask is not cleared and +policy->rwsem is released too early, so the driver can be invoked +via the cpuinfo_cur_freq sysfs attribute while its ->offline() or +->exit() callbacks are being run. + +Take policy->clk as an example: + +static int cpufreq_online(unsigned int cpu) +{ + ... + // policy->cpus != 0 at this time + down_write(&policy->rwsem); + ret = cpufreq_add_dev_interface(policy); + up_write(&policy->rwsem); + + return 0; + +out_destroy_policy: + for_each_cpu(j, policy->real_cpus) + remove_cpu_dev_symlink(policy, get_cpu_device(j)); + up_write(&policy->rwsem); +... +out_exit_policy: + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + clk_put(policy->clk); + // policy->clk is a wild pointer +... + ^ + | + Another process access + __cpufreq_get + cpufreq_verify_current_freq + cpufreq_generic_get + // acces wild pointer of policy->clk; + | + | +out_offline_policy: | + cpufreq_policy_free(policy); | + // deleted here, and will wait for no body reference + cpufreq_policy_put_kobj(policy); +} + +Address this by modifying cpufreq_online() to release policy->rwsem +in the error path after the driver callbacks have run and to clear +policy->cpus before releasing the semaphore. + +Fixes: 7106e02baed4 ("cpufreq: release policy->rwsem on error") +Signed-off-by: Schspa Shi +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index fbaa8e6c7d23..233e8af48848 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1534,8 +1534,6 @@ static int cpufreq_online(unsigned int cpu) + for_each_cpu(j, policy->real_cpus) + remove_cpu_dev_symlink(policy, get_cpu_device(j)); + +- up_write(&policy->rwsem); +- + out_offline_policy: + if (cpufreq_driver->offline) + cpufreq_driver->offline(policy); +@@ -1544,6 +1542,9 @@ static int cpufreq_online(unsigned int cpu) + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + ++ cpumask_clear(policy->cpus); ++ up_write(&policy->rwsem); ++ + out_free_policy: + cpufreq_policy_free(policy); + return ret; +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-mediatek-unregister-platform-device-on-exit.patch b/queue-5.17/cpufreq-mediatek-unregister-platform-device-on-exit.patch new file mode 100644 index 00000000000..e14a256b239 --- /dev/null +++ b/queue-5.17/cpufreq-mediatek-unregister-platform-device-on-exit.patch @@ -0,0 +1,72 @@ +From e19eb5216f86528ea6228cd7c0a107e9cc96935f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 May 2022 19:52:18 +0800 +Subject: cpufreq: mediatek: Unregister platform device on exit + +From: Rex-BC Chen + +[ Upstream commit f126fbadce92b92c3a7be41e4abc1fbae93ae2ef ] + +We register the platform device when driver inits. However, we do not +unregister it when driver exits. + +To resolve this, we declare the platform data to be a global static +variable and rename it to be "cpufreq_pdev". With this global variable, +we can do platform_device_unregister() when driver exits. + +Fixes: 501c574f4e3a ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC") +Signed-off-by: Rex-BC Chen +[ Viresh: Commit log and Subject ] +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 9d7d9c8dc184..bfe240c726e3 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -44,6 +44,8 @@ struct mtk_cpu_dvfs_info { + bool need_voltage_tracking; + }; + ++static struct platform_device *cpufreq_pdev; ++ + static LIST_HEAD(dvfs_info_list); + + static struct mtk_cpu_dvfs_info *mtk_cpu_dvfs_info_lookup(int cpu) +@@ -547,7 +549,6 @@ static int __init mtk_cpufreq_driver_init(void) + { + struct device_node *np; + const struct of_device_id *match; +- struct platform_device *pdev; + int err; + + np = of_find_node_by_path("/"); +@@ -571,11 +572,11 @@ static int __init mtk_cpufreq_driver_init(void) + * and the device registration codes are put here to handle defer + * probing. + */ +- pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0); +- if (IS_ERR(pdev)) { ++ cpufreq_pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0); ++ if (IS_ERR(cpufreq_pdev)) { + pr_err("failed to register mtk-cpufreq platform device\n"); + platform_driver_unregister(&mtk_cpufreq_platdrv); +- return PTR_ERR(pdev); ++ return PTR_ERR(cpufreq_pdev); + } + + return 0; +@@ -584,6 +585,7 @@ module_init(mtk_cpufreq_driver_init) + + static void __exit mtk_cpufreq_driver_exit(void) + { ++ platform_device_unregister(cpufreq_pdev); + platform_driver_unregister(&mtk_cpufreq_platdrv); + } + module_exit(mtk_cpufreq_driver_exit) +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-mediatek-use-module_init-and-add-module_exit.patch b/queue-5.17/cpufreq-mediatek-use-module_init-and-add-module_exit.patch new file mode 100644 index 00000000000..0fcbb016713 --- /dev/null +++ b/queue-5.17/cpufreq-mediatek-use-module_init-and-add-module_exit.patch @@ -0,0 +1,42 @@ +From a13a39f5ee8bfae13e56cc342390d5f8aa217fad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 12:58:55 +0800 +Subject: cpufreq: mediatek: Use module_init and add module_exit + +From: Jia-Wei Chang + +[ Upstream commit b7070187c81cb90549d7561c0e750d7c7eb751f4 ] + +- Use module_init instead of device_initcall. +- Add a function for module_exit to unregister driver. + +Signed-off-by: Jia-Wei Chang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 866163883b48..9d7d9c8dc184 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -580,7 +580,13 @@ static int __init mtk_cpufreq_driver_init(void) + + return 0; + } +-device_initcall(mtk_cpufreq_driver_init); ++module_init(mtk_cpufreq_driver_init) ++ ++static void __exit mtk_cpufreq_driver_exit(void) ++{ ++ platform_driver_unregister(&mtk_cpufreq_platdrv); ++} ++module_exit(mtk_cpufreq_driver_exit) + + MODULE_DESCRIPTION("MediaTek CPUFreq driver"); + MODULE_AUTHOR("Pi-Cheng Chen "); +-- +2.35.1 + diff --git a/queue-5.17/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch b/queue-5.17/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch new file mode 100644 index 00000000000..88e296b2e8b --- /dev/null +++ b/queue-5.17/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch @@ -0,0 +1,110 @@ +From 8f6356fb346febe106a422bb30a276c6e004b2a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 16:11:24 +0200 +Subject: cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode + +From: Ulf Hansson + +[ Upstream commit 171b66e2e2e9d80b93c8cff799e6175074b22297 ] + +When PSCI OSI mode is supported the syscore flag is set for the CPU devices +that becomes attached to their PM domains (genpds). In the suspend-to-idle +case, we call dev_pm_genpd_suspend|resume() to allow genpd to properly +manage the power-off/on operations (pick an idlestate and manage the on/off +notifications). + +For suspend-to-ram, dev_pm_genpd_suspend|resume() is currently not being +called, which causes a problem that the genpd on/off notifiers do not get +sent as expected. This prevents the platform-specific operations from being +executed, typically needed just before/after the boot CPU is being turned +off/on. + +To deal with this problem, let's register a syscore ops for cpuidle-psci +when PSCI OSI mode is being used and call dev_pm_genpd_suspend|resume() +from them. In this way, genpd regains control of the PM domain topology and +then sends the on/off notifications when it's appropriate. + +Reported-by: Maulik Shah +Suggested-by: Maulik Shah +Signed-off-by: Ulf Hansson +Tested-by: Maulik Shah +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-psci.c | 46 ++++++++++++++++++++++++++++++++++ + 1 file changed, 46 insertions(+) + +diff --git a/drivers/cpuidle/cpuidle-psci.c b/drivers/cpuidle/cpuidle-psci.c +index b51b5df08450..540105ca0781 100644 +--- a/drivers/cpuidle/cpuidle-psci.c ++++ b/drivers/cpuidle/cpuidle-psci.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + +@@ -131,6 +132,49 @@ static int psci_idle_cpuhp_down(unsigned int cpu) + return 0; + } + ++static void psci_idle_syscore_switch(bool suspend) ++{ ++ bool cleared = false; ++ struct device *dev; ++ int cpu; ++ ++ for_each_possible_cpu(cpu) { ++ dev = per_cpu_ptr(&psci_cpuidle_data, cpu)->dev; ++ ++ if (dev && suspend) { ++ dev_pm_genpd_suspend(dev); ++ } else if (dev) { ++ dev_pm_genpd_resume(dev); ++ ++ /* Account for userspace having offlined a CPU. */ ++ if (pm_runtime_status_suspended(dev)) ++ pm_runtime_set_active(dev); ++ ++ /* Clear domain state to re-start fresh. */ ++ if (!cleared) { ++ psci_set_domain_state(0); ++ cleared = true; ++ } ++ } ++ } ++} ++ ++static int psci_idle_syscore_suspend(void) ++{ ++ psci_idle_syscore_switch(true); ++ return 0; ++} ++ ++static void psci_idle_syscore_resume(void) ++{ ++ psci_idle_syscore_switch(false); ++} ++ ++static struct syscore_ops psci_idle_syscore_ops = { ++ .suspend = psci_idle_syscore_suspend, ++ .resume = psci_idle_syscore_resume, ++}; ++ + static void psci_idle_init_cpuhp(void) + { + int err; +@@ -138,6 +182,8 @@ static void psci_idle_init_cpuhp(void) + if (!psci_cpuidle_use_cpuhp) + return; + ++ register_syscore_ops(&psci_idle_syscore_ops); ++ + err = cpuhp_setup_state_nocalls(CPUHP_AP_CPU_PM_STARTING, + "cpuidle/psci:online", + psci_idle_cpuhp_up, +-- +2.35.1 + diff --git a/queue-5.17/crypto-ccp-fix-the-init_ex-data-file-open-failure.patch b/queue-5.17/crypto-ccp-fix-the-init_ex-data-file-open-failure.patch new file mode 100644 index 00000000000..f19b0f000ad --- /dev/null +++ b/queue-5.17/crypto-ccp-fix-the-init_ex-data-file-open-failure.patch @@ -0,0 +1,97 @@ +From 2899b2085df0b488b5e63809a1cbd48dd9f8dcdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 16:23:25 +0000 +Subject: crypto: ccp - Fix the INIT_EX data file open failure + +From: Jacky Li + +[ Upstream commit 05def5cacfa0bd5ba380116046747da07ff5bd78 ] + +There are 2 common cases when INIT_EX data file might not be +opened successfully and fail the sev initialization: + +1. In user namespaces, normal user tasks (e.g. VMM) can change their + current->fs->root to point to arbitrary directories. While + init_ex_path is provided as a module param related to root file + system. Solution: use the root directory of init_task to avoid + accessing the wrong file. + +2. Normal user tasks (e.g. VMM) don't have the privilege to access + the INIT_EX data file. Solution: open the file as root and + restore permissions immediately. + +Fixes: 3d725965f836 ("crypto: ccp - Add SEV_INIT_EX support") +Signed-off-by: Jacky Li +Reviewed-by: Peter Gonda +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sev-dev.c | 30 ++++++++++++++++++++++++++++-- + 1 file changed, 28 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 6ab93dfd478a..3aefb177715e 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + +@@ -170,6 +171,31 @@ static void *sev_fw_alloc(unsigned long len) + return page_address(page); + } + ++static struct file *open_file_as_root(const char *filename, int flags, umode_t mode) ++{ ++ struct file *fp; ++ struct path root; ++ struct cred *cred; ++ const struct cred *old_cred; ++ ++ task_lock(&init_task); ++ get_fs_root(init_task.fs, &root); ++ task_unlock(&init_task); ++ ++ cred = prepare_creds(); ++ if (!cred) ++ return ERR_PTR(-ENOMEM); ++ cred->fsuid = GLOBAL_ROOT_UID; ++ old_cred = override_creds(cred); ++ ++ fp = file_open_root(&root, filename, flags, mode); ++ path_put(&root); ++ ++ revert_creds(old_cred); ++ ++ return fp; ++} ++ + static int sev_read_init_ex_file(void) + { + struct sev_device *sev = psp_master->sev_data; +@@ -181,7 +207,7 @@ static int sev_read_init_ex_file(void) + if (!sev_init_ex_buffer) + return -EOPNOTSUPP; + +- fp = filp_open(init_ex_path, O_RDONLY, 0); ++ fp = open_file_as_root(init_ex_path, O_RDONLY, 0); + if (IS_ERR(fp)) { + int ret = PTR_ERR(fp); + +@@ -217,7 +243,7 @@ static void sev_write_init_ex_file(void) + if (!sev_init_ex_buffer) + return; + +- fp = filp_open(init_ex_path, O_CREAT | O_WRONLY, 0600); ++ fp = open_file_as_root(init_ex_path, O_CREAT | O_WRONLY, 0600); + if (IS_ERR(fp)) { + dev_err(sev->dev, + "SEV: could not open file for write, error %ld\n", +-- +2.35.1 + diff --git a/queue-5.17/crypto-ccree-use-fine-grained-dma-mapping-dir.patch b/queue-5.17/crypto-ccree-use-fine-grained-dma-mapping-dir.patch new file mode 100644 index 00000000000..77c2f3c3ed7 --- /dev/null +++ b/queue-5.17/crypto-ccree-use-fine-grained-dma-mapping-dir.patch @@ -0,0 +1,117 @@ +From 3b7034f0c756a75c2714dff6c39b452535393466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 11:11:39 +0300 +Subject: crypto: ccree - use fine grained DMA mapping dir + +From: Gilad Ben-Yossef + +[ Upstream commit a260436c98171cd825955a84a7f6e62bc8f4f00d ] + +Use a fine grained specification of DMA mapping directions +in certain cases, allowing both a more optimized operation +as well as shushing out a harmless, though persky +dma-debug warning. + +Signed-off-by: Gilad Ben-Yossef +Reported-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccree/cc_buffer_mgr.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c +index 11e0278c8631..6140e4927322 100644 +--- a/drivers/crypto/ccree/cc_buffer_mgr.c ++++ b/drivers/crypto/ccree/cc_buffer_mgr.c +@@ -356,12 +356,14 @@ void cc_unmap_cipher_request(struct device *dev, void *ctx, + req_ctx->mlli_params.mlli_dma_addr); + } + +- dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_BIDIRECTIONAL); +- dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); +- + if (src != dst) { +- dma_unmap_sg(dev, dst, req_ctx->out_nents, DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_TO_DEVICE); ++ dma_unmap_sg(dev, dst, req_ctx->out_nents, DMA_FROM_DEVICE); + dev_dbg(dev, "Unmapped req->dst=%pK\n", sg_virt(dst)); ++ dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); ++ } else { ++ dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_BIDIRECTIONAL); ++ dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); + } + } + +@@ -377,6 +379,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + u32 dummy = 0; + int rc = 0; + u32 mapped_nents = 0; ++ int src_direction = (src != dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL); + + req_ctx->dma_buf_type = CC_DMA_BUF_DLLI; + mlli_params->curr_pool = NULL; +@@ -399,7 +402,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + } + + /* Map the src SGL */ +- rc = cc_map_sg(dev, src, nbytes, DMA_BIDIRECTIONAL, &req_ctx->in_nents, ++ rc = cc_map_sg(dev, src, nbytes, src_direction, &req_ctx->in_nents, + LLI_MAX_NUM_OF_DATA_ENTRIES, &dummy, &mapped_nents); + if (rc) + goto cipher_exit; +@@ -416,7 +419,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + } + } else { + /* Map the dst sg */ +- rc = cc_map_sg(dev, dst, nbytes, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, dst, nbytes, DMA_FROM_DEVICE, + &req_ctx->out_nents, LLI_MAX_NUM_OF_DATA_ENTRIES, + &dummy, &mapped_nents); + if (rc) +@@ -456,6 +459,7 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req) + struct aead_req_ctx *areq_ctx = aead_request_ctx(req); + unsigned int hw_iv_size = areq_ctx->hw_iv_size; + struct cc_drvdata *drvdata = dev_get_drvdata(dev); ++ int src_direction = (req->src != req->dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL); + + if (areq_ctx->mac_buf_dma_addr) { + dma_unmap_single(dev, areq_ctx->mac_buf_dma_addr, +@@ -514,13 +518,11 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req) + sg_virt(req->src), areq_ctx->src.nents, areq_ctx->assoc.nents, + areq_ctx->assoclen, req->cryptlen); + +- dma_unmap_sg(dev, req->src, areq_ctx->src.mapped_nents, +- DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, req->src, areq_ctx->src.mapped_nents, src_direction); + if (req->src != req->dst) { + dev_dbg(dev, "Unmapping dst sgl: req->dst=%pK\n", + sg_virt(req->dst)); +- dma_unmap_sg(dev, req->dst, areq_ctx->dst.mapped_nents, +- DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, req->dst, areq_ctx->dst.mapped_nents, DMA_FROM_DEVICE); + } + if (drvdata->coherent && + areq_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_DECRYPT && +@@ -843,7 +845,7 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata, + else + size_for_map -= authsize; + +- rc = cc_map_sg(dev, req->dst, size_for_map, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, req->dst, size_for_map, DMA_FROM_DEVICE, + &areq_ctx->dst.mapped_nents, + LLI_MAX_NUM_OF_DATA_ENTRIES, &dst_last_bytes, + &dst_mapped_nents); +@@ -1056,7 +1058,8 @@ int cc_map_aead_request(struct cc_drvdata *drvdata, struct aead_request *req) + size_to_map += authsize; + } + +- rc = cc_map_sg(dev, req->src, size_to_map, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, req->src, size_to_map, ++ (req->src != req->dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL), + &areq_ctx->src.mapped_nents, + (LLI_MAX_NUM_OF_ASSOC_DATA_ENTRIES + + LLI_MAX_NUM_OF_DATA_ENTRIES), +-- +2.35.1 + diff --git a/queue-5.17/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch b/queue-5.17/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch new file mode 100644 index 00000000000..2575f5e4705 --- /dev/null +++ b/queue-5.17/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch @@ -0,0 +1,101 @@ +From 3e0d5dfc62630e421368f2aad431f54c402035fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:07:36 +0200 +Subject: crypto: cryptd - Protect per-CPU resource by disabling BH. + +From: Sebastian Andrzej Siewior + +[ Upstream commit 91e8bcd7b4da182e09ea19a2c73167345fe14c98 ] + +The access to cryptd_queue::cpu_queue is synchronized by disabling +preemption in cryptd_enqueue_request() and disabling BH in +cryptd_queue_worker(). This implies that access is allowed from BH. + +If cryptd_enqueue_request() is invoked from preemptible context _and_ +soft interrupt then this can lead to list corruption since +cryptd_enqueue_request() is not protected against access from +soft interrupt. + +Replace get_cpu() in cryptd_enqueue_request() with local_bh_disable() +to ensure BH is always disabled. +Remove preempt_disable() from cryptd_queue_worker() since it is not +needed because local_bh_disable() ensures synchronisation. + +Fixes: 254eff771441 ("crypto: cryptd - Per-CPU thread implementation...") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/cryptd.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/crypto/cryptd.c b/crypto/cryptd.c +index a1bea0f4baa8..668095eca0fa 100644 +--- a/crypto/cryptd.c ++++ b/crypto/cryptd.c +@@ -39,6 +39,10 @@ struct cryptd_cpu_queue { + }; + + struct cryptd_queue { ++ /* ++ * Protected by disabling BH to allow enqueueing from softinterrupt and ++ * dequeuing from kworker (cryptd_queue_worker()). ++ */ + struct cryptd_cpu_queue __percpu *cpu_queue; + }; + +@@ -125,28 +129,28 @@ static void cryptd_fini_queue(struct cryptd_queue *queue) + static int cryptd_enqueue_request(struct cryptd_queue *queue, + struct crypto_async_request *request) + { +- int cpu, err; ++ int err; + struct cryptd_cpu_queue *cpu_queue; + refcount_t *refcnt; + +- cpu = get_cpu(); ++ local_bh_disable(); + cpu_queue = this_cpu_ptr(queue->cpu_queue); + err = crypto_enqueue_request(&cpu_queue->queue, request); + + refcnt = crypto_tfm_ctx(request->tfm); + + if (err == -ENOSPC) +- goto out_put_cpu; ++ goto out; + +- queue_work_on(cpu, cryptd_wq, &cpu_queue->work); ++ queue_work_on(smp_processor_id(), cryptd_wq, &cpu_queue->work); + + if (!refcount_read(refcnt)) +- goto out_put_cpu; ++ goto out; + + refcount_inc(refcnt); + +-out_put_cpu: +- put_cpu(); ++out: ++ local_bh_enable(); + + return err; + } +@@ -162,15 +166,10 @@ static void cryptd_queue_worker(struct work_struct *work) + cpu_queue = container_of(work, struct cryptd_cpu_queue, work); + /* + * Only handle one request at a time to avoid hogging crypto workqueue. +- * preempt_disable/enable is used to prevent being preempted by +- * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent +- * cryptd_enqueue_request() being accessed from software interrupts. + */ + local_bh_disable(); +- preempt_disable(); + backlog = crypto_get_backlog(&cpu_queue->queue); + req = crypto_dequeue_request(&cpu_queue->queue); +- preempt_enable(); + local_bh_enable(); + + if (!req) +-- +2.35.1 + diff --git a/queue-5.17/crypto-marvell-cesa-ecb-does-not-iv.patch b/queue-5.17/crypto-marvell-cesa-ecb-does-not-iv.patch new file mode 100644 index 00000000000..d8ec6942888 --- /dev/null +++ b/queue-5.17/crypto-marvell-cesa-ecb-does-not-iv.patch @@ -0,0 +1,34 @@ +From 7d050c475cdeb4e26381f107c3dafb97b192d0e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 19:11:54 +0000 +Subject: crypto: marvell/cesa - ECB does not IV + +From: Corentin Labbe + +[ Upstream commit 4ffa1763622ae5752961499588f3f8874315f974 ] + +The DES3 ECB has an IV size set but ECB does not need one. + +Fixes: 4ada483978237 ("crypto: marvell/cesa - add Triple-DES support") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/cesa/cipher.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c +index b739d3b873dc..c6f2fa753b7c 100644 +--- a/drivers/crypto/marvell/cesa/cipher.c ++++ b/drivers/crypto/marvell/cesa/cipher.c +@@ -624,7 +624,6 @@ struct skcipher_alg mv_cesa_ecb_des3_ede_alg = { + .decrypt = mv_cesa_ecb_des3_ede_decrypt, + .min_keysize = DES3_EDE_KEY_SIZE, + .max_keysize = DES3_EDE_KEY_SIZE, +- .ivsize = DES3_EDE_BLOCK_SIZE, + .base = { + .cra_name = "ecb(des3_ede)", + .cra_driver_name = "mv-ecb-des3-ede", +-- +2.35.1 + diff --git a/queue-5.17/crypto-qat-fix-off-by-one-error-in-pfvf-debug-print.patch b/queue-5.17/crypto-qat-fix-off-by-one-error-in-pfvf-debug-print.patch new file mode 100644 index 00000000000..63955032c89 --- /dev/null +++ b/queue-5.17/crypto-qat-fix-off-by-one-error-in-pfvf-debug-print.patch @@ -0,0 +1,39 @@ +From 632bb88e266917ab6e0fcba9de6db7e9d12a8ebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 17:54:50 +0100 +Subject: crypto: qat - fix off-by-one error in PFVF debug print + +From: Marco Chiappero + +[ Upstream commit dd3d081b7ea6754913222ed0313fcf644edcc7e6 ] + +PFVF Block Message requests for CRC use 0-based values to indicate +amounts, which have to be remapped to 1-based values on the receiving +side. + +This patch fixes one debug print which was however using the wire value. + +Signed-off-by: Marco Chiappero +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c b/drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c +index 588352de1ef0..d17318d3f63a 100644 +--- a/drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c ++++ b/drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c +@@ -154,7 +154,7 @@ static struct pfvf_message handle_blkmsg_req(struct adf_accel_vf_info *vf_info, + if (FIELD_GET(ADF_VF2PF_BLOCK_CRC_REQ_MASK, req.data)) { + dev_dbg(&GET_DEV(vf_info->accel_dev), + "BlockMsg of type %d for CRC over %d bytes received from VF%d\n", +- blk_type, blk_byte, vf_info->vf_nr); ++ blk_type, blk_byte + 1, vf_info->vf_nr); + + if (!adf_pf2vf_blkmsg_get_data(vf_info, blk_type, blk_byte, + byte_max, &resp_data, +-- +2.35.1 + diff --git a/queue-5.17/crypto-qat-set-cipher-capability-for-dh895xcc.patch b/queue-5.17/crypto-qat-set-cipher-capability-for-dh895xcc.patch new file mode 100644 index 00000000000..7575cedde7b --- /dev/null +++ b/queue-5.17/crypto-qat-set-cipher-capability-for-dh895xcc.patch @@ -0,0 +1,57 @@ +From 4ccb776671d944cf58d7beb53e48da1d5dec4bee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 17:54:40 +0100 +Subject: crypto: qat - set CIPHER capability for DH895XCC + +From: Giovanni Cabiddu + +[ Upstream commit 6a23804cb8bcb85c6998bf193d94d4036db26f51 ] + +Set the CIPHER capability for QAT DH895XCC devices if the hardware supports +it. This is done if both the CIPHER and the AUTHENTICATION engines are +available on the device. + +Fixes: ad1332aa67ec ("crypto: qat - add support for capability detection") +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Marco Chiappero +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + .../crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +index 09599fe4d2f3..ff13047772e3 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +@@ -58,17 +58,23 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) + + capabilities = ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | + ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | +- ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ ICP_ACCEL_CAPABILITIES_AUTHENTICATION | ++ ICP_ACCEL_CAPABILITIES_CIPHER; + + /* Read accelerator capabilities mask */ + pci_read_config_dword(pdev, ADF_DEVICE_LEGFUSE_OFFSET, &legfuses); + +- if (legfuses & ICP_ACCEL_MASK_CIPHER_SLICE) ++ /* A set bit in legfuses means the feature is OFF in this SKU */ ++ if (legfuses & ICP_ACCEL_MASK_CIPHER_SLICE) { + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC; ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; ++ } + if (legfuses & ICP_ACCEL_MASK_PKE_SLICE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC; +- if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) ++ if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) { + capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; ++ } + if (legfuses & ICP_ACCEL_MASK_COMPRESS_SLICE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION; + +-- +2.35.1 + diff --git a/queue-5.17/crypto-qat-set-compression-capability-for-dh895xcc.patch b/queue-5.17/crypto-qat-set-compression-capability-for-dh895xcc.patch new file mode 100644 index 00000000000..bfa9502d9f0 --- /dev/null +++ b/queue-5.17/crypto-qat-set-compression-capability-for-dh895xcc.patch @@ -0,0 +1,43 @@ +From 3883743c2f6616962c2d72ad01b3994c3b6fcc23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 17:54:41 +0100 +Subject: crypto: qat - set COMPRESSION capability for DH895XCC + +From: Giovanni Cabiddu + +[ Upstream commit 0eaa51543273fd0f4ba9bea83638f7033436e5eb ] + +The capability detection logic clears bits for the features that are +disabled in a certain SKU. For example, if the bit associate to +compression is not present in the LEGFUSE register, the correspondent +bit is cleared in the capability mask. +This change adds the compression capability to the mask as this was +missing in the commit that enhanced the capability detection logic. + +Fixes: cfe4894eccdc ("crypto: qat - set COMPRESSION capability for QAT GEN2") +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Marco Chiappero +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +index ff13047772e3..61d5467e0d92 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +@@ -59,7 +59,8 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) + capabilities = ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | + ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | + ICP_ACCEL_CAPABILITIES_AUTHENTICATION | +- ICP_ACCEL_CAPABILITIES_CIPHER; ++ ICP_ACCEL_CAPABILITIES_CIPHER | ++ ICP_ACCEL_CAPABILITIES_COMPRESSION; + + /* Read accelerator capabilities mask */ + pci_read_config_dword(pdev, ADF_DEVICE_LEGFUSE_OFFSET, &legfuses); +-- +2.35.1 + diff --git a/queue-5.17/crypto-sun8i-ss-handle-zero-sized-sg.patch b/queue-5.17/crypto-sun8i-ss-handle-zero-sized-sg.patch new file mode 100644 index 00000000000..00f16c2d5aa --- /dev/null +++ b/queue-5.17/crypto-sun8i-ss-handle-zero-sized-sg.patch @@ -0,0 +1,49 @@ +From 3de1282971dd8249e1ba07762370a8c6086ec414 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 20:19:15 +0000 +Subject: crypto: sun8i-ss - handle zero sized sg + +From: Corentin Labbe + +[ Upstream commit c149e4763d28bb4c0e5daae8a59f2c74e889f407 ] + +sun8i-ss does not handle well the possible zero sized sg. + +Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +index 1a71ed49d233..ca4f280af35d 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +@@ -380,13 +380,21 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq) + } + + len = areq->nbytes; +- for_each_sg(areq->src, sg, nr_sgs, i) { ++ sg = areq->src; ++ i = 0; ++ while (len > 0 && sg) { ++ if (sg_dma_len(sg) == 0) { ++ sg = sg_next(sg); ++ continue; ++ } + rctx->t_src[i].addr = sg_dma_address(sg); + todo = min(len, sg_dma_len(sg)); + rctx->t_src[i].len = todo / 4; + len -= todo; + rctx->t_dst[i].addr = addr_res; + rctx->t_dst[i].len = digestsize / 4; ++ sg = sg_next(sg); ++ i++; + } + if (len > 0) { + dev_err(ss->dev, "remaining len %d\n", len); +-- +2.35.1 + diff --git a/queue-5.17/crypto-sun8i-ss-rework-handling-of-iv.patch b/queue-5.17/crypto-sun8i-ss-rework-handling-of-iv.patch new file mode 100644 index 00000000000..da5004f4d0b --- /dev/null +++ b/queue-5.17/crypto-sun8i-ss-rework-handling-of-iv.patch @@ -0,0 +1,296 @@ +From 97bbb1a53da49832a561c7a464631fd4d59dcedf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 20:19:14 +0000 +Subject: crypto: sun8i-ss - rework handling of IV + +From: Corentin Labbe + +[ Upstream commit 359e893e8af456be2fefabe851716237df289cbf ] + +sun8i-ss fail handling IVs when doing decryption of multiple SGs in-place. +It should backup the last block of each SG source for using it later as +IVs. +In the same time remove allocation on requests path for storing all +IVs. + +Fixes: f08fcced6d00 ("crypto: allwinner - Add sun8i-ss cryptographic offloader") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 115 ++++++++++++------ + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 30 +++-- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 14 ++- + 3 files changed, 107 insertions(+), 52 deletions(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +index 554e400d41ca..70e2e6e37389 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +@@ -93,6 +93,68 @@ static int sun8i_ss_cipher_fallback(struct skcipher_request *areq) + return err; + } + ++static int sun8i_ss_setup_ivs(struct skcipher_request *areq) ++{ ++ struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(areq); ++ struct sun8i_cipher_tfm_ctx *op = crypto_skcipher_ctx(tfm); ++ struct sun8i_ss_dev *ss = op->ss; ++ struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(areq); ++ struct scatterlist *sg = areq->src; ++ unsigned int todo, offset; ++ unsigned int len = areq->cryptlen; ++ unsigned int ivsize = crypto_skcipher_ivsize(tfm); ++ struct sun8i_ss_flow *sf = &ss->flows[rctx->flow]; ++ int i = 0; ++ u32 a; ++ int err; ++ ++ rctx->ivlen = ivsize; ++ if (rctx->op_dir & SS_DECRYPTION) { ++ offset = areq->cryptlen - ivsize; ++ scatterwalk_map_and_copy(sf->biv, areq->src, offset, ++ ivsize, 0); ++ } ++ ++ /* we need to copy all IVs from source in case DMA is bi-directionnal */ ++ while (sg && len) { ++ if (sg_dma_len(sg) == 0) { ++ sg = sg_next(sg); ++ continue; ++ } ++ if (i == 0) ++ memcpy(sf->iv[0], areq->iv, ivsize); ++ a = dma_map_single(ss->dev, sf->iv[i], ivsize, DMA_TO_DEVICE); ++ if (dma_mapping_error(ss->dev, a)) { ++ memzero_explicit(sf->iv[i], ivsize); ++ dev_err(ss->dev, "Cannot DMA MAP IV\n"); ++ err = -EFAULT; ++ goto dma_iv_error; ++ } ++ rctx->p_iv[i] = a; ++ /* we need to setup all others IVs only in the decrypt way */ ++ if (rctx->op_dir & SS_ENCRYPTION) ++ return 0; ++ todo = min(len, sg_dma_len(sg)); ++ len -= todo; ++ i++; ++ if (i < MAX_SG) { ++ offset = sg->length - ivsize; ++ scatterwalk_map_and_copy(sf->iv[i], sg, offset, ivsize, 0); ++ } ++ rctx->niv = i; ++ sg = sg_next(sg); ++ } ++ ++ return 0; ++dma_iv_error: ++ i--; ++ while (i >= 0) { ++ dma_unmap_single(ss->dev, rctx->p_iv[i], ivsize, DMA_TO_DEVICE); ++ memzero_explicit(sf->iv[i], ivsize); ++ } ++ return err; ++} ++ + static int sun8i_ss_cipher(struct skcipher_request *areq) + { + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(areq); +@@ -101,9 +163,9 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(areq); + struct skcipher_alg *alg = crypto_skcipher_alg(tfm); + struct sun8i_ss_alg_template *algt; ++ struct sun8i_ss_flow *sf = &ss->flows[rctx->flow]; + struct scatterlist *sg; + unsigned int todo, len, offset, ivsize; +- void *backup_iv = NULL; + int nr_sgs = 0; + int nr_sgd = 0; + int err = 0; +@@ -134,30 +196,9 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + + ivsize = crypto_skcipher_ivsize(tfm); + if (areq->iv && crypto_skcipher_ivsize(tfm) > 0) { +- rctx->ivlen = ivsize; +- rctx->biv = kzalloc(ivsize, GFP_KERNEL | GFP_DMA); +- if (!rctx->biv) { +- err = -ENOMEM; ++ err = sun8i_ss_setup_ivs(areq); ++ if (err) + goto theend_key; +- } +- if (rctx->op_dir & SS_DECRYPTION) { +- backup_iv = kzalloc(ivsize, GFP_KERNEL); +- if (!backup_iv) { +- err = -ENOMEM; +- goto theend_key; +- } +- offset = areq->cryptlen - ivsize; +- scatterwalk_map_and_copy(backup_iv, areq->src, offset, +- ivsize, 0); +- } +- memcpy(rctx->biv, areq->iv, ivsize); +- rctx->p_iv = dma_map_single(ss->dev, rctx->biv, rctx->ivlen, +- DMA_TO_DEVICE); +- if (dma_mapping_error(ss->dev, rctx->p_iv)) { +- dev_err(ss->dev, "Cannot DMA MAP IV\n"); +- err = -ENOMEM; +- goto theend_iv; +- } + } + if (areq->src == areq->dst) { + nr_sgs = dma_map_sg(ss->dev, areq->src, sg_nents(areq->src), +@@ -243,21 +284,19 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + } + + theend_iv: +- if (rctx->p_iv) +- dma_unmap_single(ss->dev, rctx->p_iv, rctx->ivlen, +- DMA_TO_DEVICE); +- + if (areq->iv && ivsize > 0) { +- if (rctx->biv) { +- offset = areq->cryptlen - ivsize; +- if (rctx->op_dir & SS_DECRYPTION) { +- memcpy(areq->iv, backup_iv, ivsize); +- kfree_sensitive(backup_iv); +- } else { +- scatterwalk_map_and_copy(areq->iv, areq->dst, offset, +- ivsize, 0); +- } +- kfree(rctx->biv); ++ for (i = 0; i < rctx->niv; i++) { ++ dma_unmap_single(ss->dev, rctx->p_iv[i], ivsize, DMA_TO_DEVICE); ++ memzero_explicit(sf->iv[i], ivsize); ++ } ++ ++ offset = areq->cryptlen - ivsize; ++ if (rctx->op_dir & SS_DECRYPTION) { ++ memcpy(areq->iv, sf->biv, ivsize); ++ memzero_explicit(sf->biv, ivsize); ++ } else { ++ scatterwalk_map_and_copy(areq->iv, areq->dst, offset, ++ ivsize, 0); + } + } + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +index 319fe3279a71..657530578643 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +@@ -66,6 +66,7 @@ int sun8i_ss_run_task(struct sun8i_ss_dev *ss, struct sun8i_cipher_req_ctx *rctx + const char *name) + { + int flow = rctx->flow; ++ unsigned int ivlen = rctx->ivlen; + u32 v = SS_START; + int i; + +@@ -104,15 +105,14 @@ int sun8i_ss_run_task(struct sun8i_ss_dev *ss, struct sun8i_cipher_req_ctx *rctx + mutex_lock(&ss->mlock); + writel(rctx->p_key, ss->base + SS_KEY_ADR_REG); + +- if (i == 0) { +- if (rctx->p_iv) +- writel(rctx->p_iv, ss->base + SS_IV_ADR_REG); +- } else { +- if (rctx->biv) { +- if (rctx->op_dir == SS_ENCRYPTION) +- writel(rctx->t_dst[i - 1].addr + rctx->t_dst[i - 1].len * 4 - rctx->ivlen, ss->base + SS_IV_ADR_REG); ++ if (ivlen) { ++ if (rctx->op_dir == SS_ENCRYPTION) { ++ if (i == 0) ++ writel(rctx->p_iv[0], ss->base + SS_IV_ADR_REG); + else +- writel(rctx->t_src[i - 1].addr + rctx->t_src[i - 1].len * 4 - rctx->ivlen, ss->base + SS_IV_ADR_REG); ++ writel(rctx->t_dst[i - 1].addr + rctx->t_dst[i - 1].len * 4 - ivlen, ss->base + SS_IV_ADR_REG); ++ } else { ++ writel(rctx->p_iv[i], ss->base + SS_IV_ADR_REG); + } + } + +@@ -464,7 +464,7 @@ static void sun8i_ss_free_flows(struct sun8i_ss_dev *ss, int i) + */ + static int allocate_flows(struct sun8i_ss_dev *ss) + { +- int i, err; ++ int i, j, err; + + ss->flows = devm_kcalloc(ss->dev, MAXFLOW, sizeof(struct sun8i_ss_flow), + GFP_KERNEL); +@@ -474,6 +474,18 @@ static int allocate_flows(struct sun8i_ss_dev *ss) + for (i = 0; i < MAXFLOW; i++) { + init_completion(&ss->flows[i].complete); + ++ ss->flows[i].biv = devm_kmalloc(ss->dev, AES_BLOCK_SIZE, ++ GFP_KERNEL | GFP_DMA); ++ if (!ss->flows[i].biv) ++ goto error_engine; ++ ++ for (j = 0; j < MAX_SG; j++) { ++ ss->flows[i].iv[j] = devm_kmalloc(ss->dev, AES_BLOCK_SIZE, ++ GFP_KERNEL | GFP_DMA); ++ if (!ss->flows[i].iv[j]) ++ goto error_engine; ++ } ++ + ss->flows[i].engine = crypto_engine_alloc_init(ss->dev, true); + if (!ss->flows[i].engine) { + dev_err(ss->dev, "Cannot allocate engine\n"); +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h +index 28188685b910..57ada8653855 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h +@@ -121,11 +121,15 @@ struct sginfo { + * @complete: completion for the current task on this flow + * @status: set to 1 by interrupt if task is done + * @stat_req: number of request done by this flow ++ * @iv: list of IV to use for each step ++ * @biv: buffer which contain the backuped IV + */ + struct sun8i_ss_flow { + struct crypto_engine *engine; + struct completion complete; + int status; ++ u8 *iv[MAX_SG]; ++ u8 *biv; + #ifdef CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG + unsigned long stat_req; + #endif +@@ -164,28 +168,28 @@ struct sun8i_ss_dev { + * @t_src: list of mapped SGs with their size + * @t_dst: list of mapped SGs with their size + * @p_key: DMA address of the key +- * @p_iv: DMA address of the IV ++ * @p_iv: DMA address of the IVs ++ * @niv: Number of IVs DMA mapped + * @method: current algorithm for this request + * @op_mode: op_mode for this request + * @op_dir: direction (encrypt vs decrypt) for this request + * @flow: the flow to use for this request +- * @ivlen: size of biv ++ * @ivlen: size of IVs + * @keylen: keylen for this request +- * @biv: buffer which contain the IV + * @fallback_req: request struct for invoking the fallback skcipher TFM + */ + struct sun8i_cipher_req_ctx { + struct sginfo t_src[MAX_SG]; + struct sginfo t_dst[MAX_SG]; + u32 p_key; +- u32 p_iv; ++ u32 p_iv[MAX_SG]; ++ int niv; + u32 method; + u32 op_mode; + u32 op_dir; + int flow; + unsigned int ivlen; + unsigned int keylen; +- void *biv; + struct skcipher_request fallback_req; // keep at the end + }; + +-- +2.35.1 + diff --git a/queue-5.17/dax-fix-cache-flush-on-pmd-mapped-pages.patch b/queue-5.17/dax-fix-cache-flush-on-pmd-mapped-pages.patch new file mode 100644 index 00000000000..19b8a51348a --- /dev/null +++ b/queue-5.17/dax-fix-cache-flush-on-pmd-mapped-pages.patch @@ -0,0 +1,58 @@ +From 901b4cf280cdae3bba6cd1ce85ad6f62245b3b8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:09 -0700 +Subject: dax: fix cache flush on PMD-mapped pages + +From: Muchun Song + +[ Upstream commit e583b5c472bd23d450e06f148dc1f37be74f7666 ] + +The flush_cache_page() only remove a PAGE_SIZE sized range from the cache. +However, it does not cover the full pages in a THP except a head page. +Replace it with flush_cache_range() to fix this issue. This is just a +documentation issue with the respect to properly documenting the expected +usage of cache flushing before modifying the pmd. However, in practice +this is not a problem due to the fact that DAX is not available on +architectures with virtually indexed caches per: + + commit d92576f1167c ("dax: does not work correctly with virtual aliasing caches") + +Link: https://lkml.kernel.org/r/20220403053957.10770-3-songmuchun@bytedance.com +Fixes: f729c8c9b24f ("dax: wrprotect pmd_t in dax_mapping_entry_mkclean") +Signed-off-by: Muchun Song +Reviewed-by: Dan Williams +Reviewed-by: Christoph Hellwig +Cc: Alistair Popple +Cc: Al Viro +Cc: Hugh Dickins +Cc: Jan Kara +Cc: "Kirill A. Shutemov" +Cc: Matthew Wilcox +Cc: Ralph Campbell +Cc: Ross Zwisler +Cc: Xiongchun Duan +Cc: Xiyu Yang +Cc: Yang Shi +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/dax.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index cd03485867a7..411ea6a0fe57 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -846,7 +846,8 @@ static void dax_entry_mkclean(struct address_space *mapping, pgoff_t index, + if (!pmd_dirty(*pmdp) && !pmd_write(*pmdp)) + goto unlock_pmd; + +- flush_cache_page(vma, address, pfn); ++ flush_cache_range(vma, address, ++ address + HPAGE_PMD_SIZE); + pmd = pmdp_invalidate(vma, address, pmdp); + pmd = pmd_wrprotect(pmd); + pmd = pmd_mkclean(pmd); +-- +2.35.1 + diff --git a/queue-5.17/device-property-allow-error-pointer-to-be-passed-to-.patch b/queue-5.17/device-property-allow-error-pointer-to-be-passed-to-.patch new file mode 100644 index 00000000000..6716f7ffca4 --- /dev/null +++ b/queue-5.17/device-property-allow-error-pointer-to-be-passed-to-.patch @@ -0,0 +1,261 @@ +From 5ae65bf727060efe1d6659c2150b62f9c6e54e59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 21:48:40 +0300 +Subject: device property: Allow error pointer to be passed to fwnode APIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 002752af7b89b74c64fe6bec8c5fde3d3a7810d8 ] + +Some of the fwnode APIs might return an error pointer instead of NULL +or valid fwnode handle. The result of such API call may be considered +optional and hence the test for it is usually done in a form of + + fwnode = fwnode_find_reference(...); + if (IS_ERR(fwnode)) + ...error handling... + +Nevertheless the resulting fwnode may have bumped the reference count +and hence caller of the above API is obliged to call fwnode_handle_put(). +Since fwnode may be not valid either as NULL or error pointer the check +has to be performed there. This approach uglifies the code and adds +a point of making a mistake, i.e. forgetting about error point case. + +To prevent this, allow an error pointer to be passed to the fwnode APIs. + +Fixes: 83b34afb6b79 ("device property: Introduce fwnode_find_reference()") +Reported-by: Nuno Sá +Tested-by: Nuno Sá +Acked-by: Nuno Sá +Reviewed-by: Sakari Ailus +Reviewed-by: Heikki Krogerus +Signed-off-by: Andy Shevchenko +Tested-by: Michael Walle +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 89 +++++++++++++++++++++++------------------ + include/linux/fwnode.h | 10 ++--- + 2 files changed, 56 insertions(+), 43 deletions(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index e6497f6877ee..4d5bac0a490d 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -47,12 +47,14 @@ bool fwnode_property_present(const struct fwnode_handle *fwnode, + { + bool ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return false; ++ + ret = fwnode_call_bool_op(fwnode, property_present, propname); +- if (ret == false && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_bool_op(fwnode->secondary, property_present, +- propname); +- return ret; ++ if (ret) ++ return ret; ++ ++ return fwnode_call_bool_op(fwnode->secondary, property_present, propname); + } + EXPORT_SYMBOL_GPL(fwnode_property_present); + +@@ -232,15 +234,16 @@ static int fwnode_property_read_int_array(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -EINVAL; ++ + ret = fwnode_call_int_op(fwnode, property_read_int_array, propname, + elem_size, val, nval); +- if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op( +- fwnode->secondary, property_read_int_array, propname, +- elem_size, val, nval); ++ if (ret != -EINVAL) ++ return ret; + +- return ret; ++ return fwnode_call_int_op(fwnode->secondary, property_read_int_array, propname, ++ elem_size, val, nval); + } + + /** +@@ -371,14 +374,16 @@ int fwnode_property_read_string_array(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -EINVAL; ++ + ret = fwnode_call_int_op(fwnode, property_read_string_array, propname, + val, nval); +- if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op(fwnode->secondary, +- property_read_string_array, propname, +- val, nval); +- return ret; ++ if (ret != -EINVAL) ++ return ret; ++ ++ return fwnode_call_int_op(fwnode->secondary, property_read_string_array, propname, ++ val, nval); + } + EXPORT_SYMBOL_GPL(fwnode_property_read_string_array); + +@@ -480,15 +485,19 @@ int fwnode_property_get_reference_args(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -ENOENT; ++ + ret = fwnode_call_int_op(fwnode, get_reference_args, prop, nargs_prop, + nargs, index, args); ++ if (ret == 0) ++ return ret; + +- if (ret < 0 && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op(fwnode->secondary, get_reference_args, +- prop, nargs_prop, nargs, index, args); ++ if (IS_ERR_OR_NULL(fwnode->secondary)) ++ return ret; + +- return ret; ++ return fwnode_call_int_op(fwnode->secondary, get_reference_args, prop, nargs_prop, ++ nargs, index, args); + } + EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args); + +@@ -635,12 +644,13 @@ EXPORT_SYMBOL_GPL(fwnode_count_parents); + struct fwnode_handle *fwnode_get_nth_parent(struct fwnode_handle *fwnode, + unsigned int depth) + { +- unsigned int i; +- + fwnode_handle_get(fwnode); + +- for (i = 0; i < depth && fwnode; i++) ++ do { ++ if (depth-- == 0) ++ break; + fwnode = fwnode_get_next_parent(fwnode); ++ } while (fwnode); + + return fwnode; + } +@@ -659,17 +669,17 @@ EXPORT_SYMBOL_GPL(fwnode_get_nth_parent); + bool fwnode_is_ancestor_of(struct fwnode_handle *test_ancestor, + struct fwnode_handle *test_child) + { +- if (!test_ancestor) ++ if (IS_ERR_OR_NULL(test_ancestor)) + return false; + + fwnode_handle_get(test_child); +- while (test_child) { ++ do { + if (test_child == test_ancestor) { + fwnode_handle_put(test_child); + return true; + } + test_child = fwnode_get_next_parent(test_child); +- } ++ } while (test_child); + return false; + } + +@@ -698,7 +708,7 @@ fwnode_get_next_available_child_node(const struct fwnode_handle *fwnode, + { + struct fwnode_handle *next_child = child; + +- if (!fwnode) ++ if (IS_ERR_OR_NULL(fwnode)) + return NULL; + + do { +@@ -722,16 +732,16 @@ struct fwnode_handle *device_get_next_child_node(struct device *dev, + const struct fwnode_handle *fwnode = dev_fwnode(dev); + struct fwnode_handle *next; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return NULL; ++ + /* Try to find a child in primary fwnode */ + next = fwnode_get_next_child_node(fwnode, child); + if (next) + return next; + + /* When no more children in primary, continue with secondary */ +- if (fwnode && !IS_ERR_OR_NULL(fwnode->secondary)) +- next = fwnode_get_next_child_node(fwnode->secondary, child); +- +- return next; ++ return fwnode_get_next_child_node(fwnode->secondary, child); + } + EXPORT_SYMBOL_GPL(device_get_next_child_node); + +@@ -798,6 +808,9 @@ EXPORT_SYMBOL_GPL(fwnode_handle_put); + */ + bool fwnode_device_is_available(const struct fwnode_handle *fwnode) + { ++ if (IS_ERR_OR_NULL(fwnode)) ++ return false; ++ + if (!fwnode_has_op(fwnode, device_is_available)) + return true; + +@@ -959,14 +972,14 @@ fwnode_graph_get_next_endpoint(const struct fwnode_handle *fwnode, + parent = fwnode_graph_get_port_parent(prev); + else + parent = fwnode; ++ if (IS_ERR_OR_NULL(parent)) ++ return NULL; + + ep = fwnode_call_ptr_op(parent, graph_get_next_endpoint, prev); ++ if (ep) ++ return ep; + +- if (IS_ERR_OR_NULL(ep) && +- !IS_ERR_OR_NULL(parent) && !IS_ERR_OR_NULL(parent->secondary)) +- ep = fwnode_graph_get_next_endpoint(parent->secondary, NULL); +- +- return ep; ++ return fwnode_graph_get_next_endpoint(parent->secondary, NULL); + } + EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint); + +diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h +index 3a532ba66f6c..7defac04f9a3 100644 +--- a/include/linux/fwnode.h ++++ b/include/linux/fwnode.h +@@ -148,12 +148,12 @@ struct fwnode_operations { + int (*add_links)(struct fwnode_handle *fwnode); + }; + +-#define fwnode_has_op(fwnode, op) \ +- ((fwnode) && (fwnode)->ops && (fwnode)->ops->op) ++#define fwnode_has_op(fwnode, op) \ ++ (!IS_ERR_OR_NULL(fwnode) && (fwnode)->ops && (fwnode)->ops->op) ++ + #define fwnode_call_int_op(fwnode, op, ...) \ +- (fwnode ? (fwnode_has_op(fwnode, op) ? \ +- (fwnode)->ops->op(fwnode, ## __VA_ARGS__) : -ENXIO) : \ +- -EINVAL) ++ (fwnode_has_op(fwnode, op) ? \ ++ (fwnode)->ops->op(fwnode, ## __VA_ARGS__) : (IS_ERR_OR_NULL(fwnode) ? -EINVAL : -ENXIO)) + + #define fwnode_call_bool_op(fwnode, op, ...) \ + (fwnode_has_op(fwnode, op) ? \ +-- +2.35.1 + diff --git a/queue-5.17/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch b/queue-5.17/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch new file mode 100644 index 00000000000..8a29053bac1 --- /dev/null +++ b/queue-5.17/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch @@ -0,0 +1,41 @@ +From c27be3356459833f411fa1249e9c0654ab951c7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 13:17:32 -0400 +Subject: dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC + +From: Mikulas Patocka + +[ Upstream commit 84bc4f1dbbbb5f8aa68706a96711dccb28b518e5 ] + +We observed the error "cacheline tracking ENOMEM, dma-debug disabled" +during a light system load (copying some files). The reason for this error +is that the dma_active_cacheline radix tree uses GFP_NOWAIT allocation - +so it can't access the emergency memory reserves and it fails as soon as +anybody reaches the watermark. + +This patch changes GFP_NOWAIT to GFP_ATOMIC, so that it can access the +emergency memory reserves. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index f8ff598596b8..ac740630c79c 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -448,7 +448,7 @@ void debug_dma_dump_mappings(struct device *dev) + * other hand, consumes a single dma_debug_entry, but inserts 'nents' + * entries into the tree. + */ +-static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT); ++static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC); + static DEFINE_SPINLOCK(radix_lock); + #define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1) + #define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT) +-- +2.35.1 + diff --git a/queue-5.17/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch b/queue-5.17/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch new file mode 100644 index 00000000000..b229fbcf02c --- /dev/null +++ b/queue-5.17/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch @@ -0,0 +1,93 @@ +From a24a703676446122a393c1a8130986b093f49936 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 19:20:24 +0200 +Subject: dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages + +From: Christoph Hellwig + +[ Upstream commit 92826e967535db2eb117db227b1191aaf98e4bb3 ] + +When dma_direct_alloc_pages encounters a highmem page it just gives up +currently. But what we really should do is to try memory using the +page allocator instead - without this platforms with a global highmem +CMA pool will fail all dma_alloc_pages allocations. + +Fixes: efa70f2fdc84 ("dma-mapping: add a new dma_alloc_pages API") +Reported-by: Mark O'Neill +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 27 ++++++++++----------------- + 1 file changed, 10 insertions(+), 17 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 50f48e9e4598..0be095579010 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -115,7 +115,7 @@ static struct page *dma_direct_alloc_swiotlb(struct device *dev, size_t size) + } + + static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, +- gfp_t gfp) ++ gfp_t gfp, bool allow_highmem) + { + int node = dev_to_node(dev); + struct page *page = NULL; +@@ -129,9 +129,12 @@ static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, + gfp |= dma_direct_optimal_gfp_mask(dev, dev->coherent_dma_mask, + &phys_limit); + page = dma_alloc_contiguous(dev, size, gfp); +- if (page && !dma_coherent_ok(dev, page_to_phys(page), size)) { +- dma_free_contiguous(dev, page, size); +- page = NULL; ++ if (page) { ++ if (!dma_coherent_ok(dev, page_to_phys(page), size) || ++ (!allow_highmem && PageHighMem(page))) { ++ dma_free_contiguous(dev, page, size); ++ page = NULL; ++ } + } + again: + if (!page) +@@ -189,7 +192,7 @@ static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size, + { + struct page *page; + +- page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO); ++ page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true); + if (!page) + return NULL; + +@@ -262,7 +265,7 @@ void *dma_direct_alloc(struct device *dev, size_t size, + return dma_direct_alloc_from_pool(dev, size, dma_handle, gfp); + + /* we always manually zero the memory once we are done */ +- page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO); ++ page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true); + if (!page) + return NULL; + if (PageHighMem(page)) { +@@ -370,19 +373,9 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, + if (force_dma_unencrypted(dev) && dma_direct_use_pool(dev, gfp)) + return dma_direct_alloc_from_pool(dev, size, dma_handle, gfp); + +- page = __dma_direct_alloc_pages(dev, size, gfp); ++ page = __dma_direct_alloc_pages(dev, size, gfp, false); + if (!page) + return NULL; +- if (PageHighMem(page)) { +- /* +- * Depending on the cma= arguments and per-arch setup +- * dma_alloc_contiguous could return highmem pages. +- * Without remapping there is no way to return them here, +- * so log an error and fail. +- */ +- dev_info(dev, "Rejecting highmem page from CMA.\n"); +- goto out_free_pages; +- } + + ret = page_address(page); + if (dma_set_decrypted(dev, ret, size)) +-- +2.35.1 + diff --git a/queue-5.17/dma-direct-don-t-over-decrypt-memory.patch b/queue-5.17/dma-direct-don-t-over-decrypt-memory.patch new file mode 100644 index 00000000000..fba0e730b09 --- /dev/null +++ b/queue-5.17/dma-direct-don-t-over-decrypt-memory.patch @@ -0,0 +1,56 @@ +From a9d988cb739fc12c20f17bf4c92f36c45c433afb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 18:10:13 +0100 +Subject: dma-direct: don't over-decrypt memory + +From: Robin Murphy + +[ Upstream commit 4a37f3dd9a83186cb88d44808ab35b78375082c9 ] + +The original x86 sev_alloc() only called set_memory_decrypted() on +memory returned by alloc_pages_node(), so the page order calculation +fell out of that logic. However, the common dma-direct code has several +potential allocators, not all of which are guaranteed to round up the +underlying allocation to a power-of-two size, so carrying over that +calculation for the encryption/decryption size was a mistake. Fix it by +rounding to a *number* of pages, rather than an order. + +Until recently there was an even worse interaction with DMA_DIRECT_REMAP +where we could have ended up decrypting part of the next adjacent +vmalloc area, only averted by no architecture actually supporting both +configs at once. Don't ask how I found that one out... + +Fixes: c10f07aa27da ("dma/direct: Handle force decryption for DMA coherent buffers in common code") +Signed-off-by: Robin Murphy +Signed-off-by: Christoph Hellwig +Acked-by: David Rientjes +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 0be095579010..54b1a5d21187 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -79,7 +79,7 @@ static int dma_set_decrypted(struct device *dev, void *vaddr, size_t size) + { + if (!force_dma_unencrypted(dev)) + return 0; +- return set_memory_decrypted((unsigned long)vaddr, 1 << get_order(size)); ++ return set_memory_decrypted((unsigned long)vaddr, PFN_UP(size)); + } + + static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size) +@@ -88,7 +88,7 @@ static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size) + + if (!force_dma_unencrypted(dev)) + return 0; +- ret = set_memory_encrypted((unsigned long)vaddr, 1 << get_order(size)); ++ ret = set_memory_encrypted((unsigned long)vaddr, PFN_UP(size)); + if (ret) + pr_warn_ratelimited("leaking DMA memory that can't be re-encrypted\n"); + return ret; +-- +2.35.1 + diff --git a/queue-5.17/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch b/queue-5.17/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch new file mode 100644 index 00000000000..cbbbd41cdc0 --- /dev/null +++ b/queue-5.17/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch @@ -0,0 +1,49 @@ +From 36acc6ab1b9b2e84ba7f44ff2544ca2356d2e905 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:13:38 +0200 +Subject: dmaengine: idxd: Fix the error handling path in idxd_cdev_register() + +From: Christophe JAILLET + +[ Upstream commit aab08c1aac01097815fbcf10fce7021d2396a31f ] + +If a call to alloc_chrdev_region() fails, the already allocated resources +are leaking. + +Add the needed error handling path to fix the leak. + +Fixes: 42d279f9137a ("dmaengine: idxd: add char driver to expose submission portal to userland") +Signed-off-by: Christophe JAILLET +Acked-by: Dave Jiang +Link: https://lore.kernel.org/r/1b5033dcc87b5f2a953c413f0306e883e6114542.1650521591.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/cdev.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c +index b9b2b4a4124e..033df43db0ce 100644 +--- a/drivers/dma/idxd/cdev.c ++++ b/drivers/dma/idxd/cdev.c +@@ -369,10 +369,16 @@ int idxd_cdev_register(void) + rc = alloc_chrdev_region(&ictx[i].devt, 0, MINORMASK, + ictx[i].name); + if (rc) +- return rc; ++ goto err_free_chrdev_region; + } + + return 0; ++ ++err_free_chrdev_region: ++ for (i--; i >= 0; i--) ++ unregister_chrdev_region(ictx[i].devt, MINORMASK); ++ ++ return rc; + } + + void idxd_cdev_remove(void) +-- +2.35.1 + diff --git a/queue-5.17/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch b/queue-5.17/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch new file mode 100644 index 00000000000..011b7200a35 --- /dev/null +++ b/queue-5.17/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch @@ -0,0 +1,41 @@ +From 890507e3967460a06445bc9e763506560e9d1f5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:53:21 +0200 +Subject: dmaengine: stm32-mdma: fix chan initialization in + stm32_mdma_irq_handler() + +From: Amelie Delaunay + +[ Upstream commit da3b8ddb464bd49b6248d00ca888ad751c9e44fd ] + +The parameter to pass back to the handler function when irq has been +requested is a struct stm32_mdma_device pointer, not a struct +stm32_mdma_chan pointer. +Even if chan is reinit later in the function, remove this wrong +initialization. + +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20220504155322.121431-3-amelie.delaunay@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index 1e6bc22ddae9..f8c8b9d76aad 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -1316,7 +1316,7 @@ static void stm32_mdma_xfer_end(struct stm32_mdma_chan *chan) + static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid) + { + struct stm32_mdma_device *dmadev = devid; +- struct stm32_mdma_chan *chan = devid; ++ struct stm32_mdma_chan *chan; + u32 reg, id, ccr, ien, status; + + /* Find out which channel generates the interrupt */ +-- +2.35.1 + diff --git a/queue-5.17/dmaengine-stm32-mdma-remove-gisr1-register.patch b/queue-5.17/dmaengine-stm32-mdma-remove-gisr1-register.patch new file mode 100644 index 00000000000..8f1737e0bd4 --- /dev/null +++ b/queue-5.17/dmaengine-stm32-mdma-remove-gisr1-register.patch @@ -0,0 +1,73 @@ +From 1fd356cd9727494e4118d9a1b3b39fae3f4ae14b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:53:20 +0200 +Subject: dmaengine: stm32-mdma: remove GISR1 register + +From: Amelie Delaunay + +[ Upstream commit 9d6a2d92e450926c483e45eaf426080a19219f4e ] + +GISR1 was described in a not up-to-date documentation when the stm32-mdma +driver has been developed. This register has not been added in reference +manual of STM32 SoC with MDMA, which have only 32 MDMA channels. +So remove it from stm32-mdma driver. + +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20220504155322.121431-2-amelie.delaunay@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 21 +++++---------------- + 1 file changed, 5 insertions(+), 16 deletions(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index 6f57ff0e7b37..1e6bc22ddae9 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -34,7 +34,6 @@ + #include "virt-dma.h" + + #define STM32_MDMA_GISR0 0x0000 /* MDMA Int Status Reg 1 */ +-#define STM32_MDMA_GISR1 0x0004 /* MDMA Int Status Reg 2 */ + + /* MDMA Channel x interrupt/status register */ + #define STM32_MDMA_CISR(x) (0x40 + 0x40 * (x)) /* x = 0..62 */ +@@ -168,7 +167,7 @@ + + #define STM32_MDMA_MAX_BUF_LEN 128 + #define STM32_MDMA_MAX_BLOCK_LEN 65536 +-#define STM32_MDMA_MAX_CHANNELS 63 ++#define STM32_MDMA_MAX_CHANNELS 32 + #define STM32_MDMA_MAX_REQUESTS 256 + #define STM32_MDMA_MAX_BURST 128 + #define STM32_MDMA_VERY_HIGH_PRIORITY 0x3 +@@ -1322,21 +1321,11 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid) + + /* Find out which channel generates the interrupt */ + status = readl_relaxed(dmadev->base + STM32_MDMA_GISR0); +- if (status) { +- id = __ffs(status); +- } else { +- status = readl_relaxed(dmadev->base + STM32_MDMA_GISR1); +- if (!status) { +- dev_dbg(mdma2dev(dmadev), "spurious it\n"); +- return IRQ_NONE; +- } +- id = __ffs(status); +- /* +- * As GISR0 provides status for channel id from 0 to 31, +- * so GISR1 provides status for channel id from 32 to 62 +- */ +- id += 32; ++ if (!status) { ++ dev_dbg(mdma2dev(dmadev), "spurious it\n"); ++ return IRQ_NONE; + } ++ id = __ffs(status); + + chan = &dmadev->chan[id]; + if (!chan) { +-- +2.35.1 + diff --git a/queue-5.17/drbd-fix-duplicate-array-initializer.patch b/queue-5.17/drbd-fix-duplicate-array-initializer.patch new file mode 100644 index 00000000000..dac6d8fa642 --- /dev/null +++ b/queue-5.17/drbd-fix-duplicate-array-initializer.patch @@ -0,0 +1,93 @@ +From 70e0135d59c8db20a94541f01d0d1aedede708d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 21:07:09 +0200 +Subject: drbd: fix duplicate array initializer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 33cb0917bbe241dd17a2b87ead63514c1b7e5615 ] + +There are two initializers for P_RETRY_WRITE: + +drivers/block/drbd/drbd_main.c:3676:22: warning: initialized field overwritten [-Woverride-init] + +Remove the first one since it was already ignored by the compiler +and reorder the list to match the enum definition. As P_ZEROES had +no entry, add that one instead. + +Fixes: 036b17eaab93 ("drbd: Receiving part for the PROTOCOL_UPDATE packet") +Fixes: f31e583aa2c2 ("drbd: introduce P_ZEROES (REQ_OP_WRITE_ZEROES on the "wire")") +Signed-off-by: Arnd Bergmann +Reviewed-by: Christoph Böhmwalder +Link: https://lore.kernel.org/r/20220406190715.1938174-2-christoph.boehmwalder@linbit.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 416f4f48f69b..8d17dd647187 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -3609,9 +3609,8 @@ const char *cmdname(enum drbd_packet cmd) + * when we want to support more than + * one PRO_VERSION */ + static const char *cmdnames[] = { ++ + [P_DATA] = "Data", +- [P_WSAME] = "WriteSame", +- [P_TRIM] = "Trim", + [P_DATA_REPLY] = "DataReply", + [P_RS_DATA_REPLY] = "RSDataReply", + [P_BARRIER] = "Barrier", +@@ -3622,7 +3621,6 @@ const char *cmdname(enum drbd_packet cmd) + [P_DATA_REQUEST] = "DataRequest", + [P_RS_DATA_REQUEST] = "RSDataRequest", + [P_SYNC_PARAM] = "SyncParam", +- [P_SYNC_PARAM89] = "SyncParam89", + [P_PROTOCOL] = "ReportProtocol", + [P_UUIDS] = "ReportUUIDs", + [P_SIZES] = "ReportSizes", +@@ -3630,6 +3628,7 @@ const char *cmdname(enum drbd_packet cmd) + [P_SYNC_UUID] = "ReportSyncUUID", + [P_AUTH_CHALLENGE] = "AuthChallenge", + [P_AUTH_RESPONSE] = "AuthResponse", ++ [P_STATE_CHG_REQ] = "StateChgRequest", + [P_PING] = "Ping", + [P_PING_ACK] = "PingAck", + [P_RECV_ACK] = "RecvAck", +@@ -3640,23 +3639,25 @@ const char *cmdname(enum drbd_packet cmd) + [P_NEG_DREPLY] = "NegDReply", + [P_NEG_RS_DREPLY] = "NegRSDReply", + [P_BARRIER_ACK] = "BarrierAck", +- [P_STATE_CHG_REQ] = "StateChgRequest", + [P_STATE_CHG_REPLY] = "StateChgReply", + [P_OV_REQUEST] = "OVRequest", + [P_OV_REPLY] = "OVReply", + [P_OV_RESULT] = "OVResult", + [P_CSUM_RS_REQUEST] = "CsumRSRequest", + [P_RS_IS_IN_SYNC] = "CsumRSIsInSync", ++ [P_SYNC_PARAM89] = "SyncParam89", + [P_COMPRESSED_BITMAP] = "CBitmap", + [P_DELAY_PROBE] = "DelayProbe", + [P_OUT_OF_SYNC] = "OutOfSync", +- [P_RETRY_WRITE] = "RetryWrite", + [P_RS_CANCEL] = "RSCancel", + [P_CONN_ST_CHG_REQ] = "conn_st_chg_req", + [P_CONN_ST_CHG_REPLY] = "conn_st_chg_reply", + [P_PROTOCOL_UPDATE] = "protocol_update", ++ [P_TRIM] = "Trim", + [P_RS_THIN_REQ] = "rs_thin_req", + [P_RS_DEALLOCATED] = "rs_deallocated", ++ [P_WSAME] = "WriteSame", ++ [P_ZEROES] = "Zeroes", + + /* enum drbd_packet, but not commands - obsoleted flags: + * P_MAY_IGNORE +-- +2.35.1 + diff --git a/queue-5.17/drivers-base-memory-fix-an-unlikely-reference-counti.patch b/queue-5.17/drivers-base-memory-fix-an-unlikely-reference-counti.patch new file mode 100644 index 00000000000..0bfc7f7ce19 --- /dev/null +++ b/queue-5.17/drivers-base-memory-fix-an-unlikely-reference-counti.patch @@ -0,0 +1,53 @@ +From e872e3259fced21a6235027bb3a9e5fe2d68de1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:19 -0700 +Subject: drivers/base/memory: fix an unlikely reference counting issue in + __add_memory_block() + +From: Christophe JAILLET + +[ Upstream commit f47f758cff59c68015d6b9b9c077110df7c2c828 ] + +__add_memory_block() calls both put_device() and device_unregister() when +storing the memory block into the xarray. This is incorrect because +xarray doesn't take an additional reference and device_unregister() +already calls put_device(). + +Triggering the issue looks really unlikely and its only effect should be +to log a spurious warning about a ref counted issue. + +Link: https://lkml.kernel.org/r/d44c63d78affe844f020dc02ad6af29abc448fc4.1650611702.git.christophe.jaillet@wanadoo.fr +Fixes: 4fb6eabf1037 ("drivers/base/memory.c: cache memory blocks in xarray to accelerate lookup") +Signed-off-by: Christophe JAILLET +Acked-by: Michal Hocko +Reviewed-by: David Hildenbrand +Cc: Greg Kroah-Hartman +Cc: "Rafael J. Wysocki" +Cc: Scott Cheloha +Cc: Nathan Lynch +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/memory.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/memory.c b/drivers/base/memory.c +index 60c38f9cf1a7..c0d501a3a714 100644 +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -634,10 +634,9 @@ int register_memory(struct memory_block *memory) + } + ret = xa_err(xa_store(&memory_blocks, memory->dev.id, memory, + GFP_KERNEL)); +- if (ret) { +- put_device(&memory->dev); ++ if (ret) + device_unregister(&memory->dev); +- } ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.17/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch b/queue-5.17/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch new file mode 100644 index 00000000000..747d30266ee --- /dev/null +++ b/queue-5.17/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch @@ -0,0 +1,44 @@ +From 6ba44ac53bbea2e43da7267b8de98cb7962e4f3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:06 -0700 +Subject: drivers/base/node.c: fix compaction sysfs file leak + +From: Miaohe Lin + +[ Upstream commit da63dc84befaa9e6079a0bc363ff0eaa975f9073 ] + +Compaction sysfs file is created via compaction_register_node in +register_node. But we forgot to remove it in unregister_node. Thus +compaction sysfs file is leaked. Using compaction_unregister_node to fix +this issue. + +Link: https://lkml.kernel.org/r/20220401070905.43679-1-linmiaohe@huawei.com +Fixes: ed4a6d7f0676 ("mm: compaction: add /sys trigger for per-node memory compaction") +Signed-off-by: Miaohe Lin +Cc: Greg Kroah-Hartman +Cc: Rafael J. Wysocki +Cc: Mel Gorman +Cc: Minchan Kim +Cc: KAMEZAWA Hiroyuki +Cc: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index 87acc47e8951..7b8368bc2000 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -682,6 +682,7 @@ static int register_node(struct node *node, int num) + */ + void unregister_node(struct node *node) + { ++ compaction_unregister_node(node); + hugetlb_unregister_node(node); /* no-op, if memoryless node */ + node_remove_accesses(node); + node_remove_caches(node); +-- +2.35.1 + diff --git a/queue-5.17/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch b/queue-5.17/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch new file mode 100644 index 00000000000..1ebc1f689de --- /dev/null +++ b/queue-5.17/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch @@ -0,0 +1,71 @@ +From 884199d771b527894a175cc87c0fbfcc3418ac2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 14:23:20 +0200 +Subject: Drivers: hv: vmbus: Fix handling of messages with transaction ID of + zero + +From: Andrea Parri (Microsoft) + +[ Upstream commit 82cd4bacff88a11e36f143e2cb950174b09c86c3 ] + +vmbus_request_addr() returns 0 (zero) if the transaction ID passed +to as argument is 0. This is unfortunate for two reasons: first, +netvsc_send_completion() does not check for a NULL cmd_rqst (before +dereferencing the corresponding NVSP message); second, 0 is a *valid* +value of cmd_rqst in netvsc_send_tx_complete(), cf. the call of +vmbus_sendpacket() in netvsc_send_pkt(). + +vmbus_request_addr() has included the code in question since its +introduction with commit e8b7db38449ac ("Drivers: hv: vmbus: Add +vmbus_requestor data structure for VMBus hardening"); such code was +motivated by the early use of vmbus_requestor by hv_storvsc. Since +hv_storvsc moved to a tag-based mechanism to generate and retrieve +transaction IDs with commit bf5fd8cae3c8f ("scsi: storvsc: Use +blk_mq_unique_tag() to generate requestIDs"), vmbus_request_addr() +can be modified to return VMBUS_RQST_ERROR if the ID is 0. This +change solves the issues in hv_netvsc (and makes the handling of +messages with transaction ID of 0 consistent with the semantics +"the ID is not contained in the requestor/invalid ID"). + +vmbus_next_request_id(), vmbus_request_addr() should still reserve +the ID of 0 for Hyper-V, because Hyper-V will "ignore" (not respond +to) VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED packets/requests with +transaction ID of 0 from the guest. + +Fixes: bf5fd8cae3c8f ("scsi: storvsc: Use blk_mq_unique_tag() to generate requestIDs") +Signed-off-by: Andrea Parri (Microsoft) +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20220419122325.10078-2-parri.andrea@gmail.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index dc5c35210c16..20fc8d50a039 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -1245,7 +1245,9 @@ u64 vmbus_next_request_id(struct vmbus_channel *channel, u64 rqst_addr) + + /* + * Cannot return an ID of 0, which is reserved for an unsolicited +- * message from Hyper-V. ++ * message from Hyper-V; Hyper-V does not acknowledge (respond to) ++ * VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED requests with ID of ++ * 0 sent by the guest. + */ + return current_id + 1; + } +@@ -1270,7 +1272,7 @@ u64 vmbus_request_addr(struct vmbus_channel *channel, u64 trans_id) + + /* Hyper-V can send an unsolicited message with ID of 0 */ + if (!trans_id) +- return trans_id; ++ return VMBUS_RQST_ERROR; + + spin_lock_irqsave(&rqstor->req_lock, flags); + +-- +2.35.1 + diff --git a/queue-5.17/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch b/queue-5.17/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch new file mode 100644 index 00000000000..0bb1abd56f9 --- /dev/null +++ b/queue-5.17/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch @@ -0,0 +1,85 @@ +From 59585b2da77241cb4ac36313e5d82883fddd8533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 12:01:20 +0530 +Subject: drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit + +From: Vignesh Raghavendra + +[ Upstream commit c7666240ec76422cb7546bd07cc8ae80dc0ccdd2 ] + +The ARASAN MMC controller on Keystone 3 class of devices need the SDCD +line to be connected for proper functioning. Similar to the issue pointed +out in sdhci-of-arasan.c driver, commit 3794c542641f ("mmc: +sdhci-of-arasan: Set controller to test mode when no CD bit"). + +In cases where this can't be connected, add a quirk to force the +controller into test mode and set the TESTCD bit. Use the flag +"ti,fails-without-test-cd", to implement this above quirk when required. + +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Aswath Govindraju +Link: https://lore.kernel.org/r/20220425063120.10135-3-a-govindraju@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_am654.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c +index b4891bb26648..a3e62e212631 100644 +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -147,6 +147,9 @@ struct sdhci_am654_data { + int drv_strength; + int strb_sel; + u32 flags; ++ u32 quirks; ++ ++#define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0) + }; + + struct sdhci_am654_driver_data { +@@ -369,6 +372,21 @@ static void sdhci_am654_write_b(struct sdhci_host *host, u8 val, int reg) + } + } + ++static void sdhci_am654_reset(struct sdhci_host *host, u8 mask) ++{ ++ u8 ctrl; ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); ++ ++ sdhci_reset(host, mask); ++ ++ if (sdhci_am654->quirks & SDHCI_AM654_QUIRK_FORCE_CDTEST) { ++ ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL); ++ ctrl |= SDHCI_CTRL_CDTEST_INS | SDHCI_CTRL_CDTEST_EN; ++ sdhci_writeb(host, ctrl, SDHCI_HOST_CONTROL); ++ } ++} ++ + static int sdhci_am654_execute_tuning(struct mmc_host *mmc, u32 opcode) + { + struct sdhci_host *host = mmc_priv(mmc); +@@ -500,7 +518,7 @@ static struct sdhci_ops sdhci_j721e_4bit_ops = { + .set_clock = sdhci_j721e_4bit_set_clock, + .write_b = sdhci_am654_write_b, + .irq = sdhci_am654_cqhci_irq, +- .reset = sdhci_reset, ++ .reset = sdhci_am654_reset, + }; + + static const struct sdhci_pltfm_data sdhci_j721e_4bit_pdata = { +@@ -719,6 +737,9 @@ static int sdhci_am654_get_of_property(struct platform_device *pdev, + device_property_read_u32(dev, "ti,clkbuf-sel", + &sdhci_am654->clkbuf_sel); + ++ if (device_property_read_bool(dev, "ti,fails-without-test-cd")) ++ sdhci_am654->quirks |= SDHCI_AM654_QUIRK_FORCE_CDTEST; ++ + sdhci_get_of_property(pdev); + + return 0; +-- +2.35.1 + diff --git a/queue-5.17/drm-amd-display-disabling-z10-on-dcn31.patch b/queue-5.17/drm-amd-display-disabling-z10-on-dcn31.patch new file mode 100644 index 00000000000..62844b5195f --- /dev/null +++ b/queue-5.17/drm-amd-display-disabling-z10-on-dcn31.patch @@ -0,0 +1,39 @@ +From f4d0faba86a55f77cfefa37c1eeecfc0b65388da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 14:25:16 -0400 +Subject: drm/amd/display: Disabling Z10 on DCN31 + +From: Saaem Rizvi + +[ Upstream commit 5d5af34072c8b11f60960c3bea57ff9de5877791 ] + +[WHY] +Z10 is should not be enabled by default on DCN31. + +[HOW] +Using DC debug flags to disable Z10 by default on DCN31. + +Reviewed-by: Eric Yang +Acked-by: Pavle Kotarac +Signed-off-by: Saaem Rizvi +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +index f3933c9f5746..6966b72eefc6 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +@@ -1030,6 +1030,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .afmt = true, + } + }, ++ .disable_z10 = true, + .optimize_edp_link_rate = true, + .enable_sw_cntl_psr = true, + .apply_vendor_specific_lttpr_wa = true, +-- +2.35.1 + diff --git a/queue-5.17/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch b/queue-5.17/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch new file mode 100644 index 00000000000..492d256685d --- /dev/null +++ b/queue-5.17/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch @@ -0,0 +1,70 @@ +From a8481abaac538ac785d5d2d5d12432119d26f077 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 10:37:19 +0000 +Subject: drm/amd/pm: fix double free in si_parse_power_table() + +From: Keita Suzuki + +[ Upstream commit f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd ] + +In function si_parse_power_table(), array adev->pm.dpm.ps and its member +is allocated. If the allocation of each member fails, the array itself +is freed and returned with an error code. However, the array is later +freed again in si_dpm_fini() function which is called when the function +returns an error. + +This leads to potential double free of the array adev->pm.dpm.ps, as +well as leak of its array members, since the members are not freed in +the allocation function and the array is not nulled when freed. +In addition adev->pm.dpm.num_ps, which keeps track of the allocated +array member, is not updated until the member allocation is +successfully finished, this could also lead to either use after free, +or uninitialized variable access in si_dpm_fini(). + +Fix this by postponing the free of the array until si_dpm_fini() and +increment adev->pm.dpm.num_ps everytime the array member is allocated. + +Signed-off-by: Keita Suzuki +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +index 81f82aa05ec2..66fc63f1f1c1 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +@@ -7247,17 +7247,15 @@ static int si_parse_power_table(struct amdgpu_device *adev) + if (!adev->pm.dpm.ps) + return -ENOMEM; + power_state_offset = (u8 *)state_array->states; +- for (i = 0; i < state_array->ucNumEntries; i++) { ++ for (adev->pm.dpm.num_ps = 0, i = 0; i < state_array->ucNumEntries; i++) { + u8 *idx; + power_state = (union pplib_power_state *)power_state_offset; + non_clock_array_index = power_state->v2.nonClockInfoIndex; + non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) + &non_clock_info_array->nonClockInfo[non_clock_array_index]; + ps = kzalloc(sizeof(struct si_ps), GFP_KERNEL); +- if (ps == NULL) { +- kfree(adev->pm.dpm.ps); ++ if (ps == NULL) + return -ENOMEM; +- } + adev->pm.dpm.ps[i].ps_priv = ps; + si_parse_pplib_non_clock_info(adev, &adev->pm.dpm.ps[i], + non_clock_info, +@@ -7279,8 +7277,8 @@ static int si_parse_power_table(struct amdgpu_device *adev) + k++; + } + power_state_offset += 2 + power_state->v2.ucNumDPMLevels; ++ adev->pm.dpm.num_ps++; + } +- adev->pm.dpm.num_ps = state_array->ucNumEntries; + + /* fill in the vce power states */ + for (i = 0; i < adev->pm.dpm.num_of_vce_states; i++) { +-- +2.35.1 + diff --git a/queue-5.17/drm-amd-pm-fix-the-compile-warning.patch b/queue-5.17/drm-amd-pm-fix-the-compile-warning.patch new file mode 100644 index 00000000000..49cddfeeab0 --- /dev/null +++ b/queue-5.17/drm-amd-pm-fix-the-compile-warning.patch @@ -0,0 +1,51 @@ +From 348aee02ff47528f86b24f81a019f1e8bc3d8d8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 10:16:46 +0800 +Subject: drm/amd/pm: fix the compile warning + +From: Evan Quan + +[ Upstream commit 555238d92ac32dbad2d77ad2bafc48d17391990c ] + +Fix the compile warning below: +drivers/gpu/drm/amd/amdgpu/../pm/legacy-dpm/kv_dpm.c:1641 +kv_get_acp_boot_level() warn: always true condition '(table->entries[i]->clk >= 0) => (0-u32max >= 0)' + +Reported-by: kernel test robot +CC: Alex Deucher +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c +index bcae42cef374..6ba4c2ae69a6 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c +@@ -1609,19 +1609,7 @@ static int kv_update_samu_dpm(struct amdgpu_device *adev, bool gate) + + static u8 kv_get_acp_boot_level(struct amdgpu_device *adev) + { +- u8 i; +- struct amdgpu_clock_voltage_dependency_table *table = +- &adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table; +- +- for (i = 0; i < table->count; i++) { +- if (table->entries[i].clk >= 0) /* XXX */ +- break; +- } +- +- if (i >= table->count) +- i = table->count - 1; +- +- return i; ++ return 0; + } + + static void kv_update_acp_boot_level(struct amdgpu_device *adev) +-- +2.35.1 + diff --git a/queue-5.17/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch b/queue-5.17/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch new file mode 100644 index 00000000000..b50d2ac8725 --- /dev/null +++ b/queue-5.17/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch @@ -0,0 +1,113 @@ +From f0071dbdc4858afeb9d2b4241c4cdee739464b5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:06:12 +0530 +Subject: drm/amd/pm: update smartshift powerboost calc for smu12 + +From: Sathishkumar S + +[ Upstream commit 138292f1dc00e7e0724f44769f9da39cf2f3bf0b ] + +smartshift apu and dgpu power boost are reported as percentage with +respect to their power limits. This value[0-100] reflects the boost +for the respective device. + +Signed-off-by: Sathishkumar S +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 60 ++++++++++++++----- + 1 file changed, 44 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +index 25c4b135f830..5e7c9e6d8125 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +@@ -1119,6 +1119,39 @@ static int renoir_get_power_profile_mode(struct smu_context *smu, + return size; + } + ++static void renoir_get_ss_power_percent(SmuMetrics_t *metrics, ++ uint32_t *apu_percent, uint32_t *dgpu_percent) ++{ ++ uint32_t apu_boost = 0; ++ uint32_t dgpu_boost = 0; ++ uint16_t apu_limit = 0; ++ uint16_t dgpu_limit = 0; ++ uint16_t apu_power = 0; ++ uint16_t dgpu_power = 0; ++ ++ apu_power = metrics->ApuPower; ++ apu_limit = metrics->StapmOriginalLimit; ++ if (apu_power > apu_limit && apu_limit != 0) ++ apu_boost = ((apu_power - apu_limit) * 100) / apu_limit; ++ apu_boost = (apu_boost > 100) ? 100 : apu_boost; ++ ++ dgpu_power = metrics->dGpuPower; ++ if (metrics->StapmCurrentLimit > metrics->StapmOriginalLimit) ++ dgpu_limit = metrics->StapmCurrentLimit - metrics->StapmOriginalLimit; ++ if (dgpu_power > dgpu_limit && dgpu_limit != 0) ++ dgpu_boost = ((dgpu_power - dgpu_limit) * 100) / dgpu_limit; ++ dgpu_boost = (dgpu_boost > 100) ? 100 : dgpu_boost; ++ ++ if (dgpu_boost >= apu_boost) ++ apu_boost = 0; ++ else ++ dgpu_boost = 0; ++ ++ *apu_percent = apu_boost; ++ *dgpu_percent = dgpu_boost; ++} ++ ++ + static int renoir_get_smu_metrics_data(struct smu_context *smu, + MetricsMember_t member, + uint32_t *value) +@@ -1127,6 +1160,9 @@ static int renoir_get_smu_metrics_data(struct smu_context *smu, + + SmuMetrics_t *metrics = (SmuMetrics_t *)smu_table->metrics_table; + int ret = 0; ++ uint32_t apu_percent = 0; ++ uint32_t dgpu_percent = 0; ++ + + mutex_lock(&smu->metrics_lock); + +@@ -1175,26 +1211,18 @@ static int renoir_get_smu_metrics_data(struct smu_context *smu, + *value = metrics->Voltage[1]; + break; + case METRICS_SS_APU_SHARE: +- /* return the percentage of APU power with respect to APU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of APU power boost ++ * with respect to APU's power limit. + */ +- if (metrics->StapmOriginalLimit > 0) +- *value = (metrics->ApuPower * 100) / metrics->StapmOriginalLimit; +- else +- *value = 0; ++ renoir_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = apu_percent; + break; + case METRICS_SS_DGPU_SHARE: +- /* return the percentage of dGPU power with respect to dGPU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of dGPU power boost ++ * with respect to dGPU's power limit. + */ +- if ((metrics->dGpuPower > 0) && +- (metrics->StapmCurrentLimit > metrics->StapmOriginalLimit)) +- *value = (metrics->dGpuPower * 100) / +- (metrics->StapmCurrentLimit - metrics->StapmOriginalLimit); +- else +- *value = 0; ++ renoir_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = dgpu_percent; + break; + default: + *value = UINT_MAX; +-- +2.35.1 + diff --git a/queue-5.17/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-26249 b/queue-5.17/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-26249 new file mode 100644 index 00000000000..e8874c8fbed --- /dev/null +++ b/queue-5.17/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-26249 @@ -0,0 +1,115 @@ +From 7c63bdd033a072bb50aa258a75160bacebae70bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:35:59 +0530 +Subject: drm/amd/pm: update smartshift powerboost calc for smu13 + +From: Sathishkumar S + +[ Upstream commit cdf4c8ec39872a61a58d62f19b4db80f0f7bc586 ] + +smartshift apu and dgpu power boost are reported as percentage +with respect to their power limits. adjust the units of power before +calculating the percentage of boost. + +Signed-off-by: Sathishkumar S +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 62 ++++++++++++++----- + 1 file changed, 46 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +index 0bc84b709a93..d0715927b07f 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +@@ -296,6 +296,42 @@ static int yellow_carp_mode2_reset(struct smu_context *smu) + return yellow_carp_mode_reset(smu, SMU_RESET_MODE_2); + } + ++ ++static void yellow_carp_get_ss_power_percent(SmuMetrics_t *metrics, ++ uint32_t *apu_percent, uint32_t *dgpu_percent) ++{ ++ uint32_t apu_boost = 0; ++ uint32_t dgpu_boost = 0; ++ uint16_t apu_limit = 0; ++ uint16_t dgpu_limit = 0; ++ uint16_t apu_power = 0; ++ uint16_t dgpu_power = 0; ++ ++ /* APU and dGPU power values are reported in milli Watts ++ * and STAPM power limits are in Watts */ ++ apu_power = metrics->ApuPower/1000; ++ apu_limit = metrics->StapmOpnLimit; ++ if (apu_power > apu_limit && apu_limit != 0) ++ apu_boost = ((apu_power - apu_limit) * 100) / apu_limit; ++ apu_boost = (apu_boost > 100) ? 100 : apu_boost; ++ ++ dgpu_power = metrics->dGpuPower/1000; ++ if (metrics->StapmCurrentLimit > metrics->StapmOpnLimit) ++ dgpu_limit = metrics->StapmCurrentLimit - metrics->StapmOpnLimit; ++ if (dgpu_power > dgpu_limit && dgpu_limit != 0) ++ dgpu_boost = ((dgpu_power - dgpu_limit) * 100) / dgpu_limit; ++ dgpu_boost = (dgpu_boost > 100) ? 100 : dgpu_boost; ++ ++ if (dgpu_boost >= apu_boost) ++ apu_boost = 0; ++ else ++ dgpu_boost = 0; ++ ++ *apu_percent = apu_boost; ++ *dgpu_percent = dgpu_boost; ++ ++} ++ + static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + MetricsMember_t member, + uint32_t *value) +@@ -304,6 +340,8 @@ static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + + SmuMetrics_t *metrics = (SmuMetrics_t *)smu_table->metrics_table; + int ret = 0; ++ uint32_t apu_percent = 0; ++ uint32_t dgpu_percent = 0; + + mutex_lock(&smu->metrics_lock); + +@@ -356,26 +394,18 @@ static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + *value = metrics->Voltage[1]; + break; + case METRICS_SS_APU_SHARE: +- /* return the percentage of APU power with respect to APU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of APU power boost ++ * with respect to APU's power limit. + */ +- if (metrics->StapmOpnLimit > 0) +- *value = (metrics->ApuPower * 100) / metrics->StapmOpnLimit; +- else +- *value = 0; ++ yellow_carp_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = apu_percent; + break; + case METRICS_SS_DGPU_SHARE: +- /* return the percentage of dGPU power with respect to dGPU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of dGPU power boost ++ * with respect to dGPU's power limit. + */ +- if ((metrics->dGpuPower > 0) && +- (metrics->StapmCurrentLimit > metrics->StapmOpnLimit)) +- *value = (metrics->dGpuPower * 100) / +- (metrics->StapmCurrentLimit - metrics->StapmOpnLimit); +- else +- *value = 0; ++ yellow_carp_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = dgpu_percent; + break; + default: + *value = UINT_MAX; +-- +2.35.1 + diff --git a/queue-5.17/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch b/queue-5.17/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch new file mode 100644 index 00000000000..4805aa9617a --- /dev/null +++ b/queue-5.17/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch @@ -0,0 +1,158 @@ +From 194c3477102a322364f94df63c9ed0f7dad84c98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 01:21:52 -0400 +Subject: drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init + +From: Alex Deucher + +[ Upstream commit b95b5391684b39695887afb4a13cccee7820f5d6 ] + +Memory allocations should be done in sw_init. hw_init should +just be hardware programming needed to initialize the IP block. +This is how most other IP blocks work. Move the GPU memory +allocations from psp hw_init to psp sw_init and move the memory +free to sw_fini. This also fixes a potential GPU memory leak +if psp hw_init fails. + +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 95 ++++++++++++------------- + 1 file changed, 47 insertions(+), 48 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index dee17a0e1187..786518f7e37b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -331,7 +331,39 @@ static int psp_sw_init(void *handle) + } + } + ++ ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, ++ amdgpu_sriov_vf(adev) ? ++ AMDGPU_GEM_DOMAIN_VRAM : AMDGPU_GEM_DOMAIN_GTT, ++ &psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, ++ &psp->fw_pri_buf); ++ if (ret) ++ return ret; ++ ++ ret = amdgpu_bo_create_kernel(adev, PSP_FENCE_BUFFER_SIZE, PAGE_SIZE, ++ AMDGPU_GEM_DOMAIN_VRAM, ++ &psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, ++ &psp->fence_buf); ++ if (ret) ++ goto failed1; ++ ++ ret = amdgpu_bo_create_kernel(adev, PSP_CMD_BUFFER_SIZE, PAGE_SIZE, ++ AMDGPU_GEM_DOMAIN_VRAM, ++ &psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, ++ (void **)&psp->cmd_buf_mem); ++ if (ret) ++ goto failed2; ++ + return 0; ++ ++failed2: ++ amdgpu_bo_free_kernel(&psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, &psp->fw_pri_buf); ++failed1: ++ amdgpu_bo_free_kernel(&psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, &psp->fence_buf); ++ return ret; + } + + static int psp_sw_fini(void *handle) +@@ -361,6 +393,13 @@ static int psp_sw_fini(void *handle) + kfree(cmd); + cmd = NULL; + ++ amdgpu_bo_free_kernel(&psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, &psp->fw_pri_buf); ++ amdgpu_bo_free_kernel(&psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, &psp->fence_buf); ++ amdgpu_bo_free_kernel(&psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, ++ (void **)&psp->cmd_buf_mem); ++ + return 0; + } + +@@ -2391,51 +2430,18 @@ static int psp_load_fw(struct amdgpu_device *adev) + struct psp_context *psp = &adev->psp; + + if (amdgpu_sriov_vf(adev) && amdgpu_in_reset(adev)) { +- psp_ring_stop(psp, PSP_RING_TYPE__KM); /* should not destroy ring, only stop */ +- goto skip_memalloc; +- } +- +- if (amdgpu_sriov_vf(adev)) { +- ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, +- &psp->fw_pri_buf); ++ /* should not destroy ring, only stop */ ++ psp_ring_stop(psp, PSP_RING_TYPE__KM); + } else { +- ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, +- AMDGPU_GEM_DOMAIN_GTT, +- &psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, +- &psp->fw_pri_buf); +- } +- +- if (ret) +- goto failed; +- +- ret = amdgpu_bo_create_kernel(adev, PSP_FENCE_BUFFER_SIZE, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->fence_buf_bo, +- &psp->fence_buf_mc_addr, +- &psp->fence_buf); +- if (ret) +- goto failed; +- +- ret = amdgpu_bo_create_kernel(adev, PSP_CMD_BUFFER_SIZE, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, +- (void **)&psp->cmd_buf_mem); +- if (ret) +- goto failed; ++ memset(psp->fence_buf, 0, PSP_FENCE_BUFFER_SIZE); + +- memset(psp->fence_buf, 0, PSP_FENCE_BUFFER_SIZE); +- +- ret = psp_ring_init(psp, PSP_RING_TYPE__KM); +- if (ret) { +- DRM_ERROR("PSP ring init failed!\n"); +- goto failed; ++ ret = psp_ring_init(psp, PSP_RING_TYPE__KM); ++ if (ret) { ++ DRM_ERROR("PSP ring init failed!\n"); ++ goto failed; ++ } + } + +-skip_memalloc: + ret = psp_hw_start(psp); + if (ret) + goto failed; +@@ -2553,13 +2559,6 @@ static int psp_hw_fini(void *handle) + psp_tmr_terminate(psp); + psp_ring_destroy(psp, PSP_RING_TYPE__KM); + +- amdgpu_bo_free_kernel(&psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, &psp->fw_pri_buf); +- amdgpu_bo_free_kernel(&psp->fence_buf_bo, +- &psp->fence_buf_mc_addr, &psp->fence_buf); +- amdgpu_bo_free_kernel(&psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, +- (void **)&psp->cmd_buf_mem); +- + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.17/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch b/queue-5.17/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch new file mode 100644 index 00000000000..96571a19166 --- /dev/null +++ b/queue-5.17/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch @@ -0,0 +1,103 @@ +From 32c97f7f185460364d2f5f415feb0f4e279a9b29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 20:41:38 +0800 +Subject: drm/amdgpu/sdma: Fix incorrect calculations of the wptr of the + doorbells +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Haohui Mai + +[ Upstream commit 7dba6e838e741caadcf27ef717b6dcb561e77f89 ] + +This patch fixes the issue where the driver miscomputes the 64-bit +values of the wptr of the SDMA doorbell when initializing the +hardware. SDMA engines v4 and later on have full 64-bit registers for +wptr thus they should be set properly. + +Older generation hardwares like CIK / SI have only 16 / 20 / 24bits +for the WPTR, where the calls of lower_32_bits() will be removed in a +following patch. + +Reviewed-by: Christian König +Signed-off-by: Haohui Mai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 ++-- + drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 8 ++++---- + drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 8 ++++---- + 3 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +index f0638db57111..66b6b175ae90 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -772,8 +772,8 @@ static void sdma_v4_0_ring_set_wptr(struct amdgpu_ring *ring) + + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +index 81e033549dda..6982735e88ba 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +@@ -400,8 +400,8 @@ static void sdma_v5_0_ring_set_wptr(struct amdgpu_ring *ring) + if (ring->use_doorbell) { + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +@@ -780,9 +780,9 @@ static int sdma_v5_0_gfx_resume(struct amdgpu_device *adev) + + if (!amdgpu_sriov_vf(adev)) { /* only bare-metal use register write for wptr */ + WREG32(sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), +- lower_32_bits(ring->wptr) << 2); ++ lower_32_bits(ring->wptr << 2)); + WREG32(sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), +- upper_32_bits(ring->wptr) << 2); ++ upper_32_bits(ring->wptr << 2)); + } + + doorbell = RREG32_SOC15_IP(GC, sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_DOORBELL)); +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +index d3d6d5b045b8..ce3a3d1bdaa8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +@@ -287,8 +287,8 @@ static void sdma_v5_2_ring_set_wptr(struct amdgpu_ring *ring) + if (ring->use_doorbell) { + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +@@ -664,8 +664,8 @@ static int sdma_v5_2_gfx_resume(struct amdgpu_device *adev) + WREG32_SOC15_IP(GC, sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_MINOR_PTR_UPDATE), 1); + + if (!amdgpu_sriov_vf(adev)) { /* only bare-metal use register write for wptr */ +- WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), lower_32_bits(ring->wptr) << 2); +- WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), upper_32_bits(ring->wptr) << 2); ++ WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), lower_32_bits(ring->wptr << 2)); ++ WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), upper_32_bits(ring->wptr << 2)); + } + + doorbell = RREG32_SOC15_IP(GC, sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_DOORBELL)); +-- +2.35.1 + diff --git a/queue-5.17/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch b/queue-5.17/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch new file mode 100644 index 00000000000..6f93b966a57 --- /dev/null +++ b/queue-5.17/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch @@ -0,0 +1,40 @@ +From 8446c33d18c49291e0d2766078021a5ebb2d21d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 11:40:18 -0400 +Subject: drm/amdgpu/ucode: Remove firmware load type check in + amdgpu_ucode_free_bo + +From: Alice Wong + +[ Upstream commit ab0cd4a9ae5b4679b714d8dbfedc0901fecdce9f ] + +When psp_hw_init failed, it will set the load_type to AMDGPU_FW_LOAD_DIRECT. +During amdgpu_device_ip_fini, amdgpu_ucode_free_bo checks that load_type is +AMDGPU_FW_LOAD_DIRECT and skips deallocating fw_buf causing memory leak. +Remove load_type check in amdgpu_ucode_free_bo. + +Signed-off-by: Alice Wong +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +index ca3350502618..aebafbc327fb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -714,8 +714,7 @@ int amdgpu_ucode_create_bo(struct amdgpu_device *adev) + + void amdgpu_ucode_free_bo(struct amdgpu_device *adev) + { +- if (adev->firmware.load_type != AMDGPU_FW_LOAD_DIRECT) +- amdgpu_bo_free_kernel(&adev->firmware.fw_buf, ++ amdgpu_bo_free_kernel(&adev->firmware.fw_buf, + &adev->firmware.fw_buf_mc, + &adev->firmware.fw_buf_ptr); + } +-- +2.35.1 + diff --git a/queue-5.17/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch b/queue-5.17/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch new file mode 100644 index 00000000000..356e975a78c --- /dev/null +++ b/queue-5.17/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch @@ -0,0 +1,37 @@ +From 7892947f8e4b497447385aad7def232d3dee6922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 11:47:05 +0100 +Subject: drm/bridge: adv7511: clean up CEC adapter when probe fails + +From: Lucas Stach + +[ Upstream commit 7ed2b0dabf7a22874cb30f8878df239ef638eb53 ] + +When the probe routine fails we also need to clean up the +CEC adapter registered in adv7511_cec_init(). + +Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support") +Signed-off-by: Lucas Stach +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220321104705.2804423-1-l.stach@pengutronix.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 77118c3395bf..320cbd5d90b8 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1313,6 +1313,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + adv7511_audio_exit(adv7511); + drm_bridge_remove(&adv7511->bridge); + err_unregister_cec: ++ cec_unregister_adapter(adv7511->cec_adap); + i2c_unregister_device(adv7511->i2c_cec); + clk_disable_unprepare(adv7511->cec_clk); + err_i2c_unregister_packet: +-- +2.35.1 + diff --git a/queue-5.17/drm-bridge-anx7625-use-uint8-for-lane-swing-arrays.patch b/queue-5.17/drm-bridge-anx7625-use-uint8-for-lane-swing-arrays.patch new file mode 100644 index 00000000000..5e5052cee5b --- /dev/null +++ b/queue-5.17/drm-bridge-anx7625-use-uint8-for-lane-swing-arrays.patch @@ -0,0 +1,93 @@ +From a9b0ad06eb60b3bd24a1e03f2ece5ce47c9f34b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:30:34 -0400 +Subject: drm/bridge: anx7625: Use uint8 for lane-swing arrays +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit fb8da7f3111ab500606960bef1bb32450c664750 ] + +As defined in the anx7625 dt-binding, the analogix,lane0-swing and +analogix,lane1-swing properties are uint8 arrays. Yet, the driver was +reading the array as if it were of uint32 and masking to 8-bit before +writing to the registers. This means that a devicetree written in +accordance to the dt-binding would have its values incorrectly parsed. + +Fix the issue by reading the array as uint8 and storing them as uint8 +internally, so that we can also drop the masking when writing the +registers. + +Fixes: fd0310b6fe7d ("drm/bridge: anx7625: add MIPI DPI input feature") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220408013034.673418-1-nfraprado@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 12 ++++++------ + drivers/gpu/drm/bridge/analogix/anx7625.h | 4 ++-- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index e596cacce9e3..ce04b17c0d3a 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -1201,12 +1201,12 @@ static void anx7625_dp_adjust_swing(struct anx7625_data *ctx) + for (i = 0; i < ctx->pdata.dp_lane0_swing_reg_cnt; i++) + anx7625_reg_write(ctx, ctx->i2c.tx_p1_client, + DP_TX_LANE0_SWING_REG0 + i, +- ctx->pdata.lane0_reg_data[i] & 0xFF); ++ ctx->pdata.lane0_reg_data[i]); + + for (i = 0; i < ctx->pdata.dp_lane1_swing_reg_cnt; i++) + anx7625_reg_write(ctx, ctx->i2c.tx_p1_client, + DP_TX_LANE1_SWING_REG0 + i, +- ctx->pdata.lane1_reg_data[i] & 0xFF); ++ ctx->pdata.lane1_reg_data[i]); + } + + static void dp_hpd_change_handler(struct anx7625_data *ctx, bool on) +@@ -1313,8 +1313,8 @@ static int anx7625_get_swing_setting(struct device *dev, + num_regs = DP_TX_SWING_REG_CNT; + + pdata->dp_lane0_swing_reg_cnt = num_regs; +- of_property_read_u32_array(dev->of_node, "analogix,lane0-swing", +- pdata->lane0_reg_data, num_regs); ++ of_property_read_u8_array(dev->of_node, "analogix,lane0-swing", ++ pdata->lane0_reg_data, num_regs); + } + + if (of_get_property(dev->of_node, +@@ -1323,8 +1323,8 @@ static int anx7625_get_swing_setting(struct device *dev, + num_regs = DP_TX_SWING_REG_CNT; + + pdata->dp_lane1_swing_reg_cnt = num_regs; +- of_property_read_u32_array(dev->of_node, "analogix,lane1-swing", +- pdata->lane1_reg_data, num_regs); ++ of_property_read_u8_array(dev->of_node, "analogix,lane1-swing", ++ pdata->lane1_reg_data, num_regs); + } + + return 0; +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.h b/drivers/gpu/drm/bridge/analogix/anx7625.h +index 3d79b6fb13c8..8759d9441f4e 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.h ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.h +@@ -370,9 +370,9 @@ struct anx7625_platform_data { + int mipi_lanes; + int audio_en; + int dp_lane0_swing_reg_cnt; +- int lane0_reg_data[DP_TX_SWING_REG_CNT]; ++ u8 lane0_reg_data[DP_TX_SWING_REG_CNT]; + int dp_lane1_swing_reg_cnt; +- int lane1_reg_data[DP_TX_SWING_REG_CNT]; ++ u8 lane1_reg_data[DP_TX_SWING_REG_CNT]; + u32 low_power_mode; + struct device_node *mipi_host_node; + }; +-- +2.35.1 + diff --git a/queue-5.17/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch b/queue-5.17/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch new file mode 100644 index 00000000000..db91a0b6c60 --- /dev/null +++ b/queue-5.17/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch @@ -0,0 +1,80 @@ +From f4734ad16f77c30aa8f05ce205f837701e60a92d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 01:16:40 +0000 +Subject: drm/bridge: Fix error handling in analogix_dp_probe + +From: Miaoqian Lin + +[ Upstream commit 9f15930bb2ef9f031d62ffc49629cbae89137733 ] + +In the error handling path, the clk_prepare_enable() function +call should be balanced by a corresponding 'clk_disable_unprepare()' +call, as already done in the remove function. + +Fixes: 3424e3a4f844 ("drm: bridge: analogix/dp: split exynos dp driver to bridge directory") +Signed-off-by: Miaoqian Lin +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220420011644.25730-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + .../gpu/drm/bridge/analogix/analogix_dp_core.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +index b7d2e4449cfa..7fe19c56f792 100644 +--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c ++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +@@ -1698,8 +1698,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + + dp->reg_base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(dp->reg_base)) +- return ERR_CAST(dp->reg_base); ++ if (IS_ERR(dp->reg_base)) { ++ ret = PTR_ERR(dp->reg_base); ++ goto err_disable_clk; ++ } + + dp->force_hpd = of_property_read_bool(dev->of_node, "force-hpd"); + +@@ -1711,7 +1713,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + if (IS_ERR(dp->hpd_gpiod)) { + dev_err(dev, "error getting HDP GPIO: %ld\n", + PTR_ERR(dp->hpd_gpiod)); +- return ERR_CAST(dp->hpd_gpiod); ++ ret = PTR_ERR(dp->hpd_gpiod); ++ goto err_disable_clk; + } + + if (dp->hpd_gpiod) { +@@ -1731,7 +1734,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + + if (dp->irq == -ENXIO) { + dev_err(&pdev->dev, "failed to get irq\n"); +- return ERR_PTR(-ENODEV); ++ ret = -ENODEV; ++ goto err_disable_clk; + } + + ret = devm_request_threaded_irq(&pdev->dev, dp->irq, +@@ -1740,11 +1744,15 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + irq_flags, "analogix-dp", dp); + if (ret) { + dev_err(&pdev->dev, "failed to request irq\n"); +- return ERR_PTR(ret); ++ goto err_disable_clk; + } + disable_irq(dp->irq); + + return dp; ++ ++err_disable_clk: ++ clk_disable_unprepare(dp->clock); ++ return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(analogix_dp_probe); + +-- +2.35.1 + diff --git a/queue-5.17/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch b/queue-5.17/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch new file mode 100644 index 00000000000..0ce59af712c --- /dev/null +++ b/queue-5.17/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch @@ -0,0 +1,94 @@ +From 0ed3b2faf17c824088094be6d543cff48f9515b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 17:05:00 +0200 +Subject: drm: bridge: icn6211: Fix HFP_HSW_HBP_HI and HFP_MIN handling + +From: Marek Vasut + +[ Upstream commit c0ff7a649d62105a9308cc3ac36e52a4669d9cb4 ] + +The HFP_HSW_HBP_HI register must be programmed with 2 LSbits of each +Horizontal Front Porch/Sync/Back Porch. Currently the driver programs +this register to 0, which breaks displays with either value above 255. + +The HFP_MIN register must be set to the same value as HFP_LI, otherwise +there is visible image distortion, usually in the form of missing lines +at the bottom of the panel. + +Fix this by correctly programming the HFP_HSW_HBP_HI and HFP_MIN registers. + +Acked-by: Maxime Ripard +Fixes: ce517f18944e3 ("drm: bridge: Add Chipone ICN6211 MIPI-DSI to RGB bridge") +Signed-off-by: Marek Vasut +Cc: Jagan Teki +Cc: Maxime Ripard +Cc: Robert Foss +Cc: Sam Ravnborg +Cc: Thomas Zimmermann +To: dri-devel@lists.freedesktop.org +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220331150509.9838-3-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/chipone-icn6211.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/chipone-icn6211.c b/drivers/gpu/drm/bridge/chipone-icn6211.c +index eb26615b2993..d7eedf35e841 100644 +--- a/drivers/gpu/drm/bridge/chipone-icn6211.c ++++ b/drivers/gpu/drm/bridge/chipone-icn6211.c +@@ -34,6 +34,9 @@ + #define HSYNC_LI 0x24 + #define HBP_LI 0x25 + #define HFP_HSW_HBP_HI 0x26 ++#define HFP_HSW_HBP_HI_HFP(n) (((n) & 0x300) >> 4) ++#define HFP_HSW_HBP_HI_HS(n) (((n) & 0x300) >> 6) ++#define HFP_HSW_HBP_HI_HBP(n) (((n) & 0x300) >> 8) + #define VFP 0x27 + #define VSYNC 0x28 + #define VBP 0x29 +@@ -165,6 +168,7 @@ static void chipone_enable(struct drm_bridge *bridge) + { + struct chipone *icn = bridge_to_chipone(bridge); + struct drm_display_mode *mode = bridge_to_mode(bridge); ++ u16 hfp, hbp, hsync; + + ICN6211_DSI(icn, MIPI_CFG_PW, MIPI_CFG_PW_CONFIG_DSI); + +@@ -180,13 +184,18 @@ static void chipone_enable(struct drm_bridge *bridge) + ((mode->hdisplay >> 8) & 0xf) | + (((mode->vdisplay >> 8) & 0xf) << 4)); + +- ICN6211_DSI(icn, HFP_LI, mode->hsync_start - mode->hdisplay); ++ hfp = mode->hsync_start - mode->hdisplay; ++ hsync = mode->hsync_end - mode->hsync_start; ++ hbp = mode->htotal - mode->hsync_end; + +- ICN6211_DSI(icn, HSYNC_LI, mode->hsync_end - mode->hsync_start); +- +- ICN6211_DSI(icn, HBP_LI, mode->htotal - mode->hsync_end); +- +- ICN6211_DSI(icn, HFP_HSW_HBP_HI, 0x00); ++ ICN6211_DSI(icn, HFP_LI, hfp & 0xff); ++ ICN6211_DSI(icn, HSYNC_LI, hsync & 0xff); ++ ICN6211_DSI(icn, HBP_LI, hbp & 0xff); ++ /* Top two bits of Horizontal Front porch/Sync/Back porch */ ++ ICN6211_DSI(icn, HFP_HSW_HBP_HI, ++ HFP_HSW_HBP_HI_HFP(hfp) | ++ HFP_HSW_HBP_HI_HS(hsync) | ++ HFP_HSW_HBP_HI_HBP(hbp)); + + ICN6211_DSI(icn, VFP, mode->vsync_start - mode->vdisplay); + +@@ -196,7 +205,7 @@ static void chipone_enable(struct drm_bridge *bridge) + + /* dsi specific sequence */ + ICN6211_DSI(icn, SYNC_EVENT_DLY, 0x80); +- ICN6211_DSI(icn, HFP_MIN, 0x28); ++ ICN6211_DSI(icn, HFP_MIN, hfp & 0xff); + ICN6211_DSI(icn, MIPI_PD_CK_LANE, 0xa0); + ICN6211_DSI(icn, PLL_CTRL(12), 0xff); + ICN6211_DSI(icn, BIST_POL, BIST_POL_DE_POL); +-- +2.35.1 + diff --git a/queue-5.17/drm-bridge-icn6211-fix-register-layout.patch b/queue-5.17/drm-bridge-icn6211-fix-register-layout.patch new file mode 100644 index 00000000000..8586ce88f85 --- /dev/null +++ b/queue-5.17/drm-bridge-icn6211-fix-register-layout.patch @@ -0,0 +1,212 @@ +From 749740cfbdf3b590ee1ee046c0d4479f46607dc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 17:04:59 +0200 +Subject: drm: bridge: icn6211: Fix register layout + +From: Marek Vasut + +[ Upstream commit 2dcec57b3734029cc1adc5cb872f61e21609eed4 ] + +The chip register layout has nothing to do with MIPI DCS, the registers +incorrectly marked as MIPI DCS in the driver are regular chip registers +often with completely different function. + +Fill in the actual register names and bits from [1] and [2] and add the +entire register layout, since the documentation for this chip is hard to +come by. + +[1] https://github.com/rockchip-linux/kernel/blob/develop-4.19/drivers/gpu/drm/bridge/icn6211.c +[2] https://github.com/tdjastrzebski/ICN6211-Configurator + +Acked-by: Maxime Ripard +Fixes: ce517f18944e3 ("drm: bridge: Add Chipone ICN6211 MIPI-DSI to RGB bridge") +Signed-off-by: Marek Vasut +Cc: Jagan Teki +Cc: Maxime Ripard +Cc: Robert Foss +Cc: Sam Ravnborg +Cc: Thomas Zimmermann +To: dri-devel@lists.freedesktop.org +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220331150509.9838-2-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/chipone-icn6211.c | 134 ++++++++++++++++++++--- + 1 file changed, 117 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/chipone-icn6211.c b/drivers/gpu/drm/bridge/chipone-icn6211.c +index a6151db95586..eb26615b2993 100644 +--- a/drivers/gpu/drm/bridge/chipone-icn6211.c ++++ b/drivers/gpu/drm/bridge/chipone-icn6211.c +@@ -14,8 +14,19 @@ + #include + #include + +-#include