From: Sasha Levin Date: Thu, 9 May 2024 17:27:48 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.19.314~103 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=88161e3afad2f75749b357c46464dde9a6d3f501;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/9p-explicitly-deny-setlease-attempts.patch b/queue-5.4/9p-explicitly-deny-setlease-attempts.patch new file mode 100644 index 00000000000..ba54b49d80c --- /dev/null +++ b/queue-5.4/9p-explicitly-deny-setlease-attempts.patch @@ -0,0 +1,42 @@ +From d7edc23082ce62fdd5057d5db4dcf1c596b389be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Mar 2024 12:34:45 -0400 +Subject: 9p: explicitly deny setlease attempts + +From: Jeff Layton + +[ Upstream commit 7a84602297d36617dbdadeba55a2567031e5165b ] + +9p is a remote network protocol, and it doesn't support asynchronous +notifications from the server. Ensure that we don't hand out any leases +since we can't guarantee they'll be broken when a file's contents +change. + +Signed-off-by: Jeff Layton +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +--- + fs/9p/vfs_file.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c +index ee9cabac12041..14d6cb0316212 100644 +--- a/fs/9p/vfs_file.c ++++ b/fs/9p/vfs_file.c +@@ -676,6 +676,7 @@ const struct file_operations v9fs_file_operations = { + .lock = v9fs_file_lock, + .mmap = generic_file_readonly_mmap, + .fsync = v9fs_file_fsync, ++ .setlease = simple_nosetlease, + }; + + const struct file_operations v9fs_file_operations_dotl = { +@@ -711,4 +712,5 @@ const struct file_operations v9fs_mmap_file_operations_dotl = { + .flock = v9fs_file_flock_dotl, + .mmap = v9fs_mmap_file_mmap, + .fsync = v9fs_file_fsync_dotl, ++ .setlease = simple_nosetlease, + }; +-- +2.43.0 + diff --git a/queue-5.4/alsa-line6-zero-initialize-message-buffers.patch b/queue-5.4/alsa-line6-zero-initialize-message-buffers.patch new file mode 100644 index 00000000000..b77a1d5cdb7 --- /dev/null +++ b/queue-5.4/alsa-line6-zero-initialize-message-buffers.patch @@ -0,0 +1,57 @@ +From 9f12510524a9176bdfe1bd357d3358f744638d75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2024 08:36:25 +0200 +Subject: ALSA: line6: Zero-initialize message buffers + +From: Takashi Iwai + +[ Upstream commit c4e51e424e2c772ce1836912a8b0b87cd61bc9d5 ] + +For shutting up spurious KMSAN uninit-value warnings, just replace +kmalloc() calls with kzalloc() for the buffers used for +communications. There should be no real issue with the original code, +but it's still better to cover. + +Reported-by: syzbot+7fb05ccf7b3d2f9617b3@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/r/00000000000084b18706150bcca5@google.com +Message-ID: <20240402063628.26609-1-tiwai@suse.de> +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/line6/driver.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index 22104cb84b1ca..efa8fb59d3ad2 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -201,7 +201,7 @@ int line6_send_raw_message_async(struct usb_line6 *line6, const char *buffer, + struct urb *urb; + + /* create message: */ +- msg = kmalloc(sizeof(struct message), GFP_ATOMIC); ++ msg = kzalloc(sizeof(struct message), GFP_ATOMIC); + if (msg == NULL) + return -ENOMEM; + +@@ -679,7 +679,7 @@ static int line6_init_cap_control(struct usb_line6 *line6) + int ret; + + /* initialize USB buffers: */ +- line6->buffer_listen = kmalloc(LINE6_BUFSIZE_LISTEN, GFP_KERNEL); ++ line6->buffer_listen = kzalloc(LINE6_BUFSIZE_LISTEN, GFP_KERNEL); + if (!line6->buffer_listen) + return -ENOMEM; + +@@ -688,7 +688,7 @@ static int line6_init_cap_control(struct usb_line6 *line6) + return -ENOMEM; + + if (line6->properties->capabilities & LINE6_CAP_CONTROL_MIDI) { +- line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); ++ line6->buffer_message = kzalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); + if (!line6->buffer_message) + return -ENOMEM; + +-- +2.43.0 + diff --git a/queue-5.4/asoc-meson-axg-card-fix-nonatomic-links.patch b/queue-5.4/asoc-meson-axg-card-fix-nonatomic-links.patch new file mode 100644 index 00000000000..96084a31106 --- /dev/null +++ b/queue-5.4/asoc-meson-axg-card-fix-nonatomic-links.patch @@ -0,0 +1,57 @@ +From 103f41e5e68957d251c876b0a90aa710a968b369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 17:57:25 +0200 +Subject: ASoC: meson: axg-card: Fix nonatomic links + +From: Neil Armstrong + +[ Upstream commit 0c9b152c72e53016e96593bdbb8cffe2176694b9 ] + +This commit e138233e56e9829e65b6293887063a1a3ccb2d68 causes the +following system crash when using audio on G12A/G12B & SM1 systems: + + BUG: sleeping function called from invalid context at kernel/locking/mutex.c:282 + in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/0 + preempt_count: 10001, expected: 0 + RCU nest depth: 0, expected: 0 + Preemption disabled at: + schedule_preempt_disabled+0x20/0x2c + + mutex_lock+0x24/0x60 + _snd_pcm_stream_lock_irqsave+0x20/0x3c + snd_pcm_period_elapsed+0x24/0xa4 + axg_fifo_pcm_irq_block+0x64/0xdc + __handle_irq_event_percpu+0x104/0x264 + handle_irq_event+0x48/0xb4 + ... + start_kernel+0x3f0/0x484 + __primary_switched+0xc0/0xc8 + +Revert this commit until the crash is fixed. + +Fixes: e138233e56e9829e65b6 ("ASoC: meson: axg-card: make links nonatomic") +Reported-by: Dmitry Shmidt +Signed-off-by: Neil Armstrong +Acked-by: Jerome Brunet +Link: https://lore.kernel.org/r/20220421155725.2589089-2-narmstrong@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/axg-card.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c +index 36a004192b562..7126344017fa6 100644 +--- a/sound/soc/meson/axg-card.c ++++ b/sound/soc/meson/axg-card.c +@@ -568,7 +568,6 @@ static int axg_card_add_link(struct snd_soc_card *card, struct device_node *np, + + dai_link->cpus = cpu; + dai_link->num_cpus = 1; +- dai_link->nonatomic = true; + + ret = axg_card_parse_dai(card, np, &dai_link->cpus->of_node, + &dai_link->cpus->dai_name); +-- +2.43.0 + diff --git a/queue-5.4/asoc-meson-axg-tdm-interface-fix-formatters-in-trigg.patch b/queue-5.4/asoc-meson-axg-tdm-interface-fix-formatters-in-trigg.patch new file mode 100644 index 00000000000..f253965c03f --- /dev/null +++ b/queue-5.4/asoc-meson-axg-tdm-interface-fix-formatters-in-trigg.patch @@ -0,0 +1,76 @@ +From 90b64d88b3ffa59ecf6e28b96437ab3421c05f6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 17:57:24 +0200 +Subject: ASoC: meson: axg-tdm-interface: Fix formatters in trigger" + +From: Neil Armstrong + +[ Upstream commit c26830b6c5c534d273ce007eb33d5a2d2ad4e969 ] + +This reverts commit bf5e4887eeddb48480568466536aa08ec7f179a5 because +the following and required commit e138233e56e9829e65b6293887063a1a3ccb2d68 +causes the following system crash when using audio: + BUG: sleeping function called from invalid context at kernel/locking/mutex.c:282 + +Fixes: bf5e4887eeddb4848056846 ("ASoC: meson: axg-tdm-interface: manage formatters in trigger") +Reported-by: Dmitry Shmidt +Signed-off-by: Neil Armstrong +Acked-by: Jerome Brunet +Link: https://lore.kernel.org/r/20220421155725.2589089-1-narmstrong@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/axg-tdm-interface.c | 26 +++++--------------------- + 1 file changed, 5 insertions(+), 21 deletions(-) + +diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c +index dc2fe9e2baadd..34aff050caf25 100644 +--- a/sound/soc/meson/axg-tdm-interface.c ++++ b/sound/soc/meson/axg-tdm-interface.c +@@ -351,29 +351,13 @@ static int axg_tdm_iface_hw_free(struct snd_pcm_substream *substream, + return 0; + } + +-static int axg_tdm_iface_trigger(struct snd_pcm_substream *substream, +- int cmd, ++static int axg_tdm_iface_prepare(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { +- struct axg_tdm_stream *ts = +- snd_soc_dai_get_dma_data(dai, substream); +- +- switch (cmd) { +- case SNDRV_PCM_TRIGGER_START: +- case SNDRV_PCM_TRIGGER_RESUME: +- case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: +- axg_tdm_stream_start(ts); +- break; +- case SNDRV_PCM_TRIGGER_SUSPEND: +- case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +- case SNDRV_PCM_TRIGGER_STOP: +- axg_tdm_stream_stop(ts); +- break; +- default: +- return -EINVAL; +- } ++ struct axg_tdm_stream *ts = snd_soc_dai_get_dma_data(dai, substream); + +- return 0; ++ /* Force all attached formatters to update */ ++ return axg_tdm_stream_reset(ts); + } + + static int axg_tdm_iface_remove_dai(struct snd_soc_dai *dai) +@@ -413,8 +397,8 @@ static const struct snd_soc_dai_ops axg_tdm_iface_ops = { + .set_fmt = axg_tdm_iface_set_fmt, + .startup = axg_tdm_iface_startup, + .hw_params = axg_tdm_iface_hw_params, ++ .prepare = axg_tdm_iface_prepare, + .hw_free = axg_tdm_iface_hw_free, +- .trigger = axg_tdm_iface_trigger, + }; + + /* TDM Backend DAIs */ +-- +2.43.0 + diff --git a/queue-5.4/ata-sata_gemini-check-clk_enable-result.patch b/queue-5.4/ata-sata_gemini-check-clk_enable-result.patch new file mode 100644 index 00000000000..eaf280d4204 --- /dev/null +++ b/queue-5.4/ata-sata_gemini-check-clk_enable-result.patch @@ -0,0 +1,38 @@ +From 8b895403a8c81e7d6970dc59b392faa5d0277745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 04:33:49 +0000 +Subject: ata: sata_gemini: Check clk_enable() result + +From: Chen Ni + +[ Upstream commit e85006ae7430aef780cc4f0849692e266a102ec0 ] + +The call to clk_enable() in gemini_sata_start_bridge() can fail. +Add a check to detect such failure. + +Signed-off-by: Chen Ni +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_gemini.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/sata_gemini.c b/drivers/ata/sata_gemini.c +index 6fd54e968d10a..1564472fd5d50 100644 +--- a/drivers/ata/sata_gemini.c ++++ b/drivers/ata/sata_gemini.c +@@ -201,7 +201,10 @@ int gemini_sata_start_bridge(struct sata_gemini *sg, unsigned int bridge) + pclk = sg->sata0_pclk; + else + pclk = sg->sata1_pclk; +- clk_enable(pclk); ++ ret = clk_enable(pclk); ++ if (ret) ++ return ret; ++ + msleep(10); + + /* Do not keep clocking a bridge that is not online */ +-- +2.43.0 + diff --git a/queue-5.4/btrfs-always-clear-pertrans-metadata-during-commit.patch b/queue-5.4/btrfs-always-clear-pertrans-metadata-during-commit.patch new file mode 100644 index 00000000000..499301514ce --- /dev/null +++ b/queue-5.4/btrfs-always-clear-pertrans-metadata-during-commit.patch @@ -0,0 +1,44 @@ +From 8d605ca3e957bdc1481bf89152687067bb94263f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 12:01:28 -0700 +Subject: btrfs: always clear PERTRANS metadata during commit + +From: Boris Burkov + +[ Upstream commit 6e68de0bb0ed59e0554a0c15ede7308c47351e2d ] + +It is possible to clear a root's IN_TRANS tag from the radix tree, but +not clear its PERTRANS, if there is some error in between. Eliminate +that possibility by moving the free up to where we clear the tag. + +Reviewed-by: Qu Wenruo +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/transaction.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 89ffc02554069..1d25bf0c55ccf 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1226,6 +1226,7 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans) + radix_tree_tag_clear(&fs_info->fs_roots_radix, + (unsigned long)root->root_key.objectid, + BTRFS_ROOT_TRANS_TAG); ++ btrfs_qgroup_free_meta_all_pertrans(root); + spin_unlock(&fs_info->fs_roots_radix_lock); + + btrfs_free_log(trans, root); +@@ -1250,7 +1251,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans) + if (ret2) + return ret2; + spin_lock(&fs_info->fs_roots_radix_lock); +- btrfs_qgroup_free_meta_all_pertrans(root); + } + } + spin_unlock(&fs_info->fs_roots_radix_lock); +-- +2.43.0 + diff --git a/queue-5.4/btrfs-make-btrfs_clear_delalloc_extent-free-delalloc.patch b/queue-5.4/btrfs-make-btrfs_clear_delalloc_extent-free-delalloc.patch new file mode 100644 index 00000000000..8181876ae20 --- /dev/null +++ b/queue-5.4/btrfs-make-btrfs_clear_delalloc_extent-free-delalloc.patch @@ -0,0 +1,41 @@ +From b5ac8b082b03da7ac4c820e4feac15c5fb3acbf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2024 11:55:22 -0700 +Subject: btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve + +From: Boris Burkov + +[ Upstream commit 3c6f0c5ecc8910d4ffb0dfe85609ebc0c91c8f34 ] + +Currently, this call site in btrfs_clear_delalloc_extent() only converts +the reservation. We are marking it not delalloc, so I don't think it +makes sense to keep the rsv around. This is a path where we are not +sure to join a transaction, so it leads to incorrect free-ing during +umount. + +Helps with the pass rate of generic/269 and generic/475. + +Reviewed-by: Qu Wenruo +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index c89e85a7da7d4..2c86be3fc25cd 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2051,7 +2051,7 @@ void btrfs_clear_delalloc_extent(struct inode *vfs_inode, + */ + if (*bits & EXTENT_CLEAR_META_RESV && + root != fs_info->tree_root) +- btrfs_delalloc_release_metadata(inode, len, false); ++ btrfs_delalloc_release_metadata(inode, len, true); + + /* For sanity tests. */ + if (btrfs_is_testing(fs_info)) +-- +2.43.0 + diff --git a/queue-5.4/clk-don-t-hold-prepare_lock-when-calling-kref_put.patch b/queue-5.4/clk-don-t-hold-prepare_lock-when-calling-kref_put.patch new file mode 100644 index 00000000000..3481b380e1e --- /dev/null +++ b/queue-5.4/clk-don-t-hold-prepare_lock-when-calling-kref_put.patch @@ -0,0 +1,71 @@ +From 746a431ec3a7f1ee104a7538082fc15d1a4e96b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 11:41:56 -0700 +Subject: clk: Don't hold prepare_lock when calling kref_put() + +From: Stephen Boyd + +[ Upstream commit 6f63af7511e7058f3fa4ad5b8102210741c9f947 ] + +We don't need to hold the prepare_lock when dropping a ref on a struct +clk_core. The release function is only freeing memory and any code with +a pointer reference has already unlinked anything pointing to the +clk_core. This reduces the holding area of the prepare_lock a bit. + +Note that we also don't call free_clk() with the prepare_lock held. +There isn't any reason to do that. + +Reviewed-by: Douglas Anderson +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20240325184204.745706-3-sboyd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 59a77587da47b..56be3f97c265a 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -4061,7 +4061,8 @@ void clk_unregister(struct clk *clk) + if (clk->core->ops == &clk_nodrv_ops) { + pr_err("%s: unregistered clock: %s\n", __func__, + clk->core->name); +- goto unlock; ++ clk_prepare_unlock(); ++ return; + } + /* + * Assign empty clock ops for consumers that might still hold +@@ -4092,11 +4093,10 @@ void clk_unregister(struct clk *clk) + if (clk->core->protect_count) + pr_warn("%s: unregistering protected clock: %s\n", + __func__, clk->core->name); ++ clk_prepare_unlock(); + + kref_put(&clk->core->ref, __clk_release); + free_clk(clk); +-unlock: +- clk_prepare_unlock(); + } + EXPORT_SYMBOL_GPL(clk_unregister); + +@@ -4258,13 +4258,11 @@ void __clk_put(struct clk *clk) + clk->max_rate < clk->core->req_rate) + clk_core_set_rate_nolock(clk->core, clk->core->req_rate); + +- owner = clk->core->owner; +- kref_put(&clk->core->ref, __clk_release); +- + clk_prepare_unlock(); + ++ owner = clk->core->owner; ++ kref_put(&clk->core->ref, __clk_release); + module_put(owner); +- + free_clk(clk); + } + +-- +2.43.0 + diff --git a/queue-5.4/firewire-ohci-mask-bus-reset-interrupts-between-isr-.patch b/queue-5.4/firewire-ohci-mask-bus-reset-interrupts-between-isr-.patch new file mode 100644 index 00000000000..3fc694da8dd --- /dev/null +++ b/queue-5.4/firewire-ohci-mask-bus-reset-interrupts-between-isr-.patch @@ -0,0 +1,87 @@ +From 76f0dd9bf79af92647068f8e5caa28a1085af55c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2024 07:38:41 +0900 +Subject: firewire: ohci: mask bus reset interrupts between ISR and bottom half + +From: Adam Goldman + +[ Upstream commit 752e3c53de0fa3b7d817a83050b6699b8e9c6ec9 ] + +In the FireWire OHCI interrupt handler, if a bus reset interrupt has +occurred, mask bus reset interrupts until bus_reset_work has serviced and +cleared the interrupt. + +Normally, we always leave bus reset interrupts masked. We infer the bus +reset from the self-ID interrupt that happens shortly thereafter. A +scenario where we unmask bus reset interrupts was introduced in 2008 in +a007bb857e0b26f5d8b73c2ff90782d9c0972620: If +OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we +will unmask bus reset interrupts so we can log them. + +irq_handler logs the bus reset interrupt. However, we can't clear the bus +reset event flag in irq_handler, because we won't service the event until +later. irq_handler exits with the event flag still set. If the +corresponding interrupt is still unmasked, the first bus reset will +usually freeze the system due to irq_handler being called again each +time it exits. This freeze can be reproduced by loading firewire_ohci +with "modprobe firewire_ohci debug=-1" (to enable all debugging output). +Apparently there are also some cases where bus_reset_work will get called +soon enough to clear the event, and operation will continue normally. + +This freeze was first reported a few months after a007bb85 was committed, +but until now it was never fixed. The debug level could safely be set +to -1 through sysfs after the module was loaded, but this would be +ineffectual in logging bus reset interrupts since they were only +unmasked during initialization. + +irq_handler will now leave the event flag set but mask bus reset +interrupts, so irq_handler won't be called again and there will be no +freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will +unmask the interrupt after servicing the event, so future interrupts +will be caught as desired. + +As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be +enabled through sysfs in addition to during initial module loading. +However, when enabled through sysfs, logging of bus reset interrupts will +be effective only starting with the second bus reset, after +bus_reset_work has executed. + +Signed-off-by: Adam Goldman +Signed-off-by: Takashi Sakamoto +Signed-off-by: Sasha Levin +--- + drivers/firewire/ohci.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c +index 6603f13f5de9b..2db5448c4293a 100644 +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -2053,6 +2053,8 @@ static void bus_reset_work(struct work_struct *work) + + ohci->generation = generation; + reg_write(ohci, OHCI1394_IntEventClear, OHCI1394_busReset); ++ if (param_debug & OHCI_PARAM_DEBUG_BUSRESETS) ++ reg_write(ohci, OHCI1394_IntMaskSet, OHCI1394_busReset); + + if (ohci->quirks & QUIRK_RESET_PACKET) + ohci->request_generation = generation; +@@ -2119,12 +2121,14 @@ static irqreturn_t irq_handler(int irq, void *data) + return IRQ_NONE; + + /* +- * busReset and postedWriteErr must not be cleared yet ++ * busReset and postedWriteErr events must not be cleared yet + * (OHCI 1.1 clauses 7.2.3.2 and 13.2.8.1) + */ + reg_write(ohci, OHCI1394_IntEventClear, + event & ~(OHCI1394_busReset | OHCI1394_postedWriteErr)); + log_irqs(ohci, event); ++ if (event & OHCI1394_busReset) ++ reg_write(ohci, OHCI1394_IntMaskClear, OHCI1394_busReset); + + if (event & OHCI1394_selfIDComplete) + queue_work(selfid_workqueue, &ohci->bus_reset_work); +-- +2.43.0 + diff --git a/queue-5.4/fs-9p-drop-inodes-immediately-on-non-.l-too.patch b/queue-5.4/fs-9p-drop-inodes-immediately-on-non-.l-too.patch new file mode 100644 index 00000000000..38b0f695895 --- /dev/null +++ b/queue-5.4/fs-9p-drop-inodes-immediately-on-non-.l-too.patch @@ -0,0 +1,31 @@ +From 819b2020e92df12ec91b2631da1966f4df25eb42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 12:22:32 +0100 +Subject: fs/9p: drop inodes immediately on non-.L too + +From: Joakim Sindholt + +[ Upstream commit 7fd524b9bd1be210fe79035800f4bd78a41b349f ] + +Signed-off-by: Joakim Sindholt +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +--- + fs/9p/vfs_super.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c +index 74df32be4c6a5..46e58fdf9ba54 100644 +--- a/fs/9p/vfs_super.c ++++ b/fs/9p/vfs_super.c +@@ -335,6 +335,7 @@ static const struct super_operations v9fs_super_ops = { + .alloc_inode = v9fs_alloc_inode, + .free_inode = v9fs_free_inode, + .statfs = simple_statfs, ++ .drop_inode = v9fs_drop_inode, + .evict_inode = v9fs_evict_inode, + .show_options = v9fs_show_options, + .umount_begin = v9fs_umount_begin, +-- +2.43.0 + diff --git a/queue-5.4/fs-9p-only-translate-rwx-permissions-for-plain-9p200.patch b/queue-5.4/fs-9p-only-translate-rwx-permissions-for-plain-9p200.patch new file mode 100644 index 00000000000..4e5c86c1d29 --- /dev/null +++ b/queue-5.4/fs-9p-only-translate-rwx-permissions-for-plain-9p200.patch @@ -0,0 +1,37 @@ +From 2a1603ea573b5f3b30d4e81dc93aff52b31c4545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 12:22:31 +0100 +Subject: fs/9p: only translate RWX permissions for plain 9P2000 + +From: Joakim Sindholt + +[ Upstream commit cd25e15e57e68a6b18dc9323047fe9c68b99290b ] + +Garbage in plain 9P2000's perm bits is allowed through, which causes it +to be able to set (among others) the suid bit. This was presumably not +the intent since the unix extended bits are handled explicitly and +conditionally on .u. + +Signed-off-by: Joakim Sindholt +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +--- + fs/9p/vfs_inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c +index b82423a72f685..b1107b424bf64 100644 +--- a/fs/9p/vfs_inode.c ++++ b/fs/9p/vfs_inode.c +@@ -86,7 +86,7 @@ static int p9mode2perm(struct v9fs_session_info *v9ses, + int res; + int mode = stat->mode; + +- res = mode & S_IALLUGO; ++ res = mode & 0777; /* S_IRWXUGO */ + if (v9fs_proto_dotu(v9ses)) { + if ((mode & P9_DMSETUID) == P9_DMSETUID) + res |= S_ISUID; +-- +2.43.0 + diff --git a/queue-5.4/fs-9p-translate-o_trunc-into-otrunc.patch b/queue-5.4/fs-9p-translate-o_trunc-into-otrunc.patch new file mode 100644 index 00000000000..b1355b4dc45 --- /dev/null +++ b/queue-5.4/fs-9p-translate-o_trunc-into-otrunc.patch @@ -0,0 +1,36 @@ +From a954f3b6f1e23bc369eeac498d3f82938705cedc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Mar 2024 12:22:33 +0100 +Subject: fs/9p: translate O_TRUNC into OTRUNC + +From: Joakim Sindholt + +[ Upstream commit 87de39e70503e04ddb58965520b15eb9efa7eef3 ] + +This one hits both 9P2000 and .u as it appears v9fs has never translated +the O_TRUNC flag. + +Signed-off-by: Joakim Sindholt +Signed-off-by: Eric Van Hensbergen +Signed-off-by: Sasha Levin +--- + fs/9p/vfs_inode.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c +index b1107b424bf64..ffce168296bd3 100644 +--- a/fs/9p/vfs_inode.c ++++ b/fs/9p/vfs_inode.c +@@ -177,6 +177,9 @@ int v9fs_uflags2omode(int uflags, int extended) + break; + } + ++ if (uflags & O_TRUNC) ++ ret |= P9_OTRUNC; ++ + if (extended) { + if (uflags & O_EXCL) + ret |= P9_OEXCL; +-- +2.43.0 + diff --git a/queue-5.4/gfs2-fix-invalid-metadata-access-in-punch_hole.patch b/queue-5.4/gfs2-fix-invalid-metadata-access-in-punch_hole.patch new file mode 100644 index 00000000000..ce6e199f68c --- /dev/null +++ b/queue-5.4/gfs2-fix-invalid-metadata-access-in-punch_hole.patch @@ -0,0 +1,47 @@ +From cd5ed2753d7fc9a36179bbc49bae4b101034171a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 16:40:36 +0100 +Subject: gfs2: Fix invalid metadata access in punch_hole + +From: Andrew Price + +[ Upstream commit c95346ac918c5badf51b9a7ac58a26d3bd5bb224 ] + +In punch_hole(), when the offset lies in the final block for a given +height, there is no hole to punch, but the maximum size check fails to +detect that. Consequently, punch_hole() will try to punch a hole beyond +the end of the metadata and fail. Fix the maximum size check. + +Signed-off-by: Andrew Price +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/bmap.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 63e925aa12a75..1dc0f0bca3ab3 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1760,7 +1760,8 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) + struct buffer_head *dibh, *bh; + struct gfs2_holder rd_gh; + unsigned int bsize_shift = sdp->sd_sb.sb_bsize_shift; +- u64 lblock = (offset + (1 << bsize_shift) - 1) >> bsize_shift; ++ unsigned int bsize = 1 << bsize_shift; ++ u64 lblock = (offset + bsize - 1) >> bsize_shift; + __u16 start_list[GFS2_MAX_META_HEIGHT]; + __u16 __end_list[GFS2_MAX_META_HEIGHT], *end_list = NULL; + unsigned int start_aligned, end_aligned; +@@ -1771,7 +1772,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) + u64 prev_bnr = 0; + __be64 *start, *end; + +- if (offset >= maxsize) { ++ if (offset + bsize - 1 >= maxsize) { + /* + * The starting point lies beyond the allocated meta-data; + * there are no blocks do deallocate. +-- +2.43.0 + diff --git a/queue-5.4/gpio-crystalcove-use-enotsupp-consistently.patch b/queue-5.4/gpio-crystalcove-use-enotsupp-consistently.patch new file mode 100644 index 00000000000..c66b2396c6f --- /dev/null +++ b/queue-5.4/gpio-crystalcove-use-enotsupp-consistently.patch @@ -0,0 +1,35 @@ +From b2eaab3be7b80acc910d64c05d31bde5dedd6d14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 19:26:22 +0300 +Subject: gpio: crystalcove: Use -ENOTSUPP consistently + +From: Andy Shevchenko + +[ Upstream commit ace0ebe5c98d66889f19e0f30e2518d0c58d0e04 ] + +The GPIO library expects the drivers to return -ENOTSUPP in some +cases and not using analogue POSIX code. Make the driver to follow +this. + +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-crystalcove.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c +index 14d1f4c933b69..8b9c1833bf7d4 100644 +--- a/drivers/gpio/gpio-crystalcove.c ++++ b/drivers/gpio/gpio-crystalcove.c +@@ -91,7 +91,7 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type) + case 0x5e: + return GPIOPANELCTL; + default: +- return -EOPNOTSUPP; ++ return -ENOTSUPP; + } + } + +-- +2.43.0 + diff --git a/queue-5.4/gpio-wcove-use-enotsupp-consistently.patch b/queue-5.4/gpio-wcove-use-enotsupp-consistently.patch new file mode 100644 index 00000000000..d2499aee67a --- /dev/null +++ b/queue-5.4/gpio-wcove-use-enotsupp-consistently.patch @@ -0,0 +1,36 @@ +From 2db20dd369f79a3e3a11c69d1db5ea482cb4e110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2024 19:25:21 +0300 +Subject: gpio: wcove: Use -ENOTSUPP consistently + +From: Andy Shevchenko + +[ Upstream commit 0c3b532ad3fbf82884a2e7e83e37c7dcdd4d1d99 ] + +The GPIO library expects the drivers to return -ENOTSUPP in some +cases and not using analogue POSIX code. Make the driver to follow +this. + +Reviewed-by: Kuppuswamy Sathyanarayanan +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-wcove.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-wcove.c b/drivers/gpio/gpio-wcove.c +index 444fe9e7f04ac..79946c098271a 100644 +--- a/drivers/gpio/gpio-wcove.c ++++ b/drivers/gpio/gpio-wcove.c +@@ -102,7 +102,7 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type) + unsigned int reg; + + if (gpio >= WCOVE_GPIO_NUM) +- return -EOPNOTSUPP; ++ return -ENOTSUPP; + + if (reg_type == CTRL_IN) + reg = GPIO_IN_CTRL_BASE + gpio; +-- +2.43.0 + diff --git a/queue-5.4/gpu-host1x-do-not-setup-dma-for-virtual-devices.patch b/queue-5.4/gpu-host1x-do-not-setup-dma-for-virtual-devices.patch new file mode 100644 index 00000000000..8fab810970f --- /dev/null +++ b/queue-5.4/gpu-host1x-do-not-setup-dma-for-virtual-devices.patch @@ -0,0 +1,61 @@ +From e282276bb0f57eda2f72a378170a6a8cb297a2e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 16:49:43 +0100 +Subject: gpu: host1x: Do not setup DMA for virtual devices + +From: Thierry Reding + +[ Upstream commit 8ab58f6841b19423231c5db3378691ec80c778f8 ] + +The host1x devices are virtual compound devices and do not perform DMA +accesses themselves, so they do not need to be set up for DMA. + +Ideally we would also not need to set up DMA masks for the virtual +devices, but we currently still need those for legacy support on old +hardware. + +Tested-by: Jon Hunter +Acked-by: Jon Hunter +Signed-off-by: Thierry Reding +Link: https://patchwork.freedesktop.org/patch/msgid/20240314154943.2487549-1-thierry.reding@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/bus.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c +index fcda8621ae6f9..5a1bf59be7341 100644 +--- a/drivers/gpu/host1x/bus.c ++++ b/drivers/gpu/host1x/bus.c +@@ -335,11 +335,6 @@ static int host1x_device_uevent(struct device *dev, + return 0; + } + +-static int host1x_dma_configure(struct device *dev) +-{ +- return of_dma_configure(dev, dev->of_node, true); +-} +- + static const struct dev_pm_ops host1x_device_pm_ops = { + .suspend = pm_generic_suspend, + .resume = pm_generic_resume, +@@ -353,7 +348,6 @@ struct bus_type host1x_bus_type = { + .name = "host1x", + .match = host1x_device_match, + .uevent = host1x_device_uevent, +- .dma_configure = host1x_dma_configure, + .pm = &host1x_device_pm_ops, + }; + +@@ -442,8 +436,6 @@ static int host1x_device_add(struct host1x *host1x, + device->dev.bus = &host1x_bus_type; + device->dev.parent = host1x->dev; + +- of_dma_configure(&device->dev, host1x->dev->of_node, true); +- + device->dev.dma_parms = &device->dma_parms; + dma_set_max_seg_size(&device->dev, SZ_4M); + +-- +2.43.0 + diff --git a/queue-5.4/mips-scall-save-thread_info.syscall-unconditionally-.patch b/queue-5.4/mips-scall-save-thread_info.syscall-unconditionally-.patch new file mode 100644 index 00000000000..17088d67c6e --- /dev/null +++ b/queue-5.4/mips-scall-save-thread_info.syscall-unconditionally-.patch @@ -0,0 +1,255 @@ +From 911f47c1f4e606e9bcdb258118c88ce005d904a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2024 14:27:56 +0000 +Subject: MIPS: scall: Save thread_info.syscall unconditionally on entry + +From: Jiaxun Yang + +[ Upstream commit 4370b673ccf240bf7587b0cb8e6726a5ccaf1f17 ] + +thread_info.syscall is used by syscall_get_nr to supply syscall nr +over a thread stack frame. + +Previously, thread_info.syscall is only saved at syscall_trace_enter +when syscall tracing is enabled. However rest of the kernel code do +expect syscall_get_nr to be available without syscall tracing. The +previous design breaks collect_syscall. + +Move saving process to syscall entry to fix it. + +Reported-by: Xi Ruoyao +Link: https://github.com/util-linux/util-linux/issues/2867 +Signed-off-by: Jiaxun Yang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/ptrace.h | 2 +- + arch/mips/kernel/asm-offsets.c | 1 + + arch/mips/kernel/ptrace.c | 15 ++++++--------- + arch/mips/kernel/scall32-o32.S | 23 +++++++++++++---------- + arch/mips/kernel/scall64-n32.S | 3 ++- + arch/mips/kernel/scall64-n64.S | 3 ++- + arch/mips/kernel/scall64-o32.S | 33 +++++++++++++++++---------------- + 7 files changed, 42 insertions(+), 38 deletions(-) + +diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h +index 2849a9b65a055..ae578860f7295 100644 +--- a/arch/mips/include/asm/ptrace.h ++++ b/arch/mips/include/asm/ptrace.h +@@ -157,7 +157,7 @@ static inline long regs_return_value(struct pt_regs *regs) + #define instruction_pointer(regs) ((regs)->cp0_epc) + #define profile_pc(regs) instruction_pointer(regs) + +-extern asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall); ++extern asmlinkage long syscall_trace_enter(struct pt_regs *regs); + extern asmlinkage void syscall_trace_leave(struct pt_regs *regs); + + extern void die(const char *, struct pt_regs *) __noreturn; +diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c +index aebfda81120a1..6c5269d3aacba 100644 +--- a/arch/mips/kernel/asm-offsets.c ++++ b/arch/mips/kernel/asm-offsets.c +@@ -100,6 +100,7 @@ void output_thread_info_defines(void) + OFFSET(TI_PRE_COUNT, thread_info, preempt_count); + OFFSET(TI_ADDR_LIMIT, thread_info, addr_limit); + OFFSET(TI_REGS, thread_info, regs); ++ OFFSET(TI_SYSCALL, thread_info, syscall); + DEFINE(_THREAD_SIZE, THREAD_SIZE); + DEFINE(_THREAD_MASK, THREAD_MASK); + DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE); +diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c +index 414b6e9c900b2..cfb548fd2712c 100644 +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -1399,16 +1399,13 @@ long arch_ptrace(struct task_struct *child, long request, + * Notification of system call entry/exit + * - triggered by current->work.syscall_trace + */ +-asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall) ++asmlinkage long syscall_trace_enter(struct pt_regs *regs) + { + user_exit(); + +- current_thread_info()->syscall = syscall; +- + if (test_thread_flag(TIF_SYSCALL_TRACE)) { + if (tracehook_report_syscall_entry(regs)) + return -1; +- syscall = current_thread_info()->syscall; + } + + #ifdef CONFIG_SECCOMP +@@ -1417,7 +1414,7 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall) + struct seccomp_data sd; + unsigned long args[6]; + +- sd.nr = syscall; ++ sd.nr = current_thread_info()->syscall; + sd.arch = syscall_get_arch(current); + syscall_get_arguments(current, regs, args); + for (i = 0; i < 6; i++) +@@ -1427,23 +1424,23 @@ asmlinkage long syscall_trace_enter(struct pt_regs *regs, long syscall) + ret = __secure_computing(&sd); + if (ret == -1) + return ret; +- syscall = current_thread_info()->syscall; + } + #endif + + if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) + trace_sys_enter(regs, regs->regs[2]); + +- audit_syscall_entry(syscall, regs->regs[4], regs->regs[5], ++ audit_syscall_entry(current_thread_info()->syscall, ++ regs->regs[4], regs->regs[5], + regs->regs[6], regs->regs[7]); + + /* + * Negative syscall numbers are mistaken for rejected syscalls, but + * won't have had the return value set appropriately, so we do so now. + */ +- if (syscall < 0) ++ if (current_thread_info()->syscall < 0) + syscall_set_return_value(current, regs, -ENOSYS, 0); +- return syscall; ++ return current_thread_info()->syscall; + } + + /* +diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S +index b449b68662a9a..80747719a35ca 100644 +--- a/arch/mips/kernel/scall32-o32.S ++++ b/arch/mips/kernel/scall32-o32.S +@@ -80,6 +80,18 @@ loads_done: + PTR load_a7, bad_stack_a7 + .previous + ++ /* ++ * syscall number is in v0 unless we called syscall(__NR_###) ++ * where the real syscall number is in a0 ++ */ ++ subu t2, v0, __NR_O32_Linux ++ bnez t2, 1f /* __NR_syscall at offset 0 */ ++ LONG_S a0, TI_SYSCALL($28) # Save a0 as syscall number ++ b 2f ++1: ++ LONG_S v0, TI_SYSCALL($28) # Save v0 as syscall number ++2: ++ + lw t0, TI_FLAGS($28) # syscall tracing enabled? + li t1, _TIF_WORK_SYSCALL_ENTRY + and t0, t1 +@@ -117,16 +129,7 @@ syscall_trace_entry: + SAVE_STATIC + move a0, sp + +- /* +- * syscall number is in v0 unless we called syscall(__NR_###) +- * where the real syscall number is in a0 +- */ +- move a1, v0 +- subu t2, v0, __NR_O32_Linux +- bnez t2, 1f /* __NR_syscall at offset 0 */ +- lw a1, PT_R4(sp) +- +-1: jal syscall_trace_enter ++ jal syscall_trace_enter + + bltz v0, 1f # seccomp failed? Skip syscall + +diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S +index 35d8c86b160ea..a8679e34c95e3 100644 +--- a/arch/mips/kernel/scall64-n32.S ++++ b/arch/mips/kernel/scall64-n32.S +@@ -44,6 +44,8 @@ NESTED(handle_sysn32, PT_SIZE, sp) + + sd a3, PT_R26(sp) # save a3 for syscall restarting + ++ LONG_S v0, TI_SYSCALL($28) # Store syscall number ++ + li t1, _TIF_WORK_SYSCALL_ENTRY + LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? + and t0, t1, t0 +@@ -72,7 +74,6 @@ syscall_common: + n32_syscall_trace_entry: + SAVE_STATIC + move a0, sp +- move a1, v0 + jal syscall_trace_enter + + bltz v0, 1f # seccomp failed? Skip syscall +diff --git a/arch/mips/kernel/scall64-n64.S b/arch/mips/kernel/scall64-n64.S +index 23b2e2b1609cf..a3b5ab509b412 100644 +--- a/arch/mips/kernel/scall64-n64.S ++++ b/arch/mips/kernel/scall64-n64.S +@@ -47,6 +47,8 @@ NESTED(handle_sys64, PT_SIZE, sp) + + sd a3, PT_R26(sp) # save a3 for syscall restarting + ++ LONG_S v0, TI_SYSCALL($28) # Store syscall number ++ + li t1, _TIF_WORK_SYSCALL_ENTRY + LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? + and t0, t1, t0 +@@ -83,7 +85,6 @@ n64_syscall_exit: + syscall_trace_entry: + SAVE_STATIC + move a0, sp +- move a1, v0 + jal syscall_trace_enter + + bltz v0, 1f # seccomp failed? Skip syscall +diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S +index 41df8221bb8fd..d8f41e919c171 100644 +--- a/arch/mips/kernel/scall64-o32.S ++++ b/arch/mips/kernel/scall64-o32.S +@@ -79,6 +79,22 @@ loads_done: + PTR load_a7, bad_stack_a7 + .previous + ++ /* ++ * absolute syscall number is in v0 unless we called syscall(__NR_###) ++ * where the real syscall number is in a0 ++ * note: NR_syscall is the first O32 syscall but the macro is ++ * only defined when compiling with -mabi=32 (CONFIG_32BIT) ++ * therefore __NR_O32_Linux is used (4000) ++ */ ++ ++ subu t2, v0, __NR_O32_Linux ++ bnez t2, 1f /* __NR_syscall at offset 0 */ ++ LONG_S a0, TI_SYSCALL($28) # Save a0 as syscall number ++ b 2f ++1: ++ LONG_S v0, TI_SYSCALL($28) # Save v0 as syscall number ++2: ++ + li t1, _TIF_WORK_SYSCALL_ENTRY + LONG_L t0, TI_FLAGS($28) # syscall tracing enabled? + and t0, t1, t0 +@@ -113,22 +129,7 @@ trace_a_syscall: + sd a7, PT_R11(sp) # For indirect syscalls + + move a0, sp +- /* +- * absolute syscall number is in v0 unless we called syscall(__NR_###) +- * where the real syscall number is in a0 +- * note: NR_syscall is the first O32 syscall but the macro is +- * only defined when compiling with -mabi=32 (CONFIG_32BIT) +- * therefore __NR_O32_Linux is used (4000) +- */ +- .set push +- .set reorder +- subu t1, v0, __NR_O32_Linux +- move a1, v0 +- bnez t1, 1f /* __NR_syscall at offset 0 */ +- ld a1, PT_R4(sp) /* Arg1 for __NR_syscall case */ +- .set pop +- +-1: jal syscall_trace_enter ++ jal syscall_trace_enter + + bltz v0, 1f # seccomp failed? Skip syscall + +-- +2.43.0 + diff --git a/queue-5.4/net-bcmgenet-reset-rbuf-on-first-open.patch b/queue-5.4/net-bcmgenet-reset-rbuf-on-first-open.patch new file mode 100644 index 00000000000..4fa1c247f77 --- /dev/null +++ b/queue-5.4/net-bcmgenet-reset-rbuf-on-first-open.patch @@ -0,0 +1,83 @@ +From 3ed455dcdca21cded97bf1263cce32a95e7dda75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2024 13:09:33 +0200 +Subject: net: bcmgenet: Reset RBUF on first open + +From: Phil Elwell + +[ Upstream commit 0a6380cb4c6b5c1d6dad226ba3130f9090f0ccea ] + +If the RBUF logic is not reset when the kernel starts then there +may be some data left over from any network boot loader. If the +64-byte packet headers are enabled then this can be fatal. + +Extend bcmgenet_dma_disable to do perform the reset, but not when +called from bcmgenet_resume in order to preserve a wake packet. + +N.B. This different handling of resume is just based on a hunch - +why else wouldn't one reset the RBUF as well as the TBUF? If this +isn't the case then it's easy to change the patch to make the RBUF +reset unconditional. + +See: https://github.com/raspberrypi/linux/issues/3850 +See: https://github.com/raspberrypi/firmware/issues/1882 + +Signed-off-by: Phil Elwell +Signed-off-by: Maarten Vanraes +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 380bf7a328ba3..469cfc74617a6 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2796,7 +2796,7 @@ static void bcmgenet_set_hw_addr(struct bcmgenet_priv *priv, + } + + /* Returns a reusable dma control register value */ +-static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv) ++static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv, bool flush_rx) + { + unsigned int i; + u32 reg; +@@ -2821,6 +2821,14 @@ static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv) + udelay(10); + bcmgenet_umac_writel(priv, 0, UMAC_TX_FLUSH); + ++ if (flush_rx) { ++ reg = bcmgenet_rbuf_ctrl_get(priv); ++ bcmgenet_rbuf_ctrl_set(priv, reg | BIT(0)); ++ udelay(10); ++ bcmgenet_rbuf_ctrl_set(priv, reg); ++ udelay(10); ++ } ++ + return dma_ctrl; + } + +@@ -2916,8 +2924,8 @@ static int bcmgenet_open(struct net_device *dev) + + bcmgenet_set_hw_addr(priv, dev->dev_addr); + +- /* Disable RX/TX DMA and flush TX queues */ +- dma_ctrl = bcmgenet_dma_disable(priv); ++ /* Disable RX/TX DMA and flush TX and RX queues */ ++ dma_ctrl = bcmgenet_dma_disable(priv, true); + + /* Reinitialize TDMA and RDMA and SW housekeeping */ + ret = bcmgenet_init_dma(priv); +@@ -3670,7 +3678,7 @@ static int bcmgenet_resume(struct device *d) + bcmgenet_power_up(priv, GENET_POWER_WOL_MAGIC); + + /* Disable RX/TX DMA and flush TX queues */ +- dma_ctrl = bcmgenet_dma_disable(priv); ++ dma_ctrl = bcmgenet_dma_disable(priv, false); + + /* Reinitialize TDMA and RDMA and SW housekeeping */ + ret = bcmgenet_init_dma(priv); +-- +2.43.0 + diff --git a/queue-5.4/net-mark-racy-access-on-sk-sk_rcvbuf.patch b/queue-5.4/net-mark-racy-access-on-sk-sk_rcvbuf.patch new file mode 100644 index 00000000000..b5721511098 --- /dev/null +++ b/queue-5.4/net-mark-racy-access-on-sk-sk_rcvbuf.patch @@ -0,0 +1,48 @@ +From 11e5a69a77d1a1131609443f14c1e0f41fb277f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2024 16:44:10 +0800 +Subject: net: mark racy access on sk->sk_rcvbuf + +From: linke li + +[ Upstream commit c2deb2e971f5d9aca941ef13ee05566979e337a4 ] + +sk->sk_rcvbuf in __sock_queue_rcv_skb() and __sk_receive_skb() can be +changed by other threads. Mark this as benign using READ_ONCE(). + +This patch is aimed at reducing the number of benign races reported by +KCSAN in order to focus future debugging effort on harmful races. + +Signed-off-by: linke li +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index daeb0e69c71b4..2b68a93adfa8d 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -453,7 +453,7 @@ int __sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) + unsigned long flags; + struct sk_buff_head *list = &sk->sk_receive_queue; + +- if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) { ++ if (atomic_read(&sk->sk_rmem_alloc) >= READ_ONCE(sk->sk_rcvbuf)) { + atomic_inc(&sk->sk_drops); + trace_sock_rcvqueue_full(sk, skb); + return -ENOMEM; +@@ -505,7 +505,7 @@ int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, + + skb->dev = NULL; + +- if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) { ++ if (sk_rcvqueues_full(sk, READ_ONCE(sk->sk_rcvbuf))) { + atomic_inc(&sk->sk_drops); + goto discard_and_relse; + } +-- +2.43.0 + diff --git a/queue-5.4/net-usb-qmi_wwan-support-rolling-modules.patch b/queue-5.4/net-usb-qmi_wwan-support-rolling-modules.patch new file mode 100644 index 00000000000..10ee2eac3b6 --- /dev/null +++ b/queue-5.4/net-usb-qmi_wwan-support-rolling-modules.patch @@ -0,0 +1,70 @@ +From 4f6367b269cb6ea802b17d7e1031f901ba5e620e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2024 20:07:13 +0800 +Subject: net:usb:qmi_wwan: support Rolling modules + +From: Vanillan Wang + +[ Upstream commit d362046021ea122309da8c8e0b6850c792ca97b5 ] + +Update the qmi_wwan driver support for the Rolling +LTE modules. + +- VID:PID 33f8:0104, RW101-GL for laptop debug M.2 cards(with RMNET +interface for /Linux/Chrome OS) +0x0104: RMNET, diag, at, pipe + +Here are the outputs of usb-devices: +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=33f8 ProdID=0104 Rev=05.04 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling Module +S: SerialNumber=ba2eb033 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Signed-off-by: Vanillan Wang +Link: https://lore.kernel.org/r/20240416120713.24777-1-vanillanwang@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index c2bd4abce6de5..1c48d3d9522ba 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1380,6 +1380,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ + {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */ + {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */ ++ {QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */ + + /* 4. Gobi 1000 devices */ + {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ +-- +2.43.0 + diff --git a/queue-5.4/pinctrl-mediatek-fix-fallback-call-path.patch b/queue-5.4/pinctrl-mediatek-fix-fallback-call-path.patch new file mode 100644 index 00000000000..c448c29352f --- /dev/null +++ b/queue-5.4/pinctrl-mediatek-fix-fallback-call-path.patch @@ -0,0 +1,41 @@ +From cdaf991decc05273aa76307203dd784a56efbc5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Dec 2020 17:04:25 +0800 +Subject: pinctrl: mediatek: Fix fallback call path + +From: Hsin-Yi Wang + +[ Upstream commit 81bd1579b43e0e285cba667399f1b063f1ce7672 ] + +Some SoCs, eg. mt8183, are using a pinconfig operation bias_set_combo. +The fallback path in mtk_pinconf_adv_pull_set() should also try this +operation. + +Fixes: cafe19db7751 ("pinctrl: mediatek: Backward compatible to previous Mediatek's bias-pull usage") +Signed-off-by: Hsin-Yi Wang +Acked-by: Sean Wang +Link: https://lore.kernel.org/r/20201228090425.2130569-1-hsinyi@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +index 634d652aed671..5ef372e702709 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c +@@ -877,6 +877,10 @@ int mtk_pinconf_adv_pull_set(struct mtk_pinctrl *hw, + err = hw->soc->bias_set(hw, desc, pullup); + if (err) + return err; ++ } else if (hw->soc->bias_set_combo) { ++ err = hw->soc->bias_set_combo(hw, desc, pullup, arg); ++ if (err) ++ return err; + } else { + return -ENOTSUPP; + } +-- +2.43.0 + diff --git a/queue-5.4/scsi-bnx2fc-remove-spin_lock_bh-while-releasing-reso.patch b/queue-5.4/scsi-bnx2fc-remove-spin_lock_bh-while-releasing-reso.patch new file mode 100644 index 00000000000..8058336c658 --- /dev/null +++ b/queue-5.4/scsi-bnx2fc-remove-spin_lock_bh-while-releasing-reso.patch @@ -0,0 +1,86 @@ +From e2032f13e86bfb46af6fc867ee7a55680de23807 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 12:44:27 +0530 +Subject: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after + upload + +From: Saurav Kashyap + +[ Upstream commit c214ed2a4dda35b308b0b28eed804d7ae66401f9 ] + +The session resources are used by FW and driver when session is offloaded, +once session is uploaded these resources are not used. The lock is not +required as these fields won't be used any longer. The offload and upload +calls are sequential, hence lock is not required. + +This will suppress following BUG_ON(): + +[ 449.843143] ------------[ cut here ]------------ +[ 449.848302] kernel BUG at mm/vmalloc.c:2727! +[ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI +[ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1 +Rebooting. +[ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016 +[ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc] +[ 449.882910] RIP: 0010:vunmap+0x2e/0x30 +[ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41 +[ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206 +[ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005 +[ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000 +[ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf +[ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000 +[ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0 +[ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000 +[ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0 +[ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 449.993028] Call Trace: +[ 449.995756] __iommu_dma_free+0x96/0x100 +[ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc] +[ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc] +[ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc] +[ 450.018136] fc_rport_work+0x103/0x5b0 [libfc] +[ 450.023103] process_one_work+0x1e8/0x3c0 +[ 450.027581] worker_thread+0x50/0x3b0 +[ 450.031669] ? rescuer_thread+0x370/0x370 +[ 450.036143] kthread+0x149/0x170 +[ 450.039744] ? set_kthread_struct+0x40/0x40 +[ 450.044411] ret_from_fork+0x22/0x30 +[ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls +[ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler +[ 450.159753] ---[ end trace 712de2c57c64abc8 ]--- + +Reported-by: Guangwu Zhang +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Link: https://lore.kernel.org/r/20240315071427.31842-1-skashyap@marvell.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/bnx2fc_tgt.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_tgt.c b/drivers/scsi/bnx2fc/bnx2fc_tgt.c +index 50384b4a817c8..5b184c8384d05 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_tgt.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_tgt.c +@@ -834,7 +834,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, + + BNX2FC_TGT_DBG(tgt, "Freeing up session resources\n"); + +- spin_lock_bh(&tgt->cq_lock); + ctx_base_ptr = tgt->ctx_base; + tgt->ctx_base = NULL; + +@@ -890,7 +889,6 @@ static void bnx2fc_free_session_resc(struct bnx2fc_hba *hba, + tgt->sq, tgt->sq_dma); + tgt->sq = NULL; + } +- spin_unlock_bh(&tgt->cq_lock); + + if (ctx_base_ptr) + iounmap(ctx_base_ptr); +-- +2.43.0 + diff --git a/queue-5.4/scsi-lpfc-update-lpfc_ramp_down_queue_handler-logic.patch b/queue-5.4/scsi-lpfc-update-lpfc_ramp_down_queue_handler-logic.patch new file mode 100644 index 00000000000..d0910eb9750 --- /dev/null +++ b/queue-5.4/scsi-lpfc-update-lpfc_ramp_down_queue_handler-logic.patch @@ -0,0 +1,92 @@ +From c2c8a281316f494912f265dc005ac99745a61d21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 12:04:55 -0800 +Subject: scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic + +From: Justin Tee + +[ Upstream commit bb011631435c705cdeddca68d5c85fd40a4320f9 ] + +Typically when an out of resource CQE status is detected, the +lpfc_ramp_down_queue_handler() logic is called to help reduce I/O load by +reducing an sdev's queue_depth. + +However, the current lpfc_rampdown_queue_depth() logic does not help reduce +queue_depth. num_cmd_success is never updated and is always zero, which +means new_queue_depth will always be set to sdev->queue_depth. So, +new_queue_depth = sdev->queue_depth - new_queue_depth always sets +new_queue_depth to zero. And, scsi_change_queue_depth(sdev, 0) is +essentially a no-op. + +Change the lpfc_ramp_down_queue_handler() logic to set new_queue_depth +equal to sdev->queue_depth subtracted from number of times num_rsrc_err was +incremented. If num_rsrc_err is >= sdev->queue_depth, then set +new_queue_depth equal to 1. Eventually, the frequency of Good_Status +frames will signal SCSI upper layer to auto increase the queue_depth back +to the driver default of 64 via scsi_handle_queue_ramp_up(). + +Signed-off-by: Justin Tee +Link: https://lore.kernel.org/r/20240305200503.57317-5-justintee8345@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc.h | 1 - + drivers/scsi/lpfc/lpfc_scsi.c | 13 ++++--------- + 2 files changed, 4 insertions(+), 10 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index 7ce0d94cdc018..98ab07c3774ed 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -1039,7 +1039,6 @@ struct lpfc_hba { + unsigned long bit_flags; + #define FABRIC_COMANDS_BLOCKED 0 + atomic_t num_rsrc_err; +- atomic_t num_cmd_success; + unsigned long last_rsrc_error_time; + unsigned long last_ramp_down_time; + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index 816235ccd2992..f238e0f41f07c 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -246,11 +246,10 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba) + struct Scsi_Host *shost; + struct scsi_device *sdev; + unsigned long new_queue_depth; +- unsigned long num_rsrc_err, num_cmd_success; ++ unsigned long num_rsrc_err; + int i; + + num_rsrc_err = atomic_read(&phba->num_rsrc_err); +- num_cmd_success = atomic_read(&phba->num_cmd_success); + + /* + * The error and success command counters are global per +@@ -265,20 +264,16 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba) + for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) { + shost = lpfc_shost_from_vport(vports[i]); + shost_for_each_device(sdev, shost) { +- new_queue_depth = +- sdev->queue_depth * num_rsrc_err / +- (num_rsrc_err + num_cmd_success); +- if (!new_queue_depth) +- new_queue_depth = sdev->queue_depth - 1; ++ if (num_rsrc_err >= sdev->queue_depth) ++ new_queue_depth = 1; + else + new_queue_depth = sdev->queue_depth - +- new_queue_depth; ++ num_rsrc_err; + scsi_change_queue_depth(sdev, new_queue_depth); + } + } + lpfc_destroy_vport_work_array(phba, vports); + atomic_set(&phba->num_rsrc_err, 0); +- atomic_set(&phba->num_cmd_success, 0); + } + + /** +-- +2.43.0 + diff --git a/queue-5.4/scsi-target-fix-selinux-error-when-systemd-modules-l.patch b/queue-5.4/scsi-target-fix-selinux-error-when-systemd-modules-l.patch new file mode 100644 index 00000000000..e0cb0cc734b --- /dev/null +++ b/queue-5.4/scsi-target-fix-selinux-error-when-systemd-modules-l.patch @@ -0,0 +1,68 @@ +From 01858cda67563c536a6b5b7b9be341a6e0e6c277 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 15:39:43 +0100 +Subject: scsi: target: Fix SELinux error when systemd-modules loads the target + module + +From: Maurizio Lombardi + +[ Upstream commit 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779 ] + +If the systemd-modules service loads the target module, the credentials of +that userspace process will be used to validate the access to the target db +directory. SELinux will prevent it, reporting an error like the following: + +kernel: audit: type=1400 audit(1676301082.205:4): avc: denied { read } +for pid=1020 comm="systemd-modules" name="target" dev="dm-3" +ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0 +tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0 + +Fix the error by using the kernel credentials to access the db directory + +Signed-off-by: Maurizio Lombardi +Link: https://lore.kernel.org/r/20240215143944.847184-2-mlombard@redhat.com +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_configfs.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c +index e6e1755978602..4edabab65b879 100644 +--- a/drivers/target/target_core_configfs.c ++++ b/drivers/target/target_core_configfs.c +@@ -3458,6 +3458,8 @@ static int __init target_core_init_configfs(void) + { + struct configfs_subsystem *subsys = &target_core_fabrics; + struct t10_alua_lu_gp *lu_gp; ++ struct cred *kern_cred; ++ const struct cred *old_cred; + int ret; + + pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage" +@@ -3534,11 +3536,21 @@ static int __init target_core_init_configfs(void) + if (ret < 0) + goto out; + ++ /* We use the kernel credentials to access the target directory */ ++ kern_cred = prepare_kernel_cred(&init_task); ++ if (!kern_cred) { ++ ret = -ENOMEM; ++ goto out; ++ } ++ old_cred = override_creds(kern_cred); + target_init_dbroot(); ++ revert_creds(old_cred); ++ put_cred(kern_cred); + + return 0; + + out: ++ target_xcopy_release_pt(); + configfs_unregister_subsystem(subsys); + core_dev_release_virtual_lun0(); + rd_module_exit(); +-- +2.43.0 + diff --git a/queue-5.4/selftests-timers-fix-valid-adjtimex-signed-left-shif.patch b/queue-5.4/selftests-timers-fix-valid-adjtimex-signed-left-shif.patch new file mode 100644 index 00000000000..05a85652c7f --- /dev/null +++ b/queue-5.4/selftests-timers-fix-valid-adjtimex-signed-left-shif.patch @@ -0,0 +1,139 @@ +From 46cf48f0277e4e7f595965b37dc51e771a0dad81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Apr 2024 13:22:12 -0700 +Subject: selftests: timers: Fix valid-adjtimex signed left-shift undefined + behavior + +From: John Stultz + +[ Upstream commit 076361362122a6d8a4c45f172ced5576b2d4a50d ] + +The struct adjtimex freq field takes a signed value who's units are in +shifted (<<16) parts-per-million. + +Unfortunately for negative adjustments, the straightforward use of: + + freq = ppm << 16 trips undefined behavior warnings with clang: + +valid-adjtimex.c:66:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value] + -499<<16, + ~~~~^ +valid-adjtimex.c:67:6: warning: shifting a negative signed value is undefined [-Wshift-negative-value] + -450<<16, + ~~~~^ +.. + +Fix it by using a multiply by (1 << 16) instead of shifting negative values +in the valid-adjtimex test case. Align the values for better readability. + +Reported-by: Lee Jones +Reported-by: Muhammad Usama Anjum +Signed-off-by: John Stultz +Signed-off-by: Thomas Gleixner +Reviewed-by: Muhammad Usama Anjum +Link: https://lore.kernel.org/r/20240409202222.2830476-1-jstultz@google.com +Link: https://lore.kernel.org/lkml/0c6d4f0d-2064-4444-986b-1d1ed782135f@collabora.com/ +Signed-off-by: Sasha Levin +--- + .../testing/selftests/timers/valid-adjtimex.c | 73 +++++++++---------- + 1 file changed, 36 insertions(+), 37 deletions(-) + +diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testing/selftests/timers/valid-adjtimex.c +index 48b9a803235a8..d13ebde203221 100644 +--- a/tools/testing/selftests/timers/valid-adjtimex.c ++++ b/tools/testing/selftests/timers/valid-adjtimex.c +@@ -21,9 +21,6 @@ + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ +- +- +- + #include + #include + #include +@@ -62,45 +59,47 @@ int clear_time_state(void) + #define NUM_FREQ_OUTOFRANGE 4 + #define NUM_FREQ_INVALID 2 + ++#define SHIFTED_PPM (1 << 16) ++ + long valid_freq[NUM_FREQ_VALID] = { +- -499<<16, +- -450<<16, +- -400<<16, +- -350<<16, +- -300<<16, +- -250<<16, +- -200<<16, +- -150<<16, +- -100<<16, +- -75<<16, +- -50<<16, +- -25<<16, +- -10<<16, +- -5<<16, +- -1<<16, ++ -499 * SHIFTED_PPM, ++ -450 * SHIFTED_PPM, ++ -400 * SHIFTED_PPM, ++ -350 * SHIFTED_PPM, ++ -300 * SHIFTED_PPM, ++ -250 * SHIFTED_PPM, ++ -200 * SHIFTED_PPM, ++ -150 * SHIFTED_PPM, ++ -100 * SHIFTED_PPM, ++ -75 * SHIFTED_PPM, ++ -50 * SHIFTED_PPM, ++ -25 * SHIFTED_PPM, ++ -10 * SHIFTED_PPM, ++ -5 * SHIFTED_PPM, ++ -1 * SHIFTED_PPM, + -1000, +- 1<<16, +- 5<<16, +- 10<<16, +- 25<<16, +- 50<<16, +- 75<<16, +- 100<<16, +- 150<<16, +- 200<<16, +- 250<<16, +- 300<<16, +- 350<<16, +- 400<<16, +- 450<<16, +- 499<<16, ++ 1 * SHIFTED_PPM, ++ 5 * SHIFTED_PPM, ++ 10 * SHIFTED_PPM, ++ 25 * SHIFTED_PPM, ++ 50 * SHIFTED_PPM, ++ 75 * SHIFTED_PPM, ++ 100 * SHIFTED_PPM, ++ 150 * SHIFTED_PPM, ++ 200 * SHIFTED_PPM, ++ 250 * SHIFTED_PPM, ++ 300 * SHIFTED_PPM, ++ 350 * SHIFTED_PPM, ++ 400 * SHIFTED_PPM, ++ 450 * SHIFTED_PPM, ++ 499 * SHIFTED_PPM, + }; + + long outofrange_freq[NUM_FREQ_OUTOFRANGE] = { +- -1000<<16, +- -550<<16, +- 550<<16, +- 1000<<16, ++ -1000 * SHIFTED_PPM, ++ -550 * SHIFTED_PPM, ++ 550 * SHIFTED_PPM, ++ 1000 * SHIFTED_PPM, + }; + + #define LONG_MAX (~0UL>>1) +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 588f90d81bf..a5e7da28374 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -33,3 +33,32 @@ clk-sunxi-ng-add-support-for-the-allwinner-a100-ccu.patch clk-sunxi-ng-add-support-for-the-allwinner-h616-ccu.patch clk-sunxi-ng-unregister-clocks-resets-when-unbinding.patch clk-sunxi-ng-h6-reparent-cpux-during-pll-cpux-rate-c.patch +scsi-lpfc-update-lpfc_ramp_down_queue_handler-logic.patch +gfs2-fix-invalid-metadata-access-in-punch_hole.patch +wifi-mac80211-fix-ieee80211_bss_-_flags-kernel-doc.patch +wifi-cfg80211-fix-rdev_dump_mpp-arguments-order.patch +net-mark-racy-access-on-sk-sk_rcvbuf.patch +scsi-bnx2fc-remove-spin_lock_bh-while-releasing-reso.patch +alsa-line6-zero-initialize-message-buffers.patch +net-bcmgenet-reset-rbuf-on-first-open.patch +ata-sata_gemini-check-clk_enable-result.patch +firewire-ohci-mask-bus-reset-interrupts-between-isr-.patch +tools-power-turbostat-fix-added-raw-msr-output.patch +tools-power-turbostat-fix-bzy_mhz-documentation-typo.patch +btrfs-make-btrfs_clear_delalloc_extent-free-delalloc.patch +btrfs-always-clear-pertrans-metadata-during-commit.patch +scsi-target-fix-selinux-error-when-systemd-modules-l.patch +gpu-host1x-do-not-setup-dma-for-virtual-devices.patch +mips-scall-save-thread_info.syscall-unconditionally-.patch +selftests-timers-fix-valid-adjtimex-signed-left-shif.patch +fs-9p-only-translate-rwx-permissions-for-plain-9p200.patch +fs-9p-translate-o_trunc-into-otrunc.patch +9p-explicitly-deny-setlease-attempts.patch +gpio-wcove-use-enotsupp-consistently.patch +gpio-crystalcove-use-enotsupp-consistently.patch +clk-don-t-hold-prepare_lock-when-calling-kref_put.patch +fs-9p-drop-inodes-immediately-on-non-.l-too.patch +net-usb-qmi_wwan-support-rolling-modules.patch +pinctrl-mediatek-fix-fallback-call-path.patch +asoc-meson-axg-card-fix-nonatomic-links.patch +asoc-meson-axg-tdm-interface-fix-formatters-in-trigg.patch diff --git a/queue-5.4/tools-power-turbostat-fix-added-raw-msr-output.patch b/queue-5.4/tools-power-turbostat-fix-added-raw-msr-output.patch new file mode 100644 index 00000000000..9c1a5953554 --- /dev/null +++ b/queue-5.4/tools-power-turbostat-fix-added-raw-msr-output.patch @@ -0,0 +1,87 @@ +From 42e9feef8c3b944a148f912d1906d4212de195ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 14:11:38 -0700 +Subject: tools/power turbostat: Fix added raw MSR output + +From: Doug Smythies + +[ Upstream commit e5f4e68eed85fa8495d78cd966eecc2b27bb9e53 ] + +When using --Summary mode, added MSRs in raw mode always +print zeros. Print the actual register contents. + +Example, with patch: + +note the added column: +--add msr0x64f,u32,package,raw,REASON + +Where: + +0x64F is MSR_CORE_PERF_LIMIT_REASONS + +Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON +0.00 4800 35 1.42 0.76 0x00000000 +0.00 4801 34 1.42 0.76 0x00000000 +80.08 4531 66 108.17 107.52 0x08000000 +98.69 4530 66 133.21 132.54 0x08000000 +99.28 4505 66 128.26 127.60 0x0c000400 +99.65 4486 68 124.91 124.25 0x0c000400 +99.63 4483 68 124.90 124.25 0x0c000400 +79.34 4481 41 99.80 99.13 0x0c000000 +0.00 4801 41 1.40 0.73 0x0c000000 + +Where, for the test processor (i5-10600K): + +PKG Limit #1: 125.000 Watts, 8.000000 sec +MSR bit 26 = log; bit 10 = status + +PKG Limit #2: 136.000 Watts, 0.002441 sec +MSR bit 27 = log; bit 11 = status + +Example, without patch: + +Busy% Bzy_MHz PkgTmp PkgWatt CorWatt REASON +0.01 4800 35 1.43 0.77 0x00000000 +0.00 4801 35 1.39 0.73 0x00000000 +83.49 4531 66 112.71 112.06 0x00000000 +98.69 4530 68 133.35 132.69 0x00000000 +99.31 4500 67 127.96 127.30 0x00000000 +99.63 4483 69 124.91 124.25 0x00000000 +99.61 4481 69 124.90 124.25 0x00000000 +99.61 4481 71 124.92 124.25 0x00000000 +59.35 4479 42 75.03 74.37 0x00000000 +0.00 4800 42 1.39 0.73 0x00000000 +0.00 4801 42 1.42 0.76 0x00000000 + +c000000 + +[lenb: simplified patch to apply only to package scope] + +Signed-off-by: Doug Smythies +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index d4235d1ab912c..8a366b1d1dd91 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -1571,9 +1571,10 @@ int sum_counters(struct thread_data *t, struct core_data *c, + average.packages.rapl_dram_perf_status += p->rapl_dram_perf_status; + + for (i = 0, mp = sys.pp; mp; i++, mp = mp->next) { +- if (mp->format == FORMAT_RAW) +- continue; +- average.packages.counter[i] += p->counter[i]; ++ if ((mp->format == FORMAT_RAW) && (topo.num_packages == 0)) ++ average.packages.counter[i] = p->counter[i]; ++ else ++ average.packages.counter[i] += p->counter[i]; + } + return 0; + } +-- +2.43.0 + diff --git a/queue-5.4/tools-power-turbostat-fix-bzy_mhz-documentation-typo.patch b/queue-5.4/tools-power-turbostat-fix-bzy_mhz-documentation-typo.patch new file mode 100644 index 00000000000..ae17e58f163 --- /dev/null +++ b/queue-5.4/tools-power-turbostat-fix-bzy_mhz-documentation-typo.patch @@ -0,0 +1,35 @@ +From 9675bb2c654224739537ca2196ef70b66551dd84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Oct 2023 13:46:22 +0800 +Subject: tools/power turbostat: Fix Bzy_MHz documentation typo + +From: Peng Liu + +[ Upstream commit 0b13410b52c4636aacb6964a4253a797c0fa0d16 ] + +The code calculates Bzy_MHz by multiplying TSC_delta * APERF_delta/MPERF_delta +The man page erroneously showed that TSC_delta was divided. + +Signed-off-by: Peng Liu +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.8 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8 +index a6db83a88e852..25a560c41321d 100644 +--- a/tools/power/x86/turbostat/turbostat.8 ++++ b/tools/power/x86/turbostat/turbostat.8 +@@ -318,7 +318,7 @@ below the processor's base frequency. + + Busy% = MPERF_delta/TSC_delta + +-Bzy_MHz = TSC_delta/APERF_delta/MPERF_delta/measurement_interval ++Bzy_MHz = TSC_delta*APERF_delta/MPERF_delta/measurement_interval + + Note that these calculations depend on TSC_delta, so they + are not reliable during intervals when TSC_MHz is not running at the base frequency. +-- +2.43.0 + diff --git a/queue-5.4/wifi-cfg80211-fix-rdev_dump_mpp-arguments-order.patch b/queue-5.4/wifi-cfg80211-fix-rdev_dump_mpp-arguments-order.patch new file mode 100644 index 00000000000..c31c54ea586 --- /dev/null +++ b/queue-5.4/wifi-cfg80211-fix-rdev_dump_mpp-arguments-order.patch @@ -0,0 +1,38 @@ +From 02929230587ce2cbd76767a9ef4dd4ed9da360d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 19:45:19 +0300 +Subject: wifi: cfg80211: fix rdev_dump_mpp() arguments order + +From: Igor Artemiev + +[ Upstream commit ec50f3114e55406a1aad24b7dfaa1c3f4336d8eb ] + +Fix the order of arguments in the TP_ARGS macro +for the rdev_dump_mpp tracepoint event. + +Found by Linux Verification Center (linuxtesting.org). + +Signed-off-by: Igor Artemiev +Link: https://msgid.link/20240311164519.118398-1-Igor.A.Artemiev@mcst.ru +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/trace.h b/net/wireless/trace.h +index 8677d7ab7d692..630b72355ebb5 100644 +--- a/net/wireless/trace.h ++++ b/net/wireless/trace.h +@@ -938,7 +938,7 @@ TRACE_EVENT(rdev_get_mpp, + TRACE_EVENT(rdev_dump_mpp, + TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, int _idx, + u8 *dst, u8 *mpp), +- TP_ARGS(wiphy, netdev, _idx, mpp, dst), ++ TP_ARGS(wiphy, netdev, _idx, dst, mpp), + TP_STRUCT__entry( + WIPHY_ENTRY + NETDEV_ENTRY +-- +2.43.0 + diff --git a/queue-5.4/wifi-mac80211-fix-ieee80211_bss_-_flags-kernel-doc.patch b/queue-5.4/wifi-mac80211-fix-ieee80211_bss_-_flags-kernel-doc.patch new file mode 100644 index 00000000000..b4892588230 --- /dev/null +++ b/queue-5.4/wifi-mac80211-fix-ieee80211_bss_-_flags-kernel-doc.patch @@ -0,0 +1,49 @@ +From 0fa5701914d3d261184b4c5d506d2c9a16707a60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 14:23:00 -0700 +Subject: wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc + +From: Jeff Johnson + +[ Upstream commit 774f8841f55d7ac4044c79812691649da203584a ] + +Running kernel-doc on ieee80211_i.h flagged the following: +net/mac80211/ieee80211_i.h:145: warning: expecting prototype for enum ieee80211_corrupt_data_flags. Prototype was for enum ieee80211_bss_corrupt_data_flags instead +net/mac80211/ieee80211_i.h:162: warning: expecting prototype for enum ieee80211_valid_data_flags. Prototype was for enum ieee80211_bss_valid_data_flags instead + +Fix these warnings. + +Signed-off-by: Jeff Johnson +Reviewed-by: Simon Horman +Link: https://msgid.link/20240314-kdoc-ieee80211_i-v1-1-72b91b55b257@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/ieee80211_i.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 3b7151501b3ed..e26368fab65d6 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -110,7 +110,7 @@ struct ieee80211_bss { + }; + + /** +- * enum ieee80211_corrupt_data_flags - BSS data corruption flags ++ * enum ieee80211_bss_corrupt_data_flags - BSS data corruption flags + * @IEEE80211_BSS_CORRUPT_BEACON: last beacon frame received was corrupted + * @IEEE80211_BSS_CORRUPT_PROBE_RESP: last probe response received was corrupted + * +@@ -123,7 +123,7 @@ enum ieee80211_bss_corrupt_data_flags { + }; + + /** +- * enum ieee80211_valid_data_flags - BSS valid data flags ++ * enum ieee80211_bss_valid_data_flags - BSS valid data flags + * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE + * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE + * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE +-- +2.43.0 +