From: Sasha Levin Date: Sat, 18 Jun 2022 17:07:49 +0000 (-0400) Subject: Fixes for 5.18 X-Git-Tag: v5.4.200~71 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7c3937a68cedcf60ac83055f0ca8555a231e6995;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.18 Signed-off-by: Sasha Levin --- diff --git a/queue-5.18/alsa-hda-mtl-add-hd-audio-pci-id-and-hdmi-codec-vend.patch b/queue-5.18/alsa-hda-mtl-add-hd-audio-pci-id-and-hdmi-codec-vend.patch new file mode 100644 index 00000000000..20c0a054d82 --- /dev/null +++ b/queue-5.18/alsa-hda-mtl-add-hd-audio-pci-id-and-hdmi-codec-vend.patch @@ -0,0 +1,53 @@ +From fb9c4b59a1276dc43328a0471cbc7785f6cf70db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 15:42:32 -0500 +Subject: ALSA: hda: MTL: add HD Audio PCI ID and HDMI codec vendor ID + +From: Yong Zhi + +[ Upstream commit 2e45f2185283a2d927ef2cdbdc246cd65740c8df ] + +Add HD Audio PCI ID for Intel Meteorlake platform. + +[ corrected the hex number to lower letters by tiwai ] + +Signed-off-by: Kai Vehmanen +Signed-off-by: Yong Zhi +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220606204232.144296-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_intel.c | 3 +++ + sound/pci/hda/patch_hdmi.c | 1 + + 2 files changed, 4 insertions(+) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 0a83eb6b88b1..a77165bd92a9 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2525,6 +2525,9 @@ static const struct pci_device_id azx_ids[] = { + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + { PCI_DEVICE(0x8086, 0x51cf), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ /* Meteorlake-P */ ++ { PCI_DEVICE(0x8086, 0x7e28), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* Broxton-P(Apollolake) */ + { PCI_DEVICE(0x8086, 0x5a98), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON }, +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 31fe41795571..6c209cd26c0c 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -4554,6 +4554,7 @@ HDA_CODEC_ENTRY(0x8086281a, "Jasperlake HDMI", patch_i915_icl_hdmi), + HDA_CODEC_ENTRY(0x8086281b, "Elkhartlake HDMI", patch_i915_icl_hdmi), + HDA_CODEC_ENTRY(0x8086281c, "Alderlake-P HDMI", patch_i915_adlp_hdmi), + HDA_CODEC_ENTRY(0x8086281f, "Raptorlake-P HDMI", patch_i915_adlp_hdmi), ++HDA_CODEC_ENTRY(0x8086281d, "Meteorlake HDMI", patch_i915_adlp_hdmi), + HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi), + HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI", patch_i915_byt_hdmi), + HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI", patch_i915_byt_hdmi), +-- +2.35.1 + diff --git a/queue-5.18/alsa-hda-realtek-add-hw8326-support.patch b/queue-5.18/alsa-hda-realtek-add-hw8326-support.patch new file mode 100644 index 00000000000..d7ec18231fd --- /dev/null +++ b/queue-5.18/alsa-hda-realtek-add-hw8326-support.patch @@ -0,0 +1,152 @@ +From 60f04708e5fc7cec01c9ffee119e88d1f2929024 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 16:23:57 +0800 +Subject: ALSA: hda/realtek - Add HW8326 support + +From: huangwenhui + +[ Upstream commit 527f4643e03c298c1e3321cfa27866b1374a55e1 ] + +Added the support of new Huawei codec HW8326. The HW8326 is developed +by Huawei with Realtek's IP Core, and it's compatible with ALC256. + +Signed-off-by: huangwenhui +Link: https://lore.kernel.org/r/20220608082357.26898-1-huangwenhuia@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/hdac_device.c | 1 + + sound/pci/hda/patch_realtek.c | 14 ++++++++++++++ + 2 files changed, 15 insertions(+) + +diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c +index 3e9e9ac804f6..b7e5032b61c9 100644 +--- a/sound/hda/hdac_device.c ++++ b/sound/hda/hdac_device.c +@@ -660,6 +660,7 @@ static const struct hda_vendor_id hda_vendor_ids[] = { + { 0x14f1, "Conexant" }, + { 0x17e8, "Chrontel" }, + { 0x1854, "LG" }, ++ { 0x19e5, "Huawei" }, + { 0x1aec, "Wolfson Microelectronics" }, + { 0x1af4, "QEMU" }, + { 0x434d, "C-Media" }, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 8d2d29880716..588d4a59c8d9 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -443,6 +443,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0245: + case 0x10ec0255: + case 0x10ec0256: ++ case 0x19e58326: + case 0x10ec0257: + case 0x10ec0282: + case 0x10ec0283: +@@ -580,6 +581,7 @@ static void alc_shutup_pins(struct hda_codec *codec) + switch (codec->core.vendor_id) { + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + case 0x10ec0283: + case 0x10ec0286: + case 0x10ec0288: +@@ -3247,6 +3249,7 @@ static void alc_disable_headset_jack_key(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x48, 0x0); + alc_update_coef_idx(codec, 0x49, 0x0045, 0x0); + break; +@@ -3275,6 +3278,7 @@ static void alc_enable_headset_jack_key(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x48, 0xd011); + alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); + break; +@@ -4910,6 +4914,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_process_coef_fw(codec, coef0256); + break; + case 0x10ec0234: +@@ -5025,6 +5030,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin, + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x45, 0xc489); + snd_hda_set_pin_ctl_cache(codec, hp_pin, 0); + alc_process_coef_fw(codec, coef0256); +@@ -5175,6 +5181,7 @@ static void alc_headset_mode_default(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x1b, 0x0e4b); + alc_write_coef_idx(codec, 0x45, 0xc089); + msleep(50); +@@ -5274,6 +5281,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_process_coef_fw(codec, coef0256); + break; + case 0x10ec0234: +@@ -5388,6 +5396,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_process_coef_fw(codec, coef0256); + break; + case 0x10ec0234: +@@ -5489,6 +5498,7 @@ static void alc_determine_headset_type(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x1b, 0x0e4b); + alc_write_coef_idx(codec, 0x06, 0x6104); + alc_write_coefex_idx(codec, 0x57, 0x3, 0x09a3); +@@ -5783,6 +5793,7 @@ static void alc255_set_default_jack_type(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_process_coef_fw(codec, alc256fw); + break; + } +@@ -6385,6 +6396,7 @@ static void alc_combo_jack_hp_jd_restart(struct hda_codec *codec) + case 0x10ec0236: + case 0x10ec0255: + case 0x10ec0256: ++ case 0x19e58326: + alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */ + alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15); + break; +@@ -10149,6 +10161,7 @@ static int patch_alc269(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + spec->codec_variant = ALC269_TYPE_ALC256; + spec->shutup = alc256_shutup; + spec->init_hook = alc256_init; +@@ -11599,6 +11612,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { + HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882), ++ HDA_CODEC_ENTRY(0x19e58326, "HW8326", patch_alc269), + {} /* terminator */ + }; + MODULE_DEVICE_TABLE(hdaudio, snd_hda_id_realtek); +-- +2.35.1 + diff --git a/queue-5.18/asoc-cs35l36-update-digital-volume-tlv.patch b/queue-5.18/asoc-cs35l36-update-digital-volume-tlv.patch new file mode 100644 index 00000000000..a10bf016017 --- /dev/null +++ b/queue-5.18/asoc-cs35l36-update-digital-volume-tlv.patch @@ -0,0 +1,37 @@ +From 8e7309ddd03fc0cb49b2216b20eaa60aadc33aa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:15 +0100 +Subject: ASoC: cs35l36: Update digital volume TLV + +From: Charles Keepax + +[ Upstream commit 5005a2345825eb8346546d99bfe669f73111b5c5 ] + +The digital volume TLV specifies the step as 0.25dB but the actual step +of the control is 0.125dB. Update the TLV to correct this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l36.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs35l36.c b/sound/soc/codecs/cs35l36.c +index d83c1b318c1c..0accdb45ed72 100644 +--- a/sound/soc/codecs/cs35l36.c ++++ b/sound/soc/codecs/cs35l36.c +@@ -444,7 +444,8 @@ static bool cs35l36_volatile_reg(struct device *dev, unsigned int reg) + } + } + +-static DECLARE_TLV_DB_SCALE(dig_vol_tlv, -10200, 25, 0); ++static const DECLARE_TLV_DB_RANGE(dig_vol_tlv, 0, 912, ++ TLV_DB_MINMAX_ITEM(-10200, 1200)); + static DECLARE_TLV_DB_SCALE(amp_gain_tlv, 0, 1, 1); + + static const char * const cs35l36_pcm_sftramp_text[] = { +-- +2.35.1 + diff --git a/queue-5.18/asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch b/queue-5.18/asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch new file mode 100644 index 00000000000..0fa87bfc1f5 --- /dev/null +++ b/queue-5.18/asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch @@ -0,0 +1,39 @@ +From d17461fbe5b82f55dc9cd861e70a7300625b51eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:19 +0100 +Subject: ASoC: cs42l51: Correct minimum value for SX volume control + +From: Charles Keepax + +[ Upstream commit fcb3b5a58926d16d9a338841b74af06d4c29be15 ] + +The minimum value for the PGA Volume is given as 0x1A, however the +values from there to 0x19 are all the same volume and this is not +represented in the TLV structure. The number of volumes given is correct +so this leads to all the volumes being shifted. Move the minimum value +up to 0x19 to fix this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-7-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l51.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c +index e9c3cb4e2bfc..b9c262a15edf 100644 +--- a/sound/soc/codecs/cs42l51.c ++++ b/sound/soc/codecs/cs42l51.c +@@ -146,7 +146,7 @@ static const struct snd_kcontrol_new cs42l51_snd_controls[] = { + 0, 0xA0, 96, adc_att_tlv), + SOC_DOUBLE_R_SX_TLV("PGA Volume", + CS42L51_ALC_PGA_CTL, CS42L51_ALC_PGB_CTL, +- 0, 0x1A, 30, pga_tlv), ++ 0, 0x19, 30, pga_tlv), + SOC_SINGLE("Playback Deemphasis Switch", CS42L51_DAC_CTL, 3, 1, 0), + SOC_SINGLE("Auto-Mute Switch", CS42L51_DAC_CTL, 2, 1, 0), + SOC_SINGLE("Soft Ramp Switch", CS42L51_DAC_CTL, 1, 1, 0), +-- +2.35.1 + diff --git a/queue-5.18/asoc-cs42l52-correct-tlv-for-bypass-volume.patch b/queue-5.18/asoc-cs42l52-correct-tlv-for-bypass-volume.patch new file mode 100644 index 00000000000..c78a76b5473 --- /dev/null +++ b/queue-5.18/asoc-cs42l52-correct-tlv-for-bypass-volume.patch @@ -0,0 +1,45 @@ +From 9bc964a14246ada717c2042da9a503315f8ef892 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:17 +0100 +Subject: ASoC: cs42l52: Correct TLV for Bypass Volume + +From: Charles Keepax + +[ Upstream commit 91e90c712fade0b69cdff7cc6512f6099bd18ae5 ] + +The Bypass Volume is accidentally using a -6dB minimum TLV rather than +the correct -60dB minimum. Add a new TLV to correct this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-5-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l52.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c +index 785caba3f653..c19ad3c24702 100644 +--- a/sound/soc/codecs/cs42l52.c ++++ b/sound/soc/codecs/cs42l52.c +@@ -137,6 +137,8 @@ static DECLARE_TLV_DB_SCALE(mic_tlv, 1600, 100, 0); + + static DECLARE_TLV_DB_SCALE(pga_tlv, -600, 50, 0); + ++static DECLARE_TLV_DB_SCALE(pass_tlv, -6000, 50, 0); ++ + static DECLARE_TLV_DB_SCALE(mix_tlv, -5150, 50, 0); + + static DECLARE_TLV_DB_SCALE(beep_tlv, -56, 200, 0); +@@ -351,7 +353,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = { + CS42L52_SPKB_VOL, 0, 0x40, 0xC0, hl_tlv), + + SOC_DOUBLE_R_SX_TLV("Bypass Volume", CS42L52_PASSTHRUA_VOL, +- CS42L52_PASSTHRUB_VOL, 0, 0x88, 0x90, pga_tlv), ++ CS42L52_PASSTHRUB_VOL, 0, 0x88, 0x90, pass_tlv), + + SOC_DOUBLE("Bypass Mute", CS42L52_MISC_CTL, 4, 5, 1, 0), + +-- +2.35.1 + diff --git a/queue-5.18/asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch b/queue-5.18/asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch new file mode 100644 index 00000000000..520e484cc72 --- /dev/null +++ b/queue-5.18/asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch @@ -0,0 +1,45 @@ +From 8d26dcfc60bdcdf3493b456fd785dd90dc47ccc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:14 +0100 +Subject: ASoC: cs42l52: Fix TLV scales for mixer controls + +From: Charles Keepax + +[ Upstream commit 8bf5aabf524eec61013e506f764a0b2652dc5665 ] + +The datasheet specifies the range of the mixer volumes as between +-51.5dB and 12dB with a 0.5dB step. Update the TLVs for this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-2-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l52.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c +index 80161151b3f2..785caba3f653 100644 +--- a/sound/soc/codecs/cs42l52.c ++++ b/sound/soc/codecs/cs42l52.c +@@ -137,7 +137,7 @@ static DECLARE_TLV_DB_SCALE(mic_tlv, 1600, 100, 0); + + static DECLARE_TLV_DB_SCALE(pga_tlv, -600, 50, 0); + +-static DECLARE_TLV_DB_SCALE(mix_tlv, -50, 50, 0); ++static DECLARE_TLV_DB_SCALE(mix_tlv, -5150, 50, 0); + + static DECLARE_TLV_DB_SCALE(beep_tlv, -56, 200, 0); + +@@ -364,7 +364,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = { + CS42L52_ADCB_VOL, 0, 0xA0, 0x78, ipd_tlv), + SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume", + CS42L52_ADCA_MIXER_VOL, CS42L52_ADCB_MIXER_VOL, +- 0, 0x19, 0x7F, ipd_tlv), ++ 0, 0x19, 0x7F, mix_tlv), + + SOC_DOUBLE("ADC Switch", CS42L52_ADC_MISC_CTL, 0, 1, 1, 0), + +-- +2.35.1 + diff --git a/queue-5.18/asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch b/queue-5.18/asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch new file mode 100644 index 00000000000..607d0f3a5aa --- /dev/null +++ b/queue-5.18/asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch @@ -0,0 +1,41 @@ +From bbbf79cd488660802f39fb96ff4018b411d97930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:18 +0100 +Subject: ASoC: cs42l56: Correct typo in minimum level for SX volume controls + +From: Charles Keepax + +[ Upstream commit a8928ada9b96944cadd8b65d191e33199fd38782 ] + +A couple of the SX volume controls specify 0x84 as the lowest volume +value, however the correct value from the datasheet is 0x44. The +datasheet don't include spaces in the value it displays as binary so +this was almost certainly just a typo reading 1000100. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-6-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l56.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c +index 3cf8a0b4478c..b39c25409c23 100644 +--- a/sound/soc/codecs/cs42l56.c ++++ b/sound/soc/codecs/cs42l56.c +@@ -391,9 +391,9 @@ static const struct snd_kcontrol_new cs42l56_snd_controls[] = { + SOC_DOUBLE("ADC Boost Switch", CS42L56_GAIN_BIAS_CTL, 3, 2, 1, 1), + + SOC_DOUBLE_R_SX_TLV("Headphone Volume", CS42L56_HPA_VOLUME, +- CS42L56_HPB_VOLUME, 0, 0x84, 0x48, hl_tlv), ++ CS42L56_HPB_VOLUME, 0, 0x44, 0x48, hl_tlv), + SOC_DOUBLE_R_SX_TLV("LineOut Volume", CS42L56_LOA_VOLUME, +- CS42L56_LOB_VOLUME, 0, 0x84, 0x48, hl_tlv), ++ CS42L56_LOB_VOLUME, 0, 0x44, 0x48, hl_tlv), + + SOC_SINGLE_TLV("Bass Shelving Volume", CS42L56_TONE_CTL, + 0, 0x00, 1, tone_tlv), +-- +2.35.1 + diff --git a/queue-5.18/asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch b/queue-5.18/asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch new file mode 100644 index 00000000000..38e6ce22bc0 --- /dev/null +++ b/queue-5.18/asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch @@ -0,0 +1,59 @@ +From 12b507110b0a17d5a7c503e64f476fe1a44ae225 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:16 +0100 +Subject: ASoC: cs53l30: Correct number of volume levels on SX controls + +From: Charles Keepax + +[ Upstream commit 7fbd6dd68127927e844912a16741016d432a0737 ] + +This driver specified the maximum value rather than the number of volume +levels on the SX controls, this is incorrect, so correct them. + +Reported-by: David Rhodes +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs53l30.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/cs53l30.c b/sound/soc/codecs/cs53l30.c +index f2087bd38dbc..c2912ad3851b 100644 +--- a/sound/soc/codecs/cs53l30.c ++++ b/sound/soc/codecs/cs53l30.c +@@ -348,22 +348,22 @@ static const struct snd_kcontrol_new cs53l30_snd_controls[] = { + SOC_ENUM("ADC2 NG Delay", adc2_ng_delay_enum), + + SOC_SINGLE_SX_TLV("ADC1A PGA Volume", +- CS53L30_ADC1A_AFE_CTL, 0, 0x34, 0x18, pga_tlv), ++ CS53L30_ADC1A_AFE_CTL, 0, 0x34, 0x24, pga_tlv), + SOC_SINGLE_SX_TLV("ADC1B PGA Volume", +- CS53L30_ADC1B_AFE_CTL, 0, 0x34, 0x18, pga_tlv), ++ CS53L30_ADC1B_AFE_CTL, 0, 0x34, 0x24, pga_tlv), + SOC_SINGLE_SX_TLV("ADC2A PGA Volume", +- CS53L30_ADC2A_AFE_CTL, 0, 0x34, 0x18, pga_tlv), ++ CS53L30_ADC2A_AFE_CTL, 0, 0x34, 0x24, pga_tlv), + SOC_SINGLE_SX_TLV("ADC2B PGA Volume", +- CS53L30_ADC2B_AFE_CTL, 0, 0x34, 0x18, pga_tlv), ++ CS53L30_ADC2B_AFE_CTL, 0, 0x34, 0x24, pga_tlv), + + SOC_SINGLE_SX_TLV("ADC1A Digital Volume", +- CS53L30_ADC1A_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv), ++ CS53L30_ADC1A_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv), + SOC_SINGLE_SX_TLV("ADC1B Digital Volume", +- CS53L30_ADC1B_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv), ++ CS53L30_ADC1B_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv), + SOC_SINGLE_SX_TLV("ADC2A Digital Volume", +- CS53L30_ADC2A_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv), ++ CS53L30_ADC2A_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv), + SOC_SINGLE_SX_TLV("ADC2B Digital Volume", +- CS53L30_ADC2B_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv), ++ CS53L30_ADC2B_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv), + }; + + static const struct snd_soc_dapm_widget cs53l30_dapm_widgets[] = { +-- +2.35.1 + diff --git a/queue-5.18/asoc-es8328-fix-event-generation-for-deemphasis-cont.patch b/queue-5.18/asoc-es8328-fix-event-generation-for-deemphasis-cont.patch new file mode 100644 index 00000000000..115ef60ff68 --- /dev/null +++ b/queue-5.18/asoc-es8328-fix-event-generation-for-deemphasis-cont.patch @@ -0,0 +1,47 @@ +From 515b295582e1932bdcc42850052d9d6637a585ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 14:39:37 +0200 +Subject: ASoC: es8328: Fix event generation for deemphasis control + +From: Mark Brown + +[ Upstream commit 8259610c2ec01c5cbfb61882ae176aabacac9c19 ] + +Currently the put() method for the deemphasis control returns 0 when a new +value is written to the control even if the value changed, meaning events +are not generated. Fix this, skip the work of updating the value when it is +unchanged and then return 1 after having done so. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220603123937.4013603-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index 3f00ead97006..dd53dfd87b04 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -161,13 +161,16 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol, + if (deemph > 1) + return -EINVAL; + ++ if (es8328->deemph == deemph) ++ return 0; ++ + ret = es8328_set_deemph(component); + if (ret < 0) + return ret; + + es8328->deemph = deemph; + +- return 0; ++ return 1; + } + + +-- +2.35.1 + diff --git a/queue-5.18/asoc-intel-cirrus-common-fix-incorrect-channel-mappi.patch b/queue-5.18/asoc-intel-cirrus-common-fix-incorrect-channel-mappi.patch new file mode 100644 index 00000000000..7ceefe6f96e --- /dev/null +++ b/queue-5.18/asoc-intel-cirrus-common-fix-incorrect-channel-mappi.patch @@ -0,0 +1,104 @@ +From 56bd9ab58b3ced7345c880219acf7126d3071491 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 13:19:22 +0800 +Subject: ASoC: Intel: cirrus-common: fix incorrect channel mapping + +From: xliu + +[ Upstream commit d69a155555c9d57463b788c400f6b452d976bacd ] + +The default mapping of ASPRX1 (DAC source) is slot 0. Change the slot +mapping of right amplifiers (WR and TR) to slot 1 to receive right +channel data. Also update the ACPI instance ID mapping according to HW +configuration. + +Signed-off-by: xliu +Signed-off-by: Brent Lu +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220602051922.1232457-1-brent.lu@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_cirrus_common.c | 40 +++++++++++++++++++--- + 1 file changed, 36 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_cirrus_common.c b/sound/soc/intel/boards/sof_cirrus_common.c +index e71d74ec1b0b..f4192df962d6 100644 +--- a/sound/soc/intel/boards/sof_cirrus_common.c ++++ b/sound/soc/intel/boards/sof_cirrus_common.c +@@ -54,22 +54,29 @@ static struct snd_soc_dai_link_component cs35l41_components[] = { + }, + }; + ++/* ++ * Mapping between ACPI instance id and speaker position. ++ * ++ * Four speakers: ++ * 0: Tweeter left, 1: Woofer left ++ * 2: Tweeter right, 3: Woofer right ++ */ + static struct snd_soc_codec_conf cs35l41_codec_conf[] = { + { + .dlc = COMP_CODEC_CONF(CS35L41_DEV0_NAME), +- .name_prefix = "WL", ++ .name_prefix = "TL", + }, + { + .dlc = COMP_CODEC_CONF(CS35L41_DEV1_NAME), +- .name_prefix = "WR", ++ .name_prefix = "WL", + }, + { + .dlc = COMP_CODEC_CONF(CS35L41_DEV2_NAME), +- .name_prefix = "TL", ++ .name_prefix = "TR", + }, + { + .dlc = COMP_CODEC_CONF(CS35L41_DEV3_NAME), +- .name_prefix = "TR", ++ .name_prefix = "WR", + }, + }; + +@@ -101,6 +108,21 @@ static int cs35l41_init(struct snd_soc_pcm_runtime *rtd) + return ret; + } + ++/* ++ * Channel map: ++ * ++ * TL/WL: ASPRX1 on slot 0, ASPRX2 on slot 1 (default) ++ * TR/WR: ASPRX1 on slot 1, ASPRX2 on slot 0 ++ */ ++static const struct { ++ unsigned int rx[2]; ++} cs35l41_channel_map[] = { ++ {.rx = {0, 1}}, /* TL */ ++ {.rx = {0, 1}}, /* WL */ ++ {.rx = {1, 0}}, /* TR */ ++ {.rx = {1, 0}}, /* WR */ ++}; ++ + static int cs35l41_hw_params(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *params) + { +@@ -134,6 +156,16 @@ static int cs35l41_hw_params(struct snd_pcm_substream *substream, + ret); + return ret; + } ++ ++ /* setup channel map */ ++ ret = snd_soc_dai_set_channel_map(codec_dai, 0, NULL, ++ ARRAY_SIZE(cs35l41_channel_map[i].rx), ++ (unsigned int *)cs35l41_channel_map[i].rx); ++ if (ret < 0) { ++ dev_err(codec_dai->dev, "fail to set channel map, ret %d\n", ++ ret); ++ return ret; ++ } + } + + return 0; +-- +2.35.1 + diff --git a/queue-5.18/asoc-nau8822-add-operation-for-internal-pll-off-and-.patch b/queue-5.18/asoc-nau8822-add-operation-for-internal-pll-off-and-.patch new file mode 100644 index 00000000000..894397cc14e --- /dev/null +++ b/queue-5.18/asoc-nau8822-add-operation-for-internal-pll-off-and-.patch @@ -0,0 +1,72 @@ +From 7ba0a0e1b62b15bcb1e4b0d57d01a81f3f7d2913 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 12:01:50 +0800 +Subject: ASoC: nau8822: Add operation for internal PLL off and on + +From: Hui Wang + +[ Upstream commit aeca8a3295022bcec46697f16e098140423d8463 ] + +We tried to enable the audio on an imx6sx EVB with the codec nau8822, +after setting the internal PLL fractional parameters, the audio still +couldn't work and the there was no sdma irq at all. + +After checking with the section "8.1.1 Phase Locked Loop (PLL) Design +Example" of "NAU88C22 Datasheet Rev 0.6", we found we need to +turn off the PLL before programming fractional parameters and turn on +the PLL after programming. + +After this change, the audio driver could record and play sound and +the sdma's irq is triggered when playing or recording. + +Cc: David Lin +Cc: John Hsu +Cc: Seven Li +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20220530040151.95221-2-hui.wang@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8822.c | 4 ++++ + sound/soc/codecs/nau8822.h | 3 +++ + 2 files changed, 7 insertions(+) + +diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c +index 58123390c7a3..b436e532993d 100644 +--- a/sound/soc/codecs/nau8822.c ++++ b/sound/soc/codecs/nau8822.c +@@ -740,6 +740,8 @@ static int nau8822_set_pll(struct snd_soc_dai *dai, int pll_id, int source, + pll_param->pll_int, pll_param->pll_frac, + pll_param->mclk_scaler, pll_param->pre_factor); + ++ snd_soc_component_update_bits(component, ++ NAU8822_REG_POWER_MANAGEMENT_1, NAU8822_PLL_EN_MASK, NAU8822_PLL_OFF); + snd_soc_component_update_bits(component, + NAU8822_REG_PLL_N, NAU8822_PLLMCLK_DIV2 | NAU8822_PLLN_MASK, + (pll_param->pre_factor ? NAU8822_PLLMCLK_DIV2 : 0) | +@@ -757,6 +759,8 @@ static int nau8822_set_pll(struct snd_soc_dai *dai, int pll_id, int source, + pll_param->mclk_scaler << NAU8822_MCLKSEL_SFT); + snd_soc_component_update_bits(component, + NAU8822_REG_CLOCKING, NAU8822_CLKM_MASK, NAU8822_CLKM_PLL); ++ snd_soc_component_update_bits(component, ++ NAU8822_REG_POWER_MANAGEMENT_1, NAU8822_PLL_EN_MASK, NAU8822_PLL_ON); + + return 0; + } +diff --git a/sound/soc/codecs/nau8822.h b/sound/soc/codecs/nau8822.h +index 489191ff187e..b45d42c15de6 100644 +--- a/sound/soc/codecs/nau8822.h ++++ b/sound/soc/codecs/nau8822.h +@@ -90,6 +90,9 @@ + #define NAU8822_REFIMP_3K 0x3 + #define NAU8822_IOBUF_EN (0x1 << 2) + #define NAU8822_ABIAS_EN (0x1 << 3) ++#define NAU8822_PLL_EN_MASK (0x1 << 5) ++#define NAU8822_PLL_ON (0x1 << 5) ++#define NAU8822_PLL_OFF (0x0 << 5) + + /* NAU8822_REG_AUDIO_INTERFACE (0x4) */ + #define NAU8822_AIFMT_MASK (0x3 << 3) +-- +2.35.1 + diff --git a/queue-5.18/asoc-qcom-lpass-platform-update-vma-access-permissio.patch b/queue-5.18/asoc-qcom-lpass-platform-update-vma-access-permissio.patch new file mode 100644 index 00000000000..45ade4ac8e4 --- /dev/null +++ b/queue-5.18/asoc-qcom-lpass-platform-update-vma-access-permissio.patch @@ -0,0 +1,39 @@ +From c3d9b82c43e4152e28e9ab887d16e2636679a155 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 May 2022 19:40:08 +0530 +Subject: ASoC: qcom: lpass-platform: Update VMA access permissions in mmap + callback + +From: Srinivasa Rao Mandadapu + +[ Upstream commit ef8d89b83bf453ea9cc3c4873a84b50ff334f797 ] + +Replace page protection permissions from noncashed to writecombine, +in lpass codec DMA path mmp callabck, to support 64 bit chromeOS. +Avoid SIGBUS error in userspace caused by noncached permissions in +64 bit chromeOS. + +Signed-off-by: Srinivasa Rao Mandadapu +Link: https://lore.kernel.org/r/1653660608-27245-1-git-send-email-quic_srivasam@quicinc.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c +index 74d62f377dfd..ae2a7837e5cc 100644 +--- a/sound/soc/qcom/lpass-platform.c ++++ b/sound/soc/qcom/lpass-platform.c +@@ -898,7 +898,7 @@ static int lpass_platform_cdc_dma_mmap(struct snd_pcm_substream *substream, + struct snd_pcm_runtime *runtime = substream->runtime; + unsigned long size, offset; + +- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); ++ vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot); + size = vma->vm_end - vma->vm_start; + offset = vma->vm_pgoff << PAGE_SHIFT; + return io_remap_pfn_range(vma, vma->vm_start, +-- +2.35.1 + diff --git a/queue-5.18/asoc-wm8962-fix-suspend-while-playing-music.patch b/queue-5.18/asoc-wm8962-fix-suspend-while-playing-music.patch new file mode 100644 index 00000000000..c843f29b678 --- /dev/null +++ b/queue-5.18/asoc-wm8962-fix-suspend-while-playing-music.patch @@ -0,0 +1,42 @@ +From ffed31739e0dc3feebff327644e7565f75e42bfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 13:21:28 -0500 +Subject: ASoC: wm8962: Fix suspend while playing music + +From: Adam Ford + +[ Upstream commit d1f5272c0f7d2e53c6f2480f46725442776f5f78 ] + +If the audio CODEC is playing sound when the system is suspended, +it can be left in a state which throws the following error: + +wm8962 3-001a: ASoC: error at soc_component_read_no_lock on wm8962.3-001a: -16 + +Once this error has occurred, the audio will not work again until rebooted. + +Fix this by configuring SET_SYSTEM_SLEEP_PM_OPS. + +Signed-off-by: Adam Ford +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20220526182129.538472-1-aford173@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index 2c41d31956aa..f622a6bbd2fb 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -3871,6 +3871,7 @@ static int wm8962_runtime_suspend(struct device *dev) + #endif + + static const struct dev_pm_ops wm8962_pm = { ++ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume) + SET_RUNTIME_PM_OPS(wm8962_runtime_suspend, wm8962_runtime_resume, NULL) + }; + +-- +2.35.1 + diff --git a/queue-5.18/asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch b/queue-5.18/asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch new file mode 100644 index 00000000000..bdb27014d51 --- /dev/null +++ b/queue-5.18/asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch @@ -0,0 +1,39 @@ +From 6f563036321e0b65bd357b3b242bf9ac822faa37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 13:50:03 +0200 +Subject: ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() + +From: Mark Brown + +[ Upstream commit 2abdf9f80019e8244d3806ed0e1c9f725e50b452 ] + +Currently wm_adsp_fw_put() returns 0 rather than 1 when updating the value +of the control, meaning that no event is generated to userspace. Fix this +by setting the default return value to 1, the code already exits early with +a return value of 0 if the value is unchanged. + +Signed-off-by: Mark Brown +Reviewed-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20220603115003.3865834-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index e32c8ded181d..9cfd4f18493f 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -333,7 +333,7 @@ int wm_adsp_fw_put(struct snd_kcontrol *kcontrol, + struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol); + struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; + struct wm_adsp *dsp = snd_soc_component_get_drvdata(component); +- int ret = 0; ++ int ret = 1; + + if (ucontrol->value.enumerated.item[0] == dsp[e->shift_l].fw) + return 0; +-- +2.35.1 + diff --git a/queue-5.18/ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch b/queue-5.18/ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch new file mode 100644 index 00000000000..14a466814b9 --- /dev/null +++ b/queue-5.18/ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch @@ -0,0 +1,50 @@ +From d0caf9bd868f9b3cd5b4c7e9dc2aaf316dbd3f67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 May 2022 23:34:10 +0300 +Subject: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() + +From: Sergey Shtylyov + +[ Upstream commit bf476fe22aa1851bab4728e0c49025a6a0bea307 ] + +In an unlikely (and probably wrong?) case that the 'ppi' parameter of +ata_host_alloc_pinfo() points to an array starting with a NULL pointer, +there's going to be a kernel oops as the 'pi' local variable won't get +reassigned from the initial value of NULL. Initialize 'pi' instead to +'&ata_dummy_port_info' to fix the possible kernel oops for good... + +Found by Linux Verification Center (linuxtesting.org) with the SVACE static +analysis tool. + +Signed-off-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 3d57fa84e2be..ea9671821258 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5506,7 +5506,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev, + const struct ata_port_info * const * ppi, + int n_ports) + { +- const struct ata_port_info *pi; ++ const struct ata_port_info *pi = &ata_dummy_port_info; + struct ata_host *host; + int i, j; + +@@ -5514,7 +5514,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev, + if (!host) + return NULL; + +- for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) { ++ for (i = 0, j = 0; i < host->n_ports; i++) { + struct ata_port *ap = host->ports[i]; + + if (ppi[j]) +-- +2.35.1 + diff --git a/queue-5.18/dma-debug-make-things-less-spammy-under-memory-press.patch b/queue-5.18/dma-debug-make-things-less-spammy-under-memory-press.patch new file mode 100644 index 00000000000..a82940e7fd4 --- /dev/null +++ b/queue-5.18/dma-debug-make-things-less-spammy-under-memory-press.patch @@ -0,0 +1,38 @@ +From 98b523331bb78e4a870cb1bac7ccf7cfec32c228 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 07:51:16 -0700 +Subject: dma-debug: make things less spammy under memory pressure + +From: Rob Clark + +[ Upstream commit e19f8fa6ce1ca9b8b934ba7d2e8f34c95abc6e60 ] + +Limit the error msg to avoid flooding the console. If you have a lot of +threads hitting this at once, they could have already gotten passed the +dma_debug_disabled() check before they get to the point of allocation +failure, resulting in quite a lot of this error message spamming the +log. Use pr_err_once() to limit that. + +Signed-off-by: Rob Clark +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index ac740630c79c..2caafd13f8aa 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -564,7 +564,7 @@ static void add_dma_entry(struct dma_debug_entry *entry, unsigned long attrs) + + rc = active_cacheline_insert(entry); + if (rc == -ENOMEM) { +- pr_err("cacheline tracking ENOMEM, dma-debug disabled\n"); ++ pr_err_once("cacheline tracking ENOMEM, dma-debug disabled\n"); + global_disable = true; + } else if (rc == -EEXIST && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) { + err_printk(entry->dev, entry, +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-display-read-golden-settings-table-from-vbio.patch b/queue-5.18/drm-amd-display-read-golden-settings-table-from-vbio.patch new file mode 100644 index 00000000000..2c73d6854d5 --- /dev/null +++ b/queue-5.18/drm-amd-display-read-golden-settings-table-from-vbio.patch @@ -0,0 +1,46 @@ +From ef5f1216200bc54d1980c97da7fc3ccb35bc5c06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 18:42:18 +0800 +Subject: drm/amd/display: Read Golden Settings Table from VBIOS + +From: Sherry Wang + +[ Upstream commit 4b81dd2cc6f4f4e8cea0ed6ee8d5193a8ae14a72 ] + +[Why] +Dmub read AUX_DPHY_RX_CONTROL0 from Golden Setting Table, +but driver will set it to default value 0x103d1110, which +causes issue in some case + +[How] +Remove the driver code, use the value set by dmub in +dp_aux_init + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Jasdeep Dhillon +Tested-by: Daniel Wheeler +Signed-off-by: Sherry Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c +index d94fd1010deb..8b12b4111c88 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c +@@ -230,9 +230,7 @@ static void enc31_hw_init(struct link_encoder *enc) + AUX_RX_PHASE_DETECT_LEN, [21,20] = 0x3 default is 3 + AUX_RX_DETECTION_THRESHOLD [30:28] = 1 + */ +- AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110); +- +- AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c7a); ++ // dmub will read AUX_DPHY_RX_CONTROL0/AUX_DPHY_TX_CONTROL from vbios table in dp_aux_init + + //AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32; + // Set AUX_TX_REF_DIV Divider to generate 2 MHz reference from refclk +-- +2.35.1 + diff --git a/queue-5.18/drm-amdgpu-resolve-ras-gfx-error-count-issue-after-c.patch b/queue-5.18/drm-amdgpu-resolve-ras-gfx-error-count-issue-after-c.patch new file mode 100644 index 00000000000..25d35a9f95a --- /dev/null +++ b/queue-5.18/drm-amdgpu-resolve-ras-gfx-error-count-issue-after-c.patch @@ -0,0 +1,122 @@ +From 769645212167782d3ee5d6ab65ce3f7beeeb9e9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 17:10:44 +0800 +Subject: drm/amdgpu: Resolve RAS GFX error count issue after cold boot on + Arcturus + +From: Candice Li + +[ Upstream commit 2a460963350ec6b1534d28d7f943b5f84815aff2 ] + +Adjust the sequence for ras late init and separate ras reset error status +from query status. + +v2: squash in fix from Candice + +Signed-off-by: Candice Li +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 9 ++++++--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 27 ++++++++++++++++++++----- + 2 files changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index 28a736c507bb..bd3b32e5ba9e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -625,17 +625,20 @@ int amdgpu_get_gfx_off_status(struct amdgpu_device *adev, uint32_t *value) + int amdgpu_gfx_ras_late_init(struct amdgpu_device *adev, struct ras_common_if *ras_block) + { + int r; +- r = amdgpu_ras_block_late_init(adev, ras_block); +- if (r) +- return r; + + if (amdgpu_ras_is_supported(adev, ras_block->block)) { + if (!amdgpu_persistent_edc_harvesting_supported(adev)) + amdgpu_ras_reset_error_status(adev, AMDGPU_RAS_BLOCK__GFX); + ++ r = amdgpu_ras_block_late_init(adev, ras_block); ++ if (r) ++ return r; ++ + r = amdgpu_irq_get(adev, &adev->gfx.cp_ecc_error_irq, 0); + if (r) + goto late_fini; ++ } else { ++ amdgpu_ras_feature_enable_on_boot(adev, ras_block, 0); + } + + return 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +index 424c22a841f4..3f96dadf2698 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +@@ -195,6 +195,13 @@ static ssize_t amdgpu_ras_debugfs_read(struct file *f, char __user *buf, + if (amdgpu_ras_query_error_status(obj->adev, &info)) + return -EINVAL; + ++ /* Hardware counter will be reset automatically after the query on Vega20 and Arcturus */ ++ if (obj->adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 2) && ++ obj->adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 4)) { ++ if (amdgpu_ras_reset_error_status(obj->adev, info.head.block)) ++ dev_warn(obj->adev->dev, "Failed to reset error counter and error status"); ++ } ++ + s = snprintf(val, sizeof(val), "%s: %lu\n%s: %lu\n", + "ue", info.ue_count, + "ce", info.ce_count); +@@ -548,9 +555,10 @@ static ssize_t amdgpu_ras_sysfs_read(struct device *dev, + if (amdgpu_ras_query_error_status(obj->adev, &info)) + return -EINVAL; + +- if (obj->adev->asic_type == CHIP_ALDEBARAN) { ++ if (obj->adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 2) && ++ obj->adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 4)) { + if (amdgpu_ras_reset_error_status(obj->adev, info.head.block)) +- DRM_WARN("Failed to reset error counter and error status"); ++ dev_warn(obj->adev->dev, "Failed to reset error counter and error status"); + } + + return sysfs_emit(buf, "%s: %lu\n%s: %lu\n", "ue", info.ue_count, +@@ -1023,9 +1031,6 @@ int amdgpu_ras_query_error_status(struct amdgpu_device *adev, + } + } + +- if (!amdgpu_persistent_edc_harvesting_supported(adev)) +- amdgpu_ras_reset_error_status(adev, info->head.block); +- + return 0; + } + +@@ -1145,6 +1150,12 @@ int amdgpu_ras_query_error_count(struct amdgpu_device *adev, + if (res) + return res; + ++ if (adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 2) && ++ adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 4)) { ++ if (amdgpu_ras_reset_error_status(adev, info.head.block)) ++ dev_warn(adev->dev, "Failed to reset error counter and error status"); ++ } ++ + ce += info.ce_count; + ue += info.ue_count; + } +@@ -1705,6 +1716,12 @@ static void amdgpu_ras_log_on_err_counter(struct amdgpu_device *adev) + continue; + + amdgpu_ras_query_error_status(adev, &info); ++ ++ if (adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 2) && ++ adev->ip_versions[MP0_HWIP][0] != IP_VERSION(11, 0, 4)) { ++ if (amdgpu_ras_reset_error_status(adev, info.head.block)) ++ dev_warn(adev->dev, "Failed to reset error counter and error status"); ++ } + } + } + +-- +2.35.1 + diff --git a/queue-5.18/drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch b/queue-5.18/drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch new file mode 100644 index 00000000000..406979d1632 --- /dev/null +++ b/queue-5.18/drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch @@ -0,0 +1,77 @@ +From c8545f93d2ee0b6fe11b3ceb1c810aeed5563e3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 09:19:43 +0800 +Subject: drm/amdkfd: add pinned BOs to kfd_bo_list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lang Yu + +[ Upstream commit 4fac4fcf4500bce515b0f32195e7bb86aa0246c6 ] + +The kfd_bo_list is used to restore process BOs after +evictions. As page tables could be destroyed during +evictions, we should also update pinned BOs' page tables +during restoring to make sure they are valid. + +So for pinned BOs, +1, Validate them and update their page tables. +2, Don't add eviction fence for them. + +v2: + - Don't handle pinned ones specially in BO validation.(Felix) + +Signed-off-by: Lang Yu +Acked-by: Christian König +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index cd89d2e46852..f4509656ea8c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -1955,9 +1955,6 @@ int amdgpu_amdkfd_gpuvm_map_gtt_bo_to_kernel(struct amdgpu_device *adev, + return -EINVAL; + } + +- /* delete kgd_mem from kfd_bo_list to avoid re-validating +- * this BO in BO's restoring after eviction. +- */ + mutex_lock(&mem->process_info->lock); + + ret = amdgpu_bo_reserve(bo, true); +@@ -1980,7 +1977,6 @@ int amdgpu_amdkfd_gpuvm_map_gtt_bo_to_kernel(struct amdgpu_device *adev, + + amdgpu_amdkfd_remove_eviction_fence( + bo, mem->process_info->eviction_fence); +- list_del_init(&mem->validate_list.head); + + if (size) + *size = amdgpu_bo_size(bo); +@@ -2544,12 +2540,15 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence **ef) + process_info->eviction_fence = new_fence; + *ef = dma_fence_get(&new_fence->base); + +- /* Attach new eviction fence to all BOs */ ++ /* Attach new eviction fence to all BOs except pinned ones */ + list_for_each_entry(mem, &process_info->kfd_bo_list, +- validate_list.head) ++ validate_list.head) { ++ if (mem->bo->tbo.pin_count) ++ continue; ++ + amdgpu_bo_fence(mem->bo, + &process_info->eviction_fence->base, true); +- ++ } + /* Attach eviction fence to PD / PT BOs */ + list_for_each_entry(peer_vm, &process_info->vm_list_head, + vm_list_node) { +-- +2.35.1 + diff --git a/queue-5.18/drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch b/queue-5.18/drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch new file mode 100644 index 00000000000..b2664db5dd2 --- /dev/null +++ b/queue-5.18/drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch @@ -0,0 +1,45 @@ +From 08bd3bb442e18f8c2b7b0f2c59bb9a1d8836b90d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 16:15:38 -0400 +Subject: drm/amdkfd: Use mmget_not_zero in MMU notifier + +From: Philip Yang + +[ Upstream commit fa582c6f3684ac0098a9d02ddf0ed52a02b37127 ] + +MMU notifier callback may pass in mm with mm->mm_users==0 when process +is exiting, use mmget_no_zero to avoid accessing invalid mm in deferred +list work after mm is gone. + +Signed-off-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 3b8856b4cece..5979335d7afd 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -2286,6 +2286,8 @@ svm_range_cpu_invalidate_pagetables(struct mmu_interval_notifier *mni, + + if (range->event == MMU_NOTIFY_RELEASE) + return true; ++ if (!mmget_not_zero(mni->mm)) ++ return true; + + start = mni->interval_tree.start; + last = mni->interval_tree.last; +@@ -2312,6 +2314,7 @@ svm_range_cpu_invalidate_pagetables(struct mmu_interval_notifier *mni, + } + + svm_range_unlock(prange); ++ mmput(mni->mm); + + return true; + } +-- +2.35.1 + diff --git a/queue-5.18/gcc-12-disable-warray-bounds-universally-for-now.patch b/queue-5.18/gcc-12-disable-warray-bounds-universally-for-now.patch new file mode 100644 index 00000000000..523c15fb4ac --- /dev/null +++ b/queue-5.18/gcc-12-disable-warray-bounds-universally-for-now.patch @@ -0,0 +1,120 @@ +From bf8694cdf0590003fc85e4053c55bded7707667e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 10:11:12 -0700 +Subject: gcc-12: disable '-Warray-bounds' universally for now + +From: Linus Torvalds + +[ Upstream commit f0be87c42cbd341d436d06da4792e6b0c83c3aeb ] + +In commit 8b202ee21839 ("s390: disable -Warray-bounds") the s390 people +disabled the '-Warray-bounds' warning for gcc-12, because the new logic +in gcc would cause warnings for their use of the S390_lowcore macro, +which accesses absolute pointers. + +It turns out gcc-12 has many other issues in this area, so this takes +that s390 warning disable logic, and turns it into a kernel build config +entry instead. + +Part of the intent is that we can make this all much more targeted, and +use this conflig flag to disable it in only particular configurations +that cause problems, with the s390 case as an example: + + select GCC12_NO_ARRAY_BOUNDS + +and we could do that for other configuration cases that cause issues. + +Or we could possibly use the CONFIG_CC_NO_ARRAY_BOUNDS thing in a more +targeted way, and disable the warning only for particular uses: again +the s390 case as an example: + + KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_CC_NO_ARRAY_BOUNDS),-Wno-array-bounds) + +but this ends up just doing it globally in the top-level Makefile, since +the current issues are spread fairly widely all over: + + KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds + +We'll try to limit this later, since the gcc-12 problems are rare enough +that *much* of the kernel can be built with it without disabling this +warning. + +Cc: Kees Cook +Cc: Nathan Chancellor +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + Makefile | 1 + + arch/s390/Kconfig | 1 + + arch/s390/Makefile | 10 +--------- + init/Kconfig | 9 +++++++++ + 4 files changed, 12 insertions(+), 9 deletions(-) + +diff --git a/Makefile b/Makefile +index 476cbe751b17..d19e3b425bd6 100644 +--- a/Makefile ++++ b/Makefile +@@ -787,6 +787,7 @@ stackp-flags-$(CONFIG_STACKPROTECTOR_STRONG) := -fstack-protector-strong + KBUILD_CFLAGS += $(stackp-flags-y) + + KBUILD_CFLAGS-$(CONFIG_WERROR) += -Werror ++KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds + KBUILD_CFLAGS += $(KBUILD_CFLAGS-y) $(CONFIG_CC_IMPLICIT_FALLTHROUGH) + + ifdef CONFIG_CC_IS_CLANG +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index e084c72104f8..359b0cc0dc35 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -125,6 +125,7 @@ config S390 + select CLONE_BACKWARDS2 + select DMA_OPS if PCI + select DYNAMIC_FTRACE if FUNCTION_TRACER ++ select GCC12_NO_ARRAY_BOUNDS + select GENERIC_ALLOCATOR + select GENERIC_CPU_AUTOPROBE + select GENERIC_CPU_VULNERABILITIES +diff --git a/arch/s390/Makefile b/arch/s390/Makefile +index df325eacf62d..eba70d585cb2 100644 +--- a/arch/s390/Makefile ++++ b/arch/s390/Makefile +@@ -30,15 +30,7 @@ KBUILD_CFLAGS_DECOMPRESSOR += -fno-stack-protector + KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, address-of-packed-member) + KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),-g) + KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO_DWARF4), $(call cc-option, -gdwarf-4,)) +- +-ifdef CONFIG_CC_IS_GCC +- ifeq ($(call cc-ifversion, -ge, 1200, y), y) +- ifeq ($(call cc-ifversion, -lt, 1300, y), y) +- KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds) +- KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, array-bounds) +- endif +- endif +-endif ++KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_CC_NO_ARRAY_BOUNDS),-Wno-array-bounds) + + UTS_MACHINE := s390x + STACK_SIZE := $(if $(CONFIG_KASAN),65536,16384) +diff --git a/init/Kconfig b/init/Kconfig +index b19e2eeaae80..fa63cc019ebf 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -899,6 +899,15 @@ config CC_IMPLICIT_FALLTHROUGH + default "-Wimplicit-fallthrough=5" if CC_IS_GCC && $(cc-option,-Wimplicit-fallthrough=5) + default "-Wimplicit-fallthrough" if CC_IS_CLANG && $(cc-option,-Wunreachable-code-fallthrough) + ++# Currently, disable gcc-12 array-bounds globally. ++# We may want to target only particular configurations some day. ++config GCC12_NO_ARRAY_BOUNDS ++ def_bool y ++ ++config CC_NO_ARRAY_BOUNDS ++ bool ++ default y if CC_IS_GCC && GCC_VERSION >= 120000 && GCC_VERSION < 130000 && GCC12_NO_ARRAY_BOUNDS ++ + # + # For architectures that know their GCC __int128 support is sound + # +-- +2.35.1 + diff --git a/queue-5.18/gcc-12-disable-wdangling-pointer-warning-for-now.patch b/queue-5.18/gcc-12-disable-wdangling-pointer-warning-for-now.patch new file mode 100644 index 00000000000..3af00180dd1 --- /dev/null +++ b/queue-5.18/gcc-12-disable-wdangling-pointer-warning-for-now.patch @@ -0,0 +1,69 @@ +From 17061e409d176e77c1c0de5477d9fd97d835e9eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 09:41:42 -0700 +Subject: gcc-12: disable '-Wdangling-pointer' warning for now +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +[ Upstream commit 49beadbd47c270a00754c107a837b4f29df4c822 ] + +While the concept of checking for dangling pointers to local variables +at function exit is really interesting, the gcc-12 implementation is not +compatible with reality, and results in false positives. + +For example, gcc sees us putting things on a local list head allocated +on the stack, which involves exactly those kinds of pointers to the +local stack entry: + + In function ‘__list_add’, + inlined from ‘list_add_tail’ at include/linux/list.h:102:2, + inlined from ‘rebuild_snap_realms’ at fs/ceph/snap.c:434:2: + include/linux/list.h:74:19: warning: storing the address of local variable ‘realm_queue’ in ‘*&realm_27(D)->rebuild_item.prev’ [-Wdangling-pointer=] + 74 | new->prev = prev; + | ~~~~~~~~~~^~~~~~ + +But then gcc - understandably - doesn't really understand the big +picture how the doubly linked list works, so doesn't see how we then end +up emptying said list head in a loop and the pointer we added has been +removed. + +Gcc also complains about us (intentionally) using this as a way to store +a kind of fake stack trace, eg + + drivers/acpi/acpica/utdebug.c:40:38: warning: storing the address of local variable ‘current_sp’ in ‘acpi_gbl_entry_stack_pointer’ [-Wdangling-pointer=] + 40 | acpi_gbl_entry_stack_pointer = ¤t_sp; + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~ + +which is entirely reasonable from a compiler standpoint, and we may want +to change those kinds of patterns, but not not. + +So this is one of those "it would be lovely if the compiler were to +complain about us leaving dangling pointers to the stack", but not this +way. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Makefile b/Makefile +index 34bfb76d6333..476cbe751b17 100644 +--- a/Makefile ++++ b/Makefile +@@ -804,6 +804,9 @@ endif + KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable) + KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) + ++# These result in bogus false positives ++KBUILD_CFLAGS += $(call cc-disable-warning, dangling-pointer) ++ + ifdef CONFIG_FRAME_POINTER + KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls + else +-- +2.35.1 + diff --git a/queue-5.18/gpio-dwapb-don-t-print-error-on-eprobe_defer.patch b/queue-5.18/gpio-dwapb-don-t-print-error-on-eprobe_defer.patch new file mode 100644 index 00000000000..f4554b51274 --- /dev/null +++ b/queue-5.18/gpio-dwapb-don-t-print-error-on-eprobe_defer.patch @@ -0,0 +1,47 @@ +From 9921cbc3d55547e68ee9189631fa09e2659e8c84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jun 2022 13:45:00 +0300 +Subject: gpio: dwapb: Don't print error on -EPROBE_DEFER + +From: Serge Semin + +[ Upstream commit 77006f6edc0e0f58617eb25e53731f78641e820d ] + +Currently if the APB or Debounce clocks aren't yet ready to be requested +the DW GPIO driver will correctly handle that by deferring the probe +procedure, but the error is still printed to the system log. It needlessly +pollutes the log since there was no real error but a request to postpone +the clock request procedure since the clocks subsystem hasn't been fully +initialized yet. Let's fix that by using the dev_err_probe method to print +the APB/clock request error status. It will correctly handle the deferred +probe situation and print the error if it actually happens. + +Signed-off-by: Serge Semin +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-dwapb.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c +index b0f3aca61974..9467d695a33e 100644 +--- a/drivers/gpio/gpio-dwapb.c ++++ b/drivers/gpio/gpio-dwapb.c +@@ -652,10 +652,9 @@ static int dwapb_get_clks(struct dwapb_gpio *gpio) + gpio->clks[1].id = "db"; + err = devm_clk_bulk_get_optional(gpio->dev, DWAPB_NR_CLOCKS, + gpio->clks); +- if (err) { +- dev_err(gpio->dev, "Cannot get APB/Debounce clocks\n"); +- return err; +- } ++ if (err) ++ return dev_err_probe(gpio->dev, err, ++ "Cannot get APB/Debounce clocks\n"); + + err = clk_bulk_prepare_enable(DWAPB_NR_CLOCKS, gpio->clks); + if (err) { +-- +2.35.1 + diff --git a/queue-5.18/input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch b/queue-5.18/input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch new file mode 100644 index 00000000000..cc345171a41 --- /dev/null +++ b/queue-5.18/input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch @@ -0,0 +1,50 @@ +From 36f79d31566c8d329b32754ed86a7cfbbc010143 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 12:10:52 -0700 +Subject: Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to + dmi_use_low_level_irq + +From: Marius Hoch + +[ Upstream commit 6ab2e51898cd4343bbdf8587af8ce8fbabddbcb5 ] + +Commit 223f61b8c5ad ("Input: soc_button_array - add Lenovo Yoga Tablet2 +1051L to the dmi_use_low_level_irq list") added the 1051L to this list +already, but the same problem applies to the 1051F. As there are no +further 1051 variants (just the F/L), we can just DMI match 1051. + +Tested on a Lenovo Yoga Tablet2 1051F: Without this patch the +home-button stops working after a wakeup from suspend. + +Signed-off-by: Marius Hoch +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20220603120246.3065-1-mail@mariushoch.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/soc_button_array.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c +index cbb1599a520e..480476121c01 100644 +--- a/drivers/input/misc/soc_button_array.c ++++ b/drivers/input/misc/soc_button_array.c +@@ -85,13 +85,13 @@ static const struct dmi_system_id dmi_use_low_level_irq[] = { + }, + { + /* +- * Lenovo Yoga Tab2 1051L, something messes with the home-button ++ * Lenovo Yoga Tab2 1051F/1051L, something messes with the home-button + * IRQ settings, leading to a non working home-button. + */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "60073"), +- DMI_MATCH(DMI_PRODUCT_VERSION, "1051L"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "1051"), + }, + }, + {} /* Terminating entry */ +-- +2.35.1 + diff --git a/queue-5.18/ipv6-fix-signed-integer-overflow-in-__ip6_append_dat.patch b/queue-5.18/ipv6-fix-signed-integer-overflow-in-__ip6_append_dat.patch new file mode 100644 index 00000000000..1ab5d0d5984 --- /dev/null +++ b/queue-5.18/ipv6-fix-signed-integer-overflow-in-__ip6_append_dat.patch @@ -0,0 +1,114 @@ +From 71c5cf33136ee53f07907445f17d6eaa5d870e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 20:00:27 +0800 +Subject: ipv6: Fix signed integer overflow in __ip6_append_data + +From: Wang Yufen + +[ Upstream commit f93431c86b631bbca5614c66f966bf3ddb3c2803 ] + +Resurrect ubsan overflow checks and ubsan report this warning, +fix it by change the variable [length] type to size_t. + +UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 +2147479552 + 8567 cannot be represented in type 'int' +CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 +Hardware name: linux,dummy-virt (DT) +Call trace: + dump_backtrace+0x214/0x230 + show_stack+0x30/0x78 + dump_stack_lvl+0xf8/0x118 + dump_stack+0x18/0x30 + ubsan_epilogue+0x18/0x60 + handle_overflow+0xd0/0xf0 + __ubsan_handle_add_overflow+0x34/0x44 + __ip6_append_data.isra.48+0x1598/0x1688 + ip6_append_data+0x128/0x260 + udpv6_sendmsg+0x680/0xdd0 + inet6_sendmsg+0x54/0x90 + sock_sendmsg+0x70/0x88 + ____sys_sendmsg+0xe8/0x368 + ___sys_sendmsg+0x98/0xe0 + __sys_sendmmsg+0xf4/0x3b8 + __arm64_sys_sendmmsg+0x34/0x48 + invoke_syscall+0x64/0x160 + el0_svc_common.constprop.4+0x124/0x300 + do_el0_svc+0x44/0xc8 + el0_svc+0x3c/0x1e8 + el0t_64_sync_handler+0x88/0xb0 + el0t_64_sync+0x16c/0x170 + +Changes since v1: +-Change the variable [length] type to unsigned, as Eric Dumazet suggested. +Changes since v2: +-Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. +Changes since v3: +-Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as +Jakub Kicinski suggested. + +Reported-by: Hulk Robot +Signed-off-by: Wang Yufen +Link: https://lore.kernel.org/r/20220607120028.845916-1-wangyufen@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ipv6.h | 4 ++-- + net/ipv6/ip6_output.c | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 213612f1680c..023435ce1606 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -1019,7 +1019,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr); + int ip6_append_data(struct sock *sk, + int getfrag(void *from, char *to, int offset, int len, + int odd, struct sk_buff *skb), +- void *from, int length, int transhdrlen, ++ void *from, size_t length, int transhdrlen, + struct ipcm6_cookie *ipc6, struct flowi6 *fl6, + struct rt6_info *rt, unsigned int flags); + +@@ -1035,7 +1035,7 @@ struct sk_buff *__ip6_make_skb(struct sock *sk, struct sk_buff_head *queue, + struct sk_buff *ip6_make_skb(struct sock *sk, + int getfrag(void *from, char *to, int offset, + int len, int odd, struct sk_buff *skb), +- void *from, int length, int transhdrlen, ++ void *from, size_t length, int transhdrlen, + struct ipcm6_cookie *ipc6, + struct rt6_info *rt, unsigned int flags, + struct inet_cork_full *cork); +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index fa63ef2bd99c..87067e0ddaa3 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1428,7 +1428,7 @@ static int __ip6_append_data(struct sock *sk, + struct page_frag *pfrag, + int getfrag(void *from, char *to, int offset, + int len, int odd, struct sk_buff *skb), +- void *from, int length, int transhdrlen, ++ void *from, size_t length, int transhdrlen, + unsigned int flags, struct ipcm6_cookie *ipc6) + { + struct sk_buff *skb, *skb_prev = NULL; +@@ -1776,7 +1776,7 @@ static int __ip6_append_data(struct sock *sk, + int ip6_append_data(struct sock *sk, + int getfrag(void *from, char *to, int offset, int len, + int odd, struct sk_buff *skb), +- void *from, int length, int transhdrlen, ++ void *from, size_t length, int transhdrlen, + struct ipcm6_cookie *ipc6, struct flowi6 *fl6, + struct rt6_info *rt, unsigned int flags) + { +@@ -1973,7 +1973,7 @@ EXPORT_SYMBOL_GPL(ip6_flush_pending_frames); + struct sk_buff *ip6_make_skb(struct sock *sk, + int getfrag(void *from, char *to, int offset, + int len, int odd, struct sk_buff *skb), +- void *from, int length, int transhdrlen, ++ void *from, size_t length, int transhdrlen, + struct ipcm6_cookie *ipc6, struct rt6_info *rt, + unsigned int flags, struct inet_cork_full *cork) + { +-- +2.35.1 + diff --git a/queue-5.18/ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch b/queue-5.18/ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch new file mode 100644 index 00000000000..bcde08108d3 --- /dev/null +++ b/queue-5.18/ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch @@ -0,0 +1,46 @@ +From f884ae390f601d1506efdab718ff2fb89d0fa4b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 20:00:28 +0800 +Subject: ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg + +From: Wang Yufen + +[ Upstream commit f638a84afef3dfe10554c51820c16e39a278c915 ] + +When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be +overflow. To fix, we can follow what udpv6 does and subtract the +transhdrlen from the max. + +Signed-off-by: Wang Yufen +Link: https://lore.kernel.org/r/20220607120028.845916-2-wangyufen@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_ip6.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index 96f975777438..d54dbd01d86f 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -502,14 +502,15 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + struct ipcm6_cookie ipc6; + int addr_len = msg->msg_namelen; + int transhdrlen = 4; /* zero session-id */ +- int ulen = len + transhdrlen; ++ int ulen; + int err; + + /* Rough check on arithmetic overflow, + * better check is made in ip6_append_data(). + */ +- if (len > INT_MAX) ++ if (len > INT_MAX - transhdrlen) + return -EMSGSIZE; ++ ulen = len + transhdrlen; + + /* Mirror BSD error message compatibility */ + if (msg->msg_flags & MSG_OOB) +-- +2.35.1 + diff --git a/queue-5.18/mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch b/queue-5.18/mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch new file mode 100644 index 00000000000..53b41c0dc72 --- /dev/null +++ b/queue-5.18/mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch @@ -0,0 +1,52 @@ +From bd803677d442ebd857c743680d21d1aa6380e2b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 10:03:28 -0700 +Subject: mellanox: mlx5: avoid uninitialized variable warning with gcc-12 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +[ Upstream commit 842c3b3ddc5f4d17275edbaa09e23d712bf8b915 ] + +gcc-12 started warning about 'tracker' being used uninitialized: + + drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c: In function ‘mlx5_do_bond’: + drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c:786:28: warning: ‘tracker’ is used uninitialized [-Wuninitialized] + 786 | struct lag_tracker tracker; + | ^~~~~~~ + +which seems to be because it doesn't track how the use (and +initialization) is bound by the 'do_bond' flag. + +But admittedly that 'do_bond' usage is fairly complicated, and involves +passing it around as an argument to helper functions, so it's somewhat +understandable that gcc doesn't see how that all works. + +This function could be rewritten to make the use of that tracker +variable more obviously safe, but for now I'm just adding the forced +initialization of it. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +index a8b98242edb1..a1e9d3051533 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +@@ -561,7 +561,7 @@ static void mlx5_do_bond(struct mlx5_lag *ldev) + { + struct mlx5_core_dev *dev0 = ldev->pf[MLX5_LAG_P1].dev; + struct mlx5_core_dev *dev1 = ldev->pf[MLX5_LAG_P2].dev; +- struct lag_tracker tracker; ++ struct lag_tracker tracker = { }; + bool do_bond, roce_lag; + int err; + +-- +2.35.1 + diff --git a/queue-5.18/mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch b/queue-5.18/mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch new file mode 100644 index 00000000000..ff09de0d8d8 --- /dev/null +++ b/queue-5.18/mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch @@ -0,0 +1,55 @@ +From ea000cfeae59d4be2fd88a0ab0ed4cc086815487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 09:12:29 +0800 +Subject: MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yupeng Li + +[ Upstream commit 41e456400212803704e82691716e1d7b0865114a ] + + set cpu_hwmon as a module build with loongson_sysconf, loongson_chiptemp + undefined error,fix cpu_hwmon compile options to be bool.Some kernel + compilation error information is as follows: + + Checking missing-syscalls for N32 + CALL scripts/checksyscalls.sh + Checking missing-syscalls for O32 + CALL scripts/checksyscalls.sh + CALL scripts/checksyscalls.sh + CHK include/generated/compile.h + CC [M] drivers/platform/mips/cpu_hwmon.o + Building modules, stage 2. + MODPOST 200 modules +ERROR: "loongson_sysconf" [drivers/platform/mips/cpu_hwmon.ko] undefined! +ERROR: "loongson_chiptemp" [drivers/platform/mips/cpu_hwmon.ko] undefined! +make[1]: *** [scripts/Makefile.modpost:92：__modpost] 错误 1 +make: *** [Makefile:1261：modules] 错误 2 + +Signed-off-by: Yupeng Li +Reviewed-by: Guenter Roeck +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + drivers/platform/mips/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/mips/Kconfig b/drivers/platform/mips/Kconfig +index d421e1482395..6b51ad01f791 100644 +--- a/drivers/platform/mips/Kconfig ++++ b/drivers/platform/mips/Kconfig +@@ -17,7 +17,7 @@ menuconfig MIPS_PLATFORM_DEVICES + if MIPS_PLATFORM_DEVICES + + config CPU_HWMON +- tristate "Loongson-3 CPU HWMon Driver" ++ bool "Loongson-3 CPU HWMon Driver" + depends on MACH_LOONGSON64 + select HWMON + default y +-- +2.35.1 + diff --git a/queue-5.18/net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch b/queue-5.18/net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch new file mode 100644 index 00000000000..d4ea8b2f8d3 --- /dev/null +++ b/queue-5.18/net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch @@ -0,0 +1,74 @@ +From 59d33550cdc0c81967e2263cf4c76e5eedd2a52e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 20:46:53 +0800 +Subject: net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface + netdev[napi]_alloc_frag + +From: Chen Lin + +[ Upstream commit 2f2c0d2919a14002760f89f4e02960c735a316d2 ] + +When rx_flag == MTK_RX_FLAGS_HWLRO, +rx_data_len = MTK_MAX_LRO_RX_LENGTH(4096 * 3) > PAGE_SIZE. +netdev_alloc_frag is for alloction of page fragment only. +Reference to other drivers and Documentation/vm/page_frags.rst + +Branch to use __get_free_pages when ring->frag_size > PAGE_SIZE. + +Signed-off-by: Chen Lin +Link: https://lore.kernel.org/r/1654692413-2598-1-git-send-email-chen45464546@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index a50090e62c8f..c075670bc562 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -778,6 +778,17 @@ static inline bool mtk_rx_get_desc(struct mtk_rx_dma *rxd, + return true; + } + ++static void *mtk_max_lro_buf_alloc(gfp_t gfp_mask) ++{ ++ unsigned int size = mtk_max_frag_size(MTK_MAX_LRO_RX_LENGTH); ++ unsigned long data; ++ ++ data = __get_free_pages(gfp_mask | __GFP_COMP | __GFP_NOWARN, ++ get_order(size)); ++ ++ return (void *)data; ++} ++ + /* the qdma core needs scratch memory to be setup */ + static int mtk_init_fq_dma(struct mtk_eth *eth) + { +@@ -1269,7 +1280,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, + goto release_desc; + + /* alloc new buffer */ +- new_data = napi_alloc_frag(ring->frag_size); ++ if (ring->frag_size <= PAGE_SIZE) ++ new_data = napi_alloc_frag(ring->frag_size); ++ else ++ new_data = mtk_max_lro_buf_alloc(GFP_ATOMIC); + if (unlikely(!new_data)) { + netdev->stats.rx_dropped++; + goto release_desc; +@@ -1683,7 +1697,10 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag) + return -ENOMEM; + + for (i = 0; i < rx_dma_size; i++) { +- ring->data[i] = netdev_alloc_frag(ring->frag_size); ++ if (ring->frag_size <= PAGE_SIZE) ++ ring->data[i] = netdev_alloc_frag(ring->frag_size); ++ else ++ ring->data[i] = mtk_max_lro_buf_alloc(GFP_KERNEL); + if (!ring->data[i]) + return -ENOMEM; + } +-- +2.35.1 + diff --git a/queue-5.18/netfs-gcc-12-temporarily-disable-wattribute-warning-.patch b/queue-5.18/netfs-gcc-12-temporarily-disable-wattribute-warning-.patch new file mode 100644 index 00000000000..c855f1f8326 --- /dev/null +++ b/queue-5.18/netfs-gcc-12-temporarily-disable-wattribute-warning-.patch @@ -0,0 +1,110 @@ +From b303c323b2137c70380eff2342ccb826591caaa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 11:29:36 -0700 +Subject: netfs: gcc-12: temporarily disable '-Wattribute-warning' for now +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +[ Upstream commit 507160f46c55913955d272ebf559d63809a8e560 ] + +This is a pure band-aid so that I can continue merging stuff from people +while some of the gcc-12 fallout gets sorted out. + +In particular, gcc-12 is very unhappy about the kinds of pointer +arithmetic tricks that netfs does, and that makes the fortify checks +trigger in afs and ceph: + + In function ‘fortify_memset_chk’, + inlined from ‘netfs_i_context_init’ at include/linux/netfs.h:327:2, + inlined from ‘afs_set_netfs_context’ at fs/afs/inode.c:61:2, + inlined from ‘afs_root_iget’ at fs/afs/inode.c:543:2: + include/linux/fortify-string.h:258:25: warning: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] + 258 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +and the reason is that netfs_i_context_init() is passed a 'struct inode' +pointer, and then it does + + struct netfs_i_context *ctx = netfs_i_context(inode); + + memset(ctx, 0, sizeof(*ctx)); + +where that netfs_i_context() function just does pointer arithmetic on +the inode pointer, knowing that the netfs_i_context is laid out +immediately after it in memory. + +This is all truly disgusting, since the whole "netfs_i_context is laid +out immediately after it in memory" is not actually remotely true in +general, but is just made to be that way for afs and ceph. + +See for example fs/cifs/cifsglob.h: + + struct cifsInodeInfo { + struct { + /* These must be contiguous */ + struct inode vfs_inode; /* the VFS's inode record */ + struct netfs_i_context netfs_ctx; /* Netfslib context */ + }; + [...] + +and realize that this is all entirely wrong, and the pointer arithmetic +that netfs_i_context() is doing is also very very wrong and wouldn't +give the right answer if netfs_ctx had different alignment rules from a +'struct inode', for example). + +Anyway, that's just a long-winded way to say "the gcc-12 warning is +actually quite reasonable, and our code happens to work but is pretty +disgusting". + +This is getting fixed properly, but for now I made the mistake of +thinking "the week right after the merge window tends to be calm for me +as people take a breather" and I did a sustem upgrade. And I got gcc-12 +as a result, so to continue merging fixes from people and not have the +end result drown in warnings, I am fixing all these gcc-12 issues I hit. + +Including with these kinds of temporary fixes. + +Cc: Kees Cook +Cc: David Howells +Link: https://lore.kernel.org/all/AEEBCF5D-8402-441D-940B-105AA718C71F@chromium.org/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 3 +++ + fs/ceph/inode.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 30b066299d39..65b439cd53d2 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -25,6 +25,9 @@ + #include "internal.h" + #include "afs_fs.h" + ++// Temporary: netfs does disgusting things with inode pointers ++#pragma GCC diagnostic ignored "-Wattribute-warning" ++ + static const struct inode_operations afs_symlink_inode_operations = { + .get_link = page_get_link, + }; +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 63113e2a4890..83739dae5268 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -20,6 +20,9 @@ + #include "cache.h" + #include + ++// Temporary: netfs does disgusting things with inode pointers ++#pragma GCC diagnostic ignored "-Wattribute-warning" ++ + /* + * Ceph inode operations + * +-- +2.35.1 + diff --git a/queue-5.18/nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch b/queue-5.18/nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch new file mode 100644 index 00000000000..7e67a100981 --- /dev/null +++ b/queue-5.18/nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch @@ -0,0 +1,66 @@ +From a155c568e8131be7f6e57a63456eb8db4bb63757 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 16:32:30 +0800 +Subject: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred + +From: Xiaohui Zhang + +[ Upstream commit 8a4d480702b71184fabcf379b80bf7539716752e ] + +Similar to the handling of play_deferred in commit 19cfe912c37b +("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought +a patch might be needed here as well. + +Currently usb_submit_urb is called directly to submit deferred tx +urbs after unanchor them. + +So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb +and cause memory leak. + +Put those urbs in tx_anchor to avoid the leak, and also fix the error +handling. + +Signed-off-by: Xiaohui Zhang +Acked-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220607083230.6182-1-xiaohuizhang@ruc.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nfcmrvl/usb.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c +index a99aedff795d..ea7309453096 100644 +--- a/drivers/nfc/nfcmrvl/usb.c ++++ b/drivers/nfc/nfcmrvl/usb.c +@@ -388,13 +388,25 @@ static void nfcmrvl_play_deferred(struct nfcmrvl_usb_drv_data *drv_data) + int err; + + while ((urb = usb_get_from_anchor(&drv_data->deferred))) { ++ usb_anchor_urb(urb, &drv_data->tx_anchor); ++ + err = usb_submit_urb(urb, GFP_ATOMIC); +- if (err) ++ if (err) { ++ kfree(urb->setup_packet); ++ usb_unanchor_urb(urb); ++ usb_free_urb(urb); + break; ++ } + + drv_data->tx_in_flight++; ++ usb_free_urb(urb); ++ } ++ ++ /* Cleanup the rest deferred urbs. */ ++ while ((urb = usb_get_from_anchor(&drv_data->deferred))) { ++ kfree(urb->setup_packet); ++ usb_free_urb(urb); + } +- usb_scuttle_anchored_urbs(&drv_data->deferred); + } + + static int nfcmrvl_resume(struct usb_interface *intf) +-- +2.35.1 + diff --git a/queue-5.18/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch b/queue-5.18/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch new file mode 100644 index 00000000000..4ef09e2b548 --- /dev/null +++ b/queue-5.18/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch @@ -0,0 +1,34 @@ +From cbe28bf976d48c6ce3b9258951eb550f850e60fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 23:20:28 +0200 +Subject: platform/x86: gigabyte-wmi: Add support for B450M DS3H-CF + +From: August Wikerfors + +[ Upstream commit c6bc7e8ee90845556a90faf8b043cbefd77b8903 ] + +Tested and works on my system. + +Signed-off-by: August Wikerfors +Link: https://lore.kernel.org/r/20220608212028.28307-1-git@augustwikerfors.se +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/gigabyte-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c +index 05588a47ac38..78446b1953f7 100644 +--- a/drivers/platform/x86/gigabyte-wmi.c ++++ b/drivers/platform/x86/gigabyte-wmi.c +@@ -140,6 +140,7 @@ static u8 gigabyte_wmi_detect_sensor_usability(struct wmi_device *wdev) + }} + + static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = { ++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H-CF"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M S2H V2"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE AX V2"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"), +-- +2.35.1 + diff --git a/queue-5.18/platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch b/queue-5.18/platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch new file mode 100644 index 00000000000..a68a754df7b --- /dev/null +++ b/queue-5.18/platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch @@ -0,0 +1,35 @@ +From 4a86e46abbe0eb8237855651bdfa7cde11dad995 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 19:15:13 +0200 +Subject: platform/x86: gigabyte-wmi: Add Z690M AORUS ELITE AX DDR4 support + +From: Piotr Chmura + +[ Upstream commit 8a041afe3e774bedd3e0a9b96f65e48a1299a595 ] + +Add dmi_system_id of Gigabyte Z690M AORUS ELITE AX DDR4 board. +Tested on my PC. + +Signed-off-by: Piotr Chmura +Link: https://lore.kernel.org/r/bd83567e-ebf5-0b31-074b-5f6dc7f7c147@gmail.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/gigabyte-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c +index e87a931eab1e..05588a47ac38 100644 +--- a/drivers/platform/x86/gigabyte-wmi.c ++++ b/drivers/platform/x86/gigabyte-wmi.c +@@ -154,6 +154,7 @@ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = { + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 GAMING X"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 I AORUS PRO WIFI"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 UD"), ++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("Z690M AORUS ELITE AX DDR4"), + { } + }; + +-- +2.35.1 + diff --git a/queue-5.18/platform-x86-intel-fix-pmt_crashlog-array-reference.patch b/queue-5.18/platform-x86-intel-fix-pmt_crashlog-array-reference.patch new file mode 100644 index 00000000000..1cd55f88f49 --- /dev/null +++ b/queue-5.18/platform-x86-intel-fix-pmt_crashlog-array-reference.patch @@ -0,0 +1,44 @@ +From e38c1903674801a03055ec89c784787f656355ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 16:31:40 -0400 +Subject: platform/x86/intel: Fix pmt_crashlog array reference + +From: David Arcari + +[ Upstream commit 66cb3a2d7ad0d0e9af4d3430a4f2a32ffb9ac098 ] + +The probe function pmt_crashlog_probe() may incorrectly reference +the 'priv->entry array' as it uses 'i' to reference the array instead +of 'priv->num_entries' as it should. This is similar to the problem +that was addressed in pmt_telemetry_probe via commit 2cdfa0c20d58 +("platform/x86/intel: Fix 'rmmod pmt_telemetry' panic"). + +Cc: "David E. Box" +Cc: Hans de Goede +Cc: Mark Gross +Cc: linux-kernel@vger.kernel.org +Signed-off-by: David Arcari +Reviewed-by: David E. Box +Link: https://lore.kernel.org/r/20220526203140.339120-1-darcari@redhat.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/pmt/crashlog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel/pmt/crashlog.c b/drivers/platform/x86/intel/pmt/crashlog.c +index 34daf9df168b..ace1239bc0a0 100644 +--- a/drivers/platform/x86/intel/pmt/crashlog.c ++++ b/drivers/platform/x86/intel/pmt/crashlog.c +@@ -282,7 +282,7 @@ static int pmt_crashlog_probe(struct auxiliary_device *auxdev, + auxiliary_set_drvdata(auxdev, priv); + + for (i = 0; i < intel_vsec_dev->num_resources; i++) { +- struct intel_pmt_entry *entry = &priv->entry[i].entry; ++ struct intel_pmt_entry *entry = &priv->entry[priv->num_entries].entry; + + ret = intel_pmt_dev_create(entry, &pmt_crashlog_ns, intel_vsec_dev, i); + if (ret < 0) +-- +2.35.1 + diff --git a/queue-5.18/platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch b/queue-5.18/platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch new file mode 100644 index 00000000000..36e32c340a5 --- /dev/null +++ b/queue-5.18/platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch @@ -0,0 +1,44 @@ +From 69dac90e2f21251ae5813d353f15d65dafd6e67c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 14:36:54 -0700 +Subject: platform/x86/intel: hid: Add Surface Go to VGBS allow list + +From: Duke Lee + +[ Upstream commit d4fe9cc4ff8656704b58cfd9363d7c3c9d65e519 ] + +The Surface Go reports Chassis Type 9 (Laptop,) so the device needs to be +added to dmi_vgbs_allow_list to enable tablet mode when an attached Type +Cover is folded back. + +BugLink: https://github.com/linux-surface/linux-surface/issues/837 +Signed-off-by: Duke Lee +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20220607213654.5567-1-krnhotwings@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index 216d31e3403d..79cff1fc675c 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -122,6 +122,12 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Convertible 15-df0xxx"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go"), ++ }, ++ }, + { } + }; + +-- +2.35.1 + diff --git a/queue-5.18/platform-x86-intel-pmc-support-intel-raptorlake-p.patch b/queue-5.18/platform-x86-intel-pmc-support-intel-raptorlake-p.patch new file mode 100644 index 00000000000..7e406dab303 --- /dev/null +++ b/queue-5.18/platform-x86-intel-pmc-support-intel-raptorlake-p.patch @@ -0,0 +1,37 @@ +From b3b23a0e7c3f6d5871ab449a1023204f13d20e6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 18:26:17 -0700 +Subject: platform/x86/intel: pmc: Support Intel Raptorlake P + +From: George D Sworo + +[ Upstream commit 552f3b801de6eb062b225a76e140995483a0609c ] + +Add Raptorlake P to the list of the platforms that intel_pmc_core driver +supports for pmc_core device. Raptorlake P PCH is based on Alderlake P +PCH. + +Signed-off-by: George D Sworo +Reviewed-by: David E. Box +Link: https://lore.kernel.org/r/20220602012617.20100-1-george.d.sworo@intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/pmc/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c +index ac19fcc9abbf..8ee15a7252c7 100644 +--- a/drivers/platform/x86/intel/pmc/core.c ++++ b/drivers/platform/x86/intel/pmc/core.c +@@ -1912,6 +1912,7 @@ static const struct x86_cpu_id intel_pmc_core_ids[] = { + X86_MATCH_INTEL_FAM6_MODEL(ROCKETLAKE, &tgl_reg_map), + X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_L, &tgl_reg_map), + X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE, &adl_reg_map), ++ X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_P, &tgl_reg_map), + {} + }; + +-- +2.35.1 + diff --git a/queue-5.18/powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch b/queue-5.18/powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch new file mode 100644 index 00000000000..2fbd474dbf9 --- /dev/null +++ b/queue-5.18/powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch @@ -0,0 +1,91 @@ +From 140e5b2bb604fcd6235bb385327057636af90c4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 20:44:18 -0500 +Subject: powerpc/kasan: Silence KASAN warnings in __get_wchan() + +From: He Ying + +[ Upstream commit a1b29ba2f2c171b9bea73be993bfdf0a62d37d15 ] + +The following KASAN warning was reported in our kernel. + + BUG: KASAN: stack-out-of-bounds in get_wchan+0x188/0x250 + Read of size 4 at addr d216f958 by task ps/14437 + + CPU: 3 PID: 14437 Comm: ps Tainted: G O 5.10.0 #1 + Call Trace: + [daa63858] [c0654348] dump_stack+0x9c/0xe4 (unreliable) + [daa63888] [c035cf0c] print_address_description.constprop.3+0x8c/0x570 + [daa63908] [c035d6bc] kasan_report+0x1ac/0x218 + [daa63948] [c00496e8] get_wchan+0x188/0x250 + [daa63978] [c0461ec8] do_task_stat+0xce8/0xe60 + [daa63b98] [c0455ac8] proc_single_show+0x98/0x170 + [daa63bc8] [c03cab8c] seq_read_iter+0x1ec/0x900 + [daa63c38] [c03cb47c] seq_read+0x1dc/0x290 + [daa63d68] [c037fc94] vfs_read+0x164/0x510 + [daa63ea8] [c03808e4] ksys_read+0x144/0x1d0 + [daa63f38] [c005b1dc] ret_from_syscall+0x0/0x38 + --- interrupt: c00 at 0x8fa8f4 + LR = 0x8fa8cc + + The buggy address belongs to the page: + page:98ebcdd2 refcount:0 mapcount:0 mapping:00000000 index:0x2 pfn:0x1216f + flags: 0x0() + raw: 00000000 00000000 01010122 00000000 00000002 00000000 ffffffff 00000000 + raw: 00000000 + page dumped because: kasan: bad access detected + + Memory state around the buggy address: + d216f800: 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 + d216f880: f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + >d216f900: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 + ^ + d216f980: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 + d216fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +After looking into this issue, I find the buggy address belongs +to the task stack region. It seems KASAN has something wrong. +I look into the code of __get_wchan in x86 architecture and +find the same issue has been resolved by the commit +f7d27c35ddff ("x86/mm, kasan: Silence KASAN warnings in get_wchan()"). +The solution could be applied to powerpc architecture too. + +As Andrey Ryabinin said, get_wchan() is racy by design, it may +access volatile stack of running task, thus it may access +redzone in a stack frame and cause KASAN to warn about this. + +Use READ_ONCE_NOCHECK() to silence these warnings. + +Reported-by: Wanming Hu +Signed-off-by: He Ying +Signed-off-by: Chen Jingwen +Reviewed-by: Kees Cook +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220121014418.155675-1-heying24@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/process.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 984813a4d5dc..a75d20f23dac 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -2160,12 +2160,12 @@ static unsigned long ___get_wchan(struct task_struct *p) + return 0; + + do { +- sp = *(unsigned long *)sp; ++ sp = READ_ONCE_NOCHECK(*(unsigned long *)sp); + if (!validate_sp(sp, p, STACK_FRAME_OVERHEAD) || + task_is_running(p)) + return 0; + if (count > 0) { +- ip = ((unsigned long *)sp)[STACK_FRAME_LR_SAVE]; ++ ip = READ_ONCE_NOCHECK(((unsigned long *)sp)[STACK_FRAME_LR_SAVE]); + if (!in_sched_functions(ip)) + return ip; + } +-- +2.35.1 + diff --git a/queue-5.18/quota-prevent-memory-allocation-recursion-while-hold.patch b/queue-5.18/quota-prevent-memory-allocation-recursion-while-hold.patch new file mode 100644 index 00000000000..209406b3db7 --- /dev/null +++ b/queue-5.18/quota-prevent-memory-allocation-recursion-while-hold.patch @@ -0,0 +1,97 @@ +From 232b982d30c92bff029d944ecbb42baae7598931 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jun 2022 15:38:13 +0100 +Subject: quota: Prevent memory allocation recursion while holding dq_lock + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 537e11cdc7a6b3ce94fa25ed41306193df9677b7 ] + +As described in commit 02117b8ae9c0 ("f2fs: Set GF_NOFS in +read_cache_page_gfp while doing f2fs_quota_read"), we must not enter +filesystem reclaim while holding the dq_lock. Prevent this more generally +by using memalloc_nofs_save() while holding the lock. + +Link: https://lore.kernel.org/r/20220605143815.2330891-2-willy@infradead.org +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index a74aef99bd3d..09d1307959d0 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -79,6 +79,7 @@ + #include + #include + #include ++#include + #include "../internal.h" /* ugh */ + + #include +@@ -425,9 +426,11 @@ EXPORT_SYMBOL(mark_info_dirty); + int dquot_acquire(struct dquot *dquot) + { + int ret = 0, ret2 = 0; ++ unsigned int memalloc; + struct quota_info *dqopt = sb_dqopt(dquot->dq_sb); + + mutex_lock(&dquot->dq_lock); ++ memalloc = memalloc_nofs_save(); + if (!test_bit(DQ_READ_B, &dquot->dq_flags)) { + ret = dqopt->ops[dquot->dq_id.type]->read_dqblk(dquot); + if (ret < 0) +@@ -458,6 +461,7 @@ int dquot_acquire(struct dquot *dquot) + smp_mb__before_atomic(); + set_bit(DQ_ACTIVE_B, &dquot->dq_flags); + out_iolock: ++ memalloc_nofs_restore(memalloc); + mutex_unlock(&dquot->dq_lock); + return ret; + } +@@ -469,9 +473,11 @@ EXPORT_SYMBOL(dquot_acquire); + int dquot_commit(struct dquot *dquot) + { + int ret = 0; ++ unsigned int memalloc; + struct quota_info *dqopt = sb_dqopt(dquot->dq_sb); + + mutex_lock(&dquot->dq_lock); ++ memalloc = memalloc_nofs_save(); + if (!clear_dquot_dirty(dquot)) + goto out_lock; + /* Inactive dquot can be only if there was error during read/init +@@ -481,6 +487,7 @@ int dquot_commit(struct dquot *dquot) + else + ret = -EIO; + out_lock: ++ memalloc_nofs_restore(memalloc); + mutex_unlock(&dquot->dq_lock); + return ret; + } +@@ -492,9 +499,11 @@ EXPORT_SYMBOL(dquot_commit); + int dquot_release(struct dquot *dquot) + { + int ret = 0, ret2 = 0; ++ unsigned int memalloc; + struct quota_info *dqopt = sb_dqopt(dquot->dq_sb); + + mutex_lock(&dquot->dq_lock); ++ memalloc = memalloc_nofs_save(); + /* Check whether we are not racing with some other dqget() */ + if (dquot_is_busy(dquot)) + goto out_dqlock; +@@ -510,6 +519,7 @@ int dquot_release(struct dquot *dquot) + } + clear_bit(DQ_ACTIVE_B, &dquot->dq_flags); + out_dqlock: ++ memalloc_nofs_restore(memalloc); + mutex_unlock(&dquot->dq_lock); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.18/random-credit-cpu-and-bootloader-seeds-by-default.patch b/queue-5.18/random-credit-cpu-and-bootloader-seeds-by-default.patch new file mode 100644 index 00000000000..30e18b55d1d --- /dev/null +++ b/queue-5.18/random-credit-cpu-and-bootloader-seeds-by-default.patch @@ -0,0 +1,200 @@ +From f6f806d227666a32889d20fc2596a6ee862711cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jun 2022 18:30:46 +0200 +Subject: random: credit cpu and bootloader seeds by default + +From: Jason A. Donenfeld + +[ Upstream commit 846bb97e131d7938847963cca00657c995b1fce1 ] + +This commit changes the default Kconfig values of RANDOM_TRUST_CPU and +RANDOM_TRUST_BOOTLOADER to be Y by default. It does not change any +existing configs or change any kernel behavior. The reason for this is +several fold. + +As background, I recently had an email thread with the kernel +maintainers of Fedora/RHEL, Debian, Ubuntu, Gentoo, Arch, NixOS, Alpine, +SUSE, and Void as recipients. I noted that some distros trust RDRAND, +some trust EFI, and some trust both, and I asked why or why not. There +wasn't really much of a "debate" but rather an interesting discussion of +what the historical reasons have been for this, and it came up that some +distros just missed the introduction of the bootloader Kconfig knob, +while another didn't want to enable it until there was a boot time +switch to turn it off for more concerned users (which has since been +added). The result of the rather uneventful discussion is that every +major Linux distro enables these two options by default. + +While I didn't have really too strong of an opinion going into this +thread -- and I mostly wanted to learn what the distros' thinking was +one way or another -- ultimately I think their choice was a decent +enough one for a default option (which can be disabled at boot time). +I'll try to summarize the pros and cons: + +Pros: + +- The RNG machinery gets initialized super quickly, and there's no + messing around with subsequent blocking behavior. + +- The bootloader mechanism is used by kexec in order for the prior + kernel to initialize the RNG of the next kernel, which increases + the entropy available to early boot daemons of the next kernel. + +- Previous objections related to backdoors centered around + Dual_EC_DRBG-like kleptographic systems, in which observing some + amount of the output stream enables an adversary holding the right key + to determine the entire output stream. + + This used to be a partially justified concern, because RDRAND output + was mixed into the output stream in varying ways, some of which may + have lacked pre-image resistance (e.g. XOR or an LFSR). + + But this is no longer the case. Now, all usage of RDRAND and + bootloader seeds go through a cryptographic hash function. This means + that the CPU would have to compute a hash pre-image, which is not + considered to be feasible (otherwise the hash function would be + terribly broken). + +- More generally, if the CPU is backdoored, the RNG is probably not the + realistic vector of choice for an attacker. + +- These CPU or bootloader seeds are far from being the only source of + entropy. Rather, there is generally a pretty huge amount of entropy, + not all of which is credited, especially on CPUs that support + instructions like RDRAND. In other words, assuming RDRAND outputs all + zeros, an attacker would *still* have to accurately model every single + other entropy source also in use. + +- The RNG now reseeds itself quite rapidly during boot, starting at 2 + seconds, then 4, then 8, then 16, and so forth, so that other sources + of entropy get used without much delay. + +- Paranoid users can set random.trust_{cpu,bootloader}=no in the kernel + command line, and paranoid system builders can set the Kconfig options + to N, so there's no reduction or restriction of optionality. + +- It's a practical default. + +- All the distros have it set this way. Microsoft and Apple trust it + too. Bandwagon. + +Cons: + +- RDRAND *could* still be backdoored with something like a fixed key or + limited space serial number seed or another indexable scheme like + that. (However, it's hard to imagine threat models where the CPU is + backdoored like this, yet people are still okay making *any* + computations with it or connecting it to networks, etc.) + +- RDRAND *could* be defective, rather than backdoored, and produce + garbage that is in one way or another insufficient for crypto. + +- Suggesting a *reduction* in paranoia, as this commit effectively does, + may cause some to question my personal integrity as a "security + person". + +- Bootloader seeds and RDRAND are generally very difficult if not all + together impossible to audit. + +Keep in mind that this doesn't actually change any behavior. This +is just a change in the default Kconfig value. The distros already are +shipping kernels that set things this way. + +Ard made an additional argument in [1]: + + We're at the mercy of firmware and micro-architecture anyway, given + that we are also relying on it to ensure that every instruction in + the kernel's executable image has been faithfully copied to memory, + and that the CPU implements those instructions as documented. So I + don't think firmware or ISA bugs related to RNGs deserve special + treatment - if they are broken, we should quirk around them like we + usually do. So enabling these by default is a step in the right + direction IMHO. + +In [2], Phil pointed out that having this disabled masked a bug that CI +otherwise would have caught: + + A clean 5.15.45 boots cleanly, whereas a downstream kernel shows the + static key warning (but it does go on to boot). The significant + difference is that our defconfigs set CONFIG_RANDOM_TRUST_BOOTLOADER=y + defining that on top of multi_v7_defconfig demonstrates the issue on + a clean 5.15.45. Conversely, not setting that option in a + downstream kernel build avoids the warning + +[1] https://lore.kernel.org/lkml/CAMj1kXGi+ieviFjXv9zQBSaGyyzeGW_VpMpTLJK8PJb2QHEQ-w@mail.gmail.com/ +[2] https://lore.kernel.org/lkml/c47c42e3-1d56-5859-a6ad-976a1a3381c6@raspberrypi.com/ + +Cc: Theodore Ts'o +Reviewed-by: Ard Biesheuvel +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Sasha Levin +--- + drivers/char/Kconfig | 50 +++++++++++++++++++++++++++----------------- + 1 file changed, 31 insertions(+), 19 deletions(-) + +diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig +index 55f48375e3fe..d454428f4981 100644 +--- a/drivers/char/Kconfig ++++ b/drivers/char/Kconfig +@@ -428,28 +428,40 @@ config ADI + driver include crash and makedumpfile. + + config RANDOM_TRUST_CPU +- bool "Trust the CPU manufacturer to initialize Linux's CRNG" ++ bool "Initialize RNG using CPU RNG instructions" ++ default y + depends on ARCH_RANDOM +- default n + help +- Assume that CPU manufacturer (e.g., Intel or AMD for RDSEED or +- RDRAND, IBM for the S390 and Power PC architectures) is trustworthy +- for the purposes of initializing Linux's CRNG. Since this is not +- something that can be independently audited, this amounts to trusting +- that CPU manufacturer (perhaps with the insistence or mandate +- of a Nation State's intelligence or law enforcement agencies) +- has not installed a hidden back door to compromise the CPU's +- random number generation facilities. This can also be configured +- at boot with "random.trust_cpu=on/off". ++ Initialize the RNG using random numbers supplied by the CPU's ++ RNG instructions (e.g. RDRAND), if supported and available. These ++ random numbers are never used directly, but are rather hashed into ++ the main input pool, and this happens regardless of whether or not ++ this option is enabled. Instead, this option controls whether the ++ they are credited and hence can initialize the RNG. Additionally, ++ other sources of randomness are always used, regardless of this ++ setting. Enabling this implies trusting that the CPU can supply high ++ quality and non-backdoored random numbers. ++ ++ Say Y here unless you have reason to mistrust your CPU or believe ++ its RNG facilities may be faulty. This may also be configured at ++ boot time with "random.trust_cpu=on/off". + + config RANDOM_TRUST_BOOTLOADER +- bool "Trust the bootloader to initialize Linux's CRNG" +- help +- Some bootloaders can provide entropy to increase the kernel's initial +- device randomness. Say Y here to assume the entropy provided by the +- booloader is trustworthy so it will be added to the kernel's entropy +- pool. Otherwise, say N here so it will be regarded as device input that +- only mixes the entropy pool. This can also be configured at boot with +- "random.trust_bootloader=on/off". ++ bool "Initialize RNG using bootloader-supplied seed" ++ default y ++ help ++ Initialize the RNG using a seed supplied by the bootloader or boot ++ environment (e.g. EFI or a bootloader-generated device tree). This ++ seed is not used directly, but is rather hashed into the main input ++ pool, and this happens regardless of whether or not this option is ++ enabled. Instead, this option controls whether the seed is credited ++ and hence can initialize the RNG. Additionally, other sources of ++ randomness are always used, regardless of this setting. Enabling ++ this implies trusting that the bootloader can supply high quality and ++ non-backdoored seeds. ++ ++ Say Y here unless you have reason to mistrust your bootloader or ++ believe its RNG facilities may be faulty. This may also be configured ++ at boot time with "random.trust_bootloader=on/off". + + endmenu +-- +2.35.1 + diff --git a/queue-5.18/scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch b/queue-5.18/scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch new file mode 100644 index 00000000000..51ad7854d89 --- /dev/null +++ b/queue-5.18/scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch @@ -0,0 +1,49 @@ +From 630639873dde977d90b5b8f1df0984df2ebf7f45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 May 2022 23:34:53 +0800 +Subject: scsi: ipr: Fix missing/incorrect resource cleanup in error case + +From: Chengguang Xu + +[ Upstream commit d64c491911322af1dcada98e5b9ee0d87e8c8fee ] + +Fix missing resource cleanup (when '(--i) == 0') for error case in +ipr_alloc_mem() and skip incorrect resource cleanup (when '(--i) == 0') for +error case in ipr_request_other_msi_irqs() because variable i started from +1. + +Link: https://lore.kernel.org/r/20220529153456.4183738-4-cgxu519@mykernel.net +Reviewed-by: Dan Carpenter +Acked-by: Brian King +Signed-off-by: Chengguang Xu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 104bee9b3a9d..00593d8953f1 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -9795,7 +9795,7 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg) + GFP_KERNEL); + + if (!ioa_cfg->hrrq[i].host_rrq) { +- while (--i > 0) ++ while (--i >= 0) + dma_free_coherent(&pdev->dev, + sizeof(u32) * ioa_cfg->hrrq[i].size, + ioa_cfg->hrrq[i].host_rrq, +@@ -10068,7 +10068,7 @@ static int ipr_request_other_msi_irqs(struct ipr_ioa_cfg *ioa_cfg, + ioa_cfg->vectors_info[i].desc, + &ioa_cfg->hrrq[i]); + if (rc) { +- while (--i >= 0) ++ while (--i > 0) + free_irq(pci_irq_vector(pdev, i), + &ioa_cfg->hrrq[i]); + return rc; +-- +2.35.1 + diff --git a/queue-5.18/scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch b/queue-5.18/scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch new file mode 100644 index 00000000000..45ad32ce893 --- /dev/null +++ b/queue-5.18/scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch @@ -0,0 +1,74 @@ +From d95f2b3d244295d3cf08ffadb4b4cd71d721f46d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 10:43:28 -0700 +Subject: scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd + completion + +From: James Smart + +[ Upstream commit 2e7e9c0c1ec05f18d320ecc8a31eec59d2af1af9 ] + +NVMe Asynchronous Event Request commands have no command timeout value per +specifications. + +Set WQE option to allow a reduced FLUSH polling rate for I/O error +detection specifically for nvme_admin_async_event commands. + +Link: https://lore.kernel.org/r/20220603174329.63777-9-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_hw4.h | 3 +++ + drivers/scsi/lpfc/lpfc_nvme.c | 11 +++++++++-- + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h +index 02e230ed6280..e7daef550095 100644 +--- a/drivers/scsi/lpfc/lpfc_hw4.h ++++ b/drivers/scsi/lpfc/lpfc_hw4.h +@@ -4488,6 +4488,9 @@ struct wqe_common { + #define wqe_sup_SHIFT 6 + #define wqe_sup_MASK 0x00000001 + #define wqe_sup_WORD word11 ++#define wqe_ffrq_SHIFT 6 ++#define wqe_ffrq_MASK 0x00000001 ++#define wqe_ffrq_WORD word11 + #define wqe_wqec_SHIFT 7 + #define wqe_wqec_MASK 0x00000001 + #define wqe_wqec_WORD word11 +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index d3a542466e98..49f44d9d04ea 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -1194,7 +1194,8 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport, + { + struct lpfc_hba *phba = vport->phba; + struct nvmefc_fcp_req *nCmd = lpfc_ncmd->nvmeCmd; +- struct lpfc_iocbq *pwqeq = &(lpfc_ncmd->cur_iocbq); ++ struct nvme_common_command *sqe; ++ struct lpfc_iocbq *pwqeq = &lpfc_ncmd->cur_iocbq; + union lpfc_wqe128 *wqe = &pwqeq->wqe; + uint32_t req_len; + +@@ -1251,8 +1252,14 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport, + cstat->control_requests++; + } + +- if (pnode->nlp_nvme_info & NLP_NVME_NSLER) ++ if (pnode->nlp_nvme_info & NLP_NVME_NSLER) { + bf_set(wqe_erp, &wqe->generic.wqe_com, 1); ++ sqe = &((struct nvme_fc_cmd_iu *) ++ nCmd->cmdaddr)->sqe.common; ++ if (sqe->opcode == nvme_admin_async_event) ++ bf_set(wqe_ffrq, &wqe->generic.wqe_com, 1); ++ } ++ + /* + * Finish initializing those WQE fields that are independent + * of the nvme_cmnd request_buffer +-- +2.35.1 + diff --git a/queue-5.18/scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch b/queue-5.18/scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch new file mode 100644 index 00000000000..fbbc117b3e6 --- /dev/null +++ b/queue-5.18/scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch @@ -0,0 +1,50 @@ +From 4973755d952afb1f7add26adf8c852ea9fd28d75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 10:43:26 -0700 +Subject: scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT + topology + +From: James Smart + +[ Upstream commit 336d63615466b4c06b9401c987813fd19bdde39b ] + +After issuing a LIP, a specific target vendor does not ACC the FLOGI that +lpfc sends. However, it does send its own FLOGI that lpfc ACCs. The +target then establishes the port IDs by sending a PLOGI. lpfc PLOGI_ACCs +and starts the RPI registration for DID 0x000001. The target then sends a +LOGO to the fabric DID. lpfc is currently treating the LOGO from the +fabric DID as a link down and cleans up all the ndlps. The ndlp for DID +0x000001 is put back into NPR and discovery stops, leaving the port in +stuck in bypassed mode. + +Change lpfc behavior such that if a LOGO is received for the fabric DID in +PT2PT topology skip the lpfc_linkdown_port() routine and just move the +fabric DID back to NPR. + +Link: https://lore.kernel.org/r/20220603174329.63777-7-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nportdisc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index 4b065c51ee1b..f5de88877ffe 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -835,7 +835,8 @@ lpfc_rcv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + lpfc_nvmet_invalidate_host(phba, ndlp); + + if (ndlp->nlp_DID == Fabric_DID) { +- if (vport->port_state <= LPFC_FDISC) ++ if (vport->port_state <= LPFC_FDISC || ++ vport->fc_flag & FC_PT2PT) + goto out; + lpfc_linkdown_port(vport); + spin_lock_irq(shost->host_lock); +-- +2.35.1 + diff --git a/queue-5.18/scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch b/queue-5.18/scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch new file mode 100644 index 00000000000..9a919d1e4b1 --- /dev/null +++ b/queue-5.18/scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch @@ -0,0 +1,78 @@ +From 69f74897ffe40da326e41d93294f726e69ba1cf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 10:43:25 -0700 +Subject: scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted + +From: James Smart + +[ Upstream commit b1b3440f437b75fb2a9b0cfe58df461e40eca474 ] + +A use-after-free crash can occur after an ELS LOGO is aborted. + +Specifically, a nodelist structure is freed and then +ndlp->vport->cfg_log_verbose is dereferenced in lpfc_nlp_get() when the +discovery state machine is mistakenly called a second time with +NLP_EVT_DEVICE_RM argument. + +Rework lpfc_cmpl_els_logo() to prevent the duplicate calls to release a +nodelist structure. + +Link: https://lore.kernel.org/r/20220603174329.63777-6-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 892b3da1ba45..9e3899580039 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -3035,18 +3035,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + spin_unlock_irq(&ndlp->lock); + lpfc_disc_state_machine(vport, ndlp, cmdiocb, + NLP_EVT_DEVICE_RM); +- lpfc_els_free_iocb(phba, cmdiocb); +- lpfc_nlp_put(ndlp); +- +- /* Presume the node was released. */ +- return; ++ goto out_rsrc_free; + } + + out: +- /* Driver is done with the IO. */ +- lpfc_els_free_iocb(phba, cmdiocb); +- lpfc_nlp_put(ndlp); +- + /* At this point, the LOGO processing is complete. NOTE: For a + * pt2pt topology, we are assuming the NPortID will only change + * on link up processing. For a LOGO / PLOGI initiated by the +@@ -3073,6 +3065,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + ndlp->nlp_DID, ulp_status, + ulp_word4, tmo, + vport->num_disc_nodes); ++ ++ lpfc_els_free_iocb(phba, cmdiocb); ++ lpfc_nlp_put(ndlp); ++ + lpfc_disc_start(vport); + return; + } +@@ -3089,6 +3085,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + lpfc_disc_state_machine(vport, ndlp, cmdiocb, + NLP_EVT_DEVICE_RM); + } ++out_rsrc_free: ++ /* Driver is done with the I/O. */ ++ lpfc_els_free_iocb(phba, cmdiocb); ++ lpfc_nlp_put(ndlp); + } + + /** +-- +2.35.1 + diff --git a/queue-5.18/scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch b/queue-5.18/scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch new file mode 100644 index 00000000000..c7aa8353e5c --- /dev/null +++ b/queue-5.18/scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch @@ -0,0 +1,94 @@ +From 66e7fc99bd5241ab34529f703138f53c371acd3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 22:09:27 +0200 +Subject: scsi: mpt3sas: Fix out-of-bounds compiler warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Helge Deller + +[ Upstream commit 120f1d95efb1cdb6fe023c84e38ba06d8f78cd03 ] + +I'm facing this warning when building for the parisc64 architecture: + +drivers/scsi/mpt3sas/mpt3sas_base.c: In function ‘_base_make_ioc_operational’: +drivers/scsi/mpt3sas/mpt3sas_base.c:5396:40: warning: array subscript ‘Mpi2SasIOUnitPage1_t {aka struct _MPI2_CONFIG_PAGE_SASIOUNIT_1}[0]’ is partly outside array bounds of ‘unsigned char[20]’ [-Warray-bounds] + 5396 | (le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth)) ? +drivers/scsi/mpt3sas/mpt3sas_base.c:5382:26: note: referencing an object of size 20 allocated by ‘kzalloc’ + 5382 | sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); + | ^~~~~~~~~~~~~~~~~~~~~~~ + +The problem is, that only 20 bytes are allocated with kmalloc(), which is +sufficient to hold the bytes which are needed. Nevertheless, gcc complains +because the whole Mpi2SasIOUnitPage1_t struct is 32 bytes in size and thus +doesn't fit into those 20 bytes. + +This patch simply allocates all 32 bytes (instead of 20) and thus avoids +the warning. There is no functional change introduced by this patch. + +While touching the code I cleaned up to calculation of max_wideport_qd, +max_narrowport_qd and max_sata_qd to make it easier readable. + +Test successfully tested on a HP C8000 PA-RISC workstation with 64-bit +kernel. + +Link: https://lore.kernel.org/r/YpZ197iZdDZSCzrT@p100 +Signed-off-by: Helge Deller +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 538d2c0cd971..aa142052ebe4 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -5368,6 +5368,7 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc) + Mpi2ConfigReply_t mpi_reply; + Mpi2SasIOUnitPage1_t *sas_iounit_pg1 = NULL; + Mpi26PCIeIOUnitPage1_t pcie_iounit_pg1; ++ u16 depth; + int sz; + int rc = 0; + +@@ -5379,7 +5380,7 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc) + goto out; + /* sas iounit page 1 */ + sz = offsetof(Mpi2SasIOUnitPage1_t, PhyData); +- sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); ++ sas_iounit_pg1 = kzalloc(sizeof(Mpi2SasIOUnitPage1_t), GFP_KERNEL); + if (!sas_iounit_pg1) { + pr_err("%s: failure at %s:%d/%s()!\n", + ioc->name, __FILE__, __LINE__, __func__); +@@ -5392,16 +5393,16 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc) + ioc->name, __FILE__, __LINE__, __func__); + goto out; + } +- ioc->max_wideport_qd = +- (le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth)) ? +- le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth) : +- MPT3SAS_SAS_QUEUE_DEPTH; +- ioc->max_narrowport_qd = +- (le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth)) ? +- le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth) : +- MPT3SAS_SAS_QUEUE_DEPTH; +- ioc->max_sata_qd = (sas_iounit_pg1->SATAMaxQDepth) ? +- sas_iounit_pg1->SATAMaxQDepth : MPT3SAS_SATA_QUEUE_DEPTH; ++ ++ depth = le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth); ++ ioc->max_wideport_qd = (depth ? depth : MPT3SAS_SAS_QUEUE_DEPTH); ++ ++ depth = le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth); ++ ioc->max_narrowport_qd = (depth ? depth : MPT3SAS_SAS_QUEUE_DEPTH); ++ ++ depth = sas_iounit_pg1->SATAMaxQDepth; ++ ioc->max_sata_qd = (depth ? depth : MPT3SAS_SATA_QUEUE_DEPTH); ++ + /* pcie iounit page 1 */ + rc = mpt3sas_config_get_pcie_iounit_pg1(ioc, &mpi_reply, + &pcie_iounit_pg1, sizeof(Mpi26PCIeIOUnitPage1_t)); +-- +2.35.1 + diff --git a/queue-5.18/scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch b/queue-5.18/scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch new file mode 100644 index 00000000000..0917c40764e --- /dev/null +++ b/queue-5.18/scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch @@ -0,0 +1,37 @@ +From 87b76a6e09176d96f96f049351bf2a1d55fad646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 May 2022 23:34:55 +0800 +Subject: scsi: pmcraid: Fix missing resource cleanup in error case + +From: Chengguang Xu + +[ Upstream commit ec1e8adcbdf661c57c395bca342945f4f815add7 ] + +Fix missing resource cleanup (when '(--i) == 0') for error case in +pmcraid_register_interrupt_handler(). + +Link: https://lore.kernel.org/r/20220529153456.4183738-6-cgxu519@mykernel.net +Reviewed-by: Dan Carpenter +Signed-off-by: Chengguang Xu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pmcraid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c +index fd674ed1febe..6d94837c9049 100644 +--- a/drivers/scsi/pmcraid.c ++++ b/drivers/scsi/pmcraid.c +@@ -4031,7 +4031,7 @@ pmcraid_register_interrupt_handler(struct pmcraid_instance *pinstance) + return 0; + + out_unwind: +- while (--i > 0) ++ while (--i >= 0) + free_irq(pci_irq_vector(pdev, i), &pinstance->hrrq_vector[i]); + pci_free_irq_vectors(pdev); + return rc; +-- +2.35.1 + diff --git a/queue-5.18/scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch b/queue-5.18/scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch new file mode 100644 index 00000000000..cd886dd50ed --- /dev/null +++ b/queue-5.18/scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch @@ -0,0 +1,40 @@ +From e35f1e120551929b2070a02591e9c30df9de4ed0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 08:57:00 +0000 +Subject: scsi: vmw_pvscsi: Expand vcpuHint to 16 bits + +From: Wentao Wang + +[ Upstream commit cf71d59c2eceadfcde0fb52e237990a0909880d7 ] + +vcpuHint has been expanded to 16 bit on host to enable routing to more +CPUs. Guest side should align with the change. This change has been tested +with hosts with 8-bit and 16-bit vcpuHint, on both platforms host side can +get correct value. + +Link: https://lore.kernel.org/r/EF35F4D5-5DCC-42C5-BCC4-29DF1729B24C@vmware.com +Signed-off-by: Wentao Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/vmw_pvscsi.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h +index 51a82f7803d3..9d16cf925483 100644 +--- a/drivers/scsi/vmw_pvscsi.h ++++ b/drivers/scsi/vmw_pvscsi.h +@@ -331,8 +331,8 @@ struct PVSCSIRingReqDesc { + u8 tag; + u8 bus; + u8 target; +- u8 vcpuHint; +- u8 unused[59]; ++ u16 vcpuHint; ++ u8 unused[58]; + } __packed; + + /* +-- +2.35.1 + diff --git a/queue-5.18/series b/queue-5.18/series index 653fd85c485..da017fc5c0c 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -2,3 +2,50 @@ revert-drm-amd-display-fix-dcn3-b0-dp-alt-mapping.patch arm64-dts-imx8mm-beacon-enable-rts-cts-on-uart3.patch arm64-dts-imx8mn-beacon-enable-rts-cts-on-uart3.patch io_uring-reinstate-the-inflight-tracking.patch +powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch +asoc-nau8822-add-operation-for-internal-pll-off-and-.patch +asoc-qcom-lpass-platform-update-vma-access-permissio.patch +drm-amd-display-read-golden-settings-table-from-vbio.patch +drm-amdgpu-resolve-ras-gfx-error-count-issue-after-c.patch +drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch +dma-debug-make-things-less-spammy-under-memory-press.patch +asoc-intel-cirrus-common-fix-incorrect-channel-mappi.patch +asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch +asoc-cs35l36-update-digital-volume-tlv.patch +asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch +asoc-cs42l52-correct-tlv-for-bypass-volume.patch +asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch +asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch +drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch +ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch +quota-prevent-memory-allocation-recursion-while-hold.patch +asoc-wm8962-fix-suspend-while-playing-music.patch +asoc-es8328-fix-event-generation-for-deemphasis-cont.patch +asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch +alsa-hda-mtl-add-hd-audio-pci-id-and-hdmi-codec-vend.patch +input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch +scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch +scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch +scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch +scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch +scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch +scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch +scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch +alsa-hda-realtek-add-hw8326-support.patch +virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch +nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch +ipv6-fix-signed-integer-overflow-in-__ip6_append_dat.patch +ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch +net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch +gcc-12-disable-wdangling-pointer-warning-for-now.patch +mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch +gcc-12-disable-warray-bounds-universally-for-now.patch +netfs-gcc-12-temporarily-disable-wattribute-warning-.patch +mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch +random-credit-cpu-and-bootloader-seeds-by-default.patch +gpio-dwapb-don-t-print-error-on-eprobe_defer.patch +platform-x86-intel-fix-pmt_crashlog-array-reference.patch +platform-x86-intel-pmc-support-intel-raptorlake-p.patch +platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch +platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch +platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch diff --git a/queue-5.18/virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch b/queue-5.18/virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch new file mode 100644 index 00000000000..9aa6d90c8eb --- /dev/null +++ b/queue-5.18/virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch @@ -0,0 +1,37 @@ +From db5d7a2e9a3a8d70c868ebdaaebf2222fff8696d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 08:55:42 +0800 +Subject: virtio-mmio: fix missing put_device() when vm_cmdline_parent + registration failed + +From: chengkaitao + +[ Upstream commit a58a7f97ba11391d2d0d408e0b24f38d86ae748e ] + +The reference must be released when device_register(&vm_cmdline_parent) +failed. Add the corresponding 'put_device()' in the error handling path. + +Signed-off-by: chengkaitao +Message-Id: <20220602005542.16489-1-chengkaitao@didiglobal.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_mmio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c +index 56128b9c46eb..1dd396d4bebb 100644 +--- a/drivers/virtio/virtio_mmio.c ++++ b/drivers/virtio/virtio_mmio.c +@@ -688,6 +688,7 @@ static int vm_cmdline_set(const char *device, + if (!vm_cmdline_parent_registered) { + err = device_register(&vm_cmdline_parent); + if (err) { ++ put_device(&vm_cmdline_parent); + pr_err("Failed to register parent device!\n"); + return err; + } +-- +2.35.1 +