From: Sasha Levin Date: Tue, 24 Jan 2023 11:22:00 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v5.10.166~96 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6b7fcc98fc13c1c077ad6542887dc718dacd53f9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/affs-initialize-fsdata-in-affs_truncate.patch b/queue-5.4/affs-initialize-fsdata-in-affs_truncate.patch new file mode 100644 index 00000000000..068b9325d33 --- /dev/null +++ b/queue-5.4/affs-initialize-fsdata-in-affs_truncate.patch @@ -0,0 +1,40 @@ +From 1b4b70fcd78a56b2ccaaf462c70f2496472be01b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 13:49:30 +0100 +Subject: affs: initialize fsdata in affs_truncate() + +From: Alexander Potapenko + +[ Upstream commit eef034ac6690118c88f357b00e2b3239c9d8575d ] + +When aops->write_begin() does not initialize fsdata, KMSAN may report +an error passing the latter to aops->write_end(). + +Fix this by unconditionally initializing fsdata. + +Fixes: f2b6a16eb8f5 ("fs: affs convert to new aops") +Suggested-by: Eric Biggers +Signed-off-by: Alexander Potapenko +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/affs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/affs/file.c b/fs/affs/file.c +index ba084b0b214b..82bb38370aa9 100644 +--- a/fs/affs/file.c ++++ b/fs/affs/file.c +@@ -878,7 +878,7 @@ affs_truncate(struct inode *inode) + if (inode->i_size > AFFS_I(inode)->mmu_private) { + struct address_space *mapping = inode->i_mapping; + struct page *page; +- void *fsdata; ++ void *fsdata = NULL; + loff_t isize = inode->i_size; + int res; + +-- +2.39.0 + diff --git a/queue-5.4/amd-xgbe-delay-an-timeout-during-kr-training.patch b/queue-5.4/amd-xgbe-delay-an-timeout-during-kr-training.patch new file mode 100644 index 00000000000..02b1591ba01 --- /dev/null +++ b/queue-5.4/amd-xgbe-delay-an-timeout-during-kr-training.patch @@ -0,0 +1,100 @@ +From c5b89f5f3dd52924e5cf9027d2a9da526fba8c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:58:52 +0530 +Subject: amd-xgbe: Delay AN timeout during KR training + +From: Raju Rangoju + +[ Upstream commit 926446ae24c03311a480fb96eb78f0ce7ea6d091 ] + +AN restart triggered during KR training not only aborts the KR training +process but also move the HW to unstable state. Driver has to wait upto +500ms or until the KR training is completed before restarting AN cycle. + +Fixes: 7c12aa08779c ("amd-xgbe: Move the PHY support into amd-xgbe") +Co-developed-by: Sudheesh Mavila +Signed-off-by: Sudheesh Mavila +Signed-off-by: Raju Rangoju +Acked-by: Shyam Sundar S K +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 24 +++++++++++++++++++++++ + drivers/net/ethernet/amd/xgbe/xgbe.h | 2 ++ + 2 files changed, 26 insertions(+) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 97167fc9bebe..7840eb4cdb8d 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -496,6 +496,7 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata, + reg |= XGBE_KR_TRAINING_ENABLE; + reg |= XGBE_KR_TRAINING_START; + XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL, reg); ++ pdata->kr_start_time = jiffies; + + netif_dbg(pdata, link, pdata->netdev, + "KR training initiated\n"); +@@ -632,6 +633,8 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata) + + xgbe_switch_mode(pdata); + ++ pdata->an_result = XGBE_AN_READY; ++ + xgbe_an_restart(pdata); + + return XGBE_AN_INCOMPAT_LINK; +@@ -1275,9 +1278,30 @@ static bool xgbe_phy_aneg_done(struct xgbe_prv_data *pdata) + static void xgbe_check_link_timeout(struct xgbe_prv_data *pdata) + { + unsigned long link_timeout; ++ unsigned long kr_time; ++ int wait; + + link_timeout = pdata->link_check + (XGBE_LINK_TIMEOUT * HZ); + if (time_after(jiffies, link_timeout)) { ++ if ((xgbe_cur_mode(pdata) == XGBE_MODE_KR) && ++ pdata->phy.autoneg == AUTONEG_ENABLE) { ++ /* AN restart should not happen while KR training is in progress. ++ * The while loop ensures no AN restart during KR training, ++ * waits up to 500ms and AN restart is triggered only if KR ++ * training is failed. ++ */ ++ wait = XGBE_KR_TRAINING_WAIT_ITER; ++ while (wait--) { ++ kr_time = pdata->kr_start_time + ++ msecs_to_jiffies(XGBE_AN_MS_TIMEOUT); ++ if (time_after(jiffies, kr_time)) ++ break; ++ /* AN restart is not required, if AN result is COMPLETE */ ++ if (pdata->an_result == XGBE_AN_COMPLETE) ++ return; ++ usleep_range(10000, 11000); ++ } ++ } + netif_dbg(pdata, link, pdata->netdev, "AN link timeout\n"); + xgbe_phy_config_aneg(pdata); + } +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h +index 0c93a552b921..729307a96c50 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h +@@ -290,6 +290,7 @@ + /* Auto-negotiation */ + #define XGBE_AN_MS_TIMEOUT 500 + #define XGBE_LINK_TIMEOUT 5 ++#define XGBE_KR_TRAINING_WAIT_ITER 50 + + #define XGBE_SGMII_AN_LINK_STATUS BIT(1) + #define XGBE_SGMII_AN_LINK_SPEED (BIT(2) | BIT(3)) +@@ -1266,6 +1267,7 @@ struct xgbe_prv_data { + unsigned int parallel_detect; + unsigned int fec_ability; + unsigned long an_start; ++ unsigned long kr_start_time; + enum xgbe_an_mode an_mode; + + /* I2C support */ +-- +2.39.0 + diff --git a/queue-5.4/amd-xgbe-tx-flow-ctrl-registers-are-h-w-ver-dependen.patch b/queue-5.4/amd-xgbe-tx-flow-ctrl-registers-are-h-w-ver-dependen.patch new file mode 100644 index 00000000000..51f742b92d2 --- /dev/null +++ b/queue-5.4/amd-xgbe-tx-flow-ctrl-registers-are-h-w-ver-dependen.patch @@ -0,0 +1,89 @@ +From 98c93b7ae3aedd096f57d5af741ced9086dd8545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:58:51 +0530 +Subject: amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent + +From: Raju Rangoju + +[ Upstream commit 579923d84b04abb6cd4cd1fd9974096a2dd1832b ] + +There is difference in the TX Flow Control registers (TFCR) between the +revisions of the hardware. The older revisions of hardware used to have +single register per queue. Whereas, the newer revision of hardware (from +ver 30H onwards) have one register per priority. + +Update the driver to use the TFCR based on the reported version of the +hardware. + +Fixes: c5aa9e3b8156 ("amd-xgbe: Initial AMD 10GbE platform driver") +Co-developed-by: Ajith Nayak +Signed-off-by: Ajith Nayak +Signed-off-by: Raju Rangoju +Acked-by: Shyam Sundar S K +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c +index d5fd49dd25f3..decc1c09a031 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c +@@ -524,19 +524,28 @@ static void xgbe_disable_vxlan(struct xgbe_prv_data *pdata) + netif_dbg(pdata, drv, pdata->netdev, "VXLAN acceleration disabled\n"); + } + ++static unsigned int xgbe_get_fc_queue_count(struct xgbe_prv_data *pdata) ++{ ++ unsigned int max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES; ++ ++ /* From MAC ver 30H the TFCR is per priority, instead of per queue */ ++ if (XGMAC_GET_BITS(pdata->hw_feat.version, MAC_VR, SNPSVER) >= 0x30) ++ return max_q_count; ++ else ++ return min_t(unsigned int, pdata->tx_q_count, max_q_count); ++} ++ + static int xgbe_disable_tx_flow_control(struct xgbe_prv_data *pdata) + { +- unsigned int max_q_count, q_count; + unsigned int reg, reg_val; +- unsigned int i; ++ unsigned int i, q_count; + + /* Clear MTL flow control */ + for (i = 0; i < pdata->rx_q_count; i++) + XGMAC_MTL_IOWRITE_BITS(pdata, i, MTL_Q_RQOMR, EHFC, 0); + + /* Clear MAC flow control */ +- max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES; +- q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count); ++ q_count = xgbe_get_fc_queue_count(pdata); + reg = MAC_Q0TFCR; + for (i = 0; i < q_count; i++) { + reg_val = XGMAC_IOREAD(pdata, reg); +@@ -553,9 +562,8 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata) + { + struct ieee_pfc *pfc = pdata->pfc; + struct ieee_ets *ets = pdata->ets; +- unsigned int max_q_count, q_count; + unsigned int reg, reg_val; +- unsigned int i; ++ unsigned int i, q_count; + + /* Set MTL flow control */ + for (i = 0; i < pdata->rx_q_count; i++) { +@@ -579,8 +587,7 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata) + } + + /* Set MAC flow control */ +- max_q_count = XGMAC_MAX_FLOW_CONTROL_QUEUES; +- q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count); ++ q_count = xgbe_get_fc_queue_count(pdata); + reg = MAC_Q0TFCR; + for (i = 0; i < q_count; i++) { + reg_val = XGMAC_IOREAD(pdata, reg); +-- +2.39.0 + diff --git a/queue-5.4/arm-dts-imx6qdl-gw560x-remove-incorrect-uart-has-rts.patch b/queue-5.4/arm-dts-imx6qdl-gw560x-remove-incorrect-uart-has-rts.patch new file mode 100644 index 00000000000..5734d30d801 --- /dev/null +++ b/queue-5.4/arm-dts-imx6qdl-gw560x-remove-incorrect-uart-has-rts.patch @@ -0,0 +1,48 @@ +From 0d0b06c60c0f81547b8c4b175ca826070f29a3b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 17:22:59 -0300 +Subject: ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' + +From: Fabio Estevam + +[ Upstream commit 9dfbc72256b5de608ad10989bcbafdbbd1ac8d4e ] + +The following build warning is seen when running: + +make dtbs_check DT_SCHEMA_FILES=fsl-imx-uart.yaml + +arch/arm/boot/dts/imx6dl-gw560x.dtb: serial@2020000: rts-gpios: False schema does not allow [[20, 1, 0]] + From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml + +The imx6qdl-gw560x board does not expose the UART RTS and CTS +as native UART pins, so 'uart-has-rtscts' should not be used. + +Using 'uart-has-rtscts' with 'rts-gpios' is an invalid combination +detected by serial.yaml. + +Fix the problem by removing the incorrect 'uart-has-rtscts' property. + +Fixes: b8a559feffb2 ("ARM: dts: imx: add Gateworks Ventana GW5600 support") +Signed-off-by: Fabio Estevam +Acked-by: Tim Harvey +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi +index e8e36dfd0a6b..c951834f4984 100644 +--- a/arch/arm/boot/dts/imx6qdl-gw560x.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw560x.dtsi +@@ -464,7 +464,6 @@ &ssi1 { + &uart1 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_uart1>; +- uart-has-rtscts; + rts-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>; + status = "okay"; + }; +-- +2.39.0 + diff --git a/queue-5.4/arm-imx-add-missing-of_node_put.patch b/queue-5.4/arm-imx-add-missing-of_node_put.patch new file mode 100644 index 00000000000..63ea4ac2d7b --- /dev/null +++ b/queue-5.4/arm-imx-add-missing-of_node_put.patch @@ -0,0 +1,94 @@ +From 5b068b2c811ccbbb03fb51975e5862f02931d65f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 17:54:03 +0100 +Subject: ARM: imx: add missing of_node_put() + +From: Dario Binacchi + +[ Upstream commit 87b30c4b0efb6a194a7b8eac2568a3da520d905f ] + +Calling of_find_compatible_node() returns a node pointer with refcount +incremented. Use of_node_put() on it when done. +The patch fixes the same problem on different i.MX platforms. + +Fixes: 8b88f7ef31dde ("ARM: mx25: Retrieve IIM base from dt") +Fixes: 94b2bec1b0e05 ("ARM: imx27: Retrieve the SYSCTRL base address from devicetree") +Fixes: 3172225d45bd9 ("ARM: imx31: Retrieve the IIM base address from devicetree") +Fixes: f68ea682d1da7 ("ARM: imx35: Retrieve the IIM base address from devicetree") +Fixes: ee18a7154ee08 ("ARM: imx5: retrieve iim base from device tree") +Signed-off-by: Dario Binacchi +Reviewed-by: Fabio Estevam +Reviewed-by: Martin Kaiser +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/cpu-imx25.c | 1 + + arch/arm/mach-imx/cpu-imx27.c | 1 + + arch/arm/mach-imx/cpu-imx31.c | 1 + + arch/arm/mach-imx/cpu-imx35.c | 1 + + arch/arm/mach-imx/cpu-imx5.c | 1 + + 5 files changed, 5 insertions(+) + +diff --git a/arch/arm/mach-imx/cpu-imx25.c b/arch/arm/mach-imx/cpu-imx25.c +index b2e1963f473d..2ee2d2813d57 100644 +--- a/arch/arm/mach-imx/cpu-imx25.c ++++ b/arch/arm/mach-imx/cpu-imx25.c +@@ -23,6 +23,7 @@ static int mx25_read_cpu_rev(void) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx25-iim"); + iim_base = of_iomap(np, 0); ++ of_node_put(np); + BUG_ON(!iim_base); + rev = readl(iim_base + MXC_IIMSREV); + iounmap(iim_base); +diff --git a/arch/arm/mach-imx/cpu-imx27.c b/arch/arm/mach-imx/cpu-imx27.c +index bf70e13bbe9e..1d2893908368 100644 +--- a/arch/arm/mach-imx/cpu-imx27.c ++++ b/arch/arm/mach-imx/cpu-imx27.c +@@ -28,6 +28,7 @@ static int mx27_read_cpu_rev(void) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx27-ccm"); + ccm_base = of_iomap(np, 0); ++ of_node_put(np); + BUG_ON(!ccm_base); + /* + * now we have access to the IO registers. As we need +diff --git a/arch/arm/mach-imx/cpu-imx31.c b/arch/arm/mach-imx/cpu-imx31.c +index b9c24b851d1a..35c544924e50 100644 +--- a/arch/arm/mach-imx/cpu-imx31.c ++++ b/arch/arm/mach-imx/cpu-imx31.c +@@ -39,6 +39,7 @@ static int mx31_read_cpu_rev(void) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx31-iim"); + iim_base = of_iomap(np, 0); ++ of_node_put(np); + BUG_ON(!iim_base); + + /* read SREV register from IIM module */ +diff --git a/arch/arm/mach-imx/cpu-imx35.c b/arch/arm/mach-imx/cpu-imx35.c +index 80e7d8ab9f1b..1fe75b39c2d9 100644 +--- a/arch/arm/mach-imx/cpu-imx35.c ++++ b/arch/arm/mach-imx/cpu-imx35.c +@@ -21,6 +21,7 @@ static int mx35_read_cpu_rev(void) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx35-iim"); + iim_base = of_iomap(np, 0); ++ of_node_put(np); + BUG_ON(!iim_base); + + rev = imx_readl(iim_base + MXC_IIMSREV); +diff --git a/arch/arm/mach-imx/cpu-imx5.c b/arch/arm/mach-imx/cpu-imx5.c +index ad56263778f9..a67c89bf155d 100644 +--- a/arch/arm/mach-imx/cpu-imx5.c ++++ b/arch/arm/mach-imx/cpu-imx5.c +@@ -28,6 +28,7 @@ static u32 imx5_read_srev_reg(const char *compat) + + np = of_find_compatible_node(NULL, NULL, compat); + iim_base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!iim_base); + + srev = readl(iim_base + IIM_SREV) & 0xff; +-- +2.39.0 + diff --git a/queue-5.4/arm-imx27-retrieve-the-sysctrl-base-address-from-dev.patch b/queue-5.4/arm-imx27-retrieve-the-sysctrl-base-address-from-dev.patch new file mode 100644 index 00000000000..c22d258321b --- /dev/null +++ b/queue-5.4/arm-imx27-retrieve-the-sysctrl-base-address-from-dev.patch @@ -0,0 +1,67 @@ +From 35623037c1d16d98b72dfad0669d6244fd090d6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 21:41:15 -0300 +Subject: ARM: imx27: Retrieve the SYSCTRL base address from devicetree + +From: Fabio Estevam + +[ Upstream commit 94b2bec1b0e054b27b0a0b5f52a0cd55c83340f4 ] + +Now that imx27 has been converted to a devicetree-only platform, +retrieve the SYSCTRL base address from devicetree. + +To keep devicetree compatibilty the SYSCTRL base address will be +retrieved from the CCM base address plus an 0x800 offset. + +This is not a problem as the imx27.dtsi describes the CCM register +range as 0x1000. + +Signed-off-by: Fabio Estevam +Acked-by: Arnd Bergmann +Signed-off-by: Shawn Guo +Stable-dep-of: 87b30c4b0efb ("ARM: imx: add missing of_node_put()") +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/cpu-imx27.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-imx/cpu-imx27.c b/arch/arm/mach-imx/cpu-imx27.c +index a969aa71b60f..bf70e13bbe9e 100644 +--- a/arch/arm/mach-imx/cpu-imx27.c ++++ b/arch/arm/mach-imx/cpu-imx27.c +@@ -9,6 +9,7 @@ + */ + + #include ++#include + #include + + #include "hardware.h" +@@ -17,16 +18,23 @@ static int mx27_cpu_rev = -1; + static int mx27_cpu_partnumber; + + #define SYS_CHIP_ID 0x00 /* The offset of CHIP ID register */ ++#define SYSCTRL_OFFSET 0x800 /* Offset from CCM base address */ + + static int mx27_read_cpu_rev(void) + { ++ void __iomem *ccm_base; ++ struct device_node *np; + u32 val; ++ ++ np = of_find_compatible_node(NULL, NULL, "fsl,imx27-ccm"); ++ ccm_base = of_iomap(np, 0); ++ BUG_ON(!ccm_base); + /* + * now we have access to the IO registers. As we need + * the silicon revision very early we read it here to + * avoid any further hooks + */ +- val = imx_readl(MX27_IO_ADDRESS(MX27_SYSCTRL_BASE_ADDR + SYS_CHIP_ID)); ++ val = imx_readl(ccm_base + SYSCTRL_OFFSET + SYS_CHIP_ID); + + mx27_cpu_partnumber = (int)((val >> 12) & 0xFFFF); + +-- +2.39.0 + diff --git a/queue-5.4/arm-imx31-retrieve-the-iim-base-address-from-devicet.patch b/queue-5.4/arm-imx31-retrieve-the-iim-base-address-from-devicet.patch new file mode 100644 index 00000000000..6fa83109ab4 --- /dev/null +++ b/queue-5.4/arm-imx31-retrieve-the-iim-base-address-from-devicet.patch @@ -0,0 +1,54 @@ +From c6341488da6b48ba91a432cbf27e3dbc35ae5ebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 21:41:17 -0300 +Subject: ARM: imx31: Retrieve the IIM base address from devicetree + +From: Fabio Estevam + +[ Upstream commit 3172225d45bd918a5c4865e7cd8eb0c9d79f8530 ] + +Now that imx31 has been converted to a devicetree-only platform, +retrieve the IIM base address from devicetree. + +Signed-off-by: Fabio Estevam +Acked-by: Arnd Bergmann +Signed-off-by: Shawn Guo +Stable-dep-of: 87b30c4b0efb ("ARM: imx: add missing of_node_put()") +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/cpu-imx31.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-imx/cpu-imx31.c b/arch/arm/mach-imx/cpu-imx31.c +index 3ee684b71006..b9c24b851d1a 100644 +--- a/arch/arm/mach-imx/cpu-imx31.c ++++ b/arch/arm/mach-imx/cpu-imx31.c +@@ -6,6 +6,7 @@ + */ + + #include ++#include + #include + + #include "common.h" +@@ -32,10 +33,16 @@ static struct { + + static int mx31_read_cpu_rev(void) + { ++ void __iomem *iim_base; ++ struct device_node *np; + u32 i, srev; + ++ np = of_find_compatible_node(NULL, NULL, "fsl,imx31-iim"); ++ iim_base = of_iomap(np, 0); ++ BUG_ON(!iim_base); ++ + /* read SREV register from IIM module */ +- srev = imx_readl(MX31_IO_ADDRESS(MX31_IIM_BASE_ADDR + MXC_IIMSREV)); ++ srev = imx_readl(iim_base + MXC_IIMSREV); + srev &= 0xff; + + for (i = 0; i < ARRAY_SIZE(mx31_cpu_type); i++) +-- +2.39.0 + diff --git a/queue-5.4/arm-imx35-retrieve-the-iim-base-address-from-devicet.patch b/queue-5.4/arm-imx35-retrieve-the-iim-base-address-from-devicet.patch new file mode 100644 index 00000000000..deae174de28 --- /dev/null +++ b/queue-5.4/arm-imx35-retrieve-the-iim-base-address-from-devicet.patch @@ -0,0 +1,53 @@ +From c5b466bf736310d59a2cbcc4ce8e558710b9815f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 21:41:20 -0300 +Subject: ARM: imx35: Retrieve the IIM base address from devicetree + +From: Fabio Estevam + +[ Upstream commit f68ea682d1da77e0133a7726640c22836a900a67 ] + +Now that imx35 has been converted to a devicetree-only platform, +retrieve the IIM base address from devicetree. + +Signed-off-by: Fabio Estevam +Acked-by: Arnd Bergmann +Signed-off-by: Shawn Guo +Stable-dep-of: 87b30c4b0efb ("ARM: imx: add missing of_node_put()") +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/cpu-imx35.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-imx/cpu-imx35.c b/arch/arm/mach-imx/cpu-imx35.c +index ebb3cdabd506..80e7d8ab9f1b 100644 +--- a/arch/arm/mach-imx/cpu-imx35.c ++++ b/arch/arm/mach-imx/cpu-imx35.c +@@ -5,6 +5,7 @@ + * Copyright (c) 2009 Daniel Mack + */ + #include ++#include + #include + + #include "hardware.h" +@@ -14,9 +15,15 @@ static int mx35_cpu_rev = -1; + + static int mx35_read_cpu_rev(void) + { ++ void __iomem *iim_base; ++ struct device_node *np; + u32 rev; + +- rev = imx_readl(MX35_IO_ADDRESS(MX35_IIM_BASE_ADDR + MXC_IIMSREV)); ++ np = of_find_compatible_node(NULL, NULL, "fsl,imx35-iim"); ++ iim_base = of_iomap(np, 0); ++ BUG_ON(!iim_base); ++ ++ rev = imx_readl(iim_base + MXC_IIMSREV); + switch (rev) { + case 0x00: + return IMX_CHIP_REVISION_1_0; +-- +2.39.0 + diff --git a/queue-5.4/asoc-fsl-asoc-card-fix-naming-of-ac-97-codec-widgets.patch b/queue-5.4/asoc-fsl-asoc-card-fix-naming-of-ac-97-codec-widgets.patch new file mode 100644 index 00000000000..f9e92da8d33 --- /dev/null +++ b/queue-5.4/asoc-fsl-asoc-card-fix-naming-of-ac-97-codec-widgets.patch @@ -0,0 +1,42 @@ +From 2611dedaab190bcda3697ba40c3f8d4906f7842a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 23:15:07 +0000 +Subject: ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets + +From: Mark Brown + +[ Upstream commit 242fc66ae6e1e2b8519daacc7590a73cd0e8a6e4 ] + +The fsl-asoc-card AC'97 support currently tries to route to Playback and +Capture widgets provided by the AC'97 CODEC. This doesn't work since the +generic AC'97 driver registers with an "AC97" at the front of the stream +and hence widget names, update to reflect reality. It's not clear to me +if or how this ever worked. + +Acked-by: Shengjiu Wang +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20230106-asoc-udoo-probe-v1-2-a5d7469d4f67@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl-asoc-card.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index d78eb9f9d24c..db663e7d17a4 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -112,8 +112,8 @@ static const struct snd_soc_dapm_route audio_map[] = { + + static const struct snd_soc_dapm_route audio_map_ac97[] = { + /* 1st half -- Normal DAPM routes */ +- {"Playback", NULL, "CPU AC97 Playback"}, +- {"CPU AC97 Capture", NULL, "Capture"}, ++ {"AC97 Playback", NULL, "CPU AC97 Playback"}, ++ {"CPU AC97 Capture", NULL, "AC97 Capture"}, + /* 2nd half -- ASRC DAPM routes */ + {"CPU AC97 Playback", NULL, "ASRC-Playback"}, + {"ASRC-Capture", NULL, "CPU AC97 Capture"}, +-- +2.39.0 + diff --git a/queue-5.4/asoc-fsl_micfil-correct-the-number-of-steps-on-sx-co.patch b/queue-5.4/asoc-fsl_micfil-correct-the-number-of-steps-on-sx-co.patch new file mode 100644 index 00000000000..ddd19cd5553 --- /dev/null +++ b/queue-5.4/asoc-fsl_micfil-correct-the-number-of-steps-on-sx-co.patch @@ -0,0 +1,59 @@ +From 168e3d718e7ece3e1ebfdaec7399bfd2c52724bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 10:57:54 +0800 +Subject: ASoC: fsl_micfil: Correct the number of steps on SX controls + +From: Chancel Liu + +[ Upstream commit cdfa92eb90f5770b26a79824ef213ebdbbd988b1 ] + +The parameter "max" of SOC_SINGLE_SX_TLV() means the number of steps +rather than maximum value. This patch corrects the minimum value to -8 +and the number of steps to 15. + +Signed-off-by: Chancel Liu +Acked-by: Shengjiu Wang +Link: https://lore.kernel.org/r/20230104025754.3019235-1-chancel.liu@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_micfil.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c +index f7f2d29f1bfe..b33746d58633 100644 +--- a/sound/soc/fsl/fsl_micfil.c ++++ b/sound/soc/fsl/fsl_micfil.c +@@ -87,21 +87,21 @@ static DECLARE_TLV_DB_SCALE(gain_tlv, 0, 100, 0); + + static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = { + SOC_SINGLE_SX_TLV("CH0 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(0), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(0), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH1 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(1), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(1), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH2 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(2), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(2), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH3 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(3), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(3), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH4 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(4), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(4), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH5 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(5), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(5), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH6 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(6), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(6), 0x8, 0xF, gain_tlv), + SOC_SINGLE_SX_TLV("CH7 Volume", REG_MICFIL_OUT_CTRL, +- MICFIL_OUTGAIN_CHX_SHIFT(7), 0xF, 0x7, gain_tlv), ++ MICFIL_OUTGAIN_CHX_SHIFT(7), 0x8, 0xF, gain_tlv), + SOC_ENUM_EXT("MICFIL Quality Select", + fsl_micfil_quality_enum, + snd_soc_get_enum_double, snd_soc_put_enum_double), +-- +2.39.0 + diff --git a/queue-5.4/asoc-fsl_ssi-rename-ac-97-streams-to-avoid-collision.patch b/queue-5.4/asoc-fsl_ssi-rename-ac-97-streams-to-avoid-collision.patch new file mode 100644 index 00000000000..71e3814925c --- /dev/null +++ b/queue-5.4/asoc-fsl_ssi-rename-ac-97-streams-to-avoid-collision.patch @@ -0,0 +1,70 @@ +From f9a5deea04c7166e5a465f3207b67311333b8462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 23:15:06 +0000 +Subject: ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 + CODEC + +From: Mark Brown + +[ Upstream commit 8c6a42b5b0ed6f96624f56954e93eeae107440a6 ] + +The SSI driver calls the AC'97 playback and transmit streams "AC97 Playback" +and "AC97 Capture" respectively. This is the same name used by the generic +AC'97 CODEC driver in ASoC, creating confusion for the Freescale ASoC card +when it attempts to use these widgets in routing. Add a "CPU" in the name +like the regular DAIs registered by the driver to disambiguate. + +Acked-by: Shengjiu Wang +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20230106-asoc-udoo-probe-v1-1-a5d7469d4f67@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl-asoc-card.c | 8 ++++---- + sound/soc/fsl/fsl_ssi.c | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c +index 39ea9bda1394..d78eb9f9d24c 100644 +--- a/sound/soc/fsl/fsl-asoc-card.c ++++ b/sound/soc/fsl/fsl-asoc-card.c +@@ -112,11 +112,11 @@ static const struct snd_soc_dapm_route audio_map[] = { + + static const struct snd_soc_dapm_route audio_map_ac97[] = { + /* 1st half -- Normal DAPM routes */ +- {"Playback", NULL, "AC97 Playback"}, +- {"AC97 Capture", NULL, "Capture"}, ++ {"Playback", NULL, "CPU AC97 Playback"}, ++ {"CPU AC97 Capture", NULL, "Capture"}, + /* 2nd half -- ASRC DAPM routes */ +- {"AC97 Playback", NULL, "ASRC-Playback"}, +- {"ASRC-Capture", NULL, "AC97 Capture"}, ++ {"CPU AC97 Playback", NULL, "ASRC-Playback"}, ++ {"ASRC-Capture", NULL, "CPU AC97 Capture"}, + }; + + /* Add all possible widgets into here without being redundant */ +diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c +index ed18bc69e095..0ab35c3dc7d2 100644 +--- a/sound/soc/fsl/fsl_ssi.c ++++ b/sound/soc/fsl/fsl_ssi.c +@@ -1147,14 +1147,14 @@ static struct snd_soc_dai_driver fsl_ssi_ac97_dai = { + .symmetric_channels = 1, + .probe = fsl_ssi_dai_probe, + .playback = { +- .stream_name = "AC97 Playback", ++ .stream_name = "CPU AC97 Playback", + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_48000, + .formats = SNDRV_PCM_FMTBIT_S16 | SNDRV_PCM_FMTBIT_S20, + }, + .capture = { +- .stream_name = "AC97 Capture", ++ .stream_name = "CPU AC97 Capture", + .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_48000, +-- +2.39.0 + diff --git a/queue-5.4/bpf-fix-pointer-leak-due-to-insufficient-speculative.patch b/queue-5.4/bpf-fix-pointer-leak-due-to-insufficient-speculative.patch new file mode 100644 index 00000000000..85ed9b28eb9 --- /dev/null +++ b/queue-5.4/bpf-fix-pointer-leak-due-to-insufficient-speculative.patch @@ -0,0 +1,109 @@ +From a40185ae9e4c30a6c174b09edfd8e60d9c5c775e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 16:05:46 +0100 +Subject: bpf: Fix pointer-leak due to insufficient speculative store bypass + mitigation + +From: Luis Gerhorst + +[ Upstream commit e4f4db47794c9f474b184ee1418f42e6a07412b6 ] + +To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to +insufficient speculative store bypass mitigation") inserts lfence +instructions after 1) initializing a stack slot and 2) spilling a +pointer to the stack. + +However, this does not cover cases where a stack slot is first +initialized with a pointer (subject to sanitization) but then +overwritten with a scalar (not subject to sanitization because +the slot was already initialized). In this case, the second write +may be subject to speculative store bypass (SSB) creating a +speculative pointer-as-scalar type confusion. This allows the +program to subsequently leak the numerical pointer value using, +for example, a branch-based cache side channel. + +To fix this, also sanitize scalars if they write a stack slot +that previously contained a pointer. Assuming that pointer-spills +are only generated by LLVM on register-pressure, the performance +impact on most real-world BPF programs should be small. + +The following unprivileged BPF bytecode drafts a minimal exploit +and the mitigation: + + [...] + // r6 = 0 or 1 (skalar, unknown user input) + // r7 = accessible ptr for side channel + // r10 = frame pointer (fp), to be leaked + // + r9 = r10 # fp alias to encourage ssb + *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked + // lfence added here because of pointer spill to stack. + // + // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor + // for no r9-r10 dependency. + // + *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr + // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, + // store may be subject to SSB + // + // fix: also add an lfence when the slot contained a ptr + // + r8 = *(u64 *)(r9 - 8) + // r8 = architecturally a scalar, speculatively a ptr + // + // leak ptr using branch-based cache side channel: + r8 &= 1 // choose bit to leak + if r8 == 0 goto SLOW // no mispredict + // architecturally dead code if input r6 is 0, + // only executes speculatively iff ptr bit is 1 + r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast) +SLOW: + [...] + +After running this, the program can time the access to *(r7 + 0) to +determine whether the chosen pointer bit was 0 or 1. Repeat this 64 +times to recover the whole address on amd64. + +In summary, sanitization can only be skipped if one scalar is +overwritten with another scalar. Scalar-confusion due to speculative +store bypass can not lead to invalid accesses because the pointer +bounds deducted during verification are enforced using branchless +logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on +pointer arithmetic") for details. + +Do not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks} +because speculative leaks are likely unexpected if these were enabled. +For example, leaking the address to a protected log file may be acceptable +while disabling the mitigation might unintentionally leak the address +into the cached-state of a map that is accessible to unprivileged +processes. + +Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") +Signed-off-by: Luis Gerhorst +Signed-off-by: Daniel Borkmann +Acked-by: Henriette Hofmeier +Link: https://lore.kernel.org/bpf/edc95bad-aada-9cfc-ffe2-fa9bb206583c@cs.fau.de +Link: https://lore.kernel.org/bpf/20230109150544.41465-1-gerhorst@cs.fau.de +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 32b32ecad770..ca7e05ddbb46 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1924,7 +1924,9 @@ static int check_stack_write(struct bpf_verifier_env *env, + bool sanitize = reg && is_spillable_regtype(reg->type); + + for (i = 0; i < size; i++) { +- if (state->stack[spi].slot_type[i] == STACK_INVALID) { ++ u8 type = state->stack[spi].slot_type[i]; ++ ++ if (type != STACK_MISC && type != STACK_ZERO) { + sanitize = true; + break; + } +-- +2.39.0 + diff --git a/queue-5.4/clk-generalize-devm_clk_get-a-bit.patch b/queue-5.4/clk-generalize-devm_clk_get-a-bit.patch new file mode 100644 index 00000000000..e64e79ac98f --- /dev/null +++ b/queue-5.4/clk-generalize-devm_clk_get-a-bit.patch @@ -0,0 +1,124 @@ +From eb75e58dd6da9b58d51a10348381e797d7126db9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 09:57:35 +0200 +Subject: clk: generalize devm_clk_get() a bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit abae8e57e49aa75f6db76aa866c775721523908f ] + +Allow to add an exit hook to devm managed clocks. Also use +clk_get_optional() in devm_clk_get_optional instead of open coding it. +The generalisation will be used in the next commit to add some more +devm_clk helpers. + +Reviewed-by: Jonathan Cameron +Reviewed-by: Alexandru Ardelean +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20220520075737.758761-3-u.kleine-koenig@pengutronix.de +Signed-off-by: Stephen Boyd +Stable-dep-of: 340cb392a038 ("memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()") +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-devres.c | 66 +++++++++++++++++++++++++++++----------- + 1 file changed, 49 insertions(+), 17 deletions(-) + +diff --git a/drivers/clk/clk-devres.c b/drivers/clk/clk-devres.c +index f9d5b7334341..c822f4ef1584 100644 +--- a/drivers/clk/clk-devres.c ++++ b/drivers/clk/clk-devres.c +@@ -4,39 +4,71 @@ + #include + #include + ++struct devm_clk_state { ++ struct clk *clk; ++ void (*exit)(struct clk *clk); ++}; ++ + static void devm_clk_release(struct device *dev, void *res) + { +- clk_put(*(struct clk **)res); ++ struct devm_clk_state *state = *(struct devm_clk_state **)res; ++ ++ if (state->exit) ++ state->exit(state->clk); ++ ++ clk_put(state->clk); + } + +-struct clk *devm_clk_get(struct device *dev, const char *id) ++static struct clk *__devm_clk_get(struct device *dev, const char *id, ++ struct clk *(*get)(struct device *dev, const char *id), ++ int (*init)(struct clk *clk), ++ void (*exit)(struct clk *clk)) + { +- struct clk **ptr, *clk; ++ struct devm_clk_state *state; ++ struct clk *clk; ++ int ret; + +- ptr = devres_alloc(devm_clk_release, sizeof(*ptr), GFP_KERNEL); +- if (!ptr) ++ state = devres_alloc(devm_clk_release, sizeof(*state), GFP_KERNEL); ++ if (!state) + return ERR_PTR(-ENOMEM); + +- clk = clk_get(dev, id); +- if (!IS_ERR(clk)) { +- *ptr = clk; +- devres_add(dev, ptr); +- } else { +- devres_free(ptr); ++ clk = get(dev, id); ++ if (IS_ERR(clk)) { ++ ret = PTR_ERR(clk); ++ goto err_clk_get; + } + ++ if (init) { ++ ret = init(clk); ++ if (ret) ++ goto err_clk_init; ++ } ++ ++ state->clk = clk; ++ state->exit = exit; ++ ++ devres_add(dev, state); ++ + return clk; ++ ++err_clk_init: ++ ++ clk_put(clk); ++err_clk_get: ++ ++ devres_free(state); ++ return ERR_PTR(ret); ++} ++ ++struct clk *devm_clk_get(struct device *dev, const char *id) ++{ ++ return __devm_clk_get(dev, id, clk_get, NULL, NULL); + } + EXPORT_SYMBOL(devm_clk_get); + + struct clk *devm_clk_get_optional(struct device *dev, const char *id) + { +- struct clk *clk = devm_clk_get(dev, id); +- +- if (clk == ERR_PTR(-ENOENT)) +- return NULL; +- +- return clk; ++ return __devm_clk_get(dev, id, clk_get_optional, NULL, NULL); + } + EXPORT_SYMBOL(devm_clk_get_optional); + +-- +2.39.0 + diff --git a/queue-5.4/clk-provide-new-devm_clk-helpers-for-prepared-and-en.patch b/queue-5.4/clk-provide-new-devm_clk-helpers-for-prepared-and-en.patch new file mode 100644 index 00000000000..1c6aff82804 --- /dev/null +++ b/queue-5.4/clk-provide-new-devm_clk-helpers-for-prepared-and-en.patch @@ -0,0 +1,214 @@ +From cbcb1f1e356aee94fddbcfac393813f876af6a73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 09:57:36 +0200 +Subject: clk: Provide new devm_clk helpers for prepared and enabled clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 7ef9651e9792b08eb310c6beb202cbc947f43cab ] + +When a driver keeps a clock prepared (or enabled) during the whole +lifetime of the driver, these helpers allow to simplify the drivers. + +Reviewed-by: Jonathan Cameron +Reviewed-by: Alexandru Ardelean +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20220520075737.758761-4-u.kleine-koenig@pengutronix.de +Signed-off-by: Stephen Boyd +Stable-dep-of: 340cb392a038 ("memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()") +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-devres.c | 27 ++++++++++ + include/linux/clk.h | 109 +++++++++++++++++++++++++++++++++++++++ + 2 files changed, 136 insertions(+) + +diff --git a/drivers/clk/clk-devres.c b/drivers/clk/clk-devres.c +index c822f4ef1584..43ccd20e0298 100644 +--- a/drivers/clk/clk-devres.c ++++ b/drivers/clk/clk-devres.c +@@ -66,12 +66,39 @@ struct clk *devm_clk_get(struct device *dev, const char *id) + } + EXPORT_SYMBOL(devm_clk_get); + ++struct clk *devm_clk_get_prepared(struct device *dev, const char *id) ++{ ++ return __devm_clk_get(dev, id, clk_get, clk_prepare, clk_unprepare); ++} ++EXPORT_SYMBOL_GPL(devm_clk_get_prepared); ++ ++struct clk *devm_clk_get_enabled(struct device *dev, const char *id) ++{ ++ return __devm_clk_get(dev, id, clk_get, ++ clk_prepare_enable, clk_disable_unprepare); ++} ++EXPORT_SYMBOL_GPL(devm_clk_get_enabled); ++ + struct clk *devm_clk_get_optional(struct device *dev, const char *id) + { + return __devm_clk_get(dev, id, clk_get_optional, NULL, NULL); + } + EXPORT_SYMBOL(devm_clk_get_optional); + ++struct clk *devm_clk_get_optional_prepared(struct device *dev, const char *id) ++{ ++ return __devm_clk_get(dev, id, clk_get_optional, ++ clk_prepare, clk_unprepare); ++} ++EXPORT_SYMBOL_GPL(devm_clk_get_optional_prepared); ++ ++struct clk *devm_clk_get_optional_enabled(struct device *dev, const char *id) ++{ ++ return __devm_clk_get(dev, id, clk_get_optional, ++ clk_prepare_enable, clk_disable_unprepare); ++} ++EXPORT_SYMBOL_GPL(devm_clk_get_optional_enabled); ++ + struct clk_bulk_devres { + struct clk_bulk_data *clks; + int num_clks; +diff --git a/include/linux/clk.h b/include/linux/clk.h +index 18b7b95a8253..87730337e28f 100644 +--- a/include/linux/clk.h ++++ b/include/linux/clk.h +@@ -418,6 +418,47 @@ int __must_check devm_clk_bulk_get_all(struct device *dev, + */ + struct clk *devm_clk_get(struct device *dev, const char *id); + ++/** ++ * devm_clk_get_prepared - devm_clk_get() + clk_prepare() ++ * @dev: device for clock "consumer" ++ * @id: clock consumer ID ++ * ++ * Context: May sleep. ++ * ++ * Return: a struct clk corresponding to the clock producer, or ++ * valid IS_ERR() condition containing errno. The implementation ++ * uses @dev and @id to determine the clock consumer, and thereby ++ * the clock producer. (IOW, @id may be identical strings, but ++ * clk_get may return different clock producers depending on @dev.) ++ * ++ * The returned clk (if valid) is prepared. Drivers must however assume ++ * that the clock is not enabled. ++ * ++ * The clock will automatically be unprepared and freed when the device ++ * is unbound from the bus. ++ */ ++struct clk *devm_clk_get_prepared(struct device *dev, const char *id); ++ ++/** ++ * devm_clk_get_enabled - devm_clk_get() + clk_prepare_enable() ++ * @dev: device for clock "consumer" ++ * @id: clock consumer ID ++ * ++ * Context: May sleep. ++ * ++ * Return: a struct clk corresponding to the clock producer, or ++ * valid IS_ERR() condition containing errno. The implementation ++ * uses @dev and @id to determine the clock consumer, and thereby ++ * the clock producer. (IOW, @id may be identical strings, but ++ * clk_get may return different clock producers depending on @dev.) ++ * ++ * The returned clk (if valid) is prepared and enabled. ++ * ++ * The clock will automatically be disabled, unprepared and freed ++ * when the device is unbound from the bus. ++ */ ++struct clk *devm_clk_get_enabled(struct device *dev, const char *id); ++ + /** + * devm_clk_get_optional - lookup and obtain a managed reference to an optional + * clock producer. +@@ -429,6 +470,50 @@ struct clk *devm_clk_get(struct device *dev, const char *id); + */ + struct clk *devm_clk_get_optional(struct device *dev, const char *id); + ++/** ++ * devm_clk_get_optional_prepared - devm_clk_get_optional() + clk_prepare() ++ * @dev: device for clock "consumer" ++ * @id: clock consumer ID ++ * ++ * Context: May sleep. ++ * ++ * Return: a struct clk corresponding to the clock producer, or ++ * valid IS_ERR() condition containing errno. The implementation ++ * uses @dev and @id to determine the clock consumer, and thereby ++ * the clock producer. If no such clk is found, it returns NULL ++ * which serves as a dummy clk. That's the only difference compared ++ * to devm_clk_get_prepared(). ++ * ++ * The returned clk (if valid) is prepared. Drivers must however ++ * assume that the clock is not enabled. ++ * ++ * The clock will automatically be unprepared and freed when the ++ * device is unbound from the bus. ++ */ ++struct clk *devm_clk_get_optional_prepared(struct device *dev, const char *id); ++ ++/** ++ * devm_clk_get_optional_enabled - devm_clk_get_optional() + ++ * clk_prepare_enable() ++ * @dev: device for clock "consumer" ++ * @id: clock consumer ID ++ * ++ * Context: May sleep. ++ * ++ * Return: a struct clk corresponding to the clock producer, or ++ * valid IS_ERR() condition containing errno. The implementation ++ * uses @dev and @id to determine the clock consumer, and thereby ++ * the clock producer. If no such clk is found, it returns NULL ++ * which serves as a dummy clk. That's the only difference compared ++ * to devm_clk_get_enabled(). ++ * ++ * The returned clk (if valid) is prepared and enabled. ++ * ++ * The clock will automatically be disabled, unprepared and freed ++ * when the device is unbound from the bus. ++ */ ++struct clk *devm_clk_get_optional_enabled(struct device *dev, const char *id); ++ + /** + * devm_get_clk_from_child - lookup and obtain a managed reference to a + * clock producer from child node. +@@ -770,12 +855,36 @@ static inline struct clk *devm_clk_get(struct device *dev, const char *id) + return NULL; + } + ++static inline struct clk *devm_clk_get_prepared(struct device *dev, ++ const char *id) ++{ ++ return NULL; ++} ++ ++static inline struct clk *devm_clk_get_enabled(struct device *dev, ++ const char *id) ++{ ++ return NULL; ++} ++ + static inline struct clk *devm_clk_get_optional(struct device *dev, + const char *id) + { + return NULL; + } + ++static inline struct clk *devm_clk_get_optional_prepared(struct device *dev, ++ const char *id) ++{ ++ return NULL; ++} ++ ++static inline struct clk *devm_clk_get_optional_enabled(struct device *dev, ++ const char *id) ++{ ++ return NULL; ++} ++ + static inline int __must_check devm_clk_bulk_get(struct device *dev, int num_clks, + struct clk_bulk_data *clks) + { +-- +2.39.0 + diff --git a/queue-5.4/cpufreq-add-tegra234-to-cpufreq-dt-platdev-blocklist.patch b/queue-5.4/cpufreq-add-tegra234-to-cpufreq-dt-platdev-blocklist.patch new file mode 100644 index 00000000000..8990946b1f7 --- /dev/null +++ b/queue-5.4/cpufreq-add-tegra234-to-cpufreq-dt-platdev-blocklist.patch @@ -0,0 +1,35 @@ +From 7f0466e7d74a167143732e23faead32ad6fa3b7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 21:32:37 +0530 +Subject: cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist + +From: Sumit Gupta + +[ Upstream commit 01c5bb0cc2a39fbc56ff9a5ef28b79447f0c2351 ] + +Tegra234 platform uses the tegra194-cpufreq driver, so add it +to the blocklist in cpufreq-dt-platdev driver to avoid the cpufreq +driver registration from there. + +Signed-off-by: Sumit Gupta +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index 1200842c3da4..5d28553b69f5 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -126,6 +126,7 @@ static const struct of_device_id blacklist[] __initconst = { + + { .compatible = "nvidia,tegra124", }, + { .compatible = "nvidia,tegra210", }, ++ { .compatible = "nvidia,tegra234", }, + + { .compatible = "qcom,apq8096", }, + { .compatible = "qcom,msm8996", }, +-- +2.39.0 + diff --git a/queue-5.4/cpufreq-armada-37xx-stop-using-0-as-null-pointer.patch b/queue-5.4/cpufreq-armada-37xx-stop-using-0-as-null-pointer.patch new file mode 100644 index 00000000000..e734354b267 --- /dev/null +++ b/queue-5.4/cpufreq-armada-37xx-stop-using-0-as-null-pointer.patch @@ -0,0 +1,35 @@ +From d192ddeb381d8f9b677baf7b9795bb7a9bbab614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 11:12:52 +0800 +Subject: cpufreq: armada-37xx: stop using 0 as NULL pointer + +From: Miles Chen + +[ Upstream commit 08f0adb193c008de640fde34a2e00a666c01d77c ] + +Use NULL for NULL pointer to fix the following sparse warning: +drivers/cpufreq/armada-37xx-cpufreq.c:448:32: sparse: warning: Using plain integer as NULL pointer + +Signed-off-by: Miles Chen +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index 2de7fd18f66a..f0be8a43ec49 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -443,7 +443,7 @@ static int __init armada37xx_cpufreq_driver_init(void) + return -ENODEV; + } + +- clk = clk_get(cpu_dev, 0); ++ clk = clk_get(cpu_dev, NULL); + if (IS_ERR(clk)) { + dev_err(cpu_dev, "Cannot get clock for CPU0\n"); + return PTR_ERR(clk); +-- +2.39.0 + diff --git a/queue-5.4/dmaengine-fix-double-increment-of-client_count-in-dm.patch b/queue-5.4/dmaengine-fix-double-increment-of-client_count-in-dm.patch new file mode 100644 index 00000000000..32bf165cf57 --- /dev/null +++ b/queue-5.4/dmaengine-fix-double-increment-of-client_count-in-dm.patch @@ -0,0 +1,126 @@ +From eba437921afd50979cb93dd3be15ae1e3bff98b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 11:00:50 +0800 +Subject: dmaengine: Fix double increment of client_count in dma_chan_get() + +From: Koba Ko + +[ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] + +The first time dma_chan_get() is called for a channel the channel +client_count is incorrectly incremented twice for public channels, +first in balance_ref_count(), and again prior to returning. This +results in an incorrect client count which will lead to the +channel resources not being freed when they should be. A simple + test of repeated module load and unload of async_tx on a Dell + Power Edge R7425 also shows this resulting in a kref underflow + warning. + +[ 124.329662] async_tx: api initialized (async) +[ 129.000627] async_tx: api initialized (async) +[ 130.047839] ------------[ cut here ]------------ +[ 130.052472] refcount_t: underflow; use-after-free. +[ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 +refcount_warn_saturate+0xba/0x110 +[ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr +intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm +mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si +syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops +k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat +fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul +libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas +i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash +dm_log dm_mod [last unloaded: async_tx] +[ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not +tainted 5.14.0-185.el9.x86_64 #1 +[ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS +1.18.0 01/17/2022 +[ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 +[ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d +26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a +bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff +48 c7 +[ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 +[ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 +[ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 +[ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff +[ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 +[ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 +[ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) +knlGS:0000000000000000 +[ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 +[ 130.219729] Call Trace: +[ 130.222192] +[ 130.224305] dma_chan_put+0x10d/0x110 +[ 130.227988] dmaengine_put+0x7a/0xa0 +[ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 +[ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 +[ 130.242652] do_syscall_64+0x5c/0x90 +[ 130.246240] ? exc_page_fault+0x62/0x150 +[ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd +[ 130.255243] RIP: 0033:0x7f6463a3f5ab +[ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 +83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 +00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 +01 48 +[ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: +00000000000000b0 +[ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab +[ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 +[ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 +[ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 +[ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 +[ 130.320875] +[ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- + +cat /sys/class/dma/dma0chan*/in_use would get the wrong result. +2 +2 +2 + +Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") +Signed-off-by: Koba Ko +Reviewed-by: Jie Hai +Test-by: Jie Hai +Reviewed-by: Jerry Snitselaar +Reviewed-by: Dave Jiang +Tested-by: Joel Savitz +Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dmaengine.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c +index 4b604086b1b3..a8996faa85a9 100644 +--- a/drivers/dma/dmaengine.c ++++ b/drivers/dma/dmaengine.c +@@ -212,7 +212,8 @@ static int dma_chan_get(struct dma_chan *chan) + /* The channel is already in use, update client count */ + if (chan->client_count) { + __module_get(owner); +- goto out; ++ chan->client_count++; ++ return 0; + } + + if (!try_module_get(owner)) +@@ -225,11 +226,11 @@ static int dma_chan_get(struct dma_chan *chan) + goto err_out; + } + ++ chan->client_count++; ++ + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) + balance_ref_count(chan); + +-out: +- chan->client_count++; + return 0; + + err_out: +-- +2.39.0 + diff --git a/queue-5.4/dmaengine-xilinx_dma-call-of_node_put-when-breaking-.patch b/queue-5.4/dmaengine-xilinx_dma-call-of_node_put-when-breaking-.patch new file mode 100644 index 00000000000..63db5fb52e7 --- /dev/null +++ b/queue-5.4/dmaengine-xilinx_dma-call-of_node_put-when-breaking-.patch @@ -0,0 +1,42 @@ +From 85c5e73e33dcc1aaadcce3643fcf2d3a2dd98125 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 10:16:12 +0800 +Subject: dmaengine: xilinx_dma: call of_node_put() when breaking out of + for_each_child_of_node() + +From: Liu Shixin + +[ Upstream commit 596b53ccc36a546ab28e8897315c5b4d1d5a0200 ] + +Since for_each_child_of_node() will increase the refcount of node, we need +to call of_node_put() manually when breaking out of the iteration. + +Fixes: 9cd4360de609 ("dma: Add Xilinx AXI Video Direct Memory Access Engine driver support") +Signed-off-by: Liu Shixin +Acked-by: Peter Korsgaard +Link: https://lore.kernel.org/r/20221122021612.1908866-1-liushixin2@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 7b60248be725..be44c86a1e03 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -2747,8 +2747,10 @@ static int xilinx_dma_probe(struct platform_device *pdev) + /* Initialize the channels */ + for_each_child_of_node(node, child) { + err = xilinx_dma_child_probe(xdev, child); +- if (err < 0) ++ if (err < 0) { ++ of_node_put(child); + goto error; ++ } + } + + if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) { +-- +2.39.0 + diff --git a/queue-5.4/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch b/queue-5.4/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch new file mode 100644 index 00000000000..5c9643efc58 --- /dev/null +++ b/queue-5.4/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch @@ -0,0 +1,68 @@ +From 2fd5861c94283cb72eb1dd54607f5202da3f39a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 11:41:23 +0530 +Subject: dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error + handling + +From: Swati Agarwal + +[ Upstream commit 91df7751eb890e970afc08f50b8f0fa5ea39e03d ] + +Add missing cleanup in devm_platform_ioremap_resource(). +When probe fails remove dma channel resources and disable clocks in +accordance with the order of resources allocated . + +Signed-off-by: Swati Agarwal +Link: https://lore.kernel.org/r/20220817061125.4720-2-swati.agarwal@xilinx.com +Signed-off-by: Vinod Koul +Stable-dep-of: 596b53ccc36a ("dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()") +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 8a7606bc326a..7b60248be725 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -2652,9 +2652,10 @@ static int xilinx_dma_probe(struct platform_device *pdev) + + /* Request and map I/O memory */ + xdev->regs = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(xdev->regs)) +- return PTR_ERR(xdev->regs); +- ++ if (IS_ERR(xdev->regs)) { ++ err = PTR_ERR(xdev->regs); ++ goto disable_clks; ++ } + /* Retrieve the DMA engine properties from the device tree */ + xdev->max_buffer_len = GENMASK(XILINX_DMA_MAX_TRANS_LEN_MAX - 1, 0); + +@@ -2747,7 +2748,7 @@ static int xilinx_dma_probe(struct platform_device *pdev) + for_each_child_of_node(node, child) { + err = xilinx_dma_child_probe(xdev, child); + if (err < 0) +- goto disable_clks; ++ goto error; + } + + if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) { +@@ -2780,12 +2781,12 @@ static int xilinx_dma_probe(struct platform_device *pdev) + + return 0; + +-disable_clks: +- xdma_disable_allclks(xdev); + error: + for (i = 0; i < xdev->nr_channels; i++) + if (xdev->chan[i]) + xilinx_dma_chan_remove(xdev->chan[i]); ++disable_clks: ++ xdma_disable_allclks(xdev); + + return err; + } +-- +2.39.0 + diff --git a/queue-5.4/dmaengine-xilinx_dma-use-devm_platform_ioremap_resou.patch b/queue-5.4/dmaengine-xilinx_dma-use-devm_platform_ioremap_resou.patch new file mode 100644 index 00000000000..9e828c6efa1 --- /dev/null +++ b/queue-5.4/dmaengine-xilinx_dma-use-devm_platform_ioremap_resou.patch @@ -0,0 +1,50 @@ +From cea9d2630607d4e89c227ff162a5222b8c2d9ee0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2019 16:20:59 +0530 +Subject: dmaengine: xilinx_dma: use devm_platform_ioremap_resource() + +From: Radhey Shyam Pandey + +[ Upstream commit a8bd47542863947e2433db35558477caf0d89995 ] + +Replace the chain of platform_get_resource() and devm_ioremap_resource() +with devm_platform_ioremap_resource(). It simplifies the flow and there +is no functional change. + +Fixes below cocinelle warning- +WARNING: Use devm_platform_ioremap_resource for xdev -> regs + +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1569495060-18117-4-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Stable-dep-of: 596b53ccc36a ("dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()") +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 3bb711e735ab..8a7606bc326a 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -2626,7 +2626,6 @@ static int xilinx_dma_probe(struct platform_device *pdev) + struct device_node *node = pdev->dev.of_node; + struct xilinx_dma_device *xdev; + struct device_node *child, *np = pdev->dev.of_node; +- struct resource *io; + u32 num_frames, addr_width, len_width; + int i, err; + +@@ -2652,8 +2651,7 @@ static int xilinx_dma_probe(struct platform_device *pdev) + return err; + + /* Request and map I/O memory */ +- io = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- xdev->regs = devm_ioremap_resource(&pdev->dev, io); ++ xdev->regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(xdev->regs)) + return PTR_ERR(xdev->regs); + +-- +2.39.0 + diff --git a/queue-5.4/driver-core-fix-test_async_probe_init-saves-device-i.patch b/queue-5.4/driver-core-fix-test_async_probe_init-saves-device-i.patch new file mode 100644 index 00000000000..4793ccea485 --- /dev/null +++ b/queue-5.4/driver-core-fix-test_async_probe_init-saves-device-i.patch @@ -0,0 +1,46 @@ +From c738911533d48a238e1c3622beac7db739169292 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 14:35:41 +0800 +Subject: driver core: Fix test_async_probe_init saves device in wrong array + +From: Chen Zhongjin + +[ Upstream commit 9be182da0a7526f1b9a3777a336f83baa2e64d23 ] + +In test_async_probe_init, second set of asynchronous devices are saved +in sync_dev[sync_id], which should be async_dev[async_id]. +This makes these devices not unregistered when exit. + +> modprobe test_async_driver_probe && \ +> modprobe -r test_async_driver_probe && \ +> modprobe test_async_driver_probe + ... +> sysfs: cannot create duplicate filename '/devices/platform/test_async_driver.4' +> kobject_add_internal failed for test_async_driver.4 with -EEXIST, + don't try to register things with the same name in the same directory. + +Fixes: 57ea974fb871 ("driver core: Rewrite test_async_driver_probe to cover serialization and NUMA affinity") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221125063541.241328-1-chenzhongjin@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/test/test_async_driver_probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/test/test_async_driver_probe.c b/drivers/base/test/test_async_driver_probe.c +index 3bb7beb127a9..c157a912d673 100644 +--- a/drivers/base/test/test_async_driver_probe.c ++++ b/drivers/base/test/test_async_driver_probe.c +@@ -146,7 +146,7 @@ static int __init test_async_probe_init(void) + calltime = ktime_get(); + for_each_online_cpu(cpu) { + nid = cpu_to_node(cpu); +- pdev = &sync_dev[sync_id]; ++ pdev = &async_dev[async_id]; + + *pdev = test_platform_device_register_node("test_async_driver", + async_id, +-- +2.39.0 + diff --git a/queue-5.4/drm-add-orientation-quirk-for-lenovo-ideapad-d330-10.patch b/queue-5.4/drm-add-orientation-quirk-for-lenovo-ideapad-d330-10.patch new file mode 100644 index 00000000000..e306d502f9f --- /dev/null +++ b/queue-5.4/drm-add-orientation-quirk-for-lenovo-ideapad-d330-10.patch @@ -0,0 +1,39 @@ +From 625aecbf383339a42ca0f3c20e4dd7b1413f2d8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 15:58:26 -0500 +Subject: drm: Add orientation quirk for Lenovo ideapad D330-10IGL + +From: Patrick Thompson + +[ Upstream commit 0688773f0710528e1ab302c3d6317e269f2e2e6e ] + +Panel is 800x1280 but mounted on a detachable form factor sideways. + +Signed-off-by: Patrick Thompson +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20221220205826.178008-1-ptf@google.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index ca0fefeaab20..ce739ba45c55 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -272,6 +272,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, ++ }, { /* Lenovo Ideapad D330-10IGL (HD) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGL"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Lenovo Yoga Book X90F / X91F / X91L */ + .matches = { + /* Non exact match to match all versions */ +-- +2.39.0 + diff --git a/queue-5.4/drm-panfrost-fix-generic_atomic64-dependency.patch b/queue-5.4/drm-panfrost-fix-generic_atomic64-dependency.patch new file mode 100644 index 00000000000..43a09ae6a23 --- /dev/null +++ b/queue-5.4/drm-panfrost-fix-generic_atomic64-dependency.patch @@ -0,0 +1,45 @@ +From bc3f41510cbca9389e819e67f3ebc67222b2e2e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 17:44:43 +0100 +Subject: drm/panfrost: fix GENERIC_ATOMIC64 dependency + +From: Arnd Bergmann + +[ Upstream commit 6437a549ae178a3f5a5c03e983f291ebcdc2bbc7 ] + +On ARMv5 and earlier, a randconfig build can still run into + +WARNING: unmet direct dependencies detected for IOMMU_IO_PGTABLE_LPAE + Depends on [n]: IOMMU_SUPPORT [=y] && (ARM [=y] || ARM64 || COMPILE_TEST [=y]) && !GENERIC_ATOMIC64 [=y] + Selected by [y]: + - DRM_PANFROST [=y] && HAS_IOMEM [=y] && DRM [=y] && (ARM [=y] || ARM64 || COMPILE_TEST [=y] && !GENERIC_ATOMIC64 [=y]) && MMU [=y] + +Rework the dependencies to always require a working cmpxchg64. + +Fixes: db594ba3fcf9 ("drm/panfrost: depend on !GENERIC_ATOMIC64 when using COMPILE_TEST") +Signed-off-by: Arnd Bergmann +Reviewed-by: Steven Price +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20230117164456.1591901-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panfrost/Kconfig b/drivers/gpu/drm/panfrost/Kconfig +index 86cdc0ce79e6..77f4d32e5204 100644 +--- a/drivers/gpu/drm/panfrost/Kconfig ++++ b/drivers/gpu/drm/panfrost/Kconfig +@@ -3,7 +3,8 @@ + config DRM_PANFROST + tristate "Panfrost (DRM support for ARM Mali Midgard/Bifrost GPUs)" + depends on DRM +- depends on ARM || ARM64 || (COMPILE_TEST && !GENERIC_ATOMIC64) ++ depends on ARM || ARM64 || COMPILE_TEST ++ depends on !GENERIC_ATOMIC64 # for IOMMU_IO_PGTABLE_LPAE + depends on MMU + select DRM_SCHED + select IOMMU_SUPPORT +-- +2.39.0 + diff --git a/queue-5.4/edac-highbank-fix-memory-leak-in-highbank_mc_probe.patch b/queue-5.4/edac-highbank-fix-memory-leak-in-highbank_mc_probe.patch new file mode 100644 index 00000000000..c49ee7bf862 --- /dev/null +++ b/queue-5.4/edac-highbank-fix-memory-leak-in-highbank_mc_probe.patch @@ -0,0 +1,54 @@ +From 511f624817dec8826a96a23e5193ca65b6891e00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Dec 2022 09:48:24 +0400 +Subject: EDAC/highbank: Fix memory leak in highbank_mc_probe() + +From: Miaoqian Lin + +[ Upstream commit e7a293658c20a7945014570e1921bf7d25d68a36 ] + +When devres_open_group() fails, it returns -ENOMEM without freeing memory +allocated by edac_mc_alloc(). + +Call edac_mc_free() on the error handling path to avoid a memory leak. + + [ bp: Massage commit message. ] + +Fixes: a1b01edb2745 ("edac: add support for Calxeda highbank memory controller") +Signed-off-by: Miaoqian Lin +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Andre Przywara +Link: https://lore.kernel.org/r/20221229054825.1361993-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/edac/highbank_mc_edac.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/highbank_mc_edac.c b/drivers/edac/highbank_mc_edac.c +index 61b76ec226af..19fba258ae10 100644 +--- a/drivers/edac/highbank_mc_edac.c ++++ b/drivers/edac/highbank_mc_edac.c +@@ -174,8 +174,10 @@ static int highbank_mc_probe(struct platform_device *pdev) + drvdata = mci->pvt_info; + platform_set_drvdata(pdev, mci); + +- if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) +- return -ENOMEM; ++ if (!devres_open_group(&pdev->dev, NULL, GFP_KERNEL)) { ++ res = -ENOMEM; ++ goto free; ++ } + + r = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!r) { +@@ -243,6 +245,7 @@ static int highbank_mc_probe(struct platform_device *pdev) + edac_mc_del_mc(&pdev->dev); + err: + devres_release_group(&pdev->dev, NULL); ++free: + edac_mc_free(mci); + return res; + } +-- +2.39.0 + diff --git a/queue-5.4/gpio-mxc-always-set-gpios-used-as-interrupt-source-t.patch b/queue-5.4/gpio-mxc-always-set-gpios-used-as-interrupt-source-t.patch new file mode 100644 index 00000000000..211c1265bc9 --- /dev/null +++ b/queue-5.4/gpio-mxc-always-set-gpios-used-as-interrupt-source-t.patch @@ -0,0 +1,41 @@ +From 9848804bc4d914ea9ace5fa973bef60faab9175c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 10:49:57 +0100 +Subject: gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode + +From: Marek Vasut + +[ Upstream commit 8e88a0feebb241cab0253698b2f7358b6ebec802 ] + +Always configure GPIO pins which are used as interrupt source as INPUTs. +In case the default pin configuration is OUTPUT, or the prior stage does +configure the pins as OUTPUT, then Linux will not reconfigure the pin as +INPUT and no interrupts are received. + +Always configure the interrupt source GPIO pin as input to fix the above case. + +Reviewed-by: Linus Walleij +Fixes: 07bd1a6cc7cbb ("MXC arch: Add gpio support for the whole platform") +Signed-off-by: Marek Vasut +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mxc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c +index c77d474185f3..2e4b6b176875 100644 +--- a/drivers/gpio/gpio-mxc.c ++++ b/drivers/gpio/gpio-mxc.c +@@ -229,7 +229,7 @@ static int gpio_set_irq_type(struct irq_data *d, u32 type) + + writel(1 << gpio_idx, port->base + GPIO_ISR); + +- return 0; ++ return port->gc.direction_input(&port->gc, gpio_idx); + } + + static void mxc_flip_edge(struct mxc_gpio_port *port, u32 gpio) +-- +2.39.0 + diff --git a/queue-5.4/hid-betop-check-shape-of-output-reports.patch b/queue-5.4/hid-betop-check-shape-of-output-reports.patch new file mode 100644 index 00000000000..394c5b6a94a --- /dev/null +++ b/queue-5.4/hid-betop-check-shape-of-output-reports.patch @@ -0,0 +1,68 @@ +From 42d515741ca33de6e361c79575dbe890a54d8b89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 18:12:16 +0000 +Subject: HID: betop: check shape of output reports + +From: Pietro Borrello + +[ Upstream commit 3782c0d6edf658b71354a64d60aa7a296188fc90 ] + +betopff_init() only checks the total sum of the report counts for each +report field to be at least 4, but hid_betopff_play() expects 4 report +fields. +A device advertising an output report with one field and 4 report counts +would pass the check but crash the kernel with a NULL pointer dereference +in hid_betopff_play(). + +Fixes: 52cd7785f3cd ("HID: betop: add drivers/hid/hid-betopff.c") +Signed-off-by: Pietro Borrello +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-betopff.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c +index 467d789f9bc2..25ed7b9a917e 100644 +--- a/drivers/hid/hid-betopff.c ++++ b/drivers/hid/hid-betopff.c +@@ -60,7 +60,6 @@ static int betopff_init(struct hid_device *hid) + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; + struct input_dev *dev; +- int field_count = 0; + int error; + int i, j; + +@@ -86,19 +85,21 @@ static int betopff_init(struct hid_device *hid) + * ----------------------------------------- + * Do init them with default value. + */ ++ if (report->maxfield < 4) { ++ hid_err(hid, "not enough fields in the report: %d\n", ++ report->maxfield); ++ return -ENODEV; ++ } + for (i = 0; i < report->maxfield; i++) { ++ if (report->field[i]->report_count < 1) { ++ hid_err(hid, "no values in the field\n"); ++ return -ENODEV; ++ } + for (j = 0; j < report->field[i]->report_count; j++) { + report->field[i]->value[j] = 0x00; +- field_count++; + } + } + +- if (field_count < 4) { +- hid_err(hid, "not enough fields in the report: %d\n", +- field_count); +- return -ENODEV; +- } +- + betopff = kzalloc(sizeof(*betopff), GFP_KERNEL); + if (!betopff) + return -ENOMEM; +-- +2.39.0 + diff --git a/queue-5.4/hid-check-empty-report_list-in-bigben_probe.patch b/queue-5.4/hid-check-empty-report_list-in-bigben_probe.patch new file mode 100644 index 00000000000..55e34185d48 --- /dev/null +++ b/queue-5.4/hid-check-empty-report_list-in-bigben_probe.patch @@ -0,0 +1,43 @@ +From 950daff893b446bf0f2b8214c1cff69fadb4ed98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 11:11:25 +0000 +Subject: HID: check empty report_list in bigben_probe() + +From: Pietro Borrello + +[ Upstream commit c7bf714f875531f227f2ef1fdcc8f4d44e7c7d9d ] + +Add a check for empty report_list in bigben_probe(). +The missing check causes a type confusion when issuing a list_entry() +on an empty report_list. +The problem is caused by the assumption that the device must +have valid report_list. While this will be true for all normal HID +devices, a suitably malicious device can violate the assumption. + +Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") +Signed-off-by: Pietro Borrello +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-bigbenff.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index e8c5e3ac9fff..e8b16665860d 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -344,6 +344,11 @@ static int bigben_probe(struct hid_device *hid, + } + + report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; ++ if (list_empty(report_list)) { ++ hid_err(hid, "no output report found\n"); ++ error = -ENODEV; ++ goto error_hw_stop; ++ } + bigben->report = list_entry(report_list->next, + struct hid_report, list); + +-- +2.39.0 + diff --git a/queue-5.4/hid-check-empty-report_list-in-hid_validate_values.patch b/queue-5.4/hid-check-empty-report_list-in-hid_validate_values.patch new file mode 100644 index 00000000000..fe99be469d3 --- /dev/null +++ b/queue-5.4/hid-check-empty-report_list-in-hid_validate_values.patch @@ -0,0 +1,42 @@ +From a78741c21d80b7bcc5cdd3c1470a1752e5657569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 11:11:24 +0000 +Subject: HID: check empty report_list in hid_validate_values() + +From: Pietro Borrello + +[ Upstream commit b12fece4c64857e5fab4290bf01b2e0317a88456 ] + +Add a check for empty report_list in hid_validate_values(). +The missing check causes a type confusion when issuing a list_entry() +on an empty report_list. +The problem is caused by the assumption that the device must +have valid report_list. While this will be true for all normal HID +devices, a suitably malicious device can violate the assumption. + +Fixes: 1b15d2e5b807 ("HID: core: fix validation of report id 0") +Signed-off-by: Pietro Borrello +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index eda96c92977b..2888bd5502f3 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -981,8 +981,8 @@ struct hid_report *hid_validate_values(struct hid_device *hid, + * Validating on id 0 means we should examine the first + * report in the list. + */ +- report = list_entry( +- hid->report_enum[type].report_list.next, ++ report = list_first_entry_or_null( ++ &hid->report_enum[type].report_list, + struct hid_report, list); + } else { + report = hid->report_enum[type].report_id_hash[id]; +-- +2.39.0 + diff --git a/queue-5.4/hid-intel_ish-hid-add-check-for-ishtp_dma_tx_map.patch b/queue-5.4/hid-intel_ish-hid-add-check-for-ishtp_dma_tx_map.patch new file mode 100644 index 00000000000..83d7451cff5 --- /dev/null +++ b/queue-5.4/hid-intel_ish-hid-add-check-for-ishtp_dma_tx_map.patch @@ -0,0 +1,53 @@ +From b8b07e93b26c24e130cdb5044e13e6522c9ccc54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 21:48:23 +0800 +Subject: HID: intel_ish-hid: Add check for ishtp_dma_tx_map + +From: Jiasheng Jiang + +[ Upstream commit b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8 ] + +As the kcalloc may return NULL pointer, +it should be better to check the ishtp_dma_tx_map +before use in order to avoid NULL pointer dereference. + +Fixes: 3703f53b99e4 ("HID: intel_ish-hid: ISH Transport layer") +Signed-off-by: Jiasheng Jiang +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ishtp/dma-if.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/hid/intel-ish-hid/ishtp/dma-if.c b/drivers/hid/intel-ish-hid/ishtp/dma-if.c +index 40554c8daca0..00046cbfd4ed 100644 +--- a/drivers/hid/intel-ish-hid/ishtp/dma-if.c ++++ b/drivers/hid/intel-ish-hid/ishtp/dma-if.c +@@ -104,6 +104,11 @@ void *ishtp_cl_get_dma_send_buf(struct ishtp_device *dev, + int required_slots = (size / DMA_SLOT_SIZE) + + 1 * (size % DMA_SLOT_SIZE != 0); + ++ if (!dev->ishtp_dma_tx_map) { ++ dev_err(dev->devc, "Fail to allocate Tx map\n"); ++ return NULL; ++ } ++ + spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags); + for (i = 0; i <= (dev->ishtp_dma_num_slots - required_slots); i++) { + free = 1; +@@ -150,6 +155,11 @@ void ishtp_cl_release_dma_acked_mem(struct ishtp_device *dev, + return; + } + ++ if (!dev->ishtp_dma_tx_map) { ++ dev_err(dev->devc, "Fail to allocate Tx map\n"); ++ return; ++ } ++ + i = (msg_addr - dev->ishtp_host_dma_tx_buf) / DMA_SLOT_SIZE; + spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags); + for (j = 0; j < acked_slots; j++) { +-- +2.39.0 + diff --git a/queue-5.4/hid-revert-cherry_mouse_000c-quirk.patch b/queue-5.4/hid-revert-cherry_mouse_000c-quirk.patch new file mode 100644 index 00000000000..8749d8c62bc --- /dev/null +++ b/queue-5.4/hid-revert-cherry_mouse_000c-quirk.patch @@ -0,0 +1,49 @@ +From a562cefb77421fb53ca7530dcec0e8c643403e16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 15:41:40 +0100 +Subject: HID: revert CHERRY_MOUSE_000C quirk + +From: Jiri Kosina + +[ Upstream commit cbf44580ce6b310272a73e3e794233fd064330bd ] + +This partially reverts commit f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk +for some mice"), as it turns out to break reboot on some platforms for reason +yet to be understood. + +Fixes: f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk for some mice") +Reported-by: Christian Zigotzky +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 - + drivers/hid/hid-quirks.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 222f525c3d04..1c034c397e3e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -259,7 +259,6 @@ + #define USB_DEVICE_ID_CH_AXIS_295 0x001c + + #define USB_VENDOR_ID_CHERRY 0x046a +-#define USB_DEVICE_ID_CHERRY_MOUSE_000C 0x000c + #define USB_DEVICE_ID_CHERRY_CYMOTION 0x0023 + #define USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR 0x0027 + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index baad65fcdff7..e5dcc47586ee 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -54,7 +54,6 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, +- { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_MOUSE_000C), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.39.0 + diff --git a/queue-5.4/ib-hfi1-fix-expected-receive-setup-error-exit-issues.patch b/queue-5.4/ib-hfi1-fix-expected-receive-setup-error-exit-issues.patch new file mode 100644 index 00000000000..bdc2d1dfae4 --- /dev/null +++ b/queue-5.4/ib-hfi1-fix-expected-receive-setup-error-exit-issues.patch @@ -0,0 +1,170 @@ +From 8f2fc0b16764222aab1b8af3d74bc607003619f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 12:31:21 -0500 +Subject: IB/hfi1: Fix expected receive setup error exit issues + +From: Dean Luick + +[ Upstream commit e0c4a422f5246abefbf7c178ef99a1f2dc3c5f62 ] + +Fix three error exit issues in expected receive setup. +Re-arrange error exits to increase readability. + +Issues and fixes: +1. Possible missed page unpin if tidlist copyout fails and + not all pinned pages where made part of a TID. + Fix: Unpin the unused pages. + +2. Return success with unset return values tidcnt and length + when no pages were pinned. + Fix: Return -ENOSPC if no pages were pinned. + +3. Return success with unset return values tidcnt and length when + no rcvarray entries available. + Fix: Return -ENOSPC if no rcvarray entries are available. + +Fixes: 7e7a436ecb6e ("staging/hfi1: Add TID entry program function body") +Fixes: 97736f36dbeb ("IB/hfi1: Validate page aligned for a given virtual addres") +Fixes: f404ca4c7ea8 ("IB/hfi1: Refactor hfi_user_exp_rcv_setup() IOCTL") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167328548150.1472310.1492305874804187634.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 83 ++++++++++++++--------- + 1 file changed, 50 insertions(+), 33 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index 7623cb61ec4c..e7daa65589ab 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -337,15 +337,14 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets), + GFP_KERNEL); + if (!tidbuf->psets) { +- kfree(tidbuf); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto fail_release_mem; + } + + pinned = pin_rcv_pages(fd, tidbuf); + if (pinned <= 0) { +- kfree(tidbuf->psets); +- kfree(tidbuf); +- return pinned; ++ ret = (pinned < 0) ? pinned : -ENOSPC; ++ goto fail_unpin; + } + + /* Find sets of physically contiguous pages */ +@@ -360,14 +359,16 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + fd->tid_used += pageset_count; + spin_unlock(&fd->tid_lock); + +- if (!pageset_count) +- goto bail; ++ if (!pageset_count) { ++ ret = -ENOSPC; ++ goto fail_unreserve; ++ } + + ngroups = pageset_count / dd->rcv_entries.group_size; + tidlist = kcalloc(pageset_count, sizeof(*tidlist), GFP_KERNEL); + if (!tidlist) { + ret = -ENOMEM; +- goto nomem; ++ goto fail_unreserve; + } + + tididx = 0; +@@ -463,44 +464,60 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + } + unlock: + mutex_unlock(&uctxt->exp_mutex); +-nomem: + hfi1_cdbg(TID, "total mapped: tidpairs:%u pages:%u (%d)", tididx, + mapped_pages, ret); ++ ++ /* fail if nothing was programmed, set error if none provided */ ++ if (tididx == 0) { ++ if (ret >= 0) ++ ret = -ENOSPC; ++ goto fail_unreserve; ++ } ++ + /* adjust reserved tid_used to actual count */ + spin_lock(&fd->tid_lock); + fd->tid_used -= pageset_count - tididx; + spin_unlock(&fd->tid_lock); +- if (tididx) { +- tinfo->tidcnt = tididx; +- tinfo->length = mapped_pages * PAGE_SIZE; + +- if (copy_to_user(u64_to_user_ptr(tinfo->tidlist), +- tidlist, sizeof(tidlist[0]) * tididx)) { +- /* +- * On failure to copy to the user level, we need to undo +- * everything done so far so we don't leak resources. +- */ +- tinfo->tidlist = (unsigned long)&tidlist; +- hfi1_user_exp_rcv_clear(fd, tinfo); +- tinfo->tidlist = 0; +- ret = -EFAULT; +- goto bail; +- } ++ /* unpin all pages not covered by a TID */ ++ unpin_rcv_pages(fd, tidbuf, NULL, mapped_pages, pinned - mapped_pages, ++ false); ++ ++ tinfo->tidcnt = tididx; ++ tinfo->length = mapped_pages * PAGE_SIZE; ++ ++ if (copy_to_user(u64_to_user_ptr(tinfo->tidlist), ++ tidlist, sizeof(tidlist[0]) * tididx)) { ++ ret = -EFAULT; ++ goto fail_unprogram; + } + +- /* +- * If not everything was mapped (due to insufficient RcvArray entries, +- * for example), unpin all unmapped pages so we can pin them nex time. +- */ +- if (mapped_pages != pinned) +- unpin_rcv_pages(fd, tidbuf, NULL, mapped_pages, +- (pinned - mapped_pages), false); +-bail: ++ kfree(tidbuf->pages); + kfree(tidbuf->psets); ++ kfree(tidbuf); + kfree(tidlist); ++ return 0; ++ ++fail_unprogram: ++ /* unprogram, unmap, and unpin all allocated TIDs */ ++ tinfo->tidlist = (unsigned long)tidlist; ++ hfi1_user_exp_rcv_clear(fd, tinfo); ++ tinfo->tidlist = 0; ++ pinned = 0; /* nothing left to unpin */ ++ pageset_count = 0; /* nothing left reserved */ ++fail_unreserve: ++ spin_lock(&fd->tid_lock); ++ fd->tid_used -= pageset_count; ++ spin_unlock(&fd->tid_lock); ++fail_unpin: ++ if (pinned > 0) ++ unpin_rcv_pages(fd, tidbuf, NULL, 0, pinned, false); ++fail_release_mem: + kfree(tidbuf->pages); ++ kfree(tidbuf->psets); + kfree(tidbuf); +- return ret > 0 ? 0 : ret; ++ kfree(tidlist); ++ return ret; + } + + int hfi1_user_exp_rcv_clear(struct hfi1_filedata *fd, +-- +2.39.0 + diff --git a/queue-5.4/ib-hfi1-reject-a-zero-length-user-expected-buffer.patch b/queue-5.4/ib-hfi1-reject-a-zero-length-user-expected-buffer.patch new file mode 100644 index 00000000000..9eb7eb41810 --- /dev/null +++ b/queue-5.4/ib-hfi1-reject-a-zero-length-user-expected-buffer.patch @@ -0,0 +1,39 @@ +From f62a51480a504893b33c14a455a956f9ac24b661 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 12:31:11 -0500 +Subject: IB/hfi1: Reject a zero-length user expected buffer + +From: Dean Luick + +[ Upstream commit 0a0a6e80472c98947d73c3d13bcd7d101895f55d ] + +A zero length user buffer makes no sense and the code +does not handle it correctly. Instead, reject a +zero length as invalid. + +Fixes: 97736f36dbeb ("IB/hfi1: Validate page aligned for a given virtual addres") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167328547120.1472310.6362802432127399257.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index 4d732353379d..28f1b3c37a4f 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -325,6 +325,8 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + + if (!PAGE_ALIGNED(tinfo->vaddr)) + return -EINVAL; ++ if (tinfo->length == 0) ++ return -EINVAL; + + tidbuf = kzalloc(sizeof(*tidbuf), GFP_KERNEL); + if (!tidbuf) +-- +2.39.0 + diff --git a/queue-5.4/ib-hfi1-reserve-user-expected-tids.patch b/queue-5.4/ib-hfi1-reserve-user-expected-tids.patch new file mode 100644 index 00000000000..8f31b663b3b --- /dev/null +++ b/queue-5.4/ib-hfi1-reserve-user-expected-tids.patch @@ -0,0 +1,63 @@ +From d2d368f66f76dced51343a8edff17dd21b44c820 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 12:31:16 -0500 +Subject: IB/hfi1: Reserve user expected TIDs + +From: Dean Luick + +[ Upstream commit ecf91551cdd2925ed6d9a9d99074fa5f67b90596 ] + +To avoid a race, reserve the number of user expected +TIDs before setup. + +Fixes: 7e7a436ecb6e ("staging/hfi1: Add TID entry program function body") +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167328547636.1472310.7419712824785353905.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index 28f1b3c37a4f..7623cb61ec4c 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -351,16 +351,13 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + /* Find sets of physically contiguous pages */ + tidbuf->n_psets = find_phys_blocks(tidbuf, pinned); + +- /* +- * We don't need to access this under a lock since tid_used is per +- * process and the same process cannot be in hfi1_user_exp_rcv_clear() +- * and hfi1_user_exp_rcv_setup() at the same time. +- */ ++ /* Reserve the number of expected tids to be used. */ + spin_lock(&fd->tid_lock); + if (fd->tid_used + tidbuf->n_psets > fd->tid_limit) + pageset_count = fd->tid_limit - fd->tid_used; + else + pageset_count = tidbuf->n_psets; ++ fd->tid_used += pageset_count; + spin_unlock(&fd->tid_lock); + + if (!pageset_count) +@@ -469,10 +466,11 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + nomem: + hfi1_cdbg(TID, "total mapped: tidpairs:%u pages:%u (%d)", tididx, + mapped_pages, ret); ++ /* adjust reserved tid_used to actual count */ ++ spin_lock(&fd->tid_lock); ++ fd->tid_used -= pageset_count - tididx; ++ spin_unlock(&fd->tid_lock); + if (tididx) { +- spin_lock(&fd->tid_lock); +- fd->tid_used += tididx; +- spin_unlock(&fd->tid_lock); + tinfo->tidcnt = tididx; + tinfo->length = mapped_pages * PAGE_SIZE; + +-- +2.39.0 + diff --git a/queue-5.4/kvm-s390-interrupt-use-read_once-before-cmpxchg.patch b/queue-5.4/kvm-s390-interrupt-use-read_once-before-cmpxchg.patch new file mode 100644 index 00000000000..3c8759ebea6 --- /dev/null +++ b/queue-5.4/kvm-s390-interrupt-use-read_once-before-cmpxchg.patch @@ -0,0 +1,72 @@ +From ebaa154deb3de9b130c54d78122fab57b1e6101b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 15:54:56 +0100 +Subject: KVM: s390: interrupt: use READ_ONCE() before cmpxchg() + +From: Heiko Carstens + +[ Upstream commit 42400d99e9f0728c17240edb9645637ead40f6b9 ] + +Use READ_ONCE() before cmpxchg() to prevent that the compiler generates +code that fetches the to be compared old value several times from memory. + +Reviewed-by: Christian Borntraeger +Acked-by: Christian Borntraeger +Reviewed-by: Claudio Imbrenda +Link: https://lore.kernel.org/r/20230109145456.2895385-1-hca@linux.ibm.com +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/interrupt.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c +index 8be5750fe5ac..a180fe54dc68 100644 +--- a/arch/s390/kvm/interrupt.c ++++ b/arch/s390/kvm/interrupt.c +@@ -81,8 +81,9 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id) + struct esca_block *sca = vcpu->kvm->arch.sca; + union esca_sigp_ctrl *sigp_ctrl = + &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); +- union esca_sigp_ctrl new_val = {0}, old_val = *sigp_ctrl; ++ union esca_sigp_ctrl new_val = {0}, old_val; + ++ old_val = READ_ONCE(*sigp_ctrl); + new_val.scn = src_id; + new_val.c = 1; + old_val.c = 0; +@@ -93,8 +94,9 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id) + struct bsca_block *sca = vcpu->kvm->arch.sca; + union bsca_sigp_ctrl *sigp_ctrl = + &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); +- union bsca_sigp_ctrl new_val = {0}, old_val = *sigp_ctrl; ++ union bsca_sigp_ctrl new_val = {0}, old_val; + ++ old_val = READ_ONCE(*sigp_ctrl); + new_val.scn = src_id; + new_val.c = 1; + old_val.c = 0; +@@ -124,16 +126,18 @@ static void sca_clear_ext_call(struct kvm_vcpu *vcpu) + struct esca_block *sca = vcpu->kvm->arch.sca; + union esca_sigp_ctrl *sigp_ctrl = + &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); +- union esca_sigp_ctrl old = *sigp_ctrl; ++ union esca_sigp_ctrl old; + ++ old = READ_ONCE(*sigp_ctrl); + expect = old.value; + rc = cmpxchg(&sigp_ctrl->value, old.value, 0); + } else { + struct bsca_block *sca = vcpu->kvm->arch.sca; + union bsca_sigp_ctrl *sigp_ctrl = + &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); +- union bsca_sigp_ctrl old = *sigp_ctrl; ++ union bsca_sigp_ctrl old; + ++ old = READ_ONCE(*sigp_ctrl); + expect = old.value; + rc = cmpxchg(&sigp_ctrl->value, old.value, 0); + } +-- +2.39.0 + diff --git a/queue-5.4/l2tp-don-t-sleep-and-disable-bh-under-writer-side-sk.patch b/queue-5.4/l2tp-don-t-sleep-and-disable-bh-under-writer-side-sk.patch new file mode 100644 index 00000000000..5b53be35bf4 --- /dev/null +++ b/queue-5.4/l2tp-don-t-sleep-and-disable-bh-under-writer-side-sk.patch @@ -0,0 +1,127 @@ +From 58bb12c176c9c3a79792d2de604658e095056be5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 09:54:26 +0100 +Subject: l2tp: Don't sleep and disable BH under writer-side sk_callback_lock + +From: Jakub Sitnicki + +[ Upstream commit af295e854a4e3813ffbdef26dbb6a4d6226c3ea1 ] + +When holding a reader-writer spin lock we cannot sleep. Calling +setup_udp_tunnel_sock() with write lock held violates this rule, because we +end up calling percpu_down_read(), which might sleep, as syzbot reports +[1]: + + __might_resched.cold+0x222/0x26b kernel/sched/core.c:9890 + percpu_down_read include/linux/percpu-rwsem.h:49 [inline] + cpus_read_lock+0x1b/0x140 kernel/cpu.c:310 + static_key_slow_inc+0x12/0x20 kernel/jump_label.c:158 + udp_tunnel_encap_enable include/net/udp_tunnel.h:187 [inline] + setup_udp_tunnel_sock+0x43d/0x550 net/ipv4/udp_tunnel_core.c:81 + l2tp_tunnel_register+0xc51/0x1210 net/l2tp/l2tp_core.c:1509 + pppol2tp_connect+0xcdc/0x1a10 net/l2tp/l2tp_ppp.c:723 + +Trim the writer-side critical section for sk_callback_lock down to the +minimum, so that it covers only operations on sk_user_data. + +Also, when grabbing the sk_callback_lock, we always need to disable BH, as +Eric points out. Failing to do so leads to deadlocks because we acquire +sk_callback_lock in softirq context, which can get stuck waiting on us if: + +1) it runs on the same CPU, or + + CPU0 + ---- + lock(clock-AF_INET6); + + lock(clock-AF_INET6); + +2) lock ordering leads to priority inversion + + CPU0 CPU1 + ---- ---- + lock(clock-AF_INET6); + local_irq_disable(); + lock(&tcp_hashinfo.bhash[i].lock); + lock(clock-AF_INET6); + + lock(&tcp_hashinfo.bhash[i].lock); + +... as syzbot reports [2,3]. Use the _bh variants for write_(un)lock. + +[1] https://lore.kernel.org/netdev/0000000000004e78ec05eda79749@google.com/ +[2] https://lore.kernel.org/netdev/000000000000e38b6605eda76f98@google.com/ +[3] https://lore.kernel.org/netdev/000000000000dfa31e05eda76f75@google.com/ + +v2: +- Check and set sk_user_data while holding sk_callback_lock for both + L2TP encapsulation types (IP and UDP) (Tetsuo) + +Cc: Tom Parkin +Cc: Tetsuo Handa +Fixes: b68777d54fac ("l2tp: Serialize access to sk_user_data with sk_callback_lock") +Reported-by: Eric Dumazet +Reported-by: syzbot+703d9e154b3b58277261@syzkaller.appspotmail.com +Reported-by: syzbot+50680ced9e98a61f7698@syzkaller.appspotmail.com +Reported-by: syzbot+de987172bb74a381879b@syzkaller.appspotmail.com +Signed-off-by: Jakub Sitnicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_core.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 0e0f3e96b80e..d001e254bada 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1496,11 +1496,12 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + } + + sk = sock->sk; +- write_lock(&sk->sk_callback_lock); +- ++ write_lock_bh(&sk->sk_callback_lock); + ret = l2tp_validate_socket(sk, net, tunnel->encap); + if (ret < 0) +- goto err_sock; ++ goto err_inval_sock; ++ rcu_assign_sk_user_data(sk, tunnel); ++ write_unlock_bh(&sk->sk_callback_lock); + + tunnel->l2tp_net = net; + pn = l2tp_pernet(net); +@@ -1529,8 +1530,6 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + }; + + setup_udp_tunnel_sock(net, sock, &udp_cfg); +- } else { +- rcu_assign_sk_user_data(sk, tunnel); + } + + tunnel->old_sk_destruct = sk->sk_destruct; +@@ -1542,16 +1541,18 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + if (tunnel->fd >= 0) + sockfd_put(sock); + +- write_unlock(&sk->sk_callback_lock); + return 0; + + err_sock: ++ write_lock_bh(&sk->sk_callback_lock); ++ rcu_assign_sk_user_data(sk, NULL); ++err_inval_sock: ++ write_unlock_bh(&sk->sk_callback_lock); ++ + if (tunnel->fd < 0) + sock_release(sock); + else + sockfd_put(sock); +- +- write_unlock(&sk->sk_callback_lock); + err: + return ret; + } +-- +2.39.0 + diff --git a/queue-5.4/l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch b/queue-5.4/l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch new file mode 100644 index 00000000000..3fa2ab88c42 --- /dev/null +++ b/queue-5.4/l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch @@ -0,0 +1,122 @@ +From 6f8bb70c85d6f6f0abdf8e6a89303b930991a0f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 20:16:19 +0100 +Subject: l2tp: Serialize access to sk_user_data with sk_callback_lock + +From: Jakub Sitnicki + +[ Upstream commit b68777d54fac21fc833ec26ea1a2a84f975ab035 ] + +sk->sk_user_data has multiple users, which are not compatible with each +other. Writers must synchronize by grabbing the sk->sk_callback_lock. + +l2tp currently fails to grab the lock when modifying the underlying tunnel +socket fields. Fix it by adding appropriate locking. + +We err on the side of safety and grab the sk_callback_lock also inside the +sk_destruct callback overridden by l2tp, even though there should be no +refs allowing access to the sock at the time when sk_destruct gets called. + +v4: +- serialize write to sk_user_data in l2tp sk_destruct + +v3: +- switch from sock lock to sk_callback_lock +- document write-protection for sk_user_data + +v2: +- update Fixes to point to origin of the bug +- use real names in Reported/Tested-by tags + +Cc: Tom Parkin +Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core") +Reported-by: Haowei Yan +Signed-off-by: Jakub Sitnicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 2 +- + net/l2tp/l2tp_core.c | 19 +++++++++++++------ + 2 files changed, 14 insertions(+), 7 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index f508e86a2021..5fa255b1e0a6 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -300,7 +300,7 @@ struct bpf_sk_storage; + * @sk_tskey: counter to disambiguate concurrent tstamp requests + * @sk_zckey: counter to order MSG_ZEROCOPY notifications + * @sk_socket: Identd and reporting IO signals +- * @sk_user_data: RPC layer private data ++ * @sk_user_data: RPC layer private data. Write-protected by @sk_callback_lock. + * @sk_frag: cached page frag + * @sk_peek_off: current peek_offset value + * @sk_send_head: front of stuff to transmit +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index a0ec61f2295b..0e0f3e96b80e 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1171,8 +1171,10 @@ static void l2tp_tunnel_destruct(struct sock *sk) + } + + /* Remove hooks into tunnel socket */ ++ write_lock_bh(&sk->sk_callback_lock); + sk->sk_destruct = tunnel->old_sk_destruct; + sk->sk_user_data = NULL; ++ write_unlock_bh(&sk->sk_callback_lock); + + /* Call the original destructor */ + if (sk->sk_destruct) +@@ -1491,16 +1493,18 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + sock = sockfd_lookup(tunnel->fd, &ret); + if (!sock) + goto err; +- +- ret = l2tp_validate_socket(sock->sk, net, tunnel->encap); +- if (ret < 0) +- goto err_sock; + } + ++ sk = sock->sk; ++ write_lock(&sk->sk_callback_lock); ++ ++ ret = l2tp_validate_socket(sk, net, tunnel->encap); ++ if (ret < 0) ++ goto err_sock; ++ + tunnel->l2tp_net = net; + pn = l2tp_pernet(net); + +- sk = sock->sk; + sock_hold(sk); + tunnel->sock = sk; + +@@ -1526,7 +1530,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + + setup_udp_tunnel_sock(net, sock, &udp_cfg); + } else { +- sk->sk_user_data = tunnel; ++ rcu_assign_sk_user_data(sk, tunnel); + } + + tunnel->old_sk_destruct = sk->sk_destruct; +@@ -1538,6 +1542,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + if (tunnel->fd >= 0) + sockfd_put(sock); + ++ write_unlock(&sk->sk_callback_lock); + return 0; + + err_sock: +@@ -1545,6 +1550,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + sock_release(sock); + else + sockfd_put(sock); ++ ++ write_unlock(&sk->sk_callback_lock); + err: + return ret; + } +-- +2.39.0 + diff --git a/queue-5.4/lockref-stop-doing-cpu_relax-in-the-cmpxchg-loop.patch b/queue-5.4/lockref-stop-doing-cpu_relax-in-the-cmpxchg-loop.patch new file mode 100644 index 00000000000..73fa38dad6b --- /dev/null +++ b/queue-5.4/lockref-stop-doing-cpu_relax-in-the-cmpxchg-loop.patch @@ -0,0 +1,107 @@ +From bdd48919f79375a278810c1349985a9cb8b62f91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 19:44:47 +0100 +Subject: lockref: stop doing cpu_relax in the cmpxchg loop + +From: Mateusz Guzik + +[ Upstream commit f5fe24ef17b5fbe6db49534163e77499fb10ae8c ] + +On the x86-64 architecture even a failing cmpxchg grants exclusive +access to the cacheline, making it preferable to retry the failed op +immediately instead of stalling with the pause instruction. + +To illustrate the impact, below are benchmark results obtained by +running various will-it-scale tests on top of the 6.2-rc3 kernel and +Cascade Lake (2 sockets * 24 cores * 2 threads) CPU. + +All results in ops/s. Note there is some variance in re-runs, but the +code is consistently faster when contention is present. + + open3 ("Same file open/close"): + proc stock no-pause + 1 805603 814942 (+%1) + 2 1054980 1054781 (-0%) + 8 1544802 1822858 (+18%) + 24 1191064 2199665 (+84%) + 48 851582 1469860 (+72%) + 96 609481 1427170 (+134%) + + fstat2 ("Same file fstat"): + proc stock no-pause + 1 3013872 3047636 (+1%) + 2 4284687 4400421 (+2%) + 8 3257721 5530156 (+69%) + 24 2239819 5466127 (+144%) + 48 1701072 5256609 (+209%) + 96 1269157 6649326 (+423%) + +Additionally, a kernel with a private patch to help access() scalability: +access2 ("Same file access"): + + proc stock patched patched + +nopause + 24 2378041 2005501 5370335 (-15% / +125%) + +That is, fixing the problems in access itself *reduces* scalability +after the cacheline ping-pong only happens in lockref with the pause +instruction. + +Note that fstat and access benchmarks are not currently integrated into +will-it-scale, but interested parties can find them in pull requests to +said project. + +Code at hand has a rather tortured history. First modification showed +up in commit d472d9d98b46 ("lockref: Relax in cmpxchg loop"), written +with Itanium in mind. Later it got patched up to use an arch-dependent +macro to stop doing it on s390 where it caused a significant regression. +Said macro had undergone revisions and was ultimately eliminated later, +going back to cpu_relax. + +While I intended to only remove cpu_relax for x86-64, I got the +following comment from Linus: + + I would actually prefer just removing it entirely and see if + somebody else hollers. You have the numbers to prove it hurts on + real hardware, and I don't think we have any numbers to the + contrary. + + So I think it's better to trust the numbers and remove it as a + failure, than say "let's just remove it on x86-64 and leave + everybody else with the potentially broken code" + +Additionally, Will Deacon (maintainer of the arm64 port, one of the +architectures previously benchmarked): + + So, from the arm64 side of the fence, I'm perfectly happy just + removing the cpu_relax() calls from lockref. + +As such, come back full circle in history and whack it altogether. + +Signed-off-by: Mateusz Guzik +Link: https://lore.kernel.org/all/CAGudoHHx0Nqg6DE70zAVA75eV-HXfWyhVMWZ-aSeOofkA_=WdA@mail.gmail.com/ +Acked-by: Tony Luck # ia64 +Acked-by: Nicholas Piggin # powerpc +Acked-by: Will Deacon # arm64 +Acked-by: Peter Zijlstra +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/lockref.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/lib/lockref.c b/lib/lockref.c +index 5b34bbd3eba8..81ac5f355242 100644 +--- a/lib/lockref.c ++++ b/lib/lockref.c +@@ -24,7 +24,6 @@ + } \ + if (!--retry) \ + break; \ +- cpu_relax(); \ + } \ + } while (0) + +-- +2.39.0 + diff --git a/queue-5.4/memory-atmel-sdramc-fix-missing-clk_disable_unprepar.patch b/queue-5.4/memory-atmel-sdramc-fix-missing-clk_disable_unprepar.patch new file mode 100644 index 00000000000..c0d1aea2f16 --- /dev/null +++ b/queue-5.4/memory-atmel-sdramc-fix-missing-clk_disable_unprepar.patch @@ -0,0 +1,52 @@ +From 4d7a17f03631d7924cdca46f7fe040b6644511f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 15:37:57 +0800 +Subject: memory: atmel-sdramc: Fix missing clk_disable_unprepare in + atmel_ramc_probe() + +From: Gaosheng Cui + +[ Upstream commit 340cb392a038cf70540a4cdf2e98a247c66b6df4 ] + +The clk_disable_unprepare() should be called in the error handling +of caps->has_mpddr_clk, fix it by replacing devm_clk_get and +clk_prepare_enable by devm_clk_get_enabled. + +Fixes: e81b6abebc87 ("memory: add a driver for atmel ram controllers") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221125073757.3535219-1-cuigaosheng1@huawei.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/atmel-sdramc.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/memory/atmel-sdramc.c b/drivers/memory/atmel-sdramc.c +index 9c49d00c2a96..ea6e9e1eaf04 100644 +--- a/drivers/memory/atmel-sdramc.c ++++ b/drivers/memory/atmel-sdramc.c +@@ -47,19 +47,17 @@ static int atmel_ramc_probe(struct platform_device *pdev) + caps = of_device_get_match_data(&pdev->dev); + + if (caps->has_ddrck) { +- clk = devm_clk_get(&pdev->dev, "ddrck"); ++ clk = devm_clk_get_enabled(&pdev->dev, "ddrck"); + if (IS_ERR(clk)) + return PTR_ERR(clk); +- clk_prepare_enable(clk); + } + + if (caps->has_mpddr_clk) { +- clk = devm_clk_get(&pdev->dev, "mpddr"); ++ clk = devm_clk_get_enabled(&pdev->dev, "mpddr"); + if (IS_ERR(clk)) { + pr_err("AT91 RAMC: couldn't get mpddr clock\n"); + return PTR_ERR(clk); + } +- clk_prepare_enable(clk); + } + + return 0; +-- +2.39.0 + diff --git a/queue-5.4/memory-mvebu-devbus-fix-missing-clk_disable_unprepar.patch b/queue-5.4/memory-mvebu-devbus-fix-missing-clk_disable_unprepar.patch new file mode 100644 index 00000000000..f1bd7d3e89d --- /dev/null +++ b/queue-5.4/memory-mvebu-devbus-fix-missing-clk_disable_unprepar.patch @@ -0,0 +1,42 @@ +From 7f23f601a0b78308598c1a264fb580871e544b20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Nov 2022 12:49:11 +0800 +Subject: memory: mvebu-devbus: Fix missing clk_disable_unprepare in + mvebu_devbus_probe() + +From: Gaosheng Cui + +[ Upstream commit cb8fd6f75775165390ededea8799b60d93d9fe3e ] + +The clk_disable_unprepare() should be called in the error handling +of devbus_get_timing_params() and of_platform_populate(), fix it by +replacing devm_clk_get and clk_prepare_enable by devm_clk_get_enabled. + +Fixes: e81b6abebc87 ("memory: add a driver for atmel ram controllers") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221126044911.7226-1-cuigaosheng1@huawei.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/mvebu-devbus.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/memory/mvebu-devbus.c b/drivers/memory/mvebu-devbus.c +index 095f8a3b2cfc..9bf477b000c0 100644 +--- a/drivers/memory/mvebu-devbus.c ++++ b/drivers/memory/mvebu-devbus.c +@@ -282,10 +282,9 @@ static int mvebu_devbus_probe(struct platform_device *pdev) + if (IS_ERR(devbus->base)) + return PTR_ERR(devbus->base); + +- clk = devm_clk_get(&pdev->dev, NULL); ++ clk = devm_clk_get_enabled(&pdev->dev, NULL); + if (IS_ERR(clk)) + return PTR_ERR(clk); +- clk_prepare_enable(clk); + + /* + * Obtain clock period in picoseconds, +-- +2.39.0 + diff --git a/queue-5.4/mmc-sdhci-esdhc-imx-clear-pending-interrupt-and-halt.patch b/queue-5.4/mmc-sdhci-esdhc-imx-clear-pending-interrupt-and-halt.patch new file mode 100644 index 00000000000..3d974d71f58 --- /dev/null +++ b/queue-5.4/mmc-sdhci-esdhc-imx-clear-pending-interrupt-and-halt.patch @@ -0,0 +1,101 @@ +From c84a679516f3b36920e2b9b1086ba47e8a515cdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2020 16:25:54 +0800 +Subject: mmc: sdhci-esdhc-imx: clear pending interrupt and halt cqhci + +From: Haibo Chen + +[ Upstream commit 982cf37da3ee0f1e3e20d97e19f13cba79be51c7 ] + +On i.MX8MM, we are running Dual Linux OS, with 1st Linux using SD Card +as rootfs storage, 2nd Linux using eMMC as rootfs storage. We let the +the 1st linux configure power/clock for the 2nd Linux. + +When the 2nd Linux is booting into rootfs stage, we let the 1st Linux +to destroy the 2nd linux, then restart the 2nd linux, we met SDHCI dump +as following, after we clear the pending interrupt and halt CQCTL, issue +gone. + +[ 1.334594] mmc2: Got command interrupt 0x00000001 even though no command operation was in progress. +[ 1.334595] mmc2: sdhci: ============ SDHCI REGISTER DUMP =========== +[ 1.334599] mmc2: sdhci: Sys addr: 0xa05dcc00 | Version: 0x00000002 +[ 1.345538] mmc2: sdhci: Blk size: 0x00000200 | Blk cnt: 0x00000000 +[ 1.345541] mmc2: sdhci: Argument: 0x00018000 | Trn mode: 0x00000033 +[ 1.345543] mmc2: sdhci: Present: 0x01f88008 | Host ctl: 0x00000031 +[ 1.345547] mmc2: sdhci: Power: 0x00000002 | Blk gap: 0x00000080 +[ 1.357903] mmc2: sdhci: Wake-up: 0x00000008 | Clock: 0x0000003f +[ 1.357905] mmc2: sdhci: Timeout: 0x0000008f | Int stat: 0x00000000 +[ 1.357908] mmc2: sdhci: Int enab: 0x107f100b | Sig enab: 0x107f100b +[ 1.357911] mmc2: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000502 +[ 1.370268] mmc2: sdhci: Caps: 0x07eb0000 | Caps_1: 0x0000b400 +[ 1.370270] mmc2: sdhci: Cmd: 0x00000d1a | Max curr: 0x00ffffff +[ 1.370273] mmc2: sdhci: Resp[0]: 0x00000b00 | Resp[1]: 0xffffffff +[ 1.370276] mmc2: sdhci: Resp[2]: 0x328f5903 | Resp[3]: 0x00d00f00 +[ 1.382132] mmc2: sdhci: Host ctl2: 0x00000000 +[ 1.382135] mmc2: sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0xa2040208 + +[ 2.060932] mmc2: Unexpected interrupt 0x00004000. +[ 2.065538] mmc2: sdhci: ============ SDHCI REGISTER DUMP =========== +[ 2.071720] mmc2: sdhci: Sys addr: 0x00000000 | Version: 0x00000002 +[ 2.077902] mmc2: sdhci: Blk size: 0x00000200 | Blk cnt: 0x00000001 +[ 2.084083] mmc2: sdhci: Argument: 0x00000000 | Trn mode: 0x00000000 +[ 2.090264] mmc2: sdhci: Present: 0x01f88009 | Host ctl: 0x00000011 +[ 2.096446] mmc2: sdhci: Power: 0x00000002 | Blk gap: 0x00000080 +[ 2.102627] mmc2: sdhci: Wake-up: 0x00000008 | Clock: 0x000010ff +[ 2.108809] mmc2: sdhci: Timeout: 0x0000008f | Int stat: 0x00004000 +[ 2.114990] mmc2: sdhci: Int enab: 0x007f1003 | Sig enab: 0x007f1003 +[ 2.121171] mmc2: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000502 +[ 2.127353] mmc2: sdhci: Caps: 0x07eb0000 | Caps_1: 0x0000b400 +[ 2.133534] mmc2: sdhci: Cmd: 0x0000371a | Max curr: 0x00ffffff +[ 2.139715] mmc2: sdhci: Resp[0]: 0x00000900 | Resp[1]: 0xffffffff +[ 2.145896] mmc2: sdhci: Resp[2]: 0x328f5903 | Resp[3]: 0x00d00f00 +[ 2.152077] mmc2: sdhci: Host ctl2: 0x00000000 +[ 2.156342] mmc2: sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0x00000000 + +Signed-off-by: Haibo Chen +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/1582100757-20683-6-git-send-email-haibo.chen@nxp.com +Signed-off-by: Ulf Hansson +Stable-dep-of: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting") +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index 96cad561e1d8..22bb5499f515 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -1180,6 +1180,7 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) + { + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); ++ struct cqhci_host *cq_host = host->mmc->cqe_private; + int tmp; + + if (esdhc_is_usdhc(imx_data)) { +@@ -1256,6 +1257,21 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) + tmp &= ~ESDHC_STD_TUNING_EN; + writel(tmp, host->ioaddr + ESDHC_TUNING_CTRL); + } ++ ++ /* ++ * On i.MX8MM, we are running Dual Linux OS, with 1st Linux using SD Card ++ * as rootfs storage, 2nd Linux using eMMC as rootfs storage. We let the ++ * the 1st linux configure power/clock for the 2nd Linux. ++ * ++ * When the 2nd Linux is booting into rootfs stage, we let the 1st Linux ++ * to destroy the 2nd linux, then restart the 2nd linux, we met SDHCI dump. ++ * After we clear the pending interrupt and halt CQCTL, issue gone. ++ */ ++ if (cq_host) { ++ tmp = cqhci_readl(cq_host, CQHCI_IS); ++ cqhci_writel(cq_host, tmp, CQHCI_IS); ++ cqhci_writel(cq_host, CQHCI_HALT, CQHCI_CTL); ++ } + } + } + +-- +2.39.0 + diff --git a/queue-5.4/mmc-sdhci-esdhc-imx-correct-the-tuning-start-tap-and.patch b/queue-5.4/mmc-sdhci-esdhc-imx-correct-the-tuning-start-tap-and.patch new file mode 100644 index 00000000000..7473556bec6 --- /dev/null +++ b/queue-5.4/mmc-sdhci-esdhc-imx-correct-the-tuning-start-tap-and.patch @@ -0,0 +1,78 @@ +From ea76c40adeeb9a88d061fea716c48d4e8fbefd3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 19:23:15 +0800 +Subject: mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting + +From: Haibo Chen + +[ Upstream commit 1e336aa0c0250ec84c6f16efac40c9f0138e367d ] + +Current code logic may be impacted by the setting of ROM/Bootloader, +so unmask these bits first, then setting these bits accordingly. + +Fixes: 2b16cf326b70 ("mmc: sdhci-esdhc-imx: move tuning static configuration into hwinit function") +Signed-off-by: Haibo Chen +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20221207112315.1812222-1-haibo.chen@nxp.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index 453ac2b6910c..b3f761eca829 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -90,6 +90,7 @@ + #define ESDHC_TUNING_START_TAP_DEFAULT 0x1 + #define ESDHC_TUNING_START_TAP_MASK 0x7f + #define ESDHC_TUNING_CMD_CRC_CHECK_DISABLE (1 << 7) ++#define ESDHC_TUNING_STEP_DEFAULT 0x1 + #define ESDHC_TUNING_STEP_MASK 0x00070000 + #define ESDHC_TUNING_STEP_SHIFT 16 + +@@ -1182,7 +1183,7 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); + struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); + struct cqhci_host *cq_host = host->mmc->cqe_private; +- int tmp; ++ u32 tmp; + + if (esdhc_is_usdhc(imx_data)) { + /* +@@ -1235,17 +1236,24 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) + + if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) { + tmp = readl(host->ioaddr + ESDHC_TUNING_CTRL); +- tmp |= ESDHC_STD_TUNING_EN | +- ESDHC_TUNING_START_TAP_DEFAULT; +- if (imx_data->boarddata.tuning_start_tap) { +- tmp &= ~ESDHC_TUNING_START_TAP_MASK; ++ tmp |= ESDHC_STD_TUNING_EN; ++ ++ /* ++ * ROM code or bootloader may config the start tap ++ * and step, unmask them first. ++ */ ++ tmp &= ~(ESDHC_TUNING_START_TAP_MASK | ESDHC_TUNING_STEP_MASK); ++ if (imx_data->boarddata.tuning_start_tap) + tmp |= imx_data->boarddata.tuning_start_tap; +- } ++ else ++ tmp |= ESDHC_TUNING_START_TAP_DEFAULT; + + if (imx_data->boarddata.tuning_step) { +- tmp &= ~ESDHC_TUNING_STEP_MASK; + tmp |= imx_data->boarddata.tuning_step + << ESDHC_TUNING_STEP_SHIFT; ++ } else { ++ tmp |= ESDHC_TUNING_STEP_DEFAULT ++ << ESDHC_TUNING_STEP_SHIFT; + } + + /* Disable the CMD CRC check for tuning, if not, need to +-- +2.39.0 + diff --git a/queue-5.4/mmc-sdhci-esdhc-imx-disable-the-cmd-crc-check-for-st.patch b/queue-5.4/mmc-sdhci-esdhc-imx-disable-the-cmd-crc-check-for-st.patch new file mode 100644 index 00000000000..3c118986ded --- /dev/null +++ b/queue-5.4/mmc-sdhci-esdhc-imx-disable-the-cmd-crc-check-for-st.patch @@ -0,0 +1,80 @@ +From a737405165d4a54e7c23ce433d05344ffaa58038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 May 2020 18:22:02 +0800 +Subject: mmc: sdhci-esdhc-imx: disable the CMD CRC check for standard tuning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Haibo Chen + +[ Upstream commit 16e40e5b1e3c6646fd90d0c3186703d209216f03 ] + +In current code, we add 1ms dealy after each tuning command for standard +tuning method. Adding this 1ms dealy is because USDHC default check the +CMD CRC and DATA line. If detect the CMD CRC, USDHC standard tuning +IC logic do not wait for the tuning data sending out by the card, trigger +the buffer read ready interrupt immediately, and step to next cycle. So +when next time the new tuning command send out by USDHC, card may still +not send out the tuning data of the upper command，then some eMMC cards +may stuck, can't response to any command, block the whole tuning procedure. + +If do not check the CMD CRC for tuning, then do not has this issue. USDHC +will wait for the tuning data of each tuning command and check them. If the +tuning data pass the check, it also means the CMD line also okay for tuning. + +So this patch disable the CMD CRC check for tuning, save some time for the +whole tuning procedure. + +Signed-off-by: Haibo Chen +Link: https://lore.kernel.org/r/1590488522-9292-2-git-send-email-haibo.chen@nxp.com +Signed-off-by: Ulf Hansson +Stable-dep-of: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting") +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-esdhc-imx.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index 22bb5499f515..453ac2b6910c 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -89,6 +89,7 @@ + /* NOTE: the minimum valid tuning start tap for mx6sl is 1 */ + #define ESDHC_TUNING_START_TAP_DEFAULT 0x1 + #define ESDHC_TUNING_START_TAP_MASK 0x7f ++#define ESDHC_TUNING_CMD_CRC_CHECK_DISABLE (1 << 7) + #define ESDHC_TUNING_STEP_MASK 0x00070000 + #define ESDHC_TUNING_STEP_SHIFT 16 + +@@ -1246,6 +1247,18 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) + tmp |= imx_data->boarddata.tuning_step + << ESDHC_TUNING_STEP_SHIFT; + } ++ ++ /* Disable the CMD CRC check for tuning, if not, need to ++ * add some delay after every tuning command, because ++ * hardware standard tuning logic will directly go to next ++ * step once it detect the CMD CRC error, will not wait for ++ * the card side to finally send out the tuning data, trigger ++ * the buffer read ready interrupt immediately. If usdhc send ++ * the next tuning command some eMMC card will stuck, can't ++ * response, block the tuning procedure or the first command ++ * after the whole tuning procedure always can't get any response. ++ */ ++ tmp |= ESDHC_TUNING_CMD_CRC_CHECK_DISABLE; + writel(tmp, host->ioaddr + ESDHC_TUNING_CTRL); + } else if (imx_data->socdata->flags & ESDHC_FLAG_MAN_TUNING) { + /* +@@ -1587,8 +1600,6 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev) + if (err) + goto disable_ahb_clk; + +- host->tuning_delay = 1; +- + sdhci_esdhc_imx_hwinit(host); + + err = sdhci_add_host(host); +-- +2.39.0 + diff --git a/queue-5.4/net-dsa-microchip-ksz9477-port-map-correction-in-alu.patch b/queue-5.4/net-dsa-microchip-ksz9477-port-map-correction-in-alu.patch new file mode 100644 index 00000000000..34ad0552fba --- /dev/null +++ b/queue-5.4/net-dsa-microchip-ksz9477-port-map-correction-in-alu.patch @@ -0,0 +1,56 @@ +From 9cb141507f952e356819cc950c82d79424c84222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 23:17:35 +0530 +Subject: net: dsa: microchip: ksz9477: port map correction in ALU table entry + register + +From: Rakesh Sankaranarayanan + +[ Upstream commit 6c977c5c2e4c5d8ad1b604724cc344e38f96fe9b ] + +ALU table entry 2 register in KSZ9477 have bit positions reserved for +forwarding port map. This field is referred in ksz9477_fdb_del() for +clearing forward port map and alu table. + +But current fdb_del refer ALU table entry 3 register for accessing forward +port map. Update ksz9477_fdb_del() to get forward port map from correct +alu table entry register. + +With this bug, issue can be observed while deleting static MAC entries. +Delete any specific MAC entry using "bridge fdb del" command. This should +clear all the specified MAC entries. But it is observed that entries with +self static alone are retained. + +Tested on LAN9370 EVB since ksz9477_fdb_del() is used common across +LAN937x and KSZ series. + +Fixes: b987e98e50ab ("dsa: add DSA switch driver for Microchip KSZ9477") +Signed-off-by: Rakesh Sankaranarayanan +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230118174735.702377-1-rakesh.sankaranarayanan@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz9477.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index c66e78b2870d..ba2dc01e0f6b 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -682,10 +682,10 @@ static int ksz9477_port_fdb_del(struct dsa_switch *ds, int port, + ksz_read32(dev, REG_SW_ALU_VAL_D, &alu_table[3]); + + /* clear forwarding port */ +- alu_table[2] &= ~BIT(port); ++ alu_table[1] &= ~BIT(port); + + /* if there is no port to forward, clear table */ +- if ((alu_table[2] & ALU_V_PORT_MAP) == 0) { ++ if ((alu_table[1] & ALU_V_PORT_MAP) == 0) { + alu_table[0] = 0; + alu_table[1] = 0; + alu_table[2] = 0; +-- +2.39.0 + diff --git a/queue-5.4/net-fix-a-concurrency-bug-in-l2tp_tunnel_register.patch b/queue-5.4/net-fix-a-concurrency-bug-in-l2tp_tunnel_register.patch new file mode 100644 index 00000000000..bf54c4941da --- /dev/null +++ b/queue-5.4/net-fix-a-concurrency-bug-in-l2tp_tunnel_register.patch @@ -0,0 +1,75 @@ +From fb7dbab07e62ded6754e34641d5d30de5302b07b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 15:04:24 +0000 +Subject: net: fix a concurrency bug in l2tp_tunnel_register() + +From: Gong, Sishuai + +[ Upstream commit 69e16d01d1de4f1249869de342915f608feb55d5 ] + +l2tp_tunnel_register() registers a tunnel without fully +initializing its attribute. This can allow another kernel thread +running l2tp_xmit_core() to access the uninitialized data and +then cause a kernel NULL pointer dereference error, as shown below. + +Thread 1 Thread 2 +//l2tp_tunnel_register() +list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); + //pppol2tp_connect() + tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); + // Fetch the new tunnel + ... + //l2tp_xmit_core() + struct sock *sk = tunnel->sock; + ... + bh_lock_sock(sk); + //Null pointer error happens +tunnel->sock = sk; + +Fix this bug by initializing tunnel->sock before adding the +tunnel into l2tp_tunnel_list. + +Reviewed-by: Cong Wang +Signed-off-by: Sishuai Gong +Reported-by: Sishuai Gong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 421b2c89ce12..a0ec61f2295b 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1500,11 +1500,15 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + tunnel->l2tp_net = net; + pn = l2tp_pernet(net); + ++ sk = sock->sk; ++ sock_hold(sk); ++ tunnel->sock = sk; ++ + spin_lock_bh(&pn->l2tp_tunnel_list_lock); + list_for_each_entry(tunnel_walk, &pn->l2tp_tunnel_list, list) { + if (tunnel_walk->tunnel_id == tunnel->tunnel_id) { + spin_unlock_bh(&pn->l2tp_tunnel_list_lock); +- ++ sock_put(sk); + ret = -EEXIST; + goto err_sock; + } +@@ -1512,10 +1516,6 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, + list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list); + spin_unlock_bh(&pn->l2tp_tunnel_list_lock); + +- sk = sock->sk; +- sock_hold(sk); +- tunnel->sock = sk; +- + if (tunnel->encap == L2TP_ENCAPTYPE_UDP) { + struct udp_tunnel_sock_cfg udp_cfg = { + .sk_user_data = tunnel, +-- +2.39.0 + diff --git a/queue-5.4/net-macb-fix-ptp-tx-timestamp-failure-due-to-packet-.patch b/queue-5.4/net-macb-fix-ptp-tx-timestamp-failure-due-to-packet-.patch new file mode 100644 index 00000000000..c33b230e345 --- /dev/null +++ b/queue-5.4/net-macb-fix-ptp-tx-timestamp-failure-due-to-packet-.patch @@ -0,0 +1,77 @@ +From c2075f1ab6177fa27c8cfc2bd8db66187e054fd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 15:41:33 -0600 +Subject: net: macb: fix PTP TX timestamp failure due to packet padding + +From: Robert Hancock + +[ Upstream commit 7b90f5a665acd46efbbfa677a3a3a18d01ad6487 ] + +PTP TX timestamp handling was observed to be broken with this driver +when using the raw Layer 2 PTP encapsulation. ptp4l was not receiving +the expected TX timestamp after transmitting a packet, causing it to +enter a failure state. + +The problem appears to be due to the way that the driver pads packets +which are smaller than the Ethernet minimum of 60 bytes. If headroom +space was available in the SKB, this caused the driver to move the data +back to utilize it. However, this appears to cause other data references +in the SKB to become inconsistent. In particular, this caused the +ptp_one_step_sync function to later (in the TX completion path) falsely +detect the packet as a one-step SYNC packet, even when it was not, which +caused the TX timestamp to not be processed when it should be. + +Using the headroom for this purpose seems like an unnecessary complexity +as this is not a hot path in the driver, and in most cases it appears +that there is sufficient tailroom to not require using the headroom +anyway. Remove this usage of headroom to prevent this inconsistency from +occurring and causing other problems. + +Fixes: 653e92a9175e ("net: macb: add support for padding and fcs computation") +Signed-off-by: Robert Hancock +Reviewed-by: Jacob Keller +Tested-by: Claudiu Beznea # on SAMA7G5 +Reviewed-by: Claudiu Beznea +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 78219a9943a7..d948b582f4c9 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -1752,7 +1752,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) + bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb) || + skb_is_nonlinear(*skb); + int padlen = ETH_ZLEN - (*skb)->len; +- int headroom = skb_headroom(*skb); + int tailroom = skb_tailroom(*skb); + struct sk_buff *nskb; + u32 fcs; +@@ -1766,9 +1765,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) + /* FCS could be appeded to tailroom. */ + if (tailroom >= ETH_FCS_LEN) + goto add_fcs; +- /* FCS could be appeded by moving data to headroom. */ +- else if (!cloned && headroom + tailroom >= ETH_FCS_LEN) +- padlen = 0; + /* No room for FCS, need to reallocate skb. */ + else + padlen = ETH_FCS_LEN; +@@ -1777,10 +1773,7 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) + padlen += ETH_FCS_LEN; + } + +- if (!cloned && headroom + tailroom >= padlen) { +- (*skb)->data = memmove((*skb)->head, (*skb)->data, (*skb)->len); +- skb_set_tail_pointer(*skb, (*skb)->len); +- } else { ++ if (cloned || tailroom < padlen) { + nskb = skb_copy_expand(*skb, 0, padlen, GFP_ATOMIC); + if (!nskb) + return -ENOMEM; +-- +2.39.0 + diff --git a/queue-5.4/net-mdio-validate-parameter-addr-in-mdiobus_get_phy.patch b/queue-5.4/net-mdio-validate-parameter-addr-in-mdiobus_get_phy.patch new file mode 100644 index 00000000000..e31e65c0414 --- /dev/null +++ b/queue-5.4/net-mdio-validate-parameter-addr-in-mdiobus_get_phy.patch @@ -0,0 +1,44 @@ +From 459da7fcf2a45acdca2f4a0be4f80b7d960dfb28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Jan 2023 11:54:06 +0100 +Subject: net: mdio: validate parameter addr in mdiobus_get_phy() + +From: Heiner Kallweit + +[ Upstream commit 867dbe784c5010a466f00a7d1467c1c5ea569c75 ] + +The caller may pass any value as addr, what may result in an out-of-bounds +access to array mdio_map. One existing case is stmmac_init_phy() that +may pass -1 as addr. Therefore validate addr before using it. + +Fixes: 7f854420fbfe ("phy: Add API for {un}registering an mdio device to a bus.") +Signed-off-by: Heiner Kallweit +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/cdf664ea-3312-e915-73f8-021678d08887@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_bus.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index 757763735e1f..fdf8221f46fa 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -117,7 +117,12 @@ EXPORT_SYMBOL(mdiobus_unregister_device); + + struct phy_device *mdiobus_get_phy(struct mii_bus *bus, int addr) + { +- struct mdio_device *mdiodev = bus->mdio_map[addr]; ++ struct mdio_device *mdiodev; ++ ++ if (addr < 0 || addr >= ARRAY_SIZE(bus->mdio_map)) ++ return NULL; ++ ++ mdiodev = bus->mdio_map[addr]; + + if (!mdiodev) + return NULL; +-- +2.39.0 + diff --git a/queue-5.4/net-mlx5-eliminate-anonymous-module_init-module_exit.patch b/queue-5.4/net-mlx5-eliminate-anonymous-module_init-module_exit.patch new file mode 100644 index 00000000000..eeab1308c9b --- /dev/null +++ b/queue-5.4/net-mlx5-eliminate-anonymous-module_init-module_exit.patch @@ -0,0 +1,76 @@ +From 79a865fa5a5b03a5d9b7a901c6110eb5f0445f0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 20:12:29 -0700 +Subject: net: mlx5: eliminate anonymous module_init & module_exit + +From: Randy Dunlap + +[ Upstream commit 2c1e1b949024989e20907b84e11a731a50778416 ] + +Eliminate anonymous module_init() and module_exit(), which can lead to +confusion or ambiguity when reading System.map, crashes/oops/bugs, +or an initcall_debug log. + +Give each of these init and exit functions unique driver-specific +names to eliminate the anonymous names. + +Example 1: (System.map) + ffffffff832fc78c t init + ffffffff832fc79e t init + ffffffff832fc8f8 t init + +Example 2: (initcall_debug log) + calling init+0x0/0x12 @ 1 + initcall init+0x0/0x12 returned 0 after 15 usecs + calling init+0x0/0x60 @ 1 + initcall init+0x0/0x60 returned 0 after 2 usecs + calling init+0x0/0x9a @ 1 + initcall init+0x0/0x9a returned 0 after 74 usecs + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Signed-off-by: Randy Dunlap +Cc: Eli Cohen +Cc: Saeed Mahameed +Cc: Leon Romanovsky +Cc: linux-rdma@vger.kernel.org +Reviewed-by: Ira Weiny +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index f2657cd3ffa4..83ee9429e7c6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1640,7 +1640,7 @@ static void mlx5_core_verify_params(void) + } + } + +-static int __init init(void) ++static int __init mlx5_init(void) + { + int err; + +@@ -1665,7 +1665,7 @@ static int __init init(void) + return err; + } + +-static void __exit cleanup(void) ++static void __exit mlx5_cleanup(void) + { + #ifdef CONFIG_MLX5_CORE_EN + mlx5e_cleanup(); +@@ -1674,5 +1674,5 @@ static void __exit cleanup(void) + mlx5_unregister_debugfs(); + } + +-module_init(init); +-module_exit(cleanup); ++module_init(mlx5_init); ++module_exit(mlx5_cleanup); +-- +2.39.0 + diff --git a/queue-5.4/net-nfc-fix-use-after-free-in-local_cleanup.patch b/queue-5.4/net-nfc-fix-use-after-free-in-local_cleanup.patch new file mode 100644 index 00000000000..322082ff2d0 --- /dev/null +++ b/queue-5.4/net-nfc-fix-use-after-free-in-local_cleanup.patch @@ -0,0 +1,112 @@ +From fdea02be8b837fa53659f89e938d499f469bebf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:19:14 +0900 +Subject: net: nfc: Fix use-after-free in local_cleanup() + +From: Jisoo Jang + +[ Upstream commit 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6 ] + +Fix a use-after-free that occurs in kfree_skb() called from +local_cleanup(). This could happen when killing nfc daemon (e.g. neard) +after detaching an nfc device. +When detaching an nfc device, local_cleanup() called from +nfc_llcp_unregister_device() frees local->rx_pending and decreases +local->ref by kref_put() in nfc_llcp_local_put(). +In the terminating process, nfc daemon releases all sockets and it leads +to decreasing local->ref. After the last release of local->ref, +local_cleanup() called from local_release() frees local->rx_pending +again, which leads to the bug. + +Setting local->rx_pending to NULL in local_cleanup() could prevent +use-after-free when local_cleanup() is called twice. + +Found by a modified version of syzkaller. + +BUG: KASAN: use-after-free in kfree_skb() + +Call Trace: +dump_stack_lvl (lib/dump_stack.c:106) +print_address_description.constprop.0.cold (mm/kasan/report.c:306) +kasan_check_range (mm/kasan/generic.c:189) +kfree_skb (net/core/skbuff.c:955) +local_cleanup (net/nfc/llcp_core.c:159) +nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172) +nfc_llcp_local_put (net/nfc/llcp_core.c:181) +llcp_sock_destruct (net/nfc/llcp_sock.c:959) +__sk_destruct (net/core/sock.c:2133) +sk_destruct (net/core/sock.c:2181) +__sk_free (net/core/sock.c:2192) +sk_free (net/core/sock.c:2203) +llcp_sock_release (net/nfc/llcp_sock.c:646) +__sock_release (net/socket.c:650) +sock_close (net/socket.c:1365) +__fput (fs/file_table.c:306) +task_work_run (kernel/task_work.c:179) +ptrace_notify (kernel/signal.c:2354) +syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278) +syscall_exit_to_user_mode (kernel/entry/common.c:296) +do_syscall_64 (arch/x86/entry/common.c:86) +entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106) + +Allocated by task 4719: +kasan_save_stack (mm/kasan/common.c:45) +__kasan_slab_alloc (mm/kasan/common.c:325) +slab_post_alloc_hook (mm/slab.h:766) +kmem_cache_alloc_node (mm/slub.c:3497) +__alloc_skb (net/core/skbuff.c:552) +pn533_recv_response (drivers/nfc/pn533/usb.c:65) +__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671) +usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704) +tasklet_action_common.isra.0 (kernel/softirq.c:797) +__do_softirq (kernel/softirq.c:571) + +Freed by task 1901: +kasan_save_stack (mm/kasan/common.c:45) +kasan_set_track (mm/kasan/common.c:52) +kasan_save_free_info (mm/kasan/genericdd.c:518) +__kasan_slab_free (mm/kasan/common.c:236) +kmem_cache_free (mm/slub.c:3809) +kfree_skbmem (net/core/skbuff.c:874) +kfree_skb (net/core/skbuff.c:931) +local_cleanup (net/nfc/llcp_core.c:159) +nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617) +nfc_unregister_device (net/nfc/core.c:1179) +pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846) +pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579) +usb_unbind_interface (drivers/usb/core/driver.c:458) +device_release_driver_internal (drivers/base/dd.c:1279) +bus_remove_device (drivers/base/bus.c:529) +device_del (drivers/base/core.c:3665) +usb_disable_device (drivers/usb/core/message.c:1420) +usb_disconnect (drivers/usb/core.c:2261) +hub_event (drivers/usb/core/hub.c:5833) +process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281) +worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423) +kthread (kernel/kthread.c:319) +ret_from_fork (arch/x86/entry/entry_64.S:301) + +Fixes: 3536da06db0b ("NFC: llcp: Clean local timers and works when removing a device") +Signed-off-by: Jisoo Jang +Link: https://lore.kernel.org/r/20230111131914.3338838-1-jisoo.jang@yonsei.ac.kr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/llcp_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c +index cc997518f79d..edadebb3efd2 100644 +--- a/net/nfc/llcp_core.c ++++ b/net/nfc/llcp_core.c +@@ -159,6 +159,7 @@ static void local_cleanup(struct nfc_llcp_local *local) + cancel_work_sync(&local->rx_work); + cancel_work_sync(&local->timeout_work); + kfree_skb(local->rx_pending); ++ local->rx_pending = NULL; + del_timer_sync(&local->sdreq_timer); + cancel_work_sync(&local->sdreq_timeout_work); + nfc_llcp_free_sdp_tlv_list(&local->pending_sdreqs); +-- +2.39.0 + diff --git a/queue-5.4/net-sched-sch_taprio-fix-possible-use-after-free.patch b/queue-5.4/net-sched-sch_taprio-fix-possible-use-after-free.patch new file mode 100644 index 00000000000..d8bac9e5c4b --- /dev/null +++ b/queue-5.4/net-sched-sch_taprio-fix-possible-use-after-free.patch @@ -0,0 +1,128 @@ +From 53a41f472aa8c2e086fe9308f0d34bf9d1d4c320 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 16:48:49 +0000 +Subject: net/sched: sch_taprio: fix possible use-after-free + +From: Eric Dumazet + +[ Upstream commit 3a415d59c1dbec9d772dbfab2d2520d98360caae ] + +syzbot reported a nasty crash [1] in net_tx_action() which +made little sense until we got a repro. + +This repro installs a taprio qdisc, but providing an +invalid TCA_RATE attribute. + +qdisc_create() has to destroy the just initialized +taprio qdisc, and taprio_destroy() is called. + +However, the hrtimer used by taprio had already fired, +therefore advance_sched() called __netif_schedule(). + +Then net_tx_action was trying to use a destroyed qdisc. + +We can not undo the __netif_schedule(), so we must wait +until one cpu serviced the qdisc before we can proceed. + +Many thanks to Alexander Potapenko for his help. + +[1] +BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] +BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline] +BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] +BUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 + queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] + do_raw_spin_trylock include/linux/spinlock.h:191 [inline] + __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] + _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 + spin_trylock include/linux/spinlock.h:359 [inline] + qdisc_run_begin include/net/sch_generic.h:187 [inline] + qdisc_run+0xee/0x540 include/net/pkt_sched.h:125 + net_tx_action+0x77c/0x9a0 net/core/dev.c:5086 + __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 + run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934 + smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164 + kthread+0x31b/0x430 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:732 [inline] + slab_alloc_node mm/slub.c:3258 [inline] + __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970 + kmalloc_reserve net/core/skbuff.c:358 [inline] + __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430 + alloc_skb include/linux/skbuff.h:1257 [inline] + nlmsg_new include/net/netlink.h:953 [inline] + netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436 + netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507 + rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:6108 + netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] + netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 + netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg net/socket.c:734 [inline] + ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 + ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536 + __sys_sendmsg net/socket.c:2565 [inline] + __do_sys_sendmsg net/socket.c:2574 [inline] + __se_sys_sendmsg net/socket.c:2572 [inline] + __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 + +Fixes: 5a781ccbd19e ("tc: Add support for configuring the taprio scheduler") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Alexander Potapenko +Cc: Vinicius Costa Gomes +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sch_generic.h | 7 +++++++ + net/sched/sch_taprio.c | 3 +++ + 2 files changed, 10 insertions(+) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 1ee396ce0eda..e8034756cbf8 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -1334,4 +1334,11 @@ static inline void skb_tc_reinsert(struct sk_buff *skb, struct tcf_result *res) + qstats_overlimit_inc(res->qstats); + } + ++/* Make sure qdisc is no longer in SCHED state. */ ++static inline void qdisc_synchronize(const struct Qdisc *q) ++{ ++ while (test_bit(__QDISC_STATE_SCHED, &q->state)) ++ msleep(1); ++} ++ + #endif +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 506ebae1f72c..4278a466cb50 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1622,6 +1622,8 @@ static void taprio_reset(struct Qdisc *sch) + int i; + + hrtimer_cancel(&q->advance_timer); ++ qdisc_synchronize(sch); ++ + if (q->qdiscs) { + for (i = 0; i < dev->num_tx_queues && q->qdiscs[i]; i++) + qdisc_reset(q->qdiscs[i]); +@@ -1644,6 +1646,7 @@ static void taprio_destroy(struct Qdisc *sch) + * happens in qdisc_create(), after taprio_init() has been called. + */ + hrtimer_cancel(&q->advance_timer); ++ qdisc_synchronize(sch); + + taprio_disable_offload(dev, q, NULL); + +-- +2.39.0 + diff --git a/queue-5.4/net-stmmac-fix-invalid-call-to-mdiobus_get_phy.patch b/queue-5.4/net-stmmac-fix-invalid-call-to-mdiobus_get_phy.patch new file mode 100644 index 00000000000..58df526f71a --- /dev/null +++ b/queue-5.4/net-stmmac-fix-invalid-call-to-mdiobus_get_phy.patch @@ -0,0 +1,42 @@ +From d292bf3e481d9ea229c31a0f842d690a90ac5321 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Jan 2023 18:24:08 +0100 +Subject: net: stmmac: fix invalid call to mdiobus_get_phy() + +From: Heiner Kallweit + +[ Upstream commit 1f3bd64ad921f051254591fbed04fd30b306cde6 ] + +In a number of cases the driver assigns a default value of -1 to +priv->plat->phy_addr. This may result in calling mdiobus_get_phy() +with addr parameter being -1. Therefore check for this scenario and +bail out before calling mdiobus_get_phy(). + +Fixes: 42e87024f727 ("net: stmmac: Fix case when PHY handle is not present") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/669f9671-ecd1-a41b-2727-7b73e3003985@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 9931724c4727..3079e5254666 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -998,6 +998,11 @@ static int stmmac_init_phy(struct net_device *dev) + int addr = priv->plat->phy_addr; + struct phy_device *phydev; + ++ if (addr < 0) { ++ netdev_err(priv->dev, "no phy found\n"); ++ return -ENODEV; ++ } ++ + phydev = mdiobus_get_phy(priv->mii, addr); + if (!phydev) { + netdev_err(priv->dev, "no phy at addr %d\n", addr); +-- +2.39.0 + diff --git a/queue-5.4/net-usb-sr9700-handle-negative-len.patch b/queue-5.4/net-usb-sr9700-handle-negative-len.patch new file mode 100644 index 00000000000..5cd0be9f6fd --- /dev/null +++ b/queue-5.4/net-usb-sr9700-handle-negative-len.patch @@ -0,0 +1,41 @@ +From 66e82421cb7b66f0b01a4f8bb90e30f6ef829776 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 19:23:26 +0100 +Subject: net: usb: sr9700: Handle negative len + +From: Szymon Heidrich + +[ Upstream commit ecf7cf8efb59789e2b21d2f9ab926142579092b2 ] + +Packet len computed as difference of length word extracted from +skb data and four may result in a negative value. In such case +processing of the buffer should be interrupted rather than +setting sr_skb->len to an unexpectedly large value (due to cast +from signed to unsigned integer) and passing sr_skb to +usbnet_skb_return. + +Fixes: e9da0b56fe27 ("sr9700: sanity check for packet length") +Signed-off-by: Szymon Heidrich +Link: https://lore.kernel.org/r/20230114182326.30479-1-szymon.heidrich@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/sr9700.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c +index fce6713e970b..811c8751308c 100644 +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -410,7 +410,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + /* ignore the CRC length */ + len = (skb->data[1] | (skb->data[2] << 8)) - 4; + +- if (len > ETH_FRAME_LEN || len > skb->len) ++ if (len > ETH_FRAME_LEN || len > skb->len || len < 0) + return 0; + + /* the last packet of current skb */ +-- +2.39.0 + diff --git a/queue-5.4/net-wan-add-checks-for-null-for-utdm-in-undo_uhdlc_i.patch b/queue-5.4/net-wan-add-checks-for-null-for-utdm-in-undo_uhdlc_i.patch new file mode 100644 index 00000000000..90f2ab0e8c4 --- /dev/null +++ b/queue-5.4/net-wan-add-checks-for-null-for-utdm-in-undo_uhdlc_i.patch @@ -0,0 +1,47 @@ +From c222c7de376b3b6895aab5b7c98eccf19e927e5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 10:47:03 +0300 +Subject: net: wan: Add checks for NULL for utdm in undo_uhdlc_init and + unmap_si_regs + +From: Esina Ekaterina + +[ Upstream commit 488e0bf7f34af3d42d1d5e56f7a5a7beaff188a3 ] + +If uhdlc_priv_tsa != 1 then utdm is not initialized. +And if ret != NULL then goto undo_uhdlc_init, where +utdm is dereferenced. Same if dev == NULL. + +Found by Astra Linux on behalf of Linux Verification Center +(linuxtesting.org) with SVACE. + +Fixes: 8d68100ab4ad ("soc/fsl/qe: fix err handling of ucc_of_parse_tdm") +Signed-off-by: Esina Ekaterina +Link: https://lore.kernel.org/r/20230112074703.13558-1-eesina@astralinux.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wan/fsl_ucc_hdlc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c +index 034eb6535ab7..46077cef855b 100644 +--- a/drivers/net/wan/fsl_ucc_hdlc.c ++++ b/drivers/net/wan/fsl_ucc_hdlc.c +@@ -1249,9 +1249,11 @@ static int ucc_hdlc_probe(struct platform_device *pdev) + free_dev: + free_netdev(dev); + undo_uhdlc_init: +- iounmap(utdm->siram); ++ if (utdm) ++ iounmap(utdm->siram); + unmap_si_regs: +- iounmap(utdm->si_regs); ++ if (utdm) ++ iounmap(utdm->si_regs); + free_utdm: + if (uhdlc_priv->tsa) + kfree(utdm); +-- +2.39.0 + diff --git a/queue-5.4/phy-rockchip-inno-usb2-fix-missing-clk_disable_unpre.patch b/queue-5.4/phy-rockchip-inno-usb2-fix-missing-clk_disable_unpre.patch new file mode 100644 index 00000000000..935b9f69792 --- /dev/null +++ b/queue-5.4/phy-rockchip-inno-usb2-fix-missing-clk_disable_unpre.patch @@ -0,0 +1,41 @@ +From a0baf92bfacab504f99e79c2a2cb71d6108dac76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 19:58:23 +0800 +Subject: phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in + rockchip_usb2phy_power_on() + +From: Shang XiaoJing + +[ Upstream commit 5daba914da0e48950e9407ea4d75fa57029c9adc ] + +The clk_disable_unprepare() should be called in the error handling of +rockchip_usb2phy_power_on(). + +Fixes: 0e08d2a727e6 ("phy: rockchip-inno-usb2: add a new driver for Rockchip usb2phy") +Signed-off-by: Shang XiaoJing +Link: https://lore.kernel.org/r/20221205115823.16957-1-shangxiaojing@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c +index eae865ff312c..b5f7a93543b0 100644 +--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c ++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c +@@ -467,8 +467,10 @@ static int rockchip_usb2phy_power_on(struct phy *phy) + return ret; + + ret = property_enable(base, &rport->port_cfg->phy_sus, false); +- if (ret) ++ if (ret) { ++ clk_disable_unprepare(rphy->clk480m); + return ret; ++ } + + /* waiting for the utmi_clk to become stable */ + usleep_range(1500, 2000); +-- +2.39.0 + diff --git a/queue-5.4/phy-ti-fix-kconfig-warning-and-operator-precedence.patch b/queue-5.4/phy-ti-fix-kconfig-warning-and-operator-precedence.patch new file mode 100644 index 00000000000..7f4c9cc596d --- /dev/null +++ b/queue-5.4/phy-ti-fix-kconfig-warning-and-operator-precedence.patch @@ -0,0 +1,55 @@ +From cb56a71d4273a01fd1e6b8e67e5d2586a15dc02d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 22:25:29 -0800 +Subject: phy: ti: fix Kconfig warning and operator precedence + +From: Randy Dunlap + +[ Upstream commit 7124c93887cc4e6c5b48920f83115e4a5892e870 ] + +Fix Kconfig depends operator precedence to prevent a Kconfig warning: + +WARNING: unmet direct dependencies detected for MUX_MMIO + Depends on [n]: MULTIPLEXER [=m] && OF [=n] + Selected by [m]: + - PHY_AM654_SERDES [=m] && (OF [=n] && ARCH_K3 || COMPILE_TEST [=y]) && COMMON_CLK [=y] + +Fixes: 71e2f5c5c224 ("phy: ti: Add a new SERDES driver for TI's AM654x SoC") +Fixes: 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E SoC") +Signed-off-by: Randy Dunlap +Cc: Vinod Koul +Cc: Kishon Vijay Abraham I +Cc: linux-phy@lists.infradead.org +Cc: Arnd Bergmann +Link: https://lore.kernel.org/r/20230110062529.22668-1-rdunlap@infradead.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/Kconfig b/drivers/phy/ti/Kconfig +index bb688de9a3ba..a1b8c473caa9 100644 +--- a/drivers/phy/ti/Kconfig ++++ b/drivers/phy/ti/Kconfig +@@ -23,7 +23,7 @@ config PHY_DM816X_USB + + config PHY_AM654_SERDES + tristate "TI AM654 SERDES support" +- depends on OF && ARCH_K3 || COMPILE_TEST ++ depends on OF && (ARCH_K3 || COMPILE_TEST) + depends on COMMON_CLK + select GENERIC_PHY + select MULTIPLEXER +@@ -35,7 +35,7 @@ config PHY_AM654_SERDES + + config PHY_J721E_WIZ + tristate "TI J721E WIZ (SERDES Wrapper) support" +- depends on OF && ARCH_K3 || COMPILE_TEST ++ depends on OF && (ARCH_K3 || COMPILE_TEST) + depends on HAS_IOMEM && OF_ADDRESS + depends on COMMON_CLK + select GENERIC_PHY +-- +2.39.0 + diff --git a/queue-5.4/phy-ti-j721e-wiz-add-support-for-wiz-module-present-.patch b/queue-5.4/phy-ti-j721e-wiz-add-support-for-wiz-module-present-.patch new file mode 100644 index 00000000000..0c5b3dc0297 --- /dev/null +++ b/queue-5.4/phy-ti-j721e-wiz-add-support-for-wiz-module-present-.patch @@ -0,0 +1,970 @@ +From b11c3b86995c74366abcf6cfd24ddde246d8b335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2019 15:27:12 +0530 +Subject: phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E + SoC + +From: Kishon Vijay Abraham I + +[ Upstream commit 091876cc355d6739e393efa4b3d07f451a6a035c ] + +Add support for WIZ module present in TI's J721E SoC. WIZ is a SERDES +wrapper used to configure some of the input signals to the SERDES. It is +used with both Sierra(16G) and Torrent(10G) SERDES. This driver configures +three clock selects (pll0, pll1, dig), two divider clocks and supports +resets for each of the lanes. + +[jsarha@ti.com: Add support for Torrent(10G) SERDES wrapper] +Signed-off-by: Jyri Sarha +Signed-off-by: Kishon Vijay Abraham I +Stable-dep-of: 7124c93887cc ("phy: ti: fix Kconfig warning and operator precedence") +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/Kconfig | 15 + + drivers/phy/ti/Makefile | 1 + + drivers/phy/ti/phy-j721e-wiz.c | 898 +++++++++++++++++++++++++++++++++ + 3 files changed, 914 insertions(+) + create mode 100644 drivers/phy/ti/phy-j721e-wiz.c + +diff --git a/drivers/phy/ti/Kconfig b/drivers/phy/ti/Kconfig +index c3fa1840f8de..af6213b734e6 100644 +--- a/drivers/phy/ti/Kconfig ++++ b/drivers/phy/ti/Kconfig +@@ -33,6 +33,21 @@ config PHY_AM654_SERDES + This option enables support for TI AM654 SerDes PHY used for + PCIe. + ++config PHY_J721E_WIZ ++ tristate "TI J721E WIZ (SERDES Wrapper) support" ++ depends on OF && ARCH_K3 || COMPILE_TEST ++ depends on COMMON_CLK ++ select GENERIC_PHY ++ select MULTIPLEXER ++ select REGMAP_MMIO ++ select MUX_MMIO ++ help ++ This option enables support for WIZ module present in TI's J721E ++ SoC. WIZ is a serdes wrapper used to configure some of the input ++ signals to the SERDES (Sierra/Torrent). This driver configures ++ three clock selects (pll0, pll1, dig) and resets for each of the ++ lanes. ++ + config OMAP_CONTROL_PHY + tristate "OMAP CONTROL PHY Driver" + depends on ARCH_OMAP2PLUS || COMPILE_TEST +diff --git a/drivers/phy/ti/Makefile b/drivers/phy/ti/Makefile +index bff901eb0ecc..dcba2571c9bd 100644 +--- a/drivers/phy/ti/Makefile ++++ b/drivers/phy/ti/Makefile +@@ -8,3 +8,4 @@ obj-$(CONFIG_PHY_TUSB1210) += phy-tusb1210.o + obj-$(CONFIG_TWL4030_USB) += phy-twl4030-usb.o + obj-$(CONFIG_PHY_AM654_SERDES) += phy-am654-serdes.o + obj-$(CONFIG_PHY_TI_GMII_SEL) += phy-gmii-sel.o ++obj-$(CONFIG_PHY_J721E_WIZ) += phy-j721e-wiz.o +diff --git a/drivers/phy/ti/phy-j721e-wiz.c b/drivers/phy/ti/phy-j721e-wiz.c +new file mode 100644 +index 000000000000..b86ebdd68302 +--- /dev/null ++++ b/drivers/phy/ti/phy-j721e-wiz.c +@@ -0,0 +1,898 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/** ++ * Wrapper driver for SERDES used in J721E ++ * ++ * Copyright (C) 2019 Texas Instruments Incorporated - http://www.ti.com/ ++ * Author: Kishon Vijay Abraham I ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define WIZ_SERDES_CTRL 0x404 ++#define WIZ_SERDES_TOP_CTRL 0x408 ++#define WIZ_SERDES_RST 0x40c ++#define WIZ_LANECTL(n) (0x480 + (0x40 * (n))) ++ ++#define WIZ_MAX_LANES 4 ++#define WIZ_MUX_NUM_CLOCKS 3 ++#define WIZ_DIV_NUM_CLOCKS_16G 2 ++#define WIZ_DIV_NUM_CLOCKS_10G 1 ++ ++enum wiz_lane_standard_mode { ++ LANE_MODE_GEN1, ++ LANE_MODE_GEN2, ++ LANE_MODE_GEN3, ++ LANE_MODE_GEN4, ++}; ++ ++enum wiz_refclk_mux_sel { ++ PLL0_REFCLK, ++ PLL1_REFCLK, ++ REFCLK_DIG, ++}; ++ ++enum wiz_refclk_div_sel { ++ CMN_REFCLK_DIG_DIV, ++ CMN_REFCLK1_DIG_DIV, ++}; ++ ++static const struct reg_field por_en = REG_FIELD(WIZ_SERDES_CTRL, 31, 31); ++static const struct reg_field phy_reset_n = REG_FIELD(WIZ_SERDES_RST, 31, 31); ++static const struct reg_field pll1_refclk_mux_sel = ++ REG_FIELD(WIZ_SERDES_RST, 29, 29); ++static const struct reg_field pll0_refclk_mux_sel = ++ REG_FIELD(WIZ_SERDES_RST, 28, 28); ++static const struct reg_field refclk_dig_sel_16g = ++ REG_FIELD(WIZ_SERDES_RST, 24, 25); ++static const struct reg_field refclk_dig_sel_10g = ++ REG_FIELD(WIZ_SERDES_RST, 24, 24); ++static const struct reg_field pma_cmn_refclk_int_mode = ++ REG_FIELD(WIZ_SERDES_TOP_CTRL, 28, 29); ++static const struct reg_field pma_cmn_refclk_mode = ++ REG_FIELD(WIZ_SERDES_TOP_CTRL, 30, 31); ++static const struct reg_field pma_cmn_refclk_dig_div = ++ REG_FIELD(WIZ_SERDES_TOP_CTRL, 26, 27); ++static const struct reg_field pma_cmn_refclk1_dig_div = ++ REG_FIELD(WIZ_SERDES_TOP_CTRL, 24, 25); ++ ++static const struct reg_field p_enable[WIZ_MAX_LANES] = { ++ REG_FIELD(WIZ_LANECTL(0), 30, 31), ++ REG_FIELD(WIZ_LANECTL(1), 30, 31), ++ REG_FIELD(WIZ_LANECTL(2), 30, 31), ++ REG_FIELD(WIZ_LANECTL(3), 30, 31), ++}; ++ ++static const struct reg_field p_align[WIZ_MAX_LANES] = { ++ REG_FIELD(WIZ_LANECTL(0), 29, 29), ++ REG_FIELD(WIZ_LANECTL(1), 29, 29), ++ REG_FIELD(WIZ_LANECTL(2), 29, 29), ++ REG_FIELD(WIZ_LANECTL(3), 29, 29), ++}; ++ ++static const struct reg_field p_raw_auto_start[WIZ_MAX_LANES] = { ++ REG_FIELD(WIZ_LANECTL(0), 28, 28), ++ REG_FIELD(WIZ_LANECTL(1), 28, 28), ++ REG_FIELD(WIZ_LANECTL(2), 28, 28), ++ REG_FIELD(WIZ_LANECTL(3), 28, 28), ++}; ++ ++static const struct reg_field p_standard_mode[WIZ_MAX_LANES] = { ++ REG_FIELD(WIZ_LANECTL(0), 24, 25), ++ REG_FIELD(WIZ_LANECTL(1), 24, 25), ++ REG_FIELD(WIZ_LANECTL(2), 24, 25), ++ REG_FIELD(WIZ_LANECTL(3), 24, 25), ++}; ++ ++struct wiz_clk_mux { ++ struct clk_hw hw; ++ struct regmap_field *field; ++ u32 *table; ++ struct clk_init_data clk_data; ++}; ++ ++#define to_wiz_clk_mux(_hw) container_of(_hw, struct wiz_clk_mux, hw) ++ ++struct wiz_clk_divider { ++ struct clk_hw hw; ++ struct regmap_field *field; ++ struct clk_div_table *table; ++ struct clk_init_data clk_data; ++}; ++ ++#define to_wiz_clk_div(_hw) container_of(_hw, struct wiz_clk_divider, hw) ++ ++struct wiz_clk_mux_sel { ++ struct regmap_field *field; ++ u32 table[4]; ++ const char *node_name; ++}; ++ ++struct wiz_clk_div_sel { ++ struct regmap_field *field; ++ struct clk_div_table *table; ++ const char *node_name; ++}; ++ ++static struct wiz_clk_mux_sel clk_mux_sel_16g[] = { ++ { ++ /* ++ * Mux value to be configured for each of the input clocks ++ * in the order populated in device tree ++ */ ++ .table = { 1, 0 }, ++ .node_name = "pll0-refclk", ++ }, ++ { ++ .table = { 1, 0 }, ++ .node_name = "pll1-refclk", ++ }, ++ { ++ .table = { 1, 3, 0, 2 }, ++ .node_name = "refclk-dig", ++ }, ++}; ++ ++static struct wiz_clk_mux_sel clk_mux_sel_10g[] = { ++ { ++ /* ++ * Mux value to be configured for each of the input clocks ++ * in the order populated in device tree ++ */ ++ .table = { 1, 0 }, ++ .node_name = "pll0-refclk", ++ }, ++ { ++ .table = { 1, 0 }, ++ .node_name = "pll1-refclk", ++ }, ++ { ++ .table = { 1, 0 }, ++ .node_name = "refclk-dig", ++ }, ++}; ++ ++static struct clk_div_table clk_div_table[] = { ++ { .val = 0, .div = 1, }, ++ { .val = 1, .div = 2, }, ++ { .val = 2, .div = 4, }, ++ { .val = 3, .div = 8, }, ++}; ++ ++static struct wiz_clk_div_sel clk_div_sel[] = { ++ { ++ .table = clk_div_table, ++ .node_name = "cmn-refclk-dig-div", ++ }, ++ { ++ .table = clk_div_table, ++ .node_name = "cmn-refclk1-dig-div", ++ }, ++}; ++ ++enum wiz_type { ++ J721E_WIZ_16G, ++ J721E_WIZ_10G, ++}; ++ ++struct wiz { ++ struct regmap *regmap; ++ enum wiz_type type; ++ struct wiz_clk_mux_sel *clk_mux_sel; ++ struct wiz_clk_div_sel *clk_div_sel; ++ unsigned int clk_div_sel_num; ++ struct regmap_field *por_en; ++ struct regmap_field *phy_reset_n; ++ struct regmap_field *p_enable[WIZ_MAX_LANES]; ++ struct regmap_field *p_align[WIZ_MAX_LANES]; ++ struct regmap_field *p_raw_auto_start[WIZ_MAX_LANES]; ++ struct regmap_field *p_standard_mode[WIZ_MAX_LANES]; ++ struct regmap_field *pma_cmn_refclk_int_mode; ++ struct regmap_field *pma_cmn_refclk_mode; ++ struct regmap_field *pma_cmn_refclk_dig_div; ++ struct regmap_field *pma_cmn_refclk1_dig_div; ++ ++ struct device *dev; ++ u32 num_lanes; ++ struct platform_device *serdes_pdev; ++ struct reset_controller_dev wiz_phy_reset_dev; ++}; ++ ++static int wiz_reset(struct wiz *wiz) ++{ ++ int ret; ++ ++ ret = regmap_field_write(wiz->por_en, 0x1); ++ if (ret) ++ return ret; ++ ++ mdelay(1); ++ ++ ret = regmap_field_write(wiz->por_en, 0x0); ++ if (ret) ++ return ret; ++ ++ return 0; ++} ++ ++static int wiz_mode_select(struct wiz *wiz) ++{ ++ u32 num_lanes = wiz->num_lanes; ++ int ret; ++ int i; ++ ++ for (i = 0; i < num_lanes; i++) { ++ ret = regmap_field_write(wiz->p_standard_mode[i], ++ LANE_MODE_GEN4); ++ if (ret) ++ return ret; ++ } ++ ++ return 0; ++} ++ ++static int wiz_init_raw_interface(struct wiz *wiz, bool enable) ++{ ++ u32 num_lanes = wiz->num_lanes; ++ int i; ++ int ret; ++ ++ for (i = 0; i < num_lanes; i++) { ++ ret = regmap_field_write(wiz->p_align[i], enable); ++ if (ret) ++ return ret; ++ ++ ret = regmap_field_write(wiz->p_raw_auto_start[i], enable); ++ if (ret) ++ return ret; ++ } ++ ++ return 0; ++} ++ ++static int wiz_init(struct wiz *wiz) ++{ ++ struct device *dev = wiz->dev; ++ int ret; ++ ++ ret = wiz_reset(wiz); ++ if (ret) { ++ dev_err(dev, "WIZ reset failed\n"); ++ return ret; ++ } ++ ++ ret = wiz_mode_select(wiz); ++ if (ret) { ++ dev_err(dev, "WIZ mode select failed\n"); ++ return ret; ++ } ++ ++ ret = wiz_init_raw_interface(wiz, true); ++ if (ret) { ++ dev_err(dev, "WIZ interface initialization failed\n"); ++ return ret; ++ } ++ ++ return 0; ++} ++ ++static int wiz_regfield_init(struct wiz *wiz) ++{ ++ struct wiz_clk_mux_sel *clk_mux_sel; ++ struct wiz_clk_div_sel *clk_div_sel; ++ struct regmap *regmap = wiz->regmap; ++ int num_lanes = wiz->num_lanes; ++ struct device *dev = wiz->dev; ++ int i; ++ ++ wiz->por_en = devm_regmap_field_alloc(dev, regmap, por_en); ++ if (IS_ERR(wiz->por_en)) { ++ dev_err(dev, "POR_EN reg field init failed\n"); ++ return PTR_ERR(wiz->por_en); ++ } ++ ++ wiz->phy_reset_n = devm_regmap_field_alloc(dev, regmap, ++ phy_reset_n); ++ if (IS_ERR(wiz->phy_reset_n)) { ++ dev_err(dev, "PHY_RESET_N reg field init failed\n"); ++ return PTR_ERR(wiz->phy_reset_n); ++ } ++ ++ wiz->pma_cmn_refclk_int_mode = ++ devm_regmap_field_alloc(dev, regmap, pma_cmn_refclk_int_mode); ++ if (IS_ERR(wiz->pma_cmn_refclk_int_mode)) { ++ dev_err(dev, "PMA_CMN_REFCLK_INT_MODE reg field init failed\n"); ++ return PTR_ERR(wiz->pma_cmn_refclk_int_mode); ++ } ++ ++ wiz->pma_cmn_refclk_mode = ++ devm_regmap_field_alloc(dev, regmap, pma_cmn_refclk_mode); ++ if (IS_ERR(wiz->pma_cmn_refclk_mode)) { ++ dev_err(dev, "PMA_CMN_REFCLK_MODE reg field init failed\n"); ++ return PTR_ERR(wiz->pma_cmn_refclk_mode); ++ } ++ ++ clk_div_sel = &wiz->clk_div_sel[CMN_REFCLK_DIG_DIV]; ++ clk_div_sel->field = devm_regmap_field_alloc(dev, regmap, ++ pma_cmn_refclk_dig_div); ++ if (IS_ERR(clk_div_sel->field)) { ++ dev_err(dev, "PMA_CMN_REFCLK_DIG_DIV reg field init failed\n"); ++ return PTR_ERR(clk_div_sel->field); ++ } ++ ++ if (wiz->type == J721E_WIZ_16G) { ++ clk_div_sel = &wiz->clk_div_sel[CMN_REFCLK1_DIG_DIV]; ++ clk_div_sel->field = ++ devm_regmap_field_alloc(dev, regmap, ++ pma_cmn_refclk1_dig_div); ++ if (IS_ERR(clk_div_sel->field)) { ++ dev_err(dev, "PMA_CMN_REFCLK1_DIG_DIV reg field init failed\n"); ++ return PTR_ERR(clk_div_sel->field); ++ } ++ } ++ ++ clk_mux_sel = &wiz->clk_mux_sel[PLL0_REFCLK]; ++ clk_mux_sel->field = devm_regmap_field_alloc(dev, regmap, ++ pll0_refclk_mux_sel); ++ if (IS_ERR(clk_mux_sel->field)) { ++ dev_err(dev, "PLL0_REFCLK_SEL reg field init failed\n"); ++ return PTR_ERR(clk_mux_sel->field); ++ } ++ ++ clk_mux_sel = &wiz->clk_mux_sel[PLL1_REFCLK]; ++ clk_mux_sel->field = devm_regmap_field_alloc(dev, regmap, ++ pll1_refclk_mux_sel); ++ if (IS_ERR(clk_mux_sel->field)) { ++ dev_err(dev, "PLL1_REFCLK_SEL reg field init failed\n"); ++ return PTR_ERR(clk_mux_sel->field); ++ } ++ ++ clk_mux_sel = &wiz->clk_mux_sel[REFCLK_DIG]; ++ if (wiz->type == J721E_WIZ_10G) ++ clk_mux_sel->field = ++ devm_regmap_field_alloc(dev, regmap, ++ refclk_dig_sel_10g); ++ else ++ clk_mux_sel->field = ++ devm_regmap_field_alloc(dev, regmap, ++ refclk_dig_sel_16g); ++ ++ if (IS_ERR(clk_mux_sel->field)) { ++ dev_err(dev, "REFCLK_DIG_SEL reg field init failed\n"); ++ return PTR_ERR(clk_mux_sel->field); ++ } ++ ++ for (i = 0; i < num_lanes; i++) { ++ wiz->p_enable[i] = devm_regmap_field_alloc(dev, regmap, ++ p_enable[i]); ++ if (IS_ERR(wiz->p_enable[i])) { ++ dev_err(dev, "P%d_ENABLE reg field init failed\n", i); ++ return PTR_ERR(wiz->p_enable[i]); ++ } ++ ++ wiz->p_align[i] = devm_regmap_field_alloc(dev, regmap, ++ p_align[i]); ++ if (IS_ERR(wiz->p_align[i])) { ++ dev_err(dev, "P%d_ALIGN reg field init failed\n", i); ++ return PTR_ERR(wiz->p_align[i]); ++ } ++ ++ wiz->p_raw_auto_start[i] = ++ devm_regmap_field_alloc(dev, regmap, p_raw_auto_start[i]); ++ if (IS_ERR(wiz->p_raw_auto_start[i])) { ++ dev_err(dev, "P%d_RAW_AUTO_START reg field init fail\n", ++ i); ++ return PTR_ERR(wiz->p_raw_auto_start[i]); ++ } ++ ++ wiz->p_standard_mode[i] = ++ devm_regmap_field_alloc(dev, regmap, p_standard_mode[i]); ++ if (IS_ERR(wiz->p_standard_mode[i])) { ++ dev_err(dev, "P%d_STANDARD_MODE reg field init fail\n", ++ i); ++ return PTR_ERR(wiz->p_standard_mode[i]); ++ } ++ } ++ ++ return 0; ++} ++ ++static u8 wiz_clk_mux_get_parent(struct clk_hw *hw) ++{ ++ struct wiz_clk_mux *mux = to_wiz_clk_mux(hw); ++ struct regmap_field *field = mux->field; ++ unsigned int val; ++ ++ regmap_field_read(field, &val); ++ return clk_mux_val_to_index(hw, mux->table, 0, val); ++} ++ ++static int wiz_clk_mux_set_parent(struct clk_hw *hw, u8 index) ++{ ++ struct wiz_clk_mux *mux = to_wiz_clk_mux(hw); ++ struct regmap_field *field = mux->field; ++ int val; ++ ++ val = mux->table[index]; ++ return regmap_field_write(field, val); ++} ++ ++static const struct clk_ops wiz_clk_mux_ops = { ++ .set_parent = wiz_clk_mux_set_parent, ++ .get_parent = wiz_clk_mux_get_parent, ++}; ++ ++static int wiz_mux_clk_register(struct wiz *wiz, struct device_node *node, ++ struct regmap_field *field, u32 *table) ++{ ++ struct device *dev = wiz->dev; ++ struct clk_init_data *init; ++ const char **parent_names; ++ unsigned int num_parents; ++ struct wiz_clk_mux *mux; ++ char clk_name[100]; ++ struct clk *clk; ++ int ret; ++ ++ mux = devm_kzalloc(dev, sizeof(*mux), GFP_KERNEL); ++ if (!mux) ++ return -ENOMEM; ++ ++ num_parents = of_clk_get_parent_count(node); ++ if (num_parents < 2) { ++ dev_err(dev, "SERDES clock must have parents\n"); ++ return -EINVAL; ++ } ++ ++ parent_names = devm_kzalloc(dev, (sizeof(char *) * num_parents), ++ GFP_KERNEL); ++ if (!parent_names) ++ return -ENOMEM; ++ ++ of_clk_parent_fill(node, parent_names, num_parents); ++ ++ snprintf(clk_name, sizeof(clk_name), "%s_%s", dev_name(dev), ++ node->name); ++ ++ init = &mux->clk_data; ++ ++ init->ops = &wiz_clk_mux_ops; ++ init->flags = CLK_SET_RATE_NO_REPARENT; ++ init->parent_names = parent_names; ++ init->num_parents = num_parents; ++ init->name = clk_name; ++ ++ mux->field = field; ++ mux->table = table; ++ mux->hw.init = init; ++ ++ clk = devm_clk_register(dev, &mux->hw); ++ if (IS_ERR(clk)) ++ return PTR_ERR(clk); ++ ++ ret = of_clk_add_provider(node, of_clk_src_simple_get, clk); ++ if (ret) ++ dev_err(dev, "Failed to add clock provider: %s\n", clk_name); ++ ++ return ret; ++} ++ ++static unsigned long wiz_clk_div_recalc_rate(struct clk_hw *hw, ++ unsigned long parent_rate) ++{ ++ struct wiz_clk_divider *div = to_wiz_clk_div(hw); ++ struct regmap_field *field = div->field; ++ int val; ++ ++ regmap_field_read(field, &val); ++ ++ return divider_recalc_rate(hw, parent_rate, val, div->table, 0x0, 2); ++} ++ ++static long wiz_clk_div_round_rate(struct clk_hw *hw, unsigned long rate, ++ unsigned long *prate) ++{ ++ struct wiz_clk_divider *div = to_wiz_clk_div(hw); ++ ++ return divider_round_rate(hw, rate, prate, div->table, 2, 0x0); ++} ++ ++static int wiz_clk_div_set_rate(struct clk_hw *hw, unsigned long rate, ++ unsigned long parent_rate) ++{ ++ struct wiz_clk_divider *div = to_wiz_clk_div(hw); ++ struct regmap_field *field = div->field; ++ int val; ++ ++ val = divider_get_val(rate, parent_rate, div->table, 2, 0x0); ++ if (val < 0) ++ return val; ++ ++ return regmap_field_write(field, val); ++} ++ ++static const struct clk_ops wiz_clk_div_ops = { ++ .recalc_rate = wiz_clk_div_recalc_rate, ++ .round_rate = wiz_clk_div_round_rate, ++ .set_rate = wiz_clk_div_set_rate, ++}; ++ ++static int wiz_div_clk_register(struct wiz *wiz, struct device_node *node, ++ struct regmap_field *field, ++ struct clk_div_table *table) ++{ ++ struct device *dev = wiz->dev; ++ struct wiz_clk_divider *div; ++ struct clk_init_data *init; ++ const char **parent_names; ++ char clk_name[100]; ++ struct clk *clk; ++ int ret; ++ ++ div = devm_kzalloc(dev, sizeof(*div), GFP_KERNEL); ++ if (!div) ++ return -ENOMEM; ++ ++ snprintf(clk_name, sizeof(clk_name), "%s_%s", dev_name(dev), ++ node->name); ++ ++ parent_names = devm_kzalloc(dev, sizeof(char *), GFP_KERNEL); ++ if (!parent_names) ++ return -ENOMEM; ++ ++ of_clk_parent_fill(node, parent_names, 1); ++ ++ init = &div->clk_data; ++ ++ init->ops = &wiz_clk_div_ops; ++ init->flags = 0; ++ init->parent_names = parent_names; ++ init->num_parents = 1; ++ init->name = clk_name; ++ ++ div->field = field; ++ div->table = table; ++ div->hw.init = init; ++ ++ clk = devm_clk_register(dev, &div->hw); ++ if (IS_ERR(clk)) ++ return PTR_ERR(clk); ++ ++ ret = of_clk_add_provider(node, of_clk_src_simple_get, clk); ++ if (ret) ++ dev_err(dev, "Failed to add clock provider: %s\n", clk_name); ++ ++ return ret; ++} ++ ++static void wiz_clock_cleanup(struct wiz *wiz, struct device_node *node) ++{ ++ struct wiz_clk_mux_sel *clk_mux_sel = wiz->clk_mux_sel; ++ struct device_node *clk_node; ++ int i; ++ ++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++) { ++ clk_node = of_get_child_by_name(node, clk_mux_sel[i].node_name); ++ of_clk_del_provider(clk_node); ++ of_node_put(clk_node); ++ } ++} ++ ++static int wiz_clock_init(struct wiz *wiz, struct device_node *node) ++{ ++ struct wiz_clk_mux_sel *clk_mux_sel = wiz->clk_mux_sel; ++ struct device *dev = wiz->dev; ++ struct device_node *clk_node; ++ const char *node_name; ++ unsigned long rate; ++ struct clk *clk; ++ int ret; ++ int i; ++ ++ clk = devm_clk_get(dev, "core_ref_clk"); ++ if (IS_ERR(clk)) { ++ dev_err(dev, "core_ref_clk clock not found\n"); ++ ret = PTR_ERR(clk); ++ return ret; ++ } ++ ++ rate = clk_get_rate(clk); ++ if (rate >= 100000000) ++ regmap_field_write(wiz->pma_cmn_refclk_int_mode, 0x1); ++ else ++ regmap_field_write(wiz->pma_cmn_refclk_int_mode, 0x3); ++ ++ clk = devm_clk_get(dev, "ext_ref_clk"); ++ if (IS_ERR(clk)) { ++ dev_err(dev, "ext_ref_clk clock not found\n"); ++ ret = PTR_ERR(clk); ++ return ret; ++ } ++ ++ rate = clk_get_rate(clk); ++ if (rate >= 100000000) ++ regmap_field_write(wiz->pma_cmn_refclk_mode, 0x0); ++ else ++ regmap_field_write(wiz->pma_cmn_refclk_mode, 0x2); ++ ++ for (i = 0; i < WIZ_MUX_NUM_CLOCKS; i++) { ++ node_name = clk_mux_sel[i].node_name; ++ clk_node = of_get_child_by_name(node, node_name); ++ if (!clk_node) { ++ dev_err(dev, "Unable to get %s node\n", node_name); ++ ret = -EINVAL; ++ goto err; ++ } ++ ++ ret = wiz_mux_clk_register(wiz, clk_node, clk_mux_sel[i].field, ++ clk_mux_sel[i].table); ++ if (ret) { ++ dev_err(dev, "Failed to register %s clock\n", ++ node_name); ++ of_node_put(clk_node); ++ goto err; ++ } ++ ++ of_node_put(clk_node); ++ } ++ ++ for (i = 0; i < wiz->clk_div_sel_num; i++) { ++ node_name = clk_div_sel[i].node_name; ++ clk_node = of_get_child_by_name(node, node_name); ++ if (!clk_node) { ++ dev_err(dev, "Unable to get %s node\n", node_name); ++ ret = -EINVAL; ++ goto err; ++ } ++ ++ ret = wiz_div_clk_register(wiz, clk_node, clk_div_sel[i].field, ++ clk_div_sel[i].table); ++ if (ret) { ++ dev_err(dev, "Failed to register %s clock\n", ++ node_name); ++ of_node_put(clk_node); ++ goto err; ++ } ++ ++ of_node_put(clk_node); ++ } ++ ++ return 0; ++err: ++ wiz_clock_cleanup(wiz, node); ++ ++ return ret; ++} ++ ++static int wiz_phy_reset_assert(struct reset_controller_dev *rcdev, ++ unsigned long id) ++{ ++ struct device *dev = rcdev->dev; ++ struct wiz *wiz = dev_get_drvdata(dev); ++ int ret = 0; ++ ++ if (id == 0) { ++ ret = regmap_field_write(wiz->phy_reset_n, false); ++ return ret; ++ } ++ ++ ret = regmap_field_write(wiz->p_enable[id - 1], false); ++ return ret; ++} ++ ++static int wiz_phy_reset_deassert(struct reset_controller_dev *rcdev, ++ unsigned long id) ++{ ++ struct device *dev = rcdev->dev; ++ struct wiz *wiz = dev_get_drvdata(dev); ++ int ret; ++ ++ if (id == 0) { ++ ret = regmap_field_write(wiz->phy_reset_n, true); ++ return ret; ++ } ++ ++ ret = regmap_field_write(wiz->p_enable[id - 1], true); ++ return ret; ++} ++ ++static const struct reset_control_ops wiz_phy_reset_ops = { ++ .assert = wiz_phy_reset_assert, ++ .deassert = wiz_phy_reset_deassert, ++}; ++ ++static struct regmap_config wiz_regmap_config = { ++ .reg_bits = 32, ++ .val_bits = 32, ++ .reg_stride = 4, ++ .fast_io = true, ++}; ++ ++static const struct of_device_id wiz_id_table[] = { ++ { ++ .compatible = "ti,j721e-wiz-16g", .data = (void *)J721E_WIZ_16G ++ }, ++ { ++ .compatible = "ti,j721e-wiz-10g", .data = (void *)J721E_WIZ_10G ++ }, ++ {} ++}; ++MODULE_DEVICE_TABLE(of, wiz_id_table); ++ ++static int wiz_probe(struct platform_device *pdev) ++{ ++ struct reset_controller_dev *phy_reset_dev; ++ struct device *dev = &pdev->dev; ++ struct device_node *node = dev->of_node; ++ struct platform_device *serdes_pdev; ++ struct device_node *child_node; ++ struct regmap *regmap; ++ struct resource res; ++ void __iomem *base; ++ struct wiz *wiz; ++ u32 num_lanes; ++ int ret; ++ ++ wiz = devm_kzalloc(dev, sizeof(*wiz), GFP_KERNEL); ++ if (!wiz) ++ return -ENOMEM; ++ ++ wiz->type = (enum wiz_type)of_device_get_match_data(dev); ++ ++ child_node = of_get_child_by_name(node, "serdes"); ++ if (!child_node) { ++ dev_err(dev, "Failed to get SERDES child DT node\n"); ++ return -ENODEV; ++ } ++ ++ ret = of_address_to_resource(child_node, 0, &res); ++ if (ret) { ++ dev_err(dev, "Failed to get memory resource\n"); ++ goto err_addr_to_resource; ++ } ++ ++ base = devm_ioremap(dev, res.start, resource_size(&res)); ++ if (IS_ERR(base)) ++ goto err_addr_to_resource; ++ ++ regmap = devm_regmap_init_mmio(dev, base, &wiz_regmap_config); ++ if (IS_ERR(regmap)) { ++ dev_err(dev, "Failed to initialize regmap\n"); ++ ret = PTR_ERR(regmap); ++ goto err_addr_to_resource; ++ } ++ ++ ret = of_property_read_u32(node, "num-lanes", &num_lanes); ++ if (ret) { ++ dev_err(dev, "Failed to read num-lanes property\n"); ++ goto err_addr_to_resource; ++ } ++ ++ if (num_lanes > WIZ_MAX_LANES) { ++ dev_err(dev, "Cannot support %d lanes\n", num_lanes); ++ goto err_addr_to_resource; ++ } ++ ++ wiz->dev = dev; ++ wiz->regmap = regmap; ++ wiz->num_lanes = num_lanes; ++ if (wiz->type == J721E_WIZ_10G) ++ wiz->clk_mux_sel = clk_mux_sel_10g; ++ else ++ wiz->clk_mux_sel = clk_mux_sel_16g; ++ ++ wiz->clk_div_sel = clk_div_sel; ++ ++ if (wiz->type == J721E_WIZ_10G) ++ wiz->clk_div_sel_num = WIZ_DIV_NUM_CLOCKS_10G; ++ else ++ wiz->clk_div_sel_num = WIZ_DIV_NUM_CLOCKS_16G; ++ ++ platform_set_drvdata(pdev, wiz); ++ ++ ret = wiz_regfield_init(wiz); ++ if (ret) { ++ dev_err(dev, "Failed to initialize regfields\n"); ++ goto err_addr_to_resource; ++ } ++ ++ phy_reset_dev = &wiz->wiz_phy_reset_dev; ++ phy_reset_dev->dev = dev; ++ phy_reset_dev->ops = &wiz_phy_reset_ops, ++ phy_reset_dev->owner = THIS_MODULE, ++ phy_reset_dev->of_node = node; ++ /* Reset for each of the lane and one for the entire SERDES */ ++ phy_reset_dev->nr_resets = num_lanes + 1; ++ ++ ret = devm_reset_controller_register(dev, phy_reset_dev); ++ if (ret < 0) { ++ dev_warn(dev, "Failed to register reset controller\n"); ++ goto err_addr_to_resource; ++ } ++ ++ pm_runtime_enable(dev); ++ ret = pm_runtime_get_sync(dev); ++ if (ret < 0) { ++ dev_err(dev, "pm_runtime_get_sync failed\n"); ++ goto err_get_sync; ++ } ++ ++ ret = wiz_clock_init(wiz, node); ++ if (ret < 0) { ++ dev_warn(dev, "Failed to initialize clocks\n"); ++ goto err_get_sync; ++ } ++ ++ serdes_pdev = of_platform_device_create(child_node, NULL, dev); ++ if (!serdes_pdev) { ++ dev_WARN(dev, "Unable to create SERDES platform device\n"); ++ goto err_pdev_create; ++ } ++ wiz->serdes_pdev = serdes_pdev; ++ ++ ret = wiz_init(wiz); ++ if (ret) { ++ dev_err(dev, "WIZ initialization failed\n"); ++ goto err_wiz_init; ++ } ++ ++ of_node_put(child_node); ++ return 0; ++ ++err_wiz_init: ++ of_platform_device_destroy(&serdes_pdev->dev, NULL); ++ ++err_pdev_create: ++ wiz_clock_cleanup(wiz, node); ++ ++err_get_sync: ++ pm_runtime_put(dev); ++ pm_runtime_disable(dev); ++ ++err_addr_to_resource: ++ of_node_put(child_node); ++ ++ return ret; ++} ++ ++static int wiz_remove(struct platform_device *pdev) ++{ ++ struct device *dev = &pdev->dev; ++ struct device_node *node = dev->of_node; ++ struct platform_device *serdes_pdev; ++ struct wiz *wiz; ++ ++ wiz = dev_get_drvdata(dev); ++ serdes_pdev = wiz->serdes_pdev; ++ ++ of_platform_device_destroy(&serdes_pdev->dev, NULL); ++ wiz_clock_cleanup(wiz, node); ++ pm_runtime_put(dev); ++ pm_runtime_disable(dev); ++ ++ return 0; ++} ++ ++static struct platform_driver wiz_driver = { ++ .probe = wiz_probe, ++ .remove = wiz_remove, ++ .driver = { ++ .name = "wiz", ++ .of_match_table = wiz_id_table, ++ }, ++}; ++module_platform_driver(wiz_driver); ++ ++MODULE_AUTHOR("Texas Instruments Inc."); ++MODULE_DESCRIPTION("TI J721E WIZ driver"); ++MODULE_LICENSE("GPL v2"); +-- +2.39.0 + diff --git a/queue-5.4/phy-ti-j721e-wiz-fix-build-error-without-config_of_a.patch b/queue-5.4/phy-ti-j721e-wiz-fix-build-error-without-config_of_a.patch new file mode 100644 index 00000000000..b87261153e8 --- /dev/null +++ b/queue-5.4/phy-ti-j721e-wiz-fix-build-error-without-config_of_a.patch @@ -0,0 +1,45 @@ +From 6681662d9f6c5bc55b7b9a2617287a2d7cd2ac8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jan 2020 02:53:10 +0530 +Subject: phy: ti: j721e-wiz: Fix build error without CONFIG_OF_ADDRESS + +From: Hongbo Yao + +[ Upstream commit 42bbdd99221bac206dde2b5e87098177fcd2a48e ] + +If CONFIG_OF_ADDRESS is not set and COMPILE_TEST=y, the following +error is seen while building phy-j721e-wiz.c + +drivers/phy/ti/phy-j721e-wiz.o: In function `wiz_remove': +phy-j721e-wiz.c:(.text+0x1a): undefined reference to +`of_platform_device_destroy' + +Fix the config dependency for PHY_J721E_WIZ here. + +Reported-by: Hulk Robot +Fixes: 091876cc355d ("phy: ti: j721e-wiz: Add support for WIZ module present in TI J721E SoC") +Signed-off-by: Hongbo Yao +Signed-off-by: Kishon Vijay Abraham I +Link: https://lore.kernel.org/r/20200117212310.2864-1-kishon@ti.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 7124c93887cc ("phy: ti: fix Kconfig warning and operator precedence") +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/ti/Kconfig b/drivers/phy/ti/Kconfig +index af6213b734e6..bb688de9a3ba 100644 +--- a/drivers/phy/ti/Kconfig ++++ b/drivers/phy/ti/Kconfig +@@ -36,6 +36,7 @@ config PHY_AM654_SERDES + config PHY_J721E_WIZ + tristate "TI J721E WIZ (SERDES Wrapper) support" + depends on OF && ARCH_K3 || COMPILE_TEST ++ depends on HAS_IOMEM && OF_ADDRESS + depends on COMMON_CLK + select GENERIC_PHY + select MULTIPLEXER +-- +2.39.0 + diff --git a/queue-5.4/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch b/queue-5.4/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch new file mode 100644 index 00000000000..bff54670ce8 --- /dev/null +++ b/queue-5.4/platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch @@ -0,0 +1,34 @@ +From 6ca4e63b3721219b41a7f8ca53b773a2640b6913 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 19:18:41 +0100 +Subject: platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK + +From: Hans de Goede + +[ Upstream commit db9494895b405bf318dc7e563dee6daa51b3b6ed ] + +The 0x33 keycode is emitted by Fn + F6 on a ASUS FX705GE laptop. + +Reported-by: Nemcev Aleksey +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20230112181841.84652-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 59b78a181723..6424bdb33d2f 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -528,6 +528,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0x30, { KEY_VOLUMEUP } }, + { KE_KEY, 0x31, { KEY_VOLUMEDOWN } }, + { KE_KEY, 0x32, { KEY_MUTE } }, ++ { KE_KEY, 0x33, { KEY_SCREENLOCK } }, + { KE_KEY, 0x35, { KEY_SCREENLOCK } }, + { KE_KEY, 0x40, { KEY_PREVIOUSSONG } }, + { KE_KEY, 0x41, { KEY_NEXTSONG } }, +-- +2.39.0 + diff --git a/queue-5.4/platform-x86-touchscreen_dmi-add-info-for-the-csl-pa.patch b/queue-5.4/platform-x86-touchscreen_dmi-add-info-for-the-csl-pa.patch new file mode 100644 index 00000000000..b8fd1787b90 --- /dev/null +++ b/queue-5.4/platform-x86-touchscreen_dmi-add-info-for-the-csl-pa.patch @@ -0,0 +1,66 @@ +From af15833e58295082bea4c8655ab6e46b5aecd70e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 13:11:03 +0100 +Subject: platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD + +From: Michael Klein + +[ Upstream commit 36c2b9d6710427f802494ba070621cb415198293 ] + +Add touchscreen info for the CSL Panther Tab HD. + +Signed-off-by: Michael Klein +Link: https://lore.kernel.org/r/20221220121103.uiwn5l7fii2iggct@LLGMVZLB-0037 +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index 515c66ca1aec..61cb1a4a8257 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -169,6 +169,23 @@ static const struct ts_dmi_data connect_tablet9_data = { + .properties = connect_tablet9_props, + }; + ++static const struct property_entry csl_panther_tab_hd_props[] = { ++ PROPERTY_ENTRY_U32("touchscreen-min-x", 1), ++ PROPERTY_ENTRY_U32("touchscreen-min-y", 20), ++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1980), ++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1526), ++ PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"), ++ PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"), ++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-csl-panther-tab-hd.fw"), ++ PROPERTY_ENTRY_U32("silead,max-fingers", 10), ++ { } ++}; ++ ++static const struct ts_dmi_data csl_panther_tab_hd_data = { ++ .acpi_name = "MSSL1680:00", ++ .properties = csl_panther_tab_hd_props, ++}; ++ + static const struct property_entry cube_iwork8_air_props[] = { + PROPERTY_ENTRY_U32("touchscreen-min-x", 1), + PROPERTY_ENTRY_U32("touchscreen-min-y", 3), +@@ -721,6 +738,14 @@ static const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Tablet 9"), + }, + }, ++ { ++ /* CSL Panther Tab HD */ ++ .driver_data = (void *)&csl_panther_tab_hd_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "CSL Computer GmbH & Co. KG"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CSL Panther Tab HD"), ++ }, ++ }, + { + /* CUBE iwork8 Air */ + .driver_data = (void *)&cube_iwork8_air_data, +-- +2.39.0 + diff --git a/queue-5.4/rdma-core-fix-ib-block-iterator-counter-overflow.patch b/queue-5.4/rdma-core-fix-ib-block-iterator-counter-overflow.patch new file mode 100644 index 00000000000..1cfea91011d --- /dev/null +++ b/queue-5.4/rdma-core-fix-ib-block-iterator-counter-overflow.patch @@ -0,0 +1,79 @@ +From 7004ba5237463900a9f6c11a6624840c4ff7beaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 13:37:11 +0000 +Subject: RDMA/core: Fix ib block iterator counter overflow + +From: Yonatan Nachum + +[ Upstream commit 0afec5e9cea732cb47014655685a2a47fb180c31 ] + +When registering a new DMA MR after selecting the best aligned page size +for it, we iterate over the given sglist to split each entry to smaller, +aligned to the selected page size, DMA blocks. + +In given circumstances where the sg entry and page size fit certain +sizes and the sg entry is not aligned to the selected page size, the +total size of the aligned pages we need to cover the sg entry is >= 4GB. +Under this circumstances, while iterating page aligned blocks, the +counter responsible for counting how much we advanced from the start of +the sg entry is overflowed because its type is u32 and we pass 4GB in +size. This can lead to an infinite loop inside the iterator function +because the overflow prevents the counter to be larger +than the size of the sg entry. + +Fix the presented problem by changing the advancement condition to +eliminate overflow. + +Backtrace: +[ 192.374329] efa_reg_user_mr_dmabuf +[ 192.376783] efa_register_mr +[ 192.382579] pgsz_bitmap 0xfffff000 rounddown 0x80000000 +[ 192.386423] pg_sz [0x80000000] umem_length[0xc0000000] +[ 192.392657] start 0x0 length 0xc0000000 params.page_shift 31 params.page_num 3 +[ 192.399559] hp_cnt[3], pages_in_hp[524288] +[ 192.403690] umem->sgt_append.sgt.nents[1] +[ 192.407905] number entries: [1], pg_bit: [31] +[ 192.411397] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] +[ 192.415601] biter->__sg_advance [665837568] sg_dma_len[3221225472] +[ 192.419823] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] +[ 192.423976] biter->__sg_advance [2813321216] sg_dma_len[3221225472] +[ 192.428243] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] +[ 192.432397] biter->__sg_advance [665837568] sg_dma_len[3221225472] + +Fixes: a808273a495c ("RDMA/verbs: Add a DMA iterator to return aligned contiguous memory blocks") +Signed-off-by: Yonatan Nachum +Link: https://lore.kernel.org/r/20230109133711.13678-1-ynachum@amazon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/verbs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 5d896f6b2b61..93a7ff1bd02c 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -2840,15 +2840,18 @@ EXPORT_SYMBOL(__rdma_block_iter_start); + bool __rdma_block_iter_next(struct ib_block_iter *biter) + { + unsigned int block_offset; ++ unsigned int sg_delta; + + if (!biter->__sg_nents || !biter->__sg) + return false; + + biter->__dma_addr = sg_dma_address(biter->__sg) + biter->__sg_advance; + block_offset = biter->__dma_addr & (BIT_ULL(biter->__pg_bit) - 1); +- biter->__sg_advance += BIT_ULL(biter->__pg_bit) - block_offset; ++ sg_delta = BIT_ULL(biter->__pg_bit) - block_offset; + +- if (biter->__sg_advance >= sg_dma_len(biter->__sg)) { ++ if (sg_dma_len(biter->__sg) - biter->__sg_advance > sg_delta) { ++ biter->__sg_advance += sg_delta; ++ } else { + biter->__sg_advance = 0; + biter->__sg = sg_next(biter->__sg); + biter->__sg_nents--; +-- +2.39.0 + diff --git a/queue-5.4/s390-debug-add-_asm_s390_-prefix-to-header-guard.patch b/queue-5.4/s390-debug-add-_asm_s390_-prefix-to-header-guard.patch new file mode 100644 index 00000000000..db882e211a5 --- /dev/null +++ b/queue-5.4/s390-debug-add-_asm_s390_-prefix-to-header-guard.patch @@ -0,0 +1,46 @@ +From 78dab07b88eb1383db68d20ae6bd6c4fc9fcd415 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 15:11:07 +0100 +Subject: s390/debug: add _ASM_S390_ prefix to header guard + +From: Niklas Schnelle + +[ Upstream commit 0d4d52361b6c29bf771acd4fa461f06d78fb2fac ] + +Using DEBUG_H without a prefix is very generic and inconsistent with +other header guards in arch/s390/include/asm. In fact it collides with +the same name in the ath9k wireless driver though that depends on !S390 +via disabled wireless support. Let's just use a consistent header guard +name and prevent possible future trouble. + +Signed-off-by: Niklas Schnelle +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/debug.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/include/asm/debug.h b/arch/s390/include/asm/debug.h +index 310134015541..54f4bc5d1108 100644 +--- a/arch/s390/include/asm/debug.h ++++ b/arch/s390/include/asm/debug.h +@@ -4,8 +4,8 @@ + * + * Copyright IBM Corp. 1999, 2000 + */ +-#ifndef DEBUG_H +-#define DEBUG_H ++#ifndef _ASM_S390_DEBUG_H ++#define _ASM_S390_DEBUG_H + + #include + #include +@@ -416,4 +416,4 @@ int debug_unregister_view(debug_info_t *id, struct debug_view *view); + #define PRINT_FATAL(x...) printk(KERN_DEBUG PRINTK_HEADER x) + #endif /* DASD_DEBUG */ + +-#endif /* DEBUG_H */ ++#endif /* _ASM_S390_DEBUG_H */ +-- +2.39.0 + diff --git a/queue-5.4/scsi-hisi_sas-set-a-port-invalid-only-if-there-are-n.patch b/queue-5.4/scsi-hisi_sas-set-a-port-invalid-only-if-there-are-n.patch new file mode 100644 index 00000000000..2170128253d --- /dev/null +++ b/queue-5.4/scsi-hisi_sas-set-a-port-invalid-only-if-there-are-n.patch @@ -0,0 +1,43 @@ +From acf1288af3439de11bb9a0b2ffd69734c75c0dd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 12:03:20 +0800 +Subject: scsi: hisi_sas: Set a port invalid only if there are no devices + attached when refreshing port id + +From: Yihang Li + +[ Upstream commit f58c89700630da6554b24fd3df293a24874c10c1 ] + +Currently the driver sets the port invalid if one phy in the port is not +enabled, which may cause issues in expander situation. In directly attached +situation, if phy up doesn't occur in time when refreshing port id, the +port is incorrectly set to invalid which will also cause disk lost. + +Therefore set a port invalid only if there are no devices attached to the +port. + +Signed-off-by: Yihang Li +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1672805000-141102-3-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 031aa4043c5e..7135bbe5abb8 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -1397,7 +1397,7 @@ static void hisi_sas_refresh_port_id(struct hisi_hba *hisi_hba) + device->linkrate = phy->sas_phy.linkrate; + + hisi_hba->hw->setup_itct(hisi_hba, sas_dev); +- } else ++ } else if (!port->port_attached) + port->id = 0xff; + } + } +-- +2.39.0 + diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..e09ab0e32d7 --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,70 @@ +clk-generalize-devm_clk_get-a-bit.patch +clk-provide-new-devm_clk-helpers-for-prepared-and-en.patch +memory-atmel-sdramc-fix-missing-clk_disable_unprepar.patch +memory-mvebu-devbus-fix-missing-clk_disable_unprepar.patch +arm-dts-imx6qdl-gw560x-remove-incorrect-uart-has-rts.patch +arm-imx27-retrieve-the-sysctrl-base-address-from-dev.patch +arm-imx31-retrieve-the-iim-base-address-from-devicet.patch +arm-imx35-retrieve-the-iim-base-address-from-devicet.patch +arm-imx-add-missing-of_node_put.patch +hid-intel_ish-hid-add-check-for-ishtp_dma_tx_map.patch +edac-highbank-fix-memory-leak-in-highbank_mc_probe.patch +tomoyo-fix-broken-dependency-on-.conf.default.patch +rdma-core-fix-ib-block-iterator-counter-overflow.patch +ib-hfi1-reject-a-zero-length-user-expected-buffer.patch +ib-hfi1-reserve-user-expected-tids.patch +ib-hfi1-fix-expected-receive-setup-error-exit-issues.patch +affs-initialize-fsdata-in-affs_truncate.patch +phy-ti-j721e-wiz-add-support-for-wiz-module-present-.patch +phy-ti-j721e-wiz-fix-build-error-without-config_of_a.patch +phy-ti-fix-kconfig-warning-and-operator-precedence.patch +amd-xgbe-tx-flow-ctrl-registers-are-h-w-ver-dependen.patch +amd-xgbe-delay-an-timeout-during-kr-training.patch +bpf-fix-pointer-leak-due-to-insufficient-speculative.patch +phy-rockchip-inno-usb2-fix-missing-clk_disable_unpre.patch +net-nfc-fix-use-after-free-in-local_cleanup.patch +net-wan-add-checks-for-null-for-utdm-in-undo_uhdlc_i.patch +gpio-mxc-always-set-gpios-used-as-interrupt-source-t.patch +wifi-rndis_wlan-prevent-buffer-overflow-in-rndis_que.patch +net-sched-sch_taprio-fix-possible-use-after-free.patch +net-fix-a-concurrency-bug-in-l2tp_tunnel_register.patch +l2tp-serialize-access-to-sk_user_data-with-sk_callba.patch +l2tp-don-t-sleep-and-disable-bh-under-writer-side-sk.patch +net-usb-sr9700-handle-negative-len.patch +net-mdio-validate-parameter-addr-in-mdiobus_get_phy.patch +hid-check-empty-report_list-in-hid_validate_values.patch +hid-check-empty-report_list-in-bigben_probe.patch +net-stmmac-fix-invalid-call-to-mdiobus_get_phy.patch +hid-revert-cherry_mouse_000c-quirk.patch +usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch +usb-gadget-f_fs-ensure-ep0req-is-dequeued-before-fre.patch +net-mlx5-eliminate-anonymous-module_init-module_exit.patch +drm-panfrost-fix-generic_atomic64-dependency.patch +dmaengine-fix-double-increment-of-client_count-in-dm.patch +net-macb-fix-ptp-tx-timestamp-failure-due-to-packet-.patch +hid-betop-check-shape-of-output-reports.patch +dmaengine-xilinx_dma-use-devm_platform_ioremap_resou.patch +dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch +dmaengine-xilinx_dma-call-of_node_put-when-breaking-.patch +tcp-avoid-the-lookup-process-failing-to-get-sk-in-eh.patch +w1-fix-deadloop-in-__w1_remove_master_device.patch +w1-fix-warning-after-calling-w1_process.patch +driver-core-fix-test_async_probe_init-saves-device-i.patch +net-dsa-microchip-ksz9477-port-map-correction-in-alu.patch +tcp-fix-rate_app_limited-to-default-to-1.patch +cpufreq-add-tegra234-to-cpufreq-dt-platdev-blocklist.patch +asoc-fsl_micfil-correct-the-number-of-steps-on-sx-co.patch +drm-add-orientation-quirk-for-lenovo-ideapad-d330-10.patch +s390-debug-add-_asm_s390_-prefix-to-header-guard.patch +cpufreq-armada-37xx-stop-using-0-as-null-pointer.patch +asoc-fsl_ssi-rename-ac-97-streams-to-avoid-collision.patch +asoc-fsl-asoc-card-fix-naming-of-ac-97-codec-widgets.patch +spi-spidev-remove-debug-messages-that-access-spidev-.patch +kvm-s390-interrupt-use-read_once-before-cmpxchg.patch +scsi-hisi_sas-set-a-port-invalid-only-if-there-are-n.patch +platform-x86-touchscreen_dmi-add-info-for-the-csl-pa.patch +platform-x86-asus-nb-wmi-add-alternate-mapping-for-k.patch +lockref-stop-doing-cpu_relax-in-the-cmpxchg-loop.patch +mmc-sdhci-esdhc-imx-clear-pending-interrupt-and-halt.patch +mmc-sdhci-esdhc-imx-disable-the-cmd-crc-check-for-st.patch +mmc-sdhci-esdhc-imx-correct-the-tuning-start-tap-and.patch diff --git a/queue-5.4/spi-spidev-remove-debug-messages-that-access-spidev-.patch b/queue-5.4/spi-spidev-remove-debug-messages-that-access-spidev-.patch new file mode 100644 index 00000000000..fc4441b4adb --- /dev/null +++ b/queue-5.4/spi-spidev-remove-debug-messages-that-access-spidev-.patch @@ -0,0 +1,46 @@ +From e12e57664c6352d3b7c29d09c0531e70f7d82acd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 11:07:19 +0100 +Subject: spi: spidev: remove debug messages that access spidev->spi without + locking + +From: Bartosz Golaszewski + +[ Upstream commit 6b35b173dbc1711f8d272e3f322d2ad697015919 ] + +The two debug messages in spidev_open() dereference spidev->spi without +taking the lock and without checking if it's not null. This can lead to +a crash. Drop the messages as they're not needed - the user-space will +get informed about ENOMEM with the syscall return value. + +Signed-off-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20230106100719.196243-2-brgl@bgdev.pl +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 2478ae471f4e..6d6fc7de9cf3 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -588,7 +588,6 @@ static int spidev_open(struct inode *inode, struct file *filp) + if (!spidev->tx_buffer) { + spidev->tx_buffer = kmalloc(bufsiz, GFP_KERNEL); + if (!spidev->tx_buffer) { +- dev_dbg(&spidev->spi->dev, "open/ENOMEM\n"); + status = -ENOMEM; + goto err_find_dev; + } +@@ -597,7 +596,6 @@ static int spidev_open(struct inode *inode, struct file *filp) + if (!spidev->rx_buffer) { + spidev->rx_buffer = kmalloc(bufsiz, GFP_KERNEL); + if (!spidev->rx_buffer) { +- dev_dbg(&spidev->spi->dev, "open/ENOMEM\n"); + status = -ENOMEM; + goto err_alloc_rx_buf; + } +-- +2.39.0 + diff --git a/queue-5.4/tcp-avoid-the-lookup-process-failing-to-get-sk-in-eh.patch b/queue-5.4/tcp-avoid-the-lookup-process-failing-to-get-sk-in-eh.patch new file mode 100644 index 00000000000..e18fafe6e1b --- /dev/null +++ b/queue-5.4/tcp-avoid-the-lookup-process-failing-to-get-sk-in-eh.patch @@ -0,0 +1,121 @@ +From 43eb4d93b9819628c689ac7e65a6ca7749f0b07f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 09:59:41 +0800 +Subject: tcp: avoid the lookup process failing to get sk in ehash table + +From: Jason Xing + +[ Upstream commit 3f4ca5fafc08881d7a57daa20449d171f2887043 ] + +While one cpu is working on looking up the right socket from ehash +table, another cpu is done deleting the request socket and is about +to add (or is adding) the big socket from the table. It means that +we could miss both of them, even though it has little chance. + +Let me draw a call trace map of the server side. + CPU 0 CPU 1 + ----- ----- +tcp_v4_rcv() syn_recv_sock() + inet_ehash_insert() + -> sk_nulls_del_node_init_rcu(osk) +__inet_lookup_established() + -> __sk_nulls_add_node_rcu(sk, list) + +Notice that the CPU 0 is receiving the data after the final ack +during 3-way shakehands and CPU 1 is still handling the final ack. + +Why could this be a real problem? +This case is happening only when the final ack and the first data +receiving by different CPUs. Then the server receiving data with +ACK flag tries to search one proper established socket from ehash +table, but apparently it fails as my map shows above. After that, +the server fetches a listener socket and then sends a RST because +it finds a ACK flag in the skb (data), which obeys RST definition +in RFC 793. + +Besides, Eric pointed out there's one more race condition where it +handles tw socket hashdance. Only by adding to the tail of the list +before deleting the old one can we avoid the race if the reader has +already begun the bucket traversal and it would possibly miss the head. + +Many thanks to Eric for great help from beginning to end. + +Fixes: 5e0724d027f0 ("tcp/dccp: fix hashdance race for passive sessions") +Suggested-by: Eric Dumazet +Signed-off-by: Jason Xing +Reviewed-by: Eric Dumazet +Reviewed-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/lkml/20230112065336.41034-1-kerneljasonxing@gmail.com/ +Link: https://lore.kernel.org/r/20230118015941.1313-1-kerneljasonxing@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 17 +++++++++++++++-- + net/ipv4/inet_timewait_sock.c | 8 ++++---- + 2 files changed, 19 insertions(+), 6 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 25334aa3da04..33292983b8cf 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -536,8 +536,20 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) + spin_lock(lock); + if (osk) { + WARN_ON_ONCE(sk->sk_hash != osk->sk_hash); +- ret = sk_nulls_del_node_init_rcu(osk); +- } else if (found_dup_sk) { ++ ret = sk_hashed(osk); ++ if (ret) { ++ /* Before deleting the node, we insert a new one to make ++ * sure that the look-up-sk process would not miss either ++ * of them and that at least one node would exist in ehash ++ * table all the time. Otherwise there's a tiny chance ++ * that lookup process could find nothing in ehash table. ++ */ ++ __sk_nulls_add_node_tail_rcu(sk, list); ++ sk_nulls_del_node_init_rcu(osk); ++ } ++ goto unlock; ++ } ++ if (found_dup_sk) { + *found_dup_sk = inet_ehash_lookup_by_sk(sk, list); + if (*found_dup_sk) + ret = false; +@@ -546,6 +558,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk) + if (ret) + __sk_nulls_add_node_rcu(sk, list); + ++unlock: + spin_unlock(lock); + + return ret; +diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c +index c411c87ae865..a00102d7c7fd 100644 +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -81,10 +81,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw) + } + EXPORT_SYMBOL_GPL(inet_twsk_put); + +-static void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw, +- struct hlist_nulls_head *list) ++static void inet_twsk_add_node_tail_rcu(struct inet_timewait_sock *tw, ++ struct hlist_nulls_head *list) + { +- hlist_nulls_add_head_rcu(&tw->tw_node, list); ++ hlist_nulls_add_tail_rcu(&tw->tw_node, list); + } + + static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw, +@@ -120,7 +120,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk, + + spin_lock(lock); + +- inet_twsk_add_node_rcu(tw, &ehead->chain); ++ inet_twsk_add_node_tail_rcu(tw, &ehead->chain); + + /* Step 3: Remove SK from hash chain */ + if (__sk_nulls_del_node_init_rcu(sk)) +-- +2.39.0 + diff --git a/queue-5.4/tcp-fix-rate_app_limited-to-default-to-1.patch b/queue-5.4/tcp-fix-rate_app_limited-to-default-to-1.patch new file mode 100644 index 00000000000..2ec03ebce3f --- /dev/null +++ b/queue-5.4/tcp-fix-rate_app_limited-to-default-to-1.patch @@ -0,0 +1,51 @@ +From bfb91be6d999606642564a1768a7bb412231a3c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 19:00:28 +0000 +Subject: tcp: fix rate_app_limited to default to 1 + +From: David Morley + +[ Upstream commit 300b655db1b5152d6101bcb6801d50899b20c2d6 ] + +The initial default value of 0 for tp->rate_app_limited was incorrect, +since a flow is indeed application-limited until it first sends +data. Fixing the default to be 1 is generally correct but also +specifically will help user-space applications avoid using the initial +tcpi_delivery_rate value of 0 that persists until the connection has +some non-zero bandwidth sample. + +Fixes: eb8329e0a04d ("tcp: export data delivery rate") +Suggested-by: Yuchung Cheng +Signed-off-by: David Morley +Signed-off-by: Neal Cardwell +Tested-by: David Morley +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 93825ec968aa..a74965a6a54f 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -429,6 +429,7 @@ void tcp_init_sock(struct sock *sk) + + /* There's a bubble in the pipe until at least the first ACK. */ + tp->app_limited = ~0U; ++ tp->rate_app_limited = 1; + + /* See draft-stevens-tcpca-spec-01 for discussion of the + * initialization of these values. +@@ -2675,6 +2676,7 @@ int tcp_disconnect(struct sock *sk, int flags) + tp->last_oow_ack_time = 0; + /* There's a bubble in the pipe until at least the first ACK. */ + tp->app_limited = ~0U; ++ tp->rate_app_limited = 1; + tp->rack.mstamp = 0; + tp->rack.advanced = 0; + tp->rack.reo_wnd_steps = 1; +-- +2.39.0 + diff --git a/queue-5.4/tomoyo-fix-broken-dependency-on-.conf.default.patch b/queue-5.4/tomoyo-fix-broken-dependency-on-.conf.default.patch new file mode 100644 index 00000000000..d7896f93199 --- /dev/null +++ b/queue-5.4/tomoyo-fix-broken-dependency-on-.conf.default.patch @@ -0,0 +1,61 @@ +From 1659c3c9dd2c0f6b721116b86e445d5618df3cc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jan 2023 16:47:41 +0900 +Subject: tomoyo: fix broken dependency on *.conf.default + +From: Masahiro Yamada + +[ Upstream commit eaf2213ba563b2d74a1f2c13a6b258273f689802 ] + +If *.conf.default is updated, builtin-policy.h should be rebuilt, +but this does not work when compiled with O= option. + +[Without this commit] + + $ touch security/tomoyo/policy/exception_policy.conf.default + $ make O=/tmp security/tomoyo/ + make[1]: Entering directory '/tmp' + GEN Makefile + CALL /home/masahiro/ref/linux/scripts/checksyscalls.sh + DESCEND objtool + make[1]: Leaving directory '/tmp' + +[With this commit] + + $ touch security/tomoyo/policy/exception_policy.conf.default + $ make O=/tmp security/tomoyo/ + make[1]: Entering directory '/tmp' + GEN Makefile + CALL /home/masahiro/ref/linux/scripts/checksyscalls.sh + DESCEND objtool + POLICY security/tomoyo/builtin-policy.h + CC security/tomoyo/common.o + AR security/tomoyo/built-in.a + make[1]: Leaving directory '/tmp' + +$(srctree)/ is essential because $(wildcard ) does not follow VPATH. + +Fixes: f02dee2d148b ("tomoyo: Do not generate empty policy files") +Signed-off-by: Masahiro Yamada +Signed-off-by: Tetsuo Handa +Signed-off-by: Sasha Levin +--- + security/tomoyo/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/tomoyo/Makefile b/security/tomoyo/Makefile +index cca5a3012fee..221eaadffb09 100644 +--- a/security/tomoyo/Makefile ++++ b/security/tomoyo/Makefile +@@ -10,7 +10,7 @@ endef + quiet_cmd_policy = POLICY $@ + cmd_policy = ($(call do_policy,profile); $(call do_policy,exception_policy); $(call do_policy,domain_policy); $(call do_policy,manager); $(call do_policy,stat)) >$@ + +-$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(src)/policy/*.conf.default) FORCE ++$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(srctree)/$(src)/policy/*.conf.default) FORCE + $(call if_changed,policy) + + $(obj)/common.o: $(obj)/builtin-policy.h +-- +2.39.0 + diff --git a/queue-5.4/usb-gadget-f_fs-ensure-ep0req-is-dequeued-before-fre.patch b/queue-5.4/usb-gadget-f_fs-ensure-ep0req-is-dequeued-before-fre.patch new file mode 100644 index 00000000000..a0f2b4dce65 --- /dev/null +++ b/queue-5.4/usb-gadget-f_fs-ensure-ep0req-is-dequeued-before-fre.patch @@ -0,0 +1,43 @@ +From 23d70b688159117489387d782059899643abb829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 10:59:06 +0530 +Subject: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request + +From: Udipto Goswami + +[ Upstream commit ce405d561b020e5a46340eb5146805a625dcacee ] + +As per the documentation, function usb_ep_free_request guarantees +the request will not be queued or no longer be re-queued (or +otherwise used). However, with the current implementation it +doesn't make sure that the request in ep0 isn't reused. + +Fix this by dequeuing the ep0req on functionfs_unbind before +freeing the request to align with the definition. + +Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver") +Signed-off-by: Udipto Goswami +Tested-by: Krishna Kurapati +Link: https://lore.kernel.org/r/20221215052906.8993-3-quic_ugoswami@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 3b7323233b39..431ab6d07497 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1903,6 +1903,8 @@ static void functionfs_unbind(struct ffs_data *ffs) + ENTER(); + + if (!WARN_ON(!ffs->gadget)) { ++ /* dequeue before freeing ep0req */ ++ usb_ep_dequeue(ffs->gadget->ep0, ffs->ep0req); + mutex_lock(&ffs->mutex); + usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req); + ffs->ep0req = NULL; +-- +2.39.0 + diff --git a/queue-5.4/usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch b/queue-5.4/usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch new file mode 100644 index 00000000000..7c35ac798f3 --- /dev/null +++ b/queue-5.4/usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch @@ -0,0 +1,61 @@ +From f7c4b6102862ac0f2b361667d7fc286c1ccfc002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 10:59:05 +0530 +Subject: usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait + +From: Udipto Goswami + +[ Upstream commit 6a19da111057f69214b97c62fb0ac59023970850 ] + +While performing fast composition switch, there is a possibility that the +process of ffs_ep0_write/ffs_ep0_read get into a race condition +due to ep0req being freed up from functionfs_unbind. + +Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait +by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't +bounded so it can go ahead and mark the ep0req to NULL, and since there +is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free. + +Fix this by making a serialized execution between the two functions using +a mutex_lock(ffs->mutex). + +Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver") +Signed-off-by: Udipto Goswami +Tested-by: Krishna Kurapati +Link: https://lore.kernel.org/r/20221215052906.8993-2-quic_ugoswami@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 5fd4fc49aef9..3b7323233b39 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -278,6 +278,9 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len) + struct usb_request *req = ffs->ep0req; + int ret; + ++ if (!req) ++ return -EINVAL; ++ + req->zero = len < le16_to_cpu(ffs->ev.setup.wLength); + + spin_unlock_irq(&ffs->ev.waitq.lock); +@@ -1900,10 +1903,12 @@ static void functionfs_unbind(struct ffs_data *ffs) + ENTER(); + + if (!WARN_ON(!ffs->gadget)) { ++ mutex_lock(&ffs->mutex); + usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req); + ffs->ep0req = NULL; + ffs->gadget = NULL; + clear_bit(FFS_FL_BOUND, &ffs->flags); ++ mutex_unlock(&ffs->mutex); + ffs_data_put(ffs); + } + } +-- +2.39.0 + diff --git a/queue-5.4/w1-fix-deadloop-in-__w1_remove_master_device.patch b/queue-5.4/w1-fix-deadloop-in-__w1_remove_master_device.patch new file mode 100644 index 00000000000..ca1d44e2f62 --- /dev/null +++ b/queue-5.4/w1-fix-deadloop-in-__w1_remove_master_device.patch @@ -0,0 +1,83 @@ +From 403f254f732d02adb40dbe38f938f12382d6330c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 16:04:34 +0800 +Subject: w1: fix deadloop in __w1_remove_master_device() + +From: Yang Yingliang + +[ Upstream commit 25d5648802f12ae486076ceca5d7ddf1fef792b2 ] + +I got a deadloop report while doing device(ds2482) add/remove test: + + [ 162.241881] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. + [ 163.272251] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. + [ 164.296157] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. + ... + +__w1_remove_master_device() can't return, because the dev->refcnt is not zero. + +w1_add_master_device() | + w1_alloc_dev() | + atomic_set(&dev->refcnt, 2) | + kthread_run() | + |__w1_remove_master_device() + | kthread_stop() + // KTHREAD_SHOULD_STOP is set, | + // threadfn(w1_process) won't be | + // called. | + kthread() | + | // refcnt will never be 0, it's deadloop. + | while (atomic_read(&dev->refcnt)) {...} + +After calling w1_add_master_device(), w1_process() is not really +invoked, before w1_process() starting, if kthread_stop() is called +in __w1_remove_master_device(), w1_process() will never be called, +the refcnt can not be decreased, then it causes deadloop in remove +function because of non-zero refcnt. + +We need to make sure w1_process() is really started, so move the +set refcnt into w1_process() to fix this problem. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221205080434.3149205-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/w1/w1.c | 2 ++ + drivers/w1/w1_int.c | 5 ++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index e58c7592008d..9a9c6f54304e 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1131,6 +1131,8 @@ int w1_process(void *data) + /* remainder if it woke up early */ + unsigned long jremain = 0; + ++ atomic_inc(&dev->refcnt); ++ + for (;;) { + + if (!jremain && dev->search_count) { +diff --git a/drivers/w1/w1_int.c b/drivers/w1/w1_int.c +index b3e1792d9c49..3a71c5eb2f83 100644 +--- a/drivers/w1/w1_int.c ++++ b/drivers/w1/w1_int.c +@@ -51,10 +51,9 @@ static struct w1_master *w1_alloc_dev(u32 id, int slave_count, int slave_ttl, + dev->search_count = w1_search_count; + dev->enable_pullup = w1_enable_pullup; + +- /* 1 for w1_process to decrement +- * 1 for __w1_remove_master_device to decrement ++ /* For __w1_remove_master_device to decrement + */ +- atomic_set(&dev->refcnt, 2); ++ atomic_set(&dev->refcnt, 1); + + INIT_LIST_HEAD(&dev->slist); + INIT_LIST_HEAD(&dev->async_list); +-- +2.39.0 + diff --git a/queue-5.4/w1-fix-warning-after-calling-w1_process.patch b/queue-5.4/w1-fix-warning-after-calling-w1_process.patch new file mode 100644 index 00000000000..5321b884089 --- /dev/null +++ b/queue-5.4/w1-fix-warning-after-calling-w1_process.patch @@ -0,0 +1,55 @@ +From f89e2c84bf00110f9370645a6654272a9a99a85a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 18:15:58 +0800 +Subject: w1: fix WARNING after calling w1_process() + +From: Yang Yingliang + +[ Upstream commit 36225a7c72e9e3e1ce4001b6ce72849f5c9a2d3b ] + +I got the following WARNING message while removing driver(ds2482): + +------------[ cut here ]------------ +do not call blocking ops when !TASK_RUNNING; state=1 set at [<000000002d50bfb6>] w1_process+0x9e/0x1d0 [wire] +WARNING: CPU: 0 PID: 262 at kernel/sched/core.c:9817 __might_sleep+0x98/0xa0 +CPU: 0 PID: 262 Comm: w1_bus_master1 Tainted: G N 6.1.0-rc3+ #307 +RIP: 0010:__might_sleep+0x98/0xa0 +Call Trace: + exit_signals+0x6c/0x550 + do_exit+0x2b4/0x17e0 + kthread_exit+0x52/0x60 + kthread+0x16d/0x1e0 + ret_from_fork+0x1f/0x30 + +The state of task is set to TASK_INTERRUPTIBLE in loop in w1_process(), +set it to TASK_RUNNING when it breaks out of the loop to avoid the +warning. + +Fixes: 3c52e4e62789 ("W1: w1_process, block or sleep") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221205101558.3599162-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/w1/w1.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index 9a9c6f54304e..2a7970a10533 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1160,8 +1160,10 @@ int w1_process(void *data) + */ + mutex_unlock(&dev->list_mutex); + +- if (kthread_should_stop()) ++ if (kthread_should_stop()) { ++ __set_current_state(TASK_RUNNING); + break; ++ } + + /* Only sleep when the search is active. */ + if (dev->search_count) { +-- +2.39.0 + diff --git a/queue-5.4/wifi-rndis_wlan-prevent-buffer-overflow-in-rndis_que.patch b/queue-5.4/wifi-rndis_wlan-prevent-buffer-overflow-in-rndis_que.patch new file mode 100644 index 00000000000..f6bc7a6bf3b --- /dev/null +++ b/queue-5.4/wifi-rndis_wlan-prevent-buffer-overflow-in-rndis_que.patch @@ -0,0 +1,75 @@ +From 44974ac8d022dcf07cc8d4a3049a9f5131de0182 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 18:50:31 +0100 +Subject: wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid + +From: Szymon Heidrich + +[ Upstream commit b870e73a56c4cccbec33224233eaf295839f228c ] + +Since resplen and respoffs are signed integers sufficiently +large values of unsigned int len and offset members of RNDIS +response will result in negative values of prior variables. +This may be utilized to bypass implemented security checks +to either extract memory contents by manipulating offset or +overflow the data buffer via memcpy by manipulating both +offset and len. + +Additionally assure that sum of resplen and respoffs does not +overflow so buffer boundaries are kept. + +Fixes: 80f8c5b434f9 ("rndis_wlan: copy only useful data from rndis_command respond") +Signed-off-by: Szymon Heidrich +Reviewed-by: Alexander Duyck +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230111175031.7049-1-szymon.heidrich@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rndis_wlan.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c +index c8f8fe5497a8..ace016967ff0 100644 +--- a/drivers/net/wireless/rndis_wlan.c ++++ b/drivers/net/wireless/rndis_wlan.c +@@ -700,8 +700,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) + struct rndis_query *get; + struct rndis_query_c *get_c; + } u; +- int ret, buflen; +- int resplen, respoffs, copylen; ++ int ret; ++ size_t buflen, resplen, respoffs, copylen; + + buflen = *len + sizeof(*u.get); + if (buflen < CONTROL_BUFFER_SIZE) +@@ -736,22 +736,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) + + if (respoffs > buflen) { + /* Device returned data offset outside buffer, error. */ +- netdev_dbg(dev->net, "%s(%s): received invalid " +- "data offset: %d > %d\n", __func__, +- oid_to_string(oid), respoffs, buflen); ++ netdev_dbg(dev->net, ++ "%s(%s): received invalid data offset: %zu > %zu\n", ++ __func__, oid_to_string(oid), respoffs, buflen); + + ret = -EINVAL; + goto exit_unlock; + } + +- if ((resplen + respoffs) > buflen) { +- /* Device would have returned more data if buffer would +- * have been big enough. Copy just the bits that we got. +- */ +- copylen = buflen - respoffs; +- } else { +- copylen = resplen; +- } ++ copylen = min(resplen, buflen - respoffs); + + if (copylen > *len) + copylen = *len; +-- +2.39.0 +